Edit tour

Windows Analysis Report
5RRVBiCpFI.exe

Overview

General Information

Sample name:	5RRVBiCpFI.exe renamed because original name is a hash value
Original sample name:	7fc182ca899a18d31e703dc27449a876.exe
Analysis ID:	1580855
MD5:	7fc182ca899a18d31e703dc27449a876
SHA1:	35575d85bde2dfa1668d4eca4d70d41e0b1e1736
SHA256:	93b56f4f608b2c3e894be0169dd92cc9012bde01568a22e4d6a44601657cb86b
Tags:	exeLummaStealeruser-abuse_ch
Infos:

Detection

LummaC

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Found malware configuration

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for submitted file

Suricata IDS alerts for network traffic

Yara detected LummaC Stealer

AI detected suspicious sample

C2 URLs / IPs found in malware configuration

LummaC encrypted strings found

Sample uses string decryption to hide its real strings

Contains functionality to call native functions

Contains functionality to read the PEB

Detected potential crypto function

Found inlined nop instructions (likely shell or obfuscated code)

Found potential string decryption / allocating functions

Internet Provider seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

PE file contains an invalid checksum

Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Suricata IDS alerts with low severity for network traffic

Uses 32bit PE files

Uses a known web browser user agent for HTTP communication

Uses code obfuscation techniques (call, push, ret)

Yara signature match

Classification

Process Tree

System is w10x64

5RRVBiCpFI.exe (PID: 6864 cmdline: "C:\Users\user\Desktop\5RRVBiCpFI.exe" MD5: 7FC182CA899A18D31E703DC27449A876)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Lumma Stealer, LummaC2 Stealer	Lumma Stealer (aka LummaC2 Stealer) is an information stealer written in C language that has been available through a Malware-as-a-Service (MaaS) model on Russian-speaking forums since at least August 2022. It is believed to have been developed by the threat actor "Shamel", who goes by the alias "Lumma". Lumma Stealer primarily targets cryptocurrency wallets and two-factor authentication (2FA) browser extensions, before ultimately stealing sensitive information from the victim's machine. Once the targeted data is obtained, it is exfiltrated to a C2 server via HTTP POST requests using the user agent "TeslaBrowser/5.5"." The stealer also features a non-resident loader that is capable of delivering additional payloads via EXE, DLL, and PowerShell.	No Attribution	https://0xmrmagnezi.github.io/malware%20analysis/LummaStealer/ https://0xtoxin-labs.gitbook.io/malware-analysis/malware-analysis/lummac2-breakdown#chrome-extensions-crx https://any.run/cybersecurity-blog/crackedcantil-breakdown/ https://blog.cyble.com/2023/01/06/lummac2-stealer-a-potent-threat-to-crypto-users/ https://blog.sekoia.io/exposing-fakebat-loader-distribution-methods-and-adversary-infrastructure/	https://malpedia.caad.fkie.fraunhofer.de/details/win.lumma

Malware Configuration

Threatname: LummaC

{"C2 url": ["deafeninggeh.biz", "sordid-snaked.cyou", "awake-weaves.cyou", "debonairnukk.xyz", "immureprech.biz", "diffuculttan.xyz", "wrathful-jammy.cyou", "tackybrushz.click", "effecterectz.xyz"], "Build id": "NFFFFFFFFF--*"}

Yara Signatures

PCAP (Network Traffic)

Source	Rule	Description	Author	Strings
sslproxydump.pcap	JoeSecurity_LummaCStealer_2	Yara detected LummaC Stealer	Joe Security

Memory Dumps

Source	Rule	Description	Author	Strings
00000000.00000002.1843357403.00000000022B0000.00000040.00001000.00020000.00000000.sdmp	JoeSecurity_LummaCStealer_4	Yara detected LummaC Stealer	Joe Security
00000000.00000002.1843357403.00000000022B0000.00000040.00001000.00020000.00000000.sdmp	Windows_Trojan_Donutloader_f40e3759	unknown	unknown	0x4abc0:$x64: 06 B8 03 40 00 80 C3 4C 8B 49 10 49 0x4e156:$x86: 04 75 EE 89 31 F0 FF 46 04 33 C0 EB
decrypted.memstr	JoeSecurity_LummaCStealer_2	Yara detected LummaC Stealer	Joe Security

Suricata Signatures

ET JA3 Hash - Possible Malware - Fake Firefox Font Update

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-26T12:07:12.528493+0100	2028371	3	Unknown Traffic	192.168.2.4	49731	104.21.42.145	443	TCP
2024-12-26T12:07:14.827336+0100	2028371	3	Unknown Traffic	192.168.2.4	49732	104.21.42.145	443	TCP

ET MALWARE Lumma Stealer CnC Host Checkin

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-26T12:07:13.448413+0100	2054653	1	A Network Trojan was detected	192.168.2.4	49731	104.21.42.145	443	TCP

ET MALWARE Lumma Stealer Related Activity

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-26T12:07:13.448413+0100	2049836	1	A Network Trojan was detected	192.168.2.4	49731	104.21.42.145	443	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Found malware configuration

Source: 5RRVBiCpFI.exe.6864.0.memstrmin

Malware Configuration Extractor: LummaC {"C2 url": ["deafeninggeh.biz", "sordid-snaked.cyou", "awake-weaves.cyou", "debonairnukk.xyz", "immureprech.biz", "diffuculttan.xyz", "wrathful-jammy.cyou", "tackybrushz.click", "effecterectz.xyz"], "Build id": "NFFFFFFFFF--*"}

Multi AV Scanner detection for submitted file

Source: 5RRVBiCpFI.exe	Virustotal: Detection: 61%			Perma Link
Source: 5RRVBiCpFI.exe	ReversingLabs: Detection: 60%

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 99.1% probability

Sample uses string decryption to hide its real strings

Source: 00000000.00000002.1843357403.00000000022B0000.00000040.00001000.00020000.00000000.sdmp	String decryptor: sordid-snaked.cyou
Source: 00000000.00000002.1843357403.00000000022B0000.00000040.00001000.00020000.00000000.sdmp	String decryptor: awake-weaves.cyou
Source: 00000000.00000002.1843357403.00000000022B0000.00000040.00001000.00020000.00000000.sdmp	String decryptor: wrathful-jammy.cyou
Source: 00000000.00000002.1843357403.00000000022B0000.00000040.00001000.00020000.00000000.sdmp	String decryptor: debonairnukk.xyz
Source: 00000000.00000002.1843357403.00000000022B0000.00000040.00001000.00020000.00000000.sdmp	String decryptor: diffuculttan.xyz
Source: 00000000.00000002.1843357403.00000000022B0000.00000040.00001000.00020000.00000000.sdmp	String decryptor: effecterectz.xyz
Source: 00000000.00000002.1843357403.00000000022B0000.00000040.00001000.00020000.00000000.sdmp	String decryptor: deafeninggeh.biz
Source: 00000000.00000002.1843357403.00000000022B0000.00000040.00001000.00020000.00000000.sdmp	String decryptor: immureprech.biz
Source: 00000000.00000002.1843357403.00000000022B0000.00000040.00001000.00020000.00000000.sdmp	String decryptor: tackybrushz.click
Source: 00000000.00000002.1843357403.00000000022B0000.00000040.00001000.00020000.00000000.sdmp	String decryptor: lid=%s&j=%s&ver=4.0
Source: 00000000.00000002.1843357403.00000000022B0000.00000040.00001000.00020000.00000000.sdmp	String decryptor: TeslaBrowser/5.5
Source: 00000000.00000002.1843357403.00000000022B0000.00000040.00001000.00020000.00000000.sdmp	String decryptor: - Screen Resoluton:
Source: 00000000.00000002.1843357403.00000000022B0000.00000040.00001000.00020000.00000000.sdmp	String decryptor: - Physical Installed Memory:
Source: 00000000.00000002.1843357403.00000000022B0000.00000040.00001000.00020000.00000000.sdmp	String decryptor: Workgroup: -
Source: 00000000.00000002.1843357403.00000000022B0000.00000040.00001000.00020000.00000000.sdmp	String decryptor: Jwquln--1312YT

Source: 5RRVBiCpFI.exe

Static PE information: EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, BYTES_REVERSED_LO, 32BIT_MACHINE, BYTES_REVERSED_HI

Source: unknown

HTTPS traffic detected: 104.21.42.145:443 -> 192.168.2.4:49731 version: TLS 1.2

Source: C:\Users\user\Desktop\5RRVBiCpFI.exe	Code function: 4x nop then movzx ecx, byte ptr [esp+eax-78E52646h]	0_2_022BB234
Source: C:\Users\user\Desktop\5RRVBiCpFI.exe	Code function: 4x nop then movzx edi, byte ptr [esp+eax-46h]	0_2_022BB234
Source: C:\Users\user\Desktop\5RRVBiCpFI.exe	Code function: 4x nop then movzx edx, byte ptr [esp+ecx+16h]	0_2_022BB234
Source: C:\Users\user\Desktop\5RRVBiCpFI.exe	Code function: 4x nop then mov byte ptr [esi], cl	0_2_022DE218
Source: C:\Users\user\Desktop\5RRVBiCpFI.exe	Code function: 4x nop then mov byte ptr [esi], cl	0_2_022DE269
Source: C:\Users\user\Desktop\5RRVBiCpFI.exe	Code function: 4x nop then mov byte ptr [esi], cl	0_2_022DE25A
Source: C:\Users\user\Desktop\5RRVBiCpFI.exe	Code function: 4x nop then mov edx, dword ptr [ebp-10h]	0_2_022EC2AB
Source: C:\Users\user\Desktop\5RRVBiCpFI.exe	Code function: 4x nop then cmp dword ptr [esi+edx*8], A896961Ch	0_2_022CB2A4
Source: C:\Users\user\Desktop\5RRVBiCpFI.exe	Code function: 4x nop then cmp dword ptr [edi+esi*8], 6E83E51Eh	0_2_022CB2A4
Source: C:\Users\user\Desktop\5RRVBiCpFI.exe	Code function: 4x nop then cmp dword ptr [ebp+ebx*8+00h], 6E83E51Eh	0_2_022CB2A4
Source: C:\Users\user\Desktop\5RRVBiCpFI.exe	Code function: 4x nop then cmp dword ptr [esi+edx*8], 67F3D776h	0_2_022CB2A4
Source: C:\Users\user\Desktop\5RRVBiCpFI.exe	Code function: 4x nop then cmp dword ptr [edi+esi*8], 67F3D776h	0_2_022CB2A4
Source: C:\Users\user\Desktop\5RRVBiCpFI.exe	Code function: 4x nop then cmp dword ptr [ebx+edi*8], B7C1BB11h	0_2_022CB2A4
Source: C:\Users\user\Desktop\5RRVBiCpFI.exe	Code function: 4x nop then cmp dword ptr [ebx+edi*8], 6E83E51Eh	0_2_022CB2A4
Source: C:\Users\user\Desktop\5RRVBiCpFI.exe	Code function: 4x nop then cmp dword ptr [ebx+edi*8], B430E561h	0_2_022CB2A4
Source: C:\Users\user\Desktop\5RRVBiCpFI.exe	Code function: 4x nop then movzx edi, byte ptr [esp+ecx+0233DBB1h]	0_2_022DA28D
Source: C:\Users\user\Desktop\5RRVBiCpFI.exe	Code function: 4x nop then movzx edx, byte ptr [esi+eax-00000089h]	0_2_022BF2D6
Source: C:\Users\user\Desktop\5RRVBiCpFI.exe	Code function: 4x nop then movzx edx, byte ptr [esi+eax-00000089h]	0_2_022BF2D6
Source: C:\Users\user\Desktop\5RRVBiCpFI.exe	Code function: 4x nop then movzx ebx, byte ptr [eax+ecx-3F9DFECCh]	0_2_022C036F
Source: C:\Users\user\Desktop\5RRVBiCpFI.exe	Code function: 4x nop then movzx edx, byte ptr [esp+eax+000000B8h]	0_2_022DD030
Source: C:\Users\user\Desktop\5RRVBiCpFI.exe	Code function: 4x nop then mov ecx, eax	0_2_022DD030
Source: C:\Users\user\Desktop\5RRVBiCpFI.exe	Code function: 4x nop then jmp eax	0_2_022D8006
Source: C:\Users\user\Desktop\5RRVBiCpFI.exe	Code function: 4x nop then jmp ecx	0_2_022EE068
Source: C:\Users\user\Desktop\5RRVBiCpFI.exe	Code function: 4x nop then mov edx, eax	0_2_022D9064
Source: C:\Users\user\Desktop\5RRVBiCpFI.exe	Code function: 4x nop then mov ecx, dword ptr [esi+64h]	0_2_022CA0AC
Source: C:\Users\user\Desktop\5RRVBiCpFI.exe	Code function: 4x nop then movzx edi, byte ptr [edx+eax-000000BFh]	0_2_022C90B6
Source: C:\Users\user\Desktop\5RRVBiCpFI.exe	Code function: 4x nop then cmp word ptr [ebx+ecx], 0000h	0_2_022D20E4
Source: C:\Users\user\Desktop\5RRVBiCpFI.exe	Code function: 4x nop then mov ecx, eax	0_2_022C60D3
Source: C:\Users\user\Desktop\5RRVBiCpFI.exe	Code function: 4x nop then movzx edx, byte ptr [esp+eax+000000B8h]	0_2_022DD02B
Source: C:\Users\user\Desktop\5RRVBiCpFI.exe	Code function: 4x nop then mov ecx, eax	0_2_022DD02B
Source: C:\Users\user\Desktop\5RRVBiCpFI.exe	Code function: 4x nop then movzx ebx, byte ptr [edx]	0_2_022E5164
Source: C:\Users\user\Desktop\5RRVBiCpFI.exe	Code function: 4x nop then mov byte ptr [esi], cl	0_2_022DE17E
Source: C:\Users\user\Desktop\5RRVBiCpFI.exe	Code function: 4x nop then mov eax, edx	0_2_022CE1EE
Source: C:\Users\user\Desktop\5RRVBiCpFI.exe	Code function: 4x nop then mov word ptr [eax], cx	0_2_022C81D4
Source: C:\Users\user\Desktop\5RRVBiCpFI.exe	Code function: 4x nop then cmp dword ptr [edi+edx*8], CAA82E26h	0_2_022EE654
Source: C:\Users\user\Desktop\5RRVBiCpFI.exe	Code function: 4x nop then mov ebp, dword ptr [eax]	0_2_022E8734
Source: C:\Users\user\Desktop\5RRVBiCpFI.exe	Code function: 4x nop then mov ecx, eax	0_2_022BC474
Source: C:\Users\user\Desktop\5RRVBiCpFI.exe	Code function: 4x nop then mov edx, ecx	0_2_022BC474
Source: C:\Users\user\Desktop\5RRVBiCpFI.exe	Code function: 4x nop then movzx edx, byte ptr [esp+eax+38h]	0_2_022BE44B
Source: C:\Users\user\Desktop\5RRVBiCpFI.exe	Code function: 4x nop then movzx ebx, byte ptr [ecx+edx]	0_2_022D04E4
Source: C:\Users\user\Desktop\5RRVBiCpFI.exe	Code function: 4x nop then mov ebx, dword ptr [edi+04h]	0_2_022DB4E4
Source: C:\Users\user\Desktop\5RRVBiCpFI.exe	Code function: 4x nop then cmp dword ptr [edi+esi*8], 67F3D776h	0_2_022D74C4
Source: C:\Users\user\Desktop\5RRVBiCpFI.exe	Code function: 4x nop then movzx ecx, di	0_2_022D74C4
Source: C:\Users\user\Desktop\5RRVBiCpFI.exe	Code function: 4x nop then movsx eax, byte ptr [esi]	0_2_022ED4D5
Source: C:\Users\user\Desktop\5RRVBiCpFI.exe	Code function: 4x nop then cmp dword ptr [ebx+edi*8], A269EEEFh	0_2_022E8508
Source: C:\Users\user\Desktop\5RRVBiCpFI.exe	Code function: 4x nop then mov esi, eax	0_2_022D5568
Source: C:\Users\user\Desktop\5RRVBiCpFI.exe	Code function: 4x nop then mov ecx, eax	0_2_022EC5E6
Source: C:\Users\user\Desktop\5RRVBiCpFI.exe	Code function: 4x nop then mov byte ptr [ebp+00h], al	0_2_022CFAB4
Source: C:\Users\user\Desktop\5RRVBiCpFI.exe	Code function: 4x nop then mov byte ptr [edi], al	0_2_022BEB27
Source: C:\Users\user\Desktop\5RRVBiCpFI.exe	Code function: 4x nop then movzx eax, byte ptr [eax+ecx-6A653384h]	0_2_022BEB27
Source: C:\Users\user\Desktop\5RRVBiCpFI.exe	Code function: 4x nop then jmp eax	0_2_022EDB35
Source: C:\Users\user\Desktop\5RRVBiCpFI.exe	Code function: 4x nop then cmp dword ptr [esi+ebp*8], B1025CF1h	0_2_022ECB9C
Source: C:\Users\user\Desktop\5RRVBiCpFI.exe	Code function: 4x nop then movzx esi, byte ptr [esp+edx-57437DD5h]	0_2_022ECB9C
Source: C:\Users\user\Desktop\5RRVBiCpFI.exe	Code function: 4x nop then cmp dword ptr [esi+ebp*8], B1025CF1h	0_2_022ECB91
Source: C:\Users\user\Desktop\5RRVBiCpFI.exe	Code function: 4x nop then movzx esi, byte ptr [esp+edx-57437DD5h]	0_2_022ECB91
Source: C:\Users\user\Desktop\5RRVBiCpFI.exe	Code function: 4x nop then mov word ptr [ebx], dx	0_2_022CA802
Source: C:\Users\user\Desktop\5RRVBiCpFI.exe	Code function: 4x nop then mov word ptr [ebx], cx	0_2_022CA802
Source: C:\Users\user\Desktop\5RRVBiCpFI.exe	Code function: 4x nop then mov ecx, eax	0_2_022D3844
Source: C:\Users\user\Desktop\5RRVBiCpFI.exe	Code function: 4x nop then mov word ptr [eax], dx	0_2_022C7846
Source: C:\Users\user\Desktop\5RRVBiCpFI.exe	Code function: 4x nop then movzx edi, byte ptr [edx+ecx]	0_2_022BF859
Source: C:\Users\user\Desktop\5RRVBiCpFI.exe	Code function: 4x nop then cmp dword ptr [edi+ebp*8], E88DDEA1h	0_2_022EE894
Source: C:\Users\user\Desktop\5RRVBiCpFI.exe	Code function: 4x nop then mov ecx, edx	0_2_022BD8FD
Source: C:\Users\user\Desktop\5RRVBiCpFI.exe	Code function: 4x nop then mov ecx, eax	0_2_022DC97C
Source: C:\Users\user\Desktop\5RRVBiCpFI.exe	Code function: 4x nop then mov ecx, eax	0_2_022DC958
Source: C:\Users\user\Desktop\5RRVBiCpFI.exe	Code function: 4x nop then jmp eax	0_2_022D89B1
Source: C:\Users\user\Desktop\5RRVBiCpFI.exe	Code function: 4x nop then mov ecx, eax	0_2_022DC928
Source: C:\Users\user\Desktop\5RRVBiCpFI.exe	Code function: 4x nop then movzx ecx, byte ptr [esp+eax+20h]	0_2_022D79C4
Source: C:\Users\user\Desktop\5RRVBiCpFI.exe	Code function: 4x nop then cmp dword ptr [edi+ebp*8], 88822328h	0_2_022EE9C4
Source: C:\Users\user\Desktop\5RRVBiCpFI.exe	Code function: 4x nop then cmp dword ptr [ecx+edi*8], 2298EE00h	0_2_022EEE24
Source: C:\Users\user\Desktop\5RRVBiCpFI.exe	Code function: 4x nop then movzx edx, word ptr [eax]	0_2_022EEE24
Source: C:\Users\user\Desktop\5RRVBiCpFI.exe	Code function: 4x nop then movzx ebx, byte ptr [edi+eax]	0_2_022C6E19
Source: C:\Users\user\Desktop\5RRVBiCpFI.exe	Code function: 4x nop then movzx edi, byte ptr [edx+eax-000000A8h]	0_2_022C7E11
Source: C:\Users\user\Desktop\5RRVBiCpFI.exe	Code function: 4x nop then mov word ptr [ebp+00h], 0000h	0_2_022D6E6A
Source: C:\Users\user\Desktop\5RRVBiCpFI.exe	Code function: 4x nop then cmp dword ptr [ebx+esi*8], B430E561h	0_2_022D6DF8
Source: C:\Users\user\Desktop\5RRVBiCpFI.exe	Code function: 4x nop then cmp dword ptr [ebx+esi*8], B430E561h	0_2_022D6E80
Source: C:\Users\user\Desktop\5RRVBiCpFI.exe	Code function: 4x nop then add ebp, dword ptr [esp+0Ch]	0_2_022DBF04
Source: C:\Users\user\Desktop\5RRVBiCpFI.exe	Code function: 4x nop then mov ecx, eax	0_2_022DDF90
Source: C:\Users\user\Desktop\5RRVBiCpFI.exe	Code function: 4x nop then cmp dword ptr [esi+ebp*8], B1025CF1h	0_2_022ECB8F
Source: C:\Users\user\Desktop\5RRVBiCpFI.exe	Code function: 4x nop then movzx esi, byte ptr [esp+edx-57437DD5h]	0_2_022ECB8F
Source: C:\Users\user\Desktop\5RRVBiCpFI.exe	Code function: 4x nop then cmp al, 2Eh	0_2_022D7C83
Source: C:\Users\user\Desktop\5RRVBiCpFI.exe	Code function: 4x nop then movzx esi, byte ptr [esp+edx-57437DD5h]	0_2_022ECCC9
Source: C:\Users\user\Desktop\5RRVBiCpFI.exe	Code function: 4x nop then mov ebx, edi	0_2_022CEDA4
Source: C:\Users\user\Desktop\5RRVBiCpFI.exe	Code function: 4x nop then lea eax, dword ptr [esp+18h]	0_2_022D6D9E
Source: C:\Users\user\Desktop\5RRVBiCpFI.exe	Code function: 4x nop then mov word ptr [eax], cx	0_2_022CDDF5

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 2049836 - Severity 1 - ET MALWARE Lumma Stealer Related Activity : 192.168.2.4:49731 -> 104.21.42.145:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.4:49731 -> 104.21.42.145:443

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor	URLs: deafeninggeh.biz
Source: Malware configuration extractor	URLs: sordid-snaked.cyou
Source: Malware configuration extractor	URLs: awake-weaves.cyou
Source: Malware configuration extractor	URLs: debonairnukk.xyz
Source: Malware configuration extractor	URLs: immureprech.biz
Source: Malware configuration extractor	URLs: diffuculttan.xyz
Source: Malware configuration extractor	URLs: wrathful-jammy.cyou
Source: Malware configuration extractor	URLs: tackybrushz.click
Source: Malware configuration extractor	URLs: effecterectz.xyz

Source: Joe Sandbox View

ASN Name: CLOUDFLARENETUS CLOUDFLARENETUS

Source: Joe Sandbox View

JA3 fingerprint: a0e9f5d64349fb13191bc781f81f42e1

Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:49731 -> 104.21.42.145:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:49732 -> 104.21.42.145:443

Source: global traffic

HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 8Host: tackybrushz.click

Source: unknown

UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: 5RRVBiCpFI.exe	String found in binary or memory: http://www.facebook.com/sharer.php?s=100&p[title]=Get Jihosoft Free Eraser Now!&p[summary]=I downloaded this free program to wipe data from my computer securely. Worth your try.&p[url]=http://www.jihosoft.com/security/eraser.html&p[images[0]=http://www.jihosoft.com/security/eraser/free.png equals www.facebook.com (Facebook)
Source: 5RRVBiCpFI.exe	String found in binary or memory: http://www.facebook.com/sharer.php?s=100&p[title]=Have a Try at Jihosoft Free Eraser!&p[summary]=Free tool to help you permanently remove any sensitive data from computer by overwriting.&p[url]=http://www.jihosoft.com/security/eraser.html&p[images[0]=http://www.jihosoft.com/security/eraser/free.png equals www.facebook.com (Facebook)
Source: 5RRVBiCpFI.exe	String found in binary or memory: http://www.facebook.com/sharer.php?s=100&p[title]=Jihosoft Free Eraser&p[summary]=Free Eraser Software to Wipe Sensitive Data Permanently&p[url]=http://www.jihosoft.com/security/eraser.html&p[images[0]=http://www.jihosoft.com/security/eraser/free.png equals www.facebook.com (Facebook)
Source: 5RRVBiCpFI.exe	String found in binary or memory: http://www.facebook.com/sharer.php?s=100&p[title]=Worry about Sensitive Data Reveal?&p[summary]=Get Jihosoft Free Eraser to help you permanently remove any sensitive files with ease.&p[url]=http://www.jihosoft.com/security/eraser.html&p[images[0]=http://www.jihosoft.com/security/eraser/free.png equals www.facebook.com (Facebook)
Source: 5RRVBiCpFI.exe	String found in binary or memory: https://twitter.com/intent/tweet?text=Ever tried Jihosoft Free Eraser? Permanently remove any sensitive data.&url=http://www.jihosoft.com/security/eraser.html&via=Jihosoft equals www.twitter.com (Twitter)
Source: 5RRVBiCpFI.exe	String found in binary or memory: https://twitter.com/intent/tweet?text=I strongly recommend Jihosoft Free Eraser - worth looking at.&url=http://www.jihosoft.com/security/eraser.html&via=Jihosoft equals www.twitter.com (Twitter)
Source: 5RRVBiCpFI.exe	String found in binary or memory: https://twitter.com/intent/tweet?text=Try Jihosoft Free Eraser. It helps me wipe sensitive data securely.&url=http://www.jihosoft.com/security/eraser.html&via=Jihosoft equals www.twitter.com (Twitter)
Source: 5RRVBiCpFI.exe	String found in binary or memory: https://twitter.com/intent/tweet?text=Try Jihosoft Free Eraser. It helps me wipe sensitive data securely.&url=http://www.jihosoft.com/security/eraser.html&via=JihosoftS equals www.twitter.com (Twitter)
Source: 5RRVBiCpFI.exe	String found in binary or memory: https://twitter.com/intent/tweet?text=if%20you%20don''t%20try%20freemake%20video%20converter%20now,%20you''ll%20hate%20yourself%20later.%20it''s%20free%20&url=http://www.freemake.com/free_video_downloader&via=Freemakecom equals www.twitter.com (Twitter)
Source: 5RRVBiCpFI.exe	String found in binary or memory: https://www.youtube.com/watch?v=VRjRFa12TCE equals www.youtube.com (Youtube)
Source: 5RRVBiCpFI.exe	String found in binary or memory: https://www.youtube.com/watch?v=VRjRFa12TCEOpenU equals www.youtube.com (Youtube)

Source: global traffic

DNS traffic detected: DNS query: tackybrushz.click

Source: unknown

Source: 5RRVBiCpFI.exe, 00000000.00000003.1841576121.0000000000882000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.microsoft
Source: 5RRVBiCpFI.exe	String found in binary or memory: http://www.freemake.com/free_video_downloader&via=Freemakecom
Source: 5RRVBiCpFI.exe	String found in binary or memory: http://www.jihosoft.com
Source: 5RRVBiCpFI.exe	String found in binary or memory: http://www.jihosoft.com/O-M/DL/DSJihoFreeEraser.php?v=2.1
Source: 5RRVBiCpFI.exe	String found in binary or memory: http://www.jihosoft.com/security/eraser-comparison.html
Source: 5RRVBiCpFI.exe	String found in binary or memory: http://www.jihosoft.com/security/eraser.html
Source: 5RRVBiCpFI.exe	String found in binary or memory: http://www.jihosoft.com/security/eraser.html&via=Jihosoft
Source: 5RRVBiCpFI.exe	String found in binary or memory: http://www.jihosoft.com/security/eraser.html&via=JihosoftS
Source: 5RRVBiCpFI.exe	String found in binary or memory: http://www.jihosoft.com/security/eraser.htmlS
Source: 5RRVBiCpFI.exe	String found in binary or memory: http://www.jihosoft.com/security/eraser.htmlU
Source: 5RRVBiCpFI.exe	String found in binary or memory: http://www.jihosoft.com/swconfig/eraser.json
Source: 5RRVBiCpFI.exe	String found in binary or memory: http://www.jihosoft.com/swconfig/eraserAD.xml
Source: 5RRVBiCpFI.exe	String found in binary or memory: http://www.sunisoft.cn
Source: 5RRVBiCpFI.exe	String found in binary or memory: https://plus.google.com/108645709773679776162
Source: 5RRVBiCpFI.exe	String found in binary or memory: https://plus.google.com/108645709773679776162OpenS
Source: 5RRVBiCpFI.exe, 00000000.00000002.1843022536.00000000008D3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://tackybrushz.click/
Source: 5RRVBiCpFI.exe, 00000000.00000002.1842557223.000000000084B000.00000004.00000020.00020000.00000000.sdmp, 5RRVBiCpFI.exe, 00000000.00000003.1841576121.00000000008D3000.00000004.00000020.00020000.00000000.sdmp, 5RRVBiCpFI.exe, 00000000.00000003.1841576121.0000000000842000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://tackybrushz.click/api
Source: 5RRVBiCpFI.exe, 00000000.00000003.1841576121.0000000000842000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://tackybrushz.click/api9
Source: 5RRVBiCpFI.exe, 00000000.00000002.1842557223.000000000088A000.00000004.00000020.00020000.00000000.sdmp, 5RRVBiCpFI.exe, 00000000.00000003.1841576121.0000000000882000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://tackybrushz.click/apiB
Source: 5RRVBiCpFI.exe, 00000000.00000003.1841576121.00000000008D3000.00000004.00000020.00020000.00000000.sdmp, 5RRVBiCpFI.exe, 00000000.00000002.1843022536.00000000008D3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://tackybrushz.click/eK
Source: 5RRVBiCpFI.exe, 00000000.00000003.1841576121.00000000008D3000.00000004.00000020.00020000.00000000.sdmp, 5RRVBiCpFI.exe, 00000000.00000002.1843022536.00000000008D3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://tackybrushz.click/uK
Source: 5RRVBiCpFI.exe	String found in binary or memory: https://twitter.com/intent/tweet?text=Ever
Source: 5RRVBiCpFI.exe	String found in binary or memory: https://twitter.com/intent/tweet?text=I
Source: 5RRVBiCpFI.exe	String found in binary or memory: https://twitter.com/intent/tweet?text=Try
Source: 5RRVBiCpFI.exe	String found in binary or memory: https://twitter.com/intent/tweet?text=if%20you%20don
Source: 5RRVBiCpFI.exe	String found in binary or memory: https://www.youtube.com/watch?v=VRjRFa12TCE
Source: 5RRVBiCpFI.exe	String found in binary or memory: https://www.youtube.com/watch?v=VRjRFa12TCEOpenU

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49732
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49731
Source: unknown	Network traffic detected: HTTP traffic on port 49731 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49732 -> 443

Source: unknown

HTTPS traffic detected: 104.21.42.145:443 -> 192.168.2.4:49731 version: TLS 1.2

System Summary

Malicious sample detected (through community Yara rule)

Source: 00000000.00000002.1843357403.00000000022B0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY

Matched rule: Windows_Trojan_Donutloader_f40e3759 Author: unknown

Source: C:\Users\user\Desktop\5RRVBiCpFI.exe

Code function: 0_2_022FF96C NtCreateSection,NtMapViewOfSection,VirtualAlloc,NtMapViewOfSection,VirtualProtect,VirtualProtect,VirtualProtect,CreateThread,

0_2_022FF96C

Source: C:\Users\user\Desktop\5RRVBiCpFI.exe	Code function: 0_2_022B0667	0_2_022B0667
Source: C:\Users\user\Desktop\5RRVBiCpFI.exe	Code function: 0_2_022FF96C	0_2_022FF96C
Source: C:\Users\user\Desktop\5RRVBiCpFI.exe	Code function: 0_2_022FC23C	0_2_022FC23C
Source: C:\Users\user\Desktop\5RRVBiCpFI.exe	Code function: 0_2_022BB234	0_2_022BB234
Source: C:\Users\user\Desktop\5RRVBiCpFI.exe	Code function: 0_2_022DE218	0_2_022DE218
Source: C:\Users\user\Desktop\5RRVBiCpFI.exe	Code function: 0_2_022B8214	0_2_022B8214
Source: C:\Users\user\Desktop\5RRVBiCpFI.exe	Code function: 0_2_022DE269	0_2_022DE269
Source: C:\Users\user\Desktop\5RRVBiCpFI.exe	Code function: 0_2_022DE25A	0_2_022DE25A
Source: C:\Users\user\Desktop\5RRVBiCpFI.exe	Code function: 0_2_022CB2A4	0_2_022CB2A4
Source: C:\Users\user\Desktop\5RRVBiCpFI.exe	Code function: 0_2_022BA2C4	0_2_022BA2C4
Source: C:\Users\user\Desktop\5RRVBiCpFI.exe	Code function: 0_2_022EF364	0_2_022EF364
Source: C:\Users\user\Desktop\5RRVBiCpFI.exe	Code function: 0_2_022EB364	0_2_022EB364
Source: C:\Users\user\Desktop\5RRVBiCpFI.exe	Code function: 0_2_022E73C4	0_2_022E73C4
Source: C:\Users\user\Desktop\5RRVBiCpFI.exe	Code function: 0_2_022DD030	0_2_022DD030
Source: C:\Users\user\Desktop\5RRVBiCpFI.exe	Code function: 0_2_022B0000	0_2_022B0000
Source: C:\Users\user\Desktop\5RRVBiCpFI.exe	Code function: 0_2_022CA0AC	0_2_022CA0AC
Source: C:\Users\user\Desktop\5RRVBiCpFI.exe	Code function: 0_2_022EF0B4	0_2_022EF0B4
Source: C:\Users\user\Desktop\5RRVBiCpFI.exe	Code function: 0_2_022DF0B2	0_2_022DF0B2
Source: C:\Users\user\Desktop\5RRVBiCpFI.exe	Code function: 0_2_022D20E4	0_2_022D20E4
Source: C:\Users\user\Desktop\5RRVBiCpFI.exe	Code function: 0_2_022DD02B	0_2_022DD02B
Source: C:\Users\user\Desktop\5RRVBiCpFI.exe	Code function: 0_2_022CF114	0_2_022CF114
Source: C:\Users\user\Desktop\5RRVBiCpFI.exe	Code function: 0_2_022FD114	0_2_022FD114
Source: C:\Users\user\Desktop\5RRVBiCpFI.exe	Code function: 0_2_022E7164	0_2_022E7164
Source: C:\Users\user\Desktop\5RRVBiCpFI.exe	Code function: 0_2_022DE17E	0_2_022DE17E
Source: C:\Users\user\Desktop\5RRVBiCpFI.exe	Code function: 0_2_022E615E	0_2_022E615E
Source: C:\Users\user\Desktop\5RRVBiCpFI.exe	Code function: 0_2_022CE1EE	0_2_022CE1EE
Source: C:\Users\user\Desktop\5RRVBiCpFI.exe	Code function: 0_2_022FC674	0_2_022FC674
Source: C:\Users\user\Desktop\5RRVBiCpFI.exe	Code function: 0_2_022E8734	0_2_022E8734
Source: C:\Users\user\Desktop\5RRVBiCpFI.exe	Code function: 0_2_022B4704	0_2_022B4704
Source: C:\Users\user\Desktop\5RRVBiCpFI.exe	Code function: 0_2_022C9474	0_2_022C9474
Source: C:\Users\user\Desktop\5RRVBiCpFI.exe	Code function: 0_2_022BC474	0_2_022BC474
Source: C:\Users\user\Desktop\5RRVBiCpFI.exe	Code function: 0_2_022BE44B	0_2_022BE44B
Source: C:\Users\user\Desktop\5RRVBiCpFI.exe	Code function: 0_2_022B54F4	0_2_022B54F4
Source: C:\Users\user\Desktop\5RRVBiCpFI.exe	Code function: 0_2_022D74C4	0_2_022D74C4
Source: C:\Users\user\Desktop\5RRVBiCpFI.exe	Code function: 0_2_022ED4D5	0_2_022ED4D5
Source: C:\Users\user\Desktop\5RRVBiCpFI.exe	Code function: 0_2_022B7524	0_2_022B7524
Source: C:\Users\user\Desktop\5RRVBiCpFI.exe	Code function: 0_2_022C1531	0_2_022C1531
Source: C:\Users\user\Desktop\5RRVBiCpFI.exe	Code function: 0_2_022CF514	0_2_022CF514
Source: C:\Users\user\Desktop\5RRVBiCpFI.exe	Code function: 0_2_022D5568	0_2_022D5568
Source: C:\Users\user\Desktop\5RRVBiCpFI.exe	Code function: 0_2_022D65C1	0_2_022D65C1
Source: C:\Users\user\Desktop\5RRVBiCpFI.exe	Code function: 0_2_022E2A24	0_2_022E2A24
Source: C:\Users\user\Desktop\5RRVBiCpFI.exe	Code function: 0_2_022CDA79	0_2_022CDA79
Source: C:\Users\user\Desktop\5RRVBiCpFI.exe	Code function: 0_2_022CFAB4	0_2_022CFAB4
Source: C:\Users\user\Desktop\5RRVBiCpFI.exe	Code function: 0_2_022B4AD4	0_2_022B4AD4
Source: C:\Users\user\Desktop\5RRVBiCpFI.exe	Code function: 0_2_022ECB9C	0_2_022ECB9C
Source: C:\Users\user\Desktop\5RRVBiCpFI.exe	Code function: 0_2_022E5BCC	0_2_022E5BCC
Source: C:\Users\user\Desktop\5RRVBiCpFI.exe	Code function: 0_2_022EEBD4	0_2_022EEBD4
Source: C:\Users\user\Desktop\5RRVBiCpFI.exe	Code function: 0_2_022CA802	0_2_022CA802
Source: C:\Users\user\Desktop\5RRVBiCpFI.exe	Code function: 0_2_022D3844	0_2_022D3844
Source: C:\Users\user\Desktop\5RRVBiCpFI.exe	Code function: 0_2_022BF859	0_2_022BF859
Source: C:\Users\user\Desktop\5RRVBiCpFI.exe	Code function: 0_2_022CF884	0_2_022CF884
Source: C:\Users\user\Desktop\5RRVBiCpFI.exe	Code function: 0_2_022D98D6	0_2_022D98D6
Source: C:\Users\user\Desktop\5RRVBiCpFI.exe	Code function: 0_2_022BD9B5	0_2_022BD9B5
Source: C:\Users\user\Desktop\5RRVBiCpFI.exe	Code function: 0_2_022D99D5	0_2_022D99D5
Source: C:\Users\user\Desktop\5RRVBiCpFI.exe	Code function: 0_2_022E79D4	0_2_022E79D4
Source: C:\Users\user\Desktop\5RRVBiCpFI.exe	Code function: 0_2_022EA9D4	0_2_022EA9D4
Source: C:\Users\user\Desktop\5RRVBiCpFI.exe	Code function: 0_2_022EEE24	0_2_022EEE24
Source: C:\Users\user\Desktop\5RRVBiCpFI.exe	Code function: 0_2_022CAE0E	0_2_022CAE0E
Source: C:\Users\user\Desktop\5RRVBiCpFI.exe	Code function: 0_2_022FBE6C	0_2_022FBE6C
Source: C:\Users\user\Desktop\5RRVBiCpFI.exe	Code function: 0_2_022B5EA4	0_2_022B5EA4
Source: C:\Users\user\Desktop\5RRVBiCpFI.exe	Code function: 0_2_022DAEDE	0_2_022DAEDE
Source: C:\Users\user\Desktop\5RRVBiCpFI.exe	Code function: 0_2_022EAED4	0_2_022EAED4
Source: C:\Users\user\Desktop\5RRVBiCpFI.exe	Code function: 0_2_022FAF78	0_2_022FAF78
Source: C:\Users\user\Desktop\5RRVBiCpFI.exe	Code function: 0_2_022B8FE4	0_2_022B8FE4
Source: C:\Users\user\Desktop\5RRVBiCpFI.exe	Code function: 0_2_022D2C14	0_2_022D2C14
Source: C:\Users\user\Desktop\5RRVBiCpFI.exe	Code function: 0_2_022D0C14	0_2_022D0C14
Source: C:\Users\user\Desktop\5RRVBiCpFI.exe	Code function: 0_2_022CCC15	0_2_022CCC15
Source: C:\Users\user\Desktop\5RRVBiCpFI.exe	Code function: 0_2_022C8C17	0_2_022C8C17
Source: C:\Users\user\Desktop\5RRVBiCpFI.exe	Code function: 0_2_022E0C64	0_2_022E0C64
Source: C:\Users\user\Desktop\5RRVBiCpFI.exe	Code function: 0_2_022DCC60	0_2_022DCC60
Source: C:\Users\user\Desktop\5RRVBiCpFI.exe	Code function: 0_2_022C8C7F	0_2_022C8C7F
Source: C:\Users\user\Desktop\5RRVBiCpFI.exe	Code function: 0_2_022B9C94	0_2_022B9C94
Source: C:\Users\user\Desktop\5RRVBiCpFI.exe	Code function: 0_2_022DCCF4	0_2_022DCCF4
Source: C:\Users\user\Desktop\5RRVBiCpFI.exe	Code function: 0_2_022C2D19	0_2_022C2D19
Source: C:\Users\user\Desktop\5RRVBiCpFI.exe	Code function: 0_2_022E7D14	0_2_022E7D14
Source: C:\Users\user\Desktop\5RRVBiCpFI.exe	Code function: 0_2_022BAD64	0_2_022BAD64
Source: C:\Users\user\Desktop\5RRVBiCpFI.exe	Code function: 0_2_022CEDA4	0_2_022CEDA4
Source: C:\Users\user\Desktop\5RRVBiCpFI.exe	Code function: 0_2_022B7D84	0_2_022B7D84
Source: C:\Users\user\Desktop\5RRVBiCpFI.exe	Code function: 0_2_022CDDF5	0_2_022CDDF5

Source: C:\Users\user\Desktop\5RRVBiCpFI.exe	Code function: String function: 022C5B94 appears 74 times
Source: C:\Users\user\Desktop\5RRVBiCpFI.exe	Code function: String function: 022B9AA4 appears 78 times

Source: 5RRVBiCpFI.exe

Static PE information: EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, BYTES_REVERSED_LO, 32BIT_MACHINE, BYTES_REVERSED_HI

Source: 00000000.00000002.1843357403.00000000022B0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY

Matched rule: Windows_Trojan_Donutloader_f40e3759 os = windows, severity = x86, creation_date = 2021-09-15, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Donutloader, fingerprint = 6400b34f762cebb4f91a8d24c5fce647e069a971fb3ec923a63aa98c8cfffab7, id = f40e3759-2531-4e21-946a-fb55104814c0, last_modified = 2022-01-13

Source: classification engine

Classification label: mal100.troj.evad.winEXE@1/0@1/1

Source: C:\Users\user\Desktop\5RRVBiCpFI.exe

Code function: 0_2_022B0D77 CreateToolhelp32Snapshot,Thread32First,Wow64SuspendThread,CloseHandle,

0_2_022B0D77

Source: C:\Users\user\Desktop\5RRVBiCpFI.exe

Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales

Jump to behavior

Source: C:\Users\user\Desktop\5RRVBiCpFI.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: 5RRVBiCpFI.exe	Virustotal: Detection: 61%
Source: 5RRVBiCpFI.exe	ReversingLabs: Detection: 60%

Source: 5RRVBiCpFI.exe	String found in binary or memory: <html><head><META http-equiv=Content-Type content="text/html; charset=utf-8"></head><body><!--StartFragment-->
Source: 5RRVBiCpFI.exe	String found in binary or memory: n<html><head><META http-equiv=Content-Type content="text/html; charset=utf-8"></head><body><!--StartFragment-->

Source: C:\Users\user\Desktop\5RRVBiCpFI.exe

File read: C:\Users\user\Desktop\5RRVBiCpFI.exe

Jump to behavior

Source: C:\Users\user\Desktop\5RRVBiCpFI.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\5RRVBiCpFI.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\5RRVBiCpFI.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\Desktop\5RRVBiCpFI.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\Desktop\5RRVBiCpFI.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\Desktop\5RRVBiCpFI.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\5RRVBiCpFI.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\5RRVBiCpFI.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\5RRVBiCpFI.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\Desktop\5RRVBiCpFI.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\5RRVBiCpFI.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Users\user\Desktop\5RRVBiCpFI.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\5RRVBiCpFI.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\5RRVBiCpFI.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\5RRVBiCpFI.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\5RRVBiCpFI.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\5RRVBiCpFI.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\Desktop\5RRVBiCpFI.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\Desktop\5RRVBiCpFI.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Users\user\Desktop\5RRVBiCpFI.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Users\user\Desktop\5RRVBiCpFI.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\5RRVBiCpFI.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\Desktop\5RRVBiCpFI.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Users\user\Desktop\5RRVBiCpFI.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\5RRVBiCpFI.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\5RRVBiCpFI.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\5RRVBiCpFI.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\5RRVBiCpFI.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\5RRVBiCpFI.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\5RRVBiCpFI.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\5RRVBiCpFI.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\5RRVBiCpFI.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Users\user\Desktop\5RRVBiCpFI.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\5RRVBiCpFI.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\5RRVBiCpFI.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior

Source: 5RRVBiCpFI.exe

Static file information: File size 2369536 > 1048576

Source: 5RRVBiCpFI.exe	Static PE information: Raw size of CODE is bigger than: 0x100000 < 0x125a00
Source: 5RRVBiCpFI.exe	Static PE information: Raw size of .rsrc is bigger than: 0x100000 < 0x101e00

Source: 5RRVBiCpFI.exe

Static PE information: real checksum: 0x6cc007b should be: 0x24a8b0

Source: C:\Users\user\Desktop\5RRVBiCpFI.exe	Code function: 0_2_022EDA34 push eax; mov dword ptr [esp], 49484716h		0_2_022EDA35
Source: C:\Users\user\Desktop\5RRVBiCpFI.exe	Code function: 0_2_022CC82A push esp; iretd		0_2_022CC833

Source: C:\Users\user\Desktop\5RRVBiCpFI.exe

Process information set: NOOPENFILEERRORBOX

Jump to behavior

Source: C:\Users\user\Desktop\5RRVBiCpFI.exe TID: 6260	Thread sleep time: -30000s >= -30000s			Jump to behavior
Source: C:\Users\user\Desktop\5RRVBiCpFI.exe TID: 3616	Thread sleep time: -30000s >= -30000s			Jump to behavior

Source: C:\Users\user\Desktop\5RRVBiCpFI.exe

WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_BIOS

Source: 5RRVBiCpFI.exe, 00000000.00000003.1841576121.0000000000882000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWu
Source: 5RRVBiCpFI.exe, 00000000.00000003.1841576121.0000000000842000.00000004.00000020.00020000.00000000.sdmp, 5RRVBiCpFI.exe, 00000000.00000003.1841576121.0000000000882000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW

Source: C:\Users\user\Desktop\5RRVBiCpFI.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Users\user\Desktop\5RRVBiCpFI.exe	Code function: 0_2_022B0667 mov edx, dword ptr fs:[00000030h]	0_2_022B0667
Source: C:\Users\user\Desktop\5RRVBiCpFI.exe	Code function: 0_2_022B0C27 mov eax, dword ptr fs:[00000030h]	0_2_022B0C27
Source: C:\Users\user\Desktop\5RRVBiCpFI.exe	Code function: 0_2_022B1277 mov eax, dword ptr fs:[00000030h]	0_2_022B1277
Source: C:\Users\user\Desktop\5RRVBiCpFI.exe	Code function: 0_2_022B1276 mov eax, dword ptr fs:[00000030h]	0_2_022B1276
Source: C:\Users\user\Desktop\5RRVBiCpFI.exe	Code function: 0_2_022B0FD7 mov eax, dword ptr fs:[00000030h]	0_2_022B0FD7

HIPS / PFW / Operating System Protection Evasion

LummaC encrypted strings found

Source: 5RRVBiCpFI.exe	String found in binary or memory: tackybrushz.click
Source: 5RRVBiCpFI.exe	String found in binary or memory: diffuculttan.xyz
Source: 5RRVBiCpFI.exe	String found in binary or memory: effecterectz.xyz
Source: 5RRVBiCpFI.exe	String found in binary or memory: deafeninggeh.biz
Source: 5RRVBiCpFI.exe	String found in binary or memory: immureprech.biz
Source: 5RRVBiCpFI.exe	String found in binary or memory: debonairnukk.xyz

Source: C:\Users\user\Desktop\5RRVBiCpFI.exe

Queries volume information: C:\ VolumeInformation

Jump to behavior

Source: C:\Users\user\Desktop\5RRVBiCpFI.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Stealing of Sensitive Information

Yara detected LummaC Stealer

Source: Yara match	File source: 00000000.00000002.1843357403.00000000022B0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: sslproxydump.pcap, type: PCAP
Source: Yara match	File source: decrypted.memstr, type: MEMORYSTR

Remote Access Functionality

Yara detected LummaC Stealer

Source: Yara match	File source: 00000000.00000002.1843357403.00000000022B0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: sslproxydump.pcap, type: PCAP
Source: Yara match	File source: decrypted.memstr, type: MEMORYSTR

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	1 Windows Management Instrumentation	1 DLL Side-Loading	1 DLL Side-Loading	1 Virtualization/Sandbox Evasion	OS Credential Dumping	1 Security Software Discovery	Remote Services	1 Archive Collected Data	11 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	2 Command and Scripting Interpreter	Boot or Logon Initialization Scripts	Boot or Logon Initialization Scripts	11 Deobfuscate/Decode Files or Information	LSASS Memory	1 Virtualization/Sandbox Evasion	Remote Desktop Protocol	Data from Removable Media	2 Non-Application Layer Protocol	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	1 PowerShell	Logon Script (Windows)	Logon Script (Windows)	3 Obfuscated Files or Information	Security Account Manager	2 Process Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	113 Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	1 DLL Side-Loading	NTDS	22 System Information Discovery	Distributed Component Object Model	Input Capture	Protocol Impersonation	Traffic Duplication	Data Destruction

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
5RRVBiCpFI.exe	61%	Virustotal		Browse
5RRVBiCpFI.exe	61%	ReversingLabs	Win32.Exploit.LummaC

Source	Detection	Scanner	Label
http://www.jihosoft.com/security/eraser.html&via=Jihosoft	0%	Avira URL Cloud	safe
https://tackybrushz.click/api9	0%	Avira URL Cloud	safe
https://tackybrushz.click/uK	0%	Avira URL Cloud	safe
http://www.jihosoft.com/swconfig/eraser.json	0%	Avira URL Cloud	safe
http://www.jihosoft.com/security/eraser-comparison.html	0%	Avira URL Cloud	safe
tackybrushz.click	0%	Avira URL Cloud	safe
https://tackybrushz.click/api	0%	Avira URL Cloud	safe
https://tackybrushz.click/eK	0%	Avira URL Cloud	safe
http://www.jihosoft.com/security/eraser.html&via=JihosoftS	0%	Avira URL Cloud	safe
http://www.sunisoft.cn	0%	Avira URL Cloud	safe
http://www.jihosoft.com/security/eraser.htmlU	0%	Avira URL Cloud	safe
https://tackybrushz.click/	0%	Avira URL Cloud	safe
http://www.jihosoft.com/security/eraser.htmlS	0%	Avira URL Cloud	safe
http://www.jihosoft.com/security/eraser.html	0%	Avira URL Cloud	safe
http://www.jihosoft.com	0%	Avira URL Cloud	safe
http://www.jihosoft.com/O-M/DL/DSJihoFreeEraser.php?v=2.1	0%	Avira URL Cloud	safe
https://tackybrushz.click/apiB	0%	Avira URL Cloud	safe
http://www.jihosoft.com/swconfig/eraserAD.xml	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
tackybrushz.click	104.21.42.145	true	true		unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
sordid-snaked.cyou	false		high
awake-weaves.cyou	false		high
immureprech.biz	false		high
deafeninggeh.biz	false		high
https://tackybrushz.click/api	true	Avira URL Cloud: safe	unknown
debonairnukk.xyz	false		high
diffuculttan.xyz	false		high
effecterectz.xyz	false		high
tackybrushz.click	true	Avira URL Cloud: safe	unknown
wrathful-jammy.cyou	false		high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://www.youtube.com/watch?v=VRjRFa12TCE	5RRVBiCpFI.exe	false		high
http://www.freemake.com/free_video_downloader&via=Freemakecom	5RRVBiCpFI.exe	false		high
https://plus.google.com/108645709773679776162OpenS	5RRVBiCpFI.exe	false		high
http://www.jihosoft.com/swconfig/eraser.json	5RRVBiCpFI.exe	false	Avira URL Cloud: safe	unknown
http://crl.microsoft	5RRVBiCpFI.exe, 00000000.00000003.1841576121.0000000000882000.00000004.00000020.00020000.00000000.sdmp	false		high
http://www.jihosoft.com/security/eraser.html&via=Jihosoft	5RRVBiCpFI.exe	false	Avira URL Cloud: safe	unknown
https://tackybrushz.click/api9	5RRVBiCpFI.exe, 00000000.00000003.1841576121.0000000000842000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://twitter.com/intent/tweet?text=I	5RRVBiCpFI.exe	false		high
https://tackybrushz.click/uK	5RRVBiCpFI.exe, 00000000.00000003.1841576121.00000000008D3000.00000004.00000020.00020000.00000000.sdmp, 5RRVBiCpFI.exe, 00000000.00000002.1843022536.00000000008D3000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.jihosoft.com/security/eraser-comparison.html	5RRVBiCpFI.exe	false	Avira URL Cloud: safe	unknown
https://twitter.com/intent/tweet?text=Try	5RRVBiCpFI.exe	false		high
https://twitter.com/intent/tweet?text=Ever	5RRVBiCpFI.exe	false		high
http://www.jihosoft.com/security/eraser.html&via=JihosoftS	5RRVBiCpFI.exe	false	Avira URL Cloud: safe	unknown
http://www.sunisoft.cn	5RRVBiCpFI.exe	false	Avira URL Cloud: safe	unknown
https://tackybrushz.click/eK	5RRVBiCpFI.exe, 00000000.00000003.1841576121.00000000008D3000.00000004.00000020.00020000.00000000.sdmp, 5RRVBiCpFI.exe, 00000000.00000002.1843022536.00000000008D3000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.jihosoft.com/security/eraser.htmlU	5RRVBiCpFI.exe	false	Avira URL Cloud: safe	unknown
http://www.jihosoft.com/security/eraser.htmlS	5RRVBiCpFI.exe	false	Avira URL Cloud: safe	unknown
https://tackybrushz.click/	5RRVBiCpFI.exe, 00000000.00000002.1843022536.00000000008D3000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://twitter.com/intent/tweet?text=if%20you%20don	5RRVBiCpFI.exe	false		high
http://www.jihosoft.com	5RRVBiCpFI.exe	false	Avira URL Cloud: safe	unknown
https://www.youtube.com/watch?v=VRjRFa12TCEOpenU	5RRVBiCpFI.exe	false		high
http://www.jihosoft.com/O-M/DL/DSJihoFreeEraser.php?v=2.1	5RRVBiCpFI.exe	false	Avira URL Cloud: safe	unknown
http://www.jihosoft.com/security/eraser.html	5RRVBiCpFI.exe	false	Avira URL Cloud: safe	unknown
https://tackybrushz.click/apiB	5RRVBiCpFI.exe, 00000000.00000002.1842557223.000000000088A000.00000004.00000020.00020000.00000000.sdmp, 5RRVBiCpFI.exe, 00000000.00000003.1841576121.0000000000882000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://plus.google.com/108645709773679776162	5RRVBiCpFI.exe	false		high
http://www.jihosoft.com/swconfig/eraserAD.xml	5RRVBiCpFI.exe	false	Avira URL Cloud: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
104.21.42.145	tackybrushz.click	United States		13335	CLOUDFLARENETUS	true

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1580855
Start date and time:	2024-12-26 12:06:06 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 3m 21s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	4
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	5RRVBiCpFI.exe renamed because original name is a hash value
Original Sample Name:	7fc182ca899a18d31e703dc27449a876.exe
Detection:	MAL
Classification:	mal100.troj.evad.winEXE@1/0@1/1
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 100% Number of executed functions: 8 Number of non-executed functions: 119
Cookbook Comments:	Found application associated with file extension: .exe Stop behavior analysis, all processes terminated

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, SIHClient.exe, conhost.exe
Excluded IPs from analysis (whitelisted): 4.175.87.197, 13.107.246.63
Excluded domains from analysis (whitelisted): ocsp.digicert.com, slscr.update.microsoft.com, otelrules.azureedge.net, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com
Not all processes where analyzed, report is missing behavior information
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtQueryValueKey calls found.

Simulations

Behavior and APIs

Time	Type	Description
06:07:12	API Interceptor	2x Sleep call for process: 5RRVBiCpFI.exe modified

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
CLOUDFLARENETUS	MPySEh8HaF.exe	Get hash	malicious	LummaC	Browse	172.67.180.113
	Dotc67890990.exe	Get hash	malicious	Snake Keylogger	Browse	104.21.27.85
	67VB5TS184.exe	Get hash	malicious	DCRat, PureLog Stealer, zgRAT	Browse	104.21.38.84
	http://booking.extranetguests.com/	Get hash	malicious	CAPTCHA Scam ClickFix	Browse	172.67.220.52
	ciwa.mp4.hta	Get hash	malicious	LummaC, PureLog Stealer	Browse	104.21.94.92
	Google Authenticator You're trying to sign in from a new location.msg	Get hash	malicious	Unknown	Browse	162.159.128.61
	xd.arm7.elf	Get hash	malicious	Mirai	Browse	162.159.16.108
	INQUIRY.exe	Get hash	malicious	MassLogger RAT, PureLog Stealer	Browse	172.67.177.134
	https://webmail.buzja.com/?auth=byoungjo.yoo@hyundaimovex.com	Get hash	malicious	HTMLPhisher	Browse	172.67.167.59
	Set-up.exe	Get hash	malicious	LummaC	Browse	172.67.214.186

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
a0e9f5d64349fb13191bc781f81f42e1	MPySEh8HaF.exe	Get hash	malicious	LummaC	Browse	104.21.42.145
	Delivery form - Airway bill details - Tracking info 45821631127I ,pdf.scr.exe	Get hash	malicious	DBatLoader, FormBook	Browse	104.21.42.145
	ciwa.mp4.hta	Get hash	malicious	LummaC, PureLog Stealer	Browse	104.21.42.145
	Set-up.exe	Get hash	malicious	LummaC	Browse	104.21.42.145
	setup.exe	Get hash	malicious	LummaC	Browse	104.21.42.145
	Set-up.exe	Get hash	malicious	LummaC Stealer	Browse	104.21.42.145
	SET_UP.exe	Get hash	malicious	LummaC	Browse	104.21.42.145
	00000.ps1	Get hash	malicious	LummaC	Browse	104.21.42.145
	123.ps1	Get hash	malicious	LummaC	Browse	104.21.42.145

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	6.93943658473428
TrID:	Win32 Executable (generic) a (10002005/4) 98.96% InstallShield setup (43055/19) 0.43% Win32 EXE PECompact compressed (generic) (41571/9) 0.41% Win32 Executable Delphi generic (14689/80) 0.15% Win16/32 Executable Delphi generic (2074/23) 0.02%
File name:	5RRVBiCpFI.exe
File size:	2'369'536 bytes
MD5:	7fc182ca899a18d31e703dc27449a876
SHA1:	35575d85bde2dfa1668d4eca4d70d41e0b1e1736
SHA256:	93b56f4f608b2c3e894be0169dd92cc9012bde01568a22e4d6a44601657cb86b
SHA512:	b97dda59d74a5ac7d636a4c5b7fc6fd35f933d8c805f1fd22eb940203ec9c0239dc2ad338e843104368149f1afc7483a5eb5ce62cbedd165d8dc4beb6d0b9766
SSDEEP:	24576:EWzHNoHAwjYBAA8PdkZCiJ3yp6ZYZxlfU1g+pCpSjNCclwoll2VzJ+/SW9IqGvDw:FFAtPdkEoyQ1Rrllcz8qmMiLv
TLSH:	9DB59E22F242C863D46719388C4BA6B85435FE526E39AD7B37F87D1C8F366837815287
File Content Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7.......................................................................................................................................

File Icon


Icon Hash:	062b614c27dc602f

Static PE Info

General

Entrypoint:	0x5267ec
Entrypoint Section:	CODE
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, BYTES_REVERSED_LO, 32BIT_MACHINE, BYTES_REVERSED_HI
DLL Characteristics:
Time Stamp:	0x2A425E19 [Fri Jun 19 22:22:17 1992 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:	1133a16cf68dab07a13253f3f67f0626

Entrypoint Preview

Instruction
push ebp
mov ebp, esp
add esp, FFFFFFF0h
mov eax, 005261ECh
call 00007F22246C7425h
mov eax, dword ptr [0052C4DCh]
mov eax, dword ptr [eax]
call 00007F22247323ADh
mov ecx, dword ptr [0052C300h]
mov eax, dword ptr [0052C4DCh]
mov eax, dword ptr [eax]
mov edx, dword ptr [0051FA98h]
call 00007F22247323ADh
mov eax, dword ptr [0052C4DCh]
mov eax, dword ptr [eax]
call 00007F2224732421h
call 00007F22246C4C24h
lea eax, dword ptr [eax+00h]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x12f000	0x2cee	.idata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x147000	0x101e00	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x134000	0x12278	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x133000	0x18	.rdata
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
CODE	0x1000	0x125834	0x125a00	d5fe699b4b0398abb412ba25bdff82ab	False	0.5005437819284803	data	6.590525369558882	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
DATA	0x127000	0x5800	0x5800	7962d3013d898cd6f11882d8bdd046f1	False	0.4740323153409091	data	5.287381992393107	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
BSS	0x12d000	0x1a61	0x0	d41d8cd98f00b204e9800998ecf8427e	False	0	empty	0.0	IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.idata	0x12f000	0x2cee	0x2e00	e670e534e6f64ae8087cd6d91cd0454a	False	0.36124320652173914	data	5.0088263356197125	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.tls	0x132000	0x10	0x0	d41d8cd98f00b204e9800998ecf8427e	False	0	empty	0.0	IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rdata	0x133000	0x18	0x200	c1d1d46389c4811f6147e35bb0ba3244	False	0.05078125	MacBinary, Mon Feb 6 07:28:16 2040 INVALID date, modified Mon Feb 6 07:28:16 2040 "S"	0.2069200177871819	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_SHARED, IMAGE_SCN_MEM_READ
.reloc	0x134000	0x12278	0x12400	73052c4011dc9054a85f5d232b05075c	False	0.5440122003424658	data	6.655570258331296	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_SHARED, IMAGE_SCN_MEM_READ
.rsrc	0x147000	0x101e00	0x101e00	ed4426e780d76a69a414cba1a66ade18	False	0.48206211373000485	data	6.9453030538277165	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_SHARED, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_CURSOR	0x14cb34	0x134	Targa image data - Map 64 x 65536 x 1 +32 "\001"			0.38636363636363635
RT_CURSOR	0x14cc68	0x134	data			0.4642857142857143
RT_CURSOR	0x14cd9c	0x134	data			0.4805194805194805
RT_CURSOR	0x14ced0	0x134	data			0.38311688311688313
RT_CURSOR	0x14d004	0x134	data			0.36038961038961037
RT_CURSOR	0x14d138	0x134	data			0.4090909090909091
RT_CURSOR	0x14d26c	0x134	Targa image data - RGB 64 x 65536 x 1 +32 "\001"			0.4967532467532468
RT_CURSOR	0x14d3a0	0x2ec	Targa image data 64 x 65536 x 1 +32 "\004"	German	Germany	0.19385026737967914
RT_CURSOR	0x14d68c	0x2ec	Targa image data 64 x 65536 x 1 +32 "\004"	German	Germany	0.18716577540106952
RT_CURSOR	0x14d978	0x2ec	Targa image data 64 x 65536 x 1 +32 "\004"	German	Germany	0.2179144385026738
RT_CURSOR	0x14dc64	0x2ec	Targa image data 64 x 65536 x 1 +32 "\004"	German	Germany	0.21122994652406418
RT_CURSOR	0x14df50	0x134	AmigaOS bitmap font "(", fc_YSize 4294967064, 3584 elements, 2nd "\377\270w\377\377\370\177\377\377\370\177\377\377\370\177\377\377\370\177\377\377\370\177\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377", 3rd	German	Germany	0.32792207792207795
RT_CURSOR	0x14e084	0x134	Targa image data 64 x 65536 x 1 +32 "\001"	German	Germany	0.5292207792207793
RT_CURSOR	0x14e1b8	0x134	Targa image data 64 x 65536 x 1 +32 "\001"			0.3538961038961039
RT_CURSOR	0x14e2ec	0x2ec	Targa image data 64 x 65536 x 1 +32 "\004"	German	Germany	0.18983957219251338
RT_CURSOR	0x14e5d8	0x2ec	Targa image data 64 x 65536 x 1 +32 "\004"	German	Germany	0.19117647058823528
RT_CURSOR	0x14e8c4	0x2ec	Targa image data 64 x 65536 x 1 +32 "\004"	German	Germany	0.19786096256684493
RT_CURSOR	0x14ebb0	0x2ec	Targa image data 64 x 65536 x 1 +32 "\004"	German	Germany	0.18983957219251338
RT_CURSOR	0x14ee9c	0x2ec	Targa image data 64 x 65536 x 1 +32 "\004"	German	Germany	0.19518716577540107
RT_CURSOR	0x14f188	0x2ec	Targa image data 64 x 65536 x 1 +32 "\004"	German	Germany	0.19518716577540107
RT_BITMAP	0x14f474	0x1d0	Device independent bitmap graphic, 36 x 18 x 4, image size 360			0.43103448275862066
RT_BITMAP	0x14f644	0x1e4	Device independent bitmap graphic, 36 x 19 x 4, image size 380			0.46487603305785125
RT_BITMAP	0x14f828	0x1d0	Device independent bitmap graphic, 36 x 18 x 4, image size 360			0.43103448275862066
RT_BITMAP	0x14f9f8	0x1d0	Device independent bitmap graphic, 36 x 18 x 4, image size 360			0.39870689655172414
RT_BITMAP	0x14fbc8	0x1d0	Device independent bitmap graphic, 36 x 18 x 4, image size 360			0.4245689655172414
RT_BITMAP	0x14fd98	0x1d0	Device independent bitmap graphic, 36 x 18 x 4, image size 360			0.5021551724137931
RT_BITMAP	0x14ff68	0x1d0	Device independent bitmap graphic, 36 x 18 x 4, image size 360			0.5064655172413793
RT_BITMAP	0x150138	0x1d0	Device independent bitmap graphic, 36 x 18 x 4, image size 360			0.39655172413793105
RT_BITMAP	0x150308	0x1d0	Device independent bitmap graphic, 36 x 18 x 4, image size 360			0.5344827586206896
RT_BITMAP	0x1504d8	0x1d0	Device independent bitmap graphic, 36 x 18 x 4, image size 360			0.39655172413793105
RT_BITMAP	0x1506a8	0x1ca0	Device independent bitmap graphic, 231 x 27 x 8, image size 6264	Chinese	China	0.11544759825327511
RT_BITMAP	0x152348	0x1d4	Device independent bitmap graphic, 52 x 13 x 4, image size 364	Chinese	China	0.3141025641025641
RT_BITMAP	0x15251c	0x170	Device independent bitmap graphic, 44 x 11 x 4, image size 264	Chinese	China	0.39402173913043476
RT_BITMAP	0x15268c	0x450	Device independent bitmap graphic, 1 x 10 x 8, image size 40	Chinese	China	0.09148550724637682
RT_BITMAP	0x152adc	0x1d4	Device independent bitmap graphic, 52 x 13 x 4, image size 364	Chinese	China	0.43803418803418803
RT_BITMAP	0x152cb0	0x3a8	Device independent bitmap graphic, 102 x 16 x 4, image size 832	Chinese	China	0.3557692307692308
RT_BITMAP	0x153058	0x5a8	Device independent bitmap graphic, 21 x 16 x 8, image size 384	Chinese	China	0.42472375690607733
RT_BITMAP	0x153600	0xbc	Device independent bitmap graphic, 1 x 21 x 4, image size 84	Chinese	China	0.5851063829787234
RT_BITMAP	0x1536bc	0x6d8	Device independent bitmap graphic, 8 x 86 x 8, image size 688	Chinese	China	0.4001141552511416
RT_BITMAP	0x153d94	0x134	Device independent bitmap graphic, 18 x 17 x 4, image size 204	Chinese	China	0.4512987012987013
RT_BITMAP	0x153ec8	0x90	Device independent bitmap graphic, 10 x 5 x 4, image size 40	Chinese	China	0.6736111111111112
RT_BITMAP	0x153f58	0xd2c	Device independent bitmap graphic, 342 x 19 x 4, image size 3268	Chinese	China	0.14383155397390274
RT_BITMAP	0x154c84	0x1b5c	Device independent bitmap graphic, 179 x 33 x 8, image size 5940	Chinese	China	0.23557966876070816
RT_BITMAP	0x1567e0	0x194c	Device independent bitmap graphic, 162 x 33 x 8, image size 5412	Chinese	China	0.2652872143298332
RT_BITMAP	0x15812c	0x1190	Device independent bitmap graphic, 101 x 33 x 8, image size 3432	Chinese	China	0.18683274021352314
RT_BITMAP	0x1592bc	0x24a	Device independent bitmap graphic, 45 x 4 x 24, image size 0, resolution 2834 x 2834 px/m	Chinese	China	0.10580204778156997
RT_BITMAP	0x159508	0x2fa	Device independent bitmap graphic, 11 x 20 x 24, image size 0, resolution 2834 x 2834 px/m	Chinese	China	0.32545931758530183
RT_BITMAP	0x159804	0x2fe	Device independent bitmap graphic, 18 x 11 x 8, image size 0, resolution 2834 x 2834 px/m, 126 important colors	Chinese	China	0.8733681462140992
RT_BITMAP	0x159b04	0xc0	Device independent bitmap graphic, 16 x 11 x 4, image size 88, 16 important colors			0.5208333333333334
RT_BITMAP	0x159bc4	0xe0	Device independent bitmap graphic, 16 x 15 x 4, image size 120, 16 important colors			0.42857142857142855
RT_BITMAP	0x159ca4	0xe0	Device independent bitmap graphic, 16 x 15 x 4, image size 120, 16 important colors			0.4955357142857143
RT_BITMAP	0x159d84	0x5c	Device independent bitmap graphic, 6 x 11 x 1, image size 44			0.391304347826087
RT_BITMAP	0x159de0	0x5c	Device independent bitmap graphic, 6 x 11 x 1, image size 44			0.532608695652174
RT_BITMAP	0x159e3c	0x5c	Device independent bitmap graphic, 6 x 11 x 1, image size 44			0.4782608695652174
RT_BITMAP	0x159e98	0x5c	Device independent bitmap graphic, 6 x 11 x 1, image size 44			0.5543478260869565
RT_BITMAP	0x159ef4	0x5c	Device independent bitmap graphic, 6 x 11 x 1, image size 44			0.4673913043478261
RT_BITMAP	0x159f50	0xe28	Device independent bitmap graphic, 160 x 16 x 8, image size 2560	Chinese	China	0.467439293598234
RT_BITMAP	0x15ad78	0x138	Device independent bitmap graphic, 28 x 13 x 4, image size 208			0.41025641025641024
RT_BITMAP	0x15aeb0	0x138	Device independent bitmap graphic, 28 x 13 x 4, image size 208			0.27564102564102566
RT_BITMAP	0x15afe8	0x138	Device independent bitmap graphic, 28 x 13 x 4, image size 208			0.3685897435897436
RT_BITMAP	0x15b120	0x138	Device independent bitmap graphic, 28 x 13 x 4, image size 208			0.3685897435897436
RT_BITMAP	0x15b258	0x138	Device independent bitmap graphic, 28 x 13 x 4, image size 208			0.34294871794871795
RT_BITMAP	0x15b390	0x138	Device independent bitmap graphic, 28 x 13 x 4, image size 208			0.3717948717948718
RT_BITMAP	0x15b4c8	0x104	Device independent bitmap graphic, 20 x 13 x 4, image size 156			0.5038461538461538
RT_BITMAP	0x15b5cc	0x138	Device independent bitmap graphic, 28 x 13 x 4, image size 208			0.4326923076923077
RT_BITMAP	0x15b704	0x104	Device independent bitmap graphic, 20 x 13 x 4, image size 156			0.5153846153846153
RT_BITMAP	0x15b808	0x138	Device independent bitmap graphic, 28 x 13 x 4, image size 208			0.46474358974358976
RT_BITMAP	0x15b940	0x998	Device independent bitmap graphic, 222 x 21 x 4, image size 2352	Chinese	China	0.05578175895765472
RT_BITMAP	0x15c2d8	0x1d4	Device independent bitmap graphic, 52 x 13 x 4, image size 364	Chinese	China	0.23931623931623933
RT_BITMAP	0x15c4ac	0x170	Device independent bitmap graphic, 44 x 11 x 4, image size 264	Chinese	China	0.29891304347826086
RT_BITMAP	0x15c61c	0x450	Device independent bitmap graphic, 1 x 10 x 8, image size 40	Chinese	China	0.04528985507246377
RT_BITMAP	0x15ca6c	0x1d4	Device independent bitmap graphic, 52 x 13 x 4, image size 364	Chinese	China	0.3974358974358974
RT_BITMAP	0x15cc40	0x368	Device independent bitmap graphic, 96 x 16 x 4, image size 768	Chinese	China	0.2018348623853211
RT_BITMAP	0x15cfa8	0x128	Device independent bitmap graphic, 21 x 16 x 4, image size 192	Chinese	China	0.32432432432432434
RT_BITMAP	0x15d0d0	0xb8	Device independent bitmap graphic, 1 x 20 x 4, image size 80	Chinese	China	0.5108695652173914
RT_BITMAP	0x15d188	0x1b4	Device independent bitmap graphic, 8 x 83 x 4, image size 332	Chinese	China	0.26605504587155965
RT_BITMAP	0x15d33c	0xf0	Device independent bitmap graphic, 12 x 17 x 4, image size 136	Chinese	China	0.3625
RT_BITMAP	0x15d42c	0x7c	Device independent bitmap graphic, 5 x 5 x 4, image size 20	Chinese	China	0.6774193548387096
RT_BITMAP	0x15d4a8	0xd2c	Device independent bitmap graphic, 342 x 19 x 4, image size 3268	Chinese	China	0.13997627520759193
RT_BITMAP	0x15e1d4	0x6e8	Device independent bitmap graphic, 98 x 32 x 4, image size 1664	Chinese	China	0.07239819004524888
RT_BITMAP	0x15e8bc	0x10a8	Device independent bitmap graphic, 97 x 32 x 8, image size 3200	Chinese	China	0.024859287054409006
RT_BITMAP	0x15f964	0x10a8	Device independent bitmap graphic, 97 x 32 x 8, image size 3200	Chinese	China	0.03541275797373358
RT_BITMAP	0x160a0c	0x24a	Device independent bitmap graphic, 45 x 4 x 24, image size 0, resolution 2834 x 2834 px/m	Chinese	China	0.10580204778156997
RT_BITMAP	0x160c58	0x2fa	Device independent bitmap graphic, 11 x 20 x 24, image size 0, resolution 2834 x 2834 px/m	Chinese	China	0.16272965879265092
RT_BITMAP	0x160f54	0x1ca	Device independent bitmap graphic, 18 x 11 x 8, image size 0, resolution 2834 x 2834 px/m, 49 important colors	Chinese	China	0.6375545851528385
RT_BITMAP	0x161120	0xe0	Device independent bitmap graphic, 16 x 15 x 4, image size 120, 16 important colors			0.38392857142857145
RT_BITMAP	0x161200	0xc0	Device independent bitmap graphic, 16 x 11 x 4, image size 88, 16 important colors			0.4947916666666667
RT_BITMAP	0x1612c0	0xf8	Device independent bitmap graphic, 20 x 12 x 4, image size 144, 16 important colors	Chinese	China	0.41935483870967744
RT_BITMAP	0x1613b8	0xf8	Device independent bitmap graphic, 20 x 12 x 4, image size 144, 16 important colors	Chinese	China	0.43548387096774194
RT_BITMAP	0x1614b0	0xc0	Device independent bitmap graphic, 16 x 11 x 4, image size 88, 16 important colors			0.484375
RT_BITMAP	0x161570	0xe0	Device independent bitmap graphic, 16 x 15 x 4, image size 120, 16 important colors			0.42410714285714285
RT_BITMAP	0x161650	0x1acc	Device independent bitmap graphic, 252 x 23 x 8, image size 5796	Chinese	China	0.3043731778425656
RT_BITMAP	0x16311c	0x824	Device independent bitmap graphic, 60 x 17 x 8, image size 1020	Chinese	China	0.7720729366602687
RT_BITMAP	0x163940	0x5e0	Device independent bitmap graphic, 40 x 11 x 8, image size 440	Chinese	China	0.8829787234042553
RT_BITMAP	0x163f20	0x538	Device independent bitmap graphic, 16 x 17 x 8, image size 272	Chinese	China	0.7664670658682635
RT_BITMAP	0x164458	0x88	Device independent bitmap graphic, 8 x 8 x 4, image size 32	Chinese	China	0.5294117647058824
RT_BITMAP	0x1644e0	0xc0	Device independent bitmap graphic, 1 x 22 x 4, image size 88, 16 important colors	Chinese	China	0.6145833333333334
RT_BITMAP	0x1645a0	0x47c	Device independent bitmap graphic, 1 x 21 x 8, image size 84	Chinese	China	0.5296167247386759
RT_BITMAP	0x164a1c	0x4c8	Device independent bitmap graphic, 13 x 10 x 8, image size 160	Chinese	China	0.7181372549019608
RT_BITMAP	0x164ee4	0x868	Device independent bitmap graphic, 64 x 17 x 8, image size 1088	Chinese	China	0.7523234200743495
RT_BITMAP	0x16574c	0xc68	Device independent bitmap graphic, 96 x 22 x 8, image size 2112	Chinese	China	0.46788413098236775
RT_BITMAP	0x1663b4	0x668	Device independent bitmap graphic, 33 x 16 x 8, image size 576	Chinese	China	0.802439024390244
RT_BITMAP	0x166a1c	0x938	Device independent bitmap graphic, 72 x 18 x 8, image size 1296	Chinese	China	0.601271186440678
RT_BITMAP	0x167354	0x47c	Device independent bitmap graphic, 1 x 21 x 8, image size 84	Chinese	China	0.5174216027874564
RT_BITMAP	0x1677d0	0x6c8	Device independent bitmap graphic, 7 x 84 x 8, image size 672	Chinese	China	0.41013824884792627
RT_BITMAP	0x167e98	0x7f4	Device independent bitmap graphic, 36 x 27 x 8, image size 972	Chinese	China	0.631139489194499
RT_BITMAP	0x16868c	0x4b4	Device independent bitmap graphic, 17 x 7 x 8, image size 140	Chinese	China	0.5191029900332226
RT_BITMAP	0x168b40	0x3d42	Device independent bitmap graphic, 306 x 17 x 24, image size 0, resolution 2834 x 2834 px/m	Chinese	China	0.12230582833822216
RT_BITMAP	0x16c884	0x8d4	Device independent bitmap graphic, 49 x 23 x 8, image size 1196, 256 important colors	Chinese	China	0.3168141592920354
RT_BITMAP	0x16d158	0x878	Device independent bitmap graphic, 48 x 23 x 8, image size 1104, 256 important colors	Chinese	China	0.16512915129151293
RT_BITMAP	0x16d9d0	0x878	Device independent bitmap graphic, 48 x 23 x 8, image size 1104, 256 important colors	Chinese	China	0.37084870848708484
RT_BITMAP	0x16e248	0x2d2	Device independent bitmap graphic, 45 x 5 x 24, image size 0, resolution 2834 x 2834 px/m	Chinese	China	0.15650969529085873
RT_BITMAP	0x16e51c	0x2fa	Device independent bitmap graphic, 11 x 20 x 24, image size 0, resolution 2834 x 2834 px/m	Chinese	China	0.473753280839895
RT_BITMAP	0x16e818	0x25a	Device independent bitmap graphic, 19 x 11 x 8, image size 0, resolution 2834 x 2834 px/m, 85 important colors	Chinese	China	0.8471760797342193
RT_BITMAP	0x16ea74	0xb0	Device independent bitmap graphic, 48 x 16 x 1, image size 128	Chinese	China	0.42045454545454547
RT_BITMAP	0x16eb24	0xe8	Device independent bitmap graphic, 16 x 16 x 4, image size 128, 16 important colors	Chinese	China	0.4353448275862069
RT_BITMAP	0x16ec0c	0x2cc	Device independent bitmap graphic, 72 x 17 x 4, image size 612	Chinese	China	0.25139664804469275
RT_BITMAP	0x16eed8	0x1fb8	Device independent bitmap graphic, 168 x 42 x 8, image size 7056	Chinese	China	0.3619458128078818
RT_BITMAP	0x170e90	0xf6aa	Device independent bitmap graphic, 181 x 116 x 24, image size 0, resolution 2834 x 2834 px/m	Chinese	China	0.021379026383302187
RT_BITMAP	0x18053c	0xc0	Device independent bitmap graphic, 16 x 11 x 4, image size 88, 16 important colors			0.5104166666666666
RT_BITMAP	0x1805fc	0xe0	Device independent bitmap graphic, 16 x 15 x 4, image size 120, 16 important colors			0.5
RT_BITMAP	0x1806dc	0x1b8	Device independent bitmap graphic, 52 x 12 x 4, image size 336	Chinese	China	0.3795454545454545
RT_BITMAP	0x180894	0xe8	Device independent bitmap graphic, 16 x 16 x 4, image size 128			0.4870689655172414
RT_BITMAP	0x18097c	0x1688	Device independent bitmap graphic, 222 x 21 x 8, image size 4704	Chinese	China	0.4433079056865465
RT_BITMAP	0x182004	0x1d4	Device independent bitmap graphic, 52 x 13 x 4, image size 364	Chinese	China	0.21794871794871795
RT_BITMAP	0x1821d8	0x170	Device independent bitmap graphic, 44 x 11 x 4, image size 264	Chinese	China	0.27445652173913043
RT_BITMAP	0x182348	0x88	Device independent bitmap graphic, 8 x 8 x 4, image size 32	Chinese	China	0.6323529411764706
RT_BITMAP	0x1823d0	0x450	Device independent bitmap graphic, 1 x 10 x 8, image size 40	Chinese	China	0.03894927536231884
RT_BITMAP	0x182820	0x1d4	Device independent bitmap graphic, 52 x 13 x 4, image size 364	Chinese	China	0.3803418803418803
RT_BITMAP	0x1829f4	0xa28	Device independent bitmap graphic, 96 x 16 x 8, image size 1536	Chinese	China	0.5411538461538462
RT_BITMAP	0x18341c	0x128	Device independent bitmap graphic, 21 x 16 x 4, image size 192	Chinese	China	0.32432432432432434
RT_BITMAP	0x183544	0xbc	Device independent bitmap graphic, 1 x 21 x 4, image size 84	Chinese	China	0.6542553191489362
RT_BITMAP	0x183600	0x1b4	Device independent bitmap graphic, 8 x 83 x 4, image size 332	Chinese	China	0.26376146788990823
RT_BITMAP	0x1837b4	0x134	Device independent bitmap graphic, 18 x 17 x 4, image size 204	Chinese	China	0.3961038961038961
RT_BITMAP	0x1838e8	0x90	Device independent bitmap graphic, 10 x 5 x 4, image size 40	Chinese	China	0.7013888888888888
RT_BITMAP	0x183978	0xd2c	Device independent bitmap graphic, 342 x 19 x 4, image size 3268	Chinese	China	0.14323843416370108
RT_BITMAP	0x1846a4	0xc4	Device independent bitmap graphic, 1 x 23 x 4, image size 92	Chinese	China	0.4744897959183674
RT_BITMAP	0x184768	0x2c0c	Device independent bitmap graphic, 441 x 23 x 8, image size 10212	Chinese	China	0.33806314295849593
RT_BITMAP	0x187374	0x484	Device independent bitmap graphic, 1 x 23 x 8, image size 92	Chinese	China	0.092560553633218
RT_BITMAP	0x1877f8	0x24a	Device independent bitmap graphic, 45 x 4 x 24, image size 0, resolution 2834 x 2834 px/m	Chinese	China	0.10238907849829351
RT_BITMAP	0x187a44	0x2fa	Device independent bitmap graphic, 11 x 20 x 24, image size 0, resolution 2834 x 2834 px/m	Chinese	China	0.3753280839895013
RT_BITMAP	0x187d40	0x282	Device independent bitmap graphic, 18 x 11 x 8, image size 0, resolution 2834 x 2834 px/m, 95 important colors	Chinese	China	0.764797507788162
RT_BITMAP	0x187fc4	0xc0	Device independent bitmap graphic, 16 x 11 x 4, image size 88, 16 important colors			0.4895833333333333
RT_BITMAP	0x188084	0x54	Device independent bitmap graphic, 7 x 9 x 1, image size 36	Chinese	China	0.47619047619047616
RT_BITMAP	0x1880d8	0xc0	Device independent bitmap graphic, 11 x 11 x 4, image size 88	Chinese	China	0.4583333333333333
RT_BITMAP	0x188198	0x668	Device independent bitmap graphic, 24 x 24 x 8, image size 576	Chinese	China	0.4115853658536585
RT_BITMAP	0x188800	0x668	Device independent bitmap graphic, 24 x 24 x 8, image size 576	Chinese	China	0.4792682926829268
RT_BITMAP	0x188e68	0x668	Device independent bitmap graphic, 24 x 24 x 8, image size 576	Chinese	China	0.4036585365853659
RT_BITMAP	0x1894d0	0x668	Device independent bitmap graphic, 24 x 24 x 8, image size 576	Chinese	China	0.4274390243902439
RT_BITMAP	0x189b38	0x668	Device independent bitmap graphic, 24 x 24 x 8, image size 576	Chinese	China	0.39695121951219514
RT_BITMAP	0x18a1a0	0x668	Device independent bitmap graphic, 24 x 24 x 8, image size 576	Chinese	China	0.41280487804878047
RT_BITMAP	0x18a808	0x668	Device independent bitmap graphic, 24 x 24 x 8, image size 576	Chinese	China	0.4451219512195122
RT_BITMAP	0x18ae70	0x668	Device independent bitmap graphic, 24 x 24 x 8, image size 576	Chinese	China	0.40426829268292686
RT_BITMAP	0x18b4d8	0x668	Device independent bitmap graphic, 24 x 24 x 8, image size 576	Chinese	China	0.4219512195121951
RT_BITMAP	0x18bb40	0x668	Device independent bitmap graphic, 24 x 24 x 8, image size 576	Chinese	China	0.4798780487804878
RT_BITMAP	0x18c1a8	0x668	Device independent bitmap graphic, 24 x 24 x 8, image size 576	Chinese	China	0.46402439024390246
RT_BITMAP	0x18c810	0x668	Device independent bitmap graphic, 24 x 24 x 8, image size 576	Chinese	China	0.4603658536585366
RT_BITMAP	0x18ce78	0x188	Device independent bitmap graphic, 24 x 24 x 4, image size 288	Chinese	China	0.5025510204081632
RT_BITMAP	0x18d000	0x668	Device independent bitmap graphic, 24 x 24 x 8, image size 576	Chinese	China	0.4634146341463415
RT_BITMAP	0x18d668	0x668	Device independent bitmap graphic, 24 x 24 x 8, image size 576	Chinese	China	0.4628048780487805
RT_BITMAP	0x18dcd0	0x668	Device independent bitmap graphic, 24 x 24 x 8, image size 576	Chinese	China	0.4676829268292683
RT_BITMAP	0x18e338	0x668	Device independent bitmap graphic, 24 x 24 x 8, image size 576	Chinese	China	0.46402439024390246
RT_BITMAP	0x18e9a0	0x668	Device independent bitmap graphic, 24 x 24 x 8, image size 576	Chinese	China	0.4554878048780488
RT_BITMAP	0x18f008	0x668	Device independent bitmap graphic, 24 x 24 x 8, image size 576	Chinese	China	0.5920731707317073
RT_BITMAP	0x18f670	0x668	Device independent bitmap graphic, 24 x 24 x 8, image size 576	Chinese	China	0.46158536585365856
RT_BITMAP	0x18fcd8	0x668	Device independent bitmap graphic, 24 x 24 x 8, image size 576	Chinese	China	0.4195121951219512
RT_BITMAP	0x190340	0x188	Device independent bitmap graphic, 24 x 24 x 4, image size 288	Chinese	China	0.4770408163265306
RT_BITMAP	0x1904c8	0x668	Device independent bitmap graphic, 24 x 24 x 8, image size 576	Chinese	China	0.4609756097560976
RT_BITMAP	0x190b30	0x668	Device independent bitmap graphic, 24 x 24 x 8, image size 576	Chinese	China	0.401219512195122
RT_BITMAP	0x191198	0x668	Device independent bitmap graphic, 24 x 24 x 8, image size 576	Chinese	China	0.4189024390243902
RT_BITMAP	0x191800	0x668	Device independent bitmap graphic, 24 x 24 x 8, image size 576	Chinese	China	0.47317073170731705
RT_BITMAP	0x191e68	0x668	Device independent bitmap graphic, 24 x 24 x 8, image size 576	Chinese	China	0.4164634146341463
RT_BITMAP	0x1924d0	0x188	Device independent bitmap graphic, 24 x 24 x 4, image size 288	Chinese	China	0.47959183673469385
RT_BITMAP	0x192658	0x188	Device independent bitmap graphic, 24 x 24 x 4, image size 288	Chinese	China	0.4872448979591837
RT_BITMAP	0x1927e0	0x668	Device independent bitmap graphic, 24 x 24 x 8, image size 576	Chinese	China	0.39207317073170733
RT_BITMAP	0x192e48	0x668	Device independent bitmap graphic, 24 x 24 x 8, image size 576	Chinese	China	0.39695121951219514
RT_BITMAP	0x1934b0	0x668	Device independent bitmap graphic, 24 x 24 x 8, image size 576	Chinese	China	0.44085365853658537
RT_BITMAP	0x193b18	0x668	Device independent bitmap graphic, 24 x 24 x 8, image size 576	Chinese	China	0.40792682926829266
RT_BITMAP	0x194180	0x188	Device independent bitmap graphic, 24 x 24 x 4, image size 288	Chinese	China	0.3979591836734694
RT_BITMAP	0x194308	0x668	Device independent bitmap graphic, 24 x 24 x 8, image size 576	Chinese	China	0.40853658536585363
RT_BITMAP	0x194970	0x668	Device independent bitmap graphic, 24 x 24 x 8, image size 576	Chinese	China	0.4067073170731707
RT_BITMAP	0x194fd8	0x668	Device independent bitmap graphic, 24 x 24 x 8, image size 576	Chinese	China	0.41097560975609754
RT_BITMAP	0x195640	0x668	Device independent bitmap graphic, 24 x 24 x 8, image size 576	Chinese	China	0.43841463414634146
RT_BITMAP	0x195ca8	0x668	Device independent bitmap graphic, 24 x 24 x 8, image size 576	Chinese	China	0.4445121951219512
RT_BITMAP	0x196310	0x668	Device independent bitmap graphic, 24 x 24 x 8, image size 576	Chinese	China	0.39390243902439026
RT_BITMAP	0x196978	0x188	Device independent bitmap graphic, 24 x 24 x 4, image size 288	Chinese	China	0.44387755102040816
RT_BITMAP	0x196b00	0x668	Device independent bitmap graphic, 24 x 24 x 8, image size 576	Chinese	China	0.4445121951219512
RT_BITMAP	0x197168	0x668	Device independent bitmap graphic, 24 x 24 x 8, image size 576	Chinese	China	0.4054878048780488
RT_BITMAP	0x1977d0	0x668	Device independent bitmap graphic, 24 x 24 x 8, image size 576	Chinese	China	0.4451219512195122
RT_BITMAP	0x197e38	0x668	Device independent bitmap graphic, 24 x 24 x 8, image size 576	Chinese	China	0.4292682926829268
RT_BITMAP	0x1984a0	0x188	Device independent bitmap graphic, 24 x 24 x 4, image size 288	Chinese	China	0.413265306122449
RT_BITMAP	0x198628	0x668	Device independent bitmap graphic, 24 x 24 x 8, image size 576	Chinese	China	0.41829268292682925
RT_BITMAP	0x198c90	0x668	Device independent bitmap graphic, 24 x 24 x 8, image size 576	Chinese	China	0.4036585365853659
RT_BITMAP	0x1992f8	0x668	Device independent bitmap graphic, 24 x 24 x 8, image size 576	Chinese	China	0.4140243902439024
RT_BITMAP	0x199960	0x668	Device independent bitmap graphic, 24 x 24 x 8, image size 576	Chinese	China	0.39878048780487807
RT_BITMAP	0x199fc8	0x668	Device independent bitmap graphic, 24 x 24 x 8, image size 576	Chinese	China	0.4140243902439024
RT_BITMAP	0x19a630	0x668	Device independent bitmap graphic, 24 x 24 x 8, image size 576	Chinese	China	0.40182926829268295
RT_BITMAP	0x19ac98	0x668	Device independent bitmap graphic, 24 x 24 x 8, image size 576	Chinese	China	0.41097560975609754
RT_BITMAP	0x19b300	0x668	Device independent bitmap graphic, 24 x 24 x 8, image size 576	Chinese	China	0.4073170731707317
RT_BITMAP	0x19b968	0x668	Device independent bitmap graphic, 24 x 24 x 8, image size 576	Chinese	China	0.41097560975609754
RT_BITMAP	0x19bfd0	0x668	Device independent bitmap graphic, 24 x 24 x 8, image size 576	Chinese	China	0.4371951219512195
RT_BITMAP	0x19c638	0x188	Device independent bitmap graphic, 24 x 24 x 4, image size 288	Chinese	China	0.4642857142857143
RT_BITMAP	0x19c7c0	0x668	Device independent bitmap graphic, 24 x 24 x 8, image size 576	Chinese	China	0.43414634146341463
RT_BITMAP	0x19ce28	0x188	Device independent bitmap graphic, 24 x 24 x 4, image size 288	Chinese	China	0.4719387755102041
RT_BITMAP	0x19cfb0	0x668	Device independent bitmap graphic, 24 x 24 x 8, image size 576	Chinese	China	0.4054878048780488
RT_BITMAP	0x19d618	0x668	Device independent bitmap graphic, 24 x 24 x 8, image size 576	Chinese	China	0.4451219512195122
RT_BITMAP	0x19dc80	0x668	Device independent bitmap graphic, 24 x 24 x 8, image size 576	Chinese	China	0.45914634146341465
RT_BITMAP	0x19e2e8	0x668	Device independent bitmap graphic, 24 x 24 x 8, image size 576	Chinese	China	0.40426829268292686
RT_BITMAP	0x19e950	0x668	Device independent bitmap graphic, 24 x 24 x 8, image size 576	Chinese	China	0.4329268292682927
RT_BITMAP	0x19efb8	0x668	Device independent bitmap graphic, 24 x 24 x 8, image size 576	Chinese	China	0.4073170731707317
RT_BITMAP	0x19f620	0xe0	Device independent bitmap graphic, 16 x 15 x 4, image size 120, 16 important colors			0.3794642857142857
RT_BITMAP	0x19f700	0xce8	Device independent bitmap graphic, 400 x 16 x 4, image size 3200			0.1089588377723971
RT_BITMAP	0x1a03e8	0xce8	Device independent bitmap graphic, 400 x 16 x 4, image size 3200			0.10714285714285714
RT_BITMAP	0x1a10d0	0xce8	Device independent bitmap graphic, 400 x 16 x 4, image size 3200			0.0950363196125908
RT_BITMAP	0x1a1db8	0x268	Device independent bitmap graphic, 32 x 32 x 4, image size 512			0.21266233766233766
RT_BITMAP	0x1a2020	0x268	Device independent bitmap graphic, 32 x 32 x 4, image size 512			0.17207792207792208
RT_BITMAP	0x1a2288	0x268	Device independent bitmap graphic, 32 x 32 x 4, image size 512			0.1672077922077922
RT_BITMAP	0x1a24f0	0xce8	Device independent bitmap graphic, 400 x 16 x 4, image size 3200			0.11955205811138014
RT_BITMAP	0x1a31d8	0xce8	Device independent bitmap graphic, 400 x 16 x 4, image size 3200			0.11561743341404358
RT_BITMAP	0x1a3ec0	0xd28	Device independent bitmap graphic, 144 x 16 x 8, image size 2304			0.23634204275534443
RT_BITMAP	0x1a4be8	0x4b2a	Device independent bitmap graphic, 400 x 16 x 24, image size 0, resolution 2834 x 2834 px/m			0.2749194470429269
RT_BITMAP	0x1a9714	0x126	Device independent bitmap graphic, 9 x 9 x 24, image size 0, resolution 2834 x 2834 px/m			0.5850340136054422
RT_BITMAP	0x1a983c	0x126	Device independent bitmap graphic, 9 x 9 x 24, image size 0, resolution 2834 x 2834 px/m			0.5918367346938775
RT_BITMAP	0x1a9964	0x8c0	Device independent bitmap graphic, 54 x 21 x 8, image size 1176	Chinese	China	0.40714285714285714
RT_BITMAP	0x1aa224	0x6cc	Device independent bitmap graphic, 52 x 13 x 8, image size 676	Chinese	China	0.5103448275862069
RT_BITMAP	0x1aa8f0	0x170	Device independent bitmap graphic, 44 x 11 x 4, image size 264	Chinese	China	0.5869565217391305
RT_BITMAP	0x1aaa60	0x548	Device independent bitmap graphic, 16 x 18 x 8, image size 288	Chinese	China	0.525887573964497
RT_BITMAP	0x1aafa8	0x478	Device independent bitmap graphic, 6 x 10 x 8, image size 80	Chinese	China	0.541083916083916
RT_BITMAP	0x1ab420	0x6cc	Device independent bitmap graphic, 52 x 13 x 8, image size 676	Chinese	China	0.6752873563218391
RT_BITMAP	0x1abaec	0xa88	Device independent bitmap graphic, 96 x 17 x 8, image size 1632	Chinese	China	0.5459940652818991
RT_BITMAP	0x1ac574	0x5a8	Device independent bitmap graphic, 21 x 16 x 8, image size 384	Chinese	China	0.56146408839779
RT_BITMAP	0x1acb1c	0x938	Device independent bitmap graphic, 72 x 18 x 8, image size 1296	Chinese	China	0.5199152542372881
RT_BITMAP	0x1ad454	0x47c	Device independent bitmap graphic, 1 x 21 x 8, image size 84	Chinese	China	0.519163763066202
RT_BITMAP	0x1ad8d0	0x6d8	Device independent bitmap graphic, 8 x 86 x 8, image size 688	Chinese	China	0.375
RT_BITMAP	0x1adfa8	0x590	Device independent bitmap graphic, 18 x 18 x 8, image size 360	Chinese	China	0.4978932584269663
RT_BITMAP	0x1ae538	0x6c	Device independent bitmap graphic, 8 x 1 x 4, image size 4	Chinese	China	0.7314814814814815
RT_BITMAP	0x1ae5a4	0x5d5a	Device independent bitmap graphic, 378 x 21 x 24, image size 0, resolution 2834 x 2834 px/m	Chinese	China	0.17557954640555695
RT_BITMAP	0x1b4300	0x50e	Device independent bitmap graphic, 37 x 29 x 8, image size 0, resolution 2834 x 2834 px/m, 23 important colors	Chinese	China	0.15301391035548687
RT_BITMAP	0x1b4810	0x83c	Device independent bitmap graphic, 35 x 29 x 8, image size 1044	Chinese	China	0.4620493358633776
RT_BITMAP	0x1b504c	0x83c	Device independent bitmap graphic, 35 x 29 x 8, image size 1044	Chinese	China	0.5028462998102466
RT_BITMAP	0x1b5888	0x46a	Device independent bitmap graphic, 45 x 8 x 24, image size 0, resolution 2834 x 2834 px/m	Chinese	China	0.08053097345132744
RT_BITMAP	0x1b5cf4	0x31e	Device independent bitmap graphic, 11 x 21 x 24, image size 0, resolution 2834 x 2834 px/m	Chinese	China	0.30451127819548873
RT_BITMAP	0x1b6014	0x1e2	Device independent bitmap graphic, 22 x 11 x 8, image size 0, resolution 2834 x 2834 px/m, 44 important colors	Chinese	China	0.6244813278008299
RT_ICON	0x1b61f8	0x128	Device independent bitmap graphic, 16 x 32 x 4, image size 128	Chinese	China	0.6587837837837838
RT_ICON	0x1b6320	0xea8	Device independent bitmap graphic, 48 x 96 x 8, image size 2304, 256 important colors	Chinese	China	0.5658315565031983
RT_ICON	0x1b71c8	0x8a8	Device independent bitmap graphic, 32 x 64 x 8, image size 1024, 256 important colors	Chinese	China	0.7197653429602888
RT_ICON	0x1b7a70	0x568	Device independent bitmap graphic, 16 x 32 x 8, image size 256, 256 important colors	Chinese	China	0.3684971098265896
RT_ICON	0x1b7fd8	0x10828	Device independent bitmap graphic, 128 x 256 x 32, image size 67584	Chinese	China	0.38884123979652196
RT_ICON	0x1c8800	0x94a8	Device independent bitmap graphic, 96 x 192 x 32, image size 38016	Chinese	China	0.4819739331511457
RT_ICON	0x1d1ca8	0x67e8	Device independent bitmap graphic, 80 x 160 x 32, image size 26560	Chinese	China	0.4575563909774436
RT_ICON	0x1d8490	0x5488	Device independent bitmap graphic, 72 x 144 x 32, image size 21600	Chinese	China	0.5074399260628466
RT_ICON	0x1dd918	0x4228	Device independent bitmap graphic, 64 x 128 x 32, image size 16896	Chinese	China	0.5247992442135097
RT_ICON	0x1e1b40	0x25a8	Device independent bitmap graphic, 48 x 96 x 32, image size 9600	Chinese	China	0.5431535269709543
RT_ICON	0x1e40e8	0x10a8	Device independent bitmap graphic, 32 x 64 x 32, image size 4224	Chinese	China	0.6357879924953096
RT_ICON	0x1e5190	0x988	Device independent bitmap graphic, 24 x 48 x 32, image size 2400	Chinese	China	0.6979508196721311
RT_ICON	0x1e5b18	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 1088	Chinese	China	0.46099290780141844
RT_DIALOG	0x1e5f80	0x52	data			0.7682926829268293
RT_STRING	0x1e5fd4	0x144	data	Chinese	China	0.5771604938271605
RT_STRING	0x1e6118	0x1b0	data	Chinese	China	0.4375
RT_STRING	0x1e62c8	0xc4	data	Chinese	China	0.6785714285714286
RT_STRING	0x1e638c	0x2a	data	Chinese	China	0.5
RT_STRING	0x1e63b8	0xadc	data			0.26187050359712233
RT_STRING	0x1e6e94	0x6a4	data			0.32235294117647056
RT_STRING	0x1e7538	0x3f4	data			0.39723320158102765
RT_STRING	0x1e792c	0x384	data			0.3811111111111111
RT_STRING	0x1e7cb0	0x408	data			0.3943798449612403
RT_STRING	0x1e80b8	0x3b8	data			0.3329831932773109
RT_STRING	0x1e8470	0x36c	data			0.4132420091324201
RT_STRING	0x1e87dc	0x2c0	data			0.4275568181818182
RT_STRING	0x1e8a9c	0x534	data			0.3918918918918919
RT_STRING	0x1e8fd0	0x354	data			0.3955399061032864
RT_STRING	0x1e9324	0x290	data			0.5442073170731707
RT_STRING	0x1e95b4	0x1d0	data			0.38146551724137934
RT_STRING	0x1e9784	0x16c	data			0.532967032967033
RT_STRING	0x1e98f0	0x1e4	Targa image data - Color 99 x 107 x 32 +68 +111 "z"			0.5041322314049587
RT_STRING	0x1e9ad4	0x260	data			0.49835526315789475
RT_STRING	0x1e9d34	0xe8	data			0.5905172413793104
RT_STRING	0x1e9e1c	0x128	data			0.5574324324324325
RT_STRING	0x1e9f44	0x2c8	data			0.45786516853932585
RT_STRING	0x1ea20c	0x420	data			0.39204545454545453
RT_STRING	0x1ea62c	0x388	data			0.39491150442477874
RT_STRING	0x1ea9b4	0x3ac	data			0.33085106382978724
RT_STRING	0x1ead60	0x334	data			0.4317073170731707
RT_STRING	0x1eb094	0xd8	data			0.5648148148148148
RT_STRING	0x1eb16c	0xbc	data			0.5425531914893617
RT_STRING	0x1eb228	0x3cc	data			0.3765432098765432
RT_STRING	0x1eb5f4	0x46c	data			0.3215547703180212
RT_STRING	0x1eba60	0x334	data			0.3719512195121951
RT_STRING	0x1ebd94	0x310	data			0.36989795918367346
RT_RCDATA	0x1ec0a4	0x10	data			1.5
RT_RCDATA	0x1ec0b4	0x934	data			0.6137521222410866
RT_RCDATA	0x1ec9e8	0x79d	Delphi compiled form 'TFrmEraserMessage'			0.39148281169830684
RT_RCDATA	0x1ed188	0x3ba	Delphi compiled form 'TFrmLoad'			0.519916142557652
RT_RCDATA	0x1ed544	0x6a6	Delphi compiled form 'TFrmMessage'			0.41245593419506466
RT_RCDATA	0x1edbec	0x2bc	Delphi compiled form 'TfrmMgr'			0.6114285714285714
RT_RCDATA	0x1edea8	0x306	Delphi compiled form 'TfrmMSNPopForm'			0.5943152454780362
RT_RCDATA	0x1ee1b0	0x7f1	Delphi compiled form 'TFrmReg'			0.3694048204623709
RT_RCDATA	0x1ee9a4	0x494	Delphi compiled form 'TLoginDialog'			0.4931740614334471
RT_RCDATA	0x1eee38	0x8b55	Delphi compiled form 'TMainFrm'			0.16154083377722953
RT_RCDATA	0x1f7990	0x3c4	Delphi compiled form 'TPasswordDialog'			0.4678423236514523
RT_GROUP_CURSOR	0x1f7d54	0x14	data			1.4
RT_GROUP_CURSOR	0x1f7d68	0x14	data			1.4
RT_GROUP_CURSOR	0x1f7d7c	0x14	data			1.4
RT_GROUP_CURSOR	0x1f7d90	0x14	data			1.4
RT_GROUP_CURSOR	0x1f7da4	0x14	data			1.4
RT_GROUP_CURSOR	0x1f7db8	0x14	data			1.4
RT_GROUP_CURSOR	0x1f7dcc	0x14	data			1.4
RT_GROUP_CURSOR	0x1f7de0	0x14	data			1.4
RT_GROUP_CURSOR	0x1f7df4	0x14	data			1.4
RT_GROUP_CURSOR	0x1f7e08	0x14	data			1.4
RT_GROUP_CURSOR	0x1f7e1c	0x14	data			1.4
RT_GROUP_CURSOR	0x1f7e30	0x14	data			1.4
RT_GROUP_CURSOR	0x1f7e44	0x14	Lotus unknown worksheet or configuration, revision 0x1			1.25
RT_GROUP_CURSOR	0x1f7e58	0x14	Lotus unknown worksheet or configuration, revision 0x1			1.25
RT_GROUP_CURSOR	0x1f7e6c	0x14	Lotus unknown worksheet or configuration, revision 0x1			1.25
RT_GROUP_CURSOR	0x1f7e80	0x14	Lotus unknown worksheet or configuration, revision 0x1			1.3
RT_GROUP_CURSOR	0x1f7e94	0x14	Lotus unknown worksheet or configuration, revision 0x1			1.3
RT_GROUP_CURSOR	0x1f7ea8	0x14	Lotus unknown worksheet or configuration, revision 0x1			1.3
RT_GROUP_CURSOR	0x1f7ebc	0x14	Lotus unknown worksheet or configuration, revision 0x1			1.3
RT_GROUP_CURSOR	0x1f7ed0	0x14	Lotus unknown worksheet or configuration, revision 0x1			1.3
RT_GROUP_ICON	0x1f7ee4	0xbc	data	Chinese	China	0.6702127659574468

Imports

DLL	Import
kernel32.dll	DeleteCriticalSection, LeaveCriticalSection, EnterCriticalSection, InitializeCriticalSection, VirtualFree, VirtualAlloc, LocalFree, LocalAlloc, GetTickCount, QueryPerformanceCounter, GetVersion, GetCurrentThreadId, InterlockedDecrement, InterlockedIncrement, VirtualQuery, WideCharToMultiByte, MultiByteToWideChar, lstrlenA, lstrcpynA, LoadLibraryExA, GetThreadLocale, GetStartupInfoA, GetProcAddress, GetModuleHandleA, GetModuleFileNameA, GetLocaleInfoA, GetCommandLineA, FreeLibrary, FindFirstFileA, FindClose, ExitProcess, ExitThread, CreateThread, WriteFile, UnhandledExceptionFilter, RtlUnwind, RaiseException, GetStdHandle
user32.dll	GetKeyboardType, LoadStringA, MessageBoxA, CharNextA
advapi32.dll	RegQueryValueExA, RegOpenKeyExA, RegCloseKey
oleaut32.dll	SysFreeString, SysReAllocStringLen, SysAllocStringLen
kernel32.dll	TlsSetValue, TlsGetValue, LocalAlloc, GetModuleHandleA
advapi32.dll	RegQueryValueExA, RegQueryInfoKeyA, RegOpenKeyExA, RegFlushKey, RegEnumKeyExA, RegCreateKeyExA, RegCloseKey, OpenProcessToken, LookupPrivilegeValueA, GetUserNameA, AdjustTokenPrivileges
kernel32.dll	lstrlenW, lstrcpyA, WriteFile, WaitForSingleObject, VirtualQuery, VirtualAlloc, Sleep, SizeofResource, SetThreadLocale, SetFilePointer, SetEvent, SetErrorMode, SetEndOfFile, ResumeThread, ResetEvent, ReadFile, MultiByteToWideChar, MulDiv, LockResource, LoadResource, LoadLibraryA, LeaveCriticalSection, IsValidLocale, InitializeCriticalSection, GlobalUnlock, GlobalSize, GlobalReAlloc, GlobalHandle, GlobalLock, GlobalFree, GlobalFindAtomA, GlobalDeleteAtom, GlobalAlloc, GlobalAddAtomA, GetWindowsDirectoryA, GetVolumeInformationA, GetVersionExA, GetVersion, GetTimeZoneInformation, GetTickCount, GetThreadLocale, GetTempPathA, GetSystemInfo, GetSystemDirectoryA, GetStringTypeExA, GetStdHandle, GetProcAddress, GetModuleHandleA, GetModuleFileNameA, GetLocaleInfoA, GetLocalTime, GetLastError, GetFullPathNameA, GetFileSize, GetFileAttributesA, GetExitCodeThread, GetDriveTypeA, GetDiskFreeSpaceA, GetDateFormatA, GetCurrentThreadId, GetCurrentProcessId, GetCurrentProcess, GetComputerNameA, GetCPInfo, GetACP, FreeResource, InterlockedIncrement, InterlockedExchange, InterlockedDecrement, FreeLibrary, FormatMessageA, FindResourceA, FindNextFileA, FindFirstFileA, FindClose, FileTimeToLocalFileTime, FileTimeToDosDateTime, EnumCalendarInfoA, EnterCriticalSection, DeleteFileA, DeleteCriticalSection, CreateThread, CreateFileA, CreateEventA, CreateDirectoryA, CopyFileA, CompareStringA, CloseHandle
version.dll	VerQueryValueA, GetFileVersionInfoSizeA, GetFileVersionInfoA
gdi32.dll	UnrealizeObject, TextOutW, StretchDIBits, StretchBlt, SetWindowOrgEx, SetWinMetaFileBits, SetViewportOrgEx, SetTextColor, SetStretchBltMode, SetROP2, SetPixel, SetMapMode, SetEnhMetaFileBits, SetDIBColorTable, SetBrushOrgEx, SetBkMode, SetBkColor, SelectPalette, SelectObject, SelectClipRgn, SaveDC, RoundRect, RestoreDC, Rectangle, RectVisible, RealizePalette, Polyline, Polygon, PlayEnhMetaFile, PathToRegion, PatBlt, OffsetRgn, MoveToEx, MaskBlt, LineTo, LPtoDP, IntersectClipRect, GetWindowOrgEx, GetWinMetaFileBits, GetViewportOrgEx, GetTextMetricsA, GetTextExtentPointA, GetTextExtentPoint32W, GetTextExtentPoint32A, GetTextColor, GetSystemPaletteEntries, GetStockObject, GetRgnBox, GetPixel, GetPaletteEntries, GetObjectA, GetNearestPaletteIndex, GetMapMode, GetEnhMetaFilePaletteEntries, GetEnhMetaFileHeader, GetEnhMetaFileBits, GetDeviceCaps, GetDIBits, GetDIBColorTable, GetDCOrgEx, GetCurrentPositionEx, GetCurrentObject, GetClipBox, GetBrushOrgEx, GetBkColor, GetBitmapBits, GdiFlush, ExtTextOutA, ExcludeClipRect, EndPath, DeleteObject, DeleteEnhMetaFile, DeleteDC, CreateSolidBrush, CreateRoundRectRgn, CreateRectRgnIndirect, CreateRectRgn, CreatePenIndirect, CreatePatternBrush, CreatePalette, CreateHalftonePalette, CreateFontIndirectA, CreateDIBitmap, CreateDIBSection, CreateCompatibleDC, CreateCompatibleBitmap, CreateBrushIndirect, CreateBitmap, CopyEnhMetaFileA, CombineRgn, CloseFigure, BitBlt, BeginPath, Arc
user32.dll	CreateWindowExA, WindowFromPoint, WindowFromDC, WinHelpA, WaitMessage, ValidateRect, UpdateWindow, UnregisterClassA, UnhookWindowsHookEx, TranslateMessage, TranslateMDISysAccel, TrackPopupMenu, ToAscii, SystemParametersInfoA, SubtractRect, ShowWindow, ShowScrollBar, ShowOwnedPopups, ShowCursor, SetWindowRgn, SetWindowsHookExA, SetWindowTextA, SetWindowPos, SetWindowPlacement, SetWindowLongA, SetTimer, SetScrollRange, SetScrollPos, SetScrollInfo, SetRect, SetPropA, SetParent, SetMenuItemInfoA, SetMenu, SetForegroundWindow, SetFocus, SetCursor, SetClipboardData, SetClassLongA, SetCapture, SetActiveWindow, SendMessageA, ScrollWindow, ScrollDC, ScreenToClient, RemovePropA, RemoveMenu, ReleaseDC, ReleaseCapture, RegisterWindowMessageA, RegisterClipboardFormatA, RegisterClassA, RedrawWindow, PtInRect, PostQuitMessage, PostMessageA, PeekMessageA, OpenClipboard, OffsetRect, OemToCharA, NotifyWinEvent, MsgWaitForMultipleObjects, MessageBoxA, MessageBeep, MapWindowPoints, MapVirtualKeyA, LockWindowUpdate, LoadStringA, LoadKeyboardLayoutA, LoadImageA, LoadIconA, LoadCursorA, LoadBitmapA, KillTimer, IsZoomed, IsWindowVisible, IsWindowEnabled, IsWindow, IsRectEmpty, IsIconic, IsDialogMessageA, IsChild, InvalidateRect, IntersectRect, InsertMenuItemA, InsertMenuA, InflateRect, GetWindowThreadProcessId, GetWindowTextA, GetWindowRect, GetWindowPlacement, GetWindowLongA, GetWindowDC, GetUpdateRect, GetTopWindow, GetSystemMetrics, GetSystemMenu, GetSysColorBrush, GetSysColor, GetSubMenu, GetScrollRange, GetScrollPos, GetScrollInfo, GetPropA, GetParent, GetWindow, GetMessagePos, GetMenuStringA, GetMenuState, GetMenuItemInfoA, GetMenuItemID, GetMenuItemCount, GetMenu, GetLastActivePopup, GetKeyboardState, GetKeyboardLayoutList, GetKeyboardLayout, GetKeyState, GetKeyNameTextA, GetIconInfo, GetForegroundWindow, GetFocus, GetDlgItem, GetDesktopWindow, GetDCEx, GetDC, GetCursorPos, GetCursor, GetClipboardFormatNameA, GetClipboardData, GetClientRect, GetClassNameA, GetClassInfoA, GetCapture, GetActiveWindow, FrameRect, FindWindowA, FillRect, ExitWindowsEx, EqualRect, EnumWindows, EnumThreadWindows, EndPaint, EndDeferWindowPos, EnableWindow, EnableScrollBar, EnableMenuItem, EmptyClipboard, DrawTextW, DrawTextA, DrawMenuBar, DrawIconEx, DrawIcon, DrawFrameControl, DrawFocusRect, DrawEdge, DispatchMessageA, DestroyWindow, DestroyMenu, DestroyIcon, DestroyCursor, DeleteMenu, DeferWindowPos, DefWindowProcA, DefMDIChildProcA, DefFrameProcA, CreatePopupMenu, CreateMenu, CreateIcon, CopyImage, CloseClipboard, ClientToScreen, CheckMenuItem, CallWindowProcA, CallNextHookEx, BeginPaint, BeginDeferWindowPos, CharNextA, CharLowerBuffA, CharLowerA, CharUpperBuffA, CharToOemA, AdjustWindowRectEx, ActivateKeyboardLayout
ole32.dll	CoTaskMemFree, StringFromCLSID, CoCreateGuid
kernel32.dll	Sleep
oleaut32.dll	SafeArrayPtrOfIndex, SafeArrayPutElement, SafeArrayGetElement, SafeArrayUnaccessData, SafeArrayAccessData, SafeArrayGetUBound, SafeArrayGetLBound, SafeArrayCreate, VariantChangeType, VariantCopyInd, VariantCopy, VariantClear, VariantInit
ole32.dll	CreateStreamOnHGlobal, ReleaseStgMedium, OleGetClipboard, OleSetClipboard, DoDragDrop, RevokeDragDrop, RegisterDragDrop, OleUninitialize, OleInitialize, CreateDataAdviseHolder, CoTaskMemAlloc, CoCreateInstance, CoUninitialize, CoInitialize
oleaut32.dll	CreateErrorInfo, GetErrorInfo, SetErrorInfo, SysFreeString
comctl32.dll	ImageList_SetIconSize, ImageList_GetIconSize, ImageList_Write, ImageList_Read, ImageList_GetDragImage, ImageList_DragShowNolock, ImageList_SetDragCursorImage, ImageList_DragMove, ImageList_DragLeave, ImageList_DragEnter, ImageList_EndDrag, ImageList_BeginDrag, ImageList_Remove, ImageList_DrawEx, ImageList_Draw, ImageList_GetBkColor, ImageList_SetBkColor, ImageList_ReplaceIcon, ImageList_Add, ImageList_GetImageCount, ImageList_Destroy, ImageList_Create, InitCommonControls
shell32.dll	ShellExecuteA
shell32.dll	SHGetSpecialFolderLocation, SHGetPathFromIDListA, SHGetMalloc, SHGetDesktopFolder, SHBrowseForFolderA
comdlg32.dll	GetSaveFileNameA, GetOpenFileNameA
winmm.dll	timeGetTime, timeEndPeriod, timeBeginPeriod
GDI32.DLL	GetRandomRgn

Possible Origin

Language of compilation system	Country where language is spoken	Map
German	Germany
Chinese	China

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2024-12-26T12:07:12.528493+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	49731	104.21.42.145	443	TCP
2024-12-26T12:07:13.448413+0100	2049836	ET MALWARE Lumma Stealer Related Activity	1	192.168.2.4	49731	104.21.42.145	443	TCP
2024-12-26T12:07:13.448413+0100	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.4	49731	104.21.42.145	443	TCP
2024-12-26T12:07:14.827336+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	49732	104.21.42.145	443	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Dec 26, 2024 12:07:11.180000067 CET	49731	443	192.168.2.4	104.21.42.145
Dec 26, 2024 12:07:11.180075884 CET	443	49731	104.21.42.145	192.168.2.4
Dec 26, 2024 12:07:11.180171967 CET	49731	443	192.168.2.4	104.21.42.145
Dec 26, 2024 12:07:11.219172955 CET	49731	443	192.168.2.4	104.21.42.145
Dec 26, 2024 12:07:11.219188929 CET	443	49731	104.21.42.145	192.168.2.4
Dec 26, 2024 12:07:12.528358936 CET	443	49731	104.21.42.145	192.168.2.4
Dec 26, 2024 12:07:12.528492928 CET	49731	443	192.168.2.4	104.21.42.145
Dec 26, 2024 12:07:12.530764103 CET	49731	443	192.168.2.4	104.21.42.145
Dec 26, 2024 12:07:12.530771017 CET	443	49731	104.21.42.145	192.168.2.4
Dec 26, 2024 12:07:12.531164885 CET	443	49731	104.21.42.145	192.168.2.4
Dec 26, 2024 12:07:12.577006102 CET	49731	443	192.168.2.4	104.21.42.145
Dec 26, 2024 12:07:12.674233913 CET	49731	443	192.168.2.4	104.21.42.145
Dec 26, 2024 12:07:12.676109076 CET	49731	443	192.168.2.4	104.21.42.145
Dec 26, 2024 12:07:12.676136017 CET	443	49731	104.21.42.145	192.168.2.4
Dec 26, 2024 12:07:13.448443890 CET	443	49731	104.21.42.145	192.168.2.4
Dec 26, 2024 12:07:13.448599100 CET	443	49731	104.21.42.145	192.168.2.4
Dec 26, 2024 12:07:13.448668957 CET	49731	443	192.168.2.4	104.21.42.145
Dec 26, 2024 12:07:13.470515966 CET	49731	443	192.168.2.4	104.21.42.145
Dec 26, 2024 12:07:13.470547915 CET	443	49731	104.21.42.145	192.168.2.4
Dec 26, 2024 12:07:13.543549061 CET	49732	443	192.168.2.4	104.21.42.145
Dec 26, 2024 12:07:13.543600082 CET	443	49732	104.21.42.145	192.168.2.4
Dec 26, 2024 12:07:13.543667078 CET	49732	443	192.168.2.4	104.21.42.145
Dec 26, 2024 12:07:13.543958902 CET	49732	443	192.168.2.4	104.21.42.145
Dec 26, 2024 12:07:13.543972969 CET	443	49732	104.21.42.145	192.168.2.4
Dec 26, 2024 12:07:14.827336073 CET	49732	443	192.168.2.4	104.21.42.145

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Dec 26, 2024 12:07:10.849065065 CET	57747	53	192.168.2.4	1.1.1.1
Dec 26, 2024 12:07:11.174725056 CET	53	57747	1.1.1.1	192.168.2.4

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Dec 26, 2024 12:07:10.849065065 CET	192.168.2.4	1.1.1.1	0xbf21	Standard query (0)	tackybrushz.click	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Dec 26, 2024 12:07:11.174725056 CET	1.1.1.1	192.168.2.4	0xbf21	No error (0)	tackybrushz.click		104.21.42.145	A (IP address)	IN (0x0001)	false
Dec 26, 2024 12:07:11.174725056 CET	1.1.1.1	192.168.2.4	0xbf21	No error (0)	tackybrushz.click		172.67.162.132	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

tackybrushz.click

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.4	49731	104.21.42.145	443	6864	C:\Users\user\Desktop\5RRVBiCpFI.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-26 11:07:12 UTC	264	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 8 Host: tackybrushz.click
2024-12-26 11:07:12 UTC	8	OUT	Data Raw: 61 63 74 3d 6c 69 66 65 Data Ascii: act=life
2024-12-26 11:07:13 UTC	1129	IN	HTTP/1.1 200 OK Date: Thu, 26 Dec 2024 11:07:13 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=k0q05k8fdp1jk9f86j3rmcr102; expires=Mon, 21 Apr 2025 04:53:52 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache X-Frame-Options: DENY X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=cbxWUKb%2FzWJifTAiawifDnyqrtw1pfH5ljpFLawNGO4OYfeyran%2Bxu2jsWaszo4AUN5xGzh6nCnQUhzurCwLreLBfJkFu44YNVyfEjVaCfkSml6auE%2B09S1DGT1hQoZegw5bLA%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f809b1d4b6b429e-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1606&min_rtt=1601&rtt_var=612&sent=6&recv=8&lost=0&retrans=0&sent_bytes=2843&recv_bytes=908&delivery_rate=1772920&cwnd=208&unsent_bytes=0&cid=b6d16432e88302ef&ts=931&x=0"
2024-12-26 11:07:13 UTC	7	IN	Data Raw: 32 0d 0a 6f 6b 0d 0a Data Ascii: 2ok
2024-12-26 11:07:13 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Target ID:	0
Start time:	06:06:57
Start date:	26/12/2024
Path:	C:\Users\user\Desktop\5RRVBiCpFI.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\5RRVBiCpFI.exe"
Imagebase:	0x400000
File size:	2'369'536 bytes
MD5 hash:	7FC182CA899A18D31E703DC27449A876
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	Borland Delphi
Yara matches:	Rule: JoeSecurity_LummaCStealer_4, Description: Yara detected LummaC Stealer, Source: 00000000.00000002.1843357403.00000000022B0000.00000040.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Donutloader_f40e3759, Description: unknown, Source: 00000000.00000002.1843357403.00000000022B0000.00000040.00001000.00020000.00000000.sdmp, Author: unknown
Reputation:	low
Has exited:	true

Show Windows behavior

Execution Graph

Execution Coverage:	1.4%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	33.8%
Total number of Nodes:	139
Total number of Limit Nodes:	13

Executed Functions

Function 022FF96C Relevance: 12.7, APIs: 8, Instructions: 730memorynativethreadCOMMON

Download Yara Rule

APIs

NtCreateSection.NTDLL(?,000F001F,00000000,?,00000040,08000000,00000000,00000000), ref: 022FFA05
NtMapViewOfSection.NTDLL(?,00000000), ref: 022FFAAD
VirtualAlloc.KERNEL32(00000000,?,00003000,00000004), ref: 022FFE21
NtMapViewOfSection.NTDLL(?,00000000,?,?,?,?,?,?), ref: 022FFED6
VirtualProtect.KERNEL32(?,?,00000008,?,?,?,?,?,?,?), ref: 022FFEF3
VirtualProtect.KERNEL32(?,?,?,00000000), ref: 022FFF96
VirtualProtect.KERNEL32(?,?,00000002,?,?,?,?,?,?,?), ref: 022FFFC9
CreateThread.KERNEL32(00000000,00000000,?,00000000,00000000,00000000,?,?,?,?,?,?), ref: 0230013A

Memory Dump Source

Source File: 00000000.00000002.1843357403.00000000022B0000.00000040.00001000.00020000.00000000.sdmp, Offset: 022B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_22b0000_5RRVBiCpFI.jbxd

Yara matches

Similarity

API ID: Virtual$ProtectSection$CreateView$AllocThread
String ID:
API String ID: 1248616170-0
Opcode ID: 34e3949558d47ac2efbd442dc042839410f73323f736e1ca0bff09bbd7760ed0
Instruction ID: 78dc2d836b6a6e642a149dab0853d2015c5ca381aa0a724ffb0e75da8df4149b
Opcode Fuzzy Hash: 34e3949558d47ac2efbd442dc042839410f73323f736e1ca0bff09bbd7760ed0
Instruction Fuzzy Hash: 32429C71618301AFD768CF64C984B6BB7E9FF88704F04492DFA859B291E770E845CBA1

Function 022B0D77 Relevance: 6.1, APIs: 4, Instructions: 100
threadprocessCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateToolhelp32Snapshot.KERNEL32(00000004,00000000,?,?,?,?,?,022B08BD,?,00000001,?,81EC8B55,000000FF), ref: 022B0DB5
Thread32First.KERNEL32(00000000,0000001C), ref: 022B0DE1
Wow64SuspendThread.KERNEL32(00000000), ref: 022B0E34
CloseHandle.KERNEL32(00000000), ref: 022B0E5E

Memory Dump Source

Source File: 00000000.00000002.1843357403.00000000022B0000.00000040.00001000.00020000.00000000.sdmp, Offset: 022B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_22b0000_5RRVBiCpFI.jbxd

Yara matches

Similarity

API ID: CloseCreateFirstHandleSnapshotSuspendThreadThread32Toolhelp32Wow64
String ID:
API String ID: 1849706056-0
Opcode ID: ed4f7e93d5c748d87e273fbd072de27cfcb41b6612c19f34ce8dd7f2a24eca5e
Instruction ID: cd0e873677c8bd25835692ca0c7d14c2190a3299e2084ea9b1e69a0ccce43d87
Opcode Fuzzy Hash: ed4f7e93d5c748d87e273fbd072de27cfcb41b6612c19f34ce8dd7f2a24eca5e
Instruction Fuzzy Hash: BF411C75A00109AFDB19DF98C890FEEB7B6EF88340F108168E6159B794DB34EE41CB94

Function 022B0C27 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 103
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateThread.KERNEL32(00000000,00000000,?,00000000,00000000,00000000), ref: 022B0CF3

Strings

,, xrefs: 022B0D3F

Memory Dump Source

Source File: 00000000.00000002.1843357403.00000000022B0000.00000040.00001000.00020000.00000000.sdmp, Offset: 022B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_22b0000_5RRVBiCpFI.jbxd

Yara matches

Similarity

API ID: CreateThread
String ID: ,
API String ID: 2422867632-3772416878
Opcode ID: fc60953fbf7661c618888493d7684cefa6d88d8934743e077e5b29c3addb46ae
Instruction ID: d793d46912f01ebab4fa8c523c4069566de4905e5b68b314a322a87a3573cdd1
Opcode Fuzzy Hash: fc60953fbf7661c618888493d7684cefa6d88d8934743e077e5b29c3addb46ae
Instruction Fuzzy Hash: 0B41B274A00209EFDB15CF98C994BAEB7B1FF88314F208198E515AB395C771AA85CF94

Function 022B0667 Relevance: 1.9, APIs: 1, Instructions: 399
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateThread.KERNEL32(00000000,00000000,?,00000000,00000000,00000000,?,00000001,?,81EC8B55,000000FF), ref: 022B090A

Memory Dump Source

Source File: 00000000.00000002.1843357403.00000000022B0000.00000040.00001000.00020000.00000000.sdmp, Offset: 022B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_22b0000_5RRVBiCpFI.jbxd

Yara matches

Similarity

API ID: CreateThread
String ID:
API String ID: 2422867632-0
Opcode ID: 9f100922927d95f7d89a2249628a3f1dcc35b7966142a06a62fc29a8db85cd85
Instruction ID: f5405dc54074efa98a5904656921d9b4b347daf50355b1385c01b69017087cf3
Opcode Fuzzy Hash: 9f100922927d95f7d89a2249628a3f1dcc35b7966142a06a62fc29a8db85cd85
Instruction Fuzzy Hash: 6912D1B0E10219DBDB15CF98C990BEEBBB2FF89304F2482A9D515AB385C7746A41CF54

Function 022FE3CC Relevance: 6.1, APIs: 4, Instructions: 99
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 023005EA: LoadLibraryA.KERNEL32(00000000,?,?), ref: 0230067C

VirtualProtect.KERNEL32(00000000,0000000C,00000040,?), ref: 022FE427
VirtualProtect.KERNEL32(00000000,0000000C,?,?), ref: 022FE45A
VirtualProtect.KERNEL32(00000000,0040145E,00000040,?), ref: 022FE48D
VirtualProtect.KERNEL32(00000000,0040145E,?,?), ref: 022FE4B7

Memory Dump Source

Source File: 00000000.00000002.1843357403.00000000022B0000.00000040.00001000.00020000.00000000.sdmp, Offset: 022B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_22b0000_5RRVBiCpFI.jbxd

Yara matches

Similarity

API ID: ProtectVirtual$LibraryLoad
String ID:
API String ID: 895956442-0
Opcode ID: 544c524c5f03252b96133d4295c441da5d44db607709df4b952f0ae727dfced4
Instruction ID: 3ef512f845db5796f802ad89cff1d6e83cd9329e937d1291506a98af9ad03a88
Opcode Fuzzy Hash: 544c524c5f03252b96133d4295c441da5d44db607709df4b952f0ae727dfced4
Instruction Fuzzy Hash: 5C210B721042497FE364A9E08C84F7BB69CDB85304F45043EFF46D21E0FB69A90587B1

Function 022FF23C Relevance: 4.8, APIs: 3, Instructions: 325
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualAlloc.KERNEL32(00000000,?,00003000,00000004,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 022FF2B6
VirtualFree.KERNELBASE(00000000,00000000,0000C000), ref: 022FF5FA
RtlExitUserProcess.NTDLL(00000000), ref: 022FF603

Memory Dump Source

Source File: 00000000.00000002.1843357403.00000000022B0000.00000040.00001000.00020000.00000000.sdmp, Offset: 022B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_22b0000_5RRVBiCpFI.jbxd

Yara matches

Similarity

API ID: Virtual$AllocExitFreeProcessUser
String ID:
API String ID: 1828502597-0
Opcode ID: 3017fd99d0584aa20b0153e116f0a50b272e6a421316d4372083565c5f77b8b3
Instruction ID: 3194d89b8332b8cd50247336ffa33549cec893b6fe706e0a83f494ed3becacdc
Opcode Fuzzy Hash: 3017fd99d0584aa20b0153e116f0a50b272e6a421316d4372083565c5f77b8b3
Instruction Fuzzy Hash: D3B11272510703ABCB759EA0CE90BABF7E9BF09304F100939EB4996994E730E554CFA1

Function 023005EA Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 66
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryA.KERNEL32(00000000,?,?), ref: 0230067C

Strings

.dll, xrefs: 02300621

Memory Dump Source

Source File: 00000000.00000002.1843357403.00000000022B0000.00000040.00001000.00020000.00000000.sdmp, Offset: 022B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_22b0000_5RRVBiCpFI.jbxd

Yara matches

Similarity

API ID: LibraryLoad
String ID: .dll
API String ID: 1029625771-2738580789
Opcode ID: f6f06f52cd4a024ca790678b75224790e8b38e6a55f670a1ffdfea5ea75d1fe1
Instruction ID: 54c242f614c7c2940cd6b5740dc0041ed7837b29b19769f1937a27c1aaedeebc
Opcode Fuzzy Hash: f6f06f52cd4a024ca790678b75224790e8b38e6a55f670a1ffdfea5ea75d1fe1
Instruction Fuzzy Hash: 5E212C756006A99FDB25CFECC4D4B6E7BA5EF45228F08416CD806CBA81DB30E845C7A0

Function 022FE4C7 Relevance: 3.0, APIs: 2, Instructions: 48
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 023005EA: LoadLibraryA.KERNEL32(00000000,?,?), ref: 0230067C

VirtualProtect.KERNEL32(00000000,00000004,00000040,?), ref: 022FE4FF
VirtualProtect.KERNEL32(00000000,00000004,?,?), ref: 022FE522

Memory Dump Source

Source File: 00000000.00000002.1843357403.00000000022B0000.00000040.00001000.00020000.00000000.sdmp, Offset: 022B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_22b0000_5RRVBiCpFI.jbxd

Yara matches

Similarity

API ID: ProtectVirtual$LibraryLoad
String ID:
API String ID: 895956442-0
Opcode ID: 355f7a5a870867b02340d2dab44903ecb3bac44aab23468b058fab7a7d97728b
Instruction ID: 2657a1e2b12daae8a99977c7cb706418bf62c317d0222b51da0a4013e03f9b05
Opcode Fuzzy Hash: 355f7a5a870867b02340d2dab44903ecb3bac44aab23468b058fab7a7d97728b
Instruction Fuzzy Hash: 5CF081B61106047EE721AAA4CC41FFB73ACDB49611F410428FB06D6080FB61B6458BB5

Non-executed Functions

Function 022E615E Relevance: 127.9, Strings: 102, Instructions: 417
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

x, xrefs: 022E61DA
M, xrefs: 022E616A
h, xrefs: 022E6403
a, xrefs: 022E6362
J, xrefs: 022E6331
c, xrefs: 022E661A
~, xrefs: 022E62F2
Z, xrefs: 022E63A1
e, xrefs: 022E61E8
, xrefs: 022E627B
z, xrefs: 022E6481
?, xrefs: 022E63A8
H, xrefs: 022E6323
!, xrefs: 022E6370
N, xrefs: 022E634D
d, xrefs: 022E6457
., xrefs: 022E626D
B, xrefs: 022E6369
., xrefs: 022E63D2
4, xrefs: 022E6729
t, xrefs: 022E6178
=, xrefs: 022E6346
e, xrefs: 022E623C
T, xrefs: 022E63E7
;, xrefs: 022E6354
t, xrefs: 022E631C
j, xrefs: 022E6411
N, xrefs: 022E62BA
<, xrefs: 022E62CF
s, xrefs: 022E63E0
i, xrefs: 022E6632
0, xrefs: 022E637E
0, xrefs: 022E62EB
4, xrefs: 022E6307
e, xrefs: 022E6212
i, xrefs: 022E61F6
@, xrefs: 022E635B
o, xrefs: 022E664A
[, xrefs: 022E62AC
", xrefs: 022E6289
V, xrefs: 022E63F5
p, xrefs: 022E64AB
(, xrefs: 022E6243
Z, xrefs: 022E62E4
~, xrefs: 022E61A2
4, xrefs: 022E6707
$, xrefs: 022E6297
Z, xrefs: 022E62C8
m, xrefs: 022E6642
O, xrefs: 022E62D6
k, xrefs: 022E663A
^, xrefs: 022E63BD
., xrefs: 022E63FC
>, xrefs: 022E638C
,, xrefs: 022E625F
r, xrefs: 022E64B9
-, xrefs: 022E6186
f, xrefs: 022E6465
N, xrefs: 022E6274
5, xrefs: 022E622E
&, xrefs: 022E62A5
F, xrefs: 022E6385
8, xrefs: 022E62B3
1, xrefs: 022E63EE
l, xrefs: 022E641F
%, xrefs: 022E61BE
b, xrefs: 022E6449
n, xrefs: 022E642D
], xrefs: 022E6496
:, xrefs: 022E62C1
>, xrefs: 022E62DD
?, xrefs: 022E6204
2, xrefs: 022E62F9
U, xrefs: 022E6258
D, xrefs: 022E629E
~, xrefs: 022E649D
v, xrefs: 022E61B0
\, xrefs: 022E63AF
;, xrefs: 022E632A
x, xrefs: 022E6473
|, xrefs: 022E648F
v, xrefs: 022E64D5
p, xrefs: 022E61CC
%, xrefs: 022E639A
+, xrefs: 022E63C4
*, xrefs: 022E6251
}, xrefs: 022E63B6
\, xrefs: 022E624A
g, xrefs: 022E662A
t, xrefs: 022E64C7
L, xrefs: 022E633F
e, xrefs: 022E6622
R, xrefs: 022E63D9
C, xrefs: 022E6450
P, xrefs: 022E63CB
), xrefs: 022E6300
`, xrefs: 022E643B
^, xrefs: 022E6290
l, xrefs: 022E6220
6, xrefs: 022E6315
X, xrefs: 022E6393
D, xrefs: 022E6377

Memory Dump Source

Source File: 00000000.00000002.1843357403.00000000022B0000.00000040.00001000.00020000.00000000.sdmp, Offset: 022B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_22b0000_5RRVBiCpFI.jbxd

Yara matches

Similarity

API ID:
String ID: $!$"$$$%$%$&$($)$*$+$,$-$.$.$.$0$0$1$2$4$4$4$5$6$8$:$;$;$<$=$>$>$?$?$@$B$C$D$D$F$H$J$L$M$N$N$N$O$P$R$T$U$V$X$Z$Z$Z$[$\$\$]$^$^$`$a$b$c$d$e$e$e$e$f$g$h$i$i$j$k$l$l$m$n$o$p$p$r$s$t$t$t$v$v$x$x$z$|$}$~$~$~
API String ID: 0-1394229784
Opcode ID: 0ad0ccab371ecf03d36c413c93bc7494f07a7df5888065dda6a46f4b89f4694b
Instruction ID: 483c89d986e3f802783609f8ce2c9e959f8887dbd42d387d3ced67ff5fb8f4e8
Opcode Fuzzy Hash: 0ad0ccab371ecf03d36c413c93bc7494f07a7df5888065dda6a46f4b89f4694b
Instruction Fuzzy Hash: F8226A2190C7D9CDEB26C678CC587DDBEA15B62314F4841D9C19D6B3C2C7BA0B89CB26

Function 022E5BCC Relevance: 36.6, Strings: 29, Instructions: 348
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

n, xrefs: 022E5E31
>, xrefs: 022E5E0C
w, xrefs: 022E5CDE
`, xrefs: 022E5E39
|, xrefs: 022E5CB6
|, xrefs: 022E5E69
:, xrefs: 022E5E2D
}, xrefs: 022E5CC6
n, xrefs: 022E5C96
+, xrefs: 022E5BD8
h, xrefs: 022E5C7E
a, xrefs: 022E5C8E
`, xrefs: 022E5C76
g, xrefs: 022E5C9E
b, xrefs: 022E5E41
x, xrefs: 022E5E59
C, xrefs: 022E5CEE
d, xrefs: 022E5E49
p, xrefs: 022E5CCE
{, xrefs: 022E5CBE
*, xrefs: 022E5C1E
s, xrefs: 022E5CD6
<, xrefs: 022E5E03
z, xrefs: 022E5E61
f, xrefs: 022E5E51
0, xrefs: 022E5F5B
d, xrefs: 022E5CAE
{, xrefs: 022E5E65
@, xrefs: 022E5CE6

Memory Dump Source

Source File: 00000000.00000002.1843357403.00000000022B0000.00000040.00001000.00020000.00000000.sdmp, Offset: 022B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_22b0000_5RRVBiCpFI.jbxd

Yara matches

Similarity

API ID:
String ID: *$+$0$:$<$>$@$C$`$`$a$b$d$d$f$g$h$n$n$p$s$w$x$z${${$|$|$}
API String ID: 0-334816167
Opcode ID: 63cdccc75301cd355fa4edc8c506f7aea9a9e61635fb673e26f729942e3a0ac3
Instruction ID: cc7beb73d104af828b15d6b53732d44ce3b1293b81a35ffc6f162d3fc9acc6d6
Opcode Fuzzy Hash: 63cdccc75301cd355fa4edc8c506f7aea9a9e61635fb673e26f729942e3a0ac3
Instruction Fuzzy Hash: 50F10521D187E98ACB32C6BC8C443DDBFA15B53224F1D43D8D4E9AB3D6C6750A46CB52

Function 022BAD64 Relevance: 18.0, Strings: 14, Instructions: 458
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

~p~9, xrefs: 022BAE99
PVNR, xrefs: 022BAEC9
R:e}, xrefs: 022BAEA9
LSJm, xrefs: 022BAED1
wkoq, xrefs: 022BAEB9
p~rs, xrefs: 022BAE89
sD/f, xrefs: 022BAE91
`{R2, xrefs: 022BAEB1
<'=0, xrefs: 022BADA4
rz|x, xrefs: 022BB202
; >?, xrefs: 022BADB4
9/,8, xrefs: 022BAD9C
agsy, xrefs: 022BAEA1
7]7N, xrefs: 022BAEC1

Memory Dump Source

Source File: 00000000.00000002.1843357403.00000000022B0000.00000040.00001000.00020000.00000000.sdmp, Offset: 022B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_22b0000_5RRVBiCpFI.jbxd

Yara matches

Similarity

API ID:
String ID: 7]7N$9/,8$; >?$<'=0$LSJm$PVNR$R:e}$`{R2$agsy$p~rs$rz|x$sD/f$wkoq$~p~9
API String ID: 0-2345621967
Opcode ID: a9be2e0f6340cc52a81f7dbe1f742bb92054bc815233c9bebfa9ac53ecd4af8d
Instruction ID: 1238ae657b08ddb23cb2563d2a3e40b2733e93eba81d7af3b39b3b0a6cf12557
Opcode Fuzzy Hash: a9be2e0f6340cc52a81f7dbe1f742bb92054bc815233c9bebfa9ac53ecd4af8d
Instruction Fuzzy Hash: 29C1597150C3858BD316CE6584A07ABBFE1EFD2345F18856CE8E11B386D739490ACB66

Function 022C1531 Relevance: 17.1, Strings: 13, Instructions: 892
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

Z, xrefs: 022C1DCD
+, xrefs: 022C1F2C
t, xrefs: 022C1B0D
O, xrefs: 022C1A24
g, xrefs: 022C191E
\, xrefs: 022C1DBD
q, xrefs: 022C16A7
C, xrefs: 022C1714
&, xrefs: 022C170F
4, xrefs: 022C1776
@, xrefs: 022C1B05
T, xrefs: 022C1766
Y, xrefs: 022C1DC5

Memory Dump Source

Source File: 00000000.00000002.1843357403.00000000022B0000.00000040.00001000.00020000.00000000.sdmp, Offset: 022B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_22b0000_5RRVBiCpFI.jbxd

Yara matches

Similarity

API ID:
String ID: &$+$4$@$C$O$T$Y$Z$\$g$q$t
API String ID: 0-2174627302
Opcode ID: 2c149d579c2bfbe290bb8fc034ca28ef72b0ce807b879de6ec01245955241a86
Instruction ID: 78a10e1860d536fdacafde93ef2b8565cf232d0e309671c3ad10c3103915763a
Opcode Fuzzy Hash: 2c149d579c2bfbe290bb8fc034ca28ef72b0ce807b879de6ec01245955241a86
Instruction Fuzzy Hash: 7F72907162C7818FD324DB78C4953AEBBE2AFC5310F294A2DD5D98738ADA798445CB03

Function 022D99D5 Relevance: 14.2, Strings: 11, Instructions: 461COMMON

Download Yara Rule

Strings

Q5Z7, xrefs: 022D9D1F
\9X;, xrefs: 022D9D27
T!M#, xrefs: 022D9CF7
V%G', xrefs: 022D9CFF
*B), xrefs: 022D9BAF
U1D3, xrefs: 022D9D17
<=, xrefs: 022D9D2F
p-B/, xrefs: 022D9D0F
*B), xrefs: 022D9E4F
XY, xrefs: 022D9E01
O)O+, xrefs: 022D9D07

Memory Dump Source

Source File: 00000000.00000002.1843357403.00000000022B0000.00000040.00001000.00020000.00000000.sdmp, Offset: 022B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_22b0000_5RRVBiCpFI.jbxd

Yara matches

Similarity

API ID:
String ID: *B)$*B)$<=$O)O+$Q5Z7$T!M#$U1D3$V%G'$XY$\9X;$p-B/
API String ID: 0-898000180
Opcode ID: 9fc2874815f84d3ef4346084d008133ae0ec9231113661370af9e7ee02782906
Instruction ID: eab154baa7d2aa29df3735291e91e6a9cb30b96107426b6a651bb0f018be3b8e
Opcode Fuzzy Hash: 9fc2874815f84d3ef4346084d008133ae0ec9231113661370af9e7ee02782906
Instruction Fuzzy Hash: 7AC1DDB12583128BDB14CFA8C89176BB7F2EF96754F088A5CF4D64B398E3348941C796

Function 022E7D14 Relevance: 10.6, Strings: 8, Instructions: 636COMMON

Download Yara Rule

Strings

BC, xrefs: 022E8099
w!s#, xrefs: 022E802A, 022E802E
A;, xrefs: 022E7F70
z7}9A3q5, xrefs: 022E80EF
X&c8, xrefs: 022E7DC3
Y/9Q, xrefs: 022E8071
T'g), xrefs: 022E8061
C, xrefs: 022E7E9D

Memory Dump Source

Source File: 00000000.00000002.1843357403.00000000022B0000.00000040.00001000.00020000.00000000.sdmp, Offset: 022B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_22b0000_5RRVBiCpFI.jbxd

Yara matches

Similarity

API ID:
String ID: A;$BC$C$T'g)$X&c8$Y/9Q$w!s#$z7}9A3q5
API String ID: 0-4124187736
Opcode ID: b153d1fc5e8c49ab62819e924da86a1564e16a90d23bd0416ffed42527983d6d
Instruction ID: 7775c49612fc7501db0236f7301b4553ebd84315e42eb2939c513f4b23738a1b
Opcode Fuzzy Hash: b153d1fc5e8c49ab62819e924da86a1564e16a90d23bd0416ffed42527983d6d
Instruction Fuzzy Hash: 1912DA72A183418BD714CFA8C881B6BBBE6FFC5304F14492CE696DB2A0D774D905CB92

Function 022D5568 Relevance: 10.4, Strings: 8, Instructions: 446COMMON

Download Yara Rule

Strings

EG, xrefs: 022D59B0
>V, xrefs: 022D5CE4
UW, xrefs: 022D59CC
|~, xrefs: 022D5B62
<>, xrefs: 022D5BE4
IK, xrefs: 022D59B7
>V, xrefs: 022D5E8A
4%, xrefs: 022D5809

Memory Dump Source

Source File: 00000000.00000002.1843357403.00000000022B0000.00000040.00001000.00020000.00000000.sdmp, Offset: 022B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_22b0000_5RRVBiCpFI.jbxd

Yara matches

Similarity

API ID:
String ID: 4%$>V$>V$<>$EG$IK$UW$|~
API String ID: 0-2246970021
Opcode ID: cc1dde96a411e1e6fcd6a59f7ef47bdc2781b26c4dfcad69bf9094ee8fc7f5bd
Instruction ID: 88c3a8f843b41b8cecd2b6958cb59ee929c0f030659740cfb6c8117c967ac90f
Opcode Fuzzy Hash: cc1dde96a411e1e6fcd6a59f7ef47bdc2781b26c4dfcad69bf9094ee8fc7f5bd
Instruction Fuzzy Hash: 753242B0611B469FDB48CF2AD580389BBB1FF45300F548698C9595FB5ADB35A8A2CFC0

Function 022D2C14 Relevance: 8.0, Strings: 6, Instructions: 536COMMON

Download Yara Rule

Strings

U, xrefs: 022D31F7
h, xrefs: 022D2E26
,, xrefs: 022D3152
V, xrefs: 022D31ED
T, xrefs: 022D31F2
!@, xrefs: 022D2C4A

Memory Dump Source

Source File: 00000000.00000002.1843357403.00000000022B0000.00000040.00001000.00020000.00000000.sdmp, Offset: 022B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_22b0000_5RRVBiCpFI.jbxd

Yara matches

Similarity

API ID:
String ID: !@$,$T$U$V$h
API String ID: 0-1072848446
Opcode ID: 8e8ca45835480ccfa162dc2bafbba4cee2664ffe78ab865597f6f2298b61ffbe
Instruction ID: 555fc9e558111f667d7a4dcc3d8ebd8c7033deeeb06b6ec483d29c724d8b5101
Opcode Fuzzy Hash: 8e8ca45835480ccfa162dc2bafbba4cee2664ffe78ab865597f6f2298b61ffbe
Instruction Fuzzy Hash: 7C22A13162C7918FD360CBA8C44436EBBE1ABC6314F058A6DE9D687396D7B9C844CB43

Function 022DE17E Relevance: 7.8, Strings: 6, Instructions: 346COMMON

Download Yara Rule

Strings

D@6T, xrefs: 022DE536
0, xrefs: 022DE3EF
EF, xrefs: 022DE69E
5, xrefs: 022DE451
&=, xrefs: 022DE54C
zJyL, xrefs: 022DE67D

Memory Dump Source

Source File: 00000000.00000002.1843357403.00000000022B0000.00000040.00001000.00020000.00000000.sdmp, Offset: 022B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_22b0000_5RRVBiCpFI.jbxd

Yara matches

Similarity

API ID:
String ID: &=$0$5$D@6T$EF$zJyL
API String ID: 0-3264166258
Opcode ID: 6f787935f52e1d9f41ee2cdf27def6dc2193743486b37ecbc705986605444a77
Instruction ID: b56f50062fe5d3088f56d554608751e105d154391204050551bc5591e14d2754
Opcode Fuzzy Hash: 6f787935f52e1d9f41ee2cdf27def6dc2193743486b37ecbc705986605444a77
Instruction Fuzzy Hash: 26B1F77011C3818BE368CF6984907BBBBD2EFD6314F198A6DE4DA8B295DB748449C713

Function 022D20E4 Relevance: 6.7, Strings: 5, Instructions: 481COMMON

Download Yara Rule

Strings

wy, xrefs: 022D21A9
0c=e, xrefs: 022D21C1
2g1i, xrefs: 022D21C9
<k;m, xrefs: 022D21D1
&', xrefs: 022D249A

Memory Dump Source

Source File: 00000000.00000002.1843357403.00000000022B0000.00000040.00001000.00020000.00000000.sdmp, Offset: 022B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_22b0000_5RRVBiCpFI.jbxd

Yara matches

Similarity

API ID:
String ID: &'$0c=e$2g1i$<k;m$wy
API String ID: 0-3335612808
Opcode ID: eb1d602c92fd99bd83cb42d187dbb3c1cba3f1d687f489207edda56632bda968
Instruction ID: 54f6cf3ff41778149cd164504c47d6a16022c227e8dbda46968ebf01c7e21a8a
Opcode Fuzzy Hash: eb1d602c92fd99bd83cb42d187dbb3c1cba3f1d687f489207edda56632bda968
Instruction Fuzzy Hash: 02D10871618301CBD728DF64C86176BB7F2EF92354F189A6CD9828F3A9E7789401CB52

Function 022DE218 Relevance: 6.6, Strings: 5, Instructions: 336COMMON

Download Yara Rule

Strings

D@6T, xrefs: 022DE536
EF, xrefs: 022DE69E
5, xrefs: 022DE451
&=, xrefs: 022DE54C
zJyL, xrefs: 022DE67D

Memory Dump Source

Source File: 00000000.00000002.1843357403.00000000022B0000.00000040.00001000.00020000.00000000.sdmp, Offset: 022B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_22b0000_5RRVBiCpFI.jbxd

Yara matches

Similarity

API ID:
String ID: &=$5$D@6T$EF$zJyL
API String ID: 0-923305466
Opcode ID: f99561a0788cee97c829df764e2ebd4c7b90c8b56b0bfd503a4f7d65a1aead45
Instruction ID: 0e4d6709a1f04c0445846fff31bb2af269856947a3fa2833fd33780399aa72bb
Opcode Fuzzy Hash: f99561a0788cee97c829df764e2ebd4c7b90c8b56b0bfd503a4f7d65a1aead45
Instruction Fuzzy Hash: 6FA1F77011C3818BE769CF6984907BBBBD2EFD2304F198A6DD4DA8B295DB748449CB13

Function 022DE269 Relevance: 6.6, Strings: 5, Instructions: 335COMMON

Download Yara Rule

Strings

D@6T, xrefs: 022DE536
EF, xrefs: 022DE69E
5, xrefs: 022DE451
&=, xrefs: 022DE54C
zJyL, xrefs: 022DE67D

Memory Dump Source

Source File: 00000000.00000002.1843357403.00000000022B0000.00000040.00001000.00020000.00000000.sdmp, Offset: 022B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_22b0000_5RRVBiCpFI.jbxd

Yara matches

Similarity

API ID:
String ID: &=$5$D@6T$EF$zJyL
API String ID: 0-923305466
Opcode ID: 5eea70b87afb6f6764b4b0a803c2ee816a1ddf72bf9f3ac6a73094afb86f43b5
Instruction ID: 61f3aa79c071d8f477cb9ebdff2dd9d1c2c497d05173bbd59125c72c0d5f71bd
Opcode Fuzzy Hash: 5eea70b87afb6f6764b4b0a803c2ee816a1ddf72bf9f3ac6a73094afb86f43b5
Instruction Fuzzy Hash: BCA1F87011C3818BE768CF6984907BBBBD2EFD2304F198A6DD4DA8B295DB748449C713

Function 022DE25A Relevance: 6.6, Strings: 5, Instructions: 312COMMON

Download Yara Rule

Strings

D@6T, xrefs: 022DE536
EF, xrefs: 022DE69E
5, xrefs: 022DE451
&=, xrefs: 022DE54C
zJyL, xrefs: 022DE67D

Memory Dump Source

Source File: 00000000.00000002.1843357403.00000000022B0000.00000040.00001000.00020000.00000000.sdmp, Offset: 022B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_22b0000_5RRVBiCpFI.jbxd

Yara matches

Similarity

API ID:
String ID: &=$5$D@6T$EF$zJyL
API String ID: 0-923305466
Opcode ID: 964c76fda7f37207e59e987132c18f71186e6d03fd2999a299809d292455ad42
Instruction ID: 7be829eb032d65daffe87ffcf0d1ed9669d48967ea9803c70640bac989e7513a
Opcode Fuzzy Hash: 964c76fda7f37207e59e987132c18f71186e6d03fd2999a299809d292455ad42
Instruction Fuzzy Hash: 5BA1E47011C3818BE364CF6984907BBBBD2AFD2304F298A6DD4D98B296DB748449CB53

Function 022CFAB4 Relevance: 5.9, Strings: 4, Instructions: 864COMMON

Download Yara Rule

Strings

&-, xrefs: 022CFECE
)R_X, xrefs: 022CFCA4
[O_[, xrefs: 022CFDDC
zusR, xrefs: 022CFC82

Memory Dump Source

Source File: 00000000.00000002.1843357403.00000000022B0000.00000040.00001000.00020000.00000000.sdmp, Offset: 022B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_22b0000_5RRVBiCpFI.jbxd

Yara matches

Similarity

API ID:
String ID: &-$)R_X$[O_[$zusR
API String ID: 0-3432275560
Opcode ID: c72d066a0ba9d98f0ff19214e9d8c23779a55738a99cb06a59f657220fc0cf28
Instruction ID: 154e2fde65c5249c72632fa279a17185bb5b35b3d98e4ee6d2366d8346602ead
Opcode Fuzzy Hash: c72d066a0ba9d98f0ff19214e9d8c23779a55738a99cb06a59f657220fc0cf28
Instruction Fuzzy Hash: 9342797051C3818FC725DFA8C85076EBBE2AF86314F08866DE8E44B3A6D775C605CB92

Function 022DD02B Relevance: 5.5, Strings: 4, Instructions: 523COMMON

Download Yara Rule

Strings

%(#}, xrefs: 022DD274
/26-, xrefs: 022DD269
1, xrefs: 022DD68D
/, xrefs: 022DD43C

Memory Dump Source

Source File: 00000000.00000002.1843357403.00000000022B0000.00000040.00001000.00020000.00000000.sdmp, Offset: 022B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_22b0000_5RRVBiCpFI.jbxd

Yara matches

Similarity

API ID:
String ID: %(#}$/$/26-$1
API String ID: 0-261129489
Opcode ID: f133d09027ec2c5d3c2aef6507ecce0520632deac5b770a07f28f5cb5c76ebf0
Instruction ID: 1935a040ce3608cbd99cb070791b73660e9c0dc3409fc809d826fd57931cf8de
Opcode Fuzzy Hash: f133d09027ec2c5d3c2aef6507ecce0520632deac5b770a07f28f5cb5c76ebf0
Instruction Fuzzy Hash: 15E1F87212C7C28BE775CF78C4507BABBD6EF92204F18896DD0D987296DB34910ACB52

Function 022DD030 Relevance: 5.5, Strings: 4, Instructions: 519COMMON

Download Yara Rule

Strings

%(#}, xrefs: 022DD274
/26-, xrefs: 022DD269
1, xrefs: 022DD68D
/, xrefs: 022DD43C

Memory Dump Source

Source File: 00000000.00000002.1843357403.00000000022B0000.00000040.00001000.00020000.00000000.sdmp, Offset: 022B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_22b0000_5RRVBiCpFI.jbxd

Yara matches

Similarity

API ID:
String ID: %(#}$/$/26-$1
API String ID: 0-261129489
Opcode ID: 47b00d7d64a94561f5ec20e782c8b23bde4d21acf7bd80337db5547180c095d9
Instruction ID: 12e69094d28e2115649f046aa31e820fbaa4effe55c4b482396d8a82515617c7
Opcode Fuzzy Hash: 47b00d7d64a94561f5ec20e782c8b23bde4d21acf7bd80337db5547180c095d9
Instruction Fuzzy Hash: 59E1F57211C7C18BE735CF35C4607BABBD6AFD2204F1888ADC1D98B296DB79410ACB16

Function 022BEB27 Relevance: 5.3, Strings: 4, Instructions: 291COMMON

Download Yara Rule

Strings

ZG, xrefs: 022BED8E
pr, xrefs: 022BEE25
3ej, xrefs: 022BEE11
BI, xrefs: 022BED87

Memory Dump Source

Source File: 00000000.00000002.1843357403.00000000022B0000.00000040.00001000.00020000.00000000.sdmp, Offset: 022B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_22b0000_5RRVBiCpFI.jbxd

Yara matches

Similarity

API ID:
String ID: BI$ZG$3ej$pr
API String ID: 0-483502859
Opcode ID: f72a1af4f7c4914e3558ee5fe4304fc6666decd496300a2b177a412071557166
Instruction ID: 8e1b304c482575e81e4f6a3fff87c37bfb497fa03d75ce6085e763e6d94227ad
Opcode Fuzzy Hash: f72a1af4f7c4914e3558ee5fe4304fc6666decd496300a2b177a412071557166
Instruction Fuzzy Hash: A3A1C3B52117818FD719CF69C590AA2BBE2FF96340B1A95ADC0D68F766D734E802CF10

Function 022CDA79 Relevance: 5.3, Strings: 4, Instructions: 271COMMON

Download Yara Rule

Strings

Iz, xrefs: 022CDC93
[^, xrefs: 022CDD1C
-, xrefs: 022CDC9B
C\, xrefs: 022CDD24

Memory Dump Source

Source File: 00000000.00000002.1843357403.00000000022B0000.00000040.00001000.00020000.00000000.sdmp, Offset: 022B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_22b0000_5RRVBiCpFI.jbxd

Yara matches

Similarity

API ID:
String ID: -$C\$Iz$[^
API String ID: 0-2105564891
Opcode ID: 856b381f3345170c9e1f152739ef8b6d943d9b4d3d608726b0c255f8cc161e2c
Instruction ID: 6390c75819d5a9dd4ee0efb05bd59e31f1cafb392f3ae9a234bacb4d5a89e8dd
Opcode Fuzzy Hash: 856b381f3345170c9e1f152739ef8b6d943d9b4d3d608726b0c255f8cc161e2c
Instruction Fuzzy Hash: A881DAB265C3509FD308CFA9885145FFBE2EFD1300F59896CF0E98B255D779960A8B82

Function 022E79D4 Relevance: 5.3, Strings: 4, Instructions: 253COMMON

Download Yara Rule

Strings

U, xrefs: 022E79ED
V, xrefs: 022E79F2
T, xrefs: 022E79E8
k, xrefs: 022E79E3

Memory Dump Source

Source File: 00000000.00000002.1843357403.00000000022B0000.00000040.00001000.00020000.00000000.sdmp, Offset: 022B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_22b0000_5RRVBiCpFI.jbxd

Yara matches

Similarity

API ID:
String ID: T$U$V$k
API String ID: 0-1255220828
Opcode ID: c93e863c5daac2f8ca78168b26a37bbe867cb239aeeaedccae74f18b85e983c0
Instruction ID: 8ca404ed1cbc8b296f1a799cbf077b80f20697ec78f0f45bd9c94ce48fc2bbe1
Opcode Fuzzy Hash: c93e863c5daac2f8ca78168b26a37bbe867cb239aeeaedccae74f18b85e983c0
Instruction Fuzzy Hash: 20A1123112C3918EDB14DBB8989022EFBD26BC6328F894B2DE4E7873D6D7748945D706

Function 022C2D19 Relevance: 4.3, Strings: 3, Instructions: 558COMMON

Download Yara Rule

Strings

e, xrefs: 022C3376
0, xrefs: 022C3143
V, xrefs: 022C2D27

Memory Dump Source

Source File: 00000000.00000002.1843357403.00000000022B0000.00000040.00001000.00020000.00000000.sdmp, Offset: 022B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_22b0000_5RRVBiCpFI.jbxd

Yara matches

Similarity

API ID:
String ID: 0$V$e
API String ID: 0-3964817793
Opcode ID: c7716370ac8927f06ffe637d3cea15850e05a15dbd07c9effa12d3fdb0013073
Instruction ID: 9f8248275c88b3b293a7fc405db9f31f26795e0ff9bc01cb3d0c8e3a9c0adf2e
Opcode Fuzzy Hash: c7716370ac8927f06ffe637d3cea15850e05a15dbd07c9effa12d3fdb0013073
Instruction Fuzzy Hash: BC22E57262C7808BD725DB7884903AEBBD2AFC5320F198F6DD5E9873D5DA748901CB42

Function 022CA0AC Relevance: 4.0, Strings: 3, Instructions: 234COMMON

Download Yara Rule

Strings

?TUV, xrefs: 022CA238
"w+y, xrefs: 022CA0DF
DX8Z, xrefs: 022CA223

Memory Dump Source

Source File: 00000000.00000002.1843357403.00000000022B0000.00000040.00001000.00020000.00000000.sdmp, Offset: 022B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_22b0000_5RRVBiCpFI.jbxd

Yara matches

Similarity

API ID:
String ID: "w+y$?TUV$DX8Z
API String ID: 0-3307990326
Opcode ID: f9c6fa3e94296cf0f303a5eebcc6256c78eaf4459c267ceffca2c103466db4c7
Instruction ID: d8110762fa1f499e0d3fa37732c0a748761e1088fd7d92bb31537685027aaa75
Opcode Fuzzy Hash: f9c6fa3e94296cf0f303a5eebcc6256c78eaf4459c267ceffca2c103466db4c7
Instruction Fuzzy Hash: DB81FF716107228FC728CF29C890666B3F2FF99710B29869CC8824FB69E775E841CB44

Function 022CB2A4 Relevance: 3.7, Strings: 2, Instructions: 1211COMMON

Download Yara Rule

Strings

,)*k, xrefs: 022CB988
I,~M, xrefs: 022CBF7C

Memory Dump Source

Source File: 00000000.00000002.1843357403.00000000022B0000.00000040.00001000.00020000.00000000.sdmp, Offset: 022B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_22b0000_5RRVBiCpFI.jbxd

Yara matches

Similarity

API ID:
String ID: ,)*k$I,~M
API String ID: 0-936430989
Opcode ID: 33fe9d4cb84d20c875b3126a1f51ea659af71ca5d5df44b5ba46a13c9140ded4
Instruction ID: d1992fb03fd2f95b7a8f170d87e37f0608308054e894937c796bbd307191c401
Opcode Fuzzy Hash: 33fe9d4cb84d20c875b3126a1f51ea659af71ca5d5df44b5ba46a13c9140ded4
Instruction Fuzzy Hash: 338216746283415FD724CFA49881B3FBBE2EFC6718F288A2CE58557299D771D802CB46

Function 022BC474 Relevance: 2.9, Strings: 2, Instructions: 421COMMON

Download Yara Rule

Strings

de, xrefs: 022BC627
BE, xrefs: 022BC691

Memory Dump Source

Source File: 00000000.00000002.1843357403.00000000022B0000.00000040.00001000.00020000.00000000.sdmp, Offset: 022B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_22b0000_5RRVBiCpFI.jbxd

Yara matches

Similarity

API ID:
String ID: BE$de
API String ID: 0-1272349043
Opcode ID: 4d61e13fd748368ac6030c890ff82cb0220032c3e56c3c983d389722b1fc0e45
Instruction ID: 7b45a9c33b9ab6b7516f616414177c00674a7d30d38a06eebf2390d36b819424
Opcode Fuzzy Hash: 4d61e13fd748368ac6030c890ff82cb0220032c3e56c3c983d389722b1fc0e45
Instruction Fuzzy Hash: 2AD1237262C3518FD729DF6888512BFBBE2AFC6344F18492DE8D19B385D7748906C782

Function 022B5EA4 Relevance: 2.8, Strings: 2, Instructions: 329COMMON

Download Yara Rule

Strings

IEND, xrefs: 022B6295
), xrefs: 022B5F1F

Memory Dump Source

Source File: 00000000.00000002.1843357403.00000000022B0000.00000040.00001000.00020000.00000000.sdmp, Offset: 022B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_22b0000_5RRVBiCpFI.jbxd

Yara matches

Similarity

API ID:
String ID: )$IEND
API String ID: 0-707183367
Opcode ID: 0115d670064ac457273b2f2da0dd0fccc32687026287eda2a08cfdc2e9f8888c
Instruction ID: 8d9539a787a88f5f990eae090d7483428538f1f2de990b0b5d00c608d06f9d29
Opcode Fuzzy Hash: 0115d670064ac457273b2f2da0dd0fccc32687026287eda2a08cfdc2e9f8888c
Instruction Fuzzy Hash: 59D1CAB19183459FE721CF54C88479ABBE8EF84344F04892DFA989B381D3B5D948CB92

Function 022DCCF4 Relevance: 2.8, Strings: 2, Instructions: 271COMMON

Download Yara Rule

Strings

Fg, xrefs: 022DCD8B
RU]l, xrefs: 022DCD0C

Memory Dump Source

Source File: 00000000.00000002.1843357403.00000000022B0000.00000040.00001000.00020000.00000000.sdmp, Offset: 022B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_22b0000_5RRVBiCpFI.jbxd

Yara matches

Similarity

API ID:
String ID: Fg$RU]l
API String ID: 0-3680832515
Opcode ID: 212695677cf782d22b69bcc5005693ffe3c19f735568b368facab7bd000f874a
Instruction ID: d8fabd6b0d2e48134da6c4491c29723b352c08cbb994a1a192bfdc638bf8a4e8
Opcode Fuzzy Hash: 212695677cf782d22b69bcc5005693ffe3c19f735568b368facab7bd000f874a
Instruction Fuzzy Hash: 3371F67121D3C18BE7798F64C8517EBBBD3EBD2214F18996DD0D947296DB38400ADB12

Function 022EE654 Relevance: 2.6, Strings: 2, Instructions: 141COMMON

Download Yara Rule

Strings

ihgf, xrefs: 022EE747
@, xrefs: 022EE729

Memory Dump Source

Source File: 00000000.00000002.1843357403.00000000022B0000.00000040.00001000.00020000.00000000.sdmp, Offset: 022B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_22b0000_5RRVBiCpFI.jbxd

Yara matches

Similarity

API ID:
String ID: @$ihgf
API String ID: 0-73152791
Opcode ID: f9d2302128f83c98de01ee7664bc871aec8e86cdf99c8f751253d6371e8ab131
Instruction ID: 66f7c64cdc26229e4af6d5f377ee0aa7973be7f13093a1f929d35d5a5b9f86d4
Opcode Fuzzy Hash: f9d2302128f83c98de01ee7664bc871aec8e86cdf99c8f751253d6371e8ab131
Instruction Fuzzy Hash: 1D4127B1A143028BDB14CF64C8527BBB7A2FF92328F55822CD5568B395E735D905CB82

Function 022C6E19 Relevance: 2.6, Strings: 2, Instructions: 113COMMON

Download Yara Rule

Strings

^P, xrefs: 022C6E7F
Z\, xrefs: 022C6E78

Memory Dump Source

Source File: 00000000.00000002.1843357403.00000000022B0000.00000040.00001000.00020000.00000000.sdmp, Offset: 022B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_22b0000_5RRVBiCpFI.jbxd

Yara matches

Similarity

API ID:
String ID: Z\$^P
API String ID: 0-3724859648
Opcode ID: 4f7f96cc206f4a51d8ad8bab145ebd28e0a9ebd1b083b1ab060fd53171580dc2
Instruction ID: 1c6ee1f6c1ca291338c32737225d8540c5db4a5f2cf3fbeaf3ccc88aa6ff2955
Opcode Fuzzy Hash: 4f7f96cc206f4a51d8ad8bab145ebd28e0a9ebd1b083b1ab060fd53171580dc2
Instruction Fuzzy Hash: 3841E2B1921601CFC729CF64C891AB2B7B2FF89314B16825CD4978F7A4E738E801CB55

Function 022FC674 Relevance: 2.3, Strings: 1, Instructions: 1066COMMON

Download Yara Rule

Strings

@, xrefs: 022FC773

Memory Dump Source

Source File: 00000000.00000002.1843357403.00000000022B0000.00000040.00001000.00020000.00000000.sdmp, Offset: 022B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_22b0000_5RRVBiCpFI.jbxd

Yara matches

Similarity

API ID:
String ID: @
API String ID: 0-2766056989
Opcode ID: 7d58ce99e14cd4456ae23e5809613514da7f6838dea5dcaaa26db1aac14b0b8b
Instruction ID: 5e613e2bcb8078c9feae59110c9314e250e52882cd41eadb91562d0d3b581f4a
Opcode Fuzzy Hash: 7d58ce99e14cd4456ae23e5809613514da7f6838dea5dcaaa26db1aac14b0b8b
Instruction Fuzzy Hash: 8672A530628B498BDB69DF68C8857A9B3E1FB98314F14463ED98BC7245DF34E542CB81

Function 022EB364 Relevance: 1.9, Strings: 1, Instructions: 681COMMON

Download Yara Rule

Strings

f, xrefs: 022EB599

Memory Dump Source

Source File: 00000000.00000002.1843357403.00000000022B0000.00000040.00001000.00020000.00000000.sdmp, Offset: 022B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_22b0000_5RRVBiCpFI.jbxd

Yara matches

Similarity

API ID:
String ID: f
API String ID: 0-1993550816
Opcode ID: 63a83f5a27331d9fe3a04257bda5fcaf30bc217a6dc898aca3077588f1bd9e28
Instruction ID: fe501e8d76f0f13f81d12e172b9f8d5698ff0fcddebb55c491b072aadbad349c
Opcode Fuzzy Hash: 63a83f5a27331d9fe3a04257bda5fcaf30bc217a6dc898aca3077588f1bd9e28
Instruction Fuzzy Hash: 502212716283528FDB14CF65C890B2BBBE2BBC5318F488A2CE5D687395DB70D805DB42

Function 022CA802 Relevance: 1.8, Strings: 1, Instructions: 598COMMON

Download Yara Rule

Strings

[, xrefs: 022CACF8

Memory Dump Source

Source File: 00000000.00000002.1843357403.00000000022B0000.00000040.00001000.00020000.00000000.sdmp, Offset: 022B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_22b0000_5RRVBiCpFI.jbxd

Yara matches

Similarity

API ID:
String ID: [
API String ID: 0-3878419350
Opcode ID: 5eb09604ed9747dca5d4520930199d487a8f62beec0cfa78d34f9f01c84922a2
Instruction ID: 9beb86f89714c9c9761df53d216a7496b362ef1314fc42ffb7c582fc2984ba3f
Opcode Fuzzy Hash: 5eb09604ed9747dca5d4520930199d487a8f62beec0cfa78d34f9f01c84922a2
Instruction Fuzzy Hash: 03022175611702CBCB34CF69C8D1662B7F2FF95314B29869CC4864B7A9EB39E442CB90

Function 022E8734 Relevance: 1.7, Strings: 1, Instructions: 453COMMON

Download Yara Rule

Strings

,)*k, xrefs: 022E8859

Memory Dump Source

Source File: 00000000.00000002.1843357403.00000000022B0000.00000040.00001000.00020000.00000000.sdmp, Offset: 022B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_22b0000_5RRVBiCpFI.jbxd

Yara matches

Similarity

API ID:
String ID: ,)*k
API String ID: 0-1228391949
Opcode ID: 81a23c36fe8827921ec37ff3d571e3748504ad247d1e8451f876af876380c648
Instruction ID: 97cf72cafa3dfe7186652f283efc851f21d210320d4e04dfdeadcd37092622b6
Opcode Fuzzy Hash: 81a23c36fe8827921ec37ff3d571e3748504ad247d1e8451f876af876380c648
Instruction Fuzzy Hash: 35C15975A183515BDF24DF90C980A3FB7E2ABD6704F599A2CE9C6533A5D7309800D783

Function 022CE1EE Relevance: 1.7, Strings: 1, Instructions: 445COMMON

Download Yara Rule

Strings

. , xrefs: 022CE29B

Memory Dump Source

Source File: 00000000.00000002.1843357403.00000000022B0000.00000040.00001000.00020000.00000000.sdmp, Offset: 022B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_22b0000_5RRVBiCpFI.jbxd

Yara matches

Similarity

API ID:
String ID: .
API String ID: 0-1505114982
Opcode ID: 2c1d9dc035ef9ac2c180075a27f0a445723f05ffce5a25362c8fe712cfd5ed31
Instruction ID: d46e5f38bc7d460874fac852d3d6bcdd2b1ecef13e37d21be58f552632e222c1
Opcode Fuzzy Hash: 2c1d9dc035ef9ac2c180075a27f0a445723f05ffce5a25362c8fe712cfd5ed31
Instruction Fuzzy Hash: 43C127B1D10652CBCB24CFA8C8517BBB7B1FF85350F2A825DD895AB394E734A841CB91

Function 022D74C4 Relevance: 1.7, Strings: 1, Instructions: 445COMMON

Download Yara Rule

Strings

167H, xrefs: 022D7599

Memory Dump Source

Source File: 00000000.00000002.1843357403.00000000022B0000.00000040.00001000.00020000.00000000.sdmp, Offset: 022B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_22b0000_5RRVBiCpFI.jbxd

Yara matches

Similarity

API ID:
String ID: 167H
API String ID: 0-2704650348
Opcode ID: 58de4fbba54e7a4bbde6691defe3cface4003d97f8efe76fd78e15d75b2f64aa
Instruction ID: 3c7eab44d4e2a896805a2ace4c90813a6d07521702acb2d614825787f9930ada
Opcode Fuzzy Hash: 58de4fbba54e7a4bbde6691defe3cface4003d97f8efe76fd78e15d75b2f64aa
Instruction Fuzzy Hash: ADD15872A243414BDB18CEA88C817BBF792EFC5314F49862CE995873C9E778D905C782

Function 022D3844 Relevance: 1.7, Strings: 1, Instructions: 425COMMON

Download Yara Rule

Strings

&#, xrefs: 022D38B1

Memory Dump Source

Source File: 00000000.00000002.1843357403.00000000022B0000.00000040.00001000.00020000.00000000.sdmp, Offset: 022B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_22b0000_5RRVBiCpFI.jbxd

Yara matches

Similarity

API ID:
String ID: &#
API String ID: 0-1789715784
Opcode ID: 0f12d66f6b808d20c475992f0f687e3f453dd6e3f6f88e05d52d4cafb9cead41
Instruction ID: 2c393349c529c96e196d072a5e241470aafc7f2826d191d09ff17f48ef7b3dd9
Opcode Fuzzy Hash: 0f12d66f6b808d20c475992f0f687e3f453dd6e3f6f88e05d52d4cafb9cead41
Instruction Fuzzy Hash: 11A148716243115BDB28EFA8C85277BB3E5EF81324F09956CE9869B284E338D901CB53

Function 022B9C94 Relevance: 1.6, Strings: 1, Instructions: 399COMMON

Download Yara Rule

Strings

-, xrefs: 022B9DB9

Memory Dump Source

Source File: 00000000.00000002.1843357403.00000000022B0000.00000040.00001000.00020000.00000000.sdmp, Offset: 022B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_22b0000_5RRVBiCpFI.jbxd

Yara matches

Similarity

API ID:
String ID: -
API String ID: 0-2547889144
Opcode ID: 27c89adea84a4971459812ff31a4728146f694fcb44008b8af47e8cd9ff8a59b
Instruction ID: 8af2f5cb0472f52fc68e58c7a3a71a8b605ee720750c22eb87187acd80d70336
Opcode Fuzzy Hash: 27c89adea84a4971459812ff31a4728146f694fcb44008b8af47e8cd9ff8a59b
Instruction Fuzzy Hash: CBD12C31A1C3464BC71A8E69C8D02AABBE2EFC5364F18CA1DE5E5073D9D7389945CF81

Function 022CDDF5 Relevance: 1.6, Strings: 1, Instructions: 342COMMON

Download Yara Rule

Strings

de, xrefs: 022CDE81

Memory Dump Source

Source File: 00000000.00000002.1843357403.00000000022B0000.00000040.00001000.00020000.00000000.sdmp, Offset: 022B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_22b0000_5RRVBiCpFI.jbxd

Yara matches

Similarity

API ID:
String ID: de
API String ID: 0-2106599819
Opcode ID: 859681f232736f0ad411de2e9c44a8bd8c96edd644b44a10bf2b24b8f8322015
Instruction ID: a1a4298b8a812f67f713bc847c394f0bdb96b659e7babba759b5b0f14368c589
Opcode Fuzzy Hash: 859681f232736f0ad411de2e9c44a8bd8c96edd644b44a10bf2b24b8f8322015
Instruction Fuzzy Hash: B69125719183118AC724DFA4C89276BB3F2EF91364F298A2CE4D64B395FB788505C792

Function 022CEDA4 Relevance: 1.6, Strings: 1, Instructions: 327COMMON

Download Yara Rule

Strings

~, xrefs: 022CEE6F

Memory Dump Source

Source File: 00000000.00000002.1843357403.00000000022B0000.00000040.00001000.00020000.00000000.sdmp, Offset: 022B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_22b0000_5RRVBiCpFI.jbxd

Yara matches

Similarity

API ID:
String ID: ~
API String ID: 0-1707062198
Opcode ID: 8c5aa6b5a5b2fe2e388992ca06d89cc462c2ef20750d480a456fbd2899bcd495
Instruction ID: c84f220a143b88477ae7d7f5526abd54ff2299629e4d19c9f35481c9fa9076b1
Opcode Fuzzy Hash: 8c5aa6b5a5b2fe2e388992ca06d89cc462c2ef20750d480a456fbd2899bcd495
Instruction Fuzzy Hash: 88A13872A142615FCB25CE68888076AB7D1AFD5324F1AC33DEDA98B3D5D7308806D7C1

Function 022BF859 Relevance: 1.6, Strings: 1, Instructions: 320COMMON

Download Yara Rule

Strings

PT, xrefs: 022BFA97

Memory Dump Source

Source File: 00000000.00000002.1843357403.00000000022B0000.00000040.00001000.00020000.00000000.sdmp, Offset: 022B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_22b0000_5RRVBiCpFI.jbxd

Yara matches

Similarity

API ID:
String ID: PT
API String ID: 0-4135314810
Opcode ID: 2838c07cfca04fbe2cabb14719c9c0661598261e54099377b9e0bd013184ce3a
Instruction ID: 25ccb863cc77ec1ff61037279dabbcd57e572556d3b19ace43a1a08591371230
Opcode Fuzzy Hash: 2838c07cfca04fbe2cabb14719c9c0661598261e54099377b9e0bd013184ce3a
Instruction Fuzzy Hash: 5AA1EFB4118B818FD726CF79C9A0A62BFE1AF47340B19869CD4D24FB66D339E406CB11

Function 022EF364 Relevance: 1.5, Strings: 1, Instructions: 299COMMON

Download Yara Rule

Strings

cdef, xrefs: 022EF3C9

Memory Dump Source

Source File: 00000000.00000002.1843357403.00000000022B0000.00000040.00001000.00020000.00000000.sdmp, Offset: 022B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_22b0000_5RRVBiCpFI.jbxd

Yara matches

Similarity

API ID:
String ID: cdef
API String ID: 0-4216504194
Opcode ID: 6cfb0631b4c3af94e0a4d7ca533938db559d7b6d0bfe02f92feebc81ba876585
Instruction ID: e6aa29500fff77e838862ea88d049c8a67e5a7f91456a5a3e7600aab44383deb
Opcode Fuzzy Hash: 6cfb0631b4c3af94e0a4d7ca533938db559d7b6d0bfe02f92feebc81ba876585
Instruction Fuzzy Hash: 5F818871A183428FCB24CF64C980A7FB7E1EFD6314F59893CD99657699C731A801D782

Function 022C8C17 Relevance: 1.5, Strings: 1, Instructions: 274COMMON

Download Yara Rule

Strings

gfff, xrefs: 022C8E26

Memory Dump Source

Source File: 00000000.00000002.1843357403.00000000022B0000.00000040.00001000.00020000.00000000.sdmp, Offset: 022B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_22b0000_5RRVBiCpFI.jbxd

Yara matches

Similarity

API ID:
String ID: gfff
API String ID: 0-1553575800
Opcode ID: c5d9ff75fed77c201b8d14b3cc3b758706ca82fef0a51ed8aa8899dc59fb4eb5
Instruction ID: b799af4828408dd5ee25a1a2c85574b70f097246d1ef9d0eeea4a3851b8ddd03
Opcode Fuzzy Hash: c5d9ff75fed77c201b8d14b3cc3b758706ca82fef0a51ed8aa8899dc59fb4eb5
Instruction Fuzzy Hash: 909113716217428FE719CB78CC507A6B7D2FF85314F18C67DC09A8B7A6EA38A442C741

Function 022C90B6 Relevance: 1.5, Strings: 1, Instructions: 269COMMON

Download Yara Rule

Strings

c$, xrefs: 022C923B

Memory Dump Source

Source File: 00000000.00000002.1843357403.00000000022B0000.00000040.00001000.00020000.00000000.sdmp, Offset: 022B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_22b0000_5RRVBiCpFI.jbxd

Yara matches

Similarity

API ID:
String ID: c$
API String ID: 0-2516980088
Opcode ID: bc3c15472f07d559a5396f8094059b7ab067923e86a285eaa48d66e2478d2574
Instruction ID: e256baca13670e6616af6735235502f556be2fd09a17aaedc9076231c2f3f88a
Opcode Fuzzy Hash: bc3c15472f07d559a5396f8094059b7ab067923e86a285eaa48d66e2478d2574
Instruction Fuzzy Hash: 079198B0110741CFD724CF25C4A5762BBB2FF46314F29968CC4864F7A9E3B9A886CB95

Function 022DCC60 Relevance: 1.5, Strings: 1, Instructions: 268COMMON

Download Yara Rule

Strings

Fg, xrefs: 022DCD8B

Memory Dump Source

Source File: 00000000.00000002.1843357403.00000000022B0000.00000040.00001000.00020000.00000000.sdmp, Offset: 022B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_22b0000_5RRVBiCpFI.jbxd

Yara matches

Similarity

API ID:
String ID: Fg
API String ID: 0-875302535
Opcode ID: 42a71ed4ddc16415858e4dfc4422956aad04ddc95995e0a2601de5add053e1e2
Instruction ID: 68f7a9d58e245b1708923989e55bc7f9417db21b17645f464ca7f27dbe52b87d
Opcode Fuzzy Hash: 42a71ed4ddc16415858e4dfc4422956aad04ddc95995e0a2601de5add053e1e2
Instruction Fuzzy Hash: 0281E87121D3808BD769CF35C8617EBBBD3EBD2204F28996DD1C987296DB38400ACB16

Function 022CCC15 Relevance: 1.5, Strings: 1, Instructions: 264COMMON

Download Yara Rule

Strings

js{g, xrefs: 022CCE80

Memory Dump Source

Source File: 00000000.00000002.1843357403.00000000022B0000.00000040.00001000.00020000.00000000.sdmp, Offset: 022B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_22b0000_5RRVBiCpFI.jbxd

Yara matches

Similarity

API ID:
String ID: js{g
API String ID: 0-1014319796
Opcode ID: 2bedd816319602fe80fa94cf924704a6c11e2863fdffa8fa3602250936590e55
Instruction ID: 9e36502d6f6de0471c2c9160fe6eb0a16b90ac2fb305e4c2662278b956fb52a5
Opcode Fuzzy Hash: 2bedd816319602fe80fa94cf924704a6c11e2863fdffa8fa3602250936590e55
Instruction Fuzzy Hash: 0A814671654B804BE7398F35C8517ABBBE3AB52618F188A5CD1D39BF99C778A406CB00

Function 022EEE24 Relevance: 1.5, Strings: 1, Instructions: 247COMMON

Download Yara Rule

Strings

ihgf, xrefs: 022EEE49

Memory Dump Source

Source File: 00000000.00000002.1843357403.00000000022B0000.00000040.00001000.00020000.00000000.sdmp, Offset: 022B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_22b0000_5RRVBiCpFI.jbxd

Yara matches

Similarity

API ID:
String ID: ihgf
API String ID: 0-2948842496
Opcode ID: eef0a356b23e55d2308e20bed1a6a7dcd73da6f3f0547914f9e2b30739e3ef6c
Instruction ID: 7bae7c8ab5a7c2b36b79be51e0f511af9ec3236d7e2b3b1a622a0ec9c9431e91
Opcode Fuzzy Hash: eef0a356b23e55d2308e20bed1a6a7dcd73da6f3f0547914f9e2b30739e3ef6c
Instruction Fuzzy Hash: 8B81F7346143019FDB24DF68C980A2BB7E2FFD5324F59952CE586873A9DB31D801DB42

Function 022C8C7F Relevance: 1.5, Strings: 1, Instructions: 244COMMON

Download Yara Rule

Strings

gfff, xrefs: 022C8E26

Memory Dump Source

Source File: 00000000.00000002.1843357403.00000000022B0000.00000040.00001000.00020000.00000000.sdmp, Offset: 022B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_22b0000_5RRVBiCpFI.jbxd

Yara matches

Similarity

API ID:
String ID: gfff
API String ID: 0-1553575800
Opcode ID: de86720abe9662384bfc4389f4b275199587a53d7c35c6b33b3c21993df62823
Instruction ID: 87e12d738c3b9c9ed3b527e5d4c220f36f7abf2e3969db3bcf8fea2d52f21c6a
Opcode Fuzzy Hash: de86720abe9662384bfc4389f4b275199587a53d7c35c6b33b3c21993df62823
Instruction Fuzzy Hash: 2171F3716217424FD319CB79CC507A6B7D2AF96304F1CC67DC096CB7AAEA78A442CB41

Function 022DBF04 Relevance: 1.5, Strings: 1, Instructions: 236COMMON

Download Yara Rule

Strings

", xrefs: 022DC102

Memory Dump Source

Source File: 00000000.00000002.1843357403.00000000022B0000.00000040.00001000.00020000.00000000.sdmp, Offset: 022B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_22b0000_5RRVBiCpFI.jbxd

Yara matches

Similarity

API ID:
String ID: "
API String ID: 0-123907689
Opcode ID: 08379c2cfec4ee4560f7149afc2674de524dbb751cb7c6d8c58db735b762b861
Instruction ID: 0ce8324d95eda64a7dbed77cc8557af451c02fac2833a16e2e5716de84ba4ef4
Opcode Fuzzy Hash: 08379c2cfec4ee4560f7149afc2674de524dbb751cb7c6d8c58db735b762b861
Instruction Fuzzy Hash: 71710832A283268FD714CEACC89031EB7E2ABC5714F19852EF494873A9D775DD45CB41

Function 022CF884 Relevance: 1.4, Strings: 1, Instructions: 199COMMON

Download Yara Rule

Strings

Y*>, xrefs: 022CF888

Memory Dump Source

Source File: 00000000.00000002.1843357403.00000000022B0000.00000040.00001000.00020000.00000000.sdmp, Offset: 022B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_22b0000_5RRVBiCpFI.jbxd

Yara matches

Similarity

API ID:
String ID: Y*>
API String ID: 0-3862480330
Opcode ID: 22b3804befe7f91e84aca949ffb80fce2ed22dd13d93b44656185de14de2ea60
Instruction ID: bfeac14e71df04633e6eb2250d398bb1ebcd6ec72809ff86c5b8ac4f970293b9
Opcode Fuzzy Hash: 22b3804befe7f91e84aca949ffb80fce2ed22dd13d93b44656185de14de2ea60
Instruction Fuzzy Hash: DF513833B799824BE72C897C4D223A6AA834BD6234B3DD77FD4B1C77E8D5A948058340

Function 022D98D6 Relevance: 1.4, Strings: 1, Instructions: 190COMMON

Download Yara Rule

Strings

m, xrefs: 022D9914

Memory Dump Source

Source File: 00000000.00000002.1843357403.00000000022B0000.00000040.00001000.00020000.00000000.sdmp, Offset: 022B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_22b0000_5RRVBiCpFI.jbxd

Yara matches

Similarity

API ID:
String ID: m
API String ID: 0-3775001192
Opcode ID: 41b4e45d489525032a7ff55d2696e510600e92b2c3d7551ddfae36ad8bd27945
Instruction ID: d5380f4e75302010ad227928633970f463e6b80d8192b3762df5571a145d2371
Opcode Fuzzy Hash: 41b4e45d489525032a7ff55d2696e510600e92b2c3d7551ddfae36ad8bd27945
Instruction Fuzzy Hash: DF5124B19183918FD720DFA484903AFBBE2AFC2304F55892CF5E54B245DB38D949CB52

Function 022EC2AB Relevance: 1.4, Strings: 1, Instructions: 129COMMON

Download Yara Rule

Strings

w, xrefs: 022EC39D

Memory Dump Source

Source File: 00000000.00000002.1843357403.00000000022B0000.00000040.00001000.00020000.00000000.sdmp, Offset: 022B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_22b0000_5RRVBiCpFI.jbxd

Yara matches

Similarity

API ID:
String ID: w
API String ID: 0-2991200456
Opcode ID: 6ffcd2417d58e0d1efea5a9724b595c411f337b55a8ae22910b9b44be8581fce
Instruction ID: e843f7ab54aba6c145f71580f0aff696955e083d82b7a6e450eb3b6b0b96e53d
Opcode Fuzzy Hash: 6ffcd2417d58e0d1efea5a9724b595c411f337b55a8ae22910b9b44be8581fce
Instruction Fuzzy Hash: 334116B6E117618FD704DFA4CC856AFBB72FB84315B0AC1A8C8857B319D77869068BD0

Function 022EE894 Relevance: 1.4, Strings: 1, Instructions: 115COMMON

Download Yara Rule

Strings

ihgf, xrefs: 022EE8B9

Memory Dump Source

Source File: 00000000.00000002.1843357403.00000000022B0000.00000040.00001000.00020000.00000000.sdmp, Offset: 022B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_22b0000_5RRVBiCpFI.jbxd

Yara matches

Similarity

API ID:
String ID: ihgf
API String ID: 0-2948842496
Opcode ID: 2b213d4144a63b266ffc054ecdea8f1b716e225e094351901ee27163bfaa7a7b
Instruction ID: d58546165c7be75431a7e54339ad34e7c72a8d709f7e7686004cf46ff0cc109b
Opcode Fuzzy Hash: 2b213d4144a63b266ffc054ecdea8f1b716e225e094351901ee27163bfaa7a7b
Instruction Fuzzy Hash: C0316C347243026FEF708BA49C81B3BB7E5EB96724F55192CE18697294D321E810E616

Function 022EE9C4 Relevance: 1.4, Strings: 1, Instructions: 112COMMON

Download Yara Rule

Strings

ihgf, xrefs: 022EE9E9

Memory Dump Source

Source File: 00000000.00000002.1843357403.00000000022B0000.00000040.00001000.00020000.00000000.sdmp, Offset: 022B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_22b0000_5RRVBiCpFI.jbxd

Yara matches

Similarity

API ID:
String ID: ihgf
API String ID: 0-2948842496
Opcode ID: ae411421d2ccc92dd1a2e9f178d6aa2591b1cae486c28fda228ff2e2e7e3843c
Instruction ID: 6634cabac23ef57d20fc674cce5df3fee4156768a4b01be59ce8ff36ae7c6fc4
Opcode Fuzzy Hash: ae411421d2ccc92dd1a2e9f178d6aa2591b1cae486c28fda228ff2e2e7e3843c
Instruction Fuzzy Hash: DD312934314302AFDB109B94DC81B3BB7E5FB86724F59452CE58697394D324E810D616

Function 022B4AD4 Relevance: .7, Instructions: 670COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1843357403.00000000022B0000.00000040.00001000.00020000.00000000.sdmp, Offset: 022B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_22b0000_5RRVBiCpFI.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2cf22539860d374f1b5b70c1f2b7734314ec6e2843ab381a6f5f63b3db803864
Instruction ID: 1f7fad9925ce75586125b3b2ca5a94ea5cebf72bc6abf60e84e8d375a5ff36f1
Opcode Fuzzy Hash: 2cf22539860d374f1b5b70c1f2b7734314ec6e2843ab381a6f5f63b3db803864
Instruction Fuzzy Hash: 4352E0315183468FCB16CF58C0D06EABBE1FF88348F588A6DE8995B356D774E849CB81

Function 022B8214 Relevance: .7, Instructions: 665COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1843357403.00000000022B0000.00000040.00001000.00020000.00000000.sdmp, Offset: 022B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_22b0000_5RRVBiCpFI.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 053ef949f8069824f8f231dbd91ce926a4ef04c181cbfe28cc923f465daa30e9
Instruction ID: 4259dc112e72f50e5e7f1e7a9a1e3f31c7e10277bf5d564be9e8c0ea451560e3
Opcode Fuzzy Hash: 053ef949f8069824f8f231dbd91ce926a4ef04c181cbfe28cc923f465daa30e9
Instruction Fuzzy Hash: 1E52D4B0918B858FE736CB74C4843E7BBE5AF41354F145C2EC5EA06A8AD379A485CB02

Function 022D0C14 Relevance: .6, Instructions: 640COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1843357403.00000000022B0000.00000040.00001000.00020000.00000000.sdmp, Offset: 022B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_22b0000_5RRVBiCpFI.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 384453c34c44fa10a221719aff1fe9f2af50c5f2060accd689493d508a0f7137
Instruction ID: c52e7c2ebb0cd4bc6d02a94e6086b5a22902ffb92f24ff0cc41495e6f80c7511
Opcode Fuzzy Hash: 384453c34c44fa10a221719aff1fe9f2af50c5f2060accd689493d508a0f7137
Instruction Fuzzy Hash: 92626BB0618B808ED325CF3C8855797BFE5AB5A314F088A5DE0EE873D2C7B56405CB66

Function 022B54F4 Relevance: .6, Instructions: 600COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1843357403.00000000022B0000.00000040.00001000.00020000.00000000.sdmp, Offset: 022B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_22b0000_5RRVBiCpFI.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8cebd1d130e129d362c74be989a8f6be5d35db3090ca8dbd55502fd1ced91e81
Instruction ID: e978eed7f077b387674a1d7bb26f2dbc394893918e645cb06e0bfeabaf1c79b0
Opcode Fuzzy Hash: 8cebd1d130e129d362c74be989a8f6be5d35db3090ca8dbd55502fd1ced91e81
Instruction Fuzzy Hash: C53246B0520B118FC33ACF69C5805AAB7F2BF45750B944A2ED6A78BE94D376F495CB00

Function 022B8FE4 Relevance: .6, Instructions: 595COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1843357403.00000000022B0000.00000040.00001000.00020000.00000000.sdmp, Offset: 022B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_22b0000_5RRVBiCpFI.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d94ed56ffcdc38c94b90bd9783928bf4a55e001c4d3c4371622baab0c0238d3b
Instruction ID: dff6e392ff73b1915738218ddb720e6760fbe6fb6ca2fffde92adf40fea72379
Opcode Fuzzy Hash: d94ed56ffcdc38c94b90bd9783928bf4a55e001c4d3c4371622baab0c0238d3b
Instruction Fuzzy Hash: 8102F732A287518BC725DF58D8847EBB3E2EFC4345F19893DCA8687299D734A485CF42

Function 022B0000 Relevance: .5, Instructions: 476COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1843357403.00000000022B0000.00000040.00001000.00020000.00000000.sdmp, Offset: 022B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_22b0000_5RRVBiCpFI.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 468bbd116e6e4160b7ead10548a23f5fa0b5aab5ed52178c23e73c87574eccfb
Instruction ID: 3eee1bc1216a344f1479d9ec015e79f688c77eb7b6151e9752c12e5e0d281b1c
Opcode Fuzzy Hash: 468bbd116e6e4160b7ead10548a23f5fa0b5aab5ed52178c23e73c87574eccfb
Instruction Fuzzy Hash: 43128B729113248FC729CFB4EC9665E7FA1FFA6304F41822AC506AB166C734154BEF85

Function 022FAF78 Relevance: .4, Instructions: 429COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1843357403.00000000022B0000.00000040.00001000.00020000.00000000.sdmp, Offset: 022B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_22b0000_5RRVBiCpFI.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3f25aa825a39bec38ad6b6d36dd1a7b58a115f37f7b46c95bc86c5f4f7415b87
Instruction ID: 4c2ce9a9dc8033609f8a6f97fbcda16af631eb7eee6a5131447f654887707839
Opcode Fuzzy Hash: 3f25aa825a39bec38ad6b6d36dd1a7b58a115f37f7b46c95bc86c5f4f7415b87
Instruction Fuzzy Hash: E5D18331718B498BDB68EF68D8896AEF7E5FB58305F00422EE95AC7244DF30E5118B81

Function 022FC23C Relevance: .4, Instructions: 409COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1843357403.00000000022B0000.00000040.00001000.00020000.00000000.sdmp, Offset: 022B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_22b0000_5RRVBiCpFI.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3e74d2aa687a79bc353c1e30e2761018af6d861ea5a8c8f1c92844b65f1d9ba9
Instruction ID: bb497b751c2a5b5030348f67d97ebe443b67fa0de0017b09659d6162f42d2edb
Opcode Fuzzy Hash: 3e74d2aa687a79bc353c1e30e2761018af6d861ea5a8c8f1c92844b65f1d9ba9
Instruction Fuzzy Hash: B2D14031518A4C8FDB59EF28C8896EAB7E1FF98300F14466EE94AC7255DF30E545CB81

Function 022B7524 Relevance: .4, Instructions: 400COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1843357403.00000000022B0000.00000040.00001000.00020000.00000000.sdmp, Offset: 022B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_22b0000_5RRVBiCpFI.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9f32036254703c86e30e41b79e12de7cc7207ac734af8b7503e36ad0a5622709
Instruction ID: 4a156c7011f1ef7ae4d88dbf344b3e58d3c789a0d6c15c64cd443c8e9013e7bc
Opcode Fuzzy Hash: 9f32036254703c86e30e41b79e12de7cc7207ac734af8b7503e36ad0a5622709
Instruction Fuzzy Hash: 18E178321087419FC721CF69C880AABFBE5EF98344F44882DE5D987751E375E948CB92

Function 022FBE6C Relevance: .4, Instructions: 380COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1843357403.00000000022B0000.00000040.00001000.00020000.00000000.sdmp, Offset: 022B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_22b0000_5RRVBiCpFI.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e45004cfa00b96cc07e21d80348e0ecc464919f4c4bc6f170ace2c42d415ba2b
Instruction ID: b454ca6f7d14cdd73e4d0ff94d55d7795ddec5d3ec1494a12d2a9b3c5a8d7cec
Opcode Fuzzy Hash: e45004cfa00b96cc07e21d80348e0ecc464919f4c4bc6f170ace2c42d415ba2b
Instruction Fuzzy Hash: A2B19730324E0E4BCB99DA68D8D4BBAF3D2FB98304F54027AD54AC7159DF24E556CB81

Function 022CAE0E Relevance: .4, Instructions: 362COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1843357403.00000000022B0000.00000040.00001000.00020000.00000000.sdmp, Offset: 022B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_22b0000_5RRVBiCpFI.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0a6ff38b7f88a38b39f0feb0216d1201f336bfe1d4496b7dedc26c113c3b1706
Instruction ID: 87095177db262e7674576db21d35afa2eab35802ce204436de06d01862b05d08
Opcode Fuzzy Hash: 0a6ff38b7f88a38b39f0feb0216d1201f336bfe1d4496b7dedc26c113c3b1706
Instruction Fuzzy Hash: A0A138B1211741CFD72ACF78C461A6677E2FF86314729869CD5E68F3A9DB389801CB50

Function 022BB234 Relevance: .4, Instructions: 351COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1843357403.00000000022B0000.00000040.00001000.00020000.00000000.sdmp, Offset: 022B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_22b0000_5RRVBiCpFI.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d8522f48c061d96a90bcbb954765979172c44a155916e8e09891f3aefe40ca7a
Instruction ID: 70bdd6f3a5766f9ca369a7783936ba185841ecb8e9804ad554fda74c01383573
Opcode Fuzzy Hash: d8522f48c061d96a90bcbb954765979172c44a155916e8e09891f3aefe40ca7a
Instruction Fuzzy Hash: 28C122B16183808BD718CF65C8507AFBBE6EFD2304F14882DE5D68B295DB38C50ACB56

Function 022CF114 Relevance: .3, Instructions: 315COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1843357403.00000000022B0000.00000040.00001000.00020000.00000000.sdmp, Offset: 022B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_22b0000_5RRVBiCpFI.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7d343a94ccc60b0ac76136acfacaf03ec9124c15c7c37e786dc5ab8e490f6e03
Instruction ID: 96311a85fa8df38107364b17f6918b9022ec824ce838c54df356045fa12f4889
Opcode Fuzzy Hash: 7d343a94ccc60b0ac76136acfacaf03ec9124c15c7c37e786dc5ab8e490f6e03
Instruction Fuzzy Hash: 57B12376914301AFDB21CF64CD41B1ABBE2FFD5318F108A2DF998A72A4D7759804DB82

Function 022E73C4 Relevance: .3, Instructions: 310COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1843357403.00000000022B0000.00000040.00001000.00020000.00000000.sdmp, Offset: 022B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_22b0000_5RRVBiCpFI.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 34b9a0d7ad4e2640ff3c38ec8b4415170da73e2657f5b2be8b12e8c2df11fb82
Instruction ID: 8f2cbb4bf831822487d7089fa1340b15559d5d4f811a4d34e6c5c8c17cb8dd1d
Opcode Fuzzy Hash: 34b9a0d7ad4e2640ff3c38ec8b4415170da73e2657f5b2be8b12e8c2df11fb82
Instruction Fuzzy Hash: 90B17B72E147918FCB05CABCCC4169AFFB25B96220B0DC399D4B6DB3DAC6348802D761

Function 022B7D84 Relevance: .3, Instructions: 303COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1843357403.00000000022B0000.00000040.00001000.00020000.00000000.sdmp, Offset: 022B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_22b0000_5RRVBiCpFI.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a1afe4e88f9b97e7e8e8fd3cb907a0d95dd7110aea04d164d9c56f244693baaf
Instruction ID: 93ca35726492a20e548c94dec463774f58dcc3660d6f98c17035b2e1ad8ce085
Opcode Fuzzy Hash: a1afe4e88f9b97e7e8e8fd3cb907a0d95dd7110aea04d164d9c56f244693baaf
Instruction Fuzzy Hash: F5C15EB2A587418FC371CF68CC86BABB7E1BF85358F08492DD1D9C6242E778A155CB06

Function 022FD114 Relevance: .3, Instructions: 283COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1843357403.00000000022B0000.00000040.00001000.00020000.00000000.sdmp, Offset: 022B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_22b0000_5RRVBiCpFI.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e2e903f92329977da97ab707699d6460e74b4fcfb6d1b984767a57618237eb95
Instruction ID: 72ac89853396f797362c8aabb7d592aae27c795e574abbf4a6747b9ef6347cea
Opcode Fuzzy Hash: e2e903f92329977da97ab707699d6460e74b4fcfb6d1b984767a57618237eb95
Instruction Fuzzy Hash: BDA13F71608A4C8FDB55EF68C889BEAB7F5FB58315F10466EE44AC7164EB30E644CB80

Function 022C9474 Relevance: .3, Instructions: 262COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1843357403.00000000022B0000.00000040.00001000.00020000.00000000.sdmp, Offset: 022B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_22b0000_5RRVBiCpFI.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 82812cdeafcd33f0fc968029d79aa7a24ca844b7ad5e98367da50fc895b2220f
Instruction ID: 8d3973f44cb6e74b07964a3c764beb498be460fa9c1c38ce912b9ff82da5b96c
Opcode Fuzzy Hash: 82812cdeafcd33f0fc968029d79aa7a24ca844b7ad5e98367da50fc895b2220f
Instruction Fuzzy Hash: 777104742246429FDB35CF64C9C0A7BB7A2EF96314B75862CD197472AAC731E882CB04

Function 022EA9D4 Relevance: .2, Instructions: 248COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1843357403.00000000022B0000.00000040.00001000.00020000.00000000.sdmp, Offset: 022B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_22b0000_5RRVBiCpFI.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 908f5c4351c674361b7bf87d10fb2e8a93db02d5169a9e62b5518be8655f3495
Instruction ID: 5fdf6e8e671be32843ed167bf27528bb9d529b93f7ce92680b706763d52716d6
Opcode Fuzzy Hash: 908f5c4351c674361b7bf87d10fb2e8a93db02d5169a9e62b5518be8655f3495
Instruction Fuzzy Hash: 715164766243414BEB18DEA8CC50B3BBB93EBD1310F59853DD58387381DB3498029746

Function 022EF0B4 Relevance: .2, Instructions: 246COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1843357403.00000000022B0000.00000040.00001000.00020000.00000000.sdmp, Offset: 022B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_22b0000_5RRVBiCpFI.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b458a4b395c5c8ee69f5f2b006b0e563729d6c6f05da1ba1057fcc05e7f9fb9b
Instruction ID: be27a3bb329e8d1286ff729d8f1ef1b16bd0e7a38f4be2651d047b2dbdff0e0e
Opcode Fuzzy Hash: b458a4b395c5c8ee69f5f2b006b0e563729d6c6f05da1ba1057fcc05e7f9fb9b
Instruction Fuzzy Hash: 5D8125356183129FCB248F58C98066FB7E2EFC9314F55852CE9868B769D731EC41DB82

Function 022CF514 Relevance: .2, Instructions: 240COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1843357403.00000000022B0000.00000040.00001000.00020000.00000000.sdmp, Offset: 022B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_22b0000_5RRVBiCpFI.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 878cf165e9656de38300a8645f53e9724a1b6a64a083f1f7d23b351aa812f187
Instruction ID: 77d38a24a3119d50abdae5097a6bee48dd402a6209301e97a0709d94ae514f18
Opcode Fuzzy Hash: 878cf165e9656de38300a8645f53e9724a1b6a64a083f1f7d23b351aa812f187
Instruction Fuzzy Hash: D5712833B6A9914BE328897C4D213AA7A830BD6234F3DC77FE5F5877E9D56588098340

Function 022EAED4 Relevance: .2, Instructions: 238COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1843357403.00000000022B0000.00000040.00001000.00020000.00000000.sdmp, Offset: 022B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_22b0000_5RRVBiCpFI.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d2f966890577f15959edc4de71345d5fecb794fae90f6da87e8e32d5ae83de50
Instruction ID: da2a95b6a2ff692269b64adc56b5b4f72b7e5aee849af284b679de5b32885e73
Opcode Fuzzy Hash: d2f966890577f15959edc4de71345d5fecb794fae90f6da87e8e32d5ae83de50
Instruction Fuzzy Hash: 40611A37B243115BDB14CAA9CC8067BB793BBC9724F49823DE996872E4DB7498019782

Function 022E0C64 Relevance: .2, Instructions: 235COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1843357403.00000000022B0000.00000040.00001000.00020000.00000000.sdmp, Offset: 022B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_22b0000_5RRVBiCpFI.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3c0d2c5577102dd58fbede460a656b1f00c5f7fe775d6732456b41350824bdc2
Instruction ID: 512fa0ec2f581317cdbf02f86c4d2009956de66af69107d23f5344b0bdd1356b
Opcode Fuzzy Hash: 3c0d2c5577102dd58fbede460a656b1f00c5f7fe775d6732456b41350824bdc2
Instruction Fuzzy Hash: 87717937A69AD14BD728897C4C603AA7A834FD2230F5DC37DE9F25B3E9C5E609069341

Function 022EEBD4 Relevance: .2, Instructions: 227COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1843357403.00000000022B0000.00000040.00001000.00020000.00000000.sdmp, Offset: 022B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_22b0000_5RRVBiCpFI.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 64b1c9c5f56f139aa65c1abfed3263135776d97135dd74b25c5f35881b33ae15
Instruction ID: ac9785d5e42180d11b6ca6ea5d7435c46ace70db361289f5e8a54d0b0a901cb2
Opcode Fuzzy Hash: 64b1c9c5f56f139aa65c1abfed3263135776d97135dd74b25c5f35881b33ae15
Instruction Fuzzy Hash: 0D516B716143029FDB249F98C881A3FB7E6EFD9720F56943CE68647359EB309811E742

Function 022DAEDE Relevance: .2, Instructions: 206COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1843357403.00000000022B0000.00000040.00001000.00020000.00000000.sdmp, Offset: 022B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_22b0000_5RRVBiCpFI.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2c0d35eb954a9d187377820dd095db1c7b0c4961e6edb85d2e315a33cbd56d54
Instruction ID: f98bf73e9dc6b706aa1bf5b4e710c5c43557b00b41d5d818db4687e682595808
Opcode Fuzzy Hash: 2c0d35eb954a9d187377820dd095db1c7b0c4961e6edb85d2e315a33cbd56d54
Instruction Fuzzy Hash: A571B071D043699FEB25CFA9CD817DDBBB2FB80310F18816DD459AB289DB7409468F80

Function 022D04E4 Relevance: .2, Instructions: 204COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1843357403.00000000022B0000.00000040.00001000.00020000.00000000.sdmp, Offset: 022B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_22b0000_5RRVBiCpFI.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a16964f98263bb64d29cf427ecac629650e46b659aa8a65445bff108377c5da2
Instruction ID: 56379b4c71afdb6cc53d2ab27f4faa36e7d4ef1cdd382406f9ed08b9aabf16ab
Opcode Fuzzy Hash: a16964f98263bb64d29cf427ecac629650e46b659aa8a65445bff108377c5da2
Instruction Fuzzy Hash: 89616A359083A14FC726CF78C850A2E7BE1AF96314F4881ADECE44B3A6D775D905CB92

Function 022D65C1 Relevance: .2, Instructions: 191COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1843357403.00000000022B0000.00000040.00001000.00020000.00000000.sdmp, Offset: 022B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_22b0000_5RRVBiCpFI.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 397dd7719a72b64fe6fd9bff4a2b0e0990fccc0e48aff55cf7b07deb802e575f
Instruction ID: 78ef12b78443fbf83054f593206b56a54ad669b8964d69e977e49ce3f3c71a20
Opcode Fuzzy Hash: 397dd7719a72b64fe6fd9bff4a2b0e0990fccc0e48aff55cf7b07deb802e575f
Instruction Fuzzy Hash: 2F517C71E242478BEB28CFA8D4A12FAFBE6EF55350B18866DC5974B3C9D7389540C780

Function 022E7164 Relevance: .2, Instructions: 189COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1843357403.00000000022B0000.00000040.00001000.00020000.00000000.sdmp, Offset: 022B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_22b0000_5RRVBiCpFI.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9a456be5166b92ab10874784492d9a7357f7a85283333ec6aeb1257d6c9849aa
Instruction ID: 8554139e8e5269d692dbb1df24e9bda106b21f0639edeb545a1bba3660ec5f44
Opcode Fuzzy Hash: 9a456be5166b92ab10874784492d9a7357f7a85283333ec6aeb1257d6c9849aa
Instruction Fuzzy Hash: EE516AB15083448FE714DF69D49435BBBE1BB84314F444A2DE5EA87390E379D6088B82

Function 022C81D4 Relevance: .2, Instructions: 186COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1843357403.00000000022B0000.00000040.00001000.00020000.00000000.sdmp, Offset: 022B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_22b0000_5RRVBiCpFI.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 896f3fb295f70a3d1d2d868c2c2a0e71ef34daf535ef3f76e5866041dfd6add5
Instruction ID: 2773a44cd50427bed2026675b4df2760b0d86ddbb0bad701c40211a92b65fa2a
Opcode Fuzzy Hash: 896f3fb295f70a3d1d2d868c2c2a0e71ef34daf535ef3f76e5866041dfd6add5
Instruction Fuzzy Hash: 996189B16003028FE769CF65D881256FBA1FF46300F1996ACC09A8F752E338E481CB86

Function 022E2A24 Relevance: .2, Instructions: 171COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1843357403.00000000022B0000.00000040.00001000.00020000.00000000.sdmp, Offset: 022B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_22b0000_5RRVBiCpFI.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c7e211e6c2eb9e6b08159abb43e9af5e1aa1d9e93aa804f146ff2ed9fa703b0b
Instruction ID: b0a3f36b4f419d06653560a73e093a453584cb49e9747218196b5740bdb97862
Opcode Fuzzy Hash: c7e211e6c2eb9e6b08159abb43e9af5e1aa1d9e93aa804f146ff2ed9fa703b0b
Instruction Fuzzy Hash: D4516833A795908BE7288D7C5C613A67A870BD6230F6CC7BEE8B3C73E5C1598804A340

Function 022DF0B2 Relevance: .2, Instructions: 169COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1843357403.00000000022B0000.00000040.00001000.00020000.00000000.sdmp, Offset: 022B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_22b0000_5RRVBiCpFI.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 20d0a7076ca4a073ae36702b2f035087ecf70489209c947b4e4cdcb3c897cb6e
Instruction ID: c10e60d39fcc94fb7873e3a35dcc7c76844aeab0e68723a57687a4a8ffdc7dba
Opcode Fuzzy Hash: 20d0a7076ca4a073ae36702b2f035087ecf70489209c947b4e4cdcb3c897cb6e
Instruction Fuzzy Hash: 045192777569004BC71CC97C8DA5266A6D3ABD822072E863DD577C77D8EAB8E8028640

Function 022ECB9C Relevance: .2, Instructions: 162COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1843357403.00000000022B0000.00000040.00001000.00020000.00000000.sdmp, Offset: 022B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_22b0000_5RRVBiCpFI.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 80662d8b24bff6f8992e634c1a49b92d2c70a6d1023e3f7c4dc80169a6ede74d
Instruction ID: 4c31f5adf3776119ad1421266b7b4b71aeebc034a4ccf6056177add17155f4af
Opcode Fuzzy Hash: 80662d8b24bff6f8992e634c1a49b92d2c70a6d1023e3f7c4dc80169a6ede74d
Instruction Fuzzy Hash: AB416B76E687144FC728EFE4D8C027AB3A2ABD7314F1E953D89D31B358DA704D019689

Function 022DC97C Relevance: .2, Instructions: 157COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1843357403.00000000022B0000.00000040.00001000.00020000.00000000.sdmp, Offset: 022B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_22b0000_5RRVBiCpFI.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a2cbd620310961616688d7e42db6707dedebd0210a3dd93db7e64ebc8315cc7a
Instruction ID: acd0a10322f223369592bc1da8a9f0cbe9da1357f2df8f97192cacaa4d10460a
Opcode Fuzzy Hash: a2cbd620310961616688d7e42db6707dedebd0210a3dd93db7e64ebc8315cc7a
Instruction Fuzzy Hash: B141C5A011C3D28BDB35CF3980607B7BFD1AF93259F2859ADC2C5A7246D7754006C759

Function 022BA2C4 Relevance: .2, Instructions: 154COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1843357403.00000000022B0000.00000040.00001000.00020000.00000000.sdmp, Offset: 022B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_22b0000_5RRVBiCpFI.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 58723dc140c456be560c71b36cd596879ae42af8ad7e401e55e8502de25fd2db
Instruction ID: 0da7ed140512dc73218a68635802340cd300eb548b8c3b137a78e569c3f9923a
Opcode Fuzzy Hash: 58723dc140c456be560c71b36cd596879ae42af8ad7e401e55e8502de25fd2db
Instruction Fuzzy Hash: 9E418E77F543090BD71CAEF48C993AAF2969BC4314F09803E5E86AB394DE784C0596C1

Function 022BE44B Relevance: .2, Instructions: 154COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1843357403.00000000022B0000.00000040.00001000.00020000.00000000.sdmp, Offset: 022B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_22b0000_5RRVBiCpFI.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 464c79d7ef81001f4e361af6555152b884662c27da4a39cdc900ccd1ec23a395
Instruction ID: d577967cee77533b28dc540c2050088b720d0dbc980226b7e8f8f6a23761d657
Opcode Fuzzy Hash: 464c79d7ef81001f4e361af6555152b884662c27da4a39cdc900ccd1ec23a395
Instruction Fuzzy Hash: 7D51467951C3418BD324CF24D840AABB7F2EFC6304F59995CF8969B2A5EB309906C746

Function 022C7846 Relevance: .2, Instructions: 151COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1843357403.00000000022B0000.00000040.00001000.00020000.00000000.sdmp, Offset: 022B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_22b0000_5RRVBiCpFI.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: afec766a8f46cebfa70309c7c12ba714155290e18f5d997497038f4e7e1a0749
Instruction ID: 16ab3c1b08f18dbb782d6308a5c2e5c283108dc923e5926d8b6e275e5239d4f7
Opcode Fuzzy Hash: afec766a8f46cebfa70309c7c12ba714155290e18f5d997497038f4e7e1a0749
Instruction Fuzzy Hash: 53414871A203428BD7248F79C891776B3E6EF96310F28436DD6E6CB7A9E7789441CB10

Function 022BD9B5 Relevance: .1, Instructions: 146COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1843357403.00000000022B0000.00000040.00001000.00020000.00000000.sdmp, Offset: 022B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_22b0000_5RRVBiCpFI.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0aff5b575bdc1cbf128a6fcaf21673d610ba054c2e19d9dceb1adbeeb882f19a
Instruction ID: a1479c8597d66a6992aaf2f0e312be8d8c09511a0c2aa201e11bf1cbecf243f3
Opcode Fuzzy Hash: 0aff5b575bdc1cbf128a6fcaf21673d610ba054c2e19d9dceb1adbeeb882f19a
Instruction Fuzzy Hash: 7241367521C3829FD7158B64CC967F777E0EF46304F18946CE486CB292E7294503CB1A

Function 022DC958 Relevance: .1, Instructions: 140COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1843357403.00000000022B0000.00000040.00001000.00020000.00000000.sdmp, Offset: 022B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_22b0000_5RRVBiCpFI.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 305eeb4800ffca951eb0843350452d0362ef6350398f3d1306d62d3ed5eba46d
Instruction ID: 8d190f02cec81998aeddb1d0c836fd766d87d5e41028f299de7ed84ebb5b00f9
Opcode Fuzzy Hash: 305eeb4800ffca951eb0843350452d0362ef6350398f3d1306d62d3ed5eba46d
Instruction Fuzzy Hash: F341A2A011C3D28BDB358F3490607BBBFD0AF93218F24599DD2D6A7286D7354007CB5A

Function 022ECB8F Relevance: .1, Instructions: 136COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1843357403.00000000022B0000.00000040.00001000.00020000.00000000.sdmp, Offset: 022B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_22b0000_5RRVBiCpFI.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b3442938981b70338c85b6fdcef42b4b1049c4e4fc606aed39a4a87bba456e78
Instruction ID: ef0f92399054a6304a75a0beaefef018466333d351d73b9248d8339c1b59c84e
Opcode Fuzzy Hash: b3442938981b70338c85b6fdcef42b4b1049c4e4fc606aed39a4a87bba456e78
Instruction Fuzzy Hash: 1641BBB29787144FCB28EFE4ECC067AB3A1AB86320F5E552DD9E31B364D7608C00D248

Function 022ECB91 Relevance: .1, Instructions: 118COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1843357403.00000000022B0000.00000040.00001000.00020000.00000000.sdmp, Offset: 022B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_22b0000_5RRVBiCpFI.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3aeefbf0a4d65d0b572efcb3e51add84d891666070d970ea2441e25f135985dc
Instruction ID: 734619da0cbe806716e0d9cd719ea6f1dca2a57dedcef2d55161a3cd94577cb5
Opcode Fuzzy Hash: 3aeefbf0a4d65d0b572efcb3e51add84d891666070d970ea2441e25f135985dc
Instruction Fuzzy Hash: EB317776A687548FC728EFE4E8C017AB3A1AB8B310F5E552D89E30B364D7708D00D649

Function 022D79C4 Relevance: .1, Instructions: 113COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1843357403.00000000022B0000.00000040.00001000.00020000.00000000.sdmp, Offset: 022B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_22b0000_5RRVBiCpFI.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a7540190068c50c970c78dd1fb816c39bd2abd836d4de7d463699aecd841a6eb
Instruction ID: d6a4c01e7073a75318fade66ae84807ecef781cc2d5b0ce32a6a87b24abf5458
Opcode Fuzzy Hash: a7540190068c50c970c78dd1fb816c39bd2abd836d4de7d463699aecd841a6eb
Instruction Fuzzy Hash: 2C4190B26187908BC734CF64C85179FBAF2EBD1214F498E2CD4DAAB345E73585098B87

Function 022DC928 Relevance: .1, Instructions: 111COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1843357403.00000000022B0000.00000040.00001000.00020000.00000000.sdmp, Offset: 022B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_22b0000_5RRVBiCpFI.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 184c9a32383a48190f2719d2aadad879d32520f34a2a0851a9020504aa8db94d
Instruction ID: b1c4ebbb58dd3683dee5b49e8945c237f40d14941401e39f23040cffe61c69cd
Opcode Fuzzy Hash: 184c9a32383a48190f2719d2aadad879d32520f34a2a0851a9020504aa8db94d
Instruction Fuzzy Hash: C8317FA011C3D28ADB35CF2490607BBBBE0AF93259F1499ADC2D5A7287D7384046CB5A

Function 022DDF90 Relevance: .1, Instructions: 111COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1843357403.00000000022B0000.00000040.00001000.00020000.00000000.sdmp, Offset: 022B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_22b0000_5RRVBiCpFI.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e0dc337c31b60e59c40b3c4b66153a54b5a75c190226419d79e85c67cff8ed99
Instruction ID: b596e8909d8c519a01a02989e49e5b38f4f0103f105664557417451e522200cd
Opcode Fuzzy Hash: e0dc337c31b60e59c40b3c4b66153a54b5a75c190226419d79e85c67cff8ed99
Instruction Fuzzy Hash: 3231097012C3C28BD7B48B2848A07BBBBD6DF83205F68592CD5CA9B196DB254046CB17

Function 022DA28D Relevance: .1, Instructions: 110COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1843357403.00000000022B0000.00000040.00001000.00020000.00000000.sdmp, Offset: 022B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_22b0000_5RRVBiCpFI.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 546c49f651c2ee0ec7203154adbd460b810419c4e5ed9a3c8b647bf01d903c3f
Instruction ID: 164a91b9f1d26d303f9027627dcb3355a9c180344843ea33012f354c0ff28c81
Opcode Fuzzy Hash: 546c49f651c2ee0ec7203154adbd460b810419c4e5ed9a3c8b647bf01d903c3f
Instruction Fuzzy Hash: 133154716293458BC764DFA48C90A7AB353EBD6308F5D893CD9858B345D379C8028746

Function 022B1277 Relevance: .1, Instructions: 107COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1843357403.00000000022B0000.00000040.00001000.00020000.00000000.sdmp, Offset: 022B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_22b0000_5RRVBiCpFI.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b09967ac5482500bc099009dc95111bd7cc7545dcabcf40ba633cd1a509d9f95
Instruction ID: 9b7866fb4f8ac91b769f241145bff181ac27143e0fded9b311be25435e9335fc
Opcode Fuzzy Hash: b09967ac5482500bc099009dc95111bd7cc7545dcabcf40ba633cd1a509d9f95
Instruction Fuzzy Hash: D6516F74E10209DFCB09CF88C590AAEB7B2FF88354F248199D815AB345D371AA91CBA4

Function 022BF2D6 Relevance: .1, Instructions: 107COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1843357403.00000000022B0000.00000040.00001000.00020000.00000000.sdmp, Offset: 022B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_22b0000_5RRVBiCpFI.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9879a937105e083bd9aef7d9b8e876d5a873d896f238b78d14b88aad6da131cd
Instruction ID: d11c5c12511ab2cd6a14e62afb356473f3a940f6290a7e668bc128a25fb7b663
Opcode Fuzzy Hash: 9879a937105e083bd9aef7d9b8e876d5a873d896f238b78d14b88aad6da131cd
Instruction Fuzzy Hash: 9A31E538A246429AE7669B59CD80B767793FF86384F58D12DF082876ACDB34A812C714

Function 022ED4D5 Relevance: .1, Instructions: 103COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1843357403.00000000022B0000.00000040.00001000.00020000.00000000.sdmp, Offset: 022B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_22b0000_5RRVBiCpFI.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9112804f8139e9297ba88e3742caefcf6529a162b57808c6ac39dfffa7ef667e
Instruction ID: b9c0f6aae485b39eb8287f76d282ee34ff9788f0f41762ed7166166d741771bf
Opcode Fuzzy Hash: 9112804f8139e9297ba88e3742caefcf6529a162b57808c6ac39dfffa7ef667e
Instruction Fuzzy Hash: 69210B21B187910BDB18DE3988D1237F7D75BCB124F48D63DC4A7972D9CA34E5058644

Function 022C7E11 Relevance: .1, Instructions: 81COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1843357403.00000000022B0000.00000040.00001000.00020000.00000000.sdmp, Offset: 022B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_22b0000_5RRVBiCpFI.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fbddf629d58ab5b7ce3c6d341b6087eefabcc06d9ed1031e48f954126914271b
Instruction ID: 83ac6a66cd45c4af7c48ab9c4b84a833da112b7a12efcebd77d02e784398a299
Opcode Fuzzy Hash: fbddf629d58ab5b7ce3c6d341b6087eefabcc06d9ed1031e48f954126914271b
Instruction Fuzzy Hash: 7821C275624B029FD3208F688884B27B7A7AB97220F24866CD5954B699CB34EC42CB54

Function 022B4704 Relevance: .1, Instructions: 76COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1843357403.00000000022B0000.00000040.00001000.00020000.00000000.sdmp, Offset: 022B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_22b0000_5RRVBiCpFI.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d6c3b5f98540c4edbfb2bfe1cd8306b70007439d23ccf1357e9be793c2fe8105
Instruction ID: 0f0ccdddec2cc35eeae68398f5baf87ac0fa6be8ec9aaea5f7299c55151c0b50
Opcode Fuzzy Hash: d6c3b5f98540c4edbfb2bfe1cd8306b70007439d23ccf1357e9be793c2fe8105
Instruction Fuzzy Hash: DF115773F3653207B351AE769CE829623A3EFC2358B1A0134E941C7686CB31FA12E164

Function 022D6DF8 Relevance: .1, Instructions: 68COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1843357403.00000000022B0000.00000040.00001000.00020000.00000000.sdmp, Offset: 022B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_22b0000_5RRVBiCpFI.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c3217eddf26d73e13bed4335cf48e091058d425e1d7b0796f7844dc1e666736a
Instruction ID: b77cd62554a6ce682687ce16d8fd9a1d008bca40f8df889daa302cc0b3c1e550
Opcode Fuzzy Hash: c3217eddf26d73e13bed4335cf48e091058d425e1d7b0796f7844dc1e666736a
Instruction Fuzzy Hash: 0B11E771664300AFCB18CFE8D8D1A7EB7A5AB87305F49953DD582C7369C674C9018B46

Function 022ECCC9 Relevance: .1, Instructions: 67COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1843357403.00000000022B0000.00000040.00001000.00020000.00000000.sdmp, Offset: 022B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_22b0000_5RRVBiCpFI.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 44c97935eddf75c305e2d2b65cd8ba00c8eb118628fa0640b3156059a25bc93e
Instruction ID: 4b1c6f2d87ed246c11aaac37a2ba167bc4f6c5a8143586559aa4ed7fee4806e4
Opcode Fuzzy Hash: 44c97935eddf75c305e2d2b65cd8ba00c8eb118628fa0640b3156059a25bc93e
Instruction Fuzzy Hash: 45114875A687458FC728FFE4ECC027AB7A5AB8B310F19843D89A647365EB608D10C649

Function 022B1276 Relevance: .1, Instructions: 66COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1843357403.00000000022B0000.00000040.00001000.00020000.00000000.sdmp, Offset: 022B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_22b0000_5RRVBiCpFI.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4e64317625e06953a0030493f718403388be9115d8c6a0e5777c3d8d6dbedd3d
Instruction ID: 2a6552a19a94f7653b4e95c49697fcd5e8b779d670d84328118365e34230d441
Opcode Fuzzy Hash: 4e64317625e06953a0030493f718403388be9115d8c6a0e5777c3d8d6dbedd3d
Instruction Fuzzy Hash: 0831A174E00219DFCF08CF98C5A0AAEBBB1FF48314F248599D815AB345D371AA92CF90

Function 022C60D3 Relevance: .1, Instructions: 65COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1843357403.00000000022B0000.00000040.00001000.00020000.00000000.sdmp, Offset: 022B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_22b0000_5RRVBiCpFI.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f5c82fc671e06e79b78df2e2b48bef573e4aa83533a2b75342557a0be53bb444
Instruction ID: 816a2d3ea1a061084e0ebd1b591b2d57a912bdd08c44ba01c196c7cb23faba0e
Opcode Fuzzy Hash: f5c82fc671e06e79b78df2e2b48bef573e4aa83533a2b75342557a0be53bb444
Instruction Fuzzy Hash: 98012B70B156015AF71847698C41B3A7363FBC3711F75932DE1819B3E6DE7188018B05

Function 022E5164 Relevance: .1, Instructions: 64COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1843357403.00000000022B0000.00000040.00001000.00020000.00000000.sdmp, Offset: 022B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_22b0000_5RRVBiCpFI.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3e517b76c81f2f0a6076fdce7dc782eea2d3cbf91ba42ade49569ad1c1c074a0
Instruction ID: 0357a181190f5b5737cbf4e00a9227af3df77f888f97d6755a5942c920ceb2ac
Opcode Fuzzy Hash: 3e517b76c81f2f0a6076fdce7dc782eea2d3cbf91ba42ade49569ad1c1c074a0
Instruction Fuzzy Hash: 3411C633A251D14DC7168D7C8810565BFA30A93238FD98399F4B59F2E6C6628A8A9360

Function 022DB4E4 Relevance: .1, Instructions: 63COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1843357403.00000000022B0000.00000040.00001000.00020000.00000000.sdmp, Offset: 022B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_22b0000_5RRVBiCpFI.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: babb52ce3867e81688af6e2cbfc925ee92a6f3f8cd139ab93b6cbf9c46b7bedb
Instruction ID: ee4b50a5930f4235cc3f359b276d3a30aa7f0723f1ffa60fbf67bb139bad2ae3
Opcode Fuzzy Hash: babb52ce3867e81688af6e2cbfc925ee92a6f3f8cd139ab93b6cbf9c46b7bedb
Instruction Fuzzy Hash: E50184F161030347EB21DED584E0B3FB3E9AF95B1CF19442CDA1457248DB76E845CAA1

Function 022D6E80 Relevance: .1, Instructions: 63COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1843357403.00000000022B0000.00000040.00001000.00020000.00000000.sdmp, Offset: 022B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_22b0000_5RRVBiCpFI.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 08b4345849cd0f47e80d1ed5c22eab79d945ad8a979d27bd12cd0f1252f48fec
Instruction ID: 3ea7d10ea44c39fa8c8fac6378227ef9303d3a3f0a59f19d4bf1ecc959cbcb6f
Opcode Fuzzy Hash: 08b4345849cd0f47e80d1ed5c22eab79d945ad8a979d27bd12cd0f1252f48fec
Instruction Fuzzy Hash: A21104767647009FDB18CFA8D8D06BAB3E19B8A311F4A953C9582C3394CBB8C9068746

Function 022E8508 Relevance: .1, Instructions: 62COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1843357403.00000000022B0000.00000040.00001000.00020000.00000000.sdmp, Offset: 022B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_22b0000_5RRVBiCpFI.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 358e2d3b4c42a0c731e3efba7596486553403020c12b89a5f8a1758b9ddfefcd
Instruction ID: 8657663bf3dc0a573fa1af6a4f5cf51f8d77c8f3382bfd1eb17317bd8e3ccea7
Opcode Fuzzy Hash: 358e2d3b4c42a0c731e3efba7596486553403020c12b89a5f8a1758b9ddfefcd
Instruction Fuzzy Hash: F9116B755143025BDB209F94DDC0B3BB7E7A7E6740F569039E6C1972A9CB30C842A753

Function 022C036F Relevance: .1, Instructions: 61COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1843357403.00000000022B0000.00000040.00001000.00020000.00000000.sdmp, Offset: 022B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_22b0000_5RRVBiCpFI.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 009d4c94d368716b5c6a07810fd56c9ecea920436c5469bb2fcdecc493a6d2d4
Instruction ID: 9ab933bd559f46b3a3c1cde878c5656ccdaec9c443026cb3e1263f9b804dfa70
Opcode Fuzzy Hash: 009d4c94d368716b5c6a07810fd56c9ecea920436c5469bb2fcdecc493a6d2d4
Instruction Fuzzy Hash: 221127B07507804FD715CF64CCC1AA57772AB86314715867CA8418BB96C67CA805CB64

Function 022BD8FD Relevance: .1, Instructions: 61COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1843357403.00000000022B0000.00000040.00001000.00020000.00000000.sdmp, Offset: 022B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_22b0000_5RRVBiCpFI.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9189c4c3175398eb84fc80681e1c6dfaa05d9782f835bdc2878a97ad02b88055
Instruction ID: 2ef85bffcb5fe3e9838de7a9405d4966b4e1e1e4c54097a233c2d7711f14faf4
Opcode Fuzzy Hash: 9189c4c3175398eb84fc80681e1c6dfaa05d9782f835bdc2878a97ad02b88055
Instruction Fuzzy Hash: CA11CE71608342ABD7248F299D906BBBBE2EBC6358F14AA2CE58243794C630C441CB0A

Function 022D89B1 Relevance: .0, Instructions: 35COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1843357403.00000000022B0000.00000040.00001000.00020000.00000000.sdmp, Offset: 022B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_22b0000_5RRVBiCpFI.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 19ed9741b84afb298707877cb2535680f06aa68bf492e7e97af849109ca09354
Instruction ID: 8651047d7c8e8c13e243c8393560793c2fb5186140bac1c38753960b10a89c39
Opcode Fuzzy Hash: 19ed9741b84afb298707877cb2535680f06aa68bf492e7e97af849109ca09354
Instruction Fuzzy Hash: C0F039B5E083818BC718CF28844066AFBE5AB9A700F10592DD58AA3341DB319545CB4A

Function 022B0FD7 Relevance: .0, Instructions: 33COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1843357403.00000000022B0000.00000040.00001000.00020000.00000000.sdmp, Offset: 022B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_22b0000_5RRVBiCpFI.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2f432f6d4d57ddd5edf10f0a55197208a6667e030cc273150dee4b63bd6a15e3
Instruction ID: 8f001eae8476c8060b1c23c2068364efd246191811e3537bb8c43614297868cf
Opcode Fuzzy Hash: 2f432f6d4d57ddd5edf10f0a55197208a6667e030cc273150dee4b63bd6a15e3
Instruction Fuzzy Hash: 47011D34A11148EFCB15DF94C294AACF7B2FF44350F208599D8056B385D731AF91DB40

Function 022D9064 Relevance: .0, Instructions: 32COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1843357403.00000000022B0000.00000040.00001000.00020000.00000000.sdmp, Offset: 022B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_22b0000_5RRVBiCpFI.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1c062fd088646d19ef1d8bd4d71c411c976c3123481e9341e85681c4dc346f69
Instruction ID: b56d3c72ccc4d872960315fef8b59e197d8309e10b2030bc5473290e33b09bc1
Opcode Fuzzy Hash: 1c062fd088646d19ef1d8bd4d71c411c976c3123481e9341e85681c4dc346f69
Instruction Fuzzy Hash: 48F046B41193929FC300DF29D29051BFBE0ABD5318FA4AA5CE8D95B216D334C6028B4A

Function 022D6D9E Relevance: .0, Instructions: 31COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1843357403.00000000022B0000.00000040.00001000.00020000.00000000.sdmp, Offset: 022B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_22b0000_5RRVBiCpFI.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 15be5673a4952075455a6c2d450438e7f22dd3e3a56e71dfeee11c81b82dc352
Instruction ID: 6193c6d390a8225c3b3a300272ce12ac19d650d288e9be0873a2adc8f31a4704
Opcode Fuzzy Hash: 15be5673a4952075455a6c2d450438e7f22dd3e3a56e71dfeee11c81b82dc352
Instruction Fuzzy Hash: 92F0EDB16C8301BAF6249E40CC43F6AB6A49755B00F301518B345790E0E5E1B9498B0E

Function 022EC5E6 Relevance: .0, Instructions: 29COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1843357403.00000000022B0000.00000040.00001000.00020000.00000000.sdmp, Offset: 022B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_22b0000_5RRVBiCpFI.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 130b8f035e0f9caf36d69ffe2fe00e5717c81f35e5d13109d0f780a603360f32
Instruction ID: 55367ec44160930b00c9fc6537dab478ff1644b50a375ce9a2e9be8a2e5deb7c
Opcode Fuzzy Hash: 130b8f035e0f9caf36d69ffe2fe00e5717c81f35e5d13109d0f780a603360f32
Instruction Fuzzy Hash: 12F0A735B456808BEB08CF38D82155ABBE2E387224F145A7DD641D3755D739C4018605

Function 022D7C83 Relevance: .0, Instructions: 22COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1843357403.00000000022B0000.00000040.00001000.00020000.00000000.sdmp, Offset: 022B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_22b0000_5RRVBiCpFI.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7004a593075d1604d820592827f960a74d411a36b63cc4088cdb0a0f645b001a
Instruction ID: 35157a91527617221951ac2766be328a81082b9bada299aafc8de39b0efc039d
Opcode Fuzzy Hash: 7004a593075d1604d820592827f960a74d411a36b63cc4088cdb0a0f645b001a
Instruction Fuzzy Hash: F5D02E7483C9238A2A290E7410202B0E7220B0350770A89E488C23F04ACF0AC9034198

Function 022D8006 Relevance: .0, Instructions: 8COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1843357403.00000000022B0000.00000040.00001000.00020000.00000000.sdmp, Offset: 022B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_22b0000_5RRVBiCpFI.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e3ed35eba93c559e2b640e4773887084713877586e1a61965fa59bb2e9adbcdb
Instruction ID: 88d28f4539103711ef6104adbc4c901a24cbbd6804f5379e7088d630b29811a1
Opcode Fuzzy Hash: e3ed35eba93c559e2b640e4773887084713877586e1a61965fa59bb2e9adbcdb
Instruction Fuzzy Hash: 5DA00129A9E6548AD2119F4494927F0F778E31770AF1438289904AB153D196E950864C

Function 022EDB35 Relevance: .0, Instructions: 8COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1843357403.00000000022B0000.00000040.00001000.00020000.00000000.sdmp, Offset: 022B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_22b0000_5RRVBiCpFI.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 39f376952ae625b8b9e581a4d9adace311e733e6b5fc1a80656dd2f6c93a6218
Instruction ID: 979b3066809f2b39c8d4e254b46c6f556eea9d2a5e27a8b6f776bea0b7d6dcb5
Opcode Fuzzy Hash: 39f376952ae625b8b9e581a4d9adace311e733e6b5fc1a80656dd2f6c93a6218
Instruction Fuzzy Hash: 1AB002759486418FC644DF18D584974F7F5AB0B211F1564549589E7222D220D8408A19

Function 022EE068 Relevance: .0, Instructions: 7COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1843357403.00000000022B0000.00000040.00001000.00020000.00000000.sdmp, Offset: 022B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_22b0000_5RRVBiCpFI.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 89a247458966beb6ee1323d7209a08a94252eab5608dc6956c606f04d9c1587d
Instruction ID: 10c72ce3a0ca8e08a8575cf423c81d1ec4165de9f21f41d416b206e48e332a4b
Opcode Fuzzy Hash: 89a247458966beb6ee1323d7209a08a94252eab5608dc6956c606f04d9c1587d
Instruction Fuzzy Hash: FDA00239E5C40197CA08CF20A854871E2BA6B5F204FA134288106B7C52D951D500854C

Function 022D6E6A Relevance: .0, Instructions: 7COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1843357403.00000000022B0000.00000040.00001000.00020000.00000000.sdmp, Offset: 022B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_22b0000_5RRVBiCpFI.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dbeba292ae877db911bd2f22180c16664a0dc2a699d78ed72cdc2ede8be8a5c3
Instruction ID: 70204a4f19da818e306c590333116dd845209fb171f96af6639338c1a50bb7b2
Opcode Fuzzy Hash: dbeba292ae877db911bd2f22180c16664a0dc2a699d78ed72cdc2ede8be8a5c3
Instruction Fuzzy Hash: 38B00254855145D6D704CF10D905575F270BF43705F10F655A40437160D3B4C248870E

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is an administration feature that provides a uniform environment to access Windows system components. The WMI service enables both local and remote access, though the latter is facilitated by Remote Services such as Distributed Component Object Model (DCOM) and Windows Remote Management (WinRM).Remote WMI over DCOM operates using port 135, whereas WMI over WinRM operates over port 5985 when using HTTP and 5986 for HTTPS.
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Connection Creation, Process: Process Creation, WMI: WMI Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse PowerShell commands and scripts for execution. PowerShell is a powerful interactive command-line interface and scripting environment included in the Windows operating system.Adversaries can use PowerShell to perform a number of actions, including discovery of information and execution of code. Examples include the `Start-Process` cmdlet which can be used to run an executable and the `Invoke-Command` cmdlet which runs a command locally or on a remote computer (though administrator permissions are required to use PowerShell to connect to remote systems).
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report 5RRVBiCpFI.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: LummaC

Yara Signatures

PCAP (Network Traffic)

Memory Dumps

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Software Vulnerabilities

Networking

System Summary

Data Obfuscation

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Data Directories

Sections

Resources

Imports

Possible Origin

Network Behavior

Suricata IDS Alerts

Network Port Distribution

TCP Packets

UDP Packets

DNS Queries

Windows Analysis Report
5RRVBiCpFI.exe

Function 022B0D77 Relevance: 6.1, APIs: 4, Instructions: 100
threadprocessCOMMON

Function 022B0C27 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 103
threadCOMMON

Function 022B0667 Relevance: 1.9, APIs: 1, Instructions: 399
threadCOMMON

Function 022FE3CC Relevance: 6.1, APIs: 4, Instructions: 99
memoryCOMMON

Function 022FF23C Relevance: 4.8, APIs: 3, Instructions: 325
memoryCOMMON

Function 023005EA Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 66
libraryCOMMON

Function 022FE4C7 Relevance: 3.0, APIs: 2, Instructions: 48
memoryCOMMON

Function 022E615E Relevance: 127.9, Strings: 102, Instructions: 417
COMMON

Function 022E5BCC Relevance: 36.6, Strings: 29, Instructions: 348
COMMON

Function 022BAD64 Relevance: 18.0, Strings: 14, Instructions: 458
COMMON

Function 022C1531 Relevance: 17.1, Strings: 13, Instructions: 892
COMMON