Edit tour

Windows Analysis Report
hCkkM0lH0P.exe

Overview

General Information

Sample name:	hCkkM0lH0P.exe renamed because original name is a hash value
Original sample name:	aa7e0932069694a1e9e98868f0128d3de3bcee0de7591f12cfc491fa91fc0dd6.exe
Analysis ID:	1587623
MD5:	0fbd42eaa6018baee8d8d62c2523763c
SHA1:	2721894c14665ebf180e94f42b5c352ac62ea7e0
SHA256:	aa7e0932069694a1e9e98868f0128d3de3bcee0de7591f12cfc491fa91fc0dd6
Tags:	AgentTeslaexeuser-adrian__luca
Infos:

Detection

AgentTesla

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Found malware configuration

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for submitted file

Yara detected AgentTesla

Yara detected AntiVM3

AI detected suspicious sample

Adds a directory exclusion to Windows Defender

Check if machine is in data center or colocation facility

Contains functionality to check if a debugger is running (CheckRemoteDebuggerPresent)

Loading BitLocker PowerShell Module

Machine Learning detection for sample

Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)

Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)

Sigma detected: Powershell Base64 Encoded MpPreference Cmdlet

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)

Tries to harvest and steal browser information (history, passwords, etc)

Tries to harvest and steal ftp login credentials

Tries to steal Mail credentials (via file / registry access)

Yara detected Generic Downloader

Allocates memory with a write watch (potentially for evading sandboxes)

Binary contains a suspicious time stamp

Checks if the current process is being debugged

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Detected potential crypto function

Enables debug privileges

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

HTTP GET or POST without a user agent

IP address seen in connection with other malware

May check the online IP address of the machine

May sleep (evasive loops) to hinder dynamic analysis

Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)

Queries sensitive Operating System Information (via WMI, Win32_ComputerSystem, often done to detect virtual machines)

Queries sensitive processor information (via WMI, Win32_Processor, often done to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sample file is different than original file name gathered from version info

Sigma detected: Powershell Defender Exclusion

Uses 32bit PE files

Uses code obfuscation techniques (call, push, ret)

Yara detected Credential Stealer

Yara signature match

Classification

Process Tree

System is w10x64

hCkkM0lH0P.exe (PID: 6468 cmdline: "C:\Users\user\Desktop\hCkkM0lH0P.exe" MD5: 0FBD42EAA6018BAEE8D8D62C2523763C)

powershell.exe (PID: 3464 cmdline: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\hCkkM0lH0P.exe" MD5: C32CA4ACFCC635EC1EA6ED8A34DF5FAC)

conhost.exe (PID: 5440 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

WmiPrvSE.exe (PID: 7360 cmdline: C:\Windows\system32\wbem\wmiprvse.exe -secured -Embedding MD5: 60FF40CFD7FB8FE41EE4FE9AE5FE1C51)

hCkkM0lH0P.exe (PID: 4884 cmdline: "C:\Users\user\Desktop\hCkkM0lH0P.exe" MD5: 0FBD42EAA6018BAEE8D8D62C2523763C)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Agent Tesla, AgentTesla	A .NET based information stealer readily available to actors due to leaked builders. The malware is able to log keystrokes, can access the host's clipboard and crawls the disk for credentials or other valuable information. It has the capability to send information back to its C&C via HTTP(S), SMTP, FTP, or towards a Telegram channel.	SWEED	http://blog.nsfocus.net/sweed-611/ http://l1v1ngc0d3.wordpress.com/2021/11/12/agenttesla-dropped-via-nsis-installer/ http://ropgadget.com/posts/originlogger.html http://www.secureworks.com/research/threat-profiles/gold-galleon https://0xmrmagnezi.github.io/malware%20analysis/AgentTesla/	https://malpedia.caad.fkie.fraunhofer.de/details/win.agent_tesla

Malware Configuration

Threatname: Agenttesla

{"Exfil Mode": "SMTP", "Port": "587", "Host": "mail.apexrnun.com", "Username": "roocckkbtwo@apexrnun.com", "Password": "TsHZsTv}Jnj5E5Bn"}

Yara Signatures

Memory Dumps

Source	Rule	Description	Author
00000004.00000002.2615899257.0000000000402000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000004.00000002.2615899257.0000000000402000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
00000004.00000002.2617872188.0000000002CE1000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000004.00000002.2617872188.0000000002CE1000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
00000000.00000002.1386426356.0000000003D19000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000000.00000002.1386426356.0000000003D19000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
00000004.00000002.2617872188.0000000002D0D000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
Process Memory Space: hCkkM0lH0P.exe PID: 6468	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: hCkkM0lH0P.exe PID: 6468	JoeSecurity_AntiVM_3	Yara detected AntiVM_3	Joe Security
Process Memory Space: hCkkM0lH0P.exe PID: 6468	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
Process Memory Space: hCkkM0lH0P.exe PID: 4884	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: hCkkM0lH0P.exe PID: 4884	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
Click to see the 7 entries

Unpacked PEs

Source	Rule	Description	Author	Strings
0.2.hCkkM0lH0P.exe.3d309f0.3.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0.2.hCkkM0lH0P.exe.3d309f0.3.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
0.2.hCkkM0lH0P.exe.3d309f0.3.unpack	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID	Detects executables referencing Windows vault credential objects. Observed in infostealers	ditekSHen	0x32361:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x323d3:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x3245d:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x324ef:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x32559:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x325cb:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x32661:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x326f1:$s8: 3C886FF3-2669-4AA2-A8FB-3F6759A77548
0.2.hCkkM0lH0P.exe.3d6c010.2.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0.2.hCkkM0lH0P.exe.3d6c010.2.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
0.2.hCkkM0lH0P.exe.3d6c010.2.unpack	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID	Detects executables referencing Windows vault credential objects. Observed in infostealers	ditekSHen	0x32361:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x323d3:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x3245d:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x324ef:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x32559:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x325cb:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x32661:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x326f1:$s8: 3C886FF3-2669-4AA2-A8FB-3F6759A77548
4.2.hCkkM0lH0P.exe.400000.0.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
4.2.hCkkM0lH0P.exe.400000.0.unpack	JoeSecurity_GenericDownloader_1	Yara detected Generic Downloader	Joe Security
4.2.hCkkM0lH0P.exe.400000.0.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
4.2.hCkkM0lH0P.exe.400000.0.unpack	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID	Detects executables referencing Windows vault credential objects. Observed in infostealers	ditekSHen	0x34161:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x341d3:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x3425d:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x342ef:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x34359:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x343cb:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x34461:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x344f1:$s8: 3C886FF3-2669-4AA2-A8FB-3F6759A77548
0.2.hCkkM0lH0P.exe.3d6c010.2.raw.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0.2.hCkkM0lH0P.exe.3d6c010.2.raw.unpack	JoeSecurity_GenericDownloader_1	Yara detected Generic Downloader	Joe Security
0.2.hCkkM0lH0P.exe.3d6c010.2.raw.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
0.2.hCkkM0lH0P.exe.3d6c010.2.raw.unpack	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID	Detects executables referencing Windows vault credential objects. Observed in infostealers	ditekSHen	0x34161:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x6f581:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x341d3:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x6f5f3:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x3425d:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x6f67d:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x342ef:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x6f70f:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x34359:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x6f779:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x343cb:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x6f7eb:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x34461:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x6f881:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x344f1:$s8: 3C886FF3-2669-4AA2-A8FB-3F6759A77548 0x6f911:$s8: 3C886FF3-2669-4AA2-A8FB-3F6759A77548
0.2.hCkkM0lH0P.exe.3d309f0.3.raw.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0.2.hCkkM0lH0P.exe.3d309f0.3.raw.unpack	JoeSecurity_GenericDownloader_1	Yara detected Generic Downloader	Joe Security
0.2.hCkkM0lH0P.exe.3d309f0.3.raw.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
0.2.hCkkM0lH0P.exe.3d309f0.3.raw.unpack	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID	Detects executables referencing Windows vault credential objects. Observed in infostealers	ditekSHen	0x34161:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x6f781:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0xaaba1:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x341d3:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x6f7f3:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0xaac13:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x3425d:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x6f87d:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0xaac9d:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x342ef:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x6f90f:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0xaad2f:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x34359:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x6f979:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0xaad99:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x343cb:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x6f9eb:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0xaae0b:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x34461:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x6fa81:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0xaaea1:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B
Click to see the 13 entries

Sigma Signatures

System Summary

Sigma detected: Powershell Base64 Encoded MpPreference Cmdlet

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\hCkkM0lH0P.exe", CommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\hCkkM0lH0P.exe", CommandLine|base64offset|contains: ~2yzw, Image: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Users\user\Desktop\hCkkM0lH0P.exe", ParentImage: C:\Users\user\Desktop\hCkkM0lH0P.exe, ParentProcessId: 6468, ParentProcessName: hCkkM0lH0P.exe, ProcessCommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\hCkkM0lH0P.exe", ProcessId: 3464, ProcessName: powershell.exe

Sigma detected: Powershell Defender Exclusion

Source: Process started

Sigma detected: Non Interactive PowerShell Process Spawned

Source: Process started

Author: Roberto Rodriguez @Cyb3rWard0g (rule), oscd.community (improvements): Data: Command: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\hCkkM0lH0P.exe", CommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\hCkkM0lH0P.exe", CommandLine|base64offset|contains: ~2yzw, Image: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Users\user\Desktop\hCkkM0lH0P.exe", ParentImage: C:\Users\user\Desktop\hCkkM0lH0P.exe, ParentProcessId: 6468, ParentProcessName: hCkkM0lH0P.exe, ProcessCommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\hCkkM0lH0P.exe", ProcessId: 3464, ProcessName: powershell.exe

Suricata Signatures

⊘No Suricata rule has matched

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: hCkkM0lH0P.exe

Avira: detected

Found malware configuration

Source: 0.2.hCkkM0lH0P.exe.3d309f0.3.raw.unpack

Malware Configuration Extractor: Agenttesla {"Exfil Mode": "SMTP", "Port": "587", "Host": "mail.apexrnun.com", "Username": "roocckkbtwo@apexrnun.com", "Password": "TsHZsTv}Jnj5E5Bn"}

Multi AV Scanner detection for submitted file

Source: hCkkM0lH0P.exe	Virustotal: Detection: 70%			Perma Link
Source: hCkkM0lH0P.exe	ReversingLabs: Detection: 91%

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 99.9% probability

Machine Learning detection for sample

Source: hCkkM0lH0P.exe

Joe Sandbox ML: detected

Source: hCkkM0lH0P.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: hCkkM0lH0P.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source:	Binary string: flAB.pdbSHA256 source: hCkkM0lH0P.exe
Source:	Binary string: flAB.pdb source: hCkkM0lH0P.exe

Networking

Yara detected Generic Downloader

Source: Yara match	File source: 4.2.hCkkM0lH0P.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.hCkkM0lH0P.exe.3d6c010.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.hCkkM0lH0P.exe.3d309f0.3.raw.unpack, type: UNPACKEDPE

Source: global traffic

HTTP traffic detected: GET /line/?fields=hosting HTTP/1.1Host: ip-api.comConnection: Keep-Alive

Source: Joe Sandbox View

IP Address: 208.95.112.1 208.95.112.1

Source: unknown

DNS query: name: ip-api.com

Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic

HTTP traffic detected: GET /line/?fields=hosting HTTP/1.1Host: ip-api.comConnection: Keep-Alive

Source: global traffic	DNS traffic detected: DNS query: ip-api.com
Source: global traffic	DNS traffic detected: DNS query: mail.apexrnun.com

Source: hCkkM0lH0P.exe, 00000004.00000002.2617872188.0000000002CB1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://ip-api.com
Source: hCkkM0lH0P.exe, 00000000.00000002.1386426356.0000000003D19000.00000004.00000800.00020000.00000000.sdmp, hCkkM0lH0P.exe, 00000004.00000002.2615899257.0000000000402000.00000040.00000400.00020000.00000000.sdmp, hCkkM0lH0P.exe, 00000004.00000002.2617872188.0000000002CB1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://ip-api.com/line/?fields=hosting
Source: hCkkM0lH0P.exe, 00000000.00000002.1378033692.0000000002D44000.00000004.00000800.00020000.00000000.sdmp, hCkkM0lH0P.exe, 00000004.00000002.2617872188.0000000002CB1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: hCkkM0lH0P.exe	String found in binary or memory: http://tempuri.org/DataSet1.xsdQdelete
Source: hCkkM0lH0P.exe, 00000000.00000002.1386426356.0000000003D19000.00000004.00000800.00020000.00000000.sdmp, hCkkM0lH0P.exe, 00000004.00000002.2615899257.0000000000402000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://account.dyn.com/

System Summary

Malicious sample detected (through community Yara rule)

Source: 0.2.hCkkM0lH0P.exe.3d309f0.3.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
Source: 0.2.hCkkM0lH0P.exe.3d6c010.2.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
Source: 4.2.hCkkM0lH0P.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
Source: 0.2.hCkkM0lH0P.exe.3d6c010.2.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
Source: 0.2.hCkkM0lH0P.exe.3d309f0.3.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen

Source: C:\Users\user\Desktop\hCkkM0lH0P.exe	Code function: 0_2_02B0D5BC	0_2_02B0D5BC
Source: C:\Users\user\Desktop\hCkkM0lH0P.exe	Code function: 0_2_08DEF8F0	0_2_08DEF8F0
Source: C:\Users\user\Desktop\hCkkM0lH0P.exe	Code function: 0_2_08DEF4B8	0_2_08DEF4B8
Source: C:\Users\user\Desktop\hCkkM0lH0P.exe	Code function: 4_2_01194AC0	4_2_01194AC0
Source: C:\Users\user\Desktop\hCkkM0lH0P.exe	Code function: 4_2_0119EDA0	4_2_0119EDA0
Source: C:\Users\user\Desktop\hCkkM0lH0P.exe	Code function: 4_2_0119ADD3	4_2_0119ADD3
Source: C:\Users\user\Desktop\hCkkM0lH0P.exe	Code function: 4_2_01193EA8	4_2_01193EA8
Source: C:\Users\user\Desktop\hCkkM0lH0P.exe	Code function: 4_2_011941F0	4_2_011941F0
Source: C:\Users\user\Desktop\hCkkM0lH0P.exe	Code function: 4_2_0688C220	4_2_0688C220
Source: C:\Users\user\Desktop\hCkkM0lH0P.exe	Code function: 4_2_0688A9D4	4_2_0688A9D4
Source: C:\Users\user\Desktop\hCkkM0lH0P.exe	Code function: 4_2_068A65F8	4_2_068A65F8
Source: C:\Users\user\Desktop\hCkkM0lH0P.exe	Code function: 4_2_068AB2A7	4_2_068AB2A7
Source: C:\Users\user\Desktop\hCkkM0lH0P.exe	Code function: 4_2_068A3088	4_2_068A3088
Source: C:\Users\user\Desktop\hCkkM0lH0P.exe	Code function: 4_2_068AC188	4_2_068AC188
Source: C:\Users\user\Desktop\hCkkM0lH0P.exe	Code function: 4_2_068A51C0	4_2_068A51C0
Source: C:\Users\user\Desktop\hCkkM0lH0P.exe	Code function: 4_2_068A7D88	4_2_068A7D88
Source: C:\Users\user\Desktop\hCkkM0lH0P.exe	Code function: 4_2_068A76A8	4_2_068A76A8
Source: C:\Users\user\Desktop\hCkkM0lH0P.exe	Code function: 4_2_068AE3A8	4_2_068AE3A8
Source: C:\Users\user\Desktop\hCkkM0lH0P.exe	Code function: 4_2_068A0040	4_2_068A0040
Source: C:\Users\user\Desktop\hCkkM0lH0P.exe	Code function: 4_2_068A58E3	4_2_068A58E3
Source: C:\Users\user\Desktop\hCkkM0lH0P.exe	Code function: 4_2_068A0033	4_2_068A0033

Source: hCkkM0lH0P.exe, 00000000.00000002.1386426356.0000000003D19000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilename2551fb91-c18e-4cfc-9a10-be38a5933551.exe4 vs hCkkM0lH0P.exe
Source: hCkkM0lH0P.exe, 00000000.00000002.1386426356.0000000003D19000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameTyrone.dll8 vs hCkkM0lH0P.exe
Source: hCkkM0lH0P.exe, 00000000.00000000.1364346545.0000000000962000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenameflAB.exe8 vs hCkkM0lH0P.exe
Source: hCkkM0lH0P.exe, 00000000.00000002.1375574401.0000000000E4E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameclr.dllT vs hCkkM0lH0P.exe
Source: hCkkM0lH0P.exe, 00000000.00000002.1400319595.00000000076E0000.00000004.08000000.00040000.00000000.sdmp	Binary or memory string: OriginalFilenameTyrone.dll8 vs hCkkM0lH0P.exe
Source: hCkkM0lH0P.exe, 00000000.00000002.1378033692.0000000002D44000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilename2551fb91-c18e-4cfc-9a10-be38a5933551.exe4 vs hCkkM0lH0P.exe
Source: hCkkM0lH0P.exe, 00000004.00000002.2616098147.0000000000B99000.00000004.00000010.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameUNKNOWN_FILET vs hCkkM0lH0P.exe
Source: hCkkM0lH0P.exe, 00000004.00000002.2615899257.000000000043E000.00000040.00000400.00020000.00000000.sdmp	Binary or memory string: OriginalFilename2551fb91-c18e-4cfc-9a10-be38a5933551.exe4 vs hCkkM0lH0P.exe
Source: hCkkM0lH0P.exe	Binary or memory string: OriginalFilenameflAB.exe8 vs hCkkM0lH0P.exe

Source: hCkkM0lH0P.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: 0.2.hCkkM0lH0P.exe.3d309f0.3.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
Source: 0.2.hCkkM0lH0P.exe.3d6c010.2.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
Source: 4.2.hCkkM0lH0P.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
Source: 0.2.hCkkM0lH0P.exe.3d6c010.2.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
Source: 0.2.hCkkM0lH0P.exe.3d309f0.3.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers

Source: hCkkM0lH0P.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@7/6@2/1

Source: C:\Users\user\Desktop\hCkkM0lH0P.exe

File created: C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\hCkkM0lH0P.exe.log

Jump to behavior

Source: C:\Users\user\Desktop\hCkkM0lH0P.exe	Mutant created: NULL
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5440:120:WilError_03

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

File created: C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_oytjxpjm.vws.ps1

Jump to behavior

Source: hCkkM0lH0P.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: hCkkM0lH0P.exe

Static file information: TRID: Win32 Executable (generic) Net Framework (10011505/4) 49.83%

Source: C:\Users\user\Desktop\hCkkM0lH0P.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\user\Desktop\hCkkM0lH0P.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor

Source: C:\Users\user\Desktop\hCkkM0lH0P.exe

File read: C:\Users\user\Desktop\desktop.ini

Jump to behavior

Source: C:\Users\user\Desktop\hCkkM0lH0P.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: hCkkM0lH0P.exe	Virustotal: Detection: 70%
Source: hCkkM0lH0P.exe	ReversingLabs: Detection: 91%

Source: hCkkM0lH0P.exe	String found in binary or memory: -Add Fertilizer Details
Source: hCkkM0lH0P.exe	String found in binary or memory: /Add Transaction Details!Transaction Name!Transaction Type/Transaction Description

Source: unknown	Process created: C:\Users\user\Desktop\hCkkM0lH0P.exe "C:\Users\user\Desktop\hCkkM0lH0P.exe"
Source: C:\Users\user\Desktop\hCkkM0lH0P.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\hCkkM0lH0P.exe"
Source: C:\Users\user\Desktop\hCkkM0lH0P.exe	Process created: C:\Users\user\Desktop\hCkkM0lH0P.exe "C:\Users\user\Desktop\hCkkM0lH0P.exe"
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\wbem\WmiPrvSE.exe C:\Windows\system32\wbem\wmiprvse.exe -secured -Embedding
Source: C:\Users\user\Desktop\hCkkM0lH0P.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\hCkkM0lH0P.exe"	Jump to behavior
Source: C:\Users\user\Desktop\hCkkM0lH0P.exe	Process created: C:\Users\user\Desktop\hCkkM0lH0P.exe "C:\Users\user\Desktop\hCkkM0lH0P.exe"	Jump to behavior

Source: C:\Users\user\Desktop\hCkkM0lH0P.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\Desktop\hCkkM0lH0P.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\hCkkM0lH0P.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\hCkkM0lH0P.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\hCkkM0lH0P.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\hCkkM0lH0P.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\hCkkM0lH0P.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\hCkkM0lH0P.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\hCkkM0lH0P.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\hCkkM0lH0P.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\hCkkM0lH0P.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\hCkkM0lH0P.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\hCkkM0lH0P.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\hCkkM0lH0P.exe	Section loaded: dwrite.dll	Jump to behavior
Source: C:\Users\user\Desktop\hCkkM0lH0P.exe	Section loaded: windowscodecs.dll	Jump to behavior
Source: C:\Users\user\Desktop\hCkkM0lH0P.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\hCkkM0lH0P.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\hCkkM0lH0P.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\hCkkM0lH0P.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\hCkkM0lH0P.exe	Section loaded: textshaping.dll	Jump to behavior
Source: C:\Users\user\Desktop\hCkkM0lH0P.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\Desktop\hCkkM0lH0P.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\Desktop\hCkkM0lH0P.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Desktop\hCkkM0lH0P.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\hCkkM0lH0P.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\hCkkM0lH0P.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\hCkkM0lH0P.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\Desktop\hCkkM0lH0P.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\hCkkM0lH0P.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\hCkkM0lH0P.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Users\user\Desktop\hCkkM0lH0P.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Users\user\Desktop\hCkkM0lH0P.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Users\user\Desktop\hCkkM0lH0P.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\user\Desktop\hCkkM0lH0P.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Desktop\hCkkM0lH0P.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: microsoft.management.infrastructure.native.unmanaged.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: miutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wmidcom.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Users\user\Desktop\hCkkM0lH0P.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\Desktop\hCkkM0lH0P.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\hCkkM0lH0P.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\hCkkM0lH0P.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\hCkkM0lH0P.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\hCkkM0lH0P.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\hCkkM0lH0P.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\hCkkM0lH0P.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\hCkkM0lH0P.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\hCkkM0lH0P.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\hCkkM0lH0P.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\hCkkM0lH0P.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\hCkkM0lH0P.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\hCkkM0lH0P.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Users\user\Desktop\hCkkM0lH0P.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\hCkkM0lH0P.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\hCkkM0lH0P.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\hCkkM0lH0P.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Users\user\Desktop\hCkkM0lH0P.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Users\user\Desktop\hCkkM0lH0P.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\hCkkM0lH0P.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\hCkkM0lH0P.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\Desktop\hCkkM0lH0P.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\hCkkM0lH0P.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\hCkkM0lH0P.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Users\user\Desktop\hCkkM0lH0P.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Users\user\Desktop\hCkkM0lH0P.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\hCkkM0lH0P.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\hCkkM0lH0P.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\Desktop\hCkkM0lH0P.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\Desktop\hCkkM0lH0P.exe	Section loaded: vaultcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\hCkkM0lH0P.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: fastprox.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: ncobjapi.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: mpclient.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: wmitomi.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: mi.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: miutils.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: gpapi.dll	Jump to behavior

Source: C:\Users\user\Desktop\hCkkM0lH0P.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0EE7644B-1BAD-48B1-9889-0281C206EB85}\InprocServer32

Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Users\user\Desktop\hCkkM0lH0P.exe

File opened: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll

Jump to behavior

Source: C:\Users\user\Desktop\hCkkM0lH0P.exe

Key opened: HKEY_CURRENT_USER\Software\Microsoft\Office\11.0\Outlook\Profiles

Jump to behavior

Source: hCkkM0lH0P.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR

Source: hCkkM0lH0P.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source: hCkkM0lH0P.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG

Source:	Binary string: flAB.pdbSHA256 source: hCkkM0lH0P.exe
Source:	Binary string: flAB.pdb source: hCkkM0lH0P.exe

Source: hCkkM0lH0P.exe

Static PE information: 0xBFF75D56 [Fri Jan 22 03:39:02 2072 UTC]

Source: C:\Users\user\Desktop\hCkkM0lH0P.exe

Code function: 0_2_08DE87E2 pushad ; iretd

0_2_08DE8800

Source: hCkkM0lH0P.exe

Static PE information: section name: .text entropy: 7.544879966198614

Hooking and other Techniques for Hiding and Protection

Loading BitLocker PowerShell Module

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior

Source: C:\Users\user\Desktop\hCkkM0lH0P.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\hCkkM0lH0P.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\hCkkM0lH0P.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\hCkkM0lH0P.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\hCkkM0lH0P.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\hCkkM0lH0P.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\hCkkM0lH0P.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\hCkkM0lH0P.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\hCkkM0lH0P.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\hCkkM0lH0P.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\hCkkM0lH0P.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\hCkkM0lH0P.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\hCkkM0lH0P.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\hCkkM0lH0P.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\hCkkM0lH0P.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\hCkkM0lH0P.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\hCkkM0lH0P.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\hCkkM0lH0P.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\hCkkM0lH0P.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\hCkkM0lH0P.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\hCkkM0lH0P.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\hCkkM0lH0P.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\hCkkM0lH0P.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\hCkkM0lH0P.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\hCkkM0lH0P.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\hCkkM0lH0P.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\hCkkM0lH0P.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\hCkkM0lH0P.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\hCkkM0lH0P.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\hCkkM0lH0P.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\hCkkM0lH0P.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\hCkkM0lH0P.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\hCkkM0lH0P.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\hCkkM0lH0P.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\hCkkM0lH0P.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\hCkkM0lH0P.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\hCkkM0lH0P.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\hCkkM0lH0P.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\hCkkM0lH0P.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\hCkkM0lH0P.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\hCkkM0lH0P.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\hCkkM0lH0P.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\hCkkM0lH0P.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\hCkkM0lH0P.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\hCkkM0lH0P.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\hCkkM0lH0P.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\hCkkM0lH0P.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\hCkkM0lH0P.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\hCkkM0lH0P.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\hCkkM0lH0P.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\hCkkM0lH0P.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\hCkkM0lH0P.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\hCkkM0lH0P.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\hCkkM0lH0P.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\hCkkM0lH0P.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\hCkkM0lH0P.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\hCkkM0lH0P.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\hCkkM0lH0P.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\hCkkM0lH0P.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\hCkkM0lH0P.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\hCkkM0lH0P.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\hCkkM0lH0P.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\hCkkM0lH0P.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\hCkkM0lH0P.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\hCkkM0lH0P.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\hCkkM0lH0P.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\hCkkM0lH0P.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\hCkkM0lH0P.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\hCkkM0lH0P.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\hCkkM0lH0P.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\hCkkM0lH0P.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\hCkkM0lH0P.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\hCkkM0lH0P.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\hCkkM0lH0P.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\hCkkM0lH0P.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\hCkkM0lH0P.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\hCkkM0lH0P.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\hCkkM0lH0P.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\hCkkM0lH0P.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\hCkkM0lH0P.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\hCkkM0lH0P.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\hCkkM0lH0P.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\hCkkM0lH0P.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\hCkkM0lH0P.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\hCkkM0lH0P.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\hCkkM0lH0P.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\hCkkM0lH0P.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\hCkkM0lH0P.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\hCkkM0lH0P.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\hCkkM0lH0P.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\hCkkM0lH0P.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\hCkkM0lH0P.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\hCkkM0lH0P.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\hCkkM0lH0P.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\hCkkM0lH0P.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\hCkkM0lH0P.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\hCkkM0lH0P.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\hCkkM0lH0P.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Yara detected AntiVM3

Source: Yara match

File source: Process Memory Space: hCkkM0lH0P.exe PID: 6468, type: MEMORYSTR

Check if machine is in data center or colocation facility

Source: global traffic

HTTP traffic detected: GET /line/?fields=hosting HTTP/1.1Host: ip-api.comConnection: Keep-Alive

Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)

Source: C:\Users\user\Desktop\hCkkM0lH0P.exe

WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_NetworkAdapterConfiguration

Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)

Source: C:\Users\user\Desktop\hCkkM0lH0P.exe

WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_VideoController

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Source: hCkkM0lH0P.exe, 00000000.00000002.1386426356.0000000003D19000.00000004.00000800.00020000.00000000.sdmp, hCkkM0lH0P.exe, 00000004.00000002.2615899257.0000000000402000.00000040.00000400.00020000.00000000.sdmp, hCkkM0lH0P.exe, 00000004.00000002.2617872188.0000000002CE1000.00000004.00000800.00020000.00000000.sdmp

Binary or memory string: SBIEDLL.DLL

Source: C:\Users\user\Desktop\hCkkM0lH0P.exe	Memory allocated: 2B00000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\hCkkM0lH0P.exe	Memory allocated: 2D10000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\hCkkM0lH0P.exe	Memory allocated: 2B60000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\hCkkM0lH0P.exe	Memory allocated: 8DF0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\hCkkM0lH0P.exe	Memory allocated: 9DF0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\hCkkM0lH0P.exe	Memory allocated: 9FF0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\hCkkM0lH0P.exe	Memory allocated: AFF0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\hCkkM0lH0P.exe	Memory allocated: 1150000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\hCkkM0lH0P.exe	Memory allocated: 2CB0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\hCkkM0lH0P.exe	Memory allocated: 12B0000 memory reserve \| memory write watch	Jump to behavior

Source: C:\Users\user\Desktop\hCkkM0lH0P.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\Desktop\hCkkM0lH0P.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\Desktop\hCkkM0lH0P.exe	Thread delayed: delay time: 922337203685477	Jump to behavior

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 6865			Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 2626			Jump to behavior

Source: C:\Users\user\Desktop\hCkkM0lH0P.exe TID: 5968	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 7316	Thread sleep time: -6456360425798339s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 7276	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\hCkkM0lH0P.exe TID: 7344	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\hCkkM0lH0P.exe TID: 7344	Thread sleep time: -100000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\hCkkM0lH0P.exe TID: 7352	Thread sleep count: 198 > 30	Jump to behavior
Source: C:\Users\user\Desktop\hCkkM0lH0P.exe TID: 7344	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior

Source: C:\Users\user\Desktop\hCkkM0lH0P.exe

WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BaseBoard

Source: C:\Users\user\Desktop\hCkkM0lH0P.exe

WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_ComputerSystem

Source: C:\Users\user\Desktop\hCkkM0lH0P.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\user\Desktop\hCkkM0lH0P.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

Last function: Thread delayed

Source: C:\Users\user\Desktop\hCkkM0lH0P.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\Desktop\hCkkM0lH0P.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\Desktop\hCkkM0lH0P.exe	Thread delayed: delay time: 100000	Jump to behavior
Source: C:\Users\user\Desktop\hCkkM0lH0P.exe	Thread delayed: delay time: 922337203685477	Jump to behavior

Source: hCkkM0lH0P.exe, 00000004.00000002.2617872188.0000000002CE1000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: VMware
Source: hCkkM0lH0P.exe, 00000004.00000002.2617872188.0000000002CE1000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: vmware
Source: hCkkM0lH0P.exe, 00000000.00000002.1375574401.0000000000E82000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\s
Source: hCkkM0lH0P.exe, 00000004.00000002.2615899257.0000000000402000.00000040.00000400.00020000.00000000.sdmp	Binary or memory string: VMwareVBoxESelect * from Win32_ComputerSystem
Source: hCkkM0lH0P.exe, 00000004.00000002.2616710759.000000000128D000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

Process information queried: ProcessInformation

Jump to behavior

Anti Debugging

Contains functionality to check if a debugger is running (CheckRemoteDebuggerPresent)

Source: C:\Users\user\Desktop\hCkkM0lH0P.exe

Code function: 4_2_011970B0 CheckRemoteDebuggerPresent,

4_2_011970B0

Source: C:\Users\user\Desktop\hCkkM0lH0P.exe

Process queried: DebugPort

Jump to behavior

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug			Jump to behavior
Source: C:\Users\user\Desktop\hCkkM0lH0P.exe	Process token adjusted: Debug			Jump to behavior

Source: C:\Users\user\Desktop\hCkkM0lH0P.exe

Memory allocated: page read and write | page guard

Jump to behavior

HIPS / PFW / Operating System Protection Evasion

Adds a directory exclusion to Windows Defender

Source: C:\Users\user\Desktop\hCkkM0lH0P.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\hCkkM0lH0P.exe"
Source: C:\Users\user\Desktop\hCkkM0lH0P.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\hCkkM0lH0P.exe"			Jump to behavior

Source: C:\Users\user\Desktop\hCkkM0lH0P.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\hCkkM0lH0P.exe"			Jump to behavior
Source: C:\Users\user\Desktop\hCkkM0lH0P.exe	Process created: C:\Users\user\Desktop\hCkkM0lH0P.exe "C:\Users\user\Desktop\hCkkM0lH0P.exe"			Jump to behavior

Source: C:\Users\user\Desktop\hCkkM0lH0P.exe	Queries volume information: C:\Users\user\Desktop\hCkkM0lH0P.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\hCkkM0lH0P.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\hCkkM0lH0P.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\hCkkM0lH0P.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\hCkkM0lH0P.exe	Queries volume information: C:\Windows\Fonts\micross.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\hCkkM0lH0P.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-GroupPolicy-ClientTools-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-AppV-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.Management.Infrastructure.Native\v4.0_1.0.0.0__31bf3856ad364e35\Microsoft.Management.Infrastructure.Native.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\AppvClient\Microsoft.AppV.AppVClientPowerShell.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1865.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~en-GB~10.0.19041.1.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\Microsoft.BitLocker.Structures.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Management\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.Commands.Management.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\hCkkM0lH0P.exe	Queries volume information: C:\Users\user\Desktop\hCkkM0lH0P.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\hCkkM0lH0P.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\hCkkM0lH0P.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Security\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Security.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\hCkkM0lH0P.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\hCkkM0lH0P.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\hCkkM0lH0P.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation	Jump to behavior

Source: C:\Users\user\Desktop\hCkkM0lH0P.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Stealing of Sensitive Information

Yara detected AgentTesla

Source: Yara match	File source: 0.2.hCkkM0lH0P.exe.3d309f0.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.hCkkM0lH0P.exe.3d6c010.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.hCkkM0lH0P.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.hCkkM0lH0P.exe.3d6c010.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.hCkkM0lH0P.exe.3d309f0.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000004.00000002.2615899257.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.2617872188.0000000002CE1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1386426356.0000000003D19000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.2617872188.0000000002D0D000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: hCkkM0lH0P.exe PID: 6468, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: hCkkM0lH0P.exe PID: 4884, type: MEMORYSTR

Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)

Source: C:\Users\user\Desktop\hCkkM0lH0P.exe

Key opened: HKEY_CURRENT_USER\SOFTWARE\Martin Prikryl\WinSCP 2\Sessions

Jump to behavior

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Users\user\Desktop\hCkkM0lH0P.exe	File opened: C:\Users\user\AppData\Roaming\NETGATE Technologies\BlackHawk\profiles.ini	Jump to behavior
Source: C:\Users\user\Desktop\hCkkM0lH0P.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\profiles.ini	Jump to behavior
Source: C:\Users\user\Desktop\hCkkM0lH0P.exe	File opened: C:\Users\user\AppData\Roaming\8pecxstudios\Cyberfox\profiles.ini	Jump to behavior
Source: C:\Users\user\Desktop\hCkkM0lH0P.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\Desktop\hCkkM0lH0P.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data	Jump to behavior

Tries to harvest and steal ftp login credentials

Source: C:\Users\user\Desktop\hCkkM0lH0P.exe

File opened: C:\FTP Navigator\Ftplist.txt

Jump to behavior

Tries to steal Mail credentials (via file / registry access)

Source: C:\Users\user\Desktop\hCkkM0lH0P.exe	File opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.ini	Jump to behavior
Source: C:\Users\user\Desktop\hCkkM0lH0P.exe	File opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.ini	Jump to behavior
Source: C:\Users\user\Desktop\hCkkM0lH0P.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles	Jump to behavior
Source: C:\Users\user\Desktop\hCkkM0lH0P.exe	Key opened: HKEY_CURRENT_USER\Software\IncrediMail\Identities	Jump to behavior

Source: Yara match	File source: 0.2.hCkkM0lH0P.exe.3d309f0.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.hCkkM0lH0P.exe.3d6c010.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.hCkkM0lH0P.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.hCkkM0lH0P.exe.3d6c010.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.hCkkM0lH0P.exe.3d309f0.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000004.00000002.2615899257.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.2617872188.0000000002CE1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1386426356.0000000003D19000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: hCkkM0lH0P.exe PID: 6468, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: hCkkM0lH0P.exe PID: 4884, type: MEMORYSTR

Remote Access Functionality

Yara detected AgentTesla

Source: Yara match	File source: 0.2.hCkkM0lH0P.exe.3d309f0.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.hCkkM0lH0P.exe.3d6c010.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.hCkkM0lH0P.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.hCkkM0lH0P.exe.3d6c010.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.hCkkM0lH0P.exe.3d309f0.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000004.00000002.2615899257.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.2617872188.0000000002CE1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1386426356.0000000003D19000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.2617872188.0000000002D0D000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: hCkkM0lH0P.exe PID: 6468, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: hCkkM0lH0P.exe PID: 4884, type: MEMORYSTR

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	231 Windows Management Instrumentation	1 DLL Side-Loading	11 Process Injection	1 Masquerading	2 OS Credential Dumping	531 Security Software Discovery	Remote Services	1 Email Collection	1 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	2 Command and Scripting Interpreter	Boot or Logon Initialization Scripts	1 DLL Side-Loading	11 Disable or Modify Tools	1 Credentials in Registry	1 Process Discovery	Remote Desktop Protocol	1 Archive Collected Data	1 Ingress Tool Transfer	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	261 Virtualization/Sandbox Evasion	Security Account Manager	261 Virtualization/Sandbox Evasion	SMB/Windows Admin Shares	2 Data from Local System	2 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	11 Process Injection	NTDS	1 Application Window Discovery	Distributed Component Object Model	Input Capture	2 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	2 Obfuscated Files or Information	LSA Secrets	1 System Network Configuration Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	2 Software Packing	Cached Domain Credentials	1 File and Directory Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	1 Timestomp	DCSync	34 System Information Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	1 DLL Side-Loading	Proc Filesystem	System Owner/User Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
hCkkM0lH0P.exe	71%	Virustotal		Browse
hCkkM0lH0P.exe	92%	ReversingLabs	ByteCode-MSIL.Backdoor.FormBook
hCkkM0lH0P.exe	100%	Avira	TR/AD.GenSteal.gvzir
hCkkM0lH0P.exe	100%	Joe Sandbox ML

Name	IP	Active	Malicious	Reputation
s-part-0017.t-0009.t-msedge.net	13.107.246.45	true	false	high
ip-api.com	208.95.112.1	true	false	high
mail.apexrnun.com	unknown	unknown	false	high

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
http://ip-api.com/line/?fields=hosting	false		high

URLs from Memory and Binaries

Name	Source	Malicious	Reputation
https://account.dyn.com/	hCkkM0lH0P.exe, 00000000.00000002.1386426356.0000000003D19000.00000004.00000800.00020000.00000000.sdmp, hCkkM0lH0P.exe, 00000004.00000002.2615899257.0000000000402000.00000040.00000400.00020000.00000000.sdmp	false	high
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	hCkkM0lH0P.exe, 00000000.00000002.1378033692.0000000002D44000.00000004.00000800.00020000.00000000.sdmp, hCkkM0lH0P.exe, 00000004.00000002.2617872188.0000000002CB1000.00000004.00000800.00020000.00000000.sdmp	false	high
http://tempuri.org/DataSet1.xsdQdelete	hCkkM0lH0P.exe	false	high
http://ip-api.com	hCkkM0lH0P.exe, 00000004.00000002.2617872188.0000000002CB1000.00000004.00000800.00020000.00000000.sdmp	false	high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
208.95.112.1	ip-api.com	United States		53334	TUT-ASUS	false

General Information

Joe Sandbox version:	42.0.0 Malachite
Analysis ID:	1587623
Start date and time:	2025-01-10 15:53:47 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 5m 42s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	11
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	hCkkM0lH0P.exe renamed because original name is a hash value
Original Sample Name:	aa7e0932069694a1e9e98868f0128d3de3bcee0de7591f12cfc491fa91fc0dd6.exe
Detection:	MAL
Classification:	mal100.troj.spyw.evad.winEXE@7/6@2/1
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 96% Number of executed functions: 146 Number of non-executed functions: 10
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, dllhost.exe, WMIADAP.exe, SIHClient.exe, conhost.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 13.107.246.45, 184.28.90.27, 172.202.163.200
Excluded domains from analysis (whitelisted): fs.microsoft.com, slscr.update.microsoft.com, otelrules.azureedge.net, otelrules.afd.azureedge.net, ctldl.windowsupdate.com, azureedge-t-prod.trafficmanager.net, fe3cr.delivery.mp.microsoft.com
Not all processes where analyzed, report is missing behavior information
Report size getting too big, too many NtCreateKey calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.

Simulations

Behavior and APIs

Time	Type	Description
09:54:49	API Interceptor	2x Sleep call for process: hCkkM0lH0P.exe modified
09:54:52	API Interceptor	15x Sleep call for process: powershell.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
208.95.112.1	sDflTDPSLw.exe	Get hash	malicious	AgentTesla	Browse	ip-api.com/line/?fields=hosting
	2HCwqwLg1G.exe	Get hash	malicious	AgentTesla	Browse	ip-api.com/line/?fields=hosting
	CdbVaYf8jC.exe	Get hash	malicious	AgentTesla	Browse	ip-api.com/line/?fields=hosting
	H9YFiQB7o3.exe	Get hash	malicious	AgentTesla	Browse	ip-api.com/line/?fields=hosting
	lFlw40OH6u.exe	Get hash	malicious	AgentTesla	Browse	ip-api.com/line/?fields=hosting
	Pago devuelto #.Documentos#9787565789678675645767856843.exe	Get hash	malicious	AgentTesla	Browse	ip-api.com/line/?fields=hosting
	driver.exe	Get hash	malicious	Blank Grabber	Browse	ip-api.com/json/?fields=225545
	XClient.exe	Get hash	malicious	XWorm	Browse	ip-api.com/line/?fields=hosting
	Comprobante.de.pago.pdf.exe	Get hash	malicious	AgentTesla	Browse	ip-api.com/line/?fields=hosting
	p.exe	Get hash	malicious	Unknown	Browse	ip-api.com/csv/?fields=query

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
s-part-0017.t-0009.t-msedge.net	RSLMZxqebl.exe	Get hash	malicious	FormBook	Browse	13.107.246.45
	nRNzqQOQwk.exe	Get hash	malicious	GuLoader	Browse	13.107.246.45
	PO-0005082025 pdf.exe	Get hash	malicious	FormBook, PureLog Stealer	Browse	13.107.246.45
	PO-0005082025 pdf.exe	Get hash	malicious	FormBook, PureLog Stealer	Browse	13.107.246.45
	Shipping Document.exe	Get hash	malicious	FormBook, PureLog Stealer	Browse	13.107.246.45
	1712226379134618467.js	Get hash	malicious	Strela Downloader	Browse	13.107.246.45
	https://sign.zoho.com/zsguest?locale=en&sign_id=234b4d535f4956237c699124bb06f6840075804affff79070f72fbd27ec4885c3a2ba06657b8a52338eb80052baee9f74c4e2e0e7f85c073df939f1ac4dff75f76c95d46ac2361c7b14335e4f12c5c5d49c49b1d2f4c838a&action_type=SIGN	Get hash	malicious	Unknown	Browse	13.107.246.45
	https://www.filemail.com/d/rxythqchkhluipl?skipreg=true	Get hash	malicious	Unknown	Browse	13.107.246.45
	https://eu.jotform.com/app/250092704521347	Get hash	malicious	Unknown	Browse	13.107.246.45
	http://loginmicrosoftonline.Bdo.scoremasters.gr/cache/cdn?email=christian.wernli@bdo.ch	Get hash	malicious	Unknown	Browse	13.107.246.45
ip-api.com	sDflTDPSLw.exe	Get hash	malicious	AgentTesla	Browse	208.95.112.1
	2HCwqwLg1G.exe	Get hash	malicious	AgentTesla	Browse	208.95.112.1
	CdbVaYf8jC.exe	Get hash	malicious	AgentTesla	Browse	208.95.112.1
	H9YFiQB7o3.exe	Get hash	malicious	AgentTesla	Browse	208.95.112.1
	lFlw40OH6u.exe	Get hash	malicious	AgentTesla	Browse	208.95.112.1
	Pago devuelto #.Documentos#9787565789678675645767856843.exe	Get hash	malicious	AgentTesla	Browse	208.95.112.1
	driver.exe	Get hash	malicious	Blank Grabber	Browse	208.95.112.1
	XClient.exe	Get hash	malicious	XWorm	Browse	208.95.112.1
	Comprobante.de.pago.pdf.exe	Get hash	malicious	AgentTesla	Browse	208.95.112.1
	p.exe	Get hash	malicious	Unknown	Browse	208.95.112.1

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
TUT-ASUS	sDflTDPSLw.exe	Get hash	malicious	AgentTesla	Browse	208.95.112.1
	2HCwqwLg1G.exe	Get hash	malicious	AgentTesla	Browse	208.95.112.1
	CdbVaYf8jC.exe	Get hash	malicious	AgentTesla	Browse	208.95.112.1
	H9YFiQB7o3.exe	Get hash	malicious	AgentTesla	Browse	208.95.112.1
	lFlw40OH6u.exe	Get hash	malicious	AgentTesla	Browse	208.95.112.1
	Pago devuelto #.Documentos#9787565789678675645767856843.exe	Get hash	malicious	AgentTesla	Browse	208.95.112.1
	driver.exe	Get hash	malicious	Blank Grabber	Browse	208.95.112.1
	XClient.exe	Get hash	malicious	XWorm	Browse	208.95.112.1
	Comprobante.de.pago.pdf.exe	Get hash	malicious	AgentTesla	Browse	208.95.112.1
	p.exe	Get hash	malicious	Unknown	Browse	208.95.112.1

Process:	C:\Users\user\Desktop\hCkkM0lH0P.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1216
Entropy (8bit):	5.34331486778365
Encrypted:	false
SSDEEP:	24:MLUE4K5E4KH1qE4qXKDE4KhKiKhPKIE4oKNzKoZAE4Kze0E4x84j:MIHK5HKH1qHiYHKh3oPtHo6hAHKze0HJ
MD5:	1330C80CAAC9A0FB172F202485E9B1E8
SHA1:	86BAFDA4E4AE68C7C3012714A33D85D2B6E1A492
SHA-256:	B6C63ECE799A8F7E497C2A158B1FFC2F5CB4F745A2F8E585F794572B7CF03560
SHA-512:	75A17AB129FE97BBAB36AA2BD66D59F41DB5AFF44A705EF3E4D094EC5FCD056A3ED59992A0AC96C9D0D40E490F8596B07DCA9B60E606B67223867B061D9D0EB2
Malicious:	true
Reputation:	high, very likely benign file
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..2,"System.Windows.Forms, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089",0..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System\920e3d1d70447c3c10e69e6df0766568\System.ni.dll",0..2,"System.Drawing, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a",0..3,"System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Core\8b2c1203fd20aea8260bfbc518004720\System.Core.ni.dll",0..3,"System.Configuration, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Configuration\2192b0d5aa4aa14486ae08118d3b9fcc\System.Configuration.ni.dll",0..3,"System.Xml, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Xml\2062ed810929ec0e33254c02

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	2232
Entropy (8bit):	5.379460230152629
Encrypted:	false
SSDEEP:	48:fWSU4y4RQmFoUeWmfgZ9tK8NPZHUm7u1iMuge//8PUyus:fLHyIFKL3IZ2KRH9Oug8s
MD5:	5EDBE2AEEFE69FB36ECED2E31AC9386F
SHA1:	6614C7900E4994E1A3606D22916BE68F701A19D4
SHA-256:	4275A59302475C8198165F4EB61EA2A88BD12056EA6EE5197C1BF8E6B6A6F9FD
SHA-512:	CFBAB752BE8CB209B25F2D1AD30E08E5E7ADB2EE5B4CCE98DCFD20B05E4B1CEFFCB6551556B134A2123412C864A8A544701C846F204783D99CB58936DC086A76
Malicious:	false
Reputation:	moderate, very likely benign file
Preview:	@...e................................................@..........P................1]...E.....j.....(.Microsoft.PowerShell.Commands.ManagementH...............o..b~.D.poM......... .Microsoft.PowerShell.ConsoleHost0......................C.l]..7.s........System..4....................D...{..\|f........System.Core.D...............4..7..D.#V.............System.Management.AutomationL.................gQ?O.....x5.......#.Microsoft.Management.Infrastructure.<................t.,.lG....M...........System.Management...@................z.U..G...5.f.1........System.DirectoryServices4.................%...K... ...........System.Xml..8..................1...L..U;V.<}........System.Numerics.4.....................@.[8]'.\........System.Data.<...............i..VdqF...\|...........System.ConfigurationH................WY..2.M.&..g(g........Microsoft.PowerShell.Security...<...............V.}...@...i...........System.Transactions.P...............8..{...@.e..."4.......%.Microsoft.PowerShell.Com

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_geugiseg.ysf.psm1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Reputation:	high, very likely benign file
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_oytjxpjm.vws.ps1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_rbp5ty1d.usf.psm1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_xkvv0hgf.uqp.ps1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Entropy (8bit):	7.535242607623147
TrID:	Win32 Executable (generic) Net Framework (10011505/4) 49.83% Win32 Executable (generic) a (10002005/4) 49.78% Generic CIL Executable (.NET, Mono, etc.) (73296/58) 0.36% Generic Win/DOS Executable (2004/3) 0.01% DOS Executable Generic (2002/1) 0.01%
File name:	hCkkM0lH0P.exe
File size:	829'440 bytes
MD5:	0fbd42eaa6018baee8d8d62c2523763c
SHA1:	2721894c14665ebf180e94f42b5c352ac62ea7e0
SHA256:	aa7e0932069694a1e9e98868f0128d3de3bcee0de7591f12cfc491fa91fc0dd6
SHA512:	12b8df1904d1c97e6658e2ab56723c65122940b22ced7950bb4d1079fceb45c7155fc58f4dd1f2e610db4a001fcdb12d9f22dc92e4615c3ae133def1ea84230a
SSDEEP:	12288:egmEIAB7wrQ3Hb13rbJxGnDEFc2WJp/pc0X3rgkesXQgMbA4cD6TOgO0:WE9r37rxGn4FcNJcogk9qcDw20
TLSH:	0B05BF1476548F53CA7987F93871E07113F85FAEA02EF2555DC26EEBB9A2F008950E83
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...V]................0.................. ........@.. ....................................@................................

File Icon


Icon Hash:	90cececece8e8eb0

Static PE Info

General

Entrypoint:	0x4cba8e
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
Time Stamp:	0xBFF75D56 [Fri Jan 22 03:39:02 2072 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:	f34d5f2d4577ed6d9ceec516c1f5a744

Entrypoint Preview

Instruction
jmp dword ptr [00402000h]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0xcba3a	0x4f	.text
IMAGE_DIRECTORY_ENTRY_RESOURCE	0xcc000	0x61c	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0xce000	0xc	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0xc7a14	0x70	.text
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x2000	0x8	.text
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x2008	0x48	.text
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x2000	0xc9a94	0xc9c00	c35d0a40adbfc4d1d725638a79950b93	False	0.8118332268432465	data	7.544879966198614	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rsrc	0xcc000	0x61c	0x800	3c7dd3e77eeba4d4ac626e462b4a6489	False	0.3369140625	data	3.4540976808955652	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0xce000	0xc	0x200	d9c033ed3985c66bf08f893a3aee7985	False	0.044921875	data	0.09800417566270775	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_VERSION	0xcc090	0x38c	PGP symmetric key encrypted data - Plaintext or unencrypted data			0.42180616740088106
RT_MANIFEST	0xcc42c	0x1ea	XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators			0.5489795918367347

Imports

DLL	Import
mscoree.dll	_CorExeMain

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 10, 2025 15:54:52.983196020 CET	49747	80	192.168.2.11	208.95.112.1
Jan 10, 2025 15:54:52.987960100 CET	80	49747	208.95.112.1	192.168.2.11
Jan 10, 2025 15:54:52.988020897 CET	49747	80	192.168.2.11	208.95.112.1
Jan 10, 2025 15:54:52.989007950 CET	49747	80	192.168.2.11	208.95.112.1
Jan 10, 2025 15:54:52.993760109 CET	80	49747	208.95.112.1	192.168.2.11
Jan 10, 2025 15:54:53.459295034 CET	80	49747	208.95.112.1	192.168.2.11
Jan 10, 2025 15:54:53.566693068 CET	49747	80	192.168.2.11	208.95.112.1
Jan 10, 2025 15:55:44.176635981 CET	49747	80	192.168.2.11	208.95.112.1
Jan 10, 2025 15:55:44.181760073 CET	80	49747	208.95.112.1	192.168.2.11
Jan 10, 2025 15:55:44.181833029 CET	49747	80	192.168.2.11	208.95.112.1

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 10, 2025 15:54:52.961042881 CET	65075	53	192.168.2.11	1.1.1.1
Jan 10, 2025 15:54:52.968019009 CET	53	65075	1.1.1.1	192.168.2.11
Jan 10, 2025 15:54:54.171463013 CET	64218	53	192.168.2.11	1.1.1.1
Jan 10, 2025 15:54:54.181550026 CET	53	64218	1.1.1.1	192.168.2.11

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Jan 10, 2025 15:54:52.961042881 CET	192.168.2.11	1.1.1.1	0xccc2	Standard query (0)	ip-api.com	A (IP address)	IN (0x0001)	false
Jan 10, 2025 15:54:54.171463013 CET	192.168.2.11	1.1.1.1	0x35cd	Standard query (0)	mail.apexrnun.com	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Jan 10, 2025 15:54:45.937536001 CET	1.1.1.1	192.168.2.11	0x96c6	No error (0)	shed.dual-low.s-part-0017.t-0009.t-msedge.net	s-part-0017.t-0009.t-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Jan 10, 2025 15:54:45.937536001 CET	1.1.1.1	192.168.2.11	0x96c6	No error (0)	s-part-0017.t-0009.t-msedge.net		13.107.246.45	A (IP address)	IN (0x0001)	false
Jan 10, 2025 15:54:52.968019009 CET	1.1.1.1	192.168.2.11	0xccc2	No error (0)	ip-api.com		208.95.112.1	A (IP address)	IN (0x0001)	false
Jan 10, 2025 15:54:54.181550026 CET	1.1.1.1	192.168.2.11	0x35cd	Name error (3)	mail.apexrnun.com	none	none	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

ip-api.com

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.11	49747	208.95.112.1	80	4884	C:\Users\user\Desktop\hCkkM0lH0P.exe

Timestamp	Bytes transferred	Direction	Data
Jan 10, 2025 15:54:52.989007950 CET	80	OUT	GET /line/?fields=hosting HTTP/1.1 Host: ip-api.com Connection: Keep-Alive
Jan 10, 2025 15:54:53.459295034 CET	175	IN	HTTP/1.1 200 OK Date: Fri, 10 Jan 2025 14:54:53 GMT Content-Type: text/plain; charset=utf-8 Content-Length: 6 Access-Control-Allow-Origin: * X-Ttl: 11 X-Rl: 43 Data Raw: 66 61 6c 73 65 0a Data Ascii: false

Target ID:	0
Start time:	09:54:48
Start date:	10/01/2025
Path:	C:\Users\user\Desktop\hCkkM0lH0P.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\hCkkM0lH0P.exe"
Imagebase:	0x960000
File size:	829'440 bytes
MD5 hash:	0FBD42EAA6018BAEE8D8D62C2523763C
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000000.00000002.1386426356.0000000003D19000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000000.00000002.1386426356.0000000003D19000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	09:54:49
Start date:	10/01/2025
Path:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\hCkkM0lH0P.exe"
Imagebase:	0xc00000
File size:	433'152 bytes
MD5 hash:	C32CA4ACFCC635EC1EA6ED8A34DF5FAC
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	09:54:49
Start date:	10/01/2025
Path:	C:\Users\user\Desktop\hCkkM0lH0P.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\hCkkM0lH0P.exe"
Imagebase:	0x940000
File size:	829'440 bytes
MD5 hash:	0FBD42EAA6018BAEE8D8D62C2523763C
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000004.00000002.2615899257.0000000000402000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000004.00000002.2615899257.0000000000402000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000004.00000002.2617872188.0000000002CE1000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000004.00000002.2617872188.0000000002CE1000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000004.00000002.2617872188.0000000002D0D000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	false

Show Windows behavior

Target ID:	5
Start time:	09:54:49
Start date:	10/01/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff68cce0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	6
Start time:	09:54:53
Start date:	10/01/2025
Path:	C:\Windows\System32\wbem\WmiPrvSE.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\wbem\wmiprvse.exe -secured -Embedding
Imagebase:	0x7ff6220e0000
File size:	496'640 bytes
MD5 hash:	60FF40CFD7FB8FE41EE4FE9AE5FE1C51
Has elevated privileges:	true
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Execution Graph

Execution Coverage:	8.1%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	0%
Total number of Nodes:	56
Total number of Limit Nodes:	1

Executed Functions

Function 08DEB908 Relevance: 2.7, Strings: 2, Instructions: 180
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

Telq, xrefs: 08DEBAA7
Telq, xrefs: 08DEBA73

Memory Dump Source

Source File: 00000000.00000002.1401383878.0000000008DE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 08DE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8de0000_hCkkM0lH0P.jbxd

Similarity

API ID:
String ID: Telq$Telq
API String ID: 0-229388037
Opcode ID: aaa833167e4f971b03e43550c611950ccc626ebbac1027b55e7b2b6e1d7a71f5
Instruction ID: 2cfc56d1539b12c5240d3d8d58bdcef947c944b828e4c4aa081907be9aeecd85
Opcode Fuzzy Hash: aaa833167e4f971b03e43550c611950ccc626ebbac1027b55e7b2b6e1d7a71f5
Instruction Fuzzy Hash: 7B71E374E042188FCB04DFAAC8846EDBBF6BF88311F10912AE559BB355D774A905CB50

Function 08DEB8F8 Relevance: 2.7, Strings: 2, Instructions: 161
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

Telq, xrefs: 08DEBAA7
Telq, xrefs: 08DEBA73

Memory Dump Source

Source File: 00000000.00000002.1401383878.0000000008DE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 08DE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8de0000_hCkkM0lH0P.jbxd

Similarity

API ID:
String ID: Telq$Telq
API String ID: 0-229388037
Opcode ID: 00fd9241f699f4c8d58c6306df579774268e8ad27cd8bba9913afc5204aefedc
Instruction ID: fc3411f38b0f09c1562915ee615d2d272e770f63370b964212e594bcf80096bf
Opcode Fuzzy Hash: 00fd9241f699f4c8d58c6306df579774268e8ad27cd8bba9913afc5204aefedc
Instruction Fuzzy Hash: 6551D674E04208CFCB04DFAAD8446EDBBF6BF89311F10912AE959BB354DB74A946CB50

Function 08DE6A90 Relevance: 2.6, Strings: 2, Instructions: 71
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

8pq, xrefs: 08DE6AEC
8pq, xrefs: 08DE6B23

Memory Dump Source

Source File: 00000000.00000002.1401383878.0000000008DE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 08DE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8de0000_hCkkM0lH0P.jbxd

Similarity

API ID:
String ID: 8pq$8pq
API String ID: 0-3067674588
Opcode ID: 1b932d5ab0bb9d255d3d2e74892493fee64a568b61f223c1b6b2b4250bb4f9e3
Instruction ID: d17a5674a05c05cf9b3d834a91e37d0d0112250aa4f2099e333878b2ff5c4576
Opcode Fuzzy Hash: 1b932d5ab0bb9d255d3d2e74892493fee64a568b61f223c1b6b2b4250bb4f9e3
Instruction Fuzzy Hash: 8121E770B44204DFDB14BB79A91496ABBEAEBE8341B10466AF106E7394EE70DD01C792

Function 02B0ADA8 Relevance: 1.7, APIs: 1, Instructions: 198
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000000.00000002.1377814386.0000000002B00000.00000040.00000800.00020000.00000000.sdmp, Offset: 02B00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2b00000_hCkkM0lH0P.jbxd

Similarity

API ID: HandleModule
String ID:
API String ID: 4139908857-0
Opcode ID: d19ef111782de605216b2aeeb2f07a29105e700df0087bc6dad1c9beff301f29
Instruction ID: 5673cc3e91d01b69a513db4f006234d6d0ab3dd8a6349fe6ddea677c38cacb0b
Opcode Fuzzy Hash: d19ef111782de605216b2aeeb2f07a29105e700df0087bc6dad1c9beff301f29
Instruction Fuzzy Hash: E3716670A00B058FD725DF29D48575ABBF1FF88304F108A6DE18AD7A90DB75E849CB90

Function 02B044B4 Relevance: 1.6, APIs: 1, Instructions: 96
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateActCtxA.KERNEL32(?), ref: 02B059D1

Memory Dump Source

Source File: 00000000.00000002.1377814386.0000000002B00000.00000040.00000800.00020000.00000000.sdmp, Offset: 02B00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2b00000_hCkkM0lH0P.jbxd

Similarity

API ID: Create
String ID:
API String ID: 2289755597-0
Opcode ID: 93908d7141938086e3e60786b90339b24b6aae43811fd775455f6d735f47159e
Instruction ID: a52b4d111cbf11220c530bf1088b1a4f616788f4e593b5b2cbd3795f4cfb2b27
Opcode Fuzzy Hash: 93908d7141938086e3e60786b90339b24b6aae43811fd775455f6d735f47159e
Instruction Fuzzy Hash: 9A41E2B0C0061DCBDB24DFAAC888B8DBBF5FF49304F60806AD418AB255DB756949CF90

Function 02B05914 Relevance: 1.6, APIs: 1, Instructions: 95
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateActCtxA.KERNEL32(?), ref: 02B059D1

Memory Dump Source

Source File: 00000000.00000002.1377814386.0000000002B00000.00000040.00000800.00020000.00000000.sdmp, Offset: 02B00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2b00000_hCkkM0lH0P.jbxd

Similarity

API ID: Create
String ID:
API String ID: 2289755597-0
Opcode ID: b37a5df80afeaeb37c16a1df46d47508ef8ed1d09ee7b9b38e7493e56bf0c06b
Instruction ID: bde72db1a0ad9624c66e1d27b5dfac70c19109e21efe8e80ca7082852ae5564a
Opcode Fuzzy Hash: b37a5df80afeaeb37c16a1df46d47508ef8ed1d09ee7b9b38e7493e56bf0c06b
Instruction Fuzzy Hash: D541E2B1C00619CFDB24CFAAC884BCDBBF1BF49704F60806AD418AB255DB756949CF50

Function 02B0D27C Relevance: 1.6, APIs: 1, Instructions: 65
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?,?,?,?,02B0D656,?,?,?,?,?), ref: 02B0D717

Memory Dump Source

Source File: 00000000.00000002.1377814386.0000000002B00000.00000040.00000800.00020000.00000000.sdmp, Offset: 02B00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2b00000_hCkkM0lH0P.jbxd

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: 6d6e26a979d5b6641947b5c43e0a530505f6bd55cc1ba45f761ad628a7072cfd
Instruction ID: b9ee67ad98067de5f3c60d09dbcb17fb6ca9c13bf2dc146fe773c35334cbe47a
Opcode Fuzzy Hash: 6d6e26a979d5b6641947b5c43e0a530505f6bd55cc1ba45f761ad628a7072cfd
Instruction Fuzzy Hash: DA21E3B5900249AFDB10CFAAD584AEEFFF8EB48310F14845AE918B3350D374A954CFA5

Function 02B0D688 Relevance: 1.6, APIs: 1, Instructions: 62
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?,?,?,?,02B0D656,?,?,?,?,?), ref: 02B0D717

Memory Dump Source

Source File: 00000000.00000002.1377814386.0000000002B00000.00000040.00000800.00020000.00000000.sdmp, Offset: 02B00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2b00000_hCkkM0lH0P.jbxd

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: c24d2d583a39b35a1e7f30b8196493ff2107603f99c38e12ff01792e2fa871be
Instruction ID: 66e71af55bba640b466a23cab70f2983a0419113a5482b69e545cb8f527dfd09
Opcode Fuzzy Hash: c24d2d583a39b35a1e7f30b8196493ff2107603f99c38e12ff01792e2fa871be
Instruction Fuzzy Hash: E421E2B5D00249AFDB10CFA9D985AEEBBF4EB48314F14845AE918B3350D378A944CFA1

Function 02B0B031 Relevance: 1.6, APIs: 1, Instructions: 59
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleW.KERNELBASE(00000000,?,?,?,?,?,?,?,02B0ADC4), ref: 02B0AFFE

Memory Dump Source

Source File: 00000000.00000002.1377814386.0000000002B00000.00000040.00000800.00020000.00000000.sdmp, Offset: 02B00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2b00000_hCkkM0lH0P.jbxd

Similarity

API ID: HandleModule
String ID:
API String ID: 4139908857-0
Opcode ID: 061ea6a1c1e27ded013c481b9477c61b79d29479240cece5fcd44b9227a95479
Instruction ID: e95b6acfa547651a99f6e8576a6bda14bc86811e5197dc5bcb2948fd0e34a982
Opcode Fuzzy Hash: 061ea6a1c1e27ded013c481b9477c61b79d29479240cece5fcd44b9227a95479
Instruction Fuzzy Hash: B1119476A003049BD715DF5AD884B9ABBF5EB88314F0484A9D518A7290D775A845CFA0

Function 02B0A0CC Relevance: 1.6, APIs: 1, Instructions: 50
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleW.KERNELBASE(00000000,?,?,?,?,?,?,?,02B0ADC4), ref: 02B0AFFE

Memory Dump Source

Source File: 00000000.00000002.1377814386.0000000002B00000.00000040.00000800.00020000.00000000.sdmp, Offset: 02B00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2b00000_hCkkM0lH0P.jbxd

Similarity

API ID: HandleModule
String ID:
API String ID: 4139908857-0
Opcode ID: b42f8cd82134349e6ed2d422cc9be295469db1a9118e58867dc3c063ed051e88
Instruction ID: a9eb38618b3f99f2f5324a9bfaa5520e1e8e54896a2aeedce50652c110f65550
Opcode Fuzzy Hash: b42f8cd82134349e6ed2d422cc9be295469db1a9118e58867dc3c063ed051e88
Instruction Fuzzy Hash: 241102B6D043498FCB20DF9AC484B9EFBF4EB48314F10846AD529B7250D379A545CFA1

Function 08DE5C71 Relevance: 1.4, Strings: 1, Instructions: 158
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

%*&/)(#$^@!~-_, xrefs: 08DE5CA9

Memory Dump Source

Source File: 00000000.00000002.1401383878.0000000008DE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 08DE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8de0000_hCkkM0lH0P.jbxd

Similarity

API ID:
String ID: %*&/)(#$^@!~-_
API String ID: 0-3325533558
Opcode ID: c582fa03fe903dd0a2fb35047251ed0429d9c0315416c5301f12105be18b98f4
Instruction ID: 54ad70aca7e0e982053a1334790b228b3239dab8cb8a4b93ded604d4472d2ebc
Opcode Fuzzy Hash: c582fa03fe903dd0a2fb35047251ed0429d9c0315416c5301f12105be18b98f4
Instruction Fuzzy Hash: 1951AD31B002449FDB04BB74E4596ADBBB3FF89300F5485A9D881AF399CF31A949C781

Function 08DE5C80 Relevance: 1.4, Strings: 1, Instructions: 152
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

%*&/)(#$^@!~-_, xrefs: 08DE5CA9

Memory Dump Source

Source File: 00000000.00000002.1401383878.0000000008DE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 08DE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8de0000_hCkkM0lH0P.jbxd

Similarity

API ID:
String ID: %*&/)(#$^@!~-_
API String ID: 0-3325533558
Opcode ID: 3e0be6e0da51c73e9f384b72a44276c860736aaf44ae1d8b3b8cbe40be247f46
Instruction ID: c1562bcd736e12a4ea6b077b8b37e916ff36cb33eee3a9f55c67ace0b64892f5
Opcode Fuzzy Hash: 3e0be6e0da51c73e9f384b72a44276c860736aaf44ae1d8b3b8cbe40be247f46
Instruction Fuzzy Hash: C351BE31B002449FDB04BB74E5596AEBBB2FF88300F5485A9D881AF399CF71AD45C781

Function 08DE6A80 Relevance: 1.3, Strings: 1, Instructions: 69COMMON

Download Yara Rule

Strings

8pq, xrefs: 08DE6AEC

Memory Dump Source

Source File: 00000000.00000002.1401383878.0000000008DE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 08DE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8de0000_hCkkM0lH0P.jbxd

Similarity

API ID:
String ID: 8pq
API String ID: 0-1942323134
Opcode ID: ea3ae0c0253abd183a54356a3a53d57df998540362085510b3c3d2ba66b0218d
Instruction ID: 65d1cebd7138806c4f23667638f7811db6c19461ada9a0cfaac3505bc322d527
Opcode Fuzzy Hash: ea3ae0c0253abd183a54356a3a53d57df998540362085510b3c3d2ba66b0218d
Instruction Fuzzy Hash: 43210670B04200CFDB14AB79A91466A7BF6EFA8342B14427AF242DB395EB74CD01C752

Function 08DE16A0 Relevance: .5, Instructions: 523COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1401383878.0000000008DE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 08DE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8de0000_hCkkM0lH0P.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 224f7cd37c2eae35666352c6568b7e353012c39bcfb797575b7e4c749d4fc275
Instruction ID: e76825baf9183423808f9775a55bca210335587706cc2c0969544465c588ecce
Opcode Fuzzy Hash: 224f7cd37c2eae35666352c6568b7e353012c39bcfb797575b7e4c749d4fc275
Instruction Fuzzy Hash: DD42E230E1061DCFCF15EFA8C8456ECBBB1BF49301F518299D5897B264EB309A99CB81

Function 08DE1691 Relevance: .5, Instructions: 518COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1401383878.0000000008DE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 08DE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8de0000_hCkkM0lH0P.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0b0432783b2b44917ecaaa2a5f8a0b53413be70eb265430bfea14673d74be7be
Instruction ID: 1494074e085ba6be12e2926ee45b0a96969bd51da138f788e1b2d43b99cf6a5f
Opcode Fuzzy Hash: 0b0432783b2b44917ecaaa2a5f8a0b53413be70eb265430bfea14673d74be7be
Instruction Fuzzy Hash: F442E330E10619CFCF15EFA8C8456ECBBB1BF49301F518299D5897B265EB309A99CF81

Function 08DE2808 Relevance: .5, Instructions: 473COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1401383878.0000000008DE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 08DE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8de0000_hCkkM0lH0P.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 72678fc32115d3fb26acf24e25d30298ee49db1463b6ccac7d11560c6842e02c
Instruction ID: 83ff4dc0f78521df4643470ab35dbc87e157338e64f8fe4f7643918e58d33434
Opcode Fuzzy Hash: 72678fc32115d3fb26acf24e25d30298ee49db1463b6ccac7d11560c6842e02c
Instruction Fuzzy Hash: 47224F31A00709DFCF15EF64C8506DDBBB6FF85340F10869AE949AB250EB71EA85CB91

Function 08DEBB20 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1401383878.0000000008DE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 08DE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8de0000_hCkkM0lH0P.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e7d241bde303dc42fc4e28a7c024c5baf547e9a49da4d5a28cdf0e54a6d5747b
Instruction ID: 488c356788034b9a1f570e658192506e05f8ffc4b58b8673e79ff183a2b54860
Opcode Fuzzy Hash: e7d241bde303dc42fc4e28a7c024c5baf547e9a49da4d5a28cdf0e54a6d5747b
Instruction Fuzzy Hash: 8CB12B74E0521ADFDB04EFA8D580AEDBBB6FF48310F109626E449AB359DB30A945CF40

Function 08DE0CF8 Relevance: .2, Instructions: 207COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1401383878.0000000008DE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 08DE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8de0000_hCkkM0lH0P.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c589d08db4afca250997c8aa7029814631fd9f302e7f42e80440bf7c610b9fdd
Instruction ID: dba415cc9c59793f9fc51045ed686e75dd0dce9a35c90f35bab827217f23015c
Opcode Fuzzy Hash: c589d08db4afca250997c8aa7029814631fd9f302e7f42e80440bf7c610b9fdd
Instruction Fuzzy Hash: 79819030A10A09DFCB11FF68D4886ADBFB1FF45341F504669E485A72A4EBB0DD65CB80

Function 08DE7F17 Relevance: .2, Instructions: 166COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1401383878.0000000008DE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 08DE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8de0000_hCkkM0lH0P.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6d4b64af620846047c233a5a0bd570a38945f9d809a20237ac695ebc65a46f8b
Instruction ID: 6d477bc8fe97c5e8d297e98480a4f93de4c4d61641e9998ce0384f63bd44c882
Opcode Fuzzy Hash: 6d4b64af620846047c233a5a0bd570a38945f9d809a20237ac695ebc65a46f8b
Instruction Fuzzy Hash: E451F474E0014AAFDB14EFA9C8417BEBFB2BB44311F108226F591A73D4CB349C428B90

Function 08DE8CA8 Relevance: .2, Instructions: 156COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1401383878.0000000008DE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 08DE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8de0000_hCkkM0lH0P.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ce0e0ba5dc22dcc2f3b9c6b94a39c63cda13be87bc0920d942d01bf3f9781ce5
Instruction ID: a9f9a03e0554a741d6490a84204741ef1dfa8fd839fa4d08875b69c9d580be45
Opcode Fuzzy Hash: ce0e0ba5dc22dcc2f3b9c6b94a39c63cda13be87bc0920d942d01bf3f9781ce5
Instruction Fuzzy Hash: D0512631B092548FC715AF6988406AA7FA2EF86B42F0486BBF186DB2D6C674D805D352

Function 08DEC108 Relevance: .1, Instructions: 132COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1401383878.0000000008DE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 08DE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8de0000_hCkkM0lH0P.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4bed18d663ecc74f1a6f57ff2b794e32b49846403e9ccaf8cdd3b3d4cef57f09
Instruction ID: fe63155bd872706c9e0c811ee6f60405096e1fcc10d2c09e883114b234fe43c0
Opcode Fuzzy Hash: 4bed18d663ecc74f1a6f57ff2b794e32b49846403e9ccaf8cdd3b3d4cef57f09
Instruction Fuzzy Hash: 4D412A74D29208CFDB04DFAAC8406FEBBF6AF8D342F14D16AE459A3251D7348941CB64

Function 08DE3F70 Relevance: .1, Instructions: 131COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1401383878.0000000008DE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 08DE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8de0000_hCkkM0lH0P.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 642283b3064b40647587cd9dfd87fd864022958834fbabbf3a1a7d591a498910
Instruction ID: a828178d636659c0585cd95f0986436b465333735c5171783eafd9bb7fc22c9c
Opcode Fuzzy Hash: 642283b3064b40647587cd9dfd87fd864022958834fbabbf3a1a7d591a498910
Instruction Fuzzy Hash: 01513D71E0064ACBCF10DFA8C881AADB7F1FF88211F14866AE459E7301D734A995CBA0

Function 08DE6020 Relevance: .1, Instructions: 127COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1401383878.0000000008DE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 08DE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8de0000_hCkkM0lH0P.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5a9af646395a709811a277ec747f54ecba7bf02801583ca74584d84abb640aaa
Instruction ID: b09fed068a60d447ed209c75a5f84854a5d9e4d8c42f37ef5d1cd1f0503dc2ca
Opcode Fuzzy Hash: 5a9af646395a709811a277ec747f54ecba7bf02801583ca74584d84abb640aaa
Instruction Fuzzy Hash: 3241BFB0D05208EFC725EFA5E5246AEBBB2FF60300F24C19AD0159B366E734CA05CB95

Function 08DE03C4 Relevance: .1, Instructions: 124COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1401383878.0000000008DE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 08DE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8de0000_hCkkM0lH0P.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a334980cac7461e613934d1db807eb89a108651cdcb1406938da95fa1ecc7dca
Instruction ID: afe7d339e7dccc9217dd71e2ed389fea985af6f941d0d3eaf2de7ba6391c25e8
Opcode Fuzzy Hash: a334980cac7461e613934d1db807eb89a108651cdcb1406938da95fa1ecc7dca
Instruction Fuzzy Hash: AD418070F045569FDF01BF64C958BAE7BB0BB44383F104A29F582E7294EA74C911CB91

Function 08DE0F70 Relevance: .1, Instructions: 120COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1401383878.0000000008DE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 08DE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8de0000_hCkkM0lH0P.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d127c2bba00fd926afc4633f53f6fc3a995b8a88a997bbda03e8ac1b5a02346a
Instruction ID: 6cfcd93b2b2d5eab87308d38d1a194cf9d5fb8f7d509bae8d5e5450ecde226bf
Opcode Fuzzy Hash: d127c2bba00fd926afc4633f53f6fc3a995b8a88a997bbda03e8ac1b5a02346a
Instruction Fuzzy Hash: 0C41D270F046969FDF02BF60C954BAE7BF0BB44283F10066AF482E7295EA34C911CB91

Function 08DE5B34 Relevance: .1, Instructions: 102COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1401383878.0000000008DE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 08DE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8de0000_hCkkM0lH0P.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bbdce2a11b0fc1a440a8484079083e3e233f84b7e07e16e8e551ebf284c0d212
Instruction ID: 4a57e42113d42f33c7987083e884d019434b1a41be6e283085f9090619de6038
Opcode Fuzzy Hash: bbdce2a11b0fc1a440a8484079083e3e233f84b7e07e16e8e551ebf284c0d212
Instruction Fuzzy Hash: 3E317CB5900208AFCB10DFA9D884ADEBFF5EF49360F10842AE809E7310D735A940CBA0

Function 08DE5EA6 Relevance: .1, Instructions: 101COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1401383878.0000000008DE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 08DE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8de0000_hCkkM0lH0P.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 778262a4d5d9820bb5920f31344281b50f331f4c983288196abdf57f2b7f8d09
Instruction ID: 21e54366fa2257950134f9c78760b019e00bbb8ea0c8e0de4c647eac5aa823f8
Opcode Fuzzy Hash: 778262a4d5d9820bb5920f31344281b50f331f4c983288196abdf57f2b7f8d09
Instruction Fuzzy Hash: 1131C07070D3804FC7166B74A8293A93FF2AB46256F1942ABE582CB2D3CD788C05C762

Function 08DE8E80 Relevance: .1, Instructions: 90COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1401383878.0000000008DE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 08DE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8de0000_hCkkM0lH0P.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1d2d3dbc623c6eba818a983a61ff6047dbe6c9ca9ff06a31d6a9f6d9228fb46d
Instruction ID: 5320fe846690f51ad5a62d9123487f9ebfa33dcbe789274dfcc2e64c23221f36
Opcode Fuzzy Hash: 1d2d3dbc623c6eba818a983a61ff6047dbe6c9ca9ff06a31d6a9f6d9228fb46d
Instruction Fuzzy Hash: F331FC70904645CFCB24EF69C4002BAFBF2FB84306F1082BAE595E7291DB39D901DBA1

Function 08DE8B18 Relevance: .1, Instructions: 88COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1401383878.0000000008DE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 08DE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8de0000_hCkkM0lH0P.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9a824705d27b249a8e22db6b9b9db3e5193b6eefbab4bac846c5b59c6ce00928
Instruction ID: 94167c83e500a0cf758d90d34cb6fd4cf92dbb2dc8125d0b98c771bcc1acc59c
Opcode Fuzzy Hash: 9a824705d27b249a8e22db6b9b9db3e5193b6eefbab4bac846c5b59c6ce00928
Instruction Fuzzy Hash: A231C0B0A05248CFD710AFA9CD8166AFBF4AF46292F04867BF496D7291D334D940D751

Function 08DE5EE8 Relevance: .1, Instructions: 84COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1401383878.0000000008DE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 08DE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8de0000_hCkkM0lH0P.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 674a03c625c97f0d810de203d21a5390430636976b04eacdd524e6acdbabc39a
Instruction ID: ad51c88472c78258c44af045b55365b64a3208d634877ce32324a068e4b0adea
Opcode Fuzzy Hash: 674a03c625c97f0d810de203d21a5390430636976b04eacdd524e6acdbabc39a
Instruction Fuzzy Hash: E021BC707142048FC7086B79A81D66E7FE7AB89396F14826AF646C73D5CE748C01C7A2

Function 08DE3EA0 Relevance: .1, Instructions: 76COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1401383878.0000000008DE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 08DE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8de0000_hCkkM0lH0P.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5a1b21d55ccf75d2bb9c485fd66454655a4fb590d615daeb57f8eaea45c4d280
Instruction ID: 6c1dcf5b64c27f14feced4c48797937585c2b2b34447666943562733c5504622
Opcode Fuzzy Hash: 5a1b21d55ccf75d2bb9c485fd66454655a4fb590d615daeb57f8eaea45c4d280
Instruction Fuzzy Hash: 5F214A31E00609CFCB05EBA9D4486BEB7B4EF89751F00866AE919E7350EB709985CB91

Function 08DE09F8 Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1401383878.0000000008DE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 08DE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8de0000_hCkkM0lH0P.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 006b394fda17d6c6c0a0af71f2f3a678fd306caf46613c9e296d6385f3d88f02
Instruction ID: d1ef329e99097e462db192217e438475862be082d9e9e837e0dcd261d40ce34d
Opcode Fuzzy Hash: 006b394fda17d6c6c0a0af71f2f3a678fd306caf46613c9e296d6385f3d88f02
Instruction Fuzzy Hash: 2D2115B59017099FDB20DF9AE884ADEFBF4FB48314F14842EE519A7300C375A944CBA4

Function 010FD01C Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1376837037.00000000010FD000.00000040.00000800.00020000.00000000.sdmp, Offset: 010FD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10fd000_hCkkM0lH0P.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c57493f0c3758ba557cf0ce7e5644e758f5a0504c88a1dec6ecebace2154077c
Instruction ID: 73f4b24a9cb049649746e0f5893e5d4551d2b308fa73d10398261fc210fb4418
Opcode Fuzzy Hash: c57493f0c3758ba557cf0ce7e5644e758f5a0504c88a1dec6ecebace2154077c
Instruction Fuzzy Hash: 78212271604200DFDB15DF98D980B26BFA5EB88314F20C5ADFA8A4B656C33AD407CB61

Function 010FD1D4 Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1376837037.00000000010FD000.00000040.00000800.00020000.00000000.sdmp, Offset: 010FD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10fd000_hCkkM0lH0P.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 303ee2c90dbbd0f5a5920f79d80ede0e8b720b0083e64a3c58f396f33c60d7ea
Instruction ID: 3148de4c7595a8a41296f216a88d5e9da6b98bf16396629744847d58ef52e30e
Opcode Fuzzy Hash: 303ee2c90dbbd0f5a5920f79d80ede0e8b720b0083e64a3c58f396f33c60d7ea
Instruction Fuzzy Hash: 97214979504200EFDB81DF98D5C1B26BBA5FB94324F20C5ADEA894B656C33AD406CBA1

Function 08DE3848 Relevance: .1, Instructions: 71COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1401383878.0000000008DE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 08DE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8de0000_hCkkM0lH0P.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9dc53ec92f48156abbf87a8e493695fa28588b38c6246a086be933ebe1eb5361
Instruction ID: 500241368c782fd00bd87e7a64a8bee4a345670d4e6659fa9e882c4e52d25963
Opcode Fuzzy Hash: 9dc53ec92f48156abbf87a8e493695fa28588b38c6246a086be933ebe1eb5361
Instruction Fuzzy Hash: AE213375A0020A8FCF04EF69C8844AEF7B9FF893507118669E905A7351EB30A945CBA1

Function 08DE3839 Relevance: .1, Instructions: 70COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1401383878.0000000008DE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 08DE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8de0000_hCkkM0lH0P.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1fdcbb76dab64098a442de7675aa50882862d142e24cc1377c2441eb217b9131
Instruction ID: e624ce090c08930a65c462a94c2dabdc46bf02dc3ac4b22b2bbcd6bf8e173d76
Opcode Fuzzy Hash: 1fdcbb76dab64098a442de7675aa50882862d142e24cc1377c2441eb217b9131
Instruction Fuzzy Hash: 67216075B002058FCB04DF69C8885AEBBB9FF89310705456EE805E7351EB30E905CBA1

Function 08DE8C98 Relevance: .1, Instructions: 66COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1401383878.0000000008DE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 08DE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8de0000_hCkkM0lH0P.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: aa9aa50f1bceabd590eb3c111c2308911504533575eff8e473017826d354caf6
Instruction ID: 2c2d89473e44979d2d3c13d395a5a3aa6e3784098644903d34463ada4e3fcd19
Opcode Fuzzy Hash: aa9aa50f1bceabd590eb3c111c2308911504533575eff8e473017826d354caf6
Instruction Fuzzy Hash: 062190B1905219DFC714BFA9D58067ABBB1FB85242F00423BF286A6281D334D951D792

Function 08DE0394 Relevance: .1, Instructions: 66COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1401383878.0000000008DE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 08DE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8de0000_hCkkM0lH0P.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6c7489c1b85e7387eee36bf1a8202399b741139c2b235513c8ed05eaa52a4b1a
Instruction ID: 8c6974662aef155a17e77be736220e7880ac4a4d28b9d9eed37b54301c29e29a
Opcode Fuzzy Hash: 6c7489c1b85e7387eee36bf1a8202399b741139c2b235513c8ed05eaa52a4b1a
Instruction Fuzzy Hash: D821F0B590174D9FDB20DF9AD884AAEBBF4FB48310F10842EE419A7200D3B4A944CBA4

Function 08DE1FB8 Relevance: .1, Instructions: 64COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1401383878.0000000008DE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 08DE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8de0000_hCkkM0lH0P.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 32121bd767d2232e572e5f709332b23e77b019fbab88187ad856319f21a93e70
Instruction ID: 85d83e0619ca67afe55b6db4f2317ddff7201057e42344e80f6cda568348f4f5
Opcode Fuzzy Hash: 32121bd767d2232e572e5f709332b23e77b019fbab88187ad856319f21a93e70
Instruction Fuzzy Hash: 0E217AB49002499FCB10EF9AD449BEEBFF5EB88310F108019E955AB380D775A945CFA1

Function 08DEC2A0 Relevance: .1, Instructions: 63COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1401383878.0000000008DE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 08DE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8de0000_hCkkM0lH0P.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7dbbedd0661e24e207f387a89c65596d6e4f8fdf8815fa96d694f58a5385a494
Instruction ID: da8a94aacb9b3eb48c04e1ab89afa3e953872d30bc1afffd28d9796cf611c6f0
Opcode Fuzzy Hash: 7dbbedd0661e24e207f387a89c65596d6e4f8fdf8815fa96d694f58a5385a494
Instruction Fuzzy Hash: EB2129B4E19209DFCB40DFA9C581AAEBBF5AB49341F609199E818A7311D3309E40DF51

Function 08DE1FA9 Relevance: .1, Instructions: 61COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1401383878.0000000008DE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 08DE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8de0000_hCkkM0lH0P.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: abe75aa82a225a9799150e9198c97360818b5489adb7e217c1bd41ace422d533
Instruction ID: 6dc39a9f1ea547230227158485787d663338e500c7e19341fee6c665e8efa5f2
Opcode Fuzzy Hash: abe75aa82a225a9799150e9198c97360818b5489adb7e217c1bd41ace422d533
Instruction Fuzzy Hash: CA2159B49043489FCB10EF99D449BAEBFF4EB49310F10841AE954BB780C739A944CFA1

Function 08DE8DA1 Relevance: .1, Instructions: 60COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1401383878.0000000008DE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 08DE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8de0000_hCkkM0lH0P.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ee0739dab5d27ac0314b3888561bca8ecad69dd87dfc1e1c0859161324914a2b
Instruction ID: 464849bdee5634c42df1c67d33bb953f4ec867ddef3757067611558ad726df25
Opcode Fuzzy Hash: ee0739dab5d27ac0314b3888561bca8ecad69dd87dfc1e1c0859161324914a2b
Instruction Fuzzy Hash: 9B110630744201CFE3146F248805B6AB7A3EBD5B52F1581BAF042CF2E5C675D842C745

Function 08DEC2B0 Relevance: .1, Instructions: 57COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1401383878.0000000008DE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 08DE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8de0000_hCkkM0lH0P.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 11db2901a78331ba194034faa006af7171538ab7216153f609cce45f637e9462
Instruction ID: 4f12dcc02d2c867471562523a2202f9e506a9b306872656e9726131912f4c6eb
Opcode Fuzzy Hash: 11db2901a78331ba194034faa006af7171538ab7216153f609cce45f637e9462
Instruction Fuzzy Hash: E621E7B8E15209CFCB44DFA9C581AAEBBF5BB48341F6091A9E819A7711D7309E40CF91

Function 08DE539C Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1401383878.0000000008DE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 08DE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8de0000_hCkkM0lH0P.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 81631d7a7115608885c991e93dfd1cce7a9503d244636c7a0e8d9f77ee8c172d
Instruction ID: 949fb3a03dd72741fe4e20460e07a709a611209460a37f32e4787879f9cdd489
Opcode Fuzzy Hash: 81631d7a7115608885c991e93dfd1cce7a9503d244636c7a0e8d9f77ee8c172d
Instruction Fuzzy Hash: 602100B59002499FCB50DF9AD884ADEBFF4FB48320F10842AE919B7310D374A954CFA1

Function 08DE4FA4 Relevance: .1, Instructions: 55COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1401383878.0000000008DE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 08DE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8de0000_hCkkM0lH0P.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 298da4614fb50cf6779f38fc6b618abe36931fd6b62f5fcfebe6c8061a540b6b
Instruction ID: 12e0ea2c9a7cbadf70f8e363d38838f184faa43c8acf4ec9c18d42d44531637b
Opcode Fuzzy Hash: 298da4614fb50cf6779f38fc6b618abe36931fd6b62f5fcfebe6c8061a540b6b
Instruction Fuzzy Hash: 0A1191B1D04209AFDB01EFA5D8506AE7FB2FF44301B0081EAE0559F3A5DB344A06CB91

Function 08DEC34F Relevance: .1, Instructions: 55COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1401383878.0000000008DE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 08DE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8de0000_hCkkM0lH0P.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fc3f4eda7e4c27868c2b1fb1003a73538ef0e9bd427f6a50c28c881d1b566d01
Instruction ID: cbf388526286b06bc808d796e3f85966feb2fed7fc9cdaa1d070fadbfc43aee8
Opcode Fuzzy Hash: fc3f4eda7e4c27868c2b1fb1003a73538ef0e9bd427f6a50c28c881d1b566d01
Instruction Fuzzy Hash: 9C114674D28208DFCB04EFA9C5409ADBFF5FB49301F1196AAE488A7212D3309A40DB41

Function 010FD1CF Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1376837037.00000000010FD000.00000040.00000800.00020000.00000000.sdmp, Offset: 010FD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10fd000_hCkkM0lH0P.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a3be7094ea246a7cddba5200c6ce82fad2e7d53e3ec886449491685f026f1607
Instruction ID: 8ea07771b568f0c79e72269f449c412fdec6780cfa00b991d5e18bda0fb7389a
Opcode Fuzzy Hash: a3be7094ea246a7cddba5200c6ce82fad2e7d53e3ec886449491685f026f1607
Instruction Fuzzy Hash: DB11BB79504280DFDB42CF54C5C4B15BBA1FB84224F24C6AED9894B696C33AD40ACBA1

Function 010FD017 Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1376837037.00000000010FD000.00000040.00000800.00020000.00000000.sdmp, Offset: 010FD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10fd000_hCkkM0lH0P.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a3be7094ea246a7cddba5200c6ce82fad2e7d53e3ec886449491685f026f1607
Instruction ID: 25e643fb9999e3ae5b84a343026ab70eb077821f5aba909f28015e587b911b8a
Opcode Fuzzy Hash: a3be7094ea246a7cddba5200c6ce82fad2e7d53e3ec886449491685f026f1607
Instruction Fuzzy Hash: 6411DD75504280CFDB16CF58D5C4B15FFA2FB84314F24C6AEE9494BA56C33AD40ACBA2

Function 08DED3D0 Relevance: .1, Instructions: 51COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1401383878.0000000008DE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 08DE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8de0000_hCkkM0lH0P.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 51b7c263b2726460c0ad19ef9d3b49e83acddde97895413ad9d8c8d6346c12f7
Instruction ID: 84c5d0382da4b2ef087574e24307e4d20c984e4219fc58ec877fe52dee3523bd
Opcode Fuzzy Hash: 51b7c263b2726460c0ad19ef9d3b49e83acddde97895413ad9d8c8d6346c12f7
Instruction Fuzzy Hash: A5111870D05218DFDB48DF6AD4408EEBBFAAF89341F04C129E859A7351DB309841CF90

Function 08DE1108 Relevance: .0, Instructions: 50COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1401383878.0000000008DE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 08DE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8de0000_hCkkM0lH0P.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 14ab665f3f47d042a75eb89a2ababe7ba6059ccf97ce7ac965c0c0f2d46585fc
Instruction ID: 83371a783d1b14a86c574a4efbd828bf02f2485c7014c3c9de686ba780578876
Opcode Fuzzy Hash: 14ab665f3f47d042a75eb89a2ababe7ba6059ccf97ce7ac965c0c0f2d46585fc
Instruction Fuzzy Hash: C411CE30E0020A9FDB00EF68C8526AFBBB2EF08354F008628E815A7390DB749545CBC0

Function 08DE8CC7 Relevance: .0, Instructions: 48COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1401383878.0000000008DE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 08DE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8de0000_hCkkM0lH0P.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 53b991f6bf2244779a8079c8e893e14765384a9f397ee5e71f3881f235a85f5a
Instruction ID: a7c348ef7bc80b556cd8c916846d2cf10e9f9a234261c2de2b5715df9b4cacd2
Opcode Fuzzy Hash: 53b991f6bf2244779a8079c8e893e14765384a9f397ee5e71f3881f235a85f5a
Instruction Fuzzy Hash: 7301D2B1A05424CFC7047F98D68077AF260FB85742F00433BF696EA6C5D630D951E791

Function 08DE4F02 Relevance: .0, Instructions: 46COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1401383878.0000000008DE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 08DE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8de0000_hCkkM0lH0P.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3cac6cfb4b0de5e596ef03c72ee57494d8904d4c09176608b46b32baf2154c21
Instruction ID: dc6f2e145705481afb029d8e0951337571b65e5692cba93ecd5dc7e7f5c437e4
Opcode Fuzzy Hash: 3cac6cfb4b0de5e596ef03c72ee57494d8904d4c09176608b46b32baf2154c21
Instruction Fuzzy Hash: 631105B1D00209AFDB41EFA9D9516AEBFB6FF44300F1085EAD055AB3A4EB341A05CB91

Function 010ED745 Relevance: .0, Instructions: 45COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1376776996.00000000010ED000.00000040.00000800.00020000.00000000.sdmp, Offset: 010ED000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10ed000_hCkkM0lH0P.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7497be55e18b470d4e368e11fb58eb04e8ac64d25c72206affd476287aeda1a3
Instruction ID: 584db7b989b99f0c2f6d2a3aa0a30509eee07a73c0785e96a83fe5d99bc413f6
Opcode Fuzzy Hash: 7497be55e18b470d4e368e11fb58eb04e8ac64d25c72206affd476287aeda1a3
Instruction Fuzzy Hash: B701FC710443809EE7104B5ACD8CB6ABFD8FF41320F04C56AEDC94A246E2799440C771

Function 08DE1118 Relevance: .0, Instructions: 43COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1401383878.0000000008DE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 08DE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8de0000_hCkkM0lH0P.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 985f5e44353ae1935c9a6ff083f809a3ab3b4445b2c75fab5c4d9873ad799bab
Instruction ID: ddea095ac1d1c132dc49ddadb9f7a718880e2aef13045e369a52ca1a5776cf75
Opcode Fuzzy Hash: 985f5e44353ae1935c9a6ff083f809a3ab3b4445b2c75fab5c4d9873ad799bab
Instruction Fuzzy Hash: E5018C30E0020A9FDB04EFA8C8026AEBBB1EF48344F108629E915E7390DB74A545CBC4

Function 08DED808 Relevance: .0, Instructions: 41COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1401383878.0000000008DE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 08DE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8de0000_hCkkM0lH0P.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 29c41920c74ea02d3741fddd22fdfe3132c25ad8071b9182e7bac3ba55e50a49
Instruction ID: 5d381bf353780c26b37e93c318fa72f22dd78be172c04cdf97011a7905ed971f
Opcode Fuzzy Hash: 29c41920c74ea02d3741fddd22fdfe3132c25ad8071b9182e7bac3ba55e50a49
Instruction Fuzzy Hash: E601FB74A09108EFC704EFA9C684AADBBFAAB49311F55D198E4499B365DB30DE00DB40

Function 08DE4F10 Relevance: .0, Instructions: 40COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1401383878.0000000008DE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 08DE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8de0000_hCkkM0lH0P.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 38f807d0627a7f8d462815bafdcf8e8374407740c2d918e0452e97b6576b382e
Instruction ID: 7cd03b80f519cbff346ff79973c397cbe59a567919db5c395d5cc18492ce598e
Opcode Fuzzy Hash: 38f807d0627a7f8d462815bafdcf8e8374407740c2d918e0452e97b6576b382e
Instruction Fuzzy Hash: D60108B1D0020DAFDB40EFA9D9516AEBFB6FF44300F1085AAD015AB354EB341A05CF81

Function 08DE1619 Relevance: .0, Instructions: 40COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1401383878.0000000008DE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 08DE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8de0000_hCkkM0lH0P.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 54366c16fe279f1e9bb6b731d767a6dcd07746faa22e959796574a9edba5f241
Instruction ID: bcc4b98b21434e267e55c01a96c5aee9543871c02075b483daf77bc155a423f2
Opcode Fuzzy Hash: 54366c16fe279f1e9bb6b731d767a6dcd07746faa22e959796574a9edba5f241
Instruction Fuzzy Hash: 4A01A232A1070ADFCF00AF78D8444D9BB76FF95305F118B2EE04567250EB759599CB90

Function 08DECCAF Relevance: .0, Instructions: 39COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1401383878.0000000008DE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 08DE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8de0000_hCkkM0lH0P.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c2a56f2501d7f60b47506f85a97ffa64bc0371dae9fb37743773d6874bd0a363
Instruction ID: b3d8a96e60f5a8ededc79a8689e7ecbc4bbfc8754962f3a4870325177ef26d15
Opcode Fuzzy Hash: c2a56f2501d7f60b47506f85a97ffa64bc0371dae9fb37743773d6874bd0a363
Instruction Fuzzy Hash: 8E017C34906218CFC725EF64E5449A8B77AFF4E312F104299E40EA7252CB32DE85CF10

Function 08DE1620 Relevance: .0, Instructions: 39COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1401383878.0000000008DE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 08DE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8de0000_hCkkM0lH0P.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0cdbd05358aac3308aca97880ad4b1bc2c2815f3e1d09ef01a980ac40ae5624c
Instruction ID: e22617c7eddb2c8bd827641a422a0c1bb4a8a8b6300910eb40332ee4d02d3139
Opcode Fuzzy Hash: 0cdbd05358aac3308aca97880ad4b1bc2c2815f3e1d09ef01a980ac40ae5624c
Instruction Fuzzy Hash: 5801A232A1070A9BCF00AF65D8488CABB75FF85305F11872AE00527210EB70A599CB90

Function 010ED744 Relevance: .0, Instructions: 36COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1376776996.00000000010ED000.00000040.00000800.00020000.00000000.sdmp, Offset: 010ED000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10ed000_hCkkM0lH0P.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: db0d065177bf5356bef0bde5f06536012433c5c5957df02389ec45178c956efa
Instruction ID: 75504fd9571ab3aa7458e84f3d7c8799a4ba44615adad5b111417cf5445080ae
Opcode Fuzzy Hash: db0d065177bf5356bef0bde5f06536012433c5c5957df02389ec45178c956efa
Instruction Fuzzy Hash: 20F06271444384AEE7218F1AC888B66FFD8EF81734F18C45AED885A286D2799844CBB1

Function 08DE3948 Relevance: .0, Instructions: 36COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1401383878.0000000008DE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 08DE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8de0000_hCkkM0lH0P.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 50a9b3b1deffbeea9ca03ee985a95e42c204dec76aa4e53c74f2e794259d6ac8
Instruction ID: c94ff64444179ac8bd64ea055b669887220bbc701616881349babc297fae4d26
Opcode Fuzzy Hash: 50a9b3b1deffbeea9ca03ee985a95e42c204dec76aa4e53c74f2e794259d6ac8
Instruction Fuzzy Hash: BCF030343105108FC744AB6DC88893973EAEFCDA51B1541BAE60ECB3B4CF60DC0287A0

Function 08DEDEE0 Relevance: .0, Instructions: 32COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1401383878.0000000008DE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 08DE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8de0000_hCkkM0lH0P.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: eb528c85c387b09b32a094ee1e83e319cb821bf3b269c4e0e994a57ae0d8f283
Instruction ID: 0ca449e1e72d027e4f159edab99e118b1dd70096826ceee32a31e2e1791d2fe1
Opcode Fuzzy Hash: eb528c85c387b09b32a094ee1e83e319cb821bf3b269c4e0e994a57ae0d8f283
Instruction Fuzzy Hash: 2F01F674D01109AFCB44EFA8D5849AEBBF5BB08301F108199E854E3341D734AA40CBA1

Function 08DEC498 Relevance: .0, Instructions: 31COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1401383878.0000000008DE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 08DE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8de0000_hCkkM0lH0P.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f69e832e9560238f4fd38e95e2c899efce453f02faa9253a2ef123ed7ea414ad
Instruction ID: 9860588b048a27744cb38c3f75a1dd46f411795d09e6092e6cf4fda973b5a114
Opcode Fuzzy Hash: f69e832e9560238f4fd38e95e2c899efce453f02faa9253a2ef123ed7ea414ad
Instruction Fuzzy Hash: F0F06DB092438A8FDB14DFA9C405AAEBFF0BF19351F1046A9E451DB241D7348145CF80

Function 08DEC4A8 Relevance: .0, Instructions: 29COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1401383878.0000000008DE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 08DE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8de0000_hCkkM0lH0P.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b0384e2c9b8ee6562d6f967b23859d44f9246206416524db58e45117ec25ad5f
Instruction ID: 0e9da5c296e475ed371ea91039cf0d1659809bf52ead766b113f0c2a8aa1046c
Opcode Fuzzy Hash: b0384e2c9b8ee6562d6f967b23859d44f9246206416524db58e45117ec25ad5f
Instruction Fuzzy Hash: C3F0DAB0D1420E9FDB44EFA9C846AAEBFF4AB48240F1046A9E919E7201D77095448F90

Function 08DE37F0 Relevance: .0, Instructions: 29COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1401383878.0000000008DE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 08DE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8de0000_hCkkM0lH0P.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fa7e25d431c496a2f5aaa80d935690727efc066424f9ec5e83534246418f8188
Instruction ID: e423a43d17183bf702771c2cdbcfb4f16d980fff3accb089c9138bf0035841a0
Opcode Fuzzy Hash: fa7e25d431c496a2f5aaa80d935690727efc066424f9ec5e83534246418f8188
Instruction Fuzzy Hash: 98E06D71B006114B871CEBABA49086AFADBEFC8650344C1AED44D8B7A4ED719C418B84

Function 08DEC3E8 Relevance: .0, Instructions: 28COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1401383878.0000000008DE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 08DE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8de0000_hCkkM0lH0P.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a7eb067e6a668b4372539dfcd2dee0b908db1e44c2207de0e419bd79bfa226db
Instruction ID: 3bd1e5622410b4bfa9f315788fa35494b8c5498d358c93705b8a8224fa3925ad
Opcode Fuzzy Hash: a7eb067e6a668b4372539dfcd2dee0b908db1e44c2207de0e419bd79bfa226db
Instruction Fuzzy Hash: 3DF0A074850207DFC720DFA8C400A5ABFF0EF18356F2486A9E458D6661E7354041CB40

Function 08DE77DE Relevance: .0, Instructions: 27COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1401383878.0000000008DE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 08DE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8de0000_hCkkM0lH0P.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7adce6766ad8537d0695724e6d0ae7cf8b3994b08da48815b5b31081ac6b1fda
Instruction ID: 45f823b303b73428df3ee78629f1e673ff87da492b600f8a73001cd7c712afd6
Opcode Fuzzy Hash: 7adce6766ad8537d0695724e6d0ae7cf8b3994b08da48815b5b31081ac6b1fda
Instruction Fuzzy Hash: C5E06576600008AF9F48EF94E941E9E7BFAEF44255B14816AF408D7324E630D951C750

Function 08DECA55 Relevance: .0, Instructions: 26COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1401383878.0000000008DE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 08DE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8de0000_hCkkM0lH0P.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7454592eeec79e1deb4890bf1e6776df554f63db45388e6e57a1addec142fe33
Instruction ID: defd2b818ee8091464c9bff9f76b47d964818fb70119b8de9671ee2544b29550
Opcode Fuzzy Hash: 7454592eeec79e1deb4890bf1e6776df554f63db45388e6e57a1addec142fe33
Instruction Fuzzy Hash: 32F0E23590E2808FC701D7A4E8A9AA47F76EF47202F0A40FBD08D9F4A3C7798518CB21

Function 08DECB45 Relevance: .0, Instructions: 25COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1401383878.0000000008DE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 08DE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8de0000_hCkkM0lH0P.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1d344c2674af4a8f792fe92bd3fc2531e369db50af21e0d5c5dfed0b717b0fc9
Instruction ID: 67fd2a8ced18cc8d426ca22a1d23671b354578f49bcc6c779e5847665fbcf693
Opcode Fuzzy Hash: 1d344c2674af4a8f792fe92bd3fc2531e369db50af21e0d5c5dfed0b717b0fc9
Instruction Fuzzy Hash: 9FF06571509204CFC715AB64E5955A47739FF4F356F0011D6E44E9B127D7329945CF20

Function 08DE09C0 Relevance: .0, Instructions: 24COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1401383878.0000000008DE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 08DE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8de0000_hCkkM0lH0P.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f3678e2c910916d5f296616ae3e0c49d0e1f43dcdbe21c8d29e306fa1ecec977
Instruction ID: 621e99b08f2b18a2ee9ec1df6903867c81470f299d1f339dd50daa337a8599b2
Opcode Fuzzy Hash: f3678e2c910916d5f296616ae3e0c49d0e1f43dcdbe21c8d29e306fa1ecec977
Instruction Fuzzy Hash: 77E02BB25062447F8702AB54DC00CC57FEDEE17D0030A8087F08CDB222D9279851C7E0

Function 08DECAB6 Relevance: .0, Instructions: 24COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1401383878.0000000008DE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 08DE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8de0000_hCkkM0lH0P.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cae3397b54498c44e3ac7cdf7bbc7c0d3c19f1641df5c8f8e35edd4fc8f270ce
Instruction ID: 00bf9130dc8b2eccc7ffdcd81174da6e663138d54cc0ac5e3ef5bfd726823b72
Opcode Fuzzy Hash: cae3397b54498c44e3ac7cdf7bbc7c0d3c19f1641df5c8f8e35edd4fc8f270ce
Instruction Fuzzy Hash: 49F0F878A09228DFDB60DF64D895BA8BBB4BB19701F1091D6E48DA7341D7749EC0CF11

Function 08DE37E0 Relevance: .0, Instructions: 22COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1401383878.0000000008DE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 08DE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8de0000_hCkkM0lH0P.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2c76ba3add25c64fb32b54b50c631d39fd04bc566fa1116bb98fa4642f0e5a26
Instruction ID: baecbe6976e8c587d747d17ec932aa78138c66b1e9379f7f56c2f72c1e9c4e93
Opcode Fuzzy Hash: 2c76ba3add25c64fb32b54b50c631d39fd04bc566fa1116bb98fa4642f0e5a26
Instruction Fuzzy Hash: A3E0DFB1A047404F931A9B29C480466BBB3BFC4210304C2AFD0498BA68E9310D01CB84

Function 08DE7448 Relevance: .0, Instructions: 21COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1401383878.0000000008DE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 08DE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8de0000_hCkkM0lH0P.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b2bca3ece15577d21e70bcf8c44044540afc2f609fc711d34567e224c0f905c9
Instruction ID: 5dbb3d7b43656478f02d83a3c09511d3e2d7780d3ba989cb54c25ebe5e678658
Opcode Fuzzy Hash: b2bca3ece15577d21e70bcf8c44044540afc2f609fc711d34567e224c0f905c9
Instruction Fuzzy Hash: 7EE06D34A00109DFEB40AFFCC94966E7BB1FB45301F200666E502E7741CA38C940C752

Function 08DE3937 Relevance: .0, Instructions: 18COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1401383878.0000000008DE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 08DE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8de0000_hCkkM0lH0P.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 658d0905f27c78fb92b8a9c4a73bae7010c0ab4452fcb499c8bd294e17da4bfb
Instruction ID: 5cfc269498f88be8ff91a065ba3bbb612c898f84621538512e39a303013ae51b
Opcode Fuzzy Hash: 658d0905f27c78fb92b8a9c4a73bae7010c0ab4452fcb499c8bd294e17da4bfb
Instruction Fuzzy Hash: 73D05E36A1C3448FCA19FA96FC511EEBF62EE98066B04416AE54897252C62B140A8725

Function 08DEC3F8 Relevance: .0, Instructions: 18COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1401383878.0000000008DE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 08DE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8de0000_hCkkM0lH0P.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c22edfbcd26b3a3c542521d160410d7d35095f23368ba951493054ec73700ec6
Instruction ID: c1266c7c32c38a07281b8c0d7736f86b14765806438b78eca655acbe6bb6dd2b
Opcode Fuzzy Hash: c22edfbcd26b3a3c542521d160410d7d35095f23368ba951493054ec73700ec6
Instruction Fuzzy Hash: BDE092B0D5020A9FD740EFB9C905A6EBBF4AB08600F1185A9D019E7211E7749A058F91

Function 08DEAF41 Relevance: .0, Instructions: 16COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1401383878.0000000008DE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 08DE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8de0000_hCkkM0lH0P.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f402eb7c4efe51a3ebcc013b6c28f2e3e9e81ec66fee8635219f2f869688bc0b
Instruction ID: 2bd33eb7707ce023ceaf917d8bb1fcf3ce9e2a2f6028f7c85823171b1b1b0f09
Opcode Fuzzy Hash: f402eb7c4efe51a3ebcc013b6c28f2e3e9e81ec66fee8635219f2f869688bc0b
Instruction Fuzzy Hash: 4BD05E3004A343CFC3026BA0EC09268BFB46B16316F4401A6E48483593DB684456C765

Function 08DEB30B Relevance: .0, Instructions: 14COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1401383878.0000000008DE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 08DE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8de0000_hCkkM0lH0P.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 38f7e37b492b028fc3d4627982765366af304ded803b3e592cfd90d652386c29
Instruction ID: cef3a11ab10916f43c414ae94707faa393643b441e4a58478de69a38ec6d0f2c
Opcode Fuzzy Hash: 38f7e37b492b028fc3d4627982765366af304ded803b3e592cfd90d652386c29
Instruction Fuzzy Hash: 13D09E759452199FCB90EB54E9817EC7779EB85225F0052A1E00D92225DB301E9ACF11

Function 08DEC548 Relevance: .0, Instructions: 14COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1401383878.0000000008DE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 08DE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8de0000_hCkkM0lH0P.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5d90c9cf1372fc477ad315d4e190e5d25da956bfc8a3803348d8feb8a1aa068c
Instruction ID: c31fa22efdb1d85ab7895b950b1c1b71369aea9a71b763f7242e22812734b78d
Opcode Fuzzy Hash: 5d90c9cf1372fc477ad315d4e190e5d25da956bfc8a3803348d8feb8a1aa068c
Instruction Fuzzy Hash: DAD0123612020D9E4B40FE99FC00C537FDDBB347517408522F508CB120EA21F434D791

Function 08DE09D0 Relevance: .0, Instructions: 13COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1401383878.0000000008DE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 08DE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8de0000_hCkkM0lH0P.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9c2c60772cc12243f4928a8b8a5b2b553d5826df92ef859b9922f0de317ba0d6
Instruction ID: f255fd340709b6aa6235f7ae64ae21fd5f5f3c61a705a942e376a6fb40236480
Opcode Fuzzy Hash: 9c2c60772cc12243f4928a8b8a5b2b553d5826df92ef859b9922f0de317ba0d6
Instruction Fuzzy Hash: 28C012361005187B4A01AB85D800C86BBADEF49654305C056F50C8B121D672E912D7E0

Function 08DEAF50 Relevance: .0, Instructions: 10COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1401383878.0000000008DE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 08DE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8de0000_hCkkM0lH0P.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8ac9de59f6f6fef98e150bc8c48f8275c7a7937850e38ccdc1197fdfa149d366
Instruction ID: af84a129a1bffba86fb6a881ea8a781b6cae22a02ce14a0435db946ed7382300
Opcode Fuzzy Hash: 8ac9de59f6f6fef98e150bc8c48f8275c7a7937850e38ccdc1197fdfa149d366
Instruction Fuzzy Hash: 3DC08C300066058FC2043BA4F90E3387668670431AF400018B909430525FA80441C699

Function 08DE5B24 Relevance: .0, Instructions: 8COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1401383878.0000000008DE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 08DE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8de0000_hCkkM0lH0P.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cc137bf870c02e5893a8fa93d99f16f2407549f86985017ad167c7731c093256
Instruction ID: de36f6a6f6b6d017039ed36fd8263c94dc604ec3e3ff64c8a48b5d33ff95d36c
Opcode Fuzzy Hash: cc137bf870c02e5893a8fa93d99f16f2407549f86985017ad167c7731c093256
Instruction Fuzzy Hash: 80B012391E7180A1D00136E459CCE2EA561EFF1786B808E12B78864018C4B08C64923B

Function 08DECC1E Relevance: .0, Instructions: 7COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1401383878.0000000008DE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 08DE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8de0000_hCkkM0lH0P.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 438dd4d98261fa841cd82db75501495fb746c8bad630d5fcf154d7a535d0650f
Instruction ID: da3c3ec1ed1f1e2199bacdd2569a5d28b0132c929e3b65b8f16bc5b24127cf18
Opcode Fuzzy Hash: 438dd4d98261fa841cd82db75501495fb746c8bad630d5fcf154d7a535d0650f
Instruction Fuzzy Hash: 87C00274914299CFDB109F90D885B9D7B31AF45355F104185D40923254C77499D6CF64

Function 08DE77B3 Relevance: .0, Instructions: 6COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1401383878.0000000008DE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 08DE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8de0000_hCkkM0lH0P.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dfa962a3340d0eda6526361c45239114f3c6600681f6d8e370b9620dd482e80c
Instruction ID: 870dab516bd382256d209577a798329217bbc78d4d5b4b81d55c3e91da03e106
Opcode Fuzzy Hash: dfa962a3340d0eda6526361c45239114f3c6600681f6d8e370b9620dd482e80c
Instruction Fuzzy Hash: 46A022EB3202800ABA083830AC02BC00A20CBF03CC3008002AB2838200CA80C0AAC03B

Non-executed Functions

Function 08DEF8F0 Relevance: .3, Instructions: 312COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1401383878.0000000008DE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 08DE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8de0000_hCkkM0lH0P.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3142eab096809de480015c83cd023c4a397d71406b9a5f893d5ef68ffdf3f32c
Instruction ID: 9fe5e2a33637d8e0e02275c619adf3d8933268f93e8f2887de9d2d3e93115601
Opcode Fuzzy Hash: 3142eab096809de480015c83cd023c4a397d71406b9a5f893d5ef68ffdf3f32c
Instruction Fuzzy Hash: 73E10C74E111198FCB14DF99C9909AEFBF2FF89305F248269E415AB355DB30A942CF60

Function 08DEF4B8 Relevance: .3, Instructions: 312COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1401383878.0000000008DE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 08DE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8de0000_hCkkM0lH0P.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 71fa32ef7cfbaa3194ececa824cadfb76d7fd43922bd3b830bbb1b6253d97561
Instruction ID: 00694195b0c1daabacb9df11770b615f3ec9b697d7d80ceaaad6ae294c6823c5
Opcode Fuzzy Hash: 71fa32ef7cfbaa3194ececa824cadfb76d7fd43922bd3b830bbb1b6253d97561
Instruction Fuzzy Hash: A6E11C74E111199FCB14DFA9C5809AEFBF2FF88315F2482A9E414AB355DB31A942CF60

Function 02B0D5BC Relevance: .3, Instructions: 264COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1377814386.0000000002B00000.00000040.00000800.00020000.00000000.sdmp, Offset: 02B00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2b00000_hCkkM0lH0P.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d100789a8dd3d27ad9e6411fa36542162a63721aa4f6d9a2357ead82e4969ddc
Instruction ID: 454e6f4cabc3eb9762a3897a119b3d2fa6095b8129d31a6ff30284a9147a17fb
Opcode Fuzzy Hash: d100789a8dd3d27ad9e6411fa36542162a63721aa4f6d9a2357ead82e4969ddc
Instruction Fuzzy Hash: E9A15032F102058FCF16DFA4C9845AEBBB2FF85304B1585AAE805AB6A5DF31E955CF40

Analysis Process: hCkkM0lH0P.exePID: 4884, Parent PID: 6468COMMON

Execution Graph

Execution Coverage:	10.8%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	3%
Total number of Nodes:	101
Total number of Limit Nodes:	15

Executed Functions

Function 068A3088 Relevance: 8.0, Strings: 6, Instructions: 545
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

$lq, xrefs: 068A37B7
$lq, xrefs: 068A375E
$lq, xrefs: 068A37AB
$lq, xrefs: 068A376A
$lq, xrefs: 068A3787
$lq, xrefs: 068A3793

Memory Dump Source

Source File: 00000004.00000002.2623821887.00000000068A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 068A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_68a0000_hCkkM0lH0P.jbxd

Similarity

API ID:
String ID: $lq$$lq$$lq$$lq$$lq$$lq
API String ID: 0-1854859054
Opcode ID: 91769c2cecb1aadddbca4e42fd3820cd10415eeef71c1f5c95d6bf4b42d9d5b0
Instruction ID: 62028bc39e76e8d58808e389716f79388cc6e681483a4cd296f7907b8a9223a0
Opcode Fuzzy Hash: 91769c2cecb1aadddbca4e42fd3820cd10415eeef71c1f5c95d6bf4b42d9d5b0
Instruction Fuzzy Hash: D0321D31E1071ADFDB14EF75C89459DB7B6BF99300F20C6AAD449A7264EB30E985CB80

Function 068A7D88 Relevance: 3.0, Strings: 2, Instructions: 473
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

$lq, xrefs: 068A832F
$lq, xrefs: 068A8323

Memory Dump Source

Source File: 00000004.00000002.2623821887.00000000068A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 068A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_68a0000_hCkkM0lH0P.jbxd

Similarity

API ID:
String ID: $lq$$lq
API String ID: 0-4169330588
Opcode ID: 05c926a341ff0f293d81aab57a3dc4c095eaa81a3c4ae5d7516583628c34bf95
Instruction ID: 3254a1e3c180cbf80a739a33230d622e2c204036eb1fffdf41f0257fbbf38ae3
Opcode Fuzzy Hash: 05c926a341ff0f293d81aab57a3dc4c095eaa81a3c4ae5d7516583628c34bf95
Instruction Fuzzy Hash: A902AD70B002059FEB54DF64D9906AEB7E2FF84304F248929E905DB399DB76EC46CB90

Function 068A51C0 Relevance: 1.8, Strings: 1, Instructions: 587COMMON

Download Yara Rule

Strings

$, xrefs: 068A54F3

Memory Dump Source

Source File: 00000004.00000002.2623821887.00000000068A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 068A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_68a0000_hCkkM0lH0P.jbxd

Similarity

API ID:
String ID: $
API String ID: 0-3993045852
Opcode ID: 2d65d0ab9233c9294708a76720ecad460efc39553041d40bb8850f19a3cf56bb
Instruction ID: 67edbe1e7f446514e3f75935120fdc229dce740a90a651b72b6638be180bce1c
Opcode Fuzzy Hash: 2d65d0ab9233c9294708a76720ecad460efc39553041d40bb8850f19a3cf56bb
Instruction Fuzzy Hash: AD22A171E003159FEB60DFA4C5806AEBBB2FF85310F248469E946EB354DA35DD81CB91

Function 011970B0 Relevance: 1.6, APIs: 1, Instructions: 65COMMON

Download Yara Rule

APIs

CheckRemoteDebuggerPresent.KERNELBASE(?,?), ref: 01197127

Memory Dump Source

Source File: 00000004.00000002.2616633159.0000000001190000.00000040.00000800.00020000.00000000.sdmp, Offset: 01190000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1190000_hCkkM0lH0P.jbxd

Similarity

API ID: CheckDebuggerPresentRemote
String ID:
API String ID: 3662101638-0
Opcode ID: d0c9b416947b32aedeb80bc975b145eb5714f945251a42cd13e13063b1faf386
Instruction ID: 48c7ec77b565204ca441c006cb578791cf388670baae47985fecd730f792b466
Opcode Fuzzy Hash: d0c9b416947b32aedeb80bc975b145eb5714f945251a42cd13e13063b1faf386
Instruction Fuzzy Hash: 742145B18002598FCB14CFAAD884BEEFBF4AF48310F14842AE459B3250D378A944CFA0

Function 068A65F8 Relevance: .8, Instructions: 814COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2623821887.00000000068A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 068A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_68a0000_hCkkM0lH0P.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2b44f9b374f0b170c853c326403af9a22e32e8276dab1dc7d437cca3b525ef6e
Instruction ID: c571e5b5a2ed8ac2c50cf9e8224c6653ce52e412573f7851940d272beb56d0f1
Opcode Fuzzy Hash: 2b44f9b374f0b170c853c326403af9a22e32e8276dab1dc7d437cca3b525ef6e
Instruction Fuzzy Hash: B9629034A003058FEB54DB68D554BADB7F2EF84314F188569E906DB398EB35ED86CB80

Function 068AC188 Relevance: .6, Instructions: 640COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2623821887.00000000068A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 068A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_68a0000_hCkkM0lH0P.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0686d9b751455d2f494cebbafe7e31b4cd53878655b2c74a6b574e9f567dc091
Instruction ID: 9b7a33c43b65b6de37a9a46fd2707b56ed73bf9aba4c334ba983a3e7a2e82673
Opcode Fuzzy Hash: 0686d9b751455d2f494cebbafe7e31b4cd53878655b2c74a6b574e9f567dc091
Instruction Fuzzy Hash: A7327034B002099FEB54DF68D990BADB7B6FB89314F108529E905EB399DB34EC45CB90

Function 068AB2A7 Relevance: .6, Instructions: 607COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2623821887.00000000068A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 068A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_68a0000_hCkkM0lH0P.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 97ada4efabb63b305cf828856374d0637ffc3506af3b30f01761fd17a165b8af
Instruction ID: 8a0b689e86ae8e605e0ad1fb1daa327c1b20ef2e835004c61688bcb1eaec31f4
Opcode Fuzzy Hash: 97ada4efabb63b305cf828856374d0637ffc3506af3b30f01761fd17a165b8af
Instruction Fuzzy Hash: 50229370E003099FEF64DB68D5807AEB7B2FB45310F24892AE955DB395DA34DC81CB91

Function 068AACD0 Relevance: 10.4, Strings: 8, Instructions: 398
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

$lq, xrefs: 068AAE73
$lq, xrefs: 068AAE9C
$lq, xrefs: 068AAE50
$lq, xrefs: 068AAE7F
$lq, xrefs: 068AAEA8
$lq, xrefs: 068AAE44
$lq, xrefs: 068AADF1
$lq, xrefs: 068AADFD

Memory Dump Source

Source File: 00000004.00000002.2623821887.00000000068A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 068A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_68a0000_hCkkM0lH0P.jbxd

Similarity

API ID:
String ID: $lq$$lq$$lq$$lq$$lq$$lq$$lq$$lq
API String ID: 0-2898588307
Opcode ID: 6707005ff4e08fe07063efde058d78f10524ea928a844b5769676d2a308fdada
Instruction ID: f0e24ac412e9fdff0e69b87d3c6f3fad4cc67d065a42b35b18b13b9cb485e514
Opcode Fuzzy Hash: 6707005ff4e08fe07063efde058d78f10524ea928a844b5769676d2a308fdada
Instruction Fuzzy Hash: 3BE16E30E1030A9FEB69DF64D5806AEB7B6FF85304F208529E905DB358DB75D846CB80

Function 0688360A Relevance: 6.1, APIs: 4, Instructions: 129
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentProcess.KERNEL32 ref: 0688368E
GetCurrentThread.KERNEL32 ref: 068836CB
GetCurrentProcess.KERNEL32 ref: 06883708
GetCurrentThreadId.KERNEL32 ref: 06883761

Memory Dump Source

Source File: 00000004.00000002.2623557392.0000000006880000.00000040.00000800.00020000.00000000.sdmp, Offset: 06880000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6880000_hCkkM0lH0P.jbxd

Similarity

API ID: Current$ProcessThread
String ID:
API String ID: 2063062207-0
Opcode ID: a8bd2dac3bca8ac6fb6caae2f3bc1cecb8153609a2bacac595c2c87daacc29d9
Instruction ID: cb92de525cdb81e2713c65985f2ed3692ca4681913f6f28f8d3023aed5538420
Opcode Fuzzy Hash: a8bd2dac3bca8ac6fb6caae2f3bc1cecb8153609a2bacac595c2c87daacc29d9
Instruction Fuzzy Hash: 955155B09002499FDB94DFA9D948BDEBBF1EF48304F288459E119B7360D734A948CF65

Function 06883610 Relevance: 6.1, APIs: 4, Instructions: 128
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentProcess.KERNEL32 ref: 0688368E
GetCurrentThread.KERNEL32 ref: 068836CB
GetCurrentProcess.KERNEL32 ref: 06883708
GetCurrentThreadId.KERNEL32 ref: 06883761

Memory Dump Source

Source File: 00000004.00000002.2623557392.0000000006880000.00000040.00000800.00020000.00000000.sdmp, Offset: 06880000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6880000_hCkkM0lH0P.jbxd

Similarity

API ID: Current$ProcessThread
String ID:
API String ID: 2063062207-0
Opcode ID: 93ee8cab436ff43b356cfaf1987afffd5e1c453b2a289b4c108ffbad30f77729
Instruction ID: 1577a6970e47c0d45e354b826ce32ab3d7030ccdaa8f619af8a4081e86eb3ac3
Opcode Fuzzy Hash: 93ee8cab436ff43b356cfaf1987afffd5e1c453b2a289b4c108ffbad30f77729
Instruction Fuzzy Hash: 735157B09002499FDB94DFA9D948B9EBBF1EF88304F28C059E119B7360D774A948CF65

Function 068A9158 Relevance: 5.2, Strings: 4, Instructions: 231
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

$lq, xrefs: 068A91C8
$lq, xrefs: 068A920F
$lq, xrefs: 068A9203
$lq, xrefs: 068A91D4

Memory Dump Source

Source File: 00000004.00000002.2623821887.00000000068A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 068A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_68a0000_hCkkM0lH0P.jbxd

Similarity

API ID:
String ID: $lq$$lq$$lq$$lq
API String ID: 0-195311763
Opcode ID: bd34c52105cf5ac21ba62e585252a4ac46c47a09fb41c3312e22e3d4ffa9f446
Instruction ID: 719d6d7ae5c7551fa7a2117ec447181a9938e6d2fcb67a9aead891747d4c35c8
Opcode Fuzzy Hash: bd34c52105cf5ac21ba62e585252a4ac46c47a09fb41c3312e22e3d4ffa9f446
Instruction Fuzzy Hash: E7915E30F1061A8FDF64DF64D9507AEB7F6EFC8200F108569D909EB358EA719D428B91

Function 068ACF48 Relevance: 4.5, Strings: 3, Instructions: 798
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

$lq, xrefs: 068AD33F
$lq, xrefs: 068AD353
$lq, xrefs: 068AD347

Memory Dump Source

Source File: 00000004.00000002.2623821887.00000000068A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 068A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_68a0000_hCkkM0lH0P.jbxd

Similarity

API ID:
String ID: $lq$$lq$$lq
API String ID: 0-2860745148
Opcode ID: 822c567d8121511896e5b0cb1588be8030b83b8e99bb2fcbdb9c161b891f8683
Instruction ID: af521dcf3f6b27f95c15bbef0470707cbb8377266ff511b66c3539c49e2d87f9
Opcode Fuzzy Hash: 822c567d8121511896e5b0cb1588be8030b83b8e99bb2fcbdb9c161b891f8683
Instruction Fuzzy Hash: 4B622F30A002068FDB55EF68D690A5EB7B2FF85304F208A68D505DB76DEB75ED46CB80

Function 068A4788 Relevance: 3.9, Strings: 3, Instructions: 186
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

XPqq, xrefs: 068A48B5
\Oqq, xrefs: 068A493F
fqq, xrefs: 068A4E95

Memory Dump Source

Source File: 00000004.00000002.2623821887.00000000068A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 068A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_68a0000_hCkkM0lH0P.jbxd

Similarity

API ID:
String ID: fqq$XPqq$\Oqq
API String ID: 0-3180005619
Opcode ID: f764c62230df0e8e6116d55a3e7fa92a11e0eb16dfdc0defd43e797f59808b8c
Instruction ID: c397340ad51ee6f982689d7ba9666bcf3b25e83a51e531ae89aa301a76ec44b8
Opcode Fuzzy Hash: f764c62230df0e8e6116d55a3e7fa92a11e0eb16dfdc0defd43e797f59808b8c
Instruction Fuzzy Hash: 41617471F002089FEF54DBA5C915BAEBAF6EF88300F208429E506EB395DFB54D459B90

Function 068AA3A8 Relevance: 2.7, Strings: 2, Instructions: 248
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

X!@, xrefs: 068AA42B
x!@, xrefs: 068AA44C

Memory Dump Source

Source File: 00000004.00000002.2623821887.00000000068A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 068A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_68a0000_hCkkM0lH0P.jbxd

Similarity

API ID:
String ID: X!@$x!@
API String ID: 0-2527372166
Opcode ID: a785ac8000a1b4a0ded9855e2cda783ebd74aaf430ea2b71d0b76f7ff5d590c9
Instruction ID: b5200fc8ead7884577837170bbd6279f4555285f83c07b3f4038667f4dd4fd3a
Opcode Fuzzy Hash: a785ac8000a1b4a0ded9855e2cda783ebd74aaf430ea2b71d0b76f7ff5d590c9
Instruction Fuzzy Hash: E281C331B002099FDF64DB68D9906ADB7B6FF88310F108429E906E7758DB35DD46CB80

Function 068A914B Relevance: 2.7, Strings: 2, Instructions: 172
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

$lq, xrefs: 068A91C8
$lq, xrefs: 068A9203

Memory Dump Source

Source File: 00000004.00000002.2623821887.00000000068A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 068A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_68a0000_hCkkM0lH0P.jbxd

Similarity

API ID:
String ID: $lq$$lq
API String ID: 0-4169330588
Opcode ID: 6deff2592bb98bb314d5b8eec92a05699eedd09a0be49fa1cd107b53ec0c73d8
Instruction ID: 81dc7b4a3732e7488fc42047b643bc100d7da7fa05b64b22253f1e764461157c
Opcode Fuzzy Hash: 6deff2592bb98bb314d5b8eec92a05699eedd09a0be49fa1cd107b53ec0c73d8
Instruction Fuzzy Hash: 50518230F102069FDF54DB78D99076EB7F6EBC8250F108569D909D7398EA71DD028B91

Function 0688BB38 Relevance: 1.7, APIs: 1, Instructions: 203COMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNELBASE(00000000), ref: 0688BD9E

Memory Dump Source

Source File: 00000004.00000002.2623557392.0000000006880000.00000040.00000800.00020000.00000000.sdmp, Offset: 06880000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6880000_hCkkM0lH0P.jbxd

Similarity

API ID: HandleModule
String ID:
API String ID: 4139908857-0
Opcode ID: 93698416ecbddf0666b233664fcb525a16e0cf44ce62cb21006e4f0d02581e6f
Instruction ID: 609115c0b6d2088d17aa38720bc2801e856542163e59f440ed20a9accb1450b7
Opcode Fuzzy Hash: 93698416ecbddf0666b233664fcb525a16e0cf44ce62cb21006e4f0d02581e6f
Instruction Fuzzy Hash: DD815670A00B059FDBA4EF29D44176ABBF1FF88304F00892EE54AD7A51DB35E845CB91

Function 0688DCE5 Relevance: 1.6, APIs: 1, Instructions: 139COMMON

Download Yara Rule

APIs

CreateWindowExW.USER32(?,?,?,?,?,?,0000000C,?,?,?,?,?), ref: 0688DE42

Memory Dump Source

Source File: 00000004.00000002.2623557392.0000000006880000.00000040.00000800.00020000.00000000.sdmp, Offset: 06880000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6880000_hCkkM0lH0P.jbxd

Similarity

API ID: CreateWindow
String ID:
API String ID: 716092398-0
Opcode ID: 76577bbeb84a1027938143aff37b12a97b473aa79141f5b98b7fb2420021f974
Instruction ID: 74eedc2212ca7ff32897579b4ddb41eb31492cbe1b98a78ae36223564759e531
Opcode Fuzzy Hash: 76577bbeb84a1027938143aff37b12a97b473aa79141f5b98b7fb2420021f974
Instruction Fuzzy Hash: A451E0B1D00249EFDF15DFA9C984ADEBFB6BF48300F15816AE918AB260D7719845CF90

Function 0688DD24 Relevance: 1.6, APIs: 1, Instructions: 119COMMON

Download Yara Rule

APIs

CreateWindowExW.USER32(?,?,?,?,?,?,0000000C,?,?,?,?,?), ref: 0688DE42

Memory Dump Source

Source File: 00000004.00000002.2623557392.0000000006880000.00000040.00000800.00020000.00000000.sdmp, Offset: 06880000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6880000_hCkkM0lH0P.jbxd

Similarity

API ID: CreateWindow
String ID:
API String ID: 716092398-0
Opcode ID: 42e4db9c5c52292427efef569c2638fa5485818368fb43a8840c22aaf26b317c
Instruction ID: a567b6921b74bda159b4959b519c80dbd2ac9915d8275cdfd5fd23cd580bac72
Opcode Fuzzy Hash: 42e4db9c5c52292427efef569c2638fa5485818368fb43a8840c22aaf26b317c
Instruction Fuzzy Hash: 6451DFB1D10349AFDB54DFA9C984ADEFBB5BF48310F24812AE819AB250D7719845CF90

Function 0688DD30 Relevance: 1.6, APIs: 1, Instructions: 113COMMON

Download Yara Rule

APIs

CreateWindowExW.USER32(?,?,?,?,?,?,0000000C,?,?,?,?,?), ref: 0688DE42

Memory Dump Source

Source File: 00000004.00000002.2623557392.0000000006880000.00000040.00000800.00020000.00000000.sdmp, Offset: 06880000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6880000_hCkkM0lH0P.jbxd

Similarity

API ID: CreateWindow
String ID:
API String ID: 716092398-0
Opcode ID: 38683a4cb623cd50bf200b91586f34a820876b2c36568c1dc1a6b401bbfc00d2
Instruction ID: 8dbd9d27f11cb581e7c299cc0f72cd7d1da11e720bba9649989a4201c7537f5f
Opcode Fuzzy Hash: 38683a4cb623cd50bf200b91586f34a820876b2c36568c1dc1a6b401bbfc00d2
Instruction Fuzzy Hash: 0041CEB1D10349DFDB54DFA9C984ADEFBB5BF88310F24812AE818AB250D775A845CF90

Function 011970AB Relevance: 1.6, APIs: 1, Instructions: 67COMMON

Download Yara Rule

APIs

CheckRemoteDebuggerPresent.KERNELBASE(?,?), ref: 01197127

Memory Dump Source

Source File: 00000004.00000002.2616633159.0000000001190000.00000040.00000800.00020000.00000000.sdmp, Offset: 01190000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1190000_hCkkM0lH0P.jbxd

Similarity

API ID: CheckDebuggerPresentRemote
String ID:
API String ID: 3662101638-0
Opcode ID: c6968b5cbf8fb8f3db2894015c5c38365b2d43ebab530567b4eea095ad742ab7
Instruction ID: 6e41baa0fb7c999520af1cee5ed2a50edbbeea3858c5a0a0dca8253f0db9b5b3
Opcode Fuzzy Hash: c6968b5cbf8fb8f3db2894015c5c38365b2d43ebab530567b4eea095ad742ab7
Instruction Fuzzy Hash: 5A2134B18002598FCB14CFAAD884BEEBBF4AF49310F14846AE459B7250C778A945CFA0

Function 06883850 Relevance: 1.6, APIs: 1, Instructions: 65COMMON

Download Yara Rule

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?), ref: 068838DF

Memory Dump Source

Source File: 00000004.00000002.2623557392.0000000006880000.00000040.00000800.00020000.00000000.sdmp, Offset: 06880000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6880000_hCkkM0lH0P.jbxd

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: c419acb657c31df5ee1f0d8e6b32e72d49a22b92d69231037b23e9bceba4bb53
Instruction ID: e4b302c43fc5e1f8b251929ae7abafc8ae9948d3ac2968e1245165bdd8e342f2
Opcode Fuzzy Hash: c419acb657c31df5ee1f0d8e6b32e72d49a22b92d69231037b23e9bceba4bb53
Instruction Fuzzy Hash: 6E21E5B5D002499FDB50DFA9D984ADEBBF4FF48310F14841AE954A3310D375A944CFA1

Function 06883858 Relevance: 1.6, APIs: 1, Instructions: 62COMMON

Download Yara Rule

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?), ref: 068838DF

Memory Dump Source

Source File: 00000004.00000002.2623557392.0000000006880000.00000040.00000800.00020000.00000000.sdmp, Offset: 06880000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6880000_hCkkM0lH0P.jbxd

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: f59bdb5f907b54d9be8cc765d176487a5cd51f86215d3e0834e9e942bf080528
Instruction ID: 20ba6c9f45ea66ba3231fecdc8e1f0c719ed2ab952803c501793e55ba918b0d9
Opcode Fuzzy Hash: f59bdb5f907b54d9be8cc765d176487a5cd51f86215d3e0834e9e942bf080528
Instruction Fuzzy Hash: B721C4B5D002499FDB50DFAAD984ADEBBF4FF48310F14841AE918A3350D375A944CFA5

Function 0119F2F7 Relevance: 1.6, APIs: 1, Instructions: 59COMMON

Download Yara Rule

APIs

GlobalMemoryStatusEx.KERNELBASE ref: 0119F377

Memory Dump Source

Source File: 00000004.00000002.2616633159.0000000001190000.00000040.00000800.00020000.00000000.sdmp, Offset: 01190000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1190000_hCkkM0lH0P.jbxd

Similarity

API ID: GlobalMemoryStatus
String ID:
API String ID: 1890195054-0
Opcode ID: e9a2c05caa452208f722e8c770535e197d1c009436619fd6ad4242aaab883a16
Instruction ID: 76eefbb8b1b2db65321d9f83d5df0c6b35703c1f364d5585f8acc34e02edf7d4
Opcode Fuzzy Hash: e9a2c05caa452208f722e8c770535e197d1c009436619fd6ad4242aaab883a16
Instruction Fuzzy Hash: DD2144B1C0025A9FCB14CFAAD544BDEFBF4AF08310F11856AD918B7250D378AA45CFA1

Function 0119F310 Relevance: 1.6, APIs: 1, Instructions: 52COMMON

Download Yara Rule

APIs

GlobalMemoryStatusEx.KERNELBASE ref: 0119F377

Memory Dump Source

Source File: 00000004.00000002.2616633159.0000000001190000.00000040.00000800.00020000.00000000.sdmp, Offset: 01190000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1190000_hCkkM0lH0P.jbxd

Similarity

API ID: GlobalMemoryStatus
String ID:
API String ID: 1890195054-0
Opcode ID: 48ecbf413c02acfd8b58207b5923ae234ae24b07ae97ae3e0a9590a281682adc
Instruction ID: 724808b4bce2f32d90649990767c7b29d2566bb0736985d695d12b3f24d428ef
Opcode Fuzzy Hash: 48ecbf413c02acfd8b58207b5923ae234ae24b07ae97ae3e0a9590a281682adc
Instruction Fuzzy Hash: 8E1120B1C0025A9BCB10DFAAC544BDEFBF4AF48320F11812AD818B7240D378AA44CFA1

Function 0688BD38 Relevance: 1.5, APIs: 1, Instructions: 47COMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNELBASE(00000000), ref: 0688BD9E

Memory Dump Source

Source File: 00000004.00000002.2623557392.0000000006880000.00000040.00000800.00020000.00000000.sdmp, Offset: 06880000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6880000_hCkkM0lH0P.jbxd

Similarity

API ID: HandleModule
String ID:
API String ID: 4139908857-0
Opcode ID: 1ef5e3d5cc73b8144688ce22f7df621891ee14147b9d32352100054b6100e4f1
Instruction ID: 332b03d0cca7fad9981d0596753d4448fb9fd50e9de81424f8cfc812281a8792
Opcode Fuzzy Hash: 1ef5e3d5cc73b8144688ce22f7df621891ee14147b9d32352100054b6100e4f1
Instruction Fuzzy Hash: 7F11E0B6C002499FCB60DF9AD944ADEFBF4EF88314F11841AD919B7210D379A545CFA1

Function 068A4778 Relevance: 1.4, Strings: 1, Instructions: 130COMMON

Download Yara Rule

Strings

XPqq, xrefs: 068A48B5

Memory Dump Source

Source File: 00000004.00000002.2623821887.00000000068A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 068A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_68a0000_hCkkM0lH0P.jbxd

Similarity

API ID:
String ID: XPqq
API String ID: 0-1382539260
Opcode ID: e9e291c89ad1b516de8276e2e5a772c5d9ceb2cb60a409371e236b9a4cf0ec33
Instruction ID: cbb7b05fdf74958433f064f1da70f7ee37bda221c6b9f8e4fadb32011b8eca8c
Opcode Fuzzy Hash: e9e291c89ad1b516de8276e2e5a772c5d9ceb2cb60a409371e236b9a4cf0ec33
Instruction Fuzzy Hash: D7418071F002089FEB54DFA5C914BAEBBF6EF89300F208529E505EB3A5DA748D018B90

Function 068ADABD Relevance: 1.4, Strings: 1, Instructions: 125COMMON

Download Yara Rule

Strings

PHlq, xrefs: 068ADC19

Memory Dump Source

Source File: 00000004.00000002.2623821887.00000000068A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 068A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_68a0000_hCkkM0lH0P.jbxd

Similarity

API ID:
String ID: PHlq
API String ID: 0-2055891399
Opcode ID: ba86def37c376ead799b4241c0e44b39f4287d644710fed2f8ea34067175669f
Instruction ID: 9b09a0adac855ac55124fe997c6e1bb160f7ef93239702ad760a8d44890baf6f
Opcode Fuzzy Hash: ba86def37c376ead799b4241c0e44b39f4287d644710fed2f8ea34067175669f
Instruction Fuzzy Hash: C6418E70E0030ADFEB55DF65C94569EBBB2FF85300F20452AE902EB654EB74D942CB81

Function 068A21D8 Relevance: 1.4, Strings: 1, Instructions: 105COMMON

Download Yara Rule

Strings

PHlq, xrefs: 068A2313

Memory Dump Source

Source File: 00000004.00000002.2623821887.00000000068A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 068A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_68a0000_hCkkM0lH0P.jbxd

Similarity

API ID:
String ID: PHlq
API String ID: 0-2055891399
Opcode ID: 3c9bab1341456e74d4a9b6105fe304ccc9eabdde725d48e1a0a48e327d71c3f0
Instruction ID: 1b50371418baa7fde3565278ffe21934eefd8bdc280f81744c168608f2fb385a
Opcode Fuzzy Hash: 3c9bab1341456e74d4a9b6105fe304ccc9eabdde725d48e1a0a48e327d71c3f0
Instruction Fuzzy Hash: E531F230B002058FDB65AF74DA2566F77E3AF89300F244568E806DB399DE35DD02C790

Function 068A21CB Relevance: 1.4, Strings: 1, Instructions: 103COMMON

Download Yara Rule

Strings

PHlq, xrefs: 068A2313

Memory Dump Source

Source File: 00000004.00000002.2623821887.00000000068A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 068A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_68a0000_hCkkM0lH0P.jbxd

Similarity

API ID:
String ID: PHlq
API String ID: 0-2055891399
Opcode ID: 316d6aeb761b6a8135deddcb65002458927e691442590573e7cd3919636564b1
Instruction ID: e69c57dcde24a89bf280daa53fa682456efdf40dbc79df793d4687bc2a0a3126
Opcode Fuzzy Hash: 316d6aeb761b6a8135deddcb65002458927e691442590573e7cd3919636564b1
Instruction Fuzzy Hash: 1C31E330B002018FEB65AF34DA6566F7BE3AF89300F184968E806DB399DE35DD02C784

Function 068AFED3 Relevance: 1.3, Strings: 1, Instructions: 65COMMON

Download Yara Rule

Strings

|, xrefs: 068AFF40

Memory Dump Source

Source File: 00000004.00000002.2623821887.00000000068A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 068A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_68a0000_hCkkM0lH0P.jbxd

Similarity

API ID:
String ID: |
API String ID: 0-2343686810
Opcode ID: 089195180f49d1ad5dc113e0aa76f2195edd7d5322857294f476a13869c40a75
Instruction ID: 99ff6faac7744a270d1f59bf349d675d62dc6f908fab66f391734d835a3be24e
Opcode Fuzzy Hash: 089195180f49d1ad5dc113e0aa76f2195edd7d5322857294f476a13869c40a75
Instruction Fuzzy Hash: 5C219D71B043518FDB559F788814B6D7BF1AF4D614F0548AEE54ADB3A1DB349D00CB81

Function 068AFEF0 Relevance: 1.3, Strings: 1, Instructions: 59COMMON

Download Yara Rule

Strings

|, xrefs: 068AFF40

Memory Dump Source

Source File: 00000004.00000002.2623821887.00000000068A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 068A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_68a0000_hCkkM0lH0P.jbxd

Similarity

API ID:
String ID: |
API String ID: 0-2343686810
Opcode ID: df11f7d304e15ea69c5115d8ca7830698807cce0bf8e43d405703c91f9f893db
Instruction ID: e90a0a420da715012887cba7bd00ce3763e9ea64d56d35838efc25c4a34af2be
Opcode Fuzzy Hash: df11f7d304e15ea69c5115d8ca7830698807cce0bf8e43d405703c91f9f893db
Instruction Fuzzy Hash: AE115B71B002149FDB54DF78C804B6E7BF5AF4CA10F108869EA1AEB3A0DB759900CB80

Function 068A82D8 Relevance: 1.3, Strings: 1, Instructions: 40COMMON

Download Yara Rule

Strings

$lq, xrefs: 068A8323

Memory Dump Source

Source File: 00000004.00000002.2623821887.00000000068A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 068A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_68a0000_hCkkM0lH0P.jbxd

Similarity

API ID:
String ID: $lq
API String ID: 0-4199647819
Opcode ID: c72f7affaebe296ce52a5b9aa4c35aa8ec85e3b93a428fdbd795b1dd18f5970d
Instruction ID: e7200f659386a20e44f80bd33cb46d247caec7140e352127924f9f1097feeb4d
Opcode Fuzzy Hash: c72f7affaebe296ce52a5b9aa4c35aa8ec85e3b93a428fdbd795b1dd18f5970d
Instruction Fuzzy Hash: 82F0FFB1B00308CFEF649E58EA8126CB7A6EB01218F14442ADE81C7248D772DD06CBA1

Function 068A4671 Relevance: 1.3, Strings: 1, Instructions: 25COMMON

Download Yara Rule

Strings

\Oqq, xrefs: 068A467D

Memory Dump Source

Source File: 00000004.00000002.2623821887.00000000068A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 068A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_68a0000_hCkkM0lH0P.jbxd

Similarity

API ID:
String ID: \Oqq
API String ID: 0-3397364966
Opcode ID: 150ccb1d23245545f0a6866f133132c6acbb2daf95424c003ec86a7ea1c084c0
Instruction ID: bca6e27f325173ad0e9f4286c47ed001cadb274c7a22c971ac85a4f703257829
Opcode Fuzzy Hash: 150ccb1d23245545f0a6866f133132c6acbb2daf95424c003ec86a7ea1c084c0
Instruction Fuzzy Hash: 3AF05E30A10219DFEF54DF90E859BAEBBB2FF44700F204119E502A7390CBB40C46CB80

Function 068A2B0B Relevance: .4, Instructions: 441COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2623821887.00000000068A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 068A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_68a0000_hCkkM0lH0P.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b082b67b22eb2b75ec8248fac9314e3a54b09cc439c743b2fe185443372c2a0c
Instruction ID: 8e3bfc4cac10efb6222f3f579249e9df32c2e40e888c42ffd97155e528c15d2f
Opcode Fuzzy Hash: b082b67b22eb2b75ec8248fac9314e3a54b09cc439c743b2fe185443372c2a0c
Instruction Fuzzy Hash: 9D027530A003048FEB64DF64C594A5DB7F2EB44314F58C5A9E91AEB265DB35ED86CF80

Function 068A5DF0 Relevance: .2, Instructions: 229COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2623821887.00000000068A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 068A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_68a0000_hCkkM0lH0P.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dc6dbb4d9a6be2a7e3040381137f402a157694300b4974dc2554082a71d25844
Instruction ID: 588f43531661bcbeef9c21d6290d6de06150f1b892f6d4117dfffaf502b4827f
Opcode Fuzzy Hash: dc6dbb4d9a6be2a7e3040381137f402a157694300b4974dc2554082a71d25844
Instruction Fuzzy Hash: 0461A171F002118BDF549A7EC88066EFADBAFC4620B254439E90ADB378DE65DD4287D1

Function 068A3EC1 Relevance: .2, Instructions: 224COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2623821887.00000000068A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 068A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_68a0000_hCkkM0lH0P.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7a93a670f9208a038995935379e31917829f7027ceee8c150d6c36d60e86274f
Instruction ID: da4c793f002bebcd6ec2fe62af372961a9c9b47f90df23ff0c3e67a2cf844c34
Opcode Fuzzy Hash: 7a93a670f9208a038995935379e31917829f7027ceee8c150d6c36d60e86274f
Instruction Fuzzy Hash: 3A815D30B107099FDF54DFA8C55476EB7F6AF89300F248529E90AEB358EA74DC428B91

Function 068A41DC Relevance: .2, Instructions: 222COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2623821887.00000000068A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 068A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_68a0000_hCkkM0lH0P.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a3e650b6b68ed3d1de3f48fb17eac2e046bd021128f227d129664a39cc624c03
Instruction ID: 6b3eab52887ad316cba12a293ef51f5331bf069b3afd0a3e449f516f6d0308e0
Opcode Fuzzy Hash: a3e650b6b68ed3d1de3f48fb17eac2e046bd021128f227d129664a39cc624c03
Instruction Fuzzy Hash: 37A14E74E1031A8BDF60DF68C840B9DB7B1FF89310F208699D549EB255DB70AA85CF90

Function 068A41F0 Relevance: .2, Instructions: 210COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2623821887.00000000068A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 068A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_68a0000_hCkkM0lH0P.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 52b024adb7764546f8e09d413578bbcc9a6e15fcce1a97bbe607ed0b48f1584b
Instruction ID: e89ce3c68fee33d834092831f41a9e6a6b7dae3e50f8c9ddada98a1aabe3afc2
Opcode Fuzzy Hash: 52b024adb7764546f8e09d413578bbcc9a6e15fcce1a97bbe607ed0b48f1584b
Instruction Fuzzy Hash: 6F912C74E1061A8BEF64DF68C840B9DB7B1FF89300F208599D549EB255DB70AA858F90

Function 068AEB08 Relevance: .2, Instructions: 205COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2623821887.00000000068A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 068A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_68a0000_hCkkM0lH0P.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fffe8f59ccbf159ff3973a7789ae3857ec5ba08428d6e93f76e37a9a958af6fe
Instruction ID: d9415ec341d443c92042ba27260158c5957a6fee8aa827f304c05b935861eb95
Opcode Fuzzy Hash: fffe8f59ccbf159ff3973a7789ae3857ec5ba08428d6e93f76e37a9a958af6fe
Instruction Fuzzy Hash: 74713D70A002099FDB54DFA9D984AAEBBF6FF84304F148929E415EB359DB30ED46CB50

Function 068AEB18 Relevance: .2, Instructions: 201COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2623821887.00000000068A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 068A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_68a0000_hCkkM0lH0P.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fb0c5527de2661ae68e7a025df098f2e4bede30848aaed2c3b3e96aa402308e2
Instruction ID: 68c380278aacb031faf61ef298626e6ebd98f833f915e668bc40d08dfa3883d7
Opcode Fuzzy Hash: fb0c5527de2661ae68e7a025df098f2e4bede30848aaed2c3b3e96aa402308e2
Instruction Fuzzy Hash: C6713E70A002099FDB54DFA9D984A9EBBF6FF84304F148929E415EB359DB30ED46CB50

Function 068AFC80 Relevance: .2, Instructions: 178COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2623821887.00000000068A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 068A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_68a0000_hCkkM0lH0P.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8c41d39c8515f9fcb8451ca6d41cdd6ec79732d41bce54d6950ee22a4306bc7d
Instruction ID: c5f9ccea279954455c2c01a4f42c15767fd8159c0a06edd0d6f0d816e3319964
Opcode Fuzzy Hash: 8c41d39c8515f9fcb8451ca6d41cdd6ec79732d41bce54d6950ee22a4306bc7d
Instruction Fuzzy Hash: 1951D131E00205DFEF65EBB8E8446ADB7B2FF84315F108829EB16DB250DB358956CB90

Function 068AF62B Relevance: .2, Instructions: 170COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2623821887.00000000068A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 068A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_68a0000_hCkkM0lH0P.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2009cf912340e6f1c785e4b2f6150830ff3a8aa04a651a094464bf100389eff4
Instruction ID: 7a154fe6a09337caf7c8d6ea35135951b421d9f69cd0e85bd099bb6b42bcb191
Opcode Fuzzy Hash: 2009cf912340e6f1c785e4b2f6150830ff3a8aa04a651a094464bf100389eff4
Instruction Fuzzy Hash: DA51E730F103159BFFA4666CD99076F36AAD789310F204829E70AC73ADDA39CC4587A2

Function 068AF638 Relevance: .2, Instructions: 163COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2623821887.00000000068A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 068A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_68a0000_hCkkM0lH0P.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 03abe65418412366492defb601e1b3648e9adff9937a3b3f90ce3247bb17ec2d
Instruction ID: 608391124881fc1b18a604c73423bf45aae4319c08ff2e5dd8f44e967a77b285
Opcode Fuzzy Hash: 03abe65418412366492defb601e1b3648e9adff9937a3b3f90ce3247bb17ec2d
Instruction Fuzzy Hash: 9851E730F103159BFFA466ACD95476F366AD789310F204829E70AC73ACDA79CC4187A2

Function 068AD970 Relevance: .1, Instructions: 98COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2623821887.00000000068A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 068A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_68a0000_hCkkM0lH0P.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2ca9dcdbc1f43b23fffcbff4d96ddf4f9b894803f8f18539dcc848b782b606e0
Instruction ID: 6d0dd814b6d8b82fbd667f7e88607825c749458ff085445082b03ce7a8847be7
Opcode Fuzzy Hash: 2ca9dcdbc1f43b23fffcbff4d96ddf4f9b894803f8f18539dcc848b782b606e0
Instruction Fuzzy Hash: B731B230E1070A8FDF65DF68D98069EB7B6FF85314F108A29E905EB654EB70E946CB40

Function 068A2098 Relevance: .1, Instructions: 91COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2623821887.00000000068A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 068A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_68a0000_hCkkM0lH0P.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1c214b9e730225a6ed7b0f8b2d838fdfe3b7c206d6f0c2ea6efd6a335dcd354e
Instruction ID: bb8d0b32018350936f4e2cf4e456b92c78c00e48373ff9a4aaf7f4513efe4690
Opcode Fuzzy Hash: 1c214b9e730225a6ed7b0f8b2d838fdfe3b7c206d6f0c2ea6efd6a335dcd354e
Instruction Fuzzy Hash: 88318234E006099BDB54DF64C8646AEB7B6FF89300F14C929E906EB354DB71ED46CB40

Function 068A2093 Relevance: .1, Instructions: 91COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2623821887.00000000068A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 068A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_68a0000_hCkkM0lH0P.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c2bb1acd6ff301112df7616df63d2bde564994a23def42ad7c8b9b7d4f803d28
Instruction ID: 3fc9aaf178086e373f23d046c496b8ec232becb02ef50eff16da21d8a35d297f
Opcode Fuzzy Hash: c2bb1acd6ff301112df7616df63d2bde564994a23def42ad7c8b9b7d4f803d28
Instruction Fuzzy Hash: 3D318234E006059FDB58DF64C9646AEB7B6BF89300F14C929E906EB354DB31ED46CB40

Function 068A3AC8 Relevance: .1, Instructions: 80COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2623821887.00000000068A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 068A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_68a0000_hCkkM0lH0P.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b40af628033ac63d66271295daf905c4104949ca8171138cf6d8436cb8a6999a
Instruction ID: 60938d0fd420b596139c7461090a83630e44f643ec66c2ce3320a53421b89c39
Opcode Fuzzy Hash: b40af628033ac63d66271295daf905c4104949ca8171138cf6d8436cb8a6999a
Instruction Fuzzy Hash: 08219F76F007199FEB50DF68D981AADBBF6AB48310F10852AE945E7394E730D9428B90

Function 068A3AD8 Relevance: .1, Instructions: 78COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2623821887.00000000068A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 068A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_68a0000_hCkkM0lH0P.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 22e91ce7cb6df589d0bdd387e9fbda279e7a8890debb1dc679f874c77f35e874
Instruction ID: 0e84a102f23f4104e80088de40979a8ea92e8360f83dc6108dcbfb88ed9dc3de
Opcode Fuzzy Hash: 22e91ce7cb6df589d0bdd387e9fbda279e7a8890debb1dc679f874c77f35e874
Instruction Fuzzy Hash: 42215C76F007199FEB50DF69D981AAEB7F6EB48610F10852AEA05E7394E770D801CB90

Function 00FBD01C Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2616341518.0000000000FBD000.00000040.00000800.00020000.00000000.sdmp, Offset: 00FBD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_fbd000_hCkkM0lH0P.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a12d0fed6d7c2b84a48be44b845a76381620d27b8a9835641e759e115aa0c7c9
Instruction ID: 52323b7e3407ca60fb655b7e4b197c95ea021a07aa63878cd0116430d4030b97
Opcode Fuzzy Hash: a12d0fed6d7c2b84a48be44b845a76381620d27b8a9835641e759e115aa0c7c9
Instruction Fuzzy Hash: 0F213775604200DFCB14EF14D9C0B56BF65FB88364F20C56DE80A0B25AD33AD807DE62

Function 068A6D20 Relevance: .1, Instructions: 68COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2623821887.00000000068A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 068A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_68a0000_hCkkM0lH0P.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 33950a92375b573db7723723b13c22080127f4144499d4901891de06bec64f62
Instruction ID: f2381348e41da31f78ad731562a663ee7540900a78a3d14500c2e3aeabdec5ba
Opcode Fuzzy Hash: 33950a92375b573db7723723b13c22080127f4144499d4901891de06bec64f62
Instruction Fuzzy Hash: 7C21D231F102099FEF54DA69E9507AEB7B6EB84350F288425E905EB348E732ED41CB80

Function 00FBD005 Relevance: .1, Instructions: 62COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2616341518.0000000000FBD000.00000040.00000800.00020000.00000000.sdmp, Offset: 00FBD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_fbd000_hCkkM0lH0P.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 47cd0ab695c866cfa8ae94e08baee01ecc7469abfe872507b1775bf613b13216
Instruction ID: 5036632721e70b1949e034ae9952a7d5e5b8043941f98951d32011277bf5f2af
Opcode Fuzzy Hash: 47cd0ab695c866cfa8ae94e08baee01ecc7469abfe872507b1775bf613b13216
Instruction Fuzzy Hash: 87219F755093C08FCB02DF24D994715BF71EB46324F29C5EAD8498F6A7C33A980ADB62

Function 068A3BE8 Relevance: .1, Instructions: 59COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2623821887.00000000068A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 068A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_68a0000_hCkkM0lH0P.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7c4edc98200fc96f434956937368880706b2d3a8567bf40d8a59c74ea7e4635e
Instruction ID: 3cd111bb5ee9c0809a5ec5b8054bc51eaa526a4bcf4e4726ad6fb7bd0e8cd947
Opcode Fuzzy Hash: 7c4edc98200fc96f434956937368880706b2d3a8567bf40d8a59c74ea7e4635e
Instruction Fuzzy Hash: AC11A132B106298FDF54D678CD146AE73AAABC8310B014539C906E7358EE34DC028BD1

Function 068A3E1F Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2623821887.00000000068A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 068A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_68a0000_hCkkM0lH0P.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5933e7f9e33914d5d0fcb404e8a1ad9449c1fc303903049a4be45b5632ef606b
Instruction ID: d21afee5379c3fff582c4cea138bb0120704c36d567a298366326ac95382710d
Opcode Fuzzy Hash: 5933e7f9e33914d5d0fcb404e8a1ad9449c1fc303903049a4be45b5632ef606b
Instruction Fuzzy Hash: 7201BC31B002110BEB64967C9854B1FB7EAEBCA724F14C43AEA0ACB745EE25DC024391

Function 068A38A0 Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2623821887.00000000068A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 068A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_68a0000_hCkkM0lH0P.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ae46eb509ba6d72c4305cc9a039ca54ba14484ec81bb9efa4ee107e364149ce5
Instruction ID: 32286876f74039fe6b87ed7091ccbf952322c34f40155917d13d2af7a44aec97
Opcode Fuzzy Hash: ae46eb509ba6d72c4305cc9a039ca54ba14484ec81bb9efa4ee107e364149ce5
Instruction Fuzzy Hash: 7D21FFB1D01299AFCB50CFAAD984BDEFFB4FB49310F10816AE918B7240D3756944CBA5

Function 068AA308 Relevance: .1, Instructions: 52COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2623821887.00000000068A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 068A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_68a0000_hCkkM0lH0P.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fad26df26176a8bec9e469328b032ef9075f61a0b852de64bd7f3883941aee62
Instruction ID: 027416aba6b100e79a02a71e8880006666fecdba083b5acf7fdabf8cb72ee5d1
Opcode Fuzzy Hash: fad26df26176a8bec9e469328b032ef9075f61a0b852de64bd7f3883941aee62
Instruction Fuzzy Hash: 5C01F735B103104FD765DA38E85072EB7EAEB86714F10C43EE58ACB399EA25CC02C780

Function 068A38A8 Relevance: .1, Instructions: 52COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2623821887.00000000068A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 068A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_68a0000_hCkkM0lH0P.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6cce494eee58ecc73b1d71818eb50a7aa98e16bdd0f5b515c758ba7b6a7df15d
Instruction ID: f4c45e5eaf12b91985a286e6dd7addcd9e3af4237eaf9876e8ec6c4b55a25e95
Opcode Fuzzy Hash: 6cce494eee58ecc73b1d71818eb50a7aa98e16bdd0f5b515c758ba7b6a7df15d
Instruction Fuzzy Hash: 8E11D0B5D01259AFCB00DF9AD984ADEFBB4FB49310F10812AE918B7300D375A944CFA5

Function 068AED88 Relevance: .1, Instructions: 52COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2623821887.00000000068A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 068A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_68a0000_hCkkM0lH0P.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 03cf01a380c70b291da9e6d3f921c6c2f06875860191ed3ae196b5d61886d755
Instruction ID: 60e87dae4ebc93cbbd665182ec537b2fae77ed7379c71f868cd2d93adb69e888
Opcode Fuzzy Hash: 03cf01a380c70b291da9e6d3f921c6c2f06875860191ed3ae196b5d61886d755
Instruction Fuzzy Hash: A001A735B001118FDBA5DA7CD45872E73E6EBC5714F14C83EE64ACB345EA25DC028781

Function 068A3E30 Relevance: .1, Instructions: 51COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2623821887.00000000068A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 068A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_68a0000_hCkkM0lH0P.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 152698b8389eee7911338be858e51dcc5609368ac5c222d4db0aed4eb7997d88
Instruction ID: 34ecef07f81c6267c10c5d9c44c6d9b50513cafb71d056448ffdac1196381690
Opcode Fuzzy Hash: 152698b8389eee7911338be858e51dcc5609368ac5c222d4db0aed4eb7997d88
Instruction Fuzzy Hash: 9501AF35B005110BEB64967D9850B2FB3DFDBC9724F20C43AEA0ACB799EE65DC024791

Function 068A3BD8 Relevance: .0, Instructions: 50COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2623821887.00000000068A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 068A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_68a0000_hCkkM0lH0P.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0a3d1fcfaa77d22a7685c9aa173a99a7bdf525016450af66438897afa9a06908
Instruction ID: a9ce686bb4b9247def0326428741ad75f5213188ccbfac22d147d2971a073c9b
Opcode Fuzzy Hash: 0a3d1fcfaa77d22a7685c9aa173a99a7bdf525016450af66438897afa9a06908
Instruction Fuzzy Hash: 8301D432F105254BDFA496388D142EE76AA9BC9320F11073AD556D73D8EF24CD024791

Function 068AED98 Relevance: .0, Instructions: 49COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2623821887.00000000068A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 068A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_68a0000_hCkkM0lH0P.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9997279e0ff65b50c45a4000bd329839a5e4a747c166508c06d1214f4aacca20
Instruction ID: 7df34f7dda125c5de5f059ee9b646d1cff4dd4a179aeb2f3c35c3ec1fc54d7c2
Opcode Fuzzy Hash: 9997279e0ff65b50c45a4000bd329839a5e4a747c166508c06d1214f4aacca20
Instruction Fuzzy Hash: 7501AF35B001144BEBA4957C985872FB3DADBC9724F14C839F60ACB344EE25DC029381

Function 068A6440 Relevance: .0, Instructions: 48COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2623821887.00000000068A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 068A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_68a0000_hCkkM0lH0P.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6de77c77dcaa520ee076881eaddac2ac29cef6b30c6c8951f5f35b42c3a427f3
Instruction ID: e619b374adcd96608aca8c5d914694d6e90d67df3e9fc941478bc2f7ff3976fb
Opcode Fuzzy Hash: 6de77c77dcaa520ee076881eaddac2ac29cef6b30c6c8951f5f35b42c3a427f3
Instruction Fuzzy Hash: 2B01717181E3D55FEB528A7899603897F748F43214F1905DBC484CB0D7F1658985C3A6

Function 068AA318 Relevance: .0, Instructions: 46COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2623821887.00000000068A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 068A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_68a0000_hCkkM0lH0P.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ceb042160873bd1fbd326479b035a3c59463669f9f5f80e4db391a94c8235f40
Instruction ID: ffbac315312c9bb87e7f98d673a758fdd40a9c75f5de5f09e03dc690252c09bf
Opcode Fuzzy Hash: ceb042160873bd1fbd326479b035a3c59463669f9f5f80e4db391a94c8235f40
Instruction Fuzzy Hash: F4014435B106145BDB64E678E85472FB3EAFB89714F10C439E54AD775CEA25DC028780

Function 068AC7E0 Relevance: .0, Instructions: 43COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2623821887.00000000068A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 068A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_68a0000_hCkkM0lH0P.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d718a20cd0ec992ab924116ef49547def293a389907f62b0a2fc5e14970b664f
Instruction ID: d6f51cb2fc0581d21778000f96516dba5b0db32272d48664ed9ec817eff94ef8
Opcode Fuzzy Hash: d718a20cd0ec992ab924116ef49547def293a389907f62b0a2fc5e14970b664f
Instruction Fuzzy Hash: B301A431F102289BDF54AA69F94169EB769FB86318F144539EA15EB344EB72AC048BC0

Non-executed Functions

Function 068A76A8 Relevance: 13.0, Strings: 10, Instructions: 468COMMON

Download Yara Rule

Strings

$lq, xrefs: 068A7C16
$lq, xrefs: 068A7C00
$lq, xrefs: 068A77C9
$lq, xrefs: 068A77D5
$lq, xrefs: 068A7B55
$lq, xrefs: 068A77A4
$lq, xrefs: 068A7C0A
$lq, xrefs: 068A7B61
$lq, xrefs: 068A7BF4
$lq, xrefs: 068A7798

Memory Dump Source

Source File: 00000004.00000002.2623821887.00000000068A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 068A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_68a0000_hCkkM0lH0P.jbxd

Similarity

API ID:
String ID: $lq$$lq$$lq$$lq$$lq$$lq$$lq$$lq$$lq$$lq
API String ID: 0-3106076279
Opcode ID: 9db5116997f19e2228bd354522d0b1d23eaafe5528acf9ef2c5e6b515651d7fc
Instruction ID: 64928f55f40ec337a8d7e6efa5dd1ef8f71a2daf8a91a8effbf3f0eee7391f62
Opcode Fuzzy Hash: 9db5116997f19e2228bd354522d0b1d23eaafe5528acf9ef2c5e6b515651d7fc
Instruction Fuzzy Hash: BE122C34A002199FEB64DF65C954AAEB7B2FF88304F208569D506EB368DB35DD85CF80

Function 068AA938 Relevance: 10.2, Strings: 8, Instructions: 229COMMON

Download Yara Rule

Strings

$lq, xrefs: 068AAAEA
$lq, xrefs: 068AAA2E
$lq, xrefs: 068AAA95
$lq, xrefs: 068AAAC0
$lq, xrefs: 068AAAF6
$lq, xrefs: 068AAAB4
$lq, xrefs: 068AAA89
$lq, xrefs: 068AAA3A

Memory Dump Source

Source File: 00000004.00000002.2623821887.00000000068A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 068A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_68a0000_hCkkM0lH0P.jbxd

Similarity

API ID:
String ID: $lq$$lq$$lq$$lq$$lq$$lq$$lq$$lq
API String ID: 0-2898588307
Opcode ID: d8e7b7a9135408b70561d75ad89c765d5c68b8e290f0508db324075ea5415d1e
Instruction ID: 1130054d030304db4cd5bd97c8041d354881dddd66fa97877210d88b4489da62
Opcode Fuzzy Hash: d8e7b7a9135408b70561d75ad89c765d5c68b8e290f0508db324075ea5415d1e
Instruction Fuzzy Hash: 72916A30A0030A9FFB68DF64DA55B6EB7B7AF44304F148529E801E7798DB75AC46CB90

Function 068A70A8 Relevance: 7.9, Strings: 6, Instructions: 405COMMON

Download Yara Rule

Strings

$lq, xrefs: 068A75BC
$lq, xrefs: 068A73E4
$lq, xrefs: 068A73F0
$lq, xrefs: 068A7544
$lq, xrefs: 068A75B0
$lq, xrefs: 068A738A

Memory Dump Source

Source File: 00000004.00000002.2623821887.00000000068A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 068A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_68a0000_hCkkM0lH0P.jbxd

Similarity

API ID:
String ID: $lq$$lq$$lq$$lq$$lq$$lq
API String ID: 0-1854859054
Opcode ID: ef45a3212ea5980334af597c49ae4e9ca3108a58181d662039da887f531c7e0e
Instruction ID: c322aad6c4230a9d03372c55eb27a2876947acd495472309b84676e07c8dd49d
Opcode Fuzzy Hash: ef45a3212ea5980334af597c49ae4e9ca3108a58181d662039da887f531c7e0e
Instruction Fuzzy Hash: 4AF15D74B01209DFDB58EF64D550A5EB7B7BF88304F248468E8159B3A8DB35EC42DB81

Function 068ABA08 Relevance: 7.7, Strings: 6, Instructions: 197COMMON

Download Yara Rule

Strings

$lq, xrefs: 068ABBD5
$lq, xrefs: 068ABBAD
$lq, xrefs: 068ABBE1
$lq, xrefs: 068ABC09
$lq, xrefs: 068ABBA1
$lq, xrefs: 068ABC15

Memory Dump Source

Source File: 00000004.00000002.2623821887.00000000068A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 068A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_68a0000_hCkkM0lH0P.jbxd

Similarity

API ID:
String ID: $lq$$lq$$lq$$lq$$lq$$lq
API String ID: 0-1854859054
Opcode ID: 953463d1af41ad3eda18326dc762c40812502e67621e40550b1a69babdc90882
Instruction ID: f8705466ef854de48abff3ea0f9fa0b92e97002aa99db488368841ccb41fb139
Opcode Fuzzy Hash: 953463d1af41ad3eda18326dc762c40812502e67621e40550b1a69babdc90882
Instruction Fuzzy Hash: 5B718170E003098FEB64DFA8D580A6EB7B6FF85314F108529D906EB259DB71ED46CB81

Function 068A83E0 Relevance: 5.3, Strings: 4, Instructions: 282COMMON

Download Yara Rule

Strings

$lq, xrefs: 068A86AB
$lq, xrefs: 068A869F
$lq, xrefs: 068A8646
$lq, xrefs: 068A863A

Memory Dump Source

Source File: 00000004.00000002.2623821887.00000000068A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 068A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_68a0000_hCkkM0lH0P.jbxd

Similarity

API ID:
String ID: $lq$$lq$$lq$$lq
API String ID: 0-195311763
Opcode ID: a963bbc4f46e31de073b9ff3db9e3e34dfc45cb09f44dcb84036c47a05a4ad99
Instruction ID: 777a0216b5dc40e39a211f5b6a7f835b946a5a08724bbb05b66b702e052db48f
Opcode Fuzzy Hash: a963bbc4f46e31de073b9ff3db9e3e34dfc45cb09f44dcb84036c47a05a4ad99
Instruction Fuzzy Hash: 95B14C70F112098FEB68EF64C99469EB7B6BF84304F248429D906DB358DB75DC86CB90

Function 068AACC3 Relevance: 5.2, Strings: 4, Instructions: 174COMMON

Download Yara Rule

Strings

$lq, xrefs: 068AAE73
$lq, xrefs: 068AAE9C
$lq, xrefs: 068AAE44
$lq, xrefs: 068AADF1

Memory Dump Source

Source File: 00000004.00000002.2623821887.00000000068A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 068A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_68a0000_hCkkM0lH0P.jbxd

Similarity

API ID:
String ID: $lq$$lq$$lq$$lq
API String ID: 0-195311763
Opcode ID: 5db85dc7b75240c77fe383ae0a4a9257e732b52d014838a9b56714325e4a051b
Instruction ID: 2a8c8e7454c103a1ba2c8b8f8427b254486d286fd9b723916ff384ceae54647d
Opcode Fuzzy Hash: 5db85dc7b75240c77fe383ae0a4a9257e732b52d014838a9b56714325e4a051b
Instruction Fuzzy Hash: C9519C30E103059FEFA9DB64E5806AEB7B6EB88305F24852AED06D7754DB35EC41CB90

Function 068A87F8 Relevance: 5.2, Strings: 4, Instructions: 168COMMON

Download Yara Rule

Strings

LRlq, xrefs: 068A88EB
LRlq, xrefs: 068A893A
$lq, xrefs: 068A8883
$lq, xrefs: 068A8877

Memory Dump Source

Source File: 00000004.00000002.2623821887.00000000068A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 068A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_68a0000_hCkkM0lH0P.jbxd

Similarity

API ID:
String ID: LRlq$LRlq$$lq$$lq
API String ID: 0-833119577
Opcode ID: ba3c32a233f39714afd0c455931fe79a5cea3105fe5b31fc3a12a4a62cb82afc
Instruction ID: a5c4a4930fe07f5f13b9e312bf288cf73e93f6daf4426812be25dbc1890ef21d
Opcode Fuzzy Hash: ba3c32a233f39714afd0c455931fe79a5cea3105fe5b31fc3a12a4a62cb82afc
Instruction Fuzzy Hash: 0C51D370B002059FEB58EB28D941A6EB7F6FF85304F148568E915DB3A9DB31EC00CBA1

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is an administration feature that provides a uniform environment to access Windows system components. The WMI service enables both local and remote access, though the latter is facilitated by Remote Services such as Distributed Component Object Model (DCOM) and Windows Remote Management (WinRM).Remote WMI over DCOM operates using port 135, whereas WMI over WinRM operates over port 5985 when using HTTP and 5986 for HTTPS.
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Connection Creation, Process: Process Creation, WMI: WMI Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify file time attributes to hide new or changes to existing files. Timestomping is a technique that modifies the timestamps of a file (the modify, access, create, and change times), often to mimic files that are in the same folder. This is done, for example, on files that have been modified or created by the adversary so that they do not appear conspicuous to forensic investigators or file analysis tools.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata, File: File Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search the Registry on compromised systems for insecurely stored credentials. The Windows Registry stores configuration information that can be used by the system or other programs. Adversaries may query the Registry looking for credentials and passwords that have been stored for use by other programs or services. Sometimes these credentials are used for automatic logons.
Tactics:	Credential Access
Data Sources:	Command: Command Execution, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may look for details about the network configuration and settings, such as IP and/or MAC addresses, of systems they access or through information discovery of remote systems. Several operating system administration utilities exist that can be used to gather this information. Examples include Arp , ipconfig / ifconfig , nbtstat , and route .
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may target user email to collect sensitive information. Emails may contain sensitive data, including trade secrets or personal information, that can prove valuable to adversaries. Adversaries can collect or forward email from mail servers or clients.
Tactics:	Collection
Data Sources:	Application Log: Application Log Content, Command: Command Execution, File: File Access, Logon Session: Logon Session Creation, Network Traffic: Network Connection Creation
Platforms:	Google Workspace, Linux, macOS, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local system sources, such as file systems and configuration files or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Access, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report hCkkM0lH0P.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: Agenttesla

Yara Signatures

Memory Dumps

Unpacked PEs

Sigma Signatures

System Summary

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Networking

System Summary

Data Obfuscation

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\hCkkM0lH0P.exe.log

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_geugiseg.ysf.psm1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_oytjxpjm.vws.ps1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_rbp5ty1d.usf.psm1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_xkvv0hgf.uqp.ps1

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Data Directories

Sections

Resources

Imports

Network Behavior

Windows Analysis Report
hCkkM0lH0P.exe

Function 08DEB908 Relevance: 2.7, Strings: 2, Instructions: 180
COMMON

Function 08DEB8F8 Relevance: 2.7, Strings: 2, Instructions: 161
COMMON

Function 08DE6A90 Relevance: 2.6, Strings: 2, Instructions: 71
COMMON

Function 02B0ADA8 Relevance: 1.7, APIs: 1, Instructions: 198
COMMON

Function 02B044B4 Relevance: 1.6, APIs: 1, Instructions: 96
COMMON

Function 02B05914 Relevance: 1.6, APIs: 1, Instructions: 95
COMMON

Function 02B0D27C Relevance: 1.6, APIs: 1, Instructions: 65
COMMON

Function 02B0D688 Relevance: 1.6, APIs: 1, Instructions: 62
COMMON

Function 02B0B031 Relevance: 1.6, APIs: 1, Instructions: 59
COMMON

Function 02B0A0CC Relevance: 1.6, APIs: 1, Instructions: 50
COMMON

Function 08DE5C71 Relevance: 1.4, Strings: 1, Instructions: 158
COMMON

Function 08DE5C80 Relevance: 1.4, Strings: 1, Instructions: 152
COMMON

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre