Edit tour

Windows Analysis Report
2zdult23rz.exe

Overview

General Information

Sample name:	2zdult23rz.exe renamed because original name is a hash value
Original sample name:	733c1261cf02626f2354e6339baa6717.exe
Analysis ID:	1434701
MD5:	733c1261cf02626f2354e6339baa6717
SHA1:	c9e3599e1d7983fa7439bf2ff122fd7e51a59b93
SHA256:	a14041622d7d427f0b7ea24efaa7e80a3b025c211273ce0914ee34b5e71bc8c4
Tags:	exe
Infos:

Detection

RisePro Stealer

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Antivirus detection for dropped file

Detected unpacking (changes PE section rights)

Detected unpacking (overwrites its own PE header)

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for dropped file

Multi AV Scanner detection for submitted file

Snort IDS alert for network traffic

Yara detected RisePro Stealer

Connects to many ports of the same IP (likely port scanning)

Contains functionality to inject threads in other processes

Found API chain indicative of sandbox detection

Found evasive API chain (may stop execution after reading information in the PEB, e.g. number of processors)

Machine Learning detection for dropped file

Machine Learning detection for sample

Uses schtasks.exe or at.exe to add and modify task schedules

AV process strings found (often used to terminate AV products)

Checks if the current process is being debugged

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to check if a debugger is running (OutputDebugString,GetLastError)

Contains functionality to detect sandboxes (mouse cursor move detection)

Contains functionality to dynamically determine API calls

Contains functionality to query CPU information (cpuid)

Contains functionality to query locales information (e.g. system language)

Contains functionality to read the PEB

Contains functionality to record screenshots

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Detected TCP or UDP traffic on non-standard ports

Detected potential crypto function

Drops PE files

Drops PE files to the application program directory (C:\ProgramData)

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Found decision node followed by non-executed suspicious APIs

Found evasive API chain (date check)

Found potential string decryption / allocating functions

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May check the online IP address of the machine

May sleep (evasive loops) to hinder dynamic analysis

One or more processes crash

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sample file is different than original file name gathered from version info

Sigma detected: CurrentVersion Autorun Keys Modification

Uses 32bit PE files

Uses Microsoft's Enhanced Cryptographic Provider

Uses a known web browser user agent for HTTP communication

Uses code obfuscation techniques (call, push, ret)

Uses the system / local time for branch decision (may execute only at specific dates)

Yara signature match

Classification

Process Tree

System is w10x64

2zdult23rz.exe (PID: 1948 cmdline: "C:\Users\user\Desktop\2zdult23rz.exe" MD5: 733C1261CF02626F2354E6339BAA6717)

schtasks.exe (PID: 2224 cmdline: schtasks /create /f /RU "user" /tr "C:\ProgramData\MPGPH131\MPGPH131.exe" /tn "MPGPH131 HR" /sc HOURLY /rl HIGHEST MD5: 48C2FE20575769DE916F48EF0676A965)

conhost.exe (PID: 5964 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

schtasks.exe (PID: 7152 cmdline: schtasks /create /f /RU "user" /tr "C:\ProgramData\MPGPH131\MPGPH131.exe" /tn "MPGPH131 LG" /sc ONLOGON /rl HIGHEST MD5: 48C2FE20575769DE916F48EF0676A965)

conhost.exe (PID: 5980 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

WerFault.exe (PID: 5392 cmdline: C:\Windows\SysWOW64\WerFault.exe -u -p 1948 -s 860 MD5: C31336C1EFC2CCB44B4326EA793040F2)

WerFault.exe (PID: 1120 cmdline: C:\Windows\SysWOW64\WerFault.exe -u -p 1948 -s 956 MD5: C31336C1EFC2CCB44B4326EA793040F2)

WerFault.exe (PID: 3880 cmdline: C:\Windows\SysWOW64\WerFault.exe -u -p 1948 -s 956 MD5: C31336C1EFC2CCB44B4326EA793040F2)

WerFault.exe (PID: 6452 cmdline: C:\Windows\SysWOW64\WerFault.exe -u -p 1948 -s 972 MD5: C31336C1EFC2CCB44B4326EA793040F2)

MPGPH131.exe (PID: 6080 cmdline: C:\ProgramData\MPGPH131\MPGPH131.exe MD5: 733C1261CF02626F2354E6339BAA6717)

WerFault.exe (PID: 1880 cmdline: C:\Windows\SysWOW64\WerFault.exe -u -p 6080 -s 800 MD5: C31336C1EFC2CCB44B4326EA793040F2)

WerFault.exe (PID: 4876 cmdline: C:\Windows\SysWOW64\WerFault.exe -u -p 6080 -s 896 MD5: C31336C1EFC2CCB44B4326EA793040F2)

WerFault.exe (PID: 5584 cmdline: C:\Windows\SysWOW64\WerFault.exe -u -p 6080 -s 928 MD5: C31336C1EFC2CCB44B4326EA793040F2)

MPGPH131.exe (PID: 2996 cmdline: C:\ProgramData\MPGPH131\MPGPH131.exe MD5: 733C1261CF02626F2354E6339BAA6717)

WerFault.exe (PID: 6060 cmdline: C:\Windows\SysWOW64\WerFault.exe -u -p 2996 -s 776 MD5: C31336C1EFC2CCB44B4326EA793040F2)

WerFault.exe (PID: 5980 cmdline: C:\Windows\SysWOW64\WerFault.exe -u -p 2996 -s 888 MD5: C31336C1EFC2CCB44B4326EA793040F2)

WerFault.exe (PID: 4816 cmdline: C:\Windows\SysWOW64\WerFault.exe -u -p 2996 -s 888 MD5: C31336C1EFC2CCB44B4326EA793040F2)

RageMP131.exe (PID: 5092 cmdline: "C:\Users\user\AppData\Local\RageMP131\RageMP131.exe" MD5: 733C1261CF02626F2354E6339BAA6717)

WerFault.exe (PID: 6656 cmdline: C:\Windows\SysWOW64\WerFault.exe -u -p 5092 -s 812 MD5: C31336C1EFC2CCB44B4326EA793040F2)

WerFault.exe (PID: 7068 cmdline: C:\Windows\SysWOW64\WerFault.exe -u -p 5092 -s 956 MD5: C31336C1EFC2CCB44B4326EA793040F2)

RageMP131.exe (PID: 6024 cmdline: "C:\Users\user\AppData\Local\RageMP131\RageMP131.exe" MD5: 733C1261CF02626F2354E6339BAA6717)

WerFault.exe (PID: 6924 cmdline: C:\Windows\SysWOW64\WerFault.exe -u -p 6024 -s 792 MD5: C31336C1EFC2CCB44B4326EA793040F2)

cleanup

Yara Signatures

Memory Dumps

Source	Rule	Description	Author	Strings
00000009.00000002.3356779154.0000000005DF5000.00000040.00000020.00020000.00000000.sdmp	Windows_Trojan_RedLineStealer_ed346e4c	unknown	unknown	0x798:$a: 55 8B EC 8B 45 14 56 57 8B 7D 08 33 F6 89 47 0C 39 75 10 76 15 8B
0000000A.00000002.3356453066.0000000005C1A000.00000040.00000020.00020000.00000000.sdmp	Windows_Trojan_RedLineStealer_ed346e4c	unknown	unknown	0x798:$a: 55 8B EC 8B 45 14 56 57 8B 7D 08 33 F6 89 47 0C 39 75 10 76 15 8B
00000018.00000002.3357697042.0000000005D4D000.00000040.00000020.00020000.00000000.sdmp	Windows_Trojan_RedLineStealer_ed346e4c	unknown	unknown	0x798:$a: 55 8B EC 8B 45 14 56 57 8B 7D 08 33 F6 89 47 0C 39 75 10 76 15 8B
00000000.00000002.3357800955.0000000005CC3000.00000040.00000020.00020000.00000000.sdmp	Windows_Trojan_RedLineStealer_ed346e4c	unknown	unknown	0x798:$a: 55 8B EC 8B 45 14 56 57 8B 7D 08 33 F6 89 47 0C 39 75 10 76 15 8B
0000000A.00000002.3356718132.0000000005F10000.00000040.00001000.00020000.00000000.sdmp	Windows_Trojan_Smokeloader_3687686f	unknown	unknown	0x30d:$a: 0C 8B 45 F0 89 45 C8 8B 45 C8 8B 40 3C 8B 4D F0 8D 44 01 04 89
00000009.00000002.3357144489.0000000005F90000.00000040.00001000.00020000.00000000.sdmp	Windows_Trojan_Smokeloader_3687686f	unknown	unknown	0x30d:$a: 0C 8B 45 F0 89 45 C8 8B 45 C8 8B 40 3C 8B 4D F0 8D 44 01 04 89
00000010.00000002.3356388466.0000000005CCC000.00000040.00000020.00020000.00000000.sdmp	Windows_Trojan_RedLineStealer_ed346e4c	unknown	unknown	0x798:$a: 55 8B EC 8B 45 14 56 57 8B 7D 08 33 F6 89 47 0C 39 75 10 76 15 8B
00000010.00000002.3356555753.0000000005DA0000.00000040.00001000.00020000.00000000.sdmp	Windows_Trojan_Smokeloader_3687686f	unknown	unknown	0x30d:$a: 0C 8B 45 F0 89 45 C8 8B 45 C8 8B 40 3C 8B 4D F0 8D 44 01 04 89
00000018.00000002.3357977475.0000000005EE0000.00000040.00001000.00020000.00000000.sdmp	Windows_Trojan_Smokeloader_3687686f	unknown	unknown	0x30d:$a: 0C 8B 45 F0 89 45 C8 8B 45 C8 8B 40 3C 8B 4D F0 8D 44 01 04 89
00000000.00000002.3357963980.0000000005E90000.00000040.00001000.00020000.00000000.sdmp	Windows_Trojan_Smokeloader_3687686f	unknown	unknown	0x30d:$a: 0C 8B 45 F0 89 45 C8 8B 45 C8 8B 40 3C 8B 4D F0 8D 44 01 04 89
Process Memory Space: 2zdult23rz.exe PID: 1948	JoeSecurity_RiseProStealer	Yara detected RisePro Stealer	Joe Security
Process Memory Space: MPGPH131.exe PID: 6080	JoeSecurity_RiseProStealer	Yara detected RisePro Stealer	Joe Security
Process Memory Space: MPGPH131.exe PID: 2996	JoeSecurity_RiseProStealer	Yara detected RisePro Stealer	Joe Security
Process Memory Space: RageMP131.exe PID: 5092	JoeSecurity_RiseProStealer	Yara detected RisePro Stealer	Joe Security
Process Memory Space: RageMP131.exe PID: 6024	JoeSecurity_RiseProStealer	Yara detected RisePro Stealer	Joe Security
Click to see the 10 entries

Sigma Signatures

System Summary

Sigma detected: CurrentVersion Autorun Keys Modification

Source: Registry Key set

Author: Victor Sergeev, Daniil Yugoslavskiy, Gleb Sukhodolskiy, Timur Zinniatullin, oscd.community, Tim Shelton, frack113 (split): Data: Details: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe, EventID: 13, EventType: SetValue, Image: C:\Users\user\Desktop\2zdult23rz.exe, ProcessId: 1948, TargetObject: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\RageMP131

Snort Signatures

ET TROJAN [ANY.RUN] RisePro TCP (External IP) - Source IP: 147.45.47.93 - Destination IP: 192.168.2.6

Timestamp:	05/01/24-16:40:33.992588
SID:	2046267
Source Port:	58709
Destination Port:	49700
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN [ANY.RUN] RisePro TCP (Token) - Source IP: 147.45.47.93 - Destination IP: 192.168.2.6

Timestamp:	05/01/24-16:40:18.542503
SID:	2046266
Source Port:	58709
Destination Port:	49700
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN [ANY.RUN] RisePro TCP (External IP) - Source IP: 147.45.47.93 - Destination IP: 192.168.2.6

Timestamp:	05/01/24-16:40:34.007377
SID:	2046267
Source Port:	58709
Destination Port:	49701
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN [ANY.RUN] RisePro TCP (Activity) - Source IP: 192.168.2.6 - Destination IP: 147.45.47.93

Timestamp:	05/01/24-16:42:16.940552
SID:	2046269
Source Port:	49701
Destination Port:	58709
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN [ANY.RUN] RisePro TCP (Token) - Source IP: 147.45.47.93 - Destination IP: 192.168.2.6

Timestamp:	05/01/24-16:40:19.140548
SID:	2046266
Source Port:	58709
Destination Port:	49701
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN RisePro TCP Heartbeat Packet - Source IP: 192.168.2.6 - Destination IP: 147.45.47.93

Timestamp:	05/01/24-16:40:13.617057
SID:	2049060
Source Port:	49699
Destination Port:	58709
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN [ANY.RUN] RisePro TCP (Activity) - Source IP: 192.168.2.6 - Destination IP: 147.45.47.93

Timestamp:	05/01/24-16:42:16.940639
SID:	2046269
Source Port:	49711
Destination Port:	58709
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN [ANY.RUN] RisePro TCP (Activity) - Source IP: 192.168.2.6 - Destination IP: 147.45.47.93

Timestamp:	05/01/24-16:42:16.940554
SID:	2046269
Source Port:	49700
Destination Port:	58709
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN [ANY.RUN] RisePro TCP (External IP) - Source IP: 147.45.47.93 - Destination IP: 192.168.2.6

Timestamp:	05/01/24-16:40:33.711799
SID:	2046267
Source Port:	58709
Destination Port:	49699
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN [ANY.RUN] RisePro TCP (Token) - Source IP: 147.45.47.93 - Destination IP: 192.168.2.6

Timestamp:	05/01/24-16:40:13.812784
SID:	2046266
Source Port:	58709
Destination Port:	49699
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN [ANY.RUN] RisePro TCP (Token) - Source IP: 147.45.47.93 - Destination IP: 192.168.2.6

Timestamp:	05/01/24-16:40:31.596033
SID:	2046266
Source Port:	58709
Destination Port:	49709
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN [ANY.RUN] RisePro TCP (External IP) - Source IP: 147.45.47.93 - Destination IP: 192.168.2.6

Timestamp:	05/01/24-16:40:34.194330
SID:	2046267
Source Port:	58709
Destination Port:	49709
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN [ANY.RUN] RisePro TCP (Token) - Source IP: 147.45.47.93 - Destination IP: 192.168.2.6

Timestamp:	05/01/24-16:40:48.719023
SID:	2046266
Source Port:	58709
Destination Port:	49711
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN [ANY.RUN] RisePro TCP (Activity) - Source IP: 192.168.2.6 - Destination IP: 147.45.47.93

Timestamp:	05/01/24-16:42:16.940722
SID:	2046269
Source Port:	49709
Destination Port:	58709
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN [ANY.RUN] RisePro TCP (Activity) - Source IP: 192.168.2.6 - Destination IP: 147.45.47.93

Timestamp:	05/01/24-16:42:16.940631
SID:	2046269
Source Port:	49699
Destination Port:	58709
Protocol:	TCP
Classtype:	A Network Trojan was detected

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: 2zdult23rz.exe

Avira: detected

Antivirus detection for dropped file

Source: C:\ProgramData\MPGPH131\MPGPH131.exe

Avira: detection malicious, Label: HEUR/AGEN.1313019

Multi AV Scanner detection for dropped file

Source: C:\ProgramData\MPGPH131\MPGPH131.exe	ReversingLabs: Detection: 81%
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Virustotal: Detection: 77%	Perma Link
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	ReversingLabs: Detection: 81%
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Virustotal: Detection: 77%	Perma Link

Multi AV Scanner detection for submitted file

Source: 2zdult23rz.exe	ReversingLabs: Detection: 81%
Source: 2zdult23rz.exe	Virustotal: Detection: 77%			Perma Link

Machine Learning detection for dropped file

Source: C:\ProgramData\MPGPH131\MPGPH131.exe

Joe Sandbox ML: detected

Machine Learning detection for sample

Source: 2zdult23rz.exe

Joe Sandbox ML: detected

Source: C:\Users\user\Desktop\2zdult23rz.exe	Code function: 0_2_004D1240 CryptUnprotectData,CryptUnprotectData,LocalFree,LocalFree,		0_2_004D1240
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 9_2_004D1240 CryptUnprotectData,CryptUnprotectData,LocalFree,LocalFree,		9_2_004D1240

Compliance

Detected unpacking (overwrites its own PE header)

Source: C:\Users\user\Desktop\2zdult23rz.exe	Unpacked PE file: 0.2.2zdult23rz.exe.400000.0.unpack
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Unpacked PE file: 9.2.MPGPH131.exe.400000.0.unpack
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Unpacked PE file: 10.2.MPGPH131.exe.400000.0.unpack
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Unpacked PE file: 16.2.RageMP131.exe.400000.0.unpack
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Unpacked PE file: 24.2.RageMP131.exe.400000.0.unpack

Source: 2zdult23rz.exe

Static PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: C:\Users\user\Desktop\2zdult23rz.exe

File opened: C:\Windows\SysWOW64\msvcr100.dll

Jump to behavior

Source: unknown	HTTPS traffic detected: 34.117.186.192:443 -> 192.168.2.6:49710 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.26.4.15:443 -> 192.168.2.6:49712 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.117.186.192:443 -> 192.168.2.6:49713 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.117.186.192:443 -> 192.168.2.6:49714 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.117.186.192:443 -> 192.168.2.6:49715 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.26.4.15:443 -> 192.168.2.6:49716 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.26.4.15:443 -> 192.168.2.6:49717 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.26.4.15:443 -> 192.168.2.6:49718 version: TLS 1.2

Source:

Binary string: C:\dedazosole.pdb source: 2zdult23rz.exe, RageMP131.exe.0.dr, MPGPH131.exe.0.dr

Source: C:\Users\user\Desktop\2zdult23rz.exe	Code function: 0_2_0044A4BD FindFirstFileExW,	0_2_0044A4BD
Source: C:\Users\user\Desktop\2zdult23rz.exe	Code function: 0_2_004F2870 FindFirstFileA,SetFileAttributesA,DeleteFileA,FindNextFileA,FindClose,GetLastError,SetFileAttributesA,GetLastError,RemoveDirectoryA,GetLastError,GetLastError,std::_Throw_Cpp_error,std::_Throw_Cpp_error,CreateDirectoryA,std::_Throw_Cpp_error,std::_Throw_Cpp_error,	0_2_004F2870
Source: C:\Users\user\Desktop\2zdult23rz.exe	Code function: 0_2_0042C82B FindClose,FindFirstFileExW,GetLastError,	0_2_0042C82B
Source: C:\Users\user\Desktop\2zdult23rz.exe	Code function: 0_2_0042C8B1 GetFileAttributesExW,GetLastError,FindFirstFileW,GetLastError,FindClose,___std_fs_open_handle@16,GetFileInformationByHandleEx,GetLastError,GetFileInformationByHandleEx,GetFileInformationByHandleEx,	0_2_0042C8B1
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 9_2_0044A4BD FindFirstFileExW,	9_2_0044A4BD
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 9_2_004F2870 FindFirstFileA,SetFileAttributesA,DeleteFileA,FindNextFileA,FindClose,GetLastError,SetFileAttributesA,GetLastError,RemoveDirectoryA,GetLastError,GetLastError,std::_Throw_Cpp_error,std::_Throw_Cpp_error,CreateDirectoryA,std::_Throw_Cpp_error,std::_Throw_Cpp_error,	9_2_004F2870
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 9_2_0042C82B FindClose,FindFirstFileExW,GetLastError,	9_2_0042C82B
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 9_2_0042C8B1 GetFileAttributesExW,GetLastError,FindFirstFileW,GetLastError,FindClose,___std_fs_open_handle@16,GetFileInformationByHandleEx,GetLastError,GetFileInformationByHandleEx,GetFileInformationByHandleEx,	9_2_0042C8B1

Networking

Snort IDS alert for network traffic

Source: Traffic	Snort IDS: 2049060 ET TROJAN RisePro TCP Heartbeat Packet 192.168.2.6:49699 -> 147.45.47.93:58709
Source: Traffic	Snort IDS: 2046266 ET TROJAN [ANY.RUN] RisePro TCP (Token) 147.45.47.93:58709 -> 192.168.2.6:49699
Source: Traffic	Snort IDS: 2046269 ET TROJAN [ANY.RUN] RisePro TCP (Activity) 192.168.2.6:49699 -> 147.45.47.93:58709
Source: Traffic	Snort IDS: 2046266 ET TROJAN [ANY.RUN] RisePro TCP (Token) 147.45.47.93:58709 -> 192.168.2.6:49700
Source: Traffic	Snort IDS: 2046266 ET TROJAN [ANY.RUN] RisePro TCP (Token) 147.45.47.93:58709 -> 192.168.2.6:49701
Source: Traffic	Snort IDS: 2046269 ET TROJAN [ANY.RUN] RisePro TCP (Activity) 192.168.2.6:49700 -> 147.45.47.93:58709
Source: Traffic	Snort IDS: 2046269 ET TROJAN [ANY.RUN] RisePro TCP (Activity) 192.168.2.6:49701 -> 147.45.47.93:58709
Source: Traffic	Snort IDS: 2046266 ET TROJAN [ANY.RUN] RisePro TCP (Token) 147.45.47.93:58709 -> 192.168.2.6:49709
Source: Traffic	Snort IDS: 2046267 ET TROJAN [ANY.RUN] RisePro TCP (External IP) 147.45.47.93:58709 -> 192.168.2.6:49699
Source: Traffic	Snort IDS: 2046267 ET TROJAN [ANY.RUN] RisePro TCP (External IP) 147.45.47.93:58709 -> 192.168.2.6:49700
Source: Traffic	Snort IDS: 2046267 ET TROJAN [ANY.RUN] RisePro TCP (External IP) 147.45.47.93:58709 -> 192.168.2.6:49701
Source: Traffic	Snort IDS: 2046267 ET TROJAN [ANY.RUN] RisePro TCP (External IP) 147.45.47.93:58709 -> 192.168.2.6:49709
Source: Traffic	Snort IDS: 2046269 ET TROJAN [ANY.RUN] RisePro TCP (Activity) 192.168.2.6:49709 -> 147.45.47.93:58709
Source: Traffic	Snort IDS: 2046266 ET TROJAN [ANY.RUN] RisePro TCP (Token) 147.45.47.93:58709 -> 192.168.2.6:49711
Source: Traffic	Snort IDS: 2046269 ET TROJAN [ANY.RUN] RisePro TCP (Activity) 192.168.2.6:49711 -> 147.45.47.93:58709

Connects to many ports of the same IP (likely port scanning)

Source: global traffic

TCP traffic: 147.45.47.93 ports 0,5,7,8,58709,9

Source: global traffic

TCP traffic: 192.168.2.6:49699 -> 147.45.47.93:58709

Source: Joe Sandbox View	IP Address: 34.117.186.192 34.117.186.192
Source: Joe Sandbox View	IP Address: 34.117.186.192 34.117.186.192
Source: Joe Sandbox View	IP Address: 147.45.47.93 147.45.47.93
Source: Joe Sandbox View	IP Address: 104.26.4.15 104.26.4.15

Source: Joe Sandbox View

ASN Name: FREE-NET-ASFREEnetEU FREE-NET-ASFREEnetEU

Source: Joe Sandbox View

JA3 fingerprint: a0e9f5d64349fb13191bc781f81f42e1

Source: unknown	DNS query: name: ipinfo.io
Source: unknown	DNS query: name: ipinfo.io

Source: global traffic	HTTP traffic detected: GET /widget/demo/149.18.24.96 HTTP/1.1Connection: Keep-AliveReferer: https://ipinfo.io/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36Host: ipinfo.io
Source: global traffic	HTTP traffic detected: GET /demo/home.php?s=149.18.24.96 HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36Host: db-ip.com
Source: global traffic	HTTP traffic detected: GET /widget/demo/149.18.24.96 HTTP/1.1Connection: Keep-AliveReferer: https://ipinfo.io/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36Host: ipinfo.io
Source: global traffic	HTTP traffic detected: GET /widget/demo/149.18.24.96 HTTP/1.1Connection: Keep-AliveReferer: https://ipinfo.io/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36Host: ipinfo.io
Source: global traffic	HTTP traffic detected: GET /widget/demo/149.18.24.96 HTTP/1.1Connection: Keep-AliveReferer: https://ipinfo.io/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36Host: ipinfo.io
Source: global traffic	HTTP traffic detected: GET /demo/home.php?s=149.18.24.96 HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36Host: db-ip.com
Source: global traffic	HTTP traffic detected: GET /demo/home.php?s=149.18.24.96 HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36Host: db-ip.com
Source: global traffic	HTTP traffic detected: GET /demo/home.php?s=149.18.24.96 HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36Host: db-ip.com

Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.47.93
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.47.93
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.47.93
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.47.93
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.47.93
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.47.93
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.47.93
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.47.93
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.47.93
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.47.93
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.47.93
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.47.93
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.47.93
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.47.93
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.47.93
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.47.93
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.47.93
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.47.93
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.47.93
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.47.93
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.47.93
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.47.93
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.47.93
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.47.93
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.47.93
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.47.93
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.47.93
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.47.93
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.47.93
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.47.93
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.47.93
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.47.93
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.47.93
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.47.93
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.47.93
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.47.93
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.47.93
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.47.93
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.47.93
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.47.93
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.47.93
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.47.93
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.47.93
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.47.93
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.47.93
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.47.93
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.47.93
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.47.93
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.47.93
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.47.93

Source: C:\Users\user\Desktop\2zdult23rz.exe

Code function: 0_2_004D3150 recv,WSAStartup,getaddrinfo,closesocket,socket,connect,closesocket,freeaddrinfo,WSACleanup,freeaddrinfo,

0_2_004D3150

Source: global traffic	HTTP traffic detected: GET /widget/demo/149.18.24.96 HTTP/1.1Connection: Keep-AliveReferer: https://ipinfo.io/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36Host: ipinfo.io
Source: global traffic	HTTP traffic detected: GET /demo/home.php?s=149.18.24.96 HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36Host: db-ip.com
Source: global traffic	HTTP traffic detected: GET /widget/demo/149.18.24.96 HTTP/1.1Connection: Keep-AliveReferer: https://ipinfo.io/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36Host: ipinfo.io
Source: global traffic	HTTP traffic detected: GET /widget/demo/149.18.24.96 HTTP/1.1Connection: Keep-AliveReferer: https://ipinfo.io/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36Host: ipinfo.io
Source: global traffic	HTTP traffic detected: GET /widget/demo/149.18.24.96 HTTP/1.1Connection: Keep-AliveReferer: https://ipinfo.io/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36Host: ipinfo.io
Source: global traffic	HTTP traffic detected: GET /demo/home.php?s=149.18.24.96 HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36Host: db-ip.com
Source: global traffic	HTTP traffic detected: GET /demo/home.php?s=149.18.24.96 HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36Host: db-ip.com
Source: global traffic	HTTP traffic detected: GET /demo/home.php?s=149.18.24.96 HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36Host: db-ip.com

Source: global traffic	DNS traffic detected: DNS query: ipinfo.io
Source: global traffic	DNS traffic detected: DNS query: db-ip.com

Source: Amcache.hve.8.dr	String found in binary or memory: http://upx.sf.net
Source: 2zdult23rz.exe, 00000000.00000002.3357800955.0000000005CC3000.00000040.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000009.00000002.3356779154.0000000005DF5000.00000040.00000020.00020000.00000000.sdmp, MPGPH131.exe, 0000000A.00000002.3356453066.0000000005C1A000.00000040.00000020.00020000.00000000.sdmp, RageMP131.exe, 00000010.00000002.3356388466.0000000005CCC000.00000040.00000020.00020000.00000000.sdmp, RageMP131.exe, 00000018.00000002.3357697042.0000000005D4D000.00000040.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.winimage.com/zLibD
Source: RageMP131.exe, 00000018.00000002.3357977475.0000000005EE0000.00000040.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.winimage.com/zLibDll
Source: MPGPH131.exe, 00000009.00000002.3355895754.00000000044FD000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 00000010.00000002.3355352428.00000000044B9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://db-ip.com/
Source: MPGPH131.exe, 00000009.00000002.3355895754.00000000044FD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://db-ip.com/89
Source: MPGPH131.exe, 0000000A.00000002.3355736939.00000000042F7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://db-ip.com/?
Source: 2zdult23rz.exe, 00000000.00000002.3356067350.00000000044B1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://db-ip.com/I
Source: RageMP131.exe, 00000010.00000002.3355352428.00000000044B9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://db-ip.com/Or
Source: 2zdult23rz.exe, 00000000.00000002.3356067350.00000000044B1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://db-ip.com/U
Source: MPGPH131.exe, 00000009.00000002.3355895754.00000000044FD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://db-ip.com/X9
Source: RageMP131.exe, 00000010.00000002.3355352428.00000000044B9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://db-ip.com/demo/home.php?s=149.18.24.96
Source: MPGPH131.exe, 0000000A.00000002.3355736939.00000000042F7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://db-ip.com/demo/home.php?s=149.18.24.965
Source: MPGPH131.exe, 00000009.00000002.3355895754.00000000044FD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://db-ip.com/demo/home.php?s=149.18.24.96F5
Source: MPGPH131.exe, 0000000A.00000002.3355736939.00000000042F7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://db-ip.com/demo/home.php?s=149.18.24.96o#
Source: RageMP131.exe, 00000010.00000002.3355352428.00000000044B9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://db-ip.com/ur
Source: MPGPH131.exe, 00000009.00000002.3355895754.00000000044FD000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 0000000A.00000002.3355736939.00000000042F7000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 00000010.00000002.3355352428.00000000044B9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://db-ip.com:443/demo/home.php?s=149.18.24.96
Source: 2zdult23rz.exe, 00000000.00000002.3356067350.00000000044B1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://db-ip.com:443/demo/home.php?s=149.18.24.968
Source: RageMP131.exe, 00000010.00000002.3355352428.000000000447C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ipinfo.io/
Source: 2zdult23rz.exe, 00000000.00000003.2065919760.0000000006030000.00000004.00001000.00020000.00000000.sdmp, 2zdult23rz.exe, 00000000.00000002.3349183063.0000000000400000.00000040.00000001.01000000.00000003.sdmp, 2zdult23rz.exe, 00000000.00000002.3357963980.0000000005E90000.00000040.00001000.00020000.00000000.sdmp, MPGPH131.exe, 00000009.00000002.3357144489.0000000005F90000.00000040.00001000.00020000.00000000.sdmp, MPGPH131.exe, 00000009.00000003.2120691078.0000000006130000.00000004.00001000.00020000.00000000.sdmp, MPGPH131.exe, 00000009.00000002.3349156602.0000000000400000.00000040.00000001.01000000.00000005.sdmp, MPGPH131.exe, 0000000A.00000002.3356718132.0000000005F10000.00000040.00001000.00020000.00000000.sdmp, MPGPH131.exe, 0000000A.00000002.3349162153.0000000000400000.00000040.00000001.01000000.00000005.sdmp, MPGPH131.exe, 0000000A.00000003.2143542863.00000000060B0000.00000004.00001000.00020000.00000000.sdmp, RageMP131.exe, 00000010.00000002.3356555753.0000000005DA0000.00000040.00001000.00020000.00000000.sdmp, RageMP131.exe, 00000010.00000003.2249432581.0000000006040000.00000004.00001000.00020000.00000000.sdmp, RageMP131.exe, 00000010.00000002.3349183258.0000000000400000.00000040.00000001.01000000.00000006.sdmp, RageMP131.exe, 00000010.00000001.2249277297.00000000004E6000.00000004.00000001.01000000.00000006.sdmp, RageMP131.exe, 00000018.00000002.3349156812.0000000000400000.00000040.00000001.01000000.00000006.sdmp, RageMP131.exe, 00000018.00000003.2350560646.0000000006080000.00000004.00001000.00020000.00000000.sdmp, RageMP131.exe, 00000018.00000002.3357977475.0000000005EE0000.00000040.00001000.00020000.00000000.sdmp	String found in binary or memory: https://ipinfo.io/Content-Type:
Source: 2zdult23rz.exe, 00000000.00000002.3356067350.00000000044A6000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000009.00000002.3355895754.00000000044E6000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 0000000A.00000002.3355736939.00000000042EB000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 00000010.00000002.3355352428.00000000044A5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ipinfo.io/Mozilla/5.0
Source: MPGPH131.exe, 0000000A.00000002.3355736939.00000000042B0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ipinfo.io/n
Source: 2zdult23rz.exe, 00000000.00000002.3356067350.000000000445F000.00000004.00000020.00020000.00000000.sdmp, 2zdult23rz.exe, 00000000.00000002.3356067350.00000000044A6000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000009.00000002.3355895754.000000000448C000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 0000000A.00000002.3355736939.00000000042EB000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 0000000A.00000002.3355736939.000000000429F000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 00000010.00000002.3355352428.00000000044A5000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 00000010.00000002.3355352428.000000000445E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ipinfo.io/widget/demo/149.18.24.96
Source: MPGPH131.exe, 00000009.00000002.3355895754.00000000044E6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ipinfo.io/widget/demo/149.18.24.96a
Source: MPGPH131.exe, 0000000A.00000002.3355736939.00000000042EB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ipinfo.io:443/widget/demo/149.18.24.96
Source: 2zdult23rz.exe, 00000000.00000002.3356067350.00000000044A6000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 00000010.00000002.3355352428.00000000044A5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ipinfo.io:443/widget/demo/149.18.24.96B
Source: MPGPH131.exe, 00000009.00000002.3355895754.00000000044E6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ipinfo.io:443/widget/demo/149.18.24.96E
Source: 2zdult23rz.exe, 00000000.00000002.3356067350.000000000442E000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000009.00000002.3355895754.000000000445E000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 0000000A.00000002.3355736939.0000000004277000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 00000010.00000002.3355352428.000000000442E000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 00000018.00000002.3356346368.00000000041D8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://t.me/RiseProSUPPORT
Source: 2zdult23rz.exe, 00000000.00000002.3356067350.000000000442E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://t.me/RiseProSUPPORTX
Source: 2zdult23rz.exe, 2zdult23rz.exe, 00000000.00000003.2065919760.0000000006030000.00000004.00001000.00020000.00000000.sdmp, 2zdult23rz.exe, 00000000.00000002.3349183063.0000000000400000.00000040.00000001.01000000.00000003.sdmp, 2zdult23rz.exe, 00000000.00000002.3357963980.0000000005E90000.00000040.00001000.00020000.00000000.sdmp, MPGPH131.exe, MPGPH131.exe, 00000009.00000002.3357144489.0000000005F90000.00000040.00001000.00020000.00000000.sdmp, MPGPH131.exe, 00000009.00000003.2120691078.0000000006130000.00000004.00001000.00020000.00000000.sdmp, MPGPH131.exe, 00000009.00000002.3349156602.0000000000400000.00000040.00000001.01000000.00000005.sdmp, MPGPH131.exe, 0000000A.00000002.3356718132.0000000005F10000.00000040.00001000.00020000.00000000.sdmp, MPGPH131.exe, 0000000A.00000002.3349162153.0000000000400000.00000040.00000001.01000000.00000005.sdmp, MPGPH131.exe, 0000000A.00000003.2143542863.00000000060B0000.00000004.00001000.00020000.00000000.sdmp, RageMP131.exe, 00000010.00000002.3356555753.0000000005DA0000.00000040.00001000.00020000.00000000.sdmp, RageMP131.exe, 00000010.00000003.2249432581.0000000006040000.00000004.00001000.00020000.00000000.sdmp, RageMP131.exe, 00000010.00000002.3349183258.0000000000400000.00000040.00000001.01000000.00000006.sdmp, RageMP131.exe, 00000010.00000001.2249277297.00000000004E6000.00000004.00000001.01000000.00000006.sdmp, RageMP131.exe, 00000018.00000002.3349156812.0000000000400000.00000040.00000001.01000000.00000006.sdmp, RageMP131.exe, 00000018.00000003.2350560646.0000000006080000.00000004.00001000.00020000.00000000.sdmp, RageMP131.exe, 00000018.00000002.3357977475.0000000005EE0000.00000040.00001000.00020000.00000000.sdmp	String found in binary or memory: https://www.maxmind.com/en/locate-my-ip-address

Source: unknown	Network traffic detected: HTTP traffic on port 49710 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49710
Source: unknown	Network traffic detected: HTTP traffic on port 49712 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49718
Source: unknown	Network traffic detected: HTTP traffic on port 49713 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49716 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49717
Source: unknown	Network traffic detected: HTTP traffic on port 49714 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49715 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49716
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49715
Source: unknown	Network traffic detected: HTTP traffic on port 49717 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49714
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49713
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49712

Source: unknown	HTTPS traffic detected: 34.117.186.192:443 -> 192.168.2.6:49710 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.26.4.15:443 -> 192.168.2.6:49712 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.117.186.192:443 -> 192.168.2.6:49713 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.117.186.192:443 -> 192.168.2.6:49714 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.117.186.192:443 -> 192.168.2.6:49715 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.26.4.15:443 -> 192.168.2.6:49716 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.26.4.15:443 -> 192.168.2.6:49717 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.26.4.15:443 -> 192.168.2.6:49718 version: TLS 1.2

Source: C:\Users\user\Desktop\2zdult23rz.exe

Code function: 0_2_004F2150 GdiplusStartup,GetSystemMetrics,GetSystemMetrics,GetSystemMetrics,GetDC,CreateCompatibleDC,CreateCompatibleBitmap,SelectObject,BitBlt,GdipCreateBitmapFromHBITMAP,GdipGetImageEncodersSize,GdipGetImageEncoders,GdipSaveImageToFile,DeleteObject,GdipDisposeImage,DeleteObject,ReleaseDC,GdiplusShutdown,

0_2_004F2150

System Summary

Malicious sample detected (through community Yara rule)

Source: 00000009.00000002.3356779154.0000000005DF5000.00000040.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_ed346e4c Author: unknown
Source: 0000000A.00000002.3356453066.0000000005C1A000.00000040.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_ed346e4c Author: unknown
Source: 00000018.00000002.3357697042.0000000005D4D000.00000040.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_ed346e4c Author: unknown
Source: 00000000.00000002.3357800955.0000000005CC3000.00000040.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_ed346e4c Author: unknown
Source: 0000000A.00000002.3356718132.0000000005F10000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_3687686f Author: unknown
Source: 00000009.00000002.3357144489.0000000005F90000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_3687686f Author: unknown
Source: 00000010.00000002.3356388466.0000000005CCC000.00000040.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_ed346e4c Author: unknown
Source: 00000010.00000002.3356555753.0000000005DA0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_3687686f Author: unknown
Source: 00000018.00000002.3357977475.0000000005EE0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_3687686f Author: unknown
Source: 00000000.00000002.3357963980.0000000005E90000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_3687686f Author: unknown

Source: C:\Users\user\Desktop\2zdult23rz.exe	Code function: 0_2_004DF790	0_2_004DF790
Source: C:\Users\user\Desktop\2zdult23rz.exe	Code function: 0_2_00453C30	0_2_00453C30
Source: C:\Users\user\Desktop\2zdult23rz.exe	Code function: 0_2_0042A040	0_2_0042A040
Source: C:\Users\user\Desktop\2zdult23rz.exe	Code function: 0_2_0044F050	0_2_0044F050
Source: C:\Users\user\Desktop\2zdult23rz.exe	Code function: 0_2_0050D010	0_2_0050D010
Source: C:\Users\user\Desktop\2zdult23rz.exe	Code function: 0_2_0052A080	0_2_0052A080
Source: C:\Users\user\Desktop\2zdult23rz.exe	Code function: 0_2_004FC0A0	0_2_004FC0A0
Source: C:\Users\user\Desktop\2zdult23rz.exe	Code function: 0_2_004FB0A0	0_2_004FB0A0
Source: C:\Users\user\Desktop\2zdult23rz.exe	Code function: 0_2_005040A0	0_2_005040A0
Source: C:\Users\user\Desktop\2zdult23rz.exe	Code function: 0_2_00510140	0_2_00510140
Source: C:\Users\user\Desktop\2zdult23rz.exe	Code function: 0_2_00553170	0_2_00553170
Source: C:\Users\user\Desktop\2zdult23rz.exe	Code function: 0_2_004371F0	0_2_004371F0
Source: C:\Users\user\Desktop\2zdult23rz.exe	Code function: 0_2_00541180	0_2_00541180
Source: C:\Users\user\Desktop\2zdult23rz.exe	Code function: 0_2_005041A0	0_2_005041A0
Source: C:\Users\user\Desktop\2zdult23rz.exe	Code function: 0_2_004351B8	0_2_004351B8
Source: C:\Users\user\Desktop\2zdult23rz.exe	Code function: 0_2_00547260	0_2_00547260
Source: C:\Users\user\Desktop\2zdult23rz.exe	Code function: 0_2_00506210	0_2_00506210
Source: C:\Users\user\Desktop\2zdult23rz.exe	Code function: 0_2_00552230	0_2_00552230
Source: C:\Users\user\Desktop\2zdult23rz.exe	Code function: 0_2_004D3280	0_2_004D3280
Source: C:\Users\user\Desktop\2zdult23rz.exe	Code function: 0_2_0054E340	0_2_0054E340
Source: C:\Users\user\Desktop\2zdult23rz.exe	Code function: 0_2_00448314	0_2_00448314
Source: C:\Users\user\Desktop\2zdult23rz.exe	Code function: 0_2_00513320	0_2_00513320
Source: C:\Users\user\Desktop\2zdult23rz.exe	Code function: 0_2_005233F0	0_2_005233F0
Source: C:\Users\user\Desktop\2zdult23rz.exe	Code function: 0_2_0050E450	0_2_0050E450
Source: C:\Users\user\Desktop\2zdult23rz.exe	Code function: 0_2_00453450	0_2_00453450
Source: C:\Users\user\Desktop\2zdult23rz.exe	Code function: 0_2_004FF450	0_2_004FF450
Source: C:\Users\user\Desktop\2zdult23rz.exe	Code function: 0_2_0050C410	0_2_0050C410
Source: C:\Users\user\Desktop\2zdult23rz.exe	Code function: 0_2_0052E510	0_2_0052E510
Source: C:\Users\user\Desktop\2zdult23rz.exe	Code function: 0_2_00502580	0_2_00502580
Source: C:\Users\user\Desktop\2zdult23rz.exe	Code function: 0_2_005145A0	0_2_005145A0
Source: C:\Users\user\Desktop\2zdult23rz.exe	Code function: 0_2_0050F620	0_2_0050F620
Source: C:\Users\user\Desktop\2zdult23rz.exe	Code function: 0_2_004536D0	0_2_004536D0
Source: C:\Users\user\Desktop\2zdult23rz.exe	Code function: 0_2_0051E6F0	0_2_0051E6F0
Source: C:\Users\user\Desktop\2zdult23rz.exe	Code function: 0_2_00516730	0_2_00516730
Source: C:\Users\user\Desktop\2zdult23rz.exe	Code function: 0_2_0043A8BD	0_2_0043A8BD
Source: C:\Users\user\Desktop\2zdult23rz.exe	Code function: 0_2_004FC8B0	0_2_004FC8B0
Source: C:\Users\user\Desktop\2zdult23rz.exe	Code function: 0_2_004F3910	0_2_004F3910
Source: C:\Users\user\Desktop\2zdult23rz.exe	Code function: 0_2_00506920	0_2_00506920
Source: C:\Users\user\Desktop\2zdult23rz.exe	Code function: 0_2_005209F0	0_2_005209F0
Source: C:\Users\user\Desktop\2zdult23rz.exe	Code function: 0_2_0054B990	0_2_0054B990
Source: C:\Users\user\Desktop\2zdult23rz.exe	Code function: 0_2_00431A30	0_2_00431A30
Source: C:\Users\user\Desktop\2zdult23rz.exe	Code function: 0_2_00504A90	0_2_00504A90
Source: C:\Users\user\Desktop\2zdult23rz.exe	Code function: 0_2_00503BD0	0_2_00503BD0
Source: C:\Users\user\Desktop\2zdult23rz.exe	Code function: 0_2_00545BF0	0_2_00545BF0
Source: C:\Users\user\Desktop\2zdult23rz.exe	Code function: 0_2_0043ABFF	0_2_0043ABFF
Source: C:\Users\user\Desktop\2zdult23rz.exe	Code function: 0_2_00553BB0	0_2_00553BB0
Source: C:\Users\user\Desktop\2zdult23rz.exe	Code function: 0_2_004FECA0	0_2_004FECA0
Source: C:\Users\user\Desktop\2zdult23rz.exe	Code function: 0_2_00506DD0	0_2_00506DD0
Source: C:\Users\user\Desktop\2zdult23rz.exe	Code function: 0_2_00552DC0	0_2_00552DC0
Source: C:\Users\user\Desktop\2zdult23rz.exe	Code function: 0_2_00420DB0	0_2_00420DB0
Source: C:\Users\user\Desktop\2zdult23rz.exe	Code function: 0_2_004FBE00	0_2_004FBE00
Source: C:\Users\user\Desktop\2zdult23rz.exe	Code function: 0_2_00503E00	0_2_00503E00
Source: C:\Users\user\Desktop\2zdult23rz.exe	Code function: 0_2_0044CEA1	0_2_0044CEA1
Source: C:\Users\user\Desktop\2zdult23rz.exe	Code function: 0_2_00504FE0	0_2_00504FE0
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 9_2_004DF790	9_2_004DF790
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 9_2_00453C30	9_2_00453C30
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 9_2_0042A040	9_2_0042A040
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 9_2_0044F050	9_2_0044F050
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 9_2_0050D010	9_2_0050D010
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 9_2_0052A080	9_2_0052A080
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 9_2_004FC0A0	9_2_004FC0A0
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 9_2_004FB0A0	9_2_004FB0A0
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 9_2_005040A0	9_2_005040A0
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 9_2_00510140	9_2_00510140
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 9_2_00553170	9_2_00553170
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 9_2_004371F0	9_2_004371F0
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 9_2_00541180	9_2_00541180
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 9_2_005041A0	9_2_005041A0
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 9_2_004351B8	9_2_004351B8
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 9_2_00547260	9_2_00547260
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 9_2_00506210	9_2_00506210
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 9_2_00552230	9_2_00552230
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 9_2_004D3280	9_2_004D3280
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 9_2_0054E340	9_2_0054E340
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 9_2_00448314	9_2_00448314
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 9_2_00513320	9_2_00513320
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 9_2_005233F0	9_2_005233F0
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 9_2_0050E450	9_2_0050E450
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 9_2_00453450	9_2_00453450
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 9_2_004FF450	9_2_004FF450
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 9_2_0050C410	9_2_0050C410
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 9_2_0052E510	9_2_0052E510
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 9_2_00502580	9_2_00502580
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 9_2_005145A0	9_2_005145A0
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 9_2_0050F620	9_2_0050F620
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 9_2_004536D0	9_2_004536D0
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 9_2_0051E6F0	9_2_0051E6F0
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 9_2_00516730	9_2_00516730
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 9_2_0043A8BD	9_2_0043A8BD
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 9_2_004FC8B0	9_2_004FC8B0
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 9_2_004F3910	9_2_004F3910
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 9_2_00506920	9_2_00506920
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 9_2_005209F0	9_2_005209F0
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 9_2_0054B990	9_2_0054B990
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 9_2_00431A30	9_2_00431A30
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 9_2_00504A90	9_2_00504A90
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 9_2_00503BD0	9_2_00503BD0
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 9_2_00545BF0	9_2_00545BF0
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 9_2_0043ABFF	9_2_0043ABFF
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 9_2_00553BB0	9_2_00553BB0
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 9_2_004FECA0	9_2_004FECA0
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 9_2_00506DD0	9_2_00506DD0
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 9_2_00552DC0	9_2_00552DC0
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 9_2_00420DB0	9_2_00420DB0
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 9_2_004FBE00	9_2_004FBE00
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 9_2_00503E00	9_2_00503E00
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 9_2_0044CEA1	9_2_0044CEA1
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 9_2_00504FE0	9_2_00504FE0

Source: C:\Users\user\Desktop\2zdult23rz.exe	Code function: String function: 00553960 appears 102 times
Source: C:\Users\user\Desktop\2zdult23rz.exe	Code function: String function: 0042EC10 appears 54 times
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: String function: 00553960 appears 102 times
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: String function: 0042EC10 appears 54 times

Source: C:\Users\user\Desktop\2zdult23rz.exe

Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 1948 -s 860

Source: 2zdult23rz.exe, 00000000.00000002.3349183063.000000000058A000.00000040.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenameCrossDeviceSettingsHost.exeX vs 2zdult23rz.exe
Source: 2zdult23rz.exe, 00000000.00000003.2065919760.0000000006030000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameCrossDeviceSettingsHost.exeX vs 2zdult23rz.exe
Source: 2zdult23rz.exe, 00000000.00000000.2064681600.00000000040D8000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenameFires( vs 2zdult23rz.exe
Source: 2zdult23rz.exe, 00000000.00000003.2092524094.00000000044A6000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameFires( vs 2zdult23rz.exe
Source: 2zdult23rz.exe, 00000000.00000003.2091633716.00000000044A6000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameFires( vs 2zdult23rz.exe
Source: 2zdult23rz.exe, 00000000.00000002.3357963980.0000000005E90000.00000040.00001000.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameCrossDeviceSettingsHost.exeX vs 2zdult23rz.exe
Source: 2zdult23rz.exe	Binary or memory string: OriginalFilenameFires( vs 2zdult23rz.exe

Source: 2zdult23rz.exe

Static PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: 00000009.00000002.3356779154.0000000005DF5000.00000040.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_ed346e4c reference_sample = a91c1d3965f11509d1c1125210166b824a79650f29ea203983fffb5f8900858c, os = windows, severity = x86, creation_date = 2022-02-17, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.RedLineStealer, fingerprint = 834c13b2e0497787e552bb1318664496d286e7cf57b4661e5e07bf1cffe61b82, id = ed346e4c-7890-41ee-8648-f512682fe20e, last_modified = 2022-04-12
Source: 0000000A.00000002.3356453066.0000000005C1A000.00000040.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_ed346e4c reference_sample = a91c1d3965f11509d1c1125210166b824a79650f29ea203983fffb5f8900858c, os = windows, severity = x86, creation_date = 2022-02-17, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.RedLineStealer, fingerprint = 834c13b2e0497787e552bb1318664496d286e7cf57b4661e5e07bf1cffe61b82, id = ed346e4c-7890-41ee-8648-f512682fe20e, last_modified = 2022-04-12
Source: 00000018.00000002.3357697042.0000000005D4D000.00000040.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_ed346e4c reference_sample = a91c1d3965f11509d1c1125210166b824a79650f29ea203983fffb5f8900858c, os = windows, severity = x86, creation_date = 2022-02-17, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.RedLineStealer, fingerprint = 834c13b2e0497787e552bb1318664496d286e7cf57b4661e5e07bf1cffe61b82, id = ed346e4c-7890-41ee-8648-f512682fe20e, last_modified = 2022-04-12
Source: 00000000.00000002.3357800955.0000000005CC3000.00000040.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_ed346e4c reference_sample = a91c1d3965f11509d1c1125210166b824a79650f29ea203983fffb5f8900858c, os = windows, severity = x86, creation_date = 2022-02-17, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.RedLineStealer, fingerprint = 834c13b2e0497787e552bb1318664496d286e7cf57b4661e5e07bf1cffe61b82, id = ed346e4c-7890-41ee-8648-f512682fe20e, last_modified = 2022-04-12
Source: 0000000A.00000002.3356718132.0000000005F10000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_3687686f reference_sample = 8b3014ecd962a335b246f6c70fc820247e8bdaef98136e464b1fdb824031eef7, os = windows, severity = x86, creation_date = 2021-07-21, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Smokeloader, fingerprint = 0f483f9f79ae29b944825c1987366d7b450312f475845e2242a07674580918bc, id = 3687686f-8fbf-4f09-9afa-612ee65dc86c, last_modified = 2021-08-23
Source: 00000009.00000002.3357144489.0000000005F90000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_3687686f reference_sample = 8b3014ecd962a335b246f6c70fc820247e8bdaef98136e464b1fdb824031eef7, os = windows, severity = x86, creation_date = 2021-07-21, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Smokeloader, fingerprint = 0f483f9f79ae29b944825c1987366d7b450312f475845e2242a07674580918bc, id = 3687686f-8fbf-4f09-9afa-612ee65dc86c, last_modified = 2021-08-23
Source: 00000010.00000002.3356388466.0000000005CCC000.00000040.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_ed346e4c reference_sample = a91c1d3965f11509d1c1125210166b824a79650f29ea203983fffb5f8900858c, os = windows, severity = x86, creation_date = 2022-02-17, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.RedLineStealer, fingerprint = 834c13b2e0497787e552bb1318664496d286e7cf57b4661e5e07bf1cffe61b82, id = ed346e4c-7890-41ee-8648-f512682fe20e, last_modified = 2022-04-12
Source: 00000010.00000002.3356555753.0000000005DA0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_3687686f reference_sample = 8b3014ecd962a335b246f6c70fc820247e8bdaef98136e464b1fdb824031eef7, os = windows, severity = x86, creation_date = 2021-07-21, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Smokeloader, fingerprint = 0f483f9f79ae29b944825c1987366d7b450312f475845e2242a07674580918bc, id = 3687686f-8fbf-4f09-9afa-612ee65dc86c, last_modified = 2021-08-23
Source: 00000018.00000002.3357977475.0000000005EE0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_3687686f reference_sample = 8b3014ecd962a335b246f6c70fc820247e8bdaef98136e464b1fdb824031eef7, os = windows, severity = x86, creation_date = 2021-07-21, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Smokeloader, fingerprint = 0f483f9f79ae29b944825c1987366d7b450312f475845e2242a07674580918bc, id = 3687686f-8fbf-4f09-9afa-612ee65dc86c, last_modified = 2021-08-23
Source: 00000000.00000002.3357963980.0000000005E90000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_3687686f reference_sample = 8b3014ecd962a335b246f6c70fc820247e8bdaef98136e464b1fdb824031eef7, os = windows, severity = x86, creation_date = 2021-07-21, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Smokeloader, fingerprint = 0f483f9f79ae29b944825c1987366d7b450312f475845e2242a07674580918bc, id = 3687686f-8fbf-4f09-9afa-612ee65dc86c, last_modified = 2021-08-23

Source: classification engine

Classification label: mal100.troj.evad.winEXE@24/58@2/3

Source: C:\Users\user\Desktop\2zdult23rz.exe

Code function: 0_2_00551490 GetLastError,GetVersionExA,FormatMessageW,LocalFree,FormatMessageA,

0_2_00551490

Source: C:\Users\user\Desktop\2zdult23rz.exe

Code function: 0_2_00551220 GetVersionExA,CreateFileW,CreateFileA,GetDiskFreeSpaceW,GetDiskFreeSpaceA,

0_2_00551220

Source: C:\Users\user\Desktop\2zdult23rz.exe

Code function: 0_2_004F3910 CreateToolhelp32Snapshot,Process32First,Process32Next,Process32Next,Process32Next,CloseHandle,

0_2_004F3910

Source: C:\Users\user\Desktop\2zdult23rz.exe

File created: C:\Users\user\AppData\Local\RageMP131

Jump to behavior

Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5980:120:WilError_03
Source: C:\Windows\SysWOW64\WerFault.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\WERReportingForProcess6024
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5964:120:WilError_03
Source: C:\Windows\SysWOW64\WerFault.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\WERReportingForProcess5092
Source: C:\Windows\SysWOW64\WerFault.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\WERReportingForProcess6080
Source: C:\Windows\SysWOW64\WerFault.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\WERReportingForProcess1948
Source: C:\Windows\SysWOW64\WerFault.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\WERReportingForProcess2996

Source: C:\Users\user\Desktop\2zdult23rz.exe

File created: C:\Users\user\AppData\Local\Temp\rage131MP.tmp

Jump to behavior

Source: C:\Users\user\Desktop\2zdult23rz.exe	Command line argument: N.E		0_2_00452DA0
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Command line argument: N.E		9_2_00452DA0

Source: 2zdult23rz.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Users\user\Desktop\2zdult23rz.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: 2zdult23rz.exe, 2zdult23rz.exe, 00000000.00000003.2065919760.0000000006030000.00000004.00001000.00020000.00000000.sdmp, 2zdult23rz.exe, 00000000.00000002.3349183063.0000000000400000.00000040.00000001.01000000.00000003.sdmp, 2zdult23rz.exe, 00000000.00000002.3357963980.0000000005E90000.00000040.00001000.00020000.00000000.sdmp, MPGPH131.exe, MPGPH131.exe, 00000009.00000002.3357144489.0000000005F90000.00000040.00001000.00020000.00000000.sdmp, MPGPH131.exe, 00000009.00000003.2120691078.0000000006130000.00000004.00001000.00020000.00000000.sdmp, MPGPH131.exe, 00000009.00000002.3349156602.0000000000400000.00000040.00000001.01000000.00000005.sdmp, MPGPH131.exe, 0000000A.00000002.3356718132.0000000005F10000.00000040.00001000.00020000.00000000.sdmp, MPGPH131.exe, 0000000A.00000002.3349162153.0000000000400000.00000040.00000001.01000000.00000005.sdmp, MPGPH131.exe, 0000000A.00000003.2143542863.00000000060B0000.00000004.00001000.00020000.00000000.sdmp, RageMP131.exe, 00000010.00000002.3356555753.0000000005DA0000.00000040.00001000.00020000.00000000.sdmp	Binary or memory string: INSERT INTO %Q.%s VALUES('index',%Q,%Q,#%d,%Q);
Source: 2zdult23rz.exe, 00000000.00000003.2065919760.0000000006030000.00000004.00001000.00020000.00000000.sdmp, 2zdult23rz.exe, 00000000.00000002.3349183063.0000000000400000.00000040.00000001.01000000.00000003.sdmp, 2zdult23rz.exe, 00000000.00000002.3357963980.0000000005E90000.00000040.00001000.00020000.00000000.sdmp, MPGPH131.exe, 00000009.00000002.3357144489.0000000005F90000.00000040.00001000.00020000.00000000.sdmp, MPGPH131.exe, 00000009.00000003.2120691078.0000000006130000.00000004.00001000.00020000.00000000.sdmp, MPGPH131.exe, 00000009.00000002.3349156602.0000000000400000.00000040.00000001.01000000.00000005.sdmp, MPGPH131.exe, 0000000A.00000002.3356718132.0000000005F10000.00000040.00001000.00020000.00000000.sdmp, MPGPH131.exe, 0000000A.00000002.3349162153.0000000000400000.00000040.00000001.01000000.00000005.sdmp, MPGPH131.exe, 0000000A.00000003.2143542863.00000000060B0000.00000004.00001000.00020000.00000000.sdmp, RageMP131.exe, 00000010.00000002.3356555753.0000000005DA0000.00000040.00001000.00020000.00000000.sdmp	Binary or memory string: UPDATE %Q.%s SET sql = sqlite_rename_table(sql, %Q), tbl_name = %Q, name = CASE WHEN type='table' THEN %Q WHEN name LIKE 'sqlite_autoindex%%' AND type='index' THEN 'sqlite_autoindex_' \|\| %Q \|\| substr(name,%d+18) ELSE name END WHERE tbl_name=%Q AND (type='table' OR type='index' OR type='trigger');

Source: 2zdult23rz.exe	ReversingLabs: Detection: 81%
Source: 2zdult23rz.exe	Virustotal: Detection: 77%

Source: 2zdult23rz.exe	String found in binary or memory: https://www.maxmind.com/en/locate-my-ip-address
Source: MPGPH131.exe	String found in binary or memory: https://www.maxmind.com/en/locate-my-ip-address

Source: C:\Users\user\Desktop\2zdult23rz.exe

File read: C:\Users\user\Desktop\2zdult23rz.exe

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\2zdult23rz.exe "C:\Users\user\Desktop\2zdult23rz.exe"
Source: C:\Users\user\Desktop\2zdult23rz.exe	Process created: C:\Windows\SysWOW64\schtasks.exe schtasks /create /f /RU "user" /tr "C:\ProgramData\MPGPH131\MPGPH131.exe" /tn "MPGPH131 HR" /sc HOURLY /rl HIGHEST
Source: C:\Windows\SysWOW64\schtasks.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\2zdult23rz.exe	Process created: C:\Windows\SysWOW64\schtasks.exe schtasks /create /f /RU "user" /tr "C:\ProgramData\MPGPH131\MPGPH131.exe" /tn "MPGPH131 LG" /sc ONLOGON /rl HIGHEST
Source: C:\Windows\SysWOW64\schtasks.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\2zdult23rz.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 1948 -s 860
Source: unknown	Process created: C:\ProgramData\MPGPH131\MPGPH131.exe C:\ProgramData\MPGPH131\MPGPH131.exe
Source: unknown	Process created: C:\ProgramData\MPGPH131\MPGPH131.exe C:\ProgramData\MPGPH131\MPGPH131.exe
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 6080 -s 800
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 2996 -s 776
Source: unknown	Process created: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe "C:\Users\user\AppData\Local\RageMP131\RageMP131.exe"
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 5092 -s 812
Source: C:\Users\user\Desktop\2zdult23rz.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 1948 -s 956
Source: unknown	Process created: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe "C:\Users\user\AppData\Local\RageMP131\RageMP131.exe"
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 2996 -s 888
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 6080 -s 896
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 5092 -s 956
Source: C:\Users\user\Desktop\2zdult23rz.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 1948 -s 956
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 6080 -s 928
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 6024 -s 792
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 2996 -s 888
Source: C:\Users\user\Desktop\2zdult23rz.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 1948 -s 972
Source: C:\Users\user\Desktop\2zdult23rz.exe	Process created: C:\Windows\SysWOW64\schtasks.exe schtasks /create /f /RU "user" /tr "C:\ProgramData\MPGPH131\MPGPH131.exe" /tn "MPGPH131 HR" /sc HOURLY /rl HIGHEST	Jump to behavior
Source: C:\Users\user\Desktop\2zdult23rz.exe	Process created: C:\Windows\SysWOW64\schtasks.exe schtasks /create /f /RU "user" /tr "C:\ProgramData\MPGPH131\MPGPH131.exe" /tn "MPGPH131 LG" /sc ONLOGON /rl HIGHEST	Jump to behavior

Source: C:\Users\user\Desktop\2zdult23rz.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\2zdult23rz.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\Desktop\2zdult23rz.exe	Section loaded: msimg32.dll	Jump to behavior
Source: C:\Users\user\Desktop\2zdult23rz.exe	Section loaded: rstrtmgr.dll	Jump to behavior
Source: C:\Users\user\Desktop\2zdult23rz.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\Desktop\2zdult23rz.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\2zdult23rz.exe	Section loaded: msvcr100.dll	Jump to behavior
Source: C:\Users\user\Desktop\2zdult23rz.exe	Section loaded: d3d11.dll	Jump to behavior
Source: C:\Users\user\Desktop\2zdult23rz.exe	Section loaded: dxgi.dll	Jump to behavior
Source: C:\Users\user\Desktop\2zdult23rz.exe	Section loaded: resourcepolicyclient.dll	Jump to behavior
Source: C:\Users\user\Desktop\2zdult23rz.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\2zdult23rz.exe	Section loaded: d3d10warp.dll	Jump to behavior
Source: C:\Users\user\Desktop\2zdult23rz.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\2zdult23rz.exe	Section loaded: dxcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\2zdult23rz.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\2zdult23rz.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\Desktop\2zdult23rz.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\Desktop\2zdult23rz.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\2zdult23rz.exe	Section loaded: devobj.dll	Jump to behavior
Source: C:\Users\user\Desktop\2zdult23rz.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\2zdult23rz.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Users\user\Desktop\2zdult23rz.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\2zdult23rz.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\2zdult23rz.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\2zdult23rz.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\Desktop\2zdult23rz.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\Desktop\2zdult23rz.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Users\user\Desktop\2zdult23rz.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Users\user\Desktop\2zdult23rz.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Users\user\Desktop\2zdult23rz.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\2zdult23rz.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\2zdult23rz.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\2zdult23rz.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\2zdult23rz.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: taskschd.dll	Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: xmllite.dll	Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: taskschd.dll	Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: xmllite.dll	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: msimg32.dll	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: rstrtmgr.dll	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: msvcr100.dll	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: d3d11.dll	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: dxgi.dll	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: resourcepolicyclient.dll	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: d3d10warp.dll	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: dxcore.dll	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: devobj.dll	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: msimg32.dll	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: rstrtmgr.dll	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: msvcr100.dll	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: d3d11.dll	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: dxgi.dll	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: resourcepolicyclient.dll	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: d3d10warp.dll	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: dxcore.dll	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: devobj.dll	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Section loaded: msimg32.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Section loaded: rstrtmgr.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Section loaded: msvcr100.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Section loaded: d3d11.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Section loaded: dxgi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Section loaded: resourcepolicyclient.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Section loaded: d3d10warp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Section loaded: dxcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Section loaded: devobj.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Section loaded: winhttp.dll
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Section loaded: msimg32.dll
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Section loaded: rstrtmgr.dll
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Section loaded: ncrypt.dll
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Section loaded: ntasn1.dll
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Section loaded: msvcr100.dll
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Section loaded: d3d11.dll
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Section loaded: dxgi.dll
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Section loaded: resourcepolicyclient.dll
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Section loaded: d3d10warp.dll
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Section loaded: uxtheme.dll
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Section loaded: dxcore.dll
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Section loaded: wininet.dll
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Section loaded: mswsock.dll
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Section loaded: devobj.dll

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Users\user\Desktop\2zdult23rz.exe

File opened: C:\Windows\SysWOW64\msvcr100.dll

Jump to behavior

Source: 2zdult23rz.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG

Source:

Binary string: C:\dedazosole.pdb source: 2zdult23rz.exe, RageMP131.exe.0.dr, MPGPH131.exe.0.dr

Data Obfuscation

Detected unpacking (changes PE section rights)

Source: C:\Users\user\Desktop\2zdult23rz.exe	Unpacked PE file: 0.2.2zdult23rz.exe.400000.0.unpack .text:ER;.rdata:R;.data:W;.rsrc:R; vs .text:ER;.rdata:R;.data:W;.rsrc:R;.reloc:R;
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Unpacked PE file: 9.2.MPGPH131.exe.400000.0.unpack .text:ER;.rdata:R;.data:W;.rsrc:R; vs .text:ER;.rdata:R;.data:W;.rsrc:R;.reloc:R;
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Unpacked PE file: 10.2.MPGPH131.exe.400000.0.unpack .text:ER;.rdata:R;.data:W;.rsrc:R; vs .text:ER;.rdata:R;.data:W;.rsrc:R;.reloc:R;
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Unpacked PE file: 16.2.RageMP131.exe.400000.0.unpack .text:ER;.rdata:R;.data:W;.rsrc:R; vs .text:ER;.rdata:R;.data:W;.rsrc:R;.reloc:R;
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Unpacked PE file: 24.2.RageMP131.exe.400000.0.unpack .text:ER;.rdata:R;.data:W;.rsrc:R; vs .text:ER;.rdata:R;.data:W;.rsrc:R;.reloc:R;

Detected unpacking (overwrites its own PE header)

Source: C:\Users\user\Desktop\2zdult23rz.exe	Unpacked PE file: 0.2.2zdult23rz.exe.400000.0.unpack
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Unpacked PE file: 9.2.MPGPH131.exe.400000.0.unpack
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Unpacked PE file: 10.2.MPGPH131.exe.400000.0.unpack
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Unpacked PE file: 16.2.RageMP131.exe.400000.0.unpack
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Unpacked PE file: 24.2.RageMP131.exe.400000.0.unpack

Source: C:\Users\user\Desktop\2zdult23rz.exe

Code function: 0_2_004DB380 VirtualAllocEx,WriteProcessMemory,WriteProcessMemory,VirtualAllocEx,LoadLibraryA,GetProcAddress,WriteProcessMemory,WriteProcessMemory,CreateRemoteThread,WaitForSingleObject,

0_2_004DB380

Source: C:\Users\user\Desktop\2zdult23rz.exe	Code function: 0_2_0042E7E9 push ecx; ret	0_2_0042E7FC
Source: C:\Users\user\Desktop\2zdult23rz.exe	Code function: 0_2_0040A943 pushad ; iretd	0_2_0040A947
Source: C:\Users\user\Desktop\2zdult23rz.exe	Code function: 0_2_05CC5793 pushad ; iretd	0_2_05CC57CA
Source: C:\Users\user\Desktop\2zdult23rz.exe	Code function: 0_2_05CC4641 push ebp; retf	0_2_05CC4646
Source: C:\Users\user\Desktop\2zdult23rz.exe	Code function: 0_2_05CC7B4C push eax; ret	0_2_05CC7BC0
Source: C:\Users\user\Desktop\2zdult23rz.exe	Code function: 0_2_05CC7B6F push eax; ret	0_2_05CC7BC0
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 9_2_0042E7E9 push ecx; ret	9_2_0042E7FC
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 9_2_0040A943 pushad ; iretd	9_2_0040A947
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 9_2_05DF7793 pushad ; iretd	9_2_05DF77CA
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 9_2_05DF6641 push ebp; retf	9_2_05DF6646
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 9_2_05DF9B4C push eax; ret	9_2_05DF9BC0
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 9_2_05DF9B6F push eax; ret	9_2_05DF9BC0

Source: C:\Users\user\Desktop\2zdult23rz.exe	File created: C:\ProgramData\MPGPH131\MPGPH131.exe			Jump to dropped file
Source: C:\Users\user\Desktop\2zdult23rz.exe	File created: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe			Jump to dropped file

Source: C:\Users\user\Desktop\2zdult23rz.exe

File created: C:\ProgramData\MPGPH131\MPGPH131.exe

Jump to dropped file

Boot Survival

Uses schtasks.exe or at.exe to add and modify task schedules

Source: C:\Users\user\Desktop\2zdult23rz.exe

Process created: C:\Windows\SysWOW64\schtasks.exe schtasks /create /f /RU "user" /tr "C:\ProgramData\MPGPH131\MPGPH131.exe" /tn "MPGPH131 HR" /sc HOURLY /rl HIGHEST

Source: C:\Users\user\Desktop\2zdult23rz.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run RageMP131			Jump to behavior
Source: C:\Users\user\Desktop\2zdult23rz.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run RageMP131			Jump to behavior

Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX

Malware Analysis System Evasion

Found API chain indicative of sandbox detection

Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Sandbox detection routine: GetCursorPos, DecisionNode, Sleep			graph_9-61112
Source: C:\Users\user\Desktop\2zdult23rz.exe	Sandbox detection routine: GetCursorPos, DecisionNode, Sleep			graph_0-61088

Found evasive API chain (may stop execution after reading information in the PEB, e.g. number of processors)

Source: C:\Users\user\Desktop\2zdult23rz.exe	Evasive API call chain: GetPEB, DecisionNodes, Sleep			graph_0-61090
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Evasive API call chain: GetPEB, DecisionNodes, Sleep			graph_9-61113

Source: C:\Users\user\Desktop\2zdult23rz.exe	Code function: GetCursorPos,GetCursorPos,GetCursorPos,Sleep,GetCursorPos,Sleep,GetCursorPos,		0_2_0045A5C0
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: GetCursorPos,GetCursorPos,GetCursorPos,Sleep,GetCursorPos,Sleep,GetCursorPos,		9_2_0045A5C0

Source: C:\Users\user\Desktop\2zdult23rz.exe	Window / User API: threadDelayed 946	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Window / User API: threadDelayed 948	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Window / User API: threadDelayed 956	Jump to behavior
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Window / User API: threadDelayed 1299	Jump to behavior
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Window / User API: threadDelayed 1309

Source: C:\Users\user\Desktop\2zdult23rz.exe	Decision node followed by non-executed suspicious API: DecisionNode, Non Executed (send or recv or WinExec)			graph_0-61749
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Decision node followed by non-executed suspicious API: DecisionNode, Non Executed (send or recv or WinExec)			graph_9-61886

Source: C:\Users\user\Desktop\2zdult23rz.exe	Evasive API call chain: GetSystemTimeAsFileTime,DecisionNodes			graph_0-61142
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Evasive API call chain: GetSystemTimeAsFileTime,DecisionNodes			graph_9-61166

Source: C:\Users\user\Desktop\2zdult23rz.exe TID: 4236	Thread sleep count: 56 > 30	Jump to behavior
Source: C:\Users\user\Desktop\2zdult23rz.exe TID: 4236	Thread sleep count: 130 > 30	Jump to behavior
Source: C:\Users\user\Desktop\2zdult23rz.exe TID: 4236	Thread sleep count: 946 > 30	Jump to behavior
Source: C:\Users\user\Desktop\2zdult23rz.exe TID: 4236	Thread sleep time: -95546s >= -30000s	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe TID: 5996	Thread sleep count: 101 > 30	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe TID: 2308	Thread sleep count: 33 > 30	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe TID: 5996	Thread sleep count: 948 > 30	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe TID: 5996	Thread sleep time: -95748s >= -30000s	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe TID: 3108	Thread sleep count: 31 > 30	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe TID: 3108	Thread sleep count: 95 > 30	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe TID: 6136	Thread sleep count: 31 > 30	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe TID: 3108	Thread sleep count: 956 > 30	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe TID: 3108	Thread sleep time: -96556s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe TID: 5056	Thread sleep count: 31 > 30	Jump to behavior
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe TID: 5056	Thread sleep count: 1299 > 30	Jump to behavior
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe TID: 5056	Thread sleep time: -131199s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe TID: 1372	Thread sleep count: 161 > 30
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe TID: 1372	Thread sleep count: 1309 > 30
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe TID: 1372	Thread sleep time: -132209s >= -30000s

Source: C:\Users\user\Desktop\2zdult23rz.exe	Last function: Thread delayed
Source: C:\Users\user\Desktop\2zdult23rz.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Last function: Thread delayed
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Last function: Thread delayed
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Last function: Thread delayed
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Last function: Thread delayed
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Last function: Thread delayed
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Last function: Thread delayed
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Last function: Thread delayed
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Last function: Thread delayed

Source: C:\Users\user\Desktop\2zdult23rz.exe	Code function: 0_2_00550DF0 GetSystemTime followed by cmp: cmp eax, 04h and CTI: jc 00550E31h		0_2_00550DF0
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 9_2_00550DF0 GetSystemTime followed by cmp: cmp eax, 04h and CTI: jc 00550E31h		9_2_00550DF0

Source: C:\Users\user\Desktop\2zdult23rz.exe	Code function: 0_2_0044A4BD FindFirstFileExW,	0_2_0044A4BD
Source: C:\Users\user\Desktop\2zdult23rz.exe	Code function: 0_2_004F2870 FindFirstFileA,SetFileAttributesA,DeleteFileA,FindNextFileA,FindClose,GetLastError,SetFileAttributesA,GetLastError,RemoveDirectoryA,GetLastError,GetLastError,std::_Throw_Cpp_error,std::_Throw_Cpp_error,CreateDirectoryA,std::_Throw_Cpp_error,std::_Throw_Cpp_error,	0_2_004F2870
Source: C:\Users\user\Desktop\2zdult23rz.exe	Code function: 0_2_0042C82B FindClose,FindFirstFileExW,GetLastError,	0_2_0042C82B
Source: C:\Users\user\Desktop\2zdult23rz.exe	Code function: 0_2_0042C8B1 GetFileAttributesExW,GetLastError,FindFirstFileW,GetLastError,FindClose,___std_fs_open_handle@16,GetFileInformationByHandleEx,GetLastError,GetFileInformationByHandleEx,GetFileInformationByHandleEx,	0_2_0042C8B1
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 9_2_0044A4BD FindFirstFileExW,	9_2_0044A4BD
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 9_2_004F2870 FindFirstFileA,SetFileAttributesA,DeleteFileA,FindNextFileA,FindClose,GetLastError,SetFileAttributesA,GetLastError,RemoveDirectoryA,GetLastError,GetLastError,std::_Throw_Cpp_error,std::_Throw_Cpp_error,CreateDirectoryA,std::_Throw_Cpp_error,std::_Throw_Cpp_error,	9_2_004F2870
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 9_2_0042C82B FindClose,FindFirstFileExW,GetLastError,	9_2_0042C82B
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 9_2_0042C8B1 GetFileAttributesExW,GetLastError,FindFirstFileW,GetLastError,FindClose,___std_fs_open_handle@16,GetFileInformationByHandleEx,GetLastError,GetFileInformationByHandleEx,GetFileInformationByHandleEx,	9_2_0042C8B1

Source: C:\Users\user\Desktop\2zdult23rz.exe

Code function: 0_2_00452968 VirtualQuery,GetSystemInfo,

0_2_00452968

Source: Amcache.hve.8.dr	Binary or memory string: VMware
Source: Amcache.hve.8.dr	Binary or memory string: Ascsi/cdrom&ven_necvmwar&prod_vmware_sata_cd00/4&224f42ef&0&000000
Source: 2zdult23rz.exe, 00000000.00000002.3356067350.00000000044B1000.00000004.00000020.00020000.00000000.sdmp, 2zdult23rz.exe, 00000000.00000002.3356067350.0000000004482000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000009.00000002.3355895754.00000000044FD000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 0000000A.00000002.3355736939.00000000042F7000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 0000000A.00000002.3355736939.00000000042C0000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 00000010.00000002.3355352428.00000000044B9000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 00000010.00000002.3355352428.0000000004481000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: MPGPH131.exe, 00000009.00000002.3355895754.00000000044E6000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWen-GBn
Source: RageMP131.exe, 00000018.00000002.3356346368.0000000004238000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \\?\SCSI#Disk&Ven_VMware&Prod_Virtual_disk#4&1656f219&0&000000#{53f56307-b6bf-11d0-94f2-00a0c91efb8b}
Source: Amcache.hve.8.dr	Binary or memory string: pci\ven_15ad&dev_0740&subsys_074015ad,pci\ven_15ad&dev_0740,root\vmwvmcihostdev
Source: RageMP131.exe, 00000018.00000002.3356346368.0000000004221000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: SCSI\DISK&VEN_VMWARE&PROD_VIRTUAL_DISK\4&1656F219&0&000000&
Source: RageMP131.exe, 00000018.00000002.3356346368.00000000041D0000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: scsi#disk&ven_vmware&prod_virtual_disk#4&1656f219&0&000000#{53f56307-b6bf-11d0-94f2-00a0c91efb8b}
Source: Amcache.hve.8.dr	Binary or memory string: vmci.sys
Source: RageMP131.exe, 00000018.00000002.3356346368.0000000004221000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: #disk&ven_vmware&prod_virtual_disk#4&1656f219&0&000000#{53f56307-b6bf-11d0-94f2-00a0c91efb8b}
Source: Amcache.hve.8.dr	Binary or memory string: VMware20,1
Source: Amcache.hve.8.dr	Binary or memory string: Microsoft Hyper-V Generation Counter
Source: Amcache.hve.8.dr	Binary or memory string: NECVMWar VMware SATA CD00
Source: Amcache.hve.8.dr	Binary or memory string: VMware Virtual disk SCSI Disk Device
Source: Amcache.hve.8.dr	Binary or memory string: scsi\diskvmware__virtual_disk____2.0_,scsi\diskvmware__virtual_disk____,scsi\diskvmware__,scsi\vmware__virtual_disk____2,vmware__virtual_disk____2,gendisk
Source: Amcache.hve.8.dr	Binary or memory string: Microsoft Hyper-V Virtualization Infrastructure Driver
Source: Amcache.hve.8.dr	Binary or memory string: VMware PCI VMCI Bus Device
Source: Amcache.hve.8.dr	Binary or memory string: VMware VMCI Bus Device
Source: Amcache.hve.8.dr	Binary or memory string: VMware Virtual RAM
Source: MPGPH131.exe, 00000009.00000003.2162421913.00000000044C1000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \\?\SCSI#Disk&Ven_VMware&Prod_Virtual_disk#4&1656f219&0&000000#{53f56307-b6bf-11d0-94f2-00a0c91efb8b}q
Source: Amcache.hve.8.dr	Binary or memory string: BiosVendor:VMware, Inc.,BiosVersion:VMW201.00V.20829224.B64.2211211842,BiosReleaseDate:11/21/2022,BiosMajorRelease:0xff,BiosMinorRelease:0xff,SystemManufacturer:VMware, Inc.,SystemProduct:VMware20,1,SystemFamily:,SystemSKUNumber:,BaseboardManufacturer:,BaseboardProduct:,BaseboardVersion:,EnclosureType:0x1
Source: Amcache.hve.8.dr	Binary or memory string: vmci.inf_amd64_68ed49469341f563
Source: MPGPH131.exe, 00000009.00000002.3355895754.00000000044AA000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW8
Source: Amcache.hve.8.dr	Binary or memory string: VMware Virtual USB Mouse
Source: MPGPH131.exe, 0000000A.00000002.3355736939.00000000042CF000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: ?\#disk&ven_vmware&prouask#4&1656f219&0&0000f5-b6bf-11d0-94f2-00a08b
Source: Amcache.hve.8.dr	Binary or memory string: vmci.syshbin
Source: Amcache.hve.8.dr	Binary or memory string: VMware, Inc.
Source: RageMP131.exe, 00000018.00000002.3349068373.000000000019A000.00000004.00000010.00020000.00000000.sdmp	Binary or memory string: \\?\scsi#disk&ven_vmware&prod_virtual_disk#4&1656f219&0&000000#{53f56307-b6bf-11d0-94f2-00a0c91efb8b}
Source: RageMP131.exe, 00000018.00000002.3356346368.00000000041D0000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: scsi#disk&ven_vmware&prod_virtual_disk#4&1656f219&0&000000#{53f56307-b6bf-11d0-94f2-00a0c91efb8b}She
Source: Amcache.hve.8.dr	Binary or memory string: VMware20,1hbin@
Source: Amcache.hve.8.dr	Binary or memory string: c:\windows\system32\driverstore\filerepository\vmci.inf_amd64_68ed49469341f563
Source: MPGPH131.exe, 0000000A.00000003.2168017060.00000000042D7000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \\?\scsi#disk&ven_vmware&prod_virtual_disk#4&1656f219&0&000000#{53f56307-b6bf-11d0-94f2-00a0
Source: Amcache.hve.8.dr	Binary or memory string: .Z$c:/windows/system32/drivers/vmci.sys
Source: Amcache.hve.8.dr	Binary or memory string: VMware-42 27 80 4d 99 30 0e 9c-c1 9b 2a 23 ea 1f c4 20
Source: Amcache.hve.8.dr	Binary or memory string: :scsi/disk&ven_vmware&prod_virtual_disk/4&1656f219&0&000000
Source: Amcache.hve.8.dr	Binary or memory string: c:/windows/system32/drivers/vmci.sys
Source: Amcache.hve.8.dr	Binary or memory string: scsi/cdrom&ven_necvmwar&prod_vmware_sata_cd00/4&224f42ef&0&000000
Source: MPGPH131.exe, 0000000A.00000002.3355736939.00000000042EB000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW#
Source: RageMP131.exe, 00000018.00000002.3356346368.0000000004221000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll
Source: MPGPH131.exe, 00000009.00000002.3355895754.00000000044AA000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: SCSI\DISK&VEN_VMWARE&PROD_VIRTUAL_DISK\4&1656F219&0&000000&S
Source: Amcache.hve.8.dr	Binary or memory string: vmci.syshbin`
Source: Amcache.hve.8.dr	Binary or memory string: \driver\vmci,\driver\pci
Source: RageMP131.exe, 00000010.00000002.3355352428.0000000004490000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: isk&Ven_VMware&Prod_Virtual_disk#4&1656f219&0&000000#{53f56307-b6bf-11d0-94f2-00a0c91efb8b}
Source: Amcache.hve.8.dr	Binary or memory string: scsi/disk&ven_vmware&prod_virtual_disk/4&1656f219&0&000000
Source: Amcache.hve.8.dr	Binary or memory string: scsi\cdromnecvmwarvmware_sata_cd001.00,scsi\cdromnecvmwarvmware_sata_cd00,scsi\cdromnecvmwar,scsi\necvmwarvmware_sata_cd001,necvmwarvmware_sata_cd001,gencdrom
Source: 2zdult23rz.exe, 00000000.00000003.2114743179.0000000004494000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \\?\SCSI#Disk&Ven_VMware&Prod_Virtual_disk#4&1656f219&0&000000#{53f56307-b6bf-11d0-94f2-00a0c91efb8b}.
Source: RageMP131.exe, 00000010.00000002.3355352428.00000000044A5000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWL
Source: RageMP131.exe, 00000018.00000002.3356346368.00000000041D8000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \\?\scsi#disk&ven_vmware&prod_virtual_disk#4&1656f219&0&000000#{53f56307-b6bf-11d0-94f2-00a0c91efb8b}8?

Source: C:\Users\user\Desktop\2zdult23rz.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Desktop\2zdult23rz.exe	Process queried: DebugPort	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Process queried: DebugPort	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Process queried: DebugPort	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Process queried: DebugPort	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Process queried: DebugPort

Source: C:\Users\user\Desktop\2zdult23rz.exe

Code function: 0_2_004332F4 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,

0_2_004332F4

Source: C:\Users\user\Desktop\2zdult23rz.exe

Code function: 0_2_00453C30 Sleep,GetCurrentProcess,SetPriorityClass,SetUnhandledExceptionFilter,SetThreadExecutionState,SetThreadExecutionState,LoadLibraryA,GetModuleFileNameA,__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z,__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z,GetProcessId,__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z,SetThreadExecutionState,SetThreadExecutionState,LoadLibraryA,CreateThread,FindCloseChangeNotification,GetTempPathA,CreateDirectoryA,CreateDirectoryA,CreateDirectoryA,SetCurrentDirectoryA,__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z,OutputDebugStringA,OutputDebugStringA,OutputDebugStringA,CreateThread,CreateThread,CreateThread,OutputDebugStringA,CreateMutexA,GetLastError,Sleep,Sleep,Sleep,Sleep,Sleep,shutdown,closesocket,Sleep,

0_2_00453C30

Source: C:\Users\user\Desktop\2zdult23rz.exe

0_2_004DB380

Source: C:\Users\user\Desktop\2zdult23rz.exe	Code function: 0_2_0045A5C0 mov eax, dword ptr fs:[00000030h]	0_2_0045A5C0
Source: C:\Users\user\Desktop\2zdult23rz.exe	Code function: 0_2_0045A5C0 mov eax, dword ptr fs:[00000030h]	0_2_0045A5C0
Source: C:\Users\user\Desktop\2zdult23rz.exe	Code function: 0_2_004DF790 mov ecx, dword ptr fs:[00000030h]	0_2_004DF790
Source: C:\Users\user\Desktop\2zdult23rz.exe	Code function: 0_2_00453C30 mov eax, dword ptr fs:[00000030h]	0_2_00453C30
Source: C:\Users\user\Desktop\2zdult23rz.exe	Code function: 0_2_00453C30 mov ecx, dword ptr fs:[00000030h]	0_2_00453C30
Source: C:\Users\user\Desktop\2zdult23rz.exe	Code function: 0_2_004D3280 mov eax, dword ptr fs:[00000030h]	0_2_004D3280
Source: C:\Users\user\Desktop\2zdult23rz.exe	Code function: 0_2_004D1380 mov eax, dword ptr fs:[00000030h]	0_2_004D1380
Source: C:\Users\user\Desktop\2zdult23rz.exe	Code function: 0_2_004E2C80 mov eax, dword ptr fs:[00000030h]	0_2_004E2C80
Source: C:\Users\user\Desktop\2zdult23rz.exe	Code function: 0_2_05CC30A3 push dword ptr fs:[00000030h]	0_2_05CC30A3
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 9_2_0045A5C0 mov eax, dword ptr fs:[00000030h]	9_2_0045A5C0
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 9_2_0045A5C0 mov eax, dword ptr fs:[00000030h]	9_2_0045A5C0
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 9_2_004DF790 mov ecx, dword ptr fs:[00000030h]	9_2_004DF790
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 9_2_00453C30 mov eax, dword ptr fs:[00000030h]	9_2_00453C30
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 9_2_00453C30 mov ecx, dword ptr fs:[00000030h]	9_2_00453C30
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 9_2_004D3280 mov eax, dword ptr fs:[00000030h]	9_2_004D3280
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 9_2_004D1380 mov eax, dword ptr fs:[00000030h]	9_2_004D1380
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 9_2_004E2C80 mov eax, dword ptr fs:[00000030h]	9_2_004E2C80
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 9_2_05DF50A3 push dword ptr fs:[00000030h]	9_2_05DF50A3

Source: C:\Users\user\Desktop\2zdult23rz.exe

Code function: 0_2_004FA050 GetProcessHeap,InternetOpenA,InternetOpenUrlA,InternetReadFile,InternetReadFile,InternetCloseHandle,InternetCloseHandle,

0_2_004FA050

Source: C:\Users\user\Desktop\2zdult23rz.exe	Code function: 0_2_00453C30 Sleep,GetCurrentProcess,SetPriorityClass,SetUnhandledExceptionFilter,SetThreadExecutionState,SetThreadExecutionState,LoadLibraryA,GetModuleFileNameA,__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z,__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z,GetProcessId,__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z,SetThreadExecutionState,SetThreadExecutionState,LoadLibraryA,CreateThread,FindCloseChangeNotification,GetTempPathA,CreateDirectoryA,CreateDirectoryA,CreateDirectoryA,SetCurrentDirectoryA,__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z,OutputDebugStringA,OutputDebugStringA,OutputDebugStringA,CreateThread,CreateThread,CreateThread,OutputDebugStringA,CreateMutexA,GetLastError,Sleep,Sleep,Sleep,Sleep,Sleep,shutdown,closesocket,Sleep,	0_2_00453C30
Source: C:\Users\user\Desktop\2zdult23rz.exe	Code function: 0_2_004332F4 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	0_2_004332F4
Source: C:\Users\user\Desktop\2zdult23rz.exe	Code function: 0_2_0042EA14 IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	0_2_0042EA14
Source: C:\Users\user\Desktop\2zdult23rz.exe	Code function: 0_2_0042EDAD SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	0_2_0042EDAD
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 9_2_00453C30 Sleep,GetCurrentProcess,SetPriorityClass,SetUnhandledExceptionFilter,SetThreadExecutionState,SetThreadExecutionState,LoadLibraryA,GetModuleFileNameA,__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z,__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z,GetProcessId,__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z,SetThreadExecutionState,SetThreadExecutionState,LoadLibraryA,CreateThread,FindCloseChangeNotification,GetTempPathA,CreateDirectoryA,CreateDirectoryA,CreateDirectoryA,SetCurrentDirectoryA,__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z,OutputDebugStringA,OutputDebugStringA,OutputDebugStringA,CreateThread,CreateThread,CreateThread,OutputDebugStringA,CreateMutexA,GetLastError,Sleep,Sleep,Sleep,Sleep,Sleep,shutdown,closesocket,Sleep,	9_2_00453C30
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 9_2_004332F4 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	9_2_004332F4
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 9_2_0042EA14 IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	9_2_0042EA14
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 9_2_0042EDAD SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	9_2_0042EDAD

HIPS / PFW / Operating System Protection Evasion

Contains functionality to inject threads in other processes

Source: C:\Users\user\Desktop\2zdult23rz.exe	Code function: 0_2_004DB380 VirtualAllocEx,WriteProcessMemory,WriteProcessMemory,VirtualAllocEx,LoadLibraryA,GetProcAddress,WriteProcessMemory,WriteProcessMemory,CreateRemoteThread,WaitForSingleObject,		0_2_004DB380
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: 9_2_004DB380 VirtualAllocEx,WriteProcessMemory,WriteProcessMemory,VirtualAllocEx,LoadLibraryA,GetProcAddress,WriteProcessMemory,WriteProcessMemory,CreateRemoteThread,WaitForSingleObject,		9_2_004DB380

Source: C:\Users\user\Desktop\2zdult23rz.exe

Code function: 0_2_0042E615 cpuid

0_2_0042E615

Source: C:\Users\user\Desktop\2zdult23rz.exe	Code function: GetACP,IsValidCodePage,GetLocaleInfoW,	0_2_0044D3EB
Source: C:\Users\user\Desktop\2zdult23rz.exe	Code function: GetLocaleInfoW,	0_2_0044D5F0
Source: C:\Users\user\Desktop\2zdult23rz.exe	Code function: GetLocaleInfoEx,FormatMessageA,	0_2_0042C623
Source: C:\Users\user\Desktop\2zdult23rz.exe	Code function: EnumSystemLocalesW,	0_2_0044D6E2
Source: C:\Users\user\Desktop\2zdult23rz.exe	Code function: EnumSystemLocalesW,	0_2_0044D697
Source: C:\Users\user\Desktop\2zdult23rz.exe	Code function: EnumSystemLocalesW,	0_2_0044D77D
Source: C:\Users\user\Desktop\2zdult23rz.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetLocaleInfoW,	0_2_0044D808
Source: C:\Users\user\Desktop\2zdult23rz.exe	Code function: EnumSystemLocalesW,	0_2_00445A41
Source: C:\Users\user\Desktop\2zdult23rz.exe	Code function: GetLocaleInfoW,	0_2_0044DA5B
Source: C:\Users\user\Desktop\2zdult23rz.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetACP,	0_2_0044DB84
Source: C:\Users\user\Desktop\2zdult23rz.exe	Code function: GetLocaleInfoW,	0_2_0044DC8A
Source: C:\Users\user\Desktop\2zdult23rz.exe	Code function: GetUserDefaultLCID,IsValidCodePage,IsValidLocale,GetLocaleInfoW,GetLocaleInfoW,	0_2_0044DD60
Source: C:\Users\user\Desktop\2zdult23rz.exe	Code function: GetLocaleInfoW,	0_2_00445FC4
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: GetACP,IsValidCodePage,GetLocaleInfoW,	9_2_0044D3EB
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: GetLocaleInfoW,	9_2_0044D5F0
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: GetLocaleInfoEx,FormatMessageA,	9_2_0042C623
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: EnumSystemLocalesW,	9_2_0044D6E2
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: EnumSystemLocalesW,	9_2_0044D697
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: EnumSystemLocalesW,	9_2_0044D77D
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetLocaleInfoW,	9_2_0044D808
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: EnumSystemLocalesW,	9_2_00445A41
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: GetLocaleInfoW,	9_2_0044DA5B
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetACP,	9_2_0044DB84
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: GetLocaleInfoW,	9_2_0044DC8A
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: GetUserDefaultLCID,IsValidCodePage,IsValidLocale,GetLocaleInfoW,GetLocaleInfoW,	9_2_0044DD60
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Code function: GetLocaleInfoW,	9_2_00445FC4

Source: C:\Users\user\Desktop\2zdult23rz.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Queries volume information: C:\ VolumeInformation

Source: C:\Users\user\Desktop\2zdult23rz.exe

Code function: 0_2_0043C1FB GetSystemTimeAsFileTime,__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z,

0_2_0043C1FB

Source: C:\Users\user\Desktop\2zdult23rz.exe

Code function: 0_2_004479BE GetTimeZoneInformation,

0_2_004479BE

Source: C:\Users\user\Desktop\2zdult23rz.exe

Code function: 0_2_00551070 GetVersionExA,GetFileAttributesW,GetFileAttributesA,

0_2_00551070

Source: C:\Users\user\Desktop\2zdult23rz.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Source: Amcache.hve.8.dr	Binary or memory string: c:\programdata\microsoft\windows defender\platform\4.18.23080.2006-0\msmpeng.exe
Source: Amcache.hve.8.dr	Binary or memory string: msmpeng.exe
Source: Amcache.hve.8.dr	Binary or memory string: c:\program files\windows defender\msmpeng.exe
Source: Amcache.hve.8.dr	Binary or memory string: c:\programdata\microsoft\windows defender\platform\4.18.23090.2008-0\msmpeng.exe
Source: Amcache.hve.8.dr	Binary or memory string: MsMpEng.exe

Stealing of Sensitive Information

Yara detected RisePro Stealer

Source: Yara match	File source: Process Memory Space: 2zdult23rz.exe PID: 1948, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: MPGPH131.exe PID: 6080, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: MPGPH131.exe PID: 2996, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: RageMP131.exe PID: 5092, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: RageMP131.exe PID: 6024, type: MEMORYSTR

Remote Access Functionality

Yara detected RisePro Stealer

Source: Yara match	File source: Process Memory Space: 2zdult23rz.exe PID: 1948, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: MPGPH131.exe PID: 6080, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: MPGPH131.exe PID: 2996, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: RageMP131.exe PID: 5092, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: RageMP131.exe PID: 6024, type: MEMORYSTR

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	12 Native API	1 DLL Side-Loading	1 DLL Side-Loading	1 Deobfuscate/Decode Files or Information	OS Credential Dumping	12 System Time Discovery	Remote Services	1 Archive Collected Data	2 Ingress Tool Transfer	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	3 Command and Scripting Interpreter	1 Scheduled Task/Job	11 Process Injection	2 Obfuscated Files or Information	LSASS Memory	1 File and Directory Discovery	Remote Desktop Protocol	1 Screen Capture	21 Encrypted Channel	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	1 Scheduled Task/Job	1 Registry Run Keys / Startup Folder	1 Scheduled Task/Job	2 Software Packing	Security Account Manager	36 System Information Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	1 Non-Standard Port	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	1 Registry Run Keys / Startup Folder	1 DLL Side-Loading	NTDS	261 Security Software Discovery	Distributed Component Object Model	Input Capture	2 Non-Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 Masquerading	LSA Secrets	12 Virtualization/Sandbox Evasion	SSH	Keylogging	13 Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	12 Virtualization/Sandbox Evasion	Cached Domain Credentials	1 Process Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	11 Process Injection	DCSync	1 Application Window Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	Indicator Removal from Tools	Proc Filesystem	1 System Network Configuration Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
2zdult23rz.exe	82%	ReversingLabs	Win32.Trojan.Privateloader
2zdult23rz.exe	77%	Virustotal		Browse
2zdult23rz.exe	100%	Avira	HEUR/AGEN.1313019
2zdult23rz.exe	100%	Joe Sandbox ML

Dropped Files

Source	Detection	Scanner	Label	Link
C:\ProgramData\MPGPH131\MPGPH131.exe	100%	Avira	HEUR/AGEN.1313019
C:\ProgramData\MPGPH131\MPGPH131.exe	100%	Joe Sandbox ML
C:\ProgramData\MPGPH131\MPGPH131.exe	82%	ReversingLabs	Win32.Trojan.Privateloader
C:\ProgramData\MPGPH131\MPGPH131.exe	77%	Virustotal		Browse
C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	82%	ReversingLabs	Win32.Trojan.Privateloader
C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	77%	Virustotal		Browse

Name	IP	Active	Malicious	Antivirus Detection	Reputation
ipinfo.io	34.117.186.192	true	false		high
db-ip.com	104.26.4.15	true	false		high

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
https://ipinfo.io/widget/demo/149.18.24.96	false		high
https://db-ip.com/demo/home.php?s=149.18.24.96	false		high

URLs from Memory and Binaries

Name	Source	Malicious	Reputation
https://ipinfo.io:443/widget/demo/149.18.24.96	MPGPH131.exe, 0000000A.00000002.3355736939.00000000042EB000.00000004.00000020.00020000.00000000.sdmp	false	high
http://www.winimage.com/zLibD	2zdult23rz.exe, 00000000.00000002.3357800955.0000000005CC3000.00000040.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000009.00000002.3356779154.0000000005DF5000.00000040.00000020.00020000.00000000.sdmp, MPGPH131.exe, 0000000A.00000002.3356453066.0000000005C1A000.00000040.00000020.00020000.00000000.sdmp, RageMP131.exe, 00000010.00000002.3356388466.0000000005CCC000.00000040.00000020.00020000.00000000.sdmp, RageMP131.exe, 00000018.00000002.3357697042.0000000005D4D000.00000040.00000020.00020000.00000000.sdmp	false	high
https://db-ip.com/demo/home.php?s=149.18.24.96o#	MPGPH131.exe, 0000000A.00000002.3355736939.00000000042F7000.00000004.00000020.00020000.00000000.sdmp	false	high
https://db-ip.com/U	2zdult23rz.exe, 00000000.00000002.3356067350.00000000044B1000.00000004.00000020.00020000.00000000.sdmp	false	high
https://db-ip.com/	MPGPH131.exe, 00000009.00000002.3355895754.00000000044FD000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 00000010.00000002.3355352428.00000000044B9000.00000004.00000020.00020000.00000000.sdmp	false	high
http://upx.sf.net	Amcache.hve.8.dr	false	high
https://t.me/RiseProSUPPORT	2zdult23rz.exe, 00000000.00000002.3356067350.000000000442E000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000009.00000002.3355895754.000000000445E000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 0000000A.00000002.3355736939.0000000004277000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 00000010.00000002.3355352428.000000000442E000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 00000018.00000002.3356346368.00000000041D8000.00000004.00000020.00020000.00000000.sdmp	false	high
https://db-ip.com/Or	RageMP131.exe, 00000010.00000002.3355352428.00000000044B9000.00000004.00000020.00020000.00000000.sdmp	false	high
https://ipinfo.io/Mozilla/5.0	2zdult23rz.exe, 00000000.00000002.3356067350.00000000044A6000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000009.00000002.3355895754.00000000044E6000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 0000000A.00000002.3355736939.00000000042EB000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 00000010.00000002.3355352428.00000000044A5000.00000004.00000020.00020000.00000000.sdmp	false	high
https://db-ip.com/89	MPGPH131.exe, 00000009.00000002.3355895754.00000000044FD000.00000004.00000020.00020000.00000000.sdmp	false	high
https://ipinfo.io/Content-Type:	2zdult23rz.exe, 00000000.00000003.2065919760.0000000006030000.00000004.00001000.00020000.00000000.sdmp, 2zdult23rz.exe, 00000000.00000002.3349183063.0000000000400000.00000040.00000001.01000000.00000003.sdmp, 2zdult23rz.exe, 00000000.00000002.3357963980.0000000005E90000.00000040.00001000.00020000.00000000.sdmp, MPGPH131.exe, 00000009.00000002.3357144489.0000000005F90000.00000040.00001000.00020000.00000000.sdmp, MPGPH131.exe, 00000009.00000003.2120691078.0000000006130000.00000004.00001000.00020000.00000000.sdmp, MPGPH131.exe, 00000009.00000002.3349156602.0000000000400000.00000040.00000001.01000000.00000005.sdmp, MPGPH131.exe, 0000000A.00000002.3356718132.0000000005F10000.00000040.00001000.00020000.00000000.sdmp, MPGPH131.exe, 0000000A.00000002.3349162153.0000000000400000.00000040.00000001.01000000.00000005.sdmp, MPGPH131.exe, 0000000A.00000003.2143542863.00000000060B0000.00000004.00001000.00020000.00000000.sdmp, RageMP131.exe, 00000010.00000002.3356555753.0000000005DA0000.00000040.00001000.00020000.00000000.sdmp, RageMP131.exe, 00000010.00000003.2249432581.0000000006040000.00000004.00001000.00020000.00000000.sdmp, RageMP131.exe, 00000010.00000002.3349183258.0000000000400000.00000040.00000001.01000000.00000006.sdmp, RageMP131.exe, 00000010.00000001.2249277297.00000000004E6000.00000004.00000001.01000000.00000006.sdmp, RageMP131.exe, 00000018.00000002.3349156812.0000000000400000.00000040.00000001.01000000.00000006.sdmp, RageMP131.exe, 00000018.00000003.2350560646.0000000006080000.00000004.00001000.00020000.00000000.sdmp, RageMP131.exe, 00000018.00000002.3357977475.0000000005EE0000.00000040.00001000.00020000.00000000.sdmp	false	high
https://db-ip.com/demo/home.php?s=149.18.24.965	MPGPH131.exe, 0000000A.00000002.3355736939.00000000042F7000.00000004.00000020.00020000.00000000.sdmp	false	high
https://t.me/RiseProSUPPORTX	2zdult23rz.exe, 00000000.00000002.3356067350.000000000442E000.00000004.00000020.00020000.00000000.sdmp	false	high
https://db-ip.com/?	MPGPH131.exe, 0000000A.00000002.3355736939.00000000042F7000.00000004.00000020.00020000.00000000.sdmp	false	high
https://ipinfo.io/	RageMP131.exe, 00000010.00000002.3355352428.000000000447C000.00000004.00000020.00020000.00000000.sdmp	false	high
https://ipinfo.io:443/widget/demo/149.18.24.96B	2zdult23rz.exe, 00000000.00000002.3356067350.00000000044A6000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 00000010.00000002.3355352428.00000000044A5000.00000004.00000020.00020000.00000000.sdmp	false	high
https://ipinfo.io/widget/demo/149.18.24.96a	MPGPH131.exe, 00000009.00000002.3355895754.00000000044E6000.00000004.00000020.00020000.00000000.sdmp	false	high
https://www.maxmind.com/en/locate-my-ip-address	2zdult23rz.exe, 2zdult23rz.exe, 00000000.00000003.2065919760.0000000006030000.00000004.00001000.00020000.00000000.sdmp, 2zdult23rz.exe, 00000000.00000002.3349183063.0000000000400000.00000040.00000001.01000000.00000003.sdmp, 2zdult23rz.exe, 00000000.00000002.3357963980.0000000005E90000.00000040.00001000.00020000.00000000.sdmp, MPGPH131.exe, MPGPH131.exe, 00000009.00000002.3357144489.0000000005F90000.00000040.00001000.00020000.00000000.sdmp, MPGPH131.exe, 00000009.00000003.2120691078.0000000006130000.00000004.00001000.00020000.00000000.sdmp, MPGPH131.exe, 00000009.00000002.3349156602.0000000000400000.00000040.00000001.01000000.00000005.sdmp, MPGPH131.exe, 0000000A.00000002.3356718132.0000000005F10000.00000040.00001000.00020000.00000000.sdmp, MPGPH131.exe, 0000000A.00000002.3349162153.0000000000400000.00000040.00000001.01000000.00000005.sdmp, MPGPH131.exe, 0000000A.00000003.2143542863.00000000060B0000.00000004.00001000.00020000.00000000.sdmp, RageMP131.exe, 00000010.00000002.3356555753.0000000005DA0000.00000040.00001000.00020000.00000000.sdmp, RageMP131.exe, 00000010.00000003.2249432581.0000000006040000.00000004.00001000.00020000.00000000.sdmp, RageMP131.exe, 00000010.00000002.3349183258.0000000000400000.00000040.00000001.01000000.00000006.sdmp, RageMP131.exe, 00000010.00000001.2249277297.00000000004E6000.00000004.00000001.01000000.00000006.sdmp, RageMP131.exe, 00000018.00000002.3349156812.0000000000400000.00000040.00000001.01000000.00000006.sdmp, RageMP131.exe, 00000018.00000003.2350560646.0000000006080000.00000004.00001000.00020000.00000000.sdmp, RageMP131.exe, 00000018.00000002.3357977475.0000000005EE0000.00000040.00001000.00020000.00000000.sdmp	false	high
https://db-ip.com:443/demo/home.php?s=149.18.24.968	2zdult23rz.exe, 00000000.00000002.3356067350.00000000044B1000.00000004.00000020.00020000.00000000.sdmp	false	high
https://db-ip.com/demo/home.php?s=149.18.24.96F5	MPGPH131.exe, 00000009.00000002.3355895754.00000000044FD000.00000004.00000020.00020000.00000000.sdmp	false	high
https://ipinfo.io:443/widget/demo/149.18.24.96E	MPGPH131.exe, 00000009.00000002.3355895754.00000000044E6000.00000004.00000020.00020000.00000000.sdmp	false	high
https://db-ip.com:443/demo/home.php?s=149.18.24.96	MPGPH131.exe, 00000009.00000002.3355895754.00000000044FD000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 0000000A.00000002.3355736939.00000000042F7000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 00000010.00000002.3355352428.00000000044B9000.00000004.00000020.00020000.00000000.sdmp	false	high
http://www.winimage.com/zLibDll	RageMP131.exe, 00000018.00000002.3357977475.0000000005EE0000.00000040.00001000.00020000.00000000.sdmp	false	high
https://ipinfo.io/n	MPGPH131.exe, 0000000A.00000002.3355736939.00000000042B0000.00000004.00000020.00020000.00000000.sdmp	false	high
https://db-ip.com/I	2zdult23rz.exe, 00000000.00000002.3356067350.00000000044B1000.00000004.00000020.00020000.00000000.sdmp	false	high
https://db-ip.com/X9	MPGPH131.exe, 00000009.00000002.3355895754.00000000044FD000.00000004.00000020.00020000.00000000.sdmp	false	high
https://db-ip.com/ur	RageMP131.exe, 00000010.00000002.3355352428.00000000044B9000.00000004.00000020.00020000.00000000.sdmp	false	high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
34.117.186.192	ipinfo.io	United States	139070	GOOGLE-AS-APGoogleAsiaPacificPteLtdSG	false
147.45.47.93	unknown	Russian Federation	2895	FREE-NET-ASFREEnetEU	true
104.26.4.15	db-ip.com	United States	13335	CLOUDFLARENETUS	false

General Information

Joe Sandbox version:	40.0.0 Tourmaline
Analysis ID:	1434701
Start date and time:	2024-05-01 16:39:23 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 8m 54s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	42
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	2zdult23rz.exe renamed because original name is a hash value
Original Sample Name:	733c1261cf02626f2354e6339baa6717.exe
Detection:	MAL
Classification:	mal100.troj.evad.winEXE@24/58@2/3
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 83% Number of executed functions: 51 Number of non-executed functions: 184
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, WerFault.exe, SIHClient.exe, svchost.exe
Excluded domains from analysis (whitelisted): ocsp.digicert.com, slscr.update.microsoft.com, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com
Not all processes where analyzed, report is missing behavior information
Report creation exceeded maximum time and may have missing disassembly code information.
Report size exceeded maximum capacity and may have missing behavior information.
Report size exceeded maximum capacity and may have missing disassembly code.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtQueryValueKey calls found.

Simulations

Behavior and APIs

Time	Type	Description
16:40:12	Task Scheduler	Run new task: MPGPH131 HR path: C:\ProgramData\MPGPH131\MPGPH131.exe
16:40:13	Task Scheduler	Run new task: MPGPH131 LG path: C:\ProgramData\MPGPH131\MPGPH131.exe
16:40:13	Autostart	Run: HKCU\Software\Microsoft\Windows\CurrentVersion\Run RageMP131 C:\Users\user\AppData\Local\RageMP131\RageMP131.exe
16:40:26	Autostart	Run: HKCU64\Software\Microsoft\Windows\CurrentVersion\Run RageMP131 C:\Users\user\AppData\Local\RageMP131\RageMP131.exe
16:41:28	API Interceptor	2140x Sleep call for process: RageMP131.exe modified
16:41:34	API Interceptor	1431x Sleep call for process: MPGPH131.exe modified
16:41:35	API Interceptor	710x Sleep call for process: 2zdult23rz.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
34.117.186.192	SecuriteInfo.com.Win32.Evo-gen.24318.16217.exe	Get hash	malicious	Unknown	Browse	ipinfo.io/json
	SecuriteInfo.com.Win32.Evo-gen.28489.31883.exe	Get hash	malicious	Unknown	Browse	ipinfo.io/json
	Raptor.HardwareService.Setup 1.msi	Get hash	malicious	Unknown	Browse	ipinfo.io/ip
	Conferma_Pdf_Editor.exe	Get hash	malicious	Planet Stealer	Browse	ipinfo.io/
	Conferma_Pdf_Editor.exe	Get hash	malicious	Planet Stealer	Browse	ipinfo.io/
	w.sh	Get hash	malicious	Xmrig	Browse	/ip
	Raptor.HardwareService.Setup_2.3.6.0.msi	Get hash	malicious	Unknown	Browse	ipinfo.io/ip
	Raptor.HardwareService.Setup_2.3.6.0.msi	Get hash	malicious	Unknown	Browse	ipinfo.io/ip
	uUsgzQ3DoW.exe	Get hash	malicious	RedLine	Browse	ipinfo.io/ip
	8BZBgbeCcz.exe	Get hash	malicious	RedLine	Browse	ipinfo.io/ip
147.45.47.93	file.exe	Get hash	malicious	RisePro Stealer	Browse
	WlCIinu0yp.exe	Get hash	malicious	LummaC Stealer, PureLog Stealer, RedLine, RisePro Stealer, Socks5Systemz, Vidar, zgRAT	Browse
	file.exe	Get hash	malicious	LummaC, GCleaner, Glupteba, LummaC Stealer, Mars Stealer, PureLog Stealer, RedLine	Browse
	file.exe	Get hash	malicious	LummaC, PureLog Stealer, RedLine, RisePro Stealer, Vidar, zgRAT	Browse
	SecuriteInfo.com.Win32.TrojanX-gen.3413.25873.exe	Get hash	malicious	RisePro Stealer	Browse
	file.exe	Get hash	malicious	RisePro Stealer	Browse
	file.exe	Get hash	malicious	RisePro Stealer	Browse
	file.exe	Get hash	malicious	RisePro Stealer	Browse
	file.exe	Get hash	malicious	Amadey, PureLog Stealer, RedLine, RisePro Stealer, zgRAT	Browse
	ygm2mXUReY.exe	Get hash	malicious	RisePro Stealer	Browse
104.26.4.15	#Ud3ec#Ud2b8#Ud3f4#Ub9ac#Uc624.exe	Get hash	malicious	Nemty, Xmrig	Browse	api.db-ip.com/v2/free/102.129.152.212/countryName

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
ipinfo.io	MegaUniversesMQ.exe	Get hash	malicious	Unknown	Browse	34.117.186.192
	file.exe	Get hash	malicious	RisePro Stealer	Browse	34.117.186.192
	MegaUniversesMQ.exe	Get hash	malicious	Unknown	Browse	34.117.186.192
	file.exe	Get hash	malicious	Clipboard Hijacker, RisePro Stealer	Browse	34.117.186.192
	WlCIinu0yp.exe	Get hash	malicious	LummaC Stealer, PureLog Stealer, RedLine, RisePro Stealer, Socks5Systemz, Vidar, zgRAT	Browse	34.117.186.192
	TomeluxGamex.exe	Get hash	malicious	Unknown	Browse	34.117.186.192
	file.exe	Get hash	malicious	Clipboard Hijacker, RisePro Stealer	Browse	34.117.186.192
	TomeluxGamex.exe	Get hash	malicious	Unknown	Browse	34.117.186.192
	file.exe	Get hash	malicious	LummaC, PureLog Stealer, RedLine, RisePro Stealer, Vidar, zgRAT	Browse	34.117.186.192
	yWOtU2Escv.exe	Get hash	malicious	DCRat, PureLog Stealer, zgRAT	Browse	34.117.186.192
db-ip.com	file.exe	Get hash	malicious	RisePro Stealer	Browse	104.26.5.15
	file.exe	Get hash	malicious	Clipboard Hijacker, RisePro Stealer	Browse	104.26.5.15
	WlCIinu0yp.exe	Get hash	malicious	LummaC Stealer, PureLog Stealer, RedLine, RisePro Stealer, Socks5Systemz, Vidar, zgRAT	Browse	104.26.4.15
	file.exe	Get hash	malicious	Clipboard Hijacker, RisePro Stealer	Browse	104.26.4.15
	file.exe	Get hash	malicious	LummaC, PureLog Stealer, RedLine, RisePro Stealer, Vidar, zgRAT	Browse	104.26.4.15
	SecuriteInfo.com.Win32.TrojanX-gen.3413.25873.exe	Get hash	malicious	RisePro Stealer	Browse	172.67.75.166
	file.exe	Get hash	malicious	RisePro Stealer	Browse	104.26.4.15
	file.exe	Get hash	malicious	RisePro Stealer	Browse	104.26.5.15
	file.exe	Get hash	malicious	RisePro Stealer	Browse	104.26.4.15
	j1zkOQTx4q.exe	Get hash	malicious	RisePro Stealer	Browse	172.67.75.166

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
GOOGLE-AS-APGoogleAsiaPacificPteLtdSG	MegaUniversesMQ.exe	Get hash	malicious	Unknown	Browse	34.117.186.192
	file.exe	Get hash	malicious	RisePro Stealer	Browse	34.117.186.192
	MegaUniversesMQ.exe	Get hash	malicious	Unknown	Browse	34.117.186.192
	file.exe	Get hash	malicious	Clipboard Hijacker, RisePro Stealer	Browse	34.117.186.192
	VOrqSh1Fts.exe	Get hash	malicious	Neoreklami, PureLog Stealer	Browse	34.117.186.192
	WlCIinu0yp.exe	Get hash	malicious	LummaC Stealer, PureLog Stealer, RedLine, RisePro Stealer, Socks5Systemz, Vidar, zgRAT	Browse	34.117.186.192
	TomeluxGamex.exe	Get hash	malicious	Unknown	Browse	34.117.186.192
	file.exe	Get hash	malicious	Clipboard Hijacker, RisePro Stealer	Browse	34.117.186.192
	TomeluxGamex.exe	Get hash	malicious	Unknown	Browse	34.117.186.192
	https://vpassz.xu4nblog.com/	Get hash	malicious	Unknown	Browse	34.117.152.183
FREE-NET-ASFREEnetEU	file.exe	Get hash	malicious	RisePro Stealer	Browse	147.45.47.93
	file.exe	Get hash	malicious	Clipboard Hijacker, RisePro Stealer	Browse	193.233.132.175
	fBirvIlaOJ.exe	Get hash	malicious	RedLine	Browse	147.45.47.36
	VOrqSh1Fts.exe	Get hash	malicious	Neoreklami, PureLog Stealer	Browse	193.233.132.234
	WlCIinu0yp.exe	Get hash	malicious	LummaC Stealer, PureLog Stealer, RedLine, RisePro Stealer, Socks5Systemz, Vidar, zgRAT	Browse	147.45.47.93
	file.exe	Get hash	malicious	Clipboard Hijacker, RisePro Stealer	Browse	193.233.132.47
	file.exe	Get hash	malicious	LummaC, GCleaner, Glupteba, LummaC Stealer, Mars Stealer, PureLog Stealer, RedLine	Browse	147.45.47.93
	http://147.45.47.87	Get hash	malicious	Unknown	Browse	147.45.47.87
	Document.doc.scr	Get hash	malicious	LockBit ransomware, TrojanRansom	Browse	193.233.132.177
	http://193.233.132.177/lbb.exe	Get hash	malicious	LockBit ransomware	Browse	193.233.132.177
CLOUDFLARENETUS	lfY08S61Ig.exe	Get hash	malicious	LummaC	Browse	104.21.81.139
	TET8iWY1w4.exe	Get hash	malicious	LummaC	Browse	172.67.141.11
	Price List MAYQTRA031244PDF.scr.exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse	104.21.13.139
	DHL EXPRESS.exe	Get hash	malicious	AgentTesla	Browse	104.26.12.205
	https://lookerstudio.google.com/s/pgWlVLRPJcs	Get hash	malicious	HTMLPhisher	Browse	172.67.182.192
	ET2431000075 & ET2431000076.xls	Get hash	malicious	AgentTesla, PureLog Stealer	Browse	172.67.74.152
	https://lp.vp4.me/twfz	Get hash	malicious	HTMLPhisher	Browse	104.17.64.14
	https://content.amanet.org/?m=CiGW.81UwlU3LD6ZH5M4ZoUXv03dAeWfC&r=https://oqiofchbb.cc.rs6.net/tn.jsp?f=001BrGNaLx5EeYT_D9fsttV9hkRaiqNiDYaatz2JV1ZFS38OJIO7WDvwvls52JcOf9z0GAE4dsuLNrEnND6nATJv3j2YQCaUptLy5L9CxqOG_pPtRB4Vlyts4RZlTRfQCbNmVNITwfGgXHfNY6m6WqVC0Xow94NtcEBBj9rVxJNygE==&c=Xts0vtSVfvt9rsVB5GMJrKbHLtDWSm9FdbWu5-xbxK7tN8TvEfkm_Q==&ch=ivuAXLyORIUuV_QkeQerj6L34kBmHi11eQ4csUXdnMhDRyXEYbCfBA====&__=/V5C/ksaffold@stepan.com	Get hash	malicious	HTMLPhisher	Browse	104.17.2.184
	Play_Now.htm	Get hash	malicious	HTMLPhisher	Browse	104.17.2.184
	https://goo.su/l1bfUYR	Get hash	malicious	Unknown	Browse	172.67.139.105

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
a0e9f5d64349fb13191bc781f81f42e1	lfY08S61Ig.exe	Get hash	malicious	LummaC	Browse	34.117.186.192 104.26.4.15
	TET8iWY1w4.exe	Get hash	malicious	LummaC	Browse	34.117.186.192 104.26.4.15
	file.exe	Get hash	malicious	RisePro Stealer	Browse	34.117.186.192 104.26.4.15
	file.exe	Get hash	malicious	Clipboard Hijacker, RisePro Stealer	Browse	34.117.186.192 104.26.4.15
	Categories 30-04-2024.xlsx	Get hash	malicious	Unknown	Browse	34.117.186.192 104.26.4.15
	Replace.exe	Get hash	malicious	Unknown	Browse	34.117.186.192 104.26.4.15
	WlCIinu0yp.exe	Get hash	malicious	LummaC Stealer, PureLog Stealer, RedLine, RisePro Stealer, Socks5Systemz, Vidar, zgRAT	Browse	34.117.186.192 104.26.4.15
	Invoice-939713625-008-5283127-8901604.js	Get hash	malicious	Unknown	Browse	34.117.186.192 104.26.4.15
	Inquiry HA-22-28199 22-077.xlsx	Get hash	malicious	Unknown	Browse	34.117.186.192 104.26.4.15
	QR#Uff7a#Uff70#Uff84#Uff9e#U4f5c#U6210#Uff74#Uff78#Uff7e#Uff99.xlsb.xlsx	Get hash	malicious	Unknown	Browse	34.117.186.192 104.26.4.15

Process:	C:\Users\user\Desktop\2zdult23rz.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	997376
Entropy (8bit):	7.761305403187805
Encrypted:	false
SSDEEP:	24576:6ExQ6yPljU6/viqZ2yM8RTza/GasmzprSd3horG7VoCN2h/:6ExQJNjU6nVZhdhza/Gasmz5S52WyCNs
MD5:	733C1261CF02626F2354E6339BAA6717
SHA1:	C9E3599E1D7983FA7439BF2FF122FD7E51A59B93
SHA-256:	A14041622D7D427F0B7EA24EFAA7E80A3B025C211273CE0914EE34B5E71BC8C4
SHA-512:	09ECAB849F20CC7E418CC665446210B1AF870C345649709F57E52B1A520E2A5296110E572523A045EA565EAC393F33A0A14A082CB06EC5D175D232AD10FD93B4
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 82% Antivirus: Virustotal, Detection: 77%, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.....................o.....P......Q.....#...........?)U.....k....?)n....Rich....................PE..L...a.Jd.....................r......m@............@..........................p...............................................j..d.......................................8....................`......@`..@............................................text............................... ..`.rdata..Pt.......v..................@..@.data................`..............@....rsrc................H..............@..@........................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\MPGPH131\MPGPH131.exe:Zone.Identifier

Download File

Process:	C:\Users\user\Desktop\2zdult23rz.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	26
Entropy (8bit):	3.95006375643621
Encrypted:	false
SSDEEP:	3:ggPYV:rPYV
MD5:	187F488E27DB4AF347237FE461A079AD
SHA1:	6693BA299EC1881249D59262276A0D2CB21F8E64
SHA-256:	255A65D30841AB4082BD9D0EEA79D49C5EE88F56136157D8D6156AEF11C12309
SHA-512:	89879F237C0C051EBE784D0690657A6827A312A82735DA42DAD5F744D734FC545BEC9642C19D14C05B2F01FF53BC731530C92F7327BB7DC9CDE1B60FB21CD64E
Malicious:	false
Preview:	[ZoneTransfer]....ZoneId=0

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_2zdult23rz.exe_11f98c9716fee19af49aa64de28cc82bb5ae24_9a0d6501_20878b5b-aecd-41dd-aadc-9fcebe731b12\Report.wer

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	0.9365068796522449
Encrypted:	false
SSDEEP:	96:XhH8P4lastYqOoA7Rn6tQXIDcQnc6rCcEhcw3rL+HbHg/PB6Heao8Fa99Oy4H9n7:m4wQG056rgjtOZrYPzuiFbZ24IO8u
MD5:	6723DFE66B3266C2CB2C85AA6F29B6E9
SHA1:	8AF9C9B62187A181949F45CE72FE8EF2A5DC0047
SHA-256:	22D8DDA8004E14B592D72FB9F07513E8C11B141CB3286AA7493100F21039E7AE
SHA-512:	BB8D1B39397B0DE71BA82B9AE9BD5EFEB9EE3B2C549D29618A1542C19AE6A771578B7E85668628A6B8C94CED7B0F0B082D26B15DBFA6186ECD0AEFE0ACA62F8F
Malicious:	false
Preview:	..V.e.r.s.i.o.n.=.1.....E.v.e.n.t.T.y.p.e.=.B.E.X.....E.v.e.n.t.T.i.m.e.=.1.3.3.5.9.0.4.8.0.4.2.4.0.2.0.4.4.0.....R.e.p.o.r.t.T.y.p.e.=.2.....C.o.n.s.e.n.t.=.1.....R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.2.0.8.7.8.b.5.b.-.a.e.c.d.-.4.1.d.d.-.a.a.d.c.-.9.f.c.e.b.e.7.3.1.b.1.2.....I.n.t.e.g.r.a.t.o.r.R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.6.3.3.d.1.2.a.7.-.4.e.e.5.-.4.f.8.3.-.a.9.8.9.-.7.0.6.6.c.0.4.d.6.c.7.0.....W.o.w.6.4.H.o.s.t.=.3.4.4.0.4.....W.o.w.6.4.G.u.e.s.t.=.3.3.2.....N.s.A.p.p.N.a.m.e.=.2.z.d.u.l.t.2.3.r.z...e.x.e.....A.p.p.S.e.s.s.i.o.n.G.u.i.d.=.0.0.0.0.0.7.9.c.-.0.0.0.1.-.0.0.1.5.-.2.1.c.2.-.0.b.7.6.d.5.9.b.d.a.0.1.....T.a.r.g.e.t.A.p.p.I.d.=.W.:.0.0.0.6.0.4.b.6.c.0.5.4.8.d.9.5.7.d.7.1.2.f.2.1.7.c.9.6.e.f.f.e.b.d.5.f.0.0.0.0.0.a.1.6.!.0.0.0.0.c.9.e.3.5.9.9.e.1.d.7.9.8.3.f.a.7.4.3.9.b.f.2.f.f.1.2.2.f.d.7.e.5.1.a.5.9.b.9.3.!.2.z.d.u.l.t.2.3.r.z...e.x.e.....T.a.r.g.e.t.A.p.p.V.e.r.=.2.0.2.4././.0.4././.2.1.:.0.7.:.5.8.:.4.0.!.0.!.2.z.d.u.l.t.2.3.r.z...e.x.e.....B.o.o.t.I.d.=.4.2.9.4.9.6.

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_2zdult23rz.exe_11f98c9716fee19af49aa64de28cc82bb5ae24_9a0d6501_777a93e1-5691-425a-8add-7dcc282e804c\Report.wer

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	0.9368167181801449
Encrypted:	false
SSDEEP:	192:l0I4NQG056rgjtOZrYPzuiFbZ24IO8ut:lZ4NQt56rgjlzuiFbY4IO8ut
MD5:	7C047205FB8D80C8AF79B4A3F527E668
SHA1:	A388C989EAE1F55D51B893E8B3EBE97E26E73729
SHA-256:	99A8D28304EE1A2E8D2043224617F54EF7888ABCCAE43109E9163C830D92D4F2
SHA-512:	A6F5FDBCD057750FA47289574ED85725DF6B30539ABC44C69D2C44F382292270C8A615E57B05F4AF7B6929185E5561AC549C64A507FCA637C476A0688ED2228D
Malicious:	false
Preview:	..V.e.r.s.i.o.n.=.1.....E.v.e.n.t.T.y.p.e.=.B.E.X.....E.v.e.n.t.T.i.m.e.=.1.3.3.5.9.0.4.8.0.4.6.6.9.6.2.1.7.4.....R.e.p.o.r.t.T.y.p.e.=.2.....C.o.n.s.e.n.t.=.1.....R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.7.7.7.a.9.3.e.1.-.5.6.9.1.-.4.2.5.a.-.8.a.d.d.-.7.d.c.c.2.8.2.e.8.0.4.c.....I.n.t.e.g.r.a.t.o.r.R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.f.5.9.a.5.0.b.7.-.f.1.5.c.-.4.8.e.4.-.9.8.1.a.-.4.6.7.1.f.6.4.e.2.8.7.4.....W.o.w.6.4.H.o.s.t.=.3.4.4.0.4.....W.o.w.6.4.G.u.e.s.t.=.3.3.2.....N.s.A.p.p.N.a.m.e.=.2.z.d.u.l.t.2.3.r.z...e.x.e.....A.p.p.S.e.s.s.i.o.n.G.u.i.d.=.0.0.0.0.0.7.9.c.-.0.0.0.1.-.0.0.1.5.-.2.1.c.2.-.0.b.7.6.d.5.9.b.d.a.0.1.....T.a.r.g.e.t.A.p.p.I.d.=.W.:.0.0.0.6.0.4.b.6.c.0.5.4.8.d.9.5.7.d.7.1.2.f.2.1.7.c.9.6.e.f.f.e.b.d.5.f.0.0.0.0.0.a.1.6.!.0.0.0.0.c.9.e.3.5.9.9.e.1.d.7.9.8.3.f.a.7.4.3.9.b.f.2.f.f.1.2.2.f.d.7.e.5.1.a.5.9.b.9.3.!.2.z.d.u.l.t.2.3.r.z...e.x.e.....T.a.r.g.e.t.A.p.p.V.e.r.=.2.0.2.4././.0.4././.2.1.:.0.7.:.5.8.:.4.0.!.0.!.2.z.d.u.l.t.2.3.r.z...e.x.e.....B.o.o.t.I.d.=.4.2.9.4.9.6.

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_2zdult23rz.exe_11f98c9716fee19af49aa64de28cc82bb5ae24_9a0d6501_ff6612eb-39b4-4539-8240-dd31e3304e2f\Report.wer

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	0.9298914215046693
Encrypted:	false
SSDEEP:	96:tFr2P4GQastYqOoA7Rn6tQXIDcQnc6rCcEhcw3rL+HbHg/PB6Heao8Fa99Oy4H95:TG4GXQG056rgjtOZrY9zuiFbZ24IO8u
MD5:	F140BBB3545697EC54F74FFC1F813B87
SHA1:	F8094F0533696FFFB54C05CDD0CC805D738A167E
SHA-256:	C4AD585D896CDE106501CB81B8A097EDD3869866C002ABBA09E8B4228F0F0555
SHA-512:	9F4D30F41F771FC55AD6C4A5FB2FE18F9EA0FD1A4911E622B3C9FC102BA1EF332FFB0194DF2C5A2A355553E053C3AAC8B7F86B69E2D702BCB5B70F30DAE86D6D
Malicious:	false
Preview:	..V.e.r.s.i.o.n.=.1.....E.v.e.n.t.T.y.p.e.=.B.E.X.....E.v.e.n.t.T.i.m.e.=.1.3.3.5.9.0.4.8.0.3.2.9.9.6.8.9.7.9.....R.e.p.o.r.t.T.y.p.e.=.2.....C.o.n.s.e.n.t.=.1.....R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.f.f.6.6.1.2.e.b.-.3.9.b.4.-.4.5.3.9.-.8.2.4.0.-.d.d.3.1.e.3.3.0.4.e.2.f.....I.n.t.e.g.r.a.t.o.r.R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.d.c.7.5.8.d.6.c.-.a.4.4.2.-.4.8.c.f.-.8.f.5.1.-.e.0.b.f.0.8.0.9.a.8.7.2.....W.o.w.6.4.H.o.s.t.=.3.4.4.0.4.....W.o.w.6.4.G.u.e.s.t.=.3.3.2.....N.s.A.p.p.N.a.m.e.=.2.z.d.u.l.t.2.3.r.z...e.x.e.....A.p.p.S.e.s.s.i.o.n.G.u.i.d.=.0.0.0.0.0.7.9.c.-.0.0.0.1.-.0.0.1.5.-.2.1.c.2.-.0.b.7.6.d.5.9.b.d.a.0.1.....T.a.r.g.e.t.A.p.p.I.d.=.W.:.0.0.0.6.0.4.b.6.c.0.5.4.8.d.9.5.7.d.7.1.2.f.2.1.7.c.9.6.e.f.f.e.b.d.5.f.0.0.0.0.0.a.1.6.!.0.0.0.0.c.9.e.3.5.9.9.e.1.d.7.9.8.3.f.a.7.4.3.9.b.f.2.f.f.1.2.2.f.d.7.e.5.1.a.5.9.b.9.3.!.2.z.d.u.l.t.2.3.r.z...e.x.e.....T.a.r.g.e.t.A.p.p.V.e.r.=.2.0.2.4././.0.4././.2.1.:.0.7.:.5.8.:.4.0.!.0.!.2.z.d.u.l.t.2.3.r.z...e.x.e.....B.o.o.t.I.d.=.4.2.9.4.9.6.

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_2zdult23rz.exe_11f98c9716fee19af49aa64de28cc82bb5ae24_9a0d6501_fff45d40-3bb3-47f1-995f-427d72b5da7d\Report.wer

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	0.9165046650011295
Encrypted:	false
SSDEEP:	192:Dhmyew4CQG056rgjtOZrY3zuiFAZ24IO8u:oG4CQt56rgjtzuiFAY4IO8u
MD5:	779FAE53544D7761A8352EDA81C3EF1F
SHA1:	ECC72FC5AAE3100AC495C3876212CD6DB00409AE
SHA-256:	B625B3DB1E9BA59BAC39C1699F9AD2CDC397302E7FD7C2434DE409F3D8FFA648
SHA-512:	32AA48D5CCC0CD3021139B6C240613F72378E4C802AD4B5EC5D22A5B4CA281697AE08B5CA28338009AB21ABCE57F3625908F3AA8075A1153A90D6CA0E331DF7A
Malicious:	false
Preview:	..V.e.r.s.i.o.n.=.1.....E.v.e.n.t.T.y.p.e.=.B.E.X.....E.v.e.n.t.T.i.m.e.=.1.3.3.5.9.0.4.8.0.1.1.6.2.3.5.5.7.6.....R.e.p.o.r.t.T.y.p.e.=.2.....C.o.n.s.e.n.t.=.1.....R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.f.f.f.4.5.d.4.0.-.3.b.b.3.-.4.7.f.1.-.9.9.5.f.-.4.2.7.d.7.2.b.5.d.a.7.d.....I.n.t.e.g.r.a.t.o.r.R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.d.6.8.b.9.5.3.f.-.3.0.8.9.-.4.e.2.c.-.9.b.d.1.-.3.b.c.3.4.1.2.f.a.f.2.9.....W.o.w.6.4.H.o.s.t.=.3.4.4.0.4.....W.o.w.6.4.G.u.e.s.t.=.3.3.2.....N.s.A.p.p.N.a.m.e.=.2.z.d.u.l.t.2.3.r.z...e.x.e.....A.p.p.S.e.s.s.i.o.n.G.u.i.d.=.0.0.0.0.0.7.9.c.-.0.0.0.1.-.0.0.1.5.-.2.1.c.2.-.0.b.7.6.d.5.9.b.d.a.0.1.....T.a.r.g.e.t.A.p.p.I.d.=.W.:.0.0.0.6.0.4.b.6.c.0.5.4.8.d.9.5.7.d.7.1.2.f.2.1.7.c.9.6.e.f.f.e.b.d.5.f.0.0.0.0.0.a.1.6.!.0.0.0.0.c.9.e.3.5.9.9.e.1.d.7.9.8.3.f.a.7.4.3.9.b.f.2.f.f.1.2.2.f.d.7.e.5.1.a.5.9.b.9.3.!.2.z.d.u.l.t.2.3.r.z...e.x.e.....T.a.r.g.e.t.A.p.p.V.e.r.=.2.0.2.4././.0.4././.2.1.:.0.7.:.5.8.:.4.0.!.0.!.2.z.d.u.l.t.2.3.r.z...e.x.e.....B.o.o.t.I.d.=.4.2.9.4.9.6.

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_MPGPH131.exe_66d9e27e738a68bc2f94c5d06af5b853bcdbaba2_05789ee0_07168908-1ada-4ad9-b8e0-75dfac6a4107\Report.wer

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	0.9418094737040694
Encrypted:	false
SSDEEP:	192:9QY8Nzy8OG056r96E6jjXZZrMbzuiFbZ24IO8Nj6t:985yjt56rwjGzuiFbY4IO8e
MD5:	619606E51BB46BAD36FC541A7803C8ED
SHA1:	C7FED2801E2F903678781DED0FC066A718522F65
SHA-256:	B6FC7985EA8B9EA5F1CA2AA781366144FEAAA8C7C7BBCA673538AD0E53FFD8C4
SHA-512:	EE1D7EB19A6822AB4CB4C0CF24806DFA798B909709CB413EDAFF5E3CDD7DC5A930ECA6385DF0CCE60AAEB42103BCB3B874A8190BE1891706B0D03C8727ACA42B
Malicious:	false
Preview:	..V.e.r.s.i.o.n.=.1.....E.v.e.n.t.T.y.p.e.=.B.E.X.....E.v.e.n.t.T.i.m.e.=.1.3.3.5.9.0.4.8.0.4.5.7.2.2.2.0.7.9.....R.e.p.o.r.t.T.y.p.e.=.2.....C.o.n.s.e.n.t.=.1.....R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.0.7.1.6.8.9.0.8.-.1.a.d.a.-.4.a.d.9.-.b.8.e.0.-.7.5.d.f.a.c.6.a.4.1.0.7.....I.n.t.e.g.r.a.t.o.r.R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.9.4.e.c.c.c.d.e.-.7.4.a.c.-.4.c.a.5.-.a.8.b.5.-.c.b.1.a.b.a.4.c.b.6.2.a.....W.o.w.6.4.H.o.s.t.=.3.4.4.0.4.....W.o.w.6.4.G.u.e.s.t.=.3.3.2.....N.s.A.p.p.N.a.m.e.=.M.P.G.P.H.1.3.1...e.x.e.....A.p.p.S.e.s.s.i.o.n.G.u.i.d.=.0.0.0.0.0.b.b.4.-.0.0.0.1.-.0.0.1.5.-.0.5.1.a.-.9.6.7.9.d.5.9.b.d.a.0.1.....T.a.r.g.e.t.A.p.p.I.d.=.W.:.0.0.0.6.e.e.3.6.b.e.9.c.1.f.9.7.5.a.b.3.8.7.c.9.1.c.5.0.e.1.5.6.3.9.8.4.0.0.0.0.0.a.1.6.!.0.0.0.0.c.9.e.3.5.9.9.e.1.d.7.9.8.3.f.a.7.4.3.9.b.f.2.f.f.1.2.2.f.d.7.e.5.1.a.5.9.b.9.3.!.M.P.G.P.H.1.3.1...e.x.e.....T.a.r.g.e.t.A.p.p.V.e.r.=.2.0.2.4././.0.4././.2.1.:.0.7.:.5.8.:.4.0.!.0.!.M.P.G.P.H.1.3.1...e.x.e.....B.o.o.t.I.d.=.4.2.9.4.9.6.7.2.9.5.....

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_MPGPH131.exe_66d9e27e738a68bc2f94c5d06af5b853bcdbaba2_05789ee0_5a4466b5-e58c-4c08-94b8-4ada0870fa41\Report.wer

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	0.9087674562418081
Encrypted:	false
SSDEEP:	192:2iX8Nzq8OG056r96E6jjtOZrYFzuiFAZ24IO8Nj6t:w5qjt56rwj/zuiFAY4IO8e
MD5:	F91D51827D28DE25A951F5DEEEB6986B
SHA1:	AC20E740FE2352F16BD737EB6CED5D6C26C057F5
SHA-256:	B63F20ECDE1E27F0BB492004231B74C0B7ED8B2A785C71C57040B8937558800C
SHA-512:	E1A4925A7E7005B90F9581FE1F916EA56A96CE0C35B8FABA85A2DA16F219A5B4A4E2E09F81F1F6CBAB0D43808B3CED8FDAEC5505678E1BF02E0707BE6F2E91ED
Malicious:	false
Preview:	..V.e.r.s.i.o.n.=.1.....E.v.e.n.t.T.y.p.e.=.B.E.X.....E.v.e.n.t.T.i.m.e.=.1.3.3.5.9.0.4.8.0.1.6.3.0.1.7.1.3.4.....R.e.p.o.r.t.T.y.p.e.=.2.....C.o.n.s.e.n.t.=.1.....R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.5.a.4.4.6.6.b.5.-.e.5.8.c.-.4.c.0.8.-.9.4.b.8.-.4.a.d.a.0.8.7.0.f.a.4.1.....I.n.t.e.g.r.a.t.o.r.R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.e.4.f.6.c.d.e.b.-.9.e.4.e.-.4.8.1.1.-.9.4.2.c.-.3.f.6.2.4.6.a.8.1.5.0.8.....W.o.w.6.4.H.o.s.t.=.3.4.4.0.4.....W.o.w.6.4.G.u.e.s.t.=.3.3.2.....N.s.A.p.p.N.a.m.e.=.M.P.G.P.H.1.3.1...e.x.e.....A.p.p.S.e.s.s.i.o.n.G.u.i.d.=.0.0.0.0.1.7.c.0.-.0.0.0.1.-.0.0.1.5.-.b.f.8.a.-.5.4.7.9.d.5.9.b.d.a.0.1.....T.a.r.g.e.t.A.p.p.I.d.=.W.:.0.0.0.6.e.e.3.6.b.e.9.c.1.f.9.7.5.a.b.3.8.7.c.9.1.c.5.0.e.1.5.6.3.9.8.4.0.0.0.0.0.a.1.6.!.0.0.0.0.c.9.e.3.5.9.9.e.1.d.7.9.8.3.f.a.7.4.3.9.b.f.2.f.f.1.2.2.f.d.7.e.5.1.a.5.9.b.9.3.!.M.P.G.P.H.1.3.1...e.x.e.....T.a.r.g.e.t.A.p.p.V.e.r.=.2.0.2.4././.0.4././.2.1.:.0.7.:.5.8.:.4.0.!.0.!.M.P.G.P.H.1.3.1...e.x.e.....B.o.o.t.I.d.=.4.2.9.4.9.6.7.2.9.5.....

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_MPGPH131.exe_66d9e27e738a68bc2f94c5d06af5b853bcdbaba2_05789ee0_79dfc724-9704-4183-b4b9-469da4028e4f\Report.wer

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	0.9489417878884037
Encrypted:	false
SSDEEP:	192:uyX8Nzi8OG056r96E6jjtOZrYKzuiFbZ24IO8Nj6t:a5ijt56rwjgzuiFbY4IO8e
MD5:	D5146F5B2C17EA09C9D754D8EE91C7E6
SHA1:	4013032101CB0596679A2E38534B7443469CE57F
SHA-256:	1CE0C6056F7427025C71718FEC37BEC115117551D704BA6B5F326C1DFB463C6B
SHA-512:	7B34265A37E16AF4BA196CB798781393BFAF0A399545D13B26E60AE396600F662E588DF4E5E058330BFCB41F2D197CFF6BAA94285F2B313CA3C6683D1F6CD703
Malicious:	false
Preview:	..V.e.r.s.i.o.n.=.1.....E.v.e.n.t.T.y.p.e.=.B.E.X.....E.v.e.n.t.T.i.m.e.=.1.3.3.5.9.0.4.8.0.4.5.4.9.8.3.4.7.8.....R.e.p.o.r.t.T.y.p.e.=.2.....C.o.n.s.e.n.t.=.1.....R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.7.9.d.f.c.7.2.4.-.9.7.0.4.-.4.1.8.3.-.b.4.b.9.-.4.6.9.d.a.4.0.2.8.e.4.f.....I.n.t.e.g.r.a.t.o.r.R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.2.9.f.5.5.4.6.7.-.9.b.e.b.-.4.f.c.e.-.a.5.6.7.-.3.f.7.f.f.d.4.7.a.9.e.d.....W.o.w.6.4.H.o.s.t.=.3.4.4.0.4.....W.o.w.6.4.G.u.e.s.t.=.3.3.2.....N.s.A.p.p.N.a.m.e.=.M.P.G.P.H.1.3.1...e.x.e.....A.p.p.S.e.s.s.i.o.n.G.u.i.d.=.0.0.0.0.1.7.c.0.-.0.0.0.1.-.0.0.1.5.-.b.f.8.a.-.5.4.7.9.d.5.9.b.d.a.0.1.....T.a.r.g.e.t.A.p.p.I.d.=.W.:.0.0.0.6.e.e.3.6.b.e.9.c.1.f.9.7.5.a.b.3.8.7.c.9.1.c.5.0.e.1.5.6.3.9.8.4.0.0.0.0.0.a.1.6.!.0.0.0.0.c.9.e.3.5.9.9.e.1.d.7.9.8.3.f.a.7.4.3.9.b.f.2.f.f.1.2.2.f.d.7.e.5.1.a.5.9.b.9.3.!.M.P.G.P.H.1.3.1...e.x.e.....T.a.r.g.e.t.A.p.p.V.e.r.=.2.0.2.4././.0.4././.2.1.:.0.7.:.5.8.:.4.0.!.0.!.M.P.G.P.H.1.3.1...e.x.e.....B.o.o.t.I.d.=.4.2.9.4.9.6.7.2.9.5.....

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_MPGPH131.exe_66d9e27e738a68bc2f94c5d06af5b853bcdbaba2_05789ee0_d7856789-e655-4e86-98a2-61bad8289a4e\Report.wer

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	0.9420143000845581
Encrypted:	false
SSDEEP:	192:qY8NzF8OG056r96E6jjXZZrMbzuiFbZ24IO8Nj6t:K5Fjt56rwjGzuiFbY4IO8e
MD5:	AA27407294A5FCF5D9A6EE6739603735
SHA1:	DB7F54A96AD7E2FB8908652181E4BFB1E3AEEC95
SHA-256:	30C8CD7DA2E8B351B9B3A94839713274BCE622A1186C6377FCB1FE183E0BEBB9
SHA-512:	3DB04BBDDE49A04CBE1D16D76A8B0DB93D1A3180A21319C5CC476736590F2461022A2C6C92231AD4EBE2D8CCBD7B932B781CD7AD35C57A9F3FECD039E39B8F2D
Malicious:	false
Preview:	..V.e.r.s.i.o.n.=.1.....E.v.e.n.t.T.y.p.e.=.B.E.X.....E.v.e.n.t.T.i.m.e.=.1.3.3.5.9.0.4.8.0.3.6.3.0.2.8.9.2.9.....R.e.p.o.r.t.T.y.p.e.=.2.....C.o.n.s.e.n.t.=.1.....R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.d.7.8.5.6.7.8.9.-.e.6.5.5.-.4.e.8.6.-.9.8.a.2.-.6.1.b.a.d.8.2.8.9.a.4.e.....I.n.t.e.g.r.a.t.o.r.R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.d.c.8.f.8.8.a.9.-.5.1.c.1.-.4.9.4.c.-.a.9.d.1.-.6.b.6.e.3.a.8.5.0.7.e.e.....W.o.w.6.4.H.o.s.t.=.3.4.4.0.4.....W.o.w.6.4.G.u.e.s.t.=.3.3.2.....N.s.A.p.p.N.a.m.e.=.M.P.G.P.H.1.3.1...e.x.e.....A.p.p.S.e.s.s.i.o.n.G.u.i.d.=.0.0.0.0.0.b.b.4.-.0.0.0.1.-.0.0.1.5.-.0.5.1.a.-.9.6.7.9.d.5.9.b.d.a.0.1.....T.a.r.g.e.t.A.p.p.I.d.=.W.:.0.0.0.6.e.e.3.6.b.e.9.c.1.f.9.7.5.a.b.3.8.7.c.9.1.c.5.0.e.1.5.6.3.9.8.4.0.0.0.0.0.a.1.6.!.0.0.0.0.c.9.e.3.5.9.9.e.1.d.7.9.8.3.f.a.7.4.3.9.b.f.2.f.f.1.2.2.f.d.7.e.5.1.a.5.9.b.9.3.!.M.P.G.P.H.1.3.1...e.x.e.....T.a.r.g.e.t.A.p.p.V.e.r.=.2.0.2.4././.0.4././.2.1.:.0.7.:.5.8.:.4.0.!.0.!.M.P.G.P.H.1.3.1...e.x.e.....B.o.o.t.I.d.=.4.2.9.4.9.6.7.2.9.5.....

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_MPGPH131.exe_66d9e27e738a68bc2f94c5d06af5b853bcdbaba2_05789ee0_df7456cb-df9e-4b59-93ca-82804b0c1b09\Report.wer

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	0.9019127937641843
Encrypted:	false
SSDEEP:	192:1+Y8Nzw8OG056r96E6jjXZZrMCzuiFAZ24IO8Nj6t:1u5wjt56rwjHzuiFAY4IO8e
MD5:	36F465E0F61B0B46B26B6123562BFDF7
SHA1:	F434BEBBCF7A772E53D4ABBF614199F7F2E07ABC
SHA-256:	B7009D2CD14760BD727514CA600779E35014EC5B82CD60140126B54A159AE7B2
SHA-512:	4FE98F0A89534DB55197DC2BFEB04AB53E27C07042BBA907717D60F4DBF1DF60E4862EA05DB31368E5CE50EA13909B87339715180398FFDBA953A1AED34C1628
Malicious:	false
Preview:	..V.e.r.s.i.o.n.=.1.....E.v.e.n.t.T.y.p.e.=.B.E.X.....E.v.e.n.t.T.i.m.e.=.1.3.3.5.9.0.4.8.0.1.6.9.4.1.9.5.9.5.....R.e.p.o.r.t.T.y.p.e.=.2.....C.o.n.s.e.n.t.=.1.....R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.d.f.7.4.5.6.c.b.-.d.f.9.e.-.4.b.5.9.-.9.3.c.a.-.8.2.8.0.4.b.0.c.1.b.0.9.....I.n.t.e.g.r.a.t.o.r.R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.0.3.6.3.b.3.5.2.-.d.8.1.6.-.4.7.5.0.-.9.d.f.d.-.1.0.e.e.b.2.a.6.9.c.8.c.....W.o.w.6.4.H.o.s.t.=.3.4.4.0.4.....W.o.w.6.4.G.u.e.s.t.=.3.3.2.....N.s.A.p.p.N.a.m.e.=.M.P.G.P.H.1.3.1...e.x.e.....A.p.p.S.e.s.s.i.o.n.G.u.i.d.=.0.0.0.0.0.b.b.4.-.0.0.0.1.-.0.0.1.5.-.0.5.1.a.-.9.6.7.9.d.5.9.b.d.a.0.1.....T.a.r.g.e.t.A.p.p.I.d.=.W.:.0.0.0.6.e.e.3.6.b.e.9.c.1.f.9.7.5.a.b.3.8.7.c.9.1.c.5.0.e.1.5.6.3.9.8.4.0.0.0.0.0.a.1.6.!.0.0.0.0.c.9.e.3.5.9.9.e.1.d.7.9.8.3.f.a.7.4.3.9.b.f.2.f.f.1.2.2.f.d.7.e.5.1.a.5.9.b.9.3.!.M.P.G.P.H.1.3.1...e.x.e.....T.a.r.g.e.t.A.p.p.V.e.r.=.2.0.2.4././.0.4././.2.1.:.0.7.:.5.8.:.4.0.!.0.!.M.P.G.P.H.1.3.1...e.x.e.....B.o.o.t.I.d.=.4.2.9.4.9.6.7.2.9.5.....

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_MPGPH131.exe_66d9e27e738a68bc2f94c5d06af5b853bcdbaba2_05789ee0_f4c77b85-3516-4f65-b357-332c4a00e2d9\Report.wer

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	0.9289505171052448
Encrypted:	false
SSDEEP:	192:/MpX8NzBz8OG056r96E6jjtOZrYCzuiFbZ24IO8Nj6t:b5Vjt56rwjYzuiFbY4IO8e
MD5:	4AF21D15D9BD6DABE05E0DEE0943E66A
SHA1:	48C8F2B889986620335C0337ADC308463693F6D1
SHA-256:	3C615B9F05CF836267BC3997802AB37C599451CC36DA7BA4082C9FDF5A22EF38
SHA-512:	D66472778122E5AC9B8FAB2DC3AA05E9172AABF7344025916F2563FB7B7CADE4EE64131EE5DFC3D3C0174516B5E504FA904A53433830F45A7BDBA5A4D29D3EAA
Malicious:	false
Preview:	..V.e.r.s.i.o.n.=.1.....E.v.e.n.t.T.y.p.e.=.B.E.X.....E.v.e.n.t.T.i.m.e.=.1.3.3.5.9.0.4.8.0.3.6.2.3.0.3.4.3.8.....R.e.p.o.r.t.T.y.p.e.=.2.....C.o.n.s.e.n.t.=.1.....R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.f.4.c.7.7.b.8.5.-.3.5.1.6.-.4.f.6.5.-.b.3.5.7.-.3.3.2.c.4.a.0.0.e.2.d.9.....I.n.t.e.g.r.a.t.o.r.R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.6.c.2.0.2.7.5.2.-.4.7.5.6.-.4.3.c.8.-.9.5.4.7.-.e.b.6.b.b.5.3.c.d.f.7.6.....W.o.w.6.4.H.o.s.t.=.3.4.4.0.4.....W.o.w.6.4.G.u.e.s.t.=.3.3.2.....N.s.A.p.p.N.a.m.e.=.M.P.G.P.H.1.3.1...e.x.e.....A.p.p.S.e.s.s.i.o.n.G.u.i.d.=.0.0.0.0.1.7.c.0.-.0.0.0.1.-.0.0.1.5.-.b.f.8.a.-.5.4.7.9.d.5.9.b.d.a.0.1.....T.a.r.g.e.t.A.p.p.I.d.=.W.:.0.0.0.6.e.e.3.6.b.e.9.c.1.f.9.7.5.a.b.3.8.7.c.9.1.c.5.0.e.1.5.6.3.9.8.4.0.0.0.0.0.a.1.6.!.0.0.0.0.c.9.e.3.5.9.9.e.1.d.7.9.8.3.f.a.7.4.3.9.b.f.2.f.f.1.2.2.f.d.7.e.5.1.a.5.9.b.9.3.!.M.P.G.P.H.1.3.1...e.x.e.....T.a.r.g.e.t.A.p.p.V.e.r.=.2.0.2.4././.0.4././.2.1.:.0.7.:.5.8.:.4.0.!.0.!.M.P.G.P.H.1.3.1...e.x.e.....B.o.o.t.I.d.=.4.2.9.4.9.6.7.2.9.5.....

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_RageMP131.exe_d88d6b71db8af1c4ceb4920f8ba97dccd2f8180_9f006fa9_1f2b9adf-cd60-4ea4-9ed5-476865d40b3f\Report.wer

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	0.9084740188087858
Encrypted:	false
SSDEEP:	192:2fswsx1E34/FG056r4jXZZrMCzuiFbZ24IO8nr:2fwx1E3oFt56r4jHzuiFbY4IO8n
MD5:	49FE6F2F29BBA02657F9F444840AE947
SHA1:	3EB46BC5F74448033916E5A2DE186069F7AD51FD
SHA-256:	25A280B8C1A097FDAEC654602A57E05C1CCCF9161821D529A0942833948CBBB6
SHA-512:	E0FD9F3F10317F08FC8CA0EDA93B58A0871B469BBBA21A6C0EFFB467EB35D5D81381BBA6B88E944B9D1F725FB06932233A3E6E7E8C8BE16B4FFF5F799414A8D2
Malicious:	false
Preview:	..V.e.r.s.i.o.n.=.1.....E.v.e.n.t.T.y.p.e.=.B.E.X.....E.v.e.n.t.T.i.m.e.=.1.3.3.5.9.0.4.8.0.4.5.5.8.9.2.6.7.0.....R.e.p.o.r.t.T.y.p.e.=.2.....C.o.n.s.e.n.t.=.1.....R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.1.f.2.b.9.a.d.f.-.c.d.6.0.-.4.e.a.4.-.9.e.d.5.-.4.7.6.8.6.5.d.4.0.b.3.f.....I.n.t.e.g.r.a.t.o.r.R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.1.1.8.7.4.0.5.6.-.e.4.d.5.-.4.0.1.c.-.b.7.d.0.-.5.3.b.d.e.6.3.d.3.2.4.9.....W.o.w.6.4.H.o.s.t.=.3.4.4.0.4.....W.o.w.6.4.G.u.e.s.t.=.3.3.2.....N.s.A.p.p.N.a.m.e.=.R.a.g.e.M.P.1.3.1...e.x.e.....A.p.p.S.e.s.s.i.o.n.G.u.i.d.=.0.0.0.0.1.7.8.8.-.0.0.0.1.-.0.0.1.5.-.f.6.f.e.-.f.3.8.6.d.5.9.b.d.a.0.1.....T.a.r.g.e.t.A.p.p.I.d.=.W.:.0.0.0.6.a.e.e.d.8.e.7.9.6.a.2.c.5.3.e.a.c.5.f.f.4.e.7.d.e.3.4.b.d.f.e.e.0.0.0.0.0.a.1.6.!.0.0.0.0.c.9.e.3.5.9.9.e.1.d.7.9.8.3.f.a.7.4.3.9.b.f.2.f.f.1.2.2.f.d.7.e.5.1.a.5.9.b.9.3.!.R.a.g.e.M.P.1.3.1...e.x.e.....T.a.r.g.e.t.A.p.p.V.e.r.=.2.0.2.4././.0.4././.2.1.:.0.7.:.5.8.:.4.0.!.0.!.R.a.g.e.M.P.1.3.1...e.x.e.....B.o.o.t.I.d.=.4.2.9.4.9.6.7.2.9.

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_RageMP131.exe_d88d6b71db8af1c4ceb4920f8ba97dccd2f8180_9f006fa9_8da1b8ba-8b09-428f-ba51-74f2c7ba8b7d\Report.wer

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	0.9552208988537024
Encrypted:	false
SSDEEP:	96:xPU6B+3MsyYqOoA7Rn6tQXIDcQnc6rCcEhcw3rD+HbHg/PB6Heao8Fa99Oy4H9nJ:xDE3MFG056r4jtOZrYKzuiFbZ24IO8n
MD5:	8D27D6464FCA56641B04705372437AC3
SHA1:	26048CC4C4EACE6A55FDA198B4A590BA1F3870C6
SHA-256:	AFCFFCADCE39C0F70AB5941C24FCE7AF393C8BFFAC739AA89FF608F6F679EA38
SHA-512:	1669F46E7A4E3C0218F674A1A0DB743B37606B42409B0366E13969CFD98937F38623EA29D9993DA1029C9F0AA0EA2000447BE8F43C1C051CCC2D618F7C7727BB
Malicious:	false
Preview:	..V.e.r.s.i.o.n.=.1.....E.v.e.n.t.T.y.p.e.=.B.E.X.....E.v.e.n.t.T.i.m.e.=.1.3.3.5.9.0.4.8.0.3.6.5.5.9.3.0.9.0.....R.e.p.o.r.t.T.y.p.e.=.2.....C.o.n.s.e.n.t.=.1.....R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.8.d.a.1.b.8.b.a.-.8.b.0.9.-.4.2.8.f.-.b.a.5.1.-.7.4.f.2.c.7.b.a.8.b.7.d.....I.n.t.e.g.r.a.t.o.r.R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.b.f.e.3.7.a.5.d.-.1.1.f.7.-.4.6.3.2.-.9.c.f.d.-.a.a.b.7.8.f.9.b.f.b.c.4.....W.o.w.6.4.H.o.s.t.=.3.4.4.0.4.....W.o.w.6.4.G.u.e.s.t.=.3.3.2.....N.s.A.p.p.N.a.m.e.=.R.a.g.e.M.P.1.3.1...e.x.e.....A.p.p.S.e.s.s.i.o.n.G.u.i.d.=.0.0.0.0.1.3.e.4.-.0.0.0.1.-.0.0.1.5.-.b.0.2.d.-.d.8.8.0.d.5.9.b.d.a.0.1.....T.a.r.g.e.t.A.p.p.I.d.=.W.:.0.0.0.6.a.e.e.d.8.e.7.9.6.a.2.c.5.3.e.a.c.5.f.f.4.e.7.d.e.3.4.b.d.f.e.e.0.0.0.0.0.a.1.6.!.0.0.0.0.c.9.e.3.5.9.9.e.1.d.7.9.8.3.f.a.7.4.3.9.b.f.2.f.f.1.2.2.f.d.7.e.5.1.a.5.9.b.9.3.!.R.a.g.e.M.P.1.3.1...e.x.e.....T.a.r.g.e.t.A.p.p.V.e.r.=.2.0.2.4././.0.4././.2.1.:.0.7.:.5.8.:.4.0.!.0.!.R.a.g.e.M.P.1.3.1...e.x.e.....B.o.o.t.I.d.=.4.2.9.4.9.6.7.2.9.

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_RageMP131.exe_d88d6b71db8af1c4ceb4920f8ba97dccd2f8180_9f006fa9_b7bd9140-c855-4d7b-8dcf-9b68772ee563\Report.wer

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	0.91533099383943
Encrypted:	false
SSDEEP:	96:amB+3KsyYqOoA7Rn6tQXIDcQnc6rCcEhcw3rD+HbHg/PB6Heao8Fa99Oy4H9nFix:7E3KFG056r4jtOZrYFzuiFbZ24IO8n
MD5:	DFD9FB88EAC3AE50DD67F8A229189769
SHA1:	2634436994DAA32640524FC80EEEBCF4D5E10C5E
SHA-256:	85232F3C1F3472B59266E303578D160A1DBBBF997AAFAC5109C0CF61D5C581D1
SHA-512:	45B4CA5DB3A56083C0619A85F6096DBC7A62254189B9C07B0E536DCB0DD5CB7F77EAF60E99F7CB75D292698D70F41D02823A5A812771B31291DEF5D1D1EF9543
Malicious:	false
Preview:	..V.e.r.s.i.o.n.=.1.....E.v.e.n.t.T.y.p.e.=.B.E.X.....E.v.e.n.t.T.i.m.e.=.1.3.3.5.9.0.4.8.0.2.7.7.1.2.8.9.4.9.....R.e.p.o.r.t.T.y.p.e.=.2.....C.o.n.s.e.n.t.=.1.....R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.b.7.b.d.9.1.4.0.-.c.8.5.5.-.4.d.7.b.-.8.d.c.f.-.9.b.6.8.7.7.2.e.e.5.6.3.....I.n.t.e.g.r.a.t.o.r.R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.2.5.1.e.b.6.7.8.-.6.e.f.5.-.4.8.4.7.-.9.3.9.8.-.7.d.d.4.3.9.d.9.6.c.0.3.....W.o.w.6.4.H.o.s.t.=.3.4.4.0.4.....W.o.w.6.4.G.u.e.s.t.=.3.3.2.....N.s.A.p.p.N.a.m.e.=.R.a.g.e.M.P.1.3.1...e.x.e.....A.p.p.S.e.s.s.i.o.n.G.u.i.d.=.0.0.0.0.1.3.e.4.-.0.0.0.1.-.0.0.1.5.-.b.0.2.d.-.d.8.8.0.d.5.9.b.d.a.0.1.....T.a.r.g.e.t.A.p.p.I.d.=.W.:.0.0.0.6.a.e.e.d.8.e.7.9.6.a.2.c.5.3.e.a.c.5.f.f.4.e.7.d.e.3.4.b.d.f.e.e.0.0.0.0.0.a.1.6.!.0.0.0.0.c.9.e.3.5.9.9.e.1.d.7.9.8.3.f.a.7.4.3.9.b.f.2.f.f.1.2.2.f.d.7.e.5.1.a.5.9.b.9.3.!.R.a.g.e.M.P.1.3.1...e.x.e.....T.a.r.g.e.t.A.p.p.V.e.r.=.2.0.2.4././.0.4././.2.1.:.0.7.:.5.8.:.4.0.!.0.!.R.a.g.e.M.P.1.3.1...e.x.e.....B.o.o.t.I.d.=.4.2.9.4.9.6.7.2.9.

C:\ProgramData\Microsoft\Windows\WER\Temp\WER136.tmp.WERInternalMetadata.xml

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	6404
Entropy (8bit):	3.7228884548738597
Encrypted:	false
SSDEEP:	192:R6l7wVeJVu06TXYvcr6pBH89b13sf4Knm:R6lXJP6DYkrl18f4z
MD5:	7E76A23C1A6FF876D79003C25D1A5BC8
SHA1:	4F95133A2571621FD7745A0BFA33D27B27403C34
SHA-256:	259AE2B083D26B40A45AF67ADCBF913B34B2B821E62DA43E4B1C21D3F70135FF
SHA-512:	AC21395C5F811E3542649EDCA27B3D959F5C615837239E648F2CCDFECCC8DE3F6E5C0C1D93A0BDADA52B500F21AB6EAF65B69F504DDF4BEAE03BFE1BF4F2A6FC
Malicious:	false
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".U.T.F.-.1.6.".?.>.....<.W.E.R.R.e.p.o.r.t.M.e.t.a.d.a.t.a.>.......<.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.........<.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.1.0...0.<./.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.........<.B.u.i.l.d.>.1.9.0.4.5.<./.B.u.i.l.d.>.........<.P.r.o.d.u.c.t.>.(.0.x.3.0.).:. .W.i.n.d.o.w.s. .1.0. .P.r.o.<./.P.r.o.d.u.c.t.>.........<.E.d.i.t.i.o.n.>.P.r.o.f.e.s.s.i.o.n.a.l.<./.E.d.i.t.i.o.n.>.........<.B.u.i.l.d.S.t.r.i.n.g.>.1.9.0.4.1...2.0.0.6...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6.<./.B.u.i.l.d.S.t.r.i.n.g.>.........<.R.e.v.i.s.i.o.n.>.2.0.0.6.<./.R.e.v.i.s.i.o.n.>.........<.F.l.a.v.o.r.>.M.u.l.t.i.p.r.o.c.e.s.s.o.r. .F.r.e.e.<./.F.l.a.v.o.r.>.........<.A.r.c.h.i.t.e.c.t.u.r.e.>.X.6.4.<./.A.r.c.h.i.t.e.c.t.u.r.e.>.........<.L.C.I.D.>.2.0.5.7.<./.L.C.I.D.>.......<./.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.......<.P.r.o.c.e.s.s.I.n.f.o.r.m.a.t.i.o.n.>.........<.P.i.d.>.2.9.9.6.<./.P.i.

C:\ProgramData\Microsoft\Windows\WER\Temp\WER156.tmp.xml

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	4712
Entropy (8bit):	4.481533194739572
Encrypted:	false
SSDEEP:	48:cvIwWl8zs4Jg77aI9S1WpW8VYyGPYm8M4J9NtF+b+q8vHNirTo6nMdd:uIjf+I78E7VnGSJ9gKHsrTo2Mdd
MD5:	769EFF6B5C40C2712D988A86CF294384
SHA1:	623381F02D626304BE4EE1B8982052C0AFE027EE
SHA-256:	301418C8B9F9BD8BEA0620F1A86A3CAFB09C3B2E49634859351B217616D4214E
SHA-512:	A496E8EB4E80C15E37E4529959AA0229866DF5EC9855C6CB3A4B5BD8F10DFB94EB9CF2BF56663A0FADAC68D99C8982956283BA4E4AE26DF4ABF19BDA382800AA
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8" standalone="yes"?>..<req ver="2">.. <tlm>.. <src>.. <desc>.. <mach>.. <os>.. <arg nm="vermaj" val="10" />.. <arg nm="vermin" val="0" />.. <arg nm="verbld" val="19045" />.. <arg nm="vercsdbld" val="2006" />.. <arg nm="verqfe" val="2006" />.. <arg nm="csdbld" val="2006" />.. <arg nm="versp" val="0" />.. <arg nm="arch" val="9" />.. <arg nm="lcid" val="2057" />.. <arg nm="geoid" val="223" />.. <arg nm="sku" val="48" />.. <arg nm="domain" val="0" />.. <arg nm="prodsuite" val="256" />.. <arg nm="ntprodtype" val="1" />.. <arg nm="platid" val="2" />.. <arg nm="tmsi" val="304182" />.. <arg nm="osinsty" val="1" />.. <arg nm="iever" val="11.789.19041.0-11.0.1000" />.. <arg nm="portos" val="0" />.. <arg nm="ram" val="409

C:\ProgramData\Microsoft\Windows\WER\Temp\WER2B04.tmp.dmp

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Mini DuMP crash report, 15 streams, Wed May 1 14:40:27 2024, 0x1205a4 type
Category:	dropped
Size (bytes):	59910
Entropy (8bit):	2.304113653085472
Encrypted:	false
SSDEEP:	384:42Az4wK0mlNTv4jhlSesS8EKoM8BjsH8FaGTpVNz81fV3a:gz1PmlNTvug7qhpVNwV3
MD5:	9F76CA39FB9D899E719D15D2BE646B0E
SHA1:	1FCD35279CCCB8F4532C0F34A1AA18FCB8227EC9
SHA-256:	6C001553473D637CE3D1D5E4E6CF15CDF7842246E2D19450E02EA1267E63894D
SHA-512:	EFBF65F04EC2DC22DFC4590EDCF32D20FB0BA8730CF773A0334B4920D7B4B2691F2623D9CBFAFA6650E60AE96A51D8D0E7892908C95C0DA8507D936758E4EBD7
Malicious:	false
Preview:	MDMP..a..... .......[T2f........................(...........$................/..........`.......8...........T...........@ ..............$...........................................................................................eJ..............GenuineIntel............T...........YT2f............................. ..................W... .E.u.r.o.p.e. .S.t.a.n.d.a.r.d. .T.i.m.e.......................................W... .E.u.r.o.p.e. .S.u.m.m.e.r. .T.i.m.e...........................................1.9.0.4.1...1...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6.......................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Windows\WER\Temp\WER2BA2.tmp.WERInternalMetadata.xml

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	8430
Entropy (8bit):	3.6965219930807716
Encrypted:	false
SSDEEP:	192:R6l7wVeJQT6Pf6Y2Dr1SUTqgmf2r6pBM89bWcsfSSm:R6lXJ06X6YsSUTqgmf2rkWvfu
MD5:	D906F905A024F375296DCE602EF04749
SHA1:	739B5D4DF29CFDD9A384D5B27CEC1379885899F6
SHA-256:	BB576BECB72C1BACA00262E18A5ED41CBA6A1A6503345537B3FD53FBA4752AB4
SHA-512:	B8842C73EF818F0FE3F10DA5813D1A8C645C846D27468E0B3CACCAE8922238E6CDD93E0EFB3D48566F62EF666B62DC4F5BEFE4D2466A31F6C4E7A68787958536
Malicious:	false
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".U.T.F.-.1.6.".?.>.....<.W.E.R.R.e.p.o.r.t.M.e.t.a.d.a.t.a.>.......<.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.........<.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.1.0...0.<./.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.........<.B.u.i.l.d.>.1.9.0.4.5.<./.B.u.i.l.d.>.........<.P.r.o.d.u.c.t.>.(.0.x.3.0.).:. .W.i.n.d.o.w.s. .1.0. .P.r.o.<./.P.r.o.d.u.c.t.>.........<.E.d.i.t.i.o.n.>.P.r.o.f.e.s.s.i.o.n.a.l.<./.E.d.i.t.i.o.n.>.........<.B.u.i.l.d.S.t.r.i.n.g.>.1.9.0.4.1...2.0.0.6...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6.<./.B.u.i.l.d.S.t.r.i.n.g.>.........<.R.e.v.i.s.i.o.n.>.2.0.0.6.<./.R.e.v.i.s.i.o.n.>.........<.F.l.a.v.o.r.>.M.u.l.t.i.p.r.o.c.e.s.s.o.r. .F.r.e.e.<./.F.l.a.v.o.r.>.........<.A.r.c.h.i.t.e.c.t.u.r.e.>.X.6.4.<./.A.r.c.h.i.t.e.c.t.u.r.e.>.........<.L.C.I.D.>.2.0.5.7.<./.L.C.I.D.>.......<./.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.......<.P.r.o.c.e.s.s.I.n.f.o.r.m.a.t.i.o.n.>.........<.P.i.d.>.5.0.9.2.<./.P.i.

C:\ProgramData\Microsoft\Windows\WER\Temp\WER2BD1.tmp.xml

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	4717
Entropy (8bit):	4.4741303057872885
Encrypted:	false
SSDEEP:	48:cvIwWl8zsnJg77aI9S1WpW8VYmYm8M4J3NtFp+q8vTN9Lwmad:uIjfJI78E7V6J3jKTzLwmad
MD5:	0858802352B28DBC69D891FC8B70ADC9
SHA1:	882AA8680B09C3B768D44548FD99DE2F2DCA03E3
SHA-256:	0E6D4AFE9200F88A63F02BA918737E24A629E45D58D287E445A1F45AD1C35F17
SHA-512:	09CCE180EE4413E0D3755FA9E861586F57FB2091E4F9B0A5778128EE11CB4203AFE4737E863E9C7C24AD77A5A7746A1A353405AF5CACA6FD608799637959FB53
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8" standalone="yes"?>..<req ver="2">.. <tlm>.. <src>.. <desc>.. <mach>.. <os>.. <arg nm="vermaj" val="10" />.. <arg nm="vermin" val="0" />.. <arg nm="verbld" val="19045" />.. <arg nm="vercsdbld" val="2006" />.. <arg nm="verqfe" val="2006" />.. <arg nm="csdbld" val="2006" />.. <arg nm="versp" val="0" />.. <arg nm="arch" val="9" />.. <arg nm="lcid" val="2057" />.. <arg nm="geoid" val="223" />.. <arg nm="sku" val="48" />.. <arg nm="domain" val="0" />.. <arg nm="prodsuite" val="256" />.. <arg nm="ntprodtype" val="1" />.. <arg nm="platid" val="2" />.. <arg nm="tmsi" val="304183" />.. <arg nm="osinsty" val="1" />.. <arg nm="iever" val="11.789.19041.0-11.0.1000" />.. <arg nm="portos" val="0" />.. <arg nm="ram" val="409

C:\ProgramData\Microsoft\Windows\WER\Temp\WER4524.tmp.dmp

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Mini DuMP crash report, 15 streams, Wed May 1 14:40:35 2024, 0x1205a4 type
Category:	dropped
Size (bytes):	75124
Entropy (8bit):	2.397766773076656
Encrypted:	false
SSDEEP:	384:37TH5gnZNTv11eMdmwlYC8JdyvJW3YNoM8zn8saAvS0XL5e1triFXH:rTZmZNTv/GItovLaftrit
MD5:	020FD1C5E75D0B7EF2C1A9DA12006C15
SHA1:	8E8056822D28CD6C154509EF4D468C749A792316
SHA-256:	0879BC716021FEED75FD1DD556A117C08E954EE7093E148C6F2A6023306F96A8
SHA-512:	68A82838835E7499B7B0BB0F6B4D75818A1ED5074D9DFAD652550D87B1B309CAED39DF25BB592FE80ED906C83112D017BAE8C1EE888EA56484B7C8180AE6DC0B
Malicious:	false
Preview:	MDMP..a..... .......cT2f........................l...........<...t............4..........`.......8...........T............%..........................................................................................................eJ......4.......GenuineIntel............T...........GT2f.............................0..................W... .E.u.r.o.p.e. .S.t.a.n.d.a.r.d. .T.i.m.e.......................................W... .E.u.r.o.p.e. .S.u.m.m.e.r. .T.i.m.e...........................................1.9.0.4.1...1...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6.......................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Windows\WER\Temp\WER498A.tmp.WERInternalMetadata.xml

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	8436
Entropy (8bit):	3.6972303841181193
Encrypted:	false
SSDEEP:	192:R6l7wVeJNZ6EYR6Y2D4SUZ5Tgmfvr6pB089bF9sfK3m:R6lXJj6EYR6YFSUZ5TgmfvrMF2fD
MD5:	F88464A339CD22349096C1E23FA8BCE6
SHA1:	EAD9BC693A25AD07DB24351A41C3E3A8C5B552D3
SHA-256:	F6DC9A40E1858C20047870EEA3B0F94D2546D5C43F6AC3A0A2B48DFA0A7ADB1C
SHA-512:	E661E29772CD4D8A26B23631078FD87E329C7D60111197EFA8B022BB8AFE63D6BEF463C163181DFA3F78C05B7007770A3CE203B88D065B171233E6464612CE0A
Malicious:	false
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".U.T.F.-.1.6.".?.>.....<.W.E.R.R.e.p.o.r.t.M.e.t.a.d.a.t.a.>.......<.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.........<.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.1.0...0.<./.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.........<.B.u.i.l.d.>.1.9.0.4.5.<./.B.u.i.l.d.>.........<.P.r.o.d.u.c.t.>.(.0.x.3.0.).:. .W.i.n.d.o.w.s. .1.0. .P.r.o.<./.P.r.o.d.u.c.t.>.........<.E.d.i.t.i.o.n.>.P.r.o.f.e.s.s.i.o.n.a.l.<./.E.d.i.t.i.o.n.>.........<.B.u.i.l.d.S.t.r.i.n.g.>.1.9.0.4.1...2.0.0.6...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6.<./.B.u.i.l.d.S.t.r.i.n.g.>.........<.R.e.v.i.s.i.o.n.>.2.0.0.6.<./.R.e.v.i.s.i.o.n.>.........<.F.l.a.v.o.r.>.M.u.l.t.i.p.r.o.c.e.s.s.o.r. .F.r.e.e.<./.F.l.a.v.o.r.>.........<.A.r.c.h.i.t.e.c.t.u.r.e.>.X.6.4.<./.A.r.c.h.i.t.e.c.t.u.r.e.>.........<.L.C.I.D.>.2.0.5.7.<./.L.C.I.D.>.......<./.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.......<.P.r.o.c.e.s.s.I.n.f.o.r.m.a.t.i.o.n.>.........<.P.i.d.>.1.9.4.8.<./.P.i.

C:\ProgramData\Microsoft\Windows\WER\Temp\WER4AA4.tmp.xml

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	4722
Entropy (8bit):	4.477455907684335
Encrypted:	false
SSDEEP:	48:cvIwWl8zsnJg77aI9S1WpW8VYbYm8M4JNNtFdT+q8vaN6ydmTBxd:uIjfJI78E7VHJNDTKaM1TBxd
MD5:	7447152905ED15904182157E66E58F3F
SHA1:	823BBE02004838159C7FEFB7A950C30899C300D1
SHA-256:	C1EED0E1F1C0BFDEA95201509DAE5AD2558B60DCD9E4ECCD143166C2D46FAB1F
SHA-512:	85D0EB57AF449B04B73627ACF67EB583201B1973AC92D18007EDDC215EB3625167596BE3102013684DAA8D111F6386FDC4567147C116DEB36D85DEC3D12065A3
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8" standalone="yes"?>..<req ver="2">.. <tlm>.. <src>.. <desc>.. <mach>.. <os>.. <arg nm="vermaj" val="10" />.. <arg nm="vermin" val="0" />.. <arg nm="verbld" val="19045" />.. <arg nm="vercsdbld" val="2006" />.. <arg nm="verqfe" val="2006" />.. <arg nm="csdbld" val="2006" />.. <arg nm="versp" val="0" />.. <arg nm="arch" val="9" />.. <arg nm="lcid" val="2057" />.. <arg nm="geoid" val="223" />.. <arg nm="sku" val="48" />.. <arg nm="domain" val="0" />.. <arg nm="prodsuite" val="256" />.. <arg nm="ntprodtype" val="1" />.. <arg nm="platid" val="2" />.. <arg nm="tmsi" val="304183" />.. <arg nm="osinsty" val="1" />.. <arg nm="iever" val="11.789.19041.0-11.0.1000" />.. <arg nm="portos" val="0" />.. <arg nm="ram" val="409

C:\ProgramData\Microsoft\Windows\WER\Temp\WER4C29.tmp.dmp

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Mini DuMP crash report, 15 streams, Wed May 1 14:40:36 2024, 0x1205a4 type
Category:	dropped
Size (bytes):	74444
Entropy (8bit):	2.391283151802473
Encrypted:	false
SSDEEP:	384:07H7AAvrNTvU+i3O1mDmfR/B/Otbz0EFywoP2oM8og8Fa5iuEf3jwXqO:07HE4rNTvXmDuR/BmaDySZdXT
MD5:	E213CE1A7AAF99E6D03BDAB811B233E0
SHA1:	1B1C2D16AD5C890B99CD418B47A5C0633511FBD9
SHA-256:	3E194C94B66ED1A6DBA0D42909C9E2CBB1FF94C09D504526D2064F49BEA778CC
SHA-512:	A9ECED5858B78D234114899BCF925ADA12D433BEB52880A7C3A6BA8DAC25DC3501B019E4B9DED7411DBE276C60C15516A5902E0B8C29905D963BC06E1B8FA957
Malicious:	false
Preview:	MDMP..a..... .......dT2f........................l...........<...t.......4....4..........`.......8...........T...........($..........................................................................................................eJ......4.......GenuineIntel............T...........LT2f.............................0..................W... .E.u.r.o.p.e. .S.t.a.n.d.a.r.d. .T.i.m.e.......................................W... .E.u.r.o.p.e. .S.u.m.m.e.r. .T.i.m.e...........................................1.9.0.4.1...1...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6.......................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Windows\WER\Temp\WER4C77.tmp.dmp

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Mini DuMP crash report, 15 streams, Wed May 1 14:40:36 2024, 0x1205a4 type
Category:	dropped
Size (bytes):	79266
Entropy (8bit):	2.2877184466916183
Encrypted:	false
SSDEEP:	384:oK1663YoJTvO6n39bB7LbZr/0E5Jy87IGoI8MN8ldY25+DYNJEDo:oK16poJTvO6DL1C+6q2xNJE0
MD5:	B66FCA5A846FF0E8C7E0D19AFDC1CABC
SHA1:	B37C9BB39E2CCD1AF5DEF15939BFE9402B8CA0AE
SHA-256:	F92639D17F30CFFDE5D43218B4E340073703CF470B5CD07BE25C89FACEA998E1
SHA-512:	D1F24C7C63CC952179DAF9E3E3A82438D9A0854720D6BECC5537497D03919CC011AB0A4DB5061720663CCBC164783AF2EBAEF5D82D1CC876FD12A2AB71E0991C
Malicious:	false
Preview:	MDMP..a..... .......dT2f............$...........D...8.......<...\|.......t....8..........`.......8...........T............#..........................................................................................................eJ......<.......GenuineIntel............T...........MT2f.............................0..................W... .E.u.r.o.p.e. .S.t.a.n.d.a.r.d. .T.i.m.e.......................................W... .E.u.r.o.p.e. .S.u.m.m.e.r. .T.i.m.e...........................................1.9.0.4.1...1...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6.......................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Windows\WER\Temp\WER4E2D.tmp.WERInternalMetadata.xml

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	6408
Entropy (8bit):	3.7205004405478173
Encrypted:	false
SSDEEP:	192:R6l7wVeJXuWb6fdqPYvcr6pB689buCIcsfWam:R6lXJfb64YkrmuCIvfi
MD5:	36CE52E236715C4368CF1A9C241D4D23
SHA1:	DD958B52602CC54D6A03FCC95EBEF7AC6D53D161
SHA-256:	2083766314C5E20FC92B51F19731CF0E4DB1F915134DD0E3BEF4B3C836053F02
SHA-512:	041EBADE8BA98AEFCFC4AF9B275F78A68376C6C983DA3D24CC5F8BD0E0470919E9C5CE9EC024A7198B6FDC31DFBDEEB1820ACFB230C0E92479780023F8C28829
Malicious:	false
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".U.T.F.-.1.6.".?.>.....<.W.E.R.R.e.p.o.r.t.M.e.t.a.d.a.t.a.>.......<.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.........<.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.1.0...0.<./.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.........<.B.u.i.l.d.>.1.9.0.4.5.<./.B.u.i.l.d.>.........<.P.r.o.d.u.c.t.>.(.0.x.3.0.).:. .W.i.n.d.o.w.s. .1.0. .P.r.o.<./.P.r.o.d.u.c.t.>.........<.E.d.i.t.i.o.n.>.P.r.o.f.e.s.s.i.o.n.a.l.<./.E.d.i.t.i.o.n.>.........<.B.u.i.l.d.S.t.r.i.n.g.>.1.9.0.4.1...2.0.0.6...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6.<./.B.u.i.l.d.S.t.r.i.n.g.>.........<.R.e.v.i.s.i.o.n.>.2.0.0.6.<./.R.e.v.i.s.i.o.n.>.........<.F.l.a.v.o.r.>.M.u.l.t.i.p.r.o.c.e.s.s.o.r. .F.r.e.e.<./.F.l.a.v.o.r.>.........<.A.r.c.h.i.t.e.c.t.u.r.e.>.X.6.4.<./.A.r.c.h.i.t.e.c.t.u.r.e.>.........<.L.C.I.D.>.2.0.5.7.<./.L.C.I.D.>.......<./.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.......<.P.r.o.c.e.s.s.I.n.f.o.r.m.a.t.i.o.n.>.........<.P.i.d.>.6.0.8.0.<./.P.i.

C:\ProgramData\Microsoft\Windows\WER\Temp\WER4E5B.tmp.dmp

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Mini DuMP crash report, 15 streams, Wed May 1 14:40:37 2024, 0x1205a4 type
Category:	dropped
Size (bytes):	79884
Entropy (8bit):	2.3012170382614903
Encrypted:	false
SSDEEP:	384:kqaY0ffkmNTvXGz3SbLfNPmvpzPxdyWcAo48fca8FNGipVNzJvNkTDoKo:kO0fMmNTv22brRm83qRpVNYDpo
MD5:	E6321AD28467981F43F7BC28F12C7403
SHA1:	FF6D456222F0E9E7C20386E2A55CE72903A644F8
SHA-256:	D35CF7BFABA7796683E046E9A8A76253C7560130F171F1DFDAEEB0E43D584771
SHA-512:	230461F4EC36C29225F437CFF8EEC6F4306A4DDD6CD85E368DF675EA33021AD98BEF67147AEFB470A7DA7768940D92E391C1C1E30F8AE66A379F58F319C5C5AE
Malicious:	false
Preview:	MDMP..a..... .......eT2f............$...............8.......<................9..........`.......8...........T............%..............$...........................................................................................eJ..............GenuineIntel............T...........YT2f............................. ..................W... .E.u.r.o.p.e. .S.t.a.n.d.a.r.d. .T.i.m.e.......................................W... .E.u.r.o.p.e. .S.u.m.m.e.r. .T.i.m.e...........................................1.9.0.4.1...1...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6.......................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Windows\WER\Temp\WER4E5C.tmp.WERInternalMetadata.xml

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	6408
Entropy (8bit):	3.7213040280364176
Encrypted:	false
SSDEEP:	96:RSIU6o7wVetbVuf6bYv2npFXaQlngaMOUu89bu3sfWam:R6l7wVeJVuf6bYvcr6pBu89bu3sfWam
MD5:	5C666647FD7843C132C33BEAD56A461C
SHA1:	42071D8306E6E21D4FB0EB488AC5F5794EFB3767
SHA-256:	6A6CD03E91D04B29BF8F3B73F6CEB40C2ED7DA2A6093ED2D4305499DE372F4FF
SHA-512:	4761FDDD23578F69C2316137AB26311193A21D600B944727D8A424AEC55DC0BEAFCED744027A10E0A29FD91D36AC4DEA1ED6E6AB24455F63F0E782B3E0CE7A9E
Malicious:	false
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".U.T.F.-.1.6.".?.>.....<.W.E.R.R.e.p.o.r.t.M.e.t.a.d.a.t.a.>.......<.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.........<.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.1.0...0.<./.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.........<.B.u.i.l.d.>.1.9.0.4.5.<./.B.u.i.l.d.>.........<.P.r.o.d.u.c.t.>.(.0.x.3.0.).:. .W.i.n.d.o.w.s. .1.0. .P.r.o.<./.P.r.o.d.u.c.t.>.........<.E.d.i.t.i.o.n.>.P.r.o.f.e.s.s.i.o.n.a.l.<./.E.d.i.t.i.o.n.>.........<.B.u.i.l.d.S.t.r.i.n.g.>.1.9.0.4.1...2.0.0.6...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6.<./.B.u.i.l.d.S.t.r.i.n.g.>.........<.R.e.v.i.s.i.o.n.>.2.0.0.6.<./.R.e.v.i.s.i.o.n.>.........<.F.l.a.v.o.r.>.M.u.l.t.i.p.r.o.c.e.s.s.o.r. .F.r.e.e.<./.F.l.a.v.o.r.>.........<.A.r.c.h.i.t.e.c.t.u.r.e.>.X.6.4.<./.A.r.c.h.i.t.e.c.t.u.r.e.>.........<.L.C.I.D.>.2.0.5.7.<./.L.C.I.D.>.......<./.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.......<.P.r.o.c.e.s.s.I.n.f.o.r.m.a.t.i.o.n.>.........<.P.i.d.>.2.9.9.6.<./.P.i.

C:\ProgramData\Microsoft\Windows\WER\Temp\WER4E7C.tmp.xml

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	4712
Entropy (8bit):	4.485328785477721
Encrypted:	false
SSDEEP:	48:cvIwWl8zsnJg77aI9S1WpW8VYLYm8M4J9NtFMGVm+q8vHNbTo6nMid:uIjfJI78E7VHJ9+dKHpTo2Mid
MD5:	7B6053A284656AC46EE8DB84F4D8BA7D
SHA1:	A4AFBF83A31F993397E53F69290B89E692F9A32C
SHA-256:	5D05525A4FEF752F4C2D5E533BB8D42D3BBE3958885872FE175029ED4827BE29
SHA-512:	793A96AC38C0ED5709D13F54B121080525B464173D9E2C8CC8FB63EF553C25B864D2A9AC3EC23250123C6F1387CC8704B69D10216645CEF9771FCD50879A555D
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8" standalone="yes"?>..<req ver="2">.. <tlm>.. <src>.. <desc>.. <mach>.. <os>.. <arg nm="vermaj" val="10" />.. <arg nm="vermin" val="0" />.. <arg nm="verbld" val="19045" />.. <arg nm="vercsdbld" val="2006" />.. <arg nm="verqfe" val="2006" />.. <arg nm="csdbld" val="2006" />.. <arg nm="versp" val="0" />.. <arg nm="arch" val="9" />.. <arg nm="lcid" val="2057" />.. <arg nm="geoid" val="223" />.. <arg nm="sku" val="48" />.. <arg nm="domain" val="0" />.. <arg nm="prodsuite" val="256" />.. <arg nm="ntprodtype" val="1" />.. <arg nm="platid" val="2" />.. <arg nm="tmsi" val="304183" />.. <arg nm="osinsty" val="1" />.. <arg nm="iever" val="11.789.19041.0-11.0.1000" />.. <arg nm="portos" val="0" />.. <arg nm="ram" val="409

C:\ProgramData\Microsoft\Windows\WER\Temp\WER4F28.tmp.xml

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	4712
Entropy (8bit):	4.481531954027711
Encrypted:	false
SSDEEP:	48:cvIwWl8zsnJg77aI9S1WpW8VYfYm8M4J9NtFkh+q8vHNirTo6nMdd:uIjfJI78E7VLJ9WhKHsrTo2Mdd
MD5:	D3137B0EBAF01386BB46786487CF6779
SHA1:	C45DE479B5A9570690BD29C7000682E7D4409711
SHA-256:	E8586E4E31670841E054A62D04831383084F0594E2B9D5448D682FA71ABBF826
SHA-512:	E29E03C8082B30A91A1CE8C6C80F0C4BB8AB6A3AC7CF7853E56544047A976D9466A14A6E88A86A7ED7E79C7C85CA034599C723CD57F122254552FB88742DA280
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8" standalone="yes"?>..<req ver="2">.. <tlm>.. <src>.. <desc>.. <mach>.. <os>.. <arg nm="vermaj" val="10" />.. <arg nm="vermin" val="0" />.. <arg nm="verbld" val="19045" />.. <arg nm="vercsdbld" val="2006" />.. <arg nm="verqfe" val="2006" />.. <arg nm="csdbld" val="2006" />.. <arg nm="versp" val="0" />.. <arg nm="arch" val="9" />.. <arg nm="lcid" val="2057" />.. <arg nm="geoid" val="223" />.. <arg nm="sku" val="48" />.. <arg nm="domain" val="0" />.. <arg nm="prodsuite" val="256" />.. <arg nm="ntprodtype" val="1" />.. <arg nm="platid" val="2" />.. <arg nm="tmsi" val="304183" />.. <arg nm="osinsty" val="1" />.. <arg nm="iever" val="11.789.19041.0-11.0.1000" />.. <arg nm="portos" val="0" />.. <arg nm="ram" val="409

C:\ProgramData\Microsoft\Windows\WER\Temp\WER5012.tmp.WERInternalMetadata.xml

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	8434
Entropy (8bit):	3.69589850732452
Encrypted:	false
SSDEEP:	192:R6l7wVeJQG6r6Y2DKSU5Zgmf2r6pBs89b3csfLdm:R6lXJJ6r6YXSU5Zgmf2r83vf8
MD5:	3777355B26F0585DB6AF71741C0D87EC
SHA1:	330450EEAD047A29932F077C6C22E5FD4F850020
SHA-256:	D9303212475EBC636E35C773B53DA3D0C4D70E2D0F8AECD29D9F02573A8C1B69
SHA-512:	E14DF876417542C5EA6BEF09025127D2377C73FE845D3326C675045F6E8BC957918CB7C4765C16A31BA6B5C92DA130582CFF3B81D3D0E37EB3D4FFD2F14C75AC
Malicious:	false
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".U.T.F.-.1.6.".?.>.....<.W.E.R.R.e.p.o.r.t.M.e.t.a.d.a.t.a.>.......<.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.........<.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.1.0...0.<./.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.........<.B.u.i.l.d.>.1.9.0.4.5.<./.B.u.i.l.d.>.........<.P.r.o.d.u.c.t.>.(.0.x.3.0.).:. .W.i.n.d.o.w.s. .1.0. .P.r.o.<./.P.r.o.d.u.c.t.>.........<.E.d.i.t.i.o.n.>.P.r.o.f.e.s.s.i.o.n.a.l.<./.E.d.i.t.i.o.n.>.........<.B.u.i.l.d.S.t.r.i.n.g.>.1.9.0.4.1...2.0.0.6...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6.<./.B.u.i.l.d.S.t.r.i.n.g.>.........<.R.e.v.i.s.i.o.n.>.2.0.0.6.<./.R.e.v.i.s.i.o.n.>.........<.F.l.a.v.o.r.>.M.u.l.t.i.p.r.o.c.e.s.s.o.r. .F.r.e.e.<./.F.l.a.v.o.r.>.........<.A.r.c.h.i.t.e.c.t.u.r.e.>.X.6.4.<./.A.r.c.h.i.t.e.c.t.u.r.e.>.........<.L.C.I.D.>.2.0.5.7.<./.L.C.I.D.>.......<./.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.......<.P.r.o.c.e.s.s.I.n.f.o.r.m.a.t.i.o.n.>.........<.P.i.d.>.5.0.9.2.<./.P.i.

C:\ProgramData\Microsoft\Windows\WER\Temp\WER5090.tmp.xml

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	4717
Entropy (8bit):	4.473634117684972
Encrypted:	false
SSDEEP:	48:cvIwWl8zsnJg77aI9S1WpW8VYwYm8M4J3NtFEg+q8vTN9Lwmad:uIjfJI78E7VoJ3jKTzLwmad
MD5:	B96B39D7D76FDEA475FB5E231DC80E31
SHA1:	120192DBE4AD4950809279D7DA6CB4E606899DCF
SHA-256:	29954F63A8C7F738962B7A26DE34911167CA66D3AC9894CF761745E24AC1E8D8
SHA-512:	506F2AD89761CEA342DFA1BECC882854B7E4A8B64B593537ACAD9785A7DFF704F304F06D5648A5F1C9B2A5790BBDFE66FE3A0278B691250F8EC3D57B820D1A62
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8" standalone="yes"?>..<req ver="2">.. <tlm>.. <src>.. <desc>.. <mach>.. <os>.. <arg nm="vermaj" val="10" />.. <arg nm="vermin" val="0" />.. <arg nm="verbld" val="19045" />.. <arg nm="vercsdbld" val="2006" />.. <arg nm="verqfe" val="2006" />.. <arg nm="csdbld" val="2006" />.. <arg nm="versp" val="0" />.. <arg nm="arch" val="9" />.. <arg nm="lcid" val="2057" />.. <arg nm="geoid" val="223" />.. <arg nm="sku" val="48" />.. <arg nm="domain" val="0" />.. <arg nm="prodsuite" val="256" />.. <arg nm="ntprodtype" val="1" />.. <arg nm="platid" val="2" />.. <arg nm="tmsi" val="304183" />.. <arg nm="osinsty" val="1" />.. <arg nm="iever" val="11.789.19041.0-11.0.1000" />.. <arg nm="portos" val="0" />.. <arg nm="ram" val="409

C:\ProgramData\Microsoft\Windows\WER\Temp\WER6445.tmp.dmp

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Mini DuMP crash report, 15 streams, Wed May 1 14:40:44 2024, 0x1205a4 type
Category:	dropped
Size (bytes):	87296
Entropy (8bit):	2.2711976993720717
Encrypted:	false
SSDEEP:	384:JYnhcwAGJNTvjL+QOjZy37QyOu148JdyvJW3YNoM8zn8saAvS0kLaamWePbkY:JiShGJNTv/mSOztovLaBeDk
MD5:	DDEFF98E8E9F704CC7767819034EADFC
SHA1:	40A5007B5843243B5329A7D67FE05BAA96BE3598
SHA-256:	AE06BDF1668EF1CB7EC723A0A20AAC9C5DE6568EB3A5DF17368F134E8FF77DC8
SHA-512:	0AB2C01A5C02A44D5E0769ABB9E77AFB0A5F91CF272594D2C5C4B2D054719D142D376C920720E7028593B3A0D137F4EEA80E8AD6557567BB862262113F1A80CD
Malicious:	false
Preview:	MDMP..a..... .......lT2f............T...............h.......<...@............;..........`.......8...........T............&..............\|...........h...............................................................................eJ..............GenuineIntel............T...........GT2f.............................0..................W... .E.u.r.o.p.e. .S.t.a.n.d.a.r.d. .T.i.m.e.......................................W... .E.u.r.o.p.e. .S.u.m.m.e.r. .T.i.m.e...........................................1.9.0.4.1...1...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6.......................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Windows\WER\Temp\WER6C06.tmp.WERInternalMetadata.xml

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	8438
Entropy (8bit):	3.6930815463905127
Encrypted:	false
SSDEEP:	192:R6l7wVeJN36/6Y2DnSUS2gmfvr6pBI89bL9sfuZm:R6lXJN6/6YaSUS2gmfvrAL2fh
MD5:	8F4233CC6ADE4450B3A0B69F603BBEAF
SHA1:	3EFCCB3F31CC9D9740CFD47A940EBD92A6023AB7
SHA-256:	D2E0219E48E9A1D39273033A31A8EACDBDF83B0C6E1E44169D60D53F9AA4E08B
SHA-512:	4EF66B38939F4AB7B6F3EFDC8EB1E029EF7198B45E78F035D60655445B0ECC3CD29F1531F44BBFF504B13C7F7E6A0E819954AAF84D9F2BEB437F1EDB7FAE49AE
Malicious:	false
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".U.T.F.-.1.6.".?.>.....<.W.E.R.R.e.p.o.r.t.M.e.t.a.d.a.t.a.>.......<.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.........<.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.1.0...0.<./.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.........<.B.u.i.l.d.>.1.9.0.4.5.<./.B.u.i.l.d.>.........<.P.r.o.d.u.c.t.>.(.0.x.3.0.).:. .W.i.n.d.o.w.s. .1.0. .P.r.o.<./.P.r.o.d.u.c.t.>.........<.E.d.i.t.i.o.n.>.P.r.o.f.e.s.s.i.o.n.a.l.<./.E.d.i.t.i.o.n.>.........<.B.u.i.l.d.S.t.r.i.n.g.>.1.9.0.4.1...2.0.0.6...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6.<./.B.u.i.l.d.S.t.r.i.n.g.>.........<.R.e.v.i.s.i.o.n.>.2.0.0.6.<./.R.e.v.i.s.i.o.n.>.........<.F.l.a.v.o.r.>.M.u.l.t.i.p.r.o.c.e.s.s.o.r. .F.r.e.e.<./.F.l.a.v.o.r.>.........<.A.r.c.h.i.t.e.c.t.u.r.e.>.X.6.4.<./.A.r.c.h.i.t.e.c.t.u.r.e.>.........<.L.C.I.D.>.2.0.5.7.<./.L.C.I.D.>.......<./.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.......<.P.r.o.c.e.s.s.I.n.f.o.r.m.a.t.i.o.n.>.........<.P.i.d.>.1.9.4.8.<./.P.i.

C:\ProgramData\Microsoft\Windows\WER\Temp\WER6CC2.tmp.xml

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	4722
Entropy (8bit):	4.476587574448641
Encrypted:	false
SSDEEP:	48:cvIwWl8zsnJg77aI9S1WpW8VYzAoYm8M4JNNtF2U7+q8vaN6ydmTBxd:uIjfJI78E7VQoJNf7KaM1TBxd
MD5:	D5017D87A4D223CA763191606A234362
SHA1:	0E3DE4B0E5DC1CA2F847AE501096552A141DC487
SHA-256:	5188CF6CAFBFA12BA3C5F76278432A60DA2D593364FAA61E5EBE7D12B757473D
SHA-512:	5D4E2A9DE7D70162ADE3E8E5B261B3B333E820A0508CF8090E22D15532242C81D7F28CEE32EDE5131002436FF229C7CAE448CDB406F730531A83E086D53B987D
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8" standalone="yes"?>..<req ver="2">.. <tlm>.. <src>.. <desc>.. <mach>.. <os>.. <arg nm="vermaj" val="10" />.. <arg nm="vermin" val="0" />.. <arg nm="verbld" val="19045" />.. <arg nm="vercsdbld" val="2006" />.. <arg nm="verqfe" val="2006" />.. <arg nm="csdbld" val="2006" />.. <arg nm="versp" val="0" />.. <arg nm="arch" val="9" />.. <arg nm="lcid" val="2057" />.. <arg nm="geoid" val="223" />.. <arg nm="sku" val="48" />.. <arg nm="domain" val="0" />.. <arg nm="prodsuite" val="256" />.. <arg nm="ntprodtype" val="1" />.. <arg nm="platid" val="2" />.. <arg nm="tmsi" val="304183" />.. <arg nm="osinsty" val="1" />.. <arg nm="iever" val="11.789.19041.0-11.0.1000" />.. <arg nm="portos" val="0" />.. <arg nm="ram" val="409

C:\ProgramData\Microsoft\Windows\WER\Temp\WER706A.tmp.dmp

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Mini DuMP crash report, 15 streams, Wed May 1 14:40:46 2024, 0x1205a4 type
Category:	dropped
Size (bytes):	85278
Entropy (8bit):	2.236671312469981
Encrypted:	false
SSDEEP:	384:3TWL90+cNTvYnrOqi3ufvoP9GvdybzSEFywoP2oM8og8Fa5iuESuaA8f8VX:3TWL2+cNTvYfnoP9AdDySZqZ
MD5:	AC0A05FFAFA2F0C07F1DC9981A4E73FC
SHA1:	F24C6E0356B50DF3E742562BA87E5B204D745D69
SHA-256:	DDCECF87A82399A7B690F8FAF562314472AB40F8A9FA5D9CD5AAEB2082AD951B
SHA-512:	2C7CD2DAB50BBB98C98986A7C13A6FBA33A34C8677CD1AAA58E9DEAC3695B56B4FD05BB1A9F0FEB8821B9E082017E72E6704E44D548063F437ACA75644058653
Malicious:	false
Preview:	MDMP..a..... .......nT2f............T...............h.......<................<..........`.......8...........T............$..V(..........T...........@...............................................................................eJ..............GenuineIntel............T...........LT2f.............................0..................W... .E.u.r.o.p.e. .S.t.a.n.d.a.r.d. .T.i.m.e.......................................W... .E.u.r.o.p.e. .S.u.m.m.e.r. .T.i.m.e...........................................1.9.0.4.1...1...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6.......................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Windows\WER\Temp\WER7125.tmp.dmp

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Mini DuMP crash report, 15 streams, Wed May 1 14:40:45 2024, 0x1205a4 type
Category:	dropped
Size (bytes):	59554
Entropy (8bit):	2.299899954807134
Encrypted:	false
SSDEEP:	384:ZoncfGJTvCeqBsxpRKoM8oDy8Fa3T5xz7mEq/PYl:ZocfGJTvcBsPqoTqX/Al
MD5:	5B58179CB24D5B9A2A71B7EEDFD30911
SHA1:	40AD0C5BCADECDD5182F79B16BA8B616274472E1
SHA-256:	148A90D291C4942C124D5B7C3E57B9208B2AE0D2BD912AC2B3CD51E57610C306
SHA-512:	D790553261FAB3F0D855F634EE892A60E32F8CEE061B2245C4901CB6B9FCD8FA77F9258C1CD669E2965F648527FF4C11880B1F7127E59370E666977C137A13E3
Malicious:	false
Preview:	MDMP..a..... .......mT2f....................................$...............(/..........`.......8...........T...........(...z.......................................................................................................eJ......<.......GenuineIntel............T...........cT2f............................. ..................W... .E.u.r.o.p.e. .S.t.a.n.d.a.r.d. .T.i.m.e.......................................W... .E.u.r.o.p.e. .S.u.m.m.e.r. .T.i.m.e...........................................1.9.0.4.1...1...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6.......................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Windows\WER\Temp\WER7174.tmp.dmp

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Mini DuMP crash report, 15 streams, Wed May 1 14:40:46 2024, 0x1205a4 type
Category:	dropped
Size (bytes):	98770
Entropy (8bit):	2.3074308344241845
Encrypted:	false
SSDEEP:	384:K6PLMDwEJTvGlIM2R3VbbyqPLrJ+4g5JyC7IGoI8MkN8ldY65SnuDeUU8SLe2O:K6PLywEJTvGlt2iqjrJhGG6q6dnEe2O
MD5:	2FC8ED14A1266082BF8830915F4BEA22
SHA1:	DB9F314F346979A31983BFDF0003CC8FFF639B57
SHA-256:	17A0CFAED22A95435C97D9968107E6F38C3BFB6D6F88093C89652C0D8A413B08
SHA-512:	5D01B2F1EC50BBA5A8E40739236CA4718AFA50B63416722437D7EE43F3A781ED645AA1055619B1CFB9D59C03982AF1681BCC01393EC1F42AD6B1EBEDD9199201
Malicious:	false
Preview:	MDMP..a..... .......nT2f........................D...........<................>..........`.......8...........T............*...W......................................................................................................eJ..............GenuineIntel............T...........MT2f.............................0..................W... .E.u.r.o.p.e. .S.t.a.n.d.a.r.d. .T.i.m.e.......................................W... .E.u.r.o.p.e. .S.u.m.m.e.r. .T.i.m.e...........................................1.9.0.4.1...1...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6.......................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Windows\WER\Temp\WER729D.tmp.WERInternalMetadata.xml

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	8434
Entropy (8bit):	3.694145581426758
Encrypted:	false
SSDEEP:	192:R6l7wVeJOjz6t6Y2D/SUi3gmf2r6pBF89bZYsf0fsdzm:R6lXJAz6t6YCSUi3gmf2r3ZLf0f/
MD5:	6D75F8A040F8762ECBFB8A89EBB7979E
SHA1:	639325662E55A075EB503BC655205260D1FAC428
SHA-256:	789651D3CFEB73C4D9F2CFE200DEAB9774590B67E6B4183504A31BA8EB42E5EC
SHA-512:	FEED9461997111AF36AC05FECFC1EE14B98DE38BE7F1FF4C934B78DA0C73EEFDCDC193A0C78AA6284A9D30D70C387ACCD499FCD66956D802E244D9EB20F90A37
Malicious:	false
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".U.T.F.-.1.6.".?.>.....<.W.E.R.R.e.p.o.r.t.M.e.t.a.d.a.t.a.>.......<.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.........<.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.1.0...0.<./.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.........<.B.u.i.l.d.>.1.9.0.4.5.<./.B.u.i.l.d.>.........<.P.r.o.d.u.c.t.>.(.0.x.3.0.).:. .W.i.n.d.o.w.s. .1.0. .P.r.o.<./.P.r.o.d.u.c.t.>.........<.E.d.i.t.i.o.n.>.P.r.o.f.e.s.s.i.o.n.a.l.<./.E.d.i.t.i.o.n.>.........<.B.u.i.l.d.S.t.r.i.n.g.>.1.9.0.4.1...2.0.0.6...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6.<./.B.u.i.l.d.S.t.r.i.n.g.>.........<.R.e.v.i.s.i.o.n.>.2.0.0.6.<./.R.e.v.i.s.i.o.n.>.........<.F.l.a.v.o.r.>.M.u.l.t.i.p.r.o.c.e.s.s.o.r. .F.r.e.e.<./.F.l.a.v.o.r.>.........<.A.r.c.h.i.t.e.c.t.u.r.e.>.X.6.4.<./.A.r.c.h.i.t.e.c.t.u.r.e.>.........<.L.C.I.D.>.2.0.5.7.<./.L.C.I.D.>.......<./.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.......<.P.r.o.c.e.s.s.I.n.f.o.r.m.a.t.i.o.n.>.........<.P.i.d.>.6.0.2.4.<./.P.i.

C:\ProgramData\Microsoft\Windows\WER\Temp\WER72ED.tmp.xml

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	4717
Entropy (8bit):	4.474687164690792
Encrypted:	false
SSDEEP:	48:cvIwWl8zsnJg77aI9S1WpW8VYYYm8M4J3NtFS/N+q8vTNC9LwmKd:uIjfJI78E7V0J3YFKTcLwmKd
MD5:	2FB60D7DBD7D1E5D0FC9686FEA769C36
SHA1:	A85A651D8E1A6F9297FF6C4D173D2C75B0F6A75C
SHA-256:	8E89F541BA98D851846AAEF3FDC5E9711F7E069B1EC1F8E73F3660DB4B90CC38
SHA-512:	8D0E4B86477E4E75EF84F2F5958C8F2EECED356CFBA95171AD0AE99E8E02118E8BF245D6682AB666233D129692DF3FD59FEA81C4632BBF474BE44905C87BDF05
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8" standalone="yes"?>..<req ver="2">.. <tlm>.. <src>.. <desc>.. <mach>.. <os>.. <arg nm="vermaj" val="10" />.. <arg nm="vermin" val="0" />.. <arg nm="verbld" val="19045" />.. <arg nm="vercsdbld" val="2006" />.. <arg nm="verqfe" val="2006" />.. <arg nm="csdbld" val="2006" />.. <arg nm="versp" val="0" />.. <arg nm="arch" val="9" />.. <arg nm="lcid" val="2057" />.. <arg nm="geoid" val="223" />.. <arg nm="sku" val="48" />.. <arg nm="domain" val="0" />.. <arg nm="prodsuite" val="256" />.. <arg nm="ntprodtype" val="1" />.. <arg nm="platid" val="2" />.. <arg nm="tmsi" val="304183" />.. <arg nm="osinsty" val="1" />.. <arg nm="iever" val="11.789.19041.0-11.0.1000" />.. <arg nm="portos" val="0" />.. <arg nm="ram" val="409

C:\ProgramData\Microsoft\Windows\WER\Temp\WER7359.tmp.WERInternalMetadata.xml

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	6408
Entropy (8bit):	3.7220483066244388
Encrypted:	false
SSDEEP:	192:R6l7wVeJXuw6Pt5yYvcr6pBM89bZCIcsfGqzm:R6lXJh6PWYkrsZCIvfm
MD5:	4CCF1628A9765FA0D86AE06912B4296C
SHA1:	C90A3479E550C541D86A34F46D7E7EC9A549C92A
SHA-256:	4C5C33573465257921CDFC409F36813053EBFC25A365CE304132BB862AADAD1F
SHA-512:	4CA295786918D4D126A6669AF0B52E9DD4C70097790EADB276579721FA7940A29943372B63B04D37BEEBA2F09A926C2657F49402E7FBA5E21C81FAA578601548
Malicious:	false
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".U.T.F.-.1.6.".?.>.....<.W.E.R.R.e.p.o.r.t.M.e.t.a.d.a.t.a.>.......<.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.........<.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.1.0...0.<./.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.........<.B.u.i.l.d.>.1.9.0.4.5.<./.B.u.i.l.d.>.........<.P.r.o.d.u.c.t.>.(.0.x.3.0.).:. .W.i.n.d.o.w.s. .1.0. .P.r.o.<./.P.r.o.d.u.c.t.>.........<.E.d.i.t.i.o.n.>.P.r.o.f.e.s.s.i.o.n.a.l.<./.E.d.i.t.i.o.n.>.........<.B.u.i.l.d.S.t.r.i.n.g.>.1.9.0.4.1...2.0.0.6...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6.<./.B.u.i.l.d.S.t.r.i.n.g.>.........<.R.e.v.i.s.i.o.n.>.2.0.0.6.<./.R.e.v.i.s.i.o.n.>.........<.F.l.a.v.o.r.>.M.u.l.t.i.p.r.o.c.e.s.s.o.r. .F.r.e.e.<./.F.l.a.v.o.r.>.........<.A.r.c.h.i.t.e.c.t.u.r.e.>.X.6.4.<./.A.r.c.h.i.t.e.c.t.u.r.e.>.........<.L.C.I.D.>.2.0.5.7.<./.L.C.I.D.>.......<./.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.......<.P.r.o.c.e.s.s.I.n.f.o.r.m.a.t.i.o.n.>.........<.P.i.d.>.6.0.8.0.<./.P.i.

C:\ProgramData\Microsoft\Windows\WER\Temp\WER73D7.tmp.xml

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	4712
Entropy (8bit):	4.484209298738292
Encrypted:	false
SSDEEP:	48:cvIwWl8zsnJg77aI9S1WpW8VYwYm8M4J9NtFs3+q8vHNbTo6nMid:uIjfJI78E7VEJ9i3KHpTo2Mid
MD5:	1BC5227BD8B90A3E24D6E49451F6CE58
SHA1:	85E8F45255FFE194F0E7E606B2868F73F807327F
SHA-256:	BB3B6D003D35E43A782BBBB63543803491D58A5B86A19F92E8491A5BEF806DA8
SHA-512:	B763BD687352C14853C53B34017FBDEBD62DEB8E94D42E83CAD24A6E7F1D80625A363F2F01071D9DC4931CBC477BA8F410FB2D8C5026D9F9D931ED2BFB3DCD41
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8" standalone="yes"?>..<req ver="2">.. <tlm>.. <src>.. <desc>.. <mach>.. <os>.. <arg nm="vermaj" val="10" />.. <arg nm="vermin" val="0" />.. <arg nm="verbld" val="19045" />.. <arg nm="vercsdbld" val="2006" />.. <arg nm="verqfe" val="2006" />.. <arg nm="csdbld" val="2006" />.. <arg nm="versp" val="0" />.. <arg nm="arch" val="9" />.. <arg nm="lcid" val="2057" />.. <arg nm="geoid" val="223" />.. <arg nm="sku" val="48" />.. <arg nm="domain" val="0" />.. <arg nm="prodsuite" val="256" />.. <arg nm="ntprodtype" val="1" />.. <arg nm="platid" val="2" />.. <arg nm="tmsi" val="304183" />.. <arg nm="osinsty" val="1" />.. <arg nm="iever" val="11.789.19041.0-11.0.1000" />.. <arg nm="portos" val="0" />.. <arg nm="ram" val="409

C:\ProgramData\Microsoft\Windows\WER\Temp\WER7424.tmp.WERInternalMetadata.xml

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	6408
Entropy (8bit):	3.719165959514013
Encrypted:	false
SSDEEP:	192:R6l7wVeJVug6YDYvcr6pBRv89bZ3sf/zm:R6lXJT6UYkrKQZ8fS
MD5:	B9F0E9F9F1042F55DC959765A7C16CA2
SHA1:	09E6A89A31742A542014A82ADD5C2D3FD5D4FC93
SHA-256:	BAA47A89A8360E6EF3BA340C4F7287AEEEBCEF621D14780EECABA0D774D948BB
SHA-512:	D229BB23BDBB0D3DB2C9C890A584871BE8CE3E15604C2565E47A03C5923C22EE96C2C4DECCD26282D58771D3C8718E06FD78BAA7A9C46D5676D2B1ABFCD4BBD6
Malicious:	false
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".U.T.F.-.1.6.".?.>.....<.W.E.R.R.e.p.o.r.t.M.e.t.a.d.a.t.a.>.......<.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.........<.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.1.0...0.<./.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.........<.B.u.i.l.d.>.1.9.0.4.5.<./.B.u.i.l.d.>.........<.P.r.o.d.u.c.t.>.(.0.x.3.0.).:. .W.i.n.d.o.w.s. .1.0. .P.r.o.<./.P.r.o.d.u.c.t.>.........<.E.d.i.t.i.o.n.>.P.r.o.f.e.s.s.i.o.n.a.l.<./.E.d.i.t.i.o.n.>.........<.B.u.i.l.d.S.t.r.i.n.g.>.1.9.0.4.1...2.0.0.6...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6.<./.B.u.i.l.d.S.t.r.i.n.g.>.........<.R.e.v.i.s.i.o.n.>.2.0.0.6.<./.R.e.v.i.s.i.o.n.>.........<.F.l.a.v.o.r.>.M.u.l.t.i.p.r.o.c.e.s.s.o.r. .F.r.e.e.<./.F.l.a.v.o.r.>.........<.A.r.c.h.i.t.e.c.t.u.r.e.>.X.6.4.<./.A.r.c.h.i.t.e.c.t.u.r.e.>.........<.L.C.I.D.>.2.0.5.7.<./.L.C.I.D.>.......<./.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.......<.P.r.o.c.e.s.s.I.n.f.o.r.m.a.t.i.o.n.>.........<.P.i.d.>.2.9.9.6.<./.P.i.

C:\ProgramData\Microsoft\Windows\WER\Temp\WER7473.tmp.xml

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	4712
Entropy (8bit):	4.479628565866061
Encrypted:	false
SSDEEP:	48:cvIwWl8zsnJg77aI9S1WpW8VYsYm8M4J9NtFl+q8vHNirTo6nMdd:uIjfJI78E7VsJ9zKHsrTo2Mdd
MD5:	C02ACCE3E6BFD668A9FDFB1F2B861D55
SHA1:	CB4713828B6DCF45A81C088D325D07CAD4CAC2F5
SHA-256:	B1F4B735811FC618D53825F6666E33621CF68427545EB698EBB937AB403E5C08
SHA-512:	6DAC05C28AD30D2B03CB1046160D4917A9BDC59F4BCF4F17663733A353DAE76AF6ABA1F43E22F61301EC0B36C33624E1AB28BC53A89EDC48DF2A54E060143182
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8" standalone="yes"?>..<req ver="2">.. <tlm>.. <src>.. <desc>.. <mach>.. <os>.. <arg nm="vermaj" val="10" />.. <arg nm="vermin" val="0" />.. <arg nm="verbld" val="19045" />.. <arg nm="vercsdbld" val="2006" />.. <arg nm="verqfe" val="2006" />.. <arg nm="csdbld" val="2006" />.. <arg nm="versp" val="0" />.. <arg nm="arch" val="9" />.. <arg nm="lcid" val="2057" />.. <arg nm="geoid" val="223" />.. <arg nm="sku" val="48" />.. <arg nm="domain" val="0" />.. <arg nm="prodsuite" val="256" />.. <arg nm="ntprodtype" val="1" />.. <arg nm="platid" val="2" />.. <arg nm="tmsi" val="304183" />.. <arg nm="osinsty" val="1" />.. <arg nm="iever" val="11.789.19041.0-11.0.1000" />.. <arg nm="portos" val="0" />.. <arg nm="ram" val="409

C:\ProgramData\Microsoft\Windows\WER\Temp\WER751D.tmp.dmp

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Mini DuMP crash report, 15 streams, Wed May 1 14:40:47 2024, 0x1205a4 type
Category:	dropped
Size (bytes):	86872
Entropy (8bit):	2.2821606270224186
Encrypted:	false
SSDEEP:	384:uhcwATNTvblQXJCU3PQ5Mu1b8JdyvJW3YNoM8zn8saAvS0qLK3azyFvn/uoDpC1:uShTNTvblIOMetovLanzyFv/Hg
MD5:	4E134B4153B8F300CC6F2B565283F7B9
SHA1:	303A9951B5007EE0F2D930B6CC6F3FF51A6D7248
SHA-256:	885CF1810BE71D5FB83C695E422C86C378E9C8D0F8E4552DE6B53393C6F1E69C
SHA-512:	07E99787BBBEBD3B38B5CBB12A30219BF4F399AB394986CA73336A499ECAD7C7E69BEE8A38CB57C6D292226122D900326A97F5D85F429FEB098D600FAD9F95DA
Malicious:	false
Preview:	MDMP..a..... .......oT2f............T...............h.......<...@............;..........`.......8...........T............&...,..........\|...........h...............................................................................eJ..............GenuineIntel............T...........GT2f.............................0..................W... .E.u.r.o.p.e. .S.t.a.n.d.a.r.d. .T.i.m.e.......................................W... .E.u.r.o.p.e. .S.u.m.m.e.r. .T.i.m.e...........................................1.9.0.4.1...1...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6.......................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Windows\WER\Temp\WER7D1D.tmp.WERInternalMetadata.xml

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	8436
Entropy (8bit):	3.6962559026975472
Encrypted:	false
SSDEEP:	192:R6l7wVeJNx6nO86Y2DTSUr8qBgmfvr6pBZ89bn9sfwfNm:R6lXJL6nl6Y+SUr8qBgmfvrrn2fwI
MD5:	2BCA9ADDF49E3C1BF28FEED5B42E2AB3
SHA1:	CC000E7BE2E29919E0E9BB2AA35B393887A19A41
SHA-256:	311098C3705FBCA605BFAB4D89FBB1F5B6DBDF822FD9730D9C9CD61D12D9B359
SHA-512:	A0A5E193C53B35182B1BEFE0C832C1D689ABE3C896F94DFB4D67F151D360F25CAF1E04B8E0C7993CCBFF0BC477A956C04C57C34B6AD0B82146C24CECD841E1A3
Malicious:	false
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".U.T.F.-.1.6.".?.>.....<.W.E.R.R.e.p.o.r.t.M.e.t.a.d.a.t.a.>.......<.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.........<.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.1.0...0.<./.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.........<.B.u.i.l.d.>.1.9.0.4.5.<./.B.u.i.l.d.>.........<.P.r.o.d.u.c.t.>.(.0.x.3.0.).:. .W.i.n.d.o.w.s. .1.0. .P.r.o.<./.P.r.o.d.u.c.t.>.........<.E.d.i.t.i.o.n.>.P.r.o.f.e.s.s.i.o.n.a.l.<./.E.d.i.t.i.o.n.>.........<.B.u.i.l.d.S.t.r.i.n.g.>.1.9.0.4.1...2.0.0.6...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6.<./.B.u.i.l.d.S.t.r.i.n.g.>.........<.R.e.v.i.s.i.o.n.>.2.0.0.6.<./.R.e.v.i.s.i.o.n.>.........<.F.l.a.v.o.r.>.M.u.l.t.i.p.r.o.c.e.s.s.o.r. .F.r.e.e.<./.F.l.a.v.o.r.>.........<.A.r.c.h.i.t.e.c.t.u.r.e.>.X.6.4.<./.A.r.c.h.i.t.e.c.t.u.r.e.>.........<.L.C.I.D.>.2.0.5.7.<./.L.C.I.D.>.......<./.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.......<.P.r.o.c.e.s.s.I.n.f.o.r.m.a.t.i.o.n.>.........<.P.i.d.>.1.9.4.8.<./.P.i.

C:\ProgramData\Microsoft\Windows\WER\Temp\WER7DAB.tmp.xml

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	4722
Entropy (8bit):	4.476947652189872
Encrypted:	false
SSDEEP:	48:cvIwWl8zsnJg77aI9S1WpW8VYMYm8M4JNNtFT+q8vaN6ydmTBxd:uIjfJI78E7VoJNdKaM1TBxd
MD5:	EAE8A99E4CB0C880EE9EF5F7038647AA
SHA1:	C89232AE5C189DB354CDC345CFA336F8DC791D22
SHA-256:	CC06D40DDF7B034B661A325DAF719CB9F69F37A2B6747829ECB05210674EDE1F
SHA-512:	FDF46B4B6F5B6DB8B7CCAA7CC933EB25CCBC414CC6452423F4DA97744E973E3FEE6E090D24B5A492A6F5C049880B76316B29A3F51531F2BF171165459AB31BEF
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8" standalone="yes"?>..<req ver="2">.. <tlm>.. <src>.. <desc>.. <mach>.. <os>.. <arg nm="vermaj" val="10" />.. <arg nm="vermin" val="0" />.. <arg nm="verbld" val="19045" />.. <arg nm="vercsdbld" val="2006" />.. <arg nm="verqfe" val="2006" />.. <arg nm="csdbld" val="2006" />.. <arg nm="versp" val="0" />.. <arg nm="arch" val="9" />.. <arg nm="lcid" val="2057" />.. <arg nm="geoid" val="223" />.. <arg nm="sku" val="48" />.. <arg nm="domain" val="0" />.. <arg nm="prodsuite" val="256" />.. <arg nm="ntprodtype" val="1" />.. <arg nm="platid" val="2" />.. <arg nm="tmsi" val="304183" />.. <arg nm="osinsty" val="1" />.. <arg nm="iever" val="11.789.19041.0-11.0.1000" />.. <arg nm="portos" val="0" />.. <arg nm="ram" val="409

C:\ProgramData\Microsoft\Windows\WER\Temp\WERB8.tmp.dmp

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Mini DuMP crash report, 15 streams, Wed May 1 14:40:17 2024, 0x1205a4 type
Category:	dropped
Size (bytes):	59312
Entropy (8bit):	2.2923021231966936
Encrypted:	false
SSDEEP:	384:m8J8NJTv+1abngePB2KoI8BtY8ldY25hG8:m8iNJTvWa76q2V
MD5:	33DAC73DC6E4697D5FA43A16AE7E8832
SHA1:	295EBA3609FF7B4F6E260AD671CA517720567CAF
SHA-256:	CC9D8C9BA4DE38CF63059DFD3FB86A2A13389AAEE0BE86AF43141FD629354726
SHA-512:	9A59EAE42CBD55CA163858E1286FDB432DC0F93A139D39C265661EFC03F361F8D56C312F656E5919A1538097DACCA7B50AF8B2FFF26690CD2A87F80BF3AB5FF2
Malicious:	false
Preview:	MDMP..a..... .......QT2f....................................$...............&/..........`.......8...........T.......................................................................................................................eJ......<.......GenuineIntel............T...........MT2f.............................0..................W... .E.u.r.o.p.e. .S.t.a.n.d.a.r.d. .T.i.m.e.......................................W... .E.u.r.o.p.e. .S.u.m.m.e.r. .T.i.m.e...........................................1.9.0.4.1...1...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6.......................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Windows\WER\Temp\WEREC07.tmp.dmp

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Mini DuMP crash report, 15 streams, Wed May 1 14:40:11 2024, 0x1205a4 type
Category:	dropped
Size (bytes):	61036
Entropy (8bit):	2.3246616207032935
Encrypted:	false
SSDEEP:	384:OYC2+y4NTvhT31asYTeTTlLKoM8gUa8saAvS0PELYHO5BKt:fCNy4NTvhTlao6vLab5BG
MD5:	02536188F269630545ACA5909932716F
SHA1:	4DF8F42C154E880E5EE87A531FC53851EA01357D
SHA-256:	EAF503A8B1202B1632F1EB2547DAEB76EF6B7147F45F509C13533E0B265896BA
SHA-512:	E9E531B278DA9284207DDD20489FEFEAF2641D69FFACEFB540A54AB6DB96A060D8FB516F577E319A0980A5FDA844126EA5634BB29F5A58A8EC22B759FAFEA6B4
Malicious:	false
Preview:	MDMP..a..... .......KT2f....................................$...l...........:0..........`.......8...........T............!..t.......................\|...............................................................................eJ..............GenuineIntel............T...........GT2f.............................0..................W... .E.u.r.o.p.e. .S.t.a.n.d.a.r.d. .T.i.m.e.......................................W... .E.u.r.o.p.e. .S.u.m.m.e.r. .T.i.m.e...........................................1.9.0.4.1...1...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6.......................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Windows\WER\Temp\WERECC4.tmp.WERInternalMetadata.xml

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	8434
Entropy (8bit):	3.6978056362041514
Encrypted:	false
SSDEEP:	192:R6l7wVeJNn6tos6Y2DbSUMZVgmfvr6pBG89bD9sfWy+Bm:R6lXJ96B6Y2SUYVgmfvryD2fW6
MD5:	E04E8EFBE425377DC1B4EB831D90891B
SHA1:	6368DA57A9D6EC043CD74DB7963C96EF939686A3
SHA-256:	E4D020CCC9DA235CBA9664C1E2BD96A73E8A8E8666C5469368DDB5B954F6B0BD
SHA-512:	F3DCE740D0CB9563AFF1F6032D15A17A0A724F1B3CFA48C4EE63A4D12B15C007D6047FA3E76A6DABEE0B4ECDF7A2E7E4ED8298D1FD2202EC26A4141AE014FCA8
Malicious:	false
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".U.T.F.-.1.6.".?.>.....<.W.E.R.R.e.p.o.r.t.M.e.t.a.d.a.t.a.>.......<.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.........<.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.1.0...0.<./.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.........<.B.u.i.l.d.>.1.9.0.4.5.<./.B.u.i.l.d.>.........<.P.r.o.d.u.c.t.>.(.0.x.3.0.).:. .W.i.n.d.o.w.s. .1.0. .P.r.o.<./.P.r.o.d.u.c.t.>.........<.E.d.i.t.i.o.n.>.P.r.o.f.e.s.s.i.o.n.a.l.<./.E.d.i.t.i.o.n.>.........<.B.u.i.l.d.S.t.r.i.n.g.>.1.9.0.4.1...2.0.0.6...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6.<./.B.u.i.l.d.S.t.r.i.n.g.>.........<.R.e.v.i.s.i.o.n.>.2.0.0.6.<./.R.e.v.i.s.i.o.n.>.........<.F.l.a.v.o.r.>.M.u.l.t.i.p.r.o.c.e.s.s.o.r. .F.r.e.e.<./.F.l.a.v.o.r.>.........<.A.r.c.h.i.t.e.c.t.u.r.e.>.X.6.4.<./.A.r.c.h.i.t.e.c.t.u.r.e.>.........<.L.C.I.D.>.2.0.5.7.<./.L.C.I.D.>.......<./.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.......<.P.r.o.c.e.s.s.I.n.f.o.r.m.a.t.i.o.n.>.........<.P.i.d.>.1.9.4.8.<./.P.i.

C:\ProgramData\Microsoft\Windows\WER\Temp\WERED23.tmp.xml

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	4722
Entropy (8bit):	4.477582945511748
Encrypted:	false
SSDEEP:	48:cvIwWl8zs4Jg77aI9S1WpW8VYIYm8M4JNNtFk7+q8vaN6ydmTBxd:uIjf+I78E7VoJNW7KaM1TBxd
MD5:	72306B7F839B296F52FB9A3C3890804C
SHA1:	B5E4427E0CD19A17649DEB414E707A1C4F6C9754
SHA-256:	699242D4CCC2C985BCA216314FA76BB97986C02E1BAEC23970BACF92EF111406
SHA-512:	2B9C2B2B6609CAC1AB695ACE830E958A3913DDE617FBF5BCC20186D8593AECCDC132E8658EDD7F2FDB7E2E534C3C87CB7234066886AC89EC6A911606DAF5E07A
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8" standalone="yes"?>..<req ver="2">.. <tlm>.. <src>.. <desc>.. <mach>.. <os>.. <arg nm="vermaj" val="10" />.. <arg nm="vermin" val="0" />.. <arg nm="verbld" val="19045" />.. <arg nm="vercsdbld" val="2006" />.. <arg nm="verqfe" val="2006" />.. <arg nm="csdbld" val="2006" />.. <arg nm="versp" val="0" />.. <arg nm="arch" val="9" />.. <arg nm="lcid" val="2057" />.. <arg nm="geoid" val="223" />.. <arg nm="sku" val="48" />.. <arg nm="domain" val="0" />.. <arg nm="prodsuite" val="256" />.. <arg nm="ntprodtype" val="1" />.. <arg nm="platid" val="2" />.. <arg nm="tmsi" val="304182" />.. <arg nm="osinsty" val="1" />.. <arg nm="iever" val="11.789.19041.0-11.0.1000" />.. <arg nm="portos" val="0" />.. <arg nm="ram" val="409

C:\ProgramData\Microsoft\Windows\WER\Temp\WERFE47.tmp.dmp

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Mini DuMP crash report, 15 streams, Wed May 1 14:40:16 2024, 0x1205a4 type
Category:	dropped
Size (bytes):	59728
Entropy (8bit):	2.2982178484628424
Encrypted:	false
SSDEEP:	384:Ker6sXGNTvla4tC9XTme761KoM88Al8Fa5iuEqACg0s:frvXGNTvllo9yySZK
MD5:	FDE1CF3A256FAFF54177A4D561129CBC
SHA1:	2DDE2BF76653FE3E1D484B58813E4E89C7356655
SHA-256:	561F1F90C3DE460779A31EA09E5A814DF616CE76C0B4EFFCE71AD76A4C9CCFB3
SHA-512:	0398877D10D5CF63CEC0E48E272229FD8F293B3133EDFB391CAB0C2DDCF75DF671A7C6A5DB33089107515B7E590C7CCD1E10D2337F5D121DEDEC4D9B8FD9E279
Malicious:	false
Preview:	MDMP..a..... .......PT2f........................(...........$................/..........`.......8...........T...........................$...........................................................................................eJ..............GenuineIntel............T...........LT2f.............................0..................W... .E.u.r.o.p.e. .S.t.a.n.d.a.r.d. .T.i.m.e.......................................W... .E.u.r.o.p.e. .S.u.m.m.e.r. .T.i.m.e...........................................1.9.0.4.1...1...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6.......................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Windows\WER\Temp\WERFF61.tmp.WERInternalMetadata.xml

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	6404
Entropy (8bit):	3.721432874191362
Encrypted:	false
SSDEEP:	192:R6l7wVeJXu762Yvcr6pBO89bsCIcsfckm:R6lXJC62YkrasCIvf2
MD5:	D745CA2E2AF5E7B8E176BF91B736CE93
SHA1:	4C61D58E768B9CC7D67BEBD9B269BAB38430B900
SHA-256:	7DD75B651510A306133350044DC80FBC1690EDFB0DB8B255D49AB97A3D299F7D
SHA-512:	C6688C5E92393AC804F05955A7428684B3F27C05A07F5B81B5A21DFEFC247A6F12C8A7A59C98C989CDCC8FA62E1E74964016CDFCEAB7864BDD2523C8D27F5244
Malicious:	false
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".U.T.F.-.1.6.".?.>.....<.W.E.R.R.e.p.o.r.t.M.e.t.a.d.a.t.a.>.......<.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.........<.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.1.0...0.<./.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.........<.B.u.i.l.d.>.1.9.0.4.5.<./.B.u.i.l.d.>.........<.P.r.o.d.u.c.t.>.(.0.x.3.0.).:. .W.i.n.d.o.w.s. .1.0. .P.r.o.<./.P.r.o.d.u.c.t.>.........<.E.d.i.t.i.o.n.>.P.r.o.f.e.s.s.i.o.n.a.l.<./.E.d.i.t.i.o.n.>.........<.B.u.i.l.d.S.t.r.i.n.g.>.1.9.0.4.1...2.0.0.6...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6.<./.B.u.i.l.d.S.t.r.i.n.g.>.........<.R.e.v.i.s.i.o.n.>.2.0.0.6.<./.R.e.v.i.s.i.o.n.>.........<.F.l.a.v.o.r.>.M.u.l.t.i.p.r.o.c.e.s.s.o.r. .F.r.e.e.<./.F.l.a.v.o.r.>.........<.A.r.c.h.i.t.e.c.t.u.r.e.>.X.6.4.<./.A.r.c.h.i.t.e.c.t.u.r.e.>.........<.L.C.I.D.>.2.0.5.7.<./.L.C.I.D.>.......<./.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.......<.P.r.o.c.e.s.s.I.n.f.o.r.m.a.t.i.o.n.>.........<.P.i.d.>.6.0.8.0.<./.P.i.

C:\ProgramData\Microsoft\Windows\WER\Temp\WERFFA1.tmp.xml

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	4712
Entropy (8bit):	4.483134434477087
Encrypted:	false
SSDEEP:	48:cvIwWl8zs4Jg77aI9S1WpW8VYHYm8M4J9NtF+s+q8vHNbTo6nMid:uIjf+I78E7VbJ9pKHpTo2Mid
MD5:	306F3611C35635EB0FFBC1A2CAA437A9
SHA1:	7EDC9AF4FCC012779AA2A4BD1FD46B12A5744F8F
SHA-256:	9F62EB8B8C6F7211B184087929AFC90858CE2A1D1289AC3131903304E7158E81
SHA-512:	2333D06B701E71BA369574D4DBA4B4780843FDB3B7B8FDD37BCB918FDB6EBC2C00F900034ADC18267C9A324882394F4E138F73910C56AA48C273D5BCEAD60339
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8" standalone="yes"?>..<req ver="2">.. <tlm>.. <src>.. <desc>.. <mach>.. <os>.. <arg nm="vermaj" val="10" />.. <arg nm="vermin" val="0" />.. <arg nm="verbld" val="19045" />.. <arg nm="vercsdbld" val="2006" />.. <arg nm="verqfe" val="2006" />.. <arg nm="csdbld" val="2006" />.. <arg nm="versp" val="0" />.. <arg nm="arch" val="9" />.. <arg nm="lcid" val="2057" />.. <arg nm="geoid" val="223" />.. <arg nm="sku" val="48" />.. <arg nm="domain" val="0" />.. <arg nm="prodsuite" val="256" />.. <arg nm="ntprodtype" val="1" />.. <arg nm="platid" val="2" />.. <arg nm="tmsi" val="304182" />.. <arg nm="osinsty" val="1" />.. <arg nm="iever" val="11.789.19041.0-11.0.1000" />.. <arg nm="portos" val="0" />.. <arg nm="ram" val="409

C:\Users\user\AppData\Local\RageMP131\RageMP131.exe

Download File

Process:	C:\Users\user\Desktop\2zdult23rz.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	997376
Entropy (8bit):	7.761305403187805
Encrypted:	false
SSDEEP:	24576:6ExQ6yPljU6/viqZ2yM8RTza/GasmzprSd3horG7VoCN2h/:6ExQJNjU6nVZhdhza/Gasmz5S52WyCNs
MD5:	733C1261CF02626F2354E6339BAA6717
SHA1:	C9E3599E1D7983FA7439BF2FF122FD7E51A59B93
SHA-256:	A14041622D7D427F0B7EA24EFAA7E80A3B025C211273CE0914EE34B5E71BC8C4
SHA-512:	09ECAB849F20CC7E418CC665446210B1AF870C345649709F57E52B1A520E2A5296110E572523A045EA565EAC393F33A0A14A082CB06EC5D175D232AD10FD93B4
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 82% Antivirus: Virustotal, Detection: 77%, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.....................o.....P......Q.....#...........?)U.....k....?)n....Rich....................PE..L...a.Jd.....................r......m@............@..........................p...............................................j..d.......................................8....................`......@`..@............................................text............................... ..`.rdata..Pt.......v..................@..@.data................`..............@....rsrc................H..............@..@........................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\RageMP131\RageMP131.exe:Zone.Identifier

Download File

Process:	C:\Users\user\Desktop\2zdult23rz.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	26
Entropy (8bit):	3.95006375643621
Encrypted:	false
SSDEEP:	3:ggPYV:rPYV
MD5:	187F488E27DB4AF347237FE461A079AD
SHA1:	6693BA299EC1881249D59262276A0D2CB21F8E64
SHA-256:	255A65D30841AB4082BD9D0EEA79D49C5EE88F56136157D8D6156AEF11C12309
SHA-512:	89879F237C0C051EBE784D0690657A6827A312A82735DA42DAD5F744D734FC545BEC9642C19D14C05B2F01FF53BC731530C92F7327BB7DC9CDE1B60FB21CD64E
Malicious:	false
Preview:	[ZoneTransfer]....ZoneId=0

C:\Users\user\AppData\Local\Temp\rage131MP.tmp

Download File

Process:	C:\Users\user\Desktop\2zdult23rz.exe
File Type:	ASCII text, with no line terminators
Category:	modified
Size (bytes):	13
Entropy (8bit):	2.8150724101159437
Encrypted:	false
SSDEEP:	3:LtWw:0w
MD5:	144CC877A0C2CF482E7AE4DE9BEA10C0
SHA1:	F8AA8CE7E90D15065A8AEEC9FDC9F8CA526F6A01
SHA-256:	E07A83F90C72C98A0EC4CF4078C41AA6F25816B691B1A13E6ACECE56DA619DDE
SHA-512:	5E0272CA778C901131238F0A55731C99EB1210284D4FB58ABD0F5E24873130493C7A4F0BB5DD7C27CA9C28C1F3AA453715F41067BE76F3190D2A99680C3E20E6
Malicious:	false
Preview:	1714580515092

C:\Windows\appcompat\Programs\Amcache.hve

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	MS Windows registry file, NT/2000 or above
Category:	dropped
Size (bytes):	1835008
Entropy (8bit):	4.471292231776426
Encrypted:	false
SSDEEP:	6144:dzZfpi6ceLPx9skLmb0fWZWSP3aJG8nAgeiJRMMhA2zX4WABluuNajDH5S:1ZHtWZWOKnMM6bFpQj4
MD5:	BB8CCCD2FB008F2664DCD620A6C60DBE
SHA1:	AB360B649411C223B7FD3B9F63B94BBB15C4E871
SHA-256:	8CD83EF4615C3EA25AA8142353562748DB7150A18D1B11086DE9F7B04B337BAE
SHA-512:	6929198462C726139A1826A3D1D16C201701EF85C4CB6EC64049CF7F31870474DAB561BD3DE834FFC9BE4E05480E5892C5B292055BAD3C85CDCB75123FA5C87F
Malicious:	false
Preview:	regfK...K....\.Z.................... ...........\.A.p.p.C.o.m.p.a.t.\.P.r.o.g.r.a.m.s.\.A.m.c.a.c.h.e...h.v.e....c...b...#.......c...b...#...........c...b...#......rmtm.U.x...............................................................................................................................................................................................................................................................................................................................................e..L........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	7.761305403187805
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	2zdult23rz.exe
File size:	997'376 bytes
MD5:	733c1261cf02626f2354e6339baa6717
SHA1:	c9e3599e1d7983fa7439bf2ff122fd7e51a59b93
SHA256:	a14041622d7d427f0b7ea24efaa7e80a3b025c211273ce0914ee34b5e71bc8c4
SHA512:	09ecab849f20cc7e418cc665446210b1af870c345649709f57e52b1a520e2a5296110e572523a045ea565eac393f33a0a14a082cb06ec5d175d232ad10fd93b4
SSDEEP:	24576:6ExQ6yPljU6/viqZ2yM8RTza/GasmzprSd3horG7VoCN2h/:6ExQJNjU6nVZhdhza/Gasmz5S52WyCNs
TLSH:	94251200B6D0C936E6B71B321CB3D644063EFE655A3188372398964EEEB51E04B357BB
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........................o.......P.......Q.......#.............?)U.......k.....?)n.....Rich....................PE..L...a.Jd...........

File Icon


Icon Hash:	cd0d3d2e4e054d05

Static PE Info

General

Entrypoint:	0x40406d
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	RELOCS_STRIPPED, EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	NX_COMPAT, TERMINAL_SERVER_AWARE
Time Stamp:	0x644A8961 [Thu Apr 27 14:40:33 2023 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	5
OS Version Minor:	1
File Version Major:	5
File Version Minor:	1
Subsystem Version Major:	5
Subsystem Version Minor:	1
Import Hash:	9f06483be0cb3e943a20251385e705a2

Entrypoint Preview

Instruction
call 00007F3004D38B28h
jmp 00007F3004D32EF5h
push 00000014h
push 004166A8h
call 00007F3004D36072h
call 00007F3004D37C33h
movzx esi, ax
push 00000002h
call 00007F3004D38ABBh
pop ecx
mov eax, 00005A4Dh
cmp word ptr [00400000h], ax
je 00007F3004D32EF6h
xor ebx, ebx
jmp 00007F3004D32F25h
mov eax, dword ptr [0040003Ch]
cmp dword ptr [eax+00400000h], 00004550h
jne 00007F3004D32EDDh
mov ecx, 0000010Bh
cmp word ptr [eax+00400018h], cx
jne 00007F3004D32ECFh
xor ebx, ebx
cmp dword ptr [eax+00400074h], 0Eh
jbe 00007F3004D32EFBh
cmp dword ptr [eax+004000E8h], ebx
setne bl
mov dword ptr [ebp-1Ch], ebx
call 00007F3004D35EE8h
test eax, eax
jne 00007F3004D32EFAh
push 0000001Ch
call 00007F3004D32FD1h
pop ecx
call 00007F3004D355C9h
test eax, eax
jne 00007F3004D32EFAh
push 00000010h
call 00007F3004D32FC0h
pop ecx
call 00007F3004D3797Ch
and dword ptr [ebp-04h], 00000000h
call 00007F3004D36FD5h
test eax, eax
jns 00007F3004D32EFAh
push 0000001Bh
call 00007F3004D32FA6h
pop ecx
call dword ptr [004100D0h]
mov dword ptr [040D776Ch], eax
call 00007F3004D38B0Fh
mov dword ptr [004E6720h], eax
call 00007F3004D3870Ch
test eax, eax
jns 00007F3004D32EFAh

Rich Headers

Programming Language:

[ASM] VS2013 build 21005
[ C ] VS2013 build 21005
[C++] VS2013 build 21005
[IMP] VS2008 SP1 build 30729
[RES] VS2013 build 21005
[LNK] VS2013 UPD5 build 40629

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x16adc	0x64	.rdata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x3cd8000	0xeea8	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DEBUG	0x10200	0x38	.rdata
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x16088	0x18	.rdata
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x16040	0x40	.rdata
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x10000	0x198	.rdata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0xe413	0xe600	1bc7c92a67f4b4a1ee59f8901b6c14fc	False	0.602156929347826	data	6.687317669995655	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rdata	0x10000	0x7450	0x7600	cad4a79147b5958598b6e035215e9ec9	False	0.3894994703389831	data	4.891024909888555	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0x18000	0x3cbf784	0xce800	08cbfa7ecb757f3d96aafa7dc4f02276	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0x3cd8000	0xeea8	0xf000	bee25c7a862d4071b940f9cc423571a6	False	0.47342122395833336	data	5.127157311164671	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_ICON	0x3cd8570	0xea8	Device independent bitmap graphic, 48 x 96 x 8, image size 2304, 256 important colors	Romanian	Romania	0.4853411513859275
RT_ICON	0x3cd9418	0x8a8	Device independent bitmap graphic, 32 x 64 x 8, image size 1024, 256 important colors	Romanian	Romania	0.5961191335740073
RT_ICON	0x3cd9cc0	0x6c8	Device independent bitmap graphic, 24 x 48 x 8, image size 576, 256 important colors	Romanian	Romania	0.6497695852534562
RT_ICON	0x3cda388	0x568	Device independent bitmap graphic, 16 x 32 x 8, image size 256, 256 important colors	Romanian	Romania	0.6473988439306358
RT_ICON	0x3cda8f0	0x25a8	Device independent bitmap graphic, 48 x 96 x 32, image size 9216	Romanian	Romania	0.3899377593360996
RT_ICON	0x3cdce98	0x10a8	Device independent bitmap graphic, 32 x 64 x 32, image size 4096	Romanian	Romania	0.5086772983114447
RT_ICON	0x3cddf40	0x988	Device independent bitmap graphic, 24 x 48 x 32, image size 2304	Romanian	Romania	0.5856557377049181
RT_ICON	0x3cde8c8	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 1024	Romanian	Romania	0.6773049645390071
RT_ICON	0x3cdeda8	0xea8	Device independent bitmap graphic, 48 x 96 x 8, image size 0	Romanian	Romania	0.40671641791044777
RT_ICON	0x3cdfc50	0x8a8	Device independent bitmap graphic, 32 x 64 x 8, image size 0	Romanian	Romania	0.4368231046931408
RT_ICON	0x3ce04f8	0x6c8	Device independent bitmap graphic, 24 x 48 x 8, image size 0	Romanian	Romania	0.5374423963133641
RT_ICON	0x3ce0bc0	0x568	Device independent bitmap graphic, 16 x 32 x 8, image size 0	Romanian	Romania	0.41040462427745666
RT_ICON	0x3ce1128	0x25a8	Device independent bitmap graphic, 48 x 96 x 32, image size 0	Romanian	Romania	0.45363070539419087
RT_ICON	0x3ce36d0	0x10a8	Device independent bitmap graphic, 32 x 64 x 32, image size 0	Romanian	Romania	0.47115384615384615
RT_ICON	0x3ce4778	0x988	Device independent bitmap graphic, 24 x 48 x 32, image size 0	Romanian	Romania	0.4905737704918033
RT_ICON	0x3ce5100	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 0	Romanian	Romania	0.5452127659574468
RT_DIALOG	0x3ce57c8	0x52	data			0.8780487804878049
RT_STRING	0x3ce5820	0x432	data	Romanian	Romania	0.45251396648044695
RT_STRING	0x3ce5c58	0x4d4	data	Romanian	Romania	0.44660194174757284
RT_STRING	0x3ce6130	0x13a	data	Romanian	Romania	0.5286624203821656
RT_STRING	0x3ce6270	0x30a	data	Romanian	Romania	0.47429305912596403
RT_STRING	0x3ce6580	0x638	data	Romanian	Romania	0.43027638190954776
RT_STRING	0x3ce6bb8	0x2ec	data	Romanian	Romania	0.47058823529411764
RT_GROUP_ICON	0x3cded30	0x76	data	Romanian	Romania	0.6610169491525424
RT_GROUP_ICON	0x3ce5568	0x76	data	Romanian	Romania	0.6694915254237288
RT_VERSION	0x3ce55e0	0x1e4	data			0.5371900826446281

Imports

DLL	Import
KERNEL32.dll	GetUserDefaultLCID, AddConsoleAliasW, CreateHardLinkA, GetTickCount, EnumTimeFormatsW, GetUserDefaultLangID, FindResourceExA, GetVolumeInformationA, GetCompressedFileSizeA, GetTempPathW, SetThreadLocale, SetLastError, GetProcAddress, CreateTimerQueueTimer, SetFileAttributesA, LocalCompact, LoadLibraryA, WriteConsoleA, InterlockedExchangeAdd, LocalAlloc, SetCalendarInfoW, GetExitCodeThread, RemoveDirectoryW, AddAtomA, SetNamedPipeHandleState, GlobalFindAtomW, GetModuleFileNameA, GetOEMCP, GlobalUnWire, LoadLibraryExA, ReadConsoleInputW, GetWindowsDirectoryW, AddConsoleAliasA, FindFirstChangeNotificationW, GetLocaleInfoA, BuildCommDCBW, GetComputerNameA, WriteConsoleW, OutputDebugStringW, GetLastError, HeapFree, EncodePointer, DecodePointer, ReadFile, ExitProcess, GetModuleHandleExW, MultiByteToWideChar, WideCharToMultiByte, GetCommandLineA, RaiseException, RtlUnwind, IsProcessorFeaturePresent, IsValidCodePage, GetACP, GetCPInfo, GetCurrentThreadId, IsDebuggerPresent, HeapAlloc, GetProcessHeap, HeapSize, EnterCriticalSection, LeaveCriticalSection, SetFilePointerEx, GetConsoleMode, GetStdHandle, GetFileType, DeleteCriticalSection, GetStartupInfoW, CloseHandle, UnhandledExceptionFilter, SetUnhandledExceptionFilter, InitializeCriticalSectionAndSpinCount, Sleep, GetCurrentProcess, TerminateProcess, TlsAlloc, TlsGetValue, TlsSetValue, TlsFree, GetModuleHandleW, WriteFile, GetModuleFileNameW, LoadLibraryExW, QueryPerformanceCounter, GetCurrentProcessId, GetSystemTimeAsFileTime, GetEnvironmentStringsW, FreeEnvironmentStringsW, GetStringTypeW, HeapReAlloc, LCMapStringW, SetStdHandle, GetConsoleCP, FlushFileBuffers, CreateFileW
GDI32.dll	GetCharacterPlacementW
ADVAPI32.dll	DeregisterEventSource
WINHTTP.dll	WinHttpConnect

Possible Origin

Language of compilation system	Country where language is spoken	Map
Romanian	Romania

Network Behavior

Snort IDS Alerts

Timestamp	Protocol	SID	Message	Source Port	Dest Port	Source IP	Dest IP
05/01/24-16:40:33.992588	TCP	2046267	ET TROJAN [ANY.RUN] RisePro TCP (External IP)	58709	49700	147.45.47.93	192.168.2.6
05/01/24-16:40:18.542503	TCP	2046266	ET TROJAN [ANY.RUN] RisePro TCP (Token)	58709	49700	147.45.47.93	192.168.2.6
05/01/24-16:40:34.007377	TCP	2046267	ET TROJAN [ANY.RUN] RisePro TCP (External IP)	58709	49701	147.45.47.93	192.168.2.6
05/01/24-16:42:16.940552	TCP	2046269	ET TROJAN [ANY.RUN] RisePro TCP (Activity)	49701	58709	192.168.2.6	147.45.47.93
05/01/24-16:40:19.140548	TCP	2046266	ET TROJAN [ANY.RUN] RisePro TCP (Token)	58709	49701	147.45.47.93	192.168.2.6
05/01/24-16:40:13.617057	TCP	2049060	ET TROJAN RisePro TCP Heartbeat Packet	49699	58709	192.168.2.6	147.45.47.93
05/01/24-16:42:16.940639	TCP	2046269	ET TROJAN [ANY.RUN] RisePro TCP (Activity)	49711	58709	192.168.2.6	147.45.47.93
05/01/24-16:42:16.940554	TCP	2046269	ET TROJAN [ANY.RUN] RisePro TCP (Activity)	49700	58709	192.168.2.6	147.45.47.93
05/01/24-16:40:33.711799	TCP	2046267	ET TROJAN [ANY.RUN] RisePro TCP (External IP)	58709	49699	147.45.47.93	192.168.2.6
05/01/24-16:40:13.812784	TCP	2046266	ET TROJAN [ANY.RUN] RisePro TCP (Token)	58709	49699	147.45.47.93	192.168.2.6
05/01/24-16:40:31.596033	TCP	2046266	ET TROJAN [ANY.RUN] RisePro TCP (Token)	58709	49709	147.45.47.93	192.168.2.6
05/01/24-16:40:34.194330	TCP	2046267	ET TROJAN [ANY.RUN] RisePro TCP (External IP)	58709	49709	147.45.47.93	192.168.2.6
05/01/24-16:40:48.719023	TCP	2046266	ET TROJAN [ANY.RUN] RisePro TCP (Token)	58709	49711	147.45.47.93	192.168.2.6
05/01/24-16:42:16.940722	TCP	2046269	ET TROJAN [ANY.RUN] RisePro TCP (Activity)	49709	58709	192.168.2.6	147.45.47.93
05/01/24-16:42:16.940631	TCP	2046269	ET TROJAN [ANY.RUN] RisePro TCP (Activity)	49699	58709	192.168.2.6	147.45.47.93

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
May 1, 2024 16:40:13.406466961 CEST	49699	58709	192.168.2.6	147.45.47.93
May 1, 2024 16:40:13.609577894 CEST	58709	49699	147.45.47.93	192.168.2.6
May 1, 2024 16:40:13.609698057 CEST	49699	58709	192.168.2.6	147.45.47.93
May 1, 2024 16:40:13.617057085 CEST	49699	58709	192.168.2.6	147.45.47.93
May 1, 2024 16:40:13.812783957 CEST	58709	49699	147.45.47.93	192.168.2.6
May 1, 2024 16:40:13.873215914 CEST	58709	49699	147.45.47.93	192.168.2.6
May 1, 2024 16:40:13.955691099 CEST	49699	58709	192.168.2.6	147.45.47.93
May 1, 2024 16:40:16.940587044 CEST	49699	58709	192.168.2.6	147.45.47.93
May 1, 2024 16:40:17.186428070 CEST	58709	49699	147.45.47.93	192.168.2.6
May 1, 2024 16:40:18.126161098 CEST	49700	58709	192.168.2.6	147.45.47.93
May 1, 2024 16:40:18.334325075 CEST	58709	49700	147.45.47.93	192.168.2.6
May 1, 2024 16:40:18.334430933 CEST	49700	58709	192.168.2.6	147.45.47.93
May 1, 2024 16:40:18.389303923 CEST	49700	58709	192.168.2.6	147.45.47.93
May 1, 2024 16:40:18.542503119 CEST	58709	49700	147.45.47.93	192.168.2.6
May 1, 2024 16:40:18.639256001 CEST	58709	49700	147.45.47.93	192.168.2.6
May 1, 2024 16:40:18.658863068 CEST	49700	58709	192.168.2.6	147.45.47.93
May 1, 2024 16:40:18.728030920 CEST	49701	58709	192.168.2.6	147.45.47.93
May 1, 2024 16:40:18.932456017 CEST	58709	49701	147.45.47.93	192.168.2.6
May 1, 2024 16:40:18.936094999 CEST	49701	58709	192.168.2.6	147.45.47.93
May 1, 2024 16:40:18.946038961 CEST	49701	58709	192.168.2.6	147.45.47.93
May 1, 2024 16:40:19.140547991 CEST	58709	49701	147.45.47.93	192.168.2.6
May 1, 2024 16:40:19.201437950 CEST	58709	49701	147.45.47.93	192.168.2.6
May 1, 2024 16:40:19.205708981 CEST	49701	58709	192.168.2.6	147.45.47.93
May 1, 2024 16:40:21.674609900 CEST	49700	58709	192.168.2.6	147.45.47.93
May 1, 2024 16:40:21.935975075 CEST	58709	49700	147.45.47.93	192.168.2.6
May 1, 2024 16:40:22.252996922 CEST	49701	58709	192.168.2.6	147.45.47.93
May 1, 2024 16:40:22.498404980 CEST	58709	49701	147.45.47.93	192.168.2.6
May 1, 2024 16:40:31.189016104 CEST	49709	58709	192.168.2.6	147.45.47.93
May 1, 2024 16:40:31.392445087 CEST	58709	49709	147.45.47.93	192.168.2.6
May 1, 2024 16:40:31.392528057 CEST	49709	58709	192.168.2.6	147.45.47.93
May 1, 2024 16:40:31.403351068 CEST	49709	58709	192.168.2.6	147.45.47.93
May 1, 2024 16:40:31.596033096 CEST	58709	49709	147.45.47.93	192.168.2.6
May 1, 2024 16:40:31.656075001 CEST	58709	49709	147.45.47.93	192.168.2.6
May 1, 2024 16:40:31.705787897 CEST	49709	58709	192.168.2.6	147.45.47.93
May 1, 2024 16:40:33.711798906 CEST	58709	49699	147.45.47.93	192.168.2.6
May 1, 2024 16:40:33.752621889 CEST	49699	58709	192.168.2.6	147.45.47.93
May 1, 2024 16:40:33.958870888 CEST	58709	49699	147.45.47.93	192.168.2.6
May 1, 2024 16:40:33.992588043 CEST	58709	49700	147.45.47.93	192.168.2.6
May 1, 2024 16:40:34.002573013 CEST	49699	58709	192.168.2.6	147.45.47.93
May 1, 2024 16:40:34.007376909 CEST	58709	49701	147.45.47.93	192.168.2.6
May 1, 2024 16:40:34.033839941 CEST	49700	58709	192.168.2.6	147.45.47.93
May 1, 2024 16:40:34.049483061 CEST	49701	58709	192.168.2.6	147.45.47.93
May 1, 2024 16:40:34.194329977 CEST	58709	49709	147.45.47.93	192.168.2.6
May 1, 2024 16:40:34.237039089 CEST	49709	58709	192.168.2.6	147.45.47.93
May 1, 2024 16:40:34.342899084 CEST	58709	49700	147.45.47.93	192.168.2.6
May 1, 2024 16:40:34.393189907 CEST	49700	58709	192.168.2.6	147.45.47.93
May 1, 2024 16:40:34.405524015 CEST	58709	49699	147.45.47.93	192.168.2.6
May 1, 2024 16:40:34.441570044 CEST	58709	49701	147.45.47.93	192.168.2.6
May 1, 2024 16:40:34.455753088 CEST	49699	58709	192.168.2.6	147.45.47.93
May 1, 2024 16:40:34.487099886 CEST	49701	58709	192.168.2.6	147.45.47.93
May 1, 2024 16:40:34.601336002 CEST	58709	49700	147.45.47.93	192.168.2.6
May 1, 2024 16:40:34.639328957 CEST	58709	49709	147.45.47.93	192.168.2.6
May 1, 2024 16:40:34.643320084 CEST	49700	58709	192.168.2.6	147.45.47.93
May 1, 2024 16:40:34.690196037 CEST	49709	58709	192.168.2.6	147.45.47.93
May 1, 2024 16:40:34.717175007 CEST	58709	49701	147.45.47.93	192.168.2.6
May 1, 2024 16:40:34.718092918 CEST	49709	58709	192.168.2.6	147.45.47.93
May 1, 2024 16:40:34.768333912 CEST	49701	58709	192.168.2.6	147.45.47.93
May 1, 2024 16:40:34.966950893 CEST	58709	49709	147.45.47.93	192.168.2.6
May 1, 2024 16:40:35.309360981 CEST	49700	58709	192.168.2.6	147.45.47.93
May 1, 2024 16:40:35.560983896 CEST	58709	49700	147.45.47.93	192.168.2.6
May 1, 2024 16:40:35.609370947 CEST	49701	58709	192.168.2.6	147.45.47.93
May 1, 2024 16:40:35.857661963 CEST	58709	49701	147.45.47.93	192.168.2.6
May 1, 2024 16:40:38.086884975 CEST	49699	58709	192.168.2.6	147.45.47.93
May 1, 2024 16:40:38.344419003 CEST	58709	49699	147.45.47.93	192.168.2.6
May 1, 2024 16:40:45.711493015 CEST	49709	58709	192.168.2.6	147.45.47.93
May 1, 2024 16:40:45.967067957 CEST	58709	49709	147.45.47.93	192.168.2.6
May 1, 2024 16:40:47.662230015 CEST	49710	443	192.168.2.6	34.117.186.192
May 1, 2024 16:40:47.662275076 CEST	443	49710	34.117.186.192	192.168.2.6
May 1, 2024 16:40:47.662334919 CEST	49710	443	192.168.2.6	34.117.186.192
May 1, 2024 16:40:47.836097002 CEST	49710	443	192.168.2.6	34.117.186.192
May 1, 2024 16:40:47.836139917 CEST	443	49710	34.117.186.192	192.168.2.6
May 1, 2024 16:40:48.038634062 CEST	443	49710	34.117.186.192	192.168.2.6
May 1, 2024 16:40:48.038714886 CEST	49710	443	192.168.2.6	34.117.186.192
May 1, 2024 16:40:48.043462992 CEST	49710	443	192.168.2.6	34.117.186.192
May 1, 2024 16:40:48.043473959 CEST	443	49710	34.117.186.192	192.168.2.6
May 1, 2024 16:40:48.043762922 CEST	443	49710	34.117.186.192	192.168.2.6
May 1, 2024 16:40:48.221343040 CEST	49710	443	192.168.2.6	34.117.186.192
May 1, 2024 16:40:48.310096979 CEST	49711	58709	192.168.2.6	147.45.47.93
May 1, 2024 16:40:48.340424061 CEST	49710	443	192.168.2.6	34.117.186.192
May 1, 2024 16:40:48.384126902 CEST	443	49710	34.117.186.192	192.168.2.6
May 1, 2024 16:40:48.472321033 CEST	443	49710	34.117.186.192	192.168.2.6
May 1, 2024 16:40:48.472428083 CEST	443	49710	34.117.186.192	192.168.2.6
May 1, 2024 16:40:48.472501040 CEST	49710	443	192.168.2.6	34.117.186.192
May 1, 2024 16:40:48.476672888 CEST	49710	443	192.168.2.6	34.117.186.192
May 1, 2024 16:40:48.476690054 CEST	443	49710	34.117.186.192	192.168.2.6
May 1, 2024 16:40:48.476701975 CEST	49710	443	192.168.2.6	34.117.186.192
May 1, 2024 16:40:48.476707935 CEST	443	49710	34.117.186.192	192.168.2.6
May 1, 2024 16:40:48.514645100 CEST	58709	49711	147.45.47.93	192.168.2.6
May 1, 2024 16:40:48.514731884 CEST	49711	58709	192.168.2.6	147.45.47.93
May 1, 2024 16:40:48.719022989 CEST	58709	49711	147.45.47.93	192.168.2.6
May 1, 2024 16:40:48.783830881 CEST	49711	58709	192.168.2.6	147.45.47.93
May 1, 2024 16:40:49.090692043 CEST	49711	58709	192.168.2.6	147.45.47.93
May 1, 2024 16:40:49.342317104 CEST	58709	49711	147.45.47.93	192.168.2.6
May 1, 2024 16:40:50.026005983 CEST	49712	443	192.168.2.6	104.26.4.15
May 1, 2024 16:40:50.026062965 CEST	443	49712	104.26.4.15	192.168.2.6
May 1, 2024 16:40:50.026132107 CEST	49712	443	192.168.2.6	104.26.4.15
May 1, 2024 16:40:50.026834011 CEST	49712	443	192.168.2.6	104.26.4.15
May 1, 2024 16:40:50.026849031 CEST	443	49712	104.26.4.15	192.168.2.6
May 1, 2024 16:40:50.229818106 CEST	443	49712	104.26.4.15	192.168.2.6
May 1, 2024 16:40:50.229895115 CEST	49712	443	192.168.2.6	104.26.4.15
May 1, 2024 16:40:50.232676983 CEST	49712	443	192.168.2.6	104.26.4.15
May 1, 2024 16:40:50.232702971 CEST	443	49712	104.26.4.15	192.168.2.6
May 1, 2024 16:40:50.232949018 CEST	443	49712	104.26.4.15	192.168.2.6
May 1, 2024 16:40:50.235002041 CEST	49712	443	192.168.2.6	104.26.4.15
May 1, 2024 16:40:50.280133963 CEST	443	49712	104.26.4.15	192.168.2.6
May 1, 2024 16:40:50.504689932 CEST	443	49712	104.26.4.15	192.168.2.6
May 1, 2024 16:40:50.504791021 CEST	443	49712	104.26.4.15	192.168.2.6
May 1, 2024 16:40:50.504853964 CEST	49712	443	192.168.2.6	104.26.4.15
May 1, 2024 16:40:50.505954981 CEST	49712	443	192.168.2.6	104.26.4.15
May 1, 2024 16:40:50.505987883 CEST	443	49712	104.26.4.15	192.168.2.6
May 1, 2024 16:40:50.506782055 CEST	49709	58709	192.168.2.6	147.45.47.93
May 1, 2024 16:40:50.763887882 CEST	58709	49709	147.45.47.93	192.168.2.6
May 1, 2024 16:40:51.257883072 CEST	49699	58709	192.168.2.6	147.45.47.93
May 1, 2024 16:40:51.514117956 CEST	58709	49699	147.45.47.93	192.168.2.6
May 1, 2024 16:40:52.018311977 CEST	49711	58709	192.168.2.6	147.45.47.93
May 1, 2024 16:40:52.156872034 CEST	49713	443	192.168.2.6	34.117.186.192
May 1, 2024 16:40:52.156924009 CEST	443	49713	34.117.186.192	192.168.2.6
May 1, 2024 16:40:52.156989098 CEST	49713	443	192.168.2.6	34.117.186.192
May 1, 2024 16:40:52.158513069 CEST	49713	443	192.168.2.6	34.117.186.192
May 1, 2024 16:40:52.158529043 CEST	443	49713	34.117.186.192	192.168.2.6
May 1, 2024 16:40:52.266288042 CEST	58709	49711	147.45.47.93	192.168.2.6
May 1, 2024 16:40:52.326271057 CEST	49714	443	192.168.2.6	34.117.186.192
May 1, 2024 16:40:52.326324940 CEST	443	49714	34.117.186.192	192.168.2.6
May 1, 2024 16:40:52.326395035 CEST	49714	443	192.168.2.6	34.117.186.192
May 1, 2024 16:40:52.328397036 CEST	49714	443	192.168.2.6	34.117.186.192
May 1, 2024 16:40:52.328408957 CEST	443	49714	34.117.186.192	192.168.2.6
May 1, 2024 16:40:52.356431961 CEST	443	49713	34.117.186.192	192.168.2.6
May 1, 2024 16:40:52.356537104 CEST	49713	443	192.168.2.6	34.117.186.192
May 1, 2024 16:40:52.357739925 CEST	49713	443	192.168.2.6	34.117.186.192
May 1, 2024 16:40:52.357749939 CEST	443	49713	34.117.186.192	192.168.2.6
May 1, 2024 16:40:52.357989073 CEST	443	49713	34.117.186.192	192.168.2.6
May 1, 2024 16:40:52.404206991 CEST	49713	443	192.168.2.6	34.117.186.192
May 1, 2024 16:40:52.442193985 CEST	49715	443	192.168.2.6	34.117.186.192
May 1, 2024 16:40:52.442234039 CEST	443	49715	34.117.186.192	192.168.2.6
May 1, 2024 16:40:52.442295074 CEST	49715	443	192.168.2.6	34.117.186.192
May 1, 2024 16:40:52.443552017 CEST	49715	443	192.168.2.6	34.117.186.192
May 1, 2024 16:40:52.443566084 CEST	443	49715	34.117.186.192	192.168.2.6
May 1, 2024 16:40:52.529742002 CEST	443	49714	34.117.186.192	192.168.2.6
May 1, 2024 16:40:52.529825926 CEST	49714	443	192.168.2.6	34.117.186.192
May 1, 2024 16:40:52.639683962 CEST	443	49715	34.117.186.192	192.168.2.6
May 1, 2024 16:40:52.639867067 CEST	49715	443	192.168.2.6	34.117.186.192
May 1, 2024 16:40:52.641577005 CEST	49715	443	192.168.2.6	34.117.186.192
May 1, 2024 16:40:52.641587019 CEST	443	49715	34.117.186.192	192.168.2.6
May 1, 2024 16:40:52.641836882 CEST	443	49715	34.117.186.192	192.168.2.6
May 1, 2024 16:40:52.815206051 CEST	49715	443	192.168.2.6	34.117.186.192
May 1, 2024 16:40:52.815206051 CEST	49701	58709	192.168.2.6	147.45.47.93
May 1, 2024 16:40:53.028459072 CEST	49714	443	192.168.2.6	34.117.186.192
May 1, 2024 16:40:53.028492928 CEST	443	49714	34.117.186.192	192.168.2.6
May 1, 2024 16:40:53.032452106 CEST	443	49714	34.117.186.192	192.168.2.6
May 1, 2024 16:40:53.060908079 CEST	58709	49701	147.45.47.93	192.168.2.6
May 1, 2024 16:40:53.244116068 CEST	443	49714	34.117.186.192	192.168.2.6
May 1, 2024 16:40:53.246048927 CEST	49714	443	192.168.2.6	34.117.186.192
May 1, 2024 16:40:54.659032106 CEST	49700	58709	192.168.2.6	147.45.47.93
May 1, 2024 16:40:54.920216084 CEST	58709	49700	147.45.47.93	192.168.2.6
May 1, 2024 16:40:55.853950024 CEST	49715	443	192.168.2.6	34.117.186.192
May 1, 2024 16:40:55.896150112 CEST	443	49715	34.117.186.192	192.168.2.6
May 1, 2024 16:40:55.979419947 CEST	443	49715	34.117.186.192	192.168.2.6
May 1, 2024 16:40:55.979542017 CEST	443	49715	34.117.186.192	192.168.2.6
May 1, 2024 16:40:55.979612112 CEST	49715	443	192.168.2.6	34.117.186.192
May 1, 2024 16:40:55.979991913 CEST	49715	443	192.168.2.6	34.117.186.192
May 1, 2024 16:40:55.980015039 CEST	443	49715	34.117.186.192	192.168.2.6
May 1, 2024 16:40:55.980029106 CEST	49715	443	192.168.2.6	34.117.186.192
May 1, 2024 16:40:55.980036020 CEST	443	49715	34.117.186.192	192.168.2.6
May 1, 2024 16:40:55.987473011 CEST	49716	443	192.168.2.6	104.26.4.15
May 1, 2024 16:40:55.987515926 CEST	443	49716	104.26.4.15	192.168.2.6
May 1, 2024 16:40:55.987574100 CEST	49716	443	192.168.2.6	104.26.4.15
May 1, 2024 16:40:55.988044977 CEST	49716	443	192.168.2.6	104.26.4.15
May 1, 2024 16:40:55.988063097 CEST	443	49716	104.26.4.15	192.168.2.6
May 1, 2024 16:40:56.088957071 CEST	49714	443	192.168.2.6	34.117.186.192
May 1, 2024 16:40:56.136121988 CEST	443	49714	34.117.186.192	192.168.2.6
May 1, 2024 16:40:56.139206886 CEST	49713	443	192.168.2.6	34.117.186.192
May 1, 2024 16:40:56.184118986 CEST	443	49713	34.117.186.192	192.168.2.6
May 1, 2024 16:40:56.192856073 CEST	443	49716	104.26.4.15	192.168.2.6
May 1, 2024 16:40:56.192979097 CEST	49716	443	192.168.2.6	104.26.4.15
May 1, 2024 16:40:56.196459055 CEST	49716	443	192.168.2.6	104.26.4.15
May 1, 2024 16:40:56.196466923 CEST	443	49716	104.26.4.15	192.168.2.6
May 1, 2024 16:40:56.196743011 CEST	443	49716	104.26.4.15	192.168.2.6
May 1, 2024 16:40:56.198489904 CEST	49716	443	192.168.2.6	104.26.4.15
May 1, 2024 16:40:56.220849991 CEST	443	49714	34.117.186.192	192.168.2.6
May 1, 2024 16:40:56.220978022 CEST	443	49714	34.117.186.192	192.168.2.6
May 1, 2024 16:40:56.221036911 CEST	49714	443	192.168.2.6	34.117.186.192
May 1, 2024 16:40:56.221416950 CEST	49714	443	192.168.2.6	34.117.186.192
May 1, 2024 16:40:56.221436024 CEST	443	49714	34.117.186.192	192.168.2.6
May 1, 2024 16:40:56.221446991 CEST	49714	443	192.168.2.6	34.117.186.192
May 1, 2024 16:40:56.221452951 CEST	443	49714	34.117.186.192	192.168.2.6
May 1, 2024 16:40:56.223203897 CEST	49717	443	192.168.2.6	104.26.4.15
May 1, 2024 16:40:56.223228931 CEST	443	49717	104.26.4.15	192.168.2.6
May 1, 2024 16:40:56.223315954 CEST	49717	443	192.168.2.6	104.26.4.15
May 1, 2024 16:40:56.223625898 CEST	49717	443	192.168.2.6	104.26.4.15
May 1, 2024 16:40:56.223639965 CEST	443	49717	104.26.4.15	192.168.2.6
May 1, 2024 16:40:56.244111061 CEST	443	49716	104.26.4.15	192.168.2.6
May 1, 2024 16:40:56.262618065 CEST	443	49713	34.117.186.192	192.168.2.6
May 1, 2024 16:40:56.262739897 CEST	443	49713	34.117.186.192	192.168.2.6
May 1, 2024 16:40:56.262914896 CEST	49713	443	192.168.2.6	34.117.186.192
May 1, 2024 16:40:56.263598919 CEST	49713	443	192.168.2.6	34.117.186.192
May 1, 2024 16:40:56.263626099 CEST	443	49713	34.117.186.192	192.168.2.6
May 1, 2024 16:40:56.263639927 CEST	49713	443	192.168.2.6	34.117.186.192
May 1, 2024 16:40:56.263647079 CEST	443	49713	34.117.186.192	192.168.2.6
May 1, 2024 16:40:56.265722990 CEST	49718	443	192.168.2.6	104.26.4.15
May 1, 2024 16:40:56.265760899 CEST	443	49718	104.26.4.15	192.168.2.6
May 1, 2024 16:40:56.265861988 CEST	49718	443	192.168.2.6	104.26.4.15
May 1, 2024 16:40:56.266153097 CEST	49718	443	192.168.2.6	104.26.4.15
May 1, 2024 16:40:56.266164064 CEST	443	49718	104.26.4.15	192.168.2.6
May 1, 2024 16:40:56.422470093 CEST	443	49717	104.26.4.15	192.168.2.6
May 1, 2024 16:40:56.422596931 CEST	49717	443	192.168.2.6	104.26.4.15
May 1, 2024 16:40:56.423880100 CEST	49717	443	192.168.2.6	104.26.4.15
May 1, 2024 16:40:56.423897982 CEST	443	49717	104.26.4.15	192.168.2.6
May 1, 2024 16:40:56.424165964 CEST	443	49717	104.26.4.15	192.168.2.6
May 1, 2024 16:40:56.428342104 CEST	49717	443	192.168.2.6	104.26.4.15
May 1, 2024 16:40:56.462177992 CEST	443	49716	104.26.4.15	192.168.2.6
May 1, 2024 16:40:56.462284088 CEST	443	49716	104.26.4.15	192.168.2.6
May 1, 2024 16:40:56.462364912 CEST	49716	443	192.168.2.6	104.26.4.15
May 1, 2024 16:40:56.462647915 CEST	49716	443	192.168.2.6	104.26.4.15
May 1, 2024 16:40:56.462667942 CEST	443	49716	104.26.4.15	192.168.2.6
May 1, 2024 16:40:56.462678909 CEST	49716	443	192.168.2.6	104.26.4.15
May 1, 2024 16:40:56.462685108 CEST	443	49716	104.26.4.15	192.168.2.6
May 1, 2024 16:40:56.463849068 CEST	49701	58709	192.168.2.6	147.45.47.93
May 1, 2024 16:40:56.464394093 CEST	443	49718	104.26.4.15	192.168.2.6
May 1, 2024 16:40:56.464467049 CEST	49718	443	192.168.2.6	104.26.4.15
May 1, 2024 16:40:56.465758085 CEST	49718	443	192.168.2.6	104.26.4.15
May 1, 2024 16:40:56.465769053 CEST	443	49718	104.26.4.15	192.168.2.6
May 1, 2024 16:40:56.466028929 CEST	443	49718	104.26.4.15	192.168.2.6
May 1, 2024 16:40:56.468152046 CEST	49718	443	192.168.2.6	104.26.4.15
May 1, 2024 16:40:56.476121902 CEST	443	49717	104.26.4.15	192.168.2.6
May 1, 2024 16:40:56.516110897 CEST	443	49718	104.26.4.15	192.168.2.6
May 1, 2024 16:40:56.703900099 CEST	443	49717	104.26.4.15	192.168.2.6
May 1, 2024 16:40:56.704015970 CEST	443	49717	104.26.4.15	192.168.2.6
May 1, 2024 16:40:56.704065084 CEST	49717	443	192.168.2.6	104.26.4.15
May 1, 2024 16:40:56.704328060 CEST	49717	443	192.168.2.6	104.26.4.15
May 1, 2024 16:40:56.704348087 CEST	443	49717	104.26.4.15	192.168.2.6
May 1, 2024 16:40:56.704359055 CEST	49717	443	192.168.2.6	104.26.4.15
May 1, 2024 16:40:56.704375982 CEST	443	49717	104.26.4.15	192.168.2.6
May 1, 2024 16:40:56.704719067 CEST	49700	58709	192.168.2.6	147.45.47.93
May 1, 2024 16:40:56.717180014 CEST	58709	49701	147.45.47.93	192.168.2.6
May 1, 2024 16:40:56.744729996 CEST	443	49718	104.26.4.15	192.168.2.6
May 1, 2024 16:40:56.744827986 CEST	443	49718	104.26.4.15	192.168.2.6
May 1, 2024 16:40:56.744884014 CEST	49718	443	192.168.2.6	104.26.4.15
May 1, 2024 16:40:56.745176077 CEST	49718	443	192.168.2.6	104.26.4.15
May 1, 2024 16:40:56.745196104 CEST	443	49718	104.26.4.15	192.168.2.6
May 1, 2024 16:40:56.745208025 CEST	49718	443	192.168.2.6	104.26.4.15
May 1, 2024 16:40:56.745213032 CEST	443	49718	104.26.4.15	192.168.2.6
May 1, 2024 16:40:56.745475054 CEST	49699	58709	192.168.2.6	147.45.47.93
May 1, 2024 16:40:56.966988087 CEST	58709	49700	147.45.47.93	192.168.2.6
May 1, 2024 16:40:56.998262882 CEST	58709	49699	147.45.47.93	192.168.2.6
May 1, 2024 16:41:17.643412113 CEST	49709	58709	192.168.2.6	147.45.47.93
May 1, 2024 16:41:17.888777018 CEST	58709	49709	147.45.47.93	192.168.2.6
May 1, 2024 16:41:21.000361919 CEST	58709	49699	147.45.47.93	192.168.2.6
May 1, 2024 16:41:21.030756950 CEST	58709	49700	147.45.47.93	192.168.2.6
May 1, 2024 16:41:21.046509981 CEST	58709	49701	147.45.47.93	192.168.2.6
May 1, 2024 16:41:21.049509048 CEST	49699	58709	192.168.2.6	147.45.47.93
May 1, 2024 16:41:21.080746889 CEST	49700	58709	192.168.2.6	147.45.47.93
May 1, 2024 16:41:21.096363068 CEST	49701	58709	192.168.2.6	147.45.47.93
May 1, 2024 16:41:21.123740911 CEST	58709	49709	147.45.47.93	192.168.2.6
May 1, 2024 16:41:21.174479008 CEST	49709	58709	192.168.2.6	147.45.47.93
May 1, 2024 16:41:23.862763882 CEST	49711	58709	192.168.2.6	147.45.47.93
May 1, 2024 16:41:24.107878923 CEST	58709	49711	147.45.47.93	192.168.2.6
May 1, 2024 16:41:24.113233089 CEST	49699	58709	192.168.2.6	147.45.47.93
May 1, 2024 16:41:24.174623966 CEST	49701	58709	192.168.2.6	147.45.47.93
May 1, 2024 16:41:24.358016014 CEST	58709	49699	147.45.47.93	192.168.2.6
May 1, 2024 16:41:24.420156956 CEST	58709	49701	147.45.47.93	192.168.2.6
May 1, 2024 16:41:27.284049034 CEST	49700	58709	192.168.2.6	147.45.47.93
May 1, 2024 16:41:27.545398951 CEST	58709	49700	147.45.47.93	192.168.2.6
May 1, 2024 16:41:43.065279007 CEST	49709	58709	192.168.2.6	147.45.47.93
May 1, 2024 16:41:43.311022043 CEST	58709	49709	147.45.47.93	192.168.2.6
May 1, 2024 16:41:45.893429995 CEST	49711	58709	192.168.2.6	147.45.47.93
May 1, 2024 16:41:46.138859987 CEST	58709	49711	147.45.47.93	192.168.2.6
May 1, 2024 16:41:53.246398926 CEST	49700	58709	192.168.2.6	147.45.47.93
May 1, 2024 16:41:53.246530056 CEST	49699	58709	192.168.2.6	147.45.47.93
May 1, 2024 16:41:53.246797085 CEST	49701	58709	192.168.2.6	147.45.47.93
May 1, 2024 16:41:53.498250008 CEST	58709	49701	147.45.47.93	192.168.2.6
May 1, 2024 16:41:53.498274088 CEST	58709	49700	147.45.47.93	192.168.2.6
May 1, 2024 16:41:53.498289108 CEST	58709	49699	147.45.47.93	192.168.2.6
May 1, 2024 16:41:56.565397024 CEST	49709	58709	192.168.2.6	147.45.47.93
May 1, 2024 16:41:56.810817957 CEST	58709	49709	147.45.47.93	192.168.2.6
May 1, 2024 16:41:59.502845049 CEST	49711	58709	192.168.2.6	147.45.47.93
May 1, 2024 16:41:59.748514891 CEST	58709	49711	147.45.47.93	192.168.2.6
May 1, 2024 16:42:02.919315100 CEST	49709	58709	192.168.2.6	147.45.47.93
May 1, 2024 16:42:03.170397997 CEST	58709	49709	147.45.47.93	192.168.2.6
May 1, 2024 16:42:05.846586943 CEST	49701	58709	192.168.2.6	147.45.47.93
May 1, 2024 16:42:05.846781015 CEST	49700	58709	192.168.2.6	147.45.47.93
May 1, 2024 16:42:05.909095049 CEST	49711	58709	192.168.2.6	147.45.47.93
May 1, 2024 16:42:05.909270048 CEST	49699	58709	192.168.2.6	147.45.47.93
May 1, 2024 16:42:06.091794014 CEST	58709	49701	147.45.47.93	192.168.2.6
May 1, 2024 16:42:06.107512951 CEST	58709	49700	147.45.47.93	192.168.2.6
May 1, 2024 16:42:06.154558897 CEST	58709	49711	147.45.47.93	192.168.2.6
May 1, 2024 16:42:06.154582024 CEST	58709	49699	147.45.47.93	192.168.2.6
May 1, 2024 16:42:09.512830019 CEST	49709	58709	192.168.2.6	147.45.47.93
May 1, 2024 16:42:09.764159918 CEST	58709	49709	147.45.47.93	192.168.2.6
May 1, 2024 16:42:13.100471020 CEST	49700	58709	192.168.2.6	147.45.47.93
May 1, 2024 16:42:13.100581884 CEST	49701	58709	192.168.2.6	147.45.47.93
May 1, 2024 16:42:13.101147890 CEST	49699	58709	192.168.2.6	147.45.47.93
May 1, 2024 16:42:13.101227045 CEST	49711	58709	192.168.2.6	147.45.47.93
May 1, 2024 16:42:13.101319075 CEST	49709	58709	192.168.2.6	147.45.47.93
May 1, 2024 16:42:13.357620001 CEST	58709	49709	147.45.47.93	192.168.2.6
May 1, 2024 16:42:13.357644081 CEST	58709	49701	147.45.47.93	192.168.2.6
May 1, 2024 16:42:13.357656956 CEST	58709	49699	147.45.47.93	192.168.2.6
May 1, 2024 16:42:13.357671022 CEST	58709	49700	147.45.47.93	192.168.2.6
May 1, 2024 16:42:13.357683897 CEST	58709	49711	147.45.47.93	192.168.2.6
May 1, 2024 16:42:16.940551996 CEST	49701	58709	192.168.2.6	147.45.47.93
May 1, 2024 16:42:16.940553904 CEST	49700	58709	192.168.2.6	147.45.47.93
May 1, 2024 16:42:16.940630913 CEST	49699	58709	192.168.2.6	147.45.47.93
May 1, 2024 16:42:16.940639019 CEST	49711	58709	192.168.2.6	147.45.47.93
May 1, 2024 16:42:16.940721989 CEST	49709	58709	192.168.2.6	147.45.47.93
May 1, 2024 16:42:17.185717106 CEST	58709	49709	147.45.47.93	192.168.2.6
May 1, 2024 16:42:17.185739994 CEST	58709	49701	147.45.47.93	192.168.2.6
May 1, 2024 16:42:17.185751915 CEST	58709	49699	147.45.47.93	192.168.2.6
May 1, 2024 16:42:17.185765028 CEST	58709	49711	147.45.47.93	192.168.2.6
May 1, 2024 16:42:17.201354027 CEST	58709	49700	147.45.47.93	192.168.2.6

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
May 1, 2024 16:40:47.284815073 CEST	65173	53	192.168.2.6	1.1.1.1
May 1, 2024 16:40:47.383929968 CEST	53	65173	1.1.1.1	192.168.2.6
May 1, 2024 16:40:49.925873995 CEST	59915	53	192.168.2.6	1.1.1.1
May 1, 2024 16:40:50.024710894 CEST	53	59915	1.1.1.1	192.168.2.6

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
May 1, 2024 16:40:47.284815073 CEST	192.168.2.6	1.1.1.1	0xefd6	Standard query (0)	ipinfo.io	A (IP address)	IN (0x0001)	false
May 1, 2024 16:40:49.925873995 CEST	192.168.2.6	1.1.1.1	0x8554	Standard query (0)	db-ip.com	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	Address	Type	Class	DNS over HTTPS
May 1, 2024 16:40:47.383929968 CEST	1.1.1.1	192.168.2.6	0xefd6	No error (0)	ipinfo.io	34.117.186.192	A (IP address)	IN (0x0001)	false
May 1, 2024 16:40:50.024710894 CEST	1.1.1.1	192.168.2.6	0x8554	No error (0)	db-ip.com	104.26.4.15	A (IP address)	IN (0x0001)	false
May 1, 2024 16:40:50.024710894 CEST	1.1.1.1	192.168.2.6	0x8554	No error (0)	db-ip.com	104.26.5.15	A (IP address)	IN (0x0001)	false
May 1, 2024 16:40:50.024710894 CEST	1.1.1.1	192.168.2.6	0x8554	No error (0)	db-ip.com	172.67.75.166	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

https:

ipinfo.io

db-ip.com

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.6	49710	34.117.186.192	443	5092	C:\Users\user\AppData\Local\RageMP131\RageMP131.exe

Timestamp	Bytes transferred	Direction	Data
2024-05-01 14:40:48 UTC	237	OUT	GET /widget/demo/149.18.24.96 HTTP/1.1 Connection: Keep-Alive Referer: https://ipinfo.io/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36 Host: ipinfo.io
2024-05-01 14:40:48 UTC	513	IN	HTTP/1.1 200 OK server: nginx/1.24.0 date: Wed, 01 May 2024 14:40:48 GMT content-type: application/json; charset=utf-8 Content-Length: 959 access-control-allow-origin: * x-frame-options: SAMEORIGIN x-xss-protection: 1; mode=block x-content-type-options: nosniff referrer-policy: strict-origin-when-cross-origin x-envoy-upstream-service-time: 2 via: 1.1 google strict-transport-security: max-age=2592000; includeSubDomains Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2024-05-01 14:40:48 UTC	742	IN	Data Raw: 7b 0a 20 20 22 69 6e 70 75 74 22 3a 20 22 31 34 39 2e 31 38 2e 32 34 2e 39 36 22 2c 0a 20 20 22 64 61 74 61 22 3a 20 7b 0a 20 20 20 20 22 69 70 22 3a 20 22 31 34 39 2e 31 38 2e 32 34 2e 39 36 22 2c 0a 20 20 20 20 22 63 69 74 79 22 3a 20 22 57 61 73 68 69 6e 67 74 6f 6e 22 2c 0a 20 20 20 20 22 72 65 67 69 6f 6e 22 3a 20 22 57 61 73 68 69 6e 67 74 6f 6e 2c 20 44 2e 43 2e 22 2c 0a 20 20 20 20 22 63 6f 75 6e 74 72 79 22 3a 20 22 55 53 22 2c 0a 20 20 20 20 22 6c 6f 63 22 3a 20 22 33 38 2e 38 39 35 31 2c 2d 37 37 2e 30 33 36 34 22 2c 0a 20 20 20 20 22 6f 72 67 22 3a 20 22 41 53 32 31 32 32 33 38 20 44 61 74 61 63 61 6d 70 20 4c 69 6d 69 74 65 64 22 2c 0a 20 20 20 20 22 70 6f 73 74 61 6c 22 3a 20 22 32 30 30 30 34 22 2c 0a 20 20 20 20 22 74 69 6d 65 7a 6f 6e 65 Data Ascii: { "input": "149.18.24.96", "data": { "ip": "149.18.24.96", "city": "Washington", "region": "Washington, D.C.", "country": "US", "loc": "38.8951,-77.0364", "org": "AS212238 Datacamp Limited", "postal": "20004", "timezone
2024-05-01 14:40:48 UTC	217	IN	Data Raw: 64 64 72 65 73 73 22 3a 20 22 55 53 2c 20 4e 59 2c 20 47 72 65 65 6e 6c 61 77 6e 2c 20 35 35 20 42 72 6f 61 64 77 61 79 2c 20 23 36 38 36 2c 20 31 31 37 34 30 22 2c 0a 20 20 20 20 20 20 22 63 6f 75 6e 74 72 79 22 3a 20 22 55 53 22 2c 0a 20 20 20 20 20 20 22 65 6d 61 69 6c 22 3a 20 22 61 62 75 73 65 40 6c 6f 67 69 63 77 65 62 2e 63 6f 6d 22 2c 0a 20 20 20 20 20 20 22 6e 61 6d 65 22 3a 20 22 41 62 75 73 65 22 2c 0a 20 20 20 20 20 20 22 6e 65 74 77 6f 72 6b 22 3a 20 22 31 34 39 2e 31 38 2e 30 2e 30 2f 31 36 22 2c 0a 20 20 20 20 20 20 22 70 68 6f 6e 65 22 3a 20 22 2b 31 2d 33 34 37 2d 32 31 32 2d 35 30 34 37 22 0a 20 20 20 20 7d 0a 20 20 7d 0a 7d Data Ascii: ddress": "US, NY, Greenlawn, 55 Broadway, #686, 11740", "country": "US", "email": "abuse@logicweb.com", "name": "Abuse", "network": "149.18.0.0/16", "phone": "+1-347-212-5047" } }}

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.6	49712	104.26.4.15	443	5092	C:\Users\user\AppData\Local\RageMP131\RageMP131.exe

Timestamp	Bytes transferred	Direction	Data
2024-05-01 14:40:50 UTC	261	OUT	GET /demo/home.php?s=149.18.24.96 HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36 Host: db-ip.com
2024-05-01 14:40:50 UTC	656	IN	HTTP/1.1 200 OK Date: Wed, 01 May 2024 14:40:50 GMT Content-Type: application/json Transfer-Encoding: chunked Connection: close x-iplb-request-id: AC46AE97:23FE_93878F2E:0050_66325472_AF918F9:7B63 x-iplb-instance: 59128 CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=zK%2Ban8f2TSS4j2%2Bw2hxolTjwBKqdigASL8GdQ18jGmG9jzqmIVD%2Bf5TUWU6FbPfo1zbFbnC%2FUyVSflAvDOhA30kzZdnpOCUJBMjolUiVRBHJWKFOQsqNYYWYoQ%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 87d0876b099b8221-IAD alt-svc: h3=":443"; ma=86400
2024-05-01 14:40:50 UTC	85	IN	Data Raw: 34 66 0d 0a 7b 22 73 74 61 74 75 73 22 3a 22 6f 6b 22 2c 22 64 65 6d 6f 49 6e 66 6f 22 3a 7b 22 65 72 72 6f 72 22 3a 22 6f 76 65 72 20 71 75 65 72 79 20 6c 69 6d 69 74 2c 20 70 6c 65 61 73 65 20 74 72 79 20 61 67 61 69 6e 20 6c 61 74 65 72 22 7d 7d 0d 0a Data Ascii: 4f{"status":"ok","demoInfo":{"error":"over query limit, please try again later"}}
2024-05-01 14:40:50 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.6	49715	34.117.186.192	443	2996	C:\ProgramData\MPGPH131\MPGPH131.exe

Timestamp	Bytes transferred	Direction	Data
2024-05-01 14:40:55 UTC	237	OUT	GET /widget/demo/149.18.24.96 HTTP/1.1 Connection: Keep-Alive Referer: https://ipinfo.io/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36 Host: ipinfo.io
2024-05-01 14:40:55 UTC	513	IN	HTTP/1.1 200 OK server: nginx/1.24.0 date: Wed, 01 May 2024 14:40:55 GMT content-type: application/json; charset=utf-8 Content-Length: 959 access-control-allow-origin: * x-frame-options: SAMEORIGIN x-xss-protection: 1; mode=block x-content-type-options: nosniff referrer-policy: strict-origin-when-cross-origin x-envoy-upstream-service-time: 2 via: 1.1 google strict-transport-security: max-age=2592000; includeSubDomains Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2024-05-01 14:40:55 UTC	742	IN	Data Raw: 7b 0a 20 20 22 69 6e 70 75 74 22 3a 20 22 31 34 39 2e 31 38 2e 32 34 2e 39 36 22 2c 0a 20 20 22 64 61 74 61 22 3a 20 7b 0a 20 20 20 20 22 69 70 22 3a 20 22 31 34 39 2e 31 38 2e 32 34 2e 39 36 22 2c 0a 20 20 20 20 22 63 69 74 79 22 3a 20 22 57 61 73 68 69 6e 67 74 6f 6e 22 2c 0a 20 20 20 20 22 72 65 67 69 6f 6e 22 3a 20 22 57 61 73 68 69 6e 67 74 6f 6e 2c 20 44 2e 43 2e 22 2c 0a 20 20 20 20 22 63 6f 75 6e 74 72 79 22 3a 20 22 55 53 22 2c 0a 20 20 20 20 22 6c 6f 63 22 3a 20 22 33 38 2e 38 39 35 31 2c 2d 37 37 2e 30 33 36 34 22 2c 0a 20 20 20 20 22 6f 72 67 22 3a 20 22 41 53 32 31 32 32 33 38 20 44 61 74 61 63 61 6d 70 20 4c 69 6d 69 74 65 64 22 2c 0a 20 20 20 20 22 70 6f 73 74 61 6c 22 3a 20 22 32 30 30 30 34 22 2c 0a 20 20 20 20 22 74 69 6d 65 7a 6f 6e 65 Data Ascii: { "input": "149.18.24.96", "data": { "ip": "149.18.24.96", "city": "Washington", "region": "Washington, D.C.", "country": "US", "loc": "38.8951,-77.0364", "org": "AS212238 Datacamp Limited", "postal": "20004", "timezone
2024-05-01 14:40:55 UTC	217	IN	Data Raw: 64 64 72 65 73 73 22 3a 20 22 55 53 2c 20 4e 59 2c 20 47 72 65 65 6e 6c 61 77 6e 2c 20 35 35 20 42 72 6f 61 64 77 61 79 2c 20 23 36 38 36 2c 20 31 31 37 34 30 22 2c 0a 20 20 20 20 20 20 22 63 6f 75 6e 74 72 79 22 3a 20 22 55 53 22 2c 0a 20 20 20 20 20 20 22 65 6d 61 69 6c 22 3a 20 22 61 62 75 73 65 40 6c 6f 67 69 63 77 65 62 2e 63 6f 6d 22 2c 0a 20 20 20 20 20 20 22 6e 61 6d 65 22 3a 20 22 41 62 75 73 65 22 2c 0a 20 20 20 20 20 20 22 6e 65 74 77 6f 72 6b 22 3a 20 22 31 34 39 2e 31 38 2e 30 2e 30 2f 31 36 22 2c 0a 20 20 20 20 20 20 22 70 68 6f 6e 65 22 3a 20 22 2b 31 2d 33 34 37 2d 32 31 32 2d 35 30 34 37 22 0a 20 20 20 20 7d 0a 20 20 7d 0a 7d Data Ascii: ddress": "US, NY, Greenlawn, 55 Broadway, #686, 11740", "country": "US", "email": "abuse@logicweb.com", "name": "Abuse", "network": "149.18.0.0/16", "phone": "+1-347-212-5047" } }}

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.6	49714	34.117.186.192	443	6080	C:\ProgramData\MPGPH131\MPGPH131.exe

Timestamp	Bytes transferred	Direction	Data
2024-05-01 14:40:56 UTC	237	OUT	GET /widget/demo/149.18.24.96 HTTP/1.1 Connection: Keep-Alive Referer: https://ipinfo.io/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36 Host: ipinfo.io
2024-05-01 14:40:56 UTC	513	IN	HTTP/1.1 200 OK server: nginx/1.24.0 date: Wed, 01 May 2024 14:40:56 GMT content-type: application/json; charset=utf-8 Content-Length: 959 access-control-allow-origin: * x-frame-options: SAMEORIGIN x-xss-protection: 1; mode=block x-content-type-options: nosniff referrer-policy: strict-origin-when-cross-origin x-envoy-upstream-service-time: 2 via: 1.1 google strict-transport-security: max-age=2592000; includeSubDomains Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2024-05-01 14:40:56 UTC	742	IN	Data Raw: 7b 0a 20 20 22 69 6e 70 75 74 22 3a 20 22 31 34 39 2e 31 38 2e 32 34 2e 39 36 22 2c 0a 20 20 22 64 61 74 61 22 3a 20 7b 0a 20 20 20 20 22 69 70 22 3a 20 22 31 34 39 2e 31 38 2e 32 34 2e 39 36 22 2c 0a 20 20 20 20 22 63 69 74 79 22 3a 20 22 57 61 73 68 69 6e 67 74 6f 6e 22 2c 0a 20 20 20 20 22 72 65 67 69 6f 6e 22 3a 20 22 57 61 73 68 69 6e 67 74 6f 6e 2c 20 44 2e 43 2e 22 2c 0a 20 20 20 20 22 63 6f 75 6e 74 72 79 22 3a 20 22 55 53 22 2c 0a 20 20 20 20 22 6c 6f 63 22 3a 20 22 33 38 2e 38 39 35 31 2c 2d 37 37 2e 30 33 36 34 22 2c 0a 20 20 20 20 22 6f 72 67 22 3a 20 22 41 53 32 31 32 32 33 38 20 44 61 74 61 63 61 6d 70 20 4c 69 6d 69 74 65 64 22 2c 0a 20 20 20 20 22 70 6f 73 74 61 6c 22 3a 20 22 32 30 30 30 34 22 2c 0a 20 20 20 20 22 74 69 6d 65 7a 6f 6e 65 Data Ascii: { "input": "149.18.24.96", "data": { "ip": "149.18.24.96", "city": "Washington", "region": "Washington, D.C.", "country": "US", "loc": "38.8951,-77.0364", "org": "AS212238 Datacamp Limited", "postal": "20004", "timezone
2024-05-01 14:40:56 UTC	217	IN	Data Raw: 64 64 72 65 73 73 22 3a 20 22 55 53 2c 20 4e 59 2c 20 47 72 65 65 6e 6c 61 77 6e 2c 20 35 35 20 42 72 6f 61 64 77 61 79 2c 20 23 36 38 36 2c 20 31 31 37 34 30 22 2c 0a 20 20 20 20 20 20 22 63 6f 75 6e 74 72 79 22 3a 20 22 55 53 22 2c 0a 20 20 20 20 20 20 22 65 6d 61 69 6c 22 3a 20 22 61 62 75 73 65 40 6c 6f 67 69 63 77 65 62 2e 63 6f 6d 22 2c 0a 20 20 20 20 20 20 22 6e 61 6d 65 22 3a 20 22 41 62 75 73 65 22 2c 0a 20 20 20 20 20 20 22 6e 65 74 77 6f 72 6b 22 3a 20 22 31 34 39 2e 31 38 2e 30 2e 30 2f 31 36 22 2c 0a 20 20 20 20 20 20 22 70 68 6f 6e 65 22 3a 20 22 2b 31 2d 33 34 37 2d 32 31 32 2d 35 30 34 37 22 0a 20 20 20 20 7d 0a 20 20 7d 0a 7d Data Ascii: ddress": "US, NY, Greenlawn, 55 Broadway, #686, 11740", "country": "US", "email": "abuse@logicweb.com", "name": "Abuse", "network": "149.18.0.0/16", "phone": "+1-347-212-5047" } }}

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.6	49713	34.117.186.192	443	1948	C:\Users\user\Desktop\2zdult23rz.exe

Timestamp	Bytes transferred	Direction	Data
2024-05-01 14:40:56 UTC	237	OUT	GET /widget/demo/149.18.24.96 HTTP/1.1 Connection: Keep-Alive Referer: https://ipinfo.io/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36 Host: ipinfo.io
2024-05-01 14:40:56 UTC	513	IN	HTTP/1.1 200 OK server: nginx/1.24.0 date: Wed, 01 May 2024 14:40:56 GMT content-type: application/json; charset=utf-8 Content-Length: 959 access-control-allow-origin: * x-frame-options: SAMEORIGIN x-xss-protection: 1; mode=block x-content-type-options: nosniff referrer-policy: strict-origin-when-cross-origin x-envoy-upstream-service-time: 2 via: 1.1 google strict-transport-security: max-age=2592000; includeSubDomains Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2024-05-01 14:40:56 UTC	742	IN	Data Raw: 7b 0a 20 20 22 69 6e 70 75 74 22 3a 20 22 31 34 39 2e 31 38 2e 32 34 2e 39 36 22 2c 0a 20 20 22 64 61 74 61 22 3a 20 7b 0a 20 20 20 20 22 69 70 22 3a 20 22 31 34 39 2e 31 38 2e 32 34 2e 39 36 22 2c 0a 20 20 20 20 22 63 69 74 79 22 3a 20 22 57 61 73 68 69 6e 67 74 6f 6e 22 2c 0a 20 20 20 20 22 72 65 67 69 6f 6e 22 3a 20 22 57 61 73 68 69 6e 67 74 6f 6e 2c 20 44 2e 43 2e 22 2c 0a 20 20 20 20 22 63 6f 75 6e 74 72 79 22 3a 20 22 55 53 22 2c 0a 20 20 20 20 22 6c 6f 63 22 3a 20 22 33 38 2e 38 39 35 31 2c 2d 37 37 2e 30 33 36 34 22 2c 0a 20 20 20 20 22 6f 72 67 22 3a 20 22 41 53 32 31 32 32 33 38 20 44 61 74 61 63 61 6d 70 20 4c 69 6d 69 74 65 64 22 2c 0a 20 20 20 20 22 70 6f 73 74 61 6c 22 3a 20 22 32 30 30 30 34 22 2c 0a 20 20 20 20 22 74 69 6d 65 7a 6f 6e 65 Data Ascii: { "input": "149.18.24.96", "data": { "ip": "149.18.24.96", "city": "Washington", "region": "Washington, D.C.", "country": "US", "loc": "38.8951,-77.0364", "org": "AS212238 Datacamp Limited", "postal": "20004", "timezone
2024-05-01 14:40:56 UTC	217	IN	Data Raw: 64 64 72 65 73 73 22 3a 20 22 55 53 2c 20 4e 59 2c 20 47 72 65 65 6e 6c 61 77 6e 2c 20 35 35 20 42 72 6f 61 64 77 61 79 2c 20 23 36 38 36 2c 20 31 31 37 34 30 22 2c 0a 20 20 20 20 20 20 22 63 6f 75 6e 74 72 79 22 3a 20 22 55 53 22 2c 0a 20 20 20 20 20 20 22 65 6d 61 69 6c 22 3a 20 22 61 62 75 73 65 40 6c 6f 67 69 63 77 65 62 2e 63 6f 6d 22 2c 0a 20 20 20 20 20 20 22 6e 61 6d 65 22 3a 20 22 41 62 75 73 65 22 2c 0a 20 20 20 20 20 20 22 6e 65 74 77 6f 72 6b 22 3a 20 22 31 34 39 2e 31 38 2e 30 2e 30 2f 31 36 22 2c 0a 20 20 20 20 20 20 22 70 68 6f 6e 65 22 3a 20 22 2b 31 2d 33 34 37 2d 32 31 32 2d 35 30 34 37 22 0a 20 20 20 20 7d 0a 20 20 7d 0a 7d Data Ascii: ddress": "US, NY, Greenlawn, 55 Broadway, #686, 11740", "country": "US", "email": "abuse@logicweb.com", "name": "Abuse", "network": "149.18.0.0/16", "phone": "+1-347-212-5047" } }}

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.6	49716	104.26.4.15	443	2996	C:\ProgramData\MPGPH131\MPGPH131.exe

Timestamp	Bytes transferred	Direction	Data
2024-05-01 14:40:56 UTC	261	OUT	GET /demo/home.php?s=149.18.24.96 HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36 Host: db-ip.com
2024-05-01 14:40:56 UTC	652	IN	HTTP/1.1 200 OK Date: Wed, 01 May 2024 14:40:56 GMT Content-Type: application/json Transfer-Encoding: chunked Connection: close x-iplb-request-id: AC4687B6:CB36_93878F2E:0050_66325478_AFD5EDE:4F34 x-iplb-instance: 59215 CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=%2BFw0TmERv7n2zgenA3gK7jFdnz%2BPwrjY3BATUNFCBIO169MCkQJlxWGlEhFb2hBGSK2A0ts8OvPIYlrAOG6anpoKOJ4AILNPpMVCNnnYSQX1n66g5D0H8ML4vA%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 87d087905bcd7fbe-IAD alt-svc: h3=":443"; ma=86400
2024-05-01 14:40:56 UTC	85	IN	Data Raw: 34 66 0d 0a 7b 22 73 74 61 74 75 73 22 3a 22 6f 6b 22 2c 22 64 65 6d 6f 49 6e 66 6f 22 3a 7b 22 65 72 72 6f 72 22 3a 22 6f 76 65 72 20 71 75 65 72 79 20 6c 69 6d 69 74 2c 20 70 6c 65 61 73 65 20 74 72 79 20 61 67 61 69 6e 20 6c 61 74 65 72 22 7d 7d 0d 0a Data Ascii: 4f{"status":"ok","demoInfo":{"error":"over query limit, please try again later"}}
2024-05-01 14:40:56 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.6	49717	104.26.4.15	443	6080	C:\ProgramData\MPGPH131\MPGPH131.exe

Timestamp	Bytes transferred	Direction	Data
2024-05-01 14:40:56 UTC	261	OUT	GET /demo/home.php?s=149.18.24.96 HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36 Host: db-ip.com
2024-05-01 14:40:56 UTC	666	IN	HTTP/1.1 200 OK Date: Wed, 01 May 2024 14:40:56 GMT Content-Type: application/json Transfer-Encoding: chunked Connection: close x-iplb-request-id: A29E4FA3:F7DE_93878F2E:0050_66325478_AF91A15:7B63 x-iplb-instance: 59128 CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=lvABRLD8smqf2iw9eF1vxR6Ko%2FOdPO5Ngoh%2BvjvoIi5lGaIkGu4fSRo%2FGlc7%2BvERkGJnPi%2BsLRjyT1a%2Bo%2BtWLrnNCrQ4QvYLytr%2B1uB99Ms1pT%2BzMUJ4kL5ScQ%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 87d08791c80657c7-IAD alt-svc: h3=":443"; ma=86400
2024-05-01 14:40:56 UTC	85	IN	Data Raw: 34 66 0d 0a 7b 22 73 74 61 74 75 73 22 3a 22 6f 6b 22 2c 22 64 65 6d 6f 49 6e 66 6f 22 3a 7b 22 65 72 72 6f 72 22 3a 22 6f 76 65 72 20 71 75 65 72 79 20 6c 69 6d 69 74 2c 20 70 6c 65 61 73 65 20 74 72 79 20 61 67 61 69 6e 20 6c 61 74 65 72 22 7d 7d 0d 0a Data Ascii: 4f{"status":"ok","demoInfo":{"error":"over query limit, please try again later"}}
2024-05-01 14:40:56 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.6	49718	104.26.4.15	443	1948	C:\Users\user\Desktop\2zdult23rz.exe

Timestamp	Bytes transferred	Direction	Data
2024-05-01 14:40:56 UTC	261	OUT	GET /demo/home.php?s=149.18.24.96 HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36 Host: db-ip.com
2024-05-01 14:40:56 UTC	660	IN	HTTP/1.1 200 OK Date: Wed, 01 May 2024 14:40:56 GMT Content-Type: application/json Transfer-Encoding: chunked Connection: close x-iplb-request-id: AC462621:B8A6_93878F2E:0050_66325478_AFD5EEF:4F34 x-iplb-instance: 59215 CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=TKC%2FXQJSce93uJptAEy0ctpGw4h2%2BhgKwm%2BBTGJtHAprbESnvQNKX0OzXnbCJoYg1Dt%2BA7xJewKlTEcGoRjnNlKkBahxk88x%2F4fLi8qIsWNLH54An96qZP%2Fv0g%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 87d087920c01394c-IAD alt-svc: h3=":443"; ma=86400
2024-05-01 14:40:56 UTC	85	IN	Data Raw: 34 66 0d 0a 7b 22 73 74 61 74 75 73 22 3a 22 6f 6b 22 2c 22 64 65 6d 6f 49 6e 66 6f 22 3a 7b 22 65 72 72 6f 72 22 3a 22 6f 76 65 72 20 71 75 65 72 79 20 6c 69 6d 69 74 2c 20 70 6c 65 61 73 65 20 74 72 79 20 61 67 61 69 6e 20 6c 61 74 65 72 22 7d 7d 0d 0a Data Ascii: 4f{"status":"ok","demoInfo":{"error":"over query limit, please try again later"}}
2024-05-01 14:40:56 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Target ID:	0
Start time:	16:40:07
Start date:	01/05/2024
Path:	C:\Users\user\Desktop\2zdult23rz.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\2zdult23rz.exe"
Imagebase:	0x400000
File size:	997'376 bytes
MD5 hash:	733C1261CF02626F2354E6339BAA6717
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: Windows_Trojan_RedLineStealer_ed346e4c, Description: unknown, Source: 00000000.00000002.3357800955.0000000005CC3000.00000040.00000020.00020000.00000000.sdmp, Author: unknown Rule: Windows_Trojan_Smokeloader_3687686f, Description: unknown, Source: 00000000.00000002.3357963980.0000000005E90000.00000040.00001000.00020000.00000000.sdmp, Author: unknown
Reputation:	low
Has exited:	false

Show Windows behavior

Target ID:	2
Start time:	16:40:10
Start date:	01/05/2024
Path:	C:\Windows\SysWOW64\schtasks.exe
Wow64 process (32bit):	true
Commandline:	schtasks /create /f /RU "user" /tr "C:\ProgramData\MPGPH131\MPGPH131.exe" /tn "MPGPH131 HR" /sc HOURLY /rl HIGHEST
Imagebase:	0x290000
File size:	187'904 bytes
MD5 hash:	48C2FE20575769DE916F48EF0676A965
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	16:40:10
Start date:	01/05/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff66e660000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	16:40:10
Start date:	01/05/2024
Path:	C:\Windows\SysWOW64\schtasks.exe
Wow64 process (32bit):	true
Commandline:	schtasks /create /f /RU "user" /tr "C:\ProgramData\MPGPH131\MPGPH131.exe" /tn "MPGPH131 LG" /sc ONLOGON /rl HIGHEST
Imagebase:	0x290000
File size:	187'904 bytes
MD5 hash:	48C2FE20575769DE916F48EF0676A965
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	5
Start time:	16:40:10
Start date:	01/05/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff66e660000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	8
Start time:	16:40:11
Start date:	01/05/2024
Path:	C:\Windows\SysWOW64\WerFault.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\WerFault.exe -u -p 1948 -s 860
Imagebase:	0x370000
File size:	483'680 bytes
MD5 hash:	C31336C1EFC2CCB44B4326EA793040F2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	9
Start time:	16:40:12
Start date:	01/05/2024
Path:	C:\ProgramData\MPGPH131\MPGPH131.exe
Wow64 process (32bit):	true
Commandline:	C:\ProgramData\MPGPH131\MPGPH131.exe
Imagebase:	0x400000
File size:	997'376 bytes
MD5 hash:	733C1261CF02626F2354E6339BAA6717
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: Windows_Trojan_RedLineStealer_ed346e4c, Description: unknown, Source: 00000009.00000002.3356779154.0000000005DF5000.00000040.00000020.00020000.00000000.sdmp, Author: unknown Rule: Windows_Trojan_Smokeloader_3687686f, Description: unknown, Source: 00000009.00000002.3357144489.0000000005F90000.00000040.00001000.00020000.00000000.sdmp, Author: unknown
Antivirus matches:	Detection: 100%, Avira Detection: 100%, Joe Sandbox ML Detection: 82%, ReversingLabs Detection: 77%, Virustotal, Browse
Reputation:	low
Has exited:	false

Show Windows behavior

Target ID:	10
Start time:	16:40:13
Start date:	01/05/2024
Path:	C:\ProgramData\MPGPH131\MPGPH131.exe
Wow64 process (32bit):	true
Commandline:	C:\ProgramData\MPGPH131\MPGPH131.exe
Imagebase:	0x400000
File size:	997'376 bytes
MD5 hash:	733C1261CF02626F2354E6339BAA6717
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: Windows_Trojan_RedLineStealer_ed346e4c, Description: unknown, Source: 0000000A.00000002.3356453066.0000000005C1A000.00000040.00000020.00020000.00000000.sdmp, Author: unknown Rule: Windows_Trojan_Smokeloader_3687686f, Description: unknown, Source: 0000000A.00000002.3356718132.0000000005F10000.00000040.00001000.00020000.00000000.sdmp, Author: unknown
Reputation:	low
Has exited:	false

Show Windows behavior

Target ID:	12
Start time:	16:40:16
Start date:	01/05/2024
Path:	C:\Windows\SysWOW64\WerFault.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\WerFault.exe -u -p 6080 -s 800
Imagebase:	0x370000
File size:	483'680 bytes
MD5 hash:	C31336C1EFC2CCB44B4326EA793040F2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	14
Start time:	16:40:16
Start date:	01/05/2024
Path:	C:\Windows\SysWOW64\WerFault.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\WerFault.exe -u -p 2996 -s 776
Imagebase:	0x370000
File size:	483'680 bytes
MD5 hash:	C31336C1EFC2CCB44B4326EA793040F2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	16
Start time:	16:40:25
Start date:	01/05/2024
Path:	C:\Users\user\AppData\Local\RageMP131\RageMP131.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\RageMP131\RageMP131.exe"
Imagebase:	0x400000
File size:	997'376 bytes
MD5 hash:	733C1261CF02626F2354E6339BAA6717
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: Windows_Trojan_RedLineStealer_ed346e4c, Description: unknown, Source: 00000010.00000002.3356388466.0000000005CCC000.00000040.00000020.00020000.00000000.sdmp, Author: unknown Rule: Windows_Trojan_Smokeloader_3687686f, Description: unknown, Source: 00000010.00000002.3356555753.0000000005DA0000.00000040.00001000.00020000.00000000.sdmp, Author: unknown
Antivirus matches:	Detection: 82%, ReversingLabs Detection: 77%, Virustotal, Browse
Reputation:	low
Has exited:	false

Show Windows behavior

Target ID:	18
Start time:	16:40:27
Start date:	01/05/2024
Path:	C:\Windows\SysWOW64\WerFault.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\WerFault.exe -u -p 5092 -s 812
Imagebase:	0x370000
File size:	483'680 bytes
MD5 hash:	C31336C1EFC2CCB44B4326EA793040F2
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	20
Start time:	16:40:32
Start date:	01/05/2024
Path:	C:\Windows\SysWOW64\WerFault.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\WerFault.exe -u -p 1948 -s 956
Imagebase:	0x370000
File size:	483'680 bytes
MD5 hash:	C31336C1EFC2CCB44B4326EA793040F2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	24
Start time:	16:40:35
Start date:	01/05/2024
Path:	C:\Users\user\AppData\Local\RageMP131\RageMP131.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\RageMP131\RageMP131.exe"
Imagebase:	0x400000
File size:	997'376 bytes
MD5 hash:	733C1261CF02626F2354E6339BAA6717
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: Windows_Trojan_RedLineStealer_ed346e4c, Description: unknown, Source: 00000018.00000002.3357697042.0000000005D4D000.00000040.00000020.00020000.00000000.sdmp, Author: unknown Rule: Windows_Trojan_Smokeloader_3687686f, Description: unknown, Source: 00000018.00000002.3357977475.0000000005EE0000.00000040.00001000.00020000.00000000.sdmp, Author: unknown
Reputation:	low
Has exited:	false

Show Windows behavior

Target ID:	25
Start time:	16:40:35
Start date:	01/05/2024
Path:	C:\Windows\SysWOW64\WerFault.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\WerFault.exe -u -p 2996 -s 888
Imagebase:	0x370000
File size:	483'680 bytes
MD5 hash:	C31336C1EFC2CCB44B4326EA793040F2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	26
Start time:	16:40:35
Start date:	01/05/2024
Path:	C:\Windows\SysWOW64\WerFault.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\WerFault.exe -u -p 6080 -s 896
Imagebase:	0x370000
File size:	483'680 bytes
MD5 hash:	C31336C1EFC2CCB44B4326EA793040F2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	27
Start time:	16:40:35
Start date:	01/05/2024
Path:	C:\Windows\SysWOW64\WerFault.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\WerFault.exe -u -p 5092 -s 956
Imagebase:	0x370000
File size:	483'680 bytes
MD5 hash:	C31336C1EFC2CCB44B4326EA793040F2
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	29
Start time:	16:40:37
Start date:	01/05/2024
Path:	C:\Windows\SysWOW64\WerFault.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\WerFault.exe -u -p 1948 -s 956
Imagebase:	0x370000
File size:	483'680 bytes
MD5 hash:	C31336C1EFC2CCB44B4326EA793040F2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	33
Start time:	16:40:44
Start date:	01/05/2024
Path:	C:\Windows\SysWOW64\WerFault.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\WerFault.exe -u -p 6080 -s 928
Imagebase:	0x370000
File size:	483'680 bytes
MD5 hash:	C31336C1EFC2CCB44B4326EA793040F2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	34
Start time:	16:40:44
Start date:	01/05/2024
Path:	C:\Windows\SysWOW64\WerFault.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\WerFault.exe -u -p 6024 -s 792
Imagebase:	0x370000
File size:	483'680 bytes
MD5 hash:	C31336C1EFC2CCB44B4326EA793040F2
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	37
Start time:	16:40:45
Start date:	01/05/2024
Path:	C:\Windows\SysWOW64\WerFault.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\WerFault.exe -u -p 2996 -s 888
Imagebase:	0x370000
File size:	483'680 bytes
MD5 hash:	C31336C1EFC2CCB44B4326EA793040F2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	40
Start time:	16:40:46
Start date:	01/05/2024
Path:	C:\Windows\SysWOW64\WerFault.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\WerFault.exe -u -p 1948 -s 972
Imagebase:	0x370000
File size:	483'680 bytes
MD5 hash:	C31336C1EFC2CCB44B4326EA793040F2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Execution Graph

Execution Coverage:	3.1%
Dynamic/Decrypted Code Coverage:	1.1%
Signature Coverage:	21.8%
Total number of Nodes:	1082
Total number of Limit Nodes:	14

Executed Functions

Function 00453C30 Relevance: 75.1, APIs: 33, Strings: 9, Instructions: 1568
sleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNELBASE(00000025), ref: 00453C44

Part of subcall function 004E2FA0: __Xtime_get_ticks.LIBCPMT ref: 004E2FA1
Part of subcall function 004E2FA0: __ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 004E2FAF

GetCurrentProcess.KERNEL32(00008000,00000000,00000000,00000001,00000000,00000000,00000001,00000000,00000000,00000001), ref: 00453DCD
SetPriorityClass.KERNELBASE(00000000), ref: 00453DD4
SetUnhandledExceptionFilter.KERNEL32(0045A780), ref: 00453DDF

Strings

futer, xrefs: 00453D39, 00453D4F, 00453D68
/*************/, xrefs: 00454952
43t res tgy45yfhyrt, xrefs: 0045A290
131, xrefs: 00453C6E, 00453CAE, 00453CB9, 00453CF4, 00453D0A, 00453D23, 00455BCB, 0045A3E6
Dk43l_dwmk438*, xrefs: 004567EA
er ert 346 34634 6ch, xrefs: 00458D6B
147.45.47.93:58709, xrefs: 00453CE7
149.18.24.96, xrefs: 00455CE8, 00455DA5
131, xrefs: 00453CA1, 00453CC4

Memory Dump Source

Source File: 00000000.00000002.3349183063.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3349183063.000000000058A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3349183063.0000000000590000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3349183063.0000000000593000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_2zdult23rz.jbxd

Similarity

API ID: ClassCurrentExceptionFilterPriorityProcessSleepUnhandledUnothrow_t@std@@@Xtime_get_ticks__ehfuncinfo$??2@
String ID: /*************/$131$131$147.45.47.93:58709$149.18.24.96$43t res tgy45yfhyrt$Dk43l_dwmk438*$er ert 346 34634 6ch$futer
API String ID: 1211644118-3050393103
Opcode ID: d8dc7ae4399afbc338cbd3cb43fe2f1cafb63e5b3bc4480d4e0b40fd1439af9b
Instruction ID: 58df280d1c5bcf31294a4ea42ed0208b52652377ae8c263acff41185647b5a58
Opcode Fuzzy Hash: d8dc7ae4399afbc338cbd3cb43fe2f1cafb63e5b3bc4480d4e0b40fd1439af9b
Instruction Fuzzy Hash: F70326B45083829FC324DF29C491AABBBE4FFD8345F40491EE98997352DB30A549CF96

Uniqueness

Uniqueness Score: -1.00%

Function 004D3150 Relevance: 12.1, APIs: 8, Instructions: 92
networkCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

WSAStartup.WS2_32 ref: 004D317A
getaddrinfo.WS2_32(?,?,?,00588CC0), ref: 004D31FC
socket.WS2_32(?,?,?), ref: 004D321D
connect.WS2_32(00000000,0055F6D1,?), ref: 004D3231
closesocket.WS2_32(00000000), ref: 004D323D
freeaddrinfo.WS2_32(?,?,?,?,00588CC0,?,?), ref: 004D324A
WSACleanup.WS2_32 ref: 004D3250
freeaddrinfo.WS2_32(?,?,?,?,00588CC0,?,?), ref: 004D3265

Memory Dump Source

Source File: 00000000.00000002.3349183063.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3349183063.000000000058A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3349183063.0000000000590000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3349183063.0000000000593000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_2zdult23rz.jbxd

Similarity

API ID: freeaddrinfo$CleanupStartupclosesocketconnectgetaddrinfosocket
String ID:
API String ID: 58224237-0
Opcode ID: 9e6883013388f64e9fa16a16f0073357cf9f7d6acb3b040fdaf446918f01256a
Instruction ID: 66b7f2af6e1e00109afe9fd9f1c3058fd8df4c895de65cf13c46908161227474
Opcode Fuzzy Hash: 9e6883013388f64e9fa16a16f0073357cf9f7d6acb3b040fdaf446918f01256a
Instruction Fuzzy Hash: 7731E631A047009BD7209F29DC4862BB7E5FF85735F104B5FF9A4933E0D37899489696

Uniqueness

Uniqueness Score: -1.00%

Function 0045A5C0 Relevance: 10.7, APIs: 5, Strings: 1, Instructions: 156
sleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCursorPos.USER32(?), ref: 0045A5D3
GetCursorPos.USER32(?), ref: 0045A5D9
Sleep.KERNELBASE(000003E9,?,?,?,?,?,?,?,?,?,?,?,00453DEA), ref: 0045A688
GetCursorPos.USER32(?), ref: 0045A68E
Sleep.KERNELBASE(00000001,?,?,?,?,?,?,?,?,?,?,?,00453DEA), ref: 0045A73A

Strings

=E, xrefs: 0045A720, 0045A668

Memory Dump Source

Source File: 00000000.00000002.3349183063.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3349183063.000000000058A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3349183063.0000000000590000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3349183063.0000000000593000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_2zdult23rz.jbxd

Similarity

API ID: Cursor$Sleep
String ID: =E
API String ID: 1847515627-2289002813
Opcode ID: 87aaf06eb3feef4bfb938811ad3031e6b1e2923ec5a892cc3e26860d6edd803d
Instruction ID: 823f227e19ebc1f4262c84ee3b7a9e46c16cc5b48225767440be61142120e435
Opcode Fuzzy Hash: 87aaf06eb3feef4bfb938811ad3031e6b1e2923ec5a892cc3e26860d6edd803d
Instruction Fuzzy Hash: B151CC35A00215CFCB18CF58C4C4EAAB7B1FF49705F19429AD945AB312D739ED1ACB81

Uniqueness

Uniqueness Score: -1.00%

Function 004DF790 Relevance: 9.5, APIs: 6, Instructions: 540
processlibraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleFileNameA.KERNEL32(00000000,?,00000200,?,?,811C9DC5), ref: 004DF7D2
GetModuleHandleA.KERNEL32(?), ref: 004DFBF1
GetProcAddress.KERNEL32(00000000,?), ref: 004DFBFC
CreateProcessA.KERNELBASE(00000000,?,00000000,00000000,00000000,00000000,00000000,00000000,00000044,?), ref: 004DFC4C

Memory Dump Source

Source File: 00000000.00000002.3349183063.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3349183063.000000000058A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3349183063.0000000000590000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3349183063.0000000000593000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_2zdult23rz.jbxd

Similarity

API ID: Module$AddressCreateFileHandleNameProcProcess
String ID:
API String ID: 347136680-0
Opcode ID: f5ef7e5a0093e01301607f7d42f07229371b5a2fad561cb305fd20bd82fb37b4
Instruction ID: 1c398614b8e40d06d673246c6905bd3bbdd575ff32f9acac0e67e79eca0af1e2
Opcode Fuzzy Hash: f5ef7e5a0093e01301607f7d42f07229371b5a2fad561cb305fd20bd82fb37b4
Instruction Fuzzy Hash: 393258B4D00249AFDB10CF98D995BEEFBB1FF48314F20425AE849AB381D7346A45CB95

Uniqueness

Uniqueness Score: -1.00%

Function 004D23C0 Relevance: 18.4, APIs: 12, Instructions: 351
networksleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

setsockopt.WS2_32(00000374,0000FFFF,00001006,?,00000008), ref: 004D2466
recv.WS2_32(?,00000004,00000002), ref: 004D2481
WSAGetLastError.WS2_32 ref: 004D2485
recv.WS2_32(00000000,0000000C,00000002,0000000C), ref: 004D24EE
recv.WS2_32(00000000,0000000C,00000008), ref: 004D250F
setsockopt.WS2_32(0000FFFF,00001006,?,00000008,?), ref: 004D258B
recv.WS2_32(00000000,?,00000008), ref: 004D25AC

Part of subcall function 004D3150: WSAStartup.WS2_32 ref: 004D317A
Part of subcall function 004D3150: getaddrinfo.WS2_32(?,?,?,00588CC0), ref: 004D31FC
Part of subcall function 004D3150: socket.WS2_32(?,?,?), ref: 004D321D
Part of subcall function 004D3150: connect.WS2_32(00000000,0055F6D1,?), ref: 004D3231
Part of subcall function 004D3150: closesocket.WS2_32(00000000), ref: 004D323D
Part of subcall function 004D3150: freeaddrinfo.WS2_32(?,?,?,?,00588CC0,?,?), ref: 004D324A
Part of subcall function 004D3150: WSACleanup.WS2_32 ref: 004D3250

recv.WS2_32(?,00000004,00000008), ref: 004D27D6
__Xtime_get_ticks.LIBCPMT ref: 004D27DA
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 004D27E8
Sleep.KERNELBASE(00000001,00000000,?,00002710,00000000), ref: 004D284F
Sleep.KERNELBASE(00000064,?,00002710,00000000), ref: 004D285D

Memory Dump Source

Source File: 00000000.00000002.3349183063.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3349183063.000000000058A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3349183063.0000000000590000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3349183063.0000000000593000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_2zdult23rz.jbxd

Similarity

API ID: recv$Sleepsetsockopt$CleanupErrorLastStartupUnothrow_t@std@@@Xtime_get_ticks__ehfuncinfo$??2@closesocketconnectfreeaddrinfogetaddrinfosocket
String ID:
API String ID: 4125349891-0
Opcode ID: 741e4aba1a023d42f8cda5b1c611e4a31a37109a2d99ce0121b9f219ece0da7f
Instruction ID: 15ea99ae058cf58d21446cf462f8f8b9c5c04bab4b96d95aa166a16db5b48a04
Opcode Fuzzy Hash: 741e4aba1a023d42f8cda5b1c611e4a31a37109a2d99ce0121b9f219ece0da7f
Instruction Fuzzy Hash: 55E13230900244DFDB15DBA4CDA07ADBBF1BF66310F24425BE841AB2D2DBB45C8ADB95

Uniqueness

Uniqueness Score: -1.00%

Function 0043D563 Relevance: 17.8, APIs: 9, Strings: 1, Instructions: 273
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 0043D21C: CreateFileW.KERNELBASE(?,?,?,?,?,?,00000000,?,00000000,00000000,00000000,00000000,00000000), ref: 0043D239

GetLastError.KERNEL32 ref: 0043D677
__dosmaperr.LIBCMT ref: 0043D67E
GetFileType.KERNELBASE(00000000), ref: 0043D68A
GetLastError.KERNEL32 ref: 0043D694
__dosmaperr.LIBCMT ref: 0043D69D
CloseHandle.KERNEL32(00000000), ref: 0043D6BD
CloseHandle.KERNEL32(?), ref: 0043D80A
GetLastError.KERNEL32 ref: 0043D83C
__dosmaperr.LIBCMT ref: 0043D843

Strings

H, xrefs: 0043D7C8

Memory Dump Source

Source File: 00000000.00000002.3349183063.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3349183063.000000000058A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3349183063.0000000000590000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3349183063.0000000000593000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_2zdult23rz.jbxd

Similarity

API ID: ErrorLast__dosmaperr$CloseFileHandle$CreateType
String ID: H
API String ID: 4237864984-2852464175
Opcode ID: 63c00d4ff725a68de22716b4a375591cf024028e2c9fd4940c7fbe6601f7ac47
Instruction ID: deea7823187220b22c69116efca66525af397024c1424d0dae53dd4a9d4c69af
Opcode Fuzzy Hash: 63c00d4ff725a68de22716b4a375591cf024028e2c9fd4940c7fbe6601f7ac47
Instruction Fuzzy Hash: 47A17C31E14114AFCF19AF68EC467AE3BB1EB0A324F14215EF811DB391DB388816DB55

Uniqueness

Uniqueness Score: -1.00%

Function 004D2190 Relevance: 16.9, APIs: 11, Instructions: 404
networkCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

std::_Throw_Cpp_error.LIBCPMT ref: 004D2391
std::_Throw_Cpp_error.LIBCPMT ref: 004D23A2
setsockopt.WS2_32(00000374,0000FFFF,00001006,?,00000008), ref: 004D2466
recv.WS2_32(?,00000004,00000002), ref: 004D2481
WSAGetLastError.WS2_32 ref: 004D2485
recv.WS2_32(00000000,0000000C,00000002,0000000C), ref: 004D24EE
recv.WS2_32(00000000,0000000C,00000008), ref: 004D250F
setsockopt.WS2_32(0000FFFF,00001006,?,00000008,?), ref: 004D258B
recv.WS2_32(00000000,?,00000008), ref: 004D25AC

Memory Dump Source

Source File: 00000000.00000002.3349183063.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3349183063.000000000058A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3349183063.0000000000590000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3349183063.0000000000593000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_2zdult23rz.jbxd

Similarity

API ID: recv$Cpp_errorThrow_setsockoptstd::_$ErrorLast
String ID:
API String ID: 4262120464-0
Opcode ID: c1582d6184370410a97c32afa1233909a04efc10503d3efc906a2629de16cee2
Instruction ID: f7b17b8e68668ba49e7fca0522a5bdce23b6917c1ff1aba89fdf03a1c4391d3e
Opcode Fuzzy Hash: c1582d6184370410a97c32afa1233909a04efc10503d3efc906a2629de16cee2
Instruction Fuzzy Hash: 8AF10070D00248DBDB14DFA8DD95BAEBBB1FF54314F10821AE804AB392DB786985DF94

Uniqueness

Uniqueness Score: -1.00%

Function 004431A0 Relevance: 12.5, APIs: 6, Strings: 1, Instructions: 292
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

, xrefs: 00443421, 00443424

Memory Dump Source

Source File: 00000000.00000002.3349183063.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3349183063.000000000058A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3349183063.0000000000590000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3349183063.0000000000593000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_2zdult23rz.jbxd

Similarity

API ID:
String ID:
API String ID: 0-3907804496
Opcode ID: f312eda8249cc3069f08ad3250047b362f1821e8ea6b527c5d9c004b485e982e
Instruction ID: e3239ec4e1ee32b8324d570a22e522ef24bddbe65fd960e714ad45a7b0e040b8
Opcode Fuzzy Hash: f312eda8249cc3069f08ad3250047b362f1821e8ea6b527c5d9c004b485e982e
Instruction Fuzzy Hash: 77B12670A04244AFEB01DF59C881BBE7BB1FF49715F14419AE90197382CB789E41CBA9

Uniqueness

Uniqueness Score: -1.00%

Function 004081E0 Relevance: 7.3, APIs: 3, Strings: 1, Instructions: 332
libraryloadernetworkCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleA.KERNEL32(Ws2_32.dll,?,?,?,?,005588D8,00000000,00000000,-00589220), ref: 00408566
GetProcAddress.KERNEL32(00000000,?), ref: 00408574
WSASend.WS2_32(?,?,00000001,00000000,00000000,00000000,00000000,?,?,?,?,005588D8,00000000,00000000,-00589220), ref: 00408589

Strings

Ws2_32.dll, xrefs: 0040855A

Memory Dump Source

Source File: 00000000.00000002.3349183063.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3349183063.000000000058A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3349183063.0000000000590000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3349183063.0000000000593000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_2zdult23rz.jbxd

Similarity

API ID: AddressHandleModuleProcSend
String ID: Ws2_32.dll
API String ID: 2819740048-3093949381
Opcode ID: 605ac2d7a3170708ba1039c723fe4127dad6931d4a4a67f7d388f1b1f58ff418
Instruction ID: b889a33a35ddf0adef0218ac58701f77bdbbaba15cb1320cc4c9efeef27d22b6
Opcode Fuzzy Hash: 605ac2d7a3170708ba1039c723fe4127dad6931d4a4a67f7d388f1b1f58ff418
Instruction Fuzzy Hash: 1BE1BC70D00258EFDF15CBA4DD917EDBBB0AF56704F14029EE8857B282DB34198ACB95

Uniqueness

Uniqueness Score: -1.00%

Function 004F2CD0 Relevance: 6.1, APIs: 4, Instructions: 66
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetFileAttributesA.KERNELBASE(?,00000005,00000005,?), ref: 004F2D0C
GetLastError.KERNEL32(?,00000005,00000005,?), ref: 004F2D17
std::_Throw_Cpp_error.LIBCPMT ref: 004F2D4E
std::_Throw_Cpp_error.LIBCPMT ref: 004F2D5F

Memory Dump Source

Source File: 00000000.00000002.3349183063.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3349183063.000000000058A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3349183063.0000000000590000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3349183063.0000000000593000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_2zdult23rz.jbxd

Similarity

API ID: Cpp_errorThrow_std::_$AttributesErrorFileLast
String ID:
API String ID: 995686243-0
Opcode ID: 1a30c07ed28fe703679387aa5b2d6d259f589d07aea0d83f312770283b1f14c8
Instruction ID: 325128bde6972141eaafbb0e95bf719766b08d5b5670bbe0189b29004b96e682
Opcode Fuzzy Hash: 1a30c07ed28fe703679387aa5b2d6d259f589d07aea0d83f312770283b1f14c8
Instruction Fuzzy Hash: 3401C071641118129A342A35ED4907F370D8713328BA80F1BEE25973D5D9DFCC45875A

Uniqueness

Uniqueness Score: -1.00%

Function 004D2890 Relevance: 5.8, APIs: 2, Strings: 1, Instructions: 560
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentProcess.KERNEL32(?,6F2977B7,?,?,?,?,?,?,?,00000000,00000001,761B23A0,00000000), ref: 004D2D54

Part of subcall function 004DB380: VirtualAllocEx.KERNEL32(00000000,00000000,?,00003000,00000040,?,00000000), ref: 004DB3EA
Part of subcall function 004DB380: WriteProcessMemory.KERNEL32(00000000,00000000,t-M,?,00000000), ref: 004DB406
Part of subcall function 004DB380: WriteProcessMemory.KERNEL32(?,?,?,?,00000000), ref: 004DB43F
Part of subcall function 004DB380: VirtualAllocEx.KERNEL32(?,00000000,00001000,00003000,00000040), ref: 004DB469

Part of subcall function 0042D43A: ReleaseSRWLockExclusive.KERNEL32(-00000008,?,004D2F08,00588C44,761B23A0,00000000), ref: 0042D44E

Strings

149.18.24.96, xrefs: 004D295C

Memory Dump Source

Source File: 00000000.00000002.3349183063.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3349183063.000000000058A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3349183063.0000000000590000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3349183063.0000000000593000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_2zdult23rz.jbxd

Similarity

API ID: Process$AllocMemoryVirtualWrite$CurrentExclusiveLockRelease
String ID: 149.18.24.96
API String ID: 666592346-171400976
Opcode ID: 270da5508d348e68f7a9e6667ccf5ce37d91e12b293a508e750d7236e560dbd7
Instruction ID: 26b9c72b6ddc4c31c1f3b4b91af9721e671e16450a7e1798ce2a3c04c8b5f315
Opcode Fuzzy Hash: 270da5508d348e68f7a9e6667ccf5ce37d91e12b293a508e750d7236e560dbd7
Instruction Fuzzy Hash: 7432DF70900208CBDB14DF68C9957EDBBB1FF58304F14419AE8096B392DB789E85CFA6

Uniqueness

Uniqueness Score: -1.00%

Function 004F8D20 Relevance: 4.8, APIs: 1, Strings: 2, Instructions: 250
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetLastError.KERNEL32 ref: 004F8DF9

Strings

-1L, xrefs: 004F8EAA
-2L, xrefs: 004F8E0D

Memory Dump Source

Source File: 00000000.00000002.3349183063.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3349183063.000000000058A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3349183063.0000000000590000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3349183063.0000000000593000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_2zdult23rz.jbxd

Similarity

API ID: ErrorLast
String ID: -1L$-2L
API String ID: 1452528299-3975959154
Opcode ID: 691346873af9f375a3fd3bec6b454848e53a0b4af0cd965a2b75b339649d0642
Instruction ID: 8532e58cabc42239c9a206463210862c2cf1955d45b676afb1905f123e481057
Opcode Fuzzy Hash: 691346873af9f375a3fd3bec6b454848e53a0b4af0cd965a2b75b339649d0642
Instruction Fuzzy Hash: 8BA1A071E102489BDB18DBA4CC95BFEB771FF58304F14821EE905BB281EB746A85CB54

Uniqueness

Uniqueness Score: -1.00%

Function 00433692 Relevance: 3.7, APIs: 1, Strings: 1, Instructions: 157
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

d A, xrefs: 00433694

Memory Dump Source

Source File: 00000000.00000002.3349183063.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3349183063.000000000058A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3349183063.0000000000590000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3349183063.0000000000593000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_2zdult23rz.jbxd

Similarity

API ID:
String ID: d A
API String ID: 0-616623946
Opcode ID: 5716fe010b3ef8e82fbddee052f2b6988042c47bb628807dafe6179510680c26
Instruction ID: 8d691b3f4dbeef2f936747217c2848be1b4780fc272094865f28ed7dea4c0760
Opcode Fuzzy Hash: 5716fe010b3ef8e82fbddee052f2b6988042c47bb628807dafe6179510680c26
Instruction Fuzzy Hash: 7B51E3B4A00104AFDB14DF59CC85AAABBF1EF4D324F24915AF8099B352D379EE41CB94

Uniqueness

Uniqueness Score: -1.00%

Function 00444019 Relevance: 3.2, APIs: 2, Instructions: 196
fileCOMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 0044372F: GetConsoleOutputCP.KERNEL32(D7297C87,00000000,00000000,00000000), ref: 00443792

WriteFile.KERNELBASE(?,00000000,?,00000000,00000000,00000000,00000000,0000000C,?,00000000,00578C88,00000014,0043BE32,00000000,00000000,00000000), ref: 0044419E
GetLastError.KERNEL32(?,00000000), ref: 004441A8

Memory Dump Source

Source File: 00000000.00000002.3349183063.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3349183063.000000000058A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3349183063.0000000000590000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3349183063.0000000000593000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_2zdult23rz.jbxd

Similarity

API ID: ConsoleErrorFileLastOutputWrite
String ID:
API String ID: 2915228174-0
Opcode ID: a2902c3c69c25210d81bcce29da4bc8cd80d89380b950bcc4e5f7a79d08526b7
Instruction ID: 0628d0172fcac0a10c399004d6184d52a202fa31f39ed19b8586a1ab0f8a80ff
Opcode Fuzzy Hash: a2902c3c69c25210d81bcce29da4bc8cd80d89380b950bcc4e5f7a79d08526b7
Instruction Fuzzy Hash: 2B61C471900119AFEF11CFA8DC84BEFBBB9BF99304F14014AE900A7202D779D955DB65

Uniqueness

Uniqueness Score: -1.00%

Function 00407B10 Relevance: 3.1, APIs: 2, Instructions: 114
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetFileAttributesA.KERNELBASE(?,7FFFFFFF,?,?,?,?,00000000,00558869,000000FF,?,?,00000000,00000001), ref: 00407B6A
CreateDirectoryA.KERNELBASE(?,00000000,?,?,?,?,?,?,?,?,00000000,00558869,000000FF,?,?,00000000), ref: 00407BF2

Memory Dump Source

Source File: 00000000.00000002.3349183063.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3349183063.000000000058A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3349183063.0000000000590000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3349183063.0000000000593000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_2zdult23rz.jbxd

Similarity

API ID: AttributesCreateDirectoryFile
String ID:
API String ID: 3401506121-0
Opcode ID: 88b6d157f409cee9c50ab71b6ff0b2b2da8276be95a888d3290d1b8dfbb9eb26
Instruction ID: 2e2c2f2e01908e67c2a54bf0340a0c4501e43c5477e127a6dc49a8083d671767
Opcode Fuzzy Hash: 88b6d157f409cee9c50ab71b6ff0b2b2da8276be95a888d3290d1b8dfbb9eb26
Instruction Fuzzy Hash: 2641F175E14601EFC720DF64EC42AAAB7B5FB54724F18032AE816633D0E7347944DB96

Uniqueness

Uniqueness Score: -1.00%

Function 0044368F Relevance: 3.1, APIs: 2, Instructions: 63COMMONLIBRARYCODE

Download Yara Rule

APIs

FindCloseChangeNotification.KERNELBASE(00000000,00000000,CF830579,?,00443576,00000000,CF830579,00578C68,0000000C,00443632,0043790D,?), ref: 004436E5
GetLastError.KERNEL32(?,00443576,00000000,CF830579,00578C68,0000000C,00443632,0043790D,?), ref: 004436EF

Memory Dump Source

Source File: 00000000.00000002.3349183063.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3349183063.000000000058A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3349183063.0000000000590000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3349183063.0000000000593000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_2zdult23rz.jbxd

Similarity

API ID: ChangeCloseErrorFindLastNotification
String ID:
API String ID: 1687624791-0
Opcode ID: b78c23c39475fb946a6917cc79ada02ff23f82b2eae8cc914a7116fd1dd25ee2
Instruction ID: 5b9e54e71ebf2813978f3334a6ac8d2e590d94fd15b88a1802dc34040f0fcd9e
Opcode Fuzzy Hash: b78c23c39475fb946a6917cc79ada02ff23f82b2eae8cc914a7116fd1dd25ee2
Instruction Fuzzy Hash: 0B118C326041153AF6302A34AC4DB3F67898B82F39F26014FF908873C2DE6D8D409658

Uniqueness

Uniqueness Score: -1.00%

Function 0043CDAC Relevance: 3.1, APIs: 2, Instructions: 52COMMONLIBRARYCODE

Download Yara Rule

APIs

SetFilePointerEx.KERNELBASE(00000000,00000000,00000000,00000000,00000002,00000000,00000000,00000000,00000000,?,0043CEE6,00000000,00000000,00000000,00000002,00000000), ref: 0043CDE8
GetLastError.KERNEL32(00000000,?,0043CEE6,00000000,00000000,00000000,00000002,00000000,?,004440BE,00000000,00000000,00000000,00000002,00000000,00000000), ref: 0043CDF5

Memory Dump Source

Source File: 00000000.00000002.3349183063.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3349183063.000000000058A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3349183063.0000000000590000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3349183063.0000000000593000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_2zdult23rz.jbxd

Similarity

API ID: ErrorFileLastPointer
String ID:
API String ID: 2976181284-0
Opcode ID: 0af088d07c5e9b5a66b5e22e0931705f94c426e6b0292fcf303bea830e5f1f74
Instruction ID: 056746620e1e5b2230fb06e89194d4bad5ac0bf9516e57b03a2b19a767fcc837
Opcode Fuzzy Hash: 0af088d07c5e9b5a66b5e22e0931705f94c426e6b0292fcf303bea830e5f1f74
Instruction Fuzzy Hash: 62012632614119AFCF058F59CC49D9E3F2AEF89320F24020AF811AB2D0EA75ED41DBD4

Uniqueness

Uniqueness Score: -1.00%

Function 05CC37C6 Relevance: 3.0, APIs: 2, Instructions: 41processCOMMON

Download Yara Rule

APIs

CreateToolhelp32Snapshot.KERNEL32(00000008,00000000), ref: 05CC37EE
Module32First.KERNEL32(00000000,00000224), ref: 05CC380E

Memory Dump Source

Source File: 00000000.00000002.3357800955.0000000005CC3000.00000040.00000020.00020000.00000000.sdmp, Offset: 05CC3000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5cc3000_2zdult23rz.jbxd

Yara matches

Similarity

API ID: CreateFirstModule32SnapshotToolhelp32
String ID:
API String ID: 3833638111-0
Opcode ID: 3788706d20f5b898e185810e19a2e38a50b9b544ac306a9cd33eedd6d527d18a
Instruction ID: 562e1f1df9967a86b8dc01b8d7d5e648caa18cc38f8a3e016f6c519a22b5169f
Opcode Fuzzy Hash: 3788706d20f5b898e185810e19a2e38a50b9b544ac306a9cd33eedd6d527d18a
Instruction Fuzzy Hash: 88F062312007106FD7207BB5B88DA6E7AF8FF49A25F104DADE643D10C0DA74E9454661

Uniqueness

Uniqueness Score: -1.00%

Function 004D20B0 Relevance: 3.0, APIs: 1, Strings: 1, Instructions: 33sleepCOMMON

Download Yara Rule

APIs

Sleep.KERNELBASE(00000065), ref: 004D2103

Strings

131, xrefs: 004D20D8

Memory Dump Source

Source File: 00000000.00000002.3349183063.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3349183063.000000000058A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3349183063.0000000000590000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3349183063.0000000000593000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_2zdult23rz.jbxd

Similarity

API ID: Sleep
String ID: 131
API String ID: 3472027048-2136814527
Opcode ID: 7fcd9baa8a9375f207873d3bd77103b4ea8c4e2924f330d05fd9db3092bf82de
Instruction ID: 16727208b5f08e4bea599353fbf53a6d413f31fbfb73884cdf8f34aab55cbcc4
Opcode Fuzzy Hash: 7fcd9baa8a9375f207873d3bd77103b4ea8c4e2924f330d05fd9db3092bf82de
Instruction Fuzzy Hash: B8F0A731B0025416EA26736D7E06B3B3F8997A5765F48009FEE403BBD2DDD9280987D6

Uniqueness

Uniqueness Score: -1.00%

Function 004F3350 Relevance: 1.7, APIs: 1, Instructions: 163COMMON

Download Yara Rule

APIs

__fread_nolock.LIBCMT ref: 004F34EF

Memory Dump Source

Source File: 00000000.00000002.3349183063.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3349183063.000000000058A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3349183063.0000000000590000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3349183063.0000000000593000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_2zdult23rz.jbxd

Similarity

API ID: __fread_nolock
String ID:
API String ID: 2638373210-0
Opcode ID: a84dd0405f3734e21e00de2f9719074e0bf350ecf619eceb43609241f9f5c459
Instruction ID: 6ce4f48939319f72f3aec6a6d9b50e6fff9bcb1e6f6dae555552d8831335830b
Opcode Fuzzy Hash: a84dd0405f3734e21e00de2f9719074e0bf350ecf619eceb43609241f9f5c459
Instruction Fuzzy Hash: 2551A0B0D002099FDB14DF59D981BAEFBB0FF49704F14825EE8146B341E779AA41CBA5

Uniqueness

Uniqueness Score: -1.00%

Function 0044550F Relevance: 1.6, APIs: 1, Instructions: 54COMMON

Download Yara Rule

APIs

__wsopen_s.LIBCMT ref: 00445549

Memory Dump Source

Source File: 00000000.00000002.3349183063.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3349183063.000000000058A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3349183063.0000000000590000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3349183063.0000000000593000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_2zdult23rz.jbxd

Similarity

API ID: __wsopen_s
String ID:
API String ID: 3347428461-0
Opcode ID: 74b1a02970c39c47b45041c200990e685aac7fc35223ed5dd6a5c291d0407c3c
Instruction ID: e92d0ab7a98c68cd7689e4ea664d55cb742e11440dbe97f573872f5ababe4450
Opcode Fuzzy Hash: 74b1a02970c39c47b45041c200990e685aac7fc35223ed5dd6a5c291d0407c3c
Instruction Fuzzy Hash: D6112A71A0410AAFDF05DF58E94199F7BF5EF48304F14405AF805EB352D670DA15CB69

Uniqueness

Uniqueness Score: -1.00%

Function 004036F0 Relevance: 1.5, APIs: 1, Instructions: 47COMMONLIBRARYCODE

Download Yara Rule

APIs

Concurrency::cancel_current_task.LIBCPMT ref: 0040373F

Memory Dump Source

Source File: 00000000.00000002.3349183063.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3349183063.000000000058A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3349183063.0000000000590000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3349183063.0000000000593000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_2zdult23rz.jbxd

Similarity

API ID: Concurrency::cancel_current_task
String ID:
API String ID: 118556049-0
Opcode ID: c8f910bf03f94a0f0c294a8cbb5c47e77f87340cd5e2596aba26795b41fc774c
Instruction ID: 1f83190ccb7284a945d627c352a8af0deec80e54417847a9b28e6d6de5687d5d
Opcode Fuzzy Hash: c8f910bf03f94a0f0c294a8cbb5c47e77f87340cd5e2596aba26795b41fc774c
Instruction Fuzzy Hash: F6F024F26000009BCB14AF61E4429FAB7ECDE243A7750447FF989D7282E73EDA448788

Uniqueness

Uniqueness Score: -1.00%

Function 00444EEA Relevance: 1.5, APIs: 1, Instructions: 39memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

RtlAllocateHeap.NTDLL(00000008,0042C58A,?,?,00444870,00000001,00000364,?,00000008,000000FF,?,0042F3CF,?,?,00000000,?), ref: 00444F2B

Memory Dump Source

Source File: 00000000.00000002.3349183063.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3349183063.000000000058A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3349183063.0000000000590000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3349183063.0000000000593000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_2zdult23rz.jbxd

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: a67815bf3a869f96681a983d491eb3b40caf69aff6fa6519728d0dfc96a736c8
Instruction ID: 086544c5e523b8e02c2757f3417cf7e9bd7439c420b709eac9e7cfb6d4d974b4
Opcode Fuzzy Hash: a67815bf3a869f96681a983d491eb3b40caf69aff6fa6519728d0dfc96a736c8
Instruction Fuzzy Hash: CEF0B4316155246BBB215E629C05B7B7788ABD17A1F158417FD04E7280CE38D80886E9

Uniqueness

Uniqueness Score: -1.00%

Function 00445924 Relevance: 1.5, APIs: 1, Instructions: 32memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

RtlAllocateHeap.NTDLL(00000000,?,?,?,0042F3CF,?,?,00000000,?,?,0040390D,0042C58A,?,?,0042C58A), ref: 00445956

Memory Dump Source

Source File: 00000000.00000002.3349183063.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3349183063.000000000058A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3349183063.0000000000590000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3349183063.0000000000593000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_2zdult23rz.jbxd

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: f2b14cbab143d06f1f7f7dbb6931a5cb890e65deebc000058d543e0d14a0fef9
Instruction ID: 47241cb67a9c7b30d4e0b830f1b418076ccf533a730137c1b779a77b3e9f7ccf
Opcode Fuzzy Hash: f2b14cbab143d06f1f7f7dbb6931a5cb890e65deebc000058d543e0d14a0fef9
Instruction Fuzzy Hash: 1CE0E571202A20EBFE252F265C0576B3648DB413B0F080113FD05F6292DB68CC0482ED

Uniqueness

Uniqueness Score: -1.00%

Function 0043D21C Relevance: 1.5, APIs: 1, Instructions: 15fileCOMMONLIBRARYCODE

Download Yara Rule

APIs

CreateFileW.KERNELBASE(?,?,?,?,?,?,00000000,?,00000000,00000000,00000000,00000000,00000000), ref: 0043D239

Memory Dump Source

Source File: 00000000.00000002.3349183063.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3349183063.000000000058A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3349183063.0000000000590000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3349183063.0000000000593000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_2zdult23rz.jbxd

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: a91d23867b62d5b96c41623edd2e8bd3ad87182c46de236b94739b51406d3068
Instruction ID: 7ae74b51c889a2cb05e6a06522f477e8d6926b4a8c7f3733491aa3a38d366a2c
Opcode Fuzzy Hash: a91d23867b62d5b96c41623edd2e8bd3ad87182c46de236b94739b51406d3068
Instruction Fuzzy Hash: 92D06C3200010DBBDF028F84DC06EDA3BAAFB4C714F014040FA1866120C772E822EB90

Uniqueness

Uniqueness Score: -1.00%

Function 05CC3485 Relevance: 1.3, APIs: 1, Instructions: 48memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNELBASE(00000000,?,00001000,00000040), ref: 05CC34D6

Memory Dump Source

Source File: 00000000.00000002.3357800955.0000000005CC3000.00000040.00000020.00020000.00000000.sdmp, Offset: 05CC3000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5cc3000_2zdult23rz.jbxd

Yara matches

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 499270a49480bde3a93b1541ef130abcc6c407f96609cce36d97d57e1d2ec7bb
Instruction ID: 632c44495199bdb385e1c2179a08d5a29573660bcdd1f37d04753ee3063fc78f
Opcode Fuzzy Hash: 499270a49480bde3a93b1541ef130abcc6c407f96609cce36d97d57e1d2ec7bb
Instruction Fuzzy Hash: 5B112B79A00208EFDB01DF98C989E99BFF5AF08751F058094F9489B361D375EA90EB80

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 0051E6F0 Relevance: 84.5, Strings: 66, Instructions: 2003COMMON

Download Yara Rule

Strings

journal_mode, xrefs: 0051EDA9
seq, xrefs: 0051F857
unique, xrefs: 0051F892
freelist_count, xrefs: 005200B3
seq, xrefs: 0051FA45
$AX, xrefs: 00520006, 0052000C
synchronous, xrefs: 0051F0C5
seq, xrefs: 0051FC92
journal_size_limit, xrefs: 0051EE82
page_count, xrefs: 0051EB62
encoding, xrefs: 0051FF66
page_size, xrefs: 0051EA3B
name, xrefs: 0051F631
schema_version, xrefs: 00520093
unsupported encoding: %s, xrefs: 0052003F, 0052007F
Safety level may not be changed inside a transaction, xrefs: 0051F115
not a writable directory, xrefs: 0051F03A
page_count, xrefs: 0051EB01
cache_size, xrefs: 0051EEA0
name, xrefs: 0051FCB5
temp_store, xrefs: 0051EF3A
like, xrefs: 0051FE5C
exclusive, xrefs: 0051EB98
table_info, xrefs: 0051F159
like, xrefs: 0051FECE, 0051FED5, 0051FEE8, 0051FEED, 0051FEFD
page_size, xrefs: 0051E9F9
glob, xrefs: 0051FE75
seqno, xrefs: 0051F5F6
index_list, xrefs: 0051F7DC
exclusive, xrefs: 0051EC50
locking_mode, xrefs: 0051EB7E
name, xrefs: 0051F1DB
glob, xrefs: 0051FE92, 0051FE97, 0051FEA8, 0051FEAD, 0051FEBD
index_info, xrefs: 0051F598
database_list, xrefs: 0051FA18
cid, xrefs: 0051F1B8
max_page_count, xrefs: 0051EA81
name, xrefs: 0051FA68
*?[, xrefs: 0051FE81
encoding, xrefs: 0051FF2D
synchronous, xrefs: 0051F0FD
cache_size, xrefs: 0051EED4
default_cache_size, xrefs: 0051E899
locking_mode, xrefs: 0051EC3D
file, xrefs: 0051FA80
notnull, xrefs: 0051F20B
type, xrefs: 0051F1F3
temp_store_directory, xrefs: 0051EFC6
memory, xrefs: 0051EF75
like, xrefs: 0051FE38
cache_size, xrefs: 0051E8D9
normal, xrefs: 0051EBAD
dflt_value, xrefs: 0051F223
user_version, xrefs: 005200A3
normal, xrefs: 0051EC5A, 0051EC6B
temp_store, xrefs: 0051EF17
max_page_count, xrefs: 0051EAEB
-%T, xrefs: 0051E78D
collation_list, xrefs: 0051FC74
temp_store_directory, xrefs: 0051EFF8
journal_mode, xrefs: 0051EC96
name, xrefs: 0051F87A
cid, xrefs: 0051F619
journal_size_limit, xrefs: 0051EDF6
file, xrefs: 0051EF5E
case_sensitive_like, xrefs: 0051FE07

Memory Dump Source

Source File: 00000000.00000002.3349183063.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3349183063.000000000058A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3349183063.0000000000590000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3349183063.0000000000593000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_2zdult23rz.jbxd

Similarity

API ID:
String ID: $AX$*?[$-%T$Safety level may not be changed inside a transaction$cache_size$cache_size$cache_size$case_sensitive_like$cid$cid$collation_list$database_list$default_cache_size$dflt_value$encoding$encoding$exclusive$exclusive$file$file$freelist_count$glob$glob$index_info$index_list$journal_mode$journal_mode$journal_size_limit$journal_size_limit$like$like$like$locking_mode$locking_mode$max_page_count$max_page_count$memory$name$name$name$name$name$normal$normal$not a writable directory$notnull$page_count$page_count$page_size$page_size$schema_version$seq$seq$seq$seqno$synchronous$synchronous$table_info$temp_store$temp_store$temp_store_directory$temp_store_directory$type$unique$unsupported encoding: %s$user_version
API String ID: 0-2540211024
Opcode ID: b3b4600330eca52d6da621488ec254c91da53a423cad2c0afe11b63631272a03
Instruction ID: e845cb136b924fc1b8bd2ff68bcba8bd07f58aab76af76392cb2f3833a97622e
Opcode Fuzzy Hash: b3b4600330eca52d6da621488ec254c91da53a423cad2c0afe11b63631272a03
Instruction Fuzzy Hash: 4603F1706047029FE724EF28C855B6ABFE1BF84344F05856DEC864B392EB75E945CB82

Uniqueness

Uniqueness Score: -1.00%

Function 004F2150 Relevance: 33.4, APIs: 17, Strings: 2, Instructions: 154windowfileCOMMON

Download Yara Rule

APIs

GdiplusStartup.GDIPLUS(?,?,00000000), ref: 004F2189
GetSystemMetrics.USER32(00000001), ref: 004F219F
GetSystemMetrics.USER32(00000000), ref: 004F21A5
GetDC.USER32(00000000), ref: 004F21AB
CreateCompatibleDC.GDI32(00000000), ref: 004F21BF
CreateCompatibleBitmap.GDI32(00000000,00000000,00000000), ref: 004F21D3
SelectObject.GDI32(?,00000000), ref: 004F21E8
BitBlt.GDI32(?,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00CC0020), ref: 004F2201
GdipCreateBitmapFromHBITMAP.GDIPLUS(?,00000000,?), ref: 004F2217
GdipGetImageEncodersSize.GDIPLUS(00000000,?), ref: 004F2233
GdipGetImageEncoders.GDIPLUS(00000000,00000000,00000000), ref: 004F225A
GdipSaveImageToFile.GDIPLUS(00000000,?,?,?), ref: 004F22FD
DeleteObject.GDI32(?), ref: 004F2306
GdipDisposeImage.GDIPLUS(00000000), ref: 004F230D
DeleteObject.GDI32(?), ref: 004F2316
ReleaseDC.USER32(00000000,00000000), ref: 004F231F
GdiplusShutdown.GDIPLUS(?), ref: 004F2328

Strings

image/png, xrefs: 004F2272
d, xrefs: 004F2165

Memory Dump Source

Source File: 00000000.00000002.3349183063.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3349183063.000000000058A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3349183063.0000000000590000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3349183063.0000000000593000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_2zdult23rz.jbxd

Similarity

API ID: Gdip$Image$CreateObject$BitmapCompatibleDeleteEncodersGdiplusMetricsSystem$DisposeFileFromReleaseSaveSelectShutdownSizeStartup
String ID: d$image/png
API String ID: 258367123-2616758285
Opcode ID: d93c92cf953bbe82929a5a79100fd7e348d6b079dbf9517b437a49d65dcd1284
Instruction ID: db5a99caf6ac0e95f343f652cfce475829ccb6d2aa326760d5af157a7b9552c8
Opcode Fuzzy Hash: d93c92cf953bbe82929a5a79100fd7e348d6b079dbf9517b437a49d65dcd1284
Instruction Fuzzy Hash: C8516D71D00209AFDF109FA4DD49BEEBBB8FF18314F100065EA05B72A1D7B99948DB64

Uniqueness

Uniqueness Score: -1.00%

Function 00420DB0 Relevance: 29.1, APIs: 12, Strings: 4, Instructions: 1114COMMON

Download Yara Rule

APIs

___std_exception_destroy.LIBVCRUNTIME ref: 00421441
___std_exception_destroy.LIBVCRUNTIME ref: 0042145A
___std_exception_destroy.LIBVCRUNTIME ref: 004215C9
___std_exception_destroy.LIBVCRUNTIME ref: 004215E2
___std_exception_destroy.LIBVCRUNTIME ref: 00421771
___std_exception_destroy.LIBVCRUNTIME ref: 0042178A
___std_exception_destroy.LIBVCRUNTIME ref: 004218F8
___std_exception_destroy.LIBVCRUNTIME ref: 00421911

Strings

object, xrefs: 0042195E
array, xrefs: 00421811
number overflow parsing ', xrefs: 00421643
value, xrefs: 00421CED

Memory Dump Source

Source File: 00000000.00000002.3349183063.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3349183063.000000000058A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3349183063.0000000000590000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3349183063.0000000000593000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_2zdult23rz.jbxd

Similarity

API ID: ___std_exception_destroy
String ID: array$number overflow parsing '$object$value
API String ID: 4194217158-3322379575
Opcode ID: e555e912bc3d5ea9eb6b2d2de366fb1622abbe6a57b9346b50e1f3dcaf57cb67
Instruction ID: 00768d5fc8748761bd5f16832d8c5e7407e174650216dc2cd932e62d29873a42
Opcode Fuzzy Hash: e555e912bc3d5ea9eb6b2d2de366fb1622abbe6a57b9346b50e1f3dcaf57cb67
Instruction Fuzzy Hash: 37A20770E0025CDFDB14DF64DC84BEEBBB4BF15304F5442AAE405AB252D778AA84CBA5

Uniqueness

Uniqueness Score: -1.00%

Function 004F2870 Relevance: 26.6, APIs: 14, Strings: 1, Instructions: 307COMMON

Download Yara Rule

APIs

std::_Throw_Cpp_error.LIBCPMT ref: 004F2C46
std::_Throw_Cpp_error.LIBCPMT ref: 004F2C57
CreateDirectoryA.KERNEL32(?,00000000,00000005,?), ref: 004F2C92
std::_Throw_Cpp_error.LIBCPMT ref: 004F2CAD
std::_Throw_Cpp_error.LIBCPMT ref: 004F2CBE

Strings

\*.*, xrefs: 004F291D

Memory Dump Source

Source File: 00000000.00000002.3349183063.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3349183063.000000000058A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3349183063.0000000000590000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3349183063.0000000000593000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_2zdult23rz.jbxd

Similarity

API ID: Cpp_errorThrow_std::_$CreateDirectory
String ID: \*.*
API String ID: 2715195259-1173974218
Opcode ID: 814ce260b9bfa26f523507cfed22b3522d2a7f73f82a2f2749aa20a71174747c
Instruction ID: 7da63344816831cd32a6d15c85321fef3bc67ca236fa94babc2c51aa99245672
Opcode Fuzzy Hash: 814ce260b9bfa26f523507cfed22b3522d2a7f73f82a2f2749aa20a71174747c
Instruction Fuzzy Hash: 83B15970D002089BDB24DF64CD897FEBBB5EF15314F14421AE914B7292DBB49A88CB65

Uniqueness

Uniqueness Score: -1.00%

Function 0052A080 Relevance: 21.0, Strings: 16, Instructions: 970COMMON

Download Yara Rule

Strings

UNIQUE, xrefs: 0052A9FA
INSERT INTO %Q.%s VALUES('index',%Q,%Q,#%d,%Q);, xrefs: 0052AA3F
table %s has no column named %s, xrefs: 0052A720
there is already a table named %s, xrefs: 0052A36A
sqlite_master, xrefs: 0052AA37
virtual tables may not be indexed, xrefs: 0052A285
sqlite_, xrefs: 0052A22A
sqlite_autoindex_%s_%d, xrefs: 0052A3ED
conflicting ON CONFLICT clauses specified, xrefs: 0052A85A
CREATE%s INDEX %.*s, xrefs: 0052AA0E
table %s may not be indexed, xrefs: 0052A269
index %s already exists, xrefs: 0052A3D0
name='%q', xrefs: 0052AAAC
altertab_, xrefs: 0052A24E
index, xrefs: 0052A198
%s %T cannot reference objects in database %s, xrefs: 0052A19D

Memory Dump Source

Source File: 00000000.00000002.3349183063.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3349183063.000000000058A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3349183063.0000000000590000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3349183063.0000000000593000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_2zdult23rz.jbxd

Similarity

API ID:
String ID: UNIQUE$%s %T cannot reference objects in database %s$CREATE%s INDEX %.*s$INSERT INTO %Q.%s VALUES('index',%Q,%Q,#%d,%Q);$altertab_$conflicting ON CONFLICT clauses specified$index$index %s already exists$name='%q'$sqlite_$sqlite_autoindex_%s_%d$sqlite_master$table %s has no column named %s$table %s may not be indexed$there is already a table named %s$virtual tables may not be indexed
API String ID: 0-2275377220
Opcode ID: 42eb52e28c9e75529f81b515b9a557a50d157e7ce874963da385c56fa8c2caa6
Instruction ID: e93dd321a033fea174b589206a083260ae5da8e2c1557436a8bfc2c3ffc6432b
Opcode Fuzzy Hash: 42eb52e28c9e75529f81b515b9a557a50d157e7ce874963da385c56fa8c2caa6
Instruction Fuzzy Hash: 8D82A274A002669FDB14CF68D494BAEBFB1BF46304F188569EC05AB382D735ED41CB92

Uniqueness

Uniqueness Score: -1.00%

Function 004DB380 Relevance: 19.5, APIs: 8, Strings: 3, Instructions: 287injectionmemorysynchronizationCOMMON

Download Yara Rule

APIs

VirtualAllocEx.KERNEL32(00000000,00000000,?,00003000,00000040,?,00000000), ref: 004DB3EA
WriteProcessMemory.KERNEL32(00000000,00000000,t-M,?,00000000), ref: 004DB406
WriteProcessMemory.KERNEL32(?,?,?,?,00000000), ref: 004DB43F
VirtualAllocEx.KERNEL32(?,00000000,00001000,00003000,00000040), ref: 004DB469
WriteProcessMemory.KERNEL32(?,?,?,00000218,00000000,00588C74,0000000C,?,?), ref: 004DB667
WriteProcessMemory.KERNEL32(?,?,004DB750,-00000010,00000000), ref: 004DB687
CreateRemoteThread.KERNEL32(?,00000000,00000000,?,?,00000000,00000000), ref: 004DB69A
WaitForSingleObject.KERNEL32(00000000,000000FF), ref: 004DB6A3

Strings

%s|%s, xrefs: 004DB646
t-M, xrefs: 004DB3C0, 004DB3C7, 004DB3CC, 004DB3D0, 004DB3F4, 004DB3FC, 004DB6F3, 004DB424, 004DB429, 004DB400, 004DB712
131, xrefs: 004DB62A, 004DB63A

Memory Dump Source

Source File: 00000000.00000002.3349183063.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3349183063.000000000058A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3349183063.0000000000590000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3349183063.0000000000593000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_2zdult23rz.jbxd

Similarity

API ID: MemoryProcessWrite$AllocVirtual$CreateObjectRemoteSingleThreadWait
String ID: %s|%s$131$t-M
API String ID: 2137838514-1610326920
Opcode ID: d846cd9efe794dabbe6303a7ca57bf51d6a4f60f0f1195384f94d2039c0c4ba4
Instruction ID: 6aa050c662bd13d499a16f11a1e563ae193b69cbb3db5d026509a3591e8fd703
Opcode Fuzzy Hash: d846cd9efe794dabbe6303a7ca57bf51d6a4f60f0f1195384f94d2039c0c4ba4
Instruction Fuzzy Hash: 6AC1AD719002089FDB14CFA8DC95BAEBBB5FF48300F10815AE905BB391DB74A984DFA5

Uniqueness

Uniqueness Score: -1.00%

Function 004F3910 Relevance: 15.5, APIs: 5, Strings: 3, Instructions: 1541processCOMMON

Download Yara Rule

APIs

CreateToolhelp32Snapshot.KERNEL32(00000002,00000000), ref: 004F3A30
Process32First.KERNEL32(00000000,00000128), ref: 004F3A40
Process32Next.KERNEL32(00000000,00000128), ref: 004F3A5D
Process32Next.KERNEL32(00000000,00000128), ref: 004F3D02
CloseHandle.KERNEL32(00000000), ref: 004F3D0E

Strings

exists, xrefs: 004F51A6, 004F526D
T, xrefs: 004F3B53
h<W, xrefs: 004F398E, 004F39C8, 004F5239

Memory Dump Source

Source File: 00000000.00000002.3349183063.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3349183063.000000000058A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3349183063.0000000000590000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3349183063.0000000000593000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_2zdult23rz.jbxd

Similarity

API ID: Process32$Next$CloseCreateFirstHandleSnapshotToolhelp32
String ID: exists$h<W$T
API String ID: 2284531361-4052732701
Opcode ID: 5f31ad664e5ba84cd135917ad95c6ca46942d6c56e0b6ec4c5cf96f2ceaf7ba0
Instruction ID: a55d78c1f13f08f41782f3ebf8019b16d79fea48d73a6b4249f6ffd2f4471d15
Opcode Fuzzy Hash: 5f31ad664e5ba84cd135917ad95c6ca46942d6c56e0b6ec4c5cf96f2ceaf7ba0
Instruction Fuzzy Hash: 15F26774C0026C9BDB25CF68C994BEEBBB1BF49304F1482DAD949A7341DB346A86CF54

Uniqueness

Uniqueness Score: -1.00%

Function 0042C8B1 Relevance: 15.2, APIs: 10, Instructions: 200fileCOMMON

Download Yara Rule

APIs

GetFileAttributesExW.KERNEL32(?,00000000,?,?,?,00000000), ref: 0042C949
GetLastError.KERNEL32(?,?,00000000), ref: 0042C953
FindFirstFileW.KERNEL32(?,?,?,?,00000000), ref: 0042C96A
GetLastError.KERNEL32(?,?,00000000), ref: 0042C975
FindClose.KERNEL32(00000000,?,?,00000000), ref: 0042C981
___std_fs_open_handle@16.LIBCPMT ref: 0042CA3A

Memory Dump Source

Source File: 00000000.00000002.3349183063.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3349183063.000000000058A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3349183063.0000000000590000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3349183063.0000000000593000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_2zdult23rz.jbxd

Similarity

API ID: ErrorFileFindLast$AttributesCloseFirst___std_fs_open_handle@16
String ID:
API String ID: 2340820627-0
Opcode ID: bf5c314ba0da57aee43f03cfb816f80cec1ee27c70f78e51851dbfabe2b1590b
Instruction ID: 9c96711158d71915e989b8915fd07cc0fb9d29d2e584a18587f3ea2c0814df8f
Opcode Fuzzy Hash: bf5c314ba0da57aee43f03cfb816f80cec1ee27c70f78e51851dbfabe2b1590b
Instruction Fuzzy Hash: B5719F74B006299FCB20CF28ECC9BAEB7B4BF05350F544256E855E3390DB74AA85CB95

Uniqueness

Uniqueness Score: -1.00%

Function 00516730 Relevance: 12.0, Strings: 9, Instructions: 760COMMON

Download Yara Rule

Strings

no tables specified, xrefs: 00517069
no such table: %s, xrefs: 00517059
too many columns in result set, xrefs: 005170BB
%s.%s, xrefs: 00516ECA
no such table, xrefs: 005169CD, 005169ED
%s: %s.%s, xrefs: 005169D2
, xrefs: 00516EBB
%s: %s, xrefs: 005169F2
sqlite_subquery_%p_, xrefs: 00516858

Memory Dump Source

Source File: 00000000.00000002.3349183063.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3349183063.000000000058A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3349183063.0000000000590000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3349183063.0000000000593000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_2zdult23rz.jbxd

Similarity

API ID:
String ID: $%s.%s$%s: %s$%s: %s.%s$no such table$no such table: %s$no tables specified$sqlite_subquery_%p_$too many columns in result set
API String ID: 0-1803442545
Opcode ID: c46570eeff12e201942a45b98213d1242dffe5d686e4ce8297ad7a80c2508b26
Instruction ID: dbcf86031569527fedc52a40f5d4d288d03f0ee8d1881843e8073522b91ea1c3
Opcode Fuzzy Hash: c46570eeff12e201942a45b98213d1242dffe5d686e4ce8297ad7a80c2508b26
Instruction Fuzzy Hash: DE626F746043428FE720DF28C484B9ABFE1BF88314F14896DE8999B352E775ED85CB91

Uniqueness

Uniqueness Score: -1.00%

Function 00551490 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 86windowCOMMON

Download Yara Rule

APIs

GetLastError.KERNEL32 ref: 005514A1
GetVersionExA.KERNEL32(?), ref: 005514C5
FormatMessageW.KERNEL32(00001300,00000000,00000000,00000000,?,00000000,00000000), ref: 005514F7
LocalFree.KERNEL32(?), ref: 0055150E
FormatMessageA.KERNEL32(00001300,00000000,00000000,00000000,?,00000000,00000000), ref: 00551546

Part of subcall function 00551FA0: AreFileApisANSI.KERNEL32(00000000,00000000,?,?,?,00550CE5), ref: 00551FAC
Part of subcall function 00551FA0: MultiByteToWideChar.KERNEL32(00000001,00000000,?,000000FF,00000000,00000000,?,?,?,00550CE5), ref: 00551FC1
Part of subcall function 00551FA0: MultiByteToWideChar.KERNEL32(00000001,00000000,?,000000FF,00000000,00000000), ref: 00551FE7

Strings

OsError 0x%x (%u), xrefs: 00551561

Memory Dump Source

Source File: 00000000.00000002.3349183063.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3349183063.000000000058A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3349183063.0000000000590000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3349183063.0000000000593000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_2zdult23rz.jbxd

Similarity

API ID: ByteCharFormatMessageMultiWide$ApisErrorFileFreeLastLocalVersion
String ID: OsError 0x%x (%u)
API String ID: 807219750-2664311388
Opcode ID: 1e980f5be3f40432892b78680a9e00c8c781f1225daa683e8a12723f3aed8efa
Instruction ID: 9b27ad27aa6b107916d8f15fc18c28eacd3d43973c27fd9c2debad90333f58c4
Opcode Fuzzy Hash: 1e980f5be3f40432892b78680a9e00c8c781f1225daa683e8a12723f3aed8efa
Instruction Fuzzy Hash: DB21A771F04208BBDB20AB75AC09F9E7FB9FB85752F1000A6F909E3190E7709E44CA65

Uniqueness

Uniqueness Score: -1.00%

Function 0052E510 Relevance: 10.6, Strings: 8, Instructions: 557COMMON

Download Yara Rule

Strings

database %s is already in use, xrefs: 0052E6DB
out of memory, xrefs: 0052EAB3
cannot ATTACH database within transaction, xrefs: 0052E633
too many attached databases - max %d, xrefs: 0052E61A
database is already attached, xrefs: 0052E8AE
attached databases must use the same text encoding as main database, xrefs: 0052E903
unknown error, xrefs: 0052EB99
unable to open database: %s, xrefs: 0052EA69

Memory Dump Source

Source File: 00000000.00000002.3349183063.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3349183063.000000000058A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3349183063.0000000000590000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3349183063.0000000000593000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_2zdult23rz.jbxd

Similarity

API ID:
String ID: attached databases must use the same text encoding as main database$cannot ATTACH database within transaction$database %s is already in use$database is already attached$out of memory$too many attached databases - max %d$unable to open database: %s$unknown error
API String ID: 0-3388813885
Opcode ID: 702ed6e63216880816570d34f11c1dba0bc889db466786b29044e47f033371ce
Instruction ID: c3b9d6300042f78e0bdfbefd1445517a0dd6b803bd7168242ccf3fd657f5b24e
Opcode Fuzzy Hash: 702ed6e63216880816570d34f11c1dba0bc889db466786b29044e47f033371ce
Instruction Fuzzy Hash: 282228706007529BDB20CF24E49676ABFF1FF56304F14882ED89A97382E770E985CB90

Uniqueness

Uniqueness Score: -1.00%

Function 0044F050 Relevance: 10.2, APIs: 1, Strings: 4, Instructions: 1473COMMON

Download Yara Rule

APIs

__floor_pentium4.LIBCMT ref: 0044F267

Strings

1#INF, xrefs: 0044F186
1#SNAN, xrefs: 0044F15C
1#QNAN, xrefs: 0044F163
1#IND, xrefs: 0044F155

Memory Dump Source

Source File: 00000000.00000002.3349183063.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3349183063.000000000058A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3349183063.0000000000590000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3349183063.0000000000593000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_2zdult23rz.jbxd

Similarity

API ID: __floor_pentium4
String ID: 1#IND$1#INF$1#QNAN$1#SNAN
API String ID: 4168288129-2761157908
Opcode ID: c68a482fff77e025b5f2395bd1c32dc8eaeef183412ba3e2533826b7f177a24f
Instruction ID: 19b2b9832e91dc5334225f28d461ebb5f9cd7fa0aaab348ffad5a30d2ce72a94
Opcode Fuzzy Hash: c68a482fff77e025b5f2395bd1c32dc8eaeef183412ba3e2533826b7f177a24f
Instruction Fuzzy Hash: 0FD23971E086288FDB64CE28DD447EAB7B5EB45305F1401EBD80DE7241EB78AE898F45

Uniqueness

Uniqueness Score: -1.00%

Function 005233F0 Relevance: 10.1, Strings: 7, Instructions: 1371COMMON

Download Yara Rule

Strings

table %S has %d columns but %d values were supplied, xrefs: 00523A39
table %S has no column named %s, xrefs: 00523C0F
%d values for %d columns, xrefs: 00523B03
ROWID, xrefs: 00523BC2
rows inserted, xrefs: 005245B5
OID, xrefs: 00523BD2
_ROWID_, xrefs: 00523BAD

Memory Dump Source

Source File: 00000000.00000002.3349183063.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3349183063.000000000058A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3349183063.0000000000590000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3349183063.0000000000593000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_2zdult23rz.jbxd

Similarity

API ID:
String ID: %d values for %d columns$OID$ROWID$_ROWID_$rows inserted$table %S has %d columns but %d values were supplied$table %S has no column named %s
API String ID: 0-557196483
Opcode ID: f76b86c6181df38b935f5e198d6386c28489abdb5433cebf390b30408947ea8e
Instruction ID: e16d57ff769c01e613f081803d3a99e8b2fa06a3413bbdfdeb6f383a167cc5c4
Opcode Fuzzy Hash: f76b86c6181df38b935f5e198d6386c28489abdb5433cebf390b30408947ea8e
Instruction Fuzzy Hash: 84D269706047528FD724DF28D444B2ABBE1FF86304F15895DE88A8B392E779E945CF82

Uniqueness

Uniqueness Score: -1.00%

Function 004D1380 Relevance: 9.7, APIs: 3, Strings: 2, Instructions: 921fileCOMMON

Download Yara Rule

APIs

std::_Throw_Cpp_error.LIBCPMT ref: 004D1837
std::_Throw_Cpp_error.LIBCPMT ref: 004D1848
DeleteFileA.KERNEL32(?), ref: 004D1911

Strings

futer, xrefs: 004D1997, 004D19B0
131, xrefs: 004D195B, 004D1974

Memory Dump Source

Source File: 00000000.00000002.3349183063.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3349183063.000000000058A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3349183063.0000000000590000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3349183063.0000000000593000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_2zdult23rz.jbxd

Similarity

API ID: Cpp_errorThrow_std::_$DeleteFile
String ID: 131$futer
API String ID: 801707934-4190298202
Opcode ID: 3351b610fb7c0e38ca72391ab1cac65f232bbd6e17476fb8fd2e1fc74a3e9932
Instruction ID: ed3f0cb8ca549558cf38e877f09047e3770604ffa05b733eb3555e5ea153d0bb
Opcode Fuzzy Hash: 3351b610fb7c0e38ca72391ab1cac65f232bbd6e17476fb8fd2e1fc74a3e9932
Instruction Fuzzy Hash: BF82D5B0D00204DFCB14DF68D895BAEBBB1FF49314F14425EE845AB392D738AA45CB95

Uniqueness

Uniqueness Score: -1.00%

Function 0044DB84 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 85COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLocaleInfoW.KERNEL32(00000000,2000000B,0044DE96,00000002,00000000,?,?,?,0044DE96,?,00000000), ref: 0044DC1D
GetLocaleInfoW.KERNEL32(00000000,20001004,0044DE96,00000002,00000000,?,?,?,0044DE96,?,00000000), ref: 0044DC46
GetACP.KERNEL32(?,?,0044DE96,?,00000000), ref: 0044DC5B

Strings

ACP, xrefs: 0044DBA2
OCP, xrefs: 0044DBD8

Memory Dump Source

Source File: 00000000.00000002.3349183063.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3349183063.000000000058A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3349183063.0000000000590000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3349183063.0000000000593000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_2zdult23rz.jbxd

Similarity

API ID: InfoLocale
String ID: ACP$OCP
API String ID: 2299586839-711371036
Opcode ID: 0db92f83539562add904e7f00848d79ebd1a0197efef5317cf0568fffe86725e
Instruction ID: 1394b0987a4baadc561295707693a2f226613c8b6a9ba9225a5c5d7c31b213ab
Opcode Fuzzy Hash: 0db92f83539562add904e7f00848d79ebd1a0197efef5317cf0568fffe86725e
Instruction Fuzzy Hash: 3E21C232E00104A6FB349F64CD84B9773A6EF54F50B568466E90ADB310EB76ED41D398

Uniqueness

Uniqueness Score: -1.00%

Function 005209F0 Relevance: 8.8, Strings: 6, Instructions: 1305COMMON

Download Yara Rule

Strings

WITHOUT ROWID, xrefs: 00520A2C, 00520A51, 00520A54
library routine called out of sequence, xrefs: 0052191B, 0052196F
d, xrefs: 00520D79
out of memory, xrefs: 00521990, 00521A00
WITHOUT ROWID, xrefs: 00520A83, 00520AA7
unknown error, xrefs: 005219C4, 00521A34

Memory Dump Source

Source File: 00000000.00000002.3349183063.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3349183063.000000000058A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3349183063.0000000000590000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3349183063.0000000000593000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_2zdult23rz.jbxd

Similarity

API ID:
String ID: WITHOUT ROWID$WITHOUT ROWID$d$library routine called out of sequence$out of memory$unknown error
API String ID: 0-1049893272
Opcode ID: 0fb34dae45e55d200879d9be982dc038cf41f4de84004c7c6be17aa8078a4593
Instruction ID: 497802968e842dde83b933efc766fcc9b30b40c45d497888dbf4db774b5c934f
Opcode Fuzzy Hash: 0fb34dae45e55d200879d9be982dc038cf41f4de84004c7c6be17aa8078a4593
Instruction Fuzzy Hash: 5CB2CF70605B52DFC728CF28E494A6BBBF1BF96304F14492DE88A97391D731E845CB86

Uniqueness

Uniqueness Score: -1.00%

Function 004FF450 Relevance: 8.2, Strings: 6, Instructions: 735COMMON

Download Yara Rule

Strings

incorrect header check, xrefs: 004FF6AD
unknown compression method, xrefs: 004FF61A
unknown compression method, xrefs: 004FF6F5
header crc mismatch, xrefs: 004FFBBB
invalid window size, xrefs: 004FF69E
unknown header flags set, xrefs: 004FF70C

Memory Dump Source

Source File: 00000000.00000002.3349183063.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3349183063.000000000058A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3349183063.0000000000590000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3349183063.0000000000593000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_2zdult23rz.jbxd

Similarity

API ID:
String ID: header crc mismatch$incorrect header check$invalid window size$unknown compression method$unknown compression method$unknown header flags set
API String ID: 0-3686625691
Opcode ID: 4c2f9d5c2bdd7808168994c88f556638d8f90cd17022183335ab7c82b5a3c369
Instruction ID: 3f80238d5f8a72e0ad2ebb0af3e3e782f679acaebd88050fb0d0b61cde383b65
Opcode Fuzzy Hash: 4c2f9d5c2bdd7808168994c88f556638d8f90cd17022183335ab7c82b5a3c369
Instruction Fuzzy Hash: 23626CB1E002499FDB14CF59C5847AEBBF1BF48308F2481AED904AB392C779D946CB94

Uniqueness

Uniqueness Score: -1.00%

Function 00551220 Relevance: 7.7, APIs: 5, Instructions: 208fileCOMMON

Download Yara Rule

APIs

GetVersionExA.KERNEL32(?), ref: 005512E3
CreateFileW.KERNEL32(00000000,C0000000,00000003,00000000,7FFFFFFD,00000000,00000000), ref: 00551313
CreateFileA.KERNEL32(00000000,C0000000,00000003,00000000,7FFFFFFD,00000000,00000000), ref: 0055131B

Memory Dump Source

Source File: 00000000.00000002.3349183063.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3349183063.000000000058A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3349183063.0000000000590000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3349183063.0000000000593000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_2zdult23rz.jbxd

Similarity

API ID: CreateFile$Version
String ID:
API String ID: 1715692615-0
Opcode ID: a50e396471c21bd5292f2ea255f87583e8432b1e27d6808c766b3da514bf39bc
Instruction ID: b4edcec529d807a06da9efb1c5396e9c71554b609393fe2db9d6cd66cb1a39d6
Opcode Fuzzy Hash: a50e396471c21bd5292f2ea255f87583e8432b1e27d6808c766b3da514bf39bc
Instruction Fuzzy Hash: C561CC71604702ABDB10DF29D854BABBFE4FF84315F04492AFC99D6280EB35D9098B96

Uniqueness

Uniqueness Score: -1.00%

Function 0044DD60 Relevance: 7.7, APIs: 5, Instructions: 182COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 004446D2: GetLastError.KERNEL32(00000000,?,0044A0B9), ref: 004446D6
Part of subcall function 004446D2: SetLastError.KERNEL32(00000000,00000000,?,00000008,000000FF), ref: 00444778

GetUserDefaultLCID.KERNEL32(?,?,?,00000055,?), ref: 0044DE68
IsValidCodePage.KERNEL32(00000000), ref: 0044DEA6
IsValidLocale.KERNEL32(?,00000001), ref: 0044DEB9
GetLocaleInfoW.KERNEL32(?,00001001,-00000050,00000040,?,000000D0,00000055,00000000,?,?,00000055,00000000), ref: 0044DF01
GetLocaleInfoW.KERNEL32(?,00001002,00000030,00000040), ref: 0044DF1C

Memory Dump Source

Source File: 00000000.00000002.3349183063.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3349183063.000000000058A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3349183063.0000000000590000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3349183063.0000000000593000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_2zdult23rz.jbxd

Similarity

API ID: Locale$ErrorInfoLastValid$CodeDefaultPageUser
String ID:
API String ID: 415426439-0
Opcode ID: c0c8c2d6262a040be15751399d3cf2aa6162f753bba806c1ef4a1672a4700e44
Instruction ID: 721269df72700bf9050ff1f907747f54117a3986f916008cc6d55a86c54b6450
Opcode Fuzzy Hash: c0c8c2d6262a040be15751399d3cf2aa6162f753bba806c1ef4a1672a4700e44
Instruction Fuzzy Hash: 12518071E00605ABFF10DFA5CC41ABB77B8EF18704F15446BE901EB290EB789904CB65

Uniqueness

Uniqueness Score: -1.00%

Function 00513320 Relevance: 7.4, Strings: 5, Instructions: 1164COMMON

Download Yara Rule

Strings

ROWID, xrefs: 00513608
rows updated, xrefs: 00514245
OID, xrefs: 00513618
no such column: %s, xrefs: 00513697
_ROWID_, xrefs: 005135F4

Memory Dump Source

Source File: 00000000.00000002.3349183063.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3349183063.000000000058A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3349183063.0000000000590000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3349183063.0000000000593000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_2zdult23rz.jbxd

Similarity

API ID:
String ID: OID$ROWID$_ROWID_$no such column: %s$rows updated
API String ID: 0-3385237395
Opcode ID: 2111e1e3017d67c2f7bbf8387bf79ca03383a41b87454351c0d0f7efb7efb2f7
Instruction ID: 54983cf935286fed85f1d38aca188a08520a17ed0d3d8c2e75c97e0ee3f6277e
Opcode Fuzzy Hash: 2111e1e3017d67c2f7bbf8387bf79ca03383a41b87454351c0d0f7efb7efb2f7
Instruction Fuzzy Hash: B6C278706047428FE724DF18C0A4B6ABBF1FF88304F16895DE9968B352D775E985CB82

Uniqueness

Uniqueness Score: -1.00%

Function 0044D3EB Relevance: 7.3, APIs: 3, Strings: 1, Instructions: 254COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 004446D2: GetLastError.KERNEL32(00000000,?,0044A0B9), ref: 004446D6
Part of subcall function 004446D2: SetLastError.KERNEL32(00000000,00000000,?,00000008,000000FF), ref: 00444778

GetACP.KERNEL32(?,?,?,?,?,?,00441B90,?,?,?,00000055,?,-00000050,?,?,00000004), ref: 0044D4AA
IsValidCodePage.KERNEL32(00000000,?,?,?,?,?,?,00441B90,?,?,?,00000055,?,-00000050,?,?), ref: 0044D4E1
GetLocaleInfoW.KERNEL32(00000000,?,?,00000078,-00000050,00000000,000000D0), ref: 0044D644

Strings

utf8, xrefs: 0044D5B3

Memory Dump Source

Source File: 00000000.00000002.3349183063.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3349183063.000000000058A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3349183063.0000000000590000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3349183063.0000000000593000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_2zdult23rz.jbxd

Similarity

API ID: ErrorLast$CodeInfoLocalePageValid
String ID: utf8
API String ID: 607553120-905460609
Opcode ID: c45a0186f4581b71202d969cc458f697c66e26bf91fa0bd1cdd2ae7615315ff2
Instruction ID: 2cfea991c2b2acc9964e98fc6b5fb71baa63820d9a3b6a37bb74a83d3ed0bc3b
Opcode Fuzzy Hash: c45a0186f4581b71202d969cc458f697c66e26bf91fa0bd1cdd2ae7615315ff2
Instruction Fuzzy Hash: F771D671A00605AAFB24AB75CC86BBB73A8EF05748F14442BF905D7281EF7CE944C769

Uniqueness

Uniqueness Score: -1.00%

Function 0050D010 Relevance: 6.1, Strings: 4, Instructions: 1130COMMON

Download Yara Rule

Strings

Q, xrefs: 0050D7B7
H, xrefs: 0050D7BE
.,+-, xrefs: 0050D490
@, xrefs: 0050D076

Memory Dump Source

Source File: 00000000.00000002.3349183063.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3349183063.000000000058A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3349183063.0000000000590000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3349183063.0000000000593000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_2zdult23rz.jbxd

Similarity

API ID:
String ID: .,+-$@$H$Q
API String ID: 0-2755557186
Opcode ID: c897259b73a0517bb5c1bfbb884ad928e7401f702e3503b2968597b33c7ccf55
Instruction ID: 7287085181065342c0cf32ad8819db337b2f58c8c442f7811d5b28c015796729
Opcode Fuzzy Hash: c897259b73a0517bb5c1bfbb884ad928e7401f702e3503b2968597b33c7ccf55
Instruction Fuzzy Hash: B5B27C74E002099FDF14DF98C890BAEBBB2FF88304F148159E845AB396D735AD55CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 0042EA14 Relevance: 6.1, APIs: 4, Instructions: 70COMMON

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32(00000017,?), ref: 0042EA20
IsDebuggerPresent.KERNEL32 ref: 0042EAEC
SetUnhandledExceptionFilter.KERNEL32(00000000), ref: 0042EB05
UnhandledExceptionFilter.KERNEL32(?), ref: 0042EB0F

Memory Dump Source

Source File: 00000000.00000002.3349183063.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3349183063.000000000058A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3349183063.0000000000590000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3349183063.0000000000593000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_2zdult23rz.jbxd

Similarity

API ID: ExceptionFilterPresentUnhandled$DebuggerFeatureProcessor
String ID:
API String ID: 254469556-0
Opcode ID: 42954efdac53cf3c2a2cf13cc16ca68fea820c5f8c06520c72d11b2371d29965
Instruction ID: 1249aa533244df727fa709a41629287d637b7995ae69670e2272991b28a3673f
Opcode Fuzzy Hash: 42954efdac53cf3c2a2cf13cc16ca68fea820c5f8c06520c72d11b2371d29965
Instruction Fuzzy Hash: C331F775D052289BDB20EFA5D9497CDBBB8BF08304F1041EAE40DAB250EB759B84CF45

Uniqueness

Uniqueness Score: -1.00%

Function 00550DF0 Relevance: 6.1, APIs: 4, Instructions: 55timeCOMMON

Download Yara Rule

APIs

GetSystemTime.KERNEL32(?), ref: 00550E0A
GetCurrentProcessId.KERNEL32 ref: 00550E25
GetTickCount.KERNEL32 ref: 00550E3A
QueryPerformanceCounter.KERNEL32(?), ref: 00550E51

Memory Dump Source

Source File: 00000000.00000002.3349183063.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3349183063.000000000058A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3349183063.0000000000590000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3349183063.0000000000593000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_2zdult23rz.jbxd

Similarity

API ID: CountCounterCurrentPerformanceProcessQuerySystemTickTime
String ID:
API String ID: 4122616988-0
Opcode ID: 2ac2ec12dac1c0ddfdd78ada81de9e9e7eb84829c7919e5107d900e7ee8de75e
Instruction ID: 0ad404b685b9be94c967810f0ec58d8e8c259cc4ebc635e655cd524cbb144e7b
Opcode Fuzzy Hash: 2ac2ec12dac1c0ddfdd78ada81de9e9e7eb84829c7919e5107d900e7ee8de75e
Instruction Fuzzy Hash: 81110432A006288BDB118FACEC884EEFBE8FF49321B404976ED49D7251DA70E484C790

Uniqueness

Uniqueness Score: -1.00%

Function 004D3280 Relevance: 5.9, Strings: 4, Instructions: 927COMMON

Download Yara Rule

Strings

Content-Type: application/x-www-form-urlencoded, xrefs: 004D3E29
Content-Type: application/x-www-form-urlencoded, xrefs: 004D33A7
149.18.24.96, xrefs: 004D7B62, 004D7C21
149.18.24.96, xrefs: 004D4761

Memory Dump Source

Source File: 00000000.00000002.3349183063.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3349183063.000000000058A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3349183063.0000000000590000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3349183063.0000000000593000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_2zdult23rz.jbxd

Similarity

API ID:
String ID: 149.18.24.96$149.18.24.96$Content-Type: application/x-www-form-urlencoded$Content-Type: application/x-www-form-urlencoded
API String ID: 0-731838243
Opcode ID: b0432dc79cd047b5696158ff9bd72d7dbe8a2134232c52a5f0752b22be155275
Instruction ID: 33a632d0a306c15a1de1fb4794a992465f2ff5513e11846780c43e6219a31879
Opcode Fuzzy Hash: b0432dc79cd047b5696158ff9bd72d7dbe8a2134232c52a5f0752b22be155275
Instruction Fuzzy Hash: BCB201B4D042589BCB25DFA8D991BECBBB1BF48314F14819AE84977341DB342E84CF69

Uniqueness

Uniqueness Score: -1.00%

Function 005145A0 Relevance: 5.4, Strings: 3, Instructions: 1619COMMON

Download Yara Rule

Strings

min, xrefs: 00515A4D
too many terms in compound SELECT, xrefs: 00514826
max, xrefs: 00515A6C

Memory Dump Source

Source File: 00000000.00000002.3349183063.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3349183063.000000000058A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3349183063.0000000000590000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3349183063.0000000000593000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_2zdult23rz.jbxd

Similarity

API ID:
String ID: max$min$too many terms in compound SELECT
API String ID: 0-238764930
Opcode ID: 205a107d1f05d0722c780a0591bc6b168285149ab388ede348cf7e081aed1c1a
Instruction ID: 21d4b731694caece0f62baeaebb39f7c46cc54ca136487e19f75387d70021220
Opcode Fuzzy Hash: 205a107d1f05d0722c780a0591bc6b168285149ab388ede348cf7e081aed1c1a
Instruction Fuzzy Hash: 97F23670604741CFE724DF28C494B6ABBE1BFC8344F15896DE9858B352EB75E885CB82

Uniqueness

Uniqueness Score: -1.00%

Function 00452968 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 49COMMONLIBRARYCODE

Download Yara Rule

APIs

VirtualQuery.KERNEL32(?,?,0000001C), ref: 00452979
GetSystemInfo.KERNEL32(?), ref: 00452994

Strings

D, xrefs: 00452988

Memory Dump Source

Source File: 00000000.00000002.3349183063.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3349183063.000000000058A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3349183063.0000000000590000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3349183063.0000000000593000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_2zdult23rz.jbxd

Similarity

API ID: InfoQuerySystemVirtual
String ID: D
API String ID: 401686933-2746444292
Opcode ID: e74ab065f0439bd4aea146d8791e2cb0e9397abd09d2c9666de48529700fe63d
Instruction ID: 5c20be6a1f0816990224c99f6728689887d7ae44d02cb0a50e4543e85df9bff5
Opcode Fuzzy Hash: e74ab065f0439bd4aea146d8791e2cb0e9397abd09d2c9666de48529700fe63d
Instruction Fuzzy Hash: 5401F7B37001096BDB14DE29DC05BDE7BAAAFD5325F0CC226ED19D7341DA78D905CA90

Uniqueness

Uniqueness Score: -1.00%

Function 0042C623 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 32windowCOMMON

Download Yara Rule

APIs

GetLocaleInfoEx.KERNEL32(!x-sys-default-locale,20000001,?,00000002,?,?,00403F3F,?,?,?,?,?,?,0055847D,000000FF), ref: 0042C637
FormatMessageA.KERNEL32(00001300,00000000,?,?,00000000,00000000,00000000,?,?,?,00403F3F,?,?), ref: 0042C65E

Strings

!x-sys-default-locale, xrefs: 0042C632

Memory Dump Source

Source File: 00000000.00000002.3349183063.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3349183063.000000000058A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3349183063.0000000000590000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3349183063.0000000000593000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_2zdult23rz.jbxd

Similarity

API ID: FormatInfoLocaleMessage
String ID: !x-sys-default-locale
API String ID: 4235545615-2729719199
Opcode ID: 6f5429a6348d8f1c07becab912b970258c68df31968fb96a1b0a6208db707351
Instruction ID: 5b6063aa3af019313e454f52bbb2b892fc0fc7ce3dc01ef7e9449aa7aef8ef01
Opcode Fuzzy Hash: 6f5429a6348d8f1c07becab912b970258c68df31968fb96a1b0a6208db707351
Instruction Fuzzy Hash: F7F03075614114FFEB189B98DC4ADAF7AACEB19394F404119F602D7150E6F1AE009760

Uniqueness

Uniqueness Score: -1.00%

Function 0044D808 Relevance: 4.7, APIs: 3, Instructions: 205COMMON

Download Yara Rule

APIs

Part of subcall function 004446D2: GetLastError.KERNEL32(00000000,?,0044A0B9), ref: 004446D6
Part of subcall function 004446D2: SetLastError.KERNEL32(00000000,00000000,?,00000008,000000FF), ref: 00444778

GetLocaleInfoW.KERNEL32(00000000,?,?,00000078), ref: 0044D85C
GetLocaleInfoW.KERNEL32(00000000,?,?,00000078), ref: 0044D8A6
GetLocaleInfoW.KERNEL32(00000000,?,?,00000078), ref: 0044D96C

Memory Dump Source

Source File: 00000000.00000002.3349183063.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3349183063.000000000058A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3349183063.0000000000590000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3349183063.0000000000593000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_2zdult23rz.jbxd

Similarity

API ID: InfoLocale$ErrorLast
String ID:
API String ID: 661929714-0
Opcode ID: 5db40f0beb62554498c78fa207cbcb21fed7a2ab908d42d80f8629cdf2fd32a1
Instruction ID: a7ef0e2b3e67b6f440219475ae74fe998f4269ac0d9ab468b59062505fc3cc5d
Opcode Fuzzy Hash: 5db40f0beb62554498c78fa207cbcb21fed7a2ab908d42d80f8629cdf2fd32a1
Instruction Fuzzy Hash: BB61A1B19001079FFB28DF29CC86BBBB3A9EF04304F10416BE905D6685EB78D991CB58

Uniqueness

Uniqueness Score: -1.00%

Function 004D1240 Relevance: 4.6, APIs: 3, Instructions: 116encryptionCOMMON

Download Yara Rule

APIs

CryptUnprotectData.CRYPT32(?,00000000,00000000,00000000,00000000,00000000,?), ref: 004D1275
LocalFree.KERNEL32(?), ref: 004D12A4
LocalFree.KERNEL32(?,?), ref: 004D1365

Memory Dump Source

Source File: 00000000.00000002.3349183063.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3349183063.000000000058A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3349183063.0000000000590000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3349183063.0000000000593000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_2zdult23rz.jbxd

Similarity

API ID: FreeLocal$CryptDataUnprotect
String ID:
API String ID: 2835072361-0
Opcode ID: faf5e702467f3a29d371903c32aaca82da333eb71e39eb5694a67d102b66e2d3
Instruction ID: edacca0892e7d6bf58cfe28d189f09218ecc2b188b76278acbc21aeb1f3e2cb0
Opcode Fuzzy Hash: faf5e702467f3a29d371903c32aaca82da333eb71e39eb5694a67d102b66e2d3
Instruction Fuzzy Hash: DD312631D001086BEB00ABA9DC857FEB779EF59314F00817BEC18B7351EB3959858BA5

Uniqueness

Uniqueness Score: -1.00%

Function 004332F4 Relevance: 4.6, APIs: 3, Instructions: 77COMMONLIBRARYCODE

Download Yara Rule

APIs

IsDebuggerPresent.KERNEL32(?,?,?,?,?,?), ref: 004333EC
SetUnhandledExceptionFilter.KERNEL32(00000000,?,?,?,?,?,?), ref: 004333F6
UnhandledExceptionFilter.KERNEL32(?,?,?,?,?,?,?), ref: 00433403

Memory Dump Source

Source File: 00000000.00000002.3349183063.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3349183063.000000000058A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3349183063.0000000000590000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3349183063.0000000000593000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_2zdult23rz.jbxd

Similarity

API ID: ExceptionFilterUnhandled$DebuggerPresent
String ID:
API String ID: 3906539128-0
Opcode ID: 9f1139638b3df056369de36d10a25bd443a0870b0bf33701996310552448855e
Instruction ID: 827401fa7b85709c6d67aee7b5506a22afc2dd98f9d62e6690368e1bc4fb37e0
Opcode Fuzzy Hash: 9f1139638b3df056369de36d10a25bd443a0870b0bf33701996310552448855e
Instruction Fuzzy Hash: 5731C2749012289BCB21DF69D9897CDBBB8BF18314F5051EAE41CA7250EB749F858F48

Uniqueness

Uniqueness Score: -1.00%

Function 0050C410 Relevance: 4.6, Strings: 3, Instructions: 827COMMON

Download Yara Rule

Strings

cannot use index: %s, xrefs: 0050CBC2
@, xrefs: 0050CA8B
at most %d tables in a join, xrefs: 0050C438

Memory Dump Source

Source File: 00000000.00000002.3349183063.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3349183063.000000000058A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3349183063.0000000000590000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3349183063.0000000000593000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_2zdult23rz.jbxd

Similarity

API ID:
String ID: @$at most %d tables in a join$cannot use index: %s
API String ID: 0-1661248
Opcode ID: 96278dc3c2256f420819860643cefb534853969c864d33d1d4ee65e6d1989b47
Instruction ID: 1e85c1d1c864a2752028fd896f2660f9a60132eac6b45b977aee6aafcb7e98c9
Opcode Fuzzy Hash: 96278dc3c2256f420819860643cefb534853969c864d33d1d4ee65e6d1989b47
Instruction Fuzzy Hash: 3B724875A087418FD724CF28C440A2ABFE2FFCA314F158A5DE8999B391D771E945CB82

Uniqueness

Uniqueness Score: -1.00%

Function 00551070 Relevance: 4.6, APIs: 3, Instructions: 71COMMON

Download Yara Rule

APIs

Part of subcall function 00551780: GetVersionExA.KERNEL32(?), ref: 005517A6

GetVersionExA.KERNEL32(?), ref: 005510AE
GetFileAttributesW.KERNEL32(00000000), ref: 005510CD

Memory Dump Source

Source File: 00000000.00000002.3349183063.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3349183063.000000000058A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3349183063.0000000000590000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3349183063.0000000000593000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_2zdult23rz.jbxd

Similarity

API ID: Version$AttributesFile
String ID:
API String ID: 1468075466-0
Opcode ID: 97c2f0af1e1d7325e694b2aa72ffb2bf89a0a7e1763b9606cc2be0516b8671bd
Instruction ID: 1b6ae3cb7f5bf0e907ef9fa77f2bed44bd693e69e760e1f883d9a1ea48be3fa6
Opcode Fuzzy Hash: 97c2f0af1e1d7325e694b2aa72ffb2bf89a0a7e1763b9606cc2be0516b8671bd
Instruction Fuzzy Hash: 9A112736A006148BC720DF7DE988BAA7FE9FB59325F0001A7ED08D3250DA30DD48CBA5

Uniqueness

Uniqueness Score: -1.00%

Function 0042C82B Relevance: 4.5, APIs: 3, Instructions: 35COMMON

Download Yara Rule

APIs

FindClose.KERNEL32(000000FF,?,004209DA,?), ref: 0042C837
FindFirstFileExW.KERNEL32(000000FF,00000001,?,00000000,00000000,00000000,?,?,?,004209DA,?), ref: 0042C866
GetLastError.KERNEL32(?,004209DA,?), ref: 0042C878

Memory Dump Source

Source File: 00000000.00000002.3349183063.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3349183063.000000000058A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3349183063.0000000000590000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3349183063.0000000000593000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_2zdult23rz.jbxd

Similarity

API ID: Find$CloseErrorFileFirstLast
String ID:
API String ID: 4020440971-0
Opcode ID: 86c14a02093f16810e4dd88f91deff2d5f86e2f0abe4bed8fc1f86c1b24be754
Instruction ID: 8a27f9886f01e289c274a129579c59828a859e60d8a88321f661c1881ad45666
Opcode Fuzzy Hash: 86c14a02093f16810e4dd88f91deff2d5f86e2f0abe4bed8fc1f86c1b24be754
Instruction Fuzzy Hash: B4F0B431100518BFDB103F79EC488BE3B9CEF14371B508626F969D11B1D7718965D664

Uniqueness

Uniqueness Score: -1.00%

Function 004FECA0 Relevance: 4.2, Strings: 3, Instructions: 430COMMON

Download Yara Rule

Strings

invalid distance too far back, xrefs: 004FF11D
invalid distance code, xrefs: 004FF104
invalid literal/length code, xrefs: 004FF0E5

Memory Dump Source

Source File: 00000000.00000002.3349183063.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3349183063.000000000058A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3349183063.0000000000590000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3349183063.0000000000593000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_2zdult23rz.jbxd

Similarity

API ID:
String ID: invalid distance code$invalid distance too far back$invalid literal/length code
API String ID: 0-3255898291
Opcode ID: a56b6f9168196dd5cbb45870d9149c3749346c5705395b0878eb4e917256bc04
Instruction ID: 8d2d3c4523878f4030503be7c435480a9b53d15c3056f5b6c5059bdf7dfacae5
Opcode Fuzzy Hash: a56b6f9168196dd5cbb45870d9149c3749346c5705395b0878eb4e917256bc04
Instruction Fuzzy Hash: 49F19231E002599FCB04CF69C5905BDBBF2FF99301B2481AED595EB342D739AA06CB64

Uniqueness

Uniqueness Score: -1.00%

Function 0054B990 Relevance: 3.5, APIs: 2, Instructions: 484COMMON

Download Yara Rule

APIs

__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 0054BB45
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 0054BE47

Memory Dump Source

Source File: 00000000.00000002.3349183063.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3349183063.000000000058A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3349183063.0000000000590000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3349183063.0000000000593000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_2zdult23rz.jbxd

Similarity

API ID: Unothrow_t@std@@@__ehfuncinfo$??2@
String ID:
API String ID: 885266447-0
Opcode ID: 8619c628930c15e3f64ee4185456f4c73d0beadc8a2f11204caef400f59f07bd
Instruction ID: a8910782226fa043b0ca02c89601bdb6306c66060be7ccd375e3029c486516c8
Opcode Fuzzy Hash: 8619c628930c15e3f64ee4185456f4c73d0beadc8a2f11204caef400f59f07bd
Instruction Fuzzy Hash: 0402A470604602AFEB14CF29C850BEABBE4FF88318F04866DE959C7650D774ED65CB92

Uniqueness

Uniqueness Score: -1.00%

Function 00553170 Relevance: 3.5, APIs: 2, Instructions: 465COMMON

Download Yara Rule

APIs

__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 00553513
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 00553571

Memory Dump Source

Source File: 00000000.00000002.3349183063.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3349183063.000000000058A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3349183063.0000000000590000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3349183063.0000000000593000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_2zdult23rz.jbxd

Similarity

API ID: Unothrow_t@std@@@__ehfuncinfo$??2@
String ID:
API String ID: 885266447-0
Opcode ID: d6ef0b778412603ae4375fe8f4b2b868cc24e55a123d3fdd18dfd41b4726deb8
Instruction ID: 3fbf31a8c3cdee1091fcfc22b4047fc9f3449861c1a85ea422063c13361c5e55
Opcode Fuzzy Hash: d6ef0b778412603ae4375fe8f4b2b868cc24e55a123d3fdd18dfd41b4726deb8
Instruction Fuzzy Hash: 7802F571E006598BCF19CF6DD8A42BDFFB1BF85351F1982ABE859AB281DB704A44C740

Uniqueness

Uniqueness Score: -1.00%

Function 004371F0 Relevance: 3.5, APIs: 2, Instructions: 455COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3349183063.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3349183063.000000000058A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3349183063.0000000000590000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3349183063.0000000000593000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_2zdult23rz.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8699a35763ac44eb22cce45b8889ca4ebfbbd05a2f808e76f48b50c83f6b4931
Instruction ID: 7de7f519c8b512efe808fbc5ffa62cc3ef6a6e83b70a7c434dda002dc4e381e9
Opcode Fuzzy Hash: 8699a35763ac44eb22cce45b8889ca4ebfbbd05a2f808e76f48b50c83f6b4931
Instruction Fuzzy Hash: 47026FB1E042199BDF24CFA9C9806AEFBF1FF48324F24826AD955E7341D735A901CB94

Uniqueness

Uniqueness Score: -1.00%

Function 004FA050 Relevance: 3.2, APIs: 2, Instructions: 220networkCOMMON

Download Yara Rule

APIs

InternetCloseHandle.WININET(?), ref: 004FA262
InternetCloseHandle.WININET(?), ref: 004FA271

Memory Dump Source

Source File: 00000000.00000002.3349183063.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3349183063.000000000058A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3349183063.0000000000590000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3349183063.0000000000593000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_2zdult23rz.jbxd

Similarity

API ID: CloseHandleInternet
String ID:
API String ID: 1081599783-0
Opcode ID: 80956989b8c3acaa30689384fa85edbe78acf62e72dad3c00cb1da54d72189f2
Instruction ID: f9047d7434dced4cf20933e84560d58d69618fbb45727c1a51f3fb53e9aaca21
Opcode Fuzzy Hash: 80956989b8c3acaa30689384fa85edbe78acf62e72dad3c00cb1da54d72189f2
Instruction Fuzzy Hash: 1B814DB5E042099BDF18CF99DD81ABEBBB5FF88310F14812AE905B7340DB359911CBA5

Uniqueness

Uniqueness Score: -1.00%

Function 0043C1FB Relevance: 3.0, APIs: 2, Instructions: 44timeCOMMON

Download Yara Rule

APIs

GetSystemTimeAsFileTime.KERNEL32(?), ref: 0043C210
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 0043C22F

Memory Dump Source

Source File: 00000000.00000002.3349183063.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3349183063.000000000058A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3349183063.0000000000590000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3349183063.0000000000593000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_2zdult23rz.jbxd

Similarity

API ID: Time$FileSystemUnothrow_t@std@@@__ehfuncinfo$??2@
String ID:
API String ID: 1518329722-0
Opcode ID: 954a7c4d5890fab9a4c96a24ff15e7c185c2cda78a089061de3c48e681f8a955
Instruction ID: ec6cd9ee3c427c05d13ca8e13f4ecd96f164f970f8f353a80a24a946ea283c5e
Opcode Fuzzy Hash: 954a7c4d5890fab9a4c96a24ff15e7c185c2cda78a089061de3c48e681f8a955
Instruction Fuzzy Hash: 9CF0F4B1E00214BB8724CFADC88499FBEEAEAC9370B35429AF809E3340E574DD01C794

Uniqueness

Uniqueness Score: -1.00%

Function 004536D0 Relevance: 3.0, Strings: 2, Instructions: 459COMMON

Download Yara Rule

Strings

+, xrefs: 00453BF3
/, xrefs: 00453BF8

Memory Dump Source

Source File: 00000000.00000002.3349183063.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3349183063.000000000058A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3349183063.0000000000590000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3349183063.0000000000593000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_2zdult23rz.jbxd

Similarity

API ID:
String ID: +$/
API String ID: 0-2439032044
Opcode ID: ab50ada89258f2e9534fe265f384ea8fb20dd5c5a6c5db8d80d47731f75520c3
Instruction ID: 796a871646bd2685f763a536c5d2eb57fa7702993fd3fc0b8e0a162fd2415c14
Opcode Fuzzy Hash: ab50ada89258f2e9534fe265f384ea8fb20dd5c5a6c5db8d80d47731f75520c3
Instruction Fuzzy Hash: 43F13471E001459FCB05CF68C4906EEBFF5FF49352F24426AE865A7382D7389A48CBA4

Uniqueness

Uniqueness Score: -1.00%

Function 0050F620 Relevance: 2.1, Strings: 1, Instructions: 858COMMON

Download Yara Rule

Strings

match, xrefs: 0050FF38

Memory Dump Source

Source File: 00000000.00000002.3349183063.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3349183063.000000000058A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3349183063.0000000000590000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3349183063.0000000000593000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_2zdult23rz.jbxd

Similarity

API ID:
String ID: match
API String ID: 0-2052834565
Opcode ID: 95e3a01fd2e5a19cfcceef5ee12e30068266fc5679921be7572f4702c3f8890c
Instruction ID: d3a6c69669175a2caa2aa64f558d39f9d5895a4d07a01edede38e67d12c62577
Opcode Fuzzy Hash: 95e3a01fd2e5a19cfcceef5ee12e30068266fc5679921be7572f4702c3f8890c
Instruction Fuzzy Hash: E272A3746047418FD724DF24C485B6BBFE1BF88304F148A6DE88A8B792D775E885CB92

Uniqueness

Uniqueness Score: -1.00%

Function 00541180 Relevance: 2.0, Strings: 1, Instructions: 710COMMON

Download Yara Rule

Strings

%s-mj%08X, xrefs: 005413D8

Memory Dump Source

Source File: 00000000.00000002.3349183063.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3349183063.000000000058A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3349183063.0000000000590000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3349183063.0000000000593000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_2zdult23rz.jbxd

Similarity

API ID:
String ID: %s-mj%08X
API String ID: 0-77246884
Opcode ID: c36b806efd238cb85f734633c2ea761f11f9bbe70b06756de1a34c4df3bb4ff0
Instruction ID: 5ca5c39a8de68291b6d3e4cc79652f43b2b7ddcad8b7fc2209c3f4d9f5c1e8c2
Opcode Fuzzy Hash: c36b806efd238cb85f734633c2ea761f11f9bbe70b06756de1a34c4df3bb4ff0
Instruction Fuzzy Hash: 1E427E74A006069FDB14CFA9D884BEEBBF1FF58308F188069D81AA7311D775A985CB58

Uniqueness

Uniqueness Score: -1.00%

Function 004479BE Relevance: 1.9, APIs: 1, Instructions: 408timeCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetTimeZoneInformation.KERNEL32(00000000,00000000,00000000,00000000,00000000,00000000,?,?,?,00447E03,00000000,00000000,00000000), ref: 00447CC2

Memory Dump Source

Source File: 00000000.00000002.3349183063.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3349183063.000000000058A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3349183063.0000000000590000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3349183063.0000000000593000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_2zdult23rz.jbxd

Similarity

API ID: InformationTimeZone
String ID:
API String ID: 565725191-0
Opcode ID: 3a5586bc615656ec4b608de28d13bf62060f675f43a55b6b57679b6e8cc7b9a4
Instruction ID: ea3c3819e00c7610c2bdce84c30dacc5ed2750e9284a6662424918e6eb4f3f86
Opcode Fuzzy Hash: 3a5586bc615656ec4b608de28d13bf62060f675f43a55b6b57679b6e8cc7b9a4
Instruction Fuzzy Hash: A2C13771D04115ABEB10BF65DC02ABF7BA9EF04758F64445BF900EB281EB389E42C798

Uniqueness

Uniqueness Score: -1.00%

Function 005041A0 Relevance: 1.9, Strings: 1, Instructions: 621COMMON

Download Yara Rule

Strings

~IP, xrefs: 00504326, 005048B9, 0050473E, 00504513, 005043EE, 00504367

Memory Dump Source

Source File: 00000000.00000002.3349183063.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3349183063.000000000058A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3349183063.0000000000590000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3349183063.0000000000593000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_2zdult23rz.jbxd

Similarity

API ID:
String ID: ~IP
API String ID: 0-3959306736
Opcode ID: b1fdcda4715aefa95cdded5a1e3c2b4ef5fa28535821b5a0eba220b7a96750b7
Instruction ID: 0e36e89e1f9e1fd0a3757911ecfb7ec23bbf8a2227642b7cf3c9c86fbdf17ad5
Opcode Fuzzy Hash: b1fdcda4715aefa95cdded5a1e3c2b4ef5fa28535821b5a0eba220b7a96750b7
Instruction Fuzzy Hash: 4942CDB1A00649CBDB14CE78C8407ADFFA1FF46311F1886ADE5A5E7781D734994ACBA0

Uniqueness

Uniqueness Score: -1.00%

Function 00448314 Relevance: 1.8, APIs: 1, Instructions: 269COMMONLIBRARYCODE

Download Yara Rule

APIs

RaiseException.KERNEL32(C000000D,00000000,00000001,?,?,00000008,?,?,0044830F,?,?,00000008,?,?,0045277F,00000000), ref: 00448541

Memory Dump Source

Source File: 00000000.00000002.3349183063.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3349183063.000000000058A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3349183063.0000000000590000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3349183063.0000000000593000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_2zdult23rz.jbxd

Similarity

API ID: ExceptionRaise
String ID:
API String ID: 3997070919-0
Opcode ID: a522b569da1b4251fc9465fad5f5be812267484b24e4dcd58fb934ad629dd70c
Instruction ID: 77f85e0033942a6f02aeb2ce0c4b177648a4ad42039305f86338891f230134e9
Opcode Fuzzy Hash: a522b569da1b4251fc9465fad5f5be812267484b24e4dcd58fb934ad629dd70c
Instruction Fuzzy Hash: 15B14B31610609DFE715CF28C48AB697BE0FF45364F25865DE899CF2A1CB39E982CB44

Uniqueness

Uniqueness Score: -1.00%

Function 0050E450 Relevance: 1.7, Strings: 1, Instructions: 425COMMON

Download Yara Rule

Strings

!, xrefs: 0050E6CF

Memory Dump Source

Source File: 00000000.00000002.3349183063.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3349183063.000000000058A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3349183063.0000000000590000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3349183063.0000000000593000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_2zdult23rz.jbxd

Similarity

API ID:
String ID: !
API String ID: 0-2657877971
Opcode ID: 2b540187df3081818611ad0faee9f1032e9016378777c44864a2ae72a30e3cb2
Instruction ID: c0eeada6260e29c31d7b62fd3a35856ce760a15ccc0f5b1cff4669d61bc51190
Opcode Fuzzy Hash: 2b540187df3081818611ad0faee9f1032e9016378777c44864a2ae72a30e3cb2
Instruction Fuzzy Hash: 06029B71D00619CFDB15CFA4D891BAEBBB5FF58340F24865AE819BB291D730A981CF90

Uniqueness

Uniqueness Score: -1.00%

Function 0054E340 Relevance: 1.7, APIs: 1, Instructions: 167COMMON

Download Yara Rule

APIs

__allrem.LIBCMT ref: 0054E3BD

Memory Dump Source

Source File: 00000000.00000002.3349183063.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3349183063.000000000058A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3349183063.0000000000590000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3349183063.0000000000593000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_2zdult23rz.jbxd

Similarity

API ID: __allrem
String ID:
API String ID: 2933888876-0
Opcode ID: a9d30a74fc4e9ed61f6c396232b0d774953ff2e67443f99245b097325991053d
Instruction ID: 6a3e6f16453dbbf5a8bbe516ce83afefbcf635a20edd48ca6a6075a7bef4e538
Opcode Fuzzy Hash: a9d30a74fc4e9ed61f6c396232b0d774953ff2e67443f99245b097325991053d
Instruction Fuzzy Hash: A9619D31610744CFCB19CF6DC880A5AFBF1BF95304B048AAEE886DB752C630E955CB91

Uniqueness

Uniqueness Score: -1.00%

Function 0042E615 Relevance: 1.6, APIs: 1, Instructions: 147COMMON

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32(0000000A), ref: 0042E62B

Memory Dump Source

Source File: 00000000.00000002.3349183063.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3349183063.000000000058A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3349183063.0000000000590000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3349183063.0000000000593000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_2zdult23rz.jbxd

Similarity

API ID: FeaturePresentProcessor
String ID:
API String ID: 2325560087-0
Opcode ID: 3ca076d294132ea85c9225524bd060b2b5d0a9659c1cd1948e615a2f79d017dc
Instruction ID: 0560f1a0132bf4e5b1c808d14a47f9a7b5d2127d5f653d530456e995a7e1946a
Opcode Fuzzy Hash: 3ca076d294132ea85c9225524bd060b2b5d0a9659c1cd1948e615a2f79d017dc
Instruction Fuzzy Hash: 1A517EB1A01215CBDB18CF69E9857AABBF4FB68310F6480AAD815EB790D379DD04CF50

Uniqueness

Uniqueness Score: -1.00%

Function 0044A4BD Relevance: 1.6, APIs: 1, Instructions: 140COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3349183063.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3349183063.000000000058A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3349183063.0000000000590000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3349183063.0000000000593000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_2zdult23rz.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: afc79e698587ceb94eb08f2d5911b01c91996052b760619b6665b5f770433781
Instruction ID: 43a8121c9936acc675afad3d7a398d95df7ce8f9f1e10b0a7353c4c380b6e0d1
Opcode Fuzzy Hash: afc79e698587ceb94eb08f2d5911b01c91996052b760619b6665b5f770433781
Instruction Fuzzy Hash: AD41C5B5844219AFEF20DF69CC89AAEBBB9EF45304F1442DEE44DD3201D6349E848F54

Uniqueness

Uniqueness Score: -1.00%

Function 0044DA5B Relevance: 1.6, APIs: 1, Instructions: 83COMMON

Download Yara Rule

APIs

Part of subcall function 004446D2: GetLastError.KERNEL32(00000000,?,0044A0B9), ref: 004446D6
Part of subcall function 004446D2: SetLastError.KERNEL32(00000000,00000000,?,00000008,000000FF), ref: 00444778

GetLocaleInfoW.KERNEL32(00000000,?,?,00000078), ref: 0044DAAF

Memory Dump Source

Source File: 00000000.00000002.3349183063.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3349183063.000000000058A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3349183063.0000000000590000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3349183063.0000000000593000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_2zdult23rz.jbxd

Similarity

API ID: ErrorLast$InfoLocale
String ID:
API String ID: 3736152602-0
Opcode ID: c2975fa7154ef1f307fe959cf56d6e9e0eddb6192ca9df98402dda858ca7e39f
Instruction ID: dd78411b6d02ea73808ec2e7c3fcf06bf5b204a043b4b0ce9a73ff3597b80607
Opcode Fuzzy Hash: c2975fa7154ef1f307fe959cf56d6e9e0eddb6192ca9df98402dda858ca7e39f
Instruction Fuzzy Hash: 7A21D032A05206ABFB289A25CC46EBB73A8EF08344F11407FF901D6241EB78ED00CB58

Uniqueness

Uniqueness Score: -1.00%

Function 00504A90 Relevance: 1.6, Strings: 1, Instructions: 325COMMON

Download Yara Rule

Strings

-, xrefs: 00504AEC

Memory Dump Source

Source File: 00000000.00000002.3349183063.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3349183063.000000000058A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3349183063.0000000000590000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3349183063.0000000000593000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_2zdult23rz.jbxd

Similarity

API ID:
String ID: -
API String ID: 0-2547889144
Opcode ID: 380dda1ef3d93faf75dbacb9f630860303182309aaebddffecc3a3ea39fa0403
Instruction ID: 38aa0a0541716d94f7284c8eb05237e614240b63d97cf31906db9550cd6421b3
Opcode Fuzzy Hash: 380dda1ef3d93faf75dbacb9f630860303182309aaebddffecc3a3ea39fa0403
Instruction Fuzzy Hash: 91C1B2759007049FEB21CFA4C841AEEFBF6FF48310F108A59E5A6D7690D770AA46CB51

Uniqueness

Uniqueness Score: -1.00%

Function 0043A8BD Relevance: 1.6, Strings: 1, Instructions: 318COMMON

Download Yara Rule

Strings

0, xrefs: 0043AA41

Memory Dump Source

Source File: 00000000.00000002.3349183063.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3349183063.000000000058A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3349183063.0000000000590000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3349183063.0000000000593000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_2zdult23rz.jbxd

Similarity

API ID:
String ID: 0
API String ID: 0-4108050209
Opcode ID: 9fae787529c539db411449c7c426ecae237ed91d3812021c802cfd60af6ea9cf
Instruction ID: 20f36868057f2dc5694f653adca667ab833700143c84c98609cf2c37f38438c9
Opcode Fuzzy Hash: 9fae787529c539db411449c7c426ecae237ed91d3812021c802cfd60af6ea9cf
Instruction Fuzzy Hash: BEB1D37158060A8BCB28DE6885556BFB7A1AF0C304F142A1FD5D2A7381C73CAD65CB9B

Uniqueness

Uniqueness Score: -1.00%

Function 0044D6E2 Relevance: 1.6, APIs: 1, Instructions: 63COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 004446D2: GetLastError.KERNEL32(00000000,?,0044A0B9), ref: 004446D6
Part of subcall function 004446D2: SetLastError.KERNEL32(00000000,00000000,?,00000008,000000FF), ref: 00444778

EnumSystemLocalesW.KERNEL32(0044D808,00000001,00000000,?,-00000050,?,0044DE3C,00000000,?,?,?,00000055,?), ref: 0044D754

Memory Dump Source

Source File: 00000000.00000002.3349183063.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3349183063.000000000058A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3349183063.0000000000590000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3349183063.0000000000593000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_2zdult23rz.jbxd

Similarity

API ID: ErrorLast$EnumLocalesSystem
String ID:
API String ID: 2417226690-0
Opcode ID: 74811ef92082ea11476a4a0775b59368989c922df0a41872fce1cb506a1c7c39
Instruction ID: d63533fa27c32808a75666b88b8b659c3fd8f93e3591a50ebc9a6a7f41383f5d
Opcode Fuzzy Hash: 74811ef92082ea11476a4a0775b59368989c922df0a41872fce1cb506a1c7c39
Instruction Fuzzy Hash: 22114C3B6007055FEB18AF39C89167BBB91FF84359B15442EE94747B40D379B842CB40

Uniqueness

Uniqueness Score: -1.00%

Function 0044DC8A Relevance: 1.5, APIs: 1, Instructions: 48COMMON

Download Yara Rule

APIs

Part of subcall function 004446D2: GetLastError.KERNEL32(00000000,?,0044A0B9), ref: 004446D6
Part of subcall function 004446D2: SetLastError.KERNEL32(00000000,00000000,?,00000008,000000FF), ref: 00444778

GetLocaleInfoW.KERNEL32(?,20000001,?,00000002,?,00000000,?,?,0044DB05,00000000,00000000,?), ref: 0044DCB6

Memory Dump Source

Source File: 00000000.00000002.3349183063.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3349183063.000000000058A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3349183063.0000000000590000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3349183063.0000000000593000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_2zdult23rz.jbxd

Similarity

API ID: ErrorLast$InfoLocale
String ID:
API String ID: 3736152602-0
Opcode ID: 0637a9234226735897cadec0c07571a5b51b04de3a391088df2eeea5decfeb04
Instruction ID: 25f27c41e2a799376a793f10ec0ae59c946a4f3c6d1d0bc4c30979dedc61f3af
Opcode Fuzzy Hash: 0637a9234226735897cadec0c07571a5b51b04de3a391088df2eeea5decfeb04
Instruction Fuzzy Hash: AE01DB32A001166BEF1C97258C856FB7754DB40354F15442EEC47A71C0DAB8ED41D594

Uniqueness

Uniqueness Score: -1.00%

Function 0044D5F0 Relevance: 1.5, APIs: 1, Instructions: 43COMMON

Download Yara Rule

APIs

Part of subcall function 004446D2: GetLastError.KERNEL32(00000000,?,0044A0B9), ref: 004446D6
Part of subcall function 004446D2: SetLastError.KERNEL32(00000000,00000000,?,00000008,000000FF), ref: 00444778

GetLocaleInfoW.KERNEL32(00000000,?,?,00000078,-00000050,00000000,000000D0), ref: 0044D644

Strings

utf8, xrefs: 0044D5B3

Memory Dump Source

Source File: 00000000.00000002.3349183063.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3349183063.000000000058A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3349183063.0000000000590000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3349183063.0000000000593000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_2zdult23rz.jbxd

Similarity

API ID: ErrorLast$InfoLocale
String ID: utf8
API String ID: 3736152602-905460609
Opcode ID: 920c1418828a3e559e3acd869b1a92a1130720e4529be8c9e90a49c049048bcc
Instruction ID: 6c0174c134c73646d7c90a0ea1aa7825cb3b77a2b70d1140e75137df18781df8
Opcode Fuzzy Hash: 920c1418828a3e559e3acd869b1a92a1130720e4529be8c9e90a49c049048bcc
Instruction Fuzzy Hash: 51F02832A00115ABEB14AF39DC5AEBA73E8DF45314F12007FF602D7240EA7CAD049758

Uniqueness

Uniqueness Score: -1.00%

Function 0044D77D Relevance: 1.5, APIs: 1, Instructions: 41COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 004446D2: GetLastError.KERNEL32(00000000,?,0044A0B9), ref: 004446D6
Part of subcall function 004446D2: SetLastError.KERNEL32(00000000,00000000,?,00000008,000000FF), ref: 00444778

EnumSystemLocalesW.KERNEL32(0044DA5B,00000001,?,?,-00000050,?,0044DE04,-00000050,?,?,?,00000055,?,-00000050,?,?), ref: 0044D7C7

Memory Dump Source

Source File: 00000000.00000002.3349183063.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3349183063.000000000058A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3349183063.0000000000590000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3349183063.0000000000593000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_2zdult23rz.jbxd

Similarity

API ID: ErrorLast$EnumLocalesSystem
String ID:
API String ID: 2417226690-0
Opcode ID: 49b0da54b3289b7529160025e64babfda73cccd0dd63a0630e318fd5595f48d0
Instruction ID: c5dd859dd70427a1582982cb37ea1c70f7b8b22991fc0cf0f6faf13280faefb1
Opcode Fuzzy Hash: 49b0da54b3289b7529160025e64babfda73cccd0dd63a0630e318fd5595f48d0
Instruction Fuzzy Hash: 42F0F6366003045FEB245F399C91A7BBB91EF8176CF15846EFA464BA90C6B99C02CA14

Uniqueness

Uniqueness Score: -1.00%

Function 00547260 Relevance: 1.5, Strings: 1, Instructions: 284COMMON

Download Yara Rule

Strings

d, xrefs: 00547491

Memory Dump Source

Source File: 00000000.00000002.3349183063.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3349183063.000000000058A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3349183063.0000000000590000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3349183063.0000000000593000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_2zdult23rz.jbxd

Similarity

API ID:
String ID: d
API String ID: 0-2564639436
Opcode ID: 65b2b50e87701b05392edcc5b016cabdb43a27c71a424911f7f495d90d19c7da
Instruction ID: 3fb9d88d0b5f755fd0e6344615324f693740c7374d349f51c13debef489c49ab
Opcode Fuzzy Hash: 65b2b50e87701b05392edcc5b016cabdb43a27c71a424911f7f495d90d19c7da
Instruction Fuzzy Hash: A9B181706087468FD714CF29C4905AABFE1BFD9308F1885ADE8958F342D775E906CB91

Uniqueness

Uniqueness Score: -1.00%

Function 00445A41 Relevance: 1.5, APIs: 1, Instructions: 33COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 0043EADB: EnterCriticalSection.KERNEL32(?,?,0044035C,00000000,00578B08,0000000C,00440324,0042C58A,?,00444F1D,0042C58A,?,00444870,00000001,00000364,?), ref: 0043EAEA

EnumSystemLocalesW.KERNEL32(00445A34,00000001,00578D88,0000000C,00445E69,00000000), ref: 00445A79

Memory Dump Source

Source File: 00000000.00000002.3349183063.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3349183063.000000000058A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3349183063.0000000000590000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3349183063.0000000000593000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_2zdult23rz.jbxd

Similarity

API ID: CriticalEnterEnumLocalesSectionSystem
String ID:
API String ID: 1272433827-0
Opcode ID: 15786d997aef7d7ab4e4b205401f3d5632b5533645e4db0cf4740f2cdb25dd2e
Instruction ID: 975feb7b3ab3afacf800ca2749cddded062046f6123fa37677f8dc3026703573
Opcode Fuzzy Hash: 15786d997aef7d7ab4e4b205401f3d5632b5533645e4db0cf4740f2cdb25dd2e
Instruction Fuzzy Hash: E2F03C32A41200DFD700DF99E846B5977F1EB18724F10851AE800AB2D1CAB949049F44

Uniqueness

Uniqueness Score: -1.00%

Function 0044D697 Relevance: 1.5, APIs: 1, Instructions: 31COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 004446D2: GetLastError.KERNEL32(00000000,?,0044A0B9), ref: 004446D6
Part of subcall function 004446D2: SetLastError.KERNEL32(00000000,00000000,?,00000008,000000FF), ref: 00444778

EnumSystemLocalesW.KERNEL32(0044D5F0,00000001,?,?,?,0044DE5E,-00000050,?,?,?,00000055,?,-00000050,?,?,00000004), ref: 0044D6CE

Memory Dump Source

Source File: 00000000.00000002.3349183063.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3349183063.000000000058A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3349183063.0000000000590000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3349183063.0000000000593000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_2zdult23rz.jbxd

Similarity

API ID: ErrorLast$EnumLocalesSystem
String ID:
API String ID: 2417226690-0
Opcode ID: ad720073d8a9bd0854b318b08c834bdb29ebfc33f3660edff20abc08132d780f
Instruction ID: e55e49f08a5d554f6926ce35e3531e1ed2b45db46240f784fd6e82346de52d89
Opcode Fuzzy Hash: ad720073d8a9bd0854b318b08c834bdb29ebfc33f3660edff20abc08132d780f
Instruction Fuzzy Hash: BEF0553A70020857EB14AF39D81576BBF90EFC2714B0B405EEE098F281CA79D842CB94

Uniqueness

Uniqueness Score: -1.00%

Function 00445FC4 Relevance: 1.5, APIs: 1, Instructions: 24COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLocaleInfoW.KERNEL32(00000000,?,00000000,?,-00000050,?,?,?,00442706,?,20001004,00000000,00000002,?,?,00441CF8), ref: 00445FF8

Memory Dump Source

Source File: 00000000.00000002.3349183063.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3349183063.000000000058A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3349183063.0000000000590000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3349183063.0000000000593000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_2zdult23rz.jbxd

Similarity

API ID: InfoLocale
String ID:
API String ID: 2299586839-0
Opcode ID: 1ba360382770a577bdc0a634bc701b9d591f825f29f064a57b32caf63b92feb7
Instruction ID: f4173b9e4e9db5570490656a11340cfbd407105faa0d346c5000665c7e3cf4e8
Opcode Fuzzy Hash: 1ba360382770a577bdc0a634bc701b9d591f825f29f064a57b32caf63b92feb7
Instruction Fuzzy Hash: D4E08632540A1CBBEF122F61DC04E9E3F16EF44761F004416FD05A6222CB798D25BBDA

Uniqueness

Uniqueness Score: -1.00%

Function 004E2C80 Relevance: 1.5, APIs: 1, Instructions: 23COMMON

Download Yara Rule

APIs

IsDebuggerPresent.KERNEL32 ref: 004E2C93

Memory Dump Source

Source File: 00000000.00000002.3349183063.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3349183063.000000000058A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3349183063.0000000000590000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3349183063.0000000000593000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_2zdult23rz.jbxd

Similarity

API ID: DebuggerPresent
String ID:
API String ID: 1347740429-0
Opcode ID: 6d7b403be2a52da18699192a358012470769ff12c202795e8b52c9651caf2a84
Instruction ID: de7932f46881d58097039676193586107e5d50b177220b61d64bf596e7e07861
Opcode Fuzzy Hash: 6d7b403be2a52da18699192a358012470769ff12c202795e8b52c9651caf2a84
Instruction Fuzzy Hash: 4EE07D71704104AFC709CB0AAD1037AB7ECEB85701F14409DF84CC3500C23DCD08A620

Uniqueness

Uniqueness Score: -1.00%

Function 00503E00 Relevance: 1.5, Strings: 1, Instructions: 219COMMON

Download Yara Rule

Strings

-, xrefs: 00503E7F

Memory Dump Source

Source File: 00000000.00000002.3349183063.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3349183063.000000000058A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3349183063.0000000000590000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3349183063.0000000000593000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_2zdult23rz.jbxd

Similarity

API ID:
String ID: -
API String ID: 0-2547889144
Opcode ID: ffad52e287b60b8b48c8f6c01dcfbe838c716be90c45fb450b26370899277487
Instruction ID: 1559c6fbe9af4ae949f9f59b4d9dd60709f0b2c6334ddd8d40e317b99a3fbb23
Opcode Fuzzy Hash: ffad52e287b60b8b48c8f6c01dcfbe838c716be90c45fb450b26370899277487
Instruction Fuzzy Hash: 8681AF70911648AEEF219AB4C840BEDFFF5EF05201F1489E8E8D1E3B41D678D64AC7A1

Uniqueness

Uniqueness Score: -1.00%

Function 00545BF0 Relevance: 1.0, Instructions: 974COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3349183063.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3349183063.000000000058A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3349183063.0000000000590000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3349183063.0000000000593000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_2zdult23rz.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: caf834001ea446df0036a476286a7bfb4e90ec212345cfca0d0e976b8e82d378
Instruction ID: 6dc6575b03be9784365497c085fa600415a15eb75f263b80c6d4bb0475320933
Opcode Fuzzy Hash: caf834001ea446df0036a476286a7bfb4e90ec212345cfca0d0e976b8e82d378
Instruction Fuzzy Hash: AB929E70A083528FC714CF29D49466ABBF1BFD9308F18896DE885D7352E735E849CB92

Uniqueness

Uniqueness Score: -1.00%

Function 004FB0A0 Relevance: .8, Instructions: 763COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3349183063.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3349183063.000000000058A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3349183063.0000000000590000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3349183063.0000000000593000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_2zdult23rz.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e66eafb21ff0ac23a1e243a383367402beece03311f5ec548545498dddb0c253
Instruction ID: f66ee135833696fdc7097fc137d742b9d11648fb3e57faaf4428e0af157d3001
Opcode Fuzzy Hash: e66eafb21ff0ac23a1e243a383367402beece03311f5ec548545498dddb0c253
Instruction Fuzzy Hash: 653274B3F5161447DF1CCA6ECC922EDB2E36FD821871E813DE80AE3345EA79E9454684

Uniqueness

Uniqueness Score: -1.00%

Function 00510140 Relevance: .7, Instructions: 660COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3349183063.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3349183063.000000000058A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3349183063.0000000000590000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3349183063.0000000000593000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_2zdult23rz.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fb20a9ab949ab236c62cc85e773eeeaf98a45e05a4b9f90c927e224cd229a3f5
Instruction ID: 7734e3287553b3d74106f6f7eb9ccba05eed1c215cdc5eb9b880f13b62f88aab
Opcode Fuzzy Hash: fb20a9ab949ab236c62cc85e773eeeaf98a45e05a4b9f90c927e224cd229a3f5
Instruction Fuzzy Hash: 65428D75A043418FE714CF28C480B5ABBE1BFC8314F149A6DE9999B395D7B1E8C5CB82

Uniqueness

Uniqueness Score: -1.00%

Function 00504FE0 Relevance: .5, Instructions: 514COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3349183063.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3349183063.000000000058A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3349183063.0000000000590000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3349183063.0000000000593000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_2zdult23rz.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 462a57ca317a6d8a166d02cb38495b8c20b9ea2f44dbbe5edf3c46a57e50bf80
Instruction ID: 7757f8fc9b8f85dab1bb2ad46412550d50e0bedee1a40c7e8741c7df14e7ece4
Opcode Fuzzy Hash: 462a57ca317a6d8a166d02cb38495b8c20b9ea2f44dbbe5edf3c46a57e50bf80
Instruction Fuzzy Hash: 8A122171E006099FDF14CFA9C884AAFBBF6BF88310F144629E856A7291E731AD458F51

Uniqueness

Uniqueness Score: -1.00%

Function 00506210 Relevance: .4, Instructions: 436COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3349183063.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3349183063.000000000058A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3349183063.0000000000590000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3349183063.0000000000593000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_2zdult23rz.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ef81d08433bf8d8d61e6c1161020cb8fffbde7e1d3568ab1fbacf3de246997fd
Instruction ID: ba967dd3ff9d9106477157ee49b7d729a4060b443a8a457c01192f13d4eca8ea
Opcode Fuzzy Hash: ef81d08433bf8d8d61e6c1161020cb8fffbde7e1d3568ab1fbacf3de246997fd
Instruction Fuzzy Hash: DA02B3326106968FC724CF29C88107BBBF1EF89311769886ED9D6DB781C634F612CB60

Uniqueness

Uniqueness Score: -1.00%

Function 004FC8B0 Relevance: .4, Instructions: 436COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3349183063.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3349183063.000000000058A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3349183063.0000000000590000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3349183063.0000000000593000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_2zdult23rz.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cd521b889542f296bfaed5314055fa668bf2ffd65be26f9d3c7731796762692a
Instruction ID: 5e2d1ab2bce61d981860ebf19bddab20534b6d4d11a507bd48879200d39f2fed
Opcode Fuzzy Hash: cd521b889542f296bfaed5314055fa668bf2ffd65be26f9d3c7731796762692a
Instruction Fuzzy Hash: 15125674A00B098FCB24CF29C5C0AAAB7F1FF88314B14496EE99A8B751D735F951CB85

Uniqueness

Uniqueness Score: -1.00%

Function 00553BB0 Relevance: .4, Instructions: 429COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3349183063.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3349183063.000000000058A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3349183063.0000000000590000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3349183063.0000000000593000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_2zdult23rz.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bae7487293e0dc385c770392db7ca73dace1d0f42b9179006753cc26472b5183
Instruction ID: 58816452aaef0bab64cc97f158be379e85dfabc4257e2525a70992e3c6a28104
Opcode Fuzzy Hash: bae7487293e0dc385c770392db7ca73dace1d0f42b9179006753cc26472b5183
Instruction Fuzzy Hash: 21F15F329051928FDB158E38C4A13EDBF72BF65341F1846A7DC999B383D2389B59C790

Uniqueness

Uniqueness Score: -1.00%

Function 00502580 Relevance: .4, Instructions: 406COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3349183063.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3349183063.000000000058A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3349183063.0000000000590000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3349183063.0000000000593000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_2zdult23rz.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 39387ab85209766842b9284995c4f4661568adcf7e725f55e952964d27ec746d
Instruction ID: 544e97e2d2659a48e5ca0f5675e74e05ae03e0083d16ca512a67e675fa9a4e76
Opcode Fuzzy Hash: 39387ab85209766842b9284995c4f4661568adcf7e725f55e952964d27ec746d
Instruction Fuzzy Hash: 27027C74905215CFCB19CF58C4D48B9BBF1FFA9310F29819DD8899B3A6D730AA81CB91

Uniqueness

Uniqueness Score: -1.00%

Function 0042A040 Relevance: .4, Instructions: 394COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3349183063.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3349183063.000000000058A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3349183063.0000000000590000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3349183063.0000000000593000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_2zdult23rz.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5fbb21310ebcda3e4e059c5daabd12ca751ce5a75bdd29feff0510c95ec1bd5b
Instruction ID: e176e8c39fa0001ffa0331148fc1a1e597aad8ea40cb8f55bb963474ee5d0d66
Opcode Fuzzy Hash: 5fbb21310ebcda3e4e059c5daabd12ca751ce5a75bdd29feff0510c95ec1bd5b
Instruction Fuzzy Hash: BEE1F372F1022A8FCB05CFA8D8816ADFBF1AF88324F5941AAD815B7340D774A955CB94

Uniqueness

Uniqueness Score: -1.00%

Function 0043ABFF Relevance: .3, Instructions: 333COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3349183063.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3349183063.000000000058A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3349183063.0000000000590000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3349183063.0000000000593000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_2zdult23rz.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b936da6fa63ff3c9941933694ab20e4ced834cba7d39d6f97687a7cc9c1a2aa9
Instruction ID: b77fb66b65a7cd15b76525c16936a83aaa1f8e48e04690ffc265ef7540f6e5ab
Opcode Fuzzy Hash: b936da6fa63ff3c9941933694ab20e4ced834cba7d39d6f97687a7cc9c1a2aa9
Instruction Fuzzy Hash: 67C1CD709806068FCB24CF68C494A7BBBB2AF0D304F24660BD4D297791C339AD65CB5B

Uniqueness

Uniqueness Score: -1.00%

Function 0044CEA1 Relevance: .3, Instructions: 327COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3349183063.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3349183063.000000000058A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3349183063.0000000000590000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3349183063.0000000000593000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_2zdult23rz.jbxd

Similarity

API ID: ErrorLast
String ID:
API String ID: 1452528299-0
Opcode ID: afcc77529efb64274b7416809ca556df6147631fdf66756cd8a0b3ef413a42af
Instruction ID: 5f1cb8c8074dd1ad8c9c3560b724a861c65c7d1d7404c3ef60a989e79c7d9ee6
Opcode Fuzzy Hash: afcc77529efb64274b7416809ca556df6147631fdf66756cd8a0b3ef413a42af
Instruction Fuzzy Hash: 9FB1E675A007019BEB389F25CCC2AB7B3A9EF54308F54456FE943C6680EA7DE986C714

Uniqueness

Uniqueness Score: -1.00%

Function 00506920 Relevance: .3, Instructions: 313COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3349183063.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3349183063.000000000058A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3349183063.0000000000590000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3349183063.0000000000593000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_2zdult23rz.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3c5e9afb0340c538037aee8e06cf4db1c74506ff76afd08ac3cc375c4bd7e949
Instruction ID: 21ea325e3d8e9dd88ad6d2e4823945e325a7d4879c9c0f24fc1850b01c051b63
Opcode Fuzzy Hash: 3c5e9afb0340c538037aee8e06cf4db1c74506ff76afd08ac3cc375c4bd7e949
Instruction Fuzzy Hash: 10D19F70600B41CBE724CF39C45079ABBE0FF45314F148A6DD4EA8B781EB74A489CB91

Uniqueness

Uniqueness Score: -1.00%

Function 00506DD0 Relevance: .3, Instructions: 294COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3349183063.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3349183063.000000000058A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3349183063.0000000000590000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3349183063.0000000000593000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_2zdult23rz.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9226b04f7e21239919893a05cdb86704bbfbc6d518d31c226dace148a3012db9
Instruction ID: 7a6889ae545e6ec7e5da51a817b46c2a83bd4d4ff43436e387e76d31d11313cc
Opcode Fuzzy Hash: 9226b04f7e21239919893a05cdb86704bbfbc6d518d31c226dace148a3012db9
Instruction Fuzzy Hash: 97B1B0756087019FC720CF68C840A6BBBE5FF88324F144B2DF8AAD3690D774EA558B52

Uniqueness

Uniqueness Score: -1.00%

Function 00552230 Relevance: .3, Instructions: 284COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3349183063.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3349183063.000000000058A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3349183063.0000000000590000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3349183063.0000000000593000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_2zdult23rz.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 893fc609b8402a8608f33f145b25375dfb948b4b09f3cbc2c50ffdfc71324a8c
Instruction ID: cf1624fd1a6dc0b57627c03be5c97227f8004610d698b89aec3193db8da64621
Opcode Fuzzy Hash: 893fc609b8402a8608f33f145b25375dfb948b4b09f3cbc2c50ffdfc71324a8c
Instruction Fuzzy Hash: FFA157B4A016169FDB14CF69C49066AFBE1FF8A315F28C66ADC18DB311E731E915CB80

Uniqueness

Uniqueness Score: -1.00%

Function 00453450 Relevance: .2, Instructions: 220COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3349183063.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3349183063.000000000058A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3349183063.0000000000590000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3349183063.0000000000593000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_2zdult23rz.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1b08204afe2b93367e389797d6b26a5b5906cfef6ab924b9fa18c453b9a8b958
Instruction ID: 4760c8aac2775d88ce5afe2aa9a6c194579425224feb06dc2f39e30c9f8e2f3f
Opcode Fuzzy Hash: 1b08204afe2b93367e389797d6b26a5b5906cfef6ab924b9fa18c453b9a8b958
Instruction Fuzzy Hash: FB8100B0E00245AFDB118F69C9907BBBBA4EB1A346F4401AADC54A7343D7399A0DD7A4

Uniqueness

Uniqueness Score: -1.00%

Function 00503BD0 Relevance: .2, Instructions: 199COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3349183063.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3349183063.000000000058A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3349183063.0000000000590000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3349183063.0000000000593000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_2zdult23rz.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 21a67febc048bd5e7bed61c903892d463eae84642cc4542d2051080d3f21be36
Instruction ID: 153ad128e3baa2a89b3cd3a6b4d1e78249d5372dd193227f4e93c557145195e1
Opcode Fuzzy Hash: 21a67febc048bd5e7bed61c903892d463eae84642cc4542d2051080d3f21be36
Instruction Fuzzy Hash: 6C61E731610609AFEB34CAA8C841AEEFFF9FF45310F108AADE596D36D0D270AA45C751

Uniqueness

Uniqueness Score: -1.00%

Function 004FBE00 Relevance: .2, Instructions: 194COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3349183063.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3349183063.000000000058A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3349183063.0000000000590000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3349183063.0000000000593000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_2zdult23rz.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 794a7f1c8da851de123a8cb36b784223d3d5061ff9f43bc90911fb1ba4d4a164
Instruction ID: 0bac669ca15a16959d8963909ca58fedb4fc25c6a12a3c3dd1bbd6b990ac7096
Opcode Fuzzy Hash: 794a7f1c8da851de123a8cb36b784223d3d5061ff9f43bc90911fb1ba4d4a164
Instruction Fuzzy Hash: 087163356201E44FD748CF5EECC0436BB62E3AE301749866ADA81CB395C575F92AE7A0

Uniqueness

Uniqueness Score: -1.00%

Function 004FC0A0 Relevance: .2, Instructions: 189COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3349183063.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3349183063.000000000058A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3349183063.0000000000590000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3349183063.0000000000593000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_2zdult23rz.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 142b9e497edc779feb926e324d820a004adefa17f44103fd404662cc1c40eab9
Instruction ID: 38e074bbf3e805e58539ca8d739cae2271b6a1961dda6b795eee354daaa2981f
Opcode Fuzzy Hash: 142b9e497edc779feb926e324d820a004adefa17f44103fd404662cc1c40eab9
Instruction Fuzzy Hash: 2361DA316201A84FE748DF5EFCC0476B361E3AE301789461AEA81CB395C675F56AE7E0

Uniqueness

Uniqueness Score: -1.00%

Function 004351B8 Relevance: .2, Instructions: 156COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3349183063.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3349183063.000000000058A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3349183063.0000000000590000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3349183063.0000000000593000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_2zdult23rz.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bd71f3774c32148dbb9a209fc02133cbfe0372526eb67c7398d57bd26b7fbe4d
Instruction ID: 96e57ead98d41e04fe68f30f62ea81bdeba23ce11bdd67b69aec938acc7c3f29
Opcode Fuzzy Hash: bd71f3774c32148dbb9a209fc02133cbfe0372526eb67c7398d57bd26b7fbe4d
Instruction Fuzzy Hash: 8F516072D00119AFDF04CF99C841AEFBBB6FF88304F598499E915AB301D7789A41DB94

Uniqueness

Uniqueness Score: -1.00%

Function 005040A0 Relevance: .1, Instructions: 89COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3349183063.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3349183063.000000000058A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3349183063.0000000000590000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3349183063.0000000000593000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_2zdult23rz.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1584348cf9e3f3be4a9b24cc4e2ffe07feb8b558a8eaef0232f41b95094aa3e0
Instruction ID: 7211d50b4de8a7ebd746b1f7ef274bdd41a532539b5b6ed0c87081a493a79e19
Opcode Fuzzy Hash: 1584348cf9e3f3be4a9b24cc4e2ffe07feb8b558a8eaef0232f41b95094aa3e0
Instruction Fuzzy Hash: 19312972B80708AEDB209E69CC40BCDBF96EF45211F04C559FD9C9B750C271E259C7A0

Uniqueness

Uniqueness Score: -1.00%

Function 00552DC0 Relevance: .1, Instructions: 85COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3349183063.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3349183063.000000000058A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3349183063.0000000000590000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3349183063.0000000000593000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_2zdult23rz.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1b63d64401bd7e6c0b9e96cbe20f5ac7b232a30cab2b22ebf5df1188a7b10d86
Instruction ID: f555f2e009fd02678a7dd5ab17e7374ade26630ceb05d7c72dcffa46560cf6fc
Opcode Fuzzy Hash: 1b63d64401bd7e6c0b9e96cbe20f5ac7b232a30cab2b22ebf5df1188a7b10d86
Instruction Fuzzy Hash: CA21A341E1A6A84BDB00593ED891792BFC5C797329F28D3F4D8588FBDED514A40AC3E1

Uniqueness

Uniqueness Score: -1.00%

Function 00431A30 Relevance: .1, Instructions: 76COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3349183063.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3349183063.000000000058A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3349183063.0000000000590000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3349183063.0000000000593000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_2zdult23rz.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 567adef0f6a617ff7e9a8750fccc1eb3e230b1b82912df90697507ac2483188c
Instruction ID: 263d72efdb7cc7cf478f7cccf9532bf8706e55590fa81357ec6907f8a2a5f3c2
Opcode Fuzzy Hash: 567adef0f6a617ff7e9a8750fccc1eb3e230b1b82912df90697507ac2483188c
Instruction Fuzzy Hash: 2F113D7724308243D604EA7DC8B45B7A7D5EBCE323F2DA37BD0418B774D22AD9459608

Uniqueness

Uniqueness Score: -1.00%

Function 05CC30A3 Relevance: .1, Instructions: 61COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3357800955.0000000005CC3000.00000040.00000020.00020000.00000000.sdmp, Offset: 05CC3000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5cc3000_2zdult23rz.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 80fd216e43a3e8e10aa1bc4256d449f15122fb9386c352c6ac78bfc1f060c30f
Instruction ID: 7e72ef2e6690c9a5bb5c930835545b38448b448786202d9581441aaa1fa49460
Opcode Fuzzy Hash: 80fd216e43a3e8e10aa1bc4256d449f15122fb9386c352c6ac78bfc1f060c30f
Instruction Fuzzy Hash: ED11A573340100AFDB54DF55ECC1FA677EAFB89620B1984A9ED08CB312D676E842C760

Uniqueness

Uniqueness Score: -1.00%

Function 004E35A0 Relevance: 24.5, APIs: 16, Instructions: 493fileCOMMON

Download Yara Rule

APIs

GetLastError.KERNEL32 ref: 004E35C8
RmStartSession.RSTRTMGR(?,00000000,?), ref: 004E3620
RmRegisterResources.RSTRTMGR(?,00000001,?,00000000,00000000,00000000,00000000,?), ref: 004E3657
RmGetList.RSTRTMGR(?,00000000,?,?,?), ref: 004E367F
RmShutdown.RSTRTMGR(?,00000001,00000000), ref: 004E36A0
RmEndSession.RSTRTMGR(?), ref: 004E36F9
SetLastError.KERNEL32(00000000), ref: 004E3700
CopyFileA.KERNEL32(?,?,00000000), ref: 004E371F
GetLastError.KERNEL32(?,?,00000000), ref: 004E372A
CopyFileA.KERNEL32(?,?,00000000), ref: 004E3742
RmStartSession.RSTRTMGR(?,00000000,?,?,00000000), ref: 004E37B1
RmRegisterResources.RSTRTMGR(?,00000001,?,00000000,00000000,00000000,00000000,?,?,00000000), ref: 004E37E8
RmGetList.RSTRTMGR(?,?,?,?,?,?,00000000), ref: 004E3810
RmShutdown.RSTRTMGR(?,00000001,00000000,?,00000000), ref: 004E3830
RmEndSession.RSTRTMGR(?,?,00000000), ref: 004E387F
SetLastError.KERNEL32(00000000,?,00000000), ref: 004E3886

Memory Dump Source

Source File: 00000000.00000002.3349183063.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3349183063.000000000058A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3349183063.0000000000590000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3349183063.0000000000593000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_2zdult23rz.jbxd

Similarity

API ID: ErrorLastSession$CopyFileListRegisterResourcesShutdownStart
String ID:
API String ID: 1315383477-0
Opcode ID: e4494fbdcfc94840c99f63401240c0ef558749a62026360f375190c91bdac27d
Instruction ID: 5bf62267ccc7f4fe4693b81ad114fb0840f9afa76d5c815397b18ace0e574e84
Opcode Fuzzy Hash: e4494fbdcfc94840c99f63401240c0ef558749a62026360f375190c91bdac27d
Instruction Fuzzy Hash: AC02AD71D00259AFCB15DFA5D888BEEBBB8FF08315F14022AE815A7391D7389E44CB95

Uniqueness

Uniqueness Score: -1.00%

Function 004FAEB0 Relevance: 19.4, APIs: 10, Strings: 1, Instructions: 142memorystringCOMMON

Download Yara Rule

APIs

CharNextA.USER32 ref: 004FAED5
CharNextA.USER32 ref: 004FAEF5
CharNextA.USER32 ref: 004FAF15
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 004FAF46
lstrlenA.KERNEL32(?,00000000,00000000,00000003,00000000), ref: 004FAFAC
GetProcessHeap.KERNEL32(00000008,?,00000000,00000000,00000003,00000000), ref: 004FAFC8
HeapAlloc.KERNEL32(00000000), ref: 004FAFCB
lstrcpynA.KERNEL32(00000000,?,?), ref: 004FAFD8
GetProcessHeap.KERNEL32(00000000,00000000), ref: 004FB003
HeapFree.KERNEL32(00000000), ref: 004FB006

Strings

Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.36, xrefs: 004FAFE8

Memory Dump Source

Source File: 00000000.00000002.3349183063.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3349183063.000000000058A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3349183063.0000000000590000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3349183063.0000000000593000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_2zdult23rz.jbxd

Similarity

API ID: Heap$CharNext$Process$AllocFreeUnothrow_t@std@@@__ehfuncinfo$??2@lstrcpynlstrlen
String ID: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.36
API String ID: 2305228968-2732702261
Opcode ID: e7e08bb893945eb25dbe9f12266579f6bca237da5d2f85bac1dfd766cae6c02f
Instruction ID: aa675b424b4e1d7cb5e2c758342acdf9c2bcf323f175e4b0a03793666df143de
Opcode Fuzzy Hash: e7e08bb893945eb25dbe9f12266579f6bca237da5d2f85bac1dfd766cae6c02f
Instruction Fuzzy Hash: 5A41F5F5A013099FCF10CFA89C846BABFF9EF69304F14009BDA08A7351D6744D169B65

Uniqueness

Uniqueness Score: -1.00%

Function 004F1F70 Relevance: 15.2, APIs: 10, Instructions: 164memoryCOMMON

Download Yara Rule

APIs

LocalAlloc.KERNEL32(00000040,0000001C), ref: 004F1FD6
SetupDiEnumDeviceInfo.SETUPAPI(00000000,00000000,00000000), ref: 004F1FE9
LocalAlloc.KERNEL32(00000040,0000001C), ref: 004F2021
SetupDiEnumDeviceInterfaces.SETUPAPI(?,00000000,00562560,00000000,00000000), ref: 004F203F
SetupDiGetDeviceInterfaceDetailA.SETUPAPI(?,00000000,00000000,00000000,00000000,00000000), ref: 004F205D
SetupDiGetDeviceInterfaceDetailA.SETUPAPI(?,?,00000000,00000000,00000000,00000000), ref: 004F2081
LocalFree.KERNEL32(?,?,?), ref: 004F20B2
LocalFree.KERNEL32(?), ref: 004F20B7
LocalFree.KERNEL32(?), ref: 004F20BC
GetModuleHandleExA.KERNEL32(00000004,004F2120,?), ref: 004F2136

Memory Dump Source

Source File: 00000000.00000002.3349183063.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3349183063.000000000058A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3349183063.0000000000590000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3349183063.0000000000593000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_2zdult23rz.jbxd

Similarity

API ID: Local$DeviceSetup$Free$AllocDetailEnumInterface$HandleInfoInterfacesModule
String ID:
API String ID: 1887780378-0
Opcode ID: 9607e7ffee7eea4fae023fd6746c200fb26042c967f9c31e3c338901e71b8e09
Instruction ID: 494fbb85ca7e0afc687ede11ca133eaef54922e140210b8116aefa76882a7597
Opcode Fuzzy Hash: 9607e7ffee7eea4fae023fd6746c200fb26042c967f9c31e3c338901e71b8e09
Instruction Fuzzy Hash: 7651C171D00209ABEB10DF55DD05BAEBFB4FF04710F20421AFA04B7290D7B96A40DBA4

Uniqueness

Uniqueness Score: -1.00%

Function 00432056 Relevance: 14.3, APIs: 4, Strings: 4, Instructions: 303COMMONLIBRARYCODE

Download Yara Rule

APIs

___TypeMatch.LIBVCRUNTIME ref: 00432283
CatchIt.LIBVCRUNTIME ref: 004322D4
_UnwindNestedFrames.LIBCMT ref: 004323D5
CallUnexpected.LIBVCRUNTIME ref: 004323F0

Strings

csm, xrefs: 00432100
csm, xrefs: 004321AC
csm, xrefs: 00432093
L;V, xrefs: 0043216C

Memory Dump Source

Source File: 00000000.00000002.3349183063.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3349183063.000000000058A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3349183063.0000000000590000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3349183063.0000000000593000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_2zdult23rz.jbxd

Similarity

API ID: CallCatchFramesMatchNestedTypeUnexpectedUnwind
String ID: L;V$csm$csm$csm
API String ID: 944608866-3339109018
Opcode ID: f219870799de8bf8d93d667d8b8260d42bea9e02fac3f36c4a5e93c416ed644d
Instruction ID: 1a3b2e3aada59ff5ba11aad393d6dbbfac41e5171332123353ed96db4a75ae81
Opcode Fuzzy Hash: f219870799de8bf8d93d667d8b8260d42bea9e02fac3f36c4a5e93c416ed644d
Instruction Fuzzy Hash: 81B19971800219EFCF18DFA5CA819AFBBB5FF08314F14605BE9106B252D7B8DA51CB99

Uniqueness

Uniqueness Score: -1.00%

Function 00452273 Relevance: 14.1, APIs: 1, Strings: 7, Instructions: 147COMMONLIBRARYCODE

Download Yara Rule

APIs

DecodePointer.KERNEL32(?,?,?,?,?,?,?,?,?,00451BDF), ref: 0045228C

Strings

exp, xrefs: 0045230B, 00452370
log10, xrefs: 004522CE, 004522DD
pow, xrefs: 0045232A, 004523D4, 00452421
asin, xrefs: 004523B9
acos, xrefs: 004523C2
sqrt, xrefs: 004523CB
log, xrefs: 004522E9, 004522F8

Memory Dump Source

Source File: 00000000.00000002.3349183063.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3349183063.000000000058A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3349183063.0000000000590000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3349183063.0000000000593000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_2zdult23rz.jbxd

Similarity

API ID: DecodePointer
String ID: acos$asin$exp$log$log10$pow$sqrt
API String ID: 3527080286-3064271455
Opcode ID: 78e946a8a646183d16df3de3d23e88c0ab9a8f5197b1dee8433a7cf1ad31b41b
Instruction ID: bc8b7c0c72404b0f1092b03344519f1b29bd64598f75d1cbe0b332ea915a13b4
Opcode Fuzzy Hash: 78e946a8a646183d16df3de3d23e88c0ab9a8f5197b1dee8433a7cf1ad31b41b
Instruction Fuzzy Hash: 40513B70A0050ADBCF148F69DA481AE7FB4FB46306F144147EC81A7266C7FC8A6EDB59

Uniqueness

Uniqueness Score: -1.00%

Function 004177F0 Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 117COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 00417826
std::_Lockit::_Lockit.LIBCPMT ref: 00417848
std::_Lockit::~_Lockit.LIBCPMT ref: 00417868
__Getctype.LIBCPMT ref: 00417911
std::_Facet_Register.LIBCPMT ref: 00417930
std::_Lockit::~_Lockit.LIBCPMT ref: 00417948

Strings

\vA, xrefs: 00417873, 004178D8
0E@, xrefs: 0041790B

Memory Dump Source

Source File: 00000000.00000002.3349183063.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3349183063.000000000058A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3349183063.0000000000590000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3349183063.0000000000593000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_2zdult23rz.jbxd

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Facet_GetctypeRegister
String ID: 0E@$\vA
API String ID: 1102183713-2226545
Opcode ID: 5ce362214d94140fd8bcfa868daed7a92143abca53e426fa9f2a0771951e31b2
Instruction ID: 09abc8fdb797d46040b568194e29cb2883a52247b0fc0860c35a2cd0411dedce
Opcode Fuzzy Hash: 5ce362214d94140fd8bcfa868daed7a92143abca53e426fa9f2a0771951e31b2
Instruction Fuzzy Hash: 1041DF70E042159FCB10DF58D985AAEBBB4EB14710F24826AE806AB351DB34AE84CBD5

Uniqueness

Uniqueness Score: -1.00%

Function 00551130 Relevance: 13.6, APIs: 9, Instructions: 88sleepfileCOMMON

Download Yara Rule

APIs

Part of subcall function 00551780: GetVersionExA.KERNEL32(?), ref: 005517A6

GetVersionExA.KERNEL32(?), ref: 00551173
DeleteFileW.KERNEL32(00000000), ref: 00551192
GetFileAttributesW.KERNEL32(00000000), ref: 00551199
GetLastError.KERNEL32 ref: 005511A6
Sleep.KERNEL32(00000064), ref: 005511BC
DeleteFileA.KERNEL32(00000000), ref: 005511C5
GetFileAttributesA.KERNEL32(00000000), ref: 005511CC
GetLastError.KERNEL32 ref: 005511D9
Sleep.KERNEL32(00000064), ref: 005511EF

Memory Dump Source

Source File: 00000000.00000002.3349183063.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3349183063.000000000058A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3349183063.0000000000590000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3349183063.0000000000593000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_2zdult23rz.jbxd

Similarity

API ID: File$AttributesDeleteErrorLastSleepVersion
String ID:
API String ID: 1421123951-0
Opcode ID: 254916c3e086d8c6bc62c099ca2d2d4904ded30bcc8ed0b7d7c71cfea1b2b4f0
Instruction ID: 2cf516fa490645c339834e1360d609708cb136430ee32b1ceb257c2769835cc0
Opcode Fuzzy Hash: 254916c3e086d8c6bc62c099ca2d2d4904ded30bcc8ed0b7d7c71cfea1b2b4f0
Instruction Fuzzy Hash: 5F21F635900E149BCB20AB78AC9C2AD7EB4FB6A336F100197EE1AD3280DA704849D751

Uniqueness

Uniqueness Score: -1.00%

Function 004FA570 Relevance: 12.7, APIs: 6, Strings: 1, Instructions: 406libraryloaderCOMMON

Download Yara Rule

APIs

GetProcAddress.KERNEL32(00000000,?), ref: 004FA60F
GetProcAddress.KERNEL32 ref: 004FA6FD
GetProcAddress.KERNEL32(00000000,?), ref: 004FAA56

Strings

oG, xrefs: 004FA637

Memory Dump Source

Source File: 00000000.00000002.3349183063.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3349183063.000000000058A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3349183063.0000000000590000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3349183063.0000000000593000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_2zdult23rz.jbxd

Similarity

API ID: AddressProc
String ID: oG
API String ID: 190572456-640269701
Opcode ID: 33fd1c439eafc3505eccf3fcbfca229b35a13e3ed88270e9ff94ed8903c26656
Instruction ID: ebb65e544f4b55e3f8542421140664e1fb1608402e4cfdf1bbd5af7b98d055f7
Opcode Fuzzy Hash: 33fd1c439eafc3505eccf3fcbfca229b35a13e3ed88270e9ff94ed8903c26656
Instruction Fuzzy Hash: 052257B8D05208EFDB54CFA8D69099CBBB1FB48310F2085AAD459BB351DB706B81EF44

Uniqueness

Uniqueness Score: -1.00%

Function 004194E0 Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 100COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 00419503
std::_Lockit::_Lockit.LIBCPMT ref: 00419525
std::_Lockit::~_Lockit.LIBCPMT ref: 00419545
std::_Facet_Register.LIBCPMT ref: 004195ED
std::_Lockit::~_Lockit.LIBCPMT ref: 00419605

Strings

rA, xrefs: 004195AC
rA, xrefs: 00419550

Memory Dump Source

Source File: 00000000.00000002.3349183063.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3349183063.000000000058A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3349183063.0000000000590000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3349183063.0000000000593000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_2zdult23rz.jbxd

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Facet_Register
String ID: rA$rA
API String ID: 459529453-3077158656
Opcode ID: 48346a4b37d6e1cd3ba8cbbf1d4ec3c7fffbc0c2fe5b83c24005499ebec7f7a9
Instruction ID: f82415891cd8211b3ee928bea85c35c3d7de34b435ea50990ee9c55b5ecdff82
Opcode Fuzzy Hash: 48346a4b37d6e1cd3ba8cbbf1d4ec3c7fffbc0c2fe5b83c24005499ebec7f7a9
Instruction Fuzzy Hash: 9141FF71A00114EBCB11CF58D890BAEBBB5FF40754F14412EE80AAB391D738ED45CB95

Uniqueness

Uniqueness Score: -1.00%

Function 004F59C0 Relevance: 12.3, APIs: 8, Instructions: 339libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(?), ref: 004F5AF1
GetProcAddress.KERNEL32(00000000,?), ref: 004F5AFD
CreateEventA.KERNEL32(00000000,00000001,00000000,?), ref: 004F5C8A
SetEvent.KERNEL32(00000000), ref: 004F5C91

Memory Dump Source

Source File: 00000000.00000002.3349183063.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3349183063.000000000058A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3349183063.0000000000590000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3349183063.0000000000593000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_2zdult23rz.jbxd

Similarity

API ID: Event$AddressCreateHandleModuleProc
String ID:
API String ID: 2341598627-0
Opcode ID: d109a23d399d555b11f58c63a38eb96ac9726a57879fb5c022911b9b90253375
Instruction ID: ab29904312227280e52672ba860979ed658178f04e72ca629b13ed8f0c29f346
Opcode Fuzzy Hash: d109a23d399d555b11f58c63a38eb96ac9726a57879fb5c022911b9b90253375
Instruction Fuzzy Hash: B5F1E2B49083489FD714CF69D880A9EFBF4FB88354F148A5EE9A9A7350D7309A41CF16

Uniqueness

Uniqueness Score: -1.00%

Function 004FA2D0 Relevance: 12.2, APIs: 8, Instructions: 165networkCOMMON

Download Yara Rule

APIs

InternetSetOptionA.WININET(00000000,00000006,?,00000004), ref: 004FA320
GetLastError.KERNEL32 ref: 004FA415
InternetQueryOptionA.WININET(00000000,0000001F,80000000,?), ref: 004FA440

Memory Dump Source

Source File: 00000000.00000002.3349183063.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3349183063.000000000058A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3349183063.0000000000590000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3349183063.0000000000593000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_2zdult23rz.jbxd

Similarity

API ID: InternetOption$ErrorLastQuery
String ID:
API String ID: 3980908186-0
Opcode ID: 13505afe8bee8b3cefde12bb8587481c6416af93cd2c35f6481ac9ff60e3cb98
Instruction ID: f01b2b404452f55ee339e3d54677c8633c7154c7c4ff77dbfa4ec76481364019
Opcode Fuzzy Hash: 13505afe8bee8b3cefde12bb8587481c6416af93cd2c35f6481ac9ff60e3cb98
Instruction Fuzzy Hash: B7515EB5D40318ABEB20CF94DC85BFEBBB4EB48711F10411AEE14B7380D7B46A059BA5

Uniqueness

Uniqueness Score: -1.00%

Function 005519B0 Relevance: 12.1, APIs: 8, Instructions: 141filesleepCOMMON

Download Yara Rule

APIs

LockFile.KERNEL32(00000000,40000000,00000000,00000001,00000000), ref: 00551A13
Sleep.KERNEL32(00000001), ref: 00551A21
GetLastError.KERNEL32 ref: 00551A38
UnlockFile.KERNEL32(00000000,40000000,00000000,?,00000000), ref: 00551A83

Memory Dump Source

Source File: 00000000.00000002.3349183063.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3349183063.000000000058A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3349183063.0000000000590000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3349183063.0000000000593000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_2zdult23rz.jbxd

Similarity

API ID: File$ErrorLastLockSleepUnlock
String ID:
API String ID: 3015003838-0
Opcode ID: f314dbaf667b006f79d421b092528d3be634706ec04991754e085598023d61a6
Instruction ID: 1a32dd69ea1bb1e7667ccce0abadb203d749469daee7398687d0a90ca2f09069
Opcode Fuzzy Hash: f314dbaf667b006f79d421b092528d3be634706ec04991754e085598023d61a6
Instruction Fuzzy Hash: 8341D531B02B156BDB318A28DDA575EBF65FB94722F208217ED08AB340D7719D88C7C4

Uniqueness

Uniqueness Score: -1.00%

Function 004F9F20 Relevance: 12.1, APIs: 8, Instructions: 122memorystringCOMMON

Download Yara Rule

APIs

CharNextA.USER32 ref: 004F9F45
CharNextA.USER32 ref: 004F9F5C
CharNextA.USER32 ref: 004F9F75
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 004F9FA6
lstrlenA.KERNEL32(?,00000000,00000000,00000003,00000000), ref: 004FA00C
GetProcessHeap.KERNEL32(00000008,?,00000000,00000000,00000003,00000000), ref: 004FA022
HeapAlloc.KERNEL32(00000000), ref: 004FA029
lstrcpynA.KERNEL32(00000000,?,?), ref: 004FA036

Memory Dump Source

Source File: 00000000.00000002.3349183063.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3349183063.000000000058A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3349183063.0000000000590000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3349183063.0000000000593000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_2zdult23rz.jbxd

Similarity

API ID: CharNext$Heap$AllocProcessUnothrow_t@std@@@__ehfuncinfo$??2@lstrcpynlstrlen
String ID:
API String ID: 1659885099-0
Opcode ID: 03b31b514a5a5bdda045a1bb753ed8d65a6b884bdd88744eed651d4e0cf060da
Instruction ID: 6765c8874e15113026cbde70767e16841385025c065108afb9b47ee34e1d185f
Opcode Fuzzy Hash: 03b31b514a5a5bdda045a1bb753ed8d65a6b884bdd88744eed651d4e0cf060da
Instruction Fuzzy Hash: 2A4106715042089FCB21CF6D98846B6BBE9EF6E314B14415BEE48E7320D7349C469B78

Uniqueness

Uniqueness Score: -1.00%

Function 004463F6 Relevance: 10.8, APIs: 7, Instructions: 329COMMON

Download Yara Rule

APIs

_strrchr.LIBCMT ref: 0044647C

Memory Dump Source

Source File: 00000000.00000002.3349183063.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3349183063.000000000058A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3349183063.0000000000590000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3349183063.0000000000593000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_2zdult23rz.jbxd

Similarity

API ID: _strrchr
String ID:
API String ID: 3213747228-0
Opcode ID: 34bc779386904af94e3a65745d8093cf5441aa8cc4e4cdc27bc5775c85d1135f
Instruction ID: 2b99461290635fdf7c51841e77c4c0c2a1f842bf94a4ab4c5a5740794f6651be
Opcode Fuzzy Hash: 34bc779386904af94e3a65745d8093cf5441aa8cc4e4cdc27bc5775c85d1135f
Instruction Fuzzy Hash: F7B16A72900255AFFB118F24CC81BAF7BA5EF17354F16415BE804AB382D67CD901CBAA

Uniqueness

Uniqueness Score: -1.00%

Function 00431B60 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 132COMMON

Download Yara Rule

APIs

_ValidateLocalCookies.LIBCMT ref: 00431B97
___except_validate_context_record.LIBVCRUNTIME ref: 00431B9F
_ValidateLocalCookies.LIBCMT ref: 00431C28
__IsNonwritableInCurrentImage.LIBCMT ref: 00431C53
_ValidateLocalCookies.LIBCMT ref: 00431CA8

Strings

csm, xrefs: 00431C3D

Memory Dump Source

Source File: 00000000.00000002.3349183063.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3349183063.000000000058A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3349183063.0000000000590000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3349183063.0000000000593000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_2zdult23rz.jbxd

Similarity

API ID: CookiesLocalValidate$CurrentImageNonwritable___except_validate_context_record
String ID: csm
API String ID: 1170836740-1018135373
Opcode ID: f167ac4cbc0b3b9c8b624ea0916c7860bb678a2d2bf17d7334bf3ba534fc49b9
Instruction ID: 00089ecd58738c76d8715bf1292c521005f35f5fc362e079b464ccdb9f512a68
Opcode Fuzzy Hash: f167ac4cbc0b3b9c8b624ea0916c7860bb678a2d2bf17d7334bf3ba534fc49b9
Instruction Fuzzy Hash: 1441C730A002089BCF10DF69D845A9FBBF5FF09314F14A05BE8149B3A2D779EA15CB95

Uniqueness

Uniqueness Score: -1.00%

Function 00550C20 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 81windowCOMMON

Download Yara Rule

APIs

GetLastError.KERNEL32 ref: 00550C2B
GetVersionExA.KERNEL32(?), ref: 00550C50
FormatMessageW.KERNEL32(00001300,00000000,00000000,00000000,?,00000000,00000000), ref: 00550C83
LocalFree.KERNEL32(?), ref: 00550C9A
FormatMessageA.KERNEL32(00001300,00000000,00000000,00000000,?,00000000,00000000), ref: 00550CD3

Part of subcall function 00551FA0: AreFileApisANSI.KERNEL32(00000000,00000000,?,?,?,00550CE5), ref: 00551FAC
Part of subcall function 00551FA0: MultiByteToWideChar.KERNEL32(00000001,00000000,?,000000FF,00000000,00000000,?,?,?,00550CE5), ref: 00551FC1
Part of subcall function 00551FA0: MultiByteToWideChar.KERNEL32(00000001,00000000,?,000000FF,00000000,00000000), ref: 00551FE7

Strings

OsError 0x%x (%u), xrefs: 00550CEE

Memory Dump Source

Source File: 00000000.00000002.3349183063.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3349183063.000000000058A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3349183063.0000000000590000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3349183063.0000000000593000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_2zdult23rz.jbxd

Similarity

API ID: ByteCharFormatMessageMultiWide$ApisErrorFileFreeLastLocalVersion
String ID: OsError 0x%x (%u)
API String ID: 807219750-2664311388
Opcode ID: cd324edbeeec52278ffea66cb50500e71f7e35b7cc21714691c6525984e38f6a
Instruction ID: 08cd3c40af0c2fcdf6899e604bb854dbb55886f7669cb3a7ffab2d22d202db60
Opcode Fuzzy Hash: cd324edbeeec52278ffea66cb50500e71f7e35b7cc21714691c6525984e38f6a
Instruction Fuzzy Hash: DC21F831A44204BBDB20AF65DC1AFAE7F78FF45751F1000AAFD09A6290DA709E08DB61

Uniqueness

Uniqueness Score: -1.00%

Function 00445C0E Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 74COMMONLIBRARYCODE

Download Yara Rule

APIs

FreeLibrary.KERNEL32(00000000,?,00445D1D,0040390D,?,00000000,?,?,?,00445F47,00000022,FlsSetValue,00566B90,00566B98,?), ref: 00445CCF

Strings

api-ms-, xrefs: 00445C65
ext-ms-, xrefs: 00445C79

Memory Dump Source

Source File: 00000000.00000002.3349183063.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3349183063.000000000058A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3349183063.0000000000590000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3349183063.0000000000593000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_2zdult23rz.jbxd

Similarity

API ID: FreeLibrary
String ID: api-ms-$ext-ms-
API String ID: 3664257935-537541572
Opcode ID: bb92fe7f77a9a60fedb79d5c16dfdd37ff0c4ae1ee88665c25182e52ac412831
Instruction ID: 12b6cf18798c9e2326ec9fd18e61984b9916515d6beb6ef8b0fade810c99d971
Opcode Fuzzy Hash: bb92fe7f77a9a60fedb79d5c16dfdd37ff0c4ae1ee88665c25182e52ac412831
Instruction Fuzzy Hash: D2212B31A01B11A7EF219B24AC81A5B3768EB617B0F240112ED06E7391DB78ED04DAD5

Uniqueness

Uniqueness Score: -1.00%

Function 004528B3 Relevance: 10.5, APIs: 3, Strings: 3, Instructions: 45libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(KERNEL32.DLL,?,?,0045292E,00452AD7), ref: 004528CA
GetProcAddress.KERNEL32(00000000,AcquireSRWLockExclusive), ref: 004528E0
GetProcAddress.KERNEL32(00000000,ReleaseSRWLockExclusive), ref: 004528F5

Strings

KERNEL32.DLL, xrefs: 004528C5
AcquireSRWLockExclusive, xrefs: 004528DA
ReleaseSRWLockExclusive, xrefs: 004528EA

Memory Dump Source

Source File: 00000000.00000002.3349183063.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3349183063.000000000058A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3349183063.0000000000590000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3349183063.0000000000593000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_2zdult23rz.jbxd

Similarity

API ID: AddressProc$HandleModule
String ID: AcquireSRWLockExclusive$KERNEL32.DLL$ReleaseSRWLockExclusive
API String ID: 667068680-1718035505
Opcode ID: 5ca132e14272f3b082404aaa7a6dd11ed0959ef9272e18b7197f08eea655af98
Instruction ID: 729d5fff529096ec94aeb90dbf1dcce1d83b151dad17e07028f84ed9cc8fa2d5
Opcode Fuzzy Hash: 5ca132e14272f3b082404aaa7a6dd11ed0959ef9272e18b7197f08eea655af98
Instruction Fuzzy Hash: 44F028F1701223674B251EA45E8063B36D8FB13356700113BDC01F3342EAD8CC8EA79A

Uniqueness

Uniqueness Score: -1.00%

Function 0045074D Relevance: 9.2, APIs: 6, Instructions: 248COMMON

Download Yara Rule

APIs

GetCPInfo.KERNEL32(00000000,00000001,?,7FFFFFFF,?,00450A1D,00000000,00000000,?,00000001,?,?,?,?,00000001,?), ref: 004507F3
__freea.LIBCMT ref: 00450988
__freea.LIBCMT ref: 0045098E
__freea.LIBCMT ref: 004509C4
__freea.LIBCMT ref: 004509CA
__freea.LIBCMT ref: 004509DA

Memory Dump Source

Source File: 00000000.00000002.3349183063.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3349183063.000000000058A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3349183063.0000000000590000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3349183063.0000000000593000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_2zdult23rz.jbxd

Similarity

API ID: __freea$Info
String ID:
API String ID: 541289543-0
Opcode ID: 7ae90ec05b67949f3af620a9af225e5826dd7639eb69a58de472c3d5dfabbd17
Instruction ID: 7f4fb2f38fc2a3d88391827f987f0ec3a0eaf25df59567eae6c8024b596d3b8f
Opcode Fuzzy Hash: 7ae90ec05b67949f3af620a9af225e5826dd7639eb69a58de472c3d5dfabbd17
Instruction Fuzzy Hash: 3A71D5BA900205ABEF21AE558C42FAF77A59F49315F29041BEC44B7383D63D9C08C799

Uniqueness

Uniqueness Score: -1.00%

Function 0042DBF9 Relevance: 9.2, APIs: 6, Instructions: 225COMMONLIBRARYCODE

Download Yara Rule

APIs

GetCPInfo.KERNEL32(?,?,?,?,?), ref: 0042DC84
MultiByteToWideChar.KERNEL32(?,00000009,?,?,00000000,00000000), ref: 0042DD10
MultiByteToWideChar.KERNEL32(?,00000001,?,?,00000000,?), ref: 0042DD7B
MultiByteToWideChar.KERNEL32(?,00000009,?,?,00000000,00000000), ref: 0042DD97
MultiByteToWideChar.KERNEL32(?,00000001,?,?,00000000,?), ref: 0042DDFA
CompareStringEx.KERNEL32(?,?,00000000,?,00000000,?,00000000,00000000,00000000), ref: 0042DE17

Memory Dump Source

Source File: 00000000.00000002.3349183063.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3349183063.000000000058A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3349183063.0000000000590000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3349183063.0000000000593000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_2zdult23rz.jbxd

Similarity

API ID: ByteCharMultiWide$CompareInfoString
String ID:
API String ID: 2984826149-0
Opcode ID: 4c9a90a3dea74e2108ad6b7928db56527dcac77587bbea659fc7601973b93a34
Instruction ID: e9bc3badf4b96eefdde01511e177a356cb443475cd584fb63612fd280f30124b
Opcode Fuzzy Hash: 4c9a90a3dea74e2108ad6b7928db56527dcac77587bbea659fc7601973b93a34
Instruction Fuzzy Hash: A971EF32F006299BDF209F65EC45BFFBBB5AF59710F95001BE854AB290D6788C00C7A9

Uniqueness

Uniqueness Score: -1.00%

Function 004F1770 Relevance: 9.2, APIs: 6, Instructions: 209COMMON

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(0000FDE9,00000000,?,000000FF,00000000,00000000), ref: 004F17F9
MultiByteToWideChar.KERNEL32(0000000F,00000000,?,000000FF,00000000,0000000F), ref: 004F182D
WideCharToMultiByte.KERNEL32(000004E3,00000000,00000000,000000FF,00000000,00000000,00000000,00000000), ref: 004F1854
WideCharToMultiByte.KERNEL32(?,00000000,00000000,000000FF,00000000,?,00000000,00000000), ref: 004F1882
WideCharToMultiByte.KERNEL32(?,00000000,?,000000FF,00000000,00000000,00000000,00000000,?,000004E3), ref: 004F192C
WideCharToMultiByte.KERNEL32(?,00000000,0000000F,000000FF,00000000,00000000,00000000,00000000), ref: 004F1957

Memory Dump Source

Source File: 00000000.00000002.3349183063.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3349183063.000000000058A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3349183063.0000000000590000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3349183063.0000000000593000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_2zdult23rz.jbxd

Similarity

API ID: ByteCharMultiWide
String ID:
API String ID: 626452242-0
Opcode ID: b243b1d06e98ba986ab6623083b8fafbda3b67136764b6e60c675227b3c12ef3
Instruction ID: c171202e14bccd46751fe906430aab80820f84c3078230ed5993c6e32c17da72
Opcode Fuzzy Hash: b243b1d06e98ba986ab6623083b8fafbda3b67136764b6e60c675227b3c12ef3
Instruction Fuzzy Hash: EB51FB71A00215BBDB209F65DC06FAF7AA5EF45760F24032AFA14B73D0D7B9990087E9

Uniqueness

Uniqueness Score: -1.00%

Function 0042D939 Relevance: 9.2, APIs: 6, Instructions: 175COMMONLIBRARYCODE

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(00000000,00000000,00000001,?,00000000,00000000,?,?,?,00000001), ref: 0042D982
MultiByteToWideChar.KERNEL32(00000001,00000001,00000000,?,00000000,00000000), ref: 0042D9ED
LCMapStringEx.KERNEL32(?,?,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 0042DA0A
LCMapStringEx.KERNEL32(?,?,00000000,00000000,00000000,?,00000000,00000000,00000000), ref: 0042DA49
LCMapStringEx.KERNEL32(?,?,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 0042DAA8
WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,00000000,?,?,00000000,00000000), ref: 0042DACB

Memory Dump Source

Source File: 00000000.00000002.3349183063.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3349183063.000000000058A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3349183063.0000000000590000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3349183063.0000000000593000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_2zdult23rz.jbxd

Similarity

API ID: ByteCharMultiStringWide
String ID:
API String ID: 2829165498-0
Opcode ID: e437e0c0af398b2dc6ece3cc5697cfe5836360b16713ca35af6ef7086f63228d
Instruction ID: 7ced6e395bd95c176d412ce2a3b5c4c8357bf70d43b6ddba362163eb6abffa5e
Opcode Fuzzy Hash: e437e0c0af398b2dc6ece3cc5697cfe5836360b16713ca35af6ef7086f63228d
Instruction Fuzzy Hash: 1351E172A00226ABDF209FA5EC45FAB3BB9EF44754F54402AF905E6290D778CC40DB98

Uniqueness

Uniqueness Score: -1.00%

Function 0041A2A0 Relevance: 9.1, APIs: 6, Instructions: 141COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 0041A2CA
std::_Lockit::_Lockit.LIBCPMT ref: 0041A2EC
std::_Lockit::~_Lockit.LIBCPMT ref: 0041A30C
__Getcoll.LIBCPMT ref: 0041A3AF
std::_Facet_Register.LIBCPMT ref: 0041A413
std::_Lockit::~_Lockit.LIBCPMT ref: 0041A42B

Memory Dump Source

Source File: 00000000.00000002.3349183063.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3349183063.000000000058A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3349183063.0000000000590000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3349183063.0000000000593000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_2zdult23rz.jbxd

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Facet_GetcollRegister
String ID:
API String ID: 1184649410-0
Opcode ID: 076d0fe7c93981d2d41f397725067e6f3a6359fb17fddf899550ac6be59329cf
Instruction ID: 4dfe593e994f1a936f3b51d0b47bc881a4e76fe992b8c8e0f1a10b66f2d188dc
Opcode Fuzzy Hash: 076d0fe7c93981d2d41f397725067e6f3a6359fb17fddf899550ac6be59329cf
Instruction Fuzzy Hash: C751F0B0901218DFCB11DF59E9857EEBBB0EF04314F14411EE806AB381D738AE85CB96

Uniqueness

Uniqueness Score: -1.00%

Function 0041A800 Relevance: 9.1, APIs: 4, Strings: 1, Instructions: 378COMMON

Download Yara Rule

APIs

___std_exception_destroy.LIBVCRUNTIME ref: 0041A959
___std_exception_destroy.LIBVCRUNTIME ref: 0041A972
___std_exception_destroy.LIBVCRUNTIME ref: 0041AB4E
___std_exception_destroy.LIBVCRUNTIME ref: 0041AB67

Strings

value, xrefs: 0041A8B3, 0041AAA2

Memory Dump Source

Source File: 00000000.00000002.3349183063.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3349183063.000000000058A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3349183063.0000000000590000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3349183063.0000000000593000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_2zdult23rz.jbxd

Similarity

API ID: ___std_exception_destroy
String ID: value
API String ID: 4194217158-494360628
Opcode ID: 1380824a95bc997cd1a618de76426d84b46abf83204bb8d30c209254a19dc526
Instruction ID: 9f034d729ebebe199f4f723a1c14bfd040db2caa5f80a11ca9a640f2ae4bdf80
Opcode Fuzzy Hash: 1380824a95bc997cd1a618de76426d84b46abf83204bb8d30c209254a19dc526
Instruction Fuzzy Hash: 8DF10370D002488FDB14DF65C844BEEBBB4BF15304F14829EE455A7782E7786A88CFA6

Uniqueness

Uniqueness Score: -1.00%

Function 00431CE8 Relevance: 9.1, APIs: 6, Instructions: 60COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32(?,?,00431CDF,0042F5D3,0042EBF1), ref: 00431CF6
___vcrt_FlsGetValue.LIBVCRUNTIME ref: 00431D04
___vcrt_FlsSetValue.LIBVCRUNTIME ref: 00431D1D
SetLastError.KERNEL32(00000000,00431CDF,0042F5D3,0042EBF1), ref: 00431D6F

Memory Dump Source

Source File: 00000000.00000002.3349183063.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3349183063.000000000058A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3349183063.0000000000590000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3349183063.0000000000593000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_2zdult23rz.jbxd

Similarity

API ID: ErrorLastValue___vcrt_
String ID:
API String ID: 3852720340-0
Opcode ID: bdf13b6d1d8e18a8b774bc6ee8821ea5a6160ca6eff986b5a5196f214e0a0951
Instruction ID: 84b5965ef68033184a41bf43324a8165c3f1a151a01a13dd34567c870461e457
Opcode Fuzzy Hash: bdf13b6d1d8e18a8b774bc6ee8821ea5a6160ca6eff986b5a5196f214e0a0951
Instruction Fuzzy Hash: EF0128362082119EA7301775BC8966B2A95DB1A7B5F30332FF421711F0EF592C45A348

Uniqueness

Uniqueness Score: -1.00%

Function 00406670 Relevance: 9.0, APIs: 1, Strings: 4, Instructions: 271COMMON

Download Yara Rule

APIs

___std_exception_copy.LIBVCRUNTIME ref: 004069C5

Strings

0f@, xrefs: 004069A5
ror, xrefs: 004066C3
parse error, xrefs: 00406711
`l@, xrefs: 004069D7

Memory Dump Source

Source File: 00000000.00000002.3349183063.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3349183063.000000000058A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3349183063.0000000000590000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3349183063.0000000000593000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_2zdult23rz.jbxd

Similarity

API ID: ___std_exception_copy
String ID: 0f@$`l@$parse error$ror
API String ID: 2659868963-3266356038
Opcode ID: 53af6addfde28bf3a16ab36eea05e26c967cdf7b503d3b1760af8db5e788244e
Instruction ID: 449376e9882de2a67fd6c2ed42b49e996c61688416e34e3c9e616e75aad760e2
Opcode Fuzzy Hash: 53af6addfde28bf3a16ab36eea05e26c967cdf7b503d3b1760af8db5e788244e
Instruction Fuzzy Hash: CCB1EE71E002488FDB18DF68DC84BADBB71FF46304F1483AAE4097B792D7789A949B54

Uniqueness

Uniqueness Score: -1.00%

Function 00551580 Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 147COMMON

Download Yara Rule

APIs

GetVersionExA.KERNEL32(?,?), ref: 005515D0
GetTempPathW.KERNEL32(000000E6,?,?), ref: 005515F9

Strings

>, xrefs: 005516E8
%s\etilqs_, xrefs: 005516AA

Memory Dump Source

Source File: 00000000.00000002.3349183063.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3349183063.000000000058A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3349183063.0000000000590000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3349183063.0000000000593000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_2zdult23rz.jbxd

Similarity

API ID: PathTempVersion
String ID: %s\etilqs_$>
API String ID: 261301950-2315843240
Opcode ID: f25726f1e54d4f4ef8faa3df188ffecf925dce7fef9fbd8a06b7c9e5c1ea5f56
Instruction ID: 10c6a091e89028816bd95ca4d441c96f5f11479c74e12f78acaf84c47584f488
Opcode Fuzzy Hash: f25726f1e54d4f4ef8faa3df188ffecf925dce7fef9fbd8a06b7c9e5c1ea5f56
Instruction Fuzzy Hash: B4518970D046999EE721DB298C55BFABFE8FF19301F0805D6ED88D6081D6748F88DBA1

Uniqueness

Uniqueness Score: -1.00%

Function 0043DEC3 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 42libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetModuleHandleExW.KERNEL32(00000000,mscoree.dll,00000000,D7297C87,?,?,00000000,0055A0C5,000000FF,?,0043DE9F,?,?,0043DE73,00000016), ref: 0043DEF8
GetProcAddress.KERNEL32(00000000,CorExitProcess), ref: 0043DF0A
FreeLibrary.KERNEL32(00000000,?,00000000,0055A0C5,000000FF,?,0043DE9F,?,?,0043DE73,00000016), ref: 0043DF2C

Strings

CorExitProcess, xrefs: 0043DF02
mscoree.dll, xrefs: 0043DEF1

Memory Dump Source

Source File: 00000000.00000002.3349183063.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3349183063.000000000058A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3349183063.0000000000590000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3349183063.0000000000593000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_2zdult23rz.jbxd

Similarity

API ID: AddressFreeHandleLibraryModuleProc
String ID: CorExitProcess$mscoree.dll
API String ID: 4061214504-1276376045
Opcode ID: fca125d382e1b5cc48cf6e2e9d09fae4a142da3bcc5b7675a46a2c223c676057
Instruction ID: fbcb35437c5a4c45ec53554002b8eb8717f145508c6dfc8984853678761e14b7
Opcode Fuzzy Hash: fca125d382e1b5cc48cf6e2e9d09fae4a142da3bcc5b7675a46a2c223c676057
Instruction Fuzzy Hash: F101DB36A54A15EFDB118F44DC09BAFBBF9FB18B11F004526F812A32E0DBB49904CB50

Uniqueness

Uniqueness Score: -1.00%

Function 00423F30 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 33COMMON

Download Yara Rule

APIs

___std_exception_copy.LIBVCRUNTIME ref: 00423F4F
___std_exception_copy.LIBVCRUNTIME ref: 00423F76

Strings

0f@, xrefs: 00423F85
0f@, xrefs: 00423F54
0l@, xrefs: 00423F4E

Memory Dump Source

Source File: 00000000.00000002.3349183063.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3349183063.000000000058A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3349183063.0000000000590000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3349183063.0000000000593000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_2zdult23rz.jbxd

Similarity

API ID: ___std_exception_copy
String ID: 0f@$0f@$0l@
API String ID: 2659868963-2787657970
Opcode ID: c65e32f6735fcb137c2d1fd996eca7bd14c30204ce9567b6a2847fa40d2b6b7a
Instruction ID: f375550aee614b99a77dada843b986f06bd88d0e3ec64062bcfec3d2063ae6e2
Opcode Fuzzy Hash: c65e32f6735fcb137c2d1fd996eca7bd14c30204ce9567b6a2847fa40d2b6b7a
Instruction Fuzzy Hash: D1F0FFB6910B16AB8751DF65D440886FBFCFE55320350872BA51597A00F7B4F6588BA0

Uniqueness

Uniqueness Score: -1.00%

Function 004F5CB0 Relevance: 7.7, APIs: 5, Instructions: 190memorylibraryloaderCOMMON

Download Yara Rule

APIs

GetProcAddress.KERNEL32(00000000,?), ref: 004F5E39
GetProcessHeap.KERNEL32 ref: 004F5E44
HeapAlloc.KERNEL32(00000000,00000000,00010000), ref: 004F5E5E
HeapAlloc.KERNEL32(?,00000000,00010000), ref: 004F5E97

Memory Dump Source

Source File: 00000000.00000002.3349183063.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3349183063.000000000058A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3349183063.0000000000590000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3349183063.0000000000593000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_2zdult23rz.jbxd

Similarity

API ID: Heap$Alloc$AddressProcProcess
String ID:
API String ID: 4220703211-0
Opcode ID: d6095e5d8173e3d06b8f2856c133445701cc9fa8f876de273903c4e643227e6e
Instruction ID: 4d7a3249636ad6ee2c5aeb2fcc37e9dbf149da18a4f7f7fc0f63c71f66f52594
Opcode Fuzzy Hash: d6095e5d8173e3d06b8f2856c133445701cc9fa8f876de273903c4e643227e6e
Instruction Fuzzy Hash: AB81E3B5D0421DAFDB14CFA9D884AAEFBB4FB48310F1085AAE925B7340D7746A01CF65

Uniqueness

Uniqueness Score: -1.00%

Function 0042D458 Relevance: 7.6, APIs: 5, Instructions: 116threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 0042D46C
AcquireSRWLockExclusive.KERNEL32(00000008), ref: 0042D48B
AcquireSRWLockExclusive.KERNEL32(00000008,00000000), ref: 0042D4B9
TryAcquireSRWLockExclusive.KERNEL32(00000008,00000000), ref: 0042D514
TryAcquireSRWLockExclusive.KERNEL32(00000008,00000000), ref: 0042D52B

Memory Dump Source

Source File: 00000000.00000002.3349183063.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3349183063.000000000058A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3349183063.0000000000590000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3349183063.0000000000593000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_2zdult23rz.jbxd

Similarity

API ID: AcquireExclusiveLock$CurrentThread
String ID:
API String ID: 66001078-0
Opcode ID: c4c7fd52ac1ab7862176d27133f6c36aafb1f8b434feb743662d2ab8792a1d7f
Instruction ID: 8be80dfe2e115d21152cf456c31a50eb731196c477f4b8b6c1033f6e00c08db3
Opcode Fuzzy Hash: c4c7fd52ac1ab7862176d27133f6c36aafb1f8b434feb743662d2ab8792a1d7f
Instruction Fuzzy Hash: B0414C70F00626EBCB20DF69E49496AB3F4FF04358BA0492BD056D7640D7B8F985CB59

Uniqueness

Uniqueness Score: -1.00%

Function 00550F60 Relevance: 7.6, APIs: 5, Instructions: 98COMMON

Download Yara Rule

APIs

Part of subcall function 00551780: GetVersionExA.KERNEL32(?), ref: 005517A6

GetVersionExA.KERNEL32(?), ref: 00550F91
GetFullPathNameW.KERNEL32(00000000,00000000,00000000,00000000), ref: 00550FB6
GetFullPathNameW.KERNEL32(00000000,00000003,00000000,00000000), ref: 00550FD6
GetFullPathNameA.KERNEL32(00000000,00000000,00000000,00000000), ref: 00550FEF
GetFullPathNameA.KERNEL32(00000000,00000003,00000000,00000000), ref: 00551021

Memory Dump Source

Source File: 00000000.00000002.3349183063.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3349183063.000000000058A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3349183063.0000000000590000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3349183063.0000000000593000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_2zdult23rz.jbxd

Similarity

API ID: FullNamePath$Version
String ID:
API String ID: 495861893-0
Opcode ID: a3e1ebd5eab9eeac9c63c83744977c54ce12b85ae5b043f29705378faabacca7
Instruction ID: 74fd7fd09348e9c58995c5d938b6904648cc58af19013d0042ae03d894627d52
Opcode Fuzzy Hash: a3e1ebd5eab9eeac9c63c83744977c54ce12b85ae5b043f29705378faabacca7
Instruction Fuzzy Hash: F5213B7260051077D7207B74DC8AF6F3F58EF56305F000069FD0966251EE29A90D87AA

Uniqueness

Uniqueness Score: -1.00%

Function 0049BD50 Relevance: 7.6, APIs: 5, Instructions: 69processCOMMON

Download Yara Rule

APIs

CreateToolhelp32Snapshot.KERNEL32(00000002,00000000), ref: 0049BD63
Process32First.KERNEL32(00000000,?), ref: 0049BD86
Process32Next.KERNEL32(00000000,00000128), ref: 0049BDD1
CloseHandle.KERNEL32(00000000), ref: 0049BDDC
CloseHandle.KERNEL32(00000000), ref: 0049BDF2

Memory Dump Source

Source File: 00000000.00000002.3349183063.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3349183063.000000000058A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3349183063.0000000000590000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3349183063.0000000000593000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_2zdult23rz.jbxd

Similarity

API ID: CloseHandleProcess32$CreateFirstNextSnapshotToolhelp32
String ID:
API String ID: 1789362936-0
Opcode ID: 770a009acf8f9bb6be9b7da15cc158ae016ff230e17289c221e4c350a9282bdc
Instruction ID: 179694a4944585f9f9ceab1c5109c52cda788e9e908b8d20a4c13795b33160ab
Opcode Fuzzy Hash: 770a009acf8f9bb6be9b7da15cc158ae016ff230e17289c221e4c350a9282bdc
Instruction Fuzzy Hash: 8A11E2312041085BDB215F39BDC8AFB7BAAEB59724F0402BAE848C3340D7268C09C6E5

Uniqueness

Uniqueness Score: -1.00%

Function 004E3B50 Relevance: 7.4, APIs: 2, Strings: 2, Instructions: 391COMMON

Download Yara Rule

APIs

SHGetFolderPathA.SHELL32(00000000,0000001A,00000000,00000000,?,?,00000001), ref: 004E3F9F
SHGetFolderPathA.SHELL32(00000000,0000001C,00000000,00000000,?,?,?,?,?,00000001), ref: 004E3FC6

Strings

type must be string, but is , xrefs: 004E3EA4
cannot get value, xrefs: 004E3E4C, 004E3EE4

Memory Dump Source

Source File: 00000000.00000002.3349183063.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3349183063.000000000058A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3349183063.0000000000590000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3349183063.0000000000593000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_2zdult23rz.jbxd

Similarity

API ID: FolderPath
String ID: cannot get value$type must be string, but is
API String ID: 1514166925-4119898599
Opcode ID: 897a0b142082e284de431c6cf79ac79c07d8f67cd46eb1ebc2775b5815bfb6a3
Instruction ID: 5f4074a8749251ac841b06303bb2772f7504fa761187663bc7cc74ccbe1f17ba
Opcode Fuzzy Hash: 897a0b142082e284de431c6cf79ac79c07d8f67cd46eb1ebc2775b5815bfb6a3
Instruction Fuzzy Hash: 28F17BB0D002489FDB15DF99D885BDEBBB4AF08315F14419AE409B7382DB34AE84CF65

Uniqueness

Uniqueness Score: -1.00%

Function 0043FA9B Relevance: 7.4, APIs: 2, Strings: 2, Instructions: 370COMMONLIBRARYCODE

Download Yara Rule

APIs

__freea.LIBCMT ref: 0043FC15
__freea.LIBCMT ref: 0043FC31

Strings

am/pm, xrefs: 0043FC93
a/p, xrefs: 0043FCF7

Memory Dump Source

Source File: 00000000.00000002.3349183063.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3349183063.000000000058A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3349183063.0000000000590000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3349183063.0000000000593000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_2zdult23rz.jbxd

Similarity

API ID: __freea
String ID: a/p$am/pm
API String ID: 240046367-3206640213
Opcode ID: 3ccfd02491b33441ae641c522ae442bb272192df0b8c9e4cf4876a613e76a739
Instruction ID: ce77a60b7f6bd147e37a680d805faa3ed9203eb9173c0ce421d6ff856f2014af
Opcode Fuzzy Hash: 3ccfd02491b33441ae641c522ae442bb272192df0b8c9e4cf4876a613e76a739
Instruction Fuzzy Hash: F5C1CF31D00216DACB248F68C85AABB77B0FF0D704F14606BE905AB761D27C9D49CB6A

Uniqueness

Uniqueness Score: -1.00%

Function 004054C0 Relevance: 7.3, APIs: 1, Strings: 3, Instructions: 286COMMON

Download Yara Rule

APIs

___std_exception_destroy.LIBVCRUNTIME ref: 004057F2

Strings

: ", xrefs: 004055B1
PT@, xrefs: 00405556, 00405570, 00405571
", ", xrefs: 004055DB

Memory Dump Source

Source File: 00000000.00000002.3349183063.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3349183063.000000000058A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3349183063.0000000000590000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3349183063.0000000000593000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_2zdult23rz.jbxd

Similarity

API ID: ___std_exception_destroy
String ID: ", "$: "$PT@
API String ID: 4194217158-3328579350
Opcode ID: 1d914cb4df4c410c17ad2a379a699a095bfe012290a2b2c59d39d768030863e2
Instruction ID: beecba9c061fcb792caf6fe18827fc463081bcb852eebce76362f3cd81d64849
Opcode Fuzzy Hash: 1d914cb4df4c410c17ad2a379a699a095bfe012290a2b2c59d39d768030863e2
Instruction Fuzzy Hash: 97A10670A006049FCB18DF68D881BAFB7F5FF44304F14462EE456A7381EB79AA44DB99

Uniqueness

Uniqueness Score: -1.00%

Function 00407270 Relevance: 7.2, APIs: 1, Strings: 3, Instructions: 228COMMON

Download Yara Rule

APIs

___std_exception_copy.LIBVCRUNTIME ref: 004073FD

Strings

ror, xrefs: 0040729F
0f@, xrefs: 004073DD
0f@, xrefs: 0040740F

Memory Dump Source

Source File: 00000000.00000002.3349183063.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3349183063.000000000058A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3349183063.0000000000590000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3349183063.0000000000593000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_2zdult23rz.jbxd

Similarity

API ID: ___std_exception_copy
String ID: 0f@$0f@$ror
API String ID: 2659868963-919343903
Opcode ID: 54ef4146cc9973e50abdb5aac5b5de4deb1e0ccdb64d7a1b44ba731a5b074de1
Instruction ID: 2d5b59f1ef23ddaf1b3783c953f764ee005f0a1066ad4b0af46aed6f156e7821
Opcode Fuzzy Hash: 54ef4146cc9973e50abdb5aac5b5de4deb1e0ccdb64d7a1b44ba731a5b074de1
Instruction Fuzzy Hash: 0981E471D002149FDB14DF98DC81BADBBB1FF49304F14826EE858AB392D774A980DB95

Uniqueness

Uniqueness Score: -1.00%

Function 00405790 Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 187COMMON

Download Yara Rule

APIs

___std_exception_destroy.LIBVCRUNTIME ref: 004057F2
___std_exception_destroy.LIBVCRUNTIME ref: 0040587F
___std_exception_copy.LIBVCRUNTIME ref: 00405948

Strings

recursive_directory_iterator::operator++, xrefs: 004058CC

Memory Dump Source

Source File: 00000000.00000002.3349183063.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3349183063.000000000058A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3349183063.0000000000590000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3349183063.0000000000593000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_2zdult23rz.jbxd

Similarity

API ID: ___std_exception_destroy$___std_exception_copy
String ID: recursive_directory_iterator::operator++
API String ID: 1206660477-953255998
Opcode ID: f6bc180c89745b515f5c8cb3eb487b2218bfc922370238037f455579fa96e755
Instruction ID: 70a2b4d5c69838f3855fcd26299ade6cc1abe9a30ceb6adbb4f24180c4878fba
Opcode Fuzzy Hash: f6bc180c89745b515f5c8cb3eb487b2218bfc922370238037f455579fa96e755
Instruction Fuzzy Hash: 2051E6B1900614ABC724EF25D845B9BBBF8FF04714F04462EF95693A81E778F944CBA4

Uniqueness

Uniqueness Score: -1.00%

Function 00406A30 Relevance: 7.2, APIs: 2, Strings: 2, Instructions: 183COMMON

Download Yara Rule

APIs

___std_exception_destroy.LIBVCRUNTIME ref: 00406C3E
___std_exception_destroy.LIBVCRUNTIME ref: 00406C4D

Strings

at line , xrefs: 00406A88
, column , xrefs: 00406AD2

Memory Dump Source

Source File: 00000000.00000002.3349183063.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3349183063.000000000058A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3349183063.0000000000590000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3349183063.0000000000593000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_2zdult23rz.jbxd

Similarity

API ID: ___std_exception_destroy
String ID: at line $, column
API String ID: 4194217158-191570568
Opcode ID: 0ed6072321b7ec8eccecababb1c0c26a46a7ebb2679eb07bb6eee8d1640a387e
Instruction ID: 827c67b6778cf999f6b6b911b024970c268a0656788cb1af533502aee38e3479
Opcode Fuzzy Hash: 0ed6072321b7ec8eccecababb1c0c26a46a7ebb2679eb07bb6eee8d1640a387e
Instruction Fuzzy Hash: E5513571D002049FDB08DF68DD857AEBBB5EF45304F14826EF416BB792D7B8AA808794

Uniqueness

Uniqueness Score: -1.00%

Function 00407080 Relevance: 7.2, APIs: 1, Strings: 3, Instructions: 159COMMON

Download Yara Rule

APIs

___std_exception_copy.LIBVCRUNTIME ref: 004071FE

Strings

0f@, xrefs: 00407210
0f@, xrefs: 004071E2
ange, xrefs: 004070AF

Memory Dump Source

Source File: 00000000.00000002.3349183063.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3349183063.000000000058A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3349183063.0000000000590000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3349183063.0000000000593000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_2zdult23rz.jbxd

Similarity

API ID: ___std_exception_copy
String ID: 0f@$0f@$ange
API String ID: 2659868963-373280750
Opcode ID: ec8c38be1f093bccec6f39d26ed8a8a50c4b02158e6fab184ee58c429a3f3a88
Instruction ID: 288f119f4ccb4c7cf0b8972ea0ca9e4329cc491e57a4aee3b53e0c7375ef9e73
Opcode Fuzzy Hash: ec8c38be1f093bccec6f39d26ed8a8a50c4b02158e6fab184ee58c429a3f3a88
Instruction Fuzzy Hash: 3E51F371D002449BDB18CFA8DC847ADBBB0FF85304F24836EE4157B391E7B8A9848B55

Uniqueness

Uniqueness Score: -1.00%

Function 004323FB Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 112COMMONLIBRARYCODE

Download Yara Rule

APIs

EncodePointer.KERNEL32(00000000,?), ref: 00432420
CatchIt.LIBVCRUNTIME ref: 00432506

Strings

RCC, xrefs: 0043243A
MOC, xrefs: 00432432

Memory Dump Source

Source File: 00000000.00000002.3349183063.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3349183063.000000000058A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3349183063.0000000000590000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3349183063.0000000000593000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_2zdult23rz.jbxd

Similarity

API ID: CatchEncodePointer
String ID: MOC$RCC
API String ID: 1435073870-2084237596
Opcode ID: f67c2448fbd4d3d6a98c50ef117b853eaea3722c114d8127ada5358994747d23
Instruction ID: 22add53dc89d87d2e38264a8044db98528aac9f98faf4db0de58bac51eca42d4
Opcode Fuzzy Hash: f67c2448fbd4d3d6a98c50ef117b853eaea3722c114d8127ada5358994747d23
Instruction Fuzzy Hash: 18418931900209AFCF16DF98CE81AEEBBB5FF4C304F14909AF91467261E379AA50DB54

Uniqueness

Uniqueness Score: -1.00%

Function 00404670 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 77COMMON

Download Yara Rule

APIs

___std_exception_copy.LIBVCRUNTIME ref: 0040470F

Part of subcall function 0042FC4B: RaiseException.KERNEL32(E06D7363,00000001,00000003,?,?,00000000,?,0042C598,?,005784EC,00000000,?,00000000,-00589220), ref: 0042FCAB

Strings

ios_base::failbit set, xrefs: 004045C8, 004046B1
ios_base::badbit set, xrefs: 004046A7, 004046D2, 004046F3
ios_base::eofbit set, xrefs: 004046B6

Memory Dump Source

Source File: 00000000.00000002.3349183063.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3349183063.000000000058A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3349183063.0000000000590000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3349183063.0000000000593000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_2zdult23rz.jbxd

Similarity

API ID: ExceptionRaise___std_exception_copy
String ID: ios_base::badbit set$ios_base::eofbit set$ios_base::failbit set
API String ID: 3109751735-1866435925
Opcode ID: 110ff22bb014f40d9c49da7570fe546000a4ac58dd781872af612f7db9225b4d
Instruction ID: 8197f4525b88e01e27707072026cd0b0714ffa689975fe44cf17ea9c6d0ad863
Opcode Fuzzy Hash: 110ff22bb014f40d9c49da7570fe546000a4ac58dd781872af612f7db9225b4d
Instruction Fuzzy Hash: 051124F29007046BC710DF59E801B96B7ECBF45310F44893BFA58AB681F779A914CBA9

Uniqueness

Uniqueness Score: -1.00%

Function 00416C30 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 35COMMON

Download Yara Rule

APIs

___std_exception_copy.LIBVCRUNTIME ref: 00416C4F
___std_exception_copy.LIBVCRUNTIME ref: 00416C76

Strings

0f@, xrefs: 00416C54
`l@, xrefs: 00416C85

Memory Dump Source

Source File: 00000000.00000002.3349183063.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3349183063.000000000058A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3349183063.0000000000590000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3349183063.0000000000593000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_2zdult23rz.jbxd

Similarity

API ID: ___std_exception_copy
String ID: 0f@$`l@
API String ID: 2659868963-1799510096
Opcode ID: 477b0db39ac4bde0970ea1e1086746235186a9288c2098ecaba58f6d346df46b
Instruction ID: dbb7af03cc5cb26d8bc31998855cb8f279f7f761c34c3e1fc76db9b3c3456bcf
Opcode Fuzzy Hash: 477b0db39ac4bde0970ea1e1086746235186a9288c2098ecaba58f6d346df46b
Instruction Fuzzy Hash: AC01CDB6910B16ABC751DF65D440842FBFCFF59310750872BA91597A00E7B4F6588BA0

Uniqueness

Uniqueness Score: -1.00%

Function 00414160 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 33COMMON

Download Yara Rule

APIs

___std_exception_copy.LIBVCRUNTIME ref: 0041417F
___std_exception_copy.LIBVCRUNTIME ref: 004141A6

Strings

0f@, xrefs: 004141B5
0f@, xrefs: 00414184

Memory Dump Source

Source File: 00000000.00000002.3349183063.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3349183063.000000000058A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3349183063.0000000000590000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3349183063.0000000000593000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_2zdult23rz.jbxd

Similarity

API ID: ___std_exception_copy
String ID: 0f@$0f@
API String ID: 2659868963-4245790314
Opcode ID: a0ec767d29c154d107e2924c90945eb70bd3bcc0216d37c8e4efd4af5cc58e06
Instruction ID: a7d6c344e60e7f18edcee1d7e68ac694af1bcf80748ebca3b88f48a52b3fdaf1
Opcode Fuzzy Hash: a0ec767d29c154d107e2924c90945eb70bd3bcc0216d37c8e4efd4af5cc58e06
Instruction Fuzzy Hash: 53F0FFB6910B16AB8751DFA6D440882FBFCFE55310750872BA51597A00F7B4F5588BA0

Uniqueness

Uniqueness Score: -1.00%

Function 00414230 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 33COMMON

Download Yara Rule

APIs

___std_exception_copy.LIBVCRUNTIME ref: 0041424F
___std_exception_copy.LIBVCRUNTIME ref: 00414276

Strings

0f@, xrefs: 00414254
0f@, xrefs: 00414285

Memory Dump Source

Source File: 00000000.00000002.3349183063.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3349183063.000000000058A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3349183063.0000000000590000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3349183063.0000000000593000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_2zdult23rz.jbxd

Similarity

API ID: ___std_exception_copy
String ID: 0f@$0f@
API String ID: 2659868963-4245790314
Opcode ID: 7df463b482ac48a62a19cdfd521df996d263433cd12c62f8aacd95f3aeb874f2
Instruction ID: c81a8536ff326cbba859ccac6298cb5db3856efc80ffb62d725151cad3de68e9
Opcode Fuzzy Hash: 7df463b482ac48a62a19cdfd521df996d263433cd12c62f8aacd95f3aeb874f2
Instruction Fuzzy Hash: D8F0FFB6910B16AB8751DF65D440882FBFCFE55324350872BA5159BA00F7B4F6588BA0

Uniqueness

Uniqueness Score: -1.00%

Function 00416CA0 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 33COMMON

Download Yara Rule

APIs

___std_exception_copy.LIBVCRUNTIME ref: 00416CBF
___std_exception_copy.LIBVCRUNTIME ref: 00416CE6

Strings

0f@, xrefs: 00416CC4
0f@, xrefs: 00416CF5

Memory Dump Source

Source File: 00000000.00000002.3349183063.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3349183063.000000000058A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3349183063.0000000000590000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3349183063.0000000000593000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_2zdult23rz.jbxd

Similarity

API ID: ___std_exception_copy
String ID: 0f@$0f@
API String ID: 2659868963-4245790314
Opcode ID: 633ac4992eca418d5ffc677f5de7f46e5b2df270f2e158bde83afa2282cd04c5
Instruction ID: 7b638e66ef1866a2a6d9d212261b8ec84c1d59c8aca785b6d2b46250148b9f13
Opcode Fuzzy Hash: 633ac4992eca418d5ffc677f5de7f46e5b2df270f2e158bde83afa2282cd04c5
Instruction Fuzzy Hash: 53F0FFB6A10B16AB8751DFA6D440882FBFCFE55310750872BA91597A00F7B4F5588BA0

Uniqueness

Uniqueness Score: -1.00%

Function 00432E17 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 27libraryCOMMONLIBRARYCODE

Download Yara Rule

APIs

LoadLibraryExW.KERNEL32(00000000,00000000,00000800,?,00432DC8,00000000,?,00588294,?,?,?,00432F6B,00000004,InitializeCriticalSectionEx,0056464C,InitializeCriticalSectionEx), ref: 00432E24
GetLastError.KERNEL32(?,00432DC8,00000000,?,00588294,?,?,?,00432F6B,00000004,InitializeCriticalSectionEx,0056464C,InitializeCriticalSectionEx,00000000,?,00432BB2), ref: 00432E2E
LoadLibraryExW.KERNEL32(00000000,00000000,00000000), ref: 00432E56

Strings

api-ms-, xrefs: 00432E3B

Memory Dump Source

Source File: 00000000.00000002.3349183063.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3349183063.000000000058A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3349183063.0000000000590000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3349183063.0000000000593000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_2zdult23rz.jbxd

Similarity

API ID: LibraryLoad$ErrorLast
String ID: api-ms-
API String ID: 3177248105-2084034818
Opcode ID: 5d5f985b6204148051b127e035a47a58822f607e3183de8785261b29c3834a7a
Instruction ID: c9dedbc074def2dabcf9ae94258afdf3d1735c7d6a4bcca6e92b2bb5c548cfe3
Opcode Fuzzy Hash: 5d5f985b6204148051b127e035a47a58822f607e3183de8785261b29c3834a7a
Instruction Fuzzy Hash: 06E0D830680709B7FF101B60ED07B5A3F15BB10FA0F140021F90CA81E0D7F6E955A98D

Uniqueness

Uniqueness Score: -1.00%

Function 00446260 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 17fileCOMMON

Download Yara Rule

APIs

DeleteFileW.KERNEL32(A{C,?,00437B41,?), ref: 00446268
GetLastError.KERNEL32(?,00437B41,?), ref: 00446272
__dosmaperr.LIBCMT ref: 00446279

Strings

A{C, xrefs: 00446265

Memory Dump Source

Source File: 00000000.00000002.3349183063.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3349183063.000000000058A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3349183063.0000000000590000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3349183063.0000000000593000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_2zdult23rz.jbxd

Similarity

API ID: DeleteErrorFileLast__dosmaperr
String ID: A{C
API String ID: 1545401867-2902953714
Opcode ID: d06e79dd3ba0cf7262f3e9d2e22031695f25905068d46e1a3810f42683731183
Instruction ID: 82298aed12121fbb76aae4bd86d3a8824ef8c8c9545724addf748e8f9a95ec58
Opcode Fuzzy Hash: d06e79dd3ba0cf7262f3e9d2e22031695f25905068d46e1a3810f42683731183
Instruction Fuzzy Hash: E2D02232018A093B8B002BFAFC0C81B3F1CDAC23B4B112212F12CC21A0DF79C880E540

Uniqueness

Uniqueness Score: -1.00%

Function 0044372F Relevance: 6.3, APIs: 4, Instructions: 333fileCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetConsoleOutputCP.KERNEL32(D7297C87,00000000,00000000,00000000), ref: 00443792

Part of subcall function 004494E3: WideCharToMultiByte.KERNEL32(?,00000000,00000000,00000000,?,-00000008,?,00000000,-00000008,-00000008,00000000,?,004450F2,?,00000000,-00000008), ref: 00449544

WriteFile.KERNEL32(?,?,00000000,?,00000000), ref: 004439E4
WriteFile.KERNEL32(?,?,00000001,?,00000000), ref: 00443A2A
GetLastError.KERNEL32 ref: 00443ACD

Memory Dump Source

Source File: 00000000.00000002.3349183063.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3349183063.000000000058A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3349183063.0000000000590000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3349183063.0000000000593000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_2zdult23rz.jbxd

Similarity

API ID: FileWrite$ByteCharConsoleErrorLastMultiOutputWide
String ID:
API String ID: 2112829910-0
Opcode ID: 6c43be61cbda0f6c097b573cc04eb8237f5f21ceac64de5e22f9761793270a88
Instruction ID: 0fce1cefab234659ad1f0217530304adac3e90b60b936070d7093385ba198d0a
Opcode Fuzzy Hash: 6c43be61cbda0f6c097b573cc04eb8237f5f21ceac64de5e22f9761793270a88
Instruction Fuzzy Hash: 44D18BB5E00248AFDB04CFA8C8809AEBBF5FF09714F28416AE456EB351D734AA05CF54

Uniqueness

Uniqueness Score: -1.00%

Function 00431DFF Relevance: 6.2, APIs: 4, Instructions: 168COMMONLIBRARYCODE

Download Yara Rule

APIs

___AdjustPointer.LIBCMT ref: 00431EC6
___AdjustPointer.LIBCMT ref: 00431EE9
___AdjustPointer.LIBCMT ref: 00431F85

Memory Dump Source

Source File: 00000000.00000002.3349183063.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3349183063.000000000058A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3349183063.0000000000590000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3349183063.0000000000593000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_2zdult23rz.jbxd

Similarity

API ID: AdjustPointer
String ID:
API String ID: 1740715915-0
Opcode ID: 22f8edb4a09f2bb08f15e0402e3299f4473d24481a960265d7d1ad828239f7ca
Instruction ID: 5e987339bfe843b9f296834bd0eb5b9b12b2b56c7c95d39286bcad5928a9d5c7
Opcode Fuzzy Hash: 22f8edb4a09f2bb08f15e0402e3299f4473d24481a960265d7d1ad828239f7ca
Instruction Fuzzy Hash: ED51D171601606AFDB289F15D841B7AB7A4EF08714F14552FEC06872A1E739ED81CB98

Uniqueness

Uniqueness Score: -1.00%

Function 0043E299 Relevance: 6.1, APIs: 4, Instructions: 132COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3349183063.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3349183063.000000000058A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3349183063.0000000000590000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3349183063.0000000000593000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_2zdult23rz.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7511f47f2b8d2fe514c419f7a8a5e884613d924f38ebbfd2c945a9fddd631bd9
Instruction ID: 2126f9bf5856ab37efc9431dc69293eb0664d4eadafdfeefbb5e8820937b8c22
Opcode Fuzzy Hash: 7511f47f2b8d2fe514c419f7a8a5e884613d924f38ebbfd2c945a9fddd631bd9
Instruction Fuzzy Hash: 0D41D572A00204AFD7259F3ACC42B6BBBA9EB8C714F10552FF951DB3C1D2B9A9408784

Uniqueness

Uniqueness Score: -1.00%

Function 0044A27A Relevance: 6.1, APIs: 4, Instructions: 82COMMON

Download Yara Rule

APIs

Part of subcall function 004494E3: WideCharToMultiByte.KERNEL32(?,00000000,00000000,00000000,?,-00000008,?,00000000,-00000008,-00000008,00000000,?,004450F2,?,00000000,-00000008), ref: 00449544

GetLastError.KERNEL32 ref: 0044A2DE
__dosmaperr.LIBCMT ref: 0044A2E5
GetLastError.KERNEL32(?,?,?,?), ref: 0044A31F
__dosmaperr.LIBCMT ref: 0044A326

Memory Dump Source

Source File: 00000000.00000002.3349183063.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3349183063.000000000058A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3349183063.0000000000590000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3349183063.0000000000593000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_2zdult23rz.jbxd

Similarity

API ID: ErrorLast__dosmaperr$ByteCharMultiWide
String ID:
API String ID: 1913693674-0
Opcode ID: 4aeb7d56512abd99a56e580aa898e1e8254ab7db8b2fd6091a031305fb940926
Instruction ID: e808a53d57fca8bd1b61f112aec170daf55b4bc7c6cded0a037d44453b824fae
Opcode Fuzzy Hash: 4aeb7d56512abd99a56e580aa898e1e8254ab7db8b2fd6091a031305fb940926
Instruction Fuzzy Hash: E8210A31644205AFEB20AF62CC8096B77A8FF44368700841FFD19C3340EB79EC619B96

Uniqueness

Uniqueness Score: -1.00%

Function 00551780 Relevance: 6.1, APIs: 4, Instructions: 81COMMON

Download Yara Rule

APIs

GetVersionExA.KERNEL32(?), ref: 005517A6

Part of subcall function 00552170: MultiByteToWideChar.KERNEL32(0000FDE9,00000000,?,000000FF,00000000,00000000,?,?,?,?,005517D5), ref: 00552186

AreFileApisANSI.KERNEL32 ref: 005517E2
WideCharToMultiByte.KERNEL32(?,00000000,00000000,000000FF,00000000,00000000,00000000,00000000), ref: 005517FB
WideCharToMultiByte.KERNEL32(?,00000000,00000000,000000FF,00000000,?,00000000,00000000), ref: 00551821

Memory Dump Source

Source File: 00000000.00000002.3349183063.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3349183063.000000000058A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3349183063.0000000000590000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3349183063.0000000000593000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_2zdult23rz.jbxd

Similarity

API ID: ByteCharMultiWide$ApisFileVersion
String ID:
API String ID: 928063719-0
Opcode ID: 031ec5809b8440159ef872148459a1f590b3e289563d8e6ea78dae530cbe2791
Instruction ID: c51e4a5004bc5c8d9a7cba6e479370a0363687ca0ec671a4cb42cd6ec07258b3
Opcode Fuzzy Hash: 031ec5809b8440159ef872148459a1f590b3e289563d8e6ea78dae530cbe2791
Instruction Fuzzy Hash: 0B112C72B4471466D730677C5C4AB6B3A9CE75A725F100266FE08E62C0DE745D08C795

Uniqueness

Uniqueness Score: -1.00%

Function 0043DFC4 Relevance: 6.1, APIs: 4, Instructions: 79COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3349183063.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3349183063.000000000058A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3349183063.0000000000590000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3349183063.0000000000593000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_2zdult23rz.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7a5f53a45029589cfd6d82fecb2c1e63987311ce998a70f6839ef034e9f5ce76
Instruction ID: 81415193f2b284d52f75cea432416567dc69263c3e1cc8c88057087f1c3c8e8c
Opcode Fuzzy Hash: 7a5f53a45029589cfd6d82fecb2c1e63987311ce998a70f6839ef034e9f5ce76
Instruction Fuzzy Hash: DF21D831601225AFDB28AF77CC4096B77B9EF48368F10651BF959D7280D7B8EC418B94

Uniqueness

Uniqueness Score: -1.00%

Function 00551D70 Relevance: 6.1, APIs: 4, Instructions: 76fileCOMMON

Download Yara Rule

APIs

SetFilePointer.KERNEL32(00000000,00000000,?,00000000), ref: 00551D99
GetLastError.KERNEL32 ref: 00551DA6
WriteFile.KERNEL32(00000000,?,?,00000000,00000000), ref: 00551DDE
GetLastError.KERNEL32 ref: 00551E0F

Memory Dump Source

Source File: 00000000.00000002.3349183063.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3349183063.000000000058A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3349183063.0000000000590000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3349183063.0000000000593000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_2zdult23rz.jbxd

Similarity

API ID: ErrorFileLast$PointerWrite
String ID:
API String ID: 2977825765-0
Opcode ID: fdd63083b0cb03508c34529706ddeef352dd26621ea0ce66a248962179dc77d8
Instruction ID: 124afd07655c65dfe8ebf02a55b60b01ba141f4f94fe2aeeedbc6b017858f8c6
Opcode Fuzzy Hash: fdd63083b0cb03508c34529706ddeef352dd26621ea0ce66a248962179dc77d8
Instruction Fuzzy Hash: 5E21A432600A09ABCB20CFA8D845BDA7FF8FB05362F144266ED19D7240D771DD589BD0

Uniqueness

Uniqueness Score: -1.00%

Function 0044B21E Relevance: 6.1, APIs: 4, Instructions: 74COMMON

Download Yara Rule

APIs

GetEnvironmentStringsW.KERNEL32 ref: 0044B226

Part of subcall function 004494E3: WideCharToMultiByte.KERNEL32(?,00000000,00000000,00000000,?,-00000008,?,00000000,-00000008,-00000008,00000000,?,004450F2,?,00000000,-00000008), ref: 00449544

FreeEnvironmentStringsW.KERNEL32(00000000), ref: 0044B25E
FreeEnvironmentStringsW.KERNEL32(00000000), ref: 0044B27E

Memory Dump Source

Source File: 00000000.00000002.3349183063.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3349183063.000000000058A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3349183063.0000000000590000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3349183063.0000000000593000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_2zdult23rz.jbxd

Similarity

API ID: EnvironmentStrings$Free$ByteCharMultiWide
String ID:
API String ID: 158306478-0
Opcode ID: 72d3ac7b96c30aebca4f7b81977510e4ddf762ba545c488265c91b440556a14b
Instruction ID: e8caac45197e5b900f97a91f35687491d1a7555c8db139f57b1f8df2d9843390
Opcode Fuzzy Hash: 72d3ac7b96c30aebca4f7b81977510e4ddf762ba545c488265c91b440556a14b
Instruction Fuzzy Hash: 9311A1B56099157F7A1127769C8EC7F696CFE95398710006AF905D2101EFACCD0192B9

Uniqueness

Uniqueness Score: -1.00%

Function 00551E30 Relevance: 6.1, APIs: 4, Instructions: 66fileCOMMON

Download Yara Rule

APIs

SetFilePointer.KERNEL32(?,?,?,00000000), ref: 00551E4F
GetLastError.KERNEL32 ref: 00551E5A
ReadFile.KERNEL32(?,?,?,?,00000000), ref: 00551E82
GetLastError.KERNEL32 ref: 00551E8C

Memory Dump Source

Source File: 00000000.00000002.3349183063.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3349183063.000000000058A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3349183063.0000000000590000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3349183063.0000000000593000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_2zdult23rz.jbxd

Similarity

API ID: ErrorFileLast$PointerRead
String ID:
API String ID: 2170121939-0
Opcode ID: b49e815b288db118013f7b31ade0b5ee7bcb2275d16c9ff237f0887fb9d13391
Instruction ID: 1c07d7795fbcd358c5ccab0054a22981654648c43a30ee7f67c6bd12fb941fbd
Opcode Fuzzy Hash: b49e815b288db118013f7b31ade0b5ee7bcb2275d16c9ff237f0887fb9d13391
Instruction Fuzzy Hash: BE116D32600509ABDB108FA9EC06B9ABFACEB55371F104266FD1CC7690D771D8649BD0

Uniqueness

Uniqueness Score: -1.00%

Function 00551BC0 Relevance: 6.1, APIs: 4, Instructions: 61fileCOMMON

Download Yara Rule

APIs

GetVersionExA.KERNEL32(?,00000000,?), ref: 00551BE7
LockFileEx.KERNEL32(?,00000001,00000000,000001FE,00000000,?,00000000,?), ref: 00551C2B
LockFile.KERNEL32(?,?,00000000,00000001,00000000,00000000,?), ref: 00551C68
GetLastError.KERNEL32 ref: 00551C74

Memory Dump Source

Source File: 00000000.00000002.3349183063.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3349183063.000000000058A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3349183063.0000000000590000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3349183063.0000000000593000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_2zdult23rz.jbxd

Similarity

API ID: FileLock$ErrorLastVersion
String ID:
API String ID: 1561719237-0
Opcode ID: b1f35983ee3affc0888187ea055b818f5b93c82708a4729dec28fa350ab0f381
Instruction ID: c6e5e3f14ebcd9b74047f326a63c3359dca0738745041834ca351f4869dad2f2
Opcode Fuzzy Hash: b1f35983ee3affc0888187ea055b818f5b93c82708a4729dec28fa350ab0f381
Instruction Fuzzy Hash: B111E270A40715EFE720DB68DC0ABAABBB6EB14311F004166EA09E72D0D7B49D488F91

Uniqueness

Uniqueness Score: -1.00%

Function 0042C79B Relevance: 6.0, APIs: 4, Instructions: 44COMMON

Download Yara Rule

APIs

WideCharToMultiByte.KERNEL32(?,00000400,?,?,?,?,00000000,00000000), ref: 0042C7B8
GetLastError.KERNEL32 ref: 0042C7C4
WideCharToMultiByte.KERNEL32(?,00000000,?,?,?,?,00000000,00000000), ref: 0042C7EA
GetLastError.KERNEL32 ref: 0042C7F6

Memory Dump Source

Source File: 00000000.00000002.3349183063.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3349183063.000000000058A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3349183063.0000000000590000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3349183063.0000000000593000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_2zdult23rz.jbxd

Similarity

API ID: ByteCharErrorLastMultiWide
String ID:
API String ID: 203985260-0
Opcode ID: d60d3f0468ca365ea2d33887d1edca9153ddd58cf00a018eb0310ef3d7885722
Instruction ID: 1457a662959836737ce5e9d14aa512d11431f433389b59119e43d7cb484e3981
Opcode Fuzzy Hash: d60d3f0468ca365ea2d33887d1edca9153ddd58cf00a018eb0310ef3d7885722
Instruction Fuzzy Hash: 8C011236A0055ABB8F221F56EC09C9F3E26FBD97A1F508015FE0596220C771C822EBB5

Uniqueness

Uniqueness Score: -1.00%

Function 0042CFB9 Relevance: 6.0, APIs: 4, Instructions: 44COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 0042CFC0
std::_Lockit::_Lockit.LIBCPMT ref: 0042CFCB
std::_Lockit::~_Lockit.LIBCPMT ref: 0042D039

Part of subcall function 0042D11C: std::locale::_Locimp::_Locimp.LIBCPMT ref: 0042D134

std::locale::_Setgloballocale.LIBCPMT ref: 0042CFE6

Memory Dump Source

Source File: 00000000.00000002.3349183063.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3349183063.000000000058A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3349183063.0000000000590000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3349183063.0000000000593000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_2zdult23rz.jbxd

Similarity

API ID: Lockitstd::_std::locale::_$H_prolog3LocimpLocimp::_Lockit::_Lockit::~_Setgloballocale
String ID:
API String ID: 677527491-0
Opcode ID: a81ae077d66b6818d886551d338491a753a81bbc704f7327620bbb46f710912f
Instruction ID: df240a295bf63e2224bd77c694c8fa0b7c15e45d42fccb058baf2628ad412d74
Opcode Fuzzy Hash: a81ae077d66b6818d886551d338491a753a81bbc704f7327620bbb46f710912f
Instruction Fuzzy Hash: 3601D431B001249BC705EF21E84557D7B61BF88744F94000EE81117391CF7CAE4ADBC9

Uniqueness

Uniqueness Score: -1.00%

Function 00551D10 Relevance: 6.0, APIs: 4, Instructions: 35fileCOMMON

Download Yara Rule

APIs

SetFilePointer.KERNEL32(?,?,?,00000000), ref: 00551D2F
GetLastError.KERNEL32 ref: 00551D3A
SetEndOfFile.KERNEL32(?), ref: 00551D47
GetLastError.KERNEL32 ref: 00551D51

Memory Dump Source

Source File: 00000000.00000002.3349183063.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3349183063.000000000058A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3349183063.0000000000590000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3349183063.0000000000593000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_2zdult23rz.jbxd

Similarity

API ID: ErrorFileLast$Pointer
String ID:
API String ID: 1697706070-0
Opcode ID: e9db830aa84e949e305a23e5519836727befb5c1dc39fe6aeceb5e7ff34a8212
Instruction ID: 78cfe8da683ddb1c4eba9ffbb4783858a20702ac95fb36532bf07bb8e13b767a
Opcode Fuzzy Hash: e9db830aa84e949e305a23e5519836727befb5c1dc39fe6aeceb5e7ff34a8212
Instruction Fuzzy Hash: 73F03031504A08AFCB109FA8EC05AAA7BB8FB15371F104356FD2DC72A0E771DD14AB84

Uniqueness

Uniqueness Score: -1.00%

Function 004515C2 Relevance: 6.0, APIs: 4, Instructions: 29COMMONLIBRARYCODE

Download Yara Rule

APIs

WriteConsoleW.KERNEL32(00000000,00000000,?,00000000,00000000,?,0044E65F,00000000,00000001,0000000C,00000000,?,00443B21,00000000,00000000,00000000), ref: 004515D9
GetLastError.KERNEL32(?,0044E65F,00000000,00000001,0000000C,00000000,?,00443B21,00000000,00000000,00000000,00000000,00000000,?,004440FB,?), ref: 004515E5

Part of subcall function 004515AB: CloseHandle.KERNEL32(FFFFFFFE,004515F5,?,0044E65F,00000000,00000001,0000000C,00000000,?,00443B21,00000000,00000000,00000000,00000000,00000000), ref: 004515BB

___initconout.LIBCMT ref: 004515F5

Part of subcall function 0045156D: CreateFileW.KERNEL32(CONOUT$,40000000,00000003,00000000,00000003,00000000,00000000,0045159C,0044E64C,00000000,?,00443B21,00000000,00000000,00000000,00000000), ref: 00451580

WriteConsoleW.KERNEL32(00000000,00000000,?,00000000,?,0044E65F,00000000,00000001,0000000C,00000000,?,00443B21,00000000,00000000,00000000,00000000), ref: 0045160A

Memory Dump Source

Source File: 00000000.00000002.3349183063.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3349183063.000000000058A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3349183063.0000000000590000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3349183063.0000000000593000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_2zdult23rz.jbxd

Similarity

API ID: ConsoleWrite$CloseCreateErrorFileHandleLast___initconout
String ID:
API String ID: 2744216297-0
Opcode ID: 825431769af7ecb58b9ff08572fa6bc7755dba3e29138d7d75499e0080207230
Instruction ID: 4f0fea4629c9a9cefdcbd6fc6812cfd1fa0f0e5bf1bcffa0db634c91b2476c24
Opcode Fuzzy Hash: 825431769af7ecb58b9ff08572fa6bc7755dba3e29138d7d75499e0080207230
Instruction Fuzzy Hash: BFF03036441118BBCF221F95DC18A8A3F66FB593A2F144415FE0D96231D7328C28FBD5

Uniqueness

Uniqueness Score: -1.00%

Function 00490040 Relevance: 6.0, APIs: 4, Instructions: 20synchronizationthreadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 00490044
GetCurrentProcessId.KERNEL32 ref: 0049004C
SetEvent.KERNEL32 ref: 00490069
WaitForSingleObject.KERNEL32(000000FF), ref: 00490077

Memory Dump Source

Source File: 00000000.00000002.3349183063.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3349183063.000000000058A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3349183063.0000000000590000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3349183063.0000000000593000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_2zdult23rz.jbxd

Similarity

API ID: Current$EventObjectProcessSingleThreadWait
String ID:
API String ID: 977356572-0
Opcode ID: 07ad26c9a8193a9c403b999b7260b6d74736513c4a61b8b242bc8500957e93da
Instruction ID: 68696a4330ff011d049e89e8b4814e5f18df6cd1e962ac77584aedc126b31ea8
Opcode Fuzzy Hash: 07ad26c9a8193a9c403b999b7260b6d74736513c4a61b8b242bc8500957e93da
Instruction Fuzzy Hash: CCE0467104A615EFCB049F68EC0C865BFA5FB297717408222FC09977B0DB708888EF80

Uniqueness

Uniqueness Score: -1.00%

Function 00407D50 Relevance: 5.6, APIs: 2, Strings: 1, Instructions: 381libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(Ws2_32.dll,?,?,?,?,?,?,?,?,?,?,00000000,?,?,00000000), ref: 00408127
GetProcAddress.KERNEL32(00000000,?), ref: 00408132

Strings

Ws2_32.dll, xrefs: 0040811E

Memory Dump Source

Source File: 00000000.00000002.3349183063.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3349183063.000000000058A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3349183063.0000000000590000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3349183063.0000000000593000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_2zdult23rz.jbxd

Similarity

API ID: AddressHandleModuleProc
String ID: Ws2_32.dll
API String ID: 1646373207-3093949381
Opcode ID: 491b632f871c0b2e9f79da60abe9135bbe45576d811639c63c87b83e1c069342
Instruction ID: 4cf5a73f60aaa9aa04889aa359a8f1718852bcf292be34ef81f356f0aae57edb
Opcode Fuzzy Hash: 491b632f871c0b2e9f79da60abe9135bbe45576d811639c63c87b83e1c069342
Instruction Fuzzy Hash: 1FF18D70E042468FCB25CF58C880A6EBBB1BF45314F24456EE5A5AB3D2D7356C42CBD6

Uniqueness

Uniqueness Score: -1.00%

Function 00405DE0 Relevance: 5.6, APIs: 2, Strings: 1, Instructions: 308COMMON

Download Yara Rule

APIs

___std_fs_directory_iterator_advance@8.LIBCPMT ref: 00406029
___std_fs_directory_iterator_advance@8.LIBCPMT ref: 00406070

Strings

., xrefs: 00406042

Memory Dump Source

Source File: 00000000.00000002.3349183063.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3349183063.000000000058A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3349183063.0000000000590000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3349183063.0000000000593000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_2zdult23rz.jbxd

Similarity

API ID: ___std_fs_directory_iterator_advance@8
String ID: .
API String ID: 2610647541-248832578
Opcode ID: d29aef357e0ccb769bd4d7c1829c3bcfe03ac4cf065ef6d39e890d2a6deccaa5
Instruction ID: 096b34988356738832717cd8d53d0dabcf9a03e197ae697f4c60f7eb60d7375d
Opcode Fuzzy Hash: d29aef357e0ccb769bd4d7c1829c3bcfe03ac4cf065ef6d39e890d2a6deccaa5
Instruction Fuzzy Hash: EBB1ED31A00A269FCB24DF28C484AABB3A5FF44314F14467AE956AB7C0D739AD55CFC4

Uniqueness

Uniqueness Score: -1.00%

Function 00421ED0 Relevance: 5.5, APIs: 2, Strings: 1, Instructions: 238COMMON

Download Yara Rule

APIs

___std_exception_destroy.LIBVCRUNTIME ref: 00422F8E
___std_exception_destroy.LIBVCRUNTIME ref: 00422FA7

Strings

value, xrefs: 00422EAA

Memory Dump Source

Source File: 00000000.00000002.3349183063.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3349183063.000000000058A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3349183063.0000000000590000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3349183063.0000000000593000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_2zdult23rz.jbxd

Similarity

API ID: ___std_exception_destroy
String ID: value
API String ID: 4194217158-494360628
Opcode ID: b4d6e486459fc4165fef155cd3e93815974afef82531802b5d23e92940ab5652
Instruction ID: e486267f6df33abbab02232f3a147fe49855a435ae29b4bed88eebe1dccc493b
Opcode Fuzzy Hash: b4d6e486459fc4165fef155cd3e93815974afef82531802b5d23e92940ab5652
Instruction Fuzzy Hash: D0911070E0025C9BCB18DBA4DD85BEDFBB4FF05304F4481AEE049A7682D7785A8ACB55

Uniqueness

Uniqueness Score: -1.00%

Function 00406410 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 195COMMON

Download Yara Rule

APIs

___std_exception_destroy.LIBVCRUNTIME ref: 00406641
___std_exception_destroy.LIBVCRUNTIME ref: 00406650

Strings

[json.exception., xrefs: 0040647C

Memory Dump Source

Source File: 00000000.00000002.3349183063.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3349183063.000000000058A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3349183063.0000000000590000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3349183063.0000000000593000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_2zdult23rz.jbxd

Similarity

API ID: ___std_exception_destroy
String ID: [json.exception.
API String ID: 4194217158-791563284
Opcode ID: 69e8ae6c3e54ae363f37629574a163c0fbf3223070608996bd2dae2b17642f6c
Instruction ID: 9d5c587d941c6c9fb92ac9ca7a55b7e2129566a9bdf696eabab773fbc3fcb82b
Opcode Fuzzy Hash: 69e8ae6c3e54ae363f37629574a163c0fbf3223070608996bd2dae2b17642f6c
Instruction Fuzzy Hash: 62616570D002089BDB18DF28DD55BAEBBB0EF45304F10822EF4157B3D2D778AA948794

Uniqueness

Uniqueness Score: -1.00%

Function 00406E90 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 157COMMON

Download Yara Rule

APIs

___std_exception_copy.LIBVCRUNTIME ref: 00407010

Strings

0f@, xrefs: 00406FF4
0f@, xrefs: 00407022

Memory Dump Source

Source File: 00000000.00000002.3349183063.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3349183063.000000000058A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3349183063.0000000000590000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3349183063.0000000000593000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_2zdult23rz.jbxd

Similarity

API ID: ___std_exception_copy
String ID: 0f@$0f@
API String ID: 2659868963-4245790314
Opcode ID: bcbe41c5aa249d1fea8852c57527764fa0294b57d9e2ba5d086127c68554cecd
Instruction ID: 3516b51c1e5f9fd4da6d9ff2b6035a17077718e5c6cfc91e46ca54004dc1bd24
Opcode Fuzzy Hash: bcbe41c5aa249d1fea8852c57527764fa0294b57d9e2ba5d086127c68554cecd
Instruction Fuzzy Hash: EC5101B1D002449BCB18CF68D8947AEBBB0FF55318F14832EE4157B381E7B8A984CB55

Uniqueness

Uniqueness Score: -1.00%

Function 00406CA0 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 154COMMON

Download Yara Rule

APIs

___std_exception_copy.LIBVCRUNTIME ref: 00406E29

Strings

0f@, xrefs: 00406E3B
0f@, xrefs: 00406E0D

Memory Dump Source

Source File: 00000000.00000002.3349183063.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3349183063.000000000058A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3349183063.0000000000590000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3349183063.0000000000593000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_2zdult23rz.jbxd

Similarity

API ID: ___std_exception_copy
String ID: 0f@$0f@
API String ID: 2659868963-4245790314
Opcode ID: 97c7d59c3b195afea6fdad5512d69d55d647ae76a1cf1ad35470bd7be0820389
Instruction ID: c8085b2431abbbd661158451a076a322d2444fb340424d65fcfd996802ac0ad0
Opcode Fuzzy Hash: 97c7d59c3b195afea6fdad5512d69d55d647ae76a1cf1ad35470bd7be0820389
Instruction Fuzzy Hash: 0351D471D002489FDB18CFA8D9447AEBBB4EF45304F14832EE4157B392E778AA84CB94

Uniqueness

Uniqueness Score: -1.00%

Function 00404590 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 150COMMON

Download Yara Rule

APIs

___std_exception_copy.LIBVCRUNTIME ref: 0040470F

Part of subcall function 0042FC4B: RaiseException.KERNEL32(E06D7363,00000001,00000003,?,?,00000000,?,0042C598,?,005784EC,00000000,?,00000000,-00589220), ref: 0042FCAB

Strings

ios_base::failbit set, xrefs: 004045C8
ios_base::badbit set, xrefs: 004046A7, 004046D2, 004046F3

Memory Dump Source

Source File: 00000000.00000002.3349183063.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3349183063.000000000058A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3349183063.0000000000590000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3349183063.0000000000593000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_2zdult23rz.jbxd

Similarity

API ID: ExceptionRaise___std_exception_copy
String ID: ios_base::badbit set$ios_base::failbit set
API String ID: 3109751735-1240500531
Opcode ID: c80e41b3c0e3f89b34bbd97eb038494ee604058bd2ebc28d0b5fc6a2886b7790
Instruction ID: b88785aaf7f68840d7686b62b29a7400031648df9c7ab407a56371cabfa6b869
Opcode Fuzzy Hash: c80e41b3c0e3f89b34bbd97eb038494ee604058bd2ebc28d0b5fc6a2886b7790
Instruction Fuzzy Hash: 4D4139B1900604ABC704DF59DC41BAAFBF8FF45310F14862EF914A7781E779A940CBA5

Uniqueness

Uniqueness Score: -1.00%

Function 00406140 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 142COMMON

Download Yara Rule

APIs

___std_fs_get_full_path_name@12.LIBCPMT ref: 004061F2

Strings

h<W, xrefs: 004061B7, 00406242
absolute, xrefs: 00406274

Memory Dump Source

Source File: 00000000.00000002.3349183063.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3349183063.000000000058A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3349183063.0000000000590000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3349183063.0000000000593000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_2zdult23rz.jbxd

Similarity

API ID: ___std_fs_get_full_path_name@12
String ID: absolute$h<W
API String ID: 319883303-1227054036
Opcode ID: fc19779bb5a5af7582c79339770b481127d2738d3652d52236bc829e3857b7da
Instruction ID: a39a9e8cd5e7c649dec9d62c81c2f08022a5113abdb27f993b439c29f203247c
Opcode Fuzzy Hash: fc19779bb5a5af7582c79339770b481127d2738d3652d52236bc829e3857b7da
Instruction Fuzzy Hash: C651AEB0E00315ABDB14DF58C9047AABBF4FF48314F10466EE815A7380D775A950CBE5

Uniqueness

Uniqueness Score: -1.00%

Function 004F2340 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 85COMMON

Download Yara Rule

APIs

GdipGetImageEncodersSize.GDIPLUS(?,?), ref: 004F2360
GdipGetImageEncoders.GDIPLUS(00000000,00000000,00000000), ref: 004F238D

Strings

image/png, xrefs: 004F23A2

Memory Dump Source

Source File: 00000000.00000002.3349183063.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3349183063.000000000058A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3349183063.0000000000590000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3349183063.0000000000593000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_2zdult23rz.jbxd

Similarity

API ID: EncodersGdipImage$Size
String ID: image/png
API String ID: 864223233-2966254431
Opcode ID: e21b857071d1cb9bc6449797421194390e2296bc93f2d18b0a27c6bddf1e72aa
Instruction ID: 99d255883ba5ce217efe5dd06ccd874c50b7054dcb2a8d5064865148aeb1c457
Opcode Fuzzy Hash: e21b857071d1cb9bc6449797421194390e2296bc93f2d18b0a27c6bddf1e72aa
Instruction Fuzzy Hash: E7213BB2E0011CABDB109BB4DD816BEB7A8EF25314F1001B6ED08E7311E7799A44C655

Uniqueness

Uniqueness Score: -1.00%

Function 00404120 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 55COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 00404141
std::_Locinfo::_Locinfo_ctor.LIBCPMT ref: 00404190

Strings

bad locale name, xrefs: 004041AB

Memory Dump Source

Source File: 00000000.00000002.3349183063.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3349183063.000000000058A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3349183063.0000000000590000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3349183063.0000000000593000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_2zdult23rz.jbxd

Similarity

API ID: std::_$Locinfo::_Locinfo_ctorLockitLockit::_
String ID: bad locale name
API String ID: 3988782225-1405518554
Opcode ID: 2d018156623b56751fe73bdace615048a592e1be14230173648bc4ea361b1185
Instruction ID: 95f085b47d10799f27f930042da3a8dc43f911f11589ebef340e3e8cf28b8f7c
Opcode Fuzzy Hash: 2d018156623b56751fe73bdace615048a592e1be14230173648bc4ea361b1185
Instruction Fuzzy Hash: 19118B70504B90AED320CF69D805B1BBBE4EF19714F008A5EE48A87B81D7B9A508CBD6

Uniqueness

Uniqueness Score: -1.00%

Function 00552100 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 48COMMON

Download Yara Rule

APIs

WideCharToMultiByte.KERNEL32(0000FDE9,00000000,00000000,000000FF,00000000,00000000,00000000,00000000,00000000,00000001,00000000,?,0055200A), ref: 0055211A
WideCharToMultiByte.KERNEL32(0000FDE9,00000000,00000000,000000FF,00000000, U,00000000,00000000,0055200A), ref: 0055214A

Strings

U, xrefs: 0055213C

Memory Dump Source

Source File: 00000000.00000002.3349183063.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3349183063.000000000058A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3349183063.0000000000590000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3349183063.0000000000593000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_2zdult23rz.jbxd

Similarity

API ID: ByteCharMultiWide
String ID: U
API String ID: 626452242-2085870877
Opcode ID: ee5a59f4ac988d56eb673c4b09d135a0ac0f9a58fb340a166edfd918ee52e803
Instruction ID: 0b132648f7774e7442f2f0b6957801b08d55499a66d80b09d0b1d43035632599
Opcode Fuzzy Hash: ee5a59f4ac988d56eb673c4b09d135a0ac0f9a58fb340a166edfd918ee52e803
Instruction Fuzzy Hash: 38F09632B8522436E63066AA5C0BF577A5CDB47F71F20036AFF18AA1D0D9E1681092DA

Uniqueness

Uniqueness Score: -1.00%

Function 004141D0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 32COMMON

Download Yara Rule

APIs

___std_exception_copy.LIBVCRUNTIME ref: 004141EF
___std_exception_copy.LIBVCRUNTIME ref: 00414216

Strings

0f@, xrefs: 004141F4

Memory Dump Source

Source File: 00000000.00000002.3349183063.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3349183063.000000000058A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3349183063.0000000000590000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3349183063.0000000000593000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_2zdult23rz.jbxd

Similarity

API ID: ___std_exception_copy
String ID: 0f@
API String ID: 2659868963-2656153907
Opcode ID: ba255ed8c3bc32c490ad3c9a6150c2f47abf7cac3b88d1f1c6bb2e2459164e61
Instruction ID: 79755fa87b84676f4e4474023142464d524d45420b01c2d18704369f933ac59c
Opcode Fuzzy Hash: ba255ed8c3bc32c490ad3c9a6150c2f47abf7cac3b88d1f1c6bb2e2459164e61
Instruction Fuzzy Hash: 1CF012B6910B16AB8751DF65D440882F7FCFE55310350872BA51597A00F7B4F5588BA0

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: MPGPH131.exePID: 6080, Parent PID: 1064COMMON

Execution Graph

Execution Coverage:	3.1%
Dynamic/Decrypted Code Coverage:	1.1%
Signature Coverage:	0%
Total number of Nodes:	1094
Total number of Limit Nodes:	17

Executed Functions

Function 00453C30 Relevance: 75.1, APIs: 33, Strings: 9, Instructions: 1568
sleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNELBASE(00000025), ref: 00453C44

Part of subcall function 004E2FA0: __Xtime_get_ticks.LIBCPMT ref: 004E2FA1
Part of subcall function 004E2FA0: __ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 004E2FAF

GetCurrentProcess.KERNEL32(00008000,00000000,00000000,00000001,00000000,00000000,00000001,00000000,00000000,00000001), ref: 00453DCD
SetPriorityClass.KERNELBASE(00000000), ref: 00453DD4
SetUnhandledExceptionFilter.KERNEL32(0045A780), ref: 00453DDF

Strings

147.45.47.93:58709, xrefs: 00453CE7
149.18.24.96, xrefs: 00455CE8, 00455DA5
43t res tgy45yfhyrt, xrefs: 0045A290
131, xrefs: 00453CA1, 00453CC4
/*************/, xrefs: 00454952
131, xrefs: 00453C6E, 00453CAE, 00453CB9, 00453CF4, 00453D0A, 00453D23, 00455BCB, 0045A3E6
futer, xrefs: 00453D39, 00453D4F, 00453D68
Dk43l_dwmk438*, xrefs: 004567EA
er ert 346 34634 6ch, xrefs: 00458D6B

Memory Dump Source

Source File: 00000009.00000002.3349156602.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.3349156602.000000000058A000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.3349156602.0000000000590000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.3349156602.0000000000593000.00000040.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_MPGPH131.jbxd

Similarity

API ID: ClassCurrentExceptionFilterPriorityProcessSleepUnhandledUnothrow_t@std@@@Xtime_get_ticks__ehfuncinfo$??2@
String ID: /*************/$131$131$147.45.47.93:58709$149.18.24.96$43t res tgy45yfhyrt$Dk43l_dwmk438*$er ert 346 34634 6ch$futer
API String ID: 1211644118-3050393103
Opcode ID: d815512b09ebf0c0998b3e8d6d46b6c6c8f98991f312bd21f85900f769a006aa
Instruction ID: 58df280d1c5bcf31294a4ea42ed0208b52652377ae8c263acff41185647b5a58
Opcode Fuzzy Hash: d815512b09ebf0c0998b3e8d6d46b6c6c8f98991f312bd21f85900f769a006aa
Instruction Fuzzy Hash: F70326B45083829FC324DF29C491AABBBE4FFD8345F40491EE98997352DB30A549CF96

Uniqueness

Uniqueness Score: -1.00%

Function 0045A5C0 Relevance: 10.7, APIs: 5, Strings: 1, Instructions: 156
sleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCursorPos.USER32(?), ref: 0045A5D3
GetCursorPos.USER32(?), ref: 0045A5D9
Sleep.KERNELBASE(000003E9,?,?,?,?,?,?,?,?,?,?,?,00453DEA), ref: 0045A688
GetCursorPos.USER32(?), ref: 0045A68E
Sleep.KERNELBASE(00000001,?,?,?,?,?,?,?,?,?,?,?,00453DEA), ref: 0045A73A

Strings

=E, xrefs: 0045A720, 0045A668

Memory Dump Source

Source File: 00000009.00000002.3349156602.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.3349156602.000000000058A000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.3349156602.0000000000590000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.3349156602.0000000000593000.00000040.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_MPGPH131.jbxd

Similarity

API ID: Cursor$Sleep
String ID: =E
API String ID: 1847515627-2289002813
Opcode ID: 87aaf06eb3feef4bfb938811ad3031e6b1e2923ec5a892cc3e26860d6edd803d
Instruction ID: 823f227e19ebc1f4262c84ee3b7a9e46c16cc5b48225767440be61142120e435
Opcode Fuzzy Hash: 87aaf06eb3feef4bfb938811ad3031e6b1e2923ec5a892cc3e26860d6edd803d
Instruction Fuzzy Hash: B151CC35A00215CFCB18CF58C4C4EAAB7B1FF49705F19429AD945AB312D739ED1ACB81

Uniqueness

Uniqueness Score: -1.00%

Function 004DF790 Relevance: 8.0, APIs: 5, Instructions: 540
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleFileNameA.KERNELBASE(00000000,?,00000200,?,?,811C9DC5), ref: 004DF7D2
GetModuleHandleA.KERNEL32(?), ref: 004DFBF1
GetProcAddress.KERNEL32(00000000,?), ref: 004DFBFC

Memory Dump Source

Source File: 00000009.00000002.3349156602.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.3349156602.000000000058A000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.3349156602.0000000000590000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.3349156602.0000000000593000.00000040.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_MPGPH131.jbxd

Similarity

API ID: Module$AddressFileHandleNameProc
String ID:
API String ID: 3556842501-0
Opcode ID: f5ef7e5a0093e01301607f7d42f07229371b5a2fad561cb305fd20bd82fb37b4
Instruction ID: 1c398614b8e40d06d673246c6905bd3bbdd575ff32f9acac0e67e79eca0af1e2
Opcode Fuzzy Hash: f5ef7e5a0093e01301607f7d42f07229371b5a2fad561cb305fd20bd82fb37b4
Instruction Fuzzy Hash: 393258B4D00249AFDB10CF98D995BEEFBB1FF48314F20425AE849AB381D7346A45CB95

Uniqueness

Uniqueness Score: -1.00%

Function 004D23C0 Relevance: 18.4, APIs: 12, Instructions: 351
networksleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

setsockopt.WS2_32(00000338,0000FFFF,00001006,?,00000008), ref: 004D2466
recv.WS2_32(?,00000004,00000002), ref: 004D2481
WSAGetLastError.WS2_32 ref: 004D2485
recv.WS2_32(00000000,0000000C,00000002,0000000C), ref: 004D24EE
recv.WS2_32(00000000,0000000C,00000008), ref: 004D250F
setsockopt.WS2_32(0000FFFF,00001006,?,00000008,?), ref: 004D258B
recv.WS2_32(00000000,?,00000008), ref: 004D25AC

Part of subcall function 004D3150: WSAStartup.WS2_32 ref: 004D317A
Part of subcall function 004D3150: getaddrinfo.WS2_32(?,?,?,00588CC0), ref: 004D31FC
Part of subcall function 004D3150: socket.WS2_32(?,?,?), ref: 004D321D
Part of subcall function 004D3150: connect.WS2_32(00000000,0055F6D1,?), ref: 004D3231
Part of subcall function 004D3150: closesocket.WS2_32(00000000), ref: 004D323D
Part of subcall function 004D3150: freeaddrinfo.WS2_32(?,?,?,?,00588CC0,?,?), ref: 004D324A
Part of subcall function 004D3150: WSACleanup.WS2_32 ref: 004D3250

recv.WS2_32(?,00000004,00000008), ref: 004D27D6
__Xtime_get_ticks.LIBCPMT ref: 004D27DA
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 004D27E8
Sleep.KERNELBASE(00000001,00000000,?,00002710,00000000), ref: 004D284F
Sleep.KERNELBASE(00000064,?,00002710,00000000), ref: 004D285D

Memory Dump Source

Source File: 00000009.00000002.3349156602.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.3349156602.000000000058A000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.3349156602.0000000000590000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.3349156602.0000000000593000.00000040.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_MPGPH131.jbxd

Similarity

API ID: recv$Sleepsetsockopt$CleanupErrorLastStartupUnothrow_t@std@@@Xtime_get_ticks__ehfuncinfo$??2@closesocketconnectfreeaddrinfogetaddrinfosocket
String ID:
API String ID: 4125349891-0
Opcode ID: 741e4aba1a023d42f8cda5b1c611e4a31a37109a2d99ce0121b9f219ece0da7f
Instruction ID: 15ea99ae058cf58d21446cf462f8f8b9c5c04bab4b96d95aa166a16db5b48a04
Opcode Fuzzy Hash: 741e4aba1a023d42f8cda5b1c611e4a31a37109a2d99ce0121b9f219ece0da7f
Instruction Fuzzy Hash: 55E13230900244DFDB15DBA4CDA07ADBBF1BF66310F24425BE841AB2D2DBB45C8ADB95

Uniqueness

Uniqueness Score: -1.00%

Function 0043D563 Relevance: 17.8, APIs: 9, Strings: 1, Instructions: 273
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 0043D21C: CreateFileW.KERNELBASE(?,?,?,?,?,?,00000000,?,00000000,00000000,00000000,00000000,00000000), ref: 0043D239

GetLastError.KERNEL32 ref: 0043D677
__dosmaperr.LIBCMT ref: 0043D67E
GetFileType.KERNELBASE(00000000), ref: 0043D68A
GetLastError.KERNEL32 ref: 0043D694
__dosmaperr.LIBCMT ref: 0043D69D
CloseHandle.KERNEL32(00000000), ref: 0043D6BD
CloseHandle.KERNEL32(?), ref: 0043D80A
GetLastError.KERNEL32 ref: 0043D83C
__dosmaperr.LIBCMT ref: 0043D843

Strings

H, xrefs: 0043D7C8

Memory Dump Source

Source File: 00000009.00000002.3349156602.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.3349156602.000000000058A000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.3349156602.0000000000590000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.3349156602.0000000000593000.00000040.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_MPGPH131.jbxd

Similarity

API ID: ErrorLast__dosmaperr$CloseFileHandle$CreateType
String ID: H
API String ID: 4237864984-2852464175
Opcode ID: 63c00d4ff725a68de22716b4a375591cf024028e2c9fd4940c7fbe6601f7ac47
Instruction ID: deea7823187220b22c69116efca66525af397024c1424d0dae53dd4a9d4c69af
Opcode Fuzzy Hash: 63c00d4ff725a68de22716b4a375591cf024028e2c9fd4940c7fbe6601f7ac47
Instruction Fuzzy Hash: 47A17C31E14114AFCF19AF68EC467AE3BB1EB0A324F14215EF811DB391DB388816DB55

Uniqueness

Uniqueness Score: -1.00%

Function 004D2190 Relevance: 16.9, APIs: 11, Instructions: 404
networkCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

std::_Throw_Cpp_error.LIBCPMT ref: 004D2391
std::_Throw_Cpp_error.LIBCPMT ref: 004D23A2
setsockopt.WS2_32(00000338,0000FFFF,00001006,?,00000008), ref: 004D2466
recv.WS2_32(?,00000004,00000002), ref: 004D2481
WSAGetLastError.WS2_32 ref: 004D2485
recv.WS2_32(00000000,0000000C,00000002,0000000C), ref: 004D24EE
recv.WS2_32(00000000,0000000C,00000008), ref: 004D250F
setsockopt.WS2_32(0000FFFF,00001006,?,00000008,?), ref: 004D258B
recv.WS2_32(00000000,?,00000008), ref: 004D25AC

Memory Dump Source

Source File: 00000009.00000002.3349156602.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.3349156602.000000000058A000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.3349156602.0000000000590000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.3349156602.0000000000593000.00000040.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_MPGPH131.jbxd

Similarity

API ID: recv$Cpp_errorThrow_setsockoptstd::_$ErrorLast
String ID:
API String ID: 4262120464-0
Opcode ID: c1582d6184370410a97c32afa1233909a04efc10503d3efc906a2629de16cee2
Instruction ID: f7b17b8e68668ba49e7fca0522a5bdce23b6917c1ff1aba89fdf03a1c4391d3e
Opcode Fuzzy Hash: c1582d6184370410a97c32afa1233909a04efc10503d3efc906a2629de16cee2
Instruction Fuzzy Hash: 8AF10070D00248DBDB14DFA8DD95BAEBBB1FF54314F10821AE804AB392DB786985DF94

Uniqueness

Uniqueness Score: -1.00%

Function 004431A0 Relevance: 12.5, APIs: 6, Strings: 1, Instructions: 292
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

, xrefs: 00443421, 00443424

Memory Dump Source

Source File: 00000009.00000002.3349156602.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.3349156602.000000000058A000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.3349156602.0000000000590000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.3349156602.0000000000593000.00000040.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_MPGPH131.jbxd

Similarity

API ID:
String ID:
API String ID: 0-3907804496
Opcode ID: f312eda8249cc3069f08ad3250047b362f1821e8ea6b527c5d9c004b485e982e
Instruction ID: e3239ec4e1ee32b8324d570a22e522ef24bddbe65fd960e714ad45a7b0e040b8
Opcode Fuzzy Hash: f312eda8249cc3069f08ad3250047b362f1821e8ea6b527c5d9c004b485e982e
Instruction Fuzzy Hash: 77B12670A04244AFEB01DF59C881BBE7BB1FF49715F14419AE90197382CB789E41CBA9

Uniqueness

Uniqueness Score: -1.00%

Function 004D3150 Relevance: 12.1, APIs: 8, Instructions: 92
networkCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

WSAStartup.WS2_32 ref: 004D317A
getaddrinfo.WS2_32(?,?,?,00588CC0), ref: 004D31FC
socket.WS2_32(?,?,?), ref: 004D321D
connect.WS2_32(00000000,0055F6D1,?), ref: 004D3231
closesocket.WS2_32(00000000), ref: 004D323D
freeaddrinfo.WS2_32(?,?,?,?,00588CC0,?,?), ref: 004D324A
WSACleanup.WS2_32 ref: 004D3250
freeaddrinfo.WS2_32(?,?,?,?,00588CC0,?,?), ref: 004D3265

Memory Dump Source

Source File: 00000009.00000002.3349156602.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.3349156602.000000000058A000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.3349156602.0000000000590000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.3349156602.0000000000593000.00000040.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_MPGPH131.jbxd

Similarity

API ID: freeaddrinfo$CleanupStartupclosesocketconnectgetaddrinfosocket
String ID:
API String ID: 58224237-0
Opcode ID: 9e6883013388f64e9fa16a16f0073357cf9f7d6acb3b040fdaf446918f01256a
Instruction ID: 66b7f2af6e1e00109afe9fd9f1c3058fd8df4c895de65cf13c46908161227474
Opcode Fuzzy Hash: 9e6883013388f64e9fa16a16f0073357cf9f7d6acb3b040fdaf446918f01256a
Instruction Fuzzy Hash: 7731E631A047009BD7209F29DC4862BB7E5FF85735F104B5FF9A4933E0D37899489696

Uniqueness

Uniqueness Score: -1.00%

Function 004081E0 Relevance: 7.3, APIs: 3, Strings: 1, Instructions: 332
libraryloadernetworkCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleA.KERNEL32(Ws2_32.dll,?,?,?,?,005588D8,00000000,00000000,-00589220), ref: 00408566
GetProcAddress.KERNEL32(00000000,?), ref: 00408574
WSASend.WS2_32(?,?,00000001,00000000,00000000,00000000,00000000,?,?,?,?,005588D8,00000000,00000000,-00589220), ref: 00408589

Strings

Ws2_32.dll, xrefs: 0040855A

Memory Dump Source

Source File: 00000009.00000002.3349156602.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.3349156602.000000000058A000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.3349156602.0000000000590000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.3349156602.0000000000593000.00000040.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_MPGPH131.jbxd

Similarity

API ID: AddressHandleModuleProcSend
String ID: Ws2_32.dll
API String ID: 2819740048-3093949381
Opcode ID: 605ac2d7a3170708ba1039c723fe4127dad6931d4a4a67f7d388f1b1f58ff418
Instruction ID: b889a33a35ddf0adef0218ac58701f77bdbbaba15cb1320cc4c9efeef27d22b6
Opcode Fuzzy Hash: 605ac2d7a3170708ba1039c723fe4127dad6931d4a4a67f7d388f1b1f58ff418
Instruction Fuzzy Hash: 1BE1BC70D00258EFDF15CBA4DD917EDBBB0AF56704F14029EE8857B282DB34198ACB95

Uniqueness

Uniqueness Score: -1.00%

Function 004F2CD0 Relevance: 6.1, APIs: 4, Instructions: 66
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetFileAttributesA.KERNELBASE(?,00000005,00000005,?), ref: 004F2D0C
GetLastError.KERNEL32(?,00000005,00000005,?), ref: 004F2D17
std::_Throw_Cpp_error.LIBCPMT ref: 004F2D4E
std::_Throw_Cpp_error.LIBCPMT ref: 004F2D5F

Memory Dump Source

Source File: 00000009.00000002.3349156602.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.3349156602.000000000058A000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.3349156602.0000000000590000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.3349156602.0000000000593000.00000040.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_MPGPH131.jbxd

Similarity

API ID: Cpp_errorThrow_std::_$AttributesErrorFileLast
String ID:
API String ID: 995686243-0
Opcode ID: 1a30c07ed28fe703679387aa5b2d6d259f589d07aea0d83f312770283b1f14c8
Instruction ID: 325128bde6972141eaafbb0e95bf719766b08d5b5670bbe0189b29004b96e682
Opcode Fuzzy Hash: 1a30c07ed28fe703679387aa5b2d6d259f589d07aea0d83f312770283b1f14c8
Instruction Fuzzy Hash: 3401C071641118129A342A35ED4907F370D8713328BA80F1BEE25973D5D9DFCC45875A

Uniqueness

Uniqueness Score: -1.00%

Function 004D2890 Relevance: 5.8, APIs: 2, Strings: 1, Instructions: 560
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentProcess.KERNEL32(?,6F2977B7,?,?,?,?,?,?,?,00000000,00000001,761B23A0,00000000), ref: 004D2D54

Part of subcall function 004DB380: VirtualAllocEx.KERNEL32(00000000,00000000,?,00003000,00000040,?,00000000), ref: 004DB3EA
Part of subcall function 004DB380: WriteProcessMemory.KERNEL32(00000000,00000000,t-M,?,00000000), ref: 004DB406
Part of subcall function 004DB380: WriteProcessMemory.KERNEL32(?,?,?,?,00000000), ref: 004DB43F
Part of subcall function 004DB380: VirtualAllocEx.KERNEL32(?,00000000,00001000,00003000,00000040), ref: 004DB469

Part of subcall function 0042D43A: ReleaseSRWLockExclusive.KERNEL32(-00000008,?,004D2F08,00588C44,761B23A0,00000000), ref: 0042D44E

Strings

149.18.24.96, xrefs: 004D295C

Memory Dump Source

Source File: 00000009.00000002.3349156602.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.3349156602.000000000058A000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.3349156602.0000000000590000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.3349156602.0000000000593000.00000040.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_MPGPH131.jbxd

Similarity

API ID: Process$AllocMemoryVirtualWrite$CurrentExclusiveLockRelease
String ID: 149.18.24.96
API String ID: 666592346-171400976
Opcode ID: 1d6045fd94a867466258dc9314ed6a82bc2f10a032054fb872e25da8cf31b458
Instruction ID: 26b9c72b6ddc4c31c1f3b4b91af9721e671e16450a7e1798ce2a3c04c8b5f315
Opcode Fuzzy Hash: 1d6045fd94a867466258dc9314ed6a82bc2f10a032054fb872e25da8cf31b458
Instruction Fuzzy Hash: 7432DF70900208CBDB14DF68C9957EDBBB1FF58304F14419AE8096B392DB789E85CFA6

Uniqueness

Uniqueness Score: -1.00%

Function 004F8D20 Relevance: 4.8, APIs: 1, Strings: 2, Instructions: 250
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetLastError.KERNEL32 ref: 004F8DF9

Strings

-2L, xrefs: 004F8E0D
-1L, xrefs: 004F8EAA

Memory Dump Source

Source File: 00000009.00000002.3349156602.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.3349156602.000000000058A000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.3349156602.0000000000590000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.3349156602.0000000000593000.00000040.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_MPGPH131.jbxd

Similarity

API ID: ErrorLast
String ID: -1L$-2L
API String ID: 1452528299-3975959154
Opcode ID: 691346873af9f375a3fd3bec6b454848e53a0b4af0cd965a2b75b339649d0642
Instruction ID: 8532e58cabc42239c9a206463210862c2cf1955d45b676afb1905f123e481057
Opcode Fuzzy Hash: 691346873af9f375a3fd3bec6b454848e53a0b4af0cd965a2b75b339649d0642
Instruction Fuzzy Hash: 8BA1A071E102489BDB18DBA4CC95BFEB771FF58304F14821EE905BB281EB746A85CB54

Uniqueness

Uniqueness Score: -1.00%

Function 00433692 Relevance: 3.7, APIs: 1, Strings: 1, Instructions: 157
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

d A, xrefs: 00433694

Memory Dump Source

Source File: 00000009.00000002.3349156602.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.3349156602.000000000058A000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.3349156602.0000000000590000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.3349156602.0000000000593000.00000040.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_MPGPH131.jbxd

Similarity

API ID:
String ID: d A
API String ID: 0-616623946
Opcode ID: 5716fe010b3ef8e82fbddee052f2b6988042c47bb628807dafe6179510680c26
Instruction ID: 8d691b3f4dbeef2f936747217c2848be1b4780fc272094865f28ed7dea4c0760
Opcode Fuzzy Hash: 5716fe010b3ef8e82fbddee052f2b6988042c47bb628807dafe6179510680c26
Instruction Fuzzy Hash: 7B51E3B4A00104AFDB14DF59CC85AAABBF1EF4D324F24915AF8099B352D379EE41CB94

Uniqueness

Uniqueness Score: -1.00%

Function 00444019 Relevance: 3.2, APIs: 2, Instructions: 196
fileCOMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 0044372F: GetConsoleOutputCP.KERNEL32(DB9B5AE9,00000000,00000000,00000000), ref: 00443792

WriteFile.KERNELBASE(?,00000000,?,00000000,00000000,00000000,00000000,0000000C,?,00000000,00578C88,00000014,0043BE32,00000000,00000000,00000000), ref: 0044419E
GetLastError.KERNEL32(?,00000000), ref: 004441A8

Memory Dump Source

Source File: 00000009.00000002.3349156602.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.3349156602.000000000058A000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.3349156602.0000000000590000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.3349156602.0000000000593000.00000040.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_MPGPH131.jbxd

Similarity

API ID: ConsoleErrorFileLastOutputWrite
String ID:
API String ID: 2915228174-0
Opcode ID: a2902c3c69c25210d81bcce29da4bc8cd80d89380b950bcc4e5f7a79d08526b7
Instruction ID: 0628d0172fcac0a10c399004d6184d52a202fa31f39ed19b8586a1ab0f8a80ff
Opcode Fuzzy Hash: a2902c3c69c25210d81bcce29da4bc8cd80d89380b950bcc4e5f7a79d08526b7
Instruction Fuzzy Hash: 2B61C471900119AFEF11CFA8DC84BEFBBB9BF99304F14014AE900A7202D779D955DB65

Uniqueness

Uniqueness Score: -1.00%

Function 0044368F Relevance: 3.1, APIs: 2, Instructions: 63
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

FindCloseChangeNotification.KERNELBASE(00000000,00000000,CF830579,?,00443576,00000000,CF830579,00578C68,0000000C,00443632,0043790D,?), ref: 004436E5
GetLastError.KERNEL32(?,00443576,00000000,CF830579,00578C68,0000000C,00443632,0043790D,?), ref: 004436EF

Memory Dump Source

Source File: 00000009.00000002.3349156602.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.3349156602.000000000058A000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.3349156602.0000000000590000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.3349156602.0000000000593000.00000040.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_MPGPH131.jbxd

Similarity

API ID: ChangeCloseErrorFindLastNotification
String ID:
API String ID: 1687624791-0
Opcode ID: b78c23c39475fb946a6917cc79ada02ff23f82b2eae8cc914a7116fd1dd25ee2
Instruction ID: 5b9e54e71ebf2813978f3334a6ac8d2e590d94fd15b88a1802dc34040f0fcd9e
Opcode Fuzzy Hash: b78c23c39475fb946a6917cc79ada02ff23f82b2eae8cc914a7116fd1dd25ee2
Instruction Fuzzy Hash: 0B118C326041153AF6302A34AC4DB3F67898B82F39F26014FF908873C2DE6D8D409658

Uniqueness

Uniqueness Score: -1.00%

Function 0043CDAC Relevance: 3.1, APIs: 2, Instructions: 52COMMONLIBRARYCODE

Download Yara Rule

APIs

SetFilePointerEx.KERNELBASE(00000000,00000000,00000000,00000000,00000002,00000000,00000000,00000000,00000000,?,0043CEE6,00000000,00000000,00000000,00000002,00000000), ref: 0043CDE8
GetLastError.KERNEL32(00000000,?,0043CEE6,00000000,00000000,00000000,00000002,00000000,?,004440BE,00000000,00000000,00000000,00000002,00000000,00000000), ref: 0043CDF5

Memory Dump Source

Source File: 00000009.00000002.3349156602.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.3349156602.000000000058A000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.3349156602.0000000000590000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.3349156602.0000000000593000.00000040.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_MPGPH131.jbxd

Similarity

API ID: ErrorFileLastPointer
String ID:
API String ID: 2976181284-0
Opcode ID: 0af088d07c5e9b5a66b5e22e0931705f94c426e6b0292fcf303bea830e5f1f74
Instruction ID: 056746620e1e5b2230fb06e89194d4bad5ac0bf9516e57b03a2b19a767fcc837
Opcode Fuzzy Hash: 0af088d07c5e9b5a66b5e22e0931705f94c426e6b0292fcf303bea830e5f1f74
Instruction Fuzzy Hash: 62012632614119AFCF058F59CC49D9E3F2AEF89320F24020AF811AB2D0EA75ED41DBD4

Uniqueness

Uniqueness Score: -1.00%

Function 05DF57C6 Relevance: 3.0, APIs: 2, Instructions: 41processCOMMON

Download Yara Rule

APIs

CreateToolhelp32Snapshot.KERNEL32(00000008,00000000), ref: 05DF57EE
Module32First.KERNEL32(00000000,00000224), ref: 05DF580E

Memory Dump Source

Source File: 00000009.00000002.3356779154.0000000005DF5000.00000040.00000020.00020000.00000000.sdmp, Offset: 05DF5000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_5df5000_MPGPH131.jbxd

Yara matches

Similarity

API ID: CreateFirstModule32SnapshotToolhelp32
String ID:
API String ID: 3833638111-0
Opcode ID: 3788706d20f5b898e185810e19a2e38a50b9b544ac306a9cd33eedd6d527d18a
Instruction ID: 42ac6b8f834d7d3206d9174c2dcaf544f4b5ef46d58161cf60c1eaae62856923
Opcode Fuzzy Hash: 3788706d20f5b898e185810e19a2e38a50b9b544ac306a9cd33eedd6d527d18a
Instruction Fuzzy Hash: A0F06D32200710BFD7203BB9B88DAAE76E8BF89625F15062AE743910C0DA70E8458B61

Uniqueness

Uniqueness Score: -1.00%

Function 004D20B0 Relevance: 3.0, APIs: 1, Strings: 1, Instructions: 33sleepCOMMON

Download Yara Rule

APIs

Sleep.KERNELBASE(00000065), ref: 004D2103

Strings

131, xrefs: 004D20D8

Memory Dump Source

Source File: 00000009.00000002.3349156602.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.3349156602.000000000058A000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.3349156602.0000000000590000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.3349156602.0000000000593000.00000040.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_MPGPH131.jbxd

Similarity

API ID: Sleep
String ID: 131
API String ID: 3472027048-2136814527
Opcode ID: 7fcd9baa8a9375f207873d3bd77103b4ea8c4e2924f330d05fd9db3092bf82de
Instruction ID: 16727208b5f08e4bea599353fbf53a6d413f31fbfb73884cdf8f34aab55cbcc4
Opcode Fuzzy Hash: 7fcd9baa8a9375f207873d3bd77103b4ea8c4e2924f330d05fd9db3092bf82de
Instruction Fuzzy Hash: B8F0A731B0025416EA26736D7E06B3B3F8997A5765F48009FEE403BBD2DDD9280987D6

Uniqueness

Uniqueness Score: -1.00%

Function 004F3350 Relevance: 1.7, APIs: 1, Instructions: 163COMMON

Download Yara Rule

APIs

__fread_nolock.LIBCMT ref: 004F34EF

Memory Dump Source

Source File: 00000009.00000002.3349156602.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.3349156602.000000000058A000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.3349156602.0000000000590000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.3349156602.0000000000593000.00000040.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_MPGPH131.jbxd

Similarity

API ID: __fread_nolock
String ID:
API String ID: 2638373210-0
Opcode ID: abf0a6e3a039cfc2225a60bdc02679f11cf7d85a06e03d077f7d644c137d6ab0
Instruction ID: 6ce4f48939319f72f3aec6a6d9b50e6fff9bcb1e6f6dae555552d8831335830b
Opcode Fuzzy Hash: abf0a6e3a039cfc2225a60bdc02679f11cf7d85a06e03d077f7d644c137d6ab0
Instruction Fuzzy Hash: 2551A0B0D002099FDB14DF59D981BAEFBB0FF49704F14825EE8146B341E779AA41CBA5

Uniqueness

Uniqueness Score: -1.00%

Function 0044550F Relevance: 1.6, APIs: 1, Instructions: 54COMMON

Download Yara Rule

APIs

__wsopen_s.LIBCMT ref: 00445549

Memory Dump Source

Source File: 00000009.00000002.3349156602.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.3349156602.000000000058A000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.3349156602.0000000000590000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.3349156602.0000000000593000.00000040.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_MPGPH131.jbxd

Similarity

API ID: __wsopen_s
String ID:
API String ID: 3347428461-0
Opcode ID: 74b1a02970c39c47b45041c200990e685aac7fc35223ed5dd6a5c291d0407c3c
Instruction ID: e92d0ab7a98c68cd7689e4ea664d55cb742e11440dbe97f573872f5ababe4450
Opcode Fuzzy Hash: 74b1a02970c39c47b45041c200990e685aac7fc35223ed5dd6a5c291d0407c3c
Instruction Fuzzy Hash: D6112A71A0410AAFDF05DF58E94199F7BF5EF48304F14405AF805EB352D670DA15CB69

Uniqueness

Uniqueness Score: -1.00%

Function 004036F0 Relevance: 1.5, APIs: 1, Instructions: 47COMMONLIBRARYCODE

Download Yara Rule

APIs

Concurrency::cancel_current_task.LIBCPMT ref: 0040373F

Memory Dump Source

Source File: 00000009.00000002.3349156602.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.3349156602.000000000058A000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.3349156602.0000000000590000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.3349156602.0000000000593000.00000040.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_MPGPH131.jbxd

Similarity

API ID: Concurrency::cancel_current_task
String ID:
API String ID: 118556049-0
Opcode ID: c8f910bf03f94a0f0c294a8cbb5c47e77f87340cd5e2596aba26795b41fc774c
Instruction ID: 1f83190ccb7284a945d627c352a8af0deec80e54417847a9b28e6d6de5687d5d
Opcode Fuzzy Hash: c8f910bf03f94a0f0c294a8cbb5c47e77f87340cd5e2596aba26795b41fc774c
Instruction Fuzzy Hash: F6F024F26000009BCB14AF61E4429FAB7ECDE243A7750447FF989D7282E73EDA448788

Uniqueness

Uniqueness Score: -1.00%

Function 00444EEA Relevance: 1.5, APIs: 1, Instructions: 39memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

RtlAllocateHeap.NTDLL(00000008,0042C58A,?,?,00444870,00000001,00000364,?,00000008,000000FF,?,0042F3CF,?,?,00000000,?), ref: 00444F2B

Memory Dump Source

Source File: 00000009.00000002.3349156602.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.3349156602.000000000058A000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.3349156602.0000000000590000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.3349156602.0000000000593000.00000040.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_MPGPH131.jbxd

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: a67815bf3a869f96681a983d491eb3b40caf69aff6fa6519728d0dfc96a736c8
Instruction ID: 086544c5e523b8e02c2757f3417cf7e9bd7439c420b709eac9e7cfb6d4d974b4
Opcode Fuzzy Hash: a67815bf3a869f96681a983d491eb3b40caf69aff6fa6519728d0dfc96a736c8
Instruction Fuzzy Hash: CEF0B4316155246BBB215E629C05B7B7788ABD17A1F158417FD04E7280CE38D80886E9

Uniqueness

Uniqueness Score: -1.00%

Function 00445924 Relevance: 1.5, APIs: 1, Instructions: 32memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

RtlAllocateHeap.NTDLL(00000000,?,?,?,0042F3CF,?,?,00000000,?,?,0040390D,0042C58A,?,?,0042C58A), ref: 00445956

Memory Dump Source

Source File: 00000009.00000002.3349156602.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.3349156602.000000000058A000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.3349156602.0000000000590000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.3349156602.0000000000593000.00000040.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_MPGPH131.jbxd

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: f2b14cbab143d06f1f7f7dbb6931a5cb890e65deebc000058d543e0d14a0fef9
Instruction ID: 47241cb67a9c7b30d4e0b830f1b418076ccf533a730137c1b779a77b3e9f7ccf
Opcode Fuzzy Hash: f2b14cbab143d06f1f7f7dbb6931a5cb890e65deebc000058d543e0d14a0fef9
Instruction Fuzzy Hash: 1CE0E571202A20EBFE252F265C0576B3648DB413B0F080113FD05F6292DB68CC0482ED

Uniqueness

Uniqueness Score: -1.00%

Function 0043D21C Relevance: 1.5, APIs: 1, Instructions: 15fileCOMMONLIBRARYCODE

Download Yara Rule

APIs

CreateFileW.KERNELBASE(?,?,?,?,?,?,00000000,?,00000000,00000000,00000000,00000000,00000000), ref: 0043D239

Memory Dump Source

Source File: 00000009.00000002.3349156602.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.3349156602.000000000058A000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.3349156602.0000000000590000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.3349156602.0000000000593000.00000040.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_MPGPH131.jbxd

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: a91d23867b62d5b96c41623edd2e8bd3ad87182c46de236b94739b51406d3068
Instruction ID: 7ae74b51c889a2cb05e6a06522f477e8d6926b4a8c7f3733491aa3a38d366a2c
Opcode Fuzzy Hash: a91d23867b62d5b96c41623edd2e8bd3ad87182c46de236b94739b51406d3068
Instruction Fuzzy Hash: 92D06C3200010DBBDF028F84DC06EDA3BAAFB4C714F014040FA1866120C772E822EB90

Uniqueness

Uniqueness Score: -1.00%

Function 05DF5485 Relevance: 1.3, APIs: 1, Instructions: 48memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNELBASE(00000000,?,00001000,00000040), ref: 05DF54D6

Memory Dump Source

Source File: 00000009.00000002.3356779154.0000000005DF5000.00000040.00000020.00020000.00000000.sdmp, Offset: 05DF5000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_5df5000_MPGPH131.jbxd

Yara matches

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 499270a49480bde3a93b1541ef130abcc6c407f96609cce36d97d57e1d2ec7bb
Instruction ID: e5a9e8f3a25edc37c38790a172b31c15b11300ccdb9fd42d5bc88643d1435af7
Opcode Fuzzy Hash: 499270a49480bde3a93b1541ef130abcc6c407f96609cce36d97d57e1d2ec7bb
Instruction Fuzzy Hash: C8112B79A00208EFDB01DF98C985E99BBF5EF08350F068095FA489B361D371EA90DB90

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 0044D3EB Relevance: 7.3, APIs: 3, Strings: 1, Instructions: 254COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 004446D2: GetLastError.KERNEL32(00000000,?,0044A0B9), ref: 004446D6
Part of subcall function 004446D2: SetLastError.KERNEL32(00000000,00000000,?,00000008,000000FF), ref: 00444778

GetACP.KERNEL32(?,?,?,?,?,?,00441B90,?,?,?,00000055,?,-00000050,?,?,00000004), ref: 0044D4AA
IsValidCodePage.KERNEL32(00000000,?,?,?,?,?,?,00441B90,?,?,?,00000055,?,-00000050,?,?), ref: 0044D4E1
GetLocaleInfoW.KERNEL32(00000000,?,?,00000078,-00000050,00000000,000000D0), ref: 0044D644

Strings

utf8, xrefs: 0044D5B3

Memory Dump Source

Source File: 00000009.00000002.3349156602.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.3349156602.000000000058A000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.3349156602.0000000000590000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.3349156602.0000000000593000.00000040.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_MPGPH131.jbxd

Similarity

API ID: ErrorLast$CodeInfoLocalePageValid
String ID: utf8
API String ID: 607553120-905460609
Opcode ID: c45a0186f4581b71202d969cc458f697c66e26bf91fa0bd1cdd2ae7615315ff2
Instruction ID: 2cfea991c2b2acc9964e98fc6b5fb71baa63820d9a3b6a37bb74a83d3ed0bc3b
Opcode Fuzzy Hash: c45a0186f4581b71202d969cc458f697c66e26bf91fa0bd1cdd2ae7615315ff2
Instruction Fuzzy Hash: F771D671A00605AAFB24AB75CC86BBB73A8EF05748F14442BF905D7281EF7CE944C769

Uniqueness

Uniqueness Score: -1.00%

Function 004F2150 Relevance: 33.4, APIs: 17, Strings: 2, Instructions: 154windowfileCOMMON

Download Yara Rule

APIs

GdiplusStartup.GDIPLUS(?,?,00000000), ref: 004F2189
GetSystemMetrics.USER32(00000001), ref: 004F219F
GetSystemMetrics.USER32(00000000), ref: 004F21A5
GetDC.USER32(00000000), ref: 004F21AB
CreateCompatibleDC.GDI32(00000000), ref: 004F21BF
CreateCompatibleBitmap.GDI32(00000000,00000000,00000000), ref: 004F21D3
SelectObject.GDI32(?,00000000), ref: 004F21E8
BitBlt.GDI32(?,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00CC0020), ref: 004F2201
GdipCreateBitmapFromHBITMAP.GDIPLUS(?,00000000,?), ref: 004F2217
GdipGetImageEncodersSize.GDIPLUS(00000000,?), ref: 004F2233
GdipGetImageEncoders.GDIPLUS(00000000,00000000,00000000), ref: 004F225A
GdipSaveImageToFile.GDIPLUS(00000000,?,?,?), ref: 004F22FD
DeleteObject.GDI32(?), ref: 004F2306
GdipDisposeImage.GDIPLUS(00000000), ref: 004F230D
DeleteObject.GDI32(?), ref: 004F2316
ReleaseDC.USER32(00000000,00000000), ref: 004F231F
GdiplusShutdown.GDIPLUS(?), ref: 004F2328

Strings

d, xrefs: 004F2165
image/png, xrefs: 004F2272

Memory Dump Source

Source File: 00000009.00000002.3349156602.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.3349156602.000000000058A000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.3349156602.0000000000590000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.3349156602.0000000000593000.00000040.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_MPGPH131.jbxd

Similarity

API ID: Gdip$Image$CreateObject$BitmapCompatibleDeleteEncodersGdiplusMetricsSystem$DisposeFileFromReleaseSaveSelectShutdownSizeStartup
String ID: d$image/png
API String ID: 258367123-2616758285
Opcode ID: d93c92cf953bbe82929a5a79100fd7e348d6b079dbf9517b437a49d65dcd1284
Instruction ID: db5a99caf6ac0e95f343f652cfce475829ccb6d2aa326760d5af157a7b9552c8
Opcode Fuzzy Hash: d93c92cf953bbe82929a5a79100fd7e348d6b079dbf9517b437a49d65dcd1284
Instruction Fuzzy Hash: C8516D71D00209AFDF109FA4DD49BEEBBB8FF18314F100065EA05B72A1D7B99948DB64

Uniqueness

Uniqueness Score: -1.00%

Function 00432056 Relevance: 14.3, APIs: 4, Strings: 4, Instructions: 303COMMONLIBRARYCODE

Download Yara Rule

APIs

___TypeMatch.LIBVCRUNTIME ref: 00432283
CatchIt.LIBVCRUNTIME ref: 004322D4
_UnwindNestedFrames.LIBCMT ref: 004323D5
CallUnexpected.LIBVCRUNTIME ref: 004323F0

Strings

L;V, xrefs: 0043216C
csm, xrefs: 00432093
csm, xrefs: 00432100
csm, xrefs: 004321AC

Memory Dump Source

Source File: 00000009.00000002.3349156602.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.3349156602.000000000058A000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.3349156602.0000000000590000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.3349156602.0000000000593000.00000040.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_MPGPH131.jbxd

Similarity

API ID: CallCatchFramesMatchNestedTypeUnexpectedUnwind
String ID: L;V$csm$csm$csm
API String ID: 944608866-3339109018
Opcode ID: f219870799de8bf8d93d667d8b8260d42bea9e02fac3f36c4a5e93c416ed644d
Instruction ID: 1a3b2e3aada59ff5ba11aad393d6dbbfac41e5171332123353ed96db4a75ae81
Opcode Fuzzy Hash: f219870799de8bf8d93d667d8b8260d42bea9e02fac3f36c4a5e93c416ed644d
Instruction Fuzzy Hash: 81B19971800219EFCF18DFA5CA819AFBBB5FF08314F14605BE9106B252D7B8DA51CB99

Uniqueness

Uniqueness Score: -1.00%

Function 00452273 Relevance: 14.1, APIs: 1, Strings: 7, Instructions: 147COMMONLIBRARYCODE

Download Yara Rule

APIs

DecodePointer.KERNEL32(?,?,?,?,?,?,?,?,?,00451BDF), ref: 0045228C

Strings

log10, xrefs: 004522CE, 004522DD
pow, xrefs: 0045232A, 004523D4, 00452421
sqrt, xrefs: 004523CB
acos, xrefs: 004523C2
asin, xrefs: 004523B9
exp, xrefs: 0045230B, 00452370
log, xrefs: 004522E9, 004522F8

Memory Dump Source

Source File: 00000009.00000002.3349156602.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.3349156602.000000000058A000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.3349156602.0000000000590000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.3349156602.0000000000593000.00000040.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_MPGPH131.jbxd

Similarity

API ID: DecodePointer
String ID: acos$asin$exp$log$log10$pow$sqrt
API String ID: 3527080286-3064271455
Opcode ID: 78e946a8a646183d16df3de3d23e88c0ab9a8f5197b1dee8433a7cf1ad31b41b
Instruction ID: bc8b7c0c72404b0f1092b03344519f1b29bd64598f75d1cbe0b332ea915a13b4
Opcode Fuzzy Hash: 78e946a8a646183d16df3de3d23e88c0ab9a8f5197b1dee8433a7cf1ad31b41b
Instruction Fuzzy Hash: 40513B70A0050ADBCF148F69DA481AE7FB4FB46306F144147EC81A7266C7FC8A6EDB59

Uniqueness

Uniqueness Score: -1.00%

Function 00551130 Relevance: 13.6, APIs: 9, Instructions: 88sleepfileCOMMON

Download Yara Rule

APIs

Part of subcall function 00551780: GetVersionExA.KERNEL32(?), ref: 005517A6

GetVersionExA.KERNEL32(?), ref: 00551173
DeleteFileW.KERNEL32(00000000), ref: 00551192
GetFileAttributesW.KERNEL32(00000000), ref: 00551199
GetLastError.KERNEL32 ref: 005511A6
Sleep.KERNEL32(00000064), ref: 005511BC
DeleteFileA.KERNEL32(00000000), ref: 005511C5
GetFileAttributesA.KERNEL32(00000000), ref: 005511CC
GetLastError.KERNEL32 ref: 005511D9
Sleep.KERNEL32(00000064), ref: 005511EF

Memory Dump Source

Source File: 00000009.00000002.3349156602.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.3349156602.000000000058A000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.3349156602.0000000000590000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.3349156602.0000000000593000.00000040.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_MPGPH131.jbxd

Similarity

API ID: File$AttributesDeleteErrorLastSleepVersion
String ID:
API String ID: 1421123951-0
Opcode ID: 254916c3e086d8c6bc62c099ca2d2d4904ded30bcc8ed0b7d7c71cfea1b2b4f0
Instruction ID: 2cf516fa490645c339834e1360d609708cb136430ee32b1ceb257c2769835cc0
Opcode Fuzzy Hash: 254916c3e086d8c6bc62c099ca2d2d4904ded30bcc8ed0b7d7c71cfea1b2b4f0
Instruction Fuzzy Hash: 5F21F635900E149BCB20AB78AC9C2AD7EB4FB6A336F100197EE1AD3280DA704849D751

Uniqueness

Uniqueness Score: -1.00%

Function 004FA2D0 Relevance: 12.2, APIs: 8, Instructions: 165networkCOMMON

Download Yara Rule

APIs

InternetSetOptionA.WININET(00000000,00000006,?,00000004), ref: 004FA320
GetLastError.KERNEL32 ref: 004FA415
InternetQueryOptionA.WININET(00000000,0000001F,80000000,?), ref: 004FA440

Memory Dump Source

Source File: 00000009.00000002.3349156602.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.3349156602.000000000058A000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.3349156602.0000000000590000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.3349156602.0000000000593000.00000040.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_MPGPH131.jbxd

Similarity

API ID: InternetOption$ErrorLastQuery
String ID:
API String ID: 3980908186-0
Opcode ID: 13505afe8bee8b3cefde12bb8587481c6416af93cd2c35f6481ac9ff60e3cb98
Instruction ID: f01b2b404452f55ee339e3d54677c8633c7154c7c4ff77dbfa4ec76481364019
Opcode Fuzzy Hash: 13505afe8bee8b3cefde12bb8587481c6416af93cd2c35f6481ac9ff60e3cb98
Instruction Fuzzy Hash: B7515EB5D40318ABEB20CF94DC85BFEBBB4EB48711F10411AEE14B7380D7B46A059BA5

Uniqueness

Uniqueness Score: -1.00%

Function 004463F6 Relevance: 10.8, APIs: 7, Instructions: 329COMMON

Download Yara Rule

APIs

_strrchr.LIBCMT ref: 0044647C

Memory Dump Source

Source File: 00000009.00000002.3349156602.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.3349156602.000000000058A000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.3349156602.0000000000590000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.3349156602.0000000000593000.00000040.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_MPGPH131.jbxd

Similarity

API ID: _strrchr
String ID:
API String ID: 3213747228-0
Opcode ID: 34bc779386904af94e3a65745d8093cf5441aa8cc4e4cdc27bc5775c85d1135f
Instruction ID: 2b99461290635fdf7c51841e77c4c0c2a1f842bf94a4ab4c5a5740794f6651be
Opcode Fuzzy Hash: 34bc779386904af94e3a65745d8093cf5441aa8cc4e4cdc27bc5775c85d1135f
Instruction Fuzzy Hash: F7B16A72900255AFFB118F24CC81BAF7BA5EF17354F16415BE804AB382D67CD901CBAA

Uniqueness

Uniqueness Score: -1.00%

Function 0041A2A0 Relevance: 9.1, APIs: 6, Instructions: 141COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 0041A2CA
std::_Lockit::_Lockit.LIBCPMT ref: 0041A2EC
std::_Lockit::~_Lockit.LIBCPMT ref: 0041A30C
__Getcoll.LIBCPMT ref: 0041A3AF
std::_Facet_Register.LIBCPMT ref: 0041A413
std::_Lockit::~_Lockit.LIBCPMT ref: 0041A42B

Memory Dump Source

Source File: 00000009.00000002.3349156602.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.3349156602.000000000058A000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.3349156602.0000000000590000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.3349156602.0000000000593000.00000040.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_MPGPH131.jbxd

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Facet_GetcollRegister
String ID:
API String ID: 1184649410-0
Opcode ID: 076d0fe7c93981d2d41f397725067e6f3a6359fb17fddf899550ac6be59329cf
Instruction ID: 4dfe593e994f1a936f3b51d0b47bc881a4e76fe992b8c8e0f1a10b66f2d188dc
Opcode Fuzzy Hash: 076d0fe7c93981d2d41f397725067e6f3a6359fb17fddf899550ac6be59329cf
Instruction Fuzzy Hash: C751F0B0901218DFCB11DF59E9857EEBBB0EF04314F14411EE806AB381D738AE85CB96

Uniqueness

Uniqueness Score: -1.00%

Function 00551220 Relevance: 7.7, APIs: 5, Instructions: 208fileCOMMON

Download Yara Rule

APIs

GetVersionExA.KERNEL32(?), ref: 005512E3
CreateFileW.KERNEL32(00000000,C0000000,00000003,00000000,7FFFFFFD,00000000,00000000), ref: 00551313
CreateFileA.KERNEL32(00000000,C0000000,00000003,00000000,7FFFFFFD,00000000,00000000), ref: 0055131B

Memory Dump Source

Source File: 00000009.00000002.3349156602.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.3349156602.000000000058A000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.3349156602.0000000000590000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.3349156602.0000000000593000.00000040.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_MPGPH131.jbxd

Similarity

API ID: CreateFile$Version
String ID:
API String ID: 1715692615-0
Opcode ID: a50e396471c21bd5292f2ea255f87583e8432b1e27d6808c766b3da514bf39bc
Instruction ID: b4edcec529d807a06da9efb1c5396e9c71554b609393fe2db9d6cd66cb1a39d6
Opcode Fuzzy Hash: a50e396471c21bd5292f2ea255f87583e8432b1e27d6808c766b3da514bf39bc
Instruction Fuzzy Hash: C561CC71604702ABDB10DF29D854BABBFE4FF84315F04492AFC99D6280EB35D9098B96

Uniqueness

Uniqueness Score: -1.00%

Function 00407270 Relevance: 7.2, APIs: 1, Strings: 3, Instructions: 228COMMON

Download Yara Rule

APIs

___std_exception_copy.LIBVCRUNTIME ref: 004073FD

Strings

0f@, xrefs: 004073DD
0f@, xrefs: 0040740F
ror, xrefs: 0040729F

Memory Dump Source

Source File: 00000009.00000002.3349156602.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.3349156602.000000000058A000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.3349156602.0000000000590000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.3349156602.0000000000593000.00000040.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_MPGPH131.jbxd

Similarity

API ID: ___std_exception_copy
String ID: 0f@$0f@$ror
API String ID: 2659868963-919343903
Opcode ID: 54ef4146cc9973e50abdb5aac5b5de4deb1e0ccdb64d7a1b44ba731a5b074de1
Instruction ID: 2d5b59f1ef23ddaf1b3783c953f764ee005f0a1066ad4b0af46aed6f156e7821
Opcode Fuzzy Hash: 54ef4146cc9973e50abdb5aac5b5de4deb1e0ccdb64d7a1b44ba731a5b074de1
Instruction Fuzzy Hash: 0981E471D002149FDB14DF98DC81BADBBB1FF49304F14826EE858AB392D774A980DB95

Uniqueness

Uniqueness Score: -1.00%

Function 00407080 Relevance: 7.2, APIs: 1, Strings: 3, Instructions: 159COMMON

Download Yara Rule

APIs

___std_exception_copy.LIBVCRUNTIME ref: 004071FE

Strings

0f@, xrefs: 004071E2
0f@, xrefs: 00407210
ange, xrefs: 004070AF

Memory Dump Source

Source File: 00000009.00000002.3349156602.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.3349156602.000000000058A000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.3349156602.0000000000590000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.3349156602.0000000000593000.00000040.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_MPGPH131.jbxd

Similarity

API ID: ___std_exception_copy
String ID: 0f@$0f@$ange
API String ID: 2659868963-373280750
Opcode ID: ec8c38be1f093bccec6f39d26ed8a8a50c4b02158e6fab184ee58c429a3f3a88
Instruction ID: 288f119f4ccb4c7cf0b8972ea0ca9e4329cc491e57a4aee3b53e0c7375ef9e73
Opcode Fuzzy Hash: ec8c38be1f093bccec6f39d26ed8a8a50c4b02158e6fab184ee58c429a3f3a88
Instruction Fuzzy Hash: 3E51F371D002449BDB18CFA8DC847ADBBB0FF85304F24836EE4157B391E7B8A9848B55

Uniqueness

Uniqueness Score: -1.00%

Function 00414160 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 33COMMON

Download Yara Rule

APIs

___std_exception_copy.LIBVCRUNTIME ref: 0041417F
___std_exception_copy.LIBVCRUNTIME ref: 004141A6

Strings

0f@, xrefs: 00414184
0f@, xrefs: 004141B5

Memory Dump Source

Source File: 00000009.00000002.3349156602.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.3349156602.000000000058A000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.3349156602.0000000000590000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.3349156602.0000000000593000.00000040.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_MPGPH131.jbxd

Similarity

API ID: ___std_exception_copy
String ID: 0f@$0f@
API String ID: 2659868963-4245790314
Opcode ID: a0ec767d29c154d107e2924c90945eb70bd3bcc0216d37c8e4efd4af5cc58e06
Instruction ID: a7d6c344e60e7f18edcee1d7e68ac694af1bcf80748ebca3b88f48a52b3fdaf1
Opcode Fuzzy Hash: a0ec767d29c154d107e2924c90945eb70bd3bcc0216d37c8e4efd4af5cc58e06
Instruction Fuzzy Hash: 53F0FFB6910B16AB8751DFA6D440882FBFCFE55310750872BA51597A00F7B4F5588BA0

Uniqueness

Uniqueness Score: -1.00%

Function 00414230 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 33COMMON

Download Yara Rule

APIs

___std_exception_copy.LIBVCRUNTIME ref: 0041424F
___std_exception_copy.LIBVCRUNTIME ref: 00414276

Strings

0f@, xrefs: 00414285
0f@, xrefs: 00414254

Memory Dump Source

Source File: 00000009.00000002.3349156602.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.3349156602.000000000058A000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.3349156602.0000000000590000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.3349156602.0000000000593000.00000040.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_MPGPH131.jbxd

Similarity

API ID: ___std_exception_copy
String ID: 0f@$0f@
API String ID: 2659868963-4245790314
Opcode ID: 7df463b482ac48a62a19cdfd521df996d263433cd12c62f8aacd95f3aeb874f2
Instruction ID: c81a8536ff326cbba859ccac6298cb5db3856efc80ffb62d725151cad3de68e9
Opcode Fuzzy Hash: 7df463b482ac48a62a19cdfd521df996d263433cd12c62f8aacd95f3aeb874f2
Instruction Fuzzy Hash: D8F0FFB6910B16AB8751DF65D440882FBFCFE55324350872BA5159BA00F7B4F6588BA0

Uniqueness

Uniqueness Score: -1.00%

Function 00446260 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 17fileCOMMON

Download Yara Rule

APIs

DeleteFileW.KERNEL32(A{C,?,00437B41,?), ref: 00446268
GetLastError.KERNEL32(?,00437B41,?), ref: 00446272
__dosmaperr.LIBCMT ref: 00446279

Strings

A{C, xrefs: 00446265

Memory Dump Source

Source File: 00000009.00000002.3349156602.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.3349156602.000000000058A000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.3349156602.0000000000590000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.3349156602.0000000000593000.00000040.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_MPGPH131.jbxd

Similarity

API ID: DeleteErrorFileLast__dosmaperr
String ID: A{C
API String ID: 1545401867-2902953714
Opcode ID: d06e79dd3ba0cf7262f3e9d2e22031695f25905068d46e1a3810f42683731183
Instruction ID: 82298aed12121fbb76aae4bd86d3a8824ef8c8c9545724addf748e8f9a95ec58
Opcode Fuzzy Hash: d06e79dd3ba0cf7262f3e9d2e22031695f25905068d46e1a3810f42683731183
Instruction Fuzzy Hash: E2D02232018A093B8B002BFAFC0C81B3F1CDAC23B4B112212F12CC21A0DF79C880E540

Uniqueness

Uniqueness Score: -1.00%

Function 0043E299 Relevance: 6.1, APIs: 4, Instructions: 132COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.3349156602.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.3349156602.000000000058A000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.3349156602.0000000000590000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.3349156602.0000000000593000.00000040.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_MPGPH131.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7511f47f2b8d2fe514c419f7a8a5e884613d924f38ebbfd2c945a9fddd631bd9
Instruction ID: 2126f9bf5856ab37efc9431dc69293eb0664d4eadafdfeefbb5e8820937b8c22
Opcode Fuzzy Hash: 7511f47f2b8d2fe514c419f7a8a5e884613d924f38ebbfd2c945a9fddd631bd9
Instruction Fuzzy Hash: 0D41D572A00204AFD7259F3ACC42B6BBBA9EB8C714F10552FF951DB3C1D2B9A9408784

Uniqueness

Uniqueness Score: -1.00%

Function 0044A27A Relevance: 6.1, APIs: 4, Instructions: 82COMMON

Download Yara Rule

APIs

Part of subcall function 004494E3: WideCharToMultiByte.KERNEL32(?,00000000,00000000,00000000,?,-00000008,?,00000000,-00000008,-00000008,00000000,?,004450F2,?,00000000,-00000008), ref: 00449544

GetLastError.KERNEL32 ref: 0044A2DE
__dosmaperr.LIBCMT ref: 0044A2E5
GetLastError.KERNEL32(?,?,?,?), ref: 0044A31F
__dosmaperr.LIBCMT ref: 0044A326

Memory Dump Source

Source File: 00000009.00000002.3349156602.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.3349156602.000000000058A000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.3349156602.0000000000590000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.3349156602.0000000000593000.00000040.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_MPGPH131.jbxd

Similarity

API ID: ErrorLast__dosmaperr$ByteCharMultiWide
String ID:
API String ID: 1913693674-0
Opcode ID: 4aeb7d56512abd99a56e580aa898e1e8254ab7db8b2fd6091a031305fb940926
Instruction ID: e808a53d57fca8bd1b61f112aec170daf55b4bc7c6cded0a037d44453b824fae
Opcode Fuzzy Hash: 4aeb7d56512abd99a56e580aa898e1e8254ab7db8b2fd6091a031305fb940926
Instruction Fuzzy Hash: E8210A31644205AFEB20AF62CC8096B77A8FF44368700841FFD19C3340EB79EC619B96

Uniqueness

Uniqueness Score: -1.00%

Function 0044B21E Relevance: 6.1, APIs: 4, Instructions: 74COMMON

Download Yara Rule

APIs

GetEnvironmentStringsW.KERNEL32 ref: 0044B226

Part of subcall function 004494E3: WideCharToMultiByte.KERNEL32(?,00000000,00000000,00000000,?,-00000008,?,00000000,-00000008,-00000008,00000000,?,004450F2,?,00000000,-00000008), ref: 00449544

FreeEnvironmentStringsW.KERNEL32(00000000), ref: 0044B25E
FreeEnvironmentStringsW.KERNEL32(00000000), ref: 0044B27E

Memory Dump Source

Source File: 00000009.00000002.3349156602.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.3349156602.000000000058A000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.3349156602.0000000000590000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.3349156602.0000000000593000.00000040.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_MPGPH131.jbxd

Similarity

API ID: EnvironmentStrings$Free$ByteCharMultiWide
String ID:
API String ID: 158306478-0
Opcode ID: 72d3ac7b96c30aebca4f7b81977510e4ddf762ba545c488265c91b440556a14b
Instruction ID: e8caac45197e5b900f97a91f35687491d1a7555c8db139f57b1f8df2d9843390
Opcode Fuzzy Hash: 72d3ac7b96c30aebca4f7b81977510e4ddf762ba545c488265c91b440556a14b
Instruction Fuzzy Hash: 9311A1B56099157F7A1127769C8EC7F696CFE95398710006AF905D2101EFACCD0192B9

Uniqueness

Uniqueness Score: -1.00%

Function 00490040 Relevance: 6.0, APIs: 4, Instructions: 20synchronizationthreadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 00490044
GetCurrentProcessId.KERNEL32 ref: 0049004C
SetEvent.KERNEL32 ref: 00490069
WaitForSingleObject.KERNEL32(000000FF), ref: 00490077

Memory Dump Source

Source File: 00000009.00000002.3349156602.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.3349156602.000000000058A000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.3349156602.0000000000590000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.3349156602.0000000000593000.00000040.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_MPGPH131.jbxd

Similarity

API ID: Current$EventObjectProcessSingleThreadWait
String ID:
API String ID: 977356572-0
Opcode ID: 07ad26c9a8193a9c403b999b7260b6d74736513c4a61b8b242bc8500957e93da
Instruction ID: 68696a4330ff011d049e89e8b4814e5f18df6cd1e962ac77584aedc126b31ea8
Opcode Fuzzy Hash: 07ad26c9a8193a9c403b999b7260b6d74736513c4a61b8b242bc8500957e93da
Instruction Fuzzy Hash: CCE0467104A615EFCB049F68EC0C865BFA5FB297717408222FC09977B0DB708888EF80

Uniqueness

Uniqueness Score: -1.00%

Function 00406140 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 142COMMON

Download Yara Rule

APIs

___std_fs_get_full_path_name@12.LIBCPMT ref: 004061F2

Strings

absolute, xrefs: 00406274
h<W, xrefs: 004061B7, 00406242

Memory Dump Source

Source File: 00000009.00000002.3349156602.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.3349156602.000000000058A000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.3349156602.0000000000590000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.3349156602.0000000000593000.00000040.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_MPGPH131.jbxd

Similarity

API ID: ___std_fs_get_full_path_name@12
String ID: absolute$h<W
API String ID: 319883303-1227054036
Opcode ID: fc19779bb5a5af7582c79339770b481127d2738d3652d52236bc829e3857b7da
Instruction ID: a39a9e8cd5e7c649dec9d62c81c2f08022a5113abdb27f993b439c29f203247c
Opcode Fuzzy Hash: fc19779bb5a5af7582c79339770b481127d2738d3652d52236bc829e3857b7da
Instruction Fuzzy Hash: C651AEB0E00315ABDB14DF58C9047AABBF4FF48314F10466EE815A7380D775A950CBE5

Uniqueness

Uniqueness Score: -1.00%

Function 004F2340 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 85COMMON

Download Yara Rule

APIs

GdipGetImageEncodersSize.GDIPLUS(?,?), ref: 004F2360
GdipGetImageEncoders.GDIPLUS(00000000,00000000,00000000), ref: 004F238D

Strings

image/png, xrefs: 004F23A2

Memory Dump Source

Source File: 00000009.00000002.3349156602.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.3349156602.000000000058A000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.3349156602.0000000000590000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.3349156602.0000000000593000.00000040.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_MPGPH131.jbxd

Similarity

API ID: EncodersGdipImage$Size
String ID: image/png
API String ID: 864223233-2966254431
Opcode ID: e21b857071d1cb9bc6449797421194390e2296bc93f2d18b0a27c6bddf1e72aa
Instruction ID: 99d255883ba5ce217efe5dd06ccd874c50b7054dcb2a8d5064865148aeb1c457
Opcode Fuzzy Hash: e21b857071d1cb9bc6449797421194390e2296bc93f2d18b0a27c6bddf1e72aa
Instruction Fuzzy Hash: E7213BB2E0011CABDB109BB4DD816BEB7A8EF25314F1001B6ED08E7311E7799A44C655

Uniqueness

Uniqueness Score: -1.00%

Function 00404120 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 55COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 00404141
std::_Locinfo::_Locinfo_ctor.LIBCPMT ref: 00404190

Strings

bad locale name, xrefs: 004041AB

Memory Dump Source

Source File: 00000009.00000002.3349156602.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.3349156602.000000000058A000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.3349156602.0000000000590000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.3349156602.0000000000593000.00000040.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_MPGPH131.jbxd

Similarity

API ID: std::_$Locinfo::_Locinfo_ctorLockitLockit::_
String ID: bad locale name
API String ID: 3988782225-1405518554
Opcode ID: 2d018156623b56751fe73bdace615048a592e1be14230173648bc4ea361b1185
Instruction ID: 95f085b47d10799f27f930042da3a8dc43f911f11589ebef340e3e8cf28b8f7c
Opcode Fuzzy Hash: 2d018156623b56751fe73bdace615048a592e1be14230173648bc4ea361b1185
Instruction Fuzzy Hash: 19118B70504B90AED320CF69D805B1BBBE4EF19714F008A5EE48A87B81D7B9A508CBD6

Uniqueness

Uniqueness Score: -1.00%

Function 00552100 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 48COMMON

Download Yara Rule

APIs

WideCharToMultiByte.KERNEL32(0000FDE9,00000000,00000000,000000FF,00000000,00000000,00000000,00000000,00000000,00000001,00000000,?,0055200A), ref: 0055211A
WideCharToMultiByte.KERNEL32(0000FDE9,00000000,00000000,000000FF,00000000, U,00000000,00000000,0055200A), ref: 0055214A

Strings

U, xrefs: 0055213C

Memory Dump Source

Source File: 00000009.00000002.3349156602.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.3349156602.000000000058A000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.3349156602.0000000000590000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.3349156602.0000000000593000.00000040.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_MPGPH131.jbxd

Similarity

API ID: ByteCharMultiWide
String ID: U
API String ID: 626452242-2085870877
Opcode ID: ee5a59f4ac988d56eb673c4b09d135a0ac0f9a58fb340a166edfd918ee52e803
Instruction ID: 0b132648f7774e7442f2f0b6957801b08d55499a66d80b09d0b1d43035632599
Opcode Fuzzy Hash: ee5a59f4ac988d56eb673c4b09d135a0ac0f9a58fb340a166edfd918ee52e803
Instruction Fuzzy Hash: 38F09632B8522436E63066AA5C0BF577A5CDB47F71F20036AFF18AA1D0D9E1681092DA

Uniqueness

Uniqueness Score: -1.00%

Function 004141D0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 32COMMON

Download Yara Rule

APIs

___std_exception_copy.LIBVCRUNTIME ref: 004141EF
___std_exception_copy.LIBVCRUNTIME ref: 00414216

Strings

0f@, xrefs: 004141F4

Memory Dump Source

Source File: 00000009.00000002.3349156602.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.3349156602.000000000058A000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.3349156602.0000000000590000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.3349156602.0000000000593000.00000040.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_MPGPH131.jbxd

Similarity

API ID: ___std_exception_copy
String ID: 0f@
API String ID: 2659868963-2656153907
Opcode ID: ba255ed8c3bc32c490ad3c9a6150c2f47abf7cac3b88d1f1c6bb2e2459164e61
Instruction ID: 79755fa87b84676f4e4474023142464d524d45420b01c2d18704369f933ac59c
Opcode Fuzzy Hash: ba255ed8c3bc32c490ad3c9a6150c2f47abf7cac3b88d1f1c6bb2e2459164e61
Instruction Fuzzy Hash: 1CF012B6910B16AB8751DF65D440882F7FCFE55310350872BA51597A00F7B4F5588BA0

Uniqueness

Uniqueness Score: -1.00%

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse task scheduling functionality to facilitate initial or recurring execution of malicious code. Utilities exist within all major operating systems to schedule programs or scripts to be executed at a specified date and time. A task can also be scheduled on a remote system, provided the proper authentication is met (ex: RPC and file and printer sharing in Windows environments). Scheduling a task on a remote system typically may require being a member of an admin or otherwise privileged group on the remote system.
Tactics:	Execution, Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, Container: Container Creation, File: File Creation, File: File Modification, Process: Process Creation, Scheduled Job: Scheduled Job Creation
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may achieve persistence by adding a program to a startup folder or referencing it with a Registry run key. Adding an entry to the "run keys" in the Registry or startup folder will cause the program referenced to be executed when a user logs in.These programs will be executed under the context of the user and will have the account's associated permissions level.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, File: File Modification, Process: Process Creation, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may look for details about the network configuration and settings, such as IP and/or MAC addresses, of systems they access or through information discovery of remote systems. Several operating system administration utilities exist that can be used to gather this information. Examples include Arp , ipconfig / ifconfig , nbtstat , and route .
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to take screen captures of the desktop to gather information over the course of an operation. Screen capturing functionality may be included as a feature of a remote access tool used in post-compromise operations. Taking a screenshot is also typically possible through native utilities or API calls, such as `CopyFromScreen` , `xwd` , or `screencapture` .
Tactics:	Collection
Data Sources:	Command: Command Execution, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report 2zdult23rz.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Memory Dumps

Sigma Signatures

System Summary

Snort Signatures

Joe Sandbox Signatures

AV Detection

Cryptography

Compliance

Spreading

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\MPGPH131\MPGPH131.exe

C:\ProgramData\MPGPH131\MPGPH131.exe:Zone.Identifier

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_2zdult23rz.exe_11f98c9716fee19af49aa64de28cc82bb5ae24_9a0d6501_20878b5b-aecd-41dd-aadc-9fcebe731b12\Report.wer

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_2zdult23rz.exe_11f98c9716fee19af49aa64de28cc82bb5ae24_9a0d6501_777a93e1-5691-425a-8add-7dcc282e804c\Report.wer

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_2zdult23rz.exe_11f98c9716fee19af49aa64de28cc82bb5ae24_9a0d6501_ff6612eb-39b4-4539-8240-dd31e3304e2f\Report.wer

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_2zdult23rz.exe_11f98c9716fee19af49aa64de28cc82bb5ae24_9a0d6501_fff45d40-3bb3-47f1-995f-427d72b5da7d\Report.wer

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_MPGPH131.exe_66d9e27e738a68bc2f94c5d06af5b853bcdbaba2_05789ee0_07168908-1ada-4ad9-b8e0-75dfac6a4107\Report.wer

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_MPGPH131.exe_66d9e27e738a68bc2f94c5d06af5b853bcdbaba2_05789ee0_5a4466b5-e58c-4c08-94b8-4ada0870fa41\Report.wer

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_MPGPH131.exe_66d9e27e738a68bc2f94c5d06af5b853bcdbaba2_05789ee0_79dfc724-9704-4183-b4b9-469da4028e4f\Report.wer

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_MPGPH131.exe_66d9e27e738a68bc2f94c5d06af5b853bcdbaba2_05789ee0_d7856789-e655-4e86-98a2-61bad8289a4e\Report.wer

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_MPGPH131.exe_66d9e27e738a68bc2f94c5d06af5b853bcdbaba2_05789ee0_df7456cb-df9e-4b59-93ca-82804b0c1b09\Report.wer

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_MPGPH131.exe_66d9e27e738a68bc2f94c5d06af5b853bcdbaba2_05789ee0_f4c77b85-3516-4f65-b357-332c4a00e2d9\Report.wer

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_RageMP131.exe_d88d6b71db8af1c4ceb4920f8ba97dccd2f8180_9f006fa9_1f2b9adf-cd60-4ea4-9ed5-476865d40b3f\Report.wer

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_RageMP131.exe_d88d6b71db8af1c4ceb4920f8ba97dccd2f8180_9f006fa9_8da1b8ba-8b09-428f-ba51-74f2c7ba8b7d\Report.wer

Windows Analysis Report
2zdult23rz.exe

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre