Edit tour

Windows Analysis Report
EMfRi659Ir.exe

Overview

General Information

Sample name:	EMfRi659Ir.exe renamed because original name is a hash value
Original sample name:	cd9660e42868082ea20472ecd6a22ae9573053af7c1de8daaa5f4f75c99c41b6.exe
Analysis ID:	1586713
MD5:	1d193430d800a1c0e6864567543c47bb
SHA1:	ab5c3eb3dab9f89a2f8876a9e3ca0a75384f4eab
SHA256:	cd9660e42868082ea20472ecd6a22ae9573053af7c1de8daaa5f4f75c99c41b6
Tags:	exeuser-crep1x
Infos:

Detection

Score:	52
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Multi AV Scanner detection for submitted file

AI detected suspicious sample

Detected potential crypto function

Found potential string decryption / allocating functions

May sleep (evasive loops) to hinder dynamic analysis

PE file contains an invalid checksum

PE file contains more sections than normal

PE file contains sections with non-standard names

Queries the installation date of Windows

Sample file is different than original file name gathered from version info

Classification

Process Tree

System is w10x64

EMfRi659Ir.exe (PID: 7992 cmdline: "C:\Users\user\Desktop\EMfRi659Ir.exe" MD5: 1D193430D800A1C0E6864567543C47BB)

cleanup

Malware Configuration

⊘No configs have been found

Yara Signatures

⊘No yara matches

Sigma Signatures

⊘No Sigma rule has matched

Suricata Signatures

⊘No Suricata rule has matched

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Multi AV Scanner detection for submitted file

Source: EMfRi659Ir.exe

ReversingLabs: Detection: 57%

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 99.5% probability

Source: EMfRi659Ir.exe

Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT

Source:	Binary string: ntdll.pdb source: EMfRi659Ir.exe, 00000002.00000002.1610782310.000001B2E6F33000.00000004.00000020.00020000.00000000.sdmp, EMfRi659Ir.exe, 00000002.00000002.1612616660.000001B2E8337000.00000004.00000020.00020000.00000000.sdmp, EMfRi659Ir.exe, 00000002.00000002.1613085089.000001B2E873D000.00000004.00000020.00020000.00000000.sdmp, EMfRi659Ir.exe, 00000002.00000002.1612261907.000001B2E7F34000.00000004.00000020.00020000.00000000.sdmp, EMfRi659Ir.exe, 00000002.00000002.1609894510.000001B2E653F000.00000004.00000020.00020000.00000000.sdmp, EMfRi659Ir.exe, 00000002.00000002.1609289526.000001B2E5F37000.00000004.00000020.00020000.00000000.sdmp, EMfRi659Ir.exe, 00000002.00000002.1612430504.000001B2E8139000.00000004.00000020.00020000.00000000.sdmp, EMfRi659Ir.exe, 00000002.00000002.1613802216.000001B2E8F3E000.00000004.00000020.00020000.00000000.sdmp, EMfRi659Ir.exe, 00000002.00000002.1611332417.000001B2E7530000.00000004.00000020.00020000.00000000.sdmp, EMfRi659Ir.exe, 00000002.00000002.1610979280.000001B2E713A000.00000004.00000020.00020000.00000000.sdmp, EMfRi659Ir.exe, 00000002.00000002.1611896797.000001B2E7B3F000.00000004.00000020.00020000.00000000.sdmp, EMfRi659Ir.exe, 00000002.00000002.1614602051.000001B2E9538000.00000004.00000020.00020000.00000000.sdmp, EMfRi659Ir.exe, 00000002.00000002.1614058305.000001B2E913F000.00000004.00000020.00020000.00000000.sdmp, EMfRi659Ir.exe, 00000002.00000002.1611149650.000001B2E733A000.00000004.00000020.00020000.00000000.sdmp, EMfRi659Ir.exe, 00000002.00000002.1613455506.000001B2E8B37000.00000004.00000020.00020000.00000000.sdmp, EMfRi659Ir.exe, 00000002.00000002.1609542464.000001B2E6135000.00000004.00000020.00020000.00000000.sdmp, EMfRi659Ir.exe, 00000002.00000002.1614307148.000001B2E933D000.00000004.00000020.00020000.00000000.sdmp, EMfRi659Ir.exe, 00000002.00000002.1613624050.000001B2E8D35000.00000004.00000020.00020000.00000000.sdmp, EMfRi659Ir.exe, 00000002.00000002.1611721174.000001B2E7934000.00000004.00000020.00020000.00000000.sdmp, EMfRi659Ir.exe, 00000002.00000002.1610075533.000001B2E6737000.00000004.00000020.00020000.00000000.sdmp, EMfRi659Ir.exe, 00000002.00000002.1611509177.000001B2E773B000.00000004.00000020.00020000.00000000.sdmp, EMfRi659Ir.exe, 00000002.00000002.1609709581.000001B2E633F000.00000004.00000020.00020000.00000000.sdmp, EMfRi659Ir.exe, 00000002.00000002.1610261446.000001B2E6932000.00000004.00000020.00020000.00000000.sdmp, EMfRi659Ir.exe, 00000002.00000002.1613284338.000001B2E8930000.00000004.00000020.00020000.00000000.sdmp, EMfRi659Ir.exe, 00000002.00000002.1610441918.000001B2E6B3D000.00000004.00000020.00020000.00000000.sdmp, EMfRi659Ir.exe, 00000002.00000002.1610623307.000001B2E6D31000.00000004.00000020.00020000.00000000.sdmp, EMfRi659Ir.exe, 00000002.00000002.1612073823.000001B2E7D34000.00000004.00000020.00020000.00000000.sdmp, EMfRi659Ir.exe, 00000002.00000002.1612801561.000001B2E853A000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: ntdll.pdbUGP source: EMfRi659Ir.exe, 00000002.00000002.1610782310.000001B2E6F33000.00000004.00000020.00020000.00000000.sdmp, EMfRi659Ir.exe, 00000002.00000002.1612616660.000001B2E8337000.00000004.00000020.00020000.00000000.sdmp, EMfRi659Ir.exe, 00000002.00000002.1613085089.000001B2E873D000.00000004.00000020.00020000.00000000.sdmp, EMfRi659Ir.exe, 00000002.00000002.1612261907.000001B2E7F34000.00000004.00000020.00020000.00000000.sdmp, EMfRi659Ir.exe, 00000002.00000002.1609894510.000001B2E653F000.00000004.00000020.00020000.00000000.sdmp, EMfRi659Ir.exe, 00000002.00000002.1609289526.000001B2E5F37000.00000004.00000020.00020000.00000000.sdmp, EMfRi659Ir.exe, 00000002.00000002.1612430504.000001B2E8139000.00000004.00000020.00020000.00000000.sdmp, EMfRi659Ir.exe, 00000002.00000002.1613802216.000001B2E8F3E000.00000004.00000020.00020000.00000000.sdmp, EMfRi659Ir.exe, 00000002.00000002.1611332417.000001B2E7530000.00000004.00000020.00020000.00000000.sdmp, EMfRi659Ir.exe, 00000002.00000002.1610979280.000001B2E713A000.00000004.00000020.00020000.00000000.sdmp, EMfRi659Ir.exe, 00000002.00000002.1611896797.000001B2E7B3F000.00000004.00000020.00020000.00000000.sdmp, EMfRi659Ir.exe, 00000002.00000002.1614602051.000001B2E9538000.00000004.00000020.00020000.00000000.sdmp, EMfRi659Ir.exe, 00000002.00000002.1614058305.000001B2E913F000.00000004.00000020.00020000.00000000.sdmp, EMfRi659Ir.exe, 00000002.00000002.1611149650.000001B2E733A000.00000004.00000020.00020000.00000000.sdmp, EMfRi659Ir.exe, 00000002.00000002.1613455506.000001B2E8B37000.00000004.00000020.00020000.00000000.sdmp, EMfRi659Ir.exe, 00000002.00000002.1609542464.000001B2E6135000.00000004.00000020.00020000.00000000.sdmp, EMfRi659Ir.exe, 00000002.00000002.1614307148.000001B2E933D000.00000004.00000020.00020000.00000000.sdmp, EMfRi659Ir.exe, 00000002.00000002.1613624050.000001B2E8D35000.00000004.00000020.00020000.00000000.sdmp, EMfRi659Ir.exe, 00000002.00000002.1611721174.000001B2E7934000.00000004.00000020.00020000.00000000.sdmp, EMfRi659Ir.exe, 00000002.00000002.1610075533.000001B2E6737000.00000004.00000020.00020000.00000000.sdmp, EMfRi659Ir.exe, 00000002.00000002.1611509177.000001B2E773B000.00000004.00000020.00020000.00000000.sdmp, EMfRi659Ir.exe, 00000002.00000002.1609709581.000001B2E633F000.00000004.00000020.00020000.00000000.sdmp, EMfRi659Ir.exe, 00000002.00000002.1610261446.000001B2E6932000.00000004.00000020.00020000.00000000.sdmp, EMfRi659Ir.exe, 00000002.00000002.1613284338.000001B2E8930000.00000004.00000020.00020000.00000000.sdmp, EMfRi659Ir.exe, 00000002.00000002.1610441918.000001B2E6B3D000.00000004.00000020.00020000.00000000.sdmp, EMfRi659Ir.exe, 00000002.00000002.1610623307.000001B2E6D31000.00000004.00000020.00020000.00000000.sdmp, EMfRi659Ir.exe, 00000002.00000002.1612073823.000001B2E7D34000.00000004.00000020.00020000.00000000.sdmp, EMfRi659Ir.exe, 00000002.00000002.1612801561.000001B2E853A000.00000004.00000020.00020000.00000000.sdmp

Source: unknown

UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic

DNS traffic detected: DNS query: tataragirld.site

Source: EMfRi659Ir.exe, 00000002.00000003.1601331341.000001B2E4399000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://tataragirld.site/
Source: EMfRi659Ir.exe, 00000002.00000002.1608884799.000001B2E4357000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://tataragirld.site/#
Source: EMfRi659Ir.exe, 00000002.00000003.1604753376.000001B2E439A000.00000004.00000020.00020000.00000000.sdmp, EMfRi659Ir.exe, 00000002.00000003.1594635739.000001B2E4399000.00000004.00000020.00020000.00000000.sdmp, EMfRi659Ir.exe, 00000002.00000003.1603226104.000001B2E439F000.00000004.00000020.00020000.00000000.sdmp, EMfRi659Ir.exe, 00000002.00000003.1600479017.000001B2E439A000.00000004.00000020.00020000.00000000.sdmp, EMfRi659Ir.exe, 00000002.00000003.1601331341.000001B2E4399000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://tataragirld.site/&E
Source: EMfRi659Ir.exe, 00000002.00000002.1609070610.000001B2E439B000.00000004.00000020.00020000.00000000.sdmp, EMfRi659Ir.exe, 00000002.00000003.1607828980.000001B2E439B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://tataragirld.site/2E
Source: EMfRi659Ir.exe, 00000002.00000003.1604870904.000001B2E4399000.00000004.00000020.00020000.00000000.sdmp, EMfRi659Ir.exe, 00000002.00000003.1606168907.000001B2E439A000.00000004.00000020.00020000.00000000.sdmp, EMfRi659Ir.exe, 00000002.00000003.1592400745.000001B2E439A000.00000004.00000020.00020000.00000000.sdmp, EMfRi659Ir.exe, 00000002.00000003.1591178752.000001B2E4399000.00000004.00000020.00020000.00000000.sdmp, EMfRi659Ir.exe, 00000002.00000003.1606336337.000001B2E4399000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://tataragirld.site/FE-L.
Source: EMfRi659Ir.exe, 00000002.00000003.1604870904.000001B2E4399000.00000004.00000020.00020000.00000000.sdmp, EMfRi659Ir.exe, 00000002.00000003.1606168907.000001B2E439A000.00000004.00000020.00020000.00000000.sdmp, EMfRi659Ir.exe, 00000002.00000003.1592544685.000001B2E4399000.00000004.00000020.00020000.00000000.sdmp, EMfRi659Ir.exe, 00000002.00000003.1606336337.000001B2E4399000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://tataragirld.site/JE
Source: EMfRi659Ir.exe, 00000002.00000003.1592400745.000001B2E439A000.00000004.00000020.00020000.00000000.sdmp, EMfRi659Ir.exe, 00000002.00000003.1592544685.000001B2E4399000.00000004.00000020.00020000.00000000.sdmp, EMfRi659Ir.exe, 00000002.00000003.1591178752.000001B2E4399000.00000004.00000020.00020000.00000000.sdmp, EMfRi659Ir.exe, 00000002.00000003.1594175635.000001B2E439A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://tataragirld.site/VE=L
Source: EMfRi659Ir.exe, 00000002.00000003.1589707781.000001B2E4399000.00000004.00000020.00020000.00000000.sdmp, EMfRi659Ir.exe, 00000002.00000003.1591034789.000001B2E439A000.00000004.00000020.00020000.00000000.sdmp, EMfRi659Ir.exe, 00000002.00000003.1591178752.000001B2E4399000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://tataragirld.site/ZE1L
Source: EMfRi659Ir.exe, 00000002.00000003.1594635739.000001B2E4399000.00000004.00000020.00020000.00000000.sdmp, EMfRi659Ir.exe, 00000002.00000003.1589707781.000001B2E4399000.00000004.00000020.00020000.00000000.sdmp, EMfRi659Ir.exe, 00000002.00000003.1591034789.000001B2E439A000.00000004.00000020.00020000.00000000.sdmp, EMfRi659Ir.exe, 00000002.00000003.1592400745.000001B2E439A000.00000004.00000020.00020000.00000000.sdmp, EMfRi659Ir.exe, 00000002.00000003.1592544685.000001B2E4399000.00000004.00000020.00020000.00000000.sdmp, EMfRi659Ir.exe, 00000002.00000003.1591178752.000001B2E4399000.00000004.00000020.00020000.00000000.sdmp, EMfRi659Ir.exe, 00000002.00000003.1594175635.000001B2E439A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://tataragirld.site/jE
Source: EMfRi659Ir.exe, 00000002.00000002.1609151257.000001B2E4430000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://tataragirld.site/sagesse_renaldo00.html
Source: EMfRi659Ir.exe, 00000002.00000002.1609151257.000001B2E4430000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://tataragirld.site/sagesse_renaldo00.html)
Source: EMfRi659Ir.exe, 00000002.00000003.1591178752.000001B2E4376000.00000004.00000020.00020000.00000000.sdmp, EMfRi659Ir.exe, 00000002.00000003.1607828980.000001B2E4376000.00000004.00000020.00020000.00000000.sdmp, EMfRi659Ir.exe, 00000002.00000003.1607703476.000001B2E43A7000.00000004.00000020.00020000.00000000.sdmp, EMfRi659Ir.exe, 00000002.00000002.1608884799.000001B2E4376000.00000004.00000020.00020000.00000000.sdmp, EMfRi659Ir.exe, 00000002.00000003.1594635739.000001B2E4399000.00000004.00000020.00020000.00000000.sdmp, EMfRi659Ir.exe, 00000002.00000003.1607828980.000001B2E439B000.00000004.00000020.00020000.00000000.sdmp, EMfRi659Ir.exe, 00000002.00000003.1587932850.000001B2E439F000.00000004.00000020.00020000.00000000.sdmp, EMfRi659Ir.exe, 00000002.00000003.1592544685.000001B2E4376000.00000004.00000020.00020000.00000000.sdmp, EMfRi659Ir.exe, 00000002.00000003.1592544685.000001B2E43A7000.00000004.00000020.00020000.00000000.sdmp, EMfRi659Ir.exe, 00000002.00000003.1594175635.000001B2E43A7000.00000004.00000020.00020000.00000000.sdmp, EMfRi659Ir.exe, 00000002.00000003.1594635739.000001B2E4376000.00000004.00000020.00020000.00000000.sdmp, EMfRi659Ir.exe, 00000002.00000003.1601331341.000001B2E4376000.00000004.00000020.00020000.00000000.sdmp, EMfRi659Ir.exe, 00000002.00000003.1606336337.000001B2E43A7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://tataragirld.site/sagesse_renaldo00.html?tdfgozllgbxxyj=yhIP6D%2BNM98rEr1pqaSoG1KWw5J7mExVtIz
Source: EMfRi659Ir.exe, 00000002.00000002.1609151257.000001B2E4430000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://tataragirld.site/sagesse_renaldo00.htmlM
Source: EMfRi659Ir.exe, 00000002.00000002.1609151257.000001B2E4430000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://tataragirld.site/sagesse_renaldo00.htmle
Source: EMfRi659Ir.exe, 00000002.00000003.1607828980.000001B2E43A7000.00000004.00000020.00020000.00000000.sdmp, EMfRi659Ir.exe, 00000002.00000003.1606168907.000001B2E43A7000.00000004.00000020.00020000.00000000.sdmp, EMfRi659Ir.exe, 00000002.00000003.1604870904.000001B2E43A7000.00000004.00000020.00020000.00000000.sdmp, EMfRi659Ir.exe, 00000002.00000003.1607703476.000001B2E43A7000.00000004.00000020.00020000.00000000.sdmp, EMfRi659Ir.exe, 00000002.00000003.1594635739.000001B2E43A7000.00000004.00000020.00020000.00000000.sdmp, EMfRi659Ir.exe, 00000002.00000003.1601331341.000001B2E43A7000.00000004.00000020.00020000.00000000.sdmp, EMfRi659Ir.exe, 00000002.00000003.1600479017.000001B2E43A7000.00000004.00000020.00020000.00000000.sdmp, EMfRi659Ir.exe, 00000002.00000003.1604753376.000001B2E43A7000.00000004.00000020.00020000.00000000.sdmp, EMfRi659Ir.exe, 00000002.00000003.1603226104.000001B2E43A7000.00000004.00000020.00020000.00000000.sdmp, EMfRi659Ir.exe, 00000002.00000002.1609070610.000001B2E43A7000.00000004.00000020.00020000.00000000.sdmp, EMfRi659Ir.exe, 00000002.00000003.1606336337.000001B2E43A7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://tataragirld.site:443
Source: EMfRi659Ir.exe, 00000002.00000003.1607828980.000001B2E43A7000.00000004.00000020.00020000.00000000.sdmp, EMfRi659Ir.exe, 00000002.00000003.1607703476.000001B2E43A7000.00000004.00000020.00020000.00000000.sdmp, EMfRi659Ir.exe, 00000002.00000002.1609070610.000001B2E43A7000.00000004.00000020.00020000.00000000.sdmp, EMfRi659Ir.exe, 00000002.00000003.1606336337.000001B2E43A7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://tataragirld.site:443:
Source: EMfRi659Ir.exe, 00000002.00000003.1594635739.000001B2E43A7000.00000004.00000020.00020000.00000000.sdmp, EMfRi659Ir.exe, 00000002.00000003.1592544685.000001B2E43A7000.00000004.00000020.00020000.00000000.sdmp, EMfRi659Ir.exe, 00000002.00000003.1601331341.000001B2E43A7000.00000004.00000020.00020000.00000000.sdmp, EMfRi659Ir.exe, 00000002.00000003.1600479017.000001B2E43A7000.00000004.00000020.00020000.00000000.sdmp, EMfRi659Ir.exe, 00000002.00000003.1594175635.000001B2E43A7000.00000004.00000020.00020000.00000000.sdmp, EMfRi659Ir.exe, 00000002.00000003.1604753376.000001B2E43A7000.00000004.00000020.00020000.00000000.sdmp, EMfRi659Ir.exe, 00000002.00000003.1603226104.000001B2E43A7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://tataragirld.site:443IN
Source: EMfRi659Ir.exe, 00000002.00000003.1607828980.000001B2E43A7000.00000004.00000020.00020000.00000000.sdmp, EMfRi659Ir.exe, 00000002.00000003.1606168907.000001B2E43A7000.00000004.00000020.00020000.00000000.sdmp, EMfRi659Ir.exe, 00000002.00000003.1604870904.000001B2E43A7000.00000004.00000020.00020000.00000000.sdmp, EMfRi659Ir.exe, 00000002.00000003.1607703476.000001B2E43A7000.00000004.00000020.00020000.00000000.sdmp, EMfRi659Ir.exe, 00000002.00000003.1604753376.000001B2E43A7000.00000004.00000020.00020000.00000000.sdmp, EMfRi659Ir.exe, 00000002.00000003.1603226104.000001B2E43A7000.00000004.00000020.00020000.00000000.sdmp, EMfRi659Ir.exe, 00000002.00000002.1609070610.000001B2E43A7000.00000004.00000020.00020000.00000000.sdmp, EMfRi659Ir.exe, 00000002.00000003.1606336337.000001B2E43A7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://tataragirld.site:443d
Source: EMfRi659Ir.exe, 00000002.00000003.1591178752.000001B2E43A7000.00000004.00000020.00020000.00000000.sdmp, EMfRi659Ir.exe, 00000002.00000003.1592400745.000001B2E43A7000.00000004.00000020.00020000.00000000.sdmp, EMfRi659Ir.exe, 00000002.00000003.1592544685.000001B2E43A7000.00000004.00000020.00020000.00000000.sdmp, EMfRi659Ir.exe, 00000002.00000003.1594175635.000001B2E43A7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://tataragirld.site:443vM

Source: C:\Users\user\Desktop\EMfRi659Ir.exe	Code function: 2_2_00007FF66CB3DE10	2_2_00007FF66CB3DE10
Source: C:\Users\user\Desktop\EMfRi659Ir.exe	Code function: 2_2_00007FF66CC63E00	2_2_00007FF66CC63E00
Source: C:\Users\user\Desktop\EMfRi659Ir.exe	Code function: 2_2_00007FF66CC57DE0	2_2_00007FF66CC57DE0
Source: C:\Users\user\Desktop\EMfRi659Ir.exe	Code function: 2_2_00007FF66CB3D180	2_2_00007FF66CB3D180
Source: C:\Users\user\Desktop\EMfRi659Ir.exe	Code function: 2_2_00007FF66CC57940	2_2_00007FF66CC57940
Source: C:\Users\user\Desktop\EMfRi659Ir.exe	Code function: 2_2_00007FF66CB3BB10	2_2_00007FF66CB3BB10
Source: C:\Users\user\Desktop\EMfRi659Ir.exe	Code function: 2_2_00007FF66CB3B730	2_2_00007FF66CB3B730
Source: C:\Users\user\Desktop\EMfRi659Ir.exe	Code function: 2_2_00007FF66CB3D6D0	2_2_00007FF66CB3D6D0
Source: C:\Users\user\Desktop\EMfRi659Ir.exe	Code function: 2_2_00007FF66CB3F25B	2_2_00007FF66CB3F25B
Source: C:\Users\user\Desktop\EMfRi659Ir.exe	Code function: 2_2_00007FF66CB3B370	2_2_00007FF66CB3B370
Source: C:\Users\user\Desktop\EMfRi659Ir.exe	Code function: 2_2_00007FF66CB34520	2_2_00007FF66CB34520
Source: C:\Users\user\Desktop\EMfRi659Ir.exe	Code function: 2_2_00007FF66CB414B0	2_2_00007FF66CB414B0
Source: C:\Users\user\Desktop\EMfRi659Ir.exe	Code function: 2_2_00007FF66CB3CDA0	2_2_00007FF66CB3CDA0
Source: C:\Users\user\Desktop\EMfRi659Ir.exe	Code function: 2_2_00007FF66CB3DDFE	2_2_00007FF66CB3DDFE
Source: C:\Users\user\Desktop\EMfRi659Ir.exe	Code function: 2_2_00007FF66CB40150	2_2_00007FF66CB40150
Source: C:\Users\user\Desktop\EMfRi659Ir.exe	Code function: 2_2_00007FF66CB3D180	2_2_00007FF66CB3D180
Source: C:\Users\user\Desktop\EMfRi659Ir.exe	Code function: 2_2_00007FF66CB385C0	2_2_00007FF66CB385C0
Source: C:\Users\user\Desktop\EMfRi659Ir.exe	Code function: 2_2_00007FF66CB3ADC0	2_2_00007FF66CB3ADC0
Source: C:\Users\user\Desktop\EMfRi659Ir.exe	Code function: 2_2_00007FF66CB385BE	2_2_00007FF66CB385BE
Source: C:\Users\user\Desktop\EMfRi659Ir.exe	Code function: 2_2_00007FF66CB375C8	2_2_00007FF66CB375C8
Source: C:\Users\user\Desktop\EMfRi659Ir.exe	Code function: 2_2_00007FF66CB395D0	2_2_00007FF66CB395D0
Source: C:\Users\user\Desktop\EMfRi659Ir.exe	Code function: 2_2_00007FF66CB335CE	2_2_00007FF66CB335CE
Source: C:\Users\user\Desktop\EMfRi659Ir.exe	Code function: 2_2_00007FF66CB37D00	2_2_00007FF66CB37D00
Source: C:\Users\user\Desktop\EMfRi659Ir.exe	Code function: 2_2_00007FF66CC1B9D8	2_2_00007FF66CC1B9D8
Source: C:\Users\user\Desktop\EMfRi659Ir.exe	Code function: 2_2_00007FF66CB32DF0	2_2_00007FF66CB32DF0
Source: C:\Users\user\Desktop\EMfRi659Ir.exe	Code function: 2_2_00007FF66CB415F0	2_2_00007FF66CB415F0
Source: C:\Users\user\Desktop\EMfRi659Ir.exe	Code function: 2_2_00007FF66CB95990	2_2_00007FF66CB95990
Source: C:\Users\user\Desktop\EMfRi659Ir.exe	Code function: 2_2_00007FF66CB31590	2_2_00007FF66CB31590
Source: C:\Users\user\Desktop\EMfRi659Ir.exe	Code function: 2_2_00007FF66CB37990	2_2_00007FF66CB37990
Source: C:\Users\user\Desktop\EMfRi659Ir.exe	Code function: 2_2_00007FF66CB7AD90	2_2_00007FF66CB7AD90
Source: C:\Users\user\Desktop\EMfRi659Ir.exe	Code function: 2_2_00007FF66CB78190	2_2_00007FF66CB78190
Source: C:\Users\user\Desktop\EMfRi659Ir.exe	Code function: 2_2_00007FF66CB36DA0	2_2_00007FF66CB36DA0
Source: C:\Users\user\Desktop\EMfRi659Ir.exe	Code function: 2_2_00007FF66CB3CDA0	2_2_00007FF66CB3CDA0
Source: C:\Users\user\Desktop\EMfRi659Ir.exe	Code function: 2_2_00007FF66CC01D40	2_2_00007FF66CC01D40
Source: C:\Users\user\Desktop\EMfRi659Ir.exe	Code function: 2_2_00007FF66CB3A540	2_2_00007FF66CB3A540
Source: C:\Users\user\Desktop\EMfRi659Ir.exe	Code function: 2_2_00007FF66CB95550	2_2_00007FF66CB95550
Source: C:\Users\user\Desktop\EMfRi659Ir.exe	Code function: 2_2_00007FF66CB40950	2_2_00007FF66CB40950
Source: C:\Users\user\Desktop\EMfRi659Ir.exe	Code function: 2_2_00007FF66CB40150	2_2_00007FF66CB40150
Source: C:\Users\user\Desktop\EMfRi659Ir.exe	Code function: 2_2_00007FF66CB3B150	2_2_00007FF66CB3B150
Source: C:\Users\user\Desktop\EMfRi659Ir.exe	Code function: 2_2_00007FF66CB7B160	2_2_00007FF66CB7B160
Source: C:\Users\user\Desktop\EMfRi659Ir.exe	Code function: 2_2_00007FF66CB3316B	2_2_00007FF66CB3316B
Source: C:\Users\user\Desktop\EMfRi659Ir.exe	Code function: 2_2_00007FF66CB7C170	2_2_00007FF66CB7C170
Source: C:\Users\user\Desktop\EMfRi659Ir.exe	Code function: 2_2_00007FF66CB41700	2_2_00007FF66CB41700
Source: C:\Users\user\Desktop\EMfRi659Ir.exe	Code function: 2_2_00007FF66CC63F10	2_2_00007FF66CC63F10
Source: C:\Users\user\Desktop\EMfRi659Ir.exe	Code function: 2_2_00007FF66CB38F20	2_2_00007FF66CB38F20
Source: C:\Users\user\Desktop\EMfRi659Ir.exe	Code function: 2_2_00007FF66CB3E320	2_2_00007FF66CB3E320
Source: C:\Users\user\Desktop\EMfRi659Ir.exe	Code function: 2_2_00007FF66CC01F2C	2_2_00007FF66CC01F2C
Source: C:\Users\user\Desktop\EMfRi659Ir.exe	Code function: 2_2_00007FF66CB382C0	2_2_00007FF66CB382C0
Source: C:\Users\user\Desktop\EMfRi659Ir.exe	Code function: 2_2_00007FF66CB7A6D0	2_2_00007FF66CB7A6D0
Source: C:\Users\user\Desktop\EMfRi659Ir.exe	Code function: 2_2_00007FF66CB392E0	2_2_00007FF66CB392E0
Source: C:\Users\user\Desktop\EMfRi659Ir.exe	Code function: 2_2_00007FF66CB372F2	2_2_00007FF66CB372F2
Source: C:\Users\user\Desktop\EMfRi659Ir.exe	Code function: 2_2_00007FF66CB40A80	2_2_00007FF66CB40A80
Source: C:\Users\user\Desktop\EMfRi659Ir.exe	Code function: 2_2_00007FF66CB65280	2_2_00007FF66CB65280
Source: C:\Users\user\Desktop\EMfRi659Ir.exe	Code function: 2_2_00007FF66CB7AE90	2_2_00007FF66CB7AE90
Source: C:\Users\user\Desktop\EMfRi659Ir.exe	Code function: 2_2_00007FF66CB3C6A0	2_2_00007FF66CB3C6A0
Source: C:\Users\user\Desktop\EMfRi659Ir.exe	Code function: 2_2_00007FF66CB3DAB0	2_2_00007FF66CB3DAB0
Source: C:\Users\user\Desktop\EMfRi659Ir.exe	Code function: 2_2_00007FF66CB41EB0	2_2_00007FF66CB41EB0
Source: C:\Users\user\Desktop\EMfRi659Ir.exe	Code function: 2_2_00007FF66CB37D00	2_2_00007FF66CB37D00
Source: C:\Users\user\Desktop\EMfRi659Ir.exe	Code function: 2_2_00007FF66CB796B0	2_2_00007FF66CB796B0
Source: C:\Users\user\Desktop\EMfRi659Ir.exe	Code function: 2_2_00007FF66CB3A670	2_2_00007FF66CB3A670
Source: C:\Users\user\Desktop\EMfRi659Ir.exe	Code function: 2_2_00007FF66CB7BA70	2_2_00007FF66CB7BA70
Source: C:\Users\user\Desktop\EMfRi659Ir.exe	Code function: 2_2_00007FF66CB3F25B	2_2_00007FF66CB3F25B
Source: C:\Users\user\Desktop\EMfRi659Ir.exe	Code function: 2_2_00007FF66CB3D3BA	2_2_00007FF66CB3D3BA
Source: C:\Users\user\Desktop\EMfRi659Ir.exe	Code function: 2_2_00007FF66CB78FC0	2_2_00007FF66CB78FC0
Source: C:\Users\user\Desktop\EMfRi659Ir.exe	Code function: 2_2_00007FF66CB40A80	2_2_00007FF66CB40A80
Source: C:\Users\user\Desktop\EMfRi659Ir.exe	Code function: 2_2_00007FF66CB7B7D0	2_2_00007FF66CB7B7D0
Source: C:\Users\user\Desktop\EMfRi659Ir.exe	Code function: 2_2_00007FF66CC1B7E0	2_2_00007FF66CC1B7E0
Source: C:\Users\user\Desktop\EMfRi659Ir.exe	Code function: 2_2_00007FF66CB3EF8B	2_2_00007FF66CB3EF8B
Source: C:\Users\user\Desktop\EMfRi659Ir.exe	Code function: 2_2_00007FF66CB39B90	2_2_00007FF66CB39B90
Source: C:\Users\user\Desktop\EMfRi659Ir.exe	Code function: 2_2_00007FF66CB78B90	2_2_00007FF66CB78B90
Source: C:\Users\user\Desktop\EMfRi659Ir.exe	Code function: 2_2_00007FF66CB33B43	2_2_00007FF66CB33B43
Source: C:\Users\user\Desktop\EMfRi659Ir.exe	Code function: 2_2_00007FF66CB78750	2_2_00007FF66CB78750
Source: C:\Users\user\Desktop\EMfRi659Ir.exe	Code function: 2_2_00007FF66CB37D00	2_2_00007FF66CB37D00
Source: C:\Users\user\Desktop\EMfRi659Ir.exe	Code function: 2_2_00007FF66CB37100	2_2_00007FF66CB37100
Source: C:\Users\user\Desktop\EMfRi659Ir.exe	Code function: 2_2_00007FF66CB78D20	2_2_00007FF66CB78D20
Source: C:\Users\user\Desktop\EMfRi659Ir.exe	Code function: 2_2_00007FF66CB41D30	2_2_00007FF66CB41D30
Source: C:\Users\user\Desktop\EMfRi659Ir.exe	Code function: 2_2_00007FF66CB3C930	2_2_00007FF66CB3C930
Source: C:\Users\user\Desktop\EMfRi659Ir.exe	Code function: 2_2_00007FF66CB3E320	2_2_00007FF66CB3E320
Source: C:\Users\user\Desktop\EMfRi659Ir.exe	Code function: 2_2_00007FF66CB788F0	2_2_00007FF66CB788F0
Source: C:\Users\user\Desktop\EMfRi659Ir.exe	Code function: 2_2_00007FF66CB324F5	2_2_00007FF66CB324F5
Source: C:\Users\user\Desktop\EMfRi659Ir.exe	Code function: 2_2_00007FF66CB3287D	2_2_00007FF66CB3287D
Source: C:\Users\user\Desktop\EMfRi659Ir.exe	Code function: 2_2_00007FF66CB78480	2_2_00007FF66CB78480
Source: C:\Users\user\Desktop\EMfRi659Ir.exe	Code function: 2_2_00007FF66CB7B480	2_2_00007FF66CB7B480
Source: C:\Users\user\Desktop\EMfRi659Ir.exe	Code function: 2_2_00007FF66CB39090	2_2_00007FF66CB39090
Source: C:\Users\user\Desktop\EMfRi659Ir.exe	Code function: 2_2_00007FF66CB398A0	2_2_00007FF66CB398A0
Source: C:\Users\user\Desktop\EMfRi659Ir.exe	Code function: 2_2_00007FF66CB798A0	2_2_00007FF66CB798A0
Source: C:\Users\user\Desktop\EMfRi659Ir.exe	Code function: 2_2_00007FF66CB3143E	2_2_00007FF66CB3143E
Source: C:\Users\user\Desktop\EMfRi659Ir.exe	Code function: 2_2_00007FF66CB95850	2_2_00007FF66CB95850
Source: C:\Users\user\Desktop\EMfRi659Ir.exe	Code function: 2_2_00007FF66CC46840	2_2_00007FF66CC46840
Source: C:\Users\user\Desktop\EMfRi659Ir.exe	Code function: 2_2_00007FF66CB38070	2_2_00007FF66CB38070

Source: C:\Users\user\Desktop\EMfRi659Ir.exe

Code function: String function: 00007FF66CB41700 appears 37 times

Source: EMfRi659Ir.exe

Static PE information: Number of sections : 11 > 10

Source: EMfRi659Ir.exe, 00000002.00000002.1609709581.000001B2E64B7000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: OriginalFilenamentdll.dllj% vs EMfRi659Ir.exe

Source: classification engine

Classification label: mal52.winEXE@1/0@1/0

Source: EMfRi659Ir.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Users\user\Desktop\EMfRi659Ir.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: EMfRi659Ir.exe

ReversingLabs: Detection: 57%

Source: C:\Users\user\Desktop\EMfRi659Ir.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\EMfRi659Ir.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\EMfRi659Ir.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\EMfRi659Ir.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\Desktop\EMfRi659Ir.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\EMfRi659Ir.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\EMfRi659Ir.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\EMfRi659Ir.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\EMfRi659Ir.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\EMfRi659Ir.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\EMfRi659Ir.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\EMfRi659Ir.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Users\user\Desktop\EMfRi659Ir.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Users\user\Desktop\EMfRi659Ir.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Users\user\Desktop\EMfRi659Ir.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\EMfRi659Ir.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\EMfRi659Ir.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\Desktop\EMfRi659Ir.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\EMfRi659Ir.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\EMfRi659Ir.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\EMfRi659Ir.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\EMfRi659Ir.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\EMfRi659Ir.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\EMfRi659Ir.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\EMfRi659Ir.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\EMfRi659Ir.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior

Source: EMfRi659Ir.exe

Static PE information: Virtual size of .text is bigger than: 0x100000

Source: EMfRi659Ir.exe

Static PE information: Image base 0x140000000 > 0x60000000

Source: EMfRi659Ir.exe

Static file information: File size 2636824 > 1048576

Source: EMfRi659Ir.exe

Static PE information: Raw size of .text is bigger than: 0x100000 < 0x22da00

Source: EMfRi659Ir.exe

Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT

Source:	Binary string: ntdll.pdb source: EMfRi659Ir.exe, 00000002.00000002.1610782310.000001B2E6F33000.00000004.00000020.00020000.00000000.sdmp, EMfRi659Ir.exe, 00000002.00000002.1612616660.000001B2E8337000.00000004.00000020.00020000.00000000.sdmp, EMfRi659Ir.exe, 00000002.00000002.1613085089.000001B2E873D000.00000004.00000020.00020000.00000000.sdmp, EMfRi659Ir.exe, 00000002.00000002.1612261907.000001B2E7F34000.00000004.00000020.00020000.00000000.sdmp, EMfRi659Ir.exe, 00000002.00000002.1609894510.000001B2E653F000.00000004.00000020.00020000.00000000.sdmp, EMfRi659Ir.exe, 00000002.00000002.1609289526.000001B2E5F37000.00000004.00000020.00020000.00000000.sdmp, EMfRi659Ir.exe, 00000002.00000002.1612430504.000001B2E8139000.00000004.00000020.00020000.00000000.sdmp, EMfRi659Ir.exe, 00000002.00000002.1613802216.000001B2E8F3E000.00000004.00000020.00020000.00000000.sdmp, EMfRi659Ir.exe, 00000002.00000002.1611332417.000001B2E7530000.00000004.00000020.00020000.00000000.sdmp, EMfRi659Ir.exe, 00000002.00000002.1610979280.000001B2E713A000.00000004.00000020.00020000.00000000.sdmp, EMfRi659Ir.exe, 00000002.00000002.1611896797.000001B2E7B3F000.00000004.00000020.00020000.00000000.sdmp, EMfRi659Ir.exe, 00000002.00000002.1614602051.000001B2E9538000.00000004.00000020.00020000.00000000.sdmp, EMfRi659Ir.exe, 00000002.00000002.1614058305.000001B2E913F000.00000004.00000020.00020000.00000000.sdmp, EMfRi659Ir.exe, 00000002.00000002.1611149650.000001B2E733A000.00000004.00000020.00020000.00000000.sdmp, EMfRi659Ir.exe, 00000002.00000002.1613455506.000001B2E8B37000.00000004.00000020.00020000.00000000.sdmp, EMfRi659Ir.exe, 00000002.00000002.1609542464.000001B2E6135000.00000004.00000020.00020000.00000000.sdmp, EMfRi659Ir.exe, 00000002.00000002.1614307148.000001B2E933D000.00000004.00000020.00020000.00000000.sdmp, EMfRi659Ir.exe, 00000002.00000002.1613624050.000001B2E8D35000.00000004.00000020.00020000.00000000.sdmp, EMfRi659Ir.exe, 00000002.00000002.1611721174.000001B2E7934000.00000004.00000020.00020000.00000000.sdmp, EMfRi659Ir.exe, 00000002.00000002.1610075533.000001B2E6737000.00000004.00000020.00020000.00000000.sdmp, EMfRi659Ir.exe, 00000002.00000002.1611509177.000001B2E773B000.00000004.00000020.00020000.00000000.sdmp, EMfRi659Ir.exe, 00000002.00000002.1609709581.000001B2E633F000.00000004.00000020.00020000.00000000.sdmp, EMfRi659Ir.exe, 00000002.00000002.1610261446.000001B2E6932000.00000004.00000020.00020000.00000000.sdmp, EMfRi659Ir.exe, 00000002.00000002.1613284338.000001B2E8930000.00000004.00000020.00020000.00000000.sdmp, EMfRi659Ir.exe, 00000002.00000002.1610441918.000001B2E6B3D000.00000004.00000020.00020000.00000000.sdmp, EMfRi659Ir.exe, 00000002.00000002.1610623307.000001B2E6D31000.00000004.00000020.00020000.00000000.sdmp, EMfRi659Ir.exe, 00000002.00000002.1612073823.000001B2E7D34000.00000004.00000020.00020000.00000000.sdmp, EMfRi659Ir.exe, 00000002.00000002.1612801561.000001B2E853A000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: ntdll.pdbUGP source: EMfRi659Ir.exe, 00000002.00000002.1610782310.000001B2E6F33000.00000004.00000020.00020000.00000000.sdmp, EMfRi659Ir.exe, 00000002.00000002.1612616660.000001B2E8337000.00000004.00000020.00020000.00000000.sdmp, EMfRi659Ir.exe, 00000002.00000002.1613085089.000001B2E873D000.00000004.00000020.00020000.00000000.sdmp, EMfRi659Ir.exe, 00000002.00000002.1612261907.000001B2E7F34000.00000004.00000020.00020000.00000000.sdmp, EMfRi659Ir.exe, 00000002.00000002.1609894510.000001B2E653F000.00000004.00000020.00020000.00000000.sdmp, EMfRi659Ir.exe, 00000002.00000002.1609289526.000001B2E5F37000.00000004.00000020.00020000.00000000.sdmp, EMfRi659Ir.exe, 00000002.00000002.1612430504.000001B2E8139000.00000004.00000020.00020000.00000000.sdmp, EMfRi659Ir.exe, 00000002.00000002.1613802216.000001B2E8F3E000.00000004.00000020.00020000.00000000.sdmp, EMfRi659Ir.exe, 00000002.00000002.1611332417.000001B2E7530000.00000004.00000020.00020000.00000000.sdmp, EMfRi659Ir.exe, 00000002.00000002.1610979280.000001B2E713A000.00000004.00000020.00020000.00000000.sdmp, EMfRi659Ir.exe, 00000002.00000002.1611896797.000001B2E7B3F000.00000004.00000020.00020000.00000000.sdmp, EMfRi659Ir.exe, 00000002.00000002.1614602051.000001B2E9538000.00000004.00000020.00020000.00000000.sdmp, EMfRi659Ir.exe, 00000002.00000002.1614058305.000001B2E913F000.00000004.00000020.00020000.00000000.sdmp, EMfRi659Ir.exe, 00000002.00000002.1611149650.000001B2E733A000.00000004.00000020.00020000.00000000.sdmp, EMfRi659Ir.exe, 00000002.00000002.1613455506.000001B2E8B37000.00000004.00000020.00020000.00000000.sdmp, EMfRi659Ir.exe, 00000002.00000002.1609542464.000001B2E6135000.00000004.00000020.00020000.00000000.sdmp, EMfRi659Ir.exe, 00000002.00000002.1614307148.000001B2E933D000.00000004.00000020.00020000.00000000.sdmp, EMfRi659Ir.exe, 00000002.00000002.1613624050.000001B2E8D35000.00000004.00000020.00020000.00000000.sdmp, EMfRi659Ir.exe, 00000002.00000002.1611721174.000001B2E7934000.00000004.00000020.00020000.00000000.sdmp, EMfRi659Ir.exe, 00000002.00000002.1610075533.000001B2E6737000.00000004.00000020.00020000.00000000.sdmp, EMfRi659Ir.exe, 00000002.00000002.1611509177.000001B2E773B000.00000004.00000020.00020000.00000000.sdmp, EMfRi659Ir.exe, 00000002.00000002.1609709581.000001B2E633F000.00000004.00000020.00020000.00000000.sdmp, EMfRi659Ir.exe, 00000002.00000002.1610261446.000001B2E6932000.00000004.00000020.00020000.00000000.sdmp, EMfRi659Ir.exe, 00000002.00000002.1613284338.000001B2E8930000.00000004.00000020.00020000.00000000.sdmp, EMfRi659Ir.exe, 00000002.00000002.1610441918.000001B2E6B3D000.00000004.00000020.00020000.00000000.sdmp, EMfRi659Ir.exe, 00000002.00000002.1610623307.000001B2E6D31000.00000004.00000020.00020000.00000000.sdmp, EMfRi659Ir.exe, 00000002.00000002.1612073823.000001B2E7D34000.00000004.00000020.00020000.00000000.sdmp, EMfRi659Ir.exe, 00000002.00000002.1612801561.000001B2E853A000.00000004.00000020.00020000.00000000.sdmp

Source: EMfRi659Ir.exe

Static PE information: real checksum: 0x28868a should be: 0x2860d3

Source: EMfRi659Ir.exe

Static PE information: section name: .xdata

Source: C:\Users\user\Desktop\EMfRi659Ir.exe TID: 8172

Thread sleep time: -120000s >= -30000s

Jump to behavior

Source: C:\Users\user\Desktop\EMfRi659Ir.exe

Code function: 2_2_00007FF66CC56900 GetSystemInfo,

2_2_00007FF66CC56900

Source: EMfRi659Ir.exe, 00000002.00000002.1608884799.000001B2E4326000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll#

Source: C:\Users\user\Desktop\EMfRi659Ir.exe	API call chain: ExitProcess graph end node	graph_2-5892
Source: C:\Users\user\Desktop\EMfRi659Ir.exe	API call chain: ExitProcess graph end node	graph_2-4843
Source: C:\Users\user\Desktop\EMfRi659Ir.exe	API call chain: ExitProcess graph end node	graph_2-4997
Source: C:\Users\user\Desktop\EMfRi659Ir.exe	API call chain: ExitProcess graph end node	graph_2-5309

Source: C:\Users\user\Desktop\EMfRi659Ir.exe

Code function: 2_2_00007FF66CB311B5 Sleep,exit,SetUnhandledExceptionFilter,SetUnhandledExceptionFilter,exit,

2_2_00007FF66CB311B5

Source: C:\Users\user\Desktop\EMfRi659Ir.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion InstallDate

Jump to behavior

Source: C:\Users\user\Desktop\EMfRi659Ir.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	Windows Management Instrumentation	1 DLL Side-Loading	1 DLL Side-Loading	1 Virtualization/Sandbox Evasion	OS Credential Dumping	1 Security Software Discovery	Remote Services	1 Archive Collected Data	1 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	Boot or Logon Initialization Scripts	1 Deobfuscate/Decode Files or Information	LSASS Memory	1 Virtualization/Sandbox Evasion	Remote Desktop Protocol	Data from Removable Media	1 Non-Application Layer Protocol	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	1 DLL Side-Loading	Security Account Manager	13 System Information Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	1 Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	1 Obfuscated Files or Information	NTDS	System Network Configuration Discovery	Distributed Component Object Model	Input Capture	Protocol Impersonation	Traffic Duplication	Data Destruction

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label	Link
EMfRi659Ir.exe	58%	ReversingLabs	Win64.Trojan.CrypterX

Dropped Files

⊘No Antivirus matches

Unpacked PE Files

⊘No Antivirus matches

Domains

⊘No Antivirus matches

URLs

Source	Detection	Scanner	Label
https://tataragirld.site/	0%	Avira URL Cloud	safe
https://tataragirld.site:443vM	0%	Avira URL Cloud	safe
https://tataragirld.site/FE-L.	0%	Avira URL Cloud	safe
https://tataragirld.site/VE=L	0%	Avira URL Cloud	safe
https://tataragirld.site/2E	0%	Avira URL Cloud	safe
https://tataragirld.site/JE	0%	Avira URL Cloud	safe
https://tataragirld.site:443:	0%	Avira URL Cloud	safe
https://tataragirld.site/sagesse_renaldo00.html)	0%	Avira URL Cloud	safe
https://tataragirld.site/sagesse_renaldo00.htmlM	0%	Avira URL Cloud	safe
https://tataragirld.site/#	0%	Avira URL Cloud	safe
https://tataragirld.site:443IN	0%	Avira URL Cloud	safe
https://tataragirld.site/sagesse_renaldo00.html?tdfgozllgbxxyj=yhIP6D%2BNM98rEr1pqaSoG1KWw5J7mExVtIz	0%	Avira URL Cloud	safe
https://tataragirld.site:443d	0%	Avira URL Cloud	safe
https://tataragirld.site/&E	0%	Avira URL Cloud	safe
https://tataragirld.site/sagesse_renaldo00.htmle	0%	Avira URL Cloud	safe
https://tataragirld.site/sagesse_renaldo00.html	0%	Avira URL Cloud	safe
https://tataragirld.site:443	0%	Avira URL Cloud	safe
https://tataragirld.site/ZE1L	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
s-part-0017.t-0009.t-msedge.net	13.107.246.45	true	false		high
tataragirld.site	unknown	unknown	false		unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://tataragirld.site:443vM	EMfRi659Ir.exe, 00000002.00000003.1591178752.000001B2E43A7000.00000004.00000020.00020000.00000000.sdmp, EMfRi659Ir.exe, 00000002.00000003.1592400745.000001B2E43A7000.00000004.00000020.00020000.00000000.sdmp, EMfRi659Ir.exe, 00000002.00000003.1592544685.000001B2E43A7000.00000004.00000020.00020000.00000000.sdmp, EMfRi659Ir.exe, 00000002.00000003.1594175635.000001B2E43A7000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://tataragirld.site/	EMfRi659Ir.exe, 00000002.00000003.1601331341.000001B2E4399000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://tataragirld.site/sagesse_renaldo00.html)	EMfRi659Ir.exe, 00000002.00000002.1609151257.000001B2E4430000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://tataragirld.site:443:	EMfRi659Ir.exe, 00000002.00000003.1607828980.000001B2E43A7000.00000004.00000020.00020000.00000000.sdmp, EMfRi659Ir.exe, 00000002.00000003.1607703476.000001B2E43A7000.00000004.00000020.00020000.00000000.sdmp, EMfRi659Ir.exe, 00000002.00000002.1609070610.000001B2E43A7000.00000004.00000020.00020000.00000000.sdmp, EMfRi659Ir.exe, 00000002.00000003.1606336337.000001B2E43A7000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://tataragirld.site/VE=L	EMfRi659Ir.exe, 00000002.00000003.1592400745.000001B2E439A000.00000004.00000020.00020000.00000000.sdmp, EMfRi659Ir.exe, 00000002.00000003.1592544685.000001B2E4399000.00000004.00000020.00020000.00000000.sdmp, EMfRi659Ir.exe, 00000002.00000003.1591178752.000001B2E4399000.00000004.00000020.00020000.00000000.sdmp, EMfRi659Ir.exe, 00000002.00000003.1594175635.000001B2E439A000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://tataragirld.site/sagesse_renaldo00.htmlM	EMfRi659Ir.exe, 00000002.00000002.1609151257.000001B2E4430000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://tataragirld.site/2E	EMfRi659Ir.exe, 00000002.00000002.1609070610.000001B2E439B000.00000004.00000020.00020000.00000000.sdmp, EMfRi659Ir.exe, 00000002.00000003.1607828980.000001B2E439B000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://tataragirld.site/#	EMfRi659Ir.exe, 00000002.00000002.1608884799.000001B2E4357000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://tataragirld.site/JE	EMfRi659Ir.exe, 00000002.00000003.1604870904.000001B2E4399000.00000004.00000020.00020000.00000000.sdmp, EMfRi659Ir.exe, 00000002.00000003.1606168907.000001B2E439A000.00000004.00000020.00020000.00000000.sdmp, EMfRi659Ir.exe, 00000002.00000003.1592544685.000001B2E4399000.00000004.00000020.00020000.00000000.sdmp, EMfRi659Ir.exe, 00000002.00000003.1606336337.000001B2E4399000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://tataragirld.site/jE	EMfRi659Ir.exe, 00000002.00000003.1594635739.000001B2E4399000.00000004.00000020.00020000.00000000.sdmp, EMfRi659Ir.exe, 00000002.00000003.1589707781.000001B2E4399000.00000004.00000020.00020000.00000000.sdmp, EMfRi659Ir.exe, 00000002.00000003.1591034789.000001B2E439A000.00000004.00000020.00020000.00000000.sdmp, EMfRi659Ir.exe, 00000002.00000003.1592400745.000001B2E439A000.00000004.00000020.00020000.00000000.sdmp, EMfRi659Ir.exe, 00000002.00000003.1592544685.000001B2E4399000.00000004.00000020.00020000.00000000.sdmp, EMfRi659Ir.exe, 00000002.00000003.1591178752.000001B2E4399000.00000004.00000020.00020000.00000000.sdmp, EMfRi659Ir.exe, 00000002.00000003.1594175635.000001B2E439A000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://tataragirld.site/FE-L.	EMfRi659Ir.exe, 00000002.00000003.1604870904.000001B2E4399000.00000004.00000020.00020000.00000000.sdmp, EMfRi659Ir.exe, 00000002.00000003.1606168907.000001B2E439A000.00000004.00000020.00020000.00000000.sdmp, EMfRi659Ir.exe, 00000002.00000003.1592400745.000001B2E439A000.00000004.00000020.00020000.00000000.sdmp, EMfRi659Ir.exe, 00000002.00000003.1591178752.000001B2E4399000.00000004.00000020.00020000.00000000.sdmp, EMfRi659Ir.exe, 00000002.00000003.1606336337.000001B2E4399000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://tataragirld.site:443IN	EMfRi659Ir.exe, 00000002.00000003.1594635739.000001B2E43A7000.00000004.00000020.00020000.00000000.sdmp, EMfRi659Ir.exe, 00000002.00000003.1592544685.000001B2E43A7000.00000004.00000020.00020000.00000000.sdmp, EMfRi659Ir.exe, 00000002.00000003.1601331341.000001B2E43A7000.00000004.00000020.00020000.00000000.sdmp, EMfRi659Ir.exe, 00000002.00000003.1600479017.000001B2E43A7000.00000004.00000020.00020000.00000000.sdmp, EMfRi659Ir.exe, 00000002.00000003.1594175635.000001B2E43A7000.00000004.00000020.00020000.00000000.sdmp, EMfRi659Ir.exe, 00000002.00000003.1604753376.000001B2E43A7000.00000004.00000020.00020000.00000000.sdmp, EMfRi659Ir.exe, 00000002.00000003.1603226104.000001B2E43A7000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://tataragirld.site:443	EMfRi659Ir.exe, 00000002.00000003.1607828980.000001B2E43A7000.00000004.00000020.00020000.00000000.sdmp, EMfRi659Ir.exe, 00000002.00000003.1606168907.000001B2E43A7000.00000004.00000020.00020000.00000000.sdmp, EMfRi659Ir.exe, 00000002.00000003.1604870904.000001B2E43A7000.00000004.00000020.00020000.00000000.sdmp, EMfRi659Ir.exe, 00000002.00000003.1607703476.000001B2E43A7000.00000004.00000020.00020000.00000000.sdmp, EMfRi659Ir.exe, 00000002.00000003.1594635739.000001B2E43A7000.00000004.00000020.00020000.00000000.sdmp, EMfRi659Ir.exe, 00000002.00000003.1601331341.000001B2E43A7000.00000004.00000020.00020000.00000000.sdmp, EMfRi659Ir.exe, 00000002.00000003.1600479017.000001B2E43A7000.00000004.00000020.00020000.00000000.sdmp, EMfRi659Ir.exe, 00000002.00000003.1604753376.000001B2E43A7000.00000004.00000020.00020000.00000000.sdmp, EMfRi659Ir.exe, 00000002.00000003.1603226104.000001B2E43A7000.00000004.00000020.00020000.00000000.sdmp, EMfRi659Ir.exe, 00000002.00000002.1609070610.000001B2E43A7000.00000004.00000020.00020000.00000000.sdmp, EMfRi659Ir.exe, 00000002.00000003.1606336337.000001B2E43A7000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://tataragirld.site/sagesse_renaldo00.html?tdfgozllgbxxyj=yhIP6D%2BNM98rEr1pqaSoG1KWw5J7mExVtIz	EMfRi659Ir.exe, 00000002.00000003.1591178752.000001B2E4376000.00000004.00000020.00020000.00000000.sdmp, EMfRi659Ir.exe, 00000002.00000003.1607828980.000001B2E4376000.00000004.00000020.00020000.00000000.sdmp, EMfRi659Ir.exe, 00000002.00000003.1607703476.000001B2E43A7000.00000004.00000020.00020000.00000000.sdmp, EMfRi659Ir.exe, 00000002.00000002.1608884799.000001B2E4376000.00000004.00000020.00020000.00000000.sdmp, EMfRi659Ir.exe, 00000002.00000003.1594635739.000001B2E4399000.00000004.00000020.00020000.00000000.sdmp, EMfRi659Ir.exe, 00000002.00000003.1607828980.000001B2E439B000.00000004.00000020.00020000.00000000.sdmp, EMfRi659Ir.exe, 00000002.00000003.1587932850.000001B2E439F000.00000004.00000020.00020000.00000000.sdmp, EMfRi659Ir.exe, 00000002.00000003.1592544685.000001B2E4376000.00000004.00000020.00020000.00000000.sdmp, EMfRi659Ir.exe, 00000002.00000003.1592544685.000001B2E43A7000.00000004.00000020.00020000.00000000.sdmp, EMfRi659Ir.exe, 00000002.00000003.1594175635.000001B2E43A7000.00000004.00000020.00020000.00000000.sdmp, EMfRi659Ir.exe, 00000002.00000003.1594635739.000001B2E4376000.00000004.00000020.00020000.00000000.sdmp, EMfRi659Ir.exe, 00000002.00000003.1601331341.000001B2E4376000.00000004.00000020.00020000.00000000.sdmp, EMfRi659Ir.exe, 00000002.00000003.1606336337.000001B2E43A7000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://tataragirld.site/sagesse_renaldo00.html	EMfRi659Ir.exe, 00000002.00000002.1609151257.000001B2E4430000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://tataragirld.site/&E	EMfRi659Ir.exe, 00000002.00000003.1604753376.000001B2E439A000.00000004.00000020.00020000.00000000.sdmp, EMfRi659Ir.exe, 00000002.00000003.1594635739.000001B2E4399000.00000004.00000020.00020000.00000000.sdmp, EMfRi659Ir.exe, 00000002.00000003.1603226104.000001B2E439F000.00000004.00000020.00020000.00000000.sdmp, EMfRi659Ir.exe, 00000002.00000003.1600479017.000001B2E439A000.00000004.00000020.00020000.00000000.sdmp, EMfRi659Ir.exe, 00000002.00000003.1601331341.000001B2E4399000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://tataragirld.site/sagesse_renaldo00.htmle	EMfRi659Ir.exe, 00000002.00000002.1609151257.000001B2E4430000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://tataragirld.site/ZE1L	EMfRi659Ir.exe, 00000002.00000003.1589707781.000001B2E4399000.00000004.00000020.00020000.00000000.sdmp, EMfRi659Ir.exe, 00000002.00000003.1591034789.000001B2E439A000.00000004.00000020.00020000.00000000.sdmp, EMfRi659Ir.exe, 00000002.00000003.1591178752.000001B2E4399000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://tataragirld.site:443d	EMfRi659Ir.exe, 00000002.00000003.1607828980.000001B2E43A7000.00000004.00000020.00020000.00000000.sdmp, EMfRi659Ir.exe, 00000002.00000003.1606168907.000001B2E43A7000.00000004.00000020.00020000.00000000.sdmp, EMfRi659Ir.exe, 00000002.00000003.1604870904.000001B2E43A7000.00000004.00000020.00020000.00000000.sdmp, EMfRi659Ir.exe, 00000002.00000003.1607703476.000001B2E43A7000.00000004.00000020.00020000.00000000.sdmp, EMfRi659Ir.exe, 00000002.00000003.1604753376.000001B2E43A7000.00000004.00000020.00020000.00000000.sdmp, EMfRi659Ir.exe, 00000002.00000003.1603226104.000001B2E43A7000.00000004.00000020.00020000.00000000.sdmp, EMfRi659Ir.exe, 00000002.00000002.1609070610.000001B2E43A7000.00000004.00000020.00020000.00000000.sdmp, EMfRi659Ir.exe, 00000002.00000003.1606336337.000001B2E43A7000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown

World Map of Contacted IPs

⊘No contacted IP infos

General Information

Joe Sandbox version:	42.0.0 Malachite
Analysis ID:	1586713
Start date and time:	2025-01-09 14:41:08 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 3m 50s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	5
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	EMfRi659Ir.exe renamed because original name is a hash value
Original Sample Name:	cd9660e42868082ea20472ecd6a22ae9573053af7c1de8daaa5f4f75c99c41b6.exe
Detection:	MAL
Classification:	mal52.winEXE@1/0@1/0
EGA Information:	Successful, ratio: 100%
HCA Information:	Failed
Cookbook Comments:	Found application associated with file extension: .exe Stop behavior analysis, all processes terminated

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, dllhost.exe, SIHClient.exe, conhost.exe
Excluded IPs from analysis (whitelisted): 13.107.246.45, 20.12.23.50
Excluded domains from analysis (whitelisted): slscr.update.microsoft.com, otelrules.azureedge.net, otelrules.afd.azureedge.net, azureedge-t-prod.trafficmanager.net, fe3cr.delivery.mp.microsoft.com
Not all processes where analyzed, report is missing behavior information
Report size getting too big, too many NtQueryValueKey calls found.
VT rate limit hit for: EMfRi659Ir.exe

Simulations

Behavior and APIs

Time	Type	Description
08:42:20	API Interceptor	20x Sleep call for process: EMfRi659Ir.exe modified

Joe Sandbox View / Context

IPs

⊘No context

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
s-part-0017.t-0009.t-msedge.net	https://laserglow-technologies-industrial-48815730.hubspotpagebuilder.com/laserglow	Get hash	malicious	HTMLPhisher	Browse	13.107.246.45
	colleague[1].htm	Get hash	malicious	Unknown	Browse	13.107.246.45
	bc7EKCf.exe	Get hash	malicious	StormKitty	Browse	13.107.246.45
	https://mo.iecxtug.ru/eoQpd/	Get hash	malicious	Unknown	Browse	13.107.246.45
	1In8uYbvZJ.ps1	Get hash	malicious	Unknown	Browse	13.107.246.45
	fuk7RfLrD3.exe	Get hash	malicious	LummaC	Browse	13.107.246.45
	Subscription_Renewal_Invoice_2025_FGHDCS.html	Get hash	malicious	HTMLPhisher	Browse	13.107.246.45
	GT98765009064.xlsx	Get hash	malicious	Unknown	Browse	13.107.246.45
	https://lap.gnoqwwhpwe.ru/3aeK/#Dmestevao@iif.com	Get hash	malicious	Unknown	Browse	13.107.246.45
	Condenast eCHECK- Payment Advice.html	Get hash	malicious	Unknown	Browse	13.107.246.45

ASNs

⊘No context

JA3 Fingerprints

⊘No context

Dropped Files

⊘No context

Created / dropped Files

⊘No created / dropped files found

Static File Info

General

File type:	PE32+ executable (GUI) x86-64 (stripped to external PDB), for MS Windows
Entropy (8bit):	6.713053675074008
TrID:	Win64 Executable (generic) (12005/4) 74.95% Generic Win/DOS Executable (2004/3) 12.51% DOS Executable Generic (2002/1) 12.50% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.04%
File name:	EMfRi659Ir.exe
File size:	2'636'824 bytes
MD5:	1d193430d800a1c0e6864567543c47bb
SHA1:	ab5c3eb3dab9f89a2f8876a9e3ca0a75384f4eab
SHA256:	cd9660e42868082ea20472ecd6a22ae9573053af7c1de8daaa5f4f75c99c41b6
SHA512:	2ae1b71a1728b5b7d80c2542b111bb818dfe7b766300a703ab4cea021f48c5110082d220b02caa549191910f78366ef331f1627d130beb182d1ebec9c3c71c30
SSDEEP:	49152:rYoQhcn8+iezb8XIw13ItW4vsmoNvOgbesU43ZkgFi0/fkhrC+11SqKDZ8gUH9jL:Pz+y4VC68YwiKN
TLSH:	8CC54A2B61A9609AE3E7C07CE5065792FC3176485E39A3B724B68392373091C9B7D373
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..d.....vg.................."..8(..J..W..........@..............................2.......(...`... ............................

File Icon


Icon Hash:	00928e8e8686b000

Static PE Info

General

Entrypoint:	0x140001157
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x140000000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, LARGE_ADDRESS_AWARE, DEBUG_STRIPPED
DLL Characteristics:	HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT
Time Stamp:	0x6776E7B8 [Thu Jan 2 19:23:36 2025 UTC]
TLS Callbacks:	0x4022d7a0, 0x1, 0x4022d860, 0x1
CLR (.Net) Version:
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:	9ce1e3b170c9365da5a16f5bce0983b0

Entrypoint Preview

Instruction
push ebp
dec eax
mov ebp, esp
dec eax
sub esp, 30h
mov dword ptr [ebp-04h], 000000FFh
dec eax
mov eax, dword ptr [00276003h]
mov dword ptr [eax], 00000001h
call 00007FAC6CB74A42h
mov dword ptr [ebp-04h], eax
nop
nop
mov eax, dword ptr [ebp-04h]
dec eax
add esp, 30h
pop ebp
ret
push ebp
dec eax
mov ebp, esp
dec eax
sub esp, 30h
mov dword ptr [ebp-04h], 000000FFh
dec eax
mov eax, dword ptr [00275FD4h]
mov dword ptr [eax], 00000000h
call 00007FAC6CB74A13h
mov dword ptr [ebp-04h], eax
nop
nop
mov eax, dword ptr [ebp-04h]
dec eax
add esp, 30h
pop ebp
ret
push ebp
dec eax
mov ebp, esp
dec eax
sub esp, 70h
dec eax
mov dword ptr [ebp-10h], 00000000h
mov dword ptr [ebp-1Ch], 00000030h
mov eax, dword ptr [ebp-1Ch]
dec eax
mov eax, dword ptr [eax]
dec eax
mov dword ptr [ebp-28h], eax
dec eax
mov eax, dword ptr [ebp-28h]
dec eax
mov eax, dword ptr [eax+08h]
dec eax
mov dword ptr [ebp-18h], eax
mov dword ptr [ebp-04h], 00000000h
jmp 00007FAC6CB74A23h
dec eax
mov eax, dword ptr [ebp-10h]
dec eax
cmp eax, dword ptr [ebp-18h]
jne 00007FAC6CB74A0Bh
mov dword ptr [ebp-04h], 00000001h
jmp 00007FAC6CB74A47h
mov ecx, 000003E8h
dec eax
mov eax, dword ptr [00319FB5h]
call eax
dec eax
mov eax, dword ptr [00275F7Ch]
dec eax
mov dword ptr [ebp-30h], eax
dec eax
mov eax, dword ptr [ebp-18h]
dec eax
mov dword ptr [ebp+00h], eax

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x31b000	0x4d4	.idata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x31e000	0x178	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x278000	0x756c	.pdata
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x31f000	0x3fc	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x276de0	0x28	.rdata
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x31b170	0x108	.idata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x22d898	0x22da00	1ba566df3d7ba406e905f858dfca9c73	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_CODE, IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.data	0x22f000	0xe990	0xea00	ed9ec624a52a1450be4e17c37ad532c7	False	0.7278812767094017	data	7.907353215783904	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rdata	0x23e000	0x39370	0x39400	62e6150683e0018b3420b1f9a04dc6f1	False	0.8832346820414847	data	7.8534439409010455	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.pdata	0x278000	0x756c	0x7600	2d192b22115fa929b7a7d51099770ce8	False	0.5051972987288136	data	6.0788567314168125	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.xdata	0x280000	0x58d8	0x5a00	f8eeb088f7b72df899cf78bcc0bd2ddd	False	0.16475694444444444	, SYS \003\001P	3.451396623499527	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.bss	0x286000	0x94860	0x0	d41d8cd98f00b204e9800998ecf8427e	False	0	empty	0.0	IMAGE_SCN_CNT_UNINITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.idata	0x31b000	0x4d4	0x600	a2a509be5075d1e02c949bb04e762558	False	0.3313802083333333	data	3.609653204427918	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.CRT	0x31c000	0x30	0x200	c27e7a3294b1032d0e919448da6c428c	False	0.05078125	data	0.19196315608732903	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.tls	0x31d000	0x10	0x200	bf619eac0cdf3f68d496ea9344137e8b	False	0.02734375	data	0.0	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0x31e000	0x178	0x200	e8d54dd241051510dbe96416ab7c3e63	False	0.400390625	data	2.0943594687221996	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0x31f000	0x3fc	0x400	16fc8c1db9ec8fce8bbe38c2129b7cf8	False	0.7080078125	data	5.253227785857478	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_VERSION	0x31e058	0x11c	SVr3 curses screen image, little-endian	English	United States	0.5985915492957746

Imports

DLL	Import
ADVAPI32.dll	RegCloseKey, RegDeleteKeyW, RegEnumKeyExA, RegQueryValueExA
KERNEL32.dll	GetOEMCP, GetProcAddress, InitializeCriticalSection, LoadLibraryA, SetUnhandledExceptionFilter, Sleep, TlsAlloc, TlsGetValue, TlsSetValue, VirtualFree, VirtualProtect, VirtualProtectEx, VirtualQuery, VirtualUnlock
msvcrt.dll	__C_specific_handler, atexit, calloc, exit, free, malloc, memcpy, memset, realloc, signal
USER32.dll	GetKeyNameTextW

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	United States

Network Behavior

Network Port Distribution

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 9, 2025 14:42:26.420454979 CET	56417	53	192.168.2.9	1.1.1.1
Jan 9, 2025 14:42:26.429110050 CET	53	56417	1.1.1.1	192.168.2.9

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Jan 9, 2025 14:42:26.420454979 CET	192.168.2.9	1.1.1.1	0xbe38	Standard query (0)	tataragirld.site	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Jan 9, 2025 14:41:57.782351017 CET	1.1.1.1	192.168.2.9	0x225e	No error (0)	shed.dual-low.s-part-0017.t-0009.t-msedge.net	s-part-0017.t-0009.t-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Jan 9, 2025 14:41:57.782351017 CET	1.1.1.1	192.168.2.9	0x225e	No error (0)	s-part-0017.t-0009.t-msedge.net		13.107.246.45	A (IP address)	IN (0x0001)	false
Jan 9, 2025 14:42:26.429110050 CET	1.1.1.1	192.168.2.9	0xbe38	Name error (3)	tataragirld.site	none	none	A (IP address)	IN (0x0001)	false

Statistics

CPU Usage

Click to jump to process

Memory Usage

Click to jump to process

High Level Behavior Distribution

Click to dive into process behavior distribution

System Behavior

Analysis Process: EMfRi659Ir.exePID: 7992, Parent PID: 3504

General

Target ID:	2
Start time:	08:42:18
Start date:	09/01/2025
Path:	C:\Users\user\Desktop\EMfRi659Ir.exe
Wow64 process (32bit):	false
Commandline:	"C:\Users\user\Desktop\EMfRi659Ir.exe"
Imagebase:	0x7ff66cb30000
File size:	2'636'824 bytes
MD5 hash:	1D193430D800A1C0E6864567543C47BB
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Chronological Activities

Disassembly

Reset < >

Analysis Process: EMfRi659Ir.exePID: 7992, Parent PID: 3504COMMON

Execution Graph

Execution Coverage:	10.8%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	43.6%
Total number of Nodes:	1533
Total number of Limit Nodes:	40

Executed Functions

Function 00007FF66CB311B5 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 97
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

exit.MSVCRT ref: 00007FF66CB31257
SetUnhandledExceptionFilter.KERNELBASE ref: 00007FF66CB312F6
exit.MSVCRT ref: 00007FF66CB31333

Strings

0, xrefs: 00007FF66CB311C5

Memory Dump Source

Source File: 00000002.00000002.1614887424.00007FF66CB31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF66CB30000, based on PE: true

Associated: 00000002.00000002.1614859264.00007FF66CB30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1615114616.00007FF66CD5F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1615136598.00007FF66CD6E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1615174624.00007FF66CDB6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1615174624.00007FF66CDB9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1615174624.00007FF66CE0F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1615174624.00007FF66CE4A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1615313210.00007FF66CE4E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff66cb30000_EMfRi659Ir.jbxd

Similarity

API ID: exit$ExceptionFilterUnhandled
String ID: 0
API String ID: 4257813844-4108050209
Opcode ID: c26cb4941d79056e3d650b2f5079423db7b870c03b046d51c95775f303d68fe4
Instruction ID: 62c579d3c95df153070379439c5a90272f00ec1bea3b9972cffcd88f6942275b
Opcode Fuzzy Hash: c26cb4941d79056e3d650b2f5079423db7b870c03b046d51c95775f303d68fe4
Instruction Fuzzy Hash: C2419F76B08E15CAFB008B96E88036933B4BB88B85F544536DE0D9B7A8DF3CE841C750

Function 00007FF66CB3F25B Relevance: 6.8, APIs: 1, Strings: 3, Instructions: 828
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

rIJd, xrefs: 00007FF66CB3F9C8
ntK, xrefs: 00007FF66CB3F2F2
Q\J, xrefs: 00007FF66CB3F96F

Memory Dump Source

Source File: 00000002.00000002.1614887424.00007FF66CB31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF66CB30000, based on PE: true

Associated: 00000002.00000002.1614859264.00007FF66CB30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1615114616.00007FF66CD5F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1615136598.00007FF66CD6E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1615174624.00007FF66CDB6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1615174624.00007FF66CDB9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1615174624.00007FF66CE0F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1615174624.00007FF66CE4A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1615313210.00007FF66CE4E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff66cb30000_EMfRi659Ir.jbxd

Similarity

API ID:
String ID: Q\J$ntK$rIJd
API String ID: 0-1247198646
Opcode ID: ba7b09d48b7f052b93f6b0604cf97d1fa194b8dcd91e3799e51ed298ccf3bd4c
Instruction ID: 5c1adea7e62025ed00afe09b5f4788c43658059f613ee212606b964b7d4ffbf2
Opcode Fuzzy Hash: ba7b09d48b7f052b93f6b0604cf97d1fa194b8dcd91e3799e51ed298ccf3bd4c
Instruction Fuzzy Hash: A7624C73B28E9182EB548679AC6177B26629B96BB1F109335EE7ECB7D4CE2CD4004700

Function 00007FF66CB3D180 Relevance: 3.9, Strings: 3, Instructions: 153
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

wg4R, xrefs: 00007FF66CB3D1C3
OJ'J, xrefs: 00007FF66CB3D1DA
bD=6, xrefs: 00007FF66CB3D2B4

Memory Dump Source

Source File: 00000002.00000002.1614887424.00007FF66CB31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF66CB30000, based on PE: true

Associated: 00000002.00000002.1614859264.00007FF66CB30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1615114616.00007FF66CD5F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1615136598.00007FF66CD6E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1615174624.00007FF66CDB6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1615174624.00007FF66CDB9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1615174624.00007FF66CE0F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1615174624.00007FF66CE4A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1615313210.00007FF66CE4E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff66cb30000_EMfRi659Ir.jbxd

Similarity

API ID:
String ID: OJ'J$bD=6$wg4R
API String ID: 0-706172807
Opcode ID: 8fd08e7703be999667e6d8d69103e5b4a2c8da8890bc35cbf5bd9395cfa3eec8
Instruction ID: 028c1de393754cd7d1ae4cb841189f9bd67d00e687dc8468946f03b0a45e5a11
Opcode Fuzzy Hash: 8fd08e7703be999667e6d8d69103e5b4a2c8da8890bc35cbf5bd9395cfa3eec8
Instruction Fuzzy Hash: B1512173F24E218AE7088B75E8416AD3BB2A789794F108639DD0DCBB98DE3CD9518700

Function 00007FF66CB3BB10 Relevance: 2.0, Strings: 1, Instructions: 712
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

#y, xrefs: 00007FF66CB3C575

Memory Dump Source

Source File: 00000002.00000002.1614887424.00007FF66CB31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF66CB30000, based on PE: true

Associated: 00000002.00000002.1614859264.00007FF66CB30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1615114616.00007FF66CD5F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1615136598.00007FF66CD6E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1615174624.00007FF66CDB6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1615174624.00007FF66CDB9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1615174624.00007FF66CE0F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1615174624.00007FF66CE4A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1615313210.00007FF66CE4E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff66cb30000_EMfRi659Ir.jbxd

Similarity

API ID:
String ID: #y
API String ID: 0-2081685464
Opcode ID: 080f371ad321deac609507d95735d04dede2c86ba12fae4106e2652649aad5ae
Instruction ID: 121450ac25529fe413c2807c069204172c308cdd6d3d50215222a58678f6b040
Opcode Fuzzy Hash: 080f371ad321deac609507d95735d04dede2c86ba12fae4106e2652649aad5ae
Instruction Fuzzy Hash: AE424972F24E61C6EB189BF598622B926A2AB5A7B4F109735DD3EDB7C4DE2CD4014300

Function 00007FF66CB34520 Relevance: 1.6, APIs: 1, Instructions: 139
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00007FF66CB342A0: VirtualAlloc.KERNEL32 ref: 00007FF66CB342BC

CreateThread.KERNELBASE ref: 00007FF66CB34696

Memory Dump Source

Source File: 00000002.00000002.1614887424.00007FF66CB31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF66CB30000, based on PE: true

Associated: 00000002.00000002.1614859264.00007FF66CB30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1615114616.00007FF66CD5F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1615136598.00007FF66CD6E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1615174624.00007FF66CDB6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1615174624.00007FF66CDB9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1615174624.00007FF66CE0F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1615174624.00007FF66CE4A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1615313210.00007FF66CE4E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff66cb30000_EMfRi659Ir.jbxd

Similarity

API ID: AllocCreateThreadVirtual
String ID:
API String ID: 3065189322-0
Opcode ID: ffc7e9ee982f55ec27b9eaa0be90bb83cf620b8f2774b364607a2151c3cf6ace
Instruction ID: e8f37a4ffec0923f795e2551c148400a324c7e7e397bf5b56f22916475fbc531
Opcode Fuzzy Hash: ffc7e9ee982f55ec27b9eaa0be90bb83cf620b8f2774b364607a2151c3cf6ace
Instruction Fuzzy Hash: 5751C332F34E60C6F7149B7AA8002A937B1A799765F508335EE5C8B7E4DE389952CB40

Function 00007FF66CB414B0 Relevance: 1.6, APIs: 1, Instructions: 80
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryA.KERNEL32 ref: 00007FF66CB415BE

Memory Dump Source

Source File: 00000002.00000002.1614887424.00007FF66CB31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF66CB30000, based on PE: true

Associated: 00000002.00000002.1614859264.00007FF66CB30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1615114616.00007FF66CD5F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1615136598.00007FF66CD6E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1615174624.00007FF66CDB6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1615174624.00007FF66CDB9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1615174624.00007FF66CE0F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1615174624.00007FF66CE4A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1615313210.00007FF66CE4E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff66cb30000_EMfRi659Ir.jbxd

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: 7b34814c95ea2a1001dec40d559c8fd0fdba46b940dc2eb4ee18432ce8495e28
Instruction ID: 22a7d4c91de4f2c61b1f6a978cd6ff0c0c3135b83abeffc2d022e1f7b01f8ce7
Opcode Fuzzy Hash: 7b34814c95ea2a1001dec40d559c8fd0fdba46b940dc2eb4ee18432ce8495e28
Instruction Fuzzy Hash: EA31D336B2895482E75CCB3A9C5132A2662EB85779B54D339E92FCB7E4CE3CD8118604

Function 00007FF66CC56900 Relevance: 1.6, APIs: 1, Instructions: 79
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00007FF66CB37220: TlsGetValue.KERNEL32 ref: 00007FF66CB372C2

GetSystemInfo.KERNELBASE ref: 00007FF66CC56A2A

Memory Dump Source

Source File: 00000002.00000002.1614887424.00007FF66CB31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF66CB30000, based on PE: true

Associated: 00000002.00000002.1614859264.00007FF66CB30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1615114616.00007FF66CD5F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1615136598.00007FF66CD6E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1615174624.00007FF66CDB6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1615174624.00007FF66CDB9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1615174624.00007FF66CE0F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1615174624.00007FF66CE4A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1615313210.00007FF66CE4E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff66cb30000_EMfRi659Ir.jbxd

Similarity

API ID: InfoSystemValue
String ID:
API String ID: 2777205056-0
Opcode ID: 28c73d186913443784a933223551e0e4e22ea77cf5c7286c60e2fd007a82f092
Instruction ID: fd9e5551d24b5c0c0eafb0a18b78d7d2ff9b7b59887f21722f0c607ef0569594
Opcode Fuzzy Hash: 28c73d186913443784a933223551e0e4e22ea77cf5c7286c60e2fd007a82f092
Instruction Fuzzy Hash: A631EF77F14E05CBE7189BB6D8922B837B1AB98745F544934EA1DCB790DE3CE451C600

Function 00007FF66CB3B370 Relevance: 1.5, APIs: 1, Instructions: 240
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

malloc.MSVCRT ref: 00007FF66CB3B38D

Memory Dump Source

Source File: 00000002.00000002.1614887424.00007FF66CB31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF66CB30000, based on PE: true

Associated: 00000002.00000002.1614859264.00007FF66CB30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1615114616.00007FF66CD5F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1615136598.00007FF66CD6E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1615174624.00007FF66CDB6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1615174624.00007FF66CDB9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1615174624.00007FF66CE0F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1615174624.00007FF66CE4A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1615313210.00007FF66CE4E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff66cb30000_EMfRi659Ir.jbxd

Similarity

API ID: malloc
String ID:
API String ID: 2803490479-0
Opcode ID: 3e7d9f36a774d7a0b3bb9895df953a5034dc6cfc59e34ab7391dc830dadec3ac
Instruction ID: 5db77ec7c3625f5e1a9d55f6871afc81cc957e0d7772a894def608b7cb82ecd5
Opcode Fuzzy Hash: 3e7d9f36a774d7a0b3bb9895df953a5034dc6cfc59e34ab7391dc830dadec3ac
Instruction Fuzzy Hash: 5691B872B28E5183EE08CB79982527A66A2EB567F1F10D335E93ECF7D9DE2CD4014600

Function 00007FF66CB3DE10 Relevance: .2, Instructions: 216COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1614887424.00007FF66CB31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF66CB30000, based on PE: true

Associated: 00000002.00000002.1614859264.00007FF66CB30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1615114616.00007FF66CD5F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1615136598.00007FF66CD6E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1615174624.00007FF66CDB6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1615174624.00007FF66CDB9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1615174624.00007FF66CE0F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1615174624.00007FF66CE4A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1615313210.00007FF66CE4E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff66cb30000_EMfRi659Ir.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fe132d8c033d72b12ea5bd384c519c182ad81d1f41d80d678c5c72c006261116
Instruction ID: 617f944b618a3933fa965dfd80cab155ff523610cd8b54fbccdb202c5236b14c
Opcode Fuzzy Hash: fe132d8c033d72b12ea5bd384c519c182ad81d1f41d80d678c5c72c006261116
Instruction Fuzzy Hash: 7A811A72729F9182DE148B79E461B6A6661E796BF0F109735EE7E8BBE4CE3CD4004700

Function 00007FF66CB3B730 Relevance: .2, Instructions: 202COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1614887424.00007FF66CB31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF66CB30000, based on PE: true

Associated: 00000002.00000002.1614859264.00007FF66CB30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1615114616.00007FF66CD5F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1615136598.00007FF66CD6E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1615174624.00007FF66CDB6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1615174624.00007FF66CDB9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1615174624.00007FF66CE0F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1615174624.00007FF66CE4A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1615313210.00007FF66CE4E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff66cb30000_EMfRi659Ir.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cb1315712ec4c63141c5c939213ffc1db5e1c3ec248deb00c095c9c8e87fe874
Instruction ID: 06ac0ecd55a96f862924c7b7e4fe06e0cc4f27f93a0167886cc824205164a37e
Opcode Fuzzy Hash: cb1315712ec4c63141c5c939213ffc1db5e1c3ec248deb00c095c9c8e87fe874
Instruction Fuzzy Hash: 9671F572F24E11C6FB1C87B59C5227E2672AB5A765F248239DD2EDF7D8DE2CD4018200

Function 00007FF66CB3D3BA Relevance: .2, Instructions: 174COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1614887424.00007FF66CB31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF66CB30000, based on PE: true

Associated: 00000002.00000002.1614859264.00007FF66CB30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1615114616.00007FF66CD5F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1615136598.00007FF66CD6E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1615174624.00007FF66CDB6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1615174624.00007FF66CDB9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1615174624.00007FF66CE0F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1615174624.00007FF66CE4A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1615313210.00007FF66CE4E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff66cb30000_EMfRi659Ir.jbxd

Similarity

API ID: calloc
String ID:
API String ID: 2635317215-0
Opcode ID: 7133b0cdfd98c493178963adb3935cf11b4d604c3f72702c25bd8b5f427eb67d
Instruction ID: faf8b6660da320c58b0b6923bd6966954ebb94e68c6797a0680904959188c96b
Opcode Fuzzy Hash: 7133b0cdfd98c493178963adb3935cf11b4d604c3f72702c25bd8b5f427eb67d
Instruction Fuzzy Hash: 1E51D6A2B28B9083ED448BB668213BA6762DB5B7F1F109335ED7E8F7D4DE5CE4014640

Function 00007FF66CB3D6D0 Relevance: .2, Instructions: 174COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1614887424.00007FF66CB31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF66CB30000, based on PE: true

Associated: 00000002.00000002.1614859264.00007FF66CB30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1615114616.00007FF66CD5F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1615136598.00007FF66CD6E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1615174624.00007FF66CDB6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1615174624.00007FF66CDB9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1615174624.00007FF66CE0F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1615174624.00007FF66CE4A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1615313210.00007FF66CE4E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff66cb30000_EMfRi659Ir.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c4094687a76753f877524ebd58b1e3cf6c639cd073f7723b587004863729a31b
Instruction ID: 1f1d75d61b1eb5791ebc1c2b5b4b39ea37c020256723ffed52fc6d978af6d6e9
Opcode Fuzzy Hash: c4094687a76753f877524ebd58b1e3cf6c639cd073f7723b587004863729a31b
Instruction Fuzzy Hash: BB51D8B2B3494287DB0C9A79992163A66A397867B4F509339F97ECF7D8DE3CD4004600

Function 00007FF66CC57940 Relevance: .1, Instructions: 123COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1614887424.00007FF66CB31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF66CB30000, based on PE: true

Associated: 00000002.00000002.1614859264.00007FF66CB30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1615114616.00007FF66CD5F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1615136598.00007FF66CD6E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1615174624.00007FF66CDB6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1615174624.00007FF66CDB9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1615174624.00007FF66CE0F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1615174624.00007FF66CE4A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1615313210.00007FF66CE4E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff66cb30000_EMfRi659Ir.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 70574bb45156ca4cc9bc43d326d16d26b20261e53bb56accc53446fd9e7a0783
Instruction ID: 10a82be7b969bef9cbc7fd1ff1236c0cb04e58b00fa7c2d221b917a855c892ed
Opcode Fuzzy Hash: 70574bb45156ca4cc9bc43d326d16d26b20261e53bb56accc53446fd9e7a0783
Instruction Fuzzy Hash: DA51C0B2F28E46C6EF449B25E89137A27B1FBA1741F408539E24ECF795DE2CE4518700

Function 00007FF66CC57DE0 Relevance: .1, Instructions: 118COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1614887424.00007FF66CB31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF66CB30000, based on PE: true

Associated: 00000002.00000002.1614859264.00007FF66CB30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1615114616.00007FF66CD5F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1615136598.00007FF66CD6E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1615174624.00007FF66CDB6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1615174624.00007FF66CDB9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1615174624.00007FF66CE0F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1615174624.00007FF66CE4A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1615313210.00007FF66CE4E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff66cb30000_EMfRi659Ir.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fe9fdd6c84e8f055cd988cdd8144a95f27fe9e8f48158308314d601d7fa36a3e
Instruction ID: d231fb88686e7f3159dc7a98cee1f8d748712407011f6e155ff1465a0dceb0f2
Opcode Fuzzy Hash: fe9fdd6c84e8f055cd988cdd8144a95f27fe9e8f48158308314d601d7fa36a3e
Instruction Fuzzy Hash: 3341C432B28D5186E728CB3EDC1113A66A29BD5771B54833AE52ECB7E8DF2CD9418704

Function 00007FF66CC63E00 Relevance: .1, Instructions: 70COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1614887424.00007FF66CB31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF66CB30000, based on PE: true

Associated: 00000002.00000002.1614859264.00007FF66CB30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1615114616.00007FF66CD5F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1615136598.00007FF66CD6E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1615174624.00007FF66CDB6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1615174624.00007FF66CDB9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1615174624.00007FF66CE0F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1615174624.00007FF66CE4A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1615313210.00007FF66CE4E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff66cb30000_EMfRi659Ir.jbxd

Similarity

API ID: ExitProcess
String ID:
API String ID: 621844428-0
Opcode ID: 18a1339708ad8fc42b0ec3be966b0cd82183f9893a66988d92d9a27b1e903bcc
Instruction ID: 9935087d4ff0b227f2aed54eff4143c71f1dc8577882a004485002717fe9dd8c
Opcode Fuzzy Hash: 18a1339708ad8fc42b0ec3be966b0cd82183f9893a66988d92d9a27b1e903bcc
Instruction Fuzzy Hash: ED212633B35C5346A71C963B9D2657A25A34B893217448B3DE52ECFAE0CE2CD8018A04

Function 00007FF66CD5D8C0 Relevance: 3.7, APIs: 1, Strings: 1, Instructions: 167
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualProtect.KERNELBASE ref: 00007FF66CD5DB1C

Strings

@, xrefs: 00007FF66CD5DA8B

Memory Dump Source

Source File: 00000002.00000002.1614887424.00007FF66CB31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF66CB30000, based on PE: true

Associated: 00000002.00000002.1614859264.00007FF66CB30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1615114616.00007FF66CD5F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1615136598.00007FF66CD6E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1615174624.00007FF66CDB6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1615174624.00007FF66CDB9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1615174624.00007FF66CE0F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1615174624.00007FF66CE4A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1615313210.00007FF66CE4E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff66cb30000_EMfRi659Ir.jbxd

Similarity

API ID: ProtectVirtual
String ID: @
API String ID: 544645111-2766056989
Opcode ID: 9a809a70ea6a6be442cea981ba0e3b0137118e0a191674c141363444c8a3c1b2
Instruction ID: f3a7ff8fe50b8f5752c0ad1af711bf5675b845bc0d97ed086745023fabf99997
Opcode Fuzzy Hash: 9a809a70ea6a6be442cea981ba0e3b0137118e0a191674c141363444c8a3c1b2
Instruction Fuzzy Hash: 9E6116B2F05B4ACBEB14CB55D68526823B2EB58BCAB558035DA1C9B714DF3CEA42D300

Function 00007FF66CD5DB3C Relevance: 1.6, APIs: 1, Instructions: 61
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualProtect.KERNELBASE(?,?,?,?,?,00007FF66CD5E01D,?,?,?,?,?,00007FF66CB312E5), ref: 00007FF66CD5DBF4

Memory Dump Source

Source File: 00000002.00000002.1614887424.00007FF66CB31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF66CB30000, based on PE: true

Associated: 00000002.00000002.1614859264.00007FF66CB30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1615114616.00007FF66CD5F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1615136598.00007FF66CD6E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1615174624.00007FF66CDB6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1615174624.00007FF66CDB9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1615174624.00007FF66CE0F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1615174624.00007FF66CE4A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1615313210.00007FF66CE4E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff66cb30000_EMfRi659Ir.jbxd

Similarity

API ID: ProtectVirtual
String ID:
API String ID: 544645111-0
Opcode ID: 2ff1b3d7804e1ac5f9623c96fe15e793a67efeed1af42faace67480986ebd4d1
Instruction ID: 9abbc0070aa1981216a87f018b10c4198db5e5dff10772a8d8defe9f50d81d1b
Opcode Fuzzy Hash: 2ff1b3d7804e1ac5f9623c96fe15e793a67efeed1af42faace67480986ebd4d1
Instruction Fuzzy Hash: 8911FEA2F0974ACBEF14CB55D68626863B2EB98BC6B55C035DD1C9B314DE2CEB42D700

Function 00007FF66CB3439A Relevance: 1.6, APIs: 1, Instructions: 56
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00007FF66CB342A0: VirtualAlloc.KERNEL32 ref: 00007FF66CB342BC

CreateThread.KERNELBASE ref: 00007FF66CB34429

Memory Dump Source

Source File: 00000002.00000002.1614887424.00007FF66CB31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF66CB30000, based on PE: true

Associated: 00000002.00000002.1614859264.00007FF66CB30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1615114616.00007FF66CD5F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1615136598.00007FF66CD6E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1615174624.00007FF66CDB6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1615174624.00007FF66CDB9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1615174624.00007FF66CE0F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1615174624.00007FF66CE4A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1615313210.00007FF66CE4E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff66cb30000_EMfRi659Ir.jbxd

Similarity

API ID: AllocCreateThreadVirtual
String ID:
API String ID: 3065189322-0
Opcode ID: a31a2a7adb770e4481704b1410f898072da79e3f039c221f79862557cbe6e8f9
Instruction ID: c0a63fe41453e38757187572b348a1922fb33819bd0b408dc71b50cfe052c317
Opcode Fuzzy Hash: a31a2a7adb770e4481704b1410f898072da79e3f039c221f79862557cbe6e8f9
Instruction Fuzzy Hash: F5213432608F45C2E7408B5AF8402AA77B4FB89B95F604135EA8C8BB64DF7DD455CB40

Function 00007FF66CB37500 Relevance: 1.3, APIs: 1, Instructions: 47
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

calloc.MSVCRT ref: 00007FF66CB37594

Memory Dump Source

Source File: 00000002.00000002.1614887424.00007FF66CB31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF66CB30000, based on PE: true

Associated: 00000002.00000002.1614859264.00007FF66CB30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1615114616.00007FF66CD5F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1615136598.00007FF66CD6E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1615174624.00007FF66CDB6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1615174624.00007FF66CDB9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1615174624.00007FF66CE0F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1615174624.00007FF66CE4A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1615313210.00007FF66CE4E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff66cb30000_EMfRi659Ir.jbxd

Similarity

API ID: calloc
String ID:
API String ID: 2635317215-0
Opcode ID: 800dfe40754887d6daf975f718097d420c903201902ce0ac1fc603334ffa51e1
Instruction ID: 4476c849b1bef4353f065a8856d7fe4a40321e36686c5ea440672a96aea2db52
Opcode Fuzzy Hash: 800dfe40754887d6daf975f718097d420c903201902ce0ac1fc603334ffa51e1
Instruction Fuzzy Hash: 5C11C632B24552C7E768CF39DD8112A67A2E7C9705B858335D54CCFB98EE3CD9018A40

Function 00007FF66CB342A0 Relevance: 1.3, APIs: 1, Instructions: 37memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNEL32 ref: 00007FF66CB342BC

Memory Dump Source

Source File: 00000002.00000002.1614887424.00007FF66CB31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF66CB30000, based on PE: true

Associated: 00000002.00000002.1614859264.00007FF66CB30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1615114616.00007FF66CD5F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1615136598.00007FF66CD6E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1615174624.00007FF66CDB6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1615174624.00007FF66CDB9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1615174624.00007FF66CE0F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1615174624.00007FF66CE4A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1615313210.00007FF66CE4E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff66cb30000_EMfRi659Ir.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 897b3e3d8ee974d65562bad4a02ede9a9146a17e5baa48e005b54433457c959e
Instruction ID: 6db198f4335cfc452d063330167380a77498f9e823da72b9342a6568addc944c
Opcode Fuzzy Hash: 897b3e3d8ee974d65562bad4a02ede9a9146a17e5baa48e005b54433457c959e
Instruction Fuzzy Hash: A0014866729F4486CB64CB56F85022AAAE0E78DBD8F100535EE8ECBB58DE3DD5118B00

Non-executed Functions

Function 00007FF66CB41700 Relevance: 7.4, APIs: 3, Strings: 1, Instructions: 375libraryloaderCOMMON

Download Yara Rule

APIs

GetProcAddress.KERNEL32 ref: 00007FF66CB417DE
GetProcAddress.KERNEL32 ref: 00007FF66CB41C65
ExitProcess.KERNEL32 ref: 00007FF66CB41CD8

Strings

>5H, xrefs: 00007FF66CB41B26

Memory Dump Source

Source File: 00000002.00000002.1614887424.00007FF66CB31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF66CB30000, based on PE: true

Associated: 00000002.00000002.1614859264.00007FF66CB30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1615114616.00007FF66CD5F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1615136598.00007FF66CD6E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1615174624.00007FF66CDB6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1615174624.00007FF66CDB9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1615174624.00007FF66CE0F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1615174624.00007FF66CE4A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1615313210.00007FF66CE4E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff66cb30000_EMfRi659Ir.jbxd

Similarity

API ID: AddressProc$ExitProcess
String ID: >5H
API String ID: 2636158824-3751592696
Opcode ID: 3896426ee85a89434f3dde0be441bcd7bc44f8757b39d5525a0a8f2fe4a72ed5
Instruction ID: b5cde2a91fec074fc00c06ec80e336dc8be216ce536c73ab91dd234d1ccf4e13
Opcode Fuzzy Hash: 3896426ee85a89434f3dde0be441bcd7bc44f8757b39d5525a0a8f2fe4a72ed5
Instruction Fuzzy Hash: 0CE13773F24A908AEB14CF79D8516A92BB1A759798F148235DE6EDBBC8DE3CD1108700

Function 00007FF66CB415F0 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 63COMMON

Download Yara Rule

APIs

ExitProcess.KERNEL32 ref: 00007FF66CB416D5

Strings

xf!!, xrefs: 00007FF66CB4163F
.|c/, xrefs: 00007FF66CB416BF

Memory Dump Source

Source File: 00000002.00000002.1614887424.00007FF66CB31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF66CB30000, based on PE: true

Associated: 00000002.00000002.1614859264.00007FF66CB30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1615114616.00007FF66CD5F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1615136598.00007FF66CD6E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1615174624.00007FF66CDB6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1615174624.00007FF66CDB9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1615174624.00007FF66CE0F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1615174624.00007FF66CE4A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1615313210.00007FF66CE4E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff66cb30000_EMfRi659Ir.jbxd

Similarity

API ID: ExitProcess
String ID: .|c/$xf!!
API String ID: 621844428-218602307
Opcode ID: 3d1ca7355ad7d66c04ea7ae02b1582cb9c03f42e701181b0fb80092c37a87ecc
Instruction ID: 187bdb15f84385287072c642013d95e7413aabbde10ff38921a97b208071f47f
Opcode Fuzzy Hash: 3d1ca7355ad7d66c04ea7ae02b1582cb9c03f42e701181b0fb80092c37a87ecc
Instruction Fuzzy Hash: 9B113632F2885283A35C8629AC6B93A56E387C8341B94D63ED52ACFFE4CD3CC9014604

Function 00007FF66CB3E320 Relevance: 2.9, Strings: 2, Instructions: 367COMMON

Download Yara Rule

Strings

>v, xrefs: 00007FF66CB3E8DF
]XQ, xrefs: 00007FF66CB3E8BB

Memory Dump Source

Source File: 00000002.00000002.1614887424.00007FF66CB31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF66CB30000, based on PE: true

Associated: 00000002.00000002.1614859264.00007FF66CB30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1615114616.00007FF66CD5F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1615136598.00007FF66CD6E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1615174624.00007FF66CDB6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1615174624.00007FF66CDB9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1615174624.00007FF66CE0F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1615174624.00007FF66CE4A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1615313210.00007FF66CE4E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff66cb30000_EMfRi659Ir.jbxd

Similarity

API ID:
String ID: >v$]XQ
API String ID: 0-500044638
Opcode ID: 8dc205b7a551c44db606aed4754a0d4c1a6eec161176c3352e2fd223ea1789e8
Instruction ID: 400e3c8e8a26dc34698b1ef53e4fa9640595c9fd66b8ae5e562ab30409ebab9a
Opcode Fuzzy Hash: 8dc205b7a551c44db606aed4754a0d4c1a6eec161176c3352e2fd223ea1789e8
Instruction Fuzzy Hash: 56D16C73B24D9183E758CA399C6196A6AA3DB967B17149336D93ECFBE4CE3CD8014700

Function 00007FF66CB39B90 Relevance: 1.8, Strings: 1, Instructions: 541COMMON

Download Yara Rule

Strings

:;%!, xrefs: 00007FF66CB3A1D2

Memory Dump Source

Source File: 00000002.00000002.1614887424.00007FF66CB31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF66CB30000, based on PE: true

Associated: 00000002.00000002.1614859264.00007FF66CB30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1615114616.00007FF66CD5F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1615136598.00007FF66CD6E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1615174624.00007FF66CDB6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1615174624.00007FF66CDB9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1615174624.00007FF66CE0F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1615174624.00007FF66CE4A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1615313210.00007FF66CE4E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff66cb30000_EMfRi659Ir.jbxd

Similarity

API ID:
String ID: :;%!
API String ID: 0-846597393
Opcode ID: 0e485e56664192e04d3ccfe4711f2e101fcce57d42dc3d13cc120306761b60d2
Instruction ID: 74d4736389870c5dc7fee465ce8419e6d2c30d32f115a8c070894e18d27758ed
Opcode Fuzzy Hash: 0e485e56664192e04d3ccfe4711f2e101fcce57d42dc3d13cc120306761b60d2
Instruction Fuzzy Hash: C122B776B19E9182DA68CB79E8513AA7761E7867B0F108735DA7ECB7D8CE3CD4408700

Function 00007FF66CB40150 Relevance: 1.7, Strings: 1, Instructions: 453COMMON

Download Yara Rule

Strings

Ygw7, xrefs: 00007FF66CB40823

Memory Dump Source

Source File: 00000002.00000002.1614887424.00007FF66CB31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF66CB30000, based on PE: true

Associated: 00000002.00000002.1614859264.00007FF66CB30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1615114616.00007FF66CD5F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1615136598.00007FF66CD6E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1615174624.00007FF66CDB6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1615174624.00007FF66CDB9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1615174624.00007FF66CE0F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1615174624.00007FF66CE4A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1615313210.00007FF66CE4E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff66cb30000_EMfRi659Ir.jbxd

Similarity

API ID:
String ID: Ygw7
API String ID: 0-35260591
Opcode ID: 6024328d236fc93138beb20e8090cf6db268e12d39fb520ea67c200acc694916
Instruction ID: 91a8990e50123c1b7d99914da01dc01e89e98371c69ec4b74704b2d59b49ee9f
Opcode Fuzzy Hash: 6024328d236fc93138beb20e8090cf6db268e12d39fb520ea67c200acc694916
Instruction Fuzzy Hash: 40020B72B29E9183EA48CA39AC5166A6662E7D67B0F54C335E97ECF7D8DE3CD0014700

Function 00007FF66CB37D00 Relevance: 1.7, APIs: 1, Instructions: 170COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1614887424.00007FF66CB31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF66CB30000, based on PE: true

Associated: 00000002.00000002.1614859264.00007FF66CB30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1615114616.00007FF66CD5F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1615136598.00007FF66CD6E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1615174624.00007FF66CDB6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1615174624.00007FF66CDB9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1615174624.00007FF66CE0F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1615174624.00007FF66CE4A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1615313210.00007FF66CE4E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff66cb30000_EMfRi659Ir.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: aac1194973ab989405c2fc458d494f2683912876a0c7217fcf68ce36b7639cf4
Instruction ID: 20e7a0d14183b1ceadc059198c395b0c4918916562f7af19e039fdf51aa1b25f
Opcode Fuzzy Hash: aac1194973ab989405c2fc458d494f2683912876a0c7217fcf68ce36b7639cf4
Instruction Fuzzy Hash: C661F672B18A52CBEB58CB38DD5123A66B2EB89311F504239E55EDF7D8DE7CD8018A00

Function 00007FF66CB3B150 Relevance: 1.6, APIs: 1, Instructions: 129COMMON

Download Yara Rule

APIs

realloc.MSVCRT ref: 00007FF66CB3B341

Memory Dump Source

Source File: 00000002.00000002.1614887424.00007FF66CB31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF66CB30000, based on PE: true

Associated: 00000002.00000002.1614859264.00007FF66CB30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1615114616.00007FF66CD5F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1615136598.00007FF66CD6E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1615174624.00007FF66CDB6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1615174624.00007FF66CDB9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1615174624.00007FF66CE0F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1615174624.00007FF66CE4A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1615313210.00007FF66CE4E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff66cb30000_EMfRi659Ir.jbxd

Similarity

API ID: realloc
String ID:
API String ID: 471065373-0
Opcode ID: f391ef24dddcb7e788386688e51425a6cc8fc8cb7e3ea9e8d9ccb3eef0cf1bff
Instruction ID: a6779fcea7ffb0f7b4a4169975334749bd5f02d596753f73e49644fa7372ea2c
Opcode Fuzzy Hash: f391ef24dddcb7e788386688e51425a6cc8fc8cb7e3ea9e8d9ccb3eef0cf1bff
Instruction Fuzzy Hash: 9141F832728E61C3E75896399C5166E66A2EBCA760F548335E57EDFBD8CE3CD8014700

Function 00007FF66CB7A6D0 Relevance: 1.6, Strings: 1, Instructions: 365COMMON

Download Yara Rule

Strings

\aM, xrefs: 00007FF66CB7AC36

Memory Dump Source

Source File: 00000002.00000002.1614887424.00007FF66CB31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF66CB30000, based on PE: true

Associated: 00000002.00000002.1614859264.00007FF66CB30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1615114616.00007FF66CD5F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1615136598.00007FF66CD6E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1615174624.00007FF66CDB6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1615174624.00007FF66CDB9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1615174624.00007FF66CE0F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1615174624.00007FF66CE4A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1615313210.00007FF66CE4E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff66cb30000_EMfRi659Ir.jbxd

Similarity

API ID:
String ID: \aM
API String ID: 0-2009346633
Opcode ID: 82ad2df2fe10aef77df0c0cac4d263066753beeede5b41941e713da9fd592624
Instruction ID: f0bfc2f13d741f86cd42913acb2c251786808836ce396def5ee42284cfbedf39
Opcode Fuzzy Hash: 82ad2df2fe10aef77df0c0cac4d263066753beeede5b41941e713da9fd592624
Instruction Fuzzy Hash: 1DE1E973719E8182D768CB35E85136A76A2A7D97B0F14D325DABDCBBD8DE2CD0008B00

Function 00007FF66CC46840 Relevance: 1.5, Strings: 1, Instructions: 278COMMON

Download Yara Rule

Strings

Lo, xrefs: 00007FF66CC46B3D

Memory Dump Source

Source File: 00000002.00000002.1614887424.00007FF66CB31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF66CB30000, based on PE: true

Associated: 00000002.00000002.1614859264.00007FF66CB30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1615114616.00007FF66CD5F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1615136598.00007FF66CD6E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1615174624.00007FF66CDB6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1615174624.00007FF66CDB9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1615174624.00007FF66CE0F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1615174624.00007FF66CE4A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1615313210.00007FF66CE4E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff66cb30000_EMfRi659Ir.jbxd

Similarity

API ID:
String ID: Lo
API String ID: 0-2285928137
Opcode ID: 83dfec23e27fadcb36c8296c46c390bb09e4352c33aa85ee6cefc978e002531a
Instruction ID: 4b7ff629eb134b6db0bbb8a11383ba159074f0a2485c82cec89e09c2de655194
Opcode Fuzzy Hash: 83dfec23e27fadcb36c8296c46c390bb09e4352c33aa85ee6cefc978e002531a
Instruction Fuzzy Hash: CFB10C33B24D6186F764CB7A9851F693A62A385778F20D324DE3A97FD8CB3985128700

Function 00007FF66CB3C930 Relevance: 1.5, Strings: 1, Instructions: 210COMMON

Download Yara Rule

Strings

txeo, xrefs: 00007FF66CB3CA1F

Memory Dump Source

Source File: 00000002.00000002.1614887424.00007FF66CB31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF66CB30000, based on PE: true

Associated: 00000002.00000002.1614859264.00007FF66CB30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1615114616.00007FF66CD5F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1615136598.00007FF66CD6E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1615174624.00007FF66CDB6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1615174624.00007FF66CDB9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1615174624.00007FF66CE0F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1615174624.00007FF66CE4A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1615313210.00007FF66CE4E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff66cb30000_EMfRi659Ir.jbxd

Similarity

API ID:
String ID: txeo
API String ID: 0-1518088724
Opcode ID: 0058d4e9d7487744abc2846d99595e57e412fd3656ba07b2b9a0ed0ba66a9af6
Instruction ID: 817cffcb7cee714b4e725f159ffecd1b229d38e328bf71d896e46266f11707b3
Opcode Fuzzy Hash: 0058d4e9d7487744abc2846d99595e57e412fd3656ba07b2b9a0ed0ba66a9af6
Instruction Fuzzy Hash: E1812873718E6183D758CA79A85166A66A2EBC67B1F148335ED7DCB7D8CE3CD4018700

Function 00007FF66CB3DAB0 Relevance: 1.5, Strings: 1, Instructions: 207COMMON

Download Yara Rule

Strings

cj*, xrefs: 00007FF66CB3DD8B

Memory Dump Source

Source File: 00000002.00000002.1614887424.00007FF66CB31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF66CB30000, based on PE: true

Associated: 00000002.00000002.1614859264.00007FF66CB30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1615114616.00007FF66CD5F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1615136598.00007FF66CD6E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1615174624.00007FF66CDB6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1615174624.00007FF66CDB9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1615174624.00007FF66CE0F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1615174624.00007FF66CE4A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1615313210.00007FF66CE4E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff66cb30000_EMfRi659Ir.jbxd

Similarity

API ID:
String ID: cj*
API String ID: 0-627523316
Opcode ID: cc62ed070d5c738b6f4ad9d89d2037aeddcea2d1da5b4b14d44cd05de93118fc
Instruction ID: 550458a64f711cc6d620f7827fd76c2e5514359577045a17f303b6aae8f7dc33
Opcode Fuzzy Hash: cc62ed070d5c738b6f4ad9d89d2037aeddcea2d1da5b4b14d44cd05de93118fc
Instruction Fuzzy Hash: FE81DA76B3895183EB48CA39E85563A77A2EB86760F548735E96ECF7D4CE3CD8018700

Function 00007FF66CB382C0 Relevance: 1.4, Strings: 1, Instructions: 187COMMON

Download Yara Rule

Strings

Z3, xrefs: 00007FF66CB384DD

Memory Dump Source

Source File: 00000002.00000002.1614887424.00007FF66CB31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF66CB30000, based on PE: true

Associated: 00000002.00000002.1614859264.00007FF66CB30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1615114616.00007FF66CD5F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1615136598.00007FF66CD6E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1615174624.00007FF66CDB6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1615174624.00007FF66CDB9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1615174624.00007FF66CE0F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1615174624.00007FF66CE4A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1615313210.00007FF66CE4E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff66cb30000_EMfRi659Ir.jbxd

Similarity

API ID:
String ID: Z3
API String ID: 0-3605120422
Opcode ID: ad06b1dbd1dfd00bd265d4ef6fbd9dc9252baf70cf2e2c80624ea4c1fab64eed
Instruction ID: 6598aab117c8794dfde4e91217c05e9f80f0c6cd1aafafbf9a93a9fb05664537
Opcode Fuzzy Hash: ad06b1dbd1dfd00bd265d4ef6fbd9dc9252baf70cf2e2c80624ea4c1fab64eed
Instruction Fuzzy Hash: 73615C73738D9183935CCA7C9C52A662A92A7867B4B649336FE39CFBD4CE3DC5004600

Function 00007FF66CB7B480 Relevance: 1.4, Strings: 1, Instructions: 181COMMON

Download Yara Rule

Strings

]{w, xrefs: 00007FF66CB7B631

Memory Dump Source

Source File: 00000002.00000002.1614887424.00007FF66CB31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF66CB30000, based on PE: true

Associated: 00000002.00000002.1614859264.00007FF66CB30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1615114616.00007FF66CD5F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1615136598.00007FF66CD6E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1615174624.00007FF66CDB6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1615174624.00007FF66CDB9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1615174624.00007FF66CE0F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1615174624.00007FF66CE4A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1615313210.00007FF66CE4E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff66cb30000_EMfRi659Ir.jbxd

Similarity

API ID:
String ID: ]{w
API String ID: 0-1355069309
Opcode ID: 48afb68adb6ab2f9bbafaa4ae46281f3214b203cbc6361128d68bf28f52eff92
Instruction ID: cfad8642d555141db5e7cfe508386b341288dee1ae0eaeadbd48619645289c74
Opcode Fuzzy Hash: 48afb68adb6ab2f9bbafaa4ae46281f3214b203cbc6361128d68bf28f52eff92
Instruction Fuzzy Hash: 1B61C532725E5582975CCA39DC5116BBAA2E7C9770B688339E67ECB7E8CE3CD4018704

Function 00007FF66CB788F0 Relevance: 1.4, Strings: 1, Instructions: 162COMMON

Download Yara Rule

Strings

IJy3, xrefs: 00007FF66CB78A8D

Memory Dump Source

Source File: 00000002.00000002.1614887424.00007FF66CB31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF66CB30000, based on PE: true

Associated: 00000002.00000002.1614859264.00007FF66CB30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1615114616.00007FF66CD5F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1615136598.00007FF66CD6E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1615174624.00007FF66CDB6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1615174624.00007FF66CDB9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1615174624.00007FF66CE0F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1615174624.00007FF66CE4A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1615313210.00007FF66CE4E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff66cb30000_EMfRi659Ir.jbxd

Similarity

API ID:
String ID: IJy3
API String ID: 0-4218970900
Opcode ID: c6db6e5034d1a5d177c476c542b1e8d78ce6b59327118fc12f00021f9c4a1027
Instruction ID: 02d16c793308411b3210391d37a9bfef71dcd11c32295a8d3e7496d5d8892c11
Opcode Fuzzy Hash: c6db6e5034d1a5d177c476c542b1e8d78ce6b59327118fc12f00021f9c4a1027
Instruction Fuzzy Hash: 5F513972F24A12CAFB14CBBA98425692AB25B993B5F149336DD3DDBBD4DD3CE0018710

Function 00007FF66CB395D0 Relevance: 1.4, Strings: 1, Instructions: 154COMMON

Download Yara Rule

Strings

h![q, xrefs: 00007FF66CB396D1

Memory Dump Source

Source File: 00000002.00000002.1614887424.00007FF66CB31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF66CB30000, based on PE: true

Associated: 00000002.00000002.1614859264.00007FF66CB30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1615114616.00007FF66CD5F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1615136598.00007FF66CD6E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1615174624.00007FF66CDB6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1615174624.00007FF66CDB9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1615174624.00007FF66CE0F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1615174624.00007FF66CE4A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1615313210.00007FF66CE4E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff66cb30000_EMfRi659Ir.jbxd

Similarity

API ID:
String ID: h![q
API String ID: 0-2551507218
Opcode ID: fb83c6c0739710af1212dfaef38b60cffd16df4571846cafb63f74a2bcaea8c9
Instruction ID: 22196b6e02e6fdbb9bd5140c583e89e13dc36791191181cc056313db411069c1
Opcode Fuzzy Hash: fb83c6c0739710af1212dfaef38b60cffd16df4571846cafb63f74a2bcaea8c9
Instruction Fuzzy Hash: E6619336A18F4582EA108B69E45075A6B71E7D6BF5F105321EEBD87BE8CF3CD4508B40

Function 00007FF66CB78480 Relevance: 1.4, Strings: 1, Instructions: 150COMMON

Download Yara Rule

Strings

)Gp&, xrefs: 00007FF66CB785DF

Memory Dump Source

Source File: 00000002.00000002.1614887424.00007FF66CB31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF66CB30000, based on PE: true

Associated: 00000002.00000002.1614859264.00007FF66CB30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1615114616.00007FF66CD5F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1615136598.00007FF66CD6E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1615174624.00007FF66CDB6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1615174624.00007FF66CDB9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1615174624.00007FF66CE0F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1615174624.00007FF66CE4A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1615313210.00007FF66CE4E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff66cb30000_EMfRi659Ir.jbxd

Similarity

API ID:
String ID: )Gp&
API String ID: 0-1956206822
Opcode ID: 5eac9f4a27a1184b8a244a38fcdcccc2689726a02756a3d24e75824d6bb8b0ea
Instruction ID: 814bb093e2448d6ddee633832b0d2c2be1343b331ecf241525cef8528b5e3aa1
Opcode Fuzzy Hash: 5eac9f4a27a1184b8a244a38fcdcccc2689726a02756a3d24e75824d6bb8b0ea
Instruction Fuzzy Hash: 34511932B2CD51C7D3588739A85123A7AB1AB8A761F54533AE57ECBAE4CE1DE400DB00

Function 00007FF66CB7AE90 Relevance: 1.4, Strings: 1, Instructions: 147COMMON

Download Yara Rule

Strings

?Ix, xrefs: 00007FF66CB7AFD0

Memory Dump Source

Source File: 00000002.00000002.1614887424.00007FF66CB31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF66CB30000, based on PE: true

Associated: 00000002.00000002.1614859264.00007FF66CB30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1615114616.00007FF66CD5F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1615136598.00007FF66CD6E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1615174624.00007FF66CDB6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1615174624.00007FF66CDB9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1615174624.00007FF66CE0F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1615174624.00007FF66CE4A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1615313210.00007FF66CE4E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff66cb30000_EMfRi659Ir.jbxd

Similarity

API ID:
String ID: ?Ix
API String ID: 0-429423128
Opcode ID: aca5c7a8083dfa1e1f35969f98539d781bd227ec2f0f68a997897b2bddc49542
Instruction ID: ba9322ad09cb5e89d1fd7fe0f3f6db3351b6486cdc181f21537a891abb35e926
Opcode Fuzzy Hash: aca5c7a8083dfa1e1f35969f98539d781bd227ec2f0f68a997897b2bddc49542
Instruction Fuzzy Hash: 3B51E8A3B28E5182EE54C679D8513266662AB86BF0F149735ED7ECBBD8CE2CD4018704

Function 00007FF66CB38070 Relevance: 1.4, APIs: 1, Instructions: 146COMMON

Download Yara Rule

APIs

malloc.MSVCRT ref: 00007FF66CB3827D

Memory Dump Source

Source File: 00000002.00000002.1614887424.00007FF66CB31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF66CB30000, based on PE: true

Associated: 00000002.00000002.1614859264.00007FF66CB30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1615114616.00007FF66CD5F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1615136598.00007FF66CD6E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1615174624.00007FF66CDB6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1615174624.00007FF66CDB9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1615174624.00007FF66CE0F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1615174624.00007FF66CE4A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1615313210.00007FF66CE4E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff66cb30000_EMfRi659Ir.jbxd

Similarity

API ID: malloc
String ID:
API String ID: 2803490479-0
Opcode ID: 3631ea9cd5a392dec5df1e690bef974c9f1d182acaf46739a31d3218deb60263
Instruction ID: f6f4abf5bddba84f2a14dfa548be673f69a2176536da12813181569b4423addc
Opcode Fuzzy Hash: 3631ea9cd5a392dec5df1e690bef974c9f1d182acaf46739a31d3218deb60263
Instruction Fuzzy Hash: 7651D532F28D11CAE748DB7ADC426792AA35B89365F50C73AD92DCBBD8CE3CD5114600

Function 00007FF66CB3ADC0 Relevance: 1.4, Strings: 1, Instructions: 123COMMON

Download Yara Rule

Strings

q\, xrefs: 00007FF66CB3AE70

Memory Dump Source

Source File: 00000002.00000002.1614887424.00007FF66CB31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF66CB30000, based on PE: true

Associated: 00000002.00000002.1614859264.00007FF66CB30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1615114616.00007FF66CD5F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1615136598.00007FF66CD6E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1615174624.00007FF66CDB6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1615174624.00007FF66CDB9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1615174624.00007FF66CE0F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1615174624.00007FF66CE4A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1615313210.00007FF66CE4E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff66cb30000_EMfRi659Ir.jbxd

Similarity

API ID:
String ID: q\
API String ID: 0-4171316048
Opcode ID: 913865039cd500ed6851c46498b319c5e4e4a80784eb1bf9e532da8f1ea99479
Instruction ID: dcf3b95a902901cdc48463c68ecbe2a6c811ad3c2dc21bd536f42f6b5cfe0e2e
Opcode Fuzzy Hash: 913865039cd500ed6851c46498b319c5e4e4a80784eb1bf9e532da8f1ea99479
Instruction Fuzzy Hash: 8D416122B2495183EBA4C639AC51B6B66529BD6774F24D331E93DCBBD8CE3CD4024B00

Function 00007FF66CB7C170 Relevance: 1.4, Strings: 1, Instructions: 123COMMON

Download Yara Rule

Strings

pr0?, xrefs: 00007FF66CB7C262

Memory Dump Source

Source File: 00000002.00000002.1614887424.00007FF66CB31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF66CB30000, based on PE: true

Associated: 00000002.00000002.1614859264.00007FF66CB30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1615114616.00007FF66CD5F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1615136598.00007FF66CD6E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1615174624.00007FF66CDB6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1615174624.00007FF66CDB9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1615174624.00007FF66CE0F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1615174624.00007FF66CE4A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1615313210.00007FF66CE4E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff66cb30000_EMfRi659Ir.jbxd

Similarity

API ID:
String ID: pr0?
API String ID: 0-1949227120
Opcode ID: 0e63dbce582f426995f05ad0d2fb32d6e6487b5c00898dd2957d9f9d53416cb7
Instruction ID: 9654436dd03c097ee4f87c43f0c0cca2eb439982f587cb489e6a6deb4f500bf4
Opcode Fuzzy Hash: 0e63dbce582f426995f05ad0d2fb32d6e6487b5c00898dd2957d9f9d53416cb7
Instruction Fuzzy Hash: BF41D433F20E61C9F7649BBAA84166E2AB1A749768F101725DE3CD7BC4DE38D4518710

Function 00007FF66CB398A0 Relevance: 1.4, Strings: 1, Instructions: 121COMMON

Download Yara Rule

Strings

iwr, xrefs: 00007FF66CB39A19

Memory Dump Source

Source File: 00000002.00000002.1614887424.00007FF66CB31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF66CB30000, based on PE: true

Associated: 00000002.00000002.1614859264.00007FF66CB30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1615114616.00007FF66CD5F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1615136598.00007FF66CD6E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1615174624.00007FF66CDB6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1615174624.00007FF66CDB9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1615174624.00007FF66CE0F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1615174624.00007FF66CE4A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1615313210.00007FF66CE4E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff66cb30000_EMfRi659Ir.jbxd

Similarity

API ID:
String ID: iwr
API String ID: 0-2058742600
Opcode ID: 6f61a8c9b805e379a5922031c1ee9c542288c254ab9feac872b3b2117e80794e
Instruction ID: 9ad36916eb82a6e6f0aa05321405c13bc60e83c2974d273be98ef3ca230ae89a
Opcode Fuzzy Hash: 6f61a8c9b805e379a5922031c1ee9c542288c254ab9feac872b3b2117e80794e
Instruction Fuzzy Hash: FB41EBB2724E5183DB488B79A95116A6692B7C9BF0B10D335DA7ECB7D8DE3CD4018704

Function 00007FF66CB65280 Relevance: 1.4, Strings: 1, Instructions: 120COMMON

Download Yara Rule

Strings

<LSr, xrefs: 00007FF66CB65337

Memory Dump Source

Source File: 00000002.00000002.1614887424.00007FF66CB31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF66CB30000, based on PE: true

Associated: 00000002.00000002.1614859264.00007FF66CB30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1615114616.00007FF66CD5F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1615136598.00007FF66CD6E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1615174624.00007FF66CDB6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1615174624.00007FF66CDB9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1615174624.00007FF66CE0F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1615174624.00007FF66CE4A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1615313210.00007FF66CE4E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff66cb30000_EMfRi659Ir.jbxd

Similarity

API ID:
String ID: <LSr
API String ID: 0-3450139174
Opcode ID: b1b1257e052bd886984fb546fdcc28c6a26f4076f7789f6df42620bbd0c1c464
Instruction ID: 288a96a6cd9414be5c800269bb0bc6189e96c978f7cd8b9aba8b2902e323b677
Opcode Fuzzy Hash: b1b1257e052bd886984fb546fdcc28c6a26f4076f7789f6df42620bbd0c1c464
Instruction Fuzzy Hash: 19412773B38D51929764CB3BA91191B3D92A7A57E4B10E335ED6AC7FE9DA3CD0004B04

Function 00007FF66CB3EF8B Relevance: 1.4, APIs: 1, Instructions: 118COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1614887424.00007FF66CB31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF66CB30000, based on PE: true

Associated: 00000002.00000002.1614859264.00007FF66CB30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1615114616.00007FF66CD5F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1615136598.00007FF66CD6E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1615174624.00007FF66CDB6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1615174624.00007FF66CDB9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1615174624.00007FF66CE0F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1615174624.00007FF66CE4A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1615313210.00007FF66CE4E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff66cb30000_EMfRi659Ir.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5ed3e7970a635fd639068a24164c8c247724026c92641874dc20c9fdae93beee
Instruction ID: a4fb137be3500b869b0cf8cdf3f63e05512f26bd10e003880d3c479655882062
Opcode Fuzzy Hash: 5ed3e7970a635fd639068a24164c8c247724026c92641874dc20c9fdae93beee
Instruction Fuzzy Hash: 464186A2729F9082DD44C7B9986137A6661DB4ABF0F209335FE7E4B7D5CF2CD0104600

Function 00007FF66CB37990 Relevance: 1.4, APIs: 1, Instructions: 102COMMON

Download Yara Rule

APIs

malloc.MSVCRT ref: 00007FF66CB37B0E

Memory Dump Source

Source File: 00000002.00000002.1614887424.00007FF66CB31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF66CB30000, based on PE: true

Associated: 00000002.00000002.1614859264.00007FF66CB30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1615114616.00007FF66CD5F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1615136598.00007FF66CD6E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1615174624.00007FF66CDB6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1615174624.00007FF66CDB9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1615174624.00007FF66CE0F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1615174624.00007FF66CE4A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1615313210.00007FF66CE4E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff66cb30000_EMfRi659Ir.jbxd

Similarity

API ID: malloc
String ID:
API String ID: 2803490479-0
Opcode ID: fbe88cca722902fb19bfad099805115882eebe76dd6971c61c3d1758a09ebe3d
Instruction ID: 68d5401ca956a3dbe6d624974e1eb14e77e8faf0a17803ec667b509b6874a4aa
Opcode Fuzzy Hash: fbe88cca722902fb19bfad099805115882eebe76dd6971c61c3d1758a09ebe3d
Instruction Fuzzy Hash: E9417773F24E15CBFB148BB1D8622BC2AB1A75D751F048134C96DCBB84EE2C95428A00

Function 00007FF66CB38F20 Relevance: 1.3, Strings: 1, Instructions: 83COMMON

Download Yara Rule

Strings

<:", xrefs: 00007FF66CB38F81

Memory Dump Source

Source File: 00000002.00000002.1614887424.00007FF66CB31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF66CB30000, based on PE: true

Associated: 00000002.00000002.1614859264.00007FF66CB30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1615114616.00007FF66CD5F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1615136598.00007FF66CD6E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1615174624.00007FF66CDB6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1615174624.00007FF66CDB9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1615174624.00007FF66CE0F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1615174624.00007FF66CE4A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1615313210.00007FF66CE4E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff66cb30000_EMfRi659Ir.jbxd

Similarity

API ID:
String ID: <:"
API String ID: 0-278960745
Opcode ID: abe581980c0359576d282b6b6fe48bd5aae6b691a50418cef75cd801f5ab5511
Instruction ID: 9d24d6835bddb6b5738b324c7583281aac85e563805ca6044a82f150f28fa978
Opcode Fuzzy Hash: abe581980c0359576d282b6b6fe48bd5aae6b691a50418cef75cd801f5ab5511
Instruction Fuzzy Hash: F5314036B2CA5183DB48CB79A56523B67E2D7C5740F508239E95ECF798CE3DC4018B04

Function 00007FF66CB41D30 Relevance: 1.3, APIs: 1, Instructions: 81COMMON

Download Yara Rule

APIs

free.MSVCRT ref: 00007FF66CB41DBB

Memory Dump Source

Source File: 00000002.00000002.1614887424.00007FF66CB31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF66CB30000, based on PE: true

Associated: 00000002.00000002.1614859264.00007FF66CB30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1615114616.00007FF66CD5F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1615136598.00007FF66CD6E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1615174624.00007FF66CDB6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1615174624.00007FF66CDB9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1615174624.00007FF66CE0F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1615174624.00007FF66CE4A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1615313210.00007FF66CE4E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff66cb30000_EMfRi659Ir.jbxd

Similarity

API ID: free
String ID:
API String ID: 1294909896-0
Opcode ID: a4a0dca8b977f78ab19cc204e255403c51ac6985bfb3cb36965ff1f069f591ca
Instruction ID: d00c258125c89453542e0e07cb6d0f5c9bf5246e9b4f83750f860c32409fea3a
Opcode Fuzzy Hash: a4a0dca8b977f78ab19cc204e255403c51ac6985bfb3cb36965ff1f069f591ca
Instruction Fuzzy Hash: 6531FB77B28A5142EB649B39DC52B262652A7967B4F40A735EC3DCBBE4CE3CD0014B00

Function 00007FF66CB335CE Relevance: 1.3, Strings: 1, Instructions: 69COMMON

Download Yara Rule

Strings

_x8, xrefs: 00007FF66CB3365C

Memory Dump Source

Source File: 00000002.00000002.1614887424.00007FF66CB31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF66CB30000, based on PE: true

Associated: 00000002.00000002.1614859264.00007FF66CB30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1615114616.00007FF66CD5F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1615136598.00007FF66CD6E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1615174624.00007FF66CDB6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1615174624.00007FF66CDB9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1615174624.00007FF66CE0F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1615174624.00007FF66CE4A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1615313210.00007FF66CE4E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff66cb30000_EMfRi659Ir.jbxd

Similarity

API ID:
String ID: _x8
API String ID: 0-3289680410
Opcode ID: f631feaa825afdbc08a687ede08a0dfac5689e191e98774b867cfaa1fa63e805
Instruction ID: 23262f01b9e1efd20de761970c73e4a49a61c0b5022ada79a689d16438a89e82
Opcode Fuzzy Hash: f631feaa825afdbc08a687ede08a0dfac5689e191e98774b867cfaa1fa63e805
Instruction Fuzzy Hash: 0E213733B34CB187B36889798C535A626A2C7877307548339E53DCFBD4DE3C99424A04

Function 00007FF66CB3A540 Relevance: 1.3, APIs: 1, Instructions: 63COMMON

Download Yara Rule

APIs

free.MSVCRT ref: 00007FF66CB3A56D

Memory Dump Source

Source File: 00000002.00000002.1614887424.00007FF66CB31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF66CB30000, based on PE: true

Associated: 00000002.00000002.1614859264.00007FF66CB30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1615114616.00007FF66CD5F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1615136598.00007FF66CD6E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1615174624.00007FF66CDB6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1615174624.00007FF66CDB9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1615174624.00007FF66CE0F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1615174624.00007FF66CE4A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1615313210.00007FF66CE4E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff66cb30000_EMfRi659Ir.jbxd

Similarity

API ID: free
String ID:
API String ID: 1294909896-0
Opcode ID: 4f26df8c92cfefb4e00d5171621374185989c3ac70e69a502f31effdb93fd1e2
Instruction ID: 946d66c5942b4b57fbe6fda4e3d2660725ca41a73afabaecec8578a87902c6ff
Opcode Fuzzy Hash: 4f26df8c92cfefb4e00d5171621374185989c3ac70e69a502f31effdb93fd1e2
Instruction Fuzzy Hash: 1121D372B34E6483E764CB3AE85171A6693E7C5764FA08324D95CCBBE4CA3DD4028B00

Function 00007FF66CB33B43 Relevance: 1.3, Strings: 1, Instructions: 58COMMON

Download Yara Rule

Strings

qDI$, xrefs: 00007FF66CB33BEA

Memory Dump Source

Source File: 00000002.00000002.1614887424.00007FF66CB31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF66CB30000, based on PE: true

Associated: 00000002.00000002.1614859264.00007FF66CB30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1615114616.00007FF66CD5F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1615136598.00007FF66CD6E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1615174624.00007FF66CDB6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1615174624.00007FF66CDB9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1615174624.00007FF66CE0F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1615174624.00007FF66CE4A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1615313210.00007FF66CE4E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff66cb30000_EMfRi659Ir.jbxd

Similarity

API ID:
String ID: qDI$
API String ID: 0-2565614948
Opcode ID: fbdd9c28dffda53a4bbf0b7a2debae409b8427f1a6fdc6088e8c5e1c31281f70
Instruction ID: 742d853c99b0a646e20709e11f5799edbbd296024211dbacc0908bb99e2a36a2
Opcode Fuzzy Hash: fbdd9c28dffda53a4bbf0b7a2debae409b8427f1a6fdc6088e8c5e1c31281f70
Instruction Fuzzy Hash: F6110B32B6491587EB5CDA388C511AB3B629789335B64C335D63ACA2D4DF38D5564304

Function 00007FF66CB3DDFE Relevance: 1.3, Strings: 1, Instructions: 43COMMON

Download Yara Rule

Strings

cj*, xrefs: 00007FF66CB3DD8B

Memory Dump Source

Source File: 00000002.00000002.1614887424.00007FF66CB31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF66CB30000, based on PE: true

Associated: 00000002.00000002.1614859264.00007FF66CB30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1615114616.00007FF66CD5F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1615136598.00007FF66CD6E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1615174624.00007FF66CDB6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1615174624.00007FF66CDB9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1615174624.00007FF66CE0F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1615174624.00007FF66CE4A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1615313210.00007FF66CE4E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff66cb30000_EMfRi659Ir.jbxd

Similarity

API ID:
String ID: cj*
API String ID: 0-627523316
Opcode ID: 3d7161360e5afa920675bc2d2458d302f6c196df4c3ec503ea480e6dd76e639b
Instruction ID: fca0435f8d801f0430017f37f94c1fa525cf7581a93ebe98fdf9012348b794e8
Opcode Fuzzy Hash: 3d7161360e5afa920675bc2d2458d302f6c196df4c3ec503ea480e6dd76e639b
Instruction Fuzzy Hash: 6F01F922B3856187A76CCA39985193B69A38786358BA09739E81ECBBD4C93CDC424E00

Function 00007FF66CB798A0 Relevance: .8, Instructions: 832COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1614887424.00007FF66CB31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF66CB30000, based on PE: true

Associated: 00000002.00000002.1614859264.00007FF66CB30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1615114616.00007FF66CD5F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1615136598.00007FF66CD6E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1615174624.00007FF66CDB6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1615174624.00007FF66CDB9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1615174624.00007FF66CE0F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1615174624.00007FF66CE4A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1615313210.00007FF66CE4E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff66cb30000_EMfRi659Ir.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7754335553c652ca7db5d5defcb2bb40cd0305c95415d3de45708637360abdb0
Instruction ID: 05208d2c89f54b5942c256cf4d6a5ff0db3417095deaa07559a7f5b081ec3fc8
Opcode Fuzzy Hash: 7754335553c652ca7db5d5defcb2bb40cd0305c95415d3de45708637360abdb0
Instruction Fuzzy Hash: 7E72F873B15E908AEB58CF7A9C513A93662AB4A7B4F109335DE3DCB7D8CE28D5118700

Function 00007FF66CB385C0 Relevance: .6, Instructions: 551COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1614887424.00007FF66CB31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF66CB30000, based on PE: true

Associated: 00000002.00000002.1614859264.00007FF66CB30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1615114616.00007FF66CD5F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1615136598.00007FF66CD6E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1615174624.00007FF66CDB6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1615174624.00007FF66CDB9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1615174624.00007FF66CE0F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1615174624.00007FF66CE4A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1615313210.00007FF66CE4E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff66cb30000_EMfRi659Ir.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6d1b6d8ad8f07414373cc46451414fc3f2136a022189f684c243e50fc0769094
Instruction ID: 6499714bd860879f51966cebe7e5973476648f5ac62220fbe4aadc79cf25be4a
Opcode Fuzzy Hash: 6d1b6d8ad8f07414373cc46451414fc3f2136a022189f684c243e50fc0769094
Instruction Fuzzy Hash: 84222EB2B20F5086EF54CBB99C617AA2662A756BF4F109725EE3D9B7D4CE3CD0118300

Function 00007FF66CB78FC0 Relevance: .4, Instructions: 374COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1614887424.00007FF66CB31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF66CB30000, based on PE: true

Associated: 00000002.00000002.1614859264.00007FF66CB30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1615114616.00007FF66CD5F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1615136598.00007FF66CD6E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1615174624.00007FF66CDB6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1615174624.00007FF66CDB9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1615174624.00007FF66CE0F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1615174624.00007FF66CE4A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1615313210.00007FF66CE4E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff66cb30000_EMfRi659Ir.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dab316e74fa5289dac492b6b6effd709150db61824f79a35152a7c5b49cb63ca
Instruction ID: 893717ca45dcb858e33f0e551767901cb2a206bf058f99bfebcd114e130c5fa5
Opcode Fuzzy Hash: dab316e74fa5289dac492b6b6effd709150db61824f79a35152a7c5b49cb63ca
Instruction Fuzzy Hash: ADE1C172F14F51C9EB14CBBA98512AD37B1AB4A7B8F104725EE3D9BBD9CE28D1508310

Function 00007FF66CB385BE Relevance: .3, Instructions: 343COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1614887424.00007FF66CB31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF66CB30000, based on PE: true

Associated: 00000002.00000002.1614859264.00007FF66CB30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1615114616.00007FF66CD5F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1615136598.00007FF66CD6E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1615174624.00007FF66CDB6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1615174624.00007FF66CDB9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1615174624.00007FF66CE0F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1615174624.00007FF66CE4A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1615313210.00007FF66CE4E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff66cb30000_EMfRi659Ir.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d9e1ccd83fb876328e5be36c3d26ce0516d520dd1450e24cb4b7ca813ba4a89f
Instruction ID: 2259183abcf3054d32e43fc242d5a9a8f1c10f5e94b523b4ee260f858fa8814c
Opcode Fuzzy Hash: d9e1ccd83fb876328e5be36c3d26ce0516d520dd1450e24cb4b7ca813ba4a89f
Instruction Fuzzy Hash: FCD13EB2B24E5186EB18CF795C21BA62A62D756BF4B20A725ED3DDB7D4CE3CD5108300

Function 00007FF66CB3A670 Relevance: .3, Instructions: 323COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1614887424.00007FF66CB31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF66CB30000, based on PE: true

Associated: 00000002.00000002.1614859264.00007FF66CB30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1615114616.00007FF66CD5F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1615136598.00007FF66CD6E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1615174624.00007FF66CDB6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1615174624.00007FF66CDB9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1615174624.00007FF66CE0F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1615174624.00007FF66CE4A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1615313210.00007FF66CE4E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff66cb30000_EMfRi659Ir.jbxd

Similarity

API ID: free
String ID:
API String ID: 1294909896-0
Opcode ID: 939e44a9546b2dea13f7735b6e46ee2b59ef737ec35c6198e66b8a24a98dbc55
Instruction ID: 1071a576cba050e863ce33d04b54807e790e09a5ccec6e8a7f6c4520666a4658
Opcode Fuzzy Hash: 939e44a9546b2dea13f7735b6e46ee2b59ef737ec35c6198e66b8a24a98dbc55
Instruction Fuzzy Hash: 47C13832F25A51C7FF18CBB5985117E27B2AB89764F604235DA2EDBBD4DE2CD4428B00

Function 00007FF66CB324F5 Relevance: .3, Instructions: 252COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1614887424.00007FF66CB31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF66CB30000, based on PE: true

Associated: 00000002.00000002.1614859264.00007FF66CB30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1615114616.00007FF66CD5F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1615136598.00007FF66CD6E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1615174624.00007FF66CDB6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1615174624.00007FF66CDB9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1615174624.00007FF66CE0F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1615174624.00007FF66CE4A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1615313210.00007FF66CE4E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff66cb30000_EMfRi659Ir.jbxd

Similarity

API ID: free
String ID:
API String ID: 1294909896-0
Opcode ID: c0dce512570cca7e4e860aae9860db8f32a2c5afb9540998f5dcff44c2b32fd0
Instruction ID: 74b4c2dea51bf155a7836c6d1a03625603664e70b2345e8df7ccee6563afa275
Opcode Fuzzy Hash: c0dce512570cca7e4e860aae9860db8f32a2c5afb9540998f5dcff44c2b32fd0
Instruction Fuzzy Hash: 74913972F28D6187E758C67A985226A26629B897B5F148335ED3ECBBD4CE2CD8018740

Function 00007FF66CB40A80 Relevance: .2, Instructions: 216COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1614887424.00007FF66CB31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF66CB30000, based on PE: true

Associated: 00000002.00000002.1614859264.00007FF66CB30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1615114616.00007FF66CD5F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1615136598.00007FF66CD6E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1615174624.00007FF66CDB6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1615174624.00007FF66CDB9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1615174624.00007FF66CE0F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1615174624.00007FF66CE4A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1615313210.00007FF66CE4E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff66cb30000_EMfRi659Ir.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 01971fc9c910d40765ece829d259352d0a8221d2c1b0b18a719987a781caaf87
Instruction ID: b78e8341c51b2f9511ff41334ade2d3147cbc7c8b01bb08af8736b59f9051301
Opcode Fuzzy Hash: 01971fc9c910d40765ece829d259352d0a8221d2c1b0b18a719987a781caaf87
Instruction Fuzzy Hash: 1E815B72718A8186EA44C679A85156A67A2DBDA7F0F50C335EE7EDF7D8DE3CD0018700

Function 00007FF66CB3316B Relevance: .2, Instructions: 198COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1614887424.00007FF66CB31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF66CB30000, based on PE: true

Associated: 00000002.00000002.1614859264.00007FF66CB30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1615114616.00007FF66CD5F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1615136598.00007FF66CD6E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1615174624.00007FF66CDB6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1615174624.00007FF66CDB9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1615174624.00007FF66CE0F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1615174624.00007FF66CE4A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1615313210.00007FF66CE4E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff66cb30000_EMfRi659Ir.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d93a2096766eae84881d122a5ce17ad27e4b4bf90b20fa71683d0e87c478b8be
Instruction ID: 640df1fdf66e8e351fd0995d7dfd662ff3790fec83465b2748360bd624e2384c
Opcode Fuzzy Hash: d93a2096766eae84881d122a5ce17ad27e4b4bf90b20fa71683d0e87c478b8be
Instruction Fuzzy Hash: 62713663B14A91C7FB148BB698513B92AA2E71A7F5F109335EE3E8B7D5CD2CD5418300

Function 00007FF66CB7BA70 Relevance: .2, Instructions: 193COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1614887424.00007FF66CB31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF66CB30000, based on PE: true

Associated: 00000002.00000002.1614859264.00007FF66CB30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1615114616.00007FF66CD5F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1615136598.00007FF66CD6E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1615174624.00007FF66CDB6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1615174624.00007FF66CDB9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1615174624.00007FF66CE0F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1615174624.00007FF66CE4A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1615313210.00007FF66CE4E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff66cb30000_EMfRi659Ir.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 201f44f6f6d04e56d651f72a5f9e31a6f23a30869d87437667d28997985bec5b
Instruction ID: 49a585ac927983e74d6dee84a13af2457063965adf6f7e2c1f53db4cde4560d3
Opcode Fuzzy Hash: 201f44f6f6d04e56d651f72a5f9e31a6f23a30869d87437667d28997985bec5b
Instruction Fuzzy Hash: D0712F32B39D5582E754CB3AA851B2776A2A7D5BA1F109335ED6ECBBD4CE3CD8018700

Function 00007FF66CB392E0 Relevance: .2, Instructions: 156COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1614887424.00007FF66CB31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF66CB30000, based on PE: true

Associated: 00000002.00000002.1614859264.00007FF66CB30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1615114616.00007FF66CD5F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1615136598.00007FF66CD6E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1615174624.00007FF66CDB6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1615174624.00007FF66CDB9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1615174624.00007FF66CE0F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1615174624.00007FF66CE4A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1615313210.00007FF66CE4E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff66cb30000_EMfRi659Ir.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fd128c612d5c08fe1fb120a982284aa4d101e8b19627c461be1d9eda26ff3d11
Instruction ID: 94b8a1ba565a2520bd27f68c418c17eedbd7788661842eb332100af6cd0c125a
Opcode Fuzzy Hash: fd128c612d5c08fe1fb120a982284aa4d101e8b19627c461be1d9eda26ff3d11
Instruction Fuzzy Hash: E761A872A18F5182EB108B79E85162A7BA1F7867B4F505721EABD8B7E8DF3CD4408700

Function 00007FF66CC1B9D8 Relevance: .2, Instructions: 155COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1614887424.00007FF66CB31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF66CB30000, based on PE: true

Associated: 00000002.00000002.1614859264.00007FF66CB30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1615114616.00007FF66CD5F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1615136598.00007FF66CD6E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1615174624.00007FF66CDB6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1615174624.00007FF66CDB9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1615174624.00007FF66CE0F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1615174624.00007FF66CE4A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1615313210.00007FF66CE4E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff66cb30000_EMfRi659Ir.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5abc14fdc8d0c46988c44e531ba42b8c7faa5b0317ab1a31f89f96c3bc02b2fd
Instruction ID: 8d4be3114eae700741f869e1a57af16d6668f8ee00293c3875287fbeef4eace9
Opcode Fuzzy Hash: 5abc14fdc8d0c46988c44e531ba42b8c7faa5b0317ab1a31f89f96c3bc02b2fd
Instruction Fuzzy Hash: 27614962F10F54C8FF14DABAD4A13AA2771AB59BB4F109726DE3D5B7D8DE28C0918300

Function 00007FF66CB78D20 Relevance: .2, Instructions: 155COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1614887424.00007FF66CB31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF66CB30000, based on PE: true

Associated: 00000002.00000002.1614859264.00007FF66CB30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1615114616.00007FF66CD5F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1615136598.00007FF66CD6E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1615174624.00007FF66CDB6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1615174624.00007FF66CDB9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1615174624.00007FF66CE0F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1615174624.00007FF66CE4A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1615313210.00007FF66CE4E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff66cb30000_EMfRi659Ir.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 914a90bc30866eafb57e86a3227da838d87067056f4f751910ba283932414035
Instruction ID: 4f4b3795ac9fbf12f28557fa2533eedde33f3708db37fbdcc88b6fa4f806d31c
Opcode Fuzzy Hash: 914a90bc30866eafb57e86a3227da838d87067056f4f751910ba283932414035
Instruction Fuzzy Hash: 0D510D76B28F5082DB44CB6AE85152A77B2E7DABE0F145235E95DDBBA4CE2CD4018B00

Function 00007FF66CB3C6A0 Relevance: .2, Instructions: 150COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1614887424.00007FF66CB31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF66CB30000, based on PE: true

Associated: 00000002.00000002.1614859264.00007FF66CB30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1615114616.00007FF66CD5F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1615136598.00007FF66CD6E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1615174624.00007FF66CDB6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1615174624.00007FF66CDB9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1615174624.00007FF66CE0F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1615174624.00007FF66CE4A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1615313210.00007FF66CE4E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff66cb30000_EMfRi659Ir.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5490750b97ab2916fd0956311d7d5d4343643a6e68e8e4c4bec7e72c20504d18
Instruction ID: b806473792c36f39fab79eb94b2fbbdb7ba9bc288e381ff20aa4d06f0c55df91
Opcode Fuzzy Hash: 5490750b97ab2916fd0956311d7d5d4343643a6e68e8e4c4bec7e72c20504d18
Instruction Fuzzy Hash: A651E432B28D6187D25896789C1127666B2DB86730FA44735F67ECFBE4CE7CD8008B04

Function 00007FF66CB375C8 Relevance: .1, Instructions: 148COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1614887424.00007FF66CB31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF66CB30000, based on PE: true

Associated: 00000002.00000002.1614859264.00007FF66CB30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1615114616.00007FF66CD5F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1615136598.00007FF66CD6E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1615174624.00007FF66CDB6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1615174624.00007FF66CDB9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1615174624.00007FF66CE0F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1615174624.00007FF66CE4A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1615313210.00007FF66CE4E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff66cb30000_EMfRi659Ir.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6bb0e7c39fa2d1bff75553abd23c58eb06594b1aa90817c6ace9224ae858f7dc
Instruction ID: a9352ca1155311acd143ebf1f77c19dfdddf118f97ce574add2aab5950555058
Opcode Fuzzy Hash: 6bb0e7c39fa2d1bff75553abd23c58eb06594b1aa90817c6ace9224ae858f7dc
Instruction Fuzzy Hash: F751A7B7A14F94C3EE00CB6AA4613AA6765E746BF1F205325EE7E6B7D4DE2CD4018600

Function 00007FF66CB7B7D0 Relevance: .1, Instructions: 147COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1614887424.00007FF66CB31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF66CB30000, based on PE: true

Associated: 00000002.00000002.1614859264.00007FF66CB30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1615114616.00007FF66CD5F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1615136598.00007FF66CD6E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1615174624.00007FF66CDB6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1615174624.00007FF66CDB9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1615174624.00007FF66CE0F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1615174624.00007FF66CE4A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1615313210.00007FF66CE4E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff66cb30000_EMfRi659Ir.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 25b93aabc8f17dba9367218e0902c9ae1635fd4bdcbd885e767d0ef09509f9a3
Instruction ID: 4a3b993c041f3de3087038eda0cba280a3a4e3ecb7cbcf67f6c1788e7ef293f5
Opcode Fuzzy Hash: 25b93aabc8f17dba9367218e0902c9ae1635fd4bdcbd885e767d0ef09509f9a3
Instruction Fuzzy Hash: 0851E932B28E90C2DB50DB26E45175AA7B1EBCA794F105235EA9DCBF98CE3DD4018F00

Function 00007FF66CB7B160 Relevance: .1, Instructions: 145COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1614887424.00007FF66CB31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF66CB30000, based on PE: true

Associated: 00000002.00000002.1614859264.00007FF66CB30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1615114616.00007FF66CD5F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1615136598.00007FF66CD6E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1615174624.00007FF66CDB6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1615174624.00007FF66CDB9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1615174624.00007FF66CE0F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1615174624.00007FF66CE4A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1615313210.00007FF66CE4E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff66cb30000_EMfRi659Ir.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 41b865182212062200e58a14f55851103bb5f4ac6215e4507b410943ec29b0fd
Instruction ID: 4c89840ec860fd8fc9af347c51f8a6622f1f0a39b20d3a25b78bf1f136641cdd
Opcode Fuzzy Hash: 41b865182212062200e58a14f55851103bb5f4ac6215e4507b410943ec29b0fd
Instruction Fuzzy Hash: EE51EB33B29F5182DB60C71AF451B2A67A1E7D9BE1F105231ED5E8BFA4CE2CD5418B00

Function 00007FF66CB40950 Relevance: .1, Instructions: 142COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1614887424.00007FF66CB31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF66CB30000, based on PE: true

Associated: 00000002.00000002.1614859264.00007FF66CB30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1615114616.00007FF66CD5F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1615136598.00007FF66CD6E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1615174624.00007FF66CDB6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1615174624.00007FF66CDB9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1615174624.00007FF66CE0F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1615174624.00007FF66CE4A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1615313210.00007FF66CE4E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff66cb30000_EMfRi659Ir.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 78e35f373a2dc23ccf9bbbabd0ae2063f1257acc4a0ba5c0e8353693e6aea1b7
Instruction ID: 20de5f979d04da0343cf33f58bdea6007c69078f46c1bf5661b3366cc73804d0
Opcode Fuzzy Hash: 78e35f373a2dc23ccf9bbbabd0ae2063f1257acc4a0ba5c0e8353693e6aea1b7
Instruction Fuzzy Hash: 39514C72B29F9182EE14C679A85026A6662DB9A7E0F50C331EA6DDF7D8CE2CD0018704

Function 00007FF66CB41EB0 Relevance: .1, Instructions: 142COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1614887424.00007FF66CB31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF66CB30000, based on PE: true

Associated: 00000002.00000002.1614859264.00007FF66CB30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1615114616.00007FF66CD5F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1615136598.00007FF66CD6E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1615174624.00007FF66CDB6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1615174624.00007FF66CDB9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1615174624.00007FF66CE0F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1615174624.00007FF66CE4A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1615313210.00007FF66CE4E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff66cb30000_EMfRi659Ir.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7ced36342bd6018fa1bd12d8c557f6cc74d9c3b78d28b75916ee81cada8f4d88
Instruction ID: 392860785d7c15234b6a1d1d48aae0969165157aed5563d1e7623dfe0aeab10d
Opcode Fuzzy Hash: 7ced36342bd6018fa1bd12d8c557f6cc74d9c3b78d28b75916ee81cada8f4d88
Instruction Fuzzy Hash: 02510A36B2CE5182EB14CA39E85176A2762E7867B5F149335FA7ECBBD8CE2DD4014700

Function 00007FF66CB3143E Relevance: .1, Instructions: 139COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1614887424.00007FF66CB31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF66CB30000, based on PE: true

Associated: 00000002.00000002.1614859264.00007FF66CB30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1615114616.00007FF66CD5F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1615136598.00007FF66CD6E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1615174624.00007FF66CDB6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1615174624.00007FF66CDB9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1615174624.00007FF66CE0F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1615174624.00007FF66CE4A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1615313210.00007FF66CE4E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff66cb30000_EMfRi659Ir.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 31fa901062d33301a9723b6844fb4856b7587dd8d1eaafd11f60bdca63199bb7
Instruction ID: a3345deb5a189aff28e1f16bb4f6976b6eb9246d0a18f20fd04d3886db936c30
Opcode Fuzzy Hash: 31fa901062d33301a9723b6844fb4856b7587dd8d1eaafd11f60bdca63199bb7
Instruction Fuzzy Hash: 36519232B19E51C2DA50DB25E85132E77B4EBCABA1F500231EA8ECB7A5CE2CD841C701

Function 00007FF66CB39090 Relevance: .1, Instructions: 130COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1614887424.00007FF66CB31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF66CB30000, based on PE: true

Associated: 00000002.00000002.1614859264.00007FF66CB30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1615114616.00007FF66CD5F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1615136598.00007FF66CD6E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1615174624.00007FF66CDB6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1615174624.00007FF66CDB9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1615174624.00007FF66CE0F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1615174624.00007FF66CE4A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1615313210.00007FF66CE4E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff66cb30000_EMfRi659Ir.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dbd56fa87474e985b56ff6bd40b240c993b3b23706c46d6bdd1c5527a2c3eb6b
Instruction ID: 27217d9ae910b5617b03cebc242610425dce2f728f1a667ecc4476f752470d67
Opcode Fuzzy Hash: dbd56fa87474e985b56ff6bd40b240c993b3b23706c46d6bdd1c5527a2c3eb6b
Instruction Fuzzy Hash: B0514E32B18F4182DA548B39E85136A77A1E7C97B0F508726E6BE8B7E8DF3CD4518704

Function 00007FF66CB3CDA0 Relevance: .1, Instructions: 129COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1614887424.00007FF66CB31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF66CB30000, based on PE: true

Associated: 00000002.00000002.1614859264.00007FF66CB30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1615114616.00007FF66CD5F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1615136598.00007FF66CD6E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1615174624.00007FF66CDB6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1615174624.00007FF66CDB9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1615174624.00007FF66CE0F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1615174624.00007FF66CE4A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1615313210.00007FF66CE4E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff66cb30000_EMfRi659Ir.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c41213fa36da5b48168a1e6d5fe76ea21fd63864a92ae5c03fcae81925d89987
Instruction ID: b35aeb3606a52f51e528a5a6068c5558f61ca476eab6154f29792b5a00fcb5e0
Opcode Fuzzy Hash: c41213fa36da5b48168a1e6d5fe76ea21fd63864a92ae5c03fcae81925d89987
Instruction Fuzzy Hash: 9951FC63718A9086DB14C779A82126B6BA2D7977B0F148735FBBD8B7D9CD2DC4008B00

Function 00007FF66CC01D40 Relevance: .1, Instructions: 127COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1614887424.00007FF66CB31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF66CB30000, based on PE: true

Associated: 00000002.00000002.1614859264.00007FF66CB30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1615114616.00007FF66CD5F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1615136598.00007FF66CD6E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1615174624.00007FF66CDB6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1615174624.00007FF66CDB9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1615174624.00007FF66CE0F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1615174624.00007FF66CE4A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1615313210.00007FF66CE4E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff66cb30000_EMfRi659Ir.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d71b1373ba1e802e9c0cf35db5ba50a78ba3d3b6dbd345608121c2dc46d188c1
Instruction ID: 49f4e2246206110cb46482678d6cf3762c2efb6ebcb7ae21e9c840595dc9ad31
Opcode Fuzzy Hash: d71b1373ba1e802e9c0cf35db5ba50a78ba3d3b6dbd345608121c2dc46d188c1
Instruction Fuzzy Hash: 03416BB3B28D4081EB58C778AC212777BA29B967B1F249335EA7ACB7D5CE1DC0404740

Function 00007FF66CB95550 Relevance: .1, Instructions: 125COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1614887424.00007FF66CB31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF66CB30000, based on PE: true

Associated: 00000002.00000002.1614859264.00007FF66CB30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1615114616.00007FF66CD5F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1615136598.00007FF66CD6E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1615174624.00007FF66CDB6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1615174624.00007FF66CDB9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1615174624.00007FF66CE0F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1615174624.00007FF66CE4A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1615313210.00007FF66CE4E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff66cb30000_EMfRi659Ir.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4db4b8dc34e4d39c9ac234305d8665cc966e7d4d7145751fd7b07199ef313960
Instruction ID: cf33513d209ae83e60da38c370f49143dacf8ad3439c8cafd98e40a4bf23ca9d
Opcode Fuzzy Hash: 4db4b8dc34e4d39c9ac234305d8665cc966e7d4d7145751fd7b07199ef313960
Instruction Fuzzy Hash: 0E41D722B58A51C2DB14C725D99133A77B1ABEA7A1F548335EA6ECB7E4CE2CD4018700

Function 00007FF66CC1B7E0 Relevance: .1, Instructions: 123COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1614887424.00007FF66CB31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF66CB30000, based on PE: true

Associated: 00000002.00000002.1614859264.00007FF66CB30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1615114616.00007FF66CD5F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1615136598.00007FF66CD6E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1615174624.00007FF66CDB6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1615174624.00007FF66CDB9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1615174624.00007FF66CE0F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1615174624.00007FF66CE4A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1615313210.00007FF66CE4E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff66cb30000_EMfRi659Ir.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9c9886b557990912b0d89a5c198d7b56921d4cb125dd1933c7c73d3724e806c0
Instruction ID: c86320c3e21861c1af10568d2dfeab8927339f67b2f381159622abd082dcae6d
Opcode Fuzzy Hash: 9c9886b557990912b0d89a5c198d7b56921d4cb125dd1933c7c73d3724e806c0
Instruction Fuzzy Hash: E4418F63738A5182EB648B3BA82272A6AB1D7427F4F105735ED7ACBFD5CD1DE0414B00

Function 00007FF66CB78190 Relevance: .1, Instructions: 114COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1614887424.00007FF66CB31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF66CB30000, based on PE: true

Associated: 00000002.00000002.1614859264.00007FF66CB30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1615114616.00007FF66CD5F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1615136598.00007FF66CD6E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1615174624.00007FF66CDB6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1615174624.00007FF66CDB9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1615174624.00007FF66CE0F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1615174624.00007FF66CE4A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1615313210.00007FF66CE4E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff66cb30000_EMfRi659Ir.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4324adf97f3402506e0e30f12422ca5792a18be4995fef3a8b795dfe9314b5e2
Instruction ID: 800c72a698832368e9a499008d8c4452f45df50b2d8d2e84851e0fefd231b23d
Opcode Fuzzy Hash: 4324adf97f3402506e0e30f12422ca5792a18be4995fef3a8b795dfe9314b5e2
Instruction Fuzzy Hash: 2D412433729E4186DA44CA3DA85127E77B1A78A730F64933AEA7ECB7D4CE2DD0018700

Function 00007FF66CB796B0 Relevance: .1, Instructions: 108COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1614887424.00007FF66CB31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF66CB30000, based on PE: true

Associated: 00000002.00000002.1614859264.00007FF66CB30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1615114616.00007FF66CD5F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1615136598.00007FF66CD6E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1615174624.00007FF66CDB6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1615174624.00007FF66CDB9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1615174624.00007FF66CE0F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1615174624.00007FF66CE4A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1615313210.00007FF66CE4E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff66cb30000_EMfRi659Ir.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6a48d4902eb25708f0a142a32f4c57a45bd762939ccacd012fceb0af4225bc36
Instruction ID: 488871bcda00c87098955dfae3839e50a4e74953d2eeced583da2ef1f2bc9bc9
Opcode Fuzzy Hash: 6a48d4902eb25708f0a142a32f4c57a45bd762939ccacd012fceb0af4225bc36
Instruction Fuzzy Hash: 72416F72F38D91826654CBBBAC52E67695257A67F87109B25ED3ADFBE4CE3CE0004300

Function 00007FF66CB32DF0 Relevance: .1, Instructions: 104COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1614887424.00007FF66CB31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF66CB30000, based on PE: true

Associated: 00000002.00000002.1614859264.00007FF66CB30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1615114616.00007FF66CD5F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1615136598.00007FF66CD6E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1615174624.00007FF66CDB6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1615174624.00007FF66CDB9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1615174624.00007FF66CE0F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1615174624.00007FF66CE4A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1615313210.00007FF66CE4E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff66cb30000_EMfRi659Ir.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 913dc2f2094a2ef6804a65b91a15564e657f86fd978184824815659326a4dba3
Instruction ID: 5e052af2ff37d1d6c75c73ab12bdd6c4d7dc231927558e2ffbd30d75ac7a0f84
Opcode Fuzzy Hash: 913dc2f2094a2ef6804a65b91a15564e657f86fd978184824815659326a4dba3
Instruction Fuzzy Hash: F441F677B28D51C7E7588728DC5213A22729BC9761B648339E66ECF7E5CE3CD8028B01

Function 00007FF66CB36DA0 Relevance: .1, Instructions: 101COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1614887424.00007FF66CB31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF66CB30000, based on PE: true

Associated: 00000002.00000002.1614859264.00007FF66CB30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1615114616.00007FF66CD5F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1615136598.00007FF66CD6E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1615174624.00007FF66CDB6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1615174624.00007FF66CDB9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1615174624.00007FF66CE0F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1615174624.00007FF66CE4A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1615313210.00007FF66CE4E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff66cb30000_EMfRi659Ir.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4ff349c07daa467edf2ec47f87510373623e86cc5eb2d5d57195e604873a2c99
Instruction ID: a577017c3ddb1837527bf1658af09c68ad25c4174da14a7d0f2bcfca15227a9e
Opcode Fuzzy Hash: 4ff349c07daa467edf2ec47f87510373623e86cc5eb2d5d57195e604873a2c99
Instruction Fuzzy Hash: 984127B6B18E8082D7148779985126A3A61E79ABB4F145325FE7E9B7E5CF2CC410C700

Function 00007FF66CB78B90 Relevance: .1, Instructions: 93COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1614887424.00007FF66CB31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF66CB30000, based on PE: true

Associated: 00000002.00000002.1614859264.00007FF66CB30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1615114616.00007FF66CD5F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1615136598.00007FF66CD6E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1615174624.00007FF66CDB6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1615174624.00007FF66CDB9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1615174624.00007FF66CE0F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1615174624.00007FF66CE4A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1615313210.00007FF66CE4E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff66cb30000_EMfRi659Ir.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 112817fc274805bf5090e48346b1a99fe352ddca5411a3ae31fa58c082f764d4
Instruction ID: 5ef2cc9875ce3e68a724ba5a32ff0b9e17e4398ed4581377e0b614805b142025
Opcode Fuzzy Hash: 112817fc274805bf5090e48346b1a99fe352ddca5411a3ae31fa58c082f764d4
Instruction Fuzzy Hash: EF315773F34E10CAF7489BBADC8217E26B2AB59710F148235DA2DDB794DE38D0618320

Function 00007FF66CB78750 Relevance: .1, Instructions: 91COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1614887424.00007FF66CB31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF66CB30000, based on PE: true

Associated: 00000002.00000002.1614859264.00007FF66CB30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1615114616.00007FF66CD5F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1615136598.00007FF66CD6E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1615174624.00007FF66CDB6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1615174624.00007FF66CDB9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1615174624.00007FF66CE0F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1615174624.00007FF66CE4A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1615313210.00007FF66CE4E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff66cb30000_EMfRi659Ir.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e4360438753c92bfbf198194a8da78cd126ba5765691bf4f71cfb58f5f96c1ae
Instruction ID: 17cf1ad44ca9bf4910f711bbc280dc8b67d2709c6ea4f86f3e37a9b5138c032c
Opcode Fuzzy Hash: e4360438753c92bfbf198194a8da78cd126ba5765691bf4f71cfb58f5f96c1ae
Instruction Fuzzy Hash: BD312832B26D6043975CCA3A9C5222B66635BD53B0B54933AF93ACBBD8CE2CD5024704

Function 00007FF66CC63F10 Relevance: .1, Instructions: 90COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1614887424.00007FF66CB31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF66CB30000, based on PE: true

Associated: 00000002.00000002.1614859264.00007FF66CB30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1615114616.00007FF66CD5F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1615136598.00007FF66CD6E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1615174624.00007FF66CDB6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1615174624.00007FF66CDB9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1615174624.00007FF66CE0F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1615174624.00007FF66CE4A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1615313210.00007FF66CE4E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff66cb30000_EMfRi659Ir.jbxd

Similarity

API ID: Value
String ID:
API String ID: 3702945584-0
Opcode ID: 1a5ecb8c25196eba6d57b83327677abb990c5c844705fda20a9656d7f8895d88
Instruction ID: e9604b3f9e22990c7e347fe0ae493203f7a43c044069ca5abbd66575ac23009c
Opcode Fuzzy Hash: 1a5ecb8c25196eba6d57b83327677abb990c5c844705fda20a9656d7f8895d88
Instruction Fuzzy Hash: 64311732B38E0182EA58CB3AED5113A72F1A785350F504639E65ECBBE4CE2DC4018B00

Function 00007FF66CB95990 Relevance: .1, Instructions: 88COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1614887424.00007FF66CB31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF66CB30000, based on PE: true

Associated: 00000002.00000002.1614859264.00007FF66CB30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1615114616.00007FF66CD5F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1615136598.00007FF66CD6E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1615174624.00007FF66CDB6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1615174624.00007FF66CDB9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1615174624.00007FF66CE0F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1615174624.00007FF66CE4A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1615313210.00007FF66CE4E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff66cb30000_EMfRi659Ir.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: baf499bde155881364829d4d41de66891fa594a8140cacf784a685c20619e89c
Instruction ID: a6c2eed1b954ac860468618b428a99d82eceba34da0b8dbdaf024acf841a81ff
Opcode Fuzzy Hash: baf499bde155881364829d4d41de66891fa594a8140cacf784a685c20619e89c
Instruction Fuzzy Hash: 6E31B272B6895183E74C8A39DC6223A76619B97771F24873DE67BCB7E0CE1CC4014708

Function 00007FF66CB372F2 Relevance: .1, Instructions: 88COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1614887424.00007FF66CB31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF66CB30000, based on PE: true

Associated: 00000002.00000002.1614859264.00007FF66CB30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1615114616.00007FF66CD5F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1615136598.00007FF66CD6E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1615174624.00007FF66CDB6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1615174624.00007FF66CDB9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1615174624.00007FF66CE0F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1615174624.00007FF66CE4A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1615313210.00007FF66CE4E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff66cb30000_EMfRi659Ir.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c5363a9de25a010a3d626757aa8728d562387b0913ee9c0bd2bdc58f44a02355
Instruction ID: cc378b50a92d7a98078eb8c62f9f5c30d3eb290fafd452c2f78f7bbf0c774e63
Opcode Fuzzy Hash: c5363a9de25a010a3d626757aa8728d562387b0913ee9c0bd2bdc58f44a02355
Instruction Fuzzy Hash: 7931F8B2714E90C2FD54C776A9227A75752AB46BF4E10A332FE7E5B7D9CE2CD0015600

Function 00007FF66CB31590 Relevance: .1, Instructions: 79COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1614887424.00007FF66CB31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF66CB30000, based on PE: true

Associated: 00000002.00000002.1614859264.00007FF66CB30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1615114616.00007FF66CD5F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1615136598.00007FF66CD6E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1615174624.00007FF66CDB6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1615174624.00007FF66CDB9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1615174624.00007FF66CE0F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1615174624.00007FF66CE4A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1615313210.00007FF66CE4E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff66cb30000_EMfRi659Ir.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 64c7c7d9d2fe2fdd3a54f242908af4f48b9254c3d2831139dd03113548b2e03a
Instruction ID: 8f52c1359434e4e4bcaf4d7af75812e53988b44ed2b9418379e6d9cf54a889ad
Opcode Fuzzy Hash: 64c7c7d9d2fe2fdd3a54f242908af4f48b9254c3d2831139dd03113548b2e03a
Instruction Fuzzy Hash: 26213EB3B398218292688739A801867259297A67B47546739E97ECFBD4CE2CD4524F04

Function 00007FF66CC01F2C Relevance: .1, Instructions: 68COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1614887424.00007FF66CB31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF66CB30000, based on PE: true

Associated: 00000002.00000002.1614859264.00007FF66CB30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1615114616.00007FF66CD5F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1615136598.00007FF66CD6E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1615174624.00007FF66CDB6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1615174624.00007FF66CDB9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1615174624.00007FF66CE0F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1615174624.00007FF66CE4A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1615313210.00007FF66CE4E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff66cb30000_EMfRi659Ir.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9ab32c668e71f8e363e22874e7fbfa9a1772f24b7d6b14cd9c2cf796a7f09244
Instruction ID: 136b628c9f7d1fa63d00dfcaa755e3b4ef6320cfbf693b65809700d862b3fe1c
Opcode Fuzzy Hash: 9ab32c668e71f8e363e22874e7fbfa9a1772f24b7d6b14cd9c2cf796a7f09244
Instruction Fuzzy Hash: 50312DB1729F4081EE50DA79986126A6661EB85BF0F10A325FE7E4B7E4CF2DD0108600

Function 00007FF66CB95850 Relevance: .1, Instructions: 68COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1614887424.00007FF66CB31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF66CB30000, based on PE: true

Associated: 00000002.00000002.1614859264.00007FF66CB30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1615114616.00007FF66CD5F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1615136598.00007FF66CD6E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1615174624.00007FF66CDB6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1615174624.00007FF66CDB9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1615174624.00007FF66CE0F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1615174624.00007FF66CE4A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1615313210.00007FF66CE4E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff66cb30000_EMfRi659Ir.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 22e4e3e16e195032f42afe1707115552a54746ec1026e54ed335814262f420ca
Instruction ID: ec4cb46c290b050c39f9a61224b0bcccea8481472c07c3183af1c0f7bbdcd988
Opcode Fuzzy Hash: 22e4e3e16e195032f42afe1707115552a54746ec1026e54ed335814262f420ca
Instruction Fuzzy Hash: D0217E32F38A5182E724CB39E84582A7BB2979B7A5F448335D94DCBAE5CE2CD1058B04

Function 00007FF66CB37100 Relevance: .1, Instructions: 64COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1614887424.00007FF66CB31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF66CB30000, based on PE: true

Associated: 00000002.00000002.1614859264.00007FF66CB30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1615114616.00007FF66CD5F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1615136598.00007FF66CD6E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1615174624.00007FF66CDB6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1615174624.00007FF66CDB9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1615174624.00007FF66CE0F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1615174624.00007FF66CE4A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1615313210.00007FF66CE4E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff66cb30000_EMfRi659Ir.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e58192846ef1a76b528f5e94a050e0c0a35c40baa889fb5d59d3f0287f8de57a
Instruction ID: d77f5866553d82c28caa4de54f61fe31d3d0418228d7370b434587766c99a5c4
Opcode Fuzzy Hash: e58192846ef1a76b528f5e94a050e0c0a35c40baa889fb5d59d3f0287f8de57a
Instruction Fuzzy Hash: AC213673B6884283C7188F38B81256A2BA2A7887A4F445724EA1ECFBE8CD3CD5104A00

Function 00007FF66CB7AD90 Relevance: .1, Instructions: 60COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1614887424.00007FF66CB31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF66CB30000, based on PE: true

Associated: 00000002.00000002.1614859264.00007FF66CB30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1615114616.00007FF66CD5F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1615136598.00007FF66CD6E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1615174624.00007FF66CDB6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1615174624.00007FF66CDB9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1615174624.00007FF66CE0F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1615174624.00007FF66CE4A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1615313210.00007FF66CE4E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff66cb30000_EMfRi659Ir.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 59ed5f5d2754730b0756c3707a50136efd2a54078264712cf85a947caf049a92
Instruction ID: dc3513a3809faea23579758c6f24057beaa39634e8736dd51e12dfda19907d4a
Opcode Fuzzy Hash: 59ed5f5d2754730b0756c3707a50136efd2a54078264712cf85a947caf049a92
Instruction Fuzzy Hash: C021DA77B289118BD358CB7AA8450667672D7C9361B549339EA1ACB7D8CE3CE5019F00

Function 00007FF66CB3287D Relevance: .1, Instructions: 58COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1614887424.00007FF66CB31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF66CB30000, based on PE: true

Associated: 00000002.00000002.1614859264.00007FF66CB30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1615114616.00007FF66CD5F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1615136598.00007FF66CD6E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1615174624.00007FF66CDB6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1615174624.00007FF66CDB9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1615174624.00007FF66CE0F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1615174624.00007FF66CE4A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1615313210.00007FF66CE4E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff66cb30000_EMfRi659Ir.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f3d84d55f720809a0a3218907a6e70eab9e61edc168425385dcba0c2de1c65e1
Instruction ID: 7cb5698979ffe68297bd3d27ff63225b2635d3512b148086677c716a44ac2f66
Opcode Fuzzy Hash: f3d84d55f720809a0a3218907a6e70eab9e61edc168425385dcba0c2de1c65e1
Instruction Fuzzy Hash: 39112273F6587097236C8ABA58116AA25626BC8771364C328DD3E9BBD8CE349D028684

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report EMfRi659Ir.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Networking

System Summary

Data Obfuscation

Malware Analysis System Evasion

Anti Debugging

Language, Device and Operating System Detection

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

URLs from Memory and Binaries

World Map of Contacted IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Data Directories

Sections

Resources

Imports

Possible Origin

Network Behavior

Network Port Distribution

UDP Packets

DNS Queries

DNS Answers

Statistics

CPU Usage

Memory Usage

High Level Behavior Distribution

back

System Behavior

Analysis Process: EMfRi659Ir.exePID: 7992, Parent PID: 3504

General

Chronological Activities

Disassembly

Analysis Process: EMfRi659Ir.exePID: 7992, Parent PID: 3504COMMON

Execution Graph

Windows Analysis Report
EMfRi659Ir.exe

Function 00007FF66CB311B5 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 97
COMMON

Function 00007FF66CB3F25B Relevance: 6.8, APIs: 1, Strings: 3, Instructions: 828
COMMON

Function 00007FF66CB3D180 Relevance: 3.9, Strings: 3, Instructions: 153
COMMON

Function 00007FF66CB3BB10 Relevance: 2.0, Strings: 1, Instructions: 712
COMMON

Function 00007FF66CB34520 Relevance: 1.6, APIs: 1, Instructions: 139
threadCOMMON

Function 00007FF66CB414B0 Relevance: 1.6, APIs: 1, Instructions: 80
libraryCOMMON

Function 00007FF66CC56900 Relevance: 1.6, APIs: 1, Instructions: 79
COMMON

Function 00007FF66CB3B370 Relevance: 1.5, APIs: 1, Instructions: 240
COMMON

Function 00007FF66CD5D8C0 Relevance: 3.7, APIs: 1, Strings: 1, Instructions: 167
memoryCOMMON

Function 00007FF66CD5DB3C Relevance: 1.6, APIs: 1, Instructions: 61
memoryCOMMON

Function 00007FF66CB3439A Relevance: 1.6, APIs: 1, Instructions: 56
threadCOMMON

Function 00007FF66CB37500 Relevance: 1.3, APIs: 1, Instructions: 47
COMMON