Edit tour

Windows Analysis Report
LisectAVT_2403002A_135.exe

Overview

General Information

Sample name:	LisectAVT_2403002A_135.exe
Analysis ID:	1482507
MD5:	01022196f7291aa2d9a6baa67efe6745
SHA1:	038ac2f83414013ad1021c4c16a47195123cd570
SHA256:	e71ad4bfc100bfe7888d7bbd57616d32927442b3c300806a67e001dd5c5afab2
Tags:	exenjrat
Infos:

Detection

Njrat

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Antivirus detection for dropped file

Malicious sample detected (through community Yara rule)

Sigma detected: Drops script at startup location

Yara detected Njrat

.NET source code contains method to dynamically call methods (often used by packers)

AI detected suspicious sample

Disables zone checking for all users

Drops PE files to the startup folder

Machine Learning detection for dropped file

Machine Learning detection for sample

Protects its processes via BreakOnTermination flag

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

AV process strings found (often used to terminate AV products)

Abnormal high CPU Usage

Allocates memory with a write watch (potentially for evading sandboxes)

Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)

Contains functionality to call native functions

Contains long sleeps (>= 3 min)

Creates a start menu entry (Start Menu\Programs\Startup)

Detected TCP or UDP traffic on non-standard ports

Detected potential crypto function

Drops PE files

Enables debug privileges

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

IP address seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

Queries the volume information (name, serial number etc) of a device

Sample file is different than original file name gathered from version info

Sigma detected: CurrentVersion Autorun Keys Modification

Sigma detected: Startup Folder File Write

Sigma detected: Wow6432Node CurrentVersion Autorun Keys Modification

Stores files to the Windows start menu directory

Uses 32bit PE files

Uses code obfuscation techniques (call, push, ret)

Yara signature match

Classification

Process Tree

System is w10x64

LisectAVT_2403002A_135.exe (PID: 7728 cmdline: "C:\Users\user\Desktop\LisectAVT_2403002A_135.exe" MD5: 01022196F7291AA2D9A6BAA67EFE6745)

LisectAVT_2403002A_135.exe (PID: 5884 cmdline: "C:\Users\user\Desktop\LisectAVT_2403002A_135.exe" .. MD5: 01022196F7291AA2D9A6BAA67EFE6745)

LisectAVT_2403002A_135.exe (PID: 2636 cmdline: "C:\Users\user\Desktop\LisectAVT_2403002A_135.exe" .. MD5: 01022196F7291AA2D9A6BAA67EFE6745)

LisectAVT_2403002A_135.exe (PID: 2040 cmdline: "C:\Users\user\Desktop\LisectAVT_2403002A_135.exe" .. MD5: 01022196F7291AA2D9A6BAA67EFE6745)

Client.exe (PID: 3996 cmdline: "C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Client.exe" MD5: 01022196F7291AA2D9A6BAA67EFE6745)

Client.exe (PID: 4576 cmdline: "C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Client.exe" MD5: 01022196F7291AA2D9A6BAA67EFE6745)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
NjRAT	RedPacket Security describes NJRat as "a remote access trojan (RAT) has capabilities to log keystrokes, access the victim's camera, steal credentials stored in browsers, open a reverse shell, upload/download files, view the victim's desktop, perform process, file, and registry manipulations, and capabilities to let the attacker update, uninstall, restart, close, disconnect the RAT and rename its campaign ID. Through the Command & Control (CnC) server software, the attacker has capabilities to create and configure the malware to spread through USB drives."It is supposedly popular with actors in the Middle East. Similar to other RATs, many leaked builders may be backdoored.	AQUATIC PANDA Earth Lusca Operation C-Major The Gorgon Group	http://blog.trendmicro.com/trendlabs-security-intelligence/new-rats-emerge-from-leaked-njw0rm-source-code/ http://blogs.360.cn/post/analysis-of-apt-c-37.html http://threatgeek.typepad.com/files/fta-1009---njrat-uncovered-1.pdf https://about.fb.com/news/2021/04/taking-action-against-hackers-in-palestine/ https://asec.ahnlab.com/1369	https://malpedia.caad.fkie.fraunhofer.de/details/win.njrat

Yara Signatures

Memory Dumps

Source	Rule	Description	Author	Strings
0000000B.00000002.1515413460.0000000003101000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_Njrat	Yara detected Njrat	Joe Security
0000000B.00000002.1515413460.0000000003101000.00000004.00000800.00020000.00000000.sdmp	Windows_Trojan_Njrat_30f3c220	unknown	unknown	0xfc3a:$a2: SEE_MASK_NOZONECHECKS 0xf98e:$a3: Download ERROR 0xfdbe:$a4: cmd.exe /c ping 0 -n 2 & del "
0000000B.00000002.1515413460.0000000003101000.00000004.00000800.00020000.00000000.sdmp	njrat1	Identify njRat	Brian Wallace @botnet_hunter	0xfc3a:$a2: SEE_MASK_NOZONECHECKS 0x10262:$b1: [TAP] 0xfdbe:$c3: cmd.exe /c ping
0000000B.00000002.1515413460.0000000003101000.00000004.00000800.00020000.00000000.sdmp	Njrat	detect njRAT in memory	JPCERT/CC Incident Response Group	0xfc3a:$reg: SEE_MASK_NOZONECHECKS 0xf966:$msg: Execute ERROR 0xf9d6:$msg: Execute ERROR 0xfdbe:$ping: cmd.exe /c ping 0 -n 2 & del
00000011.00000002.1798372852.0000000002F31000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_Njrat	Yara detected Njrat	Joe Security
00000011.00000002.1798372852.0000000002F31000.00000004.00000800.00020000.00000000.sdmp	Windows_Trojan_Njrat_30f3c220	unknown	unknown	0xfcf2:$a2: SEE_MASK_NOZONECHECKS 0xfa46:$a3: Download ERROR 0xfe76:$a4: cmd.exe /c ping 0 -n 2 & del "
00000011.00000002.1798372852.0000000002F31000.00000004.00000800.00020000.00000000.sdmp	njrat1	Identify njRat	Brian Wallace @botnet_hunter	0xfcf2:$a2: SEE_MASK_NOZONECHECKS 0x1031a:$b1: [TAP] 0xfe76:$c3: cmd.exe /c ping
00000011.00000002.1798372852.0000000002F31000.00000004.00000800.00020000.00000000.sdmp	Njrat	detect njRAT in memory	JPCERT/CC Incident Response Group	0xfcf2:$reg: SEE_MASK_NOZONECHECKS 0xfa1e:$msg: Execute ERROR 0xfa8e:$msg: Execute ERROR 0xfe76:$ping: cmd.exe /c ping 0 -n 2 & del
Process Memory Space: LisectAVT_2403002A_135.exe PID: 7728	JoeSecurity_Njrat	Yara detected Njrat	Joe Security
Process Memory Space: LisectAVT_2403002A_135.exe PID: 5884	JoeSecurity_Njrat	Yara detected Njrat	Joe Security
Process Memory Space: Client.exe PID: 3996	JoeSecurity_Njrat	Yara detected Njrat	Joe Security
Click to see the 6 entries

Sigma Signatures

System Summary

Sigma detected: CurrentVersion Autorun Keys Modification

Source: Registry Key set

Author: Victor Sergeev, Daniil Yugoslavskiy, Gleb Sukhodolskiy, Timur Zinniatullin, oscd.community, Tim Shelton, frack113 (split): Data: Details: "C:\Users\user\Desktop\LisectAVT_2403002A_135.exe" .., EventID: 13, EventType: SetValue, Image: C:\Users\user\Desktop\LisectAVT_2403002A_135.exe, ProcessId: 7728, TargetObject: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Client.exe

Sigma detected: Startup Folder File Write

Source: File created

Author: Roberto Rodriguez (Cyb3rWard0g), OTR (Open Threat Research): Data: EventID: 11, Image: C:\Users\user\Desktop\LisectAVT_2403002A_135.exe, ProcessId: 7728, TargetFilename: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Client.exe

Sigma detected: Wow6432Node CurrentVersion Autorun Keys Modification

Source: Registry Key set

Author: Victor Sergeev, Daniil Yugoslavskiy, Gleb Sukhodolskiy, Timur Zinniatullin, oscd.community, Tim Shelton, frack113 (split): Data: Details: "C:\Users\user\Desktop\LisectAVT_2403002A_135.exe" .., EventID: 13, EventType: SetValue, Image: C:\Users\user\Desktop\LisectAVT_2403002A_135.exe, ProcessId: 7728, TargetObject: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Client.exe

Data Obfuscation

Sigma detected: Drops script at startup location

Source: File created

Author: Joe Security: Data: EventID: 11, Image: C:\Users\user\Desktop\LisectAVT_2403002A_135.exe, ProcessId: 7728, TargetFilename: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Client.url

Snort Signatures

⊘No Snort rule has matched

Suricata Signatures

ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (inf) - Source IP: 192.168.2.10 - Destination IP: 147.185.221.19

Timestamp:	2024-07-25T23:57:51.109328+0200
SID:	2825563
Source Port:	49719
Destination Port:	5585
Protocol:	TCP
Classtype:	Malware Command and Control Activity Detected

ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (act) - Source IP: 192.168.2.10 - Destination IP: 147.185.221.19

Timestamp:	2024-07-25T23:56:40.736396+0200
SID:	2825564
Source Port:	49715
Destination Port:	5585
Protocol:	TCP
Classtype:	Malware Command and Control Activity Detected

ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (inf) - Source IP: 192.168.2.10 - Destination IP: 147.185.221.19

Timestamp:	2024-07-25T23:56:10.629751+0200
SID:	2825563
Source Port:	49707
Destination Port:	5585
Protocol:	TCP
Classtype:	Malware Command and Control Activity Detected

ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (inf) - Source IP: 192.168.2.10 - Destination IP: 147.185.221.19

Timestamp:	2024-07-25T23:58:23.348159+0200
SID:	2825563
Source Port:	49720
Destination Port:	5585
Protocol:	TCP
Classtype:	Malware Command and Control Activity Detected

ET MALWARE Bladabindi/njRAT CnC Command (ll) - Source IP: 192.168.2.10 - Destination IP: 147.185.221.19

Timestamp:	2024-07-25T23:56:57.567515+0200
SID:	2021176
Source Port:	49716
Destination Port:	5585
Protocol:	TCP
Classtype:	Malware Command and Control Activity Detected

ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (act) - Source IP: 192.168.2.10 - Destination IP: 147.185.221.19

Timestamp:	2024-07-25T23:56:59.790090+0200
SID:	2825564
Source Port:	49716
Destination Port:	5585
Protocol:	TCP
Classtype:	Malware Command and Control Activity Detected

ET MALWARE Bladabindi/njRAT CnC Command (ll) - Source IP: 192.168.2.10 - Destination IP: 147.185.221.19

Timestamp:	2024-07-25T23:59:03.030097+0200
SID:	2021176
Source Port:	49722
Destination Port:	5585
Protocol:	TCP
Classtype:	Malware Command and Control Activity Detected

ET MALWARE Bladabindi/njRAT CnC Command (ll) - Source IP: 192.168.2.10 - Destination IP: 147.185.221.19

Timestamp:	2024-07-25T23:59:50.254677+0200
SID:	2021176
Source Port:	49723
Destination Port:	5585
Protocol:	TCP
Classtype:	Malware Command and Control Activity Detected

ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (inf) - Source IP: 192.168.2.10 - Destination IP: 147.185.221.19

Timestamp:	2024-07-25T23:56:57.573142+0200
SID:	2825563
Source Port:	49716
Destination Port:	5585
Protocol:	TCP
Classtype:	Malware Command and Control Activity Detected

ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (act) - Source IP: 192.168.2.10 - Destination IP: 147.185.221.19

Timestamp:	2024-07-25T23:58:28.266864+0200
SID:	2825564
Source Port:	49720
Destination Port:	5585
Protocol:	TCP
Classtype:	Malware Command and Control Activity Detected

ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (act) - Source IP: 192.168.2.10 - Destination IP: 147.185.221.19

Timestamp:	2024-07-25T23:56:12.854505+0200
SID:	2825564
Source Port:	49707
Destination Port:	5585
Protocol:	TCP
Classtype:	Malware Command and Control Activity Detected

ET MALWARE Bladabindi/njRAT CnC Command (ll) - Source IP: 192.168.2.10 - Destination IP: 147.185.221.19

Timestamp:	2024-07-25T23:58:23.343002+0200
SID:	2021176
Source Port:	49720
Destination Port:	5585
Protocol:	TCP
Classtype:	Malware Command and Control Activity Detected

ET MALWARE Bladabindi/njRAT CnC Command (ll) - Source IP: 192.168.2.10 - Destination IP: 147.185.221.19

Timestamp:	2024-07-25T23:57:18.617139+0200
SID:	2021176
Source Port:	49718
Destination Port:	5585
Protocol:	TCP
Classtype:	Malware Command and Control Activity Detected

ET EXPLOIT Possible CVE-2016-2211 Symantec Cab Parsing Buffer Overflow - Source IP: 40.68.123.157 - Destination IP: 192.168.2.10

Timestamp:	2024-07-25T23:56:16.810992+0200
SID:	2022930
Source Port:	443
Destination Port:	49710
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (act) - Source IP: 192.168.2.10 - Destination IP: 147.185.221.19

Timestamp:	2024-07-25T23:56:21.795844+0200
SID:	2825564
Source Port:	49707
Destination Port:	5585
Protocol:	TCP
Classtype:	Malware Command and Control Activity Detected

ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (inf) - Source IP: 192.168.2.10 - Destination IP: 147.185.221.19

Timestamp:	2024-07-25T23:59:03.035444+0200
SID:	2825563
Source Port:	49722
Destination Port:	5585
Protocol:	TCP
Classtype:	Malware Command and Control Activity Detected

ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (inf) - Source IP: 192.168.2.10 - Destination IP: 147.185.221.19

Timestamp:	2024-07-25T23:57:18.624693+0200
SID:	2825563
Source Port:	49718
Destination Port:	5585
Protocol:	TCP
Classtype:	Malware Command and Control Activity Detected

ET MALWARE Bladabindi/njRAT CnC Command (ll) - Source IP: 192.168.2.10 - Destination IP: 147.185.221.19

Timestamp:	2024-07-25T23:57:49.987155+0200
SID:	2021176
Source Port:	49719
Destination Port:	5585
Protocol:	TCP
Classtype:	Malware Command and Control Activity Detected

ET MALWARE Bladabindi/njRAT CnC Command (ll) - Source IP: 192.168.2.10 - Destination IP: 147.185.221.19

Timestamp:	2024-07-25T23:58:50.479118+0200
SID:	2021176
Source Port:	49721
Destination Port:	5585
Protocol:	TCP
Classtype:	Malware Command and Control Activity Detected

ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (act) - Source IP: 192.168.2.10 - Destination IP: 147.185.221.19

Timestamp:	2024-07-25T23:57:52.773301+0200
SID:	2825564
Source Port:	49719
Destination Port:	5585
Protocol:	TCP
Classtype:	Malware Command and Control Activity Detected

ET EXPLOIT Possible CVE-2016-2211 Symantec Cab Parsing Buffer Overflow - Source IP: 40.68.123.157 - Destination IP: 192.168.2.10

Timestamp:	2024-07-25T23:56:59.286848+0200
SID:	2022930
Source Port:	443
Destination Port:	49717
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET MALWARE Bladabindi/njRAT CnC Command (ll) - Source IP: 192.168.2.10 - Destination IP: 147.185.221.19

Timestamp:	2024-07-25T23:56:31.291589+0200
SID:	2021176
Source Port:	49715
Destination Port:	5585
Protocol:	TCP
Classtype:	Malware Command and Control Activity Detected

ET MALWARE Bladabindi/njRAT CnC Command (ll) - Source IP: 192.168.2.10 - Destination IP: 147.185.221.19

Timestamp:	2024-07-25T23:56:10.620138+0200
SID:	2021176
Source Port:	49707
Destination Port:	5585
Protocol:	TCP
Classtype:	Malware Command and Control Activity Detected

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: LisectAVT_2403002A_135.exe

Avira: detected

Antivirus detection for dropped file

Source: C:\Client.exe	Avira: detection malicious, Label: TR/Dropper.Gen
Source: C:\Client.exe	Avira: detection malicious, Label: TR/Dropper.Gen

Yara detected Njrat

Source: Yara match	File source: 0000000B.00000002.1515413460.0000000003101000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000011.00000002.1798372852.0000000002F31000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: LisectAVT_2403002A_135.exe PID: 7728, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: LisectAVT_2403002A_135.exe PID: 5884, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: Client.exe PID: 3996, type: MEMORYSTR

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Machine Learning detection for dropped file

Source: C:\Client.exe	Joe Sandbox ML: detected
Source: C:\Client.exe	Joe Sandbox ML: detected

Machine Learning detection for sample

Source: LisectAVT_2403002A_135.exe

Joe Sandbox ML: detected

Source: LisectAVT_2403002A_135.exe

Static PE information: EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE

Source: C:\Users\user\Desktop\LisectAVT_2403002A_135.exe

File opened: C:\Windows\WinSxS\x86_microsoft.vc80.crt_1fc8b3b9a1e18e3b_8.0.50727.9672_none_d08f9da24428a513\MSVCR80.dll

Jump to behavior

Source: LisectAVT_2403002A_135.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Client.exe	File opened: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Client.exe	File opened: C:\Users\user\AppData\Roaming\Microsoft\	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Client.exe	File opened: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Client.exe	File opened: C:\Users\user\AppData\	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Client.exe	File opened: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Client.exe	File opened: C:\Users\user\	Jump to behavior

Source: global traffic

TCP traffic: 192.168.2.10:49707 -> 147.185.221.19:5585

Source: Joe Sandbox View

IP Address: 147.185.221.19 147.185.221.19

Source: unknown

UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic

DNS traffic detected: DNS query: prior-gently.gl.at.ply.gg

Source: Client.exe, 00000011.00000002.1798372852.0000000002F31000.00000004.00000800.00020000.00000000.sdmp, Client.exe, 00000012.00000002.1904061583.0000000002C0F000.00000004.00000800.00020000.00000000.sdmp, Client.exe, 00000012.00000002.1904061583.0000000002C11000.00000004.00000800.00020000.00000000.sdmp

String found in binary or memory: https://pastebin.com/raw/EngADTbC

E-Banking Fraud

Yara detected Njrat

Source: Yara match	File source: 0000000B.00000002.1515413460.0000000003101000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000011.00000002.1798372852.0000000002F31000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: LisectAVT_2403002A_135.exe PID: 7728, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: LisectAVT_2403002A_135.exe PID: 5884, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: Client.exe PID: 3996, type: MEMORYSTR

Operating System Destruction

Protects its processes via BreakOnTermination flag

Source: C:\Users\user\Desktop\LisectAVT_2403002A_135.exe

Process information set: 01 00 00 00

Jump to behavior

System Summary

Malicious sample detected (through community Yara rule)

Source: 0000000B.00000002.1515413460.0000000003101000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Njrat_30f3c220 Author: unknown
Source: 0000000B.00000002.1515413460.0000000003101000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Identify njRat Author: Brian Wallace @botnet_hunter
Source: 0000000B.00000002.1515413460.0000000003101000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: detect njRAT in memory Author: JPCERT/CC Incident Response Group
Source: 00000011.00000002.1798372852.0000000002F31000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Njrat_30f3c220 Author: unknown
Source: 00000011.00000002.1798372852.0000000002F31000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Identify njRat Author: Brian Wallace @botnet_hunter
Source: 00000011.00000002.1798372852.0000000002F31000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: detect njRAT in memory Author: JPCERT/CC Incident Response Group

Source: C:\Users\user\Desktop\LisectAVT_2403002A_135.exe

Process Stats: CPU usage > 49%

Source: C:\Users\user\Desktop\LisectAVT_2403002A_135.exe	Code function: 1_2_00ECA7E6 NtQuerySystemInformation,	1_2_00ECA7E6
Source: C:\Users\user\Desktop\LisectAVT_2403002A_135.exe	Code function: 1_2_00ECA7AD NtQuerySystemInformation,	1_2_00ECA7AD
Source: C:\Users\user\Desktop\LisectAVT_2403002A_135.exe	Code function: 1_2_052A0206 NtSetInformationProcess,	1_2_052A0206
Source: C:\Users\user\Desktop\LisectAVT_2403002A_135.exe	Code function: 1_2_052A01E4 NtSetInformationProcess,	1_2_052A01E4
Source: C:\Users\user\Desktop\LisectAVT_2403002A_135.exe	Code function: 11_2_012FA7E6 NtQuerySystemInformation,	11_2_012FA7E6
Source: C:\Users\user\Desktop\LisectAVT_2403002A_135.exe	Code function: 11_2_012FA7AD NtQuerySystemInformation,	11_2_012FA7AD
Source: C:\Users\user\Desktop\LisectAVT_2403002A_135.exe	Code function: 12_2_013FA7E6 NtQuerySystemInformation,	12_2_013FA7E6
Source: C:\Users\user\Desktop\LisectAVT_2403002A_135.exe	Code function: 12_2_013FA7AD NtQuerySystemInformation,	12_2_013FA7AD
Source: C:\Users\user\Desktop\LisectAVT_2403002A_135.exe	Code function: 13_2_00CFA7E6 NtQuerySystemInformation,	13_2_00CFA7E6
Source: C:\Users\user\Desktop\LisectAVT_2403002A_135.exe	Code function: 13_2_00CFA7AD NtQuerySystemInformation,	13_2_00CFA7AD
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Client.exe	Code function: 17_2_00F8A7E6 NtQuerySystemInformation,	17_2_00F8A7E6
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Client.exe	Code function: 17_2_00F8A7AD NtQuerySystemInformation,	17_2_00F8A7AD
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Client.exe	Code function: 18_2_00DBA7E6 NtQuerySystemInformation,	18_2_00DBA7E6
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Client.exe	Code function: 18_2_00DBA7AD NtQuerySystemInformation,	18_2_00DBA7AD

Source: C:\Users\user\Desktop\LisectAVT_2403002A_135.exe	Code function: 1_2_00ED38DC		1_2_00ED38DC
Source: C:\Users\user\Desktop\LisectAVT_2403002A_135.exe	Code function: 1_2_052B6B5C		1_2_052B6B5C

Source: LisectAVT_2403002A_135.exe, 00000001.00000002.3717013718.0000000000F5E000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: OriginalFilenamemscorwks.dllT vs LisectAVT_2403002A_135.exe

Source: LisectAVT_2403002A_135.exe

Static PE information: EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE

Source: 0000000B.00000002.1515413460.0000000003101000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Njrat_30f3c220 reference_sample = 741a0f3954499c11f9eddc8df7c31e7c59ca41f1a7005646735b8b1d53438c1b, os = windows, severity = x86, creation_date = 2021-06-13, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Njrat, fingerprint = d15e131bca6beddcaecb20fffaff1784ad8a33a25e7ce90f7450d1a362908cc4, id = 30f3c220-b8dc-45a1-bcf0-027c2f76fa63, last_modified = 2021-10-04
Source: 0000000B.00000002.1515413460.0000000003101000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: njrat1 date = 2015-05-27, author = Brian Wallace @botnet_hunter, description = Identify njRat, author_email = bwall@ballastsecurity.net
Source: 0000000B.00000002.1515413460.0000000003101000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Njrat hash1 = d5f63213ce11798879520b0e9b0d1b68d55f7727758ec8c120e370699a41379d, author = JPCERT/CC Incident Response Group, description = detect njRAT in memory, rule_usage = memory scan
Source: 00000011.00000002.1798372852.0000000002F31000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Njrat_30f3c220 reference_sample = 741a0f3954499c11f9eddc8df7c31e7c59ca41f1a7005646735b8b1d53438c1b, os = windows, severity = x86, creation_date = 2021-06-13, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Njrat, fingerprint = d15e131bca6beddcaecb20fffaff1784ad8a33a25e7ce90f7450d1a362908cc4, id = 30f3c220-b8dc-45a1-bcf0-027c2f76fa63, last_modified = 2021-10-04
Source: 00000011.00000002.1798372852.0000000002F31000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: njrat1 date = 2015-05-27, author = Brian Wallace @botnet_hunter, description = Identify njRat, author_email = bwall@ballastsecurity.net
Source: 00000011.00000002.1798372852.0000000002F31000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Njrat hash1 = d5f63213ce11798879520b0e9b0d1b68d55f7727758ec8c120e370699a41379d, author = JPCERT/CC Incident Response Group, description = detect njRAT in memory, rule_usage = memory scan

Source: LisectAVT_2403002A_135.exe, FHGKMEODNFJFBOOAPDAJBBOGACANNFCGHDOF.cs	Cryptographic APIs: 'CreateDecryptor'
Source: LisectAVT_2403002A_135.exe, FHGKMEODNFJFBOOAPDAJBBOGACANNFCGHDOF.cs	Cryptographic APIs: 'CreateDecryptor'
Source: LisectAVT_2403002A_135.exe, FHGKMEODNFJFBOOAPDAJBBOGACANNFCGHDOF.cs	Cryptographic APIs: 'CreateDecryptor'
Source: LisectAVT_2403002A_135.exe, FHGKMEODNFJFBOOAPDAJBBOGACANNFCGHDOF.cs	Cryptographic APIs: 'CreateDecryptor'
Source: 11.2.LisectAVT_2403002A_135.exe.4104268.0.raw.unpack, FHGKMEODNFJFBOOAPDAJBBOGACANNFCGHDOF.cs	Cryptographic APIs: 'CreateDecryptor'
Source: 11.2.LisectAVT_2403002A_135.exe.4104268.0.raw.unpack, FHGKMEODNFJFBOOAPDAJBBOGACANNFCGHDOF.cs	Cryptographic APIs: 'CreateDecryptor'
Source: 11.2.LisectAVT_2403002A_135.exe.4104268.0.raw.unpack, FHGKMEODNFJFBOOAPDAJBBOGACANNFCGHDOF.cs	Cryptographic APIs: 'CreateDecryptor'
Source: 11.2.LisectAVT_2403002A_135.exe.4104268.0.raw.unpack, FHGKMEODNFJFBOOAPDAJBBOGACANNFCGHDOF.cs	Cryptographic APIs: 'CreateDecryptor'

Source: classification engine

Classification label: mal100.phis.troj.adwa.expl.evad.winEXE@6/7@1/1

Source: C:\Users\user\Desktop\LisectAVT_2403002A_135.exe	Code function: 1_2_00ECB326 AdjustTokenPrivileges,	1_2_00ECB326
Source: C:\Users\user\Desktop\LisectAVT_2403002A_135.exe	Code function: 1_2_00ECB2EF AdjustTokenPrivileges,	1_2_00ECB2EF
Source: C:\Users\user\Desktop\LisectAVT_2403002A_135.exe	Code function: 11_2_012FB502 AdjustTokenPrivileges,	11_2_012FB502
Source: C:\Users\user\Desktop\LisectAVT_2403002A_135.exe	Code function: 11_2_012FB4CB AdjustTokenPrivileges,	11_2_012FB4CB
Source: C:\Users\user\Desktop\LisectAVT_2403002A_135.exe	Code function: 12_2_013FB502 AdjustTokenPrivileges,	12_2_013FB502
Source: C:\Users\user\Desktop\LisectAVT_2403002A_135.exe	Code function: 12_2_013FB4CB AdjustTokenPrivileges,	12_2_013FB4CB
Source: C:\Users\user\Desktop\LisectAVT_2403002A_135.exe	Code function: 13_2_00CFB502 AdjustTokenPrivileges,	13_2_00CFB502
Source: C:\Users\user\Desktop\LisectAVT_2403002A_135.exe	Code function: 13_2_00CFB4CB AdjustTokenPrivileges,	13_2_00CFB4CB
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Client.exe	Code function: 17_2_00F8B502 AdjustTokenPrivileges,	17_2_00F8B502
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Client.exe	Code function: 17_2_00F8B4CB AdjustTokenPrivileges,	17_2_00F8B4CB
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Client.exe	Code function: 18_2_00DBB502 AdjustTokenPrivileges,	18_2_00DBB502
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Client.exe	Code function: 18_2_00DBB4CB AdjustTokenPrivileges,	18_2_00DBB4CB

Source: C:\Users\user\Desktop\LisectAVT_2403002A_135.exe

File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Client.exe

Jump to behavior

Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Client.exe	Mutant created: NULL
Source: C:\Users\user\Desktop\LisectAVT_2403002A_135.exe	Mutant created: \Sessions\1\BaseNamedObjects\Global\.net clr networking
Source: C:\Users\user\Desktop\LisectAVT_2403002A_135.exe	Mutant created: \Sessions\1\BaseNamedObjects\Client.exe

Source: LisectAVT_2403002A_135.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: LisectAVT_2403002A_135.exe

Static file information: TRID: Win32 Executable (generic) Net Framework (10011505/4) 49.79%

Source: C:\Users\user\Desktop\LisectAVT_2403002A_135.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: LisectAVT_2403002A_135.exe, 00000001.00000002.3730044098.0000000006270000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: Select * From AntiVirusProduct;

Source: C:\Users\user\Desktop\LisectAVT_2403002A_135.exe

File read: C:\Users\user\Desktop\LisectAVT_2403002A_135.exe

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\LisectAVT_2403002A_135.exe "C:\Users\user\Desktop\LisectAVT_2403002A_135.exe"
Source: unknown	Process created: C:\Users\user\Desktop\LisectAVT_2403002A_135.exe "C:\Users\user\Desktop\LisectAVT_2403002A_135.exe" ..
Source: unknown	Process created: C:\Users\user\Desktop\LisectAVT_2403002A_135.exe "C:\Users\user\Desktop\LisectAVT_2403002A_135.exe" ..
Source: unknown	Process created: C:\Users\user\Desktop\LisectAVT_2403002A_135.exe "C:\Users\user\Desktop\LisectAVT_2403002A_135.exe" ..
Source: unknown	Process created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Client.exe "C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Client.exe"
Source: unknown	Process created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Client.exe "C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Client.exe"

Source: C:\Users\user\Desktop\LisectAVT_2403002A_135.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_135.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_135.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_135.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_135.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_135.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_135.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_135.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_135.exe	Section loaded: shfolder.dll	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_135.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_135.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_135.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_135.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_135.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_135.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_135.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_135.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_135.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_135.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_135.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_135.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_135.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_135.exe	Section loaded: avicap32.dll	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_135.exe	Section loaded: msvfw32.dll	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_135.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_135.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_135.exe	Section loaded: sxs.dll	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_135.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_135.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_135.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_135.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_135.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_135.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_135.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_135.exe	Section loaded: shfolder.dll	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_135.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_135.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_135.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_135.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_135.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_135.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_135.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_135.exe	Section loaded: shfolder.dll	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_135.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_135.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_135.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_135.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_135.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_135.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_135.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_135.exe	Section loaded: shfolder.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Client.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Client.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Client.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Client.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Client.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Client.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Client.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Client.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Client.exe	Section loaded: shfolder.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Client.exe	Section loaded: mscoree.dll
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Client.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Client.exe	Section loaded: version.dll
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Client.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Client.exe	Section loaded: wldp.dll
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Client.exe	Section loaded: profapi.dll
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Client.exe	Section loaded: uxtheme.dll
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Client.exe	Section loaded: shfolder.dll

Source: C:\Users\user\Desktop\LisectAVT_2403002A_135.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CF4CC405-E2C5-4DDD-B3CE-5E7582D8C9FA}\InprocServer32

Jump to behavior

Source: C:\Users\user\Desktop\LisectAVT_2403002A_135.exe

File opened: C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorrc.dll

Jump to behavior

Source: LisectAVT_2403002A_135.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR

Source: C:\Users\user\Desktop\LisectAVT_2403002A_135.exe

File opened: C:\Windows\WinSxS\x86_microsoft.vc80.crt_1fc8b3b9a1e18e3b_8.0.50727.9672_none_d08f9da24428a513\MSVCR80.dll

Jump to behavior

Source: LisectAVT_2403002A_135.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Data Obfuscation

.NET source code contains method to dynamically call methods (often used by packers)

Source: LisectAVT_2403002A_135.exe, FHGKMEODNFJFBOOAPDAJBBOGACANNFCGHDOF.cs	.Net Code: Type.GetTypeFromHandle(GIIPJCBAJIDGBKCAOKGHJMJMGAPJCEMCLCIM.JMLFAPEFEPIKGHOACDGINNGBFEPKDBBEHFIG(16777280)).GetMethod("GetDelegateForFunctionPointer", new Type[2]{Type.GetTypeFromHandle(GIIPJCBAJIDGBKCAOKGHJMJMGAPJCEMCLCIM.JMLFAPEFEPIKGHOACDGINNGBFEPKDBBEHFIG(16777251)),Type.GetTypeFromHandle(GIIPJCBAJIDGBKCAOKGHJMJMGAPJCEMCLCIM.JMLFAPEFEPIKGHOACDGINNGBFEPKDBBEHFIG(16777244))})
Source: 11.2.LisectAVT_2403002A_135.exe.4104268.0.raw.unpack, FHGKMEODNFJFBOOAPDAJBBOGACANNFCGHDOF.cs	.Net Code: Type.GetTypeFromHandle(GIIPJCBAJIDGBKCAOKGHJMJMGAPJCEMCLCIM.JMLFAPEFEPIKGHOACDGINNGBFEPKDBBEHFIG(16777280)).GetMethod("GetDelegateForFunctionPointer", new Type[2]{Type.GetTypeFromHandle(GIIPJCBAJIDGBKCAOKGHJMJMGAPJCEMCLCIM.JMLFAPEFEPIKGHOACDGINNGBFEPKDBBEHFIG(16777251)),Type.GetTypeFromHandle(GIIPJCBAJIDGBKCAOKGHJMJMGAPJCEMCLCIM.JMLFAPEFEPIKGHOACDGINNGBFEPKDBBEHFIG(16777244))})

Source: C:\Users\user\Desktop\LisectAVT_2403002A_135.exe	Code function: 1_2_00ED3819 push ecx; ret	1_2_00ED3821
Source: C:\Users\user\Desktop\LisectAVT_2403002A_135.exe	Code function: 1_2_00ED94AC push ebp; iretd	1_2_00ED94AD
Source: C:\Users\user\Desktop\LisectAVT_2403002A_135.exe	Code function: 1_2_00ED9422 push ecx; iretd	1_2_00ED945D
Source: C:\Users\user\Desktop\LisectAVT_2403002A_135.exe	Code function: 1_2_014E58E0 pushad ; ret	1_2_014E58E1
Source: C:\Users\user\Desktop\LisectAVT_2403002A_135.exe	Code function: 1_2_052B1DA9 push ss; iretd	1_2_052B1DAF
Source: C:\Users\user\Desktop\LisectAVT_2403002A_135.exe	Code function: 1_2_052B4B88 pushad ; iretd	1_2_052B4B89
Source: C:\Users\user\Desktop\LisectAVT_2403002A_135.exe	Code function: 11_2_014358E0 pushad ; ret	11_2_014358E1
Source: C:\Users\user\Desktop\LisectAVT_2403002A_135.exe	Code function: 11_2_05411DA9 push ss; iretd	11_2_05411DAF
Source: C:\Users\user\Desktop\LisectAVT_2403002A_135.exe	Code function: 11_2_05414B88 pushad ; iretd	11_2_05414B89
Source: C:\Users\user\Desktop\LisectAVT_2403002A_135.exe	Code function: 12_2_017758E0 pushad ; ret	12_2_017758E1
Source: C:\Users\user\Desktop\LisectAVT_2403002A_135.exe	Code function: 12_2_05651DA9 push ss; iretd	12_2_05651DAF
Source: C:\Users\user\Desktop\LisectAVT_2403002A_135.exe	Code function: 13_2_011858E0 pushad ; ret	13_2_011858E1
Source: C:\Users\user\Desktop\LisectAVT_2403002A_135.exe	Code function: 13_2_05051DA9 push ss; iretd	13_2_05051DAF
Source: C:\Users\user\Desktop\LisectAVT_2403002A_135.exe	Code function: 13_2_05054B82 pushad ; iretd	13_2_05054B89
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Client.exe	Code function: 17_2_051B58E0 pushad ; ret	17_2_051B58E1
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Client.exe	Code function: 17_2_052F1DA9 push ss; iretd	17_2_052F1DAF
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Client.exe	Code function: 18_2_012958E0 pushad ; ret	18_2_012958E1
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Client.exe	Code function: 18_2_05021DA9 push ss; iretd	18_2_05021DAF
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Client.exe	Code function: 18_2_05024B88 pushad ; iretd	18_2_05024B89

Source: C:\Users\user\Desktop\LisectAVT_2403002A_135.exe	File created: C:\Client.exe			Jump to dropped file
Source: C:\Users\user\Desktop\LisectAVT_2403002A_135.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Client.exe			Jump to dropped file

Boot Survival

Drops PE files to the startup folder

Source: C:\Users\user\Desktop\LisectAVT_2403002A_135.exe

File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Client.exe

Jump to dropped file

Source: C:\Users\user\Desktop\LisectAVT_2403002A_135.exe

File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Client.exe

Jump to behavior

Source: C:\Users\user\Desktop\LisectAVT_2403002A_135.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Client.exe	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_135.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Client.exe\:Zone.Identifier:$DATA	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_135.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Client.url	Jump to behavior

Source: C:\Users\user\Desktop\LisectAVT_2403002A_135.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run Client.exe	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_135.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run Client.exe	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_135.exe	Registry value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run Client.exe	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_135.exe	Registry value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run Client.exe	Jump to behavior

Source: C:\Users\user\Desktop\LisectAVT_2403002A_135.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_135.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_135.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_135.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_135.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_135.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_135.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_135.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_135.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_135.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_135.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_135.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_135.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_135.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_135.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_135.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_135.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_135.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_135.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_135.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_135.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_135.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_135.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_135.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_135.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_135.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_135.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_135.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_135.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_135.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_135.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_135.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_135.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_135.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_135.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_135.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_135.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_135.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_135.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_135.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_135.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_135.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_135.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_135.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_135.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_135.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_135.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_135.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_135.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_135.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_135.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_135.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_135.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_135.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_135.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_135.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_135.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_135.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_135.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_135.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_135.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_135.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_135.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_135.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_135.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_135.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_135.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_135.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_135.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_135.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_135.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_135.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_135.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_135.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_135.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_135.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_135.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_135.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_135.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_135.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_135.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_135.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_135.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_135.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_135.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_135.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_135.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_135.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_135.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_135.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_135.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_135.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_135.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_135.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_135.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_135.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_135.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_135.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_135.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_135.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_135.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_135.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_135.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_135.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_135.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_135.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_135.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_135.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_135.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_135.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_135.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_135.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_135.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_135.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_135.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_135.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_135.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_135.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_135.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_135.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_135.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_135.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_135.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_135.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_135.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_135.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_135.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_135.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_135.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Client.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Client.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Client.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Client.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Client.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Client.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Client.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Client.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Client.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Client.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Client.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Client.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Client.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Client.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Client.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Client.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Client.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Client.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Client.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Client.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Client.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Client.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Client.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Client.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Client.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Client.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Client.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Client.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Client.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Client.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Client.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Client.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Client.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Client.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Client.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Client.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Client.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Client.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Client.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Client.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Client.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Client.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Client.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Client.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Client.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Client.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Client.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Client.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Client.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Client.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Client.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Client.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Client.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Client.exe	Process information set: NOOPENFILEERRORBOX

Malware Analysis System Evasion

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Source: LisectAVT_2403002A_135.exe, 00000001.00000002.3718647898.0000000002FF1000.00000004.00000800.00020000.00000000.sdmp, LisectAVT_2403002A_135.exe, 00000001.00000002.3718647898.0000000002FEF000.00000004.00000800.00020000.00000000.sdmp, LisectAVT_2403002A_135.exe, 0000000B.00000002.1515413460.0000000003101000.00000004.00000800.00020000.00000000.sdmp, LisectAVT_2403002A_135.exe, 0000000C.00000002.1587021185.0000000003281000.00000004.00000800.00020000.00000000.sdmp, LisectAVT_2403002A_135.exe, 0000000C.00000002.1587021185.000000000327F000.00000004.00000800.00020000.00000000.sdmp, LisectAVT_2403002A_135.exe, 0000000D.00000002.1704086940.0000000002DBF000.00000004.00000800.00020000.00000000.sdmp, LisectAVT_2403002A_135.exe, 0000000D.00000002.1704086940.0000000002DC1000.00000004.00000800.00020000.00000000.sdmp, Client.exe, 00000011.00000002.1798372852.0000000002F31000.00000004.00000800.00020000.00000000.sdmp, Client.exe, 00000012.00000002.1904061583.0000000002C0F000.00000004.00000800.00020000.00000000.sdmp, Client.exe, 00000012.00000002.1904061583.0000000002C11000.00000004.00000800.00020000.00000000.sdmp

Binary or memory string: WIRESHARK.EXE

Source: C:\Users\user\Desktop\LisectAVT_2403002A_135.exe	Memory allocated: F30000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_135.exe	Memory allocated: 2FE0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_135.exe	Memory allocated: 4FE0000 memory commit \| memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_135.exe	Memory allocated: 6AA0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_135.exe	Memory allocated: 7AA0000 memory commit \| memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_135.exe	Memory allocated: 7C00000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_135.exe	Memory allocated: 8C00000 memory commit \| memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_135.exe	Memory allocated: 8EB0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_135.exe	Memory allocated: 9EB0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_135.exe	Memory allocated: AB70000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_135.exe	Memory allocated: BB70000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_135.exe	Memory allocated: CB70000 memory commit \| memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_135.exe	Memory allocated: D0C0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_135.exe	Memory allocated: E0C0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_135.exe	Memory allocated: F0C0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_135.exe	Memory allocated: 100C0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_135.exe	Memory allocated: 110C0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_135.exe	Memory allocated: 120C0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_135.exe	Memory allocated: 130C0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_135.exe	Memory allocated: 140C0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_135.exe	Memory allocated: 150C0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_135.exe	Memory allocated: 160C0000 memory commit \| memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_135.exe	Memory allocated: 16B50000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_135.exe	Memory allocated: 17B50000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_135.exe	Memory allocated: 18B50000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_135.exe	Memory allocated: 19B50000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_135.exe	Memory allocated: 1AB50000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_135.exe	Memory allocated: 1BB50000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_135.exe	Memory allocated: 1CB50000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_135.exe	Memory allocated: 1DB50000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_135.exe	Memory allocated: 1EB50000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_135.exe	Memory allocated: 1FB50000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_135.exe	Memory allocated: 20B50000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_135.exe	Memory allocated: 21B50000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_135.exe	Memory allocated: 22B50000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_135.exe	Memory allocated: AB70000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_135.exe	Memory allocated: E0C0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_135.exe	Memory allocated: B730000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_135.exe	Memory allocated: C730000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_135.exe	Memory allocated: D730000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_135.exe	Memory allocated: E730000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_135.exe	Memory allocated: F730000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_135.exe	Memory allocated: 10730000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_135.exe	Memory allocated: 11870000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_135.exe	Memory allocated: E730000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_135.exe	Memory allocated: D730000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_135.exe	Memory allocated: 12870000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_135.exe	Memory allocated: C270000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_135.exe	Memory allocated: D3B0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_135.exe	Memory allocated: E3B0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_135.exe	Memory allocated: F3B0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_135.exe	Memory allocated: 103B0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_135.exe	Memory allocated: 12870000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_135.exe	Memory allocated: 13870000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_135.exe	Memory allocated: 14870000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_135.exe	Memory allocated: 16B50000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_135.exe	Memory allocated: 17B50000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_135.exe	Memory allocated: 18B50000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_135.exe	Memory allocated: 19B50000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_135.exe	Memory allocated: 1AB50000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_135.exe	Memory allocated: 1BB50000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_135.exe	Memory allocated: 1CB50000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_135.exe	Memory allocated: 1DB50000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_135.exe	Memory allocated: 1EB50000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_135.exe	Memory allocated: 1FB50000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_135.exe	Memory allocated: 18B50000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_135.exe	Memory allocated: 103B0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_135.exe	Memory allocated: 20B50000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_135.exe	Memory allocated: 21B50000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_135.exe	Memory allocated: 22B50000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_135.exe	Memory allocated: 23B50000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_135.exe	Memory allocated: 24B50000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_135.exe	Memory allocated: 19B50000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_135.exe	Memory allocated: 25B50000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_135.exe	Memory allocated: 26B50000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_135.exe	Memory allocated: 27B50000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_135.exe	Memory allocated: 28B50000 memory commit \| memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_135.exe	Memory allocated: 2A060000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_135.exe	Memory allocated: 2B060000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_135.exe	Memory allocated: 2C060000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_135.exe	Memory allocated: 2D060000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_135.exe	Memory allocated: 15870000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_135.exe	Memory allocated: 2E060000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_135.exe	Memory allocated: 2F060000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_135.exe	Memory allocated: 30060000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_135.exe	Memory allocated: 31060000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_135.exe	Memory allocated: 32060000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_135.exe	Memory allocated: 33060000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_135.exe	Memory allocated: 34060000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_135.exe	Memory allocated: 35060000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_135.exe	Memory allocated: 36060000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_135.exe	Memory allocated: 1DB50000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_135.exe	Memory allocated: 21B50000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_135.exe	Memory allocated: 18B50000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_135.exe	Memory allocated: D3B0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_135.exe	Memory allocated: C270000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_135.exe	Memory allocated: E630000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_135.exe	Memory allocated: 11870000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_135.exe	Memory allocated: E630000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_135.exe	Memory allocated: F630000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_135.exe	Memory allocated: 11870000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_135.exe	Memory allocated: 14870000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_135.exe	Memory allocated: 15870000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_135.exe	Memory allocated: 16870000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_135.exe	Memory allocated: 17870000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_135.exe	Memory allocated: 18870000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_135.exe	Memory allocated: 19870000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_135.exe	Memory allocated: 1A870000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_135.exe	Memory allocated: 1B870000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_135.exe	Memory allocated: E630000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_135.exe	Memory allocated: F630000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_135.exe	Memory allocated: D3B0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_135.exe	Memory allocated: E630000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_135.exe	Memory allocated: 11870000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_135.exe	Memory allocated: 12870000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_135.exe	Memory allocated: 13870000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_135.exe	Memory allocated: 14870000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_135.exe	Memory allocated: 15870000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_135.exe	Memory allocated: 16870000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_135.exe	Memory allocated: 17870000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_135.exe	Memory allocated: 18870000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_135.exe	Memory allocated: 19870000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_135.exe	Memory allocated: 1A870000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_135.exe	Memory allocated: 1B870000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_135.exe	Memory allocated: 1C870000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_135.exe	Memory allocated: 1D870000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_135.exe	Memory allocated: 1E870000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_135.exe	Memory allocated: 1F870000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_135.exe	Memory allocated: 20870000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_135.exe	Memory allocated: 21870000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_135.exe	Memory allocated: 22870000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_135.exe	Memory allocated: 23870000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_135.exe	Memory allocated: 24870000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_135.exe	Memory allocated: 25870000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_135.exe	Memory allocated: 26870000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_135.exe	Memory allocated: 27870000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_135.exe	Memory allocated: 2B060000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_135.exe	Memory allocated: 2D060000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_135.exe	Memory allocated: 2F060000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_135.exe	Memory allocated: 30060000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_135.exe	Memory allocated: E630000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_135.exe	Memory allocated: 7BD0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_135.exe	Memory allocated: E630000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_135.exe	Memory allocated: 1E870000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_135.exe	Memory allocated: 7BD0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_135.exe	Memory allocated: F630000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_135.exe	Memory allocated: 18870000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_135.exe	Memory allocated: 1B870000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_135.exe	Memory allocated: 23870000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_135.exe	Memory allocated: 2A060000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_135.exe	Memory allocated: 12870000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_135.exe	Memory allocated: 16870000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_135.exe	Memory allocated: 17870000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_135.exe	Memory allocated: 18870000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_135.exe	Memory allocated: 19870000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_135.exe	Memory allocated: 1B870000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_135.exe	Memory allocated: 1C870000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_135.exe	Memory allocated: 12870000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_135.exe	Memory allocated: F630000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_135.exe	Memory allocated: F630000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_135.exe	Memory allocated: 15870000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_135.exe	Memory allocated: 16870000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_135.exe	Memory allocated: 12870000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_135.exe	Memory allocated: 15870000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_135.exe	Memory allocated: FA30000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_135.exe	Memory allocated: 11870000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_135.exe	Memory allocated: 12870000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_135.exe	Memory allocated: 13870000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_135.exe	Memory allocated: 17870000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_135.exe	Memory allocated: 18870000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_135.exe	Memory allocated: 1A870000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_135.exe	Memory allocated: 1B870000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_135.exe	Memory allocated: 1C870000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_135.exe	Memory allocated: 1D870000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_135.exe	Memory allocated: 1F870000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_135.exe	Memory allocated: 20870000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_135.exe	Memory allocated: 21870000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_135.exe	Memory allocated: 22870000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_135.exe	Memory allocated: 23870000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_135.exe	Memory allocated: 24870000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_135.exe	Memory allocated: 25870000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_135.exe	Memory allocated: 27870000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_135.exe	Memory allocated: 2B060000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_135.exe	Memory allocated: 2D060000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_135.exe	Memory allocated: 2E060000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_135.exe	Memory allocated: 25870000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_135.exe	Memory allocated: 25870000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_135.exe	Memory allocated: 25870000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_135.exe	Memory allocated: 25870000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_135.exe	Memory allocated: 25870000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_135.exe	Memory allocated: 2F060000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_135.exe	Memory allocated: 21870000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_135.exe	Memory allocated: 30060000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_135.exe	Memory allocated: 32060000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_135.exe	Memory allocated: 33060000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_135.exe	Memory allocated: 34060000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_135.exe	Memory allocated: 2D060000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_135.exe	Memory allocated: 35060000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_135.exe	Memory allocated: 36060000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_135.exe	Memory allocated: 16870000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_135.exe	Memory allocated: 17870000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_135.exe	Memory allocated: 18870000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_135.exe	Memory allocated: 1A870000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_135.exe	Memory allocated: 1B870000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_135.exe	Memory allocated: 1D870000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_135.exe	Memory allocated: 1F870000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_135.exe	Memory allocated: 20870000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_135.exe	Memory allocated: 22870000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_135.exe	Memory allocated: 23870000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_135.exe	Memory allocated: 20870000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_135.exe	Memory allocated: 27870000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_135.exe	Memory allocated: 2A060000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_135.exe	Memory allocated: 2B060000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_135.exe	Memory allocated: FA30000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_135.exe	Memory allocated: 12870000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_135.exe	Memory allocated: 13870000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_135.exe	Memory allocated: 15870000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_135.exe	Memory allocated: 16870000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_135.exe	Memory allocated: 18870000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_135.exe	Memory allocated: 19870000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_135.exe	Memory allocated: 1A870000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_135.exe	Memory allocated: 12870000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_135.exe	Memory allocated: 12870000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_135.exe	Memory allocated: FA30000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_135.exe	Memory allocated: 13870000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_135.exe	Memory allocated: FA30000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_135.exe	Memory allocated: 11870000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_135.exe	Memory allocated: 12870000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_135.exe	Memory allocated: 13870000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_135.exe	Memory allocated: 18870000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_135.exe	Memory allocated: 19870000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_135.exe	Memory allocated: 1B870000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_135.exe	Memory allocated: 13A0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_135.exe	Memory allocated: 3100000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_135.exe	Memory allocated: 5100000 memory commit \| memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_135.exe	Memory allocated: 1590000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_135.exe	Memory allocated: 3270000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_135.exe	Memory allocated: 5270000 memory commit \| memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_135.exe	Memory allocated: 10F0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_135.exe	Memory allocated: 2DB0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_135.exe	Memory allocated: 4DB0000 memory commit \| memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Client.exe	Memory allocated: FF0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Client.exe	Memory allocated: 2F30000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Client.exe	Memory allocated: 1250000 memory commit \| memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Client.exe	Memory allocated: E10000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Client.exe	Memory allocated: 2C00000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Client.exe	Memory allocated: 4C00000 memory commit \| memory reserve \| memory write watch

Source: C:\Users\user\Desktop\LisectAVT_2403002A_135.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_135.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_135.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_135.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_135.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_135.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_135.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_135.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_135.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_135.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Client.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Client.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Client.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Client.exe	Thread delayed: delay time: 922337203685477
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Client.exe	Thread delayed: delay time: 922337203685477
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Client.exe	Thread delayed: delay time: 922337203685477

Source: C:\Users\user\Desktop\LisectAVT_2403002A_135.exe	Window / User API: threadDelayed 765	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_135.exe	Window / User API: threadDelayed 619	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_135.exe	Window / User API: threadDelayed 1942	Jump to behavior

Source: C:\Users\user\Desktop\LisectAVT_2403002A_135.exe TID: 7784	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_135.exe TID: 7796	Thread sleep time: -382500s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_135.exe TID: 7796	Thread sleep time: -971000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_135.exe TID: 6536	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_135.exe TID: 6832	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_135.exe TID: 5140	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_135.exe TID: 6972	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_135.exe TID: 3688	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_135.exe TID: 1204	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_135.exe TID: 2220	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_135.exe TID: 2220	Thread sleep count: 33 > 30	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_135.exe TID: 2180	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_135.exe TID: 2216	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Client.exe TID: 1864	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Client.exe TID: 3392	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Client.exe TID: 5440	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Client.exe TID: 5288	Thread sleep time: -922337203685477s >= -30000s
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Client.exe TID: 5024	Thread sleep time: -922337203685477s >= -30000s
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Client.exe TID: 4800	Thread sleep time: -922337203685477s >= -30000s

Source: C:\Users\user\Desktop\LisectAVT_2403002A_135.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_135.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_135.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_135.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_135.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_135.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_135.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_135.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_135.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_135.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Client.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Client.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Client.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Client.exe	Thread delayed: delay time: 922337203685477
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Client.exe	Thread delayed: delay time: 922337203685477
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Client.exe	Thread delayed: delay time: 922337203685477

Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Client.exe	File opened: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Client.exe	File opened: C:\Users\user\AppData\Roaming\Microsoft\	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Client.exe	File opened: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Client.exe	File opened: C:\Users\user\AppData\	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Client.exe	File opened: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Client.exe	File opened: C:\Users\user\	Jump to behavior

Source: Client.exe, 00000012.00000002.1904061583.0000000002D6E000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: VBoxServicedS
Source: Client.exe, 00000012.00000002.1904061583.0000000002C11000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: VBoxService6TASKKILL /F /IM wscript.exe.TASKKILL /F /IM cmd.exe
Source: Client.exe, 00000011.00000002.1798372852.0000000002F31000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: VBoxServiceh
Source: Client.exe, 00000012.00000002.1904061583.0000000002F8A000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: VBoxService
Source: LisectAVT_2403002A_135.exe, 00000001.00000002.3717013718.0000000000F5E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll

Source: C:\Users\user\Desktop\LisectAVT_2403002A_135.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Users\user\Desktop\LisectAVT_2403002A_135.exe

Process token adjusted: Debug

Jump to behavior

Source: C:\Users\user\Desktop\LisectAVT_2403002A_135.exe

Memory allocated: page read and write | page guard

Jump to behavior

Source: LisectAVT_2403002A_135.exe, 0000000B.00000002.1515413460.0000000003101000.00000004.00000800.00020000.00000000.sdmp, Client.exe, 00000011.00000002.1798372852.0000000002F31000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Shell_TrayWnd
Source: LisectAVT_2403002A_135.exe, 0000000B.00000002.1515413460.0000000003101000.00000004.00000800.00020000.00000000.sdmp, Client.exe, 00000011.00000002.1798372852.0000000002F31000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Progman ChamaFrmTerrorrr

Source: C:\Users\user\Desktop\LisectAVT_2403002A_135.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_135.exe	Queries volume information: C:\Windows\assembly\GAC_32\CustomMarshalers\2.0.0.0__b03f5f7f11d50a3a\CustomMarshalers.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_135.exe	Queries volume information: C:\Windows\assembly\GAC_32\CustomMarshalers\2.0.0.0__b03f5f7f11d50a3a\CustomMarshalers.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_135.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_135.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_135.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_135.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_135.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_135.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_135.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_135.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_135.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior

Source: C:\Users\user\Desktop\LisectAVT_2403002A_135.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Lowering of HIPS / PFW / Operating System Security Settings

Disables zone checking for all users

Source: C:\Users\user\Desktop\LisectAVT_2403002A_135.exe

Registry value created: HKEY_CURRENT_USER\Environment SEE_MASK_NOZONECHECKS

Jump to behavior

Source: LisectAVT_2403002A_135.exe, 00000001.00000002.3730044098.0000000006321000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: nder\MsMpeng.exe
Source: LisectAVT_2403002A_135.exe, 00000001.00000002.3718647898.0000000002FF1000.00000004.00000800.00020000.00000000.sdmp, LisectAVT_2403002A_135.exe, 00000001.00000002.3718647898.0000000002FEF000.00000004.00000800.00020000.00000000.sdmp, LisectAVT_2403002A_135.exe, 0000000B.00000002.1515413460.0000000003101000.00000004.00000800.00020000.00000000.sdmp, LisectAVT_2403002A_135.exe, 0000000C.00000002.1587021185.0000000003281000.00000004.00000800.00020000.00000000.sdmp, LisectAVT_2403002A_135.exe, 0000000C.00000002.1587021185.000000000327F000.00000004.00000800.00020000.00000000.sdmp, LisectAVT_2403002A_135.exe, 0000000D.00000002.1704086940.0000000002DBF000.00000004.00000800.00020000.00000000.sdmp, LisectAVT_2403002A_135.exe, 0000000D.00000002.1704086940.0000000002DC1000.00000004.00000800.00020000.00000000.sdmp, Client.exe, 00000011.00000002.1798372852.0000000002F31000.00000004.00000800.00020000.00000000.sdmp, Client.exe, 00000012.00000002.1904061583.0000000002C0F000.00000004.00000800.00020000.00000000.sdmp, Client.exe, 00000012.00000002.1904061583.0000000002C11000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Wireshark.exe
Source: LisectAVT_2403002A_135.exe, 00000001.00000002.3745410226.000000000F630000.00000004.00000020.00020000.00000000.sdmp, LisectAVT_2403002A_135.exe, 00000001.00000002.3717013718.0000000000F5E000.00000004.00000020.00020000.00000000.sdmp, LisectAVT_2403002A_135.exe, 00000001.00000002.3730044098.0000000006321000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: %ProgramFiles%\Windows Defender\MsMpeng.exe

Source: C:\Users\user\Desktop\LisectAVT_2403002A_135.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\Desktop\LisectAVT_2403002A_135.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\Desktop\LisectAVT_2403002A_135.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\Desktop\LisectAVT_2403002A_135.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\Desktop\LisectAVT_2403002A_135.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\Desktop\LisectAVT_2403002A_135.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\Desktop\LisectAVT_2403002A_135.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\Desktop\LisectAVT_2403002A_135.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\Desktop\LisectAVT_2403002A_135.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\Desktop\LisectAVT_2403002A_135.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\Desktop\LisectAVT_2403002A_135.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\Desktop\LisectAVT_2403002A_135.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\Desktop\LisectAVT_2403002A_135.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\Desktop\LisectAVT_2403002A_135.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\Desktop\LisectAVT_2403002A_135.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\Desktop\LisectAVT_2403002A_135.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\Desktop\LisectAVT_2403002A_135.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\Desktop\LisectAVT_2403002A_135.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\Desktop\LisectAVT_2403002A_135.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\Desktop\LisectAVT_2403002A_135.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\Desktop\LisectAVT_2403002A_135.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\Desktop\LisectAVT_2403002A_135.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\Desktop\LisectAVT_2403002A_135.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\Desktop\LisectAVT_2403002A_135.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\Desktop\LisectAVT_2403002A_135.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\Desktop\LisectAVT_2403002A_135.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\Desktop\LisectAVT_2403002A_135.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct

Stealing of Sensitive Information

Yara detected Njrat

Source: Yara match	File source: 0000000B.00000002.1515413460.0000000003101000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000011.00000002.1798372852.0000000002F31000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: LisectAVT_2403002A_135.exe PID: 7728, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: LisectAVT_2403002A_135.exe PID: 5884, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: Client.exe PID: 3996, type: MEMORYSTR

Remote Access Functionality

Yara detected Njrat

Source: Yara match	File source: 0000000B.00000002.1515413460.0000000003101000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000011.00000002.1798372852.0000000002F31000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: LisectAVT_2403002A_135.exe PID: 7728, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: LisectAVT_2403002A_135.exe PID: 5884, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: Client.exe PID: 3996, type: MEMORYSTR

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	1 Windows Management Instrumentation	121 Registry Run Keys / Startup Folder	1 Access Token Manipulation	1 Masquerading	OS Credential Dumping	121 Security Software Discovery	Remote Services	11 Archive Collected Data	1 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	1 DLL Side-Loading	2 Process Injection	11 Disable or Modify Tools	LSASS Memory	2 Process Discovery	Remote Desktop Protocol	Data from Removable Media	1 Non-Standard Port	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	121 Registry Run Keys / Startup Folder	31 Virtualization/Sandbox Evasion	Security Account Manager	31 Virtualization/Sandbox Evasion	SMB/Windows Admin Shares	Data from Network Shared Drive	1 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	1 DLL Side-Loading	1 Access Token Manipulation	NTDS	1 Application Window Discovery	Distributed Component Object Model	Input Capture	1 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	2 Process Injection	LSA Secrets	1 File and Directory Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 Deobfuscate/Decode Files or Information	Cached Domain Credentials	12 System Information Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	1 Obfuscated Files or Information	DCSync	Remote System Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	1 Software Packing	Proc Filesystem	System Owner/User Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement
Network Topology	Malvertising	Exploit Public-Facing Application	Command and Scripting Interpreter	At	At	1 DLL Side-Loading	/etc/passwd and /etc/shadow	Network Sniffing	Direct Cloud VM Connections	Data Staged	Web Protocols	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Internal Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
LisectAVT_2403002A_135.exe	100%	Avira	TR/Dropper.Gen
LisectAVT_2403002A_135.exe	100%	Joe Sandbox ML

Dropped Files

Source	Detection	Scanner	Label
C:\Client.exe	100%	Avira	TR/Dropper.Gen
C:\Client.exe	100%	Avira	TR/Dropper.Gen
C:\Client.exe	100%	Joe Sandbox ML
C:\Client.exe	100%	Joe Sandbox ML

Source	Detection	Scanner	Label	Link
https://pastebin.com/raw/EngADTbC	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
prior-gently.gl.at.ply.gg	147.185.221.19	true	false		unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://pastebin.com/raw/EngADTbC	Client.exe, 00000011.00000002.1798372852.0000000002F31000.00000004.00000800.00020000.00000000.sdmp, Client.exe, 00000012.00000002.1904061583.0000000002C0F000.00000004.00000800.00020000.00000000.sdmp, Client.exe, 00000012.00000002.1904061583.0000000002C11000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
147.185.221.19	prior-gently.gl.at.ply.gg	United States		12087	SALSGIVERUS	false

General Information

Joe Sandbox version:	40.0.0 Tourmaline
Analysis ID:	1482507
Start date and time:	2024-07-25 23:55:05 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 9m 13s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	22
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	LisectAVT_2403002A_135.exe
Detection:	MAL
Classification:	mal100.phis.troj.adwa.expl.evad.winEXE@6/7@1/1
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 88% Number of executed functions: 792 Number of non-executed functions: 1
Cookbook Comments:	Found application associated with file extension: .exe Override analysis time to 240s for sample files taking high CPU consumption

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, dllhost.exe, audiodg.exe, WMIADAP.exe, SIHClient.exe, Sgrmuserer.exe, conhost.exe, svchost.exe
Excluded domains from analysis (whitelisted): fs.microsoft.com, slscr.update.microsoft.com, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Report size getting too big, too many NtAllocateVirtualMemory calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
VT rate limit hit for: LisectAVT_2403002A_135.exe

Simulations

Behavior and APIs

Time	Type	Description
17:56:08	API Interceptor	203900x Sleep call for process: LisectAVT_2403002A_135.exe modified
23:56:04	Autostart	Run: HKCU\Software\Microsoft\Windows\CurrentVersion\Run Client.exe "C:\Users\user\Desktop\LisectAVT_2403002A_135.exe" ..
23:56:12	Autostart	Run: HKLM\Software\Microsoft\Windows\CurrentVersion\Run Client.exe "C:\Users\user\Desktop\LisectAVT_2403002A_135.exe" ..
23:56:22	Autostart	Run: HKCU64\Software\Microsoft\Windows\CurrentVersion\Run Client.exe "C:\Users\user\Desktop\LisectAVT_2403002A_135.exe" ..
23:56:33	Autostart	Run: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Client.exe
23:56:43	Autostart	Run: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Client.url

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
147.185.221.19	SecuriteInfo.com.Win32.Evo-gen.15237.11182.exe	Get hash	malicious	Amadey, RedLine, RisePro Stealer	Browse	b-stamps.gl.at.ply.gg:30946/
147.185.221.19	X82dKIfzi3.exe	Get hash	malicious	RedLine	Browse	rights-mountains.gl.at.ply.gg:23403/

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
prior-gently.gl.at.ply.gg	V6gal0yGjX.exe	Get hash	malicious	Njrat	Browse	147.185.221.19

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
SALSGIVERUS	LisectAVT_2403002B_484.exe	Get hash	malicious	AsyncRAT, DcRat	Browse	147.185.221.19
	LisectAVT_2403002B_484.exe	Get hash	malicious	AsyncRAT, DcRat	Browse	147.185.221.19
	LisectAVT_2403002C_149.exe	Get hash	malicious	AsyncRAT	Browse	147.185.221.18
	LisectAVT_2403002C_28.exe	Get hash	malicious	Remcos	Browse	147.185.221.18
	sv6ieteV0j.exe	Get hash	malicious	Njrat, PureLog Stealer	Browse	147.185.221.21
	Ym4vc47pgk.elf	Get hash	malicious	Unknown	Browse	147.184.134.179
	Windows Defender.exe	Get hash	malicious	XWorm	Browse	147.185.221.20
	setup.exe	Get hash	malicious	RedLine	Browse	147.185.221.21
	setup.exe	Get hash	malicious	RedLine	Browse	147.185.221.21
	sqjxHtZQi8.jpg.ps1	Get hash	malicious	ArrowRAT	Browse	147.185.221.18

Process:	C:\Users\user\Desktop\LisectAVT_2403002A_135.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	423433
Entropy (8bit):	5.314920891046795
Encrypted:	false
SSDEEP:	6144:HlisFUpX3pCxUeLjU/1g9vKcKvSrOMr1RbTK3hXFx:dJgOOW1RbOx
MD5:	01022196F7291AA2D9A6BAA67EFE6745
SHA1:	038AC2F83414013AD1021C4C16A47195123CD570
SHA-256:	E71AD4BFC100BFE7888D7BBD57616D32927442B3C300806A67E001DD5C5AFAB2
SHA-512:	BB83D4B032BB075E0605BB5B33E1DB0A5E434C6E9A830968FCE23921733594B6959F070D6587A415617D113D4740D80887A2AF65E7D8EC66DA131851B755441A
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100%
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...Uz.e................................. ........@.. ....................................@.....................................K.... ..L............................................................................ ............... ..H............text...$.... ...................... ..`.sdata..............................@....rsrc...L.... ......................@..@.reloc...............t..............@..B................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Client.exe:Zone.Identifier

Download File

Process:	C:\Users\user\Desktop\LisectAVT_2403002A_135.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	26
Entropy (8bit):	3.95006375643621
Encrypted:	false
SSDEEP:	3:ggPYV:rPYV
MD5:	187F488E27DB4AF347237FE461A079AD
SHA1:	6693BA299EC1881249D59262276A0D2CB21F8E64
SHA-256:	255A65D30841AB4082BD9D0EEA79D49C5EE88F56136157D8D6156AEF11C12309
SHA-512:	89879F237C0C051EBE784D0690657A6827A312A82735DA42DAD5F744D734FC545BEC9642C19D14C05B2F01FF53BC731530C92F7327BB7DC9CDE1B60FB21CD64E
Malicious:	true
Reputation:	high, very likely benign file
Preview:	[ZoneTransfer]....ZoneId=0

C:\Users\user\AppData\Local\Microsoft\CLR_v2.0_32\UsageLogs\Client.exe.log

Download File

Process:	C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Client.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	525
Entropy (8bit):	5.259753436570609
Encrypted:	false
SSDEEP:	12:Q3LaJU2C9XAn10Ug+9pfu9t0U29xtUz1B0U2uk71K6xhk7v:MLF2CpI3zffup29Iz52Ve
MD5:	260E01CC001F9C4643CA7A62F395D747
SHA1:	492AD0ACE3A9C8736909866EEA168962D418BE5A
SHA-256:	4BC52CCF866F489772A6919A0CC2C55B1432729D6BDF29E17E5853ABDFAB6030
SHA-512:	01AF7D75257E3DBD460E328F5C057D0367B83D3D9397E89CA3AE54AB9B2842D62352D8CCB4BE98ACE0C5667846759D32C199DE39ECCD0CF9CD6A83267D27E7C4
Malicious:	false
Reputation:	moderate, very likely benign file
Preview:	1,"fusion","GAC",0..3,"C:\Windows\assembly\NativeImages_v2.0.50727_32\System\bec14584c93014efbc76285c35d1e891\System.ni.dll",0..3,"C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.VisualBas#\7d443c6c007fe8696f9aa6ff1da53ef7\Microsoft.VisualBasic.ni.dll",0..3,"C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Drawing\2cdaeaf53e3d49038cf7cb0ce9d805d3\System.Drawing.ni.dll",0..3,"C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Windows.Forms\d0e5535854cce87ea7f2d69d0594b7a8\System.Windows.Forms.ni.dll",0..

C:\Users\user\AppData\Local\Microsoft\CLR_v2.0_32\UsageLogs\LisectAVT_2403002A_135.exe.log

Download File

Process:	C:\Users\user\Desktop\LisectAVT_2403002A_135.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	525
Entropy (8bit):	5.259753436570609
Encrypted:	false
SSDEEP:	12:Q3LaJU2C9XAn10Ug+9pfu9t0U29xtUz1B0U2uk71K6xhk7v:MLF2CpI3zffup29Iz52Ve
MD5:	260E01CC001F9C4643CA7A62F395D747
SHA1:	492AD0ACE3A9C8736909866EEA168962D418BE5A
SHA-256:	4BC52CCF866F489772A6919A0CC2C55B1432729D6BDF29E17E5853ABDFAB6030
SHA-512:	01AF7D75257E3DBD460E328F5C057D0367B83D3D9397E89CA3AE54AB9B2842D62352D8CCB4BE98ACE0C5667846759D32C199DE39ECCD0CF9CD6A83267D27E7C4
Malicious:	true
Reputation:	moderate, very likely benign file
Preview:	1,"fusion","GAC",0..3,"C:\Windows\assembly\NativeImages_v2.0.50727_32\System\bec14584c93014efbc76285c35d1e891\System.ni.dll",0..3,"C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.VisualBas#\7d443c6c007fe8696f9aa6ff1da53ef7\Microsoft.VisualBasic.ni.dll",0..3,"C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Drawing\2cdaeaf53e3d49038cf7cb0ce9d805d3\System.Drawing.ni.dll",0..3,"C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Windows.Forms\d0e5535854cce87ea7f2d69d0594b7a8\System.Windows.Forms.ni.dll",0..

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Client.exe

Download File

Process:	C:\Users\user\Desktop\LisectAVT_2403002A_135.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	423433
Entropy (8bit):	5.314920891046795
Encrypted:	false
SSDEEP:	6144:HlisFUpX3pCxUeLjU/1g9vKcKvSrOMr1RbTK3hXFx:dJgOOW1RbOx
MD5:	01022196F7291AA2D9A6BAA67EFE6745
SHA1:	038AC2F83414013AD1021C4C16A47195123CD570
SHA-256:	E71AD4BFC100BFE7888D7BBD57616D32927442B3C300806A67E001DD5C5AFAB2
SHA-512:	BB83D4B032BB075E0605BB5B33E1DB0A5E434C6E9A830968FCE23921733594B6959F070D6587A415617D113D4740D80887A2AF65E7D8EC66DA131851B755441A
Malicious:	true
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...Uz.e................................. ........@.. ....................................@.....................................K.... ..L............................................................................ ............... ..H............text...$.... ...................... ..`.sdata..............................@....rsrc...L.... ......................@..@.reloc...............t..............@..B................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Client.exe:Zone.Identifier

Download File

Process:	C:\Users\user\Desktop\LisectAVT_2403002A_135.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	26
Entropy (8bit):	3.95006375643621
Encrypted:	false
SSDEEP:	3:ggPYV:rPYV
MD5:	187F488E27DB4AF347237FE461A079AD
SHA1:	6693BA299EC1881249D59262276A0D2CB21F8E64
SHA-256:	255A65D30841AB4082BD9D0EEA79D49C5EE88F56136157D8D6156AEF11C12309
SHA-512:	89879F237C0C051EBE784D0690657A6827A312A82735DA42DAD5F744D734FC545BEC9642C19D14C05B2F01FF53BC731530C92F7327BB7DC9CDE1B60FB21CD64E
Malicious:	false
Reputation:	high, very likely benign file
Preview:	[ZoneTransfer]....ZoneId=0

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Client.url

Download File

Process:	C:\Users\user\Desktop\LisectAVT_2403002A_135.exe
File Type:	MS Windows 95 Internet shortcut text (URL=<file:///C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Client.exe>), ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	176
Entropy (8bit):	5.169903771985587
Encrypted:	false
SSDEEP:	3:HRAbABGQYm5uOMEREaKC5SufyM1K/RFofD6tRQfALtNovQJ5UvycAI9Ryn:HRYFVmwOFiaZ5SuH1MUmt2oLtNovQJ5f
MD5:	B6CB8DCB59048B81978375F430687ACB
SHA1:	57D15D0F303DBEF400040A2FB6E5224691AEC04D
SHA-256:	DDC9C825A31AA63A3AD4EE257F8769D1E06CB6436C9C4B18410643A2042E888A
SHA-512:	236F9F543DB2E27CC492974EBFB3BA7D8396427C883E618A1C046A6D8B7EB092A3F312A14979E944E4C775640A09674CE0728E1F97F5BBC496F98668BD4DFED6
Malicious:	true
Preview:	[InternetShortcut]..URL=file:///C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Client.exe..IconIndex=17..IconFile=C:\Windows\system32\SHELL32.dll..

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Entropy (8bit):	5.314920891046795
TrID:	Win32 Executable (generic) Net Framework (10011505/4) 49.79% Win32 Executable (generic) a (10002005/4) 49.75% Generic CIL Executable (.NET, Mono, etc.) (73296/58) 0.36% Windows Screen Saver (13104/52) 0.07% Win16/32 Executable Delphi generic (2074/23) 0.01%
File name:	LisectAVT_2403002A_135.exe
File size:	423'433 bytes
MD5:	01022196f7291aa2d9a6baa67efe6745
SHA1:	038ac2f83414013ad1021c4c16a47195123cd570
SHA256:	e71ad4bfc100bfe7888d7bbd57616d32927442b3c300806a67e001dd5c5afab2
SHA512:	bb83d4b032bb075e0605bb5b33e1db0a5e434c6e9a830968fce23921733594b6959f070d6587a415617d113d4740d80887a2af65e7d8ec66da131851b755441a
SSDEEP:	6144:HlisFUpX3pCxUeLjU/1g9vKcKvSrOMr1RbTK3hXFx:dJgOOW1RbOx
TLSH:	EA943EAB31444B1ECA582573CCDBD03447A19C965132EA962BF43F2B37F2262DD09F96
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...Uz.e................................. ........@.. ....................................@................................

File Icon


Icon Hash:	a8c6ca6a70b2d86c

Static PE Info

General

Entrypoint:	0x43e91e
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
Time Stamp:	0x65FE7A55 [Sat Mar 23 06:44:37 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:	f34d5f2d4577ed6d9ceec516c1f5a744

Entrypoint Preview

Instruction
jmp dword ptr [00402000h]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x3e8d0	0x4b	.text
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x42000	0x29f4c	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x6c000	0xc	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x2000	0x8	.text
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x2008	0x48	.text

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x2000	0x3c924	0x3ca00	2385981aeac46a4f8805e9ee7b69ca72	False	0.5188224871134021	data	6.0460081442456	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.sdata	0x40000	0x4e8	0x600	42ec620fe04776fbfb326b7691ba0d69	False	0.5091145833333334	DOS/MBR boot sector	4.572803684399909	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0x42000	0x29f4c	0x2a000	10f0ea8b3216022b9cb433b57fe3992b	False	0.08011300223214286	data	3.185967193245626	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0x6c000	0xc	0x200	938b60c0e62c0baff7467d061c77ea6a	False	0.044921875	data	0.10191042566270775	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	ZLIB Complexity
RT_ICON	0x420e8	0x29c68	Device independent bitmap graphic, 256 x 324 x 32, image size 165888	0.07796063397073262
RT_GROUP_ICON	0x6bd50	0x14	data	1.1
RT_MANIFEST	0x6bd64	0x1e7	XML 1.0 document, ASCII text, with CRLF line terminators	0.5338809034907598

Imports

DLL	Import
mscoree.dll	_CorExeMain

Network Behavior

Suricata IDS Alerts

Timestamp	Protocol	SID	Signature	Source Port	Dest Port	Source IP	Dest IP
2024-07-25T23:57:51.109328+0200	TCP	2825563	ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (inf)	49719	5585	192.168.2.10	147.185.221.19
2024-07-25T23:56:40.736396+0200	TCP	2825564	ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (act)	49715	5585	192.168.2.10	147.185.221.19
2024-07-25T23:56:10.629751+0200	TCP	2825563	ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (inf)	49707	5585	192.168.2.10	147.185.221.19
2024-07-25T23:58:23.348159+0200	TCP	2825563	ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (inf)	49720	5585	192.168.2.10	147.185.221.19
2024-07-25T23:56:57.567515+0200	TCP	2021176	ET MALWARE Bladabindi/njRAT CnC Command (ll)	49716	5585	192.168.2.10	147.185.221.19
2024-07-25T23:56:59.790090+0200	TCP	2825564	ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (act)	49716	5585	192.168.2.10	147.185.221.19
2024-07-25T23:59:03.030097+0200	TCP	2021176	ET MALWARE Bladabindi/njRAT CnC Command (ll)	49722	5585	192.168.2.10	147.185.221.19
2024-07-25T23:59:50.254677+0200	TCP	2021176	ET MALWARE Bladabindi/njRAT CnC Command (ll)	49723	5585	192.168.2.10	147.185.221.19
2024-07-25T23:56:57.573142+0200	TCP	2825563	ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (inf)	49716	5585	192.168.2.10	147.185.221.19
2024-07-25T23:58:28.266864+0200	TCP	2825564	ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (act)	49720	5585	192.168.2.10	147.185.221.19
2024-07-25T23:56:12.854505+0200	TCP	2825564	ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (act)	49707	5585	192.168.2.10	147.185.221.19
2024-07-25T23:58:23.343002+0200	TCP	2021176	ET MALWARE Bladabindi/njRAT CnC Command (ll)	49720	5585	192.168.2.10	147.185.221.19
2024-07-25T23:57:18.617139+0200	TCP	2021176	ET MALWARE Bladabindi/njRAT CnC Command (ll)	49718	5585	192.168.2.10	147.185.221.19
2024-07-25T23:56:16.810992+0200	TCP	2022930	ET EXPLOIT Possible CVE-2016-2211 Symantec Cab Parsing Buffer Overflow	443	49710	40.68.123.157	192.168.2.10
2024-07-25T23:56:21.795844+0200	TCP	2825564	ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (act)	49707	5585	192.168.2.10	147.185.221.19
2024-07-25T23:59:03.035444+0200	TCP	2825563	ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (inf)	49722	5585	192.168.2.10	147.185.221.19
2024-07-25T23:57:18.624693+0200	TCP	2825563	ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (inf)	49718	5585	192.168.2.10	147.185.221.19
2024-07-25T23:57:49.987155+0200	TCP	2021176	ET MALWARE Bladabindi/njRAT CnC Command (ll)	49719	5585	192.168.2.10	147.185.221.19
2024-07-25T23:58:50.479118+0200	TCP	2021176	ET MALWARE Bladabindi/njRAT CnC Command (ll)	49721	5585	192.168.2.10	147.185.221.19
2024-07-25T23:57:52.773301+0200	TCP	2825564	ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (act)	49719	5585	192.168.2.10	147.185.221.19
2024-07-25T23:56:59.286848+0200	TCP	2022930	ET EXPLOIT Possible CVE-2016-2211 Symantec Cab Parsing Buffer Overflow	443	49717	40.68.123.157	192.168.2.10
2024-07-25T23:56:31.291589+0200	TCP	2021176	ET MALWARE Bladabindi/njRAT CnC Command (ll)	49715	5585	192.168.2.10	147.185.221.19
2024-07-25T23:56:10.620138+0200	TCP	2021176	ET MALWARE Bladabindi/njRAT CnC Command (ll)	49707	5585	192.168.2.10	147.185.221.19

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jul 25, 2024 23:56:07.071707964 CEST	49707	5585	192.168.2.10	147.185.221.19
Jul 25, 2024 23:56:07.076816082 CEST	5585	49707	147.185.221.19	192.168.2.10
Jul 25, 2024 23:56:07.077502966 CEST	49707	5585	192.168.2.10	147.185.221.19
Jul 25, 2024 23:56:10.620137930 CEST	49707	5585	192.168.2.10	147.185.221.19
Jul 25, 2024 23:56:10.627895117 CEST	5585	49707	147.185.221.19	192.168.2.10
Jul 25, 2024 23:56:10.629750967 CEST	49707	5585	192.168.2.10	147.185.221.19
Jul 25, 2024 23:56:10.634692907 CEST	5585	49707	147.185.221.19	192.168.2.10
Jul 25, 2024 23:56:12.854505062 CEST	49707	5585	192.168.2.10	147.185.221.19
Jul 25, 2024 23:56:12.859435081 CEST	5585	49707	147.185.221.19	192.168.2.10
Jul 25, 2024 23:56:21.795844078 CEST	49707	5585	192.168.2.10	147.185.221.19
Jul 25, 2024 23:56:21.800844908 CEST	5585	49707	147.185.221.19	192.168.2.10
Jul 25, 2024 23:56:28.488796949 CEST	5585	49707	147.185.221.19	192.168.2.10
Jul 25, 2024 23:56:28.488869905 CEST	49707	5585	192.168.2.10	147.185.221.19
Jul 25, 2024 23:56:30.553042889 CEST	49707	5585	192.168.2.10	147.185.221.19
Jul 25, 2024 23:56:30.554338932 CEST	49715	5585	192.168.2.10	147.185.221.19
Jul 25, 2024 23:56:30.558120966 CEST	5585	49707	147.185.221.19	192.168.2.10
Jul 25, 2024 23:56:30.559623003 CEST	5585	49715	147.185.221.19	192.168.2.10
Jul 25, 2024 23:56:30.559729099 CEST	49715	5585	192.168.2.10	147.185.221.19
Jul 25, 2024 23:56:31.291589022 CEST	49715	5585	192.168.2.10	147.185.221.19
Jul 25, 2024 23:56:31.296456099 CEST	5585	49715	147.185.221.19	192.168.2.10
Jul 25, 2024 23:56:31.296511889 CEST	49715	5585	192.168.2.10	147.185.221.19
Jul 25, 2024 23:56:31.301330090 CEST	5585	49715	147.185.221.19	192.168.2.10
Jul 25, 2024 23:56:40.736396074 CEST	49715	5585	192.168.2.10	147.185.221.19
Jul 25, 2024 23:56:40.742125988 CEST	5585	49715	147.185.221.19	192.168.2.10
Jul 25, 2024 23:56:52.115108967 CEST	5585	49715	147.185.221.19	192.168.2.10
Jul 25, 2024 23:56:52.115217924 CEST	49715	5585	192.168.2.10	147.185.221.19
Jul 25, 2024 23:56:54.164395094 CEST	49715	5585	192.168.2.10	147.185.221.19
Jul 25, 2024 23:56:54.165760994 CEST	49716	5585	192.168.2.10	147.185.221.19
Jul 25, 2024 23:56:54.169734955 CEST	5585	49715	147.185.221.19	192.168.2.10
Jul 25, 2024 23:56:54.170754910 CEST	5585	49716	147.185.221.19	192.168.2.10
Jul 25, 2024 23:56:54.170819044 CEST	49716	5585	192.168.2.10	147.185.221.19
Jul 25, 2024 23:56:57.567514896 CEST	49716	5585	192.168.2.10	147.185.221.19
Jul 25, 2024 23:56:57.573079109 CEST	5585	49716	147.185.221.19	192.168.2.10
Jul 25, 2024 23:56:57.573142052 CEST	49716	5585	192.168.2.10	147.185.221.19
Jul 25, 2024 23:56:57.579235077 CEST	5585	49716	147.185.221.19	192.168.2.10
Jul 25, 2024 23:56:59.790090084 CEST	49716	5585	192.168.2.10	147.185.221.19
Jul 25, 2024 23:56:59.795393944 CEST	5585	49716	147.185.221.19	192.168.2.10
Jul 25, 2024 23:57:15.559210062 CEST	5585	49716	147.185.221.19	192.168.2.10
Jul 25, 2024 23:57:15.559330940 CEST	49716	5585	192.168.2.10	147.185.221.19
Jul 25, 2024 23:57:17.569519043 CEST	49716	5585	192.168.2.10	147.185.221.19
Jul 25, 2024 23:57:17.571075916 CEST	49718	5585	192.168.2.10	147.185.221.19
Jul 25, 2024 23:57:17.574470997 CEST	5585	49716	147.185.221.19	192.168.2.10
Jul 25, 2024 23:57:17.576034069 CEST	5585	49718	147.185.221.19	192.168.2.10
Jul 25, 2024 23:57:17.576119900 CEST	49718	5585	192.168.2.10	147.185.221.19
Jul 25, 2024 23:57:18.617139101 CEST	49718	5585	192.168.2.10	147.185.221.19
Jul 25, 2024 23:57:18.624605894 CEST	5585	49718	147.185.221.19	192.168.2.10
Jul 25, 2024 23:57:18.624692917 CEST	49718	5585	192.168.2.10	147.185.221.19
Jul 25, 2024 23:57:18.629745960 CEST	5585	49718	147.185.221.19	192.168.2.10
Jul 25, 2024 23:57:38.945903063 CEST	5585	49718	147.185.221.19	192.168.2.10
Jul 25, 2024 23:57:38.945977926 CEST	49718	5585	192.168.2.10	147.185.221.19
Jul 25, 2024 23:57:40.975795031 CEST	49718	5585	192.168.2.10	147.185.221.19
Jul 25, 2024 23:57:40.980817080 CEST	5585	49718	147.185.221.19	192.168.2.10
Jul 25, 2024 23:57:42.049340963 CEST	49719	5585	192.168.2.10	147.185.221.19
Jul 25, 2024 23:57:42.054404974 CEST	5585	49719	147.185.221.19	192.168.2.10
Jul 25, 2024 23:57:42.054546118 CEST	49719	5585	192.168.2.10	147.185.221.19
Jul 25, 2024 23:57:49.987154961 CEST	49719	5585	192.168.2.10	147.185.221.19
Jul 25, 2024 23:57:49.992166996 CEST	5585	49719	147.185.221.19	192.168.2.10
Jul 25, 2024 23:57:51.109328032 CEST	49719	5585	192.168.2.10	147.185.221.19
Jul 25, 2024 23:57:51.114583015 CEST	5585	49719	147.185.221.19	192.168.2.10
Jul 25, 2024 23:57:52.773300886 CEST	49719	5585	192.168.2.10	147.185.221.19
Jul 25, 2024 23:57:52.778733015 CEST	5585	49719	147.185.221.19	192.168.2.10
Jul 25, 2024 23:58:03.449522018 CEST	5585	49719	147.185.221.19	192.168.2.10
Jul 25, 2024 23:58:03.449776888 CEST	49719	5585	192.168.2.10	147.185.221.19
Jul 25, 2024 23:58:06.023600101 CEST	49719	5585	192.168.2.10	147.185.221.19
Jul 25, 2024 23:58:06.028614044 CEST	5585	49719	147.185.221.19	192.168.2.10
Jul 25, 2024 23:58:06.047226906 CEST	49720	5585	192.168.2.10	147.185.221.19
Jul 25, 2024 23:58:07.110857010 CEST	5585	49720	147.185.221.19	192.168.2.10
Jul 25, 2024 23:58:07.111104012 CEST	49720	5585	192.168.2.10	147.185.221.19
Jul 25, 2024 23:58:23.343002081 CEST	49720	5585	192.168.2.10	147.185.221.19
Jul 25, 2024 23:58:23.348017931 CEST	5585	49720	147.185.221.19	192.168.2.10
Jul 25, 2024 23:58:23.348159075 CEST	49720	5585	192.168.2.10	147.185.221.19
Jul 25, 2024 23:58:23.352993011 CEST	5585	49720	147.185.221.19	192.168.2.10
Jul 25, 2024 23:58:28.266864061 CEST	49720	5585	192.168.2.10	147.185.221.19
Jul 25, 2024 23:58:28.456604958 CEST	5585	49720	147.185.221.19	192.168.2.10
Jul 25, 2024 23:58:28.515122890 CEST	5585	49720	147.185.221.19	192.168.2.10
Jul 25, 2024 23:58:28.515224934 CEST	49720	5585	192.168.2.10	147.185.221.19
Jul 25, 2024 23:58:30.526348114 CEST	49720	5585	192.168.2.10	147.185.221.19
Jul 25, 2024 23:58:30.531450987 CEST	5585	49720	147.185.221.19	192.168.2.10
Jul 25, 2024 23:58:30.654233932 CEST	49721	5585	192.168.2.10	147.185.221.19
Jul 25, 2024 23:58:30.659203053 CEST	5585	49721	147.185.221.19	192.168.2.10
Jul 25, 2024 23:58:30.659317970 CEST	49721	5585	192.168.2.10	147.185.221.19
Jul 25, 2024 23:58:50.479118109 CEST	49721	5585	192.168.2.10	147.185.221.19
Jul 25, 2024 23:58:50.486294031 CEST	5585	49721	147.185.221.19	192.168.2.10
Jul 25, 2024 23:58:50.486413002 CEST	49721	5585	192.168.2.10	147.185.221.19
Jul 25, 2024 23:58:50.492888927 CEST	5585	49721	147.185.221.19	192.168.2.10
Jul 25, 2024 23:58:52.369496107 CEST	5585	49721	147.185.221.19	192.168.2.10
Jul 25, 2024 23:58:52.369587898 CEST	49721	5585	192.168.2.10	147.185.221.19
Jul 25, 2024 23:58:52.370424032 CEST	5585	49721	147.185.221.19	192.168.2.10
Jul 25, 2024 23:58:52.370476007 CEST	49721	5585	192.168.2.10	147.185.221.19
Jul 25, 2024 23:58:55.397850037 CEST	49721	5585	192.168.2.10	147.185.221.19
Jul 25, 2024 23:58:55.403548956 CEST	5585	49721	147.185.221.19	192.168.2.10
Jul 25, 2024 23:58:57.082262993 CEST	49722	5585	192.168.2.10	147.185.221.19
Jul 25, 2024 23:58:57.087593079 CEST	5585	49722	147.185.221.19	192.168.2.10
Jul 25, 2024 23:58:57.087708950 CEST	49722	5585	192.168.2.10	147.185.221.19
Jul 25, 2024 23:59:03.030097008 CEST	49722	5585	192.168.2.10	147.185.221.19
Jul 25, 2024 23:59:03.035347939 CEST	5585	49722	147.185.221.19	192.168.2.10
Jul 25, 2024 23:59:03.035444021 CEST	49722	5585	192.168.2.10	147.185.221.19
Jul 25, 2024 23:59:03.040306091 CEST	5585	49722	147.185.221.19	192.168.2.10
Jul 25, 2024 23:59:18.486946106 CEST	5585	49722	147.185.221.19	192.168.2.10
Jul 25, 2024 23:59:18.487011909 CEST	49722	5585	192.168.2.10	147.185.221.19
Jul 25, 2024 23:59:20.522864103 CEST	49722	5585	192.168.2.10	147.185.221.19
Jul 25, 2024 23:59:20.535661936 CEST	49723	5585	192.168.2.10	147.185.221.19
Jul 25, 2024 23:59:20.701689005 CEST	5585	49722	147.185.221.19	192.168.2.10
Jul 25, 2024 23:59:20.701704979 CEST	5585	49723	147.185.221.19	192.168.2.10
Jul 25, 2024 23:59:20.701839924 CEST	49723	5585	192.168.2.10	147.185.221.19
Jul 25, 2024 23:59:42.094413042 CEST	5585	49723	147.185.221.19	192.168.2.10
Jul 25, 2024 23:59:42.094516993 CEST	49723	5585	192.168.2.10	147.185.221.19
Jul 25, 2024 23:59:50.254677057 CEST	49723	5585	192.168.2.10	147.185.221.19
Jul 25, 2024 23:59:50.497270107 CEST	5585	49723	147.185.221.19	192.168.2.10
Jul 25, 2024 23:59:58.690007925 CEST	49724	5585	192.168.2.10	147.185.221.19
Jul 25, 2024 23:59:58.695024014 CEST	5585	49724	147.185.221.19	192.168.2.10
Jul 25, 2024 23:59:58.695127964 CEST	49724	5585	192.168.2.10	147.185.221.19

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jul 25, 2024 23:56:06.964119911 CEST	61682	53	192.168.2.10	1.1.1.1
Jul 25, 2024 23:56:07.020715952 CEST	53	61682	1.1.1.1	192.168.2.10

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Jul 25, 2024 23:56:06.964119911 CEST	192.168.2.10	1.1.1.1	0x5727	Standard query (0)	prior-gently.gl.at.ply.gg	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Jul 25, 2024 23:56:07.020715952 CEST	1.1.1.1	192.168.2.10	0x5727	No error (0)	prior-gently.gl.at.ply.gg		147.185.221.19	A (IP address)	IN (0x0001)	false

Target ID:	1
Start time:	17:55:53
Start date:	25/07/2024
Path:	C:\Users\user\Desktop\LisectAVT_2403002A_135.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\LisectAVT_2403002A_135.exe"
Imagebase:	0x950000
File size:	423'433 bytes
MD5 hash:	01022196F7291AA2D9A6BAA67EFE6745
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	false

Show Windows behavior

Target ID:	11
Start time:	17:56:12
Start date:	25/07/2024
Path:	C:\Users\user\Desktop\LisectAVT_2403002A_135.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\LisectAVT_2403002A_135.exe" ..
Imagebase:	0xac0000
File size:	423'433 bytes
MD5 hash:	01022196F7291AA2D9A6BAA67EFE6745
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Njrat, Description: Yara detected Njrat, Source: 0000000B.00000002.1515413460.0000000003101000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Njrat_30f3c220, Description: unknown, Source: 0000000B.00000002.1515413460.0000000003101000.00000004.00000800.00020000.00000000.sdmp, Author: unknown Rule: njrat1, Description: Identify njRat, Source: 0000000B.00000002.1515413460.0000000003101000.00000004.00000800.00020000.00000000.sdmp, Author: Brian Wallace @botnet_hunter Rule: Njrat, Description: detect njRAT in memory, Source: 0000000B.00000002.1515413460.0000000003101000.00000004.00000800.00020000.00000000.sdmp, Author: JPCERT/CC Incident Response Group
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	12
Start time:	17:56:21
Start date:	25/07/2024
Path:	C:\Users\user\Desktop\LisectAVT_2403002A_135.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\LisectAVT_2403002A_135.exe" ..
Imagebase:	0xcf0000
File size:	423'433 bytes
MD5 hash:	01022196F7291AA2D9A6BAA67EFE6745
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	13
Start time:	17:56:32
Start date:	25/07/2024
Path:	C:\Users\user\Desktop\LisectAVT_2403002A_135.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\LisectAVT_2403002A_135.exe" ..
Imagebase:	0x700000
File size:	423'433 bytes
MD5 hash:	01022196F7291AA2D9A6BAA67EFE6745
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	17
Start time:	17:56:42
Start date:	25/07/2024
Path:	C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Client.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Client.exe"
Imagebase:	0x970000
File size:	423'433 bytes
MD5 hash:	01022196F7291AA2D9A6BAA67EFE6745
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Njrat, Description: Yara detected Njrat, Source: 00000011.00000002.1798372852.0000000002F31000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Njrat_30f3c220, Description: unknown, Source: 00000011.00000002.1798372852.0000000002F31000.00000004.00000800.00020000.00000000.sdmp, Author: unknown Rule: njrat1, Description: Identify njRat, Source: 00000011.00000002.1798372852.0000000002F31000.00000004.00000800.00020000.00000000.sdmp, Author: Brian Wallace @botnet_hunter Rule: Njrat, Description: detect njRAT in memory, Source: 00000011.00000002.1798372852.0000000002F31000.00000004.00000800.00020000.00000000.sdmp, Author: JPCERT/CC Incident Response Group
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	18
Start time:	17:56:53
Start date:	25/07/2024
Path:	C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Client.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Client.exe"
Imagebase:	0x6a0000
File size:	423'433 bytes
MD5 hash:	01022196F7291AA2D9A6BAA67EFE6745
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Execution Graph

Execution Coverage:	14.6%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	11.9%
Total number of Nodes:	143
Total number of Limit Nodes:	8

Executed Functions

Function 00ECB2EF Relevance: 1.6, APIs: 1, Instructions: 75COMMON

Download Yara Rule

APIs

AdjustTokenPrivileges.KERNELBASE(?,?,?,?,?,?), ref: 00ECB36F

Memory Dump Source

Source File: 00000001.00000002.3709959714.0000000000ECA000.00000040.00000800.00020000.00000000.sdmp, Offset: 00ECA000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_eca000_LisectAVT_2403002A_135.jbxd

Similarity

API ID: AdjustPrivilegesToken
String ID:
API String ID: 2874748243-0
Opcode ID: bc13ae04080293660a924471fcad54b5c27aabde645c9c65e1ccf8dac67c5c58
Instruction ID: d11f80fdfcdf44a837102990a9947a3392705ac9038a402f0f946b80de598d34
Opcode Fuzzy Hash: bc13ae04080293660a924471fcad54b5c27aabde645c9c65e1ccf8dac67c5c58
Instruction Fuzzy Hash: 9421AB765097809FDB228F25DC45B52BFB4EF06324F08849AE9858B163D371A908DB62

Function 00ECA7AD Relevance: 1.6, APIs: 1, Instructions: 62nativeCOMMON

Download Yara Rule

APIs

NtQuerySystemInformation.NTDLL ref: 00ECA821

Memory Dump Source

Source File: 00000001.00000002.3709959714.0000000000ECA000.00000040.00000800.00020000.00000000.sdmp, Offset: 00ECA000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_eca000_LisectAVT_2403002A_135.jbxd

Similarity

API ID: InformationQuerySystem
String ID:
API String ID: 3562636166-0
Opcode ID: 5907181e1d4c512ebfe915bf71ddd234a203178b4fb3a34734c379c11985fd22
Instruction ID: d8efb2411641ea81ccf20e06c5056a909cbc8ad426f04f3188fc82ec81a8209a
Opcode Fuzzy Hash: 5907181e1d4c512ebfe915bf71ddd234a203178b4fb3a34734c379c11985fd22
Instruction Fuzzy Hash: 1021CD7240D3C09FDB228F21DD44A52FFB0EF07224F0984DFE9844B163D265A919DB62

Function 00ECB326 Relevance: 1.6, APIs: 1, Instructions: 52COMMON

Download Yara Rule

APIs

AdjustTokenPrivileges.KERNELBASE(?,?,?,?,?,?), ref: 00ECB36F

Memory Dump Source

Source File: 00000001.00000002.3709959714.0000000000ECA000.00000040.00000800.00020000.00000000.sdmp, Offset: 00ECA000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_eca000_LisectAVT_2403002A_135.jbxd

Similarity

API ID: AdjustPrivilegesToken
String ID:
API String ID: 2874748243-0
Opcode ID: 168fb4c6a12e4922c7231756aa6700110a898cd45206b6df9dff9fd9fac40963
Instruction ID: c5195ac5db128d5fa4db00bf255e7f7f33bd36d173975dc53df4db3ad94c6d79
Opcode Fuzzy Hash: 168fb4c6a12e4922c7231756aa6700110a898cd45206b6df9dff9fd9fac40963
Instruction Fuzzy Hash: 8311A0355047409FDB20CF59D945B56FBE4EF04320F08C4AEDD458B652D376E415DB61

Function 052A01E4 Relevance: 1.6, APIs: 1, Instructions: 50nativeCOMMON

Download Yara Rule

APIs

NtSetInformationProcess.NTDLL ref: 052A0241

Memory Dump Source

Source File: 00000001.00000002.3727425985.00000000052A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 052A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_52a0000_LisectAVT_2403002A_135.jbxd

Similarity

API ID: InformationProcess
String ID:
API String ID: 1801817001-0
Opcode ID: 3d1033201afc4a8d6a91164474c6cf629dadc424df772c6d45995a69e40fd5f2
Instruction ID: 76217e81a1675fcb4f08a97b5ff9ee17f9452af95ecb9cf81a2714747f498748
Opcode Fuzzy Hash: 3d1033201afc4a8d6a91164474c6cf629dadc424df772c6d45995a69e40fd5f2
Instruction Fuzzy Hash: EF11A071409380AFCB228F51DC45F62FFB4EF06320F08849EED854B263D275A918CB62

Function 052A0206 Relevance: 1.5, APIs: 1, Instructions: 38nativeCOMMON

Download Yara Rule

APIs

NtSetInformationProcess.NTDLL ref: 052A0241

Memory Dump Source

Source File: 00000001.00000002.3727425985.00000000052A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 052A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_52a0000_LisectAVT_2403002A_135.jbxd

Similarity

API ID: InformationProcess
String ID:
API String ID: 1801817001-0
Opcode ID: dbcb2c65f50c23d7ed45532fa603de499d659fe9b3540bb22bb84044a835cc14
Instruction ID: ec4fdcb4be520c5256e8bc7b66866553df10043dbcf61357582c73ddf1e5c75d
Opcode Fuzzy Hash: dbcb2c65f50c23d7ed45532fa603de499d659fe9b3540bb22bb84044a835cc14
Instruction Fuzzy Hash: 06018F324147449FDB20CF55D989B21FBE1FF48720F08C09ADE890A252E375A518CB62

Function 00ECA7E6 Relevance: 1.5, APIs: 1, Instructions: 38nativeCOMMON

Download Yara Rule

APIs

NtQuerySystemInformation.NTDLL ref: 00ECA821

Memory Dump Source

Source File: 00000001.00000002.3709959714.0000000000ECA000.00000040.00000800.00020000.00000000.sdmp, Offset: 00ECA000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_eca000_LisectAVT_2403002A_135.jbxd

Similarity

API ID: InformationQuerySystem
String ID:
API String ID: 3562636166-0
Opcode ID: 5df04f04f6f050df10cc1b09f4db4e8c327eefac136a1eb94315e5393f7c98da
Instruction ID: 3db1f423d5981be4b061bb33d0d631d531831d80c4144694c73f64b036dd4682
Opcode Fuzzy Hash: 5df04f04f6f050df10cc1b09f4db4e8c327eefac136a1eb94315e5393f7c98da
Instruction Fuzzy Hash: 77018F324046449FDB208F55D989B61FBE0EF04728F08C4AEDE451A252D376A519DB62

Function 052B6B5C Relevance: .3, Instructions: 265COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.3727458401.00000000052B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 052B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_52b0000_LisectAVT_2403002A_135.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6d6dc46360e8675693d0bd6b15fd87bb7e341d333e766583f99162caafa5da93
Instruction ID: 2db1ac061f290538fbb45821644e2ad9c8884a3e648764846a9d42440141669d
Opcode Fuzzy Hash: 6d6dc46360e8675693d0bd6b15fd87bb7e341d333e766583f99162caafa5da93
Instruction Fuzzy Hash: 76C12D74A01214DFEB64AFB2DC58BAD7BB2EF88301F1044AAD50AAB3D4CE756945CF50

Function 052B7E4D Relevance: 4.1, Strings: 3, Instructions: 348
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

$, xrefs: 052B7FCB
!, xrefs: 052B8843
", xrefs: 052B7EAD

Memory Dump Source

Source File: 00000001.00000002.3727458401.00000000052B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 052B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_52b0000_LisectAVT_2403002A_135.jbxd

Similarity

API ID:
String ID: !$"$$
API String ID: 0-3824246329
Opcode ID: 2f299f02a2bc2ceca355bf65734114c444103aa428c5229391e72f46d2cc20d9
Instruction ID: c5358e14426ee7d9f0486233683fa96358ae646e57b75f8bf53065409ea9260d
Opcode Fuzzy Hash: 2f299f02a2bc2ceca355bf65734114c444103aa428c5229391e72f46d2cc20d9
Instruction Fuzzy Hash: A5D1B075A25106CFFB04DF75E988AED7BB6FF84384F088065D849EB295DBB49801CB42

Function 052A3371 Relevance: 1.6, APIs: 1, Instructions: 102
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegCreateKeyExW.KERNEL32(?,00000E24), ref: 052A343D

Memory Dump Source

Source File: 00000001.00000002.3727425985.00000000052A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 052A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_52a0000_LisectAVT_2403002A_135.jbxd

Similarity

API ID: Create
String ID:
API String ID: 2289755597-0
Opcode ID: 9b48809225cbbbcf8850edfbacf346743cf8d59f63f4802ce22f1bcb9218416f
Instruction ID: cb39aab1cfdbf2c541061ec52a954ba6d96ad3618ebc7b5adb6b0f29659eb26f
Opcode Fuzzy Hash: 9b48809225cbbbcf8850edfbacf346743cf8d59f63f4802ce22f1bcb9218416f
Instruction Fuzzy Hash: FE31AF72508744AFE722CF61CC44F67BBFCEF15214F08899AE989CB552D324E948CBA1

Function 00ECB820 Relevance: 1.6, APIs: 1, Instructions: 101
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegOpenKeyExW.KERNEL32(?,00000E24), ref: 00ECB8DD

Memory Dump Source

Source File: 00000001.00000002.3709959714.0000000000ECA000.00000040.00000800.00020000.00000000.sdmp, Offset: 00ECA000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_eca000_LisectAVT_2403002A_135.jbxd

Similarity

API ID: Open
String ID:
API String ID: 71445658-0
Opcode ID: d1eec3877231cd686340171fb212573af1c1c13aeb2e668e3641f23488afc988
Instruction ID: 184bac69457025fb04cb87fb355f7c39ca33184e64228798a7a9f448c844fe4e
Opcode Fuzzy Hash: d1eec3877231cd686340171fb212573af1c1c13aeb2e668e3641f23488afc988
Instruction Fuzzy Hash: 6D31D5B2508344AFE722CB61DC45FA6BFBCEF15324F05849EE9858B153D325A90ACB71

Function 052A11F3 Relevance: 1.6, APIs: 1, Instructions: 98
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegQueryValueExW.KERNEL32(?,00000E24,?,?), ref: 052A12BA

Memory Dump Source

Source File: 00000001.00000002.3727425985.00000000052A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 052A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_52a0000_LisectAVT_2403002A_135.jbxd

Similarity

API ID: QueryValue
String ID:
API String ID: 3660427363-0
Opcode ID: 1f956e86514f87b389b89b60420a19c3f42b0df933af175946e42d2560678e82
Instruction ID: e8589b6fb0cd11de2d2c8f98c3e2f42e505862af60f5a168b73b398dc1f94bb0
Opcode Fuzzy Hash: 1f956e86514f87b389b89b60420a19c3f42b0df933af175946e42d2560678e82
Instruction Fuzzy Hash: CE315A6550E3C06FD3138B258C65A21BFB4EF47610F0E85CBD8C48F5A3D229A919D7B2

Function 00ECA9CF Relevance: 1.6, APIs: 1, Instructions: 98
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateFileW.KERNEL32(?,?,?,?,?,?), ref: 00ECAA85

Memory Dump Source

Source File: 00000001.00000002.3709959714.0000000000ECA000.00000040.00000800.00020000.00000000.sdmp, Offset: 00ECA000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_eca000_LisectAVT_2403002A_135.jbxd

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: 7c71a94d6dc61dfe38a4cafd5612564fa4d3f4f5653880e8f50ff8533725c410
Instruction ID: ee1a199fa6a778e8a1924926871cc7931fdb9ee1df0e07ab1d5e453670e47e54
Opcode Fuzzy Hash: 7c71a94d6dc61dfe38a4cafd5612564fa4d3f4f5653880e8f50ff8533725c410
Instruction Fuzzy Hash: FE31A1B1404344AFE722CB25CD44F62BFF8EF06314F08849EE9858B152D375A909CB71

Function 052A1E20 Relevance: 1.6, APIs: 1, Instructions: 93
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

getaddrinfo.WS2_32(?,00000E24), ref: 052A1EE7

Memory Dump Source

Source File: 00000001.00000002.3727425985.00000000052A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 052A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_52a0000_LisectAVT_2403002A_135.jbxd

Similarity

API ID: getaddrinfo
String ID:
API String ID: 300660673-0
Opcode ID: f15e461b513c17eb21cfc675e072afeac8a46c806a18b9639a5366bfc3fda3ee
Instruction ID: f835f12fb0b37dc24331585a4c1a299d18a0fbb51172db94ce6c724af26d5c52
Opcode Fuzzy Hash: f15e461b513c17eb21cfc675e072afeac8a46c806a18b9639a5366bfc3fda3ee
Instruction Fuzzy Hash: B031C471504344AFEB21CF51DC44FA6FBACEF04324F04849EFA489B182D375A949CBA1

Function 052A170C Relevance: 1.6, APIs: 1, Instructions: 89
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

ConvertStringSecurityDescriptorToSecurityDescriptorW.ADVAPI32(?,00000E24), ref: 052A17A3

Memory Dump Source

Source File: 00000001.00000002.3727425985.00000000052A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 052A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_52a0000_LisectAVT_2403002A_135.jbxd

Similarity

API ID: DescriptorSecurity$ConvertString
String ID:
API String ID: 3907675253-0
Opcode ID: 023ff77cc6842c93f56f024f6140e1dc7c93efc177a458b576f8f256dc97373f
Instruction ID: 0d7b28b685a3fc3a53e919dafd621eb35dc14e5fba7bd9462e62087feda549a7
Opcode Fuzzy Hash: 023ff77cc6842c93f56f024f6140e1dc7c93efc177a458b576f8f256dc97373f
Instruction Fuzzy Hash: 2D31B172508345AFE722CF65DC45F67BBE8EF05220F08849AE945CB152D364A918CB61

Function 00ECB722 Relevance: 1.6, APIs: 1, Instructions: 89
synchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateMutexW.KERNEL32(?,?), ref: 00ECB7C9

Memory Dump Source

Source File: 00000001.00000002.3709959714.0000000000ECA000.00000040.00000800.00020000.00000000.sdmp, Offset: 00ECA000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_eca000_LisectAVT_2403002A_135.jbxd

Similarity

API ID: CreateMutex
String ID:
API String ID: 1964310414-0
Opcode ID: c17c215d8c2564464a6a03a5426acc55c8d9f374a4190c474f8a595425c15159
Instruction ID: d57d0bcd23606babd4e8dd7d461f6ae272cb227d856b35f4dbcdd7adad1f0829
Opcode Fuzzy Hash: c17c215d8c2564464a6a03a5426acc55c8d9f374a4190c474f8a595425c15159
Instruction Fuzzy Hash: D9319E715093806FE711CB65CC45F56BFF8EF06214F08849EE9848B292D365A909CB61

Function 00ECB471 Relevance: 1.6, APIs: 1, Instructions: 87
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegQueryValueExW.KERNEL32(?,00000E24,F573157E,00000000,00000000,00000000,00000000), ref: 00ECB51C

Memory Dump Source

Source File: 00000001.00000002.3709959714.0000000000ECA000.00000040.00000800.00020000.00000000.sdmp, Offset: 00ECA000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_eca000_LisectAVT_2403002A_135.jbxd

Similarity

API ID: QueryValue
String ID:
API String ID: 3660427363-0
Opcode ID: 6bfec648837fb2bbfab437c97583f6e15b62175582b238030515f0fa6dc3d769
Instruction ID: bc44087fce1c9b143aa2247b3e4038e0f3055637ca32edb2c308703d3cb0c44c
Opcode Fuzzy Hash: 6bfec648837fb2bbfab437c97583f6e15b62175582b238030515f0fa6dc3d769
Instruction Fuzzy Hash: C9317C72508384AFD722CB15DC45FA2BBF8EF06314F08849AE985DB263D365E909CB61

Function 052A33A2 Relevance: 1.6, APIs: 1, Instructions: 86
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegCreateKeyExW.KERNEL32(?,00000E24), ref: 052A343D

Memory Dump Source

Source File: 00000001.00000002.3727425985.00000000052A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 052A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_52a0000_LisectAVT_2403002A_135.jbxd

Similarity

API ID: Create
String ID:
API String ID: 2289755597-0
Opcode ID: cb46e5b7801b5cd9c28e07e1ef89a6e4493a41c4e226625242232ad209f0e6ab
Instruction ID: 898cdaf9d908077dc8673dc553162daed938f1116340831097f268a1f89aa891
Opcode Fuzzy Hash: cb46e5b7801b5cd9c28e07e1ef89a6e4493a41c4e226625242232ad209f0e6ab
Instruction Fuzzy Hash: 6F21A072504604AFEB21CF65DC44F7BBBECEF18714F04885AEA89C6651D320E5088B61

Function 00ECB925 Relevance: 1.6, APIs: 1, Instructions: 86
windowtimeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SendMessageTimeoutA.USER32(?,00000E24), ref: 00ECB9E1

Memory Dump Source

Source File: 00000001.00000002.3709959714.0000000000ECA000.00000040.00000800.00020000.00000000.sdmp, Offset: 00ECA000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_eca000_LisectAVT_2403002A_135.jbxd

Similarity

API ID: MessageSendTimeout
String ID:
API String ID: 1599653421-0
Opcode ID: 716f34a6995d2f29bfa997bbc82db969db75335a5defd5c1b9863d545b73e747
Instruction ID: 8a3f38f3cf6890343b71cf740d5e491b89728e408487dd2d45b0ee5a2abbfe94
Opcode Fuzzy Hash: 716f34a6995d2f29bfa997bbc82db969db75335a5defd5c1b9863d545b73e747
Instruction Fuzzy Hash: 5031D471409380AFEB22CF61CC45FA2FFB8EF06324F08849EE9855B152D375A509CB65

Function 052A1E42 Relevance: 1.6, APIs: 1, Instructions: 84
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

getaddrinfo.WS2_32(?,00000E24), ref: 052A1EE7

Memory Dump Source

Source File: 00000001.00000002.3727425985.00000000052A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 052A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_52a0000_LisectAVT_2403002A_135.jbxd

Similarity

API ID: getaddrinfo
String ID:
API String ID: 300660673-0
Opcode ID: 62013f0b291d90b6221034666003ee8b8b88c937d811da0a85dca0feb6a8f9e8
Instruction ID: ec1363658901cd1f598fb58fd57370f1ccc5f81f848d0fb38f2cede0813dc295
Opcode Fuzzy Hash: 62013f0b291d90b6221034666003ee8b8b88c937d811da0a85dca0feb6a8f9e8
Instruction Fuzzy Hash: 7F21D172104304AFFB20DF51CC85FA6F7ACEF04324F04889AFA489A181D3B5A949CBB5

Function 052A37C6 Relevance: 1.6, APIs: 1, Instructions: 83
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegEnumValueW.KERNEL32(?,00000E24,?,?), ref: 052A3872

Memory Dump Source

Source File: 00000001.00000002.3727425985.00000000052A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 052A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_52a0000_LisectAVT_2403002A_135.jbxd

Similarity

API ID: EnumValue
String ID:
API String ID: 2814608202-0
Opcode ID: 9cfa8304ca700d947f698b6c23cfd5a3e77c7b2efc4264124a04460db6991dc4
Instruction ID: fe6cb99650dfe3e39ccf3ca9e8c0d099f7f6c484f76f9ea3563f9c6d5b57efe1
Opcode Fuzzy Hash: 9cfa8304ca700d947f698b6c23cfd5a3e77c7b2efc4264124a04460db6991dc4
Instruction Fuzzy Hash: 9B31857154D3C06FD3138B258C65A22BFB4DF87610F1A80CBD8848F6A3D225A91AD7B2

Function 00ECA120 Relevance: 1.6, APIs: 1, Instructions: 82
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

EnumWindows.USER32(?,00000E24,?,?), ref: 00ECA1BD

Memory Dump Source

Source File: 00000001.00000002.3709959714.0000000000ECA000.00000040.00000800.00020000.00000000.sdmp, Offset: 00ECA000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_eca000_LisectAVT_2403002A_135.jbxd

Similarity

API ID: EnumWindows
String ID:
API String ID: 1129996299-0
Opcode ID: 33ede37c089507d1c3cc15700fc7438c8134095b7e76ada04c7826915b5e116e
Instruction ID: aaa8e9ed887e7f1626c73a7c75a7ca0c76e4a9cb50a73e406d35b0f24a4a73d1
Opcode Fuzzy Hash: 33ede37c089507d1c3cc15700fc7438c8134095b7e76ada04c7826915b5e116e
Instruction Fuzzy Hash: B921B57150D3C06FD3028B658C61B66BFB4EF47610F1984CBD8C4CF193D225A919C7A2

Function 052A2194 Relevance: 1.6, APIs: 1, Instructions: 81
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetVolumeInformationA.KERNEL32(?,00000E24,?,?), ref: 052A223A

Memory Dump Source

Source File: 00000001.00000002.3727425985.00000000052A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 052A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_52a0000_LisectAVT_2403002A_135.jbxd

Similarity

API ID: InformationVolume
String ID:
API String ID: 2039140958-0
Opcode ID: 4f1bbd6340c3d27a004a175db02dd70f164e9106618218571606c1d3b42b4ffd
Instruction ID: ad0544c842aa36017779f873237be491bee7dc5c8267864bd16934b59db4d277
Opcode Fuzzy Hash: 4f1bbd6340c3d27a004a175db02dd70f164e9106618218571606c1d3b42b4ffd
Instruction Fuzzy Hash: D2317E7150E3C06FD312CB258C55B62BFB8EF87610F0981DBE8849F5A3D225A959C7A2

Function 052A3615 Relevance: 1.6, APIs: 1, Instructions: 80COMMON

Download Yara Rule

APIs

select.WS2_32(?,?,?,?,?), ref: 052A36A4

Memory Dump Source

Source File: 00000001.00000002.3727425985.00000000052A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 052A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_52a0000_LisectAVT_2403002A_135.jbxd

Similarity

API ID: select
String ID:
API String ID: 1274211008-0
Opcode ID: 54dbb3024c57b20e2bc5b4551f419003f7b1b525765dd2e490f62e4e1da973e6
Instruction ID: 9c3373baa25dc1ebded20d2d097725b3126e15fabec191ce6273d984dfa7d551
Opcode Fuzzy Hash: 54dbb3024c57b20e2bc5b4551f419003f7b1b525765dd2e490f62e4e1da973e6
Instruction Fuzzy Hash: 092171755087849FDB12CF25DC44B52BFF8EF46714F0888DAE988CB263D265E908DB61

Function 00ECAADC Relevance: 1.6, APIs: 1, Instructions: 80COMMON

Download Yara Rule

APIs

GetFileType.KERNEL32(?,00000E24,F573157E,00000000,00000000,00000000,00000000), ref: 00ECAB71

Memory Dump Source

Source File: 00000001.00000002.3709959714.0000000000ECA000.00000040.00000800.00020000.00000000.sdmp, Offset: 00ECA000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_eca000_LisectAVT_2403002A_135.jbxd

Similarity

API ID: FileType
String ID:
API String ID: 3081899298-0
Opcode ID: 69294ab8e8caa9984204d3a0ec28309cbaf6ce5863c6c28d9e6c6a95367cf2e6
Instruction ID: 116c688fda57f3901cc42acc353f917919407011de265e9333215bb498118153
Opcode Fuzzy Hash: 69294ab8e8caa9984204d3a0ec28309cbaf6ce5863c6c28d9e6c6a95367cf2e6
Instruction Fuzzy Hash: CE21F5B54497846FE7128F21DC45BA2BFBCEF47724F0980DAE9808B193D264AD09CB71

Function 052A0B87 Relevance: 1.6, APIs: 1, Instructions: 79COMMON

Download Yara Rule

APIs

MkParseDisplayName.OLE32(?,00000E24,?,?), ref: 052A0C2E

Memory Dump Source

Source File: 00000001.00000002.3727425985.00000000052A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 052A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_52a0000_LisectAVT_2403002A_135.jbxd

Similarity

API ID: DisplayNameParse
String ID:
API String ID: 3580041360-0
Opcode ID: 41f0655337bc90da92c6fe7f6a2f50264d6a13675bbba932887f1cc1ba40537e
Instruction ID: 35ba208b5fa7e47d0ad3269a04784aff833586f413dd0447e3e3f29f26ceea1f
Opcode Fuzzy Hash: 41f0655337bc90da92c6fe7f6a2f50264d6a13675bbba932887f1cc1ba40537e
Instruction Fuzzy Hash: B721887154E3C06FD3138B258C51B62BFB4EF87610F0A80DBE8848F5A3D6256919C7B2

Function 052A12E6 Relevance: 1.6, APIs: 1, Instructions: 77networkCOMMON

Download Yara Rule

APIs

WSASocketW.WS2_32(?,?,?,?,?), ref: 052A1372

Memory Dump Source

Source File: 00000001.00000002.3727425985.00000000052A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 052A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_52a0000_LisectAVT_2403002A_135.jbxd

Similarity

API ID: Socket
String ID:
API String ID: 38366605-0
Opcode ID: 03f94df0c96c33b81b3a626e82720e3da79ef3bba28123cf5b7fa47db1275fab
Instruction ID: bbca3f29fc22a34be9f61712a055950b0f252c36c95b2ade484dfd81c7499dda
Opcode Fuzzy Hash: 03f94df0c96c33b81b3a626e82720e3da79ef3bba28123cf5b7fa47db1275fab
Instruction Fuzzy Hash: FE219E71409380AFE721CF51DC45F66FFF8EF05224F08889EE9858B652D375A418CB61

Function 052A18C2 Relevance: 1.6, APIs: 1, Instructions: 77fileCOMMON

Download Yara Rule

APIs

MapViewOfFile.KERNEL32 ref: 052A1956

Memory Dump Source

Source File: 00000001.00000002.3727425985.00000000052A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 052A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_52a0000_LisectAVT_2403002A_135.jbxd

Similarity

API ID: FileView
String ID:
API String ID: 3314676101-0
Opcode ID: c51b27039857e1397b789532e0c948de89dbfdab07f6fbbf6df45fdc0c02c45b
Instruction ID: 1e4efe40bc19d8ec707d0ce85ca17f082e247544986cac175cb0f44cc97af284
Opcode Fuzzy Hash: c51b27039857e1397b789532e0c948de89dbfdab07f6fbbf6df45fdc0c02c45b
Instruction Fuzzy Hash: C821A371409344AFE722CF55DC45F66FFF8EF09224F04849EE9898B552D375A508CBA1

Function 00ECB572 Relevance: 1.6, APIs: 1, Instructions: 77registryCOMMON

Download Yara Rule

APIs

RegSetValueExW.KERNEL32(?,00000E24,F573157E,00000000,00000000,00000000,00000000), ref: 00ECB608

Memory Dump Source

Source File: 00000001.00000002.3709959714.0000000000ECA000.00000040.00000800.00020000.00000000.sdmp, Offset: 00ECA000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_eca000_LisectAVT_2403002A_135.jbxd

Similarity

API ID: Value
String ID:
API String ID: 3702945584-0
Opcode ID: ec73be16ba6c117a55e8f4fd295972fc09378d4357a98768eef4dedc5a2bce39
Instruction ID: 3c4d72cef741ba5ee61d0d5dfcd084b2202d7b753dc447bd9e4722c0f20773b1
Opcode Fuzzy Hash: ec73be16ba6c117a55e8f4fd295972fc09378d4357a98768eef4dedc5a2bce39
Instruction Fuzzy Hash: 7421B0B25083806FD7228F11CD45F67BFB8EF16324F08849AE9859B252D365E909CBB1

Function 052A1732 Relevance: 1.6, APIs: 1, Instructions: 76COMMON

Download Yara Rule

APIs

ConvertStringSecurityDescriptorToSecurityDescriptorW.ADVAPI32(?,00000E24), ref: 052A17A3

Memory Dump Source

Source File: 00000001.00000002.3727425985.00000000052A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 052A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_52a0000_LisectAVT_2403002A_135.jbxd

Similarity

API ID: DescriptorSecurity$ConvertString
String ID:
API String ID: 3907675253-0
Opcode ID: cb6d1e993332ab6697140c20e74e3d8fc1736bb8234db5967d5f27c5e57111b7
Instruction ID: b94ff2a01032c6cb6bb754f6b1eba77199d1938d95d0a976c6406b02e466e22b
Opcode Fuzzy Hash: cb6d1e993332ab6697140c20e74e3d8fc1736bb8234db5967d5f27c5e57111b7
Instruction Fuzzy Hash: 1021D176604204AFEB21DF25DC45F6BBBECEF04724F04846AEA49CB241D774E918CBA5

Function 052A161A Relevance: 1.6, APIs: 1, Instructions: 76registryCOMMON

Download Yara Rule

APIs

RegQueryValueExW.KERNEL32(?,00000E24,F573157E,00000000,00000000,00000000,00000000), ref: 052A16B8

Memory Dump Source

Source File: 00000001.00000002.3727425985.00000000052A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 052A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_52a0000_LisectAVT_2403002A_135.jbxd

Similarity

API ID: QueryValue
String ID:
API String ID: 3660427363-0
Opcode ID: a4af4ced034faf25381951c8541747aaa3347661be80bbcd2fa2de5de60e6199
Instruction ID: 20d73d1f6eaec4534b018a8e5a1c651c63268298fad6c95d9f2854cb6b9eac6f
Opcode Fuzzy Hash: a4af4ced034faf25381951c8541747aaa3347661be80bbcd2fa2de5de60e6199
Instruction Fuzzy Hash: CD219F72508384AFD721CF51CC44F66BBF8EF45720F08849AE985CB192D365E508CB61

Function 00ECAA06 Relevance: 1.6, APIs: 1, Instructions: 76fileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32(?,?,?,?,?,?), ref: 00ECAA85

Memory Dump Source

Source File: 00000001.00000002.3709959714.0000000000ECA000.00000040.00000800.00020000.00000000.sdmp, Offset: 00ECA000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_eca000_LisectAVT_2403002A_135.jbxd

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: af9aabc3978e44a9e86c0d96adba7d07d0e3693fdb65e7e443460e2ed30f1a7c
Instruction ID: 445d7784d5eb0657381301f760ea10770e8a3008a29ba724b1777b1e621daa31
Opcode Fuzzy Hash: af9aabc3978e44a9e86c0d96adba7d07d0e3693fdb65e7e443460e2ed30f1a7c
Instruction Fuzzy Hash: BF21C471504204AFE720CF65CE45F66FBE8EF08328F08846DEA859B651E376E915CB72

Function 00ECB85E Relevance: 1.6, APIs: 1, Instructions: 74registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExW.KERNEL32(?,00000E24), ref: 00ECB8DD

Memory Dump Source

Source File: 00000001.00000002.3709959714.0000000000ECA000.00000040.00000800.00020000.00000000.sdmp, Offset: 00ECA000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_eca000_LisectAVT_2403002A_135.jbxd

Similarity

API ID: Open
String ID:
API String ID: 71445658-0
Opcode ID: 402d79f35a25c1b465d900440517125ba43b4baa43bdff94e2ff8f5ea2625498
Instruction ID: b78e446f5127d3965e4b260995945ea19fa6e62d4ae0125dcc7e4ec539b2700b
Opcode Fuzzy Hash: 402d79f35a25c1b465d900440517125ba43b4baa43bdff94e2ff8f5ea2625498
Instruction Fuzzy Hash: DA21CF72504204AEEB20CB11DC45FAAFBECEF14324F04845EEA459A652D335E9098BB1

Function 052A31C7 Relevance: 1.6, APIs: 1, Instructions: 73COMMON

Download Yara Rule

APIs

SetProcessWorkingSetSize.KERNEL32(?,00000E24,F573157E,00000000,00000000,00000000,00000000), ref: 052A3243

Memory Dump Source

Source File: 00000001.00000002.3727425985.00000000052A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 052A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_52a0000_LisectAVT_2403002A_135.jbxd

Similarity

API ID: ProcessSizeWorking
String ID:
API String ID: 3584180929-0
Opcode ID: 8624169071bec5b6304538a3423e4bc4afb9100a9d7c6b2b99143c97b0caae01
Instruction ID: 6cfdd529efb74606f5e7355ef5f5b94020d941042ff3dc78b3c605362060756d
Opcode Fuzzy Hash: 8624169071bec5b6304538a3423e4bc4afb9100a9d7c6b2b99143c97b0caae01
Instruction Fuzzy Hash: AB21D4715093846FD721CF61DC45F66BFA8EF45220F08C49FE985CB152D374A908CBA5

Function 00ECAC8E Relevance: 1.6, APIs: 1, Instructions: 73fileCOMMON

Download Yara Rule

APIs

ReadFile.KERNEL32(?,00000E24,F573157E,00000000,00000000,00000000,00000000), ref: 00ECAD0D

Memory Dump Source

Source File: 00000001.00000002.3709959714.0000000000ECA000.00000040.00000800.00020000.00000000.sdmp, Offset: 00ECA000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_eca000_LisectAVT_2403002A_135.jbxd

Similarity

API ID: FileRead
String ID:
API String ID: 2738559852-0
Opcode ID: aaf1e21b5d2628c9fd50a6dc27a4c5d459b11a64b02db66f5e2ce4a7cdee6c81
Instruction ID: 5ae12776e1339c034098e14e3a72e03a9401aca07256d71d4c591a2cac859b9f
Opcode Fuzzy Hash: aaf1e21b5d2628c9fd50a6dc27a4c5d459b11a64b02db66f5e2ce4a7cdee6c81
Instruction Fuzzy Hash: 7E21C271404344AFE7228F51DC44FA7BFA8EF45324F04849AE9859B552C275A909CBB5

Function 052A1B59 Relevance: 1.6, APIs: 1, Instructions: 72COMMON

Download Yara Rule

APIs

shutdown.WS2_32(?,00000E24,F573157E,00000000,00000000,00000000,00000000), ref: 052A1BDC

Memory Dump Source

Source File: 00000001.00000002.3727425985.00000000052A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 052A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_52a0000_LisectAVT_2403002A_135.jbxd

Similarity

API ID: shutdown
String ID:
API String ID: 2510479042-0
Opcode ID: b8b3ef5862f823ad007616950a2c79166beab745e87c091558c920da578e722c
Instruction ID: 0a1daf84b14109a114de0a53a4351a9fe3192840f4905dfcf5079d22c22bacec
Opcode Fuzzy Hash: b8b3ef5862f823ad007616950a2c79166beab745e87c091558c920da578e722c
Instruction Fuzzy Hash: 622192B2449384AFE712CF51DC45F66FFB8EF46224F0884DBE9849B152D368A548CB62

Function 00ECB756 Relevance: 1.6, APIs: 1, Instructions: 72synchronizationCOMMON

Download Yara Rule

APIs

CreateMutexW.KERNEL32(?,?), ref: 00ECB7C9

Memory Dump Source

Source File: 00000001.00000002.3709959714.0000000000ECA000.00000040.00000800.00020000.00000000.sdmp, Offset: 00ECA000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_eca000_LisectAVT_2403002A_135.jbxd

Similarity

API ID: CreateMutex
String ID:
API String ID: 1964310414-0
Opcode ID: 449b30b3b724432c82d364a4fb30280c51ff756a202fe524eb3dfd0ed545e8e5
Instruction ID: 71d54b469569a446940463fa8a0af2c553927938eb2edf1a83827a1e297c0986
Opcode Fuzzy Hash: 449b30b3b724432c82d364a4fb30280c51ff756a202fe524eb3dfd0ed545e8e5
Instruction Fuzzy Hash: B721AC715042409FE720DF25C946FA6BBE8EF44324F18C46EED859B241D376E8058B61

Function 052A354F Relevance: 1.6, APIs: 1, Instructions: 69COMMON

Download Yara Rule

APIs

ioctlsocket.WS2_32(?,00000E24,F573157E,00000000,00000000,00000000,00000000), ref: 052A35CB

Memory Dump Source

Source File: 00000001.00000002.3727425985.00000000052A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 052A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_52a0000_LisectAVT_2403002A_135.jbxd

Similarity

API ID: ioctlsocket
String ID:
API String ID: 3577187118-0
Opcode ID: 529a58303d5c23b416b3e8a7bc642bc3a17f3a7f5e40d482a35ea82f885a92bc
Instruction ID: ec13795f8ff24f9cd962f2c0c63c01ac65d92f5be4b5d041cece5f1d217d1c2e
Opcode Fuzzy Hash: 529a58303d5c23b416b3e8a7bc642bc3a17f3a7f5e40d482a35ea82f885a92bc
Instruction Fuzzy Hash: AC21A1714093846FD722CF51DC45FA6BFA8EF46224F08C49AE9849B152D375A508CBA5

Function 00ECBA2B Relevance: 1.6, APIs: 1, Instructions: 69COMMON

Download Yara Rule

APIs

SetFileAttributesW.KERNEL32(?,?,F573157E,00000000,?,?,?,?,?,?,?,?,6D343C58), ref: 00ECBAA7

Memory Dump Source

Source File: 00000001.00000002.3709959714.0000000000ECA000.00000040.00000800.00020000.00000000.sdmp, Offset: 00ECA000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_eca000_LisectAVT_2403002A_135.jbxd

Similarity

API ID: AttributesFile
String ID:
API String ID: 3188754299-0
Opcode ID: fe60319051ca15155be50adf9d6a0a79b28a8885024d3ee3dccbf86d5c27e0c6
Instruction ID: 63fcf9b72d91b5d1a761a1b65757aeaf615170d9207b24eb0535a92431c1455f
Opcode Fuzzy Hash: fe60319051ca15155be50adf9d6a0a79b28a8885024d3ee3dccbf86d5c27e0c6
Instruction Fuzzy Hash: FB21DE755083C45FDB12CB25DC91B92BFE8EF06324F0884EAE885CF263D2259909CB61

Function 00ECB4A2 Relevance: 1.6, APIs: 1, Instructions: 69registryCOMMON

Download Yara Rule

APIs

RegQueryValueExW.KERNEL32(?,00000E24,F573157E,00000000,00000000,00000000,00000000), ref: 00ECB51C

Memory Dump Source

Source File: 00000001.00000002.3709959714.0000000000ECA000.00000040.00000800.00020000.00000000.sdmp, Offset: 00ECA000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_eca000_LisectAVT_2403002A_135.jbxd

Similarity

API ID: QueryValue
String ID:
API String ID: 3660427363-0
Opcode ID: 54cf55e383cb4ab880f5ee26cdbc0f30a82a31d835e616274526d239a993bb09
Instruction ID: b7155ed000f70d7bd6dd0741d54e038a671a03e1552fc23660489dc4589b6354
Opcode Fuzzy Hash: 54cf55e383cb4ab880f5ee26cdbc0f30a82a31d835e616274526d239a993bb09
Instruction Fuzzy Hash: 8A21AE71604604AFE720CF15CD85F66B7ECEF04724F04C45AEA459B252D365E909CB71

Function 052A1306 Relevance: 1.6, APIs: 1, Instructions: 67networkCOMMON

Download Yara Rule

APIs

WSASocketW.WS2_32(?,?,?,?,?), ref: 052A1372

Memory Dump Source

Source File: 00000001.00000002.3727425985.00000000052A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 052A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_52a0000_LisectAVT_2403002A_135.jbxd

Similarity

API ID: Socket
String ID:
API String ID: 38366605-0
Opcode ID: d521986247d1dc18e546837c8540c6a5f487ef4fd4a742ab711db8d3c1de4291
Instruction ID: db6833bca831994e8ae71e94e4848583eddbbc7f24167ba6479f4fc786042088
Opcode Fuzzy Hash: d521986247d1dc18e546837c8540c6a5f487ef4fd4a742ab711db8d3c1de4291
Instruction Fuzzy Hash: A221C371904600AFEB21DF55DC45F66FBE8EF04324F04C85EEE858B652D375A419CBA1

Function 052A18E2 Relevance: 1.6, APIs: 1, Instructions: 67fileCOMMON

Download Yara Rule

APIs

MapViewOfFile.KERNEL32 ref: 052A1956

Memory Dump Source

Source File: 00000001.00000002.3727425985.00000000052A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 052A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_52a0000_LisectAVT_2403002A_135.jbxd

Similarity

API ID: FileView
String ID:
API String ID: 3314676101-0
Opcode ID: 84ab928819845b4049348a937ba48d4f5b874e7afabf8ce4d59e2d2e1497c9cd
Instruction ID: 40e8458387c9719a564750ffbee6780b6d32d0893ae8c47024c4efc1cb47bb9e
Opcode Fuzzy Hash: 84ab928819845b4049348a937ba48d4f5b874e7afabf8ce4d59e2d2e1497c9cd
Instruction Fuzzy Hash: 3821C072504204AFEB21CF55DC85F66FBE8EF08324F04C45EEA898B651D375A518CBA1

Function 052A1FF2 Relevance: 1.6, APIs: 1, Instructions: 67networkCOMMON

Download Yara Rule

APIs

WSAConnect.WS2_32(?,?,?,?,?,?,?), ref: 052A206E

Memory Dump Source

Source File: 00000001.00000002.3727425985.00000000052A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 052A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_52a0000_LisectAVT_2403002A_135.jbxd

Similarity

API ID: Connect
String ID:
API String ID: 3144859779-0
Opcode ID: f0105361642b436697fedec9ab3ed08468f8cd3967736477a9fe92b19f3a95ed
Instruction ID: aa12ef019242c522325b2c8a24c4a3eae5e9e5050eea7bd828b53df8ff4af5c8
Opcode Fuzzy Hash: f0105361642b436697fedec9ab3ed08468f8cd3967736477a9fe92b19f3a95ed
Instruction Fuzzy Hash: 19219275408384AFDB228F51DC44B62BFF8EF06310F0884DEE9858B163D375A819DB61

Function 052A2456 Relevance: 1.6, APIs: 1, Instructions: 66libraryCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(?,00000E24), ref: 052A24DF

Memory Dump Source

Source File: 00000001.00000002.3727425985.00000000052A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 052A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_52a0000_LisectAVT_2403002A_135.jbxd

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: d216a4578da0c7ba7b0f9ad4dc9acedd00ed1c7765dfbc4e168eb0ead74d8693
Instruction ID: a9bba5fb17273abbd45c2d52dc64c5fc02c8c12dd9aa52a5a6aff76cb9e5a4a5
Opcode Fuzzy Hash: d216a4578da0c7ba7b0f9ad4dc9acedd00ed1c7765dfbc4e168eb0ead74d8693
Instruction Fuzzy Hash: EA11E971548340AFE721CF11DC85FA6FFB8EF45720F04809AF9445B192D3B4A948CB65

Function 00ECB966 Relevance: 1.6, APIs: 1, Instructions: 66windowtimeCOMMON

Download Yara Rule

APIs

SendMessageTimeoutA.USER32(?,00000E24), ref: 00ECB9E1

Memory Dump Source

Source File: 00000001.00000002.3709959714.0000000000ECA000.00000040.00000800.00020000.00000000.sdmp, Offset: 00ECA000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_eca000_LisectAVT_2403002A_135.jbxd

Similarity

API ID: MessageSendTimeout
String ID:
API String ID: 1599653421-0
Opcode ID: 1c537a6da404cb52064d169618b2a121c43429c143e25750a5c429faab9bf5ee
Instruction ID: 70cf0c13c86a054fa40decf06b9f58086864389819142bccb9a5db81dd0c9b43
Opcode Fuzzy Hash: 1c537a6da404cb52064d169618b2a121c43429c143e25750a5c429faab9bf5ee
Instruction Fuzzy Hash: 94212171004200AFEB21CF51CC41FA6FBE8EF04324F14C85EEE855A291D376A419DBB1

Function 00ECB0B8 Relevance: 1.6, APIs: 1, Instructions: 66fileCOMMON

Download Yara Rule

APIs

CopyFileW.KERNEL32(?,?,?,F573157E,00000000,?,?,?,?,?,?,?,?,6D343C58), ref: 00ECB126

Memory Dump Source

Source File: 00000001.00000002.3709959714.0000000000ECA000.00000040.00000800.00020000.00000000.sdmp, Offset: 00ECA000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_eca000_LisectAVT_2403002A_135.jbxd

Similarity

API ID: CopyFile
String ID:
API String ID: 1304948518-0
Opcode ID: 6807a909945af00af35ece36c56ef7b0d6bc4524b25f5f662835b4df8ef00afc
Instruction ID: fe56407f5400357d607707cc5de8ceb2a410d8438142309f0e6a5cdf277c89ce
Opcode Fuzzy Hash: 6807a909945af00af35ece36c56ef7b0d6bc4524b25f5f662835b4df8ef00afc
Instruction Fuzzy Hash: EF2181715093805FD711CF65DD55B56BFE8EF06220F0C84AEE845DB262D225E805CB61

Function 052A1646 Relevance: 1.6, APIs: 1, Instructions: 65registryCOMMON

Download Yara Rule

APIs

RegQueryValueExW.KERNEL32(?,00000E24,F573157E,00000000,00000000,00000000,00000000), ref: 052A16B8

Memory Dump Source

Source File: 00000001.00000002.3727425985.00000000052A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 052A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_52a0000_LisectAVT_2403002A_135.jbxd

Similarity

API ID: QueryValue
String ID:
API String ID: 3660427363-0
Opcode ID: 4343ffaef34c4f19f34a779563dd92b0a7e2834b0a912a42ca9cd93db3463772
Instruction ID: 45a7612ea42d734d3abd73bc86917f5202dfd8fc7d0f1cb9a4a36452e30eed2c
Opcode Fuzzy Hash: 4343ffaef34c4f19f34a779563dd92b0a7e2834b0a912a42ca9cd93db3463772
Instruction Fuzzy Hash: 0511AC72604604AFEB20CF55CC44F66BBECEF44B24F08C55AEA86CA691D774E514CBB1

Function 00ECB181 Relevance: 1.6, APIs: 1, Instructions: 65COMMON

Download Yara Rule

APIs

LookupPrivilegeValueW.ADVAPI32(?,?,?), ref: 00ECB1EE

Memory Dump Source

Source File: 00000001.00000002.3709959714.0000000000ECA000.00000040.00000800.00020000.00000000.sdmp, Offset: 00ECA000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_eca000_LisectAVT_2403002A_135.jbxd

Similarity

API ID: LookupPrivilegeValue
String ID:
API String ID: 3899507212-0
Opcode ID: fb9dff26d6a678e4e1fc9d74e437662d704cc975f9a131b51d75fd63de9456f9
Instruction ID: d6fbcc43cf9b39eeaac8db272bc3120a64b1c697311f52041fd67e474e7519e4
Opcode Fuzzy Hash: fb9dff26d6a678e4e1fc9d74e437662d704cc975f9a131b51d75fd63de9456f9
Instruction Fuzzy Hash: 9411BEB26053809FEB21CF25DD45B62BFE8EF05324F0884AEED45DB252D325E808CB61

Function 00ECB596 Relevance: 1.6, APIs: 1, Instructions: 65registryCOMMON

Download Yara Rule

APIs

RegSetValueExW.KERNEL32(?,00000E24,F573157E,00000000,00000000,00000000,00000000), ref: 00ECB608

Memory Dump Source

Source File: 00000001.00000002.3709959714.0000000000ECA000.00000040.00000800.00020000.00000000.sdmp, Offset: 00ECA000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_eca000_LisectAVT_2403002A_135.jbxd

Similarity

API ID: Value
String ID:
API String ID: 3702945584-0
Opcode ID: 7e3f75a098dd9998cc386dcf6d96e2c35137d50175eef9388a1e0b2ce5419f5f
Instruction ID: 4a0e627226b295a5dcb6e62a923844e70665e8c3cacad5527c7368e84e1b3e40
Opcode Fuzzy Hash: 7e3f75a098dd9998cc386dcf6d96e2c35137d50175eef9388a1e0b2ce5419f5f
Instruction Fuzzy Hash: 3611EEB1604600AFEB208F11CD42F66FBECEF14324F04C05AEA819A641D375E8058AB1

Function 052A027F Relevance: 1.6, APIs: 1, Instructions: 63COMMON

Download Yara Rule

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?), ref: 052A02F2

Memory Dump Source

Source File: 00000001.00000002.3727425985.00000000052A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 052A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_52a0000_LisectAVT_2403002A_135.jbxd

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: 89b9caf043e64b06f2914e674eeee2c2c7a30b18cda3552e6ffb7dd2030a2295
Instruction ID: 69e93dcc37adc67cb979b14c2894c8f5592c7a55d7280382db16f10746adf27e
Opcode Fuzzy Hash: 89b9caf043e64b06f2914e674eeee2c2c7a30b18cda3552e6ffb7dd2030a2295
Instruction Fuzzy Hash: 2D2151724097C0AFDB228F51DC54A62FFF4EF4A310F0885DAE9858B163C276A519DB61

Function 052A31EA Relevance: 1.6, APIs: 1, Instructions: 62COMMON

Download Yara Rule

APIs

SetProcessWorkingSetSize.KERNEL32(?,00000E24,F573157E,00000000,00000000,00000000,00000000), ref: 052A3243

Memory Dump Source

Source File: 00000001.00000002.3727425985.00000000052A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 052A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_52a0000_LisectAVT_2403002A_135.jbxd

Similarity

API ID: ProcessSizeWorking
String ID:
API String ID: 3584180929-0
Opcode ID: c1af54ec5f9b13a1850e02d5ebe2e2dd22254a257d7d7611d72f8c40f99e4776
Instruction ID: f441a17aa4f4f0d632b745882105050485418e673f525ac163dde2e1b41e1f2b
Opcode Fuzzy Hash: c1af54ec5f9b13a1850e02d5ebe2e2dd22254a257d7d7611d72f8c40f99e4776
Instruction Fuzzy Hash: C111C172504204AFEB20CF55DC45F6ABBE8EF54324F04C86AEA458B641E374A9048BB5

Function 00ECA5D5 Relevance: 1.6, APIs: 1, Instructions: 61COMMON

Download Yara Rule

APIs

FindCloseChangeNotification.KERNEL32(?,F573157E,00000000,?,?,?,?,?,?,?,?,6D343C58), ref: 00ECA638

Memory Dump Source

Source File: 00000001.00000002.3709959714.0000000000ECA000.00000040.00000800.00020000.00000000.sdmp, Offset: 00ECA000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_eca000_LisectAVT_2403002A_135.jbxd

Similarity

API ID: ChangeCloseFindNotification
String ID:
API String ID: 2591292051-0
Opcode ID: dd0329fd489bde021c98b6cc2ecd5b824f3710581e8e570e2b88ea96baef7fbd
Instruction ID: 9349b8f68a690d2b089ceaa685470fa7644b9029f14e6d2ba8e911407b63c7d6
Opcode Fuzzy Hash: dd0329fd489bde021c98b6cc2ecd5b824f3710581e8e570e2b88ea96baef7fbd
Instruction Fuzzy Hash: E911BEB54093809FD7128F25DC45B52BFB8EF02324F0884EFEC45CB263C265A948CB62

Function 052A08CC Relevance: 1.6, APIs: 1, Instructions: 60COMMON

Download Yara Rule

APIs

K32EnumProcesses.KERNEL32(?,?,?,F573157E,00000000,?,?,?,?,?,?,?,?,6D343C58), ref: 052A092E

Memory Dump Source

Source File: 00000001.00000002.3727425985.00000000052A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 052A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_52a0000_LisectAVT_2403002A_135.jbxd

Similarity

API ID: EnumProcesses
String ID:
API String ID: 84517404-0
Opcode ID: 7fbd4918e2dde10d421940d847bf9a9bf8815f02e579d7d1cb1b9a5e887683d7
Instruction ID: c66e53ace85fc69ce33a1025b057a7bee286405399001a9fc9dff3b8af6f891d
Opcode Fuzzy Hash: 7fbd4918e2dde10d421940d847bf9a9bf8815f02e579d7d1cb1b9a5e887683d7
Instruction Fuzzy Hash: 2D11B4725093809FD711CF65DC85B52FFE8EF05320F0884AEE949CB162D235E908CB61

Function 00ECACAE Relevance: 1.6, APIs: 1, Instructions: 60fileCOMMON

Download Yara Rule

APIs

ReadFile.KERNEL32(?,00000E24,F573157E,00000000,00000000,00000000,00000000), ref: 00ECAD0D

Memory Dump Source

Source File: 00000001.00000002.3709959714.0000000000ECA000.00000040.00000800.00020000.00000000.sdmp, Offset: 00ECA000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_eca000_LisectAVT_2403002A_135.jbxd

Similarity

API ID: FileRead
String ID:
API String ID: 2738559852-0
Opcode ID: 4e90a98d34d17e050aa8ecd7dd5d1d19d9f84dedbd0d1db18b422731deced1f5
Instruction ID: d642f6b6b35202bc5e76cd072084deb5407874e8d9476dffa1f23e394263df87
Opcode Fuzzy Hash: 4e90a98d34d17e050aa8ecd7dd5d1d19d9f84dedbd0d1db18b422731deced1f5
Instruction Fuzzy Hash: E5110171404204AFEB21CF51DD40FA6FBE8EF44328F08C46EEA869B651C375A505CBB6

Function 052A3572 Relevance: 1.6, APIs: 1, Instructions: 58COMMON

Download Yara Rule

APIs

ioctlsocket.WS2_32(?,00000E24,F573157E,00000000,00000000,00000000,00000000), ref: 052A35CB

Memory Dump Source

Source File: 00000001.00000002.3727425985.00000000052A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 052A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_52a0000_LisectAVT_2403002A_135.jbxd

Similarity

API ID: ioctlsocket
String ID:
API String ID: 3577187118-0
Opcode ID: 2bc3468cc83c1d4ac1d68f5075b12622c9f6434bd842c260766ea775211c61fb
Instruction ID: e5444380f29b4b844eb30a62171b36b79515abcd8a229530ba6a0690b8419836
Opcode Fuzzy Hash: 2bc3468cc83c1d4ac1d68f5075b12622c9f6434bd842c260766ea775211c61fb
Instruction Fuzzy Hash: 7F110272504204AFEB20CF55DC85FA6FBE8EF54724F04C86AEE498B241D375A504CBB5

Function 052A1B86 Relevance: 1.6, APIs: 1, Instructions: 57COMMON

Download Yara Rule

APIs

shutdown.WS2_32(?,00000E24,F573157E,00000000,00000000,00000000,00000000), ref: 052A1BDC

Memory Dump Source

Source File: 00000001.00000002.3727425985.00000000052A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 052A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_52a0000_LisectAVT_2403002A_135.jbxd

Similarity

API ID: shutdown
String ID:
API String ID: 2510479042-0
Opcode ID: 49a8678731f6cb14681036fbd753b77f36d49f2cea53b48abebcde8a896b8133
Instruction ID: 351c2e044831d9eee070ed53a57f2ee10a84760f9b72061270a52e9549181a4c
Opcode Fuzzy Hash: 49a8678731f6cb14681036fbd753b77f36d49f2cea53b48abebcde8a896b8133
Instruction Fuzzy Hash: 2B11C272504204AFEB10CF15DC45F66BBE8EF44324F04C49AEE459B241D374A514CBB6

Function 052A2476 Relevance: 1.6, APIs: 1, Instructions: 56libraryCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(?,00000E24), ref: 052A24DF

Memory Dump Source

Source File: 00000001.00000002.3727425985.00000000052A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 052A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_52a0000_LisectAVT_2403002A_135.jbxd

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: 99389f381d533293f2e3d05ed7d4546cae570ef4a1e9d6b20c01b4473a344239
Instruction ID: ba4cbc59f99130ffde55307657efd5a67904ffc1cc628ef0f5f3250b3577f59f
Opcode Fuzzy Hash: 99389f381d533293f2e3d05ed7d4546cae570ef4a1e9d6b20c01b4473a344239
Instruction Fuzzy Hash: B811E575514200AFE720DF15DC41FB6F7A8EF44724F14C09AEE455A681D3B4A5488AA5

Function 052A364E Relevance: 1.6, APIs: 1, Instructions: 55COMMON

Download Yara Rule

APIs

select.WS2_32(?,?,?,?,?), ref: 052A36A4

Memory Dump Source

Source File: 00000001.00000002.3727425985.00000000052A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 052A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_52a0000_LisectAVT_2403002A_135.jbxd

Similarity

API ID: select
String ID:
API String ID: 1274211008-0
Opcode ID: bbd08c4322a8bd7f5c98996e6d86ff55456e7f0cedc654e05a21c4e88ff4f55f
Instruction ID: 57329ec89d6b5745a4865a610bcc942ab8127a994667b6e263be1fa7bc4b3b67
Opcode Fuzzy Hash: bbd08c4322a8bd7f5c98996e6d86ff55456e7f0cedc654e05a21c4e88ff4f55f
Instruction Fuzzy Hash: 87116A766146049FDB20CF56D884F62FBE8EF54B20F08C8AADD49CB252D375E504CB65

Function 052A049B Relevance: 1.6, APIs: 1, Instructions: 54comCOMMON

Download Yara Rule

APIs

OleInitialize.OLE32(?), ref: 052A04FC

Memory Dump Source

Source File: 00000001.00000002.3727425985.00000000052A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 052A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_52a0000_LisectAVT_2403002A_135.jbxd

Similarity

API ID: Initialize
String ID:
API String ID: 2538663250-0
Opcode ID: 7d25aeec645e54172e593112ebdc6dc64086563fe4bf3f5b71bcb8a7b6c562be
Instruction ID: 87478a2523e9c08399383efe32841cd9b801cf6088f12ddf00529cff8308b77b
Opcode Fuzzy Hash: 7d25aeec645e54172e593112ebdc6dc64086563fe4bf3f5b71bcb8a7b6c562be
Instruction Fuzzy Hash: A0116D714493849FDB12CF15DC59B52BFB4EF46224F0884DAED898B293D275A908CB62

Function 00ECA078 Relevance: 1.6, APIs: 1, Instructions: 54networkCOMMON

Download Yara Rule

APIs

send.WS2_32(?,?,?,?), ref: 00ECA0D5

Memory Dump Source

Source File: 00000001.00000002.3709959714.0000000000ECA000.00000040.00000800.00020000.00000000.sdmp, Offset: 00ECA000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_eca000_LisectAVT_2403002A_135.jbxd

Similarity

API ID: send
String ID:
API String ID: 2809346765-0
Opcode ID: d09fd2cfb9e0b796ed3419d8e74267f28085764735fe0c9dff41ab1ff739b8da
Instruction ID: 423d60f4b261e73caab8d115c7d7f6c04f970a253f4e18313da4abf30354392d
Opcode Fuzzy Hash: d09fd2cfb9e0b796ed3419d8e74267f28085764735fe0c9dff41ab1ff739b8da
Instruction Fuzzy Hash: 9911BF75409380AFDB22CF51DD44B52FFB4EF46224F08849EED848B152C276A918DB62

Function 00ECB0DE Relevance: 1.6, APIs: 1, Instructions: 53fileCOMMON

Download Yara Rule

APIs

CopyFileW.KERNEL32(?,?,?,F573157E,00000000,?,?,?,?,?,?,?,?,6D343C58), ref: 00ECB126

Memory Dump Source

Source File: 00000001.00000002.3709959714.0000000000ECA000.00000040.00000800.00020000.00000000.sdmp, Offset: 00ECA000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_eca000_LisectAVT_2403002A_135.jbxd

Similarity

API ID: CopyFile
String ID:
API String ID: 1304948518-0
Opcode ID: 7598ca122f9a78dd5e2a0c2a3566b711b2b1842ebb8509f12488103956c9ca40
Instruction ID: 8cc115840a0a77a6a7deeebee241b27c7b305223043913407936d38e9a061e25
Opcode Fuzzy Hash: 7598ca122f9a78dd5e2a0c2a3566b711b2b1842ebb8509f12488103956c9ca40
Instruction Fuzzy Hash: 0511A171A052408FEB50CF29D986B56FBE8EF04724F0CC4AEED49DB252D376E815CA61

Function 00ECB1A6 Relevance: 1.6, APIs: 1, Instructions: 53COMMON

Download Yara Rule

APIs

LookupPrivilegeValueW.ADVAPI32(?,?,?), ref: 00ECB1EE

Memory Dump Source

Source File: 00000001.00000002.3709959714.0000000000ECA000.00000040.00000800.00020000.00000000.sdmp, Offset: 00ECA000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_eca000_LisectAVT_2403002A_135.jbxd

Similarity

API ID: LookupPrivilegeValue
String ID:
API String ID: 3899507212-0
Opcode ID: 7598ca122f9a78dd5e2a0c2a3566b711b2b1842ebb8509f12488103956c9ca40
Instruction ID: 620f0fc7219d6a08b394c93be9ceb391e441273e0ff3882a72344c348ccc4c08
Opcode Fuzzy Hash: 7598ca122f9a78dd5e2a0c2a3566b711b2b1842ebb8509f12488103956c9ca40
Instruction Fuzzy Hash: D511E571A042008FEB10CF2AD946B56FBD8EF04324F08C4AEDD45DB251D335D804CB61

Function 00ECAF5C Relevance: 1.6, APIs: 1, Instructions: 52COMMON

Download Yara Rule

APIs

FindClose.KERNEL32(?,F573157E,00000000,?,?,?,?,?,?,?,?,6D343C58), ref: 00ECAFB0

Memory Dump Source

Source File: 00000001.00000002.3709959714.0000000000ECA000.00000040.00000800.00020000.00000000.sdmp, Offset: 00ECA000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_eca000_LisectAVT_2403002A_135.jbxd

Similarity

API ID: CloseFind
String ID:
API String ID: 1863332320-0
Opcode ID: 6af5c379c19934a222bb57ec5541fa693bda0deded35cce11679b58fa29cebda
Instruction ID: 44e0fa88d99bb58ca6ad8e816218d0c85beea8e361c1e644c27d880ad61750cc
Opcode Fuzzy Hash: 6af5c379c19934a222bb57ec5541fa693bda0deded35cce11679b58fa29cebda
Instruction Fuzzy Hash: CE11E1715093C49FCB128F25DD85B52FFB4DF06224F0880EEED858B2A3D275A909CB62

Function 00ECAB1E Relevance: 1.6, APIs: 1, Instructions: 52COMMON

Download Yara Rule

APIs

GetFileType.KERNEL32(?,00000E24,F573157E,00000000,00000000,00000000,00000000), ref: 00ECAB71

Memory Dump Source

Source File: 00000001.00000002.3709959714.0000000000ECA000.00000040.00000800.00020000.00000000.sdmp, Offset: 00ECA000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_eca000_LisectAVT_2403002A_135.jbxd

Similarity

API ID: FileType
String ID:
API String ID: 3081899298-0
Opcode ID: 4256cf27cad20d300dd6869e1a747b1c4638d7c5cd03f260e7d89bb90f62064d
Instruction ID: 4b4ef062599c503f9284da15879b778f76db941a7862e76cb4407f3a6c1b823f
Opcode Fuzzy Hash: 4256cf27cad20d300dd6869e1a747b1c4638d7c5cd03f260e7d89bb90f62064d
Instruction Fuzzy Hash: DE012671504704AEE720CF15DD85FB6F7E8DF04328F18C0AAEE459B241D375A9058BB6

Function 052A2022 Relevance: 1.5, APIs: 1, Instructions: 49networkCOMMON

Download Yara Rule

APIs

WSAConnect.WS2_32(?,?,?,?,?,?,?), ref: 052A206E

Memory Dump Source

Source File: 00000001.00000002.3727425985.00000000052A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 052A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_52a0000_LisectAVT_2403002A_135.jbxd

Similarity

API ID: Connect
String ID:
API String ID: 3144859779-0
Opcode ID: 9be91310b5ebeb3bb0b4d012821a8bd717b6b2019f378f05a3c67352d98159fe
Instruction ID: f62d0bb9d4a4a7049cc954a8aad4b5044e294b7844a3843659fea2b5c6e9cc3a
Opcode Fuzzy Hash: 9be91310b5ebeb3bb0b4d012821a8bd717b6b2019f378f05a3c67352d98159fe
Instruction Fuzzy Hash: 8A115A36514604DFDB20CF55D844B62FBE5EF48320F08C4AADE8A8B622D376E418DB62

Function 052A08EE Relevance: 1.5, APIs: 1, Instructions: 49COMMON

Download Yara Rule

APIs

K32EnumProcesses.KERNEL32(?,?,?,F573157E,00000000,?,?,?,?,?,?,?,?,6D343C58), ref: 052A092E

Memory Dump Source

Source File: 00000001.00000002.3727425985.00000000052A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 052A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_52a0000_LisectAVT_2403002A_135.jbxd

Similarity

API ID: EnumProcesses
String ID:
API String ID: 84517404-0
Opcode ID: 7a2eee567425ed24078e904b405dbf4dba9d9a7097da476502b9b08acf25365f
Instruction ID: ec737ef98f0392ab001b8f621ad10c5aedeca51d357c0ad08876bc414453e112
Opcode Fuzzy Hash: 7a2eee567425ed24078e904b405dbf4dba9d9a7097da476502b9b08acf25365f
Instruction Fuzzy Hash: 6311E1326042018FEB10CF65D888B62FBE8EF04720F08C4AADD498B251D375E404CB61

Function 00ECBA6A Relevance: 1.5, APIs: 1, Instructions: 48COMMON

Download Yara Rule

APIs

SetFileAttributesW.KERNEL32(?,?,F573157E,00000000,?,?,?,?,?,?,?,?,6D343C58), ref: 00ECBAA7

Memory Dump Source

Source File: 00000001.00000002.3709959714.0000000000ECA000.00000040.00000800.00020000.00000000.sdmp, Offset: 00ECA000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_eca000_LisectAVT_2403002A_135.jbxd

Similarity

API ID: AttributesFile
String ID:
API String ID: 3188754299-0
Opcode ID: ff6350300743174af93b5ae375deb505348287aa2f9436a8b784818bda566b77
Instruction ID: bab65fc47aad6588482bf5ea2ce22c1e4f1df297dfc30e9c9b7363b8396f0bb2
Opcode Fuzzy Hash: ff6350300743174af93b5ae375deb505348287aa2f9436a8b784818bda566b77
Instruction Fuzzy Hash: A801D271A042408FDB10CF2AD986B56FBD8EF04324F08C4AEDD85DB242D376D814DAA1

Function 052A21EA Relevance: 1.5, APIs: 1, Instructions: 47COMMON

Download Yara Rule

APIs

GetVolumeInformationA.KERNEL32(?,00000E24,?,?), ref: 052A223A

Memory Dump Source

Source File: 00000001.00000002.3727425985.00000000052A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 052A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_52a0000_LisectAVT_2403002A_135.jbxd

Similarity

API ID: InformationVolume
String ID:
API String ID: 2039140958-0
Opcode ID: 4a32503d925a5db96a7e85166298849695fd5c772f1bca94149b80bc204d767a
Instruction ID: 67f711f70f3f33972bba6cd1ddb05a1322942ffd24f769e70ebaba45c35afe47
Opcode Fuzzy Hash: 4a32503d925a5db96a7e85166298849695fd5c772f1bca94149b80bc204d767a
Instruction Fuzzy Hash: 5B017171900200AFD310DF16DC46B66FBE8EB88A20F14855AED499B642D731F915CBE5

Function 00ECA172 Relevance: 1.5, APIs: 1, Instructions: 47COMMON

Download Yara Rule

APIs

EnumWindows.USER32(?,00000E24,?,?), ref: 00ECA1BD

Memory Dump Source

Source File: 00000001.00000002.3709959714.0000000000ECA000.00000040.00000800.00020000.00000000.sdmp, Offset: 00ECA000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_eca000_LisectAVT_2403002A_135.jbxd

Similarity

API ID: EnumWindows
String ID:
API String ID: 1129996299-0
Opcode ID: af30b629621988b8f5cb3dcc657d5868a0deb17727ebfd7742349a97c28ab9d8
Instruction ID: 10bc7c44e0b93e121303337dac47036957a53efbba83a709628560a6c80f872b
Opcode Fuzzy Hash: af30b629621988b8f5cb3dcc657d5868a0deb17727ebfd7742349a97c28ab9d8
Instruction Fuzzy Hash: 1C018471900200AFD710DF16DC46B66FBE8FB88A20F14855AED489B742D735F915CBE5

Function 052A02AE Relevance: 1.5, APIs: 1, Instructions: 45COMMON

Download Yara Rule

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?), ref: 052A02F2

Memory Dump Source

Source File: 00000001.00000002.3727425985.00000000052A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 052A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_52a0000_LisectAVT_2403002A_135.jbxd

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: f39063eddf0aa6696758f92d0b478858fea50892a1cdad3b674ef04aa7fa9c18
Instruction ID: 7ec9b31b66855caf16bdc95c5952c91d77d022998b8053bda83bb039001b3a76
Opcode Fuzzy Hash: f39063eddf0aa6696758f92d0b478858fea50892a1cdad3b674ef04aa7fa9c18
Instruction Fuzzy Hash: BC016D328147409FDB21CF95D944B66FFE5EF48320F08C89ADE894A652D376E424DF62

Function 052A3822 Relevance: 1.5, APIs: 1, Instructions: 43registryCOMMON

Download Yara Rule

APIs

RegEnumValueW.KERNEL32(?,00000E24,?,?), ref: 052A3872

Memory Dump Source

Source File: 00000001.00000002.3727425985.00000000052A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 052A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_52a0000_LisectAVT_2403002A_135.jbxd

Similarity

API ID: EnumValue
String ID:
API String ID: 2814608202-0
Opcode ID: 2fbecb5326862f19db53b2be1fbb39e1a660b0211c6f5e035ac2a0f423343d57
Instruction ID: 8fbbd3932d7780ad8fbfc93eecf5a471105c9dfa12b3b83bf2b494d4c81593e9
Opcode Fuzzy Hash: 2fbecb5326862f19db53b2be1fbb39e1a660b0211c6f5e035ac2a0f423343d57
Instruction Fuzzy Hash: 3C016271640200ABD250DF16DC46B26FBE8FB88A20F14815AED495BB42D771FA15CBE5

Function 052A126A Relevance: 1.5, APIs: 1, Instructions: 43registryCOMMON

Download Yara Rule

APIs

RegQueryValueExW.KERNEL32(?,00000E24,?,?), ref: 052A12BA

Memory Dump Source

Source File: 00000001.00000002.3727425985.00000000052A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 052A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_52a0000_LisectAVT_2403002A_135.jbxd

Similarity

API ID: QueryValue
String ID:
API String ID: 3660427363-0
Opcode ID: 0fee123a9342ac0b98e4cc80f16312b543c249a86fb923b49ff4391a452924d8
Instruction ID: 05273554f2e6181d6f611186cdaffde5ed254b183dba9ed35db4a5c0490dca5c
Opcode Fuzzy Hash: 0fee123a9342ac0b98e4cc80f16312b543c249a86fb923b49ff4391a452924d8
Instruction Fuzzy Hash: 60016271640200ABD210DF16DC46B26FBE8FB88A20F14815AED495BB42D771F915CBE5

Function 052A0BDE Relevance: 1.5, APIs: 1, Instructions: 43COMMON

Download Yara Rule

APIs

MkParseDisplayName.OLE32(?,00000E24,?,?), ref: 052A0C2E

Memory Dump Source

Source File: 00000001.00000002.3727425985.00000000052A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 052A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_52a0000_LisectAVT_2403002A_135.jbxd

Similarity

API ID: DisplayNameParse
String ID:
API String ID: 3580041360-0
Opcode ID: 663cfa6e07bcb2d9b1594ecf834c8ee9be8f1813f4868896b0904fa21d05e53a
Instruction ID: c1d359a274f897765e7668c4af394944d946b4386240a531c2d54413df79d5f9
Opcode Fuzzy Hash: 663cfa6e07bcb2d9b1594ecf834c8ee9be8f1813f4868896b0904fa21d05e53a
Instruction Fuzzy Hash: D1016271640200ABD250DF16DC46B26FBE8FB88A20F14815AED485BB42D771F915CBE5

Function 00ECA606 Relevance: 1.5, APIs: 1, Instructions: 43COMMON

Download Yara Rule

APIs

FindCloseChangeNotification.KERNEL32(?,F573157E,00000000,?,?,?,?,?,?,?,?,6D343C58), ref: 00ECA638

Memory Dump Source

Source File: 00000001.00000002.3709959714.0000000000ECA000.00000040.00000800.00020000.00000000.sdmp, Offset: 00ECA000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_eca000_LisectAVT_2403002A_135.jbxd

Similarity

API ID: ChangeCloseFindNotification
String ID:
API String ID: 2591292051-0
Opcode ID: c6f7bb8f9fb2bd9774124d54bc3a581667f8afcbb429337172ddfb2c2b17bbd8
Instruction ID: 489be387d07f8650a402b4b1e9f5206b1a894cded3f72cee9b0c86e679798747
Opcode Fuzzy Hash: c6f7bb8f9fb2bd9774124d54bc3a581667f8afcbb429337172ddfb2c2b17bbd8
Instruction Fuzzy Hash: CE01DF749052448FDB10CF25D985BA6FBE4DF00328F1CC4AEDD4A8B252D27AA914DBA2

Function 00ECA09A Relevance: 1.5, APIs: 1, Instructions: 42networkCOMMON

Download Yara Rule

APIs

send.WS2_32(?,?,?,?), ref: 00ECA0D5

Memory Dump Source

Source File: 00000001.00000002.3709959714.0000000000ECA000.00000040.00000800.00020000.00000000.sdmp, Offset: 00ECA000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_eca000_LisectAVT_2403002A_135.jbxd

Similarity

API ID: send
String ID:
API String ID: 2809346765-0
Opcode ID: 52a73b9b739f157de8e875c810b956291c6bdef76cc176a3ce9372a10a3e0e59
Instruction ID: 0bb32bf1acda5c8e3fe6271d6cebbf9b3bc2480e4bf2df9e68c7b64334564112
Opcode Fuzzy Hash: 52a73b9b739f157de8e875c810b956291c6bdef76cc176a3ce9372a10a3e0e59
Instruction Fuzzy Hash: 6C01FC718046448FDB20CF55D985B62FBE0EF04328F0CC4AEDE898B212D376A418DBA2

Function 052A04CA Relevance: 1.5, APIs: 1, Instructions: 39comCOMMON

Download Yara Rule

APIs

OleInitialize.OLE32(?), ref: 052A04FC

Memory Dump Source

Source File: 00000001.00000002.3727425985.00000000052A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 052A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_52a0000_LisectAVT_2403002A_135.jbxd

Similarity

API ID: Initialize
String ID:
API String ID: 2538663250-0
Opcode ID: 51d1f042bf30fdb03657805b3394afa1ed12b148f81a19eda05a3d147b93b4a0
Instruction ID: f71b383435403495537f31ea9196ae15b91fc77bb4a9c9fbf582fadb98dfde35
Opcode Fuzzy Hash: 51d1f042bf30fdb03657805b3394afa1ed12b148f81a19eda05a3d147b93b4a0
Instruction Fuzzy Hash: 9301D175814244CFEB10CF15E889B62FBE4EF44320F08C4AADD498F242D3B9A504CFA2

Function 00ECAF7E Relevance: 1.5, APIs: 1, Instructions: 39COMMON

Download Yara Rule

APIs

FindClose.KERNEL32(?,F573157E,00000000,?,?,?,?,?,?,?,?,6D343C58), ref: 00ECAFB0

Memory Dump Source

Source File: 00000001.00000002.3709959714.0000000000ECA000.00000040.00000800.00020000.00000000.sdmp, Offset: 00ECA000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_eca000_LisectAVT_2403002A_135.jbxd

Similarity

API ID: CloseFind
String ID:
API String ID: 1863332320-0
Opcode ID: cf17cc61994fd1a87e5bfa5936fe7bbf6a9cd91a31bc7bd18f15294cbdea3b1d
Instruction ID: 9d9b1895722c8690b7f0745beb07b3ede686be52738c4d43c7f269c8bd8f856f
Opcode Fuzzy Hash: cf17cc61994fd1a87e5bfa5936fe7bbf6a9cd91a31bc7bd18f15294cbdea3b1d
Instruction Fuzzy Hash: 4501D6746046488FDB108F15D985B61FBE4DF04328F0CC0AEDD454B352D375E915DB62

Function 00ECA572 Relevance: 1.5, APIs: 1, Instructions: 35COMMON

Download Yara Rule

APIs

SetErrorMode.KERNEL32(?,F573157E,00000000,?,?,?,?,?,?,?,?,6D343C58), ref: 00ECA5A4

Memory Dump Source

Source File: 00000001.00000002.3709959714.0000000000ECA000.00000040.00000800.00020000.00000000.sdmp, Offset: 00ECA000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_eca000_LisectAVT_2403002A_135.jbxd

Similarity

API ID: ErrorMode
String ID:
API String ID: 2340568224-0
Opcode ID: a7e5010155506150f7e60613fff9d2f11abb2bc5753333ed1f141166f596a8d6
Instruction ID: 562816d81319acbab05fb706cd847cc47c48d368bbf9c1f1f6b4b7dd3ee11c78
Opcode Fuzzy Hash: a7e5010155506150f7e60613fff9d2f11abb2bc5753333ed1f141166f596a8d6
Instruction Fuzzy Hash: D7F0FF349042488FDB20CF15DA85B65FBE0EF08328F0CC0AEDD491F652D37AA905CBA2

Function 052B8201 Relevance: 1.5, Strings: 1, Instructions: 250COMMON

Download Yara Rule

Strings

:@zl, xrefs: 052B84AB

Memory Dump Source

Source File: 00000001.00000002.3727458401.00000000052B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 052B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_52b0000_LisectAVT_2403002A_135.jbxd

Similarity

API ID:
String ID: :@zl
API String ID: 0-1604122134
Opcode ID: 07708b8d4caa00a07137b83520a0b019d47ecdeb6d756c67230bb3306069aff8
Instruction ID: 28d1dcfff4eb2b4ff8d55c34f796218525e4df17c0aafb4c661892fcf017d66f
Opcode Fuzzy Hash: 07708b8d4caa00a07137b83520a0b019d47ecdeb6d756c67230bb3306069aff8
Instruction Fuzzy Hash: 97B15974A011048FDB54EF61ED68BAD7BB6FF88300F10806A998AAB3A4DF745D45CF21

Function 052B822D Relevance: 1.5, Strings: 1, Instructions: 221COMMON

Download Yara Rule

Strings

:@zl, xrefs: 052B84AB

Memory Dump Source

Source File: 00000001.00000002.3727458401.00000000052B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 052B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_52b0000_LisectAVT_2403002A_135.jbxd

Similarity

API ID:
String ID: :@zl
API String ID: 0-1604122134
Opcode ID: c1ac1b42924a0dad4ce476d8ff21bcf2ec9ae3e501f07b9566590602a9e3b8cc
Instruction ID: dcf957af7de6de784d4365233c7f70fccf5d4062c3bba33327e413992d42d557
Opcode Fuzzy Hash: c1ac1b42924a0dad4ce476d8ff21bcf2ec9ae3e501f07b9566590602a9e3b8cc
Instruction Fuzzy Hash: 41A15974A011048FDB54EF61ED68BAD7BB6FF88301F10806A998AA73A4DF745D85CF21

Function 052B8272 Relevance: 1.5, Strings: 1, Instructions: 218COMMON

Download Yara Rule

Strings

:@zl, xrefs: 052B84AB

Memory Dump Source

Source File: 00000001.00000002.3727458401.00000000052B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 052B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_52b0000_LisectAVT_2403002A_135.jbxd

Similarity

API ID:
String ID: :@zl
API String ID: 0-1604122134
Opcode ID: 7bef691495602894b2b49127ef8605391fc8e7f78c308a62aed7dae85114c2aa
Instruction ID: 49596f6dce1860a625eb533162cff6fe1802b3cb80537001d6c58c3d91de8a1a
Opcode Fuzzy Hash: 7bef691495602894b2b49127ef8605391fc8e7f78c308a62aed7dae85114c2aa
Instruction Fuzzy Hash: 0EA15874A001048FDB54EF61ED58BAD77B6FF88300F10806A998AA73A4DF745D85CF21

Function 052B82AB Relevance: 1.5, Strings: 1, Instructions: 217COMMON

Download Yara Rule

Strings

:@zl, xrefs: 052B84AB

Memory Dump Source

Source File: 00000001.00000002.3727458401.00000000052B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 052B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_52b0000_LisectAVT_2403002A_135.jbxd

Similarity

API ID:
String ID: :@zl
API String ID: 0-1604122134
Opcode ID: 1f0ad1be6d60b2048d58f57fed8e5c05e05f9171abe622b1d3d4a2b76a14dbd6
Instruction ID: 9ed97207a420037b92fb5281b267c0abee73ce7ccfbd2789d3e65b6c3cd097e2
Opcode Fuzzy Hash: 1f0ad1be6d60b2048d58f57fed8e5c05e05f9171abe622b1d3d4a2b76a14dbd6
Instruction Fuzzy Hash: 42A16974A011148FDB54EF61ED58BAD77B6FF88300F10806A998AA73A4DF745D85CF21

Function 052B7510 Relevance: 1.4, Strings: 1, Instructions: 194COMMON

Download Yara Rule

Strings

UNFl^, xrefs: 052B76F0

Memory Dump Source

Source File: 00000001.00000002.3727458401.00000000052B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 052B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_52b0000_LisectAVT_2403002A_135.jbxd

Similarity

API ID:
String ID: UNFl^
API String ID: 0-4111405529
Opcode ID: c6ff7cc998e2b6947a9d40b455995cd1f69ed76e36aaaa67e5e2cc480501eba6
Instruction ID: deb0ffa54543b9f6bc8277542d12c98eae3fe40421dc2eba00ade61ab112b4e9
Opcode Fuzzy Hash: c6ff7cc998e2b6947a9d40b455995cd1f69ed76e36aaaa67e5e2cc480501eba6
Instruction Fuzzy Hash: 4171A031E251058FEB14EB65E9487AD77A3EFC4390F0C4166D846BB2A4CBF49D418BD1

Function 052B55BC Relevance: 1.4, Strings: 1, Instructions: 161COMMON

Download Yara Rule

Strings

S, xrefs: 052B55CB

Memory Dump Source

Source File: 00000001.00000002.3727458401.00000000052B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 052B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_52b0000_LisectAVT_2403002A_135.jbxd

Similarity

API ID:
String ID: S
API String ID: 0-543223747
Opcode ID: d86262b8d6c933317118860e0be90be2bcea7109f944704abd59d1974829e34a
Instruction ID: fa6e595f667b60881218cb3aa787301e680650f6a080b2604dc0f6e18abc493d
Opcode Fuzzy Hash: d86262b8d6c933317118860e0be90be2bcea7109f944704abd59d1974829e34a
Instruction Fuzzy Hash: B65178726282428FFB02CF78F6CE9847FB0FE0A3607154246E1848F5CAEAA5E541CB55

Function 052B9690 Relevance: 1.4, Strings: 1, Instructions: 146COMMON

Download Yara Rule

Strings

:@zl, xrefs: 052B96FE

Memory Dump Source

Source File: 00000001.00000002.3727458401.00000000052B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 052B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_52b0000_LisectAVT_2403002A_135.jbxd

Similarity

API ID:
String ID: :@zl
API String ID: 0-1604122134
Opcode ID: 0f97f05890d4a58e2d77951f93ccebd4d0db5e7a7092b21e0ec44e33a4af8751
Instruction ID: f674fe13d11d92bc77afec560cd1389e8e3aaad922acf269e86f89c2c9344d9c
Opcode Fuzzy Hash: 0f97f05890d4a58e2d77951f93ccebd4d0db5e7a7092b21e0ec44e33a4af8751
Instruction Fuzzy Hash: E8419035B201159FEF04EBB5D954AED7BF6EF84350F04402AE64AE7290EFA49C418762

Function 014E0080 Relevance: 1.4, Strings: 1, Instructions: 108COMMON

Download Yara Rule

Strings

:@zl, xrefs: 014E016D

Memory Dump Source

Source File: 00000001.00000002.3718480063.00000000014E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 014E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_14e0000_LisectAVT_2403002A_135.jbxd

Similarity

API ID:
String ID: :@zl
API String ID: 0-1604122134
Opcode ID: b0741a5058b3c090a8a30f78bb9e40d2134388d4ce148ed8b2b9987e260f80d0
Instruction ID: e3e8a3932a28b3c42e4608caccfa1e8b1dcd071eb2379194f0a8824ab7702f74
Opcode Fuzzy Hash: b0741a5058b3c090a8a30f78bb9e40d2134388d4ce148ed8b2b9987e260f80d0
Instruction Fuzzy Hash: 394193349062458FC304EB76EA59A59BBE2EFC5304F48C13FD644AF278DF75490A8B62

Function 014E0090 Relevance: 1.4, Strings: 1, Instructions: 104COMMON

Download Yara Rule

Strings

:@zl, xrefs: 014E016D

Memory Dump Source

Source File: 00000001.00000002.3718480063.00000000014E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 014E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_14e0000_LisectAVT_2403002A_135.jbxd

Similarity

API ID:
String ID: :@zl
API String ID: 0-1604122134
Opcode ID: 21bcc9c9cb9a15ec9cbaaa1f616b02c87b013b75a1008892003e19c5c241fbba
Instruction ID: e6070d546107e01a69c73a0f1a09cf34dd2c45daf0f526714d82c9893aea9aaa
Opcode Fuzzy Hash: 21bcc9c9cb9a15ec9cbaaa1f616b02c87b013b75a1008892003e19c5c241fbba
Instruction Fuzzy Hash: 8C4174349062058FC304EB76EA59B59B7E6EFC5304F44C13ED644AF278DF75490A8BA2

Function 052B5749 Relevance: 1.4, Strings: 1, Instructions: 103COMMON

Download Yara Rule

Strings

, xrefs: 052B5D79

Memory Dump Source

Source File: 00000001.00000002.3727458401.00000000052B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 052B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_52b0000_LisectAVT_2403002A_135.jbxd

Similarity

API ID:
String ID:
API String ID: 0-3916222277
Opcode ID: cfbd615ac9e649d58086f5e700a11a83761fb334e1cfe86071f225dc813fe954
Instruction ID: 0d4bdca9318f28eb4008978fbae9e3eac776ad0e81beac6e5655c12dba0b22e8
Opcode Fuzzy Hash: cfbd615ac9e649d58086f5e700a11a83761fb334e1cfe86071f225dc813fe954
Instruction Fuzzy Hash: E2316B75B25106CFEB01CF78F6CAA98BFB1FF08384B054202E1459F289EBB0E5458B55

Function 052B59FB Relevance: 1.4, Strings: 1, Instructions: 102COMMON

Download Yara Rule

Strings

f, xrefs: 052B6095

Memory Dump Source

Source File: 00000001.00000002.3727458401.00000000052B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 052B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_52b0000_LisectAVT_2403002A_135.jbxd

Similarity

API ID:
String ID: f
API String ID: 0-1993550816
Opcode ID: e92d8dd966b06068907d5b019fcb87cd2215c1366b124ef50b876a7c615dfe9c
Instruction ID: c046e401120185cffc01fb485279de80b55e49ec92f4a1cbb5a421ec88fe88b6
Opcode Fuzzy Hash: e92d8dd966b06068907d5b019fcb87cd2215c1366b124ef50b876a7c615dfe9c
Instruction Fuzzy Hash: 8B317871B251068FFB01CF78F6CA998BFB1FF08394B558212D0459F289EBB1E5458B94

Function 052B766D Relevance: 1.3, Strings: 1, Instructions: 86COMMON

Download Yara Rule

Strings

UNFl^, xrefs: 052B76F0

Memory Dump Source

Source File: 00000001.00000002.3727458401.00000000052B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 052B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_52b0000_LisectAVT_2403002A_135.jbxd

Similarity

API ID:
String ID: UNFl^
API String ID: 0-4111405529
Opcode ID: ef1e3204eb7c48aab98ba4a534e2ff71784809353f13ece71cdfdd635181e6c8
Instruction ID: b1fa5442e79d2c2f0b59c4e44a3e5b46ab0303984b67ff9864ea75be534541dc
Opcode Fuzzy Hash: ef1e3204eb7c48aab98ba4a534e2ff71784809353f13ece71cdfdd635181e6c8
Instruction Fuzzy Hash: 0F319E31E252158FEB10DB65E5986EC77B3EFC8390F094466D856BB290CBB4AD40CBD1

Function 052B9CB4 Relevance: 1.3, Strings: 1, Instructions: 43COMMON

Download Yara Rule

Strings

:@zl, xrefs: 052B9CB9

Memory Dump Source

Source File: 00000001.00000002.3727458401.00000000052B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 052B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_52b0000_LisectAVT_2403002A_135.jbxd

Similarity

API ID:
String ID: :@zl
API String ID: 0-1604122134
Opcode ID: 17c07d1ea01a6e98d184e91eb0f1cb25bcceb4971c427e0586f18aa009818692
Instruction ID: d3057ab50da3cb6c59eb839a6754095250a341461044cd3f9d150c349b6dd590
Opcode Fuzzy Hash: 17c07d1ea01a6e98d184e91eb0f1cb25bcceb4971c427e0586f18aa009818692
Instruction Fuzzy Hash: 13012134B140559FDB046BA59A15B3E77EBEB88308F01C02F9646E77D8CEB94C428B71

Function 052B560F Relevance: 1.3, Strings: 1, Instructions: 23COMMON

Download Yara Rule

Strings

D, xrefs: 052B563C

Memory Dump Source

Source File: 00000001.00000002.3727458401.00000000052B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 052B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_52b0000_LisectAVT_2403002A_135.jbxd

Similarity

API ID:
String ID: D
API String ID: 0-2746444292
Opcode ID: e141ed5940faae814d7af81e8237b3f06ccd7d145c65dccf9768216a4aa04704
Instruction ID: 4f6e149a2a2e61113efb90e16dd4b9618e301576a8873ae4688a854a3723697c
Opcode Fuzzy Hash: e141ed5940faae814d7af81e8237b3f06ccd7d145c65dccf9768216a4aa04704
Instruction Fuzzy Hash: 91E09270626340CFD701CBA4A9582DD7FB5EF02361F040196D046DE153EBBC094A8B22

Function 052B5D8F Relevance: 1.3, Strings: 1, Instructions: 19COMMON

Download Yara Rule

Strings

2, xrefs: 052B5DC1

Memory Dump Source

Source File: 00000001.00000002.3727458401.00000000052B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 052B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_52b0000_LisectAVT_2403002A_135.jbxd

Similarity

API ID:
String ID: 2
API String ID: 0-450215437
Opcode ID: 3dedaf045a6ecb516b7ad133a4ee1ca6237afe6af3ad6224c9d70ed86e3ecf03
Instruction ID: d4b21133f4d2cbfeb09a814369ce4639bd5952af70e585468e7ed93b5a78bf14
Opcode Fuzzy Hash: 3dedaf045a6ecb516b7ad133a4ee1ca6237afe6af3ad6224c9d70ed86e3ecf03
Instruction Fuzzy Hash: 2CE01A70726304CFEB05DFA5E2481ECBBB6EF04381F108456D4029F252EABC5A09DB56

Function 052B58A6 Relevance: 1.3, Strings: 1, Instructions: 17COMMON

Download Yara Rule

Strings

<, xrefs: 052B5674

Memory Dump Source

Source File: 00000001.00000002.3727458401.00000000052B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 052B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_52b0000_LisectAVT_2403002A_135.jbxd

Similarity

API ID:
String ID: <
API String ID: 0-4251816714
Opcode ID: f3a12d4b8e3f5cf78edb9c7e9f4b0776497d5dd54090c75517b0295cd0af1dd5
Instruction ID: efa4252e8632ea76d1dc493b78783b51ab4aea47de0aedf9fd1c281a9c9d2c64
Opcode Fuzzy Hash: f3a12d4b8e3f5cf78edb9c7e9f4b0776497d5dd54090c75517b0295cd0af1dd5
Instruction Fuzzy Hash: FBE09A74B36248CFFB04CF95E5586ACBB76FF44381F10441AD507AA294DFB85A488B52

Function 052B5830 Relevance: 1.3, Strings: 1, Instructions: 11COMMON

Download Yara Rule

Strings

., xrefs: 052B5846

Memory Dump Source

Source File: 00000001.00000002.3727458401.00000000052B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 052B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_52b0000_LisectAVT_2403002A_135.jbxd

Similarity

API ID:
String ID: .
API String ID: 0-248832578
Opcode ID: 0f20602ba1b859eae15b36851903c38c7071c273f3dd46b4f320b9cfc2e3249d
Instruction ID: c217b12bfd0961d2a38a6bb4a93840f9eb0774c3f4091e57d108fd047042e033
Opcode Fuzzy Hash: 0f20602ba1b859eae15b36851903c38c7071c273f3dd46b4f320b9cfc2e3249d
Instruction Fuzzy Hash: BBD09E74B26144CFEB04CFA9F14C1ACBBB2EB44341F204416D40296290DF7859448A11

Function 052B5E05 Relevance: 1.3, Strings: 1, Instructions: 11COMMON

Download Yara Rule

Strings

%, xrefs: 052B5E21

Memory Dump Source

Source File: 00000001.00000002.3727458401.00000000052B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 052B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_52b0000_LisectAVT_2403002A_135.jbxd

Similarity

API ID:
String ID: %
API String ID: 0-2567322570
Opcode ID: 971210900159478f9d6d311f5b5add3a366567be010b044bcc72f6535fdf9055
Instruction ID: 1573e21809562bedb19d0d8c2ed75bed8301d44d5c410c459218ccdc9ab59c85
Opcode Fuzzy Hash: 971210900159478f9d6d311f5b5add3a366567be010b044bcc72f6535fdf9055
Instruction Fuzzy Hash: 59C01270A22604CFD710CBB46D1D3CC77F0FB04325B5401168402A6346FF7444474A15

Function 052B565E Relevance: 1.3, Strings: 1, Instructions: 11COMMON

Download Yara Rule

Strings

<, xrefs: 052B5674

Memory Dump Source

Source File: 00000001.00000002.3727458401.00000000052B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 052B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_52b0000_LisectAVT_2403002A_135.jbxd

Similarity

API ID:
String ID: <
API String ID: 0-4251816714
Opcode ID: f4bc5b28ded4017d592a93c880eb6303a8d8c587c7ffeffa46815a683b25ebf3
Instruction ID: 714c8419ad5ad56f50071bc98743ea4aa85ee196a8f13d7660a77008f340c9d4
Opcode Fuzzy Hash: f4bc5b28ded4017d592a93c880eb6303a8d8c587c7ffeffa46815a683b25ebf3
Instruction Fuzzy Hash: CAD09E74B26208CFEB04CF95E5485ACBB76EB04341F104416D402EA250DF785A488B11

Function 052BB259 Relevance: 1.3, Strings: 1, Instructions: 9COMMON

Download Yara Rule

Strings

d, xrefs: 052BB264

Memory Dump Source

Source File: 00000001.00000002.3727458401.00000000052B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 052B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_52b0000_LisectAVT_2403002A_135.jbxd

Similarity

API ID:
String ID: d
API String ID: 0-3778237843
Opcode ID: bd8959e1e9d833887a6304d866f1e8ec8ae242052c531ab3338f49225a80d9cc
Instruction ID: 1a6163783ab0b9d2d1735c70b47dbca63c12106310761e4633d9628d6ea6de28
Opcode Fuzzy Hash: bd8959e1e9d833887a6304d866f1e8ec8ae242052c531ab3338f49225a80d9cc
Instruction Fuzzy Hash: 69C09222019B85CBFF5117A2F50F3987B25EB4AA26F4440D3A80D99222DD89885587C2

Function 052B590C Relevance: 1.3, Strings: 1, Instructions: 7COMMON

Download Yara Rule

Strings

&, xrefs: 052B5922

Memory Dump Source

Source File: 00000001.00000002.3727458401.00000000052B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 052B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_52b0000_LisectAVT_2403002A_135.jbxd

Similarity

API ID:
String ID: &
API String ID: 0-1010288
Opcode ID: 4e86b945fc3df53776cd73b57d2ba561a83283bd0e9c5cc9a35ae8515635e1f9
Instruction ID: 0454e760de55fdacfb26f829fec29ca53749a61f9de4dbcf61bc74a350438083
Opcode Fuzzy Hash: 4e86b945fc3df53776cd73b57d2ba561a83283bd0e9c5cc9a35ae8515635e1f9
Instruction Fuzzy Hash: 17C04C74B23208CFDB24DFFAF51C1ADBBB1EB48341F10401A9413A6290DE7804488F22

Function 052B5CBB Relevance: 1.3, Strings: 1, Instructions: 7COMMON

Download Yara Rule

Strings

E, xrefs: 052B5CD1

Memory Dump Source

Source File: 00000001.00000002.3727458401.00000000052B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 052B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_52b0000_LisectAVT_2403002A_135.jbxd

Similarity

API ID:
String ID: E
API String ID: 0-3568589458
Opcode ID: 46287e506196bdeb717556456c9a1ca09c763d7bcf228d6277634e6a9b479371
Instruction ID: fb9c15609452179c682aee1697ea10b07914dd3c6e627365846a4ddc6c678838
Opcode Fuzzy Hash: 46287e506196bdeb717556456c9a1ca09c763d7bcf228d6277634e6a9b479371
Instruction Fuzzy Hash: F4C04C74B23204CFEB44DFA5E95C59CBBB2EB44341F10401AD507A6290DEB80588CA16

Function 052B5881 Relevance: 1.3, Strings: 1, Instructions: 7COMMON

Download Yara Rule

Strings

H, xrefs: 052B589A

Memory Dump Source

Source File: 00000001.00000002.3727458401.00000000052B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 052B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_52b0000_LisectAVT_2403002A_135.jbxd

Similarity

API ID:
String ID: H
API String ID: 0-2852464175
Opcode ID: 86376afe48dc1a5200fec077ab90fadca81b1eadc46be230cbf41af70ff06709
Instruction ID: a79899f9b2d75d5c86b876585ccbd34c2e6fc3d1d093ff9a0d0e8e8040368e7f
Opcode Fuzzy Hash: 86376afe48dc1a5200fec077ab90fadca81b1eadc46be230cbf41af70ff06709
Instruction Fuzzy Hash: CAC002B4B23204CFDB549BA5EA1829CBBA1EB84341F00445A9507AA290DEB809888A16

Function 052B5C96 Relevance: 1.3, Strings: 1, Instructions: 7COMMON

Download Yara Rule

Strings

J, xrefs: 052B5CAF

Memory Dump Source

Source File: 00000001.00000002.3727458401.00000000052B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 052B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_52b0000_LisectAVT_2403002A_135.jbxd

Similarity

API ID:
String ID: J
API String ID: 0-1141589763
Opcode ID: f158f0177ca0c1e7c91efc7e58de61a6b8a7570da841a87159f2d79bbce5eefc
Instruction ID: 437fe3177cbf2ce3ca4c198e8635470b62ceb8e828e1eefbd98171340b79f22c
Opcode Fuzzy Hash: f158f0177ca0c1e7c91efc7e58de61a6b8a7570da841a87159f2d79bbce5eefc
Instruction Fuzzy Hash: 50C04C74B23244CFDB54DFA6F55C29CBBB1EB44341F10805AD50BE6290DEB809889F16

Function 052B60C9 Relevance: 1.3, Strings: 1, Instructions: 7COMMON

Download Yara Rule

Strings

6, xrefs: 052B60DF

Memory Dump Source

Source File: 00000001.00000002.3727458401.00000000052B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 052B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_52b0000_LisectAVT_2403002A_135.jbxd

Similarity

API ID:
String ID: 6
API String ID: 0-498629140
Opcode ID: 32f709979dcb1c96ab49062426199c3f4e64d0138a010b746a930cde5d6be7d5
Instruction ID: e3338930bfc2027c171c7c8c120b18cc9803c6adaccd80ddd7fb2f4ed80a7886
Opcode Fuzzy Hash: 32f709979dcb1c96ab49062426199c3f4e64d0138a010b746a930cde5d6be7d5
Instruction Fuzzy Hash: DEC04C74B23204DFDB14DFF6E61C19CBBB5EB44345F10402E9403A6290DEB809488A12

Function 052B5F59 Relevance: 1.3, Strings: 1, Instructions: 7COMMON

Download Yara Rule

Strings

L, xrefs: 052B5F72

Memory Dump Source

Source File: 00000001.00000002.3727458401.00000000052B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 052B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_52b0000_LisectAVT_2403002A_135.jbxd

Similarity

API ID:
String ID: L
API String ID: 0-2909332022
Opcode ID: 0b574bd9d67006d99034f13316470096dc543f3f6f237bfeb8fb387d4916434a
Instruction ID: 7621cd8445b9f7e063cf7f5f6d0a879ab58e9cb8ddd8a1038ed5672f97fd9e9f
Opcode Fuzzy Hash: 0b574bd9d67006d99034f13316470096dc543f3f6f237bfeb8fb387d4916434a
Instruction Fuzzy Hash: F2C04CB4B23204DFEB54DFB5EA1D69CBBB1EB44341F00405AD90BA6290DE7809498A16

Function 052B5BB0 Relevance: 1.3, Strings: 1, Instructions: 7COMMON

Download Yara Rule

Strings

!, xrefs: 052B5BC9

Memory Dump Source

Source File: 00000001.00000002.3727458401.00000000052B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 052B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_52b0000_LisectAVT_2403002A_135.jbxd

Similarity

API ID:
String ID: !
API String ID: 0-2657877971
Opcode ID: 2ce84f808e3b8aeb77ea467395581285c017caef8f631c98f4022cdfcb717f6a
Instruction ID: 6351f0d921c666f9e108d1864c365c189c88f823edb8bdf20fd7694452e385d3
Opcode Fuzzy Hash: 2ce84f808e3b8aeb77ea467395581285c017caef8f631c98f4022cdfcb717f6a
Instruction Fuzzy Hash: 26C04C74B27208CFDB14DFA5E91C39CBBB1EB54341F40405AD447A6290DFB849888E12

Function 052B5EB7 Relevance: 1.3, Strings: 1, Instructions: 7COMMON

Download Yara Rule

Strings

,, xrefs: 052B5ED0

Memory Dump Source

Source File: 00000001.00000002.3727458401.00000000052B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 052B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_52b0000_LisectAVT_2403002A_135.jbxd

Similarity

API ID:
String ID: ,
API String ID: 0-3772416878
Opcode ID: 8435906243b4bd63e2a6b30d40a257740b4ce187de691f20798c6ce80f67e088
Instruction ID: ae907d5bfac23ab10dc9a1bfa0f09d602a698b537a42c7ea1a62f5bd04497f1d
Opcode Fuzzy Hash: 8435906243b4bd63e2a6b30d40a257740b4ce187de691f20798c6ce80f67e088
Instruction Fuzzy Hash: 6EC00274B22604DFEB149BBAA91D69CBBA2EB44351F00805A9807A6290DE7809489E22

Function 052B5EFF Relevance: 1.3, Strings: 1, Instructions: 7COMMON

Download Yara Rule

Strings

=, xrefs: 052B5F18

Memory Dump Source

Source File: 00000001.00000002.3727458401.00000000052B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 052B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_52b0000_LisectAVT_2403002A_135.jbxd

Similarity

API ID:
String ID: =
API String ID: 0-2322244508
Opcode ID: f4d3f1f5593f6603cc1f61d6dd6ee32d3fc7655d695fd765e75348cf47647fc6
Instruction ID: 76d5e9fa3cb750c014980c40b78a8d2454709784f9572cff2c9d733666d1914d
Opcode Fuzzy Hash: f4d3f1f5593f6603cc1f61d6dd6ee32d3fc7655d695fd765e75348cf47647fc6
Instruction Fuzzy Hash: D1C00274A23214CFEB159BA6A91C29CBBB5EB48342F00805A9407E6290DE7809489F22

Function 052B6A99 Relevance: .3, Instructions: 291COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.3727458401.00000000052B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 052B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_52b0000_LisectAVT_2403002A_135.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4164adfa62ca48d6cbde6ea59f771a4278dcf576dfdc6641bc62b69aa7c7052e
Instruction ID: 3ac899c0d15545e8825e5f0fbe96c83a2b369dfc34f6b6aad8e559638bba44c4
Opcode Fuzzy Hash: 4164adfa62ca48d6cbde6ea59f771a4278dcf576dfdc6641bc62b69aa7c7052e
Instruction Fuzzy Hash: FDE12A74A11219CFEB24EF61ED587ADBBB2FF84300F1041AAD54AAB2A4DB705D84CF11

Function 052B65AD Relevance: .3, Instructions: 290COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.3727458401.00000000052B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 052B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_52b0000_LisectAVT_2403002A_135.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: af60eb30b22ebd613236e97fd605525df8689eb1c492755783047681845f8b67
Instruction ID: 05e71b5652af47e2af95def0b79810ac9dd7adb97edfdd04b529129b974f81b9
Opcode Fuzzy Hash: af60eb30b22ebd613236e97fd605525df8689eb1c492755783047681845f8b67
Instruction Fuzzy Hash: 81E11A74A11219CFEB54EF61ED587ADBBB2FF84300F1041AAD54AAB2A4DB705D84CF11

Function 052B6B0C Relevance: .3, Instructions: 290COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.3727458401.00000000052B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 052B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_52b0000_LisectAVT_2403002A_135.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9300b3457888fdc5855988a5c7b47979777bc9b5920329f2816f6cd18ffc7da1
Instruction ID: e363fac9ea7f89ed117e2ac8171467d08bda923ea09f116641c149885e658bb4
Opcode Fuzzy Hash: 9300b3457888fdc5855988a5c7b47979777bc9b5920329f2816f6cd18ffc7da1
Instruction Fuzzy Hash: 63E11A74A11219CFEB64EF61ED587ADBBB2FF84300F1041AAD54AAB2A4DB705D84CF11

Function 052B6675 Relevance: .3, Instructions: 290COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.3727458401.00000000052B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 052B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_52b0000_LisectAVT_2403002A_135.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a6b908ef9fc09b7207bb1ce4e24b63030f748f94b8c9cb10b2cb07285fa226c0
Instruction ID: 5309570a0bc5079e7af7d180e6ff0b383fb22e4b80720e6890b55052d4ec0c7b
Opcode Fuzzy Hash: a6b908ef9fc09b7207bb1ce4e24b63030f748f94b8c9cb10b2cb07285fa226c0
Instruction Fuzzy Hash: D3E11974A11219CFEB64EF61ED587ADBBB2FF84300F1041AAD54AAB2A4DB705D84CF11

Function 052B8F88 Relevance: .2, Instructions: 249COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.3727458401.00000000052B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 052B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_52b0000_LisectAVT_2403002A_135.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9e8749e4166406a67e33d87f4ec4329983f6abd87981bbdf08bd47c284f5b827
Instruction ID: f15bccb8126c852abc69c93b1de773d476ee265e6dcfac318ac89d5c88356814
Opcode Fuzzy Hash: 9e8749e4166406a67e33d87f4ec4329983f6abd87981bbdf08bd47c284f5b827
Instruction Fuzzy Hash: 3281A431F381048BFB249B68D4887FC76A3EF88390F254426E74AA7291DAF58DC58752

Function 052BACE3 Relevance: .2, Instructions: 210COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.3727458401.00000000052B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 052B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_52b0000_LisectAVT_2403002A_135.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1688c443eee62021fb5fb75f91efe3dec3b30241f7197a362d8dfb9d3b2b6704
Instruction ID: 7ac3ebcafc036b9d08b4e1caa2cddbf3d0d9d93bde68efc674100118dbe6aa37
Opcode Fuzzy Hash: 1688c443eee62021fb5fb75f91efe3dec3b30241f7197a362d8dfb9d3b2b6704
Instruction Fuzzy Hash: 7E717272F241158BFB24EBB8D4987ED76E2AF44354F08447AD50AAB390DBF58C418B91

Function 052B88A8 Relevance: .2, Instructions: 207COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.3727458401.00000000052B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 052B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_52b0000_LisectAVT_2403002A_135.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 286710510512eb94bb556cfeff592540576c9ba9f1b773aa1804e0981f5e32bc
Instruction ID: 0a52d464ac4193c77a508e699b7e18e683ddf02ac9f84c7c4ecf280058c552c7
Opcode Fuzzy Hash: 286710510512eb94bb556cfeff592540576c9ba9f1b773aa1804e0981f5e32bc
Instruction Fuzzy Hash: 63719075A21115CFEB00DF75E848AACBBB6FF84394F058026D84AE7360DBB49C46CB56

Function 052B466C Relevance: .2, Instructions: 183COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.3727458401.00000000052B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 052B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_52b0000_LisectAVT_2403002A_135.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 928e17ab9968f8f5a554f6bc016c3d9214cb2fc0eaacbc9ded7d6fab173a10a6
Instruction ID: 8341394beab6b742767fefc225fc874b948a76063e36e83746250023df1f7722
Opcode Fuzzy Hash: 928e17ab9968f8f5a554f6bc016c3d9214cb2fc0eaacbc9ded7d6fab173a10a6
Instruction Fuzzy Hash: 1C91CA74A01219CFDB64EF61EC58BA97BB2FB58301F1041ABD90AA7394DB705E85CF50

Function 052BA0EB Relevance: .2, Instructions: 180COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.3727458401.00000000052B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 052B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_52b0000_LisectAVT_2403002A_135.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 72789ba5cc2b8daa721920e5ba92556e0a8c2ff235e6e6788ea859e4c3f8481b
Instruction ID: 8f5007c511d12db52aefab102734697fa3811daaa559e142f64e281b65f1663a
Opcode Fuzzy Hash: 72789ba5cc2b8daa721920e5ba92556e0a8c2ff235e6e6788ea859e4c3f8481b
Instruction Fuzzy Hash: BD615B35E20005CFEB08EBB4E8585EDBBB6FF88340F544526D50AAB3A4DFB09C458B91

Function 052B9F22 Relevance: .2, Instructions: 180COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.3727458401.00000000052B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 052B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_52b0000_LisectAVT_2403002A_135.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3f4fa9e83e294e20370fb2aa4cd01d9cb8f7e5cb010574bed15deb73fe176804
Instruction ID: c8107769a7dbdfa13a365cf510ad6833ad28d9212ea6fbea04fccf5c147a0398
Opcode Fuzzy Hash: 3f4fa9e83e294e20370fb2aa4cd01d9cb8f7e5cb010574bed15deb73fe176804
Instruction Fuzzy Hash: 0C614134F20146DFEF18FBB4D8586ED7BA6EF84380F144526D60AAB394DFB098818B51

Function 052B46B5 Relevance: .2, Instructions: 177COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.3727458401.00000000052B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 052B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_52b0000_LisectAVT_2403002A_135.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4edca74fd05cd761444ded0289a44357aa960c66caac5aa3898962ccce9d9287
Instruction ID: b3578a7e1a4632f9627a1a3fece6e70022b579360f53ce43c172ba468d6d98a6
Opcode Fuzzy Hash: 4edca74fd05cd761444ded0289a44357aa960c66caac5aa3898962ccce9d9287
Instruction Fuzzy Hash: 75918874A01219CFDB64EF65EC58BADBBB2FB48301F1041AAD90AA73A4DB705D85CF50

Function 052B45EE Relevance: .2, Instructions: 161COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.3727458401.00000000052B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 052B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_52b0000_LisectAVT_2403002A_135.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d82f412beb36d130966f731cc6ca74f257b99558bb76a9eb1c08148a24e171ad
Instruction ID: 6c186231c9027b3db318ed7967042193d7663fec34fbf739c8c819d1b7f7e1bb
Opcode Fuzzy Hash: d82f412beb36d130966f731cc6ca74f257b99558bb76a9eb1c08148a24e171ad
Instruction Fuzzy Hash: DD714070D25148CFEB14EFB6E9897ECBBB2EF44304F14815AD4566B291CBB44888CF66

Function 052B4626 Relevance: .2, Instructions: 158COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.3727458401.00000000052B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 052B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_52b0000_LisectAVT_2403002A_135.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2fc9864f6a18f413505e7af0fe326231c090ea03cc81bd4935262652d964c509
Instruction ID: 1562ca14f3b640cc24ce5649c1928ef46866b720c167c281ff1609f420f92b79
Opcode Fuzzy Hash: 2fc9864f6a18f413505e7af0fe326231c090ea03cc81bd4935262652d964c509
Instruction Fuzzy Hash: 80713070D25148CFEB14EFB6E9887ECBBB2FF44304F14815AD446A62A1DBB44888CF55

Function 052B4283 Relevance: .2, Instructions: 157COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.3727458401.00000000052B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 052B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_52b0000_LisectAVT_2403002A_135.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e0dc28cbd184f02cd66aa7ab6a378cb031ed88e0867db40a3e7b629838def26a
Instruction ID: 63322e4c82d67d3f46075b3301222a006bb30a07a0bdd89a84e6c5056256aa01
Opcode Fuzzy Hash: e0dc28cbd184f02cd66aa7ab6a378cb031ed88e0867db40a3e7b629838def26a
Instruction Fuzzy Hash: 91613F70D25109CFEB14EFA6E9887ECBBB2FF44304F14815AD4466B255CBB44889CFA6

Function 052B4462 Relevance: .2, Instructions: 154COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.3727458401.00000000052B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 052B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_52b0000_LisectAVT_2403002A_135.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cf6d68ddbdbd45f6a96172d51037732ac667284e78357aab9561976d4feaf6e7
Instruction ID: 23c218b1ee49130d3a9f484540f127559987f7f151ec332a373d8d235ac8cfe9
Opcode Fuzzy Hash: cf6d68ddbdbd45f6a96172d51037732ac667284e78357aab9561976d4feaf6e7
Instruction Fuzzy Hash: 83613E70D25108CFEB14EFB6E9887ECBBB2FF44304F14815AD446A62A1DBB44889CF56

Function 052B44D5 Relevance: .2, Instructions: 154COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.3727458401.00000000052B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 052B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_52b0000_LisectAVT_2403002A_135.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 366f144f7b9cd3b9d5b81ab1e153f1d79123553e8528732d56b79752d2821655
Instruction ID: 21fedfd7d40eaf3c152d8aae12005f2ebf9542b1d43f7fd5a495e0b0baebd74f
Opcode Fuzzy Hash: 366f144f7b9cd3b9d5b81ab1e153f1d79123553e8528732d56b79752d2821655
Instruction Fuzzy Hash: 51612070925108CFEB14EFB6E9887ECBBB2EF44344F18815AD44666251DBB44888CF56

Function 052B44CD Relevance: .2, Instructions: 150COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.3727458401.00000000052B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 052B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_52b0000_LisectAVT_2403002A_135.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d5ab1d5d1945ba035447bfd277b20289b8c612bffd1f6dcb7b98e129c54cd7fa
Instruction ID: f1171bc2e2f712564b3272af9f64e229dc43a099609a0a6df2f73dc53bb34b2b
Opcode Fuzzy Hash: d5ab1d5d1945ba035447bfd277b20289b8c612bffd1f6dcb7b98e129c54cd7fa
Instruction Fuzzy Hash: DB612F70D25148CFEF14EFB6E9887ECBBB2EF44344F18815AD44666251DBB44888CF66

Function 052B4161 Relevance: .1, Instructions: 149COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.3727458401.00000000052B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 052B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_52b0000_LisectAVT_2403002A_135.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bf87897a3fb0d1c8233a290a91e1fa9dda7d7a92412beeb22577e632fdcdbb3f
Instruction ID: 9deaceb84bb2cb010117435bce6f613f31bf48b3291344882fc726a81f435fdd
Opcode Fuzzy Hash: bf87897a3fb0d1c8233a290a91e1fa9dda7d7a92412beeb22577e632fdcdbb3f
Instruction Fuzzy Hash: CC613070D25108CFEB14EFB6E9887ECBBB2FF44344F14815AD446662A1CBB44888CF56

Function 052B41DC Relevance: .1, Instructions: 149COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.3727458401.00000000052B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 052B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_52b0000_LisectAVT_2403002A_135.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9f7502946c679d1c21e3bff4372b67868757e83564bdc5b90fb238daaa23371f
Instruction ID: 31d5c87579e3b79184770fae8e7e2f081cd8ad6ae2feacb7e715d863fe3ffc55
Opcode Fuzzy Hash: 9f7502946c679d1c21e3bff4372b67868757e83564bdc5b90fb238daaa23371f
Instruction Fuzzy Hash: 86613070D25148CFEB14EFB6E9887ECBBB2FF44344F14815AD446A62A1CBB44888CF56

Function 052B42C6 Relevance: .1, Instructions: 149COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.3727458401.00000000052B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 052B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_52b0000_LisectAVT_2403002A_135.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5eef16a1e61710260c34b320bdbf3e6accc96ae3d23f4a93bb94666ee08cee00
Instruction ID: 9d84dc36f01d15154ddf1ecff08604c70f1268ccf6fde93f18382f26a3da16f7
Opcode Fuzzy Hash: 5eef16a1e61710260c34b320bdbf3e6accc96ae3d23f4a93bb94666ee08cee00
Instruction Fuzzy Hash: 11613F70D25108CFEB14EFB6E9887ECBBB2FF44344F14815AD446662A1CBB44888CF66

Function 052B945A Relevance: .1, Instructions: 104COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.3727458401.00000000052B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 052B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_52b0000_LisectAVT_2403002A_135.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b7a3262acf65c519c0aa594a30eae2a44fe7558afc1c8cb2867688fa288c1c15
Instruction ID: 9baa9c1ae687ed4fc6ec5796b6d8d807fd332a7e8dd9cba91d773792a9dbf0b7
Opcode Fuzzy Hash: b7a3262acf65c519c0aa594a30eae2a44fe7558afc1c8cb2867688fa288c1c15
Instruction Fuzzy Hash: 45318230E641459BEB00EB74D485BEDB7B2EF85350F158036E706BB352EAB199818B52

Function 052BB628 Relevance: .1, Instructions: 103COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.3727458401.00000000052B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 052B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_52b0000_LisectAVT_2403002A_135.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6c27d3ffee23e29d84c7e6bc97df8a13331338a836c7f791e5ad452790083e43
Instruction ID: d489f7e4a09ae8da043a4e405269b0d7b6cda6691e30d22d6ff6246ac0c360a1
Opcode Fuzzy Hash: 6c27d3ffee23e29d84c7e6bc97df8a13331338a836c7f791e5ad452790083e43
Instruction Fuzzy Hash: E0314436A281459BEB01A7749C146FE3BBADF85380F05046BD586E7291DAF48D02C7A2

Function 052B4EF0 Relevance: .1, Instructions: 96COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.3727458401.00000000052B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 052B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_52b0000_LisectAVT_2403002A_135.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 006654373b24516779b40b008c61fc7eae90bc2a10e351c4e5af7ab096e14b7b
Instruction ID: 31f05c77d2d8f72c41606933bc7dbf518f8f2a86d4a15394e64f34f2144e9c9b
Opcode Fuzzy Hash: 006654373b24516779b40b008c61fc7eae90bc2a10e351c4e5af7ab096e14b7b
Instruction Fuzzy Hash: 57315E34A25104CFEF04EBA6E988AADB7B7FF88341F154466E806E7291DA719C44CB91

Function 052B4EE0 Relevance: .1, Instructions: 93COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.3727458401.00000000052B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 052B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_52b0000_LisectAVT_2403002A_135.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 77b20dc42f520440807adac47376726ad2c0e10f2fc170b3e3a7d44ed9009e45
Instruction ID: 7b9b7cae1db00815d1366ca1a14606edea82de46ed6d653fb3d4f888d4292c8f
Opcode Fuzzy Hash: 77b20dc42f520440807adac47376726ad2c0e10f2fc170b3e3a7d44ed9009e45
Instruction Fuzzy Hash: 23315D34A151048FDF00DB66E988AEDBBB7FF98341F15846AE806E72D1DA749C44CB91

Function 052B48B6 Relevance: .1, Instructions: 82COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.3727458401.00000000052B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 052B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_52b0000_LisectAVT_2403002A_135.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d04edfcb549801b61ecb89960afb8c0392c644bf02fc1f5dd310a23618a49c54
Instruction ID: 5b5691fbef71f69f52878d4089ef447cbc49561b095305347b4d53c8962b910a
Opcode Fuzzy Hash: d04edfcb549801b61ecb89960afb8c0392c644bf02fc1f5dd310a23618a49c54
Instruction Fuzzy Hash: 5C41D674901219CFCB64EF21ED58BADBBB2FB58301F0081ABD94AA72A4DB705D85CF50

Function 052B9D57 Relevance: .1, Instructions: 81COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.3727458401.00000000052B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 052B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_52b0000_LisectAVT_2403002A_135.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b7f117e822963d5da6b935d901cceb83322386d69f41f0408185bfeb094b98fb
Instruction ID: 157b18b3f06fb06634bc4d66f2658076cdae5d893499d157c198cf81e36aa23a
Opcode Fuzzy Hash: b7f117e822963d5da6b935d901cceb83322386d69f41f0408185bfeb094b98fb
Instruction Fuzzy Hash: 7B212135B001118FEB98BBB5E4282AD7BD79FD8351B15083BDA0AE73E8EE744C414B95

Function 052BAA01 Relevance: .1, Instructions: 80COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.3727458401.00000000052B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 052B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_52b0000_LisectAVT_2403002A_135.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 17e4b8a7c5fd230b7c93a2f8a6caaf6f41f8f0e3278131cb227c62d42cc47fdb
Instruction ID: 2bc8462790d48fdb0a6cf9ed4cbbcbd797913a8f197602b73b38e31ada265fe3
Opcode Fuzzy Hash: 17e4b8a7c5fd230b7c93a2f8a6caaf6f41f8f0e3278131cb227c62d42cc47fdb
Instruction Fuzzy Hash: 2921C9B1B381068AFB14A6B899447EDB7B7EFC8390F400477D706D3280DBF5494546B2

Function 052B4FDE Relevance: .1, Instructions: 79COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.3727458401.00000000052B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 052B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_52b0000_LisectAVT_2403002A_135.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e7f2a1af5093abd31d12c396338eaa7f8be96f16c5a803cbb3c69db310d88e6e
Instruction ID: 0334a49461f71717c0556c2c92b48090f0761a19834f851809ed412ba0722c17
Opcode Fuzzy Hash: e7f2a1af5093abd31d12c396338eaa7f8be96f16c5a803cbb3c69db310d88e6e
Instruction Fuzzy Hash: D5310D34A11104CFDF04EB66EA889ACB7B7FF98351B158566E806F72D1DB749C44CB50

Function 052BA3B0 Relevance: .1, Instructions: 76COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.3727458401.00000000052B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 052B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_52b0000_LisectAVT_2403002A_135.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 096bdc34ec6be052314e8c1fc5dd99be456b47a8bf23b92aaa20aca46fa69044
Instruction ID: fe0e3a88c47304ed8dd14244973dae5f426df97cc52ba71d7515ce2b42c36367
Opcode Fuzzy Hash: 096bdc34ec6be052314e8c1fc5dd99be456b47a8bf23b92aaa20aca46fa69044
Instruction Fuzzy Hash: 5C212435E201158BEB14EBA4E85C6ECB3B2BF84390F844575D50AEB244DBB4AC428B52

Function 0147098D Relevance: .1, Instructions: 73COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.3718339699.0000000001470000.00000040.00000020.00020000.00000000.sdmp, Offset: 01470000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_1470000_LisectAVT_2403002A_135.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7f1b6506f4df49c19d33f60ae1305ebe11b61ed75534ac6331bb62975d5e1141
Instruction ID: 5fb9246ccea5a2c7d41adf87f9a074fc8317cc8e31b0a02cb0b81fcce881460b
Opcode Fuzzy Hash: 7f1b6506f4df49c19d33f60ae1305ebe11b61ed75534ac6331bb62975d5e1141
Instruction Fuzzy Hash: 77214C351093C09FD713CB24C950B56BFB1AF47618F1985EEE4894B6A3C37A9816CB91

Function 052BB070 Relevance: .1, Instructions: 69COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.3727458401.00000000052B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 052B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_52b0000_LisectAVT_2403002A_135.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: baa22e10330a7fa0a80714bd215b31b2db64847dc4e79c9560f9b0cba4c19da5
Instruction ID: b25649225d963ed66ae48c6104e98a2ccfed4d85adcd661de5fc72e56e78c7a5
Opcode Fuzzy Hash: baa22e10330a7fa0a80714bd215b31b2db64847dc4e79c9560f9b0cba4c19da5
Instruction Fuzzy Hash: DA218130A38108CBEB04DAA8D8487EDBBF6EF4C380F558466D516E7240E7F59C41CB95

Function 052B5090 Relevance: .1, Instructions: 63COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.3727458401.00000000052B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 052B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_52b0000_LisectAVT_2403002A_135.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a71ec9dba4eb02265d05309d715426abf2c7d0ee1de77b5892495ee4fcb61006
Instruction ID: 59f433181d69c918b7d374173253c8dfd6cb937b5399cffc4d2f49e1588320ef
Opcode Fuzzy Hash: a71ec9dba4eb02265d05309d715426abf2c7d0ee1de77b5892495ee4fcb61006
Instruction Fuzzy Hash: 0C217F34A2924AEFDB00EBA4E9555ECBBB1FF44304F10845BD942BB291EBB54A05CB52

Function 052BA20A Relevance: .1, Instructions: 63COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.3727458401.00000000052B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 052B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_52b0000_LisectAVT_2403002A_135.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 540dbc2b908df0e688f1cad5c6f2d46413a21d6893fecabaf7923abd65e7dee2
Instruction ID: 7f72145ec460fe12e2b9e223468d2fd2a60817b095f9be289a4cb9767f43134d
Opcode Fuzzy Hash: 540dbc2b908df0e688f1cad5c6f2d46413a21d6893fecabaf7923abd65e7dee2
Instruction Fuzzy Hash: CC210939E2004ADFDB08EFF4E8585DDBBB6EF98340B144026D116AB368DFB04845CB91

Function 052B50A0 Relevance: .1, Instructions: 61COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.3727458401.00000000052B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 052B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_52b0000_LisectAVT_2403002A_135.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ae08b489e9928956118e2e0872df5d3e860472fe10f0330f1f8233fc644d3e05
Instruction ID: d9cf09826aa8473a0ddb1c276e1600597af290f95d4b134a8bbf78f00569e1a9
Opcode Fuzzy Hash: ae08b489e9928956118e2e0872df5d3e860472fe10f0330f1f8233fc644d3e05
Instruction Fuzzy Hash: 04217434A25209DFDB00EF94E9456ECB7B1FF44304F10845BDA42BF290EBB15A45DB92

Function 06202738 Relevance: .1, Instructions: 60COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.3729971915.0000000006200000.00000040.00000800.00020000.00000000.sdmp, Offset: 06200000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6200000_LisectAVT_2403002A_135.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a10c20b1e70de6c62bc1265b2eeb8d683d65bf077456f848ab3e40bbca22938c
Instruction ID: 2aaac99dde46a15792e98c429cf92f6b4e6c83c0876327692d1487c099d79fc6
Opcode Fuzzy Hash: a10c20b1e70de6c62bc1265b2eeb8d683d65bf077456f848ab3e40bbca22938c
Instruction Fuzzy Hash: F111CCB5908341AFD350CF19D841A5BFBE4FB88664F04895EF998D7311D335EA148FA2

Function 014709C4 Relevance: .1, Instructions: 59COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.3718339699.0000000001470000.00000040.00000020.00020000.00000000.sdmp, Offset: 01470000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_1470000_LisectAVT_2403002A_135.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d0e948effbe389985271ec63165f2f1e1a2ffbdb836c30110ed4524cc4996a88
Instruction ID: cddd36887cbaee772cb83b34a2df262db1c6a3bf8a81a4550a8dd83b9432d448
Opcode Fuzzy Hash: d0e948effbe389985271ec63165f2f1e1a2ffbdb836c30110ed4524cc4996a88
Instruction Fuzzy Hash: 1011E4302092809FD715DB14C940B66BBE5EB8A708F24C6AEF5495B763C77BD813C641

Function 052BB060 Relevance: .1, Instructions: 58COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.3727458401.00000000052B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 052B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_52b0000_LisectAVT_2403002A_135.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c3520334fa66d93166a70ddac804649abe770441e3fb583d6c3e90b356800919
Instruction ID: 33d85d5af68deeedc7a59bb830effae0d311152d4bbc6158e3120853a97a2f86
Opcode Fuzzy Hash: c3520334fa66d93166a70ddac804649abe770441e3fb583d6c3e90b356800919
Instruction Fuzzy Hash: 15119135E34108CBEB04DA69E8497E9BBF6EF4C391F008426E516F7340EBB588408B95

Function 052BB670 Relevance: .1, Instructions: 58COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.3727458401.00000000052B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 052B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_52b0000_LisectAVT_2403002A_135.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 41fd170b5f788f9785fc60e3ed65e84bd1bc0d63b4ad7e72519585885802ba3c
Instruction ID: 3dbb1ea520a397dea6c0a395c0bf30c78f3d299484cf25ba6f3d31055c926072
Opcode Fuzzy Hash: 41fd170b5f788f9785fc60e3ed65e84bd1bc0d63b4ad7e72519585885802ba3c
Instruction Fuzzy Hash: E611043AA340059BFF10EA769C546EE77AAEFC8381F150467E586E3240EBE09D018BD1

Function 052BA26C Relevance: .1, Instructions: 54COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.3727458401.00000000052B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 052B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_52b0000_LisectAVT_2403002A_135.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4866a7d73d8ad283037661d05d792c6e590bde5251971497f6a4e900f11a5050
Instruction ID: e2130d041cac175d226745d6e7d08cce7776d578f7482900f2a4f4d896c681d9
Opcode Fuzzy Hash: 4866a7d73d8ad283037661d05d792c6e590bde5251971497f6a4e900f11a5050
Instruction Fuzzy Hash: FD114C34F2005A9FDB08FFF4E4585DDBBB6AF94340B10442AD546AB368DFB048418B91

Function 00EDB8CC Relevance: .1, Instructions: 52COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.3710051555.0000000000ED2000.00000040.00000800.00020000.00000000.sdmp, Offset: 00ED2000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_ed2000_LisectAVT_2403002A_135.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d88f8ad9bb43a7042d76208f99b0cfd9fc717aa4a3926f846b31120cad288462
Instruction ID: 6fd030ebe0ae3d9c18ac26557895d8398f02b840ac6127dddaf5a22bd7d29c08
Opcode Fuzzy Hash: d88f8ad9bb43a7042d76208f99b0cfd9fc717aa4a3926f846b31120cad288462
Instruction Fuzzy Hash: 21110CB5A08301AFD350CF09DC41E57FBE8EB88660F04C91EF99997311D235E9188FA2

Function 052B4D20 Relevance: .1, Instructions: 52COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.3727458401.00000000052B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 052B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_52b0000_LisectAVT_2403002A_135.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fff6b20082097a9065031c6f92e93a29bf040a566a615d792f600c693df54c17
Instruction ID: bfef587f7b6729b1a2b63ccdb9ecaf546f8e7ca6ff09a01e8fa4b0f292e12dd6
Opcode Fuzzy Hash: fff6b20082097a9065031c6f92e93a29bf040a566a615d792f600c693df54c17
Instruction Fuzzy Hash: 981136342291118FCB10BB24A9596987BB29F81300B4681BFD506AB393CFB44C06CBD2

Function 052B99C1 Relevance: .1, Instructions: 51COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.3727458401.00000000052B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 052B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_52b0000_LisectAVT_2403002A_135.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1b7ece83fc3f5880fa41e0dd0f0e1b08391cd84374f93b188cd65afd20be4728
Instruction ID: b66e2b4036cf60507e9b1bcc8e68a269bf47c8004a298177e857ee3c22d36a8d
Opcode Fuzzy Hash: 1b7ece83fc3f5880fa41e0dd0f0e1b08391cd84374f93b188cd65afd20be4728
Instruction Fuzzy Hash: AA11A575224015CBE704BB68E49A3A937A1EF42385F44812BE247AF351CFF68C82C7C2

Function 052B8C58 Relevance: .1, Instructions: 51COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.3727458401.00000000052B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 052B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_52b0000_LisectAVT_2403002A_135.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e74750d32b717dec6da9676750619eb8b325676e28e8239a118499ea5aa9343d
Instruction ID: 1236e9fb420db0ba4f76b469d0d557a8790c9afebcd617ff6ca47bd9739117ec
Opcode Fuzzy Hash: e74750d32b717dec6da9676750619eb8b325676e28e8239a118499ea5aa9343d
Instruction Fuzzy Hash: 54013C31B101088FCF18ABB9E8185ADBBF6EB8C350B10442AE50AEB350EE705C058B90

Function 052B9AF0 Relevance: .1, Instructions: 51COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.3727458401.00000000052B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 052B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_52b0000_LisectAVT_2403002A_135.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cd7eeed81fbc13553b4d4ce8f0229a760828d052a1c0c7dbe8e3defc5b158974
Instruction ID: ec317600fe0d177bbca146111f3c7f303c321410de55fa0c386c5dc6606fc850
Opcode Fuzzy Hash: cd7eeed81fbc13553b4d4ce8f0229a760828d052a1c0c7dbe8e3defc5b158974
Instruction Fuzzy Hash: FD01572941E7C44FC71747705D21A553F711F0329AB1E41EBC0C9CE5F3E2894889D7A2

Function 052BB858 Relevance: .0, Instructions: 50COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.3727458401.00000000052B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 052B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_52b0000_LisectAVT_2403002A_135.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c60032ccaa730f4a4ef8c8c29ffd71bee8fa48b6c3af39c41d83de4491806689
Instruction ID: 7fb9839ded745cbbc6f0f59a35f8e086eea525a18beff4ed878546be41c5559b
Opcode Fuzzy Hash: c60032ccaa730f4a4ef8c8c29ffd71bee8fa48b6c3af39c41d83de4491806689
Instruction Fuzzy Hash: A1018F31B101085FDF18AB79E8586EE7BE6EFC8350B10043AE50AEB394DE719D058791

Function 052B4D30 Relevance: .0, Instructions: 49COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.3727458401.00000000052B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 052B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_52b0000_LisectAVT_2403002A_135.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 527f60a04c867cf95dff23a6a0d801ab8488181b085562bebd7b1d9bb60875d5
Instruction ID: ba2ae163127ea0c49d1d43132adb6345fa17caf927bd3223929a519b3749d9b2
Opcode Fuzzy Hash: 527f60a04c867cf95dff23a6a0d801ab8488181b085562bebd7b1d9bb60875d5
Instruction Fuzzy Hash: F901E535624112CFDB147B25F95969877A3AF81344B06817FD506AB396CFB14C06CBD2

Function 014E0006 Relevance: .0, Instructions: 49COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.3718480063.00000000014E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 014E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_14e0000_LisectAVT_2403002A_135.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ce47e253e61991cade214b3889a8508e76e56a6c7b9dfee3030ff4de8c2d3b63
Instruction ID: dc013ea8fd70137bdf64b6e79def21b7b5196151b7b19b943a6186fb0cac47a3
Opcode Fuzzy Hash: ce47e253e61991cade214b3889a8508e76e56a6c7b9dfee3030ff4de8c2d3b63
Instruction Fuzzy Hash: 2E01285148EBC25FC35386741C266A67FB16D5312434E89DBC4D58A8A3E20D494A87A3

Function 014705E0 Relevance: .0, Instructions: 47COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.3718339699.0000000001470000.00000040.00000020.00020000.00000000.sdmp, Offset: 01470000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_1470000_LisectAVT_2403002A_135.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 19917af08abe9649ead7602706a4638914e90e0746d0e38a693ae7c503e6e138
Instruction ID: f8387c4784910b24fae85339fc73f1662abdab0c7d7bd0d4708452abdc25d03f
Opcode Fuzzy Hash: 19917af08abe9649ead7602706a4638914e90e0746d0e38a693ae7c503e6e138
Instruction Fuzzy Hash: BC01DBB550D3806FC7128B169C41863FFB8DF86630709C49FEC498B653D2256905C772

Function 052BA2C6 Relevance: .0, Instructions: 47COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.3727458401.00000000052B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 052B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_52b0000_LisectAVT_2403002A_135.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dcbee521d30c90e35b6275a128a42c096b1fd78e55ae80b9fb23e89d174017ff
Instruction ID: 1dad5ca44c912fb5617f5f4616634516ddcc1541229bee5633c686d1f7aba6af
Opcode Fuzzy Hash: dcbee521d30c90e35b6275a128a42c096b1fd78e55ae80b9fb23e89d174017ff
Instruction Fuzzy Hash: 59112A34F1005A9FEB08FFF4E4585DD7BB6AFA4340B10842A954AAB368DFB09C458B91

Function 052B73A0 Relevance: .0, Instructions: 44COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.3727458401.00000000052B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 052B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_52b0000_LisectAVT_2403002A_135.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b86df026dd55c6288f9421983338b1b3a96ffdfba56c3b5e4aecb410c477b289
Instruction ID: 974166f6fd18f80f167923eebc4317ba2294d87e7bdba82bdc11c976d0e9b3c2
Opcode Fuzzy Hash: b86df026dd55c6288f9421983338b1b3a96ffdfba56c3b5e4aecb410c477b289
Instruction Fuzzy Hash: 1601753023D541CFEB14EB29E8042A93FB5EF80392F094C77E447E65A1D7E4888587A3

Function 052BB0BD Relevance: .0, Instructions: 40COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.3727458401.00000000052B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 052B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_52b0000_LisectAVT_2403002A_135.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b0b36d4cc18f1d9af9239d20e895d496a2c9020256dc506ceda4211b8937bfb4
Instruction ID: f455b43345345ee3acaabc9437dca1a88ecd39180d2fc56b424ed00697c79002
Opcode Fuzzy Hash: b0b36d4cc18f1d9af9239d20e895d496a2c9020256dc506ceda4211b8937bfb4
Instruction Fuzzy Hash: 5301FF31A34104CBEB04EBA8E94D7ECBBF2EF48391F458466E516E6240DBF58C40CB55

Function 052B8EA9 Relevance: .0, Instructions: 38COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.3727458401.00000000052B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 052B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_52b0000_LisectAVT_2403002A_135.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f7a876258ebf3d83064c126f4ee6735a4d646e4bbb7828ad769262d160f7be59
Instruction ID: 31f6ff3a46e1b060220bf702fbc553af3ad8bf8ff546500e82c46569ae9c0269
Opcode Fuzzy Hash: f7a876258ebf3d83064c126f4ee6735a4d646e4bbb7828ad769262d160f7be59
Instruction Fuzzy Hash: DFF06871E112088FCF50EFB9AC456EFBBF5EB89310F50407BD509E3240E67185458B91

Function 01470A80 Relevance: .0, Instructions: 31COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.3718339699.0000000001470000.00000040.00000020.00020000.00000000.sdmp, Offset: 01470000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_1470000_LisectAVT_2403002A_135.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9365eb27b8991b4c0bc16ede74ba678b5e17e7d95a1e1320e75ccca444366dd1
Instruction ID: e4ce2d1601ad811c55d8d06e1a0332983f0ae5690fcb27eee687f858f0b850c8
Opcode Fuzzy Hash: 9365eb27b8991b4c0bc16ede74ba678b5e17e7d95a1e1320e75ccca444366dd1
Instruction Fuzzy Hash: 48F01D35144644DFC706CF44D540B56FBA2FB89718F24C6AEE94917762C737D813DA81

Function 01470606 Relevance: .0, Instructions: 27COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.3718339699.0000000001470000.00000040.00000020.00020000.00000000.sdmp, Offset: 01470000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_1470000_LisectAVT_2403002A_135.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9f68247a65c4b66c1796e02da3a06f39b3230261f2d0f770c5c28fac318c02f9
Instruction ID: 78ee7e843d1f09b15c03c3696bab3070e056650f00e34ed15f235de25a0f3216
Opcode Fuzzy Hash: 9f68247a65c4b66c1796e02da3a06f39b3230261f2d0f770c5c28fac318c02f9
Instruction Fuzzy Hash: 5FE092B6A046044B9650CF0BEC42452F7D8EB84630718C07FDC0D8B701E236B515CAA5

Function 0620204F Relevance: .0, Instructions: 26COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.3729971915.0000000006200000.00000040.00000800.00020000.00000000.sdmp, Offset: 06200000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6200000_LisectAVT_2403002A_135.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6603d09dabd49ca0536a048da47506e722a4b5bb15557e735a6d724d0ad16272
Instruction ID: 8712b21bc338bce75fb3c866503649da08b2cda1857f165ba11ed8d00ee097e2
Opcode Fuzzy Hash: 6603d09dabd49ca0536a048da47506e722a4b5bb15557e735a6d724d0ad16272
Instruction Fuzzy Hash: 24E0D8F294020467D2109F06AC46F23FBD8DB40930F04C457EE091B342D1767614CAE1

Function 062027A3 Relevance: .0, Instructions: 26COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.3729971915.0000000006200000.00000040.00000800.00020000.00000000.sdmp, Offset: 06200000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6200000_LisectAVT_2403002A_135.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8187cf4c76937408840f5eb87cd819b836bf55a19c602fb61753ef25ed379736
Instruction ID: b7928a132535d0bdf1f7f72010ddc8af9d0cdf7b58f35763c2e6862bf351fe11
Opcode Fuzzy Hash: 8187cf4c76937408840f5eb87cd819b836bf55a19c602fb61753ef25ed379736
Instruction Fuzzy Hash: 54E0DFF2A4030467D2108F06AC46F22FBD8DB84A30F08C46BEE081B342E176B6248AE1

Function 00EDB91B Relevance: .0, Instructions: 26COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.3710051555.0000000000ED2000.00000040.00000800.00020000.00000000.sdmp, Offset: 00ED2000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_ed2000_LisectAVT_2403002A_135.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3c26b8d7aadc83549656db05df75734ba209f22905602b4b5bf3da34a729ed7f
Instruction ID: bea6043a854d0bdec4fa6681826994715c61aaa273212e5a5c184507bda5b538
Opcode Fuzzy Hash: 3c26b8d7aadc83549656db05df75734ba209f22905602b4b5bf3da34a729ed7f
Instruction Fuzzy Hash: F8E0DFB2A4020467D2108F06AC46F22FBECDB40A30F08C56BEE091B342E176B6148AF1

Function 052BB208 Relevance: .0, Instructions: 25COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.3727458401.00000000052B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 052B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_52b0000_LisectAVT_2403002A_135.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 57255b46f777e26e7e969b07bea173ce9efd36eccd214cb77a24247a1040432e
Instruction ID: cf2a0976e3716854e6dcf03564a7d29426d1d7ea64d33e23d637743c0d495b22
Opcode Fuzzy Hash: 57255b46f777e26e7e969b07bea173ce9efd36eccd214cb77a24247a1040432e
Instruction Fuzzy Hash: 60E0DF35919248CFDF1297A0A8554FC3F34EE5628171001EBD88DD2A92D6A1490AC2C1

Function 052BA08D Relevance: .0, Instructions: 21COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.3727458401.00000000052B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 052B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_52b0000_LisectAVT_2403002A_135.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a365729b73be30c2840d15e5d8511e8511bd69b07439d134b7ceb66737fc5223
Instruction ID: 79ed7ae1184939ac5d8ae43655bbdcc06883ef793f79733fdf2a6bce8e8df25f
Opcode Fuzzy Hash: a365729b73be30c2840d15e5d8511e8511bd69b07439d134b7ceb66737fc5223
Instruction Fuzzy Hash: 20E01A30F201668BFB14BBB4D45C2EC7BA9AF557C0B054527D68AA7244DFB488818B92

Function 052B6FE0 Relevance: .0, Instructions: 21COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.3727458401.00000000052B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 052B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_52b0000_LisectAVT_2403002A_135.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4bd88be6da90a0b084dac48b7fd1539f98548c7923e44d03d338092bc76d6627
Instruction ID: 9fe477c78d716ea8c5733b5a458d227cc25e410ae437c2d579548aebd1bf33fa
Opcode Fuzzy Hash: 4bd88be6da90a0b084dac48b7fd1539f98548c7923e44d03d338092bc76d6627
Instruction Fuzzy Hash: B5E09231609104CFDB10DBB6F8482ACBBB1EF84311F14403FE105E3692C7318405CB12

Function 052B452A Relevance: .0, Instructions: 19COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.3727458401.00000000052B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 052B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_52b0000_LisectAVT_2403002A_135.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bffcf2c7cc63cb81cfd834068b7996eeca0022a5672944c100aef6e91726adb7
Instruction ID: da44691e40d1e2c1cb3e7db4d22ace4a58f733374ce56dd5c4f226a40cf66de5
Opcode Fuzzy Hash: bffcf2c7cc63cb81cfd834068b7996eeca0022a5672944c100aef6e91726adb7
Instruction Fuzzy Hash: 7CE03034A11214CFDB54BF65D8583AD7BB2EF84301F40005AD50AB6290CFB41D448F51

Function 052BA8E0 Relevance: .0, Instructions: 19COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.3727458401.00000000052B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 052B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_52b0000_LisectAVT_2403002A_135.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2f8542f0cc8e01fca6fcba17ba853b6269722e09550e1be7dc84ea89eb182fd9
Instruction ID: cb4ac38c09b83a135265d91d42da1de2f6c3aeb8ca24851ccde466015e205bc6
Opcode Fuzzy Hash: 2f8542f0cc8e01fca6fcba17ba853b6269722e09550e1be7dc84ea89eb182fd9
Instruction Fuzzy Hash: 08D0123688D3899AC72243B4682289E3F245D6228DB2905EFDC4999562E5AB8196CA41

Function 052B312F Relevance: .0, Instructions: 18COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.3727458401.00000000052B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 052B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_52b0000_LisectAVT_2403002A_135.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0db8e48845536de046e7cb2e116c65c07e3165890c053fdbb7c8974540a030b3
Instruction ID: 71f3c31864ced3fd3d283330a8db5306e350ad30d6ec2a6bbacde24fa460d32d
Opcode Fuzzy Hash: 0db8e48845536de046e7cb2e116c65c07e3165890c053fdbb7c8974540a030b3
Instruction Fuzzy Hash: B5D05E36A38004EFAB04D788F8445FDB3BEEFA83B5B080463E506B7600C3F06E198A51

Function 052B8D60 Relevance: .0, Instructions: 18COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.3727458401.00000000052B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 052B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_52b0000_LisectAVT_2403002A_135.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cfad9dcdd4d8f0a5472f6b9bc3a613044c5f2564a3bbba16a053904dbada488d
Instruction ID: 2ff16e5db0d9be63ed8b2567897c5e5049b32917747c1eab8b6b502e3e52ff36
Opcode Fuzzy Hash: cfad9dcdd4d8f0a5472f6b9bc3a613044c5f2564a3bbba16a053904dbada488d
Instruction Fuzzy Hash: B7D05E3A05D38AAECF23467068105E87F352D3326136400B7D5888A963C2A6845AC291

Function 052BB828 Relevance: .0, Instructions: 18COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.3727458401.00000000052B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 052B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_52b0000_LisectAVT_2403002A_135.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ca0eda11f35e7ba9c6c015f159a52b504fc2445518b0722beccc1b4d29cddc46
Instruction ID: 073d05cd73bea220d25bd0b03d5720df0456223d26e8eb05c2be4f790cb3e119
Opcode Fuzzy Hash: ca0eda11f35e7ba9c6c015f159a52b504fc2445518b0722beccc1b4d29cddc46
Instruction Fuzzy Hash: 07D0A73140EA858FCB1217245C154E97F30AD2225030442B7E5888D6B3D2640807C6D2

Function 052B8C28 Relevance: .0, Instructions: 18COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.3727458401.00000000052B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 052B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_52b0000_LisectAVT_2403002A_135.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e61ca56b4f212dbe6026f088ef964105b3d39582d7dd5387bbaf3b178ab3a647
Instruction ID: a0ddfa40dff8ba79f257cc1daad5a91cf7152a8c2ec8353afc658669e915f713
Opcode Fuzzy Hash: e61ca56b4f212dbe6026f088ef964105b3d39582d7dd5387bbaf3b178ab3a647
Instruction Fuzzy Hash: 97D0A96A06F38CAEEE0207652C508EA3F6DD8232D23A440D3E48CD7012C0B5880B82A9

Function 052BB228 Relevance: .0, Instructions: 18COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.3727458401.00000000052B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 052B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_52b0000_LisectAVT_2403002A_135.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0e0d74db4280d24de07c6f391df735a0416faa69b16d09377324b3a00fa4c543
Instruction ID: 4570503db8b52f9f600d1d61f4a7c06fe6cf08b7f4ce0e57353616cfbc42c17b
Opcode Fuzzy Hash: 0e0d74db4280d24de07c6f391df735a0416faa69b16d09377324b3a00fa4c543
Instruction Fuzzy Hash: 94D02E31D192088FCF10CBB0E94A2FC7F64EF12300F2000EAC80AA3782E6A08D05C781

Function 052B8E48 Relevance: .0, Instructions: 18COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.3727458401.00000000052B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 052B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_52b0000_LisectAVT_2403002A_135.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: eef2d6283ab660af59253657be02d1f05877d70de08f2a6019eee8a19d2920ab
Instruction ID: 2a032c02e620efdfe126a1e86e4b1ab4e30fba850dc43bc65ffc5c924c3b3169
Opcode Fuzzy Hash: eef2d6283ab660af59253657be02d1f05877d70de08f2a6019eee8a19d2920ab
Instruction Fuzzy Hash: 8BD0222649C3CC0ECF1212203CA26E43FBCCCB3A08BA619D7E08CC6663E1C1C90B4282

Function 052B7250 Relevance: .0, Instructions: 16COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.3727458401.00000000052B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 052B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_52b0000_LisectAVT_2403002A_135.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 11df803d584f9935713bdc19e1555a869bcb882d01a84f9399204fa4c9f5c97f
Instruction ID: aa0492dd1666f49c25fb29008662eaa28544c2d859b56a1b748159057679d588
Opcode Fuzzy Hash: 11df803d584f9935713bdc19e1555a869bcb882d01a84f9399204fa4c9f5c97f
Instruction Fuzzy Hash: ABE0EC3200C2CE6ECF038FA05C118EA7F31AF162007044587F99185072C23E8635EBA2

Function 052B56F8 Relevance: .0, Instructions: 16COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.3727458401.00000000052B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 052B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_52b0000_LisectAVT_2403002A_135.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2111ca02f868db81ac9fa201d8decbdd0d30e6b91b5a896477b95dff871205db
Instruction ID: 134bee64bdf5ceaf81dfc0d2bc2b89a282ac5d7acbbccbbe9b70be1070c01735
Opcode Fuzzy Hash: 2111ca02f868db81ac9fa201d8decbdd0d30e6b91b5a896477b95dff871205db
Instruction Fuzzy Hash: 8EE0BF74B25105CFEB44DFE9E5886ACB7B2EF44385F104415D407DA254EFB859488B51

Function 00EC23F4 Relevance: .0, Instructions: 15COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.3708715920.0000000000EC2000.00000040.00000800.00020000.00000000.sdmp, Offset: 00EC2000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_ec2000_LisectAVT_2403002A_135.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7720e21d4ca66c360ac0af66f52c2ec83d4b42b46eba6e2bf583f0b343485daa
Instruction ID: 60194570bc696281f507443a246c38a9d2ff58c315ea521d1286b52c5da2d5d5
Opcode Fuzzy Hash: 7720e21d4ca66c360ac0af66f52c2ec83d4b42b46eba6e2bf583f0b343485daa
Instruction Fuzzy Hash: D7D05E7A205A814FD32A9A1CC2A4F9537E4BB51718F4A44FDA8408B763C769D982E600

Function 052B4573 Relevance: .0, Instructions: 15COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.3727458401.00000000052B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 052B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_52b0000_LisectAVT_2403002A_135.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 051f3c18bd514f4827a1e4c2bdd55bca3cdd21fed0983b3b0b4e30b95a8503a7
Instruction ID: 2595755aff3b86064725c58446b3df6c5b335bb9c63dc4f8d810e1091873a548
Opcode Fuzzy Hash: 051f3c18bd514f4827a1e4c2bdd55bca3cdd21fed0983b3b0b4e30b95a8503a7
Instruction Fuzzy Hash: 64E07571929604CFDB14AFA9E98859CFFB2EF44301F10412AA402A62A1CFB408858F40

Function 052B70F7 Relevance: .0, Instructions: 15COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.3727458401.00000000052B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 052B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_52b0000_LisectAVT_2403002A_135.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8c3ac7fcff1bd718eff96f2849462bd00db526e915274310ebd109bf85c7225e
Instruction ID: ef70935cd6d6eb8eb95c3e8e297f3629085ede5dd118d708f724aac5b96cb842
Opcode Fuzzy Hash: 8c3ac7fcff1bd718eff96f2849462bd00db526e915274310ebd109bf85c7225e
Instruction Fuzzy Hash: 66D05E210CE3E82EC30393341C614E97FB40C23010B084AEFD1C5C68A3C11E8049CB12

Function 052BAFD3 Relevance: .0, Instructions: 15COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.3727458401.00000000052B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 052B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_52b0000_LisectAVT_2403002A_135.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b5896e715e1d5dd4d83a021ffd9761aa796c0f898566c52f7fb519382bb114c4
Instruction ID: 6c3acbc4cdf1f9ccf670fc2ffcd8254517fd213af185e1ad313b414c6dca2573
Opcode Fuzzy Hash: b5896e715e1d5dd4d83a021ffd9761aa796c0f898566c52f7fb519382bb114c4
Instruction Fuzzy Hash: 20D0173600414DAECF128EA09C02AED3F22AF24340F14411AFE0404122D3728532EB91

Function 014E05C7 Relevance: .0, Instructions: 15COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.3718480063.00000000014E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 014E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_14e0000_LisectAVT_2403002A_135.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3736235ed3c31523470569377ac4ddef5c03502b43352f20e83aba1391780e90
Instruction ID: 7508b46a2ca590b115cca5d84c4de0e47dec0e99c6cb207f741652b694d88664
Opcode Fuzzy Hash: 3736235ed3c31523470569377ac4ddef5c03502b43352f20e83aba1391780e90
Instruction Fuzzy Hash: 7FE0927494512ACBDBA0CA08C995BEDB3F1FB48309F5051EAE12CAA695CB746E85CF01

Function 014E119F Relevance: .0, Instructions: 15COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.3718480063.00000000014E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 014E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_14e0000_LisectAVT_2403002A_135.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8e4dbe1957184437def6d22c8f0cc24667f79d991430a6fa277eaa27f8680e6b
Instruction ID: 7d23b0cc84a4a8ddc7baf08faaf69c6d0b89839f8102278fc8983be4f6313b29
Opcode Fuzzy Hash: 8e4dbe1957184437def6d22c8f0cc24667f79d991430a6fa277eaa27f8680e6b
Instruction Fuzzy Hash: 16E07E7494102ACBDBA1CA08C894AE9B7B1FB49308F1081E6D02DAA661CB319E968F00

Function 014E36AC Relevance: .0, Instructions: 15COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.3718480063.00000000014E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 014E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_14e0000_LisectAVT_2403002A_135.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4c73d22f30b135d44bfc1fea536cfdfc72805a1de3c41847a9a3c573ceb4015e
Instruction ID: 2085bde8c91377cbc7b2fdb733a5971fb903b3e5eecb9c2512b16b0c7fa32fa7
Opcode Fuzzy Hash: 4c73d22f30b135d44bfc1fea536cfdfc72805a1de3c41847a9a3c573ceb4015e
Instruction Fuzzy Hash: 15E08C38A4011ACFD764CF24DC58BF973B1FB48309F0040E6E45AAA6A0CB759E848F01

Function 00EC23BC Relevance: .0, Instructions: 14COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.3708715920.0000000000EC2000.00000040.00000800.00020000.00000000.sdmp, Offset: 00EC2000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_ec2000_LisectAVT_2403002A_135.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e5e1f3efb22f974eee52606f93a9d6fd0d332a24a56fb5aac216e07cd2e6ff65
Instruction ID: 9f8ec49b879a31ddcc7e633e8aeac025e73706939e2176258adf8ec5ab44830c
Opcode Fuzzy Hash: e5e1f3efb22f974eee52606f93a9d6fd0d332a24a56fb5aac216e07cd2e6ff65
Instruction Fuzzy Hash: 94D05E343006C24BC725DA0CC6D4F5933E4AB40718F0644ECAC108B262C7A9D8C1DA00

Function 052BB598 Relevance: .0, Instructions: 14COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.3727458401.00000000052B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 052B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_52b0000_LisectAVT_2403002A_135.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f95533bcc21ec0c465627336afaaecd3f4a5a57214c384be375d09a9706ac4bf
Instruction ID: 8a5d3d14fc72eae0c7f8ee2d2b67fe613be7541f420e51b2ec99e26e1747b76b
Opcode Fuzzy Hash: f95533bcc21ec0c465627336afaaecd3f4a5a57214c384be375d09a9706ac4bf
Instruction Fuzzy Hash: D1D0A93A00438CBFCB020F60DC01A8A3FB5EF0234870890ABF94888222C232A572EB54

Function 052B9BF8 Relevance: .0, Instructions: 14COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.3727458401.00000000052B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 052B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_52b0000_LisectAVT_2403002A_135.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a5934600f6407cd94b9d13911ec1faed87b7b391a510d11507b2a039499f59f2
Instruction ID: 7cf54650a8c1a0bc8d2f77c2ef5b7d94308a210b1e0d0465f9d39d6026af5a87
Opcode Fuzzy Hash: a5934600f6407cd94b9d13911ec1faed87b7b391a510d11507b2a039499f59f2
Instruction Fuzzy Hash: CBC08C3A85E21496CB214AB8AC513D57BA09B51214F2608B9D58C86B43D1EFE04B8AC0

Function 052B5228 Relevance: .0, Instructions: 14COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.3727458401.00000000052B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 052B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_52b0000_LisectAVT_2403002A_135.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 976f6f103e3e4180aba5638ac2b103b3528da76124db1f97f8b420e4dbc84015
Instruction ID: 7b48d43741bdfd985f4bef28462754299d96e48caf045fcc219ed691940126bc
Opcode Fuzzy Hash: 976f6f103e3e4180aba5638ac2b103b3528da76124db1f97f8b420e4dbc84015
Instruction Fuzzy Hash: E4D0222060E3810FCB22D6B428134A83FB10EAA24030400FFD98EC76A3C516180A9B02

Function 052BB929 Relevance: .0, Instructions: 13COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.3727458401.00000000052B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 052B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_52b0000_LisectAVT_2403002A_135.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7b1f17dc7f132f68a9dad8c7315449b1925d5f53423c16762ebeb070659a84e9
Instruction ID: af8208593c2629b66abc34617118e5789ce080438555b1edb9ef805690e5e80e
Opcode Fuzzy Hash: 7b1f17dc7f132f68a9dad8c7315449b1925d5f53423c16762ebeb070659a84e9
Instruction Fuzzy Hash: 9CC0127308060C67CF011A54C806B857B7AE760214FD040A6A54804A14D73BD0629644

Function 052B5560 Relevance: .0, Instructions: 13COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.3727458401.00000000052B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 052B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_52b0000_LisectAVT_2403002A_135.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 43fefca79ddc33d6009dc80099ad8c3ac353848df461363dd88de632f824c8e4
Instruction ID: e5f2879c261a2cbcf097ac0747e6dcad1b630168b15fbe0b0f2ab8aef4cd5785
Opcode Fuzzy Hash: 43fefca79ddc33d6009dc80099ad8c3ac353848df461363dd88de632f824c8e4
Instruction Fuzzy Hash: F4D0C95194E3C46EEB0362B018256946F200A231A0F1942CBD0848B8A7904908099A12

Function 052B98E8 Relevance: .0, Instructions: 13COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.3727458401.00000000052B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 052B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_52b0000_LisectAVT_2403002A_135.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 44a809a83880e30b82c530d2b5633ef6c0a959d1df235eb6ae037d5600576963
Instruction ID: 826b7158d429f499a2adbc9f25eda429d54dbe9d4c52d90d457d2d460b63c91a
Opcode Fuzzy Hash: 44a809a83880e30b82c530d2b5633ef6c0a959d1df235eb6ae037d5600576963
Instruction Fuzzy Hash: 96C080314CF3484FCB2301741D037D17B9C59421053D540E3D5C8C6753F195646645D2

Function 052B7360 Relevance: .0, Instructions: 13COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.3727458401.00000000052B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 052B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_52b0000_LisectAVT_2403002A_135.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b3c179602cbb1f3719dca57cdff564298982f6a6ef950ad17903bd3138cb0524
Instruction ID: 19ecd0caffba1ddda35b9919988a5dde8e5b1e053416381c17d605c8660544ed
Opcode Fuzzy Hash: b3c179602cbb1f3719dca57cdff564298982f6a6ef950ad17903bd3138cb0524
Instruction Fuzzy Hash: 28D0223088E3C92FC30353380CA00C83F700C3314830802EFC444C60A3C22E0065CB12

Function 052BAF70 Relevance: .0, Instructions: 13COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.3727458401.00000000052B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 052B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_52b0000_LisectAVT_2403002A_135.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fe13cec1634effdf64c64f78953a1ad65f92e94b3348535dc0ce74ef43958063
Instruction ID: 39f215d92bca42d858c58777b28c7a73cd69c64521b85f653aafc38bf7cfcdbf
Opcode Fuzzy Hash: fe13cec1634effdf64c64f78953a1ad65f92e94b3348535dc0ce74ef43958063
Instruction Fuzzy Hash: 4CC08C6A84D3C69ACF2182B428814D93F200A762A8B2826A3C98885893A1ED8056C281

Function 052B8F48 Relevance: .0, Instructions: 13COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.3727458401.00000000052B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 052B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_52b0000_LisectAVT_2403002A_135.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: aee7ee02a030b314d2b8649f621c466cd17905148f838b5e74ce930ab0900bb9
Instruction ID: 743b465be63e7d8d3832fa02d79c88406678f3a574fe5ffcc793fea26daceb9e
Opcode Fuzzy Hash: aee7ee02a030b314d2b8649f621c466cd17905148f838b5e74ce930ab0900bb9
Instruction Fuzzy Hash: 11C0126641F3C54BC73242B06C123D47F555F13249F1908EA854845A93E1AA8045C785

Function 052B4E70 Relevance: .0, Instructions: 13COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.3727458401.00000000052B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 052B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_52b0000_LisectAVT_2403002A_135.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 780842f1b85b7ce336ea9e2426a090768505ed5541c78827081ae47be962cebc
Instruction ID: 2967bb4fa54b768d7f8cb725d80539b84cd9a02f18132d8b3ecbc439b7cc821d
Opcode Fuzzy Hash: 780842f1b85b7ce336ea9e2426a090768505ed5541c78827081ae47be962cebc
Instruction Fuzzy Hash: 50D0C92188E7D10FCB23937458212A83F704E93189B9946FFC4D689DE7D05E0416D743

Function 052BA558 Relevance: .0, Instructions: 12COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.3727458401.00000000052B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 052B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_52b0000_LisectAVT_2403002A_135.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: eeadad31206175ea30e3d26e1e4ecebdc975ee9531f7a187249304d26e92dcd3
Instruction ID: 5facc29ef34d5059da0af3441d7658069d91994552fe2cb5fb5c5cff83cb14a8
Opcode Fuzzy Hash: eeadad31206175ea30e3d26e1e4ecebdc975ee9531f7a187249304d26e92dcd3
Instruction Fuzzy Hash: 05C02B630AE7CC4EC71222981C0B7E33B1D4C921013C800D3A48CD6107F084670102EF

Function 052B9C38 Relevance: .0, Instructions: 12COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.3727458401.00000000052B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 052B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_52b0000_LisectAVT_2403002A_135.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d1d2ad2f266f1a4ffc39c89a7d1a4631cd78e5a2062ae70fb6699b2fe427fedc
Instruction ID: aa4dfb14eb18088760a6aa8c67cdf5755f35efa7217791975e8e47a461b9bc40
Opcode Fuzzy Hash: d1d2ad2f266f1a4ffc39c89a7d1a4631cd78e5a2062ae70fb6699b2fe427fedc
Instruction Fuzzy Hash: 27C0803344D34C6FC3033671C8015463F69CE5325074504F7D8044D612D677A595D7D5

Function 052BA8C1 Relevance: .0, Instructions: 12COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.3727458401.00000000052B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 052B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_52b0000_LisectAVT_2403002A_135.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 60eaffd9fe7b8751d44716348f753f9863b36ee2e062994da4e24aed84604f0c
Instruction ID: 06e14f22d54ecab609ba8d46edb0cbdb8c59f60bc50b6e66cd703b1260f4e24d
Opcode Fuzzy Hash: 60eaffd9fe7b8751d44716348f753f9863b36ee2e062994da4e24aed84604f0c
Instruction Fuzzy Hash: 42C0803645D6D48DC7170370D81168D3F608731188F5851BEC0C5CED56D55DC5C5C500

Function 052B9BD9 Relevance: .0, Instructions: 12COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.3727458401.00000000052B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 052B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_52b0000_LisectAVT_2403002A_135.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c8ad44f4b702ff8f2b52aeb3d6193424c543c170c3f3fe0fbffb559ccb892582
Instruction ID: e66abfc1b93ab7147d7f6a98e35c1636f30b7f6dfbf9efb3eb2aed72f1a0b406
Opcode Fuzzy Hash: c8ad44f4b702ff8f2b52aeb3d6193424c543c170c3f3fe0fbffb559ccb892582
Instruction Fuzzy Hash: A0C0803105E3C545D732837848213D4BF648F13245F1409EDC9884F743C056504ED781

Function 052B8E68 Relevance: .0, Instructions: 12COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.3727458401.00000000052B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 052B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_52b0000_LisectAVT_2403002A_135.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 69ccda18be2a468dba1339ba121df4bf6820456f013f14e200df0f176e8effec
Instruction ID: 8689aa7b3924d87fcff7c670f1d6f71b5036d31974bef6a42915a3ebb4fd74c3
Opcode Fuzzy Hash: 69ccda18be2a468dba1339ba121df4bf6820456f013f14e200df0f176e8effec
Instruction Fuzzy Hash: F5C02B0902E3880ECA0203112C13A803B3CCC6310275800D7E04CD5A03F044E40501EB

Function 052B7260 Relevance: .0, Instructions: 12COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.3727458401.00000000052B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 052B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_52b0000_LisectAVT_2403002A_135.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 84dd28d8e90577b0fc765683232d73a7ef30c4575547862ab7048d97024b370a
Instruction ID: 4d51cb51bf28111cc021703e9fbd2343fec7fe464054aecac32e940386739eb3
Opcode Fuzzy Hash: 84dd28d8e90577b0fc765683232d73a7ef30c4575547862ab7048d97024b370a
Instruction Fuzzy Hash: 5FD0EA3600424EBB8F429EE19D01CEB7F6AAB19250B048406FE6445021C73BD675BBA5

Function 014EAC40 Relevance: .0, Instructions: 12COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.3718480063.00000000014E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 014E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_14e0000_LisectAVT_2403002A_135.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b08a4464d763a820bd2780aa00e1c9a0b2dfab98e128928ac81bf20b4570e2ef
Instruction ID: 3054fcc34220d6cee9bf40d1bf1b64c2256ff48a4e78ce14ebb127f3df31f735
Opcode Fuzzy Hash: b08a4464d763a820bd2780aa00e1c9a0b2dfab98e128928ac81bf20b4570e2ef
Instruction Fuzzy Hash: F2C08C2130112417C20832AD740569E328EC786362F0010ABEA09B3381CD464E0207EA

Function 014E3355 Relevance: .0, Instructions: 12COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.3718480063.00000000014E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 014E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_14e0000_LisectAVT_2403002A_135.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f981bb0d340d9b7f36e2395ebfc40469cc5f63971664fab6e719d4870ef7f28d
Instruction ID: 5311093fb719ea12f5a28339c79094ab90cf82ff7e069b3dad441d29289885b1
Opcode Fuzzy Hash: f981bb0d340d9b7f36e2395ebfc40469cc5f63971664fab6e719d4870ef7f28d
Instruction Fuzzy Hash: 0AD01230900219CBDB16CF21CD54798B7F5AB98301F4084DA800E6A550CA305B858F00

Function 052BA901 Relevance: .0, Instructions: 11COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.3727458401.00000000052B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 052B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_52b0000_LisectAVT_2403002A_135.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8a583c2dd95ed0db78dcbaa6fa4fce29bb929c2e65879c219cc93a929df2c065
Instruction ID: a23f596abd866795bc1b245d911bdf43aa032d134d87d4204030ccff14dcaebb
Opcode Fuzzy Hash: 8a583c2dd95ed0db78dcbaa6fa4fce29bb929c2e65879c219cc93a929df2c065
Instruction Fuzzy Hash: 3BC0803648D684DEC7114130EC1110C3F704621159B5541FEC4D5D5853D55F8452C601

Function 052B5070 Relevance: .0, Instructions: 11COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.3727458401.00000000052B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 052B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_52b0000_LisectAVT_2403002A_135.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0ac37dd7cfcc787777f8ff9574fc73446a625d343a3e65c3ce44a8ad8fe20d9b
Instruction ID: d84161851bec1f655d2ba36e07cdd8745c58707d7eb0fd1effbee4160a0b1732
Opcode Fuzzy Hash: 0ac37dd7cfcc787777f8ff9574fc73446a625d343a3e65c3ce44a8ad8fe20d9b
Instruction Fuzzy Hash: 41C04C6584E7C0BFC7032B716C741443F31DA1315230A46D7D485E59B39526881DC766

Function 052B6358 Relevance: .0, Instructions: 11COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.3727458401.00000000052B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 052B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_52b0000_LisectAVT_2403002A_135.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bc95f115874ada0c4165be0787249fb1b5ab08eee0746ff425d0a57f8692b553
Instruction ID: 20bfe3cced73ab7bdde565e8563325be9dfe1e7245db1337f93c4cd9f064919b
Opcode Fuzzy Hash: bc95f115874ada0c4165be0787249fb1b5ab08eee0746ff425d0a57f8692b553
Instruction Fuzzy Hash: 12C04C6595E3D45FCF13637418B848ABF704C53190B1946EFC4C9C98E3D09D5859CB13

Function 052B579E Relevance: .0, Instructions: 11COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.3727458401.00000000052B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 052B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_52b0000_LisectAVT_2403002A_135.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8cc98690631f933d314d996de0c35bd486702a923f97284723354b6d806068d0
Instruction ID: 4230eb3894cacb0c6265dcb5bfb4ead7ee736cd2cb3b97aca51b783d758b4315
Opcode Fuzzy Hash: 8cc98690631f933d314d996de0c35bd486702a923f97284723354b6d806068d0
Instruction Fuzzy Hash: D5D09274B26204CFEB04CFA9E5881ACBBB2EF04356F204426D402A6294DF785A489A12

Function 052BB238 Relevance: .0, Instructions: 11COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.3727458401.00000000052B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 052B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_52b0000_LisectAVT_2403002A_135.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 27bbc71466bbb9aa3857242f4082fa6acb8e5dfdd00a136898e624904ee7b0ed
Instruction ID: fafd2c173fe2751b339a0515d3c75c142315e6dbbc553a0b74ab0b4e0636354d
Opcode Fuzzy Hash: 27bbc71466bbb9aa3857242f4082fa6acb8e5dfdd00a136898e624904ee7b0ed
Instruction Fuzzy Hash: 66C08030D0120C9B8F04DF91F9054AC777CDB0130170000D9980953740DE315E048780

Function 052B7230 Relevance: .0, Instructions: 11COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.3727458401.00000000052B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 052B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_52b0000_LisectAVT_2403002A_135.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f62e94023ffc2071cb5797d65b128adceb30090e97610b2ecf7ad035c9b251f3
Instruction ID: cc6d603973b2c723615a9dc20c535755b538eaa5729e243f9749e0e6619e1f61
Opcode Fuzzy Hash: f62e94023ffc2071cb5797d65b128adceb30090e97610b2ecf7ad035c9b251f3
Instruction Fuzzy Hash: D0C04C1948D3D51FCB23526914A18A47FB00D6202474503EBCC8985DE7D14D451E9A12

Function 052B8E88 Relevance: .0, Instructions: 11COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.3727458401.00000000052B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 052B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_52b0000_LisectAVT_2403002A_135.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 28788b7b0d2e63b1672ff6edf5f93ac97a5280a88caa036f9955c113a376de62
Instruction ID: 9e06a019aa0ad4fda1ad57b9fe15ef248c6efa8ed1c249fc512efff8d8d17a0b
Opcode Fuzzy Hash: 28788b7b0d2e63b1672ff6edf5f93ac97a5280a88caa036f9955c113a376de62
Instruction Fuzzy Hash: A1B09233171A0A4BC6902241BC8B7C3374CC74061EF5406226418E4A00E994D84101DA

Function 052B71A0 Relevance: .0, Instructions: 10COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.3727458401.00000000052B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 052B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_52b0000_LisectAVT_2403002A_135.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 736d67cb102975c6e2f4fd86294b05303180056f5b3595bc4ecd261e11033e67
Instruction ID: 258667a1efa7701c668e6232ad791b2257ba00e2072c46140b79291e4bc9f67b
Opcode Fuzzy Hash: 736d67cb102975c6e2f4fd86294b05303180056f5b3595bc4ecd261e11033e67
Instruction Fuzzy Hash: F5C04C1548E3C92ECB13537518B149D3F74093301875A02EBD4C5C6DA3D15D454AD713

Function 052B9400 Relevance: .0, Instructions: 10COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.3727458401.00000000052B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 052B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_52b0000_LisectAVT_2403002A_135.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8debe8ba1dbced5af9652d6cb20fb4ac90055960ba940e856c2f89a0608d3f4a
Instruction ID: 73c0e02cb120e5a36fb4cf1d7401a34ec27cbddcdf085e98d4ceb0ba07a7c60a
Opcode Fuzzy Hash: 8debe8ba1dbced5af9652d6cb20fb4ac90055960ba940e856c2f89a0608d3f4a
Instruction Fuzzy Hash: CDC08C3804E3C09FCF0643B938BC8963F30490310434801CBD4D5D28A3C288840BCB12

Function 052B6460 Relevance: .0, Instructions: 10COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.3727458401.00000000052B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 052B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_52b0000_LisectAVT_2403002A_135.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ac61e751fd26ed0a46039e73294af7e7fe121aa857e2cc561805bf1bc416897a
Instruction ID: acd487e2fe91096a626c6f982be0ca21c256c82862cfb3423f404522bc8df725
Opcode Fuzzy Hash: ac61e751fd26ed0a46039e73294af7e7fe121aa857e2cc561805bf1bc416897a
Instruction Fuzzy Hash: AAC0026544E3D55ECB5293A52CA88853F704D1206935A02DBE485EA9A3C169040A8712

Function 052BAB28 Relevance: .0, Instructions: 10COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.3727458401.00000000052B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 052B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_52b0000_LisectAVT_2403002A_135.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e243772309921bd7055e41e7aee1cc6da362e8c82c13080a3e9780a00285b286
Instruction ID: f33e4724fad10c1c3895bace4bcf4abd4930f2007d13b19b9ef538a03757f29e
Opcode Fuzzy Hash: e243772309921bd7055e41e7aee1cc6da362e8c82c13080a3e9780a00285b286
Instruction Fuzzy Hash: 50C09B264497949FC301377DF80E1C13FF8C65111675415E3A648D1156E58C559E4691

Function 052B8F68 Relevance: .0, Instructions: 10COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.3727458401.00000000052B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 052B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_52b0000_LisectAVT_2403002A_135.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 43a1fa9bdbd107e4bbed495db30adc681d6a034753425edb2d781208d95c4f99
Instruction ID: f5e15ac1cd41710a9be81c2ecf6b7bbc494ad6b3a99a0d1ef439a24e39daaa95
Opcode Fuzzy Hash: 43a1fa9bdbd107e4bbed495db30adc681d6a034753425edb2d781208d95c4f99
Instruction Fuzzy Hash: 67B092A280A2980BD30623A1A897B5637A98862219B8514E36E6C95652A84D9C5E06AA

Function 052B93E1 Relevance: .0, Instructions: 10COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.3727458401.00000000052B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 052B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_52b0000_LisectAVT_2403002A_135.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 84e306decbfde912d671834b813a74e79d9d2fcd13af01e9f8413cb360e2ceb8
Instruction ID: 2879a86144714866a2c499dcb935afc310342cbb7e1890ff59dc8135b4f9f501
Opcode Fuzzy Hash: 84e306decbfde912d671834b813a74e79d9d2fcd13af01e9f8413cb360e2ceb8
Instruction Fuzzy Hash: F4C08061045B8C49DF0757F168103553B455B0234AF4055E7D54C445B296EAC4804540

Function 052BAFE0 Relevance: .0, Instructions: 10COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.3727458401.00000000052B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 052B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_52b0000_LisectAVT_2403002A_135.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e6a9aff3da8d726188631e0ef0e306897865973b9e577bcc194d79d08cdae3d3
Instruction ID: 35dac4fc10709bb3a674653a094ff7bc42a16efca731dfb0180bdefd4599fb1a
Opcode Fuzzy Hash: e6a9aff3da8d726188631e0ef0e306897865973b9e577bcc194d79d08cdae3d3
Instruction Fuzzy Hash: AAC0023200010DBB8F029E91EC01C9E3F2AAF18250F048115FE1408031D7739571BBA5

Function 052BB651 Relevance: .0, Instructions: 10COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.3727458401.00000000052B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 052B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_52b0000_LisectAVT_2403002A_135.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cc17b0d9ad032cb30b75a4a06d479fcd5cad6b75387663dbcf7e31075d2c2b30
Instruction ID: ad7113481c4da138ac0021f5a5ed183218c345d7fa3fdeebd6caf142efdecd5d
Opcode Fuzzy Hash: cc17b0d9ad032cb30b75a4a06d479fcd5cad6b75387663dbcf7e31075d2c2b30
Instruction Fuzzy Hash: F7C08C3A48D2C05ECB024321B84044E3F208722241F1452ABC486C68E3E254C0058981

Function 014E7112 Relevance: .0, Instructions: 10COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.3718480063.00000000014E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 014E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_14e0000_LisectAVT_2403002A_135.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 25ddf28eace91062aca95dda834a015af22bd105cb7ed77a70d8d100cdc82a67
Instruction ID: 41c972aa0f70953e88a4559d8e9f4d2e314369012ea89df31c331333f9251781
Opcode Fuzzy Hash: 25ddf28eace91062aca95dda834a015af22bd105cb7ed77a70d8d100cdc82a67
Instruction Fuzzy Hash: 62D0A9B0A001058FCB408B30D81C3ED77F0EB08300F0001ABA00AF3780CE700E828F22

Function 014E6F08 Relevance: .0, Instructions: 10COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.3718480063.00000000014E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 014E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_14e0000_LisectAVT_2403002A_135.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 96a21b64f327ad69e3578c3080ee5c505d95e0d7ed7189758da9a81b337ca8f6
Instruction ID: febe7d1765e00f4049e93a4b5e9c8379190d9d7586cfe411f655b593baf51618
Opcode Fuzzy Hash: 96a21b64f327ad69e3578c3080ee5c505d95e0d7ed7189758da9a81b337ca8f6
Instruction Fuzzy Hash: 0CD06C38B012258FCB54DB71E8586ADBBB1FB48306F10106A944AA36A0DE300A4A8F02

Function 052BA8A1 Relevance: .0, Instructions: 9COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.3727458401.00000000052B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 052B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_52b0000_LisectAVT_2403002A_135.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2e4e2ac20040d0f05fae1cfe570275c709cf9df952d9fd9d513b0e46b68a8dc9
Instruction ID: 87837cedb5c4259645784ef92b547f6a2a533172e856823663426090260f1340
Opcode Fuzzy Hash: 2e4e2ac20040d0f05fae1cfe570275c709cf9df952d9fd9d513b0e46b68a8dc9
Instruction Fuzzy Hash: 77C08C268AE2C40DCB0282B068509492F200623044B4822EBC0C5C8C93D28DC0448621

Function 052B54A0 Relevance: .0, Instructions: 9COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.3727458401.00000000052B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 052B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_52b0000_LisectAVT_2403002A_135.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a965d6dad1567c7c63e6cf5b22d086dda4ae266dde275eb88abb01f875da66a9
Instruction ID: 3c11a373a03c2bfdf44fd47f84a8c2cf7013735e032428e8c385dbf4c6364c4e
Opcode Fuzzy Hash: a965d6dad1567c7c63e6cf5b22d086dda4ae266dde275eb88abb01f875da66a9
Instruction Fuzzy Hash: BAC09B55C4E7C5BEDB0357B428740987F32895315475DC5CFD0C8CD5F38019445A8317

Function 052B4E98 Relevance: .0, Instructions: 9COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.3727458401.00000000052B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 052B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_52b0000_LisectAVT_2403002A_135.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 537c323e0796f8afa7d7f10d03f228dbc5af38c7215512e57f20f4802b4cff4c
Instruction ID: c07591e64b008fecfae5ea4cee9f9971abd8b85be2ac7259c04b79d0495e9310
Opcode Fuzzy Hash: 537c323e0796f8afa7d7f10d03f228dbc5af38c7215512e57f20f4802b4cff4c
Instruction Fuzzy Hash: AEC09B6151F7D0DFCB117779397D0CD7F24C95201734402EB9946960925D2504064657

Function 014EE1A8 Relevance: .0, Instructions: 9COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.3718480063.00000000014E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 014E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_14e0000_LisectAVT_2403002A_135.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 205c8b9eb06b3b45bb921189bcc31eee586cbe762c41ab9bbecef3981b473b2d
Instruction ID: 96434622af90f17e7bbfed37a5057954ab42fcd8202f70e2998286df5312686d
Opcode Fuzzy Hash: 205c8b9eb06b3b45bb921189bcc31eee586cbe762c41ab9bbecef3981b473b2d
Instruction Fuzzy Hash: DAC0122080B6884ED70213777908362BF9C9701309F480093E488A5273C2A692888263

Function 052BB959 Relevance: .0, Instructions: 8COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.3727458401.00000000052B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 052B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_52b0000_LisectAVT_2403002A_135.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3c3402363f5706f5c80dcf5431487fc7d98403957ac5b2f7b5860f2c30b87e0e
Instruction ID: 697f16a93f5c47e6a659e31d772abc643edd57077ba4eef56aec1b64b2891796
Opcode Fuzzy Hash: 3c3402363f5706f5c80dcf5431487fc7d98403957ac5b2f7b5860f2c30b87e0e
Instruction Fuzzy Hash: C6B012330C1B0C42860131A5950637733AE85D010C38010B5D20C15B319927E4534458

Function 052B7950 Relevance: .0, Instructions: 8COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.3727458401.00000000052B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 052B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_52b0000_LisectAVT_2403002A_135.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c20f6089423079ec742ad0729db7b62aed9315a9bf17313068bf679b7ae70f72
Instruction ID: dd4990138343349f529ffb4986e70d94e5d35cf7ef5689fd8e44a2aa6b295a29
Opcode Fuzzy Hash: c20f6089423079ec742ad0729db7b62aed9315a9bf17313068bf679b7ae70f72
Instruction Fuzzy Hash: 7BC04C366115089FE744A775EE297593752EB88361F040327E9229A2E4CAA01D048FA1

Function 052B4008 Relevance: .0, Instructions: 8COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.3727458401.00000000052B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 052B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_52b0000_LisectAVT_2403002A_135.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e61c3d820b4fa66de9d58e2e1e1c827453dcef317aeef42d7dc2cfc22c0af9d7
Instruction ID: 150e9803fa737bc235f3baf70c561be0f650b6faad621cd7b90c03ce43b8f295
Opcode Fuzzy Hash: e61c3d820b4fa66de9d58e2e1e1c827453dcef317aeef42d7dc2cfc22c0af9d7
Instruction Fuzzy Hash: 80C09B3500010CFFCB015F95D404D957FA9FF15360F00C061F9484A531C7339524DB61

Function 052B70E2 Relevance: .0, Instructions: 8COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.3727458401.00000000052B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 052B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_52b0000_LisectAVT_2403002A_135.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1865359019ddb8c2764fef30f9341d05f8013eed679490a4c2b183ec95824314
Instruction ID: d82a6882bfb6dd8e092caba49133c5adf4fc3fc344b5d91baa63e2e63f588a1c
Opcode Fuzzy Hash: 1865359019ddb8c2764fef30f9341d05f8013eed679490a4c2b183ec95824314
Instruction Fuzzy Hash: 49B0923508819DAE8B118665A880CE96F614A72250704422AE44985D21C766846BD908

Function 014E326C Relevance: .0, Instructions: 8COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.3718480063.00000000014E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 014E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_14e0000_LisectAVT_2403002A_135.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 614406a67e2ed6a77fd46365d41c51bacd1ced29dee1078f3b2f98caf64a15fb
Instruction ID: e2f951b3268bfcb4d7ee9904254a946994cb54a816f2400fc2654bb89acf3756
Opcode Fuzzy Hash: 614406a67e2ed6a77fd46365d41c51bacd1ced29dee1078f3b2f98caf64a15fb
Instruction Fuzzy Hash: 27D0CA7844511ACACB608A14D8A86EC72A1AB02349F2080A6D069AA6E5CB315ED28B40

Function 052B5508 Relevance: .0, Instructions: 7COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.3727458401.00000000052B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 052B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_52b0000_LisectAVT_2403002A_135.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c60a0e7e2cbca561adb12dff7575781a682cb6e8448e050b7c46dd7eaca7a54e
Instruction ID: 1f810fe94ffc57ba5439dfa4b3710bfa20f3164c94bc9fee4d2557b0b6eba5e6
Opcode Fuzzy Hash: c60a0e7e2cbca561adb12dff7575781a682cb6e8448e050b7c46dd7eaca7a54e
Instruction Fuzzy Hash: B8B0121D44F2CC2AFF12A6B534A04DC3F240871058A6502DFDC5900D46D08541195A47

Function 052B71D0 Relevance: .0, Instructions: 7COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.3727458401.00000000052B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 052B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_52b0000_LisectAVT_2403002A_135.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bba8328935ad118b2201a6887e589ef9ae05a7b5c66b74f07340f7b5626cdf83
Instruction ID: 13a24aa572ea7286a1b80e4968f7ae05271a05bcafda26ab8ca58468dbadc4ee
Opcode Fuzzy Hash: bba8328935ad118b2201a6887e589ef9ae05a7b5c66b74f07340f7b5626cdf83
Instruction Fuzzy Hash: 37B0125200434C204A0051E554008A67B9C05344007004432764446501C824E16092B8

Function 052B9C48 Relevance: .0, Instructions: 7COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.3727458401.00000000052B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 052B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_52b0000_LisectAVT_2403002A_135.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 039dd7bac22b73b987ee22bcc85523105a2cd488e3bd5b2f45bb8946a2a3f7b6
Instruction ID: 1aeed13d35ea468bba7d4146a4a512f156ffaca7992f4bb730a98cfae2ab3147
Opcode Fuzzy Hash: 039dd7bac22b73b987ee22bcc85523105a2cd488e3bd5b2f45bb8946a2a3f7b6
Instruction Fuzzy Hash: D6B0123208530CA787013A61D4009467B5D9B212547804035E50409A108773F5A0E5D4

Function 052BA8D0 Relevance: .0, Instructions: 7COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.3727458401.00000000052B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 052B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_52b0000_LisectAVT_2403002A_135.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9f7d2a81a823bc37ff0474d68f746eb471ee03d4dca5022eb5e4a545dd634b46
Instruction ID: de98885d71c8566b3b077e66e7b6e222270bc2f56864e39c8bbe4ae960916eb0
Opcode Fuzzy Hash: 9f7d2a81a823bc37ff0474d68f746eb471ee03d4dca5022eb5e4a545dd634b46
Instruction Fuzzy Hash: 82A0223002832C8EC33A23B02000A88338C8AA0C0C3C080BCC00C8FB0CAFBBE8A0C2C0

Function 052B9B20 Relevance: .0, Instructions: 7COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.3727458401.00000000052B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 052B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_52b0000_LisectAVT_2403002A_135.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ee3c1cba295e96cb91718556aa025d4495cf46e79db2d479075d0daf3ad0af68
Instruction ID: 27793517749467d54a29d83c48bddab253bc21ef4bb33cc34a0cca46cda76157
Opcode Fuzzy Hash: ee3c1cba295e96cb91718556aa025d4495cf46e79db2d479075d0daf3ad0af68
Instruction Fuzzy Hash: A8B0123104170945C73011719400360325C4B4050AE0400B5550805F16D936B0405089

Function 052B4BAC Relevance: .0, Instructions: 7COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.3727458401.00000000052B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 052B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_52b0000_LisectAVT_2403002A_135.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 92f69291b5686a09189bbe2a0a4ea8a9c6c55ea2e84058a7c93be8d7995c18f6
Instruction ID: 1cb077ed5ed0b5758deda61259647a319410c55c15b6e8122a6890eb14d4c918
Opcode Fuzzy Hash: 92f69291b5686a09189bbe2a0a4ea8a9c6c55ea2e84058a7c93be8d7995c18f6
Instruction Fuzzy Hash: ABB0123888D1459FCF0443653585CC83F60C511214320025FD44A90C12C75641068900

Function 052BB638 Relevance: .0, Instructions: 7COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.3727458401.00000000052B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 052B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_52b0000_LisectAVT_2403002A_135.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: de4ed4e15f4428461d94016b94e8077467d25db8e3f809e102043635971b93b6
Instruction ID: 10c836d7db544d5071350c4d6b5808e1b614d48a8fe512aa6fb374dd3bd6c381
Opcode Fuzzy Hash: de4ed4e15f4428461d94016b94e8077467d25db8e3f809e102043635971b93b6
Instruction Fuzzy Hash: F1B0123104130CA78B012A61D4008857B5D9B11264BC08035EA0409B108733E5A0D694

Function 052BA910 Relevance: .0, Instructions: 6COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.3727458401.00000000052B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 052B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_52b0000_LisectAVT_2403002A_135.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 52b733312b44db39862d811c6b83151ea1c4c52496bc89a195d450439c07dfce
Instruction ID: c6c4970a7907252115ceb75c65ee8eed20b62bcef2b4be1b713f4bb62b21f770
Opcode Fuzzy Hash: 52b733312b44db39862d811c6b83151ea1c4c52496bc89a195d450439c07dfce
Instruction Fuzzy Hash: B0A022300C2B0CC2820022B03002020338C880000E3E000BC8E0C08A200E3BE0B28280

Function 052BB960 Relevance: .0, Instructions: 6COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.3727458401.00000000052B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 052B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_52b0000_LisectAVT_2403002A_135.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5a120e3c9d33b4795bd8dfed161bd87569332c47402fdb3cabd8dd3bf123b408
Instruction ID: 45a23b2e2551dc3f3a62e6bccb71f2bea37cab185b97de07bbf27a2987768c81
Opcode Fuzzy Hash: 5a120e3c9d33b4795bd8dfed161bd87569332c47402fdb3cabd8dd3bf123b408
Instruction Fuzzy Hash: 03A02230082B0C82820232F2220033233CC0A8000C38000B8C20C0AF300A33F8A08088

Function 052BB1F8 Relevance: .0, Instructions: 6COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.3727458401.00000000052B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 052B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_52b0000_LisectAVT_2403002A_135.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 18872da0e1e0e6354e14c33785f8cba8acfae5758db970191c7aa64d00ff42ce
Instruction ID: d33c1bf160fb57a1fac7dc70013c4511ebce59c310094879873109c1ec0a2625
Opcode Fuzzy Hash: 18872da0e1e0e6354e14c33785f8cba8acfae5758db970191c7aa64d00ff42ce
Instruction Fuzzy Hash: EEA02230002B0C83830022B0B20002033AC3A2000C38000FAA20C08F200A3BE0A0C080

Function 052B9C08 Relevance: .0, Instructions: 6COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.3727458401.00000000052B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 052B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_52b0000_LisectAVT_2403002A_135.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f75e0cce716f5c79e47e2db3fc3d14ab2c0aa3214144efc6477fcac22a4a3cbe
Instruction ID: e2dd5afecc44825f729f8fd5dad76fa75d7fc7d1789aedb0ad44b63ad5ded63f
Opcode Fuzzy Hash: f75e0cce716f5c79e47e2db3fc3d14ab2c0aa3214144efc6477fcac22a4a3cbe
Instruction Fuzzy Hash: C4A02230082B0C82820023BAA80022033CC0A0000C38008F8C20C0AF208EB3F0A08888

Function 052B98F8 Relevance: .0, Instructions: 6COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.3727458401.00000000052B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 052B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_52b0000_LisectAVT_2403002A_135.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 03d06512dc28813e8f2ac9be66ecba7779b3f1e85da326f30505f60669527867
Instruction ID: 2c01ef96fc171254f8691401033231fa5e354d2632a774b9cf601339df1b3828
Opcode Fuzzy Hash: 03d06512dc28813e8f2ac9be66ecba7779b3f1e85da326f30505f60669527867
Instruction Fuzzy Hash: 3FA0223008BB0C838A0022F0200222033CC0A0000C3E280B8820C0AF220AB3F8B08080

Function 052B8F58 Relevance: .0, Instructions: 6COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.3727458401.00000000052B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 052B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_52b0000_LisectAVT_2403002A_135.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f2cbb95b1c124858f95fde12ba577585da5765d4642f3868b3e3e60b249824b3
Instruction ID: ee109b1d0c83410cfb2caf00a1af086c01c4fedaf646c927c0081cb667b67e8a
Opcode Fuzzy Hash: f2cbb95b1c124858f95fde12ba577585da5765d4642f3868b3e3e60b249824b3
Instruction Fuzzy Hash: 9EA02230003B0C838A2022B0200022033CC2A0020C3A000B8830C0EF200A3FF0A0C88C

Function 052B9BE8 Relevance: .0, Instructions: 6COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.3727458401.00000000052B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 052B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_52b0000_LisectAVT_2403002A_135.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0da8b97404dce94b58eaa78cac19b8ddb9b6c4fbdfa57e8cd14e0754d60d0d85
Instruction ID: e4b2f90de4110da317b25b01630f61c0839320d470e9c581b3eb36fd7b128612
Opcode Fuzzy Hash: 0da8b97404dce94b58eaa78cac19b8ddb9b6c4fbdfa57e8cd14e0754d60d0d85
Instruction Fuzzy Hash: 49A02230082B0C82820023B8200022033CC0E0000E38008F8C20C0BF208A33F0A08888

Function 052B93F0 Relevance: .0, Instructions: 6COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.3727458401.00000000052B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 052B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_52b0000_LisectAVT_2403002A_135.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a0ddb769466cf35dd05fe0b213ecc7a1890766b30c8411ac418aacbd9c26f10a
Instruction ID: d8893a5b3a46f2b81afe97c504457579975f510609fdba3f602a0d116a2b74af
Opcode Fuzzy Hash: a0ddb769466cf35dd05fe0b213ecc7a1890766b30c8411ac418aacbd9c26f10a
Instruction Fuzzy Hash: 57A022B2082B0CC28A0022F02002820338C280020C3C000F8AA0C08B300EBBE0E08080

Function 014E65BF Relevance: .0, Instructions: 6COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.3718480063.00000000014E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 014E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_14e0000_LisectAVT_2403002A_135.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7962e93e3f96d79130ca61eee2a046d24fbc72447e80c2a3b5d51d1dc9d538db
Instruction ID: 45f029d3e180b58bd50817d74f05e9f85eba87427d1ef73a88d86f724e666bed
Opcode Fuzzy Hash: 7962e93e3f96d79130ca61eee2a046d24fbc72447e80c2a3b5d51d1dc9d538db
Instruction Fuzzy Hash: 61C02B345413219BC31CEB30CF8C160BF30AB00304F0000B680810C414C3700342DF04

Function 014EA4D8 Relevance: .0, Instructions: 6COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.3718480063.00000000014E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 014E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_14e0000_LisectAVT_2403002A_135.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 63f445484af16bb73fa9a2d447261666c8db16c62ed548f0b40f255dc1731f4a
Instruction ID: b8c325d17485ff844529345e060bd18e7fb11f05713b93c838e05d2c242b03f2
Opcode Fuzzy Hash: 63f445484af16bb73fa9a2d447261666c8db16c62ed548f0b40f255dc1731f4a
Instruction Fuzzy Hash: B7A02232002A2C8F8B0033E3380C008338CFAA000F3C20023E00E028208E20200000E2

Function 014EA228 Relevance: .0, Instructions: 6COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.3718480063.00000000014E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 014E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_14e0000_LisectAVT_2403002A_135.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c2b739e6143de4b2e80f1910f2a15913308529585e9a6837397fe98f9abcd8c9
Instruction ID: ce9f0d320568e7aeddd1da0d443e20918fc001d358bb9c195afdc7c1ad0b123c
Opcode Fuzzy Hash: c2b739e6143de4b2e80f1910f2a15913308529585e9a6837397fe98f9abcd8c9
Instruction Fuzzy Hash: 32A011300002088BC200ABA8E008EA033ECAB08A08F0000F0A20C8BA228A22B8008A82

Function 052BA568 Relevance: .0, Instructions: 5COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.3727458401.00000000052B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 052B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_52b0000_LisectAVT_2403002A_135.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 29e21dd7940db255fcd5d5d66a1430479eeee038c35eb2a58302f398df766845
Instruction ID: d7404269fc1b6ebfb0d97bccc50e7057fdc93c817d00b023c8ebd539c4896a65
Opcode Fuzzy Hash: 29e21dd7940db255fcd5d5d66a1430479eeee038c35eb2a58302f398df766845
Instruction Fuzzy Hash:

Function 052B71B0 Relevance: .0, Instructions: 5COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.3727458401.00000000052B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 052B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_52b0000_LisectAVT_2403002A_135.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5bffbffbcbae5f3dacaaf10fda888b4f05c9b6d6185586f652278a333e58d7a5
Instruction ID: 90dd26f3c1e72251fe8f43ce2121378fa940850821d8557649d5ec469f783003
Opcode Fuzzy Hash: 5bffbffbcbae5f3dacaaf10fda888b4f05c9b6d6185586f652278a333e58d7a5
Instruction Fuzzy Hash:

Function 052B9988 Relevance: .0, Instructions: 5COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.3727458401.00000000052B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 052B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_52b0000_LisectAVT_2403002A_135.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9b413fa0dd8a58f4f9fc0bb160c983bf31624ab1a47fa4689f0fdc40e63f87fd
Instruction ID: 2bf4abdfac79c6418df23a69c9a50426ede08c519ee4fe963a3922e6b1222f6c
Opcode Fuzzy Hash: 9b413fa0dd8a58f4f9fc0bb160c983bf31624ab1a47fa4689f0fdc40e63f87fd
Instruction Fuzzy Hash: E990023149460D8B464037D9740E5557B5CE548615B840052B50D457015E95641089D9

Function 052B7190 Relevance: .0, Instructions: 5COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.3727458401.00000000052B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 052B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_52b0000_LisectAVT_2403002A_135.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6f78960bdab0635369488d93d1804ac3b697f3115d441c84b776ad09c871bf50
Instruction ID: 5c39a882a39b6a4cd5ae432a6e2dd123b8cb4a2ed3faee5f44fe3bcc787e8a50
Opcode Fuzzy Hash: 6f78960bdab0635369488d93d1804ac3b697f3115d441c84b776ad09c871bf50
Instruction Fuzzy Hash:

Function 052BA9F0 Relevance: .0, Instructions: 5COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.3727458401.00000000052B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 052B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_52b0000_LisectAVT_2403002A_135.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e0dadc68e193b40d0180ebd81bd0ad8cb32a244c2f95117d2c5970b59d47ddae
Instruction ID: 8ae2c2e691538dd48455820192d9fd987b1dfebdd81a86420a59a6cda6e1fb8b
Opcode Fuzzy Hash: e0dadc68e193b40d0180ebd81bd0ad8cb32a244c2f95117d2c5970b59d47ddae
Instruction Fuzzy Hash: BB900232045A0C8F454027967A09555779CD659516BC00492A51D555115A55F4144595

Function 052BB030 Relevance: .0, Instructions: 5COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.3727458401.00000000052B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 052B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_52b0000_LisectAVT_2403002A_135.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0bffdb985ff305a9628e5ac59c3a20cfb1c4dc7b94fcec9968a301febae761c6
Instruction ID: c4fd70267df43d14608eb92fe401dc3adb6b0c04aa20c1beb92278a8d01640fa
Opcode Fuzzy Hash: 0bffdb985ff305a9628e5ac59c3a20cfb1c4dc7b94fcec9968a301febae761c6
Instruction Fuzzy Hash: 4590023144460C8F464027967909665779C96885157800451A60D515129E65B4148595

Function 052B9410 Relevance: .0, Instructions: 5COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.3727458401.00000000052B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 052B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_52b0000_LisectAVT_2403002A_135.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8708b38d3fa9b6b0a1eb8e5cbea92d2617a9ffcfe4d9339fcd43566b562a3def
Instruction ID: 3c315a0342d4ff677277b45be6bb535c7383d8eac0ab7956513a9eb19bfada24
Opcode Fuzzy Hash: 8708b38d3fa9b6b0a1eb8e5cbea92d2617a9ffcfe4d9339fcd43566b562a3def
Instruction Fuzzy Hash: 3590023504564C8F4640279A7819565775CE6446157840093E54D91511DA5564144595

Function 052BB010 Relevance: .0, Instructions: 5COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.3727458401.00000000052B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 052B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_52b0000_LisectAVT_2403002A_135.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 46814b296ee059bcbade156373aafc68d7f6542f70369f6c7668747b133a1957
Instruction ID: a0b7c6165fa6172bdc4a4186f65fe775ffaa755aa933f4460fc1b04fd90fe977
Opcode Fuzzy Hash: 46814b296ee059bcbade156373aafc68d7f6542f70369f6c7668747b133a1957
Instruction Fuzzy Hash: 0F90023144470C8F874027967C09B65775CA688615B840451A50D515139E55A4148599

Function 052B9C70 Relevance: .0, Instructions: 5COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.3727458401.00000000052B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 052B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_52b0000_LisectAVT_2403002A_135.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: feea6ad92866d3d31e60f24b7fb32e7ce00d6b35800deac3e4a0e4755151f08d
Instruction ID: e6cad08069ea4f2a3ee2e88a02c0e9f9e81b69adbb777dc94823c2529046a9d8
Opcode Fuzzy Hash: feea6ad92866d3d31e60f24b7fb32e7ce00d6b35800deac3e4a0e4755151f08d
Instruction Fuzzy Hash: E0902232000A2ECF000023823808080330CC2000223C00002A00C008008A0020000A80

Function 052BA8B0 Relevance: .0, Instructions: 5COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.3727458401.00000000052B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 052B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_52b0000_LisectAVT_2403002A_135.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fc00504685c7900d914d3cef1ee54379e0c921d4ba5e160a27ceb7735d8a649b
Instruction ID: eed47578bd206ee3e8aa25b107e419df0fe09b653ee2ba25ce86ba7aaf584400
Opcode Fuzzy Hash: fc00504685c7900d914d3cef1ee54379e0c921d4ba5e160a27ceb7735d8a649b
Instruction Fuzzy Hash:

Function 052BAB38 Relevance: .0, Instructions: 5COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.3727458401.00000000052B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 052B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_52b0000_LisectAVT_2403002A_135.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1a09b45f9f33c5c98040abcf378199e1a117510ceb153664eaf5f9365ad66bdc
Instruction ID: 3da557724b161a2a31b9c4ff088fcc471e4b8c3a5ff7bb479a77e6a01bdc5bd7
Opcode Fuzzy Hash: 1a09b45f9f33c5c98040abcf378199e1a117510ceb153664eaf5f9365ad66bdc
Instruction Fuzzy Hash: 81900236045B0CCF4540279A78095D577ECD6445267901053E60D515115A5564544595

Function 052B6368 Relevance: .0, Instructions: 5COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.3727458401.00000000052B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 052B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_52b0000_LisectAVT_2403002A_135.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7a4578c51c6c9b7817a5accbf4447dd63e35becf53f0fcb772a383382dc98696
Instruction ID: a7f97640a67a91ce0918e79c541e2c5cb2f60352d10d378f5b919e589e23d3ef
Opcode Fuzzy Hash: 7a4578c51c6c9b7817a5accbf4447dd63e35becf53f0fcb772a383382dc98696
Instruction Fuzzy Hash:

Function 052B9B48 Relevance: .0, Instructions: 5COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.3727458401.00000000052B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 052B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_52b0000_LisectAVT_2403002A_135.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3a9b8534f34a65cf563aad0f162acfb84f5058e43cf6271085f76eec7b7b6c14
Instruction ID: 377db65d972969a2b4c093d6781d907f2a8247202cda06059333b15233a4f6a4
Opcode Fuzzy Hash: 3a9b8534f34a65cf563aad0f162acfb84f5058e43cf6271085f76eec7b7b6c14
Instruction Fuzzy Hash:

Function 052BAF80 Relevance: .0, Instructions: 5COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.3727458401.00000000052B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 052B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_52b0000_LisectAVT_2403002A_135.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4fc5aa8c6375007cda8a3682b8da794c8bfac25e8e438794e6c49a24aadbf3c4
Instruction ID: fca0e267ce1dee9baf8e6ffb57504bda94eddd468241ebcdfd71683816313b98
Opcode Fuzzy Hash: 4fc5aa8c6375007cda8a3682b8da794c8bfac25e8e438794e6c49a24aadbf3c4
Instruction Fuzzy Hash:

Function 052B4B90 Relevance: .0, Instructions: 5COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.3727458401.00000000052B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 052B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_52b0000_LisectAVT_2403002A_135.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 000fef6decc33f2fa86ab39ef8dd27444d75d524ae58a22848a1df1380eec7e7
Instruction ID: 4324c561aaf40fd4fb233a0bbd941db0dcabb8e46c89f03749e53f9d864678cf
Opcode Fuzzy Hash: 000fef6decc33f2fa86ab39ef8dd27444d75d524ae58a22848a1df1380eec7e7
Instruction Fuzzy Hash:

Function 052BB660 Relevance: .0, Instructions: 5COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.3727458401.00000000052B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 052B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_52b0000_LisectAVT_2403002A_135.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 38dcb9d00b7168973a36cfa5b78d6ba6e6dae72b8387d38f4ff4e7d6383f9878
Instruction ID: 8e87ddf244404b2c55a2cf144fb23b7a38317ebf85e6fe9ffd3cde76a7e7a6b6
Opcode Fuzzy Hash: 38dcb9d00b7168973a36cfa5b78d6ba6e6dae72b8387d38f4ff4e7d6383f9878
Instruction Fuzzy Hash: F8902233000A0C8F020023823808000330CE200002BC00003A00C800203E0020000080

Function 052BA678 Relevance: .0, Instructions: 5COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.3727458401.00000000052B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 052B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_52b0000_LisectAVT_2403002A_135.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 981c30cd9a6f7ab970ba4f4ec253c72f6296db3d39217f1d6b4e2d7997bffb30
Instruction ID: 9b080741689c71f6ebf9c2d104d333b215471cea60db2bbcfd477445d77a79b7
Opcode Fuzzy Hash: 981c30cd9a6f7ab970ba4f4ec253c72f6296db3d39217f1d6b4e2d7997bffb30
Instruction Fuzzy Hash: F0900433145F0CCF454037D77D0D57D775DD7445157D00053F50D555115F55741455D5

Function 052B8E78 Relevance: .0, Instructions: 5COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.3727458401.00000000052B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 052B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_52b0000_LisectAVT_2403002A_135.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: da76050a9df6970f75786c057ae505fd2c508b13f11186c8da46fbb6932105db
Instruction ID: a19876abee22e71b7c9db5f1263072fb87dfeacfc775158471265ff9fd940c1f
Opcode Fuzzy Hash: da76050a9df6970f75786c057ae505fd2c508b13f11186c8da46fbb6932105db
Instruction Fuzzy Hash:

Function 052B7240 Relevance: .0, Instructions: 5COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.3727458401.00000000052B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 052B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_52b0000_LisectAVT_2403002A_135.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8e5456eae1d101d0f9ffe3363d52a2e68b29f19c3345ee6f60fbb3d941442b2b
Instruction ID: fc137d22f271fb74deada4b0c8dbf8f52f547df453f3d293a7c280b2bcc6d37e
Opcode Fuzzy Hash: 8e5456eae1d101d0f9ffe3363d52a2e68b29f19c3345ee6f60fbb3d941442b2b
Instruction Fuzzy Hash:

Function 052B8E98 Relevance: .0, Instructions: 5COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.3727458401.00000000052B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 052B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_52b0000_LisectAVT_2403002A_135.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fd26bfb49da92df1332b4accce863d4e3d03fdf387d780242698115a75f71559
Instruction ID: 3171b1359f47297ec7bfd4b6c01234e8de0541a66caa97829805687e8a327128
Opcode Fuzzy Hash: fd26bfb49da92df1332b4accce863d4e3d03fdf387d780242698115a75f71559
Instruction Fuzzy Hash: AD902232080A0E8F000023823808080330CC2000223800202B00C008000A8020000280

Function 014EE538 Relevance: .0, Instructions: 5COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.3718480063.00000000014E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 014E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_14e0000_LisectAVT_2403002A_135.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8d09759f4bb64a0e8e5727e8d89585ad9cf169b4470c1c6d6bb14a82a9d3ff67
Instruction ID: fbc93c919e1bc571ff4a4111e643164e1e5d12253a844bc35608e0204a87509b
Opcode Fuzzy Hash: 8d09759f4bb64a0e8e5727e8d89585ad9cf169b4470c1c6d6bb14a82a9d3ff67
Instruction Fuzzy Hash: E19022B2000A0C8F020023A23808002330CE2000003800003A00C000020A0020000082

Function 014EA0E0 Relevance: .0, Instructions: 5COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.3718480063.00000000014E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 014E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_14e0000_LisectAVT_2403002A_135.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 16d0bf4605012d03402111c90b68e3edc425633f2698b2ad6262f9ee1ef15489
Instruction ID: 96b223807c3d53cc4e5904f79492d6240b70ff07a5af7b735c029b751b99e241
Opcode Fuzzy Hash: 16d0bf4605012d03402111c90b68e3edc425633f2698b2ad6262f9ee1ef15489
Instruction Fuzzy Hash:

Function 014EE0A0 Relevance: .0, Instructions: 5COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.3718480063.00000000014E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 014E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_14e0000_LisectAVT_2403002A_135.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e9874e4b80586c05cbba71267c85bf0b4f5b95b9a2d1b1d8e6b663809b076d61
Instruction ID: 00dee5d9b144309bc4bd1d88cc590ae76338b18e955bcd489c7387889b5abeb1
Opcode Fuzzy Hash: e9874e4b80586c05cbba71267c85bf0b4f5b95b9a2d1b1d8e6b663809b076d61
Instruction Fuzzy Hash: C890223000020C8F000023A2380A000B30CC2000023800022A00C002020E0820000082

Function 014EA350 Relevance: .0, Instructions: 5COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.3718480063.00000000014E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 014E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_14e0000_LisectAVT_2403002A_135.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 91b25e8d005d4a4f6e479e55aa4e3be0bb0392f5c4f9c4f315df33d20997c462
Instruction ID: b92b9b45eabd30c34984c4522f5d0683330f3cd935538dcb754d25913d557ff7
Opcode Fuzzy Hash: 91b25e8d005d4a4f6e479e55aa4e3be0bb0392f5c4f9c4f315df33d20997c462
Instruction Fuzzy Hash:

Function 014EE320 Relevance: .0, Instructions: 5COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.3718480063.00000000014E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 014E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_14e0000_LisectAVT_2403002A_135.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bbe19f45d873a1f3a289ab2ed0ff7155d3f547ed30c6a23bd871f52f28a666de
Instruction ID: 98225c7f881bc638fb63c6e1840fa5bc1f6805df254349958989ad7806483f35
Opcode Fuzzy Hash: bbe19f45d873a1f3a289ab2ed0ff7155d3f547ed30c6a23bd871f52f28a666de
Instruction Fuzzy Hash: E690023504660CEF4540A7A6780A5957B5CD6445267800052A51D516115A55A5544596

Function 014E9E50 Relevance: .0, Instructions: 5COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.3718480063.00000000014E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 014E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_14e0000_LisectAVT_2403002A_135.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 65024830558dcabf83391710fae3dbeb0d7730a77d3b39d6be7312ac2bbc8c8a
Instruction ID: 6e1537b8c9726219141c9a5280b67a5dbed4f5c8ecd28ffd318faea9db88b680
Opcode Fuzzy Hash: 65024830558dcabf83391710fae3dbeb0d7730a77d3b39d6be7312ac2bbc8c8a
Instruction Fuzzy Hash:

Function 052B8001 Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.3727458401.00000000052B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 052B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_52b0000_LisectAVT_2403002A_135.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 580d7427d1d8a7179a2426c68142d14e6e5815e62aef6273c290769ce75053cf
Instruction ID: daca00dece426c6cb18fb54f06761ce2fe11e6b6d86224324e1a972ef70a3bd3
Opcode Fuzzy Hash: 580d7427d1d8a7179a2426c68142d14e6e5815e62aef6273c290769ce75053cf
Instruction Fuzzy Hash: CAA01130E2800882FB08AAA0E8A83E822B28F80380F00800A8302200828AE800000EA2

Function 052B7FD7 Relevance: .0, Instructions: 3COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.3727458401.00000000052B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 052B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_52b0000_LisectAVT_2403002A_135.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2affb6d1fe9740f0cd80ea572cf79ce075a8701627d367f9b1f4b0204b9ecc5f
Instruction ID: 57dd21eff2e10828bcef5e73235fb62ddbd0ed5dc51b3964995afa20068fed33
Opcode Fuzzy Hash: 2affb6d1fe9740f0cd80ea572cf79ce075a8701627d367f9b1f4b0204b9ecc5f
Instruction Fuzzy Hash: EFA00275825905DFF7058FB2F94C39DBBB2EB44345F04820BA413A5665CBF400498F21

Non-executed Functions

Function 00ED38DC Relevance: .3, Instructions: 334COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.3710051555.0000000000ED2000.00000040.00000800.00020000.00000000.sdmp, Offset: 00ED2000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_ed2000_LisectAVT_2403002A_135.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: aaf050904cb0f6afc5fbe8243748c3a1f3d286d510586060496747c4d4a25633
Instruction ID: ae78356154aa996b3aeab79c90c8fd8206f858934b60e26d33942417315c929d
Opcode Fuzzy Hash: aaf050904cb0f6afc5fbe8243748c3a1f3d286d510586060496747c4d4a25633
Instruction Fuzzy Hash: F2D172A2A9D7E08FD7178B348CA82517F70EF63228B1941CFC0C19F6A7D2955916C772

Analysis Process: LisectAVT_2403002A_135.exePID: 5884, Parent PID: 3968COMMON

Execution Graph

Execution Coverage:	10.3%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	0%
Total number of Nodes:	64
Total number of Limit Nodes:	5

Executed Functions

Function 012FB4CB Relevance: 1.6, APIs: 1, Instructions: 75
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

AdjustTokenPrivileges.KERNELBASE(?,?,?,?,?,?), ref: 012FB54B

Memory Dump Source

Source File: 0000000B.00000002.1509874695.00000000012FA000.00000040.00000800.00020000.00000000.sdmp, Offset: 012FA000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_12fa000_LisectAVT_2403002A_135.jbxd

Similarity

API ID: AdjustPrivilegesToken
String ID:
API String ID: 2874748243-0
Opcode ID: c06fb75ce66182faf7945a5488201a89c2b86f4cea875e8e897988071837707b
Instruction ID: 69bae9de6f2d27d226b53150ccab1f92bbfb7eb241b4e6042878376d6005b727
Opcode Fuzzy Hash: c06fb75ce66182faf7945a5488201a89c2b86f4cea875e8e897988071837707b
Instruction Fuzzy Hash: 84216D755097809FDB228F25DC44B52BFF4EF06310F0884EAEA858B563D275D918DB62

Function 012FA7AD Relevance: 1.6, APIs: 1, Instructions: 62nativeCOMMON

Download Yara Rule

APIs

NtQuerySystemInformation.NTDLL ref: 012FA821

Memory Dump Source

Source File: 0000000B.00000002.1509874695.00000000012FA000.00000040.00000800.00020000.00000000.sdmp, Offset: 012FA000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_12fa000_LisectAVT_2403002A_135.jbxd

Similarity

API ID: InformationQuerySystem
String ID:
API String ID: 3562636166-0
Opcode ID: d19d164d2c528e1fb0f6354b7cbfd7489882ad7184aa6797e2ec950393f2df81
Instruction ID: d3e22183d89a80be23137643a7777a9c37172a624e004736408151106d26b393
Opcode Fuzzy Hash: d19d164d2c528e1fb0f6354b7cbfd7489882ad7184aa6797e2ec950393f2df81
Instruction Fuzzy Hash: 3E218C7540D3C09FDB238B21DD44A52FFB4EF07214F0984DEE9854B163D265A919DB62

Function 012FB502 Relevance: 1.6, APIs: 1, Instructions: 52COMMON

Download Yara Rule

APIs

AdjustTokenPrivileges.KERNELBASE(?,?,?,?,?,?), ref: 012FB54B

Memory Dump Source

Source File: 0000000B.00000002.1509874695.00000000012FA000.00000040.00000800.00020000.00000000.sdmp, Offset: 012FA000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_12fa000_LisectAVT_2403002A_135.jbxd

Similarity

API ID: AdjustPrivilegesToken
String ID:
API String ID: 2874748243-0
Opcode ID: e2aff6ae4c2fceb96c3361d944113447b0b629bc41f91015e9d0f4ef2fd7e69e
Instruction ID: abbe8b9fc51d8afd0b7a9d615ea85e37ea9c78ab08decf565aaceada4ba2dbd1
Opcode Fuzzy Hash: e2aff6ae4c2fceb96c3361d944113447b0b629bc41f91015e9d0f4ef2fd7e69e
Instruction Fuzzy Hash: C711C2755006409FDB21CF15E989B66FBE4EF04320F08C4AEDE458B652D375E418DF61

Function 012FA7E6 Relevance: 1.5, APIs: 1, Instructions: 38nativeCOMMON

Download Yara Rule

APIs

NtQuerySystemInformation.NTDLL ref: 012FA821

Memory Dump Source

Source File: 0000000B.00000002.1509874695.00000000012FA000.00000040.00000800.00020000.00000000.sdmp, Offset: 012FA000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_12fa000_LisectAVT_2403002A_135.jbxd

Similarity

API ID: InformationQuerySystem
String ID:
API String ID: 3562636166-0
Opcode ID: a49dced091e8f18893e9858f7747b7f4cd5ade05cac3f7d5753ab8cad4b4d87e
Instruction ID: 85451a67aa805eea46973edc8e73d0716b3b2d363ef1249eb78f9f42eee7a95a
Opcode Fuzzy Hash: a49dced091e8f18893e9858f7747b7f4cd5ade05cac3f7d5753ab8cad4b4d87e
Instruction Fuzzy Hash: 7A018B314146409FEB218F09D985B21FBE0EF08221F08C4AEDE890B252D3B5A418DFA2

Function 012FA9CF Relevance: 1.6, APIs: 1, Instructions: 98
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateFileW.KERNELBASE(?,?,?,?,?,?), ref: 012FAA85

Memory Dump Source

Source File: 0000000B.00000002.1509874695.00000000012FA000.00000040.00000800.00020000.00000000.sdmp, Offset: 012FA000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_12fa000_LisectAVT_2403002A_135.jbxd

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: 3beefe1d49ce752aa4bd0dc7b0c9d34467c237b71146f5c49380ace487f1a875
Instruction ID: 36021c085a564b102baffb1a382d66d60c5d4c65073ccd62552878d898fdbee8
Opcode Fuzzy Hash: 3beefe1d49ce752aa4bd0dc7b0c9d34467c237b71146f5c49380ace487f1a875
Instruction Fuzzy Hash: 81318FB1405380AFE722CB25DD44B62BFF8EF06214F08849EEA858B652D375E509DB71

Function 012FB722 Relevance: 1.6, APIs: 1, Instructions: 89
synchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateMutexW.KERNELBASE(?,?), ref: 012FB7C9

Memory Dump Source

Source File: 0000000B.00000002.1509874695.00000000012FA000.00000040.00000800.00020000.00000000.sdmp, Offset: 012FA000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_12fa000_LisectAVT_2403002A_135.jbxd

Similarity

API ID: CreateMutex
String ID:
API String ID: 1964310414-0
Opcode ID: a9b5d268d83bdbe500e07880a7eae1fb676f7270ba7c1746139d7bd0fd4a91f5
Instruction ID: c0ceb9838c706804f74768d3d4de3002f0d464199c5b686ceb13651ceebe202f
Opcode Fuzzy Hash: a9b5d268d83bdbe500e07880a7eae1fb676f7270ba7c1746139d7bd0fd4a91f5
Instruction Fuzzy Hash: E93170755093805FE712CB25DC45B56FFF8EF06214F0984AEEA848B292D365A909CB61

Function 012FA120 Relevance: 1.6, APIs: 1, Instructions: 84
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

FindNextFileW.KERNELBASE(?,00000E24,?,?), ref: 012FA1C2

Memory Dump Source

Source File: 0000000B.00000002.1509874695.00000000012FA000.00000040.00000800.00020000.00000000.sdmp, Offset: 012FA000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_12fa000_LisectAVT_2403002A_135.jbxd

Similarity

API ID: FileFindNext
String ID:
API String ID: 2029273394-0
Opcode ID: d7456e55771d35b1ef91d2c086d05101d8cf4522456b575d43ebe78ec33690ac
Instruction ID: 372554c0dd1158ac8e8d07d345f4eca3723befe8e24e9ecd8828d566d65f6003
Opcode Fuzzy Hash: d7456e55771d35b1ef91d2c086d05101d8cf4522456b575d43ebe78ec33690ac
Instruction Fuzzy Hash: 6421917154D3C06FD3138B258C51BA6BFB4EF47610F0A80CBD884CF693D225A919D7A2

Function 012FAADC Relevance: 1.6, APIs: 1, Instructions: 80
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetFileType.KERNELBASE(?,00000E24,3C827DA8,00000000,00000000,00000000,00000000), ref: 012FAB71

Memory Dump Source

Source File: 0000000B.00000002.1509874695.00000000012FA000.00000040.00000800.00020000.00000000.sdmp, Offset: 012FA000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_12fa000_LisectAVT_2403002A_135.jbxd

Similarity

API ID: FileType
String ID:
API String ID: 3081899298-0
Opcode ID: 2921e16f328dae7e8c07b94a54f469cc21376cfde731cd0900b039f8c4092a57
Instruction ID: 5289091c61743d2f3ede67c2a336ed6dc081dbbcd1c887c32f14971941e93922
Opcode Fuzzy Hash: 2921e16f328dae7e8c07b94a54f469cc21376cfde731cd0900b039f8c4092a57
Instruction Fuzzy Hash: 97213A754493806FE7138B21DC45BA2BFBCEF07324F0980DAEE848B193D2645909CB71

Function 012FB0ED Relevance: 1.6, APIs: 1, Instructions: 79
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegQueryValueExW.KERNELBASE(?,00000E24,3C827DA8,00000000,00000000,00000000,00000000), ref: 012FB18C

Memory Dump Source

Source File: 0000000B.00000002.1509874695.00000000012FA000.00000040.00000800.00020000.00000000.sdmp, Offset: 012FA000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_12fa000_LisectAVT_2403002A_135.jbxd

Similarity

API ID: QueryValue
String ID:
API String ID: 3660427363-0
Opcode ID: 4ba25cf204408c6e5c663ae52f6e3339a43640ab1d446df0e2eda120c5d70beb
Instruction ID: 2a3ca79755fd619d7811fa7b3d05e5711c9c3b5c1367be5f43e8c849b6fc6893
Opcode Fuzzy Hash: 4ba25cf204408c6e5c663ae52f6e3339a43640ab1d446df0e2eda120c5d70beb
Instruction Fuzzy Hash: D0217FB5504744AFE721CF15DC84F63FBFCEF05610F0884AAEA858B652D364E908CBA1

Function 012FB1E2 Relevance: 1.6, APIs: 1, Instructions: 77
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegSetValueExW.KERNELBASE(?,00000E24,3C827DA8,00000000,00000000,00000000,00000000), ref: 012FB278

Memory Dump Source

Source File: 0000000B.00000002.1509874695.00000000012FA000.00000040.00000800.00020000.00000000.sdmp, Offset: 012FA000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_12fa000_LisectAVT_2403002A_135.jbxd

Similarity

API ID: Value
String ID:
API String ID: 3702945584-0
Opcode ID: 86de766d75884a85b585aafd9d3857e3fac640e0b66cfa8dfdd4c392ff32fcbf
Instruction ID: af8925b5174d74e5fce24fba8fb0f1c392dd5b5252c37cb5ba699a87d492fd53
Opcode Fuzzy Hash: 86de766d75884a85b585aafd9d3857e3fac640e0b66cfa8dfdd4c392ff32fcbf
Instruction Fuzzy Hash: 902190765083806FE7228F15DC45F67FFBCEF46210F08849AEA858B652D264E948CB71

Function 012FAA06 Relevance: 1.6, APIs: 1, Instructions: 76
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateFileW.KERNELBASE(?,?,?,?,?,?), ref: 012FAA85

Memory Dump Source

Source File: 0000000B.00000002.1509874695.00000000012FA000.00000040.00000800.00020000.00000000.sdmp, Offset: 012FA000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_12fa000_LisectAVT_2403002A_135.jbxd

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: 8c4ec4a259a6baeeff3dbec44870b35c97916537ee857db14efa950b9030b288
Instruction ID: a33f39e5451cef63330124de04c73f5e7866c25bf12fd3e3af8c22fc1d2865ab
Opcode Fuzzy Hash: 8c4ec4a259a6baeeff3dbec44870b35c97916537ee857db14efa950b9030b288
Instruction Fuzzy Hash: 4121B071504204AFE721CF25CD85B66FBF8EF08224F08886EEA898B651D375E508CB71

Function 012FB756 Relevance: 1.6, APIs: 1, Instructions: 72
synchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateMutexW.KERNELBASE(?,?), ref: 012FB7C9

Memory Dump Source

Source File: 0000000B.00000002.1509874695.00000000012FA000.00000040.00000800.00020000.00000000.sdmp, Offset: 012FA000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_12fa000_LisectAVT_2403002A_135.jbxd

Similarity

API ID: CreateMutex
String ID:
API String ID: 1964310414-0
Opcode ID: 299df1322b4888ba5f95faa870155d0347cd079e5cb6552ffb1cf43ee3b6937f
Instruction ID: a2d3d004834698f1d152434d934e8c81c25e45fa9102dd305ef7615420785cc8
Opcode Fuzzy Hash: 299df1322b4888ba5f95faa870155d0347cd079e5cb6552ffb1cf43ee3b6937f
Instruction Fuzzy Hash: 5B219F715052409FF720DF29DC45B66FBE8EF04624F08C46EEA858B242D375E505CB75

Function 012FAF56 Relevance: 1.6, APIs: 1, Instructions: 72
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetLogicalDrives.KERNELBASE ref: 012FAFDD

Memory Dump Source

Source File: 0000000B.00000002.1509874695.00000000012FA000.00000040.00000800.00020000.00000000.sdmp, Offset: 012FA000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_12fa000_LisectAVT_2403002A_135.jbxd

Similarity

API ID: DrivesLogical
String ID:
API String ID: 999431828-0
Opcode ID: d553c07d9612f98b855d5d3a1f3b811510df3f1f5e2bbe2a228cf808aa78541d
Instruction ID: 6fba43bf75a4ad5e2710eb89e5495bfcb91656f471a10e12e1cc2a876faba4b7
Opcode Fuzzy Hash: d553c07d9612f98b855d5d3a1f3b811510df3f1f5e2bbe2a228cf808aa78541d
Instruction Fuzzy Hash: A421487144E3C09FD7138B259C65691BFB4EF43220F0A84DBD985CF1A3C2696809DB72

Function 012FAC8E Relevance: 1.6, APIs: 1, Instructions: 70
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

ReadFile.KERNELBASE(?,00000E24,3C827DA8,00000000,00000000,00000000,00000000), ref: 012FAD0D

Memory Dump Source

Source File: 0000000B.00000002.1509874695.00000000012FA000.00000040.00000800.00020000.00000000.sdmp, Offset: 012FA000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_12fa000_LisectAVT_2403002A_135.jbxd

Similarity

API ID: FileRead
String ID:
API String ID: 2738559852-0
Opcode ID: 85ab8d230220c61eb16352b9b1d402c67a88d3e0890836134718a31ab70798b8
Instruction ID: e5766e0cb5dcf1e05afde61eb0521b8da6b3ed1d6faf9f2d2b32aa92f85a272c
Opcode Fuzzy Hash: 85ab8d230220c61eb16352b9b1d402c67a88d3e0890836134718a31ab70798b8
Instruction Fuzzy Hash: 0B219F75409380AFD722CF51DC44FA6FFB8EF45224F08849AEA859B152C275A508CBB5

Function 012FB112 Relevance: 1.6, APIs: 1, Instructions: 69
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegQueryValueExW.KERNELBASE(?,00000E24,3C827DA8,00000000,00000000,00000000,00000000), ref: 012FB18C

Memory Dump Source

Source File: 0000000B.00000002.1509874695.00000000012FA000.00000040.00000800.00020000.00000000.sdmp, Offset: 012FA000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_12fa000_LisectAVT_2403002A_135.jbxd

Similarity

API ID: QueryValue
String ID:
API String ID: 3660427363-0
Opcode ID: 2b11028ea16f81e172ba2dadf1e4c415af8e7511e17980e0d27327fea75fe8ac
Instruction ID: 2f9fbafa0db0d737963c7b9a4d7f88e9200a064f00ac05744eeee90f394aa189
Opcode Fuzzy Hash: 2b11028ea16f81e172ba2dadf1e4c415af8e7511e17980e0d27327fea75fe8ac
Instruction Fuzzy Hash: A3216A75604604AFE721CE19CC85F67FBECEF04620F08C46AEB458B651D364E908CAB1

Function 012FB598 Relevance: 1.6, APIs: 1, Instructions: 68
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

FindCloseChangeNotification.KERNELBASE(?), ref: 012FB604

Memory Dump Source

Source File: 0000000B.00000002.1509874695.00000000012FA000.00000040.00000800.00020000.00000000.sdmp, Offset: 012FA000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_12fa000_LisectAVT_2403002A_135.jbxd

Similarity

API ID: ChangeCloseFindNotification
String ID:
API String ID: 2591292051-0
Opcode ID: c5f7d4feb4ad54585263fb4527b19c4529d4b85ac3b1bfa5531c2272a1fdeee6
Instruction ID: 93c0aac3df06a29f2d06f9e19b3f75666dbd19005cd289d721e304ea28b8a75b
Opcode Fuzzy Hash: c5f7d4feb4ad54585263fb4527b19c4529d4b85ac3b1bfa5531c2272a1fdeee6
Instruction Fuzzy Hash: 5E21A1715093C05FDB128F25DD94692BFB4AF07224F0984DAE9858F263D2659908DB62

Function 012FB024 Relevance: 1.6, APIs: 1, Instructions: 66
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CopyFileW.KERNELBASE(?,?,?), ref: 012FB092

Memory Dump Source

Source File: 0000000B.00000002.1509874695.00000000012FA000.00000040.00000800.00020000.00000000.sdmp, Offset: 012FA000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_12fa000_LisectAVT_2403002A_135.jbxd

Similarity

API ID: CopyFile
String ID:
API String ID: 1304948518-0
Opcode ID: 4acf1891434e64c8c88ae0bea5948ed147bf3b1a134e5e91ac69219e9c75fdb6
Instruction ID: d95ba6dae11e0c4840701a3b43fe3479f190d0b97d3c0b5061cb76f33055f60d
Opcode Fuzzy Hash: 4acf1891434e64c8c88ae0bea5948ed147bf3b1a134e5e91ac69219e9c75fdb6
Instruction Fuzzy Hash: 0B2163715093809FDB11CF69DC85B96FFF8EF06210F0884EEEA45CB252D265E848DB61

Function 012FB206 Relevance: 1.6, APIs: 1, Instructions: 65
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegSetValueExW.KERNELBASE(?,00000E24,3C827DA8,00000000,00000000,00000000,00000000), ref: 012FB278

Memory Dump Source

Source File: 0000000B.00000002.1509874695.00000000012FA000.00000040.00000800.00020000.00000000.sdmp, Offset: 012FA000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_12fa000_LisectAVT_2403002A_135.jbxd

Similarity

API ID: Value
String ID:
API String ID: 3702945584-0
Opcode ID: 526449a8d1bc8e9759ab220d912e98f726e558d6cced8d9503eb0dc54e3956d7
Instruction ID: d4afd90072005e1ea0d663331f97bf688de2c74e4aacb1a33e684db35c9dbb0c
Opcode Fuzzy Hash: 526449a8d1bc8e9759ab220d912e98f726e558d6cced8d9503eb0dc54e3956d7
Instruction Fuzzy Hash: C111BBB6614604AFEB218E15CC45F6AFBECEF04624F08C46AEF858A652D374E4048AB5

Function 012FB362 Relevance: 1.6, APIs: 1, Instructions: 64COMMON

Download Yara Rule

APIs

LookupPrivilegeValueW.ADVAPI32(?,?,?), ref: 012FB3CA

Memory Dump Source

Source File: 0000000B.00000002.1509874695.00000000012FA000.00000040.00000800.00020000.00000000.sdmp, Offset: 012FA000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_12fa000_LisectAVT_2403002A_135.jbxd

Similarity

API ID: LookupPrivilegeValue
String ID:
API String ID: 3899507212-0
Opcode ID: 57d4041f1746f38eb320c18d6254365d410314b0c042107d50f1c458f019b592
Instruction ID: a686e6e40d6243de51003d6dee2552715b9441cc5d8f4782a2c281c7be7f98af
Opcode Fuzzy Hash: 57d4041f1746f38eb320c18d6254365d410314b0c042107d50f1c458f019b592
Instruction Fuzzy Hash: D11160B56053819FEB21CF29DD45B62FFE8EF45620F0884AEEE45CB252D275E804CB61

Function 012FA5D5 Relevance: 1.6, APIs: 1, Instructions: 61COMMON

Download Yara Rule

APIs

FindCloseChangeNotification.KERNELBASE(?), ref: 012FA638

Memory Dump Source

Source File: 0000000B.00000002.1509874695.00000000012FA000.00000040.00000800.00020000.00000000.sdmp, Offset: 012FA000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_12fa000_LisectAVT_2403002A_135.jbxd

Similarity

API ID: ChangeCloseFindNotification
String ID:
API String ID: 2591292051-0
Opcode ID: 265456ef41d00a7d6003bd326871e093486ffb8c5daadde159084f7cc78d3d20
Instruction ID: 51dee2ad43b4445741e457d8b183d3126a7d15efe365de8fc96ead0b380e464e
Opcode Fuzzy Hash: 265456ef41d00a7d6003bd326871e093486ffb8c5daadde159084f7cc78d3d20
Instruction Fuzzy Hash: C7117C754493C09FDB128F25DC45792BFB4EF46220F0984EFED858F263C269A948CB62

Function 012FACAE Relevance: 1.6, APIs: 1, Instructions: 60fileCOMMON

Download Yara Rule

APIs

ReadFile.KERNELBASE(?,00000E24,3C827DA8,00000000,00000000,00000000,00000000), ref: 012FAD0D

Memory Dump Source

Source File: 0000000B.00000002.1509874695.00000000012FA000.00000040.00000800.00020000.00000000.sdmp, Offset: 012FA000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_12fa000_LisectAVT_2403002A_135.jbxd

Similarity

API ID: FileRead
String ID:
API String ID: 2738559852-0
Opcode ID: b720642a0f4c141a01220c3e86547b731e790cf563a58acf051ae8ba7fc13d74
Instruction ID: 250138b9d7f5dd8323d6716c5daf30cfcf9088acd46bae232d419d5d4948198d
Opcode Fuzzy Hash: b720642a0f4c141a01220c3e86547b731e790cf563a58acf051ae8ba7fc13d74
Instruction Fuzzy Hash: A711EF75404200AFEB21CF55DC45B66FBE8EF44325F04C46AEA898B291C375A4048BB5

Function 012FB382 Relevance: 1.6, APIs: 1, Instructions: 53COMMON

Download Yara Rule

APIs

LookupPrivilegeValueW.ADVAPI32(?,?,?), ref: 012FB3CA

Memory Dump Source

Source File: 0000000B.00000002.1509874695.00000000012FA000.00000040.00000800.00020000.00000000.sdmp, Offset: 012FA000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_12fa000_LisectAVT_2403002A_135.jbxd

Similarity

API ID: LookupPrivilegeValue
String ID:
API String ID: 3899507212-0
Opcode ID: cac3d650dc914ff3adae89e78a02b15aebf162160124590495b3b1241977575c
Instruction ID: b93542b0d6096036fc3c4b90a9d3d1661574a48d8195abee42d64285fcd08613
Opcode Fuzzy Hash: cac3d650dc914ff3adae89e78a02b15aebf162160124590495b3b1241977575c
Instruction Fuzzy Hash: 3611A1756142018FEB60DF29D885B56FBE8EF04620F08C4BEDE49CB242D375E404CB61

Function 012FB04A Relevance: 1.6, APIs: 1, Instructions: 53fileCOMMON

Download Yara Rule

APIs

CopyFileW.KERNELBASE(?,?,?), ref: 012FB092

Memory Dump Source

Source File: 0000000B.00000002.1509874695.00000000012FA000.00000040.00000800.00020000.00000000.sdmp, Offset: 012FA000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_12fa000_LisectAVT_2403002A_135.jbxd

Similarity

API ID: CopyFile
String ID:
API String ID: 1304948518-0
Opcode ID: cac3d650dc914ff3adae89e78a02b15aebf162160124590495b3b1241977575c
Instruction ID: 2b177ddb0bd733c34d74253529330f360b19be2813133444cbadbc503022f2b8
Opcode Fuzzy Hash: cac3d650dc914ff3adae89e78a02b15aebf162160124590495b3b1241977575c
Instruction Fuzzy Hash: 7F118E716142419FEB60CF29D885B56FBE8EF04221F08C4AEDE59CB642D775E404CA61

Function 012FAB1E Relevance: 1.6, APIs: 1, Instructions: 52COMMON

Download Yara Rule

APIs

GetFileType.KERNELBASE(?,00000E24,3C827DA8,00000000,00000000,00000000,00000000), ref: 012FAB71

Memory Dump Source

Source File: 0000000B.00000002.1509874695.00000000012FA000.00000040.00000800.00020000.00000000.sdmp, Offset: 012FA000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_12fa000_LisectAVT_2403002A_135.jbxd

Similarity

API ID: FileType
String ID:
API String ID: 3081899298-0
Opcode ID: 348bbc2e7d08e937dc935e32a28f84f1ba4d8d30f2a34205d8f9e01dd5630fc7
Instruction ID: ea5df7a76acb5d916fe090797a31598a23b9afd6624c030d405d3dc3c4b8e45d
Opcode Fuzzy Hash: 348bbc2e7d08e937dc935e32a28f84f1ba4d8d30f2a34205d8f9e01dd5630fc7
Instruction Fuzzy Hash: FD01D271548604AEE721CF15DC85F76F7ECDF54624F04C4AAEF498B281E3B8A5048BB5

Function 012FAEC8 Relevance: 1.6, APIs: 1, Instructions: 52COMMON

Download Yara Rule

APIs

FindClose.KERNELBASE(?), ref: 012FAF1C

Memory Dump Source

Source File: 0000000B.00000002.1509874695.00000000012FA000.00000040.00000800.00020000.00000000.sdmp, Offset: 012FA000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_12fa000_LisectAVT_2403002A_135.jbxd

Similarity

API ID: CloseFind
String ID:
API String ID: 1863332320-0
Opcode ID: d709ece9e27777838d7251127b5c4007506b01778163a28277fb0cc7d9d4195e
Instruction ID: 758a968dc2c3a1e4e8371ac053c542b4ec90d02f82aad515a8688e450ae2c331
Opcode Fuzzy Hash: d709ece9e27777838d7251127b5c4007506b01778163a28277fb0cc7d9d4195e
Instruction Fuzzy Hash: 1011A5755093809FD7128F15DD45B52FFB4EF06221F0880EEED858F293D265A948CB62

Function 012FA547 Relevance: 1.6, APIs: 1, Instructions: 50COMMON

Download Yara Rule

APIs

SetErrorMode.KERNELBASE(?), ref: 012FA5A4

Memory Dump Source

Source File: 0000000B.00000002.1509874695.00000000012FA000.00000040.00000800.00020000.00000000.sdmp, Offset: 012FA000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_12fa000_LisectAVT_2403002A_135.jbxd

Similarity

API ID: ErrorMode
String ID:
API String ID: 2340568224-0
Opcode ID: 0d551fd3ffd4d55decc3ca90022c9fceeef85729a6f77f3e881112df5548a54b
Instruction ID: f4317e3939f891470fc6c30a5a26a6b92cd9314c22a5752fcaf12a21f2f0276a
Opcode Fuzzy Hash: 0d551fd3ffd4d55decc3ca90022c9fceeef85729a6f77f3e881112df5548a54b
Instruction Fuzzy Hash: B3118671445380AFD7128F15DC44B62FFF8EF46225F0984DAED444B257D375A948CB61

Function 012FA172 Relevance: 1.5, APIs: 1, Instructions: 47fileCOMMON

Download Yara Rule

APIs

FindNextFileW.KERNELBASE(?,00000E24,?,?), ref: 012FA1C2

Memory Dump Source

Source File: 0000000B.00000002.1509874695.00000000012FA000.00000040.00000800.00020000.00000000.sdmp, Offset: 012FA000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_12fa000_LisectAVT_2403002A_135.jbxd

Similarity

API ID: FileFindNext
String ID:
API String ID: 2029273394-0
Opcode ID: 15b013d6686808f5fe5016c8faa7ae185ef3c9bb4f9679bfdecfc1f0968aef62
Instruction ID: 6408fa7c8269c6e37c7e5aee52336b3827d2cc519f2a86eaba6e67041b2df8d8
Opcode Fuzzy Hash: 15b013d6686808f5fe5016c8faa7ae185ef3c9bb4f9679bfdecfc1f0968aef62
Instruction Fuzzy Hash: 1C015E71500200AFD310DF16DD46B66FBE8EB88A20F14855AED489B641D735B915CBE5

Function 012FA606 Relevance: 1.5, APIs: 1, Instructions: 43COMMON

Download Yara Rule

APIs

FindCloseChangeNotification.KERNELBASE(?), ref: 012FA638

Memory Dump Source

Source File: 0000000B.00000002.1509874695.00000000012FA000.00000040.00000800.00020000.00000000.sdmp, Offset: 012FA000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_12fa000_LisectAVT_2403002A_135.jbxd

Similarity

API ID: ChangeCloseFindNotification
String ID:
API String ID: 2591292051-0
Opcode ID: a82ac7336b82eca1ada4838849784d0cae5fc1d7e85760fce576892f86fdb93f
Instruction ID: ba059193ff35ec786c717955cf92aea448f98128d071aa0f16e32ae720284531
Opcode Fuzzy Hash: a82ac7336b82eca1ada4838849784d0cae5fc1d7e85760fce576892f86fdb93f
Instruction Fuzzy Hash: 2D01DF745142408FDB10CF19D885766FBE4EF40220F08C4AEDE498B352D2B9A844CEA2

Function 012FB5D2 Relevance: 1.5, APIs: 1, Instructions: 43COMMON

Download Yara Rule

APIs

FindCloseChangeNotification.KERNELBASE(?), ref: 012FB604

Memory Dump Source

Source File: 0000000B.00000002.1509874695.00000000012FA000.00000040.00000800.00020000.00000000.sdmp, Offset: 012FA000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_12fa000_LisectAVT_2403002A_135.jbxd

Similarity

API ID: ChangeCloseFindNotification
String ID:
API String ID: 2591292051-0
Opcode ID: 7ac8019c706d0ad260d8398b18308e48c6c0fdf170c8cfb98b88170c083d9e93
Instruction ID: cec5a633038940fc920a70673ba1d37c6316ff9c518fe7b4580dfe9d03d8862f
Opcode Fuzzy Hash: 7ac8019c706d0ad260d8398b18308e48c6c0fdf170c8cfb98b88170c083d9e93
Instruction Fuzzy Hash: 2601DF755056408FDB50CF1AE989762FBE4EF40320F08C0AEDE498B242D2B5E454CBA2

Function 012FAEEA Relevance: 1.5, APIs: 1, Instructions: 39COMMON

Download Yara Rule

APIs

FindClose.KERNELBASE(?), ref: 012FAF1C

Memory Dump Source

Source File: 0000000B.00000002.1509874695.00000000012FA000.00000040.00000800.00020000.00000000.sdmp, Offset: 012FA000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_12fa000_LisectAVT_2403002A_135.jbxd

Similarity

API ID: CloseFind
String ID:
API String ID: 1863332320-0
Opcode ID: 32cf3555a0d2ec6565c75c4d40e534005b65447df278b0ac6361dbf0ea833bfb
Instruction ID: 3403e91fd359485d84e2fd095c82bdf2a57cb2800aa3b1a4c9814577f3f0071e
Opcode Fuzzy Hash: 32cf3555a0d2ec6565c75c4d40e534005b65447df278b0ac6361dbf0ea833bfb
Instruction Fuzzy Hash: 8901D1745146408FDB518F19D985765FBE4EF04231F08C0EEDE498F392D2BAA544CFA2

Function 012FAFAE Relevance: 1.5, APIs: 1, Instructions: 38COMMON

Download Yara Rule

APIs

GetLogicalDrives.KERNELBASE ref: 012FAFDD

Memory Dump Source

Source File: 0000000B.00000002.1509874695.00000000012FA000.00000040.00000800.00020000.00000000.sdmp, Offset: 012FA000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_12fa000_LisectAVT_2403002A_135.jbxd

Similarity

API ID: DrivesLogical
String ID:
API String ID: 999431828-0
Opcode ID: a0559365324b43fd5e56073761d0d8537ad25938bf678b09fc0957c8c67b3067
Instruction ID: 093c0348a27e7b5faa6861696eef5abb060024798834d75f8bd27f9989f152c7
Opcode Fuzzy Hash: a0559365324b43fd5e56073761d0d8537ad25938bf678b09fc0957c8c67b3067
Instruction Fuzzy Hash: C901D1744142408FDB10CF19D885765FBE4EF40620F08C4AECE498F246D3BAA444DFA2

Function 012FA572 Relevance: 1.5, APIs: 1, Instructions: 35COMMON

Download Yara Rule

APIs

SetErrorMode.KERNELBASE(?), ref: 012FA5A4

Memory Dump Source

Source File: 0000000B.00000002.1509874695.00000000012FA000.00000040.00000800.00020000.00000000.sdmp, Offset: 012FA000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_12fa000_LisectAVT_2403002A_135.jbxd

Similarity

API ID: ErrorMode
String ID:
API String ID: 2340568224-0
Opcode ID: ffdd82881b58714dc28ea4f9f9acdb605c9e8aa7f96305d7df9f1a70b1be5002
Instruction ID: 378d354cf0e475530c6e1b4a36c907722b1f49a2c2e89700fd320f926e50e4c4
Opcode Fuzzy Hash: ffdd82881b58714dc28ea4f9f9acdb605c9e8aa7f96305d7df9f1a70b1be5002
Instruction Fuzzy Hash: 20F0AF748146409FDB21CF19E989725FBE4EF04225F08C0AEDE494F756D3B9A544CEA2

Function 01430080 Relevance: 1.4, Strings: 1, Instructions: 108COMMON

Download Yara Rule

Strings

:@zl, xrefs: 0143016D

Memory Dump Source

Source File: 0000000B.00000002.1514054426.0000000001430000.00000040.00000800.00020000.00000000.sdmp, Offset: 01430000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_1430000_LisectAVT_2403002A_135.jbxd

Similarity

API ID:
String ID: :@zl
API String ID: 0-1604122134
Opcode ID: 77136d5ff259a3d33e8963b0091a38b4bad7bcf58a9d6f0e3c8bf455f91b8cc9
Instruction ID: a61034196c66bb485a342bf5508195432f6282074753a010b6e2afcef7024890
Opcode Fuzzy Hash: 77136d5ff259a3d33e8963b0091a38b4bad7bcf58a9d6f0e3c8bf455f91b8cc9
Instruction Fuzzy Hash: 4341A231505205CFD319EB76E6A529ABBEABFD5304F40C13EC6049F258DFB98886CB61

Function 01430090 Relevance: 1.4, Strings: 1, Instructions: 104COMMON

Download Yara Rule

Strings

:@zl, xrefs: 0143016D

Memory Dump Source

Source File: 0000000B.00000002.1514054426.0000000001430000.00000040.00000800.00020000.00000000.sdmp, Offset: 01430000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_1430000_LisectAVT_2403002A_135.jbxd

Similarity

API ID:
String ID: :@zl
API String ID: 0-1604122134
Opcode ID: 2296576d072a0ce8fd8a78235482dbb3539f22c29d2a8f030f7ddfa8f6c387ac
Instruction ID: d979c7e32b8985fd62ac69b74fa9973533c943880eaef632a7eed53c1373250f
Opcode Fuzzy Hash: 2296576d072a0ce8fd8a78235482dbb3539f22c29d2a8f030f7ddfa8f6c387ac
Instruction Fuzzy Hash: 70419031505205CFD319EB76D6A525ABBEABFD5304F40C13EC6049F258DFB98885CBA1

Function 016A05E0 Relevance: 1.3, Strings: 1, Instructions: 45COMMON

Download Yara Rule

Strings

LN, xrefs: 016A05E2

Memory Dump Source

Source File: 0000000B.00000002.1514563042.00000000016A0000.00000040.00000020.00020000.00000000.sdmp, Offset: 016A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_16a0000_LisectAVT_2403002A_135.jbxd

Similarity

API ID:
String ID: LN
API String ID: 0-3677361780
Opcode ID: dcb950687b4c483594aa9ba5b5eb955eab8a4b095c5037392eb3cdabb1254ea9
Instruction ID: 7dec81e0db87e734423233e2aebcca72ec3355f4a174ddd942e5b79bd5551d3c
Opcode Fuzzy Hash: dcb950687b4c483594aa9ba5b5eb955eab8a4b095c5037392eb3cdabb1254ea9
Instruction Fuzzy Hash: A00186B65093806FD7118B06AC40862FFF8EF86620709C09BED4987612D225A904CBB1

Function 054156D7 Relevance: 1.3, Strings: 1, Instructions: 23COMMON

Download Yara Rule

Strings

D, xrefs: 05415704

Memory Dump Source

Source File: 0000000B.00000002.1535529925.0000000005410000.00000040.00000800.00020000.00000000.sdmp, Offset: 05410000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_5410000_LisectAVT_2403002A_135.jbxd

Similarity

API ID:
String ID: D
API String ID: 0-2746444292
Opcode ID: 8bf857cd3cb22ecbdd8fd50c11912b34dc4d5b9ae7003c38db84d7a0114aa7fb
Instruction ID: a99b06615c96a766e073679feb08f2b49baf72160089c9ba5fb9953ecec3d787
Opcode Fuzzy Hash: 8bf857cd3cb22ecbdd8fd50c11912b34dc4d5b9ae7003c38db84d7a0114aa7fb
Instruction Fuzzy Hash: 1DE06D70905380CFCB02CBA495582C87BF5AF46321F054197D446DE502DB7C49478B1A

Function 05415858 Relevance: 1.3, Strings: 1, Instructions: 19COMMON

Download Yara Rule

Strings

E, xrefs: 05415858

Memory Dump Source

Source File: 0000000B.00000002.1535529925.0000000005410000.00000040.00000800.00020000.00000000.sdmp, Offset: 05410000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_5410000_LisectAVT_2403002A_135.jbxd

Similarity

API ID:
String ID: E
API String ID: 0-3568589458
Opcode ID: 3cc53e0a67e1c29e3b6c0ee1110dca2eded0ab5e49f8fc8f9787999bcf7d3648
Instruction ID: 2a65986045efe9c494f042b152e5d0d55059fd6ea6df20434b1bd2c8127b2b67
Opcode Fuzzy Hash: 3cc53e0a67e1c29e3b6c0ee1110dca2eded0ab5e49f8fc8f9787999bcf7d3648
Instruction Fuzzy Hash: B3E086B4D05644CFDB05CBA8D9552DCBFB1FB45315F140157C402D9185DF7889498B09

Function 05415E57 Relevance: 1.3, Strings: 1, Instructions: 19COMMON

Download Yara Rule

Strings

2, xrefs: 05415E89

Memory Dump Source

Source File: 0000000B.00000002.1535529925.0000000005410000.00000040.00000800.00020000.00000000.sdmp, Offset: 05410000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_5410000_LisectAVT_2403002A_135.jbxd

Similarity

API ID:
String ID: 2
API String ID: 0-450215437
Opcode ID: 5dc5141d9521368d1699d5f8adab404ff1a461c9e9334825de47676d1f70b90a
Instruction ID: 1420ebe6c7299445567ae61475beac92996089eb98bc4033108521b7fb492d95
Opcode Fuzzy Hash: 5dc5141d9521368d1699d5f8adab404ff1a461c9e9334825de47676d1f70b90a
Instruction Fuzzy Hash: 18E01A70906344CBDB45DFA4D2581DCBBB6EB44301F1085A7D802EF645DF788A16CB09

Function 05415F6B Relevance: 1.3, Strings: 1, Instructions: 18COMMON

Download Yara Rule

Strings

,, xrefs: 05415F98

Memory Dump Source

Source File: 0000000B.00000002.1535529925.0000000005410000.00000040.00000800.00020000.00000000.sdmp, Offset: 05410000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_5410000_LisectAVT_2403002A_135.jbxd

Similarity

API ID:
String ID: ,
API String ID: 0-3772416878
Opcode ID: cbc1122415d3f2769e185cde5f5f8905982280645b27dbe51f07b45180ebdd13
Instruction ID: a01cb9ab43ed683b6b59f6cefaf1a425686388f3bf435096ce121e4c56427967
Opcode Fuzzy Hash: cbc1122415d3f2769e185cde5f5f8905982280645b27dbe51f07b45180ebdd13
Instruction Fuzzy Hash: 3CE02B30C5A3448BCB519B38D1293C87BB4AF02220F2081CBC8878F757ED380547CB06

Function 0541596E Relevance: 1.3, Strings: 1, Instructions: 17COMMON

Download Yara Rule

Strings

<, xrefs: 0541573C

Memory Dump Source

Source File: 0000000B.00000002.1535529925.0000000005410000.00000040.00000800.00020000.00000000.sdmp, Offset: 05410000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_5410000_LisectAVT_2403002A_135.jbxd

Similarity

API ID:
String ID: <
API String ID: 0-4251816714
Opcode ID: 66f4674d82853aa344760b5e8f33cb81bf83b2f1d9baaf7d8c7186e326c9b524
Instruction ID: 73349999509e3bdba746c6d5fd52b6ba1232d52493470e92c13f5c418189f26e
Opcode Fuzzy Hash: 66f4674d82853aa344760b5e8f33cb81bf83b2f1d9baaf7d8c7186e326c9b524
Instruction Fuzzy Hash: 06E01A74901248CBDB05CFA4D2582ECB7B6AB84341F10946BD803AA284CF788A46CB09

Function 0541615D Relevance: 1.3, Strings: 1, Instructions: 16COMMON

Download Yara Rule

Strings

f, xrefs: 0541615D

Memory Dump Source

Source File: 0000000B.00000002.1535529925.0000000005410000.00000040.00000800.00020000.00000000.sdmp, Offset: 05410000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_5410000_LisectAVT_2403002A_135.jbxd

Similarity

API ID:
String ID: f
API String ID: 0-1993550816
Opcode ID: 0900ff062dfdfd590ad199b1ed84f8f987c2afa2c4cf468494be435900399ad6
Instruction ID: 2f73bdbfc338fa37a5b80d5c195c4980b9d59a6ee24564ad53cef6511d928ce8
Opcode Fuzzy Hash: 0900ff062dfdfd590ad199b1ed84f8f987c2afa2c4cf468494be435900399ad6
Instruction Fuzzy Hash: 25E0B6B0E01244CBDF08DFA5D2585EDBBB7AB84301F108066D802AA244EF788A158E09

Function 054158F8 Relevance: 1.3, Strings: 1, Instructions: 11COMMON

Download Yara Rule

Strings

., xrefs: 0541590E

Memory Dump Source

Source File: 0000000B.00000002.1535529925.0000000005410000.00000040.00000800.00020000.00000000.sdmp, Offset: 05410000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_5410000_LisectAVT_2403002A_135.jbxd

Similarity

API ID:
String ID: .
API String ID: 0-248832578
Opcode ID: 2881e5b49502e14d2b802e00f7fe7bf63f9c0979afa5ba6ec1b5d34329d90207
Instruction ID: 4cd9afbfa2e7576b2853d96ce4584523769705f68e151304f16f8b280ef4fded
Opcode Fuzzy Hash: 2881e5b49502e14d2b802e00f7fe7bf63f9c0979afa5ba6ec1b5d34329d90207
Instruction Fuzzy Hash: 30D09E74905144CBDF18DFA8D1581DCBBB6A744301F204457D80396644CF7889558F09

Function 05415726 Relevance: 1.3, Strings: 1, Instructions: 11COMMON

Download Yara Rule

Strings

<, xrefs: 0541573C

Memory Dump Source

Source File: 0000000B.00000002.1535529925.0000000005410000.00000040.00000800.00020000.00000000.sdmp, Offset: 05410000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_5410000_LisectAVT_2403002A_135.jbxd

Similarity

API ID:
String ID: <
API String ID: 0-4251816714
Opcode ID: 09042fce45af558d15e6174eebed1aebdf8a5e348e463360386031c41ba05d19
Instruction ID: 1cda0c7654a8e2ce6a70d84ed804ec610cf9ae714723948ef72d81baad3179f0
Opcode Fuzzy Hash: 09042fce45af558d15e6174eebed1aebdf8a5e348e463360386031c41ba05d19
Instruction Fuzzy Hash: 00D09274D02248CBDB09DFA8D2585ECBBB6EB44301F10946BD803EA644CF788A56CB09

Function 05415ECD Relevance: 1.3, Strings: 1, Instructions: 11COMMON

Download Yara Rule

Strings

%, xrefs: 05415EE9

Memory Dump Source

Source File: 0000000B.00000002.1535529925.0000000005410000.00000040.00000800.00020000.00000000.sdmp, Offset: 05410000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_5410000_LisectAVT_2403002A_135.jbxd

Similarity

API ID:
String ID: %
API String ID: 0-2567322570
Opcode ID: b933b2b861450e4189ed6ebea003f9801263940a522e4bb09474749d92797301
Instruction ID: 6fef4bd5400409e1327a5c6b41e494a7441d271f9c8d7f037952d6a56af022f9
Opcode Fuzzy Hash: b933b2b861450e4189ed6ebea003f9801263940a522e4bb09474749d92797301
Instruction Fuzzy Hash: 2CC012B4D026048BDB11CBB45C2D3CC77F0FB04325B5401564803A2386EB3444474A04

Function 05415949 Relevance: 1.3, Strings: 1, Instructions: 7COMMON

Download Yara Rule

Strings

H, xrefs: 05415962

Memory Dump Source

Source File: 0000000B.00000002.1535529925.0000000005410000.00000040.00000800.00020000.00000000.sdmp, Offset: 05410000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_5410000_LisectAVT_2403002A_135.jbxd

Similarity

API ID:
String ID: H
API String ID: 0-2852464175
Opcode ID: b8faaef57cf509021861e162dbab38a09337671295f1b5204d85e10d2dde0ffe
Instruction ID: 9e8b133cd98cf56e79d94a26556c2a9724134fee4a7863ed4471198d5506db46
Opcode Fuzzy Hash: b8faaef57cf509021861e162dbab38a09337671295f1b5204d85e10d2dde0ffe
Instruction Fuzzy Hash: 94C002B4A022048BDB55DBA4D52829CBAB5AB84302F0054AB9907A6284DE7849858F05

Function 05415D5E Relevance: 1.3, Strings: 1, Instructions: 7COMMON

Download Yara Rule

Strings

J, xrefs: 05415D77

Memory Dump Source

Source File: 0000000B.00000002.1535529925.0000000005410000.00000040.00000800.00020000.00000000.sdmp, Offset: 05410000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_5410000_LisectAVT_2403002A_135.jbxd

Similarity

API ID:
String ID: J
API String ID: 0-1141589763
Opcode ID: 181961a6c07fa8e43e4d6f0dd6f7252d62fc1605c82cff2ced3063e05632937d
Instruction ID: 202383292d62118aa756d7318c0eb8411e19711ad5b2ddf909cf807d93a18475
Opcode Fuzzy Hash: 181961a6c07fa8e43e4d6f0dd6f7252d62fc1605c82cff2ced3063e05632937d
Instruction Fuzzy Hash: 09C04CB4E02244CFDF55DFA4D16C2DCBAF5EB44301F1090AB990BE2284DE784985CF09

Function 054159D4 Relevance: 1.3, Strings: 1, Instructions: 7COMMON

Download Yara Rule

Strings

&, xrefs: 054159EA

Memory Dump Source

Source File: 0000000B.00000002.1535529925.0000000005410000.00000040.00000800.00020000.00000000.sdmp, Offset: 05410000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_5410000_LisectAVT_2403002A_135.jbxd

Similarity

API ID:
String ID: &
API String ID: 0-1010288
Opcode ID: c5c9531ab99aa22b6b3b54b17655ba255a0fa0fc637b0b2bc711889f0271e361
Instruction ID: cd81669256fb95b6a1b1271b694f6eb9f6fd2bfff8de5a3a2d407a4f6d707a7a
Opcode Fuzzy Hash: c5c9531ab99aa22b6b3b54b17655ba255a0fa0fc637b0b2bc711889f0271e361
Instruction Fuzzy Hash: AEC04C74D022088BDF65DFF8D12C1EDBAF5EB88301F10506B9813A2284DE3844458F15

Function 05415DD6 Relevance: 1.3, Strings: 1, Instructions: 7COMMON

Download Yara Rule

Strings

B, xrefs: 05415DEF

Memory Dump Source

Source File: 0000000B.00000002.1535529925.0000000005410000.00000040.00000800.00020000.00000000.sdmp, Offset: 05410000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_5410000_LisectAVT_2403002A_135.jbxd

Similarity

API ID:
String ID: B
API String ID: 0-1255198513
Opcode ID: 6b1357e439a8ccd48ce66c2180816d18f34b50f668570bdb52d338c990b48588
Instruction ID: 3d0a11c604ec33b69516ac4ffb3d28ec1ec10d660c7f09e460ca9edf7189b2a0
Opcode Fuzzy Hash: 6b1357e439a8ccd48ce66c2180816d18f34b50f668570bdb52d338c990b48588
Instruction Fuzzy Hash: 8BC002B4A032048BDB55DBA4912829CBAF5EB44345F0050AAA90BA2284DE384A458B05

Function 05415D83 Relevance: 1.3, Strings: 1, Instructions: 7COMMON

Download Yara Rule

Strings

E, xrefs: 05415D99

Memory Dump Source

Source File: 0000000B.00000002.1535529925.0000000005410000.00000040.00000800.00020000.00000000.sdmp, Offset: 05410000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_5410000_LisectAVT_2403002A_135.jbxd

Similarity

API ID:
String ID: E
API String ID: 0-3568589458
Opcode ID: 856f73103fdc646f851ad3ceac1440ec51a60854a95bbc37de61a7bf762260f6
Instruction ID: 0301542c76cd5dc816edce714cd8614c180d59c255e01ed2bd154356c4c599cd
Opcode Fuzzy Hash: 856f73103fdc646f851ad3ceac1440ec51a60854a95bbc37de61a7bf762260f6
Instruction Fuzzy Hash: 5CC04CB4D022048BDF55DFA4D56C5DCBAF6EB84302F10506B9907A6284DE784595CB05

Function 05416191 Relevance: 1.3, Strings: 1, Instructions: 7COMMON

Download Yara Rule

Strings

6, xrefs: 054161A7

Memory Dump Source

Source File: 0000000B.00000002.1535529925.0000000005410000.00000040.00000800.00020000.00000000.sdmp, Offset: 05410000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_5410000_LisectAVT_2403002A_135.jbxd

Similarity

API ID:
String ID: 6
API String ID: 0-498629140
Opcode ID: d6464009698d8c66d03559ff7eaa409727ffcf96e5b2bf02e0111338adaee7dd
Instruction ID: 23cdefb4ce495fe0d64eacca37195472c6ad75fb8b244a1d8aecd49b07be1699
Opcode Fuzzy Hash: d6464009698d8c66d03559ff7eaa409727ffcf96e5b2bf02e0111338adaee7dd
Instruction Fuzzy Hash: 83C00274D022049BDB65DFA4912819CBAF9AB44346F10506A9803A6284DE7849458B05

Function 05415C78 Relevance: 1.3, Strings: 1, Instructions: 7COMMON

Download Yara Rule

Strings

!, xrefs: 05415C91

Memory Dump Source

Source File: 0000000B.00000002.1535529925.0000000005410000.00000040.00000800.00020000.00000000.sdmp, Offset: 05410000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_5410000_LisectAVT_2403002A_135.jbxd

Similarity

API ID:
String ID: !
API String ID: 0-2657877971
Opcode ID: a90e4d2884e7f752ebbb804ce26f1997168bdfa219930aa3fef9d42d269a20c5
Instruction ID: 44eec164f9bf51469d5d42927c880c9f407a0c7c78789ccdb428ba10cbd8ec77
Opcode Fuzzy Hash: a90e4d2884e7f752ebbb804ce26f1997168bdfa219930aa3fef9d42d269a20c5
Instruction Fuzzy Hash: 6FC002B4E062088BDB55DBA4952C2DCBAF5AB84302F4050AA9847A6284DF7849858F05

Function 05416021 Relevance: 1.3, Strings: 1, Instructions: 7COMMON

Download Yara Rule

Strings

L, xrefs: 0541603A

Memory Dump Source

Source File: 0000000B.00000002.1535529925.0000000005410000.00000040.00000800.00020000.00000000.sdmp, Offset: 05410000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_5410000_LisectAVT_2403002A_135.jbxd

Similarity

API ID:
String ID: L
API String ID: 0-2909332022
Opcode ID: ffd11fedfc995a174fc70e494caf8d32f0818c0b1d2783766f99e03ae8f4ef41
Instruction ID: a9faecb92d2329a516e07b957e83e42725824082cb07e7d3f9cc26dd89cea9d3
Opcode Fuzzy Hash: ffd11fedfc995a174fc70e494caf8d32f0818c0b1d2783766f99e03ae8f4ef41
Instruction Fuzzy Hash: E2C04CB4E03204CBEF55DFB4D52D6DCBAF5EB84302F0050AB990BA6284DE384945CF05

Function 05415FC7 Relevance: 1.3, Strings: 1, Instructions: 7COMMON

Download Yara Rule

Strings

=, xrefs: 05415FE0

Memory Dump Source

Source File: 0000000B.00000002.1535529925.0000000005410000.00000040.00000800.00020000.00000000.sdmp, Offset: 05410000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_5410000_LisectAVT_2403002A_135.jbxd

Similarity

API ID:
String ID: =
API String ID: 0-2322244508
Opcode ID: caace8df83167484943bdfda407ee3d32b653abc9147f1bde6152bab20a5e4b0
Instruction ID: 075cf2af1218f69d43c3be77ce2f7455d1c752a4ca8fd3ba113755748aa6056f
Opcode Fuzzy Hash: caace8df83167484943bdfda407ee3d32b653abc9147f1bde6152bab20a5e4b0
Instruction Fuzzy Hash: 27C002B4902214CBDB56DBA4952C29CBAB9AB88342F0090AB9807E6684DE3849458F15

Function 054145EE Relevance: .2, Instructions: 161COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.1535529925.0000000005410000.00000040.00000800.00020000.00000000.sdmp, Offset: 05410000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_5410000_LisectAVT_2403002A_135.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a701912ac6280e32781b9535bbc26c6f687c2a1f2274bb2a225063304b4da316
Instruction ID: 9c78efb08517beec9cdbfe16be9febc9a0d09dca52f79e8655a073f12ac04780
Opcode Fuzzy Hash: a701912ac6280e32781b9535bbc26c6f687c2a1f2274bb2a225063304b4da316
Instruction Fuzzy Hash: 5D711BB0A04248CFDF25EFB5D4687EDBBF6BB44304F00815BD856AA284DB744889CF29

Function 05414626 Relevance: .2, Instructions: 158COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.1535529925.0000000005410000.00000040.00000800.00020000.00000000.sdmp, Offset: 05410000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_5410000_LisectAVT_2403002A_135.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 760f69d244f1126da448d61c122a19c80d58d925b92fb1dc1e7957d04593e407
Instruction ID: 35459e4e0ae4c6a238953dd6064a62c2903831cfdb30c2019fa0a23f3db6996c
Opcode Fuzzy Hash: 760f69d244f1126da448d61c122a19c80d58d925b92fb1dc1e7957d04593e407
Instruction Fuzzy Hash: 31710CB0A04148CFDF25EFB9D5587EDBBF6BB44308F00815BD856A6294DB744889CF29

Function 05414283 Relevance: .2, Instructions: 157COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.1535529925.0000000005410000.00000040.00000800.00020000.00000000.sdmp, Offset: 05410000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_5410000_LisectAVT_2403002A_135.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 153ff891896d47085ffcbef3250ac6b450796ab367d53178ad62f3626e0213b1
Instruction ID: f2e6e7b5fdd414cdbe50c39551137c182dfd59d1f047b8d0c25d9085bb03f560
Opcode Fuzzy Hash: 153ff891896d47085ffcbef3250ac6b450796ab367d53178ad62f3626e0213b1
Instruction Fuzzy Hash: D0612AB0A0424DCFDF25EFB5D4587EDBBB6BB44308F00805AD856AB284DB745889CF69

Function 05414462 Relevance: .2, Instructions: 154COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.1535529925.0000000005410000.00000040.00000800.00020000.00000000.sdmp, Offset: 05410000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_5410000_LisectAVT_2403002A_135.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c69ad2231deed69c7ae66dc3058ddbfc84f53f61f59122cd777517a4e2540a61
Instruction ID: 8e59e5a761d9886d1e6eb2f37f2d74fa0c0918f8f2d0f1d7af1542cbe3a48aa8
Opcode Fuzzy Hash: c69ad2231deed69c7ae66dc3058ddbfc84f53f61f59122cd777517a4e2540a61
Instruction Fuzzy Hash: 13611CB0A04148CFDF25EFB5E5587EDBBF6BB44304F00816BD856A6294DB744889CF29

Function 054144D5 Relevance: .2, Instructions: 154COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.1535529925.0000000005410000.00000040.00000800.00020000.00000000.sdmp, Offset: 05410000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_5410000_LisectAVT_2403002A_135.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: df9cf9a0077584a24da34c29b56a079f7c63207e6f3f0c098452de267fb0c5f3
Instruction ID: b94ecb60bd2f7a218d0a06825d4b75000a34f749b737844b7516bfa8a0ef61db
Opcode Fuzzy Hash: df9cf9a0077584a24da34c29b56a079f7c63207e6f3f0c098452de267fb0c5f3
Instruction Fuzzy Hash: 1A611CB0A04148CFDF25EFB5D5587EDBBF6BB44308F00815BD856A6284DB744889CF29

Function 054145D2 Relevance: .2, Instructions: 152COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.1535529925.0000000005410000.00000040.00000800.00020000.00000000.sdmp, Offset: 05410000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_5410000_LisectAVT_2403002A_135.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 35a51dbcdee4fe6d86a53c50127506506aaf49ccf767d55a08c4d08ef9251e1f
Instruction ID: b5a87fbf42646012925e9cc2446acdf79e2a1193a43e3069eab1e63968162e78
Opcode Fuzzy Hash: 35a51dbcdee4fe6d86a53c50127506506aaf49ccf767d55a08c4d08ef9251e1f
Instruction Fuzzy Hash: 966109B0A04248CFDF25DFB5D4587EDBBF6BB44308F00815BD856AA294DB744889CF29

Function 054144CD Relevance: .2, Instructions: 150COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.1535529925.0000000005410000.00000040.00000800.00020000.00000000.sdmp, Offset: 05410000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_5410000_LisectAVT_2403002A_135.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 05dedb020f39e6f4c13656bbffe7629d731401ad5fcc8f7e455afc167148fc0a
Instruction ID: 8eb3bc275322f23213500d79322d4fe198726a0df976220400b88b658cdf43b0
Opcode Fuzzy Hash: 05dedb020f39e6f4c13656bbffe7629d731401ad5fcc8f7e455afc167148fc0a
Instruction Fuzzy Hash: 0D612DB0A04249CFDF25EFB5D5587EDBBF6BB44308F00805BD856A6288DB744889CF29

Function 05414161 Relevance: .1, Instructions: 149COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.1535529925.0000000005410000.00000040.00000800.00020000.00000000.sdmp, Offset: 05410000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_5410000_LisectAVT_2403002A_135.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4ea1eeb01dbd43ebe9b977ad8b54f741e6d957ec16b55bf47fdedf93853e4105
Instruction ID: cf1f37785454dc858729d2d446d177d72bd45eca9858c43734d8db651500b396
Opcode Fuzzy Hash: 4ea1eeb01dbd43ebe9b977ad8b54f741e6d957ec16b55bf47fdedf93853e4105
Instruction Fuzzy Hash: 49613CB0A04248CFDF25EFB5E5587EDBBF6BB44308F00815BD856A6284DB744889CF29

Function 054141DC Relevance: .1, Instructions: 149COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.1535529925.0000000005410000.00000040.00000800.00020000.00000000.sdmp, Offset: 05410000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_5410000_LisectAVT_2403002A_135.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8ba0e52f6f7884c65944b3655db1d69256576579e81c2dd4f6232a31320427c1
Instruction ID: 79614c75614c4bb6fe571f99d13c0c692af791595f0ac4449c9be01ec5402f01
Opcode Fuzzy Hash: 8ba0e52f6f7884c65944b3655db1d69256576579e81c2dd4f6232a31320427c1
Instruction Fuzzy Hash: 7A613DB0A04249CFDF25EFB5D5587EDBBF6BB44308F00815BD856A6284DB744889CF29

Function 054142C6 Relevance: .1, Instructions: 149COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.1535529925.0000000005410000.00000040.00000800.00020000.00000000.sdmp, Offset: 05410000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_5410000_LisectAVT_2403002A_135.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7f88c8eb16b0bc13f0cf5093496f9bfeb9630a95481c40c971afb3d4d63fc3ad
Instruction ID: ac43f4c49825c0588f3539298bedc7c6ae5641b534c3c55b0cc0925a7f2fd068
Opcode Fuzzy Hash: 7f88c8eb16b0bc13f0cf5093496f9bfeb9630a95481c40c971afb3d4d63fc3ad
Instruction Fuzzy Hash: 18613DB0A04148CFDF25EFB5D5587EDBBF6BB44304F00815BD856A6284DB744889CF29

Function 05414EF0 Relevance: .1, Instructions: 96COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.1535529925.0000000005410000.00000040.00000800.00020000.00000000.sdmp, Offset: 05410000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_5410000_LisectAVT_2403002A_135.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3fb4284c4936ae244dd53605e878b87ed30850d4168909c96500b84b1e3942a9
Instruction ID: 32a1b52c600a3b6343203b056b000282f1c2efe73875b325bc5418f7d8947455
Opcode Fuzzy Hash: 3fb4284c4936ae244dd53605e878b87ed30850d4168909c96500b84b1e3942a9
Instruction Fuzzy Hash: 60313534E04204CBCF54DBB5D458AEEBBF6BB88311F1585ABEC06E3348DA359C418B69

Function 05414EE4 Relevance: .1, Instructions: 93COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.1535529925.0000000005410000.00000040.00000800.00020000.00000000.sdmp, Offset: 05410000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_5410000_LisectAVT_2403002A_135.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2764fc0813b700f5c1dc8dab614463ea2077b9415cf1b61543a14da07ede8d84
Instruction ID: febf608bd1fe9b0c31f72c2646e62ec50a4b9dd470f03df038551e5159c12fb9
Opcode Fuzzy Hash: 2764fc0813b700f5c1dc8dab614463ea2077b9415cf1b61543a14da07ede8d84
Instruction Fuzzy Hash: 1B31F735E002048BCF54DBB4D458AEDBBF6BB98311F1585ABE806E3348EA349C418B59

Function 05414FDE Relevance: .1, Instructions: 79COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.1535529925.0000000005410000.00000040.00000800.00020000.00000000.sdmp, Offset: 05410000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_5410000_LisectAVT_2403002A_135.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b49550f91b8d821cbbaad6f7cb2b13eb895a2d9e817223a8e4be7368d8c5ae33
Instruction ID: c8c1f87720fabe1a07ef322df5b2bf6fb6c302d91b13bb378c1d9fd864e1f442
Opcode Fuzzy Hash: b49550f91b8d821cbbaad6f7cb2b13eb895a2d9e817223a8e4be7368d8c5ae33
Instruction Fuzzy Hash: 1C31D235E00204CBCF55DBB4E598AEDBBF6BB98311F1586A7E806E3348DB349C418B58

Function 05415090 Relevance: .1, Instructions: 63COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.1535529925.0000000005410000.00000040.00000800.00020000.00000000.sdmp, Offset: 05410000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_5410000_LisectAVT_2403002A_135.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c81b23366ee27c99fb33943edb44d0b58528f3c7e2e864073670aac0d6600994
Instruction ID: 9f8dc2de2723135b19fcbe900575c3a65dd9986c579870226ea4978feb67ef78
Opcode Fuzzy Hash: c81b23366ee27c99fb33943edb44d0b58528f3c7e2e864073670aac0d6600994
Instruction Fuzzy Hash: 4F21903490920AEFCB01EFA4D4546EDBBB2FF81308F10809AD94697244DB755E49CF96

Function 054150A0 Relevance: .1, Instructions: 61COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.1535529925.0000000005410000.00000040.00000800.00020000.00000000.sdmp, Offset: 05410000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_5410000_LisectAVT_2403002A_135.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1fb69d1a381a9c175e3406875a6faeaa57202903b7fe06674d6d91ee8501ee62
Instruction ID: 66eb7ea28436c6d079b5c442caff76827a392190abe6e6f3de5f35eb4bf2b534
Opcode Fuzzy Hash: 1fb69d1a381a9c175e3406875a6faeaa57202903b7fe06674d6d91ee8501ee62
Instruction Fuzzy Hash: 01213E3490510AEFCB01EFA4D5546EDBBB6FF80308F20805BDA06A7244DB755E89DF96

Function 05414D20 Relevance: .1, Instructions: 52COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.1535529925.0000000005410000.00000040.00000800.00020000.00000000.sdmp, Offset: 05410000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_5410000_LisectAVT_2403002A_135.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 75c4b491c06d017e52d56294b63de4eadc90ab77b57fa338dea4c9bef2ad239b
Instruction ID: 19596a414f1994bd3c920c34ee5f25f5af8b923334e2058e6ea6d1246b4acd20
Opcode Fuzzy Hash: 75c4b491c06d017e52d56294b63de4eadc90ab77b57fa338dea4c9bef2ad239b
Instruction Fuzzy Hash: FB110631A042108FCF559F25E5141A8BBF1AB82354B4681FED946AB385CF384C43CB85

Function 01430006 Relevance: .0, Instructions: 50COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.1514054426.0000000001430000.00000040.00000800.00020000.00000000.sdmp, Offset: 01430000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_1430000_LisectAVT_2403002A_135.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b331ad1750bb1383392d0f527bbca279837cd42660c25090d10ca4305b639ecf
Instruction ID: 6c31c5cf4b2010624c30a058b4be2ed90b75dd2ebe8b5a623c6ed81008e1cd92
Opcode Fuzzy Hash: b331ad1750bb1383392d0f527bbca279837cd42660c25090d10ca4305b639ecf
Instruction Fuzzy Hash: D201DD6148E7C15FC3438B705C625A07FB16D4322434E85DBC4C4CE4A3D21D885AD762

Function 05414D30 Relevance: .0, Instructions: 49COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.1535529925.0000000005410000.00000040.00000800.00020000.00000000.sdmp, Offset: 05410000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_5410000_LisectAVT_2403002A_135.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fd75228b03af819782a70a81f95f4235be817f444dd3ddc8187443169bace69e
Instruction ID: 8a9ccbe988b9451b033a493e776c4c8d8b7823bc62171d850d34d2a600c4d8a6
Opcode Fuzzy Hash: fd75228b03af819782a70a81f95f4235be817f444dd3ddc8187443169bace69e
Instruction Fuzzy Hash: 87012F35A04110CBCF159F25E5246A9B7F5AB81355F4141BEED0A9B384CF344C42CBC5

Function 016A0606 Relevance: .0, Instructions: 27COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.1514563042.00000000016A0000.00000040.00000020.00020000.00000000.sdmp, Offset: 016A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_16a0000_LisectAVT_2403002A_135.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d2f71e7557b85453b7c7da8e91e411db83660055eae22cc49b4b2b000be227c3
Instruction ID: 4a3ad5072f2a4c9e1f393cc60fd90cbc6589f96d8224b3dadb8963eb24568539
Opcode Fuzzy Hash: d2f71e7557b85453b7c7da8e91e411db83660055eae22cc49b4b2b000be227c3
Instruction Fuzzy Hash: 38E06DB66446004F9750CF0BEC41462F7E8EB84631708C06BDC0D8B701E236B5048AA5

Function 0541452A Relevance: .0, Instructions: 19COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.1535529925.0000000005410000.00000040.00000800.00020000.00000000.sdmp, Offset: 05410000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_5410000_LisectAVT_2403002A_135.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4e16d8b5bd6836fdaa9ea2d872720bce117876878b5303825c28584fd7c2aac4
Instruction ID: a79725e8d89be77d1f6418eed12d00747cb5e39340a2e4a272276ae4df261e7f
Opcode Fuzzy Hash: 4e16d8b5bd6836fdaa9ea2d872720bce117876878b5303825c28584fd7c2aac4
Instruction Fuzzy Hash: 9BE0C974A05219CFCB68EF65D4283AD7ABAAB88301F4040AAD94EA66D4CF744D81CF15

Function 0541312F Relevance: .0, Instructions: 18COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.1535529925.0000000005410000.00000040.00000800.00020000.00000000.sdmp, Offset: 05410000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_5410000_LisectAVT_2403002A_135.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 058b5c301eafa09e75ca123ba96386a9501600f508a5efbffdba13e58f4b19d8
Instruction ID: 7b1ebf277ae161affbe11cc8921342b18b44c8f262480abbcfbb8f7df2d15e61
Opcode Fuzzy Hash: 058b5c301eafa09e75ca123ba96386a9501600f508a5efbffdba13e58f4b19d8
Instruction Fuzzy Hash: 96D09E76A08014EF9B04DF88E8444EDB7BAFB48635B540453ED16B7200C7716E9A8B59

Function 054157C0 Relevance: .0, Instructions: 16COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.1535529925.0000000005410000.00000040.00000800.00020000.00000000.sdmp, Offset: 05410000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_5410000_LisectAVT_2403002A_135.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dc7908ac285b8a96a8cb97b39735f9d67e994ce81c60548ce45c418a80ddaa64
Instruction ID: 9d2d5bcd2ffbc5123b45f717d501e0138947246e7ad7e708dfb9af68f3d537d5
Opcode Fuzzy Hash: dc7908ac285b8a96a8cb97b39735f9d67e994ce81c60548ce45c418a80ddaa64
Instruction Fuzzy Hash: 1AE0BFB0D01244CBDF54DFE8D6546DCB7B6AB84301F508456DC07EA244DF78895A8F09

Function 014305C7 Relevance: .0, Instructions: 15COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.1514054426.0000000001430000.00000040.00000800.00020000.00000000.sdmp, Offset: 01430000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_1430000_LisectAVT_2403002A_135.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 458b5e10ca7585a8937061c7252cdfd8b8a03823ff2958ee9b68e6ae18d10ac9
Instruction ID: 5ab65642e56396b7a211d7757396772218eeeaa5367ae6acc812e0bb94a12b10
Opcode Fuzzy Hash: 458b5e10ca7585a8937061c7252cdfd8b8a03823ff2958ee9b68e6ae18d10ac9
Instruction Fuzzy Hash: 9AE09A7094512ACBDBA1CA08C980BED73B1FB48308F5051E5D11CAA294C7746E85CF01

Function 0143119F Relevance: .0, Instructions: 15COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.1514054426.0000000001430000.00000040.00000800.00020000.00000000.sdmp, Offset: 01430000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_1430000_LisectAVT_2403002A_135.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5e997151d0371f252a423ba75ded18d88a3f36c97172ff47107f6fcd4214efc1
Instruction ID: 4bea47f5811c5e462e717f5981b0975f898f008f9463e3a74c741aff06599c5e
Opcode Fuzzy Hash: 5e997151d0371f252a423ba75ded18d88a3f36c97172ff47107f6fcd4214efc1
Instruction Fuzzy Hash: 86E07E7094102ACBDBA2CA08C880AE9B7B1FB49308F5081E5D01DA6260CB319E858F00

Function 014336AC Relevance: .0, Instructions: 15COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.1514054426.0000000001430000.00000040.00000800.00020000.00000000.sdmp, Offset: 01430000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_1430000_LisectAVT_2403002A_135.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5887a4ffbd84246e20f95177b19d88b877a6541b6f7dedef240e8914241b73ef
Instruction ID: 94ed58f0f62280b58944070b0050a923db19d11f606f4394fdbe78f7656421d0
Opcode Fuzzy Hash: 5887a4ffbd84246e20f95177b19d88b877a6541b6f7dedef240e8914241b73ef
Instruction Fuzzy Hash: 87E0EC7494011ACFE765CF14D958BF977B5FB88308F0440E6E51A9A694CB759DC08F00

Function 05414573 Relevance: .0, Instructions: 15COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.1535529925.0000000005410000.00000040.00000800.00020000.00000000.sdmp, Offset: 05410000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_5410000_LisectAVT_2403002A_135.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f18ffb0b9c00ed778c92f018ef6b400926efb06ab6f62413be2232add4ccc81e
Instruction ID: 3d1fec362c483617329be62e8107d46ee178597e555adef3977eb0504fdf7300
Opcode Fuzzy Hash: f18ffb0b9c00ed778c92f018ef6b400926efb06ab6f62413be2232add4ccc81e
Instruction Fuzzy Hash: A4E07E70908108CFDF25DFA8E5A819CBFB5AB44301F20422AE802A2294CF7408828F04

Function 012F23F4 Relevance: .0, Instructions: 15COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.1509742183.00000000012F2000.00000040.00000800.00020000.00000000.sdmp, Offset: 012F2000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_12f2000_LisectAVT_2403002A_135.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3c12d7678bc677d10bfc4a41be17345743eac46b955147fd08ba1cce9d33de60
Instruction ID: 51e80e415e7e8b1524459358eadb4e5a612efd0e79976fdcd00c2c76e2847aa2
Opcode Fuzzy Hash: 3c12d7678bc677d10bfc4a41be17345743eac46b955147fd08ba1cce9d33de60
Instruction Fuzzy Hash: 81D02E39204A928FF3238A0CC1A4B853BE4AB42704F0A40FEAA008F363C3A8D480C600

Function 05415228 Relevance: .0, Instructions: 14COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.1535529925.0000000005410000.00000040.00000800.00020000.00000000.sdmp, Offset: 05410000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_5410000_LisectAVT_2403002A_135.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6ccc2bb1d12ffd373b527a910d66a866a7c9ed795a373a26c6afdf8d2cd5dad4
Instruction ID: 28b57295ca5e6a4b57886d8d13f7285df7172827e8f6a7312262eb1d83e6effe
Opcode Fuzzy Hash: 6ccc2bb1d12ffd373b527a910d66a866a7c9ed795a373a26c6afdf8d2cd5dad4
Instruction Fuzzy Hash: 20D02230A893008FCB86CFB0A0020D437F06FAA36430040FFEA4CC7263C6291C0A8B01

Function 012F23BC Relevance: .0, Instructions: 14COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.1509742183.00000000012F2000.00000040.00000800.00020000.00000000.sdmp, Offset: 012F2000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_12f2000_LisectAVT_2403002A_135.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ea781cbd51fb86f42b840b1dbf8c69f46d5b85f38fc9d0a74542cd9cbbb13af9
Instruction ID: cc982abf02a59c50b0f1dde2b939988651a4a9aa69505f99d5d009e2da678920
Opcode Fuzzy Hash: ea781cbd51fb86f42b840b1dbf8c69f46d5b85f38fc9d0a74542cd9cbbb13af9
Instruction Fuzzy Hash: 20D05E742006828BD725DB0CC6D4F5977E4EB41714F0644FCBE108B262C7A8D8C0DA00

Function 05415560 Relevance: .0, Instructions: 13COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.1535529925.0000000005410000.00000040.00000800.00020000.00000000.sdmp, Offset: 05410000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_5410000_LisectAVT_2403002A_135.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3b403c28eeef29e3f05330bae2d215d70bac3b645f807e43b041ec329c2f9605
Instruction ID: 0499001e06f237a37b246ae4ae98559f6e5ac054011d17fd777a6cc23044bc9f
Opcode Fuzzy Hash: 3b403c28eeef29e3f05330bae2d215d70bac3b645f807e43b041ec329c2f9605
Instruction Fuzzy Hash: 22D0122014E3C45FD34317B554102847FA85F53634F1504CBD4C48F4A3D1450925D726

Function 05414E70 Relevance: .0, Instructions: 13COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.1535529925.0000000005410000.00000040.00000800.00020000.00000000.sdmp, Offset: 05410000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_5410000_LisectAVT_2403002A_135.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1b08f1a0201fbd469b09fe2dea2412ba7d5adeb8efaa415d7082e53c346a938c
Instruction ID: 0766cf2475c570c58d8e943b20d0a4337f4f850b266c5cd85e898fd9592f68c0
Opcode Fuzzy Hash: 1b08f1a0201fbd469b09fe2dea2412ba7d5adeb8efaa415d7082e53c346a938c
Instruction Fuzzy Hash: ADD0A7304983418FC7F25B7094021A437F0AF52354B6400FFC08086D56D33D4842CB02

Function 0143AC40 Relevance: .0, Instructions: 12COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.1514054426.0000000001430000.00000040.00000800.00020000.00000000.sdmp, Offset: 01430000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_1430000_LisectAVT_2403002A_135.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: facda4f29498db88cb3271793e77b85094304cee52e943a9813177800f092b7f
Instruction ID: 0a1ac3df5a2e733b552ca4229cfced2b6f7b70580dbf601ffe316496859c2b41
Opcode Fuzzy Hash: facda4f29498db88cb3271793e77b85094304cee52e943a9813177800f092b7f
Instruction Fuzzy Hash: E5C02B313101249BC11D32CC70242FE72CDE78B371F00003BE60993380CD428C0107E5

Function 01433355 Relevance: .0, Instructions: 12COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.1514054426.0000000001430000.00000040.00000800.00020000.00000000.sdmp, Offset: 01430000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_1430000_LisectAVT_2403002A_135.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8f0a9f34eca0f10a942a7af4cd129668ac89de29b33f78b64fc0ace4ed249e56
Instruction ID: 4c5766c13fd3b43b2bbd567a4699c10348988db85209ee30009629dff724a0b9
Opcode Fuzzy Hash: 8f0a9f34eca0f10a942a7af4cd129668ac89de29b33f78b64fc0ace4ed249e56
Instruction Fuzzy Hash: ADD01730900219CBEB2ACF11CDA47A8B6BAAB98300F40C0DA900E6A654CA305B8A8F04

Function 05415500 Relevance: .0, Instructions: 11COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.1535529925.0000000005410000.00000040.00000800.00020000.00000000.sdmp, Offset: 05410000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_5410000_LisectAVT_2403002A_135.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 330735cb1f9551459f29f6a2f6ffa7e7563c050701b6d1d9b7f6af3b7fd63f83
Instruction ID: c171b26948dc502a86150ebaf38fb004776c14e1359ac3c4013cf33857ead148
Opcode Fuzzy Hash: 330735cb1f9551459f29f6a2f6ffa7e7563c050701b6d1d9b7f6af3b7fd63f83
Instruction Fuzzy Hash: 44C08C3004D3CA0FC3830B7E9491011BFB86D9312870800DBE488CDD23D28948B9CB93

Function 05416460 Relevance: .0, Instructions: 11COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.1535529925.0000000005410000.00000040.00000800.00020000.00000000.sdmp, Offset: 05410000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_5410000_LisectAVT_2403002A_135.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9dc2f6c402d650d1d3f958434defb2bd395ffb373b5b30a7efa52a2af877e309
Instruction ID: 4463a82aabed47be01151b0f1ef4ae99b33f4687e3cbba14c9ce09ca1d1f5f0b
Opcode Fuzzy Hash: 9dc2f6c402d650d1d3f958434defb2bd395ffb373b5b30a7efa52a2af877e309
Instruction Fuzzy Hash: 12C08C2108E3C84FC30343B138105113FA8090302834600FBC5888E8A3E68B0D82C316

Function 05415070 Relevance: .0, Instructions: 11COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.1535529925.0000000005410000.00000040.00000800.00020000.00000000.sdmp, Offset: 05410000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_5410000_LisectAVT_2403002A_135.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9e5d1e82574435852c3e5cf6c6bf1b8a87b196e6d69a0274a6dfeeed9dd930b9
Instruction ID: 91eba30682836c2f8cf6c962d6fff167a9fd6e2ac0a74948d8289f9982954fef
Opcode Fuzzy Hash: 9e5d1e82574435852c3e5cf6c6bf1b8a87b196e6d69a0274a6dfeeed9dd930b9
Instruction Fuzzy Hash: F6C08C3049A3C0EFCB472FB0A8240903FB4EA2332070A04EAC089C6022C2BA8C08CF21

Function 01437112 Relevance: .0, Instructions: 10COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.1514054426.0000000001430000.00000040.00000800.00020000.00000000.sdmp, Offset: 01430000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_1430000_LisectAVT_2403002A_135.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 189242da2ad62f5675d4ec7947952b10e7ef2265cae1fa6c21a9fd5946f28a7e
Instruction ID: 0d66144350f15ee0925315465bff24458515588c5739a25049340ca32af5bbbb
Opcode Fuzzy Hash: 189242da2ad62f5675d4ec7947952b10e7ef2265cae1fa6c21a9fd5946f28a7e
Instruction Fuzzy Hash: FCD0C970A005159FDB659B74C9687EE7BF5BB4D308F4041AA940AE2684CE344E818F61

Function 01436F08 Relevance: .0, Instructions: 10COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.1514054426.0000000001430000.00000040.00000800.00020000.00000000.sdmp, Offset: 01430000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_1430000_LisectAVT_2403002A_135.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6befd0149114dca9acd912cdf3299d4b0b0af0f5f4829769f07615b123a53c40
Instruction ID: 13dc4c6d86cb90101e48e2f61aa4ceb990bd36cdbaa2153a85b2012b6146ce9b
Opcode Fuzzy Hash: 6befd0149114dca9acd912cdf3299d4b0b0af0f5f4829769f07615b123a53c40
Instruction Fuzzy Hash: E6D06C34E102148FEB65DB74D8686ADBBF5BB88305F10006A940A93695DE3408828F00

Function 0143E1A8 Relevance: .0, Instructions: 9COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.1514054426.0000000001430000.00000040.00000800.00020000.00000000.sdmp, Offset: 01430000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_1430000_LisectAVT_2403002A_135.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4c8277187106110930514c4efc6b199a24d801fdd169b8af1aa91b439dbc712c
Instruction ID: 2858654c02896c64c4812ce2d18324c371664d3607c225fdf55bfdb213dc09d6
Opcode Fuzzy Hash: 4c8277187106110930514c4efc6b199a24d801fdd169b8af1aa91b439dbc712c
Instruction Fuzzy Hash: A2C08C3000AFC88FDB232266F1283A27FDC3705308F4C0083E4888539BC2E69040C361

Function 054154A0 Relevance: .0, Instructions: 9COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.1535529925.0000000005410000.00000040.00000800.00020000.00000000.sdmp, Offset: 05410000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_5410000_LisectAVT_2403002A_135.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8b2227f2e7366b6a0e5c998230a623996d4b54ca92d6e66d955391eca71586c8
Instruction ID: 74e923f0de1ee70d622ea56fdc4667be237446eedf619773a5faa9c788fa9f4b
Opcode Fuzzy Hash: 8b2227f2e7366b6a0e5c998230a623996d4b54ca92d6e66d955391eca71586c8
Instruction Fuzzy Hash: 2CC08C308093C0AFDB439BA024A00D03FF0A91336471610C6C044C8862812948668301

Function 05414E98 Relevance: .0, Instructions: 9COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.1535529925.0000000005410000.00000040.00000800.00020000.00000000.sdmp, Offset: 05410000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_5410000_LisectAVT_2403002A_135.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8dded328991c720c5117eead81464289a4a86dc9d4e1d291e98a21bdd20ddd54
Instruction ID: 59d95e590a8790ed11eb75d4ea67c73113e0ec98624bfed4af95cfac336871de
Opcode Fuzzy Hash: 8dded328991c720c5117eead81464289a4a86dc9d4e1d291e98a21bdd20ddd54
Instruction Fuzzy Hash: 0FC02B31403354CFC722BF30641C0CC7B74F93121134401EFD0C5C20118B3504028B00

Function 0143326C Relevance: .0, Instructions: 8COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.1514054426.0000000001430000.00000040.00000800.00020000.00000000.sdmp, Offset: 01430000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_1430000_LisectAVT_2403002A_135.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2ba1358c08e11f1fd384df8ef6c3ebfa3e2b5139e90bb65e16345ee34c5a672e
Instruction ID: 66bf579eb7cdd51f3ee1d78ad897d4e048cde65c046851acde66789a3053ee24
Opcode Fuzzy Hash: 2ba1358c08e11f1fd384df8ef6c3ebfa3e2b5139e90bb65e16345ee34c5a672e
Instruction Fuzzy Hash: 46D012B444511ACACBA28F08D8906FD72B1FB4630CF1182F6C069AA1F4CB715EC28F00

Function 05414BAC Relevance: .0, Instructions: 7COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.1535529925.0000000005410000.00000040.00000800.00020000.00000000.sdmp, Offset: 05410000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_5410000_LisectAVT_2403002A_135.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 23e31615efa6d3d9bba0c7aa69b1e1a858290c5ffef074eaa44164a42ea2b489
Instruction ID: 7222479484cb28407b6547403913d7d89b569cd322788f94da30321b432abcec
Opcode Fuzzy Hash: 23e31615efa6d3d9bba0c7aa69b1e1a858290c5ffef074eaa44164a42ea2b489
Instruction Fuzzy Hash: E2B0123044974846C28623B470050533F5CC44161874000C2E40C4400346011111C249

Function 014365BF Relevance: .0, Instructions: 6COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.1514054426.0000000001430000.00000040.00000800.00020000.00000000.sdmp, Offset: 01430000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_1430000_LisectAVT_2403002A_135.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 74218f1191b9cab7b126dc0a184418810fae5d164a7d625e7f3035d22d2d00b4
Instruction ID: 4471958b1e32afd435d52c5983b9b0bc013e7f124a3302e99477e2fc2c8ea3a0
Opcode Fuzzy Hash: 74218f1191b9cab7b126dc0a184418810fae5d164a7d625e7f3035d22d2d00b4
Instruction Fuzzy Hash: BEC09B749853159FD76CDB24C79D5A5BF797745304F0440BBC5450D554CB740582DF04

Function 0143A4D8 Relevance: .0, Instructions: 6COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.1514054426.0000000001430000.00000040.00000800.00020000.00000000.sdmp, Offset: 01430000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_1430000_LisectAVT_2403002A_135.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3dc6203dbfb50622b21a797dfcecce1dbc2136387bbd9e779d6f274b82cc7869
Instruction ID: b708e9835f098e9f785116f6504b3911bd22f5b392e1c6c91b9469a124d985e3
Opcode Fuzzy Hash: 3dc6203dbfb50622b21a797dfcecce1dbc2136387bbd9e779d6f274b82cc7869
Instruction Fuzzy Hash: 23A0223008030C8FAA0233E2300C00A338CBAF820CBC00023E00E828028E2020000EE2

Function 0143A228 Relevance: .0, Instructions: 6COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.1514054426.0000000001430000.00000040.00000800.00020000.00000000.sdmp, Offset: 01430000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_1430000_LisectAVT_2403002A_135.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c2b739e6143de4b2e80f1910f2a15913308529585e9a6837397fe98f9abcd8c9
Instruction ID: ce9f0d320568e7aeddd1da0d443e20918fc001d358bb9c195afdc7c1ad0b123c
Opcode Fuzzy Hash: c2b739e6143de4b2e80f1910f2a15913308529585e9a6837397fe98f9abcd8c9
Instruction Fuzzy Hash: 32A011300002088BC200ABA8E008EA033ECAB08A08F0000F0A20C8BA228A22B8008A82

Function 05414B8A Relevance: .0, Instructions: 6COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.1535529925.0000000005410000.00000040.00000800.00020000.00000000.sdmp, Offset: 05410000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_5410000_LisectAVT_2403002A_135.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 281c1fd3041fdafaa1bf681295f5bda87d302044b3aec8b0804743c05fc8ad1e
Instruction ID: f23787cf8bc8255bf69bca017afa9f31c3f93a183b3b326821698b09ee0c1d63
Opcode Fuzzy Hash: 281c1fd3041fdafaa1bf681295f5bda87d302044b3aec8b0804743c05fc8ad1e
Instruction Fuzzy Hash: C4B012308943045BCBD05A5470800DD73E46EC022CF21452FD88810531436249504901

Function 0143E538 Relevance: .0, Instructions: 5COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.1514054426.0000000001430000.00000040.00000800.00020000.00000000.sdmp, Offset: 01430000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_1430000_LisectAVT_2403002A_135.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a6f2774037eadc838203d3339d771e3abc53ca3477e9593f6610460d159577c3
Instruction ID: 7c0908e8ff63d1956929b703af646e5a98292715da6434b6a1a1baa7dd6a1233
Opcode Fuzzy Hash: a6f2774037eadc838203d3339d771e3abc53ca3477e9593f6610460d159577c3
Instruction Fuzzy Hash: D690223200020C8FC200238C3008000338CF000A00B800002A00C000000A0020000280

Function 0143A0E0 Relevance: .0, Instructions: 5COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.1514054426.0000000001430000.00000040.00000800.00020000.00000000.sdmp, Offset: 01430000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_1430000_LisectAVT_2403002A_135.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cb4d783578d525ead97153faf73e26457b3700e8b37231740fa34d1003767ebd
Instruction ID: 96b223807c3d53cc4e5904f79492d6240b70ff07a5af7b735c029b751b99e241
Opcode Fuzzy Hash: cb4d783578d525ead97153faf73e26457b3700e8b37231740fa34d1003767ebd
Instruction Fuzzy Hash:

Function 0143E0A0 Relevance: .0, Instructions: 5COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.1514054426.0000000001430000.00000040.00000800.00020000.00000000.sdmp, Offset: 01430000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_1430000_LisectAVT_2403002A_135.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8b1327b942cdd0d364f219b163860c7ea807d07ca6bcde237e15bd237e94fc3c
Instruction ID: eed384848378c1fc276c5c688dd2f08bc4b315ea8e9d658e6456bd9f74ebf2eb
Opcode Fuzzy Hash: 8b1327b942cdd0d364f219b163860c7ea807d07ca6bcde237e15bd237e94fc3c
Instruction Fuzzy Hash: 7090223000020C8F80022382300A022B38CA000200B800002A00C002020E0020000280

Function 0143A350 Relevance: .0, Instructions: 5COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.1514054426.0000000001430000.00000040.00000800.00020000.00000000.sdmp, Offset: 01430000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_1430000_LisectAVT_2403002A_135.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d97abee23754980cc930dcb022528a3d30ea697fff8af4cd181d85e0ef1333dc
Instruction ID: b92b9b45eabd30c34984c4522f5d0683330f3cd935538dcb754d25913d557ff7
Opcode Fuzzy Hash: d97abee23754980cc930dcb022528a3d30ea697fff8af4cd181d85e0ef1333dc
Instruction Fuzzy Hash:

Function 0143E320 Relevance: .0, Instructions: 5COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.1514054426.0000000001430000.00000040.00000800.00020000.00000000.sdmp, Offset: 01430000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_1430000_LisectAVT_2403002A_135.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b585ccae5eaaee204b1a5c9301a179c7c2cabb53d041873ef66442b194334904
Instruction ID: f2398d17fdfaa232c225d8816099307545283e2763f050e44ccbac1c5b4fdda9
Opcode Fuzzy Hash: b585ccae5eaaee204b1a5c9301a179c7c2cabb53d041873ef66442b194334904
Instruction Fuzzy Hash: 4890023504560C9F85516795785A5D67B9CA544636B800052A50D426055B5564504695

Function 01439E50 Relevance: .0, Instructions: 5COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.1514054426.0000000001430000.00000040.00000800.00020000.00000000.sdmp, Offset: 01430000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_1430000_LisectAVT_2403002A_135.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3e51e23382fc2a203d9b4b3b0e5580ad80d2b549d2d3baeb02b07ed1b54068ac
Instruction ID: 6e1537b8c9726219141c9a5280b67a5dbed4f5c8ecd28ffd318faea9db88b680
Opcode Fuzzy Hash: 3e51e23382fc2a203d9b4b3b0e5580ad80d2b549d2d3baeb02b07ed1b54068ac
Instruction Fuzzy Hash:

Analysis Process: LisectAVT_2403002A_135.exePID: 2636, Parent PID: 3968COMMON

Execution Graph

Execution Coverage:	8.8%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	0%
Total number of Nodes:	67
Total number of Limit Nodes:	5

Executed Functions

Function 013FB4CB Relevance: 1.6, APIs: 1, Instructions: 75
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

AdjustTokenPrivileges.KERNELBASE(?,?,?,?,?,?), ref: 013FB54B

Memory Dump Source

Source File: 0000000C.00000002.1586169989.00000000013FA000.00000040.00000800.00020000.00000000.sdmp, Offset: 013FA000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_13fa000_LisectAVT_2403002A_135.jbxd

Similarity

API ID: AdjustPrivilegesToken
String ID:
API String ID: 2874748243-0
Opcode ID: be34eaf2d0f8a1cf1cd3beb126067419086d1c3489904c81d2ce6c6119fbceac
Instruction ID: d4305dfbbd8f6249fa2f1cec0f895f975d4ff5151bab436cd0edb191ade5ca51
Opcode Fuzzy Hash: be34eaf2d0f8a1cf1cd3beb126067419086d1c3489904c81d2ce6c6119fbceac
Instruction Fuzzy Hash: 2D219FB55097849FDB228F25DC44B92BFF4EF06314F0884DEE9858B163D275D908DB62

Function 013FA7AD Relevance: 1.6, APIs: 1, Instructions: 62nativeCOMMON

Download Yara Rule

APIs

NtQuerySystemInformation.NTDLL ref: 013FA821

Memory Dump Source

Source File: 0000000C.00000002.1586169989.00000000013FA000.00000040.00000800.00020000.00000000.sdmp, Offset: 013FA000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_13fa000_LisectAVT_2403002A_135.jbxd

Similarity

API ID: InformationQuerySystem
String ID:
API String ID: 3562636166-0
Opcode ID: b8ccbc13faf533d2a845cbc72ec80a3c4ddb76c14ff6a973562361aee51ee686
Instruction ID: 069d2c8e25f7103682be68d8d932563f3ae3587767ee742862985bebe209d1ce
Opcode Fuzzy Hash: b8ccbc13faf533d2a845cbc72ec80a3c4ddb76c14ff6a973562361aee51ee686
Instruction Fuzzy Hash: 6021897540D7C09FDB238F21DC84A92BFB4EF07224F0984DEE9858B163D265A919DB62

Function 013FB502 Relevance: 1.6, APIs: 1, Instructions: 52COMMON

Download Yara Rule

APIs

AdjustTokenPrivileges.KERNELBASE(?,?,?,?,?,?), ref: 013FB54B

Memory Dump Source

Source File: 0000000C.00000002.1586169989.00000000013FA000.00000040.00000800.00020000.00000000.sdmp, Offset: 013FA000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_13fa000_LisectAVT_2403002A_135.jbxd

Similarity

API ID: AdjustPrivilegesToken
String ID:
API String ID: 2874748243-0
Opcode ID: 9af3e0888fa73fefae019fc43bbc11e757dee6c7a5829aa7cbe96e176bd8244c
Instruction ID: c1e7636222c54abc499bce8b9e80ac67092fed985100c86674c6f8aa7e16fa6d
Opcode Fuzzy Hash: 9af3e0888fa73fefae019fc43bbc11e757dee6c7a5829aa7cbe96e176bd8244c
Instruction Fuzzy Hash: 44119E75504644DFDB20CF15D984B56FBE8EF04324F08C4AEDE498B666D335E418DB61

Function 013FA7E6 Relevance: 1.5, APIs: 1, Instructions: 38nativeCOMMON

Download Yara Rule

APIs

NtQuerySystemInformation.NTDLL ref: 013FA821

Memory Dump Source

Source File: 0000000C.00000002.1586169989.00000000013FA000.00000040.00000800.00020000.00000000.sdmp, Offset: 013FA000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_13fa000_LisectAVT_2403002A_135.jbxd

Similarity

API ID: InformationQuerySystem
String ID:
API String ID: 3562636166-0
Opcode ID: 4e817d098c07722938b080bb3b921b618180dbb64cb08ab5138a613a42c1b9a9
Instruction ID: 8ae911c4fac5bbf70c3533624001feaf645bb37c07fa880962bd6274a555e277
Opcode Fuzzy Hash: 4e817d098c07722938b080bb3b921b618180dbb64cb08ab5138a613a42c1b9a9
Instruction Fuzzy Hash: D4018B314046449FDB218F09D884B61FFE4EF08328F08C4AEDE894B662D3B5A418CFA2

Function 013FA9CF Relevance: 1.6, APIs: 1, Instructions: 98
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateFileW.KERNELBASE(?,?,?,?,?,?), ref: 013FAA85

Memory Dump Source

Source File: 0000000C.00000002.1586169989.00000000013FA000.00000040.00000800.00020000.00000000.sdmp, Offset: 013FA000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_13fa000_LisectAVT_2403002A_135.jbxd

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: cccc62e884b570275290f11afb053a008748919ad34e7a491887188629e264a8
Instruction ID: 36a526b91bcba252bedb3f11e88719f858bea478bb23edf5c848aa5f9ed396ba
Opcode Fuzzy Hash: cccc62e884b570275290f11afb053a008748919ad34e7a491887188629e264a8
Instruction Fuzzy Hash: BF3190B1405380AFE722CF25DD44B62BFF8EF06214F08849EEA858B662D375E509CB71

Function 013FB722 Relevance: 1.6, APIs: 1, Instructions: 89
synchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateMutexW.KERNELBASE(?,?), ref: 013FB7C9

Memory Dump Source

Source File: 0000000C.00000002.1586169989.00000000013FA000.00000040.00000800.00020000.00000000.sdmp, Offset: 013FA000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_13fa000_LisectAVT_2403002A_135.jbxd

Similarity

API ID: CreateMutex
String ID:
API String ID: 1964310414-0
Opcode ID: 7d14270dd9e75c8c98131bfcb1495cc7bbb55dbaf1925cfc8207e30cec75b317
Instruction ID: 0c603e202585e584056844dcf3a2d2fd2de1c7942193353d56078096904ecf20
Opcode Fuzzy Hash: 7d14270dd9e75c8c98131bfcb1495cc7bbb55dbaf1925cfc8207e30cec75b317
Instruction Fuzzy Hash: 8F317EB55093806FE712CF25DC45B96FFF8EF06214F09849EEA84CB292D365A909CB61

Function 013FA120 Relevance: 1.6, APIs: 1, Instructions: 84
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

FindNextFileW.KERNELBASE(?,00000E24,?,?), ref: 013FA1C2

Memory Dump Source

Source File: 0000000C.00000002.1586169989.00000000013FA000.00000040.00000800.00020000.00000000.sdmp, Offset: 013FA000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_13fa000_LisectAVT_2403002A_135.jbxd

Similarity

API ID: FileFindNext
String ID:
API String ID: 2029273394-0
Opcode ID: a3ae6349e36613e082ec94021ff9d2d11177265e9e641726aeefb9eb5a1c7558
Instruction ID: f25da1ebb87174f735aafc4cf09c9f40ea8c33b704ba2ba7700b2c92b323ab61
Opcode Fuzzy Hash: a3ae6349e36613e082ec94021ff9d2d11177265e9e641726aeefb9eb5a1c7558
Instruction Fuzzy Hash: B321917150D3C06FD3128B258C61BA6BFB4EF47610F0A80CBD984CF5A3D225A919D7A2

Function 013FAADC Relevance: 1.6, APIs: 1, Instructions: 80
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetFileType.KERNELBASE(?,00000E24,1B46BF0F,00000000,00000000,00000000,00000000), ref: 013FAB71

Memory Dump Source

Source File: 0000000C.00000002.1586169989.00000000013FA000.00000040.00000800.00020000.00000000.sdmp, Offset: 013FA000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_13fa000_LisectAVT_2403002A_135.jbxd

Similarity

API ID: FileType
String ID:
API String ID: 3081899298-0
Opcode ID: d46c32b56b4673c5cbc61533722b2aa55652bbbce85c2a19664249f81ab144c0
Instruction ID: 8a0e8386a34c6e721d5296bddd948f043441c33a0c4600cf879e73ec66a76d66
Opcode Fuzzy Hash: d46c32b56b4673c5cbc61533722b2aa55652bbbce85c2a19664249f81ab144c0
Instruction Fuzzy Hash: F52128754097806FE7138B21DC41BA2BFACDF07324F0980DAE9848B1A3D2645909CB75

Function 013FB0ED Relevance: 1.6, APIs: 1, Instructions: 79
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegQueryValueExW.KERNELBASE(?,00000E24,1B46BF0F,00000000,00000000,00000000,00000000), ref: 013FB18C

Memory Dump Source

Source File: 0000000C.00000002.1586169989.00000000013FA000.00000040.00000800.00020000.00000000.sdmp, Offset: 013FA000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_13fa000_LisectAVT_2403002A_135.jbxd

Similarity

API ID: QueryValue
String ID:
API String ID: 3660427363-0
Opcode ID: c2c7bb5c42d3329cd0707e430a97c7b1996d5fb93690cc46e55713f1d298b361
Instruction ID: b239dca84bdd1e51f12e2e4bb53edc4647c7ea7d115bfe51a91442bdde4ce3de
Opcode Fuzzy Hash: c2c7bb5c42d3329cd0707e430a97c7b1996d5fb93690cc46e55713f1d298b361
Instruction Fuzzy Hash: 80219FB5504744AFE721CF15CC84FA3FBECEF05214F08849AEA858B262D324E908CB71

Function 013FB1E2 Relevance: 1.6, APIs: 1, Instructions: 77
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegSetValueExW.KERNELBASE(?,00000E24,1B46BF0F,00000000,00000000,00000000,00000000), ref: 013FB278

Memory Dump Source

Source File: 0000000C.00000002.1586169989.00000000013FA000.00000040.00000800.00020000.00000000.sdmp, Offset: 013FA000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_13fa000_LisectAVT_2403002A_135.jbxd

Similarity

API ID: Value
String ID:
API String ID: 3702945584-0
Opcode ID: aef83ca369109a9189aa2339cefa11fed397cc1d81c83824597542a7e2d65102
Instruction ID: 001af784417ca414b816a6c265bd8459014039523d2c04b31bf3858416a6de90
Opcode Fuzzy Hash: aef83ca369109a9189aa2339cefa11fed397cc1d81c83824597542a7e2d65102
Instruction Fuzzy Hash: B42181B6508380AFD7228F15DC45F67FFBCDF46214F08849AEA858B652D264E408CB75

Function 013FAA06 Relevance: 1.6, APIs: 1, Instructions: 76
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateFileW.KERNELBASE(?,?,?,?,?,?), ref: 013FAA85

Memory Dump Source

Source File: 0000000C.00000002.1586169989.00000000013FA000.00000040.00000800.00020000.00000000.sdmp, Offset: 013FA000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_13fa000_LisectAVT_2403002A_135.jbxd

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: 1645a1e7f5ca0bde7a0f7742c7d1ad0040daddfa896a3a99f223c7eeb70b0cbe
Instruction ID: cea3990813b3bc20d788021a71fba64aa3b0a906e9a187d1e68bac48cdc96bc0
Opcode Fuzzy Hash: 1645a1e7f5ca0bde7a0f7742c7d1ad0040daddfa896a3a99f223c7eeb70b0cbe
Instruction Fuzzy Hash: BF21B071504644AFFB21CF25CD85B66FBE8EF08224F08886DEA898B651D375E408CB71

Function 013FB756 Relevance: 1.6, APIs: 1, Instructions: 72
synchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateMutexW.KERNELBASE(?,?), ref: 013FB7C9

Memory Dump Source

Source File: 0000000C.00000002.1586169989.00000000013FA000.00000040.00000800.00020000.00000000.sdmp, Offset: 013FA000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_13fa000_LisectAVT_2403002A_135.jbxd

Similarity

API ID: CreateMutex
String ID:
API String ID: 1964310414-0
Opcode ID: 371d3a11f96263b8002a7162a013150e3c67512b628b886cd6ddca3574e401fe
Instruction ID: 148e7e99f72a9b31fdbf5389c5e92b12a6ab5e2bf03812fd30196555408ff4b0
Opcode Fuzzy Hash: 371d3a11f96263b8002a7162a013150e3c67512b628b886cd6ddca3574e401fe
Instruction Fuzzy Hash: 1521CFB15042449FE720DF29CC45BA6FBE8EF04228F08C46EEA84CB646D375E409CB75

Function 013FAF56 Relevance: 1.6, APIs: 1, Instructions: 72
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetLogicalDrives.KERNELBASE ref: 013FAFDD

Memory Dump Source

Source File: 0000000C.00000002.1586169989.00000000013FA000.00000040.00000800.00020000.00000000.sdmp, Offset: 013FA000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_13fa000_LisectAVT_2403002A_135.jbxd

Similarity

API ID: DrivesLogical
String ID:
API String ID: 999431828-0
Opcode ID: a0059850c1ad722c43d57d8ef82ae7b6f501f56d3f1a5e0ee51a89060fcf006e
Instruction ID: bd2697f771b012b3aa4123937baf6b94d33ad6f73253a524c560ced51add1050
Opcode Fuzzy Hash: a0059850c1ad722c43d57d8ef82ae7b6f501f56d3f1a5e0ee51a89060fcf006e
Instruction Fuzzy Hash: 9021577140E3C09FD7138B249C65A91BFB4EF03224F0A84DBD985CF1A3C269A809CB72

Function 013FAC8E Relevance: 1.6, APIs: 1, Instructions: 70
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

ReadFile.KERNELBASE(?,00000E24,1B46BF0F,00000000,00000000,00000000,00000000), ref: 013FAD0D

Memory Dump Source

Source File: 0000000C.00000002.1586169989.00000000013FA000.00000040.00000800.00020000.00000000.sdmp, Offset: 013FA000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_13fa000_LisectAVT_2403002A_135.jbxd

Similarity

API ID: FileRead
String ID:
API String ID: 2738559852-0
Opcode ID: 52432f1da203301dc3047590def2f5b7eedf29abae123561d443e97e1e72ed8f
Instruction ID: fff5d9c0f005ac54136ff54ecb9b88316fbf2669e8bf35e7e5c60d0170b13dda
Opcode Fuzzy Hash: 52432f1da203301dc3047590def2f5b7eedf29abae123561d443e97e1e72ed8f
Instruction Fuzzy Hash: 50219F75409380AFD722CF51DC44FA6FFB8EF45224F08849AEA859B152C275A508CBB5

Function 013FB112 Relevance: 1.6, APIs: 1, Instructions: 69
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegQueryValueExW.KERNELBASE(?,00000E24,1B46BF0F,00000000,00000000,00000000,00000000), ref: 013FB18C

Memory Dump Source

Source File: 0000000C.00000002.1586169989.00000000013FA000.00000040.00000800.00020000.00000000.sdmp, Offset: 013FA000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_13fa000_LisectAVT_2403002A_135.jbxd

Similarity

API ID: QueryValue
String ID:
API String ID: 3660427363-0
Opcode ID: 6b726db0ad271a3e0be11213c79a2a16a0642cab7550963c7ca1b9433cc21fb1
Instruction ID: 2566167e102e2a7d91c1dc9577a7712cb8b8813d889440250eaa3ea7ad2fb5e0
Opcode Fuzzy Hash: 6b726db0ad271a3e0be11213c79a2a16a0642cab7550963c7ca1b9433cc21fb1
Instruction Fuzzy Hash: 47218CB5604604AFE721CE15CC84FA7FBECEF04628F08C45AEA45CB655D374E908CAB5

Function 013FB598 Relevance: 1.6, APIs: 1, Instructions: 68
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

FindCloseChangeNotification.KERNELBASE(?), ref: 013FB604

Memory Dump Source

Source File: 0000000C.00000002.1586169989.00000000013FA000.00000040.00000800.00020000.00000000.sdmp, Offset: 013FA000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_13fa000_LisectAVT_2403002A_135.jbxd

Similarity

API ID: ChangeCloseFindNotification
String ID:
API String ID: 2591292051-0
Opcode ID: 86eef5049b2741f7f9921c44e12e5e9e6a06ccb4805754c7292ad191090a43a9
Instruction ID: 42c31688825a4d38e953751b37d4114a079e57a41fa1297052ac78e8729e2feb
Opcode Fuzzy Hash: 86eef5049b2741f7f9921c44e12e5e9e6a06ccb4805754c7292ad191090a43a9
Instruction Fuzzy Hash: 7021A1B15093C05FDB128F25DC94692BFB4AF07324F0984DAE9858F263D2659908CB62

Function 013FB024 Relevance: 1.6, APIs: 1, Instructions: 66
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CopyFileW.KERNELBASE(?,?,?), ref: 013FB092

Memory Dump Source

Source File: 0000000C.00000002.1586169989.00000000013FA000.00000040.00000800.00020000.00000000.sdmp, Offset: 013FA000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_13fa000_LisectAVT_2403002A_135.jbxd

Similarity

API ID: CopyFile
String ID:
API String ID: 1304948518-0
Opcode ID: ca984753eae0fb574bae61ac3a196648ff609538795d59ed12f3c3d24915fd9c
Instruction ID: 587fa661f3a91f2908977a8ce4dd61fa3b35e0a177dbb3c4ab8711b64a836355
Opcode Fuzzy Hash: ca984753eae0fb574bae61ac3a196648ff609538795d59ed12f3c3d24915fd9c
Instruction Fuzzy Hash: E52163B15093809FD711CF69DC95B96FFE8EF06214F0884AEE945CB262D365E844CB61

Function 013FB206 Relevance: 1.6, APIs: 1, Instructions: 65
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegSetValueExW.KERNELBASE(?,00000E24,1B46BF0F,00000000,00000000,00000000,00000000), ref: 013FB278

Memory Dump Source

Source File: 0000000C.00000002.1586169989.00000000013FA000.00000040.00000800.00020000.00000000.sdmp, Offset: 013FA000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_13fa000_LisectAVT_2403002A_135.jbxd

Similarity

API ID: Value
String ID:
API String ID: 3702945584-0
Opcode ID: 697049aad8e2d48ddac795e042269c055ebf1fce19597e5ff7258037cf28e013
Instruction ID: 2485c2e11e8f6d4d9b39dce63e9293a03db04457f8248ff9df18ca2ea39b0b2b
Opcode Fuzzy Hash: 697049aad8e2d48ddac795e042269c055ebf1fce19597e5ff7258037cf28e013
Instruction Fuzzy Hash: E611DDB6604604AFEB218F15CC41F6BFBECEF04628F08C45EEE858A656D374E404CAB5

Function 013FB362 Relevance: 1.6, APIs: 1, Instructions: 64COMMON

Download Yara Rule

APIs

LookupPrivilegeValueW.ADVAPI32(?,?,?), ref: 013FB3CA

Memory Dump Source

Source File: 0000000C.00000002.1586169989.00000000013FA000.00000040.00000800.00020000.00000000.sdmp, Offset: 013FA000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_13fa000_LisectAVT_2403002A_135.jbxd

Similarity

API ID: LookupPrivilegeValue
String ID:
API String ID: 3899507212-0
Opcode ID: 2bbf91a08892efb7eb5dc88a6e60fbe28dde69c4ea0c73bbaf74e24b0efb5a5b
Instruction ID: 40c606417a3f8a55fdb9f6f9475c31ef7f0f4933e709729b8adf546b2c2b82bb
Opcode Fuzzy Hash: 2bbf91a08892efb7eb5dc88a6e60fbe28dde69c4ea0c73bbaf74e24b0efb5a5b
Instruction Fuzzy Hash: D91190B16043809FEB21CF29DC44B52FFE8EF45224F0884AEEE45DB256D275E804CB61

Function 013FA5D5 Relevance: 1.6, APIs: 1, Instructions: 61COMMON

Download Yara Rule

APIs

FindCloseChangeNotification.KERNELBASE(?), ref: 013FA638

Memory Dump Source

Source File: 0000000C.00000002.1586169989.00000000013FA000.00000040.00000800.00020000.00000000.sdmp, Offset: 013FA000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_13fa000_LisectAVT_2403002A_135.jbxd

Similarity

API ID: ChangeCloseFindNotification
String ID:
API String ID: 2591292051-0
Opcode ID: 98a9f9a2be496701fa3c74020318289444bcb83754a19ae183c8c8a5e5a00cc1
Instruction ID: deaf9232d95032fd2a470ec51ce571bb3e5da90b00a9926411ab058a8ba50736
Opcode Fuzzy Hash: 98a9f9a2be496701fa3c74020318289444bcb83754a19ae183c8c8a5e5a00cc1
Instruction Fuzzy Hash: D5116A754093809FD7128F25DC55692BFB4EF46224F0984EFED85CB263C269A948CB62

Function 013FACAE Relevance: 1.6, APIs: 1, Instructions: 60fileCOMMON

Download Yara Rule

APIs

ReadFile.KERNELBASE(?,00000E24,1B46BF0F,00000000,00000000,00000000,00000000), ref: 013FAD0D

Memory Dump Source

Source File: 0000000C.00000002.1586169989.00000000013FA000.00000040.00000800.00020000.00000000.sdmp, Offset: 013FA000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_13fa000_LisectAVT_2403002A_135.jbxd

Similarity

API ID: FileRead
String ID:
API String ID: 2738559852-0
Opcode ID: a66b58de5660b81573d00ff36d5e41fdd193c80f27373a06c385c2726bdb4ae4
Instruction ID: 1a86cb85be60c24b7963d5069b1f6c707bc62d069b44072a83a8ab6119e939bc
Opcode Fuzzy Hash: a66b58de5660b81573d00ff36d5e41fdd193c80f27373a06c385c2726bdb4ae4
Instruction Fuzzy Hash: BE11CE75404604AFEB21CF55DC44FAAFBE8EF44328F04C45EEA898B691D375A404CBB6

Function 013FB382 Relevance: 1.6, APIs: 1, Instructions: 53COMMON

Download Yara Rule

APIs

LookupPrivilegeValueW.ADVAPI32(?,?,?), ref: 013FB3CA

Memory Dump Source

Source File: 0000000C.00000002.1586169989.00000000013FA000.00000040.00000800.00020000.00000000.sdmp, Offset: 013FA000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_13fa000_LisectAVT_2403002A_135.jbxd

Similarity

API ID: LookupPrivilegeValue
String ID:
API String ID: 3899507212-0
Opcode ID: fb74e9fbaa93fa10b5fd5b28f4d9f283a216f7961076377cf05a95e74191ac5a
Instruction ID: df4c8c08a1a91b72c94d2635b4b9f1c59862fb22bf271a8863e576b0502e8437
Opcode Fuzzy Hash: fb74e9fbaa93fa10b5fd5b28f4d9f283a216f7961076377cf05a95e74191ac5a
Instruction Fuzzy Hash: C511A1B56046008FEB60DF29DC85B56FBE8EF04224F08C4AEDE49CB756D375E404CA61

Function 013FB04A Relevance: 1.6, APIs: 1, Instructions: 53fileCOMMON

Download Yara Rule

APIs

CopyFileW.KERNELBASE(?,?,?), ref: 013FB092

Memory Dump Source

Source File: 0000000C.00000002.1586169989.00000000013FA000.00000040.00000800.00020000.00000000.sdmp, Offset: 013FA000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_13fa000_LisectAVT_2403002A_135.jbxd

Similarity

API ID: CopyFile
String ID:
API String ID: 1304948518-0
Opcode ID: fb74e9fbaa93fa10b5fd5b28f4d9f283a216f7961076377cf05a95e74191ac5a
Instruction ID: 3341a8ebec13880eeb87e151779c670e7bd9bc50b051bf984c4ba2571fb41973
Opcode Fuzzy Hash: fb74e9fbaa93fa10b5fd5b28f4d9f283a216f7961076377cf05a95e74191ac5a
Instruction Fuzzy Hash: 9411A1B16042419FEB60CF29DC85B56FBE8EF04224F08C4AEDE59CB656D775E404CA61

Function 013FAB1E Relevance: 1.6, APIs: 1, Instructions: 52COMMON

Download Yara Rule

APIs

GetFileType.KERNELBASE(?,00000E24,1B46BF0F,00000000,00000000,00000000,00000000), ref: 013FAB71

Memory Dump Source

Source File: 0000000C.00000002.1586169989.00000000013FA000.00000040.00000800.00020000.00000000.sdmp, Offset: 013FA000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_13fa000_LisectAVT_2403002A_135.jbxd

Similarity

API ID: FileType
String ID:
API String ID: 3081899298-0
Opcode ID: 57aff80b39ba2bcfefb1957bbc838f5236c88f2bd259ee542f94fcb930306a75
Instruction ID: 74bb1391c516fae613fb6bde09a587ac6220074f9a92890967977a1d6139f9b6
Opcode Fuzzy Hash: 57aff80b39ba2bcfefb1957bbc838f5236c88f2bd259ee542f94fcb930306a75
Instruction Fuzzy Hash: A801D271508608AEE721CF15DC85BB6FBECDF44728F04C49AEF498B691D378A9048AB5

Function 013FAEC8 Relevance: 1.6, APIs: 1, Instructions: 52COMMON

Download Yara Rule

APIs

FindClose.KERNELBASE(?), ref: 013FAF1C

Memory Dump Source

Source File: 0000000C.00000002.1586169989.00000000013FA000.00000040.00000800.00020000.00000000.sdmp, Offset: 013FA000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_13fa000_LisectAVT_2403002A_135.jbxd

Similarity

API ID: CloseFind
String ID:
API String ID: 1863332320-0
Opcode ID: 3a09fd18059689011416e7e5e9dca51b75b83665fcd99f5192d93aed5c773239
Instruction ID: c0c1aee08c997d465f679e1d18687645bff8e5104f639a369659147932f6c60f
Opcode Fuzzy Hash: 3a09fd18059689011416e7e5e9dca51b75b83665fcd99f5192d93aed5c773239
Instruction Fuzzy Hash: 9011A1755093809FDB128F15DC95B52FFB4DF06224F08C0EEED898F2A3D265A908CB62

Function 013FA547 Relevance: 1.6, APIs: 1, Instructions: 50COMMON

Download Yara Rule

APIs

SetErrorMode.KERNELBASE(?), ref: 013FA5A4

Memory Dump Source

Source File: 0000000C.00000002.1586169989.00000000013FA000.00000040.00000800.00020000.00000000.sdmp, Offset: 013FA000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_13fa000_LisectAVT_2403002A_135.jbxd

Similarity

API ID: ErrorMode
String ID:
API String ID: 2340568224-0
Opcode ID: fce441e275ce1691f63a29b5aaea411e803ac70f43a1daf34892e7ab37e547ae
Instruction ID: 9b0f3f9c2ef32778b3958c722c3df498f0fc2bf9d89acb2155e0decf466b3e9e
Opcode Fuzzy Hash: fce441e275ce1691f63a29b5aaea411e803ac70f43a1daf34892e7ab37e547ae
Instruction Fuzzy Hash: 791170B1405380AFD7228F15DC44B62BFA8EF46224F09849AED888B266D365A908CB61

Function 013FA172 Relevance: 1.5, APIs: 1, Instructions: 47fileCOMMON

Download Yara Rule

APIs

FindNextFileW.KERNELBASE(?,00000E24,?,?), ref: 013FA1C2

Memory Dump Source

Source File: 0000000C.00000002.1586169989.00000000013FA000.00000040.00000800.00020000.00000000.sdmp, Offset: 013FA000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_13fa000_LisectAVT_2403002A_135.jbxd

Similarity

API ID: FileFindNext
String ID:
API String ID: 2029273394-0
Opcode ID: d93819357f0c40dd1bd8b791541cb2da2e2877ffb5c8dc1a85e747515bf59cb4
Instruction ID: cf2af5ae3c599f4cc55748952206899d9c6e4a38be3305c1075808342e65dde7
Opcode Fuzzy Hash: d93819357f0c40dd1bd8b791541cb2da2e2877ffb5c8dc1a85e747515bf59cb4
Instruction Fuzzy Hash: C1017171500200AFD310DF16DC46B66FBE8EB88A20F14855AED489B641D735F915CBE5

Function 013FA606 Relevance: 1.5, APIs: 1, Instructions: 43COMMON

Download Yara Rule

APIs

FindCloseChangeNotification.KERNELBASE(?), ref: 013FA638

Memory Dump Source

Source File: 0000000C.00000002.1586169989.00000000013FA000.00000040.00000800.00020000.00000000.sdmp, Offset: 013FA000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_13fa000_LisectAVT_2403002A_135.jbxd

Similarity

API ID: ChangeCloseFindNotification
String ID:
API String ID: 2591292051-0
Opcode ID: 2fc71ab70a260c94128eecf2dba753a36e2a64b2ea8b8b107d0dc700aba6ed39
Instruction ID: 3535d1d64f6e66104583851decc821dc7ce2136b19613b55c99fa551e8742be2
Opcode Fuzzy Hash: 2fc71ab70a260c94128eecf2dba753a36e2a64b2ea8b8b107d0dc700aba6ed39
Instruction Fuzzy Hash: EB01DF745042408FDB10CF19D8847A6FBE8DF40338F08C4AEDE498B662D279A804CEA2

Function 013FB5D2 Relevance: 1.5, APIs: 1, Instructions: 43COMMON

Download Yara Rule

APIs

FindCloseChangeNotification.KERNELBASE(?), ref: 013FB604

Memory Dump Source

Source File: 0000000C.00000002.1586169989.00000000013FA000.00000040.00000800.00020000.00000000.sdmp, Offset: 013FA000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_13fa000_LisectAVT_2403002A_135.jbxd

Similarity

API ID: ChangeCloseFindNotification
String ID:
API String ID: 2591292051-0
Opcode ID: a087addaa7c7d715f770db102ca8a023ae108597df4f52b3ab4bd6a0543bd408
Instruction ID: cfc9c807a09d347a9b576e5f9cbbb44be76541c18052cee506585cda25f34765
Opcode Fuzzy Hash: a087addaa7c7d715f770db102ca8a023ae108597df4f52b3ab4bd6a0543bd408
Instruction Fuzzy Hash: E601DFB55056448FDB50CF19E885792FBE8EF40334F08C0AEDE498B656D279E414CAB2

Function 013FAEEA Relevance: 1.5, APIs: 1, Instructions: 39COMMON

Download Yara Rule

APIs

FindClose.KERNELBASE(?), ref: 013FAF1C

Memory Dump Source

Source File: 0000000C.00000002.1586169989.00000000013FA000.00000040.00000800.00020000.00000000.sdmp, Offset: 013FA000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_13fa000_LisectAVT_2403002A_135.jbxd

Similarity

API ID: CloseFind
String ID:
API String ID: 1863332320-0
Opcode ID: bc6eb5420c72363b14decf5ac161ac11940584d295cfa5732bc60c39fccdec11
Instruction ID: 7e29a3a97d43cc79a7d1e976d15c9f11ed30c38ee06328e6f6c2ac67396daa40
Opcode Fuzzy Hash: bc6eb5420c72363b14decf5ac161ac11940584d295cfa5732bc60c39fccdec11
Instruction Fuzzy Hash: 9D01D1745087448FDB508F19DC85765FBE4DF04238F08C0AEDE498F792D279A408CEA2

Function 013FAFAE Relevance: 1.5, APIs: 1, Instructions: 38COMMON

Download Yara Rule

APIs

GetLogicalDrives.KERNELBASE ref: 013FAFDD

Memory Dump Source

Source File: 0000000C.00000002.1586169989.00000000013FA000.00000040.00000800.00020000.00000000.sdmp, Offset: 013FA000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_13fa000_LisectAVT_2403002A_135.jbxd

Similarity

API ID: DrivesLogical
String ID:
API String ID: 999431828-0
Opcode ID: daae679be6b1177b902565a4b3a97c70a31737ad560f247d07efc3518f9430b0
Instruction ID: 9268e73284a927e7b4ae8c7a0b266a77d2c83f6421601141f42b8e74666557e0
Opcode Fuzzy Hash: daae679be6b1177b902565a4b3a97c70a31737ad560f247d07efc3518f9430b0
Instruction Fuzzy Hash: 2801D1744042448FDB10CF19D884751FBE4DF40228F08C4AEDE488F256D379A408CEA2

Function 013FA572 Relevance: 1.5, APIs: 1, Instructions: 35COMMON

Download Yara Rule

APIs

SetErrorMode.KERNELBASE(?), ref: 013FA5A4

Memory Dump Source

Source File: 0000000C.00000002.1586169989.00000000013FA000.00000040.00000800.00020000.00000000.sdmp, Offset: 013FA000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_13fa000_LisectAVT_2403002A_135.jbxd

Similarity

API ID: ErrorMode
String ID:
API String ID: 2340568224-0
Opcode ID: 2b384725c89c876e956702e5fdf7c22c4c30c42120f0f7e672affd4e468d6238
Instruction ID: 4160635470db3ce1d6772b4120093bdfac5a96bb6da9f8835ebf0e6d77ed0cf4
Opcode Fuzzy Hash: 2b384725c89c876e956702e5fdf7c22c4c30c42120f0f7e672affd4e468d6238
Instruction Fuzzy Hash: 71F08C74408644DFDB208F19D889765FBE4EF04229F08C09ADE8D4B756D379A408CAA2

Function 01770080 Relevance: 1.4, Strings: 1, Instructions: 111COMMON

Download Yara Rule

Strings

:@zl, xrefs: 0177016D

Memory Dump Source

Source File: 0000000C.00000002.1586972189.0000000001770000.00000040.00000800.00020000.00000000.sdmp, Offset: 01770000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_1770000_LisectAVT_2403002A_135.jbxd

Similarity

API ID:
String ID: :@zl
API String ID: 0-1604122134
Opcode ID: 32fe710770df4a6d66a2497cb33fcd926140afa4bf7fcd17a71dbf064e20e58d
Instruction ID: e9c87f31e26b5b51d06324d71f34ce8edbabd300abd09d19878c7e86eea931a0
Opcode Fuzzy Hash: 32fe710770df4a6d66a2497cb33fcd926140afa4bf7fcd17a71dbf064e20e58d
Instruction Fuzzy Hash: 9341C035605601CFD325EF7EE65929ABBE2BFD5308F40C12DC6459B268EF788805CBA1

Function 01770090 Relevance: 1.4, Strings: 1, Instructions: 104COMMON

Download Yara Rule

Strings

:@zl, xrefs: 0177016D

Memory Dump Source

Source File: 0000000C.00000002.1586972189.0000000001770000.00000040.00000800.00020000.00000000.sdmp, Offset: 01770000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_1770000_LisectAVT_2403002A_135.jbxd

Similarity

API ID:
String ID: :@zl
API String ID: 0-1604122134
Opcode ID: efcfa6ca2ce2e90950b0c2ec23f6ed6c1082792d7b770dfeee2e00eea58dc505
Instruction ID: 444c325fff23dad7ed34a0c6d72348e56d0bbd82e396640d9fe3ee8034cc1963
Opcode Fuzzy Hash: efcfa6ca2ce2e90950b0c2ec23f6ed6c1082792d7b770dfeee2e00eea58dc505
Instruction Fuzzy Hash: BD419134605641CFD325EF7BE65964AFBE2BFD5208F40C12DC6099B268DF788805DBA1

Function 056556D7 Relevance: 1.3, Strings: 1, Instructions: 23COMMON

Download Yara Rule

Strings

D, xrefs: 05655704

Memory Dump Source

Source File: 0000000C.00000002.1598792865.0000000005650000.00000040.00000800.00020000.00000000.sdmp, Offset: 05650000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_5650000_LisectAVT_2403002A_135.jbxd

Similarity

API ID:
String ID: D
API String ID: 0-2746444292
Opcode ID: c4eb28a5054e388d484ca2ebcd62b6de491964018dc80c1ea4d61312674a3120
Instruction ID: b345f72531335d8a5e7f52768d158bd06b7634e8c1d03e8ec3a9795dc575215d
Opcode Fuzzy Hash: c4eb28a5054e388d484ca2ebcd62b6de491964018dc80c1ea4d61312674a3120
Instruction Fuzzy Hash: 03E09A70949385CFC712CBA4DA182CC7BB6AF02321F0541AAE847DE516DB7C094BCB12

Function 05655858 Relevance: 1.3, Strings: 1, Instructions: 19COMMON

Download Yara Rule

Strings

E, xrefs: 05655858

Memory Dump Source

Source File: 0000000C.00000002.1598792865.0000000005650000.00000040.00000800.00020000.00000000.sdmp, Offset: 05650000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_5650000_LisectAVT_2403002A_135.jbxd

Similarity

API ID:
String ID: E
API String ID: 0-3568589458
Opcode ID: 16d6f63b68177151f2c22a58f5dbb4c2cb5df41d2a38a672b67426429a161b20
Instruction ID: 4bd0dd95f74540be49a06039ca0fecb7cb4348d548a3fc2a06f1a09b4a79060f
Opcode Fuzzy Hash: 16d6f63b68177151f2c22a58f5dbb4c2cb5df41d2a38a672b67426429a161b20
Instruction Fuzzy Hash: D5E0CDB0D09645CFD741CBA8D95929C7FB1FB41315F540157C803D5185DB784945C705

Function 05655E57 Relevance: 1.3, Strings: 1, Instructions: 19COMMON

Download Yara Rule

Strings

2, xrefs: 05655E89

Memory Dump Source

Source File: 0000000C.00000002.1598792865.0000000005650000.00000040.00000800.00020000.00000000.sdmp, Offset: 05650000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_5650000_LisectAVT_2403002A_135.jbxd

Similarity

API ID:
String ID: 2
API String ID: 0-450215437
Opcode ID: f69cbba4be90e718b8e762044f4922e7f08d5dd4d4fb4b0a623786f76f2a8e36
Instruction ID: b3ba8812d1d176990b206acdcf0e301189773db9a3bb3b937d82dcbac27dd655
Opcode Fuzzy Hash: f69cbba4be90e718b8e762044f4922e7f08d5dd4d4fb4b0a623786f76f2a8e36
Instruction Fuzzy Hash: EBE01A70A86349CBDB56DFA5D60819CBBB6EB04311F108566D803AB655DB388A46C705

Function 05655F6B Relevance: 1.3, Strings: 1, Instructions: 18COMMON

Download Yara Rule

Strings

,, xrefs: 05655F98

Memory Dump Source

Source File: 0000000C.00000002.1598792865.0000000005650000.00000040.00000800.00020000.00000000.sdmp, Offset: 05650000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_5650000_LisectAVT_2403002A_135.jbxd

Similarity

API ID:
String ID: ,
API String ID: 0-3772416878
Opcode ID: e5fbd43706ff82f206b8613b08d46966a9bf9bc28b8dd43e12c0b9dfeecb0d64
Instruction ID: 3b03ccef496b6f1da94be1cc843094b73486f6b2008c7947dcc26bb6036797c9
Opcode Fuzzy Hash: e5fbd43706ff82f206b8613b08d46966a9bf9bc28b8dd43e12c0b9dfeecb0d64
Instruction Fuzzy Hash: 8BE0C270C983188BCB40CB18E4593C477B0BF05220F3481CBC88A8E756E6380547CB4A

Function 0565596E Relevance: 1.3, Strings: 1, Instructions: 17COMMON

Download Yara Rule

Strings

<, xrefs: 0565573C

Memory Dump Source

Source File: 0000000C.00000002.1598792865.0000000005650000.00000040.00000800.00020000.00000000.sdmp, Offset: 05650000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_5650000_LisectAVT_2403002A_135.jbxd

Similarity

API ID:
String ID: <
API String ID: 0-4251816714
Opcode ID: 338fda1a69fe0ab9bd66efda5b6c3e8fc0db71b5fa07468ade08728545f4d38a
Instruction ID: 36b3ca9a1e7439d0f00ad27a9d726f909919b962d3f2301f863e3d0da28c85af
Opcode Fuzzy Hash: 338fda1a69fe0ab9bd66efda5b6c3e8fc0db71b5fa07468ade08728545f4d38a
Instruction Fuzzy Hash: EAE04F74E45248CBDB55CFA4D60C26C7776FB00351F108429DC03EA684CF388A46CB01

Function 0565615D Relevance: 1.3, Strings: 1, Instructions: 16COMMON

Download Yara Rule

Strings

f, xrefs: 0565615D

Memory Dump Source

Source File: 0000000C.00000002.1598792865.0000000005650000.00000040.00000800.00020000.00000000.sdmp, Offset: 05650000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_5650000_LisectAVT_2403002A_135.jbxd

Similarity

API ID:
String ID: f
API String ID: 0-1993550816
Opcode ID: f57bf8040ae1df93c367728d6261fae1002339cca48732778f8c1c47c324bceb
Instruction ID: be1a6747b3d1845d2286350526ee55768a819bece3519947931cc7ae58101f54
Opcode Fuzzy Hash: f57bf8040ae1df93c367728d6261fae1002339cca48732778f8c1c47c324bceb
Instruction Fuzzy Hash: 0DE0EC70E45249CBDB54DFE5D60846DB7B7AB54321F548065DC03AA258EB384A45CB00

Function 056558F8 Relevance: 1.3, Strings: 1, Instructions: 11COMMON

Download Yara Rule

Strings

., xrefs: 0565590E

Memory Dump Source

Source File: 0000000C.00000002.1598792865.0000000005650000.00000040.00000800.00020000.00000000.sdmp, Offset: 05650000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_5650000_LisectAVT_2403002A_135.jbxd

Similarity

API ID:
String ID: .
API String ID: 0-248832578
Opcode ID: cf7a8fa38d743d7b93b02753da8d630d553926c24700a3a603f41e48b78d406d
Instruction ID: c8d52fcbc5319b25fe16c080ef95b86f6c516faafc5247fe7e55885fa0797d00
Opcode Fuzzy Hash: cf7a8fa38d743d7b93b02753da8d630d553926c24700a3a603f41e48b78d406d
Instruction Fuzzy Hash: B6D0C774D49145CFDB54CFE4D24C15C7BB2E744311F604415D843D6654CB784945CB01

Function 05655726 Relevance: 1.3, Strings: 1, Instructions: 11COMMON

Download Yara Rule

Strings

<, xrefs: 0565573C

Memory Dump Source

Source File: 0000000C.00000002.1598792865.0000000005650000.00000040.00000800.00020000.00000000.sdmp, Offset: 05650000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_5650000_LisectAVT_2403002A_135.jbxd

Similarity

API ID:
String ID: <
API String ID: 0-4251816714
Opcode ID: 529a4f77db77d3c231d03e3b9caa50c7bce5f09d1aa5d4fce9ff5e28b572c323
Instruction ID: ff30595564d0079b0c2f6a257d7ed2b1aaf483271c395f3778009e0cb38ad730
Opcode Fuzzy Hash: 529a4f77db77d3c231d03e3b9caa50c7bce5f09d1aa5d4fce9ff5e28b572c323
Instruction Fuzzy Hash: 6CD09274E46258CBDB55CFA4D64C56CBBB6EB04311F50942ADC03EA648CB384A46CB01

Function 05655ECD Relevance: 1.3, Strings: 1, Instructions: 11COMMON

Download Yara Rule

Strings

%, xrefs: 05655EE9

Memory Dump Source

Source File: 0000000C.00000002.1598792865.0000000005650000.00000040.00000800.00020000.00000000.sdmp, Offset: 05650000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_5650000_LisectAVT_2403002A_135.jbxd

Similarity

API ID:
String ID: %
API String ID: 0-2567322570
Opcode ID: a608074c42fa4a4249331e9182e04cef929dfef93e6bb1c94dbbd63b0348e357
Instruction ID: 7a0b9fa40c463a4aedca9b5217527c1d8b213708a6f787b7c82adbe8ba1fcb70
Opcode Fuzzy Hash: a608074c42fa4a4249331e9182e04cef929dfef93e6bb1c94dbbd63b0348e357
Instruction Fuzzy Hash: FFC012B0D066158BD7118BB45D1D38C37F0FB04335B5401254803A239AEB3444478A00

Function 05655949 Relevance: 1.3, Strings: 1, Instructions: 7COMMON

Download Yara Rule

Strings

H, xrefs: 05655962

Memory Dump Source

Source File: 0000000C.00000002.1598792865.0000000005650000.00000040.00000800.00020000.00000000.sdmp, Offset: 05650000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_5650000_LisectAVT_2403002A_135.jbxd

Similarity

API ID:
String ID: H
API String ID: 0-2852464175
Opcode ID: 3367798b8fad2ac6477e420d898cea878a186adb6f7d9ee3d100fbfb5e3a2fca
Instruction ID: da48a6b6f37761c9cb4d5571215645cc7480a090de5fbd9bae9855f3dabe4cbb
Opcode Fuzzy Hash: 3367798b8fad2ac6477e420d898cea878a186adb6f7d9ee3d100fbfb5e3a2fca
Instruction Fuzzy Hash: 9FC04CB4E06315CFDB659FA5D71C35C7BB1EB84312F04446A9907E6298DE780985CF01

Function 05655D5E Relevance: 1.3, Strings: 1, Instructions: 7COMMON

Download Yara Rule

Strings

J, xrefs: 05655D77

Memory Dump Source

Source File: 0000000C.00000002.1598792865.0000000005650000.00000040.00000800.00020000.00000000.sdmp, Offset: 05650000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_5650000_LisectAVT_2403002A_135.jbxd

Similarity

API ID:
String ID: J
API String ID: 0-1141589763
Opcode ID: 3bcf276e86a49eaaf8a2899a7db6539bd8c2b7be279ad563e09a8544aba6f891
Instruction ID: 9f74257a5bffeda43d5093b71bba37b781c074eca42a6eb20c766fb20271d038
Opcode Fuzzy Hash: 3bcf276e86a49eaaf8a2899a7db6539bd8c2b7be279ad563e09a8544aba6f891
Instruction Fuzzy Hash: 12C08CB4E06204CFCB648FA1D20C25C7AB1EB04301F008029980BE2298CE380984CF01

Function 056559D4 Relevance: 1.3, Strings: 1, Instructions: 7COMMON

Download Yara Rule

Strings

&, xrefs: 056559EA

Memory Dump Source

Source File: 0000000C.00000002.1598792865.0000000005650000.00000040.00000800.00020000.00000000.sdmp, Offset: 05650000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_5650000_LisectAVT_2403002A_135.jbxd

Similarity

API ID:
String ID: &
API String ID: 0-1010288
Opcode ID: 52119e849d71585f28ca10defeabef37e1f0d1b1a6d03d0989bfb03888494d3f
Instruction ID: f011250882aae09b2422eb6c6708923ab6497d76a6d35b7c496601feb215b856
Opcode Fuzzy Hash: 52119e849d71585f28ca10defeabef37e1f0d1b1a6d03d0989bfb03888494d3f
Instruction Fuzzy Hash: CCC04C74D062098BDB75DFF9D21C16D7AB1EB48311F1040299813A2298DE380445CF11

Function 05655DD6 Relevance: 1.3, Strings: 1, Instructions: 7COMMON

Download Yara Rule

Strings

B, xrefs: 05655DEF

Memory Dump Source

Source File: 0000000C.00000002.1598792865.0000000005650000.00000040.00000800.00020000.00000000.sdmp, Offset: 05650000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_5650000_LisectAVT_2403002A_135.jbxd

Similarity

API ID:
String ID: B
API String ID: 0-1255198513
Opcode ID: e988c50a16457a13f7d23631a1a9a28e8adf130a376fc97da331b8f4d4a835d4
Instruction ID: aad39f3ddd4291f75f53bf65cd786dda38fc646b1f97eb6f1e31f1d1703511ae
Opcode Fuzzy Hash: e988c50a16457a13f7d23631a1a9a28e8adf130a376fc97da331b8f4d4a835d4
Instruction Fuzzy Hash: D2C04CB4E07215CBDB659FA5D71C25C7BB1EB44355F014069A90BE3298DE380A45CB01

Function 05655D83 Relevance: 1.3, Strings: 1, Instructions: 7COMMON

Download Yara Rule

Strings

E, xrefs: 05655D99

Memory Dump Source

Source File: 0000000C.00000002.1598792865.0000000005650000.00000040.00000800.00020000.00000000.sdmp, Offset: 05650000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_5650000_LisectAVT_2403002A_135.jbxd

Similarity

API ID:
String ID: E
API String ID: 0-3568589458
Opcode ID: b1dacef3e36dcd86b853236a9c3039a544b9e089bd00400cf4daf0039ef47674
Instruction ID: 4628a2a8ae2f3159b900f90b778efabe1c16b658820bea662a7db1f25174e643
Opcode Fuzzy Hash: b1dacef3e36dcd86b853236a9c3039a544b9e089bd00400cf4daf0039ef47674
Instruction Fuzzy Hash: 09C04CB4D062058BDB559FA5D61C59C7AB2EB44312F1040299907A6298DE780585CB01

Function 05656191 Relevance: 1.3, Strings: 1, Instructions: 7COMMON

Download Yara Rule

Strings

6, xrefs: 056561A7

Memory Dump Source

Source File: 0000000C.00000002.1598792865.0000000005650000.00000040.00000800.00020000.00000000.sdmp, Offset: 05650000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_5650000_LisectAVT_2403002A_135.jbxd

Similarity

API ID:
String ID: 6
API String ID: 0-498629140
Opcode ID: b02ffa44e4977fc8ea8c12f822e5d5c2a090618ad68348562b3cbcb2d95d8842
Instruction ID: 7bf78944d7ea641704a7ff9d1b787352b302708c47e8e008fffbdb512cecf6cc
Opcode Fuzzy Hash: b02ffa44e4977fc8ea8c12f822e5d5c2a090618ad68348562b3cbcb2d95d8842
Instruction Fuzzy Hash: 16C04C74D072059BDB65DFF5D31C15C7AB5EB44356F10402D9803A6298DE780945CB01

Function 05655C78 Relevance: 1.3, Strings: 1, Instructions: 7COMMON

Download Yara Rule

Strings

!, xrefs: 05655C91

Memory Dump Source

Source File: 0000000C.00000002.1598792865.0000000005650000.00000040.00000800.00020000.00000000.sdmp, Offset: 05650000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_5650000_LisectAVT_2403002A_135.jbxd

Similarity

API ID:
String ID: !
API String ID: 0-2657877971
Opcode ID: d989b07afcbf74a01e6dddb00e4d074d3b23d39ea268b8ae9535a89031bb411e
Instruction ID: b4793e489ad0097fcb1b3505fee0a8ee6f48d16571346b8fa0c452d4111a3ea7
Opcode Fuzzy Hash: d989b07afcbf74a01e6dddb00e4d074d3b23d39ea268b8ae9535a89031bb411e
Instruction Fuzzy Hash: D3C04CB4E0A219CFDB65DFA5D61C39C7AB1EB54312F4040699847A6298DF784985CF01

Function 05656021 Relevance: 1.3, Strings: 1, Instructions: 7COMMON

Download Yara Rule

Strings

L, xrefs: 0565603A

Memory Dump Source

Source File: 0000000C.00000002.1598792865.0000000005650000.00000040.00000800.00020000.00000000.sdmp, Offset: 05650000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_5650000_LisectAVT_2403002A_135.jbxd

Similarity

API ID:
String ID: L
API String ID: 0-2909332022
Opcode ID: 26df6d23ccc408bac31e2b3a2911b1bbe2db7ad418c877598edc704f998b8575
Instruction ID: 729a026698eadca6d11b379aa41eae2a7e2c06fe13e9131f8b731a76c91e93d1
Opcode Fuzzy Hash: 26df6d23ccc408bac31e2b3a2911b1bbe2db7ad418c877598edc704f998b8575
Instruction Fuzzy Hash: D5C04CB4E07215CBEB659FB5D71D65C7AB1EB44312F044069990BA6298DE380945CB01

Function 05655FC7 Relevance: 1.3, Strings: 1, Instructions: 7COMMON

Download Yara Rule

Strings

=, xrefs: 05655FE0

Memory Dump Source

Source File: 0000000C.00000002.1598792865.0000000005650000.00000040.00000800.00020000.00000000.sdmp, Offset: 05650000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_5650000_LisectAVT_2403002A_135.jbxd

Similarity

API ID:
String ID: =
API String ID: 0-2322244508
Opcode ID: fb9135c8971805893bd37beecfa75c4031eaa2fc2e2335ec8096325e488008a8
Instruction ID: 4036fe3e6989d78620d7cc2b1c75754c3a6fa6790b090f549c68c6efc5276da2
Opcode Fuzzy Hash: fb9135c8971805893bd37beecfa75c4031eaa2fc2e2335ec8096325e488008a8
Instruction Fuzzy Hash: D6C04CB4D06215CBDB669FA5D61C35CBAB5EB48352F00806A9807E6298DE380945CF11

Function 056545EE Relevance: .2, Instructions: 161COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.1598792865.0000000005650000.00000040.00000800.00020000.00000000.sdmp, Offset: 05650000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_5650000_LisectAVT_2403002A_135.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 070231b3e35526f9ce80c123aa1b18deb8807eb6ac41545594db61e6ce4c28d5
Instruction ID: 467f3573cf337dcdcfe76f379f0dc7cf018d32907d2b5e24a23b46a451bf2b35
Opcode Fuzzy Hash: 070231b3e35526f9ce80c123aa1b18deb8807eb6ac41545594db61e6ce4c28d5
Instruction Fuzzy Hash: 9B715E70A44109CFDF25EFBAE5487ADBBB2FB44315F008099D946AA2A4CF744889CF25

Function 05654626 Relevance: .2, Instructions: 158COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.1598792865.0000000005650000.00000040.00000800.00020000.00000000.sdmp, Offset: 05650000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_5650000_LisectAVT_2403002A_135.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b04dd3b67e230a0b3a1af28dd8a19d7002f08090ee140dfa9061484a3600b235
Instruction ID: bb7fcc24a957ba08015262237a4989ddbc993f5cbf0bebd616f2a47d28ae4d8b
Opcode Fuzzy Hash: b04dd3b67e230a0b3a1af28dd8a19d7002f08090ee140dfa9061484a3600b235
Instruction Fuzzy Hash: F5715F70948109CFDF25EFBAE5487ACBBB2FB44315F008199D946AA2A4CF744885CF25

Function 05654283 Relevance: .2, Instructions: 157COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.1598792865.0000000005650000.00000040.00000800.00020000.00000000.sdmp, Offset: 05650000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_5650000_LisectAVT_2403002A_135.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f15eb1d0788e767760b59d508ddc46e7d25f68f4008749a727b0f60d0952fd83
Instruction ID: 800778087666295498df4cd16e4520bb5c7b1358f263ae6007a758a52f6f66be
Opcode Fuzzy Hash: f15eb1d0788e767760b59d508ddc46e7d25f68f4008749a727b0f60d0952fd83
Instruction Fuzzy Hash: FA616F70A44109CFDF25DFBAE5487ADBBB2FB44319F008099D946AB2A4CF744889CF25

Function 05654462 Relevance: .2, Instructions: 154COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.1598792865.0000000005650000.00000040.00000800.00020000.00000000.sdmp, Offset: 05650000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_5650000_LisectAVT_2403002A_135.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 826f80c9a324040fa9e8909b82e006bb05b12bdb6dc361525a141ea6a9f80b24
Instruction ID: 10e539cc0b44cbd6e2a1dcf36311f3f266f92f9c4c55e8ae3e18bbe16d8ff9bf
Opcode Fuzzy Hash: 826f80c9a324040fa9e8909b82e006bb05b12bdb6dc361525a141ea6a9f80b24
Instruction Fuzzy Hash: 93614E70948109CFDF25EFBAE6487ACBBB2FB44315F008199D946AA2A4DF7448C5CF25

Function 056544D5 Relevance: .2, Instructions: 154COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.1598792865.0000000005650000.00000040.00000800.00020000.00000000.sdmp, Offset: 05650000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_5650000_LisectAVT_2403002A_135.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 615e5fd3b7deb5c929a22f33bcefacbcad244624261d9fa4e64d82ead647e688
Instruction ID: da7dd4fb09b7be46e9ac029aa5779fbdb19be83da2fa47ffbd6dea25f93d0167
Opcode Fuzzy Hash: 615e5fd3b7deb5c929a22f33bcefacbcad244624261d9fa4e64d82ead647e688
Instruction Fuzzy Hash: 7A615E70948109CFDF25EFBAE5487ADBBB2FB44315F008199D946AA2A4CF7448C9CF25

Function 056545D4 Relevance: .2, Instructions: 151COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.1598792865.0000000005650000.00000040.00000800.00020000.00000000.sdmp, Offset: 05650000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_5650000_LisectAVT_2403002A_135.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e1f3f546fc07be63771dd4bba6e9a0f8b829dcbee0528bd75e02daa38166004b
Instruction ID: 33e8383e0cc0213b4339a00dc7c3409e854006ce70842a9f0f12715fdc9bce69
Opcode Fuzzy Hash: e1f3f546fc07be63771dd4bba6e9a0f8b829dcbee0528bd75e02daa38166004b
Instruction Fuzzy Hash: 2A616E70A44209CFDF25DFBAE5487ACBBB2FB44315F008099D946AA2A4DF7448C9CF25

Function 056544CD Relevance: .2, Instructions: 150COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.1598792865.0000000005650000.00000040.00000800.00020000.00000000.sdmp, Offset: 05650000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_5650000_LisectAVT_2403002A_135.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7a960ef4f22a583f408096f10c91d3f3dada65c5eaefe46c1a07fbab9281f327
Instruction ID: 7ff4440a247f43f913f55fb3f260167af11f643f49e9bed272c19172c38d2770
Opcode Fuzzy Hash: 7a960ef4f22a583f408096f10c91d3f3dada65c5eaefe46c1a07fbab9281f327
Instruction Fuzzy Hash: E3616F70948109CFDF25EFBAE5487ADBBB2FB44316F008099D946A62A4CF7448C9CF25

Function 05654161 Relevance: .1, Instructions: 149COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.1598792865.0000000005650000.00000040.00000800.00020000.00000000.sdmp, Offset: 05650000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_5650000_LisectAVT_2403002A_135.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 536f121c27b8a264d01a44ea540fc7f3343aad7b73bbd7029a35e550b4cfc8ba
Instruction ID: e592ac3426ab5a11ff84dd627e7e4026911665346e02e34078f7ef25fb9c1798
Opcode Fuzzy Hash: 536f121c27b8a264d01a44ea540fc7f3343aad7b73bbd7029a35e550b4cfc8ba
Instruction Fuzzy Hash: 94615070948109CFDF25EFBAE5487ADBBB2FB44315F008199D946AA2A4CF7448C9CF25

Function 056541DC Relevance: .1, Instructions: 149COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.1598792865.0000000005650000.00000040.00000800.00020000.00000000.sdmp, Offset: 05650000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_5650000_LisectAVT_2403002A_135.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 591461511f9e38f328e3f7c85cf32e1d66c57ae007ab579e78daac7b71331c02
Instruction ID: 507ca2cb5c601b5cf8431707439dcba5c6c9e981b4a2f97e9ee3e57be9dd26e6
Opcode Fuzzy Hash: 591461511f9e38f328e3f7c85cf32e1d66c57ae007ab579e78daac7b71331c02
Instruction Fuzzy Hash: 75616070948109CFDF25EFBAE5487ACBBB2FB44315F008199D946AA2A4CF7448C9CF25

Function 056542C6 Relevance: .1, Instructions: 149COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.1598792865.0000000005650000.00000040.00000800.00020000.00000000.sdmp, Offset: 05650000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_5650000_LisectAVT_2403002A_135.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5c45be6040f1ca8bc3398a61c98158a4a3ae3d8811c086de7376a0473497ad4a
Instruction ID: 71099723cb70388f87adec1e1b48f066617d5cf7cff00eb582a0392348a07d12
Opcode Fuzzy Hash: 5c45be6040f1ca8bc3398a61c98158a4a3ae3d8811c086de7376a0473497ad4a
Instruction Fuzzy Hash: 25614E70948109CFDF25EFBAE5487ADBBB2FB44315F008199D946AA2A4CF7448C9CF25

Function 05654EF0 Relevance: .1, Instructions: 96COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.1598792865.0000000005650000.00000040.00000800.00020000.00000000.sdmp, Offset: 05650000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_5650000_LisectAVT_2403002A_135.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a0e1da26334ef91ff5499d2a21ca1a79ff801f4c9087245f30ee1512e382f707
Instruction ID: a71f9484121d69b50dad5f6c6400b574b5d06191dbc936ad2815c5d9cdedd5ec
Opcode Fuzzy Hash: a0e1da26334ef91ff5499d2a21ca1a79ff801f4c9087245f30ee1512e382f707
Instruction Fuzzy Hash: 38315A30E44205CBCF10DBA9E648AADB7F2BF98322F158565EC06E3354DB359C82CB55

Function 05654EE2 Relevance: .1, Instructions: 94COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.1598792865.0000000005650000.00000040.00000800.00020000.00000000.sdmp, Offset: 05650000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_5650000_LisectAVT_2403002A_135.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cc11c3eb44a18b8d7ce49559a612291cc8041b3f7ab44c4188f35d5eefd2a574
Instruction ID: a1cab173bea8232f837934a25021c7fbe562793a0b5a89aa784d9b889e588247
Opcode Fuzzy Hash: cc11c3eb44a18b8d7ce49559a612291cc8041b3f7ab44c4188f35d5eefd2a574
Instruction Fuzzy Hash: CF312C34E44205CBCF14DB69E648A9DBBF2BF98321F158565EC06E3354EB349C82CB55

Function 05654FDE Relevance: .1, Instructions: 79COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.1598792865.0000000005650000.00000040.00000800.00020000.00000000.sdmp, Offset: 05650000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_5650000_LisectAVT_2403002A_135.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 259bfc181fd42d3141a20f79cab9ad1f3ac4bf17a728d6cb6d6cf9c732f96ce9
Instruction ID: 88a89e1fc6bb9d405baaf4c12165f8ae7b9e21cd81721dacb020f2889022e7f7
Opcode Fuzzy Hash: 259bfc181fd42d3141a20f79cab9ad1f3ac4bf17a728d6cb6d6cf9c732f96ce9
Instruction Fuzzy Hash: 9E31E834E44205CBCF15DBA9E64C9ACB7B2BF98322F158565EC06E3354DB349C82CB54

Function 05655090 Relevance: .1, Instructions: 65COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.1598792865.0000000005650000.00000040.00000800.00020000.00000000.sdmp, Offset: 05650000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_5650000_LisectAVT_2403002A_135.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0df21fdc2db4f651535c26a3db35ef13d69034f2d0ed8b856d5e06b1417658f9
Instruction ID: 09759a7d9e7ac7fd6601c56d811ed4c41f2387f8b606a4fd84dff17f10cdb90c
Opcode Fuzzy Hash: 0df21fdc2db4f651535c26a3db35ef13d69034f2d0ed8b856d5e06b1417658f9
Instruction Fuzzy Hash: F021C47090420BEFCB11EFA8D5485EDBBB1FF50318F10806ACE469B264DB354E45CB92

Function 056550A0 Relevance: .1, Instructions: 61COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.1598792865.0000000005650000.00000040.00000800.00020000.00000000.sdmp, Offset: 05650000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_5650000_LisectAVT_2403002A_135.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a436d63d38903dec6f538de3823c4cf3700ac6f15f56391b55e1e678939bd1f4
Instruction ID: e4b51e1aaac2a369eef16407135f45ae5d9aebfdd7e6d98fdff95f8c843520cf
Opcode Fuzzy Hash: a436d63d38903dec6f538de3823c4cf3700ac6f15f56391b55e1e678939bd1f4
Instruction Fuzzy Hash: BC219D7090510BEFCB10EFA9D6485ADB7B2FF50318F20806ACE06AB254DB355E45DB92

Function 01770015 Relevance: .1, Instructions: 57COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.1586972189.0000000001770000.00000040.00000800.00020000.00000000.sdmp, Offset: 01770000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_1770000_LisectAVT_2403002A_135.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dc48b2d21426d2e67551596153fa5ef3bb996f1617dfdfca3563cd7de75e50aa
Instruction ID: 3397fd94e5bdd24ad7c176a482e92e2e2a6f268890848c82e915246289f468c9
Opcode Fuzzy Hash: dc48b2d21426d2e67551596153fa5ef3bb996f1617dfdfca3563cd7de75e50aa
Instruction Fuzzy Hash: 5501D62148E7C11FC71387304C255A5BFB16D0312470E85DFD0C8CB4A3C60D9819C767

Function 05654D20 Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.1598792865.0000000005650000.00000040.00000800.00020000.00000000.sdmp, Offset: 05650000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_5650000_LisectAVT_2403002A_135.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0d90fd54a4a0ce9b64e733006007e92d7e33180ac669728bf3ae2e884acd4ced
Instruction ID: cce48382b12710c09d58e8243c5f8d3b211d2a16eeb3c734b25c2b0ca88b2a00
Opcode Fuzzy Hash: 0d90fd54a4a0ce9b64e733006007e92d7e33180ac669728bf3ae2e884acd4ced
Instruction Fuzzy Hash: 65112C31648211CFCB25DB29E148558BBB2AF85215F4282FDD8469B395CF354C83CBC1

Function 015D05E1 Relevance: .0, Instructions: 50COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.1586789021.00000000015D0000.00000040.00000020.00020000.00000000.sdmp, Offset: 015D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_15d0000_LisectAVT_2403002A_135.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 43a05dc45a87c51ce904fbb19284fe93b5a8dabb505e90d7a60b42fe7f9ccade
Instruction ID: ca66b71ac2685051b267e4236de623702ba339337ff7879993a30da49005e556
Opcode Fuzzy Hash: 43a05dc45a87c51ce904fbb19284fe93b5a8dabb505e90d7a60b42fe7f9ccade
Instruction Fuzzy Hash: D80120B150D3805FCB128F159C40C72BFB8EE86624B19C49FFC498F643D125A804C7B5

Function 05654D30 Relevance: .0, Instructions: 49COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.1598792865.0000000005650000.00000040.00000800.00020000.00000000.sdmp, Offset: 05650000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_5650000_LisectAVT_2403002A_135.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bf7b70f479fcc5a2e03679a9f8dfa1a84a10f0386aa16a53bf5a3be5d9639eba
Instruction ID: 3c6a314b3c65cb80fd189e4d4b65231a2c0a5729907cee71a636181e0aeeee64
Opcode Fuzzy Hash: bf7b70f479fcc5a2e03679a9f8dfa1a84a10f0386aa16a53bf5a3be5d9639eba
Instruction Fuzzy Hash: BF01C835A48121CBCB25AB6AE60861877A2AF81216F4282FDDD069B395DF354C82CBC1

Function 015D05D1 Relevance: .0, Instructions: 42COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.1586789021.00000000015D0000.00000040.00000020.00020000.00000000.sdmp, Offset: 015D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_15d0000_LisectAVT_2403002A_135.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 72b5c46855bd2c1e27fcc9224af6b6279b1f75ee2a4f6ad26ad48d73eb6459d6
Instruction ID: 7238bb4581b202988ba05ce2019984c203c838a113656c1016b3d833c212cfc8
Opcode Fuzzy Hash: 72b5c46855bd2c1e27fcc9224af6b6279b1f75ee2a4f6ad26ad48d73eb6459d6
Instruction Fuzzy Hash: 62F0C2B65046006BC7608F0AEC41893FBE8EB85670B04C46EFD098B211D236B904CBB5

Function 05654E70 Relevance: .0, Instructions: 29COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.1598792865.0000000005650000.00000040.00000800.00020000.00000000.sdmp, Offset: 05650000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_5650000_LisectAVT_2403002A_135.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8aa095a1a7a377bb5de5250c08bdaeb9f6600e4ffbc74da0ce3eec523dd29561
Instruction ID: f4336456937ee0e9ead172c1cf0a116e2fa7f9e8bb719613b50bca0f58f068e6
Opcode Fuzzy Hash: 8aa095a1a7a377bb5de5250c08bdaeb9f6600e4ffbc74da0ce3eec523dd29561
Instruction Fuzzy Hash: 41F05E3008E3C14FC7639B7454211D53FB0AE0326971904FFC084CB9A3C22A4846CB12

Function 015D0606 Relevance: .0, Instructions: 27COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.1586789021.00000000015D0000.00000040.00000020.00020000.00000000.sdmp, Offset: 015D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_15d0000_LisectAVT_2403002A_135.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6fa6901909706d4d13ef60aa65886d0e52cf42bcd45d502df0917a631a00fe32
Instruction ID: ed2a713fec45867fc74abbfce81cd9366cd7ad46b20f68dfbde03b3be1bf547f
Opcode Fuzzy Hash: 6fa6901909706d4d13ef60aa65886d0e52cf42bcd45d502df0917a631a00fe32
Instruction Fuzzy Hash: 6FE092B66046004BD650CF0BEC41452F7D8EB84630708C07FDD0D8B711E236B504CEA5

Function 05655560 Relevance: .0, Instructions: 26COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.1598792865.0000000005650000.00000040.00000800.00020000.00000000.sdmp, Offset: 05650000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_5650000_LisectAVT_2403002A_135.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ce7f27c0e1171606d9ece9cdffff6d7b21b1537d45d357a5d60975e39a57eaa3
Instruction ID: b84262da9b022d85a9894a9f9c7d14ef5c75a71e911670bc3c9945979ff7228a
Opcode Fuzzy Hash: ce7f27c0e1171606d9ece9cdffff6d7b21b1537d45d357a5d60975e39a57eaa3
Instruction Fuzzy Hash: B9E06D3048D3C48FC7935B7864202D83FB46F63324F2600DBC4888E9A3C25A4886CB22

Function 0565452A Relevance: .0, Instructions: 19COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.1598792865.0000000005650000.00000040.00000800.00020000.00000000.sdmp, Offset: 05650000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_5650000_LisectAVT_2403002A_135.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2d83402f38e759cc36338009cf48e3436f72717ddd4da5fe9520f41b80521b30
Instruction ID: 65d3ca8249374914690918faaf9e84d2c073e0fb82e12ad765bceee74e9937b3
Opcode Fuzzy Hash: 2d83402f38e759cc36338009cf48e3436f72717ddd4da5fe9520f41b80521b30
Instruction Fuzzy Hash: EBE03974A00214CFCB68EF65D5187ADBA72EF85302F0040A8DA4AA62A4CF740D80CF51

Function 0565312F Relevance: .0, Instructions: 18COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.1598792865.0000000005650000.00000040.00000800.00020000.00000000.sdmp, Offset: 05650000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_5650000_LisectAVT_2403002A_135.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 54a247a7eef4fb04e33e5d101f3327294ccaec69db5517274c548f526c5296f2
Instruction ID: 4a1f543f1a16d54d79575b5361b0f04d29c419787da64fceee684ea6c1d33854
Opcode Fuzzy Hash: 54a247a7eef4fb04e33e5d101f3327294ccaec69db5517274c548f526c5296f2
Instruction Fuzzy Hash: 71D01232744014DB5A24CF98A4444EDB3B6F744AB9F000452ED06A3300C7305E16CB51

Function 056557C0 Relevance: .0, Instructions: 16COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.1598792865.0000000005650000.00000040.00000800.00020000.00000000.sdmp, Offset: 05650000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_5650000_LisectAVT_2403002A_135.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f1383ee8255fe55e6df918425d4c1e5e4505c4cdaa6ec593940985146ec00a1d
Instruction ID: 5932bb5c060969ddc9bb33b326c8b32f76b8582bbfe50c9faae45bc14aa2e80d
Opcode Fuzzy Hash: f1383ee8255fe55e6df918425d4c1e5e4505c4cdaa6ec593940985146ec00a1d
Instruction Fuzzy Hash: 39E0BFB0E45155CBDB94DFE4D64855CB7B2AB44316F508465DC07EA244DF38494ACB00

Function 013F23F4 Relevance: .0, Instructions: 15COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.1586155056.00000000013F2000.00000040.00000800.00020000.00000000.sdmp, Offset: 013F2000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_13f2000_LisectAVT_2403002A_135.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c3000b7f9173f0a1c04802f1e6c44722b94a42680b38cc5973a09d9af23cc7cf
Instruction ID: d0a8320b28d37e0f0156ebc42e2470f1bef9594da277200fec85a6c53b654672
Opcode Fuzzy Hash: c3000b7f9173f0a1c04802f1e6c44722b94a42680b38cc5973a09d9af23cc7cf
Instruction Fuzzy Hash: 72D05E79205A818FE3279A1DC1A4B963BE4AB51718F4A44FEA9408F763C7A8D581D610

Function 017705C7 Relevance: .0, Instructions: 15COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.1586972189.0000000001770000.00000040.00000800.00020000.00000000.sdmp, Offset: 01770000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_1770000_LisectAVT_2403002A_135.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 23267f7f265c9f93be452ebac5e69f4874ae1022a3d07ee8b2abd69a1e54493a
Instruction ID: 9d7202f2965a4b52e3d124a1c1d04b66c4ee4049ea6bc7ccde90d269d6986d68
Opcode Fuzzy Hash: 23267f7f265c9f93be452ebac5e69f4874ae1022a3d07ee8b2abd69a1e54493a
Instruction Fuzzy Hash: D7E0927094512ACBDBA1CB08C880BEDB3B1FB48304F5181E9D12CA6294CB356E84CF01

Function 0177119F Relevance: .0, Instructions: 15COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.1586972189.0000000001770000.00000040.00000800.00020000.00000000.sdmp, Offset: 01770000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_1770000_LisectAVT_2403002A_135.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b5939171f20e80ca8ae413bce707aac99b84a984febc587ff66131fc5547ebb5
Instruction ID: 5c6524b1a9bcbd64f789744314e97b60d6e87a66a0007a237d89793d2bed8334
Opcode Fuzzy Hash: b5939171f20e80ca8ae413bce707aac99b84a984febc587ff66131fc5547ebb5
Instruction Fuzzy Hash: 62E07E7094102BCBDFA2CB08C880BE9B7B1FB48308F1185E9D01DA6250CB329E858F40

Function 017736AC Relevance: .0, Instructions: 15COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.1586972189.0000000001770000.00000040.00000800.00020000.00000000.sdmp, Offset: 01770000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_1770000_LisectAVT_2403002A_135.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 73f241dcf626892a8cce648dc55ab4f8c66fe28ee071b7ee9d94cbc15d0a762c
Instruction ID: d7e0f31613aa796906b58cede576f6cf4cb6d4c1465d3143983b63f4aa3a67f0
Opcode Fuzzy Hash: 73f241dcf626892a8cce648dc55ab4f8c66fe28ee071b7ee9d94cbc15d0a762c
Instruction Fuzzy Hash: AEE0EC3494011BCFDB65DF14D948BF9B7B1FB44318F0184E5E51A96694CB769DC08F00

Function 05654573 Relevance: .0, Instructions: 15COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.1598792865.0000000005650000.00000040.00000800.00020000.00000000.sdmp, Offset: 05650000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_5650000_LisectAVT_2403002A_135.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7d6ac2228da4e691d316feb79747b9d84a49647a20879dd4b16a652ad392d767
Instruction ID: 4e6ff8c571647867fc3c9b405352509ea6039a96de836add8ff9b487f03c9d06
Opcode Fuzzy Hash: 7d6ac2228da4e691d316feb79747b9d84a49647a20879dd4b16a652ad392d767
Instruction Fuzzy Hash: 37E0927090C104CFDB25EFBAE68819CBFB1EF84312F104229E902AA2A4CF7408C2CF04

Function 05655228 Relevance: .0, Instructions: 15COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.1598792865.0000000005650000.00000040.00000800.00020000.00000000.sdmp, Offset: 05650000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_5650000_LisectAVT_2403002A_135.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 91ea6f100b5d60beae78c05437828cce7c62624069701930672fac4867a871f1
Instruction ID: 9b1d2e2fdb93a1621d9f674b50cee5a763e692b5106afca53d9b7c7a7c83483d
Opcode Fuzzy Hash: 91ea6f100b5d60beae78c05437828cce7c62624069701930672fac4867a871f1
Instruction Fuzzy Hash: 98D02270E893008FCB9AEBA8A4020E4B7B06F9636830041FFD58CCB223DB390C018A01

Function 013F23BC Relevance: .0, Instructions: 14COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.1586155056.00000000013F2000.00000040.00000800.00020000.00000000.sdmp, Offset: 013F2000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_13f2000_LisectAVT_2403002A_135.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1bbf4970c6deb9da31ef2549a662351f6375cbc39e30a7237d723b5d0e7a204c
Instruction ID: 6bbcfbfc97907c9b75dd47076b19bd0d8c07360d3d56eb220d870b69d7458595
Opcode Fuzzy Hash: 1bbf4970c6deb9da31ef2549a662351f6375cbc39e30a7237d723b5d0e7a204c
Instruction Fuzzy Hash: 92D05E742006818BD725DA0CC6D4F5A37E4AB40718F0644EDAD108B262C7A8D8C0DA00

Function 0177AC40 Relevance: .0, Instructions: 12COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.1586972189.0000000001770000.00000040.00000800.00020000.00000000.sdmp, Offset: 01770000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_1770000_LisectAVT_2403002A_135.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ec12ad0a839904e835e8f66a53015726f8ffcb809c9052f53b0a9678fb840bf4
Instruction ID: 1c2f281c35164fb75549725e8407de5ddc61c9a242b54d2581a35df45aae15f2
Opcode Fuzzy Hash: ec12ad0a839904e835e8f66a53015726f8ffcb809c9052f53b0a9678fb840bf4
Instruction Fuzzy Hash: 73C02B313001245BC11D35CE70042DF3A4DE7CB275F00003BE60997390CE729C0107E5

Function 01773355 Relevance: .0, Instructions: 12COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.1586972189.0000000001770000.00000040.00000800.00020000.00000000.sdmp, Offset: 01770000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_1770000_LisectAVT_2403002A_135.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3f932f4afe1542565705358036987991936d5097b7492135b6594d970fd4c56a
Instruction ID: 9b54231f0291555b73a192b911a322b03b332076293b6e141d5c38fd7f63382e
Opcode Fuzzy Hash: 3f932f4afe1542565705358036987991936d5097b7492135b6594d970fd4c56a
Instruction Fuzzy Hash: 7FD01730A00218CBDB2ACF12CE947E8B6B6AB98300F4080E9900A6A644CA345B858F00

Function 05655500 Relevance: .0, Instructions: 12COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.1598792865.0000000005650000.00000040.00000800.00020000.00000000.sdmp, Offset: 05650000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_5650000_LisectAVT_2403002A_135.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d0b73e59c3d29da690a91791666278e658b8a0b733dba55178cdb977a246fb15
Instruction ID: 40f45685f775f394654a8cfdcb52a1fdec9583530e6b61cef01557c70fab2b28
Opcode Fuzzy Hash: d0b73e59c3d29da690a91791666278e658b8a0b733dba55178cdb977a246fb15
Instruction Fuzzy Hash: 5EC08C3144C3888FCB575F68B0601ED3FB56E6227C71241EBC4888AE23C33A8825CF12

Function 05656460 Relevance: .0, Instructions: 12COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.1598792865.0000000005650000.00000040.00000800.00020000.00000000.sdmp, Offset: 05650000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_5650000_LisectAVT_2403002A_135.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 88362ab5adfc9ae0c92b51bac0f86d261b86e5da7d16339e9576084ad3f4ba28
Instruction ID: 4c147de62380861910a925850837256c6cb009dd29536c9b93737f93f82708f9
Opcode Fuzzy Hash: 88362ab5adfc9ae0c92b51bac0f86d261b86e5da7d16339e9576084ad3f4ba28
Instruction Fuzzy Hash: 6DC08C314C83848FCB4686B434214E93FF48E4313830200FBC4849E423D2AE0CC3C701

Function 05655070 Relevance: .0, Instructions: 11COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.1598792865.0000000005650000.00000040.00000800.00020000.00000000.sdmp, Offset: 05650000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_5650000_LisectAVT_2403002A_135.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c47409eefda50d8d710e96faba6b3e49d76a51542dfc6c3c884fa1de2e69ef41
Instruction ID: 40054a517010de03a17566cd32f5aba5456075d638ce43fee05df7ac0a93c5aa
Opcode Fuzzy Hash: c47409eefda50d8d710e96faba6b3e49d76a51542dfc6c3c884fa1de2e69ef41
Instruction Fuzzy Hash: 09C08C3808A380AFD343AB6464650C03F32DE03224305809BC08DC656382328808CB22

Function 05654B82 Relevance: .0, Instructions: 11COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.1598792865.0000000005650000.00000040.00000800.00020000.00000000.sdmp, Offset: 05650000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_5650000_LisectAVT_2403002A_135.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 710bcb5786ac8e9f7ee242e43362b6dcec3b9d2b56de920f731ffcc00decdcbf
Instruction ID: 4180ef2d1550b7a64afed5ab026cfcd58e949996cf804e8a0e6825c83265c32d
Opcode Fuzzy Hash: 710bcb5786ac8e9f7ee242e43362b6dcec3b9d2b56de920f731ffcc00decdcbf
Instruction Fuzzy Hash: CEC0123048C3804FC792AAA860A00CE7BA0AE82228B1200ABC0C48A472936609808B02

Function 01777112 Relevance: .0, Instructions: 10COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.1586972189.0000000001770000.00000040.00000800.00020000.00000000.sdmp, Offset: 01770000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_1770000_LisectAVT_2403002A_135.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8ab8cf93cfa16a206f89c67405109b3610a5da0703eeac627d3e9bad55fe4c8d
Instruction ID: ba3bccfdb2332c1f484f05561310491a689e77cee6bd6c7d5856c3efc0555472
Opcode Fuzzy Hash: 8ab8cf93cfa16a206f89c67405109b3610a5da0703eeac627d3e9bad55fe4c8d
Instruction Fuzzy Hash: A7D0C970A00515DFCB659F76CA487EDBBB1BB48304F4045E9940AE2694CE344E818F61

Function 01776F08 Relevance: .0, Instructions: 10COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.1586972189.0000000001770000.00000040.00000800.00020000.00000000.sdmp, Offset: 01770000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_1770000_LisectAVT_2403002A_135.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bd89400aacd921bbec3a9ac94b33b533ce8a50cfefaf1693a5ba63aee4416300
Instruction ID: ef508186a19e171813bf9a0890b5b1bc2e5964263348fa88366847f582dbaa2a
Opcode Fuzzy Hash: bd89400aacd921bbec3a9ac94b33b533ce8a50cfefaf1693a5ba63aee4416300
Instruction Fuzzy Hash: 92D06C34E102158FCB65DF72D9586ADBBB1BB88305F1000A9940A936A5DE3418818F00

Function 056554A0 Relevance: .0, Instructions: 10COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.1598792865.0000000005650000.00000040.00000800.00020000.00000000.sdmp, Offset: 05650000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_5650000_LisectAVT_2403002A_135.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d9eff13e2fe84628b19f4f304884a1df788bdc2ecf340fb11a49bdd6b95f8d9a
Instruction ID: 663158dd255408eaea694f5641fec5db1b3122da69e608dc5d1b75abb3bc0fa4
Opcode Fuzzy Hash: d9eff13e2fe84628b19f4f304884a1df788bdc2ecf340fb11a49bdd6b95f8d9a
Instruction Fuzzy Hash: 1CC04C350493C5DFD7439BA974A00D47FB0B95336C71654DBC088CD972912A58A68751

Function 0177E1A8 Relevance: .0, Instructions: 9COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.1586972189.0000000001770000.00000040.00000800.00020000.00000000.sdmp, Offset: 01770000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_1770000_LisectAVT_2403002A_135.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c2374c74894378bac900c8e4d88c99e04bbf4a37cbec7229ea03de5c6995d074
Instruction ID: 8584c93780d96beed3ab62aa4bda591ff2f64c1cf734385d255627525ac402d1
Opcode Fuzzy Hash: c2374c74894378bac900c8e4d88c99e04bbf4a37cbec7229ea03de5c6995d074
Instruction Fuzzy Hash: FBC01220009B884FDB232B677308361BE9C3701208F480088E488852BBC6BA9080C361

Function 05654E98 Relevance: .0, Instructions: 9COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.1598792865.0000000005650000.00000040.00000800.00020000.00000000.sdmp, Offset: 05650000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_5650000_LisectAVT_2403002A_135.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 544d7d2744bdd4a7c78fa84885901b25cc4ca8cf6f7589e804b2f59276b2d721
Instruction ID: 150b0532d14a8cc859b456e4a3887a0de48cdfbd90efce371e2dc55792bf78db
Opcode Fuzzy Hash: 544d7d2744bdd4a7c78fa84885901b25cc4ca8cf6f7589e804b2f59276b2d721
Instruction Fuzzy Hash: A3C02B3048D784CFC223A771B4190893B31C601001B4000859C8F832529D32041083C2

Function 0177326C Relevance: .0, Instructions: 8COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.1586972189.0000000001770000.00000040.00000800.00020000.00000000.sdmp, Offset: 01770000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_1770000_LisectAVT_2403002A_135.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5ebbe4f1ec86eafaac08d2d4dadba9aab112f609ab998cabf0c1a50418ca1c19
Instruction ID: 77ece8c242597b031e0eec98ea6fb776a8fa9ae74e1dc31421de313c382aadb9
Opcode Fuzzy Hash: 5ebbe4f1ec86eafaac08d2d4dadba9aab112f609ab998cabf0c1a50418ca1c19
Instruction Fuzzy Hash: 0AD0127448611BCACB618B04D880BFCB371BB01318F1286F9C069561E4CB325EC18F00

Function 05654BAA Relevance: .0, Instructions: 8COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.1598792865.0000000005650000.00000040.00000800.00020000.00000000.sdmp, Offset: 05650000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_5650000_LisectAVT_2403002A_135.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3cc2e55d3181e6cf7e87c06fead25b200445c1376ffafc1e74a179b40fcb8948
Instruction ID: 54169a25f77731ca97676e9ac963e4b27e579108365b04e122d62601d19e317f
Opcode Fuzzy Hash: 3cc2e55d3181e6cf7e87c06fead25b200445c1376ffafc1e74a179b40fcb8948
Instruction Fuzzy Hash: E5B092708803069BCBA45A98A2450EA77B4EA51224310001AE4CA80022C27544428F44

Function 0177A4D8 Relevance: .0, Instructions: 6COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.1586972189.0000000001770000.00000040.00000800.00020000.00000000.sdmp, Offset: 01770000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_1770000_LisectAVT_2403002A_135.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 47969176037c073a9a8a8f772279a9d32d7c64ee491e21fd179a915175dc508e
Instruction ID: bd1ac2a0d384f4cb526dd56e1973e48803372d8f24e53665ef6ab667d311051d
Opcode Fuzzy Hash: 47969176037c073a9a8a8f772279a9d32d7c64ee491e21fd179a915175dc508e
Instruction Fuzzy Hash: 2BA0223000030C8FAE0033EA320C00EB30CFA8000CBC80000E80E0280AAE2220000EE2

Function 0177A228 Relevance: .0, Instructions: 6COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.1586972189.0000000001770000.00000040.00000800.00020000.00000000.sdmp, Offset: 01770000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_1770000_LisectAVT_2403002A_135.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c2b739e6143de4b2e80f1910f2a15913308529585e9a6837397fe98f9abcd8c9
Instruction ID: ce9f0d320568e7aeddd1da0d443e20918fc001d358bb9c195afdc7c1ad0b123c
Opcode Fuzzy Hash: c2b739e6143de4b2e80f1910f2a15913308529585e9a6837397fe98f9abcd8c9
Instruction Fuzzy Hash: 32A011300002088BC200ABA8E008EA033ECAB08A08F0000F0A20C8BA228A22B8008A82

Function 0177E538 Relevance: .0, Instructions: 5COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.1586972189.0000000001770000.00000040.00000800.00020000.00000000.sdmp, Offset: 01770000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_1770000_LisectAVT_2403002A_135.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 689c6b48d84c209f72ea5a5cc2a008aba5f83f82256b9aff574a925e12c9ffe9
Instruction ID: ece1b9fb6a754fd5bcdfeb4e08df094c286d1ab43cb15208fa5dd697fb9b5c91
Opcode Fuzzy Hash: 689c6b48d84c209f72ea5a5cc2a008aba5f83f82256b9aff574a925e12c9ffe9
Instruction Fuzzy Hash: 5790223200020C8F02002B8A30080003B0CF2800003800000A00C020000A2028000280

Function 017765C0 Relevance: .0, Instructions: 5COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.1586972189.0000000001770000.00000040.00000800.00020000.00000000.sdmp, Offset: 01770000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_1770000_LisectAVT_2403002A_135.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7ffab3b4d3a47a916a7ab40a8555b7b259d3ac5ce61ac68dd4ee186ba0ca2566
Instruction ID: 858b1f400b0af8e625d161c7241098499d6a616ace1a8b8049475954b576a114
Opcode Fuzzy Hash: 7ffab3b4d3a47a916a7ab40a8555b7b259d3ac5ce61ac68dd4ee186ba0ca2566
Instruction Fuzzy Hash: 9BC09274985326ABDB68EF25C78C6A5BF35BB40304F0444F9848609918C7790682EF08

Function 0177A0E0 Relevance: .0, Instructions: 5COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.1586972189.0000000001770000.00000040.00000800.00020000.00000000.sdmp, Offset: 01770000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_1770000_LisectAVT_2403002A_135.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1b26d5f6e5bb38b12771c3a9db833dfeb452e8f3ddee0a250cb4574676a5a51b
Instruction ID: 96b223807c3d53cc4e5904f79492d6240b70ff07a5af7b735c029b751b99e241
Opcode Fuzzy Hash: 1b26d5f6e5bb38b12771c3a9db833dfeb452e8f3ddee0a250cb4574676a5a51b
Instruction Fuzzy Hash:

Function 0177E0A0 Relevance: .0, Instructions: 5COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.1586972189.0000000001770000.00000040.00000800.00020000.00000000.sdmp, Offset: 01770000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_1770000_LisectAVT_2403002A_135.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f675966e9b3bd731c2afdb662da3950cba4ba93a06f28b390749ca7a1eeb7de6
Instruction ID: 9bc501f8a7eb0e5aee4b5d38fef17bfb5b9915e44037372bc56fec74ce98e91d
Opcode Fuzzy Hash: f675966e9b3bd731c2afdb662da3950cba4ba93a06f28b390749ca7a1eeb7de6
Instruction Fuzzy Hash: 3490223000020C8F00022B83320A002BB0CA2000003800020B00C002020E2030000280

Function 0177A350 Relevance: .0, Instructions: 5COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.1586972189.0000000001770000.00000040.00000800.00020000.00000000.sdmp, Offset: 01770000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_1770000_LisectAVT_2403002A_135.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dbd5ef39fba3a1336919cf2be0013abc9ea52e777e853ed24945e7251117c90d
Instruction ID: b92b9b45eabd30c34984c4522f5d0683330f3cd935538dcb754d25913d557ff7
Opcode Fuzzy Hash: dbd5ef39fba3a1336919cf2be0013abc9ea52e777e853ed24945e7251117c90d
Instruction Fuzzy Hash:

Function 0177E320 Relevance: .0, Instructions: 5COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.1586972189.0000000001770000.00000040.00000800.00020000.00000000.sdmp, Offset: 01770000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_1770000_LisectAVT_2403002A_135.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ea4015263c6e2a55dabd304d35b58157a1fce7b6685db44a13054baf425c956b
Instruction ID: 9e8d7434e5c44ccb712be517cf082c565ec3b6722a2edfc49ce3298c16774879
Opcode Fuzzy Hash: ea4015263c6e2a55dabd304d35b58157a1fce7b6685db44a13054baf425c956b
Instruction Fuzzy Hash: BC90223000020C8F00202B82380A0823F0CA2000223800000A00C022000A2020000280

Function 01779E50 Relevance: .0, Instructions: 5COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.1586972189.0000000001770000.00000040.00000800.00020000.00000000.sdmp, Offset: 01770000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_1770000_LisectAVT_2403002A_135.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ebb2775da4997139d4bb21e9840534693103fe4269729325bbadd64fe0c9f792
Instruction ID: 6e1537b8c9726219141c9a5280b67a5dbed4f5c8ecd28ffd318faea9db88b680
Opcode Fuzzy Hash: ebb2775da4997139d4bb21e9840534693103fe4269729325bbadd64fe0c9f792
Instruction Fuzzy Hash:

Analysis Process: LisectAVT_2403002A_135.exePID: 2040, Parent PID: 3968COMMON

Execution Graph

Execution Coverage:	9.5%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	0%
Total number of Nodes:	64
Total number of Limit Nodes:	5

Executed Functions

Function 00CFB4CB Relevance: 1.6, APIs: 1, Instructions: 75
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

AdjustTokenPrivileges.KERNELBASE(?,?,?,?,?,?), ref: 00CFB54B

Memory Dump Source

Source File: 0000000D.00000002.1693331007.0000000000CFA000.00000040.00000800.00020000.00000000.sdmp, Offset: 00CFA000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_cfa000_LisectAVT_2403002A_135.jbxd

Similarity

API ID: AdjustPrivilegesToken
String ID:
API String ID: 2874748243-0
Opcode ID: 5292ccca395c7ca86a53601e903461a37924318d4a8553cb4bd26126c2dfab15
Instruction ID: 706ae06232554e456374e539bde7c6121828d23964619b7c057223bc9ffdf74e
Opcode Fuzzy Hash: 5292ccca395c7ca86a53601e903461a37924318d4a8553cb4bd26126c2dfab15
Instruction Fuzzy Hash: 4321AE755097849FDB228F25DC44B62BFF4EF06310F0884DAE9858B163D375E908DB62

Function 00CFA7AD Relevance: 1.6, APIs: 1, Instructions: 62nativeCOMMON

Download Yara Rule

APIs

NtQuerySystemInformation.NTDLL ref: 00CFA821

Memory Dump Source

Source File: 0000000D.00000002.1693331007.0000000000CFA000.00000040.00000800.00020000.00000000.sdmp, Offset: 00CFA000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_cfa000_LisectAVT_2403002A_135.jbxd

Similarity

API ID: InformationQuerySystem
String ID:
API String ID: 3562636166-0
Opcode ID: d5d478db6b3461f3de615ff12fff3f5d98cc8e1987f91a05f9135f6a2782d47b
Instruction ID: 4e5b90e043b446d2c87edf4df1d946427add209bf68b46b1f8e34386ebbda819
Opcode Fuzzy Hash: d5d478db6b3461f3de615ff12fff3f5d98cc8e1987f91a05f9135f6a2782d47b
Instruction Fuzzy Hash: CF219D7540D3C09FDB228F21DC44A62FFB4EF07214F0984DFE9858B1A3D265A919DB62

Function 00CFB502 Relevance: 1.6, APIs: 1, Instructions: 52COMMON

Download Yara Rule

APIs

AdjustTokenPrivileges.KERNELBASE(?,?,?,?,?,?), ref: 00CFB54B

Memory Dump Source

Source File: 0000000D.00000002.1693331007.0000000000CFA000.00000040.00000800.00020000.00000000.sdmp, Offset: 00CFA000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_cfa000_LisectAVT_2403002A_135.jbxd

Similarity

API ID: AdjustPrivilegesToken
String ID:
API String ID: 2874748243-0
Opcode ID: 807472d2b0c60cb345068012b4db5079d47aad61f73d3c1a51b7473827c5d9e0
Instruction ID: 972d0b59c16a25e447a9d0d52f2e38662d55cb5b19dccc49998cda29ca67903b
Opcode Fuzzy Hash: 807472d2b0c60cb345068012b4db5079d47aad61f73d3c1a51b7473827c5d9e0
Instruction Fuzzy Hash: 6511C2755006449FDB60CF55D884B66FBE4EF04320F08C4AEDE458B652D335E818DF62

Function 00CFA7E6 Relevance: 1.5, APIs: 1, Instructions: 38nativeCOMMON

Download Yara Rule

APIs

NtQuerySystemInformation.NTDLL ref: 00CFA821

Memory Dump Source

Source File: 0000000D.00000002.1693331007.0000000000CFA000.00000040.00000800.00020000.00000000.sdmp, Offset: 00CFA000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_cfa000_LisectAVT_2403002A_135.jbxd

Similarity

API ID: InformationQuerySystem
String ID:
API String ID: 3562636166-0
Opcode ID: 62303116178f914e0fcf5158be69e7e749b375744f5666cf745acb508dea1bef
Instruction ID: 589c29780ccc2f1d2e4208716a52fb6cd98b60113353b7c545376efe7a5ebf96
Opcode Fuzzy Hash: 62303116178f914e0fcf5158be69e7e749b375744f5666cf745acb508dea1bef
Instruction Fuzzy Hash: B801AD71404644DFDB60CF15D984B26FBE0EF48320F08C49ADE8A4B292D3B6A519DFA3

Function 00CFA9CF Relevance: 1.6, APIs: 1, Instructions: 98
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateFileW.KERNELBASE(?,?,?,?,?,?), ref: 00CFAA85

Memory Dump Source

Source File: 0000000D.00000002.1693331007.0000000000CFA000.00000040.00000800.00020000.00000000.sdmp, Offset: 00CFA000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_cfa000_LisectAVT_2403002A_135.jbxd

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: d7d2c1e1e130cb8cee9c99df63d83a55010609c881f35ff9720c954dcaeb709d
Instruction ID: f3ccd779139f3eab21eb5a4d42c4cfafe049a9d219dfa8b22e395b8488f01b61
Opcode Fuzzy Hash: d7d2c1e1e130cb8cee9c99df63d83a55010609c881f35ff9720c954dcaeb709d
Instruction Fuzzy Hash: A131A1B1404344AFE722CB25CD44B62BFF8EF06314F08849AE9858B252D375E909DB72

Function 00CFB722 Relevance: 1.6, APIs: 1, Instructions: 89
synchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateMutexW.KERNELBASE(?,?), ref: 00CFB7C9

Memory Dump Source

Source File: 0000000D.00000002.1693331007.0000000000CFA000.00000040.00000800.00020000.00000000.sdmp, Offset: 00CFA000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_cfa000_LisectAVT_2403002A_135.jbxd

Similarity

API ID: CreateMutex
String ID:
API String ID: 1964310414-0
Opcode ID: 084ef77ed13f8c02e196c0f27028bf955732bda578905600a8f11c1a294a6dcc
Instruction ID: d630da4b7869594a31b9e17ef07242fca8e83af66decb66c0800a8da57b5855a
Opcode Fuzzy Hash: 084ef77ed13f8c02e196c0f27028bf955732bda578905600a8f11c1a294a6dcc
Instruction Fuzzy Hash: A831AF715093846FE711CB25CC45BA6BFF8EF46314F09849AE984CB293D375E909CB62

Function 00CFA120 Relevance: 1.6, APIs: 1, Instructions: 84
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

FindNextFileW.KERNELBASE(?,00000E24,?,?), ref: 00CFA1C2

Memory Dump Source

Source File: 0000000D.00000002.1693331007.0000000000CFA000.00000040.00000800.00020000.00000000.sdmp, Offset: 00CFA000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_cfa000_LisectAVT_2403002A_135.jbxd

Similarity

API ID: FileFindNext
String ID:
API String ID: 2029273394-0
Opcode ID: f828f2365514e6ad5b711afff515854e8d2a43d7f4ff7972c289d5cc4f27b371
Instruction ID: bc2e1fd0fb0637fcbc00dd4c5832a8d9c3918360b2c00175ba8da590750a1c77
Opcode Fuzzy Hash: f828f2365514e6ad5b711afff515854e8d2a43d7f4ff7972c289d5cc4f27b371
Instruction Fuzzy Hash: 0F21917150D3C06FD3128B258C51BA6BFB4EF87610F0A85CBD8C4CF593D225A91AD7A2

Function 00CFAADC Relevance: 1.6, APIs: 1, Instructions: 80
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetFileType.KERNELBASE(?,00000E24,C89430EF,00000000,00000000,00000000,00000000), ref: 00CFAB71

Memory Dump Source

Source File: 0000000D.00000002.1693331007.0000000000CFA000.00000040.00000800.00020000.00000000.sdmp, Offset: 00CFA000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_cfa000_LisectAVT_2403002A_135.jbxd

Similarity

API ID: FileType
String ID:
API String ID: 3081899298-0
Opcode ID: f155d59ba04ab65702bb7625a4145930866147160354b814e42c65fc72891e97
Instruction ID: 577b15fe7a05050669c0d7f6545df0d97aa70540fd5c5ec2ce6f2a30d4fa8579
Opcode Fuzzy Hash: f155d59ba04ab65702bb7625a4145930866147160354b814e42c65fc72891e97
Instruction Fuzzy Hash: A72128B54093806FE7128B21DC41BA2BFACDF47324F09C0DAE9848B193D2646909C771

Function 00CFB0ED Relevance: 1.6, APIs: 1, Instructions: 79
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegQueryValueExW.KERNELBASE(?,00000E24,C89430EF,00000000,00000000,00000000,00000000), ref: 00CFB18C

Memory Dump Source

Source File: 0000000D.00000002.1693331007.0000000000CFA000.00000040.00000800.00020000.00000000.sdmp, Offset: 00CFA000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_cfa000_LisectAVT_2403002A_135.jbxd

Similarity

API ID: QueryValue
String ID:
API String ID: 3660427363-0
Opcode ID: fdd8d96648a103506998fadd1e55674591aef2d668523aff6a301fe7a86c3721
Instruction ID: cbbe49610b405ead5caa14cc82d14478d7130eed02e99a099cbd7e4bccb0b548
Opcode Fuzzy Hash: fdd8d96648a103506998fadd1e55674591aef2d668523aff6a301fe7a86c3721
Instruction Fuzzy Hash: 93216DB5504744AFE721CA11DC84F67BBFCEF45710F08C49AEA859B652D364E908CB61

Function 00CFB1E2 Relevance: 1.6, APIs: 1, Instructions: 77
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegSetValueExW.KERNELBASE(?,00000E24,C89430EF,00000000,00000000,00000000,00000000), ref: 00CFB278

Memory Dump Source

Source File: 0000000D.00000002.1693331007.0000000000CFA000.00000040.00000800.00020000.00000000.sdmp, Offset: 00CFA000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_cfa000_LisectAVT_2403002A_135.jbxd

Similarity

API ID: Value
String ID:
API String ID: 3702945584-0
Opcode ID: 41ac6ad90635ca02675852ad343cf8002ad43beecdf577da7237ef15d4e1c597
Instruction ID: 19513b3c4d33e5da74df3a63acc33c4e940b81275475dae2869194ab557ccdf9
Opcode Fuzzy Hash: 41ac6ad90635ca02675852ad343cf8002ad43beecdf577da7237ef15d4e1c597
Instruction Fuzzy Hash: EE2190B25083846FD7228F11DC45F67BFBCEF46210F09849AE9858B652D364E909CB71

Function 00CFAA06 Relevance: 1.6, APIs: 1, Instructions: 76
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateFileW.KERNELBASE(?,?,?,?,?,?), ref: 00CFAA85

Memory Dump Source

Source File: 0000000D.00000002.1693331007.0000000000CFA000.00000040.00000800.00020000.00000000.sdmp, Offset: 00CFA000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_cfa000_LisectAVT_2403002A_135.jbxd

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: 1207b63914ae595e35e36db913da763fcff35c6b37f96f7046e3edf864035063
Instruction ID: 0cb89f4ecdf95c80c99f3495d809af9520c32391698d73dba2d405b9076b0169
Opcode Fuzzy Hash: 1207b63914ae595e35e36db913da763fcff35c6b37f96f7046e3edf864035063
Instruction Fuzzy Hash: 8721A1B1504204AFE720CF25CD45B66FBE8EF04320F08885DEA898B651D375E908DF72

Function 00CFB756 Relevance: 1.6, APIs: 1, Instructions: 72
synchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateMutexW.KERNELBASE(?,?), ref: 00CFB7C9

Memory Dump Source

Source File: 0000000D.00000002.1693331007.0000000000CFA000.00000040.00000800.00020000.00000000.sdmp, Offset: 00CFA000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_cfa000_LisectAVT_2403002A_135.jbxd

Similarity

API ID: CreateMutex
String ID:
API String ID: 1964310414-0
Opcode ID: 6e66d7899d7722fbd9bd1a04fa8ed8cb119a46879c236eea6a66ecb2cd49df8b
Instruction ID: 74d260d9a7c8c303afdb2619b287196dbbf898731b10a0c5e9d554f6f16fd3de
Opcode Fuzzy Hash: 6e66d7899d7722fbd9bd1a04fa8ed8cb119a46879c236eea6a66ecb2cd49df8b
Instruction Fuzzy Hash: A121BE715042449FE760DF25CC45BA6FBE8EF44324F08C86AEA89CB282D375E905CB72

Function 00CFAF56 Relevance: 1.6, APIs: 1, Instructions: 72
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetLogicalDrives.KERNELBASE ref: 00CFAFDD

Memory Dump Source

Source File: 0000000D.00000002.1693331007.0000000000CFA000.00000040.00000800.00020000.00000000.sdmp, Offset: 00CFA000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_cfa000_LisectAVT_2403002A_135.jbxd

Similarity

API ID: DrivesLogical
String ID:
API String ID: 999431828-0
Opcode ID: d03e6034f6fad7d8f44dba57ab93ab91e17b7b2b17d4073a66fa8da5ee1f1ff0
Instruction ID: b9c3d1e5005599d8614653d038abbe73118d22291e3a2d6515012df89143ac87
Opcode Fuzzy Hash: d03e6034f6fad7d8f44dba57ab93ab91e17b7b2b17d4073a66fa8da5ee1f1ff0
Instruction Fuzzy Hash: 0521487140E3C09FD7138B209C65A92BFB4EF43220F0A84DBD985CF1A3D2696909DB72

Function 00CFAC8E Relevance: 1.6, APIs: 1, Instructions: 70
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

ReadFile.KERNELBASE(?,00000E24,C89430EF,00000000,00000000,00000000,00000000), ref: 00CFAD0D

Memory Dump Source

Source File: 0000000D.00000002.1693331007.0000000000CFA000.00000040.00000800.00020000.00000000.sdmp, Offset: 00CFA000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_cfa000_LisectAVT_2403002A_135.jbxd

Similarity

API ID: FileRead
String ID:
API String ID: 2738559852-0
Opcode ID: e59aff5d4505c7e2f9bdc9f8ac8beb1e604201a223ad31c040771e31b81a477c
Instruction ID: da9ddb62dc51bac12275916937c8b624cd6cf4347642e29768caf515317e6870
Opcode Fuzzy Hash: e59aff5d4505c7e2f9bdc9f8ac8beb1e604201a223ad31c040771e31b81a477c
Instruction Fuzzy Hash: 9321CF71408384AFD722CF51DC44FA7FFB8EF45320F08849AEA858B152C235A508CBB6

Function 00CFB112 Relevance: 1.6, APIs: 1, Instructions: 69
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegQueryValueExW.KERNELBASE(?,00000E24,C89430EF,00000000,00000000,00000000,00000000), ref: 00CFB18C

Memory Dump Source

Source File: 0000000D.00000002.1693331007.0000000000CFA000.00000040.00000800.00020000.00000000.sdmp, Offset: 00CFA000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_cfa000_LisectAVT_2403002A_135.jbxd

Similarity

API ID: QueryValue
String ID:
API String ID: 3660427363-0
Opcode ID: 7392a0ce83c3a97e56f3caa0b75c0959bebfefe9a453e29e72f3e19eab338302
Instruction ID: 127bfe085d432a47e448cf13c280378b38159cf856c366b74561dc08169f3a5d
Opcode Fuzzy Hash: 7392a0ce83c3a97e56f3caa0b75c0959bebfefe9a453e29e72f3e19eab338302
Instruction Fuzzy Hash: E5218C75604608AFE760CE15CC84FBBB7ECEF04720F08C45AEA858B651D374E908CAB2

Function 00CFB598 Relevance: 1.6, APIs: 1, Instructions: 68
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

FindCloseChangeNotification.KERNELBASE(?), ref: 00CFB604

Memory Dump Source

Source File: 0000000D.00000002.1693331007.0000000000CFA000.00000040.00000800.00020000.00000000.sdmp, Offset: 00CFA000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_cfa000_LisectAVT_2403002A_135.jbxd

Similarity

API ID: ChangeCloseFindNotification
String ID:
API String ID: 2591292051-0
Opcode ID: 8d578edf6623fc8384d0738feeb1955bc42a8f3b46b0e33a0bf9453bbad59d91
Instruction ID: a1aba127a3a7fa23cba22042bf5389ceb9193cdb1f44a6e18b51b10944f3872d
Opcode Fuzzy Hash: 8d578edf6623fc8384d0738feeb1955bc42a8f3b46b0e33a0bf9453bbad59d91
Instruction Fuzzy Hash: 9B21C3715093C05FDB12CF25DC94792BFB4AF47324F0D84DAE9858F263D265A908DB62

Function 00CFB024 Relevance: 1.6, APIs: 1, Instructions: 66
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CopyFileW.KERNELBASE(?,?,?), ref: 00CFB092

Memory Dump Source

Source File: 0000000D.00000002.1693331007.0000000000CFA000.00000040.00000800.00020000.00000000.sdmp, Offset: 00CFA000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_cfa000_LisectAVT_2403002A_135.jbxd

Similarity

API ID: CopyFile
String ID:
API String ID: 1304948518-0
Opcode ID: 933e7af086ad5b0b2b89f35a7cf827c8abb536b9db515da0bc944809969bf81d
Instruction ID: 2864f777d7576234d66f8bf9027d92dfc501a29ee5c72ec7a26fede5c1d9583d
Opcode Fuzzy Hash: 933e7af086ad5b0b2b89f35a7cf827c8abb536b9db515da0bc944809969bf81d
Instruction Fuzzy Hash: AA2193B15083809FD761CF65DC85BA7BFE8EF46210F0884AAE995CB252D725E904CB62

Function 00CFB206 Relevance: 1.6, APIs: 1, Instructions: 65
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegSetValueExW.KERNELBASE(?,00000E24,C89430EF,00000000,00000000,00000000,00000000), ref: 00CFB278

Memory Dump Source

Source File: 0000000D.00000002.1693331007.0000000000CFA000.00000040.00000800.00020000.00000000.sdmp, Offset: 00CFA000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_cfa000_LisectAVT_2403002A_135.jbxd

Similarity

API ID: Value
String ID:
API String ID: 3702945584-0
Opcode ID: bcac22f252be53ef04b7ecbc6943f05c895282ffcbe46c196a575d38354f9471
Instruction ID: c0b712238e597a2f560f24fb8051a5f79defbcd489c9fca70f8d5a227416fef4
Opcode Fuzzy Hash: bcac22f252be53ef04b7ecbc6943f05c895282ffcbe46c196a575d38354f9471
Instruction Fuzzy Hash: E811BEB1604604AFEB608E11CC41F7BFBECEF54714F04C45AEE858A652D374E9048AB6

Function 00CFB362 Relevance: 1.6, APIs: 1, Instructions: 64COMMON

Download Yara Rule

APIs

LookupPrivilegeValueW.ADVAPI32(?,?,?), ref: 00CFB3CA

Memory Dump Source

Source File: 0000000D.00000002.1693331007.0000000000CFA000.00000040.00000800.00020000.00000000.sdmp, Offset: 00CFA000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_cfa000_LisectAVT_2403002A_135.jbxd

Similarity

API ID: LookupPrivilegeValue
String ID:
API String ID: 3899507212-0
Opcode ID: accacc75ef2ff4bdaa209a9360d2d1826bd48509233ebaaa812607451ac7cccb
Instruction ID: df87d5a049cffed6a4843b7c3b83816c3b77edd0b5d904a39032b936f16ca5ca
Opcode Fuzzy Hash: accacc75ef2ff4bdaa209a9360d2d1826bd48509233ebaaa812607451ac7cccb
Instruction Fuzzy Hash: 02118EB16043849FDB61CF25DC44B62BFE8EF45220F0884AAED45CB252D365E908CB62

Function 00CFA5D5 Relevance: 1.6, APIs: 1, Instructions: 61COMMON

Download Yara Rule

APIs

FindCloseChangeNotification.KERNELBASE(?), ref: 00CFA638

Memory Dump Source

Source File: 0000000D.00000002.1693331007.0000000000CFA000.00000040.00000800.00020000.00000000.sdmp, Offset: 00CFA000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_cfa000_LisectAVT_2403002A_135.jbxd

Similarity

API ID: ChangeCloseFindNotification
String ID:
API String ID: 2591292051-0
Opcode ID: d1943858ae24ffce24987c8fbec30dabfc6f77792974dff0db6344ebc141035a
Instruction ID: c82af590b2922e97ca556ef94393ae61508255e58d69a61b41f04737529d9574
Opcode Fuzzy Hash: d1943858ae24ffce24987c8fbec30dabfc6f77792974dff0db6344ebc141035a
Instruction Fuzzy Hash: F7116A755093809FD7128F25DC45A92BFB4EF46220F0984EBED85CB263C269A948CB62

Function 00CFACAE Relevance: 1.6, APIs: 1, Instructions: 60fileCOMMON

Download Yara Rule

APIs

ReadFile.KERNELBASE(?,00000E24,C89430EF,00000000,00000000,00000000,00000000), ref: 00CFAD0D

Memory Dump Source

Source File: 0000000D.00000002.1693331007.0000000000CFA000.00000040.00000800.00020000.00000000.sdmp, Offset: 00CFA000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_cfa000_LisectAVT_2403002A_135.jbxd

Similarity

API ID: FileRead
String ID:
API String ID: 2738559852-0
Opcode ID: 72c6bb4caaf32a54803483c2bb590e9de73c32363f78da6a2210094b981c5f74
Instruction ID: 9700bcb3ba57f31205466965f08769447668cc0bbc4134e715b21c216d9dffc3
Opcode Fuzzy Hash: 72c6bb4caaf32a54803483c2bb590e9de73c32363f78da6a2210094b981c5f74
Instruction Fuzzy Hash: 631120B5404204AFEB21CF52DC40FAAFBE8EF44324F04C85AEE898B651C375A504CBB6

Function 00CFB04A Relevance: 1.6, APIs: 1, Instructions: 53fileCOMMON

Download Yara Rule

APIs

CopyFileW.KERNELBASE(?,?,?), ref: 00CFB092

Memory Dump Source

Source File: 0000000D.00000002.1693331007.0000000000CFA000.00000040.00000800.00020000.00000000.sdmp, Offset: 00CFA000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_cfa000_LisectAVT_2403002A_135.jbxd

Similarity

API ID: CopyFile
String ID:
API String ID: 1304948518-0
Opcode ID: e7c7b8d9b5f2c8f69cb323d74343923d8f5dbc72fc9bf39bd36f0031eccbb887
Instruction ID: 86dabe6f13ce6d3afc7856498da69a21ccf97a0e16c2a3531c15b14dfd6d0a04
Opcode Fuzzy Hash: e7c7b8d9b5f2c8f69cb323d74343923d8f5dbc72fc9bf39bd36f0031eccbb887
Instruction Fuzzy Hash: CB1182B16042449FDB60CF25D885B67FBE8EF44320F08C46ADE55CB242DB75E904DA62

Function 00CFB382 Relevance: 1.6, APIs: 1, Instructions: 53COMMON

Download Yara Rule

APIs

LookupPrivilegeValueW.ADVAPI32(?,?,?), ref: 00CFB3CA

Memory Dump Source

Source File: 0000000D.00000002.1693331007.0000000000CFA000.00000040.00000800.00020000.00000000.sdmp, Offset: 00CFA000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_cfa000_LisectAVT_2403002A_135.jbxd

Similarity

API ID: LookupPrivilegeValue
String ID:
API String ID: 3899507212-0
Opcode ID: e7c7b8d9b5f2c8f69cb323d74343923d8f5dbc72fc9bf39bd36f0031eccbb887
Instruction ID: 43da7e629dd91ed6a083dbf08f7b9b00a0d4a52ea870e58861813a274e540c44
Opcode Fuzzy Hash: e7c7b8d9b5f2c8f69cb323d74343923d8f5dbc72fc9bf39bd36f0031eccbb887
Instruction Fuzzy Hash: 1911C8756042048FDB60DF25DC85B66FBE8EF44320F08C46ADE45CB252D775E908DB62

Function 00CFAEC8 Relevance: 1.6, APIs: 1, Instructions: 52COMMON

Download Yara Rule

APIs

FindClose.KERNELBASE(?), ref: 00CFAF1C

Memory Dump Source

Source File: 0000000D.00000002.1693331007.0000000000CFA000.00000040.00000800.00020000.00000000.sdmp, Offset: 00CFA000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_cfa000_LisectAVT_2403002A_135.jbxd

Similarity

API ID: CloseFind
String ID:
API String ID: 1863332320-0
Opcode ID: f4b4590a0e829b6217bc2646f8f0206590ac7f4fbae3432ea4793e0a52f623f0
Instruction ID: 3aee2a5dcd3618818dd3755acc61b037f464ff0def5f808da5a37ba537482832
Opcode Fuzzy Hash: f4b4590a0e829b6217bc2646f8f0206590ac7f4fbae3432ea4793e0a52f623f0
Instruction Fuzzy Hash: 2B11A5B55093849FD7128F15DC45B56FFB4DF46220F08C0DEED858F293D265A908CB62

Function 00CFAB1E Relevance: 1.6, APIs: 1, Instructions: 52COMMON

Download Yara Rule

APIs

GetFileType.KERNELBASE(?,00000E24,C89430EF,00000000,00000000,00000000,00000000), ref: 00CFAB71

Memory Dump Source

Source File: 0000000D.00000002.1693331007.0000000000CFA000.00000040.00000800.00020000.00000000.sdmp, Offset: 00CFA000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_cfa000_LisectAVT_2403002A_135.jbxd

Similarity

API ID: FileType
String ID:
API String ID: 3081899298-0
Opcode ID: d94d616fa3ab67b446da96dcc0a7b751173eda9b0d03305883d788ef52435f3f
Instruction ID: 16112b83a3caad82b60ed339a6496e02322d1f85590b4e513df38c465b945335
Opcode Fuzzy Hash: d94d616fa3ab67b446da96dcc0a7b751173eda9b0d03305883d788ef52435f3f
Instruction Fuzzy Hash: 5101D2B1508604AFE760CF15DC85F76F7ECDF54724F14C09AEE498B281D378A9048AB6

Function 00CFA547 Relevance: 1.6, APIs: 1, Instructions: 50COMMON

Download Yara Rule

APIs

SetErrorMode.KERNELBASE(?), ref: 00CFA5A4

Memory Dump Source

Source File: 0000000D.00000002.1693331007.0000000000CFA000.00000040.00000800.00020000.00000000.sdmp, Offset: 00CFA000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_cfa000_LisectAVT_2403002A_135.jbxd

Similarity

API ID: ErrorMode
String ID:
API String ID: 2340568224-0
Opcode ID: 18802d6560d7a6d6760dcacc521d9bc4e491a2f4687c225f81aec1146ba67cf9
Instruction ID: 70b88f417fabbfbf3f420c1e83a2652b2b5e1078ecf2ce750c0e1b2ce48d01a0
Opcode Fuzzy Hash: 18802d6560d7a6d6760dcacc521d9bc4e491a2f4687c225f81aec1146ba67cf9
Instruction Fuzzy Hash: 021182B1405784AFD7228F15DC44B62FFF8EF46224F09C4DAED848B267D275A908CB62

Function 00CFA172 Relevance: 1.5, APIs: 1, Instructions: 47fileCOMMON

Download Yara Rule

APIs

FindNextFileW.KERNELBASE(?,00000E24,?,?), ref: 00CFA1C2

Memory Dump Source

Source File: 0000000D.00000002.1693331007.0000000000CFA000.00000040.00000800.00020000.00000000.sdmp, Offset: 00CFA000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_cfa000_LisectAVT_2403002A_135.jbxd

Similarity

API ID: FileFindNext
String ID:
API String ID: 2029273394-0
Opcode ID: 6975173af77f562a7285d0f248e0039f1853abb2b05d6f81cd2e452a96e23a65
Instruction ID: 9709a9b5ffd76aee27333b74cc422d0148afd33264128812be5162c3e73df152
Opcode Fuzzy Hash: 6975173af77f562a7285d0f248e0039f1853abb2b05d6f81cd2e452a96e23a65
Instruction Fuzzy Hash: 96017171500200AFD310DF16DD46B66FBE8EBC8A20F14855AED489B642D735F915CBE5

Function 00CFB5D2 Relevance: 1.5, APIs: 1, Instructions: 43COMMON

Download Yara Rule

APIs

FindCloseChangeNotification.KERNELBASE(?), ref: 00CFB604

Memory Dump Source

Source File: 0000000D.00000002.1693331007.0000000000CFA000.00000040.00000800.00020000.00000000.sdmp, Offset: 00CFA000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_cfa000_LisectAVT_2403002A_135.jbxd

Similarity

API ID: ChangeCloseFindNotification
String ID:
API String ID: 2591292051-0
Opcode ID: 0675ad0526e69d41a4334e6815d1e2ce8f16700b663cb13bb095b471fa0fdd0b
Instruction ID: fa4f5d9f3dff5baec4b02bf637bef0da28d91386f8088f2652624f98901e25c2
Opcode Fuzzy Hash: 0675ad0526e69d41a4334e6815d1e2ce8f16700b663cb13bb095b471fa0fdd0b
Instruction Fuzzy Hash: B001F2755056448FDB50CF2AE885766FBE4EF40320F08C4AAEE49CF242D375E814DBA2

Function 00CFA606 Relevance: 1.5, APIs: 1, Instructions: 43COMMON

Download Yara Rule

APIs

FindCloseChangeNotification.KERNELBASE(?), ref: 00CFA638

Memory Dump Source

Source File: 0000000D.00000002.1693331007.0000000000CFA000.00000040.00000800.00020000.00000000.sdmp, Offset: 00CFA000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_cfa000_LisectAVT_2403002A_135.jbxd

Similarity

API ID: ChangeCloseFindNotification
String ID:
API String ID: 2591292051-0
Opcode ID: 9cf0fdb8528cc55c0ebf091835bc1d1e71b0595c3ea1db23c7f6c37b17455242
Instruction ID: 25c6b15d8ef84b5d81d8bd5a3bcd48799e9154556d2b8ce412040479393322dd
Opcode Fuzzy Hash: 9cf0fdb8528cc55c0ebf091835bc1d1e71b0595c3ea1db23c7f6c37b17455242
Instruction Fuzzy Hash: 0501DFB45042448FDB50CF26D884766FBE4DF40320F18C4AAEE49CB252D279A904DAA3

Function 00CFAEEA Relevance: 1.5, APIs: 1, Instructions: 39COMMON

Download Yara Rule

APIs

FindClose.KERNELBASE(?), ref: 00CFAF1C

Memory Dump Source

Source File: 0000000D.00000002.1693331007.0000000000CFA000.00000040.00000800.00020000.00000000.sdmp, Offset: 00CFA000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_cfa000_LisectAVT_2403002A_135.jbxd

Similarity

API ID: CloseFind
String ID:
API String ID: 1863332320-0
Opcode ID: 4fa8c928921fe11e32021cab453f9551ba35ab588686ef3217fe53c5243379c3
Instruction ID: 8008a3b6703f83596725b8e985c5df3936a34790fa1437229eaad7dbed4311cc
Opcode Fuzzy Hash: 4fa8c928921fe11e32021cab453f9551ba35ab588686ef3217fe53c5243379c3
Instruction Fuzzy Hash: 3001D1B45046448FDB508F16D885766FBE4DF44330F08C0AADE498F252D279A904DAA3

Function 00CFAFAE Relevance: 1.5, APIs: 1, Instructions: 38COMMON

Download Yara Rule

APIs

GetLogicalDrives.KERNELBASE ref: 00CFAFDD

Memory Dump Source

Source File: 0000000D.00000002.1693331007.0000000000CFA000.00000040.00000800.00020000.00000000.sdmp, Offset: 00CFA000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_cfa000_LisectAVT_2403002A_135.jbxd

Similarity

API ID: DrivesLogical
String ID:
API String ID: 999431828-0
Opcode ID: 7b22cd54c3ded13048ce2e905484ca849598beefb892fa03e3c18d5f9d865e89
Instruction ID: e8153460fdf74363aea5a076aa42ef73bb84e7888a9f7fed9ef9f10aeb95ad75
Opcode Fuzzy Hash: 7b22cd54c3ded13048ce2e905484ca849598beefb892fa03e3c18d5f9d865e89
Instruction Fuzzy Hash: CF01DCB49042448FDB50CF56D884766FBE4EF44320F08C4AACE498F242D37AA944DEA3

Function 00CFA572 Relevance: 1.5, APIs: 1, Instructions: 35COMMON

Download Yara Rule

APIs

SetErrorMode.KERNELBASE(?), ref: 00CFA5A4

Memory Dump Source

Source File: 0000000D.00000002.1693331007.0000000000CFA000.00000040.00000800.00020000.00000000.sdmp, Offset: 00CFA000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_cfa000_LisectAVT_2403002A_135.jbxd

Similarity

API ID: ErrorMode
String ID:
API String ID: 2340568224-0
Opcode ID: 6a3880fab5db93ca7ead40898ef4dc5a2c080babb259d5073ee9844dcf0d072a
Instruction ID: c7f006de58bf6eb9b12ab6b6c8eb921a339030cc669c97cc8d54212ffafafc73
Opcode Fuzzy Hash: 6a3880fab5db93ca7ead40898ef4dc5a2c080babb259d5073ee9844dcf0d072a
Instruction Fuzzy Hash: 6FF022B4404A449FDB60CF16D884B25FBE0EF44324F08C09ADE494F756D379A904CEA3

Function 01180080 Relevance: 1.4, Strings: 1, Instructions: 112COMMON

Download Yara Rule

Strings

:@zl, xrefs: 0118016D

Memory Dump Source

Source File: 0000000D.00000002.1703482500.0000000001180000.00000040.00000800.00020000.00000000.sdmp, Offset: 01180000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_1180000_LisectAVT_2403002A_135.jbxd

Similarity

API ID:
String ID: :@zl
API String ID: 0-1604122134
Opcode ID: f857089944eef6095e6761313b190f22f42400a695b721f44f2fdca7c94a89f4
Instruction ID: 9cd2711088c440bf4f55b78ac80c18065a487596a7ba85076ccc0d49860307f6
Opcode Fuzzy Hash: f857089944eef6095e6761313b190f22f42400a695b721f44f2fdca7c94a89f4
Instruction Fuzzy Hash: 7E41EF35904345DFC348FB79E94569ABBE2AF85304F48C12CC205DB368EF754906ABB6

Function 01180090 Relevance: 1.4, Strings: 1, Instructions: 104COMMON

Download Yara Rule

Strings

:@zl, xrefs: 0118016D

Memory Dump Source

Source File: 0000000D.00000002.1703482500.0000000001180000.00000040.00000800.00020000.00000000.sdmp, Offset: 01180000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_1180000_LisectAVT_2403002A_135.jbxd

Similarity

API ID:
String ID: :@zl
API String ID: 0-1604122134
Opcode ID: 0d85cc15de2480edeef8a6ef098b4e502166184caf9aa5907d88c7b0d4c47da1
Instruction ID: cae1c87aa3c9974288981912bb511bd36a33b87bba024856eb9da367c4687a7a
Opcode Fuzzy Hash: 0d85cc15de2480edeef8a6ef098b4e502166184caf9aa5907d88c7b0d4c47da1
Instruction Fuzzy Hash: E941E235A04305DBC348FB79E94669ABBE2AFC5304F44C12CD204DB368EF744906ABB6

Function 050556D7 Relevance: 1.3, Strings: 1, Instructions: 23COMMON

Download Yara Rule

Strings

D, xrefs: 05055704

Memory Dump Source

Source File: 0000000D.00000002.1722826252.0000000005050000.00000040.00000800.00020000.00000000.sdmp, Offset: 05050000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_5050000_LisectAVT_2403002A_135.jbxd

Similarity

API ID:
String ID: D
API String ID: 0-2746444292
Opcode ID: fec6bceedc41a5778f640fab5efea3d2ed43277e55dd25874bd99110c519c0a3
Instruction ID: e44f089ab38069576729e6f757b5a7450999365aa7a8eba2c30bf51b25156142
Opcode Fuzzy Hash: fec6bceedc41a5778f640fab5efea3d2ed43277e55dd25874bd99110c519c0a3
Instruction Fuzzy Hash: 0DE09270505380DFC701CBA49C182DE7BB2AF02321B054196D846DE613DB7C0947CB22

Function 05055858 Relevance: 1.3, Strings: 1, Instructions: 19COMMON

Download Yara Rule

Strings

E, xrefs: 05055858

Memory Dump Source

Source File: 0000000D.00000002.1722826252.0000000005050000.00000040.00000800.00020000.00000000.sdmp, Offset: 05050000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_5050000_LisectAVT_2403002A_135.jbxd

Similarity

API ID:
String ID: E
API String ID: 0-3568589458
Opcode ID: 62f44fc8077115836a8eb6aa0a7845abd03b1ffb624415cc8f2ee8a5a2fbba9c
Instruction ID: 4035dcd3d8c9f493de8009a05ba25c2511130de407f4ba888b39ad53e5e5a105
Opcode Fuzzy Hash: 62f44fc8077115836a8eb6aa0a7845abd03b1ffb624415cc8f2ee8a5a2fbba9c
Instruction Fuzzy Hash: 30E08CB0905684DFDB01CBA8EC592AD7FB2FB41326F58455AC802E9282DF7C894A8B55

Function 05055E57 Relevance: 1.3, Strings: 1, Instructions: 19COMMON

Download Yara Rule

Strings

2, xrefs: 05055E89

Memory Dump Source

Source File: 0000000D.00000002.1722826252.0000000005050000.00000040.00000800.00020000.00000000.sdmp, Offset: 05050000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_5050000_LisectAVT_2403002A_135.jbxd

Similarity

API ID:
String ID: 2
API String ID: 0-450215437
Opcode ID: b6b5639023a96cc4b76dd8bf0fce861d3dc4af16aa3b5a2dc8270fa63fb6117a
Instruction ID: a647253bcaa78b1c47bdf486bd425479e0c7d6a697b7b071e416887b97a552c2
Opcode Fuzzy Hash: b6b5639023a96cc4b76dd8bf0fce861d3dc4af16aa3b5a2dc8270fa63fb6117a
Instruction Fuzzy Hash: 5BE01A70606344CBDB45DFA4E9081EEBBB3EB04311F108966D802EB651DF3C8A46C711

Function 05055F6B Relevance: 1.3, Strings: 1, Instructions: 18COMMON

Download Yara Rule

Strings

,, xrefs: 05055F98

Memory Dump Source

Source File: 0000000D.00000002.1722826252.0000000005050000.00000040.00000800.00020000.00000000.sdmp, Offset: 05050000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_5050000_LisectAVT_2403002A_135.jbxd

Similarity

API ID:
String ID: ,
API String ID: 0-3772416878
Opcode ID: e9ee8670f7011c3fba207ef15bc3b6ab8a9a06bf0329c9186fc82f705b47dea3
Instruction ID: 87a411b7ef357869026c275ddb1c31fb7c721893c2c930d7dcfb68ae6408246d
Opcode Fuzzy Hash: e9ee8670f7011c3fba207ef15bc3b6ab8a9a06bf0329c9186fc82f705b47dea3
Instruction Fuzzy Hash: 7DE0C2308553048BCB00CB2498193CC7BB1AB05220F558186CC878B396EE3809469B55

Function 0505596E Relevance: 1.3, Strings: 1, Instructions: 17COMMON

Download Yara Rule

Strings

<, xrefs: 0505573C

Memory Dump Source

Source File: 0000000D.00000002.1722826252.0000000005050000.00000040.00000800.00020000.00000000.sdmp, Offset: 05050000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_5050000_LisectAVT_2403002A_135.jbxd

Similarity

API ID:
String ID: <
API String ID: 0-4251816714
Opcode ID: 66e099c088a91e5c4aad3855d062915267209724aac57ef1252c8bc8743e2404
Instruction ID: 82351bac3d938a4c207e24a1f91f615c2cc3fddc4560e221477e1ae2bb199575
Opcode Fuzzy Hash: 66e099c088a91e5c4aad3855d062915267209724aac57ef1252c8bc8743e2404
Instruction Fuzzy Hash: C8E09A74A05248DBDB44CFA4E9486AE77A7AB44351F548819DC03EA780DF788A46CB61

Function 0505615D Relevance: 1.3, Strings: 1, Instructions: 16COMMON

Download Yara Rule

Strings

f, xrefs: 0505615D

Memory Dump Source

Source File: 0000000D.00000002.1722826252.0000000005050000.00000040.00000800.00020000.00000000.sdmp, Offset: 05050000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_5050000_LisectAVT_2403002A_135.jbxd

Similarity

API ID:
String ID: f
API String ID: 0-1993550816
Opcode ID: c8212a8b22cabef64c97033720105b4f34225dbc55ab861b3a7349290a6e88c6
Instruction ID: ba70e9c2ef8062a1fff91130e2423c8c3815784ab8797963a55b77cc6cbbb633
Opcode Fuzzy Hash: c8212a8b22cabef64c97033720105b4f34225dbc55ab861b3a7349290a6e88c6
Instruction Fuzzy Hash: 64E0EC70E01245CBDF04DFE5E9084BEB7B7AB44321B54C425DC02EA354EF394A46CA20

Function 050558F8 Relevance: 1.3, Strings: 1, Instructions: 11COMMON

Download Yara Rule

Strings

., xrefs: 0505590E

Memory Dump Source

Source File: 0000000D.00000002.1722826252.0000000005050000.00000040.00000800.00020000.00000000.sdmp, Offset: 05050000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_5050000_LisectAVT_2403002A_135.jbxd

Similarity

API ID:
String ID: .
API String ID: 0-248832578
Opcode ID: f7c522c30a50206adb3ef308b7d487d4fc98e940f8cd4378865d7deb84c608f0
Instruction ID: 777758386709cf0ba21931b19f8e5da9740e70bb392623b7f6d0048b43acfbe1
Opcode Fuzzy Hash: f7c522c30a50206adb3ef308b7d487d4fc98e940f8cd4378865d7deb84c608f0
Instruction Fuzzy Hash: 15D09E74905244DBDB04CFA4E8481AD7BB3A744311F608415D802E6750CF7C49458A61

Function 05055726 Relevance: 1.3, Strings: 1, Instructions: 11COMMON

Download Yara Rule

Strings

<, xrefs: 0505573C

Memory Dump Source

Source File: 0000000D.00000002.1722826252.0000000005050000.00000040.00000800.00020000.00000000.sdmp, Offset: 05050000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_5050000_LisectAVT_2403002A_135.jbxd

Similarity

API ID:
String ID: <
API String ID: 0-4251816714
Opcode ID: 4dc770a14690bc2651c9100b18d6c00c586fe4fd23e8178caeadf16529d2acc5
Instruction ID: da1cd685842861415104bd275d634d80e754b7d15c535042fe66f09f41c0315a
Opcode Fuzzy Hash: 4dc770a14690bc2651c9100b18d6c00c586fe4fd23e8178caeadf16529d2acc5
Instruction Fuzzy Hash: 25D09274A02248DBDB04CFA4E8485AEBBB3EB04311B50882ADC03EA740CF384A46CB21

Function 05055ECD Relevance: 1.3, Strings: 1, Instructions: 11COMMON

Download Yara Rule

Strings

%, xrefs: 05055EE9

Memory Dump Source

Source File: 0000000D.00000002.1722826252.0000000005050000.00000040.00000800.00020000.00000000.sdmp, Offset: 05050000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_5050000_LisectAVT_2403002A_135.jbxd

Similarity

API ID:
String ID: %
API String ID: 0-2567322570
Opcode ID: bc769db6f44ebcb543a20bb0ec8ea4f50ea459930164fc0ab6fa2eae73cbde05
Instruction ID: 6e98480cedda6cf2755fd41a64e8d111a50e7cc943a46b078b020cb28a12c056
Opcode Fuzzy Hash: bc769db6f44ebcb543a20bb0ec8ea4f50ea459930164fc0ab6fa2eae73cbde05
Instruction Fuzzy Hash: 13C012B09026049BD700CFB46C1D3DD37F1FB04335B5441154802A2346EF3444478A60

Function 05055949 Relevance: 1.3, Strings: 1, Instructions: 7COMMON

Download Yara Rule

Strings

H, xrefs: 05055962

Memory Dump Source

Source File: 0000000D.00000002.1722826252.0000000005050000.00000040.00000800.00020000.00000000.sdmp, Offset: 05050000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_5050000_LisectAVT_2403002A_135.jbxd

Similarity

API ID:
String ID: H
API String ID: 0-2852464175
Opcode ID: 16a4a384f5bc7d0fddf1347e81164b780950a329667ef3aa074587ea7ff125ac
Instruction ID: 9e8a4d69015500c0f1dfa292c0ead367f3221e405f81fa974c1c05432f584abd
Opcode Fuzzy Hash: 16a4a384f5bc7d0fddf1347e81164b780950a329667ef3aa074587ea7ff125ac
Instruction Fuzzy Hash: 64C04CB4A02304DFDB44DFA4DD1C3AD7BB2EB84312F04845A9907E6390DE780985DF61

Function 05055D5E Relevance: 1.3, Strings: 1, Instructions: 7COMMON

Download Yara Rule

Strings

J, xrefs: 05055D77

Memory Dump Source

Source File: 0000000D.00000002.1722826252.0000000005050000.00000040.00000800.00020000.00000000.sdmp, Offset: 05050000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_5050000_LisectAVT_2403002A_135.jbxd

Similarity

API ID:
String ID: J
API String ID: 0-1141589763
Opcode ID: 9828f478285304e181cf43f23d5c72cabf8f79533aa62084c7ccd4b4a67e2a0f
Instruction ID: f0ca55582366e80b380a9525b0fca054c9cecd59899163150cfd73c67070b81d
Opcode Fuzzy Hash: 9828f478285304e181cf43f23d5c72cabf8f79533aa62084c7ccd4b4a67e2a0f
Instruction Fuzzy Hash: 33C04CB4A02344DFDB44DFA5E85C2AD7AB2EB44311F10C459990BE2390DE780985DF65

Function 05055D83 Relevance: 1.3, Strings: 1, Instructions: 7COMMON

Download Yara Rule

Strings

E, xrefs: 05055D99

Memory Dump Source

Source File: 0000000D.00000002.1722826252.0000000005050000.00000040.00000800.00020000.00000000.sdmp, Offset: 05050000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_5050000_LisectAVT_2403002A_135.jbxd

Similarity

API ID:
String ID: E
API String ID: 0-3568589458
Opcode ID: 0354e9e5155ba3978391a85d57a6b7a9dbb037f1bc77f4b6d31e31b75a8a4ed3
Instruction ID: 038a44fc7b4c87bd0d05694b0da3c4e0e8fdd6eb85f479f7283e0354774925ba
Opcode Fuzzy Hash: 0354e9e5155ba3978391a85d57a6b7a9dbb037f1bc77f4b6d31e31b75a8a4ed3
Instruction Fuzzy Hash: DBC04CB49023049BDB44DFA4DC1C5ED7AB3EB44312F1084199907E6391DE780585DA61

Function 05056191 Relevance: 1.3, Strings: 1, Instructions: 7COMMON

Download Yara Rule

Strings

6, xrefs: 050561A7

Memory Dump Source

Source File: 0000000D.00000002.1722826252.0000000005050000.00000040.00000800.00020000.00000000.sdmp, Offset: 05050000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_5050000_LisectAVT_2403002A_135.jbxd

Similarity

API ID:
String ID: 6
API String ID: 0-498629140
Opcode ID: 89aa222d2ee8e57bc8ff68c43b98dad28a45c2074a888a6720c1178bee5a74f7
Instruction ID: d97cc826d2e23d089accd4a43d166fa04c433f99415eccdc7b9534fc35859578
Opcode Fuzzy Hash: 89aa222d2ee8e57bc8ff68c43b98dad28a45c2074a888a6720c1178bee5a74f7
Instruction Fuzzy Hash: 26C04C74903304ABDB14DFF5D91C1AD7AB6EB44756F10842D9803E6391DE780945DA61

Function 050559D4 Relevance: 1.3, Strings: 1, Instructions: 7COMMON

Download Yara Rule

Strings

&, xrefs: 050559EA

Memory Dump Source

Source File: 0000000D.00000002.1722826252.0000000005050000.00000040.00000800.00020000.00000000.sdmp, Offset: 05050000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_5050000_LisectAVT_2403002A_135.jbxd

Similarity

API ID:
String ID: &
API String ID: 0-1010288
Opcode ID: 3bc5284f418282a970c9830e458a0f848fff2ac519586f5f038691843647d505
Instruction ID: 0637c14b47a55be09b039c34b47704da5866706a513ceeadf2945c93c19106ea
Opcode Fuzzy Hash: 3bc5284f418282a970c9830e458a0f848fff2ac519586f5f038691843647d505
Instruction Fuzzy Hash: C8C04C749023089BDB14DFF9E81C1AE7AB2EB48311F1084199813E2391DE380445DF71

Function 05055DD6 Relevance: 1.3, Strings: 1, Instructions: 7COMMON

Download Yara Rule

Strings

B, xrefs: 05055DEF

Memory Dump Source

Source File: 0000000D.00000002.1722826252.0000000005050000.00000040.00000800.00020000.00000000.sdmp, Offset: 05050000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_5050000_LisectAVT_2403002A_135.jbxd

Similarity

API ID:
String ID: B
API String ID: 0-1255198513
Opcode ID: a7f948d0877b3e7f25f4225c150f1879906eb763a3206d8980ea764ecd456d7b
Instruction ID: c8a35b17beb3008da18d94e7aa56348e0d60ed6743eeafcd6582dab987db937a
Opcode Fuzzy Hash: a7f948d0877b3e7f25f4225c150f1879906eb763a3206d8980ea764ecd456d7b
Instruction Fuzzy Hash: 81C04CB4A03304DBDB44DFA4D91C2AD7BB2EB44355F018459A90BE3391DE380A45DB61

Function 05056021 Relevance: 1.3, Strings: 1, Instructions: 7COMMON

Download Yara Rule

Strings

L, xrefs: 0505603A

Memory Dump Source

Source File: 0000000D.00000002.1722826252.0000000005050000.00000040.00000800.00020000.00000000.sdmp, Offset: 05050000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_5050000_LisectAVT_2403002A_135.jbxd

Similarity

API ID:
String ID: L
API String ID: 0-2909332022
Opcode ID: 0883d73a224afdbe7ac6701618abfeafbe34ee77548fb919eb52a3508e0ead48
Instruction ID: 31529e450aba1f32370146707acfba46ee9f375c8b8193506982dc321abd786d
Opcode Fuzzy Hash: 0883d73a224afdbe7ac6701618abfeafbe34ee77548fb919eb52a3508e0ead48
Instruction Fuzzy Hash: 6DC04CB4A03304DBEB44DFB4DD1D6AD7AB2EB44312F0484599D0BE6391DE380946DA61

Function 05055C78 Relevance: 1.3, Strings: 1, Instructions: 7COMMON

Download Yara Rule

Strings

!, xrefs: 05055C91

Memory Dump Source

Source File: 0000000D.00000002.1722826252.0000000005050000.00000040.00000800.00020000.00000000.sdmp, Offset: 05050000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_5050000_LisectAVT_2403002A_135.jbxd

Similarity

API ID:
String ID: !
API String ID: 0-2657877971
Opcode ID: ff4b6edf4adbf7e56416fd065a3241c29dfe9c002b6f5960db2d544a89cfe124
Instruction ID: 9619d2f4db48a0c7488c775c2ed19a8592d9a0c61ee71f674a981330b9a57a95
Opcode Fuzzy Hash: ff4b6edf4adbf7e56416fd065a3241c29dfe9c002b6f5960db2d544a89cfe124
Instruction Fuzzy Hash: BDC04CB4A06308DFDB04DFA4DC1C3ED7AB2EB44312F4084599847E6390DF784985DE61

Function 05055FC7 Relevance: 1.3, Strings: 1, Instructions: 7COMMON

Download Yara Rule

Strings

=, xrefs: 05055FE0

Memory Dump Source

Source File: 0000000D.00000002.1722826252.0000000005050000.00000040.00000800.00020000.00000000.sdmp, Offset: 05050000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_5050000_LisectAVT_2403002A_135.jbxd

Similarity

API ID:
String ID: =
API String ID: 0-2322244508
Opcode ID: 3f25d0b031876d86075ae748fa3f2a1e156ba5cfcb947b84ec07905d695cd167
Instruction ID: 8baa42f2f2fb11c21d79faab3d04ee8f80f09f8ed385f75fd1374b7f36359a51
Opcode Fuzzy Hash: 3f25d0b031876d86075ae748fa3f2a1e156ba5cfcb947b84ec07905d695cd167
Instruction Fuzzy Hash: 17C04CB4902314DBDB05DFA5EC1C3ADBAB6EB48352F00C45A9807E6390DE380945DF71

Function 050545EE Relevance: .2, Instructions: 161COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.1722826252.0000000005050000.00000040.00000800.00020000.00000000.sdmp, Offset: 05050000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_5050000_LisectAVT_2403002A_135.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1b9a1ef9dda6458f3fba756b172d76c9492f2cbd0455396976178e2d6e1af572
Instruction ID: 20663ccfaa84cc833fdf3975fc3484d76dbeccce3dc1a5fec812b4bfe4e757de
Opcode Fuzzy Hash: 1b9a1ef9dda6458f3fba756b172d76c9492f2cbd0455396976178e2d6e1af572
Instruction Fuzzy Hash: 97713970A04248DBDF24EFB5E8487EEBBB2AB44314F40C059D946A63A4DF744989CF66

Function 05054283 Relevance: .2, Instructions: 157COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.1722826252.0000000005050000.00000040.00000800.00020000.00000000.sdmp, Offset: 05050000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_5050000_LisectAVT_2403002A_135.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c31d12c208f108fe239c118bbd136bd9e2ad64442ceb816cf68a48b4dddc3594
Instruction ID: 61a5b95ff3a64801b6b97cf68149f49c6ff8bc01740cb17ab6c931b3e1acdccc
Opcode Fuzzy Hash: c31d12c208f108fe239c118bbd136bd9e2ad64442ceb816cf68a48b4dddc3594
Instruction Fuzzy Hash: BC613870904248DBDF24EFA5E8487EEBBB2BB44318F40C059D946A73A4DF744989CF66

Function 050545D2 Relevance: .2, Instructions: 152COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.1722826252.0000000005050000.00000040.00000800.00020000.00000000.sdmp, Offset: 05050000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_5050000_LisectAVT_2403002A_135.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6f6ea19fe9f7d285f1f17b78ac9dbf63197138bcc0a196d96012efe0c0e99395
Instruction ID: 4c6090799d204f88eb37fdfb382559fe43acbad1e1f3339c2e5031db37ab0d87
Opcode Fuzzy Hash: 6f6ea19fe9f7d285f1f17b78ac9dbf63197138bcc0a196d96012efe0c0e99395
Instruction Fuzzy Hash: 86613970908248DBDF24EFB5F8487EEBBB2AB44314F44C059D946A63A4DF744989CF26

Function 050544CD Relevance: .2, Instructions: 150COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.1722826252.0000000005050000.00000040.00000800.00020000.00000000.sdmp, Offset: 05050000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_5050000_LisectAVT_2403002A_135.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 750e52e144a0859ca7aa9b698dde7fdb6536edd79d213210a1852a01d8d10a48
Instruction ID: 59d7f0faa92b2e51a72cfa4af986de8b91fb8363d4828ee518b54efb9f1786a7
Opcode Fuzzy Hash: 750e52e144a0859ca7aa9b698dde7fdb6536edd79d213210a1852a01d8d10a48
Instruction Fuzzy Hash: FC613970904208DBDF24EFA5E8487EEBBB2AB44314F00C059D946A63A4DF744989CF26

Function 05054EC0 Relevance: .1, Instructions: 105COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.1722826252.0000000005050000.00000040.00000800.00020000.00000000.sdmp, Offset: 05050000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_5050000_LisectAVT_2403002A_135.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0e14c2ef068d65203bf2a9208addd200010707019dd9166a443e5c700d01ce83
Instruction ID: 6ecdfc7244ddd5ccdfb4acf832e1e01c344977cbaa4d088db07dbd9d9b559162
Opcode Fuzzy Hash: 0e14c2ef068d65203bf2a9208addd200010707019dd9166a443e5c700d01ce83
Instruction Fuzzy Hash: 35412B34A05304DFDB04DB68F8895DEBBF2BB89320B1584AAE806E7391DA359C45CB61

Function 05054EF0 Relevance: .1, Instructions: 96COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.1722826252.0000000005050000.00000040.00000800.00020000.00000000.sdmp, Offset: 05050000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_5050000_LisectAVT_2403002A_135.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a02be91b82d170710216889d35def2c9e9363b3d14eccece13ea4ecdb12dd248
Instruction ID: 85e90346ba4c0b6b5c204baa615e32c7dac0a95a193613291ea54912dc8610fc
Opcode Fuzzy Hash: a02be91b82d170710216889d35def2c9e9363b3d14eccece13ea4ecdb12dd248
Instruction Fuzzy Hash: EF311834A04314DFCF04DBA8F8496EEB7F2BB88321F168425E906E3390DE359C819B65

Function 05054FDE Relevance: .1, Instructions: 79COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.1722826252.0000000005050000.00000040.00000800.00020000.00000000.sdmp, Offset: 05050000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_5050000_LisectAVT_2403002A_135.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4e61d09adb503a1abfd57ff5d64d0dbcfd4a738a7c31141c7a949dbd02469e69
Instruction ID: b873fb5ed53a5dcf85e7287303f69bb3d7bd0d6bca559d8adaea5c8c03cc043a
Opcode Fuzzy Hash: 4e61d09adb503a1abfd57ff5d64d0dbcfd4a738a7c31141c7a949dbd02469e69
Instruction Fuzzy Hash: E131A935A04304DFCF44DBA8F9895EEB7F2BB98321B158565E806E3390DF359C829B64

Function 05054D20 Relevance: .1, Instructions: 66COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.1722826252.0000000005050000.00000040.00000800.00020000.00000000.sdmp, Offset: 05050000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_5050000_LisectAVT_2403002A_135.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5ea22ae238faae521512c419c207d47c3199479c35be34181024c72d94287819
Instruction ID: bac3cc0c90e6ebad170a483267f78442518aa23e1c70d225db6c571a5e87b12c
Opcode Fuzzy Hash: 5ea22ae238faae521512c419c207d47c3199479c35be34181024c72d94287819
Instruction Fuzzy Hash: FD21F63550C790CFCB559B34A81069D7FB19F4721070A81EED446DB3A2CF294C46CBB2

Function 050551C9 Relevance: .1, Instructions: 65COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.1722826252.0000000005050000.00000040.00000800.00020000.00000000.sdmp, Offset: 05050000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_5050000_LisectAVT_2403002A_135.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dfbe0afa63fe59e00f9758f5ce5507da98ed4fbeb10bb35273de26307c118569
Instruction ID: b483c0de34c6e9cd2cae687eb268983559f25bb19187fa209f3f0dee9d64acaf
Opcode Fuzzy Hash: dfbe0afa63fe59e00f9758f5ce5507da98ed4fbeb10bb35273de26307c118569
Instruction Fuzzy Hash: 4421BE31909209EFCB00EFA4E8645EDBBB2FF45304F108065EA02EB350DF365A45DBA2

Function 05055090 Relevance: .1, Instructions: 65COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.1722826252.0000000005050000.00000040.00000800.00020000.00000000.sdmp, Offset: 05050000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_5050000_LisectAVT_2403002A_135.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b806e25ec1fdfa45db32a4bb7fce1f6b1383f4f64a6e2a617b111e316336079f
Instruction ID: fbd05a122050d518d5e57285d7aecbbb2cc052f0641db5799f520d4093041231
Opcode Fuzzy Hash: b806e25ec1fdfa45db32a4bb7fce1f6b1383f4f64a6e2a617b111e316336079f
Instruction Fuzzy Hash: 31217A34909209FFCB00EFA4E8655EEBBB1FF44314F258465DA029B350DF315A45DBA2

Function 050550A0 Relevance: .1, Instructions: 61COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.1722826252.0000000005050000.00000040.00000800.00020000.00000000.sdmp, Offset: 05050000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_5050000_LisectAVT_2403002A_135.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3d4be99262653359601bb23bfe7e18e4b60d9ad1febebcb3c24dc777162a45a9
Instruction ID: cad89cfc9df416a0263cbf540c143ef624938e3edb03747c0fdcc0b4810a3ede
Opcode Fuzzy Hash: 3d4be99262653359601bb23bfe7e18e4b60d9ad1febebcb3c24dc777162a45a9
Instruction Fuzzy Hash: F3215C34905209EFCB00EFA4E9655EEB7B1BF44314F20C465DA02AB350DF755B45DBA2

Function 05054D30 Relevance: .0, Instructions: 49COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.1722826252.0000000005050000.00000040.00000800.00020000.00000000.sdmp, Offset: 05050000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_5050000_LisectAVT_2403002A_135.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2bd93d5b380f171270411c639e3029d33f8b2d42d31b3cf732203a96e38c97b4
Instruction ID: a3ff59e1747c1c7d2e8a3e76731ac8ab80c71bdc16d522036fa0f1f5ac00cced
Opcode Fuzzy Hash: 2bd93d5b380f171270411c639e3029d33f8b2d42d31b3cf732203a96e38c97b4
Instruction Fuzzy Hash: D4010835A04A10CBCB54AB65F4047EE77A2AB80315B06817CD806DB344DF344C82DBF2

Function 011C05DF Relevance: .0, Instructions: 44COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.1703784606.00000000011C0000.00000040.00000020.00020000.00000000.sdmp, Offset: 011C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_11c0000_LisectAVT_2403002A_135.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a15e51d9d76c61e161eb31dedd55f43b9c69f8a25b4a3850f4c4598ce934cb04
Instruction ID: fb4239f2c3c26731624c0bec4bc0bb57a379f3eab2155171acb578c508cb0f3b
Opcode Fuzzy Hash: a15e51d9d76c61e161eb31dedd55f43b9c69f8a25b4a3850f4c4598ce934cb04
Instruction Fuzzy Hash: 860186B65097805FD711CF169C45863FFE8DE86620709C4AFEC898B613D235B908CBB2

Function 01180018 Relevance: .0, Instructions: 41COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.1703482500.0000000001180000.00000040.00000800.00020000.00000000.sdmp, Offset: 01180000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_1180000_LisectAVT_2403002A_135.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8164bcae62a892f10f616f7e6381001b8c62fda1127682591c9388270ed221f2
Instruction ID: 41764f59e8ebd9946126d70a4582487e9be03fc97532344f69f84422b8657ea8
Opcode Fuzzy Hash: 8164bcae62a892f10f616f7e6381001b8c62fda1127682591c9388270ed221f2
Instruction Fuzzy Hash: 01F09D2048E7C19FC3A3473458266A13FB1AE4322874E45EFC480CB9B3E21C9D4ED7A2

Function 05055560 Relevance: .0, Instructions: 27COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.1722826252.0000000005050000.00000040.00000800.00020000.00000000.sdmp, Offset: 05050000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_5050000_LisectAVT_2403002A_135.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f9fbdef632dfd14edc4b565bf94fb6bd831f8e3ab108ef85bcf0da5e4079a8c1
Instruction ID: 7c36ffb90440141f714ce126ce01aff7c17eb052054c41775317e00845d2facf
Opcode Fuzzy Hash: f9fbdef632dfd14edc4b565bf94fb6bd831f8e3ab108ef85bcf0da5e4079a8c1
Instruction Fuzzy Hash: AFE0ED3154E3C82FD7039775AC619C47F78AF53218F2904CBD888CF6A7C15AA5099B62

Function 011C0606 Relevance: .0, Instructions: 27COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.1703784606.00000000011C0000.00000040.00000020.00020000.00000000.sdmp, Offset: 011C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_11c0000_LisectAVT_2403002A_135.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 940cfd319c6601154fc27dd055f4533e23b224ab8c5f13d29bb63fa6a5edc310
Instruction ID: 764b1b7a362851d73a3f4bc8cdd03e24caad9dde2037d6d35bfae3a7fb376fa1
Opcode Fuzzy Hash: 940cfd319c6601154fc27dd055f4533e23b224ab8c5f13d29bb63fa6a5edc310
Instruction Fuzzy Hash: 50E092B66046004BD650CF0BEC41852F7D8EB84630708C47FDC4D8B701E236B505CAA5

Function 0505452A Relevance: .0, Instructions: 19COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.1722826252.0000000005050000.00000040.00000800.00020000.00000000.sdmp, Offset: 05050000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_5050000_LisectAVT_2403002A_135.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9f0ba89b4b2f1e9ed08a000de5a6ea94ea3603e38629c94f536544e9df7b1160
Instruction ID: ccf97697f925fb5acede3110b80f19b16eaa41aa0ce9af666e5cf1e0044d8cb4
Opcode Fuzzy Hash: 9f0ba89b4b2f1e9ed08a000de5a6ea94ea3603e38629c94f536544e9df7b1160
Instruction Fuzzy Hash: C5E0C034A00314DFCB58EF64E8183DD7A72BBC9305F408098E54AE6794DF785981CF61

Function 0505312F Relevance: .0, Instructions: 18COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.1722826252.0000000005050000.00000040.00000800.00020000.00000000.sdmp, Offset: 05050000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_5050000_LisectAVT_2403002A_135.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 39bf86e6e4f429fc904f36749ff4899b1a3dc5b971a5554c79ccdedf56caff1b
Instruction ID: bb16b6830703b31431fd9d62746de308deb9f03bd591083dac90a0588dd77bc2
Opcode Fuzzy Hash: 39bf86e6e4f429fc904f36749ff4899b1a3dc5b971a5554c79ccdedf56caff1b
Instruction Fuzzy Hash: A3D05E36B08014EB9F04DFA8F8404EFB3B6EA883B5B080452E906F3300C7306E168A69

Function 05054B8A Relevance: .0, Instructions: 18COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.1722826252.0000000005050000.00000040.00000800.00020000.00000000.sdmp, Offset: 05050000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_5050000_LisectAVT_2403002A_135.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 64db0070a993f2ea1297ae5581ae30ccf75bd9f0591b912caf65673aa7bb51e9
Instruction ID: 22062bc4d6d8390cade81110192e17b0348f64a1ab12a37b4b8ed8fa784c52ab
Opcode Fuzzy Hash: 64db0070a993f2ea1297ae5581ae30ccf75bd9f0591b912caf65673aa7bb51e9
Instruction Fuzzy Hash: 40D0A73570830CDBCB00EB60F50449A73A8EF8050C78141D8EC0D8B351EF316E128AA1

Function 05055228 Relevance: .0, Instructions: 17COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.1722826252.0000000005050000.00000040.00000800.00020000.00000000.sdmp, Offset: 05050000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_5050000_LisectAVT_2403002A_135.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5d1c356c3de2fe76c0fdcdc415ae39c3bbb80ef1f5a48e31b865c7ef198a1d6a
Instruction ID: 062b305f50e13dd59e1557ccf11f0f9ac1064f7ff6480463e935abdddf8d5f79
Opcode Fuzzy Hash: 5d1c356c3de2fe76c0fdcdc415ae39c3bbb80ef1f5a48e31b865c7ef198a1d6a
Instruction Fuzzy Hash: 26D02230608700CFCF06BAA4F8120D077B68F0B30C70500E5EA48CB362CA21BC448A6A

Function 050557C0 Relevance: .0, Instructions: 16COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.1722826252.0000000005050000.00000040.00000800.00020000.00000000.sdmp, Offset: 05050000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_5050000_LisectAVT_2403002A_135.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a35ca4f5e21ba6fdd0d6a9d0238d9a7db00424557a1259b0f78123570e9e5d75
Instruction ID: 013450de00336627735db8571da8fa4c9485d39d49cbdfcb170b1391c2c78b2f
Opcode Fuzzy Hash: a35ca4f5e21ba6fdd0d6a9d0238d9a7db00424557a1259b0f78123570e9e5d75
Instruction Fuzzy Hash: 85E0BFB4A01645DBDB44DFE4E9445AEB7B2AB44315F508455DC07EA344DF38494A8B10

Function 00CF23F4 Relevance: .0, Instructions: 15COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.1693315224.0000000000CF2000.00000040.00000800.00020000.00000000.sdmp, Offset: 00CF2000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_cf2000_LisectAVT_2403002A_135.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9259961154db9dedfd19d2dcc1b7b8c85cbfad35f7bc4be1eccdfe9da1054944
Instruction ID: ee969ad5d5f7288bdcc5b1e22937f7479027160ca5d8080730b54374731fe2bd
Opcode Fuzzy Hash: 9259961154db9dedfd19d2dcc1b7b8c85cbfad35f7bc4be1eccdfe9da1054944
Instruction Fuzzy Hash: 26D05E79205A814FD3279A1CC1A4BA53BE4AB51714F4B44FAA8408F763C7A8DA81E611

Function 0118119F Relevance: .0, Instructions: 15COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.1703482500.0000000001180000.00000040.00000800.00020000.00000000.sdmp, Offset: 01180000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_1180000_LisectAVT_2403002A_135.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 536d818cd4217b7ad30ba4337d42f568f08ae3d51d372faaa27e04dabb5d2684
Instruction ID: ba23c2410374e1c3cf8793fc61ee5bc5303c8b92b29cc9ffe9affd753e069ef0
Opcode Fuzzy Hash: 536d818cd4217b7ad30ba4337d42f568f08ae3d51d372faaa27e04dabb5d2684
Instruction Fuzzy Hash: 05E07E7494512EDBDFA9DA08C890AEDB7B6FB49308F1091E5D02DA6250CB31AEC58F00

Function 011805C7 Relevance: .0, Instructions: 15COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.1703482500.0000000001180000.00000040.00000800.00020000.00000000.sdmp, Offset: 01180000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_1180000_LisectAVT_2403002A_135.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 057944a6b5e7a98a1c22f9bf10e850c763cdb455a56da2aacd32db74084cd4a2
Instruction ID: d42e98e5b970b579d134a2eeb1874ead30c9ab5a9451752b1f2fac900f78e562
Opcode Fuzzy Hash: 057944a6b5e7a98a1c22f9bf10e850c763cdb455a56da2aacd32db74084cd4a2
Instruction Fuzzy Hash: B4E0927494912ACBDBA8DA08C891BEDB3B5FB48304F5091E9E12CA6244CB346EC4CF01

Function 011836AC Relevance: .0, Instructions: 15COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.1703482500.0000000001180000.00000040.00000800.00020000.00000000.sdmp, Offset: 01180000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_1180000_LisectAVT_2403002A_135.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6c521e0426c80d62e599ecbfeba2de445bdea80276fbbd508d4999f4adbfd3a8
Instruction ID: 501efb474468241c1a5b9b1bd81a24e219f72da1cc8a472e10051372b7de7156
Opcode Fuzzy Hash: 6c521e0426c80d62e599ecbfeba2de445bdea80276fbbd508d4999f4adbfd3a8
Instruction Fuzzy Hash: BAE0463498021ACBDBA88B14C848BF9B3B2FB44308F0080A4E45A96280CB759A808F10

Function 00CF23BC Relevance: .0, Instructions: 14COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.1693315224.0000000000CF2000.00000040.00000800.00020000.00000000.sdmp, Offset: 00CF2000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_cf2000_LisectAVT_2403002A_135.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f2f9fbe488e73395ec03e8c03be0b2beabd3b7dec86056cf9c2aada680adf6dc
Instruction ID: c1105fa1ce51a878d4278a0c878f3747eddb71fa570279c854b92cc140e6c2ed
Opcode Fuzzy Hash: f2f9fbe488e73395ec03e8c03be0b2beabd3b7dec86056cf9c2aada680adf6dc
Instruction Fuzzy Hash: 5ED05E742006854BC725DA0CC6D4F6933E8AB40714F0644E8AD208B272C7A8D9C4DA01

Function 05054BA0 Relevance: .0, Instructions: 13COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.1722826252.0000000005050000.00000040.00000800.00020000.00000000.sdmp, Offset: 05050000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_5050000_LisectAVT_2403002A_135.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a2d3fff324597e7b15eb8b9f3874f65a8bbcb0a1ff2f30bc56f28759c0795a54
Instruction ID: 5050932a27c197762be3a4c4b2b3d346e72b9680e220a759dedff9cd04450657
Opcode Fuzzy Hash: a2d3fff324597e7b15eb8b9f3874f65a8bbcb0a1ff2f30bc56f28759c0795a54
Instruction Fuzzy Hash: 83D012324087888FC3829BB0E8448813F78EF0720838A48C6D009CF662DB2A6915EB21

Function 05054E70 Relevance: .0, Instructions: 13COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.1722826252.0000000005050000.00000040.00000800.00020000.00000000.sdmp, Offset: 05050000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_5050000_LisectAVT_2403002A_135.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c9eab6e7758d6dff1e5f0d4721f2b9b8d8319775170049763fcead35c6c6960b
Instruction ID: 45c1e07da8cd65309822c4b20bfe52236c6b7ae3dbacf89288ca27d2e73e1bc6
Opcode Fuzzy Hash: c9eab6e7758d6dff1e5f0d4721f2b9b8d8319775170049763fcead35c6c6960b
Instruction Fuzzy Hash: D1D0A73008D7818FCB72577084012D43BB09F42355B5900FFD04549D67D16E0816DB57

Function 05056460 Relevance: .0, Instructions: 12COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.1722826252.0000000005050000.00000040.00000800.00020000.00000000.sdmp, Offset: 05050000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_5050000_LisectAVT_2403002A_135.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a2a6ac3b11efae6b6245c2802b0ce4903b8e234451e7b5f484109abd02835828
Instruction ID: 56b7fb6ad2be66079bf2d42a1ad1d803b6f797c625a351da2b04f812bec60331
Opcode Fuzzy Hash: a2a6ac3b11efae6b6245c2802b0ce4903b8e234451e7b5f484109abd02835828
Instruction Fuzzy Hash: DEC08C2604D3880FC30307A8B8001807B385F0310834A00C3E148CF6A2D60A6E42C725

Function 0118AC40 Relevance: .0, Instructions: 12COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.1703482500.0000000001180000.00000040.00000800.00020000.00000000.sdmp, Offset: 01180000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_1180000_LisectAVT_2403002A_135.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c71727f85b49c64eee993375fa15f4b00bc431ce1f56e4cab4a033b85e648029
Instruction ID: 7c877345690776d4262488e35ad57a8023583571be207a18ab1daac6faf084f4
Opcode Fuzzy Hash: c71727f85b49c64eee993375fa15f4b00bc431ce1f56e4cab4a033b85e648029
Instruction Fuzzy Hash: 47C08C2130022833C618228874082EE364EC786761F000026F60993340CD454E4217F6

Function 01183355 Relevance: .0, Instructions: 12COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.1703482500.0000000001180000.00000040.00000800.00020000.00000000.sdmp, Offset: 01180000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_1180000_LisectAVT_2403002A_135.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1445836472a7e3906cfd2743d30474364cf7a786f3be61914a93db6818b82ad2
Instruction ID: 3b88c19ef26e786e6ec932ee55200e71ffe287bf74348464246f8ed32ef6599d
Opcode Fuzzy Hash: 1445836472a7e3906cfd2743d30474364cf7a786f3be61914a93db6818b82ad2
Instruction Fuzzy Hash: A9D01730900218CBDB2EDB11CE947E8B6B6AF98704F85C0D9800A6A640CB309B858F00

Function 05055500 Relevance: .0, Instructions: 11COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.1722826252.0000000005050000.00000040.00000800.00020000.00000000.sdmp, Offset: 05050000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_5050000_LisectAVT_2403002A_135.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3c9c2b673f40d245f3ac15651cd7e83134f4461e277309b5f81d7d24a81c7e08
Instruction ID: 9c70205cae4ef78ab4b50d9de8889356e1daa87017e82434b7dbcda1aa8ae521
Opcode Fuzzy Hash: 3c9c2b673f40d245f3ac15651cd7e83134f4461e277309b5f81d7d24a81c7e08
Instruction Fuzzy Hash: 2EC080300083C94FC393476454501407F7C5E5331474500C6D00C8FDA7C2585860CFE7

Function 05055070 Relevance: .0, Instructions: 11COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.1722826252.0000000005050000.00000040.00000800.00020000.00000000.sdmp, Offset: 05050000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_5050000_LisectAVT_2403002A_135.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bb99168c28d1e6ef470f3dacd53892507119f338d14737655c789b33e632085a
Instruction ID: 7d094a697fabb6dd09c58c8acbf781388f6e9692234ec461adb83329222cab26
Opcode Fuzzy Hash: bb99168c28d1e6ef470f3dacd53892507119f338d14737655c789b33e632085a
Instruction Fuzzy Hash: 74C08C7508A384FFC7832F60A4240803F70EE0322030A40E6D045C9133CA7A8C56CF31

Function 050554A0 Relevance: .0, Instructions: 11COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.1722826252.0000000005050000.00000040.00000800.00020000.00000000.sdmp, Offset: 05050000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_5050000_LisectAVT_2403002A_135.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 67ad8cf7fd074e7264bf72d228a8767a1288c97913e5443b5991cab4107c77bd
Instruction ID: 4013d33b58ba199f4ba223e64acbd8d23b1cd3b9a1bbbc2359afb8678f6b27d0
Opcode Fuzzy Hash: 67ad8cf7fd074e7264bf72d228a8767a1288c97913e5443b5991cab4107c77bd
Instruction Fuzzy Hash: 4FC08035009380EFD703971554701943F70ED1331431955C6C044CD971C136A466D731

Function 01187112 Relevance: .0, Instructions: 10COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.1703482500.0000000001180000.00000040.00000800.00020000.00000000.sdmp, Offset: 01180000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_1180000_LisectAVT_2403002A_135.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b11c1dfd798e3f3c7eccecdb52af3c76bdba2f5c2ab9c3bd736c22e09d9335dd
Instruction ID: 2e34c04b9cc02b7c4e20a843810fe7fb1d8ccc5d31a7c44470deaf9abe5c2eee
Opcode Fuzzy Hash: b11c1dfd798e3f3c7eccecdb52af3c76bdba2f5c2ab9c3bd736c22e09d9335dd
Instruction Fuzzy Hash: 1ED0C970A04214AFDF589B74D9587ED77F5EB48304F0081A9A40AE2780DF344E828F72

Function 01186F08 Relevance: .0, Instructions: 10COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.1703482500.0000000001180000.00000040.00000800.00020000.00000000.sdmp, Offset: 01180000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_1180000_LisectAVT_2403002A_135.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ecc1bc423595acf9b245a582849d38bf464b5dd24f22ef805e46e934011ffe08
Instruction ID: ff2ee40293052bc8135cb966393c9b34226740997d5e7deb4216979953f02fe1
Opcode Fuzzy Hash: ecc1bc423595acf9b245a582849d38bf464b5dd24f22ef805e46e934011ffe08
Instruction Fuzzy Hash: 61D06C34A042149FCB58DF74D8586EDBBB2BF48305F118069944AE37A0DF308A428F11

Function 05054E98 Relevance: .0, Instructions: 9COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.1722826252.0000000005050000.00000040.00000800.00020000.00000000.sdmp, Offset: 05050000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_5050000_LisectAVT_2403002A_135.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 396d709265dffc9e9775392e73aa1323284f87d9c72a903288f073b0965b35a3
Instruction ID: 30630106ebf0414a63099146b5a568befab279f07a9454204729267b82a82760
Opcode Fuzzy Hash: 396d709265dffc9e9775392e73aa1323284f87d9c72a903288f073b0965b35a3
Instruction Fuzzy Hash: 07C09B7154F785DFC711AB24A45C0DD3F74EF5721134541D7F449C51A1DE3604238B55

Function 0118E1A8 Relevance: .0, Instructions: 9COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.1703482500.0000000001180000.00000040.00000800.00020000.00000000.sdmp, Offset: 01180000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_1180000_LisectAVT_2403002A_135.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9137bcc71f21fb1f3a7ef490b73efc7a07aad03d68ac8279536b5f2e8f3ae58c
Instruction ID: cadf2649834809407f8192dbd55835537a19edf862d898f800319e0c905a016d
Opcode Fuzzy Hash: 9137bcc71f21fb1f3a7ef490b73efc7a07aad03d68ac8279536b5f2e8f3ae58c
Instruction Fuzzy Hash: A2C08C3000A7C87FE70233A479083E1BF9C1701308F4CC080E488C5B63CEBA92528679

Function 0118326C Relevance: .0, Instructions: 8COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.1703482500.0000000001180000.00000040.00000800.00020000.00000000.sdmp, Offset: 01180000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_1180000_LisectAVT_2403002A_135.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a2ee6dd940ae2087c2a6523da4d8af5961dbc6a430ab73b14f07e82922f57582
Instruction ID: d5526762e59b777ad270e0fb5d4d80224b9fe38462189bf5423aa2fe3913ee55
Opcode Fuzzy Hash: a2ee6dd940ae2087c2a6523da4d8af5961dbc6a430ab73b14f07e82922f57582
Instruction Fuzzy Hash: 91D0127858921ACACBA8AF18E8A06FCB276FB02308F11C0F4D06956194CF316EC18F01

Function 0118A4D8 Relevance: .0, Instructions: 6COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.1703482500.0000000001180000.00000040.00000800.00020000.00000000.sdmp, Offset: 01180000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_1180000_LisectAVT_2403002A_135.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: de50c9c378f1a5c679d036fe7191feb49928f7065d25c2d128a4e5c63e005c03
Instruction ID: 1796fc9fcdd389eb192b06c1afcf1abe7140f1ce586adcc11a7fcb2f7ff64f47
Opcode Fuzzy Hash: de50c9c378f1a5c679d036fe7191feb49928f7065d25c2d128a4e5c63e005c03
Instruction Fuzzy Hash: ECA01130088A08CB0E0033A83808088320CAE8000CB888002A00E82A028E08200008A2

Function 0118A228 Relevance: .0, Instructions: 6COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.1703482500.0000000001180000.00000040.00000800.00020000.00000000.sdmp, Offset: 01180000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_1180000_LisectAVT_2403002A_135.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c2b739e6143de4b2e80f1910f2a15913308529585e9a6837397fe98f9abcd8c9
Instruction ID: ce9f0d320568e7aeddd1da0d443e20918fc001d358bb9c195afdc7c1ad0b123c
Opcode Fuzzy Hash: c2b739e6143de4b2e80f1910f2a15913308529585e9a6837397fe98f9abcd8c9
Instruction Fuzzy Hash: 32A011300002088BC200ABA8E008EA033ECAB08A08F0000F0A20C8BA228A22B8008A82

Function 0118E538 Relevance: .0, Instructions: 5COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.1703482500.0000000001180000.00000040.00000800.00020000.00000000.sdmp, Offset: 01180000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_1180000_LisectAVT_2403002A_135.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 286cf3e526276399ff1f54a6c1fbd1920d21fbc208116245a198920b181be9e6
Instruction ID: 0994d78477715717ae18aa8c91d772c07df529355c0ba609b8ef62f70970b73d
Opcode Fuzzy Hash: 286cf3e526276399ff1f54a6c1fbd1920d21fbc208116245a198920b181be9e6
Instruction Fuzzy Hash: 319022F200030C8B020023803808280330CE0000003800000A00C802008E00200080A0

Function 011865C0 Relevance: .0, Instructions: 5COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.1703482500.0000000001180000.00000040.00000800.00020000.00000000.sdmp, Offset: 01180000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_1180000_LisectAVT_2403002A_135.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5a34b4899ca96c12c03d55d19fd29212da86151404d951fc636bff961c2a2d57
Instruction ID: f9eb965120e26c88f8edef5e3fedda5093d5a6f00927b0c16f4024c60f05cc3f
Opcode Fuzzy Hash: 5a34b4899ca96c12c03d55d19fd29212da86151404d951fc636bff961c2a2d57
Instruction Fuzzy Hash: 23C09B74545315A7D75CEB64C78C5A57F75AB40304F0480B5848549514C7744642DF15

Function 0118E0A0 Relevance: .0, Instructions: 5COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.1703482500.0000000001180000.00000040.00000800.00020000.00000000.sdmp, Offset: 01180000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_1180000_LisectAVT_2403002A_135.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 333f76aedf6ea115affdefaac179aded0eb29e89b80c0a1fa1c5ab12c431f2cc
Instruction ID: 306eb0a5566970e03c8beb8d4d1a832238e0ecc15ab42ce5184d1029854ca034
Opcode Fuzzy Hash: 333f76aedf6ea115affdefaac179aded0eb29e89b80c0a1fa1c5ab12c431f2cc
Instruction Fuzzy Hash: 8490223000030C8B00002388380A080B30C80000003800000A00C80302CE20200000A0

Function 0118A0E0 Relevance: .0, Instructions: 5COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.1703482500.0000000001180000.00000040.00000800.00020000.00000000.sdmp, Offset: 01180000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_1180000_LisectAVT_2403002A_135.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 664b726344c30736663d165a78cc302909c629446c2d40603c6f66e21f3c18b2
Instruction ID: 96b223807c3d53cc4e5904f79492d6240b70ff07a5af7b735c029b751b99e241
Opcode Fuzzy Hash: 664b726344c30736663d165a78cc302909c629446c2d40603c6f66e21f3c18b2
Instruction Fuzzy Hash:

Function 0118E320 Relevance: .0, Instructions: 5COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.1703482500.0000000001180000.00000040.00000800.00020000.00000000.sdmp, Offset: 01180000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_1180000_LisectAVT_2403002A_135.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cffd44a7cec2fe9d04eebe8086c2ca7bd68e2efe3fcf4d35170d004c404d652c
Instruction ID: cbd856f046f87e9e59fc097e20217d63b2a422236e6d92fb0e3094c9d6eb908c
Opcode Fuzzy Hash: cffd44a7cec2fe9d04eebe8086c2ca7bd68e2efe3fcf4d35170d004c404d652c
Instruction Fuzzy Hash: 5090023504570CBB454067D5780A5D57F5C95455267804051E50D817119E55655145A5

Function 0118A350 Relevance: .0, Instructions: 5COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.1703482500.0000000001180000.00000040.00000800.00020000.00000000.sdmp, Offset: 01180000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_1180000_LisectAVT_2403002A_135.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9ec1946cbaead13ab3182cb18a4414c4b2739bef1682f2804b45296d0d65970c
Instruction ID: b92b9b45eabd30c34984c4522f5d0683330f3cd935538dcb754d25913d557ff7
Opcode Fuzzy Hash: 9ec1946cbaead13ab3182cb18a4414c4b2739bef1682f2804b45296d0d65970c
Instruction Fuzzy Hash:

Function 01189E50 Relevance: .0, Instructions: 5COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.1703482500.0000000001180000.00000040.00000800.00020000.00000000.sdmp, Offset: 01180000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_1180000_LisectAVT_2403002A_135.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 71f50a4f291cdc1f87b19230f107a901bc463244bd8a310965541665439f4f10
Instruction ID: 6e1537b8c9726219141c9a5280b67a5dbed4f5c8ecd28ffd318faea9db88b680
Opcode Fuzzy Hash: 71f50a4f291cdc1f87b19230f107a901bc463244bd8a310965541665439f4f10
Instruction Fuzzy Hash:

Analysis Process: Client.exePID: 3996, Parent PID: 3968COMMON

Execution Graph

Execution Coverage:	6.4%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	0%
Total number of Nodes:	64
Total number of Limit Nodes:	5

Executed Functions

Function 00F8B4CB Relevance: 1.6, APIs: 1, Instructions: 75
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

AdjustTokenPrivileges.KERNELBASE(?,?,?,?,?,?), ref: 00F8B54B

Memory Dump Source

Source File: 00000011.00000002.1795352481.0000000000F8A000.00000040.00000800.00020000.00000000.sdmp, Offset: 00F8A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_f8a000_Client.jbxd

Similarity

API ID: AdjustPrivilegesToken
String ID:
API String ID: 2874748243-0
Opcode ID: 432bbaa9749d25a9d2122ea9ea58c236c602be7688b2cc41f0721ea38922c709
Instruction ID: 1f249d84e86af3061af19c9fdaeeffe221f2ff4a4d197c541adedbb8b869defb
Opcode Fuzzy Hash: 432bbaa9749d25a9d2122ea9ea58c236c602be7688b2cc41f0721ea38922c709
Instruction Fuzzy Hash: 87219C75509780AFDB228F25DC44B92BFF4EF06320F0884DAE9858F563D371A908DB62

Function 00F8A7AD Relevance: 1.6, APIs: 1, Instructions: 62nativeCOMMON

Download Yara Rule

APIs

NtQuerySystemInformation.NTDLL ref: 00F8A821

Memory Dump Source

Source File: 00000011.00000002.1795352481.0000000000F8A000.00000040.00000800.00020000.00000000.sdmp, Offset: 00F8A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_f8a000_Client.jbxd

Similarity

API ID: InformationQuerySystem
String ID:
API String ID: 3562636166-0
Opcode ID: 515e48c0d8e2614a63f909dbe75f7418186023642ceff83b0967d875c4eae402
Instruction ID: 15703b158ddc512eacd9cff9ad2888151aca23aa22a13f98bf4b8f4af4574662
Opcode Fuzzy Hash: 515e48c0d8e2614a63f909dbe75f7418186023642ceff83b0967d875c4eae402
Instruction Fuzzy Hash: 5A219D7540D3C09FDB228F21DC44A92FFB4EF07224F0984DFE9844B163D265A919DB62

Function 00F8B502 Relevance: 1.6, APIs: 1, Instructions: 52COMMON

Download Yara Rule

APIs

AdjustTokenPrivileges.KERNELBASE(?,?,?,?,?,?), ref: 00F8B54B

Memory Dump Source

Source File: 00000011.00000002.1795352481.0000000000F8A000.00000040.00000800.00020000.00000000.sdmp, Offset: 00F8A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_f8a000_Client.jbxd

Similarity

API ID: AdjustPrivilegesToken
String ID:
API String ID: 2874748243-0
Opcode ID: 15b5bd7417e910cdc89e95327286266ae9069518fd0bd36a11ab39b87cb77fce
Instruction ID: 398b9d8c8c6f4c750ba400b105048f486353cca6d3a51c48e5354b7949fefa9d
Opcode Fuzzy Hash: 15b5bd7417e910cdc89e95327286266ae9069518fd0bd36a11ab39b87cb77fce
Instruction Fuzzy Hash: D8119E755046409FDB20CF15D884BA6FBE4EF04320F08C4AEDD458B655D335E414EF61

Function 00F8A7E6 Relevance: 1.5, APIs: 1, Instructions: 38nativeCOMMON

Download Yara Rule

APIs

NtQuerySystemInformation.NTDLL ref: 00F8A821

Memory Dump Source

Source File: 00000011.00000002.1795352481.0000000000F8A000.00000040.00000800.00020000.00000000.sdmp, Offset: 00F8A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_f8a000_Client.jbxd

Similarity

API ID: InformationQuerySystem
String ID:
API String ID: 3562636166-0
Opcode ID: 12d48ddf7eda6ba95ab29502aef4c4199a7bc01c9e0dde9d1fc90a2c9ff9d0c2
Instruction ID: 38eb0c784bcf277aa86a734c7fa1227be54d492d0067c7929a341ea36c84507d
Opcode Fuzzy Hash: 12d48ddf7eda6ba95ab29502aef4c4199a7bc01c9e0dde9d1fc90a2c9ff9d0c2
Instruction Fuzzy Hash: DC018B318046409FEB209F05D984B62FBE4EF08320F08C49ADE890A252D375A419EFB2

Function 00F8A9CF Relevance: 1.6, APIs: 1, Instructions: 98
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateFileW.KERNELBASE(?,?,?,?,?,?), ref: 00F8AA85

Memory Dump Source

Source File: 00000011.00000002.1795352481.0000000000F8A000.00000040.00000800.00020000.00000000.sdmp, Offset: 00F8A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_f8a000_Client.jbxd

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: 3bcf26d8f7423dcb1532ec53050eda37439c3abf78037aa87de8c152aaa8e51c
Instruction ID: 523c44ecb6321a1c73640e709588bf299435b0269282823940d3aa7dc179a8c6
Opcode Fuzzy Hash: 3bcf26d8f7423dcb1532ec53050eda37439c3abf78037aa87de8c152aaa8e51c
Instruction Fuzzy Hash: BA3181B1405340AFE722CF25DD44B62BFF8EF06324F08849AE9858B552D375E909DB71

Function 00F8B722 Relevance: 1.6, APIs: 1, Instructions: 89
synchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateMutexW.KERNELBASE(?,?), ref: 00F8B7C9

Memory Dump Source

Source File: 00000011.00000002.1795352481.0000000000F8A000.00000040.00000800.00020000.00000000.sdmp, Offset: 00F8A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_f8a000_Client.jbxd

Similarity

API ID: CreateMutex
String ID:
API String ID: 1964310414-0
Opcode ID: b62d2d7904c45b756addfde9cc72a143adc26adea6d1bcc1729a3e68375b129f
Instruction ID: 134671e1742fedeb70464682c02536bef3ea21e7035a5817f4c99fcb52710ca7
Opcode Fuzzy Hash: b62d2d7904c45b756addfde9cc72a143adc26adea6d1bcc1729a3e68375b129f
Instruction Fuzzy Hash: 9E318F755093806FE711CB25DC45BA6BFF8EF06324F09849AE984CB292D375E909CB61

Function 00F8A120 Relevance: 1.6, APIs: 1, Instructions: 84
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

FindNextFileW.KERNELBASE(?,00000E24,?,?), ref: 00F8A1C2

Memory Dump Source

Source File: 00000011.00000002.1795352481.0000000000F8A000.00000040.00000800.00020000.00000000.sdmp, Offset: 00F8A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_f8a000_Client.jbxd

Similarity

API ID: FileFindNext
String ID:
API String ID: 2029273394-0
Opcode ID: 4dc2da0b879bc642a03e63caab2243ee0649106c48db0068c2a743a9d54aaf4d
Instruction ID: 53430335133f11001eb280488a9ad79b5b1f4f427115d7bb6170c2b87adcf249
Opcode Fuzzy Hash: 4dc2da0b879bc642a03e63caab2243ee0649106c48db0068c2a743a9d54aaf4d
Instruction Fuzzy Hash: 6A21917150D3C06FD3128B258C51BA6BFB4EF47610F0A85CBD884CF593D225A91AD7A2

Function 00F8AADC Relevance: 1.6, APIs: 1, Instructions: 80
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetFileType.KERNELBASE(?,00000E24,34B04EC5,00000000,00000000,00000000,00000000), ref: 00F8AB71

Memory Dump Source

Source File: 00000011.00000002.1795352481.0000000000F8A000.00000040.00000800.00020000.00000000.sdmp, Offset: 00F8A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_f8a000_Client.jbxd

Similarity

API ID: FileType
String ID:
API String ID: 3081899298-0
Opcode ID: 61f953e06ea8811ce7af67724ef115b8df9222cb1dcba87fb3b4e69b94b4e017
Instruction ID: 04f2fd16ca1b2f7cdb812985839e064b3c46fb36319048c3a8e83d10ee5df3aa
Opcode Fuzzy Hash: 61f953e06ea8811ce7af67724ef115b8df9222cb1dcba87fb3b4e69b94b4e017
Instruction Fuzzy Hash: 392107B54097806FE7138B21DC45BA2BFBCEF47724F09C1DAE9808B193D264A909CB71

Function 00F8B0ED Relevance: 1.6, APIs: 1, Instructions: 79
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegQueryValueExW.KERNELBASE(?,00000E24,34B04EC5,00000000,00000000,00000000,00000000), ref: 00F8B18C

Memory Dump Source

Source File: 00000011.00000002.1795352481.0000000000F8A000.00000040.00000800.00020000.00000000.sdmp, Offset: 00F8A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_f8a000_Client.jbxd

Similarity

API ID: QueryValue
String ID:
API String ID: 3660427363-0
Opcode ID: e15eee5eff960dddce61d70d65a8538a339e7b3ebce55c159593139879d09c82
Instruction ID: 7b8258486887f015be8b0a8a97e5605c2f319ed1e7f2534c676fa67101083d85
Opcode Fuzzy Hash: e15eee5eff960dddce61d70d65a8538a339e7b3ebce55c159593139879d09c82
Instruction Fuzzy Hash: 3F217F75508744AFE721CF11DC88FA7BBECEF05720F08849AE9858B652D364E908CB61

Function 00F8B1E2 Relevance: 1.6, APIs: 1, Instructions: 77
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegSetValueExW.KERNELBASE(?,00000E24,34B04EC5,00000000,00000000,00000000,00000000), ref: 00F8B278

Memory Dump Source

Source File: 00000011.00000002.1795352481.0000000000F8A000.00000040.00000800.00020000.00000000.sdmp, Offset: 00F8A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_f8a000_Client.jbxd

Similarity

API ID: Value
String ID:
API String ID: 3702945584-0
Opcode ID: 237680801853d046026128e7cac6044a69ed5f79dfc2a72c0e5cb83b160349fb
Instruction ID: 830ed5233ed851fa1c795fcd8685475088efa545cf975f2afdefe94a471c4254
Opcode Fuzzy Hash: 237680801853d046026128e7cac6044a69ed5f79dfc2a72c0e5cb83b160349fb
Instruction Fuzzy Hash: E521AFB25083806FD7228F11DC45FA7BFBCEF46320F08849AE9858B652D364E809CB71

Function 00F8AA06 Relevance: 1.6, APIs: 1, Instructions: 76
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateFileW.KERNELBASE(?,?,?,?,?,?), ref: 00F8AA85

Memory Dump Source

Source File: 00000011.00000002.1795352481.0000000000F8A000.00000040.00000800.00020000.00000000.sdmp, Offset: 00F8A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_f8a000_Client.jbxd

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: 2cac7acb18ef10c7a5463b9a9898026bfce8d0a703e44eb35f0c85a9480c8522
Instruction ID: 176f24b98857d3c5f8b9a30e0c13c61b9fc28259516e072166cc5b0ddb792780
Opcode Fuzzy Hash: 2cac7acb18ef10c7a5463b9a9898026bfce8d0a703e44eb35f0c85a9480c8522
Instruction Fuzzy Hash: C621B271504204AFE720DF25DD45B66FBE8EF04320F08885EEA858BA51E375E804DB72

Function 00F8B756 Relevance: 1.6, APIs: 1, Instructions: 72
synchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateMutexW.KERNELBASE(?,?), ref: 00F8B7C9

Memory Dump Source

Source File: 00000011.00000002.1795352481.0000000000F8A000.00000040.00000800.00020000.00000000.sdmp, Offset: 00F8A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_f8a000_Client.jbxd

Similarity

API ID: CreateMutex
String ID:
API String ID: 1964310414-0
Opcode ID: 115eaf7c89996729ac455ad80b2cc4e0571e8ffd7ee5b1b5ab3abeaa8f161291
Instruction ID: 8d2e2ce0ba2c07c00b0cd2915430ab86d56967dacd87a82992f86b57bb60ed80
Opcode Fuzzy Hash: 115eaf7c89996729ac455ad80b2cc4e0571e8ffd7ee5b1b5ab3abeaa8f161291
Instruction Fuzzy Hash: B621BE71504200AFE720DF25DC45BAAFBE8EF44724F08C86AE9848B241D375E805DB65

Function 00F8AF56 Relevance: 1.6, APIs: 1, Instructions: 72
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetLogicalDrives.KERNELBASE ref: 00F8AFDD

Memory Dump Source

Source File: 00000011.00000002.1795352481.0000000000F8A000.00000040.00000800.00020000.00000000.sdmp, Offset: 00F8A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_f8a000_Client.jbxd

Similarity

API ID: DrivesLogical
String ID:
API String ID: 999431828-0
Opcode ID: 9f6aacfb7bf8dbb571e734d59deb09481dfe7fd2dd54e2cf45f97c8193e1de52
Instruction ID: 687e2b4ffc39727a0a281ac41e9207dab5c8aa764082dd12d3bd7f2fc9d2771a
Opcode Fuzzy Hash: 9f6aacfb7bf8dbb571e734d59deb09481dfe7fd2dd54e2cf45f97c8193e1de52
Instruction Fuzzy Hash: E7216A7140E3C09FD7138B209C65692BFB4EF03220F0A84DBD985CF1A3C2696809DB72

Function 00F8AC8E Relevance: 1.6, APIs: 1, Instructions: 70
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

ReadFile.KERNELBASE(?,00000E24,34B04EC5,00000000,00000000,00000000,00000000), ref: 00F8AD0D

Memory Dump Source

Source File: 00000011.00000002.1795352481.0000000000F8A000.00000040.00000800.00020000.00000000.sdmp, Offset: 00F8A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_f8a000_Client.jbxd

Similarity

API ID: FileRead
String ID:
API String ID: 2738559852-0
Opcode ID: 219169159e6691816f9365ecab491156bc2cebf75e9a4feab7f64748d1f71098
Instruction ID: 7779155bb1e626ce1eac6fed07112e05420ee69e80c16c1d44c7237fa94d9deb
Opcode Fuzzy Hash: 219169159e6691816f9365ecab491156bc2cebf75e9a4feab7f64748d1f71098
Instruction Fuzzy Hash: 7F218072409340AFD722CF51DC44FA7BFB8EF45220F08849AE9859B552D275A508CBA6

Function 00F8B112 Relevance: 1.6, APIs: 1, Instructions: 69
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegQueryValueExW.KERNELBASE(?,00000E24,34B04EC5,00000000,00000000,00000000,00000000), ref: 00F8B18C

Memory Dump Source

Source File: 00000011.00000002.1795352481.0000000000F8A000.00000040.00000800.00020000.00000000.sdmp, Offset: 00F8A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_f8a000_Client.jbxd

Similarity

API ID: QueryValue
String ID:
API String ID: 3660427363-0
Opcode ID: 67e49bbf7ed6dfe31078d8b029310768c4bf50c35270e53612001f214da74867
Instruction ID: 7b59f3922df5ccbe1d7884192af3c3fbb826f88f20771a9a497842a18e9ce3f0
Opcode Fuzzy Hash: 67e49bbf7ed6dfe31078d8b029310768c4bf50c35270e53612001f214da74867
Instruction Fuzzy Hash: 30218C75604A04AFE720DE15CC88FA7B7ECEF04724F08C45AEA458B651D374E908DBB1

Function 00F8B598 Relevance: 1.6, APIs: 1, Instructions: 68
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

FindCloseChangeNotification.KERNELBASE(?), ref: 00F8B604

Memory Dump Source

Source File: 00000011.00000002.1795352481.0000000000F8A000.00000040.00000800.00020000.00000000.sdmp, Offset: 00F8A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_f8a000_Client.jbxd

Similarity

API ID: ChangeCloseFindNotification
String ID:
API String ID: 2591292051-0
Opcode ID: 569ce5801466f4570fd9bcf98c452366af31238b2871652c3dd9cfe7e502dd41
Instruction ID: 6cbdff42ee6432da5de4b29b0b8dc142a5ecb720d62fe4c6e3b568c9b3789fb2
Opcode Fuzzy Hash: 569ce5801466f4570fd9bcf98c452366af31238b2871652c3dd9cfe7e502dd41
Instruction Fuzzy Hash: 1D21C07250D3C05FDB12CF25DC94792BFB4AF07324F0984DAE8858F2A3D265A908DB62

Function 00F8B024 Relevance: 1.6, APIs: 1, Instructions: 66
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CopyFileW.KERNELBASE(?,?,?), ref: 00F8B092

Memory Dump Source

Source File: 00000011.00000002.1795352481.0000000000F8A000.00000040.00000800.00020000.00000000.sdmp, Offset: 00F8A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_f8a000_Client.jbxd

Similarity

API ID: CopyFile
String ID:
API String ID: 1304948518-0
Opcode ID: 7f95140a86904fb734309ec442d88a38c9b1efd26ee0727e974734ba22febc03
Instruction ID: 972b9c3fca19aeb38d81803846aea1f6da87b0528bf6373c537383515e20901f
Opcode Fuzzy Hash: 7f95140a86904fb734309ec442d88a38c9b1efd26ee0727e974734ba22febc03
Instruction Fuzzy Hash: 4A2160719093809FD721CF65DC95B97BFE8EF06220F0884EAE985CB252D365E848DB61

Function 00F8B206 Relevance: 1.6, APIs: 1, Instructions: 65
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegSetValueExW.KERNELBASE(?,00000E24,34B04EC5,00000000,00000000,00000000,00000000), ref: 00F8B278

Memory Dump Source

Source File: 00000011.00000002.1795352481.0000000000F8A000.00000040.00000800.00020000.00000000.sdmp, Offset: 00F8A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_f8a000_Client.jbxd

Similarity

API ID: Value
String ID:
API String ID: 3702945584-0
Opcode ID: 4806cfc582a81f4670374346b0110e7022c820c838184c8e9520efbad3868185
Instruction ID: 96aa24c5f6703288391a7b3b3188ec7ef4a83e4521299ad7d4197981d82386f8
Opcode Fuzzy Hash: 4806cfc582a81f4670374346b0110e7022c820c838184c8e9520efbad3868185
Instruction Fuzzy Hash: 7B11BE72604600AFEB219F11CC45FABBBECEF14724F04C45AEE858A651D374E8049BB5

Function 00F8B362 Relevance: 1.6, APIs: 1, Instructions: 64COMMON

Download Yara Rule

APIs

LookupPrivilegeValueW.ADVAPI32(?,?,?), ref: 00F8B3CA

Memory Dump Source

Source File: 00000011.00000002.1795352481.0000000000F8A000.00000040.00000800.00020000.00000000.sdmp, Offset: 00F8A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_f8a000_Client.jbxd

Similarity

API ID: LookupPrivilegeValue
String ID:
API String ID: 3899507212-0
Opcode ID: 724f5595580da1f8dbd24752894f42441760ced41614a163736e7d60c83ff383
Instruction ID: 5b43a31effa9a613c16f6ae43cbbaac6b4ea8e6c6ad186d6226668abdc56b31f
Opcode Fuzzy Hash: 724f5595580da1f8dbd24752894f42441760ced41614a163736e7d60c83ff383
Instruction Fuzzy Hash: 291151715053409FDB21CF15DC45B53BFE8EF45620F0884AAED45CB252D365E805DB61

Function 00F8A5D5 Relevance: 1.6, APIs: 1, Instructions: 61COMMON

Download Yara Rule

APIs

FindCloseChangeNotification.KERNELBASE(?), ref: 00F8A638

Memory Dump Source

Source File: 00000011.00000002.1795352481.0000000000F8A000.00000040.00000800.00020000.00000000.sdmp, Offset: 00F8A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_f8a000_Client.jbxd

Similarity

API ID: ChangeCloseFindNotification
String ID:
API String ID: 2591292051-0
Opcode ID: 04dc7ca8099d7ca71794115c12a75ee7d88a61a5722532c6219c7803a6771ea4
Instruction ID: 737938b709ee79bddce5cf0f86a6849c9a3beed961b4da5b48ef53670eddc1a4
Opcode Fuzzy Hash: 04dc7ca8099d7ca71794115c12a75ee7d88a61a5722532c6219c7803a6771ea4
Instruction Fuzzy Hash: C3117C754093C09FD7128F25DC55792BFB4EF06220F0984EBED858F263D269A948DB62

Function 00F8ACAE Relevance: 1.6, APIs: 1, Instructions: 60fileCOMMON

Download Yara Rule

APIs

ReadFile.KERNELBASE(?,00000E24,34B04EC5,00000000,00000000,00000000,00000000), ref: 00F8AD0D

Memory Dump Source

Source File: 00000011.00000002.1795352481.0000000000F8A000.00000040.00000800.00020000.00000000.sdmp, Offset: 00F8A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_f8a000_Client.jbxd

Similarity

API ID: FileRead
String ID:
API String ID: 2738559852-0
Opcode ID: 9a2f0ad29ac4f0e4154b09fb4e979eb491b8dc4146cbf9105d5404369f37eda2
Instruction ID: 25ff1a8a46499fdf6dc15123b2767cc3bd484ba607e8334190be91a4a4fcafdc
Opcode Fuzzy Hash: 9a2f0ad29ac4f0e4154b09fb4e979eb491b8dc4146cbf9105d5404369f37eda2
Instruction Fuzzy Hash: F7110E72404600AFEB21CF51DC44FAAFBE8EF54324F04C89BEA858B651D375A404DBB6

Function 00F8B04A Relevance: 1.6, APIs: 1, Instructions: 53fileCOMMON

Download Yara Rule

APIs

CopyFileW.KERNELBASE(?,?,?), ref: 00F8B092

Memory Dump Source

Source File: 00000011.00000002.1795352481.0000000000F8A000.00000040.00000800.00020000.00000000.sdmp, Offset: 00F8A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_f8a000_Client.jbxd

Similarity

API ID: CopyFile
String ID:
API String ID: 1304948518-0
Opcode ID: 3412396c5abce580c535cf73017f02ccd6f25ba7c61636d4dd9bec99ef44f42a
Instruction ID: 3033b316e77fc9f660cf2ea8548f0bee18d2087b32a79f7305ccbb5967b81014
Opcode Fuzzy Hash: 3412396c5abce580c535cf73017f02ccd6f25ba7c61636d4dd9bec99ef44f42a
Instruction Fuzzy Hash: 2D113076A042409FDB60DF15D885797FBE8EF04320F08C4AADD55CB241D775E804DB61

Function 00F8B382 Relevance: 1.6, APIs: 1, Instructions: 53COMMON

Download Yara Rule

APIs

LookupPrivilegeValueW.ADVAPI32(?,?,?), ref: 00F8B3CA

Memory Dump Source

Source File: 00000011.00000002.1795352481.0000000000F8A000.00000040.00000800.00020000.00000000.sdmp, Offset: 00F8A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_f8a000_Client.jbxd

Similarity

API ID: LookupPrivilegeValue
String ID:
API String ID: 3899507212-0
Opcode ID: 3412396c5abce580c535cf73017f02ccd6f25ba7c61636d4dd9bec99ef44f42a
Instruction ID: 375f12710088fe8e8563da3900d4b50f511b2495798d4ab3189ee76403ad4fec
Opcode Fuzzy Hash: 3412396c5abce580c535cf73017f02ccd6f25ba7c61636d4dd9bec99ef44f42a
Instruction Fuzzy Hash: 2911C471A046008FEB60DF29D885B96FBE8EF04320F08C4AADD49CB242D375E804DF61

Function 00F8AEC8 Relevance: 1.6, APIs: 1, Instructions: 52COMMON

Download Yara Rule

APIs

FindClose.KERNELBASE(?), ref: 00F8AF1C

Memory Dump Source

Source File: 00000011.00000002.1795352481.0000000000F8A000.00000040.00000800.00020000.00000000.sdmp, Offset: 00F8A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_f8a000_Client.jbxd

Similarity

API ID: CloseFind
String ID:
API String ID: 1863332320-0
Opcode ID: 1fa1204610e5310168fa6e6c0850bf484248bd11b8e63399d17e191bc4904960
Instruction ID: 3c2fa43606865fbc71b6421a510462b8dd7d64cd6afb70fb12054c4a352ed837
Opcode Fuzzy Hash: 1fa1204610e5310168fa6e6c0850bf484248bd11b8e63399d17e191bc4904960
Instruction Fuzzy Hash: EB11A1755093809FDB128F15DC84B52FFB4DF06220F08C0EFED858B2A3D265A908CB62

Function 00F8AB1E Relevance: 1.6, APIs: 1, Instructions: 52COMMON

Download Yara Rule

APIs

GetFileType.KERNELBASE(?,00000E24,34B04EC5,00000000,00000000,00000000,00000000), ref: 00F8AB71

Memory Dump Source

Source File: 00000011.00000002.1795352481.0000000000F8A000.00000040.00000800.00020000.00000000.sdmp, Offset: 00F8A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_f8a000_Client.jbxd

Similarity

API ID: FileType
String ID:
API String ID: 3081899298-0
Opcode ID: dedea8cede943d7bec2073e5c320edb0135e079d39ffa0df8deb5591cebf386a
Instruction ID: 61eecbd11050f7ebd36215841a87376a9aa03b3a6ffece5d63bd617edede6460
Opcode Fuzzy Hash: dedea8cede943d7bec2073e5c320edb0135e079d39ffa0df8deb5591cebf386a
Instruction Fuzzy Hash: 7E01D271508604AEE720DF15DC85BB6FBE8DF54724F18C09BEE458B241E378A9048BB6

Function 00F8A547 Relevance: 1.6, APIs: 1, Instructions: 50COMMON

Download Yara Rule

APIs

SetErrorMode.KERNELBASE(?), ref: 00F8A5A4

Memory Dump Source

Source File: 00000011.00000002.1795352481.0000000000F8A000.00000040.00000800.00020000.00000000.sdmp, Offset: 00F8A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_f8a000_Client.jbxd

Similarity

API ID: ErrorMode
String ID:
API String ID: 2340568224-0
Opcode ID: b58e2adb275e3be23e6a6b39a19d799b9f818b5c3f17caf85b5a00cfcf4acd24
Instruction ID: d3ae8ccca03f5ab4df2461a9649541d4764d0abf46bc1008a8502614e8a96625
Opcode Fuzzy Hash: b58e2adb275e3be23e6a6b39a19d799b9f818b5c3f17caf85b5a00cfcf4acd24
Instruction Fuzzy Hash: D21182B1405380AFD7228F15DC44B62FFE8EF46624F09C4DAED848B266D375A948CB62

Function 00F8A172 Relevance: 1.5, APIs: 1, Instructions: 47fileCOMMON

Download Yara Rule

APIs

FindNextFileW.KERNELBASE(?,00000E24,?,?), ref: 00F8A1C2

Memory Dump Source

Source File: 00000011.00000002.1795352481.0000000000F8A000.00000040.00000800.00020000.00000000.sdmp, Offset: 00F8A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_f8a000_Client.jbxd

Similarity

API ID: FileFindNext
String ID:
API String ID: 2029273394-0
Opcode ID: e1a002cbbfef988a0bb580457794a0219bcaa1ce0412648434f6ea52b550b9ab
Instruction ID: b11c47a5888d5be35e1b01364ffd13a799d130c7c21e9a06d09d512188bbb9a6
Opcode Fuzzy Hash: e1a002cbbfef988a0bb580457794a0219bcaa1ce0412648434f6ea52b550b9ab
Instruction Fuzzy Hash: 19017171500200AFD310DF16DD45B66FBE8EB88A20F14855AED489B641D735F915CBE5

Function 00F8B5D2 Relevance: 1.5, APIs: 1, Instructions: 43COMMON

Download Yara Rule

APIs

FindCloseChangeNotification.KERNELBASE(?), ref: 00F8B604

Memory Dump Source

Source File: 00000011.00000002.1795352481.0000000000F8A000.00000040.00000800.00020000.00000000.sdmp, Offset: 00F8A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_f8a000_Client.jbxd

Similarity

API ID: ChangeCloseFindNotification
String ID:
API String ID: 2591292051-0
Opcode ID: 4ad5aab34a3c2c97230d343a7f3a98ad3aa1e96af6ce22dea8850333e26c2a69
Instruction ID: c2273072bf9c8b7f5690df28a95611b0b8e96ce9d7a6b1df8178b3bd936ec559
Opcode Fuzzy Hash: 4ad5aab34a3c2c97230d343a7f3a98ad3aa1e96af6ce22dea8850333e26c2a69
Instruction Fuzzy Hash: EC01BC759056409FDB10DF19E8847A2FBE4EF44320F08C4AADD498B252E375A814EFA2

Function 00F8A606 Relevance: 1.5, APIs: 1, Instructions: 43COMMON

Download Yara Rule

APIs

FindCloseChangeNotification.KERNELBASE(?), ref: 00F8A638

Memory Dump Source

Source File: 00000011.00000002.1795352481.0000000000F8A000.00000040.00000800.00020000.00000000.sdmp, Offset: 00F8A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_f8a000_Client.jbxd

Similarity

API ID: ChangeCloseFindNotification
String ID:
API String ID: 2591292051-0
Opcode ID: 59645415f09e4c0649a649ea9688fd7142a5e06a8a79da29ecaa9109c0f6b273
Instruction ID: 6a91c1fc91809e2a3b67183b1003fed150921be77f48472e5e04daaf1b94f840
Opcode Fuzzy Hash: 59645415f09e4c0649a649ea9688fd7142a5e06a8a79da29ecaa9109c0f6b273
Instruction Fuzzy Hash: D701DF759042408FEB10DF15D8847A6FBE4EF00320F08C4ABDD498B256E379A804EFA2

Function 00F8AEEA Relevance: 1.5, APIs: 1, Instructions: 39COMMON

Download Yara Rule

APIs

FindClose.KERNELBASE(?), ref: 00F8AF1C

Memory Dump Source

Source File: 00000011.00000002.1795352481.0000000000F8A000.00000040.00000800.00020000.00000000.sdmp, Offset: 00F8A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_f8a000_Client.jbxd

Similarity

API ID: CloseFind
String ID:
API String ID: 1863332320-0
Opcode ID: c4edf04ce6eec8aab368b955a8b65ee1d9b5124b1de560e096d26f7e1b00ab2f
Instruction ID: 00da74a31bda1d2e8c7a693295f19cfb4452b46a951287834b3abd9c1d54fc38
Opcode Fuzzy Hash: c4edf04ce6eec8aab368b955a8b65ee1d9b5124b1de560e096d26f7e1b00ab2f
Instruction Fuzzy Hash: C501D1759056408FEB119F15D8847A6FBE4DF04330F08C0EBDE498B252D379A804DFA2

Function 00F8AFAE Relevance: 1.5, APIs: 1, Instructions: 38COMMON

Download Yara Rule

APIs

GetLogicalDrives.KERNELBASE ref: 00F8AFDD

Memory Dump Source

Source File: 00000011.00000002.1795352481.0000000000F8A000.00000040.00000800.00020000.00000000.sdmp, Offset: 00F8A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_f8a000_Client.jbxd

Similarity

API ID: DrivesLogical
String ID:
API String ID: 999431828-0
Opcode ID: 70991240212c74f7f22774b31cb01125ef2d852aed2817d92b529ba6846e37ff
Instruction ID: a66578b781421a44e97de8148c661caf9ed7178e09ef38ec2b8644c83dc9e375
Opcode Fuzzy Hash: 70991240212c74f7f22774b31cb01125ef2d852aed2817d92b529ba6846e37ff
Instruction Fuzzy Hash: B601DC718082408FEB10DF15D8847A2FBE4EF40320F08C4AACE488F242D379A804EFA2

Function 00F8A572 Relevance: 1.5, APIs: 1, Instructions: 35COMMON

Download Yara Rule

APIs

SetErrorMode.KERNELBASE(?), ref: 00F8A5A4

Memory Dump Source

Source File: 00000011.00000002.1795352481.0000000000F8A000.00000040.00000800.00020000.00000000.sdmp, Offset: 00F8A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_f8a000_Client.jbxd

Similarity

API ID: ErrorMode
String ID:
API String ID: 2340568224-0
Opcode ID: 0c01a4b3b8d6157cf808012f40676bc3dd36ed56179c093b3c9931c850659b08
Instruction ID: a6e5eb0835373e8054afd0438e515ca779765378e4f5d7de7bc3e8962654fe53
Opcode Fuzzy Hash: 0c01a4b3b8d6157cf808012f40676bc3dd36ed56179c093b3c9931c850659b08
Instruction Fuzzy Hash: 3DF0DC358042409FEB209F05D888766FBE0EF04324F0CC09ADD480F656E379A944DFA2

Function 051B0080 Relevance: 1.4, Strings: 1, Instructions: 111COMMON

Download Yara Rule

Strings

:@zl, xrefs: 051B016D

Memory Dump Source

Source File: 00000011.00000002.1823727129.00000000051B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 051B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_51b0000_Client.jbxd

Similarity

API ID:
String ID: :@zl
API String ID: 0-1604122134
Opcode ID: 4eeb62af3905b109a5f56e016e8fdc0ce519d2f182f2646954582a7e12e23a25
Instruction ID: 7ab00de40d192101546f1c66a00a1899a1980334116c0b7eeac72d6d2a4ddfac
Opcode Fuzzy Hash: 4eeb62af3905b109a5f56e016e8fdc0ce519d2f182f2646954582a7e12e23a25
Instruction Fuzzy Hash: 2F41F834904609CFC348FB75DA5A29ABBE3AFC5304F94C13ED504DB268EF794905AB52

Function 051B0090 Relevance: 1.4, Strings: 1, Instructions: 104COMMON

Download Yara Rule

Strings

:@zl, xrefs: 051B016D

Memory Dump Source

Source File: 00000011.00000002.1823727129.00000000051B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 051B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_51b0000_Client.jbxd

Similarity

API ID:
String ID: :@zl
API String ID: 0-1604122134
Opcode ID: 1b7c6fb94d8b7617cd399c35c905d86896aae359fda536665e8cc3afd0d6d9bc
Instruction ID: 304ae7f31576cb780c56e11f02d4040175e3316898b88cb6879046e760eeb39e
Opcode Fuzzy Hash: 1b7c6fb94d8b7617cd399c35c905d86896aae359fda536665e8cc3afd0d6d9bc
Instruction Fuzzy Hash: 6E41D934904609CBC344FB75DA5928ABBE3AFC5304F94C13ED508DB368DF795905ABA2

Function 052F56D7 Relevance: 1.3, Strings: 1, Instructions: 23COMMON

Download Yara Rule

Strings

D, xrefs: 052F5704

Memory Dump Source

Source File: 00000011.00000002.1824413050.00000000052F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 052F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_52f0000_Client.jbxd

Similarity

API ID:
String ID: D
API String ID: 0-2746444292
Opcode ID: 734a2f7a45fb35b8983e161df62057dc8532a8ea609646fbb6abf8aa9a7a2e42
Instruction ID: ff2f07c0a5527d08e1e0ec7f23c01e9526b770e693ddd2328f3e7bfeaa6f9884
Opcode Fuzzy Hash: 734a2f7a45fb35b8983e161df62057dc8532a8ea609646fbb6abf8aa9a7a2e42
Instruction Fuzzy Hash: 37E09A70A15384CFC7028BA4A8192CC7BB6EF03361B1441ABE446DE153DB7C098B8B22

Function 052F5858 Relevance: 1.3, Strings: 1, Instructions: 19COMMON

Download Yara Rule

Strings

E, xrefs: 052F5858

Memory Dump Source

Source File: 00000011.00000002.1824413050.00000000052F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 052F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_52f0000_Client.jbxd

Similarity

API ID:
String ID: E
API String ID: 0-3568589458
Opcode ID: b82e9fa5d846ebf9a3fa8d597d3b10487286abb0684fa3de64ec10df0a68c0f0
Instruction ID: d52573a48a48c887b6049dc1e791f592e8c0e24e3e01021750cda076aa9101c4
Opcode Fuzzy Hash: b82e9fa5d846ebf9a3fa8d597d3b10487286abb0684fa3de64ec10df0a68c0f0
Instruction Fuzzy Hash: 55E0CDB0D05644CFDB01CBB8F85929C7FB1FF42316F140167C402D5182DF7849468705

Function 052F5E57 Relevance: 1.3, Strings: 1, Instructions: 19COMMON

Download Yara Rule

Strings

2, xrefs: 052F5E89

Memory Dump Source

Source File: 00000011.00000002.1824413050.00000000052F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 052F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_52f0000_Client.jbxd

Similarity

API ID:
String ID: 2
API String ID: 0-450215437
Opcode ID: 9c3dc78accdc24957455762613f277c1e91505c9014612067267b1d5945bf61a
Instruction ID: 7447f690f38d167576c73ad540c1e3b310554c8ca59e5b2d51650daadf60f4c9
Opcode Fuzzy Hash: 9c3dc78accdc24957455762613f277c1e91505c9014612067267b1d5945bf61a
Instruction Fuzzy Hash: ACE01A70616348CBDB05DFA4F60859CBBB6EF45341F108566D502AB252DB788A46C711

Function 052F596E Relevance: 1.3, Strings: 1, Instructions: 17COMMON

Download Yara Rule

Strings

<, xrefs: 052F573C

Memory Dump Source

Source File: 00000011.00000002.1824413050.00000000052F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 052F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_52f0000_Client.jbxd

Similarity

API ID:
String ID: <
API String ID: 0-4251816714
Opcode ID: 82a2fb0ef4714852c740044793609a90e02499d2a06064952d928b7e518a04c6
Instruction ID: 231676780c5933fbcd05ea0af1c25ba6244a466426e801893b8341de5900a1c0
Opcode Fuzzy Hash: 82a2fb0ef4714852c740044793609a90e02499d2a06064952d928b7e518a04c6
Instruction Fuzzy Hash: ACE0BF74A25248CBDB04CFA4F54866CB776FF45381F10843BD543EA280DF788A86CB11

Function 052F615D Relevance: 1.3, Strings: 1, Instructions: 16COMMON

Download Yara Rule

Strings

f, xrefs: 052F615D

Memory Dump Source

Source File: 00000011.00000002.1824413050.00000000052F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 052F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_52f0000_Client.jbxd

Similarity

API ID:
String ID: f
API String ID: 0-1993550816
Opcode ID: 15595aa0d64a13e1366247014c8e10d4f2964f5bd3de4fb5de76aaaac680d0ce
Instruction ID: c44b869f80cb857d0dcb62a870275b18ce765576cb43e206666185b0be4a64a0
Opcode Fuzzy Hash: 15595aa0d64a13e1366247014c8e10d4f2964f5bd3de4fb5de76aaaac680d0ce
Instruction Fuzzy Hash: 68E0EC74E11249CBDB04DFE5F50846DF7B7EF85351B608036DA02AB254EF794A46CB10

Function 052F58F8 Relevance: 1.3, Strings: 1, Instructions: 11COMMON

Download Yara Rule

Strings

., xrefs: 052F590E

Memory Dump Source

Source File: 00000011.00000002.1824413050.00000000052F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 052F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_52f0000_Client.jbxd

Similarity

API ID:
String ID: .
API String ID: 0-248832578
Opcode ID: 197b5c5579cb903e3000becf1c1b0b27e2dc9c0f2a35f8653580741399564af9
Instruction ID: 3b762bbef728a4c1e7e1281ae0d34deba6e1f631f9df224d8df847ab26aad178
Opcode Fuzzy Hash: 197b5c5579cb903e3000becf1c1b0b27e2dc9c0f2a35f8653580741399564af9
Instruction Fuzzy Hash: FAD09274A15188CBDB04CFA8F54C56CBBB2EB45352F20442AD542A6290CF784A858B11

Function 052F5726 Relevance: 1.3, Strings: 1, Instructions: 11COMMON

Download Yara Rule

Strings

<, xrefs: 052F573C

Memory Dump Source

Source File: 00000011.00000002.1824413050.00000000052F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 052F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_52f0000_Client.jbxd

Similarity

API ID:
String ID: <
API String ID: 0-4251816714
Opcode ID: 6f453dbe6f19baa3a4e91913b0e9c439335ed822ac9e64255a63ec643b7fd340
Instruction ID: 8ee346c832dda0c22106fa5f48b4382afdccfad9293fadce9345e09f63004228
Opcode Fuzzy Hash: 6f453dbe6f19baa3a4e91913b0e9c439335ed822ac9e64255a63ec643b7fd340
Instruction Fuzzy Hash: 38D09E74A11148CBDB04CFA4F54855CB776EB45351B104426D903EA240CF784A86CB11

Function 052F5ECD Relevance: 1.3, Strings: 1, Instructions: 11COMMON

Download Yara Rule

Strings

%, xrefs: 052F5EE9

Memory Dump Source

Source File: 00000011.00000002.1824413050.00000000052F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 052F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_52f0000_Client.jbxd

Similarity

API ID:
String ID: %
API String ID: 0-2567322570
Opcode ID: 6426dae8bfc79092d617ab6d8ec3d39eb59a58dbd708e38c6e17aa2148a859c2
Instruction ID: 50a947c512a22db921354b667f54583a3c8e24bf8cc95899e5b11589b0838d98
Opcode Fuzzy Hash: 6426dae8bfc79092d617ab6d8ec3d39eb59a58dbd708e38c6e17aa2148a859c2
Instruction Fuzzy Hash: 16C012B09126088BDB008BB46C1D78C77F0FB05366B5401264402A3347EF7444474A10

Function 052F5949 Relevance: 1.3, Strings: 1, Instructions: 7COMMON

Download Yara Rule

Strings

H, xrefs: 052F5962

Memory Dump Source

Source File: 00000011.00000002.1824413050.00000000052F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 052F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_52f0000_Client.jbxd

Similarity

API ID:
String ID: H
API String ID: 0-2852464175
Opcode ID: 69bcd9b128d98e5afadfe29eac2808d1f8a1b12f12a34f6d7653b18661b4de60
Instruction ID: 902b1426aae199830ab700725981588e01c30ad58a07e7866605f84c86503925
Opcode Fuzzy Hash: 69bcd9b128d98e5afadfe29eac2808d1f8a1b12f12a34f6d7653b18661b4de60
Instruction Fuzzy Hash: 4BC04CB4A12308CFDB449FB4E91C35CBBB1EF85386F00446B9647E7290DE7809859F11

Function 052F5D5E Relevance: 1.3, Strings: 1, Instructions: 7COMMON

Download Yara Rule

Strings

J, xrefs: 052F5D77

Memory Dump Source

Source File: 00000011.00000002.1824413050.00000000052F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 052F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_52f0000_Client.jbxd

Similarity

API ID:
String ID: J
API String ID: 0-1141589763
Opcode ID: fda54cd9c329202d2496603549a417969f3d3752c27561082b9f0253fd0e0f37
Instruction ID: 431ad32020da1272f42dae856056f34d71e3fe15236c57ecf1b8505178cf48d8
Opcode Fuzzy Hash: fda54cd9c329202d2496603549a417969f3d3752c27561082b9f0253fd0e0f37
Instruction Fuzzy Hash: 0CC04CB4A12248CFDB449FB4E45C25CBAB1EB45386F10806B954BE2290DE780985DF15

Function 052F5D83 Relevance: 1.3, Strings: 1, Instructions: 7COMMON

Download Yara Rule

Strings

E, xrefs: 052F5D99

Memory Dump Source

Source File: 00000011.00000002.1824413050.00000000052F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 052F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_52f0000_Client.jbxd

Similarity

API ID:
String ID: E
API String ID: 0-3568589458
Opcode ID: 669fef783ac196a7e2c06037194e4fe4605e482de329a855315dfcba390321c9
Instruction ID: f320db1eef592f6a0fb757982b894808214845e8c512a100f8f22de554c97bff
Opcode Fuzzy Hash: 669fef783ac196a7e2c06037194e4fe4605e482de329a855315dfcba390321c9
Instruction Fuzzy Hash: 64C04CB4A122088BDB449FB4E81C59CBAB2EB85386F10402B9507A7291DE780585DB11

Function 052F6191 Relevance: 1.3, Strings: 1, Instructions: 7COMMON

Download Yara Rule

Strings

6, xrefs: 052F61A7

Memory Dump Source

Source File: 00000011.00000002.1824413050.00000000052F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 052F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_52f0000_Client.jbxd

Similarity

API ID:
String ID: 6
API String ID: 0-498629140
Opcode ID: d89694d709079a7e84d478df0e499dc6147ddf9dff6ec6c071beaa6398c88ad6
Instruction ID: 9bbf5fb1956c7824e8ccd6465f377624108c0d1721cdafa6a882ca1a9a12083b
Opcode Fuzzy Hash: d89694d709079a7e84d478df0e499dc6147ddf9dff6ec6c071beaa6398c88ad6
Instruction Fuzzy Hash: D7C04C74A132089BDB14DFF4E51C55CBAB5EB45386F10402F9503A7291DE780945DB11

Function 052F5DD6 Relevance: 1.3, Strings: 1, Instructions: 7COMMON

Download Yara Rule

Strings

B, xrefs: 052F5DEF

Memory Dump Source

Source File: 00000011.00000002.1824413050.00000000052F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 052F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_52f0000_Client.jbxd

Similarity

API ID:
String ID: B
API String ID: 0-1255198513
Opcode ID: bc9182676bb2f2a769d14852ba4eca4674ac190010ecad1db88169741faa86ef
Instruction ID: ba028f9d6ef4b60be30183c2a674f09d2c56f2133ffebf28a80a390b9967bcb9
Opcode Fuzzy Hash: bc9182676bb2f2a769d14852ba4eca4674ac190010ecad1db88169741faa86ef
Instruction Fuzzy Hash: CAC04CB4A13208CBDB449FB4E51C25CBBB1EB45386F00406BA64BE3291DE780A859B11

Function 052F59D4 Relevance: 1.3, Strings: 1, Instructions: 7COMMON

Download Yara Rule

Strings

&, xrefs: 052F59EA

Memory Dump Source

Source File: 00000011.00000002.1824413050.00000000052F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 052F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_52f0000_Client.jbxd

Similarity

API ID:
String ID: &
API String ID: 0-1010288
Opcode ID: cb3463df75957862e075bc75a03c9d982bc848a98f9747e232501aabb7c81dc2
Instruction ID: 4cb06c6f8acc59774ae7ac945680961f0248d60002d6785d4dc3b970da951ec3
Opcode Fuzzy Hash: cb3463df75957862e075bc75a03c9d982bc848a98f9747e232501aabb7c81dc2
Instruction Fuzzy Hash: DCC04C74A1220C8BDB14DFF8E41C16DBAB1EB89386F10402B9513A3291DE7804459F21

Function 052F6021 Relevance: 1.3, Strings: 1, Instructions: 7COMMON

Download Yara Rule

Strings

L, xrefs: 052F603A

Memory Dump Source

Source File: 00000011.00000002.1824413050.00000000052F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 052F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_52f0000_Client.jbxd

Similarity

API ID:
String ID: L
API String ID: 0-2909332022
Opcode ID: 63076678839eb06a5f5ce00deae4de3f6c6d0897587c66a22207cbcd4eb1b804
Instruction ID: 00b188c759c384102e5a036557dac3129f7a6018b00d8858da4315ed07a1d801
Opcode Fuzzy Hash: 63076678839eb06a5f5ce00deae4de3f6c6d0897587c66a22207cbcd4eb1b804
Instruction Fuzzy Hash: 47C040B4A13108CBD7449F74D51D65C7671DB45346F004057950796251DE780545DB11

Function 052F5C78 Relevance: 1.3, Strings: 1, Instructions: 7COMMON

Download Yara Rule

Strings

!, xrefs: 052F5C91

Memory Dump Source

Source File: 00000011.00000002.1824413050.00000000052F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 052F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_52f0000_Client.jbxd

Similarity

API ID:
String ID: !
API String ID: 0-2657877971
Opcode ID: 132bb4afc7ef6c3572e3b75e27d09aa7a2e1108cba77948924a6bb182eae22e9
Instruction ID: b8ce0c82f735fe7d9ef3d750318cc47fe4cdee696cc2d4ed0f2079929f5c3745
Opcode Fuzzy Hash: 132bb4afc7ef6c3572e3b75e27d09aa7a2e1108cba77948924a6bb182eae22e9
Instruction Fuzzy Hash: 8DC04CB4A1620CCFDB04DFB4E81C39CBAB1EB85386F40406B9547A7290DF784985DF11

Function 052F5F7F Relevance: 1.3, Strings: 1, Instructions: 7COMMON

Download Yara Rule

Strings

,, xrefs: 052F5F98

Memory Dump Source

Source File: 00000011.00000002.1824413050.00000000052F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 052F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_52f0000_Client.jbxd

Similarity

API ID:
String ID: ,
API String ID: 0-3772416878
Opcode ID: 55888a857730b02b0c4824f9491d699fa374abdd182c1d8a23d2ddc4838d18bd
Instruction ID: 22e56a00ad796801a7abe507d1eac9028f3a070f901b33b2b37d05adafa1984e
Opcode Fuzzy Hash: 55888a857730b02b0c4824f9491d699fa374abdd182c1d8a23d2ddc4838d18bd
Instruction Fuzzy Hash: 83C04074A11508CBDB049F74D41D65CB6B1DB45356F004057950796251DF740545DF11

Function 052F5FC7 Relevance: 1.3, Strings: 1, Instructions: 7COMMON

Download Yara Rule

Strings

=, xrefs: 052F5FE0

Memory Dump Source

Source File: 00000011.00000002.1824413050.00000000052F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 052F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_52f0000_Client.jbxd

Similarity

API ID:
String ID: =
API String ID: 0-2322244508
Opcode ID: aab860be8306d54df24a35384939817f61a04a8d65955fe5eca3e5ffdb804471
Instruction ID: 20c3c277bd634d8af4b1323768013553778c372f69d204e740ee86ca4f2ae8e3
Opcode Fuzzy Hash: aab860be8306d54df24a35384939817f61a04a8d65955fe5eca3e5ffdb804471
Instruction Fuzzy Hash: 26C04CB4A12218CBDB059FB4E81C75CBAB5EB89387F00806B9547E7290DE780985DF21

Function 052F45EE Relevance: .2, Instructions: 161COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000011.00000002.1824413050.00000000052F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 052F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_52f0000_Client.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f1a1e7b331e492a2a851bea7fec0f2dde0b934e8a19fe610e5b0145508f8ccad
Instruction ID: b47f04a0333c30f3bdc7559e1ab40d4b5a145c6a037cc4bb433d8309a0b755d9
Opcode Fuzzy Hash: f1a1e7b331e492a2a851bea7fec0f2dde0b934e8a19fe610e5b0145508f8ccad
Instruction Fuzzy Hash: E3713270D14148CBEF14FFB5E8587AEBBB2BF44304F10806AD546A7294CBB45948DFA5

Function 052F4626 Relevance: .2, Instructions: 158COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000011.00000002.1824413050.00000000052F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 052F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_52f0000_Client.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7e4df988815e4dbea8de88f29dadac5a2c727602a0cdd8661b7c8be6cfb2001b
Instruction ID: b2841401b75cc355d19710c109634bd483a5ffd0b8321dacfc0a93d116cc3fc3
Opcode Fuzzy Hash: 7e4df988815e4dbea8de88f29dadac5a2c727602a0cdd8661b7c8be6cfb2001b
Instruction Fuzzy Hash: 0F713170D24148CBEF14FFB5E8587AEBBB2BF44308F10806AD546A6290CBB45844DF95

Function 052F4283 Relevance: .2, Instructions: 157COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000011.00000002.1824413050.00000000052F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 052F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_52f0000_Client.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 79d5cc0abf1c3645bafd5cdeb7a74643a4275bfca3bc829b4ee94841992a8e95
Instruction ID: 4cb9653fe85c06cb7c9100ddacb65a4f7474f9fdbf62c3454024a06ec26ea573
Opcode Fuzzy Hash: 79d5cc0abf1c3645bafd5cdeb7a74643a4275bfca3bc829b4ee94841992a8e95
Instruction Fuzzy Hash: 13615170D14148CBEF14FFB5E8587AEBBB2BF44308F10802AD546A7294CBB45848DFA5

Function 052F4462 Relevance: .2, Instructions: 154COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000011.00000002.1824413050.00000000052F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 052F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_52f0000_Client.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8d2e5873dba7709b6004acf9ba2b575be6ffdf79deb76963d92a7ab9657dd79f
Instruction ID: 3aa3bc5a35d6ce2f12dcb317f97f4927b56dca808319b087459961c5ecfa326f
Opcode Fuzzy Hash: 8d2e5873dba7709b6004acf9ba2b575be6ffdf79deb76963d92a7ab9657dd79f
Instruction Fuzzy Hash: 60613F70D24148CBEF14FFB5E8587AEFBB2BF44308F10806AD546A6294CBB45988DF95

Function 052F44D5 Relevance: .2, Instructions: 154COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000011.00000002.1824413050.00000000052F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 052F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_52f0000_Client.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ae03cf6605bc3e38c6811dc2b1e90a29118b407005353f7da91ba5d9cdaf9119
Instruction ID: bcdfdf90189eac758b9128fa06c23d0f3788fe5a50ab05bc449a11ddb24959a2
Opcode Fuzzy Hash: ae03cf6605bc3e38c6811dc2b1e90a29118b407005353f7da91ba5d9cdaf9119
Instruction Fuzzy Hash: 20614470D24148CBEF14FFB5E8587AEFBB2BF44308F10806AD546A6294CBB45944DFA5

Function 052F45D2 Relevance: .2, Instructions: 152COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000011.00000002.1824413050.00000000052F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 052F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_52f0000_Client.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bf6337b7da7ead33cf5e262ee834b86bc6578ca7076591caed0c0f2fb913ff4a
Instruction ID: 6f630a7e159beef29eae512deadd2980ad27ba343686c47a307626d662cf8fde
Opcode Fuzzy Hash: bf6337b7da7ead33cf5e262ee834b86bc6578ca7076591caed0c0f2fb913ff4a
Instruction Fuzzy Hash: 6C614270D24148CBEF14FFB5E8587AEFBB2BF44304F10806AD546A6294CBB45988DFA5

Function 052F44CD Relevance: .2, Instructions: 150COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000011.00000002.1824413050.00000000052F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 052F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_52f0000_Client.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ed32f74dfcc5937af8a29a0ffd5bc9f9f6b2de760addc052b6b9fb3afe1f9909
Instruction ID: b2d7a0d1d7728f5200bb1696033b20c6d4337429af7fafc16033825e35edd6e3
Opcode Fuzzy Hash: ed32f74dfcc5937af8a29a0ffd5bc9f9f6b2de760addc052b6b9fb3afe1f9909
Instruction Fuzzy Hash: 32613370D24148CBEF14FFB5E8587AEBBB2BF44308F10806AD546A6294CBB45948DFA5

Function 052F4161 Relevance: .1, Instructions: 149COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000011.00000002.1824413050.00000000052F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 052F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_52f0000_Client.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fb1b590a290021f40ed0ab73be541bb789bd86ceb4b8ba89f0068ff87112be54
Instruction ID: 1421a49c1d06722fdddf388248b01f010da7093ec64e5ae379261fde77cf0d9b
Opcode Fuzzy Hash: fb1b590a290021f40ed0ab73be541bb789bd86ceb4b8ba89f0068ff87112be54
Instruction Fuzzy Hash: F0613370D24148CBEF14FFB5E8587AEFBB2BF44308F10806AD546A6294CBB45988DF95

Function 052F41DC Relevance: .1, Instructions: 149COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000011.00000002.1824413050.00000000052F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 052F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_52f0000_Client.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c66a6feb330b4e7190d535928dfcc5dfa32911433106f430aaad7958498968e5
Instruction ID: edf229d026cbf4ca4d6f0c511b551325fb4328239a83bd966c53e968b079463f
Opcode Fuzzy Hash: c66a6feb330b4e7190d535928dfcc5dfa32911433106f430aaad7958498968e5
Instruction Fuzzy Hash: 84614370D24148CBEF14FFB5E8587AEFBB2BF44308F10806AD546A6294CBB45988DF95

Function 052F42C6 Relevance: .1, Instructions: 149COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000011.00000002.1824413050.00000000052F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 052F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_52f0000_Client.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b0d40a683bd6d138a9eb0b349553b5e6a45870c8622c305c2a886ce4b4c54981
Instruction ID: e3dcfbf793646970869a1a033537ef039ec52f1c94e6228be2d8f97b2369c036
Opcode Fuzzy Hash: b0d40a683bd6d138a9eb0b349553b5e6a45870c8622c305c2a886ce4b4c54981
Instruction Fuzzy Hash: DE613470D24148CBEF14FFB5E8587AEFBB2BF44304F10806AD546A6294CBB45984DFA5

Function 052F4EC0 Relevance: .1, Instructions: 108COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000011.00000002.1824413050.00000000052F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 052F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_52f0000_Client.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cc71b28db7cd343e6a4c2843a594916c78aa7539ee8c3458d27639ae937e8478
Instruction ID: a35677636557121a667ab7cb43e1c55eac590b845a9670b9afe7ce81d14bf588
Opcode Fuzzy Hash: cc71b28db7cd343e6a4c2843a594916c78aa7539ee8c3458d27639ae937e8478
Instruction Fuzzy Hash: 62414F34A242099FCB04DB74E84899EBBF2BF89351B15857BD90AE3290DB759C41CF91

Function 052F4EF0 Relevance: .1, Instructions: 96COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000011.00000002.1824413050.00000000052F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 052F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_52f0000_Client.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 296734ab2d2266a39d06631e816c8f3a2aa7346d68644f2aeca4c19728358845
Instruction ID: 2d977ab4ab3d7d24da8654a7a46ed557a49daac1537b59a32e9f4732503fe67f
Opcode Fuzzy Hash: 296734ab2d2266a39d06631e816c8f3a2aa7346d68644f2aeca4c19728358845
Instruction Fuzzy Hash: D3314F34E24108DBDF04EBA4E84869EB7B2BF89351F15453BE90AE3390DB759C418F91

Function 052F4FDE Relevance: .1, Instructions: 79COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000011.00000002.1824413050.00000000052F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 052F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_52f0000_Client.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d45ebf13072833d00ecc565a15bcb72b82d3cf4765e944277aeee69cadd0c7d3
Instruction ID: a82f944bef954716a455c2e5b84b8f01d6045c3416a23d29385c1bfbf9772743
Opcode Fuzzy Hash: d45ebf13072833d00ecc565a15bcb72b82d3cf4765e944277aeee69cadd0c7d3
Instruction Fuzzy Hash: 22312D34A10109DFCF04EB74E8485ADB7B2BF99351B15853BE90AE3390DB759C419F90

Function 052F5090 Relevance: .1, Instructions: 65COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000011.00000002.1824413050.00000000052F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 052F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_52f0000_Client.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d0b6c603539329872be78db1acfeb2181dc9527aada39a67c43d3a21e832507b
Instruction ID: 3ab8bf62fbf71ead389f8ef856f66e857237feaf5c4a95d800f518cff022b6f3
Opcode Fuzzy Hash: d0b6c603539329872be78db1acfeb2181dc9527aada39a67c43d3a21e832507b
Instruction Fuzzy Hash: F821C434A2D20ADFDF00EFA8E8595EDBBB1FF44304F51806EDA0297260DBB55A04DB52

Function 052F50A0 Relevance: .1, Instructions: 61COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000011.00000002.1824413050.00000000052F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 052F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_52f0000_Client.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 69dd4c199d00dc0b4183226c80f3f567480fe87844c126e0ecd38c6d27cc935f
Instruction ID: 67f4b2ce81f170c268b78aba5a8c51d6d6d90600e2edd80a9d98a2c9b0bdcc80
Opcode Fuzzy Hash: 69dd4c199d00dc0b4183226c80f3f567480fe87844c126e0ecd38c6d27cc935f
Instruction Fuzzy Hash: FE215634A2910EDFDF00EFA8E9595ADF7B2FF44304F50806EDA0297250DBB55A44EB92

Function 052F4D20 Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000011.00000002.1824413050.00000000052F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 052F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_52f0000_Client.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: de84668fe4461e74e5064b71dc472bde341ed15e928ed33e021a7b083c9d99c4
Instruction ID: 851c34f4cb88868203302259d123e0b851a0df16b2df4f00833d6b32cf122656
Opcode Fuzzy Hash: de84668fe4461e74e5064b71dc472bde341ed15e928ed33e021a7b083c9d99c4
Instruction Fuzzy Hash: D61129355181148FCB15BB34F815159BBA19F82314B4681BFD54697396CFB54C43CBD2

Function 052F4D30 Relevance: .0, Instructions: 49COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000011.00000002.1824413050.00000000052F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 052F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_52f0000_Client.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a4c33330a084c8d2abaac5b7f6108bdd4eb7fd72a2e5025394c297f00bab8782
Instruction ID: 33ded69a36a7cfc920bdba6892116dcff732f4353dd2bcb312d24ba7d440ae01
Opcode Fuzzy Hash: a4c33330a084c8d2abaac5b7f6108bdd4eb7fd72a2e5025394c297f00bab8782
Instruction Fuzzy Hash: 3D012B35624114CBCF14BB24F81861ABBA2AF81355B06817FD60797385CFB14C43CBD2

Function 00FC05DF Relevance: .0, Instructions: 43COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000011.00000002.1795485335.0000000000FC0000.00000040.00000020.00020000.00000000.sdmp, Offset: 00FC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_fc0000_Client.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f01c0dbf9c01a4d2da8d6455d8f04685480479196f9d7e07b615238755ff6eae
Instruction ID: 6003cebe968703010f76febce63cba1f9c8260641ce8748c6d55ae2f6e8a2543
Opcode Fuzzy Hash: f01c0dbf9c01a4d2da8d6455d8f04685480479196f9d7e07b615238755ff6eae
Instruction Fuzzy Hash: 0001D6B650D3846FC7128F16AC44863FFB8DF86620709C4DFEC498B652D229B908CB72

Function 051B0006 Relevance: .0, Instructions: 42COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000011.00000002.1823727129.00000000051B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 051B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_51b0000_Client.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 25cbff3663ec4b414689829af1f2f679e4609af2f226cdba47ce4c860bf99493
Instruction ID: 57a9e8f22f0d4f56ee35699c4f327599d038019dd5e2a48bb2b18429612680ea
Opcode Fuzzy Hash: 25cbff3663ec4b414689829af1f2f679e4609af2f226cdba47ce4c860bf99493
Instruction Fuzzy Hash: 0601CF2141E7C08FD3038B349CA6A917FB0AE17214B4E89DBC084CB1A3D25C885DD767

Function 00FC0606 Relevance: .0, Instructions: 27COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000011.00000002.1795485335.0000000000FC0000.00000040.00000020.00020000.00000000.sdmp, Offset: 00FC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_fc0000_Client.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8d44faa15478789201ca6a865094337f167bc0dc0a9fe41121a0a338350aeb53
Instruction ID: a7b6ac86b07313498265c26dbb6bd8f520416133c9aaccb31c7289849f23bb4e
Opcode Fuzzy Hash: 8d44faa15478789201ca6a865094337f167bc0dc0a9fe41121a0a338350aeb53
Instruction Fuzzy Hash: 78E092B66046005BD650CF0BEC41462F7D8EB84630708C47FDC0D8B701E236B505CEA5

Function 052F452A Relevance: .0, Instructions: 19COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000011.00000002.1824413050.00000000052F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 052F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_52f0000_Client.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f895e75c8d820aef0656d5060d5ac80b1be91120f84db8b193723edacd5e81ff
Instruction ID: 2636800d3378254b1c89d5ad0b4d47d7d243df1fe9fcf4ef6d168636cde0a0ba
Opcode Fuzzy Hash: f895e75c8d820aef0656d5060d5ac80b1be91120f84db8b193723edacd5e81ff
Instruction Fuzzy Hash: 6AE0C974A10218CFDB58FF74D8583ADBA76AF84301F0001AADA0BA6690DFB44940DF52

Function 052F312F Relevance: .0, Instructions: 18COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000011.00000002.1824413050.00000000052F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 052F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_52f0000_Client.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 23def514cfd082c6d2649d0b0846e9083f282d88f6ddee0e227e2017ba12e53f
Instruction ID: b2067841f9c1e1a4075652b15602e0eb75365e39465429708445672a1cc479b4
Opcode Fuzzy Hash: 23def514cfd082c6d2649d0b0846e9083f282d88f6ddee0e227e2017ba12e53f
Instruction Fuzzy Hash: F6D05E36A38008EB9B04D788F8405EFF3B6EE68235B040473E616F3200C3716E158B61

Function 052F57C0 Relevance: .0, Instructions: 16COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000011.00000002.1824413050.00000000052F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 052F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_52f0000_Client.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e02f1992916948ca08a822f0d497254d4cd4d7affde7b36e65208f044fc22484
Instruction ID: 24e00c7d8872c999192d221b14dcabc348a74718a36f710e2ef2ce3a55e09d9c
Opcode Fuzzy Hash: e02f1992916948ca08a822f0d497254d4cd4d7affde7b36e65208f044fc22484
Instruction Fuzzy Hash: D3E0BFB0E11149CBDB44DFE4F54955CB7B2EF45346F608426D907EA244DF784A8A8B10

Function 051B119F Relevance: .0, Instructions: 15COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000011.00000002.1823727129.00000000051B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 051B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_51b0000_Client.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2bc1c33eb45c1188a953adf6b420d693d414b22431cc1ae027ec0a283b2187d0
Instruction ID: b1fd93dad9435e518febdaaa4747f3fcff442755e5b80178f97282f653333bc6
Opcode Fuzzy Hash: 2bc1c33eb45c1188a953adf6b420d693d414b22431cc1ae027ec0a283b2187d0
Instruction Fuzzy Hash: 1EE07E7094202ADBEFA5CF08C890AE9B7B6BB48304F1185E5E01DA6250DB719EC58F40

Function 051B05C7 Relevance: .0, Instructions: 15COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000011.00000002.1823727129.00000000051B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 051B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_51b0000_Client.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c6a769dc23e0581eb5a3e9cda96372a636826e640981347ac6d4d2ad6a266156
Instruction ID: 8b45e0a5a3faa13f33c7ff36f37d9f817345ae8a4d4fe4837a75b4b079994afe
Opcode Fuzzy Hash: c6a769dc23e0581eb5a3e9cda96372a636826e640981347ac6d4d2ad6a266156
Instruction Fuzzy Hash: BEE0127094602ACBEBA0CF08C881BEDB3B6FB48304F0140E9E12CA6280CB746EC4CF00

Function 051B36AC Relevance: .0, Instructions: 15COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000011.00000002.1823727129.00000000051B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 051B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_51b0000_Client.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 735a2f83b9a408ef0548b78790d56ba4d9c03aecf0c80c18fbcc318c4a52398a
Instruction ID: 6ca28d9119ed4e80647a0b33a9f1e04194f21a500b74ac9a2cd30a6c7b30c530
Opcode Fuzzy Hash: 735a2f83b9a408ef0548b78790d56ba4d9c03aecf0c80c18fbcc318c4a52398a
Instruction Fuzzy Hash: 03E0EC3894111ACBE764CF14DC58BFD77B6FB45304F0144E5E55A96690DBBA9EC08F00

Function 052F4573 Relevance: .0, Instructions: 15COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000011.00000002.1824413050.00000000052F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 052F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_52f0000_Client.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 90dc6da2adc617a0a287a957e0356a20e823d15ec3e876ed53a4a568857ec834
Instruction ID: c04f154afa8d06400bb0d3839c1d0641120d633ca3f9955a442fb7f72bc92d28
Opcode Fuzzy Hash: 90dc6da2adc617a0a287a957e0356a20e823d15ec3e876ed53a4a568857ec834
Instruction Fuzzy Hash: E3E09270928608CFDF15EFB8E98819CBFB1EF44702F20412AE502A62A0CFB40885DF40

Function 052F5228 Relevance: .0, Instructions: 15COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000011.00000002.1824413050.00000000052F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 052F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_52f0000_Client.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 68b4f2e81d2de2a0290bced7d22f32b7c0775868f3efcb58c9b6b27a29b80cbe
Instruction ID: f28244e6694c2a41f73777ac4f94098f41ec5c2fee6dbfe7420da8f91bbb35a3
Opcode Fuzzy Hash: 68b4f2e81d2de2a0290bced7d22f32b7c0775868f3efcb58c9b6b27a29b80cbe
Instruction Fuzzy Hash: 38D02234A4C3804FDB05CBB494424C83BB00F9A35070541FFD44ACB623D55A0816CA06

Function 00F823F4 Relevance: .0, Instructions: 15COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000011.00000002.1795336296.0000000000F82000.00000040.00000800.00020000.00000000.sdmp, Offset: 00F82000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_f82000_Client.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8ff5a8e356aace91c4551e30c3e4f500c916427a3f34929ba44cd4f85606babe
Instruction ID: 776bc5234b3a7e80380f2230fa51fb0add02d924e9766896c4d5fb89c14ba81a
Opcode Fuzzy Hash: 8ff5a8e356aace91c4551e30c3e4f500c916427a3f34929ba44cd4f85606babe
Instruction Fuzzy Hash: BDD05E79605A814FD326EA1CC1A4BD537E4AB51724F4A44FAA8408B763C768E981E610

Function 052F5560 Relevance: .0, Instructions: 14COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000011.00000002.1824413050.00000000052F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 052F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_52f0000_Client.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d77e2d1070e8352da05ceb0d3139cd5f0c57817db798fd1dad59f07b4c82668b
Instruction ID: df9cf24706ffcea8c47ad431a1f8e163b17a5f63c0ca1e2b1bba95b9cef189fa
Opcode Fuzzy Hash: d77e2d1070e8352da05ceb0d3139cd5f0c57817db798fd1dad59f07b4c82668b
Instruction Fuzzy Hash: D4D0123019D3D54FD75353B414526E87FE45F53314F1945EFC0C44F8A2C1850816DB12

Function 00F823BC Relevance: .0, Instructions: 14COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000011.00000002.1795336296.0000000000F82000.00000040.00000800.00020000.00000000.sdmp, Offset: 00F82000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_f82000_Client.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dd23c921052902b43099256f8e5a33153bd809d9af486856cb8a0244fdf50459
Instruction ID: ccdf14b242f7aa9c508a947a7b1f99197f58ae735694e825f87ef26c337328eb
Opcode Fuzzy Hash: dd23c921052902b43099256f8e5a33153bd809d9af486856cb8a0244fdf50459
Instruction Fuzzy Hash: 71D05E346006814BC766EA0CC6E4F9933E4AB40724F0644E8BC108B662C7A8E9C0EA00

Function 052F4E70 Relevance: .0, Instructions: 13COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000011.00000002.1824413050.00000000052F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 052F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_52f0000_Client.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 630a27e494a650a4d454b981b20731c977c1bbf08d2823bd3234a46af042d6ec
Instruction ID: 86fef5365556667c08fc66e98c54dbbf6e6c0ef4580cea1be78938f1d839660b
Opcode Fuzzy Hash: 630a27e494a650a4d454b981b20731c977c1bbf08d2823bd3234a46af042d6ec
Instruction Fuzzy Hash: 01D0A73008D3828FC772577088021947B709F52354B6401FFC05486D97D36E0422DB06

Function 051BAC40 Relevance: .0, Instructions: 12COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000011.00000002.1823727129.00000000051B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 051B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_51b0000_Client.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 03f17778bb394d58ddd734fb7e6e1aff387f3666b1d59397121bd54e685bf28e
Instruction ID: da23d23e900a20188ff1fbd9e5a08750271f83ce3600d5ca7b1f6f3d7dbc39aa
Opcode Fuzzy Hash: 03f17778bb394d58ddd734fb7e6e1aff387f3666b1d59397121bd54e685bf28e
Instruction Fuzzy Hash: F8C02B3130022813C61833CC78146DE324DC78B371F000037F51993341CD599F0127E5

Function 051B3355 Relevance: .0, Instructions: 12COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000011.00000002.1823727129.00000000051B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 051B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_51b0000_Client.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 18b62bfd39157b4c4738cc9f2a214444e2cffae1565caf987c0503e6d31837a2
Instruction ID: 5aa95d279e97108ea89b53824591eaf6f37a7e890f0543d8d2bbb3633642de8e
Opcode Fuzzy Hash: 18b62bfd39157b4c4738cc9f2a214444e2cffae1565caf987c0503e6d31837a2
Instruction Fuzzy Hash: B2D01734900218CBEB2ACB11CD94BE8B6BAAB98700F4184DAC00A6A550CB705B858F00

Function 052F6460 Relevance: .0, Instructions: 12COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000011.00000002.1824413050.00000000052F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 052F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_52f0000_Client.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9c30891d52bd6906faabdccbbef59b71515d21ca67b4b6f02601e1581bf97ba7
Instruction ID: 541797881b64eb286e4fb8567d986bb493ab78f6f897cd4ce67de75f74917176
Opcode Fuzzy Hash: 9c30891d52bd6906faabdccbbef59b71515d21ca67b4b6f02601e1581bf97ba7
Instruction Fuzzy Hash: C7C08C280CD3C54FCB03837238639953FB0490212430701FFC5849A8A3C29B0C83C702

Function 052F5500 Relevance: .0, Instructions: 11COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000011.00000002.1824413050.00000000052F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 052F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_52f0000_Client.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c33e83d5d9a1623cddefe071c0ca8bc1782ce731a13a2b8df0625c30fdb7b8d3
Instruction ID: f569e80bb3821d76c3ca0cd64ec06ab64da5dce6c0421272801969673265f349
Opcode Fuzzy Hash: c33e83d5d9a1623cddefe071c0ca8bc1782ce731a13a2b8df0625c30fdb7b8d3
Instruction Fuzzy Hash: 02C08C3808E3CA0FC70347B818E2094BF74AD6311830801EFD089C9D73C2984875CF02

Function 052F5070 Relevance: .0, Instructions: 11COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000011.00000002.1824413050.00000000052F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 052F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_52f0000_Client.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8b230d2d9d0bbc5f38ef4b8fbd621d02d362e1131232e79eafa64bb379725734
Instruction ID: 7b01a838c7996ca856d9032deba2ae6c1abd62e3fb3458a4ff3d15703b66e960
Opcode Fuzzy Hash: 8b230d2d9d0bbc5f38ef4b8fbd621d02d362e1131232e79eafa64bb379725734
Instruction Fuzzy Hash: 53C08C3008A385FFC7433FA0A4340503F30EA2326030600E7C044CA132D73A8C1ADF20

Function 052F4B82 Relevance: .0, Instructions: 11COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000011.00000002.1824413050.00000000052F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 052F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_52f0000_Client.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 025180e7d4054c40fe18bb91dc18b24a6a5e2e31c0f7a9789bda5274b014331a
Instruction ID: e7963bfde4e89c4641e32da96716f8aa665369fbdcc8f79efb5138489e24cb47
Opcode Fuzzy Hash: 025180e7d4054c40fe18bb91dc18b24a6a5e2e31c0f7a9789bda5274b014331a
Instruction Fuzzy Hash: 79C0122008D3A28FC71286B0A4A10CC7FA05D82228B1684EFC0848A8B2C2960806CB02

Function 051B7112 Relevance: .0, Instructions: 10COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000011.00000002.1823727129.00000000051B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 051B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_51b0000_Client.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7fa6fefe2ba4c04620c5c00d1f5b052ff2e07139043cb11729ff8bfe6ae79460
Instruction ID: c28f0dde6f74a20a2da70737504dff5567f8bd1d76b9d357a4cd845e808e7a7e
Opcode Fuzzy Hash: 7fa6fefe2ba4c04620c5c00d1f5b052ff2e07139043cb11729ff8bfe6ae79460
Instruction Fuzzy Hash: 36D0C974A001189FDB58DF74C9587EE77F6AB48300F0044AAA40AE2690DF784E819F62

Function 051B6F08 Relevance: .0, Instructions: 10COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000011.00000002.1823727129.00000000051B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 051B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_51b0000_Client.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 31d36de3a52159614a9ceb78a25f4dbf7d7e5cb726609df897b9154debc6db24
Instruction ID: ba2bece346f4ad1b94597bcca89696c478b0bcb66b5638cb197de7ff7dab53c6
Opcode Fuzzy Hash: 31d36de3a52159614a9ceb78a25f4dbf7d7e5cb726609df897b9154debc6db24
Instruction Fuzzy Hash: 6ED06C38A002188FDB64DB70D8586ADBBB2BB48305F11006AD45A936A0DF380A459F01

Function 052F54A0 Relevance: .0, Instructions: 10COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000011.00000002.1824413050.00000000052F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 052F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_52f0000_Client.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7f620bed93e7096fcc5e585c1dcdb5a9d0b5f148a6ecce017fb9b95cad646f79
Instruction ID: 0facb766e4a28e71673e8e8ae747c3146152367281174a2fdc38bae88eea2983
Opcode Fuzzy Hash: 7f620bed93e7096fcc5e585c1dcdb5a9d0b5f148a6ecce017fb9b95cad646f79
Instruction Fuzzy Hash: 2EC08C30089381DFCB138B6060A00D47FB0A92332031650E6C048C8472822A48A79314

Function 051BE1A8 Relevance: .0, Instructions: 9COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000011.00000002.1823727129.00000000051B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 051B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_51b0000_Client.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e57631ed4065a97c86bf99db06d99627e33bea76a9534130577dcb3039294ae4
Instruction ID: ab4cbc43261af4285d7cba619f56b4ae7442ea8f3501acb69ce537b4e6405863
Opcode Fuzzy Hash: e57631ed4065a97c86bf99db06d99627e33bea76a9534130577dcb3039294ae4
Instruction Fuzzy Hash: 74C08C300097CD4FE741136079083B27F9C2B05308F4C0083E48CC93E3C2969250A661

Function 052F4E98 Relevance: .0, Instructions: 9COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000011.00000002.1824413050.00000000052F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 052F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_52f0000_Client.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 56c889aeaf08befd17bb2476a8d9f4bb73971c58844b1b7d7685319481bdf838
Instruction ID: a937a3a14f5991ef02802dd849c54a24ee198ca5472dd8fc4f8aa065dd8d7b46
Opcode Fuzzy Hash: 56c889aeaf08befd17bb2476a8d9f4bb73971c58844b1b7d7685319481bdf838
Instruction Fuzzy Hash: 8BC09B76507745CFC7456B24945D09C7B34F95315235151E7D055C76E1DF350C17C710

Function 051B326C Relevance: .0, Instructions: 8COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000011.00000002.1823727129.00000000051B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 051B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_51b0000_Client.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b04fefedc8a75718dff228b6dada95f65be099271029bd110a96030eb1954053
Instruction ID: 2d78a505d9d13c63fc80dbb086507d4ef17d95df33b9fdfdc851b9c545632b5a
Opcode Fuzzy Hash: b04fefedc8a75718dff228b6dada95f65be099271029bd110a96030eb1954053
Instruction Fuzzy Hash: E9D0127454611ACAFB60CF18D8A4AFC7277BB01308F1288F4E069561E0CFB55EC28F41

Function 052F4BAA Relevance: .0, Instructions: 8COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000011.00000002.1824413050.00000000052F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 052F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_52f0000_Client.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9986b39328a69bc0d881b441c72dc90abb8464b23b0768863eb53d81a9d838bc
Instruction ID: 20a4176abd439e309bf8d3b311f595a8bb4abdcba487e491684b5568e71d8225
Opcode Fuzzy Hash: 9986b39328a69bc0d881b441c72dc90abb8464b23b0768863eb53d81a9d838bc
Instruction Fuzzy Hash: F4B0123444C34ADFCB505F7265874D87F60D951250314455EE4CA40451C76200038F01

Function 051BA4D8 Relevance: .0, Instructions: 6COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000011.00000002.1823727129.00000000051B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 051B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_51b0000_Client.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0ae5470f5cd491716fdcf4d336510e872230ca56bd4d6852792d0bcf09f87758
Instruction ID: f25ffc49cbec2349b736d12c0e713a1fc5176529f7862b815f6414f671ca4ff6
Opcode Fuzzy Hash: 0ae5470f5cd491716fdcf4d336510e872230ca56bd4d6852792d0bcf09f87758
Instruction Fuzzy Hash: 55A02230000A0C8F0A0033E2380C088330CBC8080CBC80002E00E00C028F88280022EF

Function 051BA228 Relevance: .0, Instructions: 6COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000011.00000002.1823727129.00000000051B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 051B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_51b0000_Client.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c2b739e6143de4b2e80f1910f2a15913308529585e9a6837397fe98f9abcd8c9
Instruction ID: ce9f0d320568e7aeddd1da0d443e20918fc001d358bb9c195afdc7c1ad0b123c
Opcode Fuzzy Hash: c2b739e6143de4b2e80f1910f2a15913308529585e9a6837397fe98f9abcd8c9
Instruction Fuzzy Hash: 32A011300002088BC200ABA8E008EA033ECAB08A08F0000F0A20C8BA228A22B8008A82

Function 051BE538 Relevance: .0, Instructions: 5COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000011.00000002.1823727129.00000000051B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 051B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_51b0000_Client.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8e98c9860a7f22163e59f15ed262f73daefc86796dad707b5e9b88af86b6f13e
Instruction ID: 9d821142478e74d77329c3627d4b2fcf62d4541ac1412170e832e5699d70044b
Opcode Fuzzy Hash: 8e98c9860a7f22163e59f15ed262f73daefc86796dad707b5e9b88af86b6f13e
Instruction Fuzzy Hash: 299002B204C60C8B465067D57849555775CE5446157840452A51D415115A5565105596

Function 051B65C1 Relevance: .0, Instructions: 5COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000011.00000002.1823727129.00000000051B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 051B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_51b0000_Client.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4ebc5c52c514c5deb14627b595ffd60ff121f563eaff7ee51110ab60c3758769
Instruction ID: 16c93520837dc66ca301fe21b894b64876a2cafa58c1a2ee6f1bdf0eb026c452
Opcode Fuzzy Hash: 4ebc5c52c514c5deb14627b595ffd60ff121f563eaff7ee51110ab60c3758769
Instruction Fuzzy Hash: 87B09278A0221A8BE728CF20C9DC6E97A77AB88318F024495808611540CBB80F81DE00

Function 051BE0A0 Relevance: .0, Instructions: 5COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000011.00000002.1823727129.00000000051B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 051B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_51b0000_Client.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6bcce5aa17bbed83a1cc6d4f9475a483793307674b67f11dd926e8c675b8726d
Instruction ID: da538d7e580d5e5f2acc07e488decdbf3f74f0b7542f831bfd79737a265d39eb
Opcode Fuzzy Hash: 6bcce5aa17bbed83a1cc6d4f9475a483793307674b67f11dd926e8c675b8726d
Instruction Fuzzy Hash: 3F90223000020C8B0000238B380A002B30C80000003800002A00C002020E00200000C0

Function 051BA0E0 Relevance: .0, Instructions: 5COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000011.00000002.1823727129.00000000051B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 051B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_51b0000_Client.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7ae22893bc31fd759c751dc3d03e8385d5bb029be5cb03ca12a67ddb13a8e68a
Instruction ID: 96b223807c3d53cc4e5904f79492d6240b70ff07a5af7b735c029b751b99e241
Opcode Fuzzy Hash: 7ae22893bc31fd759c751dc3d03e8385d5bb029be5cb03ca12a67ddb13a8e68a
Instruction Fuzzy Hash:

Function 051BE320 Relevance: .0, Instructions: 5COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000011.00000002.1823727129.00000000051B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 051B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_51b0000_Client.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2c9b5f062be7b978848a3858dc38da97bf94e9d0885e51654b803a29cb26630d
Instruction ID: 171da17bc08174ee9b0455745c7c31ab254d11a7195104f068bceea89a8a2be1
Opcode Fuzzy Hash: 2c9b5f062be7b978848a3858dc38da97bf94e9d0885e51654b803a29cb26630d
Instruction Fuzzy Hash: 5190023504660CAB45406796780A9957B5C95445267800052A50D416115A5569505995

Function 051BA350 Relevance: .0, Instructions: 5COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000011.00000002.1823727129.00000000051B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 051B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_51b0000_Client.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b32c70cb9de13c7b03c483e2c4538056d60f1a4654cfbdc4f05a535a34e6fc7f
Instruction ID: b92b9b45eabd30c34984c4522f5d0683330f3cd935538dcb754d25913d557ff7
Opcode Fuzzy Hash: b32c70cb9de13c7b03c483e2c4538056d60f1a4654cfbdc4f05a535a34e6fc7f
Instruction Fuzzy Hash:

Function 051B9E50 Relevance: .0, Instructions: 5COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000011.00000002.1823727129.00000000051B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 051B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_51b0000_Client.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b42ecf771e4a1293452b91c7402e0aa67c3356bed229c7ec795f6a2a7b1df377
Instruction ID: 6e1537b8c9726219141c9a5280b67a5dbed4f5c8ecd28ffd318faea9db88b680
Opcode Fuzzy Hash: b42ecf771e4a1293452b91c7402e0aa67c3356bed229c7ec795f6a2a7b1df377
Instruction Fuzzy Hash:

Analysis Process: Client.exePID: 4576, Parent PID: 3968COMMON

Execution Graph

Execution Coverage:	7.7%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	0%
Total number of Nodes:	64
Total number of Limit Nodes:	5

Executed Functions

Function 00DBB4CB Relevance: 1.6, APIs: 1, Instructions: 75
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

AdjustTokenPrivileges.KERNELBASE(?,?,?,?,?,?), ref: 00DBB54B

Memory Dump Source

Source File: 00000012.00000002.1898602721.0000000000DBA000.00000040.00000800.00020000.00000000.sdmp, Offset: 00DBA000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_dba000_Client.jbxd

Similarity

API ID: AdjustPrivilegesToken
String ID:
API String ID: 2874748243-0
Opcode ID: c93b9071a8bc6856d0b4a046232c754bf5d37076a7484df2d8a21f9520449078
Instruction ID: eef93997ee38a94b1daaf57454c4f07c59a57a8a947b988fa89bd68435c7915f
Opcode Fuzzy Hash: c93b9071a8bc6856d0b4a046232c754bf5d37076a7484df2d8a21f9520449078
Instruction Fuzzy Hash: D8218B755097809FEB228F25DC44B92BFF4AF06320F0884DAE9858B163D371A908DB62

Function 00DBA7AD Relevance: 1.6, APIs: 1, Instructions: 62nativeCOMMON

Download Yara Rule

APIs

NtQuerySystemInformation.NTDLL ref: 00DBA821

Memory Dump Source

Source File: 00000012.00000002.1898602721.0000000000DBA000.00000040.00000800.00020000.00000000.sdmp, Offset: 00DBA000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_dba000_Client.jbxd

Similarity

API ID: InformationQuerySystem
String ID:
API String ID: 3562636166-0
Opcode ID: d5dba3f8ec3aca9fe94ffca3cb617500ef333a1ab8f68a50318d769118de3ae1
Instruction ID: 9c074496a6da5534837f1d91e6a6774a86851f6e69758ee4993459494eb2c236
Opcode Fuzzy Hash: d5dba3f8ec3aca9fe94ffca3cb617500ef333a1ab8f68a50318d769118de3ae1
Instruction Fuzzy Hash: 5121AC7540D3C09FDB228B21DC80A92BFB0EF07210F0984CAE9854B563D265A809DB62

Function 00DBB502 Relevance: 1.6, APIs: 1, Instructions: 52COMMON

Download Yara Rule

APIs

AdjustTokenPrivileges.KERNELBASE(?,?,?,?,?,?), ref: 00DBB54B

Memory Dump Source

Source File: 00000012.00000002.1898602721.0000000000DBA000.00000040.00000800.00020000.00000000.sdmp, Offset: 00DBA000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_dba000_Client.jbxd

Similarity

API ID: AdjustPrivilegesToken
String ID:
API String ID: 2874748243-0
Opcode ID: 41960fc2c099ecd294806af890c0a1ddbc608516a52b1ad94278972c2134225f
Instruction ID: 61719b4dc6b85b19a3bcd301acc494bb03e49bf1ab2270f35fd20ecdaa4a679a
Opcode Fuzzy Hash: 41960fc2c099ecd294806af890c0a1ddbc608516a52b1ad94278972c2134225f
Instruction Fuzzy Hash: 6D113A75504644DFDB20CF55D884B96BBE8EB04320F08C4AADD868A651D375E418DA72

Function 00DBA7E6 Relevance: 1.5, APIs: 1, Instructions: 38nativeCOMMON

Download Yara Rule

APIs

NtQuerySystemInformation.NTDLL ref: 00DBA821

Memory Dump Source

Source File: 00000012.00000002.1898602721.0000000000DBA000.00000040.00000800.00020000.00000000.sdmp, Offset: 00DBA000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_dba000_Client.jbxd

Similarity

API ID: InformationQuerySystem
String ID:
API String ID: 3562636166-0
Opcode ID: e6deb06ee07c82fe119e3eb636f0b5efdaaa5be67acdf2a95201e620bea33f65
Instruction ID: 560c44ce4e01ff682b44a10e95bbc5af7c3f1ef4a6ef999f83d02392931b7e76
Opcode Fuzzy Hash: e6deb06ee07c82fe119e3eb636f0b5efdaaa5be67acdf2a95201e620bea33f65
Instruction Fuzzy Hash: B5018F39404640DFEB208F19D884B61FBE0EF08720F08C49ADE860A651D375A419DF72

Function 00DBA9CF Relevance: 1.6, APIs: 1, Instructions: 98
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateFileW.KERNELBASE(?,?,?,?,?,?), ref: 00DBAA85

Memory Dump Source

Source File: 00000012.00000002.1898602721.0000000000DBA000.00000040.00000800.00020000.00000000.sdmp, Offset: 00DBA000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_dba000_Client.jbxd

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: d8fc0377a23e45e7644e713771aa4fd3830417153f9813cba4a16a4d5bdb5a5f
Instruction ID: 5f593a830be05e12fd2a4df08bc9f359e85210b5fd794337cf3d6afb88d9d442
Opcode Fuzzy Hash: d8fc0377a23e45e7644e713771aa4fd3830417153f9813cba4a16a4d5bdb5a5f
Instruction Fuzzy Hash: DF318FB1405380AFE722CB25DD44B62BFF8EF06314F08849AE9858B652D375A909CB71

Function 00DBB722 Relevance: 1.6, APIs: 1, Instructions: 89
synchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateMutexW.KERNELBASE(?,?), ref: 00DBB7C9

Memory Dump Source

Source File: 00000012.00000002.1898602721.0000000000DBA000.00000040.00000800.00020000.00000000.sdmp, Offset: 00DBA000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_dba000_Client.jbxd

Similarity

API ID: CreateMutex
String ID:
API String ID: 1964310414-0
Opcode ID: 73bcefb45054baab07ffe05351152f05eee804ff3485d280662ed6b4905cb3c1
Instruction ID: e77aeaffab4a48eedd9780120a8d4d9ae73d0c3fdbfc4f8ccd9318c5daef7039
Opcode Fuzzy Hash: 73bcefb45054baab07ffe05351152f05eee804ff3485d280662ed6b4905cb3c1
Instruction Fuzzy Hash: 2F31AF75509380AFE711CB25CC44B96BFF8EF06324F08849AE985CB292D375E909CB71

Function 00DBA120 Relevance: 1.6, APIs: 1, Instructions: 84
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

FindNextFileW.KERNELBASE(?,00000E24,?,?), ref: 00DBA1C2

Memory Dump Source

Source File: 00000012.00000002.1898602721.0000000000DBA000.00000040.00000800.00020000.00000000.sdmp, Offset: 00DBA000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_dba000_Client.jbxd

Similarity

API ID: FileFindNext
String ID:
API String ID: 2029273394-0
Opcode ID: 150e158915ed470434288010f3491354529609966909e9a194e0958d9f74de00
Instruction ID: 51b7bfeeef8bac1d7c6b57697d26f3d57baea64f888132dde6e7bc126f564cea
Opcode Fuzzy Hash: 150e158915ed470434288010f3491354529609966909e9a194e0958d9f74de00
Instruction Fuzzy Hash: 8421917550D3C06FD3128B258C61BA6BFB4EF47610F0A84CBD8C4CF593D265A91AD7A2

Function 00DBAADC Relevance: 1.6, APIs: 1, Instructions: 80
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetFileType.KERNELBASE(?,00000E24,34FA8F71,00000000,00000000,00000000,00000000), ref: 00DBAB71

Memory Dump Source

Source File: 00000012.00000002.1898602721.0000000000DBA000.00000040.00000800.00020000.00000000.sdmp, Offset: 00DBA000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_dba000_Client.jbxd

Similarity

API ID: FileType
String ID:
API String ID: 3081899298-0
Opcode ID: aba100bfcb36d92d5e37290db7aca7687b319de6c2d0b1bbbc40bb65462b3551
Instruction ID: 45afe6a7d00c0fc7b8f015efe7babde5bf97a8887c291314be25a05c92a1d141
Opcode Fuzzy Hash: aba100bfcb36d92d5e37290db7aca7687b319de6c2d0b1bbbc40bb65462b3551
Instruction Fuzzy Hash: 612107B54097806FE7138B25DC45BA2BFBCEF47724F0980DAE9818B193D264A909CB75

Function 00DBB0ED Relevance: 1.6, APIs: 1, Instructions: 79
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegQueryValueExW.KERNELBASE(?,00000E24,34FA8F71,00000000,00000000,00000000,00000000), ref: 00DBB18C

Memory Dump Source

Source File: 00000012.00000002.1898602721.0000000000DBA000.00000040.00000800.00020000.00000000.sdmp, Offset: 00DBA000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_dba000_Client.jbxd

Similarity

API ID: QueryValue
String ID:
API String ID: 3660427363-0
Opcode ID: e7994e3a0cd46a75fa9e2025b330503951a381e3d541ad33b7365c171c61ef3f
Instruction ID: fbf225b29aa3119e238168df6cf97a9f58f338b2e4b4fdfe255bfd5d50d4b58a
Opcode Fuzzy Hash: e7994e3a0cd46a75fa9e2025b330503951a381e3d541ad33b7365c171c61ef3f
Instruction Fuzzy Hash: 4B218D75504740AFE721CA15CC84FA7BBECEF05360F08849AE9868B252D364E908CB71

Function 00DBB1E2 Relevance: 1.6, APIs: 1, Instructions: 77
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegSetValueExW.KERNELBASE(?,00000E24,34FA8F71,00000000,00000000,00000000,00000000), ref: 00DBB278

Memory Dump Source

Source File: 00000012.00000002.1898602721.0000000000DBA000.00000040.00000800.00020000.00000000.sdmp, Offset: 00DBA000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_dba000_Client.jbxd

Similarity

API ID: Value
String ID:
API String ID: 3702945584-0
Opcode ID: 4830ceb3dc02c945447eecf90da24d3bed66d8e8bc499f063606185c524566b7
Instruction ID: f8f21eeb1fae5796a1e27bb9ae8dc16b1db5ac38a5c92833192f9b5d83100340
Opcode Fuzzy Hash: 4830ceb3dc02c945447eecf90da24d3bed66d8e8bc499f063606185c524566b7
Instruction Fuzzy Hash: F321B272508380AFD7228B11CC45FA7BFB8DF46320F08849BE9858B152D364E808CB75

Function 00DBAA06 Relevance: 1.6, APIs: 1, Instructions: 76
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateFileW.KERNELBASE(?,?,?,?,?,?), ref: 00DBAA85

Memory Dump Source

Source File: 00000012.00000002.1898602721.0000000000DBA000.00000040.00000800.00020000.00000000.sdmp, Offset: 00DBA000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_dba000_Client.jbxd

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: fdab69151506cc3cfa828b2ba5036a28629c0b637558c3a1a6434d49a7600342
Instruction ID: 9f03b71641e64695f0c8c17330d5201aa95d7421aafc9e49d267fe0ecbf02c53
Opcode Fuzzy Hash: fdab69151506cc3cfa828b2ba5036a28629c0b637558c3a1a6434d49a7600342
Instruction Fuzzy Hash: A1218171504244AFEB20CF29DD45B66FBE8EF04324F08885DEA868B651E375E914CB72

Function 00DBB756 Relevance: 1.6, APIs: 1, Instructions: 72
synchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateMutexW.KERNELBASE(?,?), ref: 00DBB7C9

Memory Dump Source

Source File: 00000012.00000002.1898602721.0000000000DBA000.00000040.00000800.00020000.00000000.sdmp, Offset: 00DBA000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_dba000_Client.jbxd

Similarity

API ID: CreateMutex
String ID:
API String ID: 1964310414-0
Opcode ID: feca221d07fc4a1ce15eefd2badedf3719c7a9d08406e2405b8d9c7a7af84151
Instruction ID: bb60d67a5a33f3de25691bc49b2d6d357d50ad76e01b9670b63fcb63f6cb7c16
Opcode Fuzzy Hash: feca221d07fc4a1ce15eefd2badedf3719c7a9d08406e2405b8d9c7a7af84151
Instruction Fuzzy Hash: 2D21CF75504200AFE720DF25CC45BA6FBE8EF44324F08C8AEE9858B241D7B5E805CB71

Function 00DBAF56 Relevance: 1.6, APIs: 1, Instructions: 72
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetLogicalDrives.KERNELBASE ref: 00DBAFDD

Memory Dump Source

Source File: 00000012.00000002.1898602721.0000000000DBA000.00000040.00000800.00020000.00000000.sdmp, Offset: 00DBA000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_dba000_Client.jbxd

Similarity

API ID: DrivesLogical
String ID:
API String ID: 999431828-0
Opcode ID: 781dc2e78eeca60cdaf9ec9428664269bcf015a321cf6f87892369ce4e6c27e1
Instruction ID: 956d43e66e766b58c3465b72085096da773af90bb96a3a75baf750218aedc8aa
Opcode Fuzzy Hash: 781dc2e78eeca60cdaf9ec9428664269bcf015a321cf6f87892369ce4e6c27e1
Instruction Fuzzy Hash: AE21367540E3C09FD7138B209C65692BFB4EF03220F0A84DBD985CF1A3D2696809CB72

Function 00DBAC8E Relevance: 1.6, APIs: 1, Instructions: 70
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

ReadFile.KERNELBASE(?,00000E24,34FA8F71,00000000,00000000,00000000,00000000), ref: 00DBAD0D

Memory Dump Source

Source File: 00000012.00000002.1898602721.0000000000DBA000.00000040.00000800.00020000.00000000.sdmp, Offset: 00DBA000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_dba000_Client.jbxd

Similarity

API ID: FileRead
String ID:
API String ID: 2738559852-0
Opcode ID: cf549672f50c2eb9dd9209aa212341f05023864974834c6eb37e5af8c3159732
Instruction ID: 8635c901fc93aa2b6212ffe12abe88efcd872107a335f49f2b42842cfc30db9e
Opcode Fuzzy Hash: cf549672f50c2eb9dd9209aa212341f05023864974834c6eb37e5af8c3159732
Instruction Fuzzy Hash: BC219F75409380AFDB22CF51DC44FA6FFB8EF45320F08849AEA859B552D275A508CBB6

Function 00DBB112 Relevance: 1.6, APIs: 1, Instructions: 69
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegQueryValueExW.KERNELBASE(?,00000E24,34FA8F71,00000000,00000000,00000000,00000000), ref: 00DBB18C

Memory Dump Source

Source File: 00000012.00000002.1898602721.0000000000DBA000.00000040.00000800.00020000.00000000.sdmp, Offset: 00DBA000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_dba000_Client.jbxd

Similarity

API ID: QueryValue
String ID:
API String ID: 3660427363-0
Opcode ID: 84107125db2e4cefc797bb92c4f27f19f7d47a3c3c65ea7a5c3f9c1f94748584
Instruction ID: efe5ae61c9d464e85501d78fbc154042f211dbc412c77b3325562eec1ca4ff85
Opcode Fuzzy Hash: 84107125db2e4cefc797bb92c4f27f19f7d47a3c3c65ea7a5c3f9c1f94748584
Instruction Fuzzy Hash: E5216D75604704AFE720CE19CC84FA7B7ECEF04760F08C45AEA868B651D7B4E908CAB1

Function 00DBB598 Relevance: 1.6, APIs: 1, Instructions: 68
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

FindCloseChangeNotification.KERNELBASE(?), ref: 00DBB604

Memory Dump Source

Source File: 00000012.00000002.1898602721.0000000000DBA000.00000040.00000800.00020000.00000000.sdmp, Offset: 00DBA000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_dba000_Client.jbxd

Similarity

API ID: ChangeCloseFindNotification
String ID:
API String ID: 2591292051-0
Opcode ID: 8d8eaf40c8829fcc135591afd6d6b9611a33f229792a73d9a07d6809dcf0c46b
Instruction ID: 36ae286a11e8defb5135ee5cf73c6f9a9ffa595a29c69f14701d2295386ce3c8
Opcode Fuzzy Hash: 8d8eaf40c8829fcc135591afd6d6b9611a33f229792a73d9a07d6809dcf0c46b
Instruction Fuzzy Hash: 4021A1755093C09FDB128F25DC94792BFB4AF07324F0D84DAE8858F263D265A908CB62

Function 00DBB024 Relevance: 1.6, APIs: 1, Instructions: 66
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CopyFileW.KERNELBASE(?,?,?), ref: 00DBB092

Memory Dump Source

Source File: 00000012.00000002.1898602721.0000000000DBA000.00000040.00000800.00020000.00000000.sdmp, Offset: 00DBA000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_dba000_Client.jbxd

Similarity

API ID: CopyFile
String ID:
API String ID: 1304948518-0
Opcode ID: 8df01aec510643cad9c0df2c074e5cd1d23b32bca9070d57deadefb1ca3e3ed2
Instruction ID: bffe8a262ec741028d9ee95e3d790dbc288ecc920b95ca35d1e66ea5b02ca5b8
Opcode Fuzzy Hash: 8df01aec510643cad9c0df2c074e5cd1d23b32bca9070d57deadefb1ca3e3ed2
Instruction Fuzzy Hash: E92151755093809FDB11CF65DC95BA7BFE8EF06220F0C84AAE985CB252D365E848CB61

Function 00DBB206 Relevance: 1.6, APIs: 1, Instructions: 65
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegSetValueExW.KERNELBASE(?,00000E24,34FA8F71,00000000,00000000,00000000,00000000), ref: 00DBB278

Memory Dump Source

Source File: 00000012.00000002.1898602721.0000000000DBA000.00000040.00000800.00020000.00000000.sdmp, Offset: 00DBA000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_dba000_Client.jbxd

Similarity

API ID: Value
String ID:
API String ID: 3702945584-0
Opcode ID: 76f21b921fc6af3dd53b753ebc22c53c1bbf2c49965c601062031f09662802a7
Instruction ID: dfba3c614b987a20eed1410e724453f42f0dfd5261af8988a055d49d28df50c6
Opcode Fuzzy Hash: 76f21b921fc6af3dd53b753ebc22c53c1bbf2c49965c601062031f09662802a7
Instruction Fuzzy Hash: 1611BE75504600AFEB208E11CC41FAABBECEF14724F08C45AEE868A651D3B4E8048AB9

Function 00DBB362 Relevance: 1.6, APIs: 1, Instructions: 64COMMON

Download Yara Rule

APIs

LookupPrivilegeValueW.ADVAPI32(?,?,?), ref: 00DBB3CA

Memory Dump Source

Source File: 00000012.00000002.1898602721.0000000000DBA000.00000040.00000800.00020000.00000000.sdmp, Offset: 00DBA000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_dba000_Client.jbxd

Similarity

API ID: LookupPrivilegeValue
String ID:
API String ID: 3899507212-0
Opcode ID: 3ceae84a3dafe0a1b8bf874d20303a8015caf2733d8729c2f7c7e460abec1ccd
Instruction ID: 3d46a71f5a5bbfa2b22b7be65373ea6e80858a977090038912a4a2cb71bec793
Opcode Fuzzy Hash: 3ceae84a3dafe0a1b8bf874d20303a8015caf2733d8729c2f7c7e460abec1ccd
Instruction Fuzzy Hash: 7D1151755053409FDB21CF25DC44B52BFE8EF45620F0884AEED45CB252D3A5E804CB71

Function 00DBA5D5 Relevance: 1.6, APIs: 1, Instructions: 61COMMON

Download Yara Rule

APIs

FindCloseChangeNotification.KERNELBASE(?), ref: 00DBA638

Memory Dump Source

Source File: 00000012.00000002.1898602721.0000000000DBA000.00000040.00000800.00020000.00000000.sdmp, Offset: 00DBA000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_dba000_Client.jbxd

Similarity

API ID: ChangeCloseFindNotification
String ID:
API String ID: 2591292051-0
Opcode ID: 17592a2d44d665219041b634d4f202aa72888186efc9f13802ecd18b931a1f39
Instruction ID: a43a7135ee16f613633ca56bf7d20730dcb4c974e4aab67deabdbea23c4ac249
Opcode Fuzzy Hash: 17592a2d44d665219041b634d4f202aa72888186efc9f13802ecd18b931a1f39
Instruction Fuzzy Hash: 8F117F754093C09FD7128F25DC55792BFB4EF06220F0984EBDD858F163D269A948CB62

Function 00DBACAE Relevance: 1.6, APIs: 1, Instructions: 60fileCOMMON

Download Yara Rule

APIs

ReadFile.KERNELBASE(?,00000E24,34FA8F71,00000000,00000000,00000000,00000000), ref: 00DBAD0D

Memory Dump Source

Source File: 00000012.00000002.1898602721.0000000000DBA000.00000040.00000800.00020000.00000000.sdmp, Offset: 00DBA000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_dba000_Client.jbxd

Similarity

API ID: FileRead
String ID:
API String ID: 2738559852-0
Opcode ID: c3edc299018e2d3827c9ea3e43021bc430139632ec9292ed8b36a2651c1556a6
Instruction ID: 7d96225a7837e1134b8ea09f305016372766fc42c3249375e04e089d0e0a8048
Opcode Fuzzy Hash: c3edc299018e2d3827c9ea3e43021bc430139632ec9292ed8b36a2651c1556a6
Instruction Fuzzy Hash: 00110175404204EFEB21CF55DC80FAAFBE8EF44324F08C85AEA858B651D375A404CBB6

Function 00DBB04A Relevance: 1.6, APIs: 1, Instructions: 53fileCOMMON

Download Yara Rule

APIs

CopyFileW.KERNELBASE(?,?,?), ref: 00DBB092

Memory Dump Source

Source File: 00000012.00000002.1898602721.0000000000DBA000.00000040.00000800.00020000.00000000.sdmp, Offset: 00DBA000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_dba000_Client.jbxd

Similarity

API ID: CopyFile
String ID:
API String ID: 1304948518-0
Opcode ID: 990c8b7015d41c4e98130deb8cdcf0e8e6b70f44c9e9abae86b6ec8617c939be
Instruction ID: 8061ff10da4d1ef7de71011758338b7543c72d0b7df480176036bd8446f97e4a
Opcode Fuzzy Hash: 990c8b7015d41c4e98130deb8cdcf0e8e6b70f44c9e9abae86b6ec8617c939be
Instruction Fuzzy Hash: 35117075504640CFDB10DF25D8857A6FBE8EF05320F08C4AADD56CB241D7B5E804DA71

Function 00DBB382 Relevance: 1.6, APIs: 1, Instructions: 53COMMON

Download Yara Rule

APIs

LookupPrivilegeValueW.ADVAPI32(?,?,?), ref: 00DBB3CA

Memory Dump Source

Source File: 00000012.00000002.1898602721.0000000000DBA000.00000040.00000800.00020000.00000000.sdmp, Offset: 00DBA000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_dba000_Client.jbxd

Similarity

API ID: LookupPrivilegeValue
String ID:
API String ID: 3899507212-0
Opcode ID: 990c8b7015d41c4e98130deb8cdcf0e8e6b70f44c9e9abae86b6ec8617c939be
Instruction ID: bb3e67a0100d56cb23fab4cb1f980ccd49dac625951f011271fbf36c3ea4deff
Opcode Fuzzy Hash: 990c8b7015d41c4e98130deb8cdcf0e8e6b70f44c9e9abae86b6ec8617c939be
Instruction Fuzzy Hash: 64112E75604640CFEB60DF25D885796BBE8EB44224F08C4AADD46CB242D7B5E8449A71

Function 00DBAEC8 Relevance: 1.6, APIs: 1, Instructions: 52COMMON

Download Yara Rule

APIs

FindClose.KERNELBASE(?), ref: 00DBAF1C

Memory Dump Source

Source File: 00000012.00000002.1898602721.0000000000DBA000.00000040.00000800.00020000.00000000.sdmp, Offset: 00DBA000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_dba000_Client.jbxd

Similarity

API ID: CloseFind
String ID:
API String ID: 1863332320-0
Opcode ID: cc0d98e38f3530fb50612c0ddc36d3fa2b180763b5cb37184c16948b566354f0
Instruction ID: 3c63e4feebdce4a2322de3c414a367635f88cdbb6dd5e707490aeb7cc7469607
Opcode Fuzzy Hash: cc0d98e38f3530fb50612c0ddc36d3fa2b180763b5cb37184c16948b566354f0
Instruction Fuzzy Hash: 8611A5755093809FDB128F15DC94B52FFB4DF06620F0C80DEED858B293D265A948CB62

Function 00DBAB1E Relevance: 1.6, APIs: 1, Instructions: 52COMMON

Download Yara Rule

APIs

GetFileType.KERNELBASE(?,00000E24,34FA8F71,00000000,00000000,00000000,00000000), ref: 00DBAB71

Memory Dump Source

Source File: 00000012.00000002.1898602721.0000000000DBA000.00000040.00000800.00020000.00000000.sdmp, Offset: 00DBA000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_dba000_Client.jbxd

Similarity

API ID: FileType
String ID:
API String ID: 3081899298-0
Opcode ID: 184719ad9cbfd804774dcd7bc76a13e8cadb33dc60835e8c3fed61787e8a1915
Instruction ID: c7d1076e742fd50fa003c0cae4a595aa299b0cafc69a8dbc8f9d68b9133a6672
Opcode Fuzzy Hash: 184719ad9cbfd804774dcd7bc76a13e8cadb33dc60835e8c3fed61787e8a1915
Instruction Fuzzy Hash: C101D675504604AEE720CF19DC84FB6F7E8DF54724F18C09AEE858B241D374E5048EBA

Function 00DBA547 Relevance: 1.6, APIs: 1, Instructions: 50COMMON

Download Yara Rule

APIs

SetErrorMode.KERNELBASE(?), ref: 00DBA5A4

Memory Dump Source

Source File: 00000012.00000002.1898602721.0000000000DBA000.00000040.00000800.00020000.00000000.sdmp, Offset: 00DBA000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_dba000_Client.jbxd

Similarity

API ID: ErrorMode
String ID:
API String ID: 2340568224-0
Opcode ID: 3bea1223a1437081be7c7de6c1d214d901ba1aac15d0726117adaf13525d7e28
Instruction ID: b44d626a68b18ad41cff25b9e5b5d16b6a16e1ec7d2ecafe99cb33ff464439bb
Opcode Fuzzy Hash: 3bea1223a1437081be7c7de6c1d214d901ba1aac15d0726117adaf13525d7e28
Instruction Fuzzy Hash: 8C1182B5405380AFD7228F15DC44B62FFF8EF46224F0984DAED858B262D275A948CB72

Function 00DBA172 Relevance: 1.5, APIs: 1, Instructions: 47fileCOMMON

Download Yara Rule

APIs

FindNextFileW.KERNELBASE(?,00000E24,?,?), ref: 00DBA1C2

Memory Dump Source

Source File: 00000012.00000002.1898602721.0000000000DBA000.00000040.00000800.00020000.00000000.sdmp, Offset: 00DBA000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_dba000_Client.jbxd

Similarity

API ID: FileFindNext
String ID:
API String ID: 2029273394-0
Opcode ID: f2c45c2dde67cbaa5b5ed95763a7a0252ad31e80402021ec2adffc5d1f64b8b4
Instruction ID: 0ea3a370410cd2cd105c009f53e74b3855d40918eb1a00e154f6f75eaf118ddb
Opcode Fuzzy Hash: f2c45c2dde67cbaa5b5ed95763a7a0252ad31e80402021ec2adffc5d1f64b8b4
Instruction Fuzzy Hash: 5C01D475500200AFD710DF16CC45B26FBE8FB88A20F14855AED489B741D731F915CBE5

Function 00DBB5D2 Relevance: 1.5, APIs: 1, Instructions: 43COMMON

Download Yara Rule

APIs

FindCloseChangeNotification.KERNELBASE(?), ref: 00DBB604

Memory Dump Source

Source File: 00000012.00000002.1898602721.0000000000DBA000.00000040.00000800.00020000.00000000.sdmp, Offset: 00DBA000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_dba000_Client.jbxd

Similarity

API ID: ChangeCloseFindNotification
String ID:
API String ID: 2591292051-0
Opcode ID: 23580f931285462908d73f594e5c69137915d21b9205f85140812fe923d5397c
Instruction ID: 1a102ea28ae3b4a414efbc3b717b317263c95393f1053d81821936d1056dcf5c
Opcode Fuzzy Hash: 23580f931285462908d73f594e5c69137915d21b9205f85140812fe923d5397c
Instruction Fuzzy Hash: 24019E75505640CFDB10CF19D884792BBE4DB40320F08C4AADD4A8F641D3B5E854DA72

Function 00DBA606 Relevance: 1.5, APIs: 1, Instructions: 43COMMON

Download Yara Rule

APIs

FindCloseChangeNotification.KERNELBASE(?), ref: 00DBA638

Memory Dump Source

Source File: 00000012.00000002.1898602721.0000000000DBA000.00000040.00000800.00020000.00000000.sdmp, Offset: 00DBA000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_dba000_Client.jbxd

Similarity

API ID: ChangeCloseFindNotification
String ID:
API String ID: 2591292051-0
Opcode ID: 4c3ae09f886b7e78b60e4c875e09833ef038281d404a1b756706ca7b9c6d3577
Instruction ID: 7f47a5cb0c28534380e840f95ba8cc1d442b5b9935029acebc126d21883030d3
Opcode Fuzzy Hash: 4c3ae09f886b7e78b60e4c875e09833ef038281d404a1b756706ca7b9c6d3577
Instruction Fuzzy Hash: E9018475505640CFDB10CF19D8857A5FBE4DF44320F1CC4AADD468B251D279E854DE62

Function 00DBAEEA Relevance: 1.5, APIs: 1, Instructions: 39COMMON

Download Yara Rule

APIs

FindClose.KERNELBASE(?), ref: 00DBAF1C

Memory Dump Source

Source File: 00000012.00000002.1898602721.0000000000DBA000.00000040.00000800.00020000.00000000.sdmp, Offset: 00DBA000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_dba000_Client.jbxd

Similarity

API ID: CloseFind
String ID:
API String ID: 1863332320-0
Opcode ID: 79bc9e158be5375beb88d16beec79c515d24bb7dca73e46e2891f9def3326129
Instruction ID: a160bd6e1e435ef1e469f15e17c7b52e85b09bd945150e20ca28b770d81aea54
Opcode Fuzzy Hash: 79bc9e158be5375beb88d16beec79c515d24bb7dca73e46e2891f9def3326129
Instruction Fuzzy Hash: 5301D174504640CFDB108F19D8847A5FBE4DF08720F08C0EAED4A8B252D279E848CEA2

Function 00DBAFAE Relevance: 1.5, APIs: 1, Instructions: 38COMMON

Download Yara Rule

APIs

GetLogicalDrives.KERNELBASE ref: 00DBAFDD

Memory Dump Source

Source File: 00000012.00000002.1898602721.0000000000DBA000.00000040.00000800.00020000.00000000.sdmp, Offset: 00DBA000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_dba000_Client.jbxd

Similarity

API ID: DrivesLogical
String ID:
API String ID: 999431828-0
Opcode ID: 2f4329b8ca299f42ad16699f5c203437a9cc45886ca74589fb47735d2988907e
Instruction ID: 1b14eff08e6c960bc9d91eccdc83e8f7666e84f9bac90eca6edc7db26e445043
Opcode Fuzzy Hash: 2f4329b8ca299f42ad16699f5c203437a9cc45886ca74589fb47735d2988907e
Instruction Fuzzy Hash: BD016D74805244CFDB10DF19D8847A6BBE4DF45724F08C4AADE898F256D3B9E4449EB2

Function 00DBA572 Relevance: 1.5, APIs: 1, Instructions: 35COMMON

Download Yara Rule

APIs

SetErrorMode.KERNELBASE(?), ref: 00DBA5A4

Memory Dump Source

Source File: 00000012.00000002.1898602721.0000000000DBA000.00000040.00000800.00020000.00000000.sdmp, Offset: 00DBA000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_dba000_Client.jbxd

Similarity

API ID: ErrorMode
String ID:
API String ID: 2340568224-0
Opcode ID: 72b7254623319c7cd8b3098e1974bccc921c00fe709f2e3dbc94c959724ba5f1
Instruction ID: 9d0ccdd11fa772d0d112d2369897e8e78987f9894877de5a50258fe26decd8f2
Opcode Fuzzy Hash: 72b7254623319c7cd8b3098e1974bccc921c00fe709f2e3dbc94c959724ba5f1
Instruction Fuzzy Hash: 44F08C74404640DFDB208F19D884765FBE4EF04324F08C09ADD8A4B656E6B9E958CEA2

Function 01290090 Relevance: 1.4, Strings: 1, Instructions: 104COMMON

Download Yara Rule

Strings

:@zl, xrefs: 0129016D

Memory Dump Source

Source File: 00000012.00000002.1903357646.0000000001290000.00000040.00000800.00020000.00000000.sdmp, Offset: 01290000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_1290000_Client.jbxd

Similarity

API ID:
String ID: :@zl
API String ID: 0-1604122134
Opcode ID: 91d32cf591326bcda7af669dabac56df29e6e79d881afe5f3ef7b300497a3c72
Instruction ID: cbe1ecc06521fb102b84b66ff6b26e4ade617f9b01d75cbfb7d579f88e509c03
Opcode Fuzzy Hash: 91d32cf591326bcda7af669dabac56df29e6e79d881afe5f3ef7b300497a3c72
Instruction Fuzzy Hash: 63419235504382CBDB04EB79E986B99FBE2AF84308F45C128D605DB368DF7449068BB5

Function 050256D7 Relevance: 1.3, Strings: 1, Instructions: 23COMMON

Download Yara Rule

Strings

D, xrefs: 05025704

Memory Dump Source

Source File: 00000012.00000002.1933750537.0000000005020000.00000040.00000800.00020000.00000000.sdmp, Offset: 05020000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_5020000_Client.jbxd

Similarity

API ID:
String ID: D
API String ID: 0-2746444292
Opcode ID: 98e3490288e4a19f6b52d6ac71421b17dc744d19839fa9a5f822deb7dc011f53
Instruction ID: 471f6042ae07251542276607493c0cf4829720fc90da0b21f939f836ce59a9c4
Opcode Fuzzy Hash: 98e3490288e4a19f6b52d6ac71421b17dc744d19839fa9a5f822deb7dc011f53
Instruction Fuzzy Hash: A5E09A70905382CFC7028BA4A958ADC3BB2AF02321B1541DAE446DE612DBBC094B8B26

Function 05025858 Relevance: 1.3, Strings: 1, Instructions: 19COMMON

Download Yara Rule

Strings

E, xrefs: 05025858

Memory Dump Source

Source File: 00000012.00000002.1933750537.0000000005020000.00000040.00000800.00020000.00000000.sdmp, Offset: 05020000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_5020000_Client.jbxd

Similarity

API ID:
String ID: E
API String ID: 0-3568589458
Opcode ID: 9ef776fe2a41d8d5786073371cefff8ccf608c5bab7f6a7e3e7901eee1eb58cc
Instruction ID: c0dbca6e941b22631a7665429de66c31b8ce44790a3506e1143bc485197c4bc7
Opcode Fuzzy Hash: 9ef776fe2a41d8d5786073371cefff8ccf608c5bab7f6a7e3e7901eee1eb58cc
Instruction Fuzzy Hash: 84E0CDB0D05655DFD701CBA8EC557AC7FB1FB41315F14015AC402D9341DF7C49499B15

Function 05025E57 Relevance: 1.3, Strings: 1, Instructions: 19COMMON

Download Yara Rule

Strings

2, xrefs: 05025E89

Memory Dump Source

Source File: 00000012.00000002.1933750537.0000000005020000.00000040.00000800.00020000.00000000.sdmp, Offset: 05020000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_5020000_Client.jbxd

Similarity

API ID:
String ID: 2
API String ID: 0-450215437
Opcode ID: 5dc9cfb0ada50c91701cd3b0f4070ae776308e2cc14a6e7e25faeeeb7e9404e6
Instruction ID: 15d4d2e0fcd620822c8758eaa201bcc4ccd75e51030209da981e99db85e04ffb
Opcode Fuzzy Hash: 5dc9cfb0ada50c91701cd3b0f4070ae776308e2cc14a6e7e25faeeeb7e9404e6
Instruction Fuzzy Hash: D1E04F70506356CFDB05EFA4EA489ACBBB2EF44301F108596D402EF651DF7C8A0ADB15

Function 05025F6B Relevance: 1.3, Strings: 1, Instructions: 18COMMON

Download Yara Rule

Strings

,, xrefs: 05025F98

Memory Dump Source

Source File: 00000012.00000002.1933750537.0000000005020000.00000040.00000800.00020000.00000000.sdmp, Offset: 05020000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_5020000_Client.jbxd

Similarity

API ID:
String ID: ,
API String ID: 0-3772416878
Opcode ID: a8455f7e3b6a8da529d5288e76f4d3e8826b5bb755d6912167c089a316fc9b74
Instruction ID: 07950ec99d8ca2edad329f7f19c90170bac373f8f84940138fc6c8ac4c6ce16f
Opcode Fuzzy Hash: a8455f7e3b6a8da529d5288e76f4d3e8826b5bb755d6912167c089a316fc9b74
Instruction Fuzzy Hash: 6CE02B308553188FCB009B34D5193CC77B0EF0A320F2081C7C8878F766EE3805469B09

Function 0502596E Relevance: 1.3, Strings: 1, Instructions: 17COMMON

Download Yara Rule

Strings

<, xrefs: 0502573C

Memory Dump Source

Source File: 00000012.00000002.1933750537.0000000005020000.00000040.00000800.00020000.00000000.sdmp, Offset: 05020000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_5020000_Client.jbxd

Similarity

API ID:
String ID: <
API String ID: 0-4251816714
Opcode ID: 2111c12ee98838615c6cc823fc06a3cf76e888afe1667e4c1ed3fa4e36d1de1c
Instruction ID: febe83e728726d198c51709adbe80cc9f29f6d37e4912717dd9cc300c85cf028
Opcode Fuzzy Hash: 2111c12ee98838615c6cc823fc06a3cf76e888afe1667e4c1ed3fa4e36d1de1c
Instruction Fuzzy Hash: DCE0BF7490525ACBDB04DFA4EA48A6C77B6FB44341F108459D803EE780DF7C8A49DB25

Function 0502615D Relevance: 1.3, Strings: 1, Instructions: 16COMMON

Download Yara Rule

Strings

f, xrefs: 0502615D

Memory Dump Source

Source File: 00000012.00000002.1933750537.0000000005020000.00000040.00000800.00020000.00000000.sdmp, Offset: 05020000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_5020000_Client.jbxd

Similarity

API ID:
String ID: f
API String ID: 0-1993550816
Opcode ID: 44300eb5b4ee1ea8d83b63a13aa5ddcd3830ac676b701459a4a243f3c5c54b57
Instruction ID: 1a955738787bb9852a2975e0584cf3b0202a18da7afd64a95e9e684a1640df5b
Opcode Fuzzy Hash: 44300eb5b4ee1ea8d83b63a13aa5ddcd3830ac676b701459a4a243f3c5c54b57
Instruction Fuzzy Hash: 9FE0EC70E01256CBDF04DFE5E9488ADB7B7AB84301B208065D802EE354EF794A05CE24

Function 050258F8 Relevance: 1.3, Strings: 1, Instructions: 11COMMON

Download Yara Rule

Strings

., xrefs: 0502590E

Memory Dump Source

Source File: 00000012.00000002.1933750537.0000000005020000.00000040.00000800.00020000.00000000.sdmp, Offset: 05020000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_5020000_Client.jbxd

Similarity

API ID:
String ID: .
API String ID: 0-248832578
Opcode ID: dd0a1a6e3a429523b2b650148c809dc19810acea84c89815c1be9ff9576b005d
Instruction ID: 1c78a2bce9d358e3752417b2fff09282cee5ee6c80dc9ca71876220f85d093f4
Opcode Fuzzy Hash: dd0a1a6e3a429523b2b650148c809dc19810acea84c89815c1be9ff9576b005d
Instruction Fuzzy Hash: 4ED0C974945296CFDB04DFE8E94C9AC7BB2EB44301F20445AD403EA790CFBC4A859E25

Function 05025726 Relevance: 1.3, Strings: 1, Instructions: 11COMMON

Download Yara Rule

Strings

<, xrefs: 0502573C

Memory Dump Source

Source File: 00000012.00000002.1933750537.0000000005020000.00000040.00000800.00020000.00000000.sdmp, Offset: 05020000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_5020000_Client.jbxd

Similarity

API ID:
String ID: <
API String ID: 0-4251816714
Opcode ID: 8b2cd9067d9a37d31b79bf5535b3a68e56dc482e872b036977f341a96a000000
Instruction ID: 194e494143397ff2c3cbb2e284aa05c0764076ca82e68db70a717fcf25a214eb
Opcode Fuzzy Hash: 8b2cd9067d9a37d31b79bf5535b3a68e56dc482e872b036977f341a96a000000
Instruction Fuzzy Hash: AAD0927490225ACBDB04DFA4E9489AC7BB2EB44301B20846AD803EA740CF784A4ADB25

Function 05025ECD Relevance: 1.3, Strings: 1, Instructions: 11COMMON

Download Yara Rule

Strings

%, xrefs: 05025EE9

Memory Dump Source

Source File: 00000012.00000002.1933750537.0000000005020000.00000040.00000800.00020000.00000000.sdmp, Offset: 05020000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_5020000_Client.jbxd

Similarity

API ID:
String ID: %
API String ID: 0-2567322570
Opcode ID: b2976c15dae93aaefe9565690aef1675123bc681f2d93df526ce1ae52e0396a4
Instruction ID: e4204e4c9791243c41580354b23971ffb1a8b7c9b18ed8f0a3fe257863df58c3
Opcode Fuzzy Hash: b2976c15dae93aaefe9565690aef1675123bc681f2d93df526ce1ae52e0396a4
Instruction Fuzzy Hash: AEC012B09026168BD7008FB46D1DBDC37F0FB04325B5401194402A7346EF7444464A24

Function 05025949 Relevance: 1.3, Strings: 1, Instructions: 7COMMON

Download Yara Rule

Strings

H, xrefs: 05025962

Memory Dump Source

Source File: 00000012.00000002.1933750537.0000000005020000.00000040.00000800.00020000.00000000.sdmp, Offset: 05020000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_5020000_Client.jbxd

Similarity

API ID:
String ID: H
API String ID: 0-2852464175
Opcode ID: cbce6c660fa35b8d750766c6d8fb544f0332626cbedc46b8814b13335501c3fc
Instruction ID: 43aad8a473d7839a2539f7788dbf5f7385609ad335573da4b63b7eecac63a7c1
Opcode Fuzzy Hash: cbce6c660fa35b8d750766c6d8fb544f0332626cbedc46b8814b13335501c3fc
Instruction Fuzzy Hash: 9CC04CB4A02316CFDB449FA4DA1CBAC7BB1EB84302F00445A9507EA390DE7809849F25

Function 05025D5E Relevance: 1.3, Strings: 1, Instructions: 7COMMON

Download Yara Rule

Strings

J, xrefs: 05025D77

Memory Dump Source

Source File: 00000012.00000002.1933750537.0000000005020000.00000040.00000800.00020000.00000000.sdmp, Offset: 05020000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_5020000_Client.jbxd

Similarity

API ID:
String ID: J
API String ID: 0-1141589763
Opcode ID: da5f05f0a3c646d0e52207a794d8b572bc1218dac25c3a35d2a9e5fe3769c88a
Instruction ID: deb0405c85ff277f33f41ad4e02ba69ec73af5f1678a162da92756438639e78c
Opcode Fuzzy Hash: da5f05f0a3c646d0e52207a794d8b572bc1218dac25c3a35d2a9e5fe3769c88a
Instruction Fuzzy Hash: 09C04CB4A42356CFDB449FA4E95CAAC7AB1EB44301F108059950BE6390DE780984DF25

Function 05025D83 Relevance: 1.3, Strings: 1, Instructions: 7COMMON

Download Yara Rule

Strings

E, xrefs: 05025D99

Memory Dump Source

Source File: 00000012.00000002.1933750537.0000000005020000.00000040.00000800.00020000.00000000.sdmp, Offset: 05020000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_5020000_Client.jbxd

Similarity

API ID:
String ID: E
API String ID: 0-3568589458
Opcode ID: 8f7612218f34839f3470b2d1ce7efe09b34b45fb74faad35419e954d1755c3cb
Instruction ID: e0010eb840183fb8978e154731b5c7d4932197a82f9d3ef8bd8952c356c4008d
Opcode Fuzzy Hash: 8f7612218f34839f3470b2d1ce7efe09b34b45fb74faad35419e954d1755c3cb
Instruction Fuzzy Hash: 4AC04CB49023168BDB449FA4D95CDAC7AB2EB84302F1040199507E6390DE780584DA25

Function 05026191 Relevance: 1.3, Strings: 1, Instructions: 7COMMON

Download Yara Rule

Strings

6, xrefs: 050261A7

Memory Dump Source

Source File: 00000012.00000002.1933750537.0000000005020000.00000040.00000800.00020000.00000000.sdmp, Offset: 05020000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_5020000_Client.jbxd

Similarity

API ID:
String ID: 6
API String ID: 0-498629140
Opcode ID: 3de821bc98f524f49d7874930614b3df945d58dd271fea45099c9e089b93ba58
Instruction ID: fe0d8f4ce94f62d203269ae81f83fcb37a8c1a5e9037cf72f785f2effd292bab
Opcode Fuzzy Hash: 3de821bc98f524f49d7874930614b3df945d58dd271fea45099c9e089b93ba58
Instruction Fuzzy Hash: 5FC04C749033169BDB14DFF4D61C9AC7AB5EB44746F10402D9403E6390DE780944DA21

Function 05025DD6 Relevance: 1.3, Strings: 1, Instructions: 7COMMON

Download Yara Rule

Strings

B, xrefs: 05025DEF

Memory Dump Source

Source File: 00000012.00000002.1933750537.0000000005020000.00000040.00000800.00020000.00000000.sdmp, Offset: 05020000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_5020000_Client.jbxd

Similarity

API ID:
String ID: B
API String ID: 0-1255198513
Opcode ID: 615c3a78f62780fb3e1d1e4ae96517ae9d07e7ca7fad91c7dc9e143afe6dbe37
Instruction ID: b7c19b7f65340a3e94b0f65290b07db7f403eb68eb95395b6923c63d87bacc6e
Opcode Fuzzy Hash: 615c3a78f62780fb3e1d1e4ae96517ae9d07e7ca7fad91c7dc9e143afe6dbe37
Instruction Fuzzy Hash: 82C04CB4A03316CBDB44AFA4DA1CAAC7BB1EB44345F014059A50BE7390DE780A449B25

Function 050259D4 Relevance: 1.3, Strings: 1, Instructions: 7COMMON

Download Yara Rule

Strings

&, xrefs: 050259EA

Memory Dump Source

Source File: 00000012.00000002.1933750537.0000000005020000.00000040.00000800.00020000.00000000.sdmp, Offset: 05020000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_5020000_Client.jbxd

Similarity

API ID:
String ID: &
API String ID: 0-1010288
Opcode ID: 48ae543b58ab57f9a908807884da95fc2b06a3153d52968bfbd7fb3469266b67
Instruction ID: 9c96b16f8153a2cf9225b58c1b492f37aef161b0c848a9f59a44d9f78b0463df
Opcode Fuzzy Hash: 48ae543b58ab57f9a908807884da95fc2b06a3153d52968bfbd7fb3469266b67
Instruction Fuzzy Hash: 37C04C7490231A8BDB14DFF8E51C9AD7AB1EB88301F1040599413E6390DE7804449F31

Function 05026021 Relevance: 1.3, Strings: 1, Instructions: 7COMMON

Download Yara Rule

Strings

L, xrefs: 0502603A

Memory Dump Source

Source File: 00000012.00000002.1933750537.0000000005020000.00000040.00000800.00020000.00000000.sdmp, Offset: 05020000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_5020000_Client.jbxd

Similarity

API ID:
String ID: L
API String ID: 0-2909332022
Opcode ID: 3b1490e625e8068050282bce6f757f66c2f163c52b42bcf70a78564bb2c19442
Instruction ID: a4e215b8951292e8968c7a2f9766804651c72761dad58fb3a3c6e50231aecb69
Opcode Fuzzy Hash: 3b1490e625e8068050282bce6f757f66c2f163c52b42bcf70a78564bb2c19442
Instruction Fuzzy Hash: 90C04CB4A03316DBEB449FB4DA1DEAC7AB1EB84302F004059990BE6390DE780945DA25

Function 05025C78 Relevance: 1.3, Strings: 1, Instructions: 7COMMON

Download Yara Rule

Strings

!, xrefs: 05025C91

Memory Dump Source

Source File: 00000012.00000002.1933750537.0000000005020000.00000040.00000800.00020000.00000000.sdmp, Offset: 05020000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_5020000_Client.jbxd

Similarity

API ID:
String ID: !
API String ID: 0-2657877971
Opcode ID: e687c94922fe57abb9a840ef63696d7ebfa880cc94f956104ad55c6336df879c
Instruction ID: 82ff8f740659568f6db4b758fafee6877f208eac5d770fcbd7052d8662bb142d
Opcode Fuzzy Hash: e687c94922fe57abb9a840ef63696d7ebfa880cc94f956104ad55c6336df879c
Instruction Fuzzy Hash: 65C04CB4A0631ACFDB04DFA4D91CBAC7AB1EB84302F4040599447E6390DF784984DE21

Function 05025FC7 Relevance: 1.3, Strings: 1, Instructions: 7COMMON

Download Yara Rule

Strings

=, xrefs: 05025FE0

Memory Dump Source

Source File: 00000012.00000002.1933750537.0000000005020000.00000040.00000800.00020000.00000000.sdmp, Offset: 05020000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_5020000_Client.jbxd

Similarity

API ID:
String ID: =
API String ID: 0-2322244508
Opcode ID: a8c005963c5cdd8035a6dc49b647a693403823a2b309b9c78bc67770daff78d6
Instruction ID: e3ae135c5444a726dd218eca27a59132200d6c0fa941f45291b67ea676efa9ca
Opcode Fuzzy Hash: a8c005963c5cdd8035a6dc49b647a693403823a2b309b9c78bc67770daff78d6
Instruction Fuzzy Hash: 6AC04CB4902326CBDB059FA4E91CBACBAB5EB88342F00805A9407E6790DE780944DF31

Function 050245EE Relevance: .2, Instructions: 161COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000012.00000002.1933750537.0000000005020000.00000040.00000800.00020000.00000000.sdmp, Offset: 05020000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_5020000_Client.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 67e1d22b0b0621babb1f79bb18cfdcf79c21bc702d08d24395b6cb6fe681040b
Instruction ID: ddacb27750fdc3fbf011ddbdce7efb1c9965deba04aab97e377c8c76066eb1a0
Opcode Fuzzy Hash: 67e1d22b0b0621babb1f79bb18cfdcf79c21bc702d08d24395b6cb6fe681040b
Instruction Fuzzy Hash: 64711B7090425ACBDF24EFB5E948BACBBB2AB44308F04C059D44AE7395DB745988DF36

Function 05024283 Relevance: .2, Instructions: 157COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000012.00000002.1933750537.0000000005020000.00000040.00000800.00020000.00000000.sdmp, Offset: 05020000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_5020000_Client.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bf00e1c7baa0bed6e5b559590e3dbde99b36271ec9a099640e4e90e057c4b649
Instruction ID: 9849ca3d429e1b09a777d32f5e79df64dfd2bc7434133b90806fe8abada42a62
Opcode Fuzzy Hash: bf00e1c7baa0bed6e5b559590e3dbde99b36271ec9a099640e4e90e057c4b649
Instruction Fuzzy Hash: 3A612B7090425ACBDF24EFB5E948BACBBB2BB44308F00C059D44AE7395DB745989CF66

Function 050245D2 Relevance: .2, Instructions: 152COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000012.00000002.1933750537.0000000005020000.00000040.00000800.00020000.00000000.sdmp, Offset: 05020000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_5020000_Client.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e7a03aa381896f52d2570e04c393fed88fa91d8baab72855fb5679d254879e7e
Instruction ID: 45e22015be1d2d3da2993ac309ead95add8a7bc78f46c4badc8afb71f7005541
Opcode Fuzzy Hash: e7a03aa381896f52d2570e04c393fed88fa91d8baab72855fb5679d254879e7e
Instruction Fuzzy Hash: 7E612B70904266CBDF24EFB5E948BACBBB2BB44308F04C059D44AE7295DB745988CF26

Function 050244CD Relevance: .2, Instructions: 150COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000012.00000002.1933750537.0000000005020000.00000040.00000800.00020000.00000000.sdmp, Offset: 05020000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_5020000_Client.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: aa49a17655350c2d81d97def4c55dc37517496092f4318c618f2c242d38f452e
Instruction ID: 5471fd9a3dff57b32777dcca1c5e02261c5f06a2e9264add79a202e09fc27d31
Opcode Fuzzy Hash: aa49a17655350c2d81d97def4c55dc37517496092f4318c618f2c242d38f452e
Instruction Fuzzy Hash: D5611C70904266CBDF24EFB5E948BACBBB2BB44308F04C059D44AE6395DB745988DF36

Function 05024EC0 Relevance: .1, Instructions: 105COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000012.00000002.1933750537.0000000005020000.00000040.00000800.00020000.00000000.sdmp, Offset: 05020000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_5020000_Client.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5c8c6baad7437402824e2a3e2ea0dd1b16a86f214861af20dd75bdf3c4c37dc4
Instruction ID: 140166cdec82d878b63212b107b84f29ef8594106ab063de8d1634569cee066c
Opcode Fuzzy Hash: 5c8c6baad7437402824e2a3e2ea0dd1b16a86f214861af20dd75bdf3c4c37dc4
Instruction Fuzzy Hash: 0C417C34A08356CFCF40CB74E888D9DBBF2BB89211F1644AAE806E7391DA349C44CB65

Function 05024EF0 Relevance: .1, Instructions: 96COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000012.00000002.1933750537.0000000005020000.00000040.00000800.00020000.00000000.sdmp, Offset: 05020000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_5020000_Client.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a80827222b06cc96ef302d3a6d6286e3c9b9e3b8ea983a92a87491e61eece0bf
Instruction ID: befc8b28d1310b336e5f636e1d81ce9a50365351ab51b9a4fc09ba941b328c0b
Opcode Fuzzy Hash: a80827222b06cc96ef302d3a6d6286e3c9b9e3b8ea983a92a87491e61eece0bf
Instruction Fuzzy Hash: EF311D34E08226CFCF44DBA4E849EADB7F6BB88311F168465E917E7390DB359C408B65

Function 05024FDE Relevance: .1, Instructions: 79COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000012.00000002.1933750537.0000000005020000.00000040.00000800.00020000.00000000.sdmp, Offset: 05020000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_5020000_Client.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 734cb4784d5636101a4df74558c08c605b87f0c163c94dd52a1a1adce8f2c959
Instruction ID: b5db9eadcdcb8ddc1164b5c88c1e968317dd2fa65f7a8bfc85fb499700c43153
Opcode Fuzzy Hash: 734cb4784d5636101a4df74558c08c605b87f0c163c94dd52a1a1adce8f2c959
Instruction Fuzzy Hash: 67310834A04216CFCF44DBA4E889EADB7F2BB98311B168465E807E7390DF349C419F65

Function 05024D20 Relevance: .1, Instructions: 66COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000012.00000002.1933750537.0000000005020000.00000040.00000800.00020000.00000000.sdmp, Offset: 05020000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_5020000_Client.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 69ef815195b2cbc6b7c242d5d958783ccc9debe9f85610a4dfc536472fe6f819
Instruction ID: 70dbc254d5de74ff26d3a641488f8d682daf57fab7d8bbf8a52a5a52c53b451d
Opcode Fuzzy Hash: 69ef815195b2cbc6b7c242d5d958783ccc9debe9f85610a4dfc536472fe6f819
Instruction Fuzzy Hash: 3021273510CBE58FCB56AB74F854A6C3FB15B86204B4741EBD586DB393DE640C0AC7A2

Function 050251C9 Relevance: .1, Instructions: 65COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000012.00000002.1933750537.0000000005020000.00000040.00000800.00020000.00000000.sdmp, Offset: 05020000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_5020000_Client.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7ef8d5f55925e9254f7d38bd3b708f7521628eff2a0e783dc482a800e659bbfb
Instruction ID: ed7cc6160b2d6ca9e95dd110788aa7b50762695322ae9475d96d584c0520556e
Opcode Fuzzy Hash: 7ef8d5f55925e9254f7d38bd3b708f7521628eff2a0e783dc482a800e659bbfb
Instruction Fuzzy Hash: 1B219D3190824ADFCB00EB94E895AECB7B1FF85304F1080A9E906EB355DB355E05DBB6

Function 05025090 Relevance: .1, Instructions: 65COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000012.00000002.1933750537.0000000005020000.00000040.00000800.00020000.00000000.sdmp, Offset: 05020000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_5020000_Client.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 91ef1a868b9ec20d28013f4b32903423449fa19180fe0e0f40d5162db518a0db
Instruction ID: 46ebef86b1bc9dd599e4a7e261791d6a1991ab25ff993293b0eaae98a293c828
Opcode Fuzzy Hash: 91ef1a868b9ec20d28013f4b32903423449fa19180fe0e0f40d5162db518a0db
Instruction Fuzzy Hash: 36218E3490425AEFCB00EBA4EC99AACB7B1FF44304F108499E902DB355DB315A05DBA6

Function 050250A0 Relevance: .1, Instructions: 61COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000012.00000002.1933750537.0000000005020000.00000040.00000800.00020000.00000000.sdmp, Offset: 05020000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_5020000_Client.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b31aa796330cbcb22cd9d5359f62b526910dddc229c5258bdfca506368aba9c0
Instruction ID: 391b6dbcc7c6f14393449c898727d1712b60397d8f087f1ae588fdc192140748
Opcode Fuzzy Hash: b31aa796330cbcb22cd9d5359f62b526910dddc229c5258bdfca506368aba9c0
Instruction Fuzzy Hash: C2219D3490425BDFCB00EFA4ED99AACB7B1FF44308F208059E902AB354DB355E44DBA6

Function 05024D30 Relevance: .0, Instructions: 49COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000012.00000002.1933750537.0000000005020000.00000040.00000800.00020000.00000000.sdmp, Offset: 05020000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_5020000_Client.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 131b3c56c7e84938d14a6a689339c4821c118484f14b177dfd4ec06e5097fe85
Instruction ID: 1efa7276a4974d460a6b0e502791071467a7de9898377145f45add2eaa2976a3
Opcode Fuzzy Hash: 131b3c56c7e84938d14a6a689339c4821c118484f14b177dfd4ec06e5097fe85
Instruction Fuzzy Hash: DF010035604A728BCB54AB75F954B6C3BA1AB81309B47817DE54BDB384CF348C02CBA2

Function 012A05E0 Relevance: .0, Instructions: 44COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000012.00000002.1903841334.00000000012A0000.00000040.00000020.00020000.00000000.sdmp, Offset: 012A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_12a0000_Client.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9b3c6f4075259d2fb5d0f4efe498b6126fa478d5c838aab25e96814a1eb5113c
Instruction ID: ae09995a0eefc50911adf5144494507f1f8d5575c4abf3cf161331eadca31aab
Opcode Fuzzy Hash: 9b3c6f4075259d2fb5d0f4efe498b6126fa478d5c838aab25e96814a1eb5113c
Instruction Fuzzy Hash: FBF0A9B650D7805FD7118B169C44863FFF8DB86620709C4AFEC4987612D125B909CB71

Function 01290018 Relevance: .0, Instructions: 41COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000012.00000002.1903357646.0000000001290000.00000040.00000800.00020000.00000000.sdmp, Offset: 01290000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_1290000_Client.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9f0d5b5d47cbc539457c0454a1efdc971789b129931ada0c2e2211b828c6f270
Instruction ID: 0ec4747261f5ed81c3a9274de5646c0699c475fa95769b25a583d786a59c0124
Opcode Fuzzy Hash: 9f0d5b5d47cbc539457c0454a1efdc971789b129931ada0c2e2211b828c6f270
Instruction Fuzzy Hash: E3F0926188E3C28FC35347704C2A5A43FB0AE5322834E45EFC081CB5B3E25C484ACB62

Function 012A0606 Relevance: .0, Instructions: 27COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000012.00000002.1903841334.00000000012A0000.00000040.00000020.00020000.00000000.sdmp, Offset: 012A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_12a0000_Client.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a6a41ce621618acfb5d4e66f79ba0b60b5631ef5118c8b2a0bf9819e12156047
Instruction ID: eadb583f38f9a6644fe4c078cb4f49bcf58352deeb3e975dd4e3e12ea37b64bb
Opcode Fuzzy Hash: a6a41ce621618acfb5d4e66f79ba0b60b5631ef5118c8b2a0bf9819e12156047
Instruction Fuzzy Hash: 9BE092BA6046008B9650CF0BEC81452F7E8EB84630708C47FDC4D8B701E276B509CEA5

Function 05025560 Relevance: .0, Instructions: 27COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000012.00000002.1933750537.0000000005020000.00000040.00000800.00020000.00000000.sdmp, Offset: 05020000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_5020000_Client.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3bc2bc7915cf9e500ccac24a1098fbff70b72b7e89eb7f27248b9a6ca198e11d
Instruction ID: 1d5e949e320ea1d7a25bc24182327cf9042e77c15265b17544f80864654b4ee1
Opcode Fuzzy Hash: 3bc2bc7915cf9e500ccac24a1098fbff70b72b7e89eb7f27248b9a6ca198e11d
Instruction Fuzzy Hash: 08E0E52118E3E85EC75367B16C616C9BF689AA7244F5900CBE4888E9A3A095540C97AA

Function 0502452A Relevance: .0, Instructions: 19COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000012.00000002.1933750537.0000000005020000.00000040.00000800.00020000.00000000.sdmp, Offset: 05020000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_5020000_Client.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c7ec8ed0c4eeb2ad9bfa982dcd05f7ebce22b09062902dae4f51d6f83b96ded7
Instruction ID: 93e4e84da0db2e42e1373ca9c62fe021c9bcb272e56082ccec9217bfad06b44f
Opcode Fuzzy Hash: c7ec8ed0c4eeb2ad9bfa982dcd05f7ebce22b09062902dae4f51d6f83b96ded7
Instruction Fuzzy Hash: 8BE0C934A04326CFCB54EF68E8187AD7B76AB84301F0001A8E54AE6794CF746D808F61

Function 0502312F Relevance: .0, Instructions: 18COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000012.00000002.1933750537.0000000005020000.00000040.00000800.00020000.00000000.sdmp, Offset: 05020000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_5020000_Client.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4d1b76bc10d7f67014f22dc56eb0a829412c0d64d10743c5db93a9ff2e7d9785
Instruction ID: c2d0c3d700c7cf5f09c670e0f5abb7fd390aaa481107230d9c4f889ed2e16333
Opcode Fuzzy Hash: 4d1b76bc10d7f67014f22dc56eb0a829412c0d64d10743c5db93a9ff2e7d9785
Instruction Fuzzy Hash: 3ED05E36A08064EB9B04D78AF8404EDB3BAEA88329B080452E606F3200C3346E158A61

Function 05025228 Relevance: .0, Instructions: 17COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000012.00000002.1933750537.0000000005020000.00000040.00000800.00020000.00000000.sdmp, Offset: 05020000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_5020000_Client.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2bdacc2eb9d4f9d2664d48d3843457165a158d08583910a73da1e80662380591
Instruction ID: 9978e1ded4aa69b966e43e6457fbf5f40e34d928b3827d3ea351e72b7adbfece
Opcode Fuzzy Hash: 2bdacc2eb9d4f9d2664d48d3843457165a158d08583910a73da1e80662380591
Instruction Fuzzy Hash: C5D02234208748CFCB00A798E8120A0BBA49F8F30030000FAE9488B3929824280842AA

Function 050257C0 Relevance: .0, Instructions: 16COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000012.00000002.1933750537.0000000005020000.00000040.00000800.00020000.00000000.sdmp, Offset: 05020000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_5020000_Client.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 77ef8e4aeaaa4a3e9aed0e264f07b27f97ca39834bbc80be3d2df6ec5a6d9e1e
Instruction ID: e2066176ae8874d04bd7598235f3b11963c8a3fdc5d23e297d3172ccb284f416
Opcode Fuzzy Hash: 77ef8e4aeaaa4a3e9aed0e264f07b27f97ca39834bbc80be3d2df6ec5a6d9e1e
Instruction Fuzzy Hash: DBE0BFB0901656DBDB44DFE4E9449AC77B2AB44301F608455D807EE344DF78494A8B14

Function 00DB23F4 Relevance: .0, Instructions: 15COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000012.00000002.1898577558.0000000000DB2000.00000040.00000800.00020000.00000000.sdmp, Offset: 00DB2000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_db2000_Client.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 71ae0c853157d5bfa2bdd13a28a84628160a2db8e42a6702c3f33bb03a2d1f7d
Instruction ID: cd664072c11a7b6c6ea7d597945cf82f48d7d622d153d77b79edcd1df83e6cb7
Opcode Fuzzy Hash: 71ae0c853157d5bfa2bdd13a28a84628160a2db8e42a6702c3f33bb03a2d1f7d
Instruction Fuzzy Hash: B3D05E7A205A818FD3269A1CC1A5BE53BE4AF61715F4A44F9A8408BB63C768D981D610

Function 0129119F Relevance: .0, Instructions: 15COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000012.00000002.1903357646.0000000001290000.00000040.00000800.00020000.00000000.sdmp, Offset: 01290000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_1290000_Client.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7fcbcba1414cda5e39183b29823c5758c264f52f995d8027fca196ce39b55436
Instruction ID: 7e9fff694287b9ea70b8223a024f14c96a9a15da595baa03c98a509503d0ec61
Opcode Fuzzy Hash: 7fcbcba1414cda5e39183b29823c5758c264f52f995d8027fca196ce39b55436
Instruction Fuzzy Hash: 9FE07E7095106ACBDFA6CB08C890BE9B7B5FB48308F1081E9E01DA6650CB31AEC58F00

Function 012905C7 Relevance: .0, Instructions: 15COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000012.00000002.1903357646.0000000001290000.00000040.00000800.00020000.00000000.sdmp, Offset: 01290000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_1290000_Client.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1aae4c2157ae7e27b57045c5e0de84199fe49b03a000994db850069c4eba1d0d
Instruction ID: c94c192e9c2bfd9e686d7467db30ce62a1f4bed0c35a233e0c0601e85e6ee495
Opcode Fuzzy Hash: 1aae4c2157ae7e27b57045c5e0de84199fe49b03a000994db850069c4eba1d0d
Instruction Fuzzy Hash: FEE07E70A5516A8BDBA5CA08C895BE9B2B5EB48304F5091EAE12CA6644CB746A848F01

Function 012936AC Relevance: .0, Instructions: 15COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000012.00000002.1903357646.0000000001290000.00000040.00000800.00020000.00000000.sdmp, Offset: 01290000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_1290000_Client.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 64e161ad6c40a85d3d6b2562c9223d429b1333a638ce44822f6f27a3b6f28644
Instruction ID: b3b172761c541fb21bf1ee489b7364dfd3150a19d8d95c272a32db458c2a6118
Opcode Fuzzy Hash: 64e161ad6c40a85d3d6b2562c9223d429b1333a638ce44822f6f27a3b6f28644
Instruction Fuzzy Hash: F8E0B634A4021BCBEB658F18D858BF977B1FB44308F0080AAE55AD6690CB759A908F10

Function 00DB23BC Relevance: .0, Instructions: 14COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000012.00000002.1898577558.0000000000DB2000.00000040.00000800.00020000.00000000.sdmp, Offset: 00DB2000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_db2000_Client.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 005050c42b419558986d136d2fa87dbc7f07f672f27f95edc4810d0e176108e3
Instruction ID: 5061c179530d9252433fe56cad12c5f2f68e5503aa72e570b8f58d69c4f8c769
Opcode Fuzzy Hash: 005050c42b419558986d136d2fa87dbc7f07f672f27f95edc4810d0e176108e3
Instruction Fuzzy Hash: 00D05E352006818BC725DA0DC6D4FA933E4AB44714F0A44ECAC118B762C7A9D8C0DA10

Function 05024BA0 Relevance: .0, Instructions: 13COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000012.00000002.1933750537.0000000005020000.00000040.00000800.00020000.00000000.sdmp, Offset: 05020000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_5020000_Client.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 02f9b550622df4300d2ca01eab97aff9146b2eca60f9c1bcbc9397853688a425
Instruction ID: 2576574e36fd17615285d6bc9b4a402e9611360e4df9564c7fe4be25ee5427e1
Opcode Fuzzy Hash: 02f9b550622df4300d2ca01eab97aff9146b2eca60f9c1bcbc9397853688a425
Instruction Fuzzy Hash: 70C08C7280C3ADCFCB831790BC00E4C3F78A8DF20230104C2F008CE923AA564808D2A9

Function 05024E70 Relevance: .0, Instructions: 13COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000012.00000002.1933750537.0000000005020000.00000040.00000800.00020000.00000000.sdmp, Offset: 05020000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_5020000_Client.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7b22713b571f4aa1768d8c4cad386625b21bdcb7e9829d64c5660f91e97f7bab
Instruction ID: d2a5928273cb6623ca7e44174dd6543f96bbb86981e37a627ff46fbec63bf604
Opcode Fuzzy Hash: 7b22713b571f4aa1768d8c4cad386625b21bdcb7e9829d64c5660f91e97f7bab
Instruction Fuzzy Hash: 1AD0A92108E3C04ECB2343700C2A2AC3F700E83149B5805FFC09689DE3C11E0026C713

Function 05026460 Relevance: .0, Instructions: 12COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000012.00000002.1933750537.0000000005020000.00000040.00000800.00020000.00000000.sdmp, Offset: 05020000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_5020000_Client.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dfe9bb9280870c8e365c2fbc491eab92465b4fdb1dea4ffc67b2a6b5bacafa56
Instruction ID: d9ef64fac7acb2036a50098316a7db47bf8e418e30e3c34335c803cfc22c2d7c
Opcode Fuzzy Hash: dfe9bb9280870c8e365c2fbc491eab92465b4fdb1dea4ffc67b2a6b5bacafa56
Instruction Fuzzy Hash: 67C08C3204C38C4FC602036074103943F384AA710834000D3FA888A913D95A4E068251

Function 0129AC40 Relevance: .0, Instructions: 12COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000012.00000002.1903357646.0000000001290000.00000040.00000800.00020000.00000000.sdmp, Offset: 01290000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_1290000_Client.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ddacf014a73c1bcbdfe426f9194fc8d800e7b10419f798b4af890d9ba71be274
Instruction ID: 1a760ac45a9dcec5c78c35d18fa4e7fee264c751e275da86fcae21bb0d25b644
Opcode Fuzzy Hash: ddacf014a73c1bcbdfe426f9194fc8d800e7b10419f798b4af890d9ba71be274
Instruction Fuzzy Hash: FAC08C2271022557C20832887404AEE328DC786361F00403AE50A93340CD654E0107F5

Function 01293355 Relevance: .0, Instructions: 12COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000012.00000002.1903357646.0000000001290000.00000040.00000800.00020000.00000000.sdmp, Offset: 01290000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_1290000_Client.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4caa830a326fa8baee7a6d408cbe58957b8d4d107e80c7cadce31f2abdde9789
Instruction ID: a765fc46241c9ff0750736a2563c6558fa5e408dd88968e7af47397efbce4c47
Opcode Fuzzy Hash: 4caa830a326fa8baee7a6d408cbe58957b8d4d107e80c7cadce31f2abdde9789
Instruction Fuzzy Hash: 49D01730910219CBDB2ACB25CD95BA8B6B6AB98300F44C0D9800AAA640CA709B858F44

Function 05025070 Relevance: .0, Instructions: 11COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000012.00000002.1933750537.0000000005020000.00000040.00000800.00020000.00000000.sdmp, Offset: 05020000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_5020000_Client.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 78c3caa57a59fdffd1b6c25f392ff91c653eeb42162e38ae25c4e17293967bff
Instruction ID: 7969dc8681baa58913271a1216b579ab51ae3a5d4c5cf4243d254f2e8b575f8c
Opcode Fuzzy Hash: 78c3caa57a59fdffd1b6c25f392ff91c653eeb42162e38ae25c4e17293967bff
Instruction Fuzzy Hash: CEC04C6544E3C1AFD707277168349543F34881315134A06DBD086C59B3952A881DC736

Function 01297112 Relevance: .0, Instructions: 10COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000012.00000002.1903357646.0000000001290000.00000040.00000800.00020000.00000000.sdmp, Offset: 01290000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_1290000_Client.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5820297b6a7cf65bce50d6b5e0269a395623b9bfa5f16f33a09be417d056dce7
Instruction ID: f9a2adcf06a4e65c71262bc48653dfa8aa998de9f5b614d704fd6ba4ab4b92e8
Opcode Fuzzy Hash: 5820297b6a7cf65bce50d6b5e0269a395623b9bfa5f16f33a09be417d056dce7
Instruction Fuzzy Hash: 97D0C970A102169FCB549B74C958BED77B1AB49304F1081A9A40AE3780CE745E818F71

Function 01296F08 Relevance: .0, Instructions: 10COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000012.00000002.1903357646.0000000001290000.00000040.00000800.00020000.00000000.sdmp, Offset: 01290000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_1290000_Client.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b70f8c9ddff8320075cfaa6b646aef779794e476a1af0bafad2e8b7842095b34
Instruction ID: c4071fd4fb13a7da9e843df5e9111910f3732668c2df68fe21bf23ab741d0604
Opcode Fuzzy Hash: b70f8c9ddff8320075cfaa6b646aef779794e476a1af0bafad2e8b7842095b34
Instruction Fuzzy Hash: 85D06C34A102168FCB54DB74D858AADBBB1BB48305F10806A944AD37A0DE308A518F10

Function 05025508 Relevance: .0, Instructions: 9COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000012.00000002.1933750537.0000000005020000.00000040.00000800.00020000.00000000.sdmp, Offset: 05020000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_5020000_Client.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ee5b09fd87037ba600c10fec763bde7149324d1fa47e2ad3872245efc5f83f3d
Instruction ID: 04928d6c8f517c7b839a639ce2981c6fceaf20ca48fd54dc2e6d13128d462cfc
Opcode Fuzzy Hash: ee5b09fd87037ba600c10fec763bde7149324d1fa47e2ad3872245efc5f83f3d
Instruction Fuzzy Hash: 07B0123918D25C259B6122F17CE28CFBF5C04F5048610018EE80E54D42A0C1420D4CDB

Function 05024E98 Relevance: .0, Instructions: 9COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000012.00000002.1933750537.0000000005020000.00000040.00000800.00020000.00000000.sdmp, Offset: 05020000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_5020000_Client.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c515d3943ec8993f5adfb0ed4d826724c0a4eb6e26a3d3203fb883a84795052e
Instruction ID: dec9cd58667a4177e38e3728da7d9538a6e789bc7841784910d0a80868ba6d9b
Opcode Fuzzy Hash: c515d3943ec8993f5adfb0ed4d826724c0a4eb6e26a3d3203fb883a84795052e
Instruction Fuzzy Hash: F2C09B7150F3D1DFC705777925BD4DC3F28C41601134405EBD055C66A25D750412C311

Function 0129E1A8 Relevance: .0, Instructions: 9COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000012.00000002.1903357646.0000000001290000.00000040.00000800.00020000.00000000.sdmp, Offset: 01290000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_1290000_Client.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b7d8dd2b831a9d9d997f19a59b310e1d025d4cc91cc605651b20b327858bb5b0
Instruction ID: 9c5d7918797539ad5ba00077d24c363cdc730b6057ca0ca0dd2aab0b9d2544bd
Opcode Fuzzy Hash: b7d8dd2b831a9d9d997f19a59b310e1d025d4cc91cc605651b20b327858bb5b0
Instruction Fuzzy Hash: CFC08C700097CB6FDF0253687908BA1FF9C1701308F5C8080E588C5363C29692408279

Function 0129326C Relevance: .0, Instructions: 8COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000012.00000002.1903357646.0000000001290000.00000040.00000800.00020000.00000000.sdmp, Offset: 01290000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_1290000_Client.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 21f2f828f8b819a5ea10df30f7d986b3d61498561fa13b007215ecc709e59365
Instruction ID: 423790bab2f8fe2cbf0a4b8a733a4e6b25ca92f37b567ca42006919a7ae54a29
Opcode Fuzzy Hash: 21f2f828f8b819a5ea10df30f7d986b3d61498561fa13b007215ecc709e59365
Instruction Fuzzy Hash: 3DD0127466911ACADF668F0CE8A4BEC7271FB01308F1081FAE06956194CB716EC2CF00

Function 050254AC Relevance: .0, Instructions: 7COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000012.00000002.1933750537.0000000005020000.00000040.00000800.00020000.00000000.sdmp, Offset: 05020000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_5020000_Client.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7e96425bc33e22bd70385dcf4bbbc87689ffc90f7982886d45f893ceb15fdc98
Instruction ID: 8eb61419845dd4b1a020368d66cc91d944d2ecea48a58257de92663ee5627284
Opcode Fuzzy Hash: 7e96425bc33e22bd70385dcf4bbbc87689ffc90f7982886d45f893ceb15fdc98
Instruction Fuzzy Hash: 89A022200C8B0CCBC3002BCA30023AC33BC8A8F2083E0C0A0E00C8EA020E083003008E

Function 05024B8B Relevance: .0, Instructions: 6COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000012.00000002.1933750537.0000000005020000.00000040.00000800.00020000.00000000.sdmp, Offset: 05020000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_5020000_Client.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5de2117dd70fcfc402100dc06301e3b4907d484534ae20f8b3023d5901c78b82
Instruction ID: 03ed816e6b2e479b9f291b338547312576c0f0aab5849d95e9d23295ae2b2522
Opcode Fuzzy Hash: 5de2117dd70fcfc402100dc06301e3b4907d484534ae20f8b3023d5901c78b82
Instruction Fuzzy Hash: 66B0121548D3C418CB1252B034A04CD7F9008D5008F24019ED8CA016B3818302154513

Function 0129A4D8 Relevance: .0, Instructions: 6COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000012.00000002.1903357646.0000000001290000.00000040.00000800.00020000.00000000.sdmp, Offset: 01290000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_1290000_Client.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5fa484cb2e443aaf780f193d65a9d6d3f636bc1c168f082cc4073ae5b95856ef
Instruction ID: eaa00aa06e2db3f14d55d7a3c5c480040550f9cc47d6adc376524f760d2c9374
Opcode Fuzzy Hash: 5fa484cb2e443aaf780f193d65a9d6d3f636bc1c168f082cc4073ae5b95856ef
Instruction Fuzzy Hash: 10A02230000B0F8F0F0033EB380C828330CF88000CBC02000E00EC2A008E00300000FA

Function 0129A228 Relevance: .0, Instructions: 6COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000012.00000002.1903357646.0000000001290000.00000040.00000800.00020000.00000000.sdmp, Offset: 01290000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_1290000_Client.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c2b739e6143de4b2e80f1910f2a15913308529585e9a6837397fe98f9abcd8c9
Instruction ID: ce9f0d320568e7aeddd1da0d443e20918fc001d358bb9c195afdc7c1ad0b123c
Opcode Fuzzy Hash: c2b739e6143de4b2e80f1910f2a15913308529585e9a6837397fe98f9abcd8c9
Instruction Fuzzy Hash: 32A011300002088BC200ABA8E008EA033ECAB08A08F0000F0A20C8BA228A22B8008A82

Function 0129E538 Relevance: .0, Instructions: 5COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000012.00000002.1903357646.0000000001290000.00000040.00000800.00020000.00000000.sdmp, Offset: 01290000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_1290000_Client.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8327af2b0267dea10e05e167b1d3b839604955daed55bddffb85732fc330087b
Instruction ID: 66806834125f8adf08c0ff27f648fcce58f7981c01fd047c74f766bf41e8c9f9
Opcode Fuzzy Hash: 8327af2b0267dea10e05e167b1d3b839604955daed55bddffb85732fc330087b
Instruction Fuzzy Hash: F59022B200030E8B02002380380CA80330CE0000003800000A00C802000A00200000A0

Function 012965C0 Relevance: .0, Instructions: 5COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000012.00000002.1903357646.0000000001290000.00000040.00000800.00020000.00000000.sdmp, Offset: 01290000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_1290000_Client.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 67e8ace38079e16a398d794438a933784dc877c5237fe08e6f95aa39fdc97fea
Instruction ID: 7d8c183de27aa0ad89802fccc58b45056497b6e85f84875d8275c7fec1d8b9ef
Opcode Fuzzy Hash: 67e8ace38079e16a398d794438a933784dc877c5237fe08e6f95aa39fdc97fea
Instruction Fuzzy Hash: DAC09B7455535797D75CDB24C78D5657F356740304F0440B5848649514C7744641DF14

Function 0129E0A0 Relevance: .0, Instructions: 5COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000012.00000002.1903357646.0000000001290000.00000040.00000800.00020000.00000000.sdmp, Offset: 01290000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_1290000_Client.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ee5261175ebd81b461d90efafef931f27b230a7076907e50ba8635032843ea6a
Instruction ID: ea4654ecdffa037c0094fb5dc28f19e15f1fadfc1b03cce872afbe4763801cec
Opcode Fuzzy Hash: ee5261175ebd81b461d90efafef931f27b230a7076907e50ba8635032843ea6a
Instruction Fuzzy Hash: 6D90023144870F8B45492795790A955B75C95485157844051B50D817125E55651045A9

Function 0129A0E0 Relevance: .0, Instructions: 5COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000012.00000002.1903357646.0000000001290000.00000040.00000800.00020000.00000000.sdmp, Offset: 01290000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_1290000_Client.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f5e29599af82e847510ba17a5f535822a4399428458fd42c9dcb0a505ceb97f8
Instruction ID: 96b223807c3d53cc4e5904f79492d6240b70ff07a5af7b735c029b751b99e241
Opcode Fuzzy Hash: f5e29599af82e847510ba17a5f535822a4399428458fd42c9dcb0a505ceb97f8
Instruction Fuzzy Hash:

Function 0129E320 Relevance: .0, Instructions: 5COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000012.00000002.1903357646.0000000001290000.00000040.00000800.00020000.00000000.sdmp, Offset: 01290000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_1290000_Client.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e7224c6b0440514c07b165b446249143072d80738783ada574541e0b88ea8867
Instruction ID: 8eb5ae71d20f5a18f64980a6ee34feaf5bb0a3e1e10b7c587471ade6b434a680
Opcode Fuzzy Hash: e7224c6b0440514c07b165b446249143072d80738783ada574541e0b88ea8867
Instruction Fuzzy Hash: D890023508570EAB45406795780A9957B5C95455267804051A50D817115E55655045A9

Function 0129A350 Relevance: .0, Instructions: 5COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000012.00000002.1903357646.0000000001290000.00000040.00000800.00020000.00000000.sdmp, Offset: 01290000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_1290000_Client.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e0c5fedb506005dab2797b52e9359ee6b7a61934fae88087c614546664043cef
Instruction ID: b92b9b45eabd30c34984c4522f5d0683330f3cd935538dcb754d25913d557ff7
Opcode Fuzzy Hash: e0c5fedb506005dab2797b52e9359ee6b7a61934fae88087c614546664043cef
Instruction Fuzzy Hash:

Function 01299E50 Relevance: .0, Instructions: 5COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000012.00000002.1903357646.0000000001290000.00000040.00000800.00020000.00000000.sdmp, Offset: 01290000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_1290000_Client.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3acb625efb1241d68be8dcd6de0dcd11a24fd46712ab64ee92156de0f543a4d4
Instruction ID: 6e1537b8c9726219141c9a5280b67a5dbed4f5c8ecd28ffd318faea9db88b680
Opcode Fuzzy Hash: 3acb625efb1241d68be8dcd6de0dcd11a24fd46712ab64ee92156de0f543a4d4
Instruction Fuzzy Hash:

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is an administration feature that provides a uniform environment to access Windows system components. The WMI service enables both local and remote access, though the latter is facilitated by Remote Services such as Distributed Component Object Model (DCOM) and Windows Remote Management (WinRM).Remote WMI over DCOM operates using port 135, whereas WMI over WinRM operates over port 5985 when using HTTP and 5986 for HTTPS.
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Connection Creation, Process: Process Creation, WMI: WMI Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may achieve persistence by adding a program to a startup folder or referencing it with a Registry run key. Adding an entry to the "run keys" in the Registry or startup folder will cause the program referenced to be executed when a user logs in.These programs will be executed under the context of the user and will have the account's associated permissions level.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, File: File Modification, Process: Process Creation, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify access tokens to operate under a different user or system security context to perform actions and bypass access controls. Windows uses access tokens to determine the ownership of a running process. A user can manipulate access tokens to make a running process appear as though it is the child of a different process or belongs to someone other than the user that started the process. When this occurs, the process also takes on the security context associated with the new token.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	Active Directory: Active Directory Object Modification, Command: Command Execution, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, User Account: User Account Metadata
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report LisectAVT_2403002A_135.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Yara Signatures

Memory Dumps

Sigma Signatures

System Summary

Data Obfuscation

Snort Signatures

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Spreading

Networking

E-Banking Fraud

Operating System Destruction

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Client.exe

C:\Client.exe:Zone.Identifier

C:\Users\user\AppData\Local\Microsoft\CLR_v2.0_32\UsageLogs\Client.exe.log

C:\Users\user\AppData\Local\Microsoft\CLR_v2.0_32\UsageLogs\LisectAVT_2403002A_135.exe.log

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Client.exe

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Client.exe:Zone.Identifier

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Client.url

Static File Info

General

File Icon

Static PE Info

General

Windows Analysis Report
LisectAVT_2403002A_135.exe

Function 052B7E4D Relevance: 4.1, Strings: 3, Instructions: 348
COMMON

Function 052A3371 Relevance: 1.6, APIs: 1, Instructions: 102
registryCOMMON

Function 00ECB820 Relevance: 1.6, APIs: 1, Instructions: 101
registryCOMMON

Function 052A11F3 Relevance: 1.6, APIs: 1, Instructions: 98
registryCOMMON

Function 00ECA9CF Relevance: 1.6, APIs: 1, Instructions: 98
fileCOMMON

Function 052A1E20 Relevance: 1.6, APIs: 1, Instructions: 93
COMMON

Function 052A170C Relevance: 1.6, APIs: 1, Instructions: 89
COMMON

Function 00ECB722 Relevance: 1.6, APIs: 1, Instructions: 89
synchronizationCOMMON

Function 00ECB471 Relevance: 1.6, APIs: 1, Instructions: 87
registryCOMMON

Function 052A33A2 Relevance: 1.6, APIs: 1, Instructions: 86
registryCOMMON

Function 00ECB925 Relevance: 1.6, APIs: 1, Instructions: 86
windowtimeCOMMON