Edit tour

Windows Analysis Report
YcxjdYUKIb.exe

Overview

General Information

Sample name:	YcxjdYUKIb.exe renamed because original name is a hash value
Original sample name:	dd6f40ba5347afaba9cf9b57ad2e9a612e7fd5d0d93ea5a80d59e43c4c58af8b.exe
Analysis ID:	1577213
MD5:	e89c4510fd982d44f3b6c4d4671d50fd
SHA1:	b5f45fc5723466fb2c0ef4aa55453408c9bd022b
SHA256:	dd6f40ba5347afaba9cf9b57ad2e9a612e7fd5d0d93ea5a80d59e43c4c58af8b
Tags:	139-99-188-124exeuser-JAMESWT_MHT
Infos:

Detection

PureCrypter, PureLog Stealer

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Multi AV Scanner detection for submitted file

Suricata IDS alerts for network traffic

Yara detected PureLog Stealer

.NET source code contains method to dynamically call methods (often used by packers)

AI detected suspicious sample

Detected PureCrypter Trojan

Found many strings related to Crypto-Wallets (likely being stolen)

Machine Learning detection for sample

Queries memory information (via WMI often done to detect virtual machines)

Queries sensitive Plug and Play Device Information (via WMI, Win32_PnPEntity, often done to detect virtual machines)

Queries sensitive disk information (via WMI, Win32_DiskDrive, often done to detect virtual machines)

Queries sensitive physical memory information (via WMI, Win32_PhysicalMemory, often done to detect virtual machines)

Tries to harvest and steal Bitcoin Wallet information

Abnormal high CPU Usage

Allocates memory with a write watch (potentially for evading sandboxes)

Binary contains a suspicious time stamp

Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)

Contains long sleeps (>= 3 min)

Detected TCP or UDP traffic on non-standard ports

Detected potential crypto function

Enables debug privileges

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

Monitors certain registry keys / values for changes (often done to protect autostart functionality)

Queries sensitive processor information (via WMI, Win32_Processor, often done to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sample file is different than original file name gathered from version info

Uses 32bit PE files

Uses code obfuscation techniques (call, push, ret)

Yara detected Credential Stealer

Classification

Process Tree

System is w10x64

YcxjdYUKIb.exe (PID: 3744 cmdline: "C:\Users\user\Desktop\YcxjdYUKIb.exe" MD5: E89C4510FD982D44F3B6C4D4671D50FD)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
PureCrypter	According to zscaler, PureCrypter is a fully-featured loader being sold since at least March 2021The malware has been observed distributing a variety of remote access trojans and information stealersThe loader is a .NET executable obfuscated with SmartAssembly and makes use of compression, encryption and obfuscation to evade antivirus software productsPureCrypter features provide persistence, injection and defense mechanisms that are configurable in Googles Protocol Buffer message format	No Attribution	https://any.run/cybersecurity-blog/pure-malware-family-analysis/ https://blog.netlab.360.com/purecrypter-is-busy-pumping-out-various-malicious-malware-families/ https://blog.sekoia.io/mallox-ransomware-affiliate-leverages-purecrypter-in-microsoft-sql-exploitation-campaigns/ https://www.prodaft.com/m/reports/RIG___TLP_CLEAR-1.pdf https://www.zscaler.com/blogs/security-research/technical-analysis-purecrypter	https://malpedia.caad.fkie.fraunhofer.de/details/win.purecrypter

Yara Signatures

Initial Sample

Source	Rule	Description	Author	Strings
YcxjdYUKIb.exe	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security

Memory Dumps

Source	Rule	Description	Author
00000000.00000000.1758935663.0000000000BE2000.00000002.00000001.01000000.00000003.sdmp	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
00000000.00000002.4200579501.000000000331C000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000000.00000002.4200579501.000000000314A000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: YcxjdYUKIb.exe PID: 3744	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security

Unpacked PEs

Source	Rule	Description	Author	Strings
0.0.YcxjdYUKIb.exe.be0000.0.unpack	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security

Suricata Signatures

ET MALWARE Generic AsyncRAT Style SSL Cert

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-18T09:40:42.358030+0100	2035595	1	Domain Observed Used for C2 Detected	139.99.188.124	56001	192.168.2.4	49730	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: YcxjdYUKIb.exe

Avira: detected

Multi AV Scanner detection for submitted file

Source: YcxjdYUKIb.exe	Virustotal: Detection: 69%			Perma Link
Source: YcxjdYUKIb.exe	ReversingLabs: Detection: 55%

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Machine Learning detection for sample

Source: YcxjdYUKIb.exe

Joe Sandbox ML: detected

Source: YcxjdYUKIb.exe

Static PE information: EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE

Source: YcxjdYUKIb.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Networking

Suricata IDS alerts for network traffic

Source: Network traffic

Suricata IDS: 2035595 - Severity 1 - ET MALWARE Generic AsyncRAT Style SSL Cert : 139.99.188.124:56001 -> 192.168.2.4:49730

Source: global traffic

TCP traffic: 192.168.2.4:49730 -> 139.99.188.124:56001

Source: Joe Sandbox View	IP Address: 139.99.188.124 139.99.188.124
Source: Joe Sandbox View	IP Address: 139.99.188.124 139.99.188.124

Source: Joe Sandbox View

ASN Name: OVHFR OVHFR

Source: unknown	TCP traffic detected without corresponding DNS query: 139.99.188.124
Source: unknown	TCP traffic detected without corresponding DNS query: 139.99.188.124
Source: unknown	TCP traffic detected without corresponding DNS query: 139.99.188.124
Source: unknown	TCP traffic detected without corresponding DNS query: 139.99.188.124
Source: unknown	TCP traffic detected without corresponding DNS query: 139.99.188.124
Source: unknown	TCP traffic detected without corresponding DNS query: 139.99.188.124
Source: unknown	TCP traffic detected without corresponding DNS query: 139.99.188.124
Source: unknown	TCP traffic detected without corresponding DNS query: 139.99.188.124
Source: unknown	TCP traffic detected without corresponding DNS query: 139.99.188.124
Source: unknown	TCP traffic detected without corresponding DNS query: 139.99.188.124
Source: unknown	TCP traffic detected without corresponding DNS query: 139.99.188.124
Source: unknown	TCP traffic detected without corresponding DNS query: 139.99.188.124
Source: unknown	TCP traffic detected without corresponding DNS query: 139.99.188.124
Source: unknown	TCP traffic detected without corresponding DNS query: 139.99.188.124
Source: unknown	TCP traffic detected without corresponding DNS query: 139.99.188.124
Source: unknown	TCP traffic detected without corresponding DNS query: 139.99.188.124
Source: unknown	TCP traffic detected without corresponding DNS query: 139.99.188.124
Source: unknown	TCP traffic detected without corresponding DNS query: 139.99.188.124
Source: unknown	TCP traffic detected without corresponding DNS query: 139.99.188.124
Source: unknown	TCP traffic detected without corresponding DNS query: 139.99.188.124
Source: unknown	TCP traffic detected without corresponding DNS query: 139.99.188.124
Source: unknown	TCP traffic detected without corresponding DNS query: 139.99.188.124
Source: unknown	TCP traffic detected without corresponding DNS query: 139.99.188.124
Source: unknown	TCP traffic detected without corresponding DNS query: 139.99.188.124
Source: unknown	TCP traffic detected without corresponding DNS query: 139.99.188.124
Source: unknown	TCP traffic detected without corresponding DNS query: 139.99.188.124
Source: unknown	TCP traffic detected without corresponding DNS query: 139.99.188.124
Source: unknown	TCP traffic detected without corresponding DNS query: 139.99.188.124
Source: unknown	TCP traffic detected without corresponding DNS query: 139.99.188.124
Source: unknown	TCP traffic detected without corresponding DNS query: 139.99.188.124
Source: unknown	TCP traffic detected without corresponding DNS query: 139.99.188.124
Source: unknown	TCP traffic detected without corresponding DNS query: 139.99.188.124
Source: unknown	TCP traffic detected without corresponding DNS query: 139.99.188.124
Source: unknown	TCP traffic detected without corresponding DNS query: 139.99.188.124
Source: unknown	TCP traffic detected without corresponding DNS query: 139.99.188.124
Source: unknown	TCP traffic detected without corresponding DNS query: 139.99.188.124
Source: unknown	TCP traffic detected without corresponding DNS query: 139.99.188.124
Source: unknown	TCP traffic detected without corresponding DNS query: 139.99.188.124
Source: unknown	TCP traffic detected without corresponding DNS query: 139.99.188.124
Source: unknown	TCP traffic detected without corresponding DNS query: 139.99.188.124
Source: unknown	TCP traffic detected without corresponding DNS query: 139.99.188.124
Source: unknown	TCP traffic detected without corresponding DNS query: 139.99.188.124
Source: unknown	TCP traffic detected without corresponding DNS query: 139.99.188.124
Source: unknown	TCP traffic detected without corresponding DNS query: 139.99.188.124
Source: unknown	TCP traffic detected without corresponding DNS query: 139.99.188.124
Source: unknown	TCP traffic detected without corresponding DNS query: 139.99.188.124
Source: unknown	TCP traffic detected without corresponding DNS query: 139.99.188.124
Source: unknown	TCP traffic detected without corresponding DNS query: 139.99.188.124
Source: unknown	TCP traffic detected without corresponding DNS query: 139.99.188.124
Source: unknown	TCP traffic detected without corresponding DNS query: 139.99.188.124

Source: YcxjdYUKIb.exe, 00000000.00000002.4199502795.0000000001294000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en
Source: YcxjdYUKIb.exe, 00000000.00000002.4204301957.00000000058F0000.00000004.00000020.00020000.00000000.sdmp, 77EC63BDA74BD0D0E0426DC8F80085060.0.dr	String found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab
Source: YcxjdYUKIb.exe, 00000000.00000002.4200579501.000000000314A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: YcxjdYUKIb.exe, 00000000.00000002.4200579501.000000000314A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://github.com/DFfe9ewf/test3/raw/refs/heads/main/WebDriver.dll
Source: YcxjdYUKIb.exe, 00000000.00000002.4200579501.000000000314A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://github.com/DFfe9ewf/test3/raw/refs/heads/main/chromedriver.exe
Source: YcxjdYUKIb.exe, 00000000.00000002.4200579501.000000000314A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://github.com/DFfe9ewf/test3/raw/refs/heads/main/msedgedriver.exe
Source: YcxjdYUKIb.exe, 00000000.00000002.4200579501.000000000314A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://stackoverflow.com/q/11564914/23354;
Source: YcxjdYUKIb.exe, 00000000.00000002.4200579501.000000000314A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://stackoverflow.com/q/14436606/23354
Source: YcxjdYUKIb.exe, 00000000.00000002.4200579501.000000000314A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://stackoverflow.com/q/2152978/23354rCannot

Source: C:\Users\user\Desktop\YcxjdYUKIb.exe

Process Stats: CPU usage > 49%

Source: C:\Users\user\Desktop\YcxjdYUKIb.exe	Code function: 0_2_01630D50	0_2_01630D50
Source: C:\Users\user\Desktop\YcxjdYUKIb.exe	Code function: 0_2_0163A740	0_2_0163A740
Source: C:\Users\user\Desktop\YcxjdYUKIb.exe	Code function: 0_2_01630D42	0_2_01630D42
Source: C:\Users\user\Desktop\YcxjdYUKIb.exe	Code function: 0_2_03072C40	0_2_03072C40
Source: C:\Users\user\Desktop\YcxjdYUKIb.exe	Code function: 0_2_0307530B	0_2_0307530B
Source: C:\Users\user\Desktop\YcxjdYUKIb.exe	Code function: 0_2_0307331B	0_2_0307331B
Source: C:\Users\user\Desktop\YcxjdYUKIb.exe	Code function: 0_2_03073B3B	0_2_03073B3B
Source: C:\Users\user\Desktop\YcxjdYUKIb.exe	Code function: 0_2_0307434B	0_2_0307434B
Source: C:\Users\user\Desktop\YcxjdYUKIb.exe	Code function: 0_2_03074B6A	0_2_03074B6A
Source: C:\Users\user\Desktop\YcxjdYUKIb.exe	Code function: 0_2_03073371	0_2_03073371
Source: C:\Users\user\Desktop\YcxjdYUKIb.exe	Code function: 0_2_03074B95	0_2_03074B95
Source: C:\Users\user\Desktop\YcxjdYUKIb.exe	Code function: 0_2_03073B99	0_2_03073B99
Source: C:\Users\user\Desktop\YcxjdYUKIb.exe	Code function: 0_2_030753B7	0_2_030753B7
Source: C:\Users\user\Desktop\YcxjdYUKIb.exe	Code function: 0_2_03074BBE	0_2_03074BBE
Source: C:\Users\user\Desktop\YcxjdYUKIb.exe	Code function: 0_2_03073BCF	0_2_03073BCF
Source: C:\Users\user\Desktop\YcxjdYUKIb.exe	Code function: 0_2_03074BEC	0_2_03074BEC
Source: C:\Users\user\Desktop\YcxjdYUKIb.exe	Code function: 0_2_03073206	0_2_03073206
Source: C:\Users\user\Desktop\YcxjdYUKIb.exe	Code function: 0_2_03075242	0_2_03075242
Source: C:\Users\user\Desktop\YcxjdYUKIb.exe	Code function: 0_2_03074281	0_2_03074281
Source: C:\Users\user\Desktop\YcxjdYUKIb.exe	Code function: 0_2_03075280	0_2_03075280
Source: C:\Users\user\Desktop\YcxjdYUKIb.exe	Code function: 0_2_03073A94	0_2_03073A94
Source: C:\Users\user\Desktop\YcxjdYUKIb.exe	Code function: 0_2_03073ACE	0_2_03073ACE
Source: C:\Users\user\Desktop\YcxjdYUKIb.exe	Code function: 0_2_03075106	0_2_03075106
Source: C:\Users\user\Desktop\YcxjdYUKIb.exe	Code function: 0_2_0307490D	0_2_0307490D
Source: C:\Users\user\Desktop\YcxjdYUKIb.exe	Code function: 0_2_03075131	0_2_03075131
Source: C:\Users\user\Desktop\YcxjdYUKIb.exe	Code function: 0_2_0307395D	0_2_0307395D
Source: C:\Users\user\Desktop\YcxjdYUKIb.exe	Code function: 0_2_0307416A	0_2_0307416A
Source: C:\Users\user\Desktop\YcxjdYUKIb.exe	Code function: 0_2_0307398E	0_2_0307398E
Source: C:\Users\user\Desktop\YcxjdYUKIb.exe	Code function: 0_2_030751CF	0_2_030751CF
Source: C:\Users\user\Desktop\YcxjdYUKIb.exe	Code function: 0_2_030731CC	0_2_030731CC
Source: C:\Users\user\Desktop\YcxjdYUKIb.exe	Code function: 0_2_030739E7	0_2_030739E7
Source: C:\Users\user\Desktop\YcxjdYUKIb.exe	Code function: 0_2_030749F9	0_2_030749F9
Source: C:\Users\user\Desktop\YcxjdYUKIb.exe	Code function: 0_2_03073016	0_2_03073016
Source: C:\Users\user\Desktop\YcxjdYUKIb.exe	Code function: 0_2_03074022	0_2_03074022
Source: C:\Users\user\Desktop\YcxjdYUKIb.exe	Code function: 0_2_03075056	0_2_03075056
Source: C:\Users\user\Desktop\YcxjdYUKIb.exe	Code function: 0_2_03073059	0_2_03073059
Source: C:\Users\user\Desktop\YcxjdYUKIb.exe	Code function: 0_2_030740DF	0_2_030740DF
Source: C:\Users\user\Desktop\YcxjdYUKIb.exe	Code function: 0_2_030750DD	0_2_030750DD
Source: C:\Users\user\Desktop\YcxjdYUKIb.exe	Code function: 0_2_03075738	0_2_03075738
Source: C:\Users\user\Desktop\YcxjdYUKIb.exe	Code function: 0_2_03072F53	0_2_03072F53
Source: C:\Users\user\Desktop\YcxjdYUKIb.exe	Code function: 0_2_03075F51	0_2_03075F51
Source: C:\Users\user\Desktop\YcxjdYUKIb.exe	Code function: 0_2_03075763	0_2_03075763
Source: C:\Users\user\Desktop\YcxjdYUKIb.exe	Code function: 0_2_03075F60	0_2_03075F60
Source: C:\Users\user\Desktop\YcxjdYUKIb.exe	Code function: 0_2_0307376C	0_2_0307376C
Source: C:\Users\user\Desktop\YcxjdYUKIb.exe	Code function: 0_2_03072F7B	0_2_03072F7B
Source: C:\Users\user\Desktop\YcxjdYUKIb.exe	Code function: 0_2_03073797	0_2_03073797
Source: C:\Users\user\Desktop\YcxjdYUKIb.exe	Code function: 0_2_03072F9E	0_2_03072F9E
Source: C:\Users\user\Desktop\YcxjdYUKIb.exe	Code function: 0_2_03073F98	0_2_03073F98
Source: C:\Users\user\Desktop\YcxjdYUKIb.exe	Code function: 0_2_03072FB3	0_2_03072FB3
Source: C:\Users\user\Desktop\YcxjdYUKIb.exe	Code function: 0_2_030737C0	0_2_030737C0
Source: C:\Users\user\Desktop\YcxjdYUKIb.exe	Code function: 0_2_03074FD6	0_2_03074FD6
Source: C:\Users\user\Desktop\YcxjdYUKIb.exe	Code function: 0_2_030757DB	0_2_030757DB
Source: C:\Users\user\Desktop\YcxjdYUKIb.exe	Code function: 0_2_0307463F	0_2_0307463F
Source: C:\Users\user\Desktop\YcxjdYUKIb.exe	Code function: 0_2_03074E47	0_2_03074E47
Source: C:\Users\user\Desktop\YcxjdYUKIb.exe	Code function: 0_2_03073687	0_2_03073687
Source: C:\Users\user\Desktop\YcxjdYUKIb.exe	Code function: 0_2_03074695	0_2_03074695
Source: C:\Users\user\Desktop\YcxjdYUKIb.exe	Code function: 0_2_03073EA2	0_2_03073EA2
Source: C:\Users\user\Desktop\YcxjdYUKIb.exe	Code function: 0_2_030756F0	0_2_030756F0
Source: C:\Users\user\Desktop\YcxjdYUKIb.exe	Code function: 0_2_0307450E	0_2_0307450E
Source: C:\Users\user\Desktop\YcxjdYUKIb.exe	Code function: 0_2_03073D26	0_2_03073D26
Source: C:\Users\user\Desktop\YcxjdYUKIb.exe	Code function: 0_2_03075590	0_2_03075590
Source: C:\Users\user\Desktop\YcxjdYUKIb.exe	Code function: 0_2_030745C2	0_2_030745C2
Source: C:\Users\user\Desktop\YcxjdYUKIb.exe	Code function: 0_2_0307340B	0_2_0307340B
Source: C:\Users\user\Desktop\YcxjdYUKIb.exe	Code function: 0_2_03074C17	0_2_03074C17
Source: C:\Users\user\Desktop\YcxjdYUKIb.exe	Code function: 0_2_03074413	0_2_03074413
Source: C:\Users\user\Desktop\YcxjdYUKIb.exe	Code function: 0_2_03074C42	0_2_03074C42
Source: C:\Users\user\Desktop\YcxjdYUKIb.exe	Code function: 0_2_03073CA3	0_2_03073CA3
Source: C:\Users\user\Desktop\YcxjdYUKIb.exe	Code function: 0_2_03073CF8	0_2_03073CF8
Source: C:\Users\user\Desktop\YcxjdYUKIb.exe	Code function: 0_2_030754F8	0_2_030754F8
Source: C:\Users\user\Desktop\YcxjdYUKIb.exe	Code function: 0_2_0309F330	0_2_0309F330
Source: C:\Users\user\Desktop\YcxjdYUKIb.exe	Code function: 0_2_0309F690	0_2_0309F690

Source: YcxjdYUKIb.exe, 00000000.00000000.1758998167.0000000000C66000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenameTdpmxs.exe" vs YcxjdYUKIb.exe
Source: YcxjdYUKIb.exe, 00000000.00000002.4203615434.0000000005690000.00000004.08000000.00040000.00000000.sdmp	Binary or memory string: OriginalFilenameNkgaeiqqr.dll" vs YcxjdYUKIb.exe
Source: YcxjdYUKIb.exe, 00000000.00000002.4199502795.000000000125E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameclr.dllT vs YcxjdYUKIb.exe
Source: YcxjdYUKIb.exe, 00000000.00000002.4202756530.00000000041B8000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameNkgaeiqqr.dll" vs YcxjdYUKIb.exe
Source: YcxjdYUKIb.exe, 00000000.00000002.4200579501.0000000003104000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameNkgaeiqqr.dll" vs YcxjdYUKIb.exe
Source: YcxjdYUKIb.exe, 00000000.00000002.4200579501.00000000030F1000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilename vs YcxjdYUKIb.exe
Source: YcxjdYUKIb.exe	Binary or memory string: OriginalFilenameTdpmxs.exe" vs YcxjdYUKIb.exe

Source: YcxjdYUKIb.exe

Static PE information: EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE

Source: YcxjdYUKIb.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: YcxjdYUKIb.exe, oF7eu0nSr0VgyP7Zh2F.cs	Cryptographic APIs: 'CreateDecryptor'
Source: YcxjdYUKIb.exe, oF7eu0nSr0VgyP7Zh2F.cs	Cryptographic APIs: 'CreateDecryptor'
Source: YcxjdYUKIb.exe, oF7eu0nSr0VgyP7Zh2F.cs	Cryptographic APIs: 'CreateDecryptor'
Source: YcxjdYUKIb.exe, oF7eu0nSr0VgyP7Zh2F.cs	Cryptographic APIs: 'CreateDecryptor'

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@1/2@0/1

Source: C:\Users\user\Desktop\YcxjdYUKIb.exe	Mutant created: NULL
Source: C:\Users\user\Desktop\YcxjdYUKIb.exe	Mutant created: \Sessions\1\BaseNamedObjects\9f7630f8991b

Source: YcxjdYUKIb.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: YcxjdYUKIb.exe

Static file information: TRID: Win32 Executable (generic) Net Framework (10011505/4) 49.83%

Source: C:\Users\user\Desktop\YcxjdYUKIb.exe

WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor

Source: C:\Users\user\Desktop\YcxjdYUKIb.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: YcxjdYUKIb.exe	Virustotal: Detection: 69%
Source: YcxjdYUKIb.exe	ReversingLabs: Detection: 55%

Source: C:\Users\user\Desktop\YcxjdYUKIb.exe

File read: C:\Users\user\Desktop\YcxjdYUKIb.exe

Jump to behavior

Source: C:\Users\user\Desktop\YcxjdYUKIb.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\Desktop\YcxjdYUKIb.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\YcxjdYUKIb.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\YcxjdYUKIb.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\YcxjdYUKIb.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\YcxjdYUKIb.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\YcxjdYUKIb.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\YcxjdYUKIb.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\YcxjdYUKIb.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\YcxjdYUKIb.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\YcxjdYUKIb.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\YcxjdYUKIb.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\YcxjdYUKIb.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\YcxjdYUKIb.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\YcxjdYUKIb.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\YcxjdYUKIb.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\YcxjdYUKIb.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\YcxjdYUKIb.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\YcxjdYUKIb.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Users\user\Desktop\YcxjdYUKIb.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\YcxjdYUKIb.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Users\user\Desktop\YcxjdYUKIb.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Users\user\Desktop\YcxjdYUKIb.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\YcxjdYUKIb.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\Desktop\YcxjdYUKIb.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Users\user\Desktop\YcxjdYUKIb.exe	Section loaded: cryptnet.dll	Jump to behavior
Source: C:\Users\user\Desktop\YcxjdYUKIb.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\YcxjdYUKIb.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\YcxjdYUKIb.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\Desktop\YcxjdYUKIb.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\YcxjdYUKIb.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Users\user\Desktop\YcxjdYUKIb.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Users\user\Desktop\YcxjdYUKIb.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Users\user\Desktop\YcxjdYUKIb.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\YcxjdYUKIb.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\Desktop\YcxjdYUKIb.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\Desktop\YcxjdYUKIb.exe	Section loaded: cabinet.dll	Jump to behavior
Source: C:\Users\user\Desktop\YcxjdYUKIb.exe	Section loaded: wbemcomn.dll	Jump to behavior

Source: C:\Users\user\Desktop\YcxjdYUKIb.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0EE7644B-1BAD-48B1-9889-0281C206EB85}\InprocServer32

Jump to behavior

Source: C:\Users\user\Desktop\YcxjdYUKIb.exe

File opened: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll

Jump to behavior

Source: YcxjdYUKIb.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR

Source: YcxjdYUKIb.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Data Obfuscation

.NET source code contains method to dynamically call methods (often used by packers)

Source: YcxjdYUKIb.exe, oF7eu0nSr0VgyP7Zh2F.cs

.Net Code: Type.GetTypeFromHandle(cvZxcIoxKjj6VUhN9SL.mwS4yYfiHC(16777287)).GetMethod("GetDelegateForFunctionPointer", new Type[2]{Type.GetTypeFromHandle(cvZxcIoxKjj6VUhN9SL.mwS4yYfiHC(16777256)),Type.GetTypeFromHandle(cvZxcIoxKjj6VUhN9SL.mwS4yYfiHC(16777255))})

Source: YcxjdYUKIb.exe

Static PE information: 0x8FFF4003 [Sun Jul 22 10:59:15 2046 UTC]

Source: C:\Users\user\Desktop\YcxjdYUKIb.exe	Code function: 0_2_01634E07 push ebx; ret		0_2_01634E0A
Source: C:\Users\user\Desktop\YcxjdYUKIb.exe	Code function: 0_2_03071390 pushad ; ret		0_2_03071391

Source: YcxjdYUKIb.exe

Static PE information: section name: .text entropy: 7.64998562736955

Source: YcxjdYUKIb.exe, -Module--601f55d4-2c52-4332-b0ef-031246df2917-.cs	High entropy of concatenated method names: 'd90a6e52c881e44fd8db93dbcc5be2457', 'LogLocalRole', 'ChangeComparator', 'DHiIh1vOMYZQuH6Kq6k', 'EJNDVjvRM2Yix69ZWOR', 'GNyWomvYAy9pD1b8V35', 'eMtxJCvEob7gkmTvUe1', 'UqM7tlv77oA7EkJRA3S'
Source: YcxjdYUKIb.exe, tJF0gAAM5r96fnFVg4.cs	High entropy of concatenated method names: 'VHwSrpGNAF', 'LRWS99NydQ', 'bUVSLKqjpN7NhV4Datm', 'l7yOCOqkH1cwBHQEmHX', 'BD3VtHqRkWYrY3Jturm', 'kct33HqYpg3KBKTWn2C', 'NINU5KqE48YyFV3vW9b', 'W7lSlYIloD', 'Y1oBcjqLXDnpsZsPCu5', 'ge4UZtqpsSGl5wUCSK0'
Source: YcxjdYUKIb.exe, oF7eu0nSr0VgyP7Zh2F.cs	High entropy of concatenated method names: 'u3pBZ3vZdDje1wsvNyS', 'zJy3vXvs1iPfrxkBt14', 'Y6QoHCwQGO', 'aKMNPgvQHYNWff6TPQ0', 'y5ZSLnvhDPItX3PTU1Z', 'DaBrivv1u2YHALLXfuN', 'yWdD62viPF1QCTfR8pV', 'Bt7hPKvtt6ZLp9gItq3', 'm9FX2evdhnMa898t6yB', 'nW4lBacjpc'

Source: C:\Users\user\Desktop\YcxjdYUKIb.exe	Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot			Jump to behavior
Source: C:\Users\user\Desktop\YcxjdYUKIb.exe	Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT			Jump to behavior

Source: C:\Users\user\Desktop\YcxjdYUKIb.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\YcxjdYUKIb.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\YcxjdYUKIb.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\YcxjdYUKIb.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\YcxjdYUKIb.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\YcxjdYUKIb.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\YcxjdYUKIb.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\YcxjdYUKIb.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\YcxjdYUKIb.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\YcxjdYUKIb.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\YcxjdYUKIb.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\YcxjdYUKIb.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\YcxjdYUKIb.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\YcxjdYUKIb.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\YcxjdYUKIb.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\YcxjdYUKIb.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\YcxjdYUKIb.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\YcxjdYUKIb.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\YcxjdYUKIb.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\YcxjdYUKIb.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\YcxjdYUKIb.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\YcxjdYUKIb.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\YcxjdYUKIb.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\YcxjdYUKIb.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\YcxjdYUKIb.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\YcxjdYUKIb.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\YcxjdYUKIb.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\YcxjdYUKIb.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\YcxjdYUKIb.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\YcxjdYUKIb.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\YcxjdYUKIb.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\YcxjdYUKIb.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\YcxjdYUKIb.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\YcxjdYUKIb.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\YcxjdYUKIb.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\YcxjdYUKIb.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\YcxjdYUKIb.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\YcxjdYUKIb.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\YcxjdYUKIb.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\YcxjdYUKIb.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\YcxjdYUKIb.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\YcxjdYUKIb.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\YcxjdYUKIb.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\YcxjdYUKIb.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\YcxjdYUKIb.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\YcxjdYUKIb.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\YcxjdYUKIb.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\YcxjdYUKIb.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\YcxjdYUKIb.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\YcxjdYUKIb.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\YcxjdYUKIb.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\YcxjdYUKIb.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\YcxjdYUKIb.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\YcxjdYUKIb.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\YcxjdYUKIb.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\YcxjdYUKIb.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\YcxjdYUKIb.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Queries memory information (via WMI often done to detect virtual machines)

Source: C:\Users\user\Desktop\YcxjdYUKIb.exe

WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_PhysicalMemory

Queries sensitive Plug and Play Device Information (via WMI, Win32_PnPEntity, often done to detect virtual machines)

Source: C:\Users\user\Desktop\YcxjdYUKIb.exe

WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')

Queries sensitive disk information (via WMI, Win32_DiskDrive, often done to detect virtual machines)

Source: C:\Users\user\Desktop\YcxjdYUKIb.exe

WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_DiskDrive

Queries sensitive physical memory information (via WMI, Win32_PhysicalMemory, often done to detect virtual machines)

Source: C:\Users\user\Desktop\YcxjdYUKIb.exe

WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_PhysicalMemory

Source: C:\Users\user\Desktop\YcxjdYUKIb.exe	Memory allocated: 15F0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\YcxjdYUKIb.exe	Memory allocated: 30F0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\YcxjdYUKIb.exe	Memory allocated: 2F50000 memory reserve \| memory write watch	Jump to behavior

Source: C:\Users\user\Desktop\YcxjdYUKIb.exe

Thread delayed: delay time: 922337203685477

Jump to behavior

Source: C:\Users\user\Desktop\YcxjdYUKIb.exe	Window / User API: threadDelayed 2197			Jump to behavior
Source: C:\Users\user\Desktop\YcxjdYUKIb.exe	Window / User API: threadDelayed 7636			Jump to behavior

Source: C:\Users\user\Desktop\YcxjdYUKIb.exe TID: 6656	Thread sleep time: -30000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\YcxjdYUKIb.exe TID: 6528	Thread sleep time: -26747778906878833s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\YcxjdYUKIb.exe TID: 6528	Thread sleep time: -31000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\YcxjdYUKIb.exe TID: 2656	Thread sleep count: 2197 > 30	Jump to behavior
Source: C:\Users\user\Desktop\YcxjdYUKIb.exe TID: 6528	Thread sleep time: -30875s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\YcxjdYUKIb.exe TID: 2656	Thread sleep count: 7636 > 30	Jump to behavior
Source: C:\Users\user\Desktop\YcxjdYUKIb.exe TID: 6528	Thread sleep time: -30749s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\YcxjdYUKIb.exe TID: 6528	Thread sleep time: -30641s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\YcxjdYUKIb.exe TID: 6528	Thread sleep time: -30516s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\YcxjdYUKIb.exe TID: 6528	Thread sleep time: -30391s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\YcxjdYUKIb.exe TID: 6528	Thread sleep time: -30281s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\YcxjdYUKIb.exe TID: 6528	Thread sleep time: -30172s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\YcxjdYUKIb.exe TID: 6528	Thread sleep time: -30063s >= -30000s	Jump to behavior

Source: C:\Users\user\Desktop\YcxjdYUKIb.exe

WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor

Source: C:\Users\user\Desktop\YcxjdYUKIb.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\Desktop\YcxjdYUKIb.exe	Thread delayed: delay time: 31000	Jump to behavior
Source: C:\Users\user\Desktop\YcxjdYUKIb.exe	Thread delayed: delay time: 30875	Jump to behavior
Source: C:\Users\user\Desktop\YcxjdYUKIb.exe	Thread delayed: delay time: 30749	Jump to behavior
Source: C:\Users\user\Desktop\YcxjdYUKIb.exe	Thread delayed: delay time: 30641	Jump to behavior
Source: C:\Users\user\Desktop\YcxjdYUKIb.exe	Thread delayed: delay time: 30516	Jump to behavior
Source: C:\Users\user\Desktop\YcxjdYUKIb.exe	Thread delayed: delay time: 30391	Jump to behavior
Source: C:\Users\user\Desktop\YcxjdYUKIb.exe	Thread delayed: delay time: 30281	Jump to behavior
Source: C:\Users\user\Desktop\YcxjdYUKIb.exe	Thread delayed: delay time: 30172	Jump to behavior
Source: C:\Users\user\Desktop\YcxjdYUKIb.exe	Thread delayed: delay time: 30063	Jump to behavior

Source: YcxjdYUKIb.exe, 00000000.00000002.4204301957.00000000058F0000.00000004.00000020.00020000.00000000.sdmp, YcxjdYUKIb.exe, 00000000.00000002.4204386609.00000000059D3000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: YcxjdYUKIb.exe, 00000000.00000002.4204386609.000000000599A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWL

Source: C:\Users\user\Desktop\YcxjdYUKIb.exe

Process token adjusted: Debug

Jump to behavior

Source: C:\Users\user\Desktop\YcxjdYUKIb.exe

Memory allocated: page read and write | page guard

Jump to behavior

HIPS / PFW / Operating System Protection Evasion

Detected PureCrypter Trojan

Source: YcxjdYUKIb.exe, 00000000.00000002.4200579501.000000000314A000.00000004.00000800.00020000.00000000.sdmp

String found in binary or memory: 139.99.188.124MIIE4jCCAsqgAwIBAgIQAOKtuPSNgQ5jCdoOiEhUFzANBgkqhkiG9w0BAQ0FADASMRAwDgYDVQQDDAdUbnJ3ZHh1MCAXDTI0MTEwNjA2MzQxM1oYDzk5OTkxMjMxMjM1OTU5WjASMRAwDgYDVQQDDAdUbnJ3ZHh1MIICIjANBgkqhkiG9w0BAQEFAAOCAg8AMIICCgKCAgEAiKcmrI8LFgmCe13nb4a4WIIPuGRjrh3hSLtwJa9x7FR2ocSRANQvNTNjlXosIQ4ub2AK83eY3gZZbUNUKmM7/H/XHGMnTdmND2UE6J/maceV0lN6RoIaOWvq4nWRD00l7KxixDp67UMkTjx+85dy2+fVDE/aum+gH0dXx9OLnLxgnQ8pSXtj24liQgzBoKu0TIPFA9N3IxCpkOmc4yuQ+LwXHhjaCcOfxdYxA/riap7GNXLoj+8d/HNKLjlY/fiPC5rgS6JaJJv0W6TjW3Ft1JmJM1J8E+S8dtfLdtcOhIfK+eZ68EpFBB0DJtoLJSs2+Yd/kuZwjnBVRDVGwuHtA6MmRg4Fd/Jg+UKTt9uBB76KCQDlr43+vs1czB4Njagw8Ml2q67xiP68Pts4UXKtjS6F8BFbEOCv6fFmTLnrBmSUb4YKuJxTNkXqjPdbbxMM8vnR63vvxMHvTcfNZoBusX8eNdsu5aiTWE5u302GFoEM/DOEYSMzOro5+a50o3KQsHg+1t+72sqNii1SPDXTEbH2mnGnB3RHsgCYnRdSCzsWJV/9PHF7re8KBeEZnwP7WNaYcNIDmLruOCegtC00/RSJAsX8PbtR7o531bzyBbFuv/TzSjl1xefr8eoWBVw3EbJCf6AB7W6a5//+mJ7aYc30TGlKf49/3pYDiYhlph0CAwEAAaMyMDAwHQYDVR0OBBYEFC+ALuS3WAn1ELBjCv8Jss13aD9YMA8GA1UdEwEB/wQFMAMBAf8wDQYJKoZIhvcNAQENBQADggIBAFIUJJQ7zsWwRotcJFmRLxnzYq5bHi2Ieaf2G+c2DY1ml+Y2ndrKyPNpjXi5wYRW3Ek2i6VSRXOK4vEjsYsE3itqUVkykHf2LLK1aBVDpcqlnW5J9CipicYGJDrpjZd4UllzPHWE0ZLxo3oehluivb5bVMeDDll5kHIrv6SVzX3KZxYEW0j0YNwdzts3hsBU0KnJ+KdAuF/dnYXVV0hHdAa0cmnac98F4Q1nvu5Nq5Ipn5OJL4LsevooljnqoEJKWc0QNrWYE6xmei1bdo9727HVoIwg6blt6rHHjXqpERvexHfqilA/HZ9eGfshPczDPofzSB03V5uFq5If3xMtHbXTXdW0qTJrojme+l/pyDd3kQTG73giZKI8uLVh4MIXlX2tfPfYAzl2UfUkuHpI69fq0zn/k+6et55nAf25opNExyio0oUWeBmPXWTFkrakCu9937oNwPmlw6PhJvmfW48hr9N3O+PnpRpmgu5Jzd9x/0/0tFze33zB162NF11VE4QFfPzmamjdPnwrdUcpoQdnx2wMGDyj2ddwtBcWzKiB6KMiZXhHNl15KARj4pnO2aBvYupe0Df+0XvC8KncXgpBDRAuwtbVGzZAnXfgUS8lbne27I3xJWhFUEtrrRhi0bGUtiG1CKA89J+wpEb10UNP4k8hF2i5pxAN/xoXBzES"Default:BAPPDATAJ9f7630f8991b

Source: YcxjdYUKIb.exe, 00000000.00000002.4200579501.00000000033F3000.00000004.00000800.00020000.00000000.sdmp, YcxjdYUKIb.exe, 00000000.00000002.4200579501.000000000362E000.00000004.00000800.00020000.00000000.sdmp, YcxjdYUKIb.exe, 00000000.00000002.4200579501.00000000035D4000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program Manager
Source: YcxjdYUKIb.exe, 00000000.00000002.4200579501.000000000362E000.00000004.00000800.00020000.00000000.sdmp, YcxjdYUKIb.exe, 00000000.00000002.4200579501.00000000035D4000.00000004.00000800.00020000.00000000.sdmp, YcxjdYUKIb.exe, 00000000.00000002.4200579501.0000000003447000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program ManagerTefq
Source: YcxjdYUKIb.exe, 00000000.00000002.4200579501.0000000003767000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program ManagerTefqDwv
Source: YcxjdYUKIb.exe, 00000000.00000002.4200579501.0000000003471000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program ManagerTefqxAG
Source: YcxjdYUKIb.exe, 00000000.00000002.4200579501.00000000033F3000.00000004.00000800.00020000.00000000.sdmp, YcxjdYUKIb.exe, 00000000.00000002.4200579501.000000000362E000.00000004.00000800.00020000.00000000.sdmp, YcxjdYUKIb.exe, 00000000.00000002.4200579501.00000000035D4000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program Manager*
Source: YcxjdYUKIb.exe, 00000000.00000002.4200579501.00000000034BD000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program ManagerTefqP
Source: YcxjdYUKIb.exe, 00000000.00000002.4200579501.000000000355E000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program ManagerTefq0
Source: YcxjdYUKIb.exe, 00000000.00000002.4200579501.0000000003717000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program ManagerTefqDwq
Source: YcxjdYUKIb.exe, 00000000.00000002.4200579501.00000000036C7000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program ManagerTefqDwl
Source: YcxjdYUKIb.exe, 00000000.00000002.4200579501.00000000033F3000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program Managerh{fq
Source: YcxjdYUKIb.exe, 00000000.00000002.4200579501.000000000341F000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program ManagerTefqp B
Source: YcxjdYUKIb.exe, 00000000.00000002.4200579501.000000000350E000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program ManagerTefq@
Source: YcxjdYUKIb.exe, 00000000.00000002.4200579501.00000000035B0000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program ManagerTefq8%[

Source: C:\Users\user\Desktop\YcxjdYUKIb.exe	Queries volume information: C:\Users\user\Desktop\YcxjdYUKIb.exe VolumeInformation			Jump to behavior
Source: C:\Users\user\Desktop\YcxjdYUKIb.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.ServiceModel\v4.0_4.0.0.0__b77a5c561934e089\System.ServiceModel.dll VolumeInformation			Jump to behavior

Source: C:\Users\user\Desktop\YcxjdYUKIb.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Source: C:\Users\user\Desktop\YcxjdYUKIb.exe

WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : SELECT * FROM AntiVirusProduct

Stealing of Sensitive Information

Yara detected PureLog Stealer

Source: Yara match	File source: YcxjdYUKIb.exe, type: SAMPLE
Source: Yara match	File source: 0.0.YcxjdYUKIb.exe.be0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000000.1758935663.0000000000BE2000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY

Found many strings related to Crypto-Wallets (likely being stolen)

Source: YcxjdYUKIb.exe, 00000000.00000002.4200579501.000000000314A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: Electrum
Source: YcxjdYUKIb.exe, 00000000.00000002.4200579501.000000000314A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: tibnejdfjmmkpcnlpebklmnkoeoihofecuTronLinkvnkbihfbeogaeaoehlefnkodbefgpgknnwMetaMaskxfhbohimaelbohpjbbldcngcnapndodjpyBinance Chain Walletzffnbelfdoeiohenkjibnmadjiehjhajb{Yoroi\|cjelfplplebdjjenllpjcblmjkfcffne}Jaxx Liberty~fihkakfobkmkjojpchpfgcmhfjnmnfpi
Source: YcxjdYUKIb.exe, 00000000.00000002.4200579501.000000000331C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: $fq3C:\Users\user\AppData\Roaming\Exodus\exodus.wallet
Source: YcxjdYUKIb.exe, 00000000.00000002.4200579501.000000000331C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: $fq0C:\Users\user\AppData\Roaming\Ethereum\keystore
Source: YcxjdYUKIb.exe, 00000000.00000002.4200579501.000000000314A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: Exodus Web3
Source: YcxjdYUKIb.exe, 00000000.00000002.4200579501.000000000314A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: Ethereum
Source: YcxjdYUKIb.exe, 00000000.00000002.4200579501.000000000314A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: keystore

Tries to harvest and steal Bitcoin Wallet information

Source: C:\Users\user\Desktop\YcxjdYUKIb.exe

Key opened: HKEY_CURRENT_USER\Software\Bitcoin\Bitcoin-Qt

Jump to behavior

Source: Yara match	File source: 00000000.00000002.4200579501.000000000331C000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.4200579501.000000000314A000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: YcxjdYUKIb.exe PID: 3744, type: MEMORYSTR

Remote Access Functionality

Yara detected PureLog Stealer

Source: Yara match	File source: YcxjdYUKIb.exe, type: SAMPLE
Source: Yara match	File source: 0.0.YcxjdYUKIb.exe.be0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000000.1758935663.0000000000BE2000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	321 Windows Management Instrumentation	1 DLL Side-Loading	1 Process Injection	1 Disable or Modify Tools	OS Credential Dumping	1 Query Registry	Remote Services	11 Archive Collected Data	1 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	1 PowerShell	Boot or Logon Initialization Scripts	1 DLL Side-Loading	341 Virtualization/Sandbox Evasion	LSASS Memory	421 Security Software Discovery	Remote Desktop Protocol	1 Data from Local System	1 Non-Standard Port	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	1 Process Injection	Security Account Manager	1 Process Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	Steganography	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	11 Deobfuscate/Decode Files or Information	NTDS	341 Virtualization/Sandbox Evasion	Distributed Component Object Model	Input Capture	Protocol Impersonation	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	2 Obfuscated Files or Information	LSA Secrets	1 Application Window Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	12 Software Packing	Cached Domain Credentials	213 System Information Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	1 Timestomp	DCSync	Remote System Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	1 DLL Side-Loading	Proc Filesystem	System Owner/User Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
YcxjdYUKIb.exe	69%	Virustotal		Browse
YcxjdYUKIb.exe	55%	ReversingLabs	Win32.Trojan.Barys
YcxjdYUKIb.exe	100%	Avira	HEUR/AGEN.1327055
YcxjdYUKIb.exe	100%	Joe Sandbox ML

Name	IP	Active	Malicious	Antivirus Detection	Reputation
default.qdr.p1.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com	217.20.58.98	true	false		high

URLs from Memory and Binaries

Name	Source	Malicious	Reputation
https://stackoverflow.com/q/14436606/23354	YcxjdYUKIb.exe, 00000000.00000002.4200579501.000000000314A000.00000004.00000800.00020000.00000000.sdmp	false	high
https://github.com/DFfe9ewf/test3/raw/refs/heads/main/WebDriver.dll	YcxjdYUKIb.exe, 00000000.00000002.4200579501.000000000314A000.00000004.00000800.00020000.00000000.sdmp	false	high
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	YcxjdYUKIb.exe, 00000000.00000002.4200579501.000000000314A000.00000004.00000800.00020000.00000000.sdmp	false	high
https://stackoverflow.com/q/2152978/23354rCannot	YcxjdYUKIb.exe, 00000000.00000002.4200579501.000000000314A000.00000004.00000800.00020000.00000000.sdmp	false	high
https://stackoverflow.com/q/11564914/23354;	YcxjdYUKIb.exe, 00000000.00000002.4200579501.000000000314A000.00000004.00000800.00020000.00000000.sdmp	false	high
https://github.com/DFfe9ewf/test3/raw/refs/heads/main/chromedriver.exe	YcxjdYUKIb.exe, 00000000.00000002.4200579501.000000000314A000.00000004.00000800.00020000.00000000.sdmp	false	high
https://github.com/DFfe9ewf/test3/raw/refs/heads/main/msedgedriver.exe	YcxjdYUKIb.exe, 00000000.00000002.4200579501.000000000314A000.00000004.00000800.00020000.00000000.sdmp	false	high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
139.99.188.124	unknown	Canada		16276	OVHFR	true

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1577213
Start date and time:	2024-12-18 09:39:32 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 8m 1s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	5
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	YcxjdYUKIb.exe renamed because original name is a hash value
Original Sample Name:	dd6f40ba5347afaba9cf9b57ad2e9a612e7fd5d0d93ea5a80d59e43c4c58af8b.exe
Detection:	MAL
Classification:	mal100.troj.spyw.evad.winEXE@1/2@0/1
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 77% Number of executed functions: 94 Number of non-executed functions: 65
Cookbook Comments:	Found application associated with file extension: .exe Override analysis time to 240000 for current running targets taking high CPU consumption

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, WMIADAP.exe, SIHClient.exe, conhost.exe
Excluded IPs from analysis (whitelisted): 217.20.58.98, 52.149.20.212, 13.107.246.63
Excluded domains from analysis (whitelisted): ocsp.digicert.com, slscr.update.microsoft.com, otelrules.azureedge.net, ctldl.windowsupdate.com.delivery.microsoft.com, ctldl.windowsupdate.com, wu-b-net.trafficmanager.net, fe3cr.delivery.mp.microsoft.com
Not all processes where analyzed, report is missing behavior information
Report size getting too big, too many NtAllocateVirtualMemory calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtQueryValueKey calls found.

Simulations

Behavior and APIs

Time	Type	Description
03:40:44	API Interceptor	11139929x Sleep call for process: YcxjdYUKIb.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
139.99.188.124	EO3RT0fEfb.exe	Get hash	malicious	Unknown	Browse	139.99.188.124/ucZfzm.txt
	RMBOriPHVJ.exe	Get hash	malicious	Unknown	Browse	139.99.188.124/mzmLv.txt
	S6x3K8vzCA.exe	Get hash	malicious	Unknown	Browse	139.99.188.124/wPBPjuY.txt
	PPbimZI4LV.exe	Get hash	malicious	Unknown	Browse	139.99.188.124/BlQMSgJx.txt
	l5VhEpwzJy.exe	Get hash	malicious	Unknown	Browse	139.99.188.124/jiJNz.txt
	duyba.lnk.download.lnk	Get hash	malicious	Unknown	Browse	139.99.188.124/QWCheljD.txt
	pt8GJiNZDT.exe	Get hash	malicious	Unknown	Browse	139.99.188.124/QWCheljD.txt
	FwR7as4xUq.exe	Get hash	malicious	Unknown	Browse	139.99.188.124/EPDjSfs.txt

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
default.qdr.p1.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com	YF3YnL4ksc.exe	Get hash	malicious	Unknown	Browse	217.20.58.99
	#U041f#U043b#U0430#U0442i#U0436#U043d#U0430 i#U043d#U0441#U0442#U0440#U0443#U043a#U0446i#U044f.js	Get hash	malicious	SmokeLoader	Browse	217.20.58.100
	PPbimZI4LV.exe	Get hash	malicious	Unknown	Browse	217.20.58.100
	http://ngfreemessage-verifying.freewebhostmost.com/	Get hash	malicious	HTMLPhisher	Browse	217.20.58.99
	uEhN67huiV.dll	Get hash	malicious	Unknown	Browse	212.229.88.13
	JkICQ13OOY.dll	Get hash	malicious	Unknown	Browse	217.20.56.100
	V65xPrgEHH.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse	217.20.58.99
	BwQ1ZjHbt3.bat	Get hash	malicious	Unknown	Browse	217.20.57.23
	payload_1.hta	Get hash	malicious	RedLine	Browse	217.20.58.100
	69633f.msi	Get hash	malicious	Vidar	Browse	217.20.58.98

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
OVHFR	EO3RT0fEfb.exe	Get hash	malicious	Unknown	Browse	139.99.188.124
	RMBOriPHVJ.exe	Get hash	malicious	Unknown	Browse	139.99.188.124
	ToYwLfhi9B.exe	Get hash	malicious	PureCrypter, PureLog Stealer	Browse	139.99.188.124
	KE2yNJdV55.exe	Get hash	malicious	PureCrypter	Browse	139.99.188.124
	JnEZtj3vtN.exe	Get hash	malicious	PureCrypter	Browse	139.99.188.124
	uzI7DAON53.exe	Get hash	malicious	PureCrypter	Browse	139.99.188.124
	JXEsthReim.exe	Get hash	malicious	PureCrypter, PureLog Stealer	Browse	139.99.188.124
	4a5MWYOGVy.exe	Get hash	malicious	PureCrypter	Browse	139.99.188.124
	YF3YnL4ksc.exe	Get hash	malicious	Unknown	Browse	139.99.188.124
	S6x3K8vzCA.exe	Get hash	malicious	Unknown	Browse	139.99.188.124

Process:	C:\Users\user\Desktop\YcxjdYUKIb.exe
File Type:	Microsoft Cabinet archive data, Windows 2000/XP setup, 71954 bytes, 1 file, at 0x2c +A "authroot.stl", number 1, 6 datablocks, 0x1 compression
Category:	dropped
Size (bytes):	71954
Entropy (8bit):	7.996617769952133
Encrypted:	true
SSDEEP:	1536:gc257bHnClJ3v5mnAQEBP+bfnW8Ctl8G1G4eu76NWDdB34w18R5cBWcJAm68+Q:gp2ld5jPqW8LgeulxB3fgcEfDQ
MD5:	49AEBF8CBD62D92AC215B2923FB1B9F5
SHA1:	1723BE06719828DDA65AD804298D0431F6AFF976
SHA-256:	B33EFCB95235B98B48508E019AFA4B7655E80CF071DEFABD8B2123FC8B29307F
SHA-512:	BF86116B015FB56709516D686E168E7C9C68365136231CC51D0B6542AE95323A71D2C7ACEC84AAD7DCECC2E410843F6D82A0A6D51B9ACFC721A9C84FDD877B5B
Malicious:	false
Reputation:	high, very likely benign file
Preview:	MSCF............,...................I..................XaK .authroot.stl.[.i..6..CK..<Tk......4.cl!Kg..E..Y.f_..".$mR"$.J.E.KB."..rKv.."{.g....3.W.....c..9.s...=....y6#..x..........D......\(.#.s.!.A.......cd.c........+^.ov...n.....3BL..0.......BPUR&.X..02.q...R...J.....w.....b.vy>....-.&..(..oe."."...J9...0U.6J..\|U..S.....M.F8g...=.......p...........l.?3.J.x.G.Ep..$g..tj......)v]9(:.)W.8.Op.1Q..:.nPd........7.7..M].V F..g.....12..!7(...B.......h.RZ.......l.<.....6..Z^.`p?... .p.Gp.#.'.X..........\|!.8.....".m.49r?.I...g...8.v.....a``.g.R4.i...J8q....NFW,E.6Y....!.o5%.Y.....R..<..S9....r....WO...(.....F..Q=....-..7d..O(....-..+k.........K..........{Q....Z..j._.E...QZ.~.\.^......N.9.k..O.}dD.b1r...[}/....T..E..G..c.\|.c.&>?..^t. ..;..X.d.E.0G....[Q.,......#.Dp..L.o\|#syc.J............}G-.ou6.=52..XWi=...m.....^u......c..fc?&pR7S5....I...j.G........j.j..Tc.El.....B.pQ.,Bp....j...9g.. >..s..m#.Nb.o_u.M.V...........\#...v..Mo\sF..s....Y...

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506

Download File

Process:	C:\Users\user\Desktop\YcxjdYUKIb.exe
File Type:	data
Category:	dropped
Size (bytes):	328
Entropy (8bit):	3.1302776811683923
Encrypted:	false
SSDEEP:	6:kKnJ9UswDLL+N+SkQlPlEGYRMY9z+4KlDA3RUebT3:P4DnLNkPlE99SNxAhUe/3
MD5:	58C3E17A5E7E1D63E85D346BB74EAA7A
SHA1:	EC552A3C7CDEB97E4E7EDFE83406765B67C5DF05
SHA-256:	FCF094E169E0913B3B4C8F80828E1A64479C0535E6E3F00D4A7222269CF0DE91
SHA-512:	0D412AAD682A08870679A1712EF2962C033EA6321FA38BE342C91CE56DE0671591D39F593519B18925A5486B793C9BC8EA82E67185D87C4F9B36B1696ED84FE2
Malicious:	false
Reputation:	low
Preview:	p...... ........d-.(Q..(....................................................... ........G..@.......&...............h.t.t.p.:././.c.t.l.d.l...w.i.n.d.o.w.s.u.p.d.a.t.e...c.o.m./.m.s.d.o.w.n.l.o.a.d./.u.p.d.a.t.e./.v.3./.s.t.a.t.i.c./.t.r.u.s.t.e.d.r./.e.n./.a.u.t.h.r.o.o.t.s.t.l...c.a.b...".a.7.2.8.2.e.b.4.0.b.1.d.a.1.:.0."...

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Entropy (8bit):	7.637926592050706
TrID:	Win32 Executable (generic) Net Framework (10011505/4) 49.83% Win32 Executable (generic) a (10002005/4) 49.78% Generic CIL Executable (.NET, Mono, etc.) (73296/58) 0.36% Generic Win/DOS Executable (2004/3) 0.01% DOS Executable Generic (2002/1) 0.01%
File name:	YcxjdYUKIb.exe
File size:	538'624 bytes
MD5:	e89c4510fd982d44f3b6c4d4671d50fd
SHA1:	b5f45fc5723466fb2c0ef4aa55453408c9bd022b
SHA256:	dd6f40ba5347afaba9cf9b57ad2e9a612e7fd5d0d93ea5a80d59e43c4c58af8b
SHA512:	e4c2d08e77ffd7c13e0534ebf6cbe4174f50fb059988b4a6b8fc6b9f5db0c5dd1f16ee55c5cb90c0707dcc7cddf0d3d42627f112b6995d0e51b5d5caa16d57f4
SSDEEP:	6144:fGat1v6OW/Ib6ZMqokt4+jhyUStzSUOdO5BCMx62pSa6N7vZoDmHS4WhA0Go8BBx:fJAOrkt4+UUf0CMBWGSy4GD8wCgq
TLSH:	73B4D03F22A75F22C21D1974C9EF46104BF3DB8B7A37DB853E4512996D023E68E866C4
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....@................0..............M... ...`....@.. ....................................@................................

File Icon


Icon Hash:	90cececece8e8eb0

Static PE Info

General

Entrypoint:	0x484d8e
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
Time Stamp:	0x8FFF4003 [Sun Jul 22 10:59:15 2046 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:	f34d5f2d4577ed6d9ceec516c1f5a744

Entrypoint Preview

Instruction
jmp dword ptr [00402000h]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x84d40	0x4b	.text
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x86000	0x560	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x88000	0xc	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x2000	0x8	.text
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x2008	0x48	.text

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x2000	0x82d94	0x82e00	2dc3f87458032191e4c41ef45cf55aea	False	0.8335515908548233	data	7.64998562736955	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rsrc	0x86000	0x560	0x600	64dadad36679409cedf2bd74b66c9e80	False	0.3990885416666667	data	3.9149661951548707	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.reloc	0x88000	0xc	0x200	fde373e73c23b7440a006aa5b70a20d5	False	0.044921875	data	0.10191042566270775	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_VERSION	0x860a0	0x2d4	data			0.4350828729281768
RT_MANIFEST	0x86374	0x1ea	XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators			0.5489795918367347

Imports

DLL	Import
mscoree.dll	_CorExeMain

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2024-12-18T09:40:42.358030+0100	2035595	ET MALWARE Generic AsyncRAT Style SSL Cert	1	139.99.188.124	56001	192.168.2.4	49730	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Dec 18, 2024 09:40:40.330415964 CET	49730	56001	192.168.2.4	139.99.188.124
Dec 18, 2024 09:40:40.450164080 CET	56001	49730	139.99.188.124	192.168.2.4
Dec 18, 2024 09:40:40.450269938 CET	49730	56001	192.168.2.4	139.99.188.124
Dec 18, 2024 09:40:40.452238083 CET	49730	56001	192.168.2.4	139.99.188.124
Dec 18, 2024 09:40:40.571728945 CET	56001	49730	139.99.188.124	192.168.2.4
Dec 18, 2024 09:40:40.571854115 CET	49730	56001	192.168.2.4	139.99.188.124
Dec 18, 2024 09:40:40.691282034 CET	56001	49730	139.99.188.124	192.168.2.4
Dec 18, 2024 09:40:42.171268940 CET	56001	49730	139.99.188.124	192.168.2.4
Dec 18, 2024 09:40:42.171400070 CET	56001	49730	139.99.188.124	192.168.2.4
Dec 18, 2024 09:40:42.171561956 CET	49730	56001	192.168.2.4	139.99.188.124
Dec 18, 2024 09:40:42.238209963 CET	49730	56001	192.168.2.4	139.99.188.124
Dec 18, 2024 09:40:42.358030081 CET	56001	49730	139.99.188.124	192.168.2.4
Dec 18, 2024 09:40:42.769444942 CET	56001	49730	139.99.188.124	192.168.2.4
Dec 18, 2024 09:40:42.808732033 CET	49730	56001	192.168.2.4	139.99.188.124
Dec 18, 2024 09:40:45.315948009 CET	49730	56001	192.168.2.4	139.99.188.124
Dec 18, 2024 09:40:45.435743093 CET	56001	49730	139.99.188.124	192.168.2.4
Dec 18, 2024 09:40:45.435822964 CET	49730	56001	192.168.2.4	139.99.188.124
Dec 18, 2024 09:40:45.556299925 CET	56001	49730	139.99.188.124	192.168.2.4
Dec 18, 2024 09:41:15.981971979 CET	49730	56001	192.168.2.4	139.99.188.124
Dec 18, 2024 09:41:16.101422071 CET	56001	49730	139.99.188.124	192.168.2.4
Dec 18, 2024 09:41:16.101505041 CET	49730	56001	192.168.2.4	139.99.188.124
Dec 18, 2024 09:41:16.220985889 CET	56001	49730	139.99.188.124	192.168.2.4
Dec 18, 2024 09:41:16.769582987 CET	56001	49730	139.99.188.124	192.168.2.4
Dec 18, 2024 09:41:16.824434042 CET	49730	56001	192.168.2.4	139.99.188.124
Dec 18, 2024 09:41:17.025590897 CET	56001	49730	139.99.188.124	192.168.2.4
Dec 18, 2024 09:41:17.032419920 CET	49730	56001	192.168.2.4	139.99.188.124
Dec 18, 2024 09:41:17.151961088 CET	56001	49730	139.99.188.124	192.168.2.4
Dec 18, 2024 09:41:17.152096987 CET	49730	56001	192.168.2.4	139.99.188.124
Dec 18, 2024 09:41:17.271631956 CET	56001	49730	139.99.188.124	192.168.2.4
Dec 18, 2024 09:41:46.981256962 CET	49730	56001	192.168.2.4	139.99.188.124
Dec 18, 2024 09:41:47.101130962 CET	56001	49730	139.99.188.124	192.168.2.4
Dec 18, 2024 09:41:47.101203918 CET	49730	56001	192.168.2.4	139.99.188.124
Dec 18, 2024 09:41:47.220793962 CET	56001	49730	139.99.188.124	192.168.2.4
Dec 18, 2024 09:41:47.767656088 CET	56001	49730	139.99.188.124	192.168.2.4
Dec 18, 2024 09:41:47.808866978 CET	49730	56001	192.168.2.4	139.99.188.124
Dec 18, 2024 09:41:48.026654005 CET	56001	49730	139.99.188.124	192.168.2.4
Dec 18, 2024 09:41:48.029160023 CET	49730	56001	192.168.2.4	139.99.188.124
Dec 18, 2024 09:41:48.148701906 CET	56001	49730	139.99.188.124	192.168.2.4
Dec 18, 2024 09:41:48.148798943 CET	49730	56001	192.168.2.4	139.99.188.124
Dec 18, 2024 09:41:48.268261909 CET	56001	49730	139.99.188.124	192.168.2.4
Dec 18, 2024 09:42:10.778101921 CET	49730	56001	192.168.2.4	139.99.188.124
Dec 18, 2024 09:42:10.897876978 CET	56001	49730	139.99.188.124	192.168.2.4
Dec 18, 2024 09:42:10.897964954 CET	49730	56001	192.168.2.4	139.99.188.124
Dec 18, 2024 09:42:11.017663956 CET	56001	49730	139.99.188.124	192.168.2.4
Dec 18, 2024 09:42:11.559325933 CET	56001	49730	139.99.188.124	192.168.2.4
Dec 18, 2024 09:42:11.605755091 CET	49730	56001	192.168.2.4	139.99.188.124
Dec 18, 2024 09:42:11.823585033 CET	56001	49730	139.99.188.124	192.168.2.4
Dec 18, 2024 09:42:11.826195002 CET	49730	56001	192.168.2.4	139.99.188.124
Dec 18, 2024 09:42:11.945696115 CET	56001	49730	139.99.188.124	192.168.2.4
Dec 18, 2024 09:42:11.945899963 CET	49730	56001	192.168.2.4	139.99.188.124
Dec 18, 2024 09:42:12.066406965 CET	56001	49730	139.99.188.124	192.168.2.4
Dec 18, 2024 09:42:17.014141083 CET	49730	56001	192.168.2.4	139.99.188.124
Dec 18, 2024 09:42:17.133912086 CET	56001	49730	139.99.188.124	192.168.2.4
Dec 18, 2024 09:42:17.134002924 CET	49730	56001	192.168.2.4	139.99.188.124
Dec 18, 2024 09:42:17.253833055 CET	56001	49730	139.99.188.124	192.168.2.4
Dec 18, 2024 09:42:17.807460070 CET	56001	49730	139.99.188.124	192.168.2.4
Dec 18, 2024 09:42:17.841260910 CET	49730	56001	192.168.2.4	139.99.188.124
Dec 18, 2024 09:42:17.960910082 CET	56001	49730	139.99.188.124	192.168.2.4
Dec 18, 2024 09:42:17.960973978 CET	49730	56001	192.168.2.4	139.99.188.124
Dec 18, 2024 09:42:18.073621035 CET	56001	49730	139.99.188.124	192.168.2.4
Dec 18, 2024 09:42:18.080574989 CET	56001	49730	139.99.188.124	192.168.2.4
Dec 18, 2024 09:42:18.080629110 CET	49730	56001	192.168.2.4	139.99.188.124
Dec 18, 2024 09:42:18.200169086 CET	56001	49730	139.99.188.124	192.168.2.4
Dec 18, 2024 09:42:18.619569063 CET	56001	49730	139.99.188.124	192.168.2.4
Dec 18, 2024 09:42:18.668265104 CET	49730	56001	192.168.2.4	139.99.188.124
Dec 18, 2024 09:42:18.886501074 CET	56001	49730	139.99.188.124	192.168.2.4
Dec 18, 2024 09:42:18.888681889 CET	49730	56001	192.168.2.4	139.99.188.124
Dec 18, 2024 09:42:19.008229017 CET	56001	49730	139.99.188.124	192.168.2.4
Dec 18, 2024 09:42:19.010214090 CET	49730	56001	192.168.2.4	139.99.188.124
Dec 18, 2024 09:42:19.129832029 CET	56001	49730	139.99.188.124	192.168.2.4
Dec 18, 2024 09:42:21.200315952 CET	49730	56001	192.168.2.4	139.99.188.124
Dec 18, 2024 09:42:21.319994926 CET	56001	49730	139.99.188.124	192.168.2.4
Dec 18, 2024 09:42:21.322202921 CET	49730	56001	192.168.2.4	139.99.188.124
Dec 18, 2024 09:42:21.441920042 CET	56001	49730	139.99.188.124	192.168.2.4
Dec 18, 2024 09:42:21.988250017 CET	56001	49730	139.99.188.124	192.168.2.4
Dec 18, 2024 09:42:22.074533939 CET	49730	56001	192.168.2.4	139.99.188.124
Dec 18, 2024 09:42:22.246762991 CET	56001	49730	139.99.188.124	192.168.2.4
Dec 18, 2024 09:42:22.250016928 CET	49730	56001	192.168.2.4	139.99.188.124
Dec 18, 2024 09:42:22.370059013 CET	56001	49730	139.99.188.124	192.168.2.4
Dec 18, 2024 09:42:22.370105028 CET	49730	56001	192.168.2.4	139.99.188.124
Dec 18, 2024 09:42:22.489978075 CET	56001	49730	139.99.188.124	192.168.2.4
Dec 18, 2024 09:42:25.246733904 CET	49730	56001	192.168.2.4	139.99.188.124
Dec 18, 2024 09:42:25.366384029 CET	56001	49730	139.99.188.124	192.168.2.4
Dec 18, 2024 09:42:25.366617918 CET	49730	56001	192.168.2.4	139.99.188.124
Dec 18, 2024 09:42:25.486650944 CET	56001	49730	139.99.188.124	192.168.2.4
Dec 18, 2024 09:42:26.810388088 CET	56001	49730	139.99.188.124	192.168.2.4
Dec 18, 2024 09:42:26.871412039 CET	49730	56001	192.168.2.4	139.99.188.124
Dec 18, 2024 09:42:27.075911999 CET	56001	49730	139.99.188.124	192.168.2.4
Dec 18, 2024 09:42:27.080229044 CET	49730	56001	192.168.2.4	139.99.188.124
Dec 18, 2024 09:42:27.199800968 CET	56001	49730	139.99.188.124	192.168.2.4
Dec 18, 2024 09:42:27.202752113 CET	49730	56001	192.168.2.4	139.99.188.124
Dec 18, 2024 09:42:27.322506905 CET	56001	49730	139.99.188.124	192.168.2.4
Dec 18, 2024 09:42:29.715749025 CET	49730	56001	192.168.2.4	139.99.188.124
Dec 18, 2024 09:42:29.835436106 CET	56001	49730	139.99.188.124	192.168.2.4
Dec 18, 2024 09:42:29.835673094 CET	49730	56001	192.168.2.4	139.99.188.124
Dec 18, 2024 09:42:29.955394030 CET	56001	49730	139.99.188.124	192.168.2.4
Dec 18, 2024 09:42:30.524528027 CET	56001	49730	139.99.188.124	192.168.2.4
Dec 18, 2024 09:42:30.668309927 CET	49730	56001	192.168.2.4	139.99.188.124
Dec 18, 2024 09:42:30.777060986 CET	56001	49730	139.99.188.124	192.168.2.4
Dec 18, 2024 09:42:30.779787064 CET	49730	56001	192.168.2.4	139.99.188.124
Dec 18, 2024 09:42:30.899463892 CET	56001	49730	139.99.188.124	192.168.2.4
Dec 18, 2024 09:42:30.899580002 CET	49730	56001	192.168.2.4	139.99.188.124
Dec 18, 2024 09:42:31.019479036 CET	56001	49730	139.99.188.124	192.168.2.4
Dec 18, 2024 09:42:31.500135899 CET	49730	56001	192.168.2.4	139.99.188.124
Dec 18, 2024 09:42:31.619854927 CET	56001	49730	139.99.188.124	192.168.2.4
Dec 18, 2024 09:42:31.620223045 CET	49730	56001	192.168.2.4	139.99.188.124
Dec 18, 2024 09:42:31.739701986 CET	56001	49730	139.99.188.124	192.168.2.4
Dec 18, 2024 09:42:32.280119896 CET	56001	49730	139.99.188.124	192.168.2.4
Dec 18, 2024 09:42:32.371474028 CET	49730	56001	192.168.2.4	139.99.188.124
Dec 18, 2024 09:42:32.542732954 CET	56001	49730	139.99.188.124	192.168.2.4
Dec 18, 2024 09:42:32.545280933 CET	49730	56001	192.168.2.4	139.99.188.124
Dec 18, 2024 09:42:32.664803982 CET	56001	49730	139.99.188.124	192.168.2.4
Dec 18, 2024 09:42:32.664872885 CET	49730	56001	192.168.2.4	139.99.188.124
Dec 18, 2024 09:42:32.784584999 CET	56001	49730	139.99.188.124	192.168.2.4
Dec 18, 2024 09:42:37.668596029 CET	49730	56001	192.168.2.4	139.99.188.124
Dec 18, 2024 09:42:37.788202047 CET	56001	49730	139.99.188.124	192.168.2.4
Dec 18, 2024 09:42:37.791759968 CET	49730	56001	192.168.2.4	139.99.188.124
Dec 18, 2024 09:42:37.911325932 CET	56001	49730	139.99.188.124	192.168.2.4
Dec 18, 2024 09:42:38.461436033 CET	56001	49730	139.99.188.124	192.168.2.4
Dec 18, 2024 09:42:38.574572086 CET	49730	56001	192.168.2.4	139.99.188.124
Dec 18, 2024 09:42:38.730246067 CET	56001	49730	139.99.188.124	192.168.2.4
Dec 18, 2024 09:42:38.738984108 CET	49730	56001	192.168.2.4	139.99.188.124
Dec 18, 2024 09:42:38.858566046 CET	56001	49730	139.99.188.124	192.168.2.4
Dec 18, 2024 09:42:38.859456062 CET	49730	56001	192.168.2.4	139.99.188.124
Dec 18, 2024 09:42:38.979089975 CET	56001	49730	139.99.188.124	192.168.2.4
Dec 18, 2024 09:42:45.204257965 CET	49730	56001	192.168.2.4	139.99.188.124
Dec 18, 2024 09:42:45.323976040 CET	56001	49730	139.99.188.124	192.168.2.4
Dec 18, 2024 09:42:45.328284025 CET	49730	56001	192.168.2.4	139.99.188.124
Dec 18, 2024 09:42:45.448112965 CET	56001	49730	139.99.188.124	192.168.2.4
Dec 18, 2024 09:42:45.994911909 CET	56001	49730	139.99.188.124	192.168.2.4
Dec 18, 2024 09:42:46.074598074 CET	49730	56001	192.168.2.4	139.99.188.124
Dec 18, 2024 09:42:46.247795105 CET	56001	49730	139.99.188.124	192.168.2.4
Dec 18, 2024 09:42:46.250309944 CET	49730	56001	192.168.2.4	139.99.188.124
Dec 18, 2024 09:42:46.369962931 CET	56001	49730	139.99.188.124	192.168.2.4
Dec 18, 2024 09:42:46.370022058 CET	49730	56001	192.168.2.4	139.99.188.124
Dec 18, 2024 09:42:46.489641905 CET	56001	49730	139.99.188.124	192.168.2.4
Dec 18, 2024 09:43:16.211127996 CET	49730	56001	192.168.2.4	139.99.188.124
Dec 18, 2024 09:43:16.330877066 CET	56001	49730	139.99.188.124	192.168.2.4
Dec 18, 2024 09:43:16.331068039 CET	49730	56001	192.168.2.4	139.99.188.124
Dec 18, 2024 09:43:16.450761080 CET	56001	49730	139.99.188.124	192.168.2.4
Dec 18, 2024 09:43:16.668915033 CET	49730	56001	192.168.2.4	139.99.188.124
Dec 18, 2024 09:43:16.788645029 CET	56001	49730	139.99.188.124	192.168.2.4
Dec 18, 2024 09:43:16.788701057 CET	49730	56001	192.168.2.4	139.99.188.124
Dec 18, 2024 09:43:16.908273935 CET	56001	49730	139.99.188.124	192.168.2.4
Dec 18, 2024 09:43:16.997684002 CET	56001	49730	139.99.188.124	192.168.2.4
Dec 18, 2024 09:43:17.043412924 CET	49730	56001	192.168.2.4	139.99.188.124
Dec 18, 2024 09:43:17.211026907 CET	56001	49730	139.99.188.124	192.168.2.4
Dec 18, 2024 09:43:17.219770908 CET	49730	56001	192.168.2.4	139.99.188.124
Dec 18, 2024 09:43:17.339363098 CET	56001	49730	139.99.188.124	192.168.2.4
Dec 18, 2024 09:43:17.339512110 CET	49730	56001	192.168.2.4	139.99.188.124
Dec 18, 2024 09:43:17.424901009 CET	56001	49730	139.99.188.124	192.168.2.4
Dec 18, 2024 09:43:17.459137917 CET	56001	49730	139.99.188.124	192.168.2.4
Dec 18, 2024 09:43:17.480922937 CET	49730	56001	192.168.2.4	139.99.188.124
Dec 18, 2024 09:43:17.684583902 CET	56001	49730	139.99.188.124	192.168.2.4
Dec 18, 2024 09:43:17.691358089 CET	49730	56001	192.168.2.4	139.99.188.124
Dec 18, 2024 09:43:17.811516047 CET	56001	49730	139.99.188.124	192.168.2.4
Dec 18, 2024 09:43:17.814373970 CET	49730	56001	192.168.2.4	139.99.188.124
Dec 18, 2024 09:43:17.933996916 CET	56001	49730	139.99.188.124	192.168.2.4
Dec 18, 2024 09:43:19.590624094 CET	49730	56001	192.168.2.4	139.99.188.124
Dec 18, 2024 09:43:19.710390091 CET	56001	49730	139.99.188.124	192.168.2.4
Dec 18, 2024 09:43:19.710545063 CET	49730	56001	192.168.2.4	139.99.188.124
Dec 18, 2024 09:43:19.830347061 CET	56001	49730	139.99.188.124	192.168.2.4
Dec 18, 2024 09:43:20.763128042 CET	56001	49730	139.99.188.124	192.168.2.4
Dec 18, 2024 09:43:20.809066057 CET	49730	56001	192.168.2.4	139.99.188.124
Dec 18, 2024 09:43:21.028536081 CET	56001	49730	139.99.188.124	192.168.2.4
Dec 18, 2024 09:43:21.030441999 CET	49730	56001	192.168.2.4	139.99.188.124
Dec 18, 2024 09:43:21.161325932 CET	56001	49730	139.99.188.124	192.168.2.4
Dec 18, 2024 09:43:21.161474943 CET	49730	56001	192.168.2.4	139.99.188.124
Dec 18, 2024 09:43:21.281229019 CET	56001	49730	139.99.188.124	192.168.2.4
Dec 18, 2024 09:43:41.234448910 CET	49730	56001	192.168.2.4	139.99.188.124
Dec 18, 2024 09:43:41.354350090 CET	56001	49730	139.99.188.124	192.168.2.4
Dec 18, 2024 09:43:41.354484081 CET	49730	56001	192.168.2.4	139.99.188.124
Dec 18, 2024 09:43:41.474123955 CET	56001	49730	139.99.188.124	192.168.2.4
Dec 18, 2024 09:43:41.934406042 CET	49730	56001	192.168.2.4	139.99.188.124
Dec 18, 2024 09:43:42.017577887 CET	56001	49730	139.99.188.124	192.168.2.4
Dec 18, 2024 09:43:42.019756079 CET	49730	56001	192.168.2.4	139.99.188.124
Dec 18, 2024 09:43:42.053980112 CET	56001	49730	139.99.188.124	192.168.2.4
Dec 18, 2024 09:43:42.054066896 CET	49730	56001	192.168.2.4	139.99.188.124
Dec 18, 2024 09:43:42.139708996 CET	56001	49730	139.99.188.124	192.168.2.4
Dec 18, 2024 09:43:42.173696995 CET	56001	49730	139.99.188.124	192.168.2.4
Dec 18, 2024 09:43:42.292706966 CET	56001	49730	139.99.188.124	192.168.2.4
Dec 18, 2024 09:43:42.370004892 CET	49730	56001	192.168.2.4	139.99.188.124
Dec 18, 2024 09:43:42.489757061 CET	56001	49730	139.99.188.124	192.168.2.4
Dec 18, 2024 09:43:42.489826918 CET	49730	56001	192.168.2.4	139.99.188.124
Dec 18, 2024 09:43:42.609443903 CET	56001	49730	139.99.188.124	192.168.2.4
Dec 18, 2024 09:43:42.723100901 CET	56001	49730	139.99.188.124	192.168.2.4
Dec 18, 2024 09:43:42.785164118 CET	49730	56001	192.168.2.4	139.99.188.124
Dec 18, 2024 09:43:42.936933041 CET	56001	49730	139.99.188.124	192.168.2.4
Dec 18, 2024 09:43:42.939661026 CET	49730	56001	192.168.2.4	139.99.188.124
Dec 18, 2024 09:43:43.059425116 CET	56001	49730	139.99.188.124	192.168.2.4
Dec 18, 2024 09:43:43.059509039 CET	49730	56001	192.168.2.4	139.99.188.124
Dec 18, 2024 09:43:43.179713011 CET	56001	49730	139.99.188.124	192.168.2.4
Dec 18, 2024 09:43:46.825335026 CET	49730	56001	192.168.2.4	139.99.188.124
Dec 18, 2024 09:43:46.945250034 CET	56001	49730	139.99.188.124	192.168.2.4
Dec 18, 2024 09:43:46.945565939 CET	49730	56001	192.168.2.4	139.99.188.124
Dec 18, 2024 09:43:47.065273046 CET	56001	49730	139.99.188.124	192.168.2.4
Dec 18, 2024 09:43:47.615391016 CET	56001	49730	139.99.188.124	192.168.2.4
Dec 18, 2024 09:43:47.676935911 CET	49730	56001	192.168.2.4	139.99.188.124
Dec 18, 2024 09:43:47.872266054 CET	56001	49730	139.99.188.124	192.168.2.4
Dec 18, 2024 09:43:47.876570940 CET	49730	56001	192.168.2.4	139.99.188.124
Dec 18, 2024 09:43:47.996170044 CET	56001	49730	139.99.188.124	192.168.2.4
Dec 18, 2024 09:43:48.002770901 CET	49730	56001	192.168.2.4	139.99.188.124
Dec 18, 2024 09:43:48.122595072 CET	56001	49730	139.99.188.124	192.168.2.4
Dec 18, 2024 09:43:54.559777975 CET	49730	56001	192.168.2.4	139.99.188.124
Dec 18, 2024 09:43:54.679676056 CET	56001	49730	139.99.188.124	192.168.2.4
Dec 18, 2024 09:43:54.679747105 CET	49730	56001	192.168.2.4	139.99.188.124
Dec 18, 2024 09:43:54.799428940 CET	56001	49730	139.99.188.124	192.168.2.4
Dec 18, 2024 09:43:55.340529919 CET	56001	49730	139.99.188.124	192.168.2.4
Dec 18, 2024 09:43:55.387295961 CET	49730	56001	192.168.2.4	139.99.188.124
Dec 18, 2024 09:43:55.591989994 CET	56001	49730	139.99.188.124	192.168.2.4
Dec 18, 2024 09:43:55.594083071 CET	49730	56001	192.168.2.4	139.99.188.124
Dec 18, 2024 09:43:55.713850021 CET	56001	49730	139.99.188.124	192.168.2.4
Dec 18, 2024 09:43:55.716355085 CET	49730	56001	192.168.2.4	139.99.188.124
Dec 18, 2024 09:43:55.836072922 CET	56001	49730	139.99.188.124	192.168.2.4
Dec 18, 2024 09:43:59.700326920 CET	49730	56001	192.168.2.4	139.99.188.124
Dec 18, 2024 09:43:59.820694923 CET	56001	49730	139.99.188.124	192.168.2.4
Dec 18, 2024 09:43:59.820859909 CET	49730	56001	192.168.2.4	139.99.188.124
Dec 18, 2024 09:43:59.940736055 CET	56001	49730	139.99.188.124	192.168.2.4
Dec 18, 2024 09:44:00.493736029 CET	56001	49730	139.99.188.124	192.168.2.4
Dec 18, 2024 09:44:00.635637999 CET	49730	56001	192.168.2.4	139.99.188.124
Dec 18, 2024 09:44:00.747720957 CET	56001	49730	139.99.188.124	192.168.2.4
Dec 18, 2024 09:44:00.749520063 CET	49730	56001	192.168.2.4	139.99.188.124
Dec 18, 2024 09:44:00.869203091 CET	56001	49730	139.99.188.124	192.168.2.4
Dec 18, 2024 09:44:00.869271994 CET	49730	56001	192.168.2.4	139.99.188.124
Dec 18, 2024 09:44:00.988976002 CET	56001	49730	139.99.188.124	192.168.2.4
Dec 18, 2024 09:44:05.700330019 CET	49730	56001	192.168.2.4	139.99.188.124
Dec 18, 2024 09:44:05.820363998 CET	56001	49730	139.99.188.124	192.168.2.4
Dec 18, 2024 09:44:05.820600033 CET	49730	56001	192.168.2.4	139.99.188.124
Dec 18, 2024 09:44:05.940291882 CET	56001	49730	139.99.188.124	192.168.2.4
Dec 18, 2024 09:44:06.487421036 CET	56001	49730	139.99.188.124	192.168.2.4
Dec 18, 2024 09:44:06.527932882 CET	49730	56001	192.168.2.4	139.99.188.124
Dec 18, 2024 09:44:06.748748064 CET	56001	49730	139.99.188.124	192.168.2.4
Dec 18, 2024 09:44:06.751198053 CET	49730	56001	192.168.2.4	139.99.188.124
Dec 18, 2024 09:44:06.871001959 CET	56001	49730	139.99.188.124	192.168.2.4
Dec 18, 2024 09:44:06.871083975 CET	49730	56001	192.168.2.4	139.99.188.124
Dec 18, 2024 09:44:06.990758896 CET	56001	49730	139.99.188.124	192.168.2.4
Dec 18, 2024 09:44:13.231484890 CET	49730	56001	192.168.2.4	139.99.188.124
Dec 18, 2024 09:44:13.351397038 CET	56001	49730	139.99.188.124	192.168.2.4
Dec 18, 2024 09:44:13.354423046 CET	49730	56001	192.168.2.4	139.99.188.124
Dec 18, 2024 09:44:13.474040985 CET	56001	49730	139.99.188.124	192.168.2.4
Dec 18, 2024 09:44:14.010888100 CET	56001	49730	139.99.188.124	192.168.2.4
Dec 18, 2024 09:44:14.060369015 CET	49730	56001	192.168.2.4	139.99.188.124
Dec 18, 2024 09:44:14.279486895 CET	56001	49730	139.99.188.124	192.168.2.4
Dec 18, 2024 09:44:14.281795979 CET	49730	56001	192.168.2.4	139.99.188.124
Dec 18, 2024 09:44:14.401366949 CET	56001	49730	139.99.188.124	192.168.2.4
Dec 18, 2024 09:44:14.401437998 CET	49730	56001	192.168.2.4	139.99.188.124
Dec 18, 2024 09:44:14.521110058 CET	56001	49730	139.99.188.124	192.168.2.4
Dec 18, 2024 09:44:18.247147083 CET	49730	56001	192.168.2.4	139.99.188.124
Dec 18, 2024 09:44:18.366897106 CET	56001	49730	139.99.188.124	192.168.2.4
Dec 18, 2024 09:44:18.366980076 CET	49730	56001	192.168.2.4	139.99.188.124
Dec 18, 2024 09:44:18.486634016 CET	56001	49730	139.99.188.124	192.168.2.4
Dec 18, 2024 09:44:19.039160013 CET	56001	49730	139.99.188.124	192.168.2.4
Dec 18, 2024 09:44:19.090461016 CET	49730	56001	192.168.2.4	139.99.188.124
Dec 18, 2024 09:44:19.294971943 CET	56001	49730	139.99.188.124	192.168.2.4
Dec 18, 2024 09:44:19.297224045 CET	49730	56001	192.168.2.4	139.99.188.124
Dec 18, 2024 09:44:19.416861057 CET	56001	49730	139.99.188.124	192.168.2.4
Dec 18, 2024 09:44:19.416933060 CET	49730	56001	192.168.2.4	139.99.188.124
Dec 18, 2024 09:44:19.536559105 CET	56001	49730	139.99.188.124	192.168.2.4
Dec 18, 2024 09:44:28.876066923 CET	49730	56001	192.168.2.4	139.99.188.124
Dec 18, 2024 09:44:28.995750904 CET	56001	49730	139.99.188.124	192.168.2.4
Dec 18, 2024 09:44:28.995810032 CET	49730	56001	192.168.2.4	139.99.188.124
Dec 18, 2024 09:44:29.115770102 CET	56001	49730	139.99.188.124	192.168.2.4
Dec 18, 2024 09:44:29.663021088 CET	56001	49730	139.99.188.124	192.168.2.4
Dec 18, 2024 09:44:29.715516090 CET	49730	56001	192.168.2.4	139.99.188.124
Dec 18, 2024 09:44:29.920238972 CET	56001	49730	139.99.188.124	192.168.2.4
Dec 18, 2024 09:44:29.925982952 CET	49730	56001	192.168.2.4	139.99.188.124
Dec 18, 2024 09:44:30.045671940 CET	56001	49730	139.99.188.124	192.168.2.4
Dec 18, 2024 09:44:30.045746088 CET	49730	56001	192.168.2.4	139.99.188.124
Dec 18, 2024 09:44:30.165796995 CET	56001	49730	139.99.188.124	192.168.2.4
Dec 18, 2024 09:44:39.170002937 CET	49730	56001	192.168.2.4	139.99.188.124
Dec 18, 2024 09:44:39.290808916 CET	56001	49730	139.99.188.124	192.168.2.4
Dec 18, 2024 09:44:39.296020985 CET	49730	56001	192.168.2.4	139.99.188.124
Dec 18, 2024 09:44:39.415730953 CET	56001	49730	139.99.188.124	192.168.2.4
Dec 18, 2024 09:44:39.963107109 CET	56001	49730	139.99.188.124	192.168.2.4
Dec 18, 2024 09:44:40.010808945 CET	49730	56001	192.168.2.4	139.99.188.124
Dec 18, 2024 09:44:40.217485905 CET	56001	49730	139.99.188.124	192.168.2.4
Dec 18, 2024 09:44:40.262521029 CET	49730	56001	192.168.2.4	139.99.188.124

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Dec 18, 2024 09:40:43.024002075 CET	1.1.1.1	192.168.2.4	0x7250	No error (0)	edge.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com	default.qdr.p1.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com		CNAME (Canonical name)	IN (0x0001)	false
Dec 18, 2024 09:40:43.024002075 CET	1.1.1.1	192.168.2.4	0x7250	No error (0)	default.qdr.p1.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com		217.20.58.98	A (IP address)	IN (0x0001)	false
Dec 18, 2024 09:40:43.024002075 CET	1.1.1.1	192.168.2.4	0x7250	No error (0)	default.qdr.p1.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com		217.20.58.100	A (IP address)	IN (0x0001)	false
Dec 18, 2024 09:40:43.024002075 CET	1.1.1.1	192.168.2.4	0x7250	No error (0)	default.qdr.p1.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com		217.20.58.101	A (IP address)	IN (0x0001)	false
Dec 18, 2024 09:40:43.024002075 CET	1.1.1.1	192.168.2.4	0x7250	No error (0)	default.qdr.p1.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com		217.20.58.99	A (IP address)	IN (0x0001)	false

Target ID:	0
Start time:	03:40:33
Start date:	18/12/2024
Path:	C:\Users\user\Desktop\YcxjdYUKIb.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\YcxjdYUKIb.exe"
Imagebase:	0xbe0000
File size:	538'624 bytes
MD5 hash:	E89C4510FD982D44F3B6C4D4671D50FD
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_PureLogStealer, Description: Yara detected PureLog Stealer, Source: 00000000.00000000.1758935663.0000000000BE2000.00000002.00000001.01000000.00000003.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000000.00000002.4200579501.000000000331C000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000000.00000002.4200579501.000000000314A000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	false

Show Windows behavior

Execution Graph

Execution Coverage:	2%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	0%
Total number of Nodes:	33
Total number of Limit Nodes:	1

Executed Functions

Function 0309F690 Relevance: 8.2, Strings: 6, Instructions: 674
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

4'fq, xrefs: 0309FC69
Tefq, xrefs: 0309F9AC
xbiq, xrefs: 0309F6F1
TJkq, xrefs: 0309F9CD
TJkq, xrefs: 0309F710
pjq, xrefs: 0309FCA8

Memory Dump Source

Source File: 00000000.00000002.4200419504.0000000003090000.00000040.00000800.00020000.00000000.sdmp, Offset: 03090000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3090000_YcxjdYUKIb.jbxd

Similarity

API ID:
String ID: 4'fq$TJkq$TJkq$Tefq$pjq$xbiq
API String ID: 0-1172323477
Opcode ID: 5bce4818b5d9b3d46e732f2030d79572466e92c4f771aaa108061cc43c4ac52e
Instruction ID: 16adcc9ac1423b2916dd112a9acf1bc1ca76c6377c6b1d98f2b19995cddc9690
Opcode Fuzzy Hash: 5bce4818b5d9b3d46e732f2030d79572466e92c4f771aaa108061cc43c4ac52e
Instruction Fuzzy Hash: A0522475A00115DFDB55CF68C984E69BBB2FF88305F1981A9E50AEB272CB31EC91DB40

Function 0163A740 Relevance: 5.7, Strings: 4, Instructions: 669
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

xbiq, xrefs: 0163A7A1
pjq, xrefs: 0163AD4A
TJkq, xrefs: 0163A7D0
Tefq, xrefs: 0163AACD

Memory Dump Source

Source File: 00000000.00000002.4200087639.0000000001630000.00000040.00000800.00020000.00000000.sdmp, Offset: 01630000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1630000_YcxjdYUKIb.jbxd

Similarity

API ID:
String ID: TJkq$Tefq$pjq$xbiq
API String ID: 0-513662044
Opcode ID: 1fe311a80b69576e6fbabaf47b6c95d2d7da06eecdcf25e5ffe6438c1ad0b794
Instruction ID: 7c39892614f81dc3cf3d0c3ee252b0799935ef35310beafe62e0742fc753a091
Opcode Fuzzy Hash: 1fe311a80b69576e6fbabaf47b6c95d2d7da06eecdcf25e5ffe6438c1ad0b794
Instruction Fuzzy Hash: 31421575A00114DFDB55CFA8C984E69BBB2FF88314F1581A8E54AEB272CB31EC52DB50

Function 01630D42 Relevance: 2.7, Strings: 2, Instructions: 154
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

4'fq, xrefs: 01630DEF
4'fq, xrefs: 01630E1A

Memory Dump Source

Source File: 00000000.00000002.4200087639.0000000001630000.00000040.00000800.00020000.00000000.sdmp, Offset: 01630000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1630000_YcxjdYUKIb.jbxd

Similarity

API ID:
String ID: 4'fq$4'fq
API String ID: 0-751858264
Opcode ID: 75474311989c131797189cfdcc5d62e8807373980fa28debffffe1a524cc3e5a
Instruction ID: c5384b7662fb171ed364c7792fd5fbd064336142776f182ee59492ac178bb829
Opcode Fuzzy Hash: 75474311989c131797189cfdcc5d62e8807373980fa28debffffe1a524cc3e5a
Instruction Fuzzy Hash: BD612DB0A006058BE749DF7EE85469ABBE3FBC8300F15C53AD414AB368DF385849DB91

Function 0309F330 Relevance: 2.6, Strings: 2, Instructions: 150
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

4'fq, xrefs: 0309F3D4
4'fq, xrefs: 0309F3FF

Memory Dump Source

Source File: 00000000.00000002.4200419504.0000000003090000.00000040.00000800.00020000.00000000.sdmp, Offset: 03090000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3090000_YcxjdYUKIb.jbxd

Similarity

API ID:
String ID: 4'fq$4'fq
API String ID: 0-751858264
Opcode ID: d869185ac8d0094b91c61a60631caa85d27697d816012a0e9ff7cbeb14f8f37e
Instruction ID: 39e6b4906e64471ef33760f439574a9fab1485ca040f243e359f0e304d253e87
Opcode Fuzzy Hash: d869185ac8d0094b91c61a60631caa85d27697d816012a0e9ff7cbeb14f8f37e
Instruction Fuzzy Hash: DA512A74A01A058BD748EF6BE89069A7FF3FBD8344F14C52AD509AB268EF3818458B51

Function 01630D50 Relevance: 2.6, Strings: 2, Instructions: 149
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

4'fq, xrefs: 01630DEF
4'fq, xrefs: 01630E1A

Memory Dump Source

Source File: 00000000.00000002.4200087639.0000000001630000.00000040.00000800.00020000.00000000.sdmp, Offset: 01630000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1630000_YcxjdYUKIb.jbxd

Similarity

API ID:
String ID: 4'fq$4'fq
API String ID: 0-751858264
Opcode ID: aadc23887d00b446addfbc94f38855f949854f61a1feab4dd5828731bbbe918b
Instruction ID: 8583f0fd58873526583698ade4e7747fd4792e7a98b29690afdf364bcec0bad3
Opcode Fuzzy Hash: aadc23887d00b446addfbc94f38855f949854f61a1feab4dd5828731bbbe918b
Instruction Fuzzy Hash: EE511DB0A006058BE749DF7EE85069ABBE3FBC8300F15C539D415AB368EF385849DB91

Function 03072C40 Relevance: 2.1, Strings: 1, Instructions: 886
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

Dmq, xrefs: 03072CD5

Memory Dump Source

Source File: 00000000.00000002.4200376545.0000000003070000.00000040.00000800.00020000.00000000.sdmp, Offset: 03070000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3070000_YcxjdYUKIb.jbxd

Similarity

API ID:
String ID: Dmq
API String ID: 0-4031372824
Opcode ID: e6e22d2ebbe8e5a97a7403bc363448a752726bbb5d47102505fb013cd8efec86
Instruction ID: 64cfbd7e265074aa3bbc8ae6ae6561db17d76fc829e9fa8a38b8124f5cba0bfa
Opcode Fuzzy Hash: e6e22d2ebbe8e5a97a7403bc363448a752726bbb5d47102505fb013cd8efec86
Instruction Fuzzy Hash: C9529933A06221DFD706DF54EC80AF7B7A2FB85320B1946AAE4459B201D739BB51CBD0

Function 06470A2D Relevance: 9.4, Strings: 7, Instructions: 649
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

|>mq, xrefs: 06471289
T3zq, xrefs: 06470A34
Hlq, xrefs: 06470CFC
PHfq, xrefs: 06470FEC
4'fq, xrefs: 064712A1
PHfq, xrefs: 06470FDA
jq, xrefs: 064710E8

Memory Dump Source

Source File: 00000000.00000002.4204659629.0000000006470000.00000040.00000800.00020000.00000000.sdmp, Offset: 06470000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6470000_YcxjdYUKIb.jbxd

Similarity

API ID:
String ID: Hlq$4'fq$PHfq$PHfq$T3zq$|>mq$jq
API String ID: 0-342217750
Opcode ID: fe1b041733c6cd4f75b1c0590ee8f6841f2f2dc1a6643a00569b7f5f71c60da6
Instruction ID: a0a142782d44b25a534133dd0f85c6a37aef17bfc60340db132f9414710171b8
Opcode Fuzzy Hash: fe1b041733c6cd4f75b1c0590ee8f6841f2f2dc1a6643a00569b7f5f71c60da6
Instruction Fuzzy Hash: B9226E70A007058FDB65DF79C490A9EB7F2FF85310F24892AD4069B7A5DB75E846CB80

Function 030086A8 Relevance: 6.6, Strings: 2, Instructions: 4052COMMON

Download Yara Rule

Strings

4'fq, xrefs: 0300BFBB
4'fq, xrefs: 0300BFC7

Memory Dump Source

Source File: 00000000.00000002.4200258851.0000000003000000.00000040.00000800.00020000.00000000.sdmp, Offset: 03000000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3000000_YcxjdYUKIb.jbxd

Similarity

API ID:
String ID: 4'fq$4'fq
API String ID: 0-751858264
Opcode ID: 95507233082809f0bff59b69cb8e89175107344ceff1510a9b06bd8837eac768
Instruction ID: e5c230f267bba4ebcf049c28a50cc1a502b0f82502e80f60df111f686686f68c
Opcode Fuzzy Hash: 95507233082809f0bff59b69cb8e89175107344ceff1510a9b06bd8837eac768
Instruction Fuzzy Hash: AF63B974F036398BDBB5EB78C45426EB9E6AFC8750F18459AC906D7388EF348C418B91

Function 0647122F Relevance: 3.8, Strings: 3, Instructions: 84
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

|>mq, xrefs: 06471289
4'fq, xrefs: 064712A1
|>mq, xrefs: 06471271

Memory Dump Source

Source File: 00000000.00000002.4204659629.0000000006470000.00000040.00000800.00020000.00000000.sdmp, Offset: 06470000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6470000_YcxjdYUKIb.jbxd

Similarity

API ID:
String ID: 4'fq$|>mq$|>mq
API String ID: 0-1937412161
Opcode ID: cb5764063a950b3a2d5501875341e528ff6f6e53944268eb384926a2b6c9c0f9
Instruction ID: 0580149c0d16ce788d3935dd45243e4953bec5a24f00b2af8fed5f8390881afc
Opcode Fuzzy Hash: cb5764063a950b3a2d5501875341e528ff6f6e53944268eb384926a2b6c9c0f9
Instruction Fuzzy Hash: 0731F5706043454FC756DB29D490A9BBBD6BFC5310B18CA5EE48A8F3E1CB30D8059792

Function 06470B38 Relevance: 2.8, Strings: 2, Instructions: 346
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

Hlq, xrefs: 06470CFC
PHfq, xrefs: 06470FDA

Memory Dump Source

Source File: 00000000.00000002.4204659629.0000000006470000.00000040.00000800.00020000.00000000.sdmp, Offset: 06470000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6470000_YcxjdYUKIb.jbxd

Similarity

API ID:
String ID: Hlq$PHfq
API String ID: 0-2273861685
Opcode ID: 978e11eb9bbcdad02e7411883068b77961819d358f688e0766cb94939404bf7c
Instruction ID: 9e365b901759c200c92ca42839e14bd0238a92e721afa21fdfb1866fca08e9e2
Opcode Fuzzy Hash: 978e11eb9bbcdad02e7411883068b77961819d358f688e0766cb94939404bf7c
Instruction Fuzzy Hash: 99D14D70A007068FDB65DF79C550B9AB7F2FF84704F248A2AD4059B7A5DB74E886CB80

Function 0300C218 Relevance: 2.8, Strings: 2, Instructions: 314
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

4'fq, xrefs: 0300C5F0
4'fq, xrefs: 0300C5FC

Memory Dump Source

Source File: 00000000.00000002.4200258851.0000000003000000.00000040.00000800.00020000.00000000.sdmp, Offset: 03000000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3000000_YcxjdYUKIb.jbxd

Similarity

API ID:
String ID: 4'fq$4'fq
API String ID: 0-751858264
Opcode ID: 9879cd5635bfb773834dc72647882de6b40646f2e14b508e03b2b5293ca2d4bc
Instruction ID: c6bf5a5c9e9b4c565e04efa599866d612055b52eb93f4132fc2508707dbc7cf3
Opcode Fuzzy Hash: 9879cd5635bfb773834dc72647882de6b40646f2e14b508e03b2b5293ca2d4bc
Instruction Fuzzy Hash: B5B1C2387026058BEB99EBB8D0A413DBAE6BFD8651B14465ED807DB3D4EF34DC418782

Function 0163BF50 Relevance: 1.6, APIs: 1, Instructions: 56
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualProtect.KERNEL32(?,?,?,?), ref: 0163BFC4

Memory Dump Source

Source File: 00000000.00000002.4200087639.0000000001630000.00000040.00000800.00020000.00000000.sdmp, Offset: 01630000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1630000_YcxjdYUKIb.jbxd

Similarity

API ID: ProtectVirtual
String ID:
API String ID: 544645111-0
Opcode ID: 6a210972d166722a0b4d5d346e0bc89b3d00193ea0c4bc63f88a48a24d777324
Instruction ID: 6899c5c828cba34f3b56fae1d1fcb5f885ec8fa1abcd59a73d28b6cb3845134e
Opcode Fuzzy Hash: 6a210972d166722a0b4d5d346e0bc89b3d00193ea0c4bc63f88a48a24d777324
Instruction Fuzzy Hash: ED1124B1D002099FDB10DFAAC884A9EFBF4EF98320F10842AE519A7240C775A940CFA1

Function 06470448 Relevance: 1.4, Strings: 1, Instructions: 179
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

jq, xrefs: 064705C1

Memory Dump Source

Source File: 00000000.00000002.4204659629.0000000006470000.00000040.00000800.00020000.00000000.sdmp, Offset: 06470000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6470000_YcxjdYUKIb.jbxd

Similarity

API ID:
String ID: jq
API String ID: 0-3585635904
Opcode ID: 46eab628475460244756dff27272cc712ac809ef8dd9f69fd73f34557a8205d1
Instruction ID: 2610a270cad100e09a514becbee6185f63dc48bc468aa2c79fd657ef8d4d923e
Opcode Fuzzy Hash: 46eab628475460244756dff27272cc712ac809ef8dd9f69fd73f34557a8205d1
Instruction Fuzzy Hash: 1E513975B0120A9FCF55CFA8D8509EEBBF6FF88210B148126E915A7350DB31E911DBA1

Function 03072C30 Relevance: 1.4, Strings: 1, Instructions: 130
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

Dmq, xrefs: 03072CD5

Memory Dump Source

Source File: 00000000.00000002.4200376545.0000000003070000.00000040.00000800.00020000.00000000.sdmp, Offset: 03070000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3070000_YcxjdYUKIb.jbxd

Similarity

API ID:
String ID: Dmq
API String ID: 0-4031372824
Opcode ID: 9feb7d5cc9841250f6503de20cf7d84d2474e39b63addcef267d82971c98b7e3
Instruction ID: 915a03d5c5d9d9282547961c546d37f1c157b82b8cc31495c41b686aa29f0c49
Opcode Fuzzy Hash: 9feb7d5cc9841250f6503de20cf7d84d2474e39b63addcef267d82971c98b7e3
Instruction Fuzzy Hash: B4519070A016009FCB54DF28C494A69B7F6FF88310B55C9B9D815AB7A1DB34EC41CF94

Function 06473E98 Relevance: 1.4, Strings: 1, Instructions: 101
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

(jq, xrefs: 06473F61

Memory Dump Source

Source File: 00000000.00000002.4204659629.0000000006470000.00000040.00000800.00020000.00000000.sdmp, Offset: 06470000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6470000_YcxjdYUKIb.jbxd

Similarity

API ID:
String ID: (jq
API String ID: 0-3225323518
Opcode ID: 94cb0074b07d62349bc43ca147b71bb8f85a783f9066c0883fdbbbd36b0660f8
Instruction ID: 830a6fd9438e4850fc9e6c4bf7046d1cb3dc1bc566fa3517561f877876b33782
Opcode Fuzzy Hash: 94cb0074b07d62349bc43ca147b71bb8f85a783f9066c0883fdbbbd36b0660f8
Instruction Fuzzy Hash: C131F835B0415A9FCB41DF69D858AAF7BB2FBC9700F10416AEA08DB340DB345D058792

Function 06473090 Relevance: 1.3, Strings: 1, Instructions: 88COMMON

Download Yara Rule

Strings

Tefq, xrefs: 0647318D

Memory Dump Source

Source File: 00000000.00000002.4204659629.0000000006470000.00000040.00000800.00020000.00000000.sdmp, Offset: 06470000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6470000_YcxjdYUKIb.jbxd

Similarity

API ID:
String ID: Tefq
API String ID: 0-1066582953
Opcode ID: 6baa855f7d22ed1046e185409bce69f512011018de322a0609e28c9f4a9f696d
Instruction ID: 9cba5a9e0cf921bffdc9b31d767d53c215825a264b6b387e1269fc16260d86c1
Opcode Fuzzy Hash: 6baa855f7d22ed1046e185409bce69f512011018de322a0609e28c9f4a9f696d
Instruction Fuzzy Hash: CF3195347002459FD782AF6AD965BAE7FA2FBC9700F10841AE905AB384CF749C46DBD1

Function 06470637 Relevance: 1.3, Strings: 1, Instructions: 86COMMON

Download Yara Rule

Strings

(jq, xrefs: 0647069A

Memory Dump Source

Source File: 00000000.00000002.4204659629.0000000006470000.00000040.00000800.00020000.00000000.sdmp, Offset: 06470000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6470000_YcxjdYUKIb.jbxd

Similarity

API ID:
String ID: (jq
API String ID: 0-3225323518
Opcode ID: 769611ba0fbe9860af9ec9c17130c05db3e0ac58bfa183027f135e689bd5c18d
Instruction ID: 727a1255a691644f15c7a40530a30d566cf6a61dabc81e8ca896ddbd35a4ddc3
Opcode Fuzzy Hash: 769611ba0fbe9860af9ec9c17130c05db3e0ac58bfa183027f135e689bd5c18d
Instruction Fuzzy Hash: 49210C317093905FC746DB78842069BBFE5AF92654B19C4AFD849CF392DE368D06C3A1

Function 0300E070 Relevance: 1.3, Instructions: 1331COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4200258851.0000000003000000.00000040.00000800.00020000.00000000.sdmp, Offset: 03000000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3000000_YcxjdYUKIb.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ee983a8a9584f4a8c6637e998e3c33296e5f866c9d48aa38798136dc745bc56f
Instruction ID: 03f1a7819a545fb5dcfb77287a417fb38632c8cf607e83b12d6591e1c4f9c96e
Opcode Fuzzy Hash: ee983a8a9584f4a8c6637e998e3c33296e5f866c9d48aa38798136dc745bc56f
Instruction Fuzzy Hash: 71B29374A021168BE754EB69C85876EFBFAAFC8700F1448AE9A06972D9CF744D40CFD1

Function 06475F51 Relevance: 1.3, Strings: 1, Instructions: 62COMMON

Download Yara Rule

Strings

afq, xrefs: 06476000

Memory Dump Source

Source File: 00000000.00000002.4204659629.0000000006470000.00000040.00000800.00020000.00000000.sdmp, Offset: 06470000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6470000_YcxjdYUKIb.jbxd

Similarity

API ID:
String ID: afq
API String ID: 0-3703987390
Opcode ID: 64272609c80cca934f1b4ceb2a6677960e40e48110ddd6e81be53e1c7b80d04d
Instruction ID: b6c9452a1551f7c258437f5d7ac7e7b46a9336086d2f37dd699b157ab29050d3
Opcode Fuzzy Hash: 64272609c80cca934f1b4ceb2a6677960e40e48110ddd6e81be53e1c7b80d04d
Instruction Fuzzy Hash: B511E431A006188BC795EF7A94146AF7FF2FBC9701F00852AD9099B340DF345D468BD2

Function 06475F60 Relevance: 1.3, Strings: 1, Instructions: 58COMMON

Download Yara Rule

Strings

afq, xrefs: 06476000

Memory Dump Source

Source File: 00000000.00000002.4204659629.0000000006470000.00000040.00000800.00020000.00000000.sdmp, Offset: 06470000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6470000_YcxjdYUKIb.jbxd

Similarity

API ID:
String ID: afq
API String ID: 0-3703987390
Opcode ID: eb1693ab4855dd68b4b55027119a254ec45d581acd40b7b2fd0521d7a89fd239
Instruction ID: 1e85ef1567de40a744245d25311b15a4d012fb2764a4faa64b37e6839268c0e2
Opcode Fuzzy Hash: eb1693ab4855dd68b4b55027119a254ec45d581acd40b7b2fd0521d7a89fd239
Instruction Fuzzy Hash: 6C11B231B006188BC7A5EF6AE4156AFBBF6FBC9701F00852AD9099B384DF345D468BD1

Function 06473432 Relevance: 1.3, Strings: 1, Instructions: 58COMMON

Download Yara Rule

Strings

Tefq, xrefs: 0647345A

Memory Dump Source

Source File: 00000000.00000002.4204659629.0000000006470000.00000040.00000800.00020000.00000000.sdmp, Offset: 06470000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6470000_YcxjdYUKIb.jbxd

Similarity

API ID:
String ID: Tefq
API String ID: 0-1066582953
Opcode ID: 73ed4ebd67f5da3686735bcd95b0e64793d2548207871c07323ea0a3f67eff04
Instruction ID: 16556852c8e2a2e685347d49b9912c1a134c40c35b056113fb142e4b5402d4e1
Opcode Fuzzy Hash: 73ed4ebd67f5da3686735bcd95b0e64793d2548207871c07323ea0a3f67eff04
Instruction Fuzzy Hash: 3811C4347002595BCB169F69D4297AE7FA2EB89720F10405ADD01AB380CF751C82C7D2

Function 0300868D Relevance: 1.3, Strings: 1, Instructions: 55COMMON

Download Yara Rule

Strings

4'fq, xrefs: 0300BFBB

Memory Dump Source

Source File: 00000000.00000002.4200258851.0000000003000000.00000040.00000800.00020000.00000000.sdmp, Offset: 03000000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3000000_YcxjdYUKIb.jbxd

Similarity

API ID:
String ID: 4'fq
API String ID: 0-2007657732
Opcode ID: 7012166585c47f751eb6053981d4a429c832322f113c1bc0816613e587937e0f
Instruction ID: 2b8861770850dc3e652b2d50830d830731430dfbcd300467f47812f62ebfa40c
Opcode Fuzzy Hash: 7012166585c47f751eb6053981d4a429c832322f113c1bc0816613e587937e0f
Instruction Fuzzy Hash: C1110831E0A268CFDB2BCA64DC142BDBBB5BB81301F0504EAD641A73C1CB749C45CB55

Function 0163CA10 Relevance: 1.3, APIs: 1, Instructions: 52memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNEL32(?,?,?,?), ref: 0163CA7B

Memory Dump Source

Source File: 00000000.00000002.4200087639.0000000001630000.00000040.00000800.00020000.00000000.sdmp, Offset: 01630000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1630000_YcxjdYUKIb.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: c01e22fcddd537b3a96dcb45729db40c427c708c89d87345052458b1c4d6a02e
Instruction ID: 7fcb86d1d430822b5aaa8cfe517e5ba9a93c6c5ba71643ae9999b51aed495e86
Opcode Fuzzy Hash: c01e22fcddd537b3a96dcb45729db40c427c708c89d87345052458b1c4d6a02e
Instruction Fuzzy Hash: 231134B59003498FDB20DFAAC845BDEBFF5EF88320F24841AE519A7250C775A540DBA0

Function 06473440 Relevance: 1.3, Strings: 1, Instructions: 49COMMON

Download Yara Rule

Strings

Tefq, xrefs: 0647345A

Memory Dump Source

Source File: 00000000.00000002.4204659629.0000000006470000.00000040.00000800.00020000.00000000.sdmp, Offset: 06470000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6470000_YcxjdYUKIb.jbxd

Similarity

API ID:
String ID: Tefq
API String ID: 0-1066582953
Opcode ID: e1fe73510978090fa422f1232ee1af7514169ec2bbfc5e456e41ae21466ec31e
Instruction ID: 4e1ea75485089831f5ab8bbf616bcf5c245198b826c298378c2a9fb446565261
Opcode Fuzzy Hash: e1fe73510978090fa422f1232ee1af7514169ec2bbfc5e456e41ae21466ec31e
Instruction Fuzzy Hash: 3401A1347002199BCB1AAF69D8297AF7EA2EBC9B10F10411ADD01A7384CF791D4197D5

Function 06475FA7 Relevance: 1.3, Strings: 1, Instructions: 37COMMON

Download Yara Rule

Strings

afq, xrefs: 06476000

Memory Dump Source

Source File: 00000000.00000002.4204659629.0000000006470000.00000040.00000800.00020000.00000000.sdmp, Offset: 06470000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6470000_YcxjdYUKIb.jbxd

Similarity

API ID:
String ID: afq
API String ID: 0-3703987390
Opcode ID: 78f5273b1616401bb93917cf990f7629dbd4c2e69779c57b73d961d679d23e0f
Instruction ID: aea29ffc03a9109f82774b15cbfd3ebf1952cf5fbdf3fce57a8443f0542b232b
Opcode Fuzzy Hash: 78f5273b1616401bb93917cf990f7629dbd4c2e69779c57b73d961d679d23e0f
Instruction Fuzzy Hash: E7F0AF357006188BC265EB29A4507AE7BA3FBC4751F00491AD9065F380DF755D464BC2

Function 06471DD0 Relevance: .3, Instructions: 333COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4204659629.0000000006470000.00000040.00000800.00020000.00000000.sdmp, Offset: 06470000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6470000_YcxjdYUKIb.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b8c5019bad578759fb2fb511104f7b36e0c8438658f57f75f431cd0f930fd9be
Instruction ID: 6f4b1d2f2d044506de3c6e234b918ba1f2c8e221a31318bf5c1339d7c84862a2
Opcode Fuzzy Hash: b8c5019bad578759fb2fb511104f7b36e0c8438658f57f75f431cd0f930fd9be
Instruction Fuzzy Hash: 88E10A74A04209DFDB15CF59C584A9EBBB2FF49310F25C29AE409AB362C771E985CF80

Function 030724BB Relevance: .2, Instructions: 228COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4200376545.0000000003070000.00000040.00000800.00020000.00000000.sdmp, Offset: 03070000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3070000_YcxjdYUKIb.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 806d96456501542e5ab1bfa615102322a5521e911a82df0636ab6d1b0d376d35
Instruction ID: 23b5c735d34c0e946addef58a477280c2aac849df6e662dd4fc1d0adacaaa970
Opcode Fuzzy Hash: 806d96456501542e5ab1bfa615102322a5521e911a82df0636ab6d1b0d376d35
Instruction Fuzzy Hash: FBA18970A02205CFD754DF58D094B6AB7BBFB84310F248975D805ABB98C73DAC85CB44

Function 064715A2 Relevance: .2, Instructions: 225COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4204659629.0000000006470000.00000040.00000800.00020000.00000000.sdmp, Offset: 06470000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6470000_YcxjdYUKIb.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e4bce61d5e5e68f571108aaa0b4c6993a4594deba71ffbfed9f2d1a51107227d
Instruction ID: a533875356e3be4849382c539c7887598bafb3b84c3f170a8485dc13560f720f
Opcode Fuzzy Hash: e4bce61d5e5e68f571108aaa0b4c6993a4594deba71ffbfed9f2d1a51107227d
Instruction Fuzzy Hash: AD910934A00105DFCB65DFA9C594AAEBBF2BF88304F28856AD405AB361DB31ED46CF50

Function 0647184F Relevance: .2, Instructions: 209COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4204659629.0000000006470000.00000040.00000800.00020000.00000000.sdmp, Offset: 06470000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6470000_YcxjdYUKIb.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: eaa322907ef1e1c0caaf6d28da6bd5a3d9d1413fb2867e17c741d66528d1f1ce
Instruction ID: dde1893cf19616d683c607f92993ea3728cf5d918973edf780ac4ccc110d5f3c
Opcode Fuzzy Hash: eaa322907ef1e1c0caaf6d28da6bd5a3d9d1413fb2867e17c741d66528d1f1ce
Instruction Fuzzy Hash: 72910B34A00109CFDB95DFA5C494AAEBBB2FF88304F29856AD405AB365DB31ED46CF50

Function 0300F4CD Relevance: .2, Instructions: 198COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4200258851.0000000003000000.00000040.00000800.00020000.00000000.sdmp, Offset: 03000000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3000000_YcxjdYUKIb.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e631757c25b602e1fdbd66e827c640dd17e9735be1a1a28bf0c3644918c10604
Instruction ID: 1749485f46c231eb2f207d86e756d776fa8d0b713ebf5bf80978bc725d63b7d6
Opcode Fuzzy Hash: e631757c25b602e1fdbd66e827c640dd17e9735be1a1a28bf0c3644918c10604
Instruction Fuzzy Hash: D161B33030134287DB64EFA7E8D867BFBE6AFE4701B08853D8646C7794DF7858099651

Function 0300F4E8 Relevance: .2, Instructions: 193COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4200258851.0000000003000000.00000040.00000800.00020000.00000000.sdmp, Offset: 03000000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3000000_YcxjdYUKIb.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b51b38206d0b8ecc3e1ccb3db76b5fc87f86f2e8d5a5efc6227268904bf35829
Instruction ID: 100c35ca22e0037f461dd187a2f8d8382c6319295b3db111045b299bd1c95206
Opcode Fuzzy Hash: b51b38206d0b8ecc3e1ccb3db76b5fc87f86f2e8d5a5efc6227268904bf35829
Instruction Fuzzy Hash: 7951813030130287DBA4EFABE8D867BFBE7AFE4701B08853D964687794DF6498059651

Function 064716E1 Relevance: .1, Instructions: 109COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4204659629.0000000006470000.00000040.00000800.00020000.00000000.sdmp, Offset: 06470000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6470000_YcxjdYUKIb.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 69430530eb36c020235af8f26a81c8e1a6244266efa7ce5bd73d90d018680226
Instruction ID: 08de0cc51266a291159edf2291088a0795a7faf07f51ca540fb1d8316958ec9d
Opcode Fuzzy Hash: 69430530eb36c020235af8f26a81c8e1a6244266efa7ce5bd73d90d018680226
Instruction Fuzzy Hash: 28412C30A00209CFDB95DFA9C594BAEBBF2BF88300F248569D005AB3A5DB359D46CF50

Function 0155D3C8 Relevance: .1, Instructions: 75COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4199761645.000000000155D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0155D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_155d000_YcxjdYUKIb.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d813b17ca8d9e5567e7627ac196cb5dd40373bf5f9b5a1ef96bc2e011cb504b2
Instruction ID: 9ff9ed866d0592b1fc22f6e11b1474166065ebe0f9fdff67c6471650a7350a03
Opcode Fuzzy Hash: d813b17ca8d9e5567e7627ac196cb5dd40373bf5f9b5a1ef96bc2e011cb504b2
Instruction Fuzzy Hash: 0B2133B2104200DFDB45DF98D9C0B2ABFB5FB84324F20C96AED090F246C376E446CAA1

Function 0156D01C Relevance: .1, Instructions: 74COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4199875146.000000000156D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0156D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_156d000_YcxjdYUKIb.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5cd27833bf3a5b311af6efe33c6edc9c3bc387c50a77bbf8fe314234d0967289
Instruction ID: 4a0ddcda28ea387afbc1f4aa69cd6218c0214e8dbb2d6f9d0df529c6ce47b047
Opcode Fuzzy Hash: 5cd27833bf3a5b311af6efe33c6edc9c3bc387c50a77bbf8fe314234d0967289
Instruction Fuzzy Hash: 1F2121B5204244DFCB15DF48D9C0B2ABFB9FB84364F248969E9490F242D33AC406CAE2

Function 06471C40 Relevance: .1, Instructions: 66COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4204659629.0000000006470000.00000040.00000800.00020000.00000000.sdmp, Offset: 06470000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6470000_YcxjdYUKIb.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: eaca768465395faa1cfb2953ecd7dc1966bc5ff684ed03d6ace73c028a71aa27
Instruction ID: 2af4589b5b9dd0c2f5eee4bf7a433b1256270add6340961729175b6e47277c18
Opcode Fuzzy Hash: eaca768465395faa1cfb2953ecd7dc1966bc5ff684ed03d6ace73c028a71aa27
Instruction Fuzzy Hash: 16213330600A018FD764DF59D584A92F7E5FF84325F09CA6AE49E8BBA1C770E885CB80

Function 0156D006 Relevance: .1, Instructions: 64COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4199875146.000000000156D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0156D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_156d000_YcxjdYUKIb.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0408d2c12fb9cc6a3f2fa07b2ecbd7e25b66fd419c1812243323fef8231c2f2f
Instruction ID: 0ac4c2e94bcb25d847790f074dc9c6b5baf95d0efb595ed78ca631d4bbb27e48
Opcode Fuzzy Hash: 0408d2c12fb9cc6a3f2fa07b2ecbd7e25b66fd419c1812243323fef8231c2f2f
Instruction Fuzzy Hash: 9E21B3755093808FCB13CF24D994B16BF75FB46224F2885DAD8848F653C33AD80ACBA2

Function 0309EEA8 Relevance: .1, Instructions: 63COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4200419504.0000000003090000.00000040.00000800.00020000.00000000.sdmp, Offset: 03090000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3090000_YcxjdYUKIb.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 03a1f07c5d0f3117e89623f10548f0bd36144587f55cc491759dda88a688a93a
Instruction ID: 51fee7c31cda98cedd9657187e92c282f74688be63aa6de70606f79a2a696b1b
Opcode Fuzzy Hash: 03a1f07c5d0f3117e89623f10548f0bd36144587f55cc491759dda88a688a93a
Instruction Fuzzy Hash: 402128B0D05208EFEB44DFA8D48479DBBF6FB84304F2089AAC405AB650DB795E84DB45

Function 06471D10 Relevance: .1, Instructions: 62COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4204659629.0000000006470000.00000040.00000800.00020000.00000000.sdmp, Offset: 06470000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6470000_YcxjdYUKIb.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0912b583c5c264ec2e8ff187ed627e0ece185993a2af5db0d21fc00cd1ec6cf8
Instruction ID: 21e9170ffa861370c0299879a36f806716bf92cc69f8798ef42e6006a84c56f4
Opcode Fuzzy Hash: 0912b583c5c264ec2e8ff187ed627e0ece185993a2af5db0d21fc00cd1ec6cf8
Instruction Fuzzy Hash: C11160703042009FD765CB29D888A93BBF9EB89254B1985AAE44ACB352D731E846CF54

Function 06476231 Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4204659629.0000000006470000.00000040.00000800.00020000.00000000.sdmp, Offset: 06470000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6470000_YcxjdYUKIb.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f5ea99b5ae972eb1b97c1a1b05c00ecb4bbbb50a533c5f16fd2875013d05ba2a
Instruction ID: b6a586fd8d03a55cfe3867de7ff98c8bb1bfb9d2b888c6b672cf34168f825924
Opcode Fuzzy Hash: f5ea99b5ae972eb1b97c1a1b05c00ecb4bbbb50a533c5f16fd2875013d05ba2a
Instruction Fuzzy Hash: DB014571A086960FCF82D7BC58644EBFFB2DFC9120B2541ABCA98C3346EB318416C790

Function 0155D3C3 Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4199761645.000000000155D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0155D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_155d000_YcxjdYUKIb.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d470e05bf275f9961b8f2d54e60ae5f944f02dbb38b852c854ecf385a2209709
Instruction ID: 536cc3de9275e3caed3497b8f484db3f079eaac950172b21fbb854994484833a
Opcode Fuzzy Hash: d470e05bf275f9961b8f2d54e60ae5f944f02dbb38b852c854ecf385a2209709
Instruction Fuzzy Hash: E411DF72404240CFDB12CF54D5C4B5ABF72FB84324F24C6AADC090B656C33AE45ACBA1

Function 064711B0 Relevance: .1, Instructions: 55COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4204659629.0000000006470000.00000040.00000800.00020000.00000000.sdmp, Offset: 06470000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6470000_YcxjdYUKIb.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1b613e0e98ce55d9af8e52cda4823d2719c31db6ce31a2a45f424aab4c750429
Instruction ID: 5506237d7dae4aa3276dbe39b4c14ce7997f05ef485c6d29b55ac5c7f6241f82
Opcode Fuzzy Hash: 1b613e0e98ce55d9af8e52cda4823d2719c31db6ce31a2a45f424aab4c750429
Instruction Fuzzy Hash: F601AD387042005FC750CF69D8549BABBFAEBCA260718046AE49ACB322CA31EC01CB60

Function 0300E055 Relevance: .1, Instructions: 54COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4200258851.0000000003000000.00000040.00000800.00020000.00000000.sdmp, Offset: 03000000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3000000_YcxjdYUKIb.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9ddddabdad4b7f76e41d356c1a8e84f64cc25fbc3cef8b5756d5e443ebb0b025
Instruction ID: d37607ce11494f40e0916fe125bbd9d145338795506a54c9813392337bb65cc6
Opcode Fuzzy Hash: 9ddddabdad4b7f76e41d356c1a8e84f64cc25fbc3cef8b5756d5e443ebb0b025
Instruction Fuzzy Hash: AC11E571A0B3564FD711CB58C9506AABFB6AFC5600F0944BBC50497696CB75480887D2

Function 06476931 Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4204659629.0000000006470000.00000040.00000800.00020000.00000000.sdmp, Offset: 06470000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6470000_YcxjdYUKIb.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6a15e3559e69c5460f7370d08e617f281fcb9f6899518014c9e54f44328276e9
Instruction ID: c34389e5aae49b5da25fac6a77058835d269809356f05504ab104d098703727a
Opcode Fuzzy Hash: 6a15e3559e69c5460f7370d08e617f281fcb9f6899518014c9e54f44328276e9
Instruction Fuzzy Hash: 1D11EDB2804784CFDB12DFA9C5857CEFFF4AF59220F18848AC098EB652D2385944CBA1

Function 064711C0 Relevance: .0, Instructions: 47COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4204659629.0000000006470000.00000040.00000800.00020000.00000000.sdmp, Offset: 06470000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6470000_YcxjdYUKIb.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d1536b24dfda7533c4f2b286c59d12727b54ed664f764a1a13aa6a02d8a6bf30
Instruction ID: c60d665b861e7d18f2bf486ca914b73f26d3cd92744b2c5ef18d0c6d117e8dcd
Opcode Fuzzy Hash: d1536b24dfda7533c4f2b286c59d12727b54ed664f764a1a13aa6a02d8a6bf30
Instruction Fuzzy Hash: E4018F787002048FC7508B6AD89492AB7E6EBCD261718486AE55ACF311DA31EC018B50

Function 0155D819 Relevance: .0, Instructions: 45COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4199761645.000000000155D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0155D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_155d000_YcxjdYUKIb.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d25789d58114728db1e3a7fba636747e658ec8694f712dd05e589e73c7bfac69
Instruction ID: 7dee296f46c97da24840f006cb508bec79f3393f5a95b75ba89909121a26b204
Opcode Fuzzy Hash: d25789d58114728db1e3a7fba636747e658ec8694f712dd05e589e73c7bfac69
Instruction Fuzzy Hash: F4012BB2504340EAE7505A99CCC0B66BFF8FF41364F18C81BED0C5E192C7799840C671

Function 06473E88 Relevance: .0, Instructions: 41COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4204659629.0000000006470000.00000040.00000800.00020000.00000000.sdmp, Offset: 06470000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6470000_YcxjdYUKIb.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8037658b7df11fcc5909203c711d15624acd2182656523d1b04c5658b4e34ab3
Instruction ID: ebb92d96a61dd1c98983d4cea8a30702bfaf8954ce2a0d3150a998e15207e582
Opcode Fuzzy Hash: 8037658b7df11fcc5909203c711d15624acd2182656523d1b04c5658b4e34ab3
Instruction Fuzzy Hash: 3001A275A0824B9FCB028F69D8644AFBFB2EFC9200B14446AD944D7240E7345D018BA2

Function 06473E97 Relevance: .0, Instructions: 40COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4204659629.0000000006470000.00000040.00000800.00020000.00000000.sdmp, Offset: 06470000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6470000_YcxjdYUKIb.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 91df1f97ff4ce5b07e78fc92119f4969d3991df0fe0eaf53e43fab308cdab7cc
Instruction ID: 0b0dad21e3be303bdbfb9ad8326abe29434e4996650bb4192ac51f58586bfb05
Opcode Fuzzy Hash: 91df1f97ff4ce5b07e78fc92119f4969d3991df0fe0eaf53e43fab308cdab7cc
Instruction Fuzzy Hash: 0FF0A475B0011A9F8B01DFAAD8449EFBBB6FBC8350B104129E908D7304EB305D01CBE1

Function 030723F6 Relevance: .0, Instructions: 37COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4200376545.0000000003070000.00000040.00000800.00020000.00000000.sdmp, Offset: 03070000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3070000_YcxjdYUKIb.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8a4fb07f1b49f96c269e229bee9a67eb96e2ee8f2203888b88005b573f1127c6
Instruction ID: 0cf618cf6229753d597ecef684ddddfa078cb3a1731215f21077302ef9dee241
Opcode Fuzzy Hash: 8a4fb07f1b49f96c269e229bee9a67eb96e2ee8f2203888b88005b573f1127c6
Instruction Fuzzy Hash: 55017C34B041028FCB40DF18D06872977AAF7D8310F16C475D905AB798CA38DD4A8B90

Function 06475CD0 Relevance: .0, Instructions: 36COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4204659629.0000000006470000.00000040.00000800.00020000.00000000.sdmp, Offset: 06470000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6470000_YcxjdYUKIb.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8e589152b06e087041b6273c1575878992fb10edb47d4dc848efdab5691a11e9
Instruction ID: da34446670b5c392d3e5939f2e93b49adb5c3e82af3943aa087cf510c2ced0aa
Opcode Fuzzy Hash: 8e589152b06e087041b6273c1575878992fb10edb47d4dc848efdab5691a11e9
Instruction Fuzzy Hash: E0F0B4716081415FC757DB24E8919EB7F60EBC622070944CBE4C54F206CA11AC07CBB2

Function 0155D818 Relevance: .0, Instructions: 36COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4199761645.000000000155D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0155D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_155d000_YcxjdYUKIb.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bffe173dcc20fac10e29ee7b09d9add2e6f75649ce0063a12c2b75812d77a7d6
Instruction ID: 1e3f5854a8b6406d7c27953a1e8bbb0198b8f1102937bc57f17dbe6d1f299c04
Opcode Fuzzy Hash: bffe173dcc20fac10e29ee7b09d9add2e6f75649ce0063a12c2b75812d77a7d6
Instruction Fuzzy Hash: 50F0CD72404340AAE7618A4ADCC4B66FFA8EB81724F18C45BED0C5E286C379A840CAB0

Function 064740B8 Relevance: .0, Instructions: 32COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4204659629.0000000006470000.00000040.00000800.00020000.00000000.sdmp, Offset: 06470000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6470000_YcxjdYUKIb.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7e2bf0f19116db7a92d995629bf71df71c886f693fef29326a0d24ba496e2356
Instruction ID: c10e0aebdaf4f5172544ab95186cca5b2211e0ecbb97b8c743929416ceffce81
Opcode Fuzzy Hash: 7e2bf0f19116db7a92d995629bf71df71c886f693fef29326a0d24ba496e2356
Instruction Fuzzy Hash: 22F089321192805FC741CB20C8508E6FF61EF92214B18C8CED4944F253C722AC17DB60

Function 064729C8 Relevance: .0, Instructions: 31COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4204659629.0000000006470000.00000040.00000800.00020000.00000000.sdmp, Offset: 06470000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6470000_YcxjdYUKIb.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e2fba36f22678660e0f466ec4d89a1d27e00e953c706abac05b0f64ecd701b12
Instruction ID: fec7809d08f81f208963947c4bdc204dcafe5e3df9e1086ce3f37c35417fe61b
Opcode Fuzzy Hash: e2fba36f22678660e0f466ec4d89a1d27e00e953c706abac05b0f64ecd701b12
Instruction Fuzzy Hash: E0F06D6261D2C21FD3538B30A8761D7BFA19E5712171980CBC4C48A653D5214947C7A1

Function 06476991 Relevance: .0, Instructions: 30COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4204659629.0000000006470000.00000040.00000800.00020000.00000000.sdmp, Offset: 06470000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6470000_YcxjdYUKIb.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9d5f9e4e0f5b00582e2268a5bc151e843952dabd999477f0207108b12817e23b
Instruction ID: 75cab2d26d7c82c9b824b03ebc37c8729c2c5b1fa107a447d014ecfb6f723ac1
Opcode Fuzzy Hash: 9d5f9e4e0f5b00582e2268a5bc151e843952dabd999477f0207108b12817e23b
Instruction Fuzzy Hash: D4F032B5900709CFDB20CF99D8447DEBBF5AF58324F24845AD129A7350C378A844CFA0

Function 030734C3 Relevance: .0, Instructions: 28COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4200376545.0000000003070000.00000040.00000800.00020000.00000000.sdmp, Offset: 03070000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3070000_YcxjdYUKIb.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 24233581a11a0008dfaf5689b3e065f3c4cb7b6fc4883d171d447e233ad31f1e
Instruction ID: e81beaec4cc37a9b1e5e38d24cb05593bd0396aa601c8f73e7549674f080740d
Opcode Fuzzy Hash: 24233581a11a0008dfaf5689b3e065f3c4cb7b6fc4883d171d447e233ad31f1e
Instruction Fuzzy Hash: F6F0E935F10115CBDB68AF64E41829D36A9FB44791F0584B8E816EB374EEB48C059BC4

Function 064728D0 Relevance: .0, Instructions: 23COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4204659629.0000000006470000.00000040.00000800.00020000.00000000.sdmp, Offset: 06470000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6470000_YcxjdYUKIb.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 877b6213756c8c25b8ee1b6e336468ed2e69b07a10dc464494f67f59bd3ff1e7
Instruction ID: eebb347cd8eb3872a55d35496b5e39a2ae6a34e36ece05873e4806ffd325ddc0
Opcode Fuzzy Hash: 877b6213756c8c25b8ee1b6e336468ed2e69b07a10dc464494f67f59bd3ff1e7
Instruction Fuzzy Hash: E0E0D8619083C86FCB12DBB0C90449ABFF4EB06100B1546DBC1048B112FA7367146351

Function 06475C97 Relevance: .0, Instructions: 21COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4204659629.0000000006470000.00000040.00000800.00020000.00000000.sdmp, Offset: 06470000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6470000_YcxjdYUKIb.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 42ac360b81b48ce46f4c447185fd73714de60552981a127b5a97bf83063cbdad
Instruction ID: 3bcb3188a269b1e5c7f8db0c8122ac071a161af76f91017dced62c002a570ea5
Opcode Fuzzy Hash: 42ac360b81b48ce46f4c447185fd73714de60552981a127b5a97bf83063cbdad
Instruction Fuzzy Hash: 9AE08631509285DFCB02DFB494900EAFFB5DF4720075146E7D444CB112EA310A19E791

Function 0309F1E8 Relevance: .0, Instructions: 17COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4200419504.0000000003090000.00000040.00000800.00020000.00000000.sdmp, Offset: 03090000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3090000_YcxjdYUKIb.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0fe6e3aea478687c158d19a34a902664cc9df0a88a38a6ac68c528960ef1b384
Instruction ID: 29f6224dccce5c91cfde4dbcf6ef2d8eab8ae5265d8597ad401a6bfe491303de
Opcode Fuzzy Hash: 0fe6e3aea478687c158d19a34a902664cc9df0a88a38a6ac68c528960ef1b384
Instruction Fuzzy Hash: 44D06236100119BF9B05DE84DC41CA67B6AEB89660714C05AFD1547211C673DD22DBD0

Function 0647363A Relevance: .0, Instructions: 17COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4204659629.0000000006470000.00000040.00000800.00020000.00000000.sdmp, Offset: 06470000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6470000_YcxjdYUKIb.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4fbcbf2aa35743dcbda0a170ae09478bc4a9c42ca58dcf0a3cd47f3e4e86e0c5
Instruction ID: b7974086183bbd3c2bab1058421142f245efb00e63d024e9409f61b208d4d001
Opcode Fuzzy Hash: 4fbcbf2aa35743dcbda0a170ae09478bc4a9c42ca58dcf0a3cd47f3e4e86e0c5
Instruction Fuzzy Hash: 77E0EC3510D2C19FC707CB24D960865BFB2EFDA604B1988CEE9D057353C6629C1BDB62

Function 06473FD8 Relevance: .0, Instructions: 17COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4204659629.0000000006470000.00000040.00000800.00020000.00000000.sdmp, Offset: 06470000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6470000_YcxjdYUKIb.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c7502ffaac32a72c06e699369b0cd59fc34c2c5f38954621f032df3ab5fc1df9
Instruction ID: f4778283904a84e2488b668d0fb3aca1c331aa0c9a3d07f5208d956aaac29b50
Opcode Fuzzy Hash: c7502ffaac32a72c06e699369b0cd59fc34c2c5f38954621f032df3ab5fc1df9
Instruction Fuzzy Hash: F2E0127550D2C15FD302DF64F960895BFB29FA7604B18488AE581A7353C622DC16DB32

Function 030778D0 Relevance: .0, Instructions: 17COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4200376545.0000000003070000.00000040.00000800.00020000.00000000.sdmp, Offset: 03070000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3070000_YcxjdYUKIb.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 65e9df4211313857b0a23a0775e923c8a82e2e16f591bb1c4272c257be128ba2
Instruction ID: c78c6c49e93c12b88bbbc97ac4db5435eb52c945745aaa39d83051a99db181ed
Opcode Fuzzy Hash: 65e9df4211313857b0a23a0775e923c8a82e2e16f591bb1c4272c257be128ba2
Instruction Fuzzy Hash: 8BE01A34A0111ADBEB69DB54DD14FAD77B2FB98300F1141E9E94E6B264CA351E80DF60

Function 06473E59 Relevance: .0, Instructions: 16COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4204659629.0000000006470000.00000040.00000800.00020000.00000000.sdmp, Offset: 06470000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6470000_YcxjdYUKIb.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 42bd033a63a7b033b52c63177bb8434265c403f158e5c81ba866115b61d833cb
Instruction ID: 1e193d4162b5f63cc34f3a67db572cc93f2f9b626804c81e8d1d82571afb3258
Opcode Fuzzy Hash: 42bd033a63a7b033b52c63177bb8434265c403f158e5c81ba866115b61d833cb
Instruction Fuzzy Hash: 91D0A77254C3815FD305DA60D8A08AABBB2EBE5310F288C4BE494C3751C726DC07C711

Function 06474890 Relevance: .0, Instructions: 16COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4204659629.0000000006470000.00000040.00000800.00020000.00000000.sdmp, Offset: 06470000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6470000_YcxjdYUKIb.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 221c234e91f1e6758873d3d364c160b137e8898d1e6f2bbe5fe38788a93dccef
Instruction ID: 92a748b89c4485ea4c133ee3ac7af954ad210349d80136b1725a8119fdf9c813
Opcode Fuzzy Hash: 221c234e91f1e6758873d3d364c160b137e8898d1e6f2bbe5fe38788a93dccef
Instruction Fuzzy Hash: 85D0C2B250C2909FC302DF10F910906BBE16FA6500B05488AE8C0E7352D112CD16C772

Function 03072C07 Relevance: .0, Instructions: 16COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4200376545.0000000003070000.00000040.00000800.00020000.00000000.sdmp, Offset: 03070000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3070000_YcxjdYUKIb.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1aed3d58d3a5ea5fdbf3992b0a40dc4871a7644754f81a127d7c5b9b12e332ea
Instruction ID: 70a373bc05be67950d335290978ae853f21df747478709e873f3bb3b6b227782
Opcode Fuzzy Hash: 1aed3d58d3a5ea5fdbf3992b0a40dc4871a7644754f81a127d7c5b9b12e332ea
Instruction Fuzzy Hash: DCD0A7317485005FC748C7589450575B7F19F8925C715C0EE900DCB67BDB13CC134604

Function 06475ED0 Relevance: .0, Instructions: 15COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4204659629.0000000006470000.00000040.00000800.00020000.00000000.sdmp, Offset: 06470000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6470000_YcxjdYUKIb.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 03c4ffe5153de229b5ab4db236f468abf69119f2e5119a0bfbd48d0722fff4c6
Instruction ID: e14738e8b515e84b0e0bf69213fa892639e7de6404d8d4b9de2a76680d8abde3
Opcode Fuzzy Hash: 03c4ffe5153de229b5ab4db236f468abf69119f2e5119a0bfbd48d0722fff4c6
Instruction Fuzzy Hash: B0D012221891908FC3435270B4614D07F20DA8752872E88DBE048CF157D6278E878241

Function 06475C20 Relevance: .0, Instructions: 15COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4204659629.0000000006470000.00000040.00000800.00020000.00000000.sdmp, Offset: 06470000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6470000_YcxjdYUKIb.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 34cf50db706d32976c9c7ed88695e7282982701e0c9d7b6e18b1ede9d95c7ba8
Instruction ID: 67179a92b774e804feee608ca1867c9a06539abd8fdb8243c9c6b39f45035d1c
Opcode Fuzzy Hash: 34cf50db706d32976c9c7ed88695e7282982701e0c9d7b6e18b1ede9d95c7ba8
Instruction Fuzzy Hash: B8D0C96520D1D54FC3479A3498A15DABF214E8B15530980DBE8C5CF393CB158907CBA1

Function 064740E8 Relevance: .0, Instructions: 15COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4204659629.0000000006470000.00000040.00000800.00020000.00000000.sdmp, Offset: 06470000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6470000_YcxjdYUKIb.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: eb5dfafe04d3e50287a4b590f74b7d874b40388aaa58822046c93cb1f3f147a8
Instruction ID: 960342e0ebc647037d1c84ac82f46f4d497ecdf787824847d1e3cf8998880b98
Opcode Fuzzy Hash: eb5dfafe04d3e50287a4b590f74b7d874b40388aaa58822046c93cb1f3f147a8
Instruction Fuzzy Hash: E3D09E341095849BD306CB30C864815FB79AF9A60572CC58BD5499B152DB329D62EF51

Function 0307E070 Relevance: .0, Instructions: 15COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4200376545.0000000003070000.00000040.00000800.00020000.00000000.sdmp, Offset: 03070000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3070000_YcxjdYUKIb.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 01121f2c778aaa955698064ff843d2996bee34fc2f5530b77e7ea5e79a423cb0
Instruction ID: 1b0a6f6d896694a697788613f5e5355b62e48349d74697ae87246d03dd23ea49
Opcode Fuzzy Hash: 01121f2c778aaa955698064ff843d2996bee34fc2f5530b77e7ea5e79a423cb0
Instruction Fuzzy Hash: 05D0C936200118BF9B04DE88DC41CAABB6EEB89660714C05FFD1887311CAB3ED22DBD0

Function 0309F2F8 Relevance: .0, Instructions: 14COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4200419504.0000000003090000.00000040.00000800.00020000.00000000.sdmp, Offset: 03090000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3090000_YcxjdYUKIb.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4073000952fc5f2280b3c5c36b16b1ef8edf358caecd46abdf19c12acd51daa2
Instruction ID: 5a0f62a2b6755df5adc95eac048b9fff019e8c6eda15a7ab8d08964d10a70e0b
Opcode Fuzzy Hash: 4073000952fc5f2280b3c5c36b16b1ef8edf358caecd46abdf19c12acd51daa2
Instruction Fuzzy Hash: 0AD0C77591110CEFCB00DFA5D54145DBBFDDB4920075045E6D905D3210ED325E14AB91

Function 0309FF60 Relevance: .0, Instructions: 14COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4200419504.0000000003090000.00000040.00000800.00020000.00000000.sdmp, Offset: 03090000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3090000_YcxjdYUKIb.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1118bd8210093bbaf1b32a4943d1d720afb5f90d31521d73349089a15bec583b
Instruction ID: be8629c7dbd2a4c21f93b77c91546bdd0f3983bec835eacde8ce3175c40420f0
Opcode Fuzzy Hash: 1118bd8210093bbaf1b32a4943d1d720afb5f90d31521d73349089a15bec583b
Instruction Fuzzy Hash: 68D0C9B590120CBF8B00EFA8994149EBBF9DB89610B1049E69508D7210ED315E106791

Function 06473411 Relevance: .0, Instructions: 14COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4204659629.0000000006470000.00000040.00000800.00020000.00000000.sdmp, Offset: 06470000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6470000_YcxjdYUKIb.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f240468dc24c3e1381a503e3197049ca9b51bc3543e3aa8de61ad48474b8fbbe
Instruction ID: e7093aaa16e6ec40114bcb533f2c58df1a846522e575c3c2b29779f98b331201
Opcode Fuzzy Hash: f240468dc24c3e1381a503e3197049ca9b51bc3543e3aa8de61ad48474b8fbbe
Instruction Fuzzy Hash: 26D0C93110E2C00ECB97873894604E0BF619E9721471984EBD484CB153C6226817D250

Function 064728E0 Relevance: .0, Instructions: 14COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4204659629.0000000006470000.00000040.00000800.00020000.00000000.sdmp, Offset: 06470000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6470000_YcxjdYUKIb.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 00ab12d088e796d0f4868e08911f772802d15ced595aed4650e01452c75d1016
Instruction ID: a9cda137f4bd2ff1bec40ee56f6c653e69c993afe2f79a4735fdc0d4d512e23e
Opcode Fuzzy Hash: 00ab12d088e796d0f4868e08911f772802d15ced595aed4650e01452c75d1016
Instruction Fuzzy Hash: CCD0C97290120CAB8B00EFE8D94149EBBF9EB89200B1049EA9508D7210EE315A146791

Function 06475CA8 Relevance: .0, Instructions: 14COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4204659629.0000000006470000.00000040.00000800.00020000.00000000.sdmp, Offset: 06470000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6470000_YcxjdYUKIb.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: edd59ca0997f06e3af1683d38a8640ad3693f274b3a17a0e8bd59017867bca21
Instruction ID: d73a6cf02b157cbccd0233e2dd3c1f94b48a4f44f936c2e4c4808b6c1f8e20fb
Opcode Fuzzy Hash: edd59ca0997f06e3af1683d38a8640ad3693f274b3a17a0e8bd59017867bca21
Instruction Fuzzy Hash: 18D0C97190520CAB8B00DFE5994189EBBF9DB49200B1045EA9508D7210ED315A10A791

Function 06472D10 Relevance: .0, Instructions: 14COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4204659629.0000000006470000.00000040.00000800.00020000.00000000.sdmp, Offset: 06470000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6470000_YcxjdYUKIb.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3ccd0b963b8c4e672927ab6911207de52a95eaff35776d8b046e60e44cdfd272
Instruction ID: 6ef34650960f1d52a4bb01e2fe5fc5e3293aa5a821d9ecbe8ba7e1a6d62f06e5
Opcode Fuzzy Hash: 3ccd0b963b8c4e672927ab6911207de52a95eaff35776d8b046e60e44cdfd272
Instruction Fuzzy Hash: 6BD0C93120D2D08FCB87973888A0495BF719E8711471882DBD084CF657C72A6A13C752

Function 0307FF40 Relevance: .0, Instructions: 14COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4200376545.0000000003070000.00000040.00000800.00020000.00000000.sdmp, Offset: 03070000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3070000_YcxjdYUKIb.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f0e21e3f704cbff6668b896948333e82afedc0da4ce07a533a3630193b299271
Instruction ID: 5a70475cb2885a966d223f62c8d9a32ee048b4a03777423c2665d0d898199da5
Opcode Fuzzy Hash: f0e21e3f704cbff6668b896948333e82afedc0da4ce07a533a3630193b299271
Instruction Fuzzy Hash: AED0C97290120CAB8B00DFF4C94149EBBF9DB89601B1085E69509D7210ED315B106791

Function 06475D60 Relevance: .0, Instructions: 13COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4204659629.0000000006470000.00000040.00000800.00020000.00000000.sdmp, Offset: 06470000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6470000_YcxjdYUKIb.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7980d542017cfd8ac39e6840d6d94e142c68d20d0fa05d7a4ec067e81343bae4
Instruction ID: cc571d4a0bd5c88486b05823c71f4223cbbcd28c402639adb9730d113c225060
Opcode Fuzzy Hash: 7980d542017cfd8ac39e6840d6d94e142c68d20d0fa05d7a4ec067e81343bae4
Instruction Fuzzy Hash: 29D0A7301043808FC303BB14D4618C4BB30DF4A21030884FBD444CB883C7376513C651

Function 06476180 Relevance: .0, Instructions: 13COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4204659629.0000000006470000.00000040.00000800.00020000.00000000.sdmp, Offset: 06470000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6470000_YcxjdYUKIb.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4decc1cace0f42a2af3ce0ff70c2a13afb70360ae6caccc3ebf2517ff82f6ed9
Instruction ID: 98878906e802f0960e15cef33bd1e435c77f7f4bfc64b632ba4e5276ef0d2131
Opcode Fuzzy Hash: 4decc1cace0f42a2af3ce0ff70c2a13afb70360ae6caccc3ebf2517ff82f6ed9
Instruction Fuzzy Hash: C1D0CA2620E2C10ECB438B7888740A4BF31EF87104B298CCAD0D4CB667CA22BA139660

Function 06473FE8 Relevance: .0, Instructions: 12COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4204659629.0000000006470000.00000040.00000800.00020000.00000000.sdmp, Offset: 06470000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6470000_YcxjdYUKIb.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9742d7865735c7252f6c48a7c294f1d1b4f483eb85901c8c33943e63f37f990d
Instruction ID: 48e8204161933d4df9c7b41a33249025f43fd015cf28c75e97648b457401bf24
Opcode Fuzzy Hash: 9742d7865735c7252f6c48a7c294f1d1b4f483eb85901c8c33943e63f37f990d
Instruction Fuzzy Hash: 84D012752081119F9204CF44E940C6BF7E6EFC8B10B14C84EB84053310CA72DC17CBB2

Function 06472BB0 Relevance: .0, Instructions: 12COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4204659629.0000000006470000.00000040.00000800.00020000.00000000.sdmp, Offset: 06470000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6470000_YcxjdYUKIb.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ba6e586b70d73676cfd0f18949f7b806084bf6de9f74be0026f9e27917b8fc67
Instruction ID: e3155e9077695c52236f06fb9740917fe01b2421ebea82b47dc562556369f54f
Opcode Fuzzy Hash: ba6e586b70d73676cfd0f18949f7b806084bf6de9f74be0026f9e27917b8fc67
Instruction Fuzzy Hash: DDD0C92100A2C05ECB0287348474494FF70DF47108B2984CAC4848FA53C712B913D701

Function 06475CE0 Relevance: .0, Instructions: 12COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4204659629.0000000006470000.00000040.00000800.00020000.00000000.sdmp, Offset: 06470000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6470000_YcxjdYUKIb.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9742d7865735c7252f6c48a7c294f1d1b4f483eb85901c8c33943e63f37f990d
Instruction ID: 48e8204161933d4df9c7b41a33249025f43fd015cf28c75e97648b457401bf24
Opcode Fuzzy Hash: 9742d7865735c7252f6c48a7c294f1d1b4f483eb85901c8c33943e63f37f990d
Instruction Fuzzy Hash: 84D012752081119F9204CF44E940C6BF7E6EFC8B10B14C84EB84053310CA72DC17CBB2

Function 0307630E Relevance: .0, Instructions: 12COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4200376545.0000000003070000.00000040.00000800.00020000.00000000.sdmp, Offset: 03070000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3070000_YcxjdYUKIb.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0398f933a14f33ebca4e051b86d29bd006b790eae70069b5876d797ea0958181
Instruction ID: 5d61e96cfe52de4a5ab9f7fcd6d4a28ecd6d97236d94338bfc0b42a0b2f77eaa
Opcode Fuzzy Hash: 0398f933a14f33ebca4e051b86d29bd006b790eae70069b5876d797ea0958181
Instruction Fuzzy Hash: 78C012307001045F8344CA58C851CA6B7A5DFD9214310C02EA80DC7311E632DC03CA50

Function 0307347A Relevance: .0, Instructions: 12COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4200376545.0000000003070000.00000040.00000800.00020000.00000000.sdmp, Offset: 03070000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3070000_YcxjdYUKIb.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e69cd6f93f5505e2ba7954a00f3d595ea8d5937f40ec37b4d4435038d3306dd0
Instruction ID: a409b1aa7bb4d00f167cb4c48efef0bdf6dc86ccd9bbb80264e9ecc9dfb4f221
Opcode Fuzzy Hash: e69cd6f93f5505e2ba7954a00f3d595ea8d5937f40ec37b4d4435038d3306dd0
Instruction Fuzzy Hash: 3FD02231E10229DFCF59BBD8D41809C77B2FF88391B050828E906AB374DE600C069BC0

Function 06476811 Relevance: .0, Instructions: 11COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4204659629.0000000006470000.00000040.00000800.00020000.00000000.sdmp, Offset: 06470000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6470000_YcxjdYUKIb.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 65c332ad7002c05c1a0cb9e43e85fcf257045edf34a943b028b4ec52353f50db
Instruction ID: 8cd81a3f0f9efea9564abe4842dfd2b00de087a3b922fd74a6f67fdab364c64f
Opcode Fuzzy Hash: 65c332ad7002c05c1a0cb9e43e85fcf257045edf34a943b028b4ec52353f50db
Instruction Fuzzy Hash: 6CD0C92110D3C14FC7039B30C864691BF618F47228B1D40CFD0C08F563C7269A46C711

Function 03076310 Relevance: .0, Instructions: 11COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4200376545.0000000003070000.00000040.00000800.00020000.00000000.sdmp, Offset: 03070000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3070000_YcxjdYUKIb.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2f9c937b705b733c9644217cffe37b903ab6a11d94893328ab2d7921f8117b8c
Instruction ID: 89f7625bcd3042e5662e2b0f59687678129b36ffb3fe7dec0c562e4284fda470
Opcode Fuzzy Hash: 2f9c937b705b733c9644217cffe37b903ab6a11d94893328ab2d7921f8117b8c
Instruction Fuzzy Hash: 05C04C753042085F9344DA9DD851C26F7E9DBD8614714C06DA90DC7351EA72FD13C694

Function 0307F2F0 Relevance: .0, Instructions: 11COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4200376545.0000000003070000.00000040.00000800.00020000.00000000.sdmp, Offset: 03070000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3070000_YcxjdYUKIb.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2f9c937b705b733c9644217cffe37b903ab6a11d94893328ab2d7921f8117b8c
Instruction ID: 89f7625bcd3042e5662e2b0f59687678129b36ffb3fe7dec0c562e4284fda470
Opcode Fuzzy Hash: 2f9c937b705b733c9644217cffe37b903ab6a11d94893328ab2d7921f8117b8c
Instruction Fuzzy Hash: 05C04C753042085F9344DA9DD851C26F7E9DBD8614714C06DA90DC7351EA72FD13C694

Function 03071432 Relevance: .0, Instructions: 11COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4200376545.0000000003070000.00000040.00000800.00020000.00000000.sdmp, Offset: 03070000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3070000_YcxjdYUKIb.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 34c1ee6ee533057f9e7fc57c5294d88ad3d0cdd11f0347b1085d55dff0d53b7c
Instruction ID: 90ce22434cea86719ad54454051d0e32849250449f0c93dcc70868f803c82d18
Opcode Fuzzy Hash: 34c1ee6ee533057f9e7fc57c5294d88ad3d0cdd11f0347b1085d55dff0d53b7c
Instruction Fuzzy Hash: FCC04C307484008B5648C59D9951915B7D79FD8554728C16D680DC7765EA23DD138585

Function 03072C18 Relevance: .0, Instructions: 10COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4200376545.0000000003070000.00000040.00000800.00020000.00000000.sdmp, Offset: 03070000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3070000_YcxjdYUKIb.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6b890a1878f21bb7f09d862592a755ed2ce311562f5f1a0304c6abbbdd52873e
Instruction ID: 19d07928bc24b9474f7e59cbdd8b8e0d3deed1c7a519eb3c8c8690cf2c067a2b
Opcode Fuzzy Hash: 6b890a1878f21bb7f09d862592a755ed2ce311562f5f1a0304c6abbbdd52873e
Instruction Fuzzy Hash: C5C092303082084B8748D69DE851825F3DA9BCC618328C0BDA80DC7352EE23FC038684

Function 03071438 Relevance: .0, Instructions: 10COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4200376545.0000000003070000.00000040.00000800.00020000.00000000.sdmp, Offset: 03070000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3070000_YcxjdYUKIb.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6b890a1878f21bb7f09d862592a755ed2ce311562f5f1a0304c6abbbdd52873e
Instruction ID: 19d07928bc24b9474f7e59cbdd8b8e0d3deed1c7a519eb3c8c8690cf2c067a2b
Opcode Fuzzy Hash: 6b890a1878f21bb7f09d862592a755ed2ce311562f5f1a0304c6abbbdd52873e
Instruction Fuzzy Hash: C5C092303082084B8748D69DE851825F3DA9BCC618328C0BDA80DC7352EE23FC038684

Function 0307F690 Relevance: .0, Instructions: 8COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4200376545.0000000003070000.00000040.00000800.00020000.00000000.sdmp, Offset: 03070000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3070000_YcxjdYUKIb.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b07eb51126463de2bf8462432d69fd4c92e1a2acd6486d465ab4ae050f38ce89
Instruction ID: 6946c9798f7289baa91495e0fb5539b78174b0423724991b48b9fdfa7c9b4558
Opcode Fuzzy Hash: b07eb51126463de2bf8462432d69fd4c92e1a2acd6486d465ab4ae050f38ce89
Instruction Fuzzy Hash: 02B012302081084F8244D6D8E841C14F39DDBC4618354C0ADE80CCB302CF33FC0385C4

Function 0307F6F0 Relevance: .0, Instructions: 8COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4200376545.0000000003070000.00000040.00000800.00020000.00000000.sdmp, Offset: 03070000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3070000_YcxjdYUKIb.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b07eb51126463de2bf8462432d69fd4c92e1a2acd6486d465ab4ae050f38ce89
Instruction ID: 6946c9798f7289baa91495e0fb5539b78174b0423724991b48b9fdfa7c9b4558
Opcode Fuzzy Hash: b07eb51126463de2bf8462432d69fd4c92e1a2acd6486d465ab4ae050f38ce89
Instruction Fuzzy Hash: 02B012302081084F8244D6D8E841C14F39DDBC4618354C0ADE80CCB302CF33FC0385C4

Function 0307EF90 Relevance: .0, Instructions: 7COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4200376545.0000000003070000.00000040.00000800.00020000.00000000.sdmp, Offset: 03070000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3070000_YcxjdYUKIb.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 00fb257517fa66d8d82df2fc559de156622b6f4f3f56d113648c417e124a9b6c
Instruction ID: bde584bcc0a20163e1d20aefd562f14664055d751c7398f878511897cdc0a054
Opcode Fuzzy Hash: 00fb257517fa66d8d82df2fc559de156622b6f4f3f56d113648c417e124a9b6c
Instruction Fuzzy Hash: DFB012301042084B8100D6C8D841810F39CDB84518314C099980C47302CA23FC038580

Function 06475B80 Relevance: .0, Instructions: 5COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4204659629.0000000006470000.00000040.00000800.00020000.00000000.sdmp, Offset: 06470000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6470000_YcxjdYUKIb.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 848e7b2b3d1d7438aceb18ee9ce77d60f8a3148b9db338e3d364b5add5ce48b1
Instruction ID: 424522431131923360a2424e5b60fcaca403654da384226d21dcd1d1d325544f
Opcode Fuzzy Hash: 848e7b2b3d1d7438aceb18ee9ce77d60f8a3148b9db338e3d364b5add5ce48b1
Instruction Fuzzy Hash: B3A001746050109B8689DA58D991818B7A2ABC9219728C4ADA819CB25ACF33E9039A44

Function 06473420 Relevance: .0, Instructions: 5COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4204659629.0000000006470000.00000040.00000800.00020000.00000000.sdmp, Offset: 06470000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6470000_YcxjdYUKIb.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 848e7b2b3d1d7438aceb18ee9ce77d60f8a3148b9db338e3d364b5add5ce48b1
Instruction ID: 424522431131923360a2424e5b60fcaca403654da384226d21dcd1d1d325544f
Opcode Fuzzy Hash: 848e7b2b3d1d7438aceb18ee9ce77d60f8a3148b9db338e3d364b5add5ce48b1
Instruction Fuzzy Hash: B3A001746050109B8689DA58D991818B7A2ABC9219728C4ADA819CB25ACF33E9039A44

Function 064730A0 Relevance: .0, Instructions: 5COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4204659629.0000000006470000.00000040.00000800.00020000.00000000.sdmp, Offset: 06470000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6470000_YcxjdYUKIb.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 848e7b2b3d1d7438aceb18ee9ce77d60f8a3148b9db338e3d364b5add5ce48b1
Instruction ID: 424522431131923360a2424e5b60fcaca403654da384226d21dcd1d1d325544f
Opcode Fuzzy Hash: 848e7b2b3d1d7438aceb18ee9ce77d60f8a3148b9db338e3d364b5add5ce48b1
Instruction Fuzzy Hash: B3A001746050109B8689DA58D991818B7A2ABC9219728C4ADA819CB25ACF33E9039A44

Function 06472390 Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4204659629.0000000006470000.00000040.00000800.00020000.00000000.sdmp, Offset: 06470000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6470000_YcxjdYUKIb.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 584a3913bed7d41f6751d29dc0af2e109adf5df94d8de11209de24b86f245c04
Instruction ID: 2108930940694c1c8b8ad4272d9396267f2db374b9021a0985f6588530823504
Opcode Fuzzy Hash: 584a3913bed7d41f6751d29dc0af2e109adf5df94d8de11209de24b86f245c04
Instruction Fuzzy Hash: 6BA002742010009BC644DB54C991814F761EFC5219728C4DDA8198B256CF33ED03DA40

Non-executed Functions

Function 0307395D Relevance: .7, Instructions: 700COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4200376545.0000000003070000.00000040.00000800.00020000.00000000.sdmp, Offset: 03070000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3070000_YcxjdYUKIb.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 775b8f4688c0c39fb93b34e8c8cffe6e0c2e0361f4cef2a805e8a30cee7375f6
Instruction ID: c0e32e5e39de7c638078d61836e9f16c577f7b8e7c16d73eb31c6506e52ecc5b
Opcode Fuzzy Hash: 775b8f4688c0c39fb93b34e8c8cffe6e0c2e0361f4cef2a805e8a30cee7375f6
Instruction Fuzzy Hash: 3E22343394A135DFD706DE40EC81AF7B3A1FA4532572A03AAE8459B205D33AB761CBD0

Function 03073F98 Relevance: .7, Instructions: 690COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4200376545.0000000003070000.00000040.00000800.00020000.00000000.sdmp, Offset: 03070000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3070000_YcxjdYUKIb.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dd2d5d0db51d2cba9b0004c3a4b11585729a1e330cf5ca5ee9c77e249ea00678
Instruction ID: f6ce16918770f13effbbce51e61f426015a5eeb3d2613f43f8ef5f75516b675b
Opcode Fuzzy Hash: dd2d5d0db51d2cba9b0004c3a4b11585729a1e330cf5ca5ee9c77e249ea00678
Instruction Fuzzy Hash: 2C22143394A135DFD706DA40EC81AF7B3A1FA4532572E03AAE8459B205D33AB761CBD0

Function 03075280 Relevance: .7, Instructions: 686COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4200376545.0000000003070000.00000040.00000800.00020000.00000000.sdmp, Offset: 03070000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3070000_YcxjdYUKIb.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 68e1815a391fcd0a8d68085ab1768b55440bed68b79c93c8841dc7c2c45d888b
Instruction ID: 806f334e7e4ea41668f8fe2606d93906c0e8cbd67276094d44d63524203d8f73
Opcode Fuzzy Hash: 68e1815a391fcd0a8d68085ab1768b55440bed68b79c93c8841dc7c2c45d888b
Instruction Fuzzy Hash: AE22253394A135DFD716DE40EC81AF7B3A1FA4532572A03AAE8459B205D33AB761CBD0

Function 0307490D Relevance: .7, Instructions: 685COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4200376545.0000000003070000.00000040.00000800.00020000.00000000.sdmp, Offset: 03070000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3070000_YcxjdYUKIb.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3f5183971766ffa7448a7c0c1029094e975f0e8db251e9f7530f2238d8f01dbc
Instruction ID: 62baf308280e4209ab568951e9722a00e50069e8c073eb5c4f79d5d8fb5a8ca7
Opcode Fuzzy Hash: 3f5183971766ffa7448a7c0c1029094e975f0e8db251e9f7530f2238d8f01dbc
Instruction Fuzzy Hash: D422253394A135DFD706DE40EC81AF7B3A1FA4532572A03AAE9459B205D33AB761CBD0

Function 03074695 Relevance: .7, Instructions: 685COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4200376545.0000000003070000.00000040.00000800.00020000.00000000.sdmp, Offset: 03070000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3070000_YcxjdYUKIb.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a67949260029ac943e84d36b9eff57f0e814ada20340a96db001e98b91495e64
Instruction ID: bb7a97e77a6f613ac79a2c1e02355a20c03cf8d369729091b2f7fd454e8c4ddf
Opcode Fuzzy Hash: a67949260029ac943e84d36b9eff57f0e814ada20340a96db001e98b91495e64
Instruction Fuzzy Hash: 4622243394A135DFD706DE40EC81AF7B3A1FA4532572A03AAE8459B205D33AB761CBD0

Function 03073B99 Relevance: .7, Instructions: 684COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4200376545.0000000003070000.00000040.00000800.00020000.00000000.sdmp, Offset: 03070000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3070000_YcxjdYUKIb.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a65a43fb01c02a29d4b80156ca489db10de2353935b861655309cd20b59f62d8
Instruction ID: d2748080c0f8bc7eaefdd339c5db0ecba50ac3cdcdf9f821b6b1742f3df2f8c8
Opcode Fuzzy Hash: a65a43fb01c02a29d4b80156ca489db10de2353935b861655309cd20b59f62d8
Instruction Fuzzy Hash: B922253394A135DFD706DE40EC81AF7B3A1FA4532572A03AAE84597205D33AB761CBD0

Function 03074281 Relevance: .7, Instructions: 684COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4200376545.0000000003070000.00000040.00000800.00020000.00000000.sdmp, Offset: 03070000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3070000_YcxjdYUKIb.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3ff22a3a01dffd85ee5f83e4886f5420444fdc5cce523495b80e8298be5463b9
Instruction ID: ec6e5543bbd83514500a2085f0be0804b475600fbd160636e0718520c42d9d59
Opcode Fuzzy Hash: 3ff22a3a01dffd85ee5f83e4886f5420444fdc5cce523495b80e8298be5463b9
Instruction Fuzzy Hash: 0C22253394A135DFD706DE40EC81AF7B3A1FA4532572A03AAE94597205D33AB761CBD0

Function 03075131 Relevance: .7, Instructions: 684COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4200376545.0000000003070000.00000040.00000800.00020000.00000000.sdmp, Offset: 03070000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3070000_YcxjdYUKIb.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ec86812ac16c1beeec8a1ed35bca37df99f4375ce69e2355b27f0fe5c4580921
Instruction ID: 2c174f7a5966feea856e9b5d4e2aa89f763237bff686e2f66bac7a2f57c9046e
Opcode Fuzzy Hash: ec86812ac16c1beeec8a1ed35bca37df99f4375ce69e2355b27f0fe5c4580921
Instruction Fuzzy Hash: 9022143394A135DFD716DE40EC81AF7B3A1FA4532572A03AAE8459B205D33AB761CBD0

Function 03075056 Relevance: .7, Instructions: 684COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4200376545.0000000003070000.00000040.00000800.00020000.00000000.sdmp, Offset: 03070000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3070000_YcxjdYUKIb.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 37f8c0cdedd3bf9d577232ada4d558bed677d9e8c5632bf0715c4e060961ccee
Instruction ID: 1f12761913846f5325096387720ba3b406680513566f31e5910592ae37cc9d13
Opcode Fuzzy Hash: 37f8c0cdedd3bf9d577232ada4d558bed677d9e8c5632bf0715c4e060961ccee
Instruction Fuzzy Hash: 8F22243394A135DFD706DE40EC81AF7B3A1FA4532572A03AAE9459B205D33AB761CBD0

Function 0307530B Relevance: .7, Instructions: 683COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4200376545.0000000003070000.00000040.00000800.00020000.00000000.sdmp, Offset: 03070000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3070000_YcxjdYUKIb.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 709e158a86200f62e8901d36b92402557b027f223de97be0f8afadd5a9168168
Instruction ID: f5754b99572134f2c41b76b1b5fc9d73d7174406fceb5b0bdfc41a5a7d23b59f
Opcode Fuzzy Hash: 709e158a86200f62e8901d36b92402557b027f223de97be0f8afadd5a9168168
Instruction Fuzzy Hash: 8B22143394A135DFD706DE40EC81AF7B3A1FA8532572A03AAE94597205D33AB761CBD0

Function 03073B3B Relevance: .7, Instructions: 683COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4200376545.0000000003070000.00000040.00000800.00020000.00000000.sdmp, Offset: 03070000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3070000_YcxjdYUKIb.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6f9f590853f8eaf6c05d90b7fccd7ad4b4dd6d16eb6331348b7b10b56553e6ee
Instruction ID: 4decfb66161fdec6089148654de93add8148e7025823d0451a5d74d4c300137c
Opcode Fuzzy Hash: 6f9f590853f8eaf6c05d90b7fccd7ad4b4dd6d16eb6331348b7b10b56553e6ee
Instruction Fuzzy Hash: 2222243394A135DFD716DE40EC81AF7B3A1FA4532572A03AAE8459B205D33AB761CBD0

Function 0307434B Relevance: .7, Instructions: 683COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4200376545.0000000003070000.00000040.00000800.00020000.00000000.sdmp, Offset: 03070000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3070000_YcxjdYUKIb.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3305d865e7cf18ba7e113feb01799918138a1aa62225b1a01131b4725838a712
Instruction ID: 0a6bcf9976ac01e83fc4e504ad7f1478de4411774f4ea2924c4991da73964a23
Opcode Fuzzy Hash: 3305d865e7cf18ba7e113feb01799918138a1aa62225b1a01131b4725838a712
Instruction Fuzzy Hash: 5022243394A135DFD716DE40EC81AF7B3A1FA4532572A03AAE8459B205D33AB761CBD0

Function 03074B6A Relevance: .7, Instructions: 683COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4200376545.0000000003070000.00000040.00000800.00020000.00000000.sdmp, Offset: 03070000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3070000_YcxjdYUKIb.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f698c747e0e1f20f07d6091a2f1daaf29588da1f70cb6b8d7380b162f1722f27
Instruction ID: 23447e79810aeaa412093f674e3b121cebb79b2e12f71f20cf66e728240277b2
Opcode Fuzzy Hash: f698c747e0e1f20f07d6091a2f1daaf29588da1f70cb6b8d7380b162f1722f27
Instruction Fuzzy Hash: 5F22243394A135DFD706DE40EC81AF7B3A1FA8532572A03AAE94597205D33AB761CBD0

Function 03073371 Relevance: .7, Instructions: 683COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4200376545.0000000003070000.00000040.00000800.00020000.00000000.sdmp, Offset: 03070000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3070000_YcxjdYUKIb.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ab3b42d6b68f19a50f3873a587586dbbffe631ecd39872f093bce1eab6d429bc
Instruction ID: 329252fc44f1c52cba573ca41373b43f1a677af307a9b097b679e98ecc4b46c7
Opcode Fuzzy Hash: ab3b42d6b68f19a50f3873a587586dbbffe631ecd39872f093bce1eab6d429bc
Instruction Fuzzy Hash: CB22243394A135DFD706DE40EC81AF7B3A1FA4532572A03AAE8459B205D33AB761CBD0

Function 03074B95 Relevance: .7, Instructions: 683COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4200376545.0000000003070000.00000040.00000800.00020000.00000000.sdmp, Offset: 03070000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3070000_YcxjdYUKIb.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d9e7231bdf82b2bd8ceb24fd9397ca4a4aad18c3f57282dd87ae6142ef3dd675
Instruction ID: 4abcf5811a0abdad7ee3a90f6af285d81efdc184414daee32f3f1a9e993dfbb8
Opcode Fuzzy Hash: d9e7231bdf82b2bd8ceb24fd9397ca4a4aad18c3f57282dd87ae6142ef3dd675
Instruction Fuzzy Hash: 2622243394A135DFD706DE40EC81AF7B3A1FA8532572A03AAE94597205D33AB761CBD0

Function 030753B7 Relevance: .7, Instructions: 683COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4200376545.0000000003070000.00000040.00000800.00020000.00000000.sdmp, Offset: 03070000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3070000_YcxjdYUKIb.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0dd7e945cbea6f559454e2c0a2705310ec237b69cb0b5895b058523f847f5ce1
Instruction ID: 5d44d148a51cd89e2a93efd889956aeaae33df3b1b7bc9855574da8c79cff1f1
Opcode Fuzzy Hash: 0dd7e945cbea6f559454e2c0a2705310ec237b69cb0b5895b058523f847f5ce1
Instruction Fuzzy Hash: 8022243394A135DFD706DE40EC81AF7B3A1FA4532572A03AAE94597205D33AB761CBD0

Function 03074BBE Relevance: .7, Instructions: 683COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4200376545.0000000003070000.00000040.00000800.00020000.00000000.sdmp, Offset: 03070000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3070000_YcxjdYUKIb.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1e85ab9ff3c4a8d32541fb59ce9cf3c14c85c8456136a029681ac4d3a3358f56
Instruction ID: 06e1ab633bb3ec8beb0aabb6353ca1b360a24b5e1f26e63d8bb3434447060140
Opcode Fuzzy Hash: 1e85ab9ff3c4a8d32541fb59ce9cf3c14c85c8456136a029681ac4d3a3358f56
Instruction Fuzzy Hash: 7422243394A135DFD706DE40EC81AF7B3A1FA4532572A03AAE9459B205D33AB761CBD0

Function 03073BCF Relevance: .7, Instructions: 683COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4200376545.0000000003070000.00000040.00000800.00020000.00000000.sdmp, Offset: 03070000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3070000_YcxjdYUKIb.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 811b490fb4bb4bd478bc61c68036f2e9b6d9833175a9cc9b1cc0d060372cb90c
Instruction ID: 0adafdfd35370b72422e2511e80f7db5d06f7c6e6c3e25bfbba2096b23ffbcde
Opcode Fuzzy Hash: 811b490fb4bb4bd478bc61c68036f2e9b6d9833175a9cc9b1cc0d060372cb90c
Instruction Fuzzy Hash: AF22253394A135DFD706DE40EC81AF7B3A1FA4532572A03AAE5459B205D33AB761CBD0

Function 03074BEC Relevance: .7, Instructions: 683COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4200376545.0000000003070000.00000040.00000800.00020000.00000000.sdmp, Offset: 03070000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3070000_YcxjdYUKIb.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ab378fb81abf9c75cd5e5b3a38848151444c6209730f2cc80041d793cf3cd808
Instruction ID: 2bdfc9303ec8fbf9e625ad0a6bca96d29402bed064ad976ba062a869892115a1
Opcode Fuzzy Hash: ab378fb81abf9c75cd5e5b3a38848151444c6209730f2cc80041d793cf3cd808
Instruction Fuzzy Hash: 3122253394A135DFD706DE40EC81AF7B3A1FA8532572A03AAE84597205D33AB761CBD0

Function 03073206 Relevance: .7, Instructions: 683COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4200376545.0000000003070000.00000040.00000800.00020000.00000000.sdmp, Offset: 03070000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3070000_YcxjdYUKIb.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9f04b307664c347bec666c1a9f9d658a40f3874404c996315686e696cfb7d812
Instruction ID: ba0faed3b8778da3684f01e2a971c9c2f369b4261dc27a8aa395159a9b97d3f7
Opcode Fuzzy Hash: 9f04b307664c347bec666c1a9f9d658a40f3874404c996315686e696cfb7d812
Instruction Fuzzy Hash: 0522243394A135DFD716DE40EC81AF7B3A1FA4532572A03AAE8459B205D33AB761CBD0

Function 03073A94 Relevance: .7, Instructions: 683COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4200376545.0000000003070000.00000040.00000800.00020000.00000000.sdmp, Offset: 03070000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3070000_YcxjdYUKIb.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 329a02bb73ad0e5a57beaba73308be51b16717745d6ad7a7770a84adea6b932e
Instruction ID: 50fa56d8262face1c88015432b99a46c65bba30796c8ce670af4ec6c3af6075d
Opcode Fuzzy Hash: 329a02bb73ad0e5a57beaba73308be51b16717745d6ad7a7770a84adea6b932e
Instruction Fuzzy Hash: D722243394A135DFD706DE40EC81AF7B3A1FA4532572A03AAE84597205D33AB761CBD0

Function 03073ACE Relevance: .7, Instructions: 683COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4200376545.0000000003070000.00000040.00000800.00020000.00000000.sdmp, Offset: 03070000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3070000_YcxjdYUKIb.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2bf9cdd04a361b78ecc63200265dd6e93c1a3c4645f0923a5231d90bbc7386c8
Instruction ID: 22cb09743310f2b47999741fe79dcc34b6864d3ce2c1260b044a648602b4abbf
Opcode Fuzzy Hash: 2bf9cdd04a361b78ecc63200265dd6e93c1a3c4645f0923a5231d90bbc7386c8
Instruction Fuzzy Hash: 3622243394A135DFD706DE40EC81AF7B3A1FA4532572A03AAE8459B205D33AB761CBD0

Function 03075106 Relevance: .7, Instructions: 683COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4200376545.0000000003070000.00000040.00000800.00020000.00000000.sdmp, Offset: 03070000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3070000_YcxjdYUKIb.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f239172ebb5e3d763d0024d1fc869ac905cc817db95e7736ba182aaf96068f0e
Instruction ID: 91435c92fe9e64e15be59fa887ee5439945a8f0f84c7787749ffcc794307195d
Opcode Fuzzy Hash: f239172ebb5e3d763d0024d1fc869ac905cc817db95e7736ba182aaf96068f0e
Instruction Fuzzy Hash: CF22253394A135DFD706DE40EC81AF7B3A1FA4532572A03AAE94597205D33AB761CBD0

Function 0307398E Relevance: .7, Instructions: 683COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4200376545.0000000003070000.00000040.00000800.00020000.00000000.sdmp, Offset: 03070000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3070000_YcxjdYUKIb.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 923a0f4e619c68ed522114d90d04aa82553d2be19f7dced1a227e7a435077f71
Instruction ID: b7cdec6e9e5cd181cf86116ecd9e187a3d447078c08bdf47ab587f9ba3a9ac86
Opcode Fuzzy Hash: 923a0f4e619c68ed522114d90d04aa82553d2be19f7dced1a227e7a435077f71
Instruction Fuzzy Hash: 4822243394A135DFD716DE40EC81AF7B3A1FA4532572A03AAE8459B205D33AB761CBD0

Function 030749F9 Relevance: .7, Instructions: 683COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4200376545.0000000003070000.00000040.00000800.00020000.00000000.sdmp, Offset: 03070000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3070000_YcxjdYUKIb.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b70289ee0b337ad998111ffab7fd9f9069ea2a4c3784b9658259e1861210e709
Instruction ID: 1a50e265967630ace72aad0de08f28c25731a8848068c446195710f0974f5067
Opcode Fuzzy Hash: b70289ee0b337ad998111ffab7fd9f9069ea2a4c3784b9658259e1861210e709
Instruction Fuzzy Hash: 5122243394A135DFD706DE40EC81AF7B3A1FA8532572A03AAE84597205D33AB761CBD0

Function 03074022 Relevance: .7, Instructions: 683COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4200376545.0000000003070000.00000040.00000800.00020000.00000000.sdmp, Offset: 03070000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3070000_YcxjdYUKIb.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a042703041f9436d6d0adf0a5064c84ab40115e86613715d20bfe776887f7c03
Instruction ID: ec7a4e1d788b3858d9358441ad3fdfcb8f47bee7995d4eaea0aa7de0207c95f1
Opcode Fuzzy Hash: a042703041f9436d6d0adf0a5064c84ab40115e86613715d20bfe776887f7c03
Instruction Fuzzy Hash: 8F22243394A135DFD706DE40EC81AF7B3A1FA8532572A03AAE94597205D33AB761CBD0

Function 03075763 Relevance: .7, Instructions: 683COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4200376545.0000000003070000.00000040.00000800.00020000.00000000.sdmp, Offset: 03070000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3070000_YcxjdYUKIb.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e759c425b91995856e5ed59614c1a6f87b9bc390074cd9365dad862191cec3cb
Instruction ID: 790aa5cea92fe627cd8f37c14629aea7607ced45cd18d4cc648476383bb4d6a5
Opcode Fuzzy Hash: e759c425b91995856e5ed59614c1a6f87b9bc390074cd9365dad862191cec3cb
Instruction Fuzzy Hash: BA22243394A135DFD706DE40EC81AF7B3A1FA4532572A03AAE84597205D33AB761CBD0

Function 0307376C Relevance: .7, Instructions: 683COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4200376545.0000000003070000.00000040.00000800.00020000.00000000.sdmp, Offset: 03070000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3070000_YcxjdYUKIb.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ae8c3141a176a4f8dbdd819ffff3d026595e678204caf8d3d9fbf36f88b713bb
Instruction ID: 4b49af8ed2f31b1ced3496901e01a4f256c331758ce13c101a7eb000d435ae98
Opcode Fuzzy Hash: ae8c3141a176a4f8dbdd819ffff3d026595e678204caf8d3d9fbf36f88b713bb
Instruction Fuzzy Hash: 2822243394A135DFD716DE40EC81AF7B3A1FA4532572A03AAE8459B205D33AB761CBD0

Function 03072FB3 Relevance: .7, Instructions: 683COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4200376545.0000000003070000.00000040.00000800.00020000.00000000.sdmp, Offset: 03070000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3070000_YcxjdYUKIb.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6f4a181432c76032a41f3bb207e408ae4712e42a26c2dc7c8f6e46da72c133db
Instruction ID: 5b8bc3f1df5049387d0221eedefa25f6c42c2ea66ddf0394143ebf0c0026a265
Opcode Fuzzy Hash: 6f4a181432c76032a41f3bb207e408ae4712e42a26c2dc7c8f6e46da72c133db
Instruction Fuzzy Hash: 0422143394A135DFD716DE40EC81AF7B3A1FA4532572A03AAE8459B205D33AB761CBD0

Function 03074FD6 Relevance: .7, Instructions: 683COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4200376545.0000000003070000.00000040.00000800.00020000.00000000.sdmp, Offset: 03070000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3070000_YcxjdYUKIb.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 33b64253d592996a7fb88b23521080c2d43bf1bb0790a3ace82fd3d2e616fba7
Instruction ID: 2dd82b5faa205fb66b595eceb3baaa3d26b316c546e83b9d459ee8ab7c151350
Opcode Fuzzy Hash: 33b64253d592996a7fb88b23521080c2d43bf1bb0790a3ace82fd3d2e616fba7
Instruction Fuzzy Hash: 9B22243394A135DFD706DE40EC81AF7B3A1FA8532572A03AAE84597205D33AB761CBD0

Function 030757DB Relevance: .7, Instructions: 683COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4200376545.0000000003070000.00000040.00000800.00020000.00000000.sdmp, Offset: 03070000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3070000_YcxjdYUKIb.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5dfc4b7de3cc529bbdfe8e978554c4644bbb68b5a49821e0a19cf36f60244b95
Instruction ID: e386c9e6bd7b82f0a7390addf53a71e62d41152ff805abfc9b9b0068d5997b95
Opcode Fuzzy Hash: 5dfc4b7de3cc529bbdfe8e978554c4644bbb68b5a49821e0a19cf36f60244b95
Instruction Fuzzy Hash: CF22243394A135DFD706DE40EC81AF7B3A1FA4532572A03AAE94597205D33AB761CBD0

Function 03073687 Relevance: .7, Instructions: 683COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4200376545.0000000003070000.00000040.00000800.00020000.00000000.sdmp, Offset: 03070000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3070000_YcxjdYUKIb.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 03ad9772ce1d358cadd85c7a6b09ad7f54b2267602278f6b497c870dbafd4fdb
Instruction ID: 7883e29d670a79cc03a2c1e497147a1327ff6141793feac7ead6e48ad41b0f7d
Opcode Fuzzy Hash: 03ad9772ce1d358cadd85c7a6b09ad7f54b2267602278f6b497c870dbafd4fdb
Instruction Fuzzy Hash: D822143394A135DFD706DE40EC81AF7B3A1FA8532572A03AAE94597205D32AB761CBD0

Function 03073EA2 Relevance: .7, Instructions: 683COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4200376545.0000000003070000.00000040.00000800.00020000.00000000.sdmp, Offset: 03070000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3070000_YcxjdYUKIb.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6f736f28c7c713e67d5c6218d0b5a642dbd8f2ff78a817f36f6c3d3cf67b112f
Instruction ID: 679e89f30a8caee5626592d5177a2ea22c10ef13688074598ec614c244234226
Opcode Fuzzy Hash: 6f736f28c7c713e67d5c6218d0b5a642dbd8f2ff78a817f36f6c3d3cf67b112f
Instruction Fuzzy Hash: C822243394A135DFD706DE40EC81AF7B3A1FA4532572A03AAE84597205D33AB761CBD0

Function 030756F0 Relevance: .7, Instructions: 683COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4200376545.0000000003070000.00000040.00000800.00020000.00000000.sdmp, Offset: 03070000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3070000_YcxjdYUKIb.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 11df20b1fccedbfa20a1fd76b045257da9ae342d3ca5ba65c1dd9dce6c74db30
Instruction ID: 82b8908995235ff3bd6349b7111162ff5446c683d41b8806ab428f91afadf74a
Opcode Fuzzy Hash: 11df20b1fccedbfa20a1fd76b045257da9ae342d3ca5ba65c1dd9dce6c74db30
Instruction Fuzzy Hash: F622243394A135DFD706DE40EC81AF7B3A1FA4532572A03AAE9459B205D33AB761CBD0

Function 0307450E Relevance: .7, Instructions: 683COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4200376545.0000000003070000.00000040.00000800.00020000.00000000.sdmp, Offset: 03070000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3070000_YcxjdYUKIb.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b8d14b2d277f3f9e4b20d8abd6dc901a9cbccbe64ef50dd254f638ba77bce847
Instruction ID: b5016f2d51dee8d4463615dda58c33ee5f717667737951fe659edf38aef591d9
Opcode Fuzzy Hash: b8d14b2d277f3f9e4b20d8abd6dc901a9cbccbe64ef50dd254f638ba77bce847
Instruction Fuzzy Hash: DD22243394A135DFD716DE40EC81AF7B3A1FA4532572A03AAE8459B205D33AB761CBD0

Function 03073D26 Relevance: .7, Instructions: 683COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4200376545.0000000003070000.00000040.00000800.00020000.00000000.sdmp, Offset: 03070000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3070000_YcxjdYUKIb.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8fe23711ff4f973bb151515cde610b0628b2095beb1f44c7e86630440d337300
Instruction ID: f14152f54d00af415c2602c445655df4964bfedc4c8e1c9586c8fb1d1cfded6a
Opcode Fuzzy Hash: 8fe23711ff4f973bb151515cde610b0628b2095beb1f44c7e86630440d337300
Instruction Fuzzy Hash: 3A22243394A135DFD706DE40EC81AF7B3A1FA4532572A03AAE9459B205D33AB761CBD0

Function 03075590 Relevance: .7, Instructions: 683COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4200376545.0000000003070000.00000040.00000800.00020000.00000000.sdmp, Offset: 03070000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3070000_YcxjdYUKIb.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 640ecc029822f83372b14b35bfc98d394278ce3b2c251f17732a0f340bda7dbd
Instruction ID: 94cc2ade49b91237807f62fd672f04843fdee1fd936f164f01f4dae89374d04f
Opcode Fuzzy Hash: 640ecc029822f83372b14b35bfc98d394278ce3b2c251f17732a0f340bda7dbd
Instruction Fuzzy Hash: 3822243394A135DFD716DE40EC81AF7B3A1FA4532572A03AAE8459B205D33AB761CBD0

Function 030745C2 Relevance: .7, Instructions: 683COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4200376545.0000000003070000.00000040.00000800.00020000.00000000.sdmp, Offset: 03070000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3070000_YcxjdYUKIb.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0f48c67d9dd1bca67d3e522c7bf01b804d1feb5fc954b28a1f52a306fe061829
Instruction ID: ea718a40745902139b54bccac1ed3cea5874d91def0c36e466e904831966358a
Opcode Fuzzy Hash: 0f48c67d9dd1bca67d3e522c7bf01b804d1feb5fc954b28a1f52a306fe061829
Instruction Fuzzy Hash: C122143394A135DFD706DE40EC81AF7B3A1FA4532572A03AAE94597205D33AB761CBD0

Function 0307340B Relevance: .7, Instructions: 683COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4200376545.0000000003070000.00000040.00000800.00020000.00000000.sdmp, Offset: 03070000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3070000_YcxjdYUKIb.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fa6dbfe41dad59b94bad079c07caf5cbaaa623192b4fee1e50853dd43d61b3b8
Instruction ID: 9708af098921d5d027e094849bb965f154d77d2e7b8e684be50914491b09947a
Opcode Fuzzy Hash: fa6dbfe41dad59b94bad079c07caf5cbaaa623192b4fee1e50853dd43d61b3b8
Instruction Fuzzy Hash: D122243394A135DFD706DE40EC81AF7B3A1FA4532572A03AAE9459B205D33AB761CBD0

Function 03074C17 Relevance: .7, Instructions: 683COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4200376545.0000000003070000.00000040.00000800.00020000.00000000.sdmp, Offset: 03070000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3070000_YcxjdYUKIb.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 62ca14c47d35716797935a67b48efb6a8f5c9cb6eae9613e61c105324a06b9c8
Instruction ID: fc15cf3b845ed795ec77597cb1cca0beaf44accf310e1f002c21c81cd79a0681
Opcode Fuzzy Hash: 62ca14c47d35716797935a67b48efb6a8f5c9cb6eae9613e61c105324a06b9c8
Instruction Fuzzy Hash: 6822243394A135DFD716DE40EC81AF7B3A1FA4532572A03AAE84597205D33AB761CBD0

Function 03074413 Relevance: .7, Instructions: 683COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4200376545.0000000003070000.00000040.00000800.00020000.00000000.sdmp, Offset: 03070000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3070000_YcxjdYUKIb.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0defad9dd8c23448e17fd8e469b26706432b73ebad8287fc628a96e720f57286
Instruction ID: 1f30d94a4b40c58c9cddc1ac048ae3ccaf3764d49e25b3960d2529af7ac9f102
Opcode Fuzzy Hash: 0defad9dd8c23448e17fd8e469b26706432b73ebad8287fc628a96e720f57286
Instruction Fuzzy Hash: 9A22243394A135DFD706DE40EC81AF7B3A1FA4532572A03AAE94597205D33AB761CBD0

Function 03074C42 Relevance: .7, Instructions: 683COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4200376545.0000000003070000.00000040.00000800.00020000.00000000.sdmp, Offset: 03070000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3070000_YcxjdYUKIb.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 283a146ec96cc4d0b2e79e0c7c74eb472ca8f45ce42b1cb9c739d19f47d5cc4f
Instruction ID: e1256c65f8e1a3ff956f3cf0969d10ed765c5ef07fcabaa51352440bb92127ee
Opcode Fuzzy Hash: 283a146ec96cc4d0b2e79e0c7c74eb472ca8f45ce42b1cb9c739d19f47d5cc4f
Instruction Fuzzy Hash: 1A22243394A135DFD706DE40EC81AF7B3A1FA4532572A03AAE94597205D33AB761CBD0

Function 03073CA3 Relevance: .7, Instructions: 683COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4200376545.0000000003070000.00000040.00000800.00020000.00000000.sdmp, Offset: 03070000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3070000_YcxjdYUKIb.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4d3b423041d6e38493c712a8a624017f624b9c1cf8b90bad844d22d690cef32e
Instruction ID: 2fa2a6c9d442bd4b1339439b2ecb1def6b51a9afd0381bc61aaa7e18c3540267
Opcode Fuzzy Hash: 4d3b423041d6e38493c712a8a624017f624b9c1cf8b90bad844d22d690cef32e
Instruction Fuzzy Hash: C022143394A135DFD706DA40EC81AF7B3A1FA4532572E03AAE9459B205D33AB761CBD0

Function 03073CF8 Relevance: .7, Instructions: 683COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4200376545.0000000003070000.00000040.00000800.00020000.00000000.sdmp, Offset: 03070000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3070000_YcxjdYUKIb.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 251c03b603c61dcb3fcd4f7c3647a3bf2abdbb17cc91dcd0595b812f769f9ac1
Instruction ID: 69ecde97bf1d9faf0c86eeefd1fa17d220cb7c8e602b210561088c2b7e279605
Opcode Fuzzy Hash: 251c03b603c61dcb3fcd4f7c3647a3bf2abdbb17cc91dcd0595b812f769f9ac1
Instruction Fuzzy Hash: 4D22243394A135DFD706DE40EC81AF7B3A1FA4532572A03AAE4459B205D33AB761CBD0

Function 030754F8 Relevance: .7, Instructions: 683COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4200376545.0000000003070000.00000040.00000800.00020000.00000000.sdmp, Offset: 03070000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3070000_YcxjdYUKIb.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 47b5e8a393501c88baccb504ea75e8de60fc431971319868fefe6a508aa02bb0
Instruction ID: 3d1da55a0b54c4a601dc10a423bec473508f65e30766d654e630c90543a3a757
Opcode Fuzzy Hash: 47b5e8a393501c88baccb504ea75e8de60fc431971319868fefe6a508aa02bb0
Instruction Fuzzy Hash: C322243394A135DFD716DE40EC81AF7B3A1FA4532572A03AAE84597205D33AB761CBD0

Function 03075242 Relevance: .7, Instructions: 682COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4200376545.0000000003070000.00000040.00000800.00020000.00000000.sdmp, Offset: 03070000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3070000_YcxjdYUKIb.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c99d177d7e43777840bd1629e625b3fa66280eec026774e43a5f386ae7bbd42c
Instruction ID: 58ed222a52f73d4eb8bb5115b78c320f5c795607d96c44f8e0dcb3cac46e961f
Opcode Fuzzy Hash: c99d177d7e43777840bd1629e625b3fa66280eec026774e43a5f386ae7bbd42c
Instruction Fuzzy Hash: 5622243394A135DFD706DE40EC81AF7B3A1FA8532572A03AAE84597205D33AB761CBD0

Function 0307416A Relevance: .7, Instructions: 682COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4200376545.0000000003070000.00000040.00000800.00020000.00000000.sdmp, Offset: 03070000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3070000_YcxjdYUKIb.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7bf842f3c5a43264c5296b7df67f1e3ed71fa7642bf44522deba9838669f9579
Instruction ID: dd5e366b0419be0ee460ae8dd8a7c9c616799c08858223f8f16a3a392281fb8a
Opcode Fuzzy Hash: 7bf842f3c5a43264c5296b7df67f1e3ed71fa7642bf44522deba9838669f9579
Instruction Fuzzy Hash: 2922243394A135DFD716DE40EC81AF7B3A1FA8532572A03AAE84597205D33AB761CBD0

Function 030751CF Relevance: .7, Instructions: 682COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4200376545.0000000003070000.00000040.00000800.00020000.00000000.sdmp, Offset: 03070000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3070000_YcxjdYUKIb.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0c2765ef4a788a2a4bc23919dbcb8f59bf59f5d94bb0a72331a9ad1e993ecfe6
Instruction ID: d7a5795c4fbec111ee1bb80b9cbc94d391ab554b87fbef495044bf0ba0ed3e4f
Opcode Fuzzy Hash: 0c2765ef4a788a2a4bc23919dbcb8f59bf59f5d94bb0a72331a9ad1e993ecfe6
Instruction Fuzzy Hash: 7822253394A135DFD716DE40EC81AF7B3A1FA4532572A03AAE8459B205D33AB761CBD0

Function 030731CC Relevance: .7, Instructions: 682COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4200376545.0000000003070000.00000040.00000800.00020000.00000000.sdmp, Offset: 03070000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3070000_YcxjdYUKIb.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3ba38ddf5e59fd28832545194182ab391f40a8a140a7641f4f222492b162b423
Instruction ID: 24e008cb546f6db1051abe2ed01ee7c52ae7ff4d53db432b304e57286c269ca7
Opcode Fuzzy Hash: 3ba38ddf5e59fd28832545194182ab391f40a8a140a7641f4f222492b162b423
Instruction Fuzzy Hash: A922243394A135DFD706DE40EC81AF7B3A1FA4532572A03AAE9459B205D33AB761CBD0

Function 030739E7 Relevance: .7, Instructions: 682COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4200376545.0000000003070000.00000040.00000800.00020000.00000000.sdmp, Offset: 03070000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3070000_YcxjdYUKIb.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 935361790a73180c9a3f2754b6b248505ba4129b8755d1172c82ad371e403db0
Instruction ID: e03a2d08857b3f176834ed87792759dda73263ee57b153a9a37c170ca48d8741
Opcode Fuzzy Hash: 935361790a73180c9a3f2754b6b248505ba4129b8755d1172c82ad371e403db0
Instruction Fuzzy Hash: 1522243394A135DFD716DE40EC81AF7B3A1FA8532572A03AAE84597205D33AB761CBD0

Function 03073016 Relevance: .7, Instructions: 682COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4200376545.0000000003070000.00000040.00000800.00020000.00000000.sdmp, Offset: 03070000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3070000_YcxjdYUKIb.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 61123750e15819d88ee6a0ee5fa0223b1220320f6d87c11098364b6a5048fef7
Instruction ID: 217c0cdf436137605787d359ba31397cd11375e7c9b9b040245b4e58e623eb10
Opcode Fuzzy Hash: 61123750e15819d88ee6a0ee5fa0223b1220320f6d87c11098364b6a5048fef7
Instruction Fuzzy Hash: D422143394A135DFD716DA40EC81AF7B3A1FA8532572A03AAE44597205D32AB761CBD0

Function 03073059 Relevance: .7, Instructions: 682COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4200376545.0000000003070000.00000040.00000800.00020000.00000000.sdmp, Offset: 03070000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3070000_YcxjdYUKIb.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9455c4842a96e0664c354662e31a713b2a679f35ce71c412ef833796dc813161
Instruction ID: fea14885653a84c4e33c016e178da7633638336e911002c540380da20861a024
Opcode Fuzzy Hash: 9455c4842a96e0664c354662e31a713b2a679f35ce71c412ef833796dc813161
Instruction Fuzzy Hash: 4E22243394A135DFD706DE40EC81AF7B3A1FA4532572A03AAE94597205D33AB761CBD0

Function 030740DF Relevance: .7, Instructions: 682COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4200376545.0000000003070000.00000040.00000800.00020000.00000000.sdmp, Offset: 03070000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3070000_YcxjdYUKIb.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d9bd475229b77df89d7ae5279646652416c75e592eaa7d1e258b90168411c80b
Instruction ID: fecaca0db68a07144c11101544721d8667e8da49cbd95f360b8b7c998677c73e
Opcode Fuzzy Hash: d9bd475229b77df89d7ae5279646652416c75e592eaa7d1e258b90168411c80b
Instruction Fuzzy Hash: 9422143394A135DFD706DA40EC81AF7B3A1FA8532572A03AAE84597205D33AB761CBD0

Function 030750DD Relevance: .7, Instructions: 682COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4200376545.0000000003070000.00000040.00000800.00020000.00000000.sdmp, Offset: 03070000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3070000_YcxjdYUKIb.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 581bd334a15080763f798583826ffa6d9fdceee6e34345ceff4c09e0dd67fee4
Instruction ID: 3cc9826c19db4189378d6ada8020210a1ecb424c903cd92c2ae43e94152c650a
Opcode Fuzzy Hash: 581bd334a15080763f798583826ffa6d9fdceee6e34345ceff4c09e0dd67fee4
Instruction Fuzzy Hash: 1622243394A135DFD706DE40EC81AF7B3A1FA8532572A03AAE84597205D33AB761CBD0

Function 03075738 Relevance: .7, Instructions: 682COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4200376545.0000000003070000.00000040.00000800.00020000.00000000.sdmp, Offset: 03070000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3070000_YcxjdYUKIb.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1374df0643633f88ec2a871a2536569d72c4ca5069a24f353027ece8687375ae
Instruction ID: f76e19f7c618bfd294a6a49aebcb12a4b8548001cb44ba83e8e45ab0a3a94b47
Opcode Fuzzy Hash: 1374df0643633f88ec2a871a2536569d72c4ca5069a24f353027ece8687375ae
Instruction Fuzzy Hash: 4A22143394A135DFD706DA40EC81AF7B3A1FA4532572A03AAE94597205D32AB761CBD0

Function 03073797 Relevance: .7, Instructions: 682COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4200376545.0000000003070000.00000040.00000800.00020000.00000000.sdmp, Offset: 03070000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3070000_YcxjdYUKIb.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 93e7026c3f846fcad17323cb69ef733a4021fa8c8e7df4f3c5cc9a2a797e29a4
Instruction ID: 209a3be852b7d3b73521a9de58f1a2dba8e120c39b282daa13c0240a5f6dff6e
Opcode Fuzzy Hash: 93e7026c3f846fcad17323cb69ef733a4021fa8c8e7df4f3c5cc9a2a797e29a4
Instruction Fuzzy Hash: 2422253394A135DFD716DE40EC81AF7B3A1FA4532572A03AAE8459B205D33AB761CBD0

Function 030737C0 Relevance: .7, Instructions: 682COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4200376545.0000000003070000.00000040.00000800.00020000.00000000.sdmp, Offset: 03070000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3070000_YcxjdYUKIb.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4ea366e04095e809d4d5f9d8771ce88a6a158ff10065ab172707d330c25ecb27
Instruction ID: 1f780b827ed33af7a1a2a3deea9bfd56e4f2cc0e310ba1653b2e7935758080ae
Opcode Fuzzy Hash: 4ea366e04095e809d4d5f9d8771ce88a6a158ff10065ab172707d330c25ecb27
Instruction Fuzzy Hash: D322253394A135DFD706DE40EC81AF7B3A1FA4532572A03AAE84597205D33AB761CBD0

Function 0307463F Relevance: .7, Instructions: 682COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4200376545.0000000003070000.00000040.00000800.00020000.00000000.sdmp, Offset: 03070000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3070000_YcxjdYUKIb.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6fc52690b4cf42f808de5caaafc716fe0b673fac710e77ef5a47988f02c8b252
Instruction ID: cabc66c8a7160d49786a6e94b7c40e9319449df0bbaa689c9fd1638ca5207a9a
Opcode Fuzzy Hash: 6fc52690b4cf42f808de5caaafc716fe0b673fac710e77ef5a47988f02c8b252
Instruction Fuzzy Hash: 4222243394A135DFD706DA40EC81AF7B3A1FA8532572A03AAE84597205D33AB761CBD0

Function 03074E47 Relevance: .7, Instructions: 682COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4200376545.0000000003070000.00000040.00000800.00020000.00000000.sdmp, Offset: 03070000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3070000_YcxjdYUKIb.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ca5b9c4f87427ddd1c7eb425bf8304c68446d7831fcf13aa38a49dc9d2fa282c
Instruction ID: 6671250f60f579a8a93920e07b102a2a7ad0abb61411a790eef50b1140dad002
Opcode Fuzzy Hash: ca5b9c4f87427ddd1c7eb425bf8304c68446d7831fcf13aa38a49dc9d2fa282c
Instruction Fuzzy Hash: 5922253394A135DFD706DE40EC81AF7B3A1FA4532572903AAE5459B205D33AB761CBD0

Function 0307331B Relevance: .7, Instructions: 681COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4200376545.0000000003070000.00000040.00000800.00020000.00000000.sdmp, Offset: 03070000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3070000_YcxjdYUKIb.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0343e728f8d604784f246e3eb24c1f6f6a5b5c7e3897c491d2f6f670b4a396d8
Instruction ID: 7f56c0019a6736760d1f122c9586f320cb2c7eaa329604100864c93d773683e9
Opcode Fuzzy Hash: 0343e728f8d604784f246e3eb24c1f6f6a5b5c7e3897c491d2f6f670b4a396d8
Instruction Fuzzy Hash: DA22243394A135DFD706DE40EC81AF7B3A1FA4532572A03AAE54597205D33AB761CBD0

Function 03072F53 Relevance: .7, Instructions: 679COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4200376545.0000000003070000.00000040.00000800.00020000.00000000.sdmp, Offset: 03070000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3070000_YcxjdYUKIb.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f2ea6a29ddbb92721843ba34a6de52af377741c601a9e95f0b284c305f876bbd
Instruction ID: 629b63bdfb78d685986e7b6c9ebc68dd562bb7e91f9523c4e2648a6d482715ab
Opcode Fuzzy Hash: f2ea6a29ddbb92721843ba34a6de52af377741c601a9e95f0b284c305f876bbd
Instruction Fuzzy Hash: 8B22143394A135DFD706DA40EC81AF7B3A1FA8532572E03AAE5459B205D33AB761CBD0

Function 03072F9E Relevance: .7, Instructions: 679COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4200376545.0000000003070000.00000040.00000800.00020000.00000000.sdmp, Offset: 03070000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3070000_YcxjdYUKIb.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ef94efd8737ed1f82103052ba552759f8e3d46f218aa9da102ad7a565a572878
Instruction ID: fd826b9dc98ffa4623d0053b679fe2a93083d4490e50374063c6493ff5633097
Opcode Fuzzy Hash: ef94efd8737ed1f82103052ba552759f8e3d46f218aa9da102ad7a565a572878
Instruction Fuzzy Hash: 8E22243394A135DFD706DE40EC81AF7B3A1FA8532572A03AAE94597205D33AB761CBD0

Function 03072F7B Relevance: .7, Instructions: 678COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4200376545.0000000003070000.00000040.00000800.00020000.00000000.sdmp, Offset: 03070000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3070000_YcxjdYUKIb.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0abf4599881159b600529f3c0b44cdc99e2c2807276f5d6ac0d99dd0ed98ad08
Instruction ID: bd798400e5f9505a6228c0d0535545762a7cd6f9554ba580a3a33bceb2e695fd
Opcode Fuzzy Hash: 0abf4599881159b600529f3c0b44cdc99e2c2807276f5d6ac0d99dd0ed98ad08
Instruction Fuzzy Hash: F722143394A135DFD706DE40EC81AF7B3A1FA8532572A03AAE54597205D33AB761CBD0

Function 03075F60 Relevance: .3, Instructions: 279COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4200376545.0000000003070000.00000040.00000800.00020000.00000000.sdmp, Offset: 03070000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3070000_YcxjdYUKIb.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dad7ce6deca7d6040a3321586aab9e86131afcb96e2f930b26b22a7fc1883e5a
Instruction ID: 248fa01405ebdf63bee111289a57c837ae506e4328cbaa56388adac56e96a640
Opcode Fuzzy Hash: dad7ce6deca7d6040a3321586aab9e86131afcb96e2f930b26b22a7fc1883e5a
Instruction Fuzzy Hash: 48B19D71E01A699FDB11CBA8C8806ADFBF2FF88300F148669D495EB205D734ED42CB94

Function 03075F51 Relevance: .2, Instructions: 190COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4200376545.0000000003070000.00000040.00000800.00020000.00000000.sdmp, Offset: 03070000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3070000_YcxjdYUKIb.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: be9f21fd4cd42d0114b3502ebe99f0e6c68abc97ff36fa45ea378b0244bfe4d4
Instruction ID: 528d19f02c714f6d23ef041b90a1f0ae710d8a07fc58684a8cba2802e60b9f1b
Opcode Fuzzy Hash: be9f21fd4cd42d0114b3502ebe99f0e6c68abc97ff36fa45ea378b0244bfe4d4
Instruction Fuzzy Hash: A7715071E01A2E9FDB50CFA8C8806EEFBF5FB88310F148565D455E7245D734A942CB94

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is an administration feature that provides a uniform environment to access Windows system components. The WMI service enables both local and remote access, though the latter is facilitated by Remote Services such as Distributed Component Object Model (DCOM) and Windows Remote Management (WinRM).Remote WMI over DCOM operates using port 135, whereas WMI over WinRM operates over port 5985 when using HTTP and 5986 for HTTPS.
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Connection Creation, Process: Process Creation, WMI: WMI Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse PowerShell commands and scripts for execution. PowerShell is a powerful interactive command-line interface and scripting environment included in the Windows operating system.Adversaries can use PowerShell to perform a number of actions, including discovery of information and execution of code. Examples include the `Start-Process` cmdlet which can be used to run an executable and the `Invoke-Command` cmdlet which runs a command locally or on a remote computer (though administrator permissions are required to use PowerShell to connect to remote systems).
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify file time attributes to hide new or changes to existing files. Timestomping is a technique that modifies the timestamps of a file (the modify, access, create, and change times), often to mimic files that are in the same folder. This is done, for example, on files that have been modified or created by the adversary so that they do not appear conspicuous to forensic investigators or file analysis tools.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata, File: File Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the Windows Registry to gather information about the system, configuration, and installed software.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local system sources, such as file systems and configuration files or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Access, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report YcxjdYUKIb.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Yara Signatures

Initial Sample

Memory Dumps

Unpacked PEs

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Networking

System Summary

Data Obfuscation

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Data Directories

Sections

Resources

Imports

Network Behavior

Suricata IDS Alerts

Network Port Distribution

TCP Packets

DNS Answers

Statistics

Windows Analysis Report
YcxjdYUKIb.exe

Function 0309F690 Relevance: 8.2, Strings: 6, Instructions: 674
COMMON

Function 0163A740 Relevance: 5.7, Strings: 4, Instructions: 669
COMMON

Function 01630D42 Relevance: 2.7, Strings: 2, Instructions: 154
COMMON

Function 0309F330 Relevance: 2.6, Strings: 2, Instructions: 150
COMMON

Function 01630D50 Relevance: 2.6, Strings: 2, Instructions: 149
COMMON

Function 03072C40 Relevance: 2.1, Strings: 1, Instructions: 886
COMMON

Function 06470A2D Relevance: 9.4, Strings: 7, Instructions: 649
COMMON

Function 0647122F Relevance: 3.8, Strings: 3, Instructions: 84
COMMON

Function 06470B38 Relevance: 2.8, Strings: 2, Instructions: 346
COMMON

Function 0300C218 Relevance: 2.8, Strings: 2, Instructions: 314
COMMON

Function 0163BF50 Relevance: 1.6, APIs: 1, Instructions: 56
memoryCOMMON

Function 06470448 Relevance: 1.4, Strings: 1, Instructions: 179
COMMON

Function 03072C30 Relevance: 1.4, Strings: 1, Instructions: 130
COMMON

Function 06473E98 Relevance: 1.4, Strings: 1, Instructions: 101
COMMON