Edit tour

Windows Analysis Report
LA0gY3d103.exe

Overview

General Information

Sample name:	LA0gY3d103.exe renamed because original name is a hash value
Original sample name:	e13d0f9fd3d953a7561bb2e190664871513d431acf134cb3eee63b8d04b2e6f5.exe
Analysis ID:	1577212
MD5:	84344446f13fafc82222d1c2946de989
SHA1:	3cb6374dcfd3b579e53ed687712c1763d27ab099
SHA256:	e13d0f9fd3d953a7561bb2e190664871513d431acf134cb3eee63b8d04b2e6f5
Tags:	139-99-188-124exeuser-JAMESWT_MHT
Infos:

Detection

PureCrypter, PureLog Stealer

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Multi AV Scanner detection for submitted file

Suricata IDS alerts for network traffic

Yara detected PureLog Stealer

.NET source code contains method to dynamically call methods (often used by packers)

AI detected suspicious sample

Detected PureCrypter Trojan

Found many strings related to Crypto-Wallets (likely being stolen)

Machine Learning detection for sample

Queries memory information (via WMI often done to detect virtual machines)

Queries sensitive Plug and Play Device Information (via WMI, Win32_PnPEntity, often done to detect virtual machines)

Queries sensitive disk information (via WMI, Win32_DiskDrive, often done to detect virtual machines)

Queries sensitive physical memory information (via WMI, Win32_PhysicalMemory, often done to detect virtual machines)

Tries to harvest and steal Bitcoin Wallet information

AV process strings found (often used to terminate AV products)

Abnormal high CPU Usage

Allocates memory with a write watch (potentially for evading sandboxes)

Binary contains a suspicious time stamp

Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)

Contains long sleeps (>= 3 min)

Detected TCP or UDP traffic on non-standard ports

Detected potential crypto function

Enables debug privileges

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

Monitors certain registry keys / values for changes (often done to protect autostart functionality)

Queries sensitive processor information (via WMI, Win32_Processor, often done to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sample file is different than original file name gathered from version info

Uses 32bit PE files

Uses code obfuscation techniques (call, push, ret)

Yara detected Credential Stealer

Classification

Process Tree

System is w10x64

LA0gY3d103.exe (PID: 2672 cmdline: "C:\Users\user\Desktop\LA0gY3d103.exe" MD5: 84344446F13FAFC82222D1C2946DE989)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
PureCrypter	According to zscaler, PureCrypter is a fully-featured loader being sold since at least March 2021The malware has been observed distributing a variety of remote access trojans and information stealersThe loader is a .NET executable obfuscated with SmartAssembly and makes use of compression, encryption and obfuscation to evade antivirus software productsPureCrypter features provide persistence, injection and defense mechanisms that are configurable in Googles Protocol Buffer message format	No Attribution	https://any.run/cybersecurity-blog/pure-malware-family-analysis/ https://blog.netlab.360.com/purecrypter-is-busy-pumping-out-various-malicious-malware-families/ https://blog.sekoia.io/mallox-ransomware-affiliate-leverages-purecrypter-in-microsoft-sql-exploitation-campaigns/ https://www.prodaft.com/m/reports/RIG___TLP_CLEAR-1.pdf https://www.zscaler.com/blogs/security-research/technical-analysis-purecrypter	https://malpedia.caad.fkie.fraunhofer.de/details/win.purecrypter

Yara Signatures

Initial Sample

Source	Rule	Description	Author	Strings
LA0gY3d103.exe	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security

Memory Dumps

Source	Rule	Description	Author
00000000.00000000.1447019100.00000000007F2000.00000002.00000001.01000000.00000003.sdmp	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
00000000.00000002.3888658257.0000000002CBB000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: LA0gY3d103.exe PID: 2672	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security

Unpacked PEs

Source	Rule	Description	Author	Strings
0.0.LA0gY3d103.exe.7f0000.0.unpack	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security

Suricata Signatures

ET MALWARE Generic AsyncRAT Style SSL Cert

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-18T09:40:07.575206+0100	2035595	1	Domain Observed Used for C2 Detected	139.99.188.124	56001	192.168.2.8	49704	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Multi AV Scanner detection for submitted file

Source: LA0gY3d103.exe	Virustotal: Detection: 41%			Perma Link
Source: LA0gY3d103.exe	ReversingLabs: Detection: 50%

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Machine Learning detection for sample

Source: LA0gY3d103.exe

Joe Sandbox ML: detected

Source: LA0gY3d103.exe

Static PE information: EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE

Source: LA0gY3d103.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Networking

Suricata IDS alerts for network traffic

Source: Network traffic

Suricata IDS: 2035595 - Severity 1 - ET MALWARE Generic AsyncRAT Style SSL Cert : 139.99.188.124:56001 -> 192.168.2.8:49704

Source: global traffic

TCP traffic: 192.168.2.8:49704 -> 139.99.188.124:56001

Source: Joe Sandbox View	IP Address: 139.99.188.124 139.99.188.124
Source: Joe Sandbox View	IP Address: 139.99.188.124 139.99.188.124

Source: Joe Sandbox View

ASN Name: OVHFR OVHFR

Source: unknown	TCP traffic detected without corresponding DNS query: 139.99.188.124
Source: unknown	TCP traffic detected without corresponding DNS query: 139.99.188.124
Source: unknown	TCP traffic detected without corresponding DNS query: 139.99.188.124
Source: unknown	TCP traffic detected without corresponding DNS query: 139.99.188.124
Source: unknown	TCP traffic detected without corresponding DNS query: 139.99.188.124
Source: unknown	TCP traffic detected without corresponding DNS query: 139.99.188.124
Source: unknown	TCP traffic detected without corresponding DNS query: 139.99.188.124
Source: unknown	TCP traffic detected without corresponding DNS query: 139.99.188.124
Source: unknown	TCP traffic detected without corresponding DNS query: 139.99.188.124
Source: unknown	TCP traffic detected without corresponding DNS query: 139.99.188.124
Source: unknown	TCP traffic detected without corresponding DNS query: 139.99.188.124
Source: unknown	TCP traffic detected without corresponding DNS query: 139.99.188.124
Source: unknown	TCP traffic detected without corresponding DNS query: 139.99.188.124
Source: unknown	TCP traffic detected without corresponding DNS query: 139.99.188.124
Source: unknown	TCP traffic detected without corresponding DNS query: 139.99.188.124
Source: unknown	TCP traffic detected without corresponding DNS query: 139.99.188.124
Source: unknown	TCP traffic detected without corresponding DNS query: 139.99.188.124
Source: unknown	TCP traffic detected without corresponding DNS query: 139.99.188.124
Source: unknown	TCP traffic detected without corresponding DNS query: 139.99.188.124
Source: unknown	TCP traffic detected without corresponding DNS query: 139.99.188.124
Source: unknown	TCP traffic detected without corresponding DNS query: 139.99.188.124
Source: unknown	TCP traffic detected without corresponding DNS query: 139.99.188.124
Source: unknown	TCP traffic detected without corresponding DNS query: 139.99.188.124
Source: unknown	TCP traffic detected without corresponding DNS query: 139.99.188.124
Source: unknown	TCP traffic detected without corresponding DNS query: 139.99.188.124
Source: unknown	TCP traffic detected without corresponding DNS query: 139.99.188.124
Source: unknown	TCP traffic detected without corresponding DNS query: 139.99.188.124
Source: unknown	TCP traffic detected without corresponding DNS query: 139.99.188.124
Source: unknown	TCP traffic detected without corresponding DNS query: 139.99.188.124
Source: unknown	TCP traffic detected without corresponding DNS query: 139.99.188.124
Source: unknown	TCP traffic detected without corresponding DNS query: 139.99.188.124
Source: unknown	TCP traffic detected without corresponding DNS query: 139.99.188.124
Source: unknown	TCP traffic detected without corresponding DNS query: 139.99.188.124
Source: unknown	TCP traffic detected without corresponding DNS query: 139.99.188.124
Source: unknown	TCP traffic detected without corresponding DNS query: 139.99.188.124
Source: unknown	TCP traffic detected without corresponding DNS query: 139.99.188.124
Source: unknown	TCP traffic detected without corresponding DNS query: 139.99.188.124
Source: unknown	TCP traffic detected without corresponding DNS query: 139.99.188.124
Source: unknown	TCP traffic detected without corresponding DNS query: 139.99.188.124
Source: unknown	TCP traffic detected without corresponding DNS query: 139.99.188.124
Source: unknown	TCP traffic detected without corresponding DNS query: 139.99.188.124
Source: unknown	TCP traffic detected without corresponding DNS query: 139.99.188.124
Source: unknown	TCP traffic detected without corresponding DNS query: 139.99.188.124
Source: unknown	TCP traffic detected without corresponding DNS query: 139.99.188.124
Source: unknown	TCP traffic detected without corresponding DNS query: 139.99.188.124
Source: unknown	TCP traffic detected without corresponding DNS query: 139.99.188.124
Source: unknown	TCP traffic detected without corresponding DNS query: 139.99.188.124
Source: unknown	TCP traffic detected without corresponding DNS query: 139.99.188.124
Source: unknown	TCP traffic detected without corresponding DNS query: 139.99.188.124
Source: unknown	TCP traffic detected without corresponding DNS query: 139.99.188.124

Source: LA0gY3d103.exe, 00000000.00000002.3888180035.0000000000FCA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en
Source: LA0gY3d103.exe, 00000000.00000002.3888180035.0000000000FCA000.00000004.00000020.00020000.00000000.sdmp, 77EC63BDA74BD0D0E0426DC8F80085060.0.dr	String found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab
Source: LA0gY3d103.exe, 00000000.00000002.3888658257.0000000003199000.00000004.00000800.00020000.00000000.sdmp, LA0gY3d103.exe, 00000000.00000002.3888658257.0000000002CBB000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: LA0gY3d103.exe, 00000000.00000002.3888658257.0000000002CBB000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://github.com/DFfe9ewf/test3/raw/refs/heads/main/WebDriver.dll
Source: LA0gY3d103.exe, 00000000.00000002.3888658257.0000000002CBB000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://github.com/DFfe9ewf/test3/raw/refs/heads/main/chromedriver.exe
Source: LA0gY3d103.exe, 00000000.00000002.3888658257.0000000002CBB000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://github.com/DFfe9ewf/test3/raw/refs/heads/main/msedgedriver.exe
Source: LA0gY3d103.exe, 00000000.00000002.3888658257.0000000002CBB000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://stackoverflow.com/q/11564914/23354;
Source: LA0gY3d103.exe, 00000000.00000002.3888658257.0000000002CBB000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://stackoverflow.com/q/14436606/23354
Source: LA0gY3d103.exe, 00000000.00000002.3888658257.0000000002CBB000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://stackoverflow.com/q/2152978/23354rCannot

Source: C:\Users\user\Desktop\LA0gY3d103.exe

Process Stats: CPU usage > 49%

Source: C:\Users\user\Desktop\LA0gY3d103.exe	Code function: 0_2_0103E900	0_2_0103E900
Source: C:\Users\user\Desktop\LA0gY3d103.exe	Code function: 0_2_01030D70	0_2_01030D70
Source: C:\Users\user\Desktop\LA0gY3d103.exe	Code function: 0_2_01030D62	0_2_01030D62
Source: C:\Users\user\Desktop\LA0gY3d103.exe	Code function: 0_2_0103A7E0	0_2_0103A7E0
Source: C:\Users\user\Desktop\LA0gY3d103.exe	Code function: 0_2_050D5D38	0_2_050D5D38
Source: C:\Users\user\Desktop\LA0gY3d103.exe	Code function: 0_2_055034F0	0_2_055034F0
Source: C:\Users\user\Desktop\LA0gY3d103.exe	Code function: 0_2_055057E0	0_2_055057E0
Source: C:\Users\user\Desktop\LA0gY3d103.exe	Code function: 0_2_0550E6F0	0_2_0550E6F0
Source: C:\Users\user\Desktop\LA0gY3d103.exe	Code function: 0_2_05503850	0_2_05503850
Source: C:\Users\user\Desktop\LA0gY3d103.exe	Code function: 0_2_055034E0	0_2_055034E0
Source: C:\Users\user\Desktop\LA0gY3d103.exe	Code function: 0_2_05503840	0_2_05503840
Source: C:\Users\user\Desktop\LA0gY3d103.exe	Code function: 0_2_0550EBDA	0_2_0550EBDA
Source: C:\Users\user\Desktop\LA0gY3d103.exe	Code function: 0_2_06A92BB8	0_2_06A92BB8
Source: C:\Users\user\Desktop\LA0gY3d103.exe	Code function: 0_2_06A90880	0_2_06A90880
Source: C:\Users\user\Desktop\LA0gY3d103.exe	Code function: 0_2_06A906C8	0_2_06A906C8
Source: C:\Users\user\Desktop\LA0gY3d103.exe	Code function: 0_2_06A92667	0_2_06A92667
Source: C:\Users\user\Desktop\LA0gY3d103.exe	Code function: 0_2_06A92670	0_2_06A92670
Source: C:\Users\user\Desktop\LA0gY3d103.exe	Code function: 0_2_06A90BA7	0_2_06A90BA7
Source: C:\Users\user\Desktop\LA0gY3d103.exe	Code function: 0_2_06A90781	0_2_06A90781
Source: C:\Users\user\Desktop\LA0gY3d103.exe	Code function: 0_2_06A92BC1	0_2_06A92BC1
Source: C:\Users\user\Desktop\LA0gY3d103.exe	Code function: 0_2_06A90730	0_2_06A90730
Source: C:\Users\user\Desktop\LA0gY3d103.exe	Code function: 0_2_06A9275C	0_2_06A9275C
Source: C:\Users\user\Desktop\LA0gY3d103.exe	Code function: 0_2_06A92C90	0_2_06A92C90
Source: C:\Users\user\Desktop\LA0gY3d103.exe	Code function: 0_2_06A90871	0_2_06A90871
Source: C:\Users\user\Desktop\LA0gY3d103.exe	Code function: 0_2_06A901B2	0_2_06A901B2

Source: LA0gY3d103.exe, 00000000.00000002.3891426756.00000000052C0000.00000004.08000000.00040000.00000000.sdmp	Binary or memory string: OriginalFilenameNkgaeiqqr.dll" vs LA0gY3d103.exe
Source: LA0gY3d103.exe, 00000000.00000002.3888658257.0000000002C74000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameNkgaeiqqr.dll" vs LA0gY3d103.exe
Source: LA0gY3d103.exe, 00000000.00000002.3890420423.0000000003D28000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameNkgaeiqqr.dll" vs LA0gY3d103.exe
Source: LA0gY3d103.exe, 00000000.00000000.1447075445.0000000000878000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenameTdpmxs.exe" vs LA0gY3d103.exe
Source: LA0gY3d103.exe, 00000000.00000002.3888180035.0000000000EFE000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameclr.dllT vs LA0gY3d103.exe
Source: LA0gY3d103.exe, 00000000.00000002.3888658257.0000000002C61000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilename vs LA0gY3d103.exe
Source: LA0gY3d103.exe	Binary or memory string: OriginalFilenameTdpmxs.exe" vs LA0gY3d103.exe

Source: LA0gY3d103.exe

Static PE information: EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE

Source: LA0gY3d103.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: LA0gY3d103.exe, pvHnxf6DCmwjRWwiTS1.cs	Cryptographic APIs: 'CreateDecryptor'
Source: LA0gY3d103.exe, pvHnxf6DCmwjRWwiTS1.cs	Cryptographic APIs: 'CreateDecryptor'
Source: LA0gY3d103.exe, pvHnxf6DCmwjRWwiTS1.cs	Cryptographic APIs: 'CreateDecryptor'
Source: LA0gY3d103.exe, pvHnxf6DCmwjRWwiTS1.cs	Cryptographic APIs: 'CreateDecryptor'

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@1/2@0/1

Source: C:\Users\user\Desktop\LA0gY3d103.exe	Mutant created: NULL
Source: C:\Users\user\Desktop\LA0gY3d103.exe	Mutant created: \Sessions\1\BaseNamedObjects\9f7630f8991b

Source: LA0gY3d103.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: LA0gY3d103.exe

Static file information: TRID: Win32 Executable (generic) Net Framework (10011505/4) 49.83%

Source: C:\Users\user\Desktop\LA0gY3d103.exe

WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor

Source: C:\Users\user\Desktop\LA0gY3d103.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: LA0gY3d103.exe	Virustotal: Detection: 41%
Source: LA0gY3d103.exe	ReversingLabs: Detection: 50%

Source: C:\Users\user\Desktop\LA0gY3d103.exe

File read: C:\Users\user\Desktop\LA0gY3d103.exe

Jump to behavior

Source: C:\Users\user\Desktop\LA0gY3d103.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\Desktop\LA0gY3d103.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\LA0gY3d103.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\LA0gY3d103.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\LA0gY3d103.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\LA0gY3d103.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\LA0gY3d103.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\LA0gY3d103.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\LA0gY3d103.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\LA0gY3d103.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\LA0gY3d103.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\LA0gY3d103.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\LA0gY3d103.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\LA0gY3d103.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\LA0gY3d103.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\LA0gY3d103.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\LA0gY3d103.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\LA0gY3d103.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\LA0gY3d103.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Users\user\Desktop\LA0gY3d103.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\LA0gY3d103.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Users\user\Desktop\LA0gY3d103.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Users\user\Desktop\LA0gY3d103.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\LA0gY3d103.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\Desktop\LA0gY3d103.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Users\user\Desktop\LA0gY3d103.exe	Section loaded: cryptnet.dll	Jump to behavior
Source: C:\Users\user\Desktop\LA0gY3d103.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\LA0gY3d103.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\LA0gY3d103.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\Desktop\LA0gY3d103.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\LA0gY3d103.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Users\user\Desktop\LA0gY3d103.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Users\user\Desktop\LA0gY3d103.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Users\user\Desktop\LA0gY3d103.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\LA0gY3d103.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\Desktop\LA0gY3d103.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\Desktop\LA0gY3d103.exe	Section loaded: cabinet.dll	Jump to behavior
Source: C:\Users\user\Desktop\LA0gY3d103.exe	Section loaded: wbemcomn.dll	Jump to behavior

Source: C:\Users\user\Desktop\LA0gY3d103.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0EE7644B-1BAD-48B1-9889-0281C206EB85}\InprocServer32

Jump to behavior

Source: C:\Users\user\Desktop\LA0gY3d103.exe

File opened: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll

Jump to behavior

Source: LA0gY3d103.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR

Source: LA0gY3d103.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Data Obfuscation

.NET source code contains method to dynamically call methods (often used by packers)

Source: LA0gY3d103.exe, pvHnxf6DCmwjRWwiTS1.cs

.Net Code: Type.GetTypeFromHandle(jmHpK4toa2GLygSPWmr.oHAb3ljPc7(16777287)).GetMethod("GetDelegateForFunctionPointer", new Type[2]{Type.GetTypeFromHandle(jmHpK4toa2GLygSPWmr.oHAb3ljPc7(16777256)),Type.GetTypeFromHandle(jmHpK4toa2GLygSPWmr.oHAb3ljPc7(16777255))})

Source: LA0gY3d103.exe

Static PE information: 0x8FFF4003 [Sun Jul 22 10:59:15 2046 UTC]

Source: C:\Users\user\Desktop\LA0gY3d103.exe	Code function: 0_2_01031DF2 push cs; retf	0_2_01031DF6
Source: C:\Users\user\Desktop\LA0gY3d103.exe	Code function: 0_2_050D8E58 push cs; ret	0_2_050D8E67
Source: C:\Users\user\Desktop\LA0gY3d103.exe	Code function: 0_2_05523513 push ebp; retf	0_2_05523516
Source: C:\Users\user\Desktop\LA0gY3d103.exe	Code function: 0_2_05525937 push esi; ret	0_2_05525938
Source: C:\Users\user\Desktop\LA0gY3d103.exe	Code function: 0_2_05522FD2 push esi; iretd	0_2_05522FD3

Source: LA0gY3d103.exe

Static PE information: section name: .text entropy: 7.637336684046911

Source: LA0gY3d103.exe, -Module--601f55d4-2c52-4332-b0ef-031246df2917-.cs	High entropy of concatenated method names: 'd90a6e52c881e44fd8db93dbcc5be2457', 'LogLocalRole', 'ChangeComparator', 'ifp4sLImNcSm7WGLqk3', 'TOl3YVIiCJULXmR2IS6', 'hsZLT8IlNcpgs2UPrTG', 't5fmhfI2HAY6DZLvGQB', 'OugD7mIO3T1u329t4Wr'
Source: LA0gY3d103.exe, Us9VskXDMfsQ8V0LY6.cs	High entropy of concatenated method names: 'Y40DGQpDdM', 'nCDDyEeKdQ', 'i8QQKpn9qDWj1AyGX7O', 'pMIviinXaIl6xSe9qkA', 'LMDhqFni79UDYk5C5xA', 'Jh8kWCnlBkiIZ8vAEO6', 'sZRm61n2NV5OATx7nUA', 'm2RDmyLh5K', 'moXb14nB6IucG2rYIwE', 'rxGkvCnJhe6V8qOdwHX'
Source: LA0gY3d103.exe, pvHnxf6DCmwjRWwiTS1.cs	High entropy of concatenated method names: 'HOHve6IETqw3FhXqg2J', 'xe93C9I8X8j3b4xtiI6', 'NRltiV5hL1', 'vU665rIKsOTjZuIupS5', 'u1obGVIrH6YrDcMjsmr', 'CwRiCKIoPdKIy1VF4HS', 'yVRMwuIz3hcQlvQExvI', 'xG3tegSPa0SmL4GI7iP', 'duENW0SWkVKukRs45yN', 'Tqsus5SDiXv7F81bfrs'
Source: LA0gY3d103.exe, h9rFdes69daflkt82yK.cs	High entropy of concatenated method names: 'XudsbJmmyh', 'GKGsgn0NQg', 'MHTsUXUnZC', 'kqBsaaTedZ', 'oh9seYDK2A', 'z2rs3OVyP9', 'qHZsdwsyet', 'AZNsV5Cric', 'ViNsciwncT', 'FKJsuo3yBc'

Source: C:\Users\user\Desktop\LA0gY3d103.exe	Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot			Jump to behavior
Source: C:\Users\user\Desktop\LA0gY3d103.exe	Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT			Jump to behavior

Source: C:\Users\user\Desktop\LA0gY3d103.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\LA0gY3d103.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\LA0gY3d103.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\LA0gY3d103.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\LA0gY3d103.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\LA0gY3d103.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\LA0gY3d103.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\LA0gY3d103.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\LA0gY3d103.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\LA0gY3d103.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\LA0gY3d103.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\LA0gY3d103.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\LA0gY3d103.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\LA0gY3d103.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\LA0gY3d103.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\LA0gY3d103.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\LA0gY3d103.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\LA0gY3d103.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\LA0gY3d103.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\LA0gY3d103.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\LA0gY3d103.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\LA0gY3d103.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\LA0gY3d103.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\LA0gY3d103.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\LA0gY3d103.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\LA0gY3d103.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\LA0gY3d103.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\LA0gY3d103.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\LA0gY3d103.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\LA0gY3d103.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\LA0gY3d103.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\LA0gY3d103.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\LA0gY3d103.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\LA0gY3d103.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\LA0gY3d103.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\LA0gY3d103.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\LA0gY3d103.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\LA0gY3d103.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\LA0gY3d103.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\LA0gY3d103.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\LA0gY3d103.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\LA0gY3d103.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\LA0gY3d103.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\LA0gY3d103.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\LA0gY3d103.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\LA0gY3d103.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\LA0gY3d103.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\LA0gY3d103.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\LA0gY3d103.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\LA0gY3d103.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\LA0gY3d103.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\LA0gY3d103.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\LA0gY3d103.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\LA0gY3d103.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\LA0gY3d103.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\LA0gY3d103.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\LA0gY3d103.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Queries memory information (via WMI often done to detect virtual machines)

Source: C:\Users\user\Desktop\LA0gY3d103.exe

WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_PhysicalMemory

Queries sensitive Plug and Play Device Information (via WMI, Win32_PnPEntity, often done to detect virtual machines)

Source: C:\Users\user\Desktop\LA0gY3d103.exe

WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')

Queries sensitive disk information (via WMI, Win32_DiskDrive, often done to detect virtual machines)

Source: C:\Users\user\Desktop\LA0gY3d103.exe

WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_DiskDrive

Queries sensitive physical memory information (via WMI, Win32_PhysicalMemory, often done to detect virtual machines)

Source: C:\Users\user\Desktop\LA0gY3d103.exe

WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_PhysicalMemory

Source: C:\Users\user\Desktop\LA0gY3d103.exe	Memory allocated: FF0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\LA0gY3d103.exe	Memory allocated: 2C60000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\LA0gY3d103.exe	Memory allocated: 2BA0000 memory reserve \| memory write watch	Jump to behavior

Source: C:\Users\user\Desktop\LA0gY3d103.exe

Thread delayed: delay time: 922337203685477

Jump to behavior

Source: C:\Users\user\Desktop\LA0gY3d103.exe	Window / User API: threadDelayed 1763			Jump to behavior
Source: C:\Users\user\Desktop\LA0gY3d103.exe	Window / User API: threadDelayed 8094			Jump to behavior

Source: C:\Users\user\Desktop\LA0gY3d103.exe TID: 4640	Thread sleep time: -30000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\LA0gY3d103.exe TID: 4280	Thread sleep time: -25825441703193356s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\LA0gY3d103.exe TID: 4280	Thread sleep time: -37000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\LA0gY3d103.exe TID: 4280	Thread sleep time: -36890s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\LA0gY3d103.exe TID: 5448	Thread sleep count: 1763 > 30	Jump to behavior
Source: C:\Users\user\Desktop\LA0gY3d103.exe TID: 5448	Thread sleep count: 8094 > 30	Jump to behavior
Source: C:\Users\user\Desktop\LA0gY3d103.exe TID: 4280	Thread sleep time: -36781s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\LA0gY3d103.exe TID: 4280	Thread sleep time: -36578s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\LA0gY3d103.exe TID: 4280	Thread sleep time: -36469s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\LA0gY3d103.exe TID: 4280	Thread sleep time: -36344s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\LA0gY3d103.exe TID: 4280	Thread sleep time: -36234s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\LA0gY3d103.exe TID: 4280	Thread sleep time: -36124s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\LA0gY3d103.exe TID: 4280	Thread sleep time: -36015s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\LA0gY3d103.exe TID: 4280	Thread sleep time: -35906s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\LA0gY3d103.exe TID: 4280	Thread sleep time: -35797s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\LA0gY3d103.exe TID: 4280	Thread sleep time: -35687s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\LA0gY3d103.exe TID: 4280	Thread sleep time: -35566s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\LA0gY3d103.exe TID: 4280	Thread sleep time: -35437s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\LA0gY3d103.exe TID: 4280	Thread sleep time: -35328s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\LA0gY3d103.exe TID: 4280	Thread sleep time: -35218s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\LA0gY3d103.exe TID: 4280	Thread sleep time: -35109s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\LA0gY3d103.exe TID: 4280	Thread sleep time: -35000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\LA0gY3d103.exe TID: 4280	Thread sleep time: -34891s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\LA0gY3d103.exe TID: 4280	Thread sleep time: -34779s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\LA0gY3d103.exe TID: 4280	Thread sleep time: -34656s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\LA0gY3d103.exe TID: 4280	Thread sleep time: -34547s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\LA0gY3d103.exe TID: 4280	Thread sleep time: -34436s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\LA0gY3d103.exe TID: 4280	Thread sleep time: -34312s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\LA0gY3d103.exe TID: 4280	Thread sleep time: -34203s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\LA0gY3d103.exe TID: 4280	Thread sleep time: -34093s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\LA0gY3d103.exe TID: 4280	Thread sleep time: -33984s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\LA0gY3d103.exe TID: 4280	Thread sleep time: -33875s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\LA0gY3d103.exe TID: 4280	Thread sleep time: -33766s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\LA0gY3d103.exe TID: 4280	Thread sleep time: -33656s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\LA0gY3d103.exe TID: 4280	Thread sleep time: -33547s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\LA0gY3d103.exe TID: 4280	Thread sleep time: -33437s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\LA0gY3d103.exe TID: 4280	Thread sleep time: -33328s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\LA0gY3d103.exe TID: 4280	Thread sleep time: -33218s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\LA0gY3d103.exe TID: 4280	Thread sleep time: -33109s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\LA0gY3d103.exe TID: 4280	Thread sleep time: -33000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\LA0gY3d103.exe TID: 4280	Thread sleep time: -32891s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\LA0gY3d103.exe TID: 4280	Thread sleep time: -32781s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\LA0gY3d103.exe TID: 4280	Thread sleep time: -32672s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\LA0gY3d103.exe TID: 4280	Thread sleep time: -32562s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\LA0gY3d103.exe TID: 4280	Thread sleep time: -32453s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\LA0gY3d103.exe TID: 4280	Thread sleep time: -32344s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\LA0gY3d103.exe TID: 4280	Thread sleep time: -32234s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\LA0gY3d103.exe TID: 4280	Thread sleep time: -32125s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\LA0gY3d103.exe TID: 4280	Thread sleep time: -32016s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\LA0gY3d103.exe TID: 4280	Thread sleep time: -31906s >= -30000s	Jump to behavior

Source: C:\Users\user\Desktop\LA0gY3d103.exe

WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor

Source: C:\Users\user\Desktop\LA0gY3d103.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\Desktop\LA0gY3d103.exe	Thread delayed: delay time: 37000	Jump to behavior
Source: C:\Users\user\Desktop\LA0gY3d103.exe	Thread delayed: delay time: 36890	Jump to behavior
Source: C:\Users\user\Desktop\LA0gY3d103.exe	Thread delayed: delay time: 36781	Jump to behavior
Source: C:\Users\user\Desktop\LA0gY3d103.exe	Thread delayed: delay time: 36578	Jump to behavior
Source: C:\Users\user\Desktop\LA0gY3d103.exe	Thread delayed: delay time: 36469	Jump to behavior
Source: C:\Users\user\Desktop\LA0gY3d103.exe	Thread delayed: delay time: 36344	Jump to behavior
Source: C:\Users\user\Desktop\LA0gY3d103.exe	Thread delayed: delay time: 36234	Jump to behavior
Source: C:\Users\user\Desktop\LA0gY3d103.exe	Thread delayed: delay time: 36124	Jump to behavior
Source: C:\Users\user\Desktop\LA0gY3d103.exe	Thread delayed: delay time: 36015	Jump to behavior
Source: C:\Users\user\Desktop\LA0gY3d103.exe	Thread delayed: delay time: 35906	Jump to behavior
Source: C:\Users\user\Desktop\LA0gY3d103.exe	Thread delayed: delay time: 35797	Jump to behavior
Source: C:\Users\user\Desktop\LA0gY3d103.exe	Thread delayed: delay time: 35687	Jump to behavior
Source: C:\Users\user\Desktop\LA0gY3d103.exe	Thread delayed: delay time: 35566	Jump to behavior
Source: C:\Users\user\Desktop\LA0gY3d103.exe	Thread delayed: delay time: 35437	Jump to behavior
Source: C:\Users\user\Desktop\LA0gY3d103.exe	Thread delayed: delay time: 35328	Jump to behavior
Source: C:\Users\user\Desktop\LA0gY3d103.exe	Thread delayed: delay time: 35218	Jump to behavior
Source: C:\Users\user\Desktop\LA0gY3d103.exe	Thread delayed: delay time: 35109	Jump to behavior
Source: C:\Users\user\Desktop\LA0gY3d103.exe	Thread delayed: delay time: 35000	Jump to behavior
Source: C:\Users\user\Desktop\LA0gY3d103.exe	Thread delayed: delay time: 34891	Jump to behavior
Source: C:\Users\user\Desktop\LA0gY3d103.exe	Thread delayed: delay time: 34779	Jump to behavior
Source: C:\Users\user\Desktop\LA0gY3d103.exe	Thread delayed: delay time: 34656	Jump to behavior
Source: C:\Users\user\Desktop\LA0gY3d103.exe	Thread delayed: delay time: 34547	Jump to behavior
Source: C:\Users\user\Desktop\LA0gY3d103.exe	Thread delayed: delay time: 34436	Jump to behavior
Source: C:\Users\user\Desktop\LA0gY3d103.exe	Thread delayed: delay time: 34312	Jump to behavior
Source: C:\Users\user\Desktop\LA0gY3d103.exe	Thread delayed: delay time: 34203	Jump to behavior
Source: C:\Users\user\Desktop\LA0gY3d103.exe	Thread delayed: delay time: 34093	Jump to behavior
Source: C:\Users\user\Desktop\LA0gY3d103.exe	Thread delayed: delay time: 33984	Jump to behavior
Source: C:\Users\user\Desktop\LA0gY3d103.exe	Thread delayed: delay time: 33875	Jump to behavior
Source: C:\Users\user\Desktop\LA0gY3d103.exe	Thread delayed: delay time: 33766	Jump to behavior
Source: C:\Users\user\Desktop\LA0gY3d103.exe	Thread delayed: delay time: 33656	Jump to behavior
Source: C:\Users\user\Desktop\LA0gY3d103.exe	Thread delayed: delay time: 33547	Jump to behavior
Source: C:\Users\user\Desktop\LA0gY3d103.exe	Thread delayed: delay time: 33437	Jump to behavior
Source: C:\Users\user\Desktop\LA0gY3d103.exe	Thread delayed: delay time: 33328	Jump to behavior
Source: C:\Users\user\Desktop\LA0gY3d103.exe	Thread delayed: delay time: 33218	Jump to behavior
Source: C:\Users\user\Desktop\LA0gY3d103.exe	Thread delayed: delay time: 33109	Jump to behavior
Source: C:\Users\user\Desktop\LA0gY3d103.exe	Thread delayed: delay time: 33000	Jump to behavior
Source: C:\Users\user\Desktop\LA0gY3d103.exe	Thread delayed: delay time: 32891	Jump to behavior
Source: C:\Users\user\Desktop\LA0gY3d103.exe	Thread delayed: delay time: 32781	Jump to behavior
Source: C:\Users\user\Desktop\LA0gY3d103.exe	Thread delayed: delay time: 32672	Jump to behavior
Source: C:\Users\user\Desktop\LA0gY3d103.exe	Thread delayed: delay time: 32562	Jump to behavior
Source: C:\Users\user\Desktop\LA0gY3d103.exe	Thread delayed: delay time: 32453	Jump to behavior
Source: C:\Users\user\Desktop\LA0gY3d103.exe	Thread delayed: delay time: 32344	Jump to behavior
Source: C:\Users\user\Desktop\LA0gY3d103.exe	Thread delayed: delay time: 32234	Jump to behavior
Source: C:\Users\user\Desktop\LA0gY3d103.exe	Thread delayed: delay time: 32125	Jump to behavior
Source: C:\Users\user\Desktop\LA0gY3d103.exe	Thread delayed: delay time: 32016	Jump to behavior
Source: C:\Users\user\Desktop\LA0gY3d103.exe	Thread delayed: delay time: 31906	Jump to behavior

Source: LA0gY3d103.exe, 00000000.00000002.3892102124.0000000005649000.00000004.00000020.00020000.00000000.sdmp, LA0gY3d103.exe, 00000000.00000002.3893880665.00000000063F2000.00000004.00000020.00020000.00000000.sdmp, LA0gY3d103.exe, 00000000.00000002.3891947902.0000000005550000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: Hyper-V RAW

Source: C:\Users\user\Desktop\LA0gY3d103.exe

Process token adjusted: Debug

Jump to behavior

Source: C:\Users\user\Desktop\LA0gY3d103.exe

Memory allocated: page read and write | page guard

Jump to behavior

HIPS / PFW / Operating System Protection Evasion

Detected PureCrypter Trojan

Source: LA0gY3d103.exe, 00000000.00000002.3888658257.0000000002CBB000.00000004.00000800.00020000.00000000.sdmp

String found in binary or memory: 139.99.188.124MIIE4jCCAsqgAwIBAgIQAOKtuPSNgQ5jCdoOiEhUFzANBgkqhkiG9w0BAQ0FADASMRAwDgYDVQQDDAdUbnJ3ZHh1MCAXDTI0MTEwNjA2MzQxM1oYDzk5OTkxMjMxMjM1OTU5WjASMRAwDgYDVQQDDAdUbnJ3ZHh1MIICIjANBgkqhkiG9w0BAQEFAAOCAg8AMIICCgKCAgEAiKcmrI8LFgmCe13nb4a4WIIPuGRjrh3hSLtwJa9x7FR2ocSRANQvNTNjlXosIQ4ub2AK83eY3gZZbUNUKmM7/H/XHGMnTdmND2UE6J/maceV0lN6RoIaOWvq4nWRD00l7KxixDp67UMkTjx+85dy2+fVDE/aum+gH0dXx9OLnLxgnQ8pSXtj24liQgzBoKu0TIPFA9N3IxCpkOmc4yuQ+LwXHhjaCcOfxdYxA/riap7GNXLoj+8d/HNKLjlY/fiPC5rgS6JaJJv0W6TjW3Ft1JmJM1J8E+S8dtfLdtcOhIfK+eZ68EpFBB0DJtoLJSs2+Yd/kuZwjnBVRDVGwuHtA6MmRg4Fd/Jg+UKTt9uBB76KCQDlr43+vs1czB4Njagw8Ml2q67xiP68Pts4UXKtjS6F8BFbEOCv6fFmTLnrBmSUb4YKuJxTNkXqjPdbbxMM8vnR63vvxMHvTcfNZoBusX8eNdsu5aiTWE5u302GFoEM/DOEYSMzOro5+a50o3KQsHg+1t+72sqNii1SPDXTEbH2mnGnB3RHsgCYnRdSCzsWJV/9PHF7re8KBeEZnwP7WNaYcNIDmLruOCegtC00/RSJAsX8PbtR7o531bzyBbFuv/TzSjl1xefr8eoWBVw3EbJCf6AB7W6a5//+mJ7aYc30TGlKf49/3pYDiYhlph0CAwEAAaMyMDAwHQYDVR0OBBYEFC+ALuS3WAn1ELBjCv8Jss13aD9YMA8GA1UdEwEB/wQFMAMBAf8wDQYJKoZIhvcNAQENBQADggIBAFIUJJQ7zsWwRotcJFmRLxnzYq5bHi2Ieaf2G+c2DY1ml+Y2ndrKyPNpjXi5wYRW3Ek2i6VSRXOK4vEjsYsE3itqUVkykHf2LLK1aBVDpcqlnW5J9CipicYGJDrpjZd4UllzPHWE0ZLxo3oehluivb5bVMeDDll5kHIrv6SVzX3KZxYEW0j0YNwdzts3hsBU0KnJ+KdAuF/dnYXVV0hHdAa0cmnac98F4Q1nvu5Nq5Ipn5OJL4LsevooljnqoEJKWc0QNrWYE6xmei1bdo9727HVoIwg6blt6rHHjXqpERvexHfqilA/HZ9eGfshPczDPofzSB03V5uFq5If3xMtHbXTXdW0qTJrojme+l/pyDd3kQTG73giZKI8uLVh4MIXlX2tfPfYAzl2UfUkuHpI69fq0zn/k+6et55nAf25opNExyio0oUWeBmPXWTFkrakCu9937oNwPmlw6PhJvmfW48hr9N3O+PnpRpmgu5Jzd9x/0/0tFze33zB162NF11VE4QFfPzmamjdPnwrdUcpoQdnx2wMGDyj2ddwtBcWzKiB6KMiZXhHNl15KARj4pnO2aBvYupe0Df+0XvC8KncXgpBDRAuwtbVGzZAnXfgUS8lbne27I3xJWhFUEtrrRhi0bGUtiG1CKA89J+wpEb10UNP4k8hF2i5pxAN/xoXBzES"Default:BAPPDATAJ9f7630f8991b

Source: LA0gY3d103.exe, 00000000.00000002.3888658257.0000000003097000.00000004.00000800.00020000.00000000.sdmp, LA0gY3d103.exe, 00000000.00000002.3888658257.00000000030E3000.00000004.00000800.00020000.00000000.sdmp, LA0gY3d103.exe, 00000000.00000002.3888658257.0000000003161000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program Manager
Source: LA0gY3d103.exe, 00000000.00000002.3888658257.0000000003097000.00000004.00000800.00020000.00000000.sdmp, LA0gY3d103.exe, 00000000.00000002.3888658257.0000000002F72000.00000004.00000800.00020000.00000000.sdmp, LA0gY3d103.exe, 00000000.00000002.3888658257.00000000030E3000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program Manager*
Source: LA0gY3d103.exe, 00000000.00000002.3888658257.0000000002FCC000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program Managerh{
Source: LA0gY3d103.exe, 00000000.00000002.3888658257.0000000003097000.00000004.00000800.00020000.00000000.sdmp, LA0gY3d103.exe, 00000000.00000002.3888658257.00000000030E3000.00000004.00000800.00020000.00000000.sdmp, LA0gY3d103.exe, 00000000.00000002.3888658257.0000000003161000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program ManagerTe

Source: C:\Users\user\Desktop\LA0gY3d103.exe	Queries volume information: C:\Users\user\Desktop\LA0gY3d103.exe VolumeInformation			Jump to behavior
Source: C:\Users\user\Desktop\LA0gY3d103.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.ServiceModel\v4.0_4.0.0.0__b77a5c561934e089\System.ServiceModel.dll VolumeInformation			Jump to behavior

Source: C:\Users\user\Desktop\LA0gY3d103.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Source: LA0gY3d103.exe, 00000000.00000002.3888180035.0000000000F31000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: %ProgramFiles%\Windows Defender\MsMpeng.exe

Source: C:\Users\user\Desktop\LA0gY3d103.exe

WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : SELECT * FROM AntiVirusProduct

Stealing of Sensitive Information

Yara detected PureLog Stealer

Source: Yara match	File source: LA0gY3d103.exe, type: SAMPLE
Source: Yara match	File source: 0.0.LA0gY3d103.exe.7f0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000000.1447019100.00000000007F2000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY

Found many strings related to Crypto-Wallets (likely being stolen)

Source: LA0gY3d103.exe, 00000000.00000002.3888658257.0000000002F72000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: Electrum
Source: LA0gY3d103.exe, 00000000.00000002.3888658257.0000000002F72000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: q com.liberty.jaxx
Source: LA0gY3d103.exe, 00000000.00000002.3888658257.0000000002F72000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: q4C:\Users\user\AppData\Roaming\Exodus\exodus.wallet
Source: LA0gY3d103.exe, 00000000.00000002.3888658257.0000000002F72000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: q1C:\Users\user\AppData\Roaming\Ethereum\keystore
Source: LA0gY3d103.exe, 00000000.00000002.3888658257.0000000002F72000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: Exodus
Source: LA0gY3d103.exe, 00000000.00000002.3888658257.0000000002F72000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: Ethereum
Source: LA0gY3d103.exe, 00000000.00000002.3888658257.0000000002F72000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: keystore

Tries to harvest and steal Bitcoin Wallet information

Source: C:\Users\user\Desktop\LA0gY3d103.exe

Key opened: HKEY_CURRENT_USER\Software\Bitcoin\Bitcoin-Qt

Jump to behavior

Source: Yara match	File source: 00000000.00000002.3888658257.0000000002CBB000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: LA0gY3d103.exe PID: 2672, type: MEMORYSTR

Remote Access Functionality

Yara detected PureLog Stealer

Source: Yara match	File source: LA0gY3d103.exe, type: SAMPLE
Source: Yara match	File source: 0.0.LA0gY3d103.exe.7f0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000000.1447019100.00000000007F2000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	321 Windows Management Instrumentation	1 DLL Side-Loading	1 Process Injection	1 Disable or Modify Tools	OS Credential Dumping	1 Query Registry	Remote Services	11 Archive Collected Data	1 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	1 PowerShell	Boot or Logon Initialization Scripts	1 DLL Side-Loading	341 Virtualization/Sandbox Evasion	LSASS Memory	431 Security Software Discovery	Remote Desktop Protocol	1 Data from Local System	1 Non-Standard Port	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	1 Process Injection	Security Account Manager	1 Process Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	Steganography	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	11 Deobfuscate/Decode Files or Information	NTDS	341 Virtualization/Sandbox Evasion	Distributed Component Object Model	Input Capture	Protocol Impersonation	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	2 Obfuscated Files or Information	LSA Secrets	1 Application Window Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	12 Software Packing	Cached Domain Credentials	213 System Information Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	1 Timestomp	DCSync	Remote System Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	1 DLL Side-Loading	Proc Filesystem	System Owner/User Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
LA0gY3d103.exe	42%	Virustotal		Browse
LA0gY3d103.exe	50%	ReversingLabs	Win32.Infostealer.Tinba
LA0gY3d103.exe	100%	Joe Sandbox ML

Name	IP	Active	Malicious	Antivirus Detection	Reputation
bg.microsoft.map.fastly.net	199.232.214.172	true	false		high
default.qdr.p1.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com	217.20.58.100	true	false		high

URLs from Memory and Binaries

Name	Source	Malicious	Reputation
https://stackoverflow.com/q/14436606/23354	LA0gY3d103.exe, 00000000.00000002.3888658257.0000000002CBB000.00000004.00000800.00020000.00000000.sdmp	false	high
https://github.com/DFfe9ewf/test3/raw/refs/heads/main/WebDriver.dll	LA0gY3d103.exe, 00000000.00000002.3888658257.0000000002CBB000.00000004.00000800.00020000.00000000.sdmp	false	high
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	LA0gY3d103.exe, 00000000.00000002.3888658257.0000000003199000.00000004.00000800.00020000.00000000.sdmp, LA0gY3d103.exe, 00000000.00000002.3888658257.0000000002CBB000.00000004.00000800.00020000.00000000.sdmp	false	high
https://stackoverflow.com/q/2152978/23354rCannot	LA0gY3d103.exe, 00000000.00000002.3888658257.0000000002CBB000.00000004.00000800.00020000.00000000.sdmp	false	high
https://stackoverflow.com/q/11564914/23354;	LA0gY3d103.exe, 00000000.00000002.3888658257.0000000002CBB000.00000004.00000800.00020000.00000000.sdmp	false	high
https://github.com/DFfe9ewf/test3/raw/refs/heads/main/chromedriver.exe	LA0gY3d103.exe, 00000000.00000002.3888658257.0000000002CBB000.00000004.00000800.00020000.00000000.sdmp	false	high
https://github.com/DFfe9ewf/test3/raw/refs/heads/main/msedgedriver.exe	LA0gY3d103.exe, 00000000.00000002.3888658257.0000000002CBB000.00000004.00000800.00020000.00000000.sdmp	false	high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
139.99.188.124	unknown	Canada		16276	OVHFR	true

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1577212
Start date and time:	2024-12-18 09:38:59 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 8m 5s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	6
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	LA0gY3d103.exe renamed because original name is a hash value
Original Sample Name:	e13d0f9fd3d953a7561bb2e190664871513d431acf134cb3eee63b8d04b2e6f5.exe
Detection:	MAL
Classification:	mal100.troj.spyw.evad.winEXE@1/2@0/1
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 79% Number of executed functions: 178 Number of non-executed functions: 9
Cookbook Comments:	Found application associated with file extension: .exe Override analysis time to 240000 for current running targets taking high CPU consumption

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, dllhost.exe, WMIADAP.exe, SIHClient.exe, conhost.exe
Excluded IPs from analysis (whitelisted): 217.20.58.100, 52.149.20.212, 13.107.246.63
Excluded domains from analysis (whitelisted): ocsp.digicert.com, slscr.update.microsoft.com, otelrules.azureedge.net, ctldl.windowsupdate.com.delivery.microsoft.com, ctldl.windowsupdate.com, wu-b-net.trafficmanager.net, fe3cr.delivery.mp.microsoft.com
Not all processes where analyzed, report is missing behavior information
Report size getting too big, too many NtAllocateVirtualMemory calls found.
Report size getting too big, too many NtOpenFile calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtQueryValueKey calls found.

Simulations

Behavior and APIs

Time	Type	Description
03:40:09	API Interceptor	11932104x Sleep call for process: LA0gY3d103.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
139.99.188.124	EO3RT0fEfb.exe	Get hash	malicious	Unknown	Browse	139.99.188.124/ucZfzm.txt
	RMBOriPHVJ.exe	Get hash	malicious	Unknown	Browse	139.99.188.124/mzmLv.txt
	S6x3K8vzCA.exe	Get hash	malicious	Unknown	Browse	139.99.188.124/wPBPjuY.txt
	PPbimZI4LV.exe	Get hash	malicious	Unknown	Browse	139.99.188.124/BlQMSgJx.txt
	l5VhEpwzJy.exe	Get hash	malicious	Unknown	Browse	139.99.188.124/jiJNz.txt
	duyba.lnk.download.lnk	Get hash	malicious	Unknown	Browse	139.99.188.124/QWCheljD.txt
	pt8GJiNZDT.exe	Get hash	malicious	Unknown	Browse	139.99.188.124/QWCheljD.txt
	FwR7as4xUq.exe	Get hash	malicious	Unknown	Browse	139.99.188.124/EPDjSfs.txt

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
bg.microsoft.map.fastly.net	JnEZtj3vtN.exe	Get hash	malicious	PureCrypter	Browse	199.232.210.172
	uzI7DAON53.exe	Get hash	malicious	PureCrypter	Browse	199.232.214.172
	YF3YnL4ksc.exe	Get hash	malicious	Unknown	Browse	199.232.210.172
	#U041f#U043b#U0430#U0442i#U0436#U043d#U0430 i#U043d#U0441#U0442#U0440#U0443#U043a#U0446i#U044f.js	Get hash	malicious	SmokeLoader	Browse	199.232.210.172
	#U0421#U043a#U0430#U043d-#U043a#U043e#U043fi#U044f #U041f#U0430#U0441#U043f#U043e#U0440#U0442.vbs	Get hash	malicious	SmokeLoader	Browse	199.232.210.172
	#U0421#U043a#U0430#U043d-#U043a#U043e#U043fi#U044f #U0414#U043e#U0433#U043e#U0432i#U0440.js	Get hash	malicious	SmokeLoader	Browse	199.232.210.172
	ToYwLfhi9B.exe	Get hash	malicious	PureCrypter, PureLog Stealer	Browse	199.232.210.172
	17345062850621022e2a034193497843f70f72ad0e2a6d5b0e23bb6cd0de4c41fac1759029833.dat-decoded.exe	Get hash	malicious	AsyncRAT, DcRat	Browse	199.232.214.172
	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, RHADAMANTHYS, Xmrig	Browse	199.232.210.172
	Invoice.exe	Get hash	malicious	Snake Keylogger	Browse	199.232.214.172
default.qdr.p1.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com	YF3YnL4ksc.exe	Get hash	malicious	Unknown	Browse	217.20.58.99
	#U041f#U043b#U0430#U0442i#U0436#U043d#U0430 i#U043d#U0441#U0442#U0440#U0443#U043a#U0446i#U044f.js	Get hash	malicious	SmokeLoader	Browse	217.20.58.100
	PPbimZI4LV.exe	Get hash	malicious	Unknown	Browse	217.20.58.100
	http://ngfreemessage-verifying.freewebhostmost.com/	Get hash	malicious	HTMLPhisher	Browse	217.20.58.99
	uEhN67huiV.dll	Get hash	malicious	Unknown	Browse	212.229.88.13
	JkICQ13OOY.dll	Get hash	malicious	Unknown	Browse	217.20.56.100
	V65xPrgEHH.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse	217.20.58.99
	BwQ1ZjHbt3.bat	Get hash	malicious	Unknown	Browse	217.20.57.23
	payload_1.hta	Get hash	malicious	RedLine	Browse	217.20.58.100
	69633f.msi	Get hash	malicious	Vidar	Browse	217.20.58.98

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
OVHFR	EO3RT0fEfb.exe	Get hash	malicious	Unknown	Browse	139.99.188.124
	RMBOriPHVJ.exe	Get hash	malicious	Unknown	Browse	139.99.188.124
	ToYwLfhi9B.exe	Get hash	malicious	PureCrypter, PureLog Stealer	Browse	139.99.188.124
	KE2yNJdV55.exe	Get hash	malicious	PureCrypter	Browse	139.99.188.124
	JnEZtj3vtN.exe	Get hash	malicious	PureCrypter	Browse	139.99.188.124
	uzI7DAON53.exe	Get hash	malicious	PureCrypter	Browse	139.99.188.124
	JXEsthReim.exe	Get hash	malicious	PureCrypter, PureLog Stealer	Browse	139.99.188.124
	4a5MWYOGVy.exe	Get hash	malicious	PureCrypter	Browse	139.99.188.124
	YF3YnL4ksc.exe	Get hash	malicious	Unknown	Browse	139.99.188.124
	S6x3K8vzCA.exe	Get hash	malicious	Unknown	Browse	139.99.188.124

Process:	C:\Users\user\Desktop\LA0gY3d103.exe
File Type:	Microsoft Cabinet archive data, Windows 2000/XP setup, 71954 bytes, 1 file, at 0x2c +A "authroot.stl", number 1, 6 datablocks, 0x1 compression
Category:	dropped
Size (bytes):	71954
Entropy (8bit):	7.996617769952133
Encrypted:	true
SSDEEP:	1536:gc257bHnClJ3v5mnAQEBP+bfnW8Ctl8G1G4eu76NWDdB34w18R5cBWcJAm68+Q:gp2ld5jPqW8LgeulxB3fgcEfDQ
MD5:	49AEBF8CBD62D92AC215B2923FB1B9F5
SHA1:	1723BE06719828DDA65AD804298D0431F6AFF976
SHA-256:	B33EFCB95235B98B48508E019AFA4B7655E80CF071DEFABD8B2123FC8B29307F
SHA-512:	BF86116B015FB56709516D686E168E7C9C68365136231CC51D0B6542AE95323A71D2C7ACEC84AAD7DCECC2E410843F6D82A0A6D51B9ACFC721A9C84FDD877B5B
Malicious:	false
Reputation:	high, very likely benign file
Preview:	MSCF............,...................I..................XaK .authroot.stl.[.i..6..CK..<Tk......4.cl!Kg..E..Y.f_..".$mR"$.J.E.KB."..rKv.."{.g....3.W.....c..9.s...=....y6#..x..........D......\(.#.s.!.A.......cd.c........+^.ov...n.....3BL..0.......BPUR&.X..02.q...R...J.....w.....b.vy>....-.&..(..oe."."...J9...0U.6J..\|U..S.....M.F8g...=.......p...........l.?3.J.x.G.Ep..$g..tj......)v]9(:.)W.8.Op.1Q..:.nPd........7.7..M].V F..g.....12..!7(...B.......h.RZ.......l.<.....6..Z^.`p?... .p.Gp.#.'.X..........\|!.8.....".m.49r?.I...g...8.v.....a``.g.R4.i...J8q....NFW,E.6Y....!.o5%.Y.....R..<..S9....r....WO...(.....F..Q=....-..7d..O(....-..+k.........K..........{Q....Z..j._.E...QZ.~.\.^......N.9.k..O.}dD.b1r...[}/....T..E..G..c.\|.c.&>?..^t. ..;..X.d.E.0G....[Q.,......#.Dp..L.o\|#syc.J............}G-.ou6.=52..XWi=...m.....^u......c..fc?&pR7S5....I...j.G........j.j..Tc.El.....B.pQ.,Bp....j...9g.. >..s..m#.Nb.o_u.M.V...........\#...v..Mo\sF..s....Y...

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506

Download File

Process:	C:\Users\user\Desktop\LA0gY3d103.exe
File Type:	data
Category:	dropped
Size (bytes):	328
Entropy (8bit):	3.108740171929208
Encrypted:	false
SSDEEP:	6:kKbc9UswDLL+N+SkQlPlEGYRMY9z+4KlDA3RUebT3:TDnLNkPlE99SNxAhUe/3
MD5:	1254521554C0EBB0B7E37195241FA0A4
SHA1:	681AB1478CEB15A316647BBC4658942E2C6BF732
SHA-256:	A628DA149B8818A71554F76C0DBF0C883499EFC4E129857E07CB76B08FBF27CF
SHA-512:	62DEB9F929CEE2C25D83B48C3F7F10B942BD7864D95801223132E4E0D21C41F56A22E141370120594EBC22C05AFD4ADE8047D8D197A7B41FEE6E84D359C15045
Malicious:	false
Reputation:	low
Preview:	p...... ........@8.r(Q..(....................................................... ........G..@.......&...............h.t.t.p.:././.c.t.l.d.l...w.i.n.d.o.w.s.u.p.d.a.t.e...c.o.m./.m.s.d.o.w.n.l.o.a.d./.u.p.d.a.t.e./.v.3./.s.t.a.t.i.c./.t.r.u.s.t.e.d.r./.e.n./.a.u.t.h.r.o.o.t.s.t.l...c.a.b...".a.7.2.8.2.e.b.4.0.b.1.d.a.1.:.0."...

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Entropy (8bit):	7.59711791792846
TrID:	Win32 Executable (generic) Net Framework (10011505/4) 49.83% Win32 Executable (generic) a (10002005/4) 49.78% Generic CIL Executable (.NET, Mono, etc.) (73296/58) 0.36% Generic Win/DOS Executable (2004/3) 0.01% DOS Executable Generic (2002/1) 0.01%
File name:	LA0gY3d103.exe
File size:	551'936 bytes
MD5:	84344446f13fafc82222d1c2946de989
SHA1:	3cb6374dcfd3b579e53ed687712c1763d27ab099
SHA256:	e13d0f9fd3d953a7561bb2e190664871513d431acf134cb3eee63b8d04b2e6f5
SHA512:	a0102068a540d5280cd9fd5c112fa2aeac65088fe306303b793265b4dee25bef0a46a7314560d7cd3ed30fd3e6c07a5d419c29d5cff01646573bffe44ee8844e
SSDEEP:	12288:66EO6yHGDAK5COkUf0CMBWGSy4GD8wCgq:66EO5OATBUpoWBy98Pgq
TLSH:	20C4DF3A32A54F42C6186978C8EB96301FF2EC877A73DB4A3E4636D11D213A49D937D4
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....@................0..J... .......i... ........@.. ....................................@................................

File Icon


Icon Hash:	0396a6a5a1a1a6bb

Static PE Info

General

Entrypoint:	0x48690e
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
Time Stamp:	0x8FFF4003 [Sun Jul 22 10:59:15 2046 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:	f34d5f2d4577ed6d9ceec516c1f5a744

Entrypoint Preview

Instruction
jmp dword ptr [00402000h]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x868c0	0x4b	.text
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x88000	0x1c3c	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x8a000	0xc	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x2000	0x8	.text
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x2008	0x48	.text

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x2000	0x84914	0x84a00	53f3ee1e22f49d01ede69f89a439fb75	False	0.8403757510603205	SysEx File -	7.637336684046911	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rsrc	0x88000	0x1c3c	0x1e00	54a9f89345c97b8a359d9a06e7c6d03c	False	0.156640625	data	2.90517259788541	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.reloc	0x8a000	0xc	0x200	893d2848a1bf66039f171909cc89d0df	False	0.044921875	data	0.10191042566270775	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	ZLIB Complexity
RT_ICON	0x88140	0x1628	Device independent bitmap graphic, 64 x 128 x 8, image size 4096, 256 important colors	0.08885754583921016
RT_GROUP_ICON	0x89768	0x14	data	1.1
RT_VERSION	0x8977c	0x2d4	data	0.4350828729281768
RT_MANIFEST	0x89a50	0x1ea	XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators	0.5489795918367347

Imports

DLL	Import
mscoree.dll	_CorExeMain

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2024-12-18T09:40:07.575206+0100	2035595	ET MALWARE Generic AsyncRAT Style SSL Cert	1	139.99.188.124	56001	192.168.2.8	49704	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Dec 18, 2024 09:40:04.754230976 CET	49704	56001	192.168.2.8	139.99.188.124
Dec 18, 2024 09:40:04.873718977 CET	56001	49704	139.99.188.124	192.168.2.8
Dec 18, 2024 09:40:04.873950958 CET	49704	56001	192.168.2.8	139.99.188.124
Dec 18, 2024 09:40:05.754993916 CET	49704	56001	192.168.2.8	139.99.188.124
Dec 18, 2024 09:40:05.874448061 CET	56001	49704	139.99.188.124	192.168.2.8
Dec 18, 2024 09:40:05.874584913 CET	49704	56001	192.168.2.8	139.99.188.124
Dec 18, 2024 09:40:05.876445055 CET	49704	56001	192.168.2.8	139.99.188.124
Dec 18, 2024 09:40:05.995862961 CET	56001	49704	139.99.188.124	192.168.2.8
Dec 18, 2024 09:40:05.995918989 CET	49704	56001	192.168.2.8	139.99.188.124
Dec 18, 2024 09:40:06.116599083 CET	56001	49704	139.99.188.124	192.168.2.8
Dec 18, 2024 09:40:07.373092890 CET	56001	49704	139.99.188.124	192.168.2.8
Dec 18, 2024 09:40:07.373193026 CET	56001	49704	139.99.188.124	192.168.2.8
Dec 18, 2024 09:40:07.373478889 CET	49704	56001	192.168.2.8	139.99.188.124
Dec 18, 2024 09:40:07.455739975 CET	49704	56001	192.168.2.8	139.99.188.124
Dec 18, 2024 09:40:07.575206041 CET	56001	49704	139.99.188.124	192.168.2.8
Dec 18, 2024 09:40:07.977056980 CET	56001	49704	139.99.188.124	192.168.2.8
Dec 18, 2024 09:40:08.020653963 CET	49704	56001	192.168.2.8	139.99.188.124
Dec 18, 2024 09:40:14.557151079 CET	49704	56001	192.168.2.8	139.99.188.124
Dec 18, 2024 09:40:14.676717043 CET	56001	49704	139.99.188.124	192.168.2.8
Dec 18, 2024 09:40:14.676922083 CET	49704	56001	192.168.2.8	139.99.188.124
Dec 18, 2024 09:40:14.796521902 CET	56001	49704	139.99.188.124	192.168.2.8
Dec 18, 2024 09:40:47.350214958 CET	49704	56001	192.168.2.8	139.99.188.124
Dec 18, 2024 09:40:47.469818115 CET	56001	49704	139.99.188.124	192.168.2.8
Dec 18, 2024 09:40:47.469901085 CET	49704	56001	192.168.2.8	139.99.188.124
Dec 18, 2024 09:40:47.589431047 CET	56001	49704	139.99.188.124	192.168.2.8
Dec 18, 2024 09:40:48.084112883 CET	49704	56001	192.168.2.8	139.99.188.124
Dec 18, 2024 09:40:48.123513937 CET	56001	49704	139.99.188.124	192.168.2.8
Dec 18, 2024 09:40:48.123627901 CET	49704	56001	192.168.2.8	139.99.188.124
Dec 18, 2024 09:40:48.203804016 CET	56001	49704	139.99.188.124	192.168.2.8
Dec 18, 2024 09:40:48.243277073 CET	56001	49704	139.99.188.124	192.168.2.8
Dec 18, 2024 09:40:48.380295992 CET	56001	49704	139.99.188.124	192.168.2.8
Dec 18, 2024 09:40:48.394242048 CET	49704	56001	192.168.2.8	139.99.188.124
Dec 18, 2024 09:40:48.513751984 CET	56001	49704	139.99.188.124	192.168.2.8
Dec 18, 2024 09:40:48.513859987 CET	49704	56001	192.168.2.8	139.99.188.124
Dec 18, 2024 09:40:48.633352995 CET	56001	49704	139.99.188.124	192.168.2.8
Dec 18, 2024 09:40:48.864697933 CET	56001	49704	139.99.188.124	192.168.2.8
Dec 18, 2024 09:40:48.911356926 CET	49704	56001	192.168.2.8	139.99.188.124
Dec 18, 2024 09:40:49.073339939 CET	56001	49704	139.99.188.124	192.168.2.8
Dec 18, 2024 09:40:49.078886986 CET	49704	56001	192.168.2.8	139.99.188.124
Dec 18, 2024 09:40:49.198357105 CET	56001	49704	139.99.188.124	192.168.2.8
Dec 18, 2024 09:40:49.198432922 CET	49704	56001	192.168.2.8	139.99.188.124
Dec 18, 2024 09:40:49.317872047 CET	56001	49704	139.99.188.124	192.168.2.8
Dec 18, 2024 09:41:25.084364891 CET	49704	56001	192.168.2.8	139.99.188.124
Dec 18, 2024 09:41:25.203860998 CET	56001	49704	139.99.188.124	192.168.2.8
Dec 18, 2024 09:41:25.203994036 CET	49704	56001	192.168.2.8	139.99.188.124
Dec 18, 2024 09:41:25.323554993 CET	56001	49704	139.99.188.124	192.168.2.8
Dec 18, 2024 09:41:25.857870102 CET	56001	49704	139.99.188.124	192.168.2.8
Dec 18, 2024 09:41:25.911473989 CET	49704	56001	192.168.2.8	139.99.188.124
Dec 18, 2024 09:41:26.114792109 CET	56001	49704	139.99.188.124	192.168.2.8
Dec 18, 2024 09:41:26.116988897 CET	49704	56001	192.168.2.8	139.99.188.124
Dec 18, 2024 09:41:26.236520052 CET	56001	49704	139.99.188.124	192.168.2.8
Dec 18, 2024 09:41:26.236605883 CET	49704	56001	192.168.2.8	139.99.188.124
Dec 18, 2024 09:41:26.356609106 CET	56001	49704	139.99.188.124	192.168.2.8
Dec 18, 2024 09:41:51.990118980 CET	49704	56001	192.168.2.8	139.99.188.124
Dec 18, 2024 09:41:52.110013008 CET	56001	49704	139.99.188.124	192.168.2.8
Dec 18, 2024 09:41:52.110105038 CET	49704	56001	192.168.2.8	139.99.188.124
Dec 18, 2024 09:41:52.229638100 CET	56001	49704	139.99.188.124	192.168.2.8
Dec 18, 2024 09:41:52.774961948 CET	56001	49704	139.99.188.124	192.168.2.8
Dec 18, 2024 09:41:52.835347891 CET	49704	56001	192.168.2.8	139.99.188.124
Dec 18, 2024 09:41:53.021640062 CET	56001	49704	139.99.188.124	192.168.2.8
Dec 18, 2024 09:41:53.029484034 CET	49704	56001	192.168.2.8	139.99.188.124
Dec 18, 2024 09:41:53.149053097 CET	56001	49704	139.99.188.124	192.168.2.8
Dec 18, 2024 09:41:53.150331020 CET	49704	56001	192.168.2.8	139.99.188.124
Dec 18, 2024 09:41:53.269887924 CET	56001	49704	139.99.188.124	192.168.2.8
Dec 18, 2024 09:41:56.708714008 CET	49704	56001	192.168.2.8	139.99.188.124
Dec 18, 2024 09:41:56.828372955 CET	56001	49704	139.99.188.124	192.168.2.8
Dec 18, 2024 09:41:56.828563929 CET	49704	56001	192.168.2.8	139.99.188.124
Dec 18, 2024 09:41:56.948084116 CET	56001	49704	139.99.188.124	192.168.2.8
Dec 18, 2024 09:41:57.319104910 CET	49704	56001	192.168.2.8	139.99.188.124
Dec 18, 2024 09:41:57.438785076 CET	56001	49704	139.99.188.124	192.168.2.8
Dec 18, 2024 09:41:57.438848019 CET	49704	56001	192.168.2.8	139.99.188.124
Dec 18, 2024 09:41:57.487488985 CET	56001	49704	139.99.188.124	192.168.2.8
Dec 18, 2024 09:41:57.536520958 CET	49704	56001	192.168.2.8	139.99.188.124
Dec 18, 2024 09:41:57.558413029 CET	56001	49704	139.99.188.124	192.168.2.8
Dec 18, 2024 09:41:57.740711927 CET	56001	49704	139.99.188.124	192.168.2.8
Dec 18, 2024 09:41:57.742696047 CET	49704	56001	192.168.2.8	139.99.188.124
Dec 18, 2024 09:41:57.862206936 CET	56001	49704	139.99.188.124	192.168.2.8
Dec 18, 2024 09:41:57.862267971 CET	49704	56001	192.168.2.8	139.99.188.124
Dec 18, 2024 09:41:57.981829882 CET	56001	49704	139.99.188.124	192.168.2.8
Dec 18, 2024 09:41:58.097456932 CET	56001	49704	139.99.188.124	192.168.2.8
Dec 18, 2024 09:41:58.099334002 CET	49704	56001	192.168.2.8	139.99.188.124
Dec 18, 2024 09:41:58.218934059 CET	56001	49704	139.99.188.124	192.168.2.8
Dec 18, 2024 09:41:58.219268084 CET	49704	56001	192.168.2.8	139.99.188.124
Dec 18, 2024 09:41:58.306766033 CET	56001	49704	139.99.188.124	192.168.2.8
Dec 18, 2024 09:41:58.339154959 CET	56001	49704	139.99.188.124	192.168.2.8
Dec 18, 2024 09:41:58.342708111 CET	49704	56001	192.168.2.8	139.99.188.124
Dec 18, 2024 09:41:58.462557077 CET	56001	49704	139.99.188.124	192.168.2.8
Dec 18, 2024 09:41:58.775888920 CET	56001	49704	139.99.188.124	192.168.2.8
Dec 18, 2024 09:41:58.817930937 CET	49704	56001	192.168.2.8	139.99.188.124
Dec 18, 2024 09:41:59.009212017 CET	56001	49704	139.99.188.124	192.168.2.8
Dec 18, 2024 09:41:59.012701988 CET	49704	56001	192.168.2.8	139.99.188.124
Dec 18, 2024 09:41:59.132508039 CET	56001	49704	139.99.188.124	192.168.2.8
Dec 18, 2024 09:41:59.132661104 CET	49704	56001	192.168.2.8	139.99.188.124
Dec 18, 2024 09:41:59.252504110 CET	56001	49704	139.99.188.124	192.168.2.8
Dec 18, 2024 09:42:21.350522041 CET	49704	56001	192.168.2.8	139.99.188.124
Dec 18, 2024 09:42:21.470216036 CET	56001	49704	139.99.188.124	192.168.2.8
Dec 18, 2024 09:42:21.470259905 CET	49704	56001	192.168.2.8	139.99.188.124
Dec 18, 2024 09:42:21.589840889 CET	56001	49704	139.99.188.124	192.168.2.8
Dec 18, 2024 09:42:22.143996954 CET	56001	49704	139.99.188.124	192.168.2.8
Dec 18, 2024 09:42:22.193417072 CET	49704	56001	192.168.2.8	139.99.188.124
Dec 18, 2024 09:42:22.397872925 CET	56001	49704	139.99.188.124	192.168.2.8
Dec 18, 2024 09:42:22.407753944 CET	49704	56001	192.168.2.8	139.99.188.124
Dec 18, 2024 09:42:22.527836084 CET	56001	49704	139.99.188.124	192.168.2.8
Dec 18, 2024 09:42:22.535128117 CET	49704	56001	192.168.2.8	139.99.188.124
Dec 18, 2024 09:42:22.658653975 CET	56001	49704	139.99.188.124	192.168.2.8
Dec 18, 2024 09:42:45.115099907 CET	49704	56001	192.168.2.8	139.99.188.124
Dec 18, 2024 09:42:45.234642029 CET	56001	49704	139.99.188.124	192.168.2.8
Dec 18, 2024 09:42:45.235219955 CET	49704	56001	192.168.2.8	139.99.188.124
Dec 18, 2024 09:42:45.354707003 CET	56001	49704	139.99.188.124	192.168.2.8
Dec 18, 2024 09:42:45.896178961 CET	56001	49704	139.99.188.124	192.168.2.8
Dec 18, 2024 09:42:45.942887068 CET	49704	56001	192.168.2.8	139.99.188.124
Dec 18, 2024 09:42:46.147823095 CET	56001	49704	139.99.188.124	192.168.2.8
Dec 18, 2024 09:42:46.150355101 CET	49704	56001	192.168.2.8	139.99.188.124
Dec 18, 2024 09:42:46.270019054 CET	56001	49704	139.99.188.124	192.168.2.8
Dec 18, 2024 09:42:46.270138979 CET	49704	56001	192.168.2.8	139.99.188.124
Dec 18, 2024 09:42:46.389962912 CET	56001	49704	139.99.188.124	192.168.2.8
Dec 18, 2024 09:42:48.709011078 CET	49704	56001	192.168.2.8	139.99.188.124
Dec 18, 2024 09:42:48.828701019 CET	56001	49704	139.99.188.124	192.168.2.8
Dec 18, 2024 09:42:48.828789949 CET	49704	56001	192.168.2.8	139.99.188.124
Dec 18, 2024 09:42:48.948359966 CET	56001	49704	139.99.188.124	192.168.2.8
Dec 18, 2024 09:42:49.485019922 CET	56001	49704	139.99.188.124	192.168.2.8
Dec 18, 2024 09:42:49.536632061 CET	49704	56001	192.168.2.8	139.99.188.124
Dec 18, 2024 09:42:49.741671085 CET	56001	49704	139.99.188.124	192.168.2.8
Dec 18, 2024 09:42:49.743944883 CET	49704	56001	192.168.2.8	139.99.188.124
Dec 18, 2024 09:42:49.863492966 CET	56001	49704	139.99.188.124	192.168.2.8
Dec 18, 2024 09:42:49.863629103 CET	49704	56001	192.168.2.8	139.99.188.124
Dec 18, 2024 09:42:49.983088970 CET	56001	49704	139.99.188.124	192.168.2.8
Dec 18, 2024 09:42:57.349798918 CET	49704	56001	192.168.2.8	139.99.188.124
Dec 18, 2024 09:42:57.469419956 CET	56001	49704	139.99.188.124	192.168.2.8
Dec 18, 2024 09:42:57.469463110 CET	49704	56001	192.168.2.8	139.99.188.124
Dec 18, 2024 09:42:57.591444016 CET	56001	49704	139.99.188.124	192.168.2.8
Dec 18, 2024 09:42:57.912187099 CET	49704	56001	192.168.2.8	139.99.188.124
Dec 18, 2024 09:42:58.031959057 CET	56001	49704	139.99.188.124	192.168.2.8
Dec 18, 2024 09:42:58.032006025 CET	49704	56001	192.168.2.8	139.99.188.124
Dec 18, 2024 09:42:58.126157045 CET	56001	49704	139.99.188.124	192.168.2.8
Dec 18, 2024 09:42:58.151581049 CET	56001	49704	139.99.188.124	192.168.2.8
Dec 18, 2024 09:42:58.177272081 CET	49704	56001	192.168.2.8	139.99.188.124
Dec 18, 2024 09:42:58.384074926 CET	56001	49704	139.99.188.124	192.168.2.8
Dec 18, 2024 09:42:58.386909008 CET	49704	56001	192.168.2.8	139.99.188.124
Dec 18, 2024 09:42:58.506541014 CET	56001	49704	139.99.188.124	192.168.2.8
Dec 18, 2024 09:42:58.506736994 CET	49704	56001	192.168.2.8	139.99.188.124
Dec 18, 2024 09:42:58.617501974 CET	56001	49704	139.99.188.124	192.168.2.8
Dec 18, 2024 09:42:58.626344919 CET	56001	49704	139.99.188.124	192.168.2.8
Dec 18, 2024 09:42:58.661753893 CET	49704	56001	192.168.2.8	139.99.188.124
Dec 18, 2024 09:42:58.852361917 CET	56001	49704	139.99.188.124	192.168.2.8
Dec 18, 2024 09:42:58.898437977 CET	49704	56001	192.168.2.8	139.99.188.124
Dec 18, 2024 09:42:58.907835007 CET	49704	56001	192.168.2.8	139.99.188.124
Dec 18, 2024 09:42:59.027378082 CET	56001	49704	139.99.188.124	192.168.2.8
Dec 18, 2024 09:42:59.032371044 CET	49704	56001	192.168.2.8	139.99.188.124
Dec 18, 2024 09:42:59.151930094 CET	56001	49704	139.99.188.124	192.168.2.8
Dec 18, 2024 09:43:02.287333012 CET	49704	56001	192.168.2.8	139.99.188.124
Dec 18, 2024 09:43:02.407324076 CET	56001	49704	139.99.188.124	192.168.2.8
Dec 18, 2024 09:43:02.407368898 CET	49704	56001	192.168.2.8	139.99.188.124
Dec 18, 2024 09:43:02.526859999 CET	56001	49704	139.99.188.124	192.168.2.8
Dec 18, 2024 09:43:03.063381910 CET	56001	49704	139.99.188.124	192.168.2.8
Dec 18, 2024 09:43:03.114906073 CET	49704	56001	192.168.2.8	139.99.188.124
Dec 18, 2024 09:43:03.320516109 CET	56001	49704	139.99.188.124	192.168.2.8
Dec 18, 2024 09:43:03.322938919 CET	49704	56001	192.168.2.8	139.99.188.124
Dec 18, 2024 09:43:03.442442894 CET	56001	49704	139.99.188.124	192.168.2.8
Dec 18, 2024 09:43:03.442545891 CET	49704	56001	192.168.2.8	139.99.188.124
Dec 18, 2024 09:43:03.562081099 CET	56001	49704	139.99.188.124	192.168.2.8
Dec 18, 2024 09:43:39.289676905 CET	49704	56001	192.168.2.8	139.99.188.124
Dec 18, 2024 09:43:39.409420967 CET	56001	49704	139.99.188.124	192.168.2.8
Dec 18, 2024 09:43:39.412391901 CET	49704	56001	192.168.2.8	139.99.188.124
Dec 18, 2024 09:43:39.532594919 CET	56001	49704	139.99.188.124	192.168.2.8
Dec 18, 2024 09:43:40.070837021 CET	56001	49704	139.99.188.124	192.168.2.8
Dec 18, 2024 09:43:40.114880085 CET	49704	56001	192.168.2.8	139.99.188.124
Dec 18, 2024 09:43:40.320774078 CET	56001	49704	139.99.188.124	192.168.2.8
Dec 18, 2024 09:43:40.322683096 CET	49704	56001	192.168.2.8	139.99.188.124
Dec 18, 2024 09:43:40.442364931 CET	56001	49704	139.99.188.124	192.168.2.8
Dec 18, 2024 09:43:40.442451954 CET	49704	56001	192.168.2.8	139.99.188.124
Dec 18, 2024 09:43:40.562016010 CET	56001	49704	139.99.188.124	192.168.2.8
Dec 18, 2024 09:43:43.318403959 CET	49704	56001	192.168.2.8	139.99.188.124
Dec 18, 2024 09:43:43.438051939 CET	56001	49704	139.99.188.124	192.168.2.8
Dec 18, 2024 09:43:43.438127041 CET	49704	56001	192.168.2.8	139.99.188.124
Dec 18, 2024 09:43:43.557677984 CET	56001	49704	139.99.188.124	192.168.2.8
Dec 18, 2024 09:43:44.096198082 CET	56001	49704	139.99.188.124	192.168.2.8
Dec 18, 2024 09:43:44.146146059 CET	49704	56001	192.168.2.8	139.99.188.124
Dec 18, 2024 09:43:44.352343082 CET	56001	49704	139.99.188.124	192.168.2.8
Dec 18, 2024 09:43:44.354290009 CET	49704	56001	192.168.2.8	139.99.188.124
Dec 18, 2024 09:43:44.474064112 CET	56001	49704	139.99.188.124	192.168.2.8
Dec 18, 2024 09:43:44.474231005 CET	49704	56001	192.168.2.8	139.99.188.124
Dec 18, 2024 09:43:44.593950033 CET	56001	49704	139.99.188.124	192.168.2.8
Dec 18, 2024 09:44:03.654275894 CET	49704	56001	192.168.2.8	139.99.188.124
Dec 18, 2024 09:44:03.773964882 CET	56001	49704	139.99.188.124	192.168.2.8
Dec 18, 2024 09:44:03.774015903 CET	49704	56001	192.168.2.8	139.99.188.124
Dec 18, 2024 09:44:03.893662930 CET	56001	49704	139.99.188.124	192.168.2.8
Dec 18, 2024 09:44:04.442281961 CET	56001	49704	139.99.188.124	192.168.2.8
Dec 18, 2024 09:44:04.490061998 CET	49704	56001	192.168.2.8	139.99.188.124
Dec 18, 2024 09:44:04.696352005 CET	56001	49704	139.99.188.124	192.168.2.8
Dec 18, 2024 09:44:04.701145887 CET	49704	56001	192.168.2.8	139.99.188.124
Dec 18, 2024 09:44:04.820988894 CET	56001	49704	139.99.188.124	192.168.2.8
Dec 18, 2024 09:44:04.821619034 CET	49704	56001	192.168.2.8	139.99.188.124
Dec 18, 2024 09:44:04.941222906 CET	56001	49704	139.99.188.124	192.168.2.8

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Dec 18, 2024 09:40:08.272656918 CET	1.1.1.1	192.168.2.8	0xf73c	No error (0)	edge.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com	default.qdr.p1.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com		CNAME (Canonical name)	IN (0x0001)	false
Dec 18, 2024 09:40:08.272656918 CET	1.1.1.1	192.168.2.8	0xf73c	No error (0)	default.qdr.p1.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com		217.20.58.100	A (IP address)	IN (0x0001)	false
Dec 18, 2024 09:40:08.272656918 CET	1.1.1.1	192.168.2.8	0xf73c	No error (0)	default.qdr.p1.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com		217.20.58.101	A (IP address)	IN (0x0001)	false
Dec 18, 2024 09:40:08.272656918 CET	1.1.1.1	192.168.2.8	0xf73c	No error (0)	default.qdr.p1.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com		217.20.58.99	A (IP address)	IN (0x0001)	false
Dec 18, 2024 09:40:08.272656918 CET	1.1.1.1	192.168.2.8	0xf73c	No error (0)	default.qdr.p1.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com		217.20.58.98	A (IP address)	IN (0x0001)	false
Dec 18, 2024 09:41:23.812802076 CET	1.1.1.1	192.168.2.8	0x881f	No error (0)	bg.microsoft.map.fastly.net		199.232.214.172	A (IP address)	IN (0x0001)	false
Dec 18, 2024 09:41:23.812802076 CET	1.1.1.1	192.168.2.8	0x881f	No error (0)	bg.microsoft.map.fastly.net		199.232.210.172	A (IP address)	IN (0x0001)	false

Target ID:	0
Start time:	03:39:57
Start date:	18/12/2024
Path:	C:\Users\user\Desktop\LA0gY3d103.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\LA0gY3d103.exe"
Imagebase:	0x7f0000
File size:	551'936 bytes
MD5 hash:	84344446F13FAFC82222D1C2946DE989
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_PureLogStealer, Description: Yara detected PureLog Stealer, Source: 00000000.00000000.1447019100.00000000007F2000.00000002.00000001.01000000.00000003.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000000.00000002.3888658257.0000000002CBB000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	false

Show Windows behavior

Execution Graph

Execution Coverage:	11.8%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	0%
Total number of Nodes:	35
Total number of Limit Nodes:	3

Executed Functions

Function 0103E900 Relevance: 14.2, Strings: 11, Instructions: 443
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

(K, xrefs: 0103EB40
(K, xrefs: 0103E9FB
(K, xrefs: 0103ED87
(K, xrefs: 0103ECBD
(K, xrefs: 0103EA1A
(K, xrefs: 0103EA83
(K, xrefs: 0103E9DC
(K, xrefs: 0103EB88
(K, xrefs: 0103EAA2
(K, xrefs: 0103EB21
(K, xrefs: 0103EA64

Memory Dump Source

Source File: 00000000.00000002.3888370412.0000000001030000.00000040.00000800.00020000.00000000.sdmp, Offset: 01030000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1030000_LA0gY3d103.jbxd

Similarity

API ID:
String ID: (K$(K$(K$(K$(K$(K$(K$(K$(K$(K$(K
API String ID: 0-2200378177
Opcode ID: 1678762fafe09a5d58c104c7453295f69c7f9a2ef04c539e8cffc46339533de9
Instruction ID: 1ceabe9f26aa910f61b3881cfe233b3dc871a0d294c7dfa40f0f7b2cf7699d4a
Opcode Fuzzy Hash: 1678762fafe09a5d58c104c7453295f69c7f9a2ef04c539e8cffc46339533de9
Instruction Fuzzy Hash: 1102CE74B00109CFD704EB6AF8447AF73A7EBC8302F259565E542AB7A9CB349C868B51

Function 06A90880 Relevance: 2.7, Strings: 1, Instructions: 1499
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

|fW, xrefs: 06A90FE4

Memory Dump Source

Source File: 00000000.00000002.3894696406.0000000006A90000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a90000_LA0gY3d103.jbxd

Similarity

API ID:
String ID: |fW
API String ID: 0-2954663988
Opcode ID: 5cbcc14b5478cbab40a2f43c88737b95d031502e5c6f07f3454d6210b8a4e730
Instruction ID: 2f5fe8fec1631b11d45c4a925bfaf85c5ba84676076e2708cb91d3caa8fc6a0a
Opcode Fuzzy Hash: 5cbcc14b5478cbab40a2f43c88737b95d031502e5c6f07f3454d6210b8a4e730
Instruction Fuzzy Hash: 5CE2A874700225CFC749EB24D5A8B6B77F6BB8C600F5141A9D44AEB399EB32AD41DF80

Function 0550E6F0 Relevance: 2.7, Strings: 1, Instructions: 1499COMMON

Download Yara Rule

Strings

4, xrefs: 0550F63D

Memory Dump Source

Source File: 00000000.00000002.3891795807.0000000005500000.00000040.00000800.00020000.00000000.sdmp, Offset: 05500000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5500000_LA0gY3d103.jbxd

Similarity

API ID:
String ID: 4
API String ID: 0-4088798008
Opcode ID: d9f96b84c7660575e7ddf77118a5b4b49be30d4eae94658b54db72207b7b5650
Instruction ID: 7d99dd17703527d64987034a852ad4b1937f86757b467a0a5452ec17cd284af3
Opcode Fuzzy Hash: d9f96b84c7660575e7ddf77118a5b4b49be30d4eae94658b54db72207b7b5650
Instruction Fuzzy Hash: 3FE22C34A04218DFDB19EF64D895BAEBBB6FF88300F149199E905AB395DB309D41CF90

Function 06A90871 Relevance: 2.7, Strings: 1, Instructions: 1498
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

|fW, xrefs: 06A90FE4

Memory Dump Source

Source File: 00000000.00000002.3894696406.0000000006A90000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a90000_LA0gY3d103.jbxd

Similarity

API ID:
String ID: |fW
API String ID: 0-2954663988
Opcode ID: 953cbbf76aba1e5802391796347e9f2e327ba73845753bb5acb30e639467f58e
Instruction ID: 22b4aa0ddf828a32d1b0b150d116ac9272ce4fcbfee979ccf1cd117bd0934dd9
Opcode Fuzzy Hash: 953cbbf76aba1e5802391796347e9f2e327ba73845753bb5acb30e639467f58e
Instruction Fuzzy Hash: 0EF2A874700225CFC749EB24D5A8B6B77F6BB8C600F5141A9D44AEB399EB32AD41DF80

Function 06A90BA7 Relevance: 2.6, Strings: 1, Instructions: 1311
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

|fW, xrefs: 06A90FE4

Memory Dump Source

Source File: 00000000.00000002.3894696406.0000000006A90000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a90000_LA0gY3d103.jbxd

Similarity

API ID:
String ID: |fW
API String ID: 0-2954663988
Opcode ID: 75920f70847105ed4aed00dc26d7778651fd8686c077b39594d42ad4fe54b2fb
Instruction ID: 14314c4685ebc36515f685fd9cae4c55a2d10c0b66ed98d4baa16f60a92f220b
Opcode Fuzzy Hash: 75920f70847105ed4aed00dc26d7778651fd8686c077b39594d42ad4fe54b2fb
Instruction Fuzzy Hash: 3BD2A974700225CFC749EB24D5A4B6B77F6BB8C700F5141A9944AEB399EB32AD41DF80

Function 06A906C8 Relevance: 2.5, Strings: 1, Instructions: 1280
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

|fW, xrefs: 06A90FE4

Memory Dump Source

Source File: 00000000.00000002.3894696406.0000000006A90000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a90000_LA0gY3d103.jbxd

Similarity

API ID:
String ID: |fW
API String ID: 0-2954663988
Opcode ID: 01bfa2ed8b2c91d53e48cf0b8e70e136d495d5327a47bce595f1bad965359389
Instruction ID: adb2068854b42c57f36f0684ad968965b5468b3fab9c541eacc65839488adea6
Opcode Fuzzy Hash: 01bfa2ed8b2c91d53e48cf0b8e70e136d495d5327a47bce595f1bad965359389
Instruction Fuzzy Hash: EDD2A974700225CFC749EB24D5A4BAB77F6BB8C700F5141A9944AEB399EB32AD41DF80

Function 06A90730 Relevance: 2.5, Strings: 1, Instructions: 1248
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

|fW, xrefs: 06A90FE4

Memory Dump Source

Source File: 00000000.00000002.3894696406.0000000006A90000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a90000_LA0gY3d103.jbxd

Similarity

API ID:
String ID: |fW
API String ID: 0-2954663988
Opcode ID: ebaca2dddcdd2f60bc4e6ab16835b0de90631bcba5771efeb7762c5803135111
Instruction ID: 114bd40842d95d2bf185a2adc8613ce087053f56a4959e00707d8e3a14b4d885
Opcode Fuzzy Hash: ebaca2dddcdd2f60bc4e6ab16835b0de90631bcba5771efeb7762c5803135111
Instruction Fuzzy Hash: 19D2B974700225CFC749EB24D5A4BAB77F6BB8C700F5141A9944AEB399EB32AD41DF80

Function 06A90781 Relevance: 2.5, Strings: 1, Instructions: 1237
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

|fW, xrefs: 06A90FE4

Memory Dump Source

Source File: 00000000.00000002.3894696406.0000000006A90000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a90000_LA0gY3d103.jbxd

Similarity

API ID:
String ID: |fW
API String ID: 0-2954663988
Opcode ID: 150682a2f945a8875a436d671e60622515597325803085d67c5b8888935b9e59
Instruction ID: 58e9dbbf4a4f7f55c25bd1c2d484631ed381dcd37bd4dd15c554f49e55b41b1e
Opcode Fuzzy Hash: 150682a2f945a8875a436d671e60622515597325803085d67c5b8888935b9e59
Instruction Fuzzy Hash: E6D2B974700225CFC749EB24D5A4BAB77F6BB8C700F5141A9944AEB399EB32AD41DF80

Function 0550EBDA Relevance: 1.9, Strings: 1, Instructions: 696COMMON

Download Yara Rule

Strings

4, xrefs: 0550F63D

Memory Dump Source

Source File: 00000000.00000002.3891795807.0000000005500000.00000040.00000800.00020000.00000000.sdmp, Offset: 05500000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5500000_LA0gY3d103.jbxd

Similarity

API ID:
String ID: 4
API String ID: 0-4088798008
Opcode ID: cf4de601f0af55e2dfcfeb435c2c1c63dbbedd794dc2e1aaacb0ac649e810a6b
Instruction ID: d5aa015dd8e087b6e87897deb9a8a636db1da656429797711ff90376dfd85074
Opcode Fuzzy Hash: cf4de601f0af55e2dfcfeb435c2c1c63dbbedd794dc2e1aaacb0ac649e810a6b
Instruction Fuzzy Hash: F8622E34A04218CFDB65EF64D895BAEB7B6FF88300F149199E909AB395DB309D41CF90

Function 06A92BB8 Relevance: 1.6, Strings: 1, Instructions: 306COMMON

Download Yara Rule

Strings

E5t, xrefs: 06A9307E

Memory Dump Source

Source File: 00000000.00000002.3894696406.0000000006A90000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a90000_LA0gY3d103.jbxd

Similarity

API ID:
String ID: E5t
API String ID: 0-2824288718
Opcode ID: 4911fd2f0937ccb7092b708d5e6e2449a589825aae50f4413f1c0117c3d25d81
Instruction ID: 60c4168ee6c98aafbb93c128c105dba15aef7fd6ff48c005ead7f41536048add
Opcode Fuzzy Hash: 4911fd2f0937ccb7092b708d5e6e2449a589825aae50f4413f1c0117c3d25d81
Instruction Fuzzy Hash: 93D11D34B00225CFDB59EF24D598B6A77F6BB88340F2141A9D809EB399EB319D41CF91

Function 06A92BC1 Relevance: 1.5, Strings: 1, Instructions: 292COMMON

Download Yara Rule

Strings

E5t, xrefs: 06A9307E

Memory Dump Source

Source File: 00000000.00000002.3894696406.0000000006A90000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a90000_LA0gY3d103.jbxd

Similarity

API ID:
String ID: E5t
API String ID: 0-2824288718
Opcode ID: 4909741e8fd8b0ebbea5f9ade7c27f245cd28b10b13d8bd4c1db5b7c78a8e983
Instruction ID: 54a15aaf6cab5ffa9f53f896f12efecfe03ae11a81b061895a3de531a7b1a9e1
Opcode Fuzzy Hash: 4909741e8fd8b0ebbea5f9ade7c27f245cd28b10b13d8bd4c1db5b7c78a8e983
Instruction Fuzzy Hash: D2C10D34B002258FDB59EF24D598B6A77F6BB88740F2141A9D809EB398EF319D41CF91

Function 06A92C90 Relevance: 1.5, Strings: 1, Instructions: 248COMMON

Download Yara Rule

Strings

E5t, xrefs: 06A9307E

Memory Dump Source

Source File: 00000000.00000002.3894696406.0000000006A90000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a90000_LA0gY3d103.jbxd

Similarity

API ID:
String ID: E5t
API String ID: 0-2824288718
Opcode ID: 66911359dc236ffd366ef05b8888d01a55d126a34b67aa29d970d21cb9add46a
Instruction ID: f7ffef80389cc38950aed7d4508bd79bc2ff8ff5d334b99a248566605f2269de
Opcode Fuzzy Hash: 66911359dc236ffd366ef05b8888d01a55d126a34b67aa29d970d21cb9add46a
Instruction Fuzzy Hash: AEB11E34B00225CFDB59EF24D598B6A77F2BB88340F2141A9D819EB399EB319D41CF91

Function 01030D62 Relevance: 1.4, Strings: 1, Instructions: 152COMMON

Download Yara Rule

Strings

D@, xrefs: 01030F61

Memory Dump Source

Source File: 00000000.00000002.3888370412.0000000001030000.00000040.00000800.00020000.00000000.sdmp, Offset: 01030000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1030000_LA0gY3d103.jbxd

Similarity

API ID:
String ID: D@
API String ID: 0-2222373746
Opcode ID: 4327dc2aac73950e6baa0b2546a559a2a550ce6e9bd7609bad40b0536a1613dd
Instruction ID: 103e3a5b2f6d393f27cd89b90ed30d538e7c138db5fa18c473b59f17e12ca647
Opcode Fuzzy Hash: 4327dc2aac73950e6baa0b2546a559a2a550ce6e9bd7609bad40b0536a1613dd
Instruction Fuzzy Hash: CC511BB4A012448FE749EF7BF85169ABBF3BBC8300B04C129D405AB379EFB159099B50

Function 01030D70 Relevance: 1.4, Strings: 1, Instructions: 149COMMON

Download Yara Rule

Strings

D@, xrefs: 01030F61

Memory Dump Source

Source File: 00000000.00000002.3888370412.0000000001030000.00000040.00000800.00020000.00000000.sdmp, Offset: 01030000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1030000_LA0gY3d103.jbxd

Similarity

API ID:
String ID: D@
API String ID: 0-2222373746
Opcode ID: d6c55520a5b78542dcc40797e7f4ac1983458d2d05bb2e9cf42d58929d768723
Instruction ID: 3416b24a472c19e42070a4de5bf7c4f6c2115a55173876d04e4433a9c88f04fb
Opcode Fuzzy Hash: d6c55520a5b78542dcc40797e7f4ac1983458d2d05bb2e9cf42d58929d768723
Instruction Fuzzy Hash: F1511BB4A016448FE748EF7BF84169ABBE3BBC8300F04C129D405AB3B9DFB159099B51

Function 055057E0 Relevance: 1.0, Instructions: 1041COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3891795807.0000000005500000.00000040.00000800.00020000.00000000.sdmp, Offset: 05500000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5500000_LA0gY3d103.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6e2b15ee642e7ee498c14e3ac25819f8b877b76f3055fdcd9c492c33b66620ac
Instruction ID: 9d00fd790a56d3938c8d58b2b6a363092b36f70bcb1ec381784bf0f54ddedd43
Opcode Fuzzy Hash: 6e2b15ee642e7ee498c14e3ac25819f8b877b76f3055fdcd9c492c33b66620ac
Instruction Fuzzy Hash: 6282E4729105159FCB14CBA8CC86FAEBBF5FF48314B58A159D405EB382EB74E852CB90

Function 05503850 Relevance: .7, Instructions: 674COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3891795807.0000000005500000.00000040.00000800.00020000.00000000.sdmp, Offset: 05500000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5500000_LA0gY3d103.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ad1bfdce598f3d0219f52a989a0e1fabbffd95863c296475410dde4012afba44
Instruction ID: 9708114dcc3e909beb44d5775cabc9bf4e779c3bfd9b4704c3d43ae24a5dea6c
Opcode Fuzzy Hash: ad1bfdce598f3d0219f52a989a0e1fabbffd95863c296475410dde4012afba44
Instruction Fuzzy Hash: 24522575A00114DFDB15DF68C984E69BBB2FF88314F1685A8E50AEB262CB31EC51DF90

Function 055034E0 Relevance: .2, Instructions: 156COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3891795807.0000000005500000.00000040.00000800.00020000.00000000.sdmp, Offset: 05500000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5500000_LA0gY3d103.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ee9a5f8a0f2f7380b9cf8cb0e6971165fcbee34eca5816f84009366a36c0b8e9
Instruction ID: abe4c78306e2ff4928f90f37d24c54d4cadd49b275fb51135a3eee2bfba39d92
Opcode Fuzzy Hash: ee9a5f8a0f2f7380b9cf8cb0e6971165fcbee34eca5816f84009366a36c0b8e9
Instruction Fuzzy Hash: 6E611670A006148FE718EF7AF95179ABBF3BBC8214F04C529D408EB26DEB715905CB51

Function 055034F0 Relevance: .2, Instructions: 150COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3891795807.0000000005500000.00000040.00000800.00020000.00000000.sdmp, Offset: 05500000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5500000_LA0gY3d103.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8a2328fe2f3776ef77c660803205de5dea2189417e2d8cbf6773c64ea70ef44a
Instruction ID: 30b74c390e8d71ed76c5e2b4f6419712e41e94e9fc0a673c3da2c2c9dc868e16
Opcode Fuzzy Hash: 8a2328fe2f3776ef77c660803205de5dea2189417e2d8cbf6773c64ea70ef44a
Instruction Fuzzy Hash: 3E510470A006148FE758EF7AF95179ABBF3BBC8314F04C12AD408EB269EB715905CB91

Function 014586A8 Relevance: 4.1, Instructions: 4052COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3888500264.0000000001450000.00000040.00000800.00020000.00000000.sdmp, Offset: 01450000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1450000_LA0gY3d103.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f1e24f7e5bc9a93c0f5a8bba8ef45d1a5b4a58bb4028129a99b4ad7fdccf4203
Instruction ID: fe3bc075e5d4f0b4ce4542c2f0910580b8e3bc98db3d42899c8ae4ba98826bf6
Opcode Fuzzy Hash: f1e24f7e5bc9a93c0f5a8bba8ef45d1a5b4a58bb4028129a99b4ad7fdccf4203
Instruction Fuzzy Hash: B4638F71F102258BDBB65B6C841436FBAE6EFC8A40F14456BDD06E7366DF348C428B92

Function 050D26C4 Relevance: 3.8, Strings: 3, Instructions: 30
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

(K, xrefs: 050D271B
(K, xrefs: 050D26FA
(K, xrefs: 050D26DB

Memory Dump Source

Source File: 00000000.00000002.3891072915.00000000050D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 050D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_50d0000_LA0gY3d103.jbxd

Similarity

API ID:
String ID: (K$(K$(K
API String ID: 0-212160684
Opcode ID: 6f41bab68c6093b22e3b48fbdf141baa0b51e9d48da92e19571a30eafcdd4693
Instruction ID: 567c3e4b2dbefe458ba4088f98505c2df891b56af62440a612f1900dc026b92f
Opcode Fuzzy Hash: 6f41bab68c6093b22e3b48fbdf141baa0b51e9d48da92e19571a30eafcdd4693
Instruction Fuzzy Hash: F5F01D787042418FD340EB69F45576A33E2E7CC751F219064E546F73A9CA749C058B50

Function 06A93A28 Relevance: 2.7, Strings: 2, Instructions: 182
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

h,, xrefs: 06A93ADD
@,, xrefs: 06A93A7D

Memory Dump Source

Source File: 00000000.00000002.3894696406.0000000006A90000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a90000_LA0gY3d103.jbxd

Similarity

API ID:
String ID: @,$h,
API String ID: 0-3908923133
Opcode ID: 374e3dfd35f5fe2d3ec3067232519135bebd89fff71453947d456cf5fb87a635
Instruction ID: e617a4bbaab4eab1b99486fdff0e17f5f6b16fcd544fe2c8fc750b8a2caba633
Opcode Fuzzy Hash: 374e3dfd35f5fe2d3ec3067232519135bebd89fff71453947d456cf5fb87a635
Instruction Fuzzy Hash: 31514935B002099FCF45EFA9D8409EEBBF6EF88214B14806AF905E7221D735D915DBA1

Function 0103C038 Relevance: 1.6, APIs: 1, Instructions: 56memoryCOMMON

Download Yara Rule

APIs

VirtualProtect.KERNEL32(?,?,?,?), ref: 0103C0AC

Memory Dump Source

Source File: 00000000.00000002.3888370412.0000000001030000.00000040.00000800.00020000.00000000.sdmp, Offset: 01030000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1030000_LA0gY3d103.jbxd

Similarity

API ID: ProtectVirtual
String ID:
API String ID: 544645111-0
Opcode ID: 462a5426f931ac0c467d0d8e4bb8433ea675acac6c192d180ba3dd0c6ff91c8c
Instruction ID: 205f251940c7e0d3d58fd26df0b38f03569002e4013d033e2be21ace0c06b853
Opcode Fuzzy Hash: 462a5426f931ac0c467d0d8e4bb8433ea675acac6c192d180ba3dd0c6ff91c8c
Instruction Fuzzy Hash: 07112771D003498FDB10DFAAC440B9EFBF8EF88310F50841AE559A7240C775A940CFA0

Function 06A92ED7 Relevance: 1.4, Strings: 1, Instructions: 124COMMON

Download Yara Rule

Strings

E5t, xrefs: 06A9307E

Memory Dump Source

Source File: 00000000.00000002.3894696406.0000000006A90000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a90000_LA0gY3d103.jbxd

Similarity

API ID:
String ID: E5t
API String ID: 0-2824288718
Opcode ID: 42329c5efd8b49d41e09e017e3abd670b37282d5105752c3d6054226c67ddd0a
Instruction ID: f452d761b9783c0b902542466ef941a9edaf0c11c30915d26dd7e916650e3d08
Opcode Fuzzy Hash: 42329c5efd8b49d41e09e017e3abd670b37282d5105752c3d6054226c67ddd0a
Instruction Fuzzy Hash: EF511334B0111ACFDB54EF28D998BAA77F6BB88340F2041A9D419DB355EB319D41CF51

Function 06A92EE4 Relevance: 1.4, Strings: 1, Instructions: 123COMMON

Download Yara Rule

Strings

E5t, xrefs: 06A9307E

Memory Dump Source

Source File: 00000000.00000002.3894696406.0000000006A90000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a90000_LA0gY3d103.jbxd

Similarity

API ID:
String ID: E5t
API String ID: 0-2824288718
Opcode ID: 09e232a85cfc6891a4f0cfb8cdea5986457449a7edd54b2eaee3c8066dc9a2af
Instruction ID: a29662d9bb3f84e61560d1bb198cda7c0e0a6f6f842c8a98e2e1ef5d30766a35
Opcode Fuzzy Hash: 09e232a85cfc6891a4f0cfb8cdea5986457449a7edd54b2eaee3c8066dc9a2af
Instruction Fuzzy Hash: 08510034B0121ACFDB54EB28D998BAA77F6BB88340F2041A9D419EB359EB319D41CF51

Function 0145E070 Relevance: 1.3, Instructions: 1331COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3888500264.0000000001450000.00000040.00000800.00020000.00000000.sdmp, Offset: 01450000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1450000_LA0gY3d103.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2ca274a248f78fd269eb619b62fe4d85f7186451eca29a62f95516f89d2f0055
Instruction ID: a3ec582c44220ccdceefb5e5b64fcce6fcac3a720c48b004d1d9d4cadd69f0bb
Opcode Fuzzy Hash: 2ca274a248f78fd269eb619b62fe4d85f7186451eca29a62f95516f89d2f0055
Instruction Fuzzy Hash: E5B2A130A002108FEB549B69C9587AFFFBAEFC6701F10446EAA06D76A4DF784D85CB51

Function 06A93140 Relevance: 1.3, Strings: 1, Instructions: 78COMMON

Download Yara Rule

Strings

|O, xrefs: 06A93147, 06A9315F, 06A93190

Memory Dump Source

Source File: 00000000.00000002.3894696406.0000000006A90000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a90000_LA0gY3d103.jbxd

Similarity

API ID:
String ID: |O
API String ID: 0-1296324707
Opcode ID: 4d4342ea4ad7a04f2a9ca86a30c3d35d03cb28414d9de1723cae564dc339aa72
Instruction ID: a382ad1362bafbb724d79ca90d00856e2a190fdaf419dd154ff2ee773c4ef519
Opcode Fuzzy Hash: 4d4342ea4ad7a04f2a9ca86a30c3d35d03cb28414d9de1723cae564dc339aa72
Instruction Fuzzy Hash: 5521E7317082105FEB596B69A41476E7BF6FBCA751F24C06AE809EF391CE398D01C7A1

Function 0103CAF0 Relevance: 1.3, APIs: 1, Instructions: 52memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNEL32(?,?,?,?), ref: 0103CB5B

Memory Dump Source

Source File: 00000000.00000002.3888370412.0000000001030000.00000040.00000800.00020000.00000000.sdmp, Offset: 01030000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1030000_LA0gY3d103.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 4de201df84360fc6762bf32a8efc8c4912d76bfb091eb6ebbf131c34a215d566
Instruction ID: 147db78e0188166e8ae6f6e63372b031360f18cfc6632737da3acc0dc0b5241c
Opcode Fuzzy Hash: 4de201df84360fc6762bf32a8efc8c4912d76bfb091eb6ebbf131c34a215d566
Instruction Fuzzy Hash: 131137758003498FDB14DFAAC845BDEFBF9EF88320F14841AD559A7240C775A540CFA0

Function 0552251E Relevance: 1.3, Strings: 1, Instructions: 24COMMON

Download Yara Rule

Strings

(K, xrefs: 0552253E

Memory Dump Source

Source File: 00000000.00000002.3891854924.0000000005520000.00000040.00000800.00020000.00000000.sdmp, Offset: 05520000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5520000_LA0gY3d103.jbxd

Similarity

API ID:
String ID: (K
API String ID: 0-263562815
Opcode ID: fd26cdaa228d0e39a09c708d7cc7da7e466eef502c2c5ede65d1e9601f972327
Instruction ID: a64f8dd84b3009ba6309c27fc40b8b855cab6ea611c8876cf126951c8a734c40
Opcode Fuzzy Hash: fd26cdaa228d0e39a09c708d7cc7da7e466eef502c2c5ede65d1e9601f972327
Instruction Fuzzy Hash: 8AF08C307012509FEB549B54E448BAD33B3F78A350F50A5A9E206B72E5CB74DEC48B46

Function 05504780 Relevance: .8, Instructions: 776COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3891795807.0000000005500000.00000040.00000800.00020000.00000000.sdmp, Offset: 05500000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5500000_LA0gY3d103.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 08ef777034ead2436f25d8b5591723e4777792c8fdd3be89dd0bf95bdecae593
Instruction ID: 59469dac5a7324669b7c704b15939fdfd8a176612ce4bf00a5bef761264e723a
Opcode Fuzzy Hash: 08ef777034ead2436f25d8b5591723e4777792c8fdd3be89dd0bf95bdecae593
Instruction Fuzzy Hash: 5C626930B142158BE754BF78E8657AB76B2FBC8704F208429E416EB398EF349D45CB91

Function 055049CE Relevance: .6, Instructions: 607COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3891795807.0000000005500000.00000040.00000800.00020000.00000000.sdmp, Offset: 05500000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5500000_LA0gY3d103.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4336529f9d275d13cbc005a0d72655e4ede91a1710193d6cbdd87fa8a4e2dc80
Instruction ID: 45a195d27a59a6315cfcdca62daf3a335ebd511fc512ea67df651eca1556f7e4
Opcode Fuzzy Hash: 4336529f9d275d13cbc005a0d72655e4ede91a1710193d6cbdd87fa8a4e2dc80
Instruction Fuzzy Hash: F8325C30B142158BE714BF78E4697AB36B2FBC8744F208029E516EB398EF349D45CB91

Function 06A9402D Relevance: .6, Instructions: 600COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3894696406.0000000006A90000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a90000_LA0gY3d103.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c63955dc13f05cbf4df8399c9e34dad6f65052f8f1ce75956df88af698908b06
Instruction ID: 74e8da2a7b129589453b3afb5f01ba8c0d790c6d9331b2cd5a28f4a762a90a79
Opcode Fuzzy Hash: c63955dc13f05cbf4df8399c9e34dad6f65052f8f1ce75956df88af698908b06
Instruction Fuzzy Hash: 9C124730A00705CFDB65EF79C450A9EB7F2FF89704F248A69D406AB291DB75E846CB90

Function 05504A48 Relevance: .6, Instructions: 583COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3891795807.0000000005500000.00000040.00000800.00020000.00000000.sdmp, Offset: 05500000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5500000_LA0gY3d103.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 363becc2e229916503f5c0793d57b1433f045f276fde1e4e2831098fa925aa3b
Instruction ID: fe1486b76336a4ad83dc85671e6ef106a5d4958efe54a1872111345c71a20a11
Opcode Fuzzy Hash: 363becc2e229916503f5c0793d57b1433f045f276fde1e4e2831098fa925aa3b
Instruction Fuzzy Hash: FC325C30B142158BE714BF78E4697AB36B2FBC8744F208429E516EB398EF349D45CB91

Function 05504A7C Relevance: .6, Instructions: 572COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3891795807.0000000005500000.00000040.00000800.00020000.00000000.sdmp, Offset: 05500000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5500000_LA0gY3d103.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 89770ff2cd37d02cecef5ce2e54d66d528bbebaa9929a0ffbd5e02ec24694ad9
Instruction ID: 14ed211d1c250a2358fb82843064ec2f80dd2591b9f5d0f274ae123f4a1914c6
Opcode Fuzzy Hash: 89770ff2cd37d02cecef5ce2e54d66d528bbebaa9929a0ffbd5e02ec24694ad9
Instruction Fuzzy Hash: E1324B30B142158BE714BF78E4697AB36B2FBC8744F208429E516EB398EF349D45CB91

Function 05504ADA Relevance: .6, Instructions: 551COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3891795807.0000000005500000.00000040.00000800.00020000.00000000.sdmp, Offset: 05500000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5500000_LA0gY3d103.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9762ca1f83d54f16f74533788a35eef5fdc859c60f5a93aaacc02c65cd2d9cdb
Instruction ID: bc9c251411d5e41379a18ccc329afb6c6a1c9b6749fa73a7248ed563987b9198
Opcode Fuzzy Hash: 9762ca1f83d54f16f74533788a35eef5fdc859c60f5a93aaacc02c65cd2d9cdb
Instruction Fuzzy Hash: 4E224B30B142158BE744BF78E4697AB36B2FBC8744F208429E516EB398EF349D45CB91

Function 0145C218 Relevance: .3, Instructions: 314COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3888500264.0000000001450000.00000040.00000800.00020000.00000000.sdmp, Offset: 01450000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1450000_LA0gY3d103.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5eb468c9c60a6d60651fc2452f9df44df2ad6695436f239520c5b8cdd774c593
Instruction ID: 7dded4e82e27f2d26739e8cf64d088ec64f5c729c9da1aaf2f00e60c73ea319f
Opcode Fuzzy Hash: 5eb468c9c60a6d60651fc2452f9df44df2ad6695436f239520c5b8cdd774c593
Instruction Fuzzy Hash: 51B181747003198B9BA6ABA894D427F7AABFFC8604714452FEC17D3366DF3499038B91

Function 06A9981D Relevance: .2, Instructions: 234COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3894696406.0000000006A90000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a90000_LA0gY3d103.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 12e095deb437b1d7a6e7af83b5015022f2871e349930a64e540be01da894bc90
Instruction ID: b2f619afd655777bfe92cecc95ab43d7bc717d53e843d4e1288a7ccd17d6891d
Opcode Fuzzy Hash: 12e095deb437b1d7a6e7af83b5015022f2871e349930a64e540be01da894bc90
Instruction Fuzzy Hash: DDF0923620D3818FD3428A74E920695BFB19F87614B1988DAE4C09B163C6668D1BD762

Function 06A94B82 Relevance: .2, Instructions: 225COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3894696406.0000000006A90000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a90000_LA0gY3d103.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ba85af3be28e39add635f5f0b30efe7229c1827bbde25f60368908852902ea1b
Instruction ID: 3ecc110d49f5e3e62403c9c31aace456cccc7fd8a30b3caeb3f0cfdea8fa0940
Opcode Fuzzy Hash: ba85af3be28e39add635f5f0b30efe7229c1827bbde25f60368908852902ea1b
Instruction Fuzzy Hash: A891E534A10205DFDB65DFA9C994AADB7F2EF88304F248569D406AB361DB31ED42CF60

Function 055057D0 Relevance: .2, Instructions: 171COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3891795807.0000000005500000.00000040.00000800.00020000.00000000.sdmp, Offset: 05500000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5500000_LA0gY3d103.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 496db0ad67cf1bd464e32b4311d7ae821f66cdcbc714245936fd20647ab2adbd
Instruction ID: 867c0e1c800953ee4ecb136344e59e46ec78bb57b1c3983f7ea789e3d83d7990
Opcode Fuzzy Hash: 496db0ad67cf1bd464e32b4311d7ae821f66cdcbc714245936fd20647ab2adbd
Instruction Fuzzy Hash: 34715D74A006119FCB14EF29D594A59BBF2FF88310F159559E80AEB3A5EB30EC45CF90

Function 0550C290 Relevance: .2, Instructions: 156COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3891795807.0000000005500000.00000040.00000800.00020000.00000000.sdmp, Offset: 05500000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5500000_LA0gY3d103.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d8e1ad67f1400f57a66c721b0c62c08432fe21ad45e6061033ca9c70bd5b70c8
Instruction ID: 5bf53761058e69b7171c283b26993dc734569293016841675f813511da7411fc
Opcode Fuzzy Hash: d8e1ad67f1400f57a66c721b0c62c08432fe21ad45e6061033ca9c70bd5b70c8
Instruction Fuzzy Hash: 75518230B142159BD714EF68D895BAFB7B6FBC9610F109529E906EB388DF349C01CB91

Function 05509831 Relevance: .2, Instructions: 155COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3891795807.0000000005500000.00000040.00000800.00020000.00000000.sdmp, Offset: 05500000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5500000_LA0gY3d103.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4a8e364cd10e72bc3e4cc9e4493eb87ce1003f7b5664e0f4a57e10cb1ad4a533
Instruction ID: a0b8c353ef6d97916724267d207e3a613c15931f701fdc3ca19776806c510faf
Opcode Fuzzy Hash: 4a8e364cd10e72bc3e4cc9e4493eb87ce1003f7b5664e0f4a57e10cb1ad4a533
Instruction Fuzzy Hash: 0B513E75600100AFCB49AFA5D859E6A7BB7FBCC3107198094E505DB376DB32DC21EB91

Function 05509840 Relevance: .1, Instructions: 149COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3891795807.0000000005500000.00000040.00000800.00020000.00000000.sdmp, Offset: 05500000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5500000_LA0gY3d103.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fed0ab1f3f68152849073c7265ded0045868debcccc35e9d0ce34bde6e9a871b
Instruction ID: 3dc6ef3795ccbba71501d224e91858e601d058bdd9f4cbe6e373cbcdee0cf1f0
Opcode Fuzzy Hash: fed0ab1f3f68152849073c7265ded0045868debcccc35e9d0ce34bde6e9a871b
Instruction Fuzzy Hash: 48512D75600104EFCB49AFA5D819E6A7BB7FBCC350B198094E5059B376DB32DC21EB90

Function 050D2ADA Relevance: .1, Instructions: 130COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3891072915.00000000050D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 050D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_50d0000_LA0gY3d103.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 78b6e094084353bc38d443b428f361ab009227b9fbc828b045f0c93a0d2bf284
Instruction ID: 09f3e964091d0f5eff09226933486e5bea92bcfecd6aec1177a4f8bb76f6e3d7
Opcode Fuzzy Hash: 78b6e094084353bc38d443b428f361ab009227b9fbc828b045f0c93a0d2bf284
Instruction Fuzzy Hash: D2519D786007019FC758EF2AE484A6DBBF2BF89310B558568D416EB3B5DB70EC45CBA0

Function 06A95840 Relevance: .1, Instructions: 125COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3894696406.0000000006A90000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a90000_LA0gY3d103.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7ffb41afa9698cbd68e8b6a912677006e0ac37d71ec7c19d735a78270032f526
Instruction ID: 7eb5003447f730b733b730433da5b526db4c36377930e30e353cbee40d425627
Opcode Fuzzy Hash: 7ffb41afa9698cbd68e8b6a912677006e0ac37d71ec7c19d735a78270032f526
Instruction Fuzzy Hash: 4341B330A002059FDB49EF68E451AAEBBF6FFC5314B60C529D509DB355DB31AD06CBA0

Function 06A94CC7 Relevance: .1, Instructions: 112COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3894696406.0000000006A90000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a90000_LA0gY3d103.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ec16e779c1d7117ac73aaa8c6906e9a44a1e32f81172d6edaa50064966d9df1e
Instruction ID: 3ce81bdd2153efab5e1d88e81c772d68f6b42fba4e06aa2ac522d2bcafce876a
Opcode Fuzzy Hash: ec16e779c1d7117ac73aaa8c6906e9a44a1e32f81172d6edaa50064966d9df1e
Instruction Fuzzy Hash: FB410734E10208CFDB65EBA5C594BADBBF2FF88305F748568D006AB255CB75AD42CB60

Function 0145E000 Relevance: .1, Instructions: 93COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3888500264.0000000001450000.00000040.00000800.00020000.00000000.sdmp, Offset: 01450000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1450000_LA0gY3d103.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a9a7c6e879ed8c34e8044e88814c5f8bd67019130ade99d9e2d7b446c4209603
Instruction ID: fc7d373835c2da1c764ae5da4ff6c3ffeba1db7ee893b2143ce205044a419bac
Opcode Fuzzy Hash: a9a7c6e879ed8c34e8044e88814c5f8bd67019130ade99d9e2d7b446c4209603
Instruction Fuzzy Hash: CD312D71A093949FD75306698C10797BFB9DF87710F0940E7EA04DB2A3DA794D0AC361

Function 05508D38 Relevance: .1, Instructions: 92COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3891795807.0000000005500000.00000040.00000800.00020000.00000000.sdmp, Offset: 05500000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5500000_LA0gY3d103.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 18897ebb02365b4d4d5109dcb39c556d93eb1eedc0d004d7a797d0f8d3b21c89
Instruction ID: 723cc6625b58708c698bd9eb47dce07bda522205f463089318cb5900a969fa31
Opcode Fuzzy Hash: 18897ebb02365b4d4d5109dcb39c556d93eb1eedc0d004d7a797d0f8d3b21c89
Instruction Fuzzy Hash: 8B317A707102058FD704FBA8E86579B7BFAFBC8345F144029A50ADB68ADF749D01CBA1

Function 06A9480F Relevance: .1, Instructions: 91COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3894696406.0000000006A90000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a90000_LA0gY3d103.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ecb6fb7ffb589a669e4e20cb24d33851aeb7c7ea52d3747f62b5f5e6801a9fe1
Instruction ID: 9aac44d0580dc0611cb8f823913b11ec7789622657b90f2639a9e0e0e7217117
Opcode Fuzzy Hash: ecb6fb7ffb589a669e4e20cb24d33851aeb7c7ea52d3747f62b5f5e6801a9fe1
Instruction Fuzzy Hash: 5431A8347003504FE769EB39E840A5A7BE5EFC9211B18C66DD4858F6A6DB30D90AC7A1

Function 05509E38 Relevance: .1, Instructions: 87COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3891795807.0000000005500000.00000040.00000800.00020000.00000000.sdmp, Offset: 05500000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5500000_LA0gY3d103.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b0b9adaee6990bd65d9d7c1bf06bca700472f74fdca388b5fcebb7d8a392cb93
Instruction ID: 9e121240faeeacfbc3ee3a18fe1b9ad1d7ec98f6ba81f95d2a03242d3536ada4
Opcode Fuzzy Hash: b0b9adaee6990bd65d9d7c1bf06bca700472f74fdca388b5fcebb7d8a392cb93
Instruction Fuzzy Hash: C031D135A042059BD704EF68D8556DF7BBAEBC8320F24802AF521E7398DF349D05CBA0

Function 0552FD68 Relevance: .1, Instructions: 81COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3891854924.0000000005520000.00000040.00000800.00020000.00000000.sdmp, Offset: 05520000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5520000_LA0gY3d103.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 245658cc1e09c00d1096ae072dc1a824a1eff479cfe9e158792b9bd2db6d45b8
Instruction ID: 055df8de89fed8c6ca541f4da20a641bcfa8aef7d814f4a6a190d0e79461b089
Opcode Fuzzy Hash: 245658cc1e09c00d1096ae072dc1a824a1eff479cfe9e158792b9bd2db6d45b8
Instruction Fuzzy Hash: AF21B0303001104BDB09BA35E8956AB66ABFBC8254B10443AE902C7389EF35CC06DB90

Function 05509E48 Relevance: .1, Instructions: 81COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3891795807.0000000005500000.00000040.00000800.00020000.00000000.sdmp, Offset: 05500000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5500000_LA0gY3d103.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d2f7f5ecbc25ae0eaceacdd7b32c59b917864469efee3354b109199aad96ee6a
Instruction ID: 5f098cfa4d6c7a5096347012f46b3ca6038625044c4d207d10de5d4bd47a7241
Opcode Fuzzy Hash: d2f7f5ecbc25ae0eaceacdd7b32c59b917864469efee3354b109199aad96ee6a
Instruction Fuzzy Hash: 1D31A035A042059BD705EF68D855ADF7BBAEBC8320F24801AF521E7398DF345D41CBA0

Function 05505650 Relevance: .1, Instructions: 79COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3891795807.0000000005500000.00000040.00000800.00020000.00000000.sdmp, Offset: 05500000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5500000_LA0gY3d103.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fcffc40bf36e95a9bca3c4b55eaf95b8263195b8b10fd0af619f0df62d627169
Instruction ID: 85ed5460ec17b32496e0498fe9f1bcdf0420aafca7411efde45ee4d1133fc0e6
Opcode Fuzzy Hash: fcffc40bf36e95a9bca3c4b55eaf95b8263195b8b10fd0af619f0df62d627169
Instruction Fuzzy Hash: D22102347046118FD706BB74E8502AB3BF2FBC5304B25816AD841DB399EF389C06CB82

Function 0550B3C8 Relevance: .1, Instructions: 78COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3891795807.0000000005500000.00000040.00000800.00020000.00000000.sdmp, Offset: 05500000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5500000_LA0gY3d103.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 29850e7115e64fab3922ab64ed670901350d6d3cc72d14e742de330dc1547c9c
Instruction ID: bd21f639254a5925c3004fa043ea64f9748ce143c9ea3d63a9a9dfcde93a1dca
Opcode Fuzzy Hash: 29850e7115e64fab3922ab64ed670901350d6d3cc72d14e742de330dc1547c9c
Instruction Fuzzy Hash: F221C470B042048BDB50AF78D8957AF7AF6EBC8710F204029EA16D73C5DB348E01CBA0

Function 0550B3B8 Relevance: .1, Instructions: 78COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3891795807.0000000005500000.00000040.00000800.00020000.00000000.sdmp, Offset: 05500000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5500000_LA0gY3d103.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3c7b647d965e4aa44f3603069b3e16cb45c00a5827728a1bc84c4758b05b0d06
Instruction ID: 9a5c80aff8e3fb496a2b6b65d50314162c07fe8906fab5ffeb46f0a75898f7d6
Opcode Fuzzy Hash: 3c7b647d965e4aa44f3603069b3e16cb45c00a5827728a1bc84c4758b05b0d06
Instruction Fuzzy Hash: 2A21AD74B142048FCB51AFB8E8957AE3BF2EB88310F204429E915D73C9DB348E05CBA0

Function 00E4D3C8 Relevance: .1, Instructions: 75COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3887987732.0000000000E4D000.00000040.00000800.00020000.00000000.sdmp, Offset: 00E4D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e4d000_LA0gY3d103.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 81c9406897c72c1b4f56526ee9a8ce434ce89df8d79890320530c231eeaa0c8a
Instruction ID: 0543be610e1932080e29e068c8af9fe5e5bc79de3f34f4aa4ec8883abaa25802
Opcode Fuzzy Hash: 81c9406897c72c1b4f56526ee9a8ce434ce89df8d79890320530c231eeaa0c8a
Instruction Fuzzy Hash: 0C212575608304DFDB04DF10EDC4B16BB65FB94324F20C56DE9091B246C336E856CBA2

Function 00E6D01C Relevance: .1, Instructions: 74COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3888043396.0000000000E6D000.00000040.00000800.00020000.00000000.sdmp, Offset: 00E6D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e6d000_LA0gY3d103.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0337c68d58cc03291b5197f581478fb94172fd24170f2f755d6ea943eaad2f58
Instruction ID: 0d31120eb798e9b33b0f0eadfcad3932b95082f1bd300f402d3cdfff967c1fe0
Opcode Fuzzy Hash: 0337c68d58cc03291b5197f581478fb94172fd24170f2f755d6ea943eaad2f58
Instruction Fuzzy Hash: 6D212275A88344DFDB50DF14EDC4B26BB66FB84724F64C569E8091B242C336D806CBA2

Function 050D60B8 Relevance: .1, Instructions: 70COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3891072915.00000000050D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 050D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_50d0000_LA0gY3d103.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7005fe25bb98d465ad4e69429485aecdff3177732e9c52a74a5b489c719ae0f3
Instruction ID: 114e8300e5fcdf4beee1ca2860397e4d5a9d2e7b8a2a8ab6717fbc632564c911
Opcode Fuzzy Hash: 7005fe25bb98d465ad4e69429485aecdff3177732e9c52a74a5b489c719ae0f3
Instruction Fuzzy Hash: 3A215435B043688FEB609729F805B6ABBEAF785351F0D4072E949D7382CE35DC4587A1

Function 06A97111 Relevance: .1, Instructions: 68COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3894696406.0000000006A90000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a90000_LA0gY3d103.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 99d01d353d798737ee1f335110450deab079333a4d0128de2097004bbea06a16
Instruction ID: 9d18039c65dd537544e1fac61958326c69c39837eba128c4b9b3416c345c62bc
Opcode Fuzzy Hash: 99d01d353d798737ee1f335110450deab079333a4d0128de2097004bbea06a16
Instruction Fuzzy Hash: 8E21A4317453658FCB56AB7494247EF7FB2AB86710F24416AE401EB396CB780D06CBB1

Function 0550AFFE Relevance: .1, Instructions: 68COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3891795807.0000000005500000.00000040.00000800.00020000.00000000.sdmp, Offset: 05500000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5500000_LA0gY3d103.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b8b07d0cb2158d18d1ce20aaf5cef48aeb5b8aee86f8bc7af5cb8983b7ffdb61
Instruction ID: a9b2be26e04975f8b443fa6952c1e8576df5a1087be80c8f8206bd092da49d49
Opcode Fuzzy Hash: b8b07d0cb2158d18d1ce20aaf5cef48aeb5b8aee86f8bc7af5cb8983b7ffdb61
Instruction Fuzzy Hash: CB31DB78B11615DFDB04EF94E4A5AAEBBB2FF88310F144059F902AB795DB30AD45CB80

Function 06A95220 Relevance: .1, Instructions: 66COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3894696406.0000000006A90000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a90000_LA0gY3d103.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 25bccd0220dc907186fa512583b15664d41ccc4f552f8edc7fdeb1d9e9e9b1bd
Instruction ID: e0c917f62fc3a2e590856a97fb4a9246903ba530fef40a4bf5054f8d714ddf29
Opcode Fuzzy Hash: 25bccd0220dc907186fa512583b15664d41ccc4f552f8edc7fdeb1d9e9e9b1bd
Instruction Fuzzy Hash: E6214930A00A008FD724DF59D544A52F7F1FF84324F19CAA9D45E8BA62C770F845CB90

Function 06A9A710 Relevance: .1, Instructions: 64COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3894696406.0000000006A90000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a90000_LA0gY3d103.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 796f618b18c8a2bae96ad93c417f867ea59f504415a7d9a4f727ce8b8770141c
Instruction ID: 6906e5e8f332ea46934ba5b2c6c46779f66e23f89b9ab5fd1e174a6b32778661
Opcode Fuzzy Hash: 796f618b18c8a2bae96ad93c417f867ea59f504415a7d9a4f727ce8b8770141c
Instruction Fuzzy Hash: 53216AB5804349CFDB11DFA9C4867DEBFF4EF09220F24849AC494A7251D338A945CFA1

Function 00E6D005 Relevance: .1, Instructions: 64COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3888043396.0000000000E6D000.00000040.00000800.00020000.00000000.sdmp, Offset: 00E6D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e6d000_LA0gY3d103.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 875c0a5e35561d3c6b9fa589ba8e9369d0cef47946a184e43065e98fa18482a1
Instruction ID: 625304323076689cbf690812c53f567411a9a612fe39d4a0530f0f94f1a0e851
Opcode Fuzzy Hash: 875c0a5e35561d3c6b9fa589ba8e9369d0cef47946a184e43065e98fa18482a1
Instruction Fuzzy Hash: D021B07550D3C08FCB02CF20D994716BF72EB86314F2981EAD8448B693C33A980ACB62

Function 0550BC58 Relevance: .1, Instructions: 63COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3891795807.0000000005500000.00000040.00000800.00020000.00000000.sdmp, Offset: 05500000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5500000_LA0gY3d103.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cb10e4dbf47baa6bd64ed291abd144815ff67d7325e418325a24c4cea5f5d6c6
Instruction ID: bba657c557397776c28746211c56b0f4dc5ce0045092d46d9f65ffbcec6eb2a1
Opcode Fuzzy Hash: cb10e4dbf47baa6bd64ed291abd144815ff67d7325e418325a24c4cea5f5d6c6
Instruction Fuzzy Hash: 11112932709245AFC701CBA9D88498AFBB9FF8523071681B7E518C7292CB31EC01C7E1

Function 06A952F0 Relevance: .1, Instructions: 62COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3894696406.0000000006A90000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a90000_LA0gY3d103.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4b9df8633e1ff9ae37b0a2e727b074aa79ebdb5f1f36a6764db34635cd457fcc
Instruction ID: 5f1e8bf52b01aaba70e19d83393123e2ac78add173f31e33a1f17b29c5f8142f
Opcode Fuzzy Hash: 4b9df8633e1ff9ae37b0a2e727b074aa79ebdb5f1f36a6764db34635cd457fcc
Instruction Fuzzy Hash: 19119870B043409FD761DF39D898E57BBF5EF89214B248569E44ACB262D770E806CB60

Function 06A99C51 Relevance: .1, Instructions: 62COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3894696406.0000000006A90000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a90000_LA0gY3d103.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 682bdd181d8262e09786354655713afb2376c5b5547c6edf9bc2bed5a164250d
Instruction ID: ee1c468d1d2999560083248e7da24acc33dc6e065442b5c738f7dec005f833db
Opcode Fuzzy Hash: 682bdd181d8262e09786354655713afb2376c5b5547c6edf9bc2bed5a164250d
Instruction Fuzzy Hash: EE116D70A007109BEB94FF7998156AF7BE2EBC4B50F20862DD446EB384EB715E058BD1

Function 0145868C Relevance: .1, Instructions: 61COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3888500264.0000000001450000.00000040.00000800.00020000.00000000.sdmp, Offset: 01450000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1450000_LA0gY3d103.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 23552d0346416f0e0ef06a99fc4741464e1aff71088ef0ad5c430f11c3c37116
Instruction ID: 6497cc518a678c2c26329306e6d2d7b2ee9e50c6b65ee9921d8696697416176e
Opcode Fuzzy Hash: 23552d0346416f0e0ef06a99fc4741464e1aff71088ef0ad5c430f11c3c37116
Instruction Fuzzy Hash: 4311D631E042149FCB6B4A689C152EEBBB1FF41300F05049BEE45A7363CB755C41CBA1

Function 05505680 Relevance: .1, Instructions: 61COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3891795807.0000000005500000.00000040.00000800.00020000.00000000.sdmp, Offset: 05500000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5500000_LA0gY3d103.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 55cd8208df5a30cf90ad499a8438bbe3b58628460f6b3882d97efd35d17c6cd2
Instruction ID: 366e10c7bdb1efd56a7e20a7b05dec7f8876866bda4946e0d70a9c71e37ac649
Opcode Fuzzy Hash: 55cd8208df5a30cf90ad499a8438bbe3b58628460f6b3882d97efd35d17c6cd2
Instruction Fuzzy Hash: C81181357001158BD709BB74E4546AF37E3FBC8754B21902AD812D7388EF349C028BC2

Function 06A99C60 Relevance: .1, Instructions: 58COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3894696406.0000000006A90000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a90000_LA0gY3d103.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 28745c01758eeb128e3bd591ad8656e008ec7d2c4f6a563a010fcb9bb10b5af4
Instruction ID: 526bd8859f59a24e3715092c0621aad9fabd33379b9cb90f13421b9995faf9c0
Opcode Fuzzy Hash: 28745c01758eeb128e3bd591ad8656e008ec7d2c4f6a563a010fcb9bb10b5af4
Instruction Fuzzy Hash: AE118E70A007149BDB54FF69981569F7AE6EBC8B50F108519D405AB384EB315E018BD1

Function 050D9BB2 Relevance: .1, Instructions: 57COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3891072915.00000000050D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 050D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_50d0000_LA0gY3d103.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9b6712903a4fbf778232c430ccbf70420cf38011f4e06f6cdc5c3b715f877a7b
Instruction ID: 3b786eb7a6900c39f6e523a58f42805e3f7e27be2fefd86f409427e26316f66f
Opcode Fuzzy Hash: 9b6712903a4fbf778232c430ccbf70420cf38011f4e06f6cdc5c3b715f877a7b
Instruction Fuzzy Hash: 1E1169357013149FE75CEBB9A898B6B76EAFBCD311B144429F50AD3399CE709C0187A0

Function 00E4D3C3 Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3887987732.0000000000E4D000.00000040.00000800.00020000.00000000.sdmp, Offset: 00E4D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e4d000_LA0gY3d103.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e3062b24f5b0128947100ec6e500ced3c6d63245422b7ec3b5033f72fc324263
Instruction ID: b22016909113ed7ce3282bb38238e628a6836ead26a0a8fe20dc8860e969c37d
Opcode Fuzzy Hash: e3062b24f5b0128947100ec6e500ced3c6d63245422b7ec3b5033f72fc324263
Instruction Fuzzy Hash: 3B11D376508240CFCB15CF10D9C4B16BF72FB94324F24C6A9D8494B656C33AE85ACBA1

Function 055086E1 Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3891795807.0000000005500000.00000040.00000800.00020000.00000000.sdmp, Offset: 05500000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5500000_LA0gY3d103.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9cce6dbfda6d2654e0d905ae699df32d1d4fbabf7602204301e3c5d8c6d64996
Instruction ID: cdbfb559cbab466ebd8199ee26eeafe5833d48ce9bc7c4ff089d0d9341170382
Opcode Fuzzy Hash: 9cce6dbfda6d2654e0d905ae699df32d1d4fbabf7602204301e3c5d8c6d64996
Instruction Fuzzy Hash: 6F115B30A102158BDB15AB68E4697EF7AB2ABC8750F24411AE802BB3C8CF750D0587D1

Function 06A94790 Relevance: .1, Instructions: 51COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3894696406.0000000006A90000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a90000_LA0gY3d103.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 95266d76406785ec87109bf8ae1e7ea1e98bf6c5b62b687ba14fd42dfb340c84
Instruction ID: da9db231982f274a383d1ab58ee19172c8c14c421ad9f4dd09cbd0da4d40382d
Opcode Fuzzy Hash: 95266d76406785ec87109bf8ae1e7ea1e98bf6c5b62b687ba14fd42dfb340c84
Instruction Fuzzy Hash: 9C01B1387043008FD714AF69D898D2BB7E6EFCE2617284469F889DB352DA31EC02CB50

Function 055086F0 Relevance: .1, Instructions: 51COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3891795807.0000000005500000.00000040.00000800.00020000.00000000.sdmp, Offset: 05500000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5500000_LA0gY3d103.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3e17ba794f5e877b238acce6f7fd0914a5a34eac70e393d12868cebb82816323
Instruction ID: c14bd6a73a2f28a1f7107dacef9b55712c35eb21ef1372520738a950cad9fb72
Opcode Fuzzy Hash: 3e17ba794f5e877b238acce6f7fd0914a5a34eac70e393d12868cebb82816323
Instruction Fuzzy Hash: B2115A30B142198BDB05AB64D829BEF7AB3BBC8710F20411AE902AB3C8CF750D0597E5

Function 06A97140 Relevance: .0, Instructions: 49COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3894696406.0000000006A90000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a90000_LA0gY3d103.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ec05880ce178f361527e20afcb74cdfae5933cb08ebf24e33d1ef410f90b5c58
Instruction ID: 5919970e0e77c681f6263060681da087d0ab81d0d3a208f3a0a2dc94b7aa7a6c
Opcode Fuzzy Hash: ec05880ce178f361527e20afcb74cdfae5933cb08ebf24e33d1ef410f90b5c58
Instruction Fuzzy Hash: A8016131B102299BDB55BB64D829BAF7AB2BBC9B10F204129E902A7384DF754D01C7E5

Function 0550A230 Relevance: .0, Instructions: 49COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3891795807.0000000005500000.00000040.00000800.00020000.00000000.sdmp, Offset: 05500000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5500000_LA0gY3d103.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 58de75f91e271e4de906baa88e99985f2ec46838dff6afadd2add96f0f7e6c41
Instruction ID: 71a1d0e4a7b8ba2fa8c888ecd21fec08132a2967f9c541ac4244a2a4be739285
Opcode Fuzzy Hash: 58de75f91e271e4de906baa88e99985f2ec46838dff6afadd2add96f0f7e6c41
Instruction Fuzzy Hash: 1F016236305115AB9B056EA9FC949AFBFAAFBC8364B10803AFA1987350DE318D15D790

Function 06A947A0 Relevance: .0, Instructions: 47COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3894696406.0000000006A90000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a90000_LA0gY3d103.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b9f0feeb4cf9e5b7b747acc2bdc8b3dc528cbabc7c3d3f78ec7e81060a966557
Instruction ID: d3651156657215981e8afcf61b0fd677d9d44b7f86a0f7f2d2c26f7016de775c
Opcode Fuzzy Hash: b9f0feeb4cf9e5b7b747acc2bdc8b3dc528cbabc7c3d3f78ec7e81060a966557
Instruction Fuzzy Hash: 85016D397002058FD714EF69D898E2AB7EAEFCD2657284469F949DB361DA31EC02CB50

Function 06A99FD1 Relevance: .0, Instructions: 46COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3894696406.0000000006A90000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a90000_LA0gY3d103.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a47993ae5629b09431cdd87d6f673939cd9d0dd0f11c519d3e0be79576bb7b71
Instruction ID: e9e45b5e9fd0d891242f30b564ef135c898a1cd6f635752fde45ad87fbe3d407
Opcode Fuzzy Hash: a47993ae5629b09431cdd87d6f673939cd9d0dd0f11c519d3e0be79576bb7b71
Instruction Fuzzy Hash: B501D6312093825FC383AB78A8104D63FF5EF8B32075900ABD044D7693D72D1D1ADB61

Function 00E4D819 Relevance: .0, Instructions: 45COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3887987732.0000000000E4D000.00000040.00000800.00020000.00000000.sdmp, Offset: 00E4D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e4d000_LA0gY3d103.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c54aa597bcd6c9e99b8045588140cabcc9b1966dc0956a3acb863cdd7c0d2026
Instruction ID: d4c68fa845abaa5838ae6226e0172ac9b1953ea52608700b321423667e31ba2d
Opcode Fuzzy Hash: c54aa597bcd6c9e99b8045588140cabcc9b1966dc0956a3acb863cdd7c0d2026
Instruction Fuzzy Hash: 0101A7715083449AE7145A16EC84777BB98DF89779F18C41AED096A186C3799840C672

Function 06A9A740 Relevance: .0, Instructions: 44COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3894696406.0000000006A90000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a90000_LA0gY3d103.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a12d7af1857a1e1559818b73b609d1c1296e18eee4fc583fc55ef162f0847f6b
Instruction ID: d2675a2a33d85af5dff101ac14051f09bae846b69749a4866d8c565ac23067ae
Opcode Fuzzy Hash: a12d7af1857a1e1559818b73b609d1c1296e18eee4fc583fc55ef162f0847f6b
Instruction Fuzzy Hash: E71115B58003498FDB20DFAAD485BDEFBF4EB48324F20841AD519A7350C778A944CFA1

Function 0550AD61 Relevance: .0, Instructions: 39COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3891795807.0000000005500000.00000040.00000800.00020000.00000000.sdmp, Offset: 05500000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5500000_LA0gY3d103.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 85bb027bc140f095089dbbc34e0c9572d5d6355121d2c666907438ef1bd9fb50
Instruction ID: 055c2a24046a35590195485a3c1f54ca252dedc9526dbe0814c2e38937fbc1ed
Opcode Fuzzy Hash: 85bb027bc140f095089dbbc34e0c9572d5d6355121d2c666907438ef1bd9fb50
Instruction Fuzzy Hash: 7C012D3110A288AFD702CF64CC11CAA7FB9EF49201B0984D7ED44DB292DA319E54D7A1

Function 05508C20 Relevance: .0, Instructions: 39COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3891795807.0000000005500000.00000040.00000800.00020000.00000000.sdmp, Offset: 05500000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5500000_LA0gY3d103.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9ae2e6e55060daa7bfe13ecc6da1ff493a3e50d50b11a78e0c3818908e4bde15
Instruction ID: 93af25bce93dbabb7ce99e352eb6948188fde79ddbd6e0348c2ed4d4711b3c24
Opcode Fuzzy Hash: 9ae2e6e55060daa7bfe13ecc6da1ff493a3e50d50b11a78e0c3818908e4bde15
Instruction Fuzzy Hash: 7401C8303093849FD706EBB8D85178E3F75EB82200F4540FAD844DB293DA355D0AC351

Function 06A99CA7 Relevance: .0, Instructions: 37COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3894696406.0000000006A90000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a90000_LA0gY3d103.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ddb80e6171b75cf5f0a879bbacbfa6e4bb65aff399dd110f77330243288a79ce
Instruction ID: 44e15ca095ada0922ca183675e25977ff2b9b1369bf9ff463bb466056fb8e431
Opcode Fuzzy Hash: ddb80e6171b75cf5f0a879bbacbfa6e4bb65aff399dd110f77330243288a79ce
Instruction Fuzzy Hash: 7EF0C2347007105BEB64BB24A85579E77E2FBC4B51F10861DD906AB384DF751E058BD2

Function 0550A220 Relevance: .0, Instructions: 37COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3891795807.0000000005500000.00000040.00000800.00020000.00000000.sdmp, Offset: 05500000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5500000_LA0gY3d103.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6f8417396e14c943164a6253b5dd21cb15b338e44b22a8c8e242baa768725a8b
Instruction ID: c2ab0e4b51e082af2f906b91fcd3fedd42ab4bf3f7ca2c8546ba1e96cc837d8d
Opcode Fuzzy Hash: 6f8417396e14c943164a6253b5dd21cb15b338e44b22a8c8e242baa768725a8b
Instruction Fuzzy Hash: B6F0E23230220167DB113E9AFC99AAF7FAAEBC8260F444039FB0487342DE218C0197A1

Function 00E4D818 Relevance: .0, Instructions: 36COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3887987732.0000000000E4D000.00000040.00000800.00020000.00000000.sdmp, Offset: 00E4D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e4d000_LA0gY3d103.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b170f0ff5f29e9a4fc92c969b46ec0df43fb70e61499264ea6db8d6a51a70736
Instruction ID: a713515845571bb45e068e2ed1b046c0e9881599cf71e0de0d7a8692f5a39905
Opcode Fuzzy Hash: b170f0ff5f29e9a4fc92c969b46ec0df43fb70e61499264ea6db8d6a51a70736
Instruction Fuzzy Hash: DCF0C271408344AEE7148E16DC84B62FFA8EB45738F18C05AED085A286C279A844CAB1

Function 05527A8F Relevance: .0, Instructions: 35COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3891854924.0000000005520000.00000040.00000800.00020000.00000000.sdmp, Offset: 05520000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5520000_LA0gY3d103.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b603c3c58c8d6afe4de107891eaaa57f570404e6dcd6d17c5683fc287abbb360
Instruction ID: 43dfc7551d3cf4e4e7675ccb9f99b63e48433c9715b249f98623bea0e670d35a
Opcode Fuzzy Hash: b603c3c58c8d6afe4de107891eaaa57f570404e6dcd6d17c5683fc287abbb360
Instruction Fuzzy Hash: 2EF0F632210255ABC700EF99E851FA577A9F799720F08405AE804C7361CB72ED11CBD0

Function 050D60A8 Relevance: .0, Instructions: 34COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3891072915.00000000050D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 050D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_50d0000_LA0gY3d103.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ee4753ea29926153004893387eaf427eb7d8edcbcfa90f3a686e02f4863647a1
Instruction ID: 14ee4deed4aff8249e64bd41faef4c37562653fafc98899a44941f83f2aab363
Opcode Fuzzy Hash: ee4753ea29926153004893387eaf427eb7d8edcbcfa90f3a686e02f4863647a1
Instruction Fuzzy Hash: F8F0F079A043149FDF619B15F906B3AFBE9B785310F0E8055D909C3292CB62E888C7A5

Function 0550927D Relevance: .0, Instructions: 32COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3891795807.0000000005500000.00000040.00000800.00020000.00000000.sdmp, Offset: 05500000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5500000_LA0gY3d103.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 974669c68b1253b6051134966863ceda773ef1953a2e479352cc37e506d80144
Instruction ID: 5bec0d61a7d7973532752b1a66f4c6a8edc04d0852e6b61676ca3294c3ed0789
Opcode Fuzzy Hash: 974669c68b1253b6051134966863ceda773ef1953a2e479352cc37e506d80144
Instruction Fuzzy Hash: 6BF027312093854FD706AB78FC127793BB6BFC2215F0940B7D905CB293DA340C068794

Function 0550928D Relevance: .0, Instructions: 32COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3891795807.0000000005500000.00000040.00000800.00020000.00000000.sdmp, Offset: 05500000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5500000_LA0gY3d103.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5181f42351dc02d693d249488646e937f322baeaee0855888a2ce8dde6309619
Instruction ID: 9adc4e64d5f875f8bac22d48833456e5d7e83f43c8e29923d314957fe872fd3f
Opcode Fuzzy Hash: 5181f42351dc02d693d249488646e937f322baeaee0855888a2ce8dde6309619
Instruction Fuzzy Hash: 27F0E2322093824FE305AB78E8127A93BB2BFC2216F0940B7D501CB297DA244C068795

Function 050D675E Relevance: .0, Instructions: 32COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3891072915.00000000050D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 050D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_50d0000_LA0gY3d103.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 24e07bd598c28893f2340d40d05891bb0895a711b85507dff25130a1724de800
Instruction ID: c53a37663f891dcbee562a63b12caf36566f3e70d971350047a74e08374ddcf7
Opcode Fuzzy Hash: 24e07bd598c28893f2340d40d05891bb0895a711b85507dff25130a1724de800
Instruction Fuzzy Hash: FDF0C238B011118FC754EB74F45962E76E6AF8D341F0900B8E54AE7360DF349C028B61

Function 0550A3B0 Relevance: .0, Instructions: 31COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3891795807.0000000005500000.00000040.00000800.00020000.00000000.sdmp, Offset: 05500000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5500000_LA0gY3d103.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8dea82e0f783f09c1697c2cd8d70471924c449c943c79df18893b30ccb1e0df1
Instruction ID: b9dfd7487c53a42da16f45ffffddcbcd3c88272e449e374e94a3bac7ec62db9f
Opcode Fuzzy Hash: 8dea82e0f783f09c1697c2cd8d70471924c449c943c79df18893b30ccb1e0df1
Instruction Fuzzy Hash: 6BF03033210019ABDB066E98FC86BDB376AE7C8320F044025B614D2690DA719D5197A5

Function 055046F8 Relevance: .0, Instructions: 26COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3891795807.0000000005500000.00000040.00000800.00020000.00000000.sdmp, Offset: 05500000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5500000_LA0gY3d103.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ddaabe56f0ff44140a885e45e28327bdb4683a5a65f473de0762367715964f35
Instruction ID: 632f2c39fb5238f31c56260264a6ffefd9aec08016d76d78ad04b3a4241f733a
Opcode Fuzzy Hash: ddaabe56f0ff44140a885e45e28327bdb4683a5a65f473de0762367715964f35
Instruction Fuzzy Hash: A5F0A030704246DFCB09EFB8ED19A9EBBB5FF81200B0092AED449D72A6DB301E00CB51

Function 055062E9 Relevance: .0, Instructions: 25COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3891795807.0000000005500000.00000040.00000800.00020000.00000000.sdmp, Offset: 05500000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5500000_LA0gY3d103.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4c5630af5d62785648471b90f015f7889ce22d3ff91f84afa11bd97cb8a79e66
Instruction ID: 2a2bcac30f7cce3c7862b26fd376caad03d2b044a4d0c7f84a7a7f5f7acffda4
Opcode Fuzzy Hash: 4c5630af5d62785648471b90f015f7889ce22d3ff91f84afa11bd97cb8a79e66
Instruction Fuzzy Hash: E3F0A035604005DBEB0CAA34D8565ED7BB3EB44310F24A826FA0297280DE369811CB10

Function 05509D80 Relevance: .0, Instructions: 25COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3891795807.0000000005500000.00000040.00000800.00020000.00000000.sdmp, Offset: 05500000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5500000_LA0gY3d103.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 21707ee16864f6dbfc5eb77e55d0d5ed649a30b3b39ea5114809734ae1447f95
Instruction ID: def59c6be99f08413ef5ac335001175ec1333154bab09372396a601ccf769ec4
Opcode Fuzzy Hash: 21707ee16864f6dbfc5eb77e55d0d5ed649a30b3b39ea5114809734ae1447f95
Instruction Fuzzy Hash: D1E0D8333082147BC3012758E821B9B7FBED7C8361F18402AF584C7252CE74981593B1

Function 0550B628 Relevance: .0, Instructions: 24COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3891795807.0000000005500000.00000040.00000800.00020000.00000000.sdmp, Offset: 05500000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5500000_LA0gY3d103.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 53f063ab83b3592d48322ce88b0de584ef3a7bce56f95419433a4c6e23361f41
Instruction ID: 88ffa370ba1c5029a4f79a490948d559491debb130f0aa5628dd53e8c3cbe059
Opcode Fuzzy Hash: 53f063ab83b3592d48322ce88b0de584ef3a7bce56f95419433a4c6e23361f41
Instruction Fuzzy Hash: 97E0DF722041983FC360DA99DC41AA77FEDCB8D111F08845AB894C2283E569DD0187B0

Function 06A98F69 Relevance: .0, Instructions: 23COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3894696406.0000000006A90000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a90000_LA0gY3d103.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c2f67de4770dac0540222ef9c215f5b0cf42d05d8385680611a7befb54da975e
Instruction ID: 5666add28694f72fd768ab4025eb382ba0784b6ae2b076d9b762b0d95ab9ab91
Opcode Fuzzy Hash: c2f67de4770dac0540222ef9c215f5b0cf42d05d8385680611a7befb54da975e
Instruction Fuzzy Hash: 16E026719083418FC341EF78E8404C4B7F1EFA6210714898EE0859B322E725CE47C762

Function 06A9A000 Relevance: .0, Instructions: 23COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3894696406.0000000006A90000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a90000_LA0gY3d103.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3e716404bb217421b277eec076459362eb45e68e3614c7c959eb45529bca202e
Instruction ID: da0c17031e67389c0181a5b14769ed623fa214c71f1ed9933c36e7dce7595efe
Opcode Fuzzy Hash: 3e716404bb217421b277eec076459362eb45e68e3614c7c959eb45529bca202e
Instruction Fuzzy Hash: 6BE0C23231001497C218B7ACF8519AB37EEE7C8730B28042AF60AE3385CF21AC0587E4

Function 0550A1E8 Relevance: .0, Instructions: 23COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3891795807.0000000005500000.00000040.00000800.00020000.00000000.sdmp, Offset: 05500000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5500000_LA0gY3d103.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c3f7cc8fed0cf36a5d524fa22767f156a81aa6fa2cd3a9697f5f3e9a6f7a4454
Instruction ID: 39a5182c3f5b13ab966334e0d22906bb8b9727c468a8c9bcb2334718c4e59d22
Opcode Fuzzy Hash: c3f7cc8fed0cf36a5d524fa22767f156a81aa6fa2cd3a9697f5f3e9a6f7a4454
Instruction Fuzzy Hash: E0E086361001087FCB118D84DC42EE77B2DEB84310F04C016BD1492351CA73DC2197D1

Function 05503397 Relevance: .0, Instructions: 23COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3891795807.0000000005500000.00000040.00000800.00020000.00000000.sdmp, Offset: 05500000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5500000_LA0gY3d103.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5b2b5657af6503f8ee67a4e99b267b9561dbf94505f13b2d023ef80158b85f28
Instruction ID: 64d0d4c3887cd48795bf2bb2e2399fa2f32cb77c97d8974e3f188ba3d4930d66
Opcode Fuzzy Hash: 5b2b5657af6503f8ee67a4e99b267b9561dbf94505f13b2d023ef80158b85f28
Instruction Fuzzy Hash: 3AE04F32104248AFCB02DE84EC118EB7F6AEF99360F18846AFD4497211C673DD71DBA1

Function 050D9CE1 Relevance: .0, Instructions: 23COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3891072915.00000000050D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 050D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_50d0000_LA0gY3d103.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0acc503034638599dafac262b25d34cfc86025c58569a919f23a13e131505ee3
Instruction ID: 12e65e8b333abb5bb4a0b259e883cfc4605745f1d621a3048ba7a074329c40c6
Opcode Fuzzy Hash: 0acc503034638599dafac262b25d34cfc86025c58569a919f23a13e131505ee3
Instruction Fuzzy Hash: 91E0CD32280344AFD754CF78DC02FA97BA8EF56700F140495F2085F1B1C173E8508755

Function 0550A440 Relevance: .0, Instructions: 22COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3891795807.0000000005500000.00000040.00000800.00020000.00000000.sdmp, Offset: 05500000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5500000_LA0gY3d103.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 46b452dec73872ad093d40ee4a8b9727ffcc383913134a07a78e530b396b337f
Instruction ID: 1ca885869a9b44f024799a43b1021fc075f6ea93c61174d1dd617dcfd8e5fcf4
Opcode Fuzzy Hash: 46b452dec73872ad093d40ee4a8b9727ffcc383913134a07a78e530b396b337f
Instruction Fuzzy Hash: 31E04F361092987FCB02CF94DC51CE6BF79EB8A214709C59AFD4887262C772DD21D7A1

Function 05503CCA Relevance: .0, Instructions: 22COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3891795807.0000000005500000.00000040.00000800.00020000.00000000.sdmp, Offset: 05500000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5500000_LA0gY3d103.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 300499b737b66ccddd238076a256f1e131092eaef9dcfdeff9bcccf1b19130de
Instruction ID: daac240c52bf6520e904bdc598d98e9def8af974f511b45b2e0d57b4b95e57b7
Opcode Fuzzy Hash: 300499b737b66ccddd238076a256f1e131092eaef9dcfdeff9bcccf1b19130de
Instruction Fuzzy Hash: AEF03279A00108CFDB00CF45D880A9EFBB2FF84310F61C8AAE205EB250DB30A9448F61

Function 06A99597 Relevance: .0, Instructions: 21COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3894696406.0000000006A90000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a90000_LA0gY3d103.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 09fe319ccc39f7fed4bbb29a8719568440d59acb10e28fa8e0e2119b9d516cb3
Instruction ID: 1af327a4da12d426feb611223180196405a876b94771293e069a49cdde108deb
Opcode Fuzzy Hash: 09fe319ccc39f7fed4bbb29a8719568440d59acb10e28fa8e0e2119b9d516cb3
Instruction Fuzzy Hash: B5E08C32A09249DFCB02CFB0C5501EABFB0EF8B2007114AEBD084DB111EB324E19DB81

Function 05509D90 Relevance: .0, Instructions: 21COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3891795807.0000000005500000.00000040.00000800.00020000.00000000.sdmp, Offset: 05500000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5500000_LA0gY3d103.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 06cb77eed7f21138ac153cceb23fce984482fa015922ea6d11bca7ddd6eb0a33
Instruction ID: 0bcffd600edf6dea75d40e8bf066645a7602e10f027005fd910943e8736b195e
Opcode Fuzzy Hash: 06cb77eed7f21138ac153cceb23fce984482fa015922ea6d11bca7ddd6eb0a33
Instruction Fuzzy Hash: D6D0C2363001186BC7002A88E814EAB3BAEE7C87A1F148027F204C7241CE719C0197E0

Function 05508C50 Relevance: .0, Instructions: 21COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3891795807.0000000005500000.00000040.00000800.00020000.00000000.sdmp, Offset: 05500000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5500000_LA0gY3d103.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7a67336869175d72ee8ffdd79d98ee3b8c59c2ee5197ea1dfef21ebfdf7641c2
Instruction ID: be5af637d6fc87237499657640f1a51468ac3cee33e701d6644b855a3a402a03
Opcode Fuzzy Hash: 7a67336869175d72ee8ffdd79d98ee3b8c59c2ee5197ea1dfef21ebfdf7641c2
Instruction Fuzzy Hash: 45E01A30700209EFDB04EFB4F941A5FB7B6FB84300F5041A9D809E7285EB316E018B91

Function 05509E01 Relevance: .0, Instructions: 21COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3891795807.0000000005500000.00000040.00000800.00020000.00000000.sdmp, Offset: 05500000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5500000_LA0gY3d103.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9696ccceb7da2b604fe1bd6eebef7c891cc9e16554ef99acaaab7ca9aef6e806
Instruction ID: 4972b28bcde0ae35694843bb1fa0fe2e8a5620e9bd0c802af7ef76222cb9daf4
Opcode Fuzzy Hash: 9696ccceb7da2b604fe1bd6eebef7c891cc9e16554ef99acaaab7ca9aef6e806
Instruction Fuzzy Hash: 31E012375001187FEB00CE84DC41FAA7B69EB88A64F14C42AFD0987351DB72ED2297D1

Function 05526E49 Relevance: .0, Instructions: 20COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3891854924.0000000005520000.00000040.00000800.00020000.00000000.sdmp, Offset: 05520000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5520000_LA0gY3d103.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 63846a47fd2c60f6fb158a489f4b8799c99fb3fa5a1fc2eaa013e678c9891dc5
Instruction ID: 7dec44a11eec41e3341144f69929148dcf021b98126a3137063281e0de5eda72
Opcode Fuzzy Hash: 63846a47fd2c60f6fb158a489f4b8799c99fb3fa5a1fc2eaa013e678c9891dc5
Instruction Fuzzy Hash: CAE08C75810208ABCB00EFB0C900ACE7BFDFF99510F4049D6D081E7210EA30AA0097C1

Function 06A95E68 Relevance: .0, Instructions: 20COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3894696406.0000000006A90000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a90000_LA0gY3d103.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9e440c4d921597acd4de093f3b38cbf8508870668a34b658363c0a7760ebaa81
Instruction ID: e4ff390e2d268d5d622be5e7240af1de9729dbb61a606db7a1f4b93d11bfb2cb
Opcode Fuzzy Hash: 9e440c4d921597acd4de093f3b38cbf8508870668a34b658363c0a7760ebaa81
Instruction Fuzzy Hash: 44E08C755083D14FD742DF24E821821BBB0EB96220756C88AE4E483252C622AC0ACB31

Function 06A95D38 Relevance: .0, Instructions: 20COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3894696406.0000000006A90000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a90000_LA0gY3d103.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0169872e85ff63d729edd1b26352b7241e9b2c86a22fc946511b871c417889da
Instruction ID: 7c28076a1c85f0e27dd92d3f53f295ddd5e7bf0f724747540a1f2e21d87fb686
Opcode Fuzzy Hash: 0169872e85ff63d729edd1b26352b7241e9b2c86a22fc946511b871c417889da
Instruction Fuzzy Hash: 98E0C27A90C3804FD783DB54D401422BBF1EBC62307568C9FE4849B382D6629C0BC771

Function 055034A8 Relevance: .0, Instructions: 20COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3891795807.0000000005500000.00000040.00000800.00020000.00000000.sdmp, Offset: 05500000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5500000_LA0gY3d103.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f91d07cea0154caa15d19959012e4c8adca464bb63bd1106c9ffc8018d2609c8
Instruction ID: b704873d8ac0e81e60ec424cdcd87da48113003bf6d3bb190c26bdd2fcca343f
Opcode Fuzzy Hash: f91d07cea0154caa15d19959012e4c8adca464bb63bd1106c9ffc8018d2609c8
Instruction Fuzzy Hash: 11D012F6D0010CAFCB40CEA0CD427597BF8DB49104F1044A5E915D7310EA359F51ABD2

Function 05504708 Relevance: .0, Instructions: 20COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3891795807.0000000005500000.00000040.00000800.00020000.00000000.sdmp, Offset: 05500000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5500000_LA0gY3d103.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cec8396a80c30d10f0adefed219fd910e899692d25495b48213364542e8d21d4
Instruction ID: 28685baea9cef2c811a544dcb729e5bfa6dc28703803e712268fc8a3455d782d
Opcode Fuzzy Hash: cec8396a80c30d10f0adefed219fd910e899692d25495b48213364542e8d21d4
Instruction Fuzzy Hash: 97E04F30700209DFCB04FFB8ED5565E77F9FB80200F0001A9D909D7255EB312E008B81

Function 05504110 Relevance: .0, Instructions: 20COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3891795807.0000000005500000.00000040.00000800.00020000.00000000.sdmp, Offset: 05500000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5500000_LA0gY3d103.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1c88398c9f613ede9966ad648113712d43658805f2a97cbd21edb31fe19b1a74
Instruction ID: 1c832d20de63b9a58da59f189e98f50976a673632b9f6c8c931599c52f826399
Opcode Fuzzy Hash: 1c88398c9f613ede9966ad648113712d43658805f2a97cbd21edb31fe19b1a74
Instruction Fuzzy Hash: 6FD012BAA01508FFCB09EA94DA5178E76E8DFC5111F0508A59508EB200EA358E0457D1

Function 055092A8 Relevance: .0, Instructions: 20COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3891795807.0000000005500000.00000040.00000800.00020000.00000000.sdmp, Offset: 05500000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5500000_LA0gY3d103.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 22879b562252f183c5f38c9d54195fa274fdad07d846ad5347c7fd889b647507
Instruction ID: 948ff882538477b3e8dac67831d6e3cbc771fc7774e0189faca253cc8132aded
Opcode Fuzzy Hash: 22879b562252f183c5f38c9d54195fa274fdad07d846ad5347c7fd889b647507
Instruction Fuzzy Hash: B3D05B3130031957D6087679F855B7B7B9EF7C1721F40413AF60597341DE615C0547D4

Function 0550AD98 Relevance: .0, Instructions: 20COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3891795807.0000000005500000.00000040.00000800.00020000.00000000.sdmp, Offset: 05500000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5500000_LA0gY3d103.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e326b987d4402b37ac5d41816f4760bab8dc99d1e301996fd16b3d1d014a0a04
Instruction ID: 835c51e1ce15924d94130db28ab3395e6408b61fa8ea80cef13534344edf0e20
Opcode Fuzzy Hash: e326b987d4402b37ac5d41816f4760bab8dc99d1e301996fd16b3d1d014a0a04
Instruction Fuzzy Hash: 98E08C731041846FD705CE88DD12AA63F29EB85221B08C08BF858C7252C67ACD22DB60

Function 06A95A61 Relevance: .0, Instructions: 19COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3894696406.0000000006A90000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a90000_LA0gY3d103.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 104de6d821d4ff5b882869da27b590d6f71e28fd057542736475765633f06849
Instruction ID: 9732efcc43e98215ac2902984dcdf15f12edab2b355cb1fb60b630348f64876e
Opcode Fuzzy Hash: 104de6d821d4ff5b882869da27b590d6f71e28fd057542736475765633f06849
Instruction Fuzzy Hash: 0CE0C2B59083408FCB86EA90D881821B7B1AF8622072A888FE4408B213C622CC07C735

Function 055041B1 Relevance: .0, Instructions: 18COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3891795807.0000000005500000.00000040.00000800.00020000.00000000.sdmp, Offset: 05500000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5500000_LA0gY3d103.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b64d78fd8145a6d44c2873de432516657355a73b7b76ce11d82baf182cfdf3b7
Instruction ID: 04d417a0497474a21e6d8f87b90b8c47ebc99dd38306b8580808f78aa8d6b74f
Opcode Fuzzy Hash: b64d78fd8145a6d44c2873de432516657355a73b7b76ce11d82baf182cfdf3b7
Instruction Fuzzy Hash: A4D05E71A010059BCB04CB54C9517CCB371EF80208F1445D9D4189B651CB33CE419740

Function 06A962E0 Relevance: .0, Instructions: 17COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3894696406.0000000006A90000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a90000_LA0gY3d103.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f3e52862e0e05e8b5951e3c19843d058167a542fc4fe71e920e32874c2b91405
Instruction ID: b66d0fe88271920150891e3a0a237bcd0dd2d329ce207bb4466d5bc76ef0a03a
Opcode Fuzzy Hash: f3e52862e0e05e8b5951e3c19843d058167a542fc4fe71e920e32874c2b91405
Instruction Fuzzy Hash: 3BD02B71D09248DFC701DBA4A8100997FB49F4520070004EBD048DB160F5354E049391

Function 06A9733B Relevance: .0, Instructions: 17COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3894696406.0000000006A90000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a90000_LA0gY3d103.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 823affa9a3350aed676e1f488b3a3be6c3ce908718f4fc1ef160a92a398a7317
Instruction ID: 607d65e42b68e8aaa0ed7f32e084082a39d20071c85332b217bc795ce1580d92
Opcode Fuzzy Hash: 823affa9a3350aed676e1f488b3a3be6c3ce908718f4fc1ef160a92a398a7317
Instruction Fuzzy Hash: 24E0EC3510D3919FC347CF24D910966BFB1EF9A614719848FE88097262C6229C1BCB62

Function 06A9A080 Relevance: .0, Instructions: 17COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3894696406.0000000006A90000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a90000_LA0gY3d103.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bc010b4b93a5d5a24667622a99be3b3ca1a19be6a0538f9a5ed129641b2d8d2c
Instruction ID: 14dd944ee0236cdc44c4e18161b3a657ef037ac5ecebd9f7c260730dc67bda10
Opcode Fuzzy Hash: bc010b4b93a5d5a24667622a99be3b3ca1a19be6a0538f9a5ed129641b2d8d2c
Instruction Fuzzy Hash: 99D017312043428FC382CA608806481BBF0EB6626136982AAC8958A1A3C73A8A17CB51

Function 06A97CD8 Relevance: .0, Instructions: 17COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3894696406.0000000006A90000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a90000_LA0gY3d103.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c3d832c65ee3ebf44b024bfef9441519113081b558e37c7260d78975aca0f916
Instruction ID: afe37c568f201c4d53237639e90281a857c87925a1b52fe02a8b89d8bbe52ab5
Opcode Fuzzy Hash: c3d832c65ee3ebf44b024bfef9441519113081b558e37c7260d78975aca0f916
Instruction Fuzzy Hash: C6E0127510D2419FC342DF54FA10885BFF29FA6614B18888AE480D7353C626DD56CB32

Function 06A97DB8 Relevance: .0, Instructions: 17COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3894696406.0000000006A90000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a90000_LA0gY3d103.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f4b1bfc1dabe8b6df71cc979ad589fa92b524ce5f43cf738624887a6a938dd45
Instruction ID: bfd81cc1aa9a359748e1d1d54e9533928ebb677e269e60a5e4cd6d5c869c9058
Opcode Fuzzy Hash: f4b1bfc1dabe8b6df71cc979ad589fa92b524ce5f43cf738624887a6a938dd45
Instruction Fuzzy Hash: 77E05BB15183874FC341CF54D820481B7B1FF952107198C46D480CF253D729DD17DB21

Function 0550B380 Relevance: .0, Instructions: 17COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3891795807.0000000005500000.00000040.00000800.00020000.00000000.sdmp, Offset: 05500000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5500000_LA0gY3d103.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3b698f11c99261612a8dd82fe1371f716717a8e9fca5edbb0d56b47d21e06565
Instruction ID: b60f10a8e1eaf5f20a1cf0b16343cf667684a26e4c2994cbc46f1946f3ade5fc
Opcode Fuzzy Hash: 3b698f11c99261612a8dd82fe1371f716717a8e9fca5edbb0d56b47d21e06565
Instruction Fuzzy Hash: 30E0ECA510C1E04FC345CBA9EA60966BFE55E9A505F18888AA4D4DB287C515CD06CB36

Function 055033A8 Relevance: .0, Instructions: 17COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3891795807.0000000005500000.00000040.00000800.00020000.00000000.sdmp, Offset: 05500000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5500000_LA0gY3d103.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0fe6e3aea478687c158d19a34a902664cc9df0a88a38a6ac68c528960ef1b384
Instruction ID: 29f6224dccce5c91cfde4dbcf6ef2d8eab8ae5265d8597ad401a6bfe491303de
Opcode Fuzzy Hash: 0fe6e3aea478687c158d19a34a902664cc9df0a88a38a6ac68c528960ef1b384
Instruction Fuzzy Hash: 44D06236100119BF9B05DE84DC41CA67B6AEB89660714C05AFD1547211C673DD22DBD0

Function 050D607F Relevance: .0, Instructions: 17COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3891072915.00000000050D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 050D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_50d0000_LA0gY3d103.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 20ddd1b41a00f29b3b18163fa62e902ebf4d2e6b773d839f9ba19b65f0c09ccd
Instruction ID: fd6b7804594b02f52a72952e1170b8ceec0399ac2965b9a6be2beedafe4c6356
Opcode Fuzzy Hash: 20ddd1b41a00f29b3b18163fa62e902ebf4d2e6b773d839f9ba19b65f0c09ccd
Instruction Fuzzy Hash: 01D0A7F27050042FC301C564CC52AA5B7A0CFA8210B15C02DA84DC7741F563DC03C500

Function 05526E58 Relevance: .0, Instructions: 16COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3891854924.0000000005520000.00000040.00000800.00020000.00000000.sdmp, Offset: 05520000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5520000_LA0gY3d103.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 78063ce046203a19ee692bb017087f278988c93bc13d5d6e49e94b466934cbc2
Instruction ID: 28cc319712cd117abaae1f0068925976e329bc91c2e90a33d2c6e5564edc2941
Opcode Fuzzy Hash: 78063ce046203a19ee692bb017087f278988c93bc13d5d6e49e94b466934cbc2
Instruction Fuzzy Hash: 2CD09279911209EB8B01EBF089008DEBBEDAE99550B5049E69585A7210EE319A10A7D2

Function 06A97B59 Relevance: .0, Instructions: 16COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3894696406.0000000006A90000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a90000_LA0gY3d103.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 787e21e6f5123b9d7f9183e40dc66ec4cbf2114de5f6ff53b5fd9daec48def03
Instruction ID: 097b2279d08d3efe2cda4c27cafa5c2fe32f3f0cc941f2aadd2baac55561a8f2
Opcode Fuzzy Hash: 787e21e6f5123b9d7f9183e40dc66ec4cbf2114de5f6ff53b5fd9daec48def03
Instruction Fuzzy Hash: 47D05EB254C3418FD341DE44C850851BBE2FBE5310B25885AE454C2251D766DC06CB10

Function 05504322 Relevance: .0, Instructions: 16COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3891795807.0000000005500000.00000040.00000800.00020000.00000000.sdmp, Offset: 05500000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5500000_LA0gY3d103.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: afa37fd4c3b230af8f958bbe9706ad6cba7c38792023fa8b1c2d260ba5408baf
Instruction ID: 1b3e0cef1b5abe6d320de1bc4f002222b17e1c674181cefbb3ecad501c15a9b9
Opcode Fuzzy Hash: afa37fd4c3b230af8f958bbe9706ad6cba7c38792023fa8b1c2d260ba5408baf
Instruction Fuzzy Hash: 00C0121624094467DA089208E96B7E83258EB8421AFCE0850229998B80D6088EC08040

Function 050D9DAF Relevance: .0, Instructions: 16COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3891072915.00000000050D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 050D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_50d0000_LA0gY3d103.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fc5606184871fc1755390b5b11b0828c15427ff546c190a9ac818a910dea6c3d
Instruction ID: a27b33d2824a3a10328e3aa223c48e75d9302ec2eaebdfc66ad0b97761944061
Opcode Fuzzy Hash: fc5606184871fc1755390b5b11b0828c15427ff546c190a9ac818a910dea6c3d
Instruction Fuzzy Hash: 3ED0A7313402046BC740CF5CDC42B92B3D5DFA8300F14C079A808C7341DA32FD038150

Function 05527B20 Relevance: .0, Instructions: 15COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3891854924.0000000005520000.00000040.00000800.00020000.00000000.sdmp, Offset: 05520000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5520000_LA0gY3d103.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 01121f2c778aaa955698064ff843d2996bee34fc2f5530b77e7ea5e79a423cb0
Instruction ID: 1b0a6f6d896694a697788613f5e5355b62e48349d74697ae87246d03dd23ea49
Opcode Fuzzy Hash: 01121f2c778aaa955698064ff843d2996bee34fc2f5530b77e7ea5e79a423cb0
Instruction Fuzzy Hash: 05D0C936200118BF9B04DE88DC41CAABB6EEB89660714C05FFD1887311CAB3ED22DBD0

Function 05509D51 Relevance: .0, Instructions: 15COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3891795807.0000000005500000.00000040.00000800.00020000.00000000.sdmp, Offset: 05500000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5500000_LA0gY3d103.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 598c211b367cc371535c9596a235f7b77bfca036bb14be3a9662e08c7ff3c3ce
Instruction ID: c624a90eef256f8e4eb066a0f95ab3237b14f866c2f629feed68546c8465c33c
Opcode Fuzzy Hash: 598c211b367cc371535c9596a235f7b77bfca036bb14be3a9662e08c7ff3c3ce
Instruction Fuzzy Hash: 1AE012755081048FC705CF58F940D49B7E2EFD5604F148949E84093316C632DC1ACB72

Function 050D9D01 Relevance: .0, Instructions: 15COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3891072915.00000000050D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 050D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_50d0000_LA0gY3d103.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ceac0c7150eed899c73294b5c4ee36924fdbe1c53167afd579cf0b385a1d4f17
Instruction ID: e1c7017e65abc34f2503a2cdbba54f5381de4c96e035640ea031c481af88d565
Opcode Fuzzy Hash: ceac0c7150eed899c73294b5c4ee36924fdbe1c53167afd579cf0b385a1d4f17
Instruction Fuzzy Hash: BBD09232285348AFE7158F69DD46F81BFA4EF1AB00F180495FB408F6A6C6A2F420DB55

Function 050D13F7 Relevance: .0, Instructions: 15COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3891072915.00000000050D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 050D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_50d0000_LA0gY3d103.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0b96daba1157c58fee028707a14a70ed7964ae5a793dd026522a01b23ddb2399
Instruction ID: f725de39b0bbf6468e4d85244fe872b49afef1232450be9855a8e3c5309d60f3
Opcode Fuzzy Hash: 0b96daba1157c58fee028707a14a70ed7964ae5a793dd026522a01b23ddb2399
Instruction Fuzzy Hash: 54D012357582444FE305C65DEC51BA1F7C99BD8205F14C469A44CC3352DA67EE178A51

Function 050D2AB0 Relevance: .0, Instructions: 15COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3891072915.00000000050D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 050D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_50d0000_LA0gY3d103.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8b7590d9be461026fb6697927e9affd5650ff2b6b55ab62b9e83a2503b5397dc
Instruction ID: cf211923fbbd89eb01688af8249d6eb1f6f474a6ba9cf72c5f34f59eb713a9d0
Opcode Fuzzy Hash: 8b7590d9be461026fb6697927e9affd5650ff2b6b55ab62b9e83a2503b5397dc
Instruction Fuzzy Hash: 51D0C779B043045FD745C55DE811634B7D6DB9535875984BA940DC7372F552DC028650

Function 0552FE88 Relevance: .0, Instructions: 14COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3891854924.0000000005520000.00000040.00000800.00020000.00000000.sdmp, Offset: 05520000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5520000_LA0gY3d103.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7c5ef911f645582227f98d22fb29992c81fbdcc31e579eb0ffd53a54126e0760
Instruction ID: a708d1f703f68aebdf1046ccc9974aa4fb9fa51999decdd8b9904e8cf919e5dc
Opcode Fuzzy Hash: 7c5ef911f645582227f98d22fb29992c81fbdcc31e579eb0ffd53a54126e0760
Instruction Fuzzy Hash: 73D0C97190120CEF8B40EFA4894059EBBF9EF89200B1145EA9948D7210EE319A1097D1

Function 06A962F0 Relevance: .0, Instructions: 14COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3894696406.0000000006A90000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a90000_LA0gY3d103.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 21a120c7abedad89b71002261944fe2d3ac391cabacadd2d782966823614e647
Instruction ID: b765402d239db53ea0640dcb39bd8d3608bceb3f30268823a34ef9a64423eb4f
Opcode Fuzzy Hash: 21a120c7abedad89b71002261944fe2d3ac391cabacadd2d782966823614e647
Instruction Fuzzy Hash: D9D0C971D0120CEF8B00EFA4890059EBBF9EF89200B1045EA9508D7250EA319A1457D1

Function 06A995A8 Relevance: .0, Instructions: 14COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3894696406.0000000006A90000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a90000_LA0gY3d103.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7b986ece128d3320efdf30241596d9031fe10ecdb01891a90bca4edc6c97d461
Instruction ID: 4f59e05a1eea17e9e8ec4a3b28feeeea163ac6c6426809120ffb6c1a38ca9d57
Opcode Fuzzy Hash: 7b986ece128d3320efdf30241596d9031fe10ecdb01891a90bca4edc6c97d461
Instruction Fuzzy Hash: B2D0C97190520CEF8B00DFE5894059EBBF9EF89200B1045EA9508D7210EA319A1097D1

Function 055034B8 Relevance: .0, Instructions: 14COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3891795807.0000000005500000.00000040.00000800.00020000.00000000.sdmp, Offset: 05500000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5500000_LA0gY3d103.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6c7e3930613c43060cf9ccdb022c9d6a93b7408310fcf8e9e2ad1461cc643dee
Instruction ID: bf8ef7a132be763098c731e308254ba20121bd0e8c2d4fdc078e04eb4db0709e
Opcode Fuzzy Hash: 6c7e3930613c43060cf9ccdb022c9d6a93b7408310fcf8e9e2ad1461cc643dee
Instruction Fuzzy Hash: E3D0C97691120CEF8B00DFA5D90159EBBFDEB49201B1049E6E909D3210EE329F549BD2

Function 05504120 Relevance: .0, Instructions: 14COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3891795807.0000000005500000.00000040.00000800.00020000.00000000.sdmp, Offset: 05500000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5500000_LA0gY3d103.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a26bd4a90bdc51e0f84a9491c279375860acee07e674a7b71ca9f1de6f881edd
Instruction ID: c35ce4b64dbe2bb10168ff3e707c02d5d04d77fa64b2d36e0acdc676f0dea62f
Opcode Fuzzy Hash: a26bd4a90bdc51e0f84a9491c279375860acee07e674a7b71ca9f1de6f881edd
Instruction Fuzzy Hash: 36D0C9B1D0120CFF8B04EFA4890059EBBF9EF89600B1049EA9508D7210EA319E1057D1

Function 0550C258 Relevance: .0, Instructions: 14COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3891795807.0000000005500000.00000040.00000800.00020000.00000000.sdmp, Offset: 05500000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5500000_LA0gY3d103.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5f4fc1febf8e6ccf76ad34dda91ba1f893232eccb5b906097379778869fd3ef7
Instruction ID: 0e98e38a7e21acb434ce5623687f18a52ecf4c7498e266f1ffd70ef6019dc650
Opcode Fuzzy Hash: 5f4fc1febf8e6ccf76ad34dda91ba1f893232eccb5b906097379778869fd3ef7
Instruction Fuzzy Hash: 67D0C975211100ABD344C754CC8AF93B3A5DBD8205F14C069A408C7350EB32E802C655

Function 05509C40 Relevance: .0, Instructions: 14COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3891795807.0000000005500000.00000040.00000800.00020000.00000000.sdmp, Offset: 05500000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5500000_LA0gY3d103.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 79743b3565df4c092b7a1ebb32846844e8ab8e0ac384c1f8f6ad3c6bf9243b45
Instruction ID: c2b72352a526e4b6913420b5f90782a4db105b316c5b95d32e808d912c1e76e9
Opcode Fuzzy Hash: 79743b3565df4c092b7a1ebb32846844e8ab8e0ac384c1f8f6ad3c6bf9243b45
Instruction Fuzzy Hash: 15D09E702051405FC356CB58C89AD56BBA59FD5109718C5AEA888CB257D631D806C756

Function 05509FB0 Relevance: .0, Instructions: 14COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3891795807.0000000005500000.00000040.00000800.00020000.00000000.sdmp, Offset: 05500000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5500000_LA0gY3d103.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cd804ea272454a3e052f9c8780a6aa7cde426fb2f5d7611a541f7a13d27394cb
Instruction ID: d3452e6fbf3fefce1043bb5c1572b26e1221694c253d87df0d1a2cc390dec326
Opcode Fuzzy Hash: cd804ea272454a3e052f9c8780a6aa7cde426fb2f5d7611a541f7a13d27394cb
Instruction Fuzzy Hash: B5D05E7411C7804FD302CF14D860866BFE2ABC6204B18C88EE49087676C621CC0ADB21

Function 0550AEE0 Relevance: .0, Instructions: 14COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3891795807.0000000005500000.00000040.00000800.00020000.00000000.sdmp, Offset: 05500000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5500000_LA0gY3d103.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2943443a68a3283c8baa5c7ab2d404d7b64c4f0df88119714644e2bdc8116ff5
Instruction ID: 99082ec3e9ea2bcd96b10943c8da430bd4506bddb61e89110aa961f2db8a4d0a
Opcode Fuzzy Hash: 2943443a68a3283c8baa5c7ab2d404d7b64c4f0df88119714644e2bdc8116ff5
Instruction Fuzzy Hash: A4D0C9312120007BD254C515CC9BF93BBA9DB85250F54C029B408C7350EA22E80286AA

Function 055089E1 Relevance: .0, Instructions: 14COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3891795807.0000000005500000.00000040.00000800.00020000.00000000.sdmp, Offset: 05500000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5500000_LA0gY3d103.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4b0f13422dbc9dd65897293bc6fab19337f16915eacae506b23f98143a3b7202
Instruction ID: 30ac176ca5728e13fa1b6d8e2ce12806aa9ef57a46e582616ca30041d4c8ea6d
Opcode Fuzzy Hash: 4b0f13422dbc9dd65897293bc6fab19337f16915eacae506b23f98143a3b7202
Instruction Fuzzy Hash: FFD012353004006BC708DA08CCA6B56B7A1EFC4208F64C42D6488CB350DA33DC43C600

Function 0550D8B8 Relevance: .0, Instructions: 14COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3891795807.0000000005500000.00000040.00000800.00020000.00000000.sdmp, Offset: 05500000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5500000_LA0gY3d103.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9ac9694463f53a21456614d04446be1ed24152991523b18a63a031c448604c64
Instruction ID: c9a8368acf491ff8595586bccfe1bf324e7233462d9719433f4461342904d27b
Opcode Fuzzy Hash: 9ac9694463f53a21456614d04446be1ed24152991523b18a63a031c448604c64
Instruction Fuzzy Hash: 41D0C935201000ABC354CA54CD8AB9BB3A9DB98211F54C86DA488D7350EB36D8038655

Function 06A99520 Relevance: .0, Instructions: 13COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3894696406.0000000006A90000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a90000_LA0gY3d103.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2653b0a35fc928672d26b94002791a034d0f5d977bbbf96338ce8e7d0e4e7039
Instruction ID: e3d5226e76d44b8feed1c88d8049584e37df258f0e9a427579c2572f3784d2ac
Opcode Fuzzy Hash: 2653b0a35fc928672d26b94002791a034d0f5d977bbbf96338ce8e7d0e4e7039
Instruction Fuzzy Hash: C6D0026A28D2D05FC74357305DA14E93F318E4B51531954DBE0E58B6E3C7065A0BD7A1

Function 055086C0 Relevance: .0, Instructions: 13COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3891795807.0000000005500000.00000040.00000800.00020000.00000000.sdmp, Offset: 05500000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5500000_LA0gY3d103.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bb9b8985639d6e0bace8330d7e92cf62ade7ca3c630e4e486529be2ea77ffa87
Instruction ID: e98e6ea4cfad0a3a9f6fbafaeeb43a4fa3d588779d9a06d342312e415d216343
Opcode Fuzzy Hash: bb9b8985639d6e0bace8330d7e92cf62ade7ca3c630e4e486529be2ea77ffa87
Instruction Fuzzy Hash: 9FC04C312068044BC644D508CA627487651DFC4648F5D845C9499EB645CB67D8438981

Function 06A97CE8 Relevance: .0, Instructions: 12COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3894696406.0000000006A90000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a90000_LA0gY3d103.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9742d7865735c7252f6c48a7c294f1d1b4f483eb85901c8c33943e63f37f990d
Instruction ID: 48e8204161933d4df9c7b41a33249025f43fd015cf28c75e97648b457401bf24
Opcode Fuzzy Hash: 9742d7865735c7252f6c48a7c294f1d1b4f483eb85901c8c33943e63f37f990d
Instruction Fuzzy Hash: 84D012752081119F9204CF44E940C6BF7E6EFC8B10B14C84EB84053310CA72DC17CBB2

Function 06A999E0 Relevance: .0, Instructions: 12COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3894696406.0000000006A90000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a90000_LA0gY3d103.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9742d7865735c7252f6c48a7c294f1d1b4f483eb85901c8c33943e63f37f990d
Instruction ID: 48e8204161933d4df9c7b41a33249025f43fd015cf28c75e97648b457401bf24
Opcode Fuzzy Hash: 9742d7865735c7252f6c48a7c294f1d1b4f483eb85901c8c33943e63f37f990d
Instruction Fuzzy Hash: 84D012752081119F9204CF44E940C6BF7E6EFC8B10B14C84EB84053310CA72DC17CBB2

Function 06A9A5F1 Relevance: .0, Instructions: 12COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3894696406.0000000006A90000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a90000_LA0gY3d103.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 03cee83770d12d49589b9ad7d94ce33154c57bd4e9050f65dcd825fb3fe97ef0
Instruction ID: 37b132862c73e91e43894436ccf469b95c505f8c0780446b0403b4ff8c2b9f61
Opcode Fuzzy Hash: 03cee83770d12d49589b9ad7d94ce33154c57bd4e9050f65dcd825fb3fe97ef0
Instruction Fuzzy Hash: 5BD0C9112493C05FC3038730D8615E17F218F87129B1984CAD4D48F163C7169A17C741

Function 0550E6C1 Relevance: .0, Instructions: 12COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3891795807.0000000005500000.00000040.00000800.00020000.00000000.sdmp, Offset: 05500000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5500000_LA0gY3d103.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 38671ad308bde3cda2ac27b89756ff64b85fec85468354e40d4475638f2bf166
Instruction ID: 33d24404f2dbf1a3fbb8a97b12d45011c0c89c724220ac70eaa925ff8c61d00a
Opcode Fuzzy Hash: 38671ad308bde3cda2ac27b89756ff64b85fec85468354e40d4475638f2bf166
Instruction Fuzzy Hash: 2EC04C7511501067C6B59505CCCBB877E59DB84255F188059784DC7345DF26D40385D9

Function 05505C27 Relevance: .0, Instructions: 12COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3891795807.0000000005500000.00000040.00000800.00020000.00000000.sdmp, Offset: 05500000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5500000_LA0gY3d103.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6486b6f27740b5d29d84c12e8667c247524eb38701a14158966cae91085098d5
Instruction ID: aa9a831e659661bb4714529650dc5c4d27bb079df5163aa974d78b1f662418e0
Opcode Fuzzy Hash: 6486b6f27740b5d29d84c12e8667c247524eb38701a14158966cae91085098d5
Instruction Fuzzy Hash: C0D0C739514005EBDF19AB54E5515FC7673FB49300F505426F902B6390CA365D919B51

Function 0550FFB0 Relevance: .0, Instructions: 12COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3891795807.0000000005500000.00000040.00000800.00020000.00000000.sdmp, Offset: 05500000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5500000_LA0gY3d103.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d4865dabd970365e23667e951dba5e30d868d9940d4ef2a5ee660477b1ce2ec2
Instruction ID: c6123bf969dc41bdb2e9985f97501d5c425435838d613380cdc43b03baac778b
Opcode Fuzzy Hash: d4865dabd970365e23667e951dba5e30d868d9940d4ef2a5ee660477b1ce2ec2
Instruction Fuzzy Hash: 7AD05E3430A2808FC301C714C820812BFA69F85109715C0AD9498C7362C631990BDB12

Function 0550A870 Relevance: .0, Instructions: 12COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3891795807.0000000005500000.00000040.00000800.00020000.00000000.sdmp, Offset: 05500000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5500000_LA0gY3d103.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 20e6c5442d4d6cf31963d41490ce2863dc97e8ebb343734530e16b6d403f965f
Instruction ID: 83cd45ea8b485c841d2b791e5e5d30fe32c0b78794291d17d79ad423997aded7
Opcode Fuzzy Hash: 20e6c5442d4d6cf31963d41490ce2863dc97e8ebb343734530e16b6d403f965f
Instruction Fuzzy Hash: ADD0126530E1C00BCB0AC72C99A15A4FFB29F8610675DC4EA9488CB753DA26DC07C745

Function 05508800 Relevance: .0, Instructions: 12COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3891795807.0000000005500000.00000040.00000800.00020000.00000000.sdmp, Offset: 05500000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5500000_LA0gY3d103.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b5bcbb310936080ee0ab8a17d9f12f7988b1696876a3c8f3755f991a1a50a9f3
Instruction ID: 163ecd0d3c9249642e028cb9a759ff96b4f37db223c07ad5604b8b63485ffa24
Opcode Fuzzy Hash: b5bcbb310936080ee0ab8a17d9f12f7988b1696876a3c8f3755f991a1a50a9f3
Instruction Fuzzy Hash: E6C04C3121840057C645861CD9627487762EFC4208F9988699499EB785CBA6D9834995

Function 055288B0 Relevance: .0, Instructions: 11COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3891854924.0000000005520000.00000040.00000800.00020000.00000000.sdmp, Offset: 05520000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5520000_LA0gY3d103.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2f9c937b705b733c9644217cffe37b903ab6a11d94893328ab2d7921f8117b8c
Instruction ID: 89f7625bcd3042e5662e2b0f59687678129b36ffb3fe7dec0c562e4284fda470
Opcode Fuzzy Hash: 2f9c937b705b733c9644217cffe37b903ab6a11d94893328ab2d7921f8117b8c
Instruction Fuzzy Hash: 05C04C753042085F9344DA9DD851C26F7E9DBD8614714C06DA90DC7351EA72FD13C694

Function 0550C510 Relevance: .0, Instructions: 11COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3891795807.0000000005500000.00000040.00000800.00020000.00000000.sdmp, Offset: 05500000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5500000_LA0gY3d103.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b42eb4a4237f3f300b34101a9c64c7a2a34653e472d88958374a96a308d26003
Instruction ID: 0a79cfcc9f3950630def7aa8d5064f7db411a5ec17eeb1af5eeabda724e68817
Opcode Fuzzy Hash: b42eb4a4237f3f300b34101a9c64c7a2a34653e472d88958374a96a308d26003
Instruction Fuzzy Hash: 8EC012752082209F9244DA08C840C66B3AAFBC8210B14C84EE85083300CBA2EC07CBA0

Function 05508AA0 Relevance: .0, Instructions: 11COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3891795807.0000000005500000.00000040.00000800.00020000.00000000.sdmp, Offset: 05500000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5500000_LA0gY3d103.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 18038fd74c2c574b9c47b3f99b6631e1d760eed6bfaf07129a5fd35b4144ebad
Instruction ID: 98acf9514bd6c68b9db7007fbd7f217ca846dae7ebb86b7d95e65e3fd21b99b4
Opcode Fuzzy Hash: 18038fd74c2c574b9c47b3f99b6631e1d760eed6bfaf07129a5fd35b4144ebad
Instruction Fuzzy Hash: 9BC08C7230180087C7058658CCB13886310EBC0208FAD88591088CB201CF22C8038400

Function 050D9D10 Relevance: .0, Instructions: 11COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3891072915.00000000050D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 050D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_50d0000_LA0gY3d103.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6b3cf73ecc0437b7ba418ab1aa0e16a313d668e98a5c47dae4f63aedb3a58e83
Instruction ID: 1559b7bb1d66cdfc4324202593fed40f7269f97be06a62174427e62a94373c76
Opcode Fuzzy Hash: 6b3cf73ecc0437b7ba418ab1aa0e16a313d668e98a5c47dae4f63aedb3a58e83
Instruction Fuzzy Hash: 8DC00235280208AFD7109A55DC46F457B68AB15B50F554091F7045F6A1C6A2E8109A98

Function 050D9DC0 Relevance: .0, Instructions: 11COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3891072915.00000000050D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 050D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_50d0000_LA0gY3d103.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2f9c937b705b733c9644217cffe37b903ab6a11d94893328ab2d7921f8117b8c
Instruction ID: 89f7625bcd3042e5662e2b0f59687678129b36ffb3fe7dec0c562e4284fda470
Opcode Fuzzy Hash: 2f9c937b705b733c9644217cffe37b903ab6a11d94893328ab2d7921f8117b8c
Instruction Fuzzy Hash: 05C04C753042085F9344DA9DD851C26F7E9DBD8614714C06DA90DC7351EA72FD13C694

Function 050D6090 Relevance: .0, Instructions: 11COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3891072915.00000000050D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 050D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_50d0000_LA0gY3d103.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2f9c937b705b733c9644217cffe37b903ab6a11d94893328ab2d7921f8117b8c
Instruction ID: 89f7625bcd3042e5662e2b0f59687678129b36ffb3fe7dec0c562e4284fda470
Opcode Fuzzy Hash: 2f9c937b705b733c9644217cffe37b903ab6a11d94893328ab2d7921f8117b8c
Instruction Fuzzy Hash: 05C04C753042085F9344DA9DD851C26F7E9DBD8614714C06DA90DC7351EA72FD13C694

Function 05509810 Relevance: .0, Instructions: 10COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3891795807.0000000005500000.00000040.00000800.00020000.00000000.sdmp, Offset: 05500000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5500000_LA0gY3d103.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 63d907eb5a1432acf78b679e85f7573f190b570c59acf0817834fd7ed09c2f35
Instruction ID: ee71332836e6abf92d009d5e4c95eb01ee954e40103e4fe85e10eeffb44b9f9c
Opcode Fuzzy Hash: 63d907eb5a1432acf78b679e85f7573f190b570c59acf0817834fd7ed09c2f35
Instruction Fuzzy Hash: 9DC0923551200067DAE8CE00CDC7BC2B324DB80289F18C499B816AA385EB22D803DAA9

Function 050D1408 Relevance: .0, Instructions: 10COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3891072915.00000000050D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 050D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_50d0000_LA0gY3d103.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6b890a1878f21bb7f09d862592a755ed2ce311562f5f1a0304c6abbbdd52873e
Instruction ID: 19d07928bc24b9474f7e59cbdd8b8e0d3deed1c7a519eb3c8c8690cf2c067a2b
Opcode Fuzzy Hash: 6b890a1878f21bb7f09d862592a755ed2ce311562f5f1a0304c6abbbdd52873e
Instruction Fuzzy Hash: C5C092303082084B8748D69DE851825F3DA9BCC618328C0BDA80DC7352EE23FC038684

Function 050D2AC0 Relevance: .0, Instructions: 10COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3891072915.00000000050D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 050D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_50d0000_LA0gY3d103.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6b890a1878f21bb7f09d862592a755ed2ce311562f5f1a0304c6abbbdd52873e
Instruction ID: 19d07928bc24b9474f7e59cbdd8b8e0d3deed1c7a519eb3c8c8690cf2c067a2b
Opcode Fuzzy Hash: 6b890a1878f21bb7f09d862592a755ed2ce311562f5f1a0304c6abbbdd52873e
Instruction Fuzzy Hash: C5C092303082084B8748D69DE851825F3DA9BCC618328C0BDA80DC7352EE23FC038684

Function 050D9B70 Relevance: .0, Instructions: 9COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3891072915.00000000050D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 050D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_50d0000_LA0gY3d103.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 65a0b81c26358fac3cdeac52408d36df30f5a1e89446cb33edb7f45d23a121bf
Instruction ID: 80d12a240ff5386b5104f2b9fab58cc268e82ee812220a8bd3e552ec28822a22
Opcode Fuzzy Hash: 65a0b81c26358fac3cdeac52408d36df30f5a1e89446cb33edb7f45d23a121bf
Instruction Fuzzy Hash: 1EC092320212488FD6099FE9FC84F8533A8E72DA4AF400514F50CA3020CBA6A1898F91

Function 05528C50 Relevance: .0, Instructions: 8COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3891854924.0000000005520000.00000040.00000800.00020000.00000000.sdmp, Offset: 05520000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5520000_LA0gY3d103.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b07eb51126463de2bf8462432d69fd4c92e1a2acd6486d465ab4ae050f38ce89
Instruction ID: 6946c9798f7289baa91495e0fb5539b78174b0423724991b48b9fdfa7c9b4558
Opcode Fuzzy Hash: b07eb51126463de2bf8462432d69fd4c92e1a2acd6486d465ab4ae050f38ce89
Instruction Fuzzy Hash: 02B012302081084F8244D6D8E841C14F39DDBC4618354C0ADE80CCB302CF33FC0385C4

Function 05528CB0 Relevance: .0, Instructions: 8COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3891854924.0000000005520000.00000040.00000800.00020000.00000000.sdmp, Offset: 05520000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5520000_LA0gY3d103.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b07eb51126463de2bf8462432d69fd4c92e1a2acd6486d465ab4ae050f38ce89
Instruction ID: 6946c9798f7289baa91495e0fb5539b78174b0423724991b48b9fdfa7c9b4558
Opcode Fuzzy Hash: b07eb51126463de2bf8462432d69fd4c92e1a2acd6486d465ab4ae050f38ce89
Instruction Fuzzy Hash: 02B012302081084F8244D6D8E841C14F39DDBC4618354C0ADE80CCB302CF33FC0385C4

Function 06A99470 Relevance: .0, Instructions: 8COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3894696406.0000000006A90000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a90000_LA0gY3d103.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 35f93f911f4290ecc80d24755d55449ce2161d7214b1a7235fdc589927d0f83e
Instruction ID: c9cecb59e3af488c2c000251a84d823deaedb3092b0da293a775ad09c07c8adf
Opcode Fuzzy Hash: 35f93f911f4290ecc80d24755d55449ce2161d7214b1a7235fdc589927d0f83e
Instruction Fuzzy Hash: 73C04C6144A3C35FC3871A7499102827FB15B23220F5605D2D0C0C5053E25C1D56C712

Function 050D6E77 Relevance: .0, Instructions: 8COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3891072915.00000000050D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 050D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_50d0000_LA0gY3d103.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a6e7bdfb34b4ef1d60506f1924ab6fc5c709c0da990cf80c92c9d05ac9e73791
Instruction ID: b8a4ad025c529b047ad4068258cfa05d0b57c4a53591f059f2c3615204a67038
Opcode Fuzzy Hash: a6e7bdfb34b4ef1d60506f1924ab6fc5c709c0da990cf80c92c9d05ac9e73791
Instruction Fuzzy Hash: 06C01278A00205CFDB01ABA1F90862E7B62BB81202F084221D002A3265CEB48C048F62

Function 055057C0 Relevance: .0, Instructions: 7COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3891795807.0000000005500000.00000040.00000800.00020000.00000000.sdmp, Offset: 05500000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5500000_LA0gY3d103.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cdfec89ecf4d227c2e3f2741df1fca2c4e7a0756e2f1ba050c9a008d3bdc9887
Instruction ID: e80b9cbb32ce7aa80f269217a2acaa4f8c5de131eb2df65f765f3a476441bad2
Opcode Fuzzy Hash: cdfec89ecf4d227c2e3f2741df1fca2c4e7a0756e2f1ba050c9a008d3bdc9887
Instruction Fuzzy Hash: 3DB002747054005B8748D65DD951515A7D29BC9215728C4AD641DC7355DE22DD039644

Function 06A97DF8 Relevance: .0, Instructions: 6COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3894696406.0000000006A90000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a90000_LA0gY3d103.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 305fc7ee1548bfe5911c53538772243976c585bd811631a57acb259c5d461878
Instruction ID: 3a6ab80f03f14702570fad715a0eaf4cc41669ef0d9ef2f7c38899a0086c923c
Opcode Fuzzy Hash: 305fc7ee1548bfe5911c53538772243976c585bd811631a57acb259c5d461878
Instruction Fuzzy Hash: 52B09239200000ABC204CB40C990C15F7A2EFD8308B28C49DA90D4B252CB33EC13EB00

Function 06A99480 Relevance: .0, Instructions: 5COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3894696406.0000000006A90000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a90000_LA0gY3d103.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 848e7b2b3d1d7438aceb18ee9ce77d60f8a3148b9db338e3d364b5add5ce48b1
Instruction ID: 424522431131923360a2424e5b60fcaca403654da384226d21dcd1d1d325544f
Opcode Fuzzy Hash: 848e7b2b3d1d7438aceb18ee9ce77d60f8a3148b9db338e3d364b5add5ce48b1
Instruction Fuzzy Hash: B3A001746050109B8689DA58D991818B7A2ABC9219728C4ADA819CB25ACF33E9039A44

Function 06A96DA0 Relevance: .0, Instructions: 5COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3894696406.0000000006A90000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a90000_LA0gY3d103.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 848e7b2b3d1d7438aceb18ee9ce77d60f8a3148b9db338e3d364b5add5ce48b1
Instruction ID: 424522431131923360a2424e5b60fcaca403654da384226d21dcd1d1d325544f
Opcode Fuzzy Hash: 848e7b2b3d1d7438aceb18ee9ce77d60f8a3148b9db338e3d364b5add5ce48b1
Instruction Fuzzy Hash: B3A001746050109B8689DA58D991818B7A2ABC9219728C4ADA819CB25ACF33E9039A44

Function 06A97120 Relevance: .0, Instructions: 5COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3894696406.0000000006A90000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a90000_LA0gY3d103.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 848e7b2b3d1d7438aceb18ee9ce77d60f8a3148b9db338e3d364b5add5ce48b1
Instruction ID: 424522431131923360a2424e5b60fcaca403654da384226d21dcd1d1d325544f
Opcode Fuzzy Hash: 848e7b2b3d1d7438aceb18ee9ce77d60f8a3148b9db338e3d364b5add5ce48b1
Instruction Fuzzy Hash: B3A001746050109B8689DA58D991818B7A2ABC9219728C4ADA819CB25ACF33E9039A44

Function 05504330 Relevance: .0, Instructions: 5COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3891795807.0000000005500000.00000040.00000800.00020000.00000000.sdmp, Offset: 05500000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5500000_LA0gY3d103.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b03e4bc755e2b78cd26da1828b0277bded5abab527206c6716507ab66742fff4
Instruction ID: 9aab1ad472a1b146525528d180497d6c354ffa762c3b807c27782ffa140a423a
Opcode Fuzzy Hash: b03e4bc755e2b78cd26da1828b0277bded5abab527206c6716507ab66742fff4
Instruction Fuzzy Hash: C990223000028C8B00003380300A0C03B0C80000223800000B00C002000E0028808080

Function 050D9B80 Relevance: .0, Instructions: 5COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3891072915.00000000050D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 050D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_50d0000_LA0gY3d103.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 14e741a421d490a3687d94c2944ecb292b655e343da91c1326ec8dd73881376e
Instruction ID: 5cfe3c9dfb116ea7458d0a8dd3d6160ea436ac2581840ec2355a143a3920aea0
Opcode Fuzzy Hash: 14e741a421d490a3687d94c2944ecb292b655e343da91c1326ec8dd73881376e
Instruction Fuzzy Hash: 1A90043105570CCF55543FF5750DD55775CD7455157C00051F50D475155FF5741047D5

Function 06A99A72 Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3894696406.0000000006A90000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a90000_LA0gY3d103.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 584a3913bed7d41f6751d29dc0af2e109adf5df94d8de11209de24b86f245c04
Instruction ID: 2108930940694c1c8b8ad4272d9396267f2db374b9021a0985f6588530823504
Opcode Fuzzy Hash: 584a3913bed7d41f6751d29dc0af2e109adf5df94d8de11209de24b86f245c04
Instruction Fuzzy Hash: 6BA002742010009BC644DB54C991814F761EFC5219728C4DDA8198B256CF33ED03DA40

Function 06A993A2 Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3894696406.0000000006A90000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a90000_LA0gY3d103.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 584a3913bed7d41f6751d29dc0af2e109adf5df94d8de11209de24b86f245c04
Instruction ID: 2108930940694c1c8b8ad4272d9396267f2db374b9021a0985f6588530823504
Opcode Fuzzy Hash: 584a3913bed7d41f6751d29dc0af2e109adf5df94d8de11209de24b86f245c04
Instruction Fuzzy Hash: 6BA002742010009BC644DB54C991814F761EFC5219728C4DDA8198B256CF33ED03DA40

Function 06A96090 Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3894696406.0000000006A90000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a90000_LA0gY3d103.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 584a3913bed7d41f6751d29dc0af2e109adf5df94d8de11209de24b86f245c04
Instruction ID: 2108930940694c1c8b8ad4272d9396267f2db374b9021a0985f6588530823504
Opcode Fuzzy Hash: 584a3913bed7d41f6751d29dc0af2e109adf5df94d8de11209de24b86f245c04
Instruction Fuzzy Hash: 6BA002742010009BC644DB54C991814F761EFC5219728C4DDA8198B256CF33ED03DA40

Function 06A90840 Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3894696406.0000000006A90000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a90000_LA0gY3d103.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 584a3913bed7d41f6751d29dc0af2e109adf5df94d8de11209de24b86f245c04
Instruction ID: 2108930940694c1c8b8ad4272d9396267f2db374b9021a0985f6588530823504
Opcode Fuzzy Hash: 584a3913bed7d41f6751d29dc0af2e109adf5df94d8de11209de24b86f245c04
Instruction Fuzzy Hash: 6BA002742010009BC644DB54C991814F761EFC5219728C4DDA8198B256CF33ED03DA40

Function 05508C30 Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3891795807.0000000005500000.00000040.00000800.00020000.00000000.sdmp, Offset: 05500000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5500000_LA0gY3d103.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 584a3913bed7d41f6751d29dc0af2e109adf5df94d8de11209de24b86f245c04
Instruction ID: 2108930940694c1c8b8ad4272d9396267f2db374b9021a0985f6588530823504
Opcode Fuzzy Hash: 584a3913bed7d41f6751d29dc0af2e109adf5df94d8de11209de24b86f245c04
Instruction Fuzzy Hash: 6BA002742010009BC644DB54C991814F761EFC5219728C4DDA8198B256CF33ED03DA40

Non-executed Functions

Function 06A901B2 Relevance: 1.5, Strings: 1, Instructions: 224COMMON

Download Yara Rule

Strings

@, xrefs: 06A90576

Memory Dump Source

Source File: 00000000.00000002.3894696406.0000000006A90000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a90000_LA0gY3d103.jbxd

Similarity

API ID:
String ID: @
API String ID: 0-2766056989
Opcode ID: 7eddfc12ad77532533a63825850a20bcf8a3436efff9c600bf2466c7943b0154
Instruction ID: ae386d6134c44a8eb6333273adf4dd1cc727fb772f39301499cd5acf61635c05
Opcode Fuzzy Hash: 7eddfc12ad77532533a63825850a20bcf8a3436efff9c600bf2466c7943b0154
Instruction Fuzzy Hash: 9BA1CC34710224CFEA49FB64E999B6A37F6BB88744F518159D806DB398EB31AC01CF91

Function 0103A7E0 Relevance: .7, Instructions: 669COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3888370412.0000000001030000.00000040.00000800.00020000.00000000.sdmp, Offset: 01030000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1030000_LA0gY3d103.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f616dabe06ae2d524c8f0e5aee59047bf4246b2cdb6415314c41c8625da19fbe
Instruction ID: 7402db879a25b21e54cd29883e705367a2b0319126264d306c45005fa127a631
Opcode Fuzzy Hash: f616dabe06ae2d524c8f0e5aee59047bf4246b2cdb6415314c41c8625da19fbe
Instruction Fuzzy Hash: B0423775A00114DFDB19DF68C984EA9BBB6FF88304F1581A8E589EB262CB31EC51DF40

Function 06A92667 Relevance: .3, Instructions: 295COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3894696406.0000000006A90000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a90000_LA0gY3d103.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 006710b69524003639a0fbda70f758e8001e77a2736da1020ff116ce96c73ebd
Instruction ID: 91e1053bce58e9ceecad39d3f1a1efbe5ebae79f485665d61f10bbd14fb8c3df
Opcode Fuzzy Hash: 006710b69524003639a0fbda70f758e8001e77a2736da1020ff116ce96c73ebd
Instruction Fuzzy Hash: 05D10A34B012258FCB59EF28D598B6B77F6BB88740F2181A99409EB395EF319D41CF80

Function 06A92670 Relevance: .3, Instructions: 295COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3894696406.0000000006A90000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a90000_LA0gY3d103.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c45df3cdecfd282f42040ef5794489d3a9be6204a0f78216b71b8a0b923af5fa
Instruction ID: 2d35bd1f8e163c24263710e5c24a4eb88f2eda4459993c944d1ca39dc6c2db95
Opcode Fuzzy Hash: c45df3cdecfd282f42040ef5794489d3a9be6204a0f78216b71b8a0b923af5fa
Instruction Fuzzy Hash: A3D10A34B012258FCB59EF28D598B6B77F2BB88740F2181A99409EB395EF319D41CF80

Function 050D5D38 Relevance: .3, Instructions: 281COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3891072915.00000000050D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 050D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_50d0000_LA0gY3d103.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d2f88ad8d0ecfa0b771fcfd02cb965ae8c865b6c5f26d1daaca6c054eaa94d01
Instruction ID: 2accfe73c810458b298c03b14c7af0409403c7ea59841c3e377684dfa1c8c791
Opcode Fuzzy Hash: d2f88ad8d0ecfa0b771fcfd02cb965ae8c865b6c5f26d1daaca6c054eaa94d01
Instruction Fuzzy Hash: F2B19D71E106299FCB15CBA8D980ABEFBF1FB88301F54866AD455E7201D731ED42CBA0

Function 05503840 Relevance: .3, Instructions: 279COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3891795807.0000000005500000.00000040.00000800.00020000.00000000.sdmp, Offset: 05500000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5500000_LA0gY3d103.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f59f5da7be32c7fbf94bfb257d1a2d6c18ffc34ea8fa7851239a1c6a1a37fe45
Instruction ID: 93757e23238f30c513bda021d5d2ca5fdb8e12ab9bf90233596f8aba8c73797b
Opcode Fuzzy Hash: f59f5da7be32c7fbf94bfb257d1a2d6c18ffc34ea8fa7851239a1c6a1a37fe45
Instruction Fuzzy Hash: 3BB15671B006299FDB14DB68C984BADB7F2BF88304F1595A8E019EB3A1DB30EC45CB50

Function 06A9275C Relevance: .2, Instructions: 245COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3894696406.0000000006A90000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a90000_LA0gY3d103.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1a7cea0fec646166b252be4081385991d26c1911f02a29173a2cfc19c3d9d5eb
Instruction ID: fbe6ede16ae642437a8eb91a3cb89a389ab25dc7477940e0ed429b1a48105b3a
Opcode Fuzzy Hash: 1a7cea0fec646166b252be4081385991d26c1911f02a29173a2cfc19c3d9d5eb
Instruction Fuzzy Hash: 48B10B34B112258FCB59EF28D498B6B77F6BB88750F2181A99409EB395EF319D41CF80

Function 050D229B Relevance: 7.7, Strings: 6, Instructions: 204COMMON

Download Yara Rule

Strings

(K, xrefs: 050D247B
(K, xrefs: 050D229B
(K, xrefs: 050D251D
(K, xrefs: 050D2547
(K, xrefs: 050D2390
(K, xrefs: 050D24C8

Memory Dump Source

Source File: 00000000.00000002.3891072915.00000000050D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 050D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_50d0000_LA0gY3d103.jbxd

Similarity

API ID:
String ID: (K$(K$(K$(K$(K$(K
API String ID: 0-621951011
Opcode ID: 85b07643a034bf408dc0ecee5cc9198b75b2b666a554c4b63361636b34235b8b
Instruction ID: fca9a588d0d032860cb6f0fba1c8d5e8715ef9f5000dcd0a4b8856c484b120d7
Opcode Fuzzy Hash: 85b07643a034bf408dc0ecee5cc9198b75b2b666a554c4b63361636b34235b8b
Instruction Fuzzy Hash: 4F818F38604206DFD750EB55E895B6EB7B3FBC4301F158165E402AB3A9CB75AC85CBA0

Function 05504340 Relevance: 5.1, Strings: 4, Instructions: 145COMMON

Download Yara Rule

Strings

hfEf, xrefs: 055045B0
<tfW, xrefs: 0550451B
[?SZ, xrefs: 05504589
v*Q, xrefs: 055043E7

Memory Dump Source

Source File: 00000000.00000002.3891795807.0000000005500000.00000040.00000800.00020000.00000000.sdmp, Offset: 05500000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5500000_LA0gY3d103.jbxd

Similarity

API ID:
String ID: <tfW$[?SZ$hfEf$v*Q
API String ID: 0-1482441226
Opcode ID: 5e3527eba3a5359575e00fa09e79e801542ff05bd41142955bbef9976e9dd433
Instruction ID: 802aa7775ee0a5dd1f3904426a6767ddc161c510d0957e675f2b16f91097a14d
Opcode Fuzzy Hash: 5e3527eba3a5359575e00fa09e79e801542ff05bd41142955bbef9976e9dd433
Instruction Fuzzy Hash: 94A135B0806A408FD348DF4A8599FE5BAE0BF89300F5A82FAC15D9F632E7318045CF95

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is an administration feature that provides a uniform environment to access Windows system components. The WMI service enables both local and remote access, though the latter is facilitated by Remote Services such as Distributed Component Object Model (DCOM) and Windows Remote Management (WinRM).Remote WMI over DCOM operates using port 135, whereas WMI over WinRM operates over port 5985 when using HTTP and 5986 for HTTPS.
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Connection Creation, Process: Process Creation, WMI: WMI Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse PowerShell commands and scripts for execution. PowerShell is a powerful interactive command-line interface and scripting environment included in the Windows operating system.Adversaries can use PowerShell to perform a number of actions, including discovery of information and execution of code. Examples include the `Start-Process` cmdlet which can be used to run an executable and the `Invoke-Command` cmdlet which runs a command locally or on a remote computer (though administrator permissions are required to use PowerShell to connect to remote systems).
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify file time attributes to hide new or changes to existing files. Timestomping is a technique that modifies the timestamps of a file (the modify, access, create, and change times), often to mimic files that are in the same folder. This is done, for example, on files that have been modified or created by the adversary so that they do not appear conspicuous to forensic investigators or file analysis tools.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata, File: File Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the Windows Registry to gather information about the system, configuration, and installed software.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local system sources, such as file systems and configuration files or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Access, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report LA0gY3d103.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Yara Signatures

Initial Sample

Memory Dumps

Unpacked PEs

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Networking

System Summary

Data Obfuscation

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Data Directories

Sections

Resources

Imports

Network Behavior

Suricata IDS Alerts

Network Port Distribution

TCP Packets

DNS Answers

Statistics

Windows Analysis Report
LA0gY3d103.exe

Function 0103E900 Relevance: 14.2, Strings: 11, Instructions: 443
COMMON

Function 06A90880 Relevance: 2.7, Strings: 1, Instructions: 1499
COMMON

Function 06A90871 Relevance: 2.7, Strings: 1, Instructions: 1498
COMMON

Function 06A90BA7 Relevance: 2.6, Strings: 1, Instructions: 1311
COMMON

Function 06A906C8 Relevance: 2.5, Strings: 1, Instructions: 1280
COMMON

Function 06A90730 Relevance: 2.5, Strings: 1, Instructions: 1248
COMMON

Function 06A90781 Relevance: 2.5, Strings: 1, Instructions: 1237
COMMON

Function 050D26C4 Relevance: 3.8, Strings: 3, Instructions: 30
COMMON

Function 06A93A28 Relevance: 2.7, Strings: 2, Instructions: 182
COMMON