Edit tour

Windows Analysis Report
zapytanie 2025.exe

Overview

General Information

Sample name:	zapytanie 2025.exe
Analysis ID:	1589896
MD5:	15fe2ac3357c534e280cc8d9de964aed
SHA1:	af1e4824a0a4954c69fe91b6ad54e66a4f3a7511
SHA256:	441c8c73ea3f781774e9ee684d4d51127ec736c9fb6423fad0aea20695abd3c3
Tags:	exeuser-julianmckein
Infos:

Detection

AsyncRAT, PureLog Stealer

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Found malware configuration

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for submitted file

Suricata IDS alerts for network traffic

Yara detected AntiVM3

Yara detected AsyncRAT

Yara detected PureLog Stealer

AI detected suspicious sample

C2 URLs / IPs found in malware configuration

Injects a PE file into a foreign processes

Machine Learning detection for sample

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Yara detected Generic Downloader

AV process strings found (often used to terminate AV products)

Allocates memory with a write watch (potentially for evading sandboxes)

Binary contains a suspicious time stamp

Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Detected TCP or UDP traffic on non-standard ports

Detected potential crypto function

Enables debug privileges

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Internet Provider seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

Queries the volume information (name, serial number etc) of a device

Sample file is different than original file name gathered from version info

Tries to resolve domain names, but no domain seems valid (expired dropper behavior)

Uses 32bit PE files

Uses code obfuscation techniques (call, push, ret)

Yara signature match

Classification

Process Tree

System is w10x64

zapytanie 2025.exe (PID: 1012 cmdline: "C:\Users\user\Desktop\zapytanie 2025.exe" MD5: 15FE2AC3357C534E280CC8D9DE964AED)

zapytanie 2025.exe (PID: 6508 cmdline: "C:\Users\user\Desktop\zapytanie 2025.exe" MD5: 15FE2AC3357C534E280CC8D9DE964AED)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
AsyncRAT	AsyncRAT is a Remote Access Tool (RAT) designed to remotely monitor and control other computers through a secure encrypted connection. It is an open source remote administration tool, however, it could also be used maliciously because it provides functionality such as keylogger, remote desktop control, and many other functions that may cause harm to the victims computer. In addition, AsyncRAT can be delivered via various methods such as spear-phishing, malvertising, exploit kit and other techniques.	No Attribution	https://0xtoxin-labs.gitbook.io/malware-analysis/malware-analysis/asyncrat-onenote-dropper https://aidenmitchell.ca/asyncrat-via-vbs/ https://assets.virustotal.com/reports/2021trends.pdf https://axmahr.github.io/posts/asyncrat-detection/ https://blog.checkpoint.com/research/november-2023s-most-wanted-malware-new-asyncrat-campaign-discovered-while-fakeupdates-re-entered-the-top-ten-after-brief-hiatus/	https://malpedia.caad.fkie.fraunhofer.de/details/win.asyncrat

Malware Configuration

Threatname: AsyncRAT

{"Server": "quin.ydns.eu,185.38.142.240", "Port": "1962,1940", "Version": "0.5.8", "MutexName": "dLOEY8XRq1oB", "Autorun": "false", "Group": "null"}

Yara Signatures

Memory Dumps

Source	Rule	Description	Author	Strings
00000000.00000002.2053805650.0000000003809000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
00000003.00000002.3296481390.0000000000402000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_AsyncRAT	Yara detected AsyncRAT	Joe Security
00000003.00000002.3296481390.0000000000402000.00000040.00000400.00020000.00000000.sdmp	INDICATOR_SUSPICIOUS_EXE_ASEP_REG_Reverse	Detects file containing reversed ASEP Autorun registry keys	ditekSHen	0x97c5:$s1: nuR\noisreVtnerruC\swodniW\tfosorciM
00000000.00000002.2056404178.0000000006A50000.00000004.08000000.00040000.00000000.sdmp	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
00000003.00000002.3298106086.0000000002D71000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_AsyncRAT	Yara detected AsyncRAT	Joe Security
00000000.00000002.2052998629.0000000002801000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_AsyncRAT	Yara detected AsyncRAT	Joe Security
00000000.00000002.2052998629.0000000002801000.00000004.00000800.00020000.00000000.sdmp	Windows_Trojan_Asyncrat_11a11ba1	unknown	unknown	0x6ed23:$a1: /c schtasks /create /f /sc onlogon /rl highest /tn " 0x7a203:$a1: /c schtasks /create /f /sc onlogon /rl highest /tn " 0x85cc7:$a1: /c schtasks /create /f /sc onlogon /rl highest /tn " 0x70028:$a2: Stub.exe 0x700b8:$a2: Stub.exe 0x7b508:$a2: Stub.exe 0x7b598:$a2: Stub.exe 0x86fe4:$a2: Stub.exe 0x87074:$a2: Stub.exe 0x6bae6:$a3: get_ActivatePong 0x76fc6:$a3: get_ActivatePong 0x82a8a:$a3: get_ActivatePong 0x6ef3b:$a4: vmware 0x7a41b:$a4: vmware 0x85edf:$a4: vmware 0x6edb3:$a5: \nuR\noisreVtnerruC\swodniW\tfosorciM\erawtfoS 0x7a293:$a5: \nuR\noisreVtnerruC\swodniW\tfosorciM\erawtfoS 0x85d57:$a5: \nuR\noisreVtnerruC\swodniW\tfosorciM\erawtfoS 0x6c838:$a6: get_SslClient 0x77d18:$a6: get_SslClient 0x837dc:$a6: get_SslClient
00000000.00000002.2052998629.0000000002801000.00000004.00000800.00020000.00000000.sdmp	INDICATOR_SUSPICIOUS_EXE_ASEP_REG_Reverse	Detects file containing reversed ASEP Autorun registry keys	ditekSHen	0x6edb5:$s1: nuR\noisreVtnerruC\swodniW\tfosorciM 0x7a295:$s1: nuR\noisreVtnerruC\swodniW\tfosorciM 0x85d59:$s1: nuR\noisreVtnerruC\swodniW\tfosorciM
00000000.00000002.2052998629.0000000002962000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
Process Memory Space: zapytanie 2025.exe PID: 1012	JoeSecurity_AsyncRAT	Yara detected AsyncRAT	Joe Security
Process Memory Space: zapytanie 2025.exe PID: 1012	JoeSecurity_AntiVM_3	Yara detected AntiVM_3	Joe Security
Process Memory Space: zapytanie 2025.exe PID: 1012	INDICATOR_SUSPICIOUS_EXE_ASEP_REG_Reverse	Detects file containing reversed ASEP Autorun registry keys	ditekSHen	0x838c7:$s1: nuR\noisreVtnerruC\swodniW\tfosorciM
Process Memory Space: zapytanie 2025.exe PID: 6508	JoeSecurity_AsyncRAT	Yara detected AsyncRAT	Joe Security
Process Memory Space: zapytanie 2025.exe PID: 6508	INDICATOR_SUSPICIOUS_EXE_ASEP_REG_Reverse	Detects file containing reversed ASEP Autorun registry keys	ditekSHen	0x3f63d:$s1: nuR\noisreVtnerruC\swodniW\tfosorciM
Click to see the 9 entries

Unpacked PEs

Source	Rule	Description	Author	Strings
0.2.zapytanie 2025.exe.38262a8.7.raw.unpack	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
0.2.zapytanie 2025.exe.38262a8.7.unpack	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
0.2.zapytanie 2025.exe.28718d0.0.raw.unpack	JoeSecurity_AsyncRAT	Yara detected AsyncRAT	Joe Security
0.2.zapytanie 2025.exe.28718d0.0.raw.unpack	JoeSecurity_GenericDownloader_1	Yara detected Generic Downloader	Joe Security
0.2.zapytanie 2025.exe.28718d0.0.raw.unpack	Windows_Trojan_Asyncrat_11a11ba1	unknown	unknown	0x9933:$a1: /c schtasks /create /f /sc onlogon /rl highest /tn " 0x153f7:$a1: /c schtasks /create /f /sc onlogon /rl highest /tn " 0xac38:$a2: Stub.exe 0xacc8:$a2: Stub.exe 0x16714:$a2: Stub.exe 0x167a4:$a2: Stub.exe 0x66f6:$a3: get_ActivatePong 0x121ba:$a3: get_ActivatePong 0x9b4b:$a4: vmware 0x1560f:$a4: vmware 0x99c3:$a5: \nuR\noisreVtnerruC\swodniW\tfosorciM\erawtfoS 0x15487:$a5: \nuR\noisreVtnerruC\swodniW\tfosorciM\erawtfoS 0x7448:$a6: get_SslClient 0x12f0c:$a6: get_SslClient
0.2.zapytanie 2025.exe.28718d0.0.raw.unpack	rat_win_asyncrat	Detect AsyncRAT based on specific strings	Sekoia.io	0x66f6:$str01: get_ActivatePong 0x121ba:$str01: get_ActivatePong 0x7448:$str02: get_SslClient 0x12f0c:$str02: get_SslClient 0x7464:$str03: get_TcpClient 0x12f28:$str03: get_TcpClient 0x5d0e:$str04: get_SendSync 0x117d2:$str04: get_SendSync 0x5d5e:$str05: get_IsConnected 0x11822:$str05: get_IsConnected 0x648d:$str06: set_UseShellExecute 0x11f51:$str06: set_UseShellExecute 0x9c69:$str07: Pastebin 0x1572d:$str07: Pastebin 0x9ceb:$str08: Select * from AntivirusProduct 0x157af:$str08: Select * from AntivirusProduct 0xac38:$str09: Stub.exe 0xacc8:$str09: Stub.exe 0x16714:$str09: Stub.exe 0x167a4:$str09: Stub.exe 0x9a43:$str10: timeout 3 > NUL
0.2.zapytanie 2025.exe.28718d0.0.raw.unpack	INDICATOR_SUSPICIOUS_EXE_ASEP_REG_Reverse	Detects file containing reversed ASEP Autorun registry keys	ditekSHen	0x99c5:$s1: nuR\noisreVtnerruC\swodniW\tfosorciM 0x15489:$s1: nuR\noisreVtnerruC\swodniW\tfosorciM
0.2.zapytanie 2025.exe.28663f0.3.unpack	JoeSecurity_AsyncRAT	Yara detected AsyncRAT	Joe Security
0.2.zapytanie 2025.exe.28663f0.3.unpack	Windows_Trojan_Asyncrat_11a11ba1	unknown	unknown	0x7b33:$a1: /c schtasks /create /f /sc onlogon /rl highest /tn " 0x8e38:$a2: Stub.exe 0x8ec8:$a2: Stub.exe 0x48f6:$a3: get_ActivatePong 0x7d4b:$a4: vmware 0x7bc3:$a5: \nuR\noisreVtnerruC\swodniW\tfosorciM\erawtfoS 0x5648:$a6: get_SslClient
0.2.zapytanie 2025.exe.28663f0.3.unpack	rat_win_asyncrat	Detect AsyncRAT based on specific strings	Sekoia.io	0x48f6:$str01: get_ActivatePong 0x5648:$str02: get_SslClient 0x5664:$str03: get_TcpClient 0x3f0e:$str04: get_SendSync 0x3f5e:$str05: get_IsConnected 0x468d:$str06: set_UseShellExecute 0x7e69:$str07: Pastebin 0x7eeb:$str08: Select * from AntivirusProduct 0x8e38:$str09: Stub.exe 0x8ec8:$str09: Stub.exe 0x7c43:$str10: timeout 3 > NUL 0x7b33:$str11: /c schtasks /create /f /sc onlogon /rl highest /tn 0x7bc3:$str12: \nuR\noisreVtnerruC\swodniW\tfosorciM\erawtfoS
0.2.zapytanie 2025.exe.28663f0.3.unpack	INDICATOR_SUSPICIOUS_EXE_ASEP_REG_Reverse	Detects file containing reversed ASEP Autorun registry keys	ditekSHen	0x7bc5:$s1: nuR\noisreVtnerruC\swodniW\tfosorciM
0.2.zapytanie 2025.exe.6a50000.8.unpack	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
0.2.zapytanie 2025.exe.28718d0.0.unpack	JoeSecurity_AsyncRAT	Yara detected AsyncRAT	Joe Security
0.2.zapytanie 2025.exe.28718d0.0.unpack	Windows_Trojan_Asyncrat_11a11ba1	unknown	unknown	0x7b33:$a1: /c schtasks /create /f /sc onlogon /rl highest /tn " 0x8e38:$a2: Stub.exe 0x8ec8:$a2: Stub.exe 0x48f6:$a3: get_ActivatePong 0x7d4b:$a4: vmware 0x7bc3:$a5: \nuR\noisreVtnerruC\swodniW\tfosorciM\erawtfoS 0x5648:$a6: get_SslClient
0.2.zapytanie 2025.exe.2c88650.4.unpack	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
0.2.zapytanie 2025.exe.28718d0.0.unpack	rat_win_asyncrat	Detect AsyncRAT based on specific strings	Sekoia.io	0x48f6:$str01: get_ActivatePong 0x5648:$str02: get_SslClient 0x5664:$str03: get_TcpClient 0x3f0e:$str04: get_SendSync 0x3f5e:$str05: get_IsConnected 0x468d:$str06: set_UseShellExecute 0x7e69:$str07: Pastebin 0x7eeb:$str08: Select * from AntivirusProduct 0x8e38:$str09: Stub.exe 0x8ec8:$str09: Stub.exe 0x7c43:$str10: timeout 3 > NUL 0x7b33:$str11: /c schtasks /create /f /sc onlogon /rl highest /tn 0x7bc3:$str12: \nuR\noisreVtnerruC\swodniW\tfosorciM\erawtfoS
0.2.zapytanie 2025.exe.28718d0.0.unpack	INDICATOR_SUSPICIOUS_EXE_ASEP_REG_Reverse	Detects file containing reversed ASEP Autorun registry keys	ditekSHen	0x7bc5:$s1: nuR\noisreVtnerruC\swodniW\tfosorciM
0.2.zapytanie 2025.exe.6a50000.8.raw.unpack	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
3.2.zapytanie 2025.exe.400000.0.unpack	JoeSecurity_AsyncRAT	Yara detected AsyncRAT	Joe Security
3.2.zapytanie 2025.exe.400000.0.unpack	JoeSecurity_GenericDownloader_1	Yara detected Generic Downloader	Joe Security
3.2.zapytanie 2025.exe.400000.0.unpack	Windows_Trojan_Asyncrat_11a11ba1	unknown	unknown	0x9933:$a1: /c schtasks /create /f /sc onlogon /rl highest /tn " 0xac38:$a2: Stub.exe 0xacc8:$a2: Stub.exe 0x66f6:$a3: get_ActivatePong 0x9b4b:$a4: vmware 0x99c3:$a5: \nuR\noisreVtnerruC\swodniW\tfosorciM\erawtfoS 0x7448:$a6: get_SslClient
3.2.zapytanie 2025.exe.400000.0.unpack	rat_win_asyncrat	Detect AsyncRAT based on specific strings	Sekoia.io	0x66f6:$str01: get_ActivatePong 0x7448:$str02: get_SslClient 0x7464:$str03: get_TcpClient 0x5d0e:$str04: get_SendSync 0x5d5e:$str05: get_IsConnected 0x648d:$str06: set_UseShellExecute 0x9c69:$str07: Pastebin 0x9ceb:$str08: Select * from AntivirusProduct 0xac38:$str09: Stub.exe 0xacc8:$str09: Stub.exe 0x9a43:$str10: timeout 3 > NUL 0x9933:$str11: /c schtasks /create /f /sc onlogon /rl highest /tn 0x99c3:$str12: \nuR\noisreVtnerruC\swodniW\tfosorciM\erawtfoS
3.2.zapytanie 2025.exe.400000.0.unpack	INDICATOR_SUSPICIOUS_EXE_ASEP_REG_Reverse	Detects file containing reversed ASEP Autorun registry keys	ditekSHen	0x99c5:$s1: nuR\noisreVtnerruC\swodniW\tfosorciM
0.2.zapytanie 2025.exe.28663f0.3.raw.unpack	JoeSecurity_AsyncRAT	Yara detected AsyncRAT	Joe Security
0.2.zapytanie 2025.exe.28663f0.3.raw.unpack	JoeSecurity_GenericDownloader_1	Yara detected Generic Downloader	Joe Security
0.2.zapytanie 2025.exe.28663f0.3.raw.unpack	Windows_Trojan_Asyncrat_11a11ba1	unknown	unknown	0x9933:$a1: /c schtasks /create /f /sc onlogon /rl highest /tn " 0x14e13:$a1: /c schtasks /create /f /sc onlogon /rl highest /tn " 0x208d7:$a1: /c schtasks /create /f /sc onlogon /rl highest /tn " 0xac38:$a2: Stub.exe 0xacc8:$a2: Stub.exe 0x16118:$a2: Stub.exe 0x161a8:$a2: Stub.exe 0x21bf4:$a2: Stub.exe 0x21c84:$a2: Stub.exe 0x66f6:$a3: get_ActivatePong 0x11bd6:$a3: get_ActivatePong 0x1d69a:$a3: get_ActivatePong 0x9b4b:$a4: vmware 0x1502b:$a4: vmware 0x20aef:$a4: vmware 0x99c3:$a5: \nuR\noisreVtnerruC\swodniW\tfosorciM\erawtfoS 0x14ea3:$a5: \nuR\noisreVtnerruC\swodniW\tfosorciM\erawtfoS 0x20967:$a5: \nuR\noisreVtnerruC\swodniW\tfosorciM\erawtfoS 0x7448:$a6: get_SslClient 0x12928:$a6: get_SslClient 0x1e3ec:$a6: get_SslClient
0.2.zapytanie 2025.exe.28663f0.3.raw.unpack	rat_win_asyncrat	Detect AsyncRAT based on specific strings	Sekoia.io	0x66f6:$str01: get_ActivatePong 0x11bd6:$str01: get_ActivatePong 0x1d69a:$str01: get_ActivatePong 0x7448:$str02: get_SslClient 0x12928:$str02: get_SslClient 0x1e3ec:$str02: get_SslClient 0x7464:$str03: get_TcpClient 0x12944:$str03: get_TcpClient 0x1e408:$str03: get_TcpClient 0x5d0e:$str04: get_SendSync 0x111ee:$str04: get_SendSync 0x1ccb2:$str04: get_SendSync 0x5d5e:$str05: get_IsConnected 0x1123e:$str05: get_IsConnected 0x1cd02:$str05: get_IsConnected 0x648d:$str06: set_UseShellExecute 0x1196d:$str06: set_UseShellExecute 0x1d431:$str06: set_UseShellExecute 0x9c69:$str07: Pastebin 0x15149:$str07: Pastebin 0x20c0d:$str07: Pastebin
0.2.zapytanie 2025.exe.28663f0.3.raw.unpack	INDICATOR_SUSPICIOUS_EXE_ASEP_REG_Reverse	Detects file containing reversed ASEP Autorun registry keys	ditekSHen	0x99c5:$s1: nuR\noisreVtnerruC\swodniW\tfosorciM 0x14ea5:$s1: nuR\noisreVtnerruC\swodniW\tfosorciM 0x20969:$s1: nuR\noisreVtnerruC\swodniW\tfosorciM
0.2.zapytanie 2025.exe.2c88650.4.raw.unpack	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
0.2.zapytanie 2025.exe.2a66918.2.raw.unpack	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
0.2.zapytanie 2025.exe.29adf80.1.raw.unpack	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
Click to see the 26 entries

Suricata Signatures

ET MALWARE Generic AsyncRAT Style SSL Cert

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-13T10:03:23.576128+0100	2035595	1	Domain Observed Used for C2 Detected	185.38.142.240	1940	192.168.2.5	49724	TCP

ET MALWARE Observed Malicious SSL Cert (AsyncRAT Server)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-13T10:03:23.576128+0100	2035607	1	Domain Observed Used for C2 Detected	185.38.142.240	1940	192.168.2.5	49724	TCP

ETPRO JA3 Hash - Suspected ASYNCRAT Server Cert (ja3s)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-13T10:03:23.576128+0100	2842478	1	Malware Command and Control Activity Detected	185.38.142.240	1940	192.168.2.5	49724	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Found malware configuration

Source: 00000003.00000002.3298106086.0000000002D71000.00000004.00000800.00020000.00000000.sdmp

Malware Configuration Extractor: AsyncRAT {"Server": "quin.ydns.eu,185.38.142.240", "Port": "1962,1940", "Version": "0.5.8", "MutexName": "dLOEY8XRq1oB", "Autorun": "false", "Group": "null"}

Multi AV Scanner detection for submitted file

Source: zapytanie 2025.exe	Virustotal: Detection: 44%			Perma Link
Source: zapytanie 2025.exe	ReversingLabs: Detection: 34%

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Machine Learning detection for sample

Source: zapytanie 2025.exe

Joe Sandbox ML: detected

Source: zapytanie 2025.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: zapytanie 2025.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source:	Binary string: qqog.pdbSHA256 source: zapytanie 2025.exe
Source:	Binary string: qqog.pdb source: zapytanie 2025.exe

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 2842478 - Severity 1 - ETPRO JA3 Hash - Suspected ASYNCRAT Server Cert (ja3s) : 185.38.142.240:1940 -> 192.168.2.5:49724
Source: Network traffic	Suricata IDS: 2030673 - Severity 1 - ET MALWARE Observed Malicious SSL Cert (AsyncRAT Server) : 185.38.142.240:1940 -> 192.168.2.5:49724
Source: Network traffic	Suricata IDS: 2035595 - Severity 1 - ET MALWARE Generic AsyncRAT Style SSL Cert : 185.38.142.240:1940 -> 192.168.2.5:49724
Source: Network traffic	Suricata IDS: 2035607 - Severity 1 - ET MALWARE Observed Malicious SSL Cert (AsyncRAT Server) : 185.38.142.240:1940 -> 192.168.2.5:49724

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor

URLs: quin.ydns.eu

Yara detected Generic Downloader

Source: Yara match	File source: 0.2.zapytanie 2025.exe.28718d0.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.2.zapytanie 2025.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.zapytanie 2025.exe.28663f0.3.raw.unpack, type: UNPACKEDPE

Source: global traffic

TCP traffic: 192.168.2.5:49724 -> 185.38.142.240:1940

Source: Joe Sandbox View

ASN Name: NETSOLUTIONSNL NETSOLUTIONSNL

Source: unknown

DNS traffic detected: query: quin.ydns.eu replaycode: Name error (3)

Source: unknown	TCP traffic detected without corresponding DNS query: 185.38.142.240
Source: unknown	TCP traffic detected without corresponding DNS query: 185.38.142.240
Source: unknown	TCP traffic detected without corresponding DNS query: 185.38.142.240
Source: unknown	TCP traffic detected without corresponding DNS query: 185.38.142.240
Source: unknown	TCP traffic detected without corresponding DNS query: 185.38.142.240
Source: unknown	TCP traffic detected without corresponding DNS query: 185.38.142.240
Source: unknown	TCP traffic detected without corresponding DNS query: 185.38.142.240
Source: unknown	TCP traffic detected without corresponding DNS query: 185.38.142.240
Source: unknown	TCP traffic detected without corresponding DNS query: 185.38.142.240
Source: unknown	TCP traffic detected without corresponding DNS query: 185.38.142.240
Source: unknown	TCP traffic detected without corresponding DNS query: 185.38.142.240
Source: unknown	TCP traffic detected without corresponding DNS query: 185.38.142.240
Source: unknown	TCP traffic detected without corresponding DNS query: 185.38.142.240
Source: unknown	TCP traffic detected without corresponding DNS query: 185.38.142.240
Source: unknown	TCP traffic detected without corresponding DNS query: 185.38.142.240
Source: unknown	TCP traffic detected without corresponding DNS query: 185.38.142.240
Source: unknown	TCP traffic detected without corresponding DNS query: 185.38.142.240
Source: unknown	TCP traffic detected without corresponding DNS query: 185.38.142.240
Source: unknown	TCP traffic detected without corresponding DNS query: 185.38.142.240
Source: unknown	TCP traffic detected without corresponding DNS query: 185.38.142.240
Source: unknown	TCP traffic detected without corresponding DNS query: 185.38.142.240
Source: unknown	TCP traffic detected without corresponding DNS query: 185.38.142.240
Source: unknown	TCP traffic detected without corresponding DNS query: 185.38.142.240
Source: unknown	TCP traffic detected without corresponding DNS query: 185.38.142.240
Source: unknown	TCP traffic detected without corresponding DNS query: 185.38.142.240
Source: unknown	TCP traffic detected without corresponding DNS query: 185.38.142.240
Source: unknown	TCP traffic detected without corresponding DNS query: 185.38.142.240
Source: unknown	TCP traffic detected without corresponding DNS query: 185.38.142.240
Source: unknown	TCP traffic detected without corresponding DNS query: 185.38.142.240
Source: unknown	TCP traffic detected without corresponding DNS query: 185.38.142.240
Source: unknown	TCP traffic detected without corresponding DNS query: 185.38.142.240
Source: unknown	TCP traffic detected without corresponding DNS query: 185.38.142.240
Source: unknown	TCP traffic detected without corresponding DNS query: 185.38.142.240
Source: unknown	TCP traffic detected without corresponding DNS query: 185.38.142.240
Source: unknown	TCP traffic detected without corresponding DNS query: 185.38.142.240
Source: unknown	TCP traffic detected without corresponding DNS query: 185.38.142.240
Source: unknown	TCP traffic detected without corresponding DNS query: 185.38.142.240
Source: unknown	TCP traffic detected without corresponding DNS query: 185.38.142.240
Source: unknown	TCP traffic detected without corresponding DNS query: 185.38.142.240
Source: unknown	TCP traffic detected without corresponding DNS query: 185.38.142.240
Source: unknown	TCP traffic detected without corresponding DNS query: 185.38.142.240
Source: unknown	TCP traffic detected without corresponding DNS query: 185.38.142.240
Source: unknown	TCP traffic detected without corresponding DNS query: 185.38.142.240
Source: unknown	TCP traffic detected without corresponding DNS query: 185.38.142.240
Source: unknown	TCP traffic detected without corresponding DNS query: 185.38.142.240
Source: unknown	TCP traffic detected without corresponding DNS query: 185.38.142.240
Source: unknown	TCP traffic detected without corresponding DNS query: 185.38.142.240
Source: unknown	TCP traffic detected without corresponding DNS query: 185.38.142.240
Source: unknown	TCP traffic detected without corresponding DNS query: 185.38.142.240
Source: unknown	TCP traffic detected without corresponding DNS query: 185.38.142.240

Source: global traffic

DNS traffic detected: DNS query: quin.ydns.eu

Source: zapytanie 2025.exe, 00000003.00000002.3296784648.000000000105A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en
Source: zapytanie 2025.exe, 00000003.00000002.3296784648.00000000010B0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cabao
Source: zapytanie 2025.exe, 00000003.00000002.3298106086.0000000002D71000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: zapytanie 2025.exe	String found in binary or memory: http://tempuri.org/DataSet1.xsd

Key, Mouse, Clipboard, Microphone and Screen Capturing

Yara detected AsyncRAT

Source: Yara match	File source: 0.2.zapytanie 2025.exe.28718d0.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.zapytanie 2025.exe.28663f0.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.zapytanie 2025.exe.28718d0.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.2.zapytanie 2025.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.zapytanie 2025.exe.28663f0.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000003.00000002.3296481390.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.3298106086.0000000002D71000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2052998629.0000000002801000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: zapytanie 2025.exe PID: 1012, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: zapytanie 2025.exe PID: 6508, type: MEMORYSTR

System Summary

Malicious sample detected (through community Yara rule)

Source: 0.2.zapytanie 2025.exe.28718d0.0.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Asyncrat_11a11ba1 Author: unknown
Source: 0.2.zapytanie 2025.exe.28718d0.0.raw.unpack, type: UNPACKEDPE	Matched rule: Detect AsyncRAT based on specific strings Author: Sekoia.io
Source: 0.2.zapytanie 2025.exe.28718d0.0.raw.unpack, type: UNPACKEDPE	Matched rule: Detects file containing reversed ASEP Autorun registry keys Author: ditekSHen
Source: 0.2.zapytanie 2025.exe.28663f0.3.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Asyncrat_11a11ba1 Author: unknown
Source: 0.2.zapytanie 2025.exe.28663f0.3.unpack, type: UNPACKEDPE	Matched rule: Detect AsyncRAT based on specific strings Author: Sekoia.io
Source: 0.2.zapytanie 2025.exe.28663f0.3.unpack, type: UNPACKEDPE	Matched rule: Detects file containing reversed ASEP Autorun registry keys Author: ditekSHen
Source: 0.2.zapytanie 2025.exe.28718d0.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Asyncrat_11a11ba1 Author: unknown
Source: 0.2.zapytanie 2025.exe.28718d0.0.unpack, type: UNPACKEDPE	Matched rule: Detect AsyncRAT based on specific strings Author: Sekoia.io
Source: 0.2.zapytanie 2025.exe.28718d0.0.unpack, type: UNPACKEDPE	Matched rule: Detects file containing reversed ASEP Autorun registry keys Author: ditekSHen
Source: 3.2.zapytanie 2025.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Asyncrat_11a11ba1 Author: unknown
Source: 3.2.zapytanie 2025.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Detect AsyncRAT based on specific strings Author: Sekoia.io
Source: 3.2.zapytanie 2025.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Detects file containing reversed ASEP Autorun registry keys Author: ditekSHen
Source: 0.2.zapytanie 2025.exe.28663f0.3.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Asyncrat_11a11ba1 Author: unknown
Source: 0.2.zapytanie 2025.exe.28663f0.3.raw.unpack, type: UNPACKEDPE	Matched rule: Detect AsyncRAT based on specific strings Author: Sekoia.io
Source: 0.2.zapytanie 2025.exe.28663f0.3.raw.unpack, type: UNPACKEDPE	Matched rule: Detects file containing reversed ASEP Autorun registry keys Author: ditekSHen
Source: 00000003.00000002.3296481390.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects file containing reversed ASEP Autorun registry keys Author: ditekSHen
Source: 00000000.00000002.2052998629.0000000002801000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Asyncrat_11a11ba1 Author: unknown
Source: 00000000.00000002.2052998629.0000000002801000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects file containing reversed ASEP Autorun registry keys Author: ditekSHen
Source: Process Memory Space: zapytanie 2025.exe PID: 1012, type: MEMORYSTR	Matched rule: Detects file containing reversed ASEP Autorun registry keys Author: ditekSHen
Source: Process Memory Space: zapytanie 2025.exe PID: 6508, type: MEMORYSTR	Matched rule: Detects file containing reversed ASEP Autorun registry keys Author: ditekSHen

Source: C:\Users\user\Desktop\zapytanie 2025.exe	Code function: 0_2_00EEE0B4	0_2_00EEE0B4
Source: C:\Users\user\Desktop\zapytanie 2025.exe	Code function: 0_2_06E9DAD8	0_2_06E9DAD8
Source: C:\Users\user\Desktop\zapytanie 2025.exe	Code function: 0_2_06E98608	0_2_06E98608
Source: C:\Users\user\Desktop\zapytanie 2025.exe	Code function: 0_2_06E9A550	0_2_06E9A550
Source: C:\Users\user\Desktop\zapytanie 2025.exe	Code function: 0_2_06E992A0	0_2_06E992A0
Source: C:\Users\user\Desktop\zapytanie 2025.exe	Code function: 0_2_06E992B0	0_2_06E992B0
Source: C:\Users\user\Desktop\zapytanie 2025.exe	Code function: 0_2_06E9F158	0_2_06E9F158
Source: C:\Users\user\Desktop\zapytanie 2025.exe	Code function: 0_2_06E98E78	0_2_06E98E78
Source: C:\Users\user\Desktop\zapytanie 2025.exe	Code function: 0_2_06E98A40	0_2_06E98A40
Source: C:\Users\user\Desktop\zapytanie 2025.exe	Code function: 0_2_06E90B98	0_2_06E90B98
Source: C:\Users\user\Desktop\zapytanie 2025.exe	Code function: 0_2_08BBB468	0_2_08BBB468
Source: C:\Users\user\Desktop\zapytanie 2025.exe	Code function: 0_2_08BBED58	0_2_08BBED58
Source: C:\Users\user\Desktop\zapytanie 2025.exe	Code function: 0_2_08BB0006	0_2_08BB0006
Source: C:\Users\user\Desktop\zapytanie 2025.exe	Code function: 0_2_08BB0040	0_2_08BB0040
Source: C:\Users\user\Desktop\zapytanie 2025.exe	Code function: 0_2_08BB56E8	0_2_08BB56E8
Source: C:\Users\user\Desktop\zapytanie 2025.exe	Code function: 0_2_08BB56D9	0_2_08BB56D9
Source: C:\Users\user\Desktop\zapytanie 2025.exe	Code function: 3_2_02BC6868	3_2_02BC6868
Source: C:\Users\user\Desktop\zapytanie 2025.exe	Code function: 3_2_02BC5F98	3_2_02BC5F98
Source: C:\Users\user\Desktop\zapytanie 2025.exe	Code function: 3_2_02BCA648	3_2_02BCA648
Source: C:\Users\user\Desktop\zapytanie 2025.exe	Code function: 3_2_02BC5C50	3_2_02BC5C50

Source: zapytanie 2025.exe, 00000000.00000002.2052998629.0000000002962000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameCaptive.dll" vs zapytanie 2025.exe
Source: zapytanie 2025.exe, 00000000.00000002.2057146544.0000000008B20000.00000004.08000000.00040000.00000000.sdmp	Binary or memory string: OriginalFilenameMontero.dll8 vs zapytanie 2025.exe
Source: zapytanie 2025.exe, 00000000.00000002.2053805650.0000000003809000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameCaptive.dll" vs zapytanie 2025.exe
Source: zapytanie 2025.exe, 00000000.00000002.2052078527.0000000000ABE000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameclr.dllT vs zapytanie 2025.exe
Source: zapytanie 2025.exe, 00000000.00000000.2042750711.000000000050E000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenameqqog.exe0 vs zapytanie 2025.exe
Source: zapytanie 2025.exe, 00000000.00000002.2052998629.0000000002801000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameStub.exe" vs zapytanie 2025.exe
Source: zapytanie 2025.exe, 00000000.00000002.2053805650.0000000003846000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameMontero.dll8 vs zapytanie 2025.exe
Source: zapytanie 2025.exe, 00000000.00000002.2056404178.0000000006A50000.00000004.08000000.00040000.00000000.sdmp	Binary or memory string: OriginalFilenameCaptive.dll" vs zapytanie 2025.exe
Source: zapytanie 2025.exe, 00000003.00000002.3296481390.000000000040E000.00000040.00000400.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameStub.exe" vs zapytanie 2025.exe
Source: zapytanie 2025.exe	Binary or memory string: OriginalFilenameqqog.exe0 vs zapytanie 2025.exe

Source: zapytanie 2025.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: 0.2.zapytanie 2025.exe.28718d0.0.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Asyncrat_11a11ba1 reference_sample = fe09cd1d13b87c5e970d3cbc1ebc02b1523c0a939f961fc02c1395707af1c6d1, os = windows, severity = x86, creation_date = 2021-08-05, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Asyncrat, fingerprint = 715ede969076cd413cebdfcf0cdda44e3a6feb5343558f18e656f740883b41b8, id = 11a11ba1-c178-4415-9c09-45030b500f50, last_modified = 2021-10-04
Source: 0.2.zapytanie 2025.exe.28718d0.0.raw.unpack, type: UNPACKEDPE	Matched rule: rat_win_asyncrat author = Sekoia.io, description = Detect AsyncRAT based on specific strings, creation_date = 2023-01-25, classification = TLP:CLEAR, version = 1.0, id = d698e4a1-77ff-4cd7-acb3-27fb16168ceb
Source: 0.2.zapytanie 2025.exe.28718d0.0.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_ASEP_REG_Reverse author = ditekSHen, description = Detects file containing reversed ASEP Autorun registry keys
Source: 0.2.zapytanie 2025.exe.28663f0.3.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Asyncrat_11a11ba1 reference_sample = fe09cd1d13b87c5e970d3cbc1ebc02b1523c0a939f961fc02c1395707af1c6d1, os = windows, severity = x86, creation_date = 2021-08-05, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Asyncrat, fingerprint = 715ede969076cd413cebdfcf0cdda44e3a6feb5343558f18e656f740883b41b8, id = 11a11ba1-c178-4415-9c09-45030b500f50, last_modified = 2021-10-04
Source: 0.2.zapytanie 2025.exe.28663f0.3.unpack, type: UNPACKEDPE	Matched rule: rat_win_asyncrat author = Sekoia.io, description = Detect AsyncRAT based on specific strings, creation_date = 2023-01-25, classification = TLP:CLEAR, version = 1.0, id = d698e4a1-77ff-4cd7-acb3-27fb16168ceb
Source: 0.2.zapytanie 2025.exe.28663f0.3.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_ASEP_REG_Reverse author = ditekSHen, description = Detects file containing reversed ASEP Autorun registry keys
Source: 0.2.zapytanie 2025.exe.28718d0.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Asyncrat_11a11ba1 reference_sample = fe09cd1d13b87c5e970d3cbc1ebc02b1523c0a939f961fc02c1395707af1c6d1, os = windows, severity = x86, creation_date = 2021-08-05, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Asyncrat, fingerprint = 715ede969076cd413cebdfcf0cdda44e3a6feb5343558f18e656f740883b41b8, id = 11a11ba1-c178-4415-9c09-45030b500f50, last_modified = 2021-10-04
Source: 0.2.zapytanie 2025.exe.28718d0.0.unpack, type: UNPACKEDPE	Matched rule: rat_win_asyncrat author = Sekoia.io, description = Detect AsyncRAT based on specific strings, creation_date = 2023-01-25, classification = TLP:CLEAR, version = 1.0, id = d698e4a1-77ff-4cd7-acb3-27fb16168ceb
Source: 0.2.zapytanie 2025.exe.28718d0.0.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_ASEP_REG_Reverse author = ditekSHen, description = Detects file containing reversed ASEP Autorun registry keys
Source: 3.2.zapytanie 2025.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Asyncrat_11a11ba1 reference_sample = fe09cd1d13b87c5e970d3cbc1ebc02b1523c0a939f961fc02c1395707af1c6d1, os = windows, severity = x86, creation_date = 2021-08-05, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Asyncrat, fingerprint = 715ede969076cd413cebdfcf0cdda44e3a6feb5343558f18e656f740883b41b8, id = 11a11ba1-c178-4415-9c09-45030b500f50, last_modified = 2021-10-04
Source: 3.2.zapytanie 2025.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: rat_win_asyncrat author = Sekoia.io, description = Detect AsyncRAT based on specific strings, creation_date = 2023-01-25, classification = TLP:CLEAR, version = 1.0, id = d698e4a1-77ff-4cd7-acb3-27fb16168ceb
Source: 3.2.zapytanie 2025.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_ASEP_REG_Reverse author = ditekSHen, description = Detects file containing reversed ASEP Autorun registry keys
Source: 0.2.zapytanie 2025.exe.28663f0.3.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Asyncrat_11a11ba1 reference_sample = fe09cd1d13b87c5e970d3cbc1ebc02b1523c0a939f961fc02c1395707af1c6d1, os = windows, severity = x86, creation_date = 2021-08-05, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Asyncrat, fingerprint = 715ede969076cd413cebdfcf0cdda44e3a6feb5343558f18e656f740883b41b8, id = 11a11ba1-c178-4415-9c09-45030b500f50, last_modified = 2021-10-04
Source: 0.2.zapytanie 2025.exe.28663f0.3.raw.unpack, type: UNPACKEDPE	Matched rule: rat_win_asyncrat author = Sekoia.io, description = Detect AsyncRAT based on specific strings, creation_date = 2023-01-25, classification = TLP:CLEAR, version = 1.0, id = d698e4a1-77ff-4cd7-acb3-27fb16168ceb
Source: 0.2.zapytanie 2025.exe.28663f0.3.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_ASEP_REG_Reverse author = ditekSHen, description = Detects file containing reversed ASEP Autorun registry keys
Source: 00000003.00000002.3296481390.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: INDICATOR_SUSPICIOUS_EXE_ASEP_REG_Reverse author = ditekSHen, description = Detects file containing reversed ASEP Autorun registry keys
Source: 00000000.00000002.2052998629.0000000002801000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Asyncrat_11a11ba1 reference_sample = fe09cd1d13b87c5e970d3cbc1ebc02b1523c0a939f961fc02c1395707af1c6d1, os = windows, severity = x86, creation_date = 2021-08-05, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Asyncrat, fingerprint = 715ede969076cd413cebdfcf0cdda44e3a6feb5343558f18e656f740883b41b8, id = 11a11ba1-c178-4415-9c09-45030b500f50, last_modified = 2021-10-04
Source: 00000000.00000002.2052998629.0000000002801000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: INDICATOR_SUSPICIOUS_EXE_ASEP_REG_Reverse author = ditekSHen, description = Detects file containing reversed ASEP Autorun registry keys
Source: Process Memory Space: zapytanie 2025.exe PID: 1012, type: MEMORYSTR	Matched rule: INDICATOR_SUSPICIOUS_EXE_ASEP_REG_Reverse author = ditekSHen, description = Detects file containing reversed ASEP Autorun registry keys
Source: Process Memory Space: zapytanie 2025.exe PID: 6508, type: MEMORYSTR	Matched rule: INDICATOR_SUSPICIOUS_EXE_ASEP_REG_Reverse author = ditekSHen, description = Detects file containing reversed ASEP Autorun registry keys

Source: zapytanie 2025.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: classification engine

Classification label: mal100.troj.evad.winEXE@3/1@3/1

Source: C:\Users\user\Desktop\zapytanie 2025.exe

File created: C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\zapytanie 2025.exe.log

Jump to behavior

Source: C:\Users\user\Desktop\zapytanie 2025.exe	Mutant created: NULL
Source: C:\Users\user\Desktop\zapytanie 2025.exe	Mutant created: \Sessions\1\BaseNamedObjects\dLOEY8XRq1oB

Source: zapytanie 2025.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: zapytanie 2025.exe

Static file information: TRID: Win32 Executable (generic) Net Framework (10011505/4) 49.83%

Source: C:\Users\user\Desktop\zapytanie 2025.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: zapytanie 2025.exe	Virustotal: Detection: 44%
Source: zapytanie 2025.exe	ReversingLabs: Detection: 34%

Source: unknown	Process created: C:\Users\user\Desktop\zapytanie 2025.exe "C:\Users\user\Desktop\zapytanie 2025.exe"
Source: C:\Users\user\Desktop\zapytanie 2025.exe	Process created: C:\Users\user\Desktop\zapytanie 2025.exe "C:\Users\user\Desktop\zapytanie 2025.exe"
Source: C:\Users\user\Desktop\zapytanie 2025.exe	Process created: C:\Users\user\Desktop\zapytanie 2025.exe "C:\Users\user\Desktop\zapytanie 2025.exe"	Jump to behavior

Source: C:\Users\user\Desktop\zapytanie 2025.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\Desktop\zapytanie 2025.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\zapytanie 2025.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\zapytanie 2025.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\zapytanie 2025.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\zapytanie 2025.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\zapytanie 2025.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\zapytanie 2025.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\zapytanie 2025.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\zapytanie 2025.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\zapytanie 2025.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\zapytanie 2025.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\zapytanie 2025.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\zapytanie 2025.exe	Section loaded: dwrite.dll	Jump to behavior
Source: C:\Users\user\Desktop\zapytanie 2025.exe	Section loaded: windowscodecs.dll	Jump to behavior
Source: C:\Users\user\Desktop\zapytanie 2025.exe	Section loaded: textshaping.dll	Jump to behavior
Source: C:\Users\user\Desktop\zapytanie 2025.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\zapytanie 2025.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\zapytanie 2025.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\zapytanie 2025.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\zapytanie 2025.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\Desktop\zapytanie 2025.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\zapytanie 2025.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\zapytanie 2025.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\zapytanie 2025.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\zapytanie 2025.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\zapytanie 2025.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\zapytanie 2025.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\zapytanie 2025.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\zapytanie 2025.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\zapytanie 2025.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\zapytanie 2025.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\zapytanie 2025.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\zapytanie 2025.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\zapytanie 2025.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\zapytanie 2025.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\zapytanie 2025.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\zapytanie 2025.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\Desktop\zapytanie 2025.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Users\user\Desktop\zapytanie 2025.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Users\user\Desktop\zapytanie 2025.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Users\user\Desktop\zapytanie 2025.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\zapytanie 2025.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\Desktop\zapytanie 2025.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Users\user\Desktop\zapytanie 2025.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\zapytanie 2025.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Users\user\Desktop\zapytanie 2025.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\zapytanie 2025.exe	Section loaded: userenv.dll	Jump to behavior

Source: C:\Users\user\Desktop\zapytanie 2025.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0EE7644B-1BAD-48B1-9889-0281C206EB85}\InprocServer32

Jump to behavior

Source: C:\Users\user\Desktop\zapytanie 2025.exe

File opened: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll

Jump to behavior

Source: zapytanie 2025.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR

Source: zapytanie 2025.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source: zapytanie 2025.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG

Source:	Binary string: qqog.pdbSHA256 source: zapytanie 2025.exe
Source:	Binary string: qqog.pdb source: zapytanie 2025.exe

Source: zapytanie 2025.exe

Static PE information: 0xF2C954B2 [Wed Jan 28 10:51:30 2099 UTC]

Source: C:\Users\user\Desktop\zapytanie 2025.exe

Code function: 0_2_00EEDA70 push eax; retf

0_2_00EEDA71

Source: zapytanie 2025.exe

Static PE information: section name: .text entropy: 7.64947126519897

Boot Survival

Yara detected AsyncRAT

Source: Yara match	File source: 0.2.zapytanie 2025.exe.28718d0.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.zapytanie 2025.exe.28663f0.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.zapytanie 2025.exe.28718d0.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.2.zapytanie 2025.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.zapytanie 2025.exe.28663f0.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000003.00000002.3296481390.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.3298106086.0000000002D71000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2052998629.0000000002801000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: zapytanie 2025.exe PID: 1012, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: zapytanie 2025.exe PID: 6508, type: MEMORYSTR

Source: C:\Users\user\Desktop\zapytanie 2025.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\zapytanie 2025.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\zapytanie 2025.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\zapytanie 2025.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\zapytanie 2025.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\zapytanie 2025.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\zapytanie 2025.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\zapytanie 2025.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\zapytanie 2025.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\zapytanie 2025.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\zapytanie 2025.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\zapytanie 2025.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\zapytanie 2025.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\zapytanie 2025.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\zapytanie 2025.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\zapytanie 2025.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\zapytanie 2025.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\zapytanie 2025.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\zapytanie 2025.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\zapytanie 2025.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\zapytanie 2025.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\zapytanie 2025.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\zapytanie 2025.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\zapytanie 2025.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\zapytanie 2025.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\zapytanie 2025.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\zapytanie 2025.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\zapytanie 2025.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\zapytanie 2025.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\zapytanie 2025.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\zapytanie 2025.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\zapytanie 2025.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\zapytanie 2025.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\zapytanie 2025.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\zapytanie 2025.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\zapytanie 2025.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\zapytanie 2025.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\zapytanie 2025.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\zapytanie 2025.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\zapytanie 2025.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\zapytanie 2025.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\zapytanie 2025.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\zapytanie 2025.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\zapytanie 2025.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\zapytanie 2025.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\zapytanie 2025.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\zapytanie 2025.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\zapytanie 2025.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\zapytanie 2025.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\zapytanie 2025.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\zapytanie 2025.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\zapytanie 2025.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\zapytanie 2025.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\zapytanie 2025.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\zapytanie 2025.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\zapytanie 2025.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\zapytanie 2025.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\zapytanie 2025.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\zapytanie 2025.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\zapytanie 2025.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\zapytanie 2025.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\zapytanie 2025.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\zapytanie 2025.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\zapytanie 2025.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\zapytanie 2025.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\zapytanie 2025.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\zapytanie 2025.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\zapytanie 2025.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\zapytanie 2025.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\zapytanie 2025.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\zapytanie 2025.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\zapytanie 2025.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\zapytanie 2025.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\zapytanie 2025.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\zapytanie 2025.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\zapytanie 2025.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\zapytanie 2025.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\zapytanie 2025.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\zapytanie 2025.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\zapytanie 2025.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\zapytanie 2025.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\zapytanie 2025.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\zapytanie 2025.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\zapytanie 2025.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\zapytanie 2025.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\zapytanie 2025.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\zapytanie 2025.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\zapytanie 2025.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\zapytanie 2025.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Yara detected AntiVM3

Source: Yara match

File source: Process Memory Space: zapytanie 2025.exe PID: 1012, type: MEMORYSTR

Yara detected AsyncRAT

Source: Yara match	File source: 0.2.zapytanie 2025.exe.28718d0.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.zapytanie 2025.exe.28663f0.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.zapytanie 2025.exe.28718d0.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.2.zapytanie 2025.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.zapytanie 2025.exe.28663f0.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000003.00000002.3296481390.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.3298106086.0000000002D71000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2052998629.0000000002801000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: zapytanie 2025.exe PID: 1012, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: zapytanie 2025.exe PID: 6508, type: MEMORYSTR

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Source: zapytanie 2025.exe, 00000000.00000002.2052998629.0000000002801000.00000004.00000800.00020000.00000000.sdmp, zapytanie 2025.exe, 00000003.00000002.3296481390.0000000000402000.00000040.00000400.00020000.00000000.sdmp

Binary or memory string: SBIEDLL.DLL

Source: C:\Users\user\Desktop\zapytanie 2025.exe	Memory allocated: E80000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\zapytanie 2025.exe	Memory allocated: 2800000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\zapytanie 2025.exe	Memory allocated: 4800000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\zapytanie 2025.exe	Memory allocated: 9410000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\zapytanie 2025.exe	Memory allocated: A410000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\zapytanie 2025.exe	Memory allocated: A640000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\zapytanie 2025.exe	Memory allocated: B640000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\zapytanie 2025.exe	Memory allocated: 2BC0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\zapytanie 2025.exe	Memory allocated: 2D70000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\zapytanie 2025.exe	Memory allocated: 4D70000 memory reserve \| memory write watch	Jump to behavior

Source: C:\Users\user\Desktop\zapytanie 2025.exe	Thread delayed: delay time: 922337203685477			Jump to behavior
Source: C:\Users\user\Desktop\zapytanie 2025.exe	Thread delayed: delay time: 922337203685477			Jump to behavior

Source: C:\Users\user\Desktop\zapytanie 2025.exe	Window / User API: threadDelayed 1137			Jump to behavior
Source: C:\Users\user\Desktop\zapytanie 2025.exe	Window / User API: threadDelayed 8713			Jump to behavior

Source: C:\Users\user\Desktop\zapytanie 2025.exe TID: 3208	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\zapytanie 2025.exe TID: 904	Thread sleep time: -1844674407370954s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\zapytanie 2025.exe TID: 1628	Thread sleep count: 1137 > 30	Jump to behavior
Source: C:\Users\user\Desktop\zapytanie 2025.exe TID: 1628	Thread sleep count: 8713 > 30	Jump to behavior

Source: C:\Users\user\Desktop\zapytanie 2025.exe

File Volume queried: C:\ FullSizeInformation

Jump to behavior

Source: C:\Users\user\Desktop\zapytanie 2025.exe	Thread delayed: delay time: 922337203685477			Jump to behavior
Source: C:\Users\user\Desktop\zapytanie 2025.exe	Thread delayed: delay time: 922337203685477			Jump to behavior

Source: zapytanie 2025.exe, 00000003.00000002.3296481390.0000000000402000.00000040.00000400.00020000.00000000.sdmp	Binary or memory string: vmware
Source: zapytanie 2025.exe, 00000003.00000002.3296784648.000000000105A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dllia

Source: C:\Users\user\Desktop\zapytanie 2025.exe

Process token adjusted: Debug

Jump to behavior

Source: C:\Users\user\Desktop\zapytanie 2025.exe

Memory allocated: page read and write | page guard

Jump to behavior

HIPS / PFW / Operating System Protection Evasion

Injects a PE file into a foreign processes

Source: C:\Users\user\Desktop\zapytanie 2025.exe

Memory written: C:\Users\user\Desktop\zapytanie 2025.exe base: 400000 value starts with: 4D5A

Jump to behavior

Source: C:\Users\user\Desktop\zapytanie 2025.exe

Process created: C:\Users\user\Desktop\zapytanie 2025.exe "C:\Users\user\Desktop\zapytanie 2025.exe"

Jump to behavior

Source: zapytanie 2025.exe, 00000003.00000002.3298106086.0000000002DFF000.00000004.00000800.00020000.00000000.sdmp, zapytanie 2025.exe, 00000003.00000002.3298106086.0000000002DDF000.00000004.00000800.00020000.00000000.sdmp, zapytanie 2025.exe, 00000003.00000002.3298106086.0000000002DCF000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program Manager@\]q
Source: zapytanie 2025.exe, 00000003.00000002.3298106086.0000000002DFF000.00000004.00000800.00020000.00000000.sdmp, zapytanie 2025.exe, 00000003.00000002.3298106086.0000000002DDF000.00000004.00000800.00020000.00000000.sdmp, zapytanie 2025.exe, 00000003.00000002.3298106086.0000000002DCF000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program Manager
Source: zapytanie 2025.exe, 00000003.00000002.3298106086.0000000002DFF000.00000004.00000800.00020000.00000000.sdmp, zapytanie 2025.exe, 00000003.00000002.3298106086.0000000002DCF000.00000004.00000800.00020000.00000000.sdmp, zapytanie 2025.exe, 00000003.00000002.3298106086.0000000002DDB000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program Manager@\]q%
Source: zapytanie 2025.exe, 00000003.00000002.3298106086.0000000002DCF000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program ManagerTe]qX
Source: zapytanie 2025.exe, 00000003.00000002.3298106086.0000000002DCF000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program ManagerTe]q8
Source: zapytanie 2025.exe, 00000003.00000002.3298106086.0000000002DFF000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program ManagerTe]qDG
Source: zapytanie 2025.exe, 00000003.00000002.3298106086.0000000002DFF000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program ManagerTe]q$I
Source: zapytanie 2025.exe, 00000003.00000002.3298106086.0000000002DDB000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program ManagerTe]q

Source: C:\Users\user\Desktop\zapytanie 2025.exe	Queries volume information: C:\Users\user\Desktop\zapytanie 2025.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\zapytanie 2025.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\zapytanie 2025.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\zapytanie 2025.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\zapytanie 2025.exe	Queries volume information: C:\Windows\Fonts\micross.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\zapytanie 2025.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\zapytanie 2025.exe	Queries volume information: C:\Users\user\Desktop\zapytanie 2025.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\zapytanie 2025.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\zapytanie 2025.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior

Source: C:\Users\user\Desktop\zapytanie 2025.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Lowering of HIPS / PFW / Operating System Security Settings

Yara detected AsyncRAT

Source: Yara match	File source: 0.2.zapytanie 2025.exe.28718d0.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.zapytanie 2025.exe.28663f0.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.zapytanie 2025.exe.28718d0.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.2.zapytanie 2025.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.zapytanie 2025.exe.28663f0.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000003.00000002.3296481390.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.3298106086.0000000002D71000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2052998629.0000000002801000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: zapytanie 2025.exe PID: 1012, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: zapytanie 2025.exe PID: 6508, type: MEMORYSTR

Source: zapytanie 2025.exe, 00000003.00000002.3296784648.00000000010B0000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: %ProgramFiles%\Windows Defender\MsMpeng.exe

Source: C:\Users\user\Desktop\zapytanie 2025.exe

WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * from AntivirusProduct

Stealing of Sensitive Information

Yara detected PureLog Stealer

Source: Yara match	File source: 0.2.zapytanie 2025.exe.38262a8.7.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.zapytanie 2025.exe.38262a8.7.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.zapytanie 2025.exe.6a50000.8.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.zapytanie 2025.exe.2c88650.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.zapytanie 2025.exe.6a50000.8.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.zapytanie 2025.exe.2c88650.4.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.zapytanie 2025.exe.2a66918.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.zapytanie 2025.exe.29adf80.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000002.2053805650.0000000003809000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2056404178.0000000006A50000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2052998629.0000000002962000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY

Remote Access Functionality

Yara detected PureLog Stealer

Source: Yara match	File source: 0.2.zapytanie 2025.exe.38262a8.7.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.zapytanie 2025.exe.38262a8.7.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.zapytanie 2025.exe.6a50000.8.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.zapytanie 2025.exe.2c88650.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.zapytanie 2025.exe.6a50000.8.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.zapytanie 2025.exe.2c88650.4.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.zapytanie 2025.exe.2a66918.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.zapytanie 2025.exe.29adf80.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000002.2053805650.0000000003809000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2056404178.0000000006A50000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2052998629.0000000002962000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	1 Windows Management Instrumentation	1 Scheduled Task/Job	112 Process Injection	1 Masquerading	OS Credential Dumping	121 Security Software Discovery	Remote Services	1 Archive Collected Data	1 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	1 Scheduled Task/Job	1 DLL Side-Loading	1 Scheduled Task/Job	1 Disable or Modify Tools	LSASS Memory	1 Process Discovery	Remote Desktop Protocol	Data from Removable Media	1 Non-Standard Port	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	1 DLL Side-Loading	31 Virtualization/Sandbox Evasion	Security Account Manager	31 Virtualization/Sandbox Evasion	SMB/Windows Admin Shares	Data from Network Shared Drive	1 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	112 Process Injection	NTDS	1 Application Window Discovery	Distributed Component Object Model	Input Capture	11 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	12 Obfuscated Files or Information	LSA Secrets	13 System Information Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	2 Software Packing	Cached Domain Credentials	Wi-Fi Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	1 Timestomp	DCSync	Remote System Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	1 DLL Side-Loading	Proc Filesystem	System Owner/User Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Link
zapytanie 2025.exe	44%	Virustotal	Browse
zapytanie 2025.exe	34%	ReversingLabs
zapytanie 2025.exe	100%	Joe Sandbox ML

Source	Detection	Scanner	Label	Link
quin.ydns.eu	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
quin.ydns.eu	unknown	unknown	true		unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
quin.ydns.eu	true	Avira URL Cloud: safe	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	zapytanie 2025.exe, 00000003.00000002.3298106086.0000000002D71000.00000004.00000800.00020000.00000000.sdmp	false		high
http://tempuri.org/DataSet1.xsd	zapytanie 2025.exe	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
185.38.142.240	unknown	Portugal		47674	NETSOLUTIONSNL	true

General Information

Joe Sandbox version:	42.0.0 Malachite
Analysis ID:	1589896
Start date and time:	2025-01-13 10:02:10 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 4m 55s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	6
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	zapytanie 2025.exe
Detection:	MAL
Classification:	mal100.troj.evad.winEXE@3/1@3/1
EGA Information:	Successful, ratio: 50%
HCA Information:	Successful, ratio: 99% Number of executed functions: 103 Number of non-executed functions: 12
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, WMIADAP.exe, SIHClient.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 184.28.90.27, 172.202.163.200, 13.107.246.45
Excluded domains from analysis (whitelisted): fs.microsoft.com, ocsp.digicert.com, slscr.update.microsoft.com, otelrules.azureedge.net, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com
Execution Graph export aborted for target zapytanie 2025.exe, PID 6508 because it is empty
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Report size getting too big, too many NtReadVirtualMemory calls found.

Simulations

Behavior and APIs

Time	Type	Description
04:03:01	API Interceptor	1x Sleep call for process: zapytanie 2025.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
185.38.142.240	PRESUPUEST.exe	Get hash	malicious	AsyncRAT	Browse
	Aviso de transferencia.exe	Get hash	malicious	AsyncRAT, PureLog Stealer	Browse
	rUAE_LPO.com.exe	Get hash	malicious	AsyncRAT, PureLog Stealer	Browse

Domains

⊘No context

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
NETSOLUTIONSNL	46VHQmFDxC.exe	Get hash	malicious	RedLine	Browse	185.38.142.167
	ds1bfe33xg.exe	Get hash	malicious	RedLine	Browse	185.38.142.167
	PRESUPUEST.exe	Get hash	malicious	AsyncRAT	Browse	185.38.142.240
	Aviso de transferencia.exe	Get hash	malicious	AsyncRAT, PureLog Stealer	Browse	185.38.142.240
	rUAE_LPO.com.exe	Get hash	malicious	AsyncRAT, PureLog Stealer	Browse	185.38.142.240
	A9BripDhRY.lnk	Get hash	malicious	Unknown	Browse	185.38.142.128
	93.123.85.253-bot.armv4l-2024-08-28T17_49_11.elf	Get hash	malicious	Unknown	Browse	188.93.233.79
	a591d3d035cf90395ad1078a415a46b5b44dd813496291b702fe36cfb22dee36_dump.exe	Get hash	malicious	RedLine	Browse	185.38.142.10
	b3u71vBG0u.exe	Get hash	malicious	RedLine	Browse	185.38.142.10
	2MbHBiqXH2.rtf	Get hash	malicious	RedLine	Browse	185.38.142.10

Process:	C:\Users\user\Desktop\zapytanie 2025.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1216
Entropy (8bit):	5.34331486778365
Encrypted:	false
SSDEEP:	24:MLUE4K5E4KH1qE4qXKDE4KhKiKhPKIE4oKNzKoZAE4Kze0E4x84j:MIHK5HKH1qHiYHKh3oPtHo6hAHKze0HJ
MD5:	1330C80CAAC9A0FB172F202485E9B1E8
SHA1:	86BAFDA4E4AE68C7C3012714A33D85D2B6E1A492
SHA-256:	B6C63ECE799A8F7E497C2A158B1FFC2F5CB4F745A2F8E585F794572B7CF03560
SHA-512:	75A17AB129FE97BBAB36AA2BD66D59F41DB5AFF44A705EF3E4D094EC5FCD056A3ED59992A0AC96C9D0D40E490F8596B07DCA9B60E606B67223867B061D9D0EB2
Malicious:	true
Reputation:	high, very likely benign file
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..2,"System.Windows.Forms, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089",0..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System\920e3d1d70447c3c10e69e6df0766568\System.ni.dll",0..2,"System.Drawing, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a",0..3,"System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Core\8b2c1203fd20aea8260bfbc518004720\System.Core.ni.dll",0..3,"System.Configuration, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Configuration\2192b0d5aa4aa14486ae08118d3b9fcc\System.Configuration.ni.dll",0..3,"System.Xml, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Xml\2062ed810929ec0e33254c02

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Entropy (8bit):	7.641338470740373
TrID:	Win32 Executable (generic) Net Framework (10011505/4) 49.83% Win32 Executable (generic) a (10002005/4) 49.78% Generic CIL Executable (.NET, Mono, etc.) (73296/58) 0.36% Generic Win/DOS Executable (2004/3) 0.01% DOS Executable Generic (2002/1) 0.01%
File name:	zapytanie 2025.exe
File size:	702'976 bytes
MD5:	15fe2ac3357c534e280cc8d9de964aed
SHA1:	af1e4824a0a4954c69fe91b6ad54e66a4f3a7511
SHA256:	441c8c73ea3f781774e9ee684d4d51127ec736c9fb6423fad0aea20695abd3c3
SHA512:	c32bfa3d04b1e67b2019afd9ee25b136e1880279f32a17a30128d2e574eb19578996167015cb620b91e3380186bc20b997045db426d4420ea4e1977b730acbdc
SSDEEP:	12288:r8dStNKcItS4StNKcItSfl12tZ9uLUxL7HNHJTs2aInH5am38Dj11WWh2fab8fXk:r8yNK1t4NK1tOqLBCIHom383WxfaoXpe
TLSH:	EBE4F1203A9ADB03C0A66FF41521E2B457B45E8DAA21D3079FDA3DEF7C77B042944A53
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....T................0.................. ........@.. ....................... ............@................................

File Icon


Icon Hash:	00928e8e8686b000

Static PE Info

General

Entrypoint:	0x4acfae
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
Time Stamp:	0xF2C954B2 [Wed Jan 28 10:51:30 2099 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:	f34d5f2d4577ed6d9ceec516c1f5a744

Entrypoint Preview

Instruction
jmp dword ptr [00402000h]
call far 0000h : 003E9999h
aas
int CCh
dec esp
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0xacf5b	0x4f	.text
IMAGE_DIRECTORY_ENTRY_RESOURCE	0xae000	0x594	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0xb0000	0xc	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0xaaaa8	0x70	.text
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x2000	0x8	.text
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x2008	0x48	.text
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x2000	0xaafc4	0xab000	5f546096487be6875767caa1600203c0	False	0.8826183296783626	data	7.64947126519897	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rsrc	0xae000	0x594	0x600	9ad58527891a2a6016ce6039f19eae9d	False	0.4134114583333333	data	4.032472233215396	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0xb0000	0xc	0x200	cdd4228ce5fef9938235403e72991139	False	0.044921875	data	0.10191042566270775	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_VERSION	0xae090	0x304	data			0.4326424870466321
RT_MANIFEST	0xae3a4	0x1ea	XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators			0.5489795918367347

Imports

DLL	Import
mscoree.dll	_CorExeMain

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2025-01-13T10:03:23.576128+0100	2842478	ETPRO JA3 Hash - Suspected ASYNCRAT Server Cert (ja3s)	1	185.38.142.240	1940	192.168.2.5	49724	TCP
2025-01-13T10:03:23.576128+0100	2030673	ET MALWARE Observed Malicious SSL Cert (AsyncRAT Server)	1	185.38.142.240	1940	192.168.2.5	49724	TCP
2025-01-13T10:03:23.576128+0100	2035595	ET MALWARE Generic AsyncRAT Style SSL Cert	1	185.38.142.240	1940	192.168.2.5	49724	TCP
2025-01-13T10:03:23.576128+0100	2035607	ET MALWARE Observed Malicious SSL Cert (AsyncRAT Server)	1	185.38.142.240	1940	192.168.2.5	49724	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 13, 2025 10:03:22.889520884 CET	49724	1940	192.168.2.5	185.38.142.240
Jan 13, 2025 10:03:22.894460917 CET	1940	49724	185.38.142.240	192.168.2.5
Jan 13, 2025 10:03:22.894575119 CET	49724	1940	192.168.2.5	185.38.142.240
Jan 13, 2025 10:03:22.907658100 CET	49724	1940	192.168.2.5	185.38.142.240
Jan 13, 2025 10:03:22.912506104 CET	1940	49724	185.38.142.240	192.168.2.5
Jan 13, 2025 10:03:23.552273989 CET	1940	49724	185.38.142.240	192.168.2.5
Jan 13, 2025 10:03:23.552326918 CET	1940	49724	185.38.142.240	192.168.2.5
Jan 13, 2025 10:03:23.552436113 CET	49724	1940	192.168.2.5	185.38.142.240
Jan 13, 2025 10:03:23.571294069 CET	49724	1940	192.168.2.5	185.38.142.240
Jan 13, 2025 10:03:23.576128006 CET	1940	49724	185.38.142.240	192.168.2.5
Jan 13, 2025 10:03:24.257055998 CET	1940	49724	185.38.142.240	192.168.2.5
Jan 13, 2025 10:03:24.297278881 CET	49724	1940	192.168.2.5	185.38.142.240
Jan 13, 2025 10:03:24.481025934 CET	49724	1940	192.168.2.5	185.38.142.240
Jan 13, 2025 10:03:24.487875938 CET	1940	49724	185.38.142.240	192.168.2.5
Jan 13, 2025 10:03:24.487952948 CET	49724	1940	192.168.2.5	185.38.142.240
Jan 13, 2025 10:03:24.494456053 CET	1940	49724	185.38.142.240	192.168.2.5
Jan 13, 2025 10:03:25.977696896 CET	1940	49724	185.38.142.240	192.168.2.5
Jan 13, 2025 10:03:26.031606913 CET	49724	1940	192.168.2.5	185.38.142.240
Jan 13, 2025 10:03:26.095381975 CET	1940	49724	185.38.142.240	192.168.2.5
Jan 13, 2025 10:03:26.140875101 CET	49724	1940	192.168.2.5	185.38.142.240
Jan 13, 2025 10:03:37.126183033 CET	49724	1940	192.168.2.5	185.38.142.240
Jan 13, 2025 10:03:37.131218910 CET	1940	49724	185.38.142.240	192.168.2.5
Jan 13, 2025 10:03:37.131294966 CET	49724	1940	192.168.2.5	185.38.142.240
Jan 13, 2025 10:03:37.136086941 CET	1940	49724	185.38.142.240	192.168.2.5
Jan 13, 2025 10:03:37.574894905 CET	1940	49724	185.38.142.240	192.168.2.5
Jan 13, 2025 10:03:37.625461102 CET	49724	1940	192.168.2.5	185.38.142.240
Jan 13, 2025 10:03:37.705136061 CET	1940	49724	185.38.142.240	192.168.2.5
Jan 13, 2025 10:03:37.707472086 CET	49724	1940	192.168.2.5	185.38.142.240
Jan 13, 2025 10:03:37.712337017 CET	1940	49724	185.38.142.240	192.168.2.5
Jan 13, 2025 10:03:37.712397099 CET	49724	1940	192.168.2.5	185.38.142.240
Jan 13, 2025 10:03:37.717139959 CET	1940	49724	185.38.142.240	192.168.2.5
Jan 13, 2025 10:03:49.782661915 CET	49724	1940	192.168.2.5	185.38.142.240
Jan 13, 2025 10:03:49.787609100 CET	1940	49724	185.38.142.240	192.168.2.5
Jan 13, 2025 10:03:49.787686110 CET	49724	1940	192.168.2.5	185.38.142.240
Jan 13, 2025 10:03:49.792655945 CET	1940	49724	185.38.142.240	192.168.2.5
Jan 13, 2025 10:03:50.382143021 CET	1940	49724	185.38.142.240	192.168.2.5
Jan 13, 2025 10:03:50.437969923 CET	49724	1940	192.168.2.5	185.38.142.240
Jan 13, 2025 10:03:50.509856939 CET	1940	49724	185.38.142.240	192.168.2.5
Jan 13, 2025 10:03:50.522011042 CET	49724	1940	192.168.2.5	185.38.142.240
Jan 13, 2025 10:03:50.526900053 CET	1940	49724	185.38.142.240	192.168.2.5
Jan 13, 2025 10:03:50.526956081 CET	49724	1940	192.168.2.5	185.38.142.240
Jan 13, 2025 10:03:50.531846046 CET	1940	49724	185.38.142.240	192.168.2.5
Jan 13, 2025 10:03:55.993263006 CET	1940	49724	185.38.142.240	192.168.2.5
Jan 13, 2025 10:03:56.047493935 CET	49724	1940	192.168.2.5	185.38.142.240
Jan 13, 2025 10:03:56.121965885 CET	1940	49724	185.38.142.240	192.168.2.5
Jan 13, 2025 10:03:56.172369957 CET	49724	1940	192.168.2.5	185.38.142.240
Jan 13, 2025 10:04:02.438517094 CET	49724	1940	192.168.2.5	185.38.142.240
Jan 13, 2025 10:04:02.443458080 CET	1940	49724	185.38.142.240	192.168.2.5
Jan 13, 2025 10:04:02.443515062 CET	49724	1940	192.168.2.5	185.38.142.240
Jan 13, 2025 10:04:02.448385954 CET	1940	49724	185.38.142.240	192.168.2.5
Jan 13, 2025 10:04:02.732140064 CET	1940	49724	185.38.142.240	192.168.2.5
Jan 13, 2025 10:04:02.781800032 CET	49724	1940	192.168.2.5	185.38.142.240
Jan 13, 2025 10:04:02.862020969 CET	1940	49724	185.38.142.240	192.168.2.5
Jan 13, 2025 10:04:02.863992929 CET	49724	1940	192.168.2.5	185.38.142.240
Jan 13, 2025 10:04:02.868858099 CET	1940	49724	185.38.142.240	192.168.2.5
Jan 13, 2025 10:04:02.868915081 CET	49724	1940	192.168.2.5	185.38.142.240
Jan 13, 2025 10:04:02.873797894 CET	1940	49724	185.38.142.240	192.168.2.5
Jan 13, 2025 10:04:15.094880104 CET	49724	1940	192.168.2.5	185.38.142.240
Jan 13, 2025 10:04:15.099993944 CET	1940	49724	185.38.142.240	192.168.2.5
Jan 13, 2025 10:04:15.100161076 CET	49724	1940	192.168.2.5	185.38.142.240
Jan 13, 2025 10:04:15.105093002 CET	1940	49724	185.38.142.240	192.168.2.5
Jan 13, 2025 10:04:15.396262884 CET	1940	49724	185.38.142.240	192.168.2.5
Jan 13, 2025 10:04:15.438127995 CET	49724	1940	192.168.2.5	185.38.142.240
Jan 13, 2025 10:04:15.526149035 CET	1940	49724	185.38.142.240	192.168.2.5
Jan 13, 2025 10:04:15.527518988 CET	49724	1940	192.168.2.5	185.38.142.240
Jan 13, 2025 10:04:15.532368898 CET	1940	49724	185.38.142.240	192.168.2.5
Jan 13, 2025 10:04:15.532428026 CET	49724	1940	192.168.2.5	185.38.142.240
Jan 13, 2025 10:04:15.537308931 CET	1940	49724	185.38.142.240	192.168.2.5
Jan 13, 2025 10:04:26.603774071 CET	1940	49724	185.38.142.240	192.168.2.5
Jan 13, 2025 10:04:26.661753893 CET	49724	1940	192.168.2.5	185.38.142.240
Jan 13, 2025 10:04:26.734409094 CET	1940	49724	185.38.142.240	192.168.2.5
Jan 13, 2025 10:04:26.782092094 CET	49724	1940	192.168.2.5	185.38.142.240
Jan 13, 2025 10:04:27.835112095 CET	49724	1940	192.168.2.5	185.38.142.240
Jan 13, 2025 10:04:27.840270042 CET	1940	49724	185.38.142.240	192.168.2.5
Jan 13, 2025 10:04:27.840342999 CET	49724	1940	192.168.2.5	185.38.142.240
Jan 13, 2025 10:04:27.845246077 CET	1940	49724	185.38.142.240	192.168.2.5
Jan 13, 2025 10:04:28.340081930 CET	1940	49724	185.38.142.240	192.168.2.5
Jan 13, 2025 10:04:28.391469955 CET	49724	1940	192.168.2.5	185.38.142.240
Jan 13, 2025 10:04:28.472141027 CET	1940	49724	185.38.142.240	192.168.2.5
Jan 13, 2025 10:04:28.473536968 CET	49724	1940	192.168.2.5	185.38.142.240
Jan 13, 2025 10:04:28.478427887 CET	1940	49724	185.38.142.240	192.168.2.5
Jan 13, 2025 10:04:28.478497982 CET	49724	1940	192.168.2.5	185.38.142.240
Jan 13, 2025 10:04:28.483378887 CET	1940	49724	185.38.142.240	192.168.2.5
Jan 13, 2025 10:04:40.438708067 CET	49724	1940	192.168.2.5	185.38.142.240
Jan 13, 2025 10:04:40.443981886 CET	1940	49724	185.38.142.240	192.168.2.5
Jan 13, 2025 10:04:40.444168091 CET	49724	1940	192.168.2.5	185.38.142.240
Jan 13, 2025 10:04:40.449454069 CET	1940	49724	185.38.142.240	192.168.2.5
Jan 13, 2025 10:04:41.025719881 CET	1940	49724	185.38.142.240	192.168.2.5
Jan 13, 2025 10:04:41.078938961 CET	49724	1940	192.168.2.5	185.38.142.240
Jan 13, 2025 10:04:41.158514023 CET	1940	49724	185.38.142.240	192.168.2.5
Jan 13, 2025 10:04:41.160013914 CET	49724	1940	192.168.2.5	185.38.142.240
Jan 13, 2025 10:04:41.165150881 CET	1940	49724	185.38.142.240	192.168.2.5
Jan 13, 2025 10:04:41.165229082 CET	49724	1940	192.168.2.5	185.38.142.240
Jan 13, 2025 10:04:41.170253038 CET	1940	49724	185.38.142.240	192.168.2.5
Jan 13, 2025 10:04:53.095186949 CET	49724	1940	192.168.2.5	185.38.142.240
Jan 13, 2025 10:04:53.100253105 CET	1940	49724	185.38.142.240	192.168.2.5
Jan 13, 2025 10:04:53.100344896 CET	49724	1940	192.168.2.5	185.38.142.240
Jan 13, 2025 10:04:53.105190039 CET	1940	49724	185.38.142.240	192.168.2.5
Jan 13, 2025 10:04:53.388775110 CET	1940	49724	185.38.142.240	192.168.2.5
Jan 13, 2025 10:04:53.438446999 CET	49724	1940	192.168.2.5	185.38.142.240
Jan 13, 2025 10:04:53.519639015 CET	1940	49724	185.38.142.240	192.168.2.5
Jan 13, 2025 10:04:53.521285057 CET	49724	1940	192.168.2.5	185.38.142.240
Jan 13, 2025 10:04:53.526122093 CET	1940	49724	185.38.142.240	192.168.2.5
Jan 13, 2025 10:04:53.526174068 CET	49724	1940	192.168.2.5	185.38.142.240
Jan 13, 2025 10:04:53.531058073 CET	1940	49724	185.38.142.240	192.168.2.5
Jan 13, 2025 10:04:55.999870062 CET	1940	49724	185.38.142.240	192.168.2.5
Jan 13, 2025 10:04:56.047832966 CET	49724	1940	192.168.2.5	185.38.142.240
Jan 13, 2025 10:04:56.129040956 CET	1940	49724	185.38.142.240	192.168.2.5
Jan 13, 2025 10:04:56.172792912 CET	49724	1940	192.168.2.5	185.38.142.240
Jan 13, 2025 10:05:05.755537987 CET	49724	1940	192.168.2.5	185.38.142.240
Jan 13, 2025 10:05:05.760693073 CET	1940	49724	185.38.142.240	192.168.2.5
Jan 13, 2025 10:05:05.760756016 CET	49724	1940	192.168.2.5	185.38.142.240
Jan 13, 2025 10:05:05.765595913 CET	1940	49724	185.38.142.240	192.168.2.5
Jan 13, 2025 10:05:06.061837912 CET	1940	49724	185.38.142.240	192.168.2.5
Jan 13, 2025 10:05:06.110374928 CET	49724	1940	192.168.2.5	185.38.142.240
Jan 13, 2025 10:05:06.191827059 CET	1940	49724	185.38.142.240	192.168.2.5
Jan 13, 2025 10:05:06.196012020 CET	49724	1940	192.168.2.5	185.38.142.240
Jan 13, 2025 10:05:06.200931072 CET	1940	49724	185.38.142.240	192.168.2.5
Jan 13, 2025 10:05:06.200987101 CET	49724	1940	192.168.2.5	185.38.142.240
Jan 13, 2025 10:05:06.205837965 CET	1940	49724	185.38.142.240	192.168.2.5
Jan 13, 2025 10:05:08.360667944 CET	49724	1940	192.168.2.5	185.38.142.240
Jan 13, 2025 10:05:08.365814924 CET	1940	49724	185.38.142.240	192.168.2.5
Jan 13, 2025 10:05:08.365878105 CET	49724	1940	192.168.2.5	185.38.142.240
Jan 13, 2025 10:05:08.370773077 CET	1940	49724	185.38.142.240	192.168.2.5
Jan 13, 2025 10:05:08.661606073 CET	1940	49724	185.38.142.240	192.168.2.5
Jan 13, 2025 10:05:08.704149961 CET	49724	1940	192.168.2.5	185.38.142.240
Jan 13, 2025 10:05:08.894717932 CET	1940	49724	185.38.142.240	192.168.2.5
Jan 13, 2025 10:05:08.898648977 CET	49724	1940	192.168.2.5	185.38.142.240
Jan 13, 2025 10:05:08.903575897 CET	1940	49724	185.38.142.240	192.168.2.5
Jan 13, 2025 10:05:08.904208899 CET	49724	1940	192.168.2.5	185.38.142.240
Jan 13, 2025 10:05:08.909069061 CET	1940	49724	185.38.142.240	192.168.2.5

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 13, 2025 10:03:07.793204069 CET	61992	53	192.168.2.5	1.1.1.1
Jan 13, 2025 10:03:07.807765961 CET	53	61992	1.1.1.1	192.168.2.5
Jan 13, 2025 10:03:12.814002991 CET	63311	53	192.168.2.5	1.1.1.1
Jan 13, 2025 10:03:12.833627939 CET	53	63311	1.1.1.1	192.168.2.5
Jan 13, 2025 10:03:17.844820023 CET	59761	53	192.168.2.5	1.1.1.1
Jan 13, 2025 10:03:17.870762110 CET	53	59761	1.1.1.1	192.168.2.5

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Jan 13, 2025 10:03:07.793204069 CET	192.168.2.5	1.1.1.1	0xbd9d	Standard query (0)	quin.ydns.eu	A (IP address)	IN (0x0001)	false
Jan 13, 2025 10:03:12.814002991 CET	192.168.2.5	1.1.1.1	0x5f42	Standard query (0)	quin.ydns.eu	A (IP address)	IN (0x0001)	false
Jan 13, 2025 10:03:17.844820023 CET	192.168.2.5	1.1.1.1	0x15cc	Standard query (0)	quin.ydns.eu	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Jan 13, 2025 10:03:07.807765961 CET	1.1.1.1	192.168.2.5	0xbd9d	Name error (3)	quin.ydns.eu	none	none	A (IP address)	IN (0x0001)	false
Jan 13, 2025 10:03:12.833627939 CET	1.1.1.1	192.168.2.5	0x5f42	Name error (3)	quin.ydns.eu	none	none	A (IP address)	IN (0x0001)	false
Jan 13, 2025 10:03:17.870762110 CET	1.1.1.1	192.168.2.5	0x15cc	Name error (3)	quin.ydns.eu	none	none	A (IP address)	IN (0x0001)	false

Target ID:	0
Start time:	04:03:01
Start date:	13/01/2025
Path:	C:\Users\user\Desktop\zapytanie 2025.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\zapytanie 2025.exe"
Imagebase:	0x460000
File size:	702'976 bytes
MD5 hash:	15FE2AC3357C534E280CC8D9DE964AED
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_PureLogStealer, Description: Yara detected PureLog Stealer, Source: 00000000.00000002.2053805650.0000000003809000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_PureLogStealer, Description: Yara detected PureLog Stealer, Source: 00000000.00000002.2056404178.0000000006A50000.00000004.08000000.00040000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_AsyncRAT, Description: Yara detected AsyncRAT, Source: 00000000.00000002.2052998629.0000000002801000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Asyncrat_11a11ba1, Description: unknown, Source: 00000000.00000002.2052998629.0000000002801000.00000004.00000800.00020000.00000000.sdmp, Author: unknown Rule: INDICATOR_SUSPICIOUS_EXE_ASEP_REG_Reverse, Description: Detects file containing reversed ASEP Autorun registry keys, Source: 00000000.00000002.2052998629.0000000002801000.00000004.00000800.00020000.00000000.sdmp, Author: ditekSHen Rule: JoeSecurity_PureLogStealer, Description: Yara detected PureLog Stealer, Source: 00000000.00000002.2052998629.0000000002962000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	04:03:01
Start date:	13/01/2025
Path:	C:\Users\user\Desktop\zapytanie 2025.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\zapytanie 2025.exe"
Imagebase:	0xa30000
File size:	702'976 bytes
MD5 hash:	15FE2AC3357C534E280CC8D9DE964AED
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_AsyncRAT, Description: Yara detected AsyncRAT, Source: 00000003.00000002.3296481390.0000000000402000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security Rule: INDICATOR_SUSPICIOUS_EXE_ASEP_REG_Reverse, Description: Detects file containing reversed ASEP Autorun registry keys, Source: 00000003.00000002.3296481390.0000000000402000.00000040.00000400.00020000.00000000.sdmp, Author: ditekSHen Rule: JoeSecurity_AsyncRAT, Description: Yara detected AsyncRAT, Source: 00000003.00000002.3298106086.0000000002D71000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	false

Show Windows behavior

Execution Graph

Execution Coverage:	10%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	0%
Total number of Nodes:	193
Total number of Limit Nodes:	12

Executed Functions

Function 08BBB468 Relevance: 7.0, Strings: 5, Instructions: 724COMMON

Download Yara Rule

Strings

(o]q, xrefs: 08BBBCF1
,aq, xrefs: 08BBBA7F
Haq, xrefs: 08BBBD68
,aq, xrefs: 08BBBA8F
(o]q, xrefs: 08BBBCFB

Memory Dump Source

Source File: 00000000.00000002.2057303306.0000000008BB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 08BB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8bb0000_zapytanie 2025.jbxd

Similarity

API ID:
String ID: (o]q$(o]q$,aq$,aq$Haq
API String ID: 0-2157538030
Opcode ID: 4f1351610077207b986dfa2d1e81ccbb489c99621324655178342b6cc3550a4d
Instruction ID: ee1b036ee63dd1edb65022d0266b26cedbaf77ebb03446168fe77d58f376307f
Opcode Fuzzy Hash: 4f1351610077207b986dfa2d1e81ccbb489c99621324655178342b6cc3550a4d
Instruction Fuzzy Hash: B4528034A00519DFCB18DF69D494ABD7BB2FF88321B1585A9E806DB364DB75EC02CB90

Function 08BBED58 Relevance: 6.8, Strings: 5, Instructions: 591
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

,aq, xrefs: 08BBF1D7
Haq, xrefs: 08BBF47F
,aq, xrefs: 08BBF1E3
(o]q, xrefs: 08BBF211
(o]q, xrefs: 08BBF205

Memory Dump Source

Source File: 00000000.00000002.2057303306.0000000008BB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 08BB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8bb0000_zapytanie 2025.jbxd

Similarity

API ID:
String ID: (o]q$(o]q$,aq$,aq$Haq
API String ID: 0-2157538030
Opcode ID: 61c2d51191d0584ff10e08f1962e0fa5558bcf88324cb1f70498b9081b124162
Instruction ID: 0e30807d6c74ce894702db2a434b6b62b5e29b632f9cff8526b0d85ad16a42b9
Opcode Fuzzy Hash: 61c2d51191d0584ff10e08f1962e0fa5558bcf88324cb1f70498b9081b124162
Instruction Fuzzy Hash: BC226D34B00215CFCB15DF69D954ABE7BA6EF88302F1584A9E8059B361CB75EC42CBA1

Function 08BB0006 Relevance: 4.6, Instructions: 4580
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000000.00000002.2057303306.0000000008BB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 08BB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8bb0000_zapytanie 2025.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 06461bdafce33f19decaba2bbd3affa31ad5b78b0c28d2bfd7557ec891b73e3e
Instruction ID: a1045b4ccf85eb4448aca34aeb1e40f811b71aed03eae311c0c17a9caa5704f9
Opcode Fuzzy Hash: 06461bdafce33f19decaba2bbd3affa31ad5b78b0c28d2bfd7557ec891b73e3e
Instruction Fuzzy Hash: ABB3F634A11619CFDB24EF64C884A99B3F2FF89304F1196E9D4486B361DB31AE85CF91

Function 08BB0040 Relevance: 4.6, Instructions: 4562
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000000.00000002.2057303306.0000000008BB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 08BB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8bb0000_zapytanie 2025.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ebaed12e2452fd861cb49df0115122ebe79e9abd08401d6add70ab4deab37983
Instruction ID: 946ff44d825c6d4c71fba9b174ca6af55a12ab4059f44cdee10ec9f1d4c7b01c
Opcode Fuzzy Hash: ebaed12e2452fd861cb49df0115122ebe79e9abd08401d6add70ab4deab37983
Instruction Fuzzy Hash: 31B3F634A11619CFDB24EF64C884A99B3F2FF89304F1196E9D4486B361DB31AE85CF91

Function 08BB56E8 Relevance: 3.4, Instructions: 3434
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000000.00000002.2057303306.0000000008BB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 08BB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8bb0000_zapytanie 2025.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7af42c2e2d8290d3da96151e4b05d31e6fe404b8afab1f0a4b3d40df6a78a6e4
Instruction ID: 90d3ef5fc8a998c26a27133a2bd953b94a0b8cd19fae4eb0cf283b468b1360f2
Opcode Fuzzy Hash: 7af42c2e2d8290d3da96151e4b05d31e6fe404b8afab1f0a4b3d40df6a78a6e4
Instruction Fuzzy Hash: 98830734A11619CFEB24EF64C884AD9B3B2FF8A304F1146E9D4096B361DB31AE95CF51

Function 08BB56D9 Relevance: 3.4, Instructions: 3420
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000000.00000002.2057303306.0000000008BB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 08BB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8bb0000_zapytanie 2025.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ee4f0d036ea3522b074f1b6d3174777e066fa17dec15d66e3fc773cb9496c9b7
Instruction ID: 9b2d1a88891049174b600af923ba1e1dffbb7877913ae9b1c980973125cd48cf
Opcode Fuzzy Hash: ee4f0d036ea3522b074f1b6d3174777e066fa17dec15d66e3fc773cb9496c9b7
Instruction Fuzzy Hash: 28830734A11619CFEB24EF64C884AD9B3B2FF8A304F1146E9D4086B361DB31AE95CF51

Function 06E9DAD8 Relevance: .5, Instructions: 517COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2056777705.0000000006E90000.00000040.00000800.00020000.00000000.sdmp, Offset: 06E90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6e90000_zapytanie 2025.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a50ee34aaf3fde82dd8dbb3645a18d24514b5f975ef8e0b63e612145277e5232
Instruction ID: 01f969b6231d3b430cec99ff50c418992e1e0203f1ee2b6d1c93adad2ae91e4e
Opcode Fuzzy Hash: a50ee34aaf3fde82dd8dbb3645a18d24514b5f975ef8e0b63e612145277e5232
Instruction Fuzzy Hash: 18226D34B006148FDB48DF69D594AADBBF6EF88304F2591A9E515AB3A1CB30EC45CF60

Function 06E9B23D Relevance: 1.7, APIs: 1, Instructions: 248
processCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateProcessA.KERNELBASE(?,?,?,?,?,?,?,?,?,?), ref: 06E9B47E

Memory Dump Source

Source File: 00000000.00000002.2056777705.0000000006E90000.00000040.00000800.00020000.00000000.sdmp, Offset: 06E90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6e90000_zapytanie 2025.jbxd

Similarity

API ID: CreateProcess
String ID:
API String ID: 963392458-0
Opcode ID: 3f7ab5ee49761b7b6f09694d1d763f3dc9b28b6224bd6db4f5292d8c1c269dd9
Instruction ID: 4db05a3a05d939913b88456887934c3613c06faad63b044e812b2157e089dc3d
Opcode Fuzzy Hash: 3f7ab5ee49761b7b6f09694d1d763f3dc9b28b6224bd6db4f5292d8c1c269dd9
Instruction Fuzzy Hash: 33A14671D00319CFDF60DFA8D845BEEBAB2AF48304F148569E819A7240DB749985CFA1

Function 06E9B248 Relevance: 1.7, APIs: 1, Instructions: 243
processCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateProcessA.KERNELBASE(?,?,?,?,?,?,?,?,?,?), ref: 06E9B47E

Memory Dump Source

Source File: 00000000.00000002.2056777705.0000000006E90000.00000040.00000800.00020000.00000000.sdmp, Offset: 06E90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6e90000_zapytanie 2025.jbxd

Similarity

API ID: CreateProcess
String ID:
API String ID: 963392458-0
Opcode ID: 65e8486b4a18d70901653099ffdc8e175cdd3cc5da9208ee0fd768ab1f70ab19
Instruction ID: 48f105a92db778c6d04eb16f59e4afce5093d0c57909f679bb0cfb420caa91c8
Opcode Fuzzy Hash: 65e8486b4a18d70901653099ffdc8e175cdd3cc5da9208ee0fd768ab1f70ab19
Instruction Fuzzy Hash: C5914771D00319CFDF60DFA8D845BEEBAB2BF48304F14856AE818A7240DB749985CFA1

Function 00EEB261 Relevance: 1.7, APIs: 1, Instructions: 204
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleW.KERNELBASE(00000000), ref: 00EEB4C6

Memory Dump Source

Source File: 00000000.00000002.2052766286.0000000000EE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00EE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ee0000_zapytanie 2025.jbxd

Similarity

API ID: HandleModule
String ID:
API String ID: 4139908857-0
Opcode ID: 2c225736a11e71d2041d33bfa7d77e5a7a4e93e6dcb38ab07215989baaf55ca2
Instruction ID: 1d3221e1b3ce5dca19238f8d93e715c88315bc2f0806d8d21d8236ecad3a2ef5
Opcode Fuzzy Hash: 2c225736a11e71d2041d33bfa7d77e5a7a4e93e6dcb38ab07215989baaf55ca2
Instruction Fuzzy Hash: 25813370A00B898FD724DF6AD54579BBBF1BF88304F10892EE08AE7A51D775E805CB91

Function 00EE590C Relevance: 1.6, APIs: 1, Instructions: 99
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateActCtxA.KERNEL32(?), ref: 00EE59C9

Memory Dump Source

Source File: 00000000.00000002.2052766286.0000000000EE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00EE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ee0000_zapytanie 2025.jbxd

Similarity

API ID: Create
String ID:
API String ID: 2289755597-0
Opcode ID: 8d3dd99c4b57ac0949bee9459d356876b0b864004754d6922e610abe54d4ad9c
Instruction ID: 838ae70429f27f56907633f45defa45c02c5465c2532d881733cef5b03d967d4
Opcode Fuzzy Hash: 8d3dd99c4b57ac0949bee9459d356876b0b864004754d6922e610abe54d4ad9c
Instruction Fuzzy Hash: A741F4B1C0061DCFDB24CFAAC9857DDBBB1BF89308F20816AD408AB255D775594ACF51

Function 00EE4514 Relevance: 1.6, APIs: 1, Instructions: 96
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateActCtxA.KERNEL32(?), ref: 00EE59C9

Memory Dump Source

Source File: 00000000.00000002.2052766286.0000000000EE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00EE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ee0000_zapytanie 2025.jbxd

Similarity

API ID: Create
String ID:
API String ID: 2289755597-0
Opcode ID: 4b8bf3b567a11517f5d94b453cf742990d508a1c0049eb4880b77270e3e4077d
Instruction ID: 51857145c191b2844336eeaa836e2b45042895a2d1c6e1c80d6fdb56a5bdcac1
Opcode Fuzzy Hash: 4b8bf3b567a11517f5d94b453cf742990d508a1c0049eb4880b77270e3e4077d
Instruction Fuzzy Hash: B941E2B1C0071DCBDB24CFAAC944B9EBBB5BF49308F20806AD418BB255DB756949CF91

Function 06E9AFB9 Relevance: 1.6, APIs: 1, Instructions: 71injectionCOMMON

Download Yara Rule

APIs

WriteProcessMemory.KERNELBASE(?,?,00000000,?,?), ref: 06E9B050

Memory Dump Source

Source File: 00000000.00000002.2056777705.0000000006E90000.00000040.00000800.00020000.00000000.sdmp, Offset: 06E90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6e90000_zapytanie 2025.jbxd

Similarity

API ID: MemoryProcessWrite
String ID:
API String ID: 3559483778-0
Opcode ID: d214c501a9d9a9f50f24e559b64744b65b923677631fd0ec44290a197221ae95
Instruction ID: d1bbadde035aa6791f4cd5a6c253a33d4fc9dc81917afa49d45fbb7c3809b301
Opcode Fuzzy Hash: d214c501a9d9a9f50f24e559b64744b65b923677631fd0ec44290a197221ae95
Instruction Fuzzy Hash: A52135B19003099FCB10CFAAC981BEEBBF5FF48310F10842AE959A7240D7789940CBA0

Function 06E9AFC0 Relevance: 1.6, APIs: 1, Instructions: 69injectionCOMMON

Download Yara Rule

APIs

WriteProcessMemory.KERNELBASE(?,?,00000000,?,?), ref: 06E9B050

Memory Dump Source

Source File: 00000000.00000002.2056777705.0000000006E90000.00000040.00000800.00020000.00000000.sdmp, Offset: 06E90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6e90000_zapytanie 2025.jbxd

Similarity

API ID: MemoryProcessWrite
String ID:
API String ID: 3559483778-0
Opcode ID: 57329f4183d52ffc1b49ab538046a7091c5d5676ca5a85d487dc2154158c9d87
Instruction ID: e9cd826292c7d033188e58c271bb2eccc43f677e56f73a8790d6145e215607cd
Opcode Fuzzy Hash: 57329f4183d52ffc1b49ab538046a7091c5d5676ca5a85d487dc2154158c9d87
Instruction Fuzzy Hash: 482124B5900349DFCB10DFAAC985BEEBBF5FF48310F10842AE959A7250D7789944CBA0

Function 06E9B0A8 Relevance: 1.6, APIs: 1, Instructions: 66COMMON

Download Yara Rule

APIs

ReadProcessMemory.KERNELBASE(?,?,?,?,?), ref: 06E9B130

Memory Dump Source

Source File: 00000000.00000002.2056777705.0000000006E90000.00000040.00000800.00020000.00000000.sdmp, Offset: 06E90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6e90000_zapytanie 2025.jbxd

Similarity

API ID: MemoryProcessRead
String ID:
API String ID: 1726664587-0
Opcode ID: cb192a5c247a6ca4a176e437da4274d53c4fedde44dfea8ea4d6a05a03657460
Instruction ID: 929804379867fd3a17a63309a1c08772bea9535da7c0ae755c96eefbec8a513c
Opcode Fuzzy Hash: cb192a5c247a6ca4a176e437da4274d53c4fedde44dfea8ea4d6a05a03657460
Instruction Fuzzy Hash: CE212AB1D003599FCB10DFAAC885AEEFBF5FF48310F50842AE959A7250D7389545CBA1

Function 06E9AE20 Relevance: 1.6, APIs: 1, Instructions: 66threadCOMMON

Download Yara Rule

APIs

Wow64SetThreadContext.KERNEL32(?,00000000), ref: 06E9AEA6

Memory Dump Source

Source File: 00000000.00000002.2056777705.0000000006E90000.00000040.00000800.00020000.00000000.sdmp, Offset: 06E90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6e90000_zapytanie 2025.jbxd

Similarity

API ID: ContextThreadWow64
String ID:
API String ID: 983334009-0
Opcode ID: 422b3a084a6dd250bec6c5c5e34fd1e8b4bd1d2cebf7da0cd8076eca062f6fae
Instruction ID: 6054af89b9161a296d443a4efba4205289fa9a011346c7956032adec220fb36e
Opcode Fuzzy Hash: 422b3a084a6dd250bec6c5c5e34fd1e8b4bd1d2cebf7da0cd8076eca062f6fae
Instruction Fuzzy Hash: 992139B1D003098FDB50DFAAC4857EEBBF5EF88314F14842AD459A7241D7789985CFA1

Function 00EECDE0 Relevance: 1.6, APIs: 1, Instructions: 65COMMON

Download Yara Rule

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?,?,?,?,00EED706,?,?,?,?,?), ref: 00EED7C7

Memory Dump Source

Source File: 00000000.00000002.2052766286.0000000000EE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00EE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ee0000_zapytanie 2025.jbxd

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: cd7069f0e31b95f02fcda86677af0ec50bfacc84d946cad724b968e1e8e47102
Instruction ID: 40ca2a5f761c29a503fec460960fa409a68bfda787bedef7a3959a5a585ab9c4
Opcode Fuzzy Hash: cd7069f0e31b95f02fcda86677af0ec50bfacc84d946cad724b968e1e8e47102
Instruction Fuzzy Hash: 4221E6B590424C9FDB10CF9AD984ADEBBF8FB48310F14841AE914B3310D378A940CFA5

Function 00EED738 Relevance: 1.6, APIs: 1, Instructions: 64COMMON

Download Yara Rule

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?,?,?,?,00EED706,?,?,?,?,?), ref: 00EED7C7

Memory Dump Source

Source File: 00000000.00000002.2052766286.0000000000EE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00EE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ee0000_zapytanie 2025.jbxd

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: 398ea69d8fc908ff2c27798a144003b47a0922a622477137709c304f324b8803
Instruction ID: fff1f69d00b8195123d532b6df5c5250849658e25cb230b4189328cd9ee7c538
Opcode Fuzzy Hash: 398ea69d8fc908ff2c27798a144003b47a0922a622477137709c304f324b8803
Instruction Fuzzy Hash: 7D21E4B59042489FDB10CFAAD984ADEBFF4FB48310F14841AE918A7350C378A944CFA1

Function 06E9B0B0 Relevance: 1.6, APIs: 1, Instructions: 63COMMON

Download Yara Rule

APIs

ReadProcessMemory.KERNELBASE(?,?,?,?,?), ref: 06E9B130

Memory Dump Source

Source File: 00000000.00000002.2056777705.0000000006E90000.00000040.00000800.00020000.00000000.sdmp, Offset: 06E90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6e90000_zapytanie 2025.jbxd

Similarity

API ID: MemoryProcessRead
String ID:
API String ID: 1726664587-0
Opcode ID: 35d04354b9866d548ccb12dd1ccd156d1774288e407e7541d9c8e1a47101d279
Instruction ID: 88acb2459a4c1ab3cd2e00e6e64bdc94cd81c58cab0ad3b66a8a9b9805f7defc
Opcode Fuzzy Hash: 35d04354b9866d548ccb12dd1ccd156d1774288e407e7541d9c8e1a47101d279
Instruction Fuzzy Hash: 3C2107B1D003499FCB10DFAAC885AEEFBF5FF48310F50842AE959A7250D7789945CBA1

Function 06E9AE28 Relevance: 1.6, APIs: 1, Instructions: 63threadCOMMON

Download Yara Rule

APIs

Wow64SetThreadContext.KERNEL32(?,00000000), ref: 06E9AEA6

Memory Dump Source

Source File: 00000000.00000002.2056777705.0000000006E90000.00000040.00000800.00020000.00000000.sdmp, Offset: 06E90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6e90000_zapytanie 2025.jbxd

Similarity

API ID: ContextThreadWow64
String ID:
API String ID: 983334009-0
Opcode ID: fe21228ef964a386707d75c37eb41861653462ca7a574f03db8a641f3385a37c
Instruction ID: b2ba6fc792ff2bc2c1729ced7a8ef55281b8764f06a00f74d83eb41bfaf6b668
Opcode Fuzzy Hash: fe21228ef964a386707d75c37eb41861653462ca7a574f03db8a641f3385a37c
Instruction Fuzzy Hash: 7D2134B1D003098FDB10DFAAC4857EEBBF4EF88314F10842AD419A7240CB78A984CBA1

Function 06E9AEF9 Relevance: 1.6, APIs: 1, Instructions: 55memoryCOMMON

Download Yara Rule

APIs

VirtualAllocEx.KERNELBASE(?,?,?,?,?), ref: 06E9AF6E

Memory Dump Source

Source File: 00000000.00000002.2056777705.0000000006E90000.00000040.00000800.00020000.00000000.sdmp, Offset: 06E90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6e90000_zapytanie 2025.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 7ba3f449b6f6d3fad8fa2ccd4ab675afa25c305232a37beacc107cde6c88b85d
Instruction ID: 47d83bd743f992a89578ef49a8b73ea6fb946bdf7939a68538abbd2bacb8166b
Opcode Fuzzy Hash: 7ba3f449b6f6d3fad8fa2ccd4ab675afa25c305232a37beacc107cde6c88b85d
Instruction Fuzzy Hash: 661129B69002499FCF20DFAAC845BEEBBF5EF88314F248419E519A7250C7799941CFA1

Function 06E9AF00 Relevance: 1.6, APIs: 1, Instructions: 53memoryCOMMON

Download Yara Rule

APIs

VirtualAllocEx.KERNELBASE(?,?,?,?,?), ref: 06E9AF6E

Memory Dump Source

Source File: 00000000.00000002.2056777705.0000000006E90000.00000040.00000800.00020000.00000000.sdmp, Offset: 06E90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6e90000_zapytanie 2025.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: a333a2a9816dff4f919ac0ccf03f0811980d31f5fee29d4b7cf1516c56d61f1c
Instruction ID: 79db591cdd8d604530204cd6e1165a7cebedc6565530e74a6b697a8c32aaf9f0
Opcode Fuzzy Hash: a333a2a9816dff4f919ac0ccf03f0811980d31f5fee29d4b7cf1516c56d61f1c
Instruction Fuzzy Hash: D31107B69002499FCF10DFAAC845AEEBFF5EF48314F248419E519A7250C779A944CFA1

Function 06E9AD70 Relevance: 1.6, APIs: 1, Instructions: 52threadCOMMON

Download Yara Rule

APIs

ResumeThread.KERNELBASE ref: 06E9ADDA

Memory Dump Source

Source File: 00000000.00000002.2056777705.0000000006E90000.00000040.00000800.00020000.00000000.sdmp, Offset: 06E90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6e90000_zapytanie 2025.jbxd

Similarity

API ID: ResumeThread
String ID:
API String ID: 947044025-0
Opcode ID: 558b1df07cf1a2477b5f3d339c00db39891aedb02f8bc3c48e25da5a3cee2071
Instruction ID: e12b8ee4113d9e19c0c0e66872e37c5f64221816541e1fb73dd957e4c480d959
Opcode Fuzzy Hash: 558b1df07cf1a2477b5f3d339c00db39891aedb02f8bc3c48e25da5a3cee2071
Instruction Fuzzy Hash: 421107B19003498BCB20DFAAC44579EBBF5AF88314F248419D559A7240CB79A545CBA5

Function 06E9AD78 Relevance: 1.5, APIs: 1, Instructions: 49threadCOMMON

Download Yara Rule

APIs

ResumeThread.KERNELBASE ref: 06E9ADDA

Memory Dump Source

Source File: 00000000.00000002.2056777705.0000000006E90000.00000040.00000800.00020000.00000000.sdmp, Offset: 06E90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6e90000_zapytanie 2025.jbxd

Similarity

API ID: ResumeThread
String ID:
API String ID: 947044025-0
Opcode ID: 93fa9877d883001e09d745847aadb25b8e4c0b5391947f197fca631072cd3cee
Instruction ID: b6994568d7dde7d6982baeda83dc0eebd125632f84801eee25dc93030494ada3
Opcode Fuzzy Hash: 93fa9877d883001e09d745847aadb25b8e4c0b5391947f197fca631072cd3cee
Instruction Fuzzy Hash: A01128B1D003498FCB20DFAAC4457AEFBF5EF88314F208419D519A7240CB79A544CFA5

Function 06E9D7A0 Relevance: 1.5, APIs: 1, Instructions: 48windowCOMMON

Download Yara Rule

APIs

PostMessageW.USER32(?,00000010,00000000,?), ref: 06E9D805

Memory Dump Source

Source File: 00000000.00000002.2056777705.0000000006E90000.00000040.00000800.00020000.00000000.sdmp, Offset: 06E90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6e90000_zapytanie 2025.jbxd

Similarity

API ID: MessagePost
String ID:
API String ID: 410705778-0
Opcode ID: a498fc14f95fc1fbf1933dbf9624f43df5e991c8e2bcf0d15f1aecfdd811333d
Instruction ID: 909dada3e5f52522677707d82430c6ae16cf882a2ee970bfbebf54ecd505c297
Opcode Fuzzy Hash: a498fc14f95fc1fbf1933dbf9624f43df5e991c8e2bcf0d15f1aecfdd811333d
Instruction Fuzzy Hash: 3B11F5B58003489FDB60DF99C945BDEBBF8EF48314F20881AE958B7210C379A944CFA1

Function 06E97B7C Relevance: 1.5, APIs: 1, Instructions: 47windowCOMMON

Download Yara Rule

APIs

PostMessageW.USER32(?,00000010,00000000,?), ref: 06E9D805

Memory Dump Source

Source File: 00000000.00000002.2056777705.0000000006E90000.00000040.00000800.00020000.00000000.sdmp, Offset: 06E90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6e90000_zapytanie 2025.jbxd

Similarity

API ID: MessagePost
String ID:
API String ID: 410705778-0
Opcode ID: ef336faa443af371d7b3dabcff722e891ce1f4366be2f75ba8787f154ecccafc
Instruction ID: cbd03292445f62a8f5108a7a4bebfdeabbcaedc43de955fbac9a2c492b3d598c
Opcode Fuzzy Hash: ef336faa443af371d7b3dabcff722e891ce1f4366be2f75ba8787f154ecccafc
Instruction Fuzzy Hash: 4C1106B58007589FDB60DF99C845BDEBBF8EF48314F108419E518A7311C379A944CFA1

Function 00EEB460 Relevance: 1.5, APIs: 1, Instructions: 47COMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNELBASE(00000000), ref: 00EEB4C6

Memory Dump Source

Source File: 00000000.00000002.2052766286.0000000000EE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00EE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ee0000_zapytanie 2025.jbxd

Similarity

API ID: HandleModule
String ID:
API String ID: 4139908857-0
Opcode ID: 497a45bd788a25469d2519e04862137ed4ad4a1e0612a9acb5cdd31fae510136
Instruction ID: 112d46eac2b92d04042f70e42f25433770e40eba8e8a83e9a55320625ea9e8a6
Opcode Fuzzy Hash: 497a45bd788a25469d2519e04862137ed4ad4a1e0612a9acb5cdd31fae510136
Instruction Fuzzy Hash: 2B1110B6C002498FCB10DF9AC444ADEFBF8EF88324F10841AD828B7251D379A545CFA1

Function 08BBA7B9 Relevance: 1.4, Strings: 1, Instructions: 111COMMON

Download Yara Rule

Strings

Haq, xrefs: 08BBA85C

Memory Dump Source

Source File: 00000000.00000002.2057303306.0000000008BB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 08BB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8bb0000_zapytanie 2025.jbxd

Similarity

API ID:
String ID: Haq
API String ID: 0-725504367
Opcode ID: a83ab5b0d5878e191c6b11b8d06695dc2c0f2c7b3eaba21df0f8765a4b01daa8
Instruction ID: b35889260d7259dc04ac1ad7e1fe6513fd31e36cc13bdd8681ef8af0aa9a81d2
Opcode Fuzzy Hash: a83ab5b0d5878e191c6b11b8d06695dc2c0f2c7b3eaba21df0f8765a4b01daa8
Instruction Fuzzy Hash: 6E314670E08258AFEB129F749C01BFE7FB5EF86301F1084E6E545AB281CA359E02DB51

Function 08BBA7C8 Relevance: 1.3, Strings: 1, Instructions: 86COMMON

Download Yara Rule

Strings

Haq, xrefs: 08BBA85C

Memory Dump Source

Source File: 00000000.00000002.2057303306.0000000008BB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 08BB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8bb0000_zapytanie 2025.jbxd

Similarity

API ID:
String ID: Haq
API String ID: 0-725504367
Opcode ID: 13938e358d8a2bcda66861076e9fe03b169291b679027d2d1c340e91e375e9ef
Instruction ID: 66024af7c41c3da213a32535f0262fe119581c1fb0ca897ecb9518aff37fb05f
Opcode Fuzzy Hash: 13938e358d8a2bcda66861076e9fe03b169291b679027d2d1c340e91e375e9ef
Instruction Fuzzy Hash: 64210270E04218AFEB129F34AC01BFE3FA6EF85300F1084A6E941EB281DA359E06D751

Function 08BBFE7F Relevance: 1.3, Strings: 1, Instructions: 70COMMON

Download Yara Rule

Strings

4']q, xrefs: 08BBFED9

Memory Dump Source

Source File: 00000000.00000002.2057303306.0000000008BB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 08BB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8bb0000_zapytanie 2025.jbxd

Similarity

API ID:
String ID: 4']q
API String ID: 0-1259897404
Opcode ID: 6843c79369a2de022d868570af16bde70a0a35f17d7472f3ef3396081606eed2
Instruction ID: 11bb24243d0693775e8f4ed72e4c06437cc9d4991814950247c7c4d57022931d
Opcode Fuzzy Hash: 6843c79369a2de022d868570af16bde70a0a35f17d7472f3ef3396081606eed2
Instruction Fuzzy Hash: 4C21B035E00606CFCB04FFA4E8546EAB771FF85308F108255E606B7385EBB06955CB91

Function 08BBFE90 Relevance: 1.3, Strings: 1, Instructions: 62COMMON

Download Yara Rule

Strings

4']q, xrefs: 08BBFED9

Memory Dump Source

Source File: 00000000.00000002.2057303306.0000000008BB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 08BB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8bb0000_zapytanie 2025.jbxd

Similarity

API ID:
String ID: 4']q
API String ID: 0-1259897404
Opcode ID: 1108cc85b71e3a5ca821189110f0423eada00183de8634d5f214a6eb9daff9c1
Instruction ID: 37ec2b947c61fce8db72eb98a3d420b91ca788fc49c679e4e6abc2eb9226bc9b
Opcode Fuzzy Hash: 1108cc85b71e3a5ca821189110f0423eada00183de8634d5f214a6eb9daff9c1
Instruction Fuzzy Hash: 1E219235E00606CFDB44EFA4E8546E9B771FF85308F108219E206B7384DBB07945CB91

Function 08BBF570 Relevance: .3, Instructions: 255COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2057303306.0000000008BB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 08BB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8bb0000_zapytanie 2025.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 29109015f9378c5abef377db76aeb2f18a747ccaad245ee2878400f8bd16a702
Instruction ID: cfcbfd31f659db64d116796c86eb5e6ba4b98abb7fbf741c9ea18ac13689463c
Opcode Fuzzy Hash: 29109015f9378c5abef377db76aeb2f18a747ccaad245ee2878400f8bd16a702
Instruction Fuzzy Hash: 92A13874A006159FCB15DF69D884ABABBB1FF49701F1585A9E8059B3A1CB70EC42CBA0

Function 08BBAE40 Relevance: .1, Instructions: 141COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2057303306.0000000008BB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 08BB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8bb0000_zapytanie 2025.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: be4b914d851d25b5749bd007b99f0718d189384f3a9ada20993b56a34aac4a75
Instruction ID: 79108a8eee0bf808990b8e9d3fb7ed64cc248d177651cbb406cd54ceec763047
Opcode Fuzzy Hash: be4b914d851d25b5749bd007b99f0718d189384f3a9ada20993b56a34aac4a75
Instruction Fuzzy Hash: 1651E835A01118DFCB14DF64D958AEE7BB2EF48712F2494A9E902A73A0CBB5DD41CF90

Function 08BBB5A7 Relevance: .1, Instructions: 117COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2057303306.0000000008BB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 08BB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8bb0000_zapytanie 2025.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c4aafd7a9397f38c3b04f8baf6275d874cc8b4e6ba7e4177188fc35a1b01093b
Instruction ID: a08f4e91640d6b9876ef7c18b538a9594cc7da861a2138fec6a903dbdee9aa00
Opcode Fuzzy Hash: c4aafd7a9397f38c3b04f8baf6275d874cc8b4e6ba7e4177188fc35a1b01093b
Instruction Fuzzy Hash: 2F416A3070011ADFCF159F65E984ABEBBA6FF88311F148429E802973A4DB75DC52CB90

Function 08BBFCD9 Relevance: .1, Instructions: 114COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2057303306.0000000008BB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 08BB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8bb0000_zapytanie 2025.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8b7d57e83f84d05219988416db2ed6d4c87d9240118613e9eca9141adcd5f003
Instruction ID: bd39bc65022ad238c46b02b73ba5f7f4a61d774abe7174721a4c078e78650110
Opcode Fuzzy Hash: 8b7d57e83f84d05219988416db2ed6d4c87d9240118613e9eca9141adcd5f003
Instruction Fuzzy Hash: B2418E35A006458BDB40DF54D8513AA7372EF86318F1584B9DC0C7F356DBB2A94ACBA1

Function 08BB96E0 Relevance: .1, Instructions: 113COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2057303306.0000000008BB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 08BB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8bb0000_zapytanie 2025.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b5ea1602c0b1ec04b6ece99bcf264b9ff0973dae0d707611a13c024785f92673
Instruction ID: fdc9528f4e14fc07495784ad852c4bc5c7a96c640d5469dd21c0d6ef67d72d2a
Opcode Fuzzy Hash: b5ea1602c0b1ec04b6ece99bcf264b9ff0973dae0d707611a13c024785f92673
Instruction Fuzzy Hash: 28410775E012089FCB05CFA9D840AEDBBF2FF89301F1484AAE914A7351E7759A45CB90

Function 08BBFCE8 Relevance: .1, Instructions: 110COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2057303306.0000000008BB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 08BB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8bb0000_zapytanie 2025.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e74bf94dc09d892629be78ef88145a9d33755a67caf13db081fc557fddd6d4bc
Instruction ID: 06d138c29216fef91b89aa63917774af2ab5ab49d5e88b81421061df00a8070a
Opcode Fuzzy Hash: e74bf94dc09d892629be78ef88145a9d33755a67caf13db081fc557fddd6d4bc
Instruction Fuzzy Hash: D941AF35900645CBDB00DF58D8913EA73B2AF45718F1584B9DC0C7F346DBB2A98AC7A1

Function 08BBF688 Relevance: .1, Instructions: 103COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2057303306.0000000008BB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 08BB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8bb0000_zapytanie 2025.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: af16c0063cd8bc01146034a94dff58664727a15a1ee5b838aa8dfe2dbef05592
Instruction ID: c60712cfdf3b61b5464cbf419c9916a69597014f27a70f30afd98c9a7a05b0f6
Opcode Fuzzy Hash: af16c0063cd8bc01146034a94dff58664727a15a1ee5b838aa8dfe2dbef05592
Instruction Fuzzy Hash: D8410D79B005099FCB14DF29D884ABEBBB1FF88711F1585A9E9159B3A1CB70EC41CB90

Function 08BB92D8 Relevance: .1, Instructions: 99COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2057303306.0000000008BB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 08BB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8bb0000_zapytanie 2025.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d1091955a49e820c4d4b0f987a521bd9eb536d7b942bc69a34f82db66d47274a
Instruction ID: 3d4897feddd6fec6c408ba94b7f327bcfc2d07dbc5f6c608238d388977ad0753
Opcode Fuzzy Hash: d1091955a49e820c4d4b0f987a521bd9eb536d7b942bc69a34f82db66d47274a
Instruction Fuzzy Hash: 92312835E01209EFCB05CFA4D9549EEBBB6FF89301F10846AE905A7361EB759D06CB90

Function 08BB9C48 Relevance: .1, Instructions: 88COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2057303306.0000000008BB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 08BB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8bb0000_zapytanie 2025.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ebaafbb08efa1c0e4e92721e2f2e3657a93634c10bd99dd64927ba1f6eb69ec0
Instruction ID: 01ce7a04f70550634aae7125961de70415d26ba6b504b4433e4cc94cc4417277
Opcode Fuzzy Hash: ebaafbb08efa1c0e4e92721e2f2e3657a93634c10bd99dd64927ba1f6eb69ec0
Instruction Fuzzy Hash: 67310234D00218AFCB04CFA8D848AEEBBB1FF49311F1480A9E505AB261D7759944CF90

Function 00CDD4C4 Relevance: .1, Instructions: 75COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2052489802.0000000000CDD000.00000040.00000800.00020000.00000000.sdmp, Offset: 00CDD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cdd000_zapytanie 2025.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 40dd716cc9ef7eaf6c47efaac01fccf181db32e1bdffacdb39c1b524f3f5ad7f
Instruction ID: 28b2a49fbff412977ce3f17b131b40f486800b0a423c35af9f924125b8ce27e4
Opcode Fuzzy Hash: 40dd716cc9ef7eaf6c47efaac01fccf181db32e1bdffacdb39c1b524f3f5ad7f
Instruction Fuzzy Hash: 47213AB1940240DFCB15DF14E9C0F26BF65FB98318F20C56AEA0A0B356D33AD956D7A2

Function 00CDD3D8 Relevance: .1, Instructions: 75COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2052489802.0000000000CDD000.00000040.00000800.00020000.00000000.sdmp, Offset: 00CDD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cdd000_zapytanie 2025.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3037f15fc919fef939c7d0f76ba0cf473fe23622e5c02c73e5d657c614690a5f
Instruction ID: d5799f1d680b30d2a8c77cfee9e7732d74917534533cb71e2facc81dd8cd873d
Opcode Fuzzy Hash: 3037f15fc919fef939c7d0f76ba0cf473fe23622e5c02c73e5d657c614690a5f
Instruction Fuzzy Hash: E621F871904204DFDB15DF14D9C0F26BF65FB98324F24C56AEA0A0B356C33AE856DBA2

Function 08BB9C39 Relevance: .1, Instructions: 75COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2057303306.0000000008BB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 08BB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8bb0000_zapytanie 2025.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dc601ca0e5b555fbd49c836b94d83ac31efb329cb17eddb1519174ddff8a2934
Instruction ID: dad90035f1a8f071a4dca4a83fe4623b85b988d8287549fd1d88d3338a5c0764
Opcode Fuzzy Hash: dc601ca0e5b555fbd49c836b94d83ac31efb329cb17eddb1519174ddff8a2934
Instruction Fuzzy Hash: 85312471D00218AFDB14CFA9D848BEEFBB1FF88311F048169E505AB361D7799984CB90

Function 08BB9E51 Relevance: .1, Instructions: 75COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2057303306.0000000008BB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 08BB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8bb0000_zapytanie 2025.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2441b24fa5c7c2a1db93f6c8b8e4294aacf283ebab53bf43f52352061755280d
Instruction ID: 7dbfbe9f9fe204562c84d25e77215e5e3c694ff1b6cf46a0710f9f601927309b
Opcode Fuzzy Hash: 2441b24fa5c7c2a1db93f6c8b8e4294aacf283ebab53bf43f52352061755280d
Instruction Fuzzy Hash: C531B2B5D01209AFCB04CFA9D594AEDBFB1FB58311F10816AE919A7350EB345A45CF90

Function 08BBB268 Relevance: .1, Instructions: 73COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2057303306.0000000008BB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 08BB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8bb0000_zapytanie 2025.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4c426a5643b835b9a8f576bb5ca957b394cc91b915afc20805c69fdadcce5eda
Instruction ID: 390a15bb6450f04a4a0579d6a785926df199b36814de7a6abd13993113a1abd9
Opcode Fuzzy Hash: 4c426a5643b835b9a8f576bb5ca957b394cc91b915afc20805c69fdadcce5eda
Instruction Fuzzy Hash: F3217F75B40109CFCB10DFA8C884AAE7FB1EF48321F5540A9E805DB361D671ED81CB61

Function 00CED01C Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2052533425.0000000000CED000.00000040.00000800.00020000.00000000.sdmp, Offset: 00CED000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ced000_zapytanie 2025.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 143d2b7c83fe8f30301b3346d3e4bbf3d7215e9dc67d05884a0e09f0947f85a9
Instruction ID: 7ff28ad15f7f968203b0c5229bf5d1f2c65647e030b9b030b4c0095a548447c9
Opcode Fuzzy Hash: 143d2b7c83fe8f30301b3346d3e4bbf3d7215e9dc67d05884a0e09f0947f85a9
Instruction Fuzzy Hash: 4D21F271604284DFCB14DF25D9C4B26BF65FB88314F28C569E90A4B296C33AD807CA62

Function 00CED1D4 Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2052533425.0000000000CED000.00000040.00000800.00020000.00000000.sdmp, Offset: 00CED000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ced000_zapytanie 2025.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 11dcecaa5d2c531e9a4fc15058fe21ffe1326a0dc98e0014ea1f4d847ecf3dd8
Instruction ID: 0b198c1f10187f67ca8cd32df753d0eee65bafdd0163cf013e8d32f7652947f1
Opcode Fuzzy Hash: 11dcecaa5d2c531e9a4fc15058fe21ffe1326a0dc98e0014ea1f4d847ecf3dd8
Instruction Fuzzy Hash: 30210475504284EFDB05DF25D9C0F26BBA5FB88314F20C5ADEA0A4B296C33ADC46DA61

Function 08BB9E60 Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2057303306.0000000008BB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 08BB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8bb0000_zapytanie 2025.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cf52f538f24b009ff23e1810f9720a9752ad7fa70c5df7af25cecb56d9d5e786
Instruction ID: 9d116311c7e7d6f100641cbb035000b7e73e405812da252a64d39ad714674085
Opcode Fuzzy Hash: cf52f538f24b009ff23e1810f9720a9752ad7fa70c5df7af25cecb56d9d5e786
Instruction Fuzzy Hash: 8131B074D00209AFCB04CFA9D5949EEBFF1FB98300F10806AE91AA7350EB346A45CF90

Function 08BB9870 Relevance: .1, Instructions: 71COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2057303306.0000000008BB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 08BB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8bb0000_zapytanie 2025.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f995238807c21372cf8b4e30022549263ecd89a049b4153e268073c0a4892f6e
Instruction ID: 584628a185dcc8531e525a2ba2ba731190db16032705025e32901935af44271a
Opcode Fuzzy Hash: f995238807c21372cf8b4e30022549263ecd89a049b4153e268073c0a4892f6e
Instruction Fuzzy Hash: 9421C035D00209EFDF05CFA5D944ADEBBB2FF89311F10802AE915A7360DB76A956DB80

Function 00CED005 Relevance: .1, Instructions: 62COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2052533425.0000000000CED000.00000040.00000800.00020000.00000000.sdmp, Offset: 00CED000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ced000_zapytanie 2025.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 57837b697f10bac818b1f0a8b459cb24bc254e86979b3b5cc24bd7e57c2a17a0
Instruction ID: b12e832e64e8c5015cb4b36d9df506f5a904598f436d060f5b00e88b6e9128be
Opcode Fuzzy Hash: 57837b697f10bac818b1f0a8b459cb24bc254e86979b3b5cc24bd7e57c2a17a0
Instruction Fuzzy Hash: 5E216F755093C08FDB12CF24D994715BF71EB46314F28C5EAD8498F6A7C33A990ACB62

Function 00CDD3D3 Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2052489802.0000000000CDD000.00000040.00000800.00020000.00000000.sdmp, Offset: 00CDD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cdd000_zapytanie 2025.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: be84e5d2ba6eb25d2e30d29f2c5ffdc4cdcd384a79140dda988d9b090738847a
Instruction ID: db241345b0c083f06e4db6ff298a718bab0c98488a6b78591ca5a50041c44c0a
Opcode Fuzzy Hash: be84e5d2ba6eb25d2e30d29f2c5ffdc4cdcd384a79140dda988d9b090738847a
Instruction Fuzzy Hash: EF112672804240DFCB12CF00D5C4B16BF71FB94324F24C6AAD90A0B356C33AE95ACBA2

Function 00CDD4BF Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2052489802.0000000000CDD000.00000040.00000800.00020000.00000000.sdmp, Offset: 00CDD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cdd000_zapytanie 2025.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: be84e5d2ba6eb25d2e30d29f2c5ffdc4cdcd384a79140dda988d9b090738847a
Instruction ID: 7acaf40467140ca6288f69544e123297ac303abe819d73e69dfcc3356569b127
Opcode Fuzzy Hash: be84e5d2ba6eb25d2e30d29f2c5ffdc4cdcd384a79140dda988d9b090738847a
Instruction Fuzzy Hash: 8A1126B2804280CFCB12CF10D5C4B16BF71FB98314F24C6AAD94A0B356C336D95ACBA2

Function 00CED1CF Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2052533425.0000000000CED000.00000040.00000800.00020000.00000000.sdmp, Offset: 00CED000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ced000_zapytanie 2025.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 945d3a080ad63b5e32bcc5b18ec1e97d0272151c1fb78e482730898ede984437
Instruction ID: 471378391b7040ecc7e481898c364918a29be5812514083bfed444689a24c90e
Opcode Fuzzy Hash: 945d3a080ad63b5e32bcc5b18ec1e97d0272151c1fb78e482730898ede984437
Instruction Fuzzy Hash: 0811BB75504280DFCB02CF10C5C4B15BBA1FB84314F24C6A9D94A4B296C33AD84ACB62

Function 08BB9DB0 Relevance: .0, Instructions: 49COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2057303306.0000000008BB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 08BB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8bb0000_zapytanie 2025.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 609f70b7fe77fe807586e9ad3da43588bd74ec9988e5669968220dd01f1d5ca9
Instruction ID: d39f83df416c673e0acea528477f5eccdc0b8134fcd9391be3e6ec75a1d9e394
Opcode Fuzzy Hash: 609f70b7fe77fe807586e9ad3da43588bd74ec9988e5669968220dd01f1d5ca9
Instruction Fuzzy Hash: 521151B1905349DFCB12CFA8C444B9EBFB1EF46300F1585DEE504AB2A2D7368A44CB91

Function 08BB9DD0 Relevance: .0, Instructions: 41COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2057303306.0000000008BB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 08BB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8bb0000_zapytanie 2025.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 11df995d01aa8c0eeffcc26080924cb9d4f8961951f74837d8bd219c8db9eacb
Instruction ID: 5df4684fdf457bab7abfcca900c2a71d5cde09def7d4240d200c1c59343bad5f
Opcode Fuzzy Hash: 11df995d01aa8c0eeffcc26080924cb9d4f8961951f74837d8bd219c8db9eacb
Instruction Fuzzy Hash: 4F01D0B5C01209DFCB41DFA8C545AAEBFF1FF48301F1085A9E508A7260E7358A50DF91

Function 08BB9F49 Relevance: .0, Instructions: 27COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2057303306.0000000008BB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 08BB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8bb0000_zapytanie 2025.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f7d932e325f28c9e0c6531f2cffa1a1ac8ef123c407b90f72b6a7788fccf3429
Instruction ID: dd84ee2c3c73c05c658dd7bf6a4641ca6a05f04b26868a46537c105bebfaca22
Opcode Fuzzy Hash: f7d932e325f28c9e0c6531f2cffa1a1ac8ef123c407b90f72b6a7788fccf3429
Instruction Fuzzy Hash: 34F09D79D002089FDF00CFA8E9946EDBBB0FB58211F5041A9E911B3340E735AA518F60

Function 08BBB262 Relevance: .0, Instructions: 25COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2057303306.0000000008BB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 08BB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8bb0000_zapytanie 2025.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4c5c6c2ce18f14c214cde535b3a711d0ec39d4d90d13f8c63e9612909f872abc
Instruction ID: 98e6f9f4c417a2bb27d877fa4ca436ff6b80f0b146e6285e6d49e11fbddd6edb
Opcode Fuzzy Hash: 4c5c6c2ce18f14c214cde535b3a711d0ec39d4d90d13f8c63e9612909f872abc
Instruction Fuzzy Hash: 70E0863160020CABDF106AE5EC49AFFBF68DB44272F448075ED0591111D6B1D518C5B1

Non-executed Functions

Function 06E992B0 Relevance: 1.6, Strings: 1, Instructions: 312COMMON

Download Yara Rule

Strings

s@-n, xrefs: 06E9930B

Memory Dump Source

Source File: 00000000.00000002.2056777705.0000000006E90000.00000040.00000800.00020000.00000000.sdmp, Offset: 06E90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6e90000_zapytanie 2025.jbxd

Similarity

API ID:
String ID: s@-n
API String ID: 0-2725530398
Opcode ID: 57082d636589dedeb5fe76598513f4648d5d80bf03fe57d9fabee12a37de8a41
Instruction ID: 1b52362dd70ff236dff88f817fe90b681cdd35ac9d3965528805954fe8e8374f
Opcode Fuzzy Hash: 57082d636589dedeb5fe76598513f4648d5d80bf03fe57d9fabee12a37de8a41
Instruction Fuzzy Hash: C5E11974E002598FDB54DFA9C5809AEFBF2BF89305F24C169E414AB356D730A942CFA1

Function 06E992A0 Relevance: 1.4, Strings: 1, Instructions: 134COMMON

Download Yara Rule

Strings

s@-n, xrefs: 06E9930B

Memory Dump Source

Source File: 00000000.00000002.2056777705.0000000006E90000.00000040.00000800.00020000.00000000.sdmp, Offset: 06E90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6e90000_zapytanie 2025.jbxd

Similarity

API ID:
String ID: s@-n
API String ID: 0-2725530398
Opcode ID: 948adb8b9a3fd6999857b6d16eeae66e143fc1041f0461ffc71724cb8d957cdd
Instruction ID: 8b08da748224b6dd6105ea327a6ba0670cd814930d01091c1804525f49e6ee9f
Opcode Fuzzy Hash: 948adb8b9a3fd6999857b6d16eeae66e143fc1041f0461ffc71724cb8d957cdd
Instruction Fuzzy Hash: 79510D74E002198FDB55DFA9C9805AEFBF2BF89305F24C169D418A7356D730A942CFA1

Function 06E9F158 Relevance: .3, Instructions: 340COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2056777705.0000000006E90000.00000040.00000800.00020000.00000000.sdmp, Offset: 06E90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6e90000_zapytanie 2025.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 76ca26ccc4cd3f64615e9ac62a59582cf8ae6b0599481f01757d9f42339ccc08
Instruction ID: 3927609b65534296293d49e75607bd61b4be6740bc708ca971967ab3e8bb2bdc
Opcode Fuzzy Hash: 76ca26ccc4cd3f64615e9ac62a59582cf8ae6b0599481f01757d9f42339ccc08
Instruction Fuzzy Hash: 01C1DD30B017548FEBA9DB76C910BAE77EAAFC9704F14546DD106DB291DB34E802CB62

Function 06E98608 Relevance: .3, Instructions: 312COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2056777705.0000000006E90000.00000040.00000800.00020000.00000000.sdmp, Offset: 06E90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6e90000_zapytanie 2025.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f05f3e1849bcbea749d4102925ec856e77959773c737fb47658b7010cf5427a7
Instruction ID: 300aa73fac61955e9f37da5529ca79bd732485dca1878a9da56dfb3edc7857bf
Opcode Fuzzy Hash: f05f3e1849bcbea749d4102925ec856e77959773c737fb47658b7010cf5427a7
Instruction Fuzzy Hash: C5E10674E102198FCB54DFA8C5809AEFBF2BF89305F24D569E814AB356D730A941CFA1

Function 06E9A550 Relevance: .3, Instructions: 312COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2056777705.0000000006E90000.00000040.00000800.00020000.00000000.sdmp, Offset: 06E90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6e90000_zapytanie 2025.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4cd17359fa0c0f4cd831d8bfc92c6ef69e4c2bd8e64f7d5be9f6a8c5dd41adae
Instruction ID: 181fb2921e5b0ccafe4a50b0ab2962fdf949291f68eb496c1231a849f163c980
Opcode Fuzzy Hash: 4cd17359fa0c0f4cd831d8bfc92c6ef69e4c2bd8e64f7d5be9f6a8c5dd41adae
Instruction Fuzzy Hash: 95E1F874E002598FCB54DFA8C5809AEFBF2BF89305F24D169E814AB356D731A942CF61

Function 06E98E78 Relevance: .3, Instructions: 312COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2056777705.0000000006E90000.00000040.00000800.00020000.00000000.sdmp, Offset: 06E90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6e90000_zapytanie 2025.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 998c530d47e4e193abc1fd1781fa8200c24db9e7f93be1733eab639e560f6417
Instruction ID: e77f4cf9003356d33a1b35246ae8b29ca018d63b11a8c352970ef186ecc3a932
Opcode Fuzzy Hash: 998c530d47e4e193abc1fd1781fa8200c24db9e7f93be1733eab639e560f6417
Instruction Fuzzy Hash: 19E10574E002198FCB54DFA9C5809AEFBF2BF89305F24D169E814AB356D731A941CFA1

Function 06E98A40 Relevance: .3, Instructions: 312COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2056777705.0000000006E90000.00000040.00000800.00020000.00000000.sdmp, Offset: 06E90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6e90000_zapytanie 2025.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 653c8731121a91d7361522b13e67f0955d82637ab54cfaaecedc2dea034b1475
Instruction ID: 4d73e5fe65c6ed79a8cd81888538e54e30778637205b64d130e1710bd5719e96
Opcode Fuzzy Hash: 653c8731121a91d7361522b13e67f0955d82637ab54cfaaecedc2dea034b1475
Instruction Fuzzy Hash: D6E10774E002598FCB54DFA8C9809AEFBF2BF89305F24D569E414AB35AD730A941CF61

Function 00EEE0B4 Relevance: .3, Instructions: 264COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2052766286.0000000000EE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00EE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ee0000_zapytanie 2025.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 94b06aee3256606a5692360d8916b8d27dd5982ca7924ffeff27869d2efa8a53
Instruction ID: 5452cfa91c877189eba78400e15b058791d7aad34d8ccba0ca305a37ad5f64c1
Opcode Fuzzy Hash: 94b06aee3256606a5692360d8916b8d27dd5982ca7924ffeff27869d2efa8a53
Instruction Fuzzy Hash: ECA15B32E002598FCF09DFB6C84459EB7B2FF85304B25957AE805BB265DB35E945CB80

Function 06E90B98 Relevance: .2, Instructions: 216COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2056777705.0000000006E90000.00000040.00000800.00020000.00000000.sdmp, Offset: 06E90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6e90000_zapytanie 2025.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a2c4dc984b57b88ec5cb69ec8d6845e4313b6daaeef42f7d066738666d463bab
Instruction ID: d608859dcdb349a7a5b0cc51ac19cdfb6024a537ed88342b2acb51a338a89278
Opcode Fuzzy Hash: a2c4dc984b57b88ec5cb69ec8d6845e4313b6daaeef42f7d066738666d463bab
Instruction Fuzzy Hash: 2291F070D05219DFEFA4CFAAC8847EDBBB6BF49304F40A069E419AB251DB305985CF60

Function 08BB51C1 Relevance: 6.3, Strings: 5, Instructions: 67COMMON

Download Yara Rule

Strings

4']q, xrefs: 08BB5297
4']q, xrefs: 08BB5274
4']q, xrefs: 08BB522E
4']q, xrefs: 08BB5251
4']q, xrefs: 08BB520B

Memory Dump Source

Source File: 00000000.00000002.2057303306.0000000008BB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 08BB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8bb0000_zapytanie 2025.jbxd

Similarity

API ID:
String ID: 4']q$4']q$4']q$4']q$4']q
API String ID: 0-4248691736
Opcode ID: 6602fac939663b0fbad94dd0e465c66903d150618ed7b4430b6e9df3fd916efc
Instruction ID: f5498ba07b04bbce9e19a29a3b45ba3d83f314cb1b04a92d9ae86b28bc2636de
Opcode Fuzzy Hash: 6602fac939663b0fbad94dd0e465c66903d150618ed7b4430b6e9df3fd916efc
Instruction Fuzzy Hash: 8A217430A0010A9FCB0CEFA9E5519EE7BB6FFC0704F104569824567265EF34AA09CB92

Function 08BB51D0 Relevance: 6.3, Strings: 5, Instructions: 62COMMON

Download Yara Rule

Strings

4']q, xrefs: 08BB5297
4']q, xrefs: 08BB5274
4']q, xrefs: 08BB522E
4']q, xrefs: 08BB5251
4']q, xrefs: 08BB520B

Memory Dump Source

Source File: 00000000.00000002.2057303306.0000000008BB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 08BB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8bb0000_zapytanie 2025.jbxd

Similarity

API ID:
String ID: 4']q$4']q$4']q$4']q$4']q
API String ID: 0-4248691736
Opcode ID: 16e0a34ee313ab6696df6d6feb2e3e030e7de4c87489dff84321cfcd40b24bc1
Instruction ID: 073b7010d466def83c923f7682404d847c9aea506908b078e2e23c8015560a50
Opcode Fuzzy Hash: 16e0a34ee313ab6696df6d6feb2e3e030e7de4c87489dff84321cfcd40b24bc1
Instruction Fuzzy Hash: 95214530B0110A9FDB0CEFA9E5519EE7BB6FFC0704F1044A981456B265EF74AE05CB92

Function 08BBEB20 Relevance: 5.2, Strings: 4, Instructions: 150COMMON

Download Yara Rule

Strings

4']q, xrefs: 08BBEB3B
4']q, xrefs: 08BBEB96
4']q, xrefs: 08BBEBC6
$]q, xrefs: 08BBEBE8

Memory Dump Source

Source File: 00000000.00000002.2057303306.0000000008BB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 08BB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8bb0000_zapytanie 2025.jbxd

Similarity

API ID:
String ID: 4']q$4']q$4']q$$]q
API String ID: 0-3694760048
Opcode ID: f6bf3641a91537bdfec31b3e9267fb7b8fc3dd3f4324b0709a35aadbfa13105f
Instruction ID: 8ebc0521330aecf1b1082173d9129f78c872b9d11869e6f79061cdc0d4166c63
Opcode Fuzzy Hash: f6bf3641a91537bdfec31b3e9267fb7b8fc3dd3f4324b0709a35aadbfa13105f
Instruction Fuzzy Hash: C2416E303405158FCB299A799894ABE36D7FFC864172908ADE006CB3B5DEA5DC468791

Analysis Process: zapytanie 2025.exePID: 6508, Parent PID: 1012COMMON

Executed Functions

Function 02BC5F98 Relevance: 1.5, Strings: 1, Instructions: 281COMMON

Download Yara Rule

Strings

\V%m, xrefs: 02BC624F

Memory Dump Source

Source File: 00000003.00000002.3297899883.0000000002BC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02BC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_2bc0000_zapytanie 2025.jbxd

Similarity

API ID:
String ID: \V%m
API String ID: 0-324988934
Opcode ID: 5bc3980e8e5850775b2446b962d7f3553d3823113cd9b144706ab7dddb2efd63
Instruction ID: e982a45866fdc9f0a4593099cdecfcc73a15358eb41b45f55f4f39ea2c805819
Opcode Fuzzy Hash: 5bc3980e8e5850775b2446b962d7f3553d3823113cd9b144706ab7dddb2efd63
Instruction Fuzzy Hash: E9B12D70E002098FDB14CFA9C985BADBBF6EFC8714F24816DD855AB354EB749885CB81

Function 02BC6868 Relevance: .3, Instructions: 266COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3297899883.0000000002BC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02BC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_2bc0000_zapytanie 2025.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3d5964468ec69b0cffa8905d5d51554a29feccfd37e6f7473350c35484b04fb7
Instruction ID: 41818ee870300528c44025a0368bf4b5c0da49661c1beebee286c560971f1d34
Opcode Fuzzy Hash: 3d5964468ec69b0cffa8905d5d51554a29feccfd37e6f7473350c35484b04fb7
Instruction Fuzzy Hash: BFB14D71E00209CFDF14CFA9C985BADBBF6EF88714F24816DD419A7294EB749885CB81

Function 02BC1727 Relevance: 5.4, Strings: 4, Instructions: 444COMMON

Download Yara Rule

Strings

a]q, xrefs: 02BC1CDF
a]q, xrefs: 02BC1D3C
xaq, xrefs: 02BC1D76
,, xrefs: 02BC1870

Memory Dump Source

Source File: 00000003.00000002.3297899883.0000000002BC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02BC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_2bc0000_zapytanie 2025.jbxd

Similarity

API ID:
String ID: a]q$ a]q$,$xaq
API String ID: 0-452644037
Opcode ID: 17dd4054ef52abeb19c6626c509c61b8281794f93013d15162fa3c67afb6d1a2
Instruction ID: c5733be016d1a67d9730374db07906421582b9e057f0be1e9271136cdfc9de7d
Opcode Fuzzy Hash: 17dd4054ef52abeb19c6626c509c61b8281794f93013d15162fa3c67afb6d1a2
Instruction Fuzzy Hash: 7D029B70700205DFC719EF68D494B6A7BE6FF84304F20896DD506AB3A9EB75AC46CB81

Function 02BC1962 Relevance: 3.9, Strings: 3, Instructions: 183COMMON

Download Yara Rule

Strings

a]q, xrefs: 02BC1CDF
a]q, xrefs: 02BC1D3C
xaq, xrefs: 02BC1D76

Memory Dump Source

Source File: 00000003.00000002.3297899883.0000000002BC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02BC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_2bc0000_zapytanie 2025.jbxd

Similarity

API ID:
String ID: a]q$ a]q$xaq
API String ID: 0-315583803
Opcode ID: 3b76ce32eae9e55ddec6350de2d902b124dd72445c3d4451fdd01382a9d7019c
Instruction ID: aabac31d4166a9978da532cee2964e843d811d6074d4a049ac522a190163868a
Opcode Fuzzy Hash: 3b76ce32eae9e55ddec6350de2d902b124dd72445c3d4451fdd01382a9d7019c
Instruction Fuzzy Hash: 9C619A75700201DFC319AF28E494B5A7BE6FF84314F20896DD1069F3A9EBB5AD46CB80

Function 02BC0EBA Relevance: 3.9, Strings: 3, Instructions: 166COMMON

Download Yara Rule

Strings

(aq, xrefs: 02BC1192
Te]q, xrefs: 02BC0EED
d6p, xrefs: 02BC0F05

Memory Dump Source

Source File: 00000003.00000002.3297899883.0000000002BC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02BC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_2bc0000_zapytanie 2025.jbxd

Similarity

API ID:
String ID: (aq$Te]q$d6p
API String ID: 0-967301506
Opcode ID: b23df35fb624e0e9939ccd41e96af6bb8e3c78bceb463afc4872c294ee9a8e54
Instruction ID: 52f85346f48753e537d1c9272ffba4525433cc11dd9174c3d41f7d65bd0d8575
Opcode Fuzzy Hash: b23df35fb624e0e9939ccd41e96af6bb8e3c78bceb463afc4872c294ee9a8e54
Instruction Fuzzy Hash: 78516D34B101149FC754DF6DC498AAEBBF6FF89710F258099E406EB3A5CA75EC028B90

Function 02BC0D20 Relevance: 2.6, Strings: 2, Instructions: 133COMMON

Download Yara Rule

Strings

dLcq, xrefs: 02BC0D5B
Haq, xrefs: 02BC0E40

Memory Dump Source

Source File: 00000003.00000002.3297899883.0000000002BC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02BC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_2bc0000_zapytanie 2025.jbxd

Similarity

API ID:
String ID: Haq$dLcq
API String ID: 0-1713614415
Opcode ID: 444f50dc61ee6252307931f7f50fe0f11f9698f97d6619c792a8dc187a066c43
Instruction ID: ddb38313b780f3ff49e38c7bc207124920af66db9ae963e859e17f98ac793cae
Opcode Fuzzy Hash: 444f50dc61ee6252307931f7f50fe0f11f9698f97d6619c792a8dc187a066c43
Instruction Fuzzy Hash: 7341D231B042059FCB159F69D454BAEBBF6EF89304F1448AAE506DB3A1CB35EC05CB91

Function 02BC9520 Relevance: 2.6, Strings: 2, Instructions: 111COMMON

Download Yara Rule

Strings

$]q, xrefs: 02BC9555
$]q, xrefs: 02BC955F

Memory Dump Source

Source File: 00000003.00000002.3297899883.0000000002BC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02BC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_2bc0000_zapytanie 2025.jbxd

Similarity

API ID:
String ID: $]q$$]q
API String ID: 0-127220927
Opcode ID: 49fcb32287199f095a9ebb75a89a79e20c0522272ee7a4743049a2c023cfe188
Instruction ID: 58f50ba22bd72d1edddef07aa0487b02cd89a8548cfa3048cb0acc995f4c239a
Opcode Fuzzy Hash: 49fcb32287199f095a9ebb75a89a79e20c0522272ee7a4743049a2c023cfe188
Instruction Fuzzy Hash: B8414730708A41DFD7086F6A9198539BBB6FB8470577988A9E0168B395CF36DC22CB85

Function 02BC8B27 Relevance: 2.6, Strings: 2, Instructions: 55COMMON

Download Yara Rule

Strings

4']q, xrefs: 02BC8AF9
4']q, xrefs: 02BC8AD6

Memory Dump Source

Source File: 00000003.00000002.3297899883.0000000002BC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02BC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_2bc0000_zapytanie 2025.jbxd

Similarity

API ID:
String ID: 4']q$4']q
API String ID: 0-3120983240
Opcode ID: 34aaf778866599cc02e05b64617d1d1c57c73fb7ce42de4fad862e7929711f47
Instruction ID: eb5399533887c80ccbc09ea1e062f8e39b90c271463e9400d775b7461b05bd06
Opcode Fuzzy Hash: 34aaf778866599cc02e05b64617d1d1c57c73fb7ce42de4fad862e7929711f47
Instruction Fuzzy Hash: A111C130A041159FCB19EFBCF491BAD7FA6FF81718F1045A9D0459B3A8DF39A8098792

Function 02BC5F8C Relevance: 1.5, Strings: 1, Instructions: 291COMMON

Download Yara Rule

Strings

\V%m, xrefs: 02BC624F

Memory Dump Source

Source File: 00000003.00000002.3297899883.0000000002BC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02BC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_2bc0000_zapytanie 2025.jbxd

Similarity

API ID:
String ID: \V%m
API String ID: 0-324988934
Opcode ID: 554b2af991adeb7e0c9259dffe4fa17127cbb63b6d104f0f462c27f643bf507e
Instruction ID: 4cc8351f3e4fb1137a8e95325127f2482015d2d636b69f4f56f3f4a47e486d40
Opcode Fuzzy Hash: 554b2af991adeb7e0c9259dffe4fa17127cbb63b6d104f0f462c27f643bf507e
Instruction Fuzzy Hash: C5C11A70E00209CFDF14CFA8C985B9DBBF6EF88315F24816DD859AB254EB749885CB91

Function 02BC9CB0 Relevance: 1.5, Strings: 1, Instructions: 213COMMON

Download Yara Rule

Strings

xaq, xrefs: 02BC9FF6

Memory Dump Source

Source File: 00000003.00000002.3297899883.0000000002BC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02BC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_2bc0000_zapytanie 2025.jbxd

Similarity

API ID:
String ID: xaq
API String ID: 0-793007810
Opcode ID: 978548690cd870381804d93e3ef259ce57764e8fed52962be9fb585c2df4d35e
Instruction ID: 0a72ea62f8d9d71f4160b480aca574d67b7b2a18bc239e1c927df0e56fe388df
Opcode Fuzzy Hash: 978548690cd870381804d93e3ef259ce57764e8fed52962be9fb585c2df4d35e
Instruction Fuzzy Hash: C49199B0500201CFE724DF28E5647653BBAF7A8318F2455AEC4118BB88E7B6BA45CFD1

Function 02BC9A58 Relevance: 1.4, Strings: 1, Instructions: 127COMMON

Download Yara Rule

Strings

Te]q, xrefs: 02BC9AF6

Memory Dump Source

Source File: 00000003.00000002.3297899883.0000000002BC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02BC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_2bc0000_zapytanie 2025.jbxd

Similarity

API ID:
String ID: Te]q
API String ID: 0-52440209
Opcode ID: d01971c76b84bddc5e45106cf324db65356886faac877cff032679314d57b9b2
Instruction ID: 19cab06eab75ea9f5ea5d3cde96e2c9aad62dbda28543c4254c08e3b80112629
Opcode Fuzzy Hash: d01971c76b84bddc5e45106cf324db65356886faac877cff032679314d57b9b2
Instruction Fuzzy Hash: EE519C75600605DFE714DF69C998BAABBF2FF48714F204199E512AB3E4CBB1AC41CB80

Function 02BC9509 Relevance: 1.4, Strings: 1, Instructions: 111COMMON

Download Yara Rule

Strings

$]q, xrefs: 02BC9555

Memory Dump Source

Source File: 00000003.00000002.3297899883.0000000002BC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02BC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_2bc0000_zapytanie 2025.jbxd

Similarity

API ID:
String ID: $]q
API String ID: 0-1007455737
Opcode ID: e8ddb11e859bace7ea8df61ffec15d8e7a9903117fe63c7b721629c096671323
Instruction ID: c740822306f4a7d16653ec922fc596551ae60b46aa1fd19c247ef61337f8146c
Opcode Fuzzy Hash: e8ddb11e859bace7ea8df61ffec15d8e7a9903117fe63c7b721629c096671323
Instruction Fuzzy Hash: 7B41AD30608A41DFD7096F6E9188138BBB6FF847057398CAAE0468B395CF369C13CB85

Function 02BC1339 Relevance: 1.3, Strings: 1, Instructions: 91COMMON

Download Yara Rule

Strings

LR]q, xrefs: 02BC138B

Memory Dump Source

Source File: 00000003.00000002.3297899883.0000000002BC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02BC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_2bc0000_zapytanie 2025.jbxd

Similarity

API ID:
String ID: LR]q
API String ID: 0-3081347316
Opcode ID: 970e97620f87188e8a65c1eaa17e3f3ff615374e1a76beb24e9f9c2aa3a2b2ea
Instruction ID: 5743651e39b25d6d386026f2d242d66d484ef0bc7596dfb27b425dd12a57cc0e
Opcode Fuzzy Hash: 970e97620f87188e8a65c1eaa17e3f3ff615374e1a76beb24e9f9c2aa3a2b2ea
Instruction Fuzzy Hash: 17319F30F102169FCB549B7C855066E7BF2BFC9204B2480ADE54AEB365EE30DC02CB91

Function 02BC0D10 Relevance: 1.3, Strings: 1, Instructions: 89COMMON

Download Yara Rule

Strings

dLcq, xrefs: 02BC0D5B

Memory Dump Source

Source File: 00000003.00000002.3297899883.0000000002BC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02BC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_2bc0000_zapytanie 2025.jbxd

Similarity

API ID:
String ID: dLcq
API String ID: 0-2236789282
Opcode ID: 6dd5bd11aac5cd2db3fd48dee4cb5dbddc1076aa688eb69c54b031a94641b4df
Instruction ID: 0ff4573ab06b60f3b9d7548cc5027fa245ac93d62561dd3d3d5412533197a9f2
Opcode Fuzzy Hash: 6dd5bd11aac5cd2db3fd48dee4cb5dbddc1076aa688eb69c54b031a94641b4df
Instruction Fuzzy Hash: 2F316D71A002059FDB14EF69C498B9EBBF6EF48204F2485A9E401AB361CB75ED45CB91

Function 02BC9438 Relevance: 1.3, Strings: 1, Instructions: 67COMMON

Download Yara Rule

Strings

Te]q, xrefs: 02BC9452

Memory Dump Source

Source File: 00000003.00000002.3297899883.0000000002BC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02BC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_2bc0000_zapytanie 2025.jbxd

Similarity

API ID:
String ID: Te]q
API String ID: 0-52440209
Opcode ID: 8a69fe83e81b0d7a7837a56a89338717a56de4caafe23241c05eef9894a8072e
Instruction ID: 8f3e028cb8763fdf560225b84f28f66011a9265a1f136332b3ed30af44f196b9
Opcode Fuzzy Hash: 8a69fe83e81b0d7a7837a56a89338717a56de4caafe23241c05eef9894a8072e
Instruction Fuzzy Hash: 97216D307105108FEB249B68D558BAE7BF6AF88B11F24419AE502DB3A5CF719C00CB91

Function 02BC35C9 Relevance: 1.3, Strings: 1, Instructions: 64COMMON

Download Yara Rule

Strings

|, xrefs: 02BC3628

Memory Dump Source

Source File: 00000003.00000002.3297899883.0000000002BC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02BC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_2bc0000_zapytanie 2025.jbxd

Similarity

API ID:
String ID: |
API String ID: 0-2343686810
Opcode ID: 8da5861fac38e5a9eb9cf31ba9f49fe6b1ff992f37286e4b09c2a2744afe3456
Instruction ID: ad45a623cd36fe8d6154f69f67d815d26a429a19b2c556b98fd998f68ad46018
Opcode Fuzzy Hash: 8da5861fac38e5a9eb9cf31ba9f49fe6b1ff992f37286e4b09c2a2744afe3456
Instruction Fuzzy Hash: 3B116A75F042149FDB50EF78D904B6D7BF6AB48710F2084AEE94AD73A4EB35A900CB91

Function 02BC993F Relevance: 1.3, Strings: 1, Instructions: 58COMMON

Download Yara Rule

Strings

Te]q, xrefs: 02BC996B

Memory Dump Source

Source File: 00000003.00000002.3297899883.0000000002BC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02BC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_2bc0000_zapytanie 2025.jbxd

Similarity

API ID:
String ID: Te]q
API String ID: 0-52440209
Opcode ID: 8de8d0de371b0aecea8330e336f9b047e816471d82741a6310f2def099fb2e85
Instruction ID: d7fff4b871a0c24e1b6471e1c1bea7310daa3948cae5d4d4e107d0fb6f066630
Opcode Fuzzy Hash: 8de8d0de371b0aecea8330e336f9b047e816471d82741a6310f2def099fb2e85
Instruction Fuzzy Hash: 45119370B40201DFD718DF68C499BBDBBE6AF88710F24409EE506EB3A5CAB19C41CB90

Function 02BC9950 Relevance: 1.3, Strings: 1, Instructions: 57COMMON

Download Yara Rule

Strings

Te]q, xrefs: 02BC996B

Memory Dump Source

Source File: 00000003.00000002.3297899883.0000000002BC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02BC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_2bc0000_zapytanie 2025.jbxd

Similarity

API ID:
String ID: Te]q
API String ID: 0-52440209
Opcode ID: bf396772c847a46b571735c18a8490e64553db64e6c74b53625579527a7c16b1
Instruction ID: 9d15c086ff1895b14a8851a9b19648f459c29d9b5df297109624721dc990b910
Opcode Fuzzy Hash: bf396772c847a46b571735c18a8490e64553db64e6c74b53625579527a7c16b1
Instruction Fuzzy Hash: CC114F70B40104DFDB189F69C499BBEBBE6EF88710F244099E502AB3A5CEB19C41CB90

Function 02BCA470 Relevance: 1.3, Strings: 1, Instructions: 53COMMON

Download Yara Rule

Strings

Te]q, xrefs: 02BCA49D

Memory Dump Source

Source File: 00000003.00000002.3297899883.0000000002BC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02BC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_2bc0000_zapytanie 2025.jbxd

Similarity

API ID:
String ID: Te]q
API String ID: 0-52440209
Opcode ID: 19a5b19e8dca256703e8be59d50fb9cb17ba1c21c09c8d668f0704b5b577adaa
Instruction ID: 4e059ffbe58321852067c17a516e0195ce574ba2616b967fc56cd6d0d224c629
Opcode Fuzzy Hash: 19a5b19e8dca256703e8be59d50fb9cb17ba1c21c09c8d668f0704b5b577adaa
Instruction Fuzzy Hash: 34119A70B001049FDB189F28C959BAE7BF2EB88710F2040ADE502EB3A1CF755C02CB80

Function 02BC0E3F Relevance: 1.3, Strings: 1, Instructions: 46COMMON

Download Yara Rule

Strings

Haq, xrefs: 02BC0E40

Memory Dump Source

Source File: 00000003.00000002.3297899883.0000000002BC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02BC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_2bc0000_zapytanie 2025.jbxd

Similarity

API ID:
String ID: Haq
API String ID: 0-725504367
Opcode ID: c675a1992f91d31fbb4acf058d22a0fad83685f38052205a922769be8d6e7053
Instruction ID: ea9064e1fdae1ed53f5252353540119a4f5143408c37d8c69be6d3cf60c6560c
Opcode Fuzzy Hash: c675a1992f91d31fbb4acf058d22a0fad83685f38052205a922769be8d6e7053
Instruction Fuzzy Hash: EFF04C303482541FC346673D585056E7FDB9FD611035504EAE149CB396DD259C078391

Function 02BC8F80 Relevance: 1.3, Strings: 1, Instructions: 44COMMON

Download Yara Rule

Strings

LR]q, xrefs: 02BC8F95

Memory Dump Source

Source File: 00000003.00000002.3297899883.0000000002BC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02BC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_2bc0000_zapytanie 2025.jbxd

Similarity

API ID:
String ID: LR]q
API String ID: 0-3081347316
Opcode ID: 8032eb93896537d47c325450f1d26c89de94d288b7a9715cd86771680fe69bbe
Instruction ID: 31a0b58c7fb4535b4b1ccc1e93a73c3c3bb918e836832314e98ade0ef8384b2e
Opcode Fuzzy Hash: 8032eb93896537d47c325450f1d26c89de94d288b7a9715cd86771680fe69bbe
Instruction Fuzzy Hash: 65016D71B001159FDB45EBA898016BE77F6FB88710F2044ADE54AEB290EB70AA01CBD5

Function 02BC2D63 Relevance: .3, Instructions: 297COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3297899883.0000000002BC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02BC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_2bc0000_zapytanie 2025.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 259245f486a4799f13f4f5d5a6c8626d16e014344cdd217f17b0a4279e31b0c9
Instruction ID: 25aaf58cb12e15499345110d186c86551266164951dcaebbc7a1fca6d36790ec
Opcode Fuzzy Hash: 259245f486a4799f13f4f5d5a6c8626d16e014344cdd217f17b0a4279e31b0c9
Instruction Fuzzy Hash: 96C1C571A053918FDB06EF38E464A997F76FF85314F14866EC4018B3AAEB349849CBD1

Function 02BC685F Relevance: .3, Instructions: 258COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3297899883.0000000002BC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02BC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_2bc0000_zapytanie 2025.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c794cf9c3814c61269d3908e616c93e301e03bab1f3bcbdb8f8fd8db55cc6aae
Instruction ID: 7a730c6f1112d2ad37c116540ec6aea087b26184724614f14ebb57e44b0e088b
Opcode Fuzzy Hash: c794cf9c3814c61269d3908e616c93e301e03bab1f3bcbdb8f8fd8db55cc6aae
Instruction Fuzzy Hash: 84A13C70E00209CFDF14DFA8C985BADBBF5EF88714F24816DD819A7254EB749885CB91

Function 02BCA0A8 Relevance: .3, Instructions: 251COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3297899883.0000000002BC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02BC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_2bc0000_zapytanie 2025.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d3d9a7a94aeb982ff05050a65ef9deaa8c24cffbf78769d08a623c1965a7f4d2
Instruction ID: 7d535562b9c4a9bc5c7e5a3c1efa3c701099d637ddf9d6ad56ec581339999654
Opcode Fuzzy Hash: d3d9a7a94aeb982ff05050a65ef9deaa8c24cffbf78769d08a623c1965a7f4d2
Instruction Fuzzy Hash: C8A1A0717002058FCB09EF78E49465D77F6EF88708B2089ADD9069B359EF34AC4ACB81

Function 02BC2E38 Relevance: .2, Instructions: 227COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3297899883.0000000002BC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02BC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_2bc0000_zapytanie 2025.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 51941fd827d6685793ede6c1fc85f892d6a0829390273799886fdad40119d58b
Instruction ID: d57a151331df5e2d5f1714dcaa42c7fad381c5a87d24afa0fee3f9ad4b71bd70
Opcode Fuzzy Hash: 51941fd827d6685793ede6c1fc85f892d6a0829390273799886fdad40119d58b
Instruction Fuzzy Hash: 70A16E75A003419FCB05EF34E448A5E7BB6FF84354B208A6DD5068B359EB35A94ACFC0

Function 02BC36A0 Relevance: .1, Instructions: 121COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3297899883.0000000002BC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02BC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_2bc0000_zapytanie 2025.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 524800c2a4c80739a121988f873bb1d61a3143934436400bf4e71041596533f9
Instruction ID: 98b3b6d5bd42f11f470594bf55a624b616dd3be99076a113360b6abee23b5857
Opcode Fuzzy Hash: 524800c2a4c80739a121988f873bb1d61a3143934436400bf4e71041596533f9
Instruction Fuzzy Hash: 8A419F71B042498FCB14EF79D4946AEBBE6EFC9214F64846ED50A97340DF34A806CB91

Function 02BC96D3 Relevance: .1, Instructions: 120COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3297899883.0000000002BC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02BC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_2bc0000_zapytanie 2025.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 013d07dc8995a9495eaf6e93a23e7d1b9fac752185bc2878e477dfe3398fafd3
Instruction ID: f36672493fedef5be8d7b25483b4839bbd69f924ff003b3e0ab3b4248f0ff650
Opcode Fuzzy Hash: 013d07dc8995a9495eaf6e93a23e7d1b9fac752185bc2878e477dfe3398fafd3
Instruction Fuzzy Hash: F9418C34601505DFDB04EF68C984E6ABBB2FF44315F6184E9E415AB7A2DB31ED01CBA1

Function 02BC0AA0 Relevance: .1, Instructions: 118COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3297899883.0000000002BC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02BC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_2bc0000_zapytanie 2025.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2ac4cfec4b0ee6a6d7e4e6a640968326f223ca973878c2520dcf29ec17394486
Instruction ID: 6bf1a8d040a282573dd753d92e43d880ac26fc586bc8764fd6430f79fbf243ab
Opcode Fuzzy Hash: 2ac4cfec4b0ee6a6d7e4e6a640968326f223ca973878c2520dcf29ec17394486
Instruction Fuzzy Hash: 9651D33A600211CFC71AEF24F5849497B7BFF94386B508669D4428B36DEB35A946EFC0

Function 02BC11D0 Relevance: .1, Instructions: 114COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3297899883.0000000002BC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02BC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_2bc0000_zapytanie 2025.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7785043007754acc94e9471ddf74d5af543c74fffdb6731d766e6e9fa9676b36
Instruction ID: 53a63bcee8b041ba2df6adba96c7f856b357f31a37a35df337ce167795fdab1f
Opcode Fuzzy Hash: 7785043007754acc94e9471ddf74d5af543c74fffdb6731d766e6e9fa9676b36
Instruction Fuzzy Hash: 49415170B00219AFCB44EFBD855466EBBFAFF88300F608569D449D7345DA349D42CB95

Function 02BC40B8 Relevance: .1, Instructions: 90COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3297899883.0000000002BC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02BC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_2bc0000_zapytanie 2025.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e295fbf8c380f21d27fc910626c59581806f9dba7f4f8d74cce943578e6111b7
Instruction ID: 87cf1b09a11eae3b85b1c091f978a4e60011d2e46fc1bc4fd3fece39bdbbb948
Opcode Fuzzy Hash: e295fbf8c380f21d27fc910626c59581806f9dba7f4f8d74cce943578e6111b7
Instruction Fuzzy Hash: 0441EFB0D003499FDB10DF99C594ADEBFF5FF48314F248069E809AB254DB75AA85CB90

Function 02BC40AF Relevance: .1, Instructions: 90COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3297899883.0000000002BC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02BC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_2bc0000_zapytanie 2025.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b8c9ca70bbe0f16c95ea509c0489a80e2957080a47f10874fe82333bae28e2d8
Instruction ID: 5caa22a9e34874748ce4b826e485948fbb4a2a7488d15963ce1e7c7ccc12c51c
Opcode Fuzzy Hash: b8c9ca70bbe0f16c95ea509c0489a80e2957080a47f10874fe82333bae28e2d8
Instruction Fuzzy Hash: D14111B0D00308DFDB10DF99C594ADEBFB5FF08314F248029E809AB250DB759A85CB90

Function 02BC0998 Relevance: .1, Instructions: 77COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3297899883.0000000002BC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02BC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_2bc0000_zapytanie 2025.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 70b9c5e2b201f05c84f75a12dcdf2473198c1bf757c694acc4bf5877270b2b6e
Instruction ID: 91a4592fbe2f42a6f01b1e436b920fc7627c48498e1a2157b90d0d0e43868466
Opcode Fuzzy Hash: 70b9c5e2b201f05c84f75a12dcdf2473198c1bf757c694acc4bf5877270b2b6e
Instruction Fuzzy Hash: 1F215831700207DFDB68BB79D95872E3BA9EF14349B6058ADF467C2184EB30E541CBA2

Function 02BC929B Relevance: .1, Instructions: 71COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3297899883.0000000002BC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02BC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_2bc0000_zapytanie 2025.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 94fc358f66b726ee141da57bcea743dcc45c761901646e57bb8a08d029b8c4c8
Instruction ID: 38106dc02312eda37fa0a89b785d7c6213a3e016fdd54849ce2491f998fb9609
Opcode Fuzzy Hash: 94fc358f66b726ee141da57bcea743dcc45c761901646e57bb8a08d029b8c4c8
Instruction Fuzzy Hash: ED21AF31700615CFDB19AB74C9546AE77B6EF89708F64846CC402EB3A8EF319C42CB91

Function 02BC09A8 Relevance: .1, Instructions: 71COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3297899883.0000000002BC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02BC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_2bc0000_zapytanie 2025.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 784307ad8d263220d2dce31f9594d5150d71437452c73d44d24d99ddadeabc93
Instruction ID: 9be9f9079b66d25e494d612b6beacb232be14f787d9efd58e026ef9d87501531
Opcode Fuzzy Hash: 784307ad8d263220d2dce31f9594d5150d71437452c73d44d24d99ddadeabc93
Instruction Fuzzy Hash: 6C214D31710207DFDB68BB79A51872E7AA9EF14345B2058ADB517C2244EF30E501CBA2

Function 02BCA09B Relevance: .1, Instructions: 59COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3297899883.0000000002BC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02BC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_2bc0000_zapytanie 2025.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e42471f31e47fd6aafdb41a906f8cf7d9c3c2c5f02cc15fbcdbaa5be852b9bd0
Instruction ID: e760c42931c957c4cbe6916b16185be65b7b4264f173692289b83be30ba32812
Opcode Fuzzy Hash: e42471f31e47fd6aafdb41a906f8cf7d9c3c2c5f02cc15fbcdbaa5be852b9bd0
Instruction Fuzzy Hash: 3211E3357001154BCB18AB78D99066D37AB9F88618B10857DCE06D734AFF30EC0A87D2

Function 02BCB450 Relevance: .1, Instructions: 59COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3297899883.0000000002BC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02BC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_2bc0000_zapytanie 2025.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6d7482fc421939ee1295b9838cb79b6c186ed45f1a5b9d5ff71a4ea9ddfefe4f
Instruction ID: 2c04309a5f3655163c3839b9e14d87055a0d1da55c9888d09e3180011013f46d
Opcode Fuzzy Hash: 6d7482fc421939ee1295b9838cb79b6c186ed45f1a5b9d5ff71a4ea9ddfefe4f
Instruction Fuzzy Hash: F311A270A002459FCB05EF78E44059E7BE6AF80314B5046ADC1058B359EB35A90A8FD1

Function 02BC1431 Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3297899883.0000000002BC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02BC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_2bc0000_zapytanie 2025.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c8515c7c3126d537c421f9af47f1e2127da5b87ebc378d77d7bf0e2895b162e9
Instruction ID: 9808d7f816f63d0cd5e164799d063628656407d4f35d433df44dc198082e8472
Opcode Fuzzy Hash: c8515c7c3126d537c421f9af47f1e2127da5b87ebc378d77d7bf0e2895b162e9
Instruction Fuzzy Hash: B211CB71A00249CFCB54EBBCD40866A7BF6AF88304B2408BDD409DB349EA31C842DB91

Function 02BCB460 Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3297899883.0000000002BC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02BC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_2bc0000_zapytanie 2025.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 96a14e91d8f3ffa09dc99f0ab49dae0a731749ae340f4af99c5f66023c379521
Instruction ID: 1c2e058a92d072e8660c8f9dbf6a9c2ce395e3c4446c206590a1f8d68dd94608
Opcode Fuzzy Hash: 96a14e91d8f3ffa09dc99f0ab49dae0a731749ae340f4af99c5f66023c379521
Instruction Fuzzy Hash: B81194706002459FCB05FB78E44069E7BF6EF85318F6046ADC1058B349EB75AA0ACFD5

Function 02BC1440 Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3297899883.0000000002BC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02BC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_2bc0000_zapytanie 2025.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7f8a670c5dfc1ded516ebf29fcc77eba13ed381c8b3451aec174ee0935b72952
Instruction ID: 4736a8cb4d187c0d1ca4a5d78dcad3b690ca71ed9e5d86c8617043af0f5dd510
Opcode Fuzzy Hash: 7f8a670c5dfc1ded516ebf29fcc77eba13ed381c8b3451aec174ee0935b72952
Instruction Fuzzy Hash: B2118B70B00205DFCB54EBBDD40462A7BEAEF8820472408BCD40ADB355EA30DC02CBA0

Function 02BC3691 Relevance: .0, Instructions: 48COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3297899883.0000000002BC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02BC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_2bc0000_zapytanie 2025.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 08016ffd39c3f94f340dcc4a7c159af5429c4b81d9f6ac0d15ee6740ad4c3ac3
Instruction ID: 6499eeafa6f18c9d4923ec189b90829f30b67684106a30982c8337af5c0a8c47
Opcode Fuzzy Hash: 08016ffd39c3f94f340dcc4a7c159af5429c4b81d9f6ac0d15ee6740ad4c3ac3
Instruction Fuzzy Hash: 4D01D4313042408BC719AB38E994B3E76D3AFC9254B54457DD50A8B341CF34CC06CB41

Function 02BC9010 Relevance: .0, Instructions: 41COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3297899883.0000000002BC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02BC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_2bc0000_zapytanie 2025.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5b03f3af3b523b5ffd4a77c9dbc1a7af3a3f0a632a8e94f51cc27ee890226b78
Instruction ID: 63480e2db3d2e7fc828fef444545eb1382c42deb2745ee4ab5ad037939f5e935
Opcode Fuzzy Hash: 5b03f3af3b523b5ffd4a77c9dbc1a7af3a3f0a632a8e94f51cc27ee890226b78
Instruction Fuzzy Hash: 761123B59007498FDB20DF9AC544BDEFBF4FB48324F208459D519A3240C379A944CFA1

Function 02BC9008 Relevance: .0, Instructions: 41COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3297899883.0000000002BC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02BC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_2bc0000_zapytanie 2025.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8030aeb8155250e74362ad391f4a24faded9e9cb30c2800195d22eb728aeba5a
Instruction ID: 415175bd55a1403abf966c753c2bd88c9672fd3af5f069d9a2ef4cb6bbf8fdb9
Opcode Fuzzy Hash: 8030aeb8155250e74362ad391f4a24faded9e9cb30c2800195d22eb728aeba5a
Instruction Fuzzy Hash: FB1100B59006498FDB20DF99C584BEEBBF4EB48324F20844AC519A3250C378A644CFA1

Function 02BC25F1 Relevance: .0, Instructions: 24COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3297899883.0000000002BC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02BC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_2bc0000_zapytanie 2025.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 01e8e6621c28b749e2148bd35d9d9b37320848a4881e319b667eb68097f652f3
Instruction ID: 5af9dc64de2531f334065e1ab8f371e3fb138261cf36e8f5eb6a6ca375d8e587
Opcode Fuzzy Hash: 01e8e6621c28b749e2148bd35d9d9b37320848a4881e319b667eb68097f652f3
Instruction Fuzzy Hash: F3E01A7610E3C08FD303AB7898259117F74EF6B608B0A00D7D990CB2A3D218FD19EB22

Function 02BC0A8F Relevance: .0, Instructions: 9COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3297899883.0000000002BC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02BC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_2bc0000_zapytanie 2025.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bd2ef5b9a6da0ade476a749d03f9f5846cc250a2c338509574a6884ce2f42dae
Instruction ID: e468dc18ebbf6dbecb964f31571712299ea1310c955bb1b27cf87bd5b492ba50
Opcode Fuzzy Hash: bd2ef5b9a6da0ade476a749d03f9f5846cc250a2c338509574a6884ce2f42dae
Instruction Fuzzy Hash: 29C08C20245107CFD33433B4D01CB2C399AAB50302F14089DB023000A98EB43400C31A

Function 02BC0A73 Relevance: .0, Instructions: 9COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3297899883.0000000002BC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02BC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_2bc0000_zapytanie 2025.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e30d4f02304a68532fd7bc0728cfb43edd62bca1a8493ac1e363ec347d739c13
Instruction ID: 1c7f6a043364f4c260fe5c1027a3fd96314dd19d65e7a232fe0bfdcd8bada4b9
Opcode Fuzzy Hash: e30d4f02304a68532fd7bc0728cfb43edd62bca1a8493ac1e363ec347d739c13
Instruction Fuzzy Hash: 09C08C2024514ACFD7343374D01CB2C3A9AAB50302F14089EB023000A98EB43400C71A

Function 02BC2600 Relevance: .0, Instructions: 8COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3297899883.0000000002BC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02BC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_2bc0000_zapytanie 2025.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 901014f1480f8d296acd67e20bb8c53b06b60f307b729293a5c9a267d77856f1
Instruction ID: 003c395cb4ea3ff7aef76c4758e0ff7cf3f3437aa2504bf17678ed0a8d68e6f4
Opcode Fuzzy Hash: 901014f1480f8d296acd67e20bb8c53b06b60f307b729293a5c9a267d77856f1
Instruction Fuzzy Hash: 88C0923A260208CFC344EF99E588C12BBECFF58B003410099E5018B772DB21FC10EBA1

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is an administration feature that provides a uniform environment to access Windows system components. The WMI service enables both local and remote access, though the latter is facilitated by Remote Services such as Distributed Component Object Model (DCOM) and Windows Remote Management (WinRM).Remote WMI over DCOM operates using port 135, whereas WMI over WinRM operates over port 5985 when using HTTP and 5986 for HTTPS.
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Connection Creation, Process: Process Creation, WMI: WMI Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse task scheduling functionality to facilitate initial or recurring execution of malicious code. Utilities exist within all major operating systems to schedule programs or scripts to be executed at a specified date and time. A task can also be scheduled on a remote system, provided the proper authentication is met (ex: RPC and file and printer sharing in Windows environments). Scheduling a task on a remote system typically may require being a member of an admin or otherwise privileged group on the remote system.
Tactics:	Execution, Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, Container: Container Creation, File: File Creation, File: File Modification, Process: Process Creation, Scheduled Job: Scheduled Job Creation
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify file time attributes to hide new or changes to existing files. Timestomping is a technique that modifies the timestamps of a file (the modify, access, create, and change times), often to mimic files that are in the same folder. This is done, for example, on files that have been modified or created by the adversary so that they do not appear conspicuous to forensic investigators or file analysis tools.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata, File: File Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report zapytanie 2025.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: AsyncRAT

Yara Signatures

Memory Dumps

Unpacked PEs

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

System Summary

Data Obfuscation

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\zapytanie 2025.exe.log

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Data Directories

Sections

Resources

Imports

Network Behavior

Suricata IDS Alerts

Network Port Distribution

TCP Packets

Windows Analysis Report
zapytanie 2025.exe

Function 08BBED58 Relevance: 6.8, Strings: 5, Instructions: 591
COMMON

Function 08BB0006 Relevance: 4.6, Instructions: 4580
COMMON

Function 08BB0040 Relevance: 4.6, Instructions: 4562
COMMON

Function 08BB56E8 Relevance: 3.4, Instructions: 3434
COMMON

Function 08BB56D9 Relevance: 3.4, Instructions: 3420
COMMON

Function 06E9B23D Relevance: 1.7, APIs: 1, Instructions: 248
processCOMMON

Function 06E9B248 Relevance: 1.7, APIs: 1, Instructions: 243
processCOMMON

Function 00EEB261 Relevance: 1.7, APIs: 1, Instructions: 204
COMMON

Function 00EE590C Relevance: 1.6, APIs: 1, Instructions: 99
COMMON

Function 00EE4514 Relevance: 1.6, APIs: 1, Instructions: 96
COMMON