Edit tour

Windows Analysis Report
ReaderPDFadobe.exe

Overview

General Information

Sample name:	ReaderPDFadobe.exe
Analysis ID:	1587448
MD5:	5b3f4288f2239f1805e7d5c935fec648
SHA1:	3e7d6b9b8e8549bd5e359c79e64829da329c0f92
SHA256:	c761b3063a4cdad0061c015cda2d006077b52d833952ca912157bfa31d8a975d
Tags:	exeuser-zhuzhu0009
Infos:

Detection

Score:	80
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Detected unpacking (creates a PE file in dynamic memory)

Multi AV Scanner detection for submitted file

AI detected suspicious sample

Allocates memory in foreign processes

Injects a PE file into a foreign processes

Queries sensitive disk information (via WMI, Win32_DiskDrive, often done to detect virtual machines)

Writes to foreign memory regions

Yara detected Costura Assembly Loader

AV process strings found (often used to terminate AV products)

Allocates memory with a write watch (potentially for evading sandboxes)

Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)

Compiles C# or VB.Net code

Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)

Contains long sleeps (>= 3 min)

Detected TCP or UDP traffic on non-standard ports

Detected potential crypto function

Enables debug privileges

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

IP address seen in connection with other malware

Launches processes in debugging mode, may be used to hinder debugging

May sleep (evasive loops) to hinder dynamic analysis

PE file contains sections with non-standard names

Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)

Queries sensitive processor information (via WMI, Win32_Processor, often done to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sample file is different than original file name gathered from version info

Uses 32bit PE files

Uses code obfuscation techniques (call, push, ret)

Classification

Process Tree

System is w10x64

ReaderPDFadobe.exe (PID: 5536 cmdline: "C:\Users\user\Desktop\ReaderPDFadobe.exe" MD5: 5B3F4288F2239F1805E7D5C935FEC648)

csc.exe (PID: 2212 cmdline: "C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" MD5: EB80BB1CA9B9C7F516FF69AFCFD75B7D)

cleanup

Malware Configuration

⊘No configs have been found

Yara Signatures

Memory Dumps

Source	Rule	Description	Author
00000005.00000002.2677754676.0000000009D20000.00000004.08000000.00040000.00000000.sdmp	JoeSecurity_CosturaAssemblyLoader	Yara detected Costura Assembly Loader	Joe Security
00000005.00000002.2675966448.00000000074E1000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CosturaAssemblyLoader	Yara detected Costura Assembly Loader	Joe Security
00000005.00000002.2676942316.0000000008681000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CosturaAssemblyLoader	Yara detected Costura Assembly Loader	Joe Security
Process Memory Space: csc.exe PID: 2212	JoeSecurity_CosturaAssemblyLoader	Yara detected Costura Assembly Loader	Joe Security

Unpacked PEs

Source	Rule	Description	Author	Strings
5.2.csc.exe.9d20000.4.raw.unpack	JoeSecurity_CosturaAssemblyLoader	Yara detected Costura Assembly Loader	Joe Security
5.2.csc.exe.87069a8.1.raw.unpack	JoeSecurity_CosturaAssemblyLoader	Yara detected Costura Assembly Loader	Joe Security

Sigma Signatures

⊘No Sigma rule has matched

Suricata Signatures

⊘No Suricata rule has matched

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Multi AV Scanner detection for submitted file

Source: ReaderPDFadobe.exe

ReversingLabs: Detection: 47%

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Compliance

Detected unpacking (creates a PE file in dynamic memory)

Source: C:\Users\user\Desktop\ReaderPDFadobe.exe

Unpacked PE file: 0.2.ReaderPDFadobe.exe.2700000.2.unpack

Source: ReaderPDFadobe.exe

Static PE information: EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE, 32BIT_MACHINE

Source: ReaderPDFadobe.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE

Source:	Binary string: Sotffzqoj.pdb source: csc.exe, 00000005.00000003.1859237874.000000000895E000.00000004.00000800.00020000.00000000.sdmp, csc.exe, 00000005.00000002.2677292369.0000000009A20000.00000004.08000000.00040000.00000000.sdmp, csc.exe, 00000005.00000003.1859237874.000000000877C000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: D:\Sources\foobar2000-2.24\foobar2000\Release\foobar2000.pdb source: ReaderPDFadobe.exe
Source:	Binary string: protobuf-net.pdbSHA256}Lq source: csc.exe, 00000005.00000003.1859237874.000000000895E000.00000004.00000800.00020000.00000000.sdmp, csc.exe, 00000005.00000002.2677630352.0000000009C50000.00000004.08000000.00040000.00000000.sdmp, csc.exe, 00000005.00000003.1859237874.0000000008A95000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: protobuf-net.pdb source: csc.exe, 00000005.00000003.1859237874.000000000895E000.00000004.00000800.00020000.00000000.sdmp, csc.exe, 00000005.00000002.2677630352.0000000009C50000.00000004.08000000.00040000.00000000.sdmp, csc.exe, 00000005.00000003.1859237874.0000000008A95000.00000004.00000800.00020000.00000000.sdmp

Source: global traffic

TCP traffic: 192.168.2.8:49709 -> 181.71.216.203:30203

Source: Joe Sandbox View

IP Address: 181.71.216.203 181.71.216.203

Source: unknown

UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic

DNS traffic detected: DNS query: newstaticfreepoint24.ddns-ip.net

Source: ReaderPDFadobe.exe	String found in binary or memory: http://forums.foobar2000.org/
Source: csc.exe, 00000005.00000002.2675966448.00000000074E1000.00000004.00000800.00020000.00000000.sdmp, csc.exe, 00000005.00000002.2675966448.0000000007589000.00000004.00000800.00020000.00000000.sdmp, csc.exe, 00000005.00000002.2675966448.000000000757D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: ReaderPDFadobe.exe	String found in binary or memory: http://wiki.hydrogenaudio.org/index.php?title=Replaygain
Source: ReaderPDFadobe.exe	String found in binary or memory: http://wiki.hydrogenaudio.org/index.php?title=ReplaygainSet
Source: ReaderPDFadobe.exe	String found in binary or memory: https://fastcopy.jp/pro/
Source: csc.exe, 00000005.00000003.1859237874.000000000895E000.00000004.00000800.00020000.00000000.sdmp, csc.exe, 00000005.00000002.2677630352.0000000009C50000.00000004.08000000.00040000.00000000.sdmp, csc.exe, 00000005.00000003.1859237874.0000000008A95000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://github.com/mgravell/protobuf-net
Source: csc.exe, 00000005.00000003.1859237874.000000000895E000.00000004.00000800.00020000.00000000.sdmp, csc.exe, 00000005.00000002.2677630352.0000000009C50000.00000004.08000000.00040000.00000000.sdmp, csc.exe, 00000005.00000003.1859237874.0000000008A95000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://github.com/mgravell/protobuf-netJ
Source: csc.exe, 00000005.00000003.1859237874.000000000895E000.00000004.00000800.00020000.00000000.sdmp, csc.exe, 00000005.00000002.2677630352.0000000009C50000.00000004.08000000.00040000.00000000.sdmp, csc.exe, 00000005.00000003.1859237874.0000000008A95000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://github.com/mgravell/protobuf-neti
Source: ReaderPDFadobe.exe	String found in binary or memory: https://help.foobar2000.org/
Source: ReaderPDFadobe.exe	String found in binary or memory: https://help.foobar2000.org/~rbvrb
Source: csc.exe, 00000005.00000003.1859237874.000000000895E000.00000004.00000800.00020000.00000000.sdmp, csc.exe, 00000005.00000002.2677630352.0000000009C50000.00000004.08000000.00040000.00000000.sdmp, csc.exe, 00000005.00000003.1859237874.0000000008A95000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://stackoverflow.com/q/11564914/23354;
Source: csc.exe, 00000005.00000002.2675966448.00000000074E1000.00000004.00000800.00020000.00000000.sdmp, csc.exe, 00000005.00000003.1859237874.000000000895E000.00000004.00000800.00020000.00000000.sdmp, csc.exe, 00000005.00000002.2677630352.0000000009C50000.00000004.08000000.00040000.00000000.sdmp, csc.exe, 00000005.00000003.1859237874.0000000008A95000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://stackoverflow.com/q/14436606/23354
Source: csc.exe, 00000005.00000003.1859237874.000000000895E000.00000004.00000800.00020000.00000000.sdmp, csc.exe, 00000005.00000002.2677630352.0000000009C50000.00000004.08000000.00040000.00000000.sdmp, csc.exe, 00000005.00000003.1859237874.0000000008A95000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://stackoverflow.com/q/2152978/23354
Source: ReaderPDFadobe.exe	String found in binary or memory: https://www.foobar2000.org/
Source: ReaderPDFadobe.exe	String found in binary or memory: https://www.foobar2000.org/download
Source: ReaderPDFadobe.exe	String found in binary or memory: https://www.foobar2000.org/downloadcomponent_manager::on_app_initPre
Source: ReaderPDFadobe.exe	String found in binary or memory: https://www.foobar2000.org/http://forums.foobar2000.org/AboutOpens
Source: ReaderPDFadobe.exe	String found in binary or memory: https://www.foobar2000.org/license
Source: ReaderPDFadobe.exe	String found in binary or memory: https://www.radio-browser.info/
Source: ReaderPDFadobe.exe	String found in binary or memory: https://www.radio-browser.info/CountryLanguageTagNameLoading...No
Source: ReaderPDFadobe.exe	String found in binary or memory: https://www.radio-browser.info/history/

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 5_2_05913C58	5_2_05913C58
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 5_2_05913C4B	5_2_05913C4B
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 5_2_09C457D0	5_2_09C457D0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 5_2_09C411D0	5_2_09C411D0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 5_2_09C4591D	5_2_09C4591D
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 5_2_09C4112B	5_2_09C4112B
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 5_2_09C410E1	5_2_09C410E1
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 5_2_09C410F0	5_2_09C410F0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 5_2_09C413D5	5_2_09C413D5
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 5_2_09C4E3B8	5_2_09C4E3B8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 5_2_09C41305	5_2_09C41305
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 5_2_09C41254	5_2_09C41254
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 5_2_09C4156A	5_2_09C4156A
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 5_2_09C414F1	5_2_09C414F1
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 5_2_09C41464	5_2_09C41464
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 5_2_09C457CD	5_2_09C457CD
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 5_2_09C41701	5_2_09C41701
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 5_2_09C416BA	5_2_09C416BA
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 5_2_09D93500	5_2_09D93500
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 5_2_09D93D38	5_2_09D93D38
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 5_2_09D92488	5_2_09D92488
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 5_2_09D96C8E	5_2_09D96C8E
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 5_2_09D91870	5_2_09D91870
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 5_2_09D95021	5_2_09D95021
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 5_2_09D95540	5_2_09D95540
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 5_2_09D94100	5_2_09D94100
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 5_2_09D93D33	5_2_09D93D33
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 5_2_09D954C8	5_2_09D954C8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 5_2_09D934F1	5_2_09D934F1
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 5_2_09D954E6	5_2_09D954E6
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 5_2_09D9545C	5_2_09D9545C
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 5_2_09D91BB8	5_2_09D91BB8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 5_2_09DCEEB8	5_2_09DCEEB8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 5_2_09DCD8F0	5_2_09DCD8F0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 5_2_09DCEEA8	5_2_09DCEEA8

Source: ReaderPDFadobe.exe, 00000000.00000002.1616951871.000000000278C000.00000040.00001000.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameFfjhitsk.exe" vs ReaderPDFadobe.exe
Source: ReaderPDFadobe.exe, 00000000.00000000.1415078549.00000000008D5000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenamefoobar2000.exeN vs ReaderPDFadobe.exe
Source: ReaderPDFadobe.exe, 00000000.00000002.1613980572.00000000008F0000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenamefoobar2000.exeN vs ReaderPDFadobe.exe
Source: ReaderPDFadobe.exe	Binary or memory string: OriginalFilenamefoobar2000.exeN vs ReaderPDFadobe.exe

Source: ReaderPDFadobe.exe

Static PE information: EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE, 32BIT_MACHINE

Source: classification engine

Classification label: mal80.evad.winEXE@3/0@1/1

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Mutant created: NULL
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Mutant created: \Sessions\1\BaseNamedObjects\mono1234

Source: ReaderPDFadobe.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe

WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor

Source: C:\Users\user\Desktop\ReaderPDFadobe.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: ReaderPDFadobe.exe, 00000000.00000000.1414991031.0000000000675000.00000002.00000001.01000000.00000003.sdmp, ReaderPDFadobe.exe, 00000000.00000002.1610647875.0000000000675000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: SELECT COUNT(*) FROM sqlite_master WHERE type='table' AND name=?;
Source: ReaderPDFadobe.exe, 00000000.00000000.1414991031.0000000000675000.00000002.00000001.01000000.00000003.sdmp, ReaderPDFadobe.exe, 00000000.00000002.1610647875.0000000000675000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: UPDATE metadb SET lastseen = ? WHERE rowid IN (SELECT rowid FROM temp.gc_present_items);

Source: ReaderPDFadobe.exe

ReversingLabs: Detection: 47%

Source: ReaderPDFadobe.exe	String found in binary or memory: /add <list-of-files> - appends the specified files to the current playlist instead of replacing the playlist content and playing them immediately
Source: ReaderPDFadobe.exe	String found in binary or memory: /play, /pause, /playpause, /prev, /next, /rand, /stop - playback controls
Source: ReaderPDFadobe.exe	String found in binary or memory: /play, /pause, /playpause, /prev, /next, /rand, /stop - playback controls
Source: ReaderPDFadobe.exe	String found in binary or memory: " /add "%1"
Source: ReaderPDFadobe.exe	String found in binary or memory: @" "addplaynow.icoicons\generic.icoSoftware\Classesfoobar2000.url.foobar2000.SOFTWARE\Classes\CLSID\{0A35F9F4-F4BE-471A-890D-E09FFA6B38AD}\InprocServer32/CommandDelegateExecute{0A35F9F4-F4BE-471A-890D-E09FFA6B38AD}Directory\shellex\ContextMenuHandlers\Fb2kShellExtPlay in foobar2000PlayerMultiSelectModel" "%1"{0A35F9F4-F4BE-471A-890D-E09FFA6B38AD}Enqueue in foobar2000" /add "%1"AudioCD\shell\play\commandbckupAudioCDAudioCDbckupAudioCD(9D
Source: ReaderPDFadobe.exe	String found in binary or memory: /install
Source: ReaderPDFadobe.exe	String found in binary or memory: /stop
Source: ReaderPDFadobe.exe	String found in binary or memory: /stop
Source: ReaderPDFadobe.exe	String found in binary or memory: BThis playlist is already an autoplaylistThis playlist is not an autoplaylistPlaylist could not be lockedautoplaylist workerAutoplaylist provider missingCould not restore autoplaylist : Multiple wildcard levels not supported./immediate/add/playnow/help/?ErrorUnknown commandline parameter: /nogui/noresume/quiet/safe/install/hardreset/keepcomponents/nocrashinfo/playlist:/config/play/pause/playpause/prev/next/rand/stop/autoquit/exit/quit/show/hideCommand-line Help/command:/playlist_command:/playing_command:/context_command:
Source: ReaderPDFadobe.exe	String found in binary or memory: BThis playlist is already an autoplaylistThis playlist is not an autoplaylistPlaylist could not be lockedautoplaylist workerAutoplaylist provider missingCould not restore autoplaylist : Multiple wildcard levels not supported./immediate/add/playnow/help/?ErrorUnknown commandline parameter: /nogui/noresume/quiet/safe/install/hardreset/keepcomponents/nocrashinfo/playlist:/config/play/pause/playpause/prev/next/rand/stop/autoquit/exit/quit/show/hideCommand-line Help/command:/playlist_command:/playing_command:/context_command:
Source: ReaderPDFadobe.exe	String found in binary or memory: BThis playlist is already an autoplaylistThis playlist is not an autoplaylistPlaylist could not be lockedautoplaylist workerAutoplaylist provider missingCould not restore autoplaylist : Multiple wildcard levels not supported./immediate/add/playnow/help/?ErrorUnknown commandline parameter: /nogui/noresume/quiet/safe/install/hardreset/keepcomponents/nocrashinfo/playlist:/config/play/pause/playpause/prev/next/rand/stop/autoquit/exit/quit/show/hideCommand-line Help/command:/playlist_command:/playing_command:/context_command:
Source: ReaderPDFadobe.exe	String found in binary or memory: BThis playlist is already an autoplaylistThis playlist is not an autoplaylistPlaylist could not be lockedautoplaylist workerAutoplaylist provider missingCould not restore autoplaylist : Multiple wildcard levels not supported./immediate/add/playnow/help/?ErrorUnknown commandline parameter: /nogui/noresume/quiet/safe/install/hardreset/keepcomponents/nocrashinfo/playlist:/config/play/pause/playpause/prev/next/rand/stop/autoquit/exit/quit/show/hideCommand-line Help/command:/playlist_command:/playing_command:/context_command:
Source: ReaderPDFadobe.exe	String found in binary or memory: /addcomponent
Source: ReaderPDFadobe.exe	String found in binary or memory: VersionChecking for Updates UTC)ModuleAbout Install ComponentComponent maintenance failureAnother instance of this component already exists in your foobar2000 application folder; you need to remove it manually before you can update this component automatically.foobar2000 components\|foo_.zip;.fb2k-componentCould not load component "": Component removal failure(unknown - please apply changes to load)/addcomponentComponentsChecks for updated versions of installed components.Check for updated componentswww.foobar2000.orgInvalid responsechallengecomponent-updatesfingerprint5www.foobar2000.org/update-componentsmax_downloadSignature mismatchx-foobar2000-signature suppressed by user settingsComponent update: .zipComponent update of failed: Download corrupted (updated from Released on

Source: unknown	Process created: C:\Users\user\Desktop\ReaderPDFadobe.exe "C:\Users\user\Desktop\ReaderPDFadobe.exe"
Source: C:\Users\user\Desktop\ReaderPDFadobe.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe"
Source: C:\Users\user\Desktop\ReaderPDFadobe.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe"	Jump to behavior

Source: C:\Users\user\Desktop\ReaderPDFadobe.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\ReaderPDFadobe.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\Desktop\ReaderPDFadobe.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\ReaderPDFadobe.exe	Section loaded: oleacc.dll	Jump to behavior
Source: C:\Users\user\Desktop\ReaderPDFadobe.exe	Section loaded: crowdstrikeceoisextragay.dll	Jump to behavior
Source: C:\Users\user\Desktop\ReaderPDFadobe.exe	Section loaded: sentinelisabadedrtrynexttimemaybe.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Section loaded: fwpuclnt.dll	Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0EE7644B-1BAD-48B1-9889-0281C206EB85}\InprocServer32

Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe

File opened: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll

Jump to behavior

Source: ReaderPDFadobe.exe

Static PE information: Virtual size of .text is bigger than: 0x100000

Source: ReaderPDFadobe.exe

Static file information: File size 5649920 > 1048576

Source: ReaderPDFadobe.exe	Static PE information: Raw size of .text is bigger than: 0x100000 < 0x273200
Source: ReaderPDFadobe.exe	Static PE information: Raw size of .rsrc is bigger than: 0x100000 < 0x241200

Source: ReaderPDFadobe.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IMPORT
Source: ReaderPDFadobe.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_RESOURCE
Source: ReaderPDFadobe.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_BASERELOC
Source: ReaderPDFadobe.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG
Source: ReaderPDFadobe.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG
Source: ReaderPDFadobe.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IAT

Source: ReaderPDFadobe.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE

Source: ReaderPDFadobe.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG

Source:	Binary string: Sotffzqoj.pdb source: csc.exe, 00000005.00000003.1859237874.000000000895E000.00000004.00000800.00020000.00000000.sdmp, csc.exe, 00000005.00000002.2677292369.0000000009A20000.00000004.08000000.00040000.00000000.sdmp, csc.exe, 00000005.00000003.1859237874.000000000877C000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: D:\Sources\foobar2000-2.24\foobar2000\Release\foobar2000.pdb source: ReaderPDFadobe.exe
Source:	Binary string: protobuf-net.pdbSHA256}Lq source: csc.exe, 00000005.00000003.1859237874.000000000895E000.00000004.00000800.00020000.00000000.sdmp, csc.exe, 00000005.00000002.2677630352.0000000009C50000.00000004.08000000.00040000.00000000.sdmp, csc.exe, 00000005.00000003.1859237874.0000000008A95000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: protobuf-net.pdb source: csc.exe, 00000005.00000003.1859237874.000000000895E000.00000004.00000800.00020000.00000000.sdmp, csc.exe, 00000005.00000002.2677630352.0000000009C50000.00000004.08000000.00040000.00000000.sdmp, csc.exe, 00000005.00000003.1859237874.0000000008A95000.00000004.00000800.00020000.00000000.sdmp

Data Obfuscation

Detected unpacking (creates a PE file in dynamic memory)

Source: C:\Users\user\Desktop\ReaderPDFadobe.exe

Unpacked PE file: 0.2.ReaderPDFadobe.exe.2700000.2.unpack

Yara detected Costura Assembly Loader

Source: Yara match	File source: 5.2.csc.exe.9d20000.4.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.2.csc.exe.87069a8.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000005.00000002.2677754676.0000000009D20000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.2675966448.00000000074E1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.2676942316.0000000008681000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: csc.exe PID: 2212, type: MEMORYSTR

Source: C:\Users\user\Desktop\ReaderPDFadobe.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe"
Source: C:\Users\user\Desktop\ReaderPDFadobe.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe"			Jump to behavior

Source: ReaderPDFadobe.exe

Static PE information: section name: _RDATA

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 5_2_09C02A05 push es; retf	5_2_09C02A06
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 5_2_09C0FD10 push ecx; retn 0009h	5_2_09C0FD5A
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 5_2_09C461A0 pushad ; retf AC09h	5_2_09C4621A
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 5_2_09C45BD1 push esi; retf 0009h	5_2_09C45BD2
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 5_2_09C492EB push esi; iretd	5_2_09C492F1
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 5_2_09C45230 push eax; retf 0009h	5_2_09C45232
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 5_2_09C45591 push edx; retf 0009h	5_2_09C45592
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 5_2_09C45569 push ecx; retf 0009h	5_2_09C4556A
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 5_2_09C45799 push edx; retf 0009h	5_2_09C4579A
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 5_2_09C49FA8 push 2C09CA7Eh; retf	5_2_09C49FAD
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 5_2_09C41677 push ss; retf	5_2_09C41683
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 5_2_09C41671 push ss; retf	5_2_09C41683
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 5_2_09D95CF1 push dword ptr [ecx+ebx*2-75h]; iretd	5_2_09D95D30
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 5_2_09D95AD0 push dword ptr [esp+esi*2-75h]; iretd	5_2_09D95ADC
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 5_2_09DCA1FF push ebx; ret	5_2_09DCA200
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 5_2_09DC99E9 push ebx; ret	5_2_09DC99EE
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 5_2_09DCA16E push ebx; ret	5_2_09DCA16F
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 5_2_09DC791D push ebx; ret	5_2_09DC791E
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 5_2_09DC6919 push esi; ret	5_2_09DC691B
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 5_2_09DC6932 push ebp; ret	5_2_09DC6934
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 5_2_09DC98F8 push ebx; ret	5_2_09DC98FE
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 5_2_09DCA08D push ebx; ret	5_2_09DCA08E
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 5_2_09DCC8B0 pushad ; iretd	5_2_09DCC8B1
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 5_2_09DC7844 push ebx; ret	5_2_09DC7846
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 5_2_09DC0031 push ebx; retn 0009h	5_2_09DC0032
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 5_2_09DCA033 push ebx; ret	5_2_09DCA034
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 5_2_09DC9B7E push ebx; ret	5_2_09DC9B7F
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 5_2_09DC9A96 push ebx; ret	5_2_09DC9A97
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 5_2_09DC8270 push ecx; ret	5_2_09DC827E
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 5_2_09DCC5FF push ebx; ret	5_2_09DCC60E
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 5_2_09DC6D97 push ecx; ret	5_2_09DC6D9E

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Queries sensitive disk information (via WMI, Win32_DiskDrive, often done to detect virtual machines)

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_DiskDrive
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_DiskDrive

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Memory allocated: 5910000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Memory allocated: 74E0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Memory allocated: 7140000 memory reserve \| memory write watch	Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe

Thread delayed: delay time: 922337203685477

Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Window / User API: threadDelayed 8567			Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Window / User API: threadDelayed 1297			Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe TID: 4524	Thread sleep time: -25825441703193356s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe TID: 4524	Thread sleep time: -60000s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe TID: 4524	Thread sleep time: -59875s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe TID: 5908	Thread sleep count: 8567 > 30	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe TID: 5908	Thread sleep count: 1297 > 30	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe TID: 4524	Thread sleep time: -59765s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe TID: 4524	Thread sleep time: -59655s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe TID: 4524	Thread sleep time: -59546s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe TID: 4524	Thread sleep time: -59437s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe TID: 4524	Thread sleep time: -59327s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe TID: 4524	Thread sleep time: -59218s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe TID: 4524	Thread sleep time: -59109s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe TID: 4524	Thread sleep time: -58999s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe TID: 4524	Thread sleep time: -58890s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe TID: 4524	Thread sleep time: -58781s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe TID: 4524	Thread sleep time: -58671s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe TID: 4524	Thread sleep time: -58562s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe TID: 4524	Thread sleep time: -58453s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe TID: 4524	Thread sleep time: -58343s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe TID: 4524	Thread sleep time: -58234s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe TID: 4524	Thread sleep time: -58124s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe TID: 4524	Thread sleep time: -58015s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe TID: 4524	Thread sleep time: -57906s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe TID: 4524	Thread sleep time: -57796s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe TID: 4524	Thread sleep time: -57687s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe TID: 4524	Thread sleep time: -57577s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe TID: 4524	Thread sleep time: -57468s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe TID: 4524	Thread sleep time: -57359s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe TID: 4524	Thread sleep time: -57249s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe TID: 4524	Thread sleep time: -57140s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe TID: 4524	Thread sleep time: -57031s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe TID: 4524	Thread sleep time: -56921s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe TID: 4524	Thread sleep time: -56812s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe TID: 4524	Thread sleep time: -56703s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe TID: 4524	Thread sleep time: -56593s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe TID: 4524	Thread sleep time: -56483s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe TID: 4524	Thread sleep time: -56374s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe TID: 4524	Thread sleep time: -56265s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe TID: 4524	Thread sleep time: -56156s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe TID: 4524	Thread sleep time: -56046s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe TID: 4524	Thread sleep time: -55911s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe TID: 4524	Thread sleep time: -55781s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe TID: 4524	Thread sleep time: -55671s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe TID: 4524	Thread sleep time: -55562s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe TID: 4524	Thread sleep time: -55453s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe TID: 4524	Thread sleep time: -55343s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe TID: 4524	Thread sleep time: -55234s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe TID: 4524	Thread sleep time: -55125s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe TID: 4524	Thread sleep time: -55015s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe TID: 4524	Thread sleep time: -54906s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe TID: 4524	Thread sleep time: -54796s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe TID: 4524	Thread sleep time: -54687s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe TID: 4524	Thread sleep time: -54578s >= -30000s	Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe

WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BaseBoard

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe

WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Thread delayed: delay time: 60000	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Thread delayed: delay time: 59875	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Thread delayed: delay time: 59765	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Thread delayed: delay time: 59655	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Thread delayed: delay time: 59546	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Thread delayed: delay time: 59437	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Thread delayed: delay time: 59327	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Thread delayed: delay time: 59218	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Thread delayed: delay time: 59109	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Thread delayed: delay time: 58999	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Thread delayed: delay time: 58890	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Thread delayed: delay time: 58781	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Thread delayed: delay time: 58671	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Thread delayed: delay time: 58562	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Thread delayed: delay time: 58453	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Thread delayed: delay time: 58343	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Thread delayed: delay time: 58234	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Thread delayed: delay time: 58124	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Thread delayed: delay time: 58015	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Thread delayed: delay time: 57906	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Thread delayed: delay time: 57796	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Thread delayed: delay time: 57687	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Thread delayed: delay time: 57577	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Thread delayed: delay time: 57468	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Thread delayed: delay time: 57359	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Thread delayed: delay time: 57249	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Thread delayed: delay time: 57140	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Thread delayed: delay time: 57031	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Thread delayed: delay time: 56921	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Thread delayed: delay time: 56812	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Thread delayed: delay time: 56703	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Thread delayed: delay time: 56593	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Thread delayed: delay time: 56483	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Thread delayed: delay time: 56374	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Thread delayed: delay time: 56265	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Thread delayed: delay time: 56156	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Thread delayed: delay time: 56046	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Thread delayed: delay time: 55911	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Thread delayed: delay time: 55781	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Thread delayed: delay time: 55671	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Thread delayed: delay time: 55562	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Thread delayed: delay time: 55453	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Thread delayed: delay time: 55343	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Thread delayed: delay time: 55234	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Thread delayed: delay time: 55125	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Thread delayed: delay time: 55015	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Thread delayed: delay time: 54906	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Thread delayed: delay time: 54796	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Thread delayed: delay time: 54687	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Thread delayed: delay time: 54578	Jump to behavior

Source: csc.exe, 00000005.00000002.2678034785.000000000A018000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dllkk,]

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe

Code function: 5_2_09DCF115 LdrInitializeThunk,

5_2_09DCF115

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe

Process token adjusted: Debug

Jump to behavior

Source: C:\Users\user\Desktop\ReaderPDFadobe.exe

Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe"

Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe

Memory allocated: page read and write | page guard

Jump to behavior

HIPS / PFW / Operating System Protection Evasion

Allocates memory in foreign processes

Source: C:\Users\user\Desktop\ReaderPDFadobe.exe

Memory allocated: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe base: 4F10000 protect: page execute and read and write

Jump to behavior

Injects a PE file into a foreign processes

Source: C:\Users\user\Desktop\ReaderPDFadobe.exe

Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe base: 4F10000 value starts with: 4D5A

Jump to behavior

Writes to foreign memory regions

Source: C:\Users\user\Desktop\ReaderPDFadobe.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe base: 4F10000			Jump to behavior
Source: C:\Users\user\Desktop\ReaderPDFadobe.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe base: 5181008			Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe

Queries volume information: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe VolumeInformation

Jump to behavior

Source: C:\Users\user\Desktop\ReaderPDFadobe.exe

Code function: 0_2_00644383 GetSystemTimeAsFileTime,GetCurrentThreadId,GetCurrentProcessId,QueryPerformanceCounter,

0_2_00644383

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Source: csc.exe, 00000005.00000003.1643284810.0000000009FE1000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: %ProgramFiles%\Windows Defender\MsMpeng.exe

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe

WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * from AntivirusProduct

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	131 Windows Management Instrumentation	1 DLL Side-Loading	31 Process Injection	11 Disable or Modify Tools	OS Credential Dumping	1 System Time Discovery	Remote Services	1 Archive Collected Data	1 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	2 Command and Scripting Interpreter	Boot or Logon Initialization Scripts	1 DLL Side-Loading	141 Virtualization/Sandbox Evasion	LSASS Memory	131 Security Software Discovery	Remote Desktop Protocol	Data from Removable Media	1 Non-Standard Port	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	31 Process Injection	Security Account Manager	141 Virtualization/Sandbox Evasion	SMB/Windows Admin Shares	Data from Network Shared Drive	1 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	1 Obfuscated Files or Information	NTDS	1 Application Window Discovery	Distributed Component Object Model	Input Capture	1 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 Software Packing	LSA Secrets	124 System Information Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 DLL Side-Loading	Cached Domain Credentials	Wi-Fi Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
ReaderPDFadobe.exe	47%	ReversingLabs	Win32.Backdoor.Remcos

Source	Detection	Scanner	Label
https://www.foobar2000.org/http://forums.foobar2000.org/AboutOpens	0%	Avira URL Cloud	safe
http://forums.foobar2000.org/	0%	Avira URL Cloud	safe
https://help.foobar2000.org/~rbvrb	0%	Avira URL Cloud	safe
https://www.foobar2000.org/license	0%	Avira URL Cloud	safe
https://help.foobar2000.org/	0%	Avira URL Cloud	safe
https://fastcopy.jp/pro/	0%	Avira URL Cloud	safe
https://www.foobar2000.org/download	0%	Avira URL Cloud	safe
https://www.foobar2000.org/downloadcomponent_manager::on_app_initPre	0%	Avira URL Cloud	safe
http://wiki.hydrogenaudio.org/index.php?title=Replaygain	0%	Avira URL Cloud	safe
https://www.radio-browser.info/	0%	Avira URL Cloud	safe
https://www.foobar2000.org/	0%	Avira URL Cloud	safe
https://www.radio-browser.info/CountryLanguageTagNameLoading...No	0%	Avira URL Cloud	safe
http://wiki.hydrogenaudio.org/index.php?title=ReplaygainSet	0%	Avira URL Cloud	safe
https://www.radio-browser.info/history/	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
newstaticfreepoint24.ddns-ip.net	181.71.216.203	true	false		high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://www.foobar2000.org/http://forums.foobar2000.org/AboutOpens	ReaderPDFadobe.exe	false	Avira URL Cloud: safe	unknown
http://wiki.hydrogenaudio.org/index.php?title=Replaygain	ReaderPDFadobe.exe	false	Avira URL Cloud: safe	unknown
https://github.com/mgravell/protobuf-neti	csc.exe, 00000005.00000003.1859237874.000000000895E000.00000004.00000800.00020000.00000000.sdmp, csc.exe, 00000005.00000002.2677630352.0000000009C50000.00000004.08000000.00040000.00000000.sdmp, csc.exe, 00000005.00000003.1859237874.0000000008A95000.00000004.00000800.00020000.00000000.sdmp	false		high
https://stackoverflow.com/q/14436606/23354	csc.exe, 00000005.00000002.2675966448.00000000074E1000.00000004.00000800.00020000.00000000.sdmp, csc.exe, 00000005.00000003.1859237874.000000000895E000.00000004.00000800.00020000.00000000.sdmp, csc.exe, 00000005.00000002.2677630352.0000000009C50000.00000004.08000000.00040000.00000000.sdmp, csc.exe, 00000005.00000003.1859237874.0000000008A95000.00000004.00000800.00020000.00000000.sdmp	false		high
https://github.com/mgravell/protobuf-netJ	csc.exe, 00000005.00000003.1859237874.000000000895E000.00000004.00000800.00020000.00000000.sdmp, csc.exe, 00000005.00000002.2677630352.0000000009C50000.00000004.08000000.00040000.00000000.sdmp, csc.exe, 00000005.00000003.1859237874.0000000008A95000.00000004.00000800.00020000.00000000.sdmp	false		high
https://www.radio-browser.info/	ReaderPDFadobe.exe	false	Avira URL Cloud: safe	unknown
https://stackoverflow.com/q/11564914/23354;	csc.exe, 00000005.00000003.1859237874.000000000895E000.00000004.00000800.00020000.00000000.sdmp, csc.exe, 00000005.00000002.2677630352.0000000009C50000.00000004.08000000.00040000.00000000.sdmp, csc.exe, 00000005.00000003.1859237874.0000000008A95000.00000004.00000800.00020000.00000000.sdmp	false		high
https://stackoverflow.com/q/2152978/23354	csc.exe, 00000005.00000003.1859237874.000000000895E000.00000004.00000800.00020000.00000000.sdmp, csc.exe, 00000005.00000002.2677630352.0000000009C50000.00000004.08000000.00040000.00000000.sdmp, csc.exe, 00000005.00000003.1859237874.0000000008A95000.00000004.00000800.00020000.00000000.sdmp	false		high
http://forums.foobar2000.org/	ReaderPDFadobe.exe	false	Avira URL Cloud: safe	unknown
https://www.foobar2000.org/license	ReaderPDFadobe.exe	false	Avira URL Cloud: safe	unknown
https://fastcopy.jp/pro/	ReaderPDFadobe.exe	false	Avira URL Cloud: safe	unknown
https://github.com/mgravell/protobuf-net	csc.exe, 00000005.00000003.1859237874.000000000895E000.00000004.00000800.00020000.00000000.sdmp, csc.exe, 00000005.00000002.2677630352.0000000009C50000.00000004.08000000.00040000.00000000.sdmp, csc.exe, 00000005.00000003.1859237874.0000000008A95000.00000004.00000800.00020000.00000000.sdmp	false		high
https://help.foobar2000.org/~rbvrb	ReaderPDFadobe.exe	false	Avira URL Cloud: safe	unknown
https://help.foobar2000.org/	ReaderPDFadobe.exe	false	Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	csc.exe, 00000005.00000002.2675966448.00000000074E1000.00000004.00000800.00020000.00000000.sdmp, csc.exe, 00000005.00000002.2675966448.0000000007589000.00000004.00000800.00020000.00000000.sdmp, csc.exe, 00000005.00000002.2675966448.000000000757D000.00000004.00000800.00020000.00000000.sdmp	false		high
https://www.foobar2000.org/download	ReaderPDFadobe.exe	false	Avira URL Cloud: safe	unknown
https://www.foobar2000.org/downloadcomponent_manager::on_app_initPre	ReaderPDFadobe.exe	false	Avira URL Cloud: safe	unknown
https://www.radio-browser.info/CountryLanguageTagNameLoading...No	ReaderPDFadobe.exe	false	Avira URL Cloud: safe	unknown
https://www.foobar2000.org/	ReaderPDFadobe.exe	false	Avira URL Cloud: safe	unknown
http://wiki.hydrogenaudio.org/index.php?title=ReplaygainSet	ReaderPDFadobe.exe	false	Avira URL Cloud: safe	unknown
https://www.radio-browser.info/history/	ReaderPDFadobe.exe	false	Avira URL Cloud: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
181.71.216.203	newstaticfreepoint24.ddns-ip.net	Colombia		27831	ColombiaMovilCO	false

General Information

Joe Sandbox version:	42.0.0 Malachite
Analysis ID:	1587448
Start date and time:	2025-01-10 11:52:04 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 5m 29s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	9
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	ReaderPDFadobe.exe
Detection:	MAL
Classification:	mal80.evad.winEXE@3/0@1/1
EGA Information:	Successful, ratio: 50%
HCA Information:	Successful, ratio: 84% Number of executed functions: 125 Number of non-executed functions: 17
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, dllhost.exe, WMIADAP.exe, SIHClient.exe, conhost.exe
Excluded IPs from analysis (whitelisted): 20.12.23.50
Excluded domains from analysis (whitelisted): ocsp.digicert.com, slscr.update.microsoft.com, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com
Execution Graph export aborted for target ReaderPDFadobe.exe, PID 5536 because there are no executed function
Not all processes where analyzed, report is missing behavior information
Report size getting too big, too many NtProtectVirtualMemory calls found.
VT rate limit hit for: ReaderPDFadobe.exe

Simulations

Behavior and APIs

Time	Type	Description
05:53:22	API Interceptor	1376586x Sleep call for process: csc.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
181.71.216.203	MicrosoftOfficeWord.exe	Get hash	malicious	Unknown	Browse
	AdobePDF.exe	Get hash	malicious	Unknown	Browse
	AdobeReaderPDFonline.exe	Get hash	malicious	Unknown	Browse
	MicrosoftWORD.exe	Get hash	malicious	Unknown	Browse
	PDFonlineseguro.exe	Get hash	malicious	Unknown	Browse
	MicrosoftOfficeWord.exe	Get hash	malicious	Unknown	Browse
	AdobePDF.exe	Get hash	malicious	Unknown	Browse
	AdobeReaderPDFonline.exe	Get hash	malicious	Unknown	Browse
	PDFonlineseguro.exe	Get hash	malicious	Unknown	Browse
	AdobePremierPDF.exe	Get hash	malicious	Unknown	Browse

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
newstaticfreepoint24.ddns-ip.net	MicrosoftOfficeWord.exe	Get hash	malicious	Unknown	Browse	181.71.216.203
	AdobePDF.exe	Get hash	malicious	Unknown	Browse	181.71.216.203
	AdobeReaderPDFonline.exe	Get hash	malicious	Unknown	Browse	181.71.216.203
	MicrosoftWORD.exe	Get hash	malicious	Unknown	Browse	181.71.216.203
	PDFonlineseguro.exe	Get hash	malicious	Unknown	Browse	181.71.216.203
	MicrosoftOfficeWord.exe	Get hash	malicious	Unknown	Browse	181.71.216.203
	AdobePDF.exe	Get hash	malicious	Unknown	Browse	181.71.216.203
	AdobeReaderPDFonline.exe	Get hash	malicious	Unknown	Browse	181.71.216.203
	PDFonlineseguro.exe	Get hash	malicious	Unknown	Browse	181.71.216.203
	AdobePremierPDF.exe	Get hash	malicious	Unknown	Browse	181.71.216.203

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
ColombiaMovilCO	MicrosoftOfficeWord.exe	Get hash	malicious	Unknown	Browse	181.71.216.203
	AdobePDF.exe	Get hash	malicious	Unknown	Browse	181.71.216.203
	AdobeReaderPDFonline.exe	Get hash	malicious	Unknown	Browse	181.71.216.203
	MicrosoftWORD.exe	Get hash	malicious	Unknown	Browse	181.71.216.203
	PDFonlineseguro.exe	Get hash	malicious	Unknown	Browse	181.71.216.203
	MicrosoftOfficeWord.exe	Get hash	malicious	Unknown	Browse	181.71.216.203
	AdobePDF.exe	Get hash	malicious	Unknown	Browse	181.71.216.203
	AdobeReaderPDFonline.exe	Get hash	malicious	Unknown	Browse	181.71.216.203
	PDFonlineseguro.exe	Get hash	malicious	Unknown	Browse	181.71.216.203
	AdobePremierPDF.exe	Get hash	malicious	Unknown	Browse	181.71.216.203

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	6.871666663925079
TrID:	Win32 Executable (generic) a (10002005/4) 98.19% foobar 2000 generic component (102126/2) 1.00% foobar 2000 Diskwriter output component (78126/2) 0.77% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02%
File name:	ReaderPDFadobe.exe
File size:	5'649'920 bytes
MD5:	5b3f4288f2239f1805e7d5c935fec648
SHA1:	3e7d6b9b8e8549bd5e359c79e64829da329c0f92
SHA256:	c761b3063a4cdad0061c015cda2d006077b52d833952ca912157bfa31d8a975d
SHA512:	ba36f0584d294b1566b77185bf9c3450f13af917b656f0abdc1f35456974a630c9e3d17b94b23b4079a594817a2f2a3d30af673ef4e1f90c527b0911d1457c52
SSDEEP:	49152:/hKqxQ06Ybgpey773zDpgNaPvsGbNhvaE/0+dbMie3c/Hat0f3rNcXeiXzOHQXeb:5nbgpe4xdaEMybVR/XfGBPN74TlwDU
TLSH:	2C46AD32B753CC66C65100BF8979AAFD9128ED78CB7346C35284FE1D20B39E216B6917
File Content Preview:	MZ......................@...................................@...........!..L.!This program cannot be run in DOS mode....$..........,..............h........~...............~.......~.......~............'..~....d..~.......~.......~.......~.......~.......~...

File Icon


Icon Hash:	334de0b2926d330e

Static PE Info

General

Entrypoint:	0x643e93
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE
Time Stamp:	0x67600E9F [Mon Dec 16 11:27:27 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	6
OS Version Minor:	0
File Version Major:	6
File Version Minor:	0
Subsystem Version Major:	6
Subsystem Version Minor:	0
Import Hash:	d0efa8288bc8fcf1ae384debe93de6ac

Entrypoint Preview

Instruction
call 00007F7A6D1F7C5Dh
jmp 00007F7A6D1F759Fh
push 00000010h
push 006E65C0h
call 00007F7A6D1F7BACh
xor ebx, ebx
mov dword ptr [ebp-20h], ebx
mov byte ptr [ebp-19h], bl
mov dword ptr [ebp-04h], ebx
cmp ebx, dword ptr [ebp+14h]
je 00007F7A6D1F7743h
push dword ptr [ebp+0Ch]
mov ecx, dword ptr [ebp+18h]
call dword ptr [00675B18h]
mov ecx, dword ptr [ebp+08h]
call dword ptr [ebp+18h]
mov eax, dword ptr [ebp+10h]
add dword ptr [ebp+08h], eax
add dword ptr [ebp+0Ch], eax
inc ebx
mov dword ptr [ebp-20h], ebx
jmp 00007F7A6D1F76FCh
mov al, 01h
mov byte ptr [ebp-19h], al
mov dword ptr [ebp-04h], FFFFFFFEh
call 00007F7A6D1F773Dh
mov ecx, dword ptr [ebp-10h]
mov dword ptr fs:[00000000h], ecx
pop ecx
pop edi
pop esi
pop ebx
leave
retn 0018h
mov ebx, dword ptr [ebp-20h]
mov al, byte ptr [ebp-19h]
test al, al
jne 00007F7A6D1F7731h
push dword ptr [ebp+1Ch]
push ebx
push dword ptr [ebp+10h]
push dword ptr [ebp+08h]
call 00007F7A6D1F7194h
ret
push ebp
mov ebp, esp
sub esp, 0Ch
lea ecx, dword ptr [ebp-0Ch]
call 00007F7A6CFBFEE0h
push 006E66B4h
lea eax, dword ptr [ebp-0Ch]
push eax
call 00007F7A6D1F7E2Bh
int3
push ebp
mov ebp, esp
sub esp, 0Ch
lea ecx, dword ptr [ebp-0Ch]
call 00007F7A6CFBF333h
push 006E6608h
lea eax, dword ptr [ebp-0Ch]
push eax
call 00007F7A6D1F7E0Eh
int3
push ebp
mov ebp, esp
and dword ptr [00701C04h], 00000000h

Rich Headers

Programming Language:

[IMP] VS2008 SP1 build 30729

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x2e826c	0x294	.rdata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x32e000	0x24102c	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x350000	0x2c140	.rsrc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x2a823c	0x70	.rdata
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x2a82c0	0x18	.rdata
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x276d30	0x40	.rdata
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x275000	0xb18	.rdata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x2e8128	0x40	.rdata
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x274000	0x273200	696e190c41e929632b849b4372bca92f	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rdata	0x275000	0x78000	0x77600	2a4704a587240261914c1de80110ddb1	False	0.3565792702879581	data	5.125253402867627	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0x2ed000	0x1e000	0x14c00	0b15f16cdaeb2ade44ddb62497a9e5fb	False	0.22939806099397592	DOS executable (block device driver @\273\)	5.393205596281875	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
_RDATA	0x30b000	0x23000	0x22c00	241f50e9d164772437fd3eebd88a3edb	False	0.16984459307553956	data	5.38723924085817	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.rsrc	0x32e000	0x24102c	0x241200	f4ab587bb2ddbe9f5f1d926f55817b5d	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
AFX_DIALOG_LAYOUT	0x32f96c	0x2	data	English	United States	5.0
AFX_DIALOG_LAYOUT	0x32f970	0x2	data	English	United States	5.0
AFX_DIALOG_LAYOUT	0x32f974	0x2	data	English	United States	5.0
AFX_DIALOG_LAYOUT	0x32f978	0x2	data	English	United States	5.0
AFX_DIALOG_LAYOUT	0x32f97c	0x2	data	English	United States	5.0
AFX_DIALOG_LAYOUT	0x32f980	0x2	data	English	United States	5.0
AFX_DIALOG_LAYOUT	0x32f984	0x2	data	English	United States	5.0
AFX_DIALOG_LAYOUT	0x32f988	0x2	data	English	United States	5.0
AFX_DIALOG_LAYOUT	0x32f98c	0x2	data	English	United States	5.0
AFX_DIALOG_LAYOUT	0x32f990	0x2	data	English	United States	5.0
AFX_DIALOG_LAYOUT	0x32f994	0x2	data	English	United States	5.0
AFX_DIALOG_LAYOUT	0x32f998	0x2	data	English	United States	5.0
AFX_DIALOG_LAYOUT	0x32f99c	0x2	data	English	United States	5.0
AFX_DIALOG_LAYOUT	0x32f9a0	0x2	data	English	United States	5.0
AFX_DIALOG_LAYOUT	0x32f9a4	0x2	data	English	United States	5.0
AFX_DIALOG_LAYOUT	0x32f9a8	0x2	data	English	United States	5.0
AFX_DIALOG_LAYOUT	0x32f9ac	0x2	data	English	United States	5.0
AFX_DIALOG_LAYOUT	0x32f9b0	0x2	data	English	United States	5.0
AFX_DIALOG_LAYOUT	0x32f9b4	0x2	data	English	United States	5.0
AFX_DIALOG_LAYOUT	0x32f9b8	0x2	data	English	United States	5.0
AFX_DIALOG_LAYOUT	0x32f9bc	0x2	data	English	United States	5.0
AFX_DIALOG_LAYOUT	0x32f9c0	0x2	data	English	United States	5.0
AFX_DIALOG_LAYOUT	0x32f9c4	0x2	data	English	United States	5.0
PNG	0x32f9c8	0x5366	PNG image data, 256 x 256, 8-bit/color RGBA, non-interlaced	English	United States	1.0004215456674472
RT_BITMAP	0x334d30	0x72a24	Device independent bitmap graphic, 500 x 313 x 24, image size 469500, resolution 3780 x 3780 px/m			0.6494377475827405
RT_BITMAP	0x3a7754	0x72a24	Device independent bitmap graphic, 500 x 313 x 24, image size 469500, resolution 3780 x 3780 px/m			0.5587979724837074
RT_BITMAP	0x41a178	0x14be8	Device independent bitmap graphic, 302 x 276 x 8, image size 83904, 256 important colors			0.1667098201675925
RT_BITMAP	0x42ed60	0x46e8c	PC bitmap, Windows 3.x format, 36628 x 2 x 52, image size 290472, cbSize 290444, bits offset 54			0.9879563702469323
RT_BITMAP	0x475bec	0x2e02a	Device independent bitmap graphic, 1472 x 32 x 32, image size 188418, resolution 2834 x 2834 px/m			0.216446104702374
RT_BITMAP	0x4a3c18	0x402a	Device independent bitmap graphic, 64 x 64 x 32, image size 16386, resolution 2834 x 2834 px/m			0.35370753683185197
RT_BITMAP	0x4a7c44	0xcf28	Device independent bitmap graphic, 552 x 24 x 32, image size 52992, resolution 3543 x 3543 px/m			0.23476391612611253
RT_ICON	0x4b4b6c	0x10a8	Device independent bitmap graphic, 32 x 64 x 32, image size 4224	English	United States	0.33630393996247654
RT_ICON	0x4b5c14	0x1a68	Device independent bitmap graphic, 40 x 80 x 32, image size 6720	English	United States	0.29319526627218934
RT_ICON	0x4b767c	0x25a8	Device independent bitmap graphic, 48 x 96 x 32, image size 9600	English	United States	0.258298755186722
RT_ICON	0x4b9c24	0x4228	Device independent bitmap graphic, 64 x 128 x 32, image size 16896	English	United States	0.20896315540859708
RT_ICON	0x4bde4c	0x5cd2	PNG image data, 256 x 256, 8-bit/color RGBA, non-interlaced	English	United States	0.9988216480094269
RT_ICON	0x4c3b20	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 1088	English	United States	0.5301418439716312
RT_ICON	0x4c3f88	0x6b8	Device independent bitmap graphic, 20 x 40 x 32, image size 1680	English	United States	0.4511627906976744
RT_ICON	0x4c4640	0x988	Device independent bitmap graphic, 24 x 48 x 32, image size 2400	English	United States	0.41270491803278686
RT_DIALOG	0x4c4fc8	0x32a	data			0.7555555555555555
RT_DIALOG	0x4c52f4	0x35c	data	English	United States	0.436046511627907
RT_DIALOG	0x4c5650	0x502	data	English	United States	0.3962558502340094
RT_DIALOG	0x4c5b54	0x248	data	English	United States	0.4828767123287671
RT_DIALOG	0x4c5d9c	0x2c2	data	English	United States	0.4730878186968839
RT_DIALOG	0x4c6060	0x630	data	English	United States	0.4116161616161616
RT_DIALOG	0x4c6690	0x1e8	data	English	United States	0.5368852459016393
RT_DIALOG	0x4c6878	0x828	data	English	United States	0.4051724137931034
RT_DIALOG	0x4c70a0	0x36c	data	English	United States	0.45662100456621
RT_DIALOG	0x4c740c	0x188	data	English	United States	0.5586734693877551
RT_DIALOG	0x4c7594	0x1e8	data	English	United States	0.5430327868852459
RT_DIALOG	0x4c777c	0x4a8	data	English	United States	0.42533557046979864
RT_DIALOG	0x4c7c24	0x278	data	English	United States	0.44936708860759494
RT_DIALOG	0x4c7e9c	0xc8	data	English	United States	0.675
RT_DIALOG	0x4c7f64	0x634	data	English	United States	0.4275818639798489
RT_DIALOG	0x4c8598	0x4d2	data	English	United States	0.3987034035656402
RT_DIALOG	0x4c8a6c	0x2b0	data	English	United States	0.4738372093023256
RT_DIALOG	0x4c8d1c	0xd0	data	English	United States	0.6586538461538461
RT_DIALOG	0x4c8dec	0x124	data	English	United States	0.589041095890411
RT_DIALOG	0x4c8f10	0x30e	data	English	United States	0.4322250639386189
RT_DIALOG	0x4c9220	0x174	data	English	United States	0.5698924731182796
RT_DIALOG	0x4c9394	0x220	data	English	United States	0.48713235294117646
RT_DIALOG	0x4c95b4	0x2d2	data	English	United States	0.4695290858725762
RT_DIALOG	0x4c9888	0xec	data	English	United States	0.673728813559322
RT_DIALOG	0x4c9974	0x1e0	data	English	United States	0.5229166666666667
RT_DIALOG	0x4c9b54	0x1b0	data	English	United States	0.5532407407407407
RT_DIALOG	0x4c9d04	0x1a4	data	English	United States	0.5333333333333333
RT_DIALOG	0x4c9ea8	0x100	data	English	United States	0.62890625
RT_DIALOG	0x4c9fa8	0x60	data	English	United States	0.7291666666666666
RT_DIALOG	0x4ca008	0x4ac	data	English	United States	0.3804347826086957
RT_DIALOG	0x4ca4b4	0x326	data	English	United States	0.4640198511166253
RT_DIALOG	0x4ca7dc	0x1f8	data	English	United States	0.5515873015873016
RT_DIALOG	0x4ca9d4	0xe0	data	English	United States	0.6607142857142857
RT_DIALOG	0x4caab4	0xe4	data	English	United States	0.6798245614035088
RT_DIALOG	0x4cab98	0x1c4	data	English	United States	0.5575221238938053
RT_DIALOG	0x4cad5c	0x104	data	English	United States	0.573076923076923
RT_DIALOG	0x4cae60	0xaa	data	English	United States	0.7411764705882353
RT_DIALOG	0x4caf0c	0x1f4	data	English	United States	0.492
RT_DIALOG	0x4cb100	0x12c	data	English	United States	0.5966666666666667
RT_DIALOG	0x4cb22c	0x7c	data	English	United States	0.7903225806451613
RT_DIALOG	0x4cb2a8	0x40	data	English	United States	0.765625
RT_DIALOG	0x4cb2e8	0x228	data	English	United States	0.519927536231884
RT_DIALOG	0x4cb510	0xa4	data	English	United States	0.6829268292682927
RT_DIALOG	0x4cb5b4	0xb8	data	English	United States	0.6739130434782609
RT_DIALOG	0x4cb66c	0x228	data	English	United States	0.5018115942028986
RT_DIALOG	0x4cb894	0xa8	data	English	United States	0.6607142857142857
RT_DIALOG	0x4cb93c	0x11c	data	English	United States	0.5845070422535211
RT_DIALOG	0x4cba58	0x1c8	data	English	United States	0.4868421052631579
RT_DIALOG	0x4cbc20	0x32c	data	English	United States	0.45689655172413796
RT_DIALOG	0x4cbf4c	0x90	data	English	United States	0.6944444444444444
RT_DIALOG	0x4cbfdc	0xc6	data	English	United States	0.6919191919191919
RT_DIALOG	0x4cc0a4	0x224	data	English	United States	0.5547445255474452
RT_DIALOG	0x4cc2c8	0x224	data	English	United States	0.5602189781021898
RT_DIALOG	0x4cc4ec	0x120	data	English	United States	0.5972222222222222
RT_DIALOG	0x4cc60c	0x5d4	data	English	United States	0.4175603217158177
RT_DIALOG	0x4ccbe0	0x17e	data	English	United States	0.5837696335078534
RT_DIALOG	0x4ccd60	0x19e	data	English	United States	0.5217391304347826
RT_DIALOG	0x4ccf00	0x1e0	data	English	United States	0.51875
RT_DIALOG	0x4cd0e0	0x3f8	data	English	United States	0.43799212598425197
RT_DIALOG	0x4cd4d8	0x6e	data	English	United States	0.7181818181818181
RT_DIALOG	0x4cd548	0x7c	data	English	United States	0.7338709677419355
RT_DIALOG	0x4cd5c4	0x3e0	data	English	United States	0.4254032258064516
RT_DIALOG	0x4cd9a4	0x94	data	English	United States	0.7905405405405406
RT_DIALOG	0x4cda38	0x246	data	English	United States	0.49140893470790376
RT_DIALOG	0x4cdc80	0x1e8	data	English	United States	0.4959016393442623
RT_DIALOG	0x4cde68	0xfc	data	English	United States	0.6626984126984127
RT_DIALOG	0x4cdf64	0x160	data	English	United States	0.6051136363636364
RT_DIALOG	0x4ce0c4	0x4ec	data	English	United States	0.44047619047619047
RT_DIALOG	0x4ce5b0	0x2f0	data	English	United States	0.4654255319148936
RT_DIALOG	0x4ce8a0	0x1ac	data	English	United States	0.5677570093457944
RT_DIALOG	0x4cea4c	0x142	data	English	United States	0.5869565217391305
RT_DIALOG	0x4ceb90	0x1ae	data	English	United States	0.5511627906976744
RT_ACCELERATOR	0x4ced40	0x20	data	English	United States	0.96875
RT_ACCELERATOR	0x4ced60	0x28	data	English	United States	0.95
RT_RCDATA	0x4ced88	0x82e8	data			0.24680711386965862
RT_RCDATA	0x4d7070	0x11dab	Delphi compiled form 'TfFolderProperties'			0.31615867416006893
RT_RCDATA	0x4e8e1c	0x11dab	Delphi compiled form 'TfFolderProperties'			0.4024558668690432
RT_RCDATA	0x4fabc8	0x23e27	Delphi compiled form 'TfLogin'			0.28407366838341847
RT_RCDATA	0x51e9f0	0x2092	Delphi compiled form 'TWizardForm'			0.2983928999760134
RT_RCDATA	0x520a84	0xbd22	PNG image data, 118 x 102, 8-bit/color RGBA, non-interlaced			0.24928745507868974
RT_GROUP_ICON	0x52c7a8	0x76	data	English	United States	0.7457627118644068
RT_VERSION	0x52c820	0x30c	data	English	United States	0.44358974358974357
RT_ANIICON	0x52cb2c	0x424fd	PC bitmap, Windows 3.x format, 34094 x 2 x 35, image size 271646, cbSize 271613, bits offset 54			0.9939619974007136

Imports

DLL	Import
COMCTL32.dll	ImageList_Destroy, ImageList_Create, ImageList_Add
WINMM.dll	timeGetTime, timeBeginPeriod, timeEndPeriod
SHLWAPI.dll	SHAutoComplete, StrCmpLogicalW, SHDeleteKeyW
UxTheme.dll	IsThemePartDefined, OpenThemeData, GetThemePartSize, SetWindowTheme, DrawThemeBackground, EnableThemeDialogTexture, CloseThemeData
KERNEL32.dll	GetSystemPowerStatus, VerifyVersionInfoW, VerSetConditionMask, GlobalFree, SystemTimeToFileTime, LocalFileTimeToFileTime, ResumeThread, GetLocaleInfoW, GetNumberFormatW, GlobalSize, DecodePointer, Sleep, SetErrorMode, LoadLibraryW, CreateEventW, FindResourceW, FindResourceExW, LoadResource, LockResource, SizeofResource, SetEndOfFile, GetFileTime, FlushFileBuffers, CreateFileW, GetDiskFreeSpaceExW, FindFirstFileW, DeleteFileW, RemoveDirectoryW, GetFileAttributesW, GetStartupInfoW, SetUnhandledExceptionFilter, UnhandledExceptionFilter, WaitForSingleObjectEx, InitializeCriticalSectionAndSpinCount, LoadLibraryExA, GetCurrentThreadId, VirtualAlloc, IsProcessorFeaturePresent, FlushInstructionCache, InterlockedPushEntrySList, InterlockedPopEntrySList, InitializeSListHead, EncodePointer, InitOnceComplete, InitOnceBeginInitialize, SystemTimeToTzSpecificLocalTime, MoveFileExW, NormalizeString, TryEnterCriticalSection, GetVolumeNameForVolumeMountPointW, GetVolumePathNameW, DeviceIoControl, SetFileTime, SetFilePointer, DosDateTimeToFileTime, GetFileSizeEx, FileTimeToSystemTime, GetSystemTimeAsFileTime, ReadDirectoryChangesW, GetThreadPriority, GetThreadId, GetFileInformationByHandle, TerminateProcess, GetCurrentProcess, DuplicateHandle, WriteFile, CancelIo, GetOverlappedResult, ReadFile, WideCharToMultiByte, MultiByteToWideChar, WaitForMultipleObjects, FormatMessageW, GlobalUnlock, GlobalLock, GlobalAlloc, GetCommandLineW, LoadLibraryExW, lstrlenW, GetNativeSystemInfo, GetVersionExW, PowerCreateRequest, PowerClearRequest, PowerSetRequest, SetLastError, EnterCriticalSection, SetThreadPriority, OutputDebugStringW, LeaveCriticalSection, GetTickCount64, DeleteCriticalSection, GetFileAttributesExW, FindNextFileW, FindClose, GetCurrentThread, SetEvent, ResetEvent, GetExitCodeThread, GetCurrentProcessId, VirtualQuery, VirtualProtect, GetSystemInfo, ReleaseSRWLockExclusive, AcquireSRWLockExclusive, ReleaseSRWLockShared, AcquireSRWLockShared, CopyFileW, IsDebuggerPresent, FreeLibrary, SetDllDirectoryW, CloseHandle, WaitForSingleObject, GetModuleHandleW, GetProcAddress, GetTickCount, GetProcessHeap, HeapAlloc, CreateMutexW, InitializeCriticalSection, QueryPerformanceCounter, QueryPerformanceFrequency, HeapFree, HeapReAlloc, HeapSize, HeapDestroy, MulDiv, InitializeCriticalSectionEx, GetLastError, RaiseException, VirtualFree
USER32.dll	SetDlgItemTextW, MapVirtualKeyW, GetDlgItem, SendMessageW, ShowWindow, EnableWindow, SetWindowTextW, DestroyWindow, UnregisterClassW, CreateDialogParamW, SetWindowLongW, SendDlgItemMessageW, GetActiveWindow, GetWindowLongW, GetClientRect, ClientToScreen, GetWindowRect, SetWindowPos, SetLayeredWindowAttributes, CharUpperW, GetComboBoxInfo, GetSystemMetrics, EnumThreadWindows, GetWindowPlacement, IsIconic, AdjustWindowRect, DrawEdge, SetClipboardData, CloseClipboard, OpenClipboard, FillRect, AdjustWindowRectEx, GetWindowTextLengthW, GetWindowTextW, NotifyWinEvent, RedrawWindow, IsRectEmpty, DrawTextW, TrackMouseEvent, InflateRect, FrameRect, UnhookWindowsHookEx, SetWindowsHookExW, CallNextHookEx, GetNextDlgTabItem, InvalidateRgn, SystemParametersInfoW, ScrollWindowEx, SetScrollPos, UpdateWindow, SetScrollInfo, SetRectEmpty, SetGestureConfig, CloseGestureInfoHandle, GetGestureInfo, GetScrollInfo, MapDialogRect, IsZoomed, SetMenuItemInfoW, GetMenuItemInfoW, GetMenu, GetWindow, GetDC, BeginPaint, EndPaint, InvalidateRect, IsWindowEnabled, PostMessageW, CreateWindowExW, ScreenToClient, IntersectRect, MonitorFromWindow, LoadIconW, RegisterClipboardFormatW, wsprintfW, AllowSetForegroundWindow, EnumWindows, GetClassNameW, GetWindowThreadProcessId, WindowFromPoint, CheckMenuRadioItem, RegisterShellHookWindow, DeregisterShellHookWindow, RegisterWindowMessageW, RegisterClassW, GetClipboardData, IsCharAlphaW, IsClipboardFormatAvailable, DispatchMessageW, TranslateMessage, LoadImageW, GetDesktopWindow, PostQuitMessage, GetMessageW, MsgWaitForMultipleObjects, OffsetRect, CopyRect, MonitorFromRect, CharLowerW, EndDeferWindowPos, BeginDeferWindowPos, DeferWindowPos, EmptyClipboard, IsWindowVisible, MoveWindow, IsChild, PeekMessageW, SetTimer, DrawTextExW, SetForegroundWindow, PtInRect, DefWindowProcW, GetCursorPos, SetFocus, KillTimer, SetCapture, SetCursor, LoadCursorW, IsDialogMessageW, RegisterClassExW, GetClassInfoExW, CallWindowProcW, GetWindowDC, ReleaseDC, DrawFrameControl, GetParent, GetKeyState, GetMessagePos, AppendMenuW, TrackPopupMenu, CreatePopupMenu, MonitorFromPoint, GetMonitorInfoW, DestroyMenu, MessageBoxW, EndDialog, DialogBoxParamW, MessageBeep, SetActiveWindow, EnumChildWindows, MapWindowPoints, SetMenuDefaultItem, TrackPopupMenuEx, GetDlgCtrlID, GetSysColor, GetFocus, TranslateAcceleratorW, LoadAcceleratorsW, DestroyAcceleratorTable, RegisterHotKey, UnregisterHotKey
GDI32.dll	GetStockObject, SelectObject, CreateCompatibleDC, CreateCompatibleBitmap, ExtTextOutW, SetBkColor, SetTextColor, DeleteDC, DeleteObject, GetObjectW, CreateFontIndirectW, SetBkMode, CreateRectRgnIndirect, CreateRectRgn, GetTextExtentPoint32W, GetTextColor, GetBkColor, GetCurrentObject, SetDCBrushColor, CreatePen, GetDeviceCaps, GetTextMetricsW, LPtoDP, SaveDC, RestoreDC, OffsetWindowOrgEx, SetWindowOrgEx, IntersectClipRect, CreatePolygonRgn, FrameRgn, FillRgn, SetViewportOrgEx, BitBlt, CombineRgn, SetDCPenColor, LineTo, MoveToEx, OffsetRgn
ADVAPI32.dll	CryptImportKey, RegQueryValueExW, RegSetValueExW, RegCloseKey, RegOpenKeyW, RegCreateKeyW, RegDeleteValueW, CryptGetHashParam, CryptVerifySignatureW, CryptHashData, CryptCreateHash, RegGetValueW, CryptDestroyKey, CryptDestroyHash, CryptReleaseContext, RegEnumValueW, CryptAcquireContextW, RegOpenKeyExW, RegEnumKeyExW, RegQueryInfoKeyW
SHELL32.dll	SHOpenFolderAndSelectItems, SHGetFolderPathW, SHCreateItemFromIDList, DragAcceptFiles, ShellExecuteExW, SHGetDesktopFolder, DragFinish
ole32.dll	CoCreateInstance, OleSetClipboard, OleGetClipboard, CoTaskMemFree, PropVariantClear, CLSIDFromString, CoTaskMemAlloc, ReleaseStgMedium, CoCreateGuid, DoDragDrop, CoUninitialize, RegisterDragDrop, CreateStreamOnHGlobal, OleInitialize, OleUninitialize, CoInitialize, RevokeDragDrop
OLEAUT32.dll	VariantClear, VariantInit, SysAllocString
OLEACC.dll	AccessibleObjectFromWindow, LresultFromObject
CRYPT32.dll	CertVerifyRevocation, CertVerifyCertificateChainPolicy, CertGetCertificateChain, CertVerifyTimeValidity, CertCloseStore, CertFreeCertificateChain, CertFreeCertificateContext

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	United States

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 10, 2025 11:53:23.922399044 CET	49709	30203	192.168.2.8	181.71.216.203
Jan 10, 2025 11:53:23.927340984 CET	30203	49709	181.71.216.203	192.168.2.8
Jan 10, 2025 11:53:23.927438021 CET	49709	30203	192.168.2.8	181.71.216.203
Jan 10, 2025 11:53:23.991112947 CET	49709	30203	192.168.2.8	181.71.216.203
Jan 10, 2025 11:53:23.996352911 CET	30203	49709	181.71.216.203	192.168.2.8
Jan 10, 2025 11:53:23.996412992 CET	49709	30203	192.168.2.8	181.71.216.203
Jan 10, 2025 11:53:24.001775980 CET	30203	49709	181.71.216.203	192.168.2.8
Jan 10, 2025 11:53:45.302323103 CET	30203	49709	181.71.216.203	192.168.2.8
Jan 10, 2025 11:53:45.304275036 CET	49709	30203	192.168.2.8	181.71.216.203
Jan 10, 2025 11:53:45.307780027 CET	49709	30203	192.168.2.8	181.71.216.203
Jan 10, 2025 11:53:45.312623024 CET	30203	49709	181.71.216.203	192.168.2.8
Jan 10, 2025 11:53:45.474503994 CET	49710	30203	192.168.2.8	181.71.216.203
Jan 10, 2025 11:53:45.479356050 CET	30203	49710	181.71.216.203	192.168.2.8
Jan 10, 2025 11:53:45.479458094 CET	49710	30203	192.168.2.8	181.71.216.203
Jan 10, 2025 11:53:45.569863081 CET	49710	30203	192.168.2.8	181.71.216.203
Jan 10, 2025 11:53:45.574812889 CET	30203	49710	181.71.216.203	192.168.2.8
Jan 10, 2025 11:53:45.574954033 CET	49710	30203	192.168.2.8	181.71.216.203
Jan 10, 2025 11:53:45.579792976 CET	30203	49710	181.71.216.203	192.168.2.8
Jan 10, 2025 11:54:06.865113974 CET	30203	49710	181.71.216.203	192.168.2.8
Jan 10, 2025 11:54:06.865199089 CET	49710	30203	192.168.2.8	181.71.216.203
Jan 10, 2025 11:54:06.865355968 CET	49710	30203	192.168.2.8	181.71.216.203
Jan 10, 2025 11:54:06.870228052 CET	30203	49710	181.71.216.203	192.168.2.8
Jan 10, 2025 11:54:06.978739023 CET	49712	30203	192.168.2.8	181.71.216.203
Jan 10, 2025 11:54:06.983752012 CET	30203	49712	181.71.216.203	192.168.2.8
Jan 10, 2025 11:54:06.983844042 CET	49712	30203	192.168.2.8	181.71.216.203
Jan 10, 2025 11:54:06.987328053 CET	49712	30203	192.168.2.8	181.71.216.203
Jan 10, 2025 11:54:06.992194891 CET	30203	49712	181.71.216.203	192.168.2.8
Jan 10, 2025 11:54:06.992270947 CET	49712	30203	192.168.2.8	181.71.216.203
Jan 10, 2025 11:54:06.997065067 CET	30203	49712	181.71.216.203	192.168.2.8
Jan 10, 2025 11:54:28.348089933 CET	30203	49712	181.71.216.203	192.168.2.8
Jan 10, 2025 11:54:28.348181009 CET	49712	30203	192.168.2.8	181.71.216.203
Jan 10, 2025 11:54:28.348319054 CET	49712	30203	192.168.2.8	181.71.216.203
Jan 10, 2025 11:54:28.353095055 CET	30203	49712	181.71.216.203	192.168.2.8
Jan 10, 2025 11:54:28.458301067 CET	49716	30203	192.168.2.8	181.71.216.203
Jan 10, 2025 11:54:28.463145018 CET	30203	49716	181.71.216.203	192.168.2.8
Jan 10, 2025 11:54:28.463360071 CET	49716	30203	192.168.2.8	181.71.216.203
Jan 10, 2025 11:54:28.464102030 CET	49716	30203	192.168.2.8	181.71.216.203
Jan 10, 2025 11:54:28.468877077 CET	30203	49716	181.71.216.203	192.168.2.8
Jan 10, 2025 11:54:28.468938112 CET	49716	30203	192.168.2.8	181.71.216.203
Jan 10, 2025 11:54:28.473735094 CET	30203	49716	181.71.216.203	192.168.2.8
Jan 10, 2025 11:54:49.819258928 CET	30203	49716	181.71.216.203	192.168.2.8
Jan 10, 2025 11:54:49.819394112 CET	49716	30203	192.168.2.8	181.71.216.203
Jan 10, 2025 11:54:49.819592953 CET	49716	30203	192.168.2.8	181.71.216.203
Jan 10, 2025 11:54:49.825628996 CET	30203	49716	181.71.216.203	192.168.2.8
Jan 10, 2025 11:54:49.927231073 CET	49717	30203	192.168.2.8	181.71.216.203
Jan 10, 2025 11:54:49.933604002 CET	30203	49717	181.71.216.203	192.168.2.8
Jan 10, 2025 11:54:49.933717012 CET	49717	30203	192.168.2.8	181.71.216.203
Jan 10, 2025 11:54:49.934508085 CET	49717	30203	192.168.2.8	181.71.216.203
Jan 10, 2025 11:54:49.939280033 CET	30203	49717	181.71.216.203	192.168.2.8
Jan 10, 2025 11:54:49.939349890 CET	49717	30203	192.168.2.8	181.71.216.203
Jan 10, 2025 11:54:49.945647001 CET	30203	49717	181.71.216.203	192.168.2.8
Jan 10, 2025 11:55:00.787101030 CET	49717	30203	192.168.2.8	181.71.216.203
Jan 10, 2025 11:55:00.791891098 CET	30203	49717	181.71.216.203	192.168.2.8
Jan 10, 2025 11:55:00.791948080 CET	49717	30203	192.168.2.8	181.71.216.203
Jan 10, 2025 11:55:00.796824932 CET	30203	49717	181.71.216.203	192.168.2.8
Jan 10, 2025 11:55:07.228481054 CET	49717	30203	192.168.2.8	181.71.216.203
Jan 10, 2025 11:55:07.233475924 CET	30203	49717	181.71.216.203	192.168.2.8
Jan 10, 2025 11:55:07.233676910 CET	49717	30203	192.168.2.8	181.71.216.203
Jan 10, 2025 11:55:07.238524914 CET	30203	49717	181.71.216.203	192.168.2.8
Jan 10, 2025 11:55:11.302778006 CET	30203	49717	181.71.216.203	192.168.2.8
Jan 10, 2025 11:55:11.302866936 CET	49717	30203	192.168.2.8	181.71.216.203
Jan 10, 2025 11:55:11.303064108 CET	49717	30203	192.168.2.8	181.71.216.203
Jan 10, 2025 11:55:11.312918901 CET	30203	49717	181.71.216.203	192.168.2.8

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 10, 2025 11:53:23.898183107 CET	57871	53	192.168.2.8	1.1.1.1
Jan 10, 2025 11:53:23.920166969 CET	53	57871	1.1.1.1	192.168.2.8

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Jan 10, 2025 11:53:23.898183107 CET	192.168.2.8	1.1.1.1	0x4f4b	Standard query (0)	newstaticfreepoint24.ddns-ip.net	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Jan 10, 2025 11:53:23.920166969 CET	1.1.1.1	192.168.2.8	0x4f4b	No error (0)	newstaticfreepoint24.ddns-ip.net		181.71.216.203	A (IP address)	IN (0x0001)	false

Target ID:	0
Start time:	05:52:59
Start date:	10/01/2025
Path:	C:\Users\user\Desktop\ReaderPDFadobe.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\ReaderPDFadobe.exe"
Imagebase:	0x400000
File size:	5'649'920 bytes
MD5 hash:	5B3F4288F2239F1805E7D5C935FEC648
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	5
Start time:	05:53:18
Start date:	10/01/2025
Path:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe"
Imagebase:	0xa30000
File size:	2'141'552 bytes
MD5 hash:	EB80BB1CA9B9C7F516FF69AFCFD75B7D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_CosturaAssemblyLoader, Description: Yara detected Costura Assembly Loader, Source: 00000005.00000002.2677754676.0000000009D20000.00000004.08000000.00040000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CosturaAssemblyLoader, Description: Yara detected Costura Assembly Loader, Source: 00000005.00000002.2675966448.00000000074E1000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CosturaAssemblyLoader, Description: Yara detected Costura Assembly Loader, Source: 00000005.00000002.2676942316.0000000008681000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
Reputation:	moderate
Has exited:	false

Show Windows behavior

Execution Graph

Execution Coverage:	9.8%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	29.6%
Total number of Nodes:	27
Total number of Limit Nodes:	3

Executed Functions

Function 09DCEEA8 Relevance: 1.6, APIs: 1, Instructions: 148
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

KiUserExceptionDispatcher.NTDLL ref: 09DCEF74

Memory Dump Source

Source File: 00000005.00000002.2677862177.0000000009DC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 09DC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_9dc0000_csc.jbxd

Similarity

API ID: DispatcherExceptionUser
String ID:
API String ID: 6842923-0
Opcode ID: 75d52e23337b6f8c638a49d0248d159c3dfbb9b2ae1991a8275abaf66b4f9246
Instruction ID: d4106f4f133d81afde7081fdf692e732f7080fdde6eb07fb00904815a2eac2a0
Opcode Fuzzy Hash: 75d52e23337b6f8c638a49d0248d159c3dfbb9b2ae1991a8275abaf66b4f9246
Instruction Fuzzy Hash: 6251BD74B101058FC708DB68E1A5B7A37E7EB9C360B0A54ADD41ACF792DE385C49CB98

Function 09DCEEB8 Relevance: 1.6, APIs: 1, Instructions: 144
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

KiUserExceptionDispatcher.NTDLL ref: 09DCEF74

Memory Dump Source

Source File: 00000005.00000002.2677862177.0000000009DC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 09DC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_9dc0000_csc.jbxd

Similarity

API ID: DispatcherExceptionUser
String ID:
API String ID: 6842923-0
Opcode ID: beee32b3f4c560a9ce3f3b93033e80c3a49559a656eba29295fbb2e0d07796c6
Instruction ID: f8c73e757b0236f726ecfb028fe72d73931b05ab12484b35509e9d241059e891
Opcode Fuzzy Hash: beee32b3f4c560a9ce3f3b93033e80c3a49559a656eba29295fbb2e0d07796c6
Instruction Fuzzy Hash: FF51AE74B101058FD744DB69E1A4B7A37E7EB9C360B0954ACE51ACF392DE385C488B98

Function 09D93D33 Relevance: .3, Instructions: 311
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000005.00000002.2677834040.0000000009D90000.00000040.00000800.00020000.00000000.sdmp, Offset: 09D90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_9d90000_csc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 343d7c8c99018c1e05072bc7370ab9fdf09a06e52857c920cd6dd2423f7e619a
Instruction ID: edf3100dc19a6a5366a6d0de652c92122b2b9e766579f10810291e3d437bbc8a
Opcode Fuzzy Hash: 343d7c8c99018c1e05072bc7370ab9fdf09a06e52857c920cd6dd2423f7e619a
Instruction Fuzzy Hash: A6D16D34B50218CFDB14EF65D644BAAB3F3FB88310F1481A9D4169BB66DB389C86CB45

Function 09D93D38 Relevance: .3, Instructions: 308
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000005.00000002.2677834040.0000000009D90000.00000040.00000800.00020000.00000000.sdmp, Offset: 09D90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_9d90000_csc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4784f666f32298c475bac267fd1915606eff4bdfe05b44929401d78801b1e25d
Instruction ID: e49f179926614738ec0da5b8d2c2d84772bd21ef1428a42d9aaa81a832ac86ab
Opcode Fuzzy Hash: 4784f666f32298c475bac267fd1915606eff4bdfe05b44929401d78801b1e25d
Instruction Fuzzy Hash: 1BC16D34B50218CFDB14EF65D544BAAB3F3FB88310F148169D4169BB66DB38AC86CB45

Function 09D95021 Relevance: .3, Instructions: 275COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2677834040.0000000009D90000.00000040.00000800.00020000.00000000.sdmp, Offset: 09D90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_9d90000_csc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 793527ca69b841449171a9be53f85a968886f7144476570c30d458dcd154f714
Instruction ID: bcfe01acb6498d6fab37300f4b488b41bcfe66bd4ad4342eaabf8729a9ae056d
Opcode Fuzzy Hash: 793527ca69b841449171a9be53f85a968886f7144476570c30d458dcd154f714
Instruction Fuzzy Hash: 16B1C230A64209CFEF26EF65E5447ADB3B2FB85308F608079F805ABA52C775D885CB45

Function 09D96C8E Relevance: .3, Instructions: 274COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2677834040.0000000009D90000.00000040.00000800.00020000.00000000.sdmp, Offset: 09D90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_9d90000_csc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ac2c8eed6fec4aa842b5a66bb603018c077b9425ade7458deee6b9084a57fb41
Instruction ID: dada9d6024b712aa319caecca581e17c5a3ba67272d813b96788fbc7303292b5
Opcode Fuzzy Hash: ac2c8eed6fec4aa842b5a66bb603018c077b9425ade7458deee6b9084a57fb41
Instruction Fuzzy Hash: 4FC13834A61104CFDB04EF25D698BA977F2FF89314F6580A8E4059BBA6CB75EC85CB04

Function 09D954E6 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2677834040.0000000009D90000.00000040.00000800.00020000.00000000.sdmp, Offset: 09D90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_9d90000_csc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b956269b6ba58dc460d389904eb6e16180c7be677f917b3ed3a1556373f21de2
Instruction ID: 7422b10dcce3709b27b3ce72a38d8309f10af5047b7290c9c6e2beacd1469a05
Opcode Fuzzy Hash: b956269b6ba58dc460d389904eb6e16180c7be677f917b3ed3a1556373f21de2
Instruction Fuzzy Hash: DDB19F30A64209CFEF16EF65E5447ADB3B2FB85308F608479F805ABA52C775D885CB44

Function 09D92488 Relevance: .3, Instructions: 266COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2677834040.0000000009D90000.00000040.00000800.00020000.00000000.sdmp, Offset: 09D90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_9d90000_csc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e7bae38b15dce9a4ccb6aa750be5a16e49626106d26f053a7d9d0dcfb440ebd1
Instruction ID: 4879ba385454e3abe2bd2648f7be3e1b8062f502e1aa456bbe6103666369708d
Opcode Fuzzy Hash: e7bae38b15dce9a4ccb6aa750be5a16e49626106d26f053a7d9d0dcfb440ebd1
Instruction Fuzzy Hash: E1B1A070E50209DFDF10DFA8C8917ADBBF2BF88354F148129E924EB694EB749845CB81

Function 09D95540 Relevance: .3, Instructions: 252COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2677834040.0000000009D90000.00000040.00000800.00020000.00000000.sdmp, Offset: 09D90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_9d90000_csc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9c53e72f8ff06035d21801db220140eb5c3940da70575d1a1cac2a9b056d73b3
Instruction ID: 79cd6a80449fbc4e143d4f59131bd7d09d96622482a2904e9703dc488ca6dec3
Opcode Fuzzy Hash: 9c53e72f8ff06035d21801db220140eb5c3940da70575d1a1cac2a9b056d73b3
Instruction Fuzzy Hash: D6B18030A64205CFEF26EF65E5447ADB3B2FB85308F608479F805ABA52C775D885CB44

Function 09D954C8 Relevance: .2, Instructions: 247COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2677834040.0000000009D90000.00000040.00000800.00020000.00000000.sdmp, Offset: 09D90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_9d90000_csc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e4a8288a6bd8080f7bb43b4969bc9a68b63ec105cfb963d2b55a47b2048262d5
Instruction ID: 52d4b2024ff994baf50aa831201e753fbb508a7b3c2e0835eb40ddb51851427a
Opcode Fuzzy Hash: e4a8288a6bd8080f7bb43b4969bc9a68b63ec105cfb963d2b55a47b2048262d5
Instruction Fuzzy Hash: 3DA18030A64205CFEF26EF65E5847ADB3B2FB85308F608079F805ABA52C775D885CB44

Function 09D91870 Relevance: .2, Instructions: 238COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2677834040.0000000009D90000.00000040.00000800.00020000.00000000.sdmp, Offset: 09D90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_9d90000_csc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 79d60b55e2950c07886ade5a2961254a5774411cbd8101c66f3168e794363754
Instruction ID: 80bbfc621852216fbdf54885849ba537b35f758ca27cd18219fa94052960d358
Opcode Fuzzy Hash: 79d60b55e2950c07886ade5a2961254a5774411cbd8101c66f3168e794363754
Instruction Fuzzy Hash: AC919E70E5430A9FDF14EFA8C9817ADBBF2AF88304F148529E419E7694EB349845CB81

Function 09C457D0 Relevance: .2, Instructions: 233COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2677595803.0000000009C40000.00000040.00000800.00020000.00000000.sdmp, Offset: 09C40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_9c40000_csc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c094368a696f82aa7b18881bc156e9db25853f0ec376174c67b61c73960c3c31
Instruction ID: 864649791bec1e94ddbfcd9b499fd68ed2d03da50ab9b9f1a2892f3bf1c1bc49
Opcode Fuzzy Hash: c094368a696f82aa7b18881bc156e9db25853f0ec376174c67b61c73960c3c31
Instruction Fuzzy Hash: 34A1AF34F00288CFEB14CB56E584BA977F3FB84310F5880B9F4019B296DB799A85CB59

Function 09D94100 Relevance: .2, Instructions: 222COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2677834040.0000000009D90000.00000040.00000800.00020000.00000000.sdmp, Offset: 09D90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_9d90000_csc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 44c1de1fb5b2ebb9e0957883265861370c023d5969d79ec5b6d46e67e2be79c9
Instruction ID: 3582798d729abc0e805d96b451fffaa92485d346c3a812647526cc8e541fdabc
Opcode Fuzzy Hash: 44c1de1fb5b2ebb9e0957883265861370c023d5969d79ec5b6d46e67e2be79c9
Instruction Fuzzy Hash: FB916C30B50218CFDB14EF65D544B6AB3F2FB84305F248169E4159BB66DB34DC86CB45

Function 09D93500 Relevance: .2, Instructions: 215COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2677834040.0000000009D90000.00000040.00000800.00020000.00000000.sdmp, Offset: 09D90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_9d90000_csc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1e14ac4fffd503621b35893d63775c71177e3098a9a79f9e1cda9b19a3eb93bb
Instruction ID: 0f594824ebd5da89c04b1c2533f233a6ac855c46a7e129692256781d340d9d05
Opcode Fuzzy Hash: 1e14ac4fffd503621b35893d63775c71177e3098a9a79f9e1cda9b19a3eb93bb
Instruction Fuzzy Hash: 4F81B034B60204CFEF18EF25D554BA9B3E3FB88354F1480B9D0169BB96DB389885CB59

Function 09D934F1 Relevance: .2, Instructions: 215COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2677834040.0000000009D90000.00000040.00000800.00020000.00000000.sdmp, Offset: 09D90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_9d90000_csc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6b49053743430b61de148e46d11fe45d77db59f8cef571eff9e39c249074dbb0
Instruction ID: 20cb7b28e6f93638014a24c43e1b0a25a2ea2712f0ec5cab25970b5779079bae
Opcode Fuzzy Hash: 6b49053743430b61de148e46d11fe45d77db59f8cef571eff9e39c249074dbb0
Instruction Fuzzy Hash: E181B034B60204CFEF18EF25D554BA9B3E3FB88350F1580B9D0069BB56DB389885CB59

Function 09D9545C Relevance: .2, Instructions: 207COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2677834040.0000000009D90000.00000040.00000800.00020000.00000000.sdmp, Offset: 09D90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_9d90000_csc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dd22bfb53570c6b2d1524d1044c182b671e5f3d14ea8f9c2217fdda347bc26f2
Instruction ID: 8d307a2bc350caa36ecf7e4277189b4c7bee5c4ef3bdf6c16e4b97df97232bca
Opcode Fuzzy Hash: dd22bfb53570c6b2d1524d1044c182b671e5f3d14ea8f9c2217fdda347bc26f2
Instruction Fuzzy Hash: B8919030A64209CFEF26EF55E5847ADB7B2FB80308F608079F811ABA52C775D885CB44

Function 09DCF115 Relevance: .2, Instructions: 160COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2677862177.0000000009DC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 09DC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_9dc0000_csc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7298d4bc04f0804a6bf3f846ff7ddcf6a4fb2f57fe8aa1a362248d2c499c0a8b
Instruction ID: 20c64461cbf4c28246fd5c999f9c653d305d7263e13d9d6194040791c7de2728
Opcode Fuzzy Hash: 7298d4bc04f0804a6bf3f846ff7ddcf6a4fb2f57fe8aa1a362248d2c499c0a8b
Instruction Fuzzy Hash: 21519DB4A8120ACFDB14CF6DE6447E97BB3FB89310F64806DE001DBA55CB749885CB55

Function 05913C4B Relevance: .2, Instructions: 151COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2675190697.0000000005910000.00000040.00000800.00020000.00000000.sdmp, Offset: 05910000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_5910000_csc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1a083b48bf2bdfca10ec69b988d823f8c04445d379a31b2fabc1eee9469a1d1e
Instruction ID: d02076e00149daef5a2e94e5c14d13d988982d9ff450291ca176c5732333c81e
Opcode Fuzzy Hash: 1a083b48bf2bdfca10ec69b988d823f8c04445d379a31b2fabc1eee9469a1d1e
Instruction Fuzzy Hash: 4A511774A107888FE708DF7AE941699BFE3FBC8200F54C56DD8049B266EF7029059F55

Function 05913C58 Relevance: .1, Instructions: 149COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2675190697.0000000005910000.00000040.00000800.00020000.00000000.sdmp, Offset: 05910000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_5910000_csc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ee50410d59d6b0631d111f18609227ef30d7ecc6d13de99f9a76e438847afa3a
Instruction ID: c59cbf4ded8bed63dedc563a7c2bc137ad8ded7cd3e34f6e4d253270e19bcb0b
Opcode Fuzzy Hash: ee50410d59d6b0631d111f18609227ef30d7ecc6d13de99f9a76e438847afa3a
Instruction Fuzzy Hash: 76511574A10B488FE708DF7AE94169ABFE7FBC8200F44C56DE8049B266EF7028059B55

Function 0591C1D8 Relevance: 1.6, APIs: 1, Instructions: 56
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualProtect.KERNELBASE(?,?,?,?), ref: 0591C24C

Memory Dump Source

Source File: 00000005.00000002.2675190697.0000000005910000.00000040.00000800.00020000.00000000.sdmp, Offset: 05910000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_5910000_csc.jbxd

Similarity

API ID: ProtectVirtual
String ID:
API String ID: 544645111-0
Opcode ID: 4b777d71a5e1262587382c455865274231e9bbeed9604172c9190da8a2689b12
Instruction ID: 7f7f991e6720111b90bcc12dbdd3fe074cbabd9a668b1a2c32f6094e581d8a56
Opcode Fuzzy Hash: 4b777d71a5e1262587382c455865274231e9bbeed9604172c9190da8a2689b12
Instruction Fuzzy Hash: 6111F471D043499FDB10DFAAC884B9EFBF9BF88720F54842AE819A7240C7759944CFA4

Function 09D92984 Relevance: 1.3, Strings: 1, Instructions: 51
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

3, xrefs: 09D92913

Memory Dump Source

Source File: 00000005.00000002.2677834040.0000000009D90000.00000040.00000800.00020000.00000000.sdmp, Offset: 09D90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_9d90000_csc.jbxd

Similarity

API ID:
String ID: 3
API String ID: 0-1842515611
Opcode ID: 2c8ef1545489ee75b18aad754d0a14fd4e205c9f9bad9cddba159597306d5a4f
Instruction ID: fdcc71afacf456531f4183d7e93a87a89a1efa779d594863a57595a791446f34
Opcode Fuzzy Hash: 2c8ef1545489ee75b18aad754d0a14fd4e205c9f9bad9cddba159597306d5a4f
Instruction Fuzzy Hash: 1A11EC76D40209EFDF10EFA9D5053AEBBF0EB84324F20846AD2A8A7A51C7385506CB91

Function 0591C388 Relevance: 1.3, APIs: 1, Instructions: 49
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CloseHandle.KERNELBASE ref: 0591C3EA

Memory Dump Source

Source File: 00000005.00000002.2675190697.0000000005910000.00000040.00000800.00020000.00000000.sdmp, Offset: 05910000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_5910000_csc.jbxd

Similarity

API ID: CloseHandle
String ID:
API String ID: 2962429428-0
Opcode ID: 1250fdfe264586d9d546fe68b0f2c9335a65c014cb76d87e44bfaf3e8e2b7b99
Instruction ID: b2db689ae7a882d1879e8757ce92672d4f3035bf6faa90b86f30aabf7b867bc2
Opcode Fuzzy Hash: 1250fdfe264586d9d546fe68b0f2c9335a65c014cb76d87e44bfaf3e8e2b7b99
Instruction Fuzzy Hash: 44113A71D043498FDB20DFAAC4457EEFBF9EF88624F248419D519A7240CB756944CF94

Function 09D80078 Relevance: .6, Instructions: 597COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2677802483.0000000009D80000.00000040.00000800.00020000.00000000.sdmp, Offset: 09D80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_9d80000_csc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bf1e767e64a2a747af9c1148a91a1b15f6d4877b22018d540dd95abe9b8e9abd
Instruction ID: 281ad8ac8eb959819b461ae730b9425018eb800246baf6c5b06e74d0113b2f64
Opcode Fuzzy Hash: bf1e767e64a2a747af9c1148a91a1b15f6d4877b22018d540dd95abe9b8e9abd
Instruction Fuzzy Hash: 4502DA30B802189BDB393978985E37F29A7ABC4B91B41446DEE43D7B46DE34CC4D8792

Function 09D80810 Relevance: .4, Instructions: 362
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000005.00000002.2677802483.0000000009D80000.00000040.00000800.00020000.00000000.sdmp, Offset: 09D80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_9d80000_csc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1f5f3885de2c62508374b2bd560a9d2d840429e0c7ff48b6ad086bd92ed478db
Instruction ID: b71d1e47f5518bb86ab8bb573165e83770cba21ed4099ecbf228be09f486a2a4
Opcode Fuzzy Hash: 1f5f3885de2c62508374b2bd560a9d2d840429e0c7ff48b6ad086bd92ed478db
Instruction Fuzzy Hash: 28C17934B846159B9F19BB28E06E1BEBAA7BFC5341319442DE807C3742DF399C4B8742

Function 09D92485 Relevance: .3, Instructions: 259COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2677834040.0000000009D90000.00000040.00000800.00020000.00000000.sdmp, Offset: 09D90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_9d90000_csc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 36b88c3f53abf533f4d5838182f7be459d95ff1fee750daae2d8fd6bfb73920a
Instruction ID: e4ba3a795438aaa6b3f53ee04acc9ee788b9503f62d1b5c9dc3b7c927fe199b8
Opcode Fuzzy Hash: 36b88c3f53abf533f4d5838182f7be459d95ff1fee750daae2d8fd6bfb73920a
Instruction Fuzzy Hash: F9A18D70E50209DFDF10EFA8D88579DBBF1BF88354F148129E924EB694EB749845CB81

Function 09C41789 Relevance: .3, Instructions: 257COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2677595803.0000000009C40000.00000040.00000800.00020000.00000000.sdmp, Offset: 09C40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_9c40000_csc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9dd392c8c18b4eeb539d1232da2ba83769d89b344612a9b7944c38024f01b217
Instruction ID: 8ab1421baf03e40c46bd410b5a2d6bfd9f93026494a2b51ee3c4fbf4f680ea41
Opcode Fuzzy Hash: 9dd392c8c18b4eeb539d1232da2ba83769d89b344612a9b7944c38024f01b217
Instruction Fuzzy Hash: 8CA19B34B006048FDB04DF69E494A59BBF6FF88310F1985A9E845EB3A2CB31ED41CB95

Function 09D9186C Relevance: .2, Instructions: 234COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2677834040.0000000009D90000.00000040.00000800.00020000.00000000.sdmp, Offset: 09D90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_9d90000_csc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0faa85bb6402fe4e1ac762c9c86afba2cdf4f183e76100242887c03054d0f376
Instruction ID: e35b7010d9874a71a0b7a11d4308c3393bff415c0b0217fd8e120cf8d39b3a2f
Opcode Fuzzy Hash: 0faa85bb6402fe4e1ac762c9c86afba2cdf4f183e76100242887c03054d0f376
Instruction Fuzzy Hash: 51918E70E5420ADFDF10EFA8C9857DDBBF2AF88304F148129E419A7694EB349845CB91

Function 09C4C388 Relevance: .2, Instructions: 207COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2677595803.0000000009C40000.00000040.00000800.00020000.00000000.sdmp, Offset: 09C40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_9c40000_csc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c7e275219370ac34b1389bd024fa1be1fdb0f953ced9544e2548ad069d805ca6
Instruction ID: c70e5cfc9747145486785203b21606b11b2a036317b4b8956a09690f95039718
Opcode Fuzzy Hash: c7e275219370ac34b1389bd024fa1be1fdb0f953ced9544e2548ad069d805ca6
Instruction Fuzzy Hash: 30816B35B42205AFCB15CFA5E559AEDBBB2FF88301F148469E4519B3A0DB39CE41CB60

Function 09D80CC8 Relevance: .2, Instructions: 183COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2677802483.0000000009D80000.00000040.00000800.00020000.00000000.sdmp, Offset: 09D80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_9d80000_csc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 52e802dcf8b11e12dff61f3d20f71bcb5960c02ba895ca8749292c29cfce5569
Instruction ID: 8cadf1069f9631ca84879d4cb1d9b86697762eed812541fb33f72216983a9a35
Opcode Fuzzy Hash: 52e802dcf8b11e12dff61f3d20f71bcb5960c02ba895ca8749292c29cfce5569
Instruction Fuzzy Hash: 36515F307006854BD70D6AA9C49876BF6BBABD4705F50803DB706C7BA6DFB1CC0A4792

Function 09C45240 Relevance: .2, Instructions: 172COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2677595803.0000000009C40000.00000040.00000800.00020000.00000000.sdmp, Offset: 09C40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_9c40000_csc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a075a47f6c3c1a4ffb4beae11bc95dceecc68e3c7f59047eb345cc76c2024fc4
Instruction ID: 2f347692e364298dbdf396858efd990bc7c829c8fc93a4b62780e62d3bd5c132
Opcode Fuzzy Hash: a075a47f6c3c1a4ffb4beae11bc95dceecc68e3c7f59047eb345cc76c2024fc4
Instruction Fuzzy Hash: 9061B130B00249CFDB249B65E1097697FA6EB84391F0445BEF806CB28ADF78E845CF59

Function 09C4523B Relevance: .2, Instructions: 172COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2677595803.0000000009C40000.00000040.00000800.00020000.00000000.sdmp, Offset: 09C40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_9c40000_csc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 03959c47e4e31509c2b7ef4431768006824682da22d52a1b71cab647dc23af69
Instruction ID: 5b4dbee22bc1b5d5502046a948c97fbf7972758692cc10f74b297eee0c7e7c1e
Opcode Fuzzy Hash: 03959c47e4e31509c2b7ef4431768006824682da22d52a1b71cab647dc23af69
Instruction Fuzzy Hash: A461B130B00249CFDB249B65E1097693FA6EB84351F0445BEF806CB28ADF38E845CF49

Function 09C41790 Relevance: .2, Instructions: 162COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2677595803.0000000009C40000.00000040.00000800.00020000.00000000.sdmp, Offset: 09C40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_9c40000_csc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: aa52a920cbe7266f7ece480d3478462450a837d646f48b5f184b4bf5580e7ae3
Instruction ID: c9bd72bd5f7dc6b5397bd6c7f9961826ac57a989555550057c0e4f45c101597a
Opcode Fuzzy Hash: aa52a920cbe7266f7ece480d3478462450a837d646f48b5f184b4bf5580e7ae3
Instruction Fuzzy Hash: 49615A34B006048FCB14DF29E584A59BBF2FF88310F5981A9E845EB362DB31ED85CB95

Function 09D9528C Relevance: .2, Instructions: 150COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2677834040.0000000009D90000.00000040.00000800.00020000.00000000.sdmp, Offset: 09D90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_9d90000_csc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d07d89091f80e67397e6dfded8731ec167679248ab993f6556317931507f20cf
Instruction ID: 2d3e8ab955d29bbb358b76500c4ec4eba0ed42b22903710ae2bd9525b8e15fad
Opcode Fuzzy Hash: d07d89091f80e67397e6dfded8731ec167679248ab993f6556317931507f20cf
Instruction Fuzzy Hash: 26613C30A65205CFEF26EF55E584BADB7B2EB85308F248079F8116BA52C775D885CF04

Function 09C4F0B0 Relevance: .1, Instructions: 149COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2677595803.0000000009C40000.00000040.00000800.00020000.00000000.sdmp, Offset: 09C40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_9c40000_csc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6678f056d85c2b525ffaf02c7f2de5139bce3d22899ca0318d3cdeef2aba58cd
Instruction ID: e0de8c5d8ba81c94810e275b829bede287b3ff3a2985aa4ac6cdb874d9c8e82a
Opcode Fuzzy Hash: 6678f056d85c2b525ffaf02c7f2de5139bce3d22899ca0318d3cdeef2aba58cd
Instruction Fuzzy Hash: 28514A70B00204AFEB19AF69D45466E77B6FFC9700B90882CD9069B3A4CF35ED06CB91

Function 09C45F3B Relevance: .1, Instructions: 136COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2677595803.0000000009C40000.00000040.00000800.00020000.00000000.sdmp, Offset: 09C40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_9c40000_csc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f1aaa262a536ea8dcdf08300b67b71d2becf4aeea8c47033db5e96eb5ae42604
Instruction ID: 5a838ec4b9bc5e349ac381d174ab102173bdcd72eee10843350027de039ef621
Opcode Fuzzy Hash: f1aaa262a536ea8dcdf08300b67b71d2becf4aeea8c47033db5e96eb5ae42604
Instruction Fuzzy Hash: D551A630F00244CFE714CF16E658B6A77E3EB89711F548079E4029B399CB789D85CB4A

Function 09C4ACCB Relevance: .1, Instructions: 124COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2677595803.0000000009C40000.00000040.00000800.00020000.00000000.sdmp, Offset: 09C40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_9c40000_csc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e30735420737d5fe4e27a89f782e6e94c0004ea0c96a9cd9bb9ac87a29e472b8
Instruction ID: eda00241b5a5deb173ec05e94eb0f7b456f9c0e430c198132dc1629d155d8922
Opcode Fuzzy Hash: e30735420737d5fe4e27a89f782e6e94c0004ea0c96a9cd9bb9ac87a29e472b8
Instruction Fuzzy Hash: BB41E776600114AFDB4A9F98C844D59BBB7FF8C31471A84D8E2099B372DB32DC21EB91

Function 09C4B680 Relevance: .1, Instructions: 123COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2677595803.0000000009C40000.00000040.00000800.00020000.00000000.sdmp, Offset: 09C40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_9c40000_csc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 297c7b929f5800ac1f9c513cbb46648dd01764b5033a1018d0cb748415323016
Instruction ID: a043621ed4548a18a04aa9144d7ccdea4d519072e7567ea9f86272db4367a7ef
Opcode Fuzzy Hash: 297c7b929f5800ac1f9c513cbb46648dd01764b5033a1018d0cb748415323016
Instruction Fuzzy Hash: B641CD30B04B009FE3259F3AD45435A7BE2AF85310F108A29D496CB790DB78EC46CB61

Function 09C4ACD0 Relevance: .1, Instructions: 122COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2677595803.0000000009C40000.00000040.00000800.00020000.00000000.sdmp, Offset: 09C40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_9c40000_csc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bfaaadb9af4fae0943682442d91f6d6f4ce3a2becb81df09171789cb938b589a
Instruction ID: e1170ee3bc83d9cf66919775e51eaf6cd92f43dcc0954b366d9a2e209dff2b14
Opcode Fuzzy Hash: bfaaadb9af4fae0943682442d91f6d6f4ce3a2becb81df09171789cb938b589a
Instruction Fuzzy Hash: 4941F976600104AFDB4A9F98C844D597BB7FF8C31471A80D8E2099B372DB32DC21EB91

Function 09D97130 Relevance: .1, Instructions: 122COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2677834040.0000000009D90000.00000040.00000800.00020000.00000000.sdmp, Offset: 09D90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_9d90000_csc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 54eb474163ea4229267004e8ba1f2cbc863a5953f985a71730d07e1d9901500e
Instruction ID: 7d5f0a869bfa65f77f3332c5086da6098d686cc6e7c6c70a9445ad93f6298042
Opcode Fuzzy Hash: 54eb474163ea4229267004e8ba1f2cbc863a5953f985a71730d07e1d9901500e
Instruction Fuzzy Hash: 66417B30A71205CFDF14EF55D548BAA73E2FB80308F14D0AAE4299BBA6D338D846CB45

Function 09C4559F Relevance: .1, Instructions: 119COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2677595803.0000000009C40000.00000040.00000800.00020000.00000000.sdmp, Offset: 09C40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_9c40000_csc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b7e1bf0b7e0f5119f0ad080b169b41562cdb93ced4c957c344cf7b404ed24d29
Instruction ID: f5b43472067920c97785bd3bcc2d6fc137a0f24c8cdf38062e7928432c4f08a8
Opcode Fuzzy Hash: b7e1bf0b7e0f5119f0ad080b169b41562cdb93ced4c957c344cf7b404ed24d29
Instruction Fuzzy Hash: 6C41D434B205188FDB096B34E52E22D3EE6EB88612B5044BDFC07C7395DF39AD468B85

Function 09C4C6B8 Relevance: .1, Instructions: 117COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2677595803.0000000009C40000.00000040.00000800.00020000.00000000.sdmp, Offset: 09C40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_9c40000_csc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a58339caa0d6e6f94eb7e0d14dcec8e350047b81bbcc0262e0222ee54f60ca7d
Instruction ID: 2ae438b5f2543bc83f9cfb403b0ccb7355e59ea277775335a28a4058013413f3
Opcode Fuzzy Hash: a58339caa0d6e6f94eb7e0d14dcec8e350047b81bbcc0262e0222ee54f60ca7d
Instruction Fuzzy Hash: 77415934F412099FDB24DF69E894FAAB7B6EB88710F10C429E8459B361DB34E841CB90

Function 09C4ACB1 Relevance: .1, Instructions: 116COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2677595803.0000000009C40000.00000040.00000800.00020000.00000000.sdmp, Offset: 09C40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_9c40000_csc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8146936e37fc943d777b0c20071cf333e6e296dfd648dc7b96618b670491b5ee
Instruction ID: 9388fc6d49c9eecad9f58159b5ccf75ccc823e8055fec240bfe80c6c0225aedd
Opcode Fuzzy Hash: 8146936e37fc943d777b0c20071cf333e6e296dfd648dc7b96618b670491b5ee
Instruction Fuzzy Hash: 8941E576240100AFDB4A9F98D904D557BA7FF8C31471A80D8E6098F372CB32DC22EB51

Function 09D956D1 Relevance: .1, Instructions: 108COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2677834040.0000000009D90000.00000040.00000800.00020000.00000000.sdmp, Offset: 09D90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_9d90000_csc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1373955273fea3a8e2037cd33f7af97c0b51efbdbbd12e4ae87f67c9ce98911d
Instruction ID: 524f6711b365d3732faa7102d4370517a01b0a06e2d608c1d919150b0f4e1e8a
Opcode Fuzzy Hash: 1373955273fea3a8e2037cd33f7af97c0b51efbdbbd12e4ae87f67c9ce98911d
Instruction Fuzzy Hash: D541F238A50200CFDB25DF65E584B69BBF2FB88311F5481BDE9198BA91C775EC41CB44

Function 09C4C837 Relevance: .1, Instructions: 107COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2677595803.0000000009C40000.00000040.00000800.00020000.00000000.sdmp, Offset: 09C40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_9c40000_csc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6563a51be17b98aa25c4b50b91fa9da09ba745ef4c827b604b15255740035d4a
Instruction ID: 8e59e3694960acd1222dd0b783d0245f767e35c834e2d3cd92e467a9a03068df
Opcode Fuzzy Hash: 6563a51be17b98aa25c4b50b91fa9da09ba745ef4c827b604b15255740035d4a
Instruction Fuzzy Hash: 96419C71F41219AFCB14CFA5E8456EEBBB1FF89310F00806AE495E7261D734DA46CB91

Function 09D936D2 Relevance: .1, Instructions: 107COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2677834040.0000000009D90000.00000040.00000800.00020000.00000000.sdmp, Offset: 09D90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_9d90000_csc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8655ef3e50a2fd873952659dc7f265cdb8160ece9e4be1c2d8693270ba5fa60d
Instruction ID: e17132785f1b75b1654b6dba6919f5b58cfd245e8cf83db814074ac45beb1d64
Opcode Fuzzy Hash: 8655ef3e50a2fd873952659dc7f265cdb8160ece9e4be1c2d8693270ba5fa60d
Instruction Fuzzy Hash: B3419134BA5204CFDF18EF15D558B69B3E3FB84390F548068D0529BBA5DB39D885CB05

Function 09D956E0 Relevance: .1, Instructions: 104COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2677834040.0000000009D90000.00000040.00000800.00020000.00000000.sdmp, Offset: 09D90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_9d90000_csc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c915f49dfc67151e9fc42178924d02e1a20264651ec146452cac903dc3b91be6
Instruction ID: 3e5ccf15f5ae6ae54ab89e8dbf92a421e9ba3a32cddff37d179adfe1c8a692f9
Opcode Fuzzy Hash: c915f49dfc67151e9fc42178924d02e1a20264651ec146452cac903dc3b91be6
Instruction Fuzzy Hash: B341EE38A20204CFDB21DF65E584B6ABBF2FB88311F5481B9E9199BB91C775EC41CB44

Function 09C0EDE0 Relevance: .1, Instructions: 99COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2677452689.0000000009C00000.00000040.00000800.00020000.00000000.sdmp, Offset: 09C00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_9c00000_csc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 13b17eb91c8bac78a45ab3e68e5917e5f98c43ab64fe2e2526bfe8ad012dca0b
Instruction ID: 7260d9fcaf90bfa559a429b557bed4a3650e4c43db3edd60a7edd20b86022cd4
Opcode Fuzzy Hash: 13b17eb91c8bac78a45ab3e68e5917e5f98c43ab64fe2e2526bfe8ad012dca0b
Instruction Fuzzy Hash: 21319331F403358BEB14EBB9A86436EB6A6EBC5750F014879D91EE7280DB359D018791

Function 09C4B511 Relevance: .1, Instructions: 91COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2677595803.0000000009C40000.00000040.00000800.00020000.00000000.sdmp, Offset: 09C40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_9c40000_csc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4f51b3e0e1fe70bada8501f132e99f6383f1d9d66d6b4e9a60ffbfd3f9f6144a
Instruction ID: 17339594c5195a6472d0f6da8c855a6e7aa53f673823e4b582234dd3606aff0b
Opcode Fuzzy Hash: 4f51b3e0e1fe70bada8501f132e99f6383f1d9d66d6b4e9a60ffbfd3f9f6144a
Instruction Fuzzy Hash: DB210736B05205AFEB049F68E444AAEBB66EFC9320B14813AE905C7350DF32DC16C790

Function 09C4B671 Relevance: .1, Instructions: 91COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2677595803.0000000009C40000.00000040.00000800.00020000.00000000.sdmp, Offset: 09C40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_9c40000_csc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4c52ae64c15a498857d9d8298f191f5cd78cdba664609c4118a423c3e5bc82c1
Instruction ID: 838a13cf0d5c43000019ab536f59bdc167bc9cbf7d32975b2c7bfc6998bd9213
Opcode Fuzzy Hash: 4c52ae64c15a498857d9d8298f191f5cd78cdba664609c4118a423c3e5bc82c1
Instruction Fuzzy Hash: 9B31A271A00B018FE734CF3AD59435ABBF5FF84310F108A2DE49A8B6A1EB74E9458B51

Function 09D97299 Relevance: .1, Instructions: 82COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2677834040.0000000009D90000.00000040.00000800.00020000.00000000.sdmp, Offset: 09D90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_9d90000_csc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5b1714d34e167c2833361c03accbaf342d5cd59319c01097d485d433362d625f
Instruction ID: fbe782cf11963db661b984283c396579b1d9e5d7346192ba7a48fdd38c3b3815
Opcode Fuzzy Hash: 5b1714d34e167c2833361c03accbaf342d5cd59319c01097d485d433362d625f
Instruction Fuzzy Hash: E131C430A71205CFDF14EF55D544BA573A2FB81318F08D0A9E4199FEA2C338E846CB09

Function 09D9723A Relevance: .1, Instructions: 82COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2677834040.0000000009D90000.00000040.00000800.00020000.00000000.sdmp, Offset: 09D90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_9d90000_csc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 27bd7ebd9b577e153f888a11f3811cec6a43bd71fe531bef0b148dc8165ded2e
Instruction ID: ec748735e7afd21a0461524440a0502ff7dc9979fedbaeb8bc973d81529dc4ad
Opcode Fuzzy Hash: 27bd7ebd9b577e153f888a11f3811cec6a43bd71fe531bef0b148dc8165ded2e
Instruction Fuzzy Hash: D931C430A71205CFDF14EF55D144BA573A2FB81358F08D1A9E4199FE62C338E846CB09

Function 09C4A238 Relevance: .1, Instructions: 81COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2677595803.0000000009C40000.00000040.00000800.00020000.00000000.sdmp, Offset: 09C40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_9c40000_csc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ecbb187fc6f07a66f33dadf2f3d7e893c4802a6e0184e3f919d2b64c58b3f85a
Instruction ID: 3f2415ad96fd0c5fdaee2c131a44323d3fe1a2f0fd8a8d2fb7bbc1a5e33f2986
Opcode Fuzzy Hash: ecbb187fc6f07a66f33dadf2f3d7e893c4802a6e0184e3f919d2b64c58b3f85a
Instruction Fuzzy Hash: 8531A030F40118CFDB24CF59E608BAA77E3FB88310F144079E505A7696D7799845CB59

Function 09C4A233 Relevance: .1, Instructions: 80COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2677595803.0000000009C40000.00000040.00000800.00020000.00000000.sdmp, Offset: 09C40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_9c40000_csc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a43f3bafdd40113376a2d07724091e784febc5842de6b03e23427e55308e00cf
Instruction ID: 5337ddaacf8e26b2760e53ffe6de7371a300f2ad35ab745dde9ca088d0b34433
Opcode Fuzzy Hash: a43f3bafdd40113376a2d07724091e784febc5842de6b03e23427e55308e00cf
Instruction Fuzzy Hash: 4931C030F40208CFDB24CF19E6097AA77F3FB88310F144079E005A7696D77A9845CB19

Function 09C49FCC Relevance: .1, Instructions: 78COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2677595803.0000000009C40000.00000040.00000800.00020000.00000000.sdmp, Offset: 09C40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_9c40000_csc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2fd327e2fbe2375a913d3a45a8da21a068e5478f81270413e62f3bc1a10bc3ed
Instruction ID: 21a394ae970d241b8bb3038886d38ba5e1007370589835932e677afd0c708931
Opcode Fuzzy Hash: 2fd327e2fbe2375a913d3a45a8da21a068e5478f81270413e62f3bc1a10bc3ed
Instruction Fuzzy Hash: 5721D7317093945FE30AD779896576B7FA9AFCA200F0944EEE049DB3A3DE345C0583A5

Function 09D93A33 Relevance: .1, Instructions: 76COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2677834040.0000000009D90000.00000040.00000800.00020000.00000000.sdmp, Offset: 09D90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_9d90000_csc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ce1def6c5c5e705b5116770f2d2adc9673b41f09ada5185b4c06887e035c95f3
Instruction ID: 4e41c8d47bc07003e1089438a2998fad99aa9501923f52587b825bc125fd9355
Opcode Fuzzy Hash: ce1def6c5c5e705b5116770f2d2adc9673b41f09ada5185b4c06887e035c95f3
Instruction Fuzzy Hash: E731A070E00218EFDF00EF99D5487ECBBF2EF85314F1080A9D005AB691DB7999888F49

Function 09C4EB70 Relevance: .1, Instructions: 75COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2677595803.0000000009C40000.00000040.00000800.00020000.00000000.sdmp, Offset: 09C40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_9c40000_csc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ac8704e0bc15e4a80511be14da8a4984ab12c0bb4dce1f7fcc53f6063dc58bfe
Instruction ID: 779205bc717fc7d41b371482609ceeb1074a90e81024860a2ec40db9521567c6
Opcode Fuzzy Hash: ac8704e0bc15e4a80511be14da8a4984ab12c0bb4dce1f7fcc53f6063dc58bfe
Instruction Fuzzy Hash: 00213231F00209DFDB10DEB9E804BAEBBB5BB44380F518066E91ADB290E734DA40CB91

Function 09C4B419 Relevance: .1, Instructions: 74COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2677595803.0000000009C40000.00000040.00000800.00020000.00000000.sdmp, Offset: 09C40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_9c40000_csc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 26ed3579b3b44e3ce465f9fe3c932e867739aa345b4f16543d081bdded65c8a9
Instruction ID: bd4a3f6d87f31e8a8c646e35d6f7dd03827bb7b01efde2d4cc8361e69b2ded88
Opcode Fuzzy Hash: 26ed3579b3b44e3ce465f9fe3c932e867739aa345b4f16543d081bdded65c8a9
Instruction Fuzzy Hash: 97214F35E00208AFDB158FA9D8599DEBFB6EF8C320F148129E815A7394DB359D45CBA0

Function 09D961B0 Relevance: .1, Instructions: 73COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2677834040.0000000009D90000.00000040.00000800.00020000.00000000.sdmp, Offset: 09D90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_9d90000_csc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 41fcca943dde69d33a75b966f8b138f4b09264265092f5d70f4d64c0a009470e
Instruction ID: 04259d50b70c965dcc55b1310934dfb14a6ea21094c203591107ba9066ac99a3
Opcode Fuzzy Hash: 41fcca943dde69d33a75b966f8b138f4b09264265092f5d70f4d64c0a009470e
Instruction Fuzzy Hash: 4A21DE30B00214AFDB18DBB8D444AAF7BB6EF89700B508429E50AD7390CA749D06C7A2

Function 09C45D4C Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2677595803.0000000009C40000.00000040.00000800.00020000.00000000.sdmp, Offset: 09C40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_9c40000_csc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 58d4bcd7e38ef4aba6def78012d0e87072907925447091d835d01af71335bbc6
Instruction ID: ab39d003e1d6e42d646dc730934ffc2e85708490221e7e4335596004d66f5a35
Opcode Fuzzy Hash: 58d4bcd7e38ef4aba6def78012d0e87072907925447091d835d01af71335bbc6
Instruction Fuzzy Hash: 1C315974E10219DFDB08DF65E659BADBBF2BF48350F108069E402AB3A1DB349D44CBA0

Function 09C4F718 Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2677595803.0000000009C40000.00000040.00000800.00020000.00000000.sdmp, Offset: 09C40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_9c40000_csc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0022c6f16fe301ce8177bdfa667db2929c76d41eb49b6014efcd949842a6bf3d
Instruction ID: bb4cb632c4d34987ee5423a0cdf7e8c374c91c696ae8178adc2520a190813776
Opcode Fuzzy Hash: 0022c6f16fe301ce8177bdfa667db2929c76d41eb49b6014efcd949842a6bf3d
Instruction Fuzzy Hash: 89218E34700254AFCB05CF2AD850AAA7BE9EF8A350F058099FC94CB361C639DD60DB60

Function 09C4B428 Relevance: .1, Instructions: 67COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2677595803.0000000009C40000.00000040.00000800.00020000.00000000.sdmp, Offset: 09C40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_9c40000_csc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 90b6a6d92fc53432d4374e604247fbf5a596c6e0e17c54f1f30f56486c81e947
Instruction ID: 591fcff3b4e9c44292b103164dceb67297f10bf7c15347acca2151380629d704
Opcode Fuzzy Hash: 90b6a6d92fc53432d4374e604247fbf5a596c6e0e17c54f1f30f56486c81e947
Instruction Fuzzy Hash: D8217C35E00208EFDB148FA9D449ADEBBB6EF8C320F148129E815A7394CB359C41CBA0

Function 09C4A9A3 Relevance: .1, Instructions: 66COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2677595803.0000000009C40000.00000040.00000800.00020000.00000000.sdmp, Offset: 09C40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_9c40000_csc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4a8fd43587ba95bc759e95d3ff7b26e2d736d3ff849be7cc9cb67cb8a6973f40
Instruction ID: b515f02371dd9fef5a5ae864093a9365f334b47aec6f55362734535e3d9332d5
Opcode Fuzzy Hash: 4a8fd43587ba95bc759e95d3ff7b26e2d736d3ff849be7cc9cb67cb8a6973f40
Instruction Fuzzy Hash: AE21A170700306AFDB14DBA8E8197AE7BEAFBC4700F008539D40AD7685DFB469458BE1

Function 09D94D8F Relevance: .1, Instructions: 58COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2677834040.0000000009D90000.00000040.00000800.00020000.00000000.sdmp, Offset: 09D90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_9d90000_csc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4be225af8a235e3ae115ca5cdb4ddecb1a7ef567c21ddd00467b06e5c87b741a
Instruction ID: ef2ab866728cc20c0664807bc77408f3b50ef03b5a001ea851495cf9e38dfe75
Opcode Fuzzy Hash: 4be225af8a235e3ae115ca5cdb4ddecb1a7ef567c21ddd00467b06e5c87b741a
Instruction Fuzzy Hash: 92214530E1020ECBCB04EFA4E59069DFB72FF89300F10C628E801673A8DB31A94ACB45

Function 09D93243 Relevance: .1, Instructions: 57COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2677834040.0000000009D90000.00000040.00000800.00020000.00000000.sdmp, Offset: 09D90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_9d90000_csc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 86176dd75e6b1ead7dc7f1bdef221ccd5fa503acb99d0317cd73540c71a6a8a9
Instruction ID: ca1a9a3983b0131380aa3b0ad416518808521abbad7e9cb259408a90509c5f3e
Opcode Fuzzy Hash: 86176dd75e6b1ead7dc7f1bdef221ccd5fa503acb99d0317cd73540c71a6a8a9
Instruction Fuzzy Hash: 8A218130B50240EFEB14EB64D695BB933E3AB49350F0590B9E216CF792DB389C58CB59

Function 09C4BDC4 Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2677595803.0000000009C40000.00000040.00000800.00020000.00000000.sdmp, Offset: 09C40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_9c40000_csc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8dc36f270fd4f1e62b980f52bef23aeb801daed4520e3577906c6b4e8d39a004
Instruction ID: 047b89f006cb877242e8bd15d7112e04eaf8b222e2df0146123081772f0690e0
Opcode Fuzzy Hash: 8dc36f270fd4f1e62b980f52bef23aeb801daed4520e3577906c6b4e8d39a004
Instruction Fuzzy Hash: FD11A331B01215AFCB548FB9A855BBEBBF1ABC8750F104436EA45D7380EB74C941CBA0

Function 09C4A0CB Relevance: .1, Instructions: 55COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2677595803.0000000009C40000.00000040.00000800.00020000.00000000.sdmp, Offset: 09C40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_9c40000_csc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2d4ee91d1e71f5cdefd656844b27f9d95ad792d05ea5e18d964e09b1e658e46b
Instruction ID: 8faa0bd8a8cd43866af3b38cda5af8718ed448cb65f4e918baf7112102a839a0
Opcode Fuzzy Hash: 2d4ee91d1e71f5cdefd656844b27f9d95ad792d05ea5e18d964e09b1e658e46b
Instruction Fuzzy Hash: A011AD35B441008FD314CA5AE948B57B3E6EBC8711F65847AE50A8B7A5DB74EC41C644

Function 09C4A0D0 Relevance: .1, Instructions: 55COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2677595803.0000000009C40000.00000040.00000800.00020000.00000000.sdmp, Offset: 09C40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_9c40000_csc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b816c174bfc99df7a27b699b9c0d384260e47cc213deba4530da74f6225e5a35
Instruction ID: 170c36a0e744bcf4629b2c917b9257e88890908931fe26df0e96273f410862aa
Opcode Fuzzy Hash: b816c174bfc99df7a27b699b9c0d384260e47cc213deba4530da74f6225e5a35
Instruction Fuzzy Hash: 9D118C31B441048FE3248A5AE848B67B3EAEBC8710F658479E50ECB7A5DB75EC42CA44

Function 09C4BB41 Relevance: .1, Instructions: 55COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2677595803.0000000009C40000.00000040.00000800.00020000.00000000.sdmp, Offset: 09C40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_9c40000_csc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 51084f04a50ecf6b96f67f9ea3b1e8ca4c4a0d7481ba6e69621f3928316da4f8
Instruction ID: 31aaa87a3f82ea566fac745dbe3fae34b5b79afa9d58a9fce0b7c104348c727c
Opcode Fuzzy Hash: 51084f04a50ecf6b96f67f9ea3b1e8ca4c4a0d7481ba6e69621f3928316da4f8
Instruction Fuzzy Hash: D5216279B42259AFDB04CF58E594EADB7F2BF49700F104168E901EB365DB34AD41CB50

Function 09C4BA11 Relevance: .1, Instructions: 55COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2677595803.0000000009C40000.00000040.00000800.00020000.00000000.sdmp, Offset: 09C40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_9c40000_csc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2cf5b90defc58bf414445a63fef8c742428770cd7d34559b7375aade29becd6d
Instruction ID: d679db39252628c8a46ff80692ef19e94f39c2a58e15b325a765ce185d461b34
Opcode Fuzzy Hash: 2cf5b90defc58bf414445a63fef8c742428770cd7d34559b7375aade29becd6d
Instruction Fuzzy Hash: E2118476340359AFDB158F59EC85FAA7BA9FF89710F10806BF605CB2A1C671D904CB60

Function 09C4BDD0 Relevance: .1, Instructions: 55COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2677595803.0000000009C40000.00000040.00000800.00020000.00000000.sdmp, Offset: 09C40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_9c40000_csc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: df1e7e3d30ccf5e463d1127116b6cb85b1ee0550370bf22dc6b2619773d6abf9
Instruction ID: d43fd5548ae732a3ed3b7acf12f9ebddd56b6444ee60f16996195a9bf40202ec
Opcode Fuzzy Hash: df1e7e3d30ccf5e463d1127116b6cb85b1ee0550370bf22dc6b2619773d6abf9
Instruction Fuzzy Hash: 0411A335B00214AFCB549FA9A8157BE7BF2ABC8740F10843AEA05D7380DB34CD418BA0

Function 09D8005D Relevance: .1, Instructions: 51COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2677802483.0000000009D80000.00000040.00000800.00020000.00000000.sdmp, Offset: 09D80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_9d80000_csc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bd82b46768bab84d45eeb4a14f0b4196bb359fa8d38b488d09524a7d4990c063
Instruction ID: 023a21cde57209548ec1823e978378c06921eadfb14dcb4d1acd08fd4242f955
Opcode Fuzzy Hash: bd82b46768bab84d45eeb4a14f0b4196bb359fa8d38b488d09524a7d4990c063
Instruction Fuzzy Hash: 74012B39B853109BC72A2534D81A1AB3F66AB822A13444069E945C7A02C9248C0F9792

Function 09C461A0 Relevance: .0, Instructions: 48COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2677595803.0000000009C40000.00000040.00000800.00020000.00000000.sdmp, Offset: 09C40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_9c40000_csc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 917682603e4ffeb8ca0b2842ea49015a462e37bd30eaee0356cb18fbaa59d82b
Instruction ID: 979a685bcccb335095e12dfcf9cfe372c0b941a4ef784720365b23accef51c95
Opcode Fuzzy Hash: 917682603e4ffeb8ca0b2842ea49015a462e37bd30eaee0356cb18fbaa59d82b
Instruction Fuzzy Hash: 89014731F002188FC3209B79F60472A3BA9EBCA715F0680ABF848D7247CB30DC409791

Function 09D959F7 Relevance: .0, Instructions: 48COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2677834040.0000000009D90000.00000040.00000800.00020000.00000000.sdmp, Offset: 09D90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_9d90000_csc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b34fabe007a33fc6ac5dc5721e0ab3283105a3acf5e3101e421cda30126f6860
Instruction ID: ceb69a48e398604b4deb54de9da8fc43c32f1ca1521729fd02518624b4a4c699
Opcode Fuzzy Hash: b34fabe007a33fc6ac5dc5721e0ab3283105a3acf5e3101e421cda30126f6860
Instruction Fuzzy Hash: 55018B31A01205EBDB199FA4E459AAE7FF6EB8C310F10806DE802A7360CF755D06CB96

Function 09D97399 Relevance: .0, Instructions: 47COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2677834040.0000000009D90000.00000040.00000800.00020000.00000000.sdmp, Offset: 09D90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_9d90000_csc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2d7b04dc353f57f3d14a1d1ecb252e7eab12076a552bf7a5498c803bdba94625
Instruction ID: b31c02448b9694c2d904ef41d5fd8dc283aafd164fb3b42a1bd4896907225cb7
Opcode Fuzzy Hash: 2d7b04dc353f57f3d14a1d1ecb252e7eab12076a552bf7a5498c803bdba94625
Instruction Fuzzy Hash: AC01CC34A20219CFCB04EFA8C6453AEBBF6FF84311F40817AC919C7A11DB749A41CB81

Function 09D948C0 Relevance: .0, Instructions: 45COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2677834040.0000000009D90000.00000040.00000800.00020000.00000000.sdmp, Offset: 09D90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_9d90000_csc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4c4b4064fba0dc316e68b75e93f76e38bf92390521af31cf774220675c446f8c
Instruction ID: 060a842de28a0dc898703fc8baf73627ac2145730bee139a89e3e587a2a542bb
Opcode Fuzzy Hash: 4c4b4064fba0dc316e68b75e93f76e38bf92390521af31cf774220675c446f8c
Instruction Fuzzy Hash: 93F0C230B023A29FDF1A7B74441436E3AD69FC9912B1408BDD546CB381EE3AC84283C4

Function 09D948B9 Relevance: .0, Instructions: 45COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2677834040.0000000009D90000.00000040.00000800.00020000.00000000.sdmp, Offset: 09D90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_9d90000_csc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 05bc4d4eff002661673308e0933258723bf886f2fa341e885a77b68fc11d5cc1
Instruction ID: 4f995612175dd5c0ba49b3faf8440cfc276d578193bd62c53d1533e32e87ec3f
Opcode Fuzzy Hash: 05bc4d4eff002661673308e0933258723bf886f2fa341e885a77b68fc11d5cc1
Instruction Fuzzy Hash: 00018131B033619FDB1A7B74441536E7BD66FC9612B15087ED446CB381EE3AC84287C4

Function 09D973A8 Relevance: .0, Instructions: 44COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2677834040.0000000009D90000.00000040.00000800.00020000.00000000.sdmp, Offset: 09D90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_9d90000_csc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2c03ec54fde901b2dfbe944660b638778de88218f59ffcb8f3981a417c2aba94
Instruction ID: 3a116a7bf8c15293e0bd959a5ead452f238ab6e10c4d3ef48b68faf91c8b8990
Opcode Fuzzy Hash: 2c03ec54fde901b2dfbe944660b638778de88218f59ffcb8f3981a417c2aba94
Instruction Fuzzy Hash: 6201DF30A201088FCB04EAB9950476EBBF6EF84320F408179D918C3B00DB34DA42CB82

Function 09D95A08 Relevance: .0, Instructions: 44COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2677834040.0000000009D90000.00000040.00000800.00020000.00000000.sdmp, Offset: 09D90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_9d90000_csc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d68f2fff09670bd77fe5adb81b6389eb3b77f1cb6c36375f6e846b4a838f3277
Instruction ID: 69d7e277cd70cf90d23b9b2b90282ce7fdefcd0338399a0976a2be6786e68ae9
Opcode Fuzzy Hash: d68f2fff09670bd77fe5adb81b6389eb3b77f1cb6c36375f6e846b4a838f3277
Instruction Fuzzy Hash: 30019E30A00208EBDB195F65E8186AE7BB6EB8C310F108429F902A7350CF755D05CB96

Function 09D95D9B Relevance: .0, Instructions: 42COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2677834040.0000000009D90000.00000040.00000800.00020000.00000000.sdmp, Offset: 09D90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_9d90000_csc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6751f9967cda8500b59740b384c5078be9fe2bca992fb6896405d2df8084392c
Instruction ID: 903b2df0f17d127eae19153f8dc830d71d3deae3c21323ef348e414d2c562f11
Opcode Fuzzy Hash: 6751f9967cda8500b59740b384c5078be9fe2bca992fb6896405d2df8084392c
Instruction Fuzzy Hash: 89F028737792408FDB01EB34F84499A7BB0EB8533175044B7F601CB562E6324802C764

Function 09D961AF Relevance: .0, Instructions: 42COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2677834040.0000000009D90000.00000040.00000800.00020000.00000000.sdmp, Offset: 09D90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_9d90000_csc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1c429b95c3b70eee12b2623212eae9da3971d520050654de219061cbcdcc2dd2
Instruction ID: c0887beef3bcab39473f01f089ce395ad36845e16c33af57913328612fe898eb
Opcode Fuzzy Hash: 1c429b95c3b70eee12b2623212eae9da3971d520050654de219061cbcdcc2dd2
Instruction Fuzzy Hash: A101AD31A102149FCB24DF68D848FABBBF8FF89710F108129E509D7260CB709906CBA1

Function 09C4AE51 Relevance: .0, Instructions: 39COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2677595803.0000000009C40000.00000040.00000800.00020000.00000000.sdmp, Offset: 09C40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_9c40000_csc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fe7cef90581486436e84131299bc2a54d33680a1529802975ddf0a50f5d529f5
Instruction ID: 114907973173e666c8e7f2c229175cc703c740a8223afb09c6fa3a954c33a6c6
Opcode Fuzzy Hash: fe7cef90581486436e84131299bc2a54d33680a1529802975ddf0a50f5d529f5
Instruction Fuzzy Hash: 57F02B31F446115FE3144A58A84472BF7D6EFC8750F144479E405DB350CB72DC418394

Function 09D949E0 Relevance: .0, Instructions: 39COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2677834040.0000000009D90000.00000040.00000800.00020000.00000000.sdmp, Offset: 09D90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_9d90000_csc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 21892e7a701a4b98a413047f05652098c6d2ef126301d2202a438bb7ca0121a6
Instruction ID: d05a1fe251139b911944dbf835076a6492f6f9541a70e0c5713f484a17662884
Opcode Fuzzy Hash: 21892e7a701a4b98a413047f05652098c6d2ef126301d2202a438bb7ca0121a6
Instruction Fuzzy Hash: DAF08B32A651288BCF24DEA5E4847AEFB77EBC0354F01813AE401A3B65DB70A805C789

Function 09D95D31 Relevance: .0, Instructions: 39COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2677834040.0000000009D90000.00000040.00000800.00020000.00000000.sdmp, Offset: 09D90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_9d90000_csc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 39568e208e78e36c797a32b32d4e9b066d081e9e0c7428202155eaeef84c9fac
Instruction ID: 213ee75f190dc372e8304b0214a3350f5676fa29f6457e3c5c62127dde67ef9e
Opcode Fuzzy Hash: 39568e208e78e36c797a32b32d4e9b066d081e9e0c7428202155eaeef84c9fac
Instruction Fuzzy Hash: 72F090727502145FDB10AA65BC49FAFB7A5FBC4721F10403AF601D62A0DB719801C7A4

Function 09C4AEB0 Relevance: .0, Instructions: 38COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2677595803.0000000009C40000.00000040.00000800.00020000.00000000.sdmp, Offset: 09C40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_9c40000_csc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 996536acb4f546dbacff98a2c0c809daab2ae2f7e9b537a2ccb80e09f7bd0a15
Instruction ID: a009946e1328f8c5acee4f8cdb2d9de9fc8c9fb4cec7ecda97f19758c75d8ff5
Opcode Fuzzy Hash: 996536acb4f546dbacff98a2c0c809daab2ae2f7e9b537a2ccb80e09f7bd0a15
Instruction Fuzzy Hash: 08F024A2F8E3905FE31207B468153297FA19FCA680F0804EAD0818F2A2DA56DC028351

Function 09C00769 Relevance: .0, Instructions: 38COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2677452689.0000000009C00000.00000040.00000800.00020000.00000000.sdmp, Offset: 09C00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_9c00000_csc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 24c99c2c1dfdd919338c82e2f4639afa3289f9c66ab8ae4499a0ca588f07adf5
Instruction ID: cc1889fb117a466846f71838f1fef315e2f6c00e724dd4b04d3d1affe05bf2d5
Opcode Fuzzy Hash: 24c99c2c1dfdd919338c82e2f4639afa3289f9c66ab8ae4499a0ca588f07adf5
Instruction Fuzzy Hash: 25F09C32D49110BBEB11CA7FB82979AFBA5EBC9751F0A4077D409D3141D6785901CF86

Function 09D94C89 Relevance: .0, Instructions: 35COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2677834040.0000000009D90000.00000040.00000800.00020000.00000000.sdmp, Offset: 09D90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_9d90000_csc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1b1daeeba919f7ebdc57b7a71d4a387f743b6f9bf5cc8c59d966afe834bd6cda
Instruction ID: cef2db3b68089822776e08c95b46885a44365b88f1fa74ac0f419b63c3432fb2
Opcode Fuzzy Hash: 1b1daeeba919f7ebdc57b7a71d4a387f743b6f9bf5cc8c59d966afe834bd6cda
Instruction Fuzzy Hash: AAF0C8307646158FDF1CB710A1643AD33A3ABC0314F5085A8C4039F756EF785C46538D

Function 09C41AD1 Relevance: .0, Instructions: 34COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2677595803.0000000009C40000.00000040.00000800.00020000.00000000.sdmp, Offset: 09C40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_9c40000_csc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 394a7819b6c76dc207eaed1215ce06633c97e3caf3b5cdbbbe979307da6b0936
Instruction ID: e27d2ca2419a8b3d264b1038a6521b723b7e9e159ed1cc68e7683ffc45d6f05d
Opcode Fuzzy Hash: 394a7819b6c76dc207eaed1215ce06633c97e3caf3b5cdbbbe979307da6b0936
Instruction Fuzzy Hash: 7CF055323003281FE308227D1C247AAAA8EEFC5510F59846FE00ACB3A1CDB88C0653B1

Function 09C4B5A5 Relevance: .0, Instructions: 34COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2677595803.0000000009C40000.00000040.00000800.00020000.00000000.sdmp, Offset: 09C40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_9c40000_csc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7d71a370e9766494986828f3535a4873eef869f639e748091ff75461740cdbd9
Instruction ID: b21447cf4f7227a9c75a60b01aedac0375c53ab48a5b18cb467b02811f11b370
Opcode Fuzzy Hash: 7d71a370e9766494986828f3535a4873eef869f639e748091ff75461740cdbd9
Instruction Fuzzy Hash: 16F0A0767042417B9B041EAAA8959AFBF5AEFCE3207004439FA08C7300DA318C168760

Function 09C00778 Relevance: .0, Instructions: 34COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2677452689.0000000009C00000.00000040.00000800.00020000.00000000.sdmp, Offset: 09C00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_9c00000_csc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b6e86049d26d4d6eecbb4909274175081c6ffd1792ddd3b2e1f0ed4402437296
Instruction ID: aaa96e5cdcf8653a4b2ff3e4152f8c2207e60cb060365a9b3fa13c48858eeff6
Opcode Fuzzy Hash: b6e86049d26d4d6eecbb4909274175081c6ffd1792ddd3b2e1f0ed4402437296
Instruction Fuzzy Hash: 87F05432D44124BBDB10CA7FB82979EFBA5ABC8751F06817AD409D3141D6385901CF82

Function 09D949D2 Relevance: .0, Instructions: 32COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2677834040.0000000009D90000.00000040.00000800.00020000.00000000.sdmp, Offset: 09D90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_9d90000_csc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7b436fc3909d0bb61d43116c1aae5a7b159d52d422d2d002afecb553b2022f36
Instruction ID: a2e99fa6d4a7d46512f804f257bbacb6f9fee0fbc771246b0263417c2df7078e
Opcode Fuzzy Hash: 7b436fc3909d0bb61d43116c1aae5a7b159d52d422d2d002afecb553b2022f36
Instruction Fuzzy Hash: D4F0B431A262648FCF28DF60D19566ABBB3BB80344F01C07DE402ABB75DB74A845C74D

Function 09D94C62 Relevance: .0, Instructions: 32COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2677834040.0000000009D90000.00000040.00000800.00020000.00000000.sdmp, Offset: 09D90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_9d90000_csc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7becb5eb60d1f4fbea1fdb59d009951497f19b5973b3c6741be8185c1d1aee80
Instruction ID: b192a51149b1d6ebe8cab8c61845236b660d044dc09a6df04f5012d5c5cb3b15
Opcode Fuzzy Hash: 7becb5eb60d1f4fbea1fdb59d009951497f19b5973b3c6741be8185c1d1aee80
Instruction Fuzzy Hash: 7D013630565614CFDB24DF14D2C4B5973A2EB40329F559298D4125FEBBD374D846CB4C

Function 09D93A38 Relevance: .0, Instructions: 32COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2677834040.0000000009D90000.00000040.00000800.00020000.00000000.sdmp, Offset: 09D90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_9d90000_csc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bb9c15bc56a4174c0a4f8cc4525b77c7634c23f7a8cbfcccbfb16fda7a0b0e46
Instruction ID: cb602303d68129fc7b76f4c858d4d3614491c03a5444391ade21504f54db26d0
Opcode Fuzzy Hash: bb9c15bc56a4174c0a4f8cc4525b77c7634c23f7a8cbfcccbfb16fda7a0b0e46
Instruction Fuzzy Hash: 62F05831B002189FCF00EAA9D808ADE77B6EF89711F4044A8E105AB751DB3AAC098BD5

Function 09C41AE0 Relevance: .0, Instructions: 31COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2677595803.0000000009C40000.00000040.00000800.00020000.00000000.sdmp, Offset: 09C40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_9c40000_csc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4f6d4088e71b7ef4397a1179c152b87261d4672cdffddc8d14d04182b4327925
Instruction ID: 263de1836a718538746d2fd87defd2e1f5f8c98d884e6937472ea734e7a82c52
Opcode Fuzzy Hash: 4f6d4088e71b7ef4397a1179c152b87261d4672cdffddc8d14d04182b4327925
Instruction Fuzzy Hash: 06E0482130032827E70C256E5C58B6BA98EEBC5A50F54843EA50DC7395CDA19C0613E5

Function 09C4619C Relevance: .0, Instructions: 30COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2677595803.0000000009C40000.00000040.00000800.00020000.00000000.sdmp, Offset: 09C40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_9c40000_csc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a7f313b56ffe67e4e85a155d71aafec25bec40a5247d99c14fdfec4c4c51b96c
Instruction ID: 002c20da6d2c4b263a9c2d3da0543762a879808599020fd5cff6001605bfa314
Opcode Fuzzy Hash: a7f313b56ffe67e4e85a155d71aafec25bec40a5247d99c14fdfec4c4c51b96c
Instruction Fuzzy Hash: 57F0E231F001149FC7209B68F2047257BA9EB86764F0681AAEC58DB307CB30ED80CB91

Function 09C422D9 Relevance: .0, Instructions: 30COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2677595803.0000000009C40000.00000040.00000800.00020000.00000000.sdmp, Offset: 09C40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_9c40000_csc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: da4f7ae9d21c58521982f790ee3aacc6e5926be84bc2e9a4992f0dbe6de31560
Instruction ID: b1346e66abb6143ac3723e33b176b4455556ff10f3afc95cd07f1bd19e0d5151
Opcode Fuzzy Hash: da4f7ae9d21c58521982f790ee3aacc6e5926be84bc2e9a4992f0dbe6de31560
Instruction Fuzzy Hash: D8F09031F25264CBFB209E51E961B6972706F04300F4900B4EA896B2C1C330AE82CF96

Function 09C02424 Relevance: .0, Instructions: 27COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2677452689.0000000009C00000.00000040.00000800.00020000.00000000.sdmp, Offset: 09C00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_9c00000_csc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b9ccc13e297244401b25639cb0d7b790bf4bc27ddeb72ecf7fbb0e2634b27e4a
Instruction ID: 6f911edddda7aeeddb531c82f710993566e4e4332d12550461b7fcd373456502
Opcode Fuzzy Hash: b9ccc13e297244401b25639cb0d7b790bf4bc27ddeb72ecf7fbb0e2634b27e4a
Instruction Fuzzy Hash: 43F01D74D04215CFC760CB18C855B54B7B0BF89314F0500F9D599A7361D7309D41DF42

Function 09D94A40 Relevance: .0, Instructions: 27COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2677834040.0000000009D90000.00000040.00000800.00020000.00000000.sdmp, Offset: 09D90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_9d90000_csc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1559c21b9b800f1e72e1e52e9cccb48cbbb96033e6758141c7ac5bd2d01125d1
Instruction ID: 4646417834fbb33dceab2ab742a25139138fbf4ffdeff6388a31d3d88c8869a4
Opcode Fuzzy Hash: 1559c21b9b800f1e72e1e52e9cccb48cbbb96033e6758141c7ac5bd2d01125d1
Instruction Fuzzy Hash: 39F0E5307245268FDF5C7724A0643AD32A3ABC0300F90C8A8C9039B796EF782C4623CE

Function 09D93C30 Relevance: .0, Instructions: 27COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2677834040.0000000009D90000.00000040.00000800.00020000.00000000.sdmp, Offset: 09D90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_9d90000_csc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cf16e3a5ea51ebdfc5a05f1921c1c4b8d2de9c105d3772346ad0f5ff78490daa
Instruction ID: 39325917845f101e9fa4bad6af8847c4253993dc01f3d1d92a94c78a68e3b93b
Opcode Fuzzy Hash: cf16e3a5ea51ebdfc5a05f1921c1c4b8d2de9c105d3772346ad0f5ff78490daa
Instruction Fuzzy Hash: 33F03930E5064ACFCF14BB79C5143AEB3B6DB89311F008878D5029B741EA399816CB91

Function 09D93C2C Relevance: .0, Instructions: 27COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2677834040.0000000009D90000.00000040.00000800.00020000.00000000.sdmp, Offset: 09D90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_9d90000_csc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: be67d47c985fe34c904d53e5bdd5973ae980ef9e4365fe6edafa385297f379ee
Instruction ID: b67ca222311e045a553867dad4f4f2bdd6b8811b311fc70f0c1ebc16857aae3a
Opcode Fuzzy Hash: be67d47c985fe34c904d53e5bdd5973ae980ef9e4365fe6edafa385297f379ee
Instruction Fuzzy Hash: F3F03934E5464ACFCF14BB75C1143AEB7B2DB89311F00887CD5129B742EA398816CF91

Function 09C4D21C Relevance: .0, Instructions: 26COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2677595803.0000000009C40000.00000040.00000800.00020000.00000000.sdmp, Offset: 09C40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_9c40000_csc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c908afe0fe2c72c132102088ab26978c3d40742c0da4b40fce65d01f562d7944
Instruction ID: c697444e925a5bfcb4f44b500444d6d9e9e6f32ed6bef40e8663343b85f6fa47
Opcode Fuzzy Hash: c908afe0fe2c72c132102088ab26978c3d40742c0da4b40fce65d01f562d7944
Instruction Fuzzy Hash: 5CF03031E04615BBDB19DFA4E44CADD7FB6EB85211F048095E04697281DB785B81C784

Function 09C4D220 Relevance: .0, Instructions: 26COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2677595803.0000000009C40000.00000040.00000800.00020000.00000000.sdmp, Offset: 09C40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_9c40000_csc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e73b5ef9d6db2ef48daaf3ca0764cd3120f9e605c3055c8fd29bacaafe281842
Instruction ID: 9d6e6d711ca1ffa8569f3dfa6ca58f1795f4a03bca9971573ee45d1299e48872
Opcode Fuzzy Hash: e73b5ef9d6db2ef48daaf3ca0764cd3120f9e605c3055c8fd29bacaafe281842
Instruction Fuzzy Hash: 50F03031E04218ABDB19DFA4E44C6DDBFF6AB85211F048095E00693281DB745A81C794

Function 09D94988 Relevance: .0, Instructions: 26COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2677834040.0000000009D90000.00000040.00000800.00020000.00000000.sdmp, Offset: 09D90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_9d90000_csc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5e6929128e74309b0fa7cd2460e3631112a1b04cb7ef1255baf231009c4986db
Instruction ID: ea89810e4a17d6966b3de7bed6f868fcf18973ab7b308a632f4e07221d63e3eb
Opcode Fuzzy Hash: 5e6929128e74309b0fa7cd2460e3631112a1b04cb7ef1255baf231009c4986db
Instruction Fuzzy Hash: 9AE022312047185FC706AB2A91006483FA1EBC2A21B0100FAD1098F122CBB85C46C3D5

Function 09C49252 Relevance: .0, Instructions: 25COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2677595803.0000000009C40000.00000040.00000800.00020000.00000000.sdmp, Offset: 09C40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_9c40000_csc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ab8659390e3d2a64c0c69472d03c413d3719292b9fc5ee53e54f3aba1e5444a8
Instruction ID: 723d176edbb81409a10e81e198335854f6cb57be12ec8544bb524a69f898ebc0
Opcode Fuzzy Hash: ab8659390e3d2a64c0c69472d03c413d3719292b9fc5ee53e54f3aba1e5444a8
Instruction Fuzzy Hash: 1BF0A934B101108FC344EB788068B2D3BE6AF8C201B4580ACE91FDB351DE34EC068B95

Function 09C045CA Relevance: .0, Instructions: 25COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2677452689.0000000009C00000.00000040.00000800.00020000.00000000.sdmp, Offset: 09C00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_9c00000_csc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d622363d1e44644e327988ab9a17ea380eadd25ec4a895b40b1f8857499db3c7
Instruction ID: 48e0a30f0f3078733e53a47a52c84c4aa7196e1aa65fcf2e13c855e59bd039a8
Opcode Fuzzy Hash: d622363d1e44644e327988ab9a17ea380eadd25ec4a895b40b1f8857499db3c7
Instruction Fuzzy Hash: 3CF0C434E05624CFCB24DF24D958A98B7B1FF89311F4100E9D919A3790D738AE81CF41

Function 09D94C50 Relevance: .0, Instructions: 24COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2677834040.0000000009D90000.00000040.00000800.00020000.00000000.sdmp, Offset: 09D90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_9d90000_csc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 73e760e831ad9ab1455fe6abba107da39f2acae06f0910982c1e5f6622b240d3
Instruction ID: df41b0cb82c4290c8c572ad66fca916c3b89a03afc5c48afc6475681a388160b
Opcode Fuzzy Hash: 73e760e831ad9ab1455fe6abba107da39f2acae06f0910982c1e5f6622b240d3
Instruction Fuzzy Hash: F6E092307642258FDF1CB750A1A436D22A3ABC0318F61C568CA179BBAAEF785C47534E

Function 09C415F5 Relevance: .0, Instructions: 22COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2677595803.0000000009C40000.00000040.00000800.00020000.00000000.sdmp, Offset: 09C40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_9c40000_csc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: df67183f530cde860c74a30b8237491d173440191746e07b08a9a52c0cb52a8d
Instruction ID: 5575c31e10ebcdbb2fa90633913eff0b44d54e9e1dd04bc1e1c7a449aa87331d
Opcode Fuzzy Hash: df67183f530cde860c74a30b8237491d173440191746e07b08a9a52c0cb52a8d
Instruction Fuzzy Hash: 7DF0FE74A04508CFC748CB64D5A5BA97BF1AB0C310F5440BEE41ADB352DB356C44CF18

Function 09C46EDB Relevance: .0, Instructions: 22COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2677595803.0000000009C40000.00000040.00000800.00020000.00000000.sdmp, Offset: 09C40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_9c40000_csc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ee77f2d71711211f307537ea61591d51632e5cb10b1a86a8ab14f78eefb26eeb
Instruction ID: 61d39a5ad3386193266a77c06e2a7831ef24cc561ea546a25d6a3782399ebe77
Opcode Fuzzy Hash: ee77f2d71711211f307537ea61591d51632e5cb10b1a86a8ab14f78eefb26eeb
Instruction Fuzzy Hash: 7EE09B70F00118DBEB249F25E6443663765B78A345B058478DC566624DCB309D019B82

Function 09C45F00 Relevance: .0, Instructions: 20COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2677595803.0000000009C40000.00000040.00000800.00020000.00000000.sdmp, Offset: 09C40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_9c40000_csc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f1a4dbb621429800688363f0088e2f48a04c25859624c2c9d9af20cb18635e21
Instruction ID: 24f855c8da5777a8775a420425597a4f05d75493d242f2e56272fcde53b49da4
Opcode Fuzzy Hash: f1a4dbb621429800688363f0088e2f48a04c25859624c2c9d9af20cb18635e21
Instruction Fuzzy Hash: 17D01772A1120DEBCB10DEB0A9018AAB7ACDB05211B1005EAFC09C3600EE32AA119691

Function 09C01450 Relevance: .0, Instructions: 20COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2677452689.0000000009C00000.00000040.00000800.00020000.00000000.sdmp, Offset: 09C00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_9c00000_csc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 27988b60fd92af159aae8e3b4b49639904446b449087990b93c6ede17ea32824
Instruction ID: 04b947ae98fdfa6f953baf2f1a583a8aad474718276138459b0b6e7f029c044d
Opcode Fuzzy Hash: 27988b60fd92af159aae8e3b4b49639904446b449087990b93c6ede17ea32824
Instruction Fuzzy Hash: C9F0F238A416298FC750CF28D999AA8BBF1FF4D320F1542E5E90A9B761DB349D81DF00

Function 09D94998 Relevance: .0, Instructions: 20COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2677834040.0000000009D90000.00000040.00000800.00020000.00000000.sdmp, Offset: 09D90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_9d90000_csc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4cb3eb14296dd10a720fe2c134d419297cc5aaea152ecf8c511474d463cc12c5
Instruction ID: 9bd07252fb4b721c2177117dd577c96c103ac7ca1879a3c20933d6b677a489fd
Opcode Fuzzy Hash: 4cb3eb14296dd10a720fe2c134d419297cc5aaea152ecf8c511474d463cc12c5
Instruction Fuzzy Hash: E2D02B3130032C6BCB11BA2FE504B5A379AFBC4A22F0001B9E2088B202DF799C45C3D8

Function 09D92988 Relevance: .0, Instructions: 20COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2677834040.0000000009D90000.00000040.00000800.00020000.00000000.sdmp, Offset: 09D90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_9d90000_csc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6f1c692ca6b3334d90c707db30c45a80dfb11c1a3dcda105ab5609434147b441
Instruction ID: 5bd6c2d69784484b95025a1d1e2d19a4d2cebdacd1f11c55703c1a746fd4a1c9
Opcode Fuzzy Hash: 6f1c692ca6b3334d90c707db30c45a80dfb11c1a3dcda105ab5609434147b441
Instruction Fuzzy Hash: CFE04F35D54209EFCF00FE59C5047AEB3B4E784311F004475D62597601E7385516CB51

Function 09C4A8E9 Relevance: .0, Instructions: 19COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2677595803.0000000009C40000.00000040.00000800.00020000.00000000.sdmp, Offset: 09C40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_9c40000_csc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b43cde5ae3fca49cd49849da72230a6f0fdf19ea1a76d947456b67d55ab9a48f
Instruction ID: af443fd61766ad07280dc0aa127092832376d7fce843e10e51ad54ab234f71f7
Opcode Fuzzy Hash: b43cde5ae3fca49cd49849da72230a6f0fdf19ea1a76d947456b67d55ab9a48f
Instruction Fuzzy Hash: A3E08670A04208BFDB00DFB8D45459DBBB9EF45214F10869ADC08D7381EE712E419791

Function 09D94BF3 Relevance: .0, Instructions: 19COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2677834040.0000000009D90000.00000040.00000800.00020000.00000000.sdmp, Offset: 09D90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_9d90000_csc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 43f3659b94c76d805c685433e020b4eba0c81a4066e3de50d626142fb15a6b99
Instruction ID: c6c6dde4218d92f00c440baed3c6e4015bcd3e18af3488caefcbd34c809a4ac5
Opcode Fuzzy Hash: 43f3659b94c76d805c685433e020b4eba0c81a4066e3de50d626142fb15a6b99
Instruction Fuzzy Hash: 5AE0DF34A12114CFCB04CF00D194B9973F2EF48318F2580A8E1024B36AC375ED42CB48

Function 09D959C9 Relevance: .0, Instructions: 18COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2677834040.0000000009D90000.00000040.00000800.00020000.00000000.sdmp, Offset: 09D90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_9d90000_csc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d704bea42d2be026f60ac7229682ac86f1fc2065f908bc2c2d0f140723de831b
Instruction ID: 2c4d14f7e9b8e4021cc841a5ce544817261854966cc140aff74cc40c4707151d
Opcode Fuzzy Hash: d704bea42d2be026f60ac7229682ac86f1fc2065f908bc2c2d0f140723de831b
Instruction Fuzzy Hash: 8FE01D706457405FE7079A2494156567FB1BF9261070940DEE4818B566CB640941C755

Function 09C4A8F0 Relevance: .0, Instructions: 17COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2677595803.0000000009C40000.00000040.00000800.00020000.00000000.sdmp, Offset: 09C40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_9c40000_csc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d536997ebdb95ddc2dc04b11a841e1ccf2c849efeaedcd848e3812979ce9e182
Instruction ID: 9c36efa5a2cdb96a373ab768f47afd80e88bdbb12d943902d8b8995b3fc3afee
Opcode Fuzzy Hash: d536997ebdb95ddc2dc04b11a841e1ccf2c849efeaedcd848e3812979ce9e182
Instruction Fuzzy Hash: 79E01270A0120CFFDB00DFA8E50469DB7B9EB45205F108599DC08D7301DA756E419795

Function 09C45EFB Relevance: .0, Instructions: 16COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2677595803.0000000009C40000.00000040.00000800.00020000.00000000.sdmp, Offset: 09C40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_9c40000_csc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 699c455d0bb70ced7e3aba34f53e48f13010c39c699f2356ce4ba7843e393858
Instruction ID: 677d83b14e3098888b9e3c673bbc80f27fbd273bf3332d1534f622747df28cb8
Opcode Fuzzy Hash: 699c455d0bb70ced7e3aba34f53e48f13010c39c699f2356ce4ba7843e393858
Instruction Fuzzy Hash: 4DD09E75911249EBC710DFB0EA4549DB7B4AF45202B1005FAF805D7650EE329A11D791

Function 09C4849B Relevance: .0, Instructions: 13COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2677595803.0000000009C40000.00000040.00000800.00020000.00000000.sdmp, Offset: 09C40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_9c40000_csc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ad8336a107cdd51617ea5745c8f0981277789db328601321cc1c715d6de07e39
Instruction ID: b0a5d53c13efc66266f66b17cca382e99a95ed14875d3ae10d6aabbcad3c8724
Opcode Fuzzy Hash: ad8336a107cdd51617ea5745c8f0981277789db328601321cc1c715d6de07e39
Instruction Fuzzy Hash: 8ED05E71F012249BEB105B61FA453983F20BB42319F0641B0D84A6624ACE341D428B83

Function 09D94D5F Relevance: .0, Instructions: 13COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2677834040.0000000009D90000.00000040.00000800.00020000.00000000.sdmp, Offset: 09D90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_9d90000_csc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 17f18dff17c5c8bc4a8ddc2eaa308f230df977c27ffd0d219d4ac624d1548f5c
Instruction ID: a0fed8709a4d6f883811bc01c740bfb80a3e6300224dc72a41020360b951edac
Opcode Fuzzy Hash: 17f18dff17c5c8bc4a8ddc2eaa308f230df977c27ffd0d219d4ac624d1548f5c
Instruction Fuzzy Hash: D4D01234565011CFC714DF10E5997587BB3EB45315F15C1A9E4028666ADB746845CF48

Function 09C4206D Relevance: .0, Instructions: 12COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2677595803.0000000009C40000.00000040.00000800.00020000.00000000.sdmp, Offset: 09C40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_9c40000_csc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b8db3ddb4c100bf16d8078ab7053e326a1879b50874fda67defc4cf06ba08f06
Instruction ID: 686863ba985fb6f28cbefaf2e24826dd8deff7915157b12e3389d01fefe0cb6c
Opcode Fuzzy Hash: b8db3ddb4c100bf16d8078ab7053e326a1879b50874fda67defc4cf06ba08f06
Instruction Fuzzy Hash: 7ED06775E24628CFE790CB14D995B5473B1AB48360F1581F5E94E67360C7346E86CF41

Function 09C42B68 Relevance: .0, Instructions: 12COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2677595803.0000000009C40000.00000040.00000800.00020000.00000000.sdmp, Offset: 09C40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_9c40000_csc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7bb20b963c18e7ceea489770fde14181244a98db55312f03804884c201a3f7c9
Instruction ID: 918c298d8769510d1b4a1e28cc411e6cf113f99b72e05c3df604b85c35a319e3
Opcode Fuzzy Hash: 7bb20b963c18e7ceea489770fde14181244a98db55312f03804884c201a3f7c9
Instruction Fuzzy Hash: E3D09238A14664CFE751CB28C864B887BB2BF4A214F1581E6D9899B371C7306D85CF41

Function 09C0097A Relevance: .0, Instructions: 11COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2677452689.0000000009C00000.00000040.00000800.00020000.00000000.sdmp, Offset: 09C00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_9c00000_csc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4e6405822d75c0159a6a34d825af6b59791adfce5dbfece9225c3ed28ca246f6
Instruction ID: c9d5e72e1ac8ff68e1d828268ce01704da7f9aea8580231e13206f9d28470b81
Opcode Fuzzy Hash: 4e6405822d75c0159a6a34d825af6b59791adfce5dbfece9225c3ed28ca246f6
Instruction Fuzzy Hash: 9BD01234E090249BD711EB91F9B577C77B1FBC8350F020021ED069B386DB688803EB82

Function 09C45EA7 Relevance: .0, Instructions: 7COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2677595803.0000000009C40000.00000040.00000800.00020000.00000000.sdmp, Offset: 09C40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_9c40000_csc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 38cb721ed56e7a261d9e8d7756b4aeff9c9b00abc789c27b70582f55d87aa17e
Instruction ID: 1bf4d38333e9f2b5e1f7803685775dc1c80482e82706c12ab4a2c0fe591b99d7
Opcode Fuzzy Hash: 38cb721ed56e7a261d9e8d7756b4aeff9c9b00abc789c27b70582f55d87aa17e
Instruction Fuzzy Hash: 70B01237B0001986CB04E6C9F8404ECFB30DBD4332F004033C30072040873125BAC764

Function 09C4BDA8 Relevance: .0, Instructions: 6COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2677595803.0000000009C40000.00000040.00000800.00020000.00000000.sdmp, Offset: 09C40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_9c40000_csc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6910feab326ecef4588e7f199d1347b339791e8055cf2df35d42ae6e919b5f4b
Instruction ID: 173d7fd9cdc95e9380f68a6a8c52e8cba5569e2a93e6d96c0b7514f9cbf0f4c4
Opcode Fuzzy Hash: 6910feab326ecef4588e7f199d1347b339791e8055cf2df35d42ae6e919b5f4b
Instruction Fuzzy Hash: EDB01230A431007FDF12AE74940F2503F10E746750F12008991514418151B200C0CD54

Function 09C49FB0 Relevance: .0, Instructions: 5COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2677595803.0000000009C40000.00000040.00000800.00020000.00000000.sdmp, Offset: 09C40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_9c40000_csc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ede366812b54d92b4182716666a309ba3117ed8be471c79849df18eea5243032
Instruction ID: 5291727fba1a766de1f5b323858aedbc742bfe08c52ef9677e71b666e75a40b3
Opcode Fuzzy Hash: ede366812b54d92b4182716666a309ba3117ed8be471c79849df18eea5243032
Instruction Fuzzy Hash: 3590023105460C8B46407795780B5657F5CA5445657940451BA2D415015E6578115595

Function 09C49FAF Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2677595803.0000000009C40000.00000040.00000800.00020000.00000000.sdmp, Offset: 09C40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_9c40000_csc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7ce21c6e454609bab5fcb18fcaca431307c1ecf8b880e27767269503db1fbbd1
Instruction ID: 871dbee60b03a010a8c0eb4bb48cb548db445c6fbe7cf1f9e27bbb5bfdfa29f7
Opcode Fuzzy Hash: 7ce21c6e454609bab5fcb18fcaca431307c1ecf8b880e27767269503db1fbbd1
Instruction Fuzzy Hash:

Non-executed Functions

Function 09C4156A Relevance: 1.4, Strings: 1, Instructions: 132COMMON

Download Yara Rule

Strings

v2*, xrefs: 09C412B4

Memory Dump Source

Source File: 00000005.00000002.2677595803.0000000009C40000.00000040.00000800.00020000.00000000.sdmp, Offset: 09C40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_9c40000_csc.jbxd

Similarity

API ID:
String ID: v2*
API String ID: 0-216269080
Opcode ID: b2dd6a045d652011a9704e343e96f376455fcec3dde5ef53ea3dc4b7be05a15d
Instruction ID: dc11189909f34198c91f5ca364081b789faa9d73cab8993b4a23c2385c38b1ca
Opcode Fuzzy Hash: b2dd6a045d652011a9704e343e96f376455fcec3dde5ef53ea3dc4b7be05a15d
Instruction Fuzzy Hash: CE514C34E04608CFC744CF69D556BA9BBF1FB48315F5480AEE41ACB292DB39A949CF08

Function 09C413D5 Relevance: 1.4, Strings: 1, Instructions: 130COMMON

Download Yara Rule

Strings

v2*, xrefs: 09C412B4

Memory Dump Source

Source File: 00000005.00000002.2677595803.0000000009C40000.00000040.00000800.00020000.00000000.sdmp, Offset: 09C40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_9c40000_csc.jbxd

Similarity

API ID:
String ID: v2*
API String ID: 0-216269080
Opcode ID: f22c54c86ba3783812ee62fe4cf57ff142837710c0f8c549c3d48f310d4aa33f
Instruction ID: f2c0e65529e426f70771814a818da6a04e406fddfe10ed6a55ac7244fc406035
Opcode Fuzzy Hash: f22c54c86ba3783812ee62fe4cf57ff142837710c0f8c549c3d48f310d4aa33f
Instruction Fuzzy Hash: 30513C34A04608CFC754CF69E556BA9BBF1EB48311F5480AEE41ACB792DB39A948CF04

Function 09C41464 Relevance: 1.4, Strings: 1, Instructions: 126COMMON

Download Yara Rule

Strings

v2*, xrefs: 09C412B4

Memory Dump Source

Source File: 00000005.00000002.2677595803.0000000009C40000.00000040.00000800.00020000.00000000.sdmp, Offset: 09C40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_9c40000_csc.jbxd

Similarity

API ID:
String ID: v2*
API String ID: 0-216269080
Opcode ID: 21906f8b65d1c0f4fcc3316f67e1f5a72a8a8dffdd7ba8b46b8d365c28e024e4
Instruction ID: 5f4f69be95beced473db0f301b89f2ec5cec42d062635bc9f079ec7ffdba00da
Opcode Fuzzy Hash: 21906f8b65d1c0f4fcc3316f67e1f5a72a8a8dffdd7ba8b46b8d365c28e024e4
Instruction Fuzzy Hash: AC511B74E04608CFC754CF69E556BA9BBF1FB48311F5480AEE41A8B752DB38A949CF04

Function 09C41305 Relevance: 1.4, Strings: 1, Instructions: 124COMMON

Download Yara Rule

Strings

v2*, xrefs: 09C412B4

Memory Dump Source

Source File: 00000005.00000002.2677595803.0000000009C40000.00000040.00000800.00020000.00000000.sdmp, Offset: 09C40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_9c40000_csc.jbxd

Similarity

API ID:
String ID: v2*
API String ID: 0-216269080
Opcode ID: 0404e297af9c6c50c54cf8c91d962ac302b20f1d5b247b5187c82ef09a1a91c4
Instruction ID: 640cebf5d5c885e820fef06bc16779dc34386f003717cc27c5f1f9f125246caf
Opcode Fuzzy Hash: 0404e297af9c6c50c54cf8c91d962ac302b20f1d5b247b5187c82ef09a1a91c4
Instruction Fuzzy Hash: 71510874A04608CFC744CF69D556B69B7F1FB48311F5480AEE41ADB792DB38A948CF08

Function 09C41701 Relevance: 1.4, Strings: 1, Instructions: 118COMMON

Download Yara Rule

Strings

v2*, xrefs: 09C412B4

Memory Dump Source

Source File: 00000005.00000002.2677595803.0000000009C40000.00000040.00000800.00020000.00000000.sdmp, Offset: 09C40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_9c40000_csc.jbxd

Similarity

API ID:
String ID: v2*
API String ID: 0-216269080
Opcode ID: cd2337f09974d8bcba41f6284359357196e17fc662ae41c909f200461b523308
Instruction ID: 6d5b5f9356a6363efa9ba099a20e72a63d426e43542af51d5d1f6691338bbded
Opcode Fuzzy Hash: cd2337f09974d8bcba41f6284359357196e17fc662ae41c909f200461b523308
Instruction Fuzzy Hash: 31510834E04608CFD758CF69E555BA9B7F1FB48314F5480AEE41A9B352DB38A949CF08

Function 09C410E1 Relevance: 1.4, Strings: 1, Instructions: 110COMMON

Download Yara Rule

Strings

v2*, xrefs: 09C412B4

Memory Dump Source

Source File: 00000005.00000002.2677595803.0000000009C40000.00000040.00000800.00020000.00000000.sdmp, Offset: 09C40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_9c40000_csc.jbxd

Similarity

API ID:
String ID: v2*
API String ID: 0-216269080
Opcode ID: f6204549798e15527feab9000c7e4041ad4e24dd42fd9c35fffa9e872465e109
Instruction ID: 2111c866c7a83b37f26277f8802eba20889d8ac36a32f8e8af6bb6dc01a56b80
Opcode Fuzzy Hash: f6204549798e15527feab9000c7e4041ad4e24dd42fd9c35fffa9e872465e109
Instruction Fuzzy Hash: 68412934E04608CFD754CF69D556AA9BBF1FB48311F5480AEE41ADB392DB38A949CF04

Function 09C416BA Relevance: 1.4, Strings: 1, Instructions: 110COMMON

Download Yara Rule

Strings

v2*, xrefs: 09C412B4

Memory Dump Source

Source File: 00000005.00000002.2677595803.0000000009C40000.00000040.00000800.00020000.00000000.sdmp, Offset: 09C40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_9c40000_csc.jbxd

Similarity

API ID:
String ID: v2*
API String ID: 0-216269080
Opcode ID: c33338b154f67e7ac3012f5bd57561fdbf3828a149e367a4acacedc9ce89d933
Instruction ID: 588024c2904453f7f484266696a8dd00b2ad2aececece40a485796fa92ea4eab
Opcode Fuzzy Hash: c33338b154f67e7ac3012f5bd57561fdbf3828a149e367a4acacedc9ce89d933
Instruction Fuzzy Hash: 03510734E04608CFD748CF69E555BA9B7F1FB48310F5480AEE41A9B752DB38A948CF04

Function 09C410F0 Relevance: 1.4, Strings: 1, Instructions: 109COMMON

Download Yara Rule

Strings

v2*, xrefs: 09C412B4

Memory Dump Source

Source File: 00000005.00000002.2677595803.0000000009C40000.00000040.00000800.00020000.00000000.sdmp, Offset: 09C40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_9c40000_csc.jbxd

Similarity

API ID:
String ID: v2*
API String ID: 0-216269080
Opcode ID: 06d0f0bae08d802b8d75e25e39900fbaf5d9734353e585ff83ce1d3680657008
Instruction ID: eca6dbd5e6f81ed485090148d505755ce0748a1afd10d89a1aa9b4c7dce99a2d
Opcode Fuzzy Hash: 06d0f0bae08d802b8d75e25e39900fbaf5d9734353e585ff83ce1d3680657008
Instruction Fuzzy Hash: D3411974E04608CFDB54CF69D555AA9BBF1FB48310F5480AEE81ADB392DB38A949CF04

Function 09C4112B Relevance: 1.4, Strings: 1, Instructions: 105COMMON

Download Yara Rule

Strings

v2*, xrefs: 09C412B4

Memory Dump Source

Source File: 00000005.00000002.2677595803.0000000009C40000.00000040.00000800.00020000.00000000.sdmp, Offset: 09C40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_9c40000_csc.jbxd

Similarity

API ID:
String ID: v2*
API String ID: 0-216269080
Opcode ID: 57a0c7d7bf589ed477b1737e6ba83a1ece6cf3c996f75285c3347476962716d4
Instruction ID: 38e316c83b2df243a68287a63dd2740f2ab540f777f6b5d91650351bf0bfab73
Opcode Fuzzy Hash: 57a0c7d7bf589ed477b1737e6ba83a1ece6cf3c996f75285c3347476962716d4
Instruction Fuzzy Hash: A0410734A04608CFDB48CF69E555AA9BBF1FB48310F5080AEE41A9B352DB38A949CF04

Function 09C414F1 Relevance: 1.4, Strings: 1, Instructions: 103COMMON

Download Yara Rule

Strings

v2*, xrefs: 09C412B4

Memory Dump Source

Source File: 00000005.00000002.2677595803.0000000009C40000.00000040.00000800.00020000.00000000.sdmp, Offset: 09C40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_9c40000_csc.jbxd

Similarity

API ID:
String ID: v2*
API String ID: 0-216269080
Opcode ID: 125f11903ccf6985670d13e5f75040f8dd016f25754e5b868e586ed038fc6b5e
Instruction ID: b7e71e0b43e7f6cfa227f02b0e63d91d0c080a50e12065428ce7d49c098963b7
Opcode Fuzzy Hash: 125f11903ccf6985670d13e5f75040f8dd016f25754e5b868e586ed038fc6b5e
Instruction Fuzzy Hash: 5D411834E04608CFC754CF69D556BA9BBF1FB48314F5480AEE41ACB692DB38A949CF08

Function 09C41254 Relevance: 1.4, Strings: 1, Instructions: 102COMMON

Download Yara Rule

Strings

v2*, xrefs: 09C412B4

Memory Dump Source

Source File: 00000005.00000002.2677595803.0000000009C40000.00000040.00000800.00020000.00000000.sdmp, Offset: 09C40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_9c40000_csc.jbxd

Similarity

API ID:
String ID: v2*
API String ID: 0-216269080
Opcode ID: 967d716046d6f6599d68f46a54676f5ef969801a122ba35f2b55572342c9e23d
Instruction ID: d5fbe104dd1626f28c352e4359200ce64c8bc429cfcacc09b631a17dc7aca4ea
Opcode Fuzzy Hash: 967d716046d6f6599d68f46a54676f5ef969801a122ba35f2b55572342c9e23d
Instruction Fuzzy Hash: 29412934E04608CFD754CF69E556BA9B7F1FB48314F5480AEE41A8B792DB38A948CF08

Function 09C411D0 Relevance: 1.3, Strings: 1, Instructions: 98COMMON

Download Yara Rule

Strings

v2*, xrefs: 09C412B4

Memory Dump Source

Source File: 00000005.00000002.2677595803.0000000009C40000.00000040.00000800.00020000.00000000.sdmp, Offset: 09C40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_9c40000_csc.jbxd

Similarity

API ID:
String ID: v2*
API String ID: 0-216269080
Opcode ID: ea3355688f54e5df915a1ae3b23e6991779583b9c59783c60fdf22faa72a9511
Instruction ID: 2d9a01db2d61a576f46c683cd144f52f5fb0f4a99a076b079f92d3faed70ce29
Opcode Fuzzy Hash: ea3355688f54e5df915a1ae3b23e6991779583b9c59783c60fdf22faa72a9511
Instruction Fuzzy Hash: F9410834E04608CFCB58CF69D556AA9B7F1FB48310F5480AEE41ADB792DB38A948CF04

Function 09DCD8F0 Relevance: .4, Instructions: 406COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2677862177.0000000009DC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 09DC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_9dc0000_csc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 549ef1a7806f1ef4c50dc2c43262877ace6e96b454aed62a5049750305c5f678
Instruction ID: f08472449b6c4e8b70b5280dbc8fff94e3202d33108ea588330edfc42aa2c310
Opcode Fuzzy Hash: 549ef1a7806f1ef4c50dc2c43262877ace6e96b454aed62a5049750305c5f678
Instruction Fuzzy Hash: 8CF125B0B017168FDB18DF69C49966EFBB2BB88300F24852DE556D7780CB34A942CB91

Function 09C4E3B8 Relevance: .3, Instructions: 320COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2677595803.0000000009C40000.00000040.00000800.00020000.00000000.sdmp, Offset: 09C40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_9c40000_csc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8f80f28020679cb743688ccaf4116ec35f12225a0c4b8cbc1b0563212e623e73
Instruction ID: 4b7de579c1dff8afdb4aabce31570c74de5ff7823a8b9042d19cb62346c90cc3
Opcode Fuzzy Hash: 8f80f28020679cb743688ccaf4116ec35f12225a0c4b8cbc1b0563212e623e73
Instruction Fuzzy Hash: 6CD11934F006058FDB14DF69D588AA9B7F2BF88710F66C5A8E805AB361DB34ED41CB50

Function 09D91BB8 Relevance: .3, Instructions: 281COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2677834040.0000000009D90000.00000040.00000800.00020000.00000000.sdmp, Offset: 09D90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_9d90000_csc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0d93e6e69546657d894356dba843567483e15357aba722c661d884b470ff7123
Instruction ID: 4db288f0f481dca235b219628ad469fff30a1c33e827cf72e2bd03be8e7c23db
Opcode Fuzzy Hash: 0d93e6e69546657d894356dba843567483e15357aba722c661d884b470ff7123
Instruction Fuzzy Hash: 1CB17D70E5420E8FDF10DFA9C8857ADBBF2AF88314F148229E815E7694EB749845CB81

Function 09C457CD Relevance: .2, Instructions: 225COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2677595803.0000000009C40000.00000040.00000800.00020000.00000000.sdmp, Offset: 09C40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_9c40000_csc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f01455df6cbc29fcd3c3106664cb311d4a56ff5b02d206434f9eef23defa71c1
Instruction ID: 4ebbed8147bee744c6e7bff7fd92f6a79825a874e773a904f36468f5ac982e42
Opcode Fuzzy Hash: f01455df6cbc29fcd3c3106664cb311d4a56ff5b02d206434f9eef23defa71c1
Instruction Fuzzy Hash: F591A134F00288CFEB14CB16E584BA977F3FB84310F5880B9F4059B696DB799A85CB59

Function 09C4591D Relevance: .2, Instructions: 215COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2677595803.0000000009C40000.00000040.00000800.00020000.00000000.sdmp, Offset: 09C40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_9c40000_csc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6458e7c83a12eb9161db545189df291ed5953527166d4c4f993007c381e19945
Instruction ID: 8220f11737b0b06ea508fa856a80079160450f91db44562e30da4d508872b779
Opcode Fuzzy Hash: 6458e7c83a12eb9161db545189df291ed5953527166d4c4f993007c381e19945
Instruction Fuzzy Hash: 33919E34F00288CFEB10CB56E584BA977F3FB84310F5880B9F4059B296DB799A85CB19

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is an administration feature that provides a uniform environment to access Windows system components. The WMI service enables both local and remote access, though the latter is facilitated by Remote Services such as Distributed Component Object Model (DCOM) and Windows Remote Management (WinRM).Remote WMI over DCOM operates using port 135, whereas WMI over WinRM operates over port 5985 when using HTTP and 5986 for HTTPS.
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Connection Creation, Process: Process Creation, WMI: WMI Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report ReaderPDFadobe.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Memory Dumps

Unpacked PEs

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Networking

System Summary

Data Obfuscation

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Rich Headers

Data Directories

Sections

Resources

Imports

Possible Origin

Network Behavior

Network Port Distribution

TCP Packets

UDP Packets

DNS Queries

DNS Answers

Statistics

CPU Usage

Memory Usage

High Level Behavior Distribution

Windows Analysis Report
ReaderPDFadobe.exe

Function 09DCEEA8 Relevance: 1.6, APIs: 1, Instructions: 148
COMMON

Function 09DCEEB8 Relevance: 1.6, APIs: 1, Instructions: 144
COMMON

Function 09D93D33 Relevance: .3, Instructions: 311
COMMON

Function 09D93D38 Relevance: .3, Instructions: 308
COMMON

Function 0591C1D8 Relevance: 1.6, APIs: 1, Instructions: 56
memoryCOMMON

Function 09D92984 Relevance: 1.3, Strings: 1, Instructions: 51
COMMON

Function 0591C388 Relevance: 1.3, APIs: 1, Instructions: 49
COMMON

Function 09D80810 Relevance: .4, Instructions: 362
COMMON